@sixb/core 0.1.1 → 0.1.2

package/dist/chunk-htq0qh7z.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/storage/action-runs/types.ts", "../src/storage/action-runs/failure.ts"],
+  "sourcesContent": [
+    "import type { ActionSubject } from \"../../actions\"\nimport type { SixbErrorCode, SixbFailure } from \"../../errors/types\"\nimport type { JsonValue } from \"../../json\"\n\nexport type ActionRunStatus = \"queued\" | \"running\" | \"succeeded\" | \"failed\" | \"cancelled\"\n\nexport const ACTION_RUN_PHASES = [\n  \"request\",\n  \"enqueue\",\n  \"validation\",\n  \"writeback\",\n  \"edits\",\n  \"commit\",\n  \"effects\",\n  \"cancelled\",\n] as const\n\nexport type ActionRunPhase = (typeof ACTION_RUN_PHASES)[number]\n\nexport type ActionRunParams = Readonly<Record<string, JsonValue>>\n\nexport type ActionRunPhaseStatus = \"succeeded\" | \"failed\"\n\n/** Error codes an action run or phase record can persist and expose. */\nexport const ACTION_RUN_FAILURE_CODES = [\n  \"internal.unexpected\",\n  \"runtime.cancelled\",\n  \"queue.enqueue_failed\",\n  \"action.phase_failed\",\n] as const satisfies readonly [SixbErrorCode, ...SixbErrorCode[]]\n\nexport type ActionRunFailureCode = (typeof ACTION_RUN_FAILURE_CODES)[number]\n\nexport interface ActionRunFailureDetails<TPhase extends ActionRunPhase = ActionRunPhase> {\n  readonly actionId: string\n  readonly runId: string\n  readonly phase: TPhase\n}\n\n/** Portable failure record with Action's required correlation details. */\nexport interface ActionRunFailure<TPhase extends ActionRunPhase = ActionRunPhase>\n  extends Omit<SixbFailure<ActionRunFailureCode>, \"details\"> {\n  readonly details: ActionRunFailureDetails<TPhase>\n}\n\nexport type ActionRunWritebackRecord =\n  | {\n      readonly status: \"succeeded\"\n      readonly completedAt: Date\n      readonly result: JsonValue\n      readonly error?: never\n    }\n  | {\n      readonly status: \"failed\"\n      readonly completedAt: Date\n      readonly result?: never\n      readonly error: ActionRunFailure<\"writeback\">\n    }\n\nexport type ActionRunEffectsRecord =\n  | {\n      readonly status: \"succeeded\"\n      readonly completedAt: Date\n      readonly error?: never\n    }\n  | {\n      readonly status: \"failed\"\n      readonly completedAt: Date\n      readonly error: ActionRunFailure<\"effects\">\n    }\n\nexport interface ActionRunRecord {\n  readonly id: string\n  readonly projectId: string\n  readonly executionId: string\n  readonly actionId: string\n  readonly subject: ActionSubject\n  readonly status: ActionRunStatus\n  readonly phase?: ActionRunPhase\n  readonly queuedAt: Date\n  readonly startedAt?: Date\n  readonly finishedAt?: Date\n  readonly params: ActionRunParams\n  readonly idempotencyKey: string\n  readonly writeback?: ActionRunWritebackRecord\n  readonly effects?: ActionRunEffectsRecord\n  readonly error?: ActionRunFailure\n}\n\nexport interface QueueActionRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly executionId: string\n  readonly actionId: string\n  readonly subject: ActionSubject\n  readonly params: ActionRunParams\n  readonly idempotencyKey: string\n  readonly queuedAt?: Date\n}\n\nexport interface StartActionRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly startedAt?: Date\n  readonly phase?: Extract<ActionRunPhase, \"validation\">\n}\n\nexport interface EnterActionRunPhaseInput {\n  readonly id: string\n  readonly projectId: string\n  readonly