@aexhq/sdk 0.46.5-canary → 0.51.0

package/dist/_contracts/schemas/session-limits.d.ts

@@ -1,34 +0,0 @@
-/**
- * Schema for the per-session lineage-limit override.
- *
- * A SHAPE/positivity gate only. Clamping to the workspace and platform ceilings
- * is the resolver's job (`resolveSessionLimits` in `@aexhq/shared`) and must not
- * migrate here — a schema that clamped would silently change a caller's request
- * instead of describing it.
- */
-import * as z from "zod/mini";
-import { type Present } from "./wire.js";
-/**
- * Wire shape of `limits`. Declaration order is the permitted-key order reported
- * on an unknown field, and the order {@link normalizeSessionLimits} emits.
- */
-export declare const SessionLimitsSchema: z.ZodMiniObject<{
-    maxConcurrentChildSessions: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-    maxSubagentDepth: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-    maxSpendUsd: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-    maxTurns: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-    maxStepsPerTurn: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-}, z.core.$strict>;
-export type SessionLimitsWire = z.infer<typeof SessionLimitsSchema>;
-/**
- * Collapse a no-signal override to `undefined` and drop absent fields.
- *
- * Deliberately NOT a `.transform()` on the schema: `z.toJSONSchema(s, {io:"output"})`
- * throws on any transform, which would make the response half of the generated
- * spec ungenerable (L1). Schemas validate; `normalize*()` functions transform.
- *
- * `limits: {}` carries no more signal than an absent `limits`, and landing an
- * empty object on the request would make the two distinguishable downstream for
- * no reason. The resolver supplies platform defaults for every absent field.
- */
-export declare function normalizeSessionLimits(limits: SessionLimitsWire): Present<SessionLimitsWire> | undefined;

package/dist/_contracts/schemas/session-limits.js

@@ -1,39 +0,0 @@
-/**
- * Schema for the per-session lineage-limit override.
- *
- * A SHAPE/positivity gate only. Clamping to the workspace and platform ceilings
- * is the resolver's job (`resolveSessionLimits` in `@aexhq/shared`) and must not
- * migrate here — a schema that clamped would silently change a caller's request
- * instead of describing it.
- */
-import * as z from "zod/mini";
-import { positiveInt, positiveNumber } from "./numeric.js";
-import { wireObject } from "./wire.js";
-/**
- * Wire shape of `limits`. Declaration order is the permitted-key order reported
- * on an unknown field, and the order {@link normalizeSessionLimits} emits.
- */
-export const SessionLimitsSchema = wireObject("limits", {
-    maxConcurrentChildSessions: z.optional(positiveInt("limits.maxConcurrentChildSessions")),
-    maxSubagentDepth: z.optional(positiveInt("limits.maxSubagentDepth")),
-    maxSpendUsd: z.optional(positiveNumber("limits.maxSpendUsd")),
-    maxTurns: z.optional(positiveInt("limits.maxTurns")),
-    maxStepsPerTurn: z.optional(positiveInt("limits.maxStepsPerTurn"))
-});
-/**
- * Collapse a no-signal override to `undefined` and drop absent fields.
- *
- * Deliberately NOT a `.transform()` on the schema: `z.toJSONSchema(s, {io:"output"})`
- * throws on any transform, which would make the response half of the generated
- * spec ungenerable (L1). Schemas validate; `normalize*()` functions transform.
- *
- * `limits: {}` carries no more signal than an absent `limits`, and landing an
- * empty object on the request would make the two distinguishable downstream for
- * no reason. The resolver supplies platform defaults for every absent field.
- */
-export function normalizeSessionLimits(limits) {
-    const present = Object.entries(limits).filter(([, value]) => value !== undefined);
-    return present.length === 0
-        ? undefined
-        : Object.fromEntries(present);
-}

