@sixb/core 0.1.19 → 0.1.20

package/src/auth/types.ts

@@ -11,7 +11,6 @@ import type {
   SessionRecord,
   UserRecord,
 } from "../storage/auth"
-import type { AuthSessionAudience, AuthSessionAudienceOptions } from "./audience"
 
 export type Principal =
   | { readonly type: "user"; readonly id: string }
@@ -63,7 +62,6 @@ export interface InvitationDeliveryInput {
   readonly projectId: string
   readonly authStorage: AuthStorage
   readonly invitation: InvitationRecord
-  readonly audience: AuthSessionAudience
   readonly returnTo: string
   readonly requestOrigin: string
   /** Return the delivered link once so the inviter can copy it through an approved channel. */
@@ -98,7 +96,6 @@ export interface MagicLinkRequestInput {
   readonly projectId: string
   readonly authStorage: AuthStorage
   readonly email: string
-  readonly audience: AuthSessionAudience
   readonly returnTo: string
   readonly requestOrigin: string
   /**
@@ -140,7 +137,6 @@ export interface MagicLinkCallbackInput {
 }
 
 export interface MagicLinkCallbackResult extends CompleteSignInResult {
-  readonly audience: AuthSessionAudience
   readonly returnTo: string
 }
 
@@ -182,7 +178,6 @@ export interface MagicLinkAuthStrategy extends InvitationDeliveryAuthStrategy {
 export interface OidcStartSignInInput {
   readonly projectId: string
   readonly authStorage: AuthStorage
-  readonly audience: AuthSessionAudience
   readonly returnTo: string
   readonly requestOrigin: string
   readonly now?: Date
@@ -208,7 +203,6 @@ export interface OidcCallbackInput {
 }
 
 export interface OidcCallbackResult extends CompleteSignInResult {
-  readonly audience: AuthSessionAudience
   readonly returnTo: string
 }
 
@@ -277,11 +271,14 @@ export interface MembershipOperationCapabilities {
   readonly invite: boolean
   readonly assignGroups: boolean
   readonly suspend: boolean
+  readonly serviceAccounts: boolean
 }
 
 export interface GetMembershipOptionsResult {
   /** Groups the caller may assign to a member (the `assignGroups` scope). */
   readonly groups: readonly InvitationGroupOption[]
+  /** Groups the caller may place a service account in (the `serviceAccounts` scope). */
+  readonly serviceAccountGroups: readonly InvitationGroupOption[]
   readonly capabilities: MembershipOperationCapabilities
 }
 
@@ -377,7 +374,7 @@ export interface ReactivateMemberResult {
 /** `"session"` reads only the cookie; `"any"` reads a bearer access token, else the cookie. */
 export type AuthCredentialSource = "session" | "any"
 
-export interface AuthSessionResolutionOptions extends AuthSessionAudienceOptions {
+export interface AuthSessionResolutionOptions {
   readonly credentialSource?: AuthCredentialSource
   /** Marks this request as eligible to renew a near-expiry browser session. */
   readonly sessionActivity?: "foreground"
@@ -385,7 +382,6 @@ export interface AuthSessionResolutionOptions extends AuthSessionAudienceOptions
 
 /** Where an invitation link sends its recipient. */
 export interface InvitationDestination {
-  readonly audience: AuthSessionAudience
   readonly requestOrigin: string
   readonly returnTo: string
 }

package/src/auth/validation.ts

@@ -22,8 +22,6 @@ export const MAX_AUTH_INVITATION_TTL_MS = 30 * DAY
  */
 export const DEFAULT_AUTH_SESSION_CACHE_TTL_MS = 5_000
 
