@innovatorstack/harness 0.0.0-stage → 0.1.0

package/dist/platform/revisions/sequences.js

@@ -0,0 +1,38 @@
+import { PlatformError } from "../errors.js";
+const sequenceCharactersMax = 1024 * 1024;
+const sequenceValuesMax = 100_000;
+/** Resolve the exported sequence; the baseline supplies the native ItemType default. */
+export class RevisionSequences {
+    storage;
+    constructor(storage) {
+        this.storage = storage;
+    }
+    resolve(definition) {
+        const metadata = this.storage.getCatalogEntry("ItemType", definition.id);
+        let id = metadata?.properties.revisions;
+        if (id === undefined) {
+            id = this.storage
+                .getItemType("ItemType")
+                ?.properties.find((property) => property.name === "revisions")?.defaultValue;
+        }
+        if (id === undefined || id === null || id === "") {
+            return undefined;
+        }
+        const entry = typeof id === "string" ? this.storage.getCatalogEntry("Revision", id) : undefined;
+        if (!entry) {
+            throw new PlatformError("MissingRevisionSequence", `Import the Revision referenced by '${definition.name}.revisions'.`, definition.source ? { source: definition.source } : undefined);
+        }
+        const text = entry.properties.revision;
+        if (typeof text !== "string" || text.length > sequenceCharactersMax) {
+            throw new PlatformError("InvalidRevisionSequence", `Revision '${entry.id}' needs a bounded whitespace-separated sequence.`, { source: entry.source });
+        }
+        const values = text.trim().split(/\s+/u);
+        if (!values[0] ||
+            values.length > sequenceValuesMax ||
+            new Set(values).size !== values.length) {
+            throw new PlatformError("InvalidRevisionSequence", `Revision '${entry.id}' needs a nonempty sequence without duplicate values.`, { source: entry.source });
+        }
+        return { entry, values };
+    }
+}
+//# sourceMappingURL=sequences.js.map

package/dist/platform/revisions/sequences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sequences.js","sourceRoot":"","sources":["../../../src/platform/revisions/sequences.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAOlC,wFAAwF;AACxF,MAAM,OAAO,iBAAiB;IACG,OAAO;IAApC,YAA6B,OAAuB;uBAAvB,OAAO;IAAmB,CAAC;IAExD,OAAO,CAAC,UAA8B;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,IAAI,EAAE,GAAG,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC;QAExC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACnB,EAAE,GAAG,IAAI,CAAC,OAAO;iBACZ,WAAW,CAAC,UAAU,CAAC;gBACxB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,YAAY,CAAC;QACrF,CAAC;QAED,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/C,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,MAAM,KAAK,GACP,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtF,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,aAAa,CACnB,yBAAyB,EACzB,sCAAsC,UAAU,CAAC,IAAI,cAAc,EACnE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAChE,CAAC;QACN,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAEvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YAClE,MAAM,IAAI,aAAa,CACnB,yBAAyB,EACzB,aAAa,KAAK,CAAC,EAAE,kDAAkD,EACvE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAC3B,CAAC;QACN,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEzC,IACI,CAAC,MAAM,CAAC,CAAC,CAAC;YACV,MAAM,CAAC,MAAM,GAAG,iBAAiB;YACjC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EACxC,CAAC;YACC,MAAM,IAAI,aAAa,CACnB,yBAAyB,EACzB,aAAa,KAAK,CAAC,EAAE,uDAAuD,EAC5E,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAC3B,CAAC;QACN,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC7B,CAAC;CACJ"}

package/dist/platform/security/grants.d.ts

@@ -0,0 +1,14 @@
+import type { ExecutionContext } from "../../core/types.js";
+import type { MethodSecurity } from "../../methods/types.js";
+import type { PlatformTrace } from "../trace.js";
+import type { Identities } from "./identities.js";
+export declare class IdentityGrants {
+    private readonly identities;
+    private readonly trace;
+    private readonly requests;
+    constructor(identities: Identities, trace: PlatformTrace);
+    current(context: ExecutionContext): readonly string[];
+    scope(context: ExecutionContext): MethodSecurity & Disposable;
+    private grant;
+}
+//# sourceMappingURL=grants.d.ts.map

