@sixb/core 0.1.7 → 0.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sixb/core",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "The ontology-first runtime for Sixb — objects, links, telemetry, actions, and provider contracts",
   "keywords": [
     "sixb",
@@ -29,23 +29,17 @@
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
-    "./actions/worker": {
-      "types": "./dist/actions/worker.d.ts",
-      "bun": "./src/actions/worker.ts",
-      "import": "./dist/actions/worker.js",
-      "default": "./dist/actions/worker.js"
-    },
     "./agents/context": {
-      "types": "./dist/agents/context.d.ts",
-      "bun": "./src/agents/context.ts",
-      "import": "./dist/agents/context.js",
-      "default": "./dist/agents/context.js"
+      "types": "./dist/agents/context/index.d.ts",
+      "bun": "./src/agents/context/index.ts",
+      "import": "./dist/agents/context/index.js",
+      "default": "./dist/agents/context/index.js"
     },
     "./agents/streams": {
-      "types": "./dist/agents/streams.d.ts",
-      "bun": "./src/agents/streams.ts",
-      "import": "./dist/agents/streams.js",
-      "default": "./dist/agents/streams.js"
+      "types": "./dist/agents/streams/index.d.ts",
+      "bun": "./src/agents/streams/index.ts",
+      "import": "./dist/agents/streams/index.js",
+      "default": "./dist/agents/streams/index.js"
     },
     "./auth/strategy": {
       "types": "./dist/auth/strategy.d.ts",
@@ -71,18 +65,18 @@
       "import": "./dist/broker/index.js",
       "default": "./dist/broker/index.js"
     },
-    "./events/scope": {
-      "types": "./dist/events/scope.d.ts",
-      "bun": "./src/events/scope.ts",
-      "import": "./dist/events/scope.js",
-      "default": "./dist/events/scope.js"
-    },
     "./events/selectors": {
       "types": "./dist/events/selectors/index.d.ts",
       "bun": "./src/events/selectors/index.ts",
       "import": "./dist/events/selectors/index.js",
       "default": "./dist/events/selectors/index.js"
     },
+    "./internal/action-edits": {
+      "types": "./dist/actions/worker.d.ts",
+      "bun": "./src/actions/worker.ts",
+      "import": "./dist/actions/worker.js",
+      "default": "./dist/actions/worker.js"
+    },
     "./internal/actions": {
       "types": "./dist/actions/index.d.ts",
       "bun": "./src/actions/index.ts",
@@ -119,6 +113,12 @@
       "import": "./dist/storage/webhook-runs/provider.js",
       "default": "./dist/storage/webhook-runs/provider.js"
     },
+    "./internal/agents/streams": {
+      "types": "./dist/agents/streams/internal.d.ts",
+      "bun": "./src/agents/streams/internal.ts",
+      "import": "./dist/agents/streams/internal.js",
+      "default": "./dist/agents/streams/internal.js"
+    },
     "./internal/agents": {
       "types": "./dist/agents/index.d.ts",
       "bun": "./src/agents/index.ts",
@@ -179,6 +179,12 @@
       "import": "./dist/storage/connector-connections/provider.js",
       "default": "./dist/storage/connector-connections/provider.js"
     },
+    "./internal/datasets": {
+      "types": "./dist/datasets/write.d.ts",
+      "bun": "./src/datasets/write.ts",
+      "import": "./dist/datasets/write.js",
+      "default": "./dist/datasets/write.js"
+    },
     "./internal/edits": {
       "types": "./dist/edits/index.d.ts",
       "bun": "./src/edits/index.ts",
@@ -197,6 +203,12 @@
       "import": "./dist/errors/internal.js",
       "default": "./dist/errors/internal.js"
     },
+    "./internal/event-scope": {
+      "types": "./dist/events/scope.d.ts",
