@mesh-tech/mesh-cli 0.38.1 → 0.39.0

package/dist/src/commands/local/app-authz.d.ts

@@ -0,0 +1,118 @@
+export declare const LOCAL_APP_SPICEDB_IMAGE = "authzed/spicedb:v1.42.1";
+export declare const LOCAL_APP_SPICEDB_KEY = "local-dev-key";
+export declare const LOCAL_APP_SPICEDB_LABEL = "mesh.local.app-spicedb";
+export declare const LOCAL_STACK_NETWORK = "mesh-local_mesh_network";
+export type AuthzMode = "policy-engine" | "role-gating";
+export declare function readLocalAuthzConfig(appRoot: string): {
+    schema: string;
+    prebuilt: boolean;
+} | null;
+export declare function appSpiceDBSlot(app: string): number;
+export declare function appSpiceDBPorts(slot: number): {
+    grpc: number;
+    http: number;
+};
+export declare const appSpiceDBContainerName: (app: string) => string;
+export declare const appSpiceDBDatabase: (app: string) => string;
+export declare const appSpiceDBSecretName: (tenant: string, env: string, app: string) => string;
+export declare const spicedbInstanceParam: (tenant: string, env: string, instanceId: string) => string;
+export declare const appAuthzParam: (tenant: string, env: string, app: string) => string;
+export declare function instanceRegistryValue(args: {
+    app: string;
+    tenant: string;
+    env: string;
+    grpcPort: number;
+    httpPort: number;
+}): Record<string, unknown>;
+export declare function buildAppAuthzPointer(args: {
+    existing: Record<string, unknown>;
+    mode: AuthzMode;
+    instanceId?: string;
+    zitadel?: {
+        projectId: string;
+        orgId: string;
+    };
+    metadataRef: string;
+}): Record<string, unknown>;
+export declare function appSpiceDBEnv(args: {
+    grpcPort: number;
+    httpPort: number;
+    metadataPath: string;
+}): Record<string, string>;
+export declare function spicedbMigrateArgs(app: string): string[];
+export declare function spicedbServeArgs(app: string, ports: {
+    grpc: number;
+    http: number;
+}): string[];
+export declare function parseDockerPort(output: string): number | null;
+export type DockerResult = {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+};
+export type DockerRunner = (args: string[]) => DockerResult;
+export declare const defaultDocker: DockerRunner;
+export declare function ensureLocalAppSpiceDB(app: string, deps?: {
+    docker?: DockerRunner;
+    portFree?: (port: number) => Promise<boolean>;
+}): Promise<{
+    grpcPort: number;
+    httpPort: number;
+    created: boolean;
+}>;
+export declare function writeSpiceDBSchema(httpUrl: string, zed: string, opts?: {
+    fetchImpl?: typeof fetch;
+    attempts?: number;
+    delayMs?: number;
+}): Promise<void>;
+export declare function removeLocalAppSpiceDBs(docker?: DockerRunner): string[];
+export type ModuleImporter = (specifier: string, parentFile: string) => Promise<Record<string, any>>;
+export declare const tsxImporter: ModuleImporter;
+export type AppSchema = {
+    namespace: string;
+    mode?: AuthzMode;
+} & Record<string, unknown>;
+type Compilers = {
+    compileOpsHubMetadata: (schema: AppSchema) => unknown;
+    compileSpiceDBSchema: (schema: AppSchema) => {
+        zed: string;
+    };
+};
+export declare function loadAppAuthz(appRoot: string, schemaRel: string, importer?: ModuleImporter): Promise<{
+    schema: AppSchema;
+    compilers: Compilers;
+    chunk?: (body: string) => {
+        value: string;
+        parts: readonly string[];
+    };
+}>;
+export type ParamStore = {
+    get(name: string): Promise<string | undefined>;
+    put(name: string, value: string): Promise<void>;
+};
+export declare const localParamStore: () => Promise<ParamStore>;
+export type PublishLocalAppAuthzDeps = {
+    importer?: ModuleImporter;
+    params?: ParamStore;
+    putSecret?: (name: string, value: Record<string, string>) => Promise<void>;
+    ensureSpiceDB?: typeof ensureLocalAppSpiceDB;
+    writeSchema?: typeof writeSpiceDBSchema;
+};
+export declare function publishLocalAppAuthz(args: {
+    appRoot: string;
+    schema: string;
+    tenant: string;
+    app: string;
+    zitadel?: {
+        projectId: string;
+        orgId: string;
+    };
+}, deps?: PublishLocalAppAuthzDeps): Promise<{
+    mode: AuthzMode;
+    env: Record<string, string>;
+    instance?: {
+        grpcPort: number;
+        httpPort: number;
+    };
+}>;
+export {};

