@stigmer/server 3.27.2 → 3.29.0

package/src/authorization/model/rewrite.ts

@@ -1,61 +1,52 @@
 /**
- * The relation-rewrite vocabulary the model declarations are written in —
- * the forms an OpenFGA `define` line takes in the cloud's `.fga` files,
- * and nothing more:
+ * The evaluator's vocabulary for the authorization model: the five
+ * relation-rewrite forms OpenFGA's JSON uses in the compiled model
+ * (data/authorization-model.json, read by openfga-json.ts), and a kind's
+ * declaration as the evaluator consumes it. The model itself is the
+ * `.fga` files under fga/model; this module only names its shapes.
  *
- *   define organization: [organization]                      → direct(objectOf("organization"))
+ *   define organization: [organization]        → this, subjects [organization]
  *   define owner: [identity_account] or admin from organization
- *                → union(direct(objectOf("identity_account")), from("admin", "organization"))
- *   define viewer: [identity_account, organization#member, organization#viewer]
- *                   or owner or platform_viewer
- *                → union(direct(objectOf(...), usersetOf(...), usersetOf(...)),
- *                        computed("owner"), computed("platform_viewer"))
+ *                → union(this, from("admin", "organization"))
+ *   define viewer: [identity_account, organization#viewer] or owner
+ *                → union(this, computed("owner"))
  *   define member: [identity_account] and viewer from organization
- *                → intersection(direct(objectOf("identity_account")), from("viewer", "organization"))
- *   define can_view: viewer                                   → computed("viewer")
+ *                → intersection(this, from("viewer", "organization"))
+ *   define can_view: viewer                    → computed("viewer")
  *
  * `and` exists for one shape: a relation that is true only while another
- * holds too — a team's member is a person granted the role AND still one
+ * holds too (a team's member is a person granted the role AND still one
  * of the organization's viewers, so leaving the organization ends every
- * team-derived grant with no cleanup. A line is either a union or an
- * intersection of leaves, never both: the DSL would need parentheses to
- * mix them, the cloud's reader refuses parentheses, and `declareKind`
- * refuses the nesting that would need them. `but not` has no node; the day
- * a line needs it, the transcript cannot be written and the gap is a
+ * team-derived grant with no cleanup). Operators nest to any depth, as
+ * the DSL's parentheses allow; the evaluator recurses through them.
+ * `but not`, wildcards (`type:*`) and conditions have no form here: the
+ * reader refuses them by name, and the day the model needs one is a
  * design act.
  *
- * A subject type is an object type or a userset; the model admits no
- * wildcard (`type:*`) and declares no condition, so neither has a form
- * here. The day a line needs one, the transcript cannot be written and
- * the gap is a design act.
- *
- * A declaration file (model/<kind>.ts) is a TRANSCRIPT of its `.fga`
- * file: the same relations, in the file's order, each line rewritten in
- * these builders so a reader with the model open sees the same text, and
- * so a structural compare against the file (the cloud's drift test at
- * the re-pin) needs no translation table.
- *
  * The direct form carries its type restrictions (`[identity_account,
  * organization#viewer]`) because the evaluator ENFORCES them: a tuple
  * whose subject the line does not list is ignored, which is what OpenFGA
- * does at write time. That is the fail-closed property of this design —
+ * does at write time. That is the fail-closed property of this design:
  * a derivation that drifts from the model (a userset the line dropped)
- * makes open source deny, never allow.
+ * makes the evaluator deny, never allow.
  *
  * `derived` names the relations `kind_meta.authorization` cannot derive
- * from the row alone: `default_of` on an instance (the
- * blueprint's `status.default_instance_id` must name this row — one
- * blueprint read through the loader; default-of.ts, shared by the two
- * instance kinds) and `execution_viewer` on a workflow instance
- * (`spec.execution_visibility`; workflow_instance.ts). A declaration that
- * has such a relation states the rule beside the transcript; the tuple
- * source dispatches to it by relation.
+ * from the row alone: `default_of` on an instance (the blueprint's
+ * `status.default_instance_id` must name this row; default-of.ts, shared
+ * by the two instance kinds) and `execution_viewer` on a workflow
+ * instance (`spec.execution_visibility`; execution-viewer.ts). The
+ * binding table (bindings.ts) attaches them; the tuple source dispatches
+ * to them by relation.
+ *
+ * Only types live here: the one producer of production declarations is
+ * the reader joined with the bindings (model/index.ts). Tests build
+ * throwaway models (a cycle, a chain past the depth bound) with the
+ * builders in __tests__/throwaway-model.ts.
  */
 import type { DescMessage, Message } from "@bufbuild/protobuf";
 
 import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
-import { kindEnumName } from "../../pipeline/apiresource-meta.js";
 import type { ObjectRef, RowLoader, Tuple } from "../tuples.js";
 
