@sixb/core 0.1.21 → 0.1.22

package/dist/auth/strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"strategy.d.ts","sourceRoot":"","sources":["../../src/auth/strategy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,YAAY,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,YAAY,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,kCAAkC,EAClC,kCAAkC,EAClC,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,gCAAgC,EAChC,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,cAAc,CAAA"}
+{"version":3,"file":"strategy.d.ts","sourceRoot":"","sources":["../../src/auth/strategy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACzD,YAAY,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC9D,YAAY,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,kCAAkC,EAClC,kCAAkC,EAClC,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EACZ,sBAAsB,GACvB,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,gCAAgC,EAChC,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,cAAc,CAAA"}

package/dist/auth/strategy.js

@@ -1,15 +1,19 @@
 // @bun
 import {
   SignInRefusedError2,
+  signInDisplayName2,
+  signInAvatarUrl2,
   isMagicLinkAuthStrategy2,
   isInvitationDeliveryAuthStrategy2,
   isOidcAuthStrategy2
-} from "../chunk-hcbyfxbe.js";
+} from "../chunk-5grk14e5.js";
 export {
   SignInRefusedError2 as SignInRefusedError,
   isInvitationDeliveryAuthStrategy2 as isInvitationDeliveryAuthStrategy,
   isMagicLinkAuthStrategy2 as isMagicLinkAuthStrategy,
-  isOidcAuthStrategy2 as isOidcAuthStrategy
+  isOidcAuthStrategy2 as isOidcAuthStrategy,
+  signInAvatarUrl2 as signInAvatarUrl,
+  signInDisplayName2 as signInDisplayName
 };
 
-//# debugId=0814B8BAC08267AD64756E2164756E21
+//# debugId=FBAFB17D98B4860964756E2164756E21

package/dist/auth/strategy.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "0814B8BAC08267AD64756E2164756E21",
+  "debugId": "FBAFB17D98B4860964756E2164756E21",
   "names": []
 }

package/dist/auth/types.d.ts

@@ -1,5 +1,6 @@
 import type { GroupDefinition, GroupReference, MembershipOperation } from "../security";
-import type { AccessTokenRecord, AuthStorage, CompleteAuthSessionInput, CompleteSignInResult, InvitationRecord, InvitationStatus, ServiceAccountGroupMembershipRecord, ServiceAccountRecord, SessionRecord, UserRecord } from "../storage/auth";
+import type { AccessTokenRecord, AuthStorage, CompleteAuthSessionInput, CompleteSignInResult, InvitationRecord, InvitationStatus, ServiceAccountGroupMembershipRecord, ServiceAccountRecord, SessionRecord, UserIdentityRecord, UserRecord } from "../storage/auth";
+import type { UserProfile } from "../users";
 export type Principal = {
     readonly type: "user";
     readonly id: string;
@@ -10,6 +11,10 @@ export type Principal = {
     readonly type: "system";
     readonly id: string;
 };
+/** A signed-in person: the only principal who talks to the Agent or takes part in a thread. */
+export type UserPrincipal = Extract<Principal, {
+    readonly type: "user";
+}>;
 /**
  * The canonical principal for system-originated writes (runs triggered without a caller,
  * worker fallbacks, decode-time defaults). Import this everywhere instead of inlining a
@@ -19,12 +24,19 @@ export declare const SYSTEM_PRINCIPAL: Principal;
 /** Structural equality for principals (same type and id). */
 export declare function principalsEqual(left: Principal, right: Principal): boolean;
 export type AuthStrategyKind = "magicLink" | "oidc" | "dev" | "disabled";
+/** A profile field an identity provider can own. */
+export type ProfileField = "displayName" | "avatarUrl";
 export interface AuthStrategy {
     readonly id: string;
     readonly kind: AuthStrategyKind;
     readonly developmentOnly?: boolean;
     readonly disabled?: boolean;
     readonly allowDisabledInProduction?: boolean;
+    /**
+     * The profile fields this strategy's provider sets at every sign-in of the person behind
+     * `identity`, so people cannot edit them in Sixb. Omitted, the strategy manages none.
+     */
+    providerProfileFields?(identity: UserIdentityRecord): readonly ProfileField[];
 }
 export interface InvitationRecipientInput {
     readonly projectId: string;
@@ -97,6 +109,8 @@ export interface MagicLinkCallbackInput {
     readonly magicLinkId: string;
     readonly token: string;
     readonly session: CompleteAuthSessionInput;
+    /** The name the person gave. Used only when this sign-in creates their account. */
+    readonly displayName?: string;
     readonly now?: Date;
 }
 export interface MagicLinkCallbackResult extends CompleteSignInResult {
@@ -111,6 +125,8 @@ export interface MagicLinkPeekInput {
 }
 export interface MagicLinkPeekResult {
     readonly email: string;
+    /** The link will create an account, so the confirmation page may ask for a name. */
+    readonly firstSignIn?: true;
 }
 export interface MagicLinkAuthStrategy extends InvitationDeliveryAuthStrategy {
     readonly kind: "magicLink";
@@ -164,6 +180,8 @@ export interface OidcAuthStrategy extends InvitationDeliveryAuthStrategy {
     readonly bootstrapGroupIds?: readonly string[];
     startOidcSignIn(input: OidcStartSignInInput): Promise<OidcStartSignInResult>;
     completeOidcSignIn(input: OidcCallbackInput): Promise<OidcCallbackResult>;
+    /** Every OIDC sign-in sets the name and picture the provider sends, so the strategy says which. */
+    providerProfileFields(identity: UserIdentityRecord): readonly ProfileField[];
 }
 export interface InviteUserInput {
     readonly email: string;
@@ -303,6 +321,17 @@ export interface ReactivateMemberResult {
     readonly groupIds: readonly string[];
     readonly managedGroupIds: readonly string[];
 }
+/** The signed-in person's own profile. */
+export interface OwnProfile {
+    readonly profile: UserProfile;
+    /** The fields their identity provider sets at sign-in, which they cannot edit here. */
+    readonly managedFields: readonly ProfileField[];
+}
+/** Omitted fields stay unchanged, and `null` clears one. */
+export interface UpdateOwnProfileInput {
+    readonly displayName?: string | null;
+    readonly avatarUrl?: string | null;
+}
 /** `"session"` reads only the cookie; `"any"` reads a bearer access token, else the cookie. */
 export type AuthCredentialSource = "session" | "any";
 export interface AuthSessionResolutionOptions {

