@sixb/core 0.1.19 → 0.1.21

package/dist/{chunk-y7rqfrgg.js → chunk-6vb4st8k.js}

@@ -1,20 +1,22 @@
 // @bun
 import {
   GRANT_KINDS,
+  SINGLETON_GRANT_KIND_KEYS,
   TARGETED_GRANT_KIND_KEYS,
+  isSingletonGrantKind,
   grantKindOf,
   emptyGrantSets
-} from "./chunk-enpsx8k5.js";
+} from "./chunk-dhdha526.js";
 import {
   createSixbError2
-} from "./chunk-8mx7qw3y.js";
+} from "./chunk-dvd2fp9q.js";
 import {
   compileSelectedObjectReadScope2
 } from "./chunk-v4jbb3rs.js";
 import {
   findPrimitiveSchema,
   resolveSemanticType2
-} from "./chunk-hvsb78a1.js";
+} from "./chunk-8frc8a4j.js";
 import {
   kernelOperationId,
   kernelOperationFromId
@@ -603,10 +605,11 @@ function snapshotAuthorizationContext(context) {
   for (const kind of TARGETED_GRANT_KIND_KEYS) {
     grants[kind] = new ImmutableGrantSet(context.grants[kind]);
   }
-  const frozenGrants = Object.freeze({
-    ...grants,
-    "run:agent": context.grants["run:agent"]
-  });
+  const singletons = {};
+  for (const kind of SINGLETON_GRANT_KIND_KEYS) {
+    singletons[kind] = context.grants[kind];
+  }
+  const frozenGrants = Object.freeze({ ...grants, ...singletons });
   return Object.freeze({
     principal,
     ...context.sessionId === undefined ? {} : { sessionId: context.sessionId },
@@ -785,8 +788,6 @@ class AuthorizationError2 extends Error {
 // src/authorization/decision.ts
 function atomsFor(request) {
   switch (request.kind) {
-    case "application.access":
-      return [{ kind: "access:application", id: request.audience }];
     case "object.view":
       return [{ kind: "view:object", id: request.objectTypeId }];
     case "dataset.view":
@@ -808,11 +809,13 @@ function atomsFor(request) {
     case "agent.run":
       return [{ kind: "run:agent" }];
     case "logs.observe":
-      return [{ kind: "observe:logs", id: "logs" }];
+      return [{ kind: "observe:logs" }];
     case "aiUsage.observe":
-      return [{ kind: "observe:aiUsage", id: "aiUsage" }];
+      return [{ kind: "observe:aiUsage" }];
+    case "activity.observe":
+      return [{ kind: "observe:activity" }];
     case "aiUsage.manage":
-      return [{ kind: "manage:aiUsage", id: "aiUsage" }];
+      return [{ kind: "manage:aiUsage" }];
     case "connector.manage":
       return [{ kind: "manage:connector", id: request.connectorId }];
     case "object.query":
@@ -820,17 +823,10 @@ function atomsFor(request) {
   }
 }
 function atomKey(atom) {
-  if (atom.kind === "run:agent")
-    return atom.kind;
-  if (atom.kind === "observe:logs" || atom.kind === "observe:aiUsage" || atom.kind === "manage:aiUsage") {
-    return atom.kind;
-  }
-  return `${atom.kind}:${atom.id}`;
+  return "id" in atom ? `${atom.kind}:${atom.id}` : atom.kind;
 }
 function holds(grants, atom) {
-  if (atom.kind === "run:agent")
-    return grants[atom.kind];
-  return grants[atom.kind].has(atom.id);
+  return "id" in atom ? grants[atom.kind].has(atom.id) : grants[atom.kind];
 }
 function evaluate2(authorization, request) {
   const atoms = atomsFor(request);
@@ -899,8 +895,6 @@ function assertProviderAccess2(runtime, execution, operation) {
 function deniedMessage(authorization, request) {
   const principalId = authorization?.principal.id ?? "unknown";
   switch (request.kind) {
-    case "application.access":
-      return `[Sixb] Principal '${principalId}' is not allowed to access application '${request.audience}'.`;
     case "object.view":
       return `[Sixb] Principal '${principalId}' is not allowed to view object type '${request.objectTypeId}'.`;
     case "dataset.view":
@@ -925,6 +919,8 @@ function deniedMessage(authorization, request) {
       return `[Sixb] Principal '${principalId}' is not allowed to observe project logs.`;
     case "aiUsage.observe":
       return `[Sixb] Principal '${principalId}' is not allowed to observe project AI usage.`;
+    case "activity.observe":
+      return `[Sixb] Principal '${principalId}' is not allowed to observe project activity.`;
     case "aiUsage.manage":
       return `[Sixb] Principal '${principalId}' is not allowed to manage project AI usage limits.`;
     case "connector.manage":
@@ -935,14 +931,6 @@ function deniedMessage(authorization, request) {
     }
   }
 }
-
-// src/authorization/application-access.ts
-function isApplicationAccessControlled2(roles, audience) {
