@party-stack/foundry-ontology 0.18.1 → 0.20.0

package/lib/adapter/subsetFilter.js

@@ -0,0 +1,105 @@
+import { convertLikeFilter } from "./likeFilter.js";
+import { isField } from "@party-stack/ontology-storage/tables";
+//#region src/adapter/subsetFilter.ts
+const scalar = (value) => value instanceof Date ? value.toISOString() : typeof value === "object" && value !== null && "toString" in value ? value.toString() : value;
+/** Conservative candidate filtering shared by HTTP reads and WebSocket watches.
+* Unsupported terms broaden membership, including unverified negation semantics.
+* Sort/limit/cursors stay local so watches include future window entrants.
+*/
+function translate(predicate, recurse = translate) {
+	if (predicate.op === "and" || predicate.op === "or") {
+		const children = predicate.predicates.map((child) => recurse(child));
+		if (predicate.op === "or" && children.some((child) => !child)) return;
+		const supported = children.filter((child) => child !== void 0);
+		if (!supported.length) return;
+		return {
+			type: predicate.op,
+			value: supported
+		};
+	