@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/dist/authorization/model/agent_instance.d.ts

@@ -0,0 +1,2 @@
+export declare const agentInstanceDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=agent_instance.d.ts.map

package/dist/authorization/model/agent_instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent_instance.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent_instance.ts"],"names":[],"mappings":"AA0BA,eAAO,MAAM,wBAAwB,wCAuCnC,CAAC"}

package/dist/authorization/model/agent_instance.js

@@ -0,0 +1,47 @@
+/**
+ * Transcript of fga/model/agentic/agent_instance.fga — a person's
+ * configuration of an agent: owner-only in every write (no admin arm,
+ * unlike the blueprint), readable through its own visibility axis or, for
+ * the system-managed default instance, through the blueprint's whole
+ * viewer set (`viewer from default_of`; default-of.ts). `agent` is the
+ * parent link written on every instance for tracking and walked by
+ * nothing; `default_of` is the derived link written on the default
+ * instance alone.
+ */
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { defaultOfBlueprint } from "./default-of.js";
+import { computed, declareKind, direct, from, objectOf, publicWith, union, usersetOf, } from "./rewrite.js";
+export const agentInstanceDeclaration = declareKind({
+    kind: ApiResourceKind.agent_instance,
+    schema: AgentInstanceSchema,
+    source: "fga/model/agentic/agent_instance.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        ["agent", direct(objectOf("agent"))],
+        ["default_of", direct(objectOf("agent"))],
+        ["owner", direct(objectOf("identity_account"))],
+        [
+            "viewer",
+            union(direct(objectOf("identity_account"), publicWith("identity_account", "allow_public"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), from("viewer", "default_of")),
+        ],
+        ["can_view", computed("viewer")],
+        ["can_execute", computed("can_view")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+    derived: [
+        [
+            "default_of",
+            defaultOfBlueprint({
+                kind: ApiResourceKind.agent,
+                schema: AgentSchema,
+                defaultInstanceIdOf: (agent) => agent.status?.defaultInstanceId ?? "",
+            }),
+        ],
+    ],
+});
+//# sourceMappingURL=agent_instance.js.map

package/dist/authorization/model/agent_instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent_instance.js","sourceRoot":"","sources":["../../../src/authorization/model/agent_instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC;IAClD,IAAI,EAAE,eAAe,CAAC,cAAc;IACpC,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,sCAAsC;IAC9C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACpC,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,UAAU,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAC9C,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAC7B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;IACD,OAAO,EAAE;QACP;YACE,YAAY;YACZ,kBAAkB,CAAC;gBACjB,IAAI,EAAE,eAAe,CAAC,KAAK;gBAC3B,MAAM,EAAE,WAAW;gBACnB,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE;aACtE,CAAC;SACH;KACF;CACF,CAAC,CAAC"}

package/dist/authorization/model/agent_share.d.ts

@@ -0,0 +1,2 @@
+export declare const agentShareDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=agent_share.d.ts.map

package/dist/authorization/model/agent_share.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent_share.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent_share.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,qBAAqB,wCAoBhC,CAAC"}

package/dist/authorization/model/agent_share.js

@@ -0,0 +1,29 @@
+/**
+ * Transcript of fga/model/agentic/agent_share.fga — a share link's
+ * configuration row, admin-owned; its anonymous visitors are the cloud's
+ * `guest` credential on the organization, a class no open-source lane
+ * mints, so on this edition a share is visible to its owners and explicit
+ * grantees only.
+ */
+import { AgentShareSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
+export const agentShareDeclaration = declareKind({
+    kind: ApiResourceKind.agent_share,
+    schema: AgentShareSchema,
+    source: "fga/model/agentic/agent_share.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        [
+            "owner",
+            union(direct(objectOf("identity_account")), from("admin", "organization")),
+        ],
+        ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
+        ["can_view", computed("viewer")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+});
+//# sourceMappingURL=agent_share.js.map

package/dist/authorization/model/agent_share.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent_share.js","sourceRoot":"","sources":["../../../src/authorization/model/agent_share.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;IAC/C,IAAI,EAAE,eAAe,CAAC,WAAW;IACjC,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,mCAAmC;IAC3C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/api_key.d.ts

