@vorionsys/contracts 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/aci/aci-string.d.ts +539 -0
- package/dist/aci/aci-string.d.ts.map +1 -0
- package/dist/aci/aci-string.js +563 -0
- package/dist/aci/aci-string.js.map +1 -0
- package/dist/aci/attestation.d.ts +648 -0
- package/dist/aci/attestation.d.ts.map +1 -0
- package/dist/aci/attestation.js +289 -0
- package/dist/aci/attestation.js.map +1 -0
- package/dist/aci/domains.d.ts +260 -0
- package/dist/aci/domains.d.ts.map +1 -0
- package/dist/aci/domains.js +322 -0
- package/dist/aci/domains.js.map +1 -0
- package/dist/aci/effective-permission.d.ts +371 -0
- package/dist/aci/effective-permission.d.ts.map +1 -0
- package/dist/aci/effective-permission.js +351 -0
- package/dist/aci/effective-permission.js.map +1 -0
- package/dist/aci/identity.d.ts +1100 -0
- package/dist/aci/identity.d.ts.map +1 -0
- package/dist/aci/identity.js +328 -0
- package/dist/aci/identity.js.map +1 -0
- package/dist/aci/index.d.ts +67 -0
- package/dist/aci/index.d.ts.map +1 -0
- package/dist/aci/index.js +157 -0
- package/dist/aci/index.js.map +1 -0
- package/dist/aci/jwt-claims.d.ts +756 -0
- package/dist/aci/jwt-claims.d.ts.map +1 -0
- package/dist/aci/jwt-claims.js +335 -0
- package/dist/aci/jwt-claims.js.map +1 -0
- package/dist/aci/levels.d.ts +279 -0
- package/dist/aci/levels.d.ts.map +1 -0
- package/dist/aci/levels.js +467 -0
- package/dist/aci/levels.js.map +1 -0
- package/dist/aci/mapping.d.ts +291 -0
- package/dist/aci/mapping.d.ts.map +1 -0
- package/dist/aci/mapping.js +427 -0
- package/dist/aci/mapping.js.map +1 -0
- package/dist/aci/skills.d.ts +314 -0
- package/dist/aci/skills.d.ts.map +1 -0
- package/dist/aci/skills.js +404 -0
- package/dist/aci/skills.js.map +1 -0
- package/dist/aci/tiers.d.ts +403 -0
- package/dist/aci/tiers.d.ts.map +1 -0
- package/dist/aci/tiers.js +659 -0
- package/dist/aci/tiers.js.map +1 -0
- package/dist/canonical/agent.d.ts +796 -0
- package/dist/canonical/agent.d.ts.map +1 -0
- package/dist/canonical/agent.js +527 -0
- package/dist/canonical/agent.js.map +1 -0
- package/dist/canonical/governance.d.ts +905 -0
- package/dist/canonical/governance.d.ts.map +1 -0
- package/dist/canonical/governance.js +454 -0
- package/dist/canonical/governance.js.map +1 -0
- package/dist/canonical/index.d.ts +17 -0
- package/dist/canonical/index.d.ts.map +1 -0
- package/dist/canonical/index.js +21 -0
- package/dist/canonical/index.js.map +1 -0
- package/dist/canonical/intent.d.ts +727 -0
- package/dist/canonical/intent.d.ts.map +1 -0
- package/dist/canonical/intent.js +203 -0
- package/dist/canonical/intent.js.map +1 -0
- package/dist/canonical/risk-level.d.ts +344 -0
- package/dist/canonical/risk-level.d.ts.map +1 -0
- package/dist/canonical/risk-level.js +472 -0
- package/dist/canonical/risk-level.js.map +1 -0
- package/dist/canonical/trust-band.d.ts +239 -0
- package/dist/canonical/trust-band.d.ts.map +1 -0
- package/dist/canonical/trust-band.js +298 -0
- package/dist/canonical/trust-band.js.map +1 -0
- package/dist/canonical/trust-score.d.ts +301 -0
- package/dist/canonical/trust-score.d.ts.map +1 -0
- package/dist/canonical/trust-score.js +390 -0
- package/dist/canonical/trust-score.js.map +1 -0
- package/dist/canonical/trust-signal.d.ts +617 -0
- package/dist/canonical/trust-signal.d.ts.map +1 -0
- package/dist/canonical/trust-signal.js +355 -0
- package/dist/canonical/trust-signal.js.map +1 -0
- package/dist/canonical/validation.d.ts +231 -0
- package/dist/canonical/validation.d.ts.map +1 -0
- package/dist/canonical/validation.js +558 -0
- package/dist/canonical/validation.js.map +1 -0
- package/dist/common/index.d.ts +7 -0
- package/dist/common/index.d.ts.map +1 -0
- package/dist/common/index.js +7 -0
- package/dist/common/index.js.map +1 -0
- package/dist/common/primitives.d.ts +56 -0
- package/dist/common/primitives.d.ts.map +1 -0
- package/dist/common/primitives.js +70 -0
- package/dist/common/primitives.js.map +1 -0
