@inkeep/agents-core 0.46.1 → 0.47.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth/auth.js +1 -1
- package/dist/auth/authz/client.js +1 -1
- package/dist/auth/authz/config.d.ts +1 -86
- package/dist/auth/authz/config.js +6 -72
- package/dist/auth/authz/index.d.ts +2 -1
- package/dist/auth/authz/index.js +2 -1
- package/dist/auth/authz/permissions.d.ts +1 -1
- package/dist/auth/authz/permissions.js +1 -1
- package/dist/auth/authz/sync.d.ts +1 -1
- package/dist/auth/authz/sync.js +1 -1
- package/dist/auth/authz/types.d.ts +92 -0
- package/dist/auth/authz/types.js +76 -0
- package/dist/auth/init.js +1 -1
- package/dist/auth/spicedb-schema.js +2 -2
- package/dist/client-exports.d.ts +1 -1
- package/dist/client-exports.js +1 -1
- package/dist/data-access/manage/agents.d.ts +31 -31
- package/dist/data-access/manage/artifactComponents.d.ts +6 -6
- package/dist/data-access/manage/contextConfigs.d.ts +8 -8
- package/dist/data-access/manage/dataComponents.d.ts +4 -4
- package/dist/data-access/manage/functionTools.d.ts +8 -8
- package/dist/data-access/manage/subAgentExternalAgentRelations.d.ts +18 -18
- package/dist/data-access/manage/subAgentRelations.d.ts +18 -18
- package/dist/data-access/manage/subAgentTeamAgentRelations.d.ts +18 -18
- package/dist/data-access/manage/subAgents.d.ts +21 -21
- package/dist/data-access/manage/tools.d.ts +18 -18
- package/dist/data-access/runtime/apiKeys.d.ts +12 -12
- package/dist/data-access/runtime/conversations.d.ts +27 -27
- package/dist/data-access/runtime/messages.d.ts +18 -18
- package/dist/data-access/runtime/tasks.d.ts +6 -6
- package/dist/db/manage/manage-schema.d.ts +378 -378
- package/dist/db/runtime/runtime-schema.d.ts +240 -240
- package/dist/env.d.ts +6 -0
- package/dist/env.js +4 -1
- package/dist/index.d.ts +2 -1
- package/dist/index.js +2 -1
- package/dist/validation/dolt-schemas.d.ts +1 -1
- package/dist/validation/schemas.d.ts +1420 -1420
- package/package.json +1 -1
package/dist/auth/auth.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { member, ssoProvider } from "./auth-schema.js";
|
|
2
|
-
import { OrgRoles } from "./authz/
|
|
2
|
+
import { OrgRoles } from "./authz/types.js";
|
|
3
3
|
import { env } from "../env.js";
|
|
4
4
|
import { setPasswordResetLink } from "./password-reset-link-store.js";
|
|
5
5
|
import { generateId } from "../utils/conversations.js";
|
|
@@ -16,7 +16,7 @@ let client = null;
|
|
|
16
16
|
function getSpiceClient() {
|
|
17
17
|
if (!client) {
|
|
18
18
|
const config = getSpiceDbConfig();
|
|
19
|
-
client = v1.NewClient(config.token, config.endpoint, config.tlsEnabled ? v1.ClientSecurity.SECURE : v1.ClientSecurity.
|
|
19
|
+
client = v1.NewClient(config.token, config.endpoint, config.tlsEnabled ? v1.ClientSecurity.SECURE : v1.ClientSecurity.INSECURE_PLAINTEXT_CREDENTIALS);
|
|
20
20
|
}
|
|
21
21
|
return client;
|
|
22
22
|
}
|
|
@@ -12,90 +12,5 @@ declare function getSpiceDbConfig(): {
|
|
|
12
12
|
token: string;
|
|
13
13
|
tlsEnabled: boolean;
|
|
14
14
|
};
|
|
15
|
-
/**
|
|
16
|
-
* SpiceDB resource types used in the schema
|
|
17
|
-
*/
|
|
18
|
-
declare const SpiceDbResourceTypes: {
|
|
19
|
-
readonly USER: "user";
|
|
20
|
-
readonly ORGANIZATION: "organization";
|
|
21
|
-
readonly PROJECT: "project";
|
|
22
|
-
};
|
|
23
|
-
/**
|
|
24
|
-
* SpiceDB relations used in the schema
|
|
25
|
-
*
|
|
26
|
-
* Relations are named as nouns (roles) per SpiceDB best practices.
|
|
27
|
-
* Project roles are prefixed for clarity when debugging/grepping.
|
|
28
|
-
*/
|
|
29
|
-
declare const SpiceDbRelations: {
|
|
30
|
-
readonly OWNER: "owner";
|
|
31
|
-
readonly ADMIN: "admin";
|
|
32
|
-
readonly MEMBER: "member";
|
|
33
|
-
readonly ORGANIZATION: "organization";
|
|
34
|
-
readonly PROJECT_ADMIN: "project_admin";
|
|
35
|
-
readonly PROJECT_MEMBER: "project_member";
|
|
36
|
-
readonly PROJECT_VIEWER: "project_viewer";
|
|
37
|
-
};
|
|
38
|
-
/**
|
|
39
|
-
* SpiceDB permissions for organization resources.
