hexcore 10.2.0__tar.gz → 11.0.2__tar.gz

{hexcore-10.2.0/hexcore.egg-info → hexcore-11.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hexcore
-Version: 10.2.0
+Version: 11.0.2
 Summary: Reusable core for Python projects with hexagonal architecture, DDD, CQRS and background tasks. Ships the abstractions and the infrastructure: SQL session layer, FastAPI factories, worker runner, dynamic cron and identity.
 Author-email: "David Latosefki (Indroic)" <indroic@outlook.com>
 License-Expression: MIT
@@ -71,6 +71,10 @@ Requires-Dist: hexcore[darwin]; extra == "darwin-passkey"
 Requires-Dist: webauthn>=2.0.0; extra == "darwin-passkey"
 Provides-Extra: darwin-organization
 Requires-Dist: hexcore[darwin]; extra == "darwin-organization"
+Provides-Extra: darwin-rbac
+Requires-Dist: hexcore[darwin]; extra == "darwin-rbac"
+Provides-Extra: darwin-drbac
+Requires-Dist: hexcore[darwin]; extra == "darwin-drbac"
 Provides-Extra: all
 Requires-Dist: fastapi>=0.116.1; extra == "all"
 Requires-Dist: redis>=6.4.0; extra == "all"
@@ -278,8 +282,9 @@ Both generate a root `config.py` and leave Alembic configured. See
 
 | Series | Status | What it means |
 | :-- | :-- | :-- |
-| **10.x** | ✅ **Active** | The only supported one. Receives features and fixes. Darwin gains username sign-in, an optional email, a resolver for roles and scopes, a persisted key store, and startup checks that refuse the development defaults in production. |
-| **9.x** | ⛔ **Deprecated** | Adds the event store and Event Sourcing, and leaves a single event bus port. Migrating to 10.x is mechanical: `sign_in(email=...)` still resolves and warns, and the sign-in body still accepts `email`. The schema change is not: see the storage guide. |
+| **11.x** | ✅ **Active** | The only supported one. Receives features and fixes. Removes everything 11.0 had promised to remove — see the table below — and fixes the plugin startup steps that broke boot. |
+| **10.x** | ⛔ **Deprecated** | Darwin gains username sign-in, an optional email, a resolver for roles and scopes, a persisted key store, and startup checks that refuse the development defaults in production. Migrating to 11.x means dropping the names removed there; the deprecation warnings named each replacement. |
+| **9.x** | ⛔ **Deprecated** | Adds the event store and Event Sourcing, and leaves a single event bus port. The schema change is not mechanical: see the storage guide. |
 | **8.x** | ⛔ **Deprecated** | Ships Darwin. Migrating to 9.x is mechanical: the two deprecated names still resolve and warn. |
 | **7.x** | ⛔ **Deprecated** | Removes the pre-5.0 surface and fixes the CORS and rate-limiting defects. No Darwin: it shipped before the module landed on `master`. |
 | **6.x** | ⛔ **Deprecated** | No longer receives fixes. Contains the CORS and rate-limiting security defects fixed in 7.0, and the pre-5.0 aliases still present. |
@@ -305,8 +310,8 @@ The v1/v2 aliases were deprecated since 5.0 — two full majors of notice — an
 | `ICommandHandler`, `IQueryHandler` | `AbstractCommandHandler`, `AbstractQueryHandler` |
 | `IMiddleware` | `AbstractMiddleware` |
 | `ISerializer` | `AbstractSerializer` |
-| `IEventDispatcher` | `EventBus` |
-| `EventBus.register()` / `.dispatch()` | `EventBus.subscribe()` / `.publish()` |
+| `IEventDispatcher` | `AbstractEventBus` |
+| `EventBus.register()` / `.dispatch()` | `AbstractEventBus.subscribe()` / `.publish()` |
 | `ServerConfig.event_dispatcher` | `ServerConfig.event_bus` |
 | `SQLAlchemyCommonImplementationsRepo` | `SqlAlchemyRepository` |
 | `BeanieODMCommonImplementationsRepo` | `BeanieRepository` |
@@ -314,6 +319,24 @@ The v1/v2 aliases were deprecated since 5.0 — two full majors of notice — an
 | `reset_sqlalchemy_engine()` | `dispose_engine()` |
 | `MiddlewareConfig` | **Removed in 3.0.** It was dead code: never read. |
 
