@jantstack/adonis-authz 2.4.0-alpha.3 → 2.4.0-alpha.4

package/README.md

@@ -31,6 +31,8 @@ node ace authz:catalog:sync
 
 `configure` registers the provider, the commands and the `appAccess` middleware, defines the env variables, and **publishes into your project** what belongs to you: the migration for the `authz_*` tables and two config files (`config/authorization.ts` for drivers and the scope tree, `config/app_acl.ts` for your role catalog). The suite compiles both published configs against the package on every run, so they cannot drift from it.
 
+> **Upgrading to 2.4.0-alpha.4 — how the commands are registered.** `@jantstack/adonis-authz/commands` is now a real ace loader (it exports `getMetaData()`/`getCommand()`, built with `ListLoader` over the nine command classes, next to the named class exports). Until alpha.4 it only re-exported the classes, so the line `configure` writes — `commands: [() => import('@jantstack/adonis-authz/commands')]` — made **the whole `node ace` crash** at boot (`TypeError: loaderInstance.getMetaData is not a function`). If you registered the commands by wrapping the barrel in a `ListLoader(Object.values(m))` (the only way it worked before alpha.4), remove the wrapper and register the module directly: `() => import('@jantstack/adonis-authz/commands')`, which is what `node ace configure` writes. The wrapper now fails with `TypeError: command.serialize is not a function`, because the module also exports the loader functions: `Object.values(m)` includes them and `ListLoader.getMetaData()` calls `serialize()` on each value. The module has no `default` export on purpose — ace calls `getMetaData()` on the module namespace and never unwraps `default` (same shape as `@adonisjs/core/commands`).
+
 For the OpenFGA driver, also install its SDK (optional peer): `npm i @openfga/sdk`. Everything that touches the SDK lives behind the **`@jantstack/adonis-authz/openfga` subpath** (`OpenFgaAuthorizationDriver`, `provisionOpenFgaStore`, `importAuthzFactsToOpenFga`, `openFgaAuthorizationModel`, `assertHolderTypes`); the main entry never imports it, so a database-only install boots without the SDK (the suite loads `index.ts` in a child process with `@openfga/sdk` blocked to prove it: *"index.ts (la entrada principal) carga con el SDK bloqueado"*). The published config imports the driver from that subpath *inside* the factory.
 
 ## Semantics (what every driver guarantees)
@@ -765,6 +767,22 @@ Every driver **declares** this through `driver.capabilities`, and each declared
 
 **The anti-cycle checks are the package's, in both modes, and they are not optional.** Measured against OpenFGA v1.19: the server *accepts* an edge that closes a cycle, does not hang, answers in 2–7 ms, and from then on inheritance runs both ways — a grant on a descendant grants on its ancestor, and with the root inside the cycle it grants everywhere. Nothing is logged and there is no error to catch. That is why `child ≠ app`, "the parent exists" and `child ∉ ancestors(parent)` are checked before anything is written (422, no edge), and why you should not expect the backend to be a second line of defence.
 
+### Reading capabilities at runtime (2.4.0-alpha.4)
+
+The table above is what each driver **declares**; your service code can read it from the manager instead of guessing from the driver name — and instead of calling `driver()`:
+
+```ts
+// The same service code serves both drivers, without a single driver() in it.
+if ((await authorization.capabilities()).transactionalWrites) {
+  await authorization.grant(user, 'editor', unit, { transaction: trx })   // both or neither, with YOUR transaction
+} else {
+  await authorization.grant(user, 'editor', unit)                          // openfga: the recipe by direction
+}
+if (relations.capabilities().transactionalWrites) { /* relate(…, { transaction: trx }) */ }
+```
+
+`authorization.capabilities()` is `async` — it resolves the active driver through `driver()`, so it pays the driver factory once (cached from then on) and **inherits its two gates**: with `requireTransactionalWrites: true` and a driver that does not comply it is the same 500 `E_AUTHZ_CONFIG` the deployment already fails with, and a `facts` driver without `scopes.outbox` or the signature is the same 500 `E_AUTHZ_SCOPE_DRIFT_UNGUARDED`. That is deliberate: capabilities belong to the *instance* (`database` decides `transactionalWrites` from its options), and a reading that resolved the driver by any other path would leave `driver()` serving an instance that never passed the gates. Call it once at boot (a `booted`/`ready` hook), not per request. `relations.capabilities()` is synchronous: the relations driver is built eagerly and its gate already ran. Both return a **read-only, frozen, normalised copy** typed as `AuthorizationDriverCapabilities` / `RelationsDriverCapabilities` (both exported): every known key is present, only `true` is `true` — the same reading the write gates apply — so a third-party driver with partial or no `capabilities` reads as `false`, **never `undefined`**; mutating the copy throws in strict mode and changes nothing. The read does not soften anything: `{ transaction }` to a driver that declares `false` is still 500 `E_AUTHZ_UNSUPPORTED` whether or not you asked first, and **`driver()` is still platform API** — tenant code should not call it, and a code review can keep grepping for it.
+
 ## Performance
 
 Two optimisations landed in 2.1, both measured and both **without changing a single answer** (the contract suite is the proof: same cases, both drivers, before and after). Reproduce the numbers with `OPENFGA_TEST_URL=http://localhost:8101 node --import @poppinss/ts-exec scripts/bench_authorize.mjs` (chain of 3 scopes through your resolver, 5 roles per level, 20 permissions, N=200 after 30 warm-up calls, HTTP round-trip included; OpenFGA v1.19.0 on the same machine):
@@ -926,6 +944,8 @@ This is the **only** migration and verification primitive of the package, and th
 
 **It needs `scopes.enumerateEdges`** in your config: the whole tree, paginated with a cursor. `sqlScopeEdges({ table, uuidColumn, parentColumn, typeColumn })` implements it over a table with a parent column, exactly like `sqlDescendantsOf`. Without it the command refuses (500 `E_AUTHZ_CONFIG`) instead of assuming a flat tree — a flat tree would be an invented hierarchy, and an invented hierarchy grants.
 
+**`sqlScopeEdges` covers ONE table, and concatenating several does not cover a tree that lives in more than one (2.4.0-alpha.4).** The helper does a `LEFT JOIN` of the table *against itself* on `parentColumn = uuidColumn`, and a row whose declared parent has no match in *that* table is **skipped in silence** — that is the documented "a parent that does not exist is not emitted", and it has no way to tell "orphan" from "the parent lives in another table". So if your tree is spread over several tables (say `organizations` → `organization_units` → `ia_spaces`), the obvious composition — one `sqlScopeEdges` per table, drained one after the other — **does not emit the edges between tables**: every `ia_space → organization_unit` and `organization_unit → organization` edge is dropped without a word, and the parent's *type* would come out wrong anyway (it is the child table's fixed `scopeType`). With `authz:reconcile --to=openfga` that is not "some edges are missing": the destination sees them as surplus and deletes them, and by invariant 9 (`can_<P>` requires `rooted`) **the whole subtree denies**. Fail-closed, noisy, nobody escalates — and a day lost. Write your own `enumerateEdges` instead: one query that concatenates the tables (`UNION ALL` of `(child_uuid, child_type, parent_uuid, parent_type)` across the tables, `parent IS NULL` meaning `app`), ordered by a total and stable key (the child uuid works) with the cursor over that key, and emitting an edge only when the parent exists in *any* of the tables; then compare with `authz:reconcile --to=<driver> --dry-run` before the first real pass. Alternatively chain the tables in a fixed order and encode *which table* inside the opaque cursor — the contract only asks for a total, stable order across calls. *Recipe not verified by the suite* (it has no multi-table fixture); a composition helper (`composeScopeEdges`, or `parentTable` on `sqlScopeEdges`) is deferred to 2.6.
+
 What one pass does, in order: the **root marker** (`scope:app#rooted`, without which the whole store denies), the **catalog projection** (`role:<uuid>#permits_<P>`, read with the very same function `syncAuthzCatalog` uses), the **tree** from `enumerateEdges`, and the **facts** from `authz_assignments` / `authz_denies` — each assignment as its `assignee` tuple plus the two (c2) edges, each deny as `scope:<key>#denied_<P>`. It is **idempotent** (a second pass writes zero — the word the requirement used, and it has its case), **resumable** (the source is read in batches of 100 with a cursor over the primary key; repeating a pass converges) and **never silent**: the report carries `{ written, updated, unchanged, extra, deleted, skipped{reason} }` per phase, plus each row that did not migrate with its reason (`unknown-scope`, `unknown-role`, `unknown-permission`, `unknown-holder-type`, `expired`, `role-not-visible`, `cycle`, …).
 
