@jantstack/adonis-authz 2.4.0-alpha.1 → 2.4.0-alpha.3

package/build/src/manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/manager.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAyB7D,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAqC1D,OAAO,KAAK,EACV,mBAAmB,EAEnB,gBAAgB,EAGhB,WAAW,EACX,cAAc,EACd,WAAW,EACX,OAAO,EACP,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,SAAS,EAGT,iBAAiB,EACjB,cAAc,EAGd,gBAAgB,EAChB,eAAe,EAIf,kBAAkB,EAElB,gBAAgB,EAChB,QAAQ,EAER,qBAAqB,EACrB,SAAS,EACT,UAAU,EAEX,MAAM,YAAY,CAAA;AAuBnB;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,oBAAoB,EAClB,WAAW,GACX,SAAS,GACT,cAAc,GACd,YAAY,GACZ,WAAW,GACX,gBAAgB,GAChB,OAAO,GACP,QAAQ,GACR,MAAM,GACN,YAAY,GACZ,QAAQ,GACR,QAAQ,GACR,YAAY,GACZ,UAAU,GACV,YAAY,GACZ,sBAAsB,GACtB,eAAe,GACf,kBAAkB,GAClB,wBAAwB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,CACrB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAEhH;AAED,qGAAqG;AACrG,eAAO,MAAM,kBAAkB,OAAQ,CAAA;AACvC,eAAO,MAAM,uBAAuB,QAAS,CAAA;AAC7C;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAAa,CAAA;AACzC;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAA;AACtC,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAGzC,gGAAgG;AAChG,eAAO,MAAM,uBAAuB,QAAS,CAAA;AAE7C,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAgBD,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,UAAU,GAAG,SAAS,CAAA;IAC5B,8EAA8E;IAC9E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd;AAUD;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;;gBAwBnB,MAAM,EAAE,mBAAmB;IAkCvC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,iBAAiB;IAmB9D;;;;;;;;;;;;;;OAcG;IACG,MAAM,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAyD5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,UAAU,CAAA;KAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IA4DjH;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBpD;;;;OAIG;IACH,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,mGAAmG;IAC7F,YAAY,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAYlD;;;;;;;OAOG;IACG,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAuH3E,mDAAmD;IACnD,iBAAiB,IAAI,IAAI;IAiCzB;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM;0BAOW,QAAQ,UAAU,QAAQ,YAAY,qBAAqB,KAAG,OAAO,CAAC,IAAI,CAAC;QAiBnG;;;;;;;;;;;;WAYG;uBACkB,QAAQ,aAAa,QAAQ,YAAY,qBAAqB,KAAG,OAAO,CAAC,IAAI,CAAC;QAenG;;;;;;;;;;;;;;;;;;;;;;WAsBG;0BACqB,QAAQ,YAAY,qBAAqB,KAAG,OAAO,CAAC,IAAI,CAAC;MA6ClF;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACG,iBAAiB,CACrB,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GACrE,OAAO,CAAC,gBAAgB,CAAC;IAkJ5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACG,SAAS,CACb,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB,GACxD,OAAO,CAAC,eAAe,CAAC;IA4Z3B;;;;;OAKG;IACG,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IA8J5D,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAKrF,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtF;;;;;;;;OAQG;IACG,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IA0BpG,2GAA2G;IACrG,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAKrE,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAKxE,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAKlE,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAKpF,mHAAmH;IAC7G,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAM3E;;;;;;;OAOG;IACG,oBAAoB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiKnF;;;;;;;;;;;;;;;OAeG;IACG,gBAAgB,CACpB,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,QAAQ,EACpB,IAAI,EAAE,cAAc,EACpB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,WAAW,CAAC;IAmGvB;;;;;;;;OAQG;IACG,gBAAgB,CACpB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,WAAW,CAAC;IA2FvB;;;;;;OAMG;IACG,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBxG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2FG;IACG,gBAAgB,CAAC,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC;QAC3F,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,WAAW,CAAC;YAAC,KAAK,EAAE,QAAQ,CAAC;YAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;YAAC,aAAa,EAAE,OAAO,GAAG,SAAS,CAAA;SAAE,CAAC