grantr 0.1.0__tar.gz

grantr-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Alex Nodeland
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

grantr-0.1.0/PKG-INFO

@@ -0,0 +1,111 @@
+Metadata-Version: 2.4
+Name: grantr
+Version: 0.1.0
+Summary: Identity and access for artifactr and reflexr: tenants, members, groups, roles, service principals and grants, checked before every command and read.
+Keywords: authorization,access-control,rbac,multi-tenant,agents,pydantic
+Author: Alex Nodeland
+Author-email: Alex Nodeland <alex@ournature.studio>
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Framework :: Pydantic :: 2
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
+Classifier: Typing :: Typed
+Requires-Dist: pydantic>=2.13
+Requires-Dist: opentelemetry-api>=1.28
+Requires-Dist: fastapi>=0.141 ; extra == 'fastapi'
+Requires-Dist: starlette>=0.46.0 ; extra == 'fastapi'
+Requires-Dist: grantr[sql] ; extra == 'postgres'
+Requires-Dist: asyncpg>=0.31 ; extra == 'postgres'
+Requires-Dist: lattice-core-ai[sql]>=0.1.0 ; extra == 'sql'
+Requires-Dist: sqlalchemy[asyncio]>=2.1 ; extra == 'sql'
+Requires-Dist: alembic>=1.20 ; extra == 'sql'
+Requires-Dist: grantr[sql] ; extra == 'sqlite'
+Requires-Dist: aiosqlite>=0.22 ; extra == 'sqlite'
+Requires-Python: >=3.12
+Project-URL: Homepage, https://lattice.alexnodeland.com/grantr/
+Project-URL: Documentation, https://lattice.alexnodeland.com/grantr/
+Project-URL: Repository, https://github.com/alexnodeland/lattice
+Project-URL: Issues, https://github.com/alexnodeland/lattice/issues
+Project-URL: Changelog, https://github.com/alexnodeland/lattice/blob/main/packages/grantr/CHANGELOG.md
+Provides-Extra: fastapi
+Provides-Extra: postgres
+Provides-Extra: sql
+Provides-Extra: sqlite
+Description-Content-Type: text/markdown
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/alexnodeland/lattice/main/docs/grantr/assets/brand/banner-dark.svg">
+  <img alt="grantr: identity and access for artifactr, reflexr and portalr." src="https://raw.githubusercontent.com/alexnodeland/lattice/main/docs/grantr/assets/brand/banner-light.svg" width="100%">
+</picture>
+
+<p>
+  <a href="https://lattice.alexnodeland.com/grantr/"><img alt="Docs" src="https://img.shields.io/badge/docs-lattice.alexnodeland.com%2Fgrantr-6B5300"></a>
+  <a href="https://github.com/alexnodeland/lattice/actions/workflows/nightly.yml"><img alt="Nightly" src="https://github.com/alexnodeland/lattice/actions/workflows/nightly.yml/badge.svg?branch=main"></a>
+  <img alt="Python 3.12, 3.13 and 3.14" src="https://img.shields.io/badge/python-3.12%20%7C%203.13%20%7C%203.14-6B5300">
+  <img alt="Coverage: 100%" src="https://img.shields.io/badge/coverage-100%25-6B5300">
+  <img alt="Typed: pyright strict" src="https://img.shields.io/badge/typed-pyright%20strict-6B5300">
+  <a href="https://github.com/alexnodeland/lattice/blob/main/packages/grantr/LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-6B5300"></a>
+</p>
+
+**grantr** is the identity and access package for [artifactr](https://lattice.alexnodeland.com/artifactr/), [reflexr](https://lattice.alexnodeland.com/reflexr/) and [portalr](https://lattice.alexnodeland.com/portalr/): tenants, their members, groups, roles and service principals, and the grants that bind them to tenants, workspaces, threads, artifacts and rules. The libraries ask it, through their own hooks, before every command and read. It imports neither library, and neither imports it.
+
+> **Status:** v0.1's scope is built: the model, built-in and custom roles, groups, service principals and keys, checks, the libraries' hooks, restricted threads and artifacts, the audit log, in-memory and SQL storage with row-level security (the `sql`, `sqlite` and `postgres` extras), the admin router (the `fastapi` extra) and telemetry. stackr's template wires it in by default, so each library asks it before every command and read.
+
+## Why
+
+Before grantr, any user of a tenant could do anything in every workspace of that tenant. The libraries' `authorize` hook was asked when a workspace was opened, and never heard what the actor was about to do, so a viewer couldn't be kept from editing. A user had exactly one tenant, set in their token, and nothing stored members, groups or roles. [lattice RFC-0001](https://lattice.alexnodeland.com/rfcs/0001-grantr-identity-and-access/) designs access once, for every surface, and grantr is where its model is built.
