@stigmer/server 3.40.1 → 3.41.0

package/dist/authorization/model/execution-viewer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-viewer.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/execution-viewer.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,eAAO,MAAM,eAAe,EAAE,eAiC7B,CAAC"}
+{"version":3,"file":"execution-viewer.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/execution-viewer.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,eAAO,MAAM,eAAe,EAAE,eA8B7B,CAAC"}

package/dist/authorization/model/execution-viewer.js

@@ -11,40 +11,42 @@
  * `#execution_viewer@organization:<org>#viewer`, the organization's full
  * read audience (the relation also admits `#member`, the legacy shape),
  * and `private` or unset derives nothing, so each run stays its
- * triggerer's. Pure over the row; no related row is read.
+ * triggerer's. Pure over the row; no related row is read. Which level
+ * names which audience is `executionAudienceShapes`
+ * (pipeline/steps/authorization-tuples.ts), the one mapping this
+ * derivation and the lifecycle event a tuple-storing edition hears both
+ * read, so the two editions cannot disagree about who sees the runs.
  */
 import { isMessage } from "@bufbuild/protobuf";
 import { WorkflowInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
 import { WorkflowExecutionVisibility } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/spec_pb";
+import { executionAudienceShapes } from "../../pipeline/steps/authorization-tuples.js";
 export const executionViewer = (object, row) => {
     if (!isMessage(row, WorkflowInstanceSchema)) {
         return Promise.resolve([]);
     }
     const level = row.spec?.executionVisibility ?? WorkflowExecutionVisibility.unspecified;
-    switch (level) {
-        case WorkflowExecutionVisibility.organization: {
-            const org = row.metadata?.org ?? "";
-            return Promise.resolve(org === ""
-                ? []
-                : [
-                    {
-                        object,
-                        relation: "execution_viewer",
-                        subject: {
-                            form: "userset",
-                            object: { type: "organization", id: org },
-                            relation: "viewer",
-                        },
+    const org = row.metadata?.org ?? "";
+    if (org === "") {
+        return Promise.resolve([]);
+    }
+    return Promise.resolve([...executionAudienceShapes(level)].map((shape) => {
+        switch (shape) {
+            case "org-viewer":
+                return {
+                    object,
+                    relation: "execution_viewer",
+                    subject: {
+                        form: "userset",
+                        object: { type: "organization", id: org },
+                        relation: "viewer",
                     },
-                ]);
+                };
+            default: {
+                const exhaustive = shape;
+                throw new Error(`unknown execution audience: ${String(exhaustive)}`);
+            }
         }
-        case WorkflowExecutionVisibility.private:
-        case WorkflowExecutionVisibility.unspecified:
-            return Promise.resolve([]);
-        default: {
-            const exhaustive = level;
-            throw new Error(`unknown execution visibility: ${String(exhaustive)}`);
-        }
-    }
+    }));
 };
 //# sourceMappingURL=execution-viewer.js.map

package/dist/authorization/model/execution-viewer.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-viewer.js","sourceRoot":"","sources":["../../../src/authorization/model/execution-viewer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,gEAAgE,CAAC;AAI7G,MAAM,CAAC,MAAM,eAAe,GAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC9D,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GACT,GAAG,CAAC,IAAI,EAAE,mBAAmB,IAAI,2BAA2B,CAAC,WAAW,CAAC;IAC3E,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,2BAA2B,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC,OAAO,CACpB,GAAG,KAAK,EAAE;gBACR,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE;wBACE,MAAM;wBACN,QAAQ,EAAE,kBAAkB;wBAC5B,OAAO,EAAE;4BACP,IAAI,EAAE,SAAS;4BACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;4BACzC,QAAQ,EAAE,QAAQ;yBACnB;qBACF;iBACF,CACN,CAAC;QACJ,CAAC;QACD,KAAK,2BAA2B,CAAC,OAAO,CAAC;QACzC,KAAK,2BAA2B,CAAC,WAAW;YAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"execution-viewer.js","sourceRoot":"","sources":["../../../src/authorization/model/execution-viewer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,gEAAgE,CAAC;AAE7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAMvF,MAAM,CAAC,MAAM,eAAe,GAAoB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC9D,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GACT,GAAG,CAAC,IAAI,EAAE,mBAAmB,IAAI,2BAA2B,CAAC,WAAW,CAAC;IAC3E,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IACpC,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CACpB,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAS,EAAE;QACvD,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,YAAY;gBACf,OAAO;oBACL,MAAM;oBACN,QAAQ,EAAE,kBAAkB;oBAC5B,OAAO,EAAE;wBACP,IAAI,EAAE,SAAS;wBACf,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE;wBACzC,QAAQ,EAAE,QAAQ;qBACnB;iBACF,CAAC;YACJ,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,UAAU,GAAU,KAAK,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/authorization/model/index.d.ts

