@jantstack/adonis-authz 2.0.0-alpha.1 → 2.4.0-alpha.1

package/build/configure.js

@@ -5,9 +5,30 @@ import { stubsRoot } from './stubs/main.js';
  * Registra el provider, los comandos y el middleware, define las variables
  * de entorno y PUBLICA en el proyecto lo que es suyo: la migración de las
  * tablas `authz_*` y los dos configs (drivers + catálogo del nivel app).
+ *
+ * Es INTERACTIVO: pregunta lo MÍNIMO que cambia lo publicado —el driver por
+ * defecto y si publicar la migración de la outbox del árbol (opt-in, ver
+ * README)— con `command.prompt`. Lo que NO cambia según la respuesta no se
+ * pregunta: los dos configs siempre se publican con las dos costuras cableadas
+ * (el stub arranca en cualquier driver leyendo `AUTHZ_DRIVER`), así que la
+ * elección solo fija el DEFAULT de esa variable, no ramifica el stub —el que
+ * `configure.spec` compila sigue siendo el mismo—. Y las relaciones (Fase 4)
+ * NO se preguntan: sus tablas ya están en la migración del motor y su config
+ * es `defineRelationsConfig` en el propio proyecto; un prompt ahí no publicaría
+ * nada distinto.
  */
 export async function configure(command) {
     const codemods = await command.createCodemods();
+    // ── Preguntas (las únicas que cambian lo que se publica) ──────────────────
+    const defaultDriver = await command.prompt.choice('¿Qué driver de autorización por defecto? (AUTHZ_DRIVER; puedes cambiarlo por entorno)', [
+        { name: 'database', message: 'database — SQL propio, sin infraestructura extra (recomendado)' },
+        { name: 'openfga', message: 'openfga — los hechos viven en un servidor OpenFGA (necesita @openfga/sdk)' },
+    ], { default: 'database' });
+    // La outbox del árbol de scopes es OPT-IN (README: «configure no la publica,
+    // porque la outbox es opcional»). Se ofrece porque, sin ella, el consumidor
+    // tenía que copiar el stub a mano; sigue siendo suya y hay que registrar
+    // `sqlScopeOutbox()` en el config para usarla.
+    const withOutbox = await command.prompt.confirm('¿Publicar la migración de la outbox del árbol de scopes? (opt-in; propaga los cambios de árbol en tu misma transacción)', { default: false });
     await codemods.updateRcFile((rcFile) => {
         rcFile
             .addProvider('@jantstack/adonis-authz/authz_provider')
@@ -18,8 +39,12 @@ export async function configure(command) {
             name: 'appAccess',
             path: '@jantstack/adonis-authz/app_access_middleware',
         },
+        {
+            name: 'resourceAccess',
+            path: '@jantstack/adonis-authz/resource_access_middleware',
+        },
     ]);
-    await codemods.defineEnvVariables({ AUTHZ_DRIVER: 'database' });
+    await codemods.defineEnvVariables({ AUTHZ_DRIVER: defaultDriver });
     await codemods.defineEnvValidations({
         variables: {
             AUTHZ_DRIVER: `Env.schema.string.optional()`,
@@ -37,7 +62,18 @@ export async function configure(command) {
             fileName: `${new Date().getTime()}_create_authz_tables.ts`,
         },
     });
+    if (withOutbox) {
+        // El stub trae su propio destino fijo (`exports({ to: ... })`), sin plantilla.
+        await codemods.makeUsingStub(stubsRoot, 'scopes_outbox_migration.stub', {});
+    }
     command.logger.success('Autorización configurada.');
+    if (defaultDriver === 'openfga') {
+        command.logger.info('Driver por defecto: openfga. Instala su peer: npm i @openfga/sdk');
+        command.logger.info('Y aprovisiona el store: node ace openfga:provision');
+    }
+    if (withOutbox) {
+        command.logger.info('Outbox publicada. Registra `sqlScopeOutbox()` en config/authorization.ts (scopes.outbox y en el driver).');
+    }
     command.logger.info('Siguiente paso: node ace migration:run');
 }
 //# sourceMappingURL=configure.js.map

package/build/configure.js.map

@@ -1 +1 @@
-{"version":3,"file":"configure.js","sourceRoot":"","sources":["../configure.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAkB;IAChD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAA;IAE/C,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAW,EAAE,EAAE;QAC1C,MAAM;aACH,WAAW,CAAC,wCAAwC,CAAC;aACrD,UAAU,CAAC,kCAAkC,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,CAAC,kBAAkB,CAAC,OAAO,EAAE;QACzC;YACE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,+CAA+C;SACtD;KACF,CAAC,CAAA;IAEF,MAAM,QAAQ,CAAC,kBAAkB,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/D,MAAM,QAAQ,CAAC,oBAAoB,CAAC;QAClC,SAAS,EAAE;YACT,YAAY,EAAE,8BAA8B;YAC5C,WAAW,EAAE,2DAA2D;YACxE,gBAAgB,EAAE,8BAA8B;YAChD,gBAAgB,EAAE,8BAA8B;SACjD;QACD,cAAc,EAAE,sCAAsC;KACvD,CAAC,CAAA;IAEF,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,2BAA2B,EAAE,EAAE,CAAC,CAAA;IACxE,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;IAElE,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,gBAAgB,EAAE;QACxD,SAAS,EAAE;YACT,MAAM,EAAE,qBAAqB;YAC7B,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,yBAAyB;SAC3D;KACF,CAAC,CAAA;IAEF,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACnD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAA;AAC/D,CAAC"}
+{"version":3,"file":"configure.js","sourceRoot":"","sources":["../configure.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAkB;IAChD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAA;IAE/C,6EAA6E;IAC7E,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAC/C,uFAAuF,EACvF;QACE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gEAAgE,EAAE;QAC/F,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,2EAA2E,EAAE;KAC1G,EACD,EAAE,OAAO,EAAE,UAAU,EAAE,CACxB,CAAA;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,+CAA+C;IAC/C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAC7C,yHAAyH,EACzH,EAAE,OAAO,EAAE,KAAK,EAAE,CACnB,CAAA;IAED,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAW,EAAE,EAAE;QAC1C,MAAM;aACH,WAAW,CAAC,wCAAwC,CAAC;aACrD,UAAU,CAAC,kCAAkC,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,CAAC,kBAAkB,CAAC,OAAO,EAAE;QACzC;YACE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,+CAA+C;SACtD;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,oDAAoD;SAC3D;KACF,CAAC,CAAA;IAEF,MAAM,QAAQ,CAAC,kBAAkB,CAAC,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAA;IAClE,MAAM,QAAQ,CAAC,oBAAoB,CAAC;QAClC,SAAS,EAAE;YACT,YAAY,EAAE,8BAA8B;YAC5C,WAAW,EAAE,2DAA2D;YACxE,gBAAgB,EAAE,8BAA8B;YAChD,gBAAgB,EAAE,8BAA8B;SACjD;QACD,cAAc,EAAE,sCAAsC;KACvD,CAAC,CAAA;IAEF,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,2BAA2B,EAAE,EAAE,CAAC,CAAA;IACxE,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAA;IAElE,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,gBAAgB,EAAE;QACxD,SAAS,EAAE;YACT,MAAM,EAAE,qBAAqB;YAC7B,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,yBAAyB;SAC3D;KACF,CAAC,CAAA;IAEF,IAAI,UAAU,EAAE,CAAC;QACf,+EAA+E;QAC/E,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACnD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAA;QACvF,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,IAAI,CACjB,0GAA0G,CAC3G,CAAA;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAA;AAC/D,CAAC"}

