@stigmer/server 3.27.1 → 3.28.0

package/src/extensions/list-read-scope.ts

@@ -131,7 +131,10 @@ import type { ApiResourceAudit } from "@stigmer/protos/ai/stigmer/commons/apires
 // protos and each other, so there is no cycle. Deliberate — one resolver
 // for the tuple writer, the point-check driver and the list reader beats
 // a copy in the seam.
-import { inheritedAuthorizationParentOf } from "../pipeline/apiresource-meta.js";
+import {
+  inheritedAuthorizationParentOf,
+  kindEnumName,
+} from "../pipeline/apiresource-meta.js";
 import { rowAuthorizationFactsOf } from "../pipeline/steps/authorization-facts.js";
 
 import type { CallerIdentity } from "./identity.js";
@@ -192,8 +195,9 @@ export interface ListReadScope {
    * `caller` is never the `internal` class: `restrictListByReadScope`,
    * the one consumption idiom, answers that class before any driver is
    * asked (the header's contract line). A driver that is offered it has
-   * been reached around the idiom and should refuse loudly rather than
-   * evaluate the server as a person (the built-in driver does).
+   * been reached around the idiom and refuses with
+   * `InternalCallerOfferedError` rather than evaluate the server as a
+   * person.
    */
   restrictListEntries(
     caller: CallerIdentity,
@@ -202,6 +206,29 @@ export interface ListReadScope {
   ): Promise<ReadonlySet<string>>;
 }
 
+/**
+ * The restrict verb's refusal of the `internal` class (its doc above):
+ * thrown by a driver that is offered the server acting as itself, which
+ * `restrictListByReadScope` answers before any driver is asked. Being
+ * offered it means a list lane reached the driver around that idiom, and
+ * evaluating the server as a person would answer a quiet short list, the
+ * failure stigmer#1207 fixed. It is a consumer bug, never a denial (a
+ * denial is an empty set): the lane faults and the pipeline answers its
+ * sanitized INTERNAL. One type for every edition's driver, so each refuses
+ * the class the same way.
+ */
+export class InternalCallerOfferedError extends Error {
+  readonly kind: ApiResourceKind;
+
+  constructor(kind: ApiResourceKind) {
+    super(
+      `the internal caller class was offered to the list scope for kind '${kindEnumName(kind)}' — the shared helper answers that class before any driver; a list lane reached the driver around it`,
+    );
+    this.name = "InternalCallerOfferedError";
+    this.kind = kind;
+  }
+}
+
 /**
  * The shape every stored API resource message presents to the shared
  * helper — the metadata fields the scope's candidates are built from, the
@@ -224,7 +251,8 @@ export interface ScopedListResource {
 /**
  * The ONE consumption idiom for post-scan lanes (the shared-step
  * discipline of pipeline/steps/authorization-tuples.ts, rendered as a
- * helper because half the lanes are direct handlers):
+ * helper because half the lanes are direct handlers; on the barrel, so a
+ * composition's lane over its own table narrows the same way):
  *
  *   - no scope composed → the input array unchanged (byte-identity;
  *     `requestOrg` deliberately not consulted — the OSS single-tenant

