@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/dist/extensions/resource-authorization.d.ts

@@ -55,6 +55,7 @@
  */
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { OwnerAttributionType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
+import type { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import type { IamPolicy } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
 import type { IamPolicySpec } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/spec_pb";
 import type { CallerIdentity } from "./identity.js";
@@ -83,6 +84,38 @@ export interface ResolvedParentLink {
     /** The parent object's resource id. */
     readonly parentId: string;
 }
+/**
+ * The facts a stored row carries that its authorization tuples derive
+ * from — the row-side vocabulary of `kind_meta.authorization`, read back
+ * from a row rather than resolved at its create. The lifecycle derives a
+ * `ResourceCreatedEvent` from the same facts on the way in; a list lane
+ * offers them on every candidate (`ListEntryMeta`, list-read-scope.ts);
+ * the built-in authorizer derives a loaded row's tuples from them. One
+ * shape, read by one structural resolver
+ * (pipeline/steps/authorization-facts.ts), so a driver that evaluates the
+ * model over a candidate needs no second read of the row.
+ *
+ * Read-side facts are lenient where the create-time resolution is strict:
+ * a legacy row that names no organization or no parent carries none (an
+ * empty `org`, a link absent from `parentLinks`) and a stamp that names
+ * nobody is the empty string — a fact about the row, never a fault of the
+ * read.
+ */
+export interface RowAuthorizationFacts {
+    readonly id: string;
+    /** `metadata.org`; "" for kinds outside organization scope and for legacy rows that never named one. */
+    readonly org: string;
+    /** `metadata.visibility` as stored; unspecified when the row never set one. */
+    readonly visibility: ApiResourceVisibility;
+    /** `status.audit.spec_audit.created_by.id` as stamped; "" when absent. Classified by the reader, not here. */
+    readonly createdBy: string;
+    /**
+     * The scope link and every configured additional parent, in the tuple
+     * lifecycle's order, from the row's own fields; a parent the row does
+     * not name is absent, never a fault.
+     */
+    readonly parentLinks: ReadonlyArray<ResolvedParentLink>;
+}
 /** Fired synchronously after a resource row is first persisted. */
 export interface ResourceCreatedEvent {
     readonly kind: ApiResourceKind;

package/dist/extensions/resource-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-authorization.d.ts","sourceRoot":"","sources":["../../src/extensions/resource-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAC3H,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AACnI,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qDAAqD,CAAC;AAEzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAC5B,YAAY,GACZ,eAAe,GACf,iBAAiB,CAAC;AAEtB;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gCAAgC;IAChC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAChD,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAChE;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9D;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;OAKG;IACH,uBAAuB,CAAC,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;;OAIG;IACH,eAAe,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;OAIG;IACH,eAAe,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D"}
+{"version":3,"file":"resource-authorization.d.ts","sourceRoot":"","sources":["../../src/extensions/resource-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAC3H,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AACnI,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AACpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qDAAqD,CAAC;AAEzF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAC5B,YAAY,GACZ,eAAe,GACf,iBAAiB,CAAC;AAEtB;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gCAAgC;IAChC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,wGAAwG;IACxG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,8GAA8G;IAC9G,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CACzD;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAChD,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAChE;AAED,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,kEAAkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D,uEAAuE;IACvE,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC9D;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;OAKG;IACH,uBAAuB,CAAC,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;;OAIG;IACH,eAAe,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;OAIG;IACH,eAAe,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D"}

package/dist/extensions/schedule-fire-caller.d.ts

@@ -2,32 +2,59 @@
  * The schedule-fire caller seam (stigmer-cloud#572) — WHO a schedule fire
  * acts as when the RunStarter re-enters the execution create pipeline.
  *
- * OSS deliberately has no caller identity on this lane (DD-015 D-G: the
- * single-user edition has no tokens to carry one), so with no driver
- * composed every fire enters as the in-process `internal` class — today's
- * behavior, byte-identical. The cloud edition's Java baseline instead
- * mints a schedule JWT per fire (sub = the org's system-schedule account,
- * claim = the firing Schedule id) so the created session and execution
- * carry real attribution and the schedule's viewer set reaches the run
- * (the FGA model's session#schedule link — "without it a scheduled run is
- * invisible to every human, including the schedule's owner"). This seam
- * lets a composition supply that identity; the fire then propagates it
- * through the R5 caller-propagation header exactly like the other
- * request-origin in-process creates.
+ * With no driver composed a fire enters as the in-process `internal`
+ * class — the trusted-local laptop's lane, where the one caller is the
+ * server's operator and attribution has nobody to separate. Under an
+ * authentication posture that lane is wrong: the internal class carries
+ * the operator's email or `"system"`, which no enforcing evaluator
+ * recognizes as a person, so the fired session would belong to nobody
+ * (the FGA model's own words — "without it a scheduled run is invisible
+ * to every human, including the schedule's owner"). Two drivers answer
+ * it: the cloud edition mints a schedule JWT per fire (sub = the org's
+ * system-schedule account, claim = the firing Schedule id) so the run
+ * reaches the schedule's viewer set through the session#schedule link;
+ * open source, under the built-in authorization posture, makes the fire
+ * act as the schedule's CREATOR (authorization/schedule-fire-caller.ts),
+ * so the run and its session are that person's. The fire then propagates
+ * the identity through the R5 caller-propagation header exactly like the
+ * other request-origin in-process creates.
  *
  * Single-instance point. The mint is per fire — the schedule id is a
- * claim of the minted credential, never a cached field — and a mint
- * failure is an infrastructure fault: the RunStarter lets it propagate,
- * so the tick activity retries (the deterministic execution name absorbs
- * the retry) and a manual trigger surfaces the failure to its caller.
+ * claim of the minted credential, never a cached field. Two failure
+ * shapes, and the RunStarter tells them apart by type, the store-fault
+ * precedent (`ResourceNotFoundError` is checked with `instanceof`; every
+ * other fault is infrastructure):
+ *
+ *   - any other thrown error is an INFRASTRUCTURE fault: the RunStarter
+ *     lets it propagate, so the tick activity retries (the deterministic
+ *     execution name absorbs the retry) and a manual trigger surfaces
+ *     the failure to its caller;
+ *   - `ScheduleFireCallerRefusedError` is a DETERMINISTIC refusal — this
+ *     fire can act as nobody, and no retry will change that (a schedule
+ *     stamped by no person this server knows). The RunStarter answers
+ *     the `refused` outcome the way it answers a launch gate's refusal:
+ *     the failure streak counts it and pauses the schedule with the
+ *     reason, so the person who scheduled it sees why in the console
+ *     instead of a tick failing quietly forever.
  */
 import type { CallerIdentity } from "./identity.js";
 export interface ScheduleFireCallerMint {
     /**
      * Mints the caller identity one fire acts as. `rawToken` must carry the
-     * edition's verifiable credential for the identity (compositions read
-     * fire-scoped claims — e.g. the schedule id — from it downstream).
+     * edition's verifiable credential for the identity when the edition
+     * reads fire-scoped claims from it downstream (the cloud does — the
+     * schedule id); an edition that propagates the identity in-process and
+     * reads nothing off the token leaves it empty (open source does).
      */
     mintFireCaller(org: string, scheduleId: string): Promise<CallerIdentity>;
 }
+/**
+ * The mint's deterministic refusal (the module header): thrown by a
+ * driver when the fire can act as nobody and retrying cannot help. The
+ * message is the reason the schedule's status carries, so it is written
+ * for the person who scheduled the run.
+ */
+export declare class ScheduleFireCallerRefusedError extends Error {
+    constructor(reason: string);
+}
 //# sourceMappingURL=schedule-fire-caller.d.ts.map

package/dist/extensions/schedule-fire-caller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schedule-fire-caller.d.ts","sourceRoot":"","sources":["../../src/extensions/schedule-fire-caller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1E"}
+{"version":3,"file":"schedule-fire-caller.d.ts","sourceRoot":"","sources":["../../src/extensions/schedule-fire-caller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1E;AAED;;;;;GAKG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,MAAM,EAAE,MAAM;CAI3B"}

package/dist/extensions/schedule-fire-caller.js

@@ -1,2 +1,13 @@
-export {};
+/**
+ * The mint's deterministic refusal (the module header): thrown by a
+ * driver when the fire can act as nobody and retrying cannot help. The
+ * message is the reason the schedule's status carries, so it is written
+ * for the person who scheduled the run.
+ */
+export class ScheduleFireCallerRefusedError extends Error {
+    constructor(reason) {
+        super(reason);
+        this.name = "ScheduleFireCallerRefusedError";
+    }
+}
 //# sourceMappingURL=schedule-fire-caller.js.map

package/dist/extensions/schedule-fire-caller.js.map

@@ -1 +1 @@
-{"version":3,"file":"schedule-fire-caller.js","sourceRoot":"","sources":["../../src/extensions/schedule-fire-caller.ts"],"names":[],"mappings":""}
+{"version":3,"file":"schedule-fire-caller.js","sourceRoot":"","sources":["../../src/extensions/schedule-fire-caller.ts"],"names":[],"mappings":"AAoDA;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACvD,YAAY,MAAc;QACxB,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF"}

package/dist/identity/oidc-verifier.js

@@ -127,7 +127,14 @@ function classifyJoseError(error) {
         return new ConnectError(TOKEN_SIGNATURE_MESSAGE, Code.Unauthenticated);
     }
     if (error instanceof joseErrors.JWTInvalid ||
-        error instanceof joseErrors.JWSInvalid) {
+        error instanceof joseErrors.JWSInvalid ||
+        // A JWT whose algorithm the issuer's key set cannot serve (an HS256
+        // token against an RS256 JWKS): a credential this verifier recognizes
+        // but cannot verify, so a credential rejection — never the
+        // infrastructure arm. Until 2026-09-16 it fell through to INTERNAL,
+        // and a self-host with sign-in on failed every agent execution on its
+        // own runner token (stigmer#1137).
+        error instanceof joseErrors.JOSENotSupported) {
         return new ConnectError(INVALID_TOKEN_MESSAGE, Code.Unauthenticated);
     }
     // JWKSTimeout, fetch failures, and anything unclassified: infrastructure —

package/dist/identity/oidc-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-verifier.js","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAQ5E,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GACjC,qDAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAerD,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,IAA4B,CAAC;IAEjC,KAAK,UAAU,OAAO;QACpB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAC7B,IAAI,OAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC;gBACpE,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;oBACjE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;oBAC7B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC/D,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,8BAA8B;QAC1D,KAAK,YAAY,UAAU,CAAC,iBAAiB;QAC7C,KAAK,YAAY,UAAU,CAAC,wBAAwB;QACpD,KAAK,YAAY,UAAU,CAAC,WAAW,EACvC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,KAAK,YAAY,UAAU,CAAC,UAAU,EACtC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,2EAA2E;IAC3E,yDAAyD;IACzD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"oidc-verifier.js","sourceRoot":"","sources":["../../src/identity/oidc-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AAE3E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAQ5E,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GACjC,qDAAqD,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAerD,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,IAA4B,CAAC;IAEjC,KAAK,UAAU,OAAO;QACpB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;YAC7B,IAAI,OAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC1C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACtE,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,MAAM,oBAAoB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC;gBACpE,WAAW,EAAE,MAAM;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,KAAK;gBACf,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;oBACjE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;oBAC7B,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE;oBAC/D,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3C,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,YAAY,CAAC,sBAAsB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,8BAA8B;QAC1D,KAAK,YAAY,UAAU,CAAC,iBAAiB;QAC7C,KAAK,YAAY,UAAU,CAAC,wBAAwB;QACpD,KAAK,YAAY,UAAU,CAAC,WAAW,EACvC,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzE,CAAC;IACD,IACE,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,KAAK,YAAY,UAAU,CAAC,UAAU;QACtC,oEAAoE;QACpE,sEAAsE;QACtE,2DAA2D;QAC3D,oEAAoE;QACpE,sEAAsE;QACtE,mCAAmC;QACnC,KAAK,YAAY,UAAU,CAAC,gBAAgB,EAC5C,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,qBAAqB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,2EAA2E;IAC3E,yDAAyD;IACzD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -69,8 +69,18 @@ export type { AuthorizationQueryEngine } from "./extensions/authorization-querie
 export type { IdentityFederation } from "./extensions/identity-federation.js";
 export type { AccountsBySubject } from "./domain/identityaccount/resolve.js";
 export { identityIdForSubject } from "./domain/identityaccount/resolve.js";
+export type { DerivedRelation, KindDeclaration, Rewrite, SubjectType, } from "./authorization/model/rewrite.js";
+export type { Model } from "./authorization/model/index.js";
+export { builtInModel, declarationFor, newModel, } from "./authorization/model/index.js";
+export type { CheckContext, ObjectRef, Person, Subject, Tuple, TupleSource, } from "./authorization/tuples.js";
+export type { EvaluationFault } from "./authorization/evaluator.js";
+export { AuthorizationEvaluationError, MAX_RESOLUTION_DEPTH, checkRelation, } from "./authorization/evaluator.js";
+export type { StoreTestCase, StoreTestDocument, StoreTestKit, StoreTestSkip, StoreTestSkipReason, } from "./authorization/store-test-kit.js";
+export { parseStoreTestDocument, storeTestCases, } from "./authorization/store-test-kit.js";
+export { NOT_FOUND_EXEMPT_KINDS } from "./authorization/authorizer.js";
 export type { ListReadScope, ListEntryMeta, } from "./extensions/list-read-scope.js";
 export type { ScheduleFireCallerMint } from "./extensions/schedule-fire-caller.js";
+export { ScheduleFireCallerRefusedError } from "./extensions/schedule-fire-caller.js";
 export type { VisitorErrorPolicy } from "./pipeline/interceptors/error-boundary.js";
 export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-boundary.js";
 export { diffVisibilityShapes, visibilityShapesFor, } from "./pipeline/steps/authorization-tuples.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAO3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,YAAY,EACV,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAU1F,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,YAAY,EACV,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,YAAY,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,YAAY,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACtF,YAAY,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAIzC,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AASnF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,MAAM,EACN,aAAa,EACb,QAAQ,EACR,OAAO,GACR,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AASlC,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAOjE,YAAY,EACV,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EACV,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAIzE,YAAY,EACV,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,8BAA8B,EAC9B,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAO3E,YAAY,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,YAAY,EACV,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAU1F,YAAY,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,YAAY,EACV,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,YAAY,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,YAAY,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACtF,YAAY,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAO3E,YAAY,EACV,eAAe,EACf,eAAe,EACf,OAAO,EACP,WAAW,GACZ,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EACL,YAAY,EACZ,cAAc,EACd,QAAQ,GACT,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,YAAY,EACZ,SAAS,EACT,MAAM,EACN,OAAO,EACP,KAAK,EACL,WAAW,GACZ,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACb,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,cAAc,GACf,MAAM,mCAAmC,CAAC;AAI3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,YAAY,EACV,aAAa,EACb,aAAa,GACd,MAAM,iCAAiC,CAAC;AAMzC,YAAY,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAStF,YAAY,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAGlD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAKxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAgBzC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AAOjF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAOjE,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,YAAY,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAK9B,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAWhE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,YAAY,EACV,eAAe,EACf,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,GACjB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AAIrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,YAAY,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAKjG,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,YAAY,EACV,wBAAwB,EAKxB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EAKxB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAcpC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAMzD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAS9E,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAQrE,YAAY,EACV,cAAc,EACd,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0CAA0C,CAAC;AAOlD,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -49,6 +49,14 @@ export { identityAccountStoreContract } from "./domain/identityaccount/store-con
 export { DuplicatePolicyError } from "./domain/iampolicy/store.js";
 export { iamPolicyStoreContract } from "./domain/iampolicy/store-contract.js";
 export { identityIdForSubject } from "./domain/identityaccount/resolve.js";
+export { builtInModel, declarationFor, newModel, } from "./authorization/model/index.js";
+export { AuthorizationEvaluationError, MAX_RESOLUTION_DEPTH, checkRelation, } from "./authorization/evaluator.js";
+export { parseStoreTestDocument, storeTestCases, } from "./authorization/store-test-kit.js";
+// The kinds whose missing row the built-in authorizer denies instead of
+// answering not-found — the cloud's probe exemption over the open-source
+// tier; exported so the cloud's drift test pins the two sets equal.
+export { NOT_FOUND_EXEMPT_KINDS } from "./authorization/authorizer.js";
+export { ScheduleFireCallerRefusedError } from "./extensions/schedule-fire-caller.js";
 export { createErrorBoundaryInterceptor } from "./pipeline/interceptors/error-boundary.js";
 export { diffVisibilityShapes, visibilityShapesFor, } from "./pipeline/steps/authorization-tuples.js";
 export { RequestContext } from "./pipeline/request-context.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAiEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAQ3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAQ1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAW1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAKnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAK9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAkB3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wCAAwC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAiEhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAQ3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAQ1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAW1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAKnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAK9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAc3E,OAAO,EACL,YAAY,EACZ,cAAc,EACd,QAAQ,GACT,MAAM,gCAAgC,CAAC;AAUxC,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,aAAa,GACd,MAAM,8BAA8B,CAAC;AAQtC,OAAO,EACL,sBAAsB,EACtB,cAAc,GACf,MAAM,mCAAmC,CAAC;AAC3C,wEAAwE;AACxE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAWvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAUtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,yEAAyE;AACzE,+DAA+D;AAC/D,wEAAwE;AACxE,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,sEAAsE;AACtE,qEAAqE;AACrE,6DAA6D;AAC7D,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,+DAA+D;AAC/D,yEAAyE;AACzE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,mEAAmE;AACnE,2DAA2D;AAC3D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,+DAA+D;AAC/D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,iCAAiC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,oEAAoE;AACpE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kDAAkD;AAClD,OAAO,EACL,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,0EAA0E;AAC1E,uEAAuE;AACvE,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAMtE,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAM9B,uEAAuE;AACvE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAQvE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AAkBrG,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,qEAAqE;AACrE,6DAA6D;AAC7D,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,0EAA0E;AAC1E,qEAAqE;AACrE,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AAE9E,yEAAyE;AACzE,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,OAAO,EACL,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,IAAI,sCAAsC,GAC3D,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,iCAAiC,GAClC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AA0BrE,oEAAoE;AACpE,yEAAyE;AACzE,iDAAiD;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/pipeline/apiresource-labels.d.ts

@@ -8,9 +8,12 @@
  * instances) but never to GRANT anything. Where a grant-shaped decision is
  * needed, key it on server-owned state instead (e.g. the parent blueprint's
  * status.default_instance_id, written only by the create/self-heal flows).
- * The cloud edition additionally guards the whole reserved namespace at its
- * write boundaries (GuardReservedLabelsStep); OSS has no such guard, which
- * is one of the reasons OSS predicates must not trust these labels alone.
+ * Every write boundary runs GuardReservedLabels over the namespace
+ * (pipeline/steps/guard-reserved-labels.ts), but the open-source
+ * authorizer's permissive default ALLOWS reserved-label writes by design
+ * (the self-hosted operator owns the store), which is why a restrict-shaped
+ * predicate here still pairs the label with server-owned state: the
+ * plugin-managed guard refuses only beside an existing plugin row.
  */
 import type { ApiResourceMetadata } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 /**
@@ -39,6 +42,23 @@ export declare const SYSTEM_MANAGED_LABEL = "stigmer.ai/system-managed";
  * read by the predicates here.
  */
 export declare const RESERVED_LABEL_TRUE = "true";
+/**
+ * The plugin that materialised a resource: the label's value is the
+ * plugin's id (`plg_...`), never its slug, because `findAllByLabel` is
+ * org-agnostic and two organizations may both install `thermos`. Written
+ * only by the plugin controller (in-process, as the installing caller);
+ * membership is derived on read from it and stored nowhere else.
+ */
+export declare const PLUGIN_LABEL = "stigmer.ai/plugin";
+/**
+ * The archive digest a member was last materialised from — the per-child
+ * convergence marker. A re-push compares every member's value with the
+ * head's digest before deciding it has nothing to do, so a member another
+ * lane deleted or an older install left behind is re-materialised.
+ */
+export declare const PLUGIN_VERSION_LABEL = "stigmer.ai/plugin-version";
+/** The plugin id a resource's labels claim, or undefined when unlabelled. */
+export declare function pluginIdOf(metadata: ApiResourceMetadata | undefined): string | undefined;
 /**
  * Whether the metadata carries the DEFAULT_INSTANCE_LABEL marker
  * (undefined-safe) — Go IsDefaultInstance.

package/dist/pipeline/apiresource-labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiresource-labels.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AAEtG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,gCAA6C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,8BAA2C,CAAC;AAE7E;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,OAAO,CAET"}
+{"version":3,"file":"apiresource-labels.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AAEtG;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,gCAA6C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,8BAA2C,CAAC;AAE7E;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,sBAAmC,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,8BAA2C,CAAC;AAE7E,6EAA6E;AAC7E,wBAAgB,UAAU,CACxB,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,MAAM,GAAG,SAAS,CAGpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,OAAO,CAET"}

package/dist/pipeline/apiresource-labels.js

@@ -24,6 +24,26 @@ export const SYSTEM_MANAGED_LABEL = `${RESERVED_LABEL_PREFIX}system-managed`;
  * read by the predicates here.
  */
 export const RESERVED_LABEL_TRUE = "true";
+/**
+ * The plugin that materialised a resource: the label's value is the
+ * plugin's id (`plg_...`), never its slug, because `findAllByLabel` is
+ * org-agnostic and two organizations may both install `thermos`. Written
+ * only by the plugin controller (in-process, as the installing caller);
+ * membership is derived on read from it and stored nowhere else.
+ */
+export const PLUGIN_LABEL = `${RESERVED_LABEL_PREFIX}plugin`;
+/**
+ * The archive digest a member was last materialised from — the per-child
+ * convergence marker. A re-push compares every member's value with the
+ * head's digest before deciding it has nothing to do, so a member another
+ * lane deleted or an older install left behind is re-materialised.
+ */
+export const PLUGIN_VERSION_LABEL = `${RESERVED_LABEL_PREFIX}plugin-version`;
+/** The plugin id a resource's labels claim, or undefined when unlabelled. */
+export function pluginIdOf(metadata) {
+    const value = metadata?.labels[PLUGIN_LABEL];
+    return value === undefined || value === "" ? undefined : value;
+}
 /**
  * Whether the metadata carries the DEFAULT_INSTANCE_LABEL marker
  * (undefined-safe) — Go IsDefaultInstance.

package/dist/pipeline/apiresource-labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiresource-labels.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,qBAAqB,kBAAkB,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,gBAAgB,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyC;IAEzC,OAAO,QAAQ,EAAE,MAAM,CAAC,sBAAsB,CAAC,KAAK,mBAAmB,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"apiresource-labels.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-labels.ts"],"names":[],"mappings":"AAmBA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,qBAAqB,kBAAkB,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,gBAAgB,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,qBAAqB,QAAQ,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,gBAAgB,CAAC;AAE7E,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CACxB,QAAyC;IAEzC,MAAM,KAAK,GAAG,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAyC;IAEzC,OAAO,QAAQ,EAAE,MAAM,CAAC,sBAAsB,CAAC,KAAK,mBAAmB,CAAC;AAC1E,CAAC"}

package/dist/pipeline/apiresource-meta.d.ts

@@ -108,4 +108,19 @@ export declare function supportsVisibility(kind: ApiResourceKind, visibility: Ap
  * copy from this exact format.
  */
 export declare function supportedVisibilityLevels(kind: ApiResourceKind): string;
+/**
+ * The kind a minted resource id belongs to, read off its prefix — the
+ * inverse of `getIdPrefix` over the ids `generateId` mints
+ * (`<prefix>_<ulid>`, pipeline/steps/defaults.ts). The one consumer today
+ * is the runner-credential lane, whose token binds an execution by id and
+ * must know whether that id names an agent execution or a workflow
+ * execution without a second claim or a guess. Anything that is not
+ * `<known prefix>_<rest>` — no underscore, an unknown prefix, the empty
+ * string — is `api_resource_kind_unknown`; never a throw, because the id
+ * arrived inside a credential and the caller refuses with its own
+ * sentence. Every `id_prefix` in the contract is unique; the table pin in
+ * __tests__ makes a future duplicate a reviewed change, since this lookup
+ * would otherwise resolve it silently to one of the two.
+ */
+export declare function kindByIdPrefix(id: string): ApiResourceKind;
 //# sourceMappingURL=apiresource-meta.d.ts.map

package/dist/pipeline/apiresource-meta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiresource-meta.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EAEf,YAAY,EAEb,MAAM,qFAAqF,CAAC;AAC7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qFAAqF,CAAC;AAK/H,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AACnI,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,mBAAmB,CAMtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,eAAe,GACpB,oBAAoB,GAAG,SAAS,CASlC;AAED,0CAA0C;AAC1C,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAS9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAI7D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAO1D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,GACpB,qBAAqB,CAKvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,GACpB,aAAa,CAAC,OAAO,CAAC,CAMxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,aAAa,GACrB,OAAO,CAKT;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,GACrB,OAAO,CAET;AAkCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAYT;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAavE"}
+{"version":3,"file":"apiresource-meta.d.ts","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EAEf,YAAY,EAEb,MAAM,qFAAqF,CAAC;AAC7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qFAAqF,CAAC;AAK/H,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AACnI,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,mBAAmB,CAMtE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,eAAe,GACpB,oBAAoB,GAAG,SAAS,CASlC;AAED,0CAA0C;AAC1C,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAS9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAI7D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAO1D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,GACpB,qBAAqB,CAKvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,GACpB,aAAa,CAAC,OAAO,CAAC,CAMxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,aAAa,GACrB,OAAO,CAKT;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,aAAa,GACrB,OAAO,CAET;AAkCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAYT;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAavE;AA+CD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,CAS1D"}

package/dist/pipeline/apiresource-meta.js

@@ -293,4 +293,38 @@ function kindsByEnumName() {
     }
     return enumNameCache;
 }
+/**
+ * The kind a minted resource id belongs to, read off its prefix — the
+ * inverse of `getIdPrefix` over the ids `generateId` mints
+ * (`<prefix>_<ulid>`, pipeline/steps/defaults.ts). The one consumer today
+ * is the runner-credential lane, whose token binds an execution by id and
+ * must know whether that id names an agent execution or a workflow
+ * execution without a second claim or a guess. Anything that is not
+ * `<known prefix>_<rest>` — no underscore, an unknown prefix, the empty
+ * string — is `api_resource_kind_unknown`; never a throw, because the id
+ * arrived inside a credential and the caller refuses with its own
+ * sentence. Every `id_prefix` in the contract is unique; the table pin in
+ * __tests__ makes a future duplicate a reviewed change, since this lookup
+ * would otherwise resolve it silently to one of the two.
+ */
+export function kindByIdPrefix(id) {
+    const separator = id.indexOf("_");
+    if (separator <= 0) {
+        return ApiResourceKind.api_resource_kind_unknown;
+    }
+    return (kindsByIdPrefix().get(id.slice(0, separator)) ??
+        ApiResourceKind.api_resource_kind_unknown);
+}
+let idPrefixCache;
+function kindsByIdPrefix() {
+    if (idPrefixCache === undefined) {
+        idPrefixCache = new Map(ApiResourceKindSchema.values
+            .filter((value) => hasOption(value, kind_meta))
+            .map((value) => [
+            getOption(value, kind_meta).idPrefix,
+            value.number,
+        ]));
+    }
+    return idPrefixCache;
+}
 //# sourceMappingURL=apiresource-meta.js.map

package/dist/pipeline/apiresource-meta.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiresource-meta.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,SAAS,GACV,MAAM,qFAAqF,CAAC;AAE7F,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,wFAAwF,CAAC;AAGhG,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,IAAqB;IAErB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IACE,MAAM,EAAE,SAAS,KAAK,sBAAsB,CAAC,MAAM;QACnD,MAAM,CAAC,SAAS,KAAK,oBAAoB,CAAC,SAAS,EACnD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;AACpC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,CACL,eAAe,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqB;IAChD,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,KAAK,GACT,mBAAmB,CAAC,IAAI,CAAC;QACzB,mBAAmB,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACjE,OAAO,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAqB;IAErB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,OAAO,MAAM,EAAE,uBAAuB,KAAK,IAAI;QAC7C,CAAC,CAAC,qBAAqB,CAAC,cAAc;QACtC,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB;IAErB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,aAAa,EAAE,cAAc,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAkB,EAClB,OAAsB;IAEtB,IAAI,OAAO,KAAK,aAAa,CAAC,0BAA0B,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,OAAsB;IAEtB,OAAO,mBAAmB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,OAAsB;IACzC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,aAAa,CAAC,GAAG;YACpB,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,UAAU;YAC3B,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,KAAK,CAAC;QACzB,KAAK,aAAa,CAAC,0BAA0B;YAC3C,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAkB;IAClC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC,WAAW,CAAC;QAC9B,KAAK,YAAY,CAAC,yBAAyB;YACzC,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAqB,EACrB,UAAiC;IAEjC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,qBAAqB,CAAC,iBAAiB;YAC1C,OAAO,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;QACzC,KAAK,qBAAqB,CAAC,cAAc;YACvC,OAAO,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;QACtC,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,OAAO,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;QAC3C;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,IAAI,MAAM,GAAG,oBAAoB,CAAC;IAClC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,qBAAqB,CAAC;IAClC,CAAC;IACD,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAqB;IAChD,OAAO,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,kBAA4D,CAAC;AAEjE,SAAS,oBAAoB;IAC3B,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,kBAAkB,GAAG,IAAI,GAAG,CAC1B,qBAAqB,CAAC,MAAM;aACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACd,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC;YACnD,KAAK,CAAC,MAAyB;SAChC,CAAC,CACL,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,IAAI,aAAuD,CAAC;AAE5D;;;;;GAKG;AACH,SAAS,eAAe;IACtB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,GAAG,IAAI,GAAG,CACrB,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,MAAyB;SAChC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"apiresource-meta.js","sourceRoot":"","sources":["../../src/pipeline/apiresource-meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,SAAS,GACV,MAAM,qFAAqF,CAAC;AAE7F,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,wFAAwF,CAAC;AAGhG,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,IAAqB;IAErB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IAC/C,IACE,MAAM,EAAE,SAAS,KAAK,sBAAsB,CAAC,MAAM;QACnD,MAAM,CAAC,SAAS,KAAK,oBAAoB,CAAC,SAAS,EACnD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;AACpC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,CACL,eAAe,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAqB;IAChD,sEAAsE;IACtE,sEAAsE;IACtE,MAAM,KAAK,GACT,mBAAmB,CAAC,IAAI,CAAC;QACzB,mBAAmB,CAAC,eAAe,CAAC,yBAAyB,CAAC,CAAC;IACjE,OAAO,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAqB;IAErB,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,OAAO,MAAM,EAAE,uBAAuB,KAAK,IAAI;QAC7C,CAAC,CAAC,qBAAqB,CAAC,cAAc;QACtC,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAqB;IAErB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,aAAa,EAAE,cAAc,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAkB,EAClB,OAAsB;IAEtB,IAAI,OAAO,KAAK,aAAa,CAAC,0BAA0B,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqB,EACrB,OAAsB;IAEtB,OAAO,mBAAmB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,OAAsB;IACzC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,aAAa,CAAC,GAAG;YACpB,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,UAAU;YAC3B,OAAO,CAAC,CAAC;QACX,KAAK,aAAa,CAAC,KAAK,CAAC;QACzB,KAAK,aAAa,CAAC,0BAA0B;YAC3C,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAkB;IAClC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC,WAAW,CAAC;QAC9B,KAAK,YAAY,CAAC,yBAAyB;YACzC,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,CAAC,CAAC;QACX,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAqB,EACrB,UAAiC;IAEjC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,qBAAqB,CAAC,iBAAiB;YAC1C,OAAO,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;QACzC,KAAK,qBAAqB,CAAC,cAAc;YACvC,OAAO,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC;QACtC,KAAK,qBAAqB,CAAC,mBAAmB;YAC5C,OAAO,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;QAC3C;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,UAAU,CAAC;IAC3D,IAAI,MAAM,GAAG,oBAAoB,CAAC;IAClC,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,qBAAqB,CAAC;IAClC,CAAC;IACD,IAAI,MAAM,EAAE,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,uBAAuB,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAqB;IAChD,OAAO,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,kBAA4D,CAAC;AAEjE,SAAS,oBAAoB;IAC3B,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACrC,kBAAkB,GAAG,IAAI,GAAG,CAC1B,qBAAqB,CAAC,MAAM;aACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACd,iBAAiB,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC;YACnD,KAAK,CAAC,MAAyB;SAChC,CAAC,CACL,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,IAAI,aAAuD,CAAC;AAE5D;;;;;GAKG;AACH,SAAS,eAAe;IACtB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,GAAG,IAAI,GAAG,CACrB,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI;YACV,KAAK,CAAC,MAAyB;SAChC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,eAAe,CAAC,yBAAyB,CAAC;IACnD,CAAC;IACD,OAAO,CACL,eAAe,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7C,eAAe,CAAC,yBAAyB,CAC1C,CAAC;AACJ,CAAC;AAED,IAAI,aAAuD,CAAC;AAE5D,SAAS,eAAe;IACtB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,GAAG,IAAI,GAAG,CACrB,qBAAqB,CAAC,MAAM;aACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;aAC9C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACd,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,QAAQ;YACpC,KAAK,CAAC,MAAyB;SAChC,CAAC,CACL,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/pipeline/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/pipeline/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,4CAA4C;AAC5C,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAExE;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAElE;AAED,sDAAsD;AACtD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAE7E;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAErE;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE1D;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAE3E;AA2BD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAE/C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,YAAY,CAKd;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAErE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/pipeline/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,4CAA4C;AAC5C,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAExE;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAElE;AAED,sDAAsD;AACtD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,YAAY,CAK7E;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAErE;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE1D;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAE3E;AA2BD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAE/C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,YAAY,GAClB,YAAY,CAEd;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,CAErE"}

package/dist/pipeline/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/pipeline/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,4CAA4C;AAC5C,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,EAAU;IACxD,OAAO,IAAI,YAAY,CAAC,GAAG,QAAQ,eAAe,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;AACzD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,EAAU;IAC7D,OAAO,IAAI,YAAY,CAAC,GAAG,QAAQ,oBAAoB,EAAE,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC5D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,OAAe;IAC3D,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,eAAe,GAAmC;IACtD,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS;IACzB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB;IACzC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IAC3C,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,eAAe;IACrC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IAC3C,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,mBAAmB;IAC7C,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IAC/C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS;IACzB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,YAAY;IAC/B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,eAAe;IACrC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa;IACjC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB;CAC1C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,KAAmB;IAEnB,OAAO,IAAI,YAAY,CACrB,GAAG,MAAM,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,EACtC,KAAK,CAAC,IAAI,CACX,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAmB;IACjD,OAAO,qBAAqB,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,UAAU,EAAE,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAmB;IACrD,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/pipeline/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzD,4CAA4C;AAC5C,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,EAAU;IACxD,OAAO,IAAI,YAAY,CAAC,GAAG,QAAQ,eAAe,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;AACzD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,EAAU;IAC7D,OAAO,IAAI,YAAY,CACrB,GAAG,QAAQ,oBAAoB,EAAE,EAAE,EACnC,IAAI,CAAC,aAAa,CACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAC5D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,OAAe;IAC3D,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,eAAe,GAAmC;IACtD,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS;IACzB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB;IACzC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IAC3C,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,eAAe;IACrC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,kBAAkB;IAC3C,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,mBAAmB;IAC7C,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,oBAAoB;IAC/C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS;IACzB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,YAAY;IAC/B,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,eAAe;IACrC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa;IACjC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU;IAC3B,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB;CAC1C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAU;IACrC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,KAAmB;IAEnB,OAAO,IAAI,YAAY,CAAC,GAAG,MAAM,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAmB;IACjD,OAAO,qBAAqB,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,UAAU,EAAE,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAmB;IACrD,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC"}

package/dist/pipeline/steps/authorization-facts.d.ts

@@ -0,0 +1,12 @@
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ResolvedParentLink, RowAuthorizationFacts } from "../../extensions/resource-authorization.js";
+/** The row's facts, read structurally; every absence is the empty value, never a throw. */
+export declare function rowAuthorizationFactsOf(kind: ApiResourceKind, resource: object): RowAuthorizationFacts;
+/** `status.audit.spec_audit.created_by.id` as stamped — "" when any link is absent. */
+export declare function createdByOf(resource: object): string;
+/**
+ * The scope link and every configured additional parent the row names, in
+ * the tuple lifecycle's order. A parent the row does not name is left out.
+ */
+export declare function parentLinksOf(kind: ApiResourceKind, resource: object, org: string): ReadonlyArray<ResolvedParentLink>;
+//# sourceMappingURL=authorization-facts.d.ts.map

package/dist/pipeline/steps/authorization-facts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-facts.d.ts","sourceRoot":"","sources":["../../../src/pipeline/steps/authorization-facts.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAI3H,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,4CAA4C,CAAC;AAUpD,2FAA2F;AAC3F,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,MAAM,GACf,qBAAqB,CAYvB;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIpD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,aAAa,CAAC,kBAAkB,CAAC,CAsCnC"}

package/dist/pipeline/steps/authorization-facts.js

@@ -0,0 +1,100 @@
+/**
+ * The facts a stored row's authorization tuples derive from, read back
+ * from the row (`RowAuthorizationFacts`, extensions/resource-authorization.ts)
+ * — the read-time twin of the tuple lifecycle's create-time resolution in
+ * authorization-tuples.ts, and deliberately not that function: the
+ * create-time one throws when a row is missing its organization or its
+ * parent (a create must not half-succeed), while a row read back years
+ * later is a fact, missing pieces included — an empty organization
+ * resolves `admin from organization` to nobody, it does not fault a read.
+ * The two cannot drift unnoticed: src/authorization/__tests__/facts.test.ts
+ * pins that a well-formed row resolves to the same links through both.
+ *
+ * Two readers share this one resolver, which is the reason it is a leaf
+ * of its own: the list lanes' shared helper (extensions/list-read-scope.ts)
+ * builds every candidate's `ListEntryMeta` through it, and the built-in
+ * authorizer (src/authorization/facts.ts) derives a loaded row's tuples
+ * through it. It imports the two pure leaves it needs (apiresource-meta,
+ * shapes) and the protos, and nothing else, so the seam may import it by
+ * value without a cycle — the third such leaf, beside those two.
+ *
+ * Every read is structural (shapes.ts's own premise: protobuf-es messages
+ * are plain objects sharing the generated metadata and audit types), so
+ * the resolver needs no schema — a list lane holds decoded rows of a kind
+ * it names, not their descriptors.
+ */
+import { AuthorizationScopeType } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/authorization_config_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { getKindEnum, getKindMeta } from "../apiresource-meta.js";
+import { parentIdOf } from "./shapes.js";
+/** The row's facts, read structurally; every absence is the empty value, never a throw. */
+export function rowAuthorizationFactsOf(kind, resource) {
+    const metadata = resource.metadata;
+    const org = metadata?.org ?? "";
+    return {
+        id: metadata?.id ?? "",
+        org,
+        visibility: metadata?.visibility ??
+            ApiResourceVisibility.api_resource_visibility_unspecified,
+        createdBy: createdByOf(resource),
+        parentLinks: parentLinksOf(kind, resource, org),
+    };
+}
+/** `status.audit.spec_audit.created_by.id` as stamped — "" when any link is absent. */
+export function createdByOf(resource) {
+    return (resource.status?.audit?.specAudit?.createdBy?.id ?? "");
+}
+/**
+ * The scope link and every configured additional parent the row names, in
+ * the tuple lifecycle's order. A parent the row does not name is left out.
+ */
+export function parentLinksOf(kind, resource, org) {
+    const config = getKindMeta(kind).authorization;
+    if (config === undefined) {
+        return [];
+    }
+    const links = [];
+    switch (config.scopeType) {
+        case AuthorizationScopeType.ORGANIZATION:
+            if (org !== "") {
+                links.push({
+                    relation: "organization",
+                    parentKind: getKindEnum("organization"),
+                    parentId: org,
+                });
+            }
+            break;
+        case AuthorizationScopeType.PARENT:
+            if (config.parent !== undefined) {
+                pushLink(links, resource, config.parent);
+            }
+            break;
+        case AuthorizationScopeType.OWNER_ONLY:
+        case AuthorizationScopeType.PLATFORM:
+        case AuthorizationScopeType.NONE:
+        case AuthorizationScopeType.UNSPECIFIED:
+            // No scope link: OWNER_ONLY by design; PLATFORM is dead config in
+            // both editions (the lifecycle warns and writes none); NONE and
+            // UNSPECIFIED are kinds outside the model.
+            break;
+        default: {
+            const exhaustive = config.scopeType;
+            throw new Error(`unknown scope type: ${String(exhaustive)}`);
+        }
+    }
+    for (const parent of config.additionalParents) {
+        pushLink(links, resource, parent);
+    }
+    return links;
+}
+function pushLink(links, resource, parent) {
+    const parentId = parentIdOf(resource, parent.specField);
+    if (parentId !== "") {
+        links.push({
+            relation: parent.relation,
+            parentKind: getKindEnum(parent.kind),
+            parentId,
+        });
+    }
+}
+//# sourceMappingURL=authorization-facts.js.map