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACvF,OAAO,KAAK,EACV,iBAAiB,EACjB,WAAW,EACX,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,mCAAmC,EACnC,oBAAoB,EACpB,aAAa,EACb,UAAU,EACX,MAAM,iBAAiB,CAAA;AAExB,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAA4C,CAAA;AAE3E,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAE1E;AAED,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,CAAA;AAExE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;CAC7C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,MAAM,yBAAyB,GACjC,SAAS,GACT,eAAe,GACf,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,CAAA;AAElB,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAA;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,SAAS,GAAG,cAAc,CAAA;AAEzE,MAAM,MAAM,oBAAoB,GAAG,uBAAuB,GAAG,eAAe,CAAA;AAE5E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;IACrC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAA;CACvC;AAED,MAAM,WAAW,8BAA+B,SAAQ,YAAY;IAClE,2BAA2B,CAAC,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACjG,iBAAiB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;CACjF;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,MAAM,sBAAsB,GAAG,uBAAuB,CAAA;AAE5D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACxC;AAED,MAAM,MAAM,4BAA4B,GAAG,wBAAwB,CAAA;AAEnE,MAAM,MAAM,6BAA6B,GAAG,yBAAyB,CAAA;AAErE,MAAM,MAAM,6BAA6B,GAAG,yBAAyB,CAAA;AAErE,MAAM,MAAM,iCAAiC,GAAG,wBAAwB,CAAA;AAExE,MAAM,MAAM,kCAAkC,GAAG,yBAAyB,CAAA;AAE1E,MAAM,MAAM,kCAAkC,GAAG,yBAAyB,CAAA;AAE1E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAA;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,uBAAwB,SAAQ,oBAAoB;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,qBAAsB,SAAQ,8BAA8B;IAC3E,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,2BAA2B,CAAC,CAC1B,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,kCAAkC,CAAC,CAAA;IAC9C,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC/E;;;;;;OAMG;IACH,aAAa,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IAC9E,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;CACzF;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAA;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAiB,SAAQ,8BAA8B;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;IAC5E,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CAC1E;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAA;IACzB,uEAAuE;IACvE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;CACxC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACjD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAC7B;IACE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,2BAA2B,GAAG,mCAAmC,CAAA;CACnF,CAAA;AAEL,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAA;IACjD,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAA;IACxC,QAAQ,CAAC,YAAY,EAAE;QACrB,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAA;KACtD,CAAA;CACF;AAED;;;;GAIG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAA;IACjD,sFAAsF;IACtF,QAAQ,CAAC,oBAAoB,EAAE,SAAS,qBAAqB,EAAE,CAAA;IAC/D,QAAQ,CAAC,YAAY,EAAE,+BAA+B,CAAA;CACvD;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAA;IAC/C,mDAAmD;IACnD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,SAAS,EAAE,mBAAmB,EAAE,YAAY,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAAA;CACzF;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;CAChC;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAA;CAC1C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAA;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5C;AAED,+FAA+F;AAC/F,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,KAAK,CAAA;AAEpD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IAChD,6EAA6E;IAC7E,QAAQ,CAAC,eAAe,CAAC,EAAE,YAAY,CAAA;CACxC;AAED,oDAAoD;AACpD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;CACtC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,mCAAmC,EAAE,CAAA;CAC1E;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,qCAAsC,SAAQ,uBAAuB;IACpF,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;CAC9C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,EAAE,SAAS,wBAAwB,EAAE,CAAA;CAC9D;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACpD;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACpD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;CACxC;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,gGAAgG;IAChG,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAChC;AAED,MAAM,MAAM,cAAc,GACtB,YAAY,GACZ;IACE,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAA;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;CACrC,CAAA;AAEL,MAAM,MAAM,wBAAwB,GAChC,eAAe,GACf,gBAAgB,GAChB,gBAAgB,GAChB,sBAAsB,GACtB,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,2BAA2B,GAC3B,gBAAgB,CAAA;AAEpB,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,yFAAyF;IACzF,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAA;IAC3E,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,CAAA;AAErF,MAAM,MAAM,+BAA+B,GACvC,wBAAwB,GACxB,mCAAmC,CAAA;AAEvC,MAAM,MAAM,+BAA+B,GACvC,+BAA+B,GAC/B,6CAA6C,CAAA;AAEjD,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,GAAG,+BAA+B,CAAA;AAE5F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,GAAG;QACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KACzB,CAAA;CACF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACvF,OAAO,KAAK,EACV,iBAAiB,EACjB,WAAW,EACX,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,mCAAmC,EACnC,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,UAAU,EACX,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAE3C,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpD,+FAA+F;AAC/F,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAEzE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAA4C,CAAA;AAE3E,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAE1E;AAED,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,CAAA;AAExE,oDAAoD;AACpD,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,WAAW,CAAA;AAEtD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;IAC5C;;;OAGG;IACH,qBAAqB,CAAC,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,YAAY,EAAE,CAAA;CAC9E;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,MAAM,yBAAyB,GACjC,SAAS,GACT,eAAe,GACf,mBAAmB,GACnB,gBAAgB,GAChB,cAAc,CAAA;AAElB,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAA;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,SAAS,GAAG,cAAc,CAAA;AAEzE,MAAM,MAAM,oBAAoB,GAAG,uBAAuB,GAAG,eAAe,CAAA;AAE5E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;IACrC;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAA;CACvC;AAED,MAAM,WAAW,8BAA+B,SAAQ,YAAY;IAClE,2BAA2B,CAAC,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACjG,iBAAiB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;CACjF;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,MAAM,sBAAsB,GAAG,uBAAuB,CAAA;AAE5D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACxC;AAED,MAAM,MAAM,4BAA4B,GAAG,wBAAwB,CAAA;AAEnE,MAAM,MAAM,6BAA6B,GAAG,yBAAyB,CAAA;AAErE,MAAM,MAAM,6BAA6B,GAAG,yBAAyB,CAAA;AAErE,MAAM,MAAM,iCAAiC,GAAG,wBAAwB,CAAA;AAExE,MAAM,MAAM,kCAAkC,GAAG,yBAAyB,CAAA;AAE1E,MAAM,MAAM,kCAAkC,GAAG,yBAAyB,CAAA;AAE1E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAA;IAC1C,mFAAmF;IACnF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,uBAAwB,SAAQ,oBAAoB;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,oFAAoF;IACpF,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAA;CAC5B;AAED,MAAM,WAAW,qBAAsB,SAAQ,8BAA8B;IAC3E,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,2BAA2B,CAAC,CAC1B,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,kCAAkC,CAAC,CAAA;IAC9C,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC/E;;;;;;OAMG;IACH,aAAa,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IAC9E,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;CACzF;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAA;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CACpB;AAED,MAAM,WAAW,kBAAmB,SAAQ,oBAAoB;IAC9D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAiB,SAAQ,8BAA8B;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;IAC5E,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACzE,mGAAmG;IACnG,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,SAAS,YAAY,EAAE,CAAA;CAC7E;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAA;IACzB,uEAAuE;IACvE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;CACxC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACjD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAC7B;IACE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,2BAA2B,GAAG,mCAAmC,CAAA;CACnF,CAAA;AAEL,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAA;IACjD,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAA;IACxC,QAAQ,CAAC,YAAY,EAAE;QACrB,QAAQ,CAAC,gBAAgB,EAAE,0BAA0B,CAAA;KACtD,CAAA;CACF;AAED;;;;GAIG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAA;IACjD,sFAAsF;IACtF,QAAQ,CAAC,oBAAoB,EAAE,SAAS,qBAAqB,EAAE,CAAA;IAC/D,QAAQ,CAAC,YAAY,EAAE,+BAA+B,CAAA;CACvD;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAA;IAC/C,mDAAmD;IACnD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,SAAS,EAAE,mBAAmB,EAAE,YAAY,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAAA;CACzF;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;CAChC;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAA;CAC1C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAA;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5C;AAED,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAA;CAChD;AAED,4DAA4D;AAC5D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,+FAA+F;AAC/F,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,KAAK,CAAA;AAEpD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,oBAAoB,CAAA;IAChD,6EAA6E;IAC7E,QAAQ,CAAC,eAAe,CAAC,EAAE,YAAY,CAAA;CACxC;AAED,oDAAoD;AACpD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;CACtC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,mCAAmC,EAAE,CAAA;CAC1E;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,qCAAsC,SAAQ,uBAAuB;IACpF,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;CAC9C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,EAAE,SAAS,wBAAwB,EAAE,CAAA;CAC9D;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACpD;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACpD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;CACxC;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,gGAAgG;IAChG,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAChC;AAED,MAAM,MAAM,cAAc,GACtB,YAAY,GACZ;IACE,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAA;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;CACrC,CAAA;AAEL,MAAM,MAAM,wBAAwB,GAChC,eAAe,GACf,gBAAgB,GAChB,gBAAgB,GAChB,sBAAsB,GACtB,iBAAiB,GACjB,cAAc,GACd,yBAAyB,GACzB,2BAA2B,GAC3B,gBAAgB,CAAA;AAEpB,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,yFAAyF;IACzF,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACjE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAA;IAC3E,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,GAAG,wBAAwB,CAAA;AAErF,MAAM,MAAM,+BAA+B,GACvC,wBAAwB,GACxB,mCAAmC,CAAA;AAEvC,MAAM,MAAM,+BAA+B,GACvC,+BAA+B,GAC/B,6CAA6C,CAAA;AAEjD,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,GAAG,+BAA+B,CAAA;AAE5F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,GAAG;QACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KACzB,CAAA;CACF"}