package/dist/src/commands/local/app-authz.js

@@ -0,0 +1,295 @@
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { MeshCliError } from "../../utils/errors.js";
+import { upsertLocalSecret, probeTcp } from "./helpers.js";
+import { LOCAL_AWS_CONFIG, LOCAL_ENV } from "./seed.js";
+import { COMPOSE_PROJECT } from "./stack.js";
+export const LOCAL_APP_SPICEDB_IMAGE = "authzed/spicedb:v1.42.1";
+export const LOCAL_APP_SPICEDB_KEY = "local-dev-key";
+export const LOCAL_APP_SPICEDB_LABEL = "mesh.local.app-spicedb";
+export const LOCAL_STACK_NETWORK = `${COMPOSE_PROJECT}_mesh_network`;
+const STACK = "local";
+const GRPC_PORT_BASE = 50100;
+const HTTP_PORT_BASE = 18100;
+const PORT_SLOTS = 100;
+export function readLocalAuthzConfig(appRoot) {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(appRoot, "package.json"), "utf-8"));
+        const schema = pkg?.mesh?.authz?.schema;
+        if (typeof schema !== "string" || !schema.trim())
+            return null;
+        return { schema: schema.trim(), prebuilt: pkg?.mesh?.authz?.metadata !== undefined };
+    }
+    catch {
+        return null;
+    }
+}
+const slug = (name, sep) => name.toLowerCase().replace(/[^a-z0-9]+/g, sep).replace(new RegExp(`^\\${sep}+|\\${sep}+$`, "g"), "");
+export function appSpiceDBSlot(app) {
+    return createHash("sha256").update(app).digest().readUInt32BE(0) % PORT_SLOTS;
+}
+export function appSpiceDBPorts(slot) {
+    const s = ((slot % PORT_SLOTS) + PORT_SLOTS) % PORT_SLOTS;
+    return { grpc: GRPC_PORT_BASE + s, http: HTTP_PORT_BASE + s };
+}
+export const appSpiceDBContainerName = (app) => `mesh-local-spicedb-${slug(app, "-")}`;
+export const appSpiceDBDatabase = (app) => `spicedb_${slug(app, "_")}`.slice(0, 63);
+export const appSpiceDBSecretName = (tenant, env, app) => `mesh/${tenant}/${env}/${app}/spicedb/preshared-key`;
+export const spicedbInstanceParam = (tenant, env, instanceId) => `/mesh-platform/${tenant}/${env}/authz/spicedb-instances/${instanceId}`;
+export const appAuthzParam = (tenant, env, app) => `/mesh-platform/${tenant}/${env}/apps/${app}/stacks/${STACK}/authz`;
+export function instanceRegistryValue(args) {
+    const secret = appSpiceDBSecretName(args.tenant, args.env, args.app);
+    return {
+        grpcEndpoint: `localhost:${args.grpcPort}`,
+        httpEndpoint: `localhost:${args.httpPort}`,
+        namespace: args.app,
+        presharedKeySecretName: secret,
+        configSecretName: secret,
+        owner: { kind: "app", name: args.app },
+    };
+}
+export function buildAppAuthzPointer(args) {
+    const existingZitadel = args.existing.zitadel && typeof args.existing.zitadel === "object"
+        ? args.existing.zitadel
+        : {};
+    return {
+        ...args.existing,
+        spicedb: {
+            instanceRefs: args.mode === "policy-engine" && args.instanceId ? [{ instanceId: args.instanceId }] : [],
+        },
+        ...(args.zitadel || Object.keys(existingZitadel).length > 0
+            ? { zitadel: { ...existingZitadel, ...(args.zitadel ?? {}) } }
+            : {}),
+        opsHubMetadataRef: args.metadataRef,
+        mode: args.mode,
+    };
+}
+export function appSpiceDBEnv(args) {
+    return {
+        SPICEDB_ENDPOINT: `localhost:${args.grpcPort}`,
+        SPICEDB_HTTP_ENDPOINT: `http://localhost:${args.httpPort}`,
+        SPICEDB_PRESHARED_KEY: LOCAL_APP_SPICEDB_KEY,
