@innovatorstack/harness 0.0.0-stage → 0.1.0

package/dist/platform/security/permissions.js

@@ -0,0 +1,188 @@
+import { spendContext } from "../../core/context.js";
+import { Item } from "../../items/item.js";
+import { ApplicationError, PlatformError } from "../errors.js";
+import { SourceAccess } from "./source-access.js";
+import { inheritedSecurity } from "./source-inheritance.js";
+import { systemIdentity } from "./system-identities.js";
+import { TeamRoles } from "./teams.js";
+import { effective } from "./time.js";
+export var AccessRight;
+(function (AccessRight) {
+    AccessRight["Get"] = "can_get";
+    AccessRight["Update"] = "can_update";
+    AccessRight["Delete"] = "can_delete";
+    AccessRight["ChangeAccess"] = "can_change_access";
+})(AccessRight || (AccessRight = {}));
+export class ItemPermissions {
+    storage;
+    identities;
+    grants;
+    now;
+    classifications;
+    sources;
+    constructor(storage, identities, grants, now, classifications) {
+        this.storage = storage;
+        this.identities = identities;
+        this.grants = grants;
+        this.now = now;
+        this.classifications = classifications;
+        this.sources = new SourceAccess(storage);
+    }
+    readable(definition, records, context) {
+        const actor = this.actor(context);
+        this.sources.inherited(definition);
+        return records.filter((record) => this.allowed(definition, record, AccessRight.Get, actor, context));
+    }
+    assert(definition, record, right, context) {
+        if (!this.allowed(definition, record, right, this.actor(context), context)) {
+            throw new ApplicationError(Item.error(`Permission denied for '${definition.name}:${record.id}' (${right}).`, "PermissionDenied"));
+        }
+    }
+    creation(definition, values, context) {
+        const actor = this.actor(context);
+        const audit = { created_by_id: actor.user.id, created_on: this.now().toISOString() };
+        const classification = String(values.classification ?? "");
+        if (this.sources.inherited(definition)) {
+            if (!this.classifications.paths(definition, context).has(classification)) {
+                throw new ApplicationError(Item.error(`Cannot add unknown class '${classification}' on '${definition.name}'.`, "PermissionDenied"));
+            }
+            const source = this.sources.owner(definition, values, context);
+            this.assert(source.definition, source.record, AccessRight.Update, context);
+            return {
+                ...this.sourceProperties(source.definition, source.record, context),
+                ...audit,
+            };
+        }
+        this.assertCanAdd(definition, classification, actor, context);
+        const permission = values.permission_id ?? this.defaultPermission(definition, context);
+        if (typeof permission !== "string" || !this.storage.getItem("Permission", permission)) {
+            throw new PlatformError("MissingPermission", `Import a default Permission for '${definition.name}'.`);
+        }
+        this.assertSelectedPermission(definition, permission, context, values.current_state);
+        return {
+            permission_id: permission,
+            ...audit,
+        };
+    }
+    sourceProperties(definition, record, context) {
+        return {
+            ...inheritedSecurity(record),
+            permission_id: this.permissionId(definition, record, context),
+        };
+    }
+    assertCanReclassify(definition, classification, context) {
+        if (!this.sources.inherited(definition)) {
+            this.assertCanAdd(definition, classification, this.actor(context), context);
+        }
+    }
+    assertCanAdd(definition, classification, actor, context) {
+        const paths = this.classifications.paths(definition, context);
+        const rules = this.storage.listItems("Can Add");
+        spendContext(context, rules.length);
+        const permitted = paths.has(classification) &&
+            rules.some((record) => {
+                const enabled = record.properties.can_add;
+                const path = String(record.properties.class_path ?? "");
+                return ((enabled === undefined || String(enabled) === "1") &&
+                    String(record.properties.source_id).toLowerCase() ===
+                        definition.id.toLowerCase() &&
+                    paths.has(path) &&
+                    (path === "" ||
+                        classification === path ||
+                        classification.startsWith(`${path}/`)) &&
+                    effective(record, this.now()) &&
+                    actor.identities.has(String(record.properties.related_id).toLowerCase()));
