@echovisionlab/geul-proto 0.1.0

package/gen/api/policy/v1/spicedb/file.ts

@@ -0,0 +1,49 @@
+// Code generated by scripts/generated/generate-spicedb-catalog.mjs.
+// DO NOT EDIT.
+//
+// Domain: file — File resource policy
+
+import {
+  accountIdentityRelationshipSubject,
+  createCan,
+  createRelationshipMutation,
+  createRelationshipSnapshotPlan,
+  createResource,
+  platformRelationshipSubject,
+  RelationshipOperation,
+  resourceRelationshipSubject,
+} from "./internal.ts";
+import type {
+  Actor,
+  Can,
+  RelationshipMutation,
+  RelationshipSnapshotPlan,
+  Resource,
+} from "./internal.ts";
+
+export const File = Object.freeze({
+  Resource: (id: string): Resource => createResource("file", id),
+  View: (id: string): Can => createCan("file", id, "view", "view"),
+  Edit: (id: string): Can => createCan("file", id, "edit", "edit"),
+  Delete: (id: string): Can => createCan("file", id, "delete", "delete"),
+  Manage: (id: string): Can => createCan("file", id, "manage", "manage"),
+  ManageLibrary: (): Can =>
+    createCan("platform", "global", "file.manage_library", "is_admin"),
+  List: (): Can => createCan("platform", "global", "file.list", "is_author"),
+  Snapshot: (id: string): RelationshipSnapshotPlan =>
+    createRelationshipSnapshotPlan("file", id, "platform_admin", ""),
+  TouchPolicy: (id: string): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("file", id),
+      "policy",
+      platformRelationshipSubject(),
+      RelationshipOperation.Touch,
+    ),
+  DeletePolicy: (id: string): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("file", id),
+      "policy",
+      platformRelationshipSubject(),
+      RelationshipOperation.Delete,
+    ),
+});

package/gen/api/policy/v1/spicedb/form.ts

@@ -0,0 +1,54 @@
+// Code generated by scripts/generated/generate-spicedb-catalog.mjs.
+// DO NOT EDIT.
+//
+// Domain: form — Form lifecycle and share-link policy
+
+import {
+  accountIdentityRelationshipSubject,
+  createCan,
+  createRelationshipMutation,
+  createRelationshipSnapshotPlan,
+  createResource,
+  createResourceLookup,
+  platformRelationshipSubject,
+  RelationshipOperation,
+  resourceRelationshipSubject,
+} from "./internal.ts";
+import type {
+  Actor,
+  Can,
+  RelationshipMutation,
+  RelationshipSnapshotPlan,
+  Resource,
+  ResourceLookup,
+} from "./internal.ts";
+
+export const Form = Object.freeze({
+  Resource: (id: string): Resource => createResource("form", id),
+  LookupManage: (): ResourceLookup => createResourceLookup("form", "manage"),
+  View: (id: string): Can => createCan("form", id, "view", "view"),
+  Edit: (id: string): Can => createCan("form", id, "edit", "edit"),
+  Delete: (id: string): Can => createCan("form", id, "delete", "delete"),
+  Publish: (id: string): Can => createCan("form", id, "publish", "publish"),
+  Manage: (id: string): Can => createCan("form", id, "manage", "manage"),
+  ManageShareLinks: (id: string): Can =>
+    createCan("form", id, "manage_share_links", "manage_share_links"),
+  Create: (): Can => createCan("platform", "global", "form.create", "is_admin"),
+  List: (): Can => createCan("platform", "global", "form.list", "is_admin"),
+  Snapshot: (id: string): RelationshipSnapshotPlan =>
+    createRelationshipSnapshotPlan("form", id, "platform_admin", ""),
+  TouchPolicy: (id: string): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("form", id),
+      "policy",
+      platformRelationshipSubject(),
+      RelationshipOperation.Touch,
+    ),
+  DeletePolicy: (id: string): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("form", id),
+      "policy",
+      platformRelationshipSubject(),
+      RelationshipOperation.Delete,
+    ),
+});

