@stigmer/server 3.15.3-dev.20260914121148 → 3.15.3-dev.20260916211208

package/dist/authorization/store-test-kit.js

@@ -0,0 +1,311 @@
+/**
+ * The OpenFGA store-test kit — runs a `.fga.yaml` store test (the format
+ * `fga model test` reads: fixture tuples, then named tests with `check`
+ * and `list_objects` assertions) against the built-in evaluator, so the
+ * cloud's own model tests — written by the model's authors and run
+ * against real OpenFGA in the cloud's CI — are the proof that this
+ * evaluator answers the same model the same way. Open source runs the
+ * kit over pinned copies of those documents (authorization/__tests__/
+ * fixtures/fga/); the cloud runs it over the LIVE documents at the
+ * re-pin, which is what makes the copies safe to hold.
+ *
+ * Shape: the port-contract kits' (store/port-contract.ts) — vitest-free,
+ * node:assert, cases the consumer's framework iterates — because a
+ * composition consumes it through the published barrel and vitest is a
+ * devDependency that must not enter the barrel's runtime graph.
+ *
+ * What is run and what is reported. One case per named test; a case
+ * asserts every `check` in the test whose object's kind the model
+ * declares, relation by relation, and FAILS on the first disagreement
+ * (the message names the check in the document's own words). Assertions
+ * the kit does not run are returned as `skipped`, each with its reason,
+ * so a consumer pins the list and a document that gains a scenario, or a
+ * declaration that lands, is a visible diff and never a quietly smaller
+ * proof. Three reasons: a check whose TARGET kind the model does not
+ * declare (`undeclared-kind`) and every `list_objects` assertion
+ * (`list-objects`, the list scope's proof) are known when the kit is
+ * built; the third is known only from the walk. A document may grant
+ * through a type the model does not declare — the cloud's platform
+ * tenancy reaches people through `identity_provider:<idp>#platform_user`,
+ * a kind this edition does not serve — and OpenFGA answers `true` where
+ * a model without that type resolves the userset to nobody. The kit runs
+ * every assertion over a recording view of the document's tuples, and an
+ * assertion whose walk READ a tuple naming an undeclared type is
+ * reported as `undeclared-subject-type` (the types named) instead of
+ * being asserted, whatever it would have answered: decided from the
+ * model and the data, per assertion, so the sibling arms of the same
+ * check block still run and a union that is settled before it reaches
+ * such a tuple runs too. Over a model that declares every type in the
+ * file (the cloud's drift test, built from the live model) nothing is
+ * recorded and everything runs — the same kit, no edition branch.
+ * `skipped` is therefore complete once every case has run; a consumer
+ * pins it after the cases, which is the order a test file declares them.
+ *
+ * Context. A check's `context.allow` is the `allow_public` parameter
+ * (tuples.ts). A check without a context runs with `allow: false`, the
+ * listing posture: OpenFGA itself would fault on a conditional tuple it
+ * reached with the parameter missing, so the cloud's documents never do
+ * that — their CI would already fail — and the choice cannot change an
+ * answer the oracle gives. The parser is strict on purpose: an unknown
+ * key anywhere is a thrown fault, so a change to the format upstream is
+ * loud here rather than half-run.
+ */
+import assert from "node:assert/strict";
+import { checkRelation } from "./evaluator.js";
+import { ACCOUNT_TYPE, newInMemoryTupleSource, parseObjectRef, parseSubject, } from "./tuples.js";
+/**
+ * Parses a loaded YAML value into a document, refusing anything the
+ * format the cloud's files use does not carry (`sourceName` names the
+ * file in every message).