|
|
40
|
-
*
|
|
41
|
-
* From schema.zed definition organization:
|
|
42
|
-
* - view: owner + admin + member
|
|
43
|
-
* - manage: owner + admin (includes managing org settings and all projects)
|
|
44
|
-
*/
|
|
45
|
-
declare const SpiceDbOrgPermissions: {
|
|
46
|
-
readonly VIEW: "view";
|
|
47
|
-
readonly MANAGE: "manage";
|
|
48
|
-
};
|
|
49
|
-
type SpiceDbOrgPermission = (typeof SpiceDbOrgPermissions)[keyof typeof SpiceDbOrgPermissions];
|
|
50
|
-
/**
|
|
51
|
-
* SpiceDB permissions for project resources.
|
|
52
|
-
*
|
|
53
|
-
* From schema.zed definition project:
|
|
54
|
-
* - view: read-only access to project and its resources
|
|
55
|
-
* - use: invoke agents, create API keys, view traces
|
|
56
|
-
* - edit: modify configurations, manage members
|
|
57
|
-
*/
|
|
58
|
-
declare const SpiceDbProjectPermissions: {
|
|
59
|
-
readonly VIEW: "view";
|
|
60
|
-
readonly USE: "use";
|
|
61
|
-
readonly EDIT: "edit";
|
|
62
|
-
};
|
|
63
|
-
type SpiceDbProjectPermission = (typeof SpiceDbProjectPermissions)[keyof typeof SpiceDbProjectPermissions];
|
|
64
|
-
/**
|
|
65
|
-
* Permission levels for project access checks.
|
|
66
|
-
*/
|
|
67
|
-
type ProjectPermissionLevel = SpiceDbProjectPermission;
|
|
68
|
-
/**
|
|
69
|
-
* Organization roles from SpiceDB schema.
|
|
70
|
-
*/
|
|
71
|
-
declare const OrgRoles: {
|
|
72
|
-
readonly OWNER: "owner";
|
|
73
|
-
readonly ADMIN: "admin";
|
|
74
|
-
readonly MEMBER: "member";
|
|
75
|
-
};
|
|
76
|
-
type OrgRole = (typeof OrgRoles)[keyof typeof OrgRoles];
|
|
77
|
-
/**
|
|
78
|
-
* Project roles from SpiceDB schema.
|
|
79
|
-
*
|
|
80
|
-
* Hierarchy:
|
|
81
|
-
* - project_admin: Full access (view + use + edit + manage members)
|
|
82
|
-
* - project_member: Operator access (view + use: invoke agents, create API keys)
|
|
83
|
-
* - project_viewer: Read-only access (view only)
|
|
84
|
-
*/
|
|
85
|
-
declare const ProjectRoles: {
|
|
86
|
-
readonly ADMIN: "project_admin";
|
|
87
|
-
readonly MEMBER: "project_member";
|
|
88
|
-
readonly VIEWER: "project_viewer";
|
|
89
|
-
};
|
|
90
|
-
type ProjectRole = (typeof ProjectRoles)[keyof typeof ProjectRoles];
|
|
91
|
-
/**
|
|
92
|
-
* Project permission capabilities.
|
|
93
|
-
* Maps to the SpiceDB permission checks (view, use, edit).
|
|
94
|
-
*/
|
|
95
|
-
interface ProjectPermissions {
|
|
96
|
-
canView: boolean;
|
|
97
|
-
canUse: boolean;
|
|
98
|
-
canEdit: boolean;
|
|
99
|
-
}
|
|
100
15
|
//#endregion
|
|
101
|
-
export {
|
|
16
|
+
export { getSpiceDbConfig, isLocalhostEndpoint };
|
|
@@ -1,3 +1,5 @@
|
|
|
1
|
+
import { env } from "../../env.js";
|
|
2
|
+
|
|
1
3
|
//#region src/auth/authz/config.ts
|
|
2
4
|
/**
|
|
3
5
|
* Check if a SpiceDB endpoint is localhost (used for TLS auto-detection).
|
|
@@ -10,81 +12,13 @@ function isLocalhostEndpoint(endpoint) {
|
|
|
10
12
|
* TLS is auto-detected: disabled for localhost, enabled for remote endpoints.
|
|
11
13
|
*/
|
|
12
14
|
function getSpiceDbConfig() {
|
|
13
|
-
const endpoint =
|
|
15
|
+
const endpoint = env.SPICEDB_ENDPOINT || "localhost:50051";
|
|
14
16
|
return {
|
|
15
17
|
endpoint,
|
|
16
|
-
token:
|
|
17
|
-
tlsEnabled: !isLocalhostEndpoint(endpoint)
|
|
18
|
+
token: env.SPICEDB_PRESHARED_KEY || "",
|
|
19
|
+
tlsEnabled: env.SPICEDB_TLS_ENABLED ?? !isLocalhostEndpoint(endpoint)
|
|
18
20
|
};
|
|
19
21
|
}
|
|
20
|
-
/**
|
|
21
|
-
* SpiceDB resource types used in the schema
|
|
22
|
-
*/
|
|
23
|
-
const SpiceDbResourceTypes = {
|
|
24
|
-
USER: "user",
|
|
25
|
-
ORGANIZATION: "organization",
|
|
26
|
-
PROJECT: "project"
|
|
27
|
-
};
|
|
28
|
-
/**
|
|
29
|
-
* SpiceDB relations used in the schema
|
|
30
|
-
*
|
|
31
|
-
* Relations are named as nouns (roles) per SpiceDB best practices.