+The 9.0 and 10.0 deprecations were removed in 11.0, on the schedule each warning announced.
+The replacement is mechanical in every case: the old name kept working, and warned, for a full
+major.
+
+| Removed in 11.0 | Use instead | Deprecated since |
+| :-- | :-- | :-- |
+| `hexcore.domain.events.EventBus` | `hexcore.domain.cqrs.buses.AbstractEventBus` | 9.0 |
+| `hexcore.infrastructure.events.events_backends.memory.InMemoryEventBus` | `hexcore.cqrs.InMemoryEventBus` | 9.0 |
+| `hexcore.domain.auth` (the whole package) | `hexcore.darwin` | 10.0 |
+| `hexcore.domain.auth.PermissionsRegistry`, `hexcore.PermissionsRegistry` | `hexcore.darwin.RoleRegistry` | 10.0 |
+| `hexcore.domain.auth.TokenClaims`, `hexcore.TokenClaims` | `hexcore.darwin.AccessTokenClaims` | 10.0 |
+| `IdentityService.sign_in(email=...)` | `IdentityService.sign_in(identifier=...)` | 10.0 |
+
+`TokenClaims` and `AccessTokenClaims` were never interchangeable — different fields, different
+invariants, and `TokenClaims` had no `sid`, so a session issued with it could not be revoked.
+That is why the old name returned the old object and warned instead of aliasing to the new one,
+and it is why porting is a rewrite of the claims you build, not a rename.
+
 Passing `event_dispatcher=` to `ServerConfig` **fails with an error that says what to use**,
 rather than being silently ignored: pydantic discards keyword arguments it does not know, and
 keeping the default bus without noticing would surface much later as "my events never arrive".

{hexcore-10.2.0 → hexcore-11.0.2}/README.md

@@ -187,8 +187,9 @@ Both generate a root `config.py` and leave Alembic configured. See
 
 | Series | Status | What it means |
 | :-- | :-- | :-- |
-| **10.x** | ✅ **Active** | The only supported one. Receives features and fixes. Darwin gains username sign-in, an optional email, a resolver for roles and scopes, a persisted key store, and startup checks that refuse the development defaults in production. |
-| **9.x** | ⛔ **Deprecated** | Adds the event store and Event Sourcing, and leaves a single event bus port. Migrating to 10.x is mechanical: `sign_in(email=...)` still resolves and warns, and the sign-in body still accepts `email`. The schema change is not: see the storage guide. |
+| **11.x** | ✅ **Active** | The only supported one. Receives features and fixes. Removes everything 11.0 had promised to remove — see the table below — and fixes the plugin startup steps that broke boot. |
+| **10.x** | ⛔ **Deprecated** | Darwin gains username sign-in, an optional email, a resolver for roles and scopes, a persisted key store, and startup checks that refuse the development defaults in production. Migrating to 11.x means dropping the names removed there; the deprecation warnings named each replacement. |
+| **9.x** | ⛔ **Deprecated** | Adds the event store and Event Sourcing, and leaves a single event bus port. The schema change is not mechanical: see the storage guide. |
 | **8.x** | ⛔ **Deprecated** | Ships Darwin. Migrating to 9.x is mechanical: the two deprecated names still resolve and warn. |
 | **7.x** | ⛔ **Deprecated** | Removes the pre-5.0 surface and fixes the CORS and rate-limiting defects. No Darwin: it shipped before the module landed on `master`. |
 | **6.x** | ⛔ **Deprecated** | No longer receives fixes. Contains the CORS and rate-limiting security defects fixed in 7.0, and the pre-5.0 aliases still present. |
@@ -214,8 +215,8 @@ The v1/v2 aliases were deprecated since 5.0 — two full majors of notice — an
 | `ICommandHandler`, `IQueryHandler` | `AbstractCommandHandler`, `AbstractQueryHandler` |
 | `IMiddleware` | `AbstractMiddleware` |
 | `ISerializer` | `AbstractSerializer` |
-| `IEventDispatcher` | `EventBus` |
-| `EventBus.register()` / `.dispatch()` | `EventBus.subscribe()` / `.publish()` |
+| `IEventDispatcher` | `AbstractEventBus` |
+| `EventBus.register()` / `.dispatch()` | `AbstractEventBus.subscribe()` / `.publish()` |
 | `ServerConfig.event_dispatcher` | `ServerConfig.event_bus` |
 | `SQLAlchemyCommonImplementationsRepo` | `SqlAlchemyRepository` |
 | `BeanieODMCommonImplementationsRepo` | `BeanieRepository` |
@@ -223,6 +224,24 @@ The v1/v2 aliases were deprecated since 5.0 — two full majors of notice — an
 | `reset_sqlalchemy_engine()` | `dispose_engine()` |
 | `MiddlewareConfig` | **Removed in 3.0.** It was dead code: never read. |
 
