@vertesia/studio-utils 1.6.0-dev.20260918.115658Z → 1.6.0-dev.20261004.085740Z
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/conditions/index.d.ts +1 -0
- package/lib/conditions/index.d.ts.map +1 -1
- package/lib/conditions/index.js +1 -0
- package/lib/conditions/index.js.map +1 -1
- package/lib/conditions/principal-context.d.ts +55 -0
- package/lib/conditions/principal-context.d.ts.map +1 -0
- package/lib/conditions/principal-context.js +81 -0
- package/lib/conditions/principal-context.js.map +1 -0
- package/lib/index.d.ts +2 -1
- package/lib/index.d.ts.map +1 -1
- package/lib/index.js +4 -1
- package/lib/index.js.map +1 -1
- package/lib/prompts/extract-vars.d.ts +44 -12
- package/lib/prompts/extract-vars.d.ts.map +1 -1
- package/lib/prompts/extract-vars.js +165 -78
- package/lib/prompts/extract-vars.js.map +1 -1
- package/lib/prompts/render.d.ts +7 -9
- package/lib/prompts/render.d.ts.map +1 -1
- package/lib/prompts/render.js +12 -15
- package/lib/prompts/render.js.map +1 -1
- package/lib/prompts/validate.d.ts +8 -2
- package/lib/prompts/validate.d.ts.map +1 -1
- package/lib/prompts/validate.js +87 -51
- package/lib/prompts/validate.js.map +1 -1
- package/lib/roles/agent-runs.d.ts +8 -0
- package/lib/roles/agent-runs.d.ts.map +1 -0
- package/lib/roles/agent-runs.js +36 -0
- package/lib/roles/agent-runs.js.map +1 -0
- package/lib/roles/classes.d.ts +15 -1
- package/lib/roles/classes.d.ts.map +1 -1
- package/lib/roles/classes.js +10 -1
- package/lib/roles/classes.js.map +1 -1
- package/lib/roles/content.d.ts.map +1 -1
- package/lib/roles/content.js +14 -4
- package/lib/roles/content.js.map +1 -1
- package/lib/roles/index.d.ts +4 -3
- package/lib/roles/index.d.ts.map +1 -1
- package/lib/roles/index.js +7 -5
- package/lib/roles/index.js.map +1 -1
- package/lib/vertesia-studio-utils.js +2 -1
- package/lib/vertesia-studio-utils.js.map +1 -1
- package/package.json +12 -11
- package/src/conditions/index.ts +6 -0
- package/src/conditions/principal-context.ts +122 -0
- package/src/index.ts +20 -1
- package/src/prompts/extract-vars.ts +212 -71
- package/src/prompts/render.ts +24 -15
- package/src/prompts/validate.ts +113 -57
- package/src/roles/agent-runs.ts +41 -0
- package/src/roles/classes.ts +7 -0
- package/src/roles/content.ts +21 -5
- package/src/roles/index.ts +7 -5
- package/src/apps/index.test.ts +0 -166
- package/src/conditions/match.test.ts +0 -134
- package/src/prompts/render.test.ts +0 -110
- package/src/prompts/validate.test.ts +0 -309
- package/src/roles/index.test.ts +0 -221
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/prompts/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,KAAK,gBAAgB,EAAwB,KAAK,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/prompts/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,KAAK,gBAAgB,EAAwB,KAAK,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClH,OAAO,EAIH,KAAK,qBAAqB,EAE7B,MAAM,eAAe,CAAC;AAEvB,MAAM,WAAW,cAAc;IAC3B,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,YAAY,EACzB,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,EAChB,MAAM,CAAC,EAAE,qBAAqB,GAC/B,MAAM,CASR;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACtB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,GACjB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAOxE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC7B,iBAAiB,EAAE,MAAM,EACzB,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,GACjB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAOxE;AAqCD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,gBAAgB,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,GAAG,cAAc,EAAE,CAU/G;AAED,wBAAgB,sBAAsB,CAClC,QAAQ,EAAE,gBAAgB,CAAC,cAAc,CAAC,EAAE,EAC5C,YAAY,EAAE,MAAM,GAAG,UAAU,GAClC,cAAc,EAAE,CAsBlB;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,gBAAgB,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,GAAG,aAAa,EAAE,CAwB/G"}
|
package/lib/prompts/render.js
CHANGED
|
@@ -1,31 +1,28 @@
|
|
|
1
1
|
import { PromptSegmentDefType, TemplateType } from '@vertesia/common';
|
|
2
|
-
import { CompositeError, renderHandlebarsTemplate, renderJsTemplate } from '@vertesia/jst';
|
|
2
|
+
import { CompositeError, renderHandlebarsTemplate, renderJsTemplate, withTemplateSystemVariables, } from '@vertesia/jst';
|
|
3
3
|
/**
|
|
4
4
|
* Render a prompt template with the given input data.
|
|
5
5
|
*
|
|
6
|
-
* Handlebars templates use {{variable}} interpolation against `data`.
|
|
7
|
-
*
|
|
8
|
-
*
|
|
9
|
-
* studio-server executor
|
|
10
|
-
*
|
|
11
|
-
* and `apps/studio-server/src/executor/rendering/template.ts`). Listing it here keeps
|
|
12
|
-
* the Playground preview and `validatePrompt` in sync with runtime resolution — a JST
|
|
13
|
-
* template referencing `_model` validates fine here and renders fine in production.
|
|
6
|
+
* Handlebars templates use {{variable}} interpolation against `data`. JST (JavaScript template)
|
|
7
|
+
* bodies evaluate against `data` with the schema's top-level property names exposed as globals.
|
|
8
|
+
* Both see the system variables (`TEMPLATE_SYSTEM_VARIABLES` in `@vertesia/jst`), added here the
|
|
9
|
+
* same way the studio-server executor adds them, so a preview renders what an execution would.
|
|
10
|
+
* `_model` is only set when the caller passes `system.model` or the data already carries it.
|
|
14
11
|
*
|
|
15
12
|
* For `TemplateType.text`, the content is returned verbatim — it is static text, not a
|
|
16
13
|
* template — matching the studio-server executor (see `apps/studio-server/src/executor/
|
|
17
14
|
* rendering/template.ts`). Routing it through the JST evaluator would compile the prose as
|
|
18
15
|
* JavaScript and throw on any plain sentence (e.g. "You are a helpful assistant.").
