@sixb/core 0.1.18 → 0.1.19

package/dist/{chunk-f1zxad2t.js → chunk-wz0xs816.js}

@@ -2,18 +2,18 @@
 import {
   createSixbError2,
   isSixbError2
-} from "./chunk-6fsr7y93.js";
+} from "./chunk-8mx7qw3y.js";
 import {
   resolveExecutionScopeAuthorization,
   AuthorizationError2,
   assertProviderAccess2
-} from "./chunk-qkbx3tf6.js";
-import {
-  isOAuthConnectorDefinition2
-} from "./chunk-9x8dybsb.js";
+} from "./chunk-y7rqfrgg.js";
 import {
   ConnectorConnectionStorageError2
 } from "./chunk-2c4j899j.js";
+import {
+  isOAuthConnectorDefinition2
+} from "./chunk-9x8dybsb.js";
 
 // src/connectors/errors.ts
 class ConnectorError2 extends Error {
@@ -148,4 +148,4 @@ function assertConnectorConnectionAccess(runtime, execution) {
 
 export { ConnectorError2, ConnectorNotFoundError2, ConnectorOAuthError2, createConnectorCodedError, createAmbiguousProviderOperationError, oauthErrorKind, providerFailureCode, providerBoundaryError, isConnectorStorageError, storageBoundaryError, recoverConnectorFailure, createConnectorRuntime, getConnectorExecutionSourceResolver };
 
-//# debugId=B7B09D22E526C3CB64756E2164756E21
+//# debugId=3C1D35D66FA59CBC64756E2164756E21

