@xemahq/contracts 0.32.0 → 0.34.0

package/dist/authorization-module/platform/xema_core.fga.yaml

@@ -0,0 +1,123 @@
+# Standard OpenFGA tests (`fga model test`) for the xema_core platform module,
+# run against the BASE composition (no biome module installed, so every
+# parent slot is empty). `model_file` names the composed `fga.mod` the runner
+# writes beside this file.
+name: xema_core
+model_file: ./fga.mod
+tuples:
+  - user: org:org1
+    relation: parent
+    object: project:org1|p1
+  - user: user:bob
+    relation: viewer
+    object: project:org1|p1
+  - user: user:pat
+    relation: editor
+    object: project:org1|p1
+  - user: user:dave
+    relation: member
+    object: org:org1
+  - user: user:root
+    relation: admin
+    object: org:org1
+  - user: org:org2
+    relation: parent
+    object: xema_artifact:org2|a9
+  - user: project:org1|p1
+    relation: parent
+    object: xema_artifact:org1|a1
+  - user: org:org1
+    relation: parent
+    object: xema_artifact:org1|a2
+  - user: user:carol
+    relation: owner
+    object: xema_artifact:org1|a2
+  - user: project:org1|p1
+    relation: parent
+    object: xema_session:org1|s1
+  - user: user:erin
+    relation: participant
+    object: xema_session:org1|s1
+  - user: xema_session:org1|s1
+    relation: parent
+    object: xema_artifact:org1|a3
+tests:
+  - name: an artifact inherits from its project, never copied
+    check:
+      - user: user:bob
+        object: xema_artifact:org1|a1
+        assertions:
+          can_read: true
+          xema_read: true
+          can_write: false
+          can_delete: false
+      - user: user:pat
+        object: xema_artifact:org1|a1
+        assertions:
+          can_read: true
+          can_write: true
+          can_delete: false
+    list_objects:
+      - user: user:bob
+        type: xema_artifact
+        assertions:
+          can_read:
+            - xema_artifact:org1|a1
+            - xema_artifact:org1|a3
+  - name: org membership grants nothing by itself (default deny)
+    check:
+      - user: user:dave
+        object: xema_artifact:org1|a1
+        assertions:
+          can_read: false
+          xema_read: false
+      - user: user:dave
+        object: xema_artifact:org1|a2
+        assertions:
+          can_read: false
+      - user: user:dave
+        object: project:org1|p1
+        assertions:
+          xema_read: false
+  # The PDP supplies `org#admin` as a CONTEXTUAL tuple derived per request
+  # (D2); `fga model test` has no contextual tuples, so the fact is stated as
+  # a fixture tuple here — the model's semantics given the fact are the same.
+  - name: the org admin (Super User) reaches every object parented under the org
+    check:
+      - user: user:root
+        object: xema_artifact:org1|a1
+        assertions:
+          can_read: true
+          can_write: true
+          can_delete: true
+      - user: user:root
+        object: xema_artifact:org1|a3
+        assertions:
+          can_read: true
+      - user: user:root
+        object: xema_artifact:org2|a9
+        assertions:
+          can_read: false
+  - name: an org-parented object admits only its owner and the org admin
+    check:
+      - user: user:carol
+        object: xema_artifact:org1|a2
+        assertions:
+          can_read: true
+          can_delete: true
+      - user: user:bob
+        object: xema_artifact:org1|a2
+        assertions:
+          can_read: false
+  - name: a session participant reads the session's artifacts and writes none
+    check:
+      - user: user:erin
+        object: xema_artifact:org1|a3
+        assertions:
+          can_read: true
+          can_write: false
+      - user: user:bob
+        object: xema_artifact:org1|a3
+        assertions:
+          can_read: true
+          can_write: false