 **The source is read in one consistent snapshot — in the direction where the source is `authz_*` (2.3).** The two sweeps (`authz_assignments`, then `authz_denies`) used to run on the global connection, one after the other, so the gap between them — the time it takes to walk the first table in batches of 100 — let *composite* business operations slip through. An offboarding is `revoke` + `removeDeny`: landing in that gap, the pass kept one half of each and wrote **the role without its deny** into the destination, granting a permission that **neither the previous nor the following state granted**, while the report said `written=13 extra=0 skipped={} clean=true`. That is not a lost permission, it is a fabricated one — an escalation, with nothing in the report to distrust. Both sweeps now run inside **one repeatable-read transaction**, so the worst outcome of the window is *the consistent state of `t0`* — recoverable drift that the next pass repairs — instead of a state that never existed. What each engine guarantees is not the same and is stated rather than assumed: PostgreSQL takes the snapshot with `BEGIN TRANSACTION ISOLATION LEVEL REPEATABLE READ`; MySQL/InnoDB is sent `SET TRANSACTION ISOLATION LEVEL REPEATABLE READ` explicitly (it is InnoDB's default, but a server setting is not a promise of this package) and fixes the consistent read on the first query; SQLite takes no isolation level at all (knex warns and ignores it) because a read transaction is already a snapshot there, so the package does not send it one.

package/build/commands/main.d.ts

@@ -1,14 +1,16 @@
-/**
- * Comandos ace del paquete. Se registran con:
- *   node ace configure @jantstack/adonis-authz
- */
-export { default as OpenFgaProvision } from './openfga_provision.js';
-export { default as AuthzCatalogDiff } from './authz_catalog_diff.js';
-export { default as AuthzCatalogSync } from './authz_catalog_sync.js';
-export { default as AuthzCatalogPruneOrphans } from './authz_catalog_prune_orphans.js';
-export { default as AuthzScopesRelay } from './authz_scopes_relay.js';
-export { default as AuthzReconcile } from './authz_reconcile.js';
-export { default as AuthzRelationsReconcile } from './authz_relations_reconcile.js';
-export { default as AuthzFreeze } from './authz_freeze.js';
-export { default as AuthzUnfreeze } from './authz_unfreeze.js';
+import type { CommandMetaData } from '@adonisjs/core/types/ace';
+import OpenFgaProvision from './openfga_provision.js';
+import AuthzCatalogDiff from './authz_catalog_diff.js';
+import AuthzCatalogSync from './authz_catalog_sync.js';
+import AuthzCatalogPruneOrphans from './authz_catalog_prune_orphans.js';
+import AuthzScopesRelay from './authz_scopes_relay.js';
+import AuthzReconcile from './authz_reconcile.js';
+import AuthzRelationsReconcile from './authz_relations_reconcile.js';
+import AuthzFreeze from './authz_freeze.js';
+import AuthzUnfreeze from './authz_unfreeze.js';
+export { OpenFgaProvision, AuthzCatalogDiff, AuthzCatalogSync, AuthzCatalogPruneOrphans, AuthzScopesRelay, AuthzReconcile, AuthzRelationsReconcile, AuthzFreeze, AuthzUnfreeze, };
+/** Contrato de loader de ace (`LoadersContract.getMetaData`). */
+export declare function getMetaData(): Promise<CommandMetaData[]>;
+/** Contrato de loader de ace (`LoadersContract.getCommand`): la clase, o `null` si el nombre no es nuestro. */
+export declare function getCommand(metaData: CommandMetaData): Promise<any>;
 //# sourceMappingURL=main.d.ts.map

package/build/commands/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../commands/main.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,gCAAgC,CAAA;AACnF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../commands/main.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,gBAAgB,MAAM,wBAAwB,CAAA;AACrD,OAAO,gBAAgB,MAAM,yBAAyB,CAAA;AACtD,OAAO,gBAAgB,MAAM,yBAAyB,CAAA;AACtD,OAAO,wBAAwB,MAAM,kCAAkC,CAAA;AACvE,OAAO,gBAAgB,MAAM,yBAAyB,CAAA;AACtD,OAAO,cAAc,MAAM,sBAAsB,CAAA;AACjD,OAAO,uBAAuB,MAAM,gCAAgC,CAAA;AACpE,OAAO,WAAW,MAAM,mBAAmB,CAAA;AAC3C,OAAO,aAAa,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,aAAa,GACd,CAAA;AAeD,iEAAiE;AACjE,wBAAgB,WAAW,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAExD;AAED,+GAA+G;AAC/G,wBAAgB,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,CAElE"}