+ */
+export function parseStoreTestDocument(value, sourceName) {
+    const root = record(value, sourceName, [
+        "name",
+        "model_file",
+        "tuples",
+        "tests",
+    ]);
+    return {
+        name: text(root["name"], `${sourceName}: name`),
+        tuples: list(root["tuples"], `${sourceName}: tuples`).map((entry, index) => parseTuple(entry, `${sourceName}: tuples[${index}]`)),
+        tests: list(root["tests"], `${sourceName}: tests`).map((entry, index) => parseTest(entry, `${sourceName}: tests[${index}]`)),
+    };
+}
+function parseTuple(value, where) {
+    const entry = record(value, where, [
+        "user",
+        "relation",
+        "object",
+        "condition",
+    ]);
+    const tuple = {
+        user: text(entry["user"], `${where}.user`),
+        relation: text(entry["relation"], `${where}.relation`),
+        object: text(entry["object"], `${where}.object`),
+    };
+    if (entry["condition"] === undefined) {
+        return tuple;
+    }
+    const condition = record(entry["condition"], `${where}.condition`, [
+        "name",
+        "context",
+    ]);
+    return {
+        ...tuple,
+        condition: { name: text(condition["name"], `${where}.condition.name`) },
+    };
+}
+function parseTest(value, where) {
+    const entry = record(value, where, ["name", "check", "list_objects"]);
+    return {
+        name: text(entry["name"], `${where}.name`),
+        check: optionalList(entry["check"], `${where}.check`).map((item, index) => parseCheck(item, `${where}.check[${index}]`)),
+        list_objects: optionalList(entry["list_objects"], `${where}.list_objects`).map((item, index) => parseListObjects(item, `${where}.list_objects[${index}]`)),
+    };
+}
+function parseCheck(value, where) {
+    const entry = record(value, where, [
+        "user",
+        "object",
+        "context",
+        "assertions",
+    ]);
+    const assertions = record(entry["assertions"], `${where}.assertions`);
+    const parsed = {};
+    for (const [relation, expected] of Object.entries(assertions)) {
+        if (typeof expected !== "boolean") {
+            throw new Error(`${where}.assertions.${relation}: expected a boolean`);
+        }
+        parsed[relation] = expected;
+    }
+    const context = parseContext(entry["context"], `${where}.context`);
+    return {
+        user: text(entry["user"], `${where}.user`),
+        object: text(entry["object"], `${where}.object`),
+        ...(context === undefined ? {} : { context }),
+        assertions: parsed,
+    };
+}
+function parseListObjects(value, where) {
+    const entry = record(value, where, ["user", "type", "context", "assertions"]);
+    const assertions = record(entry["assertions"], `${where}.assertions`);
+    const parsed = {};
+    for (const [relation, expected] of Object.entries(assertions)) {
+        parsed[relation] = list(expected, `${where}.assertions.${relation}`).map((item, index) => text(item, `${where}.assertions.${relation}[${index}]`));
+    }
+    const context = parseContext(entry["context"], `${where}.context`);
+    return {
+        user: text(entry["user"], `${where}.user`),
+        type: text(entry["type"], `${where}.type`),
+        ...(context === undefined ? {} : { context }),
+        assertions: parsed,
+    };
+}
+function parseContext(value, where) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const entry = record(value, where, ["allow"]);
+    if (typeof entry["allow"] !== "boolean") {
+        throw new Error(`${where}.allow: expected a boolean`);
+    }
+    return { allow: entry["allow"] };
+}
+function record(value, where, allowedKeys) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error(`${where}: expected a mapping`);
+    }
+    const entry = value;
+    if (allowedKeys !== undefined) {
+        for (const key of Object.keys(entry)) {
+            if (!allowedKeys.includes(key)) {
+                throw new Error(`${where}: unknown key '${key}'`);
+            }
+        }
+    }
+    return entry;
+}
+function list(value, where) {
+    if (!Array.isArray(value)) {
+        throw new Error(`${where}: expected a list`);
+    }
+    return value;
+}
+function optionalList(value, where) {
+    return value === undefined ? [] : list(value, where);
+}
+function text(value, where) {
+    if (typeof value !== "string") {
+        throw new Error(`${where}: expected a string`);
+    }
+    return value;
+}
+/** The listing posture, for a check the document leaves without a context (the module header). */
+const CONTEXT_WHEN_ABSENT = { allow: false };
+/**
+ * The document's tests as runnable cases over `model`, plus every
+ * assertion group the kit does not run.