@@ -18,7 +18,10 @@
  * evaluation (authorizer.ts, `kindServedByEdition`): open source refuses a
  * check that targets `team`, `identity_provider`, `invitation` or
  * `platform`, and a tuple that names one resolves over tuples alone, since
- * this edition stores no row of those kinds.
+ * open source stores no row of those kinds. An edition that serves them
+ * keeps their rows in its units' own stores and registers a reader for
+ * each (extensions/resource-row-reader.ts), which the derivation reads them
+ * through.
  *
  * `newModel` exists for tests that need a throwaway model (a cycle, a
  * chain past the depth bound).

package/dist/authorization/model/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,KAAK,EAAmB,eAAe,EAAE,MAAM,cAAc,CAAC;AAErE,MAAM,WAAW,KAAK;IACpB,yBAAyB;IACzB,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACtD,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,GAAG,SAAS,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;CACnD;AAED,wBAAgB,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,GAAG,KAAK,CAe5E;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,EAC/B,QAAQ,EAAE,WAAW,CAAC,eAAe,EAAE,WAAW,CAAC,GAClD,aAAa,CAAC,eAAe,CAAC,CAoChC;AAED,iEAAiE;AACjE,eAAO,MAAM,YAAY,EAAE,KAE1B,CAAC;AAEF,sGAAsG;AACtG,wBAAgB,cAAc,CAC5B,IAAI,EAAE,eAAe,GACpB,eAAe,GAAG,SAAS,CAE7B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAGtH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,KAAK,EAAmB,eAAe,EAAE,MAAM,cAAc,CAAC;AAErE,MAAM,WAAW,KAAK;IACpB,yBAAyB;IACzB,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACtD,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,GAAG,SAAS,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;CACnD;AAED,wBAAgB,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,GAAG,KAAK,CAe5E;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,EAC/B,QAAQ,EAAE,WAAW,CAAC,eAAe,EAAE,WAAW,CAAC,GAClD,aAAa,CAAC,eAAe,CAAC,CAoChC;AAED,iEAAiE;AACjE,eAAO,MAAM,YAAY,EAAE,KAE1B,CAAC;AAEF,sGAAsG;AACtG,wBAAgB,cAAc,CAC5B,IAAI,EAAE,eAAe,GACpB,eAAe,GAAG,SAAS,CAE7B"}

package/dist/authorization/model/index.js

@@ -18,7 +18,10 @@
  * evaluation (authorizer.ts, `kindServedByEdition`): open source refuses a
  * check that targets `team`, `identity_provider`, `invitation` or
  * `platform`, and a tuple that names one resolves over tuples alone, since
- * this edition stores no row of those kinds.
+ * open source stores no row of those kinds. An edition that serves them
+ * keeps their rows in its units' own stores and registers a reader for
+ * each (extensions/resource-row-reader.ts), which the derivation reads them
+ * through.
  *
  * `newModel` exists for tests that need a throwaway model (a cycle, a
  * chain past the depth bound).

package/dist/authorization/model/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/model/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,aAAa,MAAM,iCAAiC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAElF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAUrD,MAAM,UAAU,QAAQ,CAAC,YAA4C;IACnE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,CAAC,IAAI,iCAAiC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO;QACL,YAAY;QACZ,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,KAA+B,EAC/B,QAAmD;IAEnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAmB,EAAE;QACxD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,IAAI,4BAA4B,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,IAAI,sCAAsC,CAAC,CAAC;QAC9F,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;QACnD,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,CAAC,IAAI,IAAI,QAAQ,YAAY,KAAK,CAAC,MAAM,kBAAkB,CAC3G,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO;SACR,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,qCAAqC,eAAe,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,MAAM,YAAY,GAAU,QAAQ,CACzC,SAAS,CAAC,gBAAgB,CAAC,aAAwB,CAAC,EAAE,aAAa,CAAC,CACrE,CAAC;AAEF,sGAAsG;AACtG,MAAM,UAAU,cAAc,CAC5B,IAAqB;IAErB,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/model/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,aAAa,MAAM,iCAAiC,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAElF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAUrD,MAAM,UAAU,QAAQ,CAAC,YAA4C;IACnE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,CAAC,IAAI,iCAAiC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO;QACL,YAAY;QACZ,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,KAA+B,EAC/B,QAAmD;IAEnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAmB,EAAE;QACxD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,eAAe,CAAC,yBAAyB,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,IAAI,4BAA4B,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,IAAI,sCAAsC,CAAC,CAAC;QAC9F,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;QACnD,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,CAAC,IAAI,IAAI,QAAQ,YAAY,KAAK,CAAC,MAAM,kBAAkB,CAC3G,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO;YACL,IAAI;YACJ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO;SACR,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,qCAAqC,eAAe,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,MAAM,YAAY,GAAU,QAAQ,CACzC,SAAS,CAAC,gBAAgB,CAAC,aAAwB,CAAC,EAAE,aAAa,CAAC,CACrE,CAAC;AAEF,sGAAsG;AACtG,MAAM,UAAU,cAAc,CAC5B,IAAqB;IAErB,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/authorization/model/rewrite.d.ts