 /** One entry of a direct line's type restriction list. */
@@ -88,38 +79,6 @@ export type Rewrite =
       readonly members: ReadonlyArray<Rewrite>;
     };
 
-// ---------------------------------------------------------------------------
-// Builders — named so a transcript reads like its `.fga` line.
-// ---------------------------------------------------------------------------
-
-export function objectOf(type: string): SubjectType {
-  return { form: "object", type };
-}
-
-export function usersetOf(type: string, relation: string): SubjectType {
-  return { form: "userset", type, relation };
-}
-
-export function direct(...subjects: ReadonlyArray<SubjectType>): Rewrite {
-  return { node: "this", subjects };
-}
-
-export function computed(relation: string): Rewrite {
-  return { node: "computed", relation };
-}
-
-export function from(relation: string, tupleset: string): Rewrite {
-  return { node: "from", relation, tupleset };
-}
-
-export function union(...members: ReadonlyArray<Rewrite>): Rewrite {
-  return { node: "union", members };
-}
-
-export function intersection(...members: ReadonlyArray<Rewrite>): Rewrite {
-  return { node: "intersection", members };
-}
-
 // ---------------------------------------------------------------------------
 // A kind's declaration.
 // ---------------------------------------------------------------------------
@@ -139,127 +98,19 @@ export type DerivedRelation = (
 
