@sixb/core 0.1.17 → 0.1.18

package/dist/chunk-enpsx8k5.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/authorization/grant-kinds.ts"],
+  "sourcesContent": [
+    "/**\n * Grant kinds: the single source of truth for the (capability, target) space.\n *\n * Every grant collapses to one `GrantKind` discriminant — the same\n * `capability:target` string the decision engine uses as a grant key (e.g.\n * `view:object`, `run:sync`). Resolution, validation, enforcement, and the\n * resolved `GrantIndex` all key off it, so adding a grant family is a single\n * entry in `GRANT_KINDS` plus the compile errors that forces at every consumer.\n */\n\nimport type { AgentRunGrant, GrantDefinition } from \"../security/types\"\n\nexport type GrantKind =\n  | \"access:application\"\n  | \"view:object\"\n  | \"view:dataset\"\n  | \"edit:object\"\n  | \"append:telemetry\"\n  | \"apply:action\"\n  | \"share:share\"\n  | \"run:workflow\"\n  | \"run:sync\"\n  | \"run:pipeline\"\n  | \"run:agent\"\n  | \"observe:logs\"\n  | \"observe:aiUsage\"\n  | \"manage:connector\"\n  | \"manage:aiUsage\"\n\nexport type SingletonGrantKind = \"run:agent\"\nexport type TargetedGrantKind = Exclude<GrantKind, SingletonGrantKind>\n\n/** Registered id universes a grant kind ranges over, plus subtype expansion. */\nexport interface GrantUniverse {\n  readonly applicationIds: ReadonlySet<string>\n  readonly objectTypeIds: ReadonlySet<string>\n  readonly datasetIds: ReadonlySet<string>\n  readonly actionIds: ReadonlySet<string>\n  readonly shareIds: ReadonlySet<string>\n  readonly workflowIds: ReadonlySet<string>\n  readonly syncIds: ReadonlySet<string>\n  readonly pipelineIds: ReadonlySet<string>\n  readonly observableIds: ReadonlySet<string>\n  readonly connectorIds: ReadonlySet<string>\n  readonly manageableIds: ReadonlySet<string>\n  readonly getSubTypes: (objectTypeId: string) => readonly string[]\n}\n\n/** The registered-id sets a grant kind validates against (no subtype hook). */\nexport type GrantUniverseKey = Exclude<keyof GrantUniverse, \"getSubTypes\">\n\ninterface TargetedGrantKindSpec {\n  /** Registered universe the grant's ids must belong to. */\n  readonly universeKey: GrantUniverseKey\n  /** Subject noun used in validation errors (\"unknown <subject> '<id>'\"). */\n  readonly subject: string\n  /** Actionable hint appended to the \"unknown <subject>\" error. */\n  readonly fix: string\n  /** Only object-type grants also expand to subtypes. */\n  readonly expandsSubtypes?: true\n}\n\ninterface SingletonGrantKindSpec {\n  /** Project-wide capability with no resource selection; resolves to a boolean. */\n  readonly singleton: true\n  readonly subject: string\n  readonly fix: string\n}\n\n/**\n * The exhaustive grant-kind table. A new grant family is one entry here; the\n * mapped type makes every omission a compile error.\n */\nexport const GRANT_KINDS: {\n  readonly [TKind in GrantKind]: TKind extends SingletonGrantKind\n    ? SingletonGrantKindSpec\n    : TargetedGrantKindSpec\n} = {\n  \"access:application\": {\n    universeKey: \"applicationIds\",\n    subject: \"application\",\n    fix: \"Use an application exported from '@sixb/core'.\",\n  },\n  \"view:object\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n    expandsSubtypes: true,\n  },\n  \"view:dataset\": {\n    universeKey: \"datasetIds\",\n    subject: \"dataset\",\n    fix: \"Add it to 'datasets/' or pass it to createSixb({ datasets }).\",\n  },\n  // Deliberately no `expandsSubtypes`: granting writes on a parent type must not\n  // silently extend to types added under it later. `view:object` expands because\n  // a read of a subtype reveals nothing the parent's grant did not already cover.\n  \"edit:object\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n  },\n  \"append:telemetry\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n  },\n  \"apply:action\": {\n    universeKey: \"actionIds\",\n    subject: \"action\",\n    fix: \"Add it to 'actions/' or pass it to createSixb({ actions }).\",\n  },\n  \"share:share\": {\n    universeKey: \"shareIds\",\n    subject: \"share\",\n    fix: \"Add it to 'shares/' or pass it to createSixb({ shares }).\",\n  },\n  \"run:workflow\": {\n    universeKey: \"workflowIds\",\n    subject: \"workflow\",\n    fix: \"Add it to 'workflows/' or pass it to createSixb({ workflows }).\",\n  },\n  \"run:sync\": {\n    universeKey: \"syncIds\",\n    subject: \"sync\",\n    fix: \"Add it to 'syncs/' or pass it to createSixb({ syncs }).\",\n  },\n  \"run:pipeline\": {\n    universeKey: \"pipelineIds\",\n    subject: \"pipeline\",\n    fix: \"Add it to 'pipelines/' or pass it to createSixb({ pipelines }).