@stigmer/server 3.27.1 → 3.28.0

package/dist/authorization/model/workflow_execution.js

@@ -1,33 +0,0 @@
-/**
- * Transcript of fga/model/agentic/workflow_execution.fga — a run with an
- * owner of its own (the person who triggered it; `kind_meta` attribution
- * DIRECT, unlike agent_execution's inherited owner) and two ways in for
- * others: an explicit per-run grant, or the instance's opt-in run
- * audience through `execution_viewer from workflow_instance`, standing on
- * the `workflow_instance` link the derivation writes from
- * `spec.workflow_instance_id`. No `can_delete`: run history outlives its
- * instance by design. The per-run grant may name an Enterprise team
- * (`team#member`), which no open-source tuple ever does.
- */
-import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const workflowExecutionDeclaration = declareKind({
-    kind: ApiResourceKind.workflow_execution,
-    schema: WorkflowExecutionSchema,
-    source: "fga/model/agentic/workflow_execution.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["workflow_instance", direct(objectOf("workflow_instance"))],
-        ["owner", direct(objectOf("identity_account"))],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("team", "member")), computed("owner"), from("execution_viewer", "workflow_instance")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=workflow_execution.js.map

package/dist/authorization/model/workflow_execution.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow_execution.js","sourceRoot":"","sources":["../../../src/authorization/model/workflow_execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;IACtD,IAAI,EAAE,eAAe,CAAC,kBAAkB;IACxC,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,0CAA0C;IAClD,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC5D,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EACjE,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAC9C;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/workflow_instance.d.ts

@@ -1,2 +0,0 @@
-export declare const workflowInstanceDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=workflow_instance.d.ts.map

package/dist/authorization/model/workflow_instance.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow_instance.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/workflow_instance.ts"],"names":[],"mappings":"AA2EA,eAAO,MAAM,2BAA2B,wCAiDtC,CAAC"}

package/dist/authorization/model/workflow_instance.js

@@ -1,96 +0,0 @@
-/**
- * Transcript of fga/model/agentic/workflow_instance.fga — the agent
- * instance's shape plus one relation of its own: `execution_viewer`, the
- * opt-in audience for the instance's RUN history, kept apart from
- * `viewer` so making an instance org-runnable never exposes other
- * people's run inputs and outputs. Consumed by workflow_execution through
- * `execution_viewer from workflow_instance`.
- *
- * `execution_viewer` is derived here from `spec.execution_visibility`
- * (the second rule `kind_meta` cannot express): `organization` derives
- * `#execution_viewer@organization:<org>#viewer` — the organization's full
- * read audience, the shape the file's comment names and the cloud's own
- * store test writes, with `#member` the legacy shape the line still
- * admits — and `private` or unset derives nothing, so each run stays its
- * triggerer's. The cloud has no writer for this tuple today; this
- * edition enforces the field as the contract states it.
- *
- * `team#member` on `viewer` is the Enterprise team grant, which no
- * open-source tuple ever names; `execution_viewer` is not a grantable role
- * and admits no team.
- */
-import { isMessage } from "@bufbuild/protobuf";
-import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
-import { WorkflowInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
-import { WorkflowExecutionVisibility } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/spec_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { defaultOfBlueprint } from "./default-of.js";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-const executionViewer = (object, row) => {
-    if (!isMessage(row, WorkflowInstanceSchema)) {
-        return Promise.resolve([]);
-    }
-    const level = row.spec?.executionVisibility ?? WorkflowExecutionVisibility.unspecified;
-    switch (level) {
-        case WorkflowExecutionVisibility.organization: {
-            const org = row.metadata?.org ?? "";
-            return Promise.resolve(org === ""
-                ? []
-                : [
-                    {
-                        object,
-                        relation: "execution_viewer",
-                        subject: {
-                            form: "userset",
-                            object: { type: "organization", id: org },
-                            relation: "viewer",
-                        },
-                    },
-                ]);
-        }
-        case WorkflowExecutionVisibility.private:
-        case WorkflowExecutionVisibility.unspecified:
-            return Promise.resolve([]);
-        default: {
-            const exhaustive = level;
-            throw new Error(`unknown execution visibility: ${String(exhaustive)}`);
-        }
-    }
-};
-export const workflowInstanceDeclaration = declareKind({
-    kind: ApiResourceKind.workflow_instance,
-    schema: WorkflowInstanceSchema,
-    source: "fga/model/agentic/workflow_instance.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["workflow", direct(objectOf("workflow"))],
-        ["default_of", direct(objectOf("workflow"))],
-        ["owner", direct(objectOf("identity_account"))],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer"), usersetOf("team", "member")), computed("owner"), from("viewer", "default_of")),
-        ],
-        [
-            "execution_viewer",
-            direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_execute", computed("can_view")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-    derived: [
-        [
-            "default_of",
-            defaultOfBlueprint({
-                kind: ApiResourceKind.workflow,
-                schema: WorkflowSchema,
-                defaultInstanceIdOf: (workflow) => workflow.status?.defaultInstanceId ?? "",
-            }),
-        ],
-        ["execution_viewer", executionViewer],
-    ],
-});
-//# sourceMappingURL=workflow_instance.js.map