|
|
19
16
|
*/
|
|
20
|
-
export function renderTemplate(code, contentType, schema, data) {
|
|
21
|
-
if (contentType === TemplateType.handlebars) {
|
|
22
|
-
return renderHandlebarsTemplate(code, data);
|
|
23
|
-
}
|
|
17
|
+
export function renderTemplate(code, contentType, schema, data, system) {
|
|
24
18
|
if (contentType === TemplateType.text) {
|
|
25
19
|
return code;
|
|
26
20
|
}
|
|
27
|
-
const
|
|
28
|
-
|
|
21
|
+
const input = withTemplateSystemVariables(data, system);
|
|
22
|
+
if (contentType === TemplateType.handlebars) {
|
|
23
|
+
return renderHandlebarsTemplate(code, input);
|
|
24
|
+
}
|
|
25
|
+
return renderJsTemplate(code, schema.properties ? Object.keys(schema.properties) : [], input);
|
|
29
26
|
}
|
|
30
27
|
/**
|
|
31
28
|
* Execute a JST (JavaScript Template) with given data.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/prompts/render.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,oBAAoB,EAAuB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClH,OAAO,
|
|
1
|
+
{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/prompts/render.ts"],"names":[],"mappings":"AACA,OAAO,EAAyB,oBAAoB,EAAuB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClH,OAAO,EACH,cAAc,EACd,wBAAwB,EACxB,gBAAgB,EAEhB,2BAA2B,GAC9B,MAAM,eAAe,CAAC;AASvB;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAC1B,IAAY,EACZ,WAAyB,EACzB,MAAkB,EAClB,IAAgB,EAChB,MAA8B;IAE9B,IAAI,WAAW,KAAK,YAAY,CAAC,IAAI,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,WAAW,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;QAC1C,OAAO,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAClG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACtB,UAAkB,EAClB,MAAkB,EAClB,IAAgB;IAEhB,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7F,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC7B,iBAAyB,EACzB,MAAkB,EAClB,IAAgB;IAEhB,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,iBAAiB,EAAE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACxF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7F,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAyC,EAAE,IAAgB;IAClF,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,OAAe,CAAC;IACpB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACJ,OAAO,GAAG,OAAO,OAAO,gCAAgC,CAAC;IAC7D,CAAC;IACD,OAAO;QACH,KAAK,EAAE,cAAc;QACrB,OAAO;KACV,CAAC;AACN,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAyC,EAAE,IAAgB;IACtF,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,wCAAwC,CAAC,EAAE,CAAC;IACnH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACtG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,8EAA8E;QAC9E,OAAO;YACH,KAAK;YACL,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/D,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SACnE,CAAC;IACN,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAA4C,EAAE,IAAgB;IACzF,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,CAAC,IAAI,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,CAAC,QAAQ,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACnD,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CAClC,QAA4C,EAC5C,YAAiC;IAEjC,IAAI,CAAC;QACD,OAAO,cAAc,CACjB,QAAQ,EACR,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAC1F,CAAC;IACN,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACtB,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC9B,KAAK,EAAE,GAAY;gBACnB,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,GAAG,CAAC,OAAO;aACvB,CAAC,CAAC,CAAC;QACR,CAAC;QACD,OAAO;YACH;gBACI,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChE,KAAK,EAAE,iBAAiB;gBACxB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAClE;SACJ,CAAC;IACN,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAA4C,EAAE,OAAmB;IAC1F,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACzG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,CAAC,IAAI,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACtE,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACZ,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBAC5D,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACvD,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,aAAsB;IACtC,IACI,OAAO,aAAa,KAAK,QAAQ;QACjC,aAAa,KAAK,IAAI;QACtB,SAAS,IAAI,aAAa;QAC1B,OAAQ,aAAsC,CAAC,OAAO,KAAK,QAAQ,EACrE,CAAC;QACC,OAAQ,aAAqC,CAAC,OAAO,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,SAAS,IAAI,KAAK,CAAC;AAChG,CAAC"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { type JSONSchema, TemplateType } from '@vertesia/common';
|
|
2
|
-
export type PromptValidationIssueType = 'undeclared_template_variable' | 'unused_schema_variable' | 'handlebars_render_error' | 'jst_unsafe_construct' | 'jst_render_error';
|
|
2
|
+
export type PromptValidationIssueType = 'undeclared_template_variable' | 'unused_schema_variable' | 'reserved_variable_declared' | 'system_variable_property_access' | 'helper_used_as_value' | 'helper_missing_arguments' | 'handlebars_render_error' | 'jst_unsafe_construct' | 'jst_render_error';
|
|
3
3
|
export type PromptValidationIssueSeverity = 'error' | 'warning';
|
|
4
4
|
export interface PromptValidationIssue {
|
|
5
5
|
/** Discriminator for issue kind */
|
|
@@ -32,9 +32,15 @@ export interface PromptValidationInput {
|
|
|
32
32
|
*
|
|
33
33
|
* For `handlebars` and `jst` templates, the following checks are performed:
|
|
34
34
|
* 1. Every variable referenced in the template must be declared as a top-level property
|
|
35
|
-
* in `inputSchema.properties` (else → `undeclared_template_variable` error).
|
|
35
|
+
* in `inputSchema.properties` (else → `undeclared_template_variable` error). System variables
|
|
36
|
+
* (`TEMPLATE_SYSTEM_VARIABLES` in `@vertesia/jst`) are supplied at runtime and need no declaration;
|
|
37
|
+
* declaring one → `reserved_variable_declared` warning, reading a property of one →
|
|
38
|
+
* `system_variable_property_access` error.
|
|
36
39
|
* 2. Every property declared in `inputSchema.properties` should be referenced by the template
|
|
37
40
|
* (else → `unused_schema_variable` warning — non-blocking).
|
|
41
|
+
* For Handlebars only: a helper passed as an argument (`{{#if stringify}}`) →
|
|
42
|
+
* `helper_used_as_value` error; a helper called bare without the arguments it needs
|
|
43
|
+
* (`{{stringify}}`) → `helper_missing_arguments` error.
|
|
38
44
|
* 3. The template must render successfully against schema-derived mock data
|
|
39
45
|
* (else → `handlebars_render_error` / `jst_render_error` error).
|
|
40
46
|
* 4. For JST only: unsafe constructs (`with`, `for`, `while`, `import`, class, `this`,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/prompts/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/prompts/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAcjE,MAAM,MAAM,yBAAyB,GAC/B,8BAA8B,GAC9B,wBAAwB,GACxB,4BAA4B,GAC5B,iCAAiC,GACjC,sBAAsB,GACtB,0BAA0B,GAC1B,yBAAyB,GACzB,sBAAsB,GACtB,kBAAkB,CAAC;AAEzB,MAAM,MAAM,6BAA6B,GAAG,OAAO,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,qBAAqB;IAClC,mCAAmC;IACnC,IAAI,EAAE,yBAAyB,CAAC;IAChC,uEAAuE;IACvE,QAAQ,EAAE,6BAA6B,CAAC;IACxC,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACnC,2FAA2F;IAC3F,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,aAAa,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IAClC,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,WAAW,EAAE,YAAY,CAAC;IAC1B,gEAAgE;IAChE,WAAW,CAAC,EAAE,UAAU,CAAC;CAC5B;AAyLD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB,CAWnF"}
|
package/lib/prompts/validate.js
CHANGED
|
@@ -1,17 +1,8 @@
|
|
|
1
1
|
import { TemplateType } from '@vertesia/common';
|
|
2
|
-
import { getFreeVariables, renderJsTemplate } from '@vertesia/jst';
|
|
3
|
-
import {
|
|
2
|
+
import { describeTemplateSystemVariables, getFreeVariables, isTemplateSystemVariable, JST_TEMPLATE_GLOBALS, renderJsTemplate, TEMPLATE_SYSTEM_VARIABLES, withTemplateSystemVariables, } from '@vertesia/jst';
|
|
3
|
+
import { analyzeHandlebarsTemplate } from './extract-vars.js';
|
|
4
4
|
import { generateMockData } from './mock-data.js';
|
|
5
5
|
import { executeHandlebars } from './render.js';
|
|
6
|
-
// JST's renderJsTemplate auto-adds `_` (helpers object) and runtime injects `Set` and `Array`
|
|
7
|
-
// — treat them as globals so they don't appear as free vars in user templates.
