@tatara/cli 0.5.0 → 0.7.0

package/dist/bin.mjs

@@ -257,14 +257,14 @@ async function sync(project = loadProject()) {
 		const consumers = await find(root, dirs.map((d) => `${d}/consumers/*.ts`));
 		await writeIfChanged(join(out, "consumers.ts"), listModule(consumers, {
 			prefix: "consumer",
-			typeImport: "import type { ConsumerDefinition } from \"#core/jobs/define\";",
+			typeImport: "import type { ConsumerDefinition } from \"@tatara/jobs\";",
 			typeName: "ConsumerDefinition",
 			exportName: "consumers"
 		}), written);
 		const schedules = await find(root, dirs.map((d) => `${d}/schedules/*.ts`));
 		await writeIfChanged(join(out, "schedules.ts"), listModule(schedules, {
 			prefix: "schedule",
-			typeImport: "import type { ScheduleDefinition } from \"#core/jobs/define\";",
+			typeImport: "import type { ScheduleDefinition } from \"@tatara/jobs\";",
 			typeName: "ScheduleDefinition",
 			exportName: "schedules"
 		}), written);
@@ -273,13 +273,12 @@ async function sync(project = loadProject()) {
 		const permissions = await find(root, ["src/modules/*/permissions/*.permissions.ts"]);
 		const imports = permissions.map((f) => `import ${identifier(f, "permissions")} from "${specifier(f)}";`);
 		const names = permissions.map((f) => identifier(f, "permissions"));
-		await writeIfChanged(join(out, "permissions.ts"), `${HEADER}import { mergeCatalogs, type PermissionKeysOf } from "#core/authz/catalog";
-import corePermissions from "#core/authz/permissions";
+		await writeIfChanged(join(out, "permissions.ts"), `${HEADER}import { authzPermissions, mergeCatalogs, type PermissionKeysOf } from "@tatara/authz";
 ${imports.join("\n")}${imports.length ? "\n" : ""}
-export const catalog = mergeCatalogs(corePermissions${names.map((n) => `, ${n}`).join("")});
+export const catalog = mergeCatalogs(authzPermissions${names.map((n) => `, ${n}`).join("")});
 
 export type PermissionKey =
-	| PermissionKeysOf<typeof corePermissions>${names.map((n) => `\n\t| PermissionKeysOf<typeof ${n}>`).join("")};
+	| PermissionKeysOf<typeof authzPermissions>${names.map((n) => `\n\t| PermissionKeysOf<typeof ${n}>`).join("")};
 `, written);
 	}
 	if (project.config.database !== "none") {
@@ -682,6 +681,7 @@ const authz = {
 	id: "authz",
 	kind: "addon",
 	label: "Permission system",
+	dependencies: ["@tatara/authz"],
 	slots: [
 		{
 			file: "tests/helpers/auth.ts",
@@ -711,9 +711,9 @@ const authz = {
 
 - Permissions are \`resource:action\` (optionally scoped \`own | team | org\`, where a wider scope
   satisfies a narrower one). Each module declares its resources and the grants built-in roles get
-  in \`permissions/<name>.permissions.ts\` (\`definePermissions\`); \`tatara sync\` merges them into a
+  in \`permissions/<name>.permissions.ts\` (\`definePermissions\` from \`@tatara/authz\`); \`tatara sync\` merges them into a
   typed catalog.
-- Guard routes with \`middleware: [requirePermission("project:read")]\` from \`#core/authz/middleware\`
+- Guard routes with \`middleware: [requirePermission("project:read")]\` from \`#core/authz/index\`
   and declare \`security: [{ bearerAuth: ["project:read"] }]\`. For scoped actions, call
   \`resolveScope(principal, "doc:read")\` in the service and filter rows by the returned scope.
 - Effective permissions = role grants (assigned roles + built-in roles whose key matches an
@@ -731,6 +731,7 @@ const jobs = {
 	kind: "addon",
 	label: "Jobs + cron (BullMQ)",
 	dependencies: [
+		"@tatara/jobs",
 		"bullmq",
 		"ioredis",
 		"croner"
@@ -803,8 +804,8 @@ const jobs = {
 			slot: "sections",
 			content: `## Jobs and schedules
 