+        SPICEDB_TOKEN: LOCAL_APP_SPICEDB_KEY,
+        AUTHZ_METADATA_SSM_PATH: args.metadataPath,
+    };
+}
+const datastoreUri = (app) => `postgres://postgres:postgres@database:5432/${appSpiceDBDatabase(app)}?sslmode=disable`;
+export function spicedbMigrateArgs(app) {
+    return [
+        "run", "--rm", "--network", LOCAL_STACK_NETWORK,
+        "-e", "SPICEDB_DATASTORE_ENGINE=postgres",
+        "-e", `SPICEDB_DATASTORE_CONN_URI=${datastoreUri(app)}`,
+        LOCAL_APP_SPICEDB_IMAGE, "datastore", "migrate", "head",
+    ];
+}
+export function spicedbServeArgs(app, ports) {
+    return [
+        "run", "-d",
+        "--name", appSpiceDBContainerName(app),
+        "--label", `${LOCAL_APP_SPICEDB_LABEL}=${app}`,
+        "--restart", "unless-stopped",
+        "--network", LOCAL_STACK_NETWORK,
+        "-p", `127.0.0.1:${ports.grpc}:50051`,
+        "-p", `127.0.0.1:${ports.http}:8443`,
+        "-e", `SPICEDB_GRPC_PRESHARED_KEY=${LOCAL_APP_SPICEDB_KEY}`,
+        "-e", "SPICEDB_DATASTORE_ENGINE=postgres",
+        "-e", `SPICEDB_DATASTORE_CONN_URI=${datastoreUri(app)}`,
+        "-e", "SPICEDB_HTTP_ENABLED=true",
+        "-e", "SPICEDB_DATASTORE_CONN_POOL_READ_MAX_OPEN=4",
+        "-e", "SPICEDB_DATASTORE_CONN_POOL_READ_MIN_OPEN=1",
+        "-e", "SPICEDB_DATASTORE_CONN_POOL_WRITE_MAX_OPEN=2",
+        "-e", "SPICEDB_DATASTORE_CONN_POOL_WRITE_MIN_OPEN=1",
+        LOCAL_APP_SPICEDB_IMAGE, "serve",
+    ];
+}
+export function parseDockerPort(output) {
+    const match = output.trim().split("\n")[0]?.match(/:(\d+)\s*$/);
+    return match ? Number(match[1]) : null;
+}
+export const defaultDocker = (args) => {
+    const r = spawnSync("docker", args, { encoding: "utf-8" });
+    return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+};
+const mustDocker = (docker, args, what) => {
+    const r = docker(args);
+    if (r.status !== 0) {
+        throw new MeshCliError(`${what} failed: ${(r.stderr || r.stdout).trim() || `docker exited ${r.status}`}`);
+    }
+    return r.stdout;
+};
+function ensureDatabase(docker, app) {
+    const container = mustDocker(docker, [
+        "ps", "-q",
+        "--filter", `label=com.docker.compose.project=${COMPOSE_PROJECT}`,
+        "--filter", "label=com.docker.compose.service=database",
+    ], "Finding the local Postgres").trim().split("\n")[0];
+    if (!container) {
+        throw new MeshCliError("The local platform's Postgres is not running.", {
+            remediation: { command: "mesh start" },
+        });
+    }
+    const db = appSpiceDBDatabase(app);
+    const exists = mustDocker(docker, ["exec", container, "psql", "-U", "postgres", "-tAc", `SELECT 1 FROM pg_database WHERE datname = '${db}'`], `Checking database ${db}`).trim();
+    if (exists !== "1") {
+        mustDocker(docker, ["exec", container, "psql", "-U", "postgres", "-c", `CREATE DATABASE "${db}"`], `Creating database ${db}`);
+    }
+}
+export async function ensureLocalAppSpiceDB(app, deps = {}) {
+    const docker = deps.docker ?? defaultDocker;
+    const portFree = deps.portFree ?? (async (port) => !(await probeTcp(port, { timeoutMs: 300 })));
+    const name = appSpiceDBContainerName(app);
+    const state = docker(["inspect", "-f", "{{.State.Running}}", name]);
+    if (state.status === 0) {
+        if (state.stdout.trim() !== "true")