|
|
32
|
-
* Project roles are prefixed for clarity when debugging/grepping.
|
|
33
|
-
*/
|
|
34
|
-
const SpiceDbRelations = {
|
|
35
|
-
OWNER: "owner",
|
|
36
|
-
ADMIN: "admin",
|
|
37
|
-
MEMBER: "member",
|
|
38
|
-
ORGANIZATION: "organization",
|
|
39
|
-
PROJECT_ADMIN: "project_admin",
|
|
40
|
-
PROJECT_MEMBER: "project_member",
|
|
41
|
-
PROJECT_VIEWER: "project_viewer"
|
|
42
|
-
};
|
|
43
|
-
/**
|
|
44
|
-
* SpiceDB permissions for organization resources.
|
|
45
|
-
*
|
|
46
|
-
* From schema.zed definition organization:
|
|
47
|
-
* - view: owner + admin + member
|
|
48
|
-
* - manage: owner + admin (includes managing org settings and all projects)
|
|
49
|
-
*/
|
|
50
|
-
const SpiceDbOrgPermissions = {
|
|
51
|
-
VIEW: "view",
|
|
52
|
-
MANAGE: "manage"
|
|
53
|
-
};
|
|
54
|
-
/**
|
|
55
|
-
* SpiceDB permissions for project resources.
|
|
56
|
-
*
|
|
57
|
-
* From schema.zed definition project:
|
|
58
|
-
* - view: read-only access to project and its resources
|
|
59
|
-
* - use: invoke agents, create API keys, view traces
|
|
60
|
-
* - edit: modify configurations, manage members
|
|
61
|
-
*/
|
|
62
|
-
const SpiceDbProjectPermissions = {
|
|
63
|
-
VIEW: "view",
|
|
64
|
-
USE: "use",
|
|
65
|
-
EDIT: "edit"
|
|
66
|
-
};
|
|
67
|
-
/**
|
|
68
|
-
* Organization roles from SpiceDB schema.
|
|
69
|
-
*/
|
|
70
|
-
const OrgRoles = {
|
|
71
|
-
OWNER: "owner",
|
|
72
|
-
ADMIN: "admin",
|
|
73
|
-
MEMBER: "member"
|
|
74
|
-
};
|
|
75
|
-
/**
|
|
76
|
-
* Project roles from SpiceDB schema.
|
|
77
|
-
*
|
|
78
|
-
* Hierarchy:
|
|
79
|
-
* - project_admin: Full access (view + use + edit + manage members)
|
|
80
|
-
* - project_member: Operator access (view + use: invoke agents, create API keys)
|
|
81
|
-
* - project_viewer: Read-only access (view only)
|
|
82
|
-
*/
|
|
83
|
-
const ProjectRoles = {
|
|
84
|
-
ADMIN: "project_admin",
|
|
85
|
-
MEMBER: "project_member",
|
|
86
|
-
VIEWER: "project_viewer"
|
|
87
|
-
};
|
|
88
22
|
|
|
89
23
|
//#endregion
|
|
90
|
-
export {
|
|
24
|
+
export { getSpiceDbConfig, isLocalhostEndpoint };
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, writeRelationship } from "./client.js";
|
|
2
|
-
import {
|
|
2
|
+
import { getSpiceDbConfig } from "./config.js";
|
|
3
|
+
import { OrgRole, OrgRoles, ProjectPermissionLevel, ProjectPermissions, ProjectRole, ProjectRoles, SpiceDbOrgPermission, SpiceDbOrgPermissions, SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes } from "./types.js";
|
|
3
4
|
import { canEditProject, canUseProject, canUseProjectStrict, canViewProject, listAccessibleProjectIds, listUsableProjectIds } from "./permissions.js";
|
|
4
5
|
import { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb } from "./sync.js";
|
|
5
6
|
export { type OrgRole, OrgRoles, type ProjectPermissionLevel, type ProjectPermissions, type ProjectRole, ProjectRoles, type SpiceDbOrgPermission, SpiceDbOrgPermissions, type SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes, canEditProject, canUseProject, canUseProjectStrict, canViewProject, changeOrgRole, changeProjectRole, checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, getSpiceDbConfig, grantProjectAccess, listAccessibleProjectIds, listProjectMembers, listUsableProjectIds, listUserProjectMembershipsInSpiceDb, lookupResources, readRelationships, removeProjectFromSpiceDb, resetSpiceClient, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb, writeRelationship };
|
package/dist/auth/authz/index.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
|
-
import { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes
|
|
1
|
+
import { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes } from "./types.js";
|
|
2
|
+
import { getSpiceDbConfig } from "./config.js";
