@jantstack/adonis-authz 2.4.0-alpha.1 → 2.4.0-alpha.10

package/build/commands/authz_scopes_requeue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz_scopes_requeue.js","sourceRoot":"","sources":["../../commands/authz_scopes_requeue.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAIvD,sFAAsF;AACtF,SAAS,KAAK,CAAC,IAA4B;IACzC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IACvB,MAAM,KAAK,GAAG,CAAC,CAAyC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAA;IACxF,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAA;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACrE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,OAAO,IAAI,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,EAAE,CAAA;AACvF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwE;IAInG,MAAM,KAAK,GAA+E,EAAE,CAAA;IAC5F,MAAM,IAAI,GAAG,CAAC,KAA0B,EAAE,QAA8B,EAAE,EAAE;QAC1E,KAAK,CAAC,IAAI,CAAC;YACT,KAAK;YACL,OAAO,EACL,GAAG,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,uBAAuB;gBAC7F,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,4FAA4F;gBACtH,yFAAyF;SAC5F,CAAC,CAAA;QACF,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;QAC1G,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC;gBACT,KAAK;gBACL,OAAO,EAAE,4CAA4C,QAAQ,CAAC,OAAO,CAAC,MAAM,+DAA+D;aAC5I,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAA;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC7D,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,SAAS;YAChB,OAAO,EACL,wFAAwF;gBACxF,2GAA2G;gBAC3G,wCAAwC;SAC3C,CAAC,CAAA;QACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAO,CAAA;IAC5B,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,OAAO;YACd,OAAO,EACL,qHAAqH;gBACrH,uHAAuH;gBACvH,oFAAoF;SACvF,CAAC,CAAA;QACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM;QAAE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACrF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IACvG,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,SAAS;YAChB,OAAO,EACL,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,2FAA2F;gBACpH,kHAAkH;SACrH,CAAC,CAAA;QACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAC/B,CAAC;IACD,mFAAmF;IACnF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;IAC1B,IAAI,KAAK,GAAG,IAAI,CAAA;IAChB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;aAC7F,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACrC,KAAK,GAAG,KAAK,CAAA;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,KAAK,CAAC,MAAM,IAAI,iCAAiC,MAAM,KAAK,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAA;QACnJ,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrC,KAAK,GAAG,KAAK,CAAA;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC3F,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACnC,KAAK,GAAG,KAAK,CAAA;YACb,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QACvH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;QAAE,KAAK,GAAG,KAAK,CAAA;IAClE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,SAAS;YAChB,OAAO,EACL,qHAAqH;gBACrH,mEAAmE;SACtE,CAAC,CAAA;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC;QACT,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACpC,OAAO,EAAE,KAAK;YACZ,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,6DAA6D;YACtF,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,yGAAyG;KAClK,CAAC,CAAA;IACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,WAAW;IACzD,MAAM,CAAC,WAAW,GAAG,sBAAsB,CAAA;IAC3C,MAAM,CAAC,WAAW,GAAG,+GAA+G,CAAA;IAEpI,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,IAAI;KACf,CAAA;IAsBD,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,MAA4B;QAC1C,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC1C,OAAO,MAAM;aACV,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;aAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;aACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,GAAG;QACP,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oHAAoH,CAAC,CAAA;YACvI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACtE,IAAI,MAAuC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,mBAAmB,CAAC,GAAG,EAAE;gBAC1D,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI;gBAC1B,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI;gBAC1B,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;aAChF,CAAC,CAAA;YACF,MAAM,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,EAAE,IAAI,KAAK,yBAAyB;gBAAE,MAAM,KAAK,CAAA;YAC1D,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;QACrD,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACtE,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;IACtC,CAAC;;AAjDO;IAHP,KAAK,CAAC,KAAK,CAAC;QACX,WAAW,EAAE,2FAA2F;KACzG,CAAC;;8CAC8B;AAKxB;IAHP,KAAK,CAAC,OAAO,CAAC;QACb,WAAW,EAAE,4GAA4G;KAC1H,CAAC;;iDACgC;AAK1B;IAHP,KAAK,CAAC,OAAO,CAAC;QACb,WAAW,EAAE,kHAAkH;KAChI,CAAC;;iDACgC;AAK1B;IAHP,KAAK,CAAC,MAAM,CAAC;QACZ,WAAW,EAAE,kGAAkG;KAChH,CAAC;;uDACqC"}

package/build/commands/authz_unfreeze.d.ts

@@ -7,8 +7,13 @@ import type { FreezeStatus } from '../src/manager.js';
  * sin montar un ace.
  *
  * Reglas:
- *  - Sin freeze vivo ⇒ no-op en verde (idempotente: descongelar lo
- *    descongelado no es un incidente).
+ *  - Sin freeze (nunca hubo, o ya levantado: motivo `null`) ⇒ no-op en verde
+ *    (idempotente: descongelar lo descongelado no es un incidente).
+ *  - Ventana CADUCADA (2.4.0-alpha.10: motivo puesto y `untilMs` en el pasado,
+ *    `lastFreezeStatus().expired`) ⇒ `expired`: ERROR con cuándo venció, exit
+ *    ≠ 0, y el comando limpia la fila para que el segundo `unfreeze` sea
+ *    no-op. No es «nada que levantar»: es un intervalo en el que la flota
+ *    escribió — en un cutover, escrituras que el motor nuevo no vio.
  *  - Freeze de OPERADOR ⇒ se levanta (este comando es su otra mitad).
  *  - Freeze de OTRO dueño (`reconcile`, `platform`) ⇒ NO se levanta sin
  *    `--fence`: levantar la barrera de una pasada viva es exactamente el
@@ -16,8 +21,11 @@ import type { FreezeStatus } from '../src/manager.js';
  *    («ese proceso murió sin lease»), y tiene que coincidir con el fence
  *    vivo — un fence viejo no levanta la ventana de otro.
  */
-export declare function unfreezePlan(status: FreezeStatus | null, fence: number | undefined): {
-    action: 'noop' | 'lift' | 'refuse';
+export declare function unfreezePlan(status: (FreezeStatus & {
+    expired?: boolean;
+    checkedAtMs?: number;
+}) | null, fence: number | undefined, nowMs?: number): {
+    action: 'noop' | 'lift' | 'refuse' | 'expired';
     message: string;
 };
 /**

package/build/commands/authz_unfreeze.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz_unfreeze.d.ts","sourceRoot":"","sources":["../../commands/authz_unfreeze.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,YAAY,GAAG,IAAI,EAC3B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA0BzD;AAED;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IACpD,MAAM,CAAC,WAAW,SAAmB;IACrC,MAAM,CAAC,WAAW,SAAqF;IAEvG,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAKO,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IAE3B,GAAG;CAqBV"}
+{"version":3,"file":"authz_unfreeze.d.ts","sourceRoot":"","sources":["../../commands/authz_unfreeze.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,CAAC,YAAY,GAAG;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,IAAI,EAC3E,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,CAAC,EAAE,MAAM,GACb;IAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA2CrE;AAED;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IACpD,MAAM,CAAC,WAAW,SAAmB;IACrC,MAAM,CAAC,WAAW,SAAqF;IAEvG,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAKO,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IAE3B,GAAG;CAwEV"}

