@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/src/authorization/model/default-of.ts

@@ -0,0 +1,99 @@
+/**
+ * The `default_of` derived rule, shared by the two instance kinds. The
+ * model reads `viewer from default_of` so a blueprint's system-managed
+ * default instance is exactly as reachable as its template and never
+ * more; the tuple that link stands on is not a `kind_meta` fact — the
+ * cloud writes `<instance>#default_of@<blueprint>` iff the blueprint's
+ * `status.default_instance_id` names the instance (stigmer-cloud
+ * iam/tuple-lifecycle.ts `onDefaultInstanceLinked`, fired when the
+ * pointer persists), and open source derives it from the same pointer at
+ * check time: load the blueprint the instance names, compare.
+ *
+ * The blueprint is read through the source's memoised loader, so the
+ * row this rule loads is the very row `viewer from default_of` then
+ * resolves the blueprint's `viewer` on — one read serves both. Which spec
+ * field names the blueprint is `kind_meta`'s to say (the instance kind's
+ * `additional_parents` entry for the blueprint kind), never restated
+ * here; an instance kind without that entry is a transcript bug and
+ * throws at first use rather than deriving nothing.
+ *
+ * A user-created instance points at a blueprint whose pointer names a
+ * different row (or none), so the rule derives nothing for it and its
+ * personal configuration stays its owner's — the invariant the model's
+ * comment states. A blueprint that no longer exists grants nothing, as in
+ * the cloud, where the tuple died with the row.
+ */
+import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
+import { isMessage } from "@bufbuild/protobuf";
+
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import {
+  getKindEnum,
+  getKindMeta,
+  kindByEnumName,
+  kindEnumName,
+} from "../../pipeline/apiresource-meta.js";
+import { parentIdOf } from "../../pipeline/steps/shapes.js";
+import type { Tuple } from "../tuples.js";
+import type { DerivedRelation } from "./rewrite.js";
+
+export interface BlueprintOfInstance<Desc extends DescMessage> {
+  /** The blueprint kind (`agent`, `workflow`). */
+  readonly kind: ApiResourceKind;
+  /** Its message schema: what the loaded blueprint row decodes with. */
+  readonly schema: Desc;
+  /** The blueprint's default-instance pointer, read from the typed row; "" when unset. */
+  defaultInstanceIdOf(blueprint: MessageShape<Desc>): string;
+}
+
+export function defaultOfBlueprint<Desc extends DescMessage>(
+  blueprint: BlueprintOfInstance<Desc>,
+): DerivedRelation {
+  const blueprintType = kindEnumName(blueprint.kind);
+  return async (object, row, loader): Promise<ReadonlyArray<Tuple>> => {
+    const blueprintId = parentIdOf(
+      row,
+      blueprintSpecFieldOf(object.type, blueprint.kind),
+    );
+    if (blueprintId === "") {
+      return [];
+    }
+    const loaded = await loader.load({ type: blueprintType, id: blueprintId });
+    if (
+      loaded === undefined ||
+      !isMessage(loaded, blueprint.schema) ||
+      blueprint.defaultInstanceIdOf(loaded) !== object.id
+    ) {
+      return [];
+    }
+    return [
+      {
+        object,
+        relation: "default_of",
+        subject: {
+          form: "object",
+          object: { type: blueprintType, id: blueprintId },
+        },
+      },
+    ];
+  };
+}
+
+/** The instance kind's `kind_meta` parent entry for the blueprint kind: the spec field that names it. */
+function blueprintSpecFieldOf(
+  instanceType: string,
+  blueprintKind: ApiResourceKind,
+): string {
+  const instanceKind = kindByEnumName(instanceType);
+  const parents = getKindMeta(instanceKind).authorization?.additionalParents;
+  const entry = parents?.find(
+    (parent) => getKindEnum(parent.kind) === blueprintKind,
+  );
+  if (entry === undefined) {
+    throw new Error(
+      `${instanceType} declares default_of but kind_meta names no ${kindEnumName(blueprintKind)} parent`,
+    );
+  }
+  return entry.specField;
+}