+The 9.0 and 10.0 deprecations were removed in 11.0, on the schedule each warning announced.
+The replacement is mechanical in every case: the old name kept working, and warned, for a full
+major.
+
+| Removed in 11.0 | Use instead | Deprecated since |
+| :-- | :-- | :-- |
+| `hexcore.domain.events.EventBus` | `hexcore.domain.cqrs.buses.AbstractEventBus` | 9.0 |
+| `hexcore.infrastructure.events.events_backends.memory.InMemoryEventBus` | `hexcore.cqrs.InMemoryEventBus` | 9.0 |
+| `hexcore.domain.auth` (the whole package) | `hexcore.darwin` | 10.0 |
+| `hexcore.domain.auth.PermissionsRegistry`, `hexcore.PermissionsRegistry` | `hexcore.darwin.RoleRegistry` | 10.0 |
+| `hexcore.domain.auth.TokenClaims`, `hexcore.TokenClaims` | `hexcore.darwin.AccessTokenClaims` | 10.0 |
+| `IdentityService.sign_in(email=...)` | `IdentityService.sign_in(identifier=...)` | 10.0 |
+
+`TokenClaims` and `AccessTokenClaims` were never interchangeable — different fields, different
+invariants, and `TokenClaims` had no `sid`, so a session issued with it could not be revoked.
+That is why the old name returned the old object and warned instead of aliasing to the new one,
+and it is why porting is a rewrite of the claims you build, not a rename.
+
 Passing `event_dispatcher=` to `ServerConfig` **fails with an error that says what to use**,
 rather than being silently ignored: pydantic discards keyword arguments it does not know, and
 keeping the default bus without noticing would surface much later as "my events never arrive".

hexcore-11.0.2/hexcore/__init__.py

@@ -0,0 +1,35 @@
+"""
+Euphoria Kernel Core
+Submódulo principal con entidades, eventos y repositorios.
+"""
+from __future__ import annotations
+
+from .domain.base import BaseEntity
+from .domain.events import (
+    DomainEvent,
+    EntityCreatedEvent,
+    EntityDeletedEvent,
+    EntityUpdatedEvent,
+)
+from .domain.repositories import IBaseRepository
+from .infrastructure.repositories.base import (
+    BaseSQLAlchemyRepository,
+)
+from .infrastructure import cli
+from .infrastructure import cache
+from .application.dtos.base import DTO
+from . import config
+
+__all__ = [
+    "BaseEntity",
+    "DTO",
+    "DomainEvent",
+    "EntityCreatedEvent",
+    "EntityDeletedEvent",
+    "EntityUpdatedEvent",
+    "IBaseRepository",
+    "BaseSQLAlchemyRepository",
+    "cli",
+    "cache",
+    "config",
+]

{hexcore-10.2.0 → hexcore-11.0.2}/hexcore/_deprecation.py

@@ -3,8 +3,10 @@ Mecanismo de deprecación de HexCore.
 
 Los alias anteriores a 5.0 (`ICommandBus`, `ISerializer`, `NoSqlUnitOfWork`, …) **se
 eliminaron en 7.0**: estaban deprecados desde 5.0, o sea dos majors de aviso. Este módulo
-queda como el mecanismo, no como su inventario — lo usa lo que se deprece de acá en adelante,
-empezando por `hexcore.domain.auth`, que Darwin reemplaza.
+queda como el mecanismo, no como su inventario — lo usa lo que se deprece de acá en adelante.
+En 11.0 se eliminó la tanda que vencía ahí (`hexcore.domain.auth`, los dos buses de eventos
+viejos y `sign_in(email=...)`), así que hoy el inventario está vacío: el módulo es el mecanismo
+listo para la próxima deprecación.
 
