@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/dist/authorization/model/mcp_server.js

@@ -0,0 +1,37 @@
+/**
+ * Transcript of fga/model/agentic/mcp_server.fga — a blueprint with three
+ * read-side verbs: `can_use`, `can_clone` and `can_connect` (the OAuth
+ * connect lane's gate), all `viewer`.
+ */
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, from, objectOf, publicWith, union, usersetOf, } from "./rewrite.js";
+export const mcpServerDeclaration = declareKind({
+    kind: ApiResourceKind.mcp_server,
+    schema: McpServerSchema,
+    source: "fga/model/agentic/mcp_server.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        [
+            "owner",
+            union(direct(objectOf("identity_account")), from("admin", "organization")),
+        ],
+        [
+            "platform_viewer",
+            direct(usersetOf("identity_provider", "platform_user")),
+        ],
+        [
+            "viewer",
+            union(direct(objectOf("identity_account"), publicWith("identity_account", "allow_public"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), computed("platform_viewer")),
+        ],
+        ["can_view", computed("viewer")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_use", computed("viewer")],
+        ["can_clone", computed("viewer")],
+        ["can_connect", computed("viewer")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+});
+//# sourceMappingURL=mcp_server.js.map

package/dist/authorization/model/mcp_server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp_server.js","sourceRoot":"","sources":["../../../src/authorization/model/mcp_server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;IAC9C,IAAI,EAAE,eAAe,CAAC,UAAU;IAChC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,kCAAkC;IAC1C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,UAAU,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAC9C,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/memory.d.ts

@@ -0,0 +1,2 @@
+export declare const memoryDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=memory.d.ts.map

package/dist/authorization/model/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/memory.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,iBAAiB,wCAW5B,CAAC"}

package/dist/authorization/model/memory.js

@@ -0,0 +1,26 @@
+/**
+ * Transcript of fga/model/agentic/memory.fga — subject-only: the person a
+ * memory is ABOUT is its one principal (no owner, no creator, no
+ * visibility, nothing grantable; `kind_meta` attribution NONE with
+ * `subject` as an additional parent on `spec.subject_identity_account_id`).
+ * Organization admins govern the organization's memory switch and never
+ * read content, in the contract's own words. A row whose subject field is
+ * empty derives no principal at all — the derivation's rule for an
+ * absent parent — and is then nobody's under this evaluator.
+ */
+import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, objectOf } from "./rewrite.js";
+export const memoryDeclaration = declareKind({
+    kind: ApiResourceKind.memory,
+    schema: MemorySchema,
+    source: "fga/model/agentic/memory.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        ["subject", direct(objectOf("identity_account"))],
+        ["can_view", computed("subject")],
+        ["can_edit", computed("subject")],
+        ["can_delete", computed("subject")],
+    ],
+});
+//# sourceMappingURL=memory.js.map

package/dist/authorization/model/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../../src/authorization/model/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,IAAI,EAAE,eAAe,CAAC,MAAM;IAC5B,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,8BAA8B;IACtC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACjD,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;KACpC;CACF,CAAC,CAAC"}

package/dist/authorization/model/oauth_app.d.ts

@@ -0,0 +1,2 @@
+export declare const oauthAppDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=oauth_app.d.ts.map

package/dist/authorization/model/oauth_app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth_app.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/oauth_app.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,mBAAmB,wCAqB9B,CAAC"}

package/dist/authorization/model/oauth_app.js

@@ -0,0 +1,30 @@
+/**
+ * Transcript of fga/model/iam/oauth_app.fga — the one organization-scoped
+ * kind whose `owner` has NO admin arm while its `viewer` does: the file's
+ * "administrative visibility" for the organization's admins over a
+ * registration that holds vendor client credentials, with change and
+ * deletion the creator's (or an explicit grant's) alone, and no public
+ * level at all.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
+import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
+export const oauthAppDeclaration = declareKind({
+    kind: ApiResourceKind.oauth_app,
+    schema: OAuthAppSchema,
+    source: "fga/model/iam/oauth_app.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        ["owner", direct(objectOf("identity_account"))],
+        [
+            "viewer",
+            union(direct(objectOf("identity_account")), computed("owner"), from("admin", "organization")),
+        ],
+        ["can_view", computed("viewer")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+});
+//# sourceMappingURL=oauth_app.js.map

package/dist/authorization/model/oauth_app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth_app.js","sourceRoot":"","sources":["../../../src/authorization/model/oauth_app.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAEnF,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,IAAI,EAAE,eAAe,CAAC,SAAS;IAC/B,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,6BAA6B;IACrC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/organization.d.ts

