@sixb/core 0.1.19 → 0.1.20

package/dist/authorization/decision.d.ts

@@ -9,15 +9,11 @@
  * unregistered authority is denied; only an explicitly registered trusted or disabled execution
  * is unrestricted.
  */
-import type { AuthSessionAudience } from "../auth/audience";
 import { type ResolvedRuntimeAuthorization } from "../execution/authorization";
 import type { ExecutionContext, RuntimeAuthorization } from "../execution/types";
 import type { AuthorizationContext } from "./types";
 /** Something a principal may attempt, paired with the resource it targets. */
 export type AuthzRequest = {
-    readonly kind: "application.access";
-    readonly audience: AuthSessionAudience;
-} | {
     readonly kind: "object.view";
     readonly objectTypeId: string;
 } | {

package/dist/authorization/decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/authorization/decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EACL,KAAK,4BAA4B,EAGlC,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAGhF,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,SAAS,CAAA;AAE/D,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAEvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;CAC9C;AAgED,oEAAoE;AACpE,wBAAgB,QAAQ,CACtB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,aAAa,CAOf;AAED,wBAAgB,SAAS,CACvB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,OAAO,CAET;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAkBxF;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAI3F;AAED,2FAA2F;AAC3F,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CASpE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAGpF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/F;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUpF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,GAAG;IAAE,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAA;CAAE,EACpF,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,MAAM,GAChB,IAAI,CAiBN"}
+{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/authorization/decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,KAAK,4BAA4B,EAGlC,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAGhF,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,SAAS,CAAA;AAE/D,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAEvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;CAC9C;AAqDD,oEAAoE;AACpE,wBAAgB,QAAQ,CACtB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,aAAa,CAOf;AAED,wBAAgB,SAAS,CACvB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,OAAO,CAET;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAkBxF;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAI3F;AAED,2FAA2F;AAC3F,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CASpE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAGpF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/F;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUpF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,GAAG;IAAE,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAA;CAAE,EACpF,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,MAAM,GAChB,IAAI,CAiBN"}

package/dist/authorization/grant-kinds.d.ts

@@ -7,13 +7,13 @@
  * resolved `GrantIndex` all key off it, so adding a grant family is a single
  * entry in `GRANT_KINDS` plus the compile errors that forces at every consumer.
  */
-import type { AgentRunGrant, GrantDefinition } from "../security/types";
-export type GrantKind = "access:application" | "view:object" | "view:dataset" | "edit:object" | "append:telemetry" | "apply:action" | "share:share" | "run:workflow" | "run:sync" | "run:pipeline" | "run:agent" | "observe:logs" | "observe:aiUsage" | "manage:connector" | "manage:aiUsage";
-export type SingletonGrantKind = "run:agent";
+import type { GrantDefinition } from "../security/types";
+export type GrantKind = "view:object" | "view:dataset" | "edit:object" | "append:telemetry" | "apply:action" | "share:share" | "run:workflow" | "run:sync" | "run:pipeline" | "run:agent" | "observe:logs" | "observe:aiUsage" | "manage:connector" | "manage:aiUsage";
+/** Capabilities over one project-wide surface: held or not, with no ids to select. */
+export type SingletonGrantKind = "run:agent" | "observe:logs" | "observe:aiUsage" | "manage:aiUsage";
 export type TargetedGrantKind = Exclude<GrantKind, SingletonGrantKind>;
 /** Registered id universes a grant kind ranges over, plus subtype expansion. */
 export interface GrantUniverse {
-    readonly applicationIds: ReadonlySet<string>;
     readonly objectTypeIds: ReadonlySet<string>;
     readonly datasetIds: ReadonlySet<string>;
     readonly actionIds: ReadonlySet<string>;
@@ -21,9 +21,7 @@ export interface GrantUniverse {
     readonly workflowIds: ReadonlySet<string>;
     readonly syncIds: ReadonlySet<string>;
     readonly pipelineIds: ReadonlySet<string>;
-    readonly observableIds: ReadonlySet<string>;
     readonly connectorIds: ReadonlySet<string>;
-    readonly manageableIds: ReadonlySet<string>;
     readonly getSubTypes: (objectTypeId: string) => readonly string[];
 }
 /** The registered-id sets a grant kind validates against (no subtype hook). */
@@ -52,10 +50,10 @@ export declare const GRANT_KINDS: {
     readonly [TKind in GrantKind]: TKind extends SingletonGrantKind ? SingletonGrantKindSpec : TargetedGrantKindSpec;
 };
 export declare const GRANT_KIND_KEYS: readonly GrantKind[];
+export declare const SINGLETON_GRANT_KIND_KEYS: SingletonGrantKind[];
 export declare const TARGETED_GRANT_KIND_KEYS: TargetedGrantKind[];
+export declare function isSingletonGrantKind(kind: GrantKind): kind is SingletonGrantKind;
 /** The grant kind a stored grant resolves to. */
-export declare function grantKindOf(grant: AgentRunGrant): SingletonGrantKind;
-export declare function grantKindOf(grant: Exclude<GrantDefinition, AgentRunGrant>): TargetedGrantKind;
 export declare function grantKindOf(grant: GrantDefinition): GrantKind;
 /** Mutable grant index: booleans for singleton capabilities, id sets for selected resources. */
 export type MutableGrantIndex = {

