@jantstack/adonis-authz 1.1.0 → 2.0.0-alpha.1

package/build/commands/authz_catalog_diff.d.ts

@@ -0,0 +1,28 @@
+import { BaseCommand } from '@adonisjs/core/ace';
+import { CommandOptions } from '@adonisjs/core/types/ace';
+/**
+ * Compara los catálogos declarados en `config/authorization.ts` (`catalogs`)
+ * con las tablas `authz_*` y sale con código ≠ 0 si hay diferencias: roles o
+ * permisos que faltan, vínculos que faltan, vínculos SOBRANTES (un permiso
+ * que el config ya no da y la base sigue dando: L0.9) y roles AMBIGUOS (dos
+ * homónimos visibles en la misma cadena, 3D · M2). Pensado para CI: un
+ * config que no coincide con producción no pasa.
+ *
+ *   node ace authz:catalog:diff
+ *   node ace authz:catalog:diff --fail-on-shadows
+ *
+ * Los roles locales ENSOMBRECIDOS por una definición más autorizada (un
+ * global, o el de un ancestro) se LISTAN y no cuentan como deriva (3F · S3):
+ * un tenant no puede dejar en rojo el gate de CI de la plataforma. El precio
+ * es que nadie se entera por CI de que las rutas por slug de ese subárbol
+ * están muertas, así que `--fail-on-shadows` lo convierte en deriva para
+ * quien sí quiera enterarse (3G · X3).
+ */
+export default class AuthzCatalogDiff extends BaseCommand {
+    static commandName: string;
+    static description: string;
+    static options: CommandOptions;
+    failOnShadows: boolean;
+    run(): Promise<void>;
+}
+//# sourceMappingURL=authz_catalog_diff.d.ts.map

package/build/commands/authz_catalog_diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz_catalog_diff.d.ts","sourceRoot":"","sources":["../../commands/authz_catalog_diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,SAAuB;IACzC,MAAM,CAAC,WAAW,SAAsF;IAExG,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAMO,aAAa,EAAE,OAAO,CAAA;IAExB,GAAG;CA0BV"}

package/build/commands/authz_catalog_diff.js

@@ -0,0 +1,67 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { BaseCommand, flags } from '@adonisjs/core/ace';
+/**
+ * Compara los catálogos declarados en `config/authorization.ts` (`catalogs`)
+ * con las tablas `authz_*` y sale con código ≠ 0 si hay diferencias: roles o
+ * permisos que faltan, vínculos que faltan, vínculos SOBRANTES (un permiso
+ * que el config ya no da y la base sigue dando: L0.9) y roles AMBIGUOS (dos
+ * homónimos visibles en la misma cadena, 3D · M2). Pensado para CI: un
+ * config que no coincide con producción no pasa.
+ *
+ *   node ace authz:catalog:diff
+ *   node ace authz:catalog:diff --fail-on-shadows
+ *
+ * Los roles locales ENSOMBRECIDOS por una definición más autorizada (un
+ * global, o el de un ancestro) se LISTAN y no cuentan como deriva (3F · S3):
+ * un tenant no puede dejar en rojo el gate de CI de la plataforma. El precio
+ * es que nadie se entera por CI de que las rutas por slug de ese subárbol
+ * están muertas, así que `--fail-on-shadows` lo convierte en deriva para
+ * quien sí quiera enterarse (3G · X3).
+ */
+export default class AuthzCatalogDiff extends BaseCommand {
+    static commandName = 'authz:catalog:diff';
+    static description = 'Compare the catalogs declared in config with the authz_* tables (exit 1 on drift)';
+    static options = {
+        startApp: true,
+    };
+    async run() {
+        const config = this.app.config.get('authorization');
+        const catalogs = config?.catalogs;
+        if (!Array.isArray(catalogs) || catalogs.length === 0) {
+            this.logger.error('No hay catálogos declarados: añade `catalogs: [() => import(...)]` a config/authorization.ts');
+            this.exitCode = 1;
+            return;
+        }
+        const { runCatalogDiff } = await import('../src/catalog.js');
+        // Con el resolutor del config el diff puede juzgar además si dos roles
+        // LOCALES homónimos son visibles en la misma cadena (3D · M2 d).
+        const { inSync, lines } = await runCatalogDiff(catalogs, {
+            resolveChain: config?.scopes?.resolveChain,
+            failOnShadows: this.failOnShadows === true,
+        });
+        for (const line of lines)
+            this.logger.log(line);
+        if (inSync) {
+            this.logger.success('Catálogo en sync con la base.');
+            return;
+        }
+        this.logger.error('El catálogo NO está en sync: ejecuta `node ace authz:catalog:sync`.');
+        this.exitCode = 1;
+    }
+}
+__decorate([
+    flags.boolean({
+        name: 'fail-on-shadows',
+        description: 'Exit 1 too when a local role is shadowed by a more authoritative one (global or ancestor)',
+    }),
+    __metadata("design:type", Boolean)
+], AuthzCatalogDiff.prototype, "failOnShadows", void 0);
+//# sourceMappingURL=authz_catalog_diff.js.map