+            mustDocker(docker, ["start", name], `Starting ${name}`);
+        const grpcPort = parseDockerPort(mustDocker(docker, ["port", name, "50051/tcp"], `Reading ${name}'s ports`));
+        const httpPort = parseDockerPort(mustDocker(docker, ["port", name, "8443/tcp"], `Reading ${name}'s ports`));
+        if (grpcPort && httpPort)
+            return { grpcPort, httpPort, created: false };
+        mustDocker(docker, ["rm", "-f", name], `Removing ${name}`);
+    }
+    ensureDatabase(docker, app);
+    mustDocker(docker, spicedbMigrateArgs(app), `Migrating ${name}'s datastore`);
+    const first = appSpiceDBSlot(app);
+    for (let i = 0; i < PORT_SLOTS; i++) {
+        const ports = appSpiceDBPorts(first + i);
+        if (!(await portFree(ports.grpc)) || !(await portFree(ports.http)))
+            continue;
+        mustDocker(docker, spicedbServeArgs(app, ports), `Starting ${name}`);
+        return { grpcPort: ports.grpc, httpPort: ports.http, created: true };
+    }
+    throw new MeshCliError(`No free port pair for ${name} in ${GRPC_PORT_BASE}-${GRPC_PORT_BASE + PORT_SLOTS - 1}.`);
+}
+export async function writeSpiceDBSchema(httpUrl, zed, opts = {}) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const attempts = opts.attempts ?? 30;
+    let last = "";
+    for (let i = 0; i < attempts; i++) {
+        try {
+            const res = await fetchImpl(`${httpUrl}/v1/schema/write`, {
+                method: "POST",
+                headers: { Authorization: `Bearer ${LOCAL_APP_SPICEDB_KEY}`, "content-type": "application/json" },
+                body: JSON.stringify({ schema: zed }),
+            });
+            if (res.ok)
+                return;
+            last = `${res.status} ${await res.text()}`;
+            if (res.status >= 400 && res.status < 500)
+                break;
+        }
+        catch (err) {
+            last = err instanceof Error ? err.message : String(err);
+        }
+        await new Promise((r) => setTimeout(r, opts.delayMs ?? 500));
+    }
+    throw new MeshCliError(`SpiceDB at ${httpUrl} did not accept the app's schema: ${last}`);
+}
+export function removeLocalAppSpiceDBs(docker = defaultDocker) {
+    const ids = docker(["ps", "-aq", "--filter", `label=${LOCAL_APP_SPICEDB_LABEL}`]).stdout.trim().split("\n").filter(Boolean);
+    if (ids.length > 0)
+        docker(["rm", "-f", ...ids]);
+    return ids;
+}
+export const tsxImporter = async (specifier, parentFile) => {
+    let api;
+    try {
+        api = createRequire(parentFile).resolve("tsx/esm/api");
+    }
+    catch {
+        throw new MeshCliError(`Cannot load the app's authz schema: \`tsx\` is not installed in ${path.dirname(parentFile)}. ` +
+            "Add it to the app's devDependencies (`pnpm add -D tsx`).");
+    }
+    const { tsImport } = (await import(pathToFileURL(api).href));
+    return tsImport(specifier, pathToFileURL(parentFile).href);
+};
+const unwrapDefault = (mod) => {
+    const d = mod.default ?? mod.schema;
+    return d && typeof d === "object" && "default" in d && !("namespace" in d) ? d.default : d;
+};
+export async function loadAppAuthz(appRoot, schemaRel, importer = tsxImporter) {
+    const file = path.resolve(appRoot, schemaRel);
+    if (!fs.existsSync(file)) {
+        throw new MeshCliError(`mesh.authz.schema names ${schemaRel}, which does not exist under ${appRoot}.`);
+    }