package/build/commands/main.js

@@ -1,14 +1,60 @@
 /**
- * Comandos ace del paquete. Se registran con:
- *   node ace configure @jantstack/adonis-authz
+ * **El loader de ace de los comandos del paquete** (2.4.0-alpha.4). Se
+ * registra con `node ace configure @jantstack/adonis-authz`, que escribe en el
+ * `adonisrc.ts` del consumidor:
+ *
+ *   commands: [() => import('@jantstack/adonis-authz/commands')]
+ *
+ * y ace trata **el módulo importado como el loader**: `Kernel.boot()` llama
+ * `getMetaData()` y `getCommand(meta)` sobre el namespace del módulo, sin
+ * desenvolver `default` (mismo contrato que `@adonisjs/core/commands` y
+ * `@adonisjs/lucid/commands`, que leen un `commands.json` generado por el
+ * assembler; aquí no hay assembler, así que el loader es un `ListLoader`
+ * sobre las nueve clases y no hay índice que generar).
+ *
+ * Hasta alpha.3 este fichero re-exportaba las nueve clases y NADA más, de
+ * modo que en un consumidor configurado con `node ace configure` **`node ace`
+ * entero reventaba** al arrancar (`TypeError: loaderInstance.getMetaData is
+ * not a function`), no solo `openfga:provision`. Ningún caso lo vio porque
+ * ninguno registraba el barrel como lo registra `createAceKernel`
+ * (`tests/commands.spec.ts` · C-1 lo hace desde alpha.4).
+ *
+ * Las re-exportaciones con nombre se MANTIENEN (quien importe una clase
+ * suelta sigue funcionando). Lo que NO vale desde alpha.4 es envolver el
+ * módulo en un `ListLoader(Object.values(m))`: `Object.values` incluye ahora
+ * las dos funciones y `ListLoader.getMetaData()` llama `serialize()` sobre
+ * cada valor. Se registra el módulo directamente, como escribe `configure`.
+ * Y NO se exporta `default`: ace no lo cargaría.
  */
-export { default as OpenFgaProvision } from './openfga_provision.js';
-export { default as AuthzCatalogDiff } from './authz_catalog_diff.js';
-export { default as AuthzCatalogSync } from './authz_catalog_sync.js';
-export { default as AuthzCatalogPruneOrphans } from './authz_catalog_prune_orphans.js';
-export { default as AuthzScopesRelay } from './authz_scopes_relay.js';
-export { default as AuthzReconcile } from './authz_reconcile.js';
-export { default as AuthzRelationsReconcile } from './authz_relations_reconcile.js';
-export { default as AuthzFreeze } from './authz_freeze.js';
-export { default as AuthzUnfreeze } from './authz_unfreeze.js';
+import { ListLoader } from '@adonisjs/core/ace';
+import OpenFgaProvision from './openfga_provision.js';
+import AuthzCatalogDiff from './authz_catalog_diff.js';
+import AuthzCatalogSync from './authz_catalog_sync.js';
+import AuthzCatalogPruneOrphans from './authz_catalog_prune_orphans.js';
+import AuthzScopesRelay from './authz_scopes_relay.js';
+import AuthzReconcile from './authz_reconcile.js';
+import AuthzRelationsReconcile from './authz_relations_reconcile.js';
+import AuthzFreeze from './authz_freeze.js';
+import AuthzUnfreeze from './authz_unfreeze.js';
+export { OpenFgaProvision, AuthzCatalogDiff, AuthzCatalogSync, AuthzCatalogPruneOrphans, AuthzScopesRelay, AuthzReconcile, AuthzRelationsReconcile, AuthzFreeze, AuthzUnfreeze, };
+/** Los nueve, en el orden en que `node ace list` los enseña. */
+const loader = new ListLoader([
+    OpenFgaProvision,
+    AuthzCatalogDiff,
+    AuthzCatalogSync,
+    AuthzCatalogPruneOrphans,
+    AuthzScopesRelay,
+    AuthzReconcile,
+    AuthzRelationsReconcile,
+    AuthzFreeze,
+    AuthzUnfreeze,
+]);
+/** Contrato de loader de ace (`LoadersContract.getMetaData`). */
+export function getMetaData() {
+    return loader.getMetaData();
+}
+/** Contrato de loader de ace (`LoadersContract.getCommand`): la clase, o `null` si el nombre no es nuestro. */
+export function getCommand(metaData) {
+    return loader.getCommand(metaData);
+}
 //# sourceMappingURL=main.js.map

package/build/commands/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../../commands/main.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,kCAAkC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,gCAAgC,CAAA;AACnF,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../commands/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAE/C,OAAO,gBAAgB,MAAM,wBAAwB,CAAA;AACrD,OAAO,gBAAgB,MAAM,yBAAyB,CAAA;AACtD,OAAO,gBAAgB,MAAM,yBAAyB,CAAA;AACtD,OAAO,wBAAwB,MAAM,kCAAkC,CAAA;AACvE,OAAO,gBAAgB,MAAM,yBAAyB,CAAA;AACtD,OAAO,cAAc,MAAM,sBAAsB,CAAA;AACjD,OAAO,uBAAuB,MAAM,gCAAgC,CAAA;AACpE,OAAO,WAAW,MAAM,mBAAmB,CAAA;AAC3C,OAAO,aAAa,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,aAAa,GACd,CAAA;AAED,gEAAgE;AAChE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;IAC5B,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,wBAAwB;IACxB,gBAAgB;IAChB,cAAc;IACd,uBAAuB;IACvB,WAAW;IACX,aAAa;CACP,CAAC,CAAA;AAET,iEAAiE;AACjE,MAAM,UAAU,WAAW;IACzB,OAAO,MAAM,CAAC,WAAW,EAAE,CAAA;AAC7B,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,UAAU,CAAC,QAAyB;IAClD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;AACpC,CAAC"}

package/build/commands/openfga_provision.d.ts

@@ -27,10 +27,54 @@ import { CommandOptions } from '@adonisjs/core/types/ace';
 export default class OpenFgaProvision extends BaseCommand {
     static commandName: string;
     static description: string;
+    /**
+     * **Bootstrap sin base: `startApp: false`, y el comando BOOTEA la app por su
+     * cuenta hasta `boot()`** (2.4.0-alpha.4, opción B del panel; el único de
+     * los nueve con `startApp: false`, a propósito).
+     *
+     * `this.app.config` NO existe hasta `app.boot()`: `Application.init()` no
+     * llama a `ConfigManager.process()`, `boot()` sí (`@adonisjs/application`
+     * 9.0.1; el docblock de `get config()` dice «after init» y es falso). Y el
+     * ignitor de ace solo hace `boot()`+`start()` con `startApp: true`. Hasta
+     * alpha.3 esto leía `this.app.config.get(...)` sobre `undefined`:
+     * `TypeError` en la primera línea de `run()`, en cualquier consumidor.
+     *
+     * Por qué NO `startApp: true` (opción A, la que recomendaba COGNITIV):
+     * `start()` ejecuta el `start()`/`ready()` de TODOS los providers del
+     * consumidor y sus preloads (`start/routes.ts`, `start/kernel.ts`…) —
+     * medido: un `ready()` que consulta la base mata este comando antes de
+     * `run()` con la base ausente, que es exactamente el escenario en el que
+     * corre; un preload que importe `services/relations` construye el driver
+     * de relaciones, que pide el `OPENFGA_STORE_ID` que este comando existe
+     * para producir (circular); y `app_provider.ready()` exige
+     * `config/encryption.ts` válido. Lo que este comando necesita es SOLO el
+     * config, y eso lo da `boot()` (≈80 ms: `config/*` + `register()`/`boot()`
+     * de los providers). Ver `prepare()`.
+     */
     static options: CommandOptions;
     url: string | undefined;
     storeId: string | undefined;
     name: string | undefined;
+    /**
+     * Arranca la app hasta `boot()` — sin `start()` — para que `config/*`
+     * exista. Va en `prepare()` y no en `run()` porque `BaseCommand.exec()`
+     * encadena `prepare()` → `interact()` → `run()` dentro del mismo `try`:
+     * el fallo se reporta igual y `run()` queda limpio de ciclo de vida.
+     *
+     * Las guardas de estado NO son decorativas: `Application.boot()` es un
+     * no-op SILENCIOSO si el estado no es `initiated` (⚪ 9 del auditor), así
+     * que desde `created` primero `init()`; desde `booted`/`ready` (comando
+     * invocado dentro de una app ya arrancada) no se hace nada: idempotente.
+     * Y si tras eso `app.config` sigue sin existir, se dice y se sale con 1
+     * en vez de repetir el `TypeError` con otro disfraz.
+     *
+     * **Lo que sí exige, escrito**: «antes de que haya base» sigue siendo
+     * verdad (cero conexiones, cero consultas, ningún `start`/`ready`, ningún
+     * preload), pero todo `config/*` tiene que poder IMPORTARSE — un
+     * `config/database.ts` que lance por un `.env` incompleto rompe esto igual
+     * que a cualquier otro comando.
+     */
+    prepare(): Promise<void>;
     run(): Promise<void>;
     /**
      * Los permisos del modelo, o `null` (y exit 1) si no hay ninguno: un modelo
@@ -59,9 +103,11 @@ export declare function permissionsOfCatalogs(config: any): Promise<string[]>;
  * pieza que decide si un store recién aprovisionado acepta tuplas de relación.
  *
  * La fuente es el config (`relations.config`), NO `authz_relations_config` de
- * la base: `openfga:provision` es `startApp: false` (bootstrap sin base) y el
- * config es lo único que tiene cargado — igual que los permisos salen de
- * `catalogs` y no de `authz_permissions`.
+ * la base: `openfga:provision` es bootstrap sin base (`startApp: false`;
+ * arranca hasta `boot()` para cargar `config/*`, que tiene que poder
+ * importarse; no ejecuta `start`/`ready` ni preloads) y el config es lo único
+ * que tiene cargado — igual que los permisos salen de `catalogs` y no de
+ * `authz_permissions`.
  */
 export declare function relationsConfigOf(config: any): {
     objectTypes: readonly any[];

