@stigmer/server 3.15.3-dev.20260914121148 → 3.15.3-dev.20260916211208

package/dist/authorization/authorizer.d.ts

@@ -0,0 +1,98 @@
+/**
+ * The built-in Authorizer — open source's driver for the one
+ * authorization decision seam (extensions/authorizer.ts), composed under
+ * the built-in posture (posture.ts): the cloud's model evaluated over the
+ * tuples this row would have had, derived on the fly (evaluator.ts over
+ * derived-tuples.ts). Every arm below mirrors the cloud's driver
+ * (stigmer-cloud src/authorizer/fga-authorizer.ts) by name and copy, so
+ * the two editions answer one question the same way and the drift test
+ * can pin the arms and not only the model.
+ *
+ * The arms, in order:
+ *   1. The cloud's four pre-checks with the Java service's copy, each a
+ *      `deny` with the reason: an unspecified permission, an empty
+ *      identity, an empty resource id, the unknown kind. No wire caller
+ *      reaches the unknown kind since the kind refusals landed; the
+ *      arm is the backstop, not a path.
+ *   2. A kind this edition does not serve is `deny` (`kindServedByEdition`,
+ *      the predicate 2b's `checkMyPermission` arm 1 uses, so the console
+ *      and the server agree by construction). `platform` is the one that
+ *      arrives, through `can_set_public_visibility` — under the built-in
+ *      posture nobody sets public visibility, the model's own reason for
+ *      making it a platform operator's act.
+ *   3. The caller as a person (person.ts) and one derived tuple source for
+ *      them; the target loaded ONCE through the source's memoised loader,
+ *      so the read that decides not-found is the read the derivation
+ *      uses.
+ *   4. A missing target is `not-found` — the Authorize step answers the
+ *      load-first chain's NOT_FOUND (stigmer#224) — EXCEPT for the kinds
+ *      the cloud never probes (NOT_FOUND_EXEMPT_KINDS): there a missing
+ *      row is evaluated like any other and denies, so an authenticated
+ *      member cannot learn which account ids exist. Present or exempt, the
+ *      row is then evaluated: the cloud asks OpenFGA whether or not the row
+ *      exists, and so does this driver.
+ *   5. `checkRelation` with the point-check context (`allow: true`: a
+ *      public resource reads for any authenticated caller, the cloud's
+ *      posture). True is `allow`; false is `deny` with an EMPTY reason, so
+ *      the method annotation's byte-pinned `error_msg` wins on the wire,
+ *      exactly the cloud's genuine-denial path.
+ *
+ * Faults. Everything past the pre-checks runs under one guard: a store
+ * fault, a person that names nobody (`personFor`), an evaluation fault
+ * (a cycle, the depth bound, an undeclared target — a registry gap the
+ * edition pin makes unreachable) all answer `unavailable` with the cause,
+ * which the Authorize step maps to INTERNAL. A denial is never a softened
+ * outage and an outage is never a denial; the driver itself never throws.
+ *
+ * Logging. One debug line per deny and per not-found, naming the person's
+ * account id, the permission and the object — what an operator needs to
+ * answer "why can Alice not see this" — and never the token. Allows are
+ * silent; they are the common case.
+ *
+ * Cost, per check (measured at slice 4): the target row (1), the caller's
+ * account (1 primary-key read; 2 for a caller a composition verifier left
+ * idp-shaped), the person's IamPolicy rows (1 scan of the port, once per
+ * source), and one row per parent hop the model walks.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
+import type { Logger } from "../boot/logger.js";
+import type { IamPolicyStore } from "../domain/iampolicy/store.js";
+import type { Authorizer } from "../extensions/authorizer.js";
+import type { Store } from "../store/interface.js";
+import type { Model } from "./model/index.js";
+import type { AccountsByCaller } from "./person.js";
+/**
+ * Kinds whose missing row is a denial, never `not-found` (arm 4): the
+ * cloud's `PROBE_EXEMPT_KINDS` restricted to the kinds this edition
+ * serves — `platform`, `identity_provider`, `platform_client` and
+ * `invitation` are refused by arm 2 before any row is asked about. The
+ * cloud's drift test pins the two sets equal over the open-source tier.
+ *
+ * `iam_policy` is reachable as a target through the IamPolicy RPCs' own
+ * `resource.kind` (a caller may name it); the grant scope refuses such a
+ * target after the Authorize step in both editions, and the arm here
+ * keeps the wire the same on the way there.