|
|
2
3
|
import { checkBulkPermissions, checkPermission, deleteRelationship, getSpiceClient, lookupResources, readRelationships, resetSpiceClient, writeRelationship } from "./client.js";
|
|
3
4
|
import { canEditProject, canUseProject, canUseProjectStrict, canViewProject, listAccessibleProjectIds, listUsableProjectIds } from "./permissions.js";
|
|
4
5
|
import { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb } from "./sync.js";
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { OrgRoles, SpiceDbProjectPermissions, SpiceDbResourceTypes } from "./
|
|
1
|
+
import { OrgRoles, SpiceDbProjectPermissions, SpiceDbResourceTypes } from "./types.js";
|
|
2
2
|
import { checkPermission, lookupResources } from "./client.js";
|
|
3
3
|
|
|
4
4
|
//#region src/auth/authz/permissions.ts
|
package/dist/auth/authz/sync.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { SpiceDbRelations, SpiceDbResourceTypes } from "./
|
|
1
|
+
import { SpiceDbRelations, SpiceDbResourceTypes } from "./types.js";
|
|
2
2
|
import { RelationshipOperation, deleteRelationship, getSpiceClient, readRelationships, writeRelationship } from "./client.js";
|
|
3
3
|
|
|
4
4
|
//#region src/auth/authz/sync.ts
|
|
@@ -0,0 +1,92 @@
|
|
|
1
|
+
//#region src/auth/authz/types.d.ts
|
|
2
|
+
/**
|
|
3
|
+
* Client-safe authz types and constants.
|
|
4
|
+
* These can be safely imported in client-side code without any Node.js dependencies.
|
|
5
|
+
*/
|
|
6
|
+
/**
|
|
7
|
+
* SpiceDB resource types used in the schema
|
|
8
|
+
*/
|
|
9
|
+
declare const SpiceDbResourceTypes: {
|
|
10
|
+
readonly USER: "user";
|
|
11
|
+
readonly ORGANIZATION: "organization";
|
|
12
|
+
readonly PROJECT: "project";
|
|
13
|
+
};
|
|
14
|
+
/**
|
|
15
|
+
* SpiceDB relations used in the schema
|
|
16
|
+
*
|
|
17
|
+
* Relations are named as nouns (roles) per SpiceDB best practices.
|
|
18
|
+
* Project roles are prefixed for clarity when debugging/grepping.
|
|
19
|
+
*/
|
|
20
|
+
declare const SpiceDbRelations: {
|
|
21
|
+
readonly OWNER: "owner";
|
|
22
|
+
readonly ADMIN: "admin";
|
|
23
|
+
readonly MEMBER: "member";
|
|
24
|
+
readonly ORGANIZATION: "organization";
|
|
25
|
+
readonly PROJECT_ADMIN: "project_admin";
|
|
26
|
+
readonly PROJECT_MEMBER: "project_member";
|
|
27
|
+
readonly PROJECT_VIEWER: "project_viewer";
|
|
28
|
+
};
|
|
29
|
+
/**
|
|
30
|
+
* SpiceDB permissions for organization resources.
|
|
31
|
+
*
|
|
32
|
+
* From schema.zed definition organization:
|
|
33
|
+
* - view: owner + admin + member
|
|
34
|
+
* - manage: owner + admin (includes managing org settings and all projects)
|
|
35
|
+
*/
|
|
36
|
+
declare const SpiceDbOrgPermissions: {
|
|
37
|
+
readonly VIEW: "view";
|
|
38
|
+
readonly MANAGE: "manage";
|
|
39
|
+
};
|
|
40
|
+
type SpiceDbOrgPermission = (typeof SpiceDbOrgPermissions)[keyof typeof SpiceDbOrgPermissions];
|
|
41
|
+
/**
|
|
42
|
+
* SpiceDB permissions for project resources.
|
|
43
|
+
*
|
|
44
|
+
* From schema.zed definition project:
|
|
45
|
+
* - view: read-only access to project and its resources
|
|
46
|
+
* - use: invoke agents, create API keys, view traces
|
|
47
|
+
* - edit: modify configurations, manage members
|
|
48
|
+
*/
|
|
49
|
+
declare const SpiceDbProjectPermissions: {
|
|
50
|
+
readonly VIEW: "view";
|
|
51
|
+
readonly USE: "use";
|
|
52
|
+
readonly EDIT: "edit";
|
|
53
|
+
};
|
|
54
|
+
type SpiceDbProjectPermission = (typeof SpiceDbProjectPermissions)[keyof typeof SpiceDbProjectPermissions];
|
|
55
|
+
/**
|
|
56
|
+
* Permission levels for project access checks.
|
|
57
|
+
*/
|
|
58
|
+
type ProjectPermissionLevel = SpiceDbProjectPermission;
|
|
59
|
+
/**
|
|
60
|
+
* Organization roles from SpiceDB schema.