package/src/authorization/model/environment.ts

@@ -0,0 +1,48 @@
+/**
+ * Transcript of fga/model/agentic/environment.fga — a member's credential
+ * store: owner-only writes (no admin arm), an org-visibility axis capped
+ * at the organization (`kind_meta` supports_org only — no public
+ * wildcard on the viewer line, and the evaluator would ignore one), and
+ * `can_read_secrets: creator`, the one verb that stays with the person
+ * who typed the values whatever the visibility, standing on the creator
+ * tuple `kind_meta` flags with requires_creator_tuple.
+ */
+import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import {
+  computed,
+  declareKind,
+  direct,
+  objectOf,
+  union,
+  usersetOf,
+} from "./rewrite.js";
+
+export const environmentDeclaration = declareKind({
+  kind: ApiResourceKind.environment,
+  schema: EnvironmentSchema,
+  source: "fga/model/agentic/environment.fga",
+  relations: [
+    ["organization", direct(objectOf("organization"))],
+    ["creator", direct(objectOf("identity_account"))],
+    ["owner", direct(objectOf("identity_account"))],
+    [
+      "viewer",
+      union(
+        direct(
+          objectOf("identity_account"),
+          usersetOf("organization", "member"),
+          usersetOf("organization", "viewer"),
+        ),
+        computed("owner"),
+      ),
+    ],
+    ["can_view", computed("viewer")],
+    ["can_edit", computed("owner")],
+    ["can_delete", computed("owner")],
+    ["can_read_secrets", computed("creator")],
+    ["can_grant_access", computed("owner")],
+    ["can_view_access", computed("viewer")],
+  ],
+});

package/src/authorization/model/execution_context.ts

@@ -0,0 +1,20 @@
+/**
+ * Transcript of fga/model/agentic/execution_context.fga — a run's working
+ * state, owner-only and unscoped (`kind_meta` OWNER_ONLY): two verbs,
+ * both `owner`, and no access list to grant on.
+ */
+import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import { computed, declareKind, direct, objectOf } from "./rewrite.js";
+
+export const executionContextDeclaration = declareKind({
+  kind: ApiResourceKind.execution_context,
+  schema: ExecutionContextSchema,
+  source: "fga/model/agentic/execution_context.fga",
+  relations: [
+    ["owner", direct(objectOf("identity_account"))],
+    ["can_view", computed("owner")],
+    ["can_edit", computed("owner")],
+  ],
+});

package/src/authorization/model/iam_policy.ts

@@ -0,0 +1,42 @@
+/**
+ * Transcript of fga/model/iam/iam_policy.fga — the access-list row as an
+ * object of the model: its organization's admins own and view it. Declared
+ * for completeness of the transcript set (the drift compare reads every
+ * open-source file); no wire check targets it — the IamPolicy RPCs
+ * authorize against the policy's RESOURCE (`can_grant_access` on the
+ * organization; `get` loads the row and asks about what it names), and the
+ * tuple lifecycle writes nothing for it.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
+
+import {
+  computed,
+  declareKind,
+  direct,
+  from,
+  objectOf,
+  union,
+} from "./rewrite.js";
+
+export const iamPolicyDeclaration = declareKind({
+  kind: ApiResourceKind.iam_policy,
+  schema: IamPolicySchema,
+  source: "fga/model/iam/iam_policy.fga",
+  relations: [
+    ["organization", direct(objectOf("organization"))],
+    [
+      "owner",
+      union(
+        direct(objectOf("identity_account")),
+        from("admin", "organization"),
+      ),
+    ],
+    ["viewer", from("admin", "organization")],
+    ["can_view", computed("viewer")],
+    ["can_edit", computed("owner")],
+    ["can_delete", computed("owner")],
+    ["can_grant_access", computed("owner")],
+    ["can_view_access", computed("viewer")],
+  ],
+});