-- Background work: \`enqueue(topic, payload)\` from \`#core/jobs/queue\`; a module handles it in
-  \`consumers/<name>.ts\` (\`defineConsumer({ topic, schema, handle })\`). Payloads are validated by the
+- Background work: \`enqueue(topic, payload)\` from \`#core/jobs/index\`; a module handles it in
+  \`consumers/<name>.ts\` (\`defineConsumer({ topic, schema, handle })\` from \`@tatara/jobs\`). Payloads are validated by the
   consumer's zod schema. Handlers must be idempotent: jobs retry.
 - Recurring work: \`schedules/<name>.ts\` (\`defineSchedule({ name, cron, run })\`). A Redis lock makes
   each tick run once across every cron process.
@@ -871,7 +872,11 @@ const storage = {
 	id: "storage",
 	kind: "addon",
 	label: "File storage",
-	dependencies: ["@aws-sdk/client-s3", "@aws-sdk/s3-request-presigner"],
+	dependencies: [
+		"@tatara/storage",
+		"@aws-sdk/client-s3",
+		"@aws-sdk/s3-request-presigner"
+	],
 	env: [
 		{
 			key: "STORAGE_DRIVER",
@@ -973,7 +978,7 @@ const email = {
 	id: "email",
 	kind: "addon",
 	label: "Email",
-	dependencies: ["nodemailer"],
+	dependencies: ["@tatara/email", "nodemailer"],
 	devDependencies: ["@types/nodemailer"],
 	env: [
 		{
@@ -1033,6 +1038,7 @@ const i18n = {
 	id: "i18n",
 	kind: "addon",
 	label: "i18n",
+	dependencies: ["@tatara/i18n"],
 	env: [{
 		key: "DEFAULT_LANGUAGE",
 		schema: "z.enum([\"en\", \"ar\"]).default(\"en\")",
@@ -1454,7 +1460,7 @@ const authOrgs = {
 			file: "src/core/auth/auth.ts",
 			slot: "imports",
 			when: ["authz"],
-			content: "import { removeMemberAccess } from \"#core/authz/services/members\";"
+			content: "import { removeMemberAccess } from \"#core/authz/index\";"
 		},
 		{
 			file: "tests/helpers/auth.ts",
@@ -2452,7 +2458,7 @@ function guardSlots(project, n) {
 		order: fills.length
 	});
 	if (project.has("authz")) {
-		add("imports", "import { requirePermission } from \"#core/authz/middleware\";");
+		add("imports", "import { requirePermission } from \"#core/authz/index\";");
 		for (const [route, action] of Object.entries(ACTIONS)) add(`guard-${route}`, `middleware: [requirePermission("${n.kebab}:${action}")] as const,\nsecurity: [{ bearerAuth: ["${n.kebab}:${action}"] }],`);
 		add("auth-errors", "...errorResponses(401, 403),");
 	} else if (project.has("auth")) {
@@ -3186,6 +3192,193 @@ function createBaseline(project, deps) {
 	} };
 }
 //#endregion
+//#region src/upgrade/codemods/imports.ts
+const escapeRegExp$1 = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+* The names `text` imports (or re-exports) from `specifier`, or null when it doesn't use it.
+* A namespace, default, side-effect or dynamic import gives ["*"]: it could reach any name.
+*/
+function importsOf(text, specifier) {
+	const spec = `["']${escapeRegExp$1(specifier)}["']`;
+	const names = [];
+	let found = false;
+	const fromClause = new RegExp(`(?:import|export)\\s+(?:type\\s+)?([^;]*?)\\s+from\\s+${spec}`, "g");
+	for (const match of text.matchAll(fromClause)) {
+		found = true;
+		const braces = (match[1] ?? "").match(/^\{([^}]*)\}$/);
+		if (!braces) {
+			names.push("*");
+			continue;
+		}
+		for (const part of (braces[1] ?? "").split(",")) {
+			const name = part.trim().replace(/^type\s+/, "").split(/\s+as\s+/)[0]?.trim();
+			if (name) names.push(name);
+		}
+	}
+	if (new RegExp(`import\\s*\\(\\s*${spec}\\s*\\)|import\\s+${spec}`).test(text)) {
+		found = true;
+		names.push("*");
+	}
+	return found ? names : null;
+}
+//#endregion