+      "bun": "./src/events/scope.ts",
+      "import": "./dist/events/scope.js",
+      "default": "./dist/events/scope.js"
+    },
     "./internal/events": {
       "types": "./dist/events/index.d.ts",
       "bun": "./src/events/index.ts",
@@ -216,10 +228,10 @@
       "default": "./dist/http/index.js"
     },
     "./internal/logging": {
-      "types": "./dist/logging/index.d.ts",
-      "bun": "./src/logging/index.ts",
-      "import": "./dist/logging/index.js",
-      "default": "./dist/logging/index.js"
+      "types": "./dist/logging/internal.d.ts",
+      "bun": "./src/logging/internal.ts",
+      "import": "./dist/logging/internal.js",
+      "default": "./dist/logging/internal.js"
     },
     "./internal/materialization": {
       "types": "./dist/materialization/index.d.ts",
@@ -233,6 +245,12 @@
       "import": "./dist/materializer/index.js",
       "default": "./dist/materializer/index.js"
     },
+    "./internal/model-execution": {
+      "types": "./dist/models/execution/index.d.ts",
+      "bun": "./src/models/execution/index.ts",
+      "import": "./dist/models/execution/index.js",
+      "default": "./dist/models/execution/index.js"
+    },
     "./internal/objects": {
       "types": "./dist/objects/index.d.ts",
       "bun": "./src/objects/index.ts",
@@ -263,6 +281,24 @@
       "import": "./dist/storage/projection-runs/provider.js",
       "default": "./dist/storage/projection-runs/provider.js"
     },
+    "./internal/share-grant-storage-provider": {
+      "types": "./dist/storage/share-grants/provider.d.ts",
+      "bun": "./src/storage/share-grants/provider.ts",
+      "import": "./dist/storage/share-grants/provider.js",
+      "default": "./dist/storage/share-grants/provider.js"
+    },
+    "./internal/shares": {
+      "types": "./dist/shares/internal.d.ts",
+      "bun": "./src/shares/internal.ts",
+      "import": "./dist/shares/internal.js",
+      "default": "./dist/shares/internal.js"
+    },
+    "./internal/share-session-storage-provider": {
+      "types": "./dist/storage/share-sessions/provider.d.ts",
+      "bun": "./src/storage/share-sessions/provider.ts",
+      "import": "./dist/storage/share-sessions/provider.js",
+      "default": "./dist/storage/share-sessions/provider.js"
+    },
     "./internal/projections": {
       "types": "./dist/projections/internal.d.ts",
       "bun": "./src/projections/internal.ts",
@@ -323,6 +359,12 @@
       "import": "./dist/schedules/index.js",
       "default": "./dist/schedules/index.js"
     },
+    "./internal/storage": {
+      "types": "./dist/storage/internal.d.ts",
+      "bun": "./src/storage/internal.ts",
+      "import": "./dist/storage/internal.js",
+      "default": "./dist/storage/internal.js"
+    },
     "./internal/storage-operation-scope": {
       "types": "./dist/storage/operation-scope.d.ts",
       "bun": "./src/storage/operation-scope.ts",
@@ -366,10 +408,10 @@
       "default": "./dist/models/index.js"
     },
     "./logging": {
-      "types": "./dist/logging/types.d.ts",
-      "bun": "./src/logging/types.ts",
-      "import": "./dist/logging/types.js",
-      "default": "./dist/logging/types.js"
+      "types": "./dist/logging/index.d.ts",
+      "bun": "./src/logging/index.ts",
+      "import": "./dist/logging/index.js",
+      "default": "./dist/logging/index.js"
     },
     "./ontology": {
       "types": "./dist/ontology/index.d.ts",
@@ -421,7 +463,7 @@
   },
   "license": "MIT",
   "engines": {
-    "bun": ">=1.3.0"
+    "bun": ">=1.4.2"
   },
   "publishConfig": {
     "access": "public"

