@stigmer/server 3.27.1 → 3.28.0

package/dist/authorization/model/default-of.d.ts

@@ -14,8 +14,8 @@
  * resolves the blueprint's `viewer` on — one read serves both. Which spec
  * field names the blueprint is `kind_meta`'s to say (the instance kind's
  * `additional_parents` entry for the blueprint kind), never restated
- * here; an instance kind without that entry is a transcript bug and
- * throws at first use rather than deriving nothing.
+ * here; an instance kind without that entry is a binding bug
+ * (bindings.ts) and throws at first use rather than deriving nothing.
  *
  * A user-created instance points at a blueprint whose pointer names a
  * different row (or none), so the rule derives nothing for it and its

package/dist/authorization/model/execution-viewer.d.ts

@@ -0,0 +1,3 @@
+import type { DerivedRelation } from "./rewrite.js";
+export declare const executionViewer: DerivedRelation;
+//# sourceMappingURL=execution-viewer.d.ts.map

package/dist/authorization/model/execution-viewer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-viewer.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/execution-viewer.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,eAAO,MAAM,eAAe,EAAE,eAiC7B,CAAC"}

package/dist/authorization/model/execution-viewer.js

@@ -0,0 +1,50 @@
+/**
+ * The `execution_viewer` derived rule of a workflow instance. The model
+ * (fga/model/agentic/workflow_instance.fga) keeps the instance's RUN
+ * history audience apart from `viewer`, so making an instance
+ * org-runnable never exposes other people's run inputs and outputs;
+ * workflow_execution reads it through `execution_viewer from
+ * workflow_instance`.
+ *
+ * It is derived from `spec.execution_visibility`, which `kind_meta`
+ * cannot express: `organization` derives
+ * `#execution_viewer@organization:<org>#viewer`, the organization's full
+ * read audience (the relation also admits `#member`, the legacy shape),
+ * and `private` or unset derives nothing, so each run stays its
+ * triggerer's. Pure over the row; no related row is read.
+ */
+import { isMessage } from "@bufbuild/protobuf";
+import { WorkflowInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
+import { WorkflowExecutionVisibility } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/spec_pb";
+export const executionViewer = (object, row) => {
+    if (!isMessage(row, WorkflowInstanceSchema)) {
+        return Promise.resolve([]);
+    }
+    const level = row.spec?.executionVisibility ?? WorkflowExecutionVisibility.unspecified;
+    switch (level) {
+        case WorkflowExecutionVisibility.organization: {
+            const org = row.metadata?.org ?? "";
+            return Promise.resolve(org === ""
+                ? []
+                : [
+                    {
+                        object,
+                        relation: "execution_viewer",
+                        subject: {
+                            form: "userset",
+                            object: { type: "organization", id: org },
+                            relation: "viewer",
+                        },
+                    },
+                ]);
+        }
+        case WorkflowExecutionVisibility.private:
+        case WorkflowExecutionVisibility.unspecified:
+            return Promise.resolve([]);
+        default: {
+            const exhaustive = level;
+            throw new Error(`unknown execution visibility: ${String(exhaustive)}`);
+        }
+    }
+};
+//# sourceMappingURL=execution-viewer.js.map

package/dist/authorization/model/execution-viewer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-viewer.js","sourceRoot":"","sources":["../../../src/authorization/model/execution-viewer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,gEAAgE,CAAC;AAI7G,MAAM,CAAC,MAAM,eAAe,GAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC9D,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GACT,GAAG,CAAC,IAAI,EAAE,mBAAmB,IAAI,2BAA2B,CAAC,WAAW,CAAC;IAC3E,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC,OAAO,CACpB,GAAG,KAAK,EAAE;gBACR,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE;wBACE,MAAM;wBACN,QAAQ,EAAE,kBAAkB;wBAC5B,OAAO,EAAE;4BACP,IAAI,EAAE,SAAS;4BACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;4BACzC,QAAQ,EAAE,QAAQ;yBACnB;qBACF;iBACF,CACN,CAAC;QACJ,CAAC;QACD,KAAK,2BAA2B,CAAC,OAAO,CAAC;QACzC,KAAK,2BAA2B,CAAC,WAAW;YAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC,CAAC"}