+ */
+export function storeTestCases(document, model) {
+    const source = newInMemoryTupleSource(document.tuples.map(tupleOf));
+    const skipped = [];
+    const cases = [];
+    for (const test of document.tests) {
+        const runnable = [];
+        for (const item of test.check) {
+            const object = parseObjectRef(item.object);
+            if (model.byType(object.type) === undefined) {
+                skipped.push({
+                    document: document.name,
+                    test: test.name,
+                    subject: item.user,
+                    object: item.object,
+                    reason: "undeclared-kind",
+                });
+            }
+            else {
+                runnable.push(item);
+            }
+        }
+        for (const item of test.list_objects) {
+            skipped.push({
+                document: document.name,
+                test: test.name,
+                subject: item.user,
+                object: `<${item.type}>`,
+                reason: "list-objects",
+            });
+        }
+        if (runnable.length === 0) {
+            continue;
+        }
+        cases.push({
+            name: `${document.name} :: ${test.name}`,
+            async run() {
+                for (const item of runnable) {
+                    const object = parseObjectRef(item.object);
+                    const person = personOf(item.user);
+                    const context = item.context ?? CONTEXT_WHEN_ABSENT;
+                    for (const [relation, expected] of Object.entries(item.assertions)) {
+                        const recording = recordUndeclaredTypes(source, model);
+                        const actual = await checkRelation({ model, source: recording }, object, relation, person, context);
+                        if (recording.reached.size > 0) {
+                            skipped.push({
+                                document: document.name,
+                                test: test.name,
+                                subject: item.user,
+                                object: item.object,
+                                relation,
+                                reason: "undeclared-subject-type",
+                                types: [...recording.reached].sort(),
+                            });
+                            continue;
+                        }
+                        assert.equal(actual, expected, `${document.name} :: ${test.name}: ${item.user} ${relation} ${item.object} (allow: ${String(context.allow)}) expected ${String(expected)}, got ${String(actual)}`);
+                    }
+                }
+            },
+        });
+    }
+    return { cases, skipped };
+}
+/**
+ * A view of `inner` that records, for one walk, every subject type the
+ * evaluator read that `model` does not declare. A person
+ * (`identity_account:<id>`, the wildcard) is a subject the evaluator
+ * compares, never a type it resolves, so it is not a "reach" whatever
+ * the model declares; a userset or a parent object of an undeclared
+ * type is.
+ */
+function recordUndeclaredTypes(inner, model) {
+    const reached = new Set();
+    return {
+        reached,
+        async tuplesOf(object, relation) {
+            const tuples = await inner.tuplesOf(object, relation);
+            for (const tuple of tuples) {
+                const type = resolvedTypeOf(tuple.subject);
+                if (type !== undefined && model.byType(type) === undefined) {
+                    reached.add(type);
+                }
+            }
+            return tuples;
+        },
+    };
+}
+/** The type the evaluator would resolve a subject on, or undefined for a person. */
+function resolvedTypeOf(subject) {
+    switch (subject.form) {
+        case "object":
+            return subject.object.type === ACCOUNT_TYPE
+                ? undefined
+                : subject.object.type;
+        case "userset":
+            return subject.object.type;
+        case "wildcard":
+            return undefined;
+        default: {
+            const exhaustive = subject;
+            throw new Error(`unknown subject form: ${JSON.stringify(exhaustive)}`);
+        }
+    }
+}
+function tupleOf(entry) {
+    const subject = parseSubject(entry.user);
+    return {
+        object: parseObjectRef(entry.object),
+        relation: entry.relation,
+        subject: subject.form === "wildcard" && entry.condition !== undefined
+            ? { ...subject, condition: entry.condition.name }
+            : subject,
+    };
+}
+/** The document's users are plain accounts; a user of another type is a format the kit does not run. */
+function personOf(user) {
+    const object = parseObjectRef(user);
+    if (object.type !== ACCOUNT_TYPE || object.id === "*") {
+        throw new Error(`store test users are accounts; got '${user}'`);
+    }
+    return { accountId: object.id, aliases: new Set([object.id]) };
+}
+//# sourceMappingURL=store-test-kit.js.map

