@vorionsys/contracts 0.1.1 → 0.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +44 -0
- package/LICENSE +190 -0
- package/README.md +373 -84
- package/dist/aci/index.d.ts +4 -70
- package/dist/aci/index.d.ts.map +1 -1
- package/dist/aci/index.js +18 -373
- package/dist/aci/index.js.map +1 -1
- package/dist/canonical/agent.d.ts +15 -15
- package/dist/canonical/agent.d.ts.map +1 -1
- package/dist/canonical/governance.d.ts +8 -8
- package/dist/canonical/intent.d.ts +18 -18
- package/dist/canonical/middleware.d.ts +4 -4
- package/dist/canonical/trust-signal.d.ts +48 -45
- package/dist/canonical/trust-signal.d.ts.map +1 -1
- package/dist/canonical/trust-signal.js +7 -2
- package/dist/canonical/trust-signal.js.map +1 -1
- package/dist/canonical/validation.d.ts +11 -26
- package/dist/canonical/validation.d.ts.map +1 -1
- package/dist/canonical/validation.js +30 -101
- package/dist/canonical/validation.js.map +1 -1
- package/dist/car/attestation.d.ts +30 -30
- package/dist/car/attestation.d.ts.map +1 -1
- package/dist/car/attestation.js +3 -1
- package/dist/car/attestation.js.map +1 -1
- package/dist/car/car-string.d.ts +47 -47
- package/dist/car/car-string.d.ts.map +1 -1
- package/dist/car/car-string.js +36 -36
- package/dist/car/car-string.js.map +1 -1
- package/dist/car/domains.d.ts +34 -18
- package/dist/car/domains.d.ts.map +1 -1
- package/dist/car/domains.js +53 -15
- package/dist/car/domains.js.map +1 -1
- package/dist/car/effective-permission.d.ts +61 -13
- package/dist/car/effective-permission.d.ts.map +1 -1
- package/dist/car/effective-permission.js +30 -2
- package/dist/car/effective-permission.js.map +1 -1
- package/dist/car/identity.d.ts +327 -108
- package/dist/car/identity.d.ts.map +1 -1
- package/dist/car/identity.js +112 -10
- package/dist/car/identity.js.map +1 -1
- package/dist/car/index.d.ts +3 -3
- package/dist/car/index.d.ts.map +1 -1
- package/dist/car/index.js +15 -7
- package/dist/car/index.js.map +1 -1
- package/dist/car/jwt-claims.d.ts +273 -273
- package/dist/car/jwt-claims.d.ts.map +1 -1
- package/dist/car/jwt-claims.js +39 -46
- package/dist/car/jwt-claims.js.map +1 -1
- package/dist/car/levels.d.ts +2 -2
- package/dist/car/mapping.d.ts +36 -36
- package/dist/car/mapping.d.ts.map +1 -1
- package/dist/car/mapping.js +107 -43
- package/dist/car/mapping.js.map +1 -1
- package/dist/car/skills.d.ts +4 -4
- package/dist/car/tiers.d.ts +7 -7
- package/dist/car/tiers.js +10 -10
- package/dist/car/tiers.js.map +1 -1
- package/dist/common/primitives.d.ts +2 -2
- package/dist/db/agents.d.ts +549 -9
- package/dist/db/agents.d.ts.map +1 -1
- package/dist/db/agents.js +4 -4
- package/dist/db/agents.js.map +1 -1
- package/dist/db/api-keys.d.ts +144 -3
- package/dist/db/api-keys.d.ts.map +1 -1
- package/dist/db/escalations.d.ts +156 -2
- package/dist/db/escalations.d.ts.map +1 -1
- package/dist/db/intents.d.ts +154 -3
- package/dist/db/intents.d.ts.map +1 -1
- package/dist/db/merkle.d.ts +134 -3
- package/dist/db/merkle.d.ts.map +1 -1
- package/dist/db/operations.d.ts +71 -2
- package/dist/db/operations.d.ts.map +1 -1
- package/dist/db/policy-versions.d.ts +38 -1
- package/dist/db/policy-versions.d.ts.map +1 -1
- package/dist/db/proofs.d.ts +119 -3
- package/dist/db/proofs.d.ts.map +1 -1
- package/dist/db/rbac.d.ts +233 -6
- package/dist/db/rbac.d.ts.map +1 -1
- package/dist/db/service-accounts.d.ts +218 -6
- package/dist/db/service-accounts.d.ts.map +1 -1
- package/dist/db/trust.d.ts +168 -2
- package/dist/db/trust.d.ts.map +1 -1
- package/dist/db/webhooks.d.ts +103 -1
- package/dist/db/webhooks.d.ts.map +1 -1
- package/dist/v2/enums.d.ts +5 -0
- package/dist/v2/enums.d.ts.map +1 -1
- package/dist/v2/enums.js +5 -0
- package/dist/v2/enums.js.map +1 -1
- package/dist/v2/evidence.d.ts +20 -20
- package/dist/v2/pre-action-gate.js +5 -5
- package/dist/v2/pre-action-gate.js.map +1 -1
- package/dist/v2/proof-event.d.ts +3 -1
- package/dist/v2/proof-event.d.ts.map +1 -1
- package/dist/v2/retention.d.ts +14 -14
- package/dist/v2/trust-delta.d.ts +6 -6
- package/dist/v2/trust-delta.d.ts.map +1 -1
- package/dist/v2/trust-profile.d.ts +116 -54
- package/dist/v2/trust-profile.d.ts.map +1 -1