@@ -15,10 +15,12 @@
  *   define can_view: viewer                    → computed("viewer")
  *
  * `and` exists for one shape: a relation that is true only while another
- * holds too (a team's member is a person granted the role AND still one
+ * holds too. Every direct grant on an organization-scoped type is bounded
+ * that way (`([identity_account] and affiliated from organization) or
+ * ...`), and a team's member is a person granted the role AND still one
  * of the organization's viewers, so leaving the organization ends every
- * team-derived grant with no cleanup). Operators nest to any depth, as
- * the DSL's parentheses allow; the evaluator recurses through them.
+ * grant with no cleanup. Operators nest to any depth, as the DSL's
+ * parentheses allow; the evaluator recurses through them.
  * `but not`, wildcards (`type:*`) and conditions have no form here: the
  * reader refuses them by name, and the day the model needs one is a
  * design act.

package/dist/authorization/model/rewrite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rewrite.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAE3H,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAEhE,0DAA0D;AAC1D,MAAM,MAAM,WAAW;AACrB,oEAAoE;AAClE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACpD,sFAAsF;GACpF;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEN,MAAM,MAAM,OAAO;AACjB,gGAAgG;AAC9F;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;CAAE;AAC1E,wDAAwD;GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAC1D,+FAA+F;GAC7F;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AACH,uEAAuE;GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;CAAE;AACtE,oGAAoG;GAClG;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CAC1C,CAAC;AAMN;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,SAAS,KACd,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAEnC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;IACzC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACxD"}
+{"version":3,"file":"rewrite.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAE3H,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAEhE,0DAA0D;AAC1D,MAAM,MAAM,WAAW;AACrB,oEAAoE;AAClE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACpD,sFAAsF;GACpF;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEN,MAAM,MAAM,OAAO;AACjB,gGAAgG;AAC9F;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;CAAE;AAC1E,wDAAwD;GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAC1D,+FAA+F;GAC7F;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AACH,uEAAuE;GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;CAAE;AACtE,oGAAoG;GAClG;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CAC1C,CAAC;AAMN;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,SAAS,KACd,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAEnC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,wFAAwF;IACxF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;IACzC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACxD"}

package/dist/authorization/organization-directory.d.ts

@@ -1,4 +1,46 @@
+/**
+ * The built-in organization directory — open source's driver for the
+ * organization-directory seam (extensions/organization-directory.ts),
+ * composed under the built-in posture. The cloud's directory answers
+ * `findMyOrganizations` with OpenFGA's list-objects for
+ * `organization#can_view`; this one answers the same question over the
+ * derived source: the candidates are the organizations the person's own
+ * IamPolicy rows name (on open source a person reaches an organization
+ * through a role row and nothing else — the derivation writes no
+ * organization tuple), and each candidate is kept when
+ * `can_view` holds for the person, evaluated by the same evaluator the
+ * Authorizer uses. An evaluation rather than a relation filter, so the
+ * answer stays right if the grant scope ever widens past the four roles,
+ * and stays equal to the cloud's today.
+ *
+ * `refusesEnumeration` is TRUE, the cloud's posture: `find` is
+ * skip-authorization by annotation, so under an enforcing server it would
+ * hand every member every organization row — the list that lies. The
+ * first-party clients list through `findMyOrganizations`. Trusted-local
+ * composes no directory and keeps enumerating (one caller, nothing to
+ * hide from).
+ *
+ * A caller who resolves to no account (an idp-shaped subject before
+ * provisioning) holds no rows and is answered `[]`, never a fault: the
+ * conformance sibling's readiness probe is this very RPC with a fresh
+ * subject. The `internal` class — the server acting as itself over the
+ * in-process transport — is answered `ALL_ORGANIZATIONS`: the Authorize
+ * step treats that class as the in-process authorization skip (pipeline/
+ * interceptors/auth.ts, ruling Q4), and a directory answer IS an
+ * authorization answer, so a server-internal hop sees what the permissive
+ * default showed it. `findMyOrganizations` is skip-authorization by
+ * annotation, which is why this driver meets that caller at all: a
+ * skip lane hands the directory the identity the interceptor stamped,
+ * and no Authorize arm ran before it. Every other caller gets the
+ * evaluated list.
+ * The controller loads each id it is handed and skips the ones whose row
+ * is gone (grants can outlive rows); the source has already loaded the
+ * row once for the evaluation — two primary-key reads per organization,
+ * a handful per person, and the contract's own read is the controller's.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import type { IamPolicyStore } from "../domain/iampolicy/store.js";
+import type { ResourceRowReader } from "../extensions/resource-row-reader.js";
 import type { OrganizationDirectory } from "../extensions/organization-directory.js";
 import type { Store } from "../store/interface.js";
 import type { Model } from "./model/index.js";
@@ -7,6 +49,8 @@ export interface BuiltInOrganizationDirectoryDeps {
     readonly store: Store;
     readonly policies: IamPolicyStore;
     readonly accounts: AccountsByCaller;
+    /** The readers of the kinds units keep themselves (`drivers.resourceRowReaders`), handed to every tuple source. */
+    readonly rowReaders?: ReadonlyMap<ApiResourceKind, ResourceRowReader>;
     readonly model?: Model;
 }
 export declare function newBuiltInOrganizationDirectory(deps: BuiltInOrganizationDirectoryDeps): OrganizationDirectory;

