@sixb/core 0.1.5 → 0.1.7

package/dist/{chunk-f83ka50g.js → chunk-37wk412q.js}

@@ -1,13 +1,13 @@
 // @bun
 import {
   resolveSemanticType
-} from "./chunk-rnshztfq.js";
+} from "./chunk-d63tybny.js";
 import {
   createSixbError
-} from "./chunk-0172wgm9.js";
+} from "./chunk-2xns679x.js";
 import {
   compareStrings
-} from "./chunk-t8t39h7v.js";
+} from "./chunk-n6jxh8sw.js";
 
 // src/authorization/grant-kinds.ts
 var GRANT_KINDS = {
@@ -58,22 +58,33 @@ var GRANT_KINDS = {
     fix: "Add it to 'pipelines/' or pass it to createSixb({ pipelines })."
   },
   "run:agent": {
-    universeKey: "agentIds",
+    singleton: true,
     subject: "agent",
-    fix: "Add it to 'agents/' or pass it to createSixb({ agents })."
+    fix: "Configure models.language and use the exported agent reference in can.run(agent)."
   },
   "observe:logs": {
     universeKey: "observableIds",
     subject: "observability surface",
     fix: 'Use can.observe("logs").'
   },
+  "observe:aiUsage": {
+    universeKey: "observableIds",
+    subject: "observability surface",
+    fix: "Use can.observe(agent.usage)."
+  },
   "manage:connector": {
     universeKey: "connectorIds",
     subject: "connector",
     fix: "Add it to 'connectors/' or pass it to createSixb({ connectors })."
+  },
+  "manage:aiUsage": {
+    universeKey: "manageableIds",
+    subject: "management surface",
+    fix: "Use can.manage(agent.usage)."
   }
 };
 var GRANT_KIND_KEYS = Object.keys(GRANT_KINDS);
+var TARGETED_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter((kind) => kind !== "run:agent");
 function grantKindOf(grant) {
   switch (grant.capability) {
     case "access":
@@ -89,17 +100,28 @@ function grantKindOf(grant) {
     case "run":
       return `run:${grant.target}`;
     case "observe":
-      return "observe:logs";
+      return `observe:${grant.target}`;
     case "manage":
-      return "manage:connector";
+      return `manage:${grant.target}`;
   }
 }
 function emptyGrantSets() {
-  const sets = {};
-  for (const kind of GRANT_KIND_KEYS) {
-    sets[kind] = new Set;
-  }
-  return sets;
+  return {
+    "access:application": new Set,
+    "view:object": new Set,
+    "view:dataset": new Set,
+    "edit:object": new Set,
+    "append:telemetry": new Set,
+    "apply:action": new Set,
+    "run:workflow": new Set,
+    "run:sync": new Set,
+    "run:pipeline": new Set,
+    "run:agent": false,
+    "observe:logs": new Set,
+    "observe:aiUsage": new Set,
+    "manage:connector": new Set,
+    "manage:aiUsage": new Set
+  };
 }
 
