@stigmer/server 3.27.2 → 3.29.0

package/dist/authorization/model/organization.js

@@ -1,58 +0,0 @@
-/**
- * Transcript of fga/model/tenancy/organization.fga — the root of the
- * model: no parent, the four roles as a ladder (`owner ⊂ admin ⊂ member
- * ⊂ viewer`, each `[identity_account] or <the rung above>`), and every
- * `can_create_*` an organization gates.
- *
- * In open source the `[identity_account]` tuples of this type ARE the
- * IamPolicy rows: 2b's role lifecycle writes the creator's `owner` row and
- * the grant path writes every other role, so the tuple source reads them
- * from the IamPolicyStore and the derivation writes no owner tuple for
- * this kind (derived-tuples.ts). `guest` is the cloud's anonymous
- * share-link visitor; no open-source lane mints one (claim check C5), so
- * the relation resolves to nothing and `can_create_session: member or
- * guest` is `member` here — the transcript still carries the line.
- * `can_create_team` is carried the same way: open source serves no Team
- * kind, so nothing here asks it.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
-import { computed, declareKind, direct, objectOf, union } from "./rewrite.js";
-export const organizationDeclaration = declareKind({
-    kind: ApiResourceKind.organization,
-    schema: OrganizationSchema,
-    source: "fga/model/tenancy/organization.fga",
-    relations: [
-        ["owner", direct(objectOf("identity_account"))],
-        ["admin", union(direct(objectOf("identity_account")), computed("owner"))],
-        ["member", union(direct(objectOf("identity_account")), computed("admin"))],
-        ["viewer", union(direct(objectOf("identity_account")), computed("member"))],
-        ["guest", direct(objectOf("identity_account"))],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("admin")],
-        ["can_delete", computed("owner")],
-        ["can_manage_members", computed("admin")],
-        ["can_assign_roles", computed("owner")],
-        ["can_create_agent", computed("admin")],
-        ["can_create_workflow", computed("admin")],
-        ["can_create_session", union(computed("member"), computed("guest"))],
-        ["can_create_environment", computed("member")],
-        ["can_create_skill", computed("admin")],
-        ["can_create_plugin", computed("admin")],
-        ["can_create_mcp_server", computed("admin")],
-        ["can_create_idp", computed("admin")],
-        ["can_create_identity_account", computed("admin")],
-        ["can_create_oauth_app", computed("admin")],
-        ["can_create_platform_client", computed("admin")],
-        ["can_create_channel_app", computed("admin")],
-        ["can_create_execution_in", union(computed("member"), computed("guest"))],
-        ["can_create_agent_share", computed("admin")],
-        ["can_create_agent_instance", computed("member")],
-        ["can_create_team", computed("admin")],
-        ["can_grant_access", computed("admin")],
-        ["can_view_access", computed("viewer")],
-        ["can_view_billing", computed("viewer")],
-        ["can_manage_billing", computed("admin")],
-    ],
-});
-//# sourceMappingURL=organization.js.map

package/dist/authorization/model/organization.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"organization.js","sourceRoot":"","sources":["../../../src/authorization/model/organization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAE/F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;IACjD,IAAI,EAAE,eAAe,CAAC,YAAY;IAClC,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,oCAAoC;IAC5C,SAAS,EAAE;QACT,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3E,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC,oBAAoB,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACpE,CAAC,wBAAwB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,mBAAmB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC,uBAAuB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC,6BAA6B,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC,4BAA4B,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC,yBAAyB,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC,2BAA2B,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAC1C;CACF,CAAC,CAAC"}

package/dist/authorization/model/platform_client.d.ts

@@ -1,2 +0,0 @@
-export declare const platformClientDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=platform_client.d.ts.map

package/dist/authorization/model/platform_client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform_client.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/platform_client.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,yBAAyB,wCAqBpC,CAAC"}