+//#region src/upgrade/codemods/groups.ts
+async function read$4(ctx, path) {
+	return ctx.read(path).catch(() => void 0);
+}
+function sourceFiles(ctx) {
+	return glob(["src/**/*.ts", "tests/**/*.ts"], {
+		cwd: ctx.project.root,
+		ignore: ["src/generated/**"]
+	});
+}
+/** Why the group can't move ([] when it can). Changes nothing. */
+async function blockersOf$1(ctx, group, sources) {
+	const blockers = [];
+	for (const path of [...group.regenerate, ...group.remove]) {
+		const text = await read$4(ctx, path);
+		if (text === void 0) continue;
+		if (!await ctx.baseline.isUnchanged(path, text)) blockers.push(`${path} is customised`);
+	}
+	const own = /* @__PURE__ */ new Set([...group.regenerate, ...group.remove]);
+	for (const path of sources) {
+		if (own.has(path)) continue;
+		const text = await ctx.read(path);
+		for (const rewrite of group.rewrites) {
+			const names = importsOf(text, rewrite.from);
+			if (!names) continue;
+			const allowed = rewrite.names;
+			const missing = names.filter((n) => n === "*" || allowed !== void 0 && !allowed.includes(n));
+			if (missing.length > 0) blockers.push(`${path} imports ${missing.join(", ")} from ${rewrite.from}`);
+		}
+	}
+	return blockers;
+}
+async function applyGroup(ctx, group) {
+	for (const path of group.regenerate) {
+		const next = await ctx.renderCurrent(path);
+		if (next !== void 0) await ctx.write(path, next);
+	}
+	for (const path of group.remove) await ctx.removeIfUnchanged(path);
+	for (const rewrite of group.rewrites) await ctx.rewriteImports(rewrite.from, rewrite.to);
+}
+//#endregion
+//#region src/upgrade/codemods/addon-packages.ts
+const groups$1 = {
+	storage: {
+		name: "storage",
+		regenerate: [
+			"src/core/storage/index.ts",
+			"src/core/storage/commands/check.ts",
+			"src/core/storage/tests/storage.test.ts"
+		],
+		remove: [
+			"storage.ts",
+			"local.ts",
+			"s3.ts"
+		].map((f) => `src/core/storage/${f}`),
+		rewrites: [
+			{
+				from: "#core/storage/storage",
+				to: "@tatara/storage"
+			},
+			{
+				from: "#core/storage/local",
+				to: "@tatara/storage",
+				names: []
+			},
+			{
+				from: "#core/storage/s3",
+				to: "#core/storage/index",
+				names: ["s3"]
+			}
+		]
+	},
+	email: {
+		name: "email",
+		regenerate: ["src/core/email/send.ts"],
+		remove: [],
+		rewrites: []
+	},
+	i18n: {
+		name: "i18n",
+		regenerate: ["src/core/i18n/index.ts"],
+		remove: [],
+		rewrites: []
+	},
+	jobs: {
+		name: "jobs",
+		regenerate: [
+			"src/core/jobs/index.ts",
+			"src/apps/worker/index.ts",
+			"src/apps/cron/index.ts",
+			"src/core/jobs/commands/enqueue.ts",
+			"src/modules/example/tests/jobs.test.ts"
+		],
+		remove: [
+			"define.ts",
+			"process.ts",
+			"lock.ts",
+			"redis.ts",
+			"queue.ts"
+		].map((f) => `src/core/jobs/${f}`),
+		rewrites: [
+			{
+				from: "#core/jobs/define",
+				to: "@tatara/jobs"
+			},
+			{
+				from: "#core/jobs/process",
+				to: "@tatara/jobs"
+			},
+			{
+				from: "#core/jobs/queue",
+				to: "#core/jobs/index",
+				names: ["enqueue", "QUEUE_NAME"]
+			},
+			{
+				from: "#core/jobs/redis",
+				to: "#core/jobs/index",
+				names: ["redis"]
+			},
+			{
+				from: "#core/jobs/lock",
+				to: "@tatara/jobs",
+				names: []
+			}
+		]
+	}
+};
+/** Written even though the app has no copy yet; other files are only replaced when present. */
+const NEW = /* @__PURE__ */ new Set(["src/core/jobs/index.ts"]);
+const addonPackages = {
+	version: "0.7.0",
