@dudousxd/nestjs-agent-authz 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Davide Carvalho
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,40 @@
+# `@dudousxd/nestjs-agent-authz`
+
+> 🪺 Part of the [Aviary](https://davidecarvalho.github.io/aviary) · plugs [`@dudousxd/nestjs-authz`](https://www.npmjs.com/package/@dudousxd/nestjs-authz) into [`@dudousxd/nestjs-agent`](https://www.npmjs.com/package/@dudousxd/nestjs-agent) tool authorization.
+
+By default the agent gates tools by **roles**. This adapter gates them by **abilities** through a
+`@dudousxd/nestjs-authz` `Gate`: a tool's `ability` is checked with `gate.forUser(actor).allows(ability)`.
+Tools without an `ability` fall back to the role-based policy, so apps not using authz are unaffected.
+
+## Install
+
+```bash
+pnpm add @dudousxd/nestjs-agent-authz @dudousxd/nestjs-authz
+```
+
+## Use
+
+```ts
+import { AgentAuthzModule } from '@dudousxd/nestjs-agent-authz';
+
+@Module({
+  imports: [
+    AuthzModule.forRoot(/* … */),    // the app's global Gate
+    AgentModule.forRoot({ model, store, modelId }),
+    AgentAuthzModule.forRoot(),       // binds AGENT_ROLES_POLICY to the Gate-backed policy
+  ],
+})
+export class AppModule {}
+```
+
+```ts
+@AiTool({ name: 'purgeCache', kind: 'action', description: '…', input: z.object({ key: z.string() }),
+          ability: 'cache.purge' })   // ← checked via gate.forUser(actor).allows('cache.purge')
+export class PurgeCacheTool implements ToolHandler<{ key: string }> { /* … */ }
+```
+
+`forRoot({ fallbackRoles })` configures the role policy used when a tool declares no `ability`.
+
+## License
+
+MIT © Davide Carvalho

package/dist/index.cjs

@@ -0,0 +1,102 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AgentAuthzModule: () => AgentAuthzModule,
+  AuthzRolesPolicy: () => AuthzRolesPolicy,
+  userFromActor: () => userFromActor
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/authz-roles-policy.ts
+var import_nestjs_agent_core = require("@dudousxd/nestjs-agent-core");
+function userFromActor(actor) {
+  return {
+    id: actor.id,
+    ...actor.roles !== void 0 ? {
+      roles: actor.roles
+    } : {}
+  };
+}
+__name(userFromActor, "userFromActor");
+var AuthzRolesPolicy = class {
+  static {
+    __name(this, "AuthzRolesPolicy");
+  }
+  gate;
+  options;
+  constructor(gate, options) {
+    this.gate = gate;
+    this.options = options;
+  }
+  async can(actor, tool) {
+    if (tool.ability !== void 0) {
+      return this.gate.forUser(userFromActor(actor)).allows(tool.ability);
+    }
+    return new import_nestjs_agent_core.DefaultRolesPolicy(this.options?.fallbackRoles).can(actor, tool);
+  }
+};
+
+// src/agent-authz.module.ts
+var import_nestjs_agent_core2 = require("@dudousxd/nestjs-agent-core");
+var import_nestjs_authz = require("@dudousxd/nestjs-authz");
+var import_common = require("@nestjs/common");
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+var AgentAuthzModule = class _AgentAuthzModule {
+  static {
+    __name(this, "AgentAuthzModule");
+  }
+  static forRoot(options) {
+    return {
+      module: _AgentAuthzModule,
+      providers: [
+        {
+          provide: import_nestjs_agent_core2.AGENT_ROLES_POLICY,
+          useFactory: /* @__PURE__ */ __name((gate) => new AuthzRolesPolicy(gate, options), "useFactory"),
+          inject: [
+            import_nestjs_authz.Gate
+          ]
+        }
+      ],
+      exports: [
+        import_nestjs_agent_core2.AGENT_ROLES_POLICY
+      ]
+    };
+  }
+};
+AgentAuthzModule = _ts_decorate([
+  (0, import_common.Global)(),
+  (0, import_common.Module)({})
