@sixb/core 0.1.18 → 0.1.20

package/src/security/grants.ts

@@ -1,7 +1,7 @@
 /**
  * Grant builders for role definitions.
  *
- * Grants are plain data referencing application and runtime definitions
+ * Grants are plain data referencing runtime definitions
  * by id. They carry no enforcement logic — the authorization engine expands
  * each grant's selection into per-principal id sets at startup, so runtime
  * checks stay simple `set.has(id)` lookups.
@@ -31,10 +31,8 @@ import {
   isBreadthSelector,
 } from "./every"
 import type {
-  AccessGrant,
   AgentRunGrant,
   AppendGrant,
-  ApplicationDefinition,
   ApplyGrant,
   EditGrant,
   ManageGrant,
@@ -54,7 +52,7 @@ const VIEW_TARGETS = ["object", "dataset"] as const
 const RUN_TARGETS = ["workflow", "sync", "pipeline"] as const
 
 /**
- * Seven of the nine targets carry a `kind` discriminant naming themselves. The other two — an
+ * Six of the eight targets carry a `kind` discriminant naming themselves. The other two — an
  * `ObjectType` and an `ActionDefinition` — carry none, and each appears in exactly one builder that
  * allows no other undiscriminated target, so the allowed set names them unambiguously.
  */
@@ -63,7 +61,6 @@ const TARGET_BY_DEFINITION_KIND: Readonly<Partial<Record<string, BreadthTarget>>
   sync: "sync",
   pipeline: "pipeline",
   workflow: "workflow",
-  application: "application",
   connector: "connector",
   share: "share",
 }
@@ -82,7 +79,7 @@ function targetOfDefinition<TTarget extends BreadthTarget>(
   // `spec.universeKey` with a `TypeError` naming neither the role nor the definition.
   if (discriminated) {
     if (!isAllowedTarget(discriminated, allowedTargets)) {
-      // "one targeting x", not "a x definition": four of the eight targets start with a vowel, and
+      // "one targeting x", not "a x definition": object and action start with a vowel, and
       // this string ships in a release. Same reason the selector branch below writes no article.
       throw new SecurityValidationError(
         `[Sixb] ${label} accepts ${allowedTargets.join(" or ")} definitions, but received one targeting ${discriminated}.`
@@ -158,11 +155,6 @@ function resolveGrant<TDefinition extends { readonly id?: unknown }, TTarget ext
   return { target, selection: { all: false, ids } }
 }
 
-function access(input: GrantInput<ApplicationDefinition, "application">): AccessGrant {
-  const { selection } = resolveGrant(input, "can.access", ["application"])
-  return { kind: "grant", capability: "access", target: "application", selection }
-}
-
 function view<const TObjectTypeId extends string>(
   input: ShareTarget<TObjectTypeId>
 ): ShareViewGrantBuilder<TObjectTypeId>
@@ -270,13 +262,7 @@ function observe(input: "logs" | AgentUsageReference): ObserveGrant {
   if (input !== "logs" && !isAgentUsageReference(input)) {
     throw new SecurityValidationError('[Sixb] can.observe accepts "logs" or agent.usage.')
   }
-  const target = input === "logs" ? "logs" : "aiUsage"
-  return {
-    kind: "grant",
-    capability: "observe",
-    target,
-    selection: { all: false, ids: [target] },
-  }
+  return { kind: "grant", capability: "observe", target: input === "logs" ? "logs" : "aiUsage" }
 }
 
 function manage(input: GrantInput<ConnectorDefinition, "connector">): ManageGrant<"connector">
@@ -285,12 +271,7 @@ function manage(
   input: GrantInput<ConnectorDefinition, "connector"> | AgentUsageReference
 ): ManageGrant {
   if (isAgentUsageReference(input)) {
-    return {
-      kind: "grant",
-      capability: "manage",
-      target: "aiUsage",
-      selection: { all: false, ids: ["aiUsage"] },
-    }
+    return { kind: "grant", capability: "manage", target: "aiUsage" }
   }
   return {
     kind: "grant",
@@ -301,7 +282,6 @@ function manage(
 }
 
 export const can = {
-  access,
   view,
   edit,
   append,

package/src/security/index.ts

@@ -1,4 +1,3 @@
-export { applications } from "./applications"
 export type {
   DefineGroupOptions,
   DefineMarkingOptions,
@@ -20,10 +19,8 @@ export {
 export type { SecurityDefinitionCatalog, SecurityRegistryOptions } from "./registry"
 export { SecurityRegistry } from "./registry"
 export type {
-  AccessGrant,
   AgentRunGrant,
   AppendGrant,
-  ApplicationDefinition,
   ApplyGrant,
   EditGrant,
   GrantCapability,

package/src/security/membership-policies.ts

@@ -10,7 +10,7 @@ export interface MembershipPolicyScope {
   readonly operations: Readonly<Record<MembershipOperation, MembershipOperationScope>>
 }
 
