@xemahq/contracts 0.31.0 → 0.33.0

package/dist/authorization-module/lib/authorization-module-envelope.d.ts

@@ -0,0 +1,116 @@
+import { z } from 'zod';
+export declare const AUTHORIZATION_MODULE_FILE_PATTERN: RegExp;
+export declare const AUTHORIZATION_MODULE_TEST_FILE_PATTERN: RegExp;
+export declare const AuthorizationModuleDependencySchema: z.ZodObject<{
+    biome: z.ZodString;
+    minModuleVersion: z.ZodNumber;
+}, z.core.$strict>;
+export type AuthorizationModuleDependency = z.infer<typeof AuthorizationModuleDependencySchema>;
+export declare const AuthorizationSearchableSchema: z.ZodObject<{
+    anchor: z.ZodOptional<z.ZodString>;
+    highCardinality: z.ZodBoolean;
+}, z.core.$strict>;
+export type AuthorizationSearchable = z.infer<typeof AuthorizationSearchableSchema>;
+export declare enum AuthorizationMigrationStepKind {
+    RenameType = "rename-type",
+    RenameRelation = "rename-relation",
+    DropType = "drop-type",
+    DropRelation = "drop-relation",
+    NarrowRestriction = "narrow-restriction"
+}
+export declare const AuthorizationMigrationStepSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<AuthorizationMigrationStepKind.RenameType>;
+    from: z.ZodString;
+    to: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<AuthorizationMigrationStepKind.RenameRelation>;
+    type: z.ZodString;
+    from: z.ZodString;
+    to: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<AuthorizationMigrationStepKind.DropType>;
+    type: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<AuthorizationMigrationStepKind.DropRelation>;
+    type: z.ZodString;
+    relation: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<AuthorizationMigrationStepKind.NarrowRestriction>;
+    type: z.ZodString;
+    relation: z.ZodString;
+    removed: z.ZodArray<z.ZodString>;
+}, z.core.$strict>], "kind">;
+export type AuthorizationMigrationStep = z.infer<typeof AuthorizationMigrationStepSchema>;
+export declare const AuthorizationModuleMigrationSchema: z.ZodObject<{
+    from: z.ZodNumber;
+    steps: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<AuthorizationMigrationStepKind.RenameType>;
+        from: z.ZodString;
+        to: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<AuthorizationMigrationStepKind.RenameRelation>;
+        type: z.ZodString;
+        from: z.ZodString;
+        to: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<AuthorizationMigrationStepKind.DropType>;
+        type: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<AuthorizationMigrationStepKind.DropRelation>;
+        type: z.ZodString;
+        relation: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<AuthorizationMigrationStepKind.NarrowRestriction>;
+        type: z.ZodString;
+        relation: z.ZodString;
+        removed: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>], "kind">>;
+}, z.core.$strict>;
+export type AuthorizationModuleMigration = z.infer<typeof AuthorizationModuleMigrationSchema>;
+export declare const AuthorizationModuleEnvelopeSchema: z.ZodObject<{
+    namespace: z.ZodOptional<z.ZodString>;
+    moduleVersion: z.ZodNumber;
+    platformGeneration: z.ZodString;
+    files: z.ZodArray<z.ZodString>;
+    tests: z.ZodString;
+    imports: z.ZodArray<z.ZodEnum<typeof import("./platform-authorization-modules").PlatformAuthorizationModule>>;
+    dependsOn: z.ZodArray<z.ZodObject<{
+        biome: z.ZodString;
+        minModuleVersion: z.ZodNumber;
+    }, z.core.$strict>>;
+    implements: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodEnum<typeof import("./platform-authorization-modules").XemaAuthorizationInterface>>>;
+    resourceTypes: z.ZodArray<z.ZodString>;
+    writableRelations: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+    searchable: z.ZodRecord<z.ZodString, z.ZodObject<{
+        anchor: z.ZodOptional<z.ZodString>;
+        highCardinality: z.ZodBoolean;
+    }, z.core.$strict>>;
+    publicWildcards: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+    migrations: z.ZodArray<z.ZodObject<{
+        from: z.ZodNumber;
+        steps: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<AuthorizationMigrationStepKind.RenameType>;
+            from: z.ZodString;
+            to: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<AuthorizationMigrationStepKind.RenameRelation>;
+            type: z.ZodString;
+            from: z.ZodString;
+            to: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<AuthorizationMigrationStepKind.DropType>;
+            type: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<AuthorizationMigrationStepKind.DropRelation>;
+            type: z.ZodString;
+            relation: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<AuthorizationMigrationStepKind.NarrowRestriction>;
+            type: z.ZodString;
+            relation: z.ZodString;
+            removed: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>], "kind">>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AuthorizationModuleEnvelope = z.infer<typeof AuthorizationModuleEnvelopeSchema>;
+//# sourceMappingURL=authorization-module-envelope.d.ts.map

