@jantstack/adonis-authz 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jose Tenorio
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,138 @@
+# @jantstack/adonis-authz
+
+Driver-based **authorization engine for AdonisJS 7 + Lucid**: hierarchical scopes with downward-only inheritance, explicit denies that always win, expiring assignments and polymorphic holders — behind a single contract, so the backend is a config choice, not an architectural commitment.
+
+Ships two drivers that pass **the same executable contract suite**:
+
+- **`database`** (default) — self-contained, engine-agnostic SQL over its own `authz_*` tables. Zero extra infrastructure.
+- **`openfga`** — facts live in an [OpenFGA](https://openfga.dev) server (Zanzibar model); the catalog and your scope hierarchy stay local, so switching drivers is a facts migration, not a rewrite.
+
+```ts
+import authorization from '@jantstack/adonis-authz/services/main'
+import { APP_SCOPE } from '@jantstack/adonis-authz'
+
+await authorization.grant({ type: 'users', uuid }, 'support', APP_SCOPE, {
+  expiresAt: new Date(Date.now() + 30 * 86_400_000),
+})
+
+await authorization.authorize({ type: 'users', uuid }, 'audit:read', APP_SCOPE) // → boolean
+```
+
+## Install
+
+```bash
+npm i @jantstack/adonis-authz
+node ace configure @jantstack/adonis-authz
+node ace migration:run
+```
+
+`configure` registers the provider, the commands and the `appAccess` middleware, defines the env variables, and **publishes into your project** what belongs to you: the migration for the `authz_*` tables and two config files (`config/authorization.ts` for drivers, `config/app_acl.ts` for your role catalog).
+
+For the OpenFGA driver, also install its SDK (optional peer): `npm i @openfga/sdk`.
+
+## Semantics (what every driver guarantees)
+
+1. **Hierarchical scopes, inheritance only downward.** A grant on a scope authorizes on that scope and all its descendants — never on siblings or ancestors. The engine only reserves the root (`app`); every other level is yours, declared by the `resolveAncestors` resolver you inject.
+2. **Explicit deny wins.** A deny anywhere in the scope chain blocks the permission even if a role grants it. Removing the deny restores it.
+3. **Expiry is observable.** An assignment past its `expiresAt` grants nothing — enforced in SQL by the `database` driver and by an FGA *condition* in `openfga`, so no scheduler is needed.
+4. **Polymorphic holders.** Users, admins, API integrations — any model with a morph name. Two holders with the same uuid and different type never cross.
+5. **Deny by default.** Unknown permission, role without it, or no valid assignment → `false`. `authorize()` never throws.
+6. **Idempotent writes.** Re-granting doesn't duplicate (it refreshes the expiry); re-revoking is a safe no-op.
+
+These aren't prose promises: they're `tests/…` cases in the contract suite below.
+
+## Your domain stays yours
+
+Nothing about your model is hardcoded. Three seams:
+
+```ts
+// config/authorization.ts (published by configure)
+export default defineConfig({
+  default: env.get('AUTHZ_DRIVER', 'database'),
+
+  // 1. Your guards → FGA types (only the openfga driver uses this)
+  holderTypes: { users: 'user', admins: 'admin', integrations: 'integration' },
+
+  drivers: {
+    // 2. Your scope tree: organization → unit, project → site, whatever
+    database: () => new DatabaseAuthorizationDriver({ resolveAncestors }),
+  },
+
+  // 3. Your side-effects on every write (audit, events, notifications)
+  hooks: { onWrite: (event) => audit(event) },
+})
+```
+
+`ScopeType` is an open `string`, so define your own union for type safety and let `resolveAncestors` describe the tree. The engine never queries your tables.
+
+## Enforcing in routes
+
+```ts
+router
+  .get('/admin/audit-log', [AuditLogsController, 'index'])
+  .use(middleware.appAccess({ permission: 'audit:read' }))
+```
+
+The middleware resolves the authenticated holder from its morph name and asks the engine. Identity decides *what you may do*; if you also issue scoped API tokens, that's an orthogonal check — the token narrows, it never widens.
+
+## The catalog
+
+Roles and permissions are config-driven and synced idempotently:
+
+```ts
+// config/app_acl.ts
+permissions: [{ slug: 'audit:read' }, { slug: 'admin:manage' }],
+roles: [{ slug: 'superadmin', rank: 100, permissions: '*' }],
+```
+
+```ts
+import { syncAuthzCatalog } from '@jantstack/adonis-authz'
+await syncAuthzCatalog(appAclCatalog())   // additive, safe to re-run
+```
+
+`rank` is metadata for *your* assignment policy ("nobody grants a role at or above their own rank"). The engine stores it; enforcing a privilege ceiling is a decision only your domain can make — the engine is mechanism, not policy.
+
+## Custom drivers, judged by the same suite
+
+Implement `AuthorizationDriver`, register its factory, and prove it:
+
+```ts
+import { runAuthorizationDriverContract } from '@jantstack/adonis-authz/testing'
+
+runAuthorizationDriverContract({
+  name: 'my-driver',
+  makeDriver: () => new MyDriver(),
+  seedCatalog: (catalog) => syncAuthzCatalog(catalog),
+  cleanup: () => wipeEverything(),
+})
+```
+
+A driver that passes honors the semantics above, so call-sites never change when you swap backends.
+
+## OpenFGA tooling
+
+```bash
+node ace openfga:provision            # creates a store + writes the model from your holderTypes
+node ace openfga:import --dry-run     # copies assignments/denies from the database driver
+node ace openfga:import
+```
+
+The import **copies**, it doesn't move: your `authz_*` tables stay intact, so rolling back is setting `AUTHZ_DRIVER=database` again.
+
+## Compatibility
+
+| | |
+|---|---|
+| Node | ≥ 20.6 |
+| AdonisJS | ^7 (peer) · Lucid ^22 (peer) |
+| OpenFGA SDK | ^0.9 (optional peer, only for that driver) |
+| Databases | PostgreSQL, MySQL, SQLite |
+| Module format | ESM only |
+
+## Scope and maintenance
+
+Extracted from the [adonis7-base](https://github.com/JantStack/adonis7-base) chassis, where it runs in production-shaped projects. Maintained according to that chassis's needs.
+
+## License
+
+MIT