package/dist/authorization/model/index.d.ts

@@ -1,26 +1,31 @@
 /**
- * The built-in model — every kind declaration open source evaluates,
- * registered once in the order the cloud's `fga.mod` files them, and
- * reached by kind (the driver's `AuthzCheck.resourceKind`) or by FGA type
- * name (an object reference inside a tuple). A kind with no declaration
- * is one this edition does not evaluate: as a check TARGET that is a
- * registry gap the evaluator throws on (the driver refuses unserved kinds
- * before any evaluation, so the throw is a backstop); reached through a
- * tuple it is simply an object with no relations.
+ * The built-in model: every type of the authorization model, reached by
+ * kind (the driver's `AuthzCheck.resourceKind`) or by FGA type name (an
+ * object reference inside a tuple), in `fga.mod` order.
  *
- * `newModel` exists for tests that need a throwaway model (a cycle, a
- * chain past the depth bound) and for the cloud's drift test, which
- * builds a model from the live `.fga` files and compares.
+ * It is built at module load from the one set of bytes every edition
+ * reads: data/authorization-model.json, OpenFGA's JSON compiled from the
+ * `.fga` files under fga/model (`make gen-authorization-model`), which the
+ * engine suites under fga/tests also run against. The reader
+ * (openfga-json.ts) turns it into the evaluator's vocabulary, and the
+ * binding table (bindings.ts) adds what JSON cannot carry: each kind's row
+ * schema and its derived rules. A model this server cannot evaluate, or a
+ * type and a binding that disagree, fails the load, so it fails the boot
+ * and every test that imports the model, never an answer.
+ *
+ * The model declares every type, whichever edition serves it. Which kinds
+ * an edition evaluates is the tier's question, answered before any
+ * evaluation (authorizer.ts, `kindServedByEdition`): open source refuses a
+ * check that targets `team`, `identity_provider`, `invitation` or
+ * `platform`, and a tuple that names one resolves over tuples alone, since
+ * this edition stores no row of those kinds.
  *
- * Registered: every kind of the open-source tier — the twenty-four
- * `kind_meta.tier: open_source` members — and nothing else. The three
- * files `fga.mod` lists that have no declaration here (`platform`,
- * `identity_provider`, `invitation`) are kinds this edition does not
- * serve: a check that targets one is refused by the
- * driver, and a tuple that names one (`identity_provider#platform_user`)
- * resolves to nobody. The registry test pins the list against the tier.
+ * `newModel` exists for tests that need a throwaway model (a cycle, a
+ * chain past the depth bound).
  */
-import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { KindBinding } from "./bindings.js";
+import type { ModelType } from "./openfga-json.js";
 import type { KindDeclaration } from "./rewrite.js";
 export interface Model {
     /** In registry order. */
@@ -29,8 +34,15 @@ export interface Model {
     byType(type: string): KindDeclaration | undefined;
 }
 export declare function newModel(declarations: ReadonlyArray<KindDeclaration>): Model;
-/** The declarations this edition evaluates, in `fga.mod` order. */
+/**
+ * Joins the compiled model's types with their bindings, in the model's
+ * order. Refuses a type that names no `ApiResourceKind`, a type with no
+ * binding, a binding with no type, and a derived rule for a relation the
+ * type does not define.
+ */
+export declare function bindModel(types: ReadonlyArray<ModelType>, bindings: ReadonlyMap<ApiResourceKind, KindBinding>): ReadonlyArray<KindDeclaration>;
+/** Every type of the authorization model, in `fga.mod` order. */
 export declare const builtInModel: Model;
-/** The built-in model's declaration for a kind, or undefined for a kind it does not evaluate. */
+/** The built-in model's declaration for a kind, or undefined for a kind the model does not define. */
 export declare function declarationFor(kind: ApiResourceKind): KindDeclaration | undefined;
 //# sourceMappingURL=index.d.ts.map

package/dist/authorization/model/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAoB3H,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAQpD,MAAM,WAAW,KAAK;IACpB,yBAAyB;IACzB,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACtD,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,GAAG,SAAS,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;CACnD;AAED,wBAAgB,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,GAAG,KAAK,CAe5E;AAED,mEAAmE;AACnE,eAAO,MAAM,YAAY,EAAE,KAyBzB,CAAC;AAEH,iGAAiG;AACjG,wBAAgB,cAAc,CAC5B,IAAI,EAAE,eAAe,GACpB,eAAe,GAAG,SAAS,CAE7B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,KAAK,EAAmB,eAAe,EAAE,MAAM,cAAc,CAAC;AAErE,MAAM,WAAW,KAAK;IACpB,yBAAyB;IACzB,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACtD,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,GAAG,SAAS,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;CACnD;AAED,wBAAgB,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,GAAG,KAAK,CAe5E;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,EAC/B,QAAQ,EAAE,WAAW,CAAC,eAAe,EAAE,WAAW,CAAC,GAClD,aAAa,CAAC,eAAe,CAAC,CAoChC;AAED,iEAAiE;AACjE,eAAO,MAAM,YAAY,EAAE,KAE1B,CAAC;AAEF,sGAAsG;AACtG,wBAAgB,cAAc,CAC5B,IAAI,EAAE,eAAe,GACpB,eAAe,GAAG,SAAS,CAE7B"}