,CAAA;QAClJ,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,cAAc,CAAC;YAAC,MAAM,EAAE,iBAAiB,CAAA;SAAE,CAAC,CAAA;QACnE,2FAA2F;QAC3F,SAAS,EAAE,OAAO,CAAA;QAClB,MAAM,EAAE,OAAO,CAAA;KAChB,CAAC;IAshBF;;;;;;OAMG;IACG,KAAK,CACT,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,QAAQ,EACf,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,YAAY,CAAC;IAyCxB;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1G,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IASpG,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IASvH;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,gBAAgB,CACpB,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,SAAS,EACpB,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,gBAAgB,CAAC;IAoE5B;;;;;;;OAOG;IACG,sBAAsB,CAC1B,QAAQ,EAAE,eAAe,EAAE,EAC3B,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,QAAQ,EAAE,CAAC;CAmNvB"}
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/manager.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AA0B7D,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAqC1D,OAAO,KAAK,EACV,mBAAmB,EAEnB,gBAAgB,EAGhB,WAAW,EACX,cAAc,EACd,WAAW,EACX,OAAO,EACP,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,SAAS,EAGT,iBAAiB,EACjB,cAAc,EAGd,gBAAgB,EAChB,eAAe,EAIf,kBAAkB,EAElB,gBAAgB,EAChB,QAAQ,EAER,qBAAqB,EACrB,SAAS,EACT,UAAU,EAEX,MAAM,YAAY,CAAA;AAuBnB;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,oBAAoB,EAClB,WAAW,GACX,SAAS,GACT,cAAc,GACd,YAAY,GACZ,WAAW,GACX,gBAAgB,GAChB,OAAO,GACP,QAAQ,GACR,MAAM,GACN,YAAY,GACZ,QAAQ,GACR,QAAQ,GACR,YAAY,GACZ,UAAU,GACV,YAAY,GACZ,sBAAsB,GACtB,eAAe,GACf,kBAAkB,GAClB,wBAAwB,GACxB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,CACrB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAEhH;AAED,qGAAqG;AACrG,eAAO,MAAM,kBAAkB,OAAQ,CAAA;AACvC,eAAO,MAAM,uBAAuB,QAAS,CAAA;AAC7C;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,WAAa,CAAA;AACzC;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAA;AACtC,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAGzC,gGAAgG;AAChG,eAAO,MAAM,uBAAuB,QAAS,CAAA;AAE7C,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAgBD,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,UAAU,GAAG,SAAS,CAAA;IAC5B,8EAA8E;IAC9E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,0FAA0F;IAC1F,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAC/B;AAOD;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;;gBAwBnB,MAAM,EAAE,mBAAmB;IAkCvC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,iBAAiB;IAmB9D;;;;;;;;;;;;;;OAcG;IACG,MAAM,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAiH5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,UAAU,CAAA;KAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IA4DjH;;;OAGG;IACG,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBpD;;;;OAIG;IACH,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,mGAAmG;IAC7F,YAAY,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAYlD;;;;;;;OAOG;IACG,gBAAgB,CAAC,CAAC,EACtB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,EACxC,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,UAAU,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAO,GAC/D,OAAO,CAAC,CAAC,CAAC;IAyHb,mDAAmD;IACnD,iBAAiB,IAAI,IAAI;IAiCzB;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM;0BAOW,QAAQ,UAAU,QAAQ,YAAY,qBAAqB,KAAG,OAAO,CAAC,IAAI,CAAC;QAiBnG;;;;;;;;;;;;WAYG;uBACkB,QAAQ,aAAa,QAAQ,YAAY,qBAAqB,KAAG,OAAO,CAAC,IAAI,CAAC;QAenG;;;;;;;;;;;;;;;;;;;;;;WAsBG;0BACqB,QAAQ,YAAY,qBAAqB,KAAG,OAAO,CAAC,IAAI,CAAC;MA6ClF;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACG,iBAAiB,CACrB,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GACrE,OAAO,CAAC,gBAAgB,CAAC;IAkJ5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACG,SAAS,CACb,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB,GACxD,OAAO,CAAC,eAAe,CAAC;IA+Z3B;;;;;OAKG;IACG,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IA8J5D,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAKrF,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtF;;;;;;;;OAQG;IACG,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IA0BpG,2GAA2G;IACrG,