package/dist/authorization/model/platform_client.js

@@ -1,31 +0,0 @@
-/**
- * Transcript of fga/model/iam/platform_client.fga — relation for relation
- * the oauth_app shape: organization-scoped, an `owner` with no admin arm
- * and a `viewer` that has one. A platform client holds credential material,
- * so the model is restricted: its creator (the owner) edits, deletes,
- * rotates and grants; the organization's admins may view it; ordinary
- * members have no access at all, which is why listByOrg narrows through
- * the list read scope. There is no public level.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const platformClientDeclaration = declareKind({
-    kind: ApiResourceKind.platform_client,
-    schema: PlatformClientSchema,
-    source: "fga/model/iam/platform_client.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["owner", direct(objectOf("identity_account"))],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account")), computed("owner"), from("admin", "organization")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=platform_client.js.map

package/dist/authorization/model/platform_client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform_client.js","sourceRoot":"","sources":["../../../src/authorization/model/platform_client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAE/F,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAAC;IACnD,IAAI,EAAE,eAAe,CAAC,eAAe;IACrC,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,mCAAmC;IAC3C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/plugin.d.ts

@@ -1,2 +0,0 @@
-export declare const pluginDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=plugin.d.ts.map

package/dist/authorization/model/plugin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/plugin.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,iBAAiB,wCAqC5B,CAAC"}

package/dist/authorization/model/plugin.js

@@ -1,45 +0,0 @@
-/**
- * Transcript of fga/model/agentic/plugin.fga — the unit of install, shaped
- * exactly like a skill: an organization-owned blueprint whose owner is the
- * installer (and, through the organization, its admins), whose viewers are
- * the org's members and viewers and the platform viewer. Its verbs are the blueprint set: `can_view`, `can_edit`
- * (visibility), `can_delete` (uninstall), `can_grant_access`,
- * `can_view_access`; `can_use` is carried as the model's word for
- * "install from" though no wire permission names it yet. `team#member` on
- * `viewer` is the Enterprise team grant, which no open-source tuple ever
- * names.
- *
- * The members a plugin materialises are NOT reached through this type:
- * each is an ordinary skill, MCP server, agent or workflow with its own
- * tuples, written by its own chain as the installing caller.
- */
-import { PluginSchema } from "@stigmer/protos/ai/stigmer/agentic/plugin/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const pluginDeclaration = declareKind({
-    kind: ApiResourceKind.plugin,
-    schema: PluginSchema,
-    source: "fga/model/agentic/plugin.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "platform_viewer",
-            direct(usersetOf("identity_provider", "platform_user")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer"), usersetOf("team", "member")), computed("owner"), computed("platform_viewer")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_use", computed("viewer")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=plugin.js.map

package/dist/authorization/model/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/authorization/model/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,IAAI,EAAE,eAAe,CAAC,MAAM;IAC5B,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,8BAA8B;IACtC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5B,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/schedule.d.ts

@@ -1,2 +0,0 @@
-export declare const scheduleDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=schedule.d.ts.map

package/dist/authorization/model/schedule.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"schedule.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/schedule.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,mBAAmB,wCA0B9B,CAAC"}

package/dist/authorization/model/schedule.js

@@ -1,34 +0,0 @@
-/**
- * Transcript of fga/model/agentic/schedule.fga — a scheduled run's
- * definition, admin-owned like a blueprint and viewable by its owners and
- * explicit grantees. The sessions its fires create name it back through
- * `session#schedule`, a link the cloud writes and this edition does not
- * (session.ts); the schedule's own relations are unaffected. An explicit
- * grant may name an Enterprise team (`team#member`), which no open-source
- * tuple ever does.
- */
-import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const scheduleDeclaration = declareKind({
-    kind: ApiResourceKind.schedule,
-    schema: ScheduleSchema,
-    source: "fga/model/agentic/schedule.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("team", "member")), computed("owner")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=schedule.js.map

package/dist/authorization/model/schedule.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schedule.js","sourceRoot":"","sources":["../../../src/authorization/model/schedule.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,IAAI,EAAE,eAAe,CAAC,QAAQ;IAC9B,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,gCAAgC;IACxC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EACjE,QAAQ,CAAC,OAAO,CAAC,CAClB;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/session.d.ts