package/dist/authorization/model/index.js

@@ -1,27 +1,33 @@
-import { agentDeclaration } from "./agent.js";
-import { agentChannelDeclaration } from "./agent_channel.js";
-import { agentExecutionDeclaration } from "./agent_execution.js";
-import { agentInstanceDeclaration } from "./agent_instance.js";
-import { agentShareDeclaration } from "./agent_share.js";
-import { apiKeyDeclaration } from "./api_key.js";
-import { artifactDeclaration } from "./artifact.js";
-import { channelAppDeclaration } from "./channel_app.js";
-import { environmentDeclaration } from "./environment.js";
-import { executionContextDeclaration } from "./execution_context.js";
-import { iamPolicyDeclaration } from "./iam_policy.js";
-import { identityAccountDeclaration } from "./identity_account.js";
-import { mcpServerDeclaration } from "./mcp_server.js";
-import { memoryDeclaration } from "./memory.js";
-import { oauthAppDeclaration } from "./oauth_app.js";
-import { organizationDeclaration } from "./organization.js";
-import { platformClientDeclaration } from "./platform_client.js";
-import { pluginDeclaration } from "./plugin.js";
-import { scheduleDeclaration } from "./schedule.js";
-import { sessionDeclaration } from "./session.js";
-import { skillDeclaration } from "./skill.js";
-import { workflowDeclaration } from "./workflow.js";
-import { workflowExecutionDeclaration } from "./workflow_execution.js";
-import { workflowInstanceDeclaration } from "./workflow_instance.js";
+/**
+ * The built-in model: every type of the authorization model, reached by
+ * kind (the driver's `AuthzCheck.resourceKind`) or by FGA type name (an
+ * object reference inside a tuple), in `fga.mod` order.
+ *
+ * It is built at module load from the one set of bytes every edition
+ * reads: data/authorization-model.json, OpenFGA's JSON compiled from the
+ * `.fga` files under fga/model (`make gen-authorization-model`), which the
+ * engine suites under fga/tests also run against. The reader
+ * (openfga-json.ts) turns it into the evaluator's vocabulary, and the
+ * binding table (bindings.ts) adds what JSON cannot carry: each kind's row
+ * schema and its derived rules. A model this server cannot evaluate, or a
+ * type and a binding that disagree, fails the load, so it fails the boot
+ * and every test that imports the model, never an answer.
+ *
+ * The model declares every type, whichever edition serves it. Which kinds
+ * an edition evaluates is the tier's question, answered before any
+ * evaluation (authorizer.ts, `kindServedByEdition`): open source refuses a
+ * check that targets `team`, `identity_provider`, `invitation` or
+ * `platform`, and a tuple that names one resolves over tuples alone, since
+ * this edition stores no row of those kinds.
+ *
+ * `newModel` exists for tests that need a throwaway model (a cycle, a
+ * chain past the depth bound).
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { kindByEnumName } from "../../pipeline/apiresource-meta.js";
+import { KIND_BINDINGS } from "./bindings.js";
+import compiledModel from "./data/authorization-model.json" with { type: "json" };
+import { readOpenFgaModel } from "./openfga-json.js";
 export function newModel(declarations) {
     const byKind = new Map();
     const byType = new Map();
@@ -38,34 +44,50 @@ export function newModel(declarations) {
         byType: (type) => byType.get(type),
     };
 }
-/** The declarations this edition evaluates, in `fga.mod` order. */
-export const builtInModel = newModel([
-    identityAccountDeclaration,
-    iamPolicyDeclaration,
-    apiKeyDeclaration,
-    oauthAppDeclaration,
-    platformClientDeclaration,
-    organizationDeclaration,
-    agentDeclaration,
-    agentChannelDeclaration,
-    agentShareDeclaration,
-    channelAppDeclaration,
-    agentInstanceDeclaration,
-    agentExecutionDeclaration,
-    artifactDeclaration,
-    environmentDeclaration,
-    executionContextDeclaration,
-    mcpServerDeclaration,
-    memoryDeclaration,
-    scheduleDeclaration,
-    sessionDeclaration,
-    skillDeclaration,
-    workflowDeclaration,
-    workflowInstanceDeclaration,
-    workflowExecutionDeclaration,
-    pluginDeclaration,
-]);
-/** The built-in model's declaration for a kind, or undefined for a kind it does not evaluate. */
+/**
+ * Joins the compiled model's types with their bindings, in the model's
+ * order. Refuses a type that names no `ApiResourceKind`, a type with no
+ * binding, a binding with no type, and a derived rule for a relation the
+ * type does not define.
+ */
+export function bindModel(types, bindings) {
+    const bound = new Set();
+    const declarations = types.map((entry) => {
+        const kind = kindByEnumName(entry.type);
+        if (kind === ApiResourceKind.api_resource_kind_unknown) {
+            throw new Error(`${entry.source}: type '${entry.type}' names no ApiResourceKind`);
+        }
+        const binding = bindings.get(kind);
+        if (binding === undefined) {
+            throw new Error(`${entry.source}: type '${entry.type}' has no binding (model/bindings.ts)`);
+        }
+        bound.add(kind);
+        const derived = new Map();
+        for (const [relation, rule] of Object.entries(binding.derived ?? {})) {
+            if (!entry.relations.has(relation)) {
+                throw new Error(`model/bindings.ts: a derived rule for '${entry.type}#${relation}', which ${entry.source} does not define`);
+            }
+            derived.set(relation, rule);
+        }
+        return {
+            kind,
+            type: entry.type,
+            schema: binding.schema,
+            source: entry.source,
+            relations: entry.relations,
+            derived,
+        };
+    });
+    for (const kind of bindings.keys()) {
+        if (!bound.has(kind)) {
+            throw new Error(`model/bindings.ts: a binding for '${ApiResourceKind[kind]}', which the model does not define`);
+        }
+    }
+    return declarations;
+}
+/** Every type of the authorization model, in `fga.mod` order. */
+export const builtInModel = newModel(bindModel(readOpenFgaModel(compiledModel), KIND_BINDINGS));
+/** The built-in model's declaration for a kind, or undefined for a kind the model does not define. */
 export function declarationFor(kind) {
     return builtInModel.byKind(kind);
 }