package/dist/platform/security/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../../src/platform/security/grants.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,qBAAa,cAAc;IAInB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAJ1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;IAEnE,YACqB,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,aAAa,EACrC;IAEJ,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,MAAM,EAAE,CAKpD;IAED,KAAK,CAAC,OAAO,EAAE,gBAAgB,GAAG,cAAc,GAAG,UAAU,CAsD5D;IAED,OAAO,CAAC,KAAK;CAoChB"}

package/dist/platform/security/grants.js

@@ -0,0 +1,83 @@
+import { assertActiveContext } from "../../core/context.js";
+import { requestOperationsMax } from "../../core/limits.js";
+import { PlatformError } from "../errors.js";
+export class IdentityGrants {
+    identities;
+    trace;
+    requests = new Map();
+    constructor(identities, trace) {
+        this.identities = identities;
+        this.trace = trace;
+    }
+    current(context) {
+        assertActiveContext(context);
+        const grants = this.requests.get(context.requestId);
+        return this.identities.current(grants?.values() ?? [], context);
+    }
+    scope(context) {
+        const owned = new Set();
+        let closed = false;
+        let issued = 0;
+        const active = () => {
+            assertActiveContext(context);
+            if (closed) {
+                throw new PlatformError("ExpiredSecurityScope", "The Method identity scope has completed.");
+            }
+        };
+        return {
+            getIdentities: () => {
+                active();
+                return this.current(context);
+            },
+            getIdentityByName: (name) => {
+                active();
+                return this.identities.byName(name, context);
+            },
+            grantIdentity: (id) => {
+                active();
+                if (++issued > requestOperationsMax) {
+                    throw new PlatformError("ProtocolLimit", "Identity grants exceed their invocation budget.");
+                }
+                const grant = this.grant(id, context);
+                owned.add(grant);
+                return grant;
+            },
+            [Symbol.dispose]: () => {
+                closed = true;
+                for (const grant of owned) {
+                    grant[Symbol.dispose]();
+                }
+                owned.clear();
+            },
+        };
+    }
+    grant(id, context) {
+        this.identities.user();
+        const identity = this.identities.byId(id);
+        const grants = this.requests.get(context.requestId) ?? new Map();
+        if (grants.size >= requestOperationsMax) {
+            throw new PlatformError("ProtocolLimit", "Identity grants exceed their request budget.");
+        }
+        const token = Symbol(identity.id);
+        grants.set(token, identity.id);
+        this.requests.set(context.requestId, grants);
+        this.trace.record(context, {
+            kind: "authorization",
+            name: `Grant Identity '${identity.name}'`,
+        });
+        let active = true;
+        return {
+            [Symbol.dispose]: () => {
+                if (!active) {
+                    return;
+                }
+                active = false;
+                grants.delete(token);
+                if (grants.size === 0 && this.requests.get(context.requestId) === grants) {
+                    this.requests.delete(context.requestId);
+                }
+            },
+        };
+    }
+}
+//# sourceMappingURL=grants.js.map

package/dist/platform/security/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../../src/platform/security/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7C,MAAM,OAAO,cAAc;IAIF,UAAU;IACV,KAAK;IAJT,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAEnE,YACqB,UAAsB,EACtB,KAAoB;0BADpB,UAAU;qBACV,KAAK;IACvB,CAAC;IAEJ,OAAO,CAAC,OAAyB;QAC7B,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEpD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,OAAyB;QAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAc,CAAC;QACpC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,MAAM,MAAM,GAAG,GAAG,EAAE;YAChB,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAE7B,IAAI,MAAM,EAAE,CAAC;gBACT,MAAM,IAAI,aAAa,CACnB,sBAAsB,EACtB,0CAA0C,CAC7C,CAAC;YACN,CAAC;QACL,CAAC,CAAC;QAEF,OAAO;YACH,aAAa,EAAE,GAAG,EAAE;gBAChB,MAAM,EAAE,CAAC;gBAET,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC;YAED,iBAAiB,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,MAAM,EAAE,CAAC;gBAET,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACjD,CAAC;YAED,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE;gBAClB,MAAM,EAAE,CAAC;gBAET,IAAI,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAAC;oBAClC,MAAM,IAAI,aAAa,CACnB,eAAe,EACf,iDAAiD,CACpD,CAAC;gBACN,CAAC;gBAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBACtC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAEjB,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE;gBACnB,MAAM,GAAG,IAAI,CAAC;gBAEd,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;oBACxB,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,CAAC;gBAED,KAAK,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC;SACJ,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,EAAU,EAAE,OAAyB;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAkB,CAAC;QAEjF,IAAI,MAAM,CAAC,IAAI,IAAI,oBAAoB,EAAE,CAAC;YACtC,MAAM,IAAI,aAAa,CACnB,eAAe,EACf,8CAA8C,CACjD,CAAC;QACN,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE;YACvB,IAAI,EAAE,eAAe;YACrB,IAAI,EAAE,mBAAmB,QAAQ,CAAC,IAAI,GAAG;SAC5C,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,IAAI,CAAC;QAElB,OAAO;YACH,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,MAAM,EAAE,CAAC;oBACV,OAAO;gBACX,CAAC;gBAED,MAAM,GAAG,KAAK,CAAC;gBACf,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAErB,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,MAAM,EAAE,CAAC;oBACvE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC5C,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;CACJ"}