package/dist/_contracts/schemas/session-machine.d.ts

@@ -1,23 +0,0 @@
-/**
- * Schema for the per-session capacity intent.
- *
- * Intent only — the managed runtime selects capacity from it. `spot: true` opts
- * into interruptible capacity; absent or `false` requests standard capacity.
- */
-import * as z from "zod/mini";
-import { type Present } from "./wire.js";
-/** Wire shape of `machine`. */
-export declare const SessionMachineSchema: z.ZodMiniObject<{
-    spot: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
-}, z.core.$strict>;
-export type SessionMachineWire = z.infer<typeof SessionMachineSchema>;
-/**
- * Collapse a no-signal object (`machine: {}`) to `undefined`; preserve an
- * explicit `spot`, including `false`.
- *
- * Separate from the schema for the same reason as the sibling limits
- * normaliser — see {@link import("./session-limits.js").normalizeSessionLimits}.
- * `false` is signal here: it is a caller explicitly declining interruptible
- * capacity, which is not the same as not having asked.
- */
-export declare function normalizeSessionMachine(machine: SessionMachineWire): Present<SessionMachineWire> | undefined;

package/dist/_contracts/schemas/session-machine.js

@@ -1,24 +0,0 @@
-/**
- * Schema for the per-session capacity intent.
- *
- * Intent only — the managed runtime selects capacity from it. `spot: true` opts
- * into interruptible capacity; absent or `false` requests standard capacity.
- */
-import * as z from "zod/mini";
-import { wireObject } from "./wire.js";
-/** Wire shape of `machine`. */
-export const SessionMachineSchema = wireObject("machine", {
-    spot: z.optional(z.boolean({ error: "machine.spot must be a boolean" }))
-});
-/**
- * Collapse a no-signal object (`machine: {}`) to `undefined`; preserve an
- * explicit `spot`, including `false`.
- *
- * Separate from the schema for the same reason as the sibling limits
- * normaliser — see {@link import("./session-limits.js").normalizeSessionLimits}.
- * `false` is signal here: it is a caller explicitly declining interruptible
- * capacity, which is not the same as not having asked.
- */
-export function normalizeSessionMachine(machine) {
-    return machine.spot === undefined ? undefined : { spot: machine.spot };
-}

package/dist/_contracts/schemas/session-request-config.d.ts

@@ -1,58 +0,0 @@
-/**
- * Schema for the plain JSON `aex start --config <path>` accepts: the
- * credential-free session parameters the CLI folds into a normal `submit`.
- *
- * Every message this family raises is prefixed with the words
- * `session request config` rather than a dotted path, because that is what a
- * user editing a `session.json` sees. The prefix is the schema's mount path, so
- * `wireObject`'s default `notObject` wording already reads correctly.
- */
-import * as z from "zod/mini";
-import type { SessionConfigMcpServer, SessionRequestConfig } from "../session-config.js";
-import { type McpWirePolicy } from "./mcp-server.js";
-/**
- * Wire shape of a session request config. Declaration order is both the
- * permitted-key order and the order the field checks report in, matching the
- * sequential model/system/prompt/mcpServers ladder this replaces.
- *
- * `mcpServers` is declared as a bare array here and its entries are validated by
- * {@link parseSessionConfigMcpServers} — see that function for why the entries
- * cannot be an element schema.
- */
-export declare const SessionRequestConfigSchema: z.ZodMiniObject<{
-    model: z.ZodMiniString<string>;
-    system: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    prompt: z.ZodMiniUnion<readonly [z.ZodMiniString<string>, z.ZodMiniArray<z.ZodMiniString<string>>]>;
-    mcpServers: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniUnknown>>;
-    environment: z.ZodMiniOptional<z.ZodMiniUnknown>;
-    runtimeSize: z.ZodMiniOptional<z.ZodMiniUnknown>;
-    timeout: z.ZodMiniOptional<z.ZodMiniUnknown>;
-    metadata: z.ZodMiniOptional<z.ZodMiniUnknown>;
-}, z.core.$strict>;
-export type SessionRequestConfigWire = z.infer<typeof SessionRequestConfigSchema>;
-/**
- * Validate each MCP entry at its own indexed path, in order, and reject a
- * repeated name.
- *
- * A loop rather than `z.array(sessionConfigMcpServerSchema(...))` because each
- * entry's stdio rejection has to outrank that entry's own unknown-key error, and
- * inside a single parse it cannot: Zod raises `unrecognized_keys` during the
- * object body and `errorFromZod` ranks it ahead of everything else at the same
- * depth. Sequencing the stdio gate and the object parse per entry is what the
- * hand-written parser did, and it is the only place that precedence can be
- * expressed — see {@link import("./mcp-server.js").RemoteMcpShapeSchema}.
- */
-export declare function parseSessionConfigMcpServers(entries: readonly unknown[] | undefined, policy: McpWirePolicy): readonly SessionConfigMcpServer[] | undefined;
-/**
- * Drop the absent optional fields and restore the declared field order.
- *
- * Separate from the schema per D4 — see
- * {@link import("./asset-ref.js").normalizeAssetRef}. Named for the wire type it
- * consumes so it is not confused with the public
- * `normaliseSessionRequestConfig`, which is a different operation: that one
- * splits a parsed config into the non-secret submission and the secret
- * MCP-headers bundle.
- */
-export declare function normalizeSessionRequestConfigWire(wire: SessionRequestConfigWire, mcpServers: readonly SessionConfigMcpServer[] | undefined): SessionRequestConfig;
-/** Validate a session request config end to end, in the family's own words. */
-export declare function parseSessionRequestConfigWire(input: unknown, policy: McpWirePolicy): SessionRequestConfig;