package/gen/api/policy/v1/spicedb/internal.ts

@@ -0,0 +1,350 @@
+// Code generated by scripts/generated/generate-spicedb-catalog.mjs.
+// DO NOT EDIT.
+// This implementation module is intentionally absent from package exports.
+
+export const DelegationKind = Object.freeze({
+  DirectSession: "direct_session",
+  MCPOAuth: "mcp_oauth",
+} as const);
+export type DelegationKind =
+  (typeof DelegationKind)[keyof typeof DelegationKind];
+
+export const RelationshipOperation = Object.freeze({
+  Touch: "touch",
+  Delete: "delete",
+} as const);
+export type RelationshipOperation =
+  (typeof RelationshipOperation)[keyof typeof RelationshipOperation];
+
+class ActorDescriptor {
+  readonly #actorBrand = undefined;
+
+  constructor(readonly accountIdentityId: string) {}
+}
+
+class DelegationDescriptor {
+  readonly #delegationBrand = undefined;
+
+  constructor(
+    readonly kind: DelegationKind,
+    readonly sessionId?: string,
+    readonly delegationId?: string,
+    readonly delegationDisplayName?: string,
+  ) {}
+}
+
+class ResourceDescriptor {
+  readonly #resourceBrand = undefined;
+
+  constructor(
+    readonly type: string,
+    readonly id: string,
+  ) {}
+}
+
+class ResourceLookupDescriptor {
+  readonly #resourceLookupBrand = undefined;
+
+  constructor(
+    readonly resourceType: string,
+    readonly permission: string,
+  ) {}
+}
+
+class SubjectLookupDescriptor {
+  readonly #subjectLookupBrand = undefined;
+
+  constructor(
+    readonly resourceType: string,
+    readonly resourceId: string,
+    readonly permission: string,
+    readonly subjectType: string,
+  ) {}
+}
+
+class ActionDescriptor {
+  readonly #actionBrand = undefined;
+
+  constructor(
+    readonly name: string,
+    readonly permission: string,
+  ) {}
+}
+
+class CanDescriptor {
+  readonly #canBrand = undefined;
+  readonly engineKey: string;
+
+  constructor(
+    readonly resource: ResourceDescriptor,
+    readonly action: ActionDescriptor,
+  ) {
+    this.engineKey = `${resource.type}\0${resource.id}\0${action.permission}`;
+  }
+}
+
+class AuthorizationDecisionDescriptor {
+  readonly #decisionBrand = undefined;
+  readonly resource: ResourceDescriptor;
+  readonly action: ActionDescriptor;
+  readonly engineKey: string;
+
+  constructor(
+    readonly actor: ActorDescriptor,
+    readonly delegation: DelegationDescriptor,
+    can: CanDescriptor,
+  ) {
+    this.resource = can.resource;
+    this.action = can.action;
+    this.engineKey = can.engineKey;
+  }
+}
+
+class RoleIDDescriptor {
+  readonly #roleBrand = undefined;
+
+  constructor(readonly id: string) {}
+}
+
+class RelationshipSubjectDescriptor {
+  readonly #relationshipSubjectBrand = undefined;
+
+  constructor(
+    readonly type: string,
+    readonly id: string,
+    readonly relation: string,
+  ) {}
+}
+
+class RelationshipMutationDescriptor {
+  readonly #relationshipBrand = undefined;
+
+  constructor(
+    readonly resource: ResourceDescriptor,
+    readonly relation: string,
+    readonly subject: RelationshipSubjectDescriptor,
+    readonly operation: RelationshipOperation,
+  ) {}
+}
+
+class RelationshipSnapshotPlanDescriptor {
+  readonly #relationshipSnapshotPlanBrand = undefined;
+
+  constructor(
+    readonly resource: ResourceDescriptor,