-export { resolveAuthSessionAudience } from "./audience"
-
 export function resolveAuthConfig(config: SixbAuthConfig | undefined): ResolvedAuthConfig {
   if (!config) {
     return {

package/src/authorization/decision.ts

@@ -10,7 +10,6 @@
  * is unrestricted.
  */
 
-import type { AuthSessionAudience } from "../auth/audience"
 import {
   type ResolvedRuntimeAuthorization,
   resolveExecutionScopeAuthorization,
@@ -18,12 +17,11 @@ import {
 } from "../execution/authorization"
 import type { ExecutionContext, RuntimeAuthorization } from "../execution/types"
 import { AuthorizationError } from "./errors"
-import type { GrantKind } from "./grant-kinds"
+import type { SingletonGrantKind, TargetedGrantKind } from "./grant-kinds"
 import type { AuthorizationContext, GrantIndex } from "./types"
 
 /** Something a principal may attempt, paired with the resource it targets. */
 export type AuthzRequest =
-  | { readonly kind: "application.access"; readonly audience: AuthSessionAudience }
   | { readonly kind: "object.view"; readonly objectTypeId: string }
   | { readonly kind: "dataset.view"; readonly datasetId: string }
   | { readonly kind: "object.edit"; readonly objectTypeId: string }
@@ -59,13 +57,11 @@ interface AuthorizedRuntime {
 // the two can never drift. `kind` is the resolved-index key, so enforcement is
 // a direct lookup with no per-target dispatch.
 type Atom =
-  | { readonly kind: "run:agent" }
-  | { readonly kind: Exclude<GrantKind, "run:agent">; readonly id: string }
+  | { readonly kind: SingletonGrantKind }
+  | { readonly kind: TargetedGrantKind; readonly id: string }
 
 function atomsFor(request: AuthzRequest): readonly Atom[] {
   switch (request.kind) {
-    case "application.access":
-      return [{ kind: "access:application", id: request.audience }]
     case "object.view":
       return [{ kind: "view:object", id: request.objectTypeId }]
     case "dataset.view":
@@ -87,11 +83,11 @@ function atomsFor(request: AuthzRequest): readonly Atom[] {
     case "agent.run":
       return [{ kind: "run:agent" }]
     case "logs.observe":
-      return [{ kind: "observe:logs", id: "logs" }]
+      return [{ kind: "observe:logs" }]
     case "aiUsage.observe":
-      return [{ kind: "observe:aiUsage", id: "aiUsage" }]
+      return [{ kind: "observe:aiUsage" }]
     case "aiUsage.manage":
-      return [{ kind: "manage:aiUsage", id: "aiUsage" }]
+      return [{ kind: "manage:aiUsage" }]
     case "connector.manage":
       return [{ kind: "manage:connector", id: request.connectorId }]
     case "object.query":
@@ -100,20 +96,11 @@ function atomsFor(request: AuthzRequest): readonly Atom[] {
 }
 
 function atomKey(atom: Atom): string {
-  if (atom.kind === "run:agent") return atom.kind
-  if (
-    atom.kind === "observe:logs" ||
-    atom.kind === "observe:aiUsage" ||
-    atom.kind === "manage:aiUsage"
-  ) {
-    return atom.kind
-  }
-  return `${atom.kind}:${atom.id}`
+  return "id" in atom ? `${atom.kind}:${atom.id}` : atom.kind
 }
 
 function holds(grants: GrantIndex, atom: Atom): boolean {
-  if (atom.kind === "run:agent") return grants[atom.kind]
-  return grants[atom.kind].has(atom.id)
+  return "id" in atom ? grants[atom.kind].has(atom.id) : grants[atom.kind]
 }
 
 /** Resolve a request against a principal's grants. Never throws. */
@@ -267,8 +254,6 @@ function deniedMessage(
 ): string {
   const principalId = authorization?.principal.id ?? "unknown"
   switch (request.kind) {
-    case "application.access":
-      return `[Sixb] Principal '${principalId}' is not allowed to access application '${request.audience}'.`
     case "object.view":
       return `[Sixb] Principal '${principalId}' is not allowed to view object type '${request.objectTypeId}'.`
     case "dataset.view":

package/src/authorization/grant-kinds.ts

@@ -8,10 +8,9 @@
  * entry in `GRANT_KINDS` plus the compile errors that forces at every consumer.
  */
 