 Un alias declarado como `ICommandBus = AbstractCommandBus` **no puede avisar**: es una
 asignación, y leerlo no ejecuta nada. Por eso el aviso se implementa con `__getattr__` de
@@ -45,14 +47,16 @@ __all__ = [
 #: En 7.0 los alias pre-5.0 **se eliminaron de verdad**. La constante apunta siempre al
 #: próximo major por publicar, y por eso se corre con cada major en vez de quedarse fija.
 #:
-#: Con 9.0 pasa a **10.0**, y esta vez la fecha no está vacía: 9.0 depreca
-#: `hexcore.domain.events.EventBus` y el `InMemoryEventBus` de `infrastructure.events`, que
-#: son los dos nombres que esperan esa remoción. Un major completo de aviso.
+#: En 11.0 se eliminó lo que prometía irse en 11.0, que es lo que mantiene honesta a la
+#: constante: `hexcore.domain.events.EventBus` y el `InMemoryEventBus` de
+#: `infrastructure.events` (deprecados en 9.0), `hexcore.domain.auth` entero con
+#: `PermissionsRegistry` y `TokenClaims`, y el alias `sign_in(email=...)` (deprecado en 10.0).
+#: El bump a 11.0.0 los dejó pasar, y los dos tests de abajo fueron los que lo cazaron.
 #:
 #: Lo vigila `test_removed_in_is_ahead_of_the_published_version`: si un bump vuelve a alcanzar
 #: este valor, el fallo salta en CI y no en el aviso que lee el usuario. Ese test es el que
 #: convierte "se nos pasó" en "no se puede releasear".
-REMOVED_IN = "11.0"
+REMOVED_IN = "12.0"
 
 
 def warn_deprecated(
@@ -135,10 +139,10 @@ def deprecated_lazy_names(
 
     La diferencia con `deprecated_aliases`, que es la razón de que existan las dos: `deprecated_aliases`
     resuelve el alias al **reemplazo** —sirve cuando los dos nombres apuntan a lo mismo— y esto
-    devuelve lo viejo, que sigue existiendo con su propia forma. Es el caso de
-    `hexcore.domain.auth`: `TokenClaims` y `AccessTokenClaims` **no** son intercambiables (distintos
-    campos, distintos invariantes), así que aliasarlos rompería a quien todavía use el viejo. Lo que
-    hace falta es que siga funcionando **y avise**.
+    devuelve lo viejo, que sigue existiendo con su propia forma. Fue el caso de
+    `hexcore.domain.auth` hasta que se eliminó en 11.0: `TokenClaims` y `AccessTokenClaims` **no**
+    eran intercambiables (distintos campos, distintos invariantes), así que aliasarlos habría roto
+    a quien todavía usaba el viejo. Lo que hacía falta era que siguiera funcionando **y avisara**.
 
     Y perezoso porque el objeto viejo puede vivir en un módulo que no se quiere importar en el
     arranque: el `from` eager es justamente lo que se está sacando.

{hexcore-10.2.0 → hexcore-11.0.2}/hexcore/darwin/__init__.py

@@ -90,6 +90,10 @@ _EXPORTS: dict[str, tuple[str, str]] = {
         "hexcore.darwin.domain.ports",
         "NullPrincipalResolver",
     ),
+    "CompositePrincipalResolver": (
+        "hexcore.darwin.domain.ports",
+        "CompositePrincipalResolver",
+    ),
     "ResolvedPrincipal": ("hexcore.darwin.domain.ports", "ResolvedPrincipal"),
     "AbstractSessionRepository": (
         "hexcore.darwin.domain.ports",

{hexcore-10.2.0 → hexcore-11.0.2}/hexcore/darwin/__init__.pyi

@@ -9,7 +9,7 @@
 #
 # Existe porque la fachada resuelve sus exports con `__getattr__` y declara
 # `__all__ = sorted(_EXPORTS)`: las dos son expresiones de runtime, así que sin este stub
-# los 214 símbolos de `hexcore.darwin` tipan `Any`. El runtime no cambia — Python usa
+# los 215 símbolos de `hexcore.darwin` tipan `Any`. El runtime no cambia — Python usa
 # el `.py` y el checker usa el `.pyi`, así que la carga perezosa se mantiene.
 