+            });
+        if (!permitted) {
+            throw new ApplicationError(Item.error(`Cannot add '${definition.name}' for this User.`, "PermissionDenied"));
+        }
+    }
+    actor(context) {
+        const identities = new Set(this.grants.current(context).map((id) => id.toLowerCase()));
+        return {
+            user: this.identities.user(),
+            identities,
+            teams: new TeamRoles(this.storage, identities, context),
+        };
+    }
+    allowed(definition, record, right, actor, context) {
+        spendContext(context);
+        const inherited = this.sources.inherited(definition);
+        if (inherited) {
+            this.sources.resolve(definition, record, context);
+        }
+        const required = inherited && right === AccessRight.Delete ? AccessRight.Update : right;
+        const id = this.permissionId(definition, record, context);
+        for (const access of this.storage.listItems("Access")) {
+            spendContext(context);
+            if (String(access.properties[required] ?? "0") !== "1" ||
+                String(access.properties.source_id).toLowerCase() !== id.toLowerCase() ||
+                !effective(access, this.now()) ||
+                !this.matches(String(access.properties.related_id), record, actor)) {
+                continue;
+            }
+            return true;
+        }
+        return false;
+    }
+    permissionId(definition, record, context) {
+        const id = record.properties.permission_id ?? this.defaultPermission(definition, context);
+        if (typeof id !== "string" || !this.storage.getItem("Permission", id)) {
+            throw new PlatformError("MissingPermission", `Import Permission metadata for '${record.type}:${record.id}'.`);
+        }
+        return id;
+    }
+    matches(id, record, actor) {
+        if (actor.identities.has(id.toLowerCase())) {
+            return true;
+        }
+        this.identities.byId(id);
+        if (systemIdentity(id, "Creator")) {
+            return (actor.user.id.toLowerCase() ===
+                String(record.properties.created_by_id).toLowerCase());
+        }
+        if (systemIdentity(id, "Owner")) {
+            return actor.identities.has(String(record.properties.owned_by_id).toLowerCase());
+        }
+        if (systemIdentity(id, "Manager")) {
+            return actor.identities.has(String(record.properties.managed_by_id).toLowerCase());
+        }
+        return actor.teams.matches(id, record);
+    }
+    assertIdentity(id, record, context) {
+        if (!this.matches(id, record, this.actor(context))) {
+            throw new ApplicationError(Item.error(`Identity does not permit the transition of '${record.type}'.`, "PermissionDenied"));
+        }
+    }
+    assertSelectedPermission(definition, id, context, state) {
+        const selected = this.storage.getItem("Permission", id);
+        const lifecycle = typeof state === "string"
+            ? this.storage.getCatalogEntry("Life Cycle State", state)
+            : undefined;
+        const rules = this.storage.listItems("Allowed Permission");
+        spendContext(context, rules.length);
+        const allowed = rules.some((record) => String(record.properties.source_id).toLowerCase() === definition.id.toLowerCase() &&
+            String(record.properties.related_id).toLowerCase() === id.toLowerCase());
+        const metadata = this.storage.getCatalogEntry("ItemType", definition.id);
+        const privateAllowed = String(selected?.properties.is_private ?? "0") === "1" &&
+            String(metadata?.properties.allow_private_permission ?? "1") === "1";
+        if (!selected ||
+            (!allowed &&
+                !privateAllowed &&
+                String(lifecycle?.properties.state_permission_id).toLowerCase() !==
+                    id.toLowerCase())) {
+            throw new ApplicationError(Item.error(`Permission '${id}' is not allowed for '${definition.name}'.`, "PermissionDenied"));
+        }
+    }
+    defaultPermission(definition, context) {
+        const rules = this.storage.listItems("Allowed Permission");
+        spendContext(context, rules.length);
+        const candidates = rules.filter((record) => String(record.properties.source_id).toLowerCase() === definition.id.toLowerCase() &&
+            String(record.properties.is_default ?? "0") === "1");
+        if (candidates.length > 1) {
+            throw new PlatformError("AmbiguousPermission", `ItemType '${definition.name}' has multiple default Permissions.`);
+        }
+        return candidates[0]?.properties.related_id;
+    }
+}
+//# sourceMappingURL=permissions.js.map