package/dist/authorization/store-test-kit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-test-kit.js","sourceRoot":"","sources":["../../src/authorization/store-test-kit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAS/C,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC;AAuCrB;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAc,EACd,UAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE;QACrC,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,OAAO;KACR,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,QAAQ,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,UAAU,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACzE,UAAU,CAAC,KAAK,EAAE,GAAG,UAAU,YAAY,KAAK,GAAG,CAAC,CACrD;QACD,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACtE,SAAS,CAAC,KAAK,EAAE,GAAG,UAAU,WAAW,KAAK,GAAG,CAAC,CACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE;QACjC,MAAM;QACN,UAAU;QACV,QAAQ;QACR,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,KAAK,GAAmB;QAC5B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,WAAW,CAAC;QACtD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,SAAS,CAAC;KACjD,CAAC;IACF,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,YAAY,EAAE;QACjE,MAAM;QACN,SAAS;KACV,CAAC,CAAC;IACH,OAAO;QACL,GAAG,KAAK;QACR,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,iBAAiB,CAAC,EAAE;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IACtE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxE,UAAU,CAAC,IAAI,EAAE,GAAG,KAAK,UAAU,KAAK,GAAG,CAAC,CAC7C;QACD,YAAY,EAAE,YAAY,CACxB,KAAK,CAAC,cAAc,CAAC,EACrB,GAAG,KAAK,eAAe,CACxB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,gBAAgB,CAAC,IAAI,EAAE,GAAG,KAAK,iBAAiB,KAAK,GAAG,CAAC,CAC1D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE;QACjC,MAAM;QACN,QAAQ;QACR,SAAS;QACT,YAAY;KACb,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;IACtE,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,eAAe,QAAQ,sBAAsB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;IAC9B,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,SAAS,CAAC;QAChD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;IACtE,MAAM,MAAM,GAA0C,EAAE,CAAC;IACzD,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,KAAK,eAAe,QAAQ,EAAE,CAAC,CAAC,GAAG,CACtE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,eAAe,QAAQ,IAAI,KAAK,GAAG,CAAC,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,MAAM,CACb,KAAc,EACd,KAAa,EACb,WAAmC;IAEnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,GAAG,GAAG,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAA+B,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAqCD,kGAAkG;AAClG,MAAM,mBAAmB,GAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAE3D;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA2B,EAC3B,KAAY;IAEZ,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAoB,EAAE,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,MAAM,EAAE,iBAAiB;iBAC1B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG;gBACxB,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE;YACxC,KAAK,CAAC,GAAG;gBACP,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,mBAAmB,CAAC;oBACpD,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;wBACnE,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;wBACvD,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAC5B,MAAM,EACN,QAAQ,EACR,MAAM,EACN,OAAO,CACR,CAAC;wBACF,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;4BAC/B,OAAO,CAAC,IAAI,CAAC;gCACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;gCACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,OAAO,EAAE,IAAI,CAAC,IAAI;gCAClB,MAAM,EAAE,IAAI,CAAC,MAAM;gCACnB,QAAQ;gCACR,MAAM,EAAE,yBAAyB;gCACjC,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;6BACrC,CAAC,CAAC;4BACH,SAAS;wBACX,CAAC;wBACD,MAAM,CAAC,KAAK,CACV,MAAM,EACN,QAAQ,EACR,GAAG,QAAQ,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,MAAM,CAAC,QAAQ,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,EAAE,CAClK,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAOD;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAC5B,KAAkB,EAClB,KAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO;QACL,OAAO;QACP,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ;YAC7B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC3D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,OAAgB;IACtC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,KAAK,SAAS;YACZ,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7B,KAAK,UAAU;YACb,OAAO,SAAS,CAAC;QACnB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAqB;IACpC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EACL,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAC1D,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE;YACjD,CAAC,CAAC,OAAO;KACd,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/dist/authorization/tuples.d.ts

@@ -0,0 +1,115 @@
+/**
+ * The tuple vocabulary of the built-in authorizer — the OpenFGA notions
+ * the cloud's model is written in (object, relation, subject; a subject
+ * being an object, a userset `type:id#relation`, or the public wildcard
+ * `type:*` under a condition), typed once so the evaluator, the
+ * derivation and the store-test kit speak one language. Nothing here is
+ * stored: open source derives every tuple from a row (derived-tuples.ts)
+ * or reads it from an IamPolicy row, and this module only names what a
+ * tuple IS.