@@ -0,0 +1,2 @@
+export declare const organizationDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=organization.d.ts.map

package/dist/authorization/model/organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/organization.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,uBAAuB,wCAkClC,CAAC"}

package/dist/authorization/model/organization.js

@@ -0,0 +1,54 @@
+/**
+ * Transcript of fga/model/tenancy/organization.fga — the root of the
+ * model: no parent, the four roles as a ladder (`owner ⊂ admin ⊂ member
+ * ⊂ viewer`, each `[identity_account] or <the rung above>`), and every
+ * `can_create_*` an organization gates.
+ *
+ * In open source the `[identity_account]` tuples of this type ARE the
+ * IamPolicy rows: 2b's role lifecycle writes the creator's `owner` row and
+ * the grant path writes every other role, so the tuple source reads them
+ * from the IamPolicyStore and the derivation writes no owner tuple for
+ * this kind (derived-tuples.ts). `guest` is the cloud's anonymous
+ * share-link visitor; no open-source lane mints one (claim check C5), so
+ * the relation resolves to nothing and `can_create_session: member or
+ * guest` is `member` here — the transcript still carries the line.
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+import { computed, declareKind, direct, objectOf, union } from "./rewrite.js";
+export const organizationDeclaration = declareKind({
+    kind: ApiResourceKind.organization,
+    schema: OrganizationSchema,
+    source: "fga/model/tenancy/organization.fga",
+    relations: [
+        ["owner", direct(objectOf("identity_account"))],
+        ["admin", union(direct(objectOf("identity_account")), computed("owner"))],
+        ["member", union(direct(objectOf("identity_account")), computed("admin"))],
+        ["viewer", union(direct(objectOf("identity_account")), computed("member"))],
+        ["guest", direct(objectOf("identity_account"))],
+        ["can_view", computed("viewer")],
+        ["can_edit", computed("admin")],
+        ["can_delete", computed("owner")],
+        ["can_manage_members", computed("admin")],
+        ["can_assign_roles", computed("owner")],
+        ["can_create_project", computed("admin")],
+        ["can_create_agent", computed("admin")],
+        ["can_create_workflow", computed("admin")],
+        ["can_create_session", union(computed("member"), computed("guest"))],
+        ["can_create_environment", computed("member")],
+        ["can_create_skill", computed("admin")],
+        ["can_create_plugin", computed("admin")],
+        ["can_create_idp", computed("admin")],
+        ["can_create_identity_account", computed("admin")],
+        ["can_create_oauth_app", computed("admin")],
+        ["can_create_platform_client", computed("admin")],
+        ["can_create_channel_app", computed("admin")],
+        ["can_create_execution_in", union(computed("member"), computed("guest"))],
+        ["can_create_agent_share", computed("admin")],
+        ["can_grant_access", computed("admin")],
+        ["can_view_access", computed("viewer")],
+        ["can_view_billing", computed("viewer")],
+        ["can_manage_billing", computed("admin")],
+    ],
+});
+//# sourceMappingURL=organization.js.map

package/dist/authorization/model/organization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.js","sourceRoot":"","sources":["../../../src/authorization/model/organization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAE/F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;IACjD,IAAI,EAAE,eAAe,CAAC,YAAY;IAClC,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,oCAAoC;IAC5C,SAAS,EAAE;QACT,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3E,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC,oBAAoB,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACpE,CAAC,wBAAwB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,mBAAmB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC,6BAA6B,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC,4BAA4B,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC,yBAAyB,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAC1C;CACF,CAAC,CAAC"}

package/dist/authorization/model/plugin.d.ts

@@ -0,0 +1,2 @@
+export declare const pluginDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/authorization/model/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/plugin.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,iBAAiB,wCAqC5B,CAAC"}

