@webiny/api-aco 0.0.0-unstable.496cf268ac → 0.0.0-unstable.5387e5f7c8

package/features/ai/GrantFolderAccessTool.js

@@ -0,0 +1,80 @@
+import { z } from "zod";
+import { AiSdkToolDefinition, AiSdkToolHandler } from "@webiny/api-core/features/ai/index.js";
+import { ListTeamsUseCase } from "@webiny/api-core/features/security/teams/ListTeams/index.js";
+import { GetFolderUseCase } from "../folder/GetFolder/index.js";
+import { UpdateFolderUseCase } from "../folder/UpdateFolder/index.js";
+import { loadFolderPermissions } from "./loadFolderPermissions.js";
+import { assertTargetIsUsable } from "./assertTargetIsUsable.js";
+const ACCESS_LEVELS = [
+    "owner",
+    "editor",
+    "viewer",
+    "public",
+    "no-access"
+];
+const inputSchema = z.object({
+    folderId: z.string().describe("Folder id as returned by listFolders."),
+    target: z.string().describe("Who to grant access to. A team is 'team:<slug>' — the SLUG, not the id. A user is 'admin:<userId>'. Resolve with listTeams first."),
+    level: z["enum"](ACCESS_LEVELS).describe("owner = full control including permissions; editor = change content; viewer = read only; no-access = explicitly denied.")
+});
+class GrantFolderAccessToolHandlerImpl {
+    constructor(getFolder, updateFolder, listTeams){
+        this.getFolder = getFolder;
+        this.updateFolder = updateFolder;
+        this.listTeams = listTeams;
+    }
+    async execute(input) {
+        const loaded = await loadFolderPermissions(this.getFolder, input.folderId);
+        await assertTargetIsUsable(this.listTeams, input.target, loaded.inheritedTargets);
+        const existing = loaded.direct.find((permission)=>String(permission.target) === input.target);
+        const permissions = loaded.direct.filter((permission)=>String(permission.target) !== input.target).concat([
+            {
+                target: input.target,
+                level: input.level
+            }
+        ]);
+        const result = await this.updateFolder.execute(input.folderId, {
+            permissions
+        });
+        if (result.isFail()) throw new Error(`Could not grant access: ${result.error.message}`);
+        const folder = result.value;
+        const granted = {
+            folderId: folder.id,
+            title: folder.title,
+            path: folder.path,
+            permissions: (folder.permissions ?? []).filter((permission)=>!permission.inheritedFrom).map((permission)=>({
+                    target: String(permission.target),
+                    level: permission.level
+                }))
+        };
+        if (existing) granted.replacedExistingLevel = existing.level;
+        return granted;
+    }
+}
+const GrantFolderAccessToolHandler = AiSdkToolHandler.createImplementation({
+    implementation: GrantFolderAccessToolHandlerImpl,
+    dependencies: [
+        GetFolderUseCase,
+        UpdateFolderUseCase,
+        ListTeamsUseCase
+    ]
+});
+class GrantFolderAccessToolImpl {
+    constructor(){
+        this.name = "grantFolderAccess";
+        this.title = "Grant folder access";
+        this.description = "Grants one team or user a level of access on one folder, leaving all other permissions untouched. Use listFolders for the folder id and listTeams for a team slug. Requires user approval.";
+        this.inputSchema = inputSchema;
+        this.annotations = {
+            readOnlyHint: false
+        };
+        this.handler = GrantFolderAccessToolHandler;
+    }
+}
+const GrantFolderAccessTool = AiSdkToolDefinition.createImplementation({
+    implementation: GrantFolderAccessToolImpl,
+    dependencies: []
+});
+export { GrantFolderAccessTool };
+
+//# sourceMappingURL=GrantFolderAccessTool.js.map