phase: Extract<\n    ActionRunPhase,\n    \"validation\" | \"writeback\" | \"edits\" | \"commit\" | \"effects\"\n  >\n}\n\nexport type RecordActionWritebackInput =\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"succeeded\"\n      readonly completedAt?: Date\n      readonly result: JsonValue\n    }\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"failed\"\n      readonly completedAt?: Date\n      readonly error: ActionRunFailure<\"writeback\">\n    }\n\nexport type RecordActionEffectsInput =\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"succeeded\"\n      readonly completedAt?: Date\n    }\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"failed\"\n      readonly completedAt?: Date\n      readonly error: ActionRunFailure<\"effects\">\n    }\n\nexport type FinishActionRunInput =\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"succeeded\"\n      readonly finishedAt?: Date\n      readonly phase?: ActionRunPhase\n    }\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"failed\" | \"cancelled\"\n      readonly finishedAt?: Date\n      readonly error: ActionRunFailure\n    }\n\nexport interface ListActionRunsInput {\n  readonly projectId: string\n  readonly actionId?: string\n  readonly actionIds?: readonly string[]\n  readonly subject?: ActionSubject\n  readonly objectTypeId?: string\n  readonly objectTypeIds?: readonly string[]\n  readonly primaryId?: string\n  readonly statuses?: readonly ActionRunStatus[]\n  readonly startedAfter?: Date\n  readonly startedBefore?: Date\n  readonly limit?: number\n  readonly offset?: number\n  readonly order?: \"asc\" | \"desc\"\n}\n\nexport interface ListActionRunsResult {\n  readonly runs: readonly ActionRunRecord[]\n  readonly hasMore: boolean\n  readonly total: number\n}\n\nexport interface LockActionMaterializationRunInput {\n  readonly projectId: string\n  readonly actionId: string\n  readonly runId: string\n}\n\nexport interface ActionRunStorage {\n  /** Transactional fence for Action identity and running state before a new ontology commit. */\n  lockForMaterialization(input: LockActionMaterializationRunInput): Promise<ActionRunRecord>\n  queue(input: QueueActionRunInput): Promise<ActionRunRecord>\n  start(input: StartActionRunInput): Promise<ActionRunRecord>\n  enterPhase(input: EnterActionRunPhaseInput): Promise<ActionRunRecord>\n  recordWriteback(input: RecordActionWritebackInput): Promise<ActionRunRecord>\n  recordEffects(input: RecordActionEffectsInput): Promise<ActionRunRecord>\n  finish(input: FinishActionRunInput): Promise<ActionRunRecord>\n  getById(params: { projectId: string; id: string }): Promise<ActionRunRecord | null>\n  list(input: ListActionRunsInput): Promise<ListActionRunsResult>\n}\n",
+    "import { parseSixbFailure } from \"../../errors/internal\"\nimport { isPlainRecord } from \"../../json\"\nimport {\n  ACTION_RUN_FAILURE_CODES,\n  ACTION_RUN_PHASES,\n  type ActionRunFailure,\n  type ActionRunFailureDetails,\n  type ActionRunPhase,\n} from \"./types\"\n\n/** Serializes the canonical failure plus Action's typed lifecycle extension. */\nexport function serializeActionRunFailure<TPhase extends ActionRunPhase>(\n  failure: ActionRunFailure<TPhase>,\n  expectedPhase?: TPhase\n): string {\n  const parsed =\n    expectedPhase === undefined\n      ? parseActionRunFailure(failure)\n      : parseActionRunFailure(failure, expectedPhase)\n  return JSON.stringify(parsed)\n}\n\n/** Validates and detaches an Action failure