package/build/commands/authz_catalog_diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz_catalog_diff.js","sourceRoot":"","sources":["../../commands/authz_catalog_diff.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAGvD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,GAAG,oBAAoB,CAAA;IACzC,MAAM,CAAC,WAAW,GAAG,mFAAmF,CAAA;IAExG,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,IAAI;KACf,CAAA;IAQD,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;QAC1D,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAA;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,8FAA8F,CAC/F,CAAA;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC5D,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE;YACvD,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa,KAAK,IAAI;SAC3C,CAAC,CAAA;QACF,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAA;YACpD,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAA;QACxF,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;IACnB,CAAC;;AA3BO;IAJP,KAAK,CAAC,OAAO,CAAC;QACb,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,2FAA2F;KACzG,CAAC;;uDAC4B"}

package/build/commands/authz_catalog_sync.d.ts

@@ -0,0 +1,20 @@
+import { BaseCommand } from '@adonisjs/core/ace';
+import { CommandOptions } from '@adonisjs/core/types/ace';
+/**
+ * Sincroniza a las tablas `authz_*` los catálogos declarados en
+ * `config/authorization.ts` (`catalogs`), en orden. Transaccional por
+ * catálogo; con la poda de vínculos activa por defecto (L0.9): un permiso que
+ * el config quita de un rol deja de concederse. Nunca borra roles ni
+ * permisos.
+ *
+ *   node ace authz:catalog:sync
+ *   node ace authz:catalog:sync --keep-links   # solo aditivo (1.x)
+ */
+export default class AuthzCatalogSync extends BaseCommand {
+    static commandName: string;
+    static description: string;
+    static options: CommandOptions;
+    keepLinks: boolean | undefined;
+    run(): Promise<void>;
+}
+//# sourceMappingURL=authz_catalog_sync.d.ts.map

package/build/commands/authz_catalog_sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz_catalog_sync.d.ts","sourceRoot":"","sources":["../../commands/authz_catalog_sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,SAAuB;IACzC,MAAM,CAAC,WAAW,SAAiE;IAEnF,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAGO,SAAS,EAAE,OAAO,GAAG,SAAS,CAAA;IAEhC,GAAG;CAmCV"}

package/build/commands/authz_catalog_sync.js

@@ -0,0 +1,58 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { BaseCommand, flags } from '@adonisjs/core/ace';
+/**
+ * Sincroniza a las tablas `authz_*` los catálogos declarados en
+ * `config/authorization.ts` (`catalogs`), en orden. Transaccional por
+ * catálogo; con la poda de vínculos activa por defecto (L0.9): un permiso que
+ * el config quita de un rol deja de concederse. Nunca borra roles ni
+ * permisos.
+ *
+ *   node ace authz:catalog:sync
+ *   node ace authz:catalog:sync --keep-links   # solo aditivo (1.x)
+ */
+export default class AuthzCatalogSync extends BaseCommand {
+    static commandName = 'authz:catalog:sync';
+    static description = 'Sync the catalogs declared in config into the authz_* tables';
+    static options = {
+        startApp: true,
+    };
+    async run() {
+        const config = this.app.config.get('authorization');
+        const catalogs = config?.catalogs;
+        if (!Array.isArray(catalogs) || catalogs.length === 0) {
+            this.logger.error('No hay catálogos declarados: añade `catalogs: [() => import(...)]` a config/authorization.ts');
+            this.exitCode = 1;
+            return;
+        }
+        const { syncCatalogs } = await import('../src/catalog.js');
+        const { count, shadowedByGlobal, assignableAtViolations } = await syncCatalogs(catalogs, {
+            prune: this.keepLinks ? 'none' : 'links',
+        });
+        // 3E · P1 b / P6: el sync ya no aborta por lo que un tenant hizo en su
+        // scope, pero tampoco lo silencia. Un despliegue que ensombrece roles de
+        // tenants —o que deja vínculos fuera del `assignableAt` nuevo— tiene que
+        // salir por pantalla y quedar en el log del deploy.
+        for (const role of shadowedByGlobal) {
+            this.logger.warning(`rol local ENSOMBRECIDO por el global del spec: ${role.slug}@${role.scopeType} (uuid ${role.uuid}, owner ${role.owner}). ` +
+                `El global gana; en esa cadena el slug pasa a 422 E_AUTHZ_AMBIGUOUS_ROLE hasta que se purgue uno.`);
+        }
+        for (const violation of assignableAtViolations) {
+            this.logger.warning(`vínculo fuera de assignableAt: ${violation.role.slug}@${violation.role.scopeType} (owner ${violation.role.owner}) → ` +
+                `${violation.permission}. No se ha borrado (lo asignado sigue concediendo): quítalo o amplía el assignableAt.`);
+        }
+        this.logger.success(`${count} catálogo(s) sincronizado(s)` + (this.keepLinks ? ' (sin poda de vínculos).' : '.'));
+    }
+}
+__decorate([
+    flags.boolean({ description: 'Do not prune role→permission links missing from the spec' }),
+    __metadata("design:type", Object)
+], AuthzCatalogSync.prototype, "keepLinks", void 0);
+//# sourceMappingURL=authz_catalog_sync.js.map

