@kindgi/authz 0.0.0-bootstrap.0 → 0.1.1

package/dist/principal.js

@@ -0,0 +1,71 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+// ============================================================
+// CONSTRUCTORS — thin factories for readable call sites
+// ============================================================
+export function userPrincipal(userId, tenantId) {
+    return { actor: { kind: 'user', id: userId, tenantId } };
+}
+export function systemPrincipal(tenantId) {
+    return { actor: { kind: 'system', id: 'system', tenantId } };
+}
+/**
+ * Build a principal from a service-account token. `id` is typically
+ * the token id (or a stable identifier derived from it) so grants can
+ * be attached to a specific integration.
+ */
+export function serviceAccountPrincipal(serviceAccountId, tenantId) {
+    return { actor: { kind: 'service_account', id: serviceAccountId, tenantId } };
+}
+/**
+ * Build a delegated principal: `actor` acting on behalf of `onBehalfOf`.
+ * Both must be in the same tenant (checked at construction; mismatches
+ * are configuration bugs, not runtime authz denials).
+ */
+export function delegate(actor, onBehalfOf, scope) {
+    if (actor.tenantId !== onBehalfOf.tenantId) {
+        throw new Error(`delegate: cross-tenant delegation not supported (actor.tenantId=${actor.tenantId}, onBehalfOf.tenantId=${onBehalfOf.tenantId})`);
+    }
+    return {
+        actor,
+        onBehalfOf,
+        ...(scope !== undefined ? { scope } : {}),
+    };
+}
+/**
+ * Narrow an existing principal's permissions further. Composable with
+ * delegation — an agent-on-behalf-of-user can be additionally scoped
+ * to read-only for a specific request.
+ */
+export function downscope(principal, scope) {
+    return { ...principal, scope };
+}
+// ============================================================
+// FGA MAPPING — encapsulated in one place
+// ============================================================
+/**
+ * Return the FGA subject string for a PrincipalRef. This is the ONE
+ * place that decides how principal kinds map to FGA subjects.
+ *
+ * - `user`            → `user:${id}` (real user UUID)
+ * - `agent`           → `agent:${id}`
+ * - `service_account` → `service_account:${id}` (machine identity
+ *                       with narrow grants)
+ * - `system`          → `user:system` (service identity the tenant's
+ *                       setup grants tenant admin; with one FGA store
+ *                       per tenant the string never crosses tenant
+ *                       boundaries)
+ */
+export function fgaSubject(ref) {
+    switch (ref.kind) {
+        case 'user':
+            return `user:${ref.id}`;
+        case 'agent':
+            return `agent:${ref.id}`;
+        case 'service_account':
+            return `service_account:${ref.id}`;
+        case 'system':
+            return 'user:system';
+    }
+}
+//# sourceMappingURL=principal.js.map

package/dist/principal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.js","sourceRoot":"","sources":["../src/principal.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AA2EjC,+DAA+D;AAC/D,wDAAwD;AACxD,+DAA+D;AAE/D,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,QAAkB;IAC9D,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAkB;IAChD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,gBAAwB,EAAE,QAAkB;IAClF,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CACtB,KAAmB,EACnB,UAAwB,EACxB,KAA6B;IAE7B,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,mEAAmE,KAAK,CAAC,QAAQ,yBAAyB,UAAU,CAAC,QAAQ,GAAG,CACjI,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK;QACL,UAAU;QACV,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,SAAoB,EAAE,KAA4B;IAC1E,OAAO,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,+DAA+D;AAC/D,0CAA0C;AAC1C,+DAA+D;AAE/D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CAAC,GAAiB;IAC1C,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,OAAO,QAAQ,GAAG,CAAC,EAAE,EAAE,CAAC;QAC1B,KAAK,OAAO;YACV,OAAO,SAAS,GAAG,CAAC,EAAE,EAAE,CAAC;QAC3B,KAAK,iBAAiB;YACpB,OAAO,mBAAmB,GAAG,CAAC,EAAE,EAAE,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/reviewer.d.ts

@@ -0,0 +1,8 @@
+export type ReviewerRole = 'standard' | 'senior' | 'admin';
+/**
+ * Rank order — index into an ordered scale so callers can express
+ * "requires >= senior" without hard-coding string comparisons.
