@sixb/core 0.1.21 → 0.1.22

package/dist/chunk-y7dbmaqh.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/materialization/errors.ts"],
+  "sourcesContent": [
+    "import { OntologyValidationError } from \"../ontology/errors\"\n\nexport type MaterializationConflictKind =\n  | \"idempotency\"\n  | \"projection-fence\"\n  | \"source-materialization\"\n  | \"execution-lost\"\n  | \"run-correlation\"\n  | \"effective-state\"\n  /** A state the commit was told to expect (an Action's reads) no longer matches. */\n  | \"expectation\"\n  | \"timeseries-point\"\n  | \"outbox-lease\"\n\nfunction prefixMessage(message: string): string {\n  return message.startsWith(\"[Sixb]\") ? message : `[Sixb] ${message}`\n}\n\n/**\n * A validation failure raised inside the Materializer.\n *\n * Extends `OntologyValidationError` because it is the same class of failure a caller already\n * handles: batch writes surface it rewrapped as one, so a single write must not require a second\n * `instanceof` branch to catch the identical error.\n */\nexport class MaterializationValidationError extends OntologyValidationError {\n  readonly name: string = \"MaterializationValidationError\"\n\n  constructor(message: string, options?: ErrorOptions) {\n    super(prefixMessage(message), options)\n  }\n}\n\n/** Structured missing-object failure raised by Materializer telemetry validation. */\nexport class MaterializationObjectNotFoundError extends MaterializationValidationError {\n  override readonly name = \"MaterializationObjectNotFoundError\"\n\n  constructor(\n    readonly objectTypeId: string,\n    readonly primaryId: string\n  ) {\n    super(`Cannot append telemetry to missing object '${objectTypeId}:${primaryId}'.`)\n  }\n}\n\n/**\n * A unique property value that another object of the type already holds.\n *\n * The message names only the type and the property, so a caller learns that the value is taken\n * and nothing more. The holder and the claimant are kept for messages that may name them.\n */\nexport class UniqueValueViolationError extends MaterializationValidationError {\n  override readonly name = \"UniqueValueViolationError\"\n\n  constructor(\n    readonly objectTypeId: string,\n    readonly propertyId: string,\n    readonly holderPrimaryId: string,\n    readonly claimantPrimaryId: string\n  ) {\n    super(`Another '${objectTypeId}' object already has this '${propertyId}'.`)\n  }\n}\n\n/**\n * A write to a unique property whose stored values were never built, or were built with other\n * keys: `sixb db migrate` prepares them. Writes stay refused until then, rather than accept a\n * value they cannot check.\n */\nexport class UniquePropertyNotPreparedError extends Error {\n  readonly name = \"UniquePropertyNotPreparedError\"\n\n  constructor(\n    readonly objectTypeId: string,\n    readonly propertyId: string\n  ) {\n    super(\n      `[Sixb] Unique property '${objectTypeId}.${propertyId}' is not prepared. Run \\`sixb db migrate\\`.`\n    )\n  }\n}\n\n/**\n * Abort reason for an explicit, terminal cancellation of a materialization.\n *\n * Generic aborts (worker shutdown, delivery loss, timeout) remain retryable and preserve staged\n * source state. Passing this error as an AbortSignal reason authorizes that state to be abandoned.\n */\nexport class MaterializationCancellationError extends Error {\n  readonly name = \"AbortError\"\n\n  constructor(message = \"Materialization explicitly cancelled.\", options?: ErrorOptions) {\n    super(prefixMessage(message), options)\n  }\n}\n\nexport class MaterializationConflictError extends Error {\n  readonly name: string = \"MaterializationConflictError\"\n\n  constructor(\n    readonly kind: MaterializationConflictKind,\n    message: string\n  ) {\n    super(prefixMessage(message))\n  }\n}\n\nexport function isMaterializationConflictError(\n  error: unknown\n): error is MaterializationConflictError {\n  return error instanceof MaterializationConflictError\n}\n"