package/dist/authorization-module/lib/authorization-module-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-module-envelope.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA+BxB,eAAO,MAAM,iCAAiC,QAAgC,CAAC;AAE/E,eAAO,MAAM,sCAAsC,QACd,CAAC;AAStC,eAAO,MAAM,mCAAmC;;;kBAKrC,CAAC;AACZ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,mCAAmC,CAC3C,CAAC;AAGF,eAAO,MAAM,6BAA6B;;;kBAiBtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AAOF,oBAAY,8BAA8B;IACxC,UAAU,gBAAgB;IAC1B,cAAc,oBAAoB;IAClC,QAAQ,cAAc;IACtB,YAAY,kBAAkB;IAC9B,iBAAiB,uBAAuB;CACzC;AAED,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;4BAsC3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AASF,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;kBAKpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAChD,OAAO,kCAAkC,CAC1C,CAAC;AAEF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAgDnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC"}

package/dist/authorization-module/lib/authorization-module-envelope.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationModuleEnvelopeSchema = exports.AuthorizationModuleMigrationSchema = exports.AuthorizationMigrationStepSchema = exports.AuthorizationMigrationStepKind = exports.AuthorizationSearchableSchema = exports.AuthorizationModuleDependencySchema = exports.AUTHORIZATION_MODULE_TEST_FILE_PATTERN = exports.AUTHORIZATION_MODULE_FILE_PATTERN = void 0;
+const zod_1 = require("zod");
+const authorization_facts_1 = require("../../authorization-facts");
+const platform_generation_1 = require("../../platform-generation");
+const authorization_namespace_1 = require("./authorization-namespace");
+const platform_authorization_modules_1 = require("./platform-authorization-modules");
+const TypeNameSchema = zod_1.z.string().regex(/^[^:#@*\s]{1,254}$/);
+const RelationNameSchema = zod_1.z.string().regex(/^[^:#@*\s]{1,50}$/);
+exports.AUTHORIZATION_MODULE_FILE_PATTERN = /^[a-z0-9][a-z0-9._-]*\.fga$/;
+exports.AUTHORIZATION_MODULE_TEST_FILE_PATTERN = /^[a-z0-9][a-z0-9._-]*\.fga\.yaml$/;
+function uniqueArray(item, what) {
+    return zod_1.z.array(item).refine((values) => new Set(values).size === values.length, {
+        message: `${what} must not repeat an entry.`,
+    });
+}
+exports.AuthorizationModuleDependencySchema = zod_1.z
+    .object({
+    biome: authorization_namespace_1.AuthorizationBiomeIdSchema,
+    minModuleVersion: zod_1.z.number().int().positive(),
+})
+    .strict();
+exports.AuthorizationSearchableSchema = zod_1.z
+    .object({
+    anchor: TypeNameSchema.optional(),
+    highCardinality: zod_1.z.boolean(),
+})
+    .strict()
+    .refine((s) => !s.highCardinality || s.anchor !== undefined, {
+    message: 'a high-cardinality searchable type must declare an anchor (D10).',
+});
+var AuthorizationMigrationStepKind;
+(function (AuthorizationMigrationStepKind) {
+    AuthorizationMigrationStepKind["RenameType"] = "rename-type";
+    AuthorizationMigrationStepKind["RenameRelation"] = "rename-relation";
+    AuthorizationMigrationStepKind["DropType"] = "drop-type";
+    AuthorizationMigrationStepKind["DropRelation"] = "drop-relation";
+    AuthorizationMigrationStepKind["NarrowRestriction"] = "narrow-restriction";
+})(AuthorizationMigrationStepKind || (exports.AuthorizationMigrationStepKind = AuthorizationMigrationStepKind = {}));
+exports.AuthorizationMigrationStepSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal(AuthorizationMigrationStepKind.RenameType),
+        from: TypeNameSchema,
+        to: TypeNameSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal(AuthorizationMigrationStepKind.RenameRelation),
+        type: TypeNameSchema,
+        from: RelationNameSchema,
+        to: RelationNameSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal(AuthorizationMigrationStepKind.DropType),
+        type: TypeNameSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal(AuthorizationMigrationStepKind.DropRelation),
+        type: TypeNameSchema,
+        relation: RelationNameSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal(AuthorizationMigrationStepKind.NarrowRestriction),
+        type: TypeNameSchema,
+        relation: RelationNameSchema,
+        removed: zod_1.z.array(zod_1.z.string().min(1)).min(1),
+    })
+        .strict(),
+]);
+exports.AuthorizationModuleMigrationSchema = zod_1.z
+    .object({
+    from: zod_1.z.number().int().positive(),
+    steps: zod_1.z.array(exports.AuthorizationMigrationStepSchema).min(1),
+})
+    .strict();
+exports.AuthorizationModuleEnvelopeSchema = zod_1.z
+    .object({
+    namespace: zod_1.z.string().min(1).optional(),
+    moduleVersion: zod_1.z.number().int().positive(),
+    platformGeneration: platform_generation_1.PlatformGenerationDeclarationSchema,
+    files: uniqueArray(zod_1.z.string().regex(exports.AUTHORIZATION_MODULE_FILE_PATTERN), 'files').min(1),
+    tests: zod_1.z.string().regex(exports.AUTHORIZATION_MODULE_TEST_FILE_PATTERN),
+    imports: uniqueArray(platform_authorization_modules_1.PlatformAuthorizationModuleSchema, 'imports'),
+    dependsOn: zod_1.z
+        .array(exports.AuthorizationModuleDependencySchema)
+        .refine((deps) => new Set(deps.map((d) => d.biome)).size === deps.length, { message: 'dependsOn must not name a biome twice.' }),
+    implements: zod_1.z.record(TypeNameSchema, uniqueArray(platform_authorization_modules_1.XemaAuthorizationInterfaceSchema, 'implements').min(1)),
+    resourceTypes: uniqueArray(TypeNameSchema, 'resourceTypes').min(1),
+    writableRelations: authorization_facts_1.WritableRelationsSchema,
+    searchable: zod_1.z.record(TypeNameSchema, exports.AuthorizationSearchableSchema),
+    publicWildcards: zod_1.z.record(TypeNameSchema, uniqueArray(RelationNameSchema, 'publicWildcards').min(1)),
+    migrations: zod_1.z.array(exports.AuthorizationModuleMigrationSchema),
+})
+    .strict();
+//# sourceMappingURL=authorization-module-envelope.js.map