+    readonly probePermission: string,
+    readonly incomingParentRelation: string,
+  ) {}
+}
+
+export type Actor = ActorDescriptor;
+export type Delegation = DelegationDescriptor;
+export type Resource = ResourceDescriptor;
+export type ResourceLookup = ResourceLookupDescriptor;
+export type SubjectLookup = SubjectLookupDescriptor;
+export type Action = ActionDescriptor;
+export type Can = CanDescriptor;
+export type AuthorizationDecision = AuthorizationDecisionDescriptor;
+export type RoleID = RoleIDDescriptor;
+type RelationshipSubject = RelationshipSubjectDescriptor;
+export type RelationshipMutation = RelationshipMutationDescriptor;
+export type RelationshipSnapshotPlan = RelationshipSnapshotPlanDescriptor;
+
+function immutable<T extends object>(value: T): T {
+  Object.freeze(value);
+  return value;
+}
+
+function assertIdentifier(kind: string, value: string): void {
+  if (value.length === 0 || value.trim() !== value) {
+    throw new TypeError(`${kind} must be non-empty and trimmed`);
+  }
+}
+
+export function createActor(accountIdentityId: string): Actor {
+  assertIdentifier("account identity id", accountIdentityId);
+  return immutable(new ActorDescriptor(accountIdentityId));
+}
+
+export function createDelegation(
+  kind: DelegationKind,
+  values: {
+    readonly sessionId?: string;
+    readonly delegationId?: string;
+    readonly delegationDisplayName?: string;
+  },
+): Delegation {
+  if (kind === DelegationKind.DirectSession) {
+    assertIdentifier("session id", values.sessionId ?? "");
+    if (
+      values.delegationId !== undefined ||
+      values.delegationDisplayName !== undefined
+    ) {
+      throw new TypeError(
+        "direct session delegation cannot carry MCP attribution",
+      );
+    }
+  } else if (kind === DelegationKind.MCPOAuth) {
+    assertIdentifier("delegation id", values.delegationId ?? "");
+    assertIdentifier(
+      "delegation display name",
+      values.delegationDisplayName ?? "",
+    );
+    if (values.sessionId !== undefined) {
+      throw new TypeError("MCP delegation cannot carry a session id");
+    }
+  } else {
+    throw new TypeError("delegation kind is invalid");
+  }
+  return immutable(
+    new DelegationDescriptor(
+      kind,
+      values.sessionId,
+      values.delegationId,
+      values.delegationDisplayName,
+    ),
+  );
+}
+
+export function createResource(type: string, id: string): Resource {
+  assertIdentifier("resource type", type);
+  assertIdentifier("resource id", id);
+  return immutable(new ResourceDescriptor(type, id));
+}
+
+export function createResourceLookup(
+  resourceType: string,
+  permission: string,
+): ResourceLookup {
+  assertIdentifier("resource type", resourceType);
+  assertIdentifier("permission", permission);
+  return immutable(new ResourceLookupDescriptor(resourceType, permission));
+}
+
+export function createRelationshipSnapshotPlan(
+  resourceType: string,
+  resourceId: string,
+  probePermission: string,
+  incomingParentRelation: string,
+): RelationshipSnapshotPlan {
+  assertIdentifier("probe permission", probePermission);
+  if (incomingParentRelation.trim() !== incomingParentRelation) {
+    throw new TypeError("incoming parent relation must be trimmed");
+  }
+  return immutable(