-import type { AgentRunGrant, GrantDefinition } from "../security/types"
+import type { GrantDefinition } from "../security/types"
 
 export type GrantKind =
-  | "access:application"
   | "view:object"
   | "view:dataset"
   | "edit:object"
@@ -27,12 +26,12 @@ export type GrantKind =
   | "manage:connector"
   | "manage:aiUsage"
 
-export type SingletonGrantKind = "run:agent"
+/** Capabilities over one project-wide surface: held or not, with no ids to select. */
+export type SingletonGrantKind = "run:agent" | "observe:logs" | "observe:aiUsage" | "manage:aiUsage"
 export type TargetedGrantKind = Exclude<GrantKind, SingletonGrantKind>
 
 /** Registered id universes a grant kind ranges over, plus subtype expansion. */
 export interface GrantUniverse {
-  readonly applicationIds: ReadonlySet<string>
   readonly objectTypeIds: ReadonlySet<string>
   readonly datasetIds: ReadonlySet<string>
   readonly actionIds: ReadonlySet<string>
@@ -40,9 +39,7 @@ export interface GrantUniverse {
   readonly workflowIds: ReadonlySet<string>
   readonly syncIds: ReadonlySet<string>
   readonly pipelineIds: ReadonlySet<string>
-  readonly observableIds: ReadonlySet<string>
   readonly connectorIds: ReadonlySet<string>
-  readonly manageableIds: ReadonlySet<string>
   readonly getSubTypes: (objectTypeId: string) => readonly string[]
 }
 
@@ -76,11 +73,6 @@ export const GRANT_KINDS: {
     ? SingletonGrantKindSpec
     : TargetedGrantKindSpec
 } = {
-  "access:application": {
-    universeKey: "applicationIds",
-    subject: "application",
-    fix: "Use an application exported from '@sixb/core'.",
-  },
   "view:object": {
     universeKey: "objectTypeIds",
     subject: "object type",
@@ -136,13 +128,13 @@ export const GRANT_KINDS: {
     fix: "Configure models.language and use the exported agent reference in can.run(agent).",
   },
   "observe:logs": {
-    universeKey: "observableIds",
-    subject: "observability surface",
+    singleton: true,
+    subject: "logs",
     fix: 'Use can.observe("logs").',
   },
   "observe:aiUsage": {
-    universeKey: "observableIds",
-    subject: "observability surface",
+    singleton: true,
+    subject: "AI usage",
     fix: "Use can.observe(agent.usage).",
   },
   "manage:connector": {
@@ -151,25 +143,27 @@ export const GRANT_KINDS: {
     fix: "Add it to 'connectors/' or pass it to createSixb({ connectors }).",
   },
   "manage:aiUsage": {
-    universeKey: "manageableIds",
-    subject: "management surface",
+    singleton: true,
+    subject: "AI usage",
     fix: "Use can.manage(agent.usage).",
   },
 }
 
 export const GRANT_KIND_KEYS = Object.keys(GRANT_KINDS) as readonly GrantKind[]
+export const SINGLETON_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter(
+  (kind): kind is SingletonGrantKind => "singleton" in GRANT_KINDS[kind]
+)
 export const TARGETED_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter(
-  (kind): kind is TargetedGrantKind => kind !== "run:agent"
+  (kind): kind is TargetedGrantKind => !("singleton" in GRANT_KINDS[kind])
 )
 
+export function isSingletonGrantKind(kind: GrantKind): kind is SingletonGrantKind {
+  return "singleton" in GRANT_KINDS[kind]
+}
+
 /** The grant kind a stored grant resolves to. */
-export function grantKindOf(grant: AgentRunGrant): SingletonGrantKind
-export function grantKindOf(grant: Exclude<GrantDefinition, AgentRunGrant>): TargetedGrantKind
-export function grantKindOf(grant: GrantDefinition): GrantKind
 export function grantKindOf(grant: GrantDefinition): GrantKind {
   switch (grant.capability) {
-    case "access":
-      return "access:application"
     case "view":
       return `view:${grant.target}`
     case "edit":
@@ -196,7 +190,6 @@ export type MutableGrantIndex = {
 