-const MEMBERSHIP_OPERATIONS = ["invite", "assignGroups", "suspend"] as const
+const MEMBERSHIP_OPERATIONS = ["invite", "assignGroups", "suspend", "serviceAccounts"] as const
 
 export function resolveMembershipPolicyScope(input: {
   readonly membershipPolicies: readonly MembershipPolicyDefinition[]
@@ -40,6 +40,7 @@ export function resolveMembershipPolicyScope(input: {
       invite: freezeOperationScope(operations.invite),
       assignGroups: freezeOperationScope(operations.assignGroups),
       suspend: freezeOperationScope(operations.suspend),
+      serviceAccounts: freezeOperationScope(operations.serviceAccounts),
     },
   }
 }
@@ -83,6 +84,7 @@ function createEmptyOperationScopes(): Record<
     invite: { policyIds: [], groupIds: new Set<string>() },
     assignGroups: { policyIds: [], groupIds: new Set<string>() },
     suspend: { policyIds: [], groupIds: new Set<string>() },
+    serviceAccounts: { policyIds: [], groupIds: new Set<string>() },
   }
 }
 

package/src/security/public.ts

@@ -0,0 +1,10 @@
+/**
+ * Browser-safe security entrypoint (`@sixb/core/security`).
+ *
+ * Group files import `defineGroup` from here, because an app layout imports groups to decide who
+ * sees which screens, and the browser cannot load the `@sixb/core` root.
+ */
+
+export type { DefineGroupOptions } from "./builders"
+export { defineGroup } from "./builders"
+export type { GroupDefinition } from "./types"

package/src/security/registry.ts

@@ -1,5 +1,4 @@
 import { type ResolvedRole, resolveRoleGrants } from "../authorization"
-import { APPLICATION_IDS } from "./applications"
 import type {
   GroupDefinition,
   MarkingDefinition,
@@ -26,7 +25,6 @@ export interface SecurityRegistryOptions {
   readonly groups?: readonly GroupDefinition[]
   readonly roles?: readonly RoleDefinition[]
   readonly membershipPolicies?: readonly MembershipPolicyDefinition[]
-  readonly applicationIds?: ReadonlySet<string>
   readonly objectTypeIds?: ReadonlySet<string>
   readonly datasetIds?: ReadonlySet<string>
   readonly actionIds?: ReadonlySet<string>
@@ -52,7 +50,6 @@ export class SecurityRegistry implements SecurityDefinitionCatalog {
       groups: input.groups ?? [],
       roles: input.roles ?? [],
       membershipPolicies: input.membershipPolicies ?? [],
-      applicationIds: input.applicationIds ?? APPLICATION_IDS,
       objectTypeIds: input.objectTypeIds,
       datasetIds: input.datasetIds,
       actionIds: input.actionIds,
@@ -61,13 +58,10 @@ export class SecurityRegistry implements SecurityDefinitionCatalog {
       pipelineIds: input.pipelineIds,
       agentAvailable: input.agentAvailable,
       connectorIds: input.connectorIds,
-      observableIds: new Set(["logs", "aiUsage"]),
-      manageableIds: new Set(["aiUsage"]),
       shareIds: input.shareIds,
     })
 
     const universe = {
-      applicationIds: input.applicationIds ?? APPLICATION_IDS,
       objectTypeIds: input.objectTypeIds ?? new Set<string>(),
       datasetIds: input.datasetIds ?? new Set<string>(),
       actionIds: input.actionIds ?? new Set<string>(),
@@ -75,8 +69,6 @@ export class SecurityRegistry implements SecurityDefinitionCatalog {
       syncIds: input.syncIds ?? new Set<string>(),
       pipelineIds: input.pipelineIds ?? new Set<string>(),
       connectorIds: input.connectorIds ?? new Set<string>(),
-      observableIds: new Set(["logs", "aiUsage"]),
-      manageableIds: new Set(["aiUsage"]),
       shareIds: input.shareIds ?? new Set<string>(),
       getSubTypes: input.getSubTypes ?? (() => []),
     }

package/src/security/types.ts

@@ -1,5 +1,3 @@
-import type { AuthSessionAudience } from "../auth/audience"
-
 export interface GroupDefinition<TId extends string = string> {
   readonly kind: "group"
   readonly id: TId
@@ -48,19 +46,6 @@ export type Selection =
   | { readonly all: true; readonly except: readonly string[] }
   | { readonly all: false; readonly ids: readonly string[] }
 