package/build/commands/authz_unfreeze.js

@@ -14,8 +14,13 @@ import { BaseCommand, flags } from '@adonisjs/core/ace';
  * sin montar un ace.
  *
  * Reglas:
- *  - Sin freeze vivo ⇒ no-op en verde (idempotente: descongelar lo
- *    descongelado no es un incidente).
+ *  - Sin freeze (nunca hubo, o ya levantado: motivo `null`) ⇒ no-op en verde
+ *    (idempotente: descongelar lo descongelado no es un incidente).
+ *  - Ventana CADUCADA (2.4.0-alpha.10: motivo puesto y `untilMs` en el pasado,
+ *    `lastFreezeStatus().expired`) ⇒ `expired`: ERROR con cuándo venció, exit
+ *    ≠ 0, y el comando limpia la fila para que el segundo `unfreeze` sea
+ *    no-op. No es «nada que levantar»: es un intervalo en el que la flota
+ *    escribió — en un cutover, escrituras que el motor nuevo no vio.
  *  - Freeze de OPERADOR ⇒ se levanta (este comando es su otra mitad).
  *  - Freeze de OTRO dueño (`reconcile`, `platform`) ⇒ NO se levanta sin
  *    `--fence`: levantar la barrera de una pasada viva es exactamente el
@@ -23,10 +28,26 @@ import { BaseCommand, flags } from '@adonisjs/core/ace';
  *    («ese proceso murió sin lease»), y tiene que coincidir con el fence
  *    vivo — un fence viejo no levanta la ventana de otro.
  */
-export function unfreezePlan(status, fence) {
+export function unfreezePlan(status, fence, nowMs) {
     if (status === null) {
         return { action: 'noop', message: 'No hay ningún freeze vivo: nada que levantar.' };
     }
+    // **La ventana CADUCADA** (2.4.0-alpha.10): va antes que `--fence` porque el
+    // incidente es el mismo lo pida quien lo pida — no queda barrera que
+    // levantar, queda un intervalo en el que la flota ESCRIBIÓ.
+    if (status.expired === true) {
+        const when = status.untilMs === null ? '?' : new Date(status.untilMs).toISOString();
+        const at = nowMs ?? status.checkedAtMs;
+        const since = status.untilMs !== null && at !== undefined ? ` (hace ${Math.max(0, at - status.untilMs)} ms)` : '';
+        return {
+            action: 'expired',
+            message: `La ventana de ${status.holder} (${status.reason}, fence ${status.fence}) CADUCÓ el ${when}${since} y nadie ` +
+                `la cerró: desde entonces las escrituras volvieron a entrar en toda la flota. En un cutover eso son ` +
+                `escrituras que el motor nuevo no vio si la migración ya había corrido: no des el cutover por cerrado — ` +
+                `repite la migración (authz:reconcile) dentro de una ventana sin caducidad (authz:freeze sin --lease-ms) ` +
+                `antes de cambiar de driver.`,
+        };
+    }
     if (fence !== undefined && fence !== status.fence) {
         return {
             action: 'refuse',
@@ -63,7 +84,9 @@ export default class AuthzUnfreeze extends BaseCommand {
     };
     async run() {
         const { default: authorization } = await import('../services/main.js');
-        const status = await authorization.freezeStatus();
+        // `lastFreezeStatus()` y no `freezeStatus()` (2.4.0-alpha.10): este es el
+        // único lector que tiene que ver también la ventana CADUCADA.
+        const status = await authorization.lastFreezeStatus();
         const plan = unfreezePlan(status, this.fence);
         if (plan.action === 'noop') {
             this.logger.success(plan.message);
@@ -74,13 +97,55 @@ export default class AuthzUnfreeze extends BaseCommand {
             this.exitCode = 1;
             return;
         }
-        const lifted = await authorization.unfreeze({ fence: status.fence, holder: status.holder });
-        if (!lifted) {
-            // Entre el SELECT y el UPDATE alguien lo levantó o venció: no es un error.
-            this.logger.success('El freeze ya no estaba (lo levantó su dueño o venció su lease).');
+        // Levantar (o limpiar la caducada) es CONDICIONAL por token: si otro proceso
+        // cambió la fila entre la lectura y el UPDATE no se toca nada. Cierre del
+        // auditor de alpha.10 (⚪ 4): la letra la decide el RESULTADO, releyendo la
+        // fila — hasta el cierre la rama caducada afirmaba «la fila queda limpia»
+        // sin mirar el booleano, y la de levantar decía «o venció su lease» en verde
+        // (vencer no hace fallar el UPDATE: `releaseFreeze` no mira `untilMs`).
+        const done = await authorization.unfreeze({ fence: status.fence, holder: status.holder });
+        const after = done ? null : await authorization.lastFreezeStatus();
+        const ahora = (s) => `${s.holder} (${s.reason}, fence ${s.fence}, ${s.expired ? 'CADUCADA' : 'viva'})`;
+        // Cierre-2 · C4: si el UPDATE no casó pero la fila releída es LA MISMA (holder,
+        // fence y motivo), nadie la cambió: la letra no puede afirmar «otro proceso».
+        const unchanged = after !== null && after.fence === status.fence && after.holder === status.holder && after.reason === status.reason;
+        if (plan.action === 'expired') {
+            this.logger.error(plan.message);
+            if (done) {
+                this.logger.info('La fila queda limpia: un segundo authz:unfreeze ya no repite este error.');
+            }
+            else if (after === null) {
+                this.logger.warning('La fila ya la había limpiado otro proceso entre la lectura y la limpieza: no se ha tocado nada.');
+            }
+            else if (unchanged) {
+                this.logger.error(`La fila NO se ha limpiado y la fila NO cambió: sigue siendo ${ahora(after)}, pero el UPDATE condicional por ` +
+                    'su token no casó (rama «token no casa»). Es un defecto del paquete, no una carrera: repórtalo con esta línea.');
+            }
+            else {
+                this.logger.error(`La fila NO se ha limpiado: entre la lectura y la limpieza otro proceso la cambió y ahora es ${ahora(after)}. ` +
+                    'Vuelve a ejecutar authz:unfreeze para ver su estado.');
+            }
+            this.exitCode = 1;
+            return;
+        }
+        if (done) {
+            this.logger.success(plan.message);
+            return;
+        }
+        if (after === null) {
+            // Nadie lo sostiene ya: otro lo levantó entre medias. El objetivo del operador se cumple.
+            this.logger.success('El freeze ya no estaba: otro proceso lo levantó entre la lectura y el levantamiento. Nada que hacer.');
+            return;
+        }
+        if (unchanged) {
+            this.logger.error(`No se ha levantado nada y la fila NO cambió: sigue siendo ${ahora(after)}, pero el UPDATE condicional por su ` +
+                'token no casó (rama «token no casa»). Es un defecto del paquete, no una carrera: repórtalo con esta línea.');
+            this.exitCode = 1;
             return;
         }
-        this.logger.success(plan.message);
+        this.logger.error(`No se ha levantado nada: entre la lectura y el levantamiento la fila cambió y ahora es ${ahora(after)}. ` +
+            'Vuelve a ejecutar authz:unfreeze para decidir sobre ese freeze.');
+        this.exitCode = 1;
     }
 }
 __decorate([