|
|
61
|
+
*/
|
|
62
|
+
declare const OrgRoles: {
|
|
63
|
+
readonly OWNER: "owner";
|
|
64
|
+
readonly ADMIN: "admin";
|
|
65
|
+
readonly MEMBER: "member";
|
|
66
|
+
};
|
|
67
|
+
type OrgRole = (typeof OrgRoles)[keyof typeof OrgRoles];
|
|
68
|
+
/**
|
|
69
|
+
* Project roles from SpiceDB schema.
|
|
70
|
+
*
|
|
71
|
+
* Hierarchy:
|
|
72
|
+
* - project_admin: Full access (view + use + edit + manage members)
|
|
73
|
+
* - project_member: Operator access (view + use: invoke agents, create API keys)
|
|
74
|
+
* - project_viewer: Read-only access (view only)
|
|
75
|
+
*/
|
|
76
|
+
declare const ProjectRoles: {
|
|
77
|
+
readonly ADMIN: "project_admin";
|
|
78
|
+
readonly MEMBER: "project_member";
|
|
79
|
+
readonly VIEWER: "project_viewer";
|
|
80
|
+
};
|
|
81
|
+
type ProjectRole = (typeof ProjectRoles)[keyof typeof ProjectRoles];
|
|
82
|
+
/**
|
|
83
|
+
* Project permission capabilities.
|
|
84
|
+
* Maps to the SpiceDB permission checks (view, use, edit).
|
|
85
|
+
*/
|
|
86
|
+
interface ProjectPermissions {
|
|
87
|
+
canView: boolean;
|
|
88
|
+
canUse: boolean;
|
|
89
|
+
canEdit: boolean;
|
|
90
|
+
}
|
|
91
|
+
//#endregion
|
|
92
|
+
export { OrgRole, OrgRoles, ProjectPermissionLevel, ProjectPermissions, ProjectRole, ProjectRoles, SpiceDbOrgPermission, SpiceDbOrgPermissions, SpiceDbProjectPermission, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes };
|
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
//#region src/auth/authz/types.ts
|
|
2
|
+
/**
|
|
3
|
+
* Client-safe authz types and constants.
|
|
4
|
+
* These can be safely imported in client-side code without any Node.js dependencies.
|
|
5
|
+
*/
|
|
6
|
+
/**
|
|
7
|
+
* SpiceDB resource types used in the schema
|
|
8
|
+
*/
|
|
9
|
+
const SpiceDbResourceTypes = {
|
|
10
|
+
USER: "user",
|
|
11
|
+
ORGANIZATION: "organization",
|
|
12
|
+
PROJECT: "project"
|
|
13
|
+
};
|
|
14
|
+
/**
|
|
15
|
+
* SpiceDB relations used in the schema
|
|
16
|
+
*
|
|
17
|
+
* Relations are named as nouns (roles) per SpiceDB best practices.
|
|
18
|
+
* Project roles are prefixed for clarity when debugging/grepping.
|
|
19
|
+
*/
|
|
20
|
+
const SpiceDbRelations = {
|
|
21
|
+
OWNER: "owner",
|
|
22
|
+
ADMIN: "admin",
|
|
23
|
+
MEMBER: "member",
|
|
24
|
+
ORGANIZATION: "organization",
|
|
25
|
+
PROJECT_ADMIN: "project_admin",
|
|
26
|
+
PROJECT_MEMBER: "project_member",
|
|
27
|
+
PROJECT_VIEWER: "project_viewer"
|
|
28
|
+
};
|
|
29
|
+
/**
|
|
30
|
+
* SpiceDB permissions for organization resources.
|
|
31
|
+
*
|
|
32
|
+
* From schema.zed definition organization:
|
|
33
|
+
* - view: owner + admin + member
|
|
34
|
+
* - manage: owner + admin (includes managing org settings and all projects)
|
|
35
|
+
*/
|
|
36
|
+
const SpiceDbOrgPermissions = {
|
|
37
|
+
VIEW: "view",
|
|
38
|
+
MANAGE: "manage"
|
|
39
|
+
};
|
|
40
|
+
/**
|
|
41
|
+
* SpiceDB permissions for project resources.
|
|
42
|
+
*
|
|
43
|
+
* From schema.zed definition project:
|
|
44
|
+
* - view: read-only access to project and its resources
|
|
45
|
+
* - use: invoke agents, create API keys, view traces
|
|
46
|
+
* - edit: modify configurations, manage members
|
|
47
|
+
*/
|
|
48
|
+
const SpiceDbProjectPermissions = {
|
|
49
|
+
VIEW: "view",
|
|
50
|
+
USE: "use",
|
|
51
|
+
EDIT: "edit"
|
|
52
|
+
};
|
|
53
|
+
/**
|
|
54
|
+
* Organization roles from SpiceDB schema.
|
|
55
|
+
*/
|
|
56
|
+
const OrgRoles = {
|
|
57
|
+
OWNER: "owner",
|
|
58
|
+
ADMIN: "admin",
|
|
59
|
+
MEMBER: "member"
|
|
60
|
+
};
|
|
61
|
+
/**
|
|
62
|
+
* Project roles from SpiceDB schema.