package/build/commands/openfga_provision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openfga_provision.d.ts","sourceRoot":"","sources":["../../commands/openfga_provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,SAAsB;IACxC,MAAM,CAAC,WAAW,SAAoE;IAEtF,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAGO,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAGvB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IAE1B,GAAG;IA2DT;;;;OAIG;YACW,kBAAkB;CAajC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ1E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,GAAG,GAAG;IAAE,WAAW,EAAE,SAAS,GAAG,EAAE,CAAA;CAAE,GAAG,SAAS,CAI1F"}
+{"version":3,"file":"openfga_provision.d.ts","sourceRoot":"","sources":["../../commands/openfga_provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAS,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,SAAsB;IACxC,MAAM,CAAC,WAAW,SAAoE;IAEtF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,OAAO,EAAE,cAAc,CAE7B;IAGO,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IAGvB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAG3B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IAEhC;;;;;;;;;;;;;;;;;;OAkBG;IACG,OAAO;IAaP,GAAG;IAkET;;;;OAIG;YACW,kBAAkB;CAajC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ1E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,GAAG,GAAG;IAAE,WAAW,EAAE,SAAS,GAAG,EAAE,CAAA;CAAE,GAAG,SAAS,CAI1F"}

package/build/commands/openfga_provision.js

@@ -35,10 +35,67 @@ import { BaseCommand, flags } from '@adonisjs/core/ace';
 export default class OpenFgaProvision extends BaseCommand {
     static commandName = 'openfga:provision';
     static description = 'Create an OpenFGA store + write the chassis authorization model';
+    /**
+     * **Bootstrap sin base: `startApp: false`, y el comando BOOTEA la app por su
+     * cuenta hasta `boot()`** (2.4.0-alpha.4, opción B del panel; el único de
+     * los nueve con `startApp: false`, a propósito).
+     *
+     * `this.app.config` NO existe hasta `app.boot()`: `Application.init()` no
+     * llama a `ConfigManager.process()`, `boot()` sí (`@adonisjs/application`
+     * 9.0.1; el docblock de `get config()` dice «after init» y es falso). Y el
+     * ignitor de ace solo hace `boot()`+`start()` con `startApp: true`. Hasta
+     * alpha.3 esto leía `this.app.config.get(...)` sobre `undefined`:
+     * `TypeError` en la primera línea de `run()`, en cualquier consumidor.
+     *
+     * Por qué NO `startApp: true` (opción A, la que recomendaba COGNITIV):
+     * `start()` ejecuta el `start()`/`ready()` de TODOS los providers del
+     * consumidor y sus preloads (`start/routes.ts`, `start/kernel.ts`…) —
+     * medido: un `ready()` que consulta la base mata este comando antes de
+     * `run()` con la base ausente, que es exactamente el escenario en el que
+     * corre; un preload que importe `services/relations` construye el driver
+     * de relaciones, que pide el `OPENFGA_STORE_ID` que este comando existe
+     * para producir (circular); y `app_provider.ready()` exige
+     * `config/encryption.ts` válido. Lo que este comando necesita es SOLO el
+     * config, y eso lo da `boot()` (≈80 ms: `config/*` + `register()`/`boot()`
+     * de los providers). Ver `prepare()`.
+     */
     static options = {
         startApp: false,
     };
+    /**
+     * Arranca la app hasta `boot()` — sin `start()` — para que `config/*`
+     * exista. Va en `prepare()` y no en `run()` porque `BaseCommand.exec()`
+     * encadena `prepare()` → `interact()` → `run()` dentro del mismo `try`:
+     * el fallo se reporta igual y `run()` queda limpio de ciclo de vida.
+     *
+     * Las guardas de estado NO son decorativas: `Application.boot()` es un
+     * no-op SILENCIOSO si el estado no es `initiated` (⚪ 9 del auditor), así
+     * que desde `created` primero `init()`; desde `booted`/`ready` (comando
+     * invocado dentro de una app ya arrancada) no se hace nada: idempotente.
+     * Y si tras eso `app.config` sigue sin existir, se dice y se sale con 1
+     * en vez de repetir el `TypeError` con otro disfraz.
+     *
+     * **Lo que sí exige, escrito**: «antes de que haya base» sigue siendo
+     * verdad (cero conexiones, cero consultas, ningún `start`/`ready`, ningún
+     * preload), pero todo `config/*` tiene que poder IMPORTARSE — un
+     * `config/database.ts` que lance por un `.env` incompleto rompe esto igual
+     * que a cualquier otro comando.
+     */
+    async prepare() {
+        if (this.app.getState() === 'created')
+            await this.app.init();
+        if (this.app.getState() === 'initiated')
+            await this.app.boot();
+        if (!this.app.config) {
+            this.logger.error('config/* no está cargado: openfga:provision bootea la app hasta boot() para leer config/authorization.ts ' +
+                `y tras hacerlo app.config sigue sin existir (estado de la app: ${this.app.getState()}). ` +
+                'Comprueba que la app se puede inicializar y que todo config/* se puede importar.');
+            this.exitCode = 1;
+        }
+    }
     async run() {
+        if (this.exitCode === 1)
+            return;
         const config = this.app.config.get('authorization');
         const apiUrl = this.url ?? config?.openfga?.url;
         if (!apiUrl) {
@@ -48,7 +105,7 @@ export default class OpenFgaProvision extends BaseCommand {
         }
         const { OpenFgaClient } = await import('@openfga/sdk');
         // El subpath `/openfga` es la única puerta al SDK (D9).
-        const { openFgaFactsModel, provisionOpenFgaStore } = await import('../src/openfga.js');
+        const { openFgaFactsModel, provisionOpenFgaStore, assertFactsModelPublishable } = await import('../src/openfga.js');
         // Los holders del consumidor viven en SU config, no en el paquete.
         const holderTypes = config?.holderTypes ?? {};
         // Los PERMISOS del modelo (c2r) salen de los catálogos del config. Se
@@ -60,13 +117,19 @@ export default class OpenFgaProvision extends BaseCommand {
             return;
         // Los tipos de RELACIÓN (ReBAC) que el modelo lleva FUSIONADOS (Fase 4-8):
         // salen del CONFIG estático (`relations.config`), igual que los permisos
-        // salen de `catalogs`. El comando es `startApp: false` (bootstrap del
-        // appliance, ANTES de que haya base) y no puede leer `authz_relations_config`
-        // de la BD; el config sí está cargado. Sin `relations.config` el modelo es
+        // salen de `catalogs`. El comando es bootstrap sin base —`startApp: false`,
+        // arranca hasta `boot()` para cargar `config/*`, que tiene que poder
+        // importarse; no ejecuta `start`/`ready` ni preloads— y no puede leer
+        // `authz_relations_config` de la BD; el config sí. Sin `relations.config` el modelo es
         // facts-only, como hasta ahora. Con él, un store recién aprovisionado ya
         // acepta tuplas de relación sin un `authz:catalog:sync` previo.
         const relations = relationsConfigOf(config);
         if (this.storeId) {
+            // El mismo gate que la rama que CREA el store (L-F): la rama que
+            // ACTUALIZA el modelo es justo donde se toca el techo de bytes, y sin
+            // esto salía como error crudo del SDK con una request ya hecha (⚪ N1
+            // del auditor de alpha.4). Cero requests si no es publicable.
+            assertFactsModelPublishable(holderTypes, permissions, undefined, relations);
             const client = new OpenFgaClient({ apiUrl, storeId: this.storeId });
             const model = await client.writeAuthorizationModel(openFgaFactsModel(holderTypes, permissions, relations));
             this.logger.success('Nuevo authorization model escrito en el store existente.');
@@ -144,9 +207,11 @@ export async function permissionsOfCatalogs(config) {
  * pieza que decide si un store recién aprovisionado acepta tuplas de relación.
  *
  * La fuente es el config (`relations.config`), NO `authz_relations_config` de
- * la base: `openfga:provision` es `startApp: false` (bootstrap sin base) y el
- * config es lo único que tiene cargado — igual que los permisos salen de
- * `catalogs` y no de `authz_permissions`.
+ * la base: `openfga:provision` es bootstrap sin base (`startApp: false`;
+ * arranca hasta `boot()` para cargar `config/*`, que tiene que poder
+ * importarse; no ejecuta `start`/`ready` ni preloads) y el config es lo único
+ * que tiene cargado — igual que los permisos salen de `catalogs` y no de
+ * `authz_permissions`.
  */
 export function relationsConfigOf(config) {
     const objectTypes = config?.relations?.config?.objectTypes;