package/src/actions/delegated-admission.ts

@@ -0,0 +1,72 @@
+import { AuthorizationError } from "../authorization"
+import type { ResolvedRuntimeAuthorization } from "../execution/authorization"
+import {
+  type AuthorizedObjectReader,
+  assertAuthorizedObjectReaderBinding,
+} from "../execution/authorized-object-reader"
+import type { ExecutionContext, RuntimeAuthorization } from "../execution/types"
+import type { ActionDefinition, ActionObjectSubject, ActionSubject } from "./types"
+
+type DelegatedAuthorization = Extract<ResolvedRuntimeAuthorization, { readonly type: "delegated" }>
+
+/** Reject ungranted tuples before Action lookup can become a metadata oracle. */
+export function assertDelegatedActionTarget(input: {
+  readonly authorization: DelegatedAuthorization
+  readonly actionId: string
+  readonly subject: ActionSubject
+}): ActionObjectSubject {
+  const { actionId, authorization, subject } = input
+  if (
+    subject.kind !== "object" ||
+    !authorization.actionApply.some(
+      (target) =>
+        target.actionId === actionId &&
+        target.subject.objectTypeId === subject.objectTypeId &&
+        target.subject.primaryId === subject.primaryId
+    )
+  ) {
+    throw denied(actionId, subject)
+  }
+  return subject
+}
+
+/** Admit an exact tuple against its definition and current selected-read visibility. */
+export async function admitDelegatedObjectAction(input: {
+  readonly objectReader: AuthorizedObjectReader
+  readonly runtimeAuthorization: RuntimeAuthorization
+  readonly execution: ExecutionContext
+  readonly authorization: DelegatedAuthorization
+  readonly action: ActionDefinition
+  readonly subject: ActionObjectSubject
+}): Promise<void> {
+  const { action, authorization, execution, objectReader, runtimeAuthorization, subject } = input
+  assertDelegatedActionTarget({ authorization, actionId: action.id, subject })
+  if (action.binding.kind !== "object" || action.binding.objectType.id !== subject.objectTypeId) {
+    throw denied(action.id, subject)
+  }
+
+  assertAuthorizedObjectReaderBinding({
+    reader: objectReader,
+    scope: { execution, authorization: runtimeAuthorization },
+  })
+
+  try {
+    const visible = await objectReader.getByPrimaryId({
+      objectTypeId: subject.objectTypeId,
+      primaryId: subject.primaryId,
+    })
+    if (!visible) throw denied(action.id, subject)
+  } catch (error) {
+    if (error instanceof AuthorizationError) throw denied(action.id, subject)
+    throw error
+  }
+}
+
+function denied(actionId: string, subject: ActionSubject): AuthorizationError {
+  const target =
+    subject.kind === "object" ? `${subject.objectTypeId}:${subject.primaryId}` : "global"
+  return new AuthorizationError(
+    `apply:action:${actionId}:${target}`,
+    `[Sixb] Delegated authority cannot apply Action '${actionId}' to '${target}'.`
+  )
+}

package/src/actions/descriptor.ts

@@ -0,0 +1,58 @@
+import type { ActionDefinition, ActionParamsConfig } from "./types"
+
+type DeepReadonly<T> = T extends object ? { readonly [TKey in keyof T]: DeepReadonly<T[TKey]> } : T
+
+export type ActionDescriptorBinding =
+  | { readonly kind: "global" }
+  | { readonly kind: "object"; readonly objectTypeId: string }
+
+export type ActionParamDescriptor = DeepReadonly<ActionParamsConfig[string]>
+
+export interface ActionPhaseDescriptor {
+  readonly validate: boolean
+  readonly writeback: boolean
+  readonly edits: boolean
+  readonly effects: boolean
+}
+
+/** Immutable metadata exposed by the execution-bound Actions catalog. */
+export interface ActionDescriptor<TId extends string = string> {
+  readonly id: TId
+  readonly description?: string
+  readonly binding: ActionDescriptorBinding
+  readonly params: Readonly<Record<string, ActionParamDescriptor>>
+  readonly phases: ActionPhaseDescriptor
+}
+
+/** Project an executable definition into inert, detached public metadata. */
+export function snapshotActionDescriptor(action: ActionDefinition): ActionDescriptor {
+  const params = Object.fromEntries(
+    Object.entries(action.params).map(([id, config]) => [id, structuredClone(config)])
+  ) as Record<string, ActionParamDescriptor>
+
+  return deepFreeze({
+    id: action.id,
+    ...(action.description === undefined ? {} : { description: action.description }),
+    binding:
+      action.binding.kind === "global"
+        ? { kind: "global" as const }
+        : { kind: "object" as const, objectTypeId: action.binding.objectType.id },
+    params,
+    phases: {
+      validate: action.phases.validate.length > 0,
+      writeback: action.phases.writeback !== undefined,
+      edits: action.phases.edits !== undefined,
+      effects: action.phases.effects !== undefined,
+    },
+  })
+}
+
+function deepFreeze<T>(value: T, seen: Set<object> = new Set()): T {
+  if (typeof value !== "object" || value === null || seen.has(value)) return value
+  seen.add(value)
+  for (const key of Reflect.ownKeys(value)) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key)
+    if (descriptor && "value" in descriptor) deepFreeze(descriptor.value, seen)
+  }
+  return Object.freeze(value)
+}