|
|
63
|
+
*
|
|
64
|
+
* Hierarchy:
|
|
65
|
+
* - project_admin: Full access (view + use + edit + manage members)
|
|
66
|
+
* - project_member: Operator access (view + use: invoke agents, create API keys)
|
|
67
|
+
* - project_viewer: Read-only access (view only)
|
|
68
|
+
*/
|
|
69
|
+
const ProjectRoles = {
|
|
70
|
+
ADMIN: "project_admin",
|
|
71
|
+
MEMBER: "project_member",
|
|
72
|
+
VIEWER: "project_viewer"
|
|
73
|
+
};
|
|
74
|
+
|
|
75
|
+
//#endregion
|
|
76
|
+
export { OrgRoles, ProjectRoles, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes };
|
package/dist/auth/init.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { getSpiceDbConfig
|
|
1
|
+
import { getSpiceDbConfig } from "./authz/config.js";
|
|
2
2
|
import { readFileSync } from "node:fs";
|
|
3
3
|
import { resolve } from "node:path";
|
|
4
4
|
import { v1 } from "@authzed/authzed-node";
|
|
@@ -8,7 +8,7 @@ async function writeSpiceDbSchema(options) {
|
|
|
8
8
|
const config = getSpiceDbConfig();
|
|
9
9
|
const { endpoint = config.endpoint, token = config.token, schemaPath = resolve(import.meta.dirname, "../../spicedb/schema.zed"), maxRetries = 30 } = options ?? {};
|
|
10
10
|
const schema = readFileSync(schemaPath, "utf-8");
|
|
11
|
-
const client = v1.NewClient(token, endpoint,
|
|
11
|
+
const client = v1.NewClient(token, endpoint, config.tlsEnabled ? v1.ClientSecurity.SECURE : v1.ClientSecurity.INSECURE_PLAINTEXT_CREDENTIALS);
|
|
12
12
|
let lastError;
|
|
13
13
|
for (let attempt = 1; attempt <= maxRetries; attempt++) try {
|
|
14
14
|
await client.promises.writeSchema(v1.WriteSchemaRequest.create({ schema }));
|
package/dist/client-exports.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { OrgRole, OrgRoles, ProjectRole, ProjectRoles } from "./auth/authz/
|
|
1
|
+
import { OrgRole, OrgRoles, ProjectRole, ProjectRoles } from "./auth/authz/types.js";
|
|
2
2
|
import { BreakdownComponentDef, CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, ContextBreakdown, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, parseContextBreakdownFromSpan } from "./constants/context-breakdown.js";
|
|
3
3
|
import { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AI_OPERATIONS, AI_TOOL_TYPES, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, SPAN_KEYS, SPAN_NAMES, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, UNKNOWN_VALUE } from "./constants/otel-attributes.js";
|
|
4
4
|
import { AGGREGATE_OPERATORS, DATA_SOURCES, DATA_TYPES, FIELD_TYPES, OPERATORS, ORDER_DIRECTIONS, PANEL_TYPES, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS } from "./constants/signoz-queries.js";
|
package/dist/client-exports.js
CHANGED
|
@@ -2,7 +2,7 @@ import { schemaValidationDefaults } from "./constants/schema-validation/defaults
|
|
|
2
2
|
import { CredentialStoreType, MCPTransportType } from "./types/utility.js";
|
|
3
3
|
import { AgentWithinContextOfProjectResponse, AgentWithinContextOfProjectSchema, FullAgentAgentInsertSchema, HeadersSchema, MAX_ID_LENGTH } from "./validation/schemas.js";
|
|
4
4
|
import { DEFAULT_NANGO_STORE_ID } from "./credential-stores/default-constants.js";
|
|
5
|
-
import { OrgRoles, ProjectRoles } from "./auth/authz/
|
|
5
|
+
import { OrgRoles, ProjectRoles } from "./auth/authz/types.js";
|
|
6
6
|
import { CONTEXT_BREAKDOWN_TOTAL_SPAN_ATTRIBUTE, V1_BREAKDOWN_SCHEMA, calculateBreakdownTotal, createEmptyBreakdown, parseContextBreakdownFromSpan } from "./constants/context-breakdown.js";
|
|
7
7
|
import { ACTIVITY_NAMES, ACTIVITY_STATUS, ACTIVITY_TYPES, AGENT_IDS, AI_OPERATIONS, AI_TOOL_TYPES, DELEGATION_FROM_SUB_AGENT_ID, DELEGATION_ID, DELEGATION_TO_SUB_AGENT_ID, SPAN_KEYS, SPAN_NAMES, TRANSFER_FROM_SUB_AGENT_ID, TRANSFER_TO_SUB_AGENT_ID, UNKNOWN_VALUE } from "./constants/otel-attributes.js";
|
|
8
8
|