+    new RelationshipSnapshotPlanDescriptor(
+      createResource(resourceType, resourceId),
+      probePermission,
+      incomingParentRelation,
+    ),
+  );
+}
+
+export function createSubjectLookup(
+  resourceType: string,
+  resourceId: string,
+  permission: string,
+  subjectType: string,
+): SubjectLookup {
+  assertIdentifier("resource type", resourceType);
+  assertIdentifier("resource id", resourceId);
+  assertIdentifier("permission", permission);
+  assertIdentifier("subject type", subjectType);
+  return immutable(
+    new SubjectLookupDescriptor(
+      resourceType,
+      resourceId,
+      permission,
+      subjectType,
+    ),
+  );
+}
+
+export function createCan(
+  resourceType: string,
+  resourceId: string,
+  actionName: string,
+  permission: string,
+): Can {
+  const resource = createResource(resourceType, resourceId);
+  assertIdentifier("action", actionName);
+  assertIdentifier("permission", permission);
+  const action = immutable(new ActionDescriptor(actionName, permission));
+  return immutable(new CanDescriptor(resource, action));
+}
+
+export function createDecision(
+  actor: Actor,
+  delegation: Delegation,
+  can: Can,
+): AuthorizationDecision {
+  if (
+    !(actor instanceof ActorDescriptor) ||
+    !(delegation instanceof DelegationDescriptor) ||
+    !(can instanceof CanDescriptor)
+  ) {
+    throw new TypeError(
+      "actor, delegation, and can must use supported constructors",
+    );
+  }
+  return immutable(new AuthorizationDecisionDescriptor(actor, delegation, can));
+}
+
+export function createRole(id: string): RoleID {
+  assertIdentifier("role id", id);
+  return immutable(new RoleIDDescriptor(id));
+}
+
+export function accountIdentityRelationshipSubject(
+  actor: Actor,
+): RelationshipSubject {
+  if (!(actor instanceof ActorDescriptor)) {
+    throw new TypeError("actor must use NewAccountIdentityActor");
+  }
+  return immutable(
+    new RelationshipSubjectDescriptor(
+      "account_identity",
+      actor.accountIdentityId,
+      "",
+    ),
+  );
+}
+
+export function platformRelationshipSubject(): RelationshipSubject {
+  return immutable(new RelationshipSubjectDescriptor("platform", "global", ""));
+}
+
+export function resourceRelationshipSubject(
+  type: string,
+  id: string,
+  relation: string,
+): RelationshipSubject {
+  const resource = createResource(type, id);
+  return immutable(
+    new RelationshipSubjectDescriptor(resource.type, resource.id, relation),
+  );
+}
+
+export function createRelationshipMutation(
+  resource: Resource,
+  relation: string,
+  subject: RelationshipSubject,
+  operation: RelationshipOperation,
+): RelationshipMutation {
+  if (!(resource instanceof ResourceDescriptor)) {
+    throw new TypeError("resource must use a domain constructor");
+  }
+  if (!(subject instanceof RelationshipSubjectDescriptor)) {
+    throw new TypeError("relationship subject must use a domain constructor");
+  }
+  if (
+    operation !== RelationshipOperation.Touch &&
+    operation !== RelationshipOperation.Delete
+  ) {
+    throw new TypeError("relationship operation is invalid");
+  }
+  assertIdentifier("relation", relation);
+  return immutable(
+    new RelationshipMutationDescriptor(resource, relation, subject, operation),
+  );
+}

