@sixb/core 0.1.6 → 0.1.7

package/dist/{chunk-bhxaq2nn.js → chunk-qw9gvjv5.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   captureSixbFailure
-} from "./chunk-0172wgm9.js";
+} from "./chunk-2xns679x.js";
 
 // src/error-reporting/normalize.ts
 function safeString(value) {

package/dist/{chunk-8gv5z0zm.js → chunk-rp1mvzb4.js}

@@ -3,23 +3,23 @@ import {
   createPrimitiveExecutionRecord,
   ensureExecutionRecord,
   executionRecordInputFromRuntime
-} from "./chunk-f6erf2vv.js";
+} from "./chunk-hdz94br2.js";
 import {
   PIPELINE_RUN_FAILURE_CODES
-} from "./chunk-t624af60.js";
+} from "./chunk-6ed5bwnd.js";
 import {
   PipelineRunError
-} from "./chunk-cy0n5dms.js";
+} from "./chunk-5jcdmjam.js";
 import {
   reportRunFailure
-} from "./chunk-dsrkgtnh.js";
+} from "./chunk-jq43kdvk.js";
 import {
   assertAuthorized
-} from "./chunk-f83ka50g.js";
+} from "./chunk-37wk412q.js";
 import {
   createSixbError,
   toSixbFailure
-} from "./chunk-0172wgm9.js";
+} from "./chunk-2xns679x.js";
 
 // src/pipelines/errors.ts
 class PipelineError extends Error {

package/dist/{chunk-1e8m6yn3.js → chunk-rre42skh.js}

@@ -17,7 +17,7 @@ import {
   grantKindOf,
   resolveAuthorizationContext,
   resolveRoleGrants
-} from "./chunk-f83ka50g.js";
+} from "./chunk-37wk412q.js";
 