package/dist/authorization-module/platform/xema_sharing.fga

@@ -0,0 +1,138 @@
+module xema_sharing
+
+# ═══════════════════════════════════════════════════════════════════════════
+# xema_sharing — the first-party resource kinds as ordinary types.
+#
+# Replaces the generic `type resource` and its ordinal `shared_l1..l3` slots:
+# each kind is its own type, so its relation set is visible in the model.
+# The ladder is owner ⊂ manager ⊂ editor ⊂ viewer (each including the next).
+#
+# The three former visibility patterns become WHICH TUPLES EXIST:
+#   owner-only     — owner tuples only;
+#   org-shared     — an `org_viewer` tuple to `org:<id>#member`;
+#   explicit-share — named manager / editor / viewer tuples.
+# Nothing short-circuits: org-shared is a tuple, read and revocable.
+#
+# A share may EXPIRE: `xema_share_not_expired` is evaluated against
+# `current_time`, which the PDP supplies on every check — no sweeper.
+#
+# ONE READ VERB: every type defines `xema_read` (= `can_view`), the same verb
+# the inheriting `xema_core` types define, so the PDP asks one question for
+# "may read" whatever the kind. The composer refuses a platform resource type
+# without it.
+#
+# `project` is not here: it is an inheriting `xema_core` type and its
+# sharing relations (viewer/editor/admin) live there.
+# ═══════════════════════════════════════════════════════════════════════════
+
+type xema_document
+  relations
+    define owner: [user, agent, service, external-subject, team#member, role#assignee]
+    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define org_viewer: [org#member]
+    define can_manage: manager
+    define can_edit: editor
+    define can_view: viewer or org_viewer
+    define xema_read: can_view
+
+type xema_mailbox
+  relations
+    define owner: [user, agent, service, external-subject, team#member, role#assignee]
+    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define org_viewer: [org#member]
+    define can_manage: manager
+    define can_edit: editor
+    define can_view: viewer or org_viewer
+    define xema_read: can_view
+
+type xema_portal
+  relations
+    define owner: [user, agent, service, external-subject, team#member, role#assignee]
+    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define org_viewer: [org#member]
+    define can_manage: manager
+    define can_edit: editor
+    define can_view: viewer or org_viewer
+    define xema_read: can_view
+
+type xema_connector-migration
+  relations
+    define owner: [user, agent, service, external-subject, team#member, role#assignee]
+    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define org_viewer: [org#member]
+    define can_manage: manager
+    define can_edit: editor
+    define can_view: viewer or org_viewer
+    define xema_read: can_view
+
+type xema_store-listing
+  relations
+    define owner: [user, agent, service, external-subject, team#member, role#assignee]
+    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define org_viewer: [org#member]
+    define can_manage: manager
+    define can_edit: editor
+    define can_view: viewer or org_viewer
+    define xema_read: can_view
+
+type xema_biome-lifecycle-approval
+  relations
+    define owner: [user, agent, service, external-subject, team#member, role#assignee]
+    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define org_viewer: [org#member]
+    define can_manage: manager
+    define can_edit: editor
+    define can_view: viewer or org_viewer
+    define xema_read: can_view
+
+type xema_memory
+  relations
+    define owner: [user, agent, service, external-subject, team#member, role#assignee]
+    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define org_viewer: [org#member]
+    define can_manage: manager
+    define can_edit: editor
+    define can_view: viewer or org_viewer
+    define xema_read: can_view
+
+type xema_capability-grant
+  relations
+    define owner: [user, agent, service, external-subject, team#member, role#assignee]
+    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define org_viewer: [org#member]
+    define can_manage: manager
+    define can_edit: editor
+    define can_view: viewer or org_viewer
+    define xema_read: can_view
+
+type xema_output-route
+  relations
+    define owner: [user, agent, service, external-subject, team#member, role#assignee]
+    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define org_viewer: [org#member]
+    define can_manage: manager
+    define can_edit: editor
+    define can_view: viewer or org_viewer
+    define xema_read: can_view
+
+condition xema_share_not_expired(current_time: timestamp, expires_at: timestamp) {
+  current_time < expires_at
+}