 
@@ -128,6 +128,7 @@ from hexcore.darwin.domain.ports import AbstractRevocationList as AbstractRevoca
 from hexcore.darwin.domain.ports import AbstractSessionRepository as AbstractSessionRepository
 from hexcore.darwin.domain.ports import AbstractUserRepository as AbstractUserRepository
 from hexcore.darwin.domain.ports import AbstractVerificationRepository as AbstractVerificationRepository
+from hexcore.darwin.domain.ports import CompositePrincipalResolver as CompositePrincipalResolver
 from hexcore.darwin.domain.ports import NullPrincipalResolver as NullPrincipalResolver
 from hexcore.darwin.domain.ports import ResolvedPrincipal as ResolvedPrincipal
 from hexcore.darwin.domain.value_objects import AccessTokenClaims as AccessTokenClaims
@@ -270,6 +271,7 @@ __all__ = [
     "CacheErrorPolicy",
     "CacheRevocationList",
     "ChangePassword",
+    "CompositePrincipalResolver",
     "CookieConfig",
     "CookieTransport",
     "CoreVerificationPurpose",

{hexcore-10.2.0 → hexcore-11.0.2}/hexcore/darwin/application/services.py

@@ -798,34 +798,6 @@ class IdentityService:
         )
         return usuario, codigo
 
-    def _resolver_alias_de_identificador(
-        self, identifier: str | None, email: str | None
-    ) -> str:
-        """
-        Acepta `email=` como alias deprecado de `identifier=`.
-
-        El parámetro se llamaba `email` hasta 10.0, y renombrarlo sin más rompería en silencio
-        a todo el que llame al servicio por keyword — que es la forma en que el servicio se
-        llama, porque la firma es keyword-only.
-        """
-        if identifier is not None and email is not None:
-            raise ValueError(
-                "Se pasaron `identifier` y `email` a la vez. `email` es el nombre viejo del "
-                "mismo parámetro: usá sólo `identifier`."
-            )
-        if identifier is not None:
-            return identifier
-        if email is not None:
-            from hexcore._deprecation import warn_deprecated
-
-            warn_deprecated(
-                "IdentityService.sign_in(email=...)",
-                "IdentityService.sign_in(identifier=...)",
-                since="10.0",
-            )
-            return email
-        raise ValueError("Falta el identificador: `sign_in(identifier=..., password=...)`.")
-
     async def _buscar_por_identificador(self, identificador: str) -> User | None:
         """
         Busca al usuario por lo que la configuración habilite.
@@ -930,20 +902,19 @@ class IdentityService:
     async def sign_in(
         self,
         *,
-        identifier: str | None = None,
+        identifier: str,
         password: str,
         transport: Transport = "cookie",
         ip_address: str | None = None,
         user_agent: str | None = None,
         scopes: t.Iterable[str] | None = None,
-        email: str | None = None,
     ) -> tuple[User, IdentitySession, TokenPair]:
         """
         Autentica con credencial local y crea la sesión.
 
         `identifier` es el mail o el nombre de usuario, según lo que habilite
-        `IdentityConfig.sign_in_identifiers`. `email=` se acepta como alias deprecado del
-        parámetro viejo, para que el código de 9.x siga compilando.
+        `IdentityConfig.sign_in_identifiers`. El alias `email=`, deprecado en 10.0, se
+        **eliminó en 11.0**.
 