package/dist/authorization-module/lib/authorization-module-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-module-envelope.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-module-envelope.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,mEAAoE;AACpE,mEAAgF;AAEhF,uEAAuE;AACvE,qFAG0C;AAkB1C,MAAM,cAAc,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAC9D,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAGpD,QAAA,iCAAiC,GAAG,6BAA6B,CAAC;AAElE,QAAA,sCAAsC,GACjD,mCAAmC,CAAC;AAEtC,SAAS,WAAW,CAAyB,IAAO,EAAE,IAAY;IAChE,OAAO,OAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE;QAC9E,OAAO,EAAE,GAAG,IAAI,4BAA4B;KAC7C,CAAC,CAAC;AACL,CAAC;AAGY,QAAA,mCAAmC,GAAG,OAAC;KACjD,MAAM,CAAC;IACN,KAAK,EAAE,oDAA0B;IACjC,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,MAAM,EAAE,CAAC;AAMC,QAAA,6BAA6B,GAAG,OAAC;KAC3C,MAAM,CAAC;IAKN,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE;IAMjC,eAAe,EAAE,OAAC,CAAC,OAAO,EAAE;CAC7B,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE;IAC3D,OAAO,EAAE,kEAAkE;CAC5E,CAAC,CAAC;AAUL,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,4DAA0B,CAAA;IAC1B,oEAAkC,CAAA;IAClC,wDAAsB,CAAA;IACtB,gEAA8B,CAAA;IAC9B,0EAAwC,CAAA;AAC1C,CAAC,EANW,8BAA8B,8CAA9B,8BAA8B,QAMzC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3E,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,UAAU,CAAC;QAC1D,IAAI,EAAE,cAAc;QACpB,EAAE,EAAE,cAAc;KACnB,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,cAAc,CAAC;QAC9D,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,kBAAkB;QACxB,EAAE,EAAE,kBAAkB;KACvB,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,cAAc;KACrB,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,YAAY,CAAC;QAC5D,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,kBAAkB;KAC7B,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,iBAAiB,CAAC;QACjE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,kBAAkB;QAE5B,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3C,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAYU,QAAA,kCAAkC,GAAG,OAAC;KAChD,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,wCAAgC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACxD,CAAC;KACD,MAAM,EAAE,CAAC;AAKC,QAAA,iCAAiC,GAAG,OAAC;KAC/C,MAAM,CAAC;IAEN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEvC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE1C,kBAAkB,EAAE,yDAAmC;IAEvD,KAAK,EAAE,WAAW,CAChB,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yCAAiC,CAAC,EACnD,OAAO,CACR,CAAC,GAAG,CAAC,CAAC,CAAC;IAER,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8CAAsC,CAAC;IAE/D,OAAO,EAAE,WAAW,CAAC,kEAAiC,EAAE,SAAS,CAAC;IAElE,SAAS,EAAE,OAAC;SACT,KAAK,CAAC,2CAAmC,CAAC;SAC1C,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAChE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CACtD;IAEH,UAAU,EAAE,OAAC,CAAC,MAAM,CAClB,cAAc,EACd,WAAW,CAAC,iEAAgC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACnE;IAED,aAAa,EAAE,WAAW,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAElE,iBAAiB,EAAE,6CAAuB;IAE1C,UAAU,EAAE,OAAC,CAAC,MAAM,CAAC,cAAc,EAAE,qCAA6B,CAAC;IAOnE,eAAe,EAAE,OAAC,CAAC,MAAM,CACvB,cAAc,EACd,WAAW,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAC1D;IAED,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,0CAAkC,CAAC;CACxD,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/authorization-module/lib/authorization-namespace.d.ts