package/dist/authorization/model/workflow_instance.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow_instance.js","sourceRoot":"","sources":["../../../src/authorization/model/workflow_instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,gEAAgE,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,eAAe,GAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IACvD,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GACT,GAAG,CAAC,IAAI,EAAE,mBAAmB,IAAI,2BAA2B,CAAC,WAAW,CAAC;IAC3E,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC,OAAO,CACpB,GAAG,KAAK,EAAE;gBACR,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE;wBACE,MAAM;wBACN,QAAQ,EAAE,kBAAkB;wBAC5B,OAAO,EAAE;4BACP,IAAI,EAAE,SAAS;4BACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;4BACzC,QAAQ,EAAE,QAAQ;yBACnB;qBACF;iBACF,CACN,CAAC;QACJ,CAAC;QACD,KAAK,2BAA2B,CAAC,OAAO,CAAC;QACzC,KAAK,2BAA2B,CAAC,WAAW;YAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;IACrD,IAAI,EAAE,eAAe,CAAC,iBAAiB;IACvC,MAAM,EAAE,sBAAsB;IAC9B,MAAM,EAAE,yCAAyC;IACjD,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1C,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5C,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5B,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAC7B;SACF;QACD;YACE,kBAAkB;YAClB,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;IACD,OAAO,EAAE;QACP;YACE,YAAY;YACZ,kBAAkB,CAAC;gBACjB,IAAI,EAAE,eAAe,CAAC,QAAQ;gBAC9B,MAAM,EAAE,cAAc;gBACtB,mBAAmB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAChC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE;aAC3C,CAAC;SACH;QACD,CAAC,kBAAkB,EAAE,eAAe,CAAC;KACtC;CACF,CAAC,CAAC"}