- package/dist/v2/trust-profile.js +22 -17
- package/dist/v2/trust-profile.js.map +1 -1
- package/dist/validators/decision.d.ts +6 -6
- package/dist/validators/intent.d.ts +8 -8
- package/dist/validators/proof-event.d.ts +57 -54
- package/dist/validators/proof-event.d.ts.map +1 -1
- package/dist/validators/proof-event.js +2 -1
- package/dist/validators/proof-event.js.map +1 -1
- package/dist/validators/trust-profile.d.ts +76 -244
- package/dist/validators/trust-profile.d.ts.map +1 -1
- package/dist/validators/trust-profile.js +21 -35
- package/dist/validators/trust-profile.js.map +1 -1
- package/package.json +26 -11
- package/dist/aci/aci-string.d.ts +0 -539
- package/dist/aci/aci-string.d.ts.map +0 -1
- package/dist/aci/aci-string.js +0 -581
- package/dist/aci/aci-string.js.map +0 -1
- package/dist/aci/attestation.d.ts +0 -648
- package/dist/aci/attestation.d.ts.map +0 -1
- package/dist/aci/attestation.js +0 -299
- package/dist/aci/attestation.js.map +0 -1
- package/dist/aci/domains.d.ts +0 -260
- package/dist/aci/domains.d.ts.map +0 -1
- package/dist/aci/domains.js +0 -340
- package/dist/aci/domains.js.map +0 -1
- package/dist/aci/effective-permission.d.ts +0 -371
- package/dist/aci/effective-permission.d.ts.map +0 -1
- package/dist/aci/effective-permission.js +0 -364
- package/dist/aci/effective-permission.js.map +0 -1
- package/dist/aci/identity.d.ts +0 -1100
- package/dist/aci/identity.d.ts.map +0 -1
- package/dist/aci/identity.js +0 -338
- package/dist/aci/identity.js.map +0 -1
- package/dist/aci/jwt-claims.d.ts +0 -756
- package/dist/aci/jwt-claims.d.ts.map +0 -1
- package/dist/aci/jwt-claims.js +0 -345
- package/dist/aci/jwt-claims.js.map +0 -1
- package/dist/aci/levels.d.ts +0 -279
- package/dist/aci/levels.d.ts.map +0 -1
- package/dist/aci/levels.js +0 -486
- package/dist/aci/levels.js.map +0 -1
- package/dist/aci/mapping.d.ts +0 -291
- package/dist/aci/mapping.d.ts.map +0 -1
- package/dist/aci/mapping.js +0 -447
- package/dist/aci/mapping.js.map +0 -1
- package/dist/aci/skills.d.ts +0 -314
- package/dist/aci/skills.d.ts.map +0 -1
- package/dist/aci/skills.js +0 -426
- package/dist/aci/skills.js.map +0 -1
- package/dist/aci/tiers.d.ts +0 -403
- package/dist/aci/tiers.d.ts.map +0 -1
- package/dist/aci/tiers.js +0 -686
- package/dist/aci/tiers.js.map +0 -1
|
@@ -1,364 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
/**
|
|
3
|
-
* @fileoverview Effective Permission Calculation
|
|
4
|
-
*
|
|
5
|
-
* Provides types and functions for calculating effective permissions based on
|
|
6
|
-
* multiple inputs including certification tier, competence level, runtime tier,
|
|
7
|
-
* observability ceiling, and context policy ceiling.
|
|
8
|
-
*
|
|
9
|
-
* The effective permission is the minimum of all applicable ceilings, ensuring
|
|
10
|
-
* that agents can never exceed the most restrictive constraint in any dimension.
|
|
11
|
-
*
|
|
12
|
-
* @module @vorionsys/contracts/aci/effective-permission
|
|
13
|
-
*/
|
|
14
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
15
|
-
exports.permissionCheckResultSchema = exports.effectivePermissionSchema = exports.permissionCeilingsSchema = exports.constrainingFactorSchema = exports.effectivePermissionContextSchema = void 0;
|
|
16
|
-
exports.calculateEffectivePermission = calculateEffectivePermission;
|
|
17
|
-
exports.permissionAllowsLevel = permissionAllowsLevel;
|
|
18
|
-
exports.contextAllowsLevel = contextAllowsLevel;
|
|
19
|
-
exports.checkPermission = checkPermission;
|
|
20
|
-
exports.modifyContextCeiling = modifyContextCeiling;
|
|
21
|
-
exports.calculateRequiredChanges = calculateRequiredChanges;
|
|
22
|
-
exports.createDefaultContext = createDefaultContext;
|
|
23
|
-
exports.createMaxPermissionContext = createMaxPermissionContext;
|
|
24
|
-
exports.isEffectivePermissionContext = isEffectivePermissionContext;
|
|
25
|
-
exports.isEffectivePermission = isEffectivePermission;
|
|
26
|
-
const zod_1 = require("zod");
|
|
27
|
-
const levels_js_1 = require("./levels.js");
|
|
28
|
-
const tiers_js_1 = require("./tiers.js");
|
|
29
|
-
/**
|
|
30
|
-
* Zod schema for EffectivePermissionContext.
