@sixb/core 0.1.17 → 0.1.19

package/dist/{chunk-5be2ath4.js → chunk-y7rqfrgg.js}

@@ -1,14 +1,20 @@
 // @bun
+import {
+  GRANT_KINDS,
+  TARGETED_GRANT_KIND_KEYS,
+  grantKindOf,
+  emptyGrantSets
+} from "./chunk-enpsx8k5.js";
 import {
   createSixbError2
-} from "./chunk-6fsr7y93.js";
+} from "./chunk-8mx7qw3y.js";
 import {
   compileSelectedObjectReadScope2
 } from "./chunk-v4jbb3rs.js";
 import {
   findPrimitiveSchema,
   resolveSemanticType2
-} from "./chunk-rpxz486p.js";
+} from "./chunk-hvsb78a1.js";
 import {
   kernelOperationId,
   kernelOperationFromId
@@ -25,129 +31,6 @@ function agentServiceAccountId2(actorId) {
   return `svc_agent_${actorId}`;
 }
 
-// src/authorization/grant-kinds.ts
-var GRANT_KINDS = {
-  "access:application": {
-    universeKey: "applicationIds",
-    subject: "application",
-    fix: "Use an application exported from '@sixb/core'."
-  },
-  "view:object": {
-    universeKey: "objectTypeIds",
-    subject: "object type",
-    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies }).",
-    expandsSubtypes: true
-  },
-  "view:dataset": {
-    universeKey: "datasetIds",
-    subject: "dataset",
-    fix: "Add it to 'datasets/' or pass it to createSixb({ datasets })."
-  },
-  "edit:object": {
-    universeKey: "objectTypeIds",
-    subject: "object type",
-    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies })."
-  },
-  "append:telemetry": {
-    universeKey: "objectTypeIds",
-    subject: "object type",
-    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies })."
-  },
-  "apply:action": {
-    universeKey: "actionIds",
-    subject: "action",
-    fix: "Add it to 'actions/' or pass it to createSixb({ actions })."
-  },
-  "share:share": {
-    universeKey: "shareIds",
-    subject: "share",
-    fix: "Add it to 'shares/' or pass it to createSixb({ shares })."
-  },
-  "run:workflow": {
-    universeKey: "workflowIds",
-    subject: "workflow",
-    fix: "Add it to 'workflows/' or pass it to createSixb({ workflows })."
-  },
-  "run:sync": {
-    universeKey: "syncIds",
-    subject: "sync",
-    fix: "Add it to 'syncs/' or pass it to createSixb({ syncs })."
-  },
-  "run:pipeline": {
-    universeKey: "pipelineIds",
-    subject: "pipeline",
-    fix: "Add it to 'pipelines/' or pass it to createSixb({ pipelines })."
-  },
-  "run:agent": {
-    singleton: true,
-    subject: "agent",
-    fix: "Configure models.language and use the exported agent reference in can.run(agent)."
-  },
-  "observe:logs": {
-    universeKey: "observableIds",
-    subject: "observability surface",
-    fix: 'Use can.observe("logs").'
-  },
-  "observe:aiUsage": {
-    universeKey: "observableIds",
-    subject: "observability surface",
-    fix: "Use can.observe(agent.usage)."
-  },
-  "manage:connector": {
-    universeKey: "connectorIds",
-    subject: "connector",
-    fix: "Add it to 'connectors/' or pass it to createSixb({ connectors })."
-  },
-  "manage:aiUsage": {
-    universeKey: "manageableIds",
-    subject: "management surface",
-    fix: "Use can.manage(agent.usage)."
-  }
-};
-var GRANT_KIND_KEYS = Object.keys(GRANT_KINDS);
-var TARGETED_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter((kind) => kind !== "run:agent");
-function grantKindOf(grant) {
-  switch (grant.capability) {
-    case "access":
-      return "access:application";
-    case "view":
-      return `view:${grant.target}`;
-    case "edit":
-      return "edit:object";
-    case "append":
-      return "append:telemetry";
-    case "apply":
-      return "apply:action";
-    case "share":
-      return "share:share";
-    case "run":
-      return `run:${grant.target}`;
-    case "observe":
-      return `observe:${grant.target}`;
-    case "manage":
-      return `manage:${grant.target}`;
-  }
-}
-function emptyGrantSets() {
-  return {
-    "access:application": new Set,
-    "view:object": new Set,
-    "view:dataset": new Set,
-    "edit:object": new Set,
-    "append:telemetry": new Set,
-    "apply:action": new Set,
-    "share:share": new Set,
-    "run:workflow": new Set,
-    "run:sync": new Set,
-    "run:pipeline": new Set,
-    "run:agent": false,
-    "observe:logs": new Set,
-    "observe:aiUsage": new Set,
-    "manage:connector": new Set,
-    "manage:aiUsage": new Set
-  };
-}
-
 // src/storage/objects/execution-limits.ts
 var MAX_OBJECT_READ_FACETS2 = 16;
 var MAX_OUTPUT_JSON_DEPTH = 64;
@@ -157,8 +40,8 @@ class ObjectReadLimitExceededError2 extends Error {
   limit;
   name = "ObjectReadLimitExceededError";
   code = "object_read_limit_exceeded";
-  constructor(metric, limit) {
-    super(`[Sixb] Object read exceeded its ${metric} limit (${limit}).`);
+  constructor(metric, limit, message = `[Sixb] Object read exceeded its ${metric} limit (${limit}).`) {
+    super(message);
     this.metric = metric;
     this.limit = limit;
   }
@@ -729,7 +612,8 @@ function snapshotAuthorizationContext(context) {
     ...context.sessionId === undefined ? {} : { sessionId: context.sessionId },
     groupIds: Object.freeze([...context.groupIds]),
     roleIds: Object.freeze([...context.roleIds]),
-    grants: frozenGrants
+    grants: frozenGrants,
+    clearances: new ImmutableGrantSet(context.clearances ?? [])
   });
 }
 