|
|
8
|
-
// Globals always available to JST templates regardless of schema:
|
|
9
|
-
// - `_`, `Array`, `Set`: runtime-injected by `renderJsTemplate` (jst library)
|
|
10
|
-
// - `_model`: runtime-injected by the studio-server executor as `{ ..._model: run.modelId }`
|
|
11
|
-
// (see ExecutionRequest.ts:313 and executor/rendering/template.ts:13)
|
|
12
|
-
// Keeping these in sync with `renderTemplate` in ./render.ts so a JST template that runs in
|
|
13
|
-
// production also passes the validator.
|
|
14
|
-
const JST_AUTO_GLOBALS = ['_', 'Array', 'Set', '_model'];
|
|
15
6
|
function countSeverities(issues) {
|
|
16
7
|
let error_count = 0;
|
|
17
8
|
let warning_count = 0;
|
|
@@ -25,39 +16,96 @@ function countSeverities(issues) {
|
|
|
25
16
|
}
|
|
26
17
|
return { error_count, warning_count };
|
|
27
18
|
}
|
|
28
|
-
|
|
19
|
+
/** Mock data for the render smoke test: schema-shaped input plus the runtime system values. */
|
|
20
|
+
function buildMockInput(inputSchema) {
|
|
21
|
+
const mockData = generateMockData(inputSchema);
|
|
22
|
+
const mockObject = typeof mockData === 'object' && mockData !== null && !Array.isArray(mockData) ? mockData : {};
|
|
23
|
+
return withTemplateSystemVariables(mockObject, { model: 'validation-model' });
|
|
24
|
+
}
|
|
25
|
+
/**
|
|
26
|
+
* Issues shared by both template languages: reserved names declared in the schema, and
|
|
27
|
+
* unused schema properties. `usedVars` holds the input variables the template reads.
|
|
28
|
+
*/
|
|
29
|
+
function checkDeclarations(declaredVars, usedVars, usageHint) {
|
|
29
30
|
const issues = [];
|
|
30
|
-
const
|
|
31
|
-
|
|
32
|
-
for (const used of usedVars) {
|
|
33
|
-
// The execution request injects _model for both template languages.
|
|
34
|
-
if (!declaredVars.has(used) && used !== '_model') {
|
|
31
|
+
for (const declared of declaredVars) {
|
|
32
|
+
if (isTemplateSystemVariable(declared)) {
|
|
35
33
|
issues.push({
|
|
36
|
-
type: '
|
|
37
|
-
severity: '
|
|
38
|
-
variable:
|
|
39
|
-
message: `
|
|
34
|
+
type: 'reserved_variable_declared',
|
|
35
|
+
severity: 'warning',
|
|
36
|
+
variable: declared,
|
|
37
|
+
message: `Schema declares '${declared}', a system variable the runtime supplies and overrides. Remove it from input_schema.`,
|
|
40
38
|
});
|
|
41
39
|
}
|
|
42
|
-
|
|
43
|
-
for (const declared of declaredVars) {
|
|
44
|
-
if (!usedVars.has(declared)) {
|
|
40
|
+
else if (!usedVars.has(declared)) {
|
|
45
41
|
issues.push({
|
|
46
42
|
type: 'unused_schema_variable',
|
|
47
43
|
severity: 'warning',
|
|
48
44
|
variable: declared,
|
|
49
|
-
message: `Schema declares property '${declared}' but the template never references it. Remove it from input_schema or
|
|
45
|
+
message: `Schema declares property '${declared}' but the template never references it. Remove it from input_schema or ${usageHint(declared)}.`,
|
|
50
46
|
});
|
|
51
47
|
}
|
|
52
48
|
}
|
|
49
|
+
return issues;
|
|
50
|
+
}
|
|
51
|
+
function undeclaredVariableIssue(name, where) {
|
|
52
|
+
return {
|
|
53
|
+
type: 'undeclared_template_variable',
|
|
54
|
+
severity: 'error',
|
|
55
|
+
variable: name,
|
|
56
|
+
message: `Template reads variable '${name}' ${where} but it is not declared in input_schema.properties. ` +
|
|
57
|
+
`Add '${name}' to the schema with an appropriate type. ` +
|
|
58
|
+
`System variables need no declaration: ${describeTemplateSystemVariables()}.`,
|
|
59
|
+
};
|
|
60
|
+
}
|
|
61
|
+
function validateHandlebarsPrompt(content, inputSchema) {
|
|
62
|
+
const issues = [];
|
|
63
|
+
const analysis = analyzeHandlebarsTemplate(content);
|
|
64
|
+
const declaredVars = new Set(inputSchema?.properties ? Object.keys(inputSchema.properties) : []);
|
|
65
|
+
const usedVars = new Set();
|
|
66
|
+
const reported = new Set();
|
|
67
|
+
for (const ref of analysis?.references ?? []) {
|
|
68
|
+
if (isTemplateSystemVariable(ref.name)) {
|
|
69
|
+
const variable = TEMPLATE_SYSTEM_VARIABLES.find((v) => v.name === ref.name);
|
|
70
|
+
if (ref.hasPath && variable?.type === 'string' && !reported.has(`path:${ref.expression}`)) {
|
|
71
|
+
reported.add(`path:${ref.expression}`);
|
|
72
|
+
issues.push({
|
|
73
|
+
type: 'system_variable_property_access',
|
|
74
|
+
severity: 'error',
|
|
75
|
+
variable: ref.name,
|
|
76
|
+
message: `'${ref.expression}' in ${ref.tag} reads a property of system variable '${ref.name}', which is a string (${variable.description}). Use '${ref.name}' directly.`,
|
|
77
|
+
});
|
|
78
|
+
}
|
|
79
|
+
continue;
|
|
80
|
+
}
|
|
81
|
+
usedVars.add(ref.name);
|
|
82
|
+
if (!declaredVars.has(ref.name) && !reported.has(ref.name)) {
|
|
83
|
+
reported.add(ref.name);
|
|
84
|
+
issues.push(undeclaredVariableIssue(ref.name, `in ${ref.tag}`));
|
|
85
|
+
}
|
|
86
|
+
}
|
|
87
|
+
for (const misuse of analysis?.helperMisuses ?? []) {
|
|
88
|
+
issues.push(misuse.problem === 'used_as_value'
|
|
89
|
+
? {
|
|
90
|
+
type: 'helper_used_as_value',
|
|
91
|
+
severity: 'error',
|
|
92
|
+
variable: misuse.helper,
|
|
93
|
+
message: `'${misuse.helper}' in ${misuse.tag} is a helper, but as an argument Handlebars reads it as data, which is empty. Call it as a subexpression: (${misuse.helper} ...).`,
|
|
94
|
+
}
|
|
95
|
+
: {
|
|
96
|
+
type: 'helper_missing_arguments',
|
|
97
|
+
severity: 'error',
|
|
98
|
+
variable: misuse.helper,
|
|
99
|
+
message: `${misuse.tag} calls helper '${misuse.helper}' without arguments. Pass the value it operates on, e.g. {{${misuse.helper} value}}.`,
|
|
100
|
+
});
|
|
101
|
+
}
|
|
102
|
+
issues.push(...checkDeclarations(declaredVars, usedVars, (name) => `use it via {{${name}}}`));
|
|
53
103
|
// Render-time smoke test — always runs so syntax errors and failing helper calls are
|
|
54
104
|
// surfaced even when undeclared-variable errors are already in the list. Handlebars renders
|
|
55
105
|
// missing vars as empty strings (non-strict by default), so the render check does NOT echo
|
|
56
106
|
// the var errors — anything it reports is a distinct template problem worth showing.