+], AgentAuthzModule);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AgentAuthzModule,
+  AuthzRolesPolicy,
+  userFromActor
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/authz-roles-policy.ts","../src/agent-authz.module.ts"],"sourcesContent":["export {\n  AuthzRolesPolicy,\n  userFromActor,\n  type AuthzRolesPolicyOptions,\n  type AuthzUser,\n} from './authz-roles-policy.js';\nexport { AgentAuthzModule } from './agent-authz.module.js';\n","import {\n  type Actor,\n  DefaultRolesPolicy,\n  type RolesPolicy,\n  type ToolSpec,\n} from '@dudousxd/nestjs-agent-core';\nimport type { Gate } from '@dudousxd/nestjs-authz';\n\n/** Options for {@link AuthzRolesPolicy}. */\nexport interface AuthzRolesPolicyOptions {\n  /**\n   * Roles used by the role-based fallback ({@link DefaultRolesPolicy}) when a tool\n   * declares neither an `ability` nor `roles`. Defaults to ADMIN-only (the\n   * DefaultRolesPolicy default).\n   */\n  fallbackRoles?: string[];\n}\n\n/**\n * The user object handed to `gate.forUser(...)`. The agent {@link Actor} only carries\n * `{ id, roles? }`, which is exactly what authz's default {@link defaultRoleResolver}\n * (and any ad-hoc gate reading `user.roles`) needs to resolve a role-based ability —\n * so no host user entity is required.\n */\nexport interface AuthzUser {\n  id: string;\n  roles?: string[];\n}\n\n/**\n * Map an agent {@link Actor} onto the minimal user shape authz expects. authz's\n * `User` is `unknown`, and its default role resolver reads `user.roles`; passing\n * `{ id, roles }` is enough for a role-based ability to resolve. `roles` is only\n * attached when present (honors `exactOptionalPropertyTypes`).\n */\nexport function userFromActor(actor: Actor): AuthzUser {\n  return { id: actor.id, ...(actor.roles !== undefined ? { roles: actor.roles } : {}) };\n}\n\n/**\n * A {@link RolesPolicy} backed by a `@dudousxd/nestjs-authz` {@link Gate}.\n *\n * - When a tool declares an `ability`, the decision is delegated to the Gate\n *   (`gate.forUser(actor).allows(ability)`), so apps get policies, abilities, and the\n *   RBAC seams for free.\n * - Otherwise it falls back to the role-based {@link DefaultRolesPolicy} (matching the\n *   actor's role against `tool.roles`, defaulting to `fallbackRoles`).\n */\nexport class AuthzRolesPolicy implements RolesPolicy {\n  constructor(\n    private readonly gate: Gate,\n    private readonly options?: AuthzRolesPolicyOptions,\n  ) {}\n\n  async can(actor: Actor, tool: ToolSpec): Promise<boolean> {\n    if (tool.ability !== undefined) {\n      return this.gate.forUser(userFromActor(actor)).allows(tool.ability);\n    }\n    return new DefaultRolesPolicy(this.options?.fallbackRoles).can(actor, tool);\n  }\n}\n","import { AGENT_ROLES_POLICY } from '@dudousxd/nestjs-agent-core';\nimport { Gate } from '@dudousxd/nestjs-authz';\nimport { type DynamicModule, Global, Module } from '@nestjs/common';\nimport { AuthzRolesPolicy, type AuthzRolesPolicyOptions } from './authz-roles-policy.js';\n\n/**\n * Wires an authz-backed {@link AuthzRolesPolicy} as nestjs-agent's `RolesPolicy`,\n * binding it under the shared {@link AGENT_ROLES_POLICY} token so the agent loop's\n * tool gate consults the {@link Gate}.\n *\n * The {@link Gate} is injected from the app's global `AuthzModule` — this module does\n * NOT import `AuthzModule`; the app is expected to register it once at the root.