package/dist/authorization/model/plugin.js

@@ -0,0 +1,44 @@
+/**
+ * Transcript of fga/model/agentic/plugin.fga — the unit of install, shaped
+ * exactly like a skill: an organization-owned blueprint whose owner is the
+ * installer (and, through the organization, its admins), whose viewers are
+ * the org's members and viewers, public readers when published, and the
+ * platform viewer. Its verbs are the blueprint set: `can_view`, `can_edit`
+ * (visibility), `can_delete` (uninstall), `can_grant_access`,
+ * `can_view_access`; `can_use` is carried as the model's word for
+ * "install from" though no wire permission names it yet.
+ *
+ * The members a plugin materialises are NOT reached through this type:
+ * each is an ordinary skill, MCP server, agent or workflow with its own
+ * tuples, written by its own chain as the installing caller.
+ */
+import { PluginSchema } from "@stigmer/protos/ai/stigmer/agentic/plugin/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, from, objectOf, publicWith, union, usersetOf, } from "./rewrite.js";
+export const pluginDeclaration = declareKind({
+    kind: ApiResourceKind.plugin,
+    schema: PluginSchema,
+    source: "fga/model/agentic/plugin.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        [
+            "owner",
+            union(direct(objectOf("identity_account")), from("admin", "organization")),
+        ],
+        [
+            "platform_viewer",
+            direct(usersetOf("identity_provider", "platform_user")),
+        ],
+        [
+            "viewer",
+            union(direct(objectOf("identity_account"), publicWith("identity_account", "allow_public"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner"), computed("platform_viewer")),
+        ],
+        ["can_view", computed("viewer")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_use", computed("viewer")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+});
+//# sourceMappingURL=plugin.js.map

package/dist/authorization/model/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/authorization/model/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,UAAU,EACV,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,IAAI,EAAE,eAAe,CAAC,MAAM;IAC5B,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,8BAA8B;IACtC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,UAAU,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAC9C,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/project.d.ts

@@ -0,0 +1,2 @@
+export declare const projectDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=project.d.ts.map

package/dist/authorization/model/project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/project.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,kBAAkB,wCA2B7B,CAAC"}

package/dist/authorization/model/project.js

@@ -0,0 +1,32 @@
+/**
+ * Transcript of fga/model/tenancy/project.fga — an organization's
+ * grouping: admins own it, and `viewer from organization` lets every
+ * organization viewer read it without a visibility tuple (projects have
+ * no visibility axis in `kind_meta`; the whole organization is their
+ * audience by the model's own line).
+ */
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ProjectSchema } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/api_pb";
+import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
+export const projectDeclaration = declareKind({
+    kind: ApiResourceKind.project,
+    schema: ProjectSchema,
+    source: "fga/model/tenancy/project.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        [
+            "owner",
+            union(direct(objectOf("identity_account")), from("admin", "organization")),
+        ],
+        [
+            "viewer",
+            union(direct(objectOf("identity_account")), computed("owner"), from("viewer", "organization")),
+        ],
+        ["can_view", computed("viewer")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+});
+//# sourceMappingURL=project.js.map

package/dist/authorization/model/project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../../../src/authorization/model/project.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AAErF,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC;IAC5C,IAAI,EAAE,eAAe,CAAC,OAAO;IAC7B,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,+BAA+B;IACvC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAC/B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/rewrite.d.ts

