@stigmer/server 3.27.1 → 3.28.0

package/dist/authorization/model/iam_policy.js

@@ -1,31 +0,0 @@
-/**
- * Transcript of fga/model/iam/iam_policy.fga — the access-list row as an
- * object of the model: its organization's admins own and view it. Declared
- * for completeness of the transcript set (the drift compare reads every
- * open-source file); no wire check targets it — the IamPolicy RPCs
- * authorize against the policy's RESOURCE (`can_grant_access` on the
- * organization; `get` loads the row and asks about what it names), and the
- * tuple lifecycle writes nothing for it.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const iamPolicyDeclaration = declareKind({
-    kind: ApiResourceKind.iam_policy,
-    schema: IamPolicySchema,
-    source: "fga/model/iam/iam_policy.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        ["viewer", from("admin", "organization")],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=iam_policy.js.map

package/dist/authorization/model/iam_policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"iam_policy.js","sourceRoot":"","sources":["../../../src/authorization/model/iam_policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAErF,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;IAC9C,IAAI,EAAE,eAAe,CAAC,UAAU;IAChC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,8BAA8B;IACtC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/identity_account.d.ts

@@ -1,2 +0,0 @@
-export declare const identityAccountDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=identity_account.d.ts.map

package/dist/authorization/model/identity_account.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity_account.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/identity_account.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,0BAA0B,wCAYrC,CAAC"}

package/dist/authorization/model/identity_account.js

@@ -1,25 +0,0 @@
-/**
- * Transcript of fga/model/iam/identity_account.fga — a person's own
- * record: every verb is `owner`, and the owner is the account itself
- * (`kind_meta` attribution SELF, so the derivation writes
- * `identity_account:<id>#owner@identity_account:<id>`). No organization
- * link and no admin arm: an admin manages members through IamPolicy rows
- * on the organization, never through the account row.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-export const identityAccountDeclaration = declareKind({
-    kind: ApiResourceKind.identity_account,
-    schema: IdentityAccountSchema,
-    source: "fga/model/iam/identity_account.fga",
-    relations: [
-        ["owner", direct(objectOf("identity_account"))],
-        ["can_view", computed("owner")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("owner")],
-    ],
-});
-//# sourceMappingURL=identity_account.js.map

package/dist/authorization/model/identity_account.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity_account.js","sourceRoot":"","sources":["../../../src/authorization/model/identity_account.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AAEjG,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;IACpD,IAAI,EAAE,eAAe,CAAC,gBAAgB;IACtC,MAAM,EAAE,qBAAqB;IAC7B,MAAM,EAAE,oCAAoC;IAC5C,SAAS,EAAE;QACT,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KACvC;CACF,CAAC,CAAC"}

package/dist/authorization/model/mcp_server.d.ts

@@ -1,2 +0,0 @@
-export declare const mcpServerDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=mcp_server.d.ts.map

package/dist/authorization/model/mcp_server.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp_server.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/mcp_server.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,oBAAoB,wCAuC/B,CAAC"}

package/dist/authorization/model/mcp_server.js

@@ -1,38 +0,0 @@
-/**
- * Transcript of fga/model/agentic/mcp_server.fga — a blueprint with three
- * read-side verbs: `can_use`, `can_clone` and `can_connect` (the OAuth
- * connect lane's gate), all `viewer`. `team#member` on `viewer` is the
- * Enterprise team grant, which no open-source tuple ever names.
- */
-import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const mcpServerDeclaration = declareKind({
-    kind: ApiResourceKind.mcp_server,
-    schema: McpServerSchema,
-    source: "fga/model/agentic/mcp_server.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "platform_viewer",
-            direct(usersetOf("identity_provider", "platform_user")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer"), usersetOf("team", "member")), computed("owner"), computed("platform_viewer")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_use", computed("viewer")],
-        ["can_clone", computed("viewer")],
-        ["can_connect", computed("viewer")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=mcp_server.js.map

package/dist/authorization/model/mcp_server.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp_server.js","sourceRoot":"","sources":["../../../src/authorization/model/mcp_server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;IAC9C,IAAI,EAAE,eAAe,CAAC,UAAU;IAChC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,kCAAkC;IAC1C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5B,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/memory.d.ts