|
|
57
107
|
const renderSchema = inputSchema ?? {};
|
|
58
|
-
const
|
|
59
|
-
const mockObject = typeof mockData === 'object' && mockData !== null && !Array.isArray(mockData) ? mockData : {};
|
|
60
|
-
const renderResult = executeHandlebars(content, renderSchema, mockObject);
|
|
108
|
+
const renderResult = executeHandlebars(content, renderSchema, buildMockInput(renderSchema));
|
|
61
109
|
if (!renderResult.success) {
|
|
62
110
|
issues.push({
|
|
63
111
|
type: 'handlebars_render_error',
|
|
@@ -73,7 +121,7 @@ function validateJstPrompt(content, inputSchema) {
|
|
|
73
121
|
let referenced;
|
|
74
122
|
try {
|
|
75
123
|
const result = getFreeVariables(content, {
|
|
76
|
-
globals:
|
|
124
|
+
globals: [...JST_TEMPLATE_GLOBALS],
|
|
77
125
|
acorn: { allowReturnOutsideFunction: true, locations: true },
|
|
78
126
|
});
|
|
79
127
|
referenced = result.vars;
|
|
@@ -96,35 +144,17 @@ function validateJstPrompt(content, inputSchema) {
|
|
|
96
144
|
}
|
|
97
145
|
for (const used of referenced) {
|
|
98
146
|
if (!declaredVars.has(used)) {
|
|
99
|
-
issues.push(
|
|
100
|
-
type: 'undeclared_template_variable',
|
|
101
|
-
severity: 'error',
|
|
102
|
-
variable: used,
|
|
103
|
-
message: `Template references variable '${used}' but it is not declared in input_schema.properties. Add '${used}' to the schema with an appropriate type.`,
|
|
104
|
-
});
|
|
105
|
-
}
|
|
106
|
-
}
|
|
107
|
-
for (const declared of declaredVars) {
|
|
108
|
-
if (!referenced.has(declared)) {
|
|
109
|
-
issues.push({
|
|
110
|
-
type: 'unused_schema_variable',
|
|
111
|
-
severity: 'warning',
|
|
112
|
-
variable: declared,
|
|
113
|
-
message: `Schema declares property '${declared}' but the template never references it. Remove it from input_schema or use it in the template.`,
|
|
114
|
-
});
|
|
147
|
+
issues.push(undeclaredVariableIssue(used, 'in the template'));
|
|
115
148
|
}
|
|
116
149
|
}
|
|
150
|
+
issues.push(...checkDeclarations(declaredVars, referenced, () => 'use it in the template'));
|
|
117
151
|
// Render-time smoke test — only if there are no blocking errors so far, otherwise
|
|
118
152
|
// the failure mode would just echo what we already reported.
|
|
119
153
|
const blockingSoFar = issues.some((i) => i.severity === 'error');
|
|
120
154
|
if (!blockingSoFar) {
|
|
121
155
|
const renderSchema = inputSchema ?? {};
|
|
122
|
-
const mockData = generateMockData(renderSchema);
|
|
123
|
-
const mockObject = typeof mockData === 'object' && mockData !== null && !Array.isArray(mockData)
|
|
124
|
-
? mockData
|
|
125
|
-
: {};
|
|
126
156
|
try {
|
|
127
|
-
renderJsTemplate(content, [...declaredVars],
|
|
157
|
+
renderJsTemplate(content, [...declaredVars], buildMockInput(renderSchema));
|
|
128
158
|
}
|
|
129
159
|
catch (renderError) {
|
|
130
160
|
issues.push({
|
|
@@ -141,9 +171,15 @@ function validateJstPrompt(content, inputSchema) {
|
|
|
141
171
|
*
|
|
142
172
|
* For `handlebars` and `jst` templates, the following checks are performed:
|
|
143
173
|
* 1. Every variable referenced in the template must be declared as a top-level property
|
|
144
|
-
* in `inputSchema.properties` (else → `undeclared_template_variable` error).
|
|
174
|
+
* in `inputSchema.properties` (else → `undeclared_template_variable` error). System variables
|
|
175
|
+
* (`TEMPLATE_SYSTEM_VARIABLES` in `@vertesia/jst`) are supplied at runtime and need no declaration;
|
|
176
|
+
* declaring one → `reserved_variable_declared` warning, reading a property of one →
|
|
177
|
+
* `system_variable_property_access` error.
|
|
145
178
|
* 2. Every property declared in `inputSchema.properties` should be referenced by the template
|
|
146
179
|
* (else → `unused_schema_variable` warning — non-blocking).
|
|
180
|
+
* For Handlebars only: a helper passed as an argument (`{{#if stringify}}`) →
|
|
181
|
+
* `helper_used_as_value` error; a helper called bare without the arguments it needs
|
|
182
|
+
* (`{{stringify}}`) → `helper_missing_arguments` error.
|
|
147
183
|
* 3. The template must render successfully against schema-derived mock data
|
|
148
184
|
* (else → `handlebars_render_error` / `jst_render_error` error).