package/dist/platform/security/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/platform/security/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAQ3C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG/D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,CAAN,IAAY,WAKX;AALD,WAAY,WAAW;IACnB,8BAAe,CAAA;IACf,oCAAqB,CAAA;IACrB,oCAAqB,CAAA;IACrB,iDAAkC,CAAA;AACtC,CAAC,EALW,WAAW,KAAX,WAAW,QAKtB;AAQD,MAAM,OAAO,eAAe;IAIH,OAAO;IACP,UAAU;IACV,MAAM;IACN,GAAG;IACH,eAAe;IAPnB,OAAO,CAAe;IAEvC,YACqB,OAAuB,EACvB,UAAsB,EACtB,MAAsB,EACtB,GAAe,EACf,eAAgC;uBAJhC,OAAO;0BACP,UAAU;sBACV,MAAM;mBACN,GAAG;+BACH,eAAe;QAEhC,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,QAAQ,CACJ,UAA8B,EAC9B,OAA8B,EAC9B,OAAyB;QAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAEnC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7B,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CACpE,CAAC;IACN,CAAC;IAED,MAAM,CACF,UAA8B,EAC9B,MAAkB,EAClB,KAAkB,EAClB,OAAyB;QAEzB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,gBAAgB,CACtB,IAAI,CAAC,KAAK,CACN,0BAA0B,UAAU,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,EACrE,kBAAkB,CACrB,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED,QAAQ,CACJ,UAA8B,EAC9B,MAA8C,EAC9C,OAAyB;QAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,EAAE,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACrF,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAE3D,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,gBAAgB,CACtB,IAAI,CAAC,KAAK,CACN,6BAA6B,cAAc,SAAS,UAAU,CAAC,IAAI,IAAI,EACvE,kBAAkB,CACrB,CACJ,CAAC;YACN,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAE3E,OAAO;gBACH,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBACnE,GAAG,KAAK;aACX,CAAC;QACN,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAEvF,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,aAAa,CACnB,mBAAmB,EACnB,oCAAoC,UAAU,CAAC,IAAI,IAAI,CAC1D,CAAC;QACN,CAAC;QAED,IAAI,CAAC,wBAAwB,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAErF,OAAO;YACH,aAAa,EAAE,UAAU;YACzB,GAAG,KAAK;SACX,CAAC;IACN,CAAC;IAED,gBAAgB,CACZ,UAA8B,EAC9B,MAAkB,EAClB,OAAyB;QAEzB,OAAO;YACH,GAAG,iBAAiB,CAAC,MAAM,CAAC;YAC5B,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;SAChE,CAAC;IACN,CAAC;IAED,mBAAmB,CACf,UAA8B,EAC9B,cAAsB,EACtB,OAAyB;QAEzB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QAChF,CAAC;IACL,CAAC;IAEO,YAAY,CAChB,UAA8B,EAC9B,cAAsB,EACtB,KAAY,EACZ,OAAyB;QAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAChD,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,SAAS,GACX,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBAClB,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;gBAExD,OAAO,CACH,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC;oBAClD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;wBAC7C,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE;oBAC/B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;oBACf,CAAC,IAAI,KAAK,EAAE;wBACR,cAAc,KAAK,IAAI;wBACvB,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;oBAC1C,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC7B,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAC3E,CAAC;YACN,CAAC,CAAC,CAAC;QAEP,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CACtB,IAAI,CAAC,KAAK,CAAC,eAAe,UAAU,CAAC,IAAI,kBAAkB,EAAE,kBAAkB,CAAC,CACnF,CAAC;QACN,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,OAAyB;QACnC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAEvF,OAAO;YACH,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;YAC5B,UAAU;YACV,KAAK,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC;SAC1D,CAAC;IACN,CAAC;IAEO,OAAO,CACX,UAA8B,EAC9B,MAAkB,EAClB,KAAkB,EAClB,KAAY,EACZ,OAAyB;QAEzB,YAAY,CAAC,OAAO,CAAC,CAAC;QAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAErD,IAAI,SAAS,EAAE,CAAC;YACZ,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,IAAI,KAAK,KAAK,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAExF,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAE1D,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,YAAY,CAAC,OAAO,CAAC,CAAC;YAEtB,IACI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG;gBAClD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;gBACtE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC9B,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EACpE,CAAC;gBACC,SAAS;YACb,CAAC;YAED,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,YAAY,CAChB,UAA8B,EAC9B,MAAkB,EAClB,OAAyB;QAEzB,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,aAAa,IAAI,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAE1F,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,aAAa,CACnB,mBAAmB,EACnB,mCAAmC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,IAAI,CAClE,CAAC;QACN,CAAC;QAED,OAAO,EAAE,CAAC;IACd,CAAC;IAEO,OAAO,CAAC,EAAU,EAAE,MAAkB,EAAE,KAAY;QACxD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEzB,IAAI,cAAc,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,CACH,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;gBAC3B,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CACxD,CAAC;QACN,CAAC;QAED,IAAI,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,cAAc,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,EAAU,EAAE,MAAkB,EAAE,OAAyB;QACpE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,gBAAgB,CACtB,IAAI,CAAC,KAAK,CACN,+CAA+C,MAAM,CAAC,IAAI,IAAI,EAC9D,kBAAkB,CACrB,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED,wBAAwB,CACpB,UAA8B,EAC9B,EAAU,EACV,OAAyB,EACzB,KAAoB;QAEpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,SAAS,GACX,OAAO,KAAK,KAAK,QAAQ;YACrB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,kBAAkB,EAAE,KAAK,CAAC;YACzD,CAAC,CAAC,SAAS,CAAC;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC3D,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACtB,CAAC,MAAM,EAAE,EAAE,CACP,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE;YACjF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,CAC9E,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACzE,MAAM,cAAc,GAChB,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,KAAK,GAAG;YACtD,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,wBAAwB,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC;QAEzE,IACI,CAAC,QAAQ;YACT,CAAC,CAAC,OAAO;gBACL,CAAC,cAAc;gBACf,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC,WAAW,EAAE;oBAC3D,EAAE,CAAC,WAAW,EAAE,CAAC,EAC3B,CAAC;YACC,MAAM,IAAI,gBAAgB,CACtB,IAAI,CAAC,KAAK,CACN,eAAe,EAAE,yBAAyB,UAAU,CAAC,IAAI,IAAI,EAC7D,kBAAkB,CACrB,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAEO,iBAAiB,CACrB,UAA8B,EAC9B,OAAyB;QAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC3D,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAC3B,CAAC,MAAM,EAAE,EAAE,CACP,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE;YACjF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,KAAK,GAAG,CAC1D,CAAC;QAEF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,aAAa,CACnB,qBAAqB,EACrB,aAAa,UAAU,CAAC,IAAI,qCAAqC,CACpE,CAAC;QACN,CAAC;QAED,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC;IAChD,CAAC;CACJ"}