@@ -0,0 +1,127 @@
+/**
+ * The relation-rewrite vocabulary the model declarations are written in —
+ * the four forms an OpenFGA `define` line takes in the cloud's 27 `.fga`
+ * files, and nothing more:
+ *
+ *   define organization: [organization]                      → direct(objectOf("organization"))
+ *   define owner: [identity_account] or admin from organization
+ *                → union(direct(objectOf("identity_account")), from("admin", "organization"))
+ *   define viewer: [identity_account, identity_account:* with allow_public,
+ *                   organization#member, organization#viewer] or owner or platform_viewer
+ *                → union(direct(objectOf(...), publicWith(...), usersetOf(...), usersetOf(...)),
+ *                        computed("owner"), computed("platform_viewer"))
+ *   define can_view: viewer                                   → computed("viewer")
+ *
+ * A declaration file (model/<kind>.ts) is a TRANSCRIPT of its `.fga`
+ * file: the same relations, in the file's order, each line rewritten in
+ * these builders so a reader with the model open sees the same text, and
+ * so a structural compare against the file (the cloud's drift test at
+ * the re-pin) needs no translation table. Intersection and exclusion
+ * (`and`, `but not`) do not appear in the model and have no node here;
+ * the day they do, the transcript cannot be written and the gap is a
+ * design act, not a silent approximation.
+ *
+ * The direct form carries its type restrictions (`[identity_account,
+ * organization#viewer]`) because the evaluator ENFORCES them: a tuple
+ * whose subject the line does not list is ignored, which is what OpenFGA
+ * does at write time. That is the fail-closed property of this design —
+ * a derivation that drifts from the model (a userset the line dropped)
+ * makes open source deny, never allow.
+ *
+ * `derived` names the relations `kind_meta.authorization` cannot derive
+ * from the row alone: `default_of` on an instance (the
+ * blueprint's `status.default_instance_id` must name this row — one
+ * blueprint read through the loader; default-of.ts, shared by the two
+ * instance kinds) and `execution_viewer` on a workflow instance
+ * (`spec.execution_visibility`; workflow_instance.ts). A declaration that
+ * has such a relation states the rule beside the transcript; the tuple
+ * source dispatches to it by relation.
+ */
+import type { DescMessage, Message } from "@bufbuild/protobuf";
+import type { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ObjectRef, RowLoader, Tuple } from "../tuples.js";
+/** One entry of a direct line's type restriction list. */
+export type SubjectType = 
+/** `[organization]`, `[identity_account]` — objects of the type. */
+{
+    readonly form: "object";
+    readonly type: string;
+}
+/** `[organization#viewer]` — everyone holding `relation` on an object of the type. */
+ | {
+    readonly form: "userset";
+    readonly type: string;
+    readonly relation: string;
+}
+/** `[identity_account:* with allow_public]` — every object of the type, under the condition. */
+ | {
+    readonly form: "wildcard";
+    readonly type: string;
+    readonly condition: string;
+};
+export type Rewrite = 
+/** `[…]` — the tuples stored on the relation itself, restricted to the listed subject types. */
+{
+    readonly node: "this";
+    readonly subjects: ReadonlyArray<SubjectType>;
+}
+/** `or owner` — another relation of the same object. */
+ | {
+    readonly node: "computed";
+    readonly relation: string;
+}
+/** `admin from organization` — `relation` on every object the `tupleset` relation links to. */
+ | {
+    readonly node: "from";
+    readonly relation: string;
+    readonly tupleset: string;
+}
+/** `a or b or c` — the first true member wins, in the line's order. */
+ | {
+    readonly node: "union";
+    readonly members: ReadonlyArray<Rewrite>;
+};
+export declare function objectOf(type: string): SubjectType;
+export declare function usersetOf(type: string, relation: string): SubjectType;
+export declare function publicWith(type: string, condition: string): SubjectType;
+export declare function direct(...subjects: ReadonlyArray<SubjectType>): Rewrite;
+export declare function computed(relation: string): Rewrite;
+export declare function from(relation: string, tupleset: string): Rewrite;
+export declare function union(...members: ReadonlyArray<Rewrite>): Rewrite;
+/**
+ * A relation the row does not carry as a `kind_meta` fact: the rule that
+ * derives its tuples for `object` from its decoded row, reading related
+ * rows through the loader. The source hands the object it already
+ * resolved so a rule never re-derives its own reference from the row.
+ * Pure over its inputs; faults propagate.
+ */
+export type DerivedRelation = (object: ObjectRef, row: Message, loader: RowLoader) => Promise<ReadonlyArray<Tuple>>;
+export interface KindDeclaration {
+    readonly kind: ApiResourceKind;
+    /** The FGA type name — the kind's enum member name, as the cloud renders objects. */
+    readonly type: string;
+    /** The kind's message schema: what a stored row decodes with, and where its audit lives. */
+    readonly schema: DescMessage;
+    /** The `.fga` file this transcribes, relative to the cloud's `fga/` folder. */
+    readonly source: string;
+    /** Every relation the file defines, in the file's order. */
+    readonly relations: ReadonlyMap<string, Rewrite>;
+    /** The relations `kind_meta` cannot derive (the module header). */
+    readonly derived: ReadonlyMap<string, DerivedRelation>;
+}
+export interface KindDeclarationInput {
+    readonly kind: ApiResourceKind;
+    readonly schema: DescMessage;
+    readonly source: string;
+    readonly relations: ReadonlyArray<readonly [name: string, rewrite: Rewrite]>;
+    readonly derived?: ReadonlyArray<readonly [name: string, rule: DerivedRelation]>;
+}
+/**
+ * Builds a declaration and refuses a transcript that cannot be right at
+ * module load: a relation declared twice, a `computed` naming a relation
+ * the kind does not define, a `from` whose tupleset the kind does not
+ * define (its `relation` is the PARENT's and is resolved at evaluation),
+ * a derived rule for a relation the transcript does not declare.
+ */
+export declare function declareKind(input: KindDeclarationInput): KindDeclaration;
+//# sourceMappingURL=rewrite.d.ts.map