package/dist/authorization/model/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/model/index.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AASrE,MAAM,UAAU,QAAQ,CAAC,YAA4C;IACnE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,CAAC,IAAI,iCAAiC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO;QACL,YAAY;QACZ,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,YAAY,GAAU,QAAQ,CAAC;IAC1C,0BAA0B;IAC1B,oBAAoB;IACpB,iBAAiB;IACjB,mBAAmB;IACnB,yBAAyB;IACzB,uBAAuB;IACvB,gBAAgB;IAChB,uBAAuB;IACvB,qBAAqB;IACrB,qBAAqB;IACrB,wBAAwB;IACxB,yBAAyB;IACzB,mBAAmB;IACnB,sBAAsB;IACtB,2BAA2B;IAC3B,oBAAoB;IACpB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB;IACnB,2BAA2B;IAC3B,4BAA4B;IAC5B,iBAAiB;CAClB,CAAC,CAAC;AAEH,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAC5B,IAAqB;IAErB,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/model/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,aAAa,MAAM,iCAAiC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAElF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAUrD,MAAM,UAAU,QAAQ,CAAC,YAA4C;IACnE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,CAAC,IAAI,iCAAiC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO;QACL,YAAY;QACZ,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,KAA+B,EAC/B,QAAmD;IAEnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAmB,EAAE;QACxD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,IAAI,4BAA4B,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,IAAI,sCAAsC,CAAC,CAAC;QAC9F,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;QACnD,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,CAAC,IAAI,IAAI,QAAQ,YAAY,KAAK,CAAC,MAAM,kBAAkB,CAC3G,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO;SACR,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,qCAAqC,eAAe,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,MAAM,YAAY,GAAU,QAAQ,CACzC,SAAS,CAAC,gBAAgB,CAAC,aAAwB,CAAC,EAAE,aAAa,CAAC,CACrE,CAAC;AAEF,sGAAsG;AACtG,MAAM,UAAU,cAAc,CAC5B,IAAqB;IAErB,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/authorization/model/openfga-json.d.ts