         **El orden de los chequeos es deliberado y es la parte que importa.** Primero se resuelve
         la credencial y se verifica la contraseña —hasheando un señuelo si no hay fila— y sólo
@@ -962,8 +933,7 @@ class IdentityService:
                 mismo error para los dos**, y con el mismo tiempo de respuesta.
             AccountLockedError, EmailNotVerifiedError: sólo tras validar la contraseña.
         """
-        identificador = self._resolver_alias_de_identificador(identifier, email)
-        usuario = await self._buscar_por_identificador(identificador)
+        usuario = await self._buscar_por_identificador(identifier)
 
         credencial = (
             await self._accounts.get_credential(usuario.id) if usuario else None

{hexcore-10.2.0 → hexcore-11.0.2}/hexcore/darwin/domain/context.py

@@ -226,6 +226,49 @@ class AuthContext(BaseModel, t.Generic[TUser]):
 
         return self
 
+    # ── Callers externos a Darwin ─────────────────────────────────────────────
+    @classmethod
+    def external(
+        cls,
+        user_id: UUID,
+        *,
+        roles: t.Iterable[str] = (),
+        scopes: t.Iterable[str] = (),
+        status: str | None = None,
+        transport: Transport = "bearer",
+    ) -> "AuthContext[t.Any]":
+        """
+        Un `AuthContext` para un caller externo a Darwin (HC-21).
+
+        `AccessRequest.context` exige un `AuthContext`, y hasta acá la única forma de tener uno
+        era un `Principal` de Darwin real —con su `session_id`, resuelto por
+        `AbstractPrincipalResolver`—. Un token de **otro** sistema de identidad —el caso que
+        motiva esto es la APK de redv2, que se queda en Better Auth mientras la web migra a
+        Darwin— no tiene nada de eso, y no había forma de que ese caller pasara por
+        `AuthorizationEngine.decide()` sin fabricar una sesión Darwin que no existe.
+
+        `actor` y `subject` son el mismo `Principal`, sin `session_id` (no hay sesión Darwin
+        que revocar) y sin `impersonation` (un caller externo no tiene cómo impersonar *dentro*
+        de Darwin — esa noción no existe para él). `transport` queda auditado como lo que
+        realmente es: por defecto `"bearer"`, pasable si el caller usa otro transporte.
+
+        Uso::
+
+            contexto = AuthContext.external(
+                UUID(claims["sub"]), roles=claims["roles"], scopes=claims["permissions"]
+            )
+            decision = await engine.decide(
+                AccessRequest(context=contexto, action="invoice.approve", resource=recurso)
+            )
+        """
+        principal = Principal(
+            user_id=user_id,
+            roles=frozenset(roles),
+            scopes=frozenset(scopes),
+            status=status,
+        )
+        return cls(actor=principal, subject=principal, transport=transport)
+
     # ── Identidades ───────────────────────────────────────────────────────────
     @property
     def actor_id(self) -> UUID | str:

{hexcore-10.2.0 → hexcore-11.0.2}/hexcore/darwin/domain/ports.py

@@ -49,6 +49,7 @@ __all__ = [
     "AbstractAuditSink",
     "AbstractPrincipalResolver",
     "NullPrincipalResolver",
+    "CompositePrincipalResolver",
     "ResolvedPrincipal",
 ]
 
@@ -466,3 +467,51 @@ class NullPrincipalResolver(AbstractPrincipalResolver):
     async def resolve(self, user: "User") -> "ResolvedPrincipal":
         del user
         return ResolvedPrincipal()
+
+
+class CompositePrincipalResolver(AbstractPrincipalResolver):
+    """
+    Combina varios `AbstractPrincipalResolver` en uno solo.
+
+    `configure_identity(principals=...)` sólo tiene **un** slot (HC-16): no hay forma de
+    cablear a la vez, por ejemplo, `RbacPrincipalResolver` —que resuelve roles/scopes y nunca
+    toca `status`— con un resolver propio de la app que sólo sabe de `status` ("pending",
+    "banned", lo que sea). Sin este puente, quien necesitara ambos tenía que reimplementar a
+    mano lo que `RbacPrincipalResolver` ya hace, sólo para poder agregarle un `status`.
+
+    Corre los resolvers en orden y los combina:
+
+    - `roles` y `scopes`: unión de todos.
+    - `status`: el primer resolver de la lista que devuelva algo distinto de `None` — no una
+      unión, porque el estado de una cuenta no es un conjunto, es un valor. El orden importa:
+      poné primero el resolver cuyo `status` tiene que ganar.
+
+    Uso::
+
+        configure_identity(
+            IdentityConfig(),
+            principals=CompositePrincipalResolver([
+                rbac.principal_resolver(),      # roles y scopes
+                EstadoDeCuentaResolver(uow),     # status
+            ]),
+        )
+    """
+
+    def __init__(self, resolvers: t.Sequence[AbstractPrincipalResolver]) -> None:
+        self._resolvers = list(resolvers)
+
+    async def resolve(self, user: "User") -> "ResolvedPrincipal":
+        roles: set[str] = set()
+        scopes: set[str] = set()
+        status: str | None = None
+
+        for resolver in self._resolvers:
+            resuelto = await resolver.resolve(user)
+            roles.update(resuelto.roles)
+            scopes.update(resuelto.scopes)
+            if status is None and resuelto.status is not None:
+                status = resuelto.status
+
+        return ResolvedPrincipal(
+            roles=frozenset(roles), scopes=frozenset(scopes), status=status
+        )