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAKrE,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAKxE,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAKlE,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAKpF,mHAAmH;IAC7G,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAM3E;;;;;;;OAOG;IACG,oBAAoB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiKnF;;;;;;;;;;;;;;;OAeG;IACG,gBAAgB,CACpB,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,QAAQ,EACpB,IAAI,EAAE,cAAc,EACpB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,WAAW,CAAC;IAoGvB;;;;;;;;OAQG;IACG,gBAAgB,CACpB,KAAK,EAAE,UAAU,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,EAC1B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,WAAW,CAAC;IA4FvB;;;;;;OAMG;IACG,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBxG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2FG;IACG,gBAAgB,CAAC,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC;QAC3F,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,WAAW,CAAC;YAAC,KAAK,EAAE,QAAQ,CAAC;YAAC,WAAW,EAAE,MAAM,EAAE,CAAC;YAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;YAAC,aAAa,EAAE,OAAO,GAAG,SAAS,CAAA;SAAE,CAAC,CAAA;QAClJ,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,cAAc,CAAC;YAAC,MAAM,EAAE,iBAAiB,CAAA;SAAE,CAAC,CAAA;QACnE,2FAA2F;QAC3F,SAAS,EAAE,OAAO,CAAA;QAClB,MAAM,EAAE,OAAO,CAAA;KAChB,CAAC;IAshBF;;;;;;OAMG;IACG,KAAK,CACT,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,QAAQ,EACf,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,YAAY,CAAC;IA6CxB;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB1G,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpG,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvH;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,gBAAgB,CACpB,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,SAAS,EACpB,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,gBAAgB,CAAC;IAoE5B;;;;;;;OAOG;IACG,sBAAsB,CAC1B,QAAQ,EAAE,eAAe,EAAE,EAC3B,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACnC,OAAO,CAAC,QAAQ,EAAE,CAAC;CA8NvB"}

package/build/src/manager.js

@@ -4,7 +4,7 @@ import { v7 as uuidv7 } from 'uuid';
 import { assertCatalogUuid, assertIdentity, assertScope, assertScopeType, assertSubject, assertValidSlug, chainKeysFrom, normalizeRoleQuery, scopeFromKey, scopeKey, scopeSpellings, } from './identity.js';
 import { expiryChanged } from './expiry.js';
 import { randomBytes } from 'node:crypto';
-import { DEFAULT_FREEZE_LEASE_MS, acquireFreeze, freezeIsLive, freezeKindOf, readFreezeRow, releaseFreeze, renewFreeze, } from './freeze.js';
+import { DEFAULT_FREEZE_LEASE_MS, acquireFreeze, freezeIsLive, freezeKindOf, readFreezeRow, assertNotFrozenRow, releaseFreeze, renewFreeze, } from './freeze.js';
 import { assertKnownScope, isAuthzError, resolveChain, rootOnlyResolver } from './shared/backend_guard.js';
 import { CatalogCache, GLOBAL_OWNER_KEY, invalidateAuthzCatalog, isRoleVisibleWith, readLocalRoles, withAuthzCatalogWrite } from './catalog/catalog_cache.js';
 import { assertAssignableAt } from './catalog/catalog.js';
@@ -196,10 +196,65 @@ export class AuthorizationManager {
             }
             driver = driver.withClock(clock);
         }
+        this.#assertTransactionalWritesRequired(driver);
         this.#assertScopeDriftGuarded(driver);
         this.#driver = driver;
         return driver;
     }
+    /**
+     * **Puerta 2 de `{ transaction }`** (L-2, opt-in): con
+     * `requireTransactionalWrites: true` el driver activo tiene que declarar
+     * `transactionalWrites: true` o el manager falla AL RESOLVERLO — antes de
+     * cachearlo, así que toda lectura, toda escritura y `driver()` fallan igual:
+     * el despliegue no arranca. Es la forma honesta de «fallar al construirse»:
+     * el roadmap lo pedía incondicional y eso haría `openfga` inconstruible en
+     * cualquier app que solo lo tenga registrado (y el driver se resuelve
+     * perezosamente y por nombre, así que al construir no se sabe si alguien
+     * pasará `{ transaction }`). Quien quiera fallar al arrancar, lo pide.