- package/dist/index.d.ts +11 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +15 -0
- package/dist/index.js.map +1 -0
- package/dist/v2/canary-probe.d.ts +201 -0
- package/dist/v2/canary-probe.d.ts.map +1 -0
- package/dist/v2/canary-probe.js +99 -0
- package/dist/v2/canary-probe.js.map +1 -0
- package/dist/v2/component.d.ts +132 -0
- package/dist/v2/component.d.ts.map +1 -0
- package/dist/v2/component.js +5 -0
- package/dist/v2/component.js.map +1 -0
- package/dist/v2/decision.d.ts +310 -0
- package/dist/v2/decision.d.ts.map +1 -0
- package/dist/v2/decision.js +21 -0
- package/dist/v2/decision.js.map +1 -0
- package/dist/v2/enums.d.ts +185 -0
- package/dist/v2/enums.d.ts.map +1 -0
- package/dist/v2/enums.js +203 -0
- package/dist/v2/enums.js.map +1 -0
- package/dist/v2/evidence.d.ts +368 -0
- package/dist/v2/evidence.d.ts.map +1 -0
- package/dist/v2/evidence.js +152 -0
- package/dist/v2/evidence.js.map +1 -0
- package/dist/v2/execution.d.ts +190 -0
- package/dist/v2/execution.d.ts.map +1 -0
- package/dist/v2/execution.js +5 -0
- package/dist/v2/execution.js.map +1 -0
- package/dist/v2/index.d.ts +19 -0
- package/dist/v2/index.d.ts.map +1 -0
- package/dist/v2/index.js +32 -0
- package/dist/v2/index.js.map +1 -0
- package/dist/v2/intent.d.ts +89 -0
- package/dist/v2/intent.d.ts.map +1 -0
- package/dist/v2/intent.js +5 -0
- package/dist/v2/intent.js.map +1 -0
- package/dist/v2/policy-bundle.d.ts +166 -0
- package/dist/v2/policy-bundle.d.ts.map +1 -0
- package/dist/v2/policy-bundle.js +20 -0
- package/dist/v2/policy-bundle.js.map +1 -0
- package/dist/v2/pre-action-gate.d.ts +185 -0
- package/dist/v2/pre-action-gate.d.ts.map +1 -0
- package/dist/v2/pre-action-gate.js +64 -0
- package/dist/v2/pre-action-gate.js.map +1 -0
- package/dist/v2/proof-event.d.ts +201 -0
- package/dist/v2/proof-event.d.ts.map +1 -0
- package/dist/v2/proof-event.js +5 -0
- package/dist/v2/proof-event.js.map +1 -0
- package/dist/v2/retention.d.ts +329 -0
- package/dist/v2/retention.d.ts.map +1 -0
- package/dist/v2/retention.js +162 -0
- package/dist/v2/retention.js.map +1 -0
- package/dist/v2/trust-delta.d.ts +119 -0
- package/dist/v2/trust-delta.d.ts.map +1 -0
- package/dist/v2/trust-delta.js +28 -0
- package/dist/v2/trust-delta.js.map +1 -0
- package/dist/v2/trust-profile.d.ts +337 -0
- package/dist/v2/trust-profile.d.ts.map +1 -0
- package/dist/v2/trust-profile.js +96 -0
- package/dist/v2/trust-profile.js.map +1 -0
- package/dist/validators/decision.d.ts +430 -0
- package/dist/validators/decision.d.ts.map +1 -0
- package/dist/validators/decision.js +61 -0
- package/dist/validators/decision.js.map +1 -0
- package/dist/validators/enums.d.ts +24 -0
- package/dist/validators/enums.d.ts.map +1 -0
- package/dist/validators/enums.js +24 -0
- package/dist/validators/enums.js.map +1 -0
- package/dist/validators/index.d.ts +30 -0
- package/dist/validators/index.d.ts.map +1 -0
- package/dist/validators/index.js +42 -0
- package/dist/validators/index.js.map +1 -0
- package/dist/validators/intent.d.ts +229 -0
- package/dist/validators/intent.d.ts.map +1 -0
- package/dist/validators/intent.js +47 -0
- package/dist/validators/intent.js.map +1 -0
- package/dist/validators/proof-event.d.ts +981 -0
- package/dist/validators/proof-event.d.ts.map +1 -0
- package/dist/validators/proof-event.js +134 -0
- package/dist/validators/proof-event.js.map +1 -0
- package/dist/validators/trust-profile.d.ts +350 -0
- package/dist/validators/trust-profile.d.ts.map +1 -0
- package/dist/validators/trust-profile.js +65 -0
- package/dist/validators/trust-profile.js.map +1 -0
- package/package.json +65 -0
|
@@ -0,0 +1,351 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* @fileoverview Effective Permission Calculation
|
|
3
|
+
*
|
|
4
|
+
* Provides types and functions for calculating effective permissions based on
|
|
5
|
+
* multiple inputs including certification tier, competence level, runtime tier,
|
|
6
|
+
* observability ceiling, and context policy ceiling.