package/dist/authorization/decision.d.ts

@@ -19,6 +19,8 @@ export type AuthzRequest = {
 } | {
     readonly kind: "dataset.view";
     readonly datasetId: string;
+} | {
+    readonly kind: "users.view";
 } | {
     readonly kind: "object.edit";
     readonly objectTypeId: string;
@@ -42,14 +44,20 @@ export type AuthzRequest = {
     readonly pipelineId: string;
 } | {
     readonly kind: "agent.run";
+} | {
+    readonly kind: "models.run";
 } | {
     readonly kind: "logs.observe";
 } | {
     readonly kind: "aiUsage.observe";
 } | {
     readonly kind: "activity.observe";
+} | {
+    readonly kind: "agentThreads.observe";
 } | {
     readonly kind: "aiUsage.manage";
+} | {
+    readonly kind: "agentMemory.manage";
 } | {
     readonly kind: "connector.manage";
     readonly connectorId: string;
@@ -122,5 +130,12 @@ export declare function assertPrivileged(runtime: AuthorizedRuntime, operation:
 export declare function assertProviderAccess(runtime: AuthorizedRuntime & {
     readonly runtimeAuthorization: RuntimeAuthorization;
 }, execution: ExecutionContext, operation: string): void;
+/**
+ * Assert a model call is allowed. Trusted code and genuine agent runs always may; a principal
+ * needs `can.run(project.models)`, which covers every model in the catalog.
+ */
+export declare function assertModelAccess(runtime: AuthorizedRuntime & {
+    readonly runtimeAuthorization: RuntimeAuthorization;
+}, execution: ExecutionContext, operation: string): void;
 export {};
 //# sourceMappingURL=decision.d.ts.map

package/dist/authorization/decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/authorization/decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,KAAK,4BAA4B,EAGlC,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAGhF,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,SAAS,CAAA;AAE/D,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GACrC;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAEvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;CAC9C;AAuDD,oEAAoE;AACpE,wBAAgB,QAAQ,CACtB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,aAAa,CAOf;AAED,wBAAgB,SAAS,CACvB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,OAAO,CAET;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAkBxF;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAI3F;AAED,2FAA2F;AAC3F,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CASpE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAGpF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/F;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUpF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,GAAG;IAAE,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAA;CAAE,EACpF,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,MAAM,GAChB,IAAI,CAiBN"}
+{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/authorization/decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,KAAK,4BAA4B,EAGlC,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAGhF,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,SAAS,CAAA;AAE/D,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GACrC;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;CAAE,GACzC;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE,GACvC;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAEvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;CAC9C;AA+DD,oEAAoE;AACpE,wBAAgB,QAAQ,CACtB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,aAAa,CAOf;AAED,wBAAgB,SAAS,CACvB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,OAAO,CAET;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAkBxF;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAI3F;AAED,2FAA2F;AAC3F,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CASpE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAGpF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/F;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUpF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,GAAG;IAAE,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAA;CAAE,EACpF,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,MAAM,GAChB,IAAI,CAiBN;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,iBAAiB,GAAG;IAAE,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAA;CAAE,EACpF,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,MAAM,GAChB,IAAI,CAiBN"}