@@ -0,0 +1,18 @@
+import type { Rewrite } from "./rewrite.js";
+/** The only schema version this reader accepts: the modular DSL's. */
+export declare const SUPPORTED_SCHEMA_VERSION = "1.2";
+/** One type of the compiled model, in the evaluator's vocabulary. */
+export interface ModelType {
+    /** The FGA type name: an `ApiResourceKind` member name (`agent`, `identity_account`). */
+    readonly type: string;
+    /** The `.fga` file the type is defined in, relative to the server package (`fga/model/agentic/agent.fga`). */
+    readonly source: string;
+    /** Every relation the type defines, sorted by name. */
+    readonly relations: ReadonlyMap<string, Rewrite>;
+}
+/**
+ * Reads a parsed compiled model. `where` names the file in every message.
+ * Throws on anything the module header says is refused or re-asserted.
+ */
+export declare function readOpenFgaModel(value: unknown, where?: string): ReadonlyArray<ModelType>;
+//# sourceMappingURL=openfga-json.d.ts.map

package/dist/authorization/model/openfga-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openfga-json.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/openfga-json.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,OAAO,EAAe,MAAM,cAAc,CAAC;AAEzD,sEAAsE;AACtE,eAAO,MAAM,wBAAwB,QAAQ,CAAC;AAE9C,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACxB,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8GAA8G;IAC9G,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClD;AAKD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,OAAO,EACd,KAAK,SAA6B,GACjC,aAAa,CAAC,SAAS,CAAC,CAwB1B"}

