//#region src/auth/authz/types.ts
/**
* Client-safe authz types and constants.
* These can be safely imported in client-side code without any Node.js dependencies.
*/
/**
* SpiceDB resource types used in the schema
*/
const SpiceDbResourceTypes = {
	USER: "user",
	ORGANIZATION: "organization",
	PROJECT: "project",
	APP: "app",
	CREDENTIAL_REFERENCE: "credential_reference"
};
/**
* SpiceDB relations used in the schema
*
* Relations are named as nouns (roles) per SpiceDB best practices.
* Project roles are prefixed for clarity when debugging/grepping.
*/
const SpiceDbRelations = {
	OWNER: "owner",
	ADMIN: "admin",
	MEMBER: "member",
	ORGANIZATION: "organization",
	PROJECT_ADMIN: "project_admin",
	PROJECT_MEMBER: "project_member",
	PROJECT_VIEWER: "project_viewer",
	APP_READER: "app_reader"
};
/**
* SpiceDB permissions for organization resources.
*
* From schema.zed definition organization:
* - view: owner + admin + member
* - manage: owner + admin (includes managing org settings and all projects)
*/
const SpiceDbOrgPermissions = {
	VIEW: "view",
	MANAGE: "manage"
};
/**
* SpiceDB permissions for project resources.
*
* From schema.zed definition project:
* - view: read-only access to project and its resources
* - use: invoke agents, create API keys, view traces
* - edit: modify configurations, manage members
*/
const SpiceDbProjectPermissions = {
	VIEW: "view",
	USE: "use",
	EDIT: "edit"
};
const SpiceDbCredentialReferencePermissions = { READ: "read" };
/**
* Organization roles from SpiceDB schema.
*/
const OrgRoles = {
	OWNER: "owner",
	ADMIN: "admin",
	MEMBER: "member"
};
/**
* Project roles from SpiceDB schema.
*
* Hierarchy:
* - project_admin: Full access (view + use + edit + manage members)
* - project_member: Operator access (view + use: invoke agents, create API keys)
* - project_viewer: Read-only access (view only)
*/
const ProjectRoles = {
	ADMIN: "project_admin",
	MEMBER: "project_member",
	VIEWER: "project_viewer"
};

//#endregion
export { OrgRoles, ProjectRoles, SpiceDbCredentialReferencePermissions, SpiceDbOrgPermissions, SpiceDbProjectPermissions, SpiceDbRelations, SpiceDbResourceTypes };