+	id: "addon-packages",
+	description: "Use @tatara/storage, @tatara/email, @tatara/i18n and @tatara/jobs",
+	async run(ctx) {
+		const addons = ctx.project.config.addons;
+		const sources = await sourceFiles(ctx);
+		const ready = [];
+		for (const [addon, group] of Object.entries(groups$1)) {
+			if (!addons.includes(addon)) continue;
+			await ctx.addDependency(`@tatara/${addon}`, versionOf(`@tatara/${addon}`));
+			const blockers = await blockersOf$1(ctx, group, sources);
+			if (blockers.length > 0) {
+				ctx.report.notes.push(`${addon} was not moved onto @tatara/${addon}: ${blockers.join("; ")}. Compare with a newly generated app and move it by hand.`);
+				if (!ctx.report.blocked.includes("addon-packages")) ctx.report.blocked.push("addon-packages");
+				continue;
+			}
+			const present = [];
+			for (const path of group.regenerate) if (await ctx.read(path).then(() => true, () => false) || NEW.has(path)) present.push(path);
+			ready.push({
+				...group,
+				regenerate: present
+			});
+		}
+		for (const group of ready) await applyGroup(ctx, group);
+	}
+};
+//#endregion
 //#region src/upgrade/codemods/auth-package.ts
 const AUTH = "@tatara/auth";
 const KEYCLOAK = "@tatara/keycloak";
@@ -3262,27 +3455,21 @@ function groups(keycloak) {
 	});
 	return all;
 }
-async function read$2(ctx, path) {
+async function read$3(ctx, path) {
 	return ctx.read(path).catch(() => void 0);
 }
-const escapeRegExp$1 = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 /** True when `text` imports `entry` (or one of its gone names). */
 function usesExport(text, entry) {
-	const from = new RegExp(`import\\s+(?:type\\s+)?([^;]*?)\\s+from\\s+["']${escapeRegExp$1(entry.specifier)}["']`, "g");
+	const names = importsOf(text, entry.specifier);
+	if (!names) return false;
 	const gone = entry.names;
-	for (const match of text.matchAll(from)) {
-		if (!gone) return true;
-		const braces = (match[1] ?? "").match(/\{([^}]*)\}/);
-		if (!braces) return true;
-		if ((braces[1] ?? "").split(",").map((part) => part.trim().replace(/^type\s+/, "").split(/\s+as\s+/)[0]?.trim()).some((name) => name && gone.includes(name))) return true;
-	}
-	return false;
+	return !gone || names.some((name) => name === "*" || gone.includes(name));
 }
 /** Why the group can't move, or [] when it can. */
 async function blockersOf(ctx, group, sources) {
 	const blockers = [];
 	for (const path of [...group.regenerate, ...group.remove]) {
-		const text = await read$2(ctx, path);
+		const text = await read$3(ctx, path);
 		if (text === void 0) continue;
 		if (!await ctx.baseline.isUnchanged(path, text)) blockers.push(`${path} is customised`);
 	}
@@ -3316,7 +3503,7 @@ const authPackage = {
 		}
 		for (const group of ready) {
 			for (const path of group.regenerate) {
-				if (await read$2(ctx, path) === void 0) continue;
+				if (await read$3(ctx, path) === void 0) continue;
 				const next = await ctx.renderCurrent(path);
 				if (next !== void 0) await ctx.write(path, next);
 			}
@@ -3327,6 +3514,151 @@ const authPackage = {
 	}
 };
 //#endregion
+//#region src/upgrade/codemods/authz-package.ts
+const AUTHZ = "@tatara/authz";
+const INDEX = "#core/authz/index";
+const DIR = "src/core/authz";
+/** Copies the package replaces. */
+const REMOVED = [
+	"cache.ts",
+	"catalog.ts",
+	"constants.ts",
+	"middleware.ts",
+	"permissions.ts",
+	"resolver.ts",
+	"types.ts",
+	"validators.ts",
+	"services/audit.ts",
+	"services/grants.ts",
+	"services/members.ts",