package/dist/platform/security/identities.d.ts

@@ -0,0 +1,16 @@
+import type { ExecutionContext } from "../../core/types.js";
+import type { MethodIdentity } from "../../methods/types.js";
+import type { HarnessStorage, StoredItem } from "../../storage/types.js";
+export declare class Identities {
+    private readonly storage;
+    private readonly userId;
+    private readonly now;
+    constructor(storage: HarnessStorage, userId: (() => string) | undefined, now: () => Date);
+    user(): StoredItem;
+    byName(name: string, context: ExecutionContext): MethodIdentity | undefined;
+    byId(id: string): MethodIdentity;
+    current(granted: Iterable<string>, context: ExecutionContext): readonly string[];
+    private expand;
+    private describe;
+}
+//# sourceMappingURL=identities.d.ts.map

package/dist/platform/security/identities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identities.d.ts","sourceRoot":"","sources":["../../../src/platform/security/identities.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAKzE,qBAAa,UAAU;IAEf,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHxB,YACqB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,EAClC,GAAG,EAAE,MAAM,IAAI,EAChC;IAEJ,IAAI,IAAI,UAAU,CAYjB;IAED,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,cAAc,GAAG,SAAS,CAc1E;IAED,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,CAQ/B;IAED,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gBAAgB,GAAG,SAAS,MAAM,EAAE,CA0B/E;IAED,OAAO,CAAC,MAAM;IA0Cd,OAAO,CAAC,QAAQ;CASnB"}