|
|
149
185
|
* 4. For JST only: unsafe constructs (`with`, `for`, `while`, `import`, class, `this`,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/prompts/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,
|
|
1
|
+
{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/prompts/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EACH,+BAA+B,EAC/B,gBAAgB,EAChB,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,yBAAyB,EACzB,2BAA2B,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AA4ChD,SAAS,eAAe,CAAC,MAA+B;IACpD,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC7B,WAAW,EAAE,CAAC;QAClB,CAAC;aAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACtC,aAAa,EAAE,CAAC;QACpB,CAAC;IACL,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC;AAED,+FAA+F;AAC/F,SAAS,cAAc,CAAC,WAAuB;IAC3C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,UAAU,GACZ,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,QAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,OAAO,2BAA2B,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CACtB,YAAyB,EACzB,QAAqB,EACrB,SAAmC;IAEnC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,4BAA4B;gBAClC,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,oBAAoB,QAAQ,uFAAuF;aAC/H,CAAC,CAAC;QACP,CAAC;aAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,wBAAwB;gBAC9B,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,6BAA6B,QAAQ,0EAA0E,SAAS,CAAC,QAAQ,CAAC,GAAG;aACjJ,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY,EAAE,KAAa;IACxD,OAAO;QACH,IAAI,EAAE,8BAA8B;QACpC,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,IAAI;QACd,OAAO,EACH,4BAA4B,IAAI,KAAK,KAAK,sDAAsD;YAChG,QAAQ,IAAI,4CAA4C;YACxD,yCAAyC,+BAA+B,EAAE,GAAG;KACpF,CAAC;AACN,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe,EAAE,WAAwB;IACvE,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzG,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,UAAU,IAAI,EAAE,EAAE,CAAC;QAC3C,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5E,IAAI,GAAG,CAAC,OAAO,IAAI,QAAQ,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;gBACxF,QAAQ,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;gBACvC,MAAM,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,iCAAiC;oBACvC,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,GAAG,CAAC,IAAI;oBAClB,OAAO,EAAE,IAAI,GAAG,CAAC,UAAU,QAAQ,GAAG,CAAC,GAAG,yCAAyC,GAAG,CAAC,IAAI,yBAAyB,QAAQ,CAAC,WAAW,WAAW,GAAG,CAAC,IAAI,aAAa;iBAC3K,CAAC,CAAC;YACP,CAAC;YACD,SAAS;QACb,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC;IACL,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CACP,MAAM,CAAC,OAAO,KAAK,eAAe;YAC9B,CAAC,CAAC;gBACI,IAAI,EAAE,sBAAsB;gBAC5B,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,QAAQ,MAAM,CAAC,GAAG,8GAA8G,MAAM,CAAC,MAAM,QAAQ;aAClL;YACH,CAAC,CAAC;gBACI,IAAI,EAAE,0BAA0B;gBAChC,QAAQ,EAAE,OAAO;gBACjB,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,kBAAkB,MAAM,CAAC,MAAM,8DAA8D,MAAM,CAAC,MAAM,WAAW;aAC9I,CACV,CAAC;IACN,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC;IAE9F,qFAAqF;IACrF,4FAA4F;IAC5F,2FAA2F;IAC3F,qFAAqF;IACrF,MAAM,YAAY,GAAG,WAAW,IAAK,EAAiB,CAAC;IACvD,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,YAAY,CAAe,CAAC,CAAC;IAC1G,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,gCAAgC,YAAY,CAAC,KAAK,EAAE;SAChE,CAAC,CAAC;IACP,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,WAAwB;IAChE,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEzG,IAAI,UAAuB,CAAC;IAC5B,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE;YACrC,OAAO,EAAE,CAAC,GAAG,oBAAoB,CAAC;YAClC,KAAK,EAAE,EAAE,0BAA0B,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;SAC/D,CAAC,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,sBAAsB;gBAC5B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,2BAA2B,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,OAAO,EAAE;aACrE,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QAClB,sFAAsF;QACtF,MAAM,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,qBAAqB,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;SACxG,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAClE,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAE5F,kFAAkF;IAClF,6DAA6D;IAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IACjE,IAAI,CAAC,aAAa,EAAE,CAAC;QACjB,MAAM,YAAY,GAAG,WAAW,IAAK,EAAiB,CAAC;QACvD,IAAI,CAAC;YACD,gBAAgB,CAAC,OAAO,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,yBAAyB,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;aAC/G,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,cAAc,CAAC,KAA4B;IACvD,IAAI,MAA+B,CAAC;IACpC,IAAI,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,GAAG,EAAE,CAAC;QAChD,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACJ,MAAM,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC/D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AAClD,CAAC"}
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
import { type RolePartition } from './classes.js';
|
|
2
|
+
/** Names of roles that grant conditional access to agent and process runs. */
|
|
3
|
+
export declare enum AgentRunRoleNames {
|
|
4
|
+
agent_run_reader = "agent_runs:reader",
|
|
5
|
+
agent_run_operator = "agent_runs:operator"
|
|
6
|
+
}
|
|
7
|
+
export declare const agentRunPartition: RolePartition;
|
|
8
|
+
//# sourceMappingURL=agent-runs.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"agent-runs.d.ts","sourceRoot":"","sources":["../../src/roles/agent-runs.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAMvE,8EAA8E;AAC9E,oBAAY,iBAAiB;IACzB,gBAAgB,sBAAsB;IACtC,kBAAkB,wBAAwB;CAC7C;AA0BD,eAAO,MAAM,iBAAiB,EAAE,aAG/B,CAAC"}
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
import { Permission } from '@vertesia/common';
|
|
2
|
+
import { AbacRole } from './classes.js';
|
|
3
|
+
const AgentRunRoleDomain = 'agent_runs';
|
|
4
|
+
const APPLICABLE_SCOPES = ['agent_run'];
|
|
5
|
+
/** Names of roles that grant conditional access to agent and process runs. */
|
|
6
|
+
export var AgentRunRoleNames;
|
|
7
|
+
(function (AgentRunRoleNames) {
|
|
8
|
+
AgentRunRoleNames["agent_run_reader"] = "agent_runs:reader";
|
|
9
|
+
AgentRunRoleNames["agent_run_operator"] = "agent_runs:operator";
|
|
10
|
+
})(AgentRunRoleNames || (AgentRunRoleNames = {}));
|
|
11
|
+
class AgentRunReaderRole extends AbacRole {
|
|
12
|
+
constructor() {
|
|
13
|
+
// Delegating run reads requires the RBAC the run read endpoints check (`workflow:read`), not
|
|
14
|
+
// `agent_run:read`, which is the auditor-only "see every private run" capability.