+
+## What it does
+
+- **Check every command and read.** The libraries' hook hears the action, such as `artifactr:edit_artifact`, and asks grantr before each command and read, on every surface ([ADR-0001](https://lattice.alexnodeland.com/grantr/adr/0001-the-hook-hears-the-action/)).
+- **Grant down to threads and artifacts,** and hide a restricted one from everyone without a role on it ([ADR-0002](https://lattice.alexnodeland.com/grantr/adr/0002-grants-down-to-threads-and-artifacts/), [ADR-0003](https://lattice.alexnodeland.com/grantr/adr/0003-visible-to-the-workspace-unless-restricted/)).
+- **Act for a user.** An agent's turn is checked as the person whose message started it ([ADR-0004](https://lattice.alexnodeland.com/grantr/adr/0004-an-agent-turn-acts-for-its-user/)).
+- **Own membership.** A user's tenants come from grantr, and each request names its tenant ([ADR-0005](https://lattice.alexnodeland.com/grantr/adr/0005-a-users-tenants-from-grantrs-memberships/)).
+- **Built-in and custom roles, groups and service principals,** with keys shown once, and checks that deny by default ([ADR-0006](https://lattice.alexnodeland.com/grantr/adr/0006-what-v0-1-includes/)).
+- **An append-only audit log** of every change to access ([ADR-0007](https://lattice.alexnodeland.com/grantr/adr/0007-an-append-only-audit-log/)).
+- **Its own model, with OpenFGA-shaped ports,** in memory or in SQL ([ADR-0008](https://lattice.alexnodeland.com/grantr/adr/0008-grantrs-own-model-with-openfga-shaped-ports/)), and a deployment-wide `operator` role ([ADR-0009](https://lattice.alexnodeland.com/grantr/adr/0009-a-deployment-wide-operator-role/)).
+- **Row-level security under the libraries' scoping,** with PostgreSQL keeping each tenant's rows to that tenant ([ADR-0026](https://lattice.alexnodeland.com/grantr/adr/0026-row-level-security-under-the-scoping/)).
+
+## Quick start
+
+```python
+from artifactr.workspace import ACTIONS as ARTIFACTR
+from grantr import Grants, InMemoryStorage, Resource, User
+
+grants = Grants(InMemoryStorage(), catalogs=[ARTIFACTR])
+await grants.first_operator("root")
+await grants.create_tenant("acme", owner="alice", by=User(id="root"))
+await grants.add_member("acme", User(id="bob"), by=User(id="alice"))
+main = Resource(kind="workspace", workspace="main")
+await grants.grant("acme", "editor", on=main, to=User(id="bob"), by=User(id="alice"))
+assert await grants.check("acme", User(id="bob"), "artifactr:edit_artifact", main)
+```
+
+[Getting started](https://lattice.alexnodeland.com/grantr/getting-started/) goes on to the libraries' hooks, SQL storage and the admin API.
+
+## Documentation
+
+grantr's documentation is its section of lattice's site, at **<https://lattice.alexnodeland.com/grantr/>**, built from [`docs/grantr/`](https://github.com/alexnodeland/lattice/tree/main/docs/grantr).
+
+- [Getting started](https://lattice.alexnodeland.com/grantr/getting-started/), and the guides: roles and grants, restricted threads and artifacts, service principals and keys, row-level security, and the permission matrix.
+- [Architecture](https://lattice.alexnodeland.com/grantr/architecture/): the model, the checks, the commands and the storage port.
+- [Architecture decision records](https://lattice.alexnodeland.com/grantr/adr/): why each part is the way it is.
+- [RFCs](https://lattice.alexnodeland.com/grantr/rfcs/): the v0.1 plan, its phases and what each waits on.
+- [Identity and access](https://lattice.alexnodeland.com/rfcs/0001-grantr-identity-and-access/), lattice's RFC-0001: the design grantr builds.
+- [Brand](https://lattice.alexnodeland.com/grantr/assets/brand/): the mark and its colours.
+
+## Contributing
+
+See [CONTRIBUTING.md](https://github.com/alexnodeland/lattice/blob/main/CONTRIBUTING.md) for setup, the trunk-based workflow, and the RFC and ADR process.
+
+## License
+
+[MIT](https://github.com/alexnodeland/lattice/blob/main/packages/grantr/LICENSE)