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+export declare const AUTHORIZATION_BIOME_ID_PATTERN: RegExp;
+export declare const XEMA_PLATFORM_NAMESPACE = "xema";
+export declare const AUTHORIZATION_NAMESPACE_SEPARATOR = "_";
+export declare const OPENFGA_DSL_RESERVED_WORDS: readonly string[];
+export declare enum AuthorizationNamespaceRefusal {
+    Grammar = "grammar",
+    ReservedPlatformNamespace = "reserved_platform_namespace",
+    DslKeyword = "dsl_keyword"
+}
+export declare class AuthorizationNamespaceError extends Error {
+    readonly refusal: AuthorizationNamespaceRefusal;
+    readonly biomeId: string;
+    constructor(refusal: AuthorizationNamespaceRefusal, biomeId: string);
+}
+export declare function authorizationNamespaceRefusal(biomeId: string): AuthorizationNamespaceRefusal | null;
+export declare const AuthorizationBiomeIdSchema: z.ZodString;
+export declare function deriveAuthorizationNamespace(signedBiomeId: string): {
+    readonly moduleName: string;
+    readonly prefix: string;
+};
+export declare function namespaceOfAuthorizationName(name: string): string | null;
+//# sourceMappingURL=authorization-namespace.d.ts.map

package/dist/authorization-module/lib/authorization-namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-namespace.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsBxB,eAAO,MAAM,8BAA8B,QAAsB,CAAC;AAGlE,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAG9C,eAAO,MAAM,iCAAiC,MAAM,CAAC;AAarD,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAkBtD,CAAC;AAGH,oBAAY,6BAA6B;IAEvC,OAAO,YAAY;IAEnB,yBAAyB,gCAAgC;IAEzD,UAAU,gBAAgB;CAC3B;AAED,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,OAAO,EAAE,6BAA6B,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAEb,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM;CAQpE;AAGD,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,GACd,6BAA6B,GAAG,IAAI,CAWtC;AAED,eAAO,MAAM,0BAA0B,aAQrC,CAAC;AAMH,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,MAAM,GAAG;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CASA;AAMD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGxE"}

package/dist/authorization-module/lib/authorization-namespace.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationBiomeIdSchema = exports.AuthorizationNamespaceError = exports.AuthorizationNamespaceRefusal = exports.OPENFGA_DSL_RESERVED_WORDS = exports.AUTHORIZATION_NAMESPACE_SEPARATOR = exports.XEMA_PLATFORM_NAMESPACE = exports.AUTHORIZATION_BIOME_ID_PATTERN = void 0;
+exports.authorizationNamespaceRefusal = authorizationNamespaceRefusal;
+exports.deriveAuthorizationNamespace = deriveAuthorizationNamespace;
+exports.namespaceOfAuthorizationName = namespaceOfAuthorizationName;
+const zod_1 = require("zod");
+exports.AUTHORIZATION_BIOME_ID_PATTERN = /^[a-z][a-z0-9-]*$/;
+exports.XEMA_PLATFORM_NAMESPACE = 'xema';
+exports.AUTHORIZATION_NAMESPACE_SEPARATOR = '_';
+exports.OPENFGA_DSL_RESERVED_WORDS = Object.freeze([
+    'and',
+    'condition',
+    'define',
+    'extend',
+    'false',
+    'from',
+    'in',
+    'model',
+    'module',
+    'null',
+    'or',
+    'relation',
+    'relations',
+    'schema',
+    'true',
+    'type',
+    'with',
+]);
+var AuthorizationNamespaceRefusal;
+(function (AuthorizationNamespaceRefusal) {
+    AuthorizationNamespaceRefusal["Grammar"] = "grammar";
+    AuthorizationNamespaceRefusal["ReservedPlatformNamespace"] = "reserved_platform_namespace";
+    AuthorizationNamespaceRefusal["DslKeyword"] = "dsl_keyword";
+})(AuthorizationNamespaceRefusal || (exports.AuthorizationNamespaceRefusal = AuthorizationNamespaceRefusal = {}));
+class AuthorizationNamespaceError extends Error {
+    refusal;
+    biomeId;
+    constructor(refusal, biomeId) {
+        super(`biome id "${biomeId}" cannot be an authorization namespace (${refusal}): it must match \`[a-z][a-z0-9-]*\`, must not be the reserved \`${exports.XEMA_PLATFORM_NAMESPACE}\`, and must not be an OpenFGA DSL keyword.`);
+        this.name = 'AuthorizationNamespaceError';
+        this.refusal = refusal;
+        this.biomeId = biomeId;
+    }
+}
+exports.AuthorizationNamespaceError = AuthorizationNamespaceError;
+function authorizationNamespaceRefusal(biomeId) {
+    if (!exports.AUTHORIZATION_BIOME_ID_PATTERN.test(biomeId)) {
+        return AuthorizationNamespaceRefusal.Grammar;
+    }
+    if (biomeId === exports.XEMA_PLATFORM_NAMESPACE) {
+        return AuthorizationNamespaceRefusal.ReservedPlatformNamespace;
+    }
+    if (exports.OPENFGA_DSL_RESERVED_WORDS.includes(biomeId)) {
+        return AuthorizationNamespaceRefusal.DslKeyword;
+    }
+    return null;
+}
+exports.AuthorizationBiomeIdSchema = zod_1.z.string().superRefine((id, ctx) => {
+    const refusal = authorizationNamespaceRefusal(id);
+    if (refusal !== null) {
+        ctx.addIssue({
+            code: 'custom',
+            message: new AuthorizationNamespaceError(refusal, id).message,
+        });
+    }
+});
+function deriveAuthorizationNamespace(signedBiomeId) {
+    const refusal = authorizationNamespaceRefusal(signedBiomeId);
+    if (refusal !== null) {
+        throw new AuthorizationNamespaceError(refusal, signedBiomeId);
+    }
+    return {
+        moduleName: signedBiomeId,
+        prefix: `${signedBiomeId}${exports.AUTHORIZATION_NAMESPACE_SEPARATOR}`,
+    };
+}
+function namespaceOfAuthorizationName(name) {
+    const index = name.indexOf(exports.AUTHORIZATION_NAMESPACE_SEPARATOR);
+    return index <= 0 ? null : name.slice(0, index);
+}
+//# sourceMappingURL=authorization-namespace.js.map