package/build/index.d.ts

@@ -6,8 +6,8 @@ export { AuthorizationManager, DEFAULT_MAX_SCOPES, DEFAULT_MAX_DESCENDANTS, MAX_
 export type { AuthorizationView, ForRequestOptions } from './src/manager.js';
 export { defineConfig } from './src/define_config.js';
 export type { AuthorizationConfig } from './src/define_config.js';
-export { syncAuthzCatalog, diffAuthzCatalog, catalogInSync, formatCatalogDiff, formatScopedRoles, formatShadowedRoles, runCatalogDiff, syncCatalogs, } from './src/catalog.js';
-export type { SyncCatalogOptions, CatalogDiff, CatalogLinkRef, CatalogSource } from './src/catalog.js';
+export { syncAuthzCatalog, diffAuthzCatalog, catalogInSync, formatCatalogDiff, formatScopedRoles, formatShadowedRoles, runCatalogDiff, syncCatalogs, } from './src/catalog/catalog.js';
+export type { SyncCatalogOptions, CatalogDiff, CatalogLinkRef, CatalogSource } from './src/catalog/catalog.js';
 /**
  * Memo del catálogo (2.1): se revalida contra la versión compartida
  * `authz_catalog_version`, que `syncAuthzCatalog` sube como última sentencia
@@ -16,8 +16,8 @@ export type { SyncCatalogOptions, CatalogDiff, CatalogLinkRef, CatalogSource } f
  * final: todos los procesos lo ven) — `bumpAuthzCatalogVersion(trx)` exige
  * ese trx; `invalidateAuthzCatalog()` solo alcanza a este proceso.
  */
-export { CatalogCache, invalidateAuthzCatalog, bumpAuthzCatalogVersion, withAuthzCatalogWrite, readAuthzCatalogVersion, CATALOG_VERSION_TABLE, GLOBAL_OWNER_KEY, } from './src/catalog_cache.js';
-export type { CatalogCacheOptions, CatalogRevalidate, CatalogView, CatalogRoleRef, CatalogPermission, AuthzCatalogWriteOptions, CatalogVersionClient, CatalogVersionTransaction, } from './src/catalog_cache.js';
+export { CatalogCache, invalidateAuthzCatalog, bumpAuthzCatalogVersion, withAuthzCatalogWrite, readAuthzCatalogVersion, CATALOG_VERSION_TABLE, GLOBAL_OWNER_KEY, } from './src/catalog/catalog_cache.js';
+export type { CatalogCacheOptions, CatalogRevalidate, CatalogView, CatalogRoleRef, CatalogPermission, AuthzCatalogWriteOptions, CatalogVersionClient, CatalogVersionTransaction, } from './src/catalog/catalog_cache.js';
 /**
  * Memo de ancestros de una instancia (2.1), solo para el camino de lectura.
  * `authorization.forRequest()` ya lo aplica por ti.
@@ -30,23 +30,51 @@ export { memoizeAncestors } from './src/memoize_ancestors.js';
  */
 export { hierarchicalScopeResolver } from './src/hierarchical_resolver.js';
 export type { HierarchicalResolverOptions, NodeOf, ScopeNode } from './src/hierarchical_resolver.js';
-export { sqlDescendantsOf } from './src/sql_descendants.js';
-export type { SqlDescendantsOptions } from './src/sql_descendants.js';
+export { sqlDescendantsOf, sqlScopeEdges } from './src/sql_descendants.js';
+export type { SqlDescendantsOptions, SqlScopeEdgesOptions } from './src/sql_descendants.js';
+/**
+ * **La outbox del árbol** (3b-2d): `sqlScopeOutbox` implementa el puerto
+ * `ScopeOutbox` sobre Lucid, con la tabla de
+ * `stubs/scopes_outbox_migration.stub` (cópiala a tus migraciones:
+ * `configure` no la publica, porque la outbox es opt-in). Con
+ * `scopes.outbox` declarada, `authorization.scopes.attached/moved/detached`
+ * ENCOLAN el cambio en tu transacción en vez de escribir en el backend, y lo
+ * aplica `node ace authz:scopes:relay`. Cualquier implementación del puerto
+ * vale: el paquete no impone tabla.
+ */
+export { sqlScopeOutbox } from './src/scope_outbox.js';
+export type { SqlScopeOutboxOptions } from './src/scope_outbox.js';
 /**
  * El backend de autorización no respondió (503). Tipo PROPIO a propósito: sin
  * él escaparía el error del SDK del driver, y distinguir "backend caído"
  * obligaría a importar ese SDK — acoplando el call-site al backend que este
  * paquete existe para abstraer.
  */
-export { AuthorizationBackendError, AuthorizationBackendTimeoutError, ScopeResolverError, InvalidIdentityError, InvalidSlugError, AuthorizationConfigError, AuthorizationInternalError, UnknownScopeError, NoScopeResolverError, UnknownRoleError, UnknownPermissionError, CatalogConflictError, RoleIsNotAccessError, ScopeCycleError, PurgeIncompleteError, StoreNotEmptyError, ActorRequiredError, NotWithinError, WithinRequiredError, WithinRootForbiddenError, TooManyScopesError, UnsupportedDialectError, ScopeTooDeepError, UnsupportedOperationError, NoDescendantsResolverError, ViewExpiredError, RoleNotVisibleError, AmbiguousRoleError, RoleImmutableError, RoleLevelAboveOwnerError, RoleNotAssignableAtError, PermissionNotDelegableError, RankExceededError, } from './src/errors.js';