package/dist/authorization/organization-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-directory.d.ts","sourceRoot":"","sources":["../../src/authorization/organization-directory.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAGrF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAID,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,gCAAgC,GACrC,qBAAqB,CA6CvB"}
+{"version":3,"file":"organization-directory.d.ts","sourceRoot":"","sources":["../../src/authorization/organization-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAGrF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,mHAAmH;IACnH,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAID,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,gCAAgC,GACrC,qBAAqB,CA8CvB"}

package/dist/authorization/organization-directory.js

@@ -59,6 +59,7 @@ export function newBuiltInOrganizationDirectory(deps) {
                 store: deps.store,
                 policies: deps.policies,
                 accounts: deps.accounts,
+                rowReaders: deps.rowReaders,
                 model,
             }, person);
             // The candidates come from the source's ONE read of the person's

package/dist/authorization/organization-directory.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-directory.js","sourceRoot":"","sources":["../../src/authorization/organization-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAKtH,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAS5C,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAEhE,MAAM,UAAU,+BAA+B,CAC7C,IAAsC;IAEtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,OAAO;QACL,kBAAkB,EAAE,IAAI;QAExB,KAAK,CAAC,qBAAqB,CACzB,MAAsB;YAEtB,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,iBAAiB,CAAC;YAC3B,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,qBAAqB,CAClC;gBACE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK;aACN,EACD,MAAM,CACP,CAAC;YACF,iEAAiE;YACjE,kEAAkE;YAClE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,MAAM,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;gBAChD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;oBACjE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC5B,IACE,MAAM,aAAa,CACjB,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,EAC1B,UAAU,EACV,MAAM,CACP,EACD,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"organization-directory.js","sourceRoot":"","sources":["../../src/authorization/organization-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAMtH,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAW5C,MAAM,YAAY,GAAG,YAAY,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;AAEhE,MAAM,UAAU,+BAA+B,CAC7C,IAAsC;IAEtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,OAAO;QACL,kBAAkB,EAAE,IAAI;QAExB,KAAK,CAAC,qBAAqB,CACzB,MAAsB;YAEtB,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,OAAO,iBAAiB,CAAC;YAC3B,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,qBAAqB,CAClC;gBACE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,KAAK;aACN,EACD,MAAM,CACP,CAAC;YACF,iEAAiE;YACjE,kEAAkE;YAClE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,MAAM,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;gBAChD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;oBACjE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;gBAC5B,IACE,MAAM,aAAa,CACjB,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,EAC1B,UAAU,EACV,MAAM,CACP,EACD,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authorization/person.d.ts

@@ -4,13 +4,17 @@
  * list scope when it lands), so "who is asking" cannot be answered two
  * ways.
  *
- * Two steps, split so the pure half is testable without a store:
+ * The steps, split so the pure half is testable without a store:
  *
  *   `resolvePerson(accounts, caller)` — the I/O: the account the caller
  *   stands for through `accountForCaller` (domain/identityaccount/
  *   resolve.ts, the domain's one statement of that question — the two
  *   reads whoAmI makes), then `personFor`.
  *
+ *   `personOfAccount(accounts, id)` — the person an account id names
+ *   when no caller stands for them (an invitation's creator), with the
+ *   same alias rule.
+ *
  *   `personFor(caller, account)` — the pure half: the account id the
  *   IamPolicy rows name, and every string a creator stamp may carry for
  *   the same human. A provisioned caller carries the account id and the
@@ -33,10 +37,19 @@
  */
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
 import type { AccountsByCaller } from "../domain/identityaccount/resolve.js";
+import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
 import type { CallerIdentity } from "../extensions/identity.js";
 import type { Person } from "./tuples.js";
 export type { AccountsByCaller } from "../domain/identityaccount/resolve.js";
 export declare function personFor(caller: CallerIdentity, account: IdentityAccount | undefined): Person;
+/**
+ * The person an account id names when no caller stands for them: the
+ * creator of an invitation, asked whether they could still grant what it
+ * grants. The alias rule is `personFor`'s: the id itself, and the issuer
+ * subject when the account is found. An account that is gone is its id
+ * alone, and the rows that still name it are what the check reads.
+ */
+export declare function personOfAccount(accounts: Pick<IdentityAccountStore, "findById">, accountId: string): Promise<Person>;
 /** The person a caller is, read through the account port; faults propagate as they are. */
 export declare function resolvePerson(accounts: AccountsByCaller, caller: CallerIdentity): Promise<Person>;
 //# sourceMappingURL=person.d.ts.map