package/dist/authorization-module/lib/authorization-namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-namespace.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/authorization-namespace.ts"],"names":[],"mappings":";;;AAsFA,sEAaC;AAgBD,oEAYC;AAMD,oEAGC;AAxID,6BAAwB;AAsBX,QAAA,8BAA8B,GAAG,mBAAmB,CAAC;AAGrD,QAAA,uBAAuB,GAAG,MAAM,CAAC;AAGjC,QAAA,iCAAiC,GAAG,GAAG,CAAC;AAaxC,QAAA,0BAA0B,GAAsB,MAAM,CAAC,MAAM,CAAC;IACzE,KAAK;IACL,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,MAAM;IACN,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,UAAU;IACV,WAAW;IACX,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAGH,IAAY,6BAOX;AAPD,WAAY,6BAA6B;IAEvC,oDAAmB,CAAA;IAEnB,0FAAyD,CAAA;IAEzD,2DAA0B,CAAA;AAC5B,CAAC,EAPW,6BAA6B,6CAA7B,6BAA6B,QAOxC;AAED,MAAa,2BAA4B,SAAQ,KAAK;IAC3C,OAAO,CAAgC;IACvC,OAAO,CAAS;IAEzB,YAAY,OAAsC,EAAE,OAAe;QACjE,KAAK,CACH,aAAa,OAAO,2CAA2C,OAAO,oEAAoE,+BAAuB,6CAA6C,CAC/M,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAZD,kEAYC;AAGD,SAAgB,6BAA6B,CAC3C,OAAe;IAEf,IAAI,CAAC,sCAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,OAAO,6BAA6B,CAAC,OAAO,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,KAAK,+BAAuB,EAAE,CAAC;QACxC,OAAO,6BAA6B,CAAC,yBAAyB,CAAC;IACjE,CAAC;IACD,IAAI,kCAA0B,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,6BAA6B,CAAC,UAAU,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAEY,QAAA,0BAA0B,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE;IAC3E,MAAM,OAAO,GAAG,6BAA6B,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,IAAI,2BAA2B,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO;SAC9D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAMH,SAAgB,4BAA4B,CAAC,aAAqB;IAIhE,MAAM,OAAO,GAAG,6BAA6B,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,2BAA2B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAChE,CAAC;IACD,OAAO;QACL,UAAU,EAAE,aAAa;QACzB,MAAM,EAAE,GAAG,aAAa,GAAG,yCAAiC,EAAE;KAC/D,CAAC;AACJ,CAAC;AAMD,SAAgB,4BAA4B,CAAC,IAAY;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,yCAAiC,CAAC,CAAC;IAC9D,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAClD,CAAC"}