+export { AuthorizationBackendError, AuthorizationBackendTimeoutError, ScopeResolverError, InvalidIdentityError, InvalidSlugError, AuthorizationConfigError, AuthorizationInternalError, UnknownScopeError, NoScopeResolverError, UnknownRoleError, UnknownPermissionError, CatalogConflictError, RoleIsNotAccessError, ScopeCycleError, PurgeIncompleteError, WriteConflictError, ActorRequiredError, NotWithinError, WithinRequiredError, WithinRootForbiddenError, TooManyScopesError, TooManyLocalRolesError, MassPurgeRefusedError, PruneInterruptedError, UnsupportedDialectError, ScopeTooDeepError, UnsupportedOperationError, NoDescendantsResolverError, ViewExpiredError, RoleNotVisibleError, AmbiguousRoleError, RoleImmutableError, RoleLevelAboveOwnerError, RoleNotAssignableAtError, PermissionNotDelegableError, RankExceededError, ModelTooLargeError, RelationConfigError, RelationTypeUnknownError, RelationUnknownError, ScopeTreeDriftError, ScopeDriftUnguardedError, AuthorizationFrozenError, FreezeHeldError, MassReconcileRefusedError, ReconcileTooLargeError, } from './src/errors.js';
 /**
  * Validación de identidad y de slugs (422). La aplica el manager en cada
  * llamada y los drivers por defensa en profundidad; se exporta para que un
  * consumidor valide en su borde (un formulario, un importador) con la MISMA
  * regla y no con una copia.
  */
-export { assertIdentity, assertSubject, assertScope, assertValidSlug, assertExpiresAt, assertNoSlugCollisions, normalizeRoleQuery, scopeKey, scopeFromKey, IDENTITY_LIMITS, MAX_SLUG_LENGTH, RESERVED_SLUGS, RESERVED_SLUG_PREFIXES, } from './src/identity.js';
+export { assertIdentity, assertSubject, assertScope, assertValidSlug, assertExpiresAt, assertNoSlugCollisions, normalizeRoleQuery, scopeKey, scopeFromKey, IDENTITY_LIMITS, MAX_SLUG_LENGTH, RESERVED_SLUGS, RESERVED_SLUG_PREFIXES, RESERVED_FACTS_TYPES, } from './src/identity.js';
 export type { IdentityParts, SlugKind } from './src/identity.js';
+/**
+ * ReBAC genérico (Fase 4, `relations/`). El puerto `RelationsDriver` vive en
+ * `./src/types.js` (el contrato); aquí salen la API declarativa
+ * `defineRelationsConfig`, la fachada `RelationsManager` (F-05 + `assertWrite`
+ * + `actor`) y los tipos de la config.
+ */
+export { defineRelationsConfig } from './src/relations/define_relations_config.js';
+export type { RelationsConfig, RelationsConfigSpec, RelationsDatabaseOptions, RelationObjectTypeSpec, RelationObjectRelationSpec, } from './src/relations/define_relations_config.js';
+export { RelationsManager } from './src/relations/manager.js';
+export type { RelationsManagerOptions } from './src/relations/manager.js';
+export { reconcileRelations } from './src/relations/reconcile.js';
+export type { RelationsReconcileOptions, RelationsReconcileReport } from './src/relations/reconcile.js';
+export { saveRelationsConfig, readRelationsConfig, readRelationsConfigSpec, } from './src/relations_config_store.js';
+export type { RelationsConfigStoreOptions } from './src/relations_config_store.js';
+export { DatabaseRelationsDriver } from './src/drivers/database_relations_driver.js';
+export type { DatabaseRelationsDriverOptions } from './src/drivers/database_relations_driver.js';
 export { resolveGrantExpiry, isActiveExpiry, sameInstant } from './src/expiry.js';
 export { DatabaseAuthorizationDriver, APP_SCOPE_DB_UUID } from './src/drivers/database_driver.js';
 export type { DatabaseDriverOptions } from './src/drivers/database_driver.js';
@@ -55,8 +83,9 @@ export type { DatabaseDriverOptions } from './src/drivers/database_driver.js';
  * `@jantstack/adonis-authz/openfga`, que es lo único que importa el peer
  * opcional `@openfga/sdk`. Un consumidor solo-database arranca sin él (D9).
  */
-export { APP_SCOPE, APP_SCOPE_TYPE } from './src/types.js';
-export type { AuthorizationDriver, AuthorizationDriverFactory, AuthorizedScopes, AuthzWriteEvent, AuthzCatalogWriteEvent, CatalogPermissionSpec, CatalogRole, CatalogRoleSpec, CatalogSpec, ScopedRoleChanges, ScopedRoleSpec, DenyOptions, DenyRef, ExcludedSubtree, GrantOptions, GrantOutcome, HolderTypeMap, RoleQuery, ScopeChainResolver, ScopeDescendantsResolver, ScopeDetachOutcome, ScopedWriteOptions, ScopeRef, ScopeType, SubjectRef, WriteOptions, } from './src/types.js';
+export { APP_SCOPE, APP_SCOPE_TYPE, DEFAULT_RECONCILE_MAX_TUPLES } from './src/types.js';
+export type { AuthorizationDriver, AuthorizationDriverFactory, AuthorizedScopes, AuthzWriteEvent, AuthzCatalogWriteEvent, CatalogPermissionSpec, CatalogRole, CatalogRoleSpec, CatalogSpec, ScopedRoleChanges, ScopedRoleSpec, DenyOptions, DenyRef, ExcludedSubtree, GrantOptions, GrantOutcome, HolderTypeMap, ReconcileCounts, ReconcileFact, ReconcileFactPage, ReconcileFactsEnumerator, ReconcileOptions, ReconcileReport, ReconcileSkip, ReconcileSource, RoleQuery, ScopeChainResolver, ScopeDescendantsResolver, ScopeEdge, ScopeEdgePage, ScopeEdgesEnumerator, ScopedWriteOptions, ScopeRef, ScopeType, SubjectRef, WriteOptions, RelationsDriver, RelationsDriverCapabilities, RelObject, RelSubject, RelUserset, RelationRef, RelationWriteEvent, RelationWriteOptions, RelationPage, RelationObjectsPage, RelationSubjectsPage, RelationTuple, RelationTuplePage, } from './src/types.js';
+export { isRelUserset } from './src/types.js';
 export { default as AuthzRole } from './src/models/authz_role.js';
 export { default as AuthzPermission } from './src/models/authz_permission.js';
 export { default as AuthzRolePermission } from './src/models/authz_role_permission.js';