\n */\n@Global()\n@Module({})\nexport class AgentAuthzModule {\n  static forRoot(options?: AuthzRolesPolicyOptions): DynamicModule {\n    return {\n      module: AgentAuthzModule,\n      providers: [\n        {\n          provide: AGENT_ROLES_POLICY,\n          useFactory: (gate: Gate) => new AuthzRolesPolicy(gate, options),\n          inject: [Gate],\n        },\n      ],\n      exports: [AGENT_ROLES_POLICY],\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;ACAA,+BAKO;AA8BA,SAASA,cAAcC,OAAY;AACxC,SAAO;IAAEC,IAAID,MAAMC;IAAI,GAAID,MAAME,UAAUC,SAAY;MAAED,OAAOF,MAAME;IAAM,IAAI,CAAC;EAAG;AACtF;AAFgBH;AAaT,IAAMK,mBAAN,MAAMA;EAhDb,OAgDaA;;;;;EACX,YACmBC,MACAC,SACjB;SAFiBD,OAAAA;SACAC,UAAAA;EAChB;EAEH,MAAMC,IAAIP,OAAcQ,MAAkC;AACxD,QAAIA,KAAKC,YAAYN,QAAW;AAC9B,aAAO,KAAKE,KAAKK,QAAQX,cAAcC,KAAAA,CAAAA,EAAQW,OAAOH,KAAKC,OAAO;IACpE;AACA,WAAO,IAAIG,4CAAmB,KAAKN,SAASO,aAAAA,EAAeN,IAAIP,OAAOQ,IAAAA;EACxE;AACF;;;AC5DA,IAAAM,4BAAmC;AACnC,0BAAqB;AACrB,oBAAmD;;;;;;;;AAa5C,IAAMC,mBAAN,MAAMA,kBAAAA;SAAAA;;;EACX,OAAOC,QAAQC,SAAkD;AAC/D,WAAO;MACLC,QAAQH;MACRI,WAAW;QACT;UACEC,SAASC;UACTC,YAAY,wBAACC,SAAe,IAAIC,iBAAiBD,MAAMN,OAAAA,GAA3C;UACZQ,QAAQ;YAACC;;QACX;;MAEFC,SAAS;QAACN;;IACZ;EACF;AACF;;;;;","names":["userFromActor","actor","id","roles","undefined","AuthzRolesPolicy","gate","options","can","tool","ability","forUser","allows","DefaultRolesPolicy","fallbackRoles","import_nestjs_agent_core","AgentAuthzModule","forRoot","options","module","providers","provide","AGENT_ROLES_POLICY","useFactory","gate","AuthzRolesPolicy","inject","Gate","exports"]}

package/dist/index.d.cts

@@ -0,0 +1,59 @@
+import { RolesPolicy, Actor, ToolSpec } from '@dudousxd/nestjs-agent-core';
+import { Gate } from '@dudousxd/nestjs-authz';
+import { DynamicModule } from '@nestjs/common';
+
+/** Options for {@link AuthzRolesPolicy}. */
+interface AuthzRolesPolicyOptions {
+    /**
+     * Roles used by the role-based fallback ({@link DefaultRolesPolicy}) when a tool
+     * declares neither an `ability` nor `roles`. Defaults to ADMIN-only (the
+     * DefaultRolesPolicy default).
+     */
+    fallbackRoles?: string[];
+}
+/**
+ * The user object handed to `gate.forUser(...)`. The agent {@link Actor} only carries
+ * `{ id, roles? }`, which is exactly what authz's default {@link defaultRoleResolver}
+ * (and any ad-hoc gate reading `user.roles`) needs to resolve a role-based ability —
+ * so no host user entity is required.
+ */
+interface AuthzUser {
+    id: string;
+    roles?: string[];
+}
+/**
+ * Map an agent {@link Actor} onto the minimal user shape authz expects. authz's
+ * `User` is `unknown`, and its default role resolver reads `user.roles`; passing
+ * `{ id, roles }` is enough for a role-based ability to resolve. `roles` is only
+ * attached when present (honors `exactOptionalPropertyTypes`).
+ */
+declare function userFromActor(actor: Actor): AuthzUser;
+/**
+ * A {@link RolesPolicy} backed by a `@dudousxd/nestjs-authz` {@link Gate}.
+ *
+ * - When a tool declares an `ability`, the decision is delegated to the Gate
+ *   (`gate.forUser(actor).allows(ability)`), so apps get policies, abilities, and the
+ *   RBAC seams for free.
+ * - Otherwise it falls back to the role-based {@link DefaultRolesPolicy} (matching the
+ *   actor's role against `tool.roles`, defaulting to `fallbackRoles`).
+ */
+declare class AuthzRolesPolicy implements RolesPolicy {
+    private readonly gate;
+    private readonly options?;
+    constructor(gate: Gate, options?: AuthzRolesPolicyOptions | undefined);
+    can(actor: Actor, tool: ToolSpec): Promise<boolean>;
+}
+
+/**
+ * Wires an authz-backed {@link AuthzRolesPolicy} as nestjs-agent's `RolesPolicy`,
+ * binding it under the shared {@link AGENT_ROLES_POLICY} token so the agent loop's
+ * tool gate consults the {@link Gate}.