package/build/commands/authz_catalog_sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz_catalog_sync.js","sourceRoot":"","sources":["../../commands/authz_catalog_sync.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAGvD;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,GAAG,oBAAoB,CAAA;IACzC,MAAM,CAAC,WAAW,GAAG,8DAA8D,CAAA;IAEnF,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,IAAI;KACf,CAAA;IAKD,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;QAC1D,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAA;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,8FAA8F,CAC/F,CAAA;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC1D,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE;YACvF,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;SACzC,CAAC,CAAA;QACF,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,OAAO,CACjB,kDAAkD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,KAAK,KAAK;gBACxH,kGAAkG,CACrG,CAAA;QACH,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,sBAAsB,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,CACjB,kCAAkC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,WAAW,SAAS,CAAC,IAAI,CAAC,KAAK,MAAM;gBACpH,GAAG,SAAS,CAAC,UAAU,uFAAuF,CACjH,CAAA;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CACjB,GAAG,KAAK,8BAA8B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,GAAG,CAAC,CAC7F,CAAA;IACH,CAAC;;AApCO;IADP,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;;mDACrD"}

package/build/commands/main.d.ts

@@ -4,4 +4,6 @@
  */
 export { default as OpenFgaProvision } from './openfga_provision.js';
 export { default as OpenFgaImport } from './openfga_import.js';
+export { default as AuthzCatalogDiff } from './authz_catalog_diff.js';
+export { default as AuthzCatalogSync } from './authz_catalog_sync.js';
 //# sourceMappingURL=main.d.ts.map

package/build/commands/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../commands/main.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../commands/main.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA"}

package/build/commands/main.js

@@ -4,4 +4,6 @@
  */
 export { default as OpenFgaProvision } from './openfga_provision.js';
 export { default as OpenFgaImport } from './openfga_import.js';
+export { default as AuthzCatalogDiff } from './authz_catalog_diff.js';
+export { default as AuthzCatalogSync } from './authz_catalog_sync.js';
 //# sourceMappingURL=main.js.map

package/build/commands/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../../commands/main.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../commands/main.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA"}

package/build/commands/openfga_import.d.ts

@@ -12,8 +12,12 @@ import { CommandOptions } from '@adonisjs/core/types/ace';
  *   3. node ace openfga:import [--dry-run]   → copia los hechos
  *   4. AUTHZ_DRIVER=openfga + reiniciar api/worker.
  *
- * Idempotente (re-ejecutar no duplica) y no destructivo (las tablas
- * locales quedan intactas → rollback = volver a AUTHZ_DRIVER=database).
+ * No destructivo (las tablas locales quedan intactas → rollback = volver a
+ * AUTHZ_DRIVER=database). Sobre un store que YA tiene tuplas exige
+ * `--reconcile`: compara tupla a tupla, reescribe las que difieren en
+ * caducidad (S7) — nunca "ignora duplicados", porque en FGA la condición no
+ * es parte de la clave — y cuenta las que SQL no tiene (`extra`); con
+ * `--prune` las borra (D14): es lo que hace que el reconcile converja.
  */
 export default class OpenFgaImport extends BaseCommand {
     static commandName: string;
@@ -23,6 +27,8 @@ export default class OpenFgaImport extends BaseCommand {
     storeId: string | undefined;
     modelId: string | undefined;
     dryRun: boolean | undefined;
+    reconcile: boolean | undefined;
+    prune: boolean | undefined;
     run(): Promise<void>;
 }
 //# sourceMappingURL=openfga_import.d.ts.map

package/build/commands/openfga_import.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openfga_import.d.ts","sourceRoot":"","sources":["../../commands/openfga_import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IACpD,MAAM,CAAC,WAAW,SAAmB;IACrC,MAAM,CAAC,WAAW,SAAgF;IAElG,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAGO,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAGvB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,MAAM,EAAE,OAAO,GAAG,SAAS,CAAA;IAE7B,GAAG;CA+BV"}
+{"version":3,"file":"openfga_import.d.ts","sourceRoot":"","sources":["../../commands/openfga_import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IACpD,MAAM,CAAC,WAAW,SAAmB;IACrC,MAAM,CAAC,WAAW,SAAgF;IAElG,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAGO,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAGvB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,MAAM,EAAE,OAAO,GAAG,SAAS,CAAA;IAM3B,SAAS,EAAE,OAAO,GAAG,SAAS,CAAA;IAG9B,KAAK,EAAE,OAAO,GAAG,SAAS,CAAA;IAE5B,GAAG;CAyCV"}