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACtK,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEtG;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAA;AAE/B;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,YAAY,EAAE,2BAA2B,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,YAAY,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAErE;;;;;GAKG;AACH,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,iBAAiB,CAAA;AAExB;;;;;GAKG;AACH,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,sBAAsB,GACvB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEjF,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACjG,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAE7E;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC1D,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,WAAW,EACX,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,OAAO,EACP,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,SAAS,EACT,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,UAAU,EACV,YAAY,GACb,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACtK,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAE9G;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,gCAAgC,CAAA;AAEvC;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,YAAY,EAAE,2BAA2B,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AACpG,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC1E,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAE3F;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAElE;;;;;GAKG;AACH,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EACf,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,iBAAiB,CAAA;AAExB;;;;;GAKG;AACH,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAA;AAClF,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACjE,YAAY,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAA;AAIvG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iCAAiC,CAAA;AACxC,YAAY,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAA;AAIlF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAA;AACpF,YAAY,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEjF,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACjG,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAE7E;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAA;AACxF,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,WAAW,EACX,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,OAAO,EACP,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,eAAe,EACf,SAAS,EACT,kBAAkB,EAClB,wBAAwB,EACxB,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,UAAU,EACV,YAAY,EACZ,eAAe,EACf,2BAA2B,EAC3B,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,EACpB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}