@@ -1,2 +0,0 @@
-export declare const memoryDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=memory.d.ts.map

package/dist/authorization/model/memory.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/memory.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,iBAAiB,wCAW5B,CAAC"}

package/dist/authorization/model/memory.js

@@ -1,26 +0,0 @@
-/**
- * Transcript of fga/model/agentic/memory.fga — subject-only: the person a
- * memory is ABOUT is its one principal (no owner, no creator, no
- * visibility, nothing grantable; `kind_meta` attribution NONE with
- * `subject` as an additional parent on `spec.subject_identity_account_id`).
- * Organization admins govern the organization's memory switch and never
- * read content, in the contract's own words. A row whose subject field is
- * empty derives no principal at all — the derivation's rule for an
- * absent parent — and is then nobody's under this evaluator.
- */
-import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-export const memoryDeclaration = declareKind({
-    kind: ApiResourceKind.memory,
-    schema: MemorySchema,
-    source: "fga/model/agentic/memory.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["subject", direct(objectOf("identity_account"))],
-        ["can_view", computed("subject")],
-        ["can_edit", computed("subject")],
-        ["can_delete", computed("subject")],
-    ],
-});
-//# sourceMappingURL=memory.js.map

package/dist/authorization/model/memory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../../src/authorization/model/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,IAAI,EAAE,eAAe,CAAC,MAAM;IAC5B,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,8BAA8B;IACtC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACjD,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;KACpC;CACF,CAAC,CAAC"}

package/dist/authorization/model/oauth_app.d.ts

@@ -1,2 +0,0 @@
-export declare const oauthAppDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=oauth_app.d.ts.map

package/dist/authorization/model/oauth_app.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth_app.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/oauth_app.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,mBAAmB,wCAqB9B,CAAC"}

package/dist/authorization/model/oauth_app.js

@@ -1,31 +0,0 @@
-/**
- * Transcript of fga/model/iam/oauth_app.fga — an organization-scoped kind
- * whose `owner` has NO admin arm while its `viewer` does (platform_client
- * shares the shape, for the same reason): the file's
- * "administrative visibility" for the organization's admins over a
- * registration that holds vendor client credentials, with change and
- * deletion the creator's (or an explicit grant's) alone, and no public
- * level at all.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const oauthAppDeclaration = declareKind({
-    kind: ApiResourceKind.oauth_app,
-    schema: OAuthAppSchema,
-    source: "fga/model/iam/oauth_app.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["owner", direct(objectOf("identity_account"))],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account")), computed("owner"), from("admin", "organization")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=oauth_app.js.map

package/dist/authorization/model/oauth_app.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth_app.js","sourceRoot":"","sources":["../../../src/authorization/model/oauth_app.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAEnF,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,IAAI,EAAE,eAAe,CAAC,SAAS;IAC/B,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,6BAA6B;IACrC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/organization.d.ts

@@ -1,2 +0,0 @@
-export declare const organizationDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=organization.d.ts.map

package/dist/authorization/model/organization.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/organization.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,uBAAuB,wCAoClC,CAAC"}