 // src/auth/access-tokens.ts
 import { createHash, randomBytes, randomUUID } from "crypto";
@@ -326,11 +326,17 @@ function assertGrantDefinition(value, field, createError = (message) => new Secu
   if (value.capability === "run" && value.target !== "workflow" && value.target !== "sync" && value.target !== "pipeline" && value.target !== "agent") {
     throw createError(`[Sixb] ${field} run grant target must be 'workflow', 'sync', 'pipeline', or 'agent'.`);
   }
-  if (value.capability === "observe" && value.target !== "logs") {
-    throw createError(`[Sixb] ${field} observe grant target must be 'logs'.`);
+  if (value.capability === "observe" && value.target !== "logs" && value.target !== "aiUsage") {
+    throw createError(`[Sixb] ${field} observe grant target must be 'logs' or 'aiUsage'.`);
   }
-  if (value.capability === "manage" && value.target !== undefined) {
-    throw createError(`[Sixb] ${field} manage grant must not declare a target.`);
+  if (value.capability === "manage" && value.target !== "connector" && value.target !== "aiUsage") {
+    throw createError(`[Sixb] ${field} manage grant target must be 'connector' or 'aiUsage'.`);
+  }
+  if (value.capability === "run" && value.target === "agent") {
+    if (value.selection !== undefined) {
+      throw createError(`[Sixb] ${field} agent run grant must not declare a selection.`);
+    }
+    return;
   }
   assertSelection(value.selection, field, createError);
 }
@@ -441,6 +447,13 @@ function validateSecurityDefinitionsAtStartup(input) {
   };
 }
 function assertGrantReferences(roleId, grant, registered) {
+  if (grant.capability === "run" && grant.target === "agent") {
+    const spec2 = GRANT_KINDS[grantKindOf(grant)];
+    if (!registered.agentAvailable) {
+      throw new SecurityValidationError(`[Sixb] Role '${roleId}' grants ${grant.capability} on the project Agent, but it is unavailable. ${spec2.fix}`);
+    }
+    return;
+  }
   const spec = GRANT_KINDS[grantKindOf(grant)];
   const universe = registered[spec.universeKey];
   if (!universe) {
@@ -530,7 +543,6 @@ var BREADTH_TARGETS = [
   "workflow",
   "sync",
   "pipeline",
-  "agent",
   "application",
   "connector"
 ];
@@ -565,18 +577,16 @@ var every = {
   workflow: () => all("workflow"),
   sync: () => all("sync"),
   pipeline: () => all("pipeline"),
-  agent: () => all("agent"),
   application: () => all("application"),
   connector: () => all("connector")
 };
 // src/security/grants.ts
 var VIEW_TARGETS = ["object", "dataset"];
-var RUN_TARGETS = ["workflow", "sync", "pipeline", "agent"];
+var RUN_TARGETS = ["workflow", "sync", "pipeline"];
 var TARGET_BY_DEFINITION_KIND = {
   dataset: "dataset",
   sync: "sync",
   pipeline: "pipeline",
-  agent: "agent",
   workflow: "workflow",
   application: "application",
   connector: "connector"
@@ -655,10 +665,23 @@ function apply(input) {
   };
 }
 function run(input) {
+  if (isAgentReference(input)) {
+    return { kind: "grant", capability: "run", target: "agent" };
+  }
   const { target, selection } = resolveGrant(input, "can.run", RUN_TARGETS);
   return { kind: "grant", capability: "run", target, selection };
 }
-function observe(target) {
+function isAgentReference(input) {
+  return typeof input === "object" && input !== null && !Array.isArray(input) && !isBreadthSelector(input) && "kind" in input && input.kind === "agent";
+}
+function isAgentUsageReference(input) {
+  return typeof input === "object" && input !== null && !Array.isArray(input) && !isBreadthSelector(input) && "kind" in input && input.kind === "aiUsage";
+}
+function observe(input) {
+  if (input !== "logs" && !isAgentUsageReference(input)) {
+    throw new SecurityValidationError('[Sixb] can.observe accepts "logs" or agent.usage.');
+  }
+  const target = input === "logs" ? "logs" : "aiUsage";
   return {
     kind: "grant",
     capability: "observe",
@@ -667,9 +690,18 @@ function observe(target) {
   };
 }
 function manage(input) {
+  if (isAgentUsageReference(input)) {
+    return {
+      kind: "grant",
+      capability: "manage",
+      target: "aiUsage",
+      selection: { all: false, ids: ["aiUsage"] }
+    };
+  }
   return {
     kind: "grant",
     capability: "manage",
+    target: "connector",
     selection: resolveGrant(input, "can.manage", ["connector"]).selection
   };
 }
@@ -701,9 +733,10 @@ class SecurityRegistry {
       workflowIds: input.workflowIds,
       syncIds: input.syncIds,
       pipelineIds: input.pipelineIds,
-      agentIds: input.agentIds,
+      agentAvailable: input.agentAvailable,
       connectorIds: input.connectorIds,
-      observableIds: new Set(["logs"])
+      observableIds: new Set(["logs", "aiUsage"]),
+      manageableIds: new Set(["aiUsage"])
     });
     const universe = {
       applicationIds: input.applicationIds ?? APPLICATION_IDS,
@@ -713,9 +746,9 @@ class SecurityRegistry {
       workflowIds: input.workflowIds ?? new Set,
       syncIds: input.syncIds ?? new Set,
       pipelineIds: input.pipelineIds ?? new Set,
-      agentIds: input.agentIds ?? new Set,
       connectorIds: input.connectorIds ?? new Set,
-      observableIds: new Set(["logs"]),
+      observableIds: new Set(["logs", "aiUsage"]),
+      manageableIds: new Set(["aiUsage"]),
       getSubTypes: input.getSubTypes ?? (() => [])
     };
     this.groupsById = definitions.groupsById;
@@ -770,7 +803,8 @@ function createAuthStorageState() {
     invitations: new Map,
     groupMemberships: new Map,
     magicLinks: new Map,
-    oidcAuthorizationAttempts: new Map
+    oidcAuthorizationAttempts: new Map,
+    deviceAuthorizations: new Map
   };
 }
 function scopedKey(...parts) {
@@ -791,6 +825,9 @@ function serviceAccountGroupMembershipKey(projectId, serviceAccountId, groupId)
 function sessionKey(projectId, id) {
   return scopedKey(projectId, id);
 }
+function deviceAuthorizationKey(projectId, id) {
+  return scopedKey(projectId, id);
+}
 function accessTokenKey(projectId, id) {
   return scopedKey(projectId, id);
 }
@@ -1175,6 +1212,100 @@ class InMemoryAuthAccessTokenStore {
   }
 }
 