+     */
+    #assertTransactionalWritesRequired(driver) {
+        if (this.#config.requireTransactionalWrites !== true)
+            return;
+        if (driver.capabilities?.transactionalWrites === true)
+            return;
+        throw new AuthorizationConfigError(`config.requireTransactionalWrites está en true y el driver '${this.#config.default}' declara ` +
+            `transactionalWrites: ${driver.capabilities ? String(driver.capabilities.transactionalWrites) : 'nada (sin capabilities)'}: ` +
+            `no puede inscribir grant/revoke/deny/removeDeny en la transacción del consumidor («los dos o ninguno»), así ` +
+            `que el manager no se resuelve. Usa un driver que la declare (database) o quita requireTransactionalWrites.`);
+    }
+    /**
+     * **Puerta 1 de `{ transaction }`** (L-2, siempre activa): una escritura de
+     * HECHOS con `{ transaction }` a un driver que no declara
+     * `transactionalWrites: true` es 500 `E_AUTHZ_UNSUPPORTED` nombrando driver
+     * y operación, ANTES de la barrera, de la identidad y del driver (cero
+     * llamadas). Nunca se ignora, nunca un `logger.warn`: aceptarla y no
+     * cumplirla sería publicar con nuestra firma la fuga del cruce 4 · S5.
+     * `scopes.*` NO pasa por aquí: su `transaction` ENCOLA (encolar ≠ escribir).
+     */
+    async #assertTransactionalWrite(options, operation) {
+        if (options?.transaction === undefined || options.transaction === null)
+            return;
+        const driver = await this.driver();
+        if (driver.capabilities?.transactionalWrites === true)
+            return;
+        throw UnsupportedOperationError.transactional(operation, this.#config.default, 'roles');
+    }
+    /**
+     * La marca del evento de una escritura inscrita en la transacción del
+     * llamante (L-3): `onWrite` se dispara cuando el DRIVER vuelve, y en ese
+     * momento la fila existe solo dentro de esa transacción — es un hecho si y
+     * solo si el llamante confirma, cosa que el paquete nunca ve. Quien audita
+     * lo necesita para no registrar como firme lo que un rollback deshace.
+     */
+    #transactional(options) {
+        return options?.transaction === undefined || options.transaction === null ? {} : { transactional: true };
+    }
+    /** La API de delegación no admite `{ transaction }` (§1.4 del veredicto `{trx}`): 500 antes de tocar nada. */
+    #assertNoTransaction(options, operation) {
+        if (options?.transaction === undefined || options.transaction === null)
+            return;
+        throw UnsupportedOperationError.transactionalCatalog(operation);
+    }
     /**
      * **El gate de deriva del árbol, en el MANAGER** (3b-2e · E3; cierra el
      * agujero que declaró el 3b-2d).
@@ -366,10 +421,16 @@ export class AuthorizationManager {
      * A1.1/A1.3): si este manager ya sostiene el freeze, la ventana interior
      * no toma otro ni lo levanta al salir — la exterior sigue en pie.
      */
-    async withFrozenWrites(reason, fn) {
-        const context = await this.#durableFreezeContext(reason, 'platform', { operatorAsContext: false });
+    async withFrozenWrites(reason, fn, options = {}) {
+        // L-1 · J1: una pasada que quiera correr DENTRO de la ventana del
+        // operador (el cutover) y publicar su `lapsed` —`authz:relations:reconcile`,
+        // que vive fuera de este manager— pide `kind: 'reconcile'` y
+        // `operatorAsContext: true`, lo mismo que hace `reconcile` de roles.
+        const context = await this.#durableFreezeContext(reason, options.kind ?? 'platform', {
+            operatorAsContext: options.operatorAsContext === true,
+        });
         try {
-            return await fn();
+            return await fn({ fence: context.fence, leaseMs: context.leaseMs, lapsed: context.lapsed });
         }
         finally {
             await context.release();
@@ -454,25 +515,23 @@ export class AuthorizationManager {
      * freeze, y con `catalogRevalidate: { everyMs }` la fila del memo ni se
      * lee.
      */
-    async #assertNotFrozen(operation, transaction) {
+    async #assertNotFrozen(operation) {
         const root = this.#root();
         const held = root.#heldFreeze;
         if (held) {
             throw new AuthorizationFrozenError(`${operation}: el motor de autorización está congelado (${held.reason}) y no acepta escrituras. ` +
                 `Las lecturas siguen funcionando; reintenta esta escritura cuando la operación termine.`);
         }
-        // Si la escritura llegó con la TRANSACCIÓN del consumidor, la fila se lee
-        // por ella: exigir una segunda conexión con la suya abierta interbloquea
-        // un pool de 1 (SQLite `:memory:`). El precio va declarado en freeze.ts.