 export interface KindDeclaration {
   readonly kind: ApiResourceKind;
-  /** The FGA type name — the kind's enum member name, as the cloud renders objects. */
+  /** The FGA type name: the kind's enum member name, as every edition renders objects. */
   readonly type: string;
-  /** The kind's message schema: what a stored row decodes with, and where its audit lives. */
-  readonly schema: DescMessage;
-  /** The `.fga` file this transcribes, relative to the cloud's `fga/` folder. */
+  /**
+   * The kind's message schema: what a stored row decodes with, and where
+   * its audit lives. Undefined for a ROWLESS type (bindings.ts), one with
+   * no stored resource (`platform`): it resolves over tuples alone, and
+   * no row is ever loaded or listed for it.
+   */
+  readonly schema: DescMessage | undefined;
+  /** The `.fga` file the type is defined in, relative to the server package. */
   readonly source: string;
-  /** Every relation the file defines, in the file's order. */
+  /** Every relation the type defines, sorted by name. */
   readonly relations: ReadonlyMap<string, Rewrite>;
   /** The relations `kind_meta` cannot derive (the module header). */
   readonly derived: ReadonlyMap<string, DerivedRelation>;
 }
-
-export interface KindDeclarationInput {
-  readonly kind: ApiResourceKind;
-  readonly schema: DescMessage;
-  readonly source: string;
-  readonly relations: ReadonlyArray<readonly [name: string, rewrite: Rewrite]>;
-  readonly derived?: ReadonlyArray<
-    readonly [name: string, rule: DerivedRelation]
-  >;
-}
-
-/**
- * Builds a declaration and refuses a transcript that cannot be right at
- * module load: a relation declared twice, a `computed` naming a relation
- * the kind does not define, a `from` whose tupleset the kind does not
- * define (its `relation` is the PARENT's and is resolved at evaluation),
- * a derived rule for a relation the transcript does not declare, and a
- * line no `.fga` file could hold without parentheses (a union inside an
- * intersection or the reverse, an operator nested in itself, an operator
- * over fewer than two members).
- */
-export function declareKind(input: KindDeclarationInput): KindDeclaration {
-  const type = kindEnumName(input.kind);
-  const relations = new Map<string, Rewrite>();
-  for (const [name, rewrite] of input.relations) {
-    if (relations.has(name)) {
-      throw new Error(`${input.source}: relation '${name}' is declared twice`);
-    }
-    const shape = unwritableShape(rewrite);
-    if (shape !== undefined) {
-      throw new Error(`${input.source}: '${name}' ${shape}`);
-    }
-    relations.set(name, rewrite);
-  }
-  for (const [name, rewrite] of relations) {
-    for (const reference of localReferences(rewrite)) {
-      if (!relations.has(reference.relation)) {
-        throw new Error(
-          `${input.source}: '${name}' names ${reference.role} '${reference.relation}', which ${type} does not declare`,
-        );
-      }
-    }
-  }
-  const derived = new Map<string, DerivedRelation>();
-  for (const [name, rule] of input.derived ?? []) {
-    if (!relations.has(name)) {
-      throw new Error(
-        `${input.source}: a derived rule for '${name}', which ${type} does not declare`,
-      );
-    }
-    derived.set(name, rule);
-  }
-  return {
-    kind: input.kind,
-    type,
-    schema: input.schema,
-    source: input.source,
-    relations,
-    derived,
-  };
-}
-
-/** The relations of the SAME kind a rewrite names: computed targets and tuplesets. */
-function localReferences(
-  rewrite: Rewrite,
-): ReadonlyArray<{ readonly role: string; readonly relation: string }> {
-  switch (rewrite.node) {
-    case "this":
-      return [];
-    case "computed":
-      return [{ role: "relation", relation: rewrite.relation }];
-    case "from":
-      return [{ role: "tupleset", relation: rewrite.tupleset }];
-    case "union":
-    case "intersection":
-      return rewrite.members.flatMap(localReferences);
-    default: {
-      const exhaustive: never = rewrite;
-      throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`);
-    }
-  }
-}
-
-/**
- * Why a line could not be written in a `.fga` file without parentheses,
- * or undefined when it can: an operator's members are leaves (a direct
- * list, a sibling relation, a tuple-to-userset), and there are at least
- * two of them.
- */
-function unwritableShape(rewrite: Rewrite): string | undefined {
-  switch (rewrite.node) {
-    case "this":
-    case "computed":
-    case "from":
-      return undefined;
-    case "union":
-    case "intersection": {
-      if (rewrite.members.length < 2) {
-        return `is ${rewrite.node === "union" ? "an or" : "an and"} over fewer than two members`;
-      }
-      const nested = rewrite.members.find(
-        (member) => member.node === "union" || member.node === "intersection",
-      );
-      return nested === undefined
-        ? undefined
-        : `nests ${nested.node === "union" ? "or" : "and"} inside ${rewrite.node === "union" ? "or" : "and"}, which a .fga line cannot say without parentheses`;
-    }
-    default: {
-      const exhaustive: never = rewrite;
-      throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`);
-    }
-  }
-}

package/src/authorization/strict-json.ts

@@ -0,0 +1,52 @@
+/**
+ * Strict reads of a parsed JSON or YAML value, for the two inputs the
+ * authorization module takes as data: the compiled model
+ * (model/openfga-json.ts) and the `.fga.yaml` store tests the evaluator is
+ * proven against (__tests__/store-test-kit.ts). Both are written by a
+ * format this module does not own (OpenFGA's), so both are read as
+ * `unknown` and refused loudly on anything unexpected: a change upstream
+ * is a thrown fault naming where it failed, never a half-read input.
+ *
+ * Every function takes `where`, the path of the value in its document
+ * (`authorization-model.json: type_definitions[3].relations.viewer`), and
+ * puts it at the head of the message.
+ */
+
+/** A mapping, refusing any key outside `allowedKeys` when they are given. */
+export function record(
+  value: unknown,
+  where: string,
+  allowedKeys?: ReadonlyArray<string>,
+): Record<string, unknown> {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${where}: expected a mapping`);
+  }
+  const entry = value as Record<string, unknown>;
+  if (allowedKeys !== undefined) {
+    for (const key of Object.keys(entry)) {
+      if (!allowedKeys.includes(key)) {
+        throw new Error(`${where}: unknown key '${key}'`);
+      }
+    }
+  }
+  return entry;
+}
+
+export function list(value: unknown, where: string): ReadonlyArray<unknown> {
+  if (!Array.isArray(value)) {
+    throw new Error(`${where}: expected a list`);
+  }
+  return value as ReadonlyArray<unknown>;
+}
+
+/** A list, or the empty list when the key is absent. */
+export function optionalList(value: unknown, where: string): ReadonlyArray<unknown> {
+  return value === undefined ? [] : list(value, where);
+}
+
+export function text(value: unknown, where: string): string {
+  if (typeof value !== "string") {
+    throw new Error(`${where}: expected a string`);
+  }
+  return value;
+}