package/build/commands/openfga_provision.js.map

@@ -1 +1 @@
-{"version":3,"file":"openfga_provision.js","sourceRoot":"","sources":["../../commands/openfga_provision.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAGvD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,GAAG,mBAAmB,CAAA;IACxC,MAAM,CAAC,WAAW,GAAG,iEAAiE,CAAA;IAEtF,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,KAAK;KAChB,CAAA;IAWD,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,OAAO,EAAE,GAAG,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAA;YAChG,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAA;QACtD,wDAAwD;QACxD,MAAM,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;QACtF,mEAAmE;QACnE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAA;QAE7C,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,iBAAiB;QACjB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;QACzD,IAAI,CAAC,WAAW;YAAE,OAAM;QAExB,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,8EAA8E;QAC9E,2EAA2E;QAC3E,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;QAE3C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACnE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAChD,iBAAiB,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,CACvD,CAAA;YACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAA;YAC/E,IAAI,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACvH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QAED,wEAAwE;QACxE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CACtD,MAAM,EACN,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAC3D,WAAW,EACX,WAAW,EACX,SAAS,CACV,CAAA;QACD,IAAI,SAAS;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACvH,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAA;QACjE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAA;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAW;QAC1C,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAA;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,6EAA6E;gBAC3E,qFAAqF;gBACrF,oDAAoD,CACvD,CAAA;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;;AApFO;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;6CAC5C;AAGvB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;;iDACnD;AAG3B;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;;8CAC9D;AAiFlC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAW;IACrD,MAAM,OAAO,GAAoC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAA;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAA;QAC9B,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,WAAW,IAAI,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACjF,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAW;IAC3C,MAAM,WAAW,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAA;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7E,OAAO,EAAE,WAAW,EAAE,CAAA;AACxB,CAAC"}
+{"version":3,"file":"openfga_provision.js","sourceRoot":"","sources":["../../commands/openfga_provision.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAGvD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,WAAW;IACvD,MAAM,CAAC,WAAW,GAAG,mBAAmB,CAAA;IACxC,MAAM,CAAC,WAAW,GAAG,iEAAiE,CAAA;IAEtF;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,OAAO,GAAmB;QAC/B,QAAQ,EAAE,KAAK;KAChB,CAAA;IAWD;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,WAAW;YAAE,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,2GAA2G;gBACzG,kEAAkE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK;gBAC1F,kFAAkF,CACrF,CAAA;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG;QACP,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAM;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAQ,CAAA;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,OAAO,EAAE,GAAG,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAA;YAChG,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAA;QACtD,wDAAwD;QACxD,MAAM,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAA;QACnH,mEAAmE;QACnE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAA;QAE7C,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,iBAAiB;QACjB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;QACzD,IAAI,CAAC,WAAW;YAAE,OAAM;QAExB,2EAA2E;QAC3E,yEAAyE;QACzE,4EAA4E;QAC5E,qEAAqE;QACrE,sEAAsE;QACtE,uFAAuF;QACvF,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;QAE3C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,iEAAiE;YACjE,sEAAsE;YACtE,qEAAqE;YACrE,8DAA8D;YAC9D,2BAA2B,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;YAC3E,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACnE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAChD,iBAAiB,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,CACvD,CAAA;YACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAA;YAC/E,IAAI,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACvH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,sBAAsB,EAAE,CAAC,CAAA;YACnE,OAAM;QACR,CAAC;QAED,wEAAwE;QACxE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CACtD,MAAM,EACN,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAC3D,WAAW,EACX,WAAW,EACX,SAAS,CACV,CAAA;QACD,IAAI,SAAS;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACvH,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAA;QACjE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAA;QAChE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAW;QAC1C,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAA;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,6EAA6E;gBAC3E,qFAAqF;gBACrF,oDAAoD,CACvD,CAAA;YACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAA;YACjB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;;AA3HO;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;6CAC5C;AAGvB;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;;iDACnD;AAG3B;IADP,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;;8CAC9D;AAwHlC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAW;IACrD,MAAM,OAAO,GAAoC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAA;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAA;QAC9B,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,WAAW,IAAI,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACjF,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAW;IAC3C,MAAM,WAAW,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAA;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7E,OAAO,EAAE,WAAW,EAAE,CAAA;AACxB,CAAC"}