grantr-0.1.0/README.md

@@ -0,0 +1,68 @@
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/alexnodeland/lattice/main/docs/grantr/assets/brand/banner-dark.svg">
+  <img alt="grantr: identity and access for artifactr, reflexr and portalr." src="https://raw.githubusercontent.com/alexnodeland/lattice/main/docs/grantr/assets/brand/banner-light.svg" width="100%">
+</picture>
+
+<p>
+  <a href="https://lattice.alexnodeland.com/grantr/"><img alt="Docs" src="https://img.shields.io/badge/docs-lattice.alexnodeland.com%2Fgrantr-6B5300"></a>
+  <a href="https://github.com/alexnodeland/lattice/actions/workflows/nightly.yml"><img alt="Nightly" src="https://github.com/alexnodeland/lattice/actions/workflows/nightly.yml/badge.svg?branch=main"></a>
+  <img alt="Python 3.12, 3.13 and 3.14" src="https://img.shields.io/badge/python-3.12%20%7C%203.13%20%7C%203.14-6B5300">
+  <img alt="Coverage: 100%" src="https://img.shields.io/badge/coverage-100%25-6B5300">
+  <img alt="Typed: pyright strict" src="https://img.shields.io/badge/typed-pyright%20strict-6B5300">
+  <a href="https://github.com/alexnodeland/lattice/blob/main/packages/grantr/LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-6B5300"></a>
+</p>
+
+**grantr** is the identity and access package for [artifactr](https://lattice.alexnodeland.com/artifactr/), [reflexr](https://lattice.alexnodeland.com/reflexr/) and [portalr](https://lattice.alexnodeland.com/portalr/): tenants, their members, groups, roles and service principals, and the grants that bind them to tenants, workspaces, threads, artifacts and rules. The libraries ask it, through their own hooks, before every command and read. It imports neither library, and neither imports it.
+
+> **Status:** v0.1's scope is built: the model, built-in and custom roles, groups, service principals and keys, checks, the libraries' hooks, restricted threads and artifacts, the audit log, in-memory and SQL storage with row-level security (the `sql`, `sqlite` and `postgres` extras), the admin router (the `fastapi` extra) and telemetry. stackr's template wires it in by default, so each library asks it before every command and read.
+
+## Why
+
+Before grantr, any user of a tenant could do anything in every workspace of that tenant. The libraries' `authorize` hook was asked when a workspace was opened, and never heard what the actor was about to do, so a viewer couldn't be kept from editing. A user had exactly one tenant, set in their token, and nothing stored members, groups or roles. [lattice RFC-0001](https://lattice.alexnodeland.com/rfcs/0001-grantr-identity-and-access/) designs access once, for every surface, and grantr is where its model is built.
+
+## What it does
+
+- **Check every command and read.** The libraries' hook hears the action, such as `artifactr:edit_artifact`, and asks grantr before each command and read, on every surface ([ADR-0001](https://lattice.alexnodeland.com/grantr/adr/0001-the-hook-hears-the-action/)).
+- **Grant down to threads and artifacts,** and hide a restricted one from everyone without a role on it ([ADR-0002](https://lattice.alexnodeland.com/grantr/adr/0002-grants-down-to-threads-and-artifacts/), [ADR-0003](https://lattice.alexnodeland.com/grantr/adr/0003-visible-to-the-workspace-unless-restricted/)).