package/dist/authorization/event-visibility.d.ts

@@ -9,8 +9,12 @@
  * topic we don't yet model may carry a subject the principal is not allowed to
  * see. Adding an event topic therefore requires an explicit visibility decision
  * here, never a silent default.
+ *
+ * A type the principal views only under a condition holds no view grant, so it is hidden here
+ * unless the caller names it in `conditioned`: it then passes, and the caller decides on the
+ * objects the event names.
  */
 import type { StoredDomainEvent } from "../events";
 import type { AuthorizationContext } from "./types";
-export declare function canViewEvent(authorization: AuthorizationContext | null | undefined, event: StoredDomainEvent): boolean;
+export declare function canViewEvent(authorization: AuthorizationContext | null | undefined, event: StoredDomainEvent, conditioned?: Pick<ReadonlySet<string>, "has">): boolean;
 //# sourceMappingURL=event-visibility.d.ts.map

package/dist/authorization/event-visibility.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event-visibility.d.ts","sourceRoot":"","sources":["../../src/authorization/event-visibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAElD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAEnD,wBAAgB,YAAY,CAC1B,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAkET"}
+{"version":3,"file":"event-visibility.d.ts","sourceRoot":"","sources":["../../src/authorization/event-visibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAElD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAInD,wBAAgB,YAAY,CAC1B,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,KAAK,EAAE,iBAAiB,EACxB,WAAW,GAAE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,CAAiB,GAC5D,OAAO,CA4DT"}

package/dist/authorization/grant-kinds.d.ts

@@ -8,9 +8,9 @@
  * entry in `GRANT_KINDS` plus the compile errors that forces at every consumer.
  */
 import type { GrantDefinition } from "../security/types";
-export type GrantKind = "view:object" | "view:dataset" | "edit:object" | "append:telemetry" | "apply:action" | "share:share" | "run:workflow" | "run:sync" | "run:pipeline" | "run:agent" | "observe:logs" | "observe:aiUsage" | "observe:activity" | "manage:connector" | "manage:aiUsage";
+export type GrantKind = "view:object" | "view:dataset" | "view:users" | "edit:object" | "append:telemetry" | "apply:action" | "share:share" | "run:workflow" | "run:sync" | "run:pipeline" | "run:agent" | "run:models" | "observe:logs" | "observe:aiUsage" | "observe:activity" | "observe:agentThreads" | "manage:connector" | "manage:aiUsage" | "manage:agentMemory";
 /** Capabilities over one project-wide surface: held or not, with no ids to select. */
-export type SingletonGrantKind = "run:agent" | "observe:logs" | "observe:aiUsage" | "observe:activity" | "manage:aiUsage";
+export type SingletonGrantKind = "view:users" | "run:agent" | "run:models" | "observe:logs" | "observe:aiUsage" | "observe:activity" | "observe:agentThreads" | "manage:aiUsage" | "manage:agentMemory";
 export type TargetedGrantKind = Exclude<GrantKind, SingletonGrantKind>;
 /** Registered id universes a grant kind ranges over, plus subtype expansion. */
 export interface GrantUniverse {