package/dist/authorization-module/platform/xema_sharing.fga.yaml

@@ -0,0 +1,112 @@
+# Standard OpenFGA tests (`fga model test`) for the xema_sharing platform
+# module, run against the BASE composition.
+name: xema_sharing
+model_file: ./fga.mod
+tuples:
+  - user: user:alice
+    relation: owner
+    object: xema_document:org1|d1
+  - user: user:bob
+    relation: viewer
+    object: xema_document:org1|d1
+  - user: user:eve
+    relation: editor
+    object: xema_document:org1|d1
+    condition:
+      name: xema_share_not_expired
+      context:
+        expires_at: "2030-01-01T00:00:00Z"
+  - user: user:dave
+    relation: member
+    object: org:org1
+  - user: org:org1#member
+    relation: org_viewer
+    object: xema_document:org1|d2
+  - user: user:alice
+    relation: owner
+    object: xema_document:org1|d2
+  - user: user:olga
+    relation: owner
+    object: xema_output-route:org1|r1
+  - user: team:ops#member
+    relation: viewer
+    object: xema_output-route:org1|r1
+  - user: user:tom
+    relation: direct_member
+    object: team:ops
+tests:
+  - name: the ladder — each level includes the next
+    check:
+      - user: user:alice
+        object: xema_document:org1|d1
+        assertions:
+          can_manage: true
+          can_edit: true
+          can_view: true
+      - user: user:bob
+        object: xema_document:org1|d1
+        assertions:
+          can_manage: false
+          can_edit: false
+          can_view: true
+  - name: one read verb — xema_read answers exactly what can_view answers
+    check:
+      - user: user:bob
+        object: xema_document:org1|d1
+        assertions:
+          xema_read: true
+      - user: user:dave
+        object: xema_document:org1|d2
+        assertions:
+          xema_read: true
+      - user: user:dave
+        object: xema_document:org1|d1
+        assertions:
+          xema_read: false
+  - name: output routes share through the same ladder, team shares included
+    check:
+      - user: user:olga
+        object: xema_output-route:org1|r1
+        assertions:
+          can_manage: true
+          xema_read: true
+      - user: user:tom
+        object: xema_output-route:org1|r1
+        assertions:
+          xema_read: true
+          can_edit: false
+      - user: user:dave
+        object: xema_output-route:org1|r1
+        assertions:
+          xema_read: false
+    list_objects:
+      - user: user:tom
+        type: xema_output-route
+        assertions:
+          xema_read:
+            - xema_output-route:org1|r1
+  - name: a share expires in the authority, not by a sweeper
+    check:
+      - user: user:eve
+        object: xema_document:org1|d1
+        context:
+          current_time: "2029-12-31T23:59:59Z"
+        assertions:
+          can_edit: true
+      - user: user:eve
+        object: xema_document:org1|d1
+        context:
+          current_time: "2030-01-01T00:00:01Z"
+        assertions:
+          can_edit: false
+  - name: org-shared is a tuple, owner-only is the absence of one
+    check:
+      - user: user:dave
+        object: xema_document:org1|d2
+        assertions:
+          can_view: true
+          can_edit: false
+      - user: user:dave
+        object: xema_document:org1|d1
+        assertions:
+          can_view: false

package/dist/authorization-module/server/authorization-compatibility.d.ts

@@ -0,0 +1,16 @@
+import { type AuthorizationMigrationStep } from '../lib/authorization-module-envelope';
+import { type FgaAuthorizationModel } from './authorization-model-json';
+export interface AssignableSurfaceChange {
+    readonly step: AuthorizationMigrationStep;
+    readonly namespace: string | null;
+}
+export declare function diffAuthorizationAssignableSurface(adopted: FgaAuthorizationModel, next: FgaAuthorizationModel, namespaceOf: (type: string) => string | null): AssignableSurfaceChange[];
+export declare function migrationStepCovers(declared: AuthorizationMigrationStep, observed: AuthorizationMigrationStep): boolean;
+export interface AuthorizationForwardMigrationHook {
+    readonly namespace: string;
+    readonly fromModuleVersion: number;
+    readonly toModuleVersion: number;
+    readonly steps: readonly AuthorizationMigrationStep[];
+}
+export type AuthorizationForwardMigrationExecutor = (hook: AuthorizationForwardMigrationHook) => Promise<void>;
+//# sourceMappingURL=authorization-compatibility.d.ts.map