+ */
+export declare const NOT_FOUND_EXEMPT_KINDS: ReadonlySet<ApiResourceKind>;
+/** The Java RequestAuthorizationService's pre-check copy, byte for byte (the cloud renders the same). */
+export declare const UNKNOWN_PERMISSION_DENY_REASON = "authorization cannot be performed with unknown permission";
+export declare const EMPTY_IDENTITY_DENY_REASON = "authorization cannot be performed on empty identity string";
+export declare const EMPTY_RESOURCE_ID_DENY_REASON = "authorization cannot be performed on empty api-resource-id";
+export declare const UNKNOWN_KIND_DENY_REASON = "authorization cannot be performed on unknown api-resource-kind";
+/** This edition's own arm; the cloud has no unserved kind to deny. */
+export declare const UNSERVED_KIND_DENY_REASON = "authorization cannot be performed on a kind this edition does not serve";
+export interface BuiltInAuthorizerDeps {
+    readonly store: Store;
+    /** The port the grant path writes through — the person's rows are read from the same instance. */
+    readonly policies: IamPolicyStore;
+    /** The account port: the caller's account, and identity_account targets. */
+    readonly accounts: AccountsByCaller;
+    /** The served edition (`extensions.edition`); the built-in posture pins it to `oss` at boot. */
+    readonly edition: ServerEdition;
+    readonly logger: Logger;
+    /** The declarations to evaluate; the built-in model unless a test says otherwise. */
+    readonly model?: Model;
+}
+export declare function newBuiltInAuthorizer(deps: BuiltInAuthorizerDeps): Authorizer;
+//# sourceMappingURL=authorizer.d.ts.map

package/dist/authorization/authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,UAAU,EAGX,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAKpD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,eAAe,CAG9D,CAAC;AAEH,yGAAyG;AACzG,eAAO,MAAM,8BAA8B,8DACkB,CAAC;AAC9D,eAAO,MAAM,0BAA0B,+DACuB,CAAC;AAC/D,eAAO,MAAM,6BAA6B,+DACoB,CAAC;AAC/D,eAAO,MAAM,wBAAwB,mEAC6B,CAAC;AACnE,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,4EACqC,CAAC;AAE5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,UAAU,CA8E5E"}

package/dist/authorization/authorizer.js

@@ -0,0 +1,156 @@
+/**
+ * The built-in Authorizer — open source's driver for the one
+ * authorization decision seam (extensions/authorizer.ts), composed under
+ * the built-in posture (posture.ts): the cloud's model evaluated over the
+ * tuples this row would have had, derived on the fly (evaluator.ts over
+ * derived-tuples.ts). Every arm below mirrors the cloud's driver
+ * (stigmer-cloud src/authorizer/fga-authorizer.ts) by name and copy, so
+ * the two editions answer one question the same way and the drift test
+ * can pin the arms and not only the model.
+ *
+ * The arms, in order:
+ *   1. The cloud's four pre-checks with the Java service's copy, each a
+ *      `deny` with the reason: an unspecified permission, an empty
+ *      identity, an empty resource id, the unknown kind. No wire caller
+ *      reaches the unknown kind since the kind refusals landed; the
+ *      arm is the backstop, not a path.
+ *   2. A kind this edition does not serve is `deny` (`kindServedByEdition`,
+ *      the predicate 2b's `checkMyPermission` arm 1 uses, so the console
+ *      and the server agree by construction). `platform` is the one that
+ *      arrives, through `can_set_public_visibility` — under the built-in
+ *      posture nobody sets public visibility, the model's own reason for
+ *      making it a platform operator's act.
+ *   3. The caller as a person (person.ts) and one derived tuple source for
+ *      them; the target loaded ONCE through the source's memoised loader,
+ *      so the read that decides not-found is the read the derivation
+ *      uses.
+ *   4. A missing target is `not-found` — the Authorize step answers the
+ *      load-first chain's NOT_FOUND (stigmer#224) — EXCEPT for the kinds
+ *      the cloud never probes (NOT_FOUND_EXEMPT_KINDS): there a missing
+ *      row is evaluated like any other and denies, so an authenticated
+ *      member cannot learn which account ids exist. Present or exempt, the
+ *      row is then evaluated: the cloud asks OpenFGA whether or not the row
+ *      exists, and so does this driver.