package/build/index.js

@@ -4,7 +4,7 @@
  */
 export { AuthorizationManager, DEFAULT_MAX_SCOPES, DEFAULT_MAX_DESCENDANTS, MAX_SCOPE_BOUND, DEFAULT_VIEW_MAX_AGE_MS, expandExcludedSubtrees } from './src/manager.js';
 export { defineConfig } from './src/define_config.js';
-export { syncAuthzCatalog, diffAuthzCatalog, catalogInSync, formatCatalogDiff, formatScopedRoles, formatShadowedRoles, runCatalogDiff, syncCatalogs, } from './src/catalog.js';
+export { syncAuthzCatalog, diffAuthzCatalog, catalogInSync, formatCatalogDiff, formatScopedRoles, formatShadowedRoles, runCatalogDiff, syncCatalogs, } from './src/catalog/catalog.js';
 /**
  * Memo del catálogo (2.1): se revalida contra la versión compartida
  * `authz_catalog_version`, que `syncAuthzCatalog` sube como última sentencia
@@ -13,7 +13,7 @@ export { syncAuthzCatalog, diffAuthzCatalog, catalogInSync, formatCatalogDiff, f
  * final: todos los procesos lo ven) — `bumpAuthzCatalogVersion(trx)` exige
  * ese trx; `invalidateAuthzCatalog()` solo alcanza a este proceso.
  */
-export { CatalogCache, invalidateAuthzCatalog, bumpAuthzCatalogVersion, withAuthzCatalogWrite, readAuthzCatalogVersion, CATALOG_VERSION_TABLE, GLOBAL_OWNER_KEY, } from './src/catalog_cache.js';
+export { CatalogCache, invalidateAuthzCatalog, bumpAuthzCatalogVersion, withAuthzCatalogWrite, readAuthzCatalogVersion, CATALOG_VERSION_TABLE, GLOBAL_OWNER_KEY, } from './src/catalog/catalog_cache.js';
 /**
  * Memo de ancestros de una instancia (2.1), solo para el camino de lectura.
  * `authorization.forRequest()` ya lo aplica por ti.
@@ -25,21 +25,49 @@ export { memoizeAncestors } from './src/memoize_ancestors.js';
  * `descendantsOf` opt-in (CTE recursiva, PG y SQLite) para `authorizedScopes`.
  */
 export { hierarchicalScopeResolver } from './src/hierarchical_resolver.js';
-export { sqlDescendantsOf } from './src/sql_descendants.js';
+export { sqlDescendantsOf, sqlScopeEdges } from './src/sql_descendants.js';
+/**
+ * **La outbox del árbol** (3b-2d): `sqlScopeOutbox` implementa el puerto
+ * `ScopeOutbox` sobre Lucid, con la tabla de
+ * `stubs/scopes_outbox_migration.stub` (cópiala a tus migraciones:
+ * `configure` no la publica, porque la outbox es opt-in). Con
+ * `scopes.outbox` declarada, `authorization.scopes.attached/moved/detached`
+ * ENCOLAN el cambio en tu transacción en vez de escribir en el backend, y lo
+ * aplica `node ace authz:scopes:relay`. Cualquier implementación del puerto
+ * vale: el paquete no impone tabla.
+ */
+export { sqlScopeOutbox } from './src/scope_outbox.js';
 /**
  * El backend de autorización no respondió (503). Tipo PROPIO a propósito: sin
  * él escaparía el error del SDK del driver, y distinguir "backend caído"
  * obligaría a importar ese SDK — acoplando el call-site al backend que este
  * paquete existe para abstraer.
  */
-export { AuthorizationBackendError, AuthorizationBackendTimeoutError, ScopeResolverError, InvalidIdentityError, InvalidSlugError, AuthorizationConfigError, AuthorizationInternalError, UnknownScopeError, NoScopeResolverError, UnknownRoleError, UnknownPermissionError, CatalogConflictError, RoleIsNotAccessError, ScopeCycleError, PurgeIncompleteError, StoreNotEmptyError, ActorRequiredError, NotWithinError, WithinRequiredError, WithinRootForbiddenError, TooManyScopesError, UnsupportedDialectError, ScopeTooDeepError, UnsupportedOperationError, NoDescendantsResolverError, ViewExpiredError, RoleNotVisibleError, AmbiguousRoleError, RoleImmutableError, RoleLevelAboveOwnerError, RoleNotAssignableAtError, PermissionNotDelegableError, RankExceededError, } from './src/errors.js';
+export { AuthorizationBackendError, AuthorizationBackendTimeoutError, ScopeResolverError, InvalidIdentityError, InvalidSlugError, AuthorizationConfigError, AuthorizationInternalError, UnknownScopeError, NoScopeResolverError, UnknownRoleError, UnknownPermissionError, CatalogConflictError, RoleIsNotAccessError, ScopeCycleError, PurgeIncompleteError, WriteConflictError, ActorRequiredError, NotWithinError, WithinRequiredError, WithinRootForbiddenError, TooManyScopesError, TooManyLocalRolesError, MassPurgeRefusedError, PruneInterruptedError, UnsupportedDialectError, ScopeTooDeepError, UnsupportedOperationError, NoDescendantsResolverError, ViewExpiredError, RoleNotVisibleError, AmbiguousRoleError, RoleImmutableError, RoleLevelAboveOwnerError, RoleNotAssignableAtError, PermissionNotDelegableError, RankExceededError, ModelTooLargeError, RelationConfigError, RelationTypeUnknownError, RelationUnknownError, ScopeTreeDriftError, ScopeDriftUnguardedError, AuthorizationFrozenError, FreezeHeldError, MassReconcileRefusedError, ReconcileTooLargeError, } from './src/errors.js';
 /**
  * Validación de identidad y de slugs (422). La aplica el manager en cada
  * llamada y los drivers por defensa en profundidad; se exporta para que un
  * consumidor valide en su borde (un formulario, un importador) con la MISMA
  * regla y no con una copia.
  */
-export { assertIdentity, assertSubject, assertScope, assertValidSlug, assertExpiresAt, assertNoSlugCollisions, normalizeRoleQuery, scopeKey, scopeFromKey, IDENTITY_LIMITS, MAX_SLUG_LENGTH, RESERVED_SLUGS, RESERVED_SLUG_PREFIXES, } from './src/identity.js';
+export { assertIdentity, assertSubject, assertScope, assertValidSlug, assertExpiresAt, assertNoSlugCollisions, normalizeRoleQuery, scopeKey, scopeFromKey, IDENTITY_LIMITS, MAX_SLUG_LENGTH, RESERVED_SLUGS, RESERVED_SLUG_PREFIXES, RESERVED_FACTS_TYPES, } from './src/identity.js';
+/**
+ * ReBAC genérico (Fase 4, `relations/`). El puerto `RelationsDriver` vive en
+ * `./src/types.js` (el contrato); aquí salen la API declarativa
+ * `defineRelationsConfig`, la fachada `RelationsManager` (F-05 + `assertWrite`
+ * + `actor`) y los tipos de la config.
+ */
+export { defineRelationsConfig } from './src/relations/define_relations_config.js';
+export { RelationsManager } from './src/relations/manager.js';
+export { reconcileRelations } from './src/relations/reconcile.js';
+// La config de relaciones PERSISTIDA (🟡3): API de PLATAFORMA (bajo el gate de
+// versión, invariante 14). La CONSUME `authz:relations:reconcile` (config del
+// destino, para la deriva del modelo fusionado en --dry-run).
+export { saveRelationsConfig, readRelationsConfig, readRelationsConfigSpec, } from './src/relations_config_store.js';
+// El driver `database` de relaciones (el consumidor lo cablea en
+// `relations.drivers` de config/authorization.ts). El driver `openfga` de
+// relaciones NO sale de aquí: vive en el subpath `/openfga` (peer opcional).
+export { DatabaseRelationsDriver } from './src/drivers/database_relations_driver.js';
 export { resolveGrantExpiry, isActiveExpiry, sameInstant } from './src/expiry.js';
 export { DatabaseAuthorizationDriver, APP_SCOPE_DB_UUID } from './src/drivers/database_driver.js';
 /**
@@ -47,7 +75,8 @@ export { DatabaseAuthorizationDriver, APP_SCOPE_DB_UUID } from './src/drivers/da
  * `@jantstack/adonis-authz/openfga`, que es lo único que importa el peer
  * opcional `@openfga/sdk`. Un consumidor solo-database arranca sin él (D9).
  */
-export { APP_SCOPE, APP_SCOPE_TYPE } from './src/types.js';
+export { APP_SCOPE, APP_SCOPE_TYPE, DEFAULT_RECONCILE_MAX_TUPLES } from './src/types.js';
+export { isRelUserset } from './src/types.js';
 export { default as AuthzRole } from './src/models/authz_role.js';
 export { default as AuthzPermission } from './src/models/authz_permission.js';
 export { default as AuthzRolePermission } from './src/models/authz_role_permission.js';