+ * Higher number = more senior.
+ */
+export declare const REVIEWER_ROLE_RANK: Readonly<Record<ReviewerRole, number>>;
+//# sourceMappingURL=reviewer.d.ts.map

package/dist/reviewer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewer.d.ts","sourceRoot":"","sources":["../src/reviewer.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAIrE,CAAC"}

package/dist/reviewer.js

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Rank order — index into an ordered scale so callers can express
+ * "requires >= senior" without hard-coding string comparisons.
+ * Higher number = more senior.
+ */
+export const REVIEWER_ROLE_RANK = {
+    standard: 0,
+    senior: 1,
+    admin: 2,
+};
+//# sourceMappingURL=reviewer.js.map

package/dist/reviewer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewer.js","sourceRoot":"","sources":["../src/reviewer.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAoBjC;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA2C;IACxE,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;CACT,CAAC"}

package/dist/tuples.d.ts

@@ -0,0 +1,142 @@
+import type { AgentId, FlowId, GuardrailId, OrgId, ProjectId, RunId, TeamId, TenantId, ToolId, UserId } from '@kindgi/types';
+import type { TupleIntent } from './enqueue.js';
+type EvalSuiteId = string;
+type SecretId = string;
+type EnvId = string;
+type McpEndpointId = string;
+export declare function userSubject(id: UserId): string;
+export declare function teamMemberSubject(id: TeamId): string;
+export declare function tenantObject(id: TenantId): string;
+export declare function orgObject(id: OrgId): string;
+export declare function teamObject(id: TeamId): string;
+export declare function projectObject(id: ProjectId): string;
+export declare function agentObject(id: AgentId): string;
+export declare function flowObject(id: FlowId): string;
+export declare function toolObject(id: ToolId): string;
+export declare function guardrailObject(id: GuardrailId): string;
+export declare function evalSuiteObject(id: EvalSuiteId): string;
+export declare function secretObject(id: SecretId): string;
+export declare function envObject(id: EnvId): string;
+export declare function mcpEndpointObject(id: McpEndpointId): string;
+export declare function runObject(id: RunId): string;
+export type Scope = {
+    readonly kind: 'tenant';
+    readonly tenantId: TenantId;
+} | {
+    readonly kind: 'org';
+    readonly tenantId: TenantId;
+    readonly orgId: OrgId;
+} | {
+    readonly kind: 'project';
+    readonly tenantId: TenantId;
+    readonly projectId: ProjectId;
+};
+export declare function scopeSubject(scope: Scope): string;
+export type EntityRef = {
+    readonly kind: 'org';
+    readonly id: OrgId;
+    readonly tenantId: TenantId;
+} | {
+    readonly kind: 'project';
+    readonly id: ProjectId;
+    readonly tenantId: TenantId;
+    readonly orgId?: OrgId;
+} | {
+    readonly kind: 'team';
+    readonly id: TeamId;
+    readonly tenantId: TenantId;
+    readonly orgId?: OrgId;
+} | {
+    readonly kind: 'agent';
+    readonly id: AgentId;
+    readonly tenantId: TenantId;
+    readonly projectId: ProjectId;
+} | {
+    readonly kind: 'flow';
+    readonly id: FlowId;
+    readonly tenantId: TenantId;
+    readonly projectId: ProjectId;
+} | {
+    readonly kind: 'tool';
+    readonly id: ToolId;
+    readonly tenantId: TenantId;
+    readonly projectId: ProjectId;
+} | {
+    readonly kind: 'guardrail';
+    readonly id: GuardrailId;
+    readonly tenantId: TenantId;
+    readonly projectId: ProjectId;
+} | {
+    readonly kind: 'eval_suite';
+    readonly id: EvalSuiteId;
+    readonly tenantId: TenantId;
+    readonly projectId: ProjectId;
+} | {
+    readonly kind: 'secret';
+    readonly id: SecretId;
+    readonly tenantId: TenantId;
+    readonly scope: Scope;
+} | {
+    readonly kind: 'env';
+    readonly id: EnvId;
+    readonly tenantId: TenantId;
+    readonly scope: Scope;
+} | {
+    readonly kind: 'mcp_endpoint';
+    readonly id: McpEndpointId;
+    readonly tenantId: TenantId;
+    readonly scope: Scope;
+} | {
+    readonly kind: 'run';
+    readonly id: RunId;
+    readonly tenantId: TenantId;
+    readonly projectId: ProjectId;
+};
+export declare function tuplesForCreate(entity: EntityRef, creatorUserId?: UserId): TupleIntent[];
+export declare function tuplesForDelete(entity: EntityRef): TupleIntent[];
+export type TeamRole = 'member' | 'admin';
+export type ProjectRole = 'owner' | 'admin' | 'editor' | 'viewer';