|
|
31
|
-
*/
|
|
32
|
-
exports.effectivePermissionContextSchema = zod_1.z.object({
|
|
33
|
-
certificationTier: tiers_js_1.certificationTierSchema,
|
|
34
|
-
competenceLevel: levels_js_1.capabilityLevelSchema,
|
|
35
|
-
runtimeTier: tiers_js_1.runtimeTierSchema,
|
|
36
|
-
observabilityCeiling: zod_1.z.number().int().min(0).max(7),
|
|
37
|
-
contextPolicyCeiling: zod_1.z.number().int().min(0).max(7),
|
|
38
|
-
});
|
|
39
|
-
/**
|
|
40
|
-
* Zod schema for ConstrainingFactor.
|
|
41
|
-
*/
|
|
42
|
-
exports.constrainingFactorSchema = zod_1.z.enum([
|
|
43
|
-
'certification_tier',
|
|
44
|
-
'competence_level',
|
|
45
|
-
'runtime_tier',
|
|
46
|
-
'observability_ceiling',
|
|
47
|
-
'context_policy_ceiling',
|
|
48
|
-
'multiple',
|
|
49
|
-
]);
|
|
50
|
-
/**
|
|
51
|
-
* Zod schema for PermissionCeilings.
|
|
52
|
-
*/
|
|
53
|
-
exports.permissionCeilingsSchema = zod_1.z.object({
|
|
54
|
-
certificationCeiling: levels_js_1.capabilityLevelSchema,
|
|
55
|
-
competenceCeiling: levels_js_1.capabilityLevelSchema,
|
|
56
|
-
runtimeCeiling: levels_js_1.capabilityLevelSchema,
|
|
57
|
-
observabilityCeiling: levels_js_1.capabilityLevelSchema,
|
|
58
|
-
contextPolicyCeiling: levels_js_1.capabilityLevelSchema,
|
|
59
|
-
});
|
|
60
|
-
/**
|
|
61
|
-
* Zod schema for EffectivePermission.
|
|
62
|
-
*/
|
|
63
|
-
exports.effectivePermissionSchema = zod_1.z.object({
|
|
64
|
-
level: levels_js_1.capabilityLevelSchema,
|
|
65
|
-
constrained: zod_1.z.boolean(),
|
|
66
|
-
constrainingFactor: exports.constrainingFactorSchema.optional(),
|
|
67
|
-
ceilings: exports.permissionCeilingsSchema,
|
|
68
|
-
recommendations: zod_1.z.array(zod_1.z.string()).optional(),
|
|
69
|
-
});
|
|
70
|
-
// ============================================================================
|
|
71
|
-
// Permission Calculation
|
|
72
|
-
// ============================================================================
|
|
73
|
-
/**
|
|
74
|
-
* Maps certification tier to maximum capability level.
|
|
75
|
-
*/
|
|
76
|
-
function certificationTierToCeiling(tier) {
|
|
77
|
-
return tiers_js_1.CERTIFICATION_TIER_CONFIGS[tier].maxCapabilityLevel;
|
|
78
|
-
}
|
|
79
|
-
/**
|
|
80
|
-
* Maps runtime tier to maximum capability level.
|
|
81
|
-
*/
|
|
82
|
-
function runtimeTierToCeiling(tier) {
|
|
83
|
-
// Runtime tier mapping to capability levels:
|
|
84
|
-
// T0 (Sandbox) -> L0 (Observe only)
|
|
85
|
-
// T1 (Observed) -> L1 (Advise only)
|
|
86
|
-
// T2 (Provisional) -> L2 (Draft)
|
|
87
|
-
// T3 (Monitored) -> L3 (Execute)
|
|
88
|
-
// T4 (Standard) -> L4 (Autonomous)
|
|
89
|
-
// T5 (Trusted) -> L5 (Sovereign)
|
|
90
|
-
// T6 (Certified) -> L6 (Certified)
|
|
91
|
-
// T7 (Autonomous) -> L7 (Autonomous)
|
|
92
|
-
return tier;
|
|
93
|
-
}
|
|
94
|
-
/**
|
|
95
|
-
* Calculates the effective permission from the context.
