aimeat 1.35.0 → 1.37.0

package/dist/src/data/aimeat-iam-package.js

@@ -1,15 +1,30 @@
 // ── Extension `iam` — server-side enforcement (V8 sandbox: export default async (ctx, input)) ──
 const SCRIPT_CHECK = `export default async function (ctx, input) {
-  const permission = input && input.permission;
-  if (!permission) return { allowed: false, error: 'permission required' };
   const config = (await ctx.memory.get('iam.config')) || {};
   const roles = (await ctx.memory.get('iam.roles')) || {};
+  const levels = (await ctx.memory.get('iam.levels')) || {};
+  const commands = (await ctx.memory.get('iam.commands')) || [];
   const assignments = (await ctx.memory.get('iam.assignments')) || {};
   const caller = ctx.caller && ctx.caller.gaii;
   const role = (caller && assignments[caller]) || config.defaultRole || null;
   const perms = (role && roles[role]) || [];
-  const allowed = perms.indexOf('*') !== -1 || perms.indexOf(permission) !== -1;
-  return { allowed: allowed, role: role, permission: permission };
+  const level = (role && Object.prototype.hasOwnProperty.call(levels, role)) ? levels[role] : null;
+  const has = function (cap) { return perms.indexOf('*') !== -1 || perms.indexOf(cap) !== -1; };
+  // Command mode: check { command } — resolve the command's required capability + mutation tier so the
+  // caller (a human GHII or an agent GAII, identically) knows whether it may run + when to confirm.
+  if (input && input.command) {
+    let cmd = null;
+    for (let i = 0; i < commands.length; i++) { if (commands[i] && commands[i].id === input.command) { cmd = commands[i]; break; } }
+    if (!cmd) return { allowed: false, error: 'unknown command', command: input.command, role: role, level: level };
+    return {
+      allowed: has(cmd.capability), role: role, level: level, command: cmd.id, capability: cmd.capability,
+      tier: cmd.tier || 'write', needsConfirmation: cmd.tier === 'irreversible',
+    };
+  }
+  // Permission mode (legacy — unchanged shape): check { permission }.
+  const permission = input && input.permission;
+  if (!permission) return { allowed: false, error: 'permission or command required' };
+  return { allowed: has(permission), role: role, permission: permission, level: level };
 }`;
 const SCRIPT_ADMIN = `export default async function (ctx, input) {
   const caller = ctx.caller && ctx.caller.gaii;
@@ -21,6 +36,12 @@ const SCRIPT_ADMIN = `export default async function (ctx, input) {
     roles = { admin: ['*'], editor: ['read', 'create', 'edit'], viewer: ['read'] };
     await ctx.memory.set('iam.roles', roles);
   }
+  let levels = await ctx.memory.get('iam.levels');
+  if (!levels) {
+    levels = { admin: 0, editor: 10, viewer: 20 };  // BBS ordinal, lower = more power
+    await ctx.memory.set('iam.levels', levels);
+  }
+  let commands = (await ctx.memory.get('iam.commands')) || [];
   if (op === 'claim') {
     if (!config.ownerGhii) {
       config.ownerGhii = caller;
@@ -31,7 +52,7 @@ const SCRIPT_ADMIN = `export default async function (ctx, input) {
   }
   const isOwner = !config.ownerGhii || config.ownerGhii === caller;
   if (op === 'getState') {
-    return { ok: true, ownerGhii: config.ownerGhii || null, isOwner: isOwner, config: config, roles: roles, assignments: assignments };
+    return { ok: true, ownerGhii: config.ownerGhii || null, isOwner: isOwner, config: config, roles: roles, levels: levels, commands: commands, assignments: assignments };
   }
   if (!isOwner) return { ok: false, error: 'forbidden: owner only' };
   if (op === 'setConfig') {
@@ -43,6 +64,14 @@ const SCRIPT_ADMIN = `export default async function (ctx, input) {
     if (input.roles && typeof input.roles === 'object') { roles = input.roles; await ctx.memory.set('iam.roles', roles); }
     return { ok: true, roles: roles };
   }
+  if (op === 'setLevels') {
+    if (input.levels && typeof input.levels === 'object') { levels = input.levels; await ctx.memory.set('iam.levels', levels); }
+    return { ok: true, levels: levels };
+  }
+  if (op === 'setCommands') {
+    if (Array.isArray(input.commands)) { commands = input.commands; await ctx.memory.set('iam.commands', commands); }
+    return { ok: true, commands: commands };
+  }
   if (op === 'assign') {
     if (input.ghii && input.role) { assignments[input.ghii] = input.role; await ctx.memory.set('iam.assignments', assignments); }
     return { ok: true, assignments: assignments };
@@ -57,8 +86,8 @@ const EXTENSION_IAM = JSON.stringify({
     manifest: [
         'metadata:',
         '  name: iam',
-        '  version: 1.0.0',
-        '  description: In-app role & permission management with server-side enforcement.',
+        '  version: 1.1.0',
+        '  description: In-app role & permission management with server-side enforcement (BBS levels + command manifest).',
         '  author: operator',
         'required_apis:',
         '  - memory',
@@ -66,9 +95,9 @@ const EXTENSION_IAM = JSON.stringify({
         '  - id: check',
         '    method: POST',
         '    path: /check',
-        '    description: Check whether the calling user has a permission. Any authenticated user.',
-        '    input_schema: { type: object, properties: { permission: { type: string } }, required: [permission] }',
-        '    output_schema: { type: object, properties: { allowed: { type: boolean }, role: { type: string } } }',
+        '    description: Check whether the caller may do something — pass { permission } for a raw capability or { command } to resolve an app command (returns its mutation tier + needsConfirmation). Any authenticated user.',
+        '    input_schema: { type: object, properties: { permission: { type: string }, command: { type: string } } }',
+        '    output_schema: { type: object, properties: { allowed: { type: boolean }, role: { type: string }, level: { type: number }, tier: { type: string }, needsConfirmation: { type: boolean } } }',
         '    script: check.js',
         '  - id: admin',
         '    method: POST',