+export declare function teamMembershipTuple(op: 'write' | 'delete', teamId: TeamId, userId: UserId, role: TeamRole): TupleIntent;
+export declare function projectMembershipTuple(op: 'write' | 'delete', projectId: ProjectId, userId: UserId, role: ProjectRole): TupleIntent;
+export declare function teamProjectGrantTuple(op: 'write' | 'delete', projectId: ProjectId, teamId: TeamId, role: Exclude<ProjectRole, 'owner'>): TupleIntent;
+export type MachineSubject = {
+    readonly kind: 'agent';
+    readonly id: AgentId | string;
+} | {
+    readonly kind: 'service_account';
+    readonly id: string;
+};
+export type AgentAccessResource = {
+    readonly type: 'tool';
+    readonly id: ToolId;
+} | {
+    readonly type: 'flow';
+    readonly id: FlowId;
+} | {
+    readonly type: 'eval_suite';
+    readonly id: EvalSuiteId;
+} | {
+    readonly type: 'agent';
+    readonly id: AgentId;
+} | {
+    readonly type: 'secret';
+    readonly id: SecretId;
+} | {
+    readonly type: 'env';
+    readonly id: EnvId;
+} | {
+    readonly type: 'mcp_endpoint';
+    readonly id: McpEndpointId;
+};
+/**
+ * Generic machine-subject grant. Works for both `agent` and
+ * `service_account` — the capability relations admit both.
+ */
+export declare function machineAccessTuple(op: 'write' | 'delete', subject: MachineSubject, resource: AgentAccessResource): TupleIntent;
+/**
+ * Agent-subject shorthand for
+ * `machineAccessTuple(op, { kind: 'agent', id: agentId }, resource)`.
+ */
+export declare function agentAccessTuple(op: 'write' | 'delete', agentId: AgentId, resource: AgentAccessResource): TupleIntent;
+export {};
+//# sourceMappingURL=tuples.d.ts.map

package/dist/tuples.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tuples.d.ts","sourceRoot":"","sources":["../src/tuples.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACV,OAAO,EACP,MAAM,EACN,WAAW,EACX,KAAK,EACL,SAAS,EACT,KAAK,EACL,MAAM,EACN,QAAQ,EACR,MAAM,EACN,MAAM,EACP,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIhD,KAAK,WAAW,GAAG,MAAM,CAAC;AAC1B,KAAK,QAAQ,GAAG,MAAM,CAAC;AACvB,KAAK,KAAK,GAAG,MAAM,CAAC;AACpB,KAAK,aAAa,GAAG,MAAM,CAAC;AAM5B,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEpD;AAMD,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,MAAM,CAEjD;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,GAAG,MAAM,CAE3C;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAEnD;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,OAAO,GAAG,MAAM,CAE/C;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,WAAW,GAAG,MAAM,CAEvD;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,WAAW,GAAG,MAAM,CAEvD;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG,MAAM,CAEjD;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,GAAG,MAAM,CAE3C;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,aAAa,GAAG,MAAM,CAE3D;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,GAAG,MAAM,CAE3C;AAMD,MAAM,MAAM,KAAK,GACb;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAE7F,wBAAgB,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CASjD;AAMD,MAAM,MAAM,SAAS,GAEjB;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB,GAED;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B,GAED;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;CACvB,GAED;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B,CAAC;AAMN,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE,CA4HxF;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,WAAW,EAAE,CAqEhE;AAMD,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAC1C,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAElE,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,OAAO,GAAG,QAAQ,EACtB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,QAAQ,GACb,WAAW,CAOb;AAED,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,OAAO,GAAG,QAAQ,EACtB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,GAChB,WAAW,CAOb;AAED,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,OAAO,GAAG,QAAQ,EACtB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,GAClC,WAAW,CAOb;AAkBD,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,GAAG,MAAM,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAA;CAAE,CAAC;AAMlE;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,OAAO,GAAG,QAAQ,EACtB,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,mBAAmB,GAC5B,WAAW,CAqDb;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,OAAO,GAAG,QAAQ,EACtB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,mBAAmB,GAC5B,WAAW,CAEb"}

package/dist/tuples.js