|
|
96
|
-
*
|
|
97
|
-
* The effective permission is the minimum of all applicable ceilings:
|
|
98
|
-
* - Certification tier ceiling
|
|
99
|
-
* - Competence level (agent's declared capability)
|
|
100
|
-
* - Runtime tier ceiling
|
|
101
|
-
* - Observability ceiling
|
|
102
|
-
* - Context policy ceiling
|
|
103
|
-
*
|
|
104
|
-
* @param ctx - Permission context
|
|
105
|
-
* @returns Effective permission result
|
|
106
|
-
*
|
|
107
|
-
* @example
|
|
108
|
-
* ```typescript
|
|
109
|
-
* const result = calculateEffectivePermission({
|
|
110
|
-
* certificationTier: CertificationTier.T3_MONITORED,
|
|
111
|
-
* competenceLevel: CapabilityLevel.L4_STANDARD,
|
|
112
|
-
* runtimeTier: RuntimeTier.T3_MONITORED,
|
|
113
|
-
* observabilityCeiling: 4,
|
|
114
|
-
* contextPolicyCeiling: 3,
|
|
115
|
-
* });
|
|
116
|
-
* // result.level === CapabilityLevel.L3_EXECUTE
|
|
117
|
-
* // result.constrained === true
|
|
118
|
-
* // result.constrainingFactor === 'context_policy_ceiling'
|
|
119
|
-
* ```
|
|
120
|
-
*/
|
|
121
|
-
function calculateEffectivePermission(ctx) {
|
|
122
|
-
// Calculate individual ceilings
|
|
123
|
-
const certificationCeiling = certificationTierToCeiling(ctx.certificationTier);
|
|
124
|
-
const competenceCeiling = ctx.competenceLevel;
|
|
125
|
-
const runtimeCeiling = runtimeTierToCeiling(ctx.runtimeTier);
|
|
126
|
-
const observabilityCeiling = Math.min(7, Math.max(0, ctx.observabilityCeiling));
|
|
127
|
-
const contextPolicyCeiling = Math.min(7, Math.max(0, ctx.contextPolicyCeiling));
|
|
128
|
-
const ceilings = {
|
|
129
|
-
certificationCeiling,
|
|
130
|
-
competenceCeiling,
|
|
131
|
-
runtimeCeiling,
|
|
132
|
-
observabilityCeiling,
|
|
133
|
-
contextPolicyCeiling,
|
|
134
|
-
};
|
|
135
|
-
// Find the minimum ceiling
|
|
136
|
-
const allCeilings = [
|
|
137
|
-
{ factor: 'certification_tier', level: certificationCeiling },
|
|
138
|
-
{ factor: 'competence_level', level: competenceCeiling },
|
|
139
|
-
{ factor: 'runtime_tier', level: runtimeCeiling },
|
|
140
|
-
{ factor: 'observability_ceiling', level: observabilityCeiling },
|
|
141
|
-
{ factor: 'context_policy_ceiling', level: contextPolicyCeiling },
|
|
142
|
-
];
|
|
143
|
-
const minCeilingLevel = Math.min(...allCeilings.map((c) => c.level));
|
|
144
|
-
const constrainingFactors = allCeilings.filter((c) => c.level === minCeilingLevel);
|
|
145
|
-
// Determine if constrained and by what
|
|
146
|
-
const maxPossibleLevel = Math.max(certificationCeiling, competenceCeiling, runtimeCeiling, observabilityCeiling, contextPolicyCeiling);
|
|
147
|
-
const constrained = minCeilingLevel < maxPossibleLevel;
|
|
148
|
-
let constrainingFactor;
|
|
149
|
-
if (constrained) {
|
|
150
|
-
constrainingFactor = constrainingFactors.length > 1
|
|
151
|
-
? 'multiple'
|
|
152
|
-
: constrainingFactors[0].factor;
|
|
153
|
-
}
|
|
154
|
-
// Generate recommendations
|
|
155
|
-
const recommendations = [];
|
|
156
|
-
if (constrained) {
|
|
157
|
-
for (const cf of constrainingFactors) {
|
|
158
|
-
switch (cf.factor) {
|
|
159
|
-
case 'certification_tier':
|
|
160
|
-
recommendations.push(`Increase certification tier from ${ctx.certificationTier} to unlock higher capability levels`);
|
|
161
|
-
break;
|
|
162
|
-
case 'runtime_tier':
|
|
163
|
-
recommendations.push(`Request higher runtime tier from T${ctx.runtimeTier} to enable more autonomy`);
|
|
164
|
-
break;
|
|
165
|
-
case 'observability_ceiling':
|
|
166
|
-
recommendations.push('Improve observability instrumentation to raise the observability ceiling');
|
|
167
|
-
break;
|
|
168
|
-
case 'context_policy_ceiling':
|
|
169
|
-
recommendations.push('Request policy exception or operate in a context with higher policy ceiling');
|
|
170
|
-
break;
|
|
171
|
-
case 'competence_level':
|
|
172
|
-
recommendations.push('This is the declared competence level of the agent');
|
|
173
|
-
break;
|
|
174
|
-
}
|
|
175
|
-
}
|
|
176
|
-
}
|
|
177
|
-
return {
|
|
178
|
-
level: minCeilingLevel,
|
|
179
|
-
constrained,
|
|
180
|
-
constrainingFactor,
|
|
181
|
-
ceilings,
|
|
182
|
-
recommendations: recommendations.length > 0 ? recommendations : undefined,
|
|
183
|
-
};
|
|
184
|
-
}
|
|
185
|
-
// ============================================================================
|
|
186
|
-
// Permission Checking
|
|
187
|
-
// ============================================================================
|
|
188
|
-
/**
|
|
189
|
-
* Checks if an effective permission allows a specific capability level.