+- **Act for a user.** An agent's turn is checked as the person whose message started it ([ADR-0004](https://lattice.alexnodeland.com/grantr/adr/0004-an-agent-turn-acts-for-its-user/)).
+- **Own membership.** A user's tenants come from grantr, and each request names its tenant ([ADR-0005](https://lattice.alexnodeland.com/grantr/adr/0005-a-users-tenants-from-grantrs-memberships/)).
+- **Built-in and custom roles, groups and service principals,** with keys shown once, and checks that deny by default ([ADR-0006](https://lattice.alexnodeland.com/grantr/adr/0006-what-v0-1-includes/)).
+- **An append-only audit log** of every change to access ([ADR-0007](https://lattice.alexnodeland.com/grantr/adr/0007-an-append-only-audit-log/)).
+- **Its own model, with OpenFGA-shaped ports,** in memory or in SQL ([ADR-0008](https://lattice.alexnodeland.com/grantr/adr/0008-grantrs-own-model-with-openfga-shaped-ports/)), and a deployment-wide `operator` role ([ADR-0009](https://lattice.alexnodeland.com/grantr/adr/0009-a-deployment-wide-operator-role/)).
+- **Row-level security under the libraries' scoping,** with PostgreSQL keeping each tenant's rows to that tenant ([ADR-0026](https://lattice.alexnodeland.com/grantr/adr/0026-row-level-security-under-the-scoping/)).
+
+## Quick start
+
+```python
+from artifactr.workspace import ACTIONS as ARTIFACTR
+from grantr import Grants, InMemoryStorage, Resource, User
+
+grants = Grants(InMemoryStorage(), catalogs=[ARTIFACTR])
+await grants.first_operator("root")
+await grants.create_tenant("acme", owner="alice", by=User(id="root"))
+await grants.add_member("acme", User(id="bob"), by=User(id="alice"))
+main = Resource(kind="workspace", workspace="main")
+await grants.grant("acme", "editor", on=main, to=User(id="bob"), by=User(id="alice"))
+assert await grants.check("acme", User(id="bob"), "artifactr:edit_artifact", main)
+```
+
+[Getting started](https://lattice.alexnodeland.com/grantr/getting-started/) goes on to the libraries' hooks, SQL storage and the admin API.
+
+## Documentation
+
+grantr's documentation is its section of lattice's site, at **<https://lattice.alexnodeland.com/grantr/>**, built from [`docs/grantr/`](https://github.com/alexnodeland/lattice/tree/main/docs/grantr).
+
+- [Getting started](https://lattice.alexnodeland.com/grantr/getting-started/), and the guides: roles and grants, restricted threads and artifacts, service principals and keys, row-level security, and the permission matrix.
+- [Architecture](https://lattice.alexnodeland.com/grantr/architecture/): the model, the checks, the commands and the storage port.
+- [Architecture decision records](https://lattice.alexnodeland.com/grantr/adr/): why each part is the way it is.
+- [RFCs](https://lattice.alexnodeland.com/grantr/rfcs/): the v0.1 plan, its phases and what each waits on.
+- [Identity and access](https://lattice.alexnodeland.com/rfcs/0001-grantr-identity-and-access/), lattice's RFC-0001: the design grantr builds.
+- [Brand](https://lattice.alexnodeland.com/grantr/assets/brand/): the mark and its colours.
+
+## Contributing
+
+See [CONTRIBUTING.md](https://github.com/alexnodeland/lattice/blob/main/CONTRIBUTING.md) for setup, the trunk-based workflow, and the RFC and ADR process.
+
+## License
+
+[MIT](https://github.com/alexnodeland/lattice/blob/main/packages/grantr/LICENSE)