read from a storage boundary. */\nexport function parseActionRunFailure<TPhase extends ActionRunPhase>(\n  value: unknown,\n  expectedPhase: TPhase\n): ActionRunFailure<TPhase>\nexport function parseActionRunFailure(value: unknown): ActionRunFailure\nexport function parseActionRunFailure(\n  value: unknown,\n  expectedPhase?: ActionRunPhase\n): ActionRunFailure {\n  const candidate = parseStoredActionRunFailureValue(value)\n  const failure = parseSixbFailure(candidate, ACTION_RUN_FAILURE_CODES)\n  const details = failure.details\n  if (\n    !isPlainRecord(details) ||\n    typeof details.actionId !== \"string\" ||\n    typeof details.runId !== \"string\" ||\n    typeof details.phase !== \"string\" ||\n    !(ACTION_RUN_PHASES as readonly string[]).includes(details.phase)\n  ) {\n    throw new Error(\n      \"[Sixb] Stored failure is invalid: Action details must contain actionId, runId, and a known phase.\"\n    )\n  }\n  if (expectedPhase !== undefined && details.phase !== expectedPhase) {\n    throw new Error(`[Sixb] Stored Action ${expectedPhase} failure has phase '${details.phase}'.`)\n  }\n\n  return {\n    ...failure,\n    details: details as unknown as ActionRunFailureDetails,\n  }\n}\n\nfunction parseStoredActionRunFailureValue(value: unknown): unknown {\n  if (typeof value !== \"string\") return value\n  try {\n    return JSON.parse(value) as unknown\n  } catch {\n    throw new Error(\"[Sixb] Stored failure is invalid: value is not valid JSON.\")\n  }\n}\n"
+  ],
+  "mappings": ";;;;;;;;;AAMO,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASO,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;AClBO,SAAS,yBAAwD,CACtE,SACA,eACQ;AAAA,EACR,MAAM,SACJ,kBAAkB,YACd,sBAAsB,OAAO,IAC7B,sBAAsB,SAAS,aAAa;AAAA,EAClD,OAAO,KAAK,UAAU,MAAM;AAAA;AASvB,SAAS,qBAAqB,CACnC,OACA,eACkB;AAAA,EAClB,MAAM,YAAY,iCAAiC,KAAK;AAAA,EACxD,MAAM,UAAU,iBAAiB,WAAW,wBAAwB;AAAA,EACpE,MAAM,UAAU,QAAQ;AAAA,EACxB,IACE,CAAC,cAAc,OAAO,KACtB,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,UAAU,YACzB,OAAO,QAAQ,UAAU,YACzB,CAAE,kBAAwC,SAAS,QAAQ,KAAK,GAChE;AAAA,IACA,MAAM,IAAI,MACR,mGACF;AAAA,EACF;AAAA,EACA,IAAI,kBAAkB,aAAa,QAAQ,UAAU,eAAe;AAAA,IAClE,MAAM,IAAI,MAAM,wBAAwB,oCAAoC,QAAQ,SAAS;AAAA,EAC/F;AAAA,EAEA,OAAO;AAAA,OACF;AAAA,IACH;AAAA,EACF;AAAA;AAGF,SAAS,gCAAgC,CAAC,OAAyB;AAAA,EACjE,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,IAAI;AAAA,IACF,OAAO,KAAK,MAAM,KAAK;AAAA,IACvB,MAAM;AAAA,IACN,MAAM,IAAI,MAAM,4DAA4D;AAAA;AAAA;",
+  "debugId": "C0AEB0A8D7FE678664756E2164756E21",
+  "names": []
+}

package/dist/{chunk-xt6qx9sh.js → chunk-jaj13078.js}

@@ -15,8 +15,12 @@ import {
   GRANT_KINDS,
   canAccessApplication,
   grantKindOf,
-  resolveAuthorizationContext
-} from "./chunk-exrfbt2d.js";
+  resolveAuthorizationContext,
+  resolveRoleGrants
+} from "./chunk-34bqh420.js";
+import {
+  compareStrings
+} from "./chunk-t8t39h7v.js";
 
 // src/auth/access-tokens.ts
 import { createHash, randomBytes, randomUUID } from "crypto";
@@ -98,6 +102,33 @@ function accessTokenKindFromLabel(label) {
   }
   return null;
 }
+// src/auth/attribution.ts
+async function snapshotRequesterGroupIds(input) {
+  if (input.principal.type === "system" || !input.auth) {
+    return [];
+  }
+  const memberships = input.principal.type === "user" ? await input.auth.groupMemberships.listForUser({
+    projectId: input.projectId,
+    userId: input.principal.id
+  }) : await input.auth.serviceAccountGroupMemberships.listForServiceAccount({