|
|
7
|
+
*
|
|
8
|
+
* The effective permission is the minimum of all applicable ceilings, ensuring
|
|
9
|
+
* that agents can never exceed the most restrictive constraint in any dimension.
|
|
10
|
+
*
|
|
11
|
+
* @module @vorion/contracts/aci/effective-permission
|
|
12
|
+
*/
|
|
13
|
+
import { z } from 'zod';
|
|
14
|
+
import { CapabilityLevel, capabilityLevelSchema } from './levels.js';
|
|
15
|
+
import { CertificationTier, certificationTierSchema, RuntimeTier, runtimeTierSchema, CERTIFICATION_TIER_CONFIGS, } from './tiers.js';
|
|
16
|
+
/**
|
|
17
|
+
* Zod schema for EffectivePermissionContext.
|
|
18
|
+
*/
|
|
19
|
+
export const effectivePermissionContextSchema = z.object({
|
|
20
|
+
certificationTier: certificationTierSchema,
|
|
21
|
+
competenceLevel: capabilityLevelSchema,
|
|
22
|
+
runtimeTier: runtimeTierSchema,
|
|
23
|
+
observabilityCeiling: z.number().int().min(0).max(7),
|
|
24
|
+
contextPolicyCeiling: z.number().int().min(0).max(7),
|
|
25
|
+
});
|
|
26
|
+
/**
|
|
27
|
+
* Zod schema for ConstrainingFactor.
|
|
28
|
+
*/
|
|
29
|
+
export const constrainingFactorSchema = z.enum([
|
|
30
|
+
'certification_tier',
|
|
31
|
+
'competence_level',
|
|
32
|
+
'runtime_tier',
|
|
33
|
+
'observability_ceiling',
|
|
34
|
+
'context_policy_ceiling',
|
|
35
|
+
'multiple',
|
|
36
|
+
]);
|
|
37
|
+
/**
|
|
38
|
+
* Zod schema for PermissionCeilings.
|
|
39
|
+
*/
|
|
40
|
+
export const permissionCeilingsSchema = z.object({
|
|
41
|
+
certificationCeiling: capabilityLevelSchema,
|
|
42
|
+
competenceCeiling: capabilityLevelSchema,
|
|
43
|
+
runtimeCeiling: capabilityLevelSchema,
|
|
44
|
+
observabilityCeiling: capabilityLevelSchema,
|
|
45
|
+
contextPolicyCeiling: capabilityLevelSchema,
|
|
46
|
+
});
|
|
47
|
+
/**
|
|
48
|
+
* Zod schema for EffectivePermission.
|
|
49
|
+
*/
|
|
50
|
+
export const effectivePermissionSchema = z.object({
|
|
51
|
+
level: capabilityLevelSchema,
|
|
52
|
+
constrained: z.boolean(),
|
|
53
|
+
constrainingFactor: constrainingFactorSchema.optional(),
|
|
54
|
+
ceilings: permissionCeilingsSchema,
|
|
55
|
+
recommendations: z.array(z.string()).optional(),
|
|
56
|
+
});
|
|
57
|
+
// ============================================================================
|
|
58
|
+
// Permission Calculation
|
|
59
|
+
// ============================================================================
|
|
60
|
+
/**
|
|
61
|
+
* Maps certification tier to maximum capability level.
|
|
62
|
+
*/
|
|
63
|
+
function certificationTierToCeiling(tier) {
|
|
64
|
+
return CERTIFICATION_TIER_CONFIGS[tier].maxCapabilityLevel;
|
|
65
|
+
}
|
|
66
|
+
/**
|
|
67
|
+
* Maps runtime tier to maximum capability level.