+  ],
+  "mappings": ";;;;;;AAcA,SAAS,aAAa,CAAC,SAAyB;AAAA,EAC9C,OAAO,QAAQ,WAAW,QAAQ,IAAI,UAAU,UAAU;AAAA;AAAA;AAUrD,MAAM,wCAAuC,yBAAwB;AAAA,EACjE,OAAe;AAAA,EAExB,WAAW,CAAC,SAAiB,SAAwB;AAAA,IACnD,MAAM,cAAc,OAAO,GAAG,OAAO;AAAA;AAEzC;AAAA;AAGO,MAAM,4CAA2C,gCAA+B;AAAA,EAI1E;AAAA,EACA;AAAA,EAJO,OAAO;AAAA,EAEzB,WAAW,CACA,cACA,WACT;AAAA,IACA,MAAM,8CAA8C,gBAAgB,aAAa;AAAA,IAHxE;AAAA,IACA;AAAA;AAIb;AAAA;AAQO,MAAM,mCAAkC,gCAA+B;AAAA,EAIjE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EANO,OAAO;AAAA,EAEzB,WAAW,CACA,cACA,YACA,iBACA,mBACT;AAAA,IACA,MAAM,YAAY,0CAA0C,cAAc;AAAA,IALjE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAIb;AAAA;AAOO,MAAM,uCAAuC,MAAM;AAAA,EAI7C;AAAA,EACA;AAAA,EAJF,OAAO;AAAA,EAEhB,WAAW,CACA,cACA,YACT;AAAA,IACA,MACE,2BAA2B,gBAAgB,uDAC7C;AAAA,IALS;AAAA,IACA;AAAA;AAMb;AAAA;AAQO,MAAM,0CAAyC,MAAM;AAAA,EACjD,OAAO;AAAA,EAEhB,WAAW,CAAC,UAAU,yCAAyC,SAAwB;AAAA,IACrF,MAAM,cAAc,OAAO,GAAG,OAAO;AAAA;AAEzC;AAAA;AAEO,MAAM,sCAAqC,MAAM;AAAA,EAI3C;AAAA,EAHF,OAAe;AAAA,EAExB,WAAW,CACA,MACT,SACA;AAAA,IACA,MAAM,cAAc,OAAO,CAAC;AAAA,IAHnB;AAAA;AAKb;AAEO,SAAS,+BAA8B,CAC5C,OACuC;AAAA,EACvC,OAAO,iBAAiB;AAAA;",
+  "debugId": "F880CF8C3343CEE064756E2164756E21",
+  "names": []
+}

package/dist/{chunk-6vb4st8k.js → chunk-yc9ners4.js}

@@ -6,17 +6,17 @@ import {
   isSingletonGrantKind,
   grantKindOf,
   emptyGrantSets
-} from "./chunk-dhdha526.js";
+} from "./chunk-vhbw5sqm.js";
 import {
   createSixbError2
-} from "./chunk-dvd2fp9q.js";
+} from "./chunk-zbc929zg.js";
 import {
   compileSelectedObjectReadScope2
-} from "./chunk-v4jbb3rs.js";
+} from "./chunk-rap5w0x0.js";
 import {
   findPrimitiveSchema,
   resolveSemanticType2
-} from "./chunk-8frc8a4j.js";
+} from "./chunk-65pyhyas.js";
 import {
   kernelOperationId,
   kernelOperationFromId
@@ -616,6 +616,7 @@ function snapshotAuthorizationContext(context) {
     groupIds: Object.freeze([...context.groupIds]),
     roleIds: Object.freeze([...context.roleIds]),
     grants: frozenGrants,
+    ...context.viewConditions === undefined ? {} : { viewConditions: new ImmutableViewConditions(context.viewConditions) },
     clearances: new ImmutableGrantSet(context.clearances ?? [])
   });
 }
@@ -664,6 +665,52 @@ Object.freeze(ImmutableGrantSet.prototype);
 function immutableGrantSetMutation() {
   return new Error("[Sixb] Runtime authorization grants are immutable.");
 }
+
+class ImmutableViewConditions {
+  #entries;
+  [Symbol.toStringTag] = "Map";
+  constructor(entries) {
+    this.#entries = new Map([...entries].map(([objectTypeId, predicates]) => [
+      objectTypeId,
+      deepFreeze(structuredClone([...predicates]))
+    ]));
+    Object.freeze(this);
+  }
+  get size() {
+    return this.#entries.size;
+  }
+  get(objectTypeId) {
+    return this.#entries.get(objectTypeId);
+  }
+  has(objectTypeId) {
+    return this.#entries.has(objectTypeId);
+  }
+  entries() {
+    return this.#entries.entries();
+  }
+  keys() {
+    return this.#entries.keys();
+  }
+  values() {
+    return this.#entries.values();
+  }
+  [Symbol.iterator]() {
+    return this.#entries.entries();
+  }
+  forEach(callback, thisArg) {
+    for (const [objectTypeId, predicates] of this.#entries) {
+      callback.call(thisArg, predicates, objectTypeId, this);
+    }
+  }
+}
+Object.freeze(ImmutableViewConditions.prototype);
+function deepFreeze(value) {
+  if (typeof value !== "object" || value === null)
+    return value;
+  for (const child of Object.values(value))
+    deepFreeze(child);
+  return Object.freeze(value);
+}
 function snapshotAuthorizablePrincipal(principal) {
