@stigmer/server 3.40.1 → 3.41.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (527) hide show
  1. package/dist/authorization/authorizer.d.ts +16 -10
  2. package/dist/authorization/authorizer.d.ts.map +1 -1
  3. package/dist/authorization/authorizer.js +17 -9
  4. package/dist/authorization/authorizer.js.map +1 -1
  5. package/dist/authorization/derived-tuples.d.ts +7 -3
  6. package/dist/authorization/derived-tuples.d.ts.map +1 -1
  7. package/dist/authorization/derived-tuples.js +62 -6
  8. package/dist/authorization/derived-tuples.js.map +1 -1
  9. package/dist/authorization/evaluator.d.ts +11 -7
  10. package/dist/authorization/evaluator.d.ts.map +1 -1
  11. package/dist/authorization/evaluator.js +16 -10
  12. package/dist/authorization/evaluator.js.map +1 -1
  13. package/dist/authorization/list-read-scope.d.ts +4 -0
  14. package/dist/authorization/list-read-scope.d.ts.map +1 -1
  15. package/dist/authorization/list-read-scope.js +1 -0
  16. package/dist/authorization/list-read-scope.js.map +1 -1
  17. package/dist/authorization/model/data/authorization-model.json +830 -67
  18. package/dist/authorization/model/execution-viewer.d.ts.map +1 -1
  19. package/dist/authorization/model/execution-viewer.js +26 -24
  20. package/dist/authorization/model/execution-viewer.js.map +1 -1
  21. package/dist/authorization/model/index.d.ts +4 -1
  22. package/dist/authorization/model/index.d.ts.map +1 -1
  23. package/dist/authorization/model/index.js +4 -1
  24. package/dist/authorization/model/index.js.map +1 -1
  25. package/dist/authorization/model/rewrite.d.ts +5 -3
  26. package/dist/authorization/model/rewrite.d.ts.map +1 -1
  27. package/dist/authorization/organization-directory.d.ts +44 -0
  28. package/dist/authorization/organization-directory.d.ts.map +1 -1
  29. package/dist/authorization/organization-directory.js +1 -0
  30. package/dist/authorization/organization-directory.js.map +1 -1
  31. package/dist/authorization/person.d.ts +14 -1
  32. package/dist/authorization/person.d.ts.map +1 -1
  33. package/dist/authorization/person.js +16 -0
  34. package/dist/authorization/person.js.map +1 -1
  35. package/dist/authorization/policy-check.d.ts +52 -0
  36. package/dist/authorization/policy-check.d.ts.map +1 -0
  37. package/dist/authorization/policy-check.js +35 -0
  38. package/dist/authorization/policy-check.js.map +1 -0
  39. package/dist/authorization/posture.d.ts +30 -4
  40. package/dist/authorization/posture.d.ts.map +1 -1
  41. package/dist/authorization/posture.js +58 -0
  42. package/dist/authorization/posture.js.map +1 -1
  43. package/dist/authorization/resource-creators.d.ts +4 -0
  44. package/dist/authorization/resource-creators.d.ts.map +1 -0
  45. package/dist/authorization/resource-creators.js +44 -0
  46. package/dist/authorization/resource-creators.js.map +1 -0
  47. package/dist/authorization/trusted-local-authorizer.d.ts +9 -0
  48. package/dist/authorization/trusted-local-authorizer.d.ts.map +1 -0
  49. package/dist/authorization/trusted-local-authorizer.js +70 -0
  50. package/dist/authorization/trusted-local-authorizer.js.map +1 -0
  51. package/dist/authorization/tuples.d.ts +12 -0
  52. package/dist/authorization/tuples.d.ts.map +1 -1
  53. package/dist/authorization/tuples.js +3 -0
  54. package/dist/authorization/tuples.js.map +1 -1
  55. package/dist/boot/compose.d.ts.map +1 -1
  56. package/dist/boot/compose.js +132 -43
  57. package/dist/boot/compose.js.map +1 -1
  58. package/dist/boot/config.d.ts +22 -7
  59. package/dist/boot/config.d.ts.map +1 -1
  60. package/dist/boot/config.js +2 -1
  61. package/dist/boot/config.js.map +1 -1
  62. package/dist/boot/inprocess.d.ts.map +1 -1
  63. package/dist/boot/inprocess.js +10 -4
  64. package/dist/boot/inprocess.js.map +1 -1
  65. package/dist/boot/list-indexes.d.ts.map +1 -1
  66. package/dist/boot/list-indexes.js +6 -1
  67. package/dist/boot/list-indexes.js.map +1 -1
  68. package/dist/boot/logger.d.ts +3 -1
  69. package/dist/boot/logger.d.ts.map +1 -1
  70. package/dist/boot/logger.js +3 -1
  71. package/dist/boot/logger.js.map +1 -1
  72. package/dist/boot/oauth-redirect-uri.d.ts +33 -12
  73. package/dist/boot/oauth-redirect-uri.d.ts.map +1 -1
  74. package/dist/boot/oauth-redirect-uri.js +43 -14
  75. package/dist/boot/oauth-redirect-uri.js.map +1 -1
  76. package/dist/boot/skill-transfer-origin.d.ts +46 -14
  77. package/dist/boot/skill-transfer-origin.d.ts.map +1 -1
  78. package/dist/boot/skill-transfer-origin.js +53 -13
  79. package/dist/boot/skill-transfer-origin.js.map +1 -1
  80. package/dist/domain/agentchannel/steps.d.ts +8 -6
  81. package/dist/domain/agentchannel/steps.d.ts.map +1 -1
  82. package/dist/domain/agentchannel/steps.js +9 -7
  83. package/dist/domain/agentchannel/steps.js.map +1 -1
  84. package/dist/domain/agentexecution/controller.d.ts +7 -0
  85. package/dist/domain/agentexecution/controller.d.ts.map +1 -1
  86. package/dist/domain/agentexecution/controller.js +1 -1
  87. package/dist/domain/agentexecution/controller.js.map +1 -1
  88. package/dist/domain/agentexecution/create-steps.d.ts +26 -12
  89. package/dist/domain/agentexecution/create-steps.d.ts.map +1 -1
  90. package/dist/domain/agentexecution/create-steps.js +61 -43
  91. package/dist/domain/agentexecution/create-steps.js.map +1 -1
  92. package/dist/domain/agentexecution/submit-approval.d.ts.map +1 -1
  93. package/dist/domain/agentexecution/submit-approval.js +9 -6
  94. package/dist/domain/agentexecution/submit-approval.js.map +1 -1
  95. package/dist/domain/agentexecution/submit-file-decision.d.ts.map +1 -1
  96. package/dist/domain/agentexecution/submit-file-decision.js +5 -4
  97. package/dist/domain/agentexecution/submit-file-decision.js.map +1 -1
  98. package/dist/domain/agentshare/steps.d.ts +5 -3
  99. package/dist/domain/agentshare/steps.d.ts.map +1 -1
  100. package/dist/domain/agentshare/steps.js +6 -4
  101. package/dist/domain/agentshare/steps.js.map +1 -1
  102. package/dist/domain/apikey/verifier.d.ts +7 -0
  103. package/dist/domain/apikey/verifier.d.ts.map +1 -1
  104. package/dist/domain/apikey/verifier.js +34 -1
  105. package/dist/domain/apikey/verifier.js.map +1 -1
  106. package/dist/domain/channelapp/controller.d.ts +4 -3
  107. package/dist/domain/channelapp/controller.d.ts.map +1 -1
  108. package/dist/domain/channelapp/controller.js.map +1 -1
  109. package/dist/domain/executioncontext/steps.d.ts +2 -1
  110. package/dist/domain/executioncontext/steps.d.ts.map +1 -1
  111. package/dist/domain/executioncontext/steps.js +2 -1
  112. package/dist/domain/executioncontext/steps.js.map +1 -1
  113. package/dist/domain/iampolicy/access-lists.d.ts.map +1 -1
  114. package/dist/domain/iampolicy/access-lists.js +57 -2
  115. package/dist/domain/iampolicy/access-lists.js.map +1 -1
  116. package/dist/domain/iampolicy/change.d.ts +53 -0
  117. package/dist/domain/iampolicy/change.d.ts.map +1 -0
  118. package/dist/domain/iampolicy/change.js +44 -0
  119. package/dist/domain/iampolicy/change.js.map +1 -0
  120. package/dist/domain/iampolicy/constants.d.ts +6 -0
  121. package/dist/domain/iampolicy/constants.d.ts.map +1 -1
  122. package/dist/domain/iampolicy/constants.js +6 -0
  123. package/dist/domain/iampolicy/constants.js.map +1 -1
  124. package/dist/domain/iampolicy/controller.d.ts.map +1 -1