+ *   5. `checkRelation` with the point-check context (`allow: true`: a
+ *      public resource reads for any authenticated caller, the cloud's
+ *      posture). True is `allow`; false is `deny` with an EMPTY reason, so
+ *      the method annotation's byte-pinned `error_msg` wins on the wire,
+ *      exactly the cloud's genuine-denial path.
+ *
+ * Faults. Everything past the pre-checks runs under one guard: a store
+ * fault, a person that names nobody (`personFor`), an evaluation fault
+ * (a cycle, the depth bound, an undeclared target — a registry gap the
+ * edition pin makes unreachable) all answer `unavailable` with the cause,
+ * which the Authorize step maps to INTERNAL. A denial is never a softened
+ * outage and an outage is never a denial; the driver itself never throws.
+ *
+ * Logging. One debug line per deny and per not-found, naming the person's
+ * account id, the permission and the object — what an operator needs to
+ * answer "why can Alice not see this" — and never the token. Allows are
+ * silent; they are the common case.
+ *
+ * Cost, per check (measured at slice 4): the target row (1), the caller's
+ * account (1 primary-key read; 2 for a caller a composition verifier left
+ * idp-shaped), the person's IamPolicy rows (1 scan of the port, once per
+ * source), and one row per parent hop the model walks.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import { kindEnumName, kindServedByEdition, } from "../pipeline/apiresource-meta.js";
+import { newDerivedTupleSource } from "./derived-tuples.js";
+import { checkRelation } from "./evaluator.js";
+import { builtInModel } from "./model/index.js";
+import { resolvePerson } from "./person.js";
+import { formatObjectRef } from "./tuples.js";
+/**
+ * Kinds whose missing row is a denial, never `not-found` (arm 4): the
+ * cloud's `PROBE_EXEMPT_KINDS` restricted to the kinds this edition
+ * serves — `platform`, `identity_provider`, `platform_client` and
+ * `invitation` are refused by arm 2 before any row is asked about. The
+ * cloud's drift test pins the two sets equal over the open-source tier.
+ *
+ * `iam_policy` is reachable as a target through the IamPolicy RPCs' own
+ * `resource.kind` (a caller may name it); the grant scope refuses such a
+ * target after the Authorize step in both editions, and the arm here
+ * keeps the wire the same on the way there.
+ */
+export const NOT_FOUND_EXEMPT_KINDS = new Set([
+    ApiResourceKind.identity_account,
+    ApiResourceKind.iam_policy,
+]);
+/** The Java RequestAuthorizationService's pre-check copy, byte for byte (the cloud renders the same). */
+export const UNKNOWN_PERMISSION_DENY_REASON = "authorization cannot be performed with unknown permission";
+export const EMPTY_IDENTITY_DENY_REASON = "authorization cannot be performed on empty identity string";
+export const EMPTY_RESOURCE_ID_DENY_REASON = "authorization cannot be performed on empty api-resource-id";
+export const UNKNOWN_KIND_DENY_REASON = "authorization cannot be performed on unknown api-resource-kind";
+/** This edition's own arm; the cloud has no unserved kind to deny. */
+export const UNSERVED_KIND_DENY_REASON = "authorization cannot be performed on a kind this edition does not serve";
+export function newBuiltInAuthorizer(deps) {
+    const model = deps.model ?? builtInModel;
+    return {
+        async authorize(caller, check) {
+            if (check.permission === IamPermission.unspecified) {
+                return deny(UNKNOWN_PERMISSION_DENY_REASON);
+            }
+            if (caller.identityId === "") {
+                return deny(EMPTY_IDENTITY_DENY_REASON);
+            }
+            if (check.resourceId === "") {
+                return deny(EMPTY_RESOURCE_ID_DENY_REASON);
+            }
+            if (check.resourceKind === ApiResourceKind.api_resource_kind_unknown) {
+                return deny(UNKNOWN_KIND_DENY_REASON);
+            }
+            if (!kindServedByEdition(check.resourceKind, deps.edition)) {
+                return deny(UNSERVED_KIND_DENY_REASON);
+            }
+            const object = {
+                type: kindEnumName(check.resourceKind),
+                id: check.resourceId,
+            };
+            const relation = IamPermission[check.permission];
+            try {
+                const person = await resolvePerson(deps.accounts, caller);
+                const source = newDerivedTupleSource({
+                    store: deps.store,
+                    policies: deps.policies,
+                    accounts: deps.accounts,
+                    model,
+                }, person);
+                const row = await source.loader.load(object);
+                if (row === undefined &&
+                    !NOT_FOUND_EXEMPT_KINDS.has(check.resourceKind)) {
+                    deps.logger.debug("authorization target not found", {
+                        account: person.accountId,
+                        permission: relation,
+                        object: formatObjectRef(object),
+                    });
+                    return { kind: "not-found" };
+                }
+                const allowed = await checkRelation({ model, source }, object, relation, person, { allow: true });
+                if (allowed) {
+                    return { kind: "allow" };
+                }
+                deps.logger.debug("authorization denied", {
+                    account: person.accountId,
+                    permission: relation,
+                    object: formatObjectRef(object),
+                });
+                // Empty on purpose: the Authorize step then surfaces the method
+                // annotation's byte-pinned error_msg (or its fallback copy), the
+                // cloud's genuine-denial path.