@@ -0,0 +1,2 @@
+export declare const apiKeyDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=api_key.d.ts.map

package/dist/authorization/model/api_key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api_key.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/api_key.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,iBAAiB,wCAe5B,CAAC"}

package/dist/authorization/model/api_key.js

@@ -0,0 +1,27 @@
+/**
+ * Transcript of fga/model/iam/api_key.fga — a credential, owner-only in
+ * every verb: no organization link (`kind_meta` scope OWNER_ONLY) and no
+ * admin arm, so the key a person minted is theirs to view, rotate, revoke
+ * and use, and nobody else's. `can_rotate`, `can_revoke` and `can_use` are
+ * the file's own verbs; the wire vocabulary names only the first three.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiKeySchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
+import { computed, declareKind, direct, objectOf } from "./rewrite.js";
+export const apiKeyDeclaration = declareKind({
+    kind: ApiResourceKind.api_key,
+    schema: ApiKeySchema,
+    source: "fga/model/iam/api_key.fga",
+    relations: [
+        ["owner", direct(objectOf("identity_account"))],
+        ["can_view", computed("owner")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_rotate", computed("owner")],
+        ["can_revoke", computed("owner")],
+        ["can_use", computed("owner")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("owner")],
+    ],
+});
+//# sourceMappingURL=api_key.js.map

package/dist/authorization/model/api_key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api_key.js","sourceRoot":"","sources":["../../../src/authorization/model/api_key.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAC;AAE/E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,IAAI,EAAE,eAAe,CAAC,OAAO;IAC7B,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,2BAA2B;IACnC,SAAS,EAAE;QACT,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KACvC;CACF,CAAC,CAAC"}

package/dist/authorization/model/artifact.d.ts

@@ -0,0 +1,2 @@
+export declare const artifactDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=artifact.d.ts.map

package/dist/authorization/model/artifact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/artifact.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,mBAAmB,wCAiB9B,CAAC"}

package/dist/authorization/model/artifact.js

@@ -0,0 +1,27 @@
+/**
+ * Transcript of fga/model/agentic/artifact.fga — an organization's shared
+ * output: read by its creator and by every organization viewer (`viewer
+ * from organization`, no visibility tuple involved — the kind has no
+ * visibility axis), edited by the organization's admins alone (the
+ * creator does NOT edit through `owner`), and with no `can_delete` line
+ * at all. The wire annotates only `can_view` and `can_edit` on it.
+ */
+import { ArtifactSchema } from "@stigmer/protos/ai/stigmer/agentic/artifact/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
+export const artifactDeclaration = declareKind({
+    kind: ApiResourceKind.artifact,
+    schema: ArtifactSchema,
+    source: "fga/model/agentic/artifact.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        ["owner", direct(objectOf("identity_account"))],
+        [
+            "viewer",
+            union(direct(objectOf("identity_account")), from("viewer", "organization")),
+        ],
+        ["can_view", union(computed("owner"), computed("viewer"))],
+        ["can_edit", from("admin", "organization")],
+    ],
+});
+//# sourceMappingURL=artifact.js.map

package/dist/authorization/model/artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact.js","sourceRoot":"","sources":["../../../src/authorization/model/artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,IAAI,EAAE,eAAe,CAAC,QAAQ;IAC9B,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,gCAAgC;IACxC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAC/B;SACF;QACD,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1D,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;KAC5C;CACF,CAAC,CAAC"}

package/dist/authorization/model/channel_app.d.ts

@@ -0,0 +1,2 @@
+export declare const channelAppDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=channel_app.d.ts.map

package/dist/authorization/model/channel_app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel_app.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/channel_app.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,qBAAqB,wCAoBhC,CAAC"}