  125. package/dist/domain/iampolicy/controller.js +9 -5
  126. package/dist/domain/iampolicy/controller.js.map +1 -1
  127. package/dist/domain/iampolicy/grant-path.d.ts +31 -13
  128. package/dist/domain/iampolicy/grant-path.d.ts.map +1 -1
  129. package/dist/domain/iampolicy/grant-path.js +216 -19
  130. package/dist/domain/iampolicy/grant-path.js.map +1 -1
  131. package/dist/domain/iampolicy/membership.d.ts +11 -3
  132. package/dist/domain/iampolicy/membership.d.ts.map +1 -1
  133. package/dist/domain/iampolicy/membership.js +18 -13
  134. package/dist/domain/iampolicy/membership.js.map +1 -1
  135. package/dist/domain/iampolicy/resource-store.d.ts.map +1 -1
  136. package/dist/domain/iampolicy/resource-store.js +4 -0
  137. package/dist/domain/iampolicy/resource-store.js.map +1 -1
  138. package/dist/domain/iampolicy/role-lifecycle.d.ts.map +1 -1
  139. package/dist/domain/iampolicy/role-lifecycle.js +2 -2
  140. package/dist/domain/iampolicy/role-lifecycle.js.map +1 -1
  141. package/dist/domain/iampolicy/roles.d.ts.map +1 -1
  142. package/dist/domain/iampolicy/roles.js +7 -0
  143. package/dist/domain/iampolicy/roles.js.map +1 -1
  144. package/dist/domain/iampolicy/steps.d.ts +4 -3
  145. package/dist/domain/iampolicy/steps.d.ts.map +1 -1
  146. package/dist/domain/iampolicy/steps.js +7 -7
  147. package/dist/domain/iampolicy/steps.js.map +1 -1
  148. package/dist/domain/iampolicy/store-contract.d.ts.map +1 -1
  149. package/dist/domain/iampolicy/store-contract.js +22 -1
  150. package/dist/domain/iampolicy/store-contract.js.map +1 -1
  151. package/dist/domain/iampolicy/store.d.ts +18 -5
  152. package/dist/domain/iampolicy/store.d.ts.map +1 -1
  153. package/dist/domain/iampolicy/store.js.map +1 -1
  154. package/dist/domain/identityaccount/constants.d.ts +15 -0
  155. package/dist/domain/identityaccount/constants.d.ts.map +1 -1
  156. package/dist/domain/identityaccount/constants.js +17 -0
  157. package/dist/domain/identityaccount/constants.js.map +1 -1
  158. package/dist/domain/identityaccount/controller.d.ts.map +1 -1
  159. package/dist/domain/identityaccount/controller.js +17 -6
  160. package/dist/domain/identityaccount/controller.js.map +1 -1
  161. package/dist/domain/identityaccount/resolve.d.ts +47 -0
  162. package/dist/domain/identityaccount/resolve.d.ts.map +1 -1
  163. package/dist/domain/identityaccount/resolve.js +38 -1
  164. package/dist/domain/identityaccount/resolve.js.map +1 -1
  165. package/dist/domain/identityaccount/resource-store.d.ts.map +1 -1
  166. package/dist/domain/identityaccount/resource-store.js +11 -1
  167. package/dist/domain/identityaccount/resource-store.js.map +1 -1
  168. package/dist/domain/identityaccount/steps.d.ts +2 -1
  169. package/dist/domain/identityaccount/steps.d.ts.map +1 -1
  170. package/dist/domain/identityaccount/steps.js +4 -3
  171. package/dist/domain/identityaccount/steps.js.map +1 -1
  172. package/dist/domain/identityaccount/store-contract.js +2 -2
  173. package/dist/domain/identityaccount/store-contract.js.map +1 -1
  174. package/dist/domain/identityaccount/store.d.ts +6 -1
  175. package/dist/domain/identityaccount/store.d.ts.map +1 -1
  176. package/dist/domain/mcpserver/connect-sandbox.d.ts +67 -0
  177. package/dist/domain/mcpserver/connect-sandbox.d.ts.map +1 -0
  178. package/dist/domain/mcpserver/connect-sandbox.js +64 -0
  179. package/dist/domain/mcpserver/connect-sandbox.js.map +1 -0
  180. package/dist/domain/mcpserver/connect.d.ts +42 -10
  181. package/dist/domain/mcpserver/connect.d.ts.map +1 -1
  182. package/dist/domain/mcpserver/connect.js +147 -40
  183. package/dist/domain/mcpserver/connect.js.map +1 -1
  184. package/dist/domain/mcpserver/controller.js +4 -2
  185. package/dist/domain/mcpserver/controller.js.map +1 -1
  186. package/dist/domain/mcpserver/engine.d.ts +26 -7
  187. package/dist/domain/mcpserver/engine.d.ts.map +1 -1
  188. package/dist/domain/mcpserver/engine.js.map +1 -1
  189. package/dist/domain/mcpserver/start-connect.d.ts +5 -0
  190. package/dist/domain/mcpserver/start-connect.d.ts.map +1 -1
  191. package/dist/domain/mcpserver/start-connect.js +38 -15
  192. package/dist/domain/mcpserver/start-connect.js.map +1 -1
  193. package/dist/domain/memory/controller.js +2 -1
  194. package/dist/domain/memory/controller.js.map +1 -1
  195. package/dist/domain/memory/list-index.d.ts +2 -0
  196. package/dist/domain/memory/list-index.d.ts.map +1 -0
  197. package/dist/domain/memory/list-index.js +31 -0
  198. package/dist/domain/memory/list-index.js.map +1 -0
  199. package/dist/domain/memory/queries.d.ts +10 -0
  200. package/dist/domain/memory/queries.d.ts.map +1 -0
  201. package/dist/domain/memory/queries.js +54 -0
  202. package/dist/domain/memory/queries.js.map +1 -0
  203. package/dist/domain/memory/steps.d.ts +13 -11
  204. package/dist/domain/memory/steps.d.ts.map +1 -1
  205. package/dist/domain/memory/steps.js +26 -57
  206. package/dist/domain/memory/steps.js.map +1 -1
  207. package/dist/domain/organization/steps.d.ts.map +1 -1
  208. package/dist/domain/organization/steps.js +1 -1
  209. package/dist/domain/organization/steps.js.map +1 -1
  210. package/dist/domain/platformclient/mint.d.ts.map +1 -1
  211. package/dist/domain/platformclient/mint.js +2 -2
  212. package/dist/domain/platformclient/mint.js.map +1 -1
  213. package/dist/domain/platformclient/verifier.d.ts.map +1 -1
  214. package/dist/domain/platformclient/verifier.js +6 -3
  215. package/dist/domain/platformclient/verifier.js.map +1 -1
  216. package/dist/domain/plugin/push.d.ts.map +1 -1
  217. package/dist/domain/plugin/push.js +1 -0
  218. package/dist/domain/plugin/push.js.map +1 -1
  219. package/dist/domain/schedule/steps.d.ts +3 -1
  220. package/dist/domain/schedule/steps.d.ts.map +1 -1
  221. package/dist/domain/schedule/steps.js +3 -1
  222. package/dist/domain/schedule/steps.js.map +1 -1
  223. package/dist/domain/skill/push.d.ts.map +1 -1
  224. package/dist/domain/skill/push.js +1 -0
  225. package/dist/domain/skill/push.js.map +1 -1
  226. package/dist/domain/workflow/registry/data/task-kind-registry.json +27 -1
  227. package/dist/domain/workflowexecution/submit-approval.d.ts +5 -2
  228. package/dist/domain/workflowexecution/submit-approval.d.ts.map +1 -1
  229. package/dist/domain/workflowexecution/submit-approval.js +1 -1
  230. package/dist/domain/workflowexecution/submit-approval.js.map +1 -1
  231. package/dist/domain/workflowexecution/submit-file-decision.d.ts +5 -2
  232. package/dist/domain/workflowexecution/submit-file-decision.d.ts.map +1 -1
  233. package/dist/domain/workflowexecution/submit-file-decision.js +1 -1
  234. package/dist/domain/workflowexecution/submit-file-decision.js.map +1 -1
  235. package/dist/domain/workflowexecution/submit-workflow-task-approval.d.ts.map +1 -1
  236. package/dist/domain/workflowexecution/submit-workflow-task-approval.js +12 -1
  237. package/dist/domain/workflowexecution/submit-workflow-task-approval.js.map +1 -1
  238. package/dist/domain/workflowinstance/controller.d.ts +6 -3
  239. package/dist/domain/workflowinstance/controller.d.ts.map +1 -1
  240. package/dist/domain/workflowinstance/controller.js +12 -7
  241. package/dist/domain/workflowinstance/controller.js.map +1 -1
  242. package/dist/domain/workflowinstance/steps.d.ts +31 -0