package/dist/authorization/grant-kinds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-kinds.d.ts","sourceRoot":"","sources":["../../src/authorization/grant-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEvE,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,aAAa,GACb,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,aAAa,GACb,cAAc,GACd,UAAU,GACV,cAAc,GACd,WAAW,GACX,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,CAAA;AAEpB,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAC5C,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;AAEtE,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CAClE;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,aAAa,EAAE,aAAa,CAAC,CAAA;AAE1E,UAAU,qBAAqB;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAChC;AAED,UAAU,sBAAsB;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE;IACxB,QAAQ,EAAE,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAC3D,sBAAsB,GACtB,qBAAqB;CAiF1B,CAAA;AAED,eAAO,MAAM,eAAe,EAA+B,SAAS,SAAS,EAAE,CAAA;AAC/E,eAAO,MAAM,wBAAwB,qBAEpC,CAAA;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,kBAAkB,CAAA;AACrE,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,iBAAiB,CAAA;AAC9F,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,CAAA;AAwB9D,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG;KAC7B,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAAG,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC;CAC/E,CAAA;AAED,wBAAgB,cAAc,IAAI,iBAAiB,CAkBlD"}
+{"version":3,"file":"grant-kinds.d.ts","sourceRoot":"","sources":["../../src/authorization/grant-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD,MAAM,MAAM,SAAS,GACjB,aAAa,GACb,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,aAAa,GACb,cAAc,GACd,UAAU,GACV,cAAc,GACd,WAAW,GACX,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,CAAA;AAEpB,sFAAsF;AACtF,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,cAAc,GAAG,iBAAiB,GAAG,gBAAgB,CAAA;AACpG,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;AAEtE,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CAClE;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,aAAa,EAAE,aAAa,CAAC,CAAA;AAE1E,UAAU,qBAAqB;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAChC;AAED,UAAU,sBAAsB;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE;IACxB,QAAQ,EAAE,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAC3D,sBAAsB,GACtB,qBAAqB;CA4E1B,CAAA;AAED,eAAO,MAAM,eAAe,EAA+B,SAAS,SAAS,EAAE,CAAA;AAC/E,eAAO,MAAM,yBAAyB,sBAErC,CAAA;AACD,eAAO,MAAM,wBAAwB,qBAEpC,CAAA;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,IAAI,kBAAkB,CAEhF;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,CAmB7D;AAED,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG;KAC7B,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAAG,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC;CAC/E,CAAA;AAED,wBAAgB,cAAc,IAAI,iBAAiB,CAiBlD"}

package/dist/authorization/index.d.ts

@@ -1,4 +1,3 @@
-export { canAccessApplication, isApplicationAccessControlled } from "./application-access";
 export type { AuthzDecision, AuthzRequest } from "./decision";
 export { assertAuthorized, assertCanAppendTelemetry, assertCanEdit, assertCanManageConnector, assertPrivileged, assertProviderAccess, assertRuntimeAuthorizationBound, evaluate, isAllowed, isRuntimeAllowed, } from "./decision";
 export { AuthorizationError } from "./errors";

package/dist/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AAC1F,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,+BAA+B,EAC/B,QAAQ,EACR,SAAS,EACT,gBAAgB,GACjB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,+BAA+B,EAC/B,QAAQ,EACR,SAAS,EACT,gBAAgB,GACjB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/authorization/index.js