+    const schema = unwrapDefault(await importer(pathToFileURL(file).href, file));
+    if (!schema || typeof schema.namespace !== "string") {
+        throw new MeshCliError(`${schemaRel} must export the app's defineSchema(...) result as its default export.`);
+    }
+    const compilers = (await importer("@mesh-tech/authz/compilers", file));
+    let chunk;
+    try {
+        const ssm = await importer("@mesh-tech/authz/metadata/ssm", file);
+        if (typeof ssm.chunkSsmValue === "function")
+            chunk = ssm.chunkSsmValue;
+    }
+    catch {
+    }
+    return { schema, compilers, chunk };
+}
+export const localParamStore = async () => {
+    const { SSMClient, GetParameterCommand, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+    const ssm = new SSMClient(LOCAL_AWS_CONFIG);
+    return {
+        async get(name) {
+            try {
+                return (await ssm.send(new GetParameterCommand({ Name: name }))).Parameter?.Value;
+            }
+            catch {
+                return undefined;
+            }
+        },
+        async put(name, value) {
+            await ssm.send(new PutParameterCommand({ Name: name, Value: value, Type: "String", Tier: "Advanced", Overwrite: true }));
+        },
+    };
+};
+export async function publishLocalAppAuthz(args, deps = {}) {
+    const env = LOCAL_ENV;
+    const { schema, compilers, chunk } = await loadAppAuthz(args.appRoot, args.schema, deps.importer);
+    const mode = schema.mode === "role-gating" ? "role-gating" : "policy-engine";
+    const params = deps.params ?? (await localParamStore());
+    const base = appAuthzParam(args.tenant, env, args.app);
+    const metadataRef = `${base}/ops-hub-metadata`;
+    let instance;
+    if (mode === "policy-engine") {
+        const running = await (deps.ensureSpiceDB ?? ensureLocalAppSpiceDB)(args.app);
+        instance = { grpcPort: running.grpcPort, httpPort: running.httpPort };
+        await (deps.writeSchema ?? writeSpiceDBSchema)(`http://localhost:${instance.httpPort}`, compilers.compileSpiceDBSchema(schema).zed);
+        await (deps.putSecret ?? upsertLocalSecret)(appSpiceDBSecretName(args.tenant, env, args.app), {
+            PRESHARED_KEY: LOCAL_APP_SPICEDB_KEY,
+        });
+        await params.put(spicedbInstanceParam(args.tenant, env, args.app), JSON.stringify(instanceRegistryValue({ app: args.app, tenant: args.tenant, env, ...instance })));
+    }
+    const body = JSON.stringify(compilers.compileOpsHubMetadata(schema));
+    const split = chunk ? chunk(body) : { value: body, parts: [] };
+    for (const [i, part] of split.parts.entries())
+        await params.put(`${metadataRef}/part-${i}`, part);
+    await params.put(metadataRef, split.value);
+    let existing = {};
+    const raw = await params.get(base);
+    if (raw) {
+        try {
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed === "object")
+                existing = parsed;
+        }
+        catch {
+        }
+    }
+    await params.put(base, JSON.stringify(buildAppAuthzPointer({
+        existing,
+        mode,
+        instanceId: instance ? args.app : undefined,
+        zitadel: args.zitadel,
+        metadataRef,
+    })));
+    return {
+        mode,
+        env: instance ? appSpiceDBEnv({ ...instance, metadataPath: `${base}/metadata` }) : {},
+        ...(instance ? { instance } : {}),
+    };
+}