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEtK,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,kBAAkB,CAAA;AAGzB;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAY/B;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAE1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAG3D;;;;;GAKG;AACH,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,iBAAiB,CAAA;AAExB;;;;;GAKG;AACH,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,sBAAsB,GACvB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEjF,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AAGjG;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AA8B1D,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEtK,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,0BAA0B,CAAA;AAGjC;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AAYvC;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAE1E,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAG1E;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAGtD;;;;;GAKG;AACH,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EACf,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,iBAAiB,CAAA;AAExB;;;;;GAKG;AACH,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAA;AAG1B;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAA;AAQlF,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAEjE,+EAA+E;AAC/E,8EAA8E;AAC9E,8DAA8D;AAC9D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iCAAiC,CAAA;AAExC,iEAAiE;AACjE,0EAA0E;AAC1E,6EAA6E;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAA;AAEpF,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEjF,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AAGjG;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAA;AAoDxF,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}

package/build/providers/authz_provider.d.ts

@@ -1,13 +1,37 @@
 import type { ApplicationService } from '@adonisjs/core/types';
 import { AuthorizationManager } from '../src/manager.js';
+import { RelationsManager } from '../src/relations/manager.js';
+import type { AuthorizationConfig } from '../src/define_config.js';
 declare module '@adonisjs/core/types' {
     interface ContainerBindings {
         'authz.manager': AuthorizationManager;
+        'authz.relations': RelationsManager;
     }
 }
 /**
- * Registra el manager de autorización como singleton del contenedor,
- * construido desde `config/authorization.ts` de la aplicación.
+ * **Construye el `RelationsManager` de servicio desde el config** (Fase 4-8) —
+ * el análogo de resolver el `AuthorizationManager` del provider, pero para el
+ * puerto de relaciones. Función PURA (no toca el contenedor) para tener su caso
+ * sin montar la app: recibe el config y devuelve el manager cableado.
+ *
+ * El driver ACTIVO sale de `relations.drivers[relations.default ?? default]`
+ * (los drivers de relaciones se nombran igual que los de roles); la config, de
+ * `relations.config` (la MISMA que capturan las factories de `drivers`, así que
+ * la frontera F-05 del manager y la del driver son la misma). `requireActor` se
+ * hereda del config de roles: la política de auditoría es una sola.
+ *
+ * Sin `relations.config` o sin el driver activo lanza con la receta: las
+ * relaciones son OPT-IN y este servicio solo existe si el consumidor las
+ * declaró.
+ */
+export declare function buildRelationsManager(config: AuthorizationConfig): Promise<RelationsManager>;
+/**
+ * Registra los managers de autorización como singletons del contenedor,
+ * construidos desde `config/authorization.ts` de la aplicación:
+ *
+ *  - `authz.manager`: el motor de roles (siempre).
+ *  - `authz.relations`: el motor de ReBAC (solo si el consumidor declaró
+ *    `relations.config`; si no, resolverlo lanza con la receta).
  */
 export default class AuthzProvider {
     protected app: ApplicationService;

package/build/providers/authz_provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz_provider.d.ts","sourceRoot":"","sources":["../../providers/authz_provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,QAAQ,sBAAsB,CAAC;IACpC,UAAiB,iBAAiB;QAChC,eAAe,EAAE,oBAAoB,CAAA;KACtC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,OAAO,OAAO,aAAa;IACpB,SAAS,CAAC,GAAG,EAAE,kBAAkB;gBAAvB,GAAG,EAAE,kBAAkB;IAE7C,QAAQ;CAWT"}
+{"version":3,"file":"authz_provider.d.ts","sourceRoot":"","sources":["../../providers/authz_provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAElE,OAAO,QAAQ,sBAAsB,CAAC;IACpC,UAAiB,iBAAiB;QAChC,eAAe,EAAE,oBAAoB,CAAA;QACrC,iBAAiB,EAAE,gBAAgB,CAAA;KACpC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAqBlG;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,OAAO,OAAO,aAAa;IACpB,SAAS,CAAC,GAAG,EAAE,kBAAkB;gBAAvB,GAAG,EAAE,kBAAkB;IAE7C,QAAQ;CAqBT"}

package/build/providers/authz_provider.js

@@ -1,7 +1,46 @@
 import { AuthorizationManager } from '../src/manager.js';
+import { RelationsManager } from '../src/relations/manager.js';
 /**
- * Registra el manager de autorización como singleton del contenedor,
- * construido desde `config/authorization.ts` de la aplicación.
+ * **Construye el `RelationsManager` de servicio desde el config** (Fase 4-8) —
+ * el análogo de resolver el `AuthorizationManager` del provider, pero para el
+ * puerto de relaciones. Función PURA (no toca el contenedor) para tener su caso
+ * sin montar la app: recibe el config y devuelve el manager cableado.
+ *
+ * El driver ACTIVO sale de `relations.drivers[relations.default ?? default]`
+ * (los drivers de relaciones se nombran igual que los de roles); la config, de
+ * `relations.config` (la MISMA que capturan las factories de `drivers`, así que
+ * la frontera F-05 del manager y la del driver son la misma). `requireActor` se
+ * hereda del config de roles: la política de auditoría es una sola.
+ *
+ * Sin `relations.config` o sin el driver activo lanza con la receta: las
+ * relaciones son OPT-IN y este servicio solo existe si el consumidor las
+ * declaró.
+ */
+export async function buildRelationsManager(config) {
+    const relations = config.relations;
+    if (!relations?.config) {
+        throw new Error('No hay `relations.config` en config/authorization.ts: declara `relations: { config: ' +
+            'defineRelationsConfig({...}), drivers: {...} }` para usar el servicio de relaciones ' +
+            '(@jantstack/adonis-authz/services/relations).');
+    }
+    const driverKey = relations.default ?? config.default;
+    const factory = relations.drivers?.[driverKey];
+    if (!factory) {
+        throw new Error(`No hay driver de relaciones '${driverKey}' en \`relations.drivers\` de config/authorization.ts ` +
+            `(declara la factory bajo esa clave, o fija \`relations.default\`).`);
+    }
+    const driver = await factory();
+    return new RelationsManager(driver, relations.config, {
+        requireActor: config.requireActor,
+    });
+}
+/**
+ * Registra los managers de autorización como singletons del contenedor,
+ * construidos desde `config/authorization.ts` de la aplicación:
+ *
+ *  - `authz.manager`: el motor de roles (siempre).
+ *  - `authz.relations`: el motor de ReBAC (solo si el consumidor declaró
+ *    `relations.config`; si no, resolverlo lanza con la receta).
  */
 export default class AuthzProvider {
     app;
@@ -16,6 +55,13 @@ export default class AuthzProvider {
             }
             return new AuthorizationManager(config);
         });
+        this.app.container.singleton('authz.relations', async () => {
+            const config = this.app.config.get('authorization');
+            if (!config) {
+                throw new Error('Falta config/authorization.ts — ejecuta: node ace configure @jantstack/adonis-authz');
+            }
+            return buildRelationsManager(config);
+        });
     }
 }
 //# sourceMappingURL=authz_provider.js.map