+ *
+ * The {@link Gate} is injected from the app's global `AuthzModule` — this module does
+ * NOT import `AuthzModule`; the app is expected to register it once at the root.
+ */
+declare class AgentAuthzModule {
+    static forRoot(options?: AuthzRolesPolicyOptions): DynamicModule;
+}
+
+export { AgentAuthzModule, AuthzRolesPolicy, type AuthzRolesPolicyOptions, type AuthzUser, userFromActor };

package/dist/index.d.ts

@@ -0,0 +1,59 @@
+import { RolesPolicy, Actor, ToolSpec } from '@dudousxd/nestjs-agent-core';
+import { Gate } from '@dudousxd/nestjs-authz';
+import { DynamicModule } from '@nestjs/common';
+
+/** Options for {@link AuthzRolesPolicy}. */
+interface AuthzRolesPolicyOptions {
+    /**
+     * Roles used by the role-based fallback ({@link DefaultRolesPolicy}) when a tool
+     * declares neither an `ability` nor `roles`. Defaults to ADMIN-only (the
+     * DefaultRolesPolicy default).
+     */
+    fallbackRoles?: string[];
+}
+/**
+ * The user object handed to `gate.forUser(...)`. The agent {@link Actor} only carries
+ * `{ id, roles? }`, which is exactly what authz's default {@link defaultRoleResolver}
+ * (and any ad-hoc gate reading `user.roles`) needs to resolve a role-based ability —
+ * so no host user entity is required.
+ */
+interface AuthzUser {
+    id: string;
+    roles?: string[];
+}
+/**
+ * Map an agent {@link Actor} onto the minimal user shape authz expects. authz's
+ * `User` is `unknown`, and its default role resolver reads `user.roles`; passing
+ * `{ id, roles }` is enough for a role-based ability to resolve. `roles` is only
+ * attached when present (honors `exactOptionalPropertyTypes`).
+ */
+declare function userFromActor(actor: Actor): AuthzUser;
+/**
+ * A {@link RolesPolicy} backed by a `@dudousxd/nestjs-authz` {@link Gate}.
+ *
+ * - When a tool declares an `ability`, the decision is delegated to the Gate
+ *   (`gate.forUser(actor).allows(ability)`), so apps get policies, abilities, and the
+ *   RBAC seams for free.
+ * - Otherwise it falls back to the role-based {@link DefaultRolesPolicy} (matching the
+ *   actor's role against `tool.roles`, defaulting to `fallbackRoles`).
+ */
+declare class AuthzRolesPolicy implements RolesPolicy {
+    private readonly gate;
+    private readonly options?;
+    constructor(gate: Gate, options?: AuthzRolesPolicyOptions | undefined);
+    can(actor: Actor, tool: ToolSpec): Promise<boolean>;
+}
+
+/**
+ * Wires an authz-backed {@link AuthzRolesPolicy} as nestjs-agent's `RolesPolicy`,
+ * binding it under the shared {@link AGENT_ROLES_POLICY} token so the agent loop's
+ * tool gate consults the {@link Gate}.
+ *
+ * The {@link Gate} is injected from the app's global `AuthzModule` — this module does
+ * NOT import `AuthzModule`; the app is expected to register it once at the root.