package/build/commands/main.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Comandos ace del paquete. Se registran con:
+ *   node ace configure @jantstack/adonis-authz
+ */
+export { default as OpenFgaProvision } from './openfga_provision.js';
+export { default as OpenFgaImport } from './openfga_import.js';
+//# sourceMappingURL=main.d.ts.map

package/build/commands/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../commands/main.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAA"}

package/build/commands/main.js

@@ -0,0 +1,7 @@
+/**
+ * Comandos ace del paquete. Se registran con:
+ *   node ace configure @jantstack/adonis-authz
+ */
+export { default as OpenFgaProvision } from './openfga_provision.js';
+export { default as OpenFgaImport } from './openfga_import.js';
+//# sourceMappingURL=main.js.map

package/build/commands/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../commands/main.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAA"}

package/build/commands/openfga_import.d.ts

@@ -0,0 +1,28 @@
+import { BaseCommand } from '@adonisjs/core/ace';
+import { CommandOptions } from '@adonisjs/core/types/ace';
+/**
+ * Migra los HECHOS del driver `database` a un store OpenFGA: copia las
+ * asignaciones vigentes (authz_assignments) y los denies (authz_denies)
+ * como tuples. El catálogo y la jerarquía no migran: son metadata local
+ * para ambos drivers.
+ *
+ * Proceso completo database → openfga:
+ *   1. Levantar el servidor (profile openfga del compose).
+ *   2. node ace openfga:provision            → store + model (ids al .env)
+ *   3. node ace openfga:import [--dry-run]   → copia los hechos
+ *   4. AUTHZ_DRIVER=openfga + reiniciar api/worker.
+ *
+ * Idempotente (re-ejecutar no duplica) y no destructivo (las tablas
+ * locales quedan intactas → rollback = volver a AUTHZ_DRIVER=database).
+ */
+export default class OpenFgaImport extends BaseCommand {
+    static commandName: string;
+    static description: string;
+    static options: CommandOptions;
+    url: string | undefined;
+    storeId: string | undefined;
+    modelId: string | undefined;
+    dryRun: boolean | undefined;
+    run(): Promise<void>;
+}
+//# sourceMappingURL=openfga_import.d.ts.map