package/build/commands/authz_unfreeze.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz_unfreeze.js","sourceRoot":"","sources":["../../commands/authz_unfreeze.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAIvD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA2B,EAC3B,KAAyB;IAEzB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAA;IACrF,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QAClD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,OAAO,EACL,oBAAoB,MAAM,CAAC,KAAK,0BAA0B,KAAK,6BAA6B;gBAC5F,8EAA8E;SACjF,CAAA;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,OAAO,EACL,iDAAiD,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,KAAK;gBACrF,+FAA+F;gBAC/F,uBAAuB,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gCAAgC,kBAAkB;gBACxG,kDAAkD,MAAM,CAAC,KAAK,GAAG;SACpE,CAAA;IACH,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,aAAa,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,KAAK,0CAA0C;KACvH,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IACpD,MAAM,CAAC,WAAW,GAAG,gBAAgB,CAAA;IACrC,MAAM,CAAC,WAAW,GAAG,kFAAkF,CAAA;IAEvG,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,IAAI;KACf,CAAA;IAOD,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACtE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,CAAA;QACjD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACjC,OAAM;QACR,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC/B,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAC7F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,2EAA2E;YAC3E,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAA;YACtF,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACnC,CAAC;;AAtBO;IAHP,KAAK,CAAC,MAAM,CAAC;QACZ,WAAW,EAAE,gGAAgG;KAC9G,CAAC;;4CAC+B"}
+{"version":3,"file":"authz_unfreeze.js","sourceRoot":"","sources":["../../commands/authz_unfreeze.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAIvD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA2E,EAC3E,KAAyB,EACzB,KAAc;IAEd,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAA;IACrF,CAAC;IACD,6EAA6E;IAC7E,qEAAqE;IACrE,4DAA4D;IAC5D,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;QACnF,MAAM,EAAE,GAAG,KAAK,IAAI,MAAM,CAAC,WAAW,CAAA;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;QACjH,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EACL,iBAAiB,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,KAAK,eAAe,IAAI,GAAG,KAAK,WAAW;gBAC7G,qGAAqG;gBACrG,yGAAyG;gBACzG,0GAA0G;gBAC1G,6BAA6B;SAChC,CAAA;IACH,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QAClD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,OAAO,EACL,oBAAoB,MAAM,CAAC,KAAK,0BAA0B,KAAK,6BAA6B;gBAC5F,8EAA8E;SACjF,CAAA;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,OAAO,EACL,iDAAiD,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,KAAK;gBACrF,+FAA+F;gBAC/F,uBAAuB,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gCAAgC,kBAAkB;gBACxG,kDAAkD,MAAM,CAAC,KAAK,GAAG;SACpE,CAAA;IACH,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,aAAa,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,KAAK,0CAA0C;KACvH,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,WAAW;IACpD,MAAM,CAAC,WAAW,GAAG,gBAAgB,CAAA;IACrC,MAAM,CAAC,WAAW,GAAG,kFAAkF,CAAA;IAEvG,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,IAAI;KACf,CAAA;IAOD,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACtE,0EAA0E;QAC1E,8DAA8D;QAC9D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,EAAE,CAAA;QACrD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACjC,OAAM;QACR,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC/B,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,6EAA6E;QAC7E,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,6EAA6E;QAC7E,wEAAwE;QACxE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,gBAAgB,EAAE,CAAA;QAClE,MAAM,KAAK,GAAG,CAAC,CAA4B,EAAE,EAAE,CAC7C,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAA;QACnF,gFAAgF;QAChF,8EAA8E;QAC9E,MAAM,SAAS,GACb,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,MAAO,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAO,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,MAAO,CAAC,MAAM,CAAA;QACvH,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC/B,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAA;YAC9F,CAAC;iBAAM,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,iGAAiG,CAAC,CAAA;YACxH,CAAC;iBAAM,IAAI,SAAS,EAAE,CAAC;gBACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+DAA+D,KAAK,CAAC,KAAK,CAAC,mCAAmC;oBAC5G,+GAA+G,CAClH,CAAA;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+FAA+F,KAAK,CAAC,KAAK,CAAC,IAAI;oBAC7G,sDAAsD,CACzD,CAAA;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACjC,OAAM;QACR,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,0FAA0F;YAC1F,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,sGAAsG,CAAC,CAAA;YAC3H,OAAM;QACR,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,6DAA6D,KAAK,CAAC,KAAK,CAAC,sCAAsC;gBAC7G,4GAA4G,CAC/G,CAAA;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0FAA0F,KAAK,CAAC,KAAK,CAAC,IAAI;YACxG,iEAAiE,CACpE,CAAA;QACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;IACnB,CAAC;;AAzEO;IAHP,KAAK,CAAC,MAAM,CAAC;QACZ,WAAW,EAAE,gGAAgG;KAC9G,CAAC;;4CAC+B"}

package/build/commands/main.d.ts

@@ -1,14 +1,17 @@
-/**
- * Comandos ace del paquete. Se registran con:
- *   node ace configure @jantstack/adonis-authz
- */
-export { default as OpenFgaProvision } from './openfga_provision.js';
-export { default as AuthzCatalogDiff } from './authz_catalog_diff.js';
-export { default as AuthzCatalogSync } from './authz_catalog_sync.js';
-export { default as AuthzCatalogPruneOrphans } from './authz_catalog_prune_orphans.js';
-export { default as AuthzScopesRelay } from './authz_scopes_relay.js';
-export { default as AuthzReconcile } from './authz_reconcile.js';
-export { default as AuthzRelationsReconcile } from './authz_relations_reconcile.js';
-export { default as AuthzFreeze } from './authz_freeze.js';
-export { default as AuthzUnfreeze } from './authz_unfreeze.js';
+import type { CommandMetaData } from '@adonisjs/core/types/ace';
+import OpenFgaProvision from './openfga_provision.js';
+import AuthzCatalogDiff from './authz_catalog_diff.js';
+import AuthzCatalogSync from './authz_catalog_sync.js';
+import AuthzCatalogPruneOrphans from './authz_catalog_prune_orphans.js';
+import AuthzScopesRelay from './authz_scopes_relay.js';
+import AuthzScopesRequeue from './authz_scopes_requeue.js';
+import AuthzReconcile from './authz_reconcile.js';
+import AuthzRelationsReconcile from './authz_relations_reconcile.js';
+import AuthzFreeze from './authz_freeze.js';
+import AuthzUnfreeze from './authz_unfreeze.js';
+export { OpenFgaProvision, AuthzCatalogDiff, AuthzCatalogSync, AuthzCatalogPruneOrphans, AuthzScopesRelay, AuthzScopesRequeue, AuthzReconcile, AuthzRelationsReconcile, AuthzFreeze, AuthzUnfreeze, };
+/** Contrato de loader de ace (`LoadersContract.getMetaData`). */
+export declare function getMetaData(): Promise<CommandMetaData[]>;
+/** Contrato de loader de ace (`LoadersContract.getCommand`): la clase, o `null` si el nombre no es nuestro. */
+export declare function getCommand(metaData: CommandMetaData): Promise<any>;
 //# sourceMappingURL=main.d.ts.map

package/build/commands/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../commands/main.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,gCAAgC,CAAA;AACnF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../commands/main.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,gBAAgB,MAAM,wBAAwB,CAAA;AACrD,OAAO,gBAAgB,MAAM,yBAAyB,CAAA;AACtD,OAAO,gBAAgB,MAAM,yBAAyB,CAAA;AACtD,OAAO,wBAAwB,MAAM,kCAAkC,CAAA;AACvE,OAAO,gBAAgB,MAAM,yBAAyB,CAAA;AACtD,OAAO,kBAAkB,MAAM,2BAA2B,CAAA;AAC1D,OAAO,cAAc,MAAM,sBAAsB,CAAA;AACjD,OAAO,uBAAuB,MAAM,gCAAgC,CAAA;AACpE,OAAO,WAAW,MAAM,mBAAmB,CAAA;AAC3C,OAAO,aAAa,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,aAAa,GACd,CAAA;AAgBD,iEAAiE;AACjE,wBAAgB,WAAW,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAExD;AAED,+GAA+G;AAC/G,wBAAgB,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAElE"}

package/build/commands/main.js

@@ -1,14 +1,62 @@
 /**
- * Comandos ace del paquete. Se registran con:
- *   node ace configure @jantstack/adonis-authz
+ * **El loader de ace de los comandos del paquete** (2.4.0-alpha.4). Se
+ * registra con `node ace configure @jantstack/adonis-authz`, que escribe en el
+ * `adonisrc.ts` del consumidor:
+ *
+ *   commands: [() => import('@jantstack/adonis-authz/commands')]
+ *
+ * y ace trata **el módulo importado como el loader**: `Kernel.boot()` llama
+ * `getMetaData()` y `getCommand(meta)` sobre el namespace del módulo, sin
+ * desenvolver `default` (mismo contrato que `@adonisjs/core/commands` y
+ * `@adonisjs/lucid/commands`, que leen un `commands.json` generado por el
+ * assembler; aquí no hay assembler, así que el loader es un `ListLoader`
+ * sobre las diez clases (nueve hasta alpha.4) y no hay índice que generar).
+ *
+ * Hasta alpha.3 este fichero re-exportaba las nueve clases y NADA más, de
+ * modo que en un consumidor configurado con `node ace configure` **`node ace`
+ * entero reventaba** al arrancar (`TypeError: loaderInstance.getMetaData is
+ * not a function`), no solo `openfga:provision`. Ningún caso lo vio porque
+ * ninguno registraba el barrel como lo registra `createAceKernel`
+ * (`tests/commands.spec.ts` · C-1 lo hace desde alpha.4).
+ *
+ * Las re-exportaciones con nombre se MANTIENEN (quien importe una clase
+ * suelta sigue funcionando). Lo que NO vale desde alpha.4 es envolver el
+ * módulo en un `ListLoader(Object.values(m))`: `Object.values` incluye ahora
+ * las dos funciones y `ListLoader.getMetaData()` llama `serialize()` sobre
+ * cada valor. Se registra el módulo directamente, como escribe `configure`.
+ * Y NO se exporta `default`: ace no lo cargaría.
  */
-export { default as OpenFgaProvision } from './openfga_provision.js';
-export { default as AuthzCatalogDiff } from './authz_catalog_diff.js';
-export { default as AuthzCatalogSync } from './authz_catalog_sync.js';
-export { default as AuthzCatalogPruneOrphans } from './authz_catalog_prune_orphans.js';
-export { default as AuthzScopesRelay } from './authz_scopes_relay.js';
-export { default as AuthzReconcile } from './authz_reconcile.js';
-export { default as AuthzRelationsReconcile } from './authz_relations_reconcile.js';
-export { default as AuthzFreeze } from './authz_freeze.js';
-export { default as AuthzUnfreeze } from './authz_unfreeze.js';
+import { ListLoader } from '@adonisjs/core/ace';
+import OpenFgaProvision from './openfga_provision.js';
+import AuthzCatalogDiff from './authz_catalog_diff.js';
+import AuthzCatalogSync from './authz_catalog_sync.js';
+import AuthzCatalogPruneOrphans from './authz_catalog_prune_orphans.js';
+import AuthzScopesRelay from './authz_scopes_relay.js';
+import AuthzScopesRequeue from './authz_scopes_requeue.js';
+import AuthzReconcile from './authz_reconcile.js';
+import AuthzRelationsReconcile from './authz_relations_reconcile.js';
+import AuthzFreeze from './authz_freeze.js';
+import AuthzUnfreeze from './authz_unfreeze.js';
+export { OpenFgaProvision, AuthzCatalogDiff, AuthzCatalogSync, AuthzCatalogPruneOrphans, AuthzScopesRelay, AuthzScopesRequeue, AuthzReconcile, AuthzRelationsReconcile, AuthzFreeze, AuthzUnfreeze, };
+/** Los diez (nueve hasta alpha.4; `authz:scopes:requeue` desde alpha.5), en el orden en que `node ace list` los enseña. */
+const loader = new ListLoader([
+    OpenFgaProvision,
+    AuthzCatalogDiff,
+    AuthzCatalogSync,
+    AuthzCatalogPruneOrphans,
+    AuthzScopesRelay,
+    AuthzScopesRequeue,
+    AuthzReconcile,
+    AuthzRelationsReconcile,
+    AuthzFreeze,
+    AuthzUnfreeze,
+]);
+/** Contrato de loader de ace (`LoadersContract.getMetaData`). */
+export function getMetaData() {
+    return loader.getMetaData();
+}
+/** Contrato de loader de ace (`LoadersContract.getCommand`): la clase, o `null` si el nombre no es nuestro. */
+export function getCommand(metaData) {
+    return loader.getCommand(metaData);
+}
 //# sourceMappingURL=main.js.map

package/build/commands/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../../commands/main.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,gCAAgC,CAAA;AACnF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../commands/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAE/C,OAAO,gBAAgB,MAAM,wBAAwB,CAAA;AACrD,OAAO,gBAAgB,MAAM,yBAAyB,CAAA;AACtD,OAAO,gBAAgB,MAAM,yBAAyB,CAAA;AACtD,OAAO,wBAAwB,MAAM,kCAAkC,CAAA;AACvE,OAAO,gBAAgB,MAAM,yBAAyB,CAAA;AACtD,OAAO,kBAAkB,MAAM,2BAA2B,CAAA;AAC1D,OAAO,cAAc,MAAM,sBAAsB,CAAA;AACjD,OAAO,uBAAuB,MAAM,gCAAgC,CAAA;AACpE,OAAO,WAAW,MAAM,mBAAmB,CAAA;AAC3C,OAAO,aAAa,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,aAAa,GACd,CAAA;AAED,2HAA2H;AAC3H,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;IAC5B,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,wBAAwB;IACxB,gBAAgB;IAChB,kBAAkB;IAClB,cAAc;IACd,uBAAuB;IACvB,WAAW;IACX,aAAa;CACP,CAAC,CAAA;AAET,iEAAiE;AACjE,MAAM,UAAU,WAAW;IACzB,OAAO,MAAM,CAAC,WAAW,EAAE,CAAA;AAC7B,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,UAAU,CAAC,QAAyB;IAClD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;AACpC,CAAC"}