@@ -11,8 +11,6 @@ import {
   assertCanManageConnector2,
   assertPrivileged2,
   assertProviderAccess2,
-  isApplicationAccessControlled2,
-  canAccessApplication2,
   canViewEvent2,
   resolveRoleGrants2,
   resolveAuthorizationContext2,
@@ -23,10 +21,10 @@ import {
   canViewProjectionRun2,
   canViewProjection2,
   emptyGrantIndex2
-} from "../chunk-y7rqfrgg.js";
+} from "../chunk-d0bqz29d.js";
 import"../chunk-v4jbb3rs.js";
 import"../chunk-hvsb78a1.js";
-import"../chunk-enpsx8k5.js";
+import"../chunk-gsjm1wms.js";
 import"../chunk-jhm3zsa7.js";
 import"../chunk-8mx7qw3y.js";
 import"../chunk-z3y5kg1x.js";
@@ -39,7 +37,6 @@ export {
   assertPrivileged2 as assertPrivileged,
   assertProviderAccess2 as assertProviderAccess,
   assertRuntimeAuthorizationBound2 as assertRuntimeAuthorizationBound,
-  canAccessApplication2 as canAccessApplication,
   canViewActionRun2 as canViewActionRun,
   canViewEvent2 as canViewEvent,
   canViewPipelineRun2 as canViewPipelineRun,
@@ -50,10 +47,9 @@ export {
   emptyGrantIndex2 as emptyGrantIndex,
   evaluate2 as evaluate,
   isAllowed2 as isAllowed,
-  isApplicationAccessControlled2 as isApplicationAccessControlled,
   isRuntimeAllowed2 as isRuntimeAllowed,
   resolveAuthorizationContext2 as resolveAuthorizationContext,
   resolveRoleGrants2 as resolveRoleGrants
 };
 
-//# debugId=15FFF966D0EFFC1164756E2164756E21
+//# debugId=7830C8AB397B7D9564756E2164756E21

package/dist/authorization/index.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "15FFF966D0EFFC1164756E2164756E21",
+  "debugId": "7830C8AB397B7D9564756E2164756E21",
   "names": []
 }

package/dist/authorization/resolve.d.ts

@@ -7,7 +7,7 @@ import type { AuthorizationContext, GrantIndex, ResolvedRole } from "./types";
  *
  * Broad grants (`every.object().except([...])`) expand against the registered
  * universe; object-type grants also expand to subtypes. Resource grants become
- * id sets; the project Agent grant becomes a boolean.
+ * id sets; grants on one project-wide surface (the Agent, logs, AI usage) become booleans.
  * The per-kind universe and subtype rules come from the `GRANT_KINDS` table, so
  * this loop never enumerates targets by hand.
  */

package/dist/authorization/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/authorization/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,aAAa,CAAA;AAC5D,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE7E;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,GAAG,UAAU,CAmB3F;AA4BD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CACxC,GAAG,oBAAoB,CAiCvB"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/authorization/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,aAAa,CAAA;AAC5D,OAAO,EAGL,KAAK,aAAa,EAKnB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE7E;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,GAAG,UAAU,CAqB3F;AA4BD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CACxC,GAAG,oBAAoB,CAiCvB"}