  243. package/dist/domain/workflowinstance/steps.d.ts.map +1 -1
  244. package/dist/domain/workflowinstance/steps.js +88 -1
  245. package/dist/domain/workflowinstance/steps.js.map +1 -1
  246. package/dist/extensions/composed-services.d.ts +56 -0
  247. package/dist/extensions/composed-services.d.ts.map +1 -0
  248. package/dist/extensions/composed-services.js +2 -0
  249. package/dist/extensions/composed-services.js.map +1 -0
  250. package/dist/extensions/drivers.d.ts +32 -1
  251. package/dist/extensions/drivers.d.ts.map +1 -1
  252. package/dist/extensions/identity.d.ts +4 -1
  253. package/dist/extensions/identity.d.ts.map +1 -1
  254. package/dist/extensions/identity.js +4 -1
  255. package/dist/extensions/identity.js.map +1 -1
  256. package/dist/extensions/registry.d.ts +37 -0
  257. package/dist/extensions/registry.d.ts.map +1 -1
  258. package/dist/extensions/registry.js +50 -0
  259. package/dist/extensions/registry.js.map +1 -1
  260. package/dist/extensions/resource-authorization.d.ts +78 -0
  261. package/dist/extensions/resource-authorization.d.ts.map +1 -1
  262. package/dist/extensions/resource-row-reader.d.ts +43 -0
  263. package/dist/extensions/resource-row-reader.d.ts.map +1 -0
  264. package/dist/extensions/resource-row-reader.js +2 -0
  265. package/dist/extensions/resource-row-reader.js.map +1 -0
  266. package/dist/extensions/visitor-classifier.d.ts +41 -0
  267. package/dist/extensions/visitor-classifier.d.ts.map +1 -0
  268. package/dist/extensions/visitor-classifier.js +2 -0
  269. package/dist/extensions/visitor-classifier.js.map +1 -0
  270. package/dist/identity/oidc-userinfo.d.ts +6 -1
  271. package/dist/identity/oidc-userinfo.d.ts.map +1 -1
  272. package/dist/identity/oidc-userinfo.js.map +1 -1
  273. package/dist/identity/oidc-verifier.d.ts.map +1 -1
  274. package/dist/identity/oidc-verifier.js +37 -8
  275. package/dist/identity/oidc-verifier.js.map +1 -1
  276. package/dist/index.d.ts +14 -6
  277. package/dist/index.d.ts.map +1 -1
  278. package/dist/index.js +25 -9
  279. package/dist/index.js.map +1 -1
  280. package/dist/pipeline/errors.d.ts +8 -0
  281. package/dist/pipeline/errors.d.ts.map +1 -1
  282. package/dist/pipeline/errors.js +25 -16
  283. package/dist/pipeline/errors.js.map +1 -1
  284. package/dist/pipeline/interceptors/auth.d.ts +17 -9
  285. package/dist/pipeline/interceptors/auth.d.ts.map +1 -1
  286. package/dist/pipeline/interceptors/auth.js +17 -9
  287. package/dist/pipeline/interceptors/auth.js.map +1 -1
  288. package/dist/pipeline/steps/authorization-tuples.d.ts +23 -1
  289. package/dist/pipeline/steps/authorization-tuples.d.ts.map +1 -1
  290. package/dist/pipeline/steps/authorization-tuples.js +42 -0
  291. package/dist/pipeline/steps/authorization-tuples.js.map +1 -1
  292. package/dist/pipeline/steps/authorize.d.ts +6 -5
  293. package/dist/pipeline/steps/authorize.d.ts.map +1 -1
  294. package/dist/pipeline/steps/authorize.js +6 -5
  295. package/dist/pipeline/steps/authorize.js.map +1 -1
  296. package/dist/pipeline/steps/defaults.d.ts +12 -0
  297. package/dist/pipeline/steps/defaults.d.ts.map +1 -1
  298. package/dist/pipeline/steps/defaults.js +42 -7
  299. package/dist/pipeline/steps/defaults.js.map +1 -1
  300. package/dist/pipeline/steps/guard-memory-capture.d.ts +13 -15
  301. package/dist/pipeline/steps/guard-memory-capture.d.ts.map +1 -1
  302. package/dist/pipeline/steps/guard-memory-capture.js +2 -3
  303. package/dist/pipeline/steps/guard-memory-capture.js.map +1 -1
  304. package/dist/runnerauth/built-in-runner-credential-provider.d.ts +0 -2
  305. package/dist/runnerauth/built-in-runner-credential-provider.d.ts.map +1 -1
  306. package/dist/runnerauth/built-in-runner-credential-provider.js +8 -17
  307. package/dist/runnerauth/built-in-runner-credential-provider.js.map +1 -1
  308. package/dist/runnerauth/runner-credential-provider.d.ts +17 -7
  309. package/dist/runnerauth/runner-credential-provider.d.ts.map +1 -1
  310. package/dist/runnerauth/runner-credential-provider.js.map +1 -1
  311. package/dist/sandbox/docker.d.ts.map +1 -1
  312. package/dist/sandbox/docker.js +3 -0
  313. package/dist/sandbox/docker.js.map +1 -1
  314. package/dist/sandbox/kubernetes.d.ts.map +1 -1
  315. package/dist/sandbox/kubernetes.js +3 -0
  316. package/dist/sandbox/kubernetes.js.map +1 -1
  317. package/dist/sandbox/local-process.d.ts.map +1 -1
  318. package/dist/sandbox/local-process.js +4 -0
  319. package/dist/sandbox/local-process.js.map +1 -1
  320. package/dist/sandbox/provisioner.d.ts +18 -6
  321. package/dist/sandbox/provisioner.d.ts.map +1 -1
  322. package/dist/sandbox/provisioner.js.map +1 -1
  323. package/dist/temporal/manager.d.ts +5 -0
  324. package/dist/temporal/manager.d.ts.map +1 -1
  325. package/dist/temporal/manager.js +9 -0
  326. package/dist/temporal/manager.js.map +1 -1
  327. package/dist/temporal/mcpserver/engine-client.d.ts +2 -2
  328. package/dist/temporal/mcpserver/engine-client.d.ts.map +1 -1
  329. package/dist/temporal/mcpserver/engine-client.js +6 -4
  330. package/dist/temporal/mcpserver/engine-client.js.map +1 -1
  331. package/dist/temporal/mcpserver/names.d.ts +13 -2
  332. package/dist/temporal/mcpserver/names.d.ts.map +1 -1
  333. package/dist/temporal/mcpserver/names.js +15 -2
  334. package/dist/temporal/mcpserver/names.js.map +1 -1
  335. package/dist/temporal/sdk-logger.d.ts +74 -0
  336. package/dist/temporal/sdk-logger.d.ts.map +1 -0
  337. package/dist/temporal/sdk-logger.js +143 -0
  338. package/dist/temporal/sdk-logger.js.map +1 -0
  339. package/package.json +6 -6
  340. package/src/authorization/README.md +18 -6
  341. package/src/authorization/__tests__/authorizer.test.ts +5 -1
  342. package/src/authorization/__tests__/derived-tuples.test.ts +26 -0
  343. package/src/authorization/__tests__/evaluator.test.ts +4 -0
  344. package/src/authorization/__tests__/list-read-scope.test.ts +11 -5
  345. package/src/authorization/__tests__/store-tests.test.ts +3 -1
  346. package/src/authorization/__tests__/trusted-local-authorizer.test.ts +155 -0
  347. package/src/authorization/__tests__/unit-owned-kinds.test.ts +420 -0
  348. package/src/authorization/__tests__/wire-permissions.test.ts +31 -2
  349. package/src/authorization/authorizer.ts +21 -10
  350. package/src/authorization/derived-tuples.ts +92 -18
  351. package/src/authorization/evaluator.ts +30 -15
  352. package/src/authorization/list-read-scope.ts +4 -0
  353. package/src/authorization/model/__tests__/registry.test.ts +23 -0
  354. package/src/authorization/model/data/authorization-model.json +830 -67
  355. package/src/authorization/model/execution-viewer.ts +32 -27
  356. package/src/authorization/model/index.ts +4 -1
  357. package/src/authorization/model/rewrite.ts +5 -3
  358. package/src/authorization/organization-directory.ts +4 -0
  359. package/src/authorization/person.ts +32 -1
  360. package/src/authorization/policy-check.ts +105 -0
  361. package/src/authorization/posture.ts +45 -4
  362. package/src/authorization/resource-creators.ts +48 -0
  363. package/src/authorization/trusted-local-authorizer.ts +91 -0
  364. package/src/authorization/tuples.ts +17 -0
  365. package/src/boot/__tests__/compose.test.ts +120 -4
  366. package/src/boot/__tests__/list-indexes.test.ts +4 -0