+ */
+declare class AgentAuthzModule {
+    static forRoot(options?: AuthzRolesPolicyOptions): DynamicModule;
+}
+
+export { AgentAuthzModule, AuthzRolesPolicy, type AuthzRolesPolicyOptions, type AuthzUser, userFromActor };

package/dist/index.js

@@ -0,0 +1,75 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/authz-roles-policy.ts
+import { DefaultRolesPolicy } from "@dudousxd/nestjs-agent-core";
+function userFromActor(actor) {
+  return {
+    id: actor.id,
+    ...actor.roles !== void 0 ? {
+      roles: actor.roles
+    } : {}
+  };
+}
+__name(userFromActor, "userFromActor");
+var AuthzRolesPolicy = class {
+  static {
+    __name(this, "AuthzRolesPolicy");
+  }
+  gate;
+  options;
+  constructor(gate, options) {
+    this.gate = gate;
+    this.options = options;
+  }
+  async can(actor, tool) {
+    if (tool.ability !== void 0) {
+      return this.gate.forUser(userFromActor(actor)).allows(tool.ability);
+    }
+    return new DefaultRolesPolicy(this.options?.fallbackRoles).can(actor, tool);
+  }
+};
+
+// src/agent-authz.module.ts
+import { AGENT_ROLES_POLICY } from "@dudousxd/nestjs-agent-core";
+import { Gate } from "@dudousxd/nestjs-authz";
+import { Global, Module } from "@nestjs/common";
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+var AgentAuthzModule = class _AgentAuthzModule {
+  static {
+    __name(this, "AgentAuthzModule");
+  }
+  static forRoot(options) {
+    return {
+      module: _AgentAuthzModule,
+      providers: [
+        {
+          provide: AGENT_ROLES_POLICY,
+          useFactory: /* @__PURE__ */ __name((gate) => new AuthzRolesPolicy(gate, options), "useFactory"),
+          inject: [
+            Gate
+          ]
+        }
+      ],
+      exports: [
+        AGENT_ROLES_POLICY
+      ]
+    };
+  }
+};
+AgentAuthzModule = _ts_decorate([
+  Global(),
+  Module({})
+], AgentAuthzModule);
+export {
+  AgentAuthzModule,
+  AuthzRolesPolicy,
+  userFromActor
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/authz-roles-policy.ts","../src/agent-authz.module.ts"],"sourcesContent":["import {\n  type Actor,\n  DefaultRolesPolicy,\n  type RolesPolicy,\n  type ToolSpec,\n} from '@dudousxd/nestjs-agent-core';\nimport type { Gate } from '@dudousxd/nestjs-authz';\n\n/** Options for {@link AuthzRolesPolicy}. */\nexport interface AuthzRolesPolicyOptions {\n  /**\n   * Roles used by the role-based fallback ({@link DefaultRolesPolicy}) when a tool\n   * declares neither an `ability` nor `roles`. Defaults to ADMIN-only (the\n   * DefaultRolesPolicy default).\n   */\n  fallbackRoles?: string[];\n}\n\n/**\n * The user object handed to `gate.forUser(...)`. The agent {@link Actor} only carries\n * `{ id, roles? }`, which is exactly what authz's default {@link defaultRoleResolver}\n * (and any ad-hoc gate reading `user.roles`) needs to resolve a role-based ability —\n * so no host user entity is required.\n */\nexport interface AuthzUser {\n  id: string;\n  roles?: string[];\n}\n\n/**\n * Map an agent {@link Actor} onto the minimal user shape authz expects. authz's\n * `User` is `unknown`, and its default role resolver reads `user.roles`; passing\n * `{ id, roles }` is enough for a role-based ability to resolve. `roles` is only\n * attached when present (honors `exactOptionalPropertyTypes`).\n */\nexport function userFromActor(actor: Actor): AuthzUser {\n  return { id: actor.id, ...(actor.roles !== undefined ? { roles: actor.roles } : {}) };\n}\n\n/**\n * A {@link RolesPolicy} backed by a `@dudousxd/nestjs-authz` {@link Gate}.\n *\n * - When a tool declares an `ability`, the decision is delegated to the Gate\n *   (`gate.forUser(actor).allows(ability)`), so apps get policies, abilities, and the\n *   RBAC seams for free.