grantr-0.1.0/pyproject.toml

@@ -0,0 +1,142 @@
+[project]
+name = "grantr"
+version = "0.1.0"
+description = "Identity and access for artifactr and reflexr: tenants, members, groups, roles, service principals and grants, checked before every command and read."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.12"
+keywords = [
+    "authorization",
+    "access-control",
+    "rbac",
+    "multi-tenant",
+    "agents",
+    "pydantic",
+]
+classifiers = [
+    "Development Status :: 2 - Pre-Alpha",
+    "Framework :: Pydantic :: 2",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries :: Application Frameworks",
+    "Typing :: Typed",
+]
+dependencies = [
+    "pydantic>=2.13",
+    "opentelemetry-api>=1.28",
+]
+
+[[project.authors]]
+name = "Alex Nodeland"
+email = "alex@ournature.studio"
+
+[project.optional-dependencies]
+sql = [
+    "lattice-core-ai[sql]>=0.1.0",
+    "sqlalchemy[asyncio]>=2.1",
+    "alembic>=1.20",
+]
+sqlite = [
+    "grantr[sql]",
+    "aiosqlite>=0.22",
+]
+postgres = [
+    "grantr[sql]",
+    "asyncpg>=0.31",
+]
+fastapi = [
+    "fastapi>=0.141",
+    "starlette>=0.46.0",
+]
+
+[project.urls]
+Homepage = "https://lattice.alexnodeland.com/grantr/"
+Documentation = "https://lattice.alexnodeland.com/grantr/"
+Repository = "https://github.com/alexnodeland/lattice"
+Issues = "https://github.com/alexnodeland/lattice/issues"
+Changelog = "https://github.com/alexnodeland/lattice/blob/main/packages/grantr/CHANGELOG.md"
+
+[dependency-groups]
+test = [
+    "pytest>=9.1",
+    "pytest-asyncio>=1.4",
+    "pytest-cov>=7.1",
+    "pytest-timeout>=2.4",
+    "httpx>=0.28",
+    "aiosqlite>=0.22",
+    "asyncpg>=0.31",
+    "opentelemetry-sdk>=1.28",
+    "hypothesis>=6.168",
+]
+lint = [
+    "ruff>=0.16",
+    "pyright>=1.1.414",
+]
+
+[[dependency-groups.dev]]
+include-group = "test"
+
+[[dependency-groups.dev]]
+include-group = "lint"
+
+[tool.uv.sources.lattice-core-ai]
+workspace = true
+
+[tool.deptry.package_module_name_map]
+lattice-core-ai = "lattice_core"
+
+[tool.pyright]
+include = [
+    "src",
+    "tests",
+]
+strict = ["src"]
+typeCheckingMode = "standard"
+pythonVersion = "3.12"
+venvPath = "../.."
+venv = ".venv"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = [
+    "--strict-markers",
+    "--strict-config",
+    "-ra",
+]
+timeout = 60
+timeout_method = "thread"
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "function"
+filterwarnings = ["error"]
+markers = ["postgres: needs a PostgreSQL database (set GRANTR_TEST_POSTGRES_URL)"]
+
+[tool.coverage.run]
+branch = true
+source = ["src/grantr"]
+concurrency = [
+    "greenlet",
+    "thread",
+]
+
+[tool.coverage.report]
+fail_under = 100
+show_missing = true
+skip_covered = true
+exclude_also = [
+    "if TYPE_CHECKING:",
+    "@overload",
+    'assert_never\(',
+    "raise NotImplementedError",
+    '^\s*\.\.\.$',
+    'class .*\(Protocol.*\):',
+]
+
+[build-system]
+requires = ["uv_build>=0.12,<0.13"]
+build-backend = "uv_build"