package/gen/api/policy/v1/spicedb/label.ts

@@ -0,0 +1,98 @@
+// Code generated by scripts/generated/generate-spicedb-catalog.mjs.
+// DO NOT EDIT.
+//
+// Domain: label — Label ownership, management, hierarchy, and share links
+
+import {
+  accountIdentityRelationshipSubject,
+  createCan,
+  createRelationshipMutation,
+  createRelationshipSnapshotPlan,
+  createResource,
+  platformRelationshipSubject,
+  RelationshipOperation,
+  resourceRelationshipSubject,
+} from "./internal.ts";
+import type {
+  Actor,
+  Can,
+  RelationshipMutation,
+  RelationshipSnapshotPlan,
+  Resource,
+} from "./internal.ts";
+
+export const Label = Object.freeze({
+  Resource: (id: string): Resource => createResource("label", id),
+  Edit: (id: string): Can => createCan("label", id, "edit", "edit"),
+  View: (id: string): Can => createCan("label", id, "view", "view"),
+  Delete: (id: string): Can => createCan("label", id, "delete", "delete"),
+  Publish: (id: string): Can => createCan("label", id, "publish", "publish"),
+  Manage: (id: string): Can => createCan("label", id, "manage", "manage"),
+  ManageParticipants: (id: string): Can =>
+    createCan("label", id, "manage_participants", "manage_participants"),
+  ManageShareLinks: (id: string): Can =>
+    createCan("label", id, "manage_share_links", "manage_share_links"),
+  RemoveOwner: (id: string): Can =>
+    createCan("label", id, "remove_owner", "platform_admin"),
+  Create: (): Can =>
+    createCan("platform", "global", "label.create", "is_admin"),
+  List: (): Can => createCan("platform", "global", "label.list", "is_admin"),
+  Snapshot: (id: string): RelationshipSnapshotPlan =>
+    createRelationshipSnapshotPlan("label", id, "platform_admin", "parent"),
+  TouchPolicy: (id: string): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("label", id),
+      "policy",
+      platformRelationshipSubject(),
+      RelationshipOperation.Touch,
+    ),
+  DeletePolicy: (id: string): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("label", id),
+      "policy",
+      platformRelationshipSubject(),
+      RelationshipOperation.Delete,
+    ),
+  TouchOwner: (id: string, actor: Actor): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("label", id),
+      "owner",
+      accountIdentityRelationshipSubject(actor),
+      RelationshipOperation.Touch,
+    ),
+  DeleteOwner: (id: string, actor: Actor): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("label", id),
+      "owner",
+      accountIdentityRelationshipSubject(actor),
+      RelationshipOperation.Delete,
+    ),
+  TouchManager: (id: string, actor: Actor): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("label", id),
+      "manager",
+      accountIdentityRelationshipSubject(actor),
+      RelationshipOperation.Touch,
+    ),
+  DeleteManager: (id: string, actor: Actor): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("label", id),
+      "manager",
+      accountIdentityRelationshipSubject(actor),
+      RelationshipOperation.Delete,
+    ),
+  TouchParent: (id: string, parentId: string): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("label", id),
+      "parent",
+      resourceRelationshipSubject("label", parentId, ""),
+      RelationshipOperation.Touch,
+    ),
+  DeleteParent: (id: string, parentId: string): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("label", id),
+      "parent",
+      resourceRelationshipSubject("label", parentId, ""),
+      RelationshipOperation.Delete,
+    ),
+});

