/**
 * Authorization schema — the single source of truth (@mesh-tech/authz).
 *
 * mode "role-gating": enforcement is a coarse-role check on the caller's
 * Zitadel project roles (no SpiceDB, no resources/relations). `coarseRoles` is
 * the whole vocabulary — it becomes the app's Zitadel PROJECT ROLES (declared
 * in `index.ts`), what the Hub create-key wizard lists, and what
 * `m.requireRole(...)` checks against at request time.
 *
 * Exported as the DEFAULT export so both the api runtime (`authz.ts`) and the
 * Pulumi program (`index.ts`, for `compileOpsHubMetadata`) import the same
 * definition.
 */

import { defineSchema } from "@mesh-tech/authz/schema";

export default defineSchema({
  namespace: "{{name}}",
  version: "0.1.0",
  mode: "role-gating",
  coarseRoles: ["admin", "viewer"] as const,
});