package/build/commands/openfga_provision.d.ts

@@ -27,10 +27,54 @@ import { CommandOptions } from '@adonisjs/core/types/ace';
 export default class OpenFgaProvision extends BaseCommand {
     static commandName: string;
     static description: string;
+    /**
+     * **Bootstrap sin base: `startApp: false`, y el comando BOOTEA la app por su
+     * cuenta hasta `boot()`** (2.4.0-alpha.4, opción B del panel; el único de
+     * los nueve con `startApp: false`, a propósito).
+     *
+     * `this.app.config` NO existe hasta `app.boot()`: `Application.init()` no
+     * llama a `ConfigManager.process()`, `boot()` sí (`@adonisjs/application`
+     * 9.0.1; el docblock de `get config()` dice «after init» y es falso). Y el
+     * ignitor de ace solo hace `boot()`+`start()` con `startApp: true`. Hasta
+     * alpha.3 esto leía `this.app.config.get(...)` sobre `undefined`:
+     * `TypeError` en la primera línea de `run()`, en cualquier consumidor.
+     *
+     * Por qué NO `startApp: true` (opción A, la que recomendaba COGNITIV):
+     * `start()` ejecuta el `start()`/`ready()` de TODOS los providers del
+     * consumidor y sus preloads (`start/routes.ts`, `start/kernel.ts`…) —
+     * medido: un `ready()` que consulta la base mata este comando antes de
+     * `run()` con la base ausente, que es exactamente el escenario en el que
+     * corre; un preload que importe `services/relations` construye el driver
+     * de relaciones, que pide el `OPENFGA_STORE_ID` que este comando existe
+     * para producir (circular); y `app_provider.ready()` exige
+     * `config/encryption.ts` válido. Lo que este comando necesita es SOLO el
+     * config, y eso lo da `boot()` (≈80 ms: `config/*` + `register()`/`boot()`
+     * de los providers). Ver `prepare()`.
+     */
     static options: CommandOptions;
     url: string | undefined;
     storeId: string | undefined;
     name: string | undefined;
+    /**
+     * Arranca la app hasta `boot()` — sin `start()` — para que `config/*`
+     * exista. Va en `prepare()` y no en `run()` porque `BaseCommand.exec()`
+     * encadena `prepare()` → `interact()` → `run()` dentro del mismo `try`:
+     * el fallo se reporta igual y `run()` queda limpio de ciclo de vida.
+     *
+     * Las guardas de estado NO son decorativas: `Application.boot()` es un
+     * no-op SILENCIOSO si el estado no es `initiated` (⚪ 9 del auditor), así
+     * que desde `created` primero `init()`; desde `booted`/`ready` (comando
+     * invocado dentro de una app ya arrancada) no se hace nada: idempotente.
+     * Y si tras eso `app.config` sigue sin existir, se dice y se sale con 1
+     * en vez de repetir el `TypeError` con otro disfraz.
+     *
+     * **Lo que sí exige, escrito**: «antes de que haya base» sigue siendo
+     * verdad (cero conexiones, cero consultas, ningún `start`/`ready`, ningún
+     * preload), pero todo `config/*` tiene que poder IMPORTARSE — un
+     * `config/database.ts` que lance por un `.env` incompleto rompe esto igual
+     * que a cualquier otro comando.
+     */
+    prepare(): Promise<void>;
     run(): Promise<void>;
     /**
      * Los permisos del modelo, o `null` (y exit 1) si no hay ninguno: un modelo
@@ -59,9 +103,11 @@ export declare function permissionsOfCatalogs(config: any): Promise<string[]>;
  * pieza que decide si un store recién aprovisionado acepta tuplas de relación.
  *
  * La fuente es el config (`relations.config`), NO `authz_relations_config` de
- * la base: `openfga:provision` es `startApp: false` (bootstrap sin base) y el
- * config es lo único que tiene cargado — igual que los permisos salen de
- * `catalogs` y no de `authz_permissions`.
+ * la base: `openfga:provision` es bootstrap sin base (`startApp: false`;
+ * arranca hasta `boot()` para cargar `config/*`, que tiene que poder
+ * importarse; no ejecuta `start`/`ready` ni preloads) y el config es lo único
+ * que tiene cargado — igual que los permisos salen de `catalogs` y no de
+ * `authz_permissions`.
  */
 export declare function relationsConfigOf(config: any): {
     objectTypes: readonly any[];

package/build/commands/openfga_provision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openfga_provision.d.ts","sourceRoot":"","sources":["../../commands/openfga_provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,SAAsB;IACxC,MAAM,CAAC,WAAW,SAAoE;IAEtF,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAGO,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAGvB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IAE1B,GAAG;IA2DT;;;;OAIG;YACW,kBAAkB;CAajC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ1E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,GAAG,GAAG;IAAE,WAAW,EAAE,SAAS,GAAG,EAAE,CAAA;CAAE,GAAG,SAAS,CAI1F"}
+{"version":3,"file":"openfga_provision.d.ts","sourceRoot":"","sources":["../../commands/openfga_provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,SAAsB;IACxC,MAAM,CAAC,WAAW,SAAoE;IAEtF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAGO,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAGvB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IAEhC;;;;;;;;;;;;;;;;;;OAkBG;IACG,OAAO;IAaP,GAAG;IAkET;;;;OAIG;YACW,kBAAkB;CAajC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ1E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,GAAG,GAAG;IAAE,WAAW,EAAE,SAAS,GAAG,EAAE,CAAA;CAAE,GAAG,SAAS,CAI1F"}