package/src/authorization/model/identity_account.ts

@@ -0,0 +1,26 @@
+/**
+ * Transcript of fga/model/iam/identity_account.fga — a person's own
+ * record: every verb is `owner`, and the owner is the account itself
+ * (`kind_meta` attribution SELF, so the derivation writes
+ * `identity_account:<id>#owner@identity_account:<id>`). No organization
+ * link and no admin arm: an admin manages members through IamPolicy rows
+ * on the organization, never through the account row.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+
+import { computed, declareKind, direct, objectOf } from "./rewrite.js";
+
+export const identityAccountDeclaration = declareKind({
+  kind: ApiResourceKind.identity_account,
+  schema: IdentityAccountSchema,
+  source: "fga/model/iam/identity_account.fga",
+  relations: [
+    ["owner", direct(objectOf("identity_account"))],
+    ["can_view", computed("owner")],
+    ["can_edit", computed("owner")],
+    ["can_delete", computed("owner")],
+    ["can_grant_access", computed("owner")],
+    ["can_view_access", computed("owner")],
+  ],
+});

package/src/authorization/model/index.ts

@@ -0,0 +1,108 @@
+/**
+ * The built-in model — every kind declaration open source evaluates,
+ * registered once in the order the cloud's `fga.mod` files them, and
+ * reached by kind (the driver's `AuthzCheck.resourceKind`) or by FGA type
+ * name (an object reference inside a tuple). A kind with no declaration
+ * is one this edition does not evaluate: as a check TARGET that is a
+ * registry gap the evaluator throws on (the driver refuses unserved kinds
+ * before any evaluation, so the throw is a backstop); reached through a
+ * tuple it is simply an object with no relations.
+ *
+ * `newModel` exists for tests that need a throwaway model (a cycle, a
+ * chain past the depth bound) and for the cloud's drift test, which
+ * builds a model from the live `.fga` files and compares.
+ *
+ * Registered: every kind of the open-source tier — the twenty-four
+ * `kind_meta.tier: open_source` members — and nothing else. The four
+ * files `fga.mod` lists that have no declaration here (`platform`,
+ * `identity_provider`, `platform_client`, `invitation`) are kinds this
+ * edition does not serve: a check that targets one is refused by the
+ * driver, and a tuple that names one (`identity_provider#platform_user`)
+ * resolves to nobody. The registry test pins the list against the tier.
+ */
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import { agentDeclaration } from "./agent.js";
+import { agentChannelDeclaration } from "./agent_channel.js";
+import { agentExecutionDeclaration } from "./agent_execution.js";
+import { agentInstanceDeclaration } from "./agent_instance.js";
+import { agentShareDeclaration } from "./agent_share.js";
+import { apiKeyDeclaration } from "./api_key.js";
+import { artifactDeclaration } from "./artifact.js";
+import { channelAppDeclaration } from "./channel_app.js";
+import { environmentDeclaration } from "./environment.js";
+import { executionContextDeclaration } from "./execution_context.js";
+import { iamPolicyDeclaration } from "./iam_policy.js";
+import { identityAccountDeclaration } from "./identity_account.js";
+import { mcpServerDeclaration } from "./mcp_server.js";
+import { memoryDeclaration } from "./memory.js";
+import { oauthAppDeclaration } from "./oauth_app.js";
+import { organizationDeclaration } from "./organization.js";
+import { pluginDeclaration } from "./plugin.js";
+import { projectDeclaration } from "./project.js";
+import type { KindDeclaration } from "./rewrite.js";
+import { scheduleDeclaration } from "./schedule.js";
+import { sessionDeclaration } from "./session.js";
+import { skillDeclaration } from "./skill.js";
+import { workflowDeclaration } from "./workflow.js";
+import { workflowExecutionDeclaration } from "./workflow_execution.js";
+import { workflowInstanceDeclaration } from "./workflow_instance.js";
+
+export interface Model {
+  /** In registry order. */
+  readonly declarations: ReadonlyArray<KindDeclaration>;
+  byKind(kind: ApiResourceKind): KindDeclaration | undefined;
+  byType(type: string): KindDeclaration | undefined;
+}
+
+export function newModel(declarations: ReadonlyArray<KindDeclaration>): Model {
+  const byKind = new Map<ApiResourceKind, KindDeclaration>();
+  const byType = new Map<string, KindDeclaration>();
+  for (const declaration of declarations) {
+    if (byKind.has(declaration.kind)) {
+      throw new Error(`${declaration.type} is declared twice in the model`);
+    }
+    byKind.set(declaration.kind, declaration);
+    byType.set(declaration.type, declaration);
+  }
+  return {
+    declarations,
+    byKind: (kind) => byKind.get(kind),
+    byType: (type) => byType.get(type),
+  };
+}
+
+/** The declarations this edition evaluates, in `fga.mod` order. */
+export const builtInModel: Model = newModel([
+  identityAccountDeclaration,
+  iamPolicyDeclaration,
+  apiKeyDeclaration,
+  oauthAppDeclaration,
+  organizationDeclaration,
+  projectDeclaration,
+  agentDeclaration,
+  agentChannelDeclaration,
+  agentShareDeclaration,
+  channelAppDeclaration,
+  agentInstanceDeclaration,
+  agentExecutionDeclaration,
+  artifactDeclaration,
+  environmentDeclaration,
+  executionContextDeclaration,
+  mcpServerDeclaration,
+  memoryDeclaration,
+  scheduleDeclaration,
+  sessionDeclaration,
+  skillDeclaration,
+  workflowDeclaration,
+  workflowInstanceDeclaration,
+  workflowExecutionDeclaration,
+  pluginDeclaration,
+]);
+
+/** The built-in model's declaration for a kind, or undefined for a kind it does not evaluate. */
+export function declarationFor(
+  kind: ApiResourceKind,
+): KindDeclaration | undefined {
+  return builtInModel.byKind(kind);
+}