|
|
68
|
+
*/
|
|
69
|
+
function runtimeTierToCeiling(tier) {
|
|
70
|
+
// Runtime tier mapping to capability levels:
|
|
71
|
+
// T0 (Sandbox) -> L0 (Observe only)
|
|
72
|
+
// T1 (Observed) -> L1 (Advise only)
|
|
73
|
+
// T2 (Provisional) -> L2 (Draft)
|
|
74
|
+
// T3 (Monitored) -> L3 (Execute)
|
|
75
|
+
// T4 (Standard) -> L4 (Autonomous)
|
|
76
|
+
// T5 (Trusted) -> L5 (Sovereign)
|
|
77
|
+
// T6 (Certified) -> L6 (Certified)
|
|
78
|
+
// T7 (Autonomous) -> L7 (Autonomous)
|
|
79
|
+
return tier;
|
|
80
|
+
}
|
|
81
|
+
/**
|
|
82
|
+
* Calculates the effective permission from the context.
|
|
83
|
+
*
|
|
84
|
+
* The effective permission is the minimum of all applicable ceilings:
|
|
85
|
+
* - Certification tier ceiling
|
|
86
|
+
* - Competence level (agent's declared capability)
|
|
87
|
+
* - Runtime tier ceiling
|
|
88
|
+
* - Observability ceiling
|
|
89
|
+
* - Context policy ceiling
|
|
90
|
+
*
|
|
91
|
+
* @param ctx - Permission context
|
|
92
|
+
* @returns Effective permission result
|
|
93
|
+
*
|
|
94
|
+
* @example
|
|
95
|
+
* ```typescript
|
|
96
|
+
* const result = calculateEffectivePermission({
|
|
97
|
+
* certificationTier: CertificationTier.T3_MONITORED,
|
|
98
|
+
* competenceLevel: CapabilityLevel.L4_STANDARD,
|
|
99
|
+
* runtimeTier: RuntimeTier.T3_MONITORED,
|
|
100
|
+
* observabilityCeiling: 4,
|
|
101
|
+
* contextPolicyCeiling: 3,
|
|
102
|
+
* });
|
|
103
|
+
* // result.level === CapabilityLevel.L3_EXECUTE
|
|
104
|
+
* // result.constrained === true
|
|
105
|
+
* // result.constrainingFactor === 'context_policy_ceiling'
|
|
106
|
+
* ```
|
|
107
|
+
*/
|
|
108
|
+
export function calculateEffectivePermission(ctx) {
|
|
109
|
+
// Calculate individual ceilings
|
|
110
|
+
const certificationCeiling = certificationTierToCeiling(ctx.certificationTier);
|
|
111
|
+
const competenceCeiling = ctx.competenceLevel;
|
|
112
|
+
const runtimeCeiling = runtimeTierToCeiling(ctx.runtimeTier);
|
|
113
|
+
const observabilityCeiling = Math.min(7, Math.max(0, ctx.observabilityCeiling));
|
|
114
|
+
const contextPolicyCeiling = Math.min(7, Math.max(0, ctx.contextPolicyCeiling));
|
|
115
|
+
const ceilings = {
|
|
116
|
+
certificationCeiling,
|
|
117
|
+
competenceCeiling,
|
|
118
|
+
runtimeCeiling,
|
|
119
|
+
observabilityCeiling,
|
|
120
|
+
contextPolicyCeiling,
|
|
121
|
+
};
|
|
122
|
+
// Find the minimum ceiling
|
|
123
|
+
const allCeilings = [
|
|
124
|
+
{ factor: 'certification_tier', level: certificationCeiling },
|
|
125
|
+
{ factor: 'competence_level', level: competenceCeiling },
|
|
126
|
+
{ factor: 'runtime_tier', level: runtimeCeiling },
|
|
127
|
+
{ factor: 'observability_ceiling', level: observabilityCeiling },
|
|
128
|
+
{ factor: 'context_policy_ceiling', level: contextPolicyCeiling },
|
|
129
|
+
];
|
|
130
|
+
const minCeilingLevel = Math.min(...allCeilings.map((c) => c.level));
|
|
131
|
+
const constrainingFactors = allCeilings.filter((c) => c.level === minCeilingLevel);
|
|
132
|
+
// Determine if constrained and by what
|
|
133
|
+
const maxPossibleLevel = Math.max(certificationCeiling, competenceCeiling, runtimeCeiling, observabilityCeiling, contextPolicyCeiling);
|
|
134
|
+
const constrained = minCeilingLevel < maxPossibleLevel;
|
|
135
|
+
let constrainingFactor;
|
|
136
|
+
if (constrained) {
|
|
137
|
+
constrainingFactor = constrainingFactors.length > 1
|
|
138
|
+
? 'multiple'
|
|
139
|
+
: constrainingFactors[0].factor;
|
|
140
|
+
}
|
|
141
|
+
// Generate recommendations
|
|
142
|
+
const recommendations = [];
|
|
143
|
+
if (constrained) {
|
|
144
|
+
for (const cf of constrainingFactors) {
|
|
145
|
+
switch (cf.factor) {
|
|
146
|
+