package/dist/authorization/model/rewrite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewrite.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAG3H,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAEhE,0DAA0D;AAC1D,MAAM,MAAM,WAAW;AACrB,oEAAoE;AAClE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACpD,sFAAsF;GACpF;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AACH,gGAAgG;GAC9F;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEN,MAAM,MAAM,OAAO;AACjB,gGAAgG;AAC9F;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;CAAE;AAC1E,wDAAwD;GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAC1D,+FAA+F;GAC7F;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AACH,uEAAuE;GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC;AAMzE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAElD;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,CAErE;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAEvE;AAED,wBAAgB,MAAM,CAAC,GAAG,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,OAAO,CAEvE;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,wBAAgB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,KAAK,CAAC,GAAG,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,OAAO,CAEjE;AAMD;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,SAAS,KACd,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAEnC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAC9B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,CAC/C,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe,CAmCxE"}

package/dist/authorization/model/rewrite.js

@@ -0,0 +1,82 @@
+import { kindEnumName } from "../../pipeline/apiresource-meta.js";
+// ---------------------------------------------------------------------------
+// Builders — named so a transcript reads like its `.fga` line.
+// ---------------------------------------------------------------------------
+export function objectOf(type) {
+    return { form: "object", type };
+}
+export function usersetOf(type, relation) {
+    return { form: "userset", type, relation };
+}
+export function publicWith(type, condition) {
+    return { form: "wildcard", type, condition };
+}
+export function direct(...subjects) {
+    return { node: "this", subjects };
+}
+export function computed(relation) {
+    return { node: "computed", relation };
+}
+export function from(relation, tupleset) {
+    return { node: "from", relation, tupleset };
+}
+export function union(...members) {
+    return { node: "union", members };
+}
+/**
+ * Builds a declaration and refuses a transcript that cannot be right at
+ * module load: a relation declared twice, a `computed` naming a relation
+ * the kind does not define, a `from` whose tupleset the kind does not
+ * define (its `relation` is the PARENT's and is resolved at evaluation),
+ * a derived rule for a relation the transcript does not declare.
+ */
+export function declareKind(input) {
+    const type = kindEnumName(input.kind);
+    const relations = new Map();
+    for (const [name, rewrite] of input.relations) {
+        if (relations.has(name)) {
+            throw new Error(`${input.source}: relation '${name}' is declared twice`);
+        }
+        relations.set(name, rewrite);
+    }
+    for (const [name, rewrite] of relations) {
+        for (const reference of localReferences(rewrite)) {
+            if (!relations.has(reference.relation)) {
+                throw new Error(`${input.source}: '${name}' names ${reference.role} '${reference.relation}', which ${type} does not declare`);
+            }
+        }
+    }
+    const derived = new Map();
+    for (const [name, rule] of input.derived ?? []) {
+        if (!relations.has(name)) {
+            throw new Error(`${input.source}: a derived rule for '${name}', which ${type} does not declare`);
+        }
+        derived.set(name, rule);
+    }
+    return {
+        kind: input.kind,
+        type,
+        schema: input.schema,
+        source: input.source,
+        relations,
+        derived,
+    };
+}
+/** The relations of the SAME kind a rewrite names: computed targets and tuplesets. */
+function localReferences(rewrite) {
+    switch (rewrite.node) {
+        case "this":
+            return [];
+        case "computed":
+            return [{ role: "relation", relation: rewrite.relation }];
+        case "from":
+            return [{ role: "tupleset", relation: rewrite.tupleset }];
+        case "union":
+            return rewrite.members.flatMap(localReferences);
+        default: {
+            const exhaustive = rewrite;
+            throw new Error(`unknown rewrite node: ${JSON.stringify(exhaustive)}`);
+        }
+    }
+}
+//# sourceMappingURL=rewrite.js.map

package/dist/authorization/model/rewrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewrite.js","sourceRoot":"","sources":["../../../src/authorization/model/rewrite.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAkClE,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,QAAgB;IACtD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAiB;IACxD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAG,QAAoC;IAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,QAAgB,EAAE,QAAgB;IACrD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAG,OAA+B;IACtD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AA2CD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAA2B;IACrD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,eAAe,IAAI,qBAAqB,CAAC,CAAC;QAC3E,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;QACxC,KAAK,MAAM,SAAS,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,MAAM,MAAM,IAAI,WAAW,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,QAAQ,YAAY,IAAI,mBAAmB,CAC7G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,MAAM,yBAAyB,IAAI,YAAY,IAAI,mBAAmB,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI;QACJ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS;QACT,OAAO;KACR,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,eAAe,CACtB,OAAgB;IAEhB,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5D,KAAK,MAAM;YACT,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5D,KAAK,OAAO;YACV,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/authorization/model/schedule.d.ts