 export function emptyGrantSets(): MutableGrantIndex {
   return {
-    "access:application": new Set(),
     "view:object": new Set(),
     "view:dataset": new Set(),
     "edit:object": new Set(),
@@ -207,9 +200,9 @@ export function emptyGrantSets(): MutableGrantIndex {
     "run:sync": new Set(),
     "run:pipeline": new Set(),
     "run:agent": false,
-    "observe:logs": new Set(),
-    "observe:aiUsage": new Set(),
+    "observe:logs": false,
+    "observe:aiUsage": false,
     "manage:connector": new Set(),
-    "manage:aiUsage": new Set(),
+    "manage:aiUsage": false,
   }
 }

package/src/authorization/index.ts

@@ -1,4 +1,3 @@
-export { canAccessApplication, isApplicationAccessControlled } from "./application-access"
 export type { AuthzDecision, AuthzRequest } from "./decision"
 export {
   assertAuthorized,

package/src/authorization/resolve.ts

@@ -5,6 +5,8 @@ import {
   GRANT_KINDS,
   type GrantUniverse,
   grantKindOf,
+  isSingletonGrantKind,
+  SINGLETON_GRANT_KIND_KEYS,
   TARGETED_GRANT_KIND_KEYS,
 } from "./grant-kinds"
 import type { AuthorizationContext, GrantIndex, ResolvedRole } from "./types"
@@ -14,7 +16,7 @@ import type { AuthorizationContext, GrantIndex, ResolvedRole } from "./types"
  *
  * Broad grants (`every.object().except([...])`) expand against the registered
  * universe; object-type grants also expand to subtypes. Resource grants become
- * id sets; the project Agent grant becomes a boolean.
+ * id sets; grants on one project-wide surface (the Agent, logs, AI usage) become booleans.
  * The per-kind universe and subtype rules come from the `GRANT_KINDS` table, so
  * this loop never enumerates targets by hand.
  */
@@ -22,11 +24,13 @@ export function resolveRoleGrants(role: RoleDefinition, universe: GrantUniverse)
   const grants = emptyGrantSets()
 
   for (const grant of role.grants) {
-    if (grant.capability === "run" && grant.target === "agent") {
-      grants["run:agent"] = true
+    const kind = grantKindOf(grant)
+    if (isSingletonGrantKind(kind)) {
+      grants[kind] = true
       continue
     }
-    const kind = grantKindOf(grant)
+    // Every other kind carries a selection; this narrows the grant's type to say so.
+    if (!("selection" in grant)) continue
     const spec = GRANT_KINDS[kind]
     expandSelection(
       grant.selection,
@@ -89,8 +93,8 @@ export function resolveAuthorizationContext(input: {
     }
 
     roleIds.push(role.id)
-    if (role.grants["run:agent"]) {
-      grants["run:agent"] = true
+    for (const kind of SINGLETON_GRANT_KIND_KEYS) {
+      if (role.grants[kind]) grants[kind] = true
     }
     for (const kind of TARGETED_GRANT_KIND_KEYS) {
       for (const id of role.grants[kind]) {

package/src/deploy/services.ts

@@ -10,7 +10,6 @@ import type {
 
 const SERVICES = {
   api: "http",
-  atlas: "http",
   app: "http",
   orchestrator: "singleton",
   scheduler: "singleton",

package/src/deploy/types.ts

@@ -29,7 +29,7 @@ export interface DeployConfig {
 export type DeployEnv = Readonly<Record<string, string>>
 
 /** The services a browser or client reaches through a public domain. */
-export type DeployHttpServiceName = "api" | "atlas" | "app"
+export type DeployHttpServiceName = "api" | "app"
 