+ *
+ * `Person` is the caller as the evaluator sees them: the account id the
+ * IamPolicy rows name, and every string a creator stamp may carry for the
+ * same human — the account id and the account's issuer subject (rows the
+ * 3.14.x verifiers stamped with the raw `sub`). A tuple naming
+ * `identity_account:<x>` matches the person when `x` is one of the
+ * aliases; rows are read by the account id alone, because every row open
+ * source writes names an account (domain/iampolicy/role-lifecycle.ts).
+ * The type is named here; the construction (`personFor`, `resolvePerson`)
+ * is person.ts's, so this module stays vocabulary with no I/O.
+ *
+ * `CheckContext` is the FGA condition context. The one condition the
+ * model declares is `allow_public(allow: bool)` on the public wildcard,
+ * and the cloud's own posture (stigmer-cloud authorizer/fga-authorizer.ts,
+ * the Java BuildCheckRequest) is `allow: true` on a point check — a public
+ * resource reads for any authenticated caller — and `allow: false` in a
+ * listing, which keeps a public wildcard from flooding an organization's
+ * catalog. The parameter is required so a caller states which posture it
+ * is in; there is no default because either one is wrong for the other.
+ *
+ * The string forms (`agent:x`, `organization:acme#viewer`,
+ * `identity_account:*`) are the notation the cloud's store tests and the
+ * IamPolicy proto both use; parse and format are here so the kit and the
+ * tests never spell them a second way.
+ */
+import type { Message } from "@bufbuild/protobuf";
+/** The FGA type name of the kind every person is: `identity_account:<id>`. */
+export declare const ACCOUNT_TYPE = "identity_account";
+/** The one condition the model declares; it guards the public wildcard. */
+export declare const ALLOW_PUBLIC_CONDITION = "allow_public";
+/** `type:id` — an object of the model. */
+export interface ObjectRef {
+    readonly type: string;
+    readonly id: string;
+}
+/** The subject (the FGA "user") of a tuple. */
+export type Subject = 
+/** `type:id` — an object, including a person as `identity_account:<id>`. */
+{
+    readonly form: "object";
+    readonly object: ObjectRef;
+}
+/** `type:id#relation` — everyone who holds `relation` on the object. */
+ | {
+    readonly form: "userset";
+    readonly object: ObjectRef;
+    readonly relation: string;
+}
+/** `type:*` — every object of the type, honoured only when its condition holds. */
+ | {
+    readonly form: "wildcard";
+    readonly type: string;
+    readonly condition: string | undefined;
+};
+export interface Tuple {
+    readonly object: ObjectRef;
+    readonly relation: string;
+    readonly subject: Subject;
+}
+/**
+ * Where the evaluator reads tuples from: every tuple on `object` with
+ * `relation`. A source MAY return only the tuples that can concern the
+ * person it was built for (the product source reads the person's own
+ * rows; a fixture source knows no person and returns them all) — the
+ * evaluator is correct over either, because a tuple whose subject is
+ * another person is never a match. It MUST NOT omit a userset or an
+ * object subject on the pair, which is how the person may be reached
+ * indirectly. Faults propagate; "absent" is the empty array.
+ */
+export interface TupleSource {
+    tuplesOf(object: ObjectRef, relation: string): Promise<ReadonlyArray<Tuple>>;
+}
+/** A declaration's derived-relation rule reads related rows through this (default_of needs the blueprint). */
+export interface RowLoader {
+    /** The decoded row, or undefined when there is none or the kind is not declared. */
+    load(object: ObjectRef): Promise<Message | undefined>;
+}
+/** The caller as the model sees them. */
+export interface Person {
+    /** The id the IamPolicy rows name. */
+    readonly accountId: string;
+    /** Every string a creator stamp may carry for this person; always contains `accountId`. */
+    readonly aliases: ReadonlySet<string>;
+}
+/** The condition parameters of a check (the module header). */
+export interface CheckContext {
+    readonly allow: boolean;
+}
+/** `type:id` → ObjectRef; the id may itself contain `:` (issuer subjects do). */
+export declare function parseObjectRef(text: string): ObjectRef;
+export declare function formatObjectRef(object: ObjectRef): string;
+/**
+ * `type:id`, `type:id#relation` or `type:*` → Subject. A wildcard parsed
+ * from text carries no condition; the caller attaches one when its source
+ * says so (the store tests carry it on the tuple, the derivation attaches
+ * the model's).