package/dist/authorization/model/organization.js

@@ -1,58 +0,0 @@
-/**
- * Transcript of fga/model/tenancy/organization.fga — the root of the
- * model: no parent, the four roles as a ladder (`owner ⊂ admin ⊂ member
- * ⊂ viewer`, each `[identity_account] or <the rung above>`), and every
- * `can_create_*` an organization gates.
- *
- * In open source the `[identity_account]` tuples of this type ARE the
- * IamPolicy rows: 2b's role lifecycle writes the creator's `owner` row and
- * the grant path writes every other role, so the tuple source reads them
- * from the IamPolicyStore and the derivation writes no owner tuple for
- * this kind (derived-tuples.ts). `guest` is the cloud's anonymous
- * share-link visitor; no open-source lane mints one (claim check C5), so
- * the relation resolves to nothing and `can_create_session: member or
- * guest` is `member` here — the transcript still carries the line.
- * `can_create_team` is carried the same way: open source serves no Team
- * kind, so nothing here asks it.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
-import { computed, declareKind, direct, objectOf, union } from "./rewrite.js";
-export const organizationDeclaration = declareKind({
-    kind: ApiResourceKind.organization,
-    schema: OrganizationSchema,
-    source: "fga/model/tenancy/organization.fga",
-    relations: [
-        ["owner", direct(objectOf("identity_account"))],
-        ["admin", union(direct(objectOf("identity_account")), computed("owner"))],
-        ["member", union(direct(objectOf("identity_account")), computed("admin"))],
-        ["viewer", union(direct(objectOf("identity_account")), computed("member"))],
-        ["guest", direct(objectOf("identity_account"))],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("admin")],
-        ["can_delete", computed("owner")],
-        ["can_manage_members", computed("admin")],
-        ["can_assign_roles", computed("owner")],
-        ["can_create_agent", computed("admin")],
-        ["can_create_workflow", computed("admin")],
-        ["can_create_session", union(computed("member"), computed("guest"))],
-        ["can_create_environment", computed("member")],
-        ["can_create_skill", computed("admin")],
-        ["can_create_plugin", computed("admin")],
-        ["can_create_mcp_server", computed("admin")],
-        ["can_create_idp", computed("admin")],
-        ["can_create_identity_account", computed("admin")],
-        ["can_create_oauth_app", computed("admin")],
-        ["can_create_platform_client", computed("admin")],
-        ["can_create_channel_app", computed("admin")],
-        ["can_create_execution_in", union(computed("member"), computed("guest"))],
-        ["can_create_agent_share", computed("admin")],
-        ["can_create_agent_instance", computed("member")],
-        ["can_create_team", computed("admin")],
-        ["can_grant_access", computed("admin")],
-        ["can_view_access", computed("viewer")],
-        ["can_view_billing", computed("viewer")],
-        ["can_manage_billing", computed("admin")],
-    ],
-});
-//# sourceMappingURL=organization.js.map

package/dist/authorization/model/organization.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"organization.js","sourceRoot":"","sources":["../../../src/authorization/model/organization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2DAA2D,CAAC;AAE/F,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAC;IACjD,IAAI,EAAE,eAAe,CAAC,YAAY;IAClC,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,oCAAoC;IAC5C,SAAS,EAAE;QACT,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3E,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,qBAAqB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC,oBAAoB,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACpE,CAAC,wBAAwB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,mBAAmB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC,uBAAuB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC,6BAA6B,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC,4BAA4B,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC,yBAAyB,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC,wBAAwB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC,2BAA2B,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAC1C;CACF,CAAC,CAAC"}

package/dist/authorization/model/platform_client.d.ts

@@ -1,2 +0,0 @@
-export declare const platformClientDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=platform_client.d.ts.map

package/dist/authorization/model/platform_client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform_client.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/platform_client.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,yBAAyB,wCAqBpC,CAAC"}

package/dist/authorization/model/platform_client.js

@@ -1,31 +0,0 @@
-/**
- * Transcript of fga/model/iam/platform_client.fga — relation for relation
- * the oauth_app shape: organization-scoped, an `owner` with no admin arm
- * and a `viewer` that has one. A platform client holds credential material,
- * so the model is restricted: its creator (the owner) edits, deletes,
- * rotates and grants; the organization's admins may view it; ordinary
- * members have no access at all, which is why listByOrg narrows through
- * the list read scope. There is no public level.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const platformClientDeclaration = declareKind({
-    kind: ApiResourceKind.platform_client,
-    schema: PlatformClientSchema,
-    source: "fga/model/iam/platform_client.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["owner", direct(objectOf("identity_account"))],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account")), computed("owner"), from("admin", "organization")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=platform_client.js.map

package/dist/authorization/model/platform_client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform_client.js","sourceRoot":"","sources":["../../../src/authorization/model/platform_client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAE/F,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAAC;IACnD,IAAI,EAAE,eAAe,CAAC,eAAe;IACrC,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,mCAAmC;IAC3C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/plugin.d.ts