package/build/commands/openfga_import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openfga_import.d.ts","sourceRoot":"","sources":["../../commands/openfga_import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IACpD,MAAM,CAAC,WAAW,SAAmB;IACrC,MAAM,CAAC,WAAW,SAAgF;IAElG,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAGO,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAGvB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,MAAM,EAAE,OAAO,GAAG,SAAS,CAAA;IAE7B,GAAG;CA+BV"}

package/build/commands/openfga_import.js

@@ -0,0 +1,74 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { BaseCommand, flags } from '@adonisjs/core/ace';
+/**
+ * Migra los HECHOS del driver `database` a un store OpenFGA: copia las
+ * asignaciones vigentes (authz_assignments) y los denies (authz_denies)
+ * como tuples. El catálogo y la jerarquía no migran: son metadata local
+ * para ambos drivers.
+ *
+ * Proceso completo database → openfga:
+ *   1. Levantar el servidor (profile openfga del compose).
+ *   2. node ace openfga:provision            → store + model (ids al .env)
+ *   3. node ace openfga:import [--dry-run]   → copia los hechos
+ *   4. AUTHZ_DRIVER=openfga + reiniciar api/worker.
+ *
+ * Idempotente (re-ejecutar no duplica) y no destructivo (las tablas
+ * locales quedan intactas → rollback = volver a AUTHZ_DRIVER=database).
+ */
+export default class OpenFgaImport extends BaseCommand {
+    static commandName = 'openfga:import';
+    static description = 'Copy authz facts (assignments/denies) from the database driver into OpenFGA';
+    static options = {
+        startApp: true,
+    };
+    async run() {
+        const config = this.app.config.get('authorization');
+        const apiUrl = this.url ?? config?.openfga?.url;
+        const storeId = this.storeId ?? config?.openfga?.storeId;
+        if (!apiUrl || !storeId) {
+            this.logger.error('Faltan la URL o el store: --url/--store-id o OPENFGA_URL/OPENFGA_STORE_ID (ver openfga:provision)');
+            this.exitCode = 1;
+            return;
+        }
+        const { importAuthzFactsToOpenFga } = await import('../src/drivers/openfga_driver.js');
+        const holderTypes = config?.holderTypes ?? {};
+        const result = await importAuthzFactsToOpenFga({
+            apiUrl,
+            storeId,
+            modelId: this.modelId ?? config?.openfga?.modelId,
+            dryRun: this.dryRun ?? false,
+            holderTypes,
+        });
+        const verb = result.dryRun ? 'Se escribirían' : 'Escritos';
+        this.logger.success(`${verb} ${result.assignments} assignments y ${result.denies} denies ` +
+            `(${result.skippedExpired} asignaciones ya expiradas omitidas).`);
+        if (!result.dryRun) {
+            this.logger.log('Siguiente paso: AUTHZ_DRIVER=openfga y reiniciar api/worker.');
+        }
+    }
+}
+__decorate([
+    flags.string({ description: 'OpenFGA API URL (defaults to OPENFGA_URL)' }),
+    __metadata("design:type", Object)
+], OpenFgaImport.prototype, "url", void 0);
+__decorate([
+    flags.string({ alias: 's', description: 'Store id (defaults to OPENFGA_STORE_ID)' }),
+    __metadata("design:type", Object)
+], OpenFgaImport.prototype, "storeId", void 0);
+__decorate([
+    flags.string({ description: 'Model id (defaults to OPENFGA_MODEL_ID)' }),
+    __metadata("design:type", Object)
+], OpenFgaImport.prototype, "modelId", void 0);
+__decorate([
+    flags.boolean({ description: 'Count what would be written, without writing' }),
+    __metadata("design:type", Object)
+], OpenFgaImport.prototype, "dryRun", void 0);
+//# sourceMappingURL=openfga_import.js.map