+	"services/roles.ts",
+	"services/sync.ts"
+].map((f) => `${DIR}/${f}`);
+/** App files that stay (or are new), and become what this CLI generates. system-roles.ts is the app's config and stays as it is. */
+const REGENERATED$1 = [
+	`${DIR}/index.ts`,
+	`${DIR}/db/seed.ts`,
+	`${DIR}/commands/grant-role.ts`,
+	`${DIR}/commands/sync-permissions.ts`,
+	`${DIR}/routes/authorization.routes.ts`,
+	`${DIR}/tests/authz.test.ts`,
+	"src/core/auth/tests/keycloak-authz.test.ts",
+	"tests/helpers/authz.ts"
+];
+/** Where other files' imports go, and the names that exist there. undefined: every name. */
+const MOVES = [
+	{
+		from: "#core/authz/constants",
+		to: AUTHZ
+	},
+	{
+		from: "#core/authz/types",
+		to: AUTHZ
+	},
+	{
+		from: "#core/authz/catalog",
+		to: AUTHZ
+	},
+	{
+		from: "#core/authz/validators",
+		to: AUTHZ
+	},
+	{
+		from: "#core/authz/middleware",
+		to: INDEX,
+		names: ["requirePermission"]
+	},
+	{
+		from: "#core/authz/resolver",
+		to: INDEX,
+		names: ["checkPermission", "resolveScope"]
+	},
+	{
+		from: "#core/authz/services/members",
+		to: INDEX,
+		names: ["removeMemberAccess"]
+	},
+	{
+		from: "#core/authz/cache",
+		to: INDEX,
+		names: []
+	},
+	{
+		from: "#core/authz/permissions",
+		to: INDEX,
+		names: []
+	},
+	...[
+		"audit",
+		"grants",
+		"roles",
+		"sync"
+	].map((s) => ({
+		from: `#core/authz/services/${s}`,
+		to: INDEX,
+		names: []
+	}))
+];
+/** Names the 0.5 constants file had that the package dropped. */
+const DROPPED_CONSTANTS = ["CACHE_TTL_MS"];
+async function read$2(ctx, path) {
+	return ctx.read(path).catch(() => void 0);
+}
+const authzPackage = {
+	version: "0.6.0",
+	id: "authz-package",
+	description: "Use @tatara/authz (catalog, resolver, guards, services, routes)",
+	async run(ctx) {
+		if (!ctx.project.config.addons.includes("authz")) return;
+		await ctx.addDependency(AUTHZ, versionOf(AUTHZ));
+		const blockers = [];
+		const regenerate = [];
+		for (const path of REGENERATED$1) {
+			const text = await read$2(ctx, path);
+			if (text === void 0) {
+				if (path === `${DIR}/index.ts`) regenerate.push(path);
+				continue;
+			}
+			if (await ctx.baseline.isUnchanged(path, text)) regenerate.push(path);
+			else blockers.push(`${path} is customised`);
+		}
+		const removed = [];
+		for (const path of REMOVED) {
+			const text = await read$2(ctx, path);
+			if (text === void 0) continue;
+			removed.push(path);
+			if (!await ctx.baseline.isUnchanged(path, text)) blockers.push(`${path} is customised`);
+		}
+		const own = /* @__PURE__ */ new Set([...REGENERATED$1, ...REMOVED]);
+		const sources = await glob(["src/**/*.ts", "tests/**/*.ts"], {
+			cwd: ctx.project.root,
+			ignore: ["src/generated/**"]
+		});
+		for (const path of sources) {
+			if (own.has(path)) continue;
+			const text = await ctx.read(path);
+			for (const move of MOVES) {
+				const names = importsOf(text, move.from);
+				if (!names) continue;
+				const allowed = move.names;
+				const missing = names.filter((n) => n === "*" || (allowed ? !allowed.includes(n) : move.from.endsWith("/constants") && DROPPED_CONSTANTS.includes(n)));
+				if (missing.length > 0) blockers.push(`${path} imports ${missing.join(", ")} from ${move.from}`);
+			}
+		}
+		if (blockers.length > 0) {
+			ctx.report.notes.push(`Nothing in ${DIR} was changed: ${blockers.join("; ")}. Compare with a newly generated app and move onto @tatara/authz (createAuthz in ${DIR}/index.ts) by hand.`);