|
|
15
|
+
super(AgentRunRoleNames.agent_run_reader, ['read'], AgentRunRoleDomain, APPLICABLE_SCOPES, [
|
|
16
|
+
Permission.workflow_read,
|
|
17
|
+
]);
|
|
18
|
+
}
|
|
19
|
+
}
|
|
20
|
+
class AgentRunOperatorRole extends AbacRole {
|
|
21
|
+
constructor() {
|
|
22
|
+
super(AgentRunRoleNames.agent_run_operator, ['read', 'control'], AgentRunRoleDomain, APPLICABLE_SCOPES, [
|
|
23
|
+
Permission.workflow_read,
|
|
24
|
+
Permission.workflow_run,
|
|
25
|
+
]);
|
|
26
|
+
}
|
|
27
|
+
}
|
|
28
|
+
const agentRunRoles = {
|
|
29
|
+
[AgentRunRoleNames.agent_run_reader]: new AgentRunReaderRole(),
|
|
30
|
+
[AgentRunRoleNames.agent_run_operator]: new AgentRunOperatorRole(),
|
|
31
|
+
};
|
|
32
|
+
export const agentRunPartition = {
|
|
33
|
+
domain: AgentRunRoleDomain,
|
|
34
|
+
roles: new Map(Object.entries(agentRunRoles)),
|
|
35
|
+
};
|
|
36
|
+
//# sourceMappingURL=agent-runs.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"agent-runs.js","sourceRoot":"","sources":["../../src/roles/agent-runs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,UAAU,EAAmB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAiC,MAAM,cAAc,CAAC;AAEvE,MAAM,kBAAkB,GAAe,YAAY,CAAC;AAEpD,MAAM,iBAAiB,GAAyB,CAAC,WAAW,CAAC,CAAC;AAE9D,8EAA8E;AAC9E,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IACzB,2DAAsC,CAAA;IACtC,+DAA0C,CAAA;AAC9C,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B;AAED,MAAM,kBAAmB,SAAQ,QAAQ;IACrC;QACI,6FAA6F;QAC7F,kFAAkF;QAClF,KAAK,CAAC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,iBAAiB,EAAE;YACvF,UAAU,CAAC,aAAa;SAC3B,CAAC,CAAC;IACP,CAAC;CACJ;AAED,MAAM,oBAAqB,SAAQ,QAAQ;IACvC;QACI,KAAK,CAAC,iBAAiB,CAAC,kBAAkB,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,kBAAkB,EAAE,iBAAiB,EAAE;YACpG,UAAU,CAAC,aAAa;YACxB,UAAU,CAAC,YAAY;SAC1B,CAAC,CAAC;IACP,CAAC;CACJ;AAED,MAAM,aAAa,GAAoC;IACnD,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,IAAI,kBAAkB,EAAE;IAC9D,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,IAAI,oBAAoB,EAAE;CACrE,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAkB;IAC5C,MAAM,EAAE,kBAAkB;IAC1B,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;CAChD,CAAC"}
|
package/lib/roles/classes.d.ts
CHANGED
|
@@ -45,7 +45,21 @@ export declare class SystemRole extends Role<Permission> {
|
|
|
45
45
|
*/
|
|
46
46
|
export declare class AbacRole extends Role<string> {
|
|
47
47
|
applicableScopes: readonly AbacScope[];
|
|
48
|
-
|
|
48
|
+
/**
|
|
49
|
+
* The central `Permission`s a caller must hold to delegate this role through an ACE.
|
|
50
|
+
* Declared explicitly because ABAC verbs (`read`, `control`, ...) are scope vocabulary,
|
|
51
|
+
* not `Permission` values — deriving them from `${domain}:${verb}` only happens to work
|
|
52
|
+
* for the `content` domain and yields unknown keys for every other one.
|
|
53
|
+
*/
|
|
54
|
+
delegationPermissions: readonly Permission[];
|
|
55
|
+
constructor(name: string, permissions: string[], domain: RoleDomain, applicableScopes: readonly AbacScope[],
|
|
56
|
+
/**
|
|
57
|
+
* The central `Permission`s a caller must hold to delegate this role through an ACE.
|
|
58
|
+
* Declared explicitly because ABAC verbs (`read`, `control`, ...) are scope vocabulary,
|
|
59
|
+
* not `Permission` values — deriving them from `${domain}:${verb}` only happens to work
|
|
60
|
+
* for the `content` domain and yields unknown keys for every other one.
|
|
61
|
+
*/
|
|
62
|
+
delegationPermissions: readonly Permission[]);
|
|
49
63
|
}
|
|
50
64
|
/**
|
|
51
65
|
* A logical bucket of roles owned by a single domain. The registry iterates
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"classes.d.ts","sourceRoot":"","sources":["../../src/roles/classes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE1E;;;;;GAKG;AAEH;;;;;;;;;;;;;;GAcG;AACH,qBAAa,IAAI,CAAC,cAAc,SAAS,MAAM,GAAG,MAAM;IAGzC,IAAI,EAAE,MAAM;IAEZ,MAAM,EAAE,UAAU;IAJ7B,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACjC,YACW,IAAI,EAAE,MAAM,EACnB,WAAW,EAAE,cAAc,EAAE,EACtB,MAAM,EAAE,UAAU,EAG5B;IAED,aAAa,CAAC,UAAU,EAAE,cAAc,WAEvC;CACJ;AAED;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,IAAI,CAAC,UAAU,CAAC;IAC5C,YAAY,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,EAElD;CACJ;AAED;;;;;;;GAOG;AACH,qBAAa,QAAS,SAAQ,IAAI,CAAC,MAAM,CAAC;IAK3B,gBAAgB,EAAE,SAAS,SAAS,EAAE;
|
|
1
|
+
{"version":3,"file":"classes.d.ts","sourceRoot":"","sources":["../../src/roles/classes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE1E;;;;;GAKG;AAEH;;;;;;;;;;;;;;GAcG;AACH,qBAAa,IAAI,CAAC,cAAc,SAAS,MAAM,GAAG,MAAM;IAGzC,IAAI,EAAE,MAAM;IAEZ,MAAM,EAAE,UAAU;IAJ7B,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACjC,YACW,IAAI,EAAE,MAAM,EACnB,WAAW,EAAE,cAAc,EAAE,EACtB,MAAM,EAAE,UAAU,EAG5B;IAED,aAAa,CAAC,UAAU,EAAE,cAAc,WAEvC;CACJ;AAED;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,IAAI,CAAC,UAAU,CAAC;IAC5C,YAAY,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,EAElD;CACJ;AAED;;;;;;;GAOG;AACH,qBAAa,QAAS,SAAQ,IAAI,CAAC,MAAM,CAAC;IAK3B,gBAAgB,EAAE,SAAS,SAAS,EAAE;IAC7C;;;;;OAKG;IACI,qBAAqB,EAAE,SAAS,UAAU,EAAE;IAXvD,YACI,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,MAAM,EAAE,UAAU,EACX,gBAAgB,EAAE,SAAS,SAAS,EAAE;IAC7C;;;;;OAKG;IACI,qBAAqB,EAAE,SAAS,UAAU,EAAE,EAGtD;CACJ;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CAC5B"}
|
package/lib/roles/classes.js
CHANGED
|
@@ -52,9 +52,18 @@ export class SystemRole extends Role {
|
|
|
52
52
|
*/
|
|
53
53
|
export class AbacRole extends Role {
|
|
54
54
|
applicableScopes;
|
|
55
|
-
|
|
55
|
+
delegationPermissions;
|
|
56
|
+
constructor(name, permissions, domain, applicableScopes,
|
|
57
|
+
/**
|
|
58
|
+
* The central `Permission`s a caller must hold to delegate this role through an ACE.