package/build/commands/openfga_import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openfga_import.js","sourceRoot":"","sources":["../../commands/openfga_import.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAGvD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IACpD,MAAM,CAAC,WAAW,GAAG,gBAAgB,CAAA;IACrC,MAAM,CAAC,WAAW,GAAG,6EAA6E,CAAA;IAElG,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,IAAI;KACf,CAAA;IAcD,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,OAAO,EAAE,GAAG,CAAA;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,OAAO,EAAE,OAAO,CAAA;QACxD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,mGAAmG,CACpG,CAAA;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAA;QACtF,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAA;QAC7C,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;YAC7C,MAAM;YACN,OAAO;YACP,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,OAAO,EAAE,OAAO;YACjD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,WAAW;SACZ,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAA;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,CACjB,GAAG,IAAI,IAAI,MAAM,CAAC,WAAW,kBAAkB,MAAM,CAAC,MAAM,UAAU;YACpE,IAAI,MAAM,CAAC,cAAc,uCAAuC,CACnE,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;;AAzCO;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;0CAC5C;AAGvB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;8CAClD;AAG3B;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;8CACtC;AAG3B;IADP,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;;6CAC5C"}

package/build/commands/openfga_provision.d.ts

@@ -0,0 +1,27 @@
+import { BaseCommand } from '@adonisjs/core/ace';
+import { CommandOptions } from '@adonisjs/core/types/ace';
+/**
+ * Provisiona OpenFGA para el driver `openfga` del motor de autorización:
+ * crea un store y escribe el authorization model del chasis. Imprime los
+ * ids para el .env (OPENFGA_STORE_ID / OPENFGA_MODEL_ID).
+ *
+ * Idempotencia: cada ejecución crea un store NUEVO (los stores son baratos y
+ * aislados); re-ejecutar sobre un store existente no es necesario salvo que
+ * cambie el modelo — en ese caso usar --store-id para escribir un model nuevo
+ * versionado sobre el mismo store.
+ *
+ * @example
+ *   node ace openfga:provision                      # usa OPENFGA_URL del .env
+ *   node ace openfga:provision --url http://openfga:8080
+ *   node ace openfga:provision --store-id 01H...    # nuevo model en store existente
+ */
+export default class OpenFgaProvision extends BaseCommand {
+    static commandName: string;
+    static description: string;
+    static options: CommandOptions;
+    url: string | undefined;
+    storeId: string | undefined;
+    name: string | undefined;
+    run(): Promise<void>;
+}
+//# sourceMappingURL=openfga_provision.d.ts.map

package/build/commands/openfga_provision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openfga_provision.d.ts","sourceRoot":"","sources":["../../commands/openfga_provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,SAAsB;IACxC,MAAM,CAAC,WAAW,SAAoE;IAEtF,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAGO,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAGvB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IAE1B,GAAG;CAqCV"}