|
|
190
|
-
*
|
|
191
|
-
* @param permission - Effective permission
|
|
192
|
-
* @param requiredLevel - Required capability level
|
|
193
|
-
* @returns True if the permission allows the required level
|
|
194
|
-
*/
|
|
195
|
-
function permissionAllowsLevel(permission, requiredLevel) {
|
|
196
|
-
return permission.level >= requiredLevel;
|
|
197
|
-
}
|
|
198
|
-
/**
|
|
199
|
-
* Checks if a context allows a specific capability level.
|
|
200
|
-
*
|
|
201
|
-
* @param ctx - Permission context
|
|
202
|
-
* @param requiredLevel - Required capability level
|
|
203
|
-
* @returns True if the context allows the required level
|
|
204
|
-
*/
|
|
205
|
-
function contextAllowsLevel(ctx, requiredLevel) {
|
|
206
|
-
const permission = calculateEffectivePermission(ctx);
|
|
207
|
-
return permissionAllowsLevel(permission, requiredLevel);
|
|
208
|
-
}
|
|
209
|
-
/**
|
|
210
|
-
* Performs a detailed permission check.
|
|
211
|
-
*
|
|
212
|
-
* @param ctx - Permission context
|
|
213
|
-
* @param requiredLevel - Required capability level
|
|
214
|
-
* @returns Detailed permission check result
|
|
215
|
-
*/
|
|
216
|
-
function checkPermission(ctx, requiredLevel) {
|
|
217
|
-
const permission = calculateEffectivePermission(ctx);
|
|
218
|
-
return {
|
|
219
|
-
allowed: permission.level >= requiredLevel,
|
|
220
|
-
effectiveLevel: permission.level,
|
|
221
|
-
requestedLevel: requiredLevel,
|
|
222
|
-
levelGap: Math.max(0, requiredLevel - permission.level),
|
|
223
|
-
permission,
|
|
224
|
-
};
|
|
225
|
-
}
|
|
226
|
-
/**
|
|
227
|
-
* Zod schema for PermissionCheckResult.
|
|
228
|
-
*/
|
|
229
|
-
exports.permissionCheckResultSchema = zod_1.z.object({
|
|
230
|
-
allowed: zod_1.z.boolean(),
|
|
231
|
-
effectiveLevel: levels_js_1.capabilityLevelSchema,
|
|
232
|
-
requestedLevel: levels_js_1.capabilityLevelSchema,
|
|
233
|
-
levelGap: zod_1.z.number().int().min(0),
|
|
234
|
-
permission: exports.effectivePermissionSchema,
|
|
235
|
-
});
|
|
236
|
-
// ============================================================================
|
|
237
|
-
// Permission Modification
|
|
238
|
-
// ============================================================================
|
|
239
|
-
/**
|
|
240
|
-
* Creates a new context with a modified ceiling.
|
|
241
|
-
*
|
|
242
|
-
* @param ctx - Original context
|
|
243
|
-
* @param factor - Factor to modify
|
|
244
|
-
* @param newValue - New value for the factor
|
|
245
|
-
* @returns New context with modified value
|
|
246
|
-
*/
|
|
247
|
-
function modifyContextCeiling(ctx, factor, newValue) {
|
|
248
|
-
const newCtx = { ...ctx };
|
|
249
|
-
switch (factor) {
|
|
250
|
-
case 'certification_tier':
|
|
251
|
-
newCtx.certificationTier = Math.min(7, Math.max(0, newValue));
|
|
252
|
-
break;
|
|
253
|
-
case 'competence_level':
|
|
254
|
-
newCtx.competenceLevel = Math.min(7, Math.max(0, newValue));
|
|
255
|
-
break;
|
|
256
|
-
case 'runtime_tier':
|
|
257
|
-
newCtx.runtimeTier = Math.min(7, Math.max(0, newValue));
|
|
258
|
-
break;
|
|
259
|
-
case 'observability_ceiling':
|
|
260
|
-
newCtx.observabilityCeiling = Math.min(7, Math.max(0, newValue));
|
|
261
|
-
break;
|
|
262
|
-
case 'context_policy_ceiling':
|
|
263
|
-
newCtx.contextPolicyCeiling = Math.min(7, Math.max(0, newValue));
|
|
264
|
-
break;
|
|
265
|
-
}
|
|
266
|
-
return newCtx;
|
|
267
|
-
}
|
|
268
|
-
/**
|
|
269
|
-
* Calculates what context changes would be needed to achieve a target level.