package/dist/_contracts/schemas/session-request-config.js

@@ -1,134 +0,0 @@
-/**
- * Schema for the plain JSON `aex start --config <path>` accepts: the
- * credential-free session parameters the CLI folds into a normal `submit`.
- *
- * Every message this family raises is prefixed with the words
- * `session request config` rather than a dotted path, because that is what a
- * user editing a `session.json` sees. The prefix is the schema's mount path, so
- * `wireObject`'s default `notObject` wording already reads correctly.
- */
-import * as z from "zod/mini";
-import { modelSlugSchema } from "./models.js";
-import { normalizeSessionConfigMcpServer, parseSessionConfigMcpServerWire } from "./mcp-server.js";
-import { parseWire, wireObject } from "./wire.js";
-const CONFIG = "session request config";
-/**
- * `environment`, `runtimeSize`, `timeout` and `metadata` are carried through
- * unvalidated ON PURPOSE: the BFF revalidates them via
- * `parseSessionSubmissionRequest`, and duplicating those parsers here would be a
- * second source of truth for the same rules. The CLI surfaces their structural
- * errors at submission time instead. They are untyped in the generated document
- * as a result — a known gap, not a described one.
- */
-const passthrough = z.optional(z.unknown());
-/**
- * The prompt ladder, stated once and reported for every rejected shape.
- *
- * The array case names the offending index, which the union's branch issues
- * cannot, so the wording is derived from the input here rather than attached to
- * the branches.
- */
-function promptMessage(value) {
-    if (typeof value === "string") {
-        return `${CONFIG} prompt must be a non-empty string`;
-    }
-    if (Array.isArray(value)) {
-        const index = value.findIndex((item) => typeof item !== "string" || item.length === 0);
-        return index === -1
-            ? `${CONFIG} prompt must be a non-empty string or array of strings`
-            : `${CONFIG} prompt[${index}] must be a non-empty string`;
-    }
-    return `${CONFIG} prompt must be a string or array of strings`;
-}
-/**
- * One turn, or an ordered list of them.
- *
- * Every branch check aborts. That is load-bearing: Zod surfaces a single
- * branch's issues when exactly one branch fails non-abortively, and the union's
- * own `error` only when they all abort (measured). Aborting throughout makes
- * {@link promptMessage} the reported wording in every case.
- */
-const prompt = z.union([
-    z.string().check(z.minLength(1, { abort: true })),
-    z.array(z.string().check(z.minLength(1, { abort: true }))).check(z.minLength(1, { abort: true }))
-], { error: (issue) => promptMessage(issue.input) });
-/**
- * Wire shape of a session request config. Declaration order is both the
- * permitted-key order and the order the field checks report in, matching the
- * sequential model/system/prompt/mcpServers ladder this replaces.
- *
- * `mcpServers` is declared as a bare array here and its entries are validated by
- * {@link parseSessionConfigMcpServers} — see that function for why the entries
- * cannot be an element schema.
- */
-export const SessionRequestConfigSchema = wireObject(CONFIG, {