package/dist/authorization/model/channel_app.js

@@ -0,0 +1,28 @@
+/**
+ * Transcript of fga/model/agentic/channel_app.fga — a messaging-platform
+ * app registration, admin-owned, viewable by its owners and explicit
+ * grantees: the same shape as agent_share, kept as its own file so the
+ * drift compare reads this file's lines.
+ */
+import { ChannelAppSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
+export const channelAppDeclaration = declareKind({
+    kind: ApiResourceKind.channel_app,
+    schema: ChannelAppSchema,
+    source: "fga/model/agentic/channel_app.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        [
+            "owner",
+            union(direct(objectOf("identity_account")), from("admin", "organization")),
+        ],
+        ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
+        ["can_view", computed("viewer")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+});
+//# sourceMappingURL=channel_app.js.map

package/dist/authorization/model/channel_app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel_app.js","sourceRoot":"","sources":["../../../src/authorization/model/channel_app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;IAC/C,IAAI,EAAE,eAAe,CAAC,WAAW;IACjC,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,mCAAmC;IAC3C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/default-of.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The `default_of` derived rule, shared by the two instance kinds. The
+ * model reads `viewer from default_of` so a blueprint's system-managed
+ * default instance is exactly as reachable as its template and never
+ * more; the tuple that link stands on is not a `kind_meta` fact — the
+ * cloud writes `<instance>#default_of@<blueprint>` iff the blueprint's
+ * `status.default_instance_id` names the instance (stigmer-cloud
+ * iam/tuple-lifecycle.ts `onDefaultInstanceLinked`, fired when the
+ * pointer persists), and open source derives it from the same pointer at
+ * check time: load the blueprint the instance names, compare.
+ *
+ * The blueprint is read through the source's memoised loader, so the
+ * row this rule loads is the very row `viewer from default_of` then
+ * resolves the blueprint's `viewer` on — one read serves both. Which spec
+ * field names the blueprint is `kind_meta`'s to say (the instance kind's
+ * `additional_parents` entry for the blueprint kind), never restated
+ * here; an instance kind without that entry is a transcript bug and
+ * throws at first use rather than deriving nothing.
+ *
+ * A user-created instance points at a blueprint whose pointer names a
+ * different row (or none), so the rule derives nothing for it and its
+ * personal configuration stays its owner's — the invariant the model's
+ * comment states. A blueprint that no longer exists grants nothing, as in
+ * the cloud, where the tuple died with the row.
+ */
+import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { DerivedRelation } from "./rewrite.js";
+export interface BlueprintOfInstance<Desc extends DescMessage> {
+    /** The blueprint kind (`agent`, `workflow`). */
+    readonly kind: ApiResourceKind;
+    /** Its message schema: what the loaded blueprint row decodes with. */
+    readonly schema: Desc;
+    /** The blueprint's default-instance pointer, read from the typed row; "" when unset. */
+    defaultInstanceIdOf(blueprint: MessageShape<Desc>): string;
+}
+export declare function defaultOfBlueprint<Desc extends DescMessage>(blueprint: BlueprintOfInstance<Desc>): DerivedRelation;
+//# sourceMappingURL=default-of.d.ts.map

package/dist/authorization/model/default-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-of.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/default-of.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAU3H,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,MAAM,WAAW,mBAAmB,CAAC,IAAI,SAAS,WAAW;IAC3D,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,wFAAwF;IACxF,mBAAmB,CAAC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;CAC5D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,SAAS,WAAW,EACzD,SAAS,EAAE,mBAAmB,CAAC,IAAI,CAAC,GACnC,eAAe,CA6BjB"}