package/gen/api/policy/v1/spicedb/legal_policy.ts

@@ -0,0 +1,103 @@
+// Code generated by scripts/generated/generate-spicedb-catalog.mjs.
+// DO NOT EDIT.
+//
+// Domain: legal_policy — Terms and Privacy history policy
+
+import {
+  accountIdentityRelationshipSubject,
+  createCan,
+  createRelationshipMutation,
+  createRelationshipSnapshotPlan,
+  createResource,
+  platformRelationshipSubject,
+  RelationshipOperation,
+  resourceRelationshipSubject,
+} from "./internal.ts";
+import type {
+  Actor,
+  Can,
+  RelationshipMutation,
+  RelationshipSnapshotPlan,
+  Resource,
+} from "./internal.ts";
+
+export const TermsHistory = Object.freeze({
+  Resource: (id: string): Resource => createResource("terms_history", id),
+  View: (id: string): Can => createCan("terms_history", id, "view", "view"),
+  Edit: (id: string): Can => createCan("terms_history", id, "edit", "edit"),
+  ViewArchived: (id: string): Can =>
+    createCan("terms_history", id, "view_archived", "view_archived"),
+  EditArchived: (id: string): Can =>
+    createCan("terms_history", id, "edit_archived", "edit_archived"),
+  Delete: (id: string): Can =>
+    createCan("terms_history", id, "delete", "delete"),
+  Publish: (id: string): Can =>
+    createCan("terms_history", id, "publish", "publish"),
+  Manage: (id: string): Can =>
+    createCan("terms_history", id, "manage", "manage"),
+  ManageShareLinks: (id: string): Can =>
+    createCan("terms_history", id, "manage_share_links", "manage_share_links"),
+  Create: (): Can =>
+    createCan("platform", "global", "terms_history.create", "is_admin"),
+  List: (): Can =>
+    createCan("platform", "global", "terms_history.list", "is_admin"),
+  Snapshot: (id: string): RelationshipSnapshotPlan =>
+    createRelationshipSnapshotPlan("terms_history", id, "platform_admin", ""),
+  TouchPolicy: (id: string): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("terms_history", id),
+      "policy",
+      platformRelationshipSubject(),
+      RelationshipOperation.Touch,
+    ),
+  DeletePolicy: (id: string): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("terms_history", id),
+      "policy",
+      platformRelationshipSubject(),
+      RelationshipOperation.Delete,
+    ),
+});
+
+export const PrivacyHistory = Object.freeze({
+  Resource: (id: string): Resource => createResource("privacy_history", id),
+  View: (id: string): Can => createCan("privacy_history", id, "view", "view"),
+  Edit: (id: string): Can => createCan("privacy_history", id, "edit", "edit"),
+  ViewArchived: (id: string): Can =>
+    createCan("privacy_history", id, "view_archived", "view_archived"),
+  EditArchived: (id: string): Can =>
+    createCan("privacy_history", id, "edit_archived", "edit_archived"),
+  Delete: (id: string): Can =>
+    createCan("privacy_history", id, "delete", "delete"),
+  Publish: (id: string): Can =>
+    createCan("privacy_history", id, "publish", "publish"),
+  Manage: (id: string): Can =>
+    createCan("privacy_history", id, "manage", "manage"),
+  ManageShareLinks: (id: string): Can =>
+    createCan(
+      "privacy_history",
+      id,
+      "manage_share_links",
+      "manage_share_links",
+    ),
+  Create: (): Can =>
+    createCan("platform", "global", "privacy_history.create", "is_admin"),
+  List: (): Can =>
+    createCan("platform", "global", "privacy_history.list", "is_admin"),
+  Snapshot: (id: string): RelationshipSnapshotPlan =>
+    createRelationshipSnapshotPlan("privacy_history", id, "platform_admin", ""),
+  TouchPolicy: (id: string): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("privacy_history", id),
+      "policy",
+      platformRelationshipSubject(),
+      RelationshipOperation.Touch,
+    ),
+  DeletePolicy: (id: string): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("privacy_history", id),
+      "policy",
+      platformRelationshipSubject(),
+      RelationshipOperation.Delete,
+    ),
+});

package/gen/api/policy/v1/spicedb/map_theme.ts

@@ -0,0 +1,48 @@
+// Code generated by scripts/generated/generate-spicedb-catalog.mjs.
+// DO NOT EDIT.
+//
+// Domain: map_theme — Map Theme resource policy
+
+import {
+  accountIdentityRelationshipSubject,
+  createCan,
+  createRelationshipMutation,
+  createRelationshipSnapshotPlan,
+  createResource,
+  platformRelationshipSubject,
+  RelationshipOperation,
+  resourceRelationshipSubject,
+} from "./internal.ts";
+import type {
+  Actor,
+  Can,
+  RelationshipMutation,
+  RelationshipSnapshotPlan,
+  Resource,
+} from "./internal.ts";
+
+export const MapTheme = Object.freeze({
+  Resource: (id: string): Resource => createResource("map_theme", id),
+  View: (id: string): Can => createCan("map_theme", id, "view", "view"),
+  Edit: (id: string): Can => createCan("map_theme", id, "edit", "edit"),
+  Delete: (id: string): Can => createCan("map_theme", id, "delete", "delete"),
+  Manage: (id: string): Can => createCan("map_theme", id, "manage", "manage"),
+  Create: (): Can =>
+    createCan("platform", "global", "map_theme.create", "is_admin"),
+  Snapshot: (id: string): RelationshipSnapshotPlan =>
+    createRelationshipSnapshotPlan("map_theme", id, "platform_admin", ""),
+  TouchPolicy: (id: string): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("map_theme", id),
+      "policy",
+      platformRelationshipSubject(),
+      RelationshipOperation.Touch,
+    ),
+  DeletePolicy: (id: string): RelationshipMutation =>
+    createRelationshipMutation(
+      createResource("map_theme", id),
+      "policy",
+      platformRelationshipSubject(),
+      RelationshipOperation.Delete,
+    ),
+});