@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/dist/authorization/evaluator.js

@@ -0,0 +1,153 @@
+import { ACCOUNT_TYPE, ALLOW_PUBLIC_CONDITION, formatObjectRef, pairKey, } from "./tuples.js";
+/**
+ * OpenFGA's default resolution-depth limit (its `resolveNodeLimit`), so
+ * the bound here is the oracle's own and not a number chosen locally. The
+ * deepest real chain in the model is under ten: an instance's `viewer
+ * from default_of` to its blueprint, the blueprint's `admin from
+ * organization`, then the organization's four-rung ladder.
+ */
+export const MAX_RESOLUTION_DEPTH = 25;
+/** A fault in the model or its evaluation — never a denial; the driver maps it to `unavailable`. */
+export class AuthorizationEvaluationError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = "AuthorizationEvaluationError";
+        this.reason = reason;
+    }
+}
+export async function checkRelation(deps, object, relation, person, context) {
+    if (deps.model.byType(object.type) === undefined) {
+        throw new AuthorizationEvaluationError("undeclared-target-kind", `no declaration for kind '${object.type}' (target ${formatObjectRef(object)})`);
+    }
+    return new Walk(deps, person, context).resolve(object, relation, 0);
+}
+/** One check's state: the memo and the in-progress set, over one source. */
+class Walk {
+    deps;
+    person;
+    context;
+    memo = new Map();
+    inProgress = new Set();
+    constructor(deps, person, context) {
+        this.deps = deps;
+        this.person = person;
+        this.context = context;
+    }
+    resolve(object, relation, depth) {
+        const key = pairKey(object, relation);
+        if (this.inProgress.has(key)) {
+            throw new AuthorizationEvaluationError("resolution-cycle", `'${key}' re-entered while being resolved — the declarations cycle`);
+        }
+        if (depth > MAX_RESOLUTION_DEPTH) {
+            throw new AuthorizationEvaluationError("resolution-depth-exceeded", `resolving '${key}' exceeded ${MAX_RESOLUTION_DEPTH} hops`);
+        }
+        const held = this.memo.get(key);
+        if (held !== undefined) {
+            return held;
+        }
+        const declaration = this.deps.model.byType(object.type);
+        const rewrite = declaration?.relations.get(relation);
+        if (declaration === undefined || rewrite === undefined) {
+            return Promise.resolve(false);
+        }
+        this.inProgress.add(key);
+        const result = this.evaluate(rewrite, object, relation, depth).finally(() => this.inProgress.delete(key));
+        this.memo.set(key, result);
+        return result;
+    }
+    async evaluate(rewrite, object, relation, depth) {
+        switch (rewrite.node) {
+            case "this": {
+                const tuples = await this.deps.source.tuplesOf(object, relation);
+                for (const tuple of tuples) {
+                    if (await this.subjectHolds(tuple.subject, rewrite.subjects, depth)) {
+                        return true;
+                    }
+                }
+                return false;
+            }
+            case "computed":
+                return this.resolve(object, rewrite.relation, depth + 1);
+            case "from": {
+                const linkTypes = this.objectTypesOf(object, rewrite.tupleset);
+                const links = await this.deps.source.tuplesOf(object, rewrite.tupleset);
+                for (const link of links) {
+                    if (link.subject.form === "object" &&
+                        linkTypes.has(link.subject.object.type) &&
+                        (await this.resolve(link.subject.object, rewrite.relation, depth + 1))) {
+                        return true;
+                    }
+                }
+                return false;
+            }
+            case "union": {
+                for (const member of rewrite.members) {
+                    if (await this.evaluate(member, object, relation, depth)) {
+                        return true;
+                    }
+                }
+                return false;
+            }
+            default: {
+                const exhaustive = rewrite;
+                throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`);
+            }
+        }
+    }
+    /** Whether one direct tuple's subject reaches the person, within the line's type restriction. */
+    async subjectHolds(subject, restriction, depth) {
+        switch (subject.form) {
+            case "object":
+                return (subject.object.type === ACCOUNT_TYPE &&
+                    restriction.some((allowed) => allowed.form === "object" && allowed.type === ACCOUNT_TYPE) &&
+                    this.person.aliases.has(subject.object.id));
+            case "userset":
+                return (restriction.some((allowed) => allowed.form === "userset" &&
+                    allowed.type === subject.object.type &&
+                    allowed.relation === subject.relation) && (await this.resolve(subject.object, subject.relation, depth + 1)));
+            case "wildcard": {
+                const allowed = restriction.some((entry) => entry.form === "wildcard" &&
+                    entry.type === subject.type &&
+                    entry.condition === subject.condition);
+                return allowed && this.conditionHolds(subject.condition);
+            }
+            default: {
+                const exhaustive = subject;
+                throw new Error(`unknown subject form: ${JSON.stringify(exhaustive)}`);
+            }
+        }
+    }
+    conditionHolds(condition) {
+        switch (condition) {
+            case ALLOW_PUBLIC_CONDITION:
+                return this.context.allow;
+            default:
+                throw new AuthorizationEvaluationError("unknown-condition", `the model declares no condition '${String(condition)}'`);
+        }
+    }
+    /** The object types the tupleset line admits — `[organization]`, `[session]` — from its `this` nodes. */
+    objectTypesOf(object, tupleset) {
+        const rewrite = this.deps.model
+            .byType(object.type)
+            ?.relations.get(tupleset);
+        const types = new Set();
+        const collect = (node) => {
+            if (node.node === "this") {
+                for (const subject of node.subjects) {
+                    if (subject.form === "object") {
+                        types.add(subject.type);
+                    }
+                }
+            }
+            else if (node.node === "union") {
+                node.members.forEach(collect);
+            }
+        };
+        if (rewrite !== undefined) {
+            collect(rewrite);
+        }
+        return types;
+    }
+}
+//# sourceMappingURL=evaluator.js.map

package/dist/authorization/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../src/authorization/evaluator.ts"],"names":[],"mappings":"AAqDA,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,OAAO,GACR,MAAM,aAAa,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAQvC,oGAAoG;AACpG,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,MAAM,CAAkB;IAEjC,YAAY,MAAuB,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAoB,EACpB,MAAiB,EACjB,QAAgB,EAChB,MAAc,EACd,OAAqB;IAErB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,4BAA4B,CACpC,wBAAwB,EACxB,4BAA4B,MAAM,CAAC,IAAI,aAAa,eAAe,CAAC,MAAM,CAAC,GAAG,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,4EAA4E;AAC5E,MAAM,IAAI;IAKW;IACA;IACA;IANF,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC3C,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhD,YACmB,IAAoB,EACpB,MAAc,EACd,OAAqB;QAFrB,SAAI,GAAJ,IAAI,CAAgB;QACpB,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAc;IACrC,CAAC;IAEJ,OAAO,CACL,MAAiB,EACjB,QAAgB,EAChB,KAAa;QAEb,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAA4B,CACpC,kBAAkB,EAClB,IAAI,GAAG,4DAA4D,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;YACjC,MAAM,IAAI,4BAA4B,CACpC,2BAA2B,EAC3B,cAAc,GAAG,cAAc,oBAAoB,OAAO,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAC1E,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAC5B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,OAAgB,EAChB,MAAiB,EACjB,QAAgB,EAChB,KAAa;QAEb,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;wBACpE,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC3D,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IACE,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;wBAC9B,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;wBACvC,CAAC,MAAM,IAAI,CAAC,OAAO,CACjB,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,OAAO,CAAC,QAAQ,EAChB,KAAK,GAAG,CAAC,CACV,CAAC,EACF,CAAC;wBACD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACrC,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;wBACzD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,OAAO,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,iGAAiG;IACzF,KAAK,CAAC,YAAY,CACxB,OAAgB,EAChB,WAAuC,EACvC,KAAa;QAEb,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,QAAQ;gBACX,OAAO,CACL,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACpC,WAAW,CAAC,IAAI,CACd,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,CAC7D;oBACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAC3C,CAAC;YACJ,KAAK,SAAS;gBACZ,OAAO,CACL,WAAW,CAAC,IAAI,CACd,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,IAAI,KAAK,SAAS;oBAC1B,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI;oBACpC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CACxC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CACvE,CAAC;YACJ,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAC9B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,IAAI,KAAK,UAAU;oBACzB,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;oBAC3B,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CACxC,CAAC;gBACF,OAAO,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,OAAO,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,SAA6B;QAClD,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,sBAAsB;gBACzB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAC5B;gBACE,MAAM,IAAI,4BAA4B,CACpC,mBAAmB,EACnB,oCAAoC,MAAM,CAAC,SAAS,CAAC,GAAG,CACzD,CAAC;QACN,CAAC;IACH,CAAC;IAED,yGAAyG;IACjG,aAAa,CACnB,MAAiB,EACjB,QAAgB;QAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK;aAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACpB,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,OAAO,GAAG,CAAC,IAAa,EAAQ,EAAE;YACtC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACpC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC9B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/authorization/facts.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The facts a stored row carries that its authorization tuples are
+ * derived from, as the built-in authorizer names them — the seam's
+ * `RowAuthorizationFacts` (extensions/resource-authorization.ts) with the
+ * kind beside them, because the derivation (derived-tuples.ts) reads the
+ * kind's `kind_meta` and names the object by its type.
+ *
+ * The facts have two producers and one resolver. A LOADED row (the
+ * point-check driver's path, `rowFactsOf`) and a list lane's candidate
+ * (`ListEntryMeta`, built by the lanes' shared helper; `rowFactsOfEntry`)
+ * both read through pipeline/steps/authorization-facts.ts — the read-time
+ * twin of the tuple lifecycle's create-time resolution, lenient where that
+ * one throws (a legacy row's missing organization is a fact, not a fault),
+ * and pinned equal to it in __tests__/facts.test.ts. Naming the shape once
+ * is what lets the derivation stay one function and what states exactly
+ * which facts a list candidate must carry: a candidate's facts ARE these,
+ * so a list evaluates the model over what the lane already decoded and
+ * never reads a candidate's row a second time.
+ */
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { RowAuthorizationFacts } from "../extensions/resource-authorization.js";
+export interface RowFacts extends RowAuthorizationFacts {
+    readonly kind: ApiResourceKind;
+}
+/** The facts of a loaded row of `kind`. */
+export declare function rowFactsOf(kind: ApiResourceKind, row: object): RowFacts;
+/** The facts a list candidate of `kind` carries — the same facts, already read by the lane's helper. */
+export declare function rowFactsOfEntry(kind: ApiResourceKind, entry: RowAuthorizationFacts): RowFacts;
+//# sourceMappingURL=facts.d.ts.map

package/dist/authorization/facts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facts.d.ts","sourceRoot":"","sources":["../../src/authorization/facts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAE3H,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAGrF,MAAM,WAAW,QAAS,SAAQ,qBAAqB;IACrD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC;AAED,2CAA2C;AAC3C,wBAAgB,UAAU,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,CAEvE;AAED,wGAAwG;AACxG,wBAAgB,eAAe,CAC7B,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,qBAAqB,GAC3B,QAAQ,CASV"}

package/dist/authorization/facts.js

@@ -0,0 +1,17 @@
+import { rowAuthorizationFactsOf } from "../pipeline/steps/authorization-facts.js";
+/** The facts of a loaded row of `kind`. */
+export function rowFactsOf(kind, row) {
+    return { kind, ...rowAuthorizationFactsOf(kind, row) };
+}
+/** The facts a list candidate of `kind` carries — the same facts, already read by the lane's helper. */
+export function rowFactsOfEntry(kind, entry) {
+    return {
+        kind,
+        id: entry.id,
+        org: entry.org,
+        visibility: entry.visibility,
+        createdBy: entry.createdBy,
+        parentLinks: entry.parentLinks,
+    };
+}
+//# sourceMappingURL=facts.js.map

package/dist/authorization/facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"facts.js","sourceRoot":"","sources":["../../src/authorization/facts.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAMnF,2CAA2C;AAC3C,MAAM,UAAU,UAAU,CAAC,IAAqB,EAAE,GAAW;IAC3D,OAAO,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,eAAe,CAC7B,IAAqB,EACrB,KAA4B;IAE5B,OAAO;QACL,IAAI;QACJ,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;AACJ,CAAC"}

package/dist/authorization/lane-admission.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Lane admission over the Authorizer seam — open source's rendering of
+ * the cloud's decorator (stigmer-cloud `authorizer/lane-admission.ts`,
+ * stigmer-cloud#709), composed around the built-in Authorizer under the
+ * built-in authorization posture (boot/compose.ts).
+ *
+ * The OSS AuthorizeRunTarget step asks the Authorizer, for every caller
+ * but the internal class, whether the caller may run what a session or
+ * execution targets — the run-gate checks (`isRunGateCheck`, the
+ * OSS-owned definition of that set: `can_execute` on the blueprints and
+ * instances, `can_create_execution_in` on a session). A runner acting
+ * for a WORKFLOW execution creates the workflow's child agent executions
+ * (the `agent_call` activity), and it does so AS THE HUMAN whose workflow
+ * it is (runnerauth/runner-subject-verifier.ts). Checked as that human,
+ * a member running an organization-visible workflow that calls another
+ * member's private agent would be refused at the child create — but
+ * the parent workflow execution already passed its own run gate, and
+ * the human's visibility of the agents a shared workflow calls is not
+ * the question. The cloud admits its `workflow_sandbox` lane on exactly
+ * these checks for exactly this reason; this decorator gives an
+ * enforcing self-host the same answer, so a workflow behaves the same in
+ * both editions (the parent program's rule: nothing diverges silently).
+ *
+ * Why a predicate and not a class set: the cloud keys its decorator on
+ * `callerClass` because there the class IS the token type. In open
+ * source the class is `runner` for every bound execution, and the
+ * binding's KIND lives in the token, readable by the one function that
+ * interprets runner tokens (`isWorkflowBoundRunner` in
+ * runnerauth/built-in-runner-credential-provider.ts). Handing that
+ * reading in as `isAdmittedLane` keeps this module free of token
+ * knowledge and lets the cloud adopt the same shape later without a
+ * second class name. An AGENT-bound runner is NOT admitted: a subagent
+ * create is checked as the human, the cloud's `sandbox` posture.
+ *
+ * Narrow by construction: an admitted lane on any NON-run-gate check,
+ * and any other caller on any check, delegate untouched. The cloud's
+ * header records one caveat — a human who can view a workflow execution
+ * can exchange for its token and replay it against the run gate. Open
+ * source has no such caveat: under this posture the exchange is a mint
+ * gate that answers only the run's own person (the built-in provider's
+ * exchangeScopedToken, runnerauth/built-in-runner-credential-provider.ts),
+ * so the only human who can hold a workflow's credential is the one whose
+ * workflow it is — and their own run gate already passed.
+ */
+import type { CallerIdentity } from "../extensions/identity.js";
+import type { Authorizer } from "../extensions/authorizer.js";
+/** Whether `caller` is a lane whose admission to CREATE a run was decided upstream. */
+export type LaneAdmissionPredicate = (caller: CallerIdentity) => boolean;
+export declare function newLaneAdmittedAuthorizer(inner: Authorizer, isAdmittedLane: LaneAdmissionPredicate): Authorizer;
+//# sourceMappingURL=lane-admission.d.ts.map

package/dist/authorization/lane-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lane-admission.d.ts","sourceRoot":"","sources":["../../src/authorization/lane-admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EACV,UAAU,EAGX,MAAM,6BAA6B,CAAC;AAKrC,uFAAuF;AACvF,MAAM,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC;AAEzE,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,UAAU,EACjB,cAAc,EAAE,sBAAsB,GACrC,UAAU,CAYZ"}

package/dist/authorization/lane-admission.js

@@ -0,0 +1,13 @@
+import { isRunGateCheck } from "../pipeline/steps/authorize-run-target.js";
+const ADMITTED = { kind: "allow" };
+export function newLaneAdmittedAuthorizer(inner, isAdmittedLane) {
+    return {
+        authorize(caller, check) {
+            if (isRunGateCheck(check) && isAdmittedLane(caller)) {
+                return Promise.resolve(ADMITTED);
+            }
+            return inner.authorize(caller, check);
+        },
+    };
+}
+//# sourceMappingURL=lane-admission.js.map

package/dist/authorization/lane-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lane-admission.js","sourceRoot":"","sources":["../../src/authorization/lane-admission.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAE3E,MAAM,QAAQ,GAAkB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAKlD,MAAM,UAAU,yBAAyB,CACvC,KAAiB,EACjB,cAAsC;IAEtC,OAAO;QACL,SAAS,CACP,MAAsB,EACtB,KAAiB;YAEjB,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpD,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authorization/list-read-scope.d.ts

@@ -0,0 +1,18 @@
+import type { Logger } from "../boot/logger.js";
+import type { IamPolicyStore } from "../domain/iampolicy/store.js";
+import type { ListReadScope } from "../extensions/list-read-scope.js";
+import type { Store } from "../store/interface.js";
+import type { Model } from "./model/index.js";
+import type { AccountsByCaller } from "./person.js";
+export interface BuiltInListReadScopeDeps {
+    readonly store: Store;
+    /** The port the grant path writes through — the person's rows are read from the same instance. */
+    readonly policies: IamPolicyStore;
+    /** The account port: the caller's account, and the parent hops that land on one. */
+    readonly accounts: AccountsByCaller;
+    readonly logger: Logger;
+    /** The declarations to evaluate; the built-in model unless a test says otherwise. */
+    readonly model?: Model;
+}
+export declare function newBuiltInListReadScope(deps: BuiltInListReadScopeDeps): ListReadScope;
+//# sourceMappingURL=list-read-scope.d.ts.map

package/dist/authorization/list-read-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-read-scope.d.ts","sourceRoot":"","sources":["../../src/authorization/list-read-scope.ts"],"names":[],"mappings":"AA4DA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAKnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAUpD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,aAAa,CAoHf"}

package/dist/authorization/list-read-scope.js

@@ -0,0 +1,155 @@
+/**
+ * The built-in list read scope — open source's driver for the list-read
+ * seam (extensions/list-read-scope.ts), composed under the built-in
+ * posture (posture.ts). The cloud's driver asks OpenFGA `can_view` for
+ * every candidate a list lane offers and ListObjects for the enumeration
+ * lanes; this one asks the same question of the same model, evaluated by
+ * the same evaluator the built-in Authorizer uses (evaluator.ts), over
+ * the tuples each candidate's row would have had — derived from the
+ * facts the candidate already carries (`ListEntryMeta` is the row's
+ * `RowAuthorizationFacts`; facts.ts), so a list never reads a candidate's
+ * row a second time. A self-host's lists show a person exactly what a
+ * `get` would let them read.
+ *
+ * Both verbs ask under the LISTING context, `allow: false` — the public
+ * wildcard suppressed, the cloud's own posture (its Java
+ * listAuthorizedResourceIds set it): a legacy PUBLIC row reads for any
+ * signed-in person on a point check and never expands into an outsider's
+ * listing; the organization's own people still reach it through the
+ * org-viewer shape public also emits.
+ *
+ *   - `restrictListEntries`: one derived source for the caller, seeded
+ *     with every candidate's facts; one `checkRelation` per unique id —
+ *     one evaluator walk per candidate, never shared, because the walk's
+ *     memo and its cycle detector are one object and a shared walk would
+ *     read a second candidate's in-flight resolution of the same pair as
+ *     a cycle. The candidates run concurrently: the only shared state is
+ *     the source, whose promise memo dedupes the loads (the person's rows
+ *     once; each distinct parent once — an execution list reads its
+ *     distinct SESSIONS, entry 9's parent-check exactly). The kept set is
+ *     a subset of the offered ids; order is the lane's.
+ *   - `authorizedResourceIds`: the kind scanned, decoded and evaluated
+ *     the same way. There is no tuple index to enumerate from and the
+ *     answer is genuinely not "everything" (private blueprints exist), so
+ *     the verb costs one scan of the kind — the console library rides
+ *     it (blueprints have no list RPC; the library is a search), measured
+ *     and recorded rather than assumed. A row that does not decode is
+ *     skipped with a warning, the `loadAll*` idiom every lane follows: no
+ *     lane can show it either.
+ *
+ * The `internal` class — the server acting as itself over the in-process
+ * transport — keeps every offered id and enumerates every id of the kind:
+ * the in-process authorization skip (pipeline/interceptors/auth.ts, ruling
+ * Q4) applied to a list answer, as the built-in directory applies it to a
+ * directory answer. No in-process edge reaches a list lane today; the arm
+ * is pinned so a future one meets the same rule every other lane keeps.
+ *
+ * Faults THROW and are never an empty answer (the seam: an empty set means
+ * "authorized to see nothing"; an outage is the pipeline's sanitized
+ * INTERNAL). A kind the model does not declare is a consumer bug by the
+ * seam's contract and faults through the evaluator, loud; the model
+ * declares exactly the open-source tier, so no served lane can reach it.
+ *
+ * Logging. One debug line per call — kind, offered, kept, elapsed — what
+ * an operator needs to answer "why is Alice's list short" beside the
+ * Authorizer's per-denial lines; never the token.
+ */
+import { fromBinary } from "@bufbuild/protobuf";
+import { kindEnumName } from "../pipeline/apiresource-meta.js";
+import { newDerivedTupleSource } from "./derived-tuples.js";
+import { AuthorizationEvaluationError, checkRelation } from "./evaluator.js";
+import { rowFactsOf, rowFactsOfEntry } from "./facts.js";
+import { builtInModel } from "./model/index.js";
+import { resolvePerson } from "./person.js";
+/** The relation every list lane reads through (the cloud's LIST_RELATION). */
+const LIST_RELATION = "can_view";
+/** The listing context: the public wildcard suppressed (the module header). */
+const LISTING = { allow: false };
+export function newBuiltInListReadScope(deps) {
+    const model = deps.model ?? builtInModel;
+    /** The candidates the caller may view, each answered by its own walk over one seeded source. */
+    async function visibleAmong(caller, kind, candidates) {
+        if (candidates.length === 0) {
+            return new Set();
+        }
+        const started = performance.now();
+        const person = await resolvePerson(deps.accounts, caller);
+        const source = newDerivedTupleSource({
+            store: deps.store,
+            policies: deps.policies,
+            accounts: deps.accounts,
+            model,
+        }, person, { facts: candidates });
+        const type = kindEnumName(kind);
+        const answers = await Promise.all(candidates.map(async (facts) => {
+            const object = { type, id: facts.id };
+            const allowed = await checkRelation({ model, source }, object, LIST_RELATION, person, LISTING);
+            return allowed ? facts.id : undefined;
+        }));
+        const kept = new Set();
+        for (const id of answers) {
+            if (id !== undefined) {
+                kept.add(id);
+            }
+        }
+        deps.logger.debug("list scope evaluated candidates", {
+            account: person.accountId,
+            kind: type,
+            offered: candidates.length,
+            kept: kept.size,
+            elapsedMs: Math.round(performance.now() - started),
+        });
+        return kept;
+    }
+    /** The declaration a verb evaluates against; an undeclared kind is the evaluator's own fault, raised before any read. */
+    function requireDeclared(kind) {
+        const declaration = model.byKind(kind);
+        if (declaration === undefined) {
+            throw new AuthorizationEvaluationError("undeclared-target-kind", `no declaration for kind '${kindEnumName(kind)}' — a list lane asked the scope about a kind the model does not declare`);
+        }
+        return declaration;
+    }
+    /** Every row of `kind` the store holds, as facts; a row that does not decode is skipped. */
+    async function everyRowOf(declaration) {
+        const kind = declaration.kind;
+        const rows = await deps.store.listResources(kind);
+        const facts = [];
+        for (const bytes of rows) {
+            try {
+                facts.push(rowFactsOf(kind, fromBinary(declaration.schema, bytes)));
+            }
+            catch (error) {
+                deps.logger.warn("list scope skipped a row that does not decode", {
+                    kind: kindEnumName(kind),
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        return facts;
+    }
+    return {
+        async restrictListEntries(caller, kind, entries) {
+            requireDeclared(kind);
+            // One candidate per unique id: a lane offers each row once, and a
+            // duplicate would only spend a walk to learn the same answer.
+            const unique = new Map();
+            for (const entry of entries) {
+                if (!unique.has(entry.id)) {
+                    unique.set(entry.id, rowFactsOfEntry(kind, entry));
+                }
+            }
+            if (caller.callerClass === "internal") {
+                return new Set(unique.keys());
+            }
+            return visibleAmong(caller, kind, [...unique.values()]);
+        },
+        async authorizedResourceIds(caller, kind) {
+            const candidates = await everyRowOf(requireDeclared(kind));
+            if (caller.callerClass === "internal") {
+                return new Set(candidates.map((facts) => facts.id));
+            }
+            return visibleAmong(caller, kind, candidates);
+        },
+    };
+}
+//# sourceMappingURL=list-read-scope.js.map

package/dist/authorization/list-read-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-read-scope.js","sourceRoot":"","sources":["../../src/authorization/list-read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAWhD,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,8EAA8E;AAC9E,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,+EAA+E;AAC/E,MAAM,OAAO,GAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAa/C,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IAEzC,gGAAgG;IAChG,KAAK,UAAU,YAAY,CACzB,MAAsB,EACtB,IAAqB,EACrB,UAAmC;QAEnC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAW,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,qBAAqB,CAClC;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK;SACN,EACD,MAAM,EACN,EAAE,KAAK,EAAE,UAAU,EAAE,CACtB,CAAC;QACF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,MAAM,MAAM,GAAc,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,MAAM,EACN,aAAa,EACb,MAAM,EACN,OAAO,CACR,CAAC;YACF,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxC,CAAC,CAAC,CACH,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACnD,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,UAAU,CAAC,MAAM;YAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yHAAyH;IACzH,SAAS,eAAe,CAAC,IAAqB;QAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,4BAA4B,CACpC,wBAAwB,EACxB,4BAA4B,YAAY,CAAC,IAAI,CAAC,yEAAyE,CACxH,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,4FAA4F;IAC5F,KAAK,UAAU,UAAU,CAAC,WAA4B;QACpD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBAChE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;oBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,KAAK,CAAC,mBAAmB,CACvB,MAAsB,EACtB,IAAqB,EACrB,OAAqC;YAErC,eAAe,CAAC,IAAI,CAAC,CAAC;YACtB,kEAAkE;YAClE,8DAA8D;YAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC3C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,CAAC,qBAAqB,CACzB,MAAsB,EACtB,IAAqB;YAErB,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authorization/model/agent.d.ts

@@ -0,0 +1,2 @@
+export declare const agentDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=agent.d.ts.map

package/dist/authorization/model/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,gBAAgB,wCAuC3B,CAAC"}

package/dist/authorization/model/agent.js

@@ -0,0 +1,42 @@
+/**
+ * Transcript of fga/model/agentic/agent.fga — a blueprint: owned by its
+ * creator and by the organization's admins (`admin from organization`),
+ * read by whoever the visibility axis lets in. The `organization#member`
+ * and `organization#viewer` usersets on `viewer` are the org-visibility
+ * tuple's two shapes (the cloud writes `#viewer` since cloud#257; `#member`
+ * is the legacy shape it still honours), the conditional wildcard is the
+ * public level, and `platform_viewer` is an identity-provider userset no
+ * open-source tuple ever names.
+ */
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, from, objectOf, publicWith, union, usersetOf, } from "./rewrite.js";
+export const agentDeclaration = declareKind({
+    kind: ApiResourceKind.agent,
+    schema: AgentSchema,
+    source: "fga/model/agentic/agent.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        [
+            "owner",
+            union(direct(objectOf("identity_account")), from("admin", "organization")),
+        ],
+        [
+            "platform_viewer",
+            direct(usersetOf("identity_provider", "platform_user")),
+        ],
+        [
+            "viewer",
+            union(direct(objectOf("identity_account"), publicWith("identity_account", "allow_public"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), computed("platform_viewer")),
+        ],
+        ["can_view", computed("viewer")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_execute", computed("viewer")],
+        ["can_create_instance", computed("can_execute")],
+        ["can_clone", computed("viewer")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+});
+//# sourceMappingURL=agent.js.map

package/dist/authorization/model/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../../src/authorization/model/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;IAC1C,IAAI,EAAE,eAAe,CAAC,KAAK;IAC3B,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,6BAA6B;IACrC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,UAAU,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAC9C,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,qBAAqB,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChD,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/agent_channel.d.ts

@@ -0,0 +1,2 @@
+export declare const agentChannelDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=agent_channel.d.ts.map

package/dist/authorization/model/agent_channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent_channel.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent_channel.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,uBAAuB,wCA4BlC,CAAC"}

package/dist/authorization/model/agent_channel.js

@@ -0,0 +1,38 @@
+/**
+ * Transcript of fga/model/agentic/agent_channel.fga — a channel binding,
+ * admin-owned like a blueprint, with `participant` as the one relation
+ * between owner and viewer: the conversation-participation role
+ * (reply and takeover without configuration authority), grantable as a
+ * role on this kind alone. Every owner participates; every participant
+ * views.
+ */
+import { AgentChannelSchema } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
+export const agentChannelDeclaration = declareKind({
+    kind: ApiResourceKind.agent_channel,
+    schema: AgentChannelSchema,
+    source: "fga/model/agentic/agent_channel.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        [
+            "owner",
+            union(direct(objectOf("identity_account")), from("admin", "organization")),
+        ],
+        [
+            "participant",
+            union(direct(objectOf("identity_account")), computed("owner")),
+        ],
+        [
+            "viewer",
+            union(direct(objectOf("identity_account")), computed("participant")),
+        ],
+        ["can_view", computed("viewer")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_participate", computed("participant")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+});
+//# sourceMappingURL=agent_channel.js.map

package/dist/authorization/model/agent_channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent_channel.js","sourceRoot":"","sources":["../../../src/authorization/model/agent_channel.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;IACjD,IAAI,EAAE,eAAe,CAAC,aAAa;IACnC,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,qCAAqC;IAC7C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,aAAa;YACb,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;SAC/D;QACD;YACE,QAAQ;YACR,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;SACrE;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC5C,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/agent_execution.d.ts

@@ -0,0 +1,2 @@
+export declare const agentExecutionDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=agent_execution.d.ts.map

package/dist/authorization/model/agent_execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent_execution.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent_execution.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,yBAAyB,wCAWpC,CAAC"}

package/dist/authorization/model/agent_execution.js

@@ -0,0 +1,25 @@
+/**
+ * Transcript of fga/model/agentic/agent_execution.fga — a run is its
+ * session's: no owner tuple of its own (`kind_meta` attribution
+ * INHERITED), every relation a hop through `session`, which the
+ * derivation writes from `spec.session_id`. `can_view: viewer or
+ * can_view from session` walks a parent PERMISSION whose own arms include
+ * the session's channel and schedule hops; the evaluator resolves those
+ * on the session's declaration, so this file needs no knowledge of them.
+ */
+import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
+export const agentExecutionDeclaration = declareKind({
+    kind: ApiResourceKind.agent_execution,
+    schema: AgentExecutionSchema,
+    source: "fga/model/agentic/agent_execution.fga",
+    relations: [
+        ["session", direct(objectOf("session"))],
+        ["owner", from("owner", "session")],
+        ["viewer", union(from("viewer", "session"), computed("owner"))],
+        ["can_view", union(computed("viewer"), from("can_view", "session"))],
+        ["can_edit", computed("owner")],
+    ],
+});
+//# sourceMappingURL=agent_execution.js.map

package/dist/authorization/model/agent_execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent_execution.js","sourceRoot":"","sources":["../../../src/authorization/model/agent_execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAAC;IACnD,IAAI,EAAE,eAAe,CAAC,eAAe;IACrC,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,uCAAuC;IAC/C,SAAS,EAAE;QACT,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACxC,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnC,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;QACpE,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAChC;CACF,CAAC,CAAC"}