|
|
270
|
-
*
|
|
271
|
-
* @param ctx - Current context
|
|
272
|
-
* @param targetLevel - Desired capability level
|
|
273
|
-
* @returns Map of factors to required values
|
|
274
|
-
*/
|
|
275
|
-
function calculateRequiredChanges(ctx, targetLevel) {
|
|
276
|
-
const changes = new Map();
|
|
277
|
-
const permission = calculateEffectivePermission(ctx);
|
|
278
|
-
if (permission.level >= targetLevel) {
|
|
279
|
-
return changes; // No changes needed
|
|
280
|
-
}
|
|
281
|
-
// Check each factor and determine if it needs to increase
|
|
282
|
-
const certificationCeiling = permission.ceilings.certificationCeiling;
|
|
283
|
-
if (certificationCeiling < targetLevel) {
|
|
284
|
-
// Need higher certification tier
|
|
285
|
-
for (let tier = ctx.certificationTier + 1; tier <= 7; tier++) {
|
|
286
|
-
if (certificationTierToCeiling(tier) >= targetLevel) {
|
|
287
|
-
changes.set('certification_tier', tier);
|
|
288
|
-
break;
|
|
289
|
-
}
|
|
290
|
-
}
|
|
291
|
-
}
|
|
292
|
-
if (permission.ceilings.competenceCeiling < targetLevel) {
|
|
293
|
-
changes.set('competence_level', targetLevel);
|
|
294
|
-
}
|
|
295
|
-
if (permission.ceilings.runtimeCeiling < targetLevel) {
|
|
296
|
-
changes.set('runtime_tier', targetLevel);
|
|
297
|
-
}
|
|
298
|
-
if (permission.ceilings.observabilityCeiling < targetLevel) {
|
|
299
|
-
changes.set('observability_ceiling', targetLevel);
|
|
300
|
-
}
|
|
301
|
-
if (permission.ceilings.contextPolicyCeiling < targetLevel) {
|
|
302
|
-
changes.set('context_policy_ceiling', targetLevel);
|
|
303
|
-
}
|
|
304
|
-
return changes;
|
|
305
|
-
}
|
|
306
|
-
// ============================================================================
|
|
307
|
-
// Default Context
|
|
308
|
-
// ============================================================================
|
|
309
|
-
/**
|
|
310
|
-
* Creates a default permission context.
|
|
311
|
-
*
|
|
312
|
-
* @param overrides - Optional overrides
|
|
313
|
-
* @returns Default context with any overrides applied
|
|
314
|
-
*/
|
|
315
|
-
function createDefaultContext(overrides) {
|
|
316
|
-
return {
|
|
317
|
-
certificationTier: tiers_js_1.CertificationTier.T0_SANDBOX,
|
|
318
|
-
competenceLevel: levels_js_1.CapabilityLevel.L0_OBSERVE,
|
|
319
|
-
runtimeTier: tiers_js_1.RuntimeTier.T0_SANDBOX,
|
|
320
|
-
observabilityCeiling: 7,
|
|
321
|
-
contextPolicyCeiling: 7,
|
|
322
|
-
...overrides,
|
|
323
|
-
};
|
|
324
|
-
}
|
|
325
|
-
/**
|
|
326
|
-
* Creates a maximally permissive context.
|
|
327
|
-
*
|
|
328
|
-
* @returns Context with all ceilings at maximum
|
|
329
|
-
*/
|
|
330
|
-
function createMaxPermissionContext() {
|
|
331
|
-
return {
|
|
332
|
-
certificationTier: tiers_js_1.CertificationTier.T7_AUTONOMOUS,
|
|
333
|
-
competenceLevel: levels_js_1.CapabilityLevel.L7_AUTONOMOUS,
|
|
334
|
-
runtimeTier: tiers_js_1.RuntimeTier.T7_AUTONOMOUS,
|
|
335
|
-
observabilityCeiling: 7,
|
|
336
|
-
contextPolicyCeiling: 7,
|
|
337
|
-
};
|
|
338
|
-
}
|
|
339
|
-
// ============================================================================
|
|
340
|
-
// Type Guards
|
|
341
|
-
// ============================================================================
|
|
342
|
-
/**
|
|
343
|
-
* Type guard for EffectivePermissionContext.
|
|
344
|
-
*/
|
|
345
|
-
function isEffectivePermissionContext(value) {
|
|
346
|
-
return (typeof value === 'object' &&
|
|
347
|
-
value !== null &&
|
|
348
|
-
'certificationTier' in value &&
|
|
349
|
-
'competenceLevel' in value &&
|
|
350
|
-
'runtimeTier' in value &&
|
|
351
|
-
'observabilityCeiling' in value &&
|
|
352
|
-
'contextPolicyCeiling' in value);
|
|
353
|
-
}
|
|
354
|
-
/**
|
|
355
|
-
* Type guard for EffectivePermission.