package/src/boot/compose.ts

@@ -385,13 +385,15 @@ export async function composeServer(
     requireAuthentication,
   });
   const builtInAuthorization = authorizationPosture !== "unit-authorizer";
-  // The built-in authorizer declares the open-source kinds and no other
-  // (its registry is pinned set-equal to that tier), so a composition
-  // that serves a wider edition must bring its own Authorizer: every
-  // check on a kind the model does not declare would otherwise fault
-  // INTERNAL per request. Refused at boot, the same class as a
-  // misconfigured registry (DD-006 §2b) and the verifierless posture
-  // below — caught before any side effect.
+  // The built-in authorizer evaluates the one model every edition reads,
+  // but it derives each resource's tuples from the rows in this server's
+  // store. A wider edition's kinds are served by extensions that keep
+  // their rows in stores of their own, which the built-in tuple source
+  // cannot read, so a composition that serves a wider edition must bring
+  // its own Authorizer rather than get answers derived from rows that are
+  // not there. Refused at boot, the same class as a misconfigured
+  // registry and the verifierless posture below: caught before any side
+  // effect.
   if (
     authorizationPosture === "built-in" &&
     extensions.edition !== ServerEdition.oss

package/src/extensions/__tests__/built-in-authorization-composed.test.ts

@@ -764,16 +764,13 @@ describe("built-in list scope (C4: two boots, one seed — the scope is the only
     let unscopedStore: Store | undefined;
     const passThrough: ListReadScope = {
       async authorizedResourceIds(_caller, kind) {
-        const declaration = builtInModel.byKind(kind);
-        if (unscopedStore === undefined || declaration === undefined) {
+        const schema = builtInModel.byKind(kind)?.schema;
+        if (unscopedStore === undefined || schema === undefined) {
           throw new Error("the pass-through is bound to a booted server");
         }
         const rows = await unscopedStore.listResources(kind);
         return new Set(
-          rows.map(
-            (bytes) =>
-              metadataOf(fromBinary(declaration.schema, bytes))?.id ?? "",
-          ),
+          rows.map((bytes) => metadataOf(fromBinary(schema, bytes))?.id ?? ""),
         );
       },
       restrictListEntries: (_caller, _kind, entries) =>

package/src/extensions/list-read-scope.ts

@@ -99,7 +99,8 @@
  *     with. A driver MAY answer the parent's question in place of the
  *     child's: by the model's construction the two answers are identical
  *     (the child's `owner`, `viewer` and `can_view` are all `from` the
- *     parent), and the parent's resolution is direct tuples where the
+ *     parent; authorization/model/__tests__/registry.test.ts holds that
+ *     for every such kind), and the parent's resolution is direct tuples where the
  *     child's walks the parent's whole set (OpenFGA's learned `weight2`
  *     strategy read the founder's 423 sessions per execution; that is what
  *     rolled back twice on 2026-09-14). A driver that ignores the field is
@@ -131,7 +132,10 @@ import type { ApiResourceAudit } from "@stigmer/protos/ai/stigmer/commons/apires
 // protos and each other, so there is no cycle. Deliberate — one resolver
 // for the tuple writer, the point-check driver and the list reader beats
 // a copy in the seam.
-import { inheritedAuthorizationParentOf } from "../pipeline/apiresource-meta.js";
+import {
+  inheritedAuthorizationParentOf,
+  kindEnumName,
+} from "../pipeline/apiresource-meta.js";
 import { rowAuthorizationFactsOf } from "../pipeline/steps/authorization-facts.js";
 
 import type { CallerIdentity } from "./identity.js";
@@ -192,8 +196,9 @@ export interface ListReadScope {
    * `caller` is never the `internal` class: `restrictListByReadScope`,
    * the one consumption idiom, answers that class before any driver is
    * asked (the header's contract line). A driver that is offered it has
-   * been reached around the idiom and should refuse loudly rather than
-   * evaluate the server as a person (the built-in driver does).
+   * been reached around the idiom and refuses with
+   * `InternalCallerOfferedError` rather than evaluate the server as a
+   * person.
    */
   restrictListEntries(
     caller: CallerIdentity,
@@ -202,6 +207,29 @@ export interface ListReadScope {
   ): Promise<ReadonlySet<string>>;
 }
 