package/build/commands/openfga_provision.js

@@ -35,10 +35,67 @@ import { BaseCommand, flags } from '@adonisjs/core/ace';
 export default class OpenFgaProvision extends BaseCommand {
     static commandName = 'openfga:provision';
     static description = 'Create an OpenFGA store + write the chassis authorization model';
+    /**
+     * **Bootstrap sin base: `startApp: false`, y el comando BOOTEA la app por su
+     * cuenta hasta `boot()`** (2.4.0-alpha.4, opción B del panel; el único de
+     * los nueve con `startApp: false`, a propósito).
+     *
+     * `this.app.config` NO existe hasta `app.boot()`: `Application.init()` no
+     * llama a `ConfigManager.process()`, `boot()` sí (`@adonisjs/application`
+     * 9.0.1; el docblock de `get config()` dice «after init» y es falso). Y el
+     * ignitor de ace solo hace `boot()`+`start()` con `startApp: true`. Hasta
+     * alpha.3 esto leía `this.app.config.get(...)` sobre `undefined`:
+     * `TypeError` en la primera línea de `run()`, en cualquier consumidor.
+     *
+     * Por qué NO `startApp: true` (opción A, la que recomendaba COGNITIV):
+     * `start()` ejecuta el `start()`/`ready()` de TODOS los providers del
+     * consumidor y sus preloads (`start/routes.ts`, `start/kernel.ts`…) —
+     * medido: un `ready()` que consulta la base mata este comando antes de
+     * `run()` con la base ausente, que es exactamente el escenario en el que
+     * corre; un preload que importe `services/relations` construye el driver
+     * de relaciones, que pide el `OPENFGA_STORE_ID` que este comando existe
+     * para producir (circular); y `app_provider.ready()` exige
+     * `config/encryption.ts` válido. Lo que este comando necesita es SOLO el
+     * config, y eso lo da `boot()` (≈80 ms: `config/*` + `register()`/`boot()`
+     * de los providers). Ver `prepare()`.
+     */
     static options = {
         startApp: false,
     };
+    /**
+     * Arranca la app hasta `boot()` — sin `start()` — para que `config/*`
+     * exista. Va en `prepare()` y no en `run()` porque `BaseCommand.exec()`
+     * encadena `prepare()` → `interact()` → `run()` dentro del mismo `try`:
+     * el fallo se reporta igual y `run()` queda limpio de ciclo de vida.
+     *
+     * Las guardas de estado NO son decorativas: `Application.boot()` es un
+     * no-op SILENCIOSO si el estado no es `initiated` (⚪ 9 del auditor), así
+     * que desde `created` primero `init()`; desde `booted`/`ready` (comando
+     * invocado dentro de una app ya arrancada) no se hace nada: idempotente.
+     * Y si tras eso `app.config` sigue sin existir, se dice y se sale con 1
+     * en vez de repetir el `TypeError` con otro disfraz.
+     *
+     * **Lo que sí exige, escrito**: «antes de que haya base» sigue siendo
+     * verdad (cero conexiones, cero consultas, ningún `start`/`ready`, ningún
+     * preload), pero todo `config/*` tiene que poder IMPORTARSE — un
+     * `config/database.ts` que lance por un `.env` incompleto rompe esto igual
+     * que a cualquier otro comando.
+     */
+    async prepare() {
+        if (this.app.getState() === 'created')
+            await this.app.init();
+        if (this.app.getState() === 'initiated')
+            await this.app.boot();
+        if (!this.app.config) {
+            this.logger.error('config/* no está cargado: openfga:provision bootea la app hasta boot() para leer config/authorization.ts ' +
+                `y tras hacerlo app.config sigue sin existir (estado de la app: ${this.app.getState()}). ` +
+                'Comprueba que la app se puede inicializar y que todo config/* se puede importar.');
+            this.exitCode = 1;
+        }
+    }
     async run() {
+        if (this.exitCode === 1)
+            return;
         const config = this.app.config.get('authorization');
         const apiUrl = this.url ?? config?.openfga?.url;
         if (!apiUrl) {
@@ -48,7 +105,7 @@ export default class OpenFgaProvision extends BaseCommand {
         }
         const { OpenFgaClient } = await import('@openfga/sdk');
         // El subpath `/openfga` es la única puerta al SDK (D9).
-        const { openFgaFactsModel, provisionOpenFgaStore } = await import('../src/openfga.js');
+        const { openFgaFactsModel, provisionOpenFgaStore, assertFactsModelPublishable } = await import('../src/openfga.js');
         // Los holders del consumidor viven en SU config, no en el paquete.
         const holderTypes = config?.holderTypes ?? {};
         // Los PERMISOS del modelo (c2r) salen de los catálogos del config. Se
@@ -60,13 +117,19 @@ export default class OpenFgaProvision extends BaseCommand {
             return;
         // Los tipos de RELACIÓN (ReBAC) que el modelo lleva FUSIONADOS (Fase 4-8):
         // salen del CONFIG estático (`relations.config`), igual que los permisos
-        // salen de `catalogs`. El comando es `startApp: false` (bootstrap del
-        // appliance, ANTES de que haya base) y no puede leer `authz_relations_config`
-        // de la BD; el config sí está cargado. Sin `relations.config` el modelo es
+        // salen de `catalogs`. El comando es bootstrap sin base —`startApp: false`,
+        // arranca hasta `boot()` para cargar `config/*`, que tiene que poder
+        // importarse; no ejecuta `start`/`ready` ni preloads— y no puede leer
+        // `authz_relations_config` de la BD; el config sí. Sin `relations.config` el modelo es
         // facts-only, como hasta ahora. Con él, un store recién aprovisionado ya
         // acepta tuplas de relación sin un `authz:catalog:sync` previo.
         const relations = relationsConfigOf(config);
         if (this.storeId) {
+            // El mismo gate que la rama que CREA el store (L-F): la rama que
+            // ACTUALIZA el modelo es justo donde se toca el techo de bytes, y sin
+            // esto salía como error crudo del SDK con una request ya hecha (⚪ N1
+            // del auditor de alpha.4). Cero requests si no es publicable.
+            assertFactsModelPublishable(holderTypes, permissions, undefined, relations);
             const client = new OpenFgaClient({ apiUrl, storeId: this.storeId });
             const model = await client.writeAuthorizationModel(openFgaFactsModel(holderTypes, permissions, relations));
             this.logger.success('Nuevo authorization model escrito en el store existente.');
@@ -144,9 +207,11 @@ export async function permissionsOfCatalogs(config) {
  * pieza que decide si un store recién aprovisionado acepta tuplas de relación.
  *
  * La fuente es el config (`relations.config`), NO `authz_relations_config` de
- * la base: `openfga:provision` es `startApp: false` (bootstrap sin base) y el
- * config es lo único que tiene cargado — igual que los permisos salen de
- * `catalogs` y no de `authz_permissions`.
+ * la base: `openfga:provision` es bootstrap sin base (`startApp: false`;
+ * arranca hasta `boot()` para cargar `config/*`, que tiene que poder
+ * importarse; no ejecuta `start`/`ready` ni preloads) y el config es lo único
+ * que tiene cargado — igual que los permisos salen de `catalogs` y no de
+ * `authz_permissions`.
  */
 export function relationsConfigOf(config) {
     const objectTypes = config?.relations?.config?.objectTypes;