@@ -0,0 +1,2 @@
+export declare const scheduleDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=schedule.d.ts.map

package/dist/authorization/model/schedule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/schedule.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,mBAAmB,wCAoB9B,CAAC"}

package/dist/authorization/model/schedule.js

@@ -0,0 +1,29 @@
+/**
+ * Transcript of fga/model/agentic/schedule.fga — a scheduled run's
+ * definition, admin-owned like a blueprint and viewable by its owners and
+ * explicit grantees. The sessions its fires create name it back through
+ * `session#schedule`, a link the cloud writes and this edition does not
+ * (session.ts); the schedule's own relations are unaffected.
+ */
+import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
+export const scheduleDeclaration = declareKind({
+    kind: ApiResourceKind.schedule,
+    schema: ScheduleSchema,
+    source: "fga/model/agentic/schedule.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        [
+            "owner",
+            union(direct(objectOf("identity_account")), from("admin", "organization")),
+        ],
+        ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
+        ["can_view", computed("viewer")],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+});
+//# sourceMappingURL=schedule.js.map

package/dist/authorization/model/schedule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule.js","sourceRoot":"","sources":["../../../src/authorization/model/schedule.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,IAAI,EAAE,eAAe,CAAC,QAAQ;IAC9B,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,gCAAgC;IACxC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/session.d.ts

@@ -0,0 +1,2 @@
+export declare const sessionDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=session.d.ts.map

package/dist/authorization/model/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/session.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,kBAAkB,wCAyB7B,CAAC"}

package/dist/authorization/model/session.js

@@ -0,0 +1,38 @@
+/**
+ * Transcript of fga/model/agentic/session.fga — a personal resource: the
+ * owner and explicit grantees, and NO admin arm anywhere ("private
+ * conversations that admins have no business accessing", the file's own
+ * words). Three parent links beside the organization: `agent_instance`,
+ * `channel` and `schedule`. None is a `kind_meta` fact — the cloud's
+ * channel and schedule lanes write them — so on this edition the
+ * derivation produces no such tuple and `viewer from channel` / `viewer
+ * from schedule` resolve to nobody; the lines stand in the transcript
+ * because they are the model's, and a scheduled run reaches its creator
+ * through the fire caller's stamp on the session instead.
+ */
+import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
+export const sessionDeclaration = declareKind({
+    kind: ApiResourceKind.session,
+    schema: SessionSchema,
+    source: "fga/model/agentic/session.fga",
+    relations: [
+        ["organization", direct(objectOf("organization"))],
+        ["agent_instance", direct(objectOf("agent_instance"))],
+        ["channel", direct(objectOf("agent_channel"))],
+        ["schedule", direct(objectOf("schedule"))],
+        ["owner", direct(objectOf("identity_account"))],
+        ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
+        [
+            "can_view",
+            union(computed("viewer"), from("viewer", "channel"), from("viewer", "schedule")),
+        ],
+        ["can_edit", computed("owner")],
+        ["can_delete", computed("owner")],
+        ["can_create_execution_in", computed("viewer")],
+        ["can_grant_access", computed("owner")],
+        ["can_view_access", computed("viewer")],
+    ],
+});
+//# sourceMappingURL=session.js.map

package/dist/authorization/model/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/authorization/model/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC;IAC5C,IAAI,EAAE,eAAe,CAAC,OAAO;IAC7B,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,+BAA+B;IACvC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACtD,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAC9C,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1C,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E;YACE,UAAU;YACV,KAAK,CACH,QAAQ,CAAC,QAAQ,CAAC,EAClB,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EACzB,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAC3B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,yBAAyB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/skill.d.ts

@@ -0,0 +1,2 @@
+export declare const skillDeclaration: import("./rewrite.js").KindDeclaration;
+//# sourceMappingURL=skill.d.ts.map