package/dist/authorization-module/server/authorization-compatibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-compatibility.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/server/authorization-compatibility.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,4BAA4B,CAAC;AAYpC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAE1C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAwBD,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,qBAAqB,EAC3B,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAC3C,uBAAuB,EAAE,CA4C3B;AAOD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,0BAA0B,EACpC,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAkCT;AASD,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,0BAA0B,EAAE,CAAC;CACvD;AAGD,MAAM,MAAM,qCAAqC,GAAG,CAClD,IAAI,EAAE,iCAAiC,KACpC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/authorization-module/server/authorization-compatibility.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diffAuthorizationAssignableSurface = diffAuthorizationAssignableSurface;
+exports.migrationStepCovers = migrationStepCovers;
+const authorization_module_envelope_1 = require("../lib/authorization-module-envelope");
+const authorization_model_json_1 = require("./authorization-model-json");
+function assignableSurface(model) {
+    const surface = new Map();
+    for (const typeDefinition of model.type_definitions) {
+        const relations = new Map();
+        for (const relation of Object.keys(typeDefinition.relations ?? {})) {
+            const refs = (0, authorization_model_json_1.directlyRelatedTypes)(typeDefinition, relation);
+            if (refs.length > 0) {
+                relations.set(relation, new Set(refs.map(authorization_model_json_1.formatRelationReference)));
+            }
+        }
+        surface.set(typeDefinition.type, relations);
+    }
+    return surface;
+}
+function diffAuthorizationAssignableSurface(adopted, next, namespaceOf) {
+    const before = assignableSurface(adopted);
+    const after = assignableSurface(next);
+    const changes = [];
+    for (const type of [...before.keys()].sort()) {
+        const namespace = namespaceOf(type);
+        const beforeRelations = before.get(type);
+        const afterRelations = after.get(type);
+        if (afterRelations === undefined) {
+            changes.push({
+                namespace,
+                step: { kind: authorization_module_envelope_1.AuthorizationMigrationStepKind.DropType, type },
+            });
+            continue;
+        }
+        for (const relation of [...beforeRelations.keys()].sort()) {
+            const was = beforeRelations.get(relation);
+            const now = afterRelations.get(relation);
+            if (now === undefined) {
+                changes.push({
+                    namespace,
+                    step: {
+                        kind: authorization_module_envelope_1.AuthorizationMigrationStepKind.DropRelation,
+                        type,
+                        relation,
+                    },
+                });
+                continue;
+            }
+            const removed = [...was].filter((entry) => !now.has(entry)).sort();
+            if (removed.length > 0) {
+                changes.push({
+                    namespace,
+                    step: {
+                        kind: authorization_module_envelope_1.AuthorizationMigrationStepKind.NarrowRestriction,
+                        type,
+                        relation,
+                        removed,
+                    },
+                });
+            }
+        }
+    }
+    return changes;
+}
+function migrationStepCovers(declared, observed) {
+    switch (observed.kind) {
+        case authorization_module_envelope_1.AuthorizationMigrationStepKind.DropType:
+            return ((declared.kind === authorization_module_envelope_1.AuthorizationMigrationStepKind.DropType &&
+                declared.type === observed.type) ||
+                (declared.kind === authorization_module_envelope_1.AuthorizationMigrationStepKind.RenameType &&
+                    declared.from === observed.type));
+        case authorization_module_envelope_1.AuthorizationMigrationStepKind.DropRelation:
+            return ((declared.kind === authorization_module_envelope_1.AuthorizationMigrationStepKind.DropRelation &&
+                declared.type === observed.type &&
+                declared.relation === observed.relation) ||
+                (declared.kind === authorization_module_envelope_1.AuthorizationMigrationStepKind.RenameRelation &&
+                    declared.type === observed.type &&
+                    declared.from === observed.relation) ||
+                (declared.kind === authorization_module_envelope_1.AuthorizationMigrationStepKind.DropType &&
+                    declared.type === observed.type) ||
+                (declared.kind === authorization_module_envelope_1.AuthorizationMigrationStepKind.RenameType &&
+                    declared.from === observed.type));
+        case authorization_module_envelope_1.AuthorizationMigrationStepKind.NarrowRestriction:
+            return (declared.kind === authorization_module_envelope_1.AuthorizationMigrationStepKind.NarrowRestriction &&
+                declared.type === observed.type &&
+                declared.relation === observed.relation &&
+                observed.removed.every((entry) => declared.removed.includes(entry)));
+        case authorization_module_envelope_1.AuthorizationMigrationStepKind.RenameType:
+        case authorization_module_envelope_1.AuthorizationMigrationStepKind.RenameRelation:
+            return false;
+    }
+}
+//# sourceMappingURL=authorization-compatibility.js.map