package/src/actions/execution.ts

@@ -1,5 +1,10 @@
 import { canViewActionRun, isAllowed } from "../authorization"
 import type { ExecutionContext } from "../execution"
+import { resolveRuntimeAuthorizationForProject } from "../execution/authorization"
+import {
+  assertAuthorizedObjectReaderBinding,
+  getAuthorizedOntologyView,
+} from "../execution/authorized-object-reader"
 import type { ObjectType } from "../ontology"
 import type { SixbRuntimeContext } from "../runtime/types"
 import type {
@@ -7,6 +12,8 @@ import type {
   ListActionRunsInput,
   ListActionRunsResult,
 } from "../storage/action-runs"
+import { assertObjectReadOutputWithinLimit } from "../storage/objects/execution-limits"
+import { type ActionDescriptor, snapshotActionDescriptor } from "./descriptor"
 import {
   type RequestActionAndWaitInput,
   type RequestActionInput,
@@ -14,6 +21,7 @@ import {
   requestAction,
   requestActionAndWait,
 } from "./request"
+import { canDelegationAccessActionRun } from "./run-authorization"
 import type { ActionDefinition } from "./types"
 
 export interface ActionRunsRuntime {
@@ -24,10 +32,10 @@ export interface ActionRunsRuntime {
 }
 
 export interface ActionsRuntime {
-  list(): readonly ActionDefinition[]
-  getById(actionId: string): ActionDefinition | null
-  listGlobal(): readonly ActionDefinition[]
-  listForType(objectType: ObjectType): readonly ActionDefinition[]
+  list(): readonly ActionDescriptor[]
+  getById(actionId: string): ActionDescriptor | null
+  listGlobal(): readonly ActionDescriptor[]
+  listForType(objectType: ObjectType): readonly ActionDescriptor[]
   request(input: RequestActionInput): Promise<RequestActionResult>
   requestAndWait(input: RequestActionAndWaitInput): Promise<ActionRunRecord>
   readonly runs: ActionRunsRuntime
@@ -37,45 +45,112 @@ export function createActionsRuntime(
   runtime: SixbRuntimeContext,
   execution: ExecutionContext
 ): ActionsRuntime {
-  const canList = (action: ActionDefinition) =>
-    isAllowed(runtime.authorization, { kind: "action.apply", actionId: action.id }) &&
-    (action.binding.kind === "global" ||
-      isAllowed(runtime.authorization, {
-        kind: "object.view",
-        objectTypeId: action.binding.objectType.id,
-      }))
+  const projectId = runtime.projectId
+  const runtimeAuthorization = runtime.runtimeAuthorization
+  const objectReader = runtime.objectReader
+  assertAuthorizedObjectReaderBinding({
+    reader: objectReader,
+    scope: { execution, authorization: runtimeAuthorization },
+  })
+  const authorization = resolveRuntimeAuthorizationForProject({
+    projectId,
+    runtimeAuthorization,
+  })
+  const canList = (action: ActionDefinition) => {
+    if (authorization.type === "denied") return false
+    if (authorization.type === "delegated") {
+      const binding = action.binding
+      return (
+        binding.kind === "object" &&
+        authorization.actionApply.some(
+          (target) =>
+            target.actionId === action.id && target.subject.objectTypeId === binding.objectType.id
+        ) &&
+        getAuthorizedOntologyView(objectReader).getObjectTypeById(binding.objectType.id) !== null
+      )
+    }
+    if (authorization.type === "unrestricted") return true
+    return (
+      isAllowed(authorization.context, { kind: "action.apply", actionId: action.id }) &&
+      (action.binding.kind === "global" ||
+        isAllowed(authorization.context, {
+          kind: "object.view",
+          objectTypeId: action.binding.objectType.id,
+        }))
+    )
+  }
+
+  const release = <T>(value: T): T => {
+    if (authorization.type === "delegated") {
+      assertObjectReadOutputWithinLimit(value, authorization.objectRead.limits)
+    }
+    return value
+  }
+  const describeAll = (actions: readonly ActionDefinition[]) =>
+    release(actions.filter(canList).map(snapshotActionDescriptor))
 