package/dist/authorization/person.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"person.d.ts","sourceRoot":"","sources":["../../src/authorization/person.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAGhG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,YAAY,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,wBAAgB,SAAS,CACvB,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,eAAe,GAAG,SAAS,GACnC,MAAM,CAaR;AAED,2FAA2F;AAC3F,wBAAsB,aAAa,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,CAEjB"}
+{"version":3,"file":"person.d.ts","sourceRoot":"","sources":["../../src/authorization/person.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAGhG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,YAAY,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAE7E,wBAAgB,SAAS,CACvB,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,eAAe,GAAG,SAAS,GACnC,MAAM,CAQR;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,EAChD,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAcD,2FAA2F;AAC3F,wBAAsB,aAAa,CACjC,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,MAAM,CAAC,CAEjB"}

package/dist/authorization/person.js

@@ -5,6 +5,22 @@ export function personFor(caller, account) {
     if (!isPersonStamp(accountId)) {
         throw new Error(`caller '${accountId}' names no person — the built-in authorizer evaluates people only`);
     }
+    return withAliases(accountId, account);
+}
+/**
+ * The person an account id names when no caller stands for them: the
+ * creator of an invitation, asked whether they could still grant what it
+ * grants. The alias rule is `personFor`'s: the id itself, and the issuer
+ * subject when the account is found. An account that is gone is its id
+ * alone, and the rows that still name it are what the check reads.
+ */
+export async function personOfAccount(accounts, accountId) {
+    if (!isPersonStamp(accountId)) {
+        throw new Error(`account '${accountId}' names no person — the built-in authorizer evaluates people only`);
+    }
+    return withAliases(accountId, await accounts.findById(accountId));
+}
+function withAliases(accountId, account) {
     const aliases = new Set([accountId]);
     const subject = account?.spec?.idpId ?? "";
     if (subject !== "") {

package/dist/authorization/person.js.map

@@ -1 +1 @@
-{"version":3,"file":"person.js","sourceRoot":"","sources":["../../src/authorization/person.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAMxE,MAAM,UAAU,SAAS,CACvB,MAAsB,EACtB,OAAoC;IAEpC,MAAM,SAAS,GAAG,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC;IAC7D,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,mEAAmE,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IAC3C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAA0B,EAC1B,MAAsB;IAEtB,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"person.js","sourceRoot":"","sources":["../../src/authorization/person.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAGlE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAMxE,MAAM,UAAU,SAAS,CACvB,MAAsB,EACtB,OAAoC;IAEpC,MAAM,SAAS,GAAG,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,CAAC;IAC7D,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,mEAAmE,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgD,EAChD,SAAiB;IAEjB,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,YAAY,SAAS,mEAAmE,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,SAAS,EAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAClB,SAAiB,EACjB,OAAoC;IAEpC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IAC3C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAA0B,EAC1B,MAAsB;IAEtB,OAAO,SAAS,CAAC,MAAM,EAAE,MAAM,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/authorization/policy-check.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The built-in policy check — the one question of the authorization-query
+ * engine (extensions/authorization-queries.ts, `check`) that the built-in
+ * posture can answer from its own evaluator: "is this policy effectively
+ * held". A unit composed on the built-in posture asks it through the
+ * services the composition hands it (extensions/registry.ts,
+ * `ComposedServices`), exactly where a composition with its own engine
+ * hands that engine's `check`, so the unit asks one question in every
+ * edition and the model answers it one way.
+ *
+ * What it answers, and why no more:
+ *   - A policy whose principal is a person (`identity_account:<id>`): the
+ *     person the id names, with `personFor`'s alias rule (person.ts), and
+ *     the rows they and their teams hold — the same walk a point check
+ *     makes for a caller.
+ *   - A policy whose principal is any other object (`organization:<o>`):
+ *     the structural question a grant to a team asks — does this resource
+ *     belong to the team's organization — answered by the resource's own
+ *     derived links (derived-tuples.ts).
+ *   - Contextual policies are refused as a programming error. No caller
+ *     asks with them, and the derived source has no notion of a tuple held
+ *     only for the length of one check; answering without them would be a
+ *     silent wrong answer, the failure a throw prevents.
+ *   - A userset principal (`organization:<o>#member`) is refused the same
+ *     way: the engine contract checks direct principals.
+ *
+ * The engine's list verbs are not answered here: they enumerate, which the
+ * built-in posture does not do, and the tuple-half RPCs that expose them
+ * keep refusing in open source without an engine. One source per check,
+ * like the Authorizer: its memo is the check's. Faults propagate; the
+ * caller's own error mapping decides the wire.
+ */
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { IamPolicyStore } from "../domain/iampolicy/store.js";
+import type { IdentityAccountStore } from "../domain/identityaccount/store.js";
+import type { AuthorizationQueryEngine } from "../extensions/authorization-queries.js";
+import type { ResourceRowReader } from "../extensions/resource-row-reader.js";
+import type { Store } from "../store/interface.js";
+import type { Model } from "./model/index.js";
+export interface BuiltInPolicyCheckDeps {
+    readonly store: Store;
+    /** The port the grant path writes through — the principal's rows are read from the same instance. */
+    readonly policies: IamPolicyStore;
+    /** The account port: a person principal's aliases, and identity_account objects. */
+    readonly accounts: Pick<IdentityAccountStore, "findById">;
+    /** The readers of the kinds units keep themselves (`drivers.resourceRowReaders`). */
+    readonly rowReaders?: ReadonlyMap<ApiResourceKind, ResourceRowReader>;
+    /** The declarations to evaluate; the built-in model unless a test says otherwise. */
+    readonly model?: Model;
+}
+export declare function newBuiltInPolicyCheck(deps: BuiltInPolicyCheckDeps): Pick<AuthorizationQueryEngine, "check">;
+//# sourceMappingURL=policy-check.d.ts.map