+    projectId: input.projectId,
+    serviceAccountId: input.principal.id
+  });
+  return normalizeRequesterGroupIds(memberships.map((membership) => membership.groupId));
+}
+function normalizeRequesterGroupIds(groupIds) {
+  if (!Array.isArray(groupIds)) {
+    throw new TypeError("[Sixb] requesterGroupIds must be an array.");
+  }
+  const unique = new Set;
+  for (const groupId of groupIds) {
+    if (typeof groupId !== "string" || groupId.trim().length === 0) {
+      throw new TypeError("[Sixb] requesterGroupIds entries must be nonblank.");
+    }
+    unique.add(groupId);
+  }
+  return [...unique].sort(compareStrings);
+}
 // src/auth/csrf.ts
 import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
 var CSRF_HEADER_NAME = "x-sixb-csrf";
@@ -210,7 +241,8 @@ var GRANT_CAPABILITIES = Object.keys({
   append: true,
   apply: true,
   run: true,
-  observe: true
+  observe: true,
+  manage: true
 });
 function formatAlternatives(values) {
   const quoted = values.map((value) => `'${value}'`);
@@ -327,6 +359,9 @@ function assertGrantDefinition(value, field, createError = (message) => new Secu
   if (value.capability === "observe" && value.target !== "logs") {
     throw createError(`[Sixb] ${field} observe grant target must be 'logs'.`);
   }
+  if (value.capability === "manage" && value.target !== undefined) {
+    throw createError(`[Sixb] ${field} manage grant must not declare a target.`);
+  }
   assertSelection(value.selection, field, createError);
 }
 function assertSelection(value, field, createError) {
@@ -526,7 +561,8 @@ var BREADTH_TARGETS = [
   "sync",
   "pipeline",
   "agent",
-  "application"
+  "application",
+  "connector"
 ];
 function isBreadthSelector(value) {
   if (typeof value !== "object" || value === null)
@@ -560,7 +596,8 @@ var every = {
   sync: () => all("sync"),
   pipeline: () => all("pipeline"),
   agent: () => all("agent"),
-  application: () => all("application")
+  application: () => all("application"),
+  connector: () => all("connector")
 };
 // src/security/grants.ts
 var VIEW_TARGETS = ["object", "dataset"];
@@ -571,7 +608,8 @@ var TARGET_BY_DEFINITION_KIND = {
   pipeline: "pipeline",
   agent: "agent",
   workflow: "workflow",
-  application: "application"
+  application: "application",
+  connector: "connector"
 };
 var UNDISCRIMINATED_TARGETS = ["object", "action"];
 function targetOfDefinition(item, label, allowedTargets) {
@@ -658,6 +696,13 @@ function observe(target) {
     selection: { all: false, ids: [target] }
   };
 }
+function manage(input) {
+  return {
+    kind: "grant",
+    capability: "manage",
+    selection: resolveGrant(input, "can.manage", ["connector"]).selection
+  };
+}
 var can = {
   access,
   view,
@@ -665,8 +710,75 @@ var can = {
   append,
   apply,
   run,
-  observe
+  observe,
+  manage
 };
+// src/security/registry.ts
+class SecurityRegistry {
+  groupsById;
+  rolesById;
+  membershipPoliciesById;
+  resolvedRoles;
+  constructor(input) {
+    const definitions = validateSecurityDefinitionsAtStartup({
+      groups: input.groups ?? [],
+      roles: input.roles ?? [],
+      membershipPolicies: input.membershipPolicies ?? [],
+      applicationIds: input.applicationIds ?? APPLICATION_IDS,
+      objectTypeIds: input.objectTypeIds,
+      datasetIds: input.datasetIds,
+      actionIds: input.actionIds,
+      workflowIds: input.workflowIds,
+      syncIds: input.syncIds,
+      pipelineIds: input.pipelineIds,
+      agentIds: input.agentIds,