  367. package/src/boot/__tests__/oauth-redirect-uri.test.ts +121 -10
  368. package/src/boot/__tests__/skill-transfer-origin.test.ts +96 -25
  369. package/src/boot/compose.ts +153 -61
  370. package/src/boot/config.ts +28 -12
  371. package/src/boot/inprocess.ts +18 -4
  372. package/src/boot/list-indexes.ts +6 -1
  373. package/src/boot/logger.ts +3 -1
  374. package/src/boot/oauth-redirect-uri.ts +62 -17
  375. package/src/boot/skill-transfer-origin.ts +71 -16
  376. package/src/domain/agent/__tests__/agent.test.ts +42 -1
  377. package/src/domain/agentchannel/__tests__/agentchannel.test.ts +9 -0
  378. package/src/domain/agentchannel/__tests__/channel-runtime.test.ts +2 -0
  379. package/src/domain/agentchannel/__tests__/create-authorization.test.ts +7 -6
  380. package/src/domain/agentchannel/steps.ts +9 -7
  381. package/src/domain/agentexecution/__tests__/agentexecution.test.ts +148 -56
  382. package/src/domain/agentexecution/__tests__/create-steps.test.ts +175 -12
  383. package/src/domain/agentexecution/__tests__/file-review-seed.ts +91 -0
  384. package/src/domain/agentexecution/controller.ts +8 -0
  385. package/src/domain/agentexecution/create-steps.ts +74 -44
  386. package/src/domain/agentexecution/submit-approval.ts +9 -6
  387. package/src/domain/agentexecution/submit-file-decision.ts +5 -4
  388. package/src/domain/agentinstance/__tests__/agentinstance.test.ts +2 -0
  389. package/src/domain/agentshare/__tests__/agentshare.test.ts +17 -0
  390. package/src/domain/agentshare/__tests__/create-authorization.test.ts +5 -4
  391. package/src/domain/agentshare/steps.ts +6 -4
  392. package/src/domain/apikey/__tests__/verifier.test.ts +73 -1
  393. package/src/domain/apikey/verifier.ts +45 -1
  394. package/src/domain/artifact/__tests__/artifact.test.ts +13 -24
  395. package/src/domain/channelapp/__tests__/channelapp.test.ts +7 -0
  396. package/src/domain/channelapp/controller.ts +4 -3
  397. package/src/domain/environment/__tests__/environment.test.ts +13 -0
  398. package/src/domain/executioncontext/__tests__/executioncontext.test.ts +2 -0
  399. package/src/domain/executioncontext/steps.ts +2 -1
  400. package/src/domain/iampolicy/__tests__/access-lists.test.ts +79 -0
  401. package/src/domain/iampolicy/__tests__/change.test.ts +63 -0
  402. package/src/domain/iampolicy/__tests__/controller.test.ts +39 -3
  403. package/src/domain/iampolicy/__tests__/grant-path.test.ts +595 -27
  404. package/src/domain/iampolicy/__tests__/iampolicy.test.ts +33 -2
  405. package/src/domain/iampolicy/__tests__/membership.test.ts +47 -5
  406. package/src/domain/iampolicy/__tests__/resource-store.test.ts +1 -0
  407. package/src/domain/iampolicy/__tests__/role-lifecycle.test.ts +41 -8
  408. package/src/domain/iampolicy/__tests__/roles.test.ts +3 -2
  409. package/src/domain/iampolicy/__tests__/steps.test.ts +75 -6
  410. package/src/domain/iampolicy/__tests__/support.ts +68 -4
  411. package/src/domain/iampolicy/access-lists.ts +70 -2
  412. package/src/domain/iampolicy/change.ts +109 -0
  413. package/src/domain/iampolicy/constants.ts +8 -0
  414. package/src/domain/iampolicy/controller.ts +17 -3
  415. package/src/domain/iampolicy/grant-path.ts +349 -31
  416. package/src/domain/iampolicy/membership.ts +32 -12
  417. package/src/domain/iampolicy/resource-store.ts +4 -0
  418. package/src/domain/iampolicy/role-lifecycle.ts +2 -0
  419. package/src/domain/iampolicy/roles.ts +8 -0
  420. package/src/domain/iampolicy/steps.ts +15 -5
  421. package/src/domain/iampolicy/store-contract.ts +37 -1
  422. package/src/domain/iampolicy/store.ts +19 -5
  423. package/src/domain/identityaccount/__tests__/resolve.test.ts +246 -2
  424. package/src/domain/identityaccount/__tests__/resource-store.test.ts +1 -1
  425. package/src/domain/identityaccount/constants.ts +20 -0
  426. package/src/domain/identityaccount/controller.ts +20 -5
  427. package/src/domain/identityaccount/resolve.ts +80 -1
  428. package/src/domain/identityaccount/resource-store.ts +14 -1
  429. package/src/domain/identityaccount/steps.ts +4 -3
  430. package/src/domain/identityaccount/store-contract.ts +4 -4
  431. package/src/domain/identityaccount/store.ts +6 -1
  432. package/src/domain/mcpserver/__tests__/connect-authorization.test.ts +1 -0
  433. package/src/domain/mcpserver/__tests__/connect.test.ts +358 -15
  434. package/src/domain/mcpserver/__tests__/mcpserver.test.ts +2 -0
  435. package/src/domain/mcpserver/__tests__/oauth-handshake.test.ts +2 -0
  436. package/src/domain/mcpserver/__tests__/store-faults.test.ts +2 -0
  437. package/src/domain/mcpserver/connect-sandbox.ts +135 -0
  438. package/src/domain/mcpserver/connect.ts +226 -56
  439. package/src/domain/mcpserver/controller.ts +8 -2
  440. package/src/domain/mcpserver/engine.ts +24 -6
  441. package/src/domain/mcpserver/start-connect.ts +49 -10
  442. package/src/domain/memory/__tests__/memory.test.ts +92 -22
  443. package/src/domain/memory/__tests__/queries.test.ts +173 -0
  444. package/src/domain/memory/controller.ts +2 -1
  445. package/src/domain/memory/list-index.ts +32 -0
  446. package/src/domain/memory/queries.ts +72 -0
  447. package/src/domain/memory/steps.ts +26 -63
  448. package/src/domain/oauthapp/__tests__/oauthapp.test.ts +14 -0
  449. package/src/domain/organization/__tests__/support.ts +41 -0
  450. package/src/domain/organization/steps.ts +1 -0
  451. package/src/domain/platformclient/mint.ts +6 -2
  452. package/src/domain/platformclient/verifier.ts +6 -3
  453. package/src/domain/plugin/__tests__/plugin.test.ts +11 -24
  454. package/src/domain/plugin/push.ts +1 -0
  455. package/src/domain/schedule/__tests__/schedule.composed.test.ts +2 -0
  456. package/src/domain/schedule/steps.ts +3 -1
  457. package/src/domain/session/__tests__/session.test.ts +2 -0
  458. package/src/domain/skill/__tests__/skill.test.ts +7 -25
  459. package/src/domain/skill/push.ts +1 -0
  460. package/src/domain/workflow/__tests__/workflow.test.ts +2 -0
  461. package/src/domain/workflow/registry/data/task-kind-registry.json +27 -1
  462. package/src/domain/workflowexecution/__tests__/forward-attribution-composed.test.ts +270 -0
  463. package/src/domain/workflowexecution/__tests__/submit-workflow-task-approval.test.ts +196 -0
  464. package/src/domain/workflowexecution/__tests__/workflowexecution.test.ts +3 -57
  465. package/src/domain/workflowexecution/submit-approval.ts +9 -2
  466. package/src/domain/workflowexecution/submit-file-decision.ts +6 -1
  467. package/src/domain/workflowexecution/submit-workflow-task-approval.ts +23 -5
  468. package/src/domain/workflowinstance/controller.ts +27 -9
  469. package/src/domain/workflowinstance/steps.ts +123 -1
  470. package/src/extensions/__tests__/apikey-before-sign-in-composed.test.ts +172 -0
  471. package/src/extensions/__tests__/built-in-authorization-composed.test.ts +80 -1
  472. package/src/extensions/__tests__/composed-services-composed.test.ts +236 -0
  473. package/src/extensions/__tests__/extension-composition.test.ts +229 -16
  474. package/src/extensions/__tests__/identity-account-composed.test.ts +84 -4
  475. package/src/extensions/__tests__/list-read-scope-composed.test.ts +2 -0
  476. package/src/extensions/__tests__/registry.test.ts +147 -1
  477. package/src/extensions/__tests__/secret-cleanup-composed.test.ts +2 -0
  478. package/src/extensions/__tests__/visitor-classifier-points.test.ts +42 -0
  479. package/src/extensions/composed-services.ts +61 -0
  480. package/src/extensions/drivers.ts +33 -1
  481. package/src/extensions/identity.ts +4 -1
  482. package/src/extensions/registry.ts +105 -0
  483. package/src/extensions/resource-authorization.ts +87 -0
  484. package/src/extensions/resource-row-reader.ts +43 -0
  485. package/src/extensions/visitor-classifier.ts +41 -0
  486. package/src/identity/__tests__/oidc-verifier.test.ts +38 -12
  487. package/src/identity/oidc-userinfo.ts +6 -1
  488. package/src/identity/oidc-verifier.ts +42 -8
  489. package/src/index.ts +61 -6
  490. package/src/pipeline/__tests__/steps.test.ts +31 -4
  491. package/src/pipeline/errors.ts +30 -16
  492. package/src/pipeline/interceptors/auth.ts +17 -9
  493. package/src/pipeline/steps/__tests__/authorization-tuples.test.ts +20 -0
  494. package/src/pipeline/steps/__tests__/guard-memory-capture.test.ts +72 -15
  495. package/src/pipeline/steps/authorization-tuples.ts +54 -0
  496. package/src/pipeline/steps/authorize.ts +6 -5
  497. package/src/pipeline/steps/defaults.ts +52 -7
  498. package/src/pipeline/steps/guard-memory-capture.ts +15 -20
  499. package/src/runnerauth/__tests__/built-in-runner-credential-provider.test.ts +1 -1
  500. package/src/runnerauth/__tests__/runner-subject-composed.test.ts +13 -0
  501. package/src/runnerauth/bound-execution.ts +2 -2
  502. package/src/runnerauth/built-in-runner-credential-provider.ts +8 -21
  503. package/src/runnerauth/runner-credential-provider.ts +17 -7
  504. package/src/sandbox/__tests__/docker.integration.test.ts +4 -0
  505. package/src/sandbox/__tests__/kubernetes.test.ts +18 -1
  506. package/src/sandbox/__tests__/local-process.integration.test.ts +4 -0
  507. package/src/sandbox/__tests__/provisioner.test.ts +1 -0
  508. package/src/sandbox/docker.ts +3 -0
  509. package/src/sandbox/kubernetes.ts +3 -0
  510. package/src/sandbox/local-process.ts +4 -0
  511. package/src/sandbox/provisioner.ts +18 -6
  512. package/src/store/postgres/__tests__/support.ts +11 -2
  513. package/src/temporal/README.md +1 -0
  514. package/src/temporal/__tests__/manager.test.ts +56 -4
  515. package/src/temporal/__tests__/sdk-log-workflows.ts +26 -0
  516. package/src/temporal/__tests__/sdk-logger.e2e.test.ts +150 -0
  517. package/src/temporal/__tests__/sdk-logger.test.ts +238 -0
  518. package/src/temporal/manager.ts +9 -0
  519. package/src/temporal/mcpserver/engine-client.ts +8 -3
  520. package/src/temporal/mcpserver/names.ts +16 -2
  521. package/src/temporal/sdk-logger.ts +173 -0
  522. package/dist/authorization/lane-admission.d.ts +0 -50
  523. package/dist/authorization/lane-admission.d.ts.map +0 -1
  524. package/dist/authorization/lane-admission.js +0 -13
  525. package/dist/authorization/lane-admission.js.map +0 -1
  526. package/src/authorization/__tests__/lane-admission.test.ts +0 -115
  527. package/src/authorization/lane-admission.ts +0 -73
package/src/authorization/model/data/authorization-model.json CHANGED
@@ -275,7 +275,23 @@
275
275
  "union": {
276
276
  "child": [
277
277
  {
278
- "this": {}
278
+ "intersection": {
279
+ "child": [
280
+ {
281
+ "this": {}
282
+ },
283
+ {
284
+ "tupleToUserset": {
285
+ "computedUserset": {
286
+ "relation": "affiliated"
287
+ },
288
+ "tupleset": {
289
+ "relation": "organization"
290
+ }
291
+ }
292
+ }
293
+ ]
294
+ }
279
295
  },
280
296
  {
281
297
  "computedUserset": {
@@ -521,7 +537,23 @@
521
537
  "union": {
522
538
  "child": [
523
539
  {
524
- "this": {}
540
+ "intersection": {
541
+ "child": [
542
+ {
543
+ "this": {}
544
+ },
545
+ {
546
+ "tupleToUserset": {
547
+ "computedUserset": {
548
+ "relation": "affiliated"
549
+ },
550
+ "tupleset": {
551
+ "relation": "organization"
552
+ }
553
+ }
554
+ }
555
+ ]
556
+ }
525
557
  },
526
558
  {
527
559
  "computedUserset": {
@@ -606,7 +638,23 @@
606
638
  "union": {
607
639
  "child": [
608
640
  {
609
- "this": {}
641
+ "intersection": {
642
+ "child": [
643
+ {
644
+ "this": {}
645
+ },
646
+ {
647
+ "tupleToUserset": {
648
+ "computedUserset": {
649
+ "relation": "affiliated"
650
+ },
651
+ "tupleset": {
652
+ "relation": "organization"
653
+ }
654
+ }
655
+ }
656
+ ]
657
+ }
610
658
  },
611
659
  {
612
660
  "computedUserset": {
@@ -798,6 +846,13 @@
798
846
  }
799
847
  ]
800
848
  },
849
+ "affiliated": {
850
+ "directly_related_user_types": [
851
+ {
852
+ "type": "identity_account"
853
+ }
854
+ ]
855
+ },
801
856
  "can_assign_roles": {},
802
857
  "can_create_agent": {},
803
858
  "can_create_agent_instance": {},
@@ -871,6 +926,9 @@
871
926
  ]
872
927
  }
873
928
  },
929
+ "affiliated": {
930
+ "this": {}
931
+ },
874
932
  "can_assign_roles": {
875
933
  "computedUserset": {
876
934
  "relation": "owner"
@@ -1065,8 +1123,20 @@
1065
1123
  "can_edit": {},
1066
1124
  "can_execute": {},
1067
1125
  "can_grant_access": {},
1126
+ "can_manage_audience": {},
1068
1127
  "can_view": {},
1069
1128
  "can_view_access": {},
1129
+ "editor": {
1130
+ "directly_related_user_types": [
1131
+ {
1132
+ "type": "identity_account"
1133
+ },
1134
+ {
1135
+ "relation": "member",
1136
+ "type": "team"
1137
+ }
1138
+ ]
1139
+ },
1070
1140
  "organization": {
1071
1141
  "directly_related_user_types": [
1072
1142
  {
@@ -1130,8 +1200,19 @@
1130
1200
  }
1131
1201
  },
1132
1202
  "can_edit": {
1133
- "computedUserset": {
1134
- "relation": "owner"
1203
+ "union": {
1204
+ "child": [
1205
+ {
1206
+ "computedUserset": {
1207
+ "relation": "owner"
1208
+ }
1209
+ },
1210
+ {
1211
+ "computedUserset": {
1212
+ "relation": "editor"
1213
+ }
1214
+ }
1215
+ ]
1135
1216
  }
1136
1217
  },
1137
1218
  "can_execute": {
@@ -1144,6 +1225,11 @@
1144
1225
  "relation": "owner"
1145
1226
  }
1146
1227
  },
1228
+ "can_manage_audience": {
1229
+ "computedUserset": {
1230
+ "relation": "owner"
1231
+ }
1232
+ },
1147
1233
  "can_view": {
1148
1234
  "computedUserset": {
1149
1235
  "relation": "viewer"
@@ -1154,6 +1240,25 @@
1154
1240
  "relation": "viewer"
1155
1241
  }
1156
1242
  },
1243
+ "editor": {
1244
+ "intersection": {
1245
+ "child": [
1246
+ {
1247
+ "this": {}
1248
+ },
1249
+ {
1250
+ "tupleToUserset": {
1251
+ "computedUserset": {
1252
+ "relation": "affiliated"
1253
+ },
1254
+ "tupleset": {
1255
+ "relation": "organization"
1256
+ }
1257
+ }
1258
+ }
1259
+ ]
1260
+ }
1261
+ },
1157
1262
  "organization": {
1158
1263
  "this": {}
1159
1264
  },
@@ -1161,7 +1266,23 @@
1161
1266
  "union": {
1162
1267
  "child": [
1163
1268
  {
1164
- "this": {}
1269
+ "intersection": {
1270
+ "child": [
1271
+ {
1272
+ "this": {}
1273
+ },
1274
+ {
1275
+ "tupleToUserset": {
1276
+ "computedUserset": {
1277
+ "relation": "affiliated"
1278
+ },
1279
+ "tupleset": {
1280
+ "relation": "organization"
1281
+ }
1282
+ }
1283
+ }
1284
+ ]
1285
+ }
1165
1286
  },
1166
1287
  {
1167
1288
  "tupleToUserset": {
@@ -1183,13 +1304,34 @@
1183
1304
  "union": {
1184
1305
  "child": [
1185
1306
  {
1186
- "this": {}
1307
+ "intersection": {
1308
+ "child": [
1309
+ {
1310
+ "this": {}
1311
+ },
1312
+ {
1313
+ "tupleToUserset": {
1314
+ "computedUserset": {
1315
+ "relation": "affiliated"
1316
+ },
1317
+ "tupleset": {
1318
+ "relation": "organization"
1319
+ }
1320
+ }
1321
+ }