package/dist/platform/security/policy.d.ts

@@ -0,0 +1,39 @@
+import type { ExecutionContext } from "../../core/types.js";
+import { Item } from "../../items/item.js";
+import type { HarnessStorage, CatalogEntry, ItemTypeDefinition, StorageValue, StoredItem } from "../../storage/types.js";
+import type { Classifications } from "../classifications.js";
+import type { PlatformTrace } from "../trace.js";
+import { IdentityGrants } from "./grants.js";
+import { MethodExecutionScopes } from "./method-execution.js";
+import { ItemPermissions } from "./permissions.js";
+import type { AuthorizationPolicy, AuthorizationRequest } from "./types.js";
+export declare class NativeSecurity {
+    private readonly storage;
+    private readonly mode;
+    private readonly now;
+    readonly methods: MethodExecutionScopes;
+    readonly grants: IdentityGrants;
+    readonly permissions: ItemPermissions;
+    private readonly identities;
+    private readonly inheritance;
+    private readonly sources;
+    private readonly ownedDeletes;
+    constructor(storage: HarnessStorage, mode: AuthorizationPolicy | undefined, userId: (() => string) | undefined, now: () => Date, trace: PlatformTrace, classifications: Classifications);
+    get enabled(): boolean;
+    reset(): void;
+    authorize(request: AuthorizationRequest, context: ExecutionContext): void;
+    authorizeMethodSession(context: ExecutionContext): void;
+    readable(definition: ItemTypeDefinition, records: readonly StoredItem[], context: ExecutionContext): readonly StoredItem[];
+    assertMutation(definition: ItemTypeDefinition, record: StoredItem, action: string, context: ExecutionContext): void;
+    deletingOwned(record: StoredItem, context: ExecutionContext, apply: () => Promise<Item>): Promise<Item>;
+    private ownsDeletion;
+    creation(definition: ItemTypeDefinition, values: Readonly<Record<string, StorageValue>>, context: ExecutionContext): Readonly<Record<string, StorageValue>>;
+    assertCanReclassify(definition: ItemTypeDefinition, classification: string, context: ExecutionContext): void;
+    assertAccessChange(definition: ItemTypeDefinition, record: StoredItem, changes: Readonly<Record<string, StorageValue>>, context: ExecutionContext, classificationChanged?: boolean): void;
+    assertPermissionChange(definition: ItemTypeDefinition, record: StoredItem, context: ExecutionContext): void;
+    changed(before: StoredItem, after: StoredItem, context: ExecutionContext): void;
+    copied(definition: ItemTypeDefinition, values: Readonly<Record<string, StorageValue>>, context: ExecutionContext): Readonly<Record<string, StorageValue>>;
+    transition(transition: CatalogEntry, record: StoredItem, context: ExecutionContext): void;
+    auditedChanges(record: StoredItem, changes: Record<string, StorageValue>): Record<string, StorageValue>;
+}
+//# sourceMappingURL=policy.d.ts.map

package/dist/platform/security/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/platform/security/policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,EACR,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAe,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAM5E,qBAAa,cAAc;IAUnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAErB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAZxB,QAAQ,CAAC,OAAO,wBAA+B;IAC/C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoC;IAEjE,YACqB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,mBAAmB,GAAG,SAAS,EACtD,MAAM,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,EACjB,GAAG,EAAE,MAAM,IAAI,EAChC,KAAK,EAAE,aAAa,EACpB,eAAe,EAAE,eAAe,EAanC;IAED,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,KAAK,IAAI,IAAI,CAGZ;IAED,SAAS,CAAC,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAmCxE;IAED,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAGtD;IAED,QAAQ,CACJ,UAAU,EAAE,kBAAkB,EAC9B,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,OAAO,EAAE,gBAAgB,yBAO5B;IAED,cAAc,CACV,UAAU,EAAE,kBAAkB,EAC9B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gBAAgB,GAC1B,IAAI,CAYN;IAEK,aAAa,CACf,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAC3B,OAAO,CAAC,IAAI,CAAC,CAYf;IAED,OAAO,CAAC,YAAY;IAMpB,QAAQ,CACJ,UAAU,EAAE,kBAAkB,EAC9B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,EAC9C,OAAO,EAAE,gBAAgB,0CAG5B;IAED,mBAAmB,CACf,UAAU,EAAE,kBAAkB,EAC9B,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,gBAAgB,GAC1B,IAAI,CAIN;IAED,kBAAkB,CACd,UAAU,EAAE,kBAAkB,EAC9B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,EAC/C,OAAO,EAAE,gBAAgB,EACzB,qBAAqB,UAAQ,GAC9B,IAAI,CAgCN;IAED,sBAAsB,CAClB,UAAU,EAAE,kBAAkB,EAC9B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,gBAAgB,GAC1B,IAAI,CAIN;IAED,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAI9E;IAED,MAAM,CACF,UAAU,EAAE,kBAAkB,EAC9B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,EAC9C,OAAO,EAAE,gBAAgB,GAC1B,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAQxC;IAED,UAAU,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAMxF;IAED,cAAc,CACV,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GACtC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAsB9B;CACJ"}