package/dist/platform/security/identities.js

@@ -0,0 +1,99 @@
+import { spendContext } from "../../core/context.js";
+import { dataNodesMax } from "../../core/limits.js";
+import { PlatformError } from "../errors.js";
+import { systemIdentityId } from "./system-identities.js";
+import { effective } from "./time.js";
+export class Identities {
+    storage;
+    userId;
+    now;
+    constructor(storage, userId, now) {
+        this.storage = storage;
+        this.userId = userId;
+        this.now = now;
+    }
+    user() {
+        const id = this.userId?.();
+        const user = id ? this.storage.getItem("User", id) : undefined;
+        if (!user) {
+            throw new PlatformError("SessionRequired", "Native identity checks require an imported User session.");
+        }
+        return user;
+    }
+    byName(name, context) {
+        const identities = this.storage.listItems("Identity");
+        spendContext(context, identities.length);
+        const records = identities.filter((record) => String(record.properties.name).toLowerCase() === name.toLowerCase());
+        if (records.length > 1) {
+            throw new PlatformError("AmbiguousIdentity", `Identity '${name}' is not unique.`);
+        }
+        const record = records[0];
+        return record ? this.describe(record) : undefined;
+    }
+    byId(id) {
+        const record = this.storage.getItem("Identity", id);
+        if (!record) {
+            throw new PlatformError("MissingIdentity", `Import Identity '${id}' before using it.`);
+        }
+        return this.describe(record);
+    }
+    current(granted, context) {
+        const user = this.user();
+        const worldId = systemIdentityId("World");
+        const world = worldId ? this.byId(worldId) : undefined;
+        if (!world) {
+            throw new PlatformError("MissingIdentity", "The World Identity is required.");
+        }
+        const ids = new Map([[world.id.toLowerCase(), world.id]]);
+        for (const alias of this.storage.listItems("Alias")) {
+            spendContext(context);
+            if (String(alias.properties.source_id).toLowerCase() === user.id.toLowerCase()) {
+                const identity = this.byId(String(alias.properties.related_id));
+                ids.set(identity.id.toLowerCase(), identity.id);
+            }
+        }
+        for (const id of granted) {
+            const identity = this.byId(id);
+            ids.set(identity.id.toLowerCase(), identity.id);
+        }
+        return this.expand(ids, context);
+    }
+    expand(ids, context) {
+        const parents = new Map();
+        for (const member of this.storage.listItems("Member")) {
+            spendContext(context);
+            if (effective(member, this.now())) {
+                const child = String(member.properties.related_id).toLowerCase();
+                const values = parents.get(child) ?? [];
+                values.push(String(member.properties.source_id));
+                parents.set(child, values);
+            }
+        }
+        const pending = [...ids.values()];
+        let visited = 0;
+        while (pending.length > 0) {
+            const id = pending.pop();
+            if (!id || ++visited > dataNodesMax) {
+                throw new PlatformError("ProtocolLimit", "Identity membership exceeds its graph budget.");
+            }
+            for (const parent of parents.get(id.toLowerCase()) ?? []) {
+                spendContext(context);
+                const identity = this.byId(parent);
+                const key = identity.id.toLowerCase();
+                if (!ids.has(key)) {
+                    ids.set(key, identity.id);
+                    pending.push(identity.id);
+                }
+            }
+        }
+        return [...ids.values()].sort((left, right) => left.localeCompare(right));
+    }
+    describe(record) {
+        const name = record.properties.name;
+        if (typeof name !== "string" || name.length === 0) {
+            throw new PlatformError("InvalidIdentity", `Identity '${record.id}' needs a name.`);
+        }
+        return Object.freeze({ id: record.id, name });
+    }
+}
+//# sourceMappingURL=identities.js.map

package/dist/platform/security/identities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identities.js","sourceRoot":"","sources":["../../../src/platform/security/identities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAIpD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,OAAO,UAAU;IAEE,OAAO;IACP,MAAM;IACN,GAAG;IAHxB,YACqB,OAAuB,EACvB,MAAkC,EAClC,GAAe;uBAFf,OAAO;sBACP,MAAM;mBACN,GAAG;IACrB,CAAC;IAEJ,IAAI;QACA,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,aAAa,CACnB,iBAAiB,EACjB,0DAA0D,CAC7D,CAAC;QACN,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,CAAC,IAAY,EAAE,OAAyB;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtD,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAC7B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAClF,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,aAAa,CAAC,mBAAmB,EAAE,aAAa,IAAI,kBAAkB,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAE1B,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,EAAU;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAEpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,CAAC,OAAyB,EAAE,OAAyB;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAE1E,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,YAAY,CAAC,OAAO,CAAC,CAAC;YAEtB,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;gBAChE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACpD,CAAC;QACL,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/B,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAEO,MAAM,CAAC,GAAwB,EAAE,OAAyB;QAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAE5C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,YAAY,CAAC,OAAO,CAAC,CAAC;YAEtB,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;gBACjE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;gBACjD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/B,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAClC,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAEzB,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,GAAG,YAAY,EAAE,CAAC;gBAClC,MAAM,IAAI,aAAa,CACnB,eAAe,EACf,+CAA+C,CAClD,CAAC;YACN,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;gBACvD,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;gBAEtC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAC1B,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC9B,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEO,QAAQ,CAAC,MAAkB;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;QAEpC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,aAAa,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACxF,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;CACJ"}