package/features/ai/GrantFolderAccessTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/GrantFolderAccessTool.js","sources":["../../../src/features/ai/GrantFolderAccessTool.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { AiSdkToolDefinition, AiSdkToolHandler } from \"@webiny/api-core/features/ai/index.js\";\nimport { ListTeamsUseCase } from \"@webiny/api-core/features/security/teams/ListTeams/index.js\";\nimport { GetFolderUseCase } from \"~/features/folder/GetFolder/index.js\";\nimport { UpdateFolderUseCase } from \"~/features/folder/UpdateFolder/index.js\";\nimport type { FolderPermission } from \"~/types.js\";\nimport { loadFolderPermissions } from \"./loadFolderPermissions.js\";\nimport { assertTargetIsUsable } from \"./assertTargetIsUsable.js\";\n\nconst ACCESS_LEVELS = [\"owner\", \"editor\", \"viewer\", \"public\", \"no-access\"] as const;\n\nconst inputSchema = z.object({\n    folderId: z.string().describe(\"Folder id as returned by listFolders.\"),\n    target: z\n        .string()\n        .describe(\n            \"Who to grant access to. A team is 'team:<slug>' — the SLUG, not the id. A user is 'admin:<userId>'. Resolve with listTeams first.\"\n        ),\n    level: z\n        .enum(ACCESS_LEVELS)\n        .describe(\n            \"owner = full control including permissions; editor = change content; viewer = read only; no-access = explicitly denied.\"\n        )\n});\n\ntype Input = z.infer<typeof inputSchema>;\n\ninterface GrantResult {\n    folderId: string;\n    title: string;\n    path: string;\n    /**\n     * Every direct rule on the folder afterwards.\n     *\n     * This is the set the update was asked to store, not an independent read of it:\n     * `UpdateFolderWithFolderLevelPermissions` returns the permissions it derived from the input\n     * rather than the ones the repository wrote. Treating it as a verification would let the tool\n     * confirm its own request back to itself.\n     */\n    permissions: { target: string; level: string }[];\n    /** True when the target already had a direct rule and its level was changed. */\n    replacedExistingLevel?: string;\n}\n\nclass GrantFolderAccessToolHandlerImpl implements AiSdkToolHandler.Interface<Input> {\n    constructor(\n        private getFolder: GetFolderUseCase.Interface,\n        private updateFolder: UpdateFolderUseCase.Interface,\n        private listTeams: ListTeamsUseCase.Interface\n    ) {}\n\n    async execute(input: Input): Promise<GrantResult> {\n        const loaded = await loadFolderPermissions(this.getFolder, input.folderId);\n\n        await assertTargetIsUsable(this.listTeams, input.target, loaded.inheritedTargets);\n\n        const existing = loaded.direct.find(\n            permission => String(permission.target) === input.target\n        );\n\n        const permissions: FolderPermission[] = loaded.direct\n            .filter(permission => String(permission.target) !== input.target)\n            .concat([{ target: input.target, level: input.level } as FolderPermission]);\n\n        const result = await this.updateFolder.execute(input.folderId, { permissions });\n\n        if (result.isFail()) {\n            throw new Error(`Could not grant access: ${result.error.message}`);\n        }\n\n        const folder = result.value;\n\n        const granted: GrantResult = {\n            folderId: folder.id,\n            title: folder.title,\n            path: folder.path,\n            permissions: (folder.permissions ?? [])\n                .filter(permission => !permission.inheritedFrom)\n                .map(permission => ({ target: String(permission.target), level: permission.level }))\n        };\n\n        if (existing) {\n            granted.replacedExistingLevel = existing.level;\n        }\n\n        return granted;\n    }\n}\n\nconst GrantFolderAccessToolHandler = AiSdkToolHandler.createImplementation({\n    implementation: GrantFolderAccessToolHandlerImpl,\n    dependencies: [GetFolderUseCase, UpdateFolderUseCase, ListTeamsUseCase]\n});\n\n/**\n * Grants one target access to one folder, leaving every other rule alone.\n *\n * Additive by design. The earlier tool took the complete permission set and replaced it, which meant\n * approving a change showed what would be SET and said nothing about what would be removed — a rule\n * the model omitted disappeared silently. One target per call keeps the approval honest: what the user\n * sees in the plan is the whole change.\n */\nclass GrantFolderAccessToolImpl implements AiSdkToolDefinition.Interface<Input> {\n    readonly name = \"grantFolderAccess\";\n    readonly title = \"Grant folder access\";\n    readonly description =\n        \"Grants one team or user a level of access on one folder, leaving all other permissions untouched. Use listFolders for the folder id and listTeams for a team slug. Requires user approval.\";\n    readonly inputSchema = inputSchema;\n    readonly annotations = { readOnlyHint: false };\n    readonly handler = GrantFolderAccessToolHandler;\n}\n\nexport const GrantFolderAccessTool = AiSdkToolDefinition.createImplementation({\n    implementation: GrantFolderAccessToolImpl,\n    dependencies: []\n});\n"],"names":["ACCESS_LEVELS","inputSchema","z","GrantFolderAccessToolHandlerImpl","getFolder","updateFolder","listTeams","input","loaded","loadFolderPermissions","assertTargetIsUsable","existing","permission","String","permissions","result","Error","folder","granted","GrantFolderAccessToolHandler","AiSdkToolHandler","GetFolderUseCase","UpdateFolderUseCase","ListTeamsUseCase","GrantFolderAccessToolImpl","GrantFolderAccessTool","AiSdkToolDefinition"],"mappings":";;;;;;;AASA,MAAMA,gBAAgB;IAAC;IAAS;IAAU;IAAU;IAAU;CAAY;AAE1E,MAAMC,cAAcC,EAAE,MAAM,CAAC;IACzB,UAAUA,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC9B,QAAQA,EAAAA,MACG,GACN,QAAQ,CACL;IAER,OAAOA,CAAC,CAADA,OACE,CAACF,eACL,QAAQ,CACL;AAEZ;AAqBA,MAAMG;IACF,YACYC,SAAqC,EACrCC,YAA2C,EAC3CC,SAAqC,CAC/C;aAHUF,SAAS,GAATA;aACAC,YAAY,GAAZA;aACAC,SAAS,GAATA;IACT;IAEH,MAAM,QAAQC,KAAY,EAAwB;QAC9C,MAAMC,SAAS,MAAMC,sBAAsB,IAAI,CAAC,SAAS,EAAEF,MAAM,QAAQ;QAEzE,MAAMG,qBAAqB,IAAI,CAAC,SAAS,EAAEH,MAAM,MAAM,EAAEC,OAAO,gBAAgB;QAEhF,MAAMG,WAAWH,OAAO,MAAM,CAAC,IAAI,CAC/BI,CAAAA,aAAcC,OAAOD,WAAW,MAAM,MAAML,MAAM,MAAM;QAG5D,MAAMO,cAAkCN,OAAO,MAAM,CAChD,MAAM,CAACI,CAAAA,aAAcC,OAAOD,WAAW,MAAM,MAAML,MAAM,MAAM,EAC/D,MAAM,CAAC;YAAC;gBAAE,QAAQA,MAAM,MAAM;gBAAE,OAAOA,MAAM,KAAK;YAAC;SAAsB;QAE9E,MAAMQ,SAAS,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAACR,MAAM,QAAQ,EAAE;YAAEO;QAAY;QAE7E,IAAIC,OAAO,MAAM,IACb,MAAM,IAAIC,MAAM,CAAC,wBAAwB,EAAED,OAAO,KAAK,CAAC,OAAO,EAAE;QAGrE,MAAME,SAASF,OAAO,KAAK;QAE3B,MAAMG,UAAuB;YACzB,UAAUD,OAAO,EAAE;YACnB,OAAOA,OAAO,KAAK;YACnB,MAAMA,OAAO,IAAI;YACjB,aAAcA,AAAAA,CAAAA,OAAO,WAAW,IAAI,EAAC,EAChC,MAAM,CAACL,CAAAA,aAAc,CAACA,WAAW,aAAa,EAC9C,GAAG,CAACA,CAAAA,aAAe;oBAAE,QAAQC,OAAOD,WAAW,MAAM;oBAAG,OAAOA,WAAW,KAAK;gBAAC;QACzF;QAEA,IAAID,UACAO,QAAQ,qBAAqB,GAAGP,SAAS,KAAK;QAGlD,OAAOO;IACX;AACJ;AAEA,MAAMC,+BAA+BC,iBAAiB,oBAAoB,CAAC;IACvE,gBAAgBjB;IAChB,cAAc;QAACkB;QAAkBC;QAAqBC;KAAiB;AAC3E;AAUA,MAAMC;;aACO,IAAI,GAAG;aACP,KAAK,GAAG;aACR,WAAW,GAChB;aACK,WAAW,GAAGvB;aACd,WAAW,GAAG;YAAE,cAAc;QAAM;aACpC,OAAO,GAAGkB;;AACvB;AAEO,MAAMM,wBAAwBC,oBAAoB,oBAAoB,CAAC;IAC1E,gBAAgBF;IAChB,cAAc,EAAE;AACpB"}

package/features/ai/ListFoldersTool.d.ts

@@ -0,0 +1,47 @@
+import { z } from "zod";
+import { AiSdkToolDefinition, AiSdkToolHandler } from "@webiny/api-core/features/ai/index.js";
+import { ListFoldersUseCase } from "../../features/folder/ListFolders/index.js";
+declare const inputSchema: z.ZodObject<{
+    type: z.ZodString;
+}, z.core.$strip>;
+type Input = z.infer<typeof inputSchema>;
+interface FolderSummary {
+    id: string;
+    title: string;
+    slug: string;
+    path: string;
+    parentId?: string | null;
+    permissions: {
+        target: string;
+        level: string;
+        inherited: boolean;
+    }[];
+}
+declare class ListFoldersToolHandlerImpl implements AiSdkToolHandler.Interface<Input> {
+    private listFolders;
+    constructor(listFolders: ListFoldersUseCase.Interface);
+    execute(input: Input): Promise<FolderSummary[]>;
+}
+/**
+ * Lists folders with their current access rules, so a permission change is proposed against a real
+ * folder id and the user can see what the access already is before approving a change to it.
+ */
+declare class ListFoldersToolImpl implements AiSdkToolDefinition.Interface<Input> {
+    readonly name = "listFolders";
+    readonly title = "List folders";
+    readonly description = "Lists folders of a given type with their ids, paths and current access permissions. Call this before changing folder permissions so the change targets a real folder.";
+    readonly inputSchema: z.ZodObject<{
+        type: z.ZodString;
+    }, z.core.$strip>;
+    readonly annotations: {
+        readOnlyHint: boolean;
+        idempotentHint: boolean;
+    };
+    readonly handler: typeof ListFoldersToolHandlerImpl & {
+        __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/ai/abstractions").IAiSdkToolHandler<any>>;
+    };
+}
+export declare const ListFoldersTool: typeof ListFoldersToolImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/ai/abstractions").IAiSdkToolDefinition<any>>;
+};
+export {};

package/features/ai/ListFoldersTool.js

@@ -0,0 +1,57 @@
+import { z } from "zod";
+import { AiSdkToolDefinition, AiSdkToolHandler } from "@webiny/api-core/features/ai/index.js";
+import { ListFoldersUseCase } from "../folder/ListFolders/index.js";
+const inputSchema = z.object({
+    type: z.string().describe("Folder namespace, e.g. 'FmFile' for the file manager or 'cms:<modelId>' for a content model's folders.")
+});
+class ListFoldersToolHandlerImpl {
+    constructor(listFolders){
+        this.listFolders = listFolders;
+    }
+    async execute(input) {
+        const result = await this.listFolders.execute({
+            where: {
+                type: input.type
+            }
+        });
+        if (result.isFail()) throw new Error(`Could not list folders: ${result.error.message}`);
+        return result.value.folders.map((folder)=>({
+                id: folder.id,
+                title: folder.title,
+                slug: folder.slug,
+                path: folder.path,
+                parentId: folder.parentId,
+                permissions: (folder.permissions ?? []).map((permission)=>({
+                        target: permission.target,
+                        level: permission.level,
+                        inherited: Boolean(permission.inheritedFrom)
+                    }))
+            }));
+    }
+}
+const ListFoldersToolHandler = AiSdkToolHandler.createImplementation({
+    implementation: ListFoldersToolHandlerImpl,
+    dependencies: [
+        ListFoldersUseCase
+    ]
+});
+class ListFoldersToolImpl {
+    constructor(){
+        this.name = "listFolders";
+        this.title = "List folders";
+        this.description = "Lists folders of a given type with their ids, paths and current access permissions. Call this before changing folder permissions so the change targets a real folder.";
+        this.inputSchema = inputSchema;
+        this.annotations = {
+            readOnlyHint: true,
+            idempotentHint: true
+        };
+        this.handler = ListFoldersToolHandler;
+    }
+}
+const ListFoldersTool = AiSdkToolDefinition.createImplementation({
+    implementation: ListFoldersToolImpl,
+    dependencies: []
+});
+export { ListFoldersTool };
+
+//# sourceMappingURL=ListFoldersTool.js.map

package/features/ai/ListFoldersTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/ListFoldersTool.js","sources":["../../../src/features/ai/ListFoldersTool.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { AiSdkToolDefinition, AiSdkToolHandler } from \"@webiny/api-core/features/ai/index.js\";\nimport { ListFoldersUseCase } from \"~/features/folder/ListFolders/index.js\";\n\nconst inputSchema = z.object({\n    type: z\n        .string()\n        .describe(\n            \"Folder namespace, e.g. 'FmFile' for the file manager or 'cms:<modelId>' for a content model's folders.\"\n        )\n});\n\ntype Input = z.infer<typeof inputSchema>;\n\ninterface FolderSummary {\n    id: string;\n    title: string;\n    slug: string;\n    path: string;\n    parentId?: string | null;\n    permissions: { target: string; level: string; inherited: boolean }[];\n}\n\nclass ListFoldersToolHandlerImpl implements AiSdkToolHandler.Interface<Input> {\n    constructor(private listFolders: ListFoldersUseCase.Interface) {}\n\n    async execute(input: Input): Promise<FolderSummary[]> {\n        const result = await this.listFolders.execute({ where: { type: input.type } });\n\n        if (result.isFail()) {\n            throw new Error(`Could not list folders: ${result.error.message}`);\n        }\n\n        return result.value.folders.map(folder => ({\n            id: folder.id,\n            title: folder.title,\n            slug: folder.slug,\n            path: folder.path,\n            parentId: folder.parentId,\n            permissions: (folder.permissions ?? []).map(permission => ({\n                target: permission.target,\n                level: permission.level,\n                // Inherited rules cannot be edited on this folder — only on the ancestor that set them.\n                inherited: Boolean(permission.inheritedFrom)\n            }))\n        }));\n    }\n}\n\nconst ListFoldersToolHandler = AiSdkToolHandler.createImplementation({\n    implementation: ListFoldersToolHandlerImpl,\n    dependencies: [ListFoldersUseCase]\n});\n\n/**\n * Lists folders with their current access rules, so a permission change is proposed against a real\n * folder id and the user can see what the access already is before approving a change to it.\n */\nclass ListFoldersToolImpl implements AiSdkToolDefinition.Interface<Input> {\n    readonly name = \"listFolders\";\n    readonly title = \"List folders\";\n    readonly description =\n        \"Lists folders of a given type with their ids, paths and current access permissions. Call this before changing folder permissions so the change targets a real folder.\";\n    readonly inputSchema = inputSchema;\n    readonly annotations = { readOnlyHint: true, idempotentHint: true };\n    readonly handler = ListFoldersToolHandler;\n}\n\nexport const ListFoldersTool = AiSdkToolDefinition.createImplementation({\n    implementation: ListFoldersToolImpl,\n    dependencies: []\n});\n"],"names":["inputSchema","z","ListFoldersToolHandlerImpl","listFolders","input","result","Error","folder","permission","Boolean","ListFoldersToolHandler","AiSdkToolHandler","ListFoldersUseCase","ListFoldersToolImpl","ListFoldersTool","AiSdkToolDefinition"],"mappings":";;;AAIA,MAAMA,cAAcC,EAAE,MAAM,CAAC;IACzB,MAAMA,EAAAA,MACK,GACN,QAAQ,CACL;AAEZ;AAaA,MAAMC;IACF,YAAoBC,WAAyC,CAAE;aAA3CA,WAAW,GAAXA;IAA4C;IAEhE,MAAM,QAAQC,KAAY,EAA4B;QAClD,MAAMC,SAAS,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAAE,OAAO;gBAAE,MAAMD,MAAM,IAAI;YAAC;QAAE;QAE5E,IAAIC,OAAO,MAAM,IACb,MAAM,IAAIC,MAAM,CAAC,wBAAwB,EAAED,OAAO,KAAK,CAAC,OAAO,EAAE;QAGrE,OAAOA,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAACE,CAAAA,SAAW;gBACvC,IAAIA,OAAO,EAAE;gBACb,OAAOA,OAAO,KAAK;gBACnB,MAAMA,OAAO,IAAI;gBACjB,MAAMA,OAAO,IAAI;gBACjB,UAAUA,OAAO,QAAQ;gBACzB,aAAcA,AAAAA,CAAAA,OAAO,WAAW,IAAI,EAAC,EAAG,GAAG,CAACC,CAAAA,aAAe;wBACvD,QAAQA,WAAW,MAAM;wBACzB,OAAOA,WAAW,KAAK;wBAEvB,WAAWC,QAAQD,WAAW,aAAa;oBAC/C;YACJ;IACJ;AACJ;AAEA,MAAME,yBAAyBC,iBAAiB,oBAAoB,CAAC;IACjE,gBAAgBT;IAChB,cAAc;QAACU;KAAmB;AACtC;AAMA,MAAMC;;aACO,IAAI,GAAG;aACP,KAAK,GAAG;aACR,WAAW,GAChB;aACK,WAAW,GAAGb;aACd,WAAW,GAAG;YAAE,cAAc;YAAM,gBAAgB;QAAK;aACzD,OAAO,GAAGU;;AACvB;AAEO,MAAMI,kBAAkBC,oBAAoB,oBAAoB,CAAC;IACpE,gBAAgBF;IAChB,cAAc,EAAE;AACpB"}

package/features/ai/ListRolesTool.d.ts

@@ -0,0 +1,39 @@
+import { z } from "zod";
+import { AiSdkToolDefinition, AiSdkToolHandler } from "@webiny/api-core/features/ai/index.js";
+import { ListRolesUseCase } from "@webiny/api-core/features/security/roles/ListRoles/index.js";
+interface RoleSummary {
+    id: string;
+    name: string;
+    slug: string;
+    description?: string;
+}
+declare class ListRolesToolHandlerImpl implements AiSdkToolHandler.Interface<Record<string, never>> {
+    private listRoles;
+    constructor(listRoles: ListRolesUseCase.Interface);
+    execute(): Promise<RoleSummary[]>;
+}
+/**
+ * Resolves role names to the IDs `createTeam` takes. Separate from the write, so the user approves a
+ * team with roles that were looked up rather than guessed.
+ *
+ * Returns the slug too, because it is what a human recognises and what the admin UI shows, while
+ * `id` is what a team actually stores. Nothing at the type level separates the two, so `createTeam`
+ * accepts either and resolves it rather than making the caller guess which one that field wants.
+ */
+declare class ListRolesToolImpl implements AiSdkToolDefinition.Interface<Record<string, never>> {
+    readonly name = "listRoles";
+    readonly title = "List roles";
+    readonly description = "Lists the security roles in this project. Call this before createTeam and pass the `id` of each role you want. A slug also works, but a value that is neither is rejected.";
+    readonly inputSchema: z.ZodObject<{}, z.core.$strip>;
+    readonly annotations: {
+        readOnlyHint: boolean;
+        idempotentHint: boolean;
+    };
+    readonly handler: typeof ListRolesToolHandlerImpl & {
+        __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/ai/abstractions").IAiSdkToolHandler<any>>;
+    };
+}
+export declare const ListRolesTool: typeof ListRolesToolImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/ai/abstractions").IAiSdkToolDefinition<any>>;
+};
+export {};

package/features/ai/ListRolesTool.js

@@ -0,0 +1,48 @@
+import { z } from "zod";
+import { AiSdkToolDefinition, AiSdkToolHandler } from "@webiny/api-core/features/ai/index.js";
+import { ListRolesUseCase } from "@webiny/api-core/features/security/roles/ListRoles/index.js";
+const inputSchema = z.object({});
+class ListRolesToolHandlerImpl {
+    constructor(listRoles){
+        this.listRoles = listRoles;
+    }
+    async execute() {
+        const result = await this.listRoles.execute();
+        if (result.isFail()) throw new Error(`Could not list roles: ${result.error.message}`);
+        return result.value.map((role)=>{
+            const summary = {
+                id: role.id,
+                name: role.name,
+                slug: role.slug
+            };
+            if (role.description) summary.description = role.description;
+            return summary;
+        });
+    }
+}
+const ListRolesToolHandler = AiSdkToolHandler.createImplementation({
+    implementation: ListRolesToolHandlerImpl,
+    dependencies: [
+        ListRolesUseCase
+    ]
+});
+class ListRolesToolImpl {
+    constructor(){
+        this.name = "listRoles";
+        this.title = "List roles";
+        this.description = "Lists the security roles in this project. Call this before createTeam and pass the `id` of each role you want. A slug also works, but a value that is neither is rejected.";
+        this.inputSchema = inputSchema;
+        this.annotations = {
+            readOnlyHint: true,
+            idempotentHint: true
+        };
+        this.handler = ListRolesToolHandler;
+    }
+}
+const ListRolesTool = AiSdkToolDefinition.createImplementation({
+    implementation: ListRolesToolImpl,
+    dependencies: []
+});
+export { ListRolesTool };
+
+//# sourceMappingURL=ListRolesTool.js.map

package/features/ai/ListRolesTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/ListRolesTool.js","sources":["../../../src/features/ai/ListRolesTool.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { AiSdkToolDefinition, AiSdkToolHandler } from \"@webiny/api-core/features/ai/index.js\";\nimport { ListRolesUseCase } from \"@webiny/api-core/features/security/roles/ListRoles/index.js\";\n\nconst inputSchema = z.object({});\n\ninterface RoleSummary {\n    id: string;\n    name: string;\n    slug: string;\n    description?: string;\n}\n\nclass ListRolesToolHandlerImpl implements AiSdkToolHandler.Interface<Record<string, never>> {\n    constructor(private listRoles: ListRolesUseCase.Interface) {}\n\n    async execute(): Promise<RoleSummary[]> {\n        const result = await this.listRoles.execute();\n\n        if (result.isFail()) {\n            throw new Error(`Could not list roles: ${result.error.message}`);\n        }\n\n        return result.value.map(role => {\n            const summary: RoleSummary = {\n                id: role.id,\n                name: role.name,\n                slug: role.slug\n            };\n\n            if (role.description) {\n                summary.description = role.description;\n            }\n\n            return summary;\n        });\n    }\n}\n\nconst ListRolesToolHandler = AiSdkToolHandler.createImplementation({\n    implementation: ListRolesToolHandlerImpl,\n    dependencies: [ListRolesUseCase]\n});\n\n/**\n * Resolves role names to the IDs `createTeam` takes. Separate from the write, so the user approves a\n * team with roles that were looked up rather than guessed.\n *\n * Returns the slug too, because it is what a human recognises and what the admin UI shows, while\n * `id` is what a team actually stores. Nothing at the type level separates the two, so `createTeam`\n * accepts either and resolves it rather than making the caller guess which one that field wants.\n */\nclass ListRolesToolImpl implements AiSdkToolDefinition.Interface<Record<string, never>> {\n    readonly name = \"listRoles\";\n    readonly title = \"List roles\";\n    readonly description =\n        \"Lists the security roles in this project. Call this before createTeam and pass the `id` of each role you want. A slug also works, but a value that is neither is rejected.\";\n    readonly inputSchema = inputSchema;\n    readonly annotations = { readOnlyHint: true, idempotentHint: true };\n    readonly handler = ListRolesToolHandler;\n}\n\nexport const ListRolesTool = AiSdkToolDefinition.createImplementation({\n    implementation: ListRolesToolImpl,\n    dependencies: []\n});\n"],"names":["inputSchema","z","ListRolesToolHandlerImpl","listRoles","result","Error","role","summary","ListRolesToolHandler","AiSdkToolHandler","ListRolesUseCase","ListRolesToolImpl","ListRolesTool","AiSdkToolDefinition"],"mappings":";;;AAIA,MAAMA,cAAcC,EAAE,MAAM,CAAC,CAAC;AAS9B,MAAMC;IACF,YAAoBC,SAAqC,CAAE;aAAvCA,SAAS,GAATA;IAAwC;IAE5D,MAAM,UAAkC;QACpC,MAAMC,SAAS,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO;QAE3C,IAAIA,OAAO,MAAM,IACb,MAAM,IAAIC,MAAM,CAAC,sBAAsB,EAAED,OAAO,KAAK,CAAC,OAAO,EAAE;QAGnE,OAAOA,OAAO,KAAK,CAAC,GAAG,CAACE,CAAAA;YACpB,MAAMC,UAAuB;gBACzB,IAAID,KAAK,EAAE;gBACX,MAAMA,KAAK,IAAI;gBACf,MAAMA,KAAK,IAAI;YACnB;YAEA,IAAIA,KAAK,WAAW,EAChBC,QAAQ,WAAW,GAAGD,KAAK,WAAW;YAG1C,OAAOC;QACX;IACJ;AACJ;AAEA,MAAMC,uBAAuBC,iBAAiB,oBAAoB,CAAC;IAC/D,gBAAgBP;IAChB,cAAc;QAACQ;KAAiB;AACpC;AAUA,MAAMC;;aACO,IAAI,GAAG;aACP,KAAK,GAAG;aACR,WAAW,GAChB;aACK,WAAW,GAAGX;aACd,WAAW,GAAG;YAAE,cAAc;YAAM,gBAAgB;QAAK;aACzD,OAAO,GAAGQ;;AACvB;AAEO,MAAMI,gBAAgBC,oBAAoB,oBAAoB,CAAC;IAClE,gBAAgBF;IAChB,cAAc,EAAE;AACpB"}

package/features/ai/ListTeamsTool.d.ts

@@ -0,0 +1,39 @@
+import { z } from "zod";
+import { AiSdkToolDefinition, AiSdkToolHandler } from "@webiny/api-core/features/ai/index.js";
+import { ListTeamsUseCase } from "@webiny/api-core/features/security/teams/ListTeams/index.js";
+declare const inputSchema: z.ZodObject<{}, z.core.$strip>;
+type Input = z.infer<typeof inputSchema>;
+interface TeamSummary {
+    id: string;
+    name: string;
+    slug: string;
+    description?: string;
+}
+declare class ListTeamsToolHandlerImpl implements AiSdkToolHandler.Interface<Input> {
+    private listTeams;
+    constructor(listTeams: ListTeamsUseCase.Interface);
+    execute(): Promise<TeamSummary[]>;
+}
+/**
+ * Resolves human names ("team A") to the ids folder permissions actually take.
+ *
+ * Kept separate from setFolderPermissions rather than accepting a team name there: the user approves
+ * the arguments of a write, so the id has to be looked up and shown, not guessed inside the write.
+ */
+declare class ListTeamsToolImpl implements AiSdkToolDefinition.Interface<Input> {
+    readonly name = "listTeams";
+    readonly title = "List teams";
+    readonly description = "Lists the teams in this project with their ids, names and slugs. Folder permission targets use the SLUG (`team:<slug>`), not the id.";
+    readonly inputSchema: z.ZodObject<{}, z.core.$strip>;
+    readonly annotations: {
+        readOnlyHint: boolean;
+        idempotentHint: boolean;
+    };
+    readonly handler: typeof ListTeamsToolHandlerImpl & {
+        __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/ai/abstractions").IAiSdkToolHandler<any>>;
+    };
+}
+export declare const ListTeamsTool: typeof ListTeamsToolImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/ai/abstractions").IAiSdkToolDefinition<any>>;
+};
+export {};

package/features/ai/ListTeamsTool.js

@@ -0,0 +1,48 @@
+import { z } from "zod";
+import { AiSdkToolDefinition, AiSdkToolHandler } from "@webiny/api-core/features/ai/index.js";
+import { ListTeamsUseCase } from "@webiny/api-core/features/security/teams/ListTeams/index.js";
+const inputSchema = z.object({});
+class ListTeamsToolHandlerImpl {
+    constructor(listTeams){
+        this.listTeams = listTeams;
+    }
+    async execute() {
+        const result = await this.listTeams.execute();
+        if (result.isFail()) throw new Error(`Could not list teams: ${result.error.message}`);
+        return result.value.map((team)=>{
+            const summary = {
+                id: team.id,
+                name: team.name,
+                slug: team.slug
+            };
+            if (team.description) summary.description = team.description;
+            return summary;
+        });
+    }
+}
+const ListTeamsToolHandler = AiSdkToolHandler.createImplementation({
+    implementation: ListTeamsToolHandlerImpl,
+    dependencies: [
+        ListTeamsUseCase
+    ]
+});
+class ListTeamsToolImpl {
+    constructor(){
+        this.name = "listTeams";
+        this.title = "List teams";
+        this.description = "Lists the teams in this project with their ids, names and slugs. Folder permission targets use the SLUG (`team:<slug>`), not the id.";
+        this.inputSchema = inputSchema;
+        this.annotations = {
+            readOnlyHint: true,
+            idempotentHint: true
+        };
+        this.handler = ListTeamsToolHandler;
+    }
+}
+const ListTeamsTool = AiSdkToolDefinition.createImplementation({
+    implementation: ListTeamsToolImpl,
+    dependencies: []
+});
+export { ListTeamsTool };
+
+//# sourceMappingURL=ListTeamsTool.js.map

package/features/ai/ListTeamsTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/ListTeamsTool.js","sources":["../../../src/features/ai/ListTeamsTool.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { AiSdkToolDefinition, AiSdkToolHandler } from \"@webiny/api-core/features/ai/index.js\";\nimport { ListTeamsUseCase } from \"@webiny/api-core/features/security/teams/ListTeams/index.js\";\n\nconst inputSchema = z.object({});\n\ntype Input = z.infer<typeof inputSchema>;\n\ninterface TeamSummary {\n    id: string;\n    name: string;\n    slug: string;\n    description?: string;\n}\n\nclass ListTeamsToolHandlerImpl implements AiSdkToolHandler.Interface<Input> {\n    constructor(private listTeams: ListTeamsUseCase.Interface) {}\n\n    async execute(): Promise<TeamSummary[]> {\n        const result = await this.listTeams.execute();\n\n        if (result.isFail()) {\n            throw new Error(`Could not list teams: ${result.error.message}`);\n        }\n\n        return result.value.map(team => {\n            const summary: TeamSummary = {\n                id: team.id,\n                name: team.name,\n                slug: team.slug\n            };\n\n            if (team.description) {\n                summary.description = team.description;\n            }\n\n            return summary;\n        });\n    }\n}\n\nconst ListTeamsToolHandler = AiSdkToolHandler.createImplementation({\n    implementation: ListTeamsToolHandlerImpl,\n    dependencies: [ListTeamsUseCase]\n});\n\n/**\n * Resolves human names (\"team A\") to the ids folder permissions actually take.\n *\n * Kept separate from setFolderPermissions rather than accepting a team name there: the user approves\n * the arguments of a write, so the id has to be looked up and shown, not guessed inside the write.\n */\nclass ListTeamsToolImpl implements AiSdkToolDefinition.Interface<Input> {\n    readonly name = \"listTeams\";\n    readonly title = \"List teams\";\n    readonly description =\n        \"Lists the teams in this project with their ids, names and slugs. Folder permission targets use the SLUG (`team:<slug>`), not the id.\";\n    readonly inputSchema = inputSchema;\n    readonly annotations = { readOnlyHint: true, idempotentHint: true };\n    readonly handler = ListTeamsToolHandler;\n}\n\nexport const ListTeamsTool = AiSdkToolDefinition.createImplementation({\n    implementation: ListTeamsToolImpl,\n    dependencies: []\n});\n"],"names":["inputSchema","z","ListTeamsToolHandlerImpl","listTeams","result","Error","team","summary","ListTeamsToolHandler","AiSdkToolHandler","ListTeamsUseCase","ListTeamsToolImpl","ListTeamsTool","AiSdkToolDefinition"],"mappings":";;;AAIA,MAAMA,cAAcC,EAAE,MAAM,CAAC,CAAC;AAW9B,MAAMC;IACF,YAAoBC,SAAqC,CAAE;aAAvCA,SAAS,GAATA;IAAwC;IAE5D,MAAM,UAAkC;QACpC,MAAMC,SAAS,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO;QAE3C,IAAIA,OAAO,MAAM,IACb,MAAM,IAAIC,MAAM,CAAC,sBAAsB,EAAED,OAAO,KAAK,CAAC,OAAO,EAAE;QAGnE,OAAOA,OAAO,KAAK,CAAC,GAAG,CAACE,CAAAA;YACpB,MAAMC,UAAuB;gBACzB,IAAID,KAAK,EAAE;gBACX,MAAMA,KAAK,IAAI;gBACf,MAAMA,KAAK,IAAI;YACnB;YAEA,IAAIA,KAAK,WAAW,EAChBC,QAAQ,WAAW,GAAGD,KAAK,WAAW;YAG1C,OAAOC;QACX;IACJ;AACJ;AAEA,MAAMC,uBAAuBC,iBAAiB,oBAAoB,CAAC;IAC/D,gBAAgBP;IAChB,cAAc;QAACQ;KAAiB;AACpC;AAQA,MAAMC;;aACO,IAAI,GAAG;aACP,KAAK,GAAG;aACR,WAAW,GAChB;aACK,WAAW,GAAGX;aACd,WAAW,GAAG;YAAE,cAAc;YAAM,gBAAgB;QAAK;aACzD,OAAO,GAAGQ;;AACvB;AAEO,MAAMI,gBAAgBC,oBAAoB,oBAAoB,CAAC;IAClE,gBAAgBF;IAChB,cAAc,EAAE;AACpB"}

package/features/ai/RevokeFolderAccessTool.d.ts

@@ -0,0 +1,63 @@
+import { z } from "zod";
+import { AiSdkToolDefinition, AiSdkToolHandler } from "@webiny/api-core/features/ai/index.js";
+import { GetFolderUseCase } from "../../features/folder/GetFolder/index.js";
+import { UpdateFolderUseCase } from "../../features/folder/UpdateFolder/index.js";
+declare const inputSchema: z.ZodObject<{
+    folderId: z.ZodString;
+    target: z.ZodString;
+}, z.core.$strip>;
+type Input = z.infer<typeof inputSchema>;
+interface RevokeResult {
+    folderId: string;
+    title: string;
+    path: string;
+    removed: {
+        target: string;
+        level: string;
+    };
+    /**
+     * Every direct rule remaining afterwards.
+     *
+     * This is the set the update was asked to store, not an independent read of it:
+     * `UpdateFolderWithFolderLevelPermissions` returns the permissions it derived from the input
+     * rather than the ones the repository wrote. Treating it as a verification would let the tool
+     * confirm its own request back to itself.
+     */
+    permissions: {
+        target: string;
+        level: string;
+    }[];
+}
+declare class RevokeFolderAccessToolHandlerImpl implements AiSdkToolHandler.Interface<Input> {
+    private getFolder;
+    private updateFolder;
+    constructor(getFolder: GetFolderUseCase.Interface, updateFolder: UpdateFolderUseCase.Interface);
+    execute(input: Input): Promise<RevokeResult>;
+}
+/**
+ * Removes one target's direct access to one folder.
+ *
+ * Destructive: somebody loses access, and there is no undo. Refuses when the target has no DIRECT rule
+ * rather than reporting a removal that changed nothing — an inherited grant cannot be revoked here,
+ * only where it is defined, and saying otherwise would leave the user believing access was withdrawn.
+ */
+declare class RevokeFolderAccessToolImpl implements AiSdkToolDefinition.Interface<Input> {
+    readonly name = "revokeFolderAccess";
+    readonly title = "Revoke folder access";
+    readonly description = "Removes one team's or user's direct access to one folder, leaving all other permissions untouched. Cannot remove inherited access. Requires user approval.";
+    readonly inputSchema: z.ZodObject<{
+        folderId: z.ZodString;
+        target: z.ZodString;
+    }, z.core.$strip>;
+    readonly annotations: {
+        readOnlyHint: boolean;
+        destructiveHint: boolean;
+    };
+    readonly handler: typeof RevokeFolderAccessToolHandlerImpl & {
+        __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/ai/abstractions.js").IAiSdkToolHandler<any>>;
+    };
+}
+export declare const RevokeFolderAccessTool: typeof RevokeFolderAccessToolImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-core/features/ai/abstractions.js").IAiSdkToolDefinition<any>>;
+};
+export {};

package/features/ai/RevokeFolderAccessTool.js

@@ -0,0 +1,69 @@
+import { z } from "zod";
+import { AiSdkToolDefinition, AiSdkToolHandler } from "@webiny/api-core/features/ai/index.js";
+import { GetFolderUseCase } from "../folder/GetFolder/index.js";
+import { UpdateFolderUseCase } from "../folder/UpdateFolder/index.js";
+import { loadFolderPermissions } from "./loadFolderPermissions.js";
+const inputSchema = z.object({
+    folderId: z.string().describe("Folder id as returned by listFolders."),
+    target: z.string().describe("Whose access to remove: 'team:<slug>' or 'admin:<userId>', exactly as listFolders reports it.")
+});
+class RevokeFolderAccessToolHandlerImpl {
+    constructor(getFolder, updateFolder){
+        this.getFolder = getFolder;
+        this.updateFolder = updateFolder;
+    }
+    async execute(input) {
+        const loaded = await loadFolderPermissions(this.getFolder, input.folderId);
+        const existing = loaded.direct.find((permission)=>String(permission.target) === input.target);
+        if (!existing) {
+            if (loaded.inheritedTargets.has(input.target)) throw new Error(`"${input.target}" has inherited access to this folder, not a direct rule, so it cannot be revoked here. Change it where it is defined.`);
+            throw new Error(`"${input.target}" has no direct access to this folder, so there is nothing to revoke.`);
+        }
+        const permissions = loaded.direct.filter((permission)=>String(permission.target) !== input.target);
+        const result = await this.updateFolder.execute(input.folderId, {
+            permissions
+        });
+        if (result.isFail()) throw new Error(`Could not revoke access: ${result.error.message}`);
+        const folder = result.value;
+        return {
+            folderId: folder.id,
+            title: folder.title,
+            path: folder.path,
+            removed: {
+                target: input.target,
+                level: existing.level
+            },
+            permissions: (folder.permissions ?? []).filter((permission)=>!permission.inheritedFrom).map((permission)=>({
+                    target: String(permission.target),
+                    level: permission.level
+                }))
+        };
+    }
+}
+const RevokeFolderAccessToolHandler = AiSdkToolHandler.createImplementation({
+    implementation: RevokeFolderAccessToolHandlerImpl,
+    dependencies: [
+        GetFolderUseCase,
+        UpdateFolderUseCase
+    ]
+});
+class RevokeFolderAccessToolImpl {
+    constructor(){
+        this.name = "revokeFolderAccess";
+        this.title = "Revoke folder access";
+        this.description = "Removes one team's or user's direct access to one folder, leaving all other permissions untouched. Cannot remove inherited access. Requires user approval.";
+        this.inputSchema = inputSchema;
+        this.annotations = {
+            readOnlyHint: false,
+            destructiveHint: true
+        };
+        this.handler = RevokeFolderAccessToolHandler;
+    }
+}
+const RevokeFolderAccessTool = AiSdkToolDefinition.createImplementation({
+    implementation: RevokeFolderAccessToolImpl,
+    dependencies: []
+});
+export { RevokeFolderAccessTool };
+
+//# sourceMappingURL=RevokeFolderAccessTool.js.map

package/features/ai/RevokeFolderAccessTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/RevokeFolderAccessTool.js","sources":["../../../src/features/ai/RevokeFolderAccessTool.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { AiSdkToolDefinition, AiSdkToolHandler } from \"@webiny/api-core/features/ai/index.js\";\nimport { GetFolderUseCase } from \"~/features/folder/GetFolder/index.js\";\nimport { UpdateFolderUseCase } from \"~/features/folder/UpdateFolder/index.js\";\nimport { loadFolderPermissions } from \"./loadFolderPermissions.js\";\n\nconst inputSchema = z.object({\n    folderId: z.string().describe(\"Folder id as returned by listFolders.\"),\n    target: z\n        .string()\n        .describe(\n            \"Whose access to remove: 'team:<slug>' or 'admin:<userId>', exactly as listFolders reports it.\"\n        )\n});\n\ntype Input = z.infer<typeof inputSchema>;\n\ninterface RevokeResult {\n    folderId: string;\n    title: string;\n    path: string;\n    removed: { target: string; level: string };\n    /**\n     * Every direct rule remaining afterwards.\n     *\n     * This is the set the update was asked to store, not an independent read of it:\n     * `UpdateFolderWithFolderLevelPermissions` returns the permissions it derived from the input\n     * rather than the ones the repository wrote. Treating it as a verification would let the tool\n     * confirm its own request back to itself.\n     */\n    permissions: { target: string; level: string }[];\n}\n\nclass RevokeFolderAccessToolHandlerImpl implements AiSdkToolHandler.Interface<Input> {\n    constructor(\n        private getFolder: GetFolderUseCase.Interface,\n        private updateFolder: UpdateFolderUseCase.Interface\n    ) {}\n\n    async execute(input: Input): Promise<RevokeResult> {\n        const loaded = await loadFolderPermissions(this.getFolder, input.folderId);\n\n        const existing = loaded.direct.find(\n            permission => String(permission.target) === input.target\n        );\n\n        if (!existing) {\n            if (loaded.inheritedTargets.has(input.target)) {\n                throw new Error(\n                    `\"${input.target}\" has inherited access to this folder, not a direct rule, so it cannot be revoked here. Change it where it is defined.`\n                );\n            }\n\n            throw new Error(\n                `\"${input.target}\" has no direct access to this folder, so there is nothing to revoke.`\n            );\n        }\n\n        const permissions = loaded.direct.filter(\n            permission => String(permission.target) !== input.target\n        );\n\n        const result = await this.updateFolder.execute(input.folderId, { permissions });\n\n        if (result.isFail()) {\n            throw new Error(`Could not revoke access: ${result.error.message}`);\n        }\n\n        const folder = result.value;\n\n        return {\n            folderId: folder.id,\n            title: folder.title,\n            path: folder.path,\n            removed: { target: input.target, level: existing.level },\n            permissions: (folder.permissions ?? [])\n                .filter(permission => !permission.inheritedFrom)\n                .map(permission => ({ target: String(permission.target), level: permission.level }))\n        };\n    }\n}\n\nconst RevokeFolderAccessToolHandler = AiSdkToolHandler.createImplementation({\n    implementation: RevokeFolderAccessToolHandlerImpl,\n    dependencies: [GetFolderUseCase, UpdateFolderUseCase]\n});\n\n/**\n * Removes one target's direct access to one folder.\n *\n * Destructive: somebody loses access, and there is no undo. Refuses when the target has no DIRECT rule\n * rather than reporting a removal that changed nothing — an inherited grant cannot be revoked here,\n * only where it is defined, and saying otherwise would leave the user believing access was withdrawn.\n */\nclass RevokeFolderAccessToolImpl implements AiSdkToolDefinition.Interface<Input> {\n    readonly name = \"revokeFolderAccess\";\n    readonly title = \"Revoke folder access\";\n    readonly description =\n        \"Removes one team's or user's direct access to one folder, leaving all other permissions untouched. Cannot remove inherited access. Requires user approval.\";\n    readonly inputSchema = inputSchema;\n    readonly annotations = { readOnlyHint: false, destructiveHint: true };\n    readonly handler = RevokeFolderAccessToolHandler;\n}\n\nexport const RevokeFolderAccessTool = AiSdkToolDefinition.createImplementation({\n    implementation: RevokeFolderAccessToolImpl,\n    dependencies: []\n});\n"],"names":["inputSchema","z","RevokeFolderAccessToolHandlerImpl","getFolder","updateFolder","input","loaded","loadFolderPermissions","existing","permission","String","Error","permissions","result","folder","RevokeFolderAccessToolHandler","AiSdkToolHandler","GetFolderUseCase","UpdateFolderUseCase","RevokeFolderAccessToolImpl","RevokeFolderAccessTool","AiSdkToolDefinition"],"mappings":";;;;;AAMA,MAAMA,cAAcC,EAAE,MAAM,CAAC;IACzB,UAAUA,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC9B,QAAQA,EAAAA,MACG,GACN,QAAQ,CACL;AAEZ;AAoBA,MAAMC;IACF,YACYC,SAAqC,EACrCC,YAA2C,CACrD;aAFUD,SAAS,GAATA;aACAC,YAAY,GAAZA;IACT;IAEH,MAAM,QAAQC,KAAY,EAAyB;QAC/C,MAAMC,SAAS,MAAMC,sBAAsB,IAAI,CAAC,SAAS,EAAEF,MAAM,QAAQ;QAEzE,MAAMG,WAAWF,OAAO,MAAM,CAAC,IAAI,CAC/BG,CAAAA,aAAcC,OAAOD,WAAW,MAAM,MAAMJ,MAAM,MAAM;QAG5D,IAAI,CAACG,UAAU;YACX,IAAIF,OAAO,gBAAgB,CAAC,GAAG,CAACD,MAAM,MAAM,GACxC,MAAM,IAAIM,MACN,CAAC,CAAC,EAAEN,MAAM,MAAM,CAAC,sHAAsH,CAAC;YAIhJ,MAAM,IAAIM,MACN,CAAC,CAAC,EAAEN,MAAM,MAAM,CAAC,qEAAqE,CAAC;QAE/F;QAEA,MAAMO,cAAcN,OAAO,MAAM,CAAC,MAAM,CACpCG,CAAAA,aAAcC,OAAOD,WAAW,MAAM,MAAMJ,MAAM,MAAM;QAG5D,MAAMQ,SAAS,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAACR,MAAM,QAAQ,EAAE;YAAEO;QAAY;QAE7E,IAAIC,OAAO,MAAM,IACb,MAAM,IAAIF,MAAM,CAAC,yBAAyB,EAAEE,OAAO,KAAK,CAAC,OAAO,EAAE;QAGtE,MAAMC,SAASD,OAAO,KAAK;QAE3B,OAAO;YACH,UAAUC,OAAO,EAAE;YACnB,OAAOA,OAAO,KAAK;YACnB,MAAMA,OAAO,IAAI;YACjB,SAAS;gBAAE,QAAQT,MAAM,MAAM;gBAAE,OAAOG,SAAS,KAAK;YAAC;YACvD,aAAcM,AAAAA,CAAAA,OAAO,WAAW,IAAI,EAAC,EAChC,MAAM,CAACL,CAAAA,aAAc,CAACA,WAAW,aAAa,EAC9C,GAAG,CAACA,CAAAA,aAAe;oBAAE,QAAQC,OAAOD,WAAW,MAAM;oBAAG,OAAOA,WAAW,KAAK;gBAAC;QACzF;IACJ;AACJ;AAEA,MAAMM,gCAAgCC,iBAAiB,oBAAoB,CAAC;IACxE,gBAAgBd;IAChB,cAAc;QAACe;QAAkBC;KAAoB;AACzD;AASA,MAAMC;;aACO,IAAI,GAAG;aACP,KAAK,GAAG;aACR,WAAW,GAChB;aACK,WAAW,GAAGnB;aACd,WAAW,GAAG;YAAE,cAAc;YAAO,iBAAiB;QAAK;aAC3D,OAAO,GAAGe;;AACvB;AAEO,MAAMK,yBAAyBC,oBAAoB,oBAAoB,CAAC;IAC3E,gBAAgBF;IAChB,cAAc,EAAE;AACpB"}

package/features/ai/assertTargetIsUsable.d.ts

@@ -0,0 +1,10 @@
+import type { ListTeamsUseCase } from "@webiny/api-core/features/security/teams/ListTeams/index.js";
+/**
+ * Rejects a permission target that would be stored happily and then match nobody.
+ *
+ * A folder rule identifies a team by SLUG (`team:<slug>`) and a user by id (`admin:<userId>`) — see
+ * ListFolderLevelPermissionsTargets. The field is only typed as a template string, so a team id where
+ * a slug belongs is accepted and silently grants nothing. Also refuses a target the folder inherits,
+ * since rewriting it as a direct rule detaches the folder from where the grant came from.
+ */
+export declare const assertTargetIsUsable: (listTeams: ListTeamsUseCase.Interface, target: string, inheritedTargets: Set<string>) => Promise<void>;

package/features/ai/assertTargetIsUsable.js

@@ -0,0 +1,14 @@
+const assertTargetIsUsable = async (listTeams, target, inheritedTargets)=>{
+    if (inheritedTargets.has(target)) throw new Error(`"${target}" is inherited from an ancestor folder or a role, so it cannot be changed on this folder. Change it where it is defined.`);
+    if (!target.startsWith("team:")) return;
+    const result = await listTeams.execute();
+    if (result.isFail()) throw new Error(`Could not verify the teams: ${result.error.message}`);
+    const value = target.slice(5);
+    if (result.value.some((team)=>team.slug === value)) return;
+    const byId = result.value.find((team)=>team.id === value);
+    if (byId) throw new Error(`"${target}" uses a team id. Use the slug instead: "team:${byId.slug}".`);
+    throw new Error(`"${target}" is not a known team. Call listTeams first.`);
+};
+export { assertTargetIsUsable };
+
+//# sourceMappingURL=assertTargetIsUsable.js.map

package/features/ai/assertTargetIsUsable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/assertTargetIsUsable.js","sources":["../../../src/features/ai/assertTargetIsUsable.ts"],"sourcesContent":["import type { ListTeamsUseCase } from \"@webiny/api-core/features/security/teams/ListTeams/index.js\";\n\n/**\n * Rejects a permission target that would be stored happily and then match nobody.\n *\n * A folder rule identifies a team by SLUG (`team:<slug>`) and a user by id (`admin:<userId>`) — see\n * ListFolderLevelPermissionsTargets. The field is only typed as a template string, so a team id where\n * a slug belongs is accepted and silently grants nothing. Also refuses a target the folder inherits,\n * since rewriting it as a direct rule detaches the folder from where the grant came from.\n */\nexport const assertTargetIsUsable = async (\n    listTeams: ListTeamsUseCase.Interface,\n    target: string,\n    inheritedTargets: Set<string>\n): Promise<void> => {\n    if (inheritedTargets.has(target)) {\n        throw new Error(\n            `\"${target}\" is inherited from an ancestor folder or a role, so it cannot be changed on this folder. Change it where it is defined.`\n        );\n    }\n\n    if (!target.startsWith(\"team:\")) {\n        return;\n    }\n\n    const result = await listTeams.execute();\n\n    if (result.isFail()) {\n        throw new Error(`Could not verify the teams: ${result.error.message}`);\n    }\n\n    const value = target.slice(\"team:\".length);\n\n    if (result.value.some(team => team.slug === value)) {\n        return;\n    }\n\n    const byId = result.value.find(team => team.id === value);\n\n    if (byId) {\n        throw new Error(`\"${target}\" uses a team id. Use the slug instead: \"team:${byId.slug}\".`);\n    }\n\n    throw new Error(`\"${target}\" is not a known team. Call listTeams first.`);\n};\n"],"names":["assertTargetIsUsable","listTeams","target","inheritedTargets","Error","result","value","team","byId"],"mappings":"AAUO,MAAMA,uBAAuB,OAChCC,WACAC,QACAC;IAEA,IAAIA,iBAAiB,GAAG,CAACD,SACrB,MAAM,IAAIE,MACN,CAAC,CAAC,EAAEF,OAAO,wHAAwH,CAAC;IAI5I,IAAI,CAACA,OAAO,UAAU,CAAC,UACnB;IAGJ,MAAMG,SAAS,MAAMJ,UAAU,OAAO;IAEtC,IAAII,OAAO,MAAM,IACb,MAAM,IAAID,MAAM,CAAC,4BAA4B,EAAEC,OAAO,KAAK,CAAC,OAAO,EAAE;IAGzE,MAAMC,QAAQJ,OAAO,KAAK,CAAC;IAE3B,IAAIG,OAAO,KAAK,CAAC,IAAI,CAACE,CAAAA,OAAQA,KAAK,IAAI,KAAKD,QACxC;IAGJ,MAAME,OAAOH,OAAO,KAAK,CAAC,IAAI,CAACE,CAAAA,OAAQA,KAAK,EAAE,KAAKD;IAEnD,IAAIE,MACA,MAAM,IAAIJ,MAAM,CAAC,CAAC,EAAEF,OAAO,8CAA8C,EAAEM,KAAK,IAAI,CAAC,EAAE,CAAC;IAG5F,MAAM,IAAIJ,MAAM,CAAC,CAAC,EAAEF,OAAO,4CAA4C,CAAC;AAC5E"}

package/features/ai/feature.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Folder and team tools for AI callers.
+ *
+ * The list tools are read-only and run unattended. Anything that creates, deletes or changes access is a write,
+ * so it pauses for the user to approve the exact arguments. Access changes are deliberately one target
+ * per call — granting and revoking separately means the approval block shows the entire change, rather
+ * than a desired end state whose omissions quietly remove somebody's access.
+ */
+export declare const AcoAiToolsFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/ai/feature.js

@@ -0,0 +1,25 @@
+import { createFeature } from "@webiny/feature/api";
+import { ListTeamsTool } from "./ListTeamsTool.js";
+import { ListFoldersTool } from "./ListFoldersTool.js";
+import { GrantFolderAccessTool } from "./GrantFolderAccessTool.js";
+import { RevokeFolderAccessTool } from "./RevokeFolderAccessTool.js";
+import { CreateFolderTool } from "./CreateFolderTool.js";
+import { DeleteFolderTool } from "./DeleteFolderTool.js";
+import { CreateTeamTool } from "./CreateTeamTool.js";
+import { ListRolesTool } from "./ListRolesTool.js";
+const AcoAiToolsFeature = createFeature({
+    name: "Aco/AiTools",
+    register (container) {
+        container.register(ListTeamsTool);
+        container.register(ListFoldersTool);
+        container.register(GrantFolderAccessTool);
+        container.register(RevokeFolderAccessTool);
+        container.register(CreateFolderTool);
+        container.register(DeleteFolderTool);
+        container.register(CreateTeamTool);
+        container.register(ListRolesTool);
+    }
+});
+export { AcoAiToolsFeature };
+
+//# sourceMappingURL=feature.js.map