package/build/commands/openfga_provision.js.map

@@ -1 +1 @@
-{"version":3,"file":"openfga_provision.js","sourceRoot":"","sources":["../../commands/openfga_provision.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAGvD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,GAAG,mBAAmB,CAAA;IACxC,MAAM,CAAC,WAAW,GAAG,iEAAiE,CAAA;IAEtF,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,KAAK;KAChB,CAAA;IAWD,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,OAAO,EAAE,GAAG,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAA;YAChG,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAA;QACtD,wDAAwD;QACxD,MAAM,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;QACtF,mEAAmE;QACnE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAA;QAE7C,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,iBAAiB;QACjB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;QACzD,IAAI,CAAC,WAAW;YAAE,OAAM;QAExB,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,8EAA8E;QAC9E,2EAA2E;QAC3E,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;QAE3C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACnE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAChD,iBAAiB,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,CACvD,CAAA;YACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAA;YAC/E,IAAI,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACvH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QAED,wEAAwE;QACxE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CACtD,MAAM,EACN,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAC3D,WAAW,EACX,WAAW,EACX,SAAS,CACV,CAAA;QACD,IAAI,SAAS;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACvH,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAA;QACjE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAA;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAW;QAC1C,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAA;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,6EAA6E;gBAC3E,qFAAqF;gBACrF,oDAAoD,CACvD,CAAA;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;;AApFO;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;6CAC5C;AAGvB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;;iDACnD;AAG3B;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;;8CAC9D;AAiFlC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAW;IACrD,MAAM,OAAO,GAAoC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAA;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAA;QAC9B,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,WAAW,IAAI,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACjF,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAW;IAC3C,MAAM,WAAW,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAA;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7E,OAAO,EAAE,WAAW,EAAE,CAAA;AACxB,CAAC"}
+{"version":3,"file":"openfga_provision.js","sourceRoot":"","sources":["../../commands/openfga_provision.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAGvD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,GAAG,mBAAmB,CAAA;IACxC,MAAM,CAAC,WAAW,GAAG,iEAAiE,CAAA;IAEtF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,KAAK;KAChB,CAAA;IAWD;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,WAAW;YAAE,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,2GAA2G;gBACzG,kEAAkE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK;gBAC1F,kFAAkF,CACrF,CAAA;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG;QACP,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAM;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,OAAO,EAAE,GAAG,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAA;YAChG,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAA;QACtD,wDAAwD;QACxD,MAAM,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;QACnH,mEAAmE;QACnE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAA;QAE7C,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,iBAAiB;QACjB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;QACzD,IAAI,CAAC,WAAW;YAAE,OAAM;QAExB,2EAA2E;QAC3E,yEAAyE;QACzE,4EAA4E;QAC5E,qEAAqE;QACrE,sEAAsE;QACtE,uFAAuF;QACvF,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;QAE3C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,iEAAiE;YACjE,sEAAsE;YACtE,qEAAqE;YACrE,8DAA8D;YAC9D,2BAA2B,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;YAC3E,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACnE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAChD,iBAAiB,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,CACvD,CAAA;YACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAA;YAC/E,IAAI,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACvH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QAED,wEAAwE;QACxE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CACtD,MAAM,EACN,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAC3D,WAAW,EACX,WAAW,EACX,SAAS,CACV,CAAA;QACD,IAAI,SAAS;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACvH,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAA;QACjE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAA;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAW;QAC1C,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAA;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,6EAA6E;gBAC3E,qFAAqF;gBACrF,oDAAoD,CACvD,CAAA;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;;AA3HO;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;6CAC5C;AAGvB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;;iDACnD;AAG3B;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;;8CAC9D;AAwHlC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAW;IACrD,MAAM,OAAO,GAAoC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAA;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAA;QAC9B,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,WAAW,IAAI,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACjF,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAW;IAC3C,MAAM,WAAW,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAA;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7E,OAAO,EAAE,WAAW,EAAE,CAAA;AACxB,CAAC"}