package/build/commands/openfga_import.js

@@ -20,8 +20,12 @@ import { BaseCommand, flags } from '@adonisjs/core/ace';
  *   3. node ace openfga:import [--dry-run]   → copia los hechos
  *   4. AUTHZ_DRIVER=openfga + reiniciar api/worker.
  *
- * Idempotente (re-ejecutar no duplica) y no destructivo (las tablas
- * locales quedan intactas → rollback = volver a AUTHZ_DRIVER=database).
+ * No destructivo (las tablas locales quedan intactas → rollback = volver a
+ * AUTHZ_DRIVER=database). Sobre un store que YA tiene tuplas exige
+ * `--reconcile`: compara tupla a tupla, reescribe las que difieren en
+ * caducidad (S7) — nunca "ignora duplicados", porque en FGA la condición no
+ * es parte de la clave — y cuenta las que SQL no tiene (`extra`); con
+ * `--prune` las borra (D14): es lo que hace que el reconcile converja.
  */
 export default class OpenFgaImport extends BaseCommand {
     static commandName = 'openfga:import';
@@ -38,18 +42,27 @@ export default class OpenFgaImport extends BaseCommand {
             this.exitCode = 1;
             return;
         }
-        const { importAuthzFactsToOpenFga } = await import('../src/drivers/openfga_driver.js');
+        // El subpath `/openfga` es la única puerta al SDK (D9).
+        const { importAuthzFactsToOpenFga } = await import('../src/openfga.js');
         const holderTypes = config?.holderTypes ?? {};
         const result = await importAuthzFactsToOpenFga({
             apiUrl,
             storeId,
             modelId: this.modelId ?? config?.openfga?.modelId,
             dryRun: this.dryRun ?? false,
+            reconcile: this.reconcile ?? false,
+            prune: this.prune ?? false,
             holderTypes,
         });
-        const verb = result.dryRun ? 'Se escribirían' : 'Escritos';
-        this.logger.success(`${verb} ${result.assignments} assignments y ${result.denies} denies ` +
-            `(${result.skippedExpired} asignaciones ya expiradas omitidas).`);
+        const verb = result.dryRun ? 'Se escribirían' : 'Escritas';
+        this.logger.success(`${verb} ${result.written} tuplas nuevas, ${result.updated} reescritas (caducidad distinta), ` +
+            `${result.unchanged} sin cambios; ${result.skippedExpired} asignaciones ya expiradas omitidas.`);
+        if (result.extra > 0 && !this.prune) {
+            this.logger.warning(`${result.extra} tupla(s) del store no están en SQL y SIGUEN concediendo: vuelve a ejecutar con --reconcile --prune para borrarlas.`);
+        }
+        else if (this.prune) {
+            this.logger.log(`${result.dryRun ? 'Se borrarían' : 'Borradas'} ${result.deleted} tupla(s) que SQL no tiene.`);
+        }
         if (!result.dryRun) {
             this.logger.log('Siguiente paso: AUTHZ_DRIVER=openfga y reiniciar api/worker.');
         }
@@ -71,4 +84,14 @@ __decorate([
     flags.boolean({ description: 'Count what would be written, without writing' }),
     __metadata("design:type", Object)
 ], OpenFgaImport.prototype, "dryRun", void 0);
+__decorate([
+    flags.boolean({
+        description: 'Import into a non-empty store: compare tuple by tuple, rewrite the ones that differ and count the ones SQL no longer has (extra)',
+    }),
+    __metadata("design:type", Object)
+], OpenFgaImport.prototype, "reconcile", void 0);
+__decorate([
+    flags.boolean({ description: 'With --reconcile: delete the tuples SQL no longer has (reported as deleted)' }),
+    __metadata("design:type", Object)
+], OpenFgaImport.prototype, "prune", void 0);
 //# sourceMappingURL=openfga_import.js.map