\",\n  },\n  \"run:agent\": {\n    singleton: true,\n    subject: \"agent\",\n    fix: \"Configure models.language and use the exported agent reference in can.run(agent).\",\n  },\n  \"observe:logs\": {\n    universeKey: \"observableIds\",\n    subject: \"observability surface\",\n    fix: 'Use can.observe(\"logs\").',\n  },\n  \"observe:aiUsage\": {\n    universeKey: \"observableIds\",\n    subject: \"observability surface\",\n    fix: \"Use can.observe(agent.usage).\",\n  },\n  \"manage:connector\": {\n    universeKey: \"connectorIds\",\n    subject: \"connector\",\n    fix: \"Add it to 'connectors/' or pass it to createSixb({ connectors }).\",\n  },\n  \"manage:aiUsage\": {\n    universeKey: \"manageableIds\",\n    subject: \"management surface\",\n    fix: \"Use can.manage(agent.usage).\",\n  },\n}\n\nexport const GRANT_KIND_KEYS = Object.keys(GRANT_KINDS) as readonly GrantKind[]\nexport const TARGETED_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter(\n  (kind): kind is TargetedGrantKind => kind !== \"run:agent\"\n)\n\n/** The grant kind a stored grant resolves to. */\nexport function grantKindOf(grant: AgentRunGrant): SingletonGrantKind\nexport function grantKindOf(grant: Exclude<GrantDefinition, AgentRunGrant>): TargetedGrantKind\nexport function grantKindOf(grant: GrantDefinition): GrantKind\nexport function grantKindOf(grant: GrantDefinition): GrantKind {\n  switch (grant.capability) {\n    case \"access\":\n      return \"access:application\"\n    case \"view\":\n      return `view:${grant.target}`\n    case \"edit\":\n      return \"edit:object\"\n    case \"append\":\n      return \"append:telemetry\"\n    case \"apply\":\n      return \"apply:action\"\n    case \"share\":\n      return \"share:share\"\n    case \"run\":\n      return `run:${grant.target}`\n    case \"observe\":\n      return `observe:${grant.target}`\n    case \"manage\":\n      return `manage:${grant.target}`\n  }\n}\n\n/** Mutable grant index: booleans for singleton capabilities, id sets for selected resources. */\nexport type MutableGrantIndex = {\n  [TKind in GrantKind]: TKind extends SingletonGrantKind ? boolean : Set<string>\n}\n\nexport function emptyGrantSets(): MutableGrantIndex {\n  return {\n    \"access:application\": new Set(),\n    \"view:object\": new Set(),\n    \"view:dataset\": new Set(),\n    \"edit:object\": new Set(),\n    \"append:telemetry\": new Set(),\n    \"apply:action\": new Set(),\n    \"share:share\": new Set(),\n    \"run:workflow\": new Set(),\n    \"run:sync\": new Set(),\n    \"run:pipeline\": new Set(),\n    \"run:agent\": false,\n    \"observe:logs\": new Set(),\n    \"observe:aiUsage\": new Set(),\n    \"manage:connector\": new Set(),\n    \"manage:aiUsage\": new Set(),\n  }\n}\n"
+  ],
+  "mappings": ";;AAyEO,IAAM,cAIT;AAAA,EACF,sBAAsB;AAAA,IACpB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,IACL,iBAAiB;AAAA,EACnB;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EAIA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,YAAY;AAAA,IACV,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,aAAa;AAAA,IACX,WAAW;AAAA,IACX,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,mBAAmB;AAAA,IACjB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AACF;AAEO,IAAM,kBAAkB,OAAO,KAAK,WAAW;AAC/C,IAAM,2BAA2B,gBAAgB,OACtD,CAAC,SAAoC,SAAS,WAChD;AAMO,SAAS,WAAW,CAAC,OAAmC;AAAA,EAC7D,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO,QAAQ,MAAM;AAAA,SAClB;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO,OAAO,MAAM;AAAA,SACjB;AAAA,MACH,OAAO,WAAW,MAAM;AAAA,SACrB;AAAA,MACH,OAAO,UAAU,MAAM;AAAA;AAAA;AAStB,SAAS,cAAc,GAAsB;AAAA,EAClD,OAAO;AAAA,IACL,sBAAsB,IAAI;AAAA,IAC1B,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,eAAe,IAAI;AAAA,IACnB,oBAAoB,IAAI;AAAA,IACxB,gBAAgB,IAAI;AAAA,IACpB,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,YAAY,IAAI;AAAA,IAChB,gBAAgB,IAAI;AAAA,IACpB,aAAa;AAAA,IACb,gBAAgB,IAAI;AAAA,IACpB,mBAAmB,IAAI;AAAA,IACvB,oBAAoB,IAAI;AAAA,IACxB,kBAAkB,IAAI;AAAA,EACxB;AAAA;",
+  "debugId": "C6044AB9EC3A569764756E2164756E21",
+  "names": []
+}

package/dist/{chunk-a7er86jd.js → chunk-ex496vct.js}

@@ -3,7 +3,7 @@ import {
   createTrustedPrimitiveRuntimeAuthorization,
   getAuthorizationRef,
   resolveExecutionScopeAuthorization
-} from "./chunk-5be2ath4.js";
+} from "./chunk-qkbx3tf6.js";
 import {
   ExecutionStorageError2
 } from "./chunk-tw03bsmb.js";

package/dist/{chunk-jnfxmr3f.js → chunk-f1zxad2t.js}

@@ -7,7 +7,7 @@ import {
   resolveExecutionScopeAuthorization,
   AuthorizationError2,
   assertProviderAccess2
-} from "./chunk-5be2ath4.js";
+} from "./chunk-qkbx3tf6.js";
 import {
   isOAuthConnectorDefinition2
 } from "./chunk-9x8dybsb.js";