\n * - Otherwise it falls back to the role-based {@link DefaultRolesPolicy} (matching the\n *   actor's role against `tool.roles`, defaulting to `fallbackRoles`).\n */\nexport class AuthzRolesPolicy implements RolesPolicy {\n  constructor(\n    private readonly gate: Gate,\n    private readonly options?: AuthzRolesPolicyOptions,\n  ) {}\n\n  async can(actor: Actor, tool: ToolSpec): Promise<boolean> {\n    if (tool.ability !== undefined) {\n      return this.gate.forUser(userFromActor(actor)).allows(tool.ability);\n    }\n    return new DefaultRolesPolicy(this.options?.fallbackRoles).can(actor, tool);\n  }\n}\n","import { AGENT_ROLES_POLICY } from '@dudousxd/nestjs-agent-core';\nimport { Gate } from '@dudousxd/nestjs-authz';\nimport { type DynamicModule, Global, Module } from '@nestjs/common';\nimport { AuthzRolesPolicy, type AuthzRolesPolicyOptions } from './authz-roles-policy.js';\n\n/**\n * Wires an authz-backed {@link AuthzRolesPolicy} as nestjs-agent's `RolesPolicy`,\n * binding it under the shared {@link AGENT_ROLES_POLICY} token so the agent loop's\n * tool gate consults the {@link Gate}.\n *\n * The {@link Gate} is injected from the app's global `AuthzModule` — this module does\n * NOT import `AuthzModule`; the app is expected to register it once at the root.\n */\n@Global()\n@Module({})\nexport class AgentAuthzModule {\n  static forRoot(options?: AuthzRolesPolicyOptions): DynamicModule {\n    return {\n      module: AgentAuthzModule,\n      providers: [\n        {\n          provide: AGENT_ROLES_POLICY,\n          useFactory: (gate: Gate) => new AuthzRolesPolicy(gate, options),\n          inject: [Gate],\n        },\n      ],\n      exports: [AGENT_ROLES_POLICY],\n    };\n  }\n}\n"],"mappings":";;;;AAAA,SAEEA,0BAGK;AA8BA,SAASC,cAAcC,OAAY;AACxC,SAAO;IAAEC,IAAID,MAAMC;IAAI,GAAID,MAAME,UAAUC,SAAY;MAAED,OAAOF,MAAME;IAAM,IAAI,CAAC;EAAG;AACtF;AAFgBH;AAaT,IAAMK,mBAAN,MAAMA;EAhDb,OAgDaA;;;;;EACX,YACmBC,MACAC,SACjB;SAFiBD,OAAAA;SACAC,UAAAA;EAChB;EAEH,MAAMC,IAAIP,OAAcQ,MAAkC;AACxD,QAAIA,KAAKC,YAAYN,QAAW;AAC9B,aAAO,KAAKE,KAAKK,QAAQX,cAAcC,KAAAA,CAAAA,EAAQW,OAAOH,KAAKC,OAAO;IACpE;AACA,WAAO,IAAIG,mBAAmB,KAAKN,SAASO,aAAAA,EAAeN,IAAIP,OAAOQ,IAAAA;EACxE;AACF;;;AC5DA,SAASM,0BAA0B;AACnC,SAASC,YAAY;AACrB,SAA6BC,QAAQC,cAAc;;;;;;;;AAa5C,IAAMC,mBAAN,MAAMA,kBAAAA;SAAAA;;;EACX,OAAOC,QAAQC,SAAkD;AAC/D,WAAO;MACLC,QAAQH;MACRI,WAAW;QACT;UACEC,SAASC;UACTC,YAAY,wBAACC,SAAe,IAAIC,iBAAiBD,MAAMN,OAAAA,GAA3C;UACZQ,QAAQ;YAACC;;QACX;;MAEFC,SAAS;QAACN;;IACZ;EACF;AACF;;;;;","names":["DefaultRolesPolicy","userFromActor","actor","id","roles","undefined","AuthzRolesPolicy","gate","options","can","tool","ability","forUser","allows","DefaultRolesPolicy","fallbackRoles","AGENT_ROLES_POLICY","Gate","Global","Module","AgentAuthzModule","forRoot","options","module","providers","provide","AGENT_ROLES_POLICY","useFactory","gate","AuthzRolesPolicy","inject","Gate","exports"]}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@dudousxd/nestjs-agent-authz",
+  "version": "0.1.0",
+  "description": "nestjs-agent authz adapter — plug @dudousxd/nestjs-authz into tool authorization",
+  "license": "MIT",
+  "author": "Davide Carvalho",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@dudousxd/nestjs-agent-core": "0.1.0"
+  },
+  "peerDependencies": {
+    "@dudousxd/nestjs-authz": "~0.6.3",
+    "@nestjs/common": "^10.0.0 || ^11.0.0"
+  },
+  "devDependencies": {
+    "@dudousxd/nestjs-authz": "0.6.3",
+    "@nestjs/common": "11.1.6",
+    "reflect-metadata": "0.2.2",
+    "tsup": "8.3.5",
+    "typescript": "5.9.3",
+    "zod": "3.25.76",
+    "@dudousxd/nestjs-agent-core": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}