package/dist/authorization-module/lib/platform-authorization-modules.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+export declare enum PlatformAuthorizationModule {
+    Core = "xema_core",
+    Capability = "xema_capability",
+    Sharing = "xema_sharing"
+}
+export declare const PlatformAuthorizationModuleSchema: z.ZodEnum<typeof PlatformAuthorizationModule>;
+export declare const XEMA_PARENT_TYPES_SLOT = "${XEMA_PARENT_TYPES}";
+export declare const XEMA_INHERITING_PLATFORM_TYPES: readonly ["project", "xema_artifact", "xema_session"];
+export declare enum XemaAuthorizationInterface {
+    Parent = "xema.parent"
+}
+export declare const XemaAuthorizationInterfaceSchema: z.ZodEnum<typeof XemaAuthorizationInterface>;
+export declare const XEMA_PARENT_INTERFACE_RELATIONS: readonly ["xema_read", "xema_write", "xema_admin"];
+export declare const XEMA_AUTHORIZATION_INTERFACE_RELATIONS: Readonly<Record<XemaAuthorizationInterface, readonly string[]>>;
+export declare const PLATFORM_AUTHORIZATION_EXPORTS: Readonly<Record<PlatformAuthorizationModule, Readonly<Record<string, readonly string[]>>>>;
+//# sourceMappingURL=platform-authorization-modules.d.ts.map

package/dist/authorization-module/lib/platform-authorization-modules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-authorization-modules.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuBxB,oBAAY,2BAA2B;IACrC,IAAI,cAAc;IAClB,UAAU,oBAAoB;IAC9B,OAAO,iBAAiB;CACzB;AAED,eAAO,MAAM,iCAAiC,+CAE7C,CAAC;AAQF,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAG7D,eAAO,MAAM,8BAA8B,uDAIhC,CAAC;AAUZ,oBAAY,0BAA0B;IACpC,MAAM,gBAAgB;CACvB;AAED,eAAO,MAAM,gCAAgC,8CAE5C,CAAC;AAEF,eAAO,MAAM,+BAA+B,oDAIjC,CAAC;AAGZ,eAAO,MAAM,sCAAsC,EAAE,QAAQ,CAC3D,MAAM,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC,CAGrD,CAAC;AAYH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CACnD,MAAM,CAAC,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC,CAehF,CAAC"}

package/dist/authorization-module/lib/platform-authorization-modules.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_AUTHORIZATION_EXPORTS = exports.XEMA_AUTHORIZATION_INTERFACE_RELATIONS = exports.XEMA_PARENT_INTERFACE_RELATIONS = exports.XemaAuthorizationInterfaceSchema = exports.XemaAuthorizationInterface = exports.XEMA_INHERITING_PLATFORM_TYPES = exports.XEMA_PARENT_TYPES_SLOT = exports.PlatformAuthorizationModuleSchema = exports.PlatformAuthorizationModule = void 0;
+const zod_1 = require("zod");
+var PlatformAuthorizationModule;
+(function (PlatformAuthorizationModule) {
+    PlatformAuthorizationModule["Core"] = "xema_core";
+    PlatformAuthorizationModule["Capability"] = "xema_capability";
+    PlatformAuthorizationModule["Sharing"] = "xema_sharing";
+})(PlatformAuthorizationModule || (exports.PlatformAuthorizationModule = PlatformAuthorizationModule = {}));
+exports.PlatformAuthorizationModuleSchema = zod_1.z.nativeEnum(PlatformAuthorizationModule);
+exports.XEMA_PARENT_TYPES_SLOT = '${XEMA_PARENT_TYPES}';
+exports.XEMA_INHERITING_PLATFORM_TYPES = Object.freeze([
+    'project',
+    'xema_artifact',
+    'xema_session',
+]);
+var XemaAuthorizationInterface;
+(function (XemaAuthorizationInterface) {
+    XemaAuthorizationInterface["Parent"] = "xema.parent";
+})(XemaAuthorizationInterface || (exports.XemaAuthorizationInterface = XemaAuthorizationInterface = {}));
+exports.XemaAuthorizationInterfaceSchema = zod_1.z.nativeEnum(XemaAuthorizationInterface);
+exports.XEMA_PARENT_INTERFACE_RELATIONS = Object.freeze([
+    'xema_read',
+    'xema_write',
+    'xema_admin',
+]);
+exports.XEMA_AUTHORIZATION_INTERFACE_RELATIONS = Object.freeze({
+    [XemaAuthorizationInterface.Parent]: exports.XEMA_PARENT_INTERFACE_RELATIONS,
+});
+exports.PLATFORM_AUTHORIZATION_EXPORTS = Object.freeze({
+    [PlatformAuthorizationModule.Core]: Object.freeze({
+        user: Object.freeze([]),
+        agent: Object.freeze([]),
+        service: Object.freeze([]),
+        runner: Object.freeze([]),
+        app: Object.freeze([]),
+        'external-subject': Object.freeze([]),
+        org: Object.freeze(['member', 'admin']),
+        team: Object.freeze(['member']),
+        role: Object.freeze(['assignee']),
+    }),
+    [PlatformAuthorizationModule.Capability]: Object.freeze({}),
+    [PlatformAuthorizationModule.Sharing]: Object.freeze({}),
+});
+//# sourceMappingURL=platform-authorization-modules.js.map