package/dist/platform/security/policy.js

@@ -0,0 +1,168 @@
+import { assertActiveContext } from "../../core/context.js";
+import { Item } from "../../items/item.js";
+import { ApplicationError, PlatformError } from "../errors.js";
+import { recordKey } from "../references/catalog.js";
+import { IdentityGrants } from "./grants.js";
+import { Identities } from "./identities.js";
+import { MethodExecutionScopes } from "./method-execution.js";
+import { AccessRight, ItemPermissions } from "./permissions.js";
+import { SourceAccess } from "./source-access.js";
+import { SourceInheritance } from "./source-inheritance.js";
+import { AuthorizationMode } from "./types.js";
+export class NativeSecurity {
+    storage;
+    mode;
+    now;
+    methods = new MethodExecutionScopes();
+    grants;
+    permissions;
+    identities;
+    inheritance;
+    sources;
+    ownedDeletes = new Map();
+    constructor(storage, mode, userId, now, trace, classifications) {
+        this.storage = storage;
+        this.mode = mode;
+        this.now = now;
+        this.identities = new Identities(storage, userId, now);
+        this.grants = new IdentityGrants(this.identities, trace);
+        this.permissions = new ItemPermissions(storage, this.identities, this.grants, now, classifications);
+        this.sources = new SourceAccess(storage);
+        this.inheritance = new SourceInheritance(storage, this.sources, trace, this.permissions);
+    }
+    get enabled() {
+        return this.mode === AuthorizationMode.Native;
+    }
+    reset() {
+        this.ownedDeletes.clear();
+        this.methods.reset();
+    }
+    authorize(request, context) {
+        assertActiveContext(context);
+        this.identities.user();
+        if (request.kind === "action") {
+            return;
+        }
+        let identity;
+        if (request.kind === "method") {
+            const method = this.storage
+                .listCatalogEntries("Method")
+                .find((entry) => String(entry.properties.name).toLowerCase() === request.name.toLowerCase());
+            identity = method?.properties.execution_allowed_to;
+        }
+        else {
+            identity = this.storage.getCatalogEntry("Life Cycle Transition", request.name)
+                ?.properties.role;
+        }
+        if (identity !== undefined &&
+            identity !== null &&
+            identity !== "" &&
+            !this.grants
+                .current(context)
+                .some((id) => id.toLowerCase() === String(identity).toLowerCase())) {
+            throw new ApplicationError(Item.error(`Identity does not permit '${request.name}'.`, "PermissionDenied"));
+        }
+    }
+    authorizeMethodSession(context) {
+        assertActiveContext(context);
+        this.identities.user();
+    }
+    readable(definition, records, context) {
+        if (records.length > 0 && records.every((record) => this.ownsDeletion(record, context))) {
+            return records;
+        }
+        return this.enabled ? this.permissions.readable(definition, records, context) : records;
+    }
+    assertMutation(definition, record, action, context) {
+        // Unlock checks persisted lock ownership, including after an ACL or state change.
+        if (!this.enabled ||
+            action === "unlock" ||
+            (action === "delete" && this.ownsDeletion(record, context))) {
+            return;
+        }
+        const right = action === "delete" ? AccessRight.Delete : AccessRight.Update;
+        this.permissions.assert(definition, record, right, context);
+    }
+    async deletingOwned(record, context, apply) {
+        assertActiveContext(context);
+        const scope = { recordKey: recordKey(record) };
+        this.ownedDeletes.set(context.executionId, scope);
+        try {
+            return await apply();
+        }
+        finally {
+            if (this.ownedDeletes.get(context.executionId) === scope) {
+                this.ownedDeletes.delete(context.executionId);
+            }
+        }
+    }
+    ownsDeletion(record, context) {
+        return (this.ownedDeletes.get(context.parentExecutionId ?? "")?.recordKey === recordKey(record));
+    }
+    creation(definition, values, context) {
+        return this.enabled ? this.permissions.creation(definition, values, context) : {};
+    }
+    assertCanReclassify(definition, classification, context) {
+        if (this.enabled) {
+            this.permissions.assertCanReclassify(definition, classification, context);
+        }
+    }
+    assertAccessChange(definition, record, changes, context, classificationChanged = false) {
+        if (this.enabled &&
+            changes.source_id !== undefined &&
+            String(changes.source_id).toLowerCase() !==
+                String(record.properties.source_id).toLowerCase() &&
+            this.sources.inherited(definition)) {
+            throw new PlatformError("UnsupportedSourceAccessMove", "Moving an inherited relationship to another source requires its own permission policy.", definition.source ? { source: definition.source } : undefined);
+        }
+        if (this.enabled &&
+            changes.permission_id !== undefined &&
+            String(changes.permission_id).toLowerCase() !==
+                String(record.properties.permission_id).toLowerCase()) {
+            if (!classificationChanged) {
+                this.assertPermissionChange(definition, record, context);
+            }
+            this.permissions.assertSelectedPermission(definition, String(changes.permission_id), context, record.properties.current_state);
+        }
+    }
+    assertPermissionChange(definition, record, context) {
+        if (this.enabled) {
+            this.permissions.assert(definition, record, AccessRight.ChangeAccess, context);
+        }
+    }
+    changed(before, after, context) {
+        if (this.enabled) {
+            this.inheritance.changed(before, after, context);
+        }
+    }
+    copied(definition, values, context) {
+        if (!this.enabled || !this.sources.inherited(definition)) {
+            return {};
+        }
+        const source = this.sources.owner(definition, values, context);
+        return this.permissions.sourceProperties(source.definition, source.record, context);
+    }
+    transition(transition, record, context) {
+        const role = transition.properties.role;
+        if (role !== undefined && role !== null && role !== "") {
+            this.permissions.assertIdentity(String(role), record, context);
+        }
+    }
+    auditedChanges(record, changes) {
+        if (!this.enabled) {
+            return changes;
+        }
+        for (const property of ["created_by_id", "created_on"]) {
+            if (changes[property] !== undefined &&
+                changes[property] !== record.properties[property]) {
+                throw new PlatformError("ManagedProperty", `Cannot change '${property}' on an existing Item.`);
+            }
+        }
+        return {
+            ...changes,
+            modified_by_id: this.identities.user().id,
+            modified_on: this.now().toISOString(),
+        };
+    }
+}
+//# sourceMappingURL=policy.js.map