package/src/index.ts

@@ -10,6 +10,12 @@
  * to this file are owner-visible surface changes, extended only through
  * gates (the DD-005 review property: a surface change is a one-file diff).
  *
+ * One data file is published beside it, through its own exports entry:
+ * `@stigmer/server/authorization-model.json`, the compiled authorization
+ * model (OpenFGA's JSON, generated from fga/model, whose README states the
+ * file's contract). Every edition reads those bytes: this server
+ * evaluates them, and an edition that runs OpenFGA applies them.
+ *
  * The surface is exactly what the ratified architecture names (blueprint
  * 20260826.02/03 §1) and the parameter types those entries force:
  *   - the compose entry and config loading (composeServer + its options'
@@ -224,56 +230,26 @@ export {
   canSign,
   platformTokenKeyRingFromPem,
 } from "./platformtoken/key-ring.js";
-// The built-in authorizer's model seams: the kind
-// declarations (transcripts of the cloud's `.fga` files), the evaluator,
-// and the OpenFGA store-test kit — exported so the cloud's drift test
-// compares the live model against the transcripts and runs its live
-// store tests through the evaluator, both from the published package.
-// The drivers themselves are composed by the root and are not exported.
-export type {
-  DerivedRelation,
-  KindDeclaration,
-  Rewrite,
-  SubjectType,
-} from "./authorization/model/rewrite.js";
-export type { Model } from "./authorization/model/index.js";
-export {
-  builtInModel,
-  declarationFor,
-  newModel,
-} from "./authorization/model/index.js";
-export type {
-  ObjectRef,
-  Person,
-  Subject,
-  Tuple,
-  TupleSource,
-} from "./authorization/tuples.js";
-export type { EvaluationFault } from "./authorization/evaluator.js";
-export {
-  AuthorizationEvaluationError,
-  MAX_RESOLUTION_DEPTH,
-  checkRelation,
-} from "./authorization/evaluator.js";
-export type {
-  StoreTestCase,
-  StoreTestDocument,
-  StoreTestKit,
-  StoreTestSkip,
-  StoreTestSkipReason,
-} from "./authorization/store-test-kit.js";
-export {
-  parseStoreTestDocument,
-  storeTestCases,
-} from "./authorization/store-test-kit.js";
 // The kinds whose missing row the built-in authorizer denies instead of
-// answering not-found — the cloud's probe exemption over the open-source
-// tier; exported so the cloud's drift test pins the two sets equal.
+// answering not-found: exported so a composition that authorizes with its
+// own engine and probes existence itself pins its exemptions to this set.
+// The model the authorizer evaluates is not exported as code: it is the
+// data subpath `@stigmer/server/authorization-model.json` (this file's
+// header).
 export { NOT_FOUND_EXEMPT_KINDS } from "./authorization/authorizer.js";
 export type {
   ListReadScope,
   ListEntryMeta,
 } from "./extensions/list-read-scope.js";
+// The one consumption idiom of the list read scope for post-scan list lanes:
+// exported so a list lane a composition serves from its own table narrows
+// its rows exactly as the library's lanes do, instead of building each
+// candidate's authorization facts by hand.
+export { restrictListByReadScope } from "./extensions/list-read-scope.js";
+// The seam's refusal of the `internal` caller class on the restrict verb,
+// which that idiom answers before any driver is asked: exported so a
+// composition's driver refuses the class exactly as the built-in one does.
+export { InternalCallerOfferedError } from "./extensions/list-read-scope.js";
 // The stigmer-cloud#572 seam: the identity a schedule fire acts as
 // (drivers.scheduleFireCaller) — the composition mints it per fire; the
 // RunStarter propagates it through the R5 in-process header. A mint that

package/dist/authorization/model/agent.d.ts

@@ -1,2 +0,0 @@
-export declare const agentDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=agent.d.ts.map

package/dist/authorization/model/agent.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,gBAAgB,wCAuC3B,CAAC"}

package/dist/authorization/model/agent.js

@@ -1,43 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent.fga — a blueprint: owned by its
- * creator and by the organization's admins (`admin from organization`),
- * read by whoever the visibility axis lets in. The `organization#member`
- * and `organization#viewer` usersets on `viewer` are the org-visibility
- * tuple's two shapes (the cloud writes `#viewer` since cloud#257; `#member`
- * is the legacy shape it still honours), and `platform_viewer` is an
- * identity-provider userset no open-source tuple ever names. `team#member`
- * is the Enterprise team grant; open source serves no team, so no tuple
- * here ever names one.
- */
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const agentDeclaration = declareKind({
-    kind: ApiResourceKind.agent,
-    schema: AgentSchema,
-    source: "fga/model/agentic/agent.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "platform_viewer",
-            direct(usersetOf("identity_provider", "platform_user")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer"), usersetOf("team", "member")), computed("owner"), computed("platform_viewer")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_execute", computed("viewer")],
-        ["can_create_instance", computed("can_execute")],
-        ["can_clone", computed("viewer")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=agent.js.map

package/dist/authorization/model/agent.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../../src/authorization/model/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;IAC1C,IAAI,EAAE,eAAe,CAAC,KAAK;IAC3B,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,6BAA6B;IACrC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5B,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,qBAAqB,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChD,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/agent_channel.d.ts

@@ -1,2 +0,0 @@
-export declare const agentChannelDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=agent_channel.d.ts.map

package/dist/authorization/model/agent_channel.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_channel.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent_channel.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,uBAAuB,wCAkClC,CAAC"}

package/dist/authorization/model/agent_channel.js

@@ -1,39 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_channel.fga — a channel binding,
- * admin-owned like a blueprint, with `participant` as the one relation
- * between owner and viewer: the conversation-participation role
- * (reply and takeover without configuration authority), grantable as a
- * role on this kind alone. Every owner participates; every participant
- * views. Both grantable relations may name an Enterprise team
- * (`team#member`), which no open-source tuple ever does.
- */
-import { AgentChannelSchema } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const agentChannelDeclaration = declareKind({
-    kind: ApiResourceKind.agent_channel,
-    schema: AgentChannelSchema,
-    source: "fga/model/agentic/agent_channel.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "participant",
-            union(direct(objectOf("identity_account"), usersetOf("team", "member")), computed("owner")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("team", "member")), computed("participant")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_participate", computed("participant")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=agent_channel.js.map

package/dist/authorization/model/agent_channel.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_channel.js","sourceRoot":"","sources":["../../../src/authorization/model/agent_channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;IACjD,IAAI,EAAE,eAAe,CAAC,aAAa;IACnC,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,qCAAqC;IAC7C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,aAAa;YACb,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EACjE,QAAQ,CAAC,OAAO,CAAC,CAClB;SACF;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EACjE,QAAQ,CAAC,aAAa,CAAC,CACxB;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC5C,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/agent_execution.d.ts

@@ -1,2 +0,0 @@
-export declare const agentExecutionDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=agent_execution.d.ts.map

package/dist/authorization/model/agent_execution.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_execution.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent_execution.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,yBAAyB,wCAWpC,CAAC"}

package/dist/authorization/model/agent_execution.js

@@ -1,25 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_execution.fga — a run is its
- * session's: no owner tuple of its own (`kind_meta` attribution
- * INHERITED), every relation a hop through `session`, which the
- * derivation writes from `spec.session_id`. `can_view: viewer or
- * can_view from session` walks a parent PERMISSION whose own arms include
- * the session's channel and schedule hops; the evaluator resolves those
- * on the session's declaration, so this file needs no knowledge of them.
- */
-import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const agentExecutionDeclaration = declareKind({
-    kind: ApiResourceKind.agent_execution,
-    schema: AgentExecutionSchema,
-    source: "fga/model/agentic/agent_execution.fga",
-    relations: [
-        ["session", direct(objectOf("session"))],
-        ["owner", from("owner", "session")],
-        ["viewer", union(from("viewer", "session"), computed("owner"))],
-        ["can_view", union(computed("viewer"), from("can_view", "session"))],
-        ["can_edit", computed("owner")],
-    ],
-});
-//# sourceMappingURL=agent_execution.js.map

package/dist/authorization/model/agent_execution.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_execution.js","sourceRoot":"","sources":["../../../src/authorization/model/agent_execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAAC;IACnD,IAAI,EAAE,eAAe,CAAC,eAAe;IACrC,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,uCAAuC;IAC/C,SAAS,EAAE;QACT,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACxC,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnC,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;QACpE,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAChC;CACF,CAAC,CAAC"}

package/dist/authorization/model/agent_instance.d.ts

@@ -1,2 +0,0 @@
-export declare const agentInstanceDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=agent_instance.d.ts.map

package/dist/authorization/model/agent_instance.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_instance.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent_instance.ts"],"names":[],"mappings":"AA0BA,eAAO,MAAM,wBAAwB,wCAuCnC,CAAC"}

package/dist/authorization/model/agent_instance.js

@@ -1,48 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_instance.fga — a person's
- * configuration of an agent: owner-only in every write (no admin arm,
- * unlike the blueprint), readable through its own visibility axis or, for
- * the system-managed default instance, through the blueprint's whole
- * viewer set (`viewer from default_of`; default-of.ts). `agent` is the
- * parent link written on every instance for tracking and walked by
- * nothing; `default_of` is the derived link written on the default
- * instance alone. `team#member` on `viewer` is the Enterprise team grant,
- * which no open-source tuple ever names.
- */
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { defaultOfBlueprint } from "./default-of.js";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const agentInstanceDeclaration = declareKind({
-    kind: ApiResourceKind.agent_instance,
-    schema: AgentInstanceSchema,
-    source: "fga/model/agentic/agent_instance.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["agent", direct(objectOf("agent"))],
-        ["default_of", direct(objectOf("agent"))],
-        ["owner", direct(objectOf("identity_account"))],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer"), usersetOf("team", "member")), computed("owner"), from("viewer", "default_of")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_execute", computed("can_view")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-    derived: [
-        [
-            "default_of",
-            defaultOfBlueprint({
-                kind: ApiResourceKind.agent,
-                schema: AgentSchema,
-                defaultInstanceIdOf: (agent) => agent.status?.defaultInstanceId ?? "",
-            }),
-        ],
-    ],
-});
-//# sourceMappingURL=agent_instance.js.map

package/dist/authorization/model/agent_instance.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_instance.js","sourceRoot":"","sources":["../../../src/authorization/model/agent_instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC;IAClD,IAAI,EAAE,eAAe,CAAC,cAAc;IACpC,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,sCAAsC;IAC9C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACpC,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5B,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAC7B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;IACD,OAAO,EAAE;QACP;YACE,YAAY;YACZ,kBAAkB,CAAC;gBACjB,IAAI,EAAE,eAAe,CAAC,KAAK;gBAC3B,MAAM,EAAE,WAAW;gBACnB,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE;aACtE,CAAC;SACH;KACF;CACF,CAAC,CAAC"}

package/dist/authorization/model/agent_share.d.ts

@@ -1,2 +0,0 @@
-export declare const agentShareDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=agent_share.d.ts.map

package/dist/authorization/model/agent_share.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_share.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent_share.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,qBAAqB,wCAoBhC,CAAC"}

package/dist/authorization/model/agent_share.js

@@ -1,29 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_share.fga — a share link's
- * configuration row, admin-owned; its anonymous visitors are the cloud's
- * `guest` credential on the organization, a class no open-source lane
- * mints, so on this edition a share is visible to its owners and explicit
- * grantees only.
- */
-import { AgentShareSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const agentShareDeclaration = declareKind({
-    kind: ApiResourceKind.agent_share,
-    schema: AgentShareSchema,
-    source: "fga/model/agentic/agent_share.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=agent_share.js.map

package/dist/authorization/model/agent_share.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_share.js","sourceRoot":"","sources":["../../../src/authorization/model/agent_share.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;IAC/C,IAAI,EAAE,eAAe,CAAC,WAAW;IACjC,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,mCAAmC;IAC3C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/api_key.d.ts

@@ -1,2 +0,0 @@
-export declare const apiKeyDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=api_key.d.ts.map

package/dist/authorization/model/api_key.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"api_key.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/api_key.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,iBAAiB,wCAe5B,CAAC"}

package/dist/authorization/model/api_key.js

@@ -1,27 +0,0 @@
-/**
- * Transcript of fga/model/iam/api_key.fga — a credential, owner-only in
- * every verb: no organization link (`kind_meta` scope OWNER_ONLY) and no
- * admin arm, so the key a person minted is theirs to view, rotate, revoke
- * and use, and nobody else's. `can_rotate`, `can_revoke` and `can_use` are
- * the file's own verbs; the wire vocabulary names only the first three.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { ApiKeySchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-export const apiKeyDeclaration = declareKind({
-    kind: ApiResourceKind.api_key,
-    schema: ApiKeySchema,
-    source: "fga/model/iam/api_key.fga",
-    relations: [
-        ["owner", direct(objectOf("identity_account"))],
-        ["can_view", computed("owner")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_rotate", computed("owner")],
-        ["can_revoke", computed("owner")],
-        ["can_use", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("owner")],
-    ],
-});
-//# sourceMappingURL=api_key.js.map

package/dist/authorization/model/api_key.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api_key.js","sourceRoot":"","sources":["../../../src/authorization/model/api_key.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAC;AAE/E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,IAAI,EAAE,eAAe,CAAC,OAAO;IAC7B,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,2BAA2B;IACnC,SAAS,EAAE;QACT,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KACvC;CACF,CAAC,CAAC"}

package/dist/authorization/model/artifact.d.ts

@@ -1,2 +0,0 @@
-export declare const artifactDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=artifact.d.ts.map

package/dist/authorization/model/artifact.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"artifact.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/artifact.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,mBAAmB,wCAiB9B,CAAC"}

package/dist/authorization/model/artifact.js

@@ -1,27 +0,0 @@
-/**
- * Transcript of fga/model/agentic/artifact.fga — an organization's shared
- * output: read by its creator and by every organization viewer (`viewer
- * from organization`, no visibility tuple involved — the kind has no
- * visibility axis), edited by the organization's admins alone (the
- * creator does NOT edit through `owner`), and with no `can_delete` line
- * at all. The wire annotates only `can_view` and `can_edit` on it.
- */
-import { ArtifactSchema } from "@stigmer/protos/ai/stigmer/agentic/artifact/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const artifactDeclaration = declareKind({
-    kind: ApiResourceKind.artifact,
-    schema: ArtifactSchema,
-    source: "fga/model/agentic/artifact.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["owner", direct(objectOf("identity_account"))],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account")), from("viewer", "organization")),
-        ],
-        ["can_view", union(computed("owner"), computed("viewer"))],
-        ["can_edit", from("admin", "organization")],
-    ],
-});
-//# sourceMappingURL=artifact.js.map

package/dist/authorization/model/artifact.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"artifact.js","sourceRoot":"","sources":["../../../src/authorization/model/artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,IAAI,EAAE,eAAe,CAAC,QAAQ;IAC9B,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,gCAAgC;IACxC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAC/B;SACF;QACD,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1D,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;KAC5C;CACF,CAAC,CAAC"}

package/dist/authorization/model/channel_app.d.ts

@@ -1,2 +0,0 @@
-export declare const channelAppDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=channel_app.d.ts.map

package/dist/authorization/model/channel_app.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"channel_app.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/channel_app.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,qBAAqB,wCAoBhC,CAAC"}

package/dist/authorization/model/channel_app.js

@@ -1,28 +0,0 @@
-/**
- * Transcript of fga/model/agentic/channel_app.fga — a messaging-platform
- * app registration, admin-owned, viewable by its owners and explicit
- * grantees: the same shape as agent_share, kept as its own file so the
- * drift compare reads this file's lines.
- */
-import { ChannelAppSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const channelAppDeclaration = declareKind({
-    kind: ApiResourceKind.channel_app,
-    schema: ChannelAppSchema,
-    source: "fga/model/agentic/channel_app.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=channel_app.js.map

package/dist/authorization/model/channel_app.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"channel_app.js","sourceRoot":"","sources":["../../../src/authorization/model/channel_app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;IAC/C,IAAI,EAAE,eAAe,CAAC,WAAW;IACjC,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,mCAAmC;IAC3C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/environment.d.ts

@@ -1,2 +0,0 @@
-export declare const environmentDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=environment.d.ts.map

package/dist/authorization/model/environment.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/environment.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,sBAAsB,wCA0BjC,CAAC"}

package/dist/authorization/model/environment.js

@@ -1,33 +0,0 @@
-/**
- * Transcript of fga/model/agentic/environment.fga — a member's credential
- * store: owner-only writes (no admin arm), an org-visibility axis capped
- * at the organization (`kind_meta` supports_org only — no public
- * wildcard on the viewer line, and the evaluator would ignore one), and
- * `can_read_secrets: creator`, the one verb that stays with the person
- * who typed the values whatever the visibility, standing on the creator
- * tuple `kind_meta` flags with requires_creator_tuple.
- */
-import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, objectOf, union, usersetOf, } from "./rewrite.js";
-export const environmentDeclaration = declareKind({
-    kind: ApiResourceKind.environment,
-    schema: EnvironmentSchema,
-    source: "fga/model/agentic/environment.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["creator", direct(objectOf("identity_account"))],
-        ["owner", direct(objectOf("identity_account"))],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_read_secrets", computed("creator")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=environment.js.map

package/dist/authorization/model/environment.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/authorization/model/environment.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAChD,IAAI,EAAE,eAAe,CAAC,WAAW;IACjC,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,mCAAmC;IAC3C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACjD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,CAClB;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/execution_context.d.ts

@@ -1,2 +0,0 @@
-export declare const executionContextDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=execution_context.d.ts.map

package/dist/authorization/model/execution_context.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"execution_context.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/execution_context.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,2BAA2B,wCAStC,CAAC"}

package/dist/authorization/model/execution_context.js

@@ -1,19 +0,0 @@
-/**
- * Transcript of fga/model/agentic/execution_context.fga — a run's working
- * state, owner-only and unscoped (`kind_meta` OWNER_ONLY): two verbs,
- * both `owner`, and no access list to grant on.
- */
-import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-export const executionContextDeclaration = declareKind({
-    kind: ApiResourceKind.execution_context,
-    schema: ExecutionContextSchema,
-    source: "fga/model/agentic/execution_context.fga",
-    relations: [
-        ["owner", direct(objectOf("identity_account"))],
-        ["can_view", computed("owner")],
-        ["can_edit", computed("owner")],
-    ],
-});
-//# sourceMappingURL=execution_context.js.map

package/dist/authorization/model/execution_context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"execution_context.js","sourceRoot":"","sources":["../../../src/authorization/model/execution_context.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;IACrD,IAAI,EAAE,eAAe,CAAC,iBAAiB;IACvC,MAAM,EAAE,sBAAsB;IAC9B,MAAM,EAAE,yCAAyC;IACjD,SAAS,EAAE;QACT,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAChC;CACF,CAAC,CAAC"}

package/dist/authorization/model/iam_policy.d.ts

@@ -1,2 +0,0 @@
-export declare const iamPolicyDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=iam_policy.d.ts.map

package/dist/authorization/model/iam_policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"iam_policy.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/iam_policy.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,oBAAoB,wCAoB/B,CAAC"}