   if (principal.type !== "user" && principal.type !== "serviceAccount") {
     throw new Error(`[Sixb] Principal type '${principal.type}' cannot hold runtime authorization.`);
@@ -792,6 +839,8 @@ function atomsFor(request) {
       return [{ kind: "view:object", id: request.objectTypeId }];
     case "dataset.view":
       return [{ kind: "view:dataset", id: request.datasetId }];
+    case "users.view":
+      return [{ kind: "view:users" }];
     case "object.edit":
       return [{ kind: "edit:object", id: request.objectTypeId }];
     case "telemetry.append":
@@ -808,14 +857,20 @@ function atomsFor(request) {
       return [{ kind: "run:pipeline", id: request.pipelineId }];
     case "agent.run":
       return [{ kind: "run:agent" }];
+    case "models.run":
+      return [{ kind: "run:models" }];
     case "logs.observe":
       return [{ kind: "observe:logs" }];
     case "aiUsage.observe":
       return [{ kind: "observe:aiUsage" }];
     case "activity.observe":
       return [{ kind: "observe:activity" }];
+    case "agentThreads.observe":
+      return [{ kind: "observe:agentThreads" }];
     case "aiUsage.manage":
       return [{ kind: "manage:aiUsage" }];
+    case "agentMemory.manage":
+      return [{ kind: "manage:agentMemory" }];
     case "connector.manage":
       return [{ kind: "manage:connector", id: request.connectorId }];
     case "object.query":
@@ -892,6 +947,20 @@ function assertProviderAccess2(runtime, execution, operation) {
   }
   throw new AuthorizationError2(`privileged:${operation}`, `[Sixb] Operation '${operation}' is not covered by scoped authorization grants.`);
 }
+function assertModelAccess2(runtime, execution, operation) {
+  const resolved = resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization
+  });
+  if (resolved.type === "unrestricted" || execution.executor.type === "agent")
+    return;
+  if (resolved.type === "principal") {
+    if (isAllowed2(resolved.context, { kind: "models.run" }))
+      return;
+    throw new AuthorizationError2("run:models", deniedMessage(resolved.context, { kind: "models.run" }));
+  }
+  throw new AuthorizationError2(`delegated:${operation}`, `[Sixb] Operation '${operation}' is not covered by delegated authorization.`);
+}
 function deniedMessage(authorization, request) {
   const principalId = authorization?.principal.id ?? "unknown";
   switch (request.kind) {
@@ -899,6 +968,8 @@ function deniedMessage(authorization, request) {
       return `[Sixb] Principal '${principalId}' is not allowed to view object type '${request.objectTypeId}'.`;
     case "dataset.view":
       return `[Sixb] Principal '${principalId}' is not allowed to view dataset '${request.datasetId}'.`;
+    case "users.view":
+      return `[Sixb] Principal '${principalId}' is not allowed to view the member directory.`;
     case "object.edit":
       return `[Sixb] Principal '${principalId}' is not allowed to write object type '${request.objectTypeId}'.`;
     case "telemetry.append":
@@ -915,14 +986,20 @@ function deniedMessage(authorization, request) {
       return `[Sixb] Principal '${principalId}' is not allowed to run pipeline '${request.pipelineId}'.`;
     case "agent.run":
       return `[Sixb] Principal '${principalId}' is not allowed to run the project Agent.`;
+    case "models.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to call the project's models.`;
     case "logs.observe":
       return `[Sixb] Principal '${principalId}' is not allowed to observe project logs.`;
     case "aiUsage.observe":
       return `[Sixb] Principal '${principalId}' is not allowed to observe project AI usage.`;
     case "activity.observe":
       return `[Sixb] Principal '${principalId}' is not allowed to observe project activity.`;
+    case "agentThreads.observe":