@@ -1,2 +0,0 @@
-export declare const sessionDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=session.d.ts.map

package/dist/authorization/model/session.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/session.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,kBAAkB,wCAyB7B,CAAC"}

package/dist/authorization/model/session.js

@@ -1,38 +0,0 @@
-/**
- * Transcript of fga/model/agentic/session.fga — a personal resource: the
- * owner and explicit grantees, and NO admin arm anywhere ("private
- * conversations that admins have no business accessing", the file's own
- * words). Three parent links beside the organization: `agent_instance`,
- * `channel` and `schedule`. None is a `kind_meta` fact — the cloud's
- * channel and schedule lanes write them — so on this edition the
- * derivation produces no such tuple and `viewer from channel` / `viewer
- * from schedule` resolve to nobody; the lines stand in the transcript
- * because they are the model's, and a scheduled run reaches its creator
- * through the fire caller's stamp on the session instead.
- */
-import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const sessionDeclaration = declareKind({
-    kind: ApiResourceKind.session,
-    schema: SessionSchema,
-    source: "fga/model/agentic/session.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["agent_instance", direct(objectOf("agent_instance"))],
-        ["channel", direct(objectOf("agent_channel"))],
-        ["schedule", direct(objectOf("schedule"))],
-        ["owner", direct(objectOf("identity_account"))],
-        ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
-        [
-            "can_view",
-            union(computed("viewer"), from("viewer", "channel"), from("viewer", "schedule")),
-        ],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_create_execution_in", computed("viewer")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=session.js.map

package/dist/authorization/model/session.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/authorization/model/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC;IAC5C,IAAI,EAAE,eAAe,CAAC,OAAO;IAC7B,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,+BAA+B;IACvC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACtD,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAC9C,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1C,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E;YACE,UAAU;YACV,KAAK,CACH,QAAQ,CAAC,QAAQ,CAAC,EAClB,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EACzB,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAC3B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,yBAAyB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/skill.d.ts

@@ -1,2 +0,0 @@
-export declare const skillDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=skill.d.ts.map

package/dist/authorization/model/skill.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/skill.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,gBAAgB,wCAsC3B,CAAC"}

package/dist/authorization/model/skill.js

@@ -1,39 +0,0 @@
-/**
- * Transcript of fga/model/agentic/skill.fga — a blueprint whose verbs are
- * `can_use` and `can_clone` rather than `can_execute`. Only `can_view`,
- * `can_edit`, `can_delete`, `can_grant_access` and `can_view_access` are
- * in the wire's IamPermission vocabulary; the others are the model's and
- * are carried so the transcript is the file. `team#member` on `viewer` is
- * the Enterprise team grant, which no open-source tuple ever names.
- */
-import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const skillDeclaration = declareKind({
-    kind: ApiResourceKind.skill,
-    schema: SkillSchema,
-    source: "fga/model/agentic/skill.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "platform_viewer",
-            direct(usersetOf("identity_provider", "platform_user")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer"), usersetOf("team", "member")), computed("owner"), computed("platform_viewer")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_use", computed("viewer")],
-        ["can_clone", computed("viewer")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=skill.js.map

package/dist/authorization/model/skill.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill.js","sourceRoot":"","sources":["../../../src/authorization/model/skill.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;IAC1C,IAAI,EAAE,eAAe,CAAC,KAAK;IAC3B,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,6BAA6B;IACrC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5B,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/workflow.d.ts