package/dist/authorization/store-test-kit.d.ts

@@ -1,62 +0,0 @@
-import type { Model } from "./model/index.js";
-export interface StoreTestTuple {
-    readonly user: string;
-    readonly relation: string;
-    readonly object: string;
-}
-export interface StoreTestCheck {
-    readonly user: string;
-    readonly object: string;
-    readonly assertions: Readonly<Record<string, boolean>>;
-}
-export interface StoreTestListObjects {
-    readonly user: string;
-    readonly type: string;
-    readonly assertions: Readonly<Record<string, ReadonlyArray<string>>>;
-}
-export interface StoreTest {
-    readonly name: string;
-    readonly check: ReadonlyArray<StoreTestCheck>;
-    readonly list_objects: ReadonlyArray<StoreTestListObjects>;
-}
-export interface StoreTestDocument {
-    readonly name: string;
-    readonly tuples: ReadonlyArray<StoreTestTuple>;
-    readonly tests: ReadonlyArray<StoreTest>;
-}
-/**
- * Parses a loaded YAML value into a document, refusing anything the
- * format the cloud's files use does not carry (`sourceName` names the
- * file in every message).
- */
-export declare function parseStoreTestDocument(value: unknown, sourceName: string): StoreTestDocument;
-export interface StoreTestCase {
-    /** `<document> :: <test name>` — the framework prints it as the test name. */
-    readonly name: string;
-    run(): Promise<void>;
-}
-export type StoreTestSkipReason = "undeclared-kind" | "list-objects" | "undeclared-subject-type";
-/** One assertion (or assertion group) the kit did not run, in the document's words. */
-export interface StoreTestSkip {
-    readonly document: string;
-    readonly test: string;
-    readonly subject: string;
-    /** The check's object, or `<type>` for a list_objects assertion. */
-    readonly object: string;
-    /** The one relation, for a skip decided per assertion; absent for a group. */
-    readonly relation?: string;
-    readonly reason: StoreTestSkipReason;
-    /** For `undeclared-subject-type`: the types the walk read that the model does not declare, sorted. */
-    readonly types?: ReadonlyArray<string>;
-}
-export interface StoreTestKit {
-    readonly cases: ReadonlyArray<StoreTestCase>;
-    /** Complete once every case has run (the module header). */
-    readonly skipped: ReadonlyArray<StoreTestSkip>;
-}
-/**
- * The document's tests as runnable cases over `model`, plus every
- * assertion group the kit does not run.
- */
-export declare function storeTestCases(document: StoreTestDocument, model: Model): StoreTestKit;
-//# sourceMappingURL=store-test-kit.d.ts.map

package/dist/authorization/store-test-kit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"store-test-kit.d.ts","sourceRoot":"","sources":["../../src/authorization/store-test-kit.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAa9C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,MAAM,GACjB,iBAAiB,CAgBnB;AAqGD,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,mBAAmB,GAC3B,iBAAiB,GACjB,cAAc,GACd,yBAAyB,CAAC;AAE9B,uFAAuF;AACvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,sGAAsG;IACtG,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC7C,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAChD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,KAAK,GACX,YAAY,CAsEd"}