{hexcore-10.2.0 → hexcore-11.0.2}/hexcore/darwin/infrastructure/lifespan.py

@@ -22,6 +22,26 @@ logger = logging.getLogger("hexcore.darwin.lifespan")
 __all__ = ["IdentityStep", "SessionReaperStep", "identity_startup_steps"]
 
 
+def _verificar_paso(paso: t.Any) -> None:
+    """
+    Verifica que el paso de un plugin cumpla `StartupStep` **antes** de arrancar ninguno.
+
+    Se valida la lista entera primero, y recién después se arranca: un paso mal formado en el
+    segundo plugin no puede descubrirse después de que el primero ya corrió su seeding.
+
+    El mensaje nombra al paso y la forma que le falta porque el síntoma sin esto es
+    `AttributeError: 'X' object has no attribute 'start'` saliendo de un módulo del framework,
+    que no le dice a nadie que el culpable es el plugin que acaba de agregar.
+    """
+    if callable(getattr(paso, "start", None)):
+        return
+    raise TypeError(
+        f"El paso de arranque {type(paso).__name__!r} que aporta un plugin no cumple "
+        "`StartupStep`: le falta `async def start(self) -> None`. Un `__call__` no alcanza — "
+        "`build_lifespan` y `IdentityStep` llaman a `start()`."
+    )
+
+
 class IdentityStep:
     """
     Configura Darwin y verifica que su esquema esté visible para Alembic.
@@ -56,11 +76,12 @@ class IdentityStep:
         self._config = config
         self._components = dict(components or {})
         self._verify_schema = verify_schema
+        self._plugin_steps: list[t.Any] = []
 
     async def start(self) -> None:
         from hexcore.darwin.application.container import configure_identity
 
-        configure_identity(self._config, **self._components)
+        contenedor = configure_identity(self._config, **self._components)
         logger.info("Darwin configurado.")
 
         self._verificar_defaults_de_produccion()
@@ -68,15 +89,32 @@ class IdentityStep:
         if self._verify_schema:
             self._verificar_esquema()
 
+        # `PluginRegistry.startup_steps()` existe hace varias versiones, pero nada lo llamaba
+        # acá — `RbacSeedStep` (y cualquier otro paso de plugin, como el reaper de passkeys)
+        # sólo corría si el consumidor lo descubría y lo agregaba a mano a su propio
+        # `build_lifespan(...)` (HC-17). Se corren en el orden en que los plugins fueron
+        # registrados, después de que el contenedor ya existe.
+        self._plugin_steps = list(contenedor.plugins.startup_steps())
+        for paso in self._plugin_steps:
+            _verificar_paso(paso)
+        for paso in self._plugin_steps:
+            await paso.start()
+
     async def stop(self) -> None:
         """
-        Descarta el contenedor y deregistra el sobre.
+        Para los pasos de los plugins y descarta el contenedor.
 
         Importa en un worker de vida larga que reconfigura, y en los tests: sin esto el
         registro del sobre queda apuntando a un contenedor que ya no existe.
         """
         from hexcore.darwin.application.container import reset_identity
 
+        for paso in reversed(self._plugin_steps):
+            detener = getattr(paso, "stop", None)
+            if detener is not None:
+                await detener()
+        self._plugin_steps = []
+
         reset_identity()
 
     def _verificar_esquema(self) -> None: