accesstoken

const (
	// ResourceDaemon binds to one daemon id.
	ResourceDaemon ResourceKind = "daemon"
	// ResourcePort binds to one proxied port of one daemon. The id is
	// PortResourceID(daemonID, port).
	ResourcePort ResourceKind = "port"
	// ResourceConnector binds to one MCP connector grant id.
	ResourceConnector ResourceKind = "connector"
	// ResourceEnvironment binds to one environment id: a CI token that may
	// read one env's telemetry (obs:read), triage its issues (obs:triage) or
	// query its database (db:query), and no other env of the org.
	ResourceEnvironment ResourceKind = "environment"
)

const (
	// ScopeDeployRead reads the org's deploy state.
	ScopeDeployRead Scope = "deploy:read"
	// ScopeDeployWrite mutates it (releases, environments, publish,
	// promote). Implies deploy:read at the point of use.
	ScopeDeployWrite Scope = "deploy:write"

	// ScopeBillingRead reads the org's billing-backed cost and usage. It grants
	// no billing management rights and is not implied by deploy or telemetry
	// authority. Consumers must check the tenant and current grants at use.
	ScopeBillingRead Scope = "billing:read"

	// ScopeClusterManage registers, rotates and removes the org's BYO
	// clusters — the credentials the platform uses to reach infrastructure
	// the org owns. Its own product, not a deploy action: deploy:write moves
	// a release onto clusters the org already trusts, and must not be able
	// to change WHICH clusters those are. An org-admin authority.
	ScopeClusterManage Scope = "cluster:manage"

	// ScopeTokenRead lists the org's machine credentials — an inventory of
	// its automation, so a separate authority from deploy:read.
	ScopeTokenRead Scope = "token:read"
	// ScopeTokenWrite mints and revokes credentials, bounded by Covers: a
	// holder can never grant a scope it does not hold. Without this scope a
	// token cannot mint at all, which is the general form of "a PAT cannot
	// mint a PAT".
	ScopeTokenWrite Scope = "token:write"

	// ScopeReliantAPI acts as the token's acting user against the reliant
	// API — the CLI / automation credential. Requires an acting user.
	ScopeReliantAPI Scope = "reliant:api"

	// ScopeDaemonConnect authenticates a daemon's stream to the gateway.
	// When bound to a daemon resource it authenticates as that daemon only.
	ScopeDaemonConnect Scope = "daemon:connect"

	// ScopeLLMInvoke calls the LLM gateway, billed to the acting user.
	ScopeLLMInvoke Scope = "llm:invoke"

	// ScopeProxyPort reaches one proxied daemon port. Always bound to a
	// port resource: an unbound port credential would open every port.
	ScopeProxyPort Scope = "proxy:port"

	// ScopeMCPConnector is a third-party MCP client's credential, confined to
	// one connector grant. Always bound to a connector resource.
	ScopeMCPConnector Scope = "mcp:connector"

	// ScopeDaemonResume resolves and wakes ONE suspended daemon on its acting
	// user's behalf, so a run nobody is watching (a scheduled trigger) can
	// reach the machine it was told to run on. Always bound to that daemon
	// resource and always acting as a user: an unbound resume credential
	// could wake every machine the person owns, and the point of a trigger
	// naming its daemon is that it never needs to.
	//
	// Wake only. It cannot connect AS the daemon (daemon:connect), run
	// anything on it, or read anything from it; the worst a leaked one does
	// is start a machine its owner already pays for.
	ScopeDaemonResume Scope = "daemon:resume"

