@webiny/api-aco 6.6.0-alpha.0 → 6.6.0-alpha.2

package/features/ai/GrantFolderAccessTool.js

@@ -0,0 +1,71 @@
+import { z } from "zod";
+import { AiSdkTool } from "@webiny/api-core/features/ai/index.js";
+import { ListTeamsUseCase } from "@webiny/api-core/features/security/teams/ListTeams/index.js";
+import { GetFolderUseCase } from "../folder/GetFolder/index.js";
+import { UpdateFolderUseCase } from "../folder/UpdateFolder/index.js";
+import { loadFolderPermissions } from "./loadFolderPermissions.js";
+import { assertTargetIsUsable } from "./assertTargetIsUsable.js";
+const ACCESS_LEVELS = [
+    "owner",
+    "editor",
+    "viewer",
+    "public",
+    "no-access"
+];
+const inputSchema = z.object({
+    folderId: z.string().describe("Folder id as returned by listFolders."),
+    target: z.string().describe("Who to grant access to. A team is 'team:<slug>' — the SLUG, not the id. A user is 'admin:<userId>'. Resolve with listTeams first."),
+    level: z["enum"](ACCESS_LEVELS).describe("owner = full control including permissions; editor = change content; viewer = read only; no-access = explicitly denied.")
+});
+class GrantFolderAccessToolImpl {
+    constructor(getFolder, updateFolder, listTeams){
+        this.getFolder = getFolder;
+        this.updateFolder = updateFolder;
+        this.listTeams = listTeams;
+        this.name = "grantFolderAccess";
+        this.title = "Grant folder access";
+        this.description = "Grants one team or user a level of access on one folder, leaving all other permissions untouched. Use listFolders for the folder id and listTeams for a team slug. Requires user approval.";
+        this.inputSchema = inputSchema;
+        this.annotations = {
+            readOnlyHint: false
+        };
+    }
+    async execute(input) {
+        const loaded = await loadFolderPermissions(this.getFolder, input.folderId);
+        await assertTargetIsUsable(this.listTeams, input.target, loaded.inheritedTargets);
+        const existing = loaded.direct.find((permission)=>String(permission.target) === input.target);
+        const permissions = loaded.direct.filter((permission)=>String(permission.target) !== input.target).concat([
+            {
+                target: input.target,
+                level: input.level
+            }
+        ]);
+        const result = await this.updateFolder.execute(input.folderId, {
+            permissions
+        });
+        if (result.isFail()) throw new Error(`Could not grant access: ${result.error.message}`);
+        const folder = result.value;
+        const granted = {
+            folderId: folder.id,
+            title: folder.title,
+            path: folder.path,
+            permissions: (folder.permissions ?? []).filter((permission)=>!permission.inheritedFrom).map((permission)=>({
+                    target: String(permission.target),
+                    level: permission.level
+                }))
+        };
+        if (existing) granted.replacedExistingLevel = existing.level;
+        return granted;
+    }
+}
+const GrantFolderAccessTool = AiSdkTool.createImplementation({
+    implementation: GrantFolderAccessToolImpl,
+    dependencies: [
+        GetFolderUseCase,
+        UpdateFolderUseCase,
+        ListTeamsUseCase
+    ]
+});
+export { GrantFolderAccessTool };
+
+//# sourceMappingURL=GrantFolderAccessTool.js.map

package/features/ai/GrantFolderAccessTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/GrantFolderAccessTool.js","sources":["../../../src/features/ai/GrantFolderAccessTool.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { AiSdkTool } from \"@webiny/api-core/features/ai/index.js\";\nimport type { IAiSdkTool } from \"@webiny/api-core/features/ai/index.js\";\nimport { ListTeamsUseCase } from \"@webiny/api-core/features/security/teams/ListTeams/index.js\";\nimport { GetFolderUseCase } from \"~/features/folder/GetFolder/index.js\";\nimport { UpdateFolderUseCase } from \"~/features/folder/UpdateFolder/index.js\";\nimport type { FolderPermission } from \"~/types.js\";\nimport { loadFolderPermissions } from \"./loadFolderPermissions.js\";\nimport { assertTargetIsUsable } from \"./assertTargetIsUsable.js\";\n\nconst ACCESS_LEVELS = [\"owner\", \"editor\", \"viewer\", \"public\", \"no-access\"] as const;\n\nconst inputSchema = z.object({\n    folderId: z.string().describe(\"Folder id as returned by listFolders.\"),\n    target: z\n        .string()\n        .describe(\n            \"Who to grant access to. A team is 'team:<slug>' — the SLUG, not the id. A user is 'admin:<userId>'. Resolve with listTeams first.\"\n        ),\n    level: z\n        .enum(ACCESS_LEVELS)\n        .describe(\n            \"owner = full control including permissions; editor = change content; viewer = read only; no-access = explicitly denied.\"\n        )\n});\n\ntype Input = z.infer<typeof inputSchema>;\n\ninterface GrantResult {\n    folderId: string;\n    title: string;\n    path: string;\n    /**\n     * Every direct rule on the folder afterwards.\n     *\n     * This is the set the update was asked to store, not an independent read of it:\n     * `UpdateFolderWithFolderLevelPermissions` returns the permissions it derived from the input\n     * rather than the ones the repository wrote. Treating it as a verification would let the tool\n     * confirm its own request back to itself.\n     */\n    permissions: { target: string; level: string }[];\n    /** True when the target already had a direct rule and its level was changed. */\n    replacedExistingLevel?: string;\n}\n\n/**\n * Grants one target access to one folder, leaving every other rule alone.\n *\n * Additive by design. The earlier tool took the complete permission set and replaced it, which meant\n * approving a change showed what would be SET and said nothing about what would be removed — a rule\n * the model omitted disappeared silently. One target per call keeps the approval honest: what the user\n * sees in the plan is the whole change.\n */\nclass GrantFolderAccessToolImpl implements IAiSdkTool<Input> {\n    readonly name = \"grantFolderAccess\";\n    readonly title = \"Grant folder access\";\n    readonly description =\n        \"Grants one team or user a level of access on one folder, leaving all other permissions untouched. Use listFolders for the folder id and listTeams for a team slug. Requires user approval.\";\n    readonly inputSchema = inputSchema;\n    readonly annotations = { readOnlyHint: false };\n\n    constructor(\n        private getFolder: GetFolderUseCase.Interface,\n        private updateFolder: UpdateFolderUseCase.Interface,\n        private listTeams: ListTeamsUseCase.Interface\n    ) {}\n\n    async execute(input: Input): Promise<GrantResult> {\n        const loaded = await loadFolderPermissions(this.getFolder, input.folderId);\n\n        await assertTargetIsUsable(this.listTeams, input.target, loaded.inheritedTargets);\n\n        const existing = loaded.direct.find(\n            permission => String(permission.target) === input.target\n        );\n\n        const permissions: FolderPermission[] = loaded.direct\n            .filter(permission => String(permission.target) !== input.target)\n            .concat([{ target: input.target, level: input.level } as FolderPermission]);\n\n        const result = await this.updateFolder.execute(input.folderId, { permissions });\n\n        if (result.isFail()) {\n            throw new Error(`Could not grant access: ${result.error.message}`);\n        }\n\n        const folder = result.value;\n\n        const granted: GrantResult = {\n            folderId: folder.id,\n            title: folder.title,\n            path: folder.path,\n            permissions: (folder.permissions ?? [])\n                .filter(permission => !permission.inheritedFrom)\n                .map(permission => ({ target: String(permission.target), level: permission.level }))\n        };\n\n        if (existing) {\n            granted.replacedExistingLevel = existing.level;\n        }\n\n        return granted;\n    }\n}\n\nexport const GrantFolderAccessTool = AiSdkTool.createImplementation({\n    implementation: GrantFolderAccessToolImpl,\n    dependencies: [GetFolderUseCase, UpdateFolderUseCase, ListTeamsUseCase]\n});\n"],"names":["ACCESS_LEVELS","inputSchema","z","GrantFolderAccessToolImpl","getFolder","updateFolder","listTeams","input","loaded","loadFolderPermissions","assertTargetIsUsable","existing","permission","String","permissions","result","Error","folder","granted","GrantFolderAccessTool","AiSdkTool","GetFolderUseCase","UpdateFolderUseCase","ListTeamsUseCase"],"mappings":";;;;;;;AAUA,MAAMA,gBAAgB;IAAC;IAAS;IAAU;IAAU;IAAU;CAAY;AAE1E,MAAMC,cAAcC,EAAE,MAAM,CAAC;IACzB,UAAUA,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC9B,QAAQA,EAAAA,MACG,GACN,QAAQ,CACL;IAER,OAAOA,CAAC,CAADA,OACE,CAACF,eACL,QAAQ,CACL;AAEZ;AA6BA,MAAMG;IAQF,YACYC,SAAqC,EACrCC,YAA2C,EAC3CC,SAAqC,CAC/C;aAHUF,SAAS,GAATA;aACAC,YAAY,GAAZA;aACAC,SAAS,GAATA;aAVH,IAAI,GAAG;aACP,KAAK,GAAG;aACR,WAAW,GAChB;aACK,WAAW,GAAGL;aACd,WAAW,GAAG;YAAE,cAAc;QAAM;IAM1C;IAEH,MAAM,QAAQM,KAAY,EAAwB;QAC9C,MAAMC,SAAS,MAAMC,sBAAsB,IAAI,CAAC,SAAS,EAAEF,MAAM,QAAQ;QAEzE,MAAMG,qBAAqB,IAAI,CAAC,SAAS,EAAEH,MAAM,MAAM,EAAEC,OAAO,gBAAgB;QAEhF,MAAMG,WAAWH,OAAO,MAAM,CAAC,IAAI,CAC/BI,CAAAA,aAAcC,OAAOD,WAAW,MAAM,MAAML,MAAM,MAAM;QAG5D,MAAMO,cAAkCN,OAAO,MAAM,CAChD,MAAM,CAACI,CAAAA,aAAcC,OAAOD,WAAW,MAAM,MAAML,MAAM,MAAM,EAC/D,MAAM,CAAC;YAAC;gBAAE,QAAQA,MAAM,MAAM;gBAAE,OAAOA,MAAM,KAAK;YAAC;SAAsB;QAE9E,MAAMQ,SAAS,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAACR,MAAM,QAAQ,EAAE;YAAEO;QAAY;QAE7E,IAAIC,OAAO,MAAM,IACb,MAAM,IAAIC,MAAM,CAAC,wBAAwB,EAAED,OAAO,KAAK,CAAC,OAAO,EAAE;QAGrE,MAAME,SAASF,OAAO,KAAK;QAE3B,MAAMG,UAAuB;YACzB,UAAUD,OAAO,EAAE;YACnB,OAAOA,OAAO,KAAK;YACnB,MAAMA,OAAO,IAAI;YACjB,aAAcA,AAAAA,CAAAA,OAAO,WAAW,IAAI,EAAC,EAChC,MAAM,CAACL,CAAAA,aAAc,CAACA,WAAW,aAAa,EAC9C,GAAG,CAACA,CAAAA,aAAe;oBAAE,QAAQC,OAAOD,WAAW,MAAM;oBAAG,OAAOA,WAAW,KAAK;gBAAC;QACzF;QAEA,IAAID,UACAO,QAAQ,qBAAqB,GAAGP,SAAS,KAAK;QAGlD,OAAOO;IACX;AACJ;AAEO,MAAMC,wBAAwBC,UAAU,oBAAoB,CAAC;IAChE,gBAAgBjB;IAChB,cAAc;QAACkB;QAAkBC;QAAqBC;KAAiB;AAC3E"}

package/features/ai/ListFoldersTool.d.ts

@@ -0,0 +1,42 @@
+import { z } from "zod";
+import type { IAiSdkTool } from "@webiny/api-core/features/ai/index.js";
+import { ListFoldersUseCase } from "../../features/folder/ListFolders/index.js";
+declare const inputSchema: z.ZodObject<{
+    type: z.ZodString;
+}, z.core.$strip>;
+type Input = z.infer<typeof inputSchema>;
+interface FolderSummary {
+    id: string;
+    title: string;
+    slug: string;
+    path: string;
+    parentId?: string | null;
+    permissions: {
+        target: string;
+        level: string;
+        inherited: boolean;
+    }[];
+}
+/**
+ * Lists folders with their current access rules, so a permission change is proposed against a real
+ * folder id and the user can see what the access already is before approving a change to it.
+ */
+declare class ListFoldersToolImpl implements IAiSdkTool<Input> {
+    private listFolders;
+    readonly name = "listFolders";
+    readonly title = "List folders";
+    readonly description = "Lists folders of a given type with their ids, paths and current access permissions. Call this before changing folder permissions so the change targets a real folder.";
+    readonly inputSchema: z.ZodObject<{
+        type: z.ZodString;
+    }, z.core.$strip>;
+    readonly annotations: {
+        readOnlyHint: boolean;
+        idempotentHint: boolean;
+    };
+    constructor(listFolders: ListFoldersUseCase.Interface);
+    execute(input: Input): Promise<FolderSummary[]>;
+}
+export declare const ListFoldersTool: typeof ListFoldersToolImpl & {
+    __abstraction: import("@webiny/di").Abstraction<IAiSdkTool<any>>;
+};
+export {};

package/features/ai/ListFoldersTool.js

@@ -0,0 +1,48 @@
+import { z } from "zod";
+import { AiSdkTool } from "@webiny/api-core/features/ai/index.js";
+import { ListFoldersUseCase } from "../folder/ListFolders/index.js";
+const inputSchema = z.object({
+    type: z.string().describe("Folder namespace, e.g. 'FmFile' for the file manager or 'cms:<modelId>' for a content model's folders.")
+});
+class ListFoldersToolImpl {
+    constructor(listFolders){
+        this.listFolders = listFolders;
+        this.name = "listFolders";
+        this.title = "List folders";
+        this.description = "Lists folders of a given type with their ids, paths and current access permissions. Call this before changing folder permissions so the change targets a real folder.";
+        this.inputSchema = inputSchema;
+        this.annotations = {
+            readOnlyHint: true,
+            idempotentHint: true
+        };
+    }
+    async execute(input) {
+        const result = await this.listFolders.execute({
+            where: {
+                type: input.type
+            }
+        });
+        if (result.isFail()) throw new Error(`Could not list folders: ${result.error.message}`);
+        return result.value.folders.map((folder)=>({
+                id: folder.id,
+                title: folder.title,
+                slug: folder.slug,
+                path: folder.path,
+                parentId: folder.parentId,
+                permissions: (folder.permissions ?? []).map((permission)=>({
+                        target: permission.target,
+                        level: permission.level,
+                        inherited: Boolean(permission.inheritedFrom)
+                    }))
+            }));
+    }
+}
+const ListFoldersTool = AiSdkTool.createImplementation({
+    implementation: ListFoldersToolImpl,
+    dependencies: [
+        ListFoldersUseCase
+    ]
+});
+export { ListFoldersTool };
+
+//# sourceMappingURL=ListFoldersTool.js.map

package/features/ai/ListFoldersTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/ListFoldersTool.js","sources":["../../../src/features/ai/ListFoldersTool.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { AiSdkTool } from \"@webiny/api-core/features/ai/index.js\";\nimport type { IAiSdkTool } from \"@webiny/api-core/features/ai/index.js\";\nimport { ListFoldersUseCase } from \"~/features/folder/ListFolders/index.js\";\n\nconst inputSchema = z.object({\n    type: z\n        .string()\n        .describe(\n            \"Folder namespace, e.g. 'FmFile' for the file manager or 'cms:<modelId>' for a content model's folders.\"\n        )\n});\n\ntype Input = z.infer<typeof inputSchema>;\n\ninterface FolderSummary {\n    id: string;\n    title: string;\n    slug: string;\n    path: string;\n    parentId?: string | null;\n    permissions: { target: string; level: string; inherited: boolean }[];\n}\n\n/**\n * Lists folders with their current access rules, so a permission change is proposed against a real\n * folder id and the user can see what the access already is before approving a change to it.\n */\nclass ListFoldersToolImpl implements IAiSdkTool<Input> {\n    readonly name = \"listFolders\";\n    readonly title = \"List folders\";\n    readonly description =\n        \"Lists folders of a given type with their ids, paths and current access permissions. Call this before changing folder permissions so the change targets a real folder.\";\n    readonly inputSchema = inputSchema;\n    readonly annotations = { readOnlyHint: true, idempotentHint: true };\n\n    constructor(private listFolders: ListFoldersUseCase.Interface) {}\n\n    async execute(input: Input): Promise<FolderSummary[]> {\n        const result = await this.listFolders.execute({ where: { type: input.type } });\n\n        if (result.isFail()) {\n            throw new Error(`Could not list folders: ${result.error.message}`);\n        }\n\n        return result.value.folders.map(folder => ({\n            id: folder.id,\n            title: folder.title,\n            slug: folder.slug,\n            path: folder.path,\n            parentId: folder.parentId,\n            permissions: (folder.permissions ?? []).map(permission => ({\n                target: permission.target,\n                level: permission.level,\n                // Inherited rules cannot be edited on this folder — only on the ancestor that set them.\n                inherited: Boolean(permission.inheritedFrom)\n            }))\n        }));\n    }\n}\n\nexport const ListFoldersTool = AiSdkTool.createImplementation({\n    implementation: ListFoldersToolImpl,\n    dependencies: [ListFoldersUseCase]\n});\n"],"names":["inputSchema","z","ListFoldersToolImpl","listFolders","input","result","Error","folder","permission","Boolean","ListFoldersTool","AiSdkTool","ListFoldersUseCase"],"mappings":";;;AAKA,MAAMA,cAAcC,EAAE,MAAM,CAAC;IACzB,MAAMA,EAAAA,MACK,GACN,QAAQ,CACL;AAEZ;AAiBA,MAAMC;IAQF,YAAoBC,WAAyC,CAAE;aAA3CA,WAAW,GAAXA;aAPX,IAAI,GAAG;aACP,KAAK,GAAG;aACR,WAAW,GAChB;aACK,WAAW,GAAGH;aACd,WAAW,GAAG;YAAE,cAAc;YAAM,gBAAgB;QAAK;IAEF;IAEhE,MAAM,QAAQI,KAAY,EAA4B;QAClD,MAAMC,SAAS,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAAE,OAAO;gBAAE,MAAMD,MAAM,IAAI;YAAC;QAAE;QAE5E,IAAIC,OAAO,MAAM,IACb,MAAM,IAAIC,MAAM,CAAC,wBAAwB,EAAED,OAAO,KAAK,CAAC,OAAO,EAAE;QAGrE,OAAOA,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAACE,CAAAA,SAAW;gBACvC,IAAIA,OAAO,EAAE;gBACb,OAAOA,OAAO,KAAK;gBACnB,MAAMA,OAAO,IAAI;gBACjB,MAAMA,OAAO,IAAI;gBACjB,UAAUA,OAAO,QAAQ;gBACzB,aAAcA,AAAAA,CAAAA,OAAO,WAAW,IAAI,EAAC,EAAG,GAAG,CAACC,CAAAA,aAAe;wBACvD,QAAQA,WAAW,MAAM;wBACzB,OAAOA,WAAW,KAAK;wBAEvB,WAAWC,QAAQD,WAAW,aAAa;oBAC/C;YACJ;IACJ;AACJ;AAEO,MAAME,kBAAkBC,UAAU,oBAAoB,CAAC;IAC1D,gBAAgBT;IAChB,cAAc;QAACU;KAAmB;AACtC"}

package/features/ai/ListRolesTool.d.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+import type { IAiSdkTool } from "@webiny/api-core/features/ai/index.js";
+import { ListRolesUseCase } from "@webiny/api-core/features/security/roles/ListRoles/index.js";
+interface RoleSummary {
+    id: string;
+    name: string;
+    slug: string;
+    description?: string;
+}
+/**
+ * Resolves role names to the IDs `createTeam` takes. Separate from the write, so the user approves a
+ * team with roles that were looked up rather than guessed.
+ *
+ * Returns the slug too, because it is what a human recognises and what the admin UI shows, while
+ * `id` is what a team actually stores. Nothing at the type level separates the two, so `createTeam`
+ * accepts either and resolves it rather than making the caller guess which one that field wants.
+ */
+declare class ListRolesToolImpl implements IAiSdkTool<Record<string, never>> {
+    private listRoles;
+    readonly name = "listRoles";
+    readonly title = "List roles";
+    readonly description = "Lists the security roles in this project. Call this before createTeam and pass the `id` of each role you want. A slug also works, but a value that is neither is rejected.";
+    readonly inputSchema: z.ZodObject<{}, z.core.$strip>;
+    readonly annotations: {
+        readOnlyHint: boolean;
+        idempotentHint: boolean;
+    };
+    constructor(listRoles: ListRolesUseCase.Interface);
+    execute(): Promise<RoleSummary[]>;
+}
+export declare const ListRolesTool: typeof ListRolesToolImpl & {
+    __abstraction: import("@webiny/di").Abstraction<IAiSdkTool<any>>;
+};
+export {};

package/features/ai/ListRolesTool.js

@@ -0,0 +1,39 @@
+import { z } from "zod";
+import { AiSdkTool } from "@webiny/api-core/features/ai/index.js";
+import { ListRolesUseCase } from "@webiny/api-core/features/security/roles/ListRoles/index.js";
+const inputSchema = z.object({});
+class ListRolesToolImpl {
+    constructor(listRoles){
+        this.listRoles = listRoles;
+        this.name = "listRoles";
+        this.title = "List roles";
+        this.description = "Lists the security roles in this project. Call this before createTeam and pass the `id` of each role you want. A slug also works, but a value that is neither is rejected.";
+        this.inputSchema = inputSchema;
+        this.annotations = {
+            readOnlyHint: true,
+            idempotentHint: true
+        };
+    }
+    async execute() {
+        const result = await this.listRoles.execute();
+        if (result.isFail()) throw new Error(`Could not list roles: ${result.error.message}`);
+        return result.value.map((role)=>{
+            const summary = {
+                id: role.id,
+                name: role.name,
+                slug: role.slug
+            };
+            if (role.description) summary.description = role.description;
+            return summary;
+        });
+    }
+}
+const ListRolesTool = AiSdkTool.createImplementation({
+    implementation: ListRolesToolImpl,
+    dependencies: [
+        ListRolesUseCase
+    ]
+});
+export { ListRolesTool };
+
+//# sourceMappingURL=ListRolesTool.js.map

package/features/ai/ListRolesTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/ListRolesTool.js","sources":["../../../src/features/ai/ListRolesTool.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { AiSdkTool } from \"@webiny/api-core/features/ai/index.js\";\nimport type { IAiSdkTool } from \"@webiny/api-core/features/ai/index.js\";\nimport { ListRolesUseCase } from \"@webiny/api-core/features/security/roles/ListRoles/index.js\";\n\nconst inputSchema = z.object({});\n\ninterface RoleSummary {\n    id: string;\n    name: string;\n    slug: string;\n    description?: string;\n}\n\n/**\n * Resolves role names to the IDs `createTeam` takes. Separate from the write, so the user approves a\n * team with roles that were looked up rather than guessed.\n *\n * Returns the slug too, because it is what a human recognises and what the admin UI shows, while\n * `id` is what a team actually stores. Nothing at the type level separates the two, so `createTeam`\n * accepts either and resolves it rather than making the caller guess which one that field wants.\n */\nclass ListRolesToolImpl implements IAiSdkTool<Record<string, never>> {\n    readonly name = \"listRoles\";\n    readonly title = \"List roles\";\n    readonly description =\n        \"Lists the security roles in this project. Call this before createTeam and pass the `id` of each role you want. A slug also works, but a value that is neither is rejected.\";\n    readonly inputSchema = inputSchema;\n    readonly annotations = { readOnlyHint: true, idempotentHint: true };\n\n    constructor(private listRoles: ListRolesUseCase.Interface) {}\n\n    async execute(): Promise<RoleSummary[]> {\n        const result = await this.listRoles.execute();\n\n        if (result.isFail()) {\n            throw new Error(`Could not list roles: ${result.error.message}`);\n        }\n\n        return result.value.map(role => {\n            const summary: RoleSummary = {\n                id: role.id,\n                name: role.name,\n                slug: role.slug\n            };\n\n            if (role.description) {\n                summary.description = role.description;\n            }\n\n            return summary;\n        });\n    }\n}\n\nexport const ListRolesTool = AiSdkTool.createImplementation({\n    implementation: ListRolesToolImpl,\n    dependencies: [ListRolesUseCase]\n});\n"],"names":["inputSchema","z","ListRolesToolImpl","listRoles","result","Error","role","summary","ListRolesTool","AiSdkTool","ListRolesUseCase"],"mappings":";;;AAKA,MAAMA,cAAcC,EAAE,MAAM,CAAC,CAAC;AAiB9B,MAAMC;IAQF,YAAoBC,SAAqC,CAAE;aAAvCA,SAAS,GAATA;aAPX,IAAI,GAAG;aACP,KAAK,GAAG;aACR,WAAW,GAChB;aACK,WAAW,GAAGH;aACd,WAAW,GAAG;YAAE,cAAc;YAAM,gBAAgB;QAAK;IAEN;IAE5D,MAAM,UAAkC;QACpC,MAAMI,SAAS,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO;QAE3C,IAAIA,OAAO,MAAM,IACb,MAAM,IAAIC,MAAM,CAAC,sBAAsB,EAAED,OAAO,KAAK,CAAC,OAAO,EAAE;QAGnE,OAAOA,OAAO,KAAK,CAAC,GAAG,CAACE,CAAAA;YACpB,MAAMC,UAAuB;gBACzB,IAAID,KAAK,EAAE;gBACX,MAAMA,KAAK,IAAI;gBACf,MAAMA,KAAK,IAAI;YACnB;YAEA,IAAIA,KAAK,WAAW,EAChBC,QAAQ,WAAW,GAAGD,KAAK,WAAW;YAG1C,OAAOC;QACX;IACJ;AACJ;AAEO,MAAMC,gBAAgBC,UAAU,oBAAoB,CAAC;IACxD,gBAAgBP;IAChB,cAAc;QAACQ;KAAiB;AACpC"}

package/features/ai/ListTeamsTool.d.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+import type { IAiSdkTool } from "@webiny/api-core/features/ai/index.js";
+import { ListTeamsUseCase } from "@webiny/api-core/features/security/teams/ListTeams/index.js";
+declare const inputSchema: z.ZodObject<{}, z.core.$strip>;
+type Input = z.infer<typeof inputSchema>;
+interface TeamSummary {
+    id: string;
+    name: string;
+    slug: string;
+    description?: string;
+}
+/**
+ * Resolves human names ("team A") to the ids folder permissions actually take.
+ *
+ * Kept separate from setFolderPermissions rather than accepting a team name there: the user approves
+ * the arguments of a write, so the id has to be looked up and shown, not guessed inside the write.
+ */
+declare class ListTeamsToolImpl implements IAiSdkTool<Input> {
+    private listTeams;
+    readonly name = "listTeams";
+    readonly title = "List teams";
+    readonly description = "Lists the teams in this project with their ids, names and slugs. Folder permission targets use the SLUG (`team:<slug>`), not the id.";
+    readonly inputSchema: z.ZodObject<{}, z.core.$strip>;
+    readonly annotations: {
+        readOnlyHint: boolean;
+        idempotentHint: boolean;
+    };
+    constructor(listTeams: ListTeamsUseCase.Interface);
+    execute(): Promise<TeamSummary[]>;
+}
+export declare const ListTeamsTool: typeof ListTeamsToolImpl & {
+    __abstraction: import("@webiny/di").Abstraction<IAiSdkTool<any>>;
+};
+export {};

package/features/ai/ListTeamsTool.js

@@ -0,0 +1,39 @@
+import { z } from "zod";
+import { AiSdkTool } from "@webiny/api-core/features/ai/index.js";
+import { ListTeamsUseCase } from "@webiny/api-core/features/security/teams/ListTeams/index.js";
+const inputSchema = z.object({});
+class ListTeamsToolImpl {
+    constructor(listTeams){
+        this.listTeams = listTeams;
+        this.name = "listTeams";
+        this.title = "List teams";
+        this.description = "Lists the teams in this project with their ids, names and slugs. Folder permission targets use the SLUG (`team:<slug>`), not the id.";
+        this.inputSchema = inputSchema;
+        this.annotations = {
+            readOnlyHint: true,
+            idempotentHint: true
+        };
+    }
+    async execute() {
+        const result = await this.listTeams.execute();
+        if (result.isFail()) throw new Error(`Could not list teams: ${result.error.message}`);
+        return result.value.map((team)=>{
+            const summary = {
+                id: team.id,
+                name: team.name,
+                slug: team.slug
+            };
+            if (team.description) summary.description = team.description;
+            return summary;
+        });
+    }
+}
+const ListTeamsTool = AiSdkTool.createImplementation({
+    implementation: ListTeamsToolImpl,
+    dependencies: [
+        ListTeamsUseCase
+    ]
+});
+export { ListTeamsTool };
+
+//# sourceMappingURL=ListTeamsTool.js.map

package/features/ai/ListTeamsTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/ListTeamsTool.js","sources":["../../../src/features/ai/ListTeamsTool.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { AiSdkTool } from \"@webiny/api-core/features/ai/index.js\";\nimport type { IAiSdkTool } from \"@webiny/api-core/features/ai/index.js\";\nimport { ListTeamsUseCase } from \"@webiny/api-core/features/security/teams/ListTeams/index.js\";\n\nconst inputSchema = z.object({});\n\ntype Input = z.infer<typeof inputSchema>;\n\ninterface TeamSummary {\n    id: string;\n    name: string;\n    slug: string;\n    description?: string;\n}\n\n/**\n * Resolves human names (\"team A\") to the ids folder permissions actually take.\n *\n * Kept separate from setFolderPermissions rather than accepting a team name there: the user approves\n * the arguments of a write, so the id has to be looked up and shown, not guessed inside the write.\n */\nclass ListTeamsToolImpl implements IAiSdkTool<Input> {\n    readonly name = \"listTeams\";\n    readonly title = \"List teams\";\n    readonly description =\n        \"Lists the teams in this project with their ids, names and slugs. Folder permission targets use the SLUG (`team:<slug>`), not the id.\";\n    readonly inputSchema = inputSchema;\n    readonly annotations = { readOnlyHint: true, idempotentHint: true };\n\n    constructor(private listTeams: ListTeamsUseCase.Interface) {}\n\n    async execute(): Promise<TeamSummary[]> {\n        const result = await this.listTeams.execute();\n\n        if (result.isFail()) {\n            throw new Error(`Could not list teams: ${result.error.message}`);\n        }\n\n        return result.value.map(team => {\n            const summary: TeamSummary = {\n                id: team.id,\n                name: team.name,\n                slug: team.slug\n            };\n\n            if (team.description) {\n                summary.description = team.description;\n            }\n\n            return summary;\n        });\n    }\n}\n\nexport const ListTeamsTool = AiSdkTool.createImplementation({\n    implementation: ListTeamsToolImpl,\n    dependencies: [ListTeamsUseCase]\n});\n"],"names":["inputSchema","z","ListTeamsToolImpl","listTeams","result","Error","team","summary","ListTeamsTool","AiSdkTool","ListTeamsUseCase"],"mappings":";;;AAKA,MAAMA,cAAcC,EAAE,MAAM,CAAC,CAAC;AAiB9B,MAAMC;IAQF,YAAoBC,SAAqC,CAAE;aAAvCA,SAAS,GAATA;aAPX,IAAI,GAAG;aACP,KAAK,GAAG;aACR,WAAW,GAChB;aACK,WAAW,GAAGH;aACd,WAAW,GAAG;YAAE,cAAc;YAAM,gBAAgB;QAAK;IAEN;IAE5D,MAAM,UAAkC;QACpC,MAAMI,SAAS,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO;QAE3C,IAAIA,OAAO,MAAM,IACb,MAAM,IAAIC,MAAM,CAAC,sBAAsB,EAAED,OAAO,KAAK,CAAC,OAAO,EAAE;QAGnE,OAAOA,OAAO,KAAK,CAAC,GAAG,CAACE,CAAAA;YACpB,MAAMC,UAAuB;gBACzB,IAAID,KAAK,EAAE;gBACX,MAAMA,KAAK,IAAI;gBACf,MAAMA,KAAK,IAAI;YACnB;YAEA,IAAIA,KAAK,WAAW,EAChBC,QAAQ,WAAW,GAAGD,KAAK,WAAW;YAG1C,OAAOC;QACX;IACJ;AACJ;AAEO,MAAMC,gBAAgBC,UAAU,oBAAoB,CAAC;IACxD,gBAAgBP;IAChB,cAAc;QAACQ;KAAiB;AACpC"}

package/features/ai/RevokeFolderAccessTool.d.ts

@@ -0,0 +1,58 @@
+import { z } from "zod";
+import type { IAiSdkTool } from "@webiny/api-core/features/ai/index.js";
+import { GetFolderUseCase } from "../../features/folder/GetFolder/index.js";
+import { UpdateFolderUseCase } from "../../features/folder/UpdateFolder/index.js";
+declare const inputSchema: z.ZodObject<{
+    folderId: z.ZodString;
+    target: z.ZodString;
+}, z.core.$strip>;
+type Input = z.infer<typeof inputSchema>;
+interface RevokeResult {
+    folderId: string;
+    title: string;
+    path: string;
+    removed: {
+        target: string;
+        level: string;
+    };
+    /**
+     * Every direct rule remaining afterwards.
+     *
+     * This is the set the update was asked to store, not an independent read of it:
+     * `UpdateFolderWithFolderLevelPermissions` returns the permissions it derived from the input
+     * rather than the ones the repository wrote. Treating it as a verification would let the tool
+     * confirm its own request back to itself.
+     */
+    permissions: {
+        target: string;
+        level: string;
+    }[];
+}
+/**
+ * Removes one target's direct access to one folder.
+ *
+ * Destructive: somebody loses access, and there is no undo. Refuses when the target has no DIRECT rule
+ * rather than reporting a removal that changed nothing — an inherited grant cannot be revoked here,
+ * only where it is defined, and saying otherwise would leave the user believing access was withdrawn.
+ */
+declare class RevokeFolderAccessToolImpl implements IAiSdkTool<Input> {
+    private getFolder;
+    private updateFolder;
+    readonly name = "revokeFolderAccess";
+    readonly title = "Revoke folder access";
+    readonly description = "Removes one team's or user's direct access to one folder, leaving all other permissions untouched. Cannot remove inherited access. Requires user approval.";
+    readonly inputSchema: z.ZodObject<{
+        folderId: z.ZodString;
+        target: z.ZodString;
+    }, z.core.$strip>;
+    readonly annotations: {
+        readOnlyHint: boolean;
+        destructiveHint: boolean;
+    };
+    constructor(getFolder: GetFolderUseCase.Interface, updateFolder: UpdateFolderUseCase.Interface);
+    execute(input: Input): Promise<RevokeResult>;
+}
+export declare const RevokeFolderAccessTool: typeof RevokeFolderAccessToolImpl & {
+    __abstraction: import("@webiny/di").Abstraction<IAiSdkTool<any>>;
+};
+export {};

package/features/ai/RevokeFolderAccessTool.js

@@ -0,0 +1,60 @@
+import { z } from "zod";
+import { AiSdkTool } from "@webiny/api-core/features/ai/index.js";
+import { GetFolderUseCase } from "../folder/GetFolder/index.js";
+import { UpdateFolderUseCase } from "../folder/UpdateFolder/index.js";
+import { loadFolderPermissions } from "./loadFolderPermissions.js";
+const inputSchema = z.object({
+    folderId: z.string().describe("Folder id as returned by listFolders."),
+    target: z.string().describe("Whose access to remove: 'team:<slug>' or 'admin:<userId>', exactly as listFolders reports it.")
+});
+class RevokeFolderAccessToolImpl {
+    constructor(getFolder, updateFolder){
+        this.getFolder = getFolder;
+        this.updateFolder = updateFolder;
+        this.name = "revokeFolderAccess";
+        this.title = "Revoke folder access";
+        this.description = "Removes one team's or user's direct access to one folder, leaving all other permissions untouched. Cannot remove inherited access. Requires user approval.";
+        this.inputSchema = inputSchema;
+        this.annotations = {
+            readOnlyHint: false,
+            destructiveHint: true
+        };
+    }
+    async execute(input) {
+        const loaded = await loadFolderPermissions(this.getFolder, input.folderId);
+        const existing = loaded.direct.find((permission)=>String(permission.target) === input.target);
+        if (!existing) {
+            if (loaded.inheritedTargets.has(input.target)) throw new Error(`"${input.target}" has inherited access to this folder, not a direct rule, so it cannot be revoked here. Change it where it is defined.`);
+            throw new Error(`"${input.target}" has no direct access to this folder, so there is nothing to revoke.`);
+        }
+        const permissions = loaded.direct.filter((permission)=>String(permission.target) !== input.target);
+        const result = await this.updateFolder.execute(input.folderId, {
+            permissions
+        });
+        if (result.isFail()) throw new Error(`Could not revoke access: ${result.error.message}`);
+        const folder = result.value;
+        return {
+            folderId: folder.id,
+            title: folder.title,
+            path: folder.path,
+            removed: {
+                target: input.target,
+                level: existing.level
+            },
+            permissions: (folder.permissions ?? []).filter((permission)=>!permission.inheritedFrom).map((permission)=>({
+                    target: String(permission.target),
+                    level: permission.level
+                }))
+        };
+    }
+}
+const RevokeFolderAccessTool = AiSdkTool.createImplementation({
+    implementation: RevokeFolderAccessToolImpl,
+    dependencies: [
+        GetFolderUseCase,
+        UpdateFolderUseCase
+    ]
+});
+export { RevokeFolderAccessTool };
+
+//# sourceMappingURL=RevokeFolderAccessTool.js.map

package/features/ai/RevokeFolderAccessTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/RevokeFolderAccessTool.js","sources":["../../../src/features/ai/RevokeFolderAccessTool.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { AiSdkTool } from \"@webiny/api-core/features/ai/index.js\";\nimport type { IAiSdkTool } from \"@webiny/api-core/features/ai/index.js\";\nimport { GetFolderUseCase } from \"~/features/folder/GetFolder/index.js\";\nimport { UpdateFolderUseCase } from \"~/features/folder/UpdateFolder/index.js\";\nimport { loadFolderPermissions } from \"./loadFolderPermissions.js\";\n\nconst inputSchema = z.object({\n    folderId: z.string().describe(\"Folder id as returned by listFolders.\"),\n    target: z\n        .string()\n        .describe(\n            \"Whose access to remove: 'team:<slug>' or 'admin:<userId>', exactly as listFolders reports it.\"\n        )\n});\n\ntype Input = z.infer<typeof inputSchema>;\n\ninterface RevokeResult {\n    folderId: string;\n    title: string;\n    path: string;\n    removed: { target: string; level: string };\n    /**\n     * Every direct rule remaining afterwards.\n     *\n     * This is the set the update was asked to store, not an independent read of it:\n     * `UpdateFolderWithFolderLevelPermissions` returns the permissions it derived from the input\n     * rather than the ones the repository wrote. Treating it as a verification would let the tool\n     * confirm its own request back to itself.\n     */\n    permissions: { target: string; level: string }[];\n}\n\n/**\n * Removes one target's direct access to one folder.\n *\n * Destructive: somebody loses access, and there is no undo. Refuses when the target has no DIRECT rule\n * rather than reporting a removal that changed nothing — an inherited grant cannot be revoked here,\n * only where it is defined, and saying otherwise would leave the user believing access was withdrawn.\n */\nclass RevokeFolderAccessToolImpl implements IAiSdkTool<Input> {\n    readonly name = \"revokeFolderAccess\";\n    readonly title = \"Revoke folder access\";\n    readonly description =\n        \"Removes one team's or user's direct access to one folder, leaving all other permissions untouched. Cannot remove inherited access. Requires user approval.\";\n    readonly inputSchema = inputSchema;\n    readonly annotations = { readOnlyHint: false, destructiveHint: true };\n\n    constructor(\n        private getFolder: GetFolderUseCase.Interface,\n        private updateFolder: UpdateFolderUseCase.Interface\n    ) {}\n\n    async execute(input: Input): Promise<RevokeResult> {\n        const loaded = await loadFolderPermissions(this.getFolder, input.folderId);\n\n        const existing = loaded.direct.find(\n            permission => String(permission.target) === input.target\n        );\n\n        if (!existing) {\n            if (loaded.inheritedTargets.has(input.target)) {\n                throw new Error(\n                    `\"${input.target}\" has inherited access to this folder, not a direct rule, so it cannot be revoked here. Change it where it is defined.`\n                );\n            }\n\n            throw new Error(\n                `\"${input.target}\" has no direct access to this folder, so there is nothing to revoke.`\n            );\n        }\n\n        const permissions = loaded.direct.filter(\n            permission => String(permission.target) !== input.target\n        );\n\n        const result = await this.updateFolder.execute(input.folderId, { permissions });\n\n        if (result.isFail()) {\n            throw new Error(`Could not revoke access: ${result.error.message}`);\n        }\n\n        const folder = result.value;\n\n        return {\n            folderId: folder.id,\n            title: folder.title,\n            path: folder.path,\n            removed: { target: input.target, level: existing.level },\n            permissions: (folder.permissions ?? [])\n                .filter(permission => !permission.inheritedFrom)\n                .map(permission => ({ target: String(permission.target), level: permission.level }))\n        };\n    }\n}\n\nexport const RevokeFolderAccessTool = AiSdkTool.createImplementation({\n    implementation: RevokeFolderAccessToolImpl,\n    dependencies: [GetFolderUseCase, UpdateFolderUseCase]\n});\n"],"names":["inputSchema","z","RevokeFolderAccessToolImpl","getFolder","updateFolder","input","loaded","loadFolderPermissions","existing","permission","String","Error","permissions","result","folder","RevokeFolderAccessTool","AiSdkTool","GetFolderUseCase","UpdateFolderUseCase"],"mappings":";;;;;AAOA,MAAMA,cAAcC,EAAE,MAAM,CAAC;IACzB,UAAUA,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC9B,QAAQA,EAAAA,MACG,GACN,QAAQ,CACL;AAEZ;AA2BA,MAAMC;IAQF,YACYC,SAAqC,EACrCC,YAA2C,CACrD;aAFUD,SAAS,GAATA;aACAC,YAAY,GAAZA;aATH,IAAI,GAAG;aACP,KAAK,GAAG;aACR,WAAW,GAChB;aACK,WAAW,GAAGJ;aACd,WAAW,GAAG;YAAE,cAAc;YAAO,iBAAiB;QAAK;IAKjE;IAEH,MAAM,QAAQK,KAAY,EAAyB;QAC/C,MAAMC,SAAS,MAAMC,sBAAsB,IAAI,CAAC,SAAS,EAAEF,MAAM,QAAQ;QAEzE,MAAMG,WAAWF,OAAO,MAAM,CAAC,IAAI,CAC/BG,CAAAA,aAAcC,OAAOD,WAAW,MAAM,MAAMJ,MAAM,MAAM;QAG5D,IAAI,CAACG,UAAU;YACX,IAAIF,OAAO,gBAAgB,CAAC,GAAG,CAACD,MAAM,MAAM,GACxC,MAAM,IAAIM,MACN,CAAC,CAAC,EAAEN,MAAM,MAAM,CAAC,sHAAsH,CAAC;YAIhJ,MAAM,IAAIM,MACN,CAAC,CAAC,EAAEN,MAAM,MAAM,CAAC,qEAAqE,CAAC;QAE/F;QAEA,MAAMO,cAAcN,OAAO,MAAM,CAAC,MAAM,CACpCG,CAAAA,aAAcC,OAAOD,WAAW,MAAM,MAAMJ,MAAM,MAAM;QAG5D,MAAMQ,SAAS,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAACR,MAAM,QAAQ,EAAE;YAAEO;QAAY;QAE7E,IAAIC,OAAO,MAAM,IACb,MAAM,IAAIF,MAAM,CAAC,yBAAyB,EAAEE,OAAO,KAAK,CAAC,OAAO,EAAE;QAGtE,MAAMC,SAASD,OAAO,KAAK;QAE3B,OAAO;YACH,UAAUC,OAAO,EAAE;YACnB,OAAOA,OAAO,KAAK;YACnB,MAAMA,OAAO,IAAI;YACjB,SAAS;gBAAE,QAAQT,MAAM,MAAM;gBAAE,OAAOG,SAAS,KAAK;YAAC;YACvD,aAAcM,AAAAA,CAAAA,OAAO,WAAW,IAAI,EAAC,EAChC,MAAM,CAACL,CAAAA,aAAc,CAACA,WAAW,aAAa,EAC9C,GAAG,CAACA,CAAAA,aAAe;oBAAE,QAAQC,OAAOD,WAAW,MAAM;oBAAG,OAAOA,WAAW,KAAK;gBAAC;QACzF;IACJ;AACJ;AAEO,MAAMM,yBAAyBC,UAAU,oBAAoB,CAAC;IACjE,gBAAgBd;IAChB,cAAc;QAACe;QAAkBC;KAAoB;AACzD"}

package/features/ai/assertTargetIsUsable.d.ts

@@ -0,0 +1,10 @@
+import type { ListTeamsUseCase } from "@webiny/api-core/features/security/teams/ListTeams/index.js";
+/**
+ * Rejects a permission target that would be stored happily and then match nobody.
+ *
+ * A folder rule identifies a team by SLUG (`team:<slug>`) and a user by id (`admin:<userId>`) — see
+ * ListFolderLevelPermissionsTargets. The field is only typed as a template string, so a team id where
+ * a slug belongs is accepted and silently grants nothing. Also refuses a target the folder inherits,
+ * since rewriting it as a direct rule detaches the folder from where the grant came from.
+ */
+export declare const assertTargetIsUsable: (listTeams: ListTeamsUseCase.Interface, target: string, inheritedTargets: Set<string>) => Promise<void>;

package/features/ai/assertTargetIsUsable.js

@@ -0,0 +1,14 @@
+const assertTargetIsUsable = async (listTeams, target, inheritedTargets)=>{
+    if (inheritedTargets.has(target)) throw new Error(`"${target}" is inherited from an ancestor folder or a role, so it cannot be changed on this folder. Change it where it is defined.`);
+    if (!target.startsWith("team:")) return;
+    const result = await listTeams.execute();
+    if (result.isFail()) throw new Error(`Could not verify the teams: ${result.error.message}`);
+    const value = target.slice(5);
+    if (result.value.some((team)=>team.slug === value)) return;
+    const byId = result.value.find((team)=>team.id === value);
+    if (byId) throw new Error(`"${target}" uses a team id. Use the slug instead: "team:${byId.slug}".`);
+    throw new Error(`"${target}" is not a known team. Call listTeams first.`);
+};
+export { assertTargetIsUsable };
+
+//# sourceMappingURL=assertTargetIsUsable.js.map

package/features/ai/assertTargetIsUsable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/assertTargetIsUsable.js","sources":["../../../src/features/ai/assertTargetIsUsable.ts"],"sourcesContent":["import type { ListTeamsUseCase } from \"@webiny/api-core/features/security/teams/ListTeams/index.js\";\n\n/**\n * Rejects a permission target that would be stored happily and then match nobody.\n *\n * A folder rule identifies a team by SLUG (`team:<slug>`) and a user by id (`admin:<userId>`) — see\n * ListFolderLevelPermissionsTargets. The field is only typed as a template string, so a team id where\n * a slug belongs is accepted and silently grants nothing. Also refuses a target the folder inherits,\n * since rewriting it as a direct rule detaches the folder from where the grant came from.\n */\nexport const assertTargetIsUsable = async (\n    listTeams: ListTeamsUseCase.Interface,\n    target: string,\n    inheritedTargets: Set<string>\n): Promise<void> => {\n    if (inheritedTargets.has(target)) {\n        throw new Error(\n            `\"${target}\" is inherited from an ancestor folder or a role, so it cannot be changed on this folder. Change it where it is defined.`\n        );\n    }\n\n    if (!target.startsWith(\"team:\")) {\n        return;\n    }\n\n    const result = await listTeams.execute();\n\n    if (result.isFail()) {\n        throw new Error(`Could not verify the teams: ${result.error.message}`);\n    }\n\n    const value = target.slice(\"team:\".length);\n\n    if (result.value.some(team => team.slug === value)) {\n        return;\n    }\n\n    const byId = result.value.find(team => team.id === value);\n\n    if (byId) {\n        throw new Error(`\"${target}\" uses a team id. Use the slug instead: \"team:${byId.slug}\".`);\n    }\n\n    throw new Error(`\"${target}\" is not a known team. Call listTeams first.`);\n};\n"],"names":["assertTargetIsUsable","listTeams","target","inheritedTargets","Error","result","value","team","byId"],"mappings":"AAUO,MAAMA,uBAAuB,OAChCC,WACAC,QACAC;IAEA,IAAIA,iBAAiB,GAAG,CAACD,SACrB,MAAM,IAAIE,MACN,CAAC,CAAC,EAAEF,OAAO,wHAAwH,CAAC;IAI5I,IAAI,CAACA,OAAO,UAAU,CAAC,UACnB;IAGJ,MAAMG,SAAS,MAAMJ,UAAU,OAAO;IAEtC,IAAII,OAAO,MAAM,IACb,MAAM,IAAID,MAAM,CAAC,4BAA4B,EAAEC,OAAO,KAAK,CAAC,OAAO,EAAE;IAGzE,MAAMC,QAAQJ,OAAO,KAAK,CAAC;IAE3B,IAAIG,OAAO,KAAK,CAAC,IAAI,CAACE,CAAAA,OAAQA,KAAK,IAAI,KAAKD,QACxC;IAGJ,MAAME,OAAOH,OAAO,KAAK,CAAC,IAAI,CAACE,CAAAA,OAAQA,KAAK,EAAE,KAAKD;IAEnD,IAAIE,MACA,MAAM,IAAIJ,MAAM,CAAC,CAAC,EAAEF,OAAO,8CAA8C,EAAEM,KAAK,IAAI,CAAC,EAAE,CAAC;IAG5F,MAAM,IAAIJ,MAAM,CAAC,CAAC,EAAEF,OAAO,4CAA4C,CAAC;AAC5E"}

package/features/ai/feature.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Folder and team tools for AI callers.
+ *
+ * The list tools are read-only and run unattended. Anything that creates or changes access is a write,
+ * so it pauses for the user to approve the exact arguments. Access changes are deliberately one target
+ * per call — granting and revoking separately means the approval block shows the entire change, rather
+ * than a desired end state whose omissions quietly remove somebody's access.
+ */
+export declare const AcoAiToolsFeature: {
+    name: string;
+    register(container: import("@webiny/di").Container): void;
+};

package/features/ai/feature.js

@@ -0,0 +1,23 @@
+import { createFeature } from "@webiny/feature/api";
+import { ListTeamsTool } from "./ListTeamsTool.js";
+import { ListFoldersTool } from "./ListFoldersTool.js";
+import { GrantFolderAccessTool } from "./GrantFolderAccessTool.js";
+import { RevokeFolderAccessTool } from "./RevokeFolderAccessTool.js";
+import { CreateFolderTool } from "./CreateFolderTool.js";
+import { CreateTeamTool } from "./CreateTeamTool.js";
+import { ListRolesTool } from "./ListRolesTool.js";
+const AcoAiToolsFeature = createFeature({
+    name: "Aco/AiTools",
+    register (container) {
+        container.register(ListTeamsTool);
+        container.register(ListFoldersTool);
+        container.register(GrantFolderAccessTool);
+        container.register(RevokeFolderAccessTool);
+        container.register(CreateFolderTool);
+        container.register(CreateTeamTool);
+        container.register(ListRolesTool);
+    }
+});
+export { AcoAiToolsFeature };
+
+//# sourceMappingURL=feature.js.map

package/features/ai/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/ai/feature.js","sources":["../../../src/features/ai/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { ListTeamsTool } from \"./ListTeamsTool.js\";\nimport { ListFoldersTool } from \"./ListFoldersTool.js\";\nimport { GrantFolderAccessTool } from \"./GrantFolderAccessTool.js\";\nimport { RevokeFolderAccessTool } from \"./RevokeFolderAccessTool.js\";\nimport { CreateFolderTool } from \"./CreateFolderTool.js\";\nimport { CreateTeamTool } from \"./CreateTeamTool.js\";\nimport { ListRolesTool } from \"./ListRolesTool.js\";\n\n/**\n * Folder and team tools for AI callers.\n *\n * The list tools are read-only and run unattended. Anything that creates or changes access is a write,\n * so it pauses for the user to approve the exact arguments. Access changes are deliberately one target\n * per call — granting and revoking separately means the approval block shows the entire change, rather\n * than a desired end state whose omissions quietly remove somebody's access.\n */\nexport const AcoAiToolsFeature = createFeature({\n    name: \"Aco/AiTools\",\n    register(container) {\n        container.register(ListTeamsTool);\n        container.register(ListFoldersTool);\n        container.register(GrantFolderAccessTool);\n        container.register(RevokeFolderAccessTool);\n        container.register(CreateFolderTool);\n        container.register(CreateTeamTool);\n        container.register(ListRolesTool);\n    }\n});\n"],"names":["AcoAiToolsFeature","createFeature","container","ListTeamsTool","ListFoldersTool","GrantFolderAccessTool","RevokeFolderAccessTool","CreateFolderTool","CreateTeamTool","ListRolesTool"],"mappings":";;;;;;;;AAiBO,MAAMA,oBAAoBC,cAAc;IAC3C,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;QACnBD,UAAU,QAAQ,CAACE;QACnBF,UAAU,QAAQ,CAACG;QACnBH,UAAU,QAAQ,CAACI;QACnBJ,UAAU,QAAQ,CAACK;QACnBL,UAAU,QAAQ,CAACM;QACnBN,UAAU,QAAQ,CAACO;IACvB;AACJ"}

package/features/ai/index.d.ts

@@ -0,0 +1,8 @@
+export { AcoAiToolsFeature } from "./feature.js";
+export { ListTeamsTool } from "./ListTeamsTool.js";
+export { ListFoldersTool } from "./ListFoldersTool.js";
+export { ListRolesTool } from "./ListRolesTool.js";
+export { GrantFolderAccessTool } from "./GrantFolderAccessTool.js";
+export { RevokeFolderAccessTool } from "./RevokeFolderAccessTool.js";
+export { CreateFolderTool } from "./CreateFolderTool.js";
+export { CreateTeamTool } from "./CreateTeamTool.js";

package/features/ai/index.js

@@ -0,0 +1,8 @@
+export { AcoAiToolsFeature } from "./feature.js";
+export { ListTeamsTool } from "./ListTeamsTool.js";
+export { ListFoldersTool } from "./ListFoldersTool.js";
+export { ListRolesTool } from "./ListRolesTool.js";
+export { GrantFolderAccessTool } from "./GrantFolderAccessTool.js";
+export { RevokeFolderAccessTool } from "./RevokeFolderAccessTool.js";
+export { CreateFolderTool } from "./CreateFolderTool.js";
+export { CreateTeamTool } from "./CreateTeamTool.js";

package/features/ai/loadFolderPermissions.d.ts

@@ -0,0 +1,16 @@
+import type { GetFolderUseCase } from "../../features/folder/GetFolder/index.js";
+import type { Folder, FolderPermission } from "../../types.js";
+export interface LoadedFolderPermissions {
+    folder: Folder;
+    /** Rules set on this folder. The only ones it may change. */
+    direct: FolderPermission[];
+    /** Targets granted by an ancestor or a role. Writing these back would detach the inheritance. */
+    inheritedTargets: Set<string>;
+}
+/**
+ * Reads a folder and separates the rules it owns from the ones it merely inherits.
+ *
+ * Every permission write starts here, because the field holds both kinds and a change has to preserve
+ * the direct rules while leaving the inherited ones alone.
+ */
+export declare const loadFolderPermissions: (getFolder: GetFolderUseCase.Interface, folderId: string) => Promise<LoadedFolderPermissions>;

package/features/ai/loadFolderPermissions.js

@@ -0,0 +1,14 @@
+const loadFolderPermissions = async (getFolder, folderId)=>{
+    const result = await getFolder.execute(folderId);
+    if (result.isFail()) throw new Error(`Folder "${folderId}" not found: ${result.error.message}. Call listFolders for valid ids.`);
+    const folder = result.value;
+    const permissions = folder.permissions ?? [];
+    return {
+        folder,
+        direct: permissions.filter((permission)=>!permission.inheritedFrom),
+        inheritedTargets: new Set(permissions.filter((permission)=>permission.inheritedFrom).map((p)=>String(p.target)))
+    };
+};
+export { loadFolderPermissions };
+
+//# sourceMappingURL=loadFolderPermissions.js.map