package/build/commands/openfga_import.js.map

@@ -1 +1 @@
-{"version":3,"file":"openfga_import.js","sourceRoot":"","sources":["../../commands/openfga_import.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAGvD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IACpD,MAAM,CAAC,WAAW,GAAG,gBAAgB,CAAA;IACrC,MAAM,CAAC,WAAW,GAAG,6EAA6E,CAAA;IAElG,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,IAAI;KACf,CAAA;IAcD,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,OAAO,EAAE,GAAG,CAAA;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,OAAO,EAAE,OAAO,CAAA;QACxD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,mGAAmG,CACpG,CAAA;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAA;QACtF,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAA;QAC7C,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;YAC7C,MAAM;YACN,OAAO;YACP,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,OAAO,EAAE,OAAO;YACjD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,WAAW;SACZ,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAA;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,CACjB,GAAG,IAAI,IAAI,MAAM,CAAC,WAAW,kBAAkB,MAAM,CAAC,MAAM,UAAU;YACpE,IAAI,MAAM,CAAC,cAAc,uCAAuC,CACnE,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;;AAzCO;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;0CAC5C;AAGvB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;8CAClD;AAG3B;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;8CACtC;AAG3B;IADP,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;;6CAC5C"}
+{"version":3,"file":"openfga_import.js","sourceRoot":"","sources":["../../commands/openfga_import.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAGvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IACpD,MAAM,CAAC,WAAW,GAAG,gBAAgB,CAAA;IACrC,MAAM,CAAC,WAAW,GAAG,6EAA6E,CAAA;IAElG,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,IAAI;KACf,CAAA;IAuBD,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,OAAO,EAAE,GAAG,CAAA;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,OAAO,EAAE,OAAO,CAAA;QACxD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,mGAAmG,CACpG,CAAA;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,wDAAwD;QACxD,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;QACvE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAA;QAC7C,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;YAC7C,MAAM;YACN,OAAO;YACP,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,OAAO,EAAE,OAAO;YACjD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YAC5B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK;YAClC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK;YAC1B,WAAW;SACZ,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAA;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,CACjB,GAAG,IAAI,IAAI,MAAM,CAAC,OAAO,mBAAmB,MAAM,CAAC,OAAO,oCAAoC;YAC5F,GAAG,MAAM,CAAC,SAAS,iBAAiB,MAAM,CAAC,cAAc,sCAAsC,CAClG,CAAA;QACD,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,OAAO,CACjB,GAAG,MAAM,CAAC,KAAK,qHAAqH,CACrI,CAAA;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAA;QAChH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAA;QACjF,CAAC;IACH,CAAC;;AA5DO;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;0CAC5C;AAGvB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;8CAClD;AAG3B;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;8CACtC;AAG3B;IADP,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;;6CAC5C;AAM3B;IAJP,KAAK,CAAC,OAAO,CAAC;QACb,WAAW,EACT,kIAAkI;KACrI,CAAC;;gDACoC;AAG9B;IADP,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,6EAA6E,EAAE,CAAC;;4CAC5E"}

package/build/commands/openfga_provision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openfga_provision.d.ts","sourceRoot":"","sources":["../../commands/openfga_provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,SAAsB;IACxC,MAAM,CAAC,WAAW,SAAoE;IAEtF,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAGO,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAGvB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IAE1B,GAAG;CAqCV"}
+{"version":3,"file":"openfga_provision.d.ts","sourceRoot":"","sources":["../../commands/openfga_provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,SAAsB;IACxC,MAAM,CAAC,WAAW,SAAoE;IAEtF,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAGO,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAGvB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IAE1B,GAAG;CAoCV"}

package/build/commands/openfga_provision.js

@@ -38,7 +38,8 @@ export default class OpenFgaProvision extends BaseCommand {
             return;
         }
         const { OpenFgaClient } = await import('@openfga/sdk');
-        const { openFgaAuthorizationModel, provisionOpenFgaStore } = await import('../src/drivers/openfga_driver.js');
+        // El subpath `/openfga` es la única puerta al SDK (D9).
+        const { openFgaAuthorizationModel, provisionOpenFgaStore } = await import('../src/openfga.js');
         // Los holders del consumidor viven en SU config, no en el paquete.
         const holderTypes = config?.holderTypes ?? {};
         if (this.storeId) {

package/build/commands/openfga_provision.js.map

@@ -1 +1 @@
-{"version":3,"file":"openfga_provision.js","sourceRoot":"","sources":["../../commands/openfga_provision.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAGvD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,GAAG,mBAAmB,CAAA;IACxC,MAAM,CAAC,WAAW,GAAG,iEAAiE,CAAA;IAEtF,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,KAAK;KAChB,CAAA;IAWD,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,OAAO,EAAE,GAAG,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAA;YAChG,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAA;QACtD,MAAM,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CACvE,kCAAkC,CACnC,CAAA;QACD,mEAAmE;QACnE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAA;QAE7C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACnE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAA;YAC1F,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAA;YAC/E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QAED,wEAAwE;QACxE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CACtD,MAAM,EACN,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAC3D,WAAW,CACZ,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAA;QACjE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAA;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;;AA5CO;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;6CAC5C;AAGvB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;;iDACnD;AAG3B;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;;8CAC9D"}
+{"version":3,"file":"openfga_provision.js","sourceRoot":"","sources":["../../commands/openfga_provision.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAGvD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,GAAG,mBAAmB,CAAA;IACxC,MAAM,CAAC,WAAW,GAAG,iEAAiE,CAAA;IAEtF,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,KAAK;KAChB,CAAA;IAWD,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,OAAO,EAAE,GAAG,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAA;YAChG,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAA;QACtD,wDAAwD;QACxD,MAAM,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC9F,mEAAmE;QACnE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAA;QAE7C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACnE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAA;YAC1F,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAA;YAC/E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QAED,wEAAwE;QACxE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CACtD,MAAM,EACN,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAC3D,WAAW,CACZ,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAA;QACjE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAA;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;;AA3CO;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;6CAC5C;AAGvB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;;iDACnD;AAG3B;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;;8CAC9D"}