package/dist/platform/security/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/platform/security/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAS3C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAO/C,MAAM,OAAO,cAAc;IAUF,OAAO;IACP,IAAI;IAEJ,GAAG;IAZf,OAAO,GAAG,IAAI,qBAAqB,EAAE,CAAC;IACtC,MAAM,CAAiB;IACvB,WAAW,CAAkB;IACrB,UAAU,CAAa;IACvB,WAAW,CAAoB;IAC/B,OAAO,CAAe;IACtB,YAAY,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEjE,YACqB,OAAuB,EACvB,IAAqC,EACtD,MAAkC,EACjB,GAAe,EAChC,KAAoB,EACpB,eAAgC;uBALf,OAAO;oBACP,IAAI;mBAEJ,GAAG;QAIpB,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,GAAG,IAAI,eAAe,CAClC,OAAO,EACP,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,MAAM,EACX,GAAG,EACH,eAAe,CAClB,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,IAAI,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,IAAI,KAAK,iBAAiB,CAAC,MAAM,CAAC;IAClD,CAAC;IAED,KAAK;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAED,SAAS,CAAC,OAA6B,EAAE,OAAyB;QAC9D,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAEvB,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO;QACX,CAAC;QAED,IAAI,QAAkC,CAAC;QAEvC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO;iBACtB,kBAAkB,CAAC,QAAQ,CAAC;iBAC5B,IAAI,CACD,CAAC,KAAK,EAAE,EAAE,CACN,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CACjF,CAAC;YACN,QAAQ,GAAG,MAAM,EAAE,UAAU,CAAC,oBAAoB,CAAC;QACvD,CAAC;aAAM,CAAC;YACJ,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,uBAAuB,EAAE,OAAO,CAAC,IAAI,CAAC;gBAC1E,EAAE,UAAU,CAAC,IAAI,CAAC;QAC1B,CAAC;QAED,IACI,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,IAAI;YACjB,QAAQ,KAAK,EAAE;YACf,CAAC,IAAI,CAAC,MAAM;iBACP,OAAO,CAAC,OAAO,CAAC;iBAChB,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,EACxE,CAAC;YACC,MAAM,IAAI,gBAAgB,CACtB,IAAI,CAAC,KAAK,CAAC,6BAA6B,OAAO,CAAC,IAAI,IAAI,EAAE,kBAAkB,CAAC,CAChF,CAAC;QACN,CAAC;IACL,CAAC;IAED,sBAAsB,CAAC,OAAyB;QAC5C,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,QAAQ,CACJ,UAA8B,EAC9B,OAA8B,EAC9B,OAAyB;QAEzB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACtF,OAAO,OAAO,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5F,CAAC;IAED,cAAc,CACV,UAA8B,EAC9B,MAAkB,EAClB,MAAc,EACd,OAAyB;QAEzB,kFAAkF;QAClF,IACI,CAAC,IAAI,CAAC,OAAO;YACb,MAAM,KAAK,QAAQ;YACnB,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC7D,CAAC;YACC,OAAO;QACX,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;QAC5E,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,aAAa,CACf,MAAkB,EAClB,OAAyB,EACzB,KAA0B;QAE1B,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAElD,IAAI,CAAC;YACD,OAAO,MAAM,KAAK,EAAE,CAAC;QACzB,CAAC;gBAAS,CAAC;YACP,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,KAAK,EAAE,CAAC;gBACvD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAClD,CAAC;QACL,CAAC;IACL,CAAC;IAEO,YAAY,CAAC,MAAkB,EAAE,OAAyB;QAC9D,OAAO,CACH,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,SAAS,KAAK,SAAS,CAAC,MAAM,CAAC,CAC1F,CAAC;IACN,CAAC;IAED,QAAQ,CACJ,UAA8B,EAC9B,MAA8C,EAC9C,OAAyB;QAEzB,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,CAAC;IAED,mBAAmB,CACf,UAA8B,EAC9B,cAAsB,EACtB,OAAyB;QAEzB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;QAC9E,CAAC;IACL,CAAC;IAED,kBAAkB,CACd,UAA8B,EAC9B,MAAkB,EAClB,OAA+C,EAC/C,OAAyB,EACzB,qBAAqB,GAAG,KAAK;QAE7B,IACI,IAAI,CAAC,OAAO;YACZ,OAAO,CAAC,SAAS,KAAK,SAAS;YAC/B,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;gBACnC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;YACrD,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,EACpC,CAAC;YACC,MAAM,IAAI,aAAa,CACnB,6BAA6B,EAC7B,wFAAwF,EACxF,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAChE,CAAC;QACN,CAAC;QAED,IACI,IAAI,CAAC,OAAO;YACZ,OAAO,CAAC,aAAa,KAAK,SAAS;YACnC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE;gBACvC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,EAC3D,CAAC;YACC,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACzB,IAAI,CAAC,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7D,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,wBAAwB,CACrC,UAAU,EACV,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAC7B,OAAO,EACP,MAAM,CAAC,UAAU,CAAC,aAAa,CAClC,CAAC;QACN,CAAC;IACL,CAAC;IAED,sBAAsB,CAClB,UAA8B,EAC9B,MAAkB,EAClB,OAAyB;QAEzB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnF,CAAC;IACL,CAAC;IAED,OAAO,CAAC,MAAkB,EAAE,KAAiB,EAAE,OAAyB;QACpE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;IACL,CAAC;IAED,MAAM,CACF,UAA8B,EAC9B,MAA8C,EAC9C,OAAyB;QAEzB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAE/D,OAAO,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;IAED,UAAU,CAAC,UAAwB,EAAE,MAAkB,EAAE,OAAyB;QAC9E,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAExC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACrD,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACnE,CAAC;IACL,CAAC;IAED,cAAc,CACV,MAAkB,EAClB,OAAqC;QAErC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC;QACnB,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,CAAC;YACrD,IACI,OAAO,CAAC,QAAQ,CAAC,KAAK,SAAS;gBAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EACnD,CAAC;gBACC,MAAM,IAAI,aAAa,CACnB,iBAAiB,EACjB,kBAAkB,QAAQ,wBAAwB,CACrD,CAAC;YACN,CAAC;QACL,CAAC;QAED,OAAO;YACH,GAAG,OAAO;YACV,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE;YACzC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACxC,CAAC;IACN,CAAC;CACJ"}