package/build/index.d.ts

@@ -84,7 +84,7 @@ export type { DatabaseDriverOptions } from './src/drivers/database_driver.js';
  * opcional `@openfga/sdk`. Un consumidor solo-database arranca sin él (D9).
  */
 export { APP_SCOPE, APP_SCOPE_TYPE, DEFAULT_RECONCILE_MAX_TUPLES } from './src/types.js';
-export type { AuthorizationDriver, AuthorizationDriverFactory, AuthorizedScopes, AuthzWriteEvent, AuthzCatalogWriteEvent, CatalogPermissionSpec, CatalogRole, CatalogRoleSpec, CatalogSpec, ScopedRoleChanges, ScopedRoleSpec, DenyOptions, DenyRef, ExcludedSubtree, GrantOptions, GrantOutcome, HolderTypeMap, ReconcileCounts, ReconcileFact, ReconcileFactPage, ReconcileFactsEnumerator, ReconcileOptions, ReconcileReport, ReconcileSkip, ReconcileSource, RoleQuery, ScopeChainResolver, ScopeDescendantsResolver, ScopeEdge, ScopeEdgePage, ScopeEdgesEnumerator, ScopedWriteOptions, ScopeRef, ScopeType, SubjectRef, WriteOptions, RelationsDriver, RelationsDriverCapabilities, RelObject, RelSubject, RelUserset, RelationRef, RelationWriteEvent, RelationWriteOptions, RelationTransactionOptions, RelationPurgeOptions, RelationPage, RelationObjectsPage, RelationSubjectsPage, RelationTuple, RelationTuplePage, } from './src/types.js';
+export type { AuthorizationDriver, AuthorizationDriverFactory, AuthorizedScopes, AuthzWriteEvent, AuthzCatalogWriteEvent, CatalogPermissionSpec, CatalogRole, CatalogRoleSpec, CatalogSpec, ScopedRoleChanges, ScopedRoleSpec, DenyOptions, DenyRef, ExcludedSubtree, GrantOptions, GrantOutcome, HolderTypeMap, ReconcileCounts, ReconcileFact, ReconcileFactPage, ReconcileFactsEnumerator, ReconcileOptions, ReconcileReport, ReconcileSkip, ReconcileSource, RoleQuery, ScopeChainResolver, ScopeDescendantsResolver, ScopeEdge, ScopeEdgePage, ScopeEdgesEnumerator, ScopedWriteOptions, ScopeRef, ScopeType, SubjectRef, WriteOptions, AuthorizationDriverCapabilities, RelationsDriver, RelationsDriverCapabilities, RelObject, RelSubject, RelUserset, RelationRef, RelationWriteEvent, RelationWriteOptions, RelationTransactionOptions, RelationPurgeOptions, RelationPage, RelationObjectsPage, RelationSubjectsPage, RelationTuple, RelationTuplePage, } from './src/types.js';
 export { isRelUserset } from './src/types.js';
 /**
  * **¿De quién es esta transacción?** (L-1 · 🟠 9, regla del puerto `{trx}`):

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACtK,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAE9G;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,gCAAgC,CAAA;AAEvC;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,YAAY,EAAE,2BAA2B,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AACpG,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC1E,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAE3F;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAElE;;;;;GAKG;AACH,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EAItB,gBAAgB,EAChB,cAAc,GACf,MAAM,iBAAiB,CAAA;AAExB;;;;;GAKG;AACH,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAA;AAClF,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACjE,YAAY,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAA;AAIvG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iCAAiC,CAAA;AACxC,YAAY,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAA;AAIlF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAA;AACpF,YAAY,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEjF,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACjG,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAE7E;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAA;AACxF,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,WAAW,EACX,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,OAAO,EACP,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,eAAe,EACf,SAAS,EACT,kBAAkB,EAClB,wBAAwB,EACxB,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,UAAU,EACV,YAAY,EACZ,eAAe,EACf,2BAA2B,EAC3B,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,EACpB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C;;;;;;;;GAQG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAA;AAC3E,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAElG,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACtK,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAE9G;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,gCAAgC,CAAA;AAEvC;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,YAAY,EAAE,2BAA2B,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAA;AACpG,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAC1E,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAE3F;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAElE;;;;;GAKG;AACH,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EACf,yBAAyB,EACzB,sBAAsB,EAItB,gBAAgB,EAChB,cAAc,GACf,MAAM,iBAAiB,CAAA;AAExB;;;;;GAKG;AACH,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEhE;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAA;AAClF,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,4CAA4C,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,YAAY,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACjE,YAAY,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAA;AAIvG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iCAAiC,CAAA;AACxC,YAAY,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAA;AAIlF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAA;AACpF,YAAY,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAA;AAChG,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEjF,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACjG,YAAY,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AAE7E;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAA;AACxF,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,WAAW,EACX,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,OAAO,EACP,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,eAAe,EACf,SAAS,EACT,kBAAkB,EAClB,wBAAwB,EACxB,SAAS,EACT,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,UAAU,EACV,YAAY,EACZ,+BAA+B,EAC/B,eAAe,EACf,2BAA2B,EAC3B,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,EACpB,aAAa,EACb,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C;;;;;;;;GAQG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAA;AAC3E,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAElG,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEtK,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,0BAA0B,CAAA;AAGjC;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AAYvC;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAE1E,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAG1E;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAGtD;;;;;GAKG;AACH,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EACf,yBAAyB,EACzB,sBAAsB;AACtB,0EAA0E;AAC1E,yEAAyE;AACzE,6EAA6E;AAC7E,gBAAgB,EAChB,cAAc,GACf,MAAM,iBAAiB,CAAA;AAExB;;;;;GAKG;AACH,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAA;AAG1B;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAA;AAQlF,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAEjE,+EAA+E;AAC/E,8EAA8E;AAC9E,8DAA8D;AAC9D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iCAAiC,CAAA;AAExC,iEAAiE;AACjE,0EAA0E;AAC1E,6EAA6E;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAA;AAEpF,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEjF,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AAGjG;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAA;AAsDxF,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C;;;;;;;;GAQG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAA;AAG3E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,eAAe,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEtK,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,GACb,MAAM,0BAA0B,CAAA;AAGjC;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AAYvC;;;GAGG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D;;;;GAIG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAE1E,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAG1E;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAGtD;;;;;GAKG;AACH,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,yBAAyB,EACzB,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,EACf,yBAAyB,EACzB,sBAAsB;AACtB,0EAA0E;AAC1E,yEAAyE;AACzE,6EAA6E;AAC7E,gBAAgB,EAChB,cAAc,GACf,MAAM,iBAAiB,CAAA;AAExB;;;;;GAKG;AACH,OAAO,EACL,cAAc,EACd,aAAa,EACb,WAAW,EACX,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAA;AAG1B;;;;;GAKG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAA;AAQlF,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAE7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAEjE,+EAA+E;AAC/E,8EAA8E;AAC9E,8DAA8D;AAC9D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,iCAAiC,CAAA;AAExC,iEAAiE;AACjE,0EAA0E;AAC1E,6EAA6E;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAA;AAEpF,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAEjF,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AAGjG;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAA;AAuDxF,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C;;;;;;;;GAQG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAA;AAG3E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AACtF,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAC7E,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAA"}

package/build/src/drivers/openfga_driver.d.ts

@@ -89,8 +89,10 @@ export declare function correlateBatchResults(checks: ClientBatchCheckItem[], re
  *
  * Los permisos entran aquí porque el modelo (c2r) declara CUATRO relaciones
  * por permiso: un store provisionado sin ellos no puede responder a ninguna
- * pregunta. `assertFactsModelPublishable` comprueba antes las cotas (nombre
- * de relación y techo de 262.144 bytes ⇒ 500 `E_AUTHZ_MODEL_TOO_LARGE`).
+ * pregunta. `assertFactsModelPublishable` comprueba las cotas (nombre de
+ * relación y techo de 262.144 bytes ⇒ 500 `E_AUTHZ_MODEL_TOO_LARGE`) **antes
+ * de crear el store** (2.4.0-alpha.4): un catálogo impublicable no deja un
+ * store huérfano ni sale como error crudo del SDK.
  * Añadir un permiso al catálogo obliga a republicar el modelo: es lo que
  * hace `syncAuthzCatalog` con la proyección inyectada, y por eso el modelo
  * versionado del store se escribe con `--store-id`.