package/dist/{chunk-f1zxad2t.js.map → chunk-wz0xs816.js.map}

@@ -6,6 +6,6 @@
     "import { AuthorizationError, assertProviderAccess } from \"../authorization\"\nimport type { ExecutionContext } from \"../execution\"\nimport { resolveExecutionScopeAuthorization } from \"../execution/authorization\"\nimport type { SixbRuntimeContext } from \"../runtime/types\"\nimport { createConnectorCodedError } from \"./errors\"\nimport type { ConnectorService } from \"./service\"\nimport type {\n  AnyConnectorAdapter,\n  ConnectorAdapter,\n  ConnectorClient,\n  ConnectorConnectionMetadata,\n  ConnectorConnectionSelector,\n  ConnectorDefinition,\n  OAuthConnectorAdapter,\n} from \"./types\"\nimport { isOAuthConnectorDefinition } from \"./types\"\n\n/** Resolve a registered connector through one authorized execution. */\nexport interface ConnectorRuntime {\n  <TAdapter extends ConnectorAdapter>(\n    definition: ConnectorDefinition<string, TAdapter>\n  ): Promise<ConnectorClient<TAdapter>>\n  <TAdapter extends OAuthConnectorAdapter>(\n    definition: ConnectorDefinition<string, TAdapter>,\n    selector: ConnectorConnectionSelector\n  ): Promise<ConnectorClient<TAdapter>>\n}\n\nexport interface ConnectorExecutionSource<\n  TAdapter extends AnyConnectorAdapter = AnyConnectorAdapter,\n> {\n  readonly connection?: ConnectorConnectionMetadata\n  connect(signal: AbortSignal): Promise<ConnectorClient<TAdapter>>\n}\n\nexport interface ConnectorExecutionSourceResolver {\n  list<TAdapter extends AnyConnectorAdapter>(\n    definition: ConnectorDefinition<string, TAdapter>\n  ): Promise<readonly ConnectorExecutionSource<TAdapter>[]>\n}\n\nconst sourceResolvers = new WeakMap<ConnectorRuntime, ConnectorExecutionSourceResolver>()\n\nexport function createConnectorRuntime(\n  runtime: SixbRuntimeContext,\n  execution: ExecutionContext,\n  service: ConnectorService\n): ConnectorRuntime {\n  const connector = ((definition: ConnectorDefinition, selector?: ConnectorConnectionSelector) => {\n    if (isOAuthConnectorDefinition(definition)) {\n      assertConnectorConnectionAccess(runtime, execution)\n      if (!selector) {\n        throw createConnectorCodedError(\n          \"connector.configuration_invalid\",\n          `[Sixb] Connector '${definition.id}' uses persistent connections and requires an explicit owner and slot.`\n        )\n      }\n      return service.connectConnection(definition, selector)\n    }\n    if (selector) {\n      throw createConnectorCodedError(\n        \"connector.configuration_invalid\",\n        `[Sixb] Static connector '${definition.id}' does not accept a connection.`\n      )\n    }\n    assertProviderAccess(runtime, execution, \"connector.connect\")\n    return service.connect(definition as ConnectorDefinition<string, ConnectorAdapter>)\n  }) as ConnectorRuntime\n\n  registerConnectorExecutionSourceResolver(connector, {\n    async list<TAdapter extends AnyConnectorAdapter>(\n      definition: ConnectorDefinition<string, TAdapter>\n    ): Promise<readonly ConnectorExecutionSource<TAdapter>[]> {\n      if (!isOAuthConnectorDefinition(definition)) {\n        return [\n          {\n            connect: (_signal) =>\n              connector(definition as ConnectorDefinition<string, ConnectorAdapter>) as Promise<\n                ConnectorClient<TAdapter>\n              >,\n          },\n        ]\n      }\n\n      assertConnectorConnectionAccess(runtime, execution)\n      const connections = await service.listExecutionConnections(definition)\n      return connections.map((connection) => ({\n        connection: {\n          id: connection.id,\n          connectorId: connection.connectorId,\n          owner: connection.owner,\n          slot: connection.slot,\n          account: connection.account,\n        },\n        connect: (signal) =>\n          service.connectExecutionConnection(definition, connection, signal) as Promise<\n            ConnectorClient<TAdapter>\n          >,\n      }))\n    },\n  })\n  return connector\n}\n\nfunction registerConnectorExecutionSourceResolver(\n  connector: ConnectorRuntime,\n  resolver: ConnectorExecutionSourceResolver\n): void {\n  const registered = sourceResolvers.get(connector)\n  if (registered && registered !== resolver) {\n    throw new Error(\"[Sixb] Connector source resolver is already registered for this execution.