package/dist/authorization/store-test-kit.js

@@ -1,265 +0,0 @@
-/**
- * The OpenFGA store-test kit — runs a `.fga.yaml` store test (the format
- * `fga model test` reads: fixture tuples, then named tests with `check`
- * and `list_objects` assertions) against the built-in evaluator, so the
- * cloud's own model tests — written by the model's authors and run
- * against real OpenFGA in the cloud's CI — are the proof that this
- * evaluator answers the same model the same way. Open source runs the
- * kit over pinned copies of those documents (authorization/__tests__/
- * fixtures/fga/); the cloud runs it over the LIVE documents at the
- * re-pin, which is what makes the copies safe to hold.
- *
- * Shape: the port-contract kits' (store/port-contract.ts) — vitest-free,
- * node:assert, cases the consumer's framework iterates — because a
- * composition consumes it through the published barrel and vitest is a
- * devDependency that must not enter the barrel's runtime graph.
- *
- * What is run and what is reported. One case per named test; a case
- * asserts every `check` in the test whose object's kind the model
- * declares, relation by relation, and FAILS on the first disagreement
- * (the message names the check in the document's own words). Assertions
- * the kit does not run are returned as `skipped`, each with its reason,
- * so a consumer pins the list and a document that gains a scenario, or a
- * declaration that lands, is a visible diff and never a quietly smaller
- * proof. Three reasons: a check whose TARGET kind the model does not
- * declare (`undeclared-kind`) and every `list_objects` assertion
- * (`list-objects`, the list scope's proof) are known when the kit is
- * built; the third is known only from the walk. A document may grant
- * through a type the model does not declare — the cloud's platform
- * tenancy reaches people through `identity_provider:<idp>#platform_user`,
- * a kind this edition does not serve — and OpenFGA answers `true` where
- * a model without that type resolves the userset to nobody. The kit runs
- * every assertion over a recording view of the document's tuples, and an
- * assertion whose walk READ a tuple naming an undeclared type is
- * reported as `undeclared-subject-type` (the types named) instead of
- * being asserted, whatever it would have answered: decided from the
- * model and the data, per assertion, so the sibling arms of the same
- * check block still run and a union that is settled before it reaches
- * such a tuple runs too. Over a model that declares every type in the
- * file (the cloud's drift test, built from the live model) nothing is
- * recorded and everything runs — the same kit, no edition branch.
- * `skipped` is therefore complete once every case has run; a consumer
- * pins it after the cases, which is the order a test file declares them.
- *
- * The parser is strict on purpose: an unknown key anywhere is a thrown
- * fault, so a change to the format upstream is loud here rather than
- * half-run. The model declares no condition, so the format's `condition`
- * on a tuple and `context` on a check are among the keys refused: a
- * document that still carries them is written against a model this
- * evaluator does not answer, and saying so beats running it half-blind.
- */
-import assert from "node:assert/strict";
-import { checkRelation } from "./evaluator.js";
-import { ACCOUNT_TYPE, newInMemoryTupleSource, parseObjectRef, parseSubject, } from "./tuples.js";
-/**
- * Parses a loaded YAML value into a document, refusing anything the
- * format the cloud's files use does not carry (`sourceName` names the
- * file in every message).
- */
-export function parseStoreTestDocument(value, sourceName) {
-    const root = record(value, sourceName, [
-        "name",
-        "model_file",
-        "tuples",
-        "tests",
-    ]);
-    return {
-        name: text(root["name"], `${sourceName}: name`),
-        tuples: list(root["tuples"], `${sourceName}: tuples`).map((entry, index) => parseTuple(entry, `${sourceName}: tuples[${index}]`)),
-        tests: list(root["tests"], `${sourceName}: tests`).map((entry, index) => parseTest(entry, `${sourceName}: tests[${index}]`)),
-    };
-}
-function parseTuple(value, where) {
-    const entry = record(value, where, ["user", "relation", "object"]);
-    return {
-        user: text(entry["user"], `${where}.user`),
-        relation: text(entry["relation"], `${where}.relation`),
-        object: text(entry["object"], `${where}.object`),
-    };
-}
-function parseTest(value, where) {
-    const entry = record(value, where, ["name", "check", "list_objects"]);
-    return {
-        name: text(entry["name"], `${where}.name`),
-        check: optionalList(entry["check"], `${where}.check`).map((item, index) => parseCheck(item, `${where}.check[${index}]`)),
-        list_objects: optionalList(entry["list_objects"], `${where}.list_objects`).map((item, index) => parseListObjects(item, `${where}.list_objects[${index}]`)),
-    };
-}
-function parseCheck(value, where) {
-    const entry = record(value, where, ["user", "object", "assertions"]);
-    const assertions = record(entry["assertions"], `${where}.assertions`);
-    const parsed = {};
-    for (const [relation, expected] of Object.entries(assertions)) {
-        if (typeof expected !== "boolean") {
-            throw new Error(`${where}.assertions.${relation}: expected a boolean`);
-        }
-        parsed[relation] = expected;
-    }
-    return {
-        user: text(entry["user"], `${where}.user`),
-        object: text(entry["object"], `${where}.object`),
-        assertions: parsed,
-    };
-}
-function parseListObjects(value, where) {
-    const entry = record(value, where, ["user", "type", "assertions"]);
-    const assertions = record(entry["assertions"], `${where}.assertions`);
-    const parsed = {};
-    for (const [relation, expected] of Object.entries(assertions)) {