-    model: modelSlugSchema(`${CONFIG} model`),
-    system: z.optional(z.string({ error: `${CONFIG} system, when provided, must be a string` })),
-    prompt,
-    mcpServers: z.optional(z.array(z.unknown(), { error: `${CONFIG} mcpServers must be an array` })),
-    environment: passthrough,
-    runtimeSize: passthrough,
-    timeout: passthrough,
-    metadata: passthrough
-}, { unknownKey: (path, key) => `${path} contains unexpected field: ${key}` });
-/**
- * Validate each MCP entry at its own indexed path, in order, and reject a
- * repeated name.
- *
- * A loop rather than `z.array(sessionConfigMcpServerSchema(...))` because each
- * entry's stdio rejection has to outrank that entry's own unknown-key error, and
- * inside a single parse it cannot: Zod raises `unrecognized_keys` during the
- * object body and `errorFromZod` ranks it ahead of everything else at the same
- * depth. Sequencing the stdio gate and the object parse per entry is what the
- * hand-written parser did, and it is the only place that precedence can be
- * expressed — see {@link import("./mcp-server.js").RemoteMcpShapeSchema}.
- */
-export function parseSessionConfigMcpServers(entries, policy) {
-    if (entries === undefined) {
-        return undefined;
-    }
-    const seen = new Set();
-    return entries.map((item, index) => {
-        const entry = normalizeSessionConfigMcpServer(parseSessionConfigMcpServerWire(item, `${CONFIG} mcpServers[${index}]`, policy));
-        if (seen.has(entry.name)) {
-            throw new Error(`${CONFIG} mcpServers duplicate name: ${entry.name}`);
-        }
-        seen.add(entry.name);
-        return entry;
-    });
-}
-/**
- * Drop the absent optional fields and restore the declared field order.
- *
- * Separate from the schema per D4 — see
- * {@link import("./asset-ref.js").normalizeAssetRef}. Named for the wire type it
- * consumes so it is not confused with the public
- * `normaliseSessionRequestConfig`, which is a different operation: that one
- * splits a parsed config into the non-secret submission and the secret
- * MCP-headers bundle.
- */
-export function normalizeSessionRequestConfigWire(wire, mcpServers) {
-    return {
-        model: wire.model,
-        ...(wire.system !== undefined ? { system: wire.system } : {}),
-        prompt: wire.prompt,
-        ...(mcpServers !== undefined ? { mcpServers } : {}),
-        ...(wire.environment !== undefined
-            ? { environment: wire.environment }
-            : {}),
-        ...(wire.runtimeSize !== undefined
-            ? { runtimeSize: wire.runtimeSize }
-            : {}),
-        ...(wire.timeout !== undefined
-            ? { timeout: wire.timeout }
-            : {}),
-        ...(wire.metadata !== undefined
-            ? { metadata: wire.metadata }
-            : {})
-    };
-}
-/** Validate a session request config end to end, in the family's own words. */
-export function parseSessionRequestConfigWire(input, policy) {
-    const wire = parseWire(SessionRequestConfigSchema, input);
-    return normalizeSessionRequestConfigWire(wire, parseSessionConfigMcpServers(wire.mcpServers, policy));
-}