\")\n  }\n  sourceResolvers.set(connector, resolver)\n}\n\nexport function getConnectorExecutionSourceResolver(\n  connector: ConnectorRuntime\n): ConnectorExecutionSourceResolver {\n  const resolver = sourceResolvers.get(connector)\n  if (resolver) return resolver\n\n  return {\n    async list<TAdapter extends AnyConnectorAdapter>(\n      definition: ConnectorDefinition<string, TAdapter>\n    ): Promise<readonly ConnectorExecutionSource<TAdapter>[]> {\n      if (isOAuthConnectorDefinition(definition)) {\n        throw createConnectorCodedError(\n          \"connector.configuration_invalid\",\n          `[Sixb] OAuth connector '${definition.id}' cannot be resolved without the managed connection runtime.`\n        )\n      }\n      return [\n        {\n          connect: (_signal) =>\n            connector(definition as ConnectorDefinition<string, ConnectorAdapter>) as Promise<\n              ConnectorClient<TAdapter>\n            >,\n        },\n      ]\n    },\n  }\n}\n\nfunction assertConnectorConnectionAccess(\n  runtime: SixbRuntimeContext,\n  execution: ExecutionContext\n): void {\n  const resolved = resolveExecutionScopeAuthorization(runtime.projectId, {\n    execution,\n    authorization: runtime.runtimeAuthorization,\n  })\n  if (resolved.type === \"unrestricted\" && resolved.ref.type === \"trustedPrimitive\") return\n  throw new AuthorizationError(\n    \"privileged:connector-connection.connect\",\n    \"[Sixb] Connector connection clients are restricted to trusted primitive executions.\"\n  )\n}\n"
   ],
   "mappings": ";;;;;;;;;;;;;;;;;;AAkBO,MAAM,wBAAuB,MAAM;AAAA,EAC/B,OAAe;AAC1B;AAAA;AAEO,MAAM,gCAA+B,gBAAe;AAAA,EAEpC;AAAA,EADH,OAAO;AAAA,EACzB,WAAW,CAAU,aAAqB;AAAA,IACxC,MAAM,sBAAsB,cAAc;AAAA,IADvB;AAAA;AAGvB;AAAA;AAaO,MAAM,6BAA4B,gBAAe;AAAA,EAI3C;AAAA,EAHO,OAAO;AAAA,EAEzB,WAAW,CACA,MACT,SACA,SACA;AAAA,IACA,MAAM,SAAS,OAAO;AAAA,IAJb;AAAA;AAMb;AAGO,SAAS,yBAAyB,CACvC,MACA,SACA,UAA4B,CAAC,GACb;AAAA,EAChB,OAAO,iBACL,MACA,QAAQ,WAAW,QAAQ,IAAI,UAAU,UAAU,WACnD,OACF;AAAA;AAIK,SAAS,qCAAqC,CACnD,UAA4B,CAAC,GACb;AAAA,EAChB,OAAO,0BACL,6BACA,sDACA,OACF;AAAA;AAGK,SAAS,cAAc,CAAC,OAAyC;AAAA,EACtE,OAAO,iBAAiB,uBAAsB,MAAM,OAAO;AAAA;AAGtD,SAAS,mBAAmB,CACjC,OACgE;AAAA,EAChE,OAAO,eAAe,KAAK,MAAM,cAC7B,mCACA;AAAA;AAGC,SAAS,qBAAqB,CACnC,OACA,MACA,SACO;AAAA,EACP,IAAI,aAAY,KAAK,KAAK,MAAM,KAAK,WAAW,YAAY;AAAA,IAAG,OAAO;AAAA,EACtE,OAAO,0BAA0B,MAAM,SAAS,EAAE,OAAO,MAAM,CAAC;AAAA;AAG3D,SAAS,uBAAuB,CACrC,OACA,MAC0C;AAAA,EAC1C,OACE,iBAAiB,qCAAoC,SAAS,aAAa,MAAM,SAAS;AAAA;AAIvF,SAAS,oBAAoB,CAAC,OAAgB,SAAiC;AAAA,EACpF,OAAO,0BAA0B,uBAAuB,SAAS,EAAE,OAAO,MAAM,CAAC;AAAA;AAGnF,eAAsB,uBAA0B,CAC9C,cACA,SACA,UACY;AAAA,EACZ,IAAI;AAAA,IACF,OAAO,MAAM,SAAS;AAAA,IACtB,OAAO,eAAe;AAAA,IACtB,MAAM,0BAA0B,uBAAuB,SAAS;AAAA,MAC9D,OAAO,IAAI,eAAe,CAAC,cAAc,aAAa,GAAG,OAAO;AAAA,IAClE,CAAC;AAAA;AAAA;;;AC/EL,IAAM,kBAAkB,IAAI;AAErB,SAAS,sBAAsB,CACpC,SACA,WACA,SACkB;AAAA,EAClB,MAAM,YAAa,CAAC,YAAiC,aAA2C;AAAA,IAC9F,IAAI,4BAA2B,UAAU,GAAG;AAAA,MAC1C,gCAAgC,SAAS,SAAS;AAAA,MAClD,IAAI,CAAC,UAAU;AAAA,QACb,MAAM,0BACJ,mCACA,qBAAqB,WAAW,0EAClC;AAAA,MACF;AAAA,MACA,OAAO,QAAQ,kBAAkB,YAAY,QAAQ;AAAA,IACvD;AAAA,IACA,IAAI,UAAU;AAAA,MACZ,MAAM,0BACJ,mCACA,4BAA4B,WAAW,mCACzC;AAAA,IACF;AAAA,IACA,sBAAqB,SAAS,WAAW,mBAAmB;AAAA,IAC5D,OAAO,QAAQ,QAAQ,UAA2D;AAAA;AAAA,EAGpF,yCAAyC,WAAW;AAAA,SAC5C,KAA0C,CAC9C,YACwD;AAAA,MACxD,IAAI,CAAC,4BAA2B,UAAU,GAAG;AAAA,QAC3C,OAAO;AAAA,UACL;AAAA,YACE,SAAS,CAAC,YACR,UAAU,UAA2D;AAAA,UAGzE;AAAA,QACF;AAAA,MACF;AAAA,MAEA,gCAAgC,SAAS,SAAS;AAAA,MAClD,MAAM,cAAc,MAAM,QAAQ,yBAAyB,UAAU;AAAA,MACrE,OAAO,YAAY,IAAI,CAAC,gBAAgB;AAAA,QACtC,YAAY;AAAA,UACV,IAAI,WAAW;AAAA,UACf,aAAa,WAAW;AAAA,UACxB,OAAO,WAAW;AAAA,UAClB,MAAM,WAAW;AAAA,UACjB,SAAS,WAAW;AAAA,QACtB;AAAA,QACA,SAAS,CAAC,WACR,QAAQ,2BAA2B,YAAY,YAAY,MAAM;AAAA,MAGrE,EAAE;AAAA;AAAA,EAEN,CAAC;AAAA,EACD,OAAO;AAAA;AAGT,SAAS,wCAAwC,CAC/C,WACA,UACM;AAAA,EACN,MAAM,aAAa,gBAAgB,IAAI,SAAS;AAAA,EAChD,IAAI,cAAc,eAAe,UAAU;AAAA,IACzC,MAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AAAA,EACA,gBAAgB,IAAI,WAAW,QAAQ;AAAA;AAGlC,SAAS,mCAAmC,CACjD,WACkC;AAAA,EAClC,MAAM,WAAW,gBAAgB,IAAI,SAAS;AAAA,EAC9C,IAAI;AAAA,IAAU,OAAO;AAAA,EAErB,OAAO;AAAA,SACC,KAA0C,CAC9C,YACwD;AAAA,MACxD,IAAI,4BAA2B,UAAU,GAAG;AAAA,QAC1C,MAAM,0BACJ,mCACA,2BAA2B,WAAW,gEACxC;AAAA,MACF;AAAA,MACA,OAAO;AAAA,QACL;AAAA,UACE,SAAS,CAAC,YACR,UAAU,UAA2D;AAAA,QAGzE;AAAA,MACF;AAAA;AAAA,EAEJ;AAAA;AAGF,SAAS,+BAA+B,CACtC,SACA,WACM;AAAA,EACN,MAAM,WAAW,mCAAmC,QAAQ,WAAW;AAAA,IACrE;AAAA,IACA,eAAe,QAAQ;AAAA,EACzB,CAAC;AAAA,EACD,IAAI,SAAS,SAAS,kBAAkB,SAAS,IAAI,SAAS;AAAA,IAAoB;AAAA,EAClF,MAAM,IAAI,oBACR,2CACA,qFACF;AAAA;",
-  "debugId": "B7B09D22E526C3CB64756E2164756E21",
+  "debugId": "3C1D35D66FA59CBC64756E2164756E21",
   "names": []
 }