package/dist/authorization/model/openfga-json.js

@@ -0,0 +1,266 @@
+/**
+ * The reader of the compiled authorization model: OpenFGA's own JSON
+ * (data/authorization-model.json, written by `make gen-authorization-model`
+ * from the `.fga` files under fga/model) turned into the evaluator's
+ * vocabulary (rewrite.ts), one entry per type in the file's order.
+ *
+ * The file is OpenFGA's format, not this server's, so it is read as
+ * `unknown` and refused loudly (strict-json.ts): every key the compiled
+ * model carries is listed below, and any other key, at any depth, is a
+ * thrown fault naming where. It runs when model/index.ts loads, so a model
+ * this server cannot evaluate fails the boot and every test that imports
+ * the model, never an answer.
+ *
+ * What is accepted, which is what the compiled model uses:
+ *   - `schema_version` "1.2" and `type_definitions`;
+ *   - per type: `type`, `relations`, and `metadata.{module, relations,
+ *     source_info.file}`;
+ *   - per relation's metadata: `directly_related_user_types[]`, each an
+ *     object type (`{type}`) or a userset (`{type, relation}`);
+ *   - per rewrite node: `this`, `computedUserset.relation`,
+ *     `tupleToUserset.{tupleset,computedUserset}.relation`, `union.child`
+ *     and `intersection.child`, nested to any depth (the evaluator
+ *     recurses through any nesting).
+ *
+ * What is refused by name, because the evaluator does not implement it
+ * and the day the model needs it is a design act: `difference` (`but
+ * not`), conditions (a `conditions` map, or a type reference carrying
+ * `condition`), wildcards (`type:*`), a `computedUserset` that names
+ * another object, and any schema version but 1.2.
+ *
+ * What is re-asserted, though OpenFGA's validator proved it when the file
+ * was compiled, because the file is committed data and a hand edit must
+ * fail here rather than in an answer: every computed target and tupleset
+ * is a relation of its own type; every subject type names a declared type,
+ * and a userset subject a relation that type declares; and a relation
+ * lists direct subject types exactly when its rewrite has a `this` node,
+ * which is where the evaluator reads that list from.
+ *
+ * Relations come out sorted by name (the canonical file sorts keys; the
+ * evaluator only looks relations up). A union's or an intersection's
+ * children keep the file's order: the evaluator short-circuits in that
+ * order, so it is what the cost of a check rides on.
+ *
+ * The reader imports nothing but the vocabulary and the strict-read
+ * helpers, so the reader and the evaluator stay a self-contained pair.
+ */
+import { list, record, text } from "../strict-json.js";
+/** The only schema version this reader accepts: the modular DSL's. */
+export const SUPPORTED_SCHEMA_VERSION = "1.2";
+/** Where the `.fga` files live, relative to the server package; `source_info.file` is relative to it. */
+const MODEL_SOURCE_DIR = "fga/model";
+/**
+ * Reads a parsed compiled model. `where` names the file in every message.
+ * Throws on anything the module header says is refused or re-asserted.
+ */
+export function readOpenFgaModel(value, where = "authorization-model.json") {
+    const root = record(value, where, ["schema_version", "type_definitions", "conditions"]);
+    if (root["conditions"] !== undefined) {
+        throw new Error(`${where}: conditions are not evaluated by this server`);
+    }
+    const version = text(root["schema_version"], `${where}: schema_version`);
+    if (version !== SUPPORTED_SCHEMA_VERSION) {
+        throw new Error(`${where}: schema_version '${version}' is not ${SUPPORTED_SCHEMA_VERSION}, the only version this server reads`);
+    }
+    const types = [];
+    const seen = new Set();
+    list(root["type_definitions"], `${where}: type_definitions`).forEach((entry, index) => {
+        const parsed = readType(entry, `${where}: type_definitions[${index}]`);
+        if (seen.has(parsed.type)) {
+            throw new Error(`${where}: type '${parsed.type}' is defined twice`);
+        }
+        seen.add(parsed.type);
+        types.push(parsed);
+    });
+    assertReferencesResolve(types, where);
+    return types;
+}
+function readType(value, where) {
+    const entry = record(value, where, ["type", "relations", "metadata"]);
+    const type = text(entry["type"], `${where}.type`);
+    const at = `${where} (${type})`;
+    const metadata = record(entry["metadata"], `${at}.metadata`, [
+        "module",
+        "relations",
+        "source_info",
+    ]);
+    text(metadata["module"], `${at}.metadata.module`);
+    const sourceInfo = record(metadata["source_info"], `${at}.metadata.source_info`, ["file"]);
+    const file = text(sourceInfo["file"], `${at}.metadata.source_info.file`);
+    const directTypes = readDirectTypes(metadata["relations"], `${at}.metadata.relations`);
+    const rewrites = entry["relations"] === undefined ? {} : record(entry["relations"], `${at}.relations`);
+    for (const relation of directTypes.keys()) {
+        if (!(relation in rewrites)) {
+            throw new Error(`${at}.metadata.relations.${relation}: metadata for a relation ${type} does not define`);
+        }
+    }
+    const relations = new Map();
+    for (const name of Object.keys(rewrites).sort()) {
+        const subjects = directTypes.get(name);
+        const rewrite = readRewrite(rewrites[name], `${at}.relations.${name}`, subjects);
+        const hasThis = containsThis(rewrite);
+        if (hasThis && subjects === undefined) {
+            throw new Error(`${at}.relations.${name}: a direct relation with no directly_related_user_types`);
+        }
+        if (!hasThis && subjects !== undefined) {
+            throw new Error(`${at}.relations.${name}: directly_related_user_types on a relation with no direct node`);
+        }
+        relations.set(name, rewrite);
+    }
+    return { type, source: `${MODEL_SOURCE_DIR}/${file}`, relations };
+}
+/** Each relation's direct subject types; a relation whose metadata is `{}` lists none and is absent. */
+function readDirectTypes(value, where) {
+    const out = new Map();
+    if (value === undefined) {
+        return out;
+    }
+    for (const [relation, meta] of Object.entries(record(value, where))) {
+        const entry = record(meta, `${where}.${relation}`, ["directly_related_user_types"]);