package/build/commands/openfga_provision.js

@@ -0,0 +1,73 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { BaseCommand, flags } from '@adonisjs/core/ace';
+/**
+ * Provisiona OpenFGA para el driver `openfga` del motor de autorización:
+ * crea un store y escribe el authorization model del chasis. Imprime los
+ * ids para el .env (OPENFGA_STORE_ID / OPENFGA_MODEL_ID).
+ *
+ * Idempotencia: cada ejecución crea un store NUEVO (los stores son baratos y
+ * aislados); re-ejecutar sobre un store existente no es necesario salvo que
+ * cambie el modelo — en ese caso usar --store-id para escribir un model nuevo
+ * versionado sobre el mismo store.
+ *
+ * @example
+ *   node ace openfga:provision                      # usa OPENFGA_URL del .env
+ *   node ace openfga:provision --url http://openfga:8080
+ *   node ace openfga:provision --store-id 01H...    # nuevo model en store existente
+ */
+export default class OpenFgaProvision extends BaseCommand {
+    static commandName = 'openfga:provision';
+    static description = 'Create an OpenFGA store + write the chassis authorization model';
+    static options = {
+        startApp: false,
+    };
+    async run() {
+        const config = this.app.config.get('authorization');
+        const apiUrl = this.url ?? config?.openfga?.url;
+        if (!apiUrl) {
+            this.logger.error('Falta la URL del servidor: --url o `openfga.url` en config/authorization.ts');
+            this.exitCode = 1;
+            return;
+        }
+        const { OpenFgaClient } = await import('@openfga/sdk');
+        const { openFgaAuthorizationModel, provisionOpenFgaStore } = await import('../src/drivers/openfga_driver.js');
+        // Los holders del consumidor viven en SU config, no en el paquete.
+        const holderTypes = config?.holderTypes ?? {};
+        if (this.storeId) {
+            const client = new OpenFgaClient({ apiUrl, storeId: this.storeId });
+            const model = await client.writeAuthorizationModel(openFgaAuthorizationModel(holderTypes));
+            this.logger.success('Nuevo authorization model escrito en el store existente.');
+            this.logger.log(`OPENFGA_STORE_ID=${this.storeId}`);
+            this.logger.log(`OPENFGA_MODEL_ID=${model.authorization_model_id}`);
+            return;
+        }
+        // El paquete no lee env: el default APP_NAME se resuelve aquí (chasis).
+        const { storeId, modelId } = await provisionOpenFgaStore(apiUrl, this.name ?? config?.openfga?.storeName ?? this.app.appName, holderTypes);
+        this.logger.success('Store + authorization model provisionados.');
+        this.logger.log('Añade al .env (junto a AUTHZ_DRIVER=openfga):');
+        this.logger.log(`OPENFGA_URL=${apiUrl}`);
+        this.logger.log(`OPENFGA_STORE_ID=${storeId}`);
+        this.logger.log(`OPENFGA_MODEL_ID=${modelId}`);
+    }
+}
+__decorate([
+    flags.string({ description: 'OpenFGA API URL (defaults to OPENFGA_URL)' }),
+    __metadata("design:type", Object)
+], OpenFgaProvision.prototype, "url", void 0);
+__decorate([
+    flags.string({ alias: 's', description: 'Write a new model into an EXISTING store' }),
+    __metadata("design:type", Object)
+], OpenFgaProvision.prototype, "storeId", void 0);
+__decorate([
+    flags.string({ description: 'Store name when creating one (default: APP_NAME del entorno)' }),
+    __metadata("design:type", Object)
+], OpenFgaProvision.prototype, "name", void 0);
+//# sourceMappingURL=openfga_provision.js.map

package/build/commands/openfga_provision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openfga_provision.js","sourceRoot":"","sources":["../../commands/openfga_provision.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAGvD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,GAAG,mBAAmB,CAAA;IACxC,MAAM,CAAC,WAAW,GAAG,iEAAiE,CAAA;IAEtF,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,KAAK;KAChB,CAAA;IAWD,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,OAAO,EAAE,GAAG,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAA;YAChG,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAA;QACtD,MAAM,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CACvE,kCAAkC,CACnC,CAAA;QACD,mEAAmE;QACnE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAA;QAE7C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACnE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAA;YAC1F,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAA;YAC/E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QAED,wEAAwE;QACxE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CACtD,MAAM,EACN,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAC3D,WAAW,CACZ,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAA;QACjE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAA;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;;AA5CO;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;6CAC5C;AAGvB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;;iDACnD;AAG3B;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;;8CAC9D"}