 /** The services that must run as exactly one process: a second would duplicate their work. */
 export type DeploySingletonServiceName = "orchestrator" | "scheduler" | "rules"
@@ -40,7 +40,6 @@ export type DeployWorkerType = "sync" | "agent" | "pipeline" | "projection" | "w
 
 export interface DeployServicesConfig {
   readonly api?: boolean | DeployHttpServiceConfig
-  readonly atlas?: boolean | DeployHttpServiceConfig
   readonly app?: boolean | DeployHttpServiceConfig
   readonly orchestrator?: boolean | DeploySingletonServiceConfig
   readonly scheduler?: boolean | DeploySingletonServiceConfig

package/src/deploy/validation.ts

@@ -55,7 +55,9 @@ function target(value: unknown): void {
 
 function services(value: unknown): void {
   const config = record(value, "services")
-  knownKeys(config, DEPLOY_SERVICES, "services")
+  knownKeys(config, DEPLOY_SERVICES, "services", {
+    atlas: "Atlas's pages are part of the app now; remove the setting and configure `app`.",
+  })
 
   for (const service of DEPLOY_SERVICES) {
     const override = config[service]

package/src/execution/authorization.ts

@@ -1,7 +1,12 @@
 import { isDeepStrictEqual } from "node:util"
 import { agentServiceAccountId } from "../agents/identity"
 import type { Principal } from "../auth"
-import { TARGETED_GRANT_KIND_KEYS, type TargetedGrantKind } from "../authorization/grant-kinds"
+import {
+  SINGLETON_GRANT_KIND_KEYS,
+  type SingletonGrantKind,
+  TARGETED_GRANT_KIND_KEYS,
+  type TargetedGrantKind,
+} from "../authorization/grant-kinds"
 import type { AuthorizationContext, GrantIndex } from "../authorization/types"
 import { createSixbError } from "../errors/internal"
 import type { ObjectRef } from "../ontology"
@@ -586,10 +591,11 @@ function snapshotAuthorizationContext(
   for (const kind of TARGETED_GRANT_KIND_KEYS) {
     grants[kind] = new ImmutableGrantSet(context.grants[kind])
   }
-  const frozenGrants: GrantIndex = Object.freeze({
-    ...grants,
-    "run:agent": context.grants["run:agent"],
-  })
+  const singletons = {} as Record<SingletonGrantKind, boolean>
+  for (const kind of SINGLETON_GRANT_KIND_KEYS) {
+    singletons[kind] = context.grants[kind]
+  }
+  const frozenGrants: GrantIndex = Object.freeze({ ...grants, ...singletons })
   return Object.freeze({
     principal,
     ...(context.sessionId === undefined ? {} : { sessionId: context.sessionId }),

package/src/index.ts

@@ -391,8 +391,6 @@ export {
 
 export type {
   AuthCookieOptions,
-  AuthSessionAudience,
-  AuthSessionAudienceOptions,
   AuthSessionOptions,
   AuthStrategy,
   AuthStrategyKind,
@@ -401,22 +399,14 @@ export type {
   Principal,
   SixbAuthConfig,
 } from "./auth"
-export {
-  DEFAULT_AUTH_SESSION_AUDIENCE,
-  isValidAuthSessionAudience,
-  principalsEqual,
-  resolveAuthSessionAudience,
-  SYSTEM_PRINCIPAL,
-} from "./auth"
+export { principalsEqual, SYSTEM_PRINCIPAL } from "./auth"
 
 // ── Authorization ──────────────────────────────────────────
 
 export type { AuthorizationContext, GrantIndex, GrantKind } from "./authorization"
 export {
   AuthorizationError,
-  canAccessApplication,
   isAllowed,
-  isApplicationAccessControlled,
   resolveAuthorizationContext,
 } from "./authorization"
 