+			ctx.report.blocked.push("authz-package");
+			return;
+		}
+		for (const path of regenerate) {
+			const next = await ctx.renderCurrent(path);
+			if (next !== void 0) await ctx.write(path, next);
+		}
+		for (const path of removed) await ctx.removeIfUnchanged(path);
+		for (const move of MOVES) await ctx.rewriteImports(move.from, move.to);
+	}
+};
+//#endregion
 //#region src/upgrade/codemods/core-package.ts
 const CORE = "@tatara/core";
 /** Files @tatara/core replaces, with the import specifier apps used for each. */
@@ -3586,6 +3918,7 @@ const CODEMODS = [
 			for (const path of await outsideImporters(ctx)) blockers.push(`${path} imports one of the moved files`);
 			if (blockers.length > 0) {
 				ctx.report.notes.push(`Nothing in src/core/http was changed: ${blockers.join("; ")}. Move these onto @tatara/http (createApp, mountRoutes, serveOpenApi, handleErrors, startServer and its error classes) by hand, then delete the old files.`);
+				ctx.report.blocked.push("http-package");
 				return;
 			}
 			for (const path of replace) {
@@ -3601,7 +3934,9 @@ const CODEMODS = [
 		}
 	},
 	dbTesting,
-	authPackage
+	authPackage,
+	authzPackage,
+	addonPackages
 ];
 //#endregion
 //#region src/upgrade/context.ts
@@ -3613,7 +3948,8 @@ function createContext(project, baseline, opts = {}) {
 		regenerated: [],
 		removed: [],
 		kept: [],
-		notes: []
+		notes: [],
+		blocked: []
 	};
 	const abs = (path) => join(project.root, path);
 	let rendered;
@@ -3725,13 +4061,16 @@ async function upgrade(project, opts = {}) {
 	const from = project.config.version;
 	const ctx = createContext(project, opts.baseline ?? createBaseline(project), { dryRun: opts.dryRun });
 	const due = [...opts.codemods ?? CODEMODS].filter((m) => compareVersions(m.version, from) > 0 && compareVersions(m.version, target) <= 0).sort((a, b) => compareVersions(a.version, b.version));
+	let reached = target;
 	for (const mod of due) {
+		const blockedBefore = ctx.report.blocked.length;
 		try {
 			await mod.run(ctx);
 		} catch (error) {
 			throw new Error(`codemod ${mod.id} (${mod.version}) failed: ${error.message}`, { cause: error });
 		}
 		ctx.report.ran.push(mod.id);
+		if (ctx.report.blocked.length > blockedBefore && reached === target) reached = due.slice(0, due.indexOf(mod)).at(-1)?.version ?? from;
 	}
 	if (opts.dryRun) return ctx.report;
 	const format = opts.formatFile ?? biomeFormat;
@@ -3741,9 +4080,9 @@ async function upgrade(project, opts = {}) {
 	const config = JSON.parse(await readFile(path, "utf8"));
 	const next = {
 		...config,
-		version: target,
+		version: reached,
 		generated: {
-			cli: target,
+			cli: reached,
 			files: await nextRecord(project, ctx.report)
 		}
 	};
@@ -3763,6 +4102,7 @@ function printUpgrade(report, from, to) {
 	for (const path of report.removed) console.log(pc.dim(`  removed ${path} (now provided by a package)`));
 	for (const { path } of report.kept) console.log(pc.yellow(`  kept ${path}: changed in this app; move the change into options or eject`));
 	for (const note of report.notes) console.log(`  ${note}`);
+	if (report.blocked.length > 0) console.log(pc.yellow(`  ${report.blocked.join(", ")} did not run: make the changes above, then run tatara upgrade again`));
 }
 //#endregion
 //#region src/bin.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tatara/cli",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Create and grow opinionated Hono backends",
   "type": "module",
   "license": "MIT",