+// src/storage/auth/types.ts
+var MAX_PENDING_DEVICE_AUTHORIZATIONS = 100;
+
+// src/storage/auth/in-memory/device-authorizations.ts
+class InMemoryAuthDeviceAuthorizationStore {
+  state;
+  constructor(state) {
+    this.state = state;
+  }
+  async create(input) {
+    const id = assertNonEmpty2(input.id, "Device authorization id");
+    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    for (const [key2, authorization] of this.state.deviceAuthorizations) {
+      if (authorization.projectId === projectId && authorization.expiresAt <= input.createdAt) {
+        this.state.deviceAuthorizations.delete(key2);
+      }
+    }
+    const pending = [...this.state.deviceAuthorizations.values()].filter((authorization) => authorization.projectId === projectId && authorization.status === "pending").length;
+    if (pending >= MAX_PENDING_DEVICE_AUTHORIZATIONS) {
+      throw new AuthStorageError("device_authorization_limit_exceeded", `[Sixb] Project '${projectId}' has too many pending device authorizations.`);
+    }
+    const key = deviceAuthorizationKey(projectId, id);
+    if (this.state.deviceAuthorizations.has(key)) {
+      throw duplicateAuthorization(id, projectId);
+    }
+    const record = {
+      id,
+      projectId,
+      deviceCodeHash: assertNonEmpty2(input.deviceCodeHash, "Device code hash"),
+      userCode: assertNonEmpty2(input.userCode, "User code"),
+      clientName: assertNonEmpty2(input.clientName, "Client name"),
+      tokenName: assertNonEmpty2(input.tokenName, "Token name"),
+      tokenExpiresAt: new Date(input.tokenExpiresAt),
+      status: "pending",
+      createdAt: new Date(input.createdAt),
+      expiresAt: new Date(input.expiresAt)
+    };
+    this.state.deviceAuthorizations.set(key, cloneRecord(record));
+    return cloneRecord(record);
+  }
+  async getById(params) {
+    const record = this.state.deviceAuthorizations.get(deviceAuthorizationKey(params.projectId, params.id));
+    return record ? cloneRecord(record) : null;
+  }
+  async getByUserCode(params) {
+    for (const record of this.state.deviceAuthorizations.values()) {
+      if (record.projectId === params.projectId && record.userCode === params.userCode) {
+        return cloneRecord(record);
+      }
+    }
+    return null;
+  }
+  async approve(params) {
+    const record = this.requirePending(params.projectId, params.id, params.approvedAt);
+    const user = this.state.users.get(userKey(params.projectId, params.userId));
+    const session = this.state.sessions.get(sessionKey(params.projectId, params.sessionId));
+    if (!user || user.status !== "active" || !session || session.userId !== user.id || !isActiveSession(session, params.approvedAt)) {
+      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Device authorization requires an active user session.");
+    }
+    const next = {
+      ...record,
+      status: "approved",
+      approvedUserId: assertNonEmpty2(params.userId, "Approved user id"),
+      approvedSessionId: assertNonEmpty2(params.sessionId, "Approved session id"),
+      approvedAt: new Date(params.approvedAt)
+    };
+    this.state.deviceAuthorizations.set(deviceAuthorizationKey(params.projectId, params.id), next);
+    return cloneRecord(next);
+  }
+  async deny(params) {
+    const record = this.requirePending(params.projectId, params.id, params.deniedAt);
+    const next = {
+      ...record,
+      status: "denied",
+      deniedAt: new Date(params.deniedAt)
+    };
+    this.state.deviceAuthorizations.set(deviceAuthorizationKey(params.projectId, params.id), next);
+    return cloneRecord(next);
+  }
+  requirePending(projectId, id, now) {
+    const record = this.state.deviceAuthorizations.get(deviceAuthorizationKey(projectId, id));
+    if (!record) {
+      throw new AuthStorageError("missing_device_authorization", `[Sixb] Device authorization '${id}' not found for project '${projectId}'.`);
+    }
+    if (record.status !== "pending" || record.expiresAt <= now) {
+      throw new AuthStorageError("invalid_device_authorization", `[Sixb] Device authorization '${id}' is no longer pending for project '${projectId}'.`);
+    }
+    return record;
+  }
+}
+function duplicateAuthorization(id, projectId) {
+  return new AuthStorageError("duplicate_device_authorization", `[Sixb] Device authorization '${id}' already exists for project '${projectId}'.`);
+}
+
 // src/storage/auth/in-memory/group-memberships.ts
 class InMemoryAuthGroupMembershipStore {
   state;
@@ -1707,6 +1838,7 @@ class InMemoryAuthStorage {
   groupMemberships = new InMemoryAuthGroupMembershipStore(this.state);
   magicLinks = new InMemoryAuthMagicLinkStore(this.state);
   oidcAuthorizationAttempts = new InMemoryAuthOidcAuthorizationAttemptStore(this.state);
