@abloatai/transaction 0.38.0 → 0.40.0

package/dist/wire/auth.d.ts

@@ -34,7 +34,13 @@ export declare const ephemeralKeyRequestSchema: z.ZodObject<{
     schemaProjectId: z.ZodOptional<z.ZodString>;
     schemaOwnerOrgId: z.ZodOptional<z.ZodString>;
     syncGroups: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodUnion<readonly [z.ZodLiteral<"default">, z.core.$ZodBranded<z.ZodTemplateLiteral<`${string}:${string}`>, "SyncGroup", "out">]>>>>;
-    operations: z.ZodArray<z.ZodTemplateLiteral<`${string}.update` | `${string}.create` | `${string}.delete` | `${string}.read`>>;
+    operations: z.ZodOptional<z.ZodArray<z.ZodTemplateLiteral<`${string}.update` | `${string}.create` | `${string}.delete` | `${string}.read`>>>;
+    activeSchemaOperations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        update: "update";
+        create: "create";
+        delete: "delete";
+        read: "read";
+    }>>>;
     ttlSeconds: z.ZodOptional<z.ZodNumber>;
     label: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;

package/dist/wire/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/wire/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB;;;iBAGjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;iBAiCrC,CAAC;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;GAWG;AACH,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/wire/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,4CAA4C;AAC5C,eAAO,MAAM,sBAAsB;;;iBAGjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;iBA4DrC,CAAC;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;;;GAWG;AACH,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/wire/auth.js

@@ -10,7 +10,7 @@
  * `auth/schemas.ts`.
  */
 import { z } from 'zod';
-import { grantedOperationSchema } from '../auth/capability.js';
+import { capabilityOperationSchema, grantedOperationSchema } from '../auth/capability.js';
 import { syncGroupInputSchema } from '../coordination/schema.js';
 /** The participant this session acts as. */
 export const ephemeralKeyUserSchema = z.object({
@@ -44,8 +44,25 @@ export const ephemeralKeyRequestSchema = z.object({
     schemaOwnerOrgId: z.string().min(1).optional(),
     /** Narrow the session to these sync groups. */
     syncGroups: z.array(syncGroupInputSchema).readonly().optional(),
-    /** Required least-privilege allowlist. */
-    operations: z.array(grantedOperationSchema).min(1),
+    /**
+     * Least-privilege allowlist, named model by model. For a caller that knows
+     * the schema the session will resolve. Exactly one of this and
+     * {@link ephemeralKeyRequestSchema.shape.activeSchemaOperations} is required.
+     */
+    operations: z.array(grantedOperationSchema).min(1).optional(),
+    /**
+     * The same allowlist expressed as verbs alone, for a caller that CANNOT know
+     * the models: an identity service minting sessions for organizations whose
+     * schemas it does not own has no way to name them, and a grant is checked
+     * against the session's schema at mint time, so naming another schema's
+     * models fails every time.
+     *
+     * The server expands these across the models in the session's active schema
+     * and stores the concrete result, so what lands on the credential is the same
+     * enumerated allowlist as the field above. A verb is granted only where the
+     * model admits it — an immutable model takes `read` and nothing else.
+     */
+    activeSchemaOperations: z.array(capabilityOperationSchema).min(1).optional(),
     /** Lifetime in seconds. Capped by the server's maximum. */
     ttlSeconds: z.number().int().positive().optional(),
     /** A human-readable tag recorded with the key, for debugging. */
@@ -54,6 +71,12 @@ export const ephemeralKeyRequestSchema = z.object({
     (request.schemaOwnerOrgId === undefined), {
     message: 'schemaProjectId and schemaOwnerOrgId must be provided together',
     path: ['schemaProjectId'],
+}).refine((request) => (request.operations === undefined) !== (request.activeSchemaOperations === undefined), {
+    // Exactly one, never both and never neither. Neither would leave the
+    // credential with an empty allowlist, which reads as UNRESTRICTED at the
+    // gate rather than as nothing; both would leave two answers to one question.
+    message: 'provide either operations or activeSchemaOperations, not both',
+    path: ['operations'],
 });
 /**
  * The capability mint body lives with the rest of the capability vocabulary in

package/dist/wire/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/wire/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,4CAA4C;IAC5C,IAAI,EAAE,sBAAsB;IAC5B;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,+CAA+C;IAC/C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/D,0CAA0C;IAC1C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,2DAA2D;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,iEAAiE;IACjE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC,MAAM,CACP,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC;IACvC,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,EAC1C;IACE,OAAO,EACL,gEAAgE;IAClE,IAAI,EAAE,CAAC,iBAAiB,CAAC;CAC1B,CACF,CAAC;AAGF;;;;;;;;;;;GAWG;AACH,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/wire/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,4CAA4C;IAC5C,IAAI,EAAE,sBAAsB;IAC5B;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C;;;;OAIG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,+CAA+C;IAC/C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/D;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7D;;;;;;;;;;;OAWG;IACH,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5E,2DAA2D;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,iEAAiE;IACjE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC,MAAM,CACP,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC;IACvC,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,EAC1C;IACE,OAAO,EACL,gEAAgE;IAClE,IAAI,EAAE,CAAC,iBAAiB,CAAC;CAC1B,CACF,CAAC,MAAM,CACN,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,KAAK,SAAS,CAAC,EACvF;IACE,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;IAC7E,OAAO,EAAE,+DAA+D;IACxE,IAAI,EAAE,CAAC,YAAY,CAAC;CACrB,CACF,CAAC;AAGF;;;;;;;;;;;GAWG;AACH,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC"}