From 37439188ca75099b69247ff2f77754507e63e3c5 Mon Sep 17 00:00:00 2001
From: Ajay Ghanwat <ghanwat.ajay@workroot.in>
Date: Sat, 22 Aug 2026 23:30:01 +0530
Subject: [PATCH] fix: share authz catalog across package instances

---
 bun.lock                         |  4 ++--
 packages/authz/package.json      |  2 +-
 packages/authz/src/client.ts     | 16 +++++++++++++---
 packages/dev-server/package.json |  2 +-
 4 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/bun.lock b/bun.lock
index 04386c86..007e5ba8 100644
--- a/bun.lock
+++ b/bun.lock
@@ -257,7 +257,7 @@
     },
     "packages/authz": {
       "name": "@wrnexus/authz",
-      "version": "0.8.13",
+      "version": "0.8.14",
       "dependencies": {
         "@wrnexus/core": "workspace:*",
         "@wrnexus/db": "workspace:*",
@@ -357,7 +357,7 @@
     },
     "packages/dev-server": {
       "name": "@wrnexus/dev-server",
-      "version": "0.8.45",
+      "version": "0.8.46",
       "dependencies": {
         "@wrnexus/authz": "workspace:*",
         "@wrnexus/cache": "workspace:*",
diff --git a/packages/authz/package.json b/packages/authz/package.json
index ffa08cd3..fbeefd12 100644
--- a/packages/authz/package.json
+++ b/packages/authz/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/authz",
-  "version": "0.8.13",
+  "version": "0.8.14",
   "private": true,
   "type": "module",
   "main": "src/index.ts",
diff --git a/packages/authz/src/client.ts b/packages/authz/src/client.ts
index a1504918..71f36cda 100644
--- a/packages/authz/src/client.ts
+++ b/packages/authz/src/client.ts
@@ -32,16 +32,26 @@
 
 import type { AuthzCatalog } from "./types.ts";
 
-let catalog: AuthzCatalog | undefined;
+interface AuthzCatalogState {
+  catalog?: AuthzCatalog;
+}
+
+const catalogKey = Symbol.for("@wrnexus/authz:catalog:v1");
+
+function state(): AuthzCatalogState {
+  const global = globalThis as Record<PropertyKey, unknown>;
+  return (global[catalogKey] ??= {}) as AuthzCatalogState;
+}
 
 /** Set the process-wide authorization catalog (called by the framework at boot). */
 export function setAuthzCatalog(next: AuthzCatalog): AuthzCatalog {
-  catalog = next;
+  state().catalog = next;
   return next;
 }
 
 /** The process-wide authorization catalog. Throws if it hasn't been set. */
 export function getAuthzCatalog(): AuthzCatalog {
+  const catalog = state().catalog;
   if (!catalog) {
     throw new Error(
       "WRN-AUTHZ-SETUP: no authorization catalog is configured. The dev server and " +
@@ -59,5 +69,5 @@ export function getAuthzCatalog(): AuthzCatalog {
 
 /** Whether the process-wide authorization catalog has been set. */
 export function hasAuthzCatalog(): boolean {
-  return catalog !== undefined;
+  return state().catalog !== undefined;
 }
diff --git a/packages/dev-server/package.json b/packages/dev-server/package.json
index 2d77ee7a..6158626e 100644
--- a/packages/dev-server/package.json
+++ b/packages/dev-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/dev-server",
-  "version": "0.8.45",
+  "version": "0.8.46",
   "type": "module",
   "main": "src/index.ts",
   "exports": {