|
|
59
|
+
* Declared explicitly because ABAC verbs (`read`, `control`, ...) are scope vocabulary,
|
|
60
|
+
* not `Permission` values — deriving them from `${domain}:${verb}` only happens to work
|
|
61
|
+
* for the `content` domain and yields unknown keys for every other one.
|
|
62
|
+
*/
|
|
63
|
+
delegationPermissions) {
|
|
56
64
|
super(name, permissions, domain);
|
|
57
65
|
this.applicableScopes = applicableScopes;
|
|
66
|
+
this.delegationPermissions = delegationPermissions;
|
|
58
67
|
}
|
|
59
68
|
}
|
|
60
69
|
//# sourceMappingURL=classes.js.map
|
package/lib/roles/classes.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"classes.js","sourceRoot":"","sources":["../../src/roles/classes.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,IAAI;IAGF,IAAI;IAEJ,MAAM;IAJjB,WAAW,CAAsB;IACjC,YACW,IAAY,EACnB,WAA6B,EACtB,MAAkB;oBAFlB,IAAI;sBAEJ,MAAM;QAEb,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,aAAa,CAAC,UAA0B;QACpC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;CACJ;AAED;;;;GAIG;AACH,MAAM,OAAO,UAAW,SAAQ,IAAgB;IAC5C,YAAY,IAAY,EAAE,WAAyB;QAC/C,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;CACJ;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,QAAS,SAAQ,IAAY;IAK3B,gBAAgB;
|
|
1
|
+
{"version":3,"file":"classes.js","sourceRoot":"","sources":["../../src/roles/classes.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,IAAI;IAGF,IAAI;IAEJ,MAAM;IAJjB,WAAW,CAAsB;IACjC,YACW,IAAY,EACnB,WAA6B,EACtB,MAAkB;oBAFlB,IAAI;sBAEJ,MAAM;QAEb,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,aAAa,CAAC,UAA0B;QACpC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;CACJ;AAED;;;;GAIG;AACH,MAAM,OAAO,UAAW,SAAQ,IAAgB;IAC5C,YAAY,IAAY,EAAE,WAAyB;QAC/C,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;CACJ;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,QAAS,SAAQ,IAAY;IAK3B,gBAAgB;IAOhB,qBAAqB;IAXhC,YACI,IAAY,EACZ,WAAqB,EACrB,MAAkB,EACX,gBAAsC;IAC7C;;;;;OAKG;IACI,qBAA4C;QAEnD,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;gCAT1B,gBAAgB;qCAOhB,qBAAqB;IAGhC,CAAC;CACJ"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/roles/content.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/roles/content.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAavE;;;;GAIG;AACH,oBAAY,gBAAgB;IACxB,cAAc,mBAAmB;IACjC,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;CACtC;AAmCD,eAAO,MAAM,gBAAgB,EAAE,aAG9B,CAAC"}
|
package/lib/roles/content.js
CHANGED
|
@@ -1,6 +1,13 @@
|
|
|
1
|
+
import { Permission } from '@vertesia/common';
|
|
1
2
|
import { AbacRole } from './classes.js';
|
|
2
3
|
const ContentRoleDomain = 'content';
|
|
3
|
-
|
|
4
|
+
// Scopes where content can be written/managed. `shared_content` is deliberately absent — shared content
|
|
5
|
+
// is read-only, so writer/manager never apply to it.
|
|
6
|
+
const WRITABLE_CONTENT_SCOPES = ['document', 'collection'];
|
|
7
|
+
// content:reader additionally serves the read-only `shared_content` scope: cross-project sharing reuses
|
|
8
|
+
// the content read permission — `shared_content` is a SCOPE over content (like `collection`), not its own
|
|
9
|
+
// domain. Only the reader lists it, so the vocabulary can't grant write/manage on shared content.
|
|
10
|
+
const READER_SCOPES = [...WRITABLE_CONTENT_SCOPES, 'shared_content'];
|
|
4
11
|
/**
|
|
5
12
|
* Names of roles owned by the `content` domain. Apply to ResourceSet ACEs
|
|
6
13
|
* scoped to either `document` or `collection` — the semantics of "read
|
|
@@ -14,17 +21,20 @@ export var ContentRoleNames;
|
|
|
14
21
|
})(ContentRoleNames || (ContentRoleNames = {}));
|
|
15
22
|
class ContentReaderRole extends AbacRole {
|
|
16
23
|
constructor() {
|
|
17
|
-
super(ContentRoleNames.content_reader, ['read'], ContentRoleDomain,
|
|
24
|
+
super(ContentRoleNames.content_reader, ['read'], ContentRoleDomain, READER_SCOPES, [Permission.content_read]);
|
|
18
25
|
}
|
|
19
26
|
}
|
|
20
27
|
class ContentWriterRole extends AbacRole {
|
|
21
28
|
constructor() {
|
|
22
|
-
super(ContentRoleNames.content_writer, ['read', 'write'], ContentRoleDomain,
|
|
29
|
+
super(ContentRoleNames.content_writer, ['read', 'write'], ContentRoleDomain, WRITABLE_CONTENT_SCOPES, [
|
|
30
|
+
Permission.content_read,
|
|
31
|
+
Permission.content_write,
|
|
32
|
+
]);
|
|
23
33
|
}
|
|
24
34
|
}
|
|
25
35
|
class ContentManagerRole extends AbacRole {
|
|
26
36
|
constructor() {
|
|
27
|
-
super(ContentRoleNames.content_manager, ['read', 'write', 'delete'], ContentRoleDomain,
|
|
37
|
+
super(ContentRoleNames.content_manager, ['read', 'write', 'delete'], ContentRoleDomain, WRITABLE_CONTENT_SCOPES, [Permission.content_read, Permission.content_write, Permission.content_delete]);
|
|
28
38
|
}
|
|
29
39
|
}
|
|
30
40
|
const contentRoles = {
|
package/lib/roles/content.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"content.js","sourceRoot":"","sources":["../../src/roles/content.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"content.js","sourceRoot":"","sources":["../../src/roles/content.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,UAAU,EAAmB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAiC,MAAM,cAAc,CAAC;AAEvE,MAAM,iBAAiB,GAAe,SAAS,CAAC;AAEhD,wGAAwG;AACxG,qDAAqD;AACrD,MAAM,uBAAuB,GAAyB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AAEjF,wGAAwG;AACxG,0GAA0G;AAC1G,kGAAkG;AAClG,MAAM,aAAa,GAAyB,CAAC,GAAG,uBAAuB,EAAE,gBAAgB,CAAC,CAAC;AAE3F;;;;GAIG;AACH,MAAM,CAAN,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IACxB,qDAAiC,CAAA;IACjC,qDAAiC,CAAA;IACjC,uDAAmC,CAAA;AACvC,CAAC,EAJW,gBAAgB,KAAhB,gBAAgB,QAI3B;AAED,MAAM,iBAAkB,SAAQ,QAAQ;IACpC;QACI,KAAK,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAClH,CAAC;CACJ;AAED,MAAM,iBAAkB,SAAQ,QAAQ;IACpC;QACI,KAAK,CAAC,gBAAgB,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,uBAAuB,EAAE;YAClG,UAAU,CAAC,YAAY;YACvB,UAAU,CAAC,aAAa;SAC3B,CAAC,CAAC;IACP,CAAC;CACJ;AAED,MAAM,kBAAmB,SAAQ,QAAQ;IACrC;QACI,KAAK,CACD,gBAAgB,CAAC,eAAe,EAChC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAC3B,iBAAiB,EACjB,uBAAuB,EACvB,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,cAAc,CAAC,CACjF,CAAC;IACN,CAAC;CACJ;AAED,MAAM,YAAY,GAAmC;IACjD,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,IAAI,iBAAiB,EAAE;IAC1D,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,IAAI,iBAAiB,EAAE;IAC1D,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,IAAI,kBAAkB,EAAE;CAC/D,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAkB;IAC3C,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;CAC/C,CAAC"}
|
package/lib/roles/index.d.ts
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import type { AbacScope, RoleDomain } from '@vertesia/common';
|
|
2
2
|
import { AbacRole, type Role, SystemRole } from './classes.js';
|
|
3
|
+
export { AgentRunRoleNames } from './agent-runs.js';
|
|
3
4
|
export { AbacRole, Role, type RolePartition, SystemRole } from './classes.js';
|
|
4
5
|
export { ContentRoleNames } from './content.js';
|
|
5
6
|
/** Look up a role by its name across all registered partitions. */
|
|
@@ -25,11 +26,11 @@ export declare function getAllRoleNames(): string[];
|
|
|
25
26
|
*/
|
|
26
27
|
export declare function getPermissionsForRoles(roleNames: Iterable<string>): string[];
|
|
27
28
|
/**
|
|
28
|
-
* Return the platform
|
|
29
|
+
* Return the platform `Permission` keys a caller must hold to delegate a role.