package/dist/_contracts/schemas/session-webhook.d.ts

@@ -1,11 +0,0 @@
-/**
- * Schema for the per-session run-callback registration.
- *
- * Submit-time shape gate only. Delivery-time re-resolution and IP-deny checks
- * live server-side; this rejects the URLs that must never reach that stage.
- */
-import * as z from "zod/mini";
-/** Wire shape of `webhook` on a session submission request. */
-export declare const SessionWebhookSchema: z.ZodMiniObject<{
-    url: z.ZodMiniString<string>;
-}, z.core.$strict>;

package/dist/_contracts/schemas/session-webhook.js

@@ -1,38 +0,0 @@
-/**
- * Schema for the per-session run-callback registration.
- *
- * Submit-time shape gate only. Delivery-time re-resolution and IP-deny checks
- * live server-side; this rejects the URLs that must never reach that stage.
- */
-import * as z from "zod/mini";
-import { wireObject } from "./wire.js";
-function toUrl(value) {
-    try {
-        return new URL(value);
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * An https callback URL with no userinfo — credentials must not ride in a URL
- * the platform stores and later replays.
- *
- * Each check aborts so the reported failure is the first one a reader would
- * hit, matching the sequential `new URL()` / protocol / userinfo ladder this
- * replaces.
- */
-const callbackUrl = z
-    .string({ error: "webhook.url must be a non-empty string" })
-    .check(z.minLength(1, { error: "webhook.url must be a non-empty string", abort: true }), z.refine((value) => toUrl(value) !== undefined, {
-    error: (issue) => `webhook.url must be a valid absolute URL (got ${JSON.stringify(issue.input)})`,
-    abort: true
-}), z.refine((value) => toUrl(value)?.protocol === "https:", {
-    error: (issue) => `webhook.url must use https (got ${toUrl(issue.input)?.protocol.replace(/:$/, "") ?? ""})`,
-    abort: true
-}), z.refine((value) => {
-    const url = toUrl(value);
-    return url?.username === "" && url.password === "";
-}, { error: "webhook.url must not contain userinfo (user:pass@host)", abort: true }));
-/** Wire shape of `webhook` on a session submission request. */
-export const SessionWebhookSchema = wireObject("webhook", { url: callbackUrl });