package/dist/chunk-y0c4e6ex.js

@@ -0,0 +1,16 @@
+// @bun
+import {
+  MaterializationConflictError2
+} from "./chunk-96yw3pwd.js";
+
+// src/storage/action-runs/errors.ts
+class ActionRunError2 extends MaterializationConflictError2 {
+  name = "ActionRunError";
+  constructor(message) {
+    super("run-correlation", message);
+  }
+}
+
+export { ActionRunError2 };
+
+//# debugId=1014D87D7C9505E464756E2164756E21

package/dist/chunk-y0c4e6ex.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/storage/action-runs/errors.ts"],
+  "sourcesContent": [
+    "import { MaterializationConflictError } from \"../../materialization/errors\"\n\n/**\n * Base error for action-run storage operations. Callers can use this to catch\n * domain-specific failures without relying on message text.\n */\nexport class ActionRunError extends MaterializationConflictError {\n  readonly name = \"ActionRunError\"\n\n  constructor(message: string) {\n    super(\"run-correlation\", message)\n  }\n}\n"
+  ],
+  "mappings": ";;;;;;AAMO,MAAM,wBAAuB,8BAA6B;AAAA,EACtD,OAAO;AAAA,EAEhB,WAAW,CAAC,SAAiB;AAAA,IAC3B,MAAM,mBAAmB,OAAO;AAAA;AAEpC;",
+  "debugId": "1014D87D7C9505E464756E2164756E21",
+  "names": []
+}

