@stigmer/server 3.27.2 → 3.28.0

package/dist/authorization/model/agent_execution.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_execution.js","sourceRoot":"","sources":["../../../src/authorization/model/agent_execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,6DAA6D,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAAC;IACnD,IAAI,EAAE,eAAe,CAAC,eAAe;IACrC,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,uCAAuC;IAC/C,SAAS,EAAE;QACT,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACxC,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnC,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;QACpE,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAChC;CACF,CAAC,CAAC"}

package/dist/authorization/model/agent_instance.d.ts

@@ -1,2 +0,0 @@
-export declare const agentInstanceDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=agent_instance.d.ts.map

package/dist/authorization/model/agent_instance.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_instance.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent_instance.ts"],"names":[],"mappings":"AA0BA,eAAO,MAAM,wBAAwB,wCAuCnC,CAAC"}

package/dist/authorization/model/agent_instance.js

@@ -1,48 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_instance.fga — a person's
- * configuration of an agent: owner-only in every write (no admin arm,
- * unlike the blueprint), readable through its own visibility axis or, for
- * the system-managed default instance, through the blueprint's whole
- * viewer set (`viewer from default_of`; default-of.ts). `agent` is the
- * parent link written on every instance for tracking and walked by
- * nothing; `default_of` is the derived link written on the default
- * instance alone. `team#member` on `viewer` is the Enterprise team grant,
- * which no open-source tuple ever names.
- */
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { defaultOfBlueprint } from "./default-of.js";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const agentInstanceDeclaration = declareKind({
-    kind: ApiResourceKind.agent_instance,
-    schema: AgentInstanceSchema,
-    source: "fga/model/agentic/agent_instance.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["agent", direct(objectOf("agent"))],
-        ["default_of", direct(objectOf("agent"))],
-        ["owner", direct(objectOf("identity_account"))],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer"), usersetOf("team", "member")), computed("owner"), from("viewer", "default_of")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_execute", computed("can_view")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-    derived: [
-        [
-            "default_of",
-            defaultOfBlueprint({
-                kind: ApiResourceKind.agent,
-                schema: AgentSchema,
-                defaultInstanceIdOf: (agent) => agent.status?.defaultInstanceId ?? "",
-            }),
-        ],
-    ],
-});
-//# sourceMappingURL=agent_instance.js.map

package/dist/authorization/model/agent_instance.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_instance.js","sourceRoot":"","sources":["../../../src/authorization/model/agent_instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,oDAAoD,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4DAA4D,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC;IAClD,IAAI,EAAE,eAAe,CAAC,cAAc;IACpC,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,sCAAsC;IAC9C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACpC,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5B,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAC7B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;IACD,OAAO,EAAE;QACP;YACE,YAAY;YACZ,kBAAkB,CAAC;gBACjB,IAAI,EAAE,eAAe,CAAC,KAAK;gBAC3B,MAAM,EAAE,WAAW;gBACnB,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE;aACtE,CAAC;SACH;KACF;CACF,CAAC,CAAC"}

package/dist/authorization/model/agent_share.d.ts

@@ -1,2 +0,0 @@
-export declare const agentShareDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=agent_share.d.ts.map

package/dist/authorization/model/agent_share.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_share.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/agent_share.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,qBAAqB,wCAoBhC,CAAC"}

package/dist/authorization/model/agent_share.js

@@ -1,29 +0,0 @@
-/**
- * Transcript of fga/model/agentic/agent_share.fga — a share link's
- * configuration row, admin-owned; its anonymous visitors are the cloud's
- * `guest` credential on the organization, a class no open-source lane
- * mints, so on this edition a share is visible to its owners and explicit
- * grantees only.
- */
-import { AgentShareSchema } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const agentShareDeclaration = declareKind({
-    kind: ApiResourceKind.agent_share,
-    schema: AgentShareSchema,
-    source: "fga/model/agentic/agent_share.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=agent_share.js.map

package/dist/authorization/model/agent_share.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent_share.js","sourceRoot":"","sources":["../../../src/authorization/model/agent_share.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;IAC/C,IAAI,EAAE,eAAe,CAAC,WAAW;IACjC,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,mCAAmC;IAC3C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/api_key.d.ts

@@ -1,2 +0,0 @@
-export declare const apiKeyDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=api_key.d.ts.map

package/dist/authorization/model/api_key.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"api_key.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/api_key.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,iBAAiB,wCAe5B,CAAC"}

package/dist/authorization/model/api_key.js

@@ -1,27 +0,0 @@
-/**
- * Transcript of fga/model/iam/api_key.fga — a credential, owner-only in
- * every verb: no organization link (`kind_meta` scope OWNER_ONLY) and no
- * admin arm, so the key a person minted is theirs to view, rotate, revoke
- * and use, and nobody else's. `can_rotate`, `can_revoke` and `can_use` are
- * the file's own verbs; the wire vocabulary names only the first three.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { ApiKeySchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-export const apiKeyDeclaration = declareKind({
-    kind: ApiResourceKind.api_key,
-    schema: ApiKeySchema,
-    source: "fga/model/iam/api_key.fga",
-    relations: [
-        ["owner", direct(objectOf("identity_account"))],
-        ["can_view", computed("owner")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_rotate", computed("owner")],
-        ["can_revoke", computed("owner")],
-        ["can_use", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("owner")],
-    ],
-});
-//# sourceMappingURL=api_key.js.map

package/dist/authorization/model/api_key.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api_key.js","sourceRoot":"","sources":["../../../src/authorization/model/api_key.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAC;AAE/E,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,IAAI,EAAE,eAAe,CAAC,OAAO;IAC7B,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,2BAA2B;IACnC,SAAS,EAAE;QACT,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KACvC;CACF,CAAC,CAAC"}

package/dist/authorization/model/artifact.d.ts

@@ -1,2 +0,0 @@
-export declare const artifactDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=artifact.d.ts.map

package/dist/authorization/model/artifact.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"artifact.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/artifact.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,mBAAmB,wCAiB9B,CAAC"}

package/dist/authorization/model/artifact.js

@@ -1,27 +0,0 @@
-/**
- * Transcript of fga/model/agentic/artifact.fga — an organization's shared
- * output: read by its creator and by every organization viewer (`viewer
- * from organization`, no visibility tuple involved — the kind has no
- * visibility axis), edited by the organization's admins alone (the
- * creator does NOT edit through `owner`), and with no `can_delete` line
- * at all. The wire annotates only `can_view` and `can_edit` on it.
- */
-import { ArtifactSchema } from "@stigmer/protos/ai/stigmer/agentic/artifact/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const artifactDeclaration = declareKind({
-    kind: ApiResourceKind.artifact,
-    schema: ArtifactSchema,
-    source: "fga/model/agentic/artifact.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["owner", direct(objectOf("identity_account"))],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account")), from("viewer", "organization")),
-        ],
-        ["can_view", union(computed("owner"), computed("viewer"))],
-        ["can_edit", from("admin", "organization")],
-    ],
-});
-//# sourceMappingURL=artifact.js.map

package/dist/authorization/model/artifact.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"artifact.js","sourceRoot":"","sources":["../../../src/authorization/model/artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,uDAAuD,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,IAAI,EAAE,eAAe,CAAC,QAAQ;IAC9B,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,gCAAgC;IACxC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAC/B;SACF;QACD,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1D,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;KAC5C;CACF,CAAC,CAAC"}

package/dist/authorization/model/channel_app.d.ts

@@ -1,2 +0,0 @@
-export declare const channelAppDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=channel_app.d.ts.map

package/dist/authorization/model/channel_app.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"channel_app.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/channel_app.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,qBAAqB,wCAoBhC,CAAC"}

package/dist/authorization/model/channel_app.js

@@ -1,28 +0,0 @@
-/**
- * Transcript of fga/model/agentic/channel_app.fga — a messaging-platform
- * app registration, admin-owned, viewable by its owners and explicit
- * grantees: the same shape as agent_share, kept as its own file so the
- * drift compare reads this file's lines.
- */
-import { ChannelAppSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const channelAppDeclaration = declareKind({
-    kind: ApiResourceKind.channel_app,
-    schema: ChannelAppSchema,
-    source: "fga/model/agentic/channel_app.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=channel_app.js.map

package/dist/authorization/model/channel_app.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"channel_app.js","sourceRoot":"","sources":["../../../src/authorization/model/channel_app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yDAAyD,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;IAC/C,IAAI,EAAE,eAAe,CAAC,WAAW;IACjC,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,mCAAmC;IAC3C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/environment.d.ts

@@ -1,2 +0,0 @@
-export declare const environmentDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=environment.d.ts.map

package/dist/authorization/model/environment.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/environment.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,sBAAsB,wCA0BjC,CAAC"}

package/dist/authorization/model/environment.js

@@ -1,33 +0,0 @@
-/**
- * Transcript of fga/model/agentic/environment.fga — a member's credential
- * store: owner-only writes (no admin arm), an org-visibility axis capped
- * at the organization (`kind_meta` supports_org only — no public
- * wildcard on the viewer line, and the evaluator would ignore one), and
- * `can_read_secrets: creator`, the one verb that stays with the person
- * who typed the values whatever the visibility, standing on the creator
- * tuple `kind_meta` flags with requires_creator_tuple.
- */
-import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, objectOf, union, usersetOf, } from "./rewrite.js";
-export const environmentDeclaration = declareKind({
-    kind: ApiResourceKind.environment,
-    schema: EnvironmentSchema,
-    source: "fga/model/agentic/environment.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["creator", direct(objectOf("identity_account"))],
-        ["owner", direct(objectOf("identity_account"))],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer")), computed("owner")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_read_secrets", computed("creator")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=environment.js.map

package/dist/authorization/model/environment.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/authorization/model/environment.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0DAA0D,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAChD,IAAI,EAAE,eAAe,CAAC,WAAW;IACjC,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,mCAAmC;IAC3C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACjD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CACpC,EACD,QAAQ,CAAC,OAAO,CAAC,CAClB;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/execution_context.d.ts

@@ -1,2 +0,0 @@
-export declare const executionContextDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=execution_context.d.ts.map

package/dist/authorization/model/execution_context.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"execution_context.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/execution_context.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,2BAA2B,wCAStC,CAAC"}

package/dist/authorization/model/execution_context.js

@@ -1,19 +0,0 @@
-/**
- * Transcript of fga/model/agentic/execution_context.fga — a run's working
- * state, owner-only and unscoped (`kind_meta` OWNER_ONLY): two verbs,
- * both `owner`, and no access list to grant on.
- */
-import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-export const executionContextDeclaration = declareKind({
-    kind: ApiResourceKind.execution_context,
-    schema: ExecutionContextSchema,
-    source: "fga/model/agentic/execution_context.fga",
-    relations: [
-        ["owner", direct(objectOf("identity_account"))],
-        ["can_view", computed("owner")],
-        ["can_edit", computed("owner")],
-    ],
-});
-//# sourceMappingURL=execution_context.js.map

package/dist/authorization/model/execution_context.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"execution_context.js","sourceRoot":"","sources":["../../../src/authorization/model/execution_context.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,CAAC,MAAM,2BAA2B,GAAG,WAAW,CAAC;IACrD,IAAI,EAAE,eAAe,CAAC,iBAAiB;IACvC,MAAM,EAAE,sBAAsB;IAC9B,MAAM,EAAE,yCAAyC;IACjD,SAAS,EAAE;QACT,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAChC;CACF,CAAC,CAAC"}

package/dist/authorization/model/iam_policy.d.ts

@@ -1,2 +0,0 @@
-export declare const iamPolicyDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=iam_policy.d.ts.map

package/dist/authorization/model/iam_policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"iam_policy.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/iam_policy.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,oBAAoB,wCAoB/B,CAAC"}

package/dist/authorization/model/iam_policy.js

@@ -1,31 +0,0 @@
-/**
- * Transcript of fga/model/iam/iam_policy.fga — the access-list row as an
- * object of the model: its organization's admins own and view it. Declared
- * for completeness of the transcript set (the drift compare reads every
- * open-source file); no wire check targets it — the IamPolicy RPCs
- * authorize against the policy's RESOURCE (`can_grant_access` on the
- * organization; `get` loads the row and asks about what it names), and the
- * tuple lifecycle writes nothing for it.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const iamPolicyDeclaration = declareKind({
-    kind: ApiResourceKind.iam_policy,
-    schema: IamPolicySchema,
-    source: "fga/model/iam/iam_policy.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        ["viewer", from("admin", "organization")],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=iam_policy.js.map

package/dist/authorization/model/iam_policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"iam_policy.js","sourceRoot":"","sources":["../../../src/authorization/model/iam_policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAErF,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;IAC9C,IAAI,EAAE,eAAe,CAAC,UAAU;IAChC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,8BAA8B;IACtC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACzC,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/identity_account.d.ts

@@ -1,2 +0,0 @@
-export declare const identityAccountDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=identity_account.d.ts.map

package/dist/authorization/model/identity_account.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity_account.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/identity_account.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,0BAA0B,wCAYrC,CAAC"}

package/dist/authorization/model/identity_account.js

@@ -1,25 +0,0 @@
-/**
- * Transcript of fga/model/iam/identity_account.fga — a person's own
- * record: every verb is `owner`, and the owner is the account itself
- * (`kind_meta` attribution SELF, so the derivation writes
- * `identity_account:<id>#owner@identity_account:<id>`). No organization
- * link and no admin arm: an admin manages members through IamPolicy rows
- * on the organization, never through the account row.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-export const identityAccountDeclaration = declareKind({
-    kind: ApiResourceKind.identity_account,
-    schema: IdentityAccountSchema,
-    source: "fga/model/iam/identity_account.fga",
-    relations: [
-        ["owner", direct(objectOf("identity_account"))],
-        ["can_view", computed("owner")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("owner")],
-    ],
-});
-//# sourceMappingURL=identity_account.js.map

package/dist/authorization/model/identity_account.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity_account.js","sourceRoot":"","sources":["../../../src/authorization/model/identity_account.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0DAA0D,CAAC;AAEjG,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,CAAC,MAAM,0BAA0B,GAAG,WAAW,CAAC;IACpD,IAAI,EAAE,eAAe,CAAC,gBAAgB;IACtC,MAAM,EAAE,qBAAqB;IAC7B,MAAM,EAAE,oCAAoC;IAC5C,SAAS,EAAE;QACT,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KACvC;CACF,CAAC,CAAC"}

package/dist/authorization/model/mcp_server.d.ts

@@ -1,2 +0,0 @@
-export declare const mcpServerDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=mcp_server.d.ts.map

package/dist/authorization/model/mcp_server.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp_server.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/mcp_server.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,oBAAoB,wCAuC/B,CAAC"}

package/dist/authorization/model/mcp_server.js

@@ -1,38 +0,0 @@
-/**
- * Transcript of fga/model/agentic/mcp_server.fga — a blueprint with three
- * read-side verbs: `can_use`, `can_clone` and `can_connect` (the OAuth
- * connect lane's gate), all `viewer`. `team#member` on `viewer` is the
- * Enterprise team grant, which no open-source tuple ever names.
- */
-import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, from, objectOf, union, usersetOf, } from "./rewrite.js";
-export const mcpServerDeclaration = declareKind({
-    kind: ApiResourceKind.mcp_server,
-    schema: McpServerSchema,
-    source: "fga/model/agentic/mcp_server.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        [
-            "owner",
-            union(direct(objectOf("identity_account")), from("admin", "organization")),
-        ],
-        [
-            "platform_viewer",
-            direct(usersetOf("identity_provider", "platform_user")),
-        ],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account"), usersetOf("organization", "member"), usersetOf("organization", "viewer"), usersetOf("team", "member")), computed("owner"), computed("platform_viewer")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_use", computed("viewer")],
-        ["can_clone", computed("viewer")],
-        ["can_connect", computed("viewer")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=mcp_server.js.map

package/dist/authorization/model/mcp_server.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp_server.js","sourceRoot":"","sources":["../../../src/authorization/model/mcp_server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wDAAwD,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,SAAS,GACV,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;IAC9C,IAAI,EAAE,eAAe,CAAC,UAAU;IAChC,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,kCAAkC;IAC1C,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD;YACE,OAAO;YACP,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD;YACE,iBAAiB;YACjB,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC;SACxD;QACD;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CACJ,QAAQ,CAAC,kBAAkB,CAAC,EAC5B,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,EACnC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAC5B,EACD,QAAQ,CAAC,OAAO,CAAC,EACjB,QAAQ,CAAC,iBAAiB,CAAC,CAC5B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/memory.d.ts

@@ -1,2 +0,0 @@
-export declare const memoryDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=memory.d.ts.map

package/dist/authorization/model/memory.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/memory.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,iBAAiB,wCAW5B,CAAC"}

package/dist/authorization/model/memory.js

@@ -1,26 +0,0 @@
-/**
- * Transcript of fga/model/agentic/memory.fga — subject-only: the person a
- * memory is ABOUT is its one principal (no owner, no creator, no
- * visibility, nothing grantable; `kind_meta` attribution NONE with
- * `subject` as an additional parent on `spec.subject_identity_account_id`).
- * Organization admins govern the organization's memory switch and never
- * read content, in the contract's own words. A row whose subject field is
- * empty derives no principal at all — the derivation's rule for an
- * absent parent — and is then nobody's under this evaluator.
- */
-import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-export const memoryDeclaration = declareKind({
-    kind: ApiResourceKind.memory,
-    schema: MemorySchema,
-    source: "fga/model/agentic/memory.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["subject", direct(objectOf("identity_account"))],
-        ["can_view", computed("subject")],
-        ["can_edit", computed("subject")],
-        ["can_delete", computed("subject")],
-    ],
-});
-//# sourceMappingURL=memory.js.map

package/dist/authorization/model/memory.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../../src/authorization/model/memory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAEtH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;IAC3C,IAAI,EAAE,eAAe,CAAC,MAAM;IAC5B,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,8BAA8B;IACtC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACjD,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;KACpC;CACF,CAAC,CAAC"}

package/dist/authorization/model/oauth_app.d.ts

@@ -1,2 +0,0 @@
-export declare const oauthAppDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=oauth_app.d.ts.map

package/dist/authorization/model/oauth_app.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth_app.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/oauth_app.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,mBAAmB,wCAqB9B,CAAC"}

package/dist/authorization/model/oauth_app.js

@@ -1,31 +0,0 @@
-/**
- * Transcript of fga/model/iam/oauth_app.fga — an organization-scoped kind
- * whose `owner` has NO admin arm while its `viewer` does (platform_client
- * shares the shape, for the same reason): the file's
- * "administrative visibility" for the organization's admins over a
- * registration that holds vendor client credentials, with change and
- * deletion the creator's (or an explicit grant's) alone, and no public
- * level at all.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
-import { computed, declareKind, direct, from, objectOf, union, } from "./rewrite.js";
-export const oauthAppDeclaration = declareKind({
-    kind: ApiResourceKind.oauth_app,
-    schema: OAuthAppSchema,
-    source: "fga/model/iam/oauth_app.fga",
-    relations: [
-        ["organization", direct(objectOf("organization"))],
-        ["owner", direct(objectOf("identity_account"))],
-        [
-            "viewer",
-            union(direct(objectOf("identity_account")), computed("owner"), from("admin", "organization")),
-        ],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("owner")],
-        ["can_delete", computed("owner")],
-        ["can_grant_access", computed("owner")],
-        ["can_view_access", computed("viewer")],
-    ],
-});
-//# sourceMappingURL=oauth_app.js.map

package/dist/authorization/model/oauth_app.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth_app.js","sourceRoot":"","sources":["../../../src/authorization/model/oauth_app.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AAEnF,OAAO,EACL,QAAQ,EACR,WAAW,EACX,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,KAAK,GACN,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;IAC7C,IAAI,EAAE,eAAe,CAAC,SAAS;IAC/B,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,6BAA6B;IACrC,SAAS,EAAE;QACT,CAAC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAClD,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/C;YACE,QAAQ;YACR,KAAK,CACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,EACpC,QAAQ,CAAC,OAAO,CAAC,EACjB,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAC9B;SACF;QACD,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;KACxC;CACF,CAAC,CAAC"}

package/dist/authorization/model/organization.d.ts

@@ -1,2 +0,0 @@
-export declare const organizationDeclaration: import("./rewrite.js").KindDeclaration;
-//# sourceMappingURL=organization.d.ts.map

package/dist/authorization/model/organization.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../../src/authorization/model/organization.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,uBAAuB,wCAoClC,CAAC"}

package/dist/authorization/model/organization.js

@@ -1,58 +0,0 @@
-/**
- * Transcript of fga/model/tenancy/organization.fga — the root of the
- * model: no parent, the four roles as a ladder (`owner ⊂ admin ⊂ member
- * ⊂ viewer`, each `[identity_account] or <the rung above>`), and every
- * `can_create_*` an organization gates.
- *
- * In open source the `[identity_account]` tuples of this type ARE the
- * IamPolicy rows: 2b's role lifecycle writes the creator's `owner` row and
- * the grant path writes every other role, so the tuple source reads them
- * from the IamPolicyStore and the derivation writes no owner tuple for
- * this kind (derived-tuples.ts). `guest` is the cloud's anonymous
- * share-link visitor; no open-source lane mints one (claim check C5), so
- * the relation resolves to nothing and `can_create_session: member or
- * guest` is `member` here — the transcript still carries the line.
- * `can_create_team` is carried the same way: open source serves no Team
- * kind, so nothing here asks it.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
-import { computed, declareKind, direct, objectOf, union } from "./rewrite.js";
-export const organizationDeclaration = declareKind({
-    kind: ApiResourceKind.organization,
-    schema: OrganizationSchema,
-    source: "fga/model/tenancy/organization.fga",
-    relations: [
-        ["owner", direct(objectOf("identity_account"))],
-        ["admin", union(direct(objectOf("identity_account")), computed("owner"))],
-        ["member", union(direct(objectOf("identity_account")), computed("admin"))],
-        ["viewer", union(direct(objectOf("identity_account")), computed("member"))],
-        ["guest", direct(objectOf("identity_account"))],
-        ["can_view", computed("viewer")],
-        ["can_edit", computed("admin")],
-        ["can_delete", computed("owner")],
-        ["can_manage_members", computed("admin")],
-        ["can_assign_roles", computed("owner")],
-        ["can_create_agent", computed("admin")],
-        ["can_create_workflow", computed("admin")],
-        ["can_create_session", union(computed("member"), computed("guest"))],
-        ["can_create_environment", computed("member")],
-        ["can_create_skill", computed("admin")],
-        ["can_create_plugin", computed("admin")],
-        ["can_create_mcp_server", computed("admin")],
-        ["can_create_idp", computed("admin")],
-        ["can_create_identity_account", computed("admin")],
-        ["can_create_oauth_app", computed("admin")],
-        ["can_create_platform_client", computed("admin")],
-        ["can_create_channel_app", computed("admin")],
-        ["can_create_execution_in", union(computed("member"), computed("guest"))],
-        ["can_create_agent_share", computed("admin")],
-        ["can_create_agent_instance", computed("member")],
-        ["can_create_team", computed("admin")],
-        ["can_grant_access", computed("admin")],
-        ["can_view_access", computed("viewer")],
-        ["can_view_billing", computed("viewer")],
-        ["can_manage_billing", computed("admin")],
-    ],
-});
-//# sourceMappingURL=organization.js.map