+/**
+ * The restrict verb's refusal of the `internal` class (its doc above):
+ * thrown by a driver that is offered the server acting as itself, which
+ * `restrictListByReadScope` answers before any driver is asked. Being
+ * offered it means a list lane reached the driver around that idiom, and
+ * evaluating the server as a person would answer a quiet short list, the
+ * failure stigmer#1207 fixed. It is a consumer bug, never a denial (a
+ * denial is an empty set): the lane faults and the pipeline answers its
+ * sanitized INTERNAL. One type for every edition's driver, so each refuses
+ * the class the same way.
+ */
+export class InternalCallerOfferedError extends Error {
+  readonly kind: ApiResourceKind;
+
+  constructor(kind: ApiResourceKind) {
+    super(
+      `the internal caller class was offered to the list scope for kind '${kindEnumName(kind)}' — the shared helper answers that class before any driver; a list lane reached the driver around it`,
+    );
+    this.name = "InternalCallerOfferedError";
+    this.kind = kind;
+  }
+}
+
 /**
  * The shape every stored API resource message presents to the shared
  * helper — the metadata fields the scope's candidates are built from, the

package/src/index.ts

@@ -10,6 +10,12 @@
  * to this file are owner-visible surface changes, extended only through
  * gates (the DD-005 review property: a surface change is a one-file diff).
  *
+ * One data file is published beside it, through its own exports entry:
+ * `@stigmer/server/authorization-model.json`, the compiled authorization
+ * model (OpenFGA's JSON, generated from fga/model, whose README states the
+ * file's contract). Every edition reads those bytes: this server
+ * evaluates them, and an edition that runs OpenFGA applies them.
+ *
  * The surface is exactly what the ratified architecture names (blueprint
  * 20260826.02/03 §1) and the parameter types those entries force:
  *   - the compose entry and config loading (composeServer + its options'
@@ -224,51 +230,12 @@ export {
   canSign,
   platformTokenKeyRingFromPem,
 } from "./platformtoken/key-ring.js";
-// The built-in authorizer's model seams: the kind
-// declarations (transcripts of the cloud's `.fga` files), the evaluator,
-// and the OpenFGA store-test kit — exported so the cloud's drift test
-// compares the live model against the transcripts and runs its live
-// store tests through the evaluator, both from the published package.
-// The drivers themselves are composed by the root and are not exported.
-export type {
-  DerivedRelation,
-  KindDeclaration,
-  Rewrite,
-  SubjectType,
-} from "./authorization/model/rewrite.js";
-export type { Model } from "./authorization/model/index.js";
-export {
-  builtInModel,
-  declarationFor,
-  newModel,
-} from "./authorization/model/index.js";
-export type {
-  ObjectRef,
-  Person,
-  Subject,
-  Tuple,
-  TupleSource,
-} from "./authorization/tuples.js";
-export type { EvaluationFault } from "./authorization/evaluator.js";
-export {
-  AuthorizationEvaluationError,
-  MAX_RESOLUTION_DEPTH,
-  checkRelation,
-} from "./authorization/evaluator.js";
-export type {
-  StoreTestCase,
-  StoreTestDocument,
-  StoreTestKit,
-  StoreTestSkip,
-  StoreTestSkipReason,
-} from "./authorization/store-test-kit.js";
-export {
-  parseStoreTestDocument,
-  storeTestCases,
-} from "./authorization/store-test-kit.js";
 // The kinds whose missing row the built-in authorizer denies instead of
-// answering not-found — the cloud's probe exemption over the open-source
-// tier; exported so the cloud's drift test pins the two sets equal.
+// answering not-found: exported so a composition that authorizes with its
+// own engine and probes existence itself pins its exemptions to this set.
+// The model the authorizer evaluates is not exported as code: it is the
+// data subpath `@stigmer/server/authorization-model.json` (this file's
+// header).
 export { NOT_FOUND_EXEMPT_KINDS } from "./authorization/authorizer.js";
 export type {
   ListReadScope,
@@ -279,6 +246,10 @@ export type {
 // its rows exactly as the library's lanes do, instead of building each
 // candidate's authorization facts by hand.
 export { restrictListByReadScope } from "./extensions/list-read-scope.js";
+// The seam's refusal of the `internal` caller class on the restrict verb,
+// which that idiom answers before any driver is asked: exported so a
+// composition's driver refuses the class exactly as the built-in one does.
+export { InternalCallerOfferedError } from "./extensions/list-read-scope.js";
 // The stigmer-cloud#572 seam: the identity a schedule fire acts as
 // (drivers.scheduleFireCaller) — the composition mints it per fire; the
 // RunStarter propagates it through the R5 in-process header. A mint that