@@ -1076,13 +960,6 @@ function canViewEvent2(authorization, event) {
         kind: "object.view",
         objectTypeId: event.payload.sourceTypeId
       }) && isAllowed2(authorization, { kind: "object.view", objectTypeId: event.payload.targetTypeId });
-    case "actions": {
-      if (!isAllowed2(authorization, { kind: "action.apply", actionId: event.payload.actionId })) {
-        return false;
-      }
-      const subject = event.payload.subject;
-      return subject.kind === "object" ? isAllowed2(authorization, { kind: "object.view", objectTypeId: subject.objectTypeId }) : true;
-    }
     case "workflows":
       return isAllowed2(authorization, {
         kind: "workflow.run",
@@ -1151,6 +1028,7 @@ function resolveAuthorizationContext2(input) {
   const memberGroupIds = new Set(input.groupIds);
   const roleIds = [];
   const grants = emptyGrantSets();
+  const clearances = new Set;
   for (const role of input.roles) {
     if (!role.grantedToGroupIds.some((groupId) => memberGroupIds.has(groupId))) {
       continue;
@@ -1164,13 +1042,17 @@ function resolveAuthorizationContext2(input) {
         grants[kind].add(id);
       }
     }
+    for (const markingId of role.clearances ?? []) {
+      clearances.add(markingId);
+    }
   }
   return {
     principal: input.principal,
     ...input.sessionId !== undefined ? { sessionId: input.sessionId } : {},
     groupIds: input.groupIds,
     roleIds,
-    grants
+    grants,
+    clearances
   };
 }
 // src/projections/errors.ts
@@ -1901,6 +1783,6 @@ function canViewProjection2(authorization, projection) {
 function emptyGrantIndex2() {
   return emptyGrantSets();
 }
-export { ProjectionValidationError2, computeProjectionOwnership2, validateProjectionOwnership2, validateTelemetryProjectionFieldMapping2, validateProjectionsAtStartup, defineProjection2, fromForeignKey2, isObjectProjectionDefinition2, isLinkProjectionDefinition2, isTelemetryProjectionDefinition2, isProjectionDefinition2, projectionTargetOf2, agentServiceAccountId2, GRANT_KINDS, grantKindOf, MAX_OBJECT_READ_FACETS2, ObjectReadLimitExceededError2, snapshotObjectReadExecutionLimits2, assertObjectReadFacetCount2, assertObjectReadOutputWithinLimit2, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createDelegatedRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, createKernelRuntimeAuthorization, resolveRuntimeAuthorizationForProject, getAuthorizationRef, captureExecutionScope, resolveExecutionScopeAuthorization, AuthorizationError2, evaluate2, isAllowed2, assertAuthorized2, isRuntimeAllowed2, assertRuntimeAuthorizationBound2, assertCanEdit2, assertCanAppendTelemetry2, assertCanManageConnector2, assertPrivileged2, assertProviderAccess2, isApplicationAccessControlled2, canAccessApplication2, canViewEvent2, resolveRoleGrants2, resolveAuthorizationContext2, canViewActionRun2, canViewWorkflowRun2, canViewWorkflowIntervention2, canViewPipelineRun2, canViewProjectionRun2, canViewProjection2, emptyGrantIndex2 };
+export { agentServiceAccountId2, MAX_OBJECT_READ_FACETS2, ObjectReadLimitExceededError2, snapshotObjectReadExecutionLimits2, assertObjectReadFacetCount2, assertObjectReadOutputWithinLimit2, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createDelegatedRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, createKernelRuntimeAuthorization, resolveRuntimeAuthorizationForProject, getAuthorizationRef, captureExecutionScope, resolveExecutionScopeAuthorization, AuthorizationError2, evaluate2, isAllowed2, assertAuthorized2, isRuntimeAllowed2, assertRuntimeAuthorizationBound2, assertCanEdit2, assertCanAppendTelemetry2, assertCanManageConnector2, assertPrivileged2, assertProviderAccess2, isApplicationAccessControlled2, canAccessApplication2, canViewEvent2, resolveRoleGrants2, resolveAuthorizationContext2, ProjectionValidationError2, computeProjectionOwnership2, validateProjectionOwnership2, validateTelemetryProjectionFieldMapping2, validateProjectionsAtStartup, defineProjection2, fromForeignKey2, isObjectProjectionDefinition2, isLinkProjectionDefinition2, isTelemetryProjectionDefinition2, isProjectionDefinition2, projectionTargetOf2, canViewActionRun2, canViewWorkflowRun2, canViewWorkflowIntervention2, canViewPipelineRun2, canViewProjectionRun2, canViewProjection2, emptyGrantIndex2 };
 
-//# debugId=0D4C4769683DF03564756E2164756E21
+//# debugId=316DB507DF90EFBD64756E2164756E21