grantr-0.1.0/pyproject.toml.orig

@@ -0,0 +1,116 @@
+[project]
+name = "grantr"
+version = "0.1.0"
+description = "Identity and access for artifactr and reflexr: tenants, members, groups, roles, service principals and grants, checked before every command and read."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Alex Nodeland", email = "alex@ournature.studio" }]
+requires-python = ">=3.12"
+keywords = ["authorization", "access-control", "rbac", "multi-tenant", "agents", "pydantic"]
+classifiers = [
+    "Development Status :: 2 - Pre-Alpha",
+    "Framework :: Pydantic :: 2",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries :: Application Frameworks",
+    "Typing :: Typed",
+]
+dependencies = [
+    "pydantic>=2.13",
+    "opentelemetry-api>=1.28",
+]
+
+[project.optional-dependencies]
+sql = ["lattice-core-ai[sql]>=0.1.0", "sqlalchemy[asyncio]>=2.1", "alembic>=1.20"]
+sqlite = ["grantr[sql]", "aiosqlite>=0.22"]
+postgres = ["grantr[sql]", "asyncpg>=0.31"]
+fastapi = ["fastapi>=0.141", "starlette>=0.46.0"]
+
+[project.urls]
+Homepage = "https://lattice.alexnodeland.com/grantr/"
+Documentation = "https://lattice.alexnodeland.com/grantr/"
+Repository = "https://github.com/alexnodeland/lattice"
+Issues = "https://github.com/alexnodeland/lattice/issues"
+Changelog = "https://github.com/alexnodeland/lattice/blob/main/packages/grantr/CHANGELOG.md"
+
+[dependency-groups]
+test = [
+    "pytest>=9.1",
+    "pytest-asyncio>=1.4",
+    "pytest-cov>=7.1",
+    "pytest-timeout>=2.4",
+    "httpx>=0.28",
+    "aiosqlite>=0.22",
+    "asyncpg>=0.31",
+    "opentelemetry-sdk>=1.28",
+    "hypothesis>=6.168",
+]
+lint = ["ruff>=0.16", "pyright>=1.1.414"]
+dev = [
+    { include-group = "test" },
+    { include-group = "lint" },
+]
+
+# In lattice, lattice-core is the checkout's. A built wheel keeps the range in [project] alone.
+[tool.uv.sources]
+lattice-core-ai = { workspace = true }
+
+[build-system]
+requires = ["uv_build>=0.12,<0.13"]
+build-backend = "uv_build"
+
+# ─── dependencies ─────────────────────────────────────────────────────────────
+
+# deptry can't tell from the workspace's editable install which module lattice-core-ai provides.
+[tool.deptry.package_module_name_map]
+lattice-core-ai = "lattice_core"
+
+# ─── types ────────────────────────────────────────────────────────────────────
+
+[tool.pyright]
+include = ["src", "tests"]
+strict = ["src"]
+typeCheckingMode = "standard"
+pythonVersion = "3.12"
+venvPath = "../.."
+venv = ".venv"
+
+# ─── tests and coverage ───────────────────────────────────────────────────────
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = ["--strict-markers", "--strict-config", "-ra"]
+# A test that runs for a minute is stuck: fail it, with every thread's stack.
+timeout = 60
+timeout_method = "thread"
+asyncio_mode = "auto"
+asyncio_default_fixture_loop_scope = "function"
+filterwarnings = ["error"]
+markers = [
+    "postgres: needs a PostgreSQL database (set GRANTR_TEST_POSTGRES_URL)",
+]
+
+[tool.coverage.run]
+branch = true
+source = ["src/grantr"]
+# SQLAlchemy runs run_sync callables in a greenlet, which coverage follows only when told.
+concurrency = ["greenlet", "thread"]
+
+[tool.coverage.report]
+fail_under = 100
+show_missing = true
+skip_covered = true
+exclude_also = [
+    "if TYPE_CHECKING:",
+    "@overload",
+    "assert_never\\(",
+    "raise NotImplementedError",
+    "^\\s*\\.\\.\\.$",
+    "class .*\\(Protocol.*\\):",
+]

grantr-0.1.0/src/grantr/__init__.py

@@ -0,0 +1,84 @@
+"""grantr: identity and access for artifactr, reflexr and portalr.
+
+Tenants, their members, groups, roles and service principals, and the grants that bind them to
+tenants, workspaces, threads, artifacts and rules. The libraries ask it, through their own hooks,
+before every command and read; it imports neither library, and neither imports it.
+
+The model and its rules are in :mod:`grantr.core`, with no I/O; :class:`Grants` answers checks
+and changes access over a storage, such as :class:`InMemoryStorage`. The documentation, with its
+decisions and the plan that builds grantr, is at <https://lattice.alexnodeland.com/grantr/>.
+"""
+
+from importlib.metadata import version
+
+from grantr.core import (
+    DEPLOYMENT,
+    TENANT,
+    Agent,
+    AuditEntry,
+    AuditEvent,
+    AuditFilter,
+    AuditType,
+    BuiltInRole,
+    CatalogView,
+    Forbidden,
+    Grant,
+    Grantee,
+    GrantrError,
+    Group,
+    Invalid,
+    Member,
+    Membership,
+    Resource,
+    ResourceKind,
+    Role,
+    RulePrincipal,
+    ServicePrincipal,
+    Subject,
+    TenantId,
+    User,
+    UserId,
+    Visibility,
+    WorkspaceId,
+)
+from grantr.grants import Access, Grants, Hooks, InMemoryStorage, Storage, SubjectOf
+
+__version__ = version("grantr")
+
+__all__ = [
+    "DEPLOYMENT",
+    "TENANT",
+    "Access",
+    "Agent",
+    "AuditEntry",
+    "AuditEvent",
+    "AuditFilter",
+    "AuditType",
+    "BuiltInRole",
+    "CatalogView",
+    "Forbidden",
+    "Grant",
+    "Grantee",
+    "GrantrError",
+    "Grants",
+    "Group",
+    "Hooks",
+    "InMemoryStorage",
+    "Invalid",
+    "Member",
+    "Membership",
+    "Resource",
+    "ResourceKind",
+    "Role",
+    "RulePrincipal",
+    "ServicePrincipal",
+    "Storage",
+    "Subject",
+    "SubjectOf",
+    "TenantId",
+    "User",
+    "UserId",
+    "Visibility",
+    "WorkspaceId",
+    "__version__",
+]