package/dist/authorization/model/default-of.js

@@ -0,0 +1,39 @@
+import { isMessage } from "@bufbuild/protobuf";
+import { getKindEnum, getKindMeta, kindByEnumName, kindEnumName, } from "../../pipeline/apiresource-meta.js";
+import { parentIdOf } from "../../pipeline/steps/shapes.js";
+export function defaultOfBlueprint(blueprint) {
+    const blueprintType = kindEnumName(blueprint.kind);
+    return async (object, row, loader) => {
+        const blueprintId = parentIdOf(row, blueprintSpecFieldOf(object.type, blueprint.kind));
+        if (blueprintId === "") {
+            return [];
+        }
+        const loaded = await loader.load({ type: blueprintType, id: blueprintId });
+        if (loaded === undefined ||
+            !isMessage(loaded, blueprint.schema) ||
+            blueprint.defaultInstanceIdOf(loaded) !== object.id) {
+            return [];
+        }
+        return [
+            {
+                object,
+                relation: "default_of",
+                subject: {
+                    form: "object",
+                    object: { type: blueprintType, id: blueprintId },
+                },
+            },
+        ];
+    };
+}
+/** The instance kind's `kind_meta` parent entry for the blueprint kind: the spec field that names it. */
+function blueprintSpecFieldOf(instanceType, blueprintKind) {
+    const instanceKind = kindByEnumName(instanceType);
+    const parents = getKindMeta(instanceKind).authorization?.additionalParents;
+    const entry = parents?.find((parent) => getKindEnum(parent.kind) === blueprintKind);
+    if (entry === undefined) {
+        throw new Error(`${instanceType} declares default_of but kind_meta names no ${kindEnumName(blueprintKind)} parent`);
+    }
+    return entry.specField;
+}
+//# sourceMappingURL=default-of.js.map

package/dist/authorization/model/default-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-of.js","sourceRoot":"","sources":["../../../src/authorization/model/default-of.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAI/C,OAAO,EACL,WAAW,EACX,WAAW,EACX,cAAc,EACd,YAAY,GACb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAa5D,MAAM,UAAU,kBAAkB,CAChC,SAAoC;IAEpC,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAiC,EAAE;QAClE,MAAM,WAAW,GAAG,UAAU,CAC5B,GAAG,EACH,oBAAoB,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAClD,CAAC;QACF,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3E,IACE,MAAM,KAAK,SAAS;YACpB,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC;YACpC,SAAS,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,EAAE,EACnD,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO;YACL;gBACE,MAAM;gBACN,QAAQ,EAAE,YAAY;gBACtB,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE;iBACjD;aACF;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,SAAS,oBAAoB,CAC3B,YAAoB,EACpB,aAA8B;IAE9B,MAAM,YAAY,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE,iBAAiB,CAAC;IAC3E,MAAM,KAAK,GAAG,OAAO,EAAE,IAAI,CACzB,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,aAAa,CACvD,CAAC;IACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,GAAG,YAAY,+CAA+C,YAAY,CAAC,aAAa,CAAC,SAAS,CACnG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,SAAS,CAAC;AACzB,CAAC"}

package/dist/authorization/model/environment.d.ts

@@ -0,0 +1,2 @@
+export declare const environmentDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=environment.d.ts.map

package/dist/authorization/model/environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/environment.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,sBAAsB,wCA0BjC,CAAC"}

package/dist/authorization/model/environment.js

@@ -0,0 +1,33 @@
+/**
+ * Transcript of fga/model/agentic/environment.fga — a member's credential
+ * store: owner-only writes (no admin arm), an org-visibility axis capped
+ * at the organization (`kind_meta` supports_org only — no public
+ * wildcard on the viewer line, and the evaluator would ignore one), and
+ * `can_read_secrets: creator`, the one verb that stays with the person
+ * who typed the values whatever the visibility, standing on the creator
+ * tuple `kind_meta` flags with requires_creator_tuple.
+ */
+import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, objectOf, union, usersetOf, } from "./rewrite.js";
+export const environmentDeclaration = declareKind({
+    kind: ApiResourceKind.environment,
+    schema: EnvironmentSchema,
+    source: "fga/model/agentic/environment.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        ["creator", direct(objectOf("identity_account"))],
+        ["owner", direct(objectOf("identity_account"))],
+        [
+            "viewer",
+            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner")),
+        ],
+        ["can_view", computed("viewer")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_read_secrets", computed("creator")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+});
+//# sourceMappingURL=environment.js.map

package/dist/authorization/model/environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/authorization/model/environment.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAChD,IAAI,EAAE,eAAe,CAAC,WAAW;IACjC,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,mCAAmC;IAC3C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACjD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,CAClB;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/execution_context.d.ts