|
|
356
|
-
*/
|
|
357
|
-
function isEffectivePermission(value) {
|
|
358
|
-
return (typeof value === 'object' &&
|
|
359
|
-
value !== null &&
|
|
360
|
-
'level' in value &&
|
|
361
|
-
'constrained' in value &&
|
|
362
|
-
'ceilings' in value);
|
|
363
|
-
}
|
|
364
|
-
//# sourceMappingURL=effective-permission.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"effective-permission.js","sourceRoot":"","sources":["../../src/aci/effective-permission.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAyLH,oEAwFC;AAaD,sDAKC;AASD,gDAMC;AAyBD,0CAaC;AAyBD,oDA0BC;AASD,4DAwCC;AAYD,oDAWC;AAOD,gEAQC;AASD,oEAYC;AAKD,sDAQC;AAlgBD,6BAAwB;AACxB,2CAAqE;AACrE,yCAMoB;AA6BpB;;GAEG;AACU,QAAA,gCAAgC,GAAG,OAAC,CAAC,MAAM,CAAC;IACvD,iBAAiB,EAAE,kCAAuB;IAC1C,eAAe,EAAE,iCAAqB;IACtC,WAAW,EAAE,4BAAiB;IAC9B,oBAAoB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,oBAAoB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACrD,CAAC,CAAC;AAiDH;;GAEG;AACU,QAAA,wBAAwB,GAAG,OAAC,CAAC,IAAI,CAAC;IAC7C,oBAAoB;IACpB,kBAAkB;IAClB,cAAc;IACd,uBAAuB;IACvB,wBAAwB;IACxB,UAAU;CACX,CAAC,CAAC;AAEH;;GAEG;AACU,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,oBAAoB,EAAE,iCAAqB;IAC3C,iBAAiB,EAAE,iCAAqB;IACxC,cAAc,EAAE,iCAAqB;IACrC,oBAAoB,EAAE,iCAAqB;IAC3C,oBAAoB,EAAE,iCAAqB;CAC5C,CAAC,CAAC;AAEH;;GAEG;AACU,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,iCAAqB;IAC5B,WAAW,EAAE,OAAC,CAAC,OAAO,EAAE;IACxB,kBAAkB,EAAE,gCAAwB,CAAC,QAAQ,EAAE;IACvD,QAAQ,EAAE,gCAAwB;IAClC,eAAe,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAEH,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;GAEG;AACH,SAAS,0BAA0B,CAAC,IAAuB;IACzD,OAAO,qCAA0B,CAAC,IAAI,CAAC,CAAC,kBAAqC,CAAC;AAChF,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAAiB;IAC7C,6CAA6C;IAC7C,oCAAoC;IACpC,oCAAoC;IACpC,iCAAiC;IACjC,iCAAiC;IACjC,mCAAmC;IACnC,iCAAiC;IACjC,mCAAmC;IACnC,qCAAqC;IACrC,OAAO,IAAkC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAgB,4BAA4B,CAC1C,GAA+B;IAE/B,gCAAgC;IAChC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/E,MAAM,iBAAiB,GAAG,GAAG,CAAC,eAAe,CAAC;IAC9C,MAAM,cAAc,GAAG,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAoB,CAAC;IACnG,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAoB,CAAC;IAEnG,MAAM,QAAQ,GAAuB;QACnC,oBAAoB;QACpB,iBAAiB;QACjB,cAAc;QACd,oBAAoB;QACpB,oBAAoB;KACrB,CAAC;IAEF,2BAA2B;IAC3B,MAAM,WAAW,GAAG;QAClB,EAAE,MAAM,EAAE,oBAA6B,EAAE,KAAK,EAAE,oBAAoB,EAAE;QACtE,EAAE,MAAM,EAAE,kBAA2B,EAAE,KAAK,EAAE,iBAAiB,EAAE;QACjE,EAAE,MAAM,EAAE,cAAuB,EAAE,KAAK,EAAE,cAAc,EAAE;QAC1D,EAAE,MAAM,EAAE,uBAAgC,EAAE,KAAK,EAAE,oBAAoB,EAAE;QACzE,EAAE,MAAM,EAAE,wBAAiC,EAAE,KAAK,EAAE,oBAAoB,EAAE;KAC3E,CAAC;IAEF,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAoB,CAAC;IACxF,MAAM,mBAAmB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC;IAEnF,uCAAuC;IACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAC/B,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,CACrB,CAAC;IACF,MAAM,WAAW,GAAG,eAAe,GAAG,gBAAgB,CAAC;IAEvD,IAAI,kBAAkD,CAAC;IACvD,IAAI,WAAW,EAAE,CAAC;QAChB,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,GAAG,CAAC;YACjD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;IACrC,CAAC;IAED,2BAA2B;IAC3B,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,IAAI,WAAW,EAAE,CAAC;QAChB,KAAK,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC;YACrC,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC;gBAClB,KAAK,oBAAoB;oBACvB,eAAe,CAAC,IAAI,CAClB,oCAAoC,GAAG,CAAC,iBAAiB,qCAAqC,CAC/F,CAAC;oBACF,MAAM;gBACR,KAAK,cAAc;oBACjB,eAAe,CAAC,IAAI,CAClB,qCAAqC,GAAG,CAAC,WAAW,0BAA0B,CAC/E,CAAC;oBACF,MAAM;gBACR,KAAK,uBAAuB;oBAC1B,eAAe,CAAC,IAAI,CAClB,0EAA0E,CAC3E,CAAC;oBACF,MAAM;gBACR,KAAK,wBAAwB;oBAC3B,eAAe,CAAC,IAAI,CAClB,6EAA6E,