-        parsed[relation] = list(expected, `${where}.assertions.${relation}`).map((item, index) => text(item, `${where}.assertions.${relation}[${index}]`));
-    }
-    return {
-        user: text(entry["user"], `${where}.user`),
-        type: text(entry["type"], `${where}.type`),
-        assertions: parsed,
-    };
-}
-function record(value, where, allowedKeys) {
-    if (value === null || typeof value !== "object" || Array.isArray(value)) {
-        throw new Error(`${where}: expected a mapping`);
-    }
-    const entry = value;
-    if (allowedKeys !== undefined) {
-        for (const key of Object.keys(entry)) {
-            if (!allowedKeys.includes(key)) {
-                throw new Error(`${where}: unknown key '${key}'`);
-            }
-        }
-    }
-    return entry;
-}
-function list(value, where) {
-    if (!Array.isArray(value)) {
-        throw new Error(`${where}: expected a list`);
-    }
-    return value;
-}
-function optionalList(value, where) {
-    return value === undefined ? [] : list(value, where);
-}
-function text(value, where) {
-    if (typeof value !== "string") {
-        throw new Error(`${where}: expected a string`);
-    }
-    return value;
-}
-/**
- * The document's tests as runnable cases over `model`, plus every
- * assertion group the kit does not run.
- */
-export function storeTestCases(document, model) {
-    const source = newInMemoryTupleSource(document.tuples.map(tupleOf));
-    const skipped = [];
-    const cases = [];
-    for (const test of document.tests) {
-        const runnable = [];
-        for (const item of test.check) {
-            const object = parseObjectRef(item.object);
-            if (model.byType(object.type) === undefined) {
-                skipped.push({
-                    document: document.name,
-                    test: test.name,
-                    subject: item.user,
-                    object: item.object,
-                    reason: "undeclared-kind",
-                });
-            }
-            else {
-                runnable.push(item);
-            }
-        }
-        for (const item of test.list_objects) {
-            skipped.push({
-                document: document.name,
-                test: test.name,
-                subject: item.user,
-                object: `<${item.type}>`,
-                reason: "list-objects",
-            });
-        }
-        if (runnable.length === 0) {
-            continue;
-        }
-        cases.push({
-            name: `${document.name} :: ${test.name}`,
-            async run() {
-                for (const item of runnable) {
-                    const object = parseObjectRef(item.object);
-                    const person = personOf(item.user);
-                    for (const [relation, expected] of Object.entries(item.assertions)) {
-                        const recording = recordUndeclaredTypes(source, model);
-                        const actual = await checkRelation({ model, source: recording }, object, relation, person);
-                        if (recording.reached.size > 0) {
-                            skipped.push({
-                                document: document.name,
-                                test: test.name,
-                                subject: item.user,
-                                object: item.object,
-                                relation,
-                                reason: "undeclared-subject-type",
-                                types: [...recording.reached].sort(),
-                            });
-                            continue;
-                        }
-                        assert.equal(actual, expected, `${document.name} :: ${test.name}: ${item.user} ${relation} ${item.object} expected ${String(expected)}, got ${String(actual)}`);
-                    }
-                }
-            },
-        });
-    }
-    return { cases, skipped };
-}
-/**
- * A view of `inner` that records, for one walk, every subject type the
- * evaluator read that `model` does not declare. A person
- * (`identity_account:<id>`) is a subject the evaluator compares, never a
- * type it resolves, so it is not a "reach" whatever the model declares; a
- * userset or a parent object of an undeclared type is.
- */
-function recordUndeclaredTypes(inner, model) {
-    const reached = new Set();
-    return {
-        reached,
-        async tuplesOf(object, relation) {
-            const tuples = await inner.tuplesOf(object, relation);
-            for (const tuple of tuples) {
-                const type = resolvedTypeOf(tuple.subject);
-                if (type !== undefined && model.byType(type) === undefined) {
-                    reached.add(type);
-                }
-            }
-            return tuples;
-        },
-    };
-}
-/** The type the evaluator would resolve a subject on, or undefined for a person. */
-function resolvedTypeOf(subject) {
-    switch (subject.form) {
-        case "object":
-            return subject.object.type === ACCOUNT_TYPE
-                ? undefined
-                : subject.object.type;
-        case "userset":
-            return subject.object.type;
-        default: {
-            const exhaustive = subject;
-            throw new Error(`unknown subject form: ${JSON.stringify(exhaustive)}`);
-        }
-    }
-}
-function tupleOf(entry) {
-    return {
-        object: parseObjectRef(entry.object),
-        relation: entry.relation,
-        subject: parseSubject(entry.user),
-    };
-}
-/** The document's users are plain accounts; a user of another type is a format the kit does not run. */
-function personOf(user) {
-    const object = parseObjectRef(user);
-    if (object.type !== ACCOUNT_TYPE || object.id === "*") {
-        throw new Error(`store test users are accounts; got '${user}'`);
-    }
-    return { accountId: object.id, aliases: new Set([object.id]) };
-}
-//# sourceMappingURL=store-test-kit.js.map