package/dist/authorization/policy-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-check.d.ts","sourceRoot":"","sources":["../../src/authorization/policy-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAE3H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAGnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAM9C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,qGAAqG;IACrG,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAC1D,qFAAqF;IACrF,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACtE,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,sBAAsB,GAC3B,IAAI,CAAC,wBAAwB,EAAE,OAAO,CAAC,CA2CzC"}

package/dist/authorization/policy-check.js

@@ -0,0 +1,35 @@
+import { newDerivedTupleSource } from "./derived-tuples.js";
+import { checkRelation } from "./evaluator.js";
+import { builtInModel } from "./model/index.js";
+import { personOfAccount } from "./person.js";
+import { ACCOUNT_TYPE } from "./tuples.js";
+export function newBuiltInPolicyCheck(deps) {
+    const model = deps.model ?? builtInModel;
+    return {
+        async check(policy, contextualPolicies) {
+            if (contextualPolicies.length > 0) {
+                throw new Error("the built-in policy check evaluates held policies only — contextual policies are not supported");
+            }
+            const principalRef = policy.principal;
+            const resource = policy.resource;
+            if (principalRef === undefined || resource === undefined) {
+                throw new Error("the built-in policy check needs a principal and a resource");
+            }
+            if (principalRef.relation !== "") {
+                throw new Error(`the built-in policy check takes a direct principal — '${principalRef.kind}:${principalRef.id}#${principalRef.relation}' is a userset`);
+            }
+            const principal = principalRef.kind === ACCOUNT_TYPE
+                ? await personOfAccount(deps.accounts, principalRef.id)
+                : { object: { type: principalRef.kind, id: principalRef.id } };
+            const source = newDerivedTupleSource({
+                store: deps.store,
+                policies: deps.policies,
+                accounts: deps.accounts,
+                rowReaders: deps.rowReaders,
+                model,
+            }, principal);
+            return checkRelation({ model, source }, { type: resource.kind, id: resource.id }, policy.relation, principal);
+        },
+    };
+}
+//# sourceMappingURL=policy-check.js.map

package/dist/authorization/policy-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-check.js","sourceRoot":"","sources":["../../src/authorization/policy-check.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAc3C,MAAM,UAAU,qBAAqB,CACnC,IAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB;YACpC,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC;YACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACjC,IAAI,YAAY,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;YACJ,CAAC;YACD,IAAI,YAAY,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,yDAAyD,YAAY,CAAC,IAAI,IAAI,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,QAAQ,gBAAgB,CACvI,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GACb,YAAY,CAAC,IAAI,KAAK,YAAY;gBAChC,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;gBACvD,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,qBAAqB,CAClC;gBACE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,KAAK;aACN,EACD,SAAS,CACV,CAAC;YACF,OAAO,aAAa,CAClB,EAAE,KAAK,EAAE,MAAM,EAAE,EACjB,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,EACxC,MAAM,CAAC,QAAQ,EACf,SAAS,CACV,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authorization/posture.d.ts