package/dist/platform/security/inherited-relationships.d.ts

@@ -0,0 +1,15 @@
+import type { ExecutionContext } from "../../core/types.js";
+import type { HarnessStorage, StoredItem } from "../../storage/types.js";
+import type { SourceAccess } from "./source-access.js";
+/** Ownership is stable during synchronous ACL propagation; index each relevant table once. */
+export declare class InheritedRelationships {
+    private readonly storage;
+    private readonly context;
+    private readonly types;
+    private readonly records;
+    private indexed;
+    constructor(storage: HarnessStorage, sources: SourceAccess, context: ExecutionContext);
+    children(parent: StoredItem): Generator<StoredItem, void, void>;
+    private bySource;
+}
+//# sourceMappingURL=inherited-relationships.d.ts.map

package/dist/platform/security/inherited-relationships.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inherited-relationships.d.ts","sourceRoot":"","sources":["../../../src/platform/security/inherited-relationships.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAsB,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE7F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,8FAA8F;AAC9F,qBAAa,sBAAsB;IAM3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA2C;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiE;IACzF,OAAO,CAAC,OAAO,CAAK;IAEpB,YACqB,OAAO,EAAE,cAAc,EACxC,OAAO,EAAE,YAAY,EACJ,OAAO,EAAE,gBAAgB,EAgB7C;IAEA,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CA8B/D;IAED,OAAO,CAAC,QAAQ;CAoCnB"}

package/dist/platform/security/inherited-relationships.js

@@ -0,0 +1,70 @@
+import { spendContext } from "../../core/context.js";
+import { dataNodesMax } from "../../core/limits.js";
+import { PlatformError } from "../errors.js";
+/** Ownership is stable during synchronous ACL propagation; index each relevant table once. */
+export class InheritedRelationships {
+    storage;
+    context;
+    types = new Map();
+    records = new Map();
+    indexed = 0;
+    constructor(storage, sources, context) {
+        this.storage = storage;
+        this.context = context;
+        for (const definition of storage.listItemTypes()) {
+            spendContext(context, definition.properties.length + 1);
+            if (!definition.isRelationship || !sources.inherited(definition)) {
+                continue;
+            }
+            const source = definition.properties.find((property) => property.name === "source_id");
+            const sourceType = source?.dataType === "item" ? (source.dataSource?.toLowerCase() ?? "") : "";
+            const siblings = this.types.get(sourceType) ?? [];
+            siblings.push(definition);
+            this.types.set(sourceType, siblings);
+        }
+    }
+    *children(parent) {
+        const owner = this.storage.getItemType(parent.type);
+        if (!owner) {
+            throw new PlatformError("MissingItemType", `Permission source '${parent.type}' has no schema.`);
+        }
+        const types = [
+            ...(this.types.get(owner.id.toLowerCase()) ?? []),
+            ...(this.types.get("") ?? []),
+        ];
+        for (const definition of types) {
+            spendContext(this.context);
+            const records = this.bySource(definition).get(parent.id.toLowerCase()) ?? [];
+            const source = definition.properties.find((property) => property.name === "source_id");
+            if (records.length > 0 && (source?.dataType !== "item" || !source.dataSource)) {
+                throw new PlatformError("UnsupportedSourceAccess", `Propagating permissions to '${definition.name}' requires for_all source-type resolution.`, definition.source ? { source: definition.source } : undefined);
+            }
+            yield* records;
+        }
+    }
+    bySource(definition) {
+        const cached = this.records.get(definition.id);
+        if (cached) {
+            return cached;
+        }
+        const index = new Map();
+        for (const record of this.storage.listItems(definition.name)) {
+            spendContext(this.context);
+            this.indexed += 1;
+            if (this.indexed > dataNodesMax) {
+                throw new PlatformError("ProtocolLimit", "Inherited permissions exceed their ownership index limit.");
+            }
+            const source = record.properties.source_id;
+            if (typeof source !== "string" || !source) {
+                continue;
+            }
+            const key = source.toLowerCase();
+            const siblings = index.get(key) ?? [];
+            siblings.push(record);
+            index.set(key, siblings);
+        }
+        this.records.set(definition.id, index);
+        return index;
+    }
+}
+//# sourceMappingURL=inherited-relationships.js.map