   return {
-    list: () => runtime.actionRegistry.list().filter(canList),
+    list: () => describeAll(runtime.actionRegistry.list()),
     getById: (actionId) => {
       const action = runtime.actionRegistry.getById(actionId)
-      return action && canList(action) ? action : null
+      return release(action && canList(action) ? snapshotActionDescriptor(action) : null)
     },
-    listGlobal: () => runtime.actionRegistry.listGlobal().filter(canList),
-    listForType: (objectType) => runtime.actionRegistry.listForType(objectType).filter(canList),
+    listGlobal: () => describeAll(runtime.actionRegistry.listGlobal()),
+    listForType: (objectType) =>
+      describeAll(
+        runtime.actionRegistry
+          .listForType(objectType)
+          .filter(
+            (action) =>
+              authorization.type !== "delegated" ||
+              (action.binding.kind === "object" && action.binding.objectType.id === objectType.id)
+          )
+      ),
     request: (input) => requestAction(runtime, execution, input),
     requestAndWait: (input) => requestActionAndWait(runtime, execution, input),
     runs: {
       getById: async (runId) => {
+        if (
+          authorization.type === "denied" ||
+          (authorization.type === "delegated" &&
+            (!authorization.delegation || authorization.actionApply.length === 0))
+        )
+          return null
         const run =
           (await runtime.storage.actionRuns?.getById({
-            projectId: runtime.projectId,
+            projectId,
             id: runId,
           })) ?? null
-        return run && canViewActionRun(runtime.authorization, run) ? run : null
+        return run &&
+          (authorization.type === "unrestricted" ||
+            (authorization.type === "principal" && canViewActionRun(authorization.context, run)) ||
+            (authorization.type === "delegated" &&
+              (await canDelegationAccessActionRun({
+                storage: runtime.storage,
+                projectId,
+                authority: authorization,
+                run,
+              }))))
+          ? release(run)
+          : null
       },
       list: (input = {}) => {
+        if (authorization.type === "denied" || authorization.type === "delegated") {
+          return Promise.resolve({ runs: [], hasMore: false, total: 0 })
+        }
         const storage = runtime.storage.actionRuns
         if (!storage) return Promise.resolve({ runs: [], hasMore: false, total: 0 })
         return storage.list({
-          projectId: runtime.projectId,
           ...input,
-          actionIds: runtime.authorization
-            ? [...runtime.authorization.grants["apply:action"]]
-            : undefined,
-          objectTypeIds: runtime.authorization
-            ? [...runtime.authorization.grants["view:object"]]
-            : undefined,
+          projectId,
+          actionIds:
+            authorization.type === "principal"
+              ? [...authorization.context.grants["apply:action"]]
+              : undefined,
+          objectTypeIds:
+            authorization.type === "principal"
+              ? [...authorization.context.grants["view:object"]]
+              : undefined,
         })
       },
     },