@stigmer/server 3.22.1-dev.20260922095755 → 3.22.1

package/dist/authorization/authorizer.d.ts

@@ -17,7 +17,9 @@
  *   2. A kind this edition does not serve is `deny` (`kindServedByEdition`,
  *      the predicate 2b's `checkMyPermission` arm 1 uses, so the console
  *      and the server agree by construction). `platform` is the one that
- *      can arrive, through an operator capability no self-host holds.
+ *      arrives, through `can_set_public_visibility` — under the built-in
+ *      posture nobody sets public visibility, the model's own reason for
+ *      making it a platform operator's act.
  *   3. The caller as a person (person.ts) and one derived tuple source for
  *      them; the target loaded ONCE through the source's memoised loader,
  *      so the read that decides not-found is the read the derivation
@@ -29,9 +31,11 @@
  *      member cannot learn which account ids exist. Present or exempt, the
  *      row is then evaluated: the cloud asks OpenFGA whether or not the row
  *      exists, and so does this driver.
- *   5. `checkRelation`. True is `allow`; false is `deny` with an EMPTY
- *      reason, so the method annotation's byte-pinned `error_msg` wins on
- *      the wire, exactly the cloud's genuine-denial path.
+ *   5. `checkRelation` with the point-check context (`allow: true`: a
+ *      public resource reads for any authenticated caller, the cloud's
+ *      posture). True is `allow`; false is `deny` with an EMPTY reason, so
+ *      the method annotation's byte-pinned `error_msg` wins on the wire,
+ *      exactly the cloud's genuine-denial path.
  *
  * Faults. Everything past the pre-checks runs under one guard: a store
  * fault, a person that names nobody (`personFor`), an evaluation fault

package/dist/authorization/authorizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,UAAU,EAGX,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAKpD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,eAAe,CAG9D,CAAC;AAEH,yGAAyG;AACzG,eAAO,MAAM,8BAA8B,8DACkB,CAAC;AAC9D,eAAO,MAAM,0BAA0B,+DACuB,CAAC;AAC/D,eAAO,MAAM,6BAA6B,+DACoB,CAAC;AAC/D,eAAO,MAAM,wBAAwB,mEAC6B,CAAC;AACnE,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,4EACqC,CAAC;AAE5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,UAAU,CA6E5E"}
+{"version":3,"file":"authorizer.d.ts","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAE3F,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,UAAU,EAGX,MAAM,6BAA6B,CAAC;AAMrC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAKpD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,eAAe,CAG9D,CAAC;AAEH,yGAAyG;AACzG,eAAO,MAAM,8BAA8B,8DACkB,CAAC;AAC9D,eAAO,MAAM,0BAA0B,+DACuB,CAAC;AAC/D,eAAO,MAAM,6BAA6B,+DACoB,CAAC;AAC/D,eAAO,MAAM,wBAAwB,mEAC6B,CAAC;AACnE,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,4EACqC,CAAC;AAE5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,qBAAqB,GAAG,UAAU,CA8E5E"}

package/dist/authorization/authorizer.js

@@ -17,7 +17,9 @@
  *   2. A kind this edition does not serve is `deny` (`kindServedByEdition`,
  *      the predicate 2b's `checkMyPermission` arm 1 uses, so the console
  *      and the server agree by construction). `platform` is the one that
- *      can arrive, through an operator capability no self-host holds.
+ *      arrives, through `can_set_public_visibility` — under the built-in
+ *      posture nobody sets public visibility, the model's own reason for
+ *      making it a platform operator's act.
  *   3. The caller as a person (person.ts) and one derived tuple source for
  *      them; the target loaded ONCE through the source's memoised loader,
  *      so the read that decides not-found is the read the derivation
@@ -29,9 +31,11 @@
  *      member cannot learn which account ids exist. Present or exempt, the
  *      row is then evaluated: the cloud asks OpenFGA whether or not the row
  *      exists, and so does this driver.
- *   5. `checkRelation`. True is `allow`; false is `deny` with an EMPTY
- *      reason, so the method annotation's byte-pinned `error_msg` wins on
- *      the wire, exactly the cloud's genuine-denial path.
+ *   5. `checkRelation` with the point-check context (`allow: true`: a
+ *      public resource reads for any authenticated caller, the cloud's
+ *      posture). True is `allow`; false is `deny` with an EMPTY reason, so
+ *      the method annotation's byte-pinned `error_msg` wins on the wire,
+ *      exactly the cloud's genuine-denial path.
  *
  * Faults. Everything past the pre-checks runs under one guard: a store
  * fault, a person that names nobody (`personFor`), an evaluation fault
@@ -123,7 +127,7 @@ export function newBuiltInAuthorizer(deps) {
                     });
                     return { kind: "not-found" };
                 }
-                const allowed = await checkRelation({ model, source }, object, relation, person);
+                const allowed = await checkRelation({ model, source }, object, relation, person, { allow: true });
                 if (allowed) {
                     return { kind: "allow" };
                 }

package/dist/authorization/authorizer.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAW1E,OAAO,EACL,YAAY,EACZ,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,IAAI,GAAG,CAAC;IAC1E,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,UAAU;CAC3B,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,CAAC,MAAM,8BAA8B,GACzC,2DAA2D,CAAC;AAC9D,MAAM,CAAC,MAAM,0BAA0B,GACrC,4DAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GACxC,4DAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GACnC,gEAAgE,CAAC;AACnE,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GACpC,yEAAyE,CAAC;AAe5E,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,OAAO;QACL,KAAK,CAAC,SAAS,CACb,MAAsB,EACtB,KAAiB;YAEjB,IAAI,KAAK,CAAC,UAAU,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACzC,CAAC;YAED,MAAM,MAAM,GAAc;gBACxB,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC;gBACtC,EAAE,EAAE,KAAK,CAAC,UAAU;aACrB,CAAC;YACF,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,qBAAqB,CAClC;oBACE,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK;iBACN,EACD,MAAM,CACP,CAAC;gBACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC7C,IACE,GAAG,KAAK,SAAS;oBACjB,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAC/C,CAAC;oBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;wBAClD,OAAO,EAAE,MAAM,CAAC,SAAS;wBACzB,UAAU,EAAE,QAAQ;wBACpB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;qBAChC,CAAC,CAAC;oBACH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;gBAC/B,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,MAAM,EACN,QAAQ,EACR,MAAM,CACP,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC3B,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;oBACxC,OAAO,EAAE,MAAM,CAAC,SAAS;oBACzB,UAAU,EAAE,QAAQ;oBACpB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;iBAChC,CAAC,CAAC;gBACH,gEAAgE;gBAChE,iEAAiE;gBACjE,+BAA+B;gBAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,IAAI,EAAE,aAAa;oBACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;iBACjE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"authorizer.js","sourceRoot":"","sources":["../../src/authorization/authorizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAW1E,OAAO,EACL,YAAY,EACZ,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAiC,IAAI,GAAG,CAAC;IAC1E,eAAe,CAAC,gBAAgB;IAChC,eAAe,CAAC,UAAU;CAC3B,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,CAAC,MAAM,8BAA8B,GACzC,2DAA2D,CAAC;AAC9D,MAAM,CAAC,MAAM,0BAA0B,GACrC,4DAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,6BAA6B,GACxC,4DAA4D,CAAC;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GACnC,gEAAgE,CAAC;AACnE,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GACpC,yEAAyE,CAAC;AAe5E,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,OAAO;QACL,KAAK,CAAC,SAAS,CACb,MAAsB,EACtB,KAAiB;YAEjB,IAAI,KAAK,CAAC,UAAU,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3D,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACzC,CAAC;YAED,MAAM,MAAM,GAAc;gBACxB,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC;gBACtC,EAAE,EAAE,KAAK,CAAC,UAAU;aACrB,CAAC;YACF,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,qBAAqB,CAClC;oBACE,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK;iBACN,EACD,MAAM,CACP,CAAC;gBACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC7C,IACE,GAAG,KAAK,SAAS;oBACjB,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,EAC/C,CAAC;oBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;wBAClD,OAAO,EAAE,MAAM,CAAC,SAAS;wBACzB,UAAU,EAAE,QAAQ;wBACpB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;qBAChC,CAAC,CAAC;oBACH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;gBAC/B,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,MAAM,EACN,QAAQ,EACR,MAAM,EACN,EAAE,KAAK,EAAE,IAAI,EAAE,CAChB,CAAC;gBACF,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC3B,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE;oBACxC,OAAO,EAAE,MAAM,CAAC,SAAS;oBACzB,UAAU,EAAE,QAAQ;oBACpB,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC;iBAChC,CAAC,CAAC;gBACH,gEAAgE;gBAChE,iEAAiE;gBACjE,+BAA+B;gBAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,IAAI,EAAE,aAAa;oBACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;iBACjE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/authorization/derived-tuples.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"derived-tuples.d.ts","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"AAgEA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAQ/E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAEV,MAAM,EACN,SAAS,EAET,KAAK,EACL,WAAW,EACZ,MAAM,aAAa,CAAC;AAGrB;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,eAAe,CAEhE,CAAC;AAMH,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,KAAK,EAAE,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAuDlE;AA8BD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,uHAAuH;IACvH,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAC1D,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,sBAAsB,GAC5B,kBAAkB,CAoFpB"}
+{"version":3,"file":"derived-tuples.d.ts","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"AAiEA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAQ/E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAEV,MAAM,EACN,SAAS,EAET,KAAK,EACL,WAAW,EACZ,MAAM,aAAa,CAAC;AAOrB;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,eAAe,CAEhE,CAAC;AAMH,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,KAAK,EAAE,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAuDlE;AAoCD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,uHAAuH;IACvH,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAC1D,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;CACzC;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,sBAAsB,GAC5B,kBAAkB,CAoFpB"}

package/dist/authorization/derived-tuples.js

@@ -6,7 +6,7 @@ import { visibilityShapesFor } from "../pipeline/steps/authorization-tuples.js";
 import { ResourceNotFoundError } from "../store/interface.js";
 import { rowFactsOf } from "./facts.js";
 import { builtInModel } from "./model/index.js";
-import { ACCOUNT_TYPE, formatObjectRef } from "./tuples.js";
+import { ACCOUNT_TYPE, ALLOW_PUBLIC_CONDITION, formatObjectRef, } from "./tuples.js";
 /**
  * Kinds whose `[identity_account]` owner is recorded as an IamPolicy row
  * by this edition (the module header): the derivation writes no owner
@@ -88,6 +88,12 @@ function visibilitySubject(shape, org) {
                     object: { type: "organization", id: org },
                     relation: "viewer",
                 };
+        case "public-viewer":
+            return {
+                form: "wildcard",
+                type: ACCOUNT_TYPE,
+                condition: ALLOW_PUBLIC_CONDITION,
+            };
         case "platform-viewer":
             return undefined;
         default: {
@@ -208,18 +214,27 @@ function tupleOfRow(row) {
         type: principal?.kind ?? "",
         id: principal?.id ?? "",
     };
-    // A principal id of `*` (a wildcard row a cloud database may still hold
-    // from the retired public level) is read as an ordinary object id here:
-    // no person carries `*` among their aliases, so the row matches nobody
-    // and reads as the inert grant it is, never as a fault that would turn
-    // the resource unreadable.
-    const subject = principal !== undefined && principal.relation !== ""
-        ? {
+    let subject;
+    if (principal !== undefined && principal.relation !== "") {
+        subject = {
             form: "userset",
             object: principalObject,
             relation: principal.relation,
-        }
-        : { form: "object", object: principalObject };
+        };
+    }
+    else if (principalObject.id === "*") {
+        // A wildcard row carries no condition of its own; the evaluator
+        // honours it only where a line admits an unconditioned wildcard,
+        // which no line in the model does.
+        subject = {
+            form: "wildcard",
+            type: principalObject.type,
+            condition: undefined,
+        };
+    }
+    else {
+        subject = { form: "object", object: principalObject };
+    }
     return { object, relation: spec?.relation ?? "", subject };
 }
 //# sourceMappingURL=derived-tuples.js.map

package/dist/authorization/derived-tuples.js.map

@@ -1 +1 @@
-{"version":3,"file":"derived-tuples.js","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"AAgEA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AAG9H,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAIlE,OAAO,EACL,WAAW,EACX,cAAc,EACd,YAAY,GACb,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAEhF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAShD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAiC,IAAI,GAAG,CAAC;IAC5E,eAAe,CAAC,YAAY;CAC7B,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,EAAU;IACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,KAAe;IAC1C,MAAM,MAAM,GAAc,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IACrD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE;aACnE;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,oBAAoB,CAAC,MAAM;YAC9B,IAAI,aAAa,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,MAAM,CAAC,IAAI,CAAC;oBACV,MAAM;oBACN,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,oBAAoB,CAAC,IAAI;YAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,MAAM;QACR,KAAK,oBAAoB,CAAC,SAAS,CAAC;QACpC,KAAK,oBAAoB,CAAC,IAAI,CAAC;QAC/B,KAAK,oBAAoB,CAAC,WAAW;YACnC,iFAAiF;YACjF,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC,SAAS,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM;YACN,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oGAAoG;AACpG,SAAS,iBAAiB,CACxB,KAA2B,EAC3B,GAAW;IAEX,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,YAAY;YACf,0DAA0D;YAC1D,OAAO,GAAG,KAAK,EAAE;gBACf,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;oBACzC,QAAQ,EAAE,QAAQ;iBACnB,CAAC;QACR,KAAK,iBAAiB;YACpB,OAAO,SAAS,CAAC;QACnB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAiCD,MAAM,UAAU,qBAAqB,CACnC,IAA4B,EAC5B,MAAc,EACd,IAA6B;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CACR,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EACjE,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,UAAqD,CAAC;IAE1D,MAAM,MAAM,GAAc;QACxB,IAAI,CAAC,MAAM;YACT,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IAEF,SAAS,eAAe,CAAC,MAAiB;QACxC,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,QAAuC,CAAC;QAC5C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM;iBACd,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,KAAK,SAAS;gBACf,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CACpD,CAAC;QACN,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS,SAAS;QAChB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,UAAU,GAAG,IAAI,CAAC,QAAQ;iBACvB,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC;iBAC/C,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO;QACL,MAAM;QACN,YAAY,EAAE,SAAS;QACvB,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ;YAC7B,MAAM,MAAM,GAAG,CAAC,KAAY,EAAW,EAAE,CACvC,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAC3B,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBACjC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,KAAK,UAAU,OAAO,CACpB,IAAwD,EACxD,KAAY,EACZ,MAAiB;IAEjB,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,IACE,WAAW,KAAK,SAAS;QACzB,IAAI,KAAK,eAAe,CAAC,yBAAyB;QAClD,MAAM,CAAC,EAAE,KAAK,EAAE,EAChB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,GAAc;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;IAChC,MAAM,MAAM,GAAc;QACxB,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE;QAC1B,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;KACvB,CAAC;IACF,MAAM,eAAe,GAAc;QACjC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE;QAC3B,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;KACxB,CAAC;IACF,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,2BAA2B;IAC3B,MAAM,OAAO,GACX,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE;QAClD,CAAC,CAAC;YACE,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,SAAS,CAAC,QAAQ;SAC7B;QACH,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAClD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"derived-tuples.js","sourceRoot":"","sources":["../../src/authorization/derived-tuples.ts"],"names":[],"mappings":"AAiEA,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wFAAwF,CAAC;AAG9H,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAIlE,OAAO,EACL,WAAW,EACX,cAAc,EACd,YAAY,GACb,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAEhF,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAShD,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAiC,IAAI,GAAG,CAAC;IAC5E,eAAe,CAAC,YAAY;CAC7B,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,EAAU;IACzB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,KAAe;IAC1C,MAAM,MAAM,GAAc,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;IACrD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC;YACV,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE;aACnE;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrD,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;QACzB,KAAK,oBAAoB,CAAC,MAAM;YAC9B,IAAI,aAAa,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,MAAM,CAAC,IAAI,CAAC;oBACV,MAAM;oBACN,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,oBAAoB,CAAC,IAAI;YAC5B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvE,MAAM;QACR,KAAK,oBAAoB,CAAC,SAAS,CAAC;QACpC,KAAK,oBAAoB,CAAC,IAAI,CAAC;QAC/B,KAAK,oBAAoB,CAAC,WAAW;YACnC,iFAAiF;YACjF,MAAM;QACR,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC,SAAS,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM;YACN,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oGAAoG;AACpG,SAAS,iBAAiB,CACxB,KAA2B,EAC3B,GAAW;IAEX,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,YAAY;YACf,0DAA0D;YAC1D,OAAO,GAAG,KAAK,EAAE;gBACf,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC;oBACE,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;oBACzC,QAAQ,EAAE,QAAQ;iBACnB,CAAC;QACR,KAAK,eAAe;YAClB,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,YAAY;gBAClB,SAAS,EAAE,sBAAsB;aAClC,CAAC;QACJ,KAAK,iBAAiB;YACpB,OAAO,SAAS,CAAC;QACnB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAiCD,MAAM,UAAU,qBAAqB,CACnC,IAA4B,EAC5B,MAAc,EACd,IAA6B;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CACR,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,EACjE,KAAK,CACN,CAAC;IACJ,CAAC;IACD,IAAI,UAAqD,CAAC;IAE1D,MAAM,MAAM,GAAc;QACxB,IAAI,CAAC,MAAM;YACT,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IAEF,SAAS,eAAe,CAAC,MAAiB;QACxC,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,QAAuC,CAAC;QAC5C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM;iBACd,IAAI,CAAC,MAAM,CAAC;iBACZ,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG,KAAK,SAAS;gBACf,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CACpD,CAAC;QACN,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,SAAS,SAAS;QAChB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,UAAU,GAAG,IAAI,CAAC,QAAQ;iBACvB,eAAe,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC;iBAC/C,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO;QACL,MAAM;QACN,YAAY,EAAE,SAAS;QACvB,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ;YAC7B,MAAM,MAAM,GAAG,CAAC,KAAY,EAAW,EAAE,CACvC,KAAK,CAAC,QAAQ,KAAK,QAAQ;gBAC3B,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBACjC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,KAAK,UAAU,OAAO,CACpB,IAAwD,EACxD,KAAY,EACZ,MAAiB;IAEjB,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,IACE,WAAW,KAAK,SAAS;QACzB,IAAI,KAAK,eAAe,CAAC,yBAAyB;QAClD,MAAM,CAAC,EAAE,KAAK,EAAE,EAChB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,GAAc;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IAClC,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,CAAC;IAChC,MAAM,MAAM,GAAc;QACxB,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE;QAC1B,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE;KACvB,CAAC;IACF,MAAM,eAAe,GAAc;QACjC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE;QAC3B,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE;KACxB,CAAC;IACF,IAAI,OAAgB,CAAC;IACrB,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACzD,OAAO,GAAG;YACR,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,SAAS,CAAC,QAAQ;SAC7B,CAAC;IACJ,CAAC;SAAM,IAAI,eAAe,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;QACtC,gEAAgE;QAChE,iEAAiE;QACjE,mCAAmC;QACnC,OAAO,GAAG;YACR,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,SAAS,EAAE,SAAS;SACrB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC"}

package/dist/authorization/evaluator.d.ts

@@ -1,11 +1,10 @@
 /**
  * The evaluator — OpenFGA's check, over the built-in model and a tuple
  * source, small because the model uses four rewrite forms and nothing
- * else (model/rewrite.ts). `checkRelation(object, relation, person)`
+ * else (model/rewrite.ts). `checkRelation(object, relation, person, context)`
  * answers "does this person hold this relation on this object" the way
  * the cloud's engine answers it over stored tuples, so the two editions
- * share one meaning of authorization. There is no context parameter: the
- * model declares no condition, so a check has no posture to state.
+ * share one meaning of authorization.
  *
  * The walk, in the order a `.fga` line reads:
  *   - `this`: the tuples on (object, relation). A tuple counts only if
@@ -13,7 +12,9 @@
  *     OpenFGA makes at write time, made here at read time, so a derived
  *     tuple the model no longer admits denies instead of allowing. An
  *     object subject matches when it names one of the person's aliases;
- *     a userset subject is resolved on its own object.
+ *     a userset subject is resolved on its own object; the wildcard is
+ *     honoured only under its condition (`allow_public` reads the
+ *     context's `allow`; an unknown condition is a fault).
  *   - `computed`: the same object, another relation.
  *   - `from`: every object the tupleset relation links to (again within
  *     the tupleset line's type restriction), resolved for the relation.
@@ -42,7 +43,7 @@
  * denial.
  */
 import type { Model } from "./model/index.js";
-import type { ObjectRef, Person, TupleSource } from "./tuples.js";
+import type { CheckContext, ObjectRef, Person, TupleSource } from "./tuples.js";
 /**
  * OpenFGA's default resolution-depth limit (its `resolveNodeLimit`), so
  * the bound here is the oracle's own and not a number chosen locally. The
@@ -57,7 +58,7 @@ export declare const MAX_RESOLUTION_DEPTH = 25;
  * offered to the list scope's restrict verb, which the shared helper
  * answers before any driver); the rest are the model's own.
  */
-export type EvaluationFault = "undeclared-target-kind" | "internal-caller-offered" | "resolution-depth-exceeded" | "resolution-cycle";
+export type EvaluationFault = "undeclared-target-kind" | "internal-caller-offered" | "resolution-depth-exceeded" | "resolution-cycle" | "unknown-condition";
 /** A fault in the model or its evaluation — never a denial; the driver maps it to `unavailable`. */
 export declare class AuthorizationEvaluationError extends Error {
     readonly reason: EvaluationFault;
@@ -67,5 +68,5 @@ export interface EvaluationDeps {
     readonly model: Model;
     readonly source: TupleSource;
 }
-export declare function checkRelation(deps: EvaluationDeps, object: ObjectRef, relation: string, person: Person): Promise<boolean>;
+export declare function checkRelation(deps: EvaluationDeps, object: ObjectRef, relation: string, person: Person, context: CheckContext): Promise<boolean>;
 //# sourceMappingURL=evaluator.d.ts.map

package/dist/authorization/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/authorization/evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAW,WAAW,EAAE,MAAM,aAAa,CAAC;AAG3E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB,wBAAwB,GACxB,yBAAyB,GACzB,2BAA2B,GAC3B,kBAAkB,CAAC;AAEvB,oGAAoG;AACpG,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;gBAErB,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM;CAKrD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAQlB"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/authorization/evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,MAAM,EAEN,WAAW,EACZ,MAAM,aAAa,CAAC;AAQrB;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB,wBAAwB,GACxB,yBAAyB,GACzB,2BAA2B,GAC3B,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,oGAAoG;AACpG,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;gBAErB,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM;CAKrD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,OAAO,CAAC,CAQlB"}

package/dist/authorization/evaluator.js

@@ -1,4 +1,4 @@
-import { ACCOUNT_TYPE, formatObjectRef, pairKey } from "./tuples.js";
+import { ACCOUNT_TYPE, ALLOW_PUBLIC_CONDITION, formatObjectRef, pairKey, } from "./tuples.js";
 /**
  * OpenFGA's default resolution-depth limit (its `resolveNodeLimit`), so
  * the bound here is the oracle's own and not a number chosen locally. The
@@ -16,21 +16,23 @@ export class AuthorizationEvaluationError extends Error {
         this.reason = reason;
     }
 }
-export async function checkRelation(deps, object, relation, person) {
+export async function checkRelation(deps, object, relation, person, context) {
     if (deps.model.byType(object.type) === undefined) {
         throw new AuthorizationEvaluationError("undeclared-target-kind", `no declaration for kind '${object.type}' (target ${formatObjectRef(object)})`);
     }
-    return new Walk(deps, person).resolve(object, relation, 0);
+    return new Walk(deps, person, context).resolve(object, relation, 0);
 }
 /** One check's state: the memo and the in-progress set, over one source. */
 class Walk {
     deps;
     person;
+    context;
     memo = new Map();
     inProgress = new Set();
-    constructor(deps, person) {
+    constructor(deps, person, context) {
         this.deps = deps;
         this.person = person;
+        this.context = context;
     }
     resolve(object, relation, depth) {
         const key = pairKey(object, relation);
@@ -104,12 +106,26 @@ class Walk {
                 return (restriction.some((allowed) => allowed.form === "userset" &&
                     allowed.type === subject.object.type &&
                     allowed.relation === subject.relation) && (await this.resolve(subject.object, subject.relation, depth + 1)));
+            case "wildcard": {
+                const allowed = restriction.some((entry) => entry.form === "wildcard" &&
+                    entry.type === subject.type &&
+                    entry.condition === subject.condition);
+                return allowed && this.conditionHolds(subject.condition);
+            }
             default: {
                 const exhaustive = subject;
                 throw new Error(`unknown subject form: ${JSON.stringify(exhaustive)}`);
             }
         }
     }
+    conditionHolds(condition) {
+        switch (condition) {
+            case ALLOW_PUBLIC_CONDITION:
+                return this.context.allow;
+            default:
+                throw new AuthorizationEvaluationError("unknown-condition", `the model declares no condition '${String(condition)}'`);
+        }
+    }
     /** The object types the tupleset line admits — `[organization]`, `[session]` — from its `this` nodes. */
     objectTypesOf(object, tupleset) {
         const rewrite = this.deps.model

package/dist/authorization/evaluator.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../src/authorization/evaluator.ts"],"names":[],"mappings":"AA8CA,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAcvC,oGAAoG;AACpG,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,MAAM,CAAkB;IAEjC,YAAY,MAAuB,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAoB,EACpB,MAAiB,EACjB,QAAgB,EAChB,MAAc;IAEd,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,4BAA4B,CACpC,wBAAwB,EACxB,4BAA4B,MAAM,CAAC,IAAI,aAAa,eAAe,CAAC,MAAM,CAAC,GAAG,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,4EAA4E;AAC5E,MAAM,IAAI;IAKW;IACA;IALF,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC3C,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhD,YACmB,IAAoB,EACpB,MAAc;QADd,SAAI,GAAJ,IAAI,CAAgB;QACpB,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,OAAO,CACL,MAAiB,EACjB,QAAgB,EAChB,KAAa;QAEb,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAA4B,CACpC,kBAAkB,EAClB,IAAI,GAAG,4DAA4D,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;YACjC,MAAM,IAAI,4BAA4B,CACpC,2BAA2B,EAC3B,cAAc,GAAG,cAAc,oBAAoB,OAAO,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAC1E,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAC5B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,OAAgB,EAChB,MAAiB,EACjB,QAAgB,EAChB,KAAa;QAEb,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;wBACpE,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC3D,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IACE,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;wBAC9B,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;wBACvC,CAAC,MAAM,IAAI,CAAC,OAAO,CACjB,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,OAAO,CAAC,QAAQ,EAChB,KAAK,GAAG,CAAC,CACV,CAAC,EACF,CAAC;wBACD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACrC,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;wBACzD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,OAAO,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,iGAAiG;IACzF,KAAK,CAAC,YAAY,CACxB,OAAgB,EAChB,WAAuC,EACvC,KAAa;QAEb,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,QAAQ;gBACX,OAAO,CACL,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACpC,WAAW,CAAC,IAAI,CACd,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,CAC7D;oBACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAC3C,CAAC;YACJ,KAAK,SAAS;gBACZ,OAAO,CACL,WAAW,CAAC,IAAI,CACd,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,IAAI,KAAK,SAAS;oBAC1B,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI;oBACpC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CACxC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CACvE,CAAC;YACJ,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,OAAO,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,yGAAyG;IACjG,aAAa,CACnB,MAAiB,EACjB,QAAgB;QAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK;aAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACpB,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,OAAO,GAAG,CAAC,IAAa,EAAQ,EAAE;YACtC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACpC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC9B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"evaluator.js","sourceRoot":"","sources":["../../src/authorization/evaluator.ts"],"names":[],"mappings":"AAqDA,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,OAAO,GACR,MAAM,aAAa,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAevC,oGAAoG;AACpG,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAC5C,MAAM,CAAkB;IAEjC,YAAY,MAAuB,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAoB,EACpB,MAAiB,EACjB,QAAgB,EAChB,MAAc,EACd,OAAqB;IAErB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,4BAA4B,CACpC,wBAAwB,EACxB,4BAA4B,MAAM,CAAC,IAAI,aAAa,eAAe,CAAC,MAAM,CAAC,GAAG,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,4EAA4E;AAC5E,MAAM,IAAI;IAKW;IACA;IACA;IANF,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC3C,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhD,YACmB,IAAoB,EACpB,MAAc,EACd,OAAqB;QAFrB,SAAI,GAAJ,IAAI,CAAgB;QACpB,WAAM,GAAN,MAAM,CAAQ;QACd,YAAO,GAAP,OAAO,CAAc;IACrC,CAAC;IAEJ,OAAO,CACL,MAAiB,EACjB,QAAgB,EAChB,KAAa;QAEb,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAA4B,CACpC,kBAAkB,EAClB,IAAI,GAAG,4DAA4D,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;YACjC,MAAM,IAAI,4BAA4B,CACpC,2BAA2B,EAC3B,cAAc,GAAG,cAAc,oBAAoB,OAAO,CAC3D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACvD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAC1E,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAC5B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,OAAgB,EAChB,MAAiB,EACjB,QAAgB,EAChB,KAAa;QAEb,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACjE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;wBACpE,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC3D,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACxE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IACE,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;wBAC9B,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;wBACvC,CAAC,MAAM,IAAI,CAAC,OAAO,CACjB,IAAI,CAAC,OAAO,CAAC,MAAM,EACnB,OAAO,CAAC,QAAQ,EAChB,KAAK,GAAG,CAAC,CACV,CAAC,EACF,CAAC;wBACD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBACrC,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;wBACzD,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,OAAO,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,iGAAiG;IACzF,KAAK,CAAC,YAAY,CACxB,OAAgB,EAChB,WAAuC,EACvC,KAAa;QAEb,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,QAAQ;gBACX,OAAO,CACL,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACpC,WAAW,CAAC,IAAI,CACd,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,CAC7D;oBACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAC3C,CAAC;YACJ,KAAK,SAAS;gBACZ,OAAO,CACL,WAAW,CAAC,IAAI,CACd,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,IAAI,KAAK,SAAS;oBAC1B,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI;oBACpC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CACxC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CACvE,CAAC;YACJ,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAC9B,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,IAAI,KAAK,UAAU;oBACzB,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;oBAC3B,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CACxC,CAAC;gBACF,OAAO,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,OAAO,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,SAA6B;QAClD,QAAQ,SAAS,EAAE,CAAC;YAClB,KAAK,sBAAsB;gBACzB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YAC5B;gBACE,MAAM,IAAI,4BAA4B,CACpC,mBAAmB,EACnB,oCAAoC,MAAM,CAAC,SAAS,CAAC,GAAG,CACzD,CAAC;QACN,CAAC;IACH,CAAC;IAED,yGAAyG;IACjG,aAAa,CACnB,MAAiB,EACjB,QAAgB;QAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK;aAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACpB,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,OAAO,GAAG,CAAC,IAAa,EAAQ,EAAE;YACtC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACpC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC9B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,OAAO,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/authorization/list-read-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-read-scope.d.ts","sourceRoot":"","sources":["../../src/authorization/list-read-scope.ts"],"names":[],"mappings":"AAkEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAKnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAOpD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,aAAa,CAsHf"}
+{"version":3,"file":"list-read-scope.d.ts","sourceRoot":"","sources":["../../src/authorization/list-read-scope.ts"],"names":[],"mappings":"AAoEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAKnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAUpD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,wBAAwB,GAC7B,aAAa,CAuHf"}

package/dist/authorization/list-read-scope.js

@@ -11,10 +11,12 @@
  * row a second time. A self-host's lists show a person exactly what a
  * `get` would let them read.
  *
- * Both verbs ask the same question a point check asks, `can_view` on the
- * candidate: the model has no subject whose answer differs between a
- * listing and a get, so a list is exactly the set of rows a get would
- * read.
+ * Both verbs ask under the LISTING context, `allow: false` — the public
+ * wildcard suppressed, the cloud's own posture (its Java
+ * listAuthorizedResourceIds set it): a legacy PUBLIC row reads for any
+ * signed-in person on a point check and never expands into an outsider's
+ * listing; the organization's own people still reach it through the
+ * org-viewer shape public also emits.
  *
  *   - `restrictListEntries`: one derived source for the caller, seeded
  *     with every candidate's facts; one `checkRelation` per unique id —
@@ -69,6 +71,8 @@ import { builtInModel } from "./model/index.js";
 import { resolvePerson } from "./person.js";
 /** The relation every list lane reads through (the cloud's LIST_RELATION). */
 const LIST_RELATION = "can_view";
+/** The listing context: the public wildcard suppressed (the module header). */
+const LISTING = { allow: false };
 export function newBuiltInListReadScope(deps) {
     const model = deps.model ?? builtInModel;
     /** The candidates the caller may view, each answered by its own walk over one seeded source. */
@@ -87,7 +91,7 @@ export function newBuiltInListReadScope(deps) {
         const type = kindEnumName(kind);
         const answers = await Promise.all(candidates.map(async (facts) => {
             const object = { type, id: facts.id };
-            const allowed = await checkRelation({ model, source }, object, LIST_RELATION, person);
+            const allowed = await checkRelation({ model, source }, object, LIST_RELATION, person, LISTING);
             return allowed ? facts.id : undefined;
         }));
         const kept = new Set();

package/dist/authorization/list-read-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-read-scope.js","sourceRoot":"","sources":["../../src/authorization/list-read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAWhD,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,8EAA8E;AAC9E,MAAM,aAAa,GAAG,UAAU,CAAC;AAajC,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IAEzC,gGAAgG;IAChG,KAAK,UAAU,YAAY,CACzB,MAAsB,EACtB,IAAqB,EACrB,UAAmC;QAEnC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAW,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,qBAAqB,CAClC;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK;SACN,EACD,MAAM,EACN,EAAE,KAAK,EAAE,UAAU,EAAE,CACtB,CAAC;QACF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,MAAM,MAAM,GAAc,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,MAAM,EACN,aAAa,EACb,MAAM,CACP,CAAC;YACF,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxC,CAAC,CAAC,CACH,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACnD,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,UAAU,CAAC,MAAM;YAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yHAAyH;IACzH,SAAS,eAAe,CAAC,IAAqB;QAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,4BAA4B,CACpC,wBAAwB,EACxB,4BAA4B,YAAY,CAAC,IAAI,CAAC,yEAAyE,CACxH,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,4FAA4F;IAC5F,KAAK,UAAU,UAAU,CAAC,WAA4B;QACpD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBAChE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;oBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,KAAK,CAAC,mBAAmB,CACvB,MAAsB,EACtB,IAAqB,EACrB,OAAqC;YAErC,eAAe,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,MAAM,IAAI,4BAA4B,CACpC,yBAAyB,EACzB,qEAAqE,YAAY,CAAC,IAAI,CAAC,sGAAsG,CAC9L,CAAC;YACJ,CAAC;YACD,kEAAkE;YAClE,8DAA8D;YAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC3C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;YACD,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,CAAC,qBAAqB,CACzB,MAAsB,EACtB,IAAqB;YAErB,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"list-read-scope.js","sourceRoot":"","sources":["../../src/authorization/list-read-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAWhD,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,8EAA8E;AAC9E,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,+EAA+E;AAC/E,MAAM,OAAO,GAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAa/C,MAAM,UAAU,uBAAuB,CACrC,IAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IAEzC,gGAAgG;IAChG,KAAK,UAAU,YAAY,CACzB,MAAsB,EACtB,IAAqB,EACrB,UAAmC;QAEnC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAW,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,qBAAqB,CAClC;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK;SACN,EACD,MAAM,EACN,EAAE,KAAK,EAAE,UAAU,EAAE,CACtB,CAAC;QACF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC7B,MAAM,MAAM,GAAc,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,MAAM,EACN,aAAa,EACb,MAAM,EACN,OAAO,CACR,CAAC;YACF,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxC,CAAC,CAAC,CACH,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACnD,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,UAAU,CAAC,MAAM;YAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yHAAyH;IACzH,SAAS,eAAe,CAAC,IAAqB;QAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,4BAA4B,CACpC,wBAAwB,EACxB,4BAA4B,YAAY,CAAC,IAAI,CAAC,yEAAyE,CACxH,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,4FAA4F;IAC5F,KAAK,UAAU,UAAU,CAAC,WAA4B;QACpD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBAChE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;oBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,KAAK,CAAC,mBAAmB,CACvB,MAAsB,EACtB,IAAqB,EACrB,OAAqC;YAErC,eAAe,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,MAAM,IAAI,4BAA4B,CACpC,yBAAyB,EACzB,qEAAqE,YAAY,CAAC,IAAI,CAAC,sGAAsG,CAC9L,CAAC;YACJ,CAAC;YACD,kEAAkE;YAClE,8DAA8D;YAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC3C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;YACD,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,CAAC,qBAAqB,CACzB,MAAsB,EACtB,IAAqB;YAErB,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authorization/model/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,gBAAgB,wCAsC3B,CAAC"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,gBAAgB,wCAuC3B,CAAC"}

package/dist/authorization/model/agent.js

@@ -4,12 +4,13 @@
  * read by whoever the visibility axis lets in. The `organization#member`
  * and `organization#viewer` usersets on `viewer` are the org-visibility
  * tuple's two shapes (the cloud writes `#viewer` since cloud#257; `#member`
- * is the legacy shape it still honours), and `platform_viewer` is an
- * identity-provider userset no open-source tuple ever names.
+ * is the legacy shape it still honours), the conditional wildcard is the
+ * public level, and `platform_viewer` is an identity-provider userset no
+ * open-source tuple ever names.
  */
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
+import { computed, declareKind, direct, from, objectOf, publicWith, union, usersetOf, } from "./rewrite.js";
 export const agentDeclaration = declareKind({
     kind: ApiResourceKind.agent,
     schema: AgentSchema,
@@ -26,7 +27,7 @@ export const agentDeclaration = declareKind({
         ],
         [
             "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), computed("platform_viewer")),
+            union(direct(objectOf("identity_account"), publicWith("identity_account", "allow_public"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), computed("platform_viewer")),
         ],
         ["can_view", computed("viewer")],
         ["can_edit", computed("owner")],

package/dist/authorization/model/agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../../src/authorization/model/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;IAC1C,IAAI,EAAE,eAAe,CAAC,KAAK;IAC3B,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,6BAA6B;IACrC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,qBAAqB,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChD,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../../src/authorization/model/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;IAC1C,IAAI,EAAE,eAAe,CAAC,KAAK;IAC3B,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,6BAA6B;IACrC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,UAAU,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAC9C,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,qBAAqB,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChD,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/agent_instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent_instance.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent_instance.ts"],"names":[],"mappings":"AAyBA,eAAO,MAAM,wBAAwB,wCAsCnC,CAAC"}
+{"version":3,"file":"agent_instance.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent_instance.ts"],"names":[],"mappings":"AA0BA,eAAO,MAAM,wBAAwB,wCAuCnC,CAAC"}

package/dist/authorization/model/agent_instance.js

@@ -12,7 +12,7 @@ import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb"
 import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { defaultOfBlueprint } from "./default-of.js";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
+import { computed, declareKind, direct, from, objectOf, publicWith, union, usersetOf, } from "./rewrite.js";
 export const agentInstanceDeclaration = declareKind({
     kind: ApiResourceKind.agent_instance,
     schema: AgentInstanceSchema,
@@ -24,7 +24,7 @@ export const agentInstanceDeclaration = declareKind({
         ["owner", direct(objectOf("identity_account"))],
         [
             "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), from("viewer", "default_of")),
+            union(direct(objectOf("identity_account"), publicWith("identity_account", "allow_public"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), from("viewer", "default_of")),
         ],
         ["can_view", computed("viewer")],
         ["can_execute", computed("can_view")],

package/dist/authorization/model/agent_instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent_instance.js","sourceRoot":"","sources":["../../../src/authorization/model/agent_instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC;IAClD,IAAI,EAAE,eAAe,CAAC,cAAc;IACpC,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,sCAAsC;IAC9C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACpC,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAC7B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;IACD,OAAO,EAAE;QACP;YACE,YAAY;YACZ,kBAAkB,CAAC;gBACjB,IAAI,EAAE,eAAe,CAAC,KAAK;gBAC3B,MAAM,EAAE,WAAW;gBACnB,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE;aACtE,CAAC;SACH;KACF;CACF,CAAC,CAAC"}
+{"version":3,"file":"agent_instance.js","sourceRoot":"","sources":["../../../src/authorization/model/agent_instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC;IAClD,IAAI,EAAE,eAAe,CAAC,cAAc;IACpC,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,sCAAsC;IAC9C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACpC,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,UAAU,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAC9C,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAC7B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;IACD,OAAO,EAAE;QACP;YACE,YAAY;YACZ,kBAAkB,CAAC;gBACjB,IAAI,EAAE,eAAe,CAAC,KAAK;gBAC3B,MAAM,EAAE,WAAW;gBACnB,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE;aACtE,CAAC;SACH;KACF;CACF,CAAC,CAAC"}

package/dist/authorization/model/mcp_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp_server.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/mcp_server.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,oBAAoB,wCAsC/B,CAAC"}
+{"version":3,"file":"mcp_server.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/mcp_server.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,oBAAoB,wCAuC/B,CAAC"}

package/dist/authorization/model/mcp_server.js

@@ -5,7 +5,7 @@
  */
 import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
+import { computed, declareKind, direct, from, objectOf, publicWith, union, usersetOf, } from "./rewrite.js";
 export const mcpServerDeclaration = declareKind({
     kind: ApiResourceKind.mcp_server,
     schema: McpServerSchema,
@@ -22,7 +22,7 @@ export const mcpServerDeclaration = declareKind({
         ],
         [
             "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), computed("platform_viewer")),
+            union(direct(objectOf("identity_account"), publicWith("identity_account", "allow_public"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), computed("platform_viewer")),
         ],
         ["can_view", computed("viewer")],
         ["can_edit", computed("owner")],

package/dist/authorization/model/mcp_server.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp_server.js","sourceRoot":"","sources":["../../../src/authorization/model/mcp_server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;IAC9C,IAAI,EAAE,eAAe,CAAC,UAAU;IAChC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,kCAAkC;IAC1C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}
+{"version":3,"file":"mcp_server.js","sourceRoot":"","sources":["../../../src/authorization/model/mcp_server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;IAC9C,IAAI,EAAE,eAAe,CAAC,UAAU;IAChC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,kCAAkC;IAC1C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,UAAU,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAC9C,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/plugin.ts"],"names":[],"mappings":"AA0BA,eAAO,MAAM,iBAAiB,wCAoC5B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/plugin.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,iBAAiB,wCAqC5B,CAAC"}

package/dist/authorization/model/plugin.js

@@ -2,7 +2,8 @@
  * Transcript of fga/model/agentic/plugin.fga — the unit of install, shaped
  * exactly like a skill: an organization-owned blueprint whose owner is the
  * installer (and, through the organization, its admins), whose viewers are
- * the org's members and viewers and the platform viewer. Its verbs are the blueprint set: `can_view`, `can_edit`
+ * the org's members and viewers, public readers when published, and the
+ * platform viewer. Its verbs are the blueprint set: `can_view`, `can_edit`
  * (visibility), `can_delete` (uninstall), `can_grant_access`,
  * `can_view_access`; `can_use` is carried as the model's word for
  * "install from" though no wire permission names it yet.
@@ -13,7 +14,7 @@
  */
 import { PluginSchema } from "@stigmer/protos/ai/stigmer/agentic/plugin/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
+import { computed, declareKind, direct, from, objectOf, publicWith, union, usersetOf, } from "./rewrite.js";
 export const pluginDeclaration = declareKind({
     kind: ApiResourceKind.plugin,
     schema: PluginSchema,
@@ -30,7 +31,7 @@ export const pluginDeclaration = declareKind({
         ],
         [
             "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), computed("platform_viewer")),
+            union(direct(objectOf("identity_account"), publicWith("identity_account", "allow_public"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), computed("platform_viewer")),
         ],
         ["can_view", computed("viewer")],
         ["can_edit", computed("owner")],

package/dist/authorization/model/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/authorization/model/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,IAAI,EAAE,eAAe,CAAC,MAAM;IAC5B,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,8BAA8B;IACtC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/authorization/model/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,IAAI,EAAE,eAAe,CAAC,MAAM;IAC5B,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,8BAA8B;IACtC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,UAAU,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAC9C,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}