package/dist/{chunk-qkbx3tf6.js → chunk-y7rqfrgg.js}

@@ -7,14 +7,14 @@ import {
 } from "./chunk-enpsx8k5.js";
 import {
   createSixbError2
-} from "./chunk-6fsr7y93.js";
+} from "./chunk-8mx7qw3y.js";
 import {
   compileSelectedObjectReadScope2
 } from "./chunk-v4jbb3rs.js";
 import {
   findPrimitiveSchema,
   resolveSemanticType2
-} from "./chunk-y05543x6.js";
+} from "./chunk-hvsb78a1.js";
 import {
   kernelOperationId,
   kernelOperationFromId
@@ -40,8 +40,8 @@ class ObjectReadLimitExceededError2 extends Error {
   limit;
   name = "ObjectReadLimitExceededError";
   code = "object_read_limit_exceeded";
-  constructor(metric, limit) {
-    super(`[Sixb] Object read exceeded its ${metric} limit (${limit}).`);
+  constructor(metric, limit, message = `[Sixb] Object read exceeded its ${metric} limit (${limit}).`) {
+    super(message);
     this.metric = metric;
     this.limit = limit;
   }
@@ -960,13 +960,6 @@ function canViewEvent2(authorization, event) {
         kind: "object.view",
         objectTypeId: event.payload.sourceTypeId
       }) && isAllowed2(authorization, { kind: "object.view", objectTypeId: event.payload.targetTypeId });
-    case "actions": {
-      if (!isAllowed2(authorization, { kind: "action.apply", actionId: event.payload.actionId })) {
-        return false;
-      }
-      const subject = event.payload.subject;
-      return subject.kind === "object" ? isAllowed2(authorization, { kind: "object.view", objectTypeId: subject.objectTypeId }) : true;
-    }
     case "workflows":
       return isAllowed2(authorization, {
         kind: "workflow.run",
@@ -1790,6 +1783,6 @@ function canViewProjection2(authorization, projection) {
 function emptyGrantIndex2() {
   return emptyGrantSets();
 }
-export { ProjectionValidationError2, computeProjectionOwnership2, validateProjectionOwnership2, validateTelemetryProjectionFieldMapping2, validateProjectionsAtStartup, defineProjection2, fromForeignKey2, isObjectProjectionDefinition2, isLinkProjectionDefinition2, isTelemetryProjectionDefinition2, isProjectionDefinition2, projectionTargetOf2, agentServiceAccountId2, MAX_OBJECT_READ_FACETS2, ObjectReadLimitExceededError2, snapshotObjectReadExecutionLimits2, assertObjectReadFacetCount2, assertObjectReadOutputWithinLimit2, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createDelegatedRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, createKernelRuntimeAuthorization, resolveRuntimeAuthorizationForProject, getAuthorizationRef, captureExecutionScope, resolveExecutionScopeAuthorization, AuthorizationError2, evaluate2, isAllowed2, assertAuthorized2, isRuntimeAllowed2, assertRuntimeAuthorizationBound2, assertCanEdit2, assertCanAppendTelemetry2, assertCanManageConnector2, assertPrivileged2, assertProviderAccess2, isApplicationAccessControlled2, canAccessApplication2, canViewEvent2, resolveRoleGrants2, resolveAuthorizationContext2, canViewActionRun2, canViewWorkflowRun2, canViewWorkflowIntervention2, canViewPipelineRun2, canViewProjectionRun2, canViewProjection2, emptyGrantIndex2 };
+export { agentServiceAccountId2, MAX_OBJECT_READ_FACETS2, ObjectReadLimitExceededError2, snapshotObjectReadExecutionLimits2, assertObjectReadFacetCount2, assertObjectReadOutputWithinLimit2, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createDelegatedRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, createKernelRuntimeAuthorization, resolveRuntimeAuthorizationForProject, getAuthorizationRef, captureExecutionScope, resolveExecutionScopeAuthorization, AuthorizationError2, evaluate2, isAllowed2, assertAuthorized2, isRuntimeAllowed2, assertRuntimeAuthorizationBound2, assertCanEdit2, assertCanAppendTelemetry2, assertCanManageConnector2, assertPrivileged2, assertProviderAccess2, isApplicationAccessControlled2, canAccessApplication2, canViewEvent2, resolveRoleGrants2, resolveAuthorizationContext2, ProjectionValidationError2, computeProjectionOwnership2, validateProjectionOwnership2, validateTelemetryProjectionFieldMapping2, validateProjectionsAtStartup, defineProjection2, fromForeignKey2, isObjectProjectionDefinition2, isLinkProjectionDefinition2, isTelemetryProjectionDefinition2, isProjectionDefinition2, projectionTargetOf2, canViewActionRun2, canViewWorkflowRun2, canViewWorkflowIntervention2, canViewPipelineRun2, canViewProjectionRun2, canViewProjection2, emptyGrantIndex2 };
 
-//# debugId=EE4F623367B105A264756E2164756E21
+//# debugId=316DB507DF90EFBD64756E2164756E21