package/build/src/drivers/openfga_driver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openfga_driver.d.ts","sourceRoot":"","sources":["../../../src/drivers/openfga_driver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAkBxF,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAGjB,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,aAAa,EAGb,iBAAiB,EAEjB,gBAAgB,EAChB,eAAe,EAEf,eAAe,EACf,SAAS,EACT,kBAAkB,EAClB,WAAW,EACX,QAAQ,EACR,SAAS,EACT,UAAU,EACV,YAAY,EACb,MAAM,aAAa,CAAA;AA2CpB,OAAO,EAAE,YAAY,EAAoF,MAAM,6BAA6B,CAAA;AAC5I,OAAO,KAAK,EAAE,iBAAiB,EAAe,cAAc,EAAe,MAAM,6BAA6B,CAAA;AAC9G,OAAO,EAYL,iBAAiB,EAYlB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAiC,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAI7F,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;GAIG;AACH,YAAY,EAAE,aAAa,EAAE,CAAA;AAE7B;;;;GAIG;AACH,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAQ5B;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAenF;AA8BD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,oBAAoB,EAAE,EAC9B,OAAO,EAAE,8BAA8B,EAAE,GACxC,8BAA8B,EAAE,CA4BlC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,SAAS,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAM/C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAaxD;AAsFD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yDAAyD;IACzD,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC;;;OAGG;IACH,WAAW,EAAE,aAAa,CAAA;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IACxC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,oBAAoB,GAAG,kBAAkB,CAAA;IACvD;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACzD;;;;OAIG;IACH,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAA;IACX;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAE,GAChE,IAAI,CAUN;AAED,eAAO,MAAM,kBAAkB,OAAQ,CAAA;AAiCvC;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QAAS,CAAA;AACpC;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,OAAQ,CAAA;AACzC,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE;;;;;;;;;;;OAWG;IACH,IAAI,YAAY;;;;;;;;;;OAkCf;IAED,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,WAAW,CAAe;IAElC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW;;MAA6B;IACjD,OAAO,CAAC,MAAM,CAAiC;IAC/C,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,WAAW,CAAuB;IAC1C,oFAAoF;IACpF,OAAO,CAAC,GAAG,CAAO;IAClB;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;gBAElB,OAAO,EAAE,oBAAoB;IAqCzC;;;;;;OAMG;IACH,OAAO,CAAC,KAAK;IAIb,gFAAgF;IAChF,OAAO,CAAC,UAAU;IAIlB,oFAAoF;IACpF,OAAO,CAAC,eAAe;IAIvB,gHAAgH;IAChH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;OAMG;IACH,iBAAiB,CAAC,YAAY,EAAE,kBAAkB,GAAG,mBAAmB;IAMxE;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,KAAK,GAAG,mBAAmB;IAS1C;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;OAIG;IACH,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,UAAU;IAIlB;;;;OAIG;YACW,aAAa;YAiCb,cAAc;IAI5B;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY;IAUd,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAe3F;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,cAAc;IAa5B;;;;;;;OAOG;IACG,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAcpG;;;;;;;;;;OAUG;YACW,kBAAkB;IAyBhC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAKnB,KAAK,CACT,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,QAAQ,EACf,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,YAAY,CAAC;IA6IxB;;;;;;OAMG;YACW,eAAe;IAmB7B;;;;;;OAMG;YACW,iBAAiB;IAW/B;;;;;;;;OAQG;YACW,cAAc;IAoBtB,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBpG,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IA0BhF,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAWrG,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjH;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,SAAS;IASjB;;;;OAIG;IACG,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IA2C3E;;;OAGG;YACW,YAAY;IAY1B,2FAA2F;YAC7E,eAAe;IAkB7B;;;;;;;;;OASG;YACW,WAAW;IA+BzB,OAAO,CAAC,aAAa;IAkBrB,OAAO,CAAC,IAAI;IAIN,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBxE;;;;;OAKG;IACG,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,QAAQ,CAAC;QAAC,IAAI,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;IAyB/G,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAuB9E,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IA+B9E;;;;;OAKG;IACG,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAqB3E;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IASvB;;;;;OAKG;IACG,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE;;;;;;;;OAQG;IACG,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE;;;;;;;;;;;;;;;;;;OAkBG;YACW,UAAU;IAyBxB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,eAAe,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBrD;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,QAAQ;IAyDtB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,sBAAsB;IA8CpC;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,mBAAmB;IA+BjC;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;;;;;OAMG;YACW,iBAAiB;IAwB/B;;;;;;;OAOG;YACW,UAAU;IA2BxB;;;;;;;;;;OAUG;IACG,UAAU,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0GjD;;;;;;;;;;;OAWG;IACH,iBAAiB,IAAI,iBAAiB;IAStC;;;;;;;;;;;;;;;;;;OAkBG;YACW,eAAe;IAW7B;;;;;;;;;OASG;YACW,cAAc;IA+C5B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuFhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBlE;;;;;;;;;;;;;;;;OAgBG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACG,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC;IA4MlG;;;;;OAKG;YACW,gBAAgB;IAS9B;;;;;;OAMG;YACW,cAAc;IA6E5B;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,eAAe;IA0E7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;YACW,kBAAkB;IA2BhC;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,eAAe;IAiF7B;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IA4CtB,gFAAgF;IAChF,OAAO,CAAC,QAAQ;IAwBhB;;;;;;;;;;OAUG;YACW,OAAO;IAoBrB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAwHzF;;;;;;OAMG;YACW,cAAc;IAsD5B;;;;;;OAMG;YACW,oBAAoB;IAWlC;;;;;;;;;;;;;OAaG;YACW,aAAa;CAoD5B"}
+{"version":3,"file":"openfga_driver.d.ts","sourceRoot":"","sources":["../../../src/drivers/openfga_driver.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAkBxF,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAGjB,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,aAAa,EAGb,iBAAiB,EAEjB,gBAAgB,EAChB,eAAe,EAEf,eAAe,EACf,SAAS,EACT,kBAAkB,EAClB,WAAW,EACX,QAAQ,EACR,SAAS,EACT,UAAU,EACV,YAAY,EACb,MAAM,aAAa,CAAA;AA2CpB,OAAO,EAAE,YAAY,EAAoF,MAAM,6BAA6B,CAAA;AAC5I,OAAO,KAAK,EAAE,iBAAiB,EAAe,cAAc,EAAe,MAAM,6BAA6B,CAAA;AAC9G,OAAO,EAYL,iBAAiB,EAYlB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAiC,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAI7F,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;GAIG;AACH,YAAY,EAAE,aAAa,EAAE,CAAA;AAE7B;;;;GAIG;AACH,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAQ5B;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAenF;AA8BD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,oBAAoB,EAAE,EAC9B,OAAO,EAAE,8BAA8B,EAAE,GACxC,8BAA8B,EAAE,CA4BlC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,SAAS,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAc/C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAaxD;AAsFD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,yDAAyD;IACzD,YAAY,CAAC,EAAE,kBAAkB,CAAA;IACjC;;;OAGG;IACH,WAAW,EAAE,aAAa,CAAA;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IACxC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,oBAAoB,GAAG,kBAAkB,CAAA;IACvD;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACzD;;;;OAIG;IACH,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAA;IACX;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAE,GAChE,IAAI,CAUN;AAED,eAAO,MAAM,kBAAkB,OAAQ,CAAA;AAiCvC;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QAAS,CAAA;AACpC;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,OAAQ,CAAA;AACzC,qBAAa,0BAA2B,YAAW,mBAAmB;IACpE;;;;;;;;;;;OAWG;IACH,IAAI,YAAY;;;;;;;;;;OAkCf;IAED,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,WAAW,CAAe;IAElC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW;;MAA6B;IACjD,OAAO,CAAC,MAAM,CAAiC;IAC/C,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,WAAW,CAAuB;IAC1C,oFAAoF;IACpF,OAAO,CAAC,GAAG,CAAO;IAClB;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;gBAElB,OAAO,EAAE,oBAAoB;IAqCzC;;;;;;OAMG;IACH,OAAO,CAAC,KAAK;IAIb,gFAAgF;IAChF,OAAO,CAAC,UAAU;IAIlB,oFAAoF;IACpF,OAAO,CAAC,eAAe;IAIvB,gHAAgH;IAChH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;OAMG;IACH,iBAAiB,CAAC,YAAY,EAAE,kBAAkB,GAAG,mBAAmB;IAMxE;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,KAAK,GAAG,mBAAmB;IAS1C;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;OAIG;IACH,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,UAAU;IAIlB;;;;OAIG;YACW,aAAa;YAiCb,cAAc;IAI5B;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY;IAUd,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAe3F;;;;;;;;;;;;;;;;;;;;;OAqBG;YACW,cAAc;IAa5B;;;;;;;OAOG;IACG,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAcpG;;;;;;;;;;OAUG;YACW,kBAAkB;IAyBhC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAKnB,KAAK,CACT,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,QAAQ,EACf,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,YAAY,CAAC;IA6IxB;;;;;;OAMG;YACW,eAAe;IAmB7B;;;;;;OAMG;YACW,iBAAiB;IAW/B;;;;;;;;OAQG;YACW,cAAc;IAoBtB,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBpG,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IA0BhF,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAWrG,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjH;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,SAAS;IASjB;;;;OAIG;IACG,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IA2C3E;;;OAGG;YACW,YAAY;IAY1B,2FAA2F;YAC7E,eAAe;IAkB7B;;;;;;;;;OASG;YACW,WAAW;IA+BzB,OAAO,CAAC,aAAa;IAkBrB,OAAO,CAAC,IAAI;IAIN,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBxE;;;;;OAKG;IACG,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,QAAQ,CAAC;QAAC,IAAI,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;IAyB/G,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAuB9E,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IA+B9E;;;;;OAKG;IACG,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAqB3E;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IASvB;;;;;OAKG;IACG,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE;;;;;;;;OAQG;IACG,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE;;;;;;;;;;;;;;;;;;OAkBG;YACW,UAAU;IAyBxB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,eAAe,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBrD;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,QAAQ;IAyDtB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,sBAAsB;IA8CpC;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,mBAAmB;IA+BjC;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;;;;;OAMG;YACW,iBAAiB;IAwB/B;;;;;;;OAOG;YACW,UAAU;IA2BxB;;;;;;;;;;OAUG;IACG,UAAU,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0GjD;;;;;;;;;;;OAWG;IACH,iBAAiB,IAAI,iBAAiB;IAStC;;;;;;;;;;;;;;;;;;OAkBG;YACW,eAAe;IAW7B;;;;;;;;;OASG;YACW,cAAc;IA+C5B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuFhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBlE;;;;;;;;;;;;;;;;OAgBG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACG,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC;IA4MlG;;;;;OAKG;YACW,gBAAgB;IAS9B;;;;;;OAMG;YACW,cAAc;IA6E5B;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,eAAe;IA0E7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;YACW,kBAAkB;IA2BhC;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,eAAe;IAiF7B;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IA4CtB,gFAAgF;IAChF,OAAO,CAAC,QAAQ;IAwBhB;;;;;;;;;;OAUG;YACW,OAAO;IAoBrB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,cAAc,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAwHzF;;;;;;OAMG;YACW,cAAc;IAsD5B;;;;;;OAMG;YACW,oBAAoB;IAWlC;;;;;;;;;;;;;OAaG;YACW,aAAa;CAoD5B"}