@@ -1,2 +0,0 @@
-export declare const workflowDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=workflow.d.ts.map

package/dist/authorization/model/workflow.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/workflow.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,mBAAmB,wCAsC9B,CAAC"}

package/dist/authorization/model/workflow.js

@@ -1,39 +0,0 @@
-/**
- * Transcript of fga/model/agentic/workflow.fga — the agent's shape
- * without `can_create_instance` (a workflow instance is created through
- * the workflow-instance lane, gated by the organization). Kept as its own
- * transcript, not a shared "blueprint" helper, so the file-by-file drift
- * compare sees exactly this file's lines. `team#member` on `viewer` is the
- * Enterprise team grant, which no open-source tuple ever names.
- */
-import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const workflowDeclaration = declareKind({
-    kind: ApiResourceKind.workflow,
-    schema: WorkflowSchema,
-    source: "fga/model/agentic/workflow.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "platform_viewer",
-            direct(usersetOf("identity_provider", "platform_user")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer"), usersetOf("team", "member")), computed("owner"), computed("platform_viewer")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_execute", computed("viewer")],
-        ["can_clone", computed("viewer")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=workflow.js.map

package/dist/authorization/model/workflow.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../../../src/authorization/model/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,IAAI,EAAE,eAAe,CAAC,QAAQ;IAC9B,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,gCAAgC;IACxC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5B,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/workflow_execution.d.ts

@@ -1,2 +0,0 @@
-export declare const workflowExecutionDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=workflow_execution.d.ts.map

package/dist/authorization/model/workflow_execution.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow_execution.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/workflow_execution.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,4BAA4B,wCAqBvC,CAAC"}

package/dist/authorization/model/workflow_execution.js

@@ -1,33 +0,0 @@
-/**
- * Transcript of fga/model/agentic/workflow_execution.fga — a run with an
- * owner of its own (the person who triggered it; `kind_meta` attribution
- * DIRECT, unlike agent_execution's inherited owner) and two ways in for
- * others: an explicit per-run grant, or the instance's opt-in run
- * audience through `execution_viewer from workflow_instance`, standing on
- * the `workflow_instance` link the derivation writes from
- * `spec.workflow_instance_id`. No `can_delete`: run history outlives its
- * instance by design. The per-run grant may name an Enterprise team
- * (`team#member`), which no open-source tuple ever does.
- */
-import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const workflowExecutionDeclaration = declareKind({
-    kind: ApiResourceKind.workflow_execution,
-    schema: WorkflowExecutionSchema,
-    source: "fga/model/agentic/workflow_execution.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["workflow_instance", direct(objectOf("workflow_instance"))],
-        ["owner", direct(objectOf("identity_account"))],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("team", "member")), computed("owner"), from("execution_viewer", "workflow_instance")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=workflow_execution.js.map

package/dist/authorization/model/workflow_execution.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow_execution.js","sourceRoot":"","sources":["../../../src/authorization/model/workflow_execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gEAAgE,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;IACtD,IAAI,EAAE,eAAe,CAAC,kBAAkB;IACxC,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,0CAA0C;IAClD,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC5D,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EACjE,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAC9C;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/workflow_instance.d.ts

@@ -1,2 +0,0 @@
-export declare const workflowInstanceDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=workflow_instance.d.ts.map

package/dist/authorization/model/workflow_instance.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow_instance.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/workflow_instance.ts"],"names":[],"mappings":"AA2EA,eAAO,MAAM,2BAA2B,wCAiDtC,CAAC"}

