@stigmer/server 3.27.2 → 3.28.0

package/src/authorization/model/environment.ts

@@ -1,48 +0,0 @@
-/**
- * Transcript of fga/model/agentic/environment.fga — a member's credential
- * store: owner-only writes (no admin arm), an org-visibility axis capped
- * at the organization (`kind_meta` supports_org only — no public
- * wildcard on the viewer line, and the evaluator would ignore one), and
- * `can_read_secrets: creator`, the one verb that stays with the person
- * who typed the values whatever the visibility, standing on the creator
- * tuple `kind_meta` flags with requires_creator_tuple.
- */
-import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  objectOf,
-  union,
-  usersetOf,
-} from "./rewrite.js";
-
-export const environmentDeclaration = declareKind({
-  kind: ApiResourceKind.environment,
-  schema: EnvironmentSchema,
-  source: "fga/model/agentic/environment.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    ["creator", direct(objectOf("identity_account"))],
-    ["owner", direct(objectOf("identity_account"))],
-    [
-      "viewer",
-      union(
-        direct(
-          objectOf("identity_account"),
-          usersetOf("organization", "member"),
-          usersetOf("organization", "viewer"),
-        ),
-        computed("owner"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_read_secrets", computed("creator")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/execution_context.ts

@@ -1,20 +0,0 @@
-/**
- * Transcript of fga/model/agentic/execution_context.fga — a run's working
- * state, owner-only and unscoped (`kind_meta` OWNER_ONLY): two verbs,
- * both `owner`, and no access list to grant on.
- */
-import { ExecutionContextSchema } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-
-export const executionContextDeclaration = declareKind({
-  kind: ApiResourceKind.execution_context,
-  schema: ExecutionContextSchema,
-  source: "fga/model/agentic/execution_context.fga",
-  relations: [
-    ["owner", direct(objectOf("identity_account"))],
-    ["can_view", computed("owner")],
-    ["can_edit", computed("owner")],
-  ],
-});

package/src/authorization/model/iam_policy.ts

@@ -1,42 +0,0 @@
-/**
- * Transcript of fga/model/iam/iam_policy.fga — the access-list row as an
- * object of the model: its organization's admins own and view it. Declared
- * for completeness of the transcript set (the drift compare reads every
- * open-source file); no wire check targets it — the IamPolicy RPCs
- * authorize against the policy's RESOURCE (`can_grant_access` on the
- * organization; `get` loads the row and asks about what it names), and the
- * tuple lifecycle writes nothing for it.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { IamPolicySchema } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/api_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-} from "./rewrite.js";
-
-export const iamPolicyDeclaration = declareKind({
-  kind: ApiResourceKind.iam_policy,
-  schema: IamPolicySchema,
-  source: "fga/model/iam/iam_policy.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    ["viewer", from("admin", "organization")],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/identity_account.ts

@@ -1,26 +0,0 @@
-/**
- * Transcript of fga/model/iam/identity_account.fga — a person's own
- * record: every verb is `owner`, and the owner is the account itself
- * (`kind_meta` attribution SELF, so the derivation writes
- * `identity_account:<id>#owner@identity_account:<id>`). No organization
- * link and no admin arm: an admin manages members through IamPolicy rows
- * on the organization, never through the account row.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { IdentityAccountSchema } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
-
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-
-export const identityAccountDeclaration = declareKind({
-  kind: ApiResourceKind.identity_account,
-  schema: IdentityAccountSchema,
-  source: "fga/model/iam/identity_account.fga",
-  relations: [
-    ["owner", direct(objectOf("identity_account"))],
-    ["can_view", computed("owner")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("owner")],
-  ],
-});

package/src/authorization/model/mcp_server.ts

@@ -1,59 +0,0 @@
-/**
- * Transcript of fga/model/agentic/mcp_server.fga — a blueprint with three
- * read-side verbs: `can_use`, `can_clone` and `can_connect` (the OAuth
- * connect lane's gate), all `viewer`. `team#member` on `viewer` is the
- * Enterprise team grant, which no open-source tuple ever names.
- */
-import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-  usersetOf,
-} from "./rewrite.js";
-
-export const mcpServerDeclaration = declareKind({
-  kind: ApiResourceKind.mcp_server,
-  schema: McpServerSchema,
-  source: "fga/model/agentic/mcp_server.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    [
-      "platform_viewer",
-      direct(usersetOf("identity_provider", "platform_user")),
-    ],
-    [
-      "viewer",
-      union(
-        direct(
-          objectOf("identity_account"),
-          usersetOf("organization", "member"),
-          usersetOf("organization", "viewer"),
-          usersetOf("team", "member"),
-        ),
-        computed("owner"),
-        computed("platform_viewer"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_use", computed("viewer")],
-    ["can_clone", computed("viewer")],
-    ["can_connect", computed("viewer")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/memory.ts

@@ -1,27 +0,0 @@
-/**
- * Transcript of fga/model/agentic/memory.fga — subject-only: the person a
- * memory is ABOUT is its one principal (no owner, no creator, no
- * visibility, nothing grantable; `kind_meta` attribution NONE with
- * `subject` as an additional parent on `spec.subject_identity_account_id`).
- * Organization admins govern the organization's memory switch and never
- * read content, in the contract's own words. A row whose subject field is
- * empty derives no principal at all — the derivation's rule for an
- * absent parent — and is then nobody's under this evaluator.
- */
-import { MemorySchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import { computed, declareKind, direct, objectOf } from "./rewrite.js";
-
-export const memoryDeclaration = declareKind({
-  kind: ApiResourceKind.memory,
-  schema: MemorySchema,
-  source: "fga/model/agentic/memory.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    ["subject", direct(objectOf("identity_account"))],
-    ["can_view", computed("subject")],
-    ["can_edit", computed("subject")],
-    ["can_delete", computed("subject")],
-  ],
-});

package/src/authorization/model/oauth_app.ts

@@ -1,43 +0,0 @@
-/**
- * Transcript of fga/model/iam/oauth_app.fga — an organization-scoped kind
- * whose `owner` has NO admin arm while its `viewer` does (platform_client
- * shares the shape, for the same reason): the file's
- * "administrative visibility" for the organization's admins over a
- * registration that holds vendor client credentials, with change and
- * deletion the creator's (or an explicit grant's) alone, and no public
- * level at all.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { OAuthAppSchema } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-} from "./rewrite.js";
-
-export const oauthAppDeclaration = declareKind({
-  kind: ApiResourceKind.oauth_app,
-  schema: OAuthAppSchema,
-  source: "fga/model/iam/oauth_app.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    ["owner", direct(objectOf("identity_account"))],
-    [
-      "viewer",
-      union(
-        direct(objectOf("identity_account")),
-        computed("owner"),
-        from("admin", "organization"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/organization.ts

@@ -1,59 +0,0 @@
-/**
- * Transcript of fga/model/tenancy/organization.fga — the root of the
- * model: no parent, the four roles as a ladder (`owner ⊂ admin ⊂ member
- * ⊂ viewer`, each `[identity_account] or <the rung above>`), and every
- * `can_create_*` an organization gates.
- *
- * In open source the `[identity_account]` tuples of this type ARE the
- * IamPolicy rows: 2b's role lifecycle writes the creator's `owner` row and
- * the grant path writes every other role, so the tuple source reads them
- * from the IamPolicyStore and the derivation writes no owner tuple for
- * this kind (derived-tuples.ts). `guest` is the cloud's anonymous
- * share-link visitor; no open-source lane mints one (claim check C5), so
- * the relation resolves to nothing and `can_create_session: member or
- * guest` is `member` here — the transcript still carries the line.
- * `can_create_team` is carried the same way: open source serves no Team
- * kind, so nothing here asks it.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
-
-import { computed, declareKind, direct, objectOf, union } from "./rewrite.js";
-
-export const organizationDeclaration = declareKind({
-  kind: ApiResourceKind.organization,
-  schema: OrganizationSchema,
-  source: "fga/model/tenancy/organization.fga",
-  relations: [
-    ["owner", direct(objectOf("identity_account"))],
-    ["admin", union(direct(objectOf("identity_account")), computed("owner"))],
-    ["member", union(direct(objectOf("identity_account")), computed("admin"))],
-    ["viewer", union(direct(objectOf("identity_account")), computed("member"))],
-    ["guest", direct(objectOf("identity_account"))],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("admin")],
-    ["can_delete", computed("owner")],
-    ["can_manage_members", computed("admin")],
-    ["can_assign_roles", computed("owner")],
-    ["can_create_agent", computed("admin")],
-    ["can_create_workflow", computed("admin")],
-    ["can_create_session", union(computed("member"), computed("guest"))],
-    ["can_create_environment", computed("member")],
-    ["can_create_skill", computed("admin")],
-    ["can_create_plugin", computed("admin")],
-    ["can_create_mcp_server", computed("admin")],
-    ["can_create_idp", computed("admin")],
-    ["can_create_identity_account", computed("admin")],
-    ["can_create_oauth_app", computed("admin")],
-    ["can_create_platform_client", computed("admin")],
-    ["can_create_channel_app", computed("admin")],
-    ["can_create_execution_in", union(computed("member"), computed("guest"))],
-    ["can_create_agent_share", computed("admin")],
-    ["can_create_agent_instance", computed("member")],
-    ["can_create_team", computed("admin")],
-    ["can_grant_access", computed("admin")],
-    ["can_view_access", computed("viewer")],
-    ["can_view_billing", computed("viewer")],
-    ["can_manage_billing", computed("admin")],
-  ],
-});

package/src/authorization/model/platform_client.ts

@@ -1,43 +0,0 @@
-/**
- * Transcript of fga/model/iam/platform_client.fga — relation for relation
- * the oauth_app shape: organization-scoped, an `owner` with no admin arm
- * and a `viewer` that has one. A platform client holds credential material,
- * so the model is restricted: its creator (the owner) edits, deletes,
- * rotates and grants; the organization's admins may view it; ordinary
- * members have no access at all, which is why listByOrg narrows through
- * the list read scope. There is no public level.
- */
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { PlatformClientSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-} from "./rewrite.js";
-
-export const platformClientDeclaration = declareKind({
-  kind: ApiResourceKind.platform_client,
-  schema: PlatformClientSchema,
-  source: "fga/model/iam/platform_client.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    ["owner", direct(objectOf("identity_account"))],
-    [
-      "viewer",
-      union(
-        direct(objectOf("identity_account")),
-        computed("owner"),
-        from("admin", "organization"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/plugin.ts

@@ -1,66 +0,0 @@
-/**
- * Transcript of fga/model/agentic/plugin.fga — the unit of install, shaped
- * exactly like a skill: an organization-owned blueprint whose owner is the
- * installer (and, through the organization, its admins), whose viewers are
- * the org's members and viewers and the platform viewer. Its verbs are the blueprint set: `can_view`, `can_edit`
- * (visibility), `can_delete` (uninstall), `can_grant_access`,
- * `can_view_access`; `can_use` is carried as the model's word for
- * "install from" though no wire permission names it yet. `team#member` on
- * `viewer` is the Enterprise team grant, which no open-source tuple ever
- * names.
- *
- * The members a plugin materialises are NOT reached through this type:
- * each is an ordinary skill, MCP server, agent or workflow with its own
- * tuples, written by its own chain as the installing caller.
- */
-import { PluginSchema } from "@stigmer/protos/ai/stigmer/agentic/plugin/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-  usersetOf,
-} from "./rewrite.js";
-
-export const pluginDeclaration = declareKind({
-  kind: ApiResourceKind.plugin,
-  schema: PluginSchema,
-  source: "fga/model/agentic/plugin.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    [
-      "platform_viewer",
-      direct(usersetOf("identity_provider", "platform_user")),
-    ],
-    [
-      "viewer",
-      union(
-        direct(
-          objectOf("identity_account"),
-          usersetOf("organization", "member"),
-          usersetOf("organization", "viewer"),
-          usersetOf("team", "member"),
-        ),
-        computed("owner"),
-        computed("platform_viewer"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_use", computed("viewer")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/schedule.ts

@@ -1,49 +0,0 @@
-/**
- * Transcript of fga/model/agentic/schedule.fga — a scheduled run's
- * definition, admin-owned like a blueprint and viewable by its owners and
- * explicit grantees. The sessions its fires create name it back through
- * `session#schedule`, a link the cloud writes and this edition does not
- * (session.ts); the schedule's own relations are unaffected. An explicit
- * grant may name an Enterprise team (`team#member`), which no open-source
- * tuple ever does.
- */
-import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-  usersetOf,
-} from "./rewrite.js";
-
-export const scheduleDeclaration = declareKind({
-  kind: ApiResourceKind.schedule,
-  schema: ScheduleSchema,
-  source: "fga/model/agentic/schedule.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    [
-      "viewer",
-      union(
-        direct(objectOf("identity_account"), usersetOf("team", "member")),
-        computed("owner"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/session.ts

@@ -1,50 +0,0 @@
-/**
- * Transcript of fga/model/agentic/session.fga — a personal resource: the
- * owner and explicit grantees, and NO admin arm anywhere ("private
- * conversations that admins have no business accessing", the file's own
- * words). Three parent links beside the organization: `agent_instance`,
- * `channel` and `schedule`. None is a `kind_meta` fact — the cloud's
- * channel and schedule lanes write them — so on this edition the
- * derivation produces no such tuple and `viewer from channel` / `viewer
- * from schedule` resolve to nobody; the lines stand in the transcript
- * because they are the model's, and a scheduled run reaches its creator
- * through the fire caller's stamp on the session instead.
- */
-import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-} from "./rewrite.js";
-
-export const sessionDeclaration = declareKind({
-  kind: ApiResourceKind.session,
-  schema: SessionSchema,
-  source: "fga/model/agentic/session.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    ["agent_instance", direct(objectOf("agent_instance"))],
-    ["channel", direct(objectOf("agent_channel"))],
-    ["schedule", direct(objectOf("schedule"))],
-    ["owner", direct(objectOf("identity_account"))],
-    ["viewer", union(direct(objectOf("identity_account")), computed("owner"))],
-    [
-      "can_view",
-      union(
-        computed("viewer"),
-        from("viewer", "channel"),
-        from("viewer", "schedule"),
-      ),
-    ],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_create_execution_in", computed("viewer")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/skill.ts

@@ -1,60 +0,0 @@
-/**
- * Transcript of fga/model/agentic/skill.fga — a blueprint whose verbs are
- * `can_use` and `can_clone` rather than `can_execute`. Only `can_view`,
- * `can_edit`, `can_delete`, `can_grant_access` and `can_view_access` are
- * in the wire's IamPermission vocabulary; the others are the model's and
- * are carried so the transcript is the file. `team#member` on `viewer` is
- * the Enterprise team grant, which no open-source tuple ever names.
- */
-import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-  usersetOf,
-} from "./rewrite.js";
-
-export const skillDeclaration = declareKind({
-  kind: ApiResourceKind.skill,
-  schema: SkillSchema,
-  source: "fga/model/agentic/skill.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    [
-      "platform_viewer",
-      direct(usersetOf("identity_provider", "platform_user")),
-    ],
-    [
-      "viewer",
-      union(
-        direct(
-          objectOf("identity_account"),
-          usersetOf("organization", "member"),
-          usersetOf("organization", "viewer"),
-          usersetOf("team", "member"),
-        ),
-        computed("owner"),
-        computed("platform_viewer"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_use", computed("viewer")],
-    ["can_clone", computed("viewer")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});

package/src/authorization/model/workflow.ts

@@ -1,60 +0,0 @@
-/**
- * Transcript of fga/model/agentic/workflow.fga — the agent's shape
- * without `can_create_instance` (a workflow instance is created through
- * the workflow-instance lane, gated by the organization). Kept as its own
- * transcript, not a shared "blueprint" helper, so the file-by-file drift
- * compare sees exactly this file's lines. `team#member` on `viewer` is the
- * Enterprise team grant, which no open-source tuple ever names.
- */
-import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-
-import {
-  computed,
-  declareKind,
-  direct,
-  from,
-  objectOf,
-  union,
-  usersetOf,
-} from "./rewrite.js";
-
-export const workflowDeclaration = declareKind({
-  kind: ApiResourceKind.workflow,
-  schema: WorkflowSchema,
-  source: "fga/model/agentic/workflow.fga",
-  relations: [
-    ["organization", direct(objectOf("organization"))],
-    [
-      "owner",
-      union(
-        direct(objectOf("identity_account")),
-        from("admin", "organization"),
-      ),
-    ],
-    [
-      "platform_viewer",
-      direct(usersetOf("identity_provider", "platform_user")),
-    ],
-    [
-      "viewer",
-      union(
-        direct(
-          objectOf("identity_account"),
-          usersetOf("organization", "member"),
-          usersetOf("organization", "viewer"),
-          usersetOf("team", "member"),
-        ),
-        computed("owner"),
-        computed("platform_viewer"),
-      ),
-    ],
-    ["can_view", computed("viewer")],
-    ["can_edit", computed("owner")],
-    ["can_delete", computed("owner")],
-    ["can_execute", computed("viewer")],
-    ["can_clone", computed("viewer")],
-    ["can_grant_access", computed("owner")],
-    ["can_view_access", computed("viewer")],
-  ],
-});