package/dist/bootstrap/index.js

@@ -5,22 +5,23 @@ import {
   listProjectModules2,
   discoverProjectDefinitions2,
   listOntologyModuleFiles
-} from "../chunk-80mc0971.js";
+} from "../chunk-ren4kg2j.js";
 import"../chunk-jhm3zsa7.js";
 import"../chunk-z3y5kg1x.js";
 import"../chunk-hvsb78a1.js";
 import"../chunk-v9xd5wzd.js";
-import"../chunk-enpsx8k5.js";
+import"../chunk-gsjm1wms.js";
 import"../chunk-8mx7qw3y.js";
-import"../chunk-y7rqfrgg.js";
+import"../chunk-d0bqz29d.js";
 import"../chunk-v4jbb3rs.js";
-import"../chunk-1f7wpmyp.js";
+import"../chunk-rrzt8jdy.js";
 import"../chunk-7n440zgt.js";
+import"../chunk-n33z5bjw.js";
 import"../chunk-a40ad1ft.js";
 import"../chunk-b38szspf.js";
-import"../chunk-3gnrh4ve.js";
-import"../chunk-xt1zt7gv.js";
-import"../chunk-2jntasmh.js";
+import"../chunk-vpq4shxz.js";
+import"../chunk-es1gxsbf.js";
+import"../chunk-hcbyfxbe.js";
 import"../chunk-pqajwytd.js";
 import"../chunk-29yx306f.js";
 import"../chunk-gfdh9kqa.js";
@@ -29,10 +30,9 @@ import"../chunk-s54c868q.js";
 import"../chunk-ere85b8y.js";
 import"../chunk-4as3wt1c.js";
 import"../chunk-h89wz928.js";
-import"../chunk-7kg3k1m9.js";
+import"../chunk-9w055r5b.js";
 import"../chunk-tw03bsmb.js";
-import"../chunk-bpgy64fw.js";
-import"../chunk-j2bp5ryw.js";
+import"../chunk-d09tj99x.js";
 import"../chunk-pbcbn83d.js";
 import"../chunk-qczk96d9.js";
 import"../chunk-mmagke4x.js";
@@ -40,39 +40,39 @@ import"../chunk-hn2r7z41.js";
 import"../chunk-9ybhtmg4.js";
 import"../chunk-jmfet9r4.js";
 import"../chunk-qf954wje.js";
-import"../chunk-4tcx876c.js";
-import"../chunk-ey3pyej1.js";
+import"../chunk-bx9q3cwv.js";
+import"../chunk-6c6sn0bh.js";
 import"../chunk-fa02jy15.js";
-import"../chunk-wwdfe68s.js";
+import"../chunk-4vyr1j8f.js";
 import"../chunk-vyf9kfqf.js";
 import"../chunk-pfp1txq2.js";
 import"../chunk-5e43w60z.js";
 import"../chunk-3zxk45er.js";
 import"../chunk-5a4a52tq.js";
-import"../chunk-wz0xs816.js";
-import"../chunk-rz53yb4v.js";
-import"../chunk-6gmfggss.js";
+import"../chunk-tg2cw67r.js";
+import"../chunk-0yh890a4.js";
+import"../chunk-t7x8dmn0.js";
 import"../chunk-99nd4rc1.js";
-import"../chunk-zrmy8zvw.js";
+import"../chunk-hjzdd750.js";
 import"../chunk-3qms4nax.js";
 import"../chunk-m427qgq0.js";
-import"../chunk-tjb1mk5t.js";
+import"../chunk-x6m907x7.js";
 import"../chunk-bkpke1sg.js";
 import"../chunk-yxd3nnqt.js";
 import"../chunk-nq6gpjt7.js";
 import"../chunk-fb3feg1e.js";
-import"../chunk-rhg02hxq.js";
+import"../chunk-dk8tkk5f.js";
 import"../chunk-1sr8ryzk.js";
 import"../chunk-tpn40322.js";
-import"../chunk-85yvv5n0.js";
+import"../chunk-k6q3n2sc.js";
 import"../chunk-x9v4cx1d.js";
 import"../chunk-1k89ecfr.js";
-import"../chunk-t6vq7bff.js";
-import"../chunk-52bk93x8.js";
+import"../chunk-xfs8x8m9.js";
+import"../chunk-fkgc1wt8.js";
 import"../chunk-mfs23znk.js";
-import"../chunk-7mbzgd9m.js";
-import"../chunk-d2ync1v3.js";
-import"../chunk-nre82s12.js";
+import"../chunk-1zq2p6g0.js";
+import"../chunk-yevzdx4y.js";
+import"../chunk-9dmt152s.js";
 import"../chunk-br3k6qbf.js";
 import"../chunk-s16apyk9.js";
 import"../chunk-rj69qcrd.js";
@@ -80,7 +80,7 @@ import {
   RuntimeError2
 } from "../chunk-m4ehq95f.js";
 import"../chunk-7t429e3f.js";
-import"../chunk-bwjcehza.js";
+import"../chunk-way52z4h.js";
 import"../chunk-c85m1hyj.js";
 // src/bootstrap/ontology-type-manifest.ts
 import { access, mkdir, readFile, writeFile } from "fs/promises";