import { AGGREGATE_OPERATORS, DATA_SOURCES, DATA_TYPES, FIELD_TYPES, OPERATORS, ORDER_DIRECTIONS, PANEL_TYPES, QUERY_DEFAULTS, QUERY_EXPRESSIONS, QUERY_FIELD_CONFIGS, QUERY_TYPES, REDUCE_OPERATIONS } from "./constants/signoz-queries.js";
|
|
@@ -10,9 +10,11 @@ declare const getAgentById: (db: AgentsManageDatabaseClient) => (params: {
|
|
|
10
10
|
}) => Promise<{
|
|
11
11
|
id: string;
|
|
12
12
|
name: string;
|
|
13
|
-
createdAt: string;
|
|
14
|
-
updatedAt: string;
|
|
15
13
|
description: string | null;
|
|
14
|
+
defaultSubAgentId: string | null;
|
|
15
|
+
tenantId: string;
|
|
16
|
+
projectId: string;
|
|
17
|
+
prompt: string | null;
|
|
16
18
|
models: {
|
|
17
19
|
base?: {
|
|
18
20
|
model?: string | undefined;
|
|
@@ -30,11 +32,9 @@ declare const getAgentById: (db: AgentsManageDatabaseClient) => (params: {
|
|
|
30
32
|
stopWhen: {
|
|
31
33
|
transferCountIs?: number | undefined;
|
|
32
34
|
} | null;
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
defaultSubAgentId: string | null;
|
|
35
|
+
createdAt: string;
|
|
36
|
+
updatedAt: string;
|
|
36
37
|
contextConfigId: string | null;
|
|
37
|
-
prompt: string | null;
|
|
38
38
|
statusUpdates: {
|
|
39
39
|
enabled?: boolean | undefined;
|
|
40
40
|
numEvents?: number | undefined;
|
|
@@ -56,9 +56,11 @@ declare const getAgentWithDefaultSubAgent: (db: AgentsManageDatabaseClient) => (
|
|
|
56
56
|
}) => Promise<{
|
|
57
57
|
id: string;
|
|
58
58
|
name: string;
|
|
59
|
-
createdAt: string;
|
|
60
|
-
updatedAt: string;
|
|
61
59
|
description: string | null;
|
|
60
|
+
defaultSubAgentId: string | null;
|
|
61
|
+
tenantId: string;
|
|
62
|
+
projectId: string;
|
|
63
|
+
prompt: string | null;
|
|
62
64
|
models: {
|
|
63
65
|
base?: {
|
|
64
66
|
model?: string | undefined;
|
|
@@ -76,11 +78,9 @@ declare const getAgentWithDefaultSubAgent: (db: AgentsManageDatabaseClient) => (
|
|
|
76
78
|
stopWhen: {
|
|
77
79
|
transferCountIs?: number | undefined;
|
|
78
80
|
} | null;
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
defaultSubAgentId: string | null;
|
|
81
|
+
createdAt: string;
|
|
82
|
+
updatedAt: string;
|
|
82
83
|
contextConfigId: string | null;
|
|
83
|
-
prompt: string | null;
|
|
84
84
|
statusUpdates: {
|
|
85
85
|
enabled?: boolean | undefined;
|
|
86
86
|
numEvents?: number | undefined;
|
|
@@ -99,9 +99,12 @@ declare const getAgentWithDefaultSubAgent: (db: AgentsManageDatabaseClient) => (
|
|
|
99
99
|
defaultSubAgent: {
|
|
100
100
|
id: string;
|
|
101
101
|
name: string;
|
|
102
|
-
createdAt: string;
|
|
103
|
-
updatedAt: string;
|
|
104
102
|
description: string | null;
|
|
103
|
+
tenantId: string;
|
|
104
|
+
projectId: string;
|
|
105
|
+
agentId: string;
|
|
106
|
+
prompt: string | null;
|
|
107
|
+
conversationHistoryConfig: ConversationHistoryConfig | null;
|
|
105
108
|
models: {
|
|
106
109
|
base?: {
|
|
107
110
|
model?: string | undefined;
|
|
@@ -119,11 +122,8 @@ declare const getAgentWithDefaultSubAgent: (db: AgentsManageDatabaseClient) => (
|
|
|
119
122
|
stopWhen: {
|
|
120
123
|
stepCountIs?: number | undefined;
|
|
121
124
|
} | null;
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
prompt: string | null;
|
|
125
|
-
agentId: string;
|
|
126
|
-
conversationHistoryConfig: ConversationHistoryConfig | null;
|
|
125
|
+
createdAt: string;
|
|
126
|
+
updatedAt: string;
|
|
127
127
|
} | null;
|
|
128
128
|
} | null>;
|
|
129
129
|
declare const listAgents: (db: AgentsManageDatabaseClient) => (params: {
|
|
@@ -131,9 +131,11 @@ declare const listAgents: (db: AgentsManageDatabaseClient) => (params: {
|
|
|
131
131
|
}) => Promise<{
|
|
132
132
|
id: string;
|
|
133
133
|
name: string;
|
|
134
|
-
createdAt: string;
|
|
135
|
-
updatedAt: string;
|
|
136
134
|
description: string | null;
|
|
135
|
+
defaultSubAgentId: string | null;
|
|
136
|
+
tenantId: string;
|
|
137
|
+
projectId: string;
|
|
138
|
+
prompt: string | null;