@@ -0,0 +1,372 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+// ============================================================
+// SUBJECT HELPERS
+// ============================================================
+export function userSubject(id) {
+    return `user:${id}`;
+}
+export function teamMemberSubject(id) {
+    return `team:${id}#member`;
+}
+// ============================================================
+// OBJECT HELPERS
+// ============================================================
+export function tenantObject(id) {
+    return `tenant:${id}`;
+}
+export function orgObject(id) {
+    return `org:${id}`;
+}
+export function teamObject(id) {
+    return `team:${id}`;
+}
+export function projectObject(id) {
+    return `project:${id}`;
+}
+export function agentObject(id) {
+    return `agent:${id}`;
+}
+export function flowObject(id) {
+    return `flow:${id}`;
+}
+export function toolObject(id) {
+    return `tool:${id}`;
+}
+export function guardrailObject(id) {
+    return `guardrail:${id}`;
+}
+export function evalSuiteObject(id) {
+    return `eval_suite:${id}`;
+}
+export function secretObject(id) {
+    return `secret:${id}`;
+}
+export function envObject(id) {
+    return `env:${id}`;
+}
+export function mcpEndpointObject(id) {
+    return `mcp_endpoint:${id}`;
+}
+export function runObject(id) {
+    return `run:${id}`;
+}
+export function scopeSubject(scope) {
+    switch (scope.kind) {
+        case 'tenant':
+            return tenantObject(scope.tenantId);
+        case 'org':
+            return orgObject(scope.orgId);
+        case 'project':
+            return projectObject(scope.projectId);
+    }
+}
+// ============================================================
+// TUPLE GENERATORS FOR CREATE / DELETE
+// ============================================================
+export function tuplesForCreate(entity, creatorUserId) {
+    switch (entity.kind) {
+        case 'org': {
+            const tuples = [
+                {
+                    operation: 'write',
+                    user: tenantObject(entity.tenantId),
+                    relation: 'parent',
+                    object: orgObject(entity.id),
+                },
+            ];
+            if (creatorUserId !== undefined) {
+                tuples.push({
+                    operation: 'write',
+                    user: userSubject(creatorUserId),
+                    relation: 'admin',
+                    object: orgObject(entity.id),
+                });
+            }
+            return tuples;
+        }
+        case 'team': {
+            const tuples = [
+                {
+                    operation: 'write',
+                    user: entity.orgId !== undefined ? orgObject(entity.orgId) : tenantObject(entity.tenantId),
+                    relation: 'parent',
+                    object: teamObject(entity.id),
+                },
+            ];
+            if (creatorUserId !== undefined) {
+                tuples.push({
+                    operation: 'write',
+                    user: userSubject(creatorUserId),
+                    relation: 'admin',
+                    object: teamObject(entity.id),
+                });
+            }
+            return tuples;
+        }
+        case 'project': {
+            const tuples = [
+                {
+                    operation: 'write',
+                    user: entity.orgId !== undefined ? orgObject(entity.orgId) : tenantObject(entity.tenantId),
+                    relation: 'parent',
+                    object: projectObject(entity.id),
+                },
+            ];
+            if (creatorUserId !== undefined) {
+                tuples.push({
+                    operation: 'write',
+                    user: userSubject(creatorUserId),
+                    relation: 'owner',
+                    object: projectObject(entity.id),
+                });
+            }
+            return tuples;
+        }
+        case 'agent':
+        case 'flow':
+        case 'tool':
+        case 'guardrail':
+        case 'eval_suite': {
+            const object = contentObject(entity);
+            const tuples = [
+                {
+                    operation: 'write',
+                    user: projectObject(entity.projectId),
+                    relation: 'parent',
+                    object,
+                },
+            ];
+            if (creatorUserId !== undefined) {
+                tuples.push({
+                    operation: 'write',
+                    user: userSubject(creatorUserId),