@@ -1,2 +0,0 @@
-export declare const pluginDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=plugin.d.ts.map

package/dist/authorization/model/plugin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/plugin.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,iBAAiB,wCAqC5B,CAAC"}

package/dist/authorization/model/plugin.js

@@ -1,45 +0,0 @@
-/**
- * Transcript of fga/model/agentic/plugin.fga — the unit of install, shaped
- * exactly like a skill: an organization-owned blueprint whose owner is the
- * installer (and, through the organization, its admins), whose viewers are
- * the org's members and viewers and the platform viewer. Its verbs are the blueprint set: `can_view`, `can_edit`
- * (visibility), `can_delete` (uninstall), `can_grant_access`,
- * `can_view_access`; `can_use` is carried as the model's word for
- * "install from" though no wire permission names it yet. `team#member` on
- * `viewer` is the Enterprise team grant, which no open-source tuple ever
- * names.
- *
- * The members a plugin materialises are NOT reached through this type:
- * each is an ordinary skill, MCP server, agent or workflow with its own
- * tuples, written by its own chain as the installing caller.
- */
-import { PluginSchema } from "@stigmer/protos/ai/stigmer/agentic/plugin/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const pluginDeclaration = declareKind({
-    kind: ApiResourceKind.plugin,
-    schema: PluginSchema,
-    source: "fga/model/agentic/plugin.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "platform_viewer",
-            direct(usersetOf("identity_provider", "platform_user")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer"), usersetOf("team", "member")), computed("owner"), computed("platform_viewer")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_use", computed("viewer")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=plugin.js.map

package/dist/authorization/model/plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/authorization/model/plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,IAAI,EAAE,eAAe,CAAC,MAAM;IAC5B,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,8BAA8B;IACtC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5B,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/schedule.d.ts

@@ -1,2 +0,0 @@
-export declare const scheduleDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=schedule.d.ts.map

package/dist/authorization/model/schedule.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"schedule.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/schedule.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,mBAAmB,wCA0B9B,CAAC"}

package/dist/authorization/model/schedule.js

@@ -1,34 +0,0 @@
-/**
- * Transcript of fga/model/agentic/schedule.fga — a scheduled run's
- * definition, admin-owned like a blueprint and viewable by its owners and
- * explicit grantees. The sessions its fires create name it back through
- * `session#schedule`, a link the cloud writes and this edition does not
- * (session.ts); the schedule's own relations are unaffected. An explicit
- * grant may name an Enterprise team (`team#member`), which no open-source
- * tuple ever does.
- */
-import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const scheduleDeclaration = declareKind({
-    kind: ApiResourceKind.schedule,
-    schema: ScheduleSchema,
-    source: "fga/model/agentic/schedule.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("team", "member")), computed("owner")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=schedule.js.map

package/dist/authorization/model/schedule.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schedule.js","sourceRoot":"","sources":["../../../src/authorization/model/schedule.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,IAAI,EAAE,eAAe,CAAC,QAAQ;IAC9B,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,gCAAgC;IACxC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EACjE,QAAQ,CAAC,OAAO,CAAC,CAClB;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/session.d.ts

@@ -1,2 +0,0 @@
-export declare const sessionDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=session.d.ts.map

package/dist/authorization/model/session.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/session.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,kBAAkB,wCAyB7B,CAAC"}

package/dist/authorization/model/session.js

@@ -1,38 +0,0 @@
-/**
- * Transcript of fga/model/agentic/session.fga — a personal resource: the
- * owner and explicit grantees, and NO admin arm anywhere ("private
- * conversations that admins have no business accessing", the file's own
- * words). Three parent links beside the organization: `agent_instance`,
- * `channel` and `schedule`. None is a `kind_meta` fact — the cloud's
- * channel and schedule lanes write them — so on this edition the
- * derivation produces no such tuple and `viewer from channel` / `viewer
- * from schedule` resolve to nobody; the lines stand in the transcript
- * because they are the model's, and a scheduled run reaches its creator
- * through the fire caller's stamp on the session instead.
- */
-import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const sessionDeclaration = declareKind({
-    kind: ApiResourceKind.session,
-    schema: SessionSchema,
-    source: "fga/model/agentic/session.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["agent_instance", direct(objectOf("agent_instance"))],
-        ["channel", direct(objectOf("agent_channel"))],
-        ["schedule", direct(objectOf("schedule"))],
-        ["owner", direct(objectOf("identity_account"))],
-        ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
-        [
-            "can_view",
-            union(computed("viewer"), from("viewer", "channel"), from("viewer", "schedule")),
-        ],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_create_execution_in", computed("viewer")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=session.js.map