package/templates/features/auth-keycloak/files+authz/src/core/auth/tests/keycloak-authz.test.ts

@@ -1,5 +1,5 @@
 import { beforeEach, describe, expect, it } from "vitest";
-import { syncSystemRoles } from "#core/authz/services/sync";
+import { authz } from "#core/authz/index";
 import { api } from "#tests/helpers/api";
 import { keycloakToken } from "#tests/helpers/auth";
 import { resetDatabase } from "#tests/helpers/db";
@@ -12,7 +12,7 @@ beforeEach(async () => {
 
 describe("Keycloak access tokens with authz", () => {
 	it("lets token roles match built-in authz roles", async () => {
-		await syncSystemRoles();
+		await authz.syncSystemRoles();
 		const admin = await keycloakToken({ roles: ["admin"] });
 		const user = await keycloakToken({ roles: ["user"] });
 		expect((await api.get("/api/authorization/roles", { headers: bearer(admin) })).status).toBe(

package/templates/features/authz/files/src/core/authz/commands/grant-role.ts

@@ -1,7 +1,6 @@
 import { z } from "zod";
-import { DEFAULT_ORG_ID, SYSTEM_ORG_ID } from "#core/authz/constants";
-import { store } from "#core/authz/db/store";
-import { assignRole } from "#core/authz/services/members";
+import { DEFAULT_ORG_ID, SYSTEM_ORG_ID } from "@tatara/authz";
+import { authz } from "#core/authz/index";
 import { defineCommand } from "@tatara/core";
 
 export default defineCommand({
@@ -13,9 +12,10 @@ export default defineCommand({
 		org: z.string().default(DEFAULT_ORG_ID),
 	}),
 	async run({ user, role, org }, { logger }) {
-		const found = (await store.findRoleByKey(org, role)) ?? (await store.findRoleByKey(SYSTEM_ORG_ID, role));
+		const found = (await authz.store.findRoleByKey(org, role)) ??
+			(await authz.store.findRoleByKey(SYSTEM_ORG_ID, role));
 		if (!found) throw new Error(`No role "${role}" (run authz:sync-permissions first for built-in roles)`);
-		const added = await assignRole(null, org, user, found.id);
+		const added = await authz.assignRole(null, org, user, found.id);
 		logger.info({ user, role, org, added }, added ? "role assigned" : "role already assigned");
 	},
 });

package/templates/features/authz/files/src/core/authz/commands/sync-permissions.ts

@@ -1,11 +1,11 @@
 import { defineCommand } from "@tatara/core";
-import { syncSystemRoles } from "#core/authz/services/sync";
+import { authz } from "#core/authz/index";
 
 export default defineCommand({
 	name: "authz:sync-permissions",
 	description: "Create/update built-in roles so their grants match the code (run on every deploy)",
 	async run(_args, { logger }) {
-		const result = await syncSystemRoles();
+		const result = await authz.syncSystemRoles();
 		logger.info(result, "built-in roles in sync");
 	},
 });

package/templates/features/authz/files/src/core/authz/db/seed.ts

@@ -1,10 +1,10 @@
-import { syncSystemRoles } from "#core/authz/services/sync";
+import { authz } from "#core/authz/index";
 import { defineSeed } from "@tatara/db";
 
 export default defineSeed({
 	name: "authz:system-roles",
 	order: -10,
 	async run({ logger }) {
-		logger.info(await syncSystemRoles(), "built-in roles in sync");
+		logger.info(await authz.syncSystemRoles(), "built-in roles in sync");
 	},
 });

package/templates/features/authz/files/src/core/authz/index.ts

@@ -0,0 +1,9 @@
+import { createAuthz } from "@tatara/authz";
+import { store } from "#core/authz/db/store";
+import { SYSTEM_ROLES } from "#core/authz/system-roles";
+import { catalog, type PermissionKey } from "#generated/permissions";
+
+/** The app's authorization: its store, the permission catalog from `tatara sync`, built-in roles. */
+export const authz = createAuthz<PermissionKey>({ store, catalog, systemRoles: SYSTEM_ROLES });
+
+export const { checkPermission, removeMemberAccess, requirePermission, resolveScope } = authz;