package/src/authorization/model/mcp_server.ts

@@ -0,0 +1,59 @@
+/**
+ * Transcript of fga/model/agentic/mcp_server.fga — a blueprint with three
+ * read-side verbs: `can_use`, `can_clone` and `can_connect` (the OAuth
+ * connect lane's gate), all `viewer`.
+ */
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import {
+  computed,
+  declareKind,
+  direct,
+  from,
+  objectOf,
+  publicWith,
+  union,
+  usersetOf,
+} from "./rewrite.js";
+
+export const mcpServerDeclaration = declareKind({
+  kind: ApiResourceKind.mcp_server,
+  schema: McpServerSchema,
+  source: "fga/model/agentic/mcp_server.fga",
+  relations: [
+    ["organization", direct(objectOf("organization"))],
+    [
+      "owner",
+      union(
+        direct(objectOf("identity_account")),
+        from("admin", "organization"),
+      ),
+    ],
+    [
+      "platform_viewer",
+      direct(usersetOf("identity_provider", "platform_user")),
+    ],
+    [
+      "viewer",
+      union(
+        direct(
+          objectOf("identity_account"),
+          publicWith("identity_account", "allow_public"),
+          usersetOf("organization", "member"),
+          usersetOf("organization", "viewer"),
+        ),
+        computed("owner"),
+        computed("platform_viewer"),
+      ),
+    ],
+    ["can_view", computed("viewer")],
+    ["can_edit", computed("owner")],
+    ["can_delete", computed("owner")],
+    ["can_use", computed("viewer")],
+    ["can_clone", computed("viewer")],
+    ["can_connect", computed("viewer")],
+    ["can_grant_access", computed("owner")],
+    ["can_view_access", computed("viewer")],
+  ],
+});

package/src/authorization/model/memory.ts

@@ -0,0 +1,27 @@
+/**
+ * Transcript of fga/model/agentic/memory.fga — subject-only: the person a
+ * memory is ABOUT is its one principal (no owner, no creator, no
+ * visibility, nothing grantable; `kind_meta` attribution NONE with
+ * `subject` as an additional parent on `spec.subject_identity_account_id`).
+ * Organization admins govern the organization's memory switch and never
+ * read content, in the contract's own words. A row whose subject field is
+ * empty derives no principal at all — the derivation's rule for an
+ * absent parent — and is then nobody's under this evaluator.
+ */
+import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import { computed, declareKind, direct, objectOf } from "./rewrite.js";
+
+export const memoryDeclaration = declareKind({
+  kind: ApiResourceKind.memory,
+  schema: MemorySchema,
+  source: "fga/model/agentic/memory.fga",
+  relations: [
+    ["organization", direct(objectOf("organization"))],
+    ["subject", direct(objectOf("identity_account"))],
+    ["can_view", computed("subject")],
+    ["can_edit", computed("subject")],
+    ["can_delete", computed("subject")],
+  ],
+});