package/dist/_contracts/schemas/side-effect-audit.d.ts

@@ -1,98 +0,0 @@
-/**
- * Schemas for the side-effect audit metadata envelope.
- *
- * Audit records are published to consumers that must never see request bodies,
- * raw URLs, or identity, so the envelope is a closed set of containers rather
- * than free-form metadata. These schemas are that closed set: the shape of each
- * one *is* the supported field list it rejects against.
- *
- * Two rules keep the schemas honest about what they do not cover:
- *
- * - **The public-safety scan stays outside.** It raises
- *   `SideEffectAuditRedactionError`, a typed error carrying `findings` that
- *   callers catch by class, which a schema cannot produce. `../side-effect-audit.ts`
- *   scans the whole payload before parsing it and again after building it.
- * - **`counts` and `timestamps` are described as opaque here.** Their keys come
- *   from `SIDE_EFFECT_AUDIT_COUNT_NAMES` / `…_TIMESTAMP_NAMES`, which are
- *   already the single source of that list; importing them would close an
- *   import cycle, and their entries are still checked by the normalisers that
- *   own those lists.
- */
-import * as z from "zod/mini";
-/** Wire shape of `metadata.status`. */
-export declare const SideEffectAuditStatusMetadataSchema: z.ZodMiniObject<{
-    status: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    statusCode: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-    errorClass: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    denialReason: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    followUpRequired: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
-}, z.core.$strict>;
-/** Wire shape of `metadata.dimensions`. */
-export declare const SideEffectAuditDimensionsMetadataSchema: z.ZodMiniObject<{
-    provider: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    namespace: z.ZodMiniOptional<z.ZodMiniEnum<{
-        metadata: "metadata";
-        files: "files";
-        archive: "archive";
-        events: "events";
-        logs: "logs";
-    }>>;
-    method: z.ZodMiniOptional<z.ZodMiniEnum<{
-        GET: "GET";
-        POST: "POST";
-        PATCH: "PATCH";
-        DELETE: "DELETE";
-        PUT: "PUT";
-    }>>;
-    surface: z.ZodMiniOptional<z.ZodMiniString<string>>;
-}, z.core.$strict>;
-/**
- * Wire shape of `metadata` on a deletion action.
- *
- * Deletion audits are the record of data going away and are read after the
- * session they describe no longer exists, so they carry no `dimensions`: the
- * provider, namespace, method, and surface of the call are exactly the detail a
- * deletion record must not preserve. The full envelope below adds that
- * container back rather than either shape restating the shared three.
- */
-export declare const SideEffectAuditDeletionMetadataSchema: z.ZodMiniObject<{
-    status: z.ZodMiniOptional<z.ZodMiniObject<{
-        status: z.ZodMiniOptional<z.ZodMiniString<string>>;
-        statusCode: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-        errorClass: z.ZodMiniOptional<z.ZodMiniString<string>>;
-        denialReason: z.ZodMiniOptional<z.ZodMiniString<string>>;
-        followUpRequired: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
-    }, z.core.$strict>>;
-    counts: z.ZodMiniOptional<z.ZodMiniUnknown>;
-    timestamps: z.ZodMiniOptional<z.ZodMiniUnknown>;
-}, z.core.$strict>;
-/** Wire shape of `metadata` on every other action. */
-export declare const SideEffectAuditMetadataSchema: z.ZodMiniObject<{
-    dimensions: z.ZodMiniOptional<z.ZodMiniObject<{
-        provider: z.ZodMiniOptional<z.ZodMiniString<string>>;
-        namespace: z.ZodMiniOptional<z.ZodMiniEnum<{
-            metadata: "metadata";
-            files: "files";
-            archive: "archive";
-            events: "events";
-            logs: "logs";
-        }>>;
-        method: z.ZodMiniOptional<z.ZodMiniEnum<{
-            GET: "GET";
-            POST: "POST";
-            PATCH: "PATCH";
-            DELETE: "DELETE";
-            PUT: "PUT";
-        }>>;
-        surface: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    }, z.core.$strict>>;
-    status: z.ZodMiniOptional<z.ZodMiniObject<{
-        status: z.ZodMiniOptional<z.ZodMiniString<string>>;
-        statusCode: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-        errorClass: z.ZodMiniOptional<z.ZodMiniString<string>>;
-        denialReason: z.ZodMiniOptional<z.ZodMiniString<string>>;
-        followUpRequired: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
-    }, z.core.$strict>>;
-    counts: z.ZodMiniOptional<z.ZodMiniUnknown>;
-    timestamps: z.ZodMiniOptional<z.ZodMiniUnknown>;
-}, z.core.$strict>;