package/build/index.d.ts

@@ -2,22 +2,61 @@
  * Entrada pública del paquete.
  *   import { AuthorizationManager, APP_SCOPE } from '@jantstack/adonis-authz'
  */
-export { AuthorizationManager } from './src/manager.js';
+export { AuthorizationManager, DEFAULT_MAX_SCOPES, DEFAULT_MAX_DESCENDANTS, MAX_SCOPE_BOUND, DEFAULT_VIEW_MAX_AGE_MS, expandExcludedSubtrees } from './src/manager.js';
+export type { AuthorizationView, ForRequestOptions } from './src/manager.js';
 export { defineConfig } from './src/define_config.js';
 export type { AuthorizationConfig } from './src/define_config.js';
-export { syncAuthzCatalog } from './src/catalog.js';
+export { syncAuthzCatalog, diffAuthzCatalog, catalogInSync, formatCatalogDiff, formatScopedRoles, formatShadowedRoles, runCatalogDiff, syncCatalogs, } from './src/catalog.js';
+export type { SyncCatalogOptions, CatalogDiff, CatalogLinkRef, CatalogSource } from './src/catalog.js';
+/**
+ * Memo del catálogo (2.1): se revalida contra la versión compartida
+ * `authz_catalog_version`, que `syncAuthzCatalog` sube como última sentencia
+ * de su transacción. Quien escriba `authz_*` por fuera lo hace con
+ * `withAuthzCatalogWrite(async (trx) => …)` (misma transacción, bump al
+ * final: todos los procesos lo ven) — `bumpAuthzCatalogVersion(trx)` exige
+ * ese trx; `invalidateAuthzCatalog()` solo alcanza a este proceso.
+ */
+export { CatalogCache, invalidateAuthzCatalog, bumpAuthzCatalogVersion, withAuthzCatalogWrite, readAuthzCatalogVersion, CATALOG_VERSION_TABLE, GLOBAL_OWNER_KEY, } from './src/catalog_cache.js';
+export type { CatalogCacheOptions, CatalogRevalidate, CatalogView, CatalogRoleRef, CatalogPermission, AuthzCatalogWriteOptions, CatalogVersionClient, CatalogVersionTransaction, } from './src/catalog_cache.js';
+/**
+ * Memo de ancestros de una instancia (2.1), solo para el camino de lectura.
+ * `authorization.forRequest()` ya lo aplica por ti.
+ */
+export { memoizeAncestors } from './src/memoize_ancestors.js';
+/**
+ * Arbol del consumidor (2.1): `hierarchicalScopeResolver` construye el
+ * resolutor de ancestros desde un `parentOf`; `sqlDescendantsOf` genera el
+ * `descendantsOf` opt-in (CTE recursiva, PG y SQLite) para `authorizedScopes`.
+ */
+export { hierarchicalScopeResolver } from './src/hierarchical_resolver.js';
+export type { HierarchicalResolverOptions, NodeOf, ScopeNode } from './src/hierarchical_resolver.js';
+export { sqlDescendantsOf } from './src/sql_descendants.js';
+export type { SqlDescendantsOptions } from './src/sql_descendants.js';
 /**
  * El backend de autorización no respondió (503). Tipo PROPIO a propósito: sin
  * él escaparía el error del SDK del driver, y distinguir "backend caído"
  * obligaría a importar ese SDK — acoplando el call-site al backend que este
  * paquete existe para abstraer.
  */
-export { AuthorizationBackendError } from './src/errors.js';