package/dist/{chunk-aff7cyea.js → chunk-0rbyz4qy.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-jhm3zsa7.js";
 import {
   SecurityValidationError2
-} from "./chunk-xt1zt7gv.js";
+} from "./chunk-es1gxsbf.js";
 import {
   OntologyRegistry2
-} from "./chunk-bpgy64fw.js";
+} from "./chunk-d09tj99x.js";
 import {
   captureSixbFailure2,
   isSixbError2
@@ -16,16 +16,20 @@ import {
   captureExecutionScope,
   resolveExecutionScopeAuthorization,
   AuthorizationError2
-} from "./chunk-y7rqfrgg.js";
+} from "./chunk-d0bqz29d.js";
+import {
+  isMigrationCapableStorage2,
+  checkStorageSchema2
+} from "./chunk-n33z5bjw.js";
 import {
   SecurityRegistry,
   AuthRuntime2
-} from "./chunk-3gnrh4ve.js";
+} from "./chunk-vpq4shxz.js";
 import {
   AuthRuntimeError2,
   isMagicLinkAuthStrategy2,
   isOidcAuthStrategy2
-} from "./chunk-2jntasmh.js";
+} from "./chunk-hcbyfxbe.js";
 import {
   indexModelBindings,
   assertRerankingModel,
@@ -36,11 +40,7 @@ import {
 } from "./chunk-29yx306f.js";
 import {
   FileUploadSessionError2
-} from "./chunk-7kg3k1m9.js";
-import {
-  isMigrationCapableStorage2,
-  checkStorageSchema2
-} from "./chunk-j2bp5ryw.js";
+} from "./chunk-9w055r5b.js";
 import {
   ActionRegistry2,
   createAuthorizedObjectReader,
@@ -54,7 +54,7 @@ import {
   createBoundSixb,
   ActionRunExecutor,
   registerActionRunExecutor
-} from "./chunk-ey3pyej1.js";
+} from "./chunk-6c6sn0bh.js";
 import {
   attachSixbErrorReporter2,
   shareSixbErrorReporter2
@@ -63,7 +63,7 @@ import {
   registerOntologyMutationRuntime2,
   createOntologyMutationRuntime2,
   ModelExecutionSession
-} from "./chunk-wwdfe68s.js";
+} from "./chunk-4vyr1j8f.js";
 import {
   registerConnectorConnectionCallbackProcess
 } from "./chunk-5a4a52tq.js";
@@ -78,14 +78,14 @@ import {
   isConnectorStorageError,
   storageBoundaryError,
   recoverConnectorFailure
-} from "./chunk-wz0xs816.js";
+} from "./chunk-tg2cw67r.js";
 import {
   assertDatasetDefinition2
-} from "./chunk-rz53yb4v.js";
+} from "./chunk-0yh890a4.js";
 import {
   ProjectionRegistry2,
   createOntologyMaterializer2
-} from "./chunk-zrmy8zvw.js";
+} from "./chunk-hjzdd750.js";
 import {
   LoggingService2
 } from "./chunk-3qms4nax.js";
@@ -113,22 +113,22 @@ import {
   validateSharesAtStartup,
   discoverOntologySources,
   discoverProjectDefinitions2
-} from "./chunk-80mc0971.js";
+} from "./chunk-ren4kg2j.js";
 import {
   bindEmbeddingModels,
   createVectorIndexingRuntime,
   registerVectorIndexingRuntime,
   getApiPublicOrigin
-} from "./chunk-kyzq4wy9.js";
+} from "./chunk-5j58wjct.js";
 import {
   registerProjectionRegistry2
-} from "./chunk-q1vkr2ys.js";
+} from "./chunk-6p49a5cq.js";
 import {
   SyncValidationError2
-} from "./chunk-t6vq7bff.js";
+} from "./chunk-xfs8x8m9.js";
 import {
   ensureExecutionRecord2
-} from "./chunk-nre82s12.js";
+} from "./chunk-9dmt152s.js";
 import {
   ConnectorConnectionStorageError2,
   CONNECTOR_CONNECTION_RUN_FAILURE_CODES2
@@ -4087,4 +4087,4 @@ async function createSixb2(options) {
 }
 export { WebhookValidationError2, defineWebhook2, webhookConnector2, UnverifiedWebhookError2, resolveWebhookVerification2, warnUnverifiedWebhook2, SixbHost2, createSixb2 };
 
-//# debugId=FFB103AB39C9032D64756E2164756E21
+//# debugId=6128FDB623B490B964756E2164756E21