package/dist/authorization-module/lib/platform-authorization-modules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-authorization-modules.js","sourceRoot":"","sources":["../../../src/authorization-module/lib/platform-authorization-modules.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAuBxB,IAAY,2BAIX;AAJD,WAAY,2BAA2B;IACrC,iDAAkB,CAAA;IAClB,6DAA8B,CAAA;IAC9B,uDAAwB,CAAA;AAC1B,CAAC,EAJW,2BAA2B,2CAA3B,2BAA2B,QAItC;AAEY,QAAA,iCAAiC,GAAG,OAAC,CAAC,UAAU,CAC3D,2BAA2B,CAC5B,CAAC;AAQW,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAGhD,QAAA,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1D,SAAS;IACT,eAAe;IACf,cAAc;CACN,CAAC,CAAC;AAUZ,IAAY,0BAEX;AAFD,WAAY,0BAA0B;IACpC,oDAAsB,CAAA;AACxB,CAAC,EAFW,0BAA0B,0CAA1B,0BAA0B,QAErC;AAEY,QAAA,gCAAgC,GAAG,OAAC,CAAC,UAAU,CAC1D,0BAA0B,CAC3B,CAAC;AAEW,QAAA,+BAA+B,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,WAAW;IACX,YAAY;IACZ,YAAY;CACJ,CAAC,CAAC;AAGC,QAAA,sCAAsC,GAE/C,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,uCAA+B;CACrE,CAAC,CAAC;AAYU,QAAA,8BAA8B,GAEvC,MAAM,CAAC,MAAM,CAAC;IAChB,CAAC,2BAA2B,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;QAChD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;KAClC,CAAC;IACF,CAAC,2BAA2B,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3D,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;CACzD,CAAC,CAAC"}

package/dist/authorization-module/platform/xema_capability.fga

@@ -0,0 +1,23 @@
+module xema_capability
+
+# ═══════════════════════════════════════════════════════════════════════════
+# xema_capability — the capability VERB grants.
+#
+# An object is `capability:<encoded capability ref>|<encoded environment>`
+# (org-scoped grants prefix `<encoded org>|`; authorization-api builds the id).
+# `granted_to` admits the verb outright; `granted_pending_approval` admits it
+# only through the approval gate — the two are disjoint relations so a grant
+# is in exactly one of them.
+#
+# `user:*` on `granted_to` is the public-grant idiom: a PLATFORM-owned
+# wildcard, written only by authorization-api's grant door.
+#
+# Every request evaluates against the org's composed policy-set model, so
+# this module is part of EVERY composition — the verb verdict and the
+# instance relation are answered by one model.
+# ═══════════════════════════════════════════════════════════════════════════
+
+type capability
+  relations
+    define granted_to: [user, user:*, agent, app, service, runner, external-subject, role#assignee, team#member]
+    define granted_pending_approval: [user, agent, app, service, runner, external-subject, role#assignee, team#member]