package/build/providers/authz_provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz_provider.js","sourceRoot":"","sources":["../../providers/authz_provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAQxD;;;GAGG;AACH,MAAM,CAAC,OAAO,OAAO,aAAa;IACV;IAAtB,YAAsB,GAAuB;QAAvB,QAAG,GAAH,GAAG,CAAoB;IAAG,CAAC;IAEjD,QAAQ;QACN,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;YAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAA;YACH,CAAC;YACD,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAA;QACzC,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"authz_provider.js","sourceRoot":"","sources":["../../providers/authz_provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAU9D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAA2B;IACrE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;IAClC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,sFAAsF;YACpF,sFAAsF;YACtF,+CAA+C,CAClD,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAA;IACrD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAA;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,gCAAgC,SAAS,wDAAwD;YAC/F,oEAAoE,CACvE,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAA;IAC9B,OAAO,IAAI,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;QACpD,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,OAAO,OAAO,aAAa;IACV;IAAtB,YAAsB,GAAuB;QAAvB,QAAG,GAAH,GAAG,CAAoB;IAAG,CAAC;IAEjD,QAAQ;QACN,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;YACvD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;YAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAA;YACH,CAAC;YACD,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAA;QACzC,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;YAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAA;YACH,CAAC;YACD,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAA;QACtC,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/build/services/relations.d.ts

@@ -0,0 +1,14 @@
+import type { RelationsManager } from '../src/relations/manager.js';
+/**
+ * Singleton del motor de relaciones (ReBAC), resuelto del contenedor cuando la
+ * app ha booteado — el análogo de `services/main` para el puerto
+ * `RelationsDriver`. Solo existe si el consumidor declaró `relations.config` en
+ * `config/authorization.ts`; si no, resolverlo lanza con la receta.
+ *
+ *   import relations from '@jantstack/adonis-authz/services/relations'
+ *   await relations.relate(user, 'viewer', { type: 'document', id }, APP_SCOPE)
+ *   await relations.check(user, 'viewer', { type: 'document', id }, APP_SCOPE)
+ */
+declare let relations: RelationsManager;
+export { relations as default };
+//# sourceMappingURL=relations.d.ts.map

package/build/services/relations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations.d.ts","sourceRoot":"","sources":["../../services/relations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAEnE;;;;;;;;;GASG;AACH,QAAA,IAAI,SAAS,EAAE,gBAAgB,CAAA;AAM/B,OAAO,EAAE,SAAS,IAAI,OAAO,EAAE,CAAA"}

package/build/services/relations.js

@@ -0,0 +1,17 @@
+import app from '@adonisjs/core/services/app';
+/**
+ * Singleton del motor de relaciones (ReBAC), resuelto del contenedor cuando la
+ * app ha booteado — el análogo de `services/main` para el puerto
+ * `RelationsDriver`. Solo existe si el consumidor declaró `relations.config` en
+ * `config/authorization.ts`; si no, resolverlo lanza con la receta.
+ *
+ *   import relations from '@jantstack/adonis-authz/services/relations'
+ *   await relations.relate(user, 'viewer', { type: 'document', id }, APP_SCOPE)
+ *   await relations.check(user, 'viewer', { type: 'document', id }, APP_SCOPE)
+ */
+let relations;
+await app.booted(async () => {
+    relations = await app.container.make('authz.relations');
+});
+export { relations as default };
+//# sourceMappingURL=relations.js.map

package/build/services/relations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations.js","sourceRoot":"","sources":["../../services/relations.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,6BAA6B,CAAA;AAG7C;;;;;;;;;GASG;AACH,IAAI,SAA2B,CAAA;AAE/B,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;IAC1B,SAAS,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;AACzD,CAAC,CAAC,CAAA;AAEF,OAAO,EAAE,SAAS,IAAI,OAAO,EAAE,CAAA"}