package/dist/authorization/store-test-kit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"store-test-kit.js","sourceRoot":"","sources":["../../src/authorization/store-test-kit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG/C,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC;AAoCrB;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAc,EACd,UAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE;QACrC,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,OAAO;KACR,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,QAAQ,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,UAAU,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACzE,UAAU,CAAC,KAAK,EAAE,GAAG,UAAU,YAAY,KAAK,GAAG,CAAC,CACrD;QACD,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACtE,SAAS,CAAC,KAAK,EAAE,GAAG,UAAU,WAAW,KAAK,GAAG,CAAC,CACnD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,WAAW,CAAC;QACtD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,SAAS,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IACtE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxE,UAAU,CAAC,IAAI,EAAE,GAAG,KAAK,UAAU,KAAK,GAAG,CAAC,CAC7C;QACD,YAAY,EAAE,YAAY,CACxB,KAAK,CAAC,cAAc,CAAC,EACrB,GAAG,KAAK,eAAe,CACxB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,gBAAgB,CAAC,IAAI,EAAE,GAAG,KAAK,iBAAiB,KAAK,GAAG,CAAC,CAC1D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;IACtE,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,eAAe,QAAQ,sBAAsB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;IAC9B,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,SAAS,CAAC;QAChD,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAAa;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;IACtE,MAAM,MAAM,GAA0C,EAAE,CAAC;IACzD,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,KAAK,eAAe,QAAQ,EAAE,CAAC,CAAC,GAAG,CACtE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,eAAe,QAAQ,IAAI,KAAK,GAAG,CAAC,CACzE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC;QAC1C,UAAU,EAAE,MAAM;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CACb,KAAc,EACd,KAAa,EACb,WAAmC;IAEnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,GAAG,GAAG,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAA+B,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAqCD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA2B,EAC3B,KAAY;IAEZ,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAoB,EAAE,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC5C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,IAAI,CAAC,IAAI;oBAClB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,MAAM,EAAE,iBAAiB;iBAC1B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG;gBACxB,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE;YACxC,KAAK,CAAC,GAAG;gBACP,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACnC,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;wBACnE,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;wBACvD,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAC5B,MAAM,EACN,QAAQ,EACR,MAAM,CACP,CAAC;wBACF,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;4BAC/B,OAAO,CAAC,IAAI,CAAC;gCACX,QAAQ,EAAE,QAAQ,CAAC,IAAI;gCACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gCACf,OAAO,EAAE,IAAI,CAAC,IAAI;gCAClB,MAAM,EAAE,IAAI,CAAC,MAAM;gCACnB,QAAQ;gCACR,MAAM,EAAE,yBAAyB;gCACjC,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;6BACrC,CAAC,CAAC;4BACH,SAAS;wBACX,CAAC;wBACD,MAAM,CAAC,KAAK,CACV,MAAM,EACN,QAAQ,EACR,GAAG,QAAQ,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,aAAa,MAAM,CAAC,QAAQ,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,EAAE,CAChI,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAOD;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,KAAkB,EAClB,KAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO;QACL,OAAO;QACP,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ;YAC7B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC3D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,cAAc,CAAC,OAAgB;IACtC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;gBACzC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,KAAK,SAAS;YACZ,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAqB;IACpC,OAAO;QACL,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/src/authorization/__tests__/fixtures/fga/agent-channel-owner.fga.yaml