package/dist/platform/security/source-access.d.ts

@@ -0,0 +1,19 @@
+import type { ExecutionContext } from "../../core/types.js";
+import type { HarnessStorage, ItemTypeDefinition, StorageValue, StoredItem } from "../../storage/types.js";
+interface PermissionSource {
+    readonly definition: ItemTypeDefinition;
+    readonly record: StoredItem;
+}
+/** Static preflight and runtime actions enforce the same metadata contract. */
+export declare function sourceAccessEnabled(definition: Pick<ItemTypeDefinition, "name" | "isRelationship" | "source">, value: StorageValue | undefined): boolean;
+/** Resolve stored source generations without invoking business get hooks. */
+export declare class SourceAccess {
+    private readonly storage;
+    private readonly types;
+    constructor(storage: HarnessStorage);
+    inherited(definition: ItemTypeDefinition): boolean;
+    resolve(definition: ItemTypeDefinition, record: StoredItem, context: ExecutionContext): PermissionSource;
+    owner(relationship: ItemTypeDefinition, values: Readonly<Record<string, StorageValue>>, context: ExecutionContext): PermissionSource;
+}
+export {};
+//# sourceMappingURL=source-access.d.ts.map

package/dist/platform/security/source-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-access.d.ts","sourceRoot":"","sources":["../../../src/platform/security/source-access.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EACR,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACb,MAAM,wBAAwB,CAAC;AAIhC,UAAU,gBAAgB;IACtB,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC/B;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAC/B,UAAU,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,gBAAgB,GAAG,QAAQ,CAAC,EAC1E,KAAK,EAAE,YAAY,GAAG,SAAS,GAChC,OAAO,CAkBT;AAED,6EAA6E;AAC7E,qBAAa,YAAY;IAMT,OAAO,CAAC,QAAQ,CAAC,OAAO;IALpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAGlB;IAEJ,YAA6B,OAAO,EAAE,cAAc,EAAI;IAExD,SAAS,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAKjD;IAED,OAAO,CACH,UAAU,EAAE,kBAAkB,EAC9B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,gBAAgB,GAC1B,gBAAgB,CAiClB;IAED,KAAK,CACD,YAAY,EAAE,kBAAkB,EAChC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,EAC9C,OAAO,EAAE,gBAAgB,GAC1B,gBAAgB,CA8ClB;CACJ"}

package/dist/platform/security/source-access.js

@@ -0,0 +1,72 @@
+import { spendContext } from "../../core/context.js";
+import { dataDepthMax } from "../../core/limits.js";
+import { PlatformError } from "../errors.js";
+import { recordKey } from "../references/catalog.js";
+/** Static preflight and runtime actions enforce the same metadata contract. */
+export function sourceAccessEnabled(definition, value) {
+    if (value !== undefined && value !== null && !["0", "1"].includes(String(value))) {
+        throw new PlatformError("InvalidSourceAccess", `Invalid use_src_access on '${definition.name}'.`, definition.source ? { source: definition.source } : undefined);
+    }
+    if (String(value ?? "0") === "1" && !definition.isRelationship) {
+        throw new PlatformError("UnsupportedSourceAccess", `Source access requires a relationship ItemType; '${definition.name}' is not one.`, definition.source ? { source: definition.source } : undefined);
+    }
+    return String(value ?? "0") === "1";
+}
+/** Resolve stored source generations without invoking business get hooks. */
+export class SourceAccess {
+    storage;
+    types = new WeakMap();
+    constructor(storage) {
+        this.storage = storage;
+    }
+    inherited(definition) {
+        const value = this.storage.getCatalogEntry("ItemType", definition.id)?.properties
+            .use_src_access;
+        return sourceAccessEnabled(definition, value);
+    }
+    resolve(definition, record, context) {
+        let current = { definition, record };
+        if (!this.inherited(definition)) {
+            return current;
+        }
+        const visited = new Set();
+        while (this.inherited(current.definition)) {
+            spendContext(context);
+            const key = recordKey(current.record);
+            if (visited.has(key)) {
+                throw new PlatformError("SourceAccessCycle", `Source permissions form a cycle at '${current.record.type}:${current.record.id}'.`, current.definition.source ? { source: current.definition.source } : undefined);
+            }
+            if (visited.size >= dataDepthMax) {
+                throw new PlatformError("ProtocolLimit", "Source permissions exceed their depth limit.");
+            }
+            visited.add(key);
+            current = this.owner(current.definition, current.record.properties, context);
+        }
+        return current;
+    }
+    owner(relationship, values, context) {
+        const source = relationship.properties.find((property) => property.name === "source_id");
+        if (!source?.dataSource) {
+            throw new PlatformError("UnsupportedSourceAccess", `Source access on '${relationship.name}' requires a concrete source ItemType. for_all relationships need source-type resolution.`, relationship.source ? { source: relationship.source } : undefined);
+        }
+        let types = this.types.get(context);
+        if (!types) {
+            const definitions = this.storage.listItemTypes();
+            spendContext(context, definitions.length);
+            types = new Map(definitions.map((definition) => [definition.id.toLowerCase(), definition]));
+            this.types.set(context, types);
+        }
+        spendContext(context);
+        const definition = source.dataType === "item" ? types.get(source.dataSource.toLowerCase()) : undefined;
+        const id = values.source_id;
+        if (!definition || typeof id !== "string" || !id) {
+            throw new PlatformError("InvalidSourceAccess", `Relationship '${relationship.name}' requires a typed source_id to resolve its permissions.`, relationship.source ? { source: relationship.source } : undefined);
+        }
+        const record = this.storage.getItem(definition.name, id);
+        if (!record) {
+            throw new PlatformError("MissingSourceItem", `Permission source '${definition.name}:${id}' for '${relationship.name}' is missing.`, relationship.source ? { source: relationship.source } : undefined);
+        }
+        return { definition, record };
+    }
+}
+//# sourceMappingURL=source-access.js.map