package/build/configure.d.ts

@@ -0,0 +1,10 @@
+import type Configure from '@adonisjs/core/commands/configure';
+/**
+ * `node ace configure @jantstack/adonis-authz`
+ *
+ * Registra el provider, los comandos y el middleware, define las variables
+ * de entorno y PUBLICA en el proyecto lo que es suyo: la migración de las
+ * tablas `authz_*` y los dos configs (drivers + catálogo del nivel app).
+ */
+export declare function configure(command: Configure): Promise<void>;
+//# sourceMappingURL=configure.d.ts.map

package/build/configure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../configure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,mCAAmC,CAAA;AAG9D;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,SAAS,iBAuCjD"}

package/build/configure.js

@@ -0,0 +1,43 @@
+import { stubsRoot } from './stubs/main.js';
+/**
+ * `node ace configure @jantstack/adonis-authz`
+ *
+ * Registra el provider, los comandos y el middleware, define las variables
+ * de entorno y PUBLICA en el proyecto lo que es suyo: la migración de las
+ * tablas `authz_*` y los dos configs (drivers + catálogo del nivel app).
+ */
+export async function configure(command) {
+    const codemods = await command.createCodemods();
+    await codemods.updateRcFile((rcFile) => {
+        rcFile
+            .addProvider('@jantstack/adonis-authz/authz_provider')
+            .addCommand('@jantstack/adonis-authz/commands');
+    });
+    await codemods.registerMiddleware('named', [
+        {
+            name: 'appAccess',
+            path: '@jantstack/adonis-authz/app_access_middleware',
+        },
+    ]);
+    await codemods.defineEnvVariables({ AUTHZ_DRIVER: 'database' });
+    await codemods.defineEnvValidations({
+        variables: {
+            AUTHZ_DRIVER: `Env.schema.string.optional()`,
+            OPENFGA_URL: `Env.schema.string.optional({ format: 'url', tld: false })`,
+            OPENFGA_STORE_ID: `Env.schema.string.optional()`,
+            OPENFGA_MODEL_ID: `Env.schema.string.optional()`,
+        },
+        leadingComment: 'Variables de @jantstack/adonis-authz',
+    });
+    await codemods.makeUsingStub(stubsRoot, 'config/authorization.stub', {});
+    await codemods.makeUsingStub(stubsRoot, 'config/app_acl.stub', {});
+    await codemods.makeUsingStub(stubsRoot, 'migration.stub', {
+        migration: {
+            folder: 'database/migrations',
+            fileName: `${new Date().getTime()}_create_authz_tables.ts`,
+        },
+    });
+    command.logger.success('Autorización configurada.');
+    command.logger.info('Siguiente paso: node ace migration:run');
+}
+//# sourceMappingURL=configure.js.map

package/build/configure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.js","sourceRoot":"","sources":["../configure.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAkB;IAChD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAA;IAE/C,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAW,EAAE,EAAE;QAC1C,MAAM;aACH,WAAW,CAAC,wCAAwC,CAAC;aACrD,UAAU,CAAC,kCAAkC,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,CAAC,kBAAkB,CAAC,OAAO,EAAE;QACzC;YACE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,+CAA+C;SACtD;KACF,CAAC,CAAA;IAEF,MAAM,QAAQ,CAAC,kBAAkB,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,QAAQ,CAAC,oBAAoB,CAAC;QAClC,SAAS,EAAE;YACT,YAAY,EAAE,8BAA8B;YAC5C,WAAW,EAAE,2DAA2D;YACxE,gBAAgB,EAAE,8BAA8B;YAChD,gBAAgB,EAAE,8BAA8B;SACjD;QACD,cAAc,EAAE,sCAAsC;KACvD,CAAC,CAAA;IAEF,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,2BAA2B,EAAE,EAAE,CAAC,CAAA;IACxE,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;IAElE,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,gBAAgB,EAAE;QACxD,SAAS,EAAE;YACT,MAAM,EAAE,qBAAqB;YAC7B,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,yBAAyB;SAC3D;KACF,CAAC,CAAA;IAEF,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACnD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAA;AAC/D,CAAC"}