+        if (entry["directly_related_user_types"] === undefined) {
+            continue;
+        }
+        const at = `${where}.${relation}.directly_related_user_types`;
+        out.set(relation, list(entry["directly_related_user_types"], at).map((item, index) => readSubjectType(item, `${at}[${index}]`)));
+    }
+    return out;
+}
+function readSubjectType(value, where) {
+    const entry = record(value, where, ["type", "relation", "wildcard", "condition"]);
+    if (entry["wildcard"] !== undefined) {
+        throw new Error(`${where}: wildcard subject types are not evaluated by this server`);
+    }
+    if (entry["condition"] !== undefined) {
+        throw new Error(`${where}: conditional subject types are not evaluated by this server`);
+    }
+    const type = text(entry["type"], `${where}.type`);
+    return entry["relation"] === undefined
+        ? { form: "object", type }
+        : { form: "userset", type, relation: text(entry["relation"], `${where}.relation`) };
+}
+/**
+ * One rewrite node. `subjects` is the relation's direct list, which a
+ * `this` node takes; it is checked against the node's presence by the
+ * caller.
+ */
+function readRewrite(value, where, subjects) {
+    const node = record(value, where, [
+        "this",
+        "computedUserset",
+        "tupleToUserset",
+        "union",
+        "intersection",
+        "difference",
+    ]);
+    const keys = Object.keys(node);
+    if (keys.length !== 1) {
+        throw new Error(`${where}: a rewrite node has exactly one form, found ${keys.length}`);
+    }
+    const form = keys[0];
+    switch (form) {
+        case "this":
+            record(node["this"], `${where}.this`, []);
+            return { node: "this", subjects: subjects ?? [] };
+        case "computedUserset":
+            return { node: "computed", relation: localRelation(node["computedUserset"], `${where}.computedUserset`) };
+        case "tupleToUserset": {
+            const ttu = record(node["tupleToUserset"], `${where}.tupleToUserset`, [
+                "tupleset",
+                "computedUserset",
+            ]);
+            return {
+                node: "from",
+                tupleset: localRelation(ttu["tupleset"], `${where}.tupleToUserset.tupleset`),
+                relation: localRelation(ttu["computedUserset"], `${where}.tupleToUserset.computedUserset`),
+            };
+        }
+        case "union":
+        case "intersection": {
+            const operator = record(node[form], `${where}.${form}`, ["child"]);
+            const members = list(operator["child"], `${where}.${form}.child`).map((child, index) => readRewrite(child, `${where}.${form}.child[${index}]`, subjects));
+            if (members.length === 0) {
+                throw new Error(`${where}.${form}: an operator with no children`);
+            }
+            return { node: form, members };
+        }
+        case "difference":
+            throw new Error(`${where}: 'but not' (difference) is not evaluated by this server`);
+        default:
+            throw new Error(`${where}: unknown rewrite form '${String(form)}'`);
+    }
+}
+/** An `ObjectRelation` naming a relation of the same object: `object` must be unset. */
+function localRelation(value, where) {
+    const entry = record(value, where, ["relation", "object"]);
+    if (entry["object"] !== undefined) {
+        throw new Error(`${where}: a relation on another object is not evaluated by this server`);
+    }
+    return text(entry["relation"], `${where}.relation`);
+}
+function containsThis(rewrite) {
+    switch (rewrite.node) {
+        case "this":
+            return true;
+        case "computed":
+        case "from":
+            return false;
+        case "union":
+        case "intersection":
+            return rewrite.members.some(containsThis);
+        default: {
+            const exhaustive = rewrite;
+            throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`);
+        }
+    }
+}
+/** The cross-type re-assertions of the module header. */
+function assertReferencesResolve(types, where) {
+    const byType = new Map(types.map((entry) => [entry.type, entry]));
+    for (const entry of types) {
+        for (const [name, rewrite] of entry.relations) {
+            const at = `${where}: ${entry.type}#${name}`;
+            walk(rewrite, (node) => {
+                switch (node.node) {
+                    case "computed":
+                        if (!entry.relations.has(node.relation)) {
+                            throw new Error(`${at}: names relation '${node.relation}', which ${entry.type} does not define`);
+                        }
+                        return;
+                    case "from":
+                        if (!entry.relations.has(node.tupleset)) {
+                            throw new Error(`${at}: names tupleset '${node.tupleset}', which ${entry.type} does not define`);
+                        }
+                        return;
+                    case "this":
+                        for (const subject of node.subjects) {
+                            const target = byType.get(subject.type);
+                            if (target === undefined) {
+                                throw new Error(`${at}: admits subject type '${subject.type}', which the model does not define`);
+                            }
+                            if (subject.form === "userset" && !target.relations.has(subject.relation)) {
+                                throw new Error(`${at}: admits '${subject.type}#${subject.relation}', which ${subject.type} does not define`);
+                            }
+                        }
+                        return;
+                    case "union":
+                    case "intersection":
+                        return;
+                    default: {
+                        const exhaustive = node;
+                        throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`);
+                    }
+                }
+            });
+        }
+    }
+}
+/** Visits every node of a rewrite, depth first, in order. */
+function walk(rewrite, visit) {
+    visit(rewrite);
+    if (rewrite.node === "union" || rewrite.node === "intersection") {
+        for (const member of rewrite.members) {
+            walk(member, visit);
+        }
+    }
+}
+//# sourceMappingURL=openfga-json.js.map