 // src/execution/types.ts
@@ -128,17 +150,28 @@ function createPrincipalRuntimeAuthorization(input) {
   return createRegisteredPrincipalAuthorization(input);
 }
 function createAgentRuntimeAuthorization(input) {
-  if (input.context.principal.type !== "serviceAccount") {
-    throw new Error("[Sixb] Agent execution authority must belong to a service account.");
-  }
   assertNonEmpty(input.executionId, "Execution id");
-  assertNonEmpty(input.agentId, "Agent id");
+  if (input.actorId !== undefined)
+    assertNonEmpty(input.actorId, "Agent actor id");
   assertNonEmpty(input.runId, "Agent run id");
-  return createRegisteredPrincipalAuthorization(input, {
+  const executionBinding = {
     type: "agent",
     executionId: input.executionId,
-    agentId: input.agentId,
+    ...input.actorId === undefined ? {} : { actorId: input.actorId },
     runId: input.runId
+  };
+  if (input.authority.type === "principal") {
+    return createRegisteredPrincipalAuthorization({
+      projectId: input.projectId,
+      context: input.authority.context,
+      ...input.authority.credential === undefined ? {} : { credential: input.authority.credential }
+    }, executionBinding);
+  }
+  return register({
+    type: "unrestricted",
+    projectId: input.projectId,
+    ref: Object.freeze({ type: "disabled" }),
+    executionBinding: Object.freeze(executionBinding)
   });
 }
 function createRegisteredPrincipalAuthorization(input, executionBinding) {
@@ -234,10 +267,14 @@ function resolveExecutionScopeAuthorization(projectId, scope) {
       }
       return resolved;
     case "agent":
-      if (resolved.type !== "principal" || resolved.ref.type !== "principal" || resolved.ref.principal.type !== "serviceAccount" || resolved.ref.credential !== undefined || resolved.executionBinding?.type !== "agent" || resolved.executionBinding.executionId !== execution.id || resolved.executionBinding.agentId !== execution.executor.agentId || resolved.executionBinding.runId !== execution.executor.runId) {
+      if (resolved.executionBinding?.type !== "agent" || resolved.executionBinding.executionId !== execution.id || resolved.executionBinding.actorId !== execution.executor.actorId || resolved.executionBinding.runId !== execution.executor.runId) {
         throw invalidExecutionAuthority(execution.id, "agent authority does not match its execution binding");
       }
-      return resolved;
+      if (resolved.type === "principal" && resolved.ref.type === "principal")
+        return resolved;
+      if (resolved.type === "unrestricted" && resolved.ref.type === "disabled")
+        return resolved;
+      throw invalidExecutionAuthority(execution.id, "agent authority must be principal or explicitly disabled");
     case "kernel":
       if (resolved.ref.type !== "kernel" || execution.requestedBy !== undefined || resolved.ref.operation.type !== execution.executor.operation.type || resolved.ref.operation.recoveryId !== execution.executor.operation.recoveryId) {
         throw invalidExecutionAuthority(execution.id, "kernel authority does not match its executor");
@@ -260,7 +297,8 @@ function register(input) {
 function snapshotAuthorizationContext(context) {
   const principal = snapshotAuthorizablePrincipal(context.principal);
   const grants = emptyGrantSets();
-  for (const kind of GRANT_KIND_KEYS) {
+  grants["run:agent"] = context.grants["run:agent"];
+  for (const kind of TARGETED_GRANT_KIND_KEYS) {
     grants[kind] = new Set(context.grants[kind]);
   }
   const frozenGrants = Object.freeze(grants);
@@ -363,9 +401,13 @@ function atomsFor(request) {
     case "pipeline.run":
       return [{ kind: "run:pipeline", id: request.pipelineId }];
     case "agent.run":
-      return [{ kind: "run:agent", id: request.agentId }];
+      return [{ kind: "run:agent" }];
     case "logs.observe":
       return [{ kind: "observe:logs", id: "logs" }];
+    case "aiUsage.observe":
+      return [{ kind: "observe:aiUsage", id: "aiUsage" }];
+    case "aiUsage.manage":
+      return [{ kind: "manage:aiUsage", id: "aiUsage" }];
     case "connector.manage":
       return [{ kind: "manage:connector", id: request.connectorId }];
     case "object.query":
@@ -373,11 +415,16 @@ function atomsFor(request) {
   }
 }
 function atomKey(atom) {
-  if (atom.kind === "observe:logs")
+  if (atom.kind === "run:agent")
     return atom.kind;
+  if (atom.kind === "observe:logs" || atom.kind === "observe:aiUsage" || atom.kind === "manage:aiUsage") {
+    return atom.kind;
+  }
   return `${atom.kind}:${atom.id}`;
 }
 function holds(grants, atom) {
+  if (atom.kind === "run:agent")
+    return grants[atom.kind];
   return grants[atom.kind].has(atom.id);