	// ScopeDaemonManage lists, starts, stops and resizes the daemons its
	// acting user owns, as the machine settings page does: a person's CLI
	// login managing their own machines. Always acting as a user, and never
	// bound to anything — in particular never to a daemon, so no daemon's
	// own credential (a daemon wildcard resolves through Grant.Admissible)
	// and nothing an agent running on a daemon holds can carry it. Starting
	// and resizing spend the person's money, which is why a machine must not
	// be able to do it for itself or its siblings.
	//
	// It implies nothing and nothing implies it: not daemon:resume (one
	// bound machine, wake only), not daemon:connect, not reliant:api. The
	// consumer still resolves ownership, plan and funding from the acting
	// user exactly as for the person's own session.
	ScopeDaemonManage Scope = "daemon:manage"

	// ScopeSecretRead lists the org's managed secrets' METADATA (names,
	// versions) for every environment, and — for LOCAL environments ONLY —
	// pulls their VALUES (LocalSecretService/PullSecrets), because a LOCAL
	// env's workloads run on the developer's machine (`forge env up`) and
	// need them there. A PERSISTENT environment's values are never readable
	// through a token: the platform materializes them into its workloads and
	// the pull path is structurally confined to local envs.
	ScopeSecretRead Scope = "secret:read"
	// ScopeSecretWrite sets and deletes managed secret values. Implies
	// secret:read at the point of use.
	ScopeSecretWrite Scope = "secret:write"

	// ScopeDomainRead lists the org's custom domains and their bindings.
	ScopeDomainRead Scope = "domain:read"
	// ScopeDomainWrite registers domains, requests certificates and binds
	// them to environments. Implies domain:read at the point of use.
	//
	// ITS OWN PRODUCT, NOT A DEPLOY ACTION. A domain is a PUBLIC IDENTITY
	// and a certificate is issued in the org's name; binding one repoints
	// live traffic. deploy:write moves a release onto hostnames the org
	// already owns, and must not be able to change which names those are —
	// the same separation cluster:manage has from deploy:write.
	ScopeDomainWrite Scope = "domain:write"

	// ScopeIdentityRead reads an environment's managed identity: its status
	// and the end users of its instance, with their roles.
	ScopeIdentityRead Scope = "identity:read"
	// ScopeIdentityManage administers those end users: invite, change roles,
	// lock, delete, end sessions, issue password-set codes, and export the
	// instance. Implies identity:read at the point of use.
	//
	// ITS OWN PRODUCT, NOT A DEPLOY ACTION. It acts on the PEOPLE who sign in
	// to the org's apps, not on the org's infrastructure: a code it issues
	// sets an end user's password. deploy:write ships a release and must not
	// be able to take over the accounts of the people who use it.
	ScopeIdentityManage Scope = "identity:manage"

	// ScopeObsRead reads an environment's telemetry and what is derived from
	// it: traces, logs, metrics, issues and release health. Org automation
	// tokens carry it so CI and agents can gate a deploy on `forge obs check`.
	ScopeObsRead Scope = "obs:read"
	// ScopeObsTriage changes an issue's triage state (resolve, ignore,
	// unresolve). Implies obs:read at the point of use.
	//
	// ITS OWN SCOPE, NOT A READ. A read-only automation token must not be
	// able to silence an alert, so triage is held explicitly even by a
	// holder that reads.
	ScopeObsTriage Scope = "obs:triage"
	// ScopeObsWrite authors the org's observability workspace: dashboards
	// (save, restore, archive, promote) and anything else a person edits in
	// the telemetry console. Implies obs:read at the point of use.
	//
	// ITS OWN SCOPE, NOT TRIAGE. obs:triage changes the state of an issue; this
	// changes shared, versioned artifacts the whole org reads. Neither implies
	// the other, so a token that silences alerts cannot rewrite dashboards and
	// the reverse. Never bound to an environment: what it writes is org-wide.
	ScopeObsWrite Scope = "obs:write"

	// ScopeDBQuery runs a read-only query against an environment's database.
	// Not implied by any other scope and implying none: the data in an
	// app's database is the app's users' data, a different class of authority
	// from the telemetry obs:read reads. A real environment's policy may
	// further restrict it to people (audited); the scope alone never opens
	// one.
	ScopeDBQuery Scope = "db:query"
)