@@ -1,112 +0,0 @@
-# Pinned copy of stigmer-cloud backend/services/stigmer-server/fga/tests/agent-channel-owner.fga.yaml
-# at commit b87dd1170 (the OpenFGA store test the cloud runs against its live model).
-# The body below is byte-identical to the source; the cloud re-runs the LIVE
-# file against this evaluator at the re-pin, so a stale copy is caught there.
-# Agent channels are owner-scoped connection config (channel-integrations
-# decision 001, cloned from the agent_share model): the creator owns the
-# channel; view/edit/delete/install require ownership or an explicit grant.
-# Plain org members get NO implicit access, and — critically — no
-# workspace-visitor tuples exist at all: workspace-user admission to the
-# channel runtime is app-level (webhook signature + channel caller identity
-# + per-turn gates), never FGA.
-#
-# Org ADMINS inherit owner (T08, consistent with agents and shares — an
-# admin who can edit the agent can manage its distribution channels). The
-# narrowness these tests pin: owner + admins have control, granted viewers
-# read, plain members have nothing.
-#
-# Run: fga model test --tests agent-channel-owner.fga.yaml
-
-name: agent-channel-owner
-model_file: ../model/fga.mod
-
-tuples:
-  # Org membership for both accounts — proving membership grants nothing.
-  - user: identity_account:alice
-    relation: member
-    object: organization:acme
-  - user: identity_account:mallory
-    relation: member
-    object: organization:acme
-
-  # Org admin — proving T08 inheritance reaches channels.
-  - user: identity_account:ana
-    relation: admin
-    object: organization:acme
-
-  # The channel, created by alice (the config-driven create tuples).
-  - user: organization:acme
-    relation: organization
-    object: agent_channel:support-bot-slack
-  - user: identity_account:alice
-    relation: owner
-    object: agent_channel:support-bot-slack
-
-  # An explicit viewer grant to carol (not even an org member).
-  - user: identity_account:carol
-    relation: viewer
-    object: agent_channel:support-bot-slack
-
-tests:
-  - name: owner has full control including grant management
-    check:
-      - user: identity_account:alice
-        object: agent_channel:support-bot-slack
-        assertions:
-          can_view: true
-          can_edit: true
-          can_delete: true
-          can_grant_access: true
-          can_view_access: true
-
-  - name: explicitly granted viewer can read but not mutate
-    check:
-      - user: identity_account:carol
-        object: agent_channel:support-bot-slack
-        assertions:
-          can_view: true
-          can_edit: false
-          can_delete: false
-          can_grant_access: false
-          can_view_access: true
-
-  - name: fellow org member has no implicit access
-    check:
-      - user: identity_account:mallory
-        object: agent_channel:support-bot-slack
-        assertions:
-          can_view: false
-          can_edit: false
-          can_delete: false
-          can_grant_access: false
-          can_view_access: false
-
-  - name: org admin inherits channel management (T08)
-    check:
-      - user: identity_account:ana
-        object: agent_channel:support-bot-slack
-        assertions:
-          can_view: true
-          can_edit: true
-          can_delete: true
-          can_grant_access: true
-
-  - name: listing channels reflects ownership and grants, not membership
-    list_objects:
-      - user: identity_account:alice
-        type: agent_channel
-        assertions:
-          can_view:
-            - agent_channel:support-bot-slack
-          can_edit:
-            - agent_channel:support-bot-slack
-      - user: identity_account:carol
-        type: agent_channel
-        assertions:
-          can_view:
-            - agent_channel:support-bot-slack
-          can_edit: []
-      - user: identity_account:mallory
-        type: agent_channel
-        assertions:
-          can_view: []