package/dist/_contracts/schemas/side-effect-audit.js

@@ -1,102 +0,0 @@
-/**
- * Schemas for the side-effect audit metadata envelope.
- *
- * Audit records are published to consumers that must never see request bodies,
- * raw URLs, or identity, so the envelope is a closed set of containers rather
- * than free-form metadata. These schemas are that closed set: the shape of each
- * one *is* the supported field list it rejects against.
- *
- * Two rules keep the schemas honest about what they do not cover:
- *
- * - **The public-safety scan stays outside.** It raises
- *   `SideEffectAuditRedactionError`, a typed error carrying `findings` that
- *   callers catch by class, which a schema cannot produce. `../side-effect-audit.ts`
- *   scans the whole payload before parsing it and again after building it.
- * - **`counts` and `timestamps` are described as opaque here.** Their keys come
- *   from `SIDE_EFFECT_AUDIT_COUNT_NAMES` / `…_TIMESTAMP_NAMES`, which are
- *   already the single source of that list; importing them would close an
- *   import cycle, and their entries are still checked by the normalisers that
- *   own those lists.
- */
-import * as z from "zod/mini";
-import { wireObject } from "./wire.js";
-/**
- * This family words both of its own diagnostics the same way — an unsupported
- * container key and an unsupported nested key read identically, which is what
- * lets one text object serve every level of the envelope.
- */
-const auditText = {
-    notObject: (path) => `side-effect audit ${path} must be an object`,
-    unknownKey: (path, key) => `side-effect audit ${path}.${key} is not supported`
-};
-/**
- * A metadata string. Emptiness is NOT checked here: a falsy value is dropped by
- * the normaliser rather than rejected, and this schema must not turn that drop
- * into a failure. The "non-empty" wording is retained because it is the message
- * `assertSafeMetadataString` raises for the whitespace-only case that survives
- * to the normaliser.
- */
-function metadataString(path) {
-    return z.string({ error: `side-effect audit ${path} must be a non-empty string` });
-}
-/** A non-negative safe integer, worded as this family words it. */
-function nonNegativeSafeInt(path) {
-    const message = `side-effect audit ${path} must be a non-negative safe integer`;
-    return z
-        .number({ error: message })
-        .check(z.refine((value) => Number.isSafeInteger(value) && value >= 0, {
-        error: message,
-        abort: true
-    }));
-}
-/**
- * A closed value set, reported in the same `<what> <value> is not supported`
- * form the action, outcome, and principal-type checks already use.
- */
-function auditEnum(path, values) {
-    return z.enum(values, {
-        error: (issue) => `side-effect audit ${path} ${String(issue.input)} is not supported`
-    });
-}
-/** Wire shape of `metadata.status`. */
-export const SideEffectAuditStatusMetadataSchema = wireObject("metadata.status", {
-    status: z.optional(metadataString("metadata.status.status")),
-    statusCode: z.optional(nonNegativeSafeInt("metadata.status.statusCode")),
-    errorClass: z.optional(metadataString("metadata.status.errorClass")),
-    denialReason: z.optional(metadataString("metadata.status.denialReason")),
-    followUpRequired: z.optional(z.boolean({ error: "side-effect audit metadata.status.followUpRequired must be a boolean" }))
-}, auditText);
-/** Wire shape of `metadata.dimensions`. */
-export const SideEffectAuditDimensionsMetadataSchema = wireObject("metadata.dimensions", {
-    provider: z.optional(metadataString("metadata.dimensions.provider")),
-    namespace: z.optional(auditEnum("metadata.dimensions.namespace", [
-        "metadata",
-        "events",
-        "logs",
-        "files",
-        "archive"
-    ])),
-    method: z.optional(auditEnum("metadata.dimensions.method", ["GET", "POST", "PUT", "PATCH", "DELETE"])),
-    surface: z.optional(metadataString("metadata.dimensions.surface"))
-}, auditText);
-/** The containers every audit action may carry. */
-const undimensionedMetadataShape = {
-    status: z.optional(SideEffectAuditStatusMetadataSchema),
-    counts: z.optional(z.unknown()),
-    timestamps: z.optional(z.unknown())
-};
-/**
- * Wire shape of `metadata` on a deletion action.
- *
- * Deletion audits are the record of data going away and are read after the
- * session they describe no longer exists, so they carry no `dimensions`: the
- * provider, namespace, method, and surface of the call are exactly the detail a
- * deletion record must not preserve. The full envelope below adds that
- * container back rather than either shape restating the shared three.
- */
-export const SideEffectAuditDeletionMetadataSchema = wireObject("metadata", undimensionedMetadataShape, auditText);
-/** Wire shape of `metadata` on every other action. */
-export const SideEffectAuditMetadataSchema = wireObject("metadata", {
-    ...undimensionedMetadataShape,
-    dimensions: z.optional(SideEffectAuditDimensionsMetadataSchema)
-}, auditText);