+                    relation: 'owner',
+                    object,
+                });
+            }
+            return tuples;
+        }
+        case 'secret':
+        case 'env':
+        case 'mcp_endpoint': {
+            const object = configObject(entity);
+            const tuples = [
+                {
+                    operation: 'write',
+                    user: scopeSubject(entity.scope),
+                    relation: 'scope',
+                    object,
+                },
+            ];
+            if (creatorUserId !== undefined) {
+                tuples.push({
+                    operation: 'write',
+                    user: userSubject(creatorUserId),
+                    relation: 'admin',
+                    object,
+                });
+            }
+            return tuples;
+        }
+        case 'run':
+            // Runs are system-created; no `owner` role (read access comes
+            // through the parent project).
+            return [
+                {
+                    operation: 'write',
+                    user: projectObject(entity.projectId),
+                    relation: 'parent',
+                    object: runObject(entity.id),
+                },
+            ];
+    }
+}
+export function tuplesForDelete(entity) {
+    // Deletes only the parent/scope tuple written at create time. Role
+    // and grant tuples added later (membership / grant helpers below)
+    // are removed separately by whoever wrote them. Orphan tuples are
+    // safe — they only reference objects that no longer exist.
+    switch (entity.kind) {
+        case 'org':
+            return [
+                {
+                    operation: 'delete',
+                    user: tenantObject(entity.tenantId),
+                    relation: 'parent',
+                    object: orgObject(entity.id),
+                },
+            ];
+        case 'team':
+            return [
+                {
+                    operation: 'delete',
+                    user: entity.orgId !== undefined ? orgObject(entity.orgId) : tenantObject(entity.tenantId),
+                    relation: 'parent',
+                    object: teamObject(entity.id),
+                },
+            ];
+        case 'project':
+            return [
+                {
+                    operation: 'delete',
+                    user: entity.orgId !== undefined ? orgObject(entity.orgId) : tenantObject(entity.tenantId),
+                    relation: 'parent',
+                    object: projectObject(entity.id),
+                },
+            ];
+        case 'agent':
+        case 'flow':
+        case 'tool':
+        case 'guardrail':
+        case 'eval_suite':
+            return [
+                {
+                    operation: 'delete',
+                    user: projectObject(entity.projectId),
+                    relation: 'parent',
+                    object: contentObject(entity),
+                },
+            ];
+        case 'secret':
+        case 'env':
+        case 'mcp_endpoint':
+            return [
+                {
+                    operation: 'delete',
+                    user: scopeSubject(entity.scope),
+                    relation: 'scope',
+                    object: configObject(entity),
+                },
+            ];
+        case 'run':
+            return [
+                {
+                    operation: 'delete',
+                    user: projectObject(entity.projectId),
+                    relation: 'parent',
+                    object: runObject(entity.id),
+                },
+            ];
+    }
+}
+export function teamMembershipTuple(op, teamId, userId, role) {
+    return {
+        operation: op,
+        user: userSubject(userId),
+        relation: role,
+        object: teamObject(teamId),
+    };
+}
+export function projectMembershipTuple(op, projectId, userId, role) {
+    return {
+        operation: op,
+        user: userSubject(userId),
+        relation: role,
+        object: projectObject(projectId),
+    };
+}
+export function teamProjectGrantTuple(op, projectId, teamId, role) {
+    return {
+        operation: op,
+        user: teamMemberSubject(teamId),
+        relation: role,
+        object: projectObject(projectId),
+    };
+}
+function machineSubjectString(subject) {
+    return `${subject.kind}:${subject.id}`;
+}
+/**
+ * Generic machine-subject grant. Works for both `agent` and
+ * `service_account` — the capability relations admit both.