-  return roles.some((role) => role.grants["access:application"].has(audience));
-}
-function canAccessApplication2(authorization, roles, audience) {
-  return !isApplicationAccessControlled2(roles, audience) || isAllowed2(authorization, { kind: "application.access", audience });
-}
 // src/authorization/event-visibility.ts
 function canViewEvent2(authorization, event) {
   if (!authorization) {
@@ -995,11 +983,13 @@ function canViewEvent2(authorization, event) {
 function resolveRoleGrants2(role, universe) {
   const grants = emptyGrantSets();
   for (const grant of role.grants) {
-    if (grant.capability === "run" && grant.target === "agent") {
-      grants["run:agent"] = true;
+    const kind = grantKindOf(grant);
+    if (isSingletonGrantKind(kind)) {
+      grants[kind] = true;
       continue;
     }
-    const kind = grantKindOf(grant);
+    if (!("selection" in grant))
+      continue;
     const spec = GRANT_KINDS[kind];
     expandSelection(grant.selection, universe[spec.universeKey], grants[kind], spec.expandsSubtypes ? universe.getSubTypes : undefined);
   }
@@ -1034,8 +1024,9 @@ function resolveAuthorizationContext2(input) {
       continue;
     }
     roleIds.push(role.id);
-    if (role.grants["run:agent"]) {
-      grants["run:agent"] = true;
+    for (const kind of SINGLETON_GRANT_KIND_KEYS) {
+      if (role.grants[kind])
+        grants[kind] = true;
     }
     for (const kind of TARGETED_GRANT_KIND_KEYS) {
       for (const id of role.grants[kind]) {
@@ -1783,6 +1774,6 @@ function canViewProjection2(authorization, projection) {
 function emptyGrantIndex2() {
   return emptyGrantSets();
 }
-export { agentServiceAccountId2, MAX_OBJECT_READ_FACETS2, ObjectReadLimitExceededError2, snapshotObjectReadExecutionLimits2, assertObjectReadFacetCount2, assertObjectReadOutputWithinLimit2, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createDelegatedRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, createKernelRuntimeAuthorization, resolveRuntimeAuthorizationForProject, getAuthorizationRef, captureExecutionScope, resolveExecutionScopeAuthorization, AuthorizationError2, evaluate2, isAllowed2, assertAuthorized2, isRuntimeAllowed2, assertRuntimeAuthorizationBound2, assertCanEdit2, assertCanAppendTelemetry2, assertCanManageConnector2, assertPrivileged2, assertProviderAccess2, isApplicationAccessControlled2, canAccessApplication2, canViewEvent2, resolveRoleGrants2, resolveAuthorizationContext2, ProjectionValidationError2, computeProjectionOwnership2, validateProjectionOwnership2, validateTelemetryProjectionFieldMapping2, validateProjectionsAtStartup, defineProjection2, fromForeignKey2, isObjectProjectionDefinition2, isLinkProjectionDefinition2, isTelemetryProjectionDefinition2, isProjectionDefinition2, projectionTargetOf2, canViewActionRun2, canViewWorkflowRun2, canViewWorkflowIntervention2, canViewPipelineRun2, canViewProjectionRun2, canViewProjection2, emptyGrantIndex2 };
+export { agentServiceAccountId2, MAX_OBJECT_READ_FACETS2, ObjectReadLimitExceededError2, snapshotObjectReadExecutionLimits2, assertObjectReadFacetCount2, assertObjectReadOutputWithinLimit2, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createDelegatedRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, createKernelRuntimeAuthorization, resolveRuntimeAuthorizationForProject, getAuthorizationRef, captureExecutionScope, resolveExecutionScopeAuthorization, AuthorizationError2, evaluate2, isAllowed2, assertAuthorized2, isRuntimeAllowed2, assertRuntimeAuthorizationBound2, assertCanEdit2, assertCanAppendTelemetry2, assertCanManageConnector2, assertPrivileged2, assertProviderAccess2, canViewEvent2, resolveRoleGrants2, resolveAuthorizationContext2, ProjectionValidationError2, computeProjectionOwnership2, validateProjectionOwnership2, validateTelemetryProjectionFieldMapping2, validateProjectionsAtStartup, defineProjection2, fromForeignKey2, isObjectProjectionDefinition2, isLinkProjectionDefinition2, isTelemetryProjectionDefinition2, isProjectionDefinition2, projectionTargetOf2, canViewActionRun2, canViewWorkflowRun2, canViewWorkflowIntervention2, canViewPipelineRun2, canViewProjectionRun2, canViewProjection2, emptyGrantIndex2 };
 
-//# debugId=316DB507DF90EFBD64756E2164756E21
+//# debugId=8216D89BFBAD691B64756E2164756E21