package/dist/src/commands/local/auth-provision.d.ts

@@ -21,6 +21,7 @@ export declare function reconcileRegistryFromZitadel(): Promise<{
     tenants: string[];
     apps: number;
 }>;
+export declare function isZitadelNoChanges(err: unknown): boolean;
 export declare function ensureSignInApp(args: {
     tenant: string;
     app: string;

package/dist/src/commands/local/auth-provision.js

@@ -197,6 +197,11 @@ export async function reconcileRegistryFromZitadel() {
     }
     return { tenants, apps };
 }
+export function isZitadelNoChanges(err) {
+    if (!(err instanceof Error))
+        return false;
+    return err.status === 400 && /No changes|COMMAND-1m88i/.test(err.message);
+}
 export async function ensureSignInApp(args) {
     const pat = readSeederPat();
     const orgId = await ensureOrg(pat, args.tenant);
@@ -220,7 +225,13 @@ export async function ensureSignInApp(args) {
     };
     const existing = await searchZitadelApp(pat, projectId, name, orgId);
     if (existing) {
-        await api(pat, "PUT", `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config`, config, orgId);
+        try {
+            await api(pat, "PUT", `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config`, config, orgId);
+        }
+        catch (err) {
+            if (!isZitadelNoChanges(err))
+                throw err;
+        }
         return;
     }
     const created = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/oidc`, { name, ...config }, orgId);

package/dist/src/commands/local/index.js

@@ -3,6 +3,7 @@ import * as path from "path";
 import chalk from "chalk";
 import { logError, logInfo, logSuccess, logWarn } from "../../utils/log.js";
 import { MeshCliError } from "../../utils/errors.js";
+import { removeLocalAppSpiceDBs } from "./app-authz.js";
 import { compose, COMPOSE_PROJECT, composeStreamed, crashedServices, DEFAULT_HUB_PORT, ensureDockerAvailable, findPackageRoot, hubApiRunning, hubEndpoints, hubOverlayServices, hubPort, idpsOverlayServices, ONE_SHOT_SERVICES, overlayRunning, probeEndpoint, STACK_ENDPOINTS, stackOwnedElsewhere, stackServices, } from "./stack.js";
 import { probeRegistryToken, REGISTRY_LOGIN_FIX } from "../../utils/auth-preflight.js";
 import { ensureHubAuthImage, ensureHubImages, buildHubImagesFromSource, readHubCompiledAuthz, hasRegistryAuth, localHubVersion, planWithHubRefresh, } from "./hub-local.js";
@@ -314,6 +315,7 @@ export function registerLocalCommands(program) {
         if (foreign && !opts.force) {
             throw new MeshCliError(`The running local platform was started from a different checkout (${foreign}) — another project may be using it.`, { remediation: { command: "mesh stop --force   # stop it anyway" } });
         }
+        removeLocalAppSpiceDBs();
         const aliases = removeAllAliasContainers();
         if (aliases.length > 0)
             logInfo(`Removed ${aliases.length} local docs alias container(s).`);

package/dist/src/commands/temporal.js

@@ -475,7 +475,7 @@ var init_cache_home = __esm({
 
 // packages/mesh-cli/src/commands/local/stack.ts
 import { parse as parseYaml } from "yaml";
-var DEFAULT_HUB_PORT;
+var COMPOSE_PROJECT, DEFAULT_HUB_PORT;
 var init_stack = __esm({
   "packages/mesh-cli/src/commands/local/stack.ts"() {
     "use strict";
@@ -483,6 +483,7 @@ var init_stack = __esm({
     init_cache_home();
     init_errors();
     init_log();
+    COMPOSE_PROJECT = "mesh-local";
     DEFAULT_HUB_PORT = "9000";
   }
 });
@@ -784,6 +785,19 @@ var init_dev_local = __esm({
   }
 });
 
+// packages/mesh-cli/src/commands/local/app-authz.ts
+var LOCAL_STACK_NETWORK;
+var init_app_authz = __esm({
+  "packages/mesh-cli/src/commands/local/app-authz.ts"() {
+    "use strict";
+    init_errors();
+    init_helpers();
+    init_seed();
+    init_stack();
+    LOCAL_STACK_NETWORK = `${COMPOSE_PROJECT}_mesh_network`;
+  }
+});
+
 // packages/mesh-cli/src/commands/local/local-spicedb.ts
 var init_local_spicedb = __esm({
   "packages/mesh-cli/src/commands/local/local-spicedb.ts"() {
@@ -873,6 +887,7 @@ var init_dev = __esm({
     init_dev_launch();
     init_dev_local();
     init_auth_provision();
+    init_app_authz();
     init_seed();
     init_publish_docs();
     init_act_as_local();