+export { AuthorizationBackendError, AuthorizationBackendTimeoutError, ScopeResolverError, InvalidIdentityError, InvalidSlugError, AuthorizationConfigError, AuthorizationInternalError, UnknownScopeError, NoScopeResolverError, UnknownRoleError, UnknownPermissionError, CatalogConflictError, RoleIsNotAccessError, ScopeCycleError, PurgeIncompleteError, StoreNotEmptyError, ActorRequiredError, NotWithinError, WithinRequiredError, WithinRootForbiddenError, TooManyScopesError, UnsupportedDialectError, ScopeTooDeepError, UnsupportedOperationError, NoDescendantsResolverError, ViewExpiredError, RoleNotVisibleError, AmbiguousRoleError, RoleImmutableError, RoleLevelAboveOwnerError, RoleNotAssignableAtError, PermissionNotDelegableError, RankExceededError, } from './src/errors.js';
+/**
+ * Validación de identidad y de slugs (422). La aplica el manager en cada
+ * llamada y los drivers por defensa en profundidad; se exporta para que un
+ * consumidor valide en su borde (un formulario, un importador) con la MISMA
+ * regla y no con una copia.
+ */
+export { assertIdentity, assertSubject, assertScope, assertValidSlug, assertExpiresAt, assertNoSlugCollisions, normalizeRoleQuery, scopeKey, scopeFromKey, IDENTITY_LIMITS, MAX_SLUG_LENGTH, RESERVED_SLUGS, RESERVED_SLUG_PREFIXES, } from './src/identity.js';
+export type { IdentityParts, SlugKind } from './src/identity.js';
+export { resolveGrantExpiry, isActiveExpiry, sameInstant } from './src/expiry.js';
 export { DatabaseAuthorizationDriver, APP_SCOPE_DB_UUID } from './src/drivers/database_driver.js';
-export { OpenFgaAuthorizationDriver, openFgaAuthorizationModel, provisionOpenFgaStore, importAuthzFactsToOpenFga, } from './src/drivers/openfga_driver.js';
-export type { HolderTypeMap, OpenFgaDriverOptions } from './src/drivers/openfga_driver.js';
+export type { DatabaseDriverOptions } from './src/drivers/database_driver.js';
+/**
+ * El driver `openfga` NO se exporta desde aquí: vive en el subpath
+ * `@jantstack/adonis-authz/openfga`, que es lo único que importa el peer
+ * opcional `@openfga/sdk`. Un consumidor solo-database arranca sin él (D9).
+ */
 export { APP_SCOPE, APP_SCOPE_TYPE } from './src/types.js';
-export type { AuthorizationDriver, AuthorizationDriverFactory, AuthzWriteEvent, CatalogRoleSpec, CatalogSpec, GrantOptions, ScopeAncestorsResolver, ScopeRef, ScopeType, SubjectRef, } from './src/types.js';
+export type { AuthorizationDriver, AuthorizationDriverFactory, AuthorizedScopes, AuthzWriteEvent, AuthzCatalogWriteEvent, CatalogPermissionSpec, CatalogRole, CatalogRoleSpec, CatalogSpec, ScopedRoleChanges, ScopedRoleSpec, DenyOptions, DenyRef, ExcludedSubtree, GrantOptions, GrantOutcome, HolderTypeMap, RoleQuery, ScopeChainResolver, ScopeDescendantsResolver, ScopeDetachOutcome, ScopedWriteOptions, ScopeRef, ScopeType, SubjectRef, WriteOptions, } from './src/types.js';
 export { default as AuthzRole } from './src/models/authz_role.js';
 export { default as AuthzPermission } from './src/models/authz_permission.js';
 export { default as AuthzRolePermission } from './src/models/authz_role_permission.js';