+      return `[Sixb] Principal '${principalId}' is not allowed to observe other users' Agent conversations.`;
     case "aiUsage.manage":
       return `[Sixb] Principal '${principalId}' is not allowed to manage project AI usage limits.`;
+    case "agentMemory.manage":
+      return `[Sixb] Principal '${principalId}' is not allowed to manage the project's Agent memory.`;
     case "connector.manage":
       return `[Sixb] Principal '${principalId}' is not allowed to manage connector '${request.connectorId}'.`;
     case "object.query": {
@@ -932,32 +1009,25 @@ function deniedMessage(authorization, request) {
   }
 }
 // src/authorization/event-visibility.ts
-function canViewEvent2(authorization, event) {
+var NO_CONDITIONS = new Set;
+function canViewEvent2(authorization, event, conditioned = NO_CONDITIONS) {
   if (!authorization) {
     return true;
   }
+  const viewsObjects = (objectTypeId) => conditioned.has(objectTypeId) || isAllowed2(authorization, { kind: "object.view", objectTypeId });
   switch (event.topic) {
     case "objects":
     case "telemetry":
-      return isAllowed2(authorization, {
-        kind: "object.view",
-        objectTypeId: event.payload.objectTypeId
-      });
+      return viewsObjects(event.payload.objectTypeId);
     case "links":
-      return isAllowed2(authorization, {
-        kind: "object.view",
-        objectTypeId: event.payload.sourceTypeId
-      }) && isAllowed2(authorization, { kind: "object.view", objectTypeId: event.payload.targetTypeId });
+      return viewsObjects(event.payload.sourceTypeId) && viewsObjects(event.payload.targetTypeId);
     case "workflows":
       return isAllowed2(authorization, {
         kind: "workflow.run",
         workflowId: event.payload.workflowId
       });
     case "rules":
-      return isAllowed2(authorization, {
-        kind: "object.view",
-        objectTypeId: event.payload.subject.objectTypeId
-      });
+      return viewsObjects(event.payload.subject.objectTypeId);
     case "syncs":
       return isAllowed2(authorization, {
         kind: "sync.run",
@@ -975,6 +1045,8 @@ function canViewEvent2(authorization, event) {
         kind: "dataset.view",
         datasetId: event.payload.datasetId
       });
+    case "users":
+      return isAllowed2(authorization, { kind: "users.view" });
     default:
       return false;
   }
@@ -983,6 +1055,8 @@ function canViewEvent2(authorization, event) {
 function resolveRoleGrants2(role, universe) {
   const grants = emptyGrantSets();
   for (const grant of role.grants) {
+    if ("condition" in grant && grant.condition !== undefined)
+      continue;
     const kind = grantKindOf(grant);
     if (isSingletonGrantKind(kind)) {
       grants[kind] = true;
@@ -995,6 +1069,25 @@ function resolveRoleGrants2(role, universe) {
   }
   return grants;
 }
+function resolveRoleViewConditions2(conditions, grants, universe) {
+  const byType = new Map;
+  for (const condition of conditions) {
+    const objectTypeIds = [condition.objectTypeId, ...universe.getSubTypes(condition.objectTypeId)];
+    for (const objectTypeId of objectTypeIds) {
+      if (grants["view:object"].has(objectTypeId))
+        continue;
+      const predicates = byType.get(objectTypeId) ?? [];
+      predicates.push(condition.predicate);
+      byType.set(objectTypeId, predicates);
+    }
+  }
+  return new Map([...byType].map(([objectTypeId, predicates]) => [objectTypeId, anyOf(predicates)]));
+}
+function anyOf(predicates) {
+  if (predicates.length === 1)
+    return predicates[0];
+  return Object.freeze({ op: "or", items: Object.freeze([...predicates]) });
+}
 function expandSelection(selection, universe, into, expand) {
   if (selection.all) {
     const except = new Set(selection.except);
@@ -1019,6 +1112,7 @@ function resolveAuthorizationContext2(input) {