package/dist/src/data/aimeat-iam-package.js.map

@@ -1 +1 @@
-{"version":3,"file":"aimeat-iam-package.js","sourceRoot":"","sources":["../../../src/data/aimeat-iam-package.ts"],"names":[],"mappings":"AAwBA,kGAAkG;AAElG,MAAM,YAAY,GAAG;;;;;;;;;;;EAWnB,CAAC;AAEH,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyCnB,CAAC;AAEH,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC;IACnC,QAAQ,EAAE;QACR,WAAW;QACX,aAAa;QACb,kBAAkB;QAClB,kFAAkF;QAClF,oBAAoB;QACpB,gBAAgB;QAChB,YAAY;QACZ,UAAU;QACV,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,2FAA2F;QAC3F,0GAA0G;QAC1G,yGAAyG;QACzG,sBAAsB;QACtB,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,oFAAoF;QACpF,0FAA0F;QAC1F,4EAA4E;QAC5E,sBAAsB;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC;IACZ,OAAO,EAAE;QACP,UAAU,EAAE,YAAY;QACxB,UAAU,EAAE,YAAY;KACzB;CACF,CAAC,CAAC;AAEH,qGAAqG;AAErG,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4Md,CAAC;AAET,wEAAwE;AAExE,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,yUAAyU;QACtV,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,CAAC;QAC3E,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE;YACV,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,2BAA2B,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE;YACxH,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,eAAe,CAAC,EAAE;SACtH;QACD,eAAe,EAAE;YACf,KAAK,EAAE,kCAAkC;YACzC,WAAW,EAAE,8cAA8c;YAC3d,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC;SAChE;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"aimeat-iam-package.js","sourceRoot":"","sources":["../../../src/data/aimeat-iam-package.ts"],"names":[],"mappings":"AAgCA,kGAAkG;AAElG,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;EA0BnB,CAAC;AAEH,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuDnB,CAAC;AAEH,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC;IACnC,QAAQ,EAAE;QACR,WAAW;QACX,aAAa;QACb,kBAAkB;QAClB,kHAAkH;QAClH,oBAAoB;QACpB,gBAAgB;QAChB,YAAY;QACZ,UAAU;QACV,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,yNAAyN;QACzN,6GAA6G;QAC7G,gMAAgM;QAChM,sBAAsB;QACtB,eAAe;QACf,kBAAkB;QAClB,kBAAkB;QAClB,oFAAoF;QACpF,0FAA0F;QAC1F,4EAA4E;QAC5E,sBAAsB;KACvB,CAAC,IAAI,CAAC,IAAI,CAAC;IACZ,OAAO,EAAE;QACP,UAAU,EAAE,YAAY;QACxB,UAAU,EAAE,YAAY;KACzB;CACF,CAAC,CAAC;AAEH,qGAAqG;AAErG,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4Md,CAAC;AAET,wEAAwE;AAExE,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,yUAAyU;QACtV,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,CAAC;QAC3E,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE;YACV,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,2BAA2B,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE;YACxH,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,eAAe,CAAC,EAAE;SACtH;QACD,eAAe,EAAE;YACf,KAAK,EAAE,kCAAkC;YACzC,WAAW,EAAE,8cAA8c;YAC3d,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC;SAChE;KACF,CAAC;AACJ,CAAC"}