@@ -14,19 +14,31 @@
  *     posture (the OSS OIDC issuer, or a unit's declaration). Open source
  *     composes the built-in Authorizer, the organization directory and
  *     the schedule fire caller — the cloud's model evaluated over derived
- *     tuples — so the roles 2b records are enforced.
+ *     tuples — so the roles 2b records are enforced. An edition above
+ *     open source may run it too, once every kind it serves has rows the
+ *     derivation can read (`kindsWithoutRows` below).
  *   - `trusted-local`: no unit Authorizer and no authentication posture —
- *     the laptop. The permissive default stays: one caller, nothing to
- *     separate; the trusted-local identity carries the operator's EMAIL,
+ *     the laptop. The permissive driver (trusted-local-authorizer.ts): one
+ *     caller, nothing to separate, so every check is allowed except one
+ *     that names an Organization the server does not hold, which is
+ *     not-found as under the other two postures (stigmer#1163). The
+ *     trusted-local identity carries the operator's EMAIL,
  *     never an account id, and pre-2a rows are stamped `"system"`, so an
  *     enforcing evaluator would refuse the laptop's own history. The roles
  *     still exist (the lifecycle and the membership rules run) to feed the
- *     Members page truthfully.
+ *     Members page truthfully. Open source's edition only: a composition
+ *     serving an edition above it refuses to boot here, since an edition
+ *     of many organizations with no sign-in would act as the operator for
+ *     every request that carries no credential.
  *
  * The type lives with the module that gives it meaning (the precedent:
  * `ConsoleSignInPosture` in transport/console/handler.ts); the
  * composition root computes the value once and hands it down.
  */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
+import type { ResourceRowReader } from "../extensions/resource-row-reader.js";
+import type { Model } from "./model/index.js";
 export type AuthorizationPosture = "trusted-local" | "built-in" | "unit-authorizer";
 export interface AuthorizationPostureInputs {
     /** A unit registered `authorizer` (ResolvedExtensions.authorizer !== undefined). */
@@ -35,4 +47,18 @@ export interface AuthorizationPostureInputs {
     readonly requireAuthentication: boolean;
 }
 export declare function authorizationPostureOf(inputs: AuthorizationPostureInputs): AuthorizationPosture;
+/**
+ * The kinds an edition serves whose rows the built-in authorizer could not
+ * read: declared by the model with a row schema, served by the edition,
+ * not served by open source (whose kinds are its own store's), and not
+ * `identity_account` (read through the account port), with no reader
+ * registered for them. Empty means the built-in posture can answer every
+ * check the edition's lanes make. The composition root refuses a built-in
+ * posture that leaves any, rather than answer from rows that are not there.
+ */
+export declare function kindsWithoutRows(inputs: {
+    readonly edition: ServerEdition;
+    readonly model: Model;
+    readonly readers: ReadonlyMap<ApiResourceKind, ResourceRowReader>;
+}): ReadonlyArray<ApiResourceKind>;
 //# sourceMappingURL=posture.d.ts.map

package/dist/authorization/posture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posture.d.ts","sourceRoot":"","sources":["../../src/authorization/posture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,oBAAoB,GAC5B,eAAe,GACf,UAAU,GACV,iBAAiB,CAAC;AAEtB,MAAM,WAAW,0BAA0B;IACzC,oFAAoF;IACpF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;CACzC;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,0BAA0B,GACjC,oBAAoB,CAKtB"}
+{"version":3,"file":"posture.d.ts","sourceRoot":"","sources":["../../src/authorization/posture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAEtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAE9E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,MAAM,oBAAoB,GAC5B,eAAe,GACf,UAAU,GACV,iBAAiB,CAAC;AAEtB,MAAM,WAAW,0BAA0B;IACzC,oFAAoF;IACpF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;CACzC;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,0BAA0B,GACjC,oBAAoB,CAKtB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;CACnE,GAAG,aAAa,CAAC,eAAe,CAAC,CAWjC"}

package/dist/authorization/posture.js

@@ -1,7 +1,65 @@
+/**
+ * The authorization posture — WHICH authorizer a composed server runs,
+ * named once so the composition root, the boot log and the tests speak
+ * one word for it. Three postures, decided by two facts the registry and
+ * the config already hold:
+ *
+ *   - `unit-authorizer`: a unit registered its own Authorizer (the cloud
+ *     composes OpenFGA). Nothing built in is installed — not the
+ *     authorizer, not the directory, not the fire caller, and not the
+ *     role lifecycle or the membership rules either (a composition with
+ *     its own Authorizer has its own onboarding). The require-
+ *     authentication posture does not change this.
+ *   - `built-in`: no unit Authorizer AND the require-authentication
+ *     posture (the OSS OIDC issuer, or a unit's declaration). Open source
+ *     composes the built-in Authorizer, the organization directory and
+ *     the schedule fire caller — the cloud's model evaluated over derived
+ *     tuples — so the roles 2b records are enforced. An edition above
+ *     open source may run it too, once every kind it serves has rows the
+ *     derivation can read (`kindsWithoutRows` below).
+ *   - `trusted-local`: no unit Authorizer and no authentication posture —
+ *     the laptop. The permissive driver (trusted-local-authorizer.ts): one
+ *     caller, nothing to separate, so every check is allowed except one
+ *     that names an Organization the server does not hold, which is
+ *     not-found as under the other two postures (stigmer#1163). The
+ *     trusted-local identity carries the operator's EMAIL,
+ *     never an account id, and pre-2a rows are stamped `"system"`, so an
+ *     enforcing evaluator would refuse the laptop's own history. The roles
+ *     still exist (the lifecycle and the membership rules run) to feed the
+ *     Members page truthfully. Open source's edition only: a composition
+ *     serving an edition above it refuses to boot here, since an edition
+ *     of many organizations with no sign-in would act as the operator for
+ *     every request that carries no credential.
+ *
+ * The type lives with the module that gives it meaning (the precedent:
+ * `ConsoleSignInPosture` in transport/console/handler.ts); the
+ * composition root computes the value once and hands it down.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ServerEdition } from "@stigmer/protos/ai/stigmer/platform/v1/server_info_pb";
+import { kindServedByEdition } from "../pipeline/apiresource-meta.js";
 export function authorizationPostureOf(inputs) {
     if (inputs.unitAuthorizer) {
         return "unit-authorizer";
     }
     return inputs.requireAuthentication ? "built-in" : "trusted-local";
 }
+/**
+ * The kinds an edition serves whose rows the built-in authorizer could not
+ * read: declared by the model with a row schema, served by the edition,
+ * not served by open source (whose kinds are its own store's), and not
+ * `identity_account` (read through the account port), with no reader
+ * registered for them. Empty means the built-in posture can answer every
+ * check the edition's lanes make. The composition root refuses a built-in
+ * posture that leaves any, rather than answer from rows that are not there.
+ */
+export function kindsWithoutRows(inputs) {
+    return inputs.model.declarations
+        .filter((declaration) => declaration.schema !== undefined &&
+        declaration.kind !== ApiResourceKind.identity_account &&
+        kindServedByEdition(declaration.kind, inputs.edition) &&
+        !kindServedByEdition(declaration.kind, ServerEdition.oss) &&
+        !inputs.readers.has(declaration.kind))
+        .map((declaration) => declaration.kind);
+}
 //# sourceMappingURL=posture.js.map