+      connectorIds: input.connectorIds,
+      observableIds: new Set(["logs"])
+    });
+    const universe = {
+      applicationIds: input.applicationIds ?? APPLICATION_IDS,
+      objectTypeIds: input.objectTypeIds ?? new Set,
+      datasetIds: input.datasetIds ?? new Set,
+      actionIds: input.actionIds ?? new Set,
+      workflowIds: input.workflowIds ?? new Set,
+      syncIds: input.syncIds ?? new Set,
+      pipelineIds: input.pipelineIds ?? new Set,
+      agentIds: input.agentIds ?? new Set,
+      connectorIds: input.connectorIds ?? new Set,
+      observableIds: new Set(["logs"]),
+      getSubTypes: input.getSubTypes ?? (() => [])
+    };
+    this.groupsById = definitions.groupsById;
+    this.rolesById = definitions.rolesById;
+    this.membershipPoliciesById = definitions.membershipPoliciesById;
+    this.resolvedRoles = definitions.roles.map((role) => ({
+      id: role.id,
+      grantedToGroupIds: role.grantedToGroupIds,
+      grants: resolveRoleGrants(role, universe)
+    }));
+  }
+  listGroups() {
+    return [...this.groupsById.values()];
+  }
+  getGroupById(groupId) {
+    return this.groupsById.get(groupId) ?? null;
+  }
+  listRoles() {
+    return [...this.rolesById.values()];
+  }
+  getRoleById(roleId) {
+    return this.rolesById.get(roleId) ?? null;
+  }
+  listResolvedRoles() {
+    return this.resolvedRoles;
+  }
+  listMembershipPolicies() {
+    return [...this.membershipPoliciesById.values()];
+  }
+  getMembershipPolicyById(policyId) {
+    return this.membershipPoliciesById.get(policyId) ?? null;
+  }
+}
 // src/storage/auth/errors.ts
 class AuthStorageError extends Error {
   code;
@@ -2949,6 +3061,6 @@ var SYSTEM_PRINCIPAL = { type: "system", id: "system" };
 function principalsEqual(left, right) {
   return left.type === right.type && left.id === right.id;
 }
-export { PERSONAL_ACCESS_TOKEN_PREFIX, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, generateAccessTokenSecret, hashAccessTokenSecret, formatAccessTokenValue, parseAccessTokenValue, getBearerAccessTokenValue, createAccessTokenCredential, CSRF_HEADER_NAME, generateCsrfToken, isCsrfExemptMethod, verifyDoubleSubmitCsrf, applications, APPLICATION_IDS, SecurityValidationError, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, validateSecurityDefinitionsAtStartup, defineGroup, defineRole, defineMembershipPolicy, every, can, AuthStorageError, paginate, InMemoryAuthStorage, generateSessionSecret, hashSessionSecret, formatSessionCookieValue, parseSessionCookieValue, createSessionCredential, AuthRuntime, SYSTEM_PRINCIPAL, principalsEqual };
+export { PERSONAL_ACCESS_TOKEN_PREFIX, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, generateAccessTokenSecret, hashAccessTokenSecret, formatAccessTokenValue, parseAccessTokenValue, getBearerAccessTokenValue, createAccessTokenCredential, snapshotRequesterGroupIds, normalizeRequesterGroupIds, CSRF_HEADER_NAME, generateCsrfToken, isCsrfExemptMethod, verifyDoubleSubmitCsrf, applications, SecurityValidationError, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup, defineRole, defineMembershipPolicy, every, can, SecurityRegistry, AuthStorageError, paginate, InMemoryAuthStorage, generateSessionSecret, hashSessionSecret, formatSessionCookieValue, parseSessionCookieValue, createSessionCredential, AuthRuntime, SYSTEM_PRINCIPAL, principalsEqual };
 
-//# debugId=76194AFCF3E3EC0564756E2164756E21
+//# debugId=DBCFDF8FE8B1380C64756E2164756E21