CAC9E,CAAC;oBACF,MAAM;gBACR,KAAK,kBAAkB;oBACrB,eAAe,CAAC,IAAI,CAClB,oDAAoD,CACrD,CAAC;oBACF,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,eAAe;QACtB,WAAW;QACX,kBAAkB;QAClB,QAAQ;QACR,eAAe,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;KAC1E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAgB,qBAAqB,CACnC,UAA+B,EAC/B,aAA8B;IAE9B,OAAO,UAAU,CAAC,KAAK,IAAI,aAAa,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAChC,GAA+B,EAC/B,aAA8B;IAE9B,MAAM,UAAU,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,qBAAqB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC;AAkBD;;;;;;GAMG;AACH,SAAgB,eAAe,CAC7B,GAA+B,EAC/B,aAA8B;IAE9B,MAAM,UAAU,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAErD,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,KAAK,IAAI,aAAa;QAC1C,cAAc,EAAE,UAAU,CAAC,KAAK;QAChC,cAAc,EAAE,aAAa;QAC7B,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;QACvD,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;GAEG;AACU,QAAA,2BAA2B,GAAG,OAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;IACpB,cAAc,EAAE,iCAAqB;IACrC,cAAc,EAAE,iCAAqB;IACrC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,iCAAyB;CACtC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAClC,GAA+B,EAC/B,MAA+C,EAC/C,QAAgB;IAEhB,MAAM,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAE1B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,oBAAoB;YACvB,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAsB,CAAC;YACnF,MAAM;QACR,KAAK,kBAAkB;YACrB,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAoB,CAAC;YAC/E,MAAM;QACR,KAAK,cAAc;YACjB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAgB,CAAC;YACvE,MAAM;QACR,KAAK,uBAAuB;YAC1B,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjE,MAAM;QACR,KAAK,wBAAwB;YAC3B,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjE,MAAM;IACV,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,wBAAwB,CACtC,GAA+B,EAC/B,WAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmD,CAAC;IAC3E,MAAM,UAAU,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAErD,IAAI,UAAU,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,CAAC,oBAAoB;IACtC,CAAC;IAED,0DAA0D;IAC1D,MAAM,oBAAoB,GAAG,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IACtE,IAAI,oBAAoB,GAAG,WAAW,EAAE,CAAC;QACvC,iCAAiC;QACjC,KAAK,IAAI,IAAI,GAAG,GAAG,CAAC,iBAAiB,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YAC7D,IAAI,0BAA0B,CAAC,IAAyB,CAAC,IAAI,WAAW,EAAE,CAAC;gBACzE,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;gBACxC,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,iBAAiB,GAAG,WAAW,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,cAAc,GAAG,WAAW,EAAE,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,GAAG,WAAW,EAAE,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,GAAG,WAAW,EAAE,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;GAKG;AACH,SAAgB,oBAAoB,CAClC,SAA+C;IAE/C,OAAO;QACL,iBAAiB,EAAE,4BAAiB,CAAC,UAAU;QAC/C,eAAe,EAAE,2BAAe,CAAC,UAAU;QAC3C,WAAW,EAAE,sBAAW,CAAC,UAAU;QACnC,oBAAoB,EAAE,CAAC;QACvB,oBAAoB,EAAE,CAAC;QACvB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,0BAA0B;IACxC,OAAO;QACL,iBAAiB,EAAE,4BAAiB,CAAC,aAAa;QAClD,eAAe,EAAE,2BAAe,CAAC,aAAa;QAC9C,WAAW,EAAE,sBAAW,CAAC,aAAa;QACtC,oBAAoB,EAAE,CAAC;QACvB,oBAAoB,EAAE,CAAC;KACxB,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,4BAA4B,CAC1C,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,mBAAmB,IAAI,KAAK;QAC5B,iBAAiB,IAAI,KAAK;QAC1B,aAAa,IAAI,KAAK;QACtB,sBAAsB,IAAI,KAAK;QAC/B,sBAAsB,IAAI,KAAK,CAChC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,KAAc;IAClD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAO,IAAI,KAAK;QAChB,aAAa,IAAI,KAAK;QACtB,UAAU,IAAI,KAAK,CACpB,CAAC;AACJ,CAAC"}
|