@@ -440,10 +430,8 @@ export type {
 // ── Security Definitions ───────────────────────────────────
 
 export type {
-  AccessGrant,
   AgentRunGrant,
   AppendGrant,
-  ApplicationDefinition,
   ApplyGrant,
   BreadthSelector,
   BreadthTarget,
@@ -476,7 +464,6 @@ export type {
   ViewGrantTarget,
 } from "./security"
 export {
-  applications,
   can,
   defineGroup,
   defineMarking,

package/src/models/execution/embedding.ts

@@ -58,9 +58,9 @@ async function executeEmbedding(
   if (purpose !== undefined && purpose !== "document" && purpose !== "query") {
     throw new TypeError("[SixbModels] Embedding purpose must be 'document' or 'query'.")
   }
+  // The caller owns the deadline: only it knows whether anyone is waiting for the result.
   const signal = session.signal(input.signal)
-  const requestSignal = AbortSignal.any([signal, AbortSignal.timeout(30_000)])
-  requestSignal.throwIfAborted()
+  signal.throwIfAborted()
   if (!texts.length) return { vectors: [] }
 
   const accounting = await session.accounting()
@@ -72,7 +72,7 @@ async function executeEmbedding(
       "[SixbModels] Resolved embedding model identity does not match the selected model."
     )
   }
-  requestSignal.throwIfAborted()
+  signal.throwIfAborted()
   const callId = `call_${randomUUID()}`
   const tokens = texts.reduce(
     (sum, text) => sum + Math.ceil(new TextEncoder().encode(text).byteLength / 4),
@@ -92,8 +92,8 @@ async function executeEmbedding(
 
   let result: EmbeddingModelResult
   try {
-    requestSignal.throwIfAborted()
-    result = await model.embed({ texts, purpose, signal: requestSignal })
+    signal.throwIfAborted()
+    result = await model.embed({ texts, purpose, signal })
   } catch (error) {
     if (error instanceof EmbeddingModelResponseError) {
       await recordEmbedding(accounting, model, callId, error.metadata)
@@ -105,7 +105,7 @@ async function executeEmbedding(
   }
   // Account before cancellation, vector validation or the materializer's optimistic write.
   await recordEmbedding(accounting, model, callId, result ?? {})
-  requestSignal.throwIfAborted()
+  signal.throwIfAborted()
   return result
 }
 

package/src/objects/vectors/README.md

@@ -5,6 +5,10 @@ A named profile identifies a derived representation, separate from object proper
 Indexing sends embedding purpose `document`; search sends `query`. The execution wrapper preserves
 that role through model resolution, admission and accounting. Symmetric providers may ignore it.
 
+Each caller sets its own deadline; the execution wrapper adds none. A search has someone waiting
+and gives up after 30 seconds. Indexing, automatic or explicit, waits five minutes: the provider
+bills a call whose response is abandoned, and an abandoned automatic call is a terminal failure.
+
 Vector candidates may come from filters, traversals, explicit refs or set operations. Canonical
 validation requires one concrete result type and admits every intermediate type, edge and source
 property. Model lookup uses that resolved result type, not the query's initial type. SQL ranks the

package/src/objects/vectors/handle.ts

@@ -6,7 +6,12 @@ import type { PreparedObjectVector } from "../../materialization/vectors"
 import { sameEmbeddingModel } from "../../models/embedding-model"
 import { getOntologyMutationRuntime } from "../../runtime/ontology-mutations"
 import type { ExecutionObjectContext } from "../context"
-import { normalizeVector, vectorConfiguration, vectorSources } from "./profile"
+import {
+  INDEXING_EMBEDDING_TIMEOUT_MS,
+  normalizeVector,
+  vectorConfiguration,
+  vectorSources,
+} from "./profile"
 import type { ObjectVectorHandle } from "./types"
 
 export function createObjectVectorHandle(
@@ -65,7 +70,11 @@ export function createObjectVectorHandle(
       }
 
       // Network work never holds a storage transaction or retries an obsolete computation.
-      const result = await model.embed({ texts: [input.text], purpose: "document" })
+      const result = await model.embed({
+        texts: [input.text],
+        purpose: "document",
+        signal: AbortSignal.timeout(INDEXING_EMBEDDING_TIMEOUT_MS),
+      })
       if (!Array.isArray(result?.vectors) || result.vectors.length !== 1) {
         throw new MaterializationValidationError(
           "Embedding model must return exactly one vector for one input text."