package/dist/authorization-module/server/authorization-compatibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-compatibility.js","sourceRoot":"","sources":["../../../src/authorization-module/server/authorization-compatibility.ts"],"names":[],"mappings":";;AAiDA,gFAgDC;AAOD,kDAqCC;AA7ID,wFAG8C;AAE9C,yEAIoC;AAkBpC,SAAS,iBAAiB,CACxB,KAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC5D,KAAK,MAAM,cAAc,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;QACjD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,GAAG,IAAA,+CAAoB,EAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,kDAAuB,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD,SAAgB,kCAAkC,CAChD,OAA8B,EAC9B,IAA2B,EAC3B,WAA4C;IAE5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAA6B,CAAC;QACrE,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC;gBACX,SAAS;gBACT,IAAI,EAAE,EAAE,IAAI,EAAE,8DAA8B,CAAC,QAAQ,EAAE,IAAI,EAAE;aAC9D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1D,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAgB,CAAC;YACzD,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,CAAC,IAAI,CAAC;oBACX,SAAS;oBACT,IAAI,EAAE;wBACJ,IAAI,EAAE,8DAA8B,CAAC,YAAY;wBACjD,IAAI;wBACJ,QAAQ;qBACT;iBACF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC;oBACX,SAAS;oBACT,IAAI,EAAE;wBACJ,IAAI,EAAE,8DAA8B,CAAC,iBAAiB;wBACtD,IAAI;wBACJ,QAAQ;wBACR,OAAO;qBACR;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD,SAAgB,mBAAmB,CACjC,QAAoC,EACpC,QAAoC;IAEpC,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,8DAA8B,CAAC,QAAQ;YAC1C,OAAO,CACL,CAAC,QAAQ,CAAC,IAAI,KAAK,8DAA8B,CAAC,QAAQ;gBACxD,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC;gBAClC,CAAC,QAAQ,CAAC,IAAI,KAAK,8DAA8B,CAAC,UAAU;oBAC1D,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,CACnC,CAAC;QACJ,KAAK,8DAA8B,CAAC,YAAY;YAC9C,OAAO,CACL,CAAC,QAAQ,CAAC,IAAI,KAAK,8DAA8B,CAAC,YAAY;gBAC5D,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;gBAC/B,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAC;gBAC1C,CAAC,QAAQ,CAAC,IAAI,KAAK,8DAA8B,CAAC,cAAc;oBAC9D,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;oBAC/B,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC;gBACtC,CAAC,QAAQ,CAAC,IAAI,KAAK,8DAA8B,CAAC,QAAQ;oBACxD,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC;gBAClC,CAAC,QAAQ,CAAC,IAAI,KAAK,8DAA8B,CAAC,UAAU;oBAC1D,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,CACnC,CAAC;QACJ,KAAK,8DAA8B,CAAC,iBAAiB;YACnD,OAAO,CACL,QAAQ,CAAC,IAAI,KAAK,8DAA8B,CAAC,iBAAiB;gBAClE,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;gBAC/B,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;gBACvC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACpE,CAAC;QACJ,KAAK,8DAA8B,CAAC,UAAU,CAAC;QAC/C,KAAK,8DAA8B,CAAC,cAAc;YAEhD,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/authorization-module/server/authorization-model-json.d.ts