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEnD;;;;;GAKG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAE3D,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACjG,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,iCAAiC,CAAA;AACxC,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AAE1F,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC1D,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,eAAe,EACf,eAAe,EACf,WAAW,EACX,YAAY,EACZ,sBAAsB,EACtB,QAAQ,EACR,SAAS,EACT,UAAU,GACX,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACtK,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEtG;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAA;AAE/B;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,YAAY,EAAE,2BAA2B,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,YAAY,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAErE;;;;;GAKG;AACH,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,iBAAiB,CAAA;AAExB;;;;;GAKG;AACH,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,sBAAsB,GACvB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEjF,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACjG,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAE7E;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC1D,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,WAAW,EACX,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,OAAO,EACP,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,SAAS,EACT,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,UAAU,EACV,YAAY,GACb,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}

package/build/index.js

@@ -2,18 +2,51 @@
  * Entrada pública del paquete.
  *   import { AuthorizationManager, APP_SCOPE } from '@jantstack/adonis-authz'
  */
-export { AuthorizationManager } from './src/manager.js';
+export { AuthorizationManager, DEFAULT_MAX_SCOPES, DEFAULT_MAX_DESCENDANTS, MAX_SCOPE_BOUND, DEFAULT_VIEW_MAX_AGE_MS, expandExcludedSubtrees } from './src/manager.js';
 export { defineConfig } from './src/define_config.js';
-export { syncAuthzCatalog } from './src/catalog.js';
+export { syncAuthzCatalog, diffAuthzCatalog, catalogInSync, formatCatalogDiff, formatScopedRoles, formatShadowedRoles, runCatalogDiff, syncCatalogs, } from './src/catalog.js';
+/**
+ * Memo del catálogo (2.1): se revalida contra la versión compartida
+ * `authz_catalog_version`, que `syncAuthzCatalog` sube como última sentencia
+ * de su transacción. Quien escriba `authz_*` por fuera lo hace con
+ * `withAuthzCatalogWrite(async (trx) => …)` (misma transacción, bump al
+ * final: todos los procesos lo ven) — `bumpAuthzCatalogVersion(trx)` exige
+ * ese trx; `invalidateAuthzCatalog()` solo alcanza a este proceso.
+ */
+export { CatalogCache, invalidateAuthzCatalog, bumpAuthzCatalogVersion, withAuthzCatalogWrite, readAuthzCatalogVersion, CATALOG_VERSION_TABLE, GLOBAL_OWNER_KEY, } from './src/catalog_cache.js';
+/**
+ * Memo de ancestros de una instancia (2.1), solo para el camino de lectura.
+ * `authorization.forRequest()` ya lo aplica por ti.
+ */
+export { memoizeAncestors } from './src/memoize_ancestors.js';
+/**
+ * Arbol del consumidor (2.1): `hierarchicalScopeResolver` construye el
+ * resolutor de ancestros desde un `parentOf`; `sqlDescendantsOf` genera el
+ * `descendantsOf` opt-in (CTE recursiva, PG y SQLite) para `authorizedScopes`.
+ */
+export { hierarchicalScopeResolver } from './src/hierarchical_resolver.js';
+export { sqlDescendantsOf } from './src/sql_descendants.js';
 /**
  * El backend de autorización no respondió (503). Tipo PROPIO a propósito: sin
  * él escaparía el error del SDK del driver, y distinguir "backend caído"
  * obligaría a importar ese SDK — acoplando el call-site al backend que este
  * paquete existe para abstraer.
  */
-export { AuthorizationBackendError } from './src/errors.js';
+export { AuthorizationBackendError, AuthorizationBackendTimeoutError, ScopeResolverError, InvalidIdentityError, InvalidSlugError, AuthorizationConfigError, AuthorizationInternalError, UnknownScopeError, NoScopeResolverError, UnknownRoleError, UnknownPermissionError, CatalogConflictError, RoleIsNotAccessError, ScopeCycleError, PurgeIncompleteError, StoreNotEmptyError, ActorRequiredError, NotWithinError, WithinRequiredError, WithinRootForbiddenError, TooManyScopesError, UnsupportedDialectError, ScopeTooDeepError, UnsupportedOperationError, NoDescendantsResolverError, ViewExpiredError, RoleNotVisibleError, AmbiguousRoleError, RoleImmutableError, RoleLevelAboveOwnerError, RoleNotAssignableAtError, PermissionNotDelegableError, RankExceededError, } from './src/errors.js';
+/**
+ * Validación de identidad y de slugs (422). La aplica el manager en cada
+ * llamada y los drivers por defensa en profundidad; se exporta para que un
+ * consumidor valide en su borde (un formulario, un importador) con la MISMA
+ * regla y no con una copia.
+ */
+export { assertIdentity, assertSubject, assertScope, assertValidSlug, assertExpiresAt, assertNoSlugCollisions, normalizeRoleQuery, scopeKey, scopeFromKey, IDENTITY_LIMITS, MAX_SLUG_LENGTH, RESERVED_SLUGS, RESERVED_SLUG_PREFIXES, } from './src/identity.js';
+export { resolveGrantExpiry, isActiveExpiry, sameInstant } from './src/expiry.js';
 export { DatabaseAuthorizationDriver, APP_SCOPE_DB_UUID } from './src/drivers/database_driver.js';
-export { OpenFgaAuthorizationDriver, openFgaAuthorizationModel, provisionOpenFgaStore, importAuthzFactsToOpenFga, } from './src/drivers/openfga_driver.js';
+/**
+ * El driver `openfga` NO se exporta desde aquí: vive en el subpath
+ * `@jantstack/adonis-authz/openfga`, que es lo único que importa el peer
+ * opcional `@openfga/sdk`. Un consumidor solo-database arranca sin él (D9).
+ */
 export { APP_SCOPE, APP_SCOPE_TYPE } from './src/types.js';
 export { default as AuthzRole } from './src/models/authz_role.js';
 export { default as AuthzPermission } from './src/models/authz_permission.js';

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEnD;;;;;GAKG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAE3D,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACjG,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,iCAAiC,CAAA;AAGxC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAc1D,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEtK,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,kBAAkB,CAAA;AAGzB;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAY/B;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAE1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAG3D;;;;;GAKG;AACH,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,iBAAiB,CAAA;AAExB;;;;;GAKG;AACH,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,sBAAsB,GACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEjF,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AAGjG;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AA8B1D,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}