-export interface ApplicationDefinition<TId extends AuthSessionAudience = AuthSessionAudience> {
-  readonly kind: "application"
-  readonly id: TId
-  readonly label: string
-}
-
-export interface AccessGrant {
-  readonly kind: "grant"
-  readonly capability: "access"
-  readonly target: "application"
-  readonly selection: Selection
-}
-
 export type ViewGrantTarget = "object" | "dataset"
 
 export interface ViewGrant<TTarget extends ViewGrantTarget = ViewGrantTarget> {
@@ -133,25 +118,34 @@ export interface AgentRunGrant {
 
 export type ObserveGrantTarget = "logs" | "aiUsage"
 
+/** Read the project's logs or its AI usage. Each is one surface, so there is nothing to select. */
 export interface ObserveGrant {
   readonly kind: "grant"
   readonly capability: "observe"
   readonly target: ObserveGrantTarget
-  readonly selection: Selection
 }
 
 export type ManageGrantTarget = "connector" | "aiUsage"
 
-/** Manage a selected connector or the project's AI usage-limit policies. */
-export interface ManageGrant<TTarget extends ManageGrantTarget = ManageGrantTarget> {
-  readonly kind: "grant"
-  readonly capability: "manage"
-  readonly target: TTarget
-  readonly selection: Selection
-}
+/**
+ * Manage the selected connectors, or the project's AI usage-limit policies. AI usage is one
+ * surface, so its grant selects nothing.
+ */
+export type ManageGrant<TTarget extends ManageGrantTarget = ManageGrantTarget> =
+  TTarget extends "connector"
+    ? {
+        readonly kind: "grant"
+        readonly capability: "manage"
+        readonly target: TTarget
+        readonly selection: Selection
+      }
+    : {
+        readonly kind: "grant"
+        readonly capability: "manage"
+        readonly target: TTarget
+      }
 
 export type GrantDefinition =
-  | AccessGrant
   | ViewGrant
   | EditGrant
   | AppendGrant
@@ -175,7 +169,7 @@ export interface RoleDefinition<TId extends string = string> {
   readonly clearances?: readonly string[]
 }
 
-export type MembershipOperation = "invite" | "assignGroups" | "suspend"
+export type MembershipOperation = "invite" | "assignGroups" | "suspend" | "serviceAccounts"
 
 export interface MembershipPolicyDefinition<TId extends string = string> {
   readonly kind: "membershipPolicy"

package/src/security/validation.ts

@@ -1,4 +1,9 @@
-import { GRANT_KINDS, type GrantUniverseKey, grantKindOf } from "../authorization/grant-kinds"
+import {
+  GRANT_KINDS,
+  type GrantUniverseKey,
+  grantKindOf,
+  isSingletonGrantKind,
+} from "../authorization/grant-kinds"
 import { SecurityValidationError } from "./errors"
 import { isMembershipOperation } from "./membership-policies"
 import type {
@@ -22,11 +27,10 @@ type RegisteredUniverses = Partial<Record<GrantUniverseKey, ReadonlySet<string>>
  *
  * Written as a total `Record<GrantCapability, true>` rather than a bare array so a capability added
  * to `GrantDefinition` is a compile error here — the same discipline `GRANT_KINDS` uses. The
- * hand-written `capability !== "access" && …` chain this replaces would have accepted the new
+ * hand-written `capability !== "view" && …` chain this replaces would have accepted the new
  * capability at startup and then died on `GRANT_KINDS[kind].universeKey`.
  */
 const GRANT_CAPABILITIES = Object.keys({
-  access: true,
   view: true,
   edit: true,
   append: true,
@@ -102,7 +106,7 @@ function assertMembershipOperationArray(
   for (const item of value) {
     if (!isMembershipOperation(item)) {
       throw createError(
-        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`
+        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`
       )
     }
   }
@@ -231,10 +235,6 @@ export function assertGrantDefinition(
     )
   }
 
-  if (value.capability === "access" && value.target !== "application") {
-    throw createError(`[Sixb] ${field} access grant target must be 'application'.`)
-  }
-
   if (value.capability === "view" && value.target !== "object" && value.target !== "dataset") {
     throw createError(`[Sixb] ${field} view grant target must be 'object' or 'dataset'.`)
   }
@@ -259,9 +259,13 @@ export function assertGrantDefinition(
     throw createError(`[Sixb] ${field} manage grant target must be 'connector' or 'aiUsage'.`)
   }
 