package/dist/authorization/model/openfga-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openfga-json.js","sourceRoot":"","sources":["../../../src/authorization/model/openfga-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAGvD,sEAAsE;AACtE,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAY9C,yGAAyG;AACzG,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAc,EACd,KAAK,GAAG,0BAA0B;IAElC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC;IACxF,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC;IACzE,IAAI,OAAO,KAAK,wBAAwB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,qBAAqB,OAAO,YAAY,wBAAwB,sCAAsC,CAC/G,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACpF,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,KAAK,sBAAsB,KAAK,GAAG,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW,MAAM,CAAC,IAAI,oBAAoB,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,KAAa;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE;QAC3D,QAAQ;QACR,WAAW;QACX,aAAa;KACd,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAEzE,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;IACvF,MAAM,QAAQ,GACZ,KAAK,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IAExF,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,uBAAuB,QAAQ,6BAA6B,IAAI,kBAAkB,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,cAAc,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,OAAO,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,cAAc,IAAI,yDAAyD,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,cAAc,IAAI,iEAAiE,CAAC,CAAC;QAC5G,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC;AACpE,CAAC;AAED,wGAAwG;AACxG,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,QAAQ,EAAE,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAC;QACpF,IAAI,KAAK,CAAC,6BAA6B,CAAC,KAAK,SAAS,EAAE,CAAC;YACvD,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,GAAG,KAAK,IAAI,QAAQ,8BAA8B,CAAC;QAC9D,GAAG,CAAC,GAAG,CACL,QAAQ,EACR,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjE,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,KAAK,GAAG,CAAC,CACzC,CACF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2DAA2D,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8DAA8D,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS;QACpC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,WAAW,CAAC,EAAE,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAClB,KAAc,EACd,KAAa,EACb,QAAgD;IAEhD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE;QAChC,MAAM;QACN,iBAAiB;QACjB,gBAAgB;QAChB,OAAO;QACP,cAAc;QACd,YAAY;KACb,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gDAAgD,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC;YAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;QACpD,KAAK,iBAAiB;YACpB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,GAAG,KAAK,kBAAkB,CAAC,EAAE,CAAC;QAC5G,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,KAAK,iBAAiB,EAAE;gBACpE,UAAU;gBACV,iBAAiB;aAClB,CAAC,CAAC;YACH,OAAO;gBACL,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,0BAA0B,CAAC;gBAC5E,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,GAAG,KAAK,iCAAiC,CAAC;aAC3F,CAAC;QACJ,CAAC;QACD,KAAK,OAAO,CAAC;QACb,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,KAAK,IAAI,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACrF,WAAW,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,IAAI,UAAU,KAAK,GAAG,EAAE,QAAQ,CAAC,CACjE,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,gCAAgC,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACjC,CAAC;QACD,KAAK,YAAY;YACf,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0DAA0D,CAAC,CAAC;QACtF;YACE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gEAAgE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB;IACpC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,OAAO,CAAC;QACb,KAAK,cAAc;YACjB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,SAAS,uBAAuB,CAAC,KAA+B,EAAE,KAAa;IAC7E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAClE,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,EAAE,GAAG,GAAG,KAAK,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACrB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;oBAClB,KAAK,UAAU;wBACb,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;4BACxC,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,qBAAqB,IAAI,CAAC,QAAQ,YAAY,KAAK,CAAC,IAAI,kBAAkB,CAAC,CAAC;wBACnG,CAAC;wBACD,OAAO;oBACT,KAAK,MAAM;wBACT,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;4BACxC,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,qBAAqB,IAAI,CAAC,QAAQ,YAAY,KAAK,CAAC,IAAI,kBAAkB,CAAC,CAAC;wBACnG,CAAC;wBACD,OAAO;oBACT,KAAK,MAAM;wBACT,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACpC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;4BACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gCACzB,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,0BAA0B,OAAO,CAAC,IAAI,oCAAoC,CAAC,CAAC;4BACnG,CAAC;4BACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gCAC1E,MAAM,IAAI,KAAK,CACb,GAAG,EAAE,aAAa,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,YAAY,OAAO,CAAC,IAAI,kBAAkB,CAC7F,CAAC;4BACJ,CAAC;wBACH,CAAC;wBACD,OAAO;oBACT,KAAK,OAAO,CAAC;oBACb,KAAK,cAAc;wBACjB,OAAO;oBACT,OAAO,CAAC,CAAC,CAAC;wBACR,MAAM,UAAU,GAAU,IAAI,CAAC;wBAC/B,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBACzE,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,SAAS,IAAI,CAAC,OAAgB,EAAE,KAA8B;IAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;IACf,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAChE,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;AACH,CAAC"}