@stigmer/server 3.15.3-dev.20260914100347 → 3.15.3-dev.20260916211208

package/dist/authorization/model/workflow.d.ts

@@ -0,0 +1,2 @@
+export declare const workflowDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=workflow.d.ts.map

package/dist/authorization/model/workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/workflow.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,mBAAmB,wCAsC9B,CAAC"}

package/dist/authorization/model/workflow.js

@@ -0,0 +1,38 @@
+/**
+ * Transcript of fga/model/agentic/workflow.fga — the agent's shape
+ * without `can_create_instance` (a workflow instance is created through
+ * the workflow-instance lane, gated by the organization). Kept as its own
+ * transcript, not a shared "blueprint" helper, so the file-by-file drift
+ * compare sees exactly this file's lines.
+ */
+import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, from, objectOf, publicWith, union, usersetOf, } from "./rewrite.js";
+export const workflowDeclaration = declareKind({
+    kind: ApiResourceKind.workflow,
+    schema: WorkflowSchema,
+    source: "fga/model/agentic/workflow.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        [
+            "owner",
+            union(direct(objectOf("identity_account")), from("admin", "organization")),
+        ],
+        [
+            "platform_viewer",
+            direct(usersetOf("identity_provider", "platform_user")),
+        ],
+        [
+            "viewer",
+            union(direct(objectOf("identity_account"), publicWith("identity_account", "allow_public"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), computed("platform_viewer")),
+        ],
+        ["can_view", computed("viewer")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_execute", computed("viewer")],
+        ["can_clone", computed("viewer")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+});
+//# sourceMappingURL=workflow.js.map

package/dist/authorization/model/workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../../../src/authorization/model/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,IAAI,EAAE,eAAe,CAAC,QAAQ;IAC9B,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,gCAAgC;IACxC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,UAAU,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAC9C,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/workflow_execution.d.ts

@@ -0,0 +1,2 @@
+export declare const workflowExecutionDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=workflow_execution.d.ts.map

package/dist/authorization/model/workflow_execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow_execution.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/workflow_execution.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,4BAA4B,wCAqBvC,CAAC"}

package/dist/authorization/model/workflow_execution.js

@@ -0,0 +1,32 @@
+/**
+ * Transcript of fga/model/agentic/workflow_execution.fga — a run with an
+ * owner of its own (the person who triggered it; `kind_meta` attribution
+ * DIRECT, unlike agent_execution's inherited owner) and two ways in for
+ * others: an explicit per-run grant, or the instance's opt-in run
+ * audience through `execution_viewer from workflow_instance`, standing on
+ * the `workflow_instance` link the derivation writes from
+ * `spec.workflow_instance_id`. No `can_delete`: run history outlives its
+ * instance by design.
+ */
+import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
+export const workflowExecutionDeclaration = declareKind({
+    kind: ApiResourceKind.workflow_execution,
+    schema: WorkflowExecutionSchema,
+    source: "fga/model/agentic/workflow_execution.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        ["workflow_instance", direct(objectOf("workflow_instance"))],
+        ["owner", direct(objectOf("identity_account"))],
+        [
+            "viewer",
+            union(direct(objectOf("identity_account")), computed("owner"), from("execution_viewer", "workflow_instance")),
+        ],
+        ["can_view", computed("viewer")],
+        ["can_edit", computed("owner")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+});
+//# sourceMappingURL=workflow_execution.js.map

package/dist/authorization/model/workflow_execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow_execution.js","sourceRoot":"","sources":["../../../src/authorization/model/workflow_execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;IACtD,IAAI,EAAE,eAAe,CAAC,kBAAkB;IACxC,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,0CAA0C;IAClD,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC5D,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAC9C;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/workflow_instance.d.ts