package/build/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Entrada pública del paquete.
+ *   import { AuthorizationManager, APP_SCOPE } from '@jantstack/adonis-authz'
+ */
+export { AuthorizationManager } from './src/manager.js';
+export { defineConfig } from './src/define_config.js';
+export type { AuthorizationConfig } from './src/define_config.js';
+export { syncAuthzCatalog } from './src/catalog.js';
+export { DatabaseAuthorizationDriver, APP_SCOPE_DB_UUID } from './src/drivers/database_driver.js';
+export { OpenFgaAuthorizationDriver, openFgaAuthorizationModel, provisionOpenFgaStore, importAuthzFactsToOpenFga, } from './src/drivers/openfga_driver.js';
+export type { HolderTypeMap, OpenFgaDriverOptions } from './src/drivers/openfga_driver.js';
+export { APP_SCOPE, APP_SCOPE_TYPE } from './src/types.js';
+export type { AuthorizationDriver, AuthorizationDriverFactory, AuthzWriteEvent, CatalogRoleSpec, CatalogSpec, GrantOptions, ScopeAncestorsResolver, ScopeRef, ScopeType, SubjectRef, } from './src/types.js';
+export { default as AuthzRole } from './src/models/authz_role.js';
+export { default as AuthzPermission } from './src/models/authz_permission.js';
+export { default as AuthzRolePermission } from './src/models/authz_role_permission.js';
+export { default as AuthzAssignment } from './src/models/authz_assignment.js';
+export { default as AuthzDeny } from './src/models/authz_deny.js';
+export { withAuthzScopes } from './src/traits/authz_scopes.js';
+export { hasUuid } from './src/traits/has_uuid.js';
+//# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACjG,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,iCAAiC,CAAA;AACxC,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AAE1F,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC1D,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,eAAe,EACf,eAAe,EACf,WAAW,EACX,YAAY,EACZ,sBAAsB,EACtB,QAAQ,EACR,SAAS,EACT,UAAU,GACX,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}

package/build/index.js

@@ -0,0 +1,18 @@
+/**
+ * Entrada pública del paquete.
+ *   import { AuthorizationManager, APP_SCOPE } from '@jantstack/adonis-authz'
+ */
+export { AuthorizationManager } from './src/manager.js';
+export { defineConfig } from './src/define_config.js';
+export { syncAuthzCatalog } from './src/catalog.js';
+export { DatabaseAuthorizationDriver, APP_SCOPE_DB_UUID } from './src/drivers/database_driver.js';
+export { OpenFgaAuthorizationDriver, openFgaAuthorizationModel, provisionOpenFgaStore, importAuthzFactsToOpenFga, } from './src/drivers/openfga_driver.js';
+export { APP_SCOPE, APP_SCOPE_TYPE } from './src/types.js';
+export { default as AuthzRole } from './src/models/authz_role.js';
+export { default as AuthzPermission } from './src/models/authz_permission.js';
+export { default as AuthzRolePermission } from './src/models/authz_role_permission.js';
+export { default as AuthzAssignment } from './src/models/authz_assignment.js';
+export { default as AuthzDeny } from './src/models/authz_deny.js';
+export { withAuthzScopes } from './src/traits/authz_scopes.js';
+export { hasUuid } from './src/traits/has_uuid.js';
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACjG,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,iCAAiC,CAAA;AAGxC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAc1D,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}

package/build/providers/authz_provider.d.ts

@@ -0,0 +1,17 @@
+import type { ApplicationService } from '@adonisjs/core/types';
+import { AuthorizationManager } from '../src/manager.js';
+declare module '@adonisjs/core/types' {
+    interface ContainerBindings {
+        'authz.manager': AuthorizationManager;
+    }
+}
+/**
+ * Registra el manager de autorización como singleton del contenedor,
+ * construido desde `config/authorization.ts` de la aplicación.
+ */
+export default class AuthzProvider {
+    protected app: ApplicationService;
+    constructor(app: ApplicationService);
+    register(): void;
+}
+//# sourceMappingURL=authz_provider.d.ts.map