1322
+ ]
1323
+ }
1187
1324
  },
1188
1325
  {
1189
1326
  "computedUserset": {
1190
1327
  "relation": "owner"
1191
1328
  }
1192
1329
  },
1330
+ {
1331
+ "computedUserset": {
1332
+ "relation": "editor"
1333
+ }
1334
+ },
1193
1335
  {
1194
1336
  "computedUserset": {
1195
1337
  "relation": "platform_viewer"
@@ -1290,7 +1432,23 @@
1290
1432
  "union": {
1291
1433
  "child": [
1292
1434
  {
1293
- "this": {}
1435
+ "intersection": {
1436
+ "child": [
1437
+ {
1438
+ "this": {}
1439
+ },
1440
+ {
1441
+ "tupleToUserset": {
1442
+ "computedUserset": {
1443
+ "relation": "affiliated"
1444
+ },
1445
+ "tupleset": {
1446
+ "relation": "organization"
1447
+ }
1448
+ }
1449
+ }
1450
+ ]
1451
+ }
1294
1452
  },
1295
1453
  {
1296
1454
  "tupleToUserset": {
@@ -1309,7 +1467,23 @@
1309
1467
  "union": {
1310
1468
  "child": [
1311
1469
  {
1312
- "this": {}
1470
+ "intersection": {
1471
+ "child": [
1472
+ {
1473
+ "this": {}
1474
+ },
1475
+ {
1476
+ "tupleToUserset": {
1477
+ "computedUserset": {
1478
+ "relation": "affiliated"
1479
+ },
1480
+ "tupleset": {
1481
+ "relation": "organization"
1482
+ }
1483
+ }
1484
+ }
1485
+ ]
1486
+ }
1313
1487
  },
1314
1488
  {
1315
1489
  "computedUserset": {
@@ -1323,7 +1497,23 @@
1323
1497
  "union": {
1324
1498
  "child": [
1325
1499
  {
1326
- "this": {}
1500
+ "intersection": {
1501
+ "child": [
1502
+ {
1503
+ "this": {}
1504
+ },
1505
+ {
1506
+ "tupleToUserset": {
1507
+ "computedUserset": {
1508
+ "relation": "affiliated"
1509
+ },
1510
+ "tupleset": {
1511
+ "relation": "organization"
1512
+ }
1513
+ }
1514
+ }
1515
+ ]
1516
+ }
1327
1517
  },
1328
1518
  {
1329
1519
  "computedUserset": {
@@ -1404,7 +1594,23 @@
1404
1594
  "union": {
1405
1595
  "child": [
1406
1596
  {
1407
- "this": {}
1597
+ "intersection": {
1598
+ "child": [
1599
+ {
1600
+ "this": {}
1601
+ },
1602
+ {
1603
+ "tupleToUserset": {
1604
+ "computedUserset": {
1605
+ "relation": "affiliated"
1606
+ },
1607
+ "tupleset": {
1608
+ "relation": "organization"
1609
+ }
1610
+ }
1611
+ }
1612
+ ]
1613
+ }
1408
1614
  },
1409
1615
  {
1410
1616
  "tupleToUserset": {
@@ -1423,7 +1629,23 @@
1423
1629
  "union": {
1424
1630
  "child": [
1425
1631
  {
1426
- "this": {}
1632
+ "intersection": {
1633
+ "child": [
1634
+ {
1635
+ "this": {}
1636
+ },
1637
+ {
1638
+ "tupleToUserset": {
1639
+ "computedUserset": {
1640
+ "relation": "affiliated"
1641
+ },
1642
+ "tupleset": {
1643
+ "relation": "organization"
1644
+ }
1645
+ }
1646
+ }
1647
+ ]
1648
+ }
1427
1649
  },
1428
1650
  {
1429
1651
  "computedUserset": {
@@ -1452,13 +1674,7 @@
1452
1674
  }
1453
1675
  ]
1454
1676
  },
1455
- "owner": {
1456
- "directly_related_user_types": [
1457
- {
1458
- "type": "identity_account"
1459
- }
1460
- ]
1461
- },
1677
+ "owner": {},
1462
1678
  "viewer": {
1463
1679
  "directly_related_user_types": [
1464
1680
  {
@@ -1501,29 +1717,36 @@
1501
1717
  "this": {}
1502
1718
  },
1503
1719
  "owner": {
1504
- "union": {
1505
- "child": [
1506
- {
1507
- "this": {}
1508
- },
1509
- {
1510
- "tupleToUserset": {
1511
- "computedUserset": {
1512
- "relation": "admin"
1513
- },
1514
- "tupleset": {
1515
- "relation": "organization"
1516
- }
1517
- }
1518
- }
1519
- ]
1720
+ "tupleToUserset": {
1721
+ "computedUserset": {
1722
+ "relation": "admin"
1723
+ },
1724
+ "tupleset": {
1725
+ "relation": "organization"
1726
+ }
1520
1727
  }
1521
1728
  },
1522
1729
  "viewer": {
1523
1730
  "union": {
1524
1731
  "child": [
1525
1732
  {
1526
- "this": {}
1733
+ "intersection": {
1734
+ "child": [
1735
+ {
1736
+ "this": {}
1737
+ },
1738
+ {
1739
+ "tupleToUserset": {
1740
+ "computedUserset": {
1741
+ "relation": "affiliated"
1742
+ },
1743
+ "tupleset": {
1744
+ "relation": "organization"
1745
+ }
1746
+ }
1747
+ }
1748
+ ]
1749
+ }
1527
1750
  },
1528
1751
  {
1529
1752
  "computedUserset": {
@@ -1551,6 +1774,7 @@
1551
1774
  "can_edit": {},
1552
1775
  "can_execute": {},
1553
1776
  "can_grant_access": {},
1777
+ "can_manage_audience": {},
1554
1778
  "can_view": {},
1555
1779
  "can_view_access": {},
1556
1780
  "default_of": {
@@ -1622,6 +1846,11 @@
1622
1846
  "relation": "owner"
1623
1847
  }
1624
1848
  },
1849
+ "can_manage_audience": {
1850
+ "computedUserset": {
1851
+ "relation": "owner"
1852
+ }
1853
+ },
1625
1854
  "can_view": {
1626
1855
  "computedUserset": {
1627
1856
  "relation": "viewer"
@@ -1639,13 +1868,45 @@
1639
1868
  "this": {}
1640
1869
  },
1641
1870
  "owner": {
1642
- "this": {}
1871
+ "intersection": {
1872
+ "child": [
1873
+ {
1874
+ "this": {}
1875
+ },
1876
+ {
1877
+ "tupleToUserset": {
1878
+ "computedUserset": {
1879
+ "relation": "affiliated"
1880
+ },
1881
+ "tupleset": {
1882
+ "relation": "organization"
1883
+ }
1884
+ }
1885
+ }
1886
+ ]
1887
+ }
1643
1888
  },
1644
1889
  "viewer": {
1645
1890
  "union": {
1646
1891
  "child": [
1647
1892
  {
1648
- "this": {}
1893
+ "intersection": {
1894
+ "child": [
1895
+ {
1896
+ "this": {}
1897
+ },
1898
+ {
1899
+ "tupleToUserset": {
1900
+ "computedUserset": {
1901
+ "relation": "affiliated"
1902
+ },
1903
+ "tupleset": {
1904
+ "relation": "organization"
1905
+ }
1906
+ }
1907
+ }
1908
+ ]
1909
+ }
1649
1910
  },
1650
1911
  {
1651
1912
  "computedUserset": {
@@ -1815,13 +2076,45 @@
1815
2076
  "this": {}
1816
2077
  },
1817
2078
  "owner": {
1818
- "this": {}
2079
+ "intersection": {
2080
+ "child": [
2081
+ {
2082
+ "this": {}
2083
+ },
2084
+ {
2085
+ "tupleToUserset": {
2086
+ "computedUserset": {
2087
+ "relation": "affiliated"
2088
+ },
2089
+ "tupleset": {
2090
+ "relation": "organization"
2091
+ }
2092
+ }
2093
+ }
2094
+ ]
2095
+ }
1819
2096
  },
1820
2097
  "viewer": {
1821
2098
  "union": {
1822
2099
  "child": [
1823
2100
  {
1824
- "this": {}
2101
+ "intersection": {
2102
+ "child": [
2103
+ {
2104
+ "this": {}
2105
+ },
2106
+ {
2107
+ "tupleToUserset": {
2108
+ "computedUserset": {
2109
+ "relation": "affiliated"
2110
+ },
2111
+ "tupleset": {
2112
+ "relation": "organization"
2113
+ }
2114
+ }
2115
+ }
2116
+ ]
2117
+ }
1825
2118
  },
1826
2119
  {
1827
2120
  "tupleToUserset": {
@@ -1846,6 +2139,7 @@
1846
2139
  "can_delete": {},
1847
2140
  "can_edit": {},
1848
2141
  "can_grant_access": {},
2142
+ "can_manage_audience": {},
1849
2143
  "can_read_secrets": {},
1850
2144
  "can_view": {},
1851
2145
  "can_view_access": {},
@@ -1906,6 +2200,11 @@
1906
2200
  "relation": "owner"
1907
2201
  }
1908
2202
  },
2203
+ "can_manage_audience": {
2204
+ "computedUserset": {
2205
+ "relation": "owner"
2206
+ }
2207
+ },
1909
2208
  "can_read_secrets": {
1910
2209
  "computedUserset": {
1911
2210
  "relation": "creator"
@@ -1922,19 +2221,67 @@
1922
2221
  }
1923
2222
  },
1924
2223
  "creator": {
1925
- "this": {}
2224
+ "intersection": {
2225
+ "child": [
2226
+ {
2227
+ "this": {}
2228
+ },
2229
+ {
2230
+ "tupleToUserset": {
2231
+ "computedUserset": {
2232
+ "relation": "affiliated"
2233
+ },
2234
+ "tupleset": {
2235
+ "relation": "organization"
2236
+ }
2237
+ }
2238
+ }
2239
+ ]
2240
+ }
1926
2241
  },
1927
2242
  "organization": {
1928
2243
  "this": {}
1929
2244
  },
1930
2245
  "owner": {
1931
- "this": {}
2246
+ "intersection": {
2247
+ "child": [
2248
+ {
2249
+ "this": {}
2250
+ },
2251
+ {
2252
+ "tupleToUserset": {
2253
+ "computedUserset": {
2254
+ "relation": "affiliated"
2255
+ },
2256
+ "tupleset": {
2257
+ "relation": "organization"
2258
+ }
2259
+ }
2260
+ }
2261
+ ]
2262
+ }
1932
2263
  },
1933
2264
  "viewer": {
1934
2265
  "union": {
1935
2266
  "child": [
1936
2267
  {
1937
- "this": {}
2268
+ "intersection": {
2269
+ "child": [
2270
+ {
2271
+ "this": {}
2272
+ },
2273
+ {
2274
+ "tupleToUserset": {
2275
+ "computedUserset": {
2276
+ "relation": "affiliated"
2277
+ },
2278
+ "tupleset": {
2279
+ "relation": "organization"
2280
+ }
2281
+ }
2282
+ }
2283
+ ]
2284
+ }
1938
2285
  },
1939
2286
  {
1940
2287
  "computedUserset": {
@@ -1991,9 +2338,21 @@
1991
2338
  "can_delete": {},
1992
2339
  "can_edit": {},
1993
2340
  "can_grant_access": {},
2341
+ "can_manage_audience": {},
1994
2342
  "can_use": {},
1995
2343
  "can_view": {},
1996
2344
  "can_view_access": {},
2345
+ "editor": {
2346
+ "directly_related_user_types": [
2347
+ {
2348
+ "type": "identity_account"
2349
+ },
2350
+ {
2351
+ "relation": "member",
2352
+ "type": "team"
2353
+ }
2354
+ ]
2355
+ },
1997
2356
  "organization": {
1998
2357
  "directly_related_user_types": [
1999
2358
  {
@@ -2057,11 +2416,27 @@
2057
2416
  }
2058
2417
  },
2059
2418
  "can_edit": {
2419
+ "union": {
2420
+ "child": [
2421
+ {
2422
+ "computedUserset": {
2423
+ "relation": "owner"
2424
+ }
2425
+ },
2426
+ {
2427
+ "computedUserset": {
2428
+ "relation": "editor"
2429
+ }
2430
+ }
2431
+ ]
2432
+ }
2433
+ },
2434
+ "can_grant_access": {
2060
2435
  "computedUserset": {
2061
2436
  "relation": "owner"
2062
2437
  }
2063
2438
  },
2064
- "can_grant_access": {
2439
+ "can_manage_audience": {
2065
2440
  "computedUserset": {
2066
2441
  "relation": "owner"
2067
2442
  }
@@ -2081,6 +2456,25 @@
2081
2456
  "relation": "viewer"
2082
2457
  }
2083
2458
  },
2459
+ "editor": {
2460
+ "intersection": {
2461
+ "child": [
2462
+ {
2463
+ "this": {}
2464
+ },
2465
+ {
2466
+ "tupleToUserset": {
2467
+ "computedUserset": {
2468
+ "relation": "affiliated"
2469
+ },
2470
+ "tupleset": {
2471
+ "relation": "organization"
2472
+ }
2473
+ }
2474
+ }
2475
+ ]
2476
+ }
2477
+ },
2084
2478
  "organization": {
2085
2479
  "this": {}
2086
2480
  },
@@ -2088,7 +2482,23 @@
2088
2482
  "union": {
2089
2483
  "child": [
2090
2484
  {
2091
- "this": {}
2485
+ "intersection": {
2486
+ "child": [
2487
+ {
2488
+ "this": {}
2489
+ },
2490
+ {
2491
+ "tupleToUserset": {
2492
+ "computedUserset": {
2493
+ "relation": "affiliated"
2494
+ },
2495
+ "tupleset": {
2496
+ "relation": "organization"
2497
+ }
2498
+ }
2499
+ }
2500
+ ]
2501
+ }
2092
2502
  },
2093
2503
  {
2094
2504
  "tupleToUserset": {
@@ -2110,13 +2520,34 @@
2110
2520
  "union": {
2111
2521
  "child": [
2112
2522
  {
2113
- "this": {}
2523
+ "intersection": {
2524
+ "child": [
2525
+ {
2526
+ "this": {}
2527
+ },
2528
+ {
2529
+ "tupleToUserset": {
2530
+ "computedUserset": {
2531
+ "relation": "affiliated"
2532
+ },
2533
+ "tupleset": {
2534
+ "relation": "organization"
2535
+ }
2536
+ }
2537
+ }
2538
+ ]
2539
+ }
2114
2540
  },
2115
2541
  {
2116
2542
  "computedUserset": {
2117
2543
  "relation": "owner"
2118
2544
  }
2119
2545
  },
2546
+ {
2547
+ "computedUserset": {
2548
+ "relation": "editor"
2549
+ }
2550
+ },
2120
2551
  {
2121
2552
  "computedUserset": {
2122
2553
  "relation": "platform_viewer"
@@ -2148,7 +2579,8 @@
2148
2579
  "type": "identity_account"
2149
2580
  }
2150
2581
  ]
2151
- }
2582
+ },
2583
+ "subject_in_organization": {}
2152
2584
  },
2153
2585
  "source_info": {
2154
2586
  "file": "agentic/memory.fga"
@@ -2157,17 +2589,17 @@
2157
2589
  "relations": {
2158
2590
  "can_delete": {
2159
2591
  "computedUserset": {
2160
- "relation": "subject"
2592
+ "relation": "subject_in_organization"
2161
2593
  }
2162
2594
  },
2163
2595
  "can_edit": {
2164
2596
  "computedUserset": {
2165
- "relation": "subject"
2597
+ "relation": "subject_in_organization"
2166
2598
  }
2167
2599
  },
2168
2600
  "can_view": {
2169
2601
  "computedUserset": {
2170
- "relation": "subject"
2602
+ "relation": "subject_in_organization"
2171
2603
  }
2172
2604
  },
2173
2605
  "organization": {
@@ -2175,6 +2607,27 @@
2175
2607
  },
2176
2608
  "subject": {
2177
2609
  "this": {}
2610
+ },
2611
+ "subject_in_organization": {
2612
+ "intersection": {
2613
+ "child": [
2614
+ {
2615
+ "computedUserset": {
2616
+ "relation": "subject"
2617
+ }
2618
+ },
2619
+ {
2620
+ "tupleToUserset": {
2621
+ "computedUserset": {
2622
+ "relation": "affiliated"
2623
+ },
2624
+ "tupleset": {
2625
+ "relation": "organization"
2626
+ }
2627
+ }
2628
+ }
2629
+ ]
2630
+ }
2178
2631
  }
2179
2632
  },
2180
2633
  "type": "memory"
@@ -2186,6 +2639,7 @@
2186
2639
  "can_delete": {},
2187
2640
  "can_edit": {},
2188
2641
  "can_grant_access": {},
2642
+ "can_manage_audience": {},
2189
2643
  "can_use": {},
2190
2644
  "can_view": {},
2191
2645
  "can_view_access": {},
@@ -2251,6 +2705,11 @@
2251
2705
  "relation": "owner"
2252
2706
  }
2253
2707
  },
2708
+ "can_manage_audience": {
2709
+ "computedUserset": {
2710
+ "relation": "owner"
2711
+ }
2712
+ },
2254
2713
  "can_use": {
2255
2714
  "computedUserset": {
2256
2715
  "relation": "viewer"
@@ -2273,7 +2732,23 @@
2273
2732
  "union": {
2274
2733
  "child": [
2275
2734
  {
2276
- "this": {}
2735
+ "intersection": {
2736
+ "child": [
2737
+ {
2738
+ "this": {}
2739
+ },
2740
+ {
2741
+ "tupleToUserset": {
2742
+ "computedUserset": {
2743
+ "relation": "affiliated"
2744
+ },
2745
+ "tupleset": {
2746
+ "relation": "organization"
2747
+ }
2748
+ }
2749
+ }
2750
+ ]
2751
+ }
2277
2752
  },
2278
2753
  {
2279
2754
  "tupleToUserset": {
@@ -2295,7 +2770,23 @@
2295
2770
  "union": {
2296
2771
  "child": [
2297
2772
  {
2298
- "this": {}
2773
+ "intersection": {
2774
+ "child": [
2775
+ {
2776
+ "this": {}
2777
+ },
2778
+ {
2779
+ "tupleToUserset": {
2780
+ "computedUserset": {
2781
+ "relation": "affiliated"
2782
+ },
2783
+ "tupleset": {
2784
+ "relation": "organization"
2785
+ }
2786
+ }
2787
+ }
2788
+ ]
2789
+ }
2299
2790
  },
2300
2791
  {
2301
2792
  "computedUserset": {
@@ -2385,7 +2876,23 @@
2385
2876
  "union": {
2386
2877
  "child": [
2387
2878
  {
2388
- "this": {}
2879
+ "intersection": {
2880
+ "child": [
2881
+ {
2882
+ "this": {}
2883
+ },
2884
+ {
2885
+ "tupleToUserset": {
2886
+ "computedUserset": {
2887
+ "relation": "affiliated"
2888
+ },
2889
+ "tupleset": {
2890
+ "relation": "organization"
2891
+ }
2892
+ }
2893
+ }
2894
+ ]
2895
+ }
2389
2896
  },
2390
2897
  {
2391
2898
  "tupleToUserset": {
@@ -2404,7 +2911,23 @@
2404
2911
  "union": {
2405
2912
  "child": [
2406
2913
  {
2407
- "this": {}
2914
+ "intersection": {
2915
+ "child": [
2916
+ {
2917
+ "this": {}
2918
+ },
2919
+ {
2920
+ "tupleToUserset": {
2921
+ "computedUserset": {
2922
+ "relation": "affiliated"
2923
+ },
2924
+ "tupleset": {
2925
+ "relation": "organization"
2926
+ }
2927
+ }
2928
+ }
2929
+ ]
2930
+ }
2408
2931
  },
2409
2932
  {
2410
2933
  "computedUserset": {
@@ -2541,7 +3064,23 @@
2541
3064
  "this": {}
2542
3065
  },
2543
3066
  "owner": {
2544
- "this": {}
3067
+ "intersection": {
3068
+ "child": [
3069
+ {
3070
+ "this": {}
3071
+ },
3072
+ {
3073
+ "tupleToUserset": {
3074
+ "computedUserset": {
3075
+ "relation": "affiliated"
3076
+ },
3077
+ "tupleset": {
3078
+ "relation": "organization"
3079
+ }
3080
+ }
3081
+ }
3082
+ ]
3083
+ }
2545
3084
  },
2546
3085
  "schedule": {
2547
3086
  "this": {}
@@ -2550,7 +3089,23 @@
2550
3089
  "union": {
2551
3090
  "child": [
2552
3091
  {
2553
- "this": {}
3092
+ "intersection": {
3093
+ "child": [
3094
+ {
3095
+ "this": {}
3096
+ },
3097
+ {
3098
+ "tupleToUserset": {
3099
+ "computedUserset": {
3100
+ "relation": "affiliated"
3101
+ },
3102
+ "tupleset": {
3103
+ "relation": "organization"
3104
+ }
3105
+ }
3106
+ }
3107
+ ]
3108
+ }
2554
3109
  },
2555
3110
  {
2556
3111
  "computedUserset": {
@@ -2571,6 +3126,7 @@
2571
3126
  "can_delete": {},
2572
3127
  "can_edit": {},
2573
3128
  "can_grant_access": {},
3129
+ "can_manage_audience": {},
2574
3130
  "can_use": {},
2575
3131
  "can_view": {},
2576
3132
  "can_view_access": {},
@@ -2641,6 +3197,11 @@
2641
3197
  "relation": "owner"
2642
3198
  }
2643
3199
  },
3200
+ "can_manage_audience": {
3201
+ "computedUserset": {
3202
+ "relation": "owner"
3203
+ }
3204
+ },
2644
3205
  "can_use": {
2645
3206
  "computedUserset": {
2646
3207
  "relation": "viewer"
@@ -2663,7 +3224,23 @@
2663
3224
  "union": {
2664
3225
  "child": [
2665
3226
  {
2666
- "this": {}
3227
+ "intersection": {
3228
+ "child": [
3229
+ {
3230
+ "this": {}
3231
+ },
3232
+ {
3233
+ "tupleToUserset": {
3234
+ "computedUserset": {
3235
+ "relation": "affiliated"
3236
+ },
3237
+ "tupleset": {
3238
+ "relation": "organization"
3239
+ }
3240
+ }
3241
+ }
3242
+ ]
3243
+ }
2667
3244
  },
2668
3245
  {
2669
3246
  "tupleToUserset": {
@@ -2685,7 +3262,23 @@
2685
3262
  "union": {
2686
3263
  "child": [
2687
3264
  {
2688
- "this": {}
3265
+ "intersection": {
3266
+ "child": [
3267
+ {
3268
+ "this": {}
3269
+ },
3270
+ {
3271
+ "tupleToUserset": {
3272
+ "computedUserset": {
3273
+ "relation": "affiliated"
3274
+ },
3275
+ "tupleset": {
3276
+ "relation": "organization"
3277
+ }
3278
+ }
3279
+ }
3280
+ ]
3281
+ }
2689
3282
  },
2690
3283
  {
2691
3284
  "computedUserset": {
@@ -2712,8 +3305,20 @@
2712
3305
  "can_edit": {},
2713
3306
  "can_execute": {},
2714
3307
  "can_grant_access": {},
3308
+ "can_manage_audience": {},
2715
3309
  "can_view": {},
2716
3310
  "can_view_access": {},
3311
+ "editor": {
3312
+ "directly_related_user_types": [
3313
+ {
3314
+ "type": "identity_account"
3315
+ },
3316
+ {
3317
+ "relation": "member",
3318
+ "type": "team"
3319
+ }
3320
+ ]
3321
+ },
2717
3322
  "organization": {
2718
3323
  "directly_related_user_types": [
2719
3324
  {
@@ -2772,8 +3377,19 @@
2772
3377
  }
2773
3378
  },
2774
3379
  "can_edit": {
2775
- "computedUserset": {
2776
- "relation": "owner"
3380
+ "union": {
3381
+ "child": [
3382
+ {
3383
+ "computedUserset": {
3384
+ "relation": "owner"
3385
+ }
3386
+ },
3387
+ {
3388
+ "computedUserset": {
3389
+ "relation": "editor"
3390
+ }
3391
+ }
3392
+ ]
2777
3393
  }
2778
3394
  },
2779
3395
  "can_execute": {
@@ -2786,6 +3402,11 @@
2786
3402
  "relation": "owner"
2787
3403
  }
2788
3404
  },
3405
+ "can_manage_audience": {
3406
+ "computedUserset": {
3407
+ "relation": "owner"
3408
+ }
3409
+ },
2789
3410
  "can_view": {
2790
3411
  "computedUserset": {
2791
3412
  "relation": "viewer"
@@ -2796,6 +3417,25 @@
2796
3417
  "relation": "viewer"
2797
3418
  }
2798
3419
  },
3420
+ "editor": {
3421
+ "intersection": {
3422
+ "child": [
3423
+ {
3424
+ "this": {}
3425
+ },
3426
+ {
3427
+ "tupleToUserset": {
3428
+ "computedUserset": {
3429
+ "relation": "affiliated"
3430
+ },
3431
+ "tupleset": {
3432
+ "relation": "organization"
3433
+ }
3434
+ }
3435
+ }
3436
+ ]
3437
+ }
3438
+ },
2799
3439
  "organization": {
2800
3440
  "this": {}
2801
3441
  },
@@ -2803,7 +3443,23 @@
2803
3443
  "union": {
2804
3444
  "child": [
2805
3445
  {
2806
- "this": {}
3446
+ "intersection": {
3447
+ "child": [
3448
+ {
3449
+ "this": {}
3450
+ },
3451
+ {
3452
+ "tupleToUserset": {
3453
+ "computedUserset": {
3454
+ "relation": "affiliated"
3455
+ },
3456
+ "tupleset": {
3457
+ "relation": "organization"
3458
+ }
3459
+ }
3460
+ }
3461
+ ]
3462
+ }
2807
3463
  },
2808
3464
  {
2809
3465
  "tupleToUserset": {
@@ -2825,13 +3481,34 @@
2825
3481
  "union": {
2826
3482
  "child": [
2827
3483
  {
2828
- "this": {}
3484
+ "intersection": {
3485
+ "child": [
3486
+ {
3487
+ "this": {}
3488
+ },
3489
+ {
3490
+ "tupleToUserset": {
3491
+ "computedUserset": {
3492
+ "relation": "affiliated"
3493
+ },
3494
+ "tupleset": {
3495
+ "relation": "organization"
3496
+ }
3497
+ }
3498
+ }
3499
+ ]
3500
+ }
2829
3501
  },
2830
3502
  {
2831
3503
  "computedUserset": {
2832
3504
  "relation": "owner"
2833
3505
  }
2834
3506
  },
3507
+ {
3508
+ "computedUserset": {
3509
+ "relation": "editor"
3510
+ }
3511
+ },
2835
3512
  {
2836
3513
  "computedUserset": {
2837
3514
  "relation": "platform_viewer"
@@ -2851,6 +3528,7 @@
2851
3528
  "can_edit": {},
2852
3529
  "can_execute": {},
2853
3530
  "can_grant_access": {},
3531
+ "can_manage_audience": {},
2854
3532
  "can_view": {},
2855
3533
  "can_view_access": {},
2856
3534
  "default_of": {
@@ -2941,6 +3619,11 @@
2941
3619
  "relation": "owner"
2942
3620
  }
2943
3621
  },
3622
+ "can_manage_audience": {
3623
+ "computedUserset": {
3624
+ "relation": "owner"
3625
+ }
3626
+ },
2944
3627
  "can_view": {
2945
3628
  "computedUserset": {
2946
3629
  "relation": "viewer"
@@ -2955,19 +3638,67 @@
2955
3638
  "this": {}
2956
3639
  },
2957
3640
  "execution_viewer": {
2958
- "this": {}
3641
+ "intersection": {
3642
+ "child": [
3643
+ {
3644
+ "this": {}
3645
+ },
3646
+ {
3647
+ "tupleToUserset": {
3648
+ "computedUserset": {
3649
+ "relation": "affiliated"
3650
+ },
3651
+ "tupleset": {
3652
+ "relation": "organization"
3653
+ }
3654
+ }
3655
+ }
3656
+ ]
3657
+ }
2959
3658
  },
2960
3659
  "organization": {
2961
3660
  "this": {}
2962
3661
  },
2963
3662
  "owner": {
2964
- "this": {}
3663
+ "intersection": {
3664
+ "child": [
3665
+ {
3666
+ "this": {}
3667
+ },
3668
+ {
3669
+ "tupleToUserset": {
3670
+ "computedUserset": {
3671
+ "relation": "affiliated"
3672
+ },
3673
+ "tupleset": {
3674
+ "relation": "organization"
3675
+ }
3676
+ }
3677
+ }
3678
+ ]
3679
+ }
2965
3680
  },
2966
3681
  "viewer": {
2967
3682
  "union": {
2968
3683
  "child": [
2969
3684
  {
2970
- "this": {}
3685
+ "intersection": {
3686
+ "child": [
3687
+ {
3688
+ "this": {}
3689
+ },
3690
+ {
3691
+ "tupleToUserset": {
3692
+ "computedUserset": {
3693
+ "relation": "affiliated"
3694
+ },
3695
+ "tupleset": {
3696
+ "relation": "organization"
3697
+ }
3698
+ }
3699
+ }
3700
+ ]
3701
+ }
2971
3702
  },
2972
3703
  {
2973
3704
  "computedUserset": {
@@ -3063,13 +3794,45 @@
3063
3794
  "this": {}
3064
3795
  },
3065
3796
  "owner": {
3066
- "this": {}
3797
+ "intersection": {
3798
+ "child": [
3799
+ {
3800
+ "this": {}
3801
+ },
3802
+ {
3803
+ "tupleToUserset": {
3804
+ "computedUserset": {
3805
+ "relation": "affiliated"
3806
+ },
3807
+ "tupleset": {
3808
+ "relation": "organization"
3809
+ }
3810
+ }
3811
+ }
3812
+ ]
3813
+ }
3067
3814
  },
3068
3815
  "viewer": {
3069
3816
  "union": {
3070
3817
  "child": [
3071
3818
  {
3072
- "this": {}
3819
+ "intersection": {
3820
+ "child": [
3821
+ {
3822
+ "this": {}
3823
+ },
3824
+ {
3825
+ "tupleToUserset": {
3826
+ "computedUserset": {
3827
+ "relation": "affiliated"
3828
+ },
3829
+ "tupleset": {
3830
+ "relation": "organization"
3831
+ }
3832
+ }
3833
+ }
3834
+ ]
3835
+ }
3073
3836
  },
3074
3837
  {
3075
3838
  "computedUserset": {