package/build/src/{catalog.d.ts → catalog/catalog.d.ts}

@@ -1,4 +1,4 @@
-import type { CatalogRoleRef, CatalogSpec, ScopeChainResolver, ScopeType } from './types.js';
+import type { CatalogProjection, CatalogProjectionReport, CatalogProjectionSnapshot, CatalogRoleRef, CatalogSpec, ScopeChainResolver, ScopeType } from '../types.js';
 /**
  * `assignableAt` de un permiso tal como se GUARDA (`authz_permissions.assignable_at`):
  * JSON ordenado y sin duplicados, o `null` = cualquier nivel. Ordenado para
@@ -60,6 +60,12 @@ export interface CatalogSyncReport {
         role: CatalogRoleRef;
         permission: string;
     }>;
+    /**
+     * Lo que movió la proyección del driver, si se pasó una (3b-2a · A5).
+     * Ausente sin `projection`. Nunca un booleano: una proyección que no dice
+     * cuánto escribió y cuánto borró no se vigila.
+     */
+    projection?: CatalogProjectionReport;
 }
 export interface SyncCatalogOptions {
     /**
@@ -76,6 +82,22 @@ export interface SyncCatalogOptions {
      * cliente SQL: el sync corre en el arranque de un despliegue (D15).
      */
     timeoutMs?: number;
+    /**
+     * Proyección DERIVADA del catálogo en el backend de un driver (3b-2a · A5;
+     * regla del catálogo reescrita, panel 2 cruce 7). Se INYECTA en vez de
+     * importarse: este módulo es la ruta de un consumidor solo-database y no
+     * puede tirar del SDK de OpenFGA (regla 3 de `check_purity.mjs`).
+     *
+     * Con ella, el sync (a) comprueba ANTES de escribir que el catálogo que va
+     * a quedar es publicable en ese backend —cotas de nombre y techo del
+     * modelo, A3/A4—, y (b) rehace la proyección con el catálogo ya
+     * CONFIRMADO. En ese orden: la fuente de verdad son las tablas `authz_*`,
+     * y una proyección que se adelantara a la transacción concedería lo que la
+     * base no respalda. Si la proyección falla, el catálogo ya está escrito y
+     * lo que queda es deriva reconstruible (`authz:reconcile`), no una
+     * decisión inventada.
+     */
+    projection?: CatalogProjection;
 }
 /**
  * Sincroniza un catálogo (roles + permisos + vínculos) a las tablas `authz_*`.
@@ -97,6 +119,23 @@ export interface SyncCatalogOptions {
  * driver externo (openfga) materializa aparte solo los hechos.
  */
 export declare function syncAuthzCatalog(catalog: CatalogSpec, options?: SyncCatalogOptions): Promise<CatalogSyncReport>;
+/**
+ * **La foto del catálogo que se PROYECTA** (3b-2a · A5), leída de `authz_*`.
+ *
+ * Es el catálogo ENTERO, no el spec que se está sincronizando: la proyección
+ * es un espejo y lo que sobra en el backend solo se sabe comparando contra
+ * todo. `syncAuthzCatalog` la lee DENTRO de su transacción (coherente con lo
+ * que acaba de escribir) y `authz:reconcile` fuera, contra la base: las dos
+ * tienen que construir exactamente la misma foto, o reconcile "arreglaría" en
+ * cada pasada lo que el sync acaba de dejar bien. Por eso está aquí y no
+ * duplicada en el driver.
+ *
+ * `source` es cualquier cosa con `from(tabla)` (el `db` de Lucid o una
+ * transacción) y `sql` envuelve cada consulta con el deadline de quien llama.
+ */
+export declare function readCatalogProjectionSnapshot(source: {
+    from(table: string): any;
+}, sql?: <T>(operation: string, fn: () => Promise<T>) => Promise<T>): Promise<CatalogProjectionSnapshot>;
 export interface CatalogLinkRef {
     role: string;
     scopeType: ScopeType;
@@ -223,7 +262,7 @@ export declare function formatScopedRoles(diff: CatalogDiff): string[];
  * mientras duren, ese slug es 422 `E_AUTHZ_AMBIGUOUS_ROLE` en la cadena de
  * su owner y hay que operar por `{ uuid }` (o purgar uno de los dos).
  */
-export declare function formatShadowedRoles(diff: CatalogDiff): string[];
+export declare function formatShadowedRoles(diff: Pick<CatalogDiff, 'shadowedByGlobal' | 'shadowedByAncestor'>): string[];
 /** Fábricas de catálogo tal como se declaran en `config.catalogs`. */
 export type CatalogSource = () => Promise<CatalogSpec> | CatalogSpec;
 /**

package/build/src/catalog/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../../src/catalog/catalog.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,SAAS,EACV,MAAM,aAAa,CAAA;AAOpB;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGjF;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAO5E;AAED,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,eAAmB,CAAA;AAkBrD,sIAAsI;AACtI,wBAAgB,kBAAkB,CAChC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,EAC5C,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,SAAS,SAAS,EAAE,GAAG,IAAI,GAClC,IAAI,CAON;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,MAAM,CAAA;AAEpC,kFAAkF;AAClF,eAAO,MAAM,0BAA0B,OAAQ,CAAA;AAE/C;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,gBAAgB,EAAE,cAAc,EAAE,CAAA;IAClC;;;;;;;;OAQG;IACH,sBAAsB,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,cAAc,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3E;;;;OAIG;IACH,UAAU,CAAC,EAAE,uBAAuB,CAAA;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,iBAAiB,CAAA;CAC/B;AAgED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CAyC5B;AA6PD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE;IAAE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,EACpC,GAAG,GAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAA4B,GACzF,OAAO,CAAC,yBAAyB,CAAC,CAmBpC;AAID,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,SAAS,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,gDAAgD;IAChD,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,CAAA;KAAE,CAAC,CAAA;IAC3D,uDAAuD;IACvD,YAAY,EAAE,cAAc,EAAE,CAAA;IAC9B,+FAA+F;IAC/F,UAAU,EAAE,cAAc,EAAE,CAAA;IAC5B,mDAAmD;IACnD,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC/F;;;;;OAKG;IACH,sBAAsB,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAClI;;;;OAIG;IACH,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACzE;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAC/E;;;;;;;;;OASG;IACH,gBAAgB,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9E;;;;;OAKG;IACH,kBAAkB,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpG;;;;OAIG;IACH,sBAAsB,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACzG;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,kBAAkB,CAAA;CAAO,GACtE,OAAO,CAAC,WAAW,CAAC,CAoItB;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAWxD;AAqID,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CAmC7D;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CAE7D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,kBAAkB,GAAG,oBAAoB,CAAC,GAAG,MAAM,EAAE,CAiBhH;AAED,sEAAsE;AACtE,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,GAAG,WAAW,CAAA;AAyCpE;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,aAAa,EAAE,EACzB,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3E,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAuE/C;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,aAAa,EAAE,EACzB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,iBAAiB,CAAC,CAWhD"}