-  if (value.capability === "run" && value.target === "agent") {
+  // The agent, logs and AI usage are one surface each, so their grants select nothing. The checks
+  // above settled the capability and target, so the kind is known.
+  if (isSingletonGrantKind(grantKindOf(value as unknown as GrantDefinition))) {
     if (value.selection !== undefined) {
-      throw createError(`[Sixb] ${field} agent run grant must not declare a selection.`)
+      throw createError(
+        `[Sixb] ${field} ${value.capability} grant on '${value.target}' must not declare a selection.`
+      )
     }
     return
   }
@@ -332,8 +336,6 @@ export function validateSecurityDefinitionsAtStartup(input: {
   readonly groups: readonly GroupDefinition[]
   readonly membershipPolicies: readonly MembershipPolicyDefinition[]
   readonly roles?: readonly RoleDefinition[]
-  /** Registered browser application ids — when provided, access grants must reference them. */
-  readonly applicationIds?: ReadonlySet<string>
   /** Registered object type ids — when provided, view grants must reference them. */
   readonly objectTypeIds?: ReadonlySet<string>
   /** Registered dataset ids — when provided, dataset view grants must reference them. */
@@ -348,10 +350,6 @@ export function validateSecurityDefinitionsAtStartup(input: {
   readonly pipelineIds?: ReadonlySet<string>
   /** Whether the project's single conversational Agent is configured. */
   readonly agentAvailable?: boolean
-  /** Registered observability surfaces. */
-  readonly observableIds?: ReadonlySet<string>
-  /** Registered singleton management surfaces. */
-  readonly manageableIds?: ReadonlySet<string>
   /** Registered connector ids — when provided, manage grants must reference them. */
   readonly connectorIds?: ReadonlySet<string>
   /** Registered Share ids — when provided, share grants must reference them. */
@@ -496,7 +494,11 @@ function assertGrantReferences(
     }
     return
   }
-  const spec = GRANT_KINDS[grantKindOf(grant)]
+  // Logs and AI usage are always there; only targeted grants name ids to check.
+  if (!("selection" in grant)) return
+  const kind = grantKindOf(grant)
+  if (isSingletonGrantKind(kind)) return
+  const spec = GRANT_KINDS[kind]
   const universe = registered[spec.universeKey]
 
   if (!universe) {

package/src/storage/action-runs/idempotency.ts

@@ -1,13 +1,6 @@
 import type { ActionSubject } from "../../actions"
 import { stableJsonStringify } from "../../json"
-import type {
-  ActionRunEffectsRecord,
-  ActionRunPhase,
-  ActionRunRecord,
-  ActionRunWritebackRecord,
-  FinishActionRunInput,
-  QueueActionRunInput,
-} from "./types"
+import type { ActionRunEffectsRecord, ActionRunRecord, ActionRunWritebackRecord } from "./types"
 
 export function actionSubjectsEqual(left: ActionSubject, right: ActionSubject): boolean {
   if (left.kind !== right.kind) return false
@@ -20,6 +13,18 @@ export function actionRunParamsEqual(left: unknown, right: unknown): boolean {
   return stableJsonStringify(left) === stableJsonStringify(right)
 }
 
+/** Whether two runs carry the same request: the same Action, subject, and params. */
+export function actionRunRequestsEqual(
+  left: Pick<ActionRunRecord, "actionId" | "subject" | "params">,
+  right: Pick<ActionRunRecord, "actionId" | "subject" | "params">
+): boolean {
+  return (
+    left.actionId === right.actionId &&
+    actionSubjectsEqual(left.subject, right.subject) &&
+    actionRunParamsEqual(left.params, right.params)
+  )
+}
+
 export type ActionRunPhaseRecord = ActionRunWritebackRecord | ActionRunEffectsRecord
 
 export function actionRunPhaseRecordsEqual(
@@ -29,39 +34,6 @@ export function actionRunPhaseRecordsEqual(
   return actionRunParamsEqual(stripPhaseRecordCompletedAt(left), stripPhaseRecordCompletedAt(right))
 }
 
-export function finishActionRunPhase(
-  input: FinishActionRunInput,
-  current: ActionRunPhase | null | undefined
-): ActionRunPhase {
-  if (input.status === "succeeded") {
-    return input.phase ?? current ?? "validation"
-  }
-
-  return input.error.details.phase
-}
-
-export function canRequeueActionRunAfterEnqueueFailure(
-  existing: ActionRunRecord,
-  input: QueueActionRunInput
-): boolean {
-  return (
-    existing.status === "failed" &&
-    existing.phase === "enqueue" &&
-    existing.executionId === input.executionId &&
-    existing.error?.retryable === true &&
-    existing.actionId === input.actionId &&
-    existing.idempotencyKey === input.idempotencyKey &&
-    actionSubjectsEqual(existing.subject, input.subject) &&
-    actionRunParamsEqual(existing.params, input.params)
-  )
-}
-
-export function isTerminalActionRun(record: Pick<ActionRunRecord, "status">): boolean {
-  return (
-    record.status === "succeeded" || record.status === "failed" || record.status === "cancelled"
-  )
-}
-
 function stripPhaseRecordCompletedAt(
   record: ActionRunPhaseRecord
 ): Omit<ActionRunPhaseRecord, "completedAt"> {