+                return deny("");
+            }
+            catch (error) {
+                return {
+                    kind: "unavailable",
+                    cause: error instanceof Error ? error : new Error(String(error)),
+                };
+            }
+        },
+    };
+}
+function deny(reason) {
+    return { kind: "deny", reason };
+}
+//# sourceMappingURL=authorizer.js.map

package/dist/authorization/authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAW1E,OAAO,EACL,YAAY,EACZ,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,IAAI,GAAG,CAAC;IAC1E,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,UAAU;CAC3B,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,CAAC,MAAM,8BAA8B,GACzC,2DAA2D,CAAC;AAC9D,MAAM,CAAC,MAAM,0BAA0B,GACrC,4DAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GACxC,4DAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GACnC,gEAAgE,CAAC;AACnE,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GACpC,yEAAyE,CAAC;AAe5E,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,OAAO;QACL,KAAK,CAAC,SAAS,CACb,MAAsB,EACtB,KAAiB;YAEjB,IAAI,KAAK,CAAC,UAAU,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACzC,CAAC;YAED,MAAM,MAAM,GAAc;gBACxB,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC;gBACtC,EAAE,EAAE,KAAK,CAAC,UAAU;aACrB,CAAC;YACF,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,qBAAqB,CAClC;oBACE,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK;iBACN,EACD,MAAM,CACP,CAAC;gBACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC7C,IACE,GAAG,KAAK,SAAS;oBACjB,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAC/C,CAAC;oBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;wBAClD,OAAO,EAAE,MAAM,CAAC,SAAS;wBACzB,UAAU,EAAE,QAAQ;wBACpB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;qBAChC,CAAC,CAAC;oBACH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;gBAC/B,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,MAAM,EACN,QAAQ,EACR,MAAM,EACN,EAAE,KAAK,EAAE,IAAI,EAAE,CAChB,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC3B,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;oBACxC,OAAO,EAAE,MAAM,CAAC,SAAS;oBACzB,UAAU,EAAE,QAAQ;oBACpB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;iBAChC,CAAC,CAAC;gBACH,gEAAgE;gBAChE,iEAAiE;gBACjE,+BAA+B;gBAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,IAAI,EAAE,aAAa;oBACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;iBACjE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/authorization/derived-tuples.d.ts

@@ -0,0 +1,42 @@
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { IamPolicyStore } from "../domain/iampolicy/store.js";
+import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
+import type { Store } from "../store/interface.js";
+import type { RowFacts } from "./facts.js";
+import type { Model } from "./model/index.js";
+import type { Person, RowLoader, Tuple, TupleSource } from "./tuples.js";
+/**
+ * Kinds whose `[identity_account]` owner is recorded as an IamPolicy row
+ * by this edition (the module header): the derivation writes no owner
+ * tuple for them. Mirrors role-lifecycle.ts's create arm, which writes
+ * the row for `organization` and nothing else.
+ */
+export declare const ROW_RECORDED_OWNER_KINDS: ReadonlySet<ApiResourceKind>;
+/** The tuples a row stands for, in the cloud driver's shapes and order. */
+export declare function deriveTuples(facts: RowFacts): ReadonlyArray<Tuple>;
+export interface DerivedTupleSourceDeps {
+    readonly store: Store;
+    /** The port the grant path writes through — the rows are read from the same instance. */
+    readonly policies: IamPolicyStore;
+    /** The account port — an `identity_account` object is read through it, never the generic Store (the module header). */
+    readonly accounts: Pick<IdentityAccountStore, "findById">;
+    /** The declarations to derive with; the built-in model unless a test says otherwise. */
+    readonly model?: Model;
+}
+export interface DerivedTupleSource extends TupleSource {
+    /** The memoised row reads, exposed for a declaration's `derived` rules and for tests. */
+    readonly loader: RowLoader;
+    /**
+     * The person's own IamPolicy rows as tuples — the ONE read of them this
+     * source makes, shared with `tuplesOf`. A list-shaped consumer (the
+     * organization directory; the list scope) reads its candidate objects
+     * from here instead of scanning the port a second time.