package/dist/platform/security/inherited-relationships.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inherited-relationships.js","sourceRoot":"","sources":["../../../src/platform/security/inherited-relationships.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,8FAA8F;AAC9F,MAAM,OAAO,sBAAsB;IAMV,OAAO;IAEP,OAAO;IAPX,KAAK,GAAG,IAAI,GAAG,EAAgC,CAAC;IAChD,OAAO,GAAG,IAAI,GAAG,EAAsD,CAAC;IACjF,OAAO,GAAG,CAAC,CAAC;IAEpB,YACqB,OAAuB,EACxC,OAAqB,EACJ,OAAyB;uBAFzB,OAAO;uBAEP,OAAO;QAExB,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;YAC/C,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAExD,IAAI,CAAC,UAAU,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/D,SAAS;YACb,CAAC;YAED,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;YACvF,MAAM,UAAU,GACZ,MAAM,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;IACL,CAAC;IAED,CAAC,QAAQ,CAAC,MAAkB;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,aAAa,CACnB,iBAAiB,EACjB,sBAAsB,MAAM,CAAC,IAAI,kBAAkB,CACtD,CAAC;QACN,CAAC;QAED,MAAM,KAAK,GAAG;YACV,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;YACjD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;SAChC,CAAC;QAEF,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;YAEvF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,aAAa,CACnB,yBAAyB,EACzB,+BAA+B,UAAU,CAAC,IAAI,4CAA4C,EAC1F,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAChE,CAAC;YACN,CAAC;YAED,KAAK,CAAC,CAAC,OAAO,CAAC;QACnB,CAAC;IACL,CAAC;IAEO,QAAQ,CAAC,UAA8B;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAE/C,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,MAAM,CAAC;QAClB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;QAE9C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3B,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YAElB,IAAI,IAAI,CAAC,OAAO,GAAG,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,aAAa,CACnB,eAAe,EACf,2DAA2D,CAC9D,CAAC;YACN,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;YAE3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACxC,SAAS;YACb,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAEvC,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ"}

package/dist/platform/security/method-execution.d.ts

@@ -0,0 +1,12 @@
+import type { ExecutionContext } from "../../core/types.js";
+interface MethodExecutionScope extends Disposable {
+    readonly checkExecutionIdentity: boolean;
+}
+/** Native NoCheck follows a bound Method's call chain without adding an Identity grant. */
+export declare class MethodExecutionScopes {
+    private roots;
+    enter(context: ExecutionContext, platformBound: boolean): MethodExecutionScope;
+    reset(): void;
+}
+export {};
+//# sourceMappingURL=method-execution.d.ts.map

package/dist/platform/security/method-execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-execution.d.ts","sourceRoot":"","sources":["../../../src/platform/security/method-execution.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,UAAU,oBAAqB,SAAQ,UAAU;IAC7C,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC5C;AAED,2FAA2F;AAC3F,qBAAa,qBAAqB;IAC9B,OAAO,CAAC,KAAK,CAAmC;IAEhD,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,GAAG,oBAAoB,CAiB7E;IAED,KAAK,IAAI,IAAI,CAEZ;CACJ"}

package/dist/platform/security/method-execution.js

@@ -0,0 +1,24 @@
+import { assertActiveContext, hasContextAncestor } from "../../core/context.js";
+/** Native NoCheck follows a bound Method's call chain without adding an Identity grant. */
+export class MethodExecutionScopes {
+    roots = new WeakSet();
+    enter(context, platformBound) {
+        assertActiveContext(context);
+        const inherited = hasContextAncestor(context, (ancestor) => this.roots.has(ancestor));
+        if (platformBound) {
+            this.roots.add(context);
+        }
+        return {
+            checkExecutionIdentity: !platformBound && !inherited,
+            [Symbol.dispose]: () => {
+                if (platformBound) {
+                    this.roots.delete(context);
+                }
+            },
+        };
+    }
+    reset() {
+        this.roots = new WeakSet();
+    }
+}
+//# sourceMappingURL=method-execution.js.map

package/dist/platform/security/method-execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-execution.js","sourceRoot":"","sources":["../../../src/platform/security/method-execution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAOhF,2FAA2F;AAC3F,MAAM,OAAO,qBAAqB;IACtB,KAAK,GAAG,IAAI,OAAO,EAAoB,CAAC;IAEhD,KAAK,CAAC,OAAyB,EAAE,aAAsB;QACnD,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEtF,IAAI,aAAa,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO;YACH,sBAAsB,EAAE,CAAC,aAAa,IAAI,CAAC,SAAS;YAEpD,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE;gBACnB,IAAI,aAAa,EAAE,CAAC;oBAChB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC/B,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IAED,KAAK;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,EAAE,CAAC;IAC/B,CAAC;CACJ"}