package/build/providers/authz_provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz_provider.d.ts","sourceRoot":"","sources":["../../providers/authz_provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,QAAQ,sBAAsB,CAAC;IACpC,UAAiB,iBAAiB;QAChC,eAAe,EAAE,oBAAoB,CAAA;KACtC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,OAAO,OAAO,aAAa;IACpB,SAAS,CAAC,GAAG,EAAE,kBAAkB;gBAAvB,GAAG,EAAE,kBAAkB;IAE7C,QAAQ;CAWT"}

package/build/providers/authz_provider.js

@@ -0,0 +1,21 @@
+import { AuthorizationManager } from '../src/manager.js';
+/**
+ * Registra el manager de autorización como singleton del contenedor,
+ * construido desde `config/authorization.ts` de la aplicación.
+ */
+export default class AuthzProvider {
+    app;
+    constructor(app) {
+        this.app = app;
+    }
+    register() {
+        this.app.container.singleton('authz.manager', async () => {
+            const config = this.app.config.get('authorization');
+            if (!config) {
+                throw new Error('Falta config/authorization.ts — ejecuta: node ace configure @jantstack/adonis-authz');
+            }
+            return new AuthorizationManager(config);
+        });
+    }
+}
+//# sourceMappingURL=authz_provider.js.map

package/build/providers/authz_provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz_provider.js","sourceRoot":"","sources":["../../providers/authz_provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAQxD;;;GAGG;AACH,MAAM,CAAC,OAAO,OAAO,aAAa;IACV;IAAtB,YAAsB,GAAuB;QAAvB,QAAG,GAAH,GAAG,CAAoB;IAAG,CAAC;IAEjD,QAAQ;QACN,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;YAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAA;YACH,CAAC;YACD,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAA;QACzC,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/build/services/main.d.ts

@@ -0,0 +1,10 @@
+import type { AuthorizationManager } from '../src/manager.js';
+/**
+ * Singleton del manager, resuelto del contenedor cuando la app ha booteado.
+ *
+ *   import authorization from '@jantstack/adonis-authz/services/main'
+ *   await authorization.authorize(subject, 'audit:read', APP_SCOPE)
+ */
+declare let authorization: AuthorizationManager;
+export { authorization as default };
+//# sourceMappingURL=main.d.ts.map

package/build/services/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../services/main.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAE7D;;;;;GAKG;AACH,QAAA,IAAI,aAAa,EAAE,oBAAoB,CAAA;AAMvC,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,CAAA"}

package/build/services/main.js

@@ -0,0 +1,13 @@
+import app from '@adonisjs/core/services/app';
+/**
+ * Singleton del manager, resuelto del contenedor cuando la app ha booteado.
+ *
+ *   import authorization from '@jantstack/adonis-authz/services/main'
+ *   await authorization.authorize(subject, 'audit:read', APP_SCOPE)
+ */
+let authorization;
+await app.booted(async () => {
+    authorization = await app.container.make('authz.manager');
+});
+export { authorization as default };
+//# sourceMappingURL=main.js.map

package/build/services/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../services/main.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,6BAA6B,CAAA;AAG7C;;;;;GAKG;AACH,IAAI,aAAmC,CAAA;AAEvC,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;IAC1B,aAAa,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;AAC3D,CAAC,CAAC,CAAA;AAEF,OAAO,EAAE,aAAa,IAAI,OAAO,EAAE,CAAA"}

package/build/src/catalog.d.ts

@@ -0,0 +1,3 @@
+import type { CatalogSpec } from './types.js';
+export declare function syncAuthzCatalog(catalog: CatalogSpec): Promise<void>;
+//# sourceMappingURL=catalog.d.ts.map

package/build/src/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/catalog.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AA+B7C,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAwE1E"}