package/dist/authorization/model/workflow_instance.js

@@ -1,96 +0,0 @@
-/**
- * Transcript of fga/model/agentic/workflow_instance.fga — the agent
- * instance's shape plus one relation of its own: `execution_viewer`, the
- * opt-in audience for the instance's RUN history, kept apart from
- * `viewer` so making an instance org-runnable never exposes other
- * people's run inputs and outputs. Consumed by workflow_execution through
- * `execution_viewer from workflow_instance`.
- *
- * `execution_viewer` is derived here from `spec.execution_visibility`
- * (the second rule `kind_meta` cannot express): `organization` derives
- * `#execution_viewer@organization:<org>#viewer` — the organization's full
- * read audience, the shape the file's comment names and the cloud's own
- * store test writes, with `#member` the legacy shape the line still
- * admits — and `private` or unset derives nothing, so each run stays its
- * triggerer's. The cloud has no writer for this tuple today; this
- * edition enforces the field as the contract states it.
- *
- * `team#member` on `viewer` is the Enterprise team grant, which no
- * open-source tuple ever names; `execution_viewer` is not a grantable role
- * and admits no team.
- */
-import { isMessage } from "@bufbuild/protobuf";
-import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
-import { WorkflowInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
-import { WorkflowExecutionVisibility } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/spec_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { defaultOfBlueprint } from "./default-of.js";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-const executionViewer = (object, row) => {
-    if (!isMessage(row, WorkflowInstanceSchema)) {
-        return Promise.resolve([]);
-    }
-    const level = row.spec?.executionVisibility ?? WorkflowExecutionVisibility.unspecified;
-    switch (level) {
-        case WorkflowExecutionVisibility.organization: {
-            const org = row.metadata?.org ?? "";
-            return Promise.resolve(org === ""
-                ? []
-                : [
-                    {
-                        object,
-                        relation: "execution_viewer",
-                        subject: {
-                            form: "userset",
-                            object: { type: "organization", id: org },
-                            relation: "viewer",
-                        },
-                    },
-                ]);
-        }
-        case WorkflowExecutionVisibility.private:
-        case WorkflowExecutionVisibility.unspecified:
-            return Promise.resolve([]);
-        default: {
-            const exhaustive = level;
-            throw new Error(`unknown execution visibility: ${String(exhaustive)}`);
-        }
-    }
-};
-export const workflowInstanceDeclaration = declareKind({
-    kind: ApiResourceKind.workflow_instance,
-    schema: WorkflowInstanceSchema,
-    source: "fga/model/agentic/workflow_instance.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["workflow", direct(objectOf("workflow"))],
-        ["default_of", direct(objectOf("workflow"))],
-        ["owner", direct(objectOf("identity_account"))],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer"), usersetOf("team", "member")), computed("owner"), from("viewer", "default_of")),
-        ],
-        [
-            "execution_viewer",
-            direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_execute", computed("can_view")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-    derived: [
-        [
-            "default_of",
-            defaultOfBlueprint({
-                kind: ApiResourceKind.workflow,
-                schema: WorkflowSchema,
-                defaultInstanceIdOf: (workflow) => workflow.status?.defaultInstanceId ?? "",
-            }),
-        ],
-        ["execution_viewer", executionViewer],
-    ],
-});
-//# sourceMappingURL=workflow_instance.js.map

package/dist/authorization/model/workflow_instance.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow_instance.js","sourceRoot":"","sources":["../../../src/authorization/model/workflow_instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,gEAAgE,CAAC;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,eAAe,GAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IACvD,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GACT,GAAG,CAAC,IAAI,EAAE,mBAAmB,IAAI,2BAA2B,CAAC,WAAW,CAAC;IAC3E,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC,OAAO,CACpB,GAAG,KAAK,EAAE;gBACR,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE;wBACE,MAAM;wBACN,QAAQ,EAAE,kBAAkB;wBAC5B,OAAO,EAAE;4BACP,IAAI,EAAE,SAAS;4BACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;4BACzC,QAAQ,EAAE,QAAQ;yBACnB;qBACF;iBACF,CACN,CAAC;QACJ,CAAC;QACD,KAAK,2BAA2B,CAAC,OAAO,CAAC;QACzC,KAAK,2BAA2B,CAAC,WAAW;YAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;IACrD,IAAI,EAAE,eAAe,CAAC,iBAAiB;IACvC,MAAM,EAAE,sBAAsB;IAC9B,MAAM,EAAE,yCAAyC;IACjD,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1C,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5C,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5B,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAC7B;SACF;QACD;YACE,kBAAkB;YAClB,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;IACD,OAAO,EAAE;QACP;YACE,YAAY;YACZ,kBAAkB,CAAC;gBACjB,IAAI,EAAE,eAAe,CAAC,QAAQ;gBAC9B,MAAM,EAAE,cAAc;gBACtB,mBAAmB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAChC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE;aAC3C,CAAC;SACH;QACD,CAAC,kBAAkB,EAAE,eAAe,CAAC;KACtC;CACF,CAAC,CAAC"}