+ */
+export function machineAccessTuple(op, subject, resource) {
+    const subjectString = machineSubjectString(subject);
+    switch (resource.type) {
+        case 'tool':
+            return {
+                operation: op,
+                user: subjectString,
+                relation: 'invoker',
+                object: toolObject(resource.id),
+            };
+        case 'flow':
+            return {
+                operation: op,
+                user: subjectString,
+                relation: 'executor',
+                object: flowObject(resource.id),
+            };
+        case 'eval_suite':
+            return {
+                operation: op,
+                user: subjectString,
+                relation: 'executor',
+                object: evalSuiteObject(resource.id),
+            };
+        case 'agent':
+            return {
+                operation: op,
+                user: subjectString,
+                relation: 'caller',
+                object: agentObject(resource.id),
+            };
+        case 'secret':
+            return {
+                operation: op,
+                user: subjectString,
+                relation: 'reader',
+                object: secretObject(resource.id),
+            };
+        case 'env':
+            return {
+                operation: op,
+                user: subjectString,
+                relation: 'reader',
+                object: envObject(resource.id),
+            };
+        case 'mcp_endpoint':
+            return {
+                operation: op,
+                user: subjectString,
+                relation: 'reader',
+                object: mcpEndpointObject(resource.id),
+            };
+    }
+}
+/**
+ * Agent-subject shorthand for
+ * `machineAccessTuple(op, { kind: 'agent', id: agentId }, resource)`.
+ */
+export function agentAccessTuple(op, agentId, resource) {
+    return machineAccessTuple(op, { kind: 'agent', id: agentId }, resource);
+}
+// ============================================================
+// INTERNAL HELPERS
+// ============================================================
+function contentObject(entity) {
+    switch (entity.kind) {
+        case 'agent':
+            return agentObject(entity.id);
+        case 'flow':
+            return flowObject(entity.id);
+        case 'tool':
+            return toolObject(entity.id);
+        case 'guardrail':
+            return guardrailObject(entity.id);
+        case 'eval_suite':
+            return evalSuiteObject(entity.id);
+    }
+}
+function configObject(entity) {
+    switch (entity.kind) {
+        case 'secret':
+            return secretObject(entity.id);
+        case 'env':
+            return envObject(entity.id);
+        case 'mcp_endpoint':
+            return mcpEndpointObject(entity.id);
+    }
+}
+//# sourceMappingURL=tuples.js.map

package/dist/tuples.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tuples.js","sourceRoot":"","sources":["../src/tuples.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAkCjC,+DAA+D;AAC/D,kBAAkB;AAClB,+DAA+D;AAE/D,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,OAAO,QAAQ,EAAE,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,OAAO,QAAQ,EAAE,SAAS,CAAC;AAC7B,CAAC;AAED,+DAA+D;AAC/D,iBAAiB;AACjB,+DAA+D;AAE/D,MAAM,UAAU,YAAY,CAAC,EAAY;IACvC,OAAO,UAAU,EAAE,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAS;IACjC,OAAO,OAAO,EAAE,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAU;IACnC,OAAO,QAAQ,EAAE,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAa;IACzC,OAAO,WAAW,EAAE,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAW;IACrC,OAAO,SAAS,EAAE,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAU;IACnC,OAAO,QAAQ,EAAE,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAU;IACnC,OAAO,QAAQ,EAAE,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAe;IAC7C,OAAO,aAAa,EAAE,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAe;IAC7C,OAAO,cAAc,