@@ -0,0 +1,65 @@
+export interface FgaSourceInfo {
+    readonly file?: string;
+}
+export interface FgaRelationReference {
+    readonly type: string;
+    readonly relation?: string;
+    readonly wildcard?: Record<string, never>;
+    readonly condition?: string;
+}
+export interface FgaRelationMetadata {
+    readonly directly_related_user_types?: readonly FgaRelationReference[];
+    readonly module?: string;
+    readonly source_info?: FgaSourceInfo;
+}
+export interface FgaUserset {
+    readonly this?: Record<string, never>;
+    readonly computedUserset?: {
+        readonly relation?: string;
+    };
+    readonly tupleToUserset?: {
+        readonly tupleset: {
+            readonly relation?: string;
+        };
+        readonly computedUserset: {
+            readonly relation?: string;
+        };
+    };
+    readonly union?: {
+        readonly child: readonly FgaUserset[];
+    };
+    readonly intersection?: {
+        readonly child: readonly FgaUserset[];
+    };
+    readonly difference?: {
+        readonly base: FgaUserset;
+        readonly subtract: FgaUserset;
+    };
+}
+export interface FgaTypeDefinition {
+    readonly type: string;
+    readonly relations?: Readonly<Record<string, FgaUserset>>;
+    readonly metadata?: {
+        readonly relations?: Readonly<Record<string, FgaRelationMetadata>>;
+        readonly module?: string;
+        readonly source_info?: FgaSourceInfo;
+    } | null;
+}
+export interface FgaCondition {
+    readonly name: string;
+    readonly expression: string;
+    readonly parameters?: Readonly<Record<string, unknown>>;
+    readonly metadata?: {
+        readonly module?: string;
+        readonly source_info?: FgaSourceInfo;
+    };
+}
+export interface FgaAuthorizationModel {
+    readonly schema_version: string;
+    readonly type_definitions: readonly FgaTypeDefinition[];
+    readonly conditions?: Readonly<Record<string, FgaCondition>>;
+}
+export declare const FGA_MODULAR_SCHEMA_VERSION = "1.2";
+export declare function directlyRelatedTypes(typeDefinition: FgaTypeDefinition, relation: string): readonly FgaRelationReference[];
+export declare function formatRelationReference(ref: FgaRelationReference): string;
+//# sourceMappingURL=authorization-model-json.d.ts.map

package/dist/authorization-module/server/authorization-model-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-model-json.d.ts","sourceRoot":"","sources":["../../../src/authorization-module/server/authorization-model-json.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;CACtC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,QAAQ,CAAC,cAAc,CAAC,EAAE;QACxB,QAAQ,CAAC,QAAQ,EAAE;YAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAClD,QAAQ,CAAC,eAAe,EAAE;YAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC1D,CAAC;IACF,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAA;KAAE,CAAC;IAC3D,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;KAC/B,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;KACtC,GAAG,IAAI,CAAC;CACV;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;KACtC,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACxD,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;CAC9D;AAGD,eAAO,MAAM,0BAA0B,QAAQ,CAAC;AAMhD,wBAAgB,oBAAoB,CAClC,cAAc,EAAE,iBAAiB,EACjC,QAAQ,EAAE,MAAM,GACf,SAAS,oBAAoB,EAAE,CAKjC;AAGD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,oBAAoB,GAAG,MAAM,CAUzE"}

package/dist/authorization-module/server/authorization-model-json.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FGA_MODULAR_SCHEMA_VERSION = void 0;
+exports.directlyRelatedTypes = directlyRelatedTypes;
+exports.formatRelationReference = formatRelationReference;
+exports.FGA_MODULAR_SCHEMA_VERSION = '1.2';
+function directlyRelatedTypes(typeDefinition, relation) {
+    return (typeDefinition.metadata?.relations?.[relation]
+        ?.directly_related_user_types ?? []);
+}
+function formatRelationReference(ref) {
+    const base = ref.wildcard !== undefined
+        ? `${ref.type}:*`
+        : ref.relation !== undefined
+            ? `${ref.type}#${ref.relation}`
+            : ref.type;
+    return ref.condition !== undefined && ref.condition !== ''
+        ? `${base} with ${ref.condition}`
+        : base;
+}
+//# sourceMappingURL=authorization-model-json.js.map