 }
 function evaluate(authorization, request) {
@@ -429,7 +476,7 @@ function assertProviderAccess(runtime, execution, operation) {
   }
   const binding = resolved.executionBinding;
   const executor = execution.executor;
-  if (binding?.type === "agent" && executor.type === "agent" && binding.executionId === execution.id && binding.agentId === executor.agentId && binding.runId === executor.runId) {
+  if (binding?.type === "agent" && executor.type === "agent" && binding.executionId === execution.id && binding.actorId === executor.actorId && binding.runId === executor.runId) {
     return;
   }
   throw new AuthorizationError(`privileged:${operation}`, `[Sixb] Operation '${operation}' is not covered by scoped authorization grants.`);
@@ -456,9 +503,13 @@ function deniedMessage(authorization, request) {
     case "pipeline.run":
       return `[Sixb] Principal '${principalId}' is not allowed to run pipeline '${request.pipelineId}'.`;
     case "agent.run":
-      return `[Sixb] Principal '${principalId}' is not allowed to run agent '${request.agentId}'.`;
+      return `[Sixb] Principal '${principalId}' is not allowed to run the project Agent.`;
     case "logs.observe":
       return `[Sixb] Principal '${principalId}' is not allowed to observe project logs.`;
+    case "aiUsage.observe":
+      return `[Sixb] Principal '${principalId}' is not allowed to observe project AI usage.`;
+    case "aiUsage.manage":
+      return `[Sixb] Principal '${principalId}' is not allowed to manage project AI usage limits.`;
     case "connector.manage":
       return `[Sixb] Principal '${principalId}' is not allowed to manage connector '${request.connectorId}'.`;
     case "object.query": {
@@ -534,6 +585,10 @@ function canViewEvent(authorization, event) {
 function resolveRoleGrants(role, universe) {
   const grants = emptyGrantSets();
   for (const grant of role.grants) {
+    if (grant.capability === "run" && grant.target === "agent") {
+      grants["run:agent"] = true;
+      continue;
+    }
     const kind = grantKindOf(grant);
     const spec = GRANT_KINDS[kind];
     expandSelection(grant.selection, universe[spec.universeKey], grants[kind], spec.expandsSubtypes ? universe.getSubTypes : undefined);
@@ -568,7 +623,10 @@ function resolveAuthorizationContext(input) {
       continue;
     }
     roleIds.push(role.id);
-    for (const kind of GRANT_KIND_KEYS) {
+    if (role.grants["run:agent"]) {
+      grants["run:agent"] = true;
+    }
+    for (const kind of TARGETED_GRANT_KIND_KEYS) {
       for (const id of role.grants[kind]) {
         grants[kind].add(id);
       }
@@ -1307,6 +1365,6 @@ function canViewProjection(authorization, projection) {
 function emptyGrantIndex() {
   return emptyGrantSets();
 }
-export { ProjectionValidationError, computeProjectionOwnership, validateProjectionOwnership, validateTelemetryProjectionFieldMapping, validateProjectionsAtStartup, defineProjection, fromForeignKey, isObjectProjectionDefinition, isLinkProjectionDefinition, isTelemetryProjectionDefinition, isProjectionDefinition, projectionTargetOf, GRANT_KINDS, grantKindOf, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, getAuthorizationRef, resolveExecutionScopeAuthorization, AuthorizationError, evaluate, isAllowed, assertAuthorized, assertCanEdit, assertCanAppendTelemetry, assertCanManageConnector, assertPrivileged, assertProviderAccess, isApplicationAccessControlled, canAccessApplication, canViewEvent, resolveRoleGrants, resolveAuthorizationContext, canViewActionRun, canViewWorkflowRun, canViewWorkflowIntervention, canViewPipelineRun, canViewProjectionRun, canViewProjection, emptyGrantIndex };
+export { ProjectionValidationError, computeProjectionOwnership, validateProjectionOwnership, validateTelemetryProjectionFieldMapping, validateProjectionsAtStartup, defineProjection, fromForeignKey, isObjectProjectionDefinition, isLinkProjectionDefinition, isTelemetryProjectionDefinition, isProjectionDefinition, projectionTargetOf, GRANT_KINDS, grantKindOf, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, getAuthorizationRef, resolveExecutionScopeAuthorization, AuthorizationError, evaluate, isAllowed, assertAuthorized, assertRuntimeAuthorizationBound, assertCanEdit, assertCanAppendTelemetry, assertCanManageConnector, assertPrivileged, assertProviderAccess, isApplicationAccessControlled, canAccessApplication, canViewEvent, resolveRoleGrants, resolveAuthorizationContext, canViewActionRun, canViewWorkflowRun, canViewWorkflowIntervention, canViewPipelineRun, canViewProjectionRun, canViewProjection, emptyGrantIndex };
 
-//# debugId=48D20BF42F9CD3F464756E2164756E21
+//# debugId=61CE77C324BED20164756E2164756E21