case 'certification_tier':
|
|
147
|
+
recommendations.push(`Increase certification tier from ${ctx.certificationTier} to unlock higher capability levels`);
|
|
148
|
+
break;
|
|
149
|
+
case 'runtime_tier':
|
|
150
|
+
recommendations.push(`Request higher runtime tier from T${ctx.runtimeTier} to enable more autonomy`);
|
|
151
|
+
break;
|
|
152
|
+
case 'observability_ceiling':
|
|
153
|
+
recommendations.push('Improve observability instrumentation to raise the observability ceiling');
|
|
154
|
+
break;
|
|
155
|
+
case 'context_policy_ceiling':
|
|
156
|
+
recommendations.push('Request policy exception or operate in a context with higher policy ceiling');
|
|
157
|
+
break;
|
|
158
|
+
case 'competence_level':
|
|
159
|
+
recommendations.push('This is the declared competence level of the agent');
|
|
160
|
+
break;
|
|
161
|
+
}
|
|
162
|
+
}
|
|
163
|
+
}
|
|
164
|
+
return {
|
|
165
|
+
level: minCeilingLevel,
|
|
166
|
+
constrained,
|
|
167
|
+
constrainingFactor,
|
|
168
|
+
ceilings,
|
|
169
|
+
recommendations: recommendations.length > 0 ? recommendations : undefined,
|
|
170
|
+
};
|
|
171
|
+
}
|
|
172
|
+
// ============================================================================
|
|
173
|
+
// Permission Checking
|
|
174
|
+
// ============================================================================
|
|
175
|
+
/**
|
|
176
|
+
* Checks if an effective permission allows a specific capability level.
|
|
177
|
+
*
|
|
178
|
+
* @param permission - Effective permission
|
|
179
|
+
* @param requiredLevel - Required capability level
|
|
180
|
+
* @returns True if the permission allows the required level
|
|
181
|
+
*/
|
|
182
|
+
export function permissionAllowsLevel(permission, requiredLevel) {
|
|
183
|
+
return permission.level >= requiredLevel;
|
|
184
|
+
}
|
|
185
|
+
/**
|
|
186
|
+
* Checks if a context allows a specific capability level.
|
|
187
|
+
*
|
|
188
|
+
* @param ctx - Permission context
|
|
189
|
+
* @param requiredLevel - Required capability level
|
|
190
|
+
* @returns True if the context allows the required level
|
|
191
|
+
*/
|
|
192
|
+
export function contextAllowsLevel(ctx, requiredLevel) {
|
|
193
|
+
const permission = calculateEffectivePermission(ctx);
|
|
194
|
+
return permissionAllowsLevel(permission, requiredLevel);
|
|
195
|
+
}
|
|
196
|
+
/**
|
|
197
|
+
* Performs a detailed permission check.
|
|
198
|
+
*
|
|
199
|
+
* @param ctx - Permission context
|
|
200
|
+
* @param requiredLevel - Required capability level
|
|
201
|
+
* @returns Detailed permission check result
|
|
202
|
+
*/
|
|
203
|
+
export function checkPermission(ctx, requiredLevel) {
|
|
204
|
+
const permission = calculateEffectivePermission(ctx);
|
|
205
|
+
return {
|
|
206
|
+
allowed: permission.level >= requiredLevel,
|
|
207
|
+
effectiveLevel: permission.level,
|
|
208
|
+
requestedLevel: requiredLevel,
|
|
209
|
+
levelGap: Math.max(0, requiredLevel - permission.level),
|
|
210
|
+
permission,
|
|
211
|
+
};
|
|
212
|
+
}
|
|
213
|
+
/**
|
|
214
|
+
* Zod schema for PermissionCheckResult.
|
|
215
|
+
*/
|
|
216
|
+
export const permissionCheckResultSchema = z.object({
|
|
217
|
+
allowed: z.boolean(),
|
|
218
|
+
effectiveLevel: capabilityLevelSchema,
|
|
219
|
+
requestedLevel: capabilityLevelSchema,
|
|
220
|
+
levelGap: z.number().int().min(0),
|
|
221
|
+
permission: effectivePermissionSchema,
|
|
222
|
+
});
|
|
223
|
+
// ============================================================================
|
|
224
|
+
// Permission Modification
|
|
225
|
+
// ============================================================================
|
|
226
|
+
/**
|
|
227
|
+
* Creates a new context with a modified ceiling.