package/dist/authorization/grant-kinds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-kinds.d.ts","sourceRoot":"","sources":["../../src/authorization/grant-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD,MAAM,MAAM,SAAS,GACjB,aAAa,GACb,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,aAAa,GACb,cAAc,GACd,UAAU,GACV,cAAc,GACd,WAAW,GACX,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,kBAAkB,GAClB,gBAAgB,CAAA;AAEpB,sFAAsF;AACtF,MAAM,MAAM,kBAAkB,GAC1B,WAAW,GACX,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,CAAA;AACpB,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;AAEtE,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CAClE;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,aAAa,EAAE,aAAa,CAAC,CAAA;AAE1E,UAAU,qBAAqB;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAChC;AAED,UAAU,sBAAsB;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE;IACxB,QAAQ,EAAE,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAC3D,sBAAsB,GACtB,qBAAqB;CAiF1B,CAAA;AAED,eAAO,MAAM,eAAe,EAA+B,SAAS,SAAS,EAAE,CAAA;AAC/E,eAAO,MAAM,yBAAyB,sBAErC,CAAA;AACD,eAAO,MAAM,wBAAwB,qBAEpC,CAAA;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,IAAI,kBAAkB,CAEhF;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,CAmB7D;AAED,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG;KAC7B,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAAG,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC;CAC/E,CAAA;AAED,wBAAgB,cAAc,IAAI,iBAAiB,CAkBlD"}
+{"version":3,"file":"grant-kinds.d.ts","sourceRoot":"","sources":["../../src/authorization/grant-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD,MAAM,MAAM,SAAS,GACjB,aAAa,GACb,cAAc,GACd,YAAY,GACZ,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,aAAa,GACb,cAAc,GACd,UAAU,GACV,cAAc,GACd,WAAW,GACX,YAAY,GACZ,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,sBAAsB,GACtB,kBAAkB,GAClB,gBAAgB,GAChB,oBAAoB,CAAA;AAExB,sFAAsF;AACtF,MAAM,MAAM,kBAAkB,GAC1B,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,sBAAsB,GACtB,gBAAgB,GAChB,oBAAoB,CAAA;AACxB,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;AAEtE,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CAClE;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,aAAa,EAAE,aAAa,CAAC,CAAA;AAE1E,UAAU,qBAAqB;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAChC;AAED,UAAU,sBAAsB;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE;IACxB,QAAQ,EAAE,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAC3D,sBAAsB,GACtB,qBAAqB;CAqG1B,CAAA;AAED,eAAO,MAAM,eAAe,EAA+B,SAAS,SAAS,EAAE,CAAA;AAC/E,eAAO,MAAM,yBAAyB,sBAErC,CAAA;AACD,eAAO,MAAM,wBAAwB,qBAEpC,CAAA;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,IAAI,kBAAkB,CAEhF;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,CAmB7D;AAED,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG;KAC7B,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAAG,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC;CAC/E,CAAA;AAED,wBAAgB,cAAc,IAAI,iBAAiB,CAsBlD"}

package/dist/authorization/index.d.ts

@@ -1,9 +1,9 @@
 export type { AuthzDecision, AuthzRequest } from "./decision";
-export { assertAuthorized, assertCanAppendTelemetry, assertCanEdit, assertCanManageConnector, assertPrivileged, assertProviderAccess, assertRuntimeAuthorizationBound, evaluate, isAllowed, isRuntimeAllowed, } from "./decision";
+export { assertAuthorized, assertCanAppendTelemetry, assertCanEdit, assertCanManageConnector, assertModelAccess, assertPrivileged, assertProviderAccess, assertRuntimeAuthorizationBound, evaluate, isAllowed, isRuntimeAllowed, } from "./decision";
 export { AuthorizationError } from "./errors";
 export { canViewEvent } from "./event-visibility";
 export type { GrantKind, GrantUniverse } from "./grant-kinds";
-export { resolveAuthorizationContext, resolveRoleGrants } from "./resolve";
+export { resolveAuthorizationContext, resolveRoleGrants, resolveRoleViewConditions, } from "./resolve";
 export { canViewActionRun, canViewPipelineRun, canViewProjection, canViewProjectionRun, canViewWorkflowIntervention, canViewWorkflowRun, } from "./run-visibility";
 export type { AuthorizationContext, GrantIndex, ResolvedRole } from "./types";
 export { emptyGrantIndex } from "./types";

package/dist/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,+BAA+B,EAC/B,QAAQ,EACR,SAAS,EACT,gBAAgB,GACjB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,wBAAwB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,+BAA+B,EAC/B,QAAQ,EACR,SAAS,EACT,gBAAgB,GACjB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/authorization/index.js

@@ -11,8 +11,10 @@ import {
   assertCanManageConnector2,
   assertPrivileged2,
   assertProviderAccess2,
+  assertModelAccess2,
   canViewEvent2,
   resolveRoleGrants2,
+  resolveRoleViewConditions2,
   resolveAuthorizationContext2,
   canViewActionRun2,
   canViewWorkflowRun2,
@@ -21,11 +23,12 @@ import {
   canViewProjectionRun2,
   canViewProjection2,
   emptyGrantIndex2
-} from "../chunk-6vb4st8k.js";
-import"../chunk-v4jbb3rs.js";
-import"../chunk-8frc8a4j.js";
-import"../chunk-dhdha526.js";
-import"../chunk-dvd2fp9q.js";
+} from "../chunk-yc9ners4.js";
+import"../chunk-rap5w0x0.js";
+import"../chunk-65pyhyas.js";
+import"../chunk-4y26vs3v.js";
+import"../chunk-vhbw5sqm.js";
+import"../chunk-zbc929zg.js";
 import"../chunk-6eqsgvxk.js";
 import"../chunk-wkv3h3q7.js";
 export {
@@ -34,6 +37,7 @@ export {
   assertCanAppendTelemetry2 as assertCanAppendTelemetry,
   assertCanEdit2 as assertCanEdit,
   assertCanManageConnector2 as assertCanManageConnector,
+  assertModelAccess2 as assertModelAccess,
   assertPrivileged2 as assertPrivileged,
   assertProviderAccess2 as assertProviderAccess,
   assertRuntimeAuthorizationBound2 as assertRuntimeAuthorizationBound,
@@ -49,7 +53,8 @@ export {
   isAllowed2 as isAllowed,
   isRuntimeAllowed2 as isRuntimeAllowed,
   resolveAuthorizationContext2 as resolveAuthorizationContext,
-  resolveRoleGrants2 as resolveRoleGrants
+  resolveRoleGrants2 as resolveRoleGrants,
+  resolveRoleViewConditions2 as resolveRoleViewConditions
 };
 