EAAE,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAY;IACvC,OAAO,UAAU,EAAE,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAS;IACjC,OAAO,OAAO,EAAE,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAiB;IACjD,OAAO,gBAAgB,EAAE,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAS;IACjC,OAAO,OAAO,EAAE,EAAE,CAAC;AACrB,CAAC;AAWD,MAAM,UAAU,YAAY,CAAC,KAAY;IACvC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtC,KAAK,KAAK;YACR,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,KAAK,SAAS;YACZ,OAAO,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAmFD,+DAA+D;AAC/D,uCAAuC;AACvC,+DAA+D;AAE/D,MAAM,UAAU,eAAe,CAAC,MAAiB,EAAE,aAAsB;IACvE,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,MAAM,GAAkB;gBAC5B;oBACE,SAAS,EAAE,OAAO;oBAClB,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC;oBACnC,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;iBAC7B;aACF,CAAC;YACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC;oBACV,SAAS,EAAE,OAAO;oBAClB,IAAI,EAAE,WAAW,CAAC,aAAa,CAAC;oBAChC,QAAQ,EAAE,OAAO;oBACjB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;iBAC7B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,MAAM,GAAkB;gBAC5B;oBACE,SAAS,EAAE,OAAO;oBAClB,IAAI,EACF,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC;oBACtF,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;iBAC9B;aACF,CAAC;YACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC;oBACV,SAAS,EAAE,OAAO;oBAClB,IAAI,EAAE,WAAW,CAAC,aAAa,CAAC;oBAChC,QAAQ,EAAE,OAAO;oBACjB,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;iBAC9B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,MAAM,GAAkB;gBAC5B;oBACE,SAAS,EAAE,OAAO;oBAClB,IAAI,EACF,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC;oBACtF,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;iBACjC;aACF,CAAC;YACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC;oBACV,SAAS,EAAE,OAAO;oBAClB,IAAI,EAAE,WAAW,CAAC,aAAa,CAAC;oBAChC,QAAQ,EAAE,OAAO;oBACjB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;iBACjC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,MAAM,GAAkB;gBAC5B;oBACE,SAAS,EAAE,OAAO;oBAClB,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;oBACrC,QAAQ,EAAE,QAAQ;oBAClB,MAAM;iBACP;aACF,CAAC;YACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC;oBACV,SAAS,EAAE,OAAO;oBAClB,IAAI,EAAE,WAAW,CAAC,aAAa,CAAC;oBAChC,QAAQ,EAAE,OAAO;oBACjB,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,QAAQ,CAAC;QACd,KAAK,KAAK,CAAC;QACX,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAAkB;gBAC5B;oBACE,SAAS,EAAE,OAAO;oBAClB,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC;oBAChC,QAAQ,EAAE,OAAO;oBACjB,MAAM;iBACP;aACF,CAAC;YACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC;oBACV,SAAS,EAAE,OAAO;oBAClB,IAAI,EAAE,WAAW,CAAC,aAAa,CAAC;oBAChC,QAAQ,EAAE,OAAO;oBACjB,MAAM;iBACP,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,KAAK;YACR,8DAA8D;YAC9D,+BAA+B;YAC/B,OAAO;gBACL;oBACE,SAAS,EAAE,OAAO;oBAClB,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;oBACrC,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;iBAC7B;aACF,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,mEAAmE;IACnE,kEAAkE;IAClE,kEAAkE;IAClE,2DAA2D;IAC3D,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,KAAK;YACR,OAAO;gBACL;oBACE,SAAS,EAAE,QAAQ;oBACnB,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC;oBACnC,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;iBAC7B;aACF,CAAC;QACJ,KAAK,MAAM;YACT,OAAO;gBACL;oBACE,SAAS,EAAE,QAAQ;oBACnB,IAAI,EACF,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC;oBACtF,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;iBAC9B;aACF,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO;gBACL;oBACE,SAAS,EAAE,QAAQ;oBACnB,IAAI,EACF,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC;oBACtF,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;iBACjC;aACF,CAAC;QACJ,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY;YACf,OAAO;gBACL;oBACE,SAAS,EAAE,QAAQ;oBACnB,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