package/src/objects/vectors/indexing-generate.ts

@@ -11,7 +11,7 @@ import { ModelExecutionSession } from "../../models/execution/session"
 import type { SixbHostContext } from "../../runtime/types"
 import type { VectorIndexingWork } from "../../storage/ontology/vector-indexing"
 import { fail, retryAt, VectorIndexingDeferred } from "./indexing-shared"
-import { normalizeVector } from "./profile"
+import { INDEXING_EMBEDDING_TIMEOUT_MS, normalizeVector } from "./profile"
 
 export interface PreparedIndexingWork {
   readonly work: VectorIndexingWork
@@ -66,7 +66,7 @@ export async function generateVectors(
     const result = await model.embed({
       texts: entries.map((entry) => entry.input.text),
       purpose: "document",
-      signal,
+      signal: AbortSignal.any([signal, AbortSignal.timeout(INDEXING_EMBEDDING_TIMEOUT_MS)]),
     })
     const values = normalizeEmbeddingResult(
       result,

package/src/objects/vectors/profile.ts

@@ -4,6 +4,11 @@ import type { ObjectVectorSearchProfile } from "../../ontology/types"
 
 export const MAX_VECTOR_K = 1000
 export const VECTOR_INPUT_VERSION = 1
+/**
+ * Nobody waits on indexing, and the provider bills a call whose response is abandoned. The
+ * deadline only frees the worker from a dead connection, so it is far longer than a search's.
+ */
+export const INDEXING_EMBEDDING_TIMEOUT_MS = 5 * 60_000
 
 export function vectorConfiguration(profile: ObjectVectorSearchProfile): string {
   return sha256Canonical({

package/src/security/builders.ts

@@ -39,7 +39,12 @@ export interface DefineMembershipPolicyOptions {
   readonly can: readonly MembershipOperation[]
 }
 
-const MEMBERSHIP_OPERATIONS = new Set<MembershipOperation>(["invite", "assignGroups", "suspend"])
+const MEMBERSHIP_OPERATIONS = new Set<MembershipOperation>([
+  "invite",
+  "assignGroups",
+  "suspend",
+  "serviceAccounts",
+])
 
 function assertNonEmptyArray<T>(value: readonly T[], field: string): void {
   if (value.length === 0) {
@@ -65,7 +70,7 @@ function membershipOperationsFrom(
   return operations.map((operation) => {
     if (!MEMBERSHIP_OPERATIONS.has(operation)) {
       throw new SecurityValidationError(
-        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`
+        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`
       )
     }
 

package/src/security/every.ts

@@ -20,7 +20,6 @@ import type { ShareDefinition } from "../shares"
 import type { SyncDefinition } from "../syncs"
 import type { WorkflowDefinition } from "../workflows/types"
 import { SecurityValidationError } from "./errors"
-import type { ApplicationDefinition } from "./types"
 
 /** Capability targets a breadth selector can range over. */
 export const BREADTH_TARGETS = [
@@ -30,7 +29,6 @@ export const BREADTH_TARGETS = [
   "workflow",
   "sync",
   "pipeline",
-  "application",
   "connector",
   "share",
 ] as const
@@ -44,7 +42,6 @@ interface BreadthTargetInput {
   workflow: WorkflowDefinition
   sync: SyncDefinition
   pipeline: PipelineDefinition
-  application: ApplicationDefinition
   connector: ConnectorDefinition
   share: ShareDefinition
 }
@@ -106,7 +103,6 @@ export const every = {
   workflow: (): BreadthSelector<"workflow"> => all("workflow"),
   sync: (): BreadthSelector<"sync"> => all("sync"),
   pipeline: (): BreadthSelector<"pipeline"> => all("pipeline"),
-  application: (): BreadthSelector<"application"> => all("application"),
   connector: (): BreadthSelector<"connector"> => all("connector"),
   share: (): BreadthSelector<"share"> => all("share"),
 }