package/dist/authorization/model/agent.d.ts

@@ -1,2 +0,0 @@
-export declare const agentDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=agent.d.ts.map

package/dist/authorization/model/agent.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,gBAAgB,wCAuC3B,CAAC"}

package/dist/authorization/model/agent.js

@@ -1,43 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent.fga — a blueprint: owned by its
- * creator and by the organization's admins (`admin from organization`),
- * read by whoever the visibility axis lets in. The `organization#member`
- * and `organization#viewer` usersets on `viewer` are the org-visibility
- * tuple's two shapes (the cloud writes `#viewer` since cloud#257; `#member`
- * is the legacy shape it still honours), and `platform_viewer` is an
- * identity-provider userset no open-source tuple ever names. `team#member`
- * is the Enterprise team grant; open source serves no team, so no tuple
- * here ever names one.
- */
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const agentDeclaration = declareKind({
-    kind: ApiResourceKind.agent,
-    schema: AgentSchema,
-    source: "fga/model/agentic/agent.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "platform_viewer",
-            direct(usersetOf("identity_provider", "platform_user")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer"), usersetOf("team", "member")), computed("owner"), computed("platform_viewer")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_execute", computed("viewer")],
-        ["can_create_instance", computed("can_execute")],
-        ["can_clone", computed("viewer")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=agent.js.map

package/dist/authorization/model/agent.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../../src/authorization/model/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;IAC1C,IAAI,EAAE,eAAe,CAAC,KAAK;IAC3B,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,6BAA6B;IACrC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5B,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,qBAAqB,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChD,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/agent_channel.d.ts

@@ -1,2 +0,0 @@
-export declare const agentChannelDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=agent_channel.d.ts.map

package/dist/authorization/model/agent_channel.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_channel.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent_channel.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,uBAAuB,wCAkClC,CAAC"}

package/dist/authorization/model/agent_channel.js

@@ -1,39 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_channel.fga — a channel binding,
- * admin-owned like a blueprint, with `participant` as the one relation
- * between owner and viewer: the conversation-participation role
- * (reply and takeover without configuration authority), grantable as a
- * role on this kind alone. Every owner participates; every participant
- * views. Both grantable relations may name an Enterprise team
- * (`team#member`), which no open-source tuple ever does.
- */
-import { AgentChannelSchema } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const agentChannelDeclaration = declareKind({
-    kind: ApiResourceKind.agent_channel,
-    schema: AgentChannelSchema,
-    source: "fga/model/agentic/agent_channel.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "participant",
-            union(direct(objectOf("identity_account"), usersetOf("team", "member")), computed("owner")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("team", "member")), computed("participant")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_participate", computed("participant")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=agent_channel.js.map

package/dist/authorization/model/agent_channel.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_channel.js","sourceRoot":"","sources":["../../../src/authorization/model/agent_channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;IACjD,IAAI,EAAE,eAAe,CAAC,aAAa;IACnC,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,qCAAqC;IAC7C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,aAAa;YACb,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EACjE,QAAQ,CAAC,OAAO,CAAC,CAClB;SACF;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EACjE,QAAQ,CAAC,aAAa,CAAC,CACxB;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC5C,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/agent_execution.d.ts

@@ -1,2 +0,0 @@
-export declare const agentExecutionDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=agent_execution.d.ts.map

package/dist/authorization/model/agent_execution.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_execution.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent_execution.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,yBAAyB,wCAWpC,CAAC"}