package/build/index.d.ts

@@ -2,7 +2,7 @@
  * Entrada pública del paquete.
  *   import { AuthorizationManager, APP_SCOPE } from '@jantstack/adonis-authz'
  */
-export { AuthorizationManager, DEFAULT_MAX_SCOPES, DEFAULT_MAX_DESCENDANTS, MAX_SCOPE_BOUND, DEFAULT_VIEW_MAX_AGE_MS, expandExcludedSubtrees } from './src/manager.js';
+export { AuthorizationManager, DEFAULT_MAX_SCOPES, DEFAULT_MAX_DESCENDANTS, MAX_SCOPE_BOUND, DEFAULT_VIEW_MAX_AGE_MS, PARKED_CENSUS_MAX, RELAY_ORIGIN_MAX_HOPS, RELAY_LEASE_POLL_MS, expandExcludedSubtrees } from './src/manager.js';
 export type { AuthorizationView, ForRequestOptions } from './src/manager.js';
 export { defineConfig } from './src/define_config.js';
 export type { AuthorizationConfig } from './src/define_config.js';
@@ -50,7 +50,7 @@ export type { SqlScopeOutboxOptions } from './src/scope_outbox.js';
  * obligaría a importar ese SDK — acoplando el call-site al backend que este
  * paquete existe para abstraer.
  */
-export { AuthorizationBackendError, AuthorizationBackendTimeoutError, ScopeResolverError, InvalidIdentityError, InvalidSlugError, AuthorizationConfigError, AuthorizationInternalError, UnknownScopeError, NoScopeResolverError, UnknownRoleError, UnknownPermissionError, CatalogConflictError, RoleIsNotAccessError, ScopeCycleError, PurgeIncompleteError, WriteConflictError, ActorRequiredError, NotWithinError, WithinRequiredError, WithinRootForbiddenError, TooManyScopesError, TooManyLocalRolesError, MassPurgeRefusedError, PruneInterruptedError, UnsupportedDialectError, ScopeTooDeepError, UnsupportedOperationError, NoDescendantsResolverError, ViewExpiredError, RoleNotVisibleError, AmbiguousRoleError, RoleImmutableError, RoleLevelAboveOwnerError, RoleNotAssignableAtError, PermissionNotDelegableError, RankExceededError, ModelTooLargeError, RelationConfigError, RelationTypeUnknownError, RelationUnknownError, ScopeTreeDriftError, ScopeDriftUnguardedError, AuthorizationFrozenError, FreezeHeldError, MassReconcileRefusedError, ReconcileTooLargeError, } from './src/errors.js';
+export { AuthorizationBackendError, AuthorizationBackendTimeoutError, ScopeResolverError, InvalidIdentityError, InvalidSlugError, AuthorizationConfigError, AuthorizationInternalError, UnknownScopeError, NoScopeResolverError, UnknownRoleError, UnknownPermissionError, CatalogConflictError, RoleIsNotAccessError, ScopeCycleError, PurgeIncompleteError, WriteConflictError, ActorRequiredError, NotWithinError, WithinRequiredError, WithinRootForbiddenError, TooManyScopesError, TooManyLocalRolesError, MassPurgeRefusedError, PruneInterruptedError, UnsupportedDialectError, ScopeTooDeepError, ScopeDepthLimitError, ScopeRequeueRefusedError, UnsupportedOperationError, NoDescendantsResolverError, ViewExpiredError, RoleNotVisibleError, AmbiguousRoleError, RoleImmutableError, RoleLevelAboveOwnerError, RoleNotAssignableAtError, PermissionNotDelegableError, RankExceededError, ModelTooLargeError, RelationConfigError, RelationTypeUnknownError, RelationUnknownError, ScopeTreeDriftError, ScopeDriftUnguardedError, AuthorizationFrozenError, FreezeHeldError, MassReconcileRefusedError, StaleSourceRefusedError, OperatorWindowExpiredError, ReconcileTooLargeError, markPartialWrite, isPartialWrite, } from './src/errors.js';
 /**
  * Validación de identidad y de slugs (422). La aplica el manager en cada
  * llamada y los drivers por defensa en profundidad; se exporta para que un
@@ -69,8 +69,7 @@ export { defineRelationsConfig } from './src/relations/define_relations_config.j
 export type { RelationsConfig, RelationsConfigSpec, RelationsDatabaseOptions, RelationObjectTypeSpec, RelationObjectRelationSpec, } from './src/relations/define_relations_config.js';
 export { RelationsManager } from './src/relations/manager.js';
 export type { RelationsManagerOptions } from './src/relations/manager.js';
-export { reconcileRelations } from './src/relations/reconcile.js';
-export type { RelationsReconcileOptions, RelationsReconcileReport } from './src/relations/reconcile.js';
+export type { RelationsReconcileReport } from './src/relations/reconcile.js';
 export { saveRelationsConfig, readRelationsConfig, readRelationsConfigSpec, } from './src/relations_config_store.js';
 export type { RelationsConfigStoreOptions } from './src/relations_config_store.js';
 export { DatabaseRelationsDriver } from './src/drivers/database_relations_driver.js';
@@ -84,8 +83,19 @@ export type { DatabaseDriverOptions } from './src/drivers/database_driver.js';
  * opcional `@openfga/sdk`. Un consumidor solo-database arranca sin él (D9).
  */
 export { APP_SCOPE, APP_SCOPE_TYPE, DEFAULT_RECONCILE_MAX_TUPLES } from './src/types.js';
-export type { AuthorizationDriver, AuthorizationDriverFactory, AuthorizedScopes, AuthzWriteEvent, AuthzCatalogWriteEvent, CatalogPermissionSpec, CatalogRole, CatalogRoleSpec, CatalogSpec, ScopedRoleChanges, ScopedRoleSpec, DenyOptions, DenyRef, ExcludedSubtree, GrantOptions, GrantOutcome, HolderTypeMap, ReconcileCounts, ReconcileFact, ReconcileFactPage, ReconcileFactsEnumerator, ReconcileOptions, ReconcileReport, ReconcileSkip, ReconcileSource, RoleQuery, ScopeChainResolver, ScopeDescendantsResolver, ScopeEdge, ScopeEdgePage, ScopeEdgesEnumerator, ScopedWriteOptions, ScopeRef, ScopeType, SubjectRef, WriteOptions, RelationsDriver, RelationsDriverCapabilities, RelObject, RelSubject, RelUserset, RelationRef, RelationWriteEvent, RelationWriteOptions, RelationPage, RelationObjectsPage, RelationSubjectsPage, RelationTuple, RelationTuplePage, } from './src/types.js';
+export type { AuthorizationDriver, AuthorizationDriverFactory, AuthorizedScopes, AuthzWriteEvent, AuthzCatalogWriteEvent, CatalogPermissionSpec, CatalogRole, CatalogRoleSpec, CatalogSpec, ScopedRoleChanges, ScopedRoleSpec, DenyOptions, DenyRef, ExcludedSubtree, GrantOptions, GrantOutcome, HolderTypeMap, ReconcileCounts, ReconcileFact, ReconcileFactPage, ReconcileFactsEnumerator, ReconcileOptions, ReconcileReport, ReconcileSkip, ReconcileSource, RoleQuery, ScopeChainResolver, ScopeDescendantsResolver, ScopeEdge, ScopeEdgePage, ScopeEdgesEnumerator, ScopedWriteOptions, ScopeRef, ScopeType, SubjectRef, WriteOptions, AuthorizationDriverCapabilities, RelationsDriver, RelationsDriverCapabilities, RelObject, RelSubject, RelUserset, RelationRef, RelationWriteEvent, RelationWriteOptions, RelationTransactionOptions, RelationPurgeOptions, RelationPage, RelationObjectsPage, RelationSubjectsPage, RelationTuple, RelationTuplePage, ScopeOutbox, ScopeOutboxContext, ScopeOutboxLease, ScopeOutboxPendingFilter, ScopeOutboxFailure, ScopeRequeueConflict, ScopeRequeueReport, ScopeTreeChange, PendingScopeTreeChange, RelayedScopeChange, ScopeRelayReport, ScopeRelayFailure, ScopeRelayEntry, ScopeRelayEntryStatus, ScopeEnqueueReceipt, } from './src/types.js';
 export { isRelUserset } from './src/types.js';
+/**
+ * **¿De quién es esta transacción?** (L-1 · 🟠 9, regla del puerto `{trx}`):
+ * la ÚNICA comprobación con la que una escritura del paquete —la outbox de
+ * `scopes.*` hoy; `grant`/`relate` de un driver con `transactionalWrites:
+ * true`— se inscribe en `{ transaction }`: tiene que ser una transacción
+ * ABIERTA de Lucid de la conexión de quien escribe (otra conexión, un
+ * `QueryClient` o el `db` entero son 500 `E_AUTHZ_CONFIG`). Un driver de
+ * terceros que declare `transactionalWrites: true` la llama con SU conexión.
+ */
+export { assertCallerTransaction } from './src/shared/transaction_guard.js';
+export type { CallerTransaction, CallerTransactionOwner } from './src/shared/transaction_guard.js';
 export { default as AuthzRole } from './src/models/authz_role.js';
 export { default as AuthzPermission } from './src/models/authz_permission.js';
 export { default as AuthzRolePermission } from './src/models/authz_role_permission.js';

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACtK,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAE9G;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,gCAAgC,CAAA;AAEvC;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,YAAY,EAAE,2BAA2B,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AACpG,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC1E,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAE3F;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAElE;;;;;GAKG;AACH,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EACf,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,iBAAiB,CAAA;AAExB;;;;;GAKG;AACH,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAA;AAClF,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACjE,YAAY,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAA;AAIvG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iCAAiC,CAAA;AACxC,YAAY,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAA;AAIlF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAA;AACpF,YAAY,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEjF,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACjG,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAE7E;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAA;AACxF,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,WAAW,EACX,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,OAAO,EACP,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,eAAe,EACf,SAAS,EACT,kBAAkB,EAClB,wBAAwB,EACxB,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,UAAU,EACV,YAAY,EACZ,eAAe,EACf,2BAA2B,EAC3B,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,EACpB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACrO,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAE9G;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,gCAAgC,CAAA;AAEvC;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,YAAY,EAAE,2BAA2B,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AACpG,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC1E,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAE3F;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAElE;;;;;GAKG;AACH,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,sBAAsB,EAItB,gBAAgB,EAChB,cAAc,GACf,MAAM,iBAAiB,CAAA;AAExB;;;;;GAKG;AACH,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAA;AAClF,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AASzE,YAAY,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAA;AAI5E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iCAAiC,CAAA;AACxC,YAAY,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAA;AAIlF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAA;AACpF,YAAY,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEjF,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACjG,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAE7E;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAA;AACxF,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,WAAW,EACX,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,OAAO,EACP,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,eAAe,EACf,SAAS,EACT,kBAAkB,EAClB,wBAAwB,EACxB,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,UAAU,EACV,YAAY,EACZ,+BAA+B,EAC/B,eAAe,EACf,2BAA2B,EAC3B,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EAIjB,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C;;;;;;;;GAQG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAA;AAC3E,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAElG,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}