@stigmer/server 3.27.1 → 3.28.0

package/src/authorization/model/agent.ts

@@ -1,64 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent.fga — a blueprint: owned by its
- * creator and by the organization's admins (`admin from organization`),
- * read by whoever the visibility axis lets in. The `organization#member`
- * and `organization#viewer` usersets on `viewer` are the org-visibility
- * tuple's two shapes (the cloud writes `#viewer` since cloud#257; `#member`
- * is the legacy shape it still honours), and `platform_viewer` is an
- * identity-provider userset no open-source tuple ever names. `team#member`
- * is the Enterprise team grant; open source serves no team, so no tuple
- * here ever names one.
- */
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-  usersetOf,
-} from "./rewrite.js";
-
-export const agentDeclaration = declareKind({
-  kind: ApiResourceKind.agent,
-  schema: AgentSchema,
-  source: "fga/model/agentic/agent.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    [
-      "platform_viewer",
-      direct(usersetOf("identity_provider", "platform_user")),
-    ],
-    [
-      "viewer",
-      union(
-        direct(
-          objectOf("identity_account"),
-          usersetOf("organization", "member"),
-          usersetOf("organization", "viewer"),
-          usersetOf("team", "member"),
-        ),
-        computed("owner"),
-        computed("platform_viewer"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_execute", computed("viewer")],
-    ["can_create_instance", computed("can_execute")],
-    ["can_clone", computed("viewer")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/agent_channel.ts

@@ -1,57 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_channel.fga — a channel binding,
- * admin-owned like a blueprint, with `participant` as the one relation
- * between owner and viewer: the conversation-participation role
- * (reply and takeover without configuration authority), grantable as a
- * role on this kind alone. Every owner participates; every participant
- * views. Both grantable relations may name an Enterprise team
- * (`team#member`), which no open-source tuple ever does.
- */
-import { AgentChannelSchema } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-  usersetOf,
-} from "./rewrite.js";
-
-export const agentChannelDeclaration = declareKind({
-  kind: ApiResourceKind.agent_channel,
-  schema: AgentChannelSchema,
-  source: "fga/model/agentic/agent_channel.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    [
-      "participant",
-      union(
-        direct(objectOf("identity_account"), usersetOf("team", "member")),
-        computed("owner"),
-      ),
-    ],
-    [
-      "viewer",
-      union(
-        direct(objectOf("identity_account"), usersetOf("team", "member")),
-        computed("participant"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_participate", computed("participant")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/agent_execution.ts

@@ -1,33 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_execution.fga — a run is its
- * session's: no owner tuple of its own (`kind_meta` attribution
- * INHERITED), every relation a hop through `session`, which the
- * derivation writes from `spec.session_id`. `can_view: viewer or
- * can_view from session` walks a parent PERMISSION whose own arms include
- * the session's channel and schedule hops; the evaluator resolves those
- * on the session's declaration, so this file needs no knowledge of them.
- */
-import { AgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-} from "./rewrite.js";
-
-export const agentExecutionDeclaration = declareKind({
-  kind: ApiResourceKind.agent_execution,
-  schema: AgentExecutionSchema,
-  source: "fga/model/agentic/agent_execution.fga",
-  relations: [
-    ["session", direct(objectOf("session"))],
-    ["owner", from("owner", "session")],
-    ["viewer", union(from("viewer", "session"), computed("owner"))],
-    ["can_view", union(computed("viewer"), from("can_view", "session"))],
-    ["can_edit", computed("owner")],
-  ],
-});

package/src/authorization/model/agent_instance.ts

@@ -1,66 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_instance.fga — a person's
- * configuration of an agent: owner-only in every write (no admin arm,
- * unlike the blueprint), readable through its own visibility axis or, for
- * the system-managed default instance, through the blueprint's whole
- * viewer set (`viewer from default_of`; default-of.ts). `agent` is the
- * parent link written on every instance for tracking and walked by
- * nothing; `default_of` is the derived link written on the default
- * instance alone. `team#member` on `viewer` is the Enterprise team grant,
- * which no open-source tuple ever names.
- */
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import { defaultOfBlueprint } from "./default-of.js";
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-  usersetOf,
-} from "./rewrite.js";
-
-export const agentInstanceDeclaration = declareKind({
-  kind: ApiResourceKind.agent_instance,
-  schema: AgentInstanceSchema,
-  source: "fga/model/agentic/agent_instance.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    ["agent", direct(objectOf("agent"))],
-    ["default_of", direct(objectOf("agent"))],
-    ["owner", direct(objectOf("identity_account"))],
-    [
-      "viewer",
-      union(
-        direct(
-          objectOf("identity_account"),
-          usersetOf("organization", "member"),
-          usersetOf("organization", "viewer"),
-          usersetOf("team", "member"),
-        ),
-        computed("owner"),
-        from("viewer", "default_of"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_execute", computed("can_view")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-  derived: [
-    [
-      "default_of",
-      defaultOfBlueprint({
-        kind: ApiResourceKind.agent,
-        schema: AgentSchema,
-        defaultInstanceIdOf: (agent) => agent.status?.defaultInstanceId ?? "",
-      }),
-    ],
-  ],
-});

package/src/authorization/model/agent_share.ts

@@ -1,40 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_share.fga — a share link's
- * configuration row, admin-owned; its anonymous visitors are the cloud's
- * `guest` credential on the organization, a class no open-source lane
- * mints, so on this edition a share is visible to its owners and explicit
- * grantees only.
- */
-import { AgentShareSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-} from "./rewrite.js";
-
-export const agentShareDeclaration = declareKind({
-  kind: ApiResourceKind.agent_share,
-  schema: AgentShareSchema,
-  source: "fga/model/agentic/agent_share.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/api_key.ts

@@ -1,28 +0,0 @@
-/**
- * Transcript of fga/model/iam/api_key.fga — a credential, owner-only in
- * every verb: no organization link (`kind_meta` scope OWNER_ONLY) and no
- * admin arm, so the key a person minted is theirs to view, rotate, revoke
- * and use, and nobody else's. `can_rotate`, `can_revoke` and `can_use` are
- * the file's own verbs; the wire vocabulary names only the first three.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { ApiKeySchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
-
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-
-export const apiKeyDeclaration = declareKind({
-  kind: ApiResourceKind.api_key,
-  schema: ApiKeySchema,
-  source: "fga/model/iam/api_key.fga",
-  relations: [
-    ["owner", direct(objectOf("identity_account"))],
-    ["can_view", computed("owner")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_rotate", computed("owner")],
-    ["can_revoke", computed("owner")],
-    ["can_use", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("owner")],
-  ],
-});

package/src/authorization/model/artifact.ts

@@ -1,38 +0,0 @@
-/**
- * Transcript of fga/model/agentic/artifact.fga — an organization's shared
- * output: read by its creator and by every organization viewer (`viewer
- * from organization`, no visibility tuple involved — the kind has no
- * visibility axis), edited by the organization's admins alone (the
- * creator does NOT edit through `owner`), and with no `can_delete` line
- * at all. The wire annotates only `can_view` and `can_edit` on it.
- */
-import { ArtifactSchema } from "@stigmer/protos/ai/stigmer/agentic/artifact/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-} from "./rewrite.js";
-
-export const artifactDeclaration = declareKind({
-  kind: ApiResourceKind.artifact,
-  schema: ArtifactSchema,
-  source: "fga/model/agentic/artifact.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    ["owner", direct(objectOf("identity_account"))],
-    [
-      "viewer",
-      union(
-        direct(objectOf("identity_account")),
-        from("viewer", "organization"),
-      ),
-    ],
-    ["can_view", union(computed("owner"), computed("viewer"))],
-    ["can_edit", from("admin", "organization")],
-  ],
-});

package/src/authorization/model/channel_app.ts

@@ -1,39 +0,0 @@
-/**
- * Transcript of fga/model/agentic/channel_app.fga — a messaging-platform
- * app registration, admin-owned, viewable by its owners and explicit
- * grantees: the same shape as agent_share, kept as its own file so the
- * drift compare reads this file's lines.
- */
-import { ChannelAppSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-} from "./rewrite.js";
-
-export const channelAppDeclaration = declareKind({
-  kind: ApiResourceKind.channel_app,
-  schema: ChannelAppSchema,
-  source: "fga/model/agentic/channel_app.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/environment.ts

@@ -1,48 +0,0 @@
-/**
- * Transcript of fga/model/agentic/environment.fga — a member's credential
- * store: owner-only writes (no admin arm), an org-visibility axis capped
- * at the organization (`kind_meta` supports_org only — no public
- * wildcard on the viewer line, and the evaluator would ignore one), and
- * `can_read_secrets: creator`, the one verb that stays with the person
- * who typed the values whatever the visibility, standing on the creator
- * tuple `kind_meta` flags with requires_creator_tuple.
- */
-import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  objectOf,
-  union,
-  usersetOf,
-} from "./rewrite.js";
-
-export const environmentDeclaration = declareKind({
-  kind: ApiResourceKind.environment,
-  schema: EnvironmentSchema,
-  source: "fga/model/agentic/environment.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    ["creator", direct(objectOf("identity_account"))],
-    ["owner", direct(objectOf("identity_account"))],
-    [
-      "viewer",
-      union(
-        direct(
-          objectOf("identity_account"),
-          usersetOf("organization", "member"),
-          usersetOf("organization", "viewer"),
-        ),
-        computed("owner"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_read_secrets", computed("creator")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/execution_context.ts

@@ -1,20 +0,0 @@
-/**
- * Transcript of fga/model/agentic/execution_context.fga — a run's working
- * state, owner-only and unscoped (`kind_meta` OWNER_ONLY): two verbs,
- * both `owner`, and no access list to grant on.
- */
-import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-
-export const executionContextDeclaration = declareKind({
-  kind: ApiResourceKind.execution_context,
-  schema: ExecutionContextSchema,
-  source: "fga/model/agentic/execution_context.fga",
-  relations: [
-    ["owner", direct(objectOf("identity_account"))],
-    ["can_view", computed("owner")],
-    ["can_edit", computed("owner")],
-  ],
-});

package/src/authorization/model/iam_policy.ts

@@ -1,42 +0,0 @@
-/**
- * Transcript of fga/model/iam/iam_policy.fga — the access-list row as an
- * object of the model: its organization's admins own and view it. Declared
- * for completeness of the transcript set (the drift compare reads every
- * open-source file); no wire check targets it — the IamPolicy RPCs
- * authorize against the policy's RESOURCE (`can_grant_access` on the
- * organization; `get` loads the row and asks about what it names), and the
- * tuple lifecycle writes nothing for it.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-} from "./rewrite.js";
-
-export const iamPolicyDeclaration = declareKind({
-  kind: ApiResourceKind.iam_policy,
-  schema: IamPolicySchema,
-  source: "fga/model/iam/iam_policy.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    ["viewer", from("admin", "organization")],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/identity_account.ts

@@ -1,26 +0,0 @@
-/**
- * Transcript of fga/model/iam/identity_account.fga — a person's own
- * record: every verb is `owner`, and the owner is the account itself
- * (`kind_meta` attribution SELF, so the derivation writes
- * `identity_account:<id>#owner@identity_account:<id>`). No organization
- * link and no admin arm: an admin manages members through IamPolicy rows
- * on the organization, never through the account row.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
-
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-
-export const identityAccountDeclaration = declareKind({
-  kind: ApiResourceKind.identity_account,
-  schema: IdentityAccountSchema,
-  source: "fga/model/iam/identity_account.fga",
-  relations: [
-    ["owner", direct(objectOf("identity_account"))],
-    ["can_view", computed("owner")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("owner")],
-  ],
-});

package/src/authorization/model/mcp_server.ts

@@ -1,59 +0,0 @@
-/**
- * Transcript of fga/model/agentic/mcp_server.fga — a blueprint with three
- * read-side verbs: `can_use`, `can_clone` and `can_connect` (the OAuth
- * connect lane's gate), all `viewer`. `team#member` on `viewer` is the
- * Enterprise team grant, which no open-source tuple ever names.
- */
-import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-  usersetOf,
-} from "./rewrite.js";
-
-export const mcpServerDeclaration = declareKind({
-  kind: ApiResourceKind.mcp_server,
-  schema: McpServerSchema,
-  source: "fga/model/agentic/mcp_server.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    [
-      "platform_viewer",
-      direct(usersetOf("identity_provider", "platform_user")),
-    ],
-    [
-      "viewer",
-      union(
-        direct(
-          objectOf("identity_account"),
-          usersetOf("organization", "member"),
-          usersetOf("organization", "viewer"),
-          usersetOf("team", "member"),
-        ),
-        computed("owner"),
-        computed("platform_viewer"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_use", computed("viewer")],
-    ["can_clone", computed("viewer")],
-    ["can_connect", computed("viewer")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/memory.ts

@@ -1,27 +0,0 @@
-/**
- * Transcript of fga/model/agentic/memory.fga — subject-only: the person a
- * memory is ABOUT is its one principal (no owner, no creator, no
- * visibility, nothing grantable; `kind_meta` attribution NONE with
- * `subject` as an additional parent on `spec.subject_identity_account_id`).
- * Organization admins govern the organization's memory switch and never
- * read content, in the contract's own words. A row whose subject field is
- * empty derives no principal at all — the derivation's rule for an
- * absent parent — and is then nobody's under this evaluator.
- */
-import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-
-export const memoryDeclaration = declareKind({
-  kind: ApiResourceKind.memory,
-  schema: MemorySchema,
-  source: "fga/model/agentic/memory.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    ["subject", direct(objectOf("identity_account"))],
-    ["can_view", computed("subject")],
-    ["can_edit", computed("subject")],
-    ["can_delete", computed("subject")],
-  ],
-});

package/src/authorization/model/oauth_app.ts

@@ -1,43 +0,0 @@
-/**
- * Transcript of fga/model/iam/oauth_app.fga — an organization-scoped kind
- * whose `owner` has NO admin arm while its `viewer` does (platform_client
- * shares the shape, for the same reason): the file's
- * "administrative visibility" for the organization's admins over a
- * registration that holds vendor client credentials, with change and
- * deletion the creator's (or an explicit grant's) alone, and no public
- * level at all.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-} from "./rewrite.js";
-
-export const oauthAppDeclaration = declareKind({
-  kind: ApiResourceKind.oauth_app,
-  schema: OAuthAppSchema,
-  source: "fga/model/iam/oauth_app.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    ["owner", direct(objectOf("identity_account"))],
-    [
-      "viewer",
-      union(
-        direct(objectOf("identity_account")),
-        computed("owner"),
-        from("admin", "organization"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});