|
|
228
|
+
*
|
|
229
|
+
* @param ctx - Original context
|
|
230
|
+
* @param factor - Factor to modify
|
|
231
|
+
* @param newValue - New value for the factor
|
|
232
|
+
* @returns New context with modified value
|
|
233
|
+
*/
|
|
234
|
+
export function modifyContextCeiling(ctx, factor, newValue) {
|
|
235
|
+
const newCtx = { ...ctx };
|
|
236
|
+
switch (factor) {
|
|
237
|
+
case 'certification_tier':
|
|
238
|
+
newCtx.certificationTier = Math.min(7, Math.max(0, newValue));
|
|
239
|
+
break;
|
|
240
|
+
case 'competence_level':
|
|
241
|
+
newCtx.competenceLevel = Math.min(7, Math.max(0, newValue));
|
|
242
|
+
break;
|
|
243
|
+
case 'runtime_tier':
|
|
244
|
+
newCtx.runtimeTier = Math.min(7, Math.max(0, newValue));
|
|
245
|
+
break;
|
|
246
|
+
case 'observability_ceiling':
|
|
247
|
+
newCtx.observabilityCeiling = Math.min(7, Math.max(0, newValue));
|
|
248
|
+
break;
|
|
249
|
+
case 'context_policy_ceiling':
|
|
250
|
+
newCtx.contextPolicyCeiling = Math.min(7, Math.max(0, newValue));
|
|
251
|
+
break;
|
|
252
|
+
}
|
|
253
|
+
return newCtx;
|
|
254
|
+
}
|
|
255
|
+
/**
|
|
256
|
+
* Calculates what context changes would be needed to achieve a target level.
|
|
257
|
+
*
|
|
258
|
+
* @param ctx - Current context
|
|
259
|
+
* @param targetLevel - Desired capability level
|
|
260
|
+
* @returns Map of factors to required values
|
|
261
|
+
*/
|
|
262
|
+
export function calculateRequiredChanges(ctx, targetLevel) {
|
|
263
|
+
const changes = new Map();
|
|
264
|
+
const permission = calculateEffectivePermission(ctx);
|
|
265
|
+
if (permission.level >= targetLevel) {
|
|
266
|
+
return changes; // No changes needed
|
|
267
|
+
}
|
|
268
|
+
// Check each factor and determine if it needs to increase
|
|
269
|
+
const certificationCeiling = permission.ceilings.certificationCeiling;
|
|
270
|
+
if (certificationCeiling < targetLevel) {
|
|
271
|
+
// Need higher certification tier
|
|
272
|
+
for (let tier = ctx.certificationTier + 1; tier <= 7; tier++) {
|
|
273
|
+
if (certificationTierToCeiling(tier) >= targetLevel) {
|
|
274
|
+
changes.set('certification_tier', tier);
|
|
275
|
+
break;
|
|
276
|
+
}
|
|
277
|
+
}
|
|
278
|
+
}
|
|
279
|
+
if (permission.ceilings.competenceCeiling < targetLevel) {
|
|
280
|
+
changes.set('competence_level', targetLevel);
|
|
281
|
+
}
|
|
282
|
+
if (permission.ceilings.runtimeCeiling < targetLevel) {
|
|
283
|
+
changes.set('runtime_tier', targetLevel);
|
|
284
|
+
}
|
|
285
|
+
if (permission.ceilings.observabilityCeiling < targetLevel) {
|
|
286
|
+
changes.set('observability_ceiling', targetLevel);
|
|
287
|
+
}
|
|
288
|
+
if (permission.ceilings.contextPolicyCeiling < targetLevel) {
|
|
289
|
+
changes.set('context_policy_ceiling', targetLevel);
|
|
290
|
+
}
|
|
291
|
+
return changes;
|
|
292
|
+
}
|
|
293
|
+
// ============================================================================
|
|
294
|
+
// Default Context
|
|
295
|
+
// ============================================================================
|
|
296
|
+
/**
|
|
297
|
+
* Creates a default permission context.
|
|
298
|
+
*
|
|
299
|
+
* @param overrides - Optional overrides
|
|
300
|
+
* @returns Default context with any overrides applied
|
|
301
|
+
*/
|
|
302
|
+
export function createDefaultContext(overrides) {
|
|
303
|
+
return {
|
|
304
|
+
certificationTier: CertificationTier.T0_SANDBOX,
|
|
305
|
+
competenceLevel: CapabilityLevel.L0_OBSERVE,
|
|
306
|
+
runtimeTier: RuntimeTier.T0_SANDBOX,
|
|
307
|
+
observabilityCeiling: 7,
|
|
308
|
+
contextPolicyCeiling: 7,
|
|
309
|
+
...overrides,
|
|
310
|
+
};
|
|
311
|
+
}
|
|
312
|
+
/**
|
|
313
|
+
* Creates a maximally permissive context.