@@ -0,0 +1,2 @@
+export declare const executionContextDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=execution_context.d.ts.map

package/dist/authorization/model/execution_context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution_context.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/execution_context.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,2BAA2B,wCAStC,CAAC"}

package/dist/authorization/model/execution_context.js

@@ -0,0 +1,19 @@
+/**
+ * Transcript of fga/model/agentic/execution_context.fga — a run's working
+ * state, owner-only and unscoped (`kind_meta` OWNER_ONLY): two verbs,
+ * both `owner`, and no access list to grant on.
+ */
+import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, objectOf } from "./rewrite.js";
+export const executionContextDeclaration = declareKind({
+    kind: ApiResourceKind.execution_context,
+    schema: ExecutionContextSchema,
+    source: "fga/model/agentic/execution_context.fga",
+    relations: [
+        ["owner", direct(objectOf("identity_account"))],
+        ["can_view", computed("owner")],
+        ["can_edit", computed("owner")],
+    ],
+});
+//# sourceMappingURL=execution_context.js.map

package/dist/authorization/model/execution_context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution_context.js","sourceRoot":"","sources":["../../../src/authorization/model/execution_context.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;IACrD,IAAI,EAAE,eAAe,CAAC,iBAAiB;IACvC,MAAM,EAAE,sBAAsB;IAC9B,MAAM,EAAE,yCAAyC;IACjD,SAAS,EAAE;QACT,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAChC;CACF,CAAC,CAAC"}

package/dist/authorization/model/iam_policy.d.ts

@@ -0,0 +1,2 @@
+export declare const iamPolicyDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=iam_policy.d.ts.map

package/dist/authorization/model/iam_policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam_policy.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/iam_policy.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,oBAAoB,wCAoB/B,CAAC"}

package/dist/authorization/model/iam_policy.js

@@ -0,0 +1,31 @@
+/**
+ * Transcript of fga/model/iam/iam_policy.fga — the access-list row as an
+ * object of the model: its organization's admins own and view it. Declared
+ * for completeness of the transcript set (the drift compare reads every
+ * open-source file); no wire check targets it — the IamPolicy RPCs
+ * authorize against the policy's RESOURCE (`can_grant_access` on the
+ * organization; `get` loads the row and asks about what it names), and the
+ * tuple lifecycle writes nothing for it.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
+export const iamPolicyDeclaration = declareKind({
+    kind: ApiResourceKind.iam_policy,
+    schema: IamPolicySchema,
+    source: "fga/model/iam/iam_policy.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        [
+            "owner",
+            union(direct(objectOf("identity_account")), from("admin", "organization")),
+        ],
+        ["viewer", from("admin", "organization")],
+        ["can_view", computed("viewer")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+});
+//# sourceMappingURL=iam_policy.js.map

package/dist/authorization/model/iam_policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam_policy.js","sourceRoot":"","sources":["../../../src/authorization/model/iam_policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAErF,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;IAC9C,IAAI,EAAE,eAAe,CAAC,UAAU;IAChC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,8BAA8B;IACtC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/identity_account.d.ts

@@ -0,0 +1,2 @@
+export declare const identityAccountDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=identity_account.d.ts.map

package/dist/authorization/model/identity_account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity_account.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/identity_account.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,0BAA0B,wCAYrC,CAAC"}