+     */
+    personTuples(): Promise<ReadonlyArray<Tuple>>;
+}
+export interface DerivedTupleSourceSeed {
+    /** Objects whose facts the caller already holds; their rows are not read for derivation. */
+    readonly facts: ReadonlyArray<RowFacts>;
+}
+export declare function newDerivedTupleSource(deps: DerivedTupleSourceDeps, person: Person, seed?: DerivedTupleSourceSeed): DerivedTupleSource;
+//# sourceMappingURL=derived-tuples.d.ts.map

package/dist/authorization/derived-tuples.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-tuples.d.ts","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"AAiEA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAQ/E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAEV,MAAM,EACN,SAAS,EAET,KAAK,EACL,WAAW,EACZ,MAAM,aAAa,CAAC;AAOrB;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,eAAe,CAEhE,CAAC;AAMH,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,KAAK,EAAE,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAuDlE;AAoCD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,uHAAuH;IACvH,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAC1D,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,sBAAsB,GAC5B,kBAAkB,CAoFpB"}

package/dist/authorization/derived-tuples.js

@@ -0,0 +1,240 @@
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { OwnerAttributionType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
+import { isPersonStamp } from "../domain/iampolicy/membership.js";
+import { getKindMeta, kindByEnumName, kindEnumName, } from "../pipeline/apiresource-meta.js";
+import { visibilityShapesFor } from "../pipeline/steps/authorization-tuples.js";
+import { ResourceNotFoundError } from "../store/interface.js";
+import { rowFactsOf } from "./facts.js";
+import { builtInModel } from "./model/index.js";
+import { ACCOUNT_TYPE, ALLOW_PUBLIC_CONDITION, formatObjectRef, } from "./tuples.js";
+/**
+ * Kinds whose `[identity_account]` owner is recorded as an IamPolicy row
+ * by this edition (the module header): the derivation writes no owner
+ * tuple for them. Mirrors role-lifecycle.ts's create arm, which writes
+ * the row for `organization` and nothing else.
+ */
+export const ROW_RECORDED_OWNER_KINDS = new Set([
+    ApiResourceKind.organization,
+]);
+function account(id) {
+    return { form: "object", object: { type: ACCOUNT_TYPE, id } };
+}
+/** The tuples a row stands for, in the cloud driver's shapes and order. */
+export function deriveTuples(facts) {
+    const object = { type: kindEnumName(facts.kind), id: facts.id };
+    const config = getKindMeta(facts.kind).authorization;
+    if (config === undefined) {
+        return [];
+    }
+    const tuples = [];
+    for (const link of facts.parentLinks) {
+        tuples.push({
+            object,
+            relation: link.relation,
+            subject: {
+                form: "object",
+                object: { type: kindEnumName(link.parentKind), id: link.parentId },
+            },
+        });
+    }
+    const stampIsPerson = isPersonStamp(facts.createdBy);
+    switch (config.ownerType) {
+        case OwnerAttributionType.DIRECT:
+            if (stampIsPerson && !ROW_RECORDED_OWNER_KINDS.has(facts.kind)) {
+                tuples.push({
+                    object,
+                    relation: "owner",
+                    subject: account(facts.createdBy),
+                });
+            }
+            break;
+        case OwnerAttributionType.SELF:
+            tuples.push({ object, relation: "owner", subject: account(facts.id) });
+            break;
+        case OwnerAttributionType.INHERITED:
+        case OwnerAttributionType.NONE:
+        case OwnerAttributionType.UNSPECIFIED:
+            // Inherited: the model walks `owner from <parent>`; none: the kind has no owner.