package/src/authorization/model/oauth_app.ts

@@ -0,0 +1,42 @@
+/**
+ * Transcript of fga/model/iam/oauth_app.fga — the one organization-scoped
+ * kind whose `owner` has NO admin arm while its `viewer` does: the file's
+ * "administrative visibility" for the organization's admins over a
+ * registration that holds vendor client credentials, with change and
+ * deletion the creator's (or an explicit grant's) alone, and no public
+ * level at all.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
+
+import {
+  computed,
+  declareKind,
+  direct,
+  from,
+  objectOf,
+  union,
+} from "./rewrite.js";
+
+export const oauthAppDeclaration = declareKind({
+  kind: ApiResourceKind.oauth_app,
+  schema: OAuthAppSchema,
+  source: "fga/model/iam/oauth_app.fga",
+  relations: [
+    ["organization", direct(objectOf("organization"))],
+    ["owner", direct(objectOf("identity_account"))],
+    [
+      "viewer",
+      union(
+        direct(objectOf("identity_account")),
+        computed("owner"),
+        from("admin", "organization"),
+      ),
+    ],
+    ["can_view", computed("viewer")],
+    ["can_edit", computed("owner")],
+    ["can_delete", computed("owner")],
+    ["can_grant_access", computed("owner")],
+    ["can_view_access", computed("viewer")],
+  ],
+});

package/src/authorization/model/organization.ts

@@ -0,0 +1,55 @@
+/**
+ * Transcript of fga/model/tenancy/organization.fga — the root of the
+ * model: no parent, the four roles as a ladder (`owner ⊂ admin ⊂ member
+ * ⊂ viewer`, each `[identity_account] or <the rung above>`), and every
+ * `can_create_*` an organization gates.
+ *
+ * In open source the `[identity_account]` tuples of this type ARE the
+ * IamPolicy rows: 2b's role lifecycle writes the creator's `owner` row and
+ * the grant path writes every other role, so the tuple source reads them
+ * from the IamPolicyStore and the derivation writes no owner tuple for
+ * this kind (derived-tuples.ts). `guest` is the cloud's anonymous
+ * share-link visitor; no open-source lane mints one (claim check C5), so
+ * the relation resolves to nothing and `can_create_session: member or
+ * guest` is `member` here — the transcript still carries the line.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+
+import { computed, declareKind, direct, objectOf, union } from "./rewrite.js";
+
+export const organizationDeclaration = declareKind({
+  kind: ApiResourceKind.organization,
+  schema: OrganizationSchema,
+  source: "fga/model/tenancy/organization.fga",
+  relations: [
+    ["owner", direct(objectOf("identity_account"))],
+    ["admin", union(direct(objectOf("identity_account")), computed("owner"))],
+    ["member", union(direct(objectOf("identity_account")), computed("admin"))],
+    ["viewer", union(direct(objectOf("identity_account")), computed("member"))],
+    ["guest", direct(objectOf("identity_account"))],
+    ["can_view", computed("viewer")],
+    ["can_edit", computed("admin")],
+    ["can_delete", computed("owner")],
+    ["can_manage_members", computed("admin")],
+    ["can_assign_roles", computed("owner")],
+    ["can_create_project", computed("admin")],
+    ["can_create_agent", computed("admin")],
+    ["can_create_workflow", computed("admin")],
+    ["can_create_session", union(computed("member"), computed("guest"))],
+    ["can_create_environment", computed("member")],
+    ["can_create_skill", computed("admin")],
+    ["can_create_plugin", computed("admin")],
+    ["can_create_idp", computed("admin")],
+    ["can_create_identity_account", computed("admin")],
+    ["can_create_oauth_app", computed("admin")],
+    ["can_create_platform_client", computed("admin")],
+    ["can_create_channel_app", computed("admin")],
+    ["can_create_execution_in", union(computed("member"), computed("guest"))],
+    ["can_create_agent_share", computed("admin")],
+    ["can_grant_access", computed("admin")],
+    ["can_view_access", computed("viewer")],
+    ["can_view_billing", computed("viewer")],
+    ["can_manage_billing", computed("admin")],
+  ],
+});