package/dist/authorization/model/identity_account.js

@@ -0,0 +1,25 @@
+/**
+ * Transcript of fga/model/iam/identity_account.fga — a person's own
+ * record: every verb is `owner`, and the owner is the account itself
+ * (`kind_meta` attribution SELF, so the derivation writes
+ * `identity_account:<id>#owner@identity_account:<id>`). No organization
+ * link and no admin arm: an admin manages members through IamPolicy rows
+ * on the organization, never through the account row.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { computed, declareKind, direct, objectOf } from "./rewrite.js";
+export const identityAccountDeclaration = declareKind({
+    kind: ApiResourceKind.identity_account,
+    schema: IdentityAccountSchema,
+    source: "fga/model/iam/identity_account.fga",
+    relations: [
+        ["owner", direct(objectOf("identity_account"))],
+        ["can_view", computed("owner")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("owner")],
+    ],
+});
+//# sourceMappingURL=identity_account.js.map

package/dist/authorization/model/identity_account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity_account.js","sourceRoot":"","sources":["../../../src/authorization/model/identity_account.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AAEjG,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;IACpD,IAAI,EAAE,eAAe,CAAC,gBAAgB;IACtC,MAAM,EAAE,qBAAqB;IAC7B,MAAM,EAAE,oCAAoC;IAC5C,SAAS,EAAE;QACT,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KACvC;CACF,CAAC,CAAC"}

package/dist/authorization/model/index.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The built-in model — every kind declaration open source evaluates,
+ * registered once in the order the cloud's `fga.mod` files them, and
+ * reached by kind (the driver's `AuthzCheck.resourceKind`) or by FGA type
+ * name (an object reference inside a tuple). A kind with no declaration
+ * is one this edition does not evaluate: as a check TARGET that is a
+ * registry gap the evaluator throws on (the driver refuses unserved kinds
+ * before any evaluation, so the throw is a backstop); reached through a
+ * tuple it is simply an object with no relations.
+ *
+ * `newModel` exists for tests that need a throwaway model (a cycle, a
+ * chain past the depth bound) and for the cloud's drift test, which
+ * builds a model from the live `.fga` files and compares.
+ *
+ * Registered: every kind of the open-source tier — the twenty-four
+ * `kind_meta.tier: open_source` members — and nothing else. The four
+ * files `fga.mod` lists that have no declaration here (`platform`,
+ * `identity_provider`, `platform_client`, `invitation`) are kinds this
+ * edition does not serve: a check that targets one is refused by the
+ * driver, and a tuple that names one (`identity_provider#platform_user`)
+ * resolves to nobody. The registry test pins the list against the tier.
+ */
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { KindDeclaration } from "./rewrite.js";
+export interface Model {
+    /** In registry order. */
+    readonly declarations: ReadonlyArray<KindDeclaration>;
+    byKind(kind: ApiResourceKind): KindDeclaration | undefined;
+    byType(type: string): KindDeclaration | undefined;
+}
+export declare function newModel(declarations: ReadonlyArray<KindDeclaration>): Model;
+/** The declarations this edition evaluates, in `fga.mod` order. */
+export declare const builtInModel: Model;
+/** The built-in model's declaration for a kind, or undefined for a kind it does not evaluate. */
+export declare function declarationFor(kind: ApiResourceKind): KindDeclaration | undefined;
+//# sourceMappingURL=index.d.ts.map

package/dist/authorization/model/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAoB3H,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAQpD,MAAM,WAAW,KAAK;IACpB,yBAAyB;IACzB,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACtD,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,GAAG,SAAS,CAAC;IAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAAC;CACnD;AAED,wBAAgB,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,eAAe,CAAC,GAAG,KAAK,CAe5E;AAED,mEAAmE;AACnE,eAAO,MAAM,YAAY,EAAE,KAyBzB,CAAC;AAEH,iGAAiG;AACjG,wBAAgB,cAAc,CAC5B,IAAI,EAAE,eAAe,GACpB,eAAe,GAAG,SAAS,CAE7B"}