|
|
29
30
|
*
|
|
30
31
|
* System roles already contain complete `domain:verb` Permission values. ABAC roles store bare
|
|
31
|
-
* verbs for
|
|
32
|
-
*
|
|
32
|
+
* scope verbs (`read`, `control`, ...) for token generation, which are not Permission values, so
|
|
33
|
+
* they declare the Permissions that gate their delegation separately (`AbacRole.delegationPermissions`).
|
|
33
34
|
*/
|
|
34
35
|
export declare function getDelegablePermissionsForRole(roleName: string): string[];
|
|
35
36
|
/**
|
package/lib/roles/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAsB,UAAU,EAAE,MAAM,cAAc,CAAC;AAInF,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAShD,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAMhD;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,IAAI,IAAI,EAAE,CAQlC;AAED,uEAAuE;AACvE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,EAAE,CAG5D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,EAAE,CAElE;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,IAAI,UAAU,EAAE,CAE9C;AAED,0GAA0G;AAC1G,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAS5E;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAMzE;AAED;;GAEG;AACH,qBAAa,QAAQ;aACmB,KAAK,EAAE,IAAI,EAAE;IAAjD,OAAO,eAA8C;IAErD,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,QAAQ,CAGlD;IAED,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAG9C;IAED,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnC;CACJ"}
|
package/lib/roles/index.js
CHANGED
|
@@ -1,6 +1,8 @@
|
|
|
1
|
+
import { agentRunPartition } from './agent-runs.js';
|
|
1
2
|
import { AbacRole, SystemRole } from './classes.js';
|
|
2
3
|
import { contentPartition } from './content.js';
|
|
3
4
|
import { systemPartition } from './system.js';
|
|
5
|
+
export { AgentRunRoleNames } from './agent-runs.js';
|
|
4
6
|
export { AbacRole, Role, SystemRole } from './classes.js';
|
|
5
7
|
export { ContentRoleNames } from './content.js';
|
|
6
8
|
/**
|
|
@@ -8,7 +10,7 @@ export { ContentRoleNames } from './content.js';
|
|
|
8
10
|
* match wins. The `system` partition is registered first so domain-specific
|
|
9
11
|
* partitions (added later) cannot shadow built-in system roles.
|
|
10
12
|
*/
|
|
11
|
-
const partitions = [systemPartition, contentPartition];
|
|
13
|
+
const partitions = [systemPartition, contentPartition, agentRunPartition];
|
|
12
14
|
/** Look up a role by its name across all registered partitions. */
|
|
13
15
|
export function getRoleByName(name) {
|
|
14
16
|
for (const partition of partitions) {
|
|
@@ -65,16 +67,16 @@ export function getPermissionsForRoles(roleNames) {
|
|
|
65
67
|
return Array.from(permissions);
|
|
66
68
|
}
|
|
67
69
|
/**
|
|
68
|
-
* Return the platform
|
|
70
|
+
* Return the platform `Permission` keys a caller must hold to delegate a role.
|
|
69
71
|
*
|
|
70
72
|
* System roles already contain complete `domain:verb` Permission values. ABAC roles store bare
|
|
71
|
-
* verbs for
|
|
72
|
-
*
|
|
73
|
+
* scope verbs (`read`, `control`, ...) for token generation, which are not Permission values, so
|
|
74
|
+
* they declare the Permissions that gate their delegation separately (`AbacRole.delegationPermissions`).
|
|
73
75
|
*/
|
|
74
76
|
export function getDelegablePermissionsForRole(roleName) {
|
|
75
77
|
const role = getRoleByName(roleName);
|
|
76
78
|
if (role instanceof AbacRole) {
|
|
77
|
-
return [...role.
|
|
79
|
+
return [...role.delegationPermissions];
|
|
78
80
|
}
|
|
79
81
|
return [...role.permissions];
|
|
80
82
|
}
|
package/lib/roles/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAiC,UAAU,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAsB,UAAU,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,GAAoB,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAiC,UAAU,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAsB,UAAU,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,GAAoB,CAAC,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;AAE3F,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,IAAY;IACtC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IAC1B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC;AAC9C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,SAAS;IACrB,MAAM,MAAM,GAAW,EAAE,CAAC;IAC1B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,MAAkB;IAChD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAgB;IAClD,OAAO,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,YAAY,QAAQ,IAAI,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACjH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,eAAe;IAC3B,OAAO,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,YAAY,UAAU,CAAC,CAAC;AAC/E,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,eAAe;IAC3B,OAAO,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAA2B;IAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACrC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACxC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAAgB;IAC3D,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,IAAI,YAAY,QAAQ,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,QAAQ;IACmB,KAAK;IAAzC,YAAoC,KAAa;qBAAb,KAAK;IAAW,CAAC;IAErD,MAAM,CAAC,aAAa,CAAC,SAAmB;QACpC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,QAAgB;QAChC,MAAM,KAAK,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,aAAa,CAAC,IAAY;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;CACJ"}
|