|
|
137
139
|
models: {
|
|
138
140
|
base?: {
|
|
139
141
|
model?: string | undefined;
|
|
@@ -151,11 +153,9 @@ declare const listAgents: (db: AgentsManageDatabaseClient) => (params: {
|
|
|
151
153
|
stopWhen: {
|
|
152
154
|
transferCountIs?: number | undefined;
|
|
153
155
|
} | null;
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
defaultSubAgentId: string | null;
|
|
156
|
+
createdAt: string;
|
|
157
|
+
updatedAt: string;
|
|
157
158
|
contextConfigId: string | null;
|
|
158
|
-
prompt: string | null;
|
|
159
159
|
statusUpdates: {
|
|
160
160
|
enabled?: boolean | undefined;
|
|
161
161
|
numEvents?: number | undefined;
|
|
@@ -247,9 +247,11 @@ declare function listAgentsAcrossProjectMainBranches(db: AgentsManageDatabaseCli
|
|
|
247
247
|
declare const createAgent: (db: AgentsManageDatabaseClient) => (data: AgentInsert) => Promise<{
|
|
248
248
|
id: string;
|
|
249
249
|
name: string;
|
|
250
|
-
createdAt: string;
|
|
251
|
-
updatedAt: string;
|
|
252
250
|
description: string | null;
|
|
251
|
+
defaultSubAgentId: string | null;
|
|
252
|
+
tenantId: string;
|
|
253
|
+
projectId: string;
|
|
254
|
+
prompt: string | null;
|
|
253
255
|
models: {
|
|
254
256
|
base?: {
|
|
255
257
|
model?: string | undefined;
|
|
@@ -267,11 +269,9 @@ declare const createAgent: (db: AgentsManageDatabaseClient) => (data: AgentInser
|
|
|
267
269
|
stopWhen: {
|
|
268
270
|
transferCountIs?: number | undefined;
|
|
269
271
|
} | null;
|
|
270
|
-
|
|
271
|
-
|
|
272
|
-
defaultSubAgentId: string | null;
|
|
272
|
+
createdAt: string;
|
|
273
|
+
updatedAt: string;
|
|
273
274
|
contextConfigId: string | null;
|
|
274
|
-
prompt: string | null;
|
|
275
275
|
statusUpdates: {
|
|
276
276
|
enabled?: boolean | undefined;
|
|
277
277
|
numEvents?: number | undefined;
|
|
@@ -9,11 +9,11 @@ declare const getArtifactComponentById: (db: AgentsManageDatabaseClient) => (par
|
|
|
9
9
|
}) => Promise<{
|
|
10
10
|
id: string;
|
|
11
11
|
name: string;
|
|
12
|
-
createdAt: string;
|
|
13
|
-
updatedAt: string;
|
|
14
12
|
description: string | null;
|
|
15
13
|
tenantId: string;
|
|
16
14
|
projectId: string;
|
|
15
|
+
createdAt: string;
|
|
16
|
+
updatedAt: string;
|
|
17
17
|
props: Record<string, unknown> | null;
|
|
18
18
|
render: {
|
|
19
19
|
component: string;
|
|
@@ -51,11 +51,11 @@ declare const listArtifactComponentsPaginated: (db: AgentsManageDatabaseClient)
|
|
|
51
51
|
declare const createArtifactComponent: (db: AgentsManageDatabaseClient) => (params: ArtifactComponentInsert) => Promise<{
|
|
52
52
|
id: string;
|
|
53
53
|
name: string;
|
|
54
|
-
createdAt: string;
|
|
55
|
-
updatedAt: string;
|
|
56
54
|
description: string | null;
|
|
57
55
|
tenantId: string;
|
|
58
56
|
projectId: string;
|
|
57
|
+
createdAt: string;
|
|
58
|
+
updatedAt: string;
|
|
59
59
|
props: Record<string, unknown> | null;
|
|
60
60
|
render: {
|
|
61
61
|
component: string;
|
|
@@ -105,10 +105,10 @@ declare const associateArtifactComponentWithAgent: (db: AgentsManageDatabaseClie
|
|
|
105
105
|
artifactComponentId: string;
|
|
106
106
|
}) => Promise<{
|
|
107
107
|
id: string;
|
|
108
|
-
createdAt: string;
|
|
109
108
|
tenantId: string;
|
|
110
109
|
projectId: string;
|
|
111
110
|
agentId: string;
|
|
111
|
+
createdAt: string;
|
|
112
112
|
subAgentId: string;
|
|
113
113
|
artifactComponentId: string;
|
|
114
114
|
}>;
|
|
@@ -148,10 +148,10 @@ declare const upsertAgentArtifactComponentRelation: (db: AgentsManageDatabaseCli
|
|
|
148
148
|
artifactComponentId: string;
|
|
149
149
|
}) => Promise<{
|
|
150
150
|
id: string;
|
|
151
|
-
createdAt: string;
|
|
152
151
|
tenantId: string;
|
|
153
152
|
projectId: string;
|
|
154
153
|
agentId: string;
|
|
154
|
+
createdAt: string;
|
|
155
155
|
subAgentId: string;
|
|
156
156
|
artifactComponentId: string;
|
|
157
157
|
} | null>;
|