package/dist/authorization/store-test-kit.d.ts

@@ -1,62 +0,0 @@
-import type { Model } from "./model/index.js";
-export interface StoreTestTuple {
-    readonly user: string;
-    readonly relation: string;
-    readonly object: string;
-}
-export interface StoreTestCheck {
-    readonly user: string;
-    readonly object: string;
-    readonly assertions: Readonly<Record<string, boolean>>;
-}
-export interface StoreTestListObjects {
-    readonly user: string;
-    readonly type: string;
-    readonly assertions: Readonly<Record<string, ReadonlyArray<string>>>;
-}
-export interface StoreTest {
-    readonly name: string;
-    readonly check: ReadonlyArray<StoreTestCheck>;
-    readonly list_objects: ReadonlyArray<StoreTestListObjects>;
-}
-export interface StoreTestDocument {
-    readonly name: string;
-    readonly tuples: ReadonlyArray<StoreTestTuple>;
-    readonly tests: ReadonlyArray<StoreTest>;
-}
-/**
- * Parses a loaded YAML value into a document, refusing anything the
- * format the cloud's files use does not carry (`sourceName` names the
- * file in every message).
- */
-export declare function parseStoreTestDocument(value: unknown, sourceName: string): StoreTestDocument;
-export interface StoreTestCase {
-    /** `<document> :: <test name>` — the framework prints it as the test name. */
-    readonly name: string;
-    run(): Promise<void>;
-}
-export type StoreTestSkipReason = "undeclared-kind" | "list-objects" | "undeclared-subject-type";
-/** One assertion (or assertion group) the kit did not run, in the document's words. */
-export interface StoreTestSkip {
-    readonly document: string;
-    readonly test: string;
-    readonly subject: string;
-    /** The check's object, or `<type>` for a list_objects assertion. */
-    readonly object: string;
-    /** The one relation, for a skip decided per assertion; absent for a group. */
-    readonly relation?: string;
-    readonly reason: StoreTestSkipReason;
-    /** For `undeclared-subject-type`: the types the walk read that the model does not declare, sorted. */
-    readonly types?: ReadonlyArray<string>;
-}
-export interface StoreTestKit {
-    readonly cases: ReadonlyArray<StoreTestCase>;
-    /** Complete once every case has run (the module header). */
-    readonly skipped: ReadonlyArray<StoreTestSkip>;
-}
-/**
- * The document's tests as runnable cases over `model`, plus every
- * assertion group the kit does not run.
- */
-export declare function storeTestCases(document: StoreTestDocument, model: Model): StoreTestKit;
-//# sourceMappingURL=store-test-kit.d.ts.map

package/dist/authorization/store-test-kit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"store-test-kit.d.ts","sourceRoot":"","sources":["../../src/authorization/store-test-kit.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAa9C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,EACd,UAAU,EAAE,MAAM,GACjB,iBAAiB,CAgBnB;AAqGD,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAED,MAAM,MAAM,mBAAmB,GAC3B,iBAAiB,GACjB,cAAc,GACd,yBAAyB,CAAC;AAE9B,uFAAuF;AACvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,sGAAsG;IACtG,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC7C,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAChD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,KAAK,GACX,YAAY,CAsEd"}