grantr-0.1.0/src/grantr/core/__init__.py

@@ -0,0 +1,123 @@
+"""grantr's model, and the rules a check and a grant follow: no I/O, no async.
+
+:class:`~grantr.grants.Grants` loads what a decision needs from storage, and decides with these.
+"""
+
+from grantr.core.audit import (
+    AuditEntry,
+    AuditEvent,
+    AuditFilter,
+    AuditType,
+    DeploymentTenantCreated,
+    Granted,
+    GroupDefined,
+    GroupDeleted,
+    KeyIssued,
+    KeyRevoked,
+    MemberAdded,
+    MemberRemoved,
+    Restricted,
+    Revoked,
+    RoleDefined,
+    RoleDeleted,
+    TenantCreated,
+    TenantDeleted,
+    Unrestricted,
+)
+from grantr.core.errors import Forbidden, GrantrError, Invalid
+from grantr.core.grants import Grant, Membership, Visibility, memberships
+from grantr.core.ids import PRINCIPAL_ID, TENANT_ID, PrincipalId, TenantId, UserId, WorkspaceId
+from grantr.core.keys import Key, issue, key_id, verify
+from grantr.core.resources import (
+    DEPLOYMENT,
+    ITEMS,
+    TENANT,
+    ListableKind,
+    Resource,
+    ResourceKind,
+)
+from grantr.core.roles import (
+    APPLICATION,
+    BUILT_IN,
+    GRANTR_ACTIONS,
+    MEMBER,
+    OPERATOR,
+    BuiltInRole,
+    Catalog,
+    CatalogView,
+    Level,
+    Role,
+)
+from grantr.core.subjects import (
+    Agent,
+    Grantee,
+    Group,
+    Member,
+    RulePrincipal,
+    ServicePrincipal,
+    Subject,
+    User,
+)
+
+__all__ = [
+    "APPLICATION",
+    "BUILT_IN",
+    "DEPLOYMENT",
+    "GRANTR_ACTIONS",
+    "ITEMS",
+    "MEMBER",
+    "OPERATOR",
+    "PRINCIPAL_ID",
+    "TENANT",
+    "TENANT_ID",
+    "Agent",
+    "AuditEntry",
+    "AuditEvent",
+    "AuditFilter",
+    "AuditType",
+    "BuiltInRole",
+    "Catalog",
+    "CatalogView",
+    "DeploymentTenantCreated",
+    "Forbidden",
+    "Grant",
+    "Granted",
+    "Grantee",
+    "GrantrError",
+    "Group",
+    "GroupDefined",
+    "GroupDeleted",
+    "Invalid",
+    "Key",
+    "KeyIssued",
+    "KeyRevoked",
+    "Level",
+    "ListableKind",
+    "Member",
+    "MemberAdded",
+    "MemberRemoved",
+    "Membership",
+    "PrincipalId",
+    "Resource",
+    "ResourceKind",
+    "Restricted",
+    "Revoked",
+    "Role",
+    "RoleDefined",
+    "RoleDeleted",
+    "RulePrincipal",
+    "ServicePrincipal",
+    "Subject",
+    "TenantCreated",
+    "TenantDeleted",
+    "TenantId",
+    "Unrestricted",
+    "User",
+    "UserId",
+    "Visibility",
+    "WorkspaceId",
+    "issue",
+    "key_id",
+    "memberships",
+    "verify",
+]