+            break;
+        default: {
+            const exhaustive = config.ownerType;
+            throw new Error(`unknown owner attribution: ${String(exhaustive)}`);
+        }
+    }
+    if (config.requiresCreatorTuple && stampIsPerson) {
+        tuples.push({
+            object,
+            relation: "creator",
+            subject: account(facts.createdBy),
+        });
+    }
+    for (const shape of visibilityShapesFor(facts.kind, facts.visibility)) {
+        const subject = visibilitySubject(shape, facts.org);
+        if (subject !== undefined) {
+            tuples.push({ object, relation: "viewer", subject });
+        }
+    }
+    return tuples;
+}
+/** The driver's grant table for a visibility shape; undefined where this edition writes nothing. */
+function visibilitySubject(shape, org) {
+    switch (shape) {
+        case "org-viewer":
+            // No organization to point at (a legacy row): no userset.
+            return org === ""
+                ? undefined
+                : {
+                    form: "userset",
+                    object: { type: "organization", id: org },
+                    relation: "viewer",
+                };
+        case "public-viewer":
+            return {
+                form: "wildcard",
+                type: ACCOUNT_TYPE,
+                condition: ALLOW_PUBLIC_CONDITION,
+            };
+        case "platform-viewer":
+            return undefined;
+        default: {
+            const exhaustive = shape;
+            throw new Error(`unknown visibility shape: ${String(exhaustive)}`);
+        }
+    }
+}
+export function newDerivedTupleSource(deps, person, seed) {
+    const model = deps.model ?? builtInModel;
+    const rows = new Map();
+    const derived = new Map();
+    const seeded = new Map();
+    for (const facts of seed?.facts ?? []) {
+        seeded.set(formatObjectRef({ type: kindEnumName(facts.kind), id: facts.id }), facts);
+    }
+    let personRows;
+    const loader = {
+        load(object) {
+            const key = formatObjectRef(object);
+            const held = rows.get(key);
+            if (held !== undefined) {
+                return held;
+            }
+            const loading = loadRow(deps, model, object);
+            rows.set(key, loading);
+            return loading;
+        },
+    };
+    function derivedTuplesOf(object) {
+        const key = formatObjectRef(object);
+        const held = derived.get(key);
+        if (held !== undefined) {
+            return held;
+        }
+        const declaration = model.byType(object.type);
+        const known = seeded.get(key);
+        let deriving;
+        if (declaration === undefined) {
+            deriving = Promise.resolve([]);
+        }
+        else if (known !== undefined) {
+            deriving = Promise.resolve(deriveTuples(known));
+        }
+        else {
+            deriving = loader
+                .load(object)
+                .then((row) => row === undefined
+                ? []
+                : deriveTuples(rowFactsOf(declaration.kind, row)));
+        }
+        derived.set(key, deriving);
+        return deriving;
+    }
+    function rowTuples() {
+        if (personRows === undefined) {
+            personRows = deps.policies
+                .findByPrincipal(ACCOUNT_TYPE, person.accountId)
+                .then((found) => found.map(tupleOfRow));
+        }
+        return personRows;
+    }
+    return {
+        loader,
+        personTuples: rowTuples,
+        async tuplesOf(object, relation) {
+            const onPair = (tuple) => tuple.relation === relation &&
+                tuple.object.type === object.type &&
+                tuple.object.id === object.id;
+            const fromRows = (await rowTuples()).filter(onPair);
+            const declaration = model.byType(object.type);
+            if (declaration === undefined) {
+                return fromRows;
+            }
+            const fromRow = (await derivedTuplesOf(object)).filter(onPair);
+            const rule = declaration.derived.get(relation);
+            if (rule === undefined) {
+                return [...fromRows, ...fromRow];
+            }
+            const row = await loader.load(object);
+            const fromRule = row === undefined ? [] : await rule(object, row, loader);
+            return [...fromRows, ...fromRow, ...fromRule];
+        },
+    };
+}
+/** The decoded row for an object, or undefined when the kind is not declared or the row does not exist. */
+async function loadRow(deps, model, object) {
+    const declaration = model.byType(object.type);
+    const kind = kindByEnumName(object.type);
+    if (declaration === undefined ||
+        kind === ApiResourceKind.api_resource_kind_unknown ||
+        object.id === "") {
+        return undefined;
+    }
+    if (kind === ApiResourceKind.identity_account) {
+        return deps.accounts.findById(object.id);
+    }
+    try {
+        return await deps.store.getResource(kind, object.id, declaration.schema);
+    }
+    catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+            return undefined;
+        }
+        throw error;
+    }
+}
+/** An IamPolicy row as the tuple it records: `resource#relation@principal`. */
+function tupleOfRow(row) {
+    const spec = row.spec;
+    const principal = spec?.principal;
+    const resource = spec?.resource;
+    const object = {
+        type: resource?.kind ?? "",
+        id: resource?.id ?? "",
+    };
+    const principalObject = {
+        type: principal?.kind ?? "",
+        id: principal?.id ?? "",
+    };
+    let subject;
+    if (principal !== undefined && principal.relation !== "") {
+        subject = {
+            form: "userset",
+            object: principalObject,
+            relation: principal.relation,
+        };
+    }
+    else if (principalObject.id === "*") {
+        // A wildcard row carries no condition of its own; the evaluator
+        // honours it only where a line admits an unconditioned wildcard,
+        // which no line in the model does.