;oBACrC,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;iBAC9B;aACF,CAAC;QACJ,KAAK,QAAQ,CAAC;QACd,KAAK,KAAK,CAAC;QACX,KAAK,cAAc;YACjB,OAAO;gBACL;oBACE,SAAS,EAAE,QAAQ;oBACnB,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC;oBAChC,QAAQ,EAAE,OAAO;oBACjB,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;iBAC7B;aACF,CAAC;QACJ,KAAK,KAAK;YACR,OAAO;gBACL;oBACE,SAAS,EAAE,QAAQ;oBACnB,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC;oBACrC,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;iBAC7B;aACF,CAAC;IACN,CAAC;AACH,CAAC;AASD,MAAM,UAAU,mBAAmB,CACjC,EAAsB,EACtB,MAAc,EACd,MAAc,EACd,IAAc;IAEd,OAAO;QACL,SAAS,EAAE,EAAE;QACb,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC;QACzB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,EAAsB,EACtB,SAAoB,EACpB,MAAc,EACd,IAAiB;IAEjB,OAAO;QACL,SAAS,EAAE,EAAE;QACb,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC;QACzB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,EAAsB,EACtB,SAAoB,EACpB,MAAc,EACd,IAAmC;IAEnC,OAAO;QACL,SAAS,EAAE,EAAE;QACb,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC;QAC/B,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;KACjC,CAAC;AACJ,CAAC;AA+BD,SAAS,oBAAoB,CAAC,OAAuB;IACnD,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,EAAsB,EACtB,OAAuB,EACvB,QAA6B;IAE7B,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACpD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,MAAM;YACT,OAAO;gBACL,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;aAChC,CAAC;QACJ,KAAK,MAAM;YACT,OAAO;gBACL,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;aAChC,CAAC;QACJ,KAAK,YAAY;YACf,OAAO;gBACL,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;aACrC,CAAC;QACJ,KAAK,OAAO;YACV,OAAO;gBACL,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;aACjC,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO;gBACL,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;aAClC,CAAC;QACJ,KAAK,KAAK;YACR,OAAO;gBACL,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;aAC/B,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO;gBACL,SAAS,EAAE,EAAE;gBACb,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;aACvC,CAAC;IACN,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,EAAsB,EACtB,OAAgB,EAChB,QAA6B;IAE7B,OAAO,kBAAkB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,+DAA+D;AAC/D,mBAAmB;AACnB,+DAA+D;AAE/D,SAAS,aAAa,CACpB,MAA4F;IAE5F,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,KAAK,WAAW;YACd,OAAO,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,KAAK,YAAY;YACf,OAAO,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,MAAuE;IAEvE,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,KAAK,KAAK;YACR,OAAO,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9B,KAAK,cAAc;YACjB,OAAO,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,12 @@
+export declare const OBJECT_TYPES: readonly ["tenant", "org", "team", "project", "user", "agent", "flow", "tool", "guardrail", "eval_suite", "trigger", "conversation", "secret", "env", "mcp_endpoint", "run"];
+export type ObjectType = (typeof OBJECT_TYPES)[number];
+export declare const ACTIONS: readonly ["read", "write", "delete", "admin", "execute", "invoke", "publish", "rotate", "fire", "cancel"];
+export type Action = (typeof ACTIONS)[number];
+export declare const ACTION_TO_RELATION: Record<Action, string>;
+export declare const OBJECT_ACTIONS: Record<ObjectType, readonly Action[]>;
+export interface ResourceRef {
+    readonly type: ObjectType;
+    readonly id: string;
+}
+export declare function resourceKey(ref: ResourceRef): string;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,YAAY,8KAqBf,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,eAAO,MAAM,OAAO,2GAWV,CAAC;AAEX,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9C,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAWrD,CAAC;AAIF,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAoBhE,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAEpD"}