package/build/src/drivers/openfga_driver.js

@@ -126,8 +126,10 @@ export function correlateBatchResults(checks, results) {
  *
  * Los permisos entran aquí porque el modelo (c2r) declara CUATRO relaciones
  * por permiso: un store provisionado sin ellos no puede responder a ninguna
- * pregunta. `assertFactsModelPublishable` comprueba antes las cotas (nombre
- * de relación y techo de 262.144 bytes ⇒ 500 `E_AUTHZ_MODEL_TOO_LARGE`).
+ * pregunta. `assertFactsModelPublishable` comprueba las cotas (nombre de
+ * relación y techo de 262.144 bytes ⇒ 500 `E_AUTHZ_MODEL_TOO_LARGE`) **antes
+ * de crear el store** (2.4.0-alpha.4): un catálogo impublicable no deja un
+ * store huérfano ni sale como error crudo del SDK.
  * Añadir un permiso al catálogo obliga a republicar el modelo: es lo que
  * hace `syncAuthzCatalog` con la proyección inyectada, y por eso el modelo
  * versionado del store se escribe con `--store-id`.
@@ -141,11 +143,19 @@ export function correlateBatchResults(checks, results) {
  * found»). El gate de bytes mide el modelo FUSIONADO.
  */
 export async function provisionOpenFgaStore(apiUrl, name, holderTypeMap, permissions, relations) {
+    // El modelo se construye y se VALIDA antes de crear el store (2.4.0-alpha.4,
+    // ⚪ 7 del auditor): hasta alpha.3 el `createStore` iba primero, así que un
+    // catálogo inválido (slugs que colisionan, `holderTypes` no inyectivo) o
+    // que desborda el techo de bytes dejaba un store HUÉRFANO sin modelo en el
+    // servidor por cada intento, y el techo llegaba como error crudo del SDK
+    // en vez de 500 `E_AUTHZ_MODEL_TOO_LARGE`. Cero requests si no es publicable.
+    assertFactsModelPublishable(holderTypeMap, permissions, undefined, relations);
+    const model = openFgaFactsModel(holderTypeMap, permissions, relations);
     const client = new OpenFgaClient({ apiUrl });
     const store = await client.createStore({ name });
     const scoped = new OpenFgaClient({ apiUrl, storeId: store.id });
-    const model = await scoped.writeAuthorizationModel(openFgaFactsModel(holderTypeMap, permissions, relations));
-    return { storeId: store.id, modelId: model.authorization_model_id };
+    const written = await scoped.writeAuthorizationModel(model);
+    return { storeId: store.id, modelId: written.authorization_model_id };
 }
 /**
  * ¿El error (o su cadena de causas) es el rechazo de FGA a escribir una tuple