   const roleIds = [];
   const grants = emptyGrantSets();
   const clearances = new Set;
+  const viewConditions = new Map;
   for (const role of input.roles) {
     if (!role.grantedToGroupIds.some((groupId) => memberGroupIds.has(groupId))) {
       continue;
@@ -1036,6 +1130,12 @@ function resolveAuthorizationContext2(input) {
     for (const markingId of role.clearances ?? []) {
       clearances.add(markingId);
     }
+    for (const [objectTypeId, predicate] of role.viewConditions ?? []) {
+      viewConditions.set(objectTypeId, [...viewConditions.get(objectTypeId) ?? [], predicate]);
+    }
+  }
+  for (const objectTypeId of grants["view:object"]) {
+    viewConditions.delete(objectTypeId);
   }
   return {
     principal: input.principal,
@@ -1043,6 +1143,7 @@ function resolveAuthorizationContext2(input) {
     groupIds: input.groupIds,
     roleIds,
     grants,
+    ...viewConditions.size > 0 ? { viewConditions } : {},
     clearances
   };
 }
@@ -1774,6 +1875,6 @@ function canViewProjection2(authorization, projection) {
 function emptyGrantIndex2() {
   return emptyGrantSets();
 }
-export { agentServiceAccountId2, MAX_OBJECT_READ_FACETS2, ObjectReadLimitExceededError2, snapshotObjectReadExecutionLimits2, assertObjectReadFacetCount2, assertObjectReadOutputWithinLimit2, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createDelegatedRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, createKernelRuntimeAuthorization, resolveRuntimeAuthorizationForProject, getAuthorizationRef, captureExecutionScope, resolveExecutionScopeAuthorization, AuthorizationError2, evaluate2, isAllowed2, assertAuthorized2, isRuntimeAllowed2, assertRuntimeAuthorizationBound2, assertCanEdit2, assertCanAppendTelemetry2, assertCanManageConnector2, assertPrivileged2, assertProviderAccess2, canViewEvent2, resolveRoleGrants2, resolveAuthorizationContext2, ProjectionValidationError2, computeProjectionOwnership2, validateProjectionOwnership2, validateTelemetryProjectionFieldMapping2, validateProjectionsAtStartup, defineProjection2, fromForeignKey2, isObjectProjectionDefinition2, isLinkProjectionDefinition2, isTelemetryProjectionDefinition2, isProjectionDefinition2, projectionTargetOf2, canViewActionRun2, canViewWorkflowRun2, canViewWorkflowIntervention2, canViewPipelineRun2, canViewProjectionRun2, canViewProjection2, emptyGrantIndex2 };
+export { agentServiceAccountId2, MAX_OBJECT_READ_FACETS2, ObjectReadLimitExceededError2, snapshotObjectReadExecutionLimits2, assertObjectReadFacetCount2, assertObjectReadOutputWithinLimit2, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createDelegatedRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, createKernelRuntimeAuthorization, resolveRuntimeAuthorizationForProject, getAuthorizationRef, captureExecutionScope, resolveExecutionScopeAuthorization, AuthorizationError2, evaluate2, isAllowed2, assertAuthorized2, isRuntimeAllowed2, assertRuntimeAuthorizationBound2, assertCanEdit2, assertCanAppendTelemetry2, assertCanManageConnector2, assertPrivileged2, assertProviderAccess2, assertModelAccess2, canViewEvent2, resolveRoleGrants2, resolveRoleViewConditions2, resolveAuthorizationContext2, ProjectionValidationError2, computeProjectionOwnership2, validateProjectionOwnership2, validateTelemetryProjectionFieldMapping2, validateProjectionsAtStartup, defineProjection2, fromForeignKey2, isObjectProjectionDefinition2, isLinkProjectionDefinition2, isTelemetryProjectionDefinition2, isProjectionDefinition2, projectionTargetOf2, canViewActionRun2, canViewWorkflowRun2, canViewWorkflowIntervention2, canViewPipelineRun2, canViewProjectionRun2, canViewProjection2, emptyGrantIndex2 };
 
-//# debugId=8216D89BFBAD691B64756E2164756E21
+//# debugId=4A557346A48D475E64756E2164756E21