package/dist/authorization/model/session.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/authorization/model/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC;IAC5C,IAAI,EAAE,eAAe,CAAC,OAAO;IAC7B,MAAM,EAAE,aAAa;IACrB,MAAM,EAAE,+BAA+B;IACvC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACtD,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAC9C,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1C,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E;YACE,UAAU;YACV,KAAK,CACH,QAAQ,CAAC,QAAQ,CAAC,EAClB,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EACzB,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAC3B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,yBAAyB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/skill.d.ts

@@ -1,2 +0,0 @@
-export declare const skillDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=skill.d.ts.map

package/dist/authorization/model/skill.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/skill.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,gBAAgB,wCAsC3B,CAAC"}

package/dist/authorization/model/skill.js

@@ -1,39 +0,0 @@
-/**
- * Transcript of fga/model/agentic/skill.fga — a blueprint whose verbs are
- * `can_use` and `can_clone` rather than `can_execute`. Only `can_view`,
- * `can_edit`, `can_delete`, `can_grant_access` and `can_view_access` are
- * in the wire's IamPermission vocabulary; the others are the model's and
- * are carried so the transcript is the file. `team#member` on `viewer` is
- * the Enterprise team grant, which no open-source tuple ever names.
- */
-import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const skillDeclaration = declareKind({
-    kind: ApiResourceKind.skill,
-    schema: SkillSchema,
-    source: "fga/model/agentic/skill.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "platform_viewer",
-            direct(usersetOf("identity_provider", "platform_user")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer"), usersetOf("team", "member")), computed("owner"), computed("platform_viewer")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_use", computed("viewer")],
-        ["can_clone", computed("viewer")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=skill.js.map

package/dist/authorization/model/skill.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill.js","sourceRoot":"","sources":["../../../src/authorization/model/skill.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;IAC1C,IAAI,EAAE,eAAe,CAAC,KAAK;IAC3B,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,6BAA6B;IACrC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5B,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/workflow.d.ts

@@ -1,2 +0,0 @@
-export declare const workflowDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=workflow.d.ts.map

package/dist/authorization/model/workflow.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/workflow.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,mBAAmB,wCAsC9B,CAAC"}

package/dist/authorization/model/workflow.js

@@ -1,39 +0,0 @@
-/**
- * Transcript of fga/model/agentic/workflow.fga — the agent's shape
- * without `can_create_instance` (a workflow instance is created through
- * the workflow-instance lane, gated by the organization). Kept as its own
- * transcript, not a shared "blueprint" helper, so the file-by-file drift
- * compare sees exactly this file's lines. `team#member` on `viewer` is the
- * Enterprise team grant, which no open-source tuple ever names.
- */
-import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const workflowDeclaration = declareKind({
-    kind: ApiResourceKind.workflow,
-    schema: WorkflowSchema,
-    source: "fga/model/agentic/workflow.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "platform_viewer",
-            direct(usersetOf("identity_provider", "platform_user")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer"), usersetOf("team", "member")), computed("owner"), computed("platform_viewer")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_execute", computed("viewer")],
-        ["can_clone", computed("viewer")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=workflow.js.map

package/dist/authorization/model/workflow.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../../../src/authorization/model/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,IAAI,EAAE,eAAe,CAAC,QAAQ;IAC9B,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,gCAAgC;IACxC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5B,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/workflow_execution.d.ts

@@ -1,2 +0,0 @@
-export declare const workflowExecutionDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=workflow_execution.d.ts.map

package/dist/authorization/model/workflow_execution.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"workflow_execution.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/workflow_execution.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,4BAA4B,wCAqBvC,CAAC"}