package/dist/authorization-module/server/authorization-model-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-model-json.js","sourceRoot":"","sources":["../../../src/authorization-module/server/authorization-model-json.ts"],"names":[],"mappings":";;;AAwEA,oDAQC;AAGD,0DAUC;AA3BY,QAAA,0BAA0B,GAAG,KAAK,CAAC;AAMhD,SAAgB,oBAAoB,CAClC,cAAiC,EACjC,QAAgB;IAEhB,OAAO,CACL,cAAc,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC;QAC5C,EAAE,2BAA2B,IAAI,EAAE,CACtC,CAAC;AACJ,CAAC;AAGD,SAAgB,uBAAuB,CAAC,GAAyB;IAC/D,MAAM,IAAI,GACR,GAAG,CAAC,QAAQ,KAAK,SAAS;QACxB,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI;QACjB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS;YAC1B,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,EAAE;YAC/B,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACjB,OAAO,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,EAAE;QACxD,CAAC,CAAC,GAAG,IAAI,SAAS,GAAG,CAAC,SAAS,EAAE;QACjC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC"}

package/dist/authorization-module/server/compose-authorization-base.d.ts

@@ -0,0 +1,67 @@
+import { type AssignableSurfaceChange, type AuthorizationForwardMigrationHook } from './authorization-compatibility';
+import { type FgaAuthorizationModel } from './authorization-model-json';
+import { type PlatformAuthorizationModuleFiles } from './platform-module-files';
+export interface AuthorizationModuleInput {
+    readonly signedBiomeId: string;
+    readonly signedBiomeVersion: string;
+    readonly manifest: unknown;
+}
+export declare function authorizationModuleInputFromContribution(contribution: {
+    readonly owner: {
+        readonly id: string;
+        readonly version: string;
+    };
+    readonly manifest: unknown;
+}): AuthorizationModuleInput;
+export interface AdoptedAuthorizationModule {
+    readonly moduleVersion: number;
+    readonly contentHash: string;
+}
+export interface AdoptedAuthorizationBase {
+    readonly model: FgaAuthorizationModel;
+    readonly modules: Readonly<Record<string, AdoptedAuthorizationModule>>;
+}
+export interface AuthorizationCompositionBudgets {
+    readonly maxModelBytes: number;
+    readonly maxTypeDefinitions: number;
+}
+export declare const DEFAULT_AUTHORIZATION_COMPOSITION_BUDGETS: AuthorizationCompositionBudgets;
+export interface AuthorizationCompositionGovernance {
+    readonly admitUnconditionedPublicWildcards: boolean;
+}
+export declare const DEFAULT_AUTHORIZATION_COMPOSITION_GOVERNANCE: AuthorizationCompositionGovernance;
+export interface ComposeAuthorizationBaseInput {
+    readonly modules: readonly AuthorizationModuleInput[];
+    readonly currentPlatformGeneration: string;
+    readonly adopted?: AdoptedAuthorizationBase;
+    readonly governance?: AuthorizationCompositionGovernance;
+    readonly budgets?: Partial<AuthorizationCompositionBudgets>;
+    readonly platformModules?: readonly PlatformAuthorizationModuleFiles[];
+}
+export interface ComposedFile {
+    readonly name: string;
+    readonly contents: string;
+}
+export interface ComposedAuthorizationModule {
+    readonly namespace: string;
+    readonly moduleVersion: number;
+    readonly contentHash: string;
+    readonly signedBiomeVersion: string;
+}
+export interface ComposedAuthorizationBase {
+    readonly model: FgaAuthorizationModel;
+    readonly modelHash: string;
+    readonly modelBytes: number;
+    readonly files: readonly ComposedFile[];
+    readonly testFiles: readonly (ComposedFile & {
+        readonly owner: string;
+    })[];
+    readonly modules: readonly ComposedAuthorizationModule[];
+    readonly parentImplementers: readonly string[];
+    readonly platformSurfaceChanges: readonly AssignableSurfaceChange[];
+    readonly removedNamespaces: readonly string[];
+    readonly migrationHooks: readonly AuthorizationForwardMigrationHook[];
+}
+export declare const FGA_MOD_FILE_NAME = "fga.mod";
+export declare function composeAuthorizationBase(input: ComposeAuthorizationBaseInput): ComposedAuthorizationBase;
+//# sourceMappingURL=compose-authorization-base.d.ts.map