package/dist/platform/security/permissions.d.ts

@@ -0,0 +1,34 @@
+import type { ExecutionContext } from "../../core/types.js";
+import type { HarnessStorage, ItemTypeDefinition, StorageValue, StoredItem } from "../../storage/types.js";
+import type { Classifications } from "../classifications.js";
+import type { IdentityGrants } from "./grants.js";
+import type { Identities } from "./identities.js";
+export declare enum AccessRight {
+    Get = "can_get",
+    Update = "can_update",
+    Delete = "can_delete",
+    ChangeAccess = "can_change_access"
+}
+export declare class ItemPermissions {
+    private readonly storage;
+    private readonly identities;
+    private readonly grants;
+    private readonly now;
+    private readonly classifications;
+    private readonly sources;
+    constructor(storage: HarnessStorage, identities: Identities, grants: IdentityGrants, now: () => Date, classifications: Classifications);
+    readable(definition: ItemTypeDefinition, records: readonly StoredItem[], context: ExecutionContext): readonly StoredItem[];
+    assert(definition: ItemTypeDefinition, record: StoredItem, right: AccessRight, context: ExecutionContext): void;
+    creation(definition: ItemTypeDefinition, values: Readonly<Record<string, StorageValue>>, context: ExecutionContext): Readonly<Record<string, StorageValue>>;
+    sourceProperties(definition: ItemTypeDefinition, record: StoredItem, context: ExecutionContext): Readonly<Record<string, StorageValue>>;
+    assertCanReclassify(definition: ItemTypeDefinition, classification: string, context: ExecutionContext): void;
+    private assertCanAdd;
+    private actor;
+    private allowed;
+    private permissionId;
+    private matches;
+    assertIdentity(id: string, record: StoredItem, context: ExecutionContext): void;
+    assertSelectedPermission(definition: ItemTypeDefinition, id: string, context: ExecutionContext, state?: StorageValue): void;
+    private defaultPermission;
+}
+//# sourceMappingURL=permissions.d.ts.map

package/dist/platform/security/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/platform/security/permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,KAAK,EACR,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAOlD,oBAAY,WAAW;IACnB,GAAG,YAAY;IACf,MAAM,eAAe;IACrB,MAAM,eAAe;IACrB,YAAY,sBAAsB;CACrC;AAQD,qBAAa,eAAe;IAIpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAPpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IAEvC,YACqB,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,MAAM,IAAI,EACf,eAAe,EAAE,eAAe,EAGpD;IAED,QAAQ,CACJ,UAAU,EAAE,kBAAkB,EAC9B,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,OAAO,EAAE,gBAAgB,GAC1B,SAAS,UAAU,EAAE,CAOvB;IAED,MAAM,CACF,UAAU,EAAE,kBAAkB,EAC9B,MAAM,EAAE,UAAU,EAClB,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,gBAAgB,GAC1B,IAAI,CASN;IAED,QAAQ,CACJ,UAAU,EAAE,kBAAkB,EAC9B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,EAC9C,OAAO,EAAE,gBAAgB,GAC1B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAwCxC;IAED,gBAAgB,CACZ,UAAU,EAAE,kBAAkB,EAC9B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,gBAAgB,GAC1B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAKxC;IAED,mBAAmB,CACf,UAAU,EAAE,kBAAkB,EAC9B,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,gBAAgB,GAC1B,IAAI,CAIN;IAED,OAAO,CAAC,YAAY;IAmCpB,OAAO,CAAC,KAAK;IAUb,OAAO,CAAC,OAAO;IAqCf,OAAO,CAAC,YAAY;IAiBpB,OAAO,CAAC,OAAO;IAyBf,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAS9E;IAED,wBAAwB,CACpB,UAAU,EAAE,kBAAkB,EAC9B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,gBAAgB,EACzB,KAAK,CAAC,EAAE,YAAY,GACrB,IAAI,CAgCN;IAED,OAAO,CAAC,iBAAiB;CAqB5B"}