+        subject = {
+            form: "wildcard",
+            type: principalObject.type,
+            condition: undefined,
+        };
+    }
+    else {
+        subject = { form: "object", object: principalObject };
+    }
+    return { object, relation: spec?.relation ?? "", subject };
+}
+//# sourceMappingURL=derived-tuples.js.map

package/dist/authorization/derived-tuples.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-tuples.js","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"AAiEA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AAG9H,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAIlE,OAAO,EACL,WAAW,EACX,cAAc,EACd,YAAY,GACb,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAEhF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAShD,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAiC,IAAI,GAAG,CAAC;IAC5E,eAAe,CAAC,YAAY;CAC7B,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,EAAU;IACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,KAAe;IAC1C,MAAM,MAAM,GAAc,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IACrD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE;aACnE;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,oBAAoB,CAAC,MAAM;YAC9B,IAAI,aAAa,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,MAAM,CAAC,IAAI,CAAC;oBACV,MAAM;oBACN,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,oBAAoB,CAAC,IAAI;YAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,MAAM;QACR,KAAK,oBAAoB,CAAC,SAAS,CAAC;QACpC,KAAK,oBAAoB,CAAC,IAAI,CAAC;QAC/B,KAAK,oBAAoB,CAAC,WAAW;YACnC,iFAAiF;YACjF,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC,SAAS,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM;YACN,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oGAAoG;AACpG,SAAS,iBAAiB,CACxB,KAA2B,EAC3B,GAAW;IAEX,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,YAAY;YACf,0DAA0D;YAC1D,OAAO,GAAG,KAAK,EAAE;gBACf,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;oBACzC,QAAQ,EAAE,QAAQ;iBACnB,CAAC;QACR,KAAK,eAAe;YAClB,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,YAAY;gBAClB,SAAS,EAAE,sBAAsB;aAClC,CAAC;QACJ,KAAK,iBAAiB;YACpB,OAAO,SAAS,CAAC;QACnB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAiCD,MAAM,UAAU,qBAAqB,CACnC,IAA4B,EAC5B,MAAc,EACd,IAA6B;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CACR,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EACjE,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,UAAqD,CAAC;IAE1D,MAAM,MAAM,GAAc;QACxB,IAAI,CAAC,MAAM;YACT,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IAEF,SAAS,eAAe,CAAC,MAAiB;QACxC,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,QAAuC,CAAC;QAC5C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM;iBACd,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,KAAK,SAAS;gBACf,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CACpD,CAAC;QACN,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS,SAAS;QAChB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,UAAU,GAAG,IAAI,CAAC,QAAQ;iBACvB,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC;iBAC/C,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO;QACL,MAAM;QACN,YAAY,EAAE,SAAS;QACvB,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ;YAC7B,MAAM,MAAM,GAAG,CAAC,KAAY,EAAW,EAAE,CACvC,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAC3B,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBACjC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,KAAK,UAAU,OAAO,CACpB,IAAwD,EACxD,KAAY,EACZ,MAAiB;IAEjB,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,IACE,WAAW,KAAK,SAAS;QACzB,IAAI,KAAK,eAAe,CAAC,yBAAyB;QAClD,MAAM,CAAC,EAAE,KAAK,EAAE,EAChB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,GAAc;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;IAChC,MAAM,MAAM,GAAc;QACxB,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE;QAC1B,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;KACvB,CAAC;IACF,MAAM,eAAe,GAAc;QACjC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE;QAC3B,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;KACxB,CAAC;IACF,IAAI,OAAgB,CAAC;IACrB,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACzD,OAAO,GAAG;YACR,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,SAAS,CAAC,QAAQ;SAC7B,CAAC;IACJ,CAAC;SAAM,IAAI,eAAe,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;QACtC,gEAAgE;QAChE,iEAAiE;QACjE,mCAAmC;QACnC,OAAO,GAAG;YACR,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,SAAS,EAAE,SAAS;SACrB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC"}

package/dist/authorization/evaluator.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The evaluator — OpenFGA's check, over the built-in model and a tuple
+ * source, small because the model uses four rewrite forms and nothing
+ * else (model/rewrite.ts). `checkRelation(object, relation, person, context)`
+ * answers "does this person hold this relation on this object" the way
+ * the cloud's engine answers it over stored tuples, so the two editions
+ * share one meaning of authorization.