@@ -0,0 +1,2 @@
+export declare const workflowInstanceDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=workflow_instance.d.ts.map

package/dist/authorization/model/workflow_instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow_instance.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/workflow_instance.ts"],"names":[],"mappings":"AAwEA,eAAO,MAAM,2BAA2B,wCAiDtC,CAAC"}

package/dist/authorization/model/workflow_instance.js

@@ -0,0 +1,92 @@
+/**
+ * Transcript of fga/model/agentic/workflow_instance.fga — the agent
+ * instance's shape plus one relation of its own: `execution_viewer`, the
+ * opt-in audience for the instance's RUN history, kept apart from
+ * `viewer` so making an instance org-runnable never exposes other
+ * people's run inputs and outputs. Consumed by workflow_execution through
+ * `execution_viewer from workflow_instance`.
+ *
+ * `execution_viewer` is derived here from `spec.execution_visibility`
+ * (the second rule `kind_meta` cannot express): `organization` derives
+ * `#execution_viewer@organization:<org>#viewer` — the organization's full
+ * read audience, the shape the file's comment names and the cloud's own
+ * store test writes, with `#member` the legacy shape the line still
+ * admits — and `private` or unset derives nothing, so each run stays its
+ * triggerer's. The cloud has no writer for this tuple today; this
+ * edition enforces the field as the contract states it.
+ */
+import { isMessage } from "@bufbuild/protobuf";
+import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import { WorkflowInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
+import { WorkflowExecutionVisibility } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/spec_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { defaultOfBlueprint } from "./default-of.js";
+import { computed, declareKind, direct, from, objectOf, publicWith, union, usersetOf, } from "./rewrite.js";
+const executionViewer = (object, row) => {
+    if (!isMessage(row, WorkflowInstanceSchema)) {
+        return Promise.resolve([]);
+    }
+    const level = row.spec?.executionVisibility ?? WorkflowExecutionVisibility.unspecified;
+    switch (level) {
+        case WorkflowExecutionVisibility.organization: {
+            const org = row.metadata?.org ?? "";
+            return Promise.resolve(org === ""
+                ? []
+                : [
+                    {
+                        object,
+                        relation: "execution_viewer",
+                        subject: {
+                            form: "userset",
+                            object: { type: "organization", id: org },
+                            relation: "viewer",
+                        },
+                    },
+                ]);
+        }
+        case WorkflowExecutionVisibility.private:
+        case WorkflowExecutionVisibility.unspecified:
+            return Promise.resolve([]);
+        default: {
+            const exhaustive = level;
+            throw new Error(`unknown execution visibility: ${String(exhaustive)}`);
+        }
+    }
+};
+export const workflowInstanceDeclaration = declareKind({
+    kind: ApiResourceKind.workflow_instance,
+    schema: WorkflowInstanceSchema,
+    source: "fga/model/agentic/workflow_instance.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        ["workflow", direct(objectOf("workflow"))],
+        ["default_of", direct(objectOf("workflow"))],
+        ["owner", direct(objectOf("identity_account"))],
+        [
+            "viewer",
+            union(direct(objectOf("identity_account"), publicWith("identity_account", "allow_public"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), from("viewer", "default_of")),
+        ],
+        [
+            "execution_viewer",
+            direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer")),
+        ],
+        ["can_view", computed("viewer")],
+        ["can_execute", computed("can_view")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+    derived: [
+        [
+            "default_of",
+            defaultOfBlueprint({
+                kind: ApiResourceKind.workflow,
+                schema: WorkflowSchema,
+                defaultInstanceIdOf: (workflow) => workflow.status?.defaultInstanceId ?? "",
+            }),
+        ],
+        ["execution_viewer", executionViewer],
+    ],
+});
+//# sourceMappingURL=workflow_instance.js.map