-        const client = transaction && typeof transaction.from === 'function'
-            ? transaction
-            : undefined;
-        const row = await readFreezeRow({ driver: this.#config.default, client });
-        if (!freezeIsLive(row, root.#wallMs()))
-            return;
-        const lift = freezeKindOf(row.holder) === 'operator' ? ' (la levanta authz:unfreeze)' : '';
-        throw new AuthorizationFrozenError(`${operation}: el motor de autorización está congelado (${row.reason})${lift} y no acepta escrituras. ` +
-            `Las lecturas siguen funcionando; reintenta esta escritura cuando la ventana termine.`);
+        // La fila se lee SIEMPRE por la conexión del motor (L-1 · 🟠 8). Hasta
+        // L-1 se leía por la transacción del consumidor si la escritura llegaba
+        // con una —«para no interbloquear un pool de 1»—, y eso era el agujero:
+        // la barrera la decidía el snapshot del llamante (medido en SQLite, MySQL
+        // y PG). Con pool 1 el precio es un 503 con deadline, no un bypass.
+        await assertNotFrozenRow(operation, {
+            driver: this.#config.default,
+            nowMs: root.#wallMs(),
+            timeoutMs: this.#config.freezeTimeoutMs,
+        });
     }
     /** Solo tests: fuerza re-resolución del driver. */
     clearCachedDriver() {
@@ -1163,7 +1222,10 @@ export class AuthorizationManager {
      * `{}` si no hay actor: el evento no inventa autores).
      */
     async #writeOptions(options, operation) {
-        await this.#assertNotFrozen(operation, options?.transaction);
+        // Sin cast sobre `transaction` (L-1 · 🟠 8): la barrera no lee nada del
+        // llamante, y `transaction` solo lo consumen los tipos que lo declaran
+        // (`ScopeTreeWriteOptions`, para ENCOLAR — nunca para decidir).
+        await this.#assertNotFrozen(operation);
         if (options?.actor !== undefined)
             assertSubject(options.actor);
         if (this.#config.requireActor === true && !options?.actor) {
@@ -1594,6 +1656,7 @@ export class AuthorizationManager {
      * Devuelve el rol y notifica `role_defined`.
      */
     async defineScopedRole(actor, ownerScope, spec, options) {
+        this.#assertNoTransaction(options, 'defineScopedRole');
         const who = await this.#requireActor(actor, 'defineScopedRole');
         this.#assertOwnerScope(ownerScope, 'defineScopedRole');
         const parsed = this.#parseScopedRoleSpec(spec);
@@ -1693,6 +1756,7 @@ export class AuthorizationManager {
      * escribe ni notifica (idempotente). Notifica `role_updated`.
      */
     async updateScopedRole(actor, roleUuid, changes, options) {
+        this.#assertNoTransaction(options, 'updateScopedRole');
         const who = await this.#requireActor(actor, 'updateScopedRole');
         assertCatalogUuid('rol', roleUuid);
         const parsed = this.#parseScopedRoleChanges(changes);
@@ -1786,6 +1850,7 @@ export class AuthorizationManager {
      * su owner. Notifica `role_purged`. No necesita `listDenies`.
      */
     async deleteScopedRole(actor, roleUuid, options) {
+        this.#assertNoTransaction(options, 'deleteScopedRole');
         const who = await this.#requireActor(actor, 'deleteScopedRole');
         assertCatalogUuid('rol', roleUuid);
         const driver = await this.driver();
@@ -2397,13 +2462,15 @@ export class AuthorizationManager {
      * `E_AUTHZ_AMBIGUOUS_ROLE`, nunca «el más cercano gana»).
      */
     async grant(subject, role, scope, options) {
+        await this.#assertTransactionalWrite(options, 'grant');
         const actor = await this.#writeOptions(options, 'grant');
         assertIdentity({ subject, role, scope, expiresAt: options?.expiresAt });
         await this.#assertWithin(scope, options, 'grant');
         // 3E · Q7: el evento lleva el rol RESUELTO (uuid + slug + nivel + owner),
         // no la pregunta cruda. Solo se resuelve si hay hook que lo vaya a leer.
         const roles = await this.#resolvedRoles(role, scope, 'grant');
-        const outcome = (await this.#write({ action: 'granted', subject, scope, roles, expiresAt: options?.expiresAt ?? null, ...actor }, async () => (await this.driver()).grant(subject, role, scope, options))) ??
+        const transactional = this.#transactional(options);
+        const outcome = (await this.#write({ action: 'granted', subject, scope, roles, expiresAt: options?.expiresAt ?? null, ...actor, ...transactional }, async () => (await this.driver()).grant(subject, role, scope, options))) ??