+ *
+ * The walk, in the order a `.fga` line reads:
+ *   - `this`: the tuples on (object, relation). A tuple counts only if
+ *     its subject's TYPE is in the line's restriction list — the check
+ *     OpenFGA makes at write time, made here at read time, so a derived
+ *     tuple the model no longer admits denies instead of allowing. An
+ *     object subject matches when it names one of the person's aliases;
+ *     a userset subject is resolved on its own object; the wildcard is
+ *     honoured only under its condition (`allow_public` reads the
+ *     context's `allow`; an unknown condition is a fault).
+ *   - `computed`: the same object, another relation.
+ *   - `from`: every object the tupleset relation links to (again within
+ *     the tupleset line's type restriction), resolved for the relation.
+ *   - `union`: the first true member wins; members are tried in the
+ *     line's order, so the cheap arms the model lists first (the person's
+ *     own owner tuple) are read before the hops.
+ *
+ * Bounds and faults. Every (object, relation) pair is resolved once per
+ * check (the memo — a diamond such as `owner` reached through `viewer`
+ * and through `can_edit` reads the source once). A pair re-entered while
+ * it is being resolved is a cycle in the declarations, which is a bug,
+ * and a resolution deeper than MAX_RESOLUTION_DEPTH is the same class of
+ * bug; both throw, because the alternative — a quiet `false` — would turn
+ * a broken transcript into a lockout nobody can see. A kind the model does
+ * not declare is a fault as the check's TARGET (the driver refuses
+ * unserved kinds before evaluation, so reaching here is a registry gap)
+ * and simply an object with no relations when reached through a tuple
+ * (`identity_provider#platform_user`, which no open-source tuple names).
+ * A relation the kind does not declare is `false` — the ruled answer for
+ * a wire question the model has no line for, where OpenFGA
+ * itself answers a validation error.
+ *
+ * The evaluator does no I/O of its own and knows no store: the source
+ * owns every read, and a fault it raises propagates through untouched,
+ * so the driver above can fold it into `unavailable` and never into a
+ * denial.
+ */
+import type { Model } from "./model/index.js";
+import type { CheckContext, ObjectRef, Person, TupleSource } from "./tuples.js";
+/**
+ * OpenFGA's default resolution-depth limit (its `resolveNodeLimit`), so
+ * the bound here is the oracle's own and not a number chosen locally. The
+ * deepest real chain in the model is under ten: an instance's `viewer
+ * from default_of` to its blueprint, the blueprint's `admin from
+ * organization`, then the organization's four-rung ladder.
+ */
+export declare const MAX_RESOLUTION_DEPTH = 25;
+export type EvaluationFault = "undeclared-target-kind" | "resolution-depth-exceeded" | "resolution-cycle" | "unknown-condition";
+/** A fault in the model or its evaluation — never a denial; the driver maps it to `unavailable`. */
+export declare class AuthorizationEvaluationError extends Error {
+    readonly reason: EvaluationFault;
+    constructor(reason: EvaluationFault, message: string);
+}
+export interface EvaluationDeps {
+    readonly model: Model;
+    readonly source: TupleSource;
+}
+export declare function checkRelation(deps: EvaluationDeps, object: ObjectRef, relation: string, person: Person, context: CheckContext): Promise<boolean>;
+//# sourceMappingURL=evaluator.d.ts.map

package/dist/authorization/evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/authorization/evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,MAAM,EAEN,WAAW,EACZ,MAAM,aAAa,CAAC;AAQrB;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,MAAM,MAAM,eAAe,GACvB,wBAAwB,GACxB,2BAA2B,GAC3B,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,oGAAoG;AACpG,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;gBAErB,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM;CAKrD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,OAAO,CAAC,CAQlB"}