package/src/authorization/model/plugin.ts

@@ -0,0 +1,66 @@
+/**
+ * Transcript of fga/model/agentic/plugin.fga — the unit of install, shaped
+ * exactly like a skill: an organization-owned blueprint whose owner is the
+ * installer (and, through the organization, its admins), whose viewers are
+ * the org's members and viewers, public readers when published, and the
+ * platform viewer. Its verbs are the blueprint set: `can_view`, `can_edit`
+ * (visibility), `can_delete` (uninstall), `can_grant_access`,
+ * `can_view_access`; `can_use` is carried as the model's word for
+ * "install from" though no wire permission names it yet.
+ *
+ * The members a plugin materialises are NOT reached through this type:
+ * each is an ordinary skill, MCP server, agent or workflow with its own
+ * tuples, written by its own chain as the installing caller.
+ */
+import { PluginSchema } from "@stigmer/protos/ai/stigmer/agentic/plugin/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import {
+  computed,
+  declareKind,
+  direct,
+  from,
+  objectOf,
+  publicWith,
+  union,
+  usersetOf,
+} from "./rewrite.js";
+
+export const pluginDeclaration = declareKind({
+  kind: ApiResourceKind.plugin,
+  schema: PluginSchema,
+  source: "fga/model/agentic/plugin.fga",
+  relations: [
+    ["organization", direct(objectOf("organization"))],
+    [
+      "owner",
+      union(
+        direct(objectOf("identity_account")),
+        from("admin", "organization"),
+      ),
+    ],
+    [
+      "platform_viewer",
+      direct(usersetOf("identity_provider", "platform_user")),
+    ],
+    [
+      "viewer",
+      union(
+        direct(
+          objectOf("identity_account"),
+          publicWith("identity_account", "allow_public"),
+          usersetOf("organization", "member"),
+          usersetOf("organization", "viewer"),
+        ),
+        computed("owner"),
+        computed("platform_viewer"),
+      ),
+    ],
+    ["can_view", computed("viewer")],
+    ["can_edit", computed("owner")],
+    ["can_delete", computed("owner")],
+    ["can_use", computed("viewer")],
+    ["can_grant_access", computed("owner")],
+    ["can_view_access", computed("viewer")],
+  ],
+});

package/src/authorization/model/project.ts

@@ -0,0 +1,47 @@
+/**
+ * Transcript of fga/model/tenancy/project.fga — an organization's
+ * grouping: admins own it, and `viewer from organization` lets every
+ * organization viewer read it without a visibility tuple (projects have
+ * no visibility axis in `kind_meta`; the whole organization is their
+ * audience by the model's own line).
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ProjectSchema } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/api_pb";
+
+import {
+  computed,
+  declareKind,
+  direct,
+  from,
+  objectOf,
+  union,
+} from "./rewrite.js";
+
+export const projectDeclaration = declareKind({
+  kind: ApiResourceKind.project,
+  schema: ProjectSchema,
+  source: "fga/model/tenancy/project.fga",
+  relations: [
+    ["organization", direct(objectOf("organization"))],
+    [
+      "owner",
+      union(
+        direct(objectOf("identity_account")),
+        from("admin", "organization"),
+      ),
+    ],
+    [
+      "viewer",
+      union(
+        direct(objectOf("identity_account")),
+        computed("owner"),
+        from("viewer", "organization"),
+      ),
+    ],
+    ["can_view", computed("viewer")],
+    ["can_edit", computed("owner")],
+    ["can_delete", computed("owner")],
+    ["can_grant_access", computed("owner")],
+    ["can_view_access", computed("viewer")],
+  ],
+});