-//# debugId=7830C8AB397B7D9564756E2164756E21
+//# debugId=03C415152E608EB864756E2164756E21

package/dist/authorization/index.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "7830C8AB397B7D9564756E2164756E21",
+  "debugId": "03C415152E608EB864756E2164756E21",
   "names": []
 }

package/dist/authorization/resolve.d.ts

@@ -1,4 +1,5 @@
 import type { Principal } from "../auth/types";
+import type { ObjectQueryPredicate } from "../objects/query/ir";
 import type { RoleDefinition } from "../security";
 import { type GrantUniverse } from "./grant-kinds";
 import type { AuthorizationContext, GrantIndex, ResolvedRole } from "./types";
@@ -7,17 +8,34 @@ import type { AuthorizationContext, GrantIndex, ResolvedRole } from "./types";
  *
  * Broad grants (`every.object().except([...])`) expand against the registered
  * universe; object-type grants also expand to subtypes. Resource grants become
- * id sets; grants on one project-wide surface (the Agent, logs, AI usage) become booleans.
+ * id sets; grants on one project-wide surface (the member directory, the Agent, logs, AI usage)
+ * become booleans.
  * The per-kind universe and subtype rules come from the `GRANT_KINDS` table, so
  * this loop never enumerates targets by hand.
+ *
+ * A view grant with a condition grants no type here: see {@link resolveRoleViewConditions}.
  */
 export declare function resolveRoleGrants(role: RoleDefinition, universe: GrantUniverse): GrantIndex;
+/**
+ * Resolve a role's conditional view grants once at startup, from their validated conditions.
+ *
+ * A condition applies to the type its grant names and to each subtype, as a view grant does.
+ * Several conditions on one type combine with `or`, and a type the role also views without a
+ * condition drops them: the role shows every object of it.
+ */
+export declare function resolveRoleViewConditions(conditions: readonly {
+    readonly objectTypeId: string;
+    readonly predicate: ObjectQueryPredicate;
+}[], grants: GrantIndex, universe: GrantUniverse): ReadonlyMap<string, ObjectQueryPredicate>;
 /**
  * Resolve a principal's authorization context from its group memberships.
  *
  * Pure set-union over pre-resolved roles: roles match when their grantedTo
  * groups intersect the principal's memberships, and their concrete id sets
  * and clearances union into the principal's context.
+ *
+ * View conditions union too: the principal sees an object any of them matches. A type one role
+ * views without a condition is viewed whole, whatever conditions the others put on it.
  */
 export declare function resolveAuthorizationContext(input: {
     readonly principal: Principal;

package/dist/authorization/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/authorization/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,aAAa,CAAA;AAC5D,OAAO,EAGL,KAAK,aAAa,EAKnB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE7E;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,GAAG,UAAU,CAqB3F;AA4BD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CACxC,GAAG,oBAAoB,CAiCvB"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/authorization/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,aAAa,CAAA;AAC5D,OAAO,EAGL,KAAK,aAAa,EAKnB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE7E;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,GAAG,UAAU,CAuB3F;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,SAAS;IACnB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAA;CACzC,EAAE,EACH,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,aAAa,GACtB,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAkB3C;AAiCD;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CACxC,GAAG,oBAAoB,CA0CvB"}