|
|
314
|
+
*
|
|
315
|
+
* @returns Context with all ceilings at maximum
|
|
316
|
+
*/
|
|
317
|
+
export function createMaxPermissionContext() {
|
|
318
|
+
return {
|
|
319
|
+
certificationTier: CertificationTier.T7_AUTONOMOUS,
|
|
320
|
+
competenceLevel: CapabilityLevel.L7_AUTONOMOUS,
|
|
321
|
+
runtimeTier: RuntimeTier.T7_AUTONOMOUS,
|
|
322
|
+
observabilityCeiling: 7,
|
|
323
|
+
contextPolicyCeiling: 7,
|
|
324
|
+
};
|
|
325
|
+
}
|
|
326
|
+
// ============================================================================
|
|
327
|
+
// Type Guards
|
|
328
|
+
// ============================================================================
|
|
329
|
+
/**
|
|
330
|
+
* Type guard for EffectivePermissionContext.
|
|
331
|
+
*/
|
|
332
|
+
export function isEffectivePermissionContext(value) {
|
|
333
|
+
return (typeof value === 'object' &&
|
|
334
|
+
value !== null &&
|
|
335
|
+
'certificationTier' in value &&
|
|
336
|
+
'competenceLevel' in value &&
|
|
337
|
+
'runtimeTier' in value &&
|
|
338
|
+
'observabilityCeiling' in value &&
|
|
339
|
+
'contextPolicyCeiling' in value);
|
|
340
|
+
}
|
|
341
|
+
/**
|
|
342
|
+
* Type guard for EffectivePermission.
|
|
343
|
+
*/
|
|
344
|
+
export function isEffectivePermission(value) {
|
|
345
|
+
return (typeof value === 'object' &&
|
|
346
|
+
value !== null &&
|
|
347
|
+
'level' in value &&
|
|
348
|
+
'constrained' in value &&
|
|
349
|
+
'ceilings' in value);
|
|
350
|
+
}
|
|
351
|
+
//# sourceMappingURL=effective-permission.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"effective-permission.js","sourceRoot":"","sources":["../../src/aci/effective-permission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,WAAW,EACX,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AA6BpB;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,iBAAiB,EAAE,uBAAuB;IAC1C,eAAe,EAAE,qBAAqB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACrD,CAAC,CAAC;AAiDH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,oBAAoB;IACpB,kBAAkB;IAClB,cAAc;IACd,uBAAuB;IACvB,wBAAwB;IACxB,UAAU;CACX,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,oBAAoB,EAAE,qBAAqB;IAC3C,iBAAiB,EAAE,qBAAqB;IACxC,cAAc,EAAE,qBAAqB;IACrC,oBAAoB,EAAE,qBAAqB;IAC3C,oBAAoB,EAAE,qBAAqB;CAC5C,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,qBAAqB;IAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,kBAAkB,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IACvD,QAAQ,EAAE,wBAAwB;IAClC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAEH,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;GAEG;AACH,SAAS,0BAA0B,CAAC,IAAuB;IACzD,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,kBAAqC,CAAC;AAChF,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAiB;IAC7C,6CAA6C;IAC7C,oCAAoC;IACpC,oCAAoC;IACpC,iCAAiC;IACjC,iCAAiC;IACjC,mCAAmC;IACnC,iCAAiC;IACjC,mCAAmC;IACnC,qCAAqC;IACrC,OAAO,IAAkC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,4BAA4B,CAC1C,GAA+B;IAE/B,gCAAgC;IAChC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/E,MAAM,iBAAiB,GAAG,GAAG,CAAC,eAAe,CAAC;IAC9C,MAAM,cAAc,GAAG,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAoB,CAAC;IACnG,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAoB,CAAC;IAEnG,MAAM,QAAQ,GAAuB;QACnC,oBAAoB;QACpB,iBAAiB;QACjB,cAAc;QACd,oBAAoB;QACpB,oBAAoB;KACrB,CAAC;IAEF,2BAA2B;IAC3B,MAAM,WAAW,GAAG;QAClB,EAAE,MAAM,EAAE,oBAA6B,EAAE,KAAK,EAAE,oBAAoB,EAAE;QACtE,EAAE,MAAM,EAAE,kBAA2B,EAAE,KAAK,EAAE,iBAAiB,EAAE;QACjE,EAAE,MAAM,EAAE,cAAuB,EAAE,KAAK,EAAE,cAAc,EAAE;QAC1D,EAAE,MAAM,EAAE,uBAAgC,EAAE,KAAK,EAAE,oBAAoB,EAAE;QACzE,EAAE,MAAM,EAAE,wBAAiC,EAAE,KAAK,EAAE,oBAAoB,EAAE;KAC3E,CAAC;IAEF,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAoB,CAAC;IACxF,MAAM,mBAAmB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC;IAEnF,uCAAuC;IACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAC/B,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;IACF,MAAM,WAAW,GAAG,eAAe,GAAG,gBAAgB,CAAC;IAEvD,IAAI,kBAAkD,CAAC;IACvD,IAAI,WAAW,EAAE,CAAC;QAChB,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,GAAG,CAAC;YACjD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;IACrC,CAAC;IAED,2BAA2B;IAC3B,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC;YACrC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC;gBAClB,KAAK,oBAAoB;oBACvB,eAAe,CAAC,IAAI,CAClB,oCAAoC,GAAG,CAAC,iBAAiB,qCAAqC,CAC/F,CAAC;oBACF,MAAM;gBACR,KAAK,cAAc;oBACjB,eAAe,CAAC,IAAI,CAClB,qCAAqC,GAAG,CAAC,WAAW,0BAA0B,CAC/E,CAAC;oBACF,MAAM;gBACR,KAAK,uBAAuB;oBAC1B,eAAe,CAAC,IAAI,CAClB,0EAA0E,CAC3E,CAAC;oBACF,MAAM;gBACR,KAAK,wBAAwB;oBAC3B,eAAe,CAAC,IAAI,CAClB,6EAA6E,CAC9E,CAAC;oBACF,MAAM;gBACR,KAAK,kBAAkB;oBACrB,eAAe,CAAC,IAAI,CAClB,oDAAoD,CACrD,CAAC;oBACF,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,eAAe;QACtB,WAAW;QACX,kBAAkB;QAClB,QAAQ;QACR,eAAe,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;KAC1E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAA+B,EAC/B,aAA8B;IAE9B,OAAO,UAAU,CAAC,KAAK,IAAI,aAAa,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAA+B,EAC/B,aAA8B;IAE9B,MAAM,UAAU,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,qBAAqB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,GAA+B,EAC/B,aAA8B;IAE9B,MAAM,UAAU,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,KAAK,IAAI,aAAa;QAC1C,cAAc,EAAE,UAAU,CAAC,KAAK;QAChC,cAAc,EAAE,aAAa;QAC7B,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;QACvD,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,cAAc,EAAE,qBAAqB;IACrC,cAAc,EAAE,qBAAqB;IACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,yBAAyB;CACtC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAA+B,EAC/B,MAA+C,EAC/C,QAAgB;IAEhB,MAAM,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAE1B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,oBAAoB;YACvB,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAsB,CAAC;YACnF,MAAM;QACR,KAAK,kBAAkB;YACrB,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAoB,CAAC;YAC/E,MAAM;QACR,KAAK,cAAc;YACjB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAgB,CAAC;YACvE,MAAM;QACR,KAAK,uBAAuB;YAC1B,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjE,MAAM;QACR,KAAK,wBAAwB;YAC3B,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjE,MAAM;IACV,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAA+B,EAC/B,WAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmD,CAAC;IAC3E,MAAM,UAAU,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAErD,IAAI,UAAU,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,CAAC,oBAAoB;IACtC,CAAC;IAED,0DAA0D;IAC1D,MAAM,oBAAoB,GAAG,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IACtE,IAAI,oBAAoB,GAAG,WAAW,EAAE,CAAC;QACvC,iCAAiC;QACjC,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC,iBAAiB,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YAC7D,IAAI,0BAA0B,CAAC,IAAyB,CAAC,IAAI,WAAW,EAAE,CAAC;gBACzE,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;gBACxC,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,iBAAiB,GAAG,WAAW,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,cAAc,GAAG,WAAW,EAAE,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,GAAG,WAAW,EAAE,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,GAAG,WAAW,EAAE,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAA+C;IAE/C,OAAO;QACL,iBAAiB,EAAE,iBAAiB,CAAC,UAAU;QAC/C,eAAe,EAAE,eAAe,CAAC,UAAU;QAC3C,WAAW,EAAE,WAAW,CAAC,UAAU;QACnC,oBAAoB,EAAE,CAAC;QACvB,oBAAoB,EAAE,CAAC;QACvB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,iBAAiB,EAAE,iBAAiB,CAAC,aAAa;QAClD,eAAe,EAAE,eAAe,CAAC,aAAa;QAC9C,WAAW,EAAE,WAAW,CAAC,aAAa;QACtC,oBAAoB,EAAE,CAAC;QACvB,oBAAoB,EAAE,CAAC;KACxB,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,mBAAmB,IAAI,KAAK;QAC5B,iBAAiB,IAAI,KAAK;QAC1B,aAAa,IAAI,KAAK;QACtB,sBAAsB,IAAI,KAAK;QAC/B,sBAAsB,IAAI,KAAK,CAChC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAO,IAAI,KAAK;QAChB,aAAa,IAAI,KAAK;QACtB,UAAU,IAAI,KAAK,CACpB,CAAC;AACJ,CAAC"}
|