package/dist/platform/security/source-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-access.js","sourceRoot":"","sources":["../../../src/platform/security/source-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAQpD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAOrD,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAC/B,UAA0E,EAC1E,KAA+B;IAE/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,aAAa,CACnB,qBAAqB,EACrB,8BAA8B,UAAU,CAAC,IAAI,IAAI,EACjD,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAChE,CAAC;IACN,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QAC7D,MAAM,IAAI,aAAa,CACnB,yBAAyB,EACzB,oDAAoD,UAAU,CAAC,IAAI,eAAe,EAClF,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAChE,CAAC;IACN,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC;AACxC,CAAC;AAED,6EAA6E;AAC7E,MAAM,OAAO,YAAY;IAMQ,OAAO;IALnB,KAAK,GAAG,IAAI,OAAO,EAGjC,CAAC;IAEJ,YAA6B,OAAuB;uBAAvB,OAAO;IAAmB,CAAC;IAExD,SAAS,CAAC,UAA8B;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,UAAU;aAC5E,cAAc,CAAC;QAEpB,OAAO,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,CACH,UAA8B,EAC9B,MAAkB,EAClB,OAAyB;QAEzB,IAAI,OAAO,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAErC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAEtC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,aAAa,CACnB,mBAAmB,EACnB,uCAAuC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EACnF,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAChF,CAAC;YACN,CAAC;YAED,IAAI,OAAO,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;gBAC/B,MAAM,IAAI,aAAa,CACnB,eAAe,EACf,8CAA8C,CACjD,CAAC;YACN,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjF,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,KAAK,CACD,YAAgC,EAChC,MAA8C,EAC9C,OAAyB;QAEzB,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAEzF,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CACnB,yBAAyB,EACzB,qBAAqB,YAAY,CAAC,IAAI,2FAA2F,EACjI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CACpE,CAAC;QACN,CAAC;QAED,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACjD,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1C,KAAK,GAAG,IAAI,GAAG,CACX,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,UAAU,CAAC,CAAC,CAC7E,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QAED,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,MAAM,UAAU,GACZ,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;QAE5B,IAAI,CAAC,UAAU,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,aAAa,CACnB,qBAAqB,EACrB,iBAAiB,YAAY,CAAC,IAAI,0DAA0D,EAC5F,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CACpE,CAAC;QACN,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAEzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,aAAa,CACnB,mBAAmB,EACnB,sBAAsB,UAAU,CAAC,IAAI,IAAI,EAAE,UAAU,YAAY,CAAC,IAAI,eAAe,EACrF,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CACpE,CAAC;QACN,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;CACJ"}

package/dist/platform/security/source-inheritance.d.ts

@@ -0,0 +1,19 @@
+import type { ExecutionContext } from "../../core/types.js";
+import type { HarnessStorage, StorageValue, StoredItem } from "../../storage/types.js";
+import type { PlatformTrace } from "../trace.js";
+import type { ItemPermissions } from "./permissions.js";
+import type { SourceAccess } from "./source-access.js";
+/** Audit fields belong to the relationship; these four fields inherit from its source. */
+export declare function inheritedSecurity(source: StoredItem): Record<string, StorageValue>;
+/** Native ACL propagation is a platform write in the original action's transaction. */
+export declare class SourceInheritance {
+    private readonly storage;
+    private readonly sources;
+    private readonly trace;
+    private readonly permissions;
+    constructor(storage: HarnessStorage, sources: SourceAccess, trace: PlatformTrace, permissions: ItemPermissions);
+    changed(before: StoredItem, after: StoredItem, context: ExecutionContext): void;
+    private propagate;
+    private update;
+}
+//# sourceMappingURL=source-inheritance.d.ts.map

package/dist/platform/security/source-inheritance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-inheritance.d.ts","sourceRoot":"","sources":["../../../src/platform/security/source-inheritance.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGvF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIvD,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAQlF;AAED,uFAAuF;AACvF,qBAAa,iBAAiB;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAJhC,YACqB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,eAAe,EAC7C;IAEJ,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,CA4B9E;IAED,OAAO,CAAC,SAAS;IA4CjB,OAAO,CAAC,MAAM;CA0BjB"}