package/dist/authorization/run-visibility.d.ts

@@ -4,11 +4,18 @@ import type { PipelineRunRecord } from "../storage/pipeline-runs";
 import type { WorkflowInterventionRecord } from "../storage/workflow-interventions";
 import type { WorkflowRunRecord } from "../storage/workflow-runs";
 import type { AuthorizationContext } from "./types";
+/**
+ * Whether a principal may view a run, by its action and its subject's type. A type the principal
+ * views only through a condition fails here: the subject decides, which `viewableActionRuns` reads.
+ */
 export declare function canViewActionRun(authorization: AuthorizationContext | null | undefined, run: Pick<ActionRunRecord, "actionId" | "subject">): boolean;
 export declare function canViewWorkflowRun(authorization: AuthorizationContext | null | undefined, run: Pick<WorkflowRunRecord, "workflowId">): boolean;
 export declare function canViewWorkflowIntervention(authorization: AuthorizationContext | null | undefined, intervention: Pick<WorkflowInterventionRecord, "workflowId">): boolean;
 export declare function canViewPipelineRun(authorization: AuthorizationContext | null | undefined, run: Pick<PipelineRunRecord, "pipelineId">): boolean;
-/** A projection run is viewable when its target object type(s) are viewable. */
+/**
+ * A projection run is viewable when its target object type(s) are viewable. A run, like its
+ * definition, describes every object of the type, so a type viewed through a condition stays closed.
+ */
 export declare function canViewProjectionRun(authorization: AuthorizationContext | null | undefined, target: ProjectionTarget): boolean;
 /** Whether a principal may see a projection definition (and its run history). */
 export declare function canViewProjection(authorization: AuthorizationContext | null | undefined, projection: ProjectionDefinition): boolean;

package/dist/authorization/run-visibility.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-visibility.d.ts","sourceRoot":"","sources":["../../src/authorization/run-visibility.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAE5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAEjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAEnD,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,SAAS,CAAC,GACjD,OAAO,CAeT;AAED,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,GACzC,OAAO,CAIT;AAED,wBAAgB,2BAA2B,CACzC,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,YAAY,EAAE,IAAI,CAAC,0BAA0B,EAAE,YAAY,CAAC,GAC3D,OAAO,CAKT;AAED,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,GACzC,OAAO,CAIT;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAQT;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,UAAU,EAAE,oBAAoB,GAC/B,OAAO,CAET"}
+{"version":3,"file":"run-visibility.d.ts","sourceRoot":"","sources":["../../src/authorization/run-visibility.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAE5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAEjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAEnD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,SAAS,CAAC,GACjD,OAAO,CAeT;AAED,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,GACzC,OAAO,CAIT;AAED,wBAAgB,2BAA2B,CACzC,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,YAAY,EAAE,IAAI,CAAC,0BAA0B,EAAE,YAAY,CAAC,GAC3D,OAAO,CAKT;AAED,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,GACzC,OAAO,CAIT;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAQT;AAED,iFAAiF;AACjF,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,UAAU,EAAE,oBAAoB,GAC/B,OAAO,CAET"}

package/dist/authorization/types.d.ts

@@ -7,6 +7,7 @@
  * Group and role ids are retained so decisions stay explainable.
  */
 import type { Principal } from "../auth/types";
+import type { ObjectQueryPredicate } from "../objects/query/ir";
 import { type GrantKind, type SingletonGrantKind } from "./grant-kinds";
 /**
  * Grants keyed by kind (`view:object`, `run:sync`, …). Resource selections resolve
@@ -36,6 +37,12 @@ export interface ResolvedRole {
     readonly id: string;
     readonly grantedToGroupIds: readonly string[];
     readonly grants: GrantIndex;
+    /**
+     * What the role's `can.view(Type).where(...)` grants show, per concrete type: the type's
+     * conditions, combined with `or`. A type the role also views without a condition is in
+     * `grants["view:object"]` and not here. Absent means none.
+     */
+    readonly viewConditions?: ReadonlyMap<string, ObjectQueryPredicate>;
     /** Marking ids this role clears. Absent means none. */
     readonly clearances?: ReadonlySet<string>;
 }
@@ -46,6 +53,13 @@ export interface AuthorizationContext {
     /** Roles whose grantedTo groups intersect the principal's memberships. */
     readonly roleIds: readonly string[];
     readonly grants: GrantIndex;
+    /**
+     * The object types the principal views only where a condition matches, with one condition per
+     * role that grants it. A type in `grants["view:object"]` is never here, so a check on that grant
+     * denies these types; only the authorized object reader reads them, through these conditions.
+     * Absent means none.
+     */
+    readonly viewConditions?: ReadonlyMap<string, readonly ObjectQueryPredicate[]>;
     /**
      * Marking ids the principal may read, unioned from its roles. Absent means none: a context built
      * without clearances reads no marked property.

package/dist/authorization/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAkB,KAAK,SAAS,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC;KAC/B,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAAG,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC;CACvF,CAAC,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,IAAI,UAAU,CAE5C;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAC1C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAAkB,KAAK,SAAS,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC;KAC/B,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAAG,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC;CACvF,CAAC,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,IAAI,UAAU,CAE5C;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IACnE,uDAAuD;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC,CAAA;IAC9E;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAC1C"}