+  deviceAuthorizations = new InMemoryAuthDeviceAuthorizationStore(this.state);
   snapshot() {
     return {
       users: structuredClone(this.state.users),
@@ -1718,7 +1850,8 @@ class InMemoryAuthStorage {
       invitations: structuredClone(this.state.invitations),
       groupMemberships: structuredClone(this.state.groupMemberships),
       magicLinks: structuredClone(this.state.magicLinks),
-      oidcAuthorizationAttempts: structuredClone(this.state.oidcAuthorizationAttempts)
+      oidcAuthorizationAttempts: structuredClone(this.state.oidcAuthorizationAttempts),
+      deviceAuthorizations: structuredClone(this.state.deviceAuthorizations)
     };
   }
   restore(snapshot) {
@@ -1732,6 +1865,37 @@ class InMemoryAuthStorage {
     restoreMap(this.state.groupMemberships, snapshot.groupMemberships);
     restoreMap(this.state.magicLinks, snapshot.magicLinks);
     restoreMap(this.state.oidcAuthorizationAttempts, snapshot.oidcAuthorizationAttempts);
+    restoreMap(this.state.deviceAuthorizations, snapshot.deviceAuthorizations);
+  }
+  async completeDeviceAuthorization(input) {
+    const key = deviceAuthorizationKey(input.projectId, input.id);
+    const authorization = this.state.deviceAuthorizations.get(key);
+    if (!authorization) {
+      throw new AuthStorageError("missing_device_authorization", `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`);
+    }
+    if (authorization.deviceCodeHash !== input.deviceCodeHash) {
+      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Invalid device authorization.");
+    }
+    if (authorization.status === "pending") {
+      throw new AuthStorageError("pending_device_authorization", "[Sixb] Device authorization is pending.");
+    }
+    if (authorization.status === "denied") {
+      throw new AuthStorageError("device_authorization_denied", "[Sixb] Device authorization was denied.");
+    }
+    if (authorization.status !== "approved" || !authorization.approvedUserId || !authorization.approvedSessionId || authorization.expiresAt <= input.completedAt) {
+      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Device authorization is invalid.");
+    }
+    if (input.accessToken.projectId !== input.projectId || input.accessToken.subjectType !== "user" || input.accessToken.subjectId !== authorization.approvedUserId || input.accessToken.createdBySessionId !== authorization.approvedSessionId) {
+      throw new AuthStorageError("invalid_device_authorization", "[Sixb] Device access token is invalid.");
+    }
+    const accessToken = createAccessTokenRecord(this.state, input.accessToken);
+    const consumed = {
+      ...authorization,
+      status: "consumed",
+      consumedAt: new Date(input.completedAt)
+    };
+    this.state.deviceAuthorizations.set(key, cloneRecord(consumed));
+    return { authorization: cloneRecord(consumed), accessToken: cloneRecord(accessToken) };
   }
   async completeMagicLinkSignIn(input) {
     const projectId = assertNonEmpty2(input.projectId, "Project id");
@@ -3036,6 +3200,6 @@ var SYSTEM_PRINCIPAL = { type: "system", id: "system" };
 function principalsEqual(left, right) {
   return left.type === right.type && left.id === right.id;
 }
-export { PERSONAL_ACCESS_TOKEN_PREFIX, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, generateAccessTokenSecret, hashAccessTokenSecret, formatAccessTokenValue, parseAccessTokenValue, getBearerAccessTokenValue, createAccessTokenCredential, CSRF_HEADER_NAME, generateCsrfToken, isCsrfExemptMethod, verifyDoubleSubmitCsrf, applications, SecurityValidationError, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup, defineRole, defineMembershipPolicy, every, can, SecurityRegistry, AuthStorageError, paginate, InMemoryAuthStorage, generateSessionSecret, hashSessionSecret, formatSessionCookieValue, parseSessionCookieValue, createSessionCredential, AuthRuntime, SYSTEM_PRINCIPAL, principalsEqual };
+export { PERSONAL_ACCESS_TOKEN_PREFIX, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, generateAccessTokenSecret, hashAccessTokenSecret, formatAccessTokenValue, parseAccessTokenValue, getBearerAccessTokenValue, createAccessTokenCredential, CSRF_HEADER_NAME, generateCsrfToken, isCsrfExemptMethod, verifyDoubleSubmitCsrf, applications, SecurityValidationError, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup, defineRole, defineMembershipPolicy, every, can, SecurityRegistry, AuthStorageError, MAX_PENDING_DEVICE_AUTHORIZATIONS, paginate, InMemoryAuthStorage, generateSessionSecret, hashSessionSecret, formatSessionCookieValue, parseSessionCookieValue, createSessionCredential, AuthRuntime, SYSTEM_PRINCIPAL, principalsEqual };
 
-//# debugId=C60B118153C5BA0F64756E2164756E21
+//# debugId=D187F2B23E70181D64756E2164756E21