package/dist/authorization/posture.js.map

@@ -1 +1 @@
-{"version":3,"file":"posture.js","sourceRoot":"","sources":["../../src/authorization/posture.ts"],"names":[],"mappings":"AAyCA,MAAM,UAAU,sBAAsB,CACpC,MAAkC;IAElC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC;AACrE,CAAC"}
+{"version":3,"file":"posture.js","sourceRoot":"","sources":["../../src/authorization/posture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,uDAAuD,CAAC;AAGtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAetE,MAAM,UAAU,sBAAsB,CACpC,MAAkC;IAElC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC;AACrE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAIhC;IACC,OAAO,MAAM,CAAC,KAAK,CAAC,YAAY;SAC7B,MAAM,CACL,CAAC,WAAW,EAAE,EAAE,CACd,WAAW,CAAC,MAAM,KAAK,SAAS;QAChC,WAAW,CAAC,IAAI,KAAK,eAAe,CAAC,gBAAgB;QACrD,mBAAmB,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC;QACrD,CAAC,mBAAmB,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC;QACzD,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CACxC;SACA,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC"}

package/dist/authorization/resource-creators.d.ts

@@ -0,0 +1,4 @@
+import type { ResourceCreators } from "../domain/iampolicy/grant-path.js";
+import type { Store } from "../store/interface.js";
+export declare function newStoreResourceCreators(store: Store): ResourceCreators;
+//# sourceMappingURL=resource-creators.d.ts.map

package/dist/authorization/resource-creators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-creators.d.ts","sourceRoot":"","sources":["../../src/authorization/resource-creators.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAG1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAInD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,KAAK,GAAG,gBAAgB,CAuBvE"}

package/dist/authorization/resource-creators.js

@@ -0,0 +1,44 @@
+/**
+ * The removal sweep's one read outside the policy rows: a stored
+ * resource's recorded creator (`ResourceCreators`,
+ * domain/iampolicy/grant-path.ts). When an account leaves an
+ * organization, the grant path keeps the rows that record the account as
+ * a resource's author, and only the resource's own row says who that is.
+ *
+ * The row is read through the generic store with the schema the built-in
+ * model binds to its kind, the same read the derived tuple source makes
+ * for a check (derived-tuples.ts `loadRow`), and the creator is the stamp
+ * that source derives an author's `owner` tuple from (`createdByOf`). A
+ * kind the model binds no schema to, or a row the store does not hold (a
+ * kind a composition keeps in its own table), has no recorded creator
+ * here, so no row of it is kept as authorship.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { kindByEnumName } from "../pipeline/apiresource-meta.js";
+import { createdByOf } from "../pipeline/steps/authorization-facts.js";
+import { ResourceNotFoundError } from "../store/interface.js";
+import { builtInModel } from "./model/index.js";
+export function newStoreResourceCreators(store) {
+    return {
+        async creatorOf(kindName, id) {
+            const kind = kindByEnumName(kindName);
+            const schema = builtInModel.byKind(kind)?.schema;
+            if (kind === ApiResourceKind.api_resource_kind_unknown ||
+                kind === ApiResourceKind.identity_account ||
+                schema === undefined ||
+                id === "") {
+                return undefined;
+            }
+            try {
+                return createdByOf(await store.getResource(kind, id, schema));
+            }
+            catch (error) {
+                if (error instanceof ResourceNotFoundError) {
+                    return undefined;
+                }
+                throw error;
+            }
+        },
+    };
+}
+//# sourceMappingURL=resource-creators.js.map