+ */
+export declare function parseSubject(text: string): Subject;
+export declare function formatSubject(subject: Subject): string;
+/** `object#relation@subject` — the IamPolicy proto's own tuple notation. */
+export declare function formatTuple(tuple: Tuple): string;
+/** The memo and fixture key of an (object, relation) pair. */
+export declare function pairKey(object: ObjectRef, relation: string): string;
+/** A source over a fixed tuple list — the store-test kit's and the unit tests' fixture. */
+export declare function newInMemoryTupleSource(tuples: ReadonlyArray<Tuple>): TupleSource;
+//# sourceMappingURL=tuples.d.ts.map

package/dist/authorization/tuples.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tuples.d.ts","sourceRoot":"","sources":["../../src/authorization/tuples.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,8EAA8E;AAC9E,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAE/C,2EAA2E;AAC3E,eAAO,MAAM,sBAAsB,iBAAiB,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,+CAA+C;AAC/C,MAAM,MAAM,OAAO;AACjB,4EAA4E;AAC1E;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE;AACzD,wEAAwE;GACtE;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AACH,mFAAmF;GACjF;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC,CAAC;AAEN,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;CAC9E;AAED,8GAA8G;AAC9G,MAAM,WAAW,SAAS;IACxB,oFAAoF;IACpF,IAAI,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CACvD;AAED,yCAAyC;AACzC,MAAM,WAAW,MAAM;IACrB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACvC;AAED,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAMD,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAMtD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAclD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAetD;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAEhD;AAED,8DAA8D;AAC9D,wBAAgB,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,2FAA2F;AAC3F,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,GAC3B,WAAW,CAgBb"}

package/dist/authorization/tuples.js

@@ -0,0 +1,83 @@
+/** The FGA type name of the kind every person is: `identity_account:<id>`. */
+export const ACCOUNT_TYPE = "identity_account";
+/** The one condition the model declares; it guards the public wildcard. */
+export const ALLOW_PUBLIC_CONDITION = "allow_public";
+// ---------------------------------------------------------------------------
+// The string notation.
+// ---------------------------------------------------------------------------
+/** `type:id` → ObjectRef; the id may itself contain `:` (issuer subjects do). */
+export function parseObjectRef(text) {
+    const colon = text.indexOf(":");
+    if (colon <= 0) {
+        throw new Error(`not an object reference: '${text}'`);
+    }
+    return { type: text.slice(0, colon), id: text.slice(colon + 1) };
+}
+export function formatObjectRef(object) {
+    return `${object.type}:${object.id}`;
+}
+/**
+ * `type:id`, `type:id#relation` or `type:*` → Subject. A wildcard parsed
+ * from text carries no condition; the caller attaches one when its source
+ * says so (the store tests carry it on the tuple, the derivation attaches
+ * the model's).