package/dist/authorization/model/index.js

@@ -0,0 +1,72 @@
+import { agentDeclaration } from "./agent.js";
+import { agentChannelDeclaration } from "./agent_channel.js";
+import { agentExecutionDeclaration } from "./agent_execution.js";
+import { agentInstanceDeclaration } from "./agent_instance.js";
+import { agentShareDeclaration } from "./agent_share.js";
+import { apiKeyDeclaration } from "./api_key.js";
+import { artifactDeclaration } from "./artifact.js";
+import { channelAppDeclaration } from "./channel_app.js";
+import { environmentDeclaration } from "./environment.js";
+import { executionContextDeclaration } from "./execution_context.js";
+import { iamPolicyDeclaration } from "./iam_policy.js";
+import { identityAccountDeclaration } from "./identity_account.js";
+import { mcpServerDeclaration } from "./mcp_server.js";
+import { memoryDeclaration } from "./memory.js";
+import { oauthAppDeclaration } from "./oauth_app.js";
+import { organizationDeclaration } from "./organization.js";
+import { pluginDeclaration } from "./plugin.js";
+import { projectDeclaration } from "./project.js";
+import { scheduleDeclaration } from "./schedule.js";
+import { sessionDeclaration } from "./session.js";
+import { skillDeclaration } from "./skill.js";
+import { workflowDeclaration } from "./workflow.js";
+import { workflowExecutionDeclaration } from "./workflow_execution.js";
+import { workflowInstanceDeclaration } from "./workflow_instance.js";
+export function newModel(declarations) {
+    const byKind = new Map();
+    const byType = new Map();
+    for (const declaration of declarations) {
+        if (byKind.has(declaration.kind)) {
+            throw new Error(`${declaration.type} is declared twice in the model`);
+        }
+        byKind.set(declaration.kind, declaration);
+        byType.set(declaration.type, declaration);
+    }
+    return {
+        declarations,
+        byKind: (kind) => byKind.get(kind),
+        byType: (type) => byType.get(type),
+    };
+}
+/** The declarations this edition evaluates, in `fga.mod` order. */
+export const builtInModel = newModel([
+    identityAccountDeclaration,
+    iamPolicyDeclaration,
+    apiKeyDeclaration,
+    oauthAppDeclaration,
+    organizationDeclaration,
+    projectDeclaration,
+    agentDeclaration,
+    agentChannelDeclaration,
+    agentShareDeclaration,
+    channelAppDeclaration,
+    agentInstanceDeclaration,
+    agentExecutionDeclaration,
+    artifactDeclaration,
+    environmentDeclaration,
+    executionContextDeclaration,
+    mcpServerDeclaration,
+    memoryDeclaration,
+    scheduleDeclaration,
+    sessionDeclaration,
+    skillDeclaration,
+    workflowDeclaration,
+    workflowInstanceDeclaration,
+    workflowExecutionDeclaration,
+    pluginDeclaration,
+]);
+/** The built-in model's declaration for a kind, or undefined for a kind it does not evaluate. */
+export function declarationFor(kind) {
+    return builtInModel.byKind(kind);
+}
+//# sourceMappingURL=index.js.map

package/dist/authorization/model/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authorization/model/index.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AASrE,MAAM,UAAU,QAAQ,CAAC,YAA4C;IACnE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,CAAC,IAAI,iCAAiC,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO;QACL,YAAY;QACZ,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,YAAY,GAAU,QAAQ,CAAC;IAC1C,0BAA0B;IAC1B,oBAAoB;IACpB,iBAAiB;IACjB,mBAAmB;IACnB,uBAAuB;IACvB,kBAAkB;IAClB,gBAAgB;IAChB,uBAAuB;IACvB,qBAAqB;IACrB,qBAAqB;IACrB,wBAAwB;IACxB,yBAAyB;IACzB,mBAAmB;IACnB,sBAAsB;IACtB,2BAA2B;IAC3B,oBAAoB;IACpB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB;IACnB,2BAA2B;IAC3B,4BAA4B;IAC5B,iBAAiB;CAClB,CAAC,CAAC;AAEH,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAC5B,IAAqB;IAErB,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/authorization/model/mcp_server.d.ts

@@ -0,0 +1,2 @@
+export declare const mcpServerDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=mcp_server.d.ts.map

package/dist/authorization/model/mcp_server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp_server.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/mcp_server.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,oBAAoB,wCAuC/B,CAAC"}