             // Un driver de terceros que aún devuelva `void`: la firma promete un
             // `GrantOutcome` y no miente (E1). Sin lectura previa no hay caducidad
             // anterior que contar: es lo que pidió el llamante, y `existed: false`.
@@ -2419,6 +2486,7 @@ export class AuthorizationManager {
                 expiresAt: outcome.expiresAt,
                 previousExpiresAt: outcome.previousExpiresAt,
                 ...actor,
+                ...transactional,
             });
         }
         else {
@@ -2429,6 +2497,7 @@ export class AuthorizationManager {
                 roles,
                 expiresAt: outcome.expiresAt,
                 ...actor,
+                ...transactional,
             });
         }
         return outcome;
@@ -2440,27 +2509,38 @@ export class AuthorizationManager {
      * rol.
      */
     async revoke(subject, role, scope, options) {
+        await this.#assertTransactionalWrite(options, 'revoke');
         const actor = await this.#writeOptions(options, 'revoke');
         assertIdentity({ subject, role, scope });
         await this.#assertWithin(scope, options, 'revoke');
-        const event = { action: 'revoked', subject, scope, roles: await this.#resolvedRoles(role, scope, 'revoke'), ...actor };
-        await this.#write(event, async () => (await this.driver()).revoke(subject, role, scope));
+        const event = {
+            action: 'revoked',
+            subject,
+            scope,
+            roles: await this.#resolvedRoles(role, scope, 'revoke'),
+            ...actor,
+            ...this.#transactional(options),
+        };
+        // L-2: las opciones viajan al driver (`transaction`, si la puerta la dejó pasar) — como en `grant`.
+        await this.#write(event, async () => (await this.driver()).revoke(subject, role, scope, options));
         await this.#notify(event);
     }
     async deny(subject, permission, scope, options) {
+        await this.#assertTransactionalWrite(options, 'deny');
         const actor = await this.#writeOptions(options, 'deny');
         assertIdentity({ subject, permission, scope });
         await this.#assertWithin(scope, options, 'deny');
-        const event = { action: 'denied', subject, scope, permission, ...actor };
-        await this.#write(event, async () => (await this.driver()).deny(subject, permission, scope));
+        const event = { action: 'denied', subject, scope, permission, ...actor, ...this.#transactional(options) };
+        await this.#write(event, async () => (await this.driver()).deny(subject, permission, scope, options));
         await this.#notify(event);
     }
     async removeDeny(subject, permission, scope, options) {
+        await this.#assertTransactionalWrite(options, 'removeDeny');
         const actor = await this.#writeOptions(options, 'removeDeny');
         assertIdentity({ subject, permission, scope });
         await this.#assertWithin(scope, options, 'removeDeny');
-        const event = { action: 'deny_removed', subject, scope, permission, ...actor };
-        await this.#write(event, async () => (await this.driver()).removeDeny(subject, permission, scope));
+        const event = { action: 'deny_removed', subject, scope, permission, ...actor, ...this.#transactional(options) };
+        await this.#write(event, async () => (await this.driver()).removeDeny(subject, permission, scope, options));
         await this.#notify(event);
     }
     /**
@@ -2711,6 +2791,17 @@ export class AuthorizationManager {
      * `indeterminate: true`, para que quien audita registre "puede haber
      * ocurrido" en vez de nada. Cualquier otro fallo (422, conexión rechazada)
      * significa que la escritura no ocurrió y se propaga sin evento.
+     *
+     * **Dentro de la transacción del llamante (L-3) el deadline sigue siendo
+     * `indeterminate: true`**, y el evento lleva además `transactional: true`.
+     * El auditor del panel `{trx}` (🟡 12) objetó que ahí «el rollback la
+     * determina»; pero lo que determina el rollback lo determina el LLAMANTE
+     * y el paquete no lo ve: en el instante del 503 la sentencia puede haber
+     * aterrizado en la transacción (SQLite no cancela; en PG la transacción
+     * queda abortada y ya no puede confirmar; en MySQL la sentencia se mata y
+     * la transacción sigue viva) y el llamante puede confirmar o no. Lo
+     * honesto es el mismo «no lo sé» de siempre más la marca de que la última
+     * palabra es su commit. Medido por motor en `database_transaction.spec.ts`.
      */
     async #write(event, fn) {
         try {