package/dist/authorization-module/platform/xema_capability.fga.yaml

@@ -0,0 +1,108 @@
+# Standard OpenFGA tests (`fga model test`) for the xema_capability platform
+# module, run against the BASE composition. Ports the capability-grant
+# semantics authorization-api relies on: direct grants, team grants through
+# nested sub-teams, role grants through team-held assignments, the public
+# `user:*` grant, and the disjoint approval-gated relation.
+name: xema_capability
+model_file: ./fga.mod
+tuples:
+  # direct user grant
+  - user: user:alice
+    relation: granted_to
+    object: capability:kb~3adoc.read@1|default
+  # team grant, reached through a nested sub-team
+  - user: team:parent#member
+    relation: granted_to
+    object: capability:kb~3adoc.write@1|default
+  - user: team:child
+    relation: sub_team
+    object: team:parent
+  - user: user:bob
+    relation: direct_member
+    object: team:child
+  # role grant, held by a team's members
+  - user: role:editors#assignee
+    relation: granted_to
+    object: capability:kb~3adoc.publish@1|default
+  - user: team:child#member
+    relation: assignee
+    object: role:editors
+  # public grant
+  - user: user:*
+    relation: granted_to
+    object: capability:catalog~3aread@1|default
+  # approval-gated grant
+  - user: agent:a1
+    relation: granted_pending_approval
+    object: capability:mail~3asend@1|default
+  # service and runner subjects
+  - user: service:svc1
+    relation: granted_to
+    object: capability:kb~3adoc.read@1|default
+  - user: runner:r1
+    relation: granted_to
+    object: capability:runner~3anoop.echo@1|default
+tests:
+  - name: a direct grant admits only its subject
+    check:
+      - user: user:alice
+        object: capability:kb~3adoc.read@1|default
+        assertions:
+          granted_to: true
+      - user: user:bob
+        object: capability:kb~3adoc.read@1|default
+        assertions:
+          granted_to: false
+      - user: service:svc1
+        object: capability:kb~3adoc.read@1|default
+        assertions:
+          granted_to: true
+      - user: runner:r1
+        object: capability:runner~3anoop.echo@1|default
+        assertions:
+          granted_to: true
+  - name: a team grant reaches members of descendant teams
+    check:
+      - user: user:bob
+        object: capability:kb~3adoc.write@1|default
+        assertions:
+          granted_to: true
+      - user: user:alice
+        object: capability:kb~3adoc.write@1|default
+        assertions:
+          granted_to: false
+  - name: a role grant reaches the role's team-held assignees
+    check:
+      - user: user:bob
+        object: capability:kb~3adoc.publish@1|default
+        assertions:
+          granted_to: true
+      - user: user:alice
+        object: capability:kb~3adoc.publish@1|default
+        assertions:
+          granted_to: false
+  - name: the public grant admits every user and no other subject kind
+    check:
+      - user: user:anyone
+        object: capability:catalog~3aread@1|default
+        assertions:
+          granted_to: true
+      - user: agent:a1
+        object: capability:catalog~3aread@1|default
+        assertions:
+          granted_to: false
+  - name: approval-gated and granted are disjoint
+    check:
+      - user: agent:a1
+        object: capability:mail~3asend@1|default
+        assertions:
+          granted_pending_approval: true
+          granted_to: false
+    list_objects:
+      - user: user:bob
+        type: capability
+        assertions:
+          granted_to:
+            - capability:kb~3adoc.write@1|default
+            - capability:kb~3adoc.publish@1|default
+            - capability:catalog~3aread@1|default

package/dist/authorization-module/platform/xema_core.fga

@@ -0,0 +1,81 @@
+module xema_core
+
+# ═══════════════════════════════════════════════════════════════════════════
+# xema_core — the platform's principals, its tenancy types, and the platform
+# objects that INHERIT from biome objects.
+#
+# This file is a TEMPLATE. Each `${XEMA_PARENT_TYPES}` is filled by the
+# composer with the sorted list of biome types whose envelopes declare
+# `implements: ["xema.parent"]` (or removed, with its comma, when none does).
+# A biome contributes a type NAME to a list; it never contributes text here.
+#
+# DEFAULT DENY. Org membership grants nothing by itself: a relation that
+# admits org members says so (`org#member` as a direct subject type), and is
+# evaluated by READING a tuple. `org#admin` is never written: the Super User
+# reaches the PDP as a CONTEXTUAL tuple derived per request from the verified
+# token (D2).
+#
+# `org` implements `xema.parent` as the ROOT parent: an object parented by the
+# org (an org-level project, artifact or session) inherits only the org
+# admin's authority — never the members'.
+# ═══════════════════════════════════════════════════════════════════════════
+
+type user
+type agent
+type service
+type runner
+type app
+type external-subject
+
+type org
+  relations
+    define member: [user, agent, app, service]
+    define admin: [user]
+    define xema_admin: admin
+    define xema_write: admin
+    define xema_read: admin
+
+# Teams nest: `member` is the transitive closure over `sub_team`, so a grant to
+# `team:<id>#member` reaches every member of every descendant team.
+type team
+  relations
+    define parent: [org]
+    define sub_team: [team]
+    define admin: [user]
+    define direct_member: [user, agent, service, app, external-subject]
+    define member: direct_member or member from sub_team
+
+type role
+  relations
+    define parent: [org]
+    define assignee: [user, agent, service, app, team#member]
+
+type project
+  relations
+    define parent: [org, ${XEMA_PARENT_TYPES}]
+    define owner: [user, agent, service]
+    define admin: [user, agent, team#member, role#assignee]
+    define editor: [user, agent, team#member, role#assignee]
+    define viewer: [user, agent, team#member, role#assignee, org#member]
+    define xema_admin: owner or admin or xema_admin from parent
+    define xema_write: editor or xema_admin or xema_write from parent
+    define xema_read: viewer or xema_write or xema_read from parent
+
+type xema_session
+  relations
+    define parent: [org, project, ${XEMA_PARENT_TYPES}]
+    define owner: [user, agent]
+    define participant: [user, agent]
+    define xema_admin: owner or xema_admin from parent
+    define xema_write: owner or xema_write from parent
+    define xema_read: owner or participant or xema_read from parent
+    define can_read: xema_read
+    define can_write: xema_write
+
+type xema_artifact
+  relations
+    define parent: [org, project, xema_session, ${XEMA_PARENT_TYPES}]
+    define owner: [user, agent, service]
+    define can_delete: owner or xema_admin from parent
+    define can_write: owner or xema_write from parent
+    define can_read: owner or can_write or xema_read from parent