+ */
+export function parseSubject(text) {
+    const hash = text.indexOf("#");
+    if (hash > 0) {
+        return {
+            form: "userset",
+            object: parseObjectRef(text.slice(0, hash)),
+            relation: text.slice(hash + 1),
+        };
+    }
+    const object = parseObjectRef(text);
+    if (object.id === "*") {
+        return { form: "wildcard", type: object.type, condition: undefined };
+    }
+    return { form: "object", object };
+}
+export function formatSubject(subject) {
+    switch (subject.form) {
+        case "object":
+            return formatObjectRef(subject.object);
+        case "userset":
+            return `${formatObjectRef(subject.object)}#${subject.relation}`;
+        case "wildcard":
+            return subject.condition === undefined
+                ? `${subject.type}:*`
+                : `${subject.type}:* with ${subject.condition}`;
+        default: {
+            const exhaustive = subject;
+            throw new Error(`unknown subject form: ${JSON.stringify(exhaustive)}`);
+        }
+    }
+}
+/** `object#relation@subject` — the IamPolicy proto's own tuple notation. */
+export function formatTuple(tuple) {
+    return `${formatObjectRef(tuple.object)}#${tuple.relation}@${formatSubject(tuple.subject)}`;
+}
+/** The memo and fixture key of an (object, relation) pair. */
+export function pairKey(object, relation) {
+    return `${formatObjectRef(object)}#${relation}`;
+}
+/** A source over a fixed tuple list — the store-test kit's and the unit tests' fixture. */
+export function newInMemoryTupleSource(tuples) {
+    const byPair = new Map();
+    for (const tuple of tuples) {
+        const key = pairKey(tuple.object, tuple.relation);
+        const held = byPair.get(key);
+        if (held === undefined) {
+            byPair.set(key, [tuple]);
+        }
+        else {
+            held.push(tuple);
+        }
+    }
+    return {
+        tuplesOf(object, relation) {
+            return Promise.resolve(byPair.get(pairKey(object, relation)) ?? []);
+        },
+    };
+}
+//# sourceMappingURL=tuples.js.map

package/dist/authorization/tuples.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tuples.js","sourceRoot":"","sources":["../../src/authorization/tuples.ts"],"names":[],"mappings":"AAoCA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAE/C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAgErD,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC3C,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;SAC/B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,SAAS;YACZ,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClE,KAAK,UAAU;YACb,OAAO,OAAO,CAAC,SAAS,KAAK,SAAS;gBACpC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI;gBACrB,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,WAAW,OAAO,CAAC,SAAS,EAAE,CAAC;QACpD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,KAAY;IACtC,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,OAAO,CAAC,MAAiB,EAAE,QAAgB;IACzD,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CACpC,MAA4B;IAE5B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ,CAAC,MAAM,EAAE,QAAQ;YACvB,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/boot/compose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/boot/compose.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAgBpE,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAIzE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAmCzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AA6BlE,OAAO,EAKL,aAAa,EAEd,MAAM,6BAA6B,CAAC;AAqBrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAWjE,OAAO,EAAE,YAAY,IAAI,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAW7G,OAAO,EAAE,WAAW,EAAyB,MAAM,wBAAwB,CAAC;AAQ5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,WAAW,CAAC;IACzB,+EAA+E;IAC/E,KAAK,EAAE,KAAK,CAAC;IACb;;;;;;;;;OASG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,eAAe,EAAE,eAAe,CAAC;IACjC;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;;OAIG;IACH,0BAA0B,EAAE,YAAY,CAAC;IACzC;;;;;OAKG;IACH,6BAA6B,EAAE,6BAA6B,CAAC;IAC7D;;;;;;;;;OASG;IACH,kBAAkB,EAAE,SAAS,CAAC;IAC9B;;;;;;;;OAQG;IACH,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD;;;;;OAKG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IACxC,+EAA+E;IAC/E,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,kEAAkE;IAClE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5C,gEAAgE;IAChE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAwuCzB"}
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/boot/compose.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AA0BpE,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAC;AAIzE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAmCzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAgClE,OAAO,EAKL,aAAa,EAEd,MAAM,6BAA6B,CAAC;AAqBrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAWjE,OAAO,EAAE,YAAY,IAAI,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAW7G,OAAO,EAAE,WAAW,EAAyB,MAAM,wBAAwB,CAAC;AAQ5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,WAAW,CAAC;IACzB,+EAA+E;IAC/E,KAAK,EAAE,KAAK,CAAC;IACb;;;;;;;;;OASG;IACH,OAAO,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,eAAe,EAAE,eAAe,CAAC;IACjC;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;;OAIG;IACH,0BAA0B,EAAE,YAAY,CAAC;IACzC;;;;;OAKG;IACH,6BAA6B,EAAE,6BAA6B,CAAC;IAC7D;;;;;;;;;OASG;IACH,kBAAkB,EAAE,SAAS,CAAC;IAC9B;;;;;;;;OAQG;IACH,iBAAiB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACnD;;;;;OAKG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;IACxC,+EAA+E;IAC/E,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,kEAAkE;IAClE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC5C,gEAAgE;IAChE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAo2CzB"}