package/dist/authorization/model/workflow_instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow_instance.js","sourceRoot":"","sources":["../../../src/authorization/model/workflow_instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,gEAAgE,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,eAAe,GAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IACvD,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GACT,GAAG,CAAC,IAAI,EAAE,mBAAmB,IAAI,2BAA2B,CAAC,WAAW,CAAC;IAC3E,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC,OAAO,CACpB,GAAG,KAAK,EAAE;gBACR,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE;wBACE,MAAM;wBACN,QAAQ,EAAE,kBAAkB;wBAC5B,OAAO,EAAE;4BACP,IAAI,EAAE,SAAS;4BACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;4BACzC,QAAQ,EAAE,QAAQ;yBACnB;qBACF;iBACF,CACN,CAAC;QACJ,CAAC;QACD,KAAK,2BAA2B,CAAC,OAAO,CAAC;QACzC,KAAK,2BAA2B,CAAC,WAAW;YAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;IACrD,IAAI,EAAE,eAAe,CAAC,iBAAiB;IACvC,MAAM,EAAE,sBAAsB;IAC9B,MAAM,EAAE,yCAAyC;IACjD,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1C,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5C,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,UAAU,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAC9C,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAC7B;SACF;QACD;YACE,kBAAkB;YAClB,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;IACD,OAAO,EAAE;QACP;YACE,YAAY;YACZ,kBAAkB,CAAC;gBACjB,IAAI,EAAE,eAAe,CAAC,QAAQ;gBAC9B,MAAM,EAAE,cAAc;gBACtB,mBAAmB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAChC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE;aAC3C,CAAC;SACH;QACD,CAAC,kBAAkB,EAAE,eAAe,CAAC;KACtC;CACF,CAAC,CAAC"}

package/dist/authorization/organization-directory.d.ts

@@ -0,0 +1,13 @@
+import type { IamPolicyStore } from "../domain/iampolicy/store.js";
+import type { OrganizationDirectory } from "../extensions/organization-directory.js";
+import type { Store } from "../store/interface.js";
+import type { Model } from "./model/index.js";
+import type { AccountsByCaller } from "./person.js";
+export interface BuiltInOrganizationDirectoryDeps {
+    readonly store: Store;
+    readonly policies: IamPolicyStore;
+    readonly accounts: AccountsByCaller;
+    readonly model?: Model;
+}
+export declare function newBuiltInOrganizationDirectory(deps: BuiltInOrganizationDirectoryDeps): OrganizationDirectory;
+//# sourceMappingURL=organization-directory.d.ts.map

package/dist/authorization/organization-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-directory.d.ts","sourceRoot":"","sources":["../../src/authorization/organization-directory.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAGrF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAID,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,gCAAgC,GACrC,qBAAqB,CA8CvB"}

package/dist/authorization/organization-directory.js

@@ -0,0 +1,83 @@
+/**
+ * The built-in organization directory — open source's driver for the
+ * organization-directory seam (extensions/organization-directory.ts),
+ * composed under the built-in posture. The cloud's directory answers
+ * `findMyOrganizations` with OpenFGA's list-objects for
+ * `organization#can_view`; this one answers the same question over the
+ * derived source: the candidates are the organizations the person's own
+ * IamPolicy rows name (on open source a person reaches an organization
+ * through a role row and nothing else — the derivation writes no
+ * organization tuple), and each candidate is kept when
+ * `can_view` holds for the person, evaluated by the same evaluator the
+ * Authorizer uses. An evaluation rather than a relation filter, so the
+ * answer stays right if the grant scope ever widens past the four roles,
+ * and stays equal to the cloud's today.
+ *
+ * `refusesEnumeration` is TRUE, the cloud's posture: `find` is
+ * skip-authorization by annotation, so under an enforcing server it would
+ * hand every member every organization row — the list that lies. The
+ * first-party clients list through `findMyOrganizations`. Trusted-local
+ * composes no directory and keeps enumerating (one caller, nothing to
+ * hide from).
+ *
+ * A caller who resolves to no account (an idp-shaped subject before
+ * provisioning) holds no rows and is answered `[]`, never a fault: the
+ * conformance sibling's readiness probe is this very RPC with a fresh
+ * subject. The `internal` class — the server acting as itself over the
+ * in-process transport — is answered `ALL_ORGANIZATIONS`: the Authorize
+ * step treats that class as the in-process authorization skip (pipeline/
+ * interceptors/auth.ts, ruling Q4), and a directory answer IS an
+ * authorization answer, so a server-internal hop sees what the permissive
+ * default showed it. `findMyOrganizations` is skip-authorization by
+ * annotation, which is why this driver meets that caller at all: a
+ * skip lane hands the directory the identity the interceptor stamped,
+ * and no Authorize arm ran before it. Every other caller gets the
+ * evaluated list. The listing context (`allow: false`) is the cloud's,
+ * though no organization line admits a wildcard.
+ * The controller loads each id it is handed and skips the ones whose row
+ * is gone (grants can outlive rows); the source has already loaded the
+ * row once for the evaluation — two primary-key reads per organization,
+ * a handful per person, and the contract's own read is the controller's.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ALL_ORGANIZATIONS } from "../extensions/organization-directory.js";
+import { kindEnumName } from "../pipeline/apiresource-meta.js";
+import { newDerivedTupleSource } from "./derived-tuples.js";
+import { checkRelation } from "./evaluator.js";
+import { builtInModel } from "./model/index.js";
+import { resolvePerson } from "./person.js";
+const ORGANIZATION = kindEnumName(ApiResourceKind.organization);
+export function newBuiltInOrganizationDirectory(deps) {
+    const model = deps.model ?? builtInModel;
+    return {
+        refusesEnumeration: true,
+        async listMyOrganizationIds(caller) {
+            if (caller.callerClass === "internal") {
+                return ALL_ORGANIZATIONS;
+            }
+            const person = await resolvePerson(deps.accounts, caller);
+            const source = newDerivedTupleSource({
+                store: deps.store,
+                policies: deps.policies,
+                accounts: deps.accounts,
+                model,
+            }, person);
+            // The candidates come from the source's ONE read of the person's
+            // rows — the same read `tuplesOf` will serve the evaluation from.
+            const candidates = new Set();
+            for (const tuple of await source.personTuples()) {
+                if (tuple.object.type === ORGANIZATION && tuple.object.id !== "") {
+                    candidates.add(tuple.object.id);
+                }
+            }
+            const visible = [];
+            for (const id of candidates) {
+                if (await checkRelation({ model, source }, { type: ORGANIZATION, id }, "can_view", person, { allow: false })) {
+                    visible.push(id);
+                }
+            }
+            return visible;
+        },
+    };
+}
+//# sourceMappingURL=organization-directory.js.map

package/dist/authorization/organization-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-directory.js","sourceRoot":"","sources":["../../src/authorization/organization-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAS5C,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAEhE,MAAM,UAAU,+BAA+B,CAC7C,IAAsC;IAEtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,OAAO;QACL,kBAAkB,EAAE,IAAI;QAExB,KAAK,CAAC,qBAAqB,CACzB,MAAsB;YAEtB,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,iBAAiB,CAAC;YAC3B,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,qBAAqB,CAClC;gBACE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK;aACN,EACD,MAAM,CACP,CAAC;YACF,iEAAiE;YACjE,kEAAkE;YAClE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,MAAM,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;gBAChD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;oBACjE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC5B,IACE,MAAM,aAAa,CACjB,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,EAC1B,UAAU,EACV,MAAM,EACN,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,EACD,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authorization/person.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The caller as the model sees them — `Person`, built ONCE here for every
+ * built-in driver (the Authorizer, the organization directory, and the
+ * list scope when it lands), so "who is asking" cannot be answered two
+ * ways.
+ *
+ * Two steps, split so the pure half is testable without a store:
+ *
+ *   `resolvePerson(accounts, caller)` — the I/O: the account the caller
+ *   stands for through `accountForCaller` (domain/identityaccount/
+ *   resolve.ts, the domain's one statement of that question — the two
+ *   reads whoAmI makes), then `personFor`.
+ *
+ *   `personFor(caller, account)` — the pure half: the account id the
+ *   IamPolicy rows name, and every string a creator stamp may carry for
+ *   the same human. A provisioned caller carries the account id and the
+ *   account's issuer subject (rows the 3.14.x verifiers stamped with the
+ *   raw `sub` still match — the alias rule); an unprovisioned one
+ *   is their identity id alone and holds no rows. Nothing else is an
+ *   alias: an email stamp is nobody's, in the membership rules and here.
+ *
+ * Refuses an identity that names no person — the empty id and the
+ * unconfigured laptop's `"system"` placeholder — with the same predicate
+ * the derivation uses to keep such stamps out of tuples (`isPersonStamp`,
+ * the membership rules'). The two guards together are what make the
+ * evaluator's alias comparison a plain set membership: no tuple side and
+ * no person side ever carries a non-person string. Under the
+ * require-authentication posture neither id reaches a check (the
+ * verifiers stamp accounts or subjects; the in-process class skips
+ * authorization; the driver's own arm denies the empty id first), so the
+ * throw is the backstop for a caller built outside those lanes, and the
+ * driver folds it to `unavailable`.
+ */
+import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import type { AccountsByCaller } from "../domain/identityaccount/resolve.js";
+import type { CallerIdentity } from "../extensions/identity.js";
+import type { Person } from "./tuples.js";
+export type { AccountsByCaller } from "../domain/identityaccount/resolve.js";
+export declare function personFor(caller: CallerIdentity, account: IdentityAccount | undefined): Person;
+/** The person a caller is, read through the account port; faults propagate as they are. */
+export declare function resolvePerson(accounts: AccountsByCaller, caller: CallerIdentity): Promise<Person>;
+//# sourceMappingURL=person.d.ts.map

package/dist/authorization/person.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"person.d.ts","sourceRoot":"","sources":["../../src/authorization/person.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAGhG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,YAAY,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,wBAAgB,SAAS,CACvB,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,eAAe,GAAG,SAAS,GACnC,MAAM,CAaR;AAED,2FAA2F;AAC3F,wBAAsB,aAAa,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,CAEjB"}

package/dist/authorization/person.js

@@ -0,0 +1,19 @@
+import { isPersonStamp } from "../domain/iampolicy/membership.js";
+import { accountForCaller } from "../domain/identityaccount/resolve.js";
+export function personFor(caller, account) {
+    const accountId = account?.metadata?.id ?? caller.identityId;
+    if (!isPersonStamp(accountId)) {
+        throw new Error(`caller '${accountId}' names no person — the built-in authorizer evaluates people only`);
+    }
+    const aliases = new Set([accountId]);
+    const subject = account?.spec?.idpId ?? "";
+    if (subject !== "") {
+        aliases.add(subject);
+    }
+    return { accountId, aliases };
+}
+/** The person a caller is, read through the account port; faults propagate as they are. */
+export async function resolvePerson(accounts, caller) {
+    return personFor(caller, await accountForCaller(accounts, caller));
+}
+//# sourceMappingURL=person.js.map

package/dist/authorization/person.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"person.js","sourceRoot":"","sources":["../../src/authorization/person.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAMxE,MAAM,UAAU,SAAS,CACvB,MAAsB,EACtB,OAAoC;IAEpC,MAAM,SAAS,GAAG,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC;IAC7D,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,mEAAmE,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IAC3C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAA0B,EAC1B,MAAsB;IAEtB,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/authorization/posture.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The authorization posture — WHICH authorizer a composed server runs,
+ * named once so the composition root, the boot log and the tests speak
+ * one word for it. Three postures, decided by two facts the registry and
+ * the config already hold:
+ *
+ *   - `unit-authorizer`: a unit registered its own Authorizer (the cloud
+ *     composes OpenFGA). Nothing built in is installed — not the
+ *     authorizer, not the directory, not the fire caller, and not the
+ *     role lifecycle or the membership rules either (a composition with
+ *     its own Authorizer has its own onboarding). The require-
+ *     authentication posture does not change this.
+ *   - `built-in`: no unit Authorizer AND the require-authentication
+ *     posture (the OSS OIDC issuer, or a unit's declaration). Open source
+ *     composes the built-in Authorizer, the organization directory and
+ *     the schedule fire caller — the cloud's model evaluated over derived
+ *     tuples — so the roles 2b records are enforced.
+ *   - `trusted-local`: no unit Authorizer and no authentication posture —
+ *     the laptop. The permissive default stays: one caller, nothing to
+ *     separate; the trusted-local identity carries the operator's EMAIL,
+ *     never an account id, and pre-2a rows are stamped `"system"`, so an
+ *     enforcing evaluator would refuse the laptop's own history. The roles
+ *     still exist (the lifecycle and the membership rules run) to feed the
+ *     Members page truthfully.
+ *
+ * The type lives with the module that gives it meaning (the precedent:
+ * `ConsoleSignInPosture` in transport/console/handler.ts); the
+ * composition root computes the value once and hands it down.
+ */
+export type AuthorizationPosture = "trusted-local" | "built-in" | "unit-authorizer";
+export interface AuthorizationPostureInputs {
+    /** A unit registered `authorizer` (ResolvedExtensions.authorizer !== undefined). */
+    readonly unitAuthorizer: boolean;
+    /** The require-authentication posture is on (the OIDC issuer or a unit's declaration). */
+    readonly requireAuthentication: boolean;
+}
+export declare function authorizationPostureOf(inputs: AuthorizationPostureInputs): AuthorizationPosture;
+//# sourceMappingURL=posture.d.ts.map

package/dist/authorization/posture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"posture.d.ts","sourceRoot":"","sources":["../../src/authorization/posture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,oBAAoB,GAC5B,eAAe,GACf,UAAU,GACV,iBAAiB,CAAC;AAEtB,MAAM,WAAW,0BAA0B;IACzC,oFAAoF;IACpF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;CACzC;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,0BAA0B,GACjC,oBAAoB,CAKtB"}

package/dist/authorization/posture.js

@@ -0,0 +1,7 @@
+export function authorizationPostureOf(inputs) {
+    if (inputs.unitAuthorizer) {
+        return "unit-authorizer";
+    }
+    return inputs.requireAuthentication ? "built-in" : "trusted-local";
+}
+//# sourceMappingURL=posture.js.map

package/dist/authorization/posture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"posture.js","sourceRoot":"","sources":["../../src/authorization/posture.ts"],"names":[],"mappings":"AAyCA,MAAM,UAAU,sBAAsB,CACpC,MAAkC;IAElC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC;AACrE,CAAC"}

package/dist/authorization/schedule-fire-caller.d.ts

@@ -0,0 +1,12 @@
+import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
+import type { ScheduleFireCallerMint } from "../extensions/schedule-fire-caller.js";
+import type { Store } from "../store/interface.js";
+export interface BuiltInScheduleFireCallerDeps {
+    readonly store: Store;
+    /** The account port: the stamp is resolved as an account id, then as a direct subject. */
+    readonly accounts: Pick<IdentityAccountStore, "findById" | "findDirectByIdpId">;
+}
+/** The refusal's copy — written for the person who scheduled the run (the schedule's status carries it). */
+export declare function scheduleHasNoPersonMessage(scheduleId: string): string;
+export declare function newBuiltInScheduleFireCaller(deps: BuiltInScheduleFireCallerDeps): ScheduleFireCallerMint;
+//# sourceMappingURL=schedule-fire-caller.d.ts.map

package/dist/authorization/schedule-fire-caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule-fire-caller.d.ts","sourceRoot":"","sources":["../../src/authorization/schedule-fire-caller.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAGpF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,0FAA0F;IAC1F,QAAQ,CAAC,QAAQ,EAAE,IAAI,CACrB,oBAAoB,EACpB,UAAU,GAAG,mBAAmB,CACjC,CAAC;CACH;AAED,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,6BAA6B,GAClC,sBAAsB,CAuBxB"}

package/dist/authorization/schedule-fire-caller.js

@@ -0,0 +1,67 @@
+/**
+ * The built-in schedule fire caller — a fire acts as the schedule's
+ * CREATOR. Open source's driver for the scheduleFireCaller seam
+ * (extensions/schedule-fire-caller.ts), composed under the built-in
+ * authorization posture.
+ *
+ * Why the creator: with no driver a fire enters the create pipeline as
+ * the `internal` class carrying the operator's email or `"system"`, and
+ * under an enforcing authorizer the fired session belongs to nobody the
+ * model recognizes — the person who scheduled it cannot see it, the
+ * operator cannot, the runner cannot report on it. The creator is the
+ * one person the schedule row names, and the person the runner will act
+ * as once its own lane lands. The run and its auto-created session are
+ * stamped with their account, so their `owner` derives, and the create
+ * runs the full chain as them: a creator who has since lost `can_execute`
+ * on the agent is refused by the launch gate, which the RunStarter already
+ * counts against the schedule.
+ *
+ * Recorded difference from the cloud: there the schedule's org admins and
+ * grantees also see the run, through the session#schedule tuple; here
+ * only the creator does, because deriving that link from the
+ * client-suppliable schedule-id label is what the cloud explicitly
+ * refused.
+ *
+ * The creator's account is resolved from the row's stamp two ways — as an
+ * account id (rows stamped since 3.15.0) and as the raw issuer subject
+ * (rows the 3.14.x verifiers stamped) — through the account port, the
+ * same two shapes `Person` aliases. A stamp that resolves to no account
+ * is the seam's DETERMINISTIC refusal (`ScheduleFireCallerRefusedError`):
+ * the empty stamp, the laptop's `"system"`, an email from the
+ * trusted-local era, a deleted account — no retry will make that schedule
+ * anyone's, so the RunStarter pauses it with this message rather than
+ * failing every tick. A missing schedule row or a store fault is an
+ * infrastructure throw, as for every other mint.
+ *
+ * The identity is `accountAsCaller(account)` (domain/identityaccount/
+ * actor.ts, the one construction of an account acting as itself): a
+ * `user` with no issuer and no token — open source reads no fire-scoped
+ * claims downstream, and the propagation lane stamps `origin:
+ * "in-process"` on it.
+ */
+import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { accountAsCaller } from "../domain/identityaccount/actor.js";
+import { ScheduleFireCallerRefusedError } from "../extensions/schedule-fire-caller.js";
+import { auditOf } from "../pipeline/steps/defaults.js";
+/** The refusal's copy — written for the person who scheduled the run (the schedule's status carries it). */
+export function scheduleHasNoPersonMessage(scheduleId) {
+    return `schedule ${scheduleId} was created by nobody this server recognizes as a person; recreate it while signed in`;
+}
+export function newBuiltInScheduleFireCaller(deps) {
+    return {
+        async mintFireCaller(_org, scheduleId) {
+            const schedule = await deps.store.getResource(ApiResourceKind.schedule, scheduleId, ScheduleSchema);
+            const stamp = auditOf(ScheduleSchema, schedule)?.specAudit?.createdBy?.id ?? "";
+            const account = stamp === ""
+                ? undefined
+                : ((await deps.accounts.findById(stamp)) ??
+                    (await deps.accounts.findDirectByIdpId(stamp)));
+            if (account === undefined) {
+                throw new ScheduleFireCallerRefusedError(scheduleHasNoPersonMessage(scheduleId));
+            }
+            return accountAsCaller(account);
+        },
+    };
+}
+//# sourceMappingURL=schedule-fire-caller.js.map

package/dist/authorization/schedule-fire-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule-fire-caller.js","sourceRoot":"","sources":["../../src/authorization/schedule-fire-caller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAGrE,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAYxD,4GAA4G;AAC5G,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,OAAO,YAAY,UAAU,wFAAwF,CAAC;AACxH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,IAAmC;IAEnC,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU;YACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAC3C,eAAe,CAAC,QAAQ,EACxB,UAAU,EACV,cAAc,CACf,CAAC;YACF,MAAM,KAAK,GACT,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;YACpE,MAAM,OAAO,GACX,KAAK,KAAK,EAAE;gBACV,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBACtC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,8BAA8B,CACtC,0BAA0B,CAAC,UAAU,CAAC,CACvC,CAAC;YACJ,CAAC;YACD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authorization/store-test-kit.d.ts

@@ -0,0 +1,68 @@
+import type { Model } from "./model/index.js";
+import type { CheckContext } from "./tuples.js";
+export interface StoreTestTuple {
+    readonly user: string;
+    readonly relation: string;
+    readonly object: string;
+    readonly condition?: {
+        readonly name: string;
+    };
+}
+export interface StoreTestCheck {
+    readonly user: string;
+    readonly object: string;
+    readonly context?: CheckContext;
+    readonly assertions: Readonly<Record<string, boolean>>;
+}
+export interface StoreTestListObjects {
+    readonly user: string;
+    readonly type: string;
+    readonly context?: CheckContext;
+    readonly assertions: Readonly<Record<string, ReadonlyArray<string>>>;
+}
+export interface StoreTest {
+    readonly name: string;
+    readonly check: ReadonlyArray<StoreTestCheck>;
+    readonly list_objects: ReadonlyArray<StoreTestListObjects>;
+}
+export interface StoreTestDocument {
+    readonly name: string;
+    readonly tuples: ReadonlyArray<StoreTestTuple>;
+    readonly tests: ReadonlyArray<StoreTest>;
+}
+/**
+ * Parses a loaded YAML value into a document, refusing anything the
+ * format the cloud's files use does not carry (`sourceName` names the
+ * file in every message).
+ */
+export declare function parseStoreTestDocument(value: unknown, sourceName: string): StoreTestDocument;
+export interface StoreTestCase {
+    /** `<document> :: <test name>` — the framework prints it as the test name. */
+    readonly name: string;
+    run(): Promise<void>;
+}
+export type StoreTestSkipReason = "undeclared-kind" | "list-objects" | "undeclared-subject-type";
+/** One assertion (or assertion group) the kit did not run, in the document's words. */
+export interface StoreTestSkip {
+    readonly document: string;
+    readonly test: string;
+    readonly subject: string;
+    /** The check's object, or `<type>` for a list_objects assertion. */
+    readonly object: string;
+    /** The one relation, for a skip decided per assertion; absent for a group. */
+    readonly relation?: string;
+    readonly reason: StoreTestSkipReason;
+    /** For `undeclared-subject-type`: the types the walk read that the model does not declare, sorted. */
+    readonly types?: ReadonlyArray<string>;
+}
+export interface StoreTestKit {
+    readonly cases: ReadonlyArray<StoreTestCase>;
+    /** Complete once every case has run (the module header). */
+    readonly skipped: ReadonlyArray<StoreTestSkip>;
+}
+/**
+ * The document's tests as runnable cases over `model`, plus every
+ * assertion group the kit does not run.
+ */
+export declare function storeTestCases(document: StoreTestDocument, model: Model): StoreTestKit;
+//# sourceMappingURL=store-test-kit.d.ts.map

package/dist/authorization/store-test-kit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-test-kit.d.ts","sourceRoot":"","sources":["../../src/authorization/store-test-kit.ts"],"names":[],"mappings":"AAuDA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EACV,YAAY,EAKb,MAAM,aAAa,CAAC;AAYrB,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,MAAM,GACjB,iBAAiB,CAgBnB;AAyID,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,mBAAmB,GAC3B,iBAAiB,GACjB,cAAc,GACd,yBAAyB,CAAC;AAE9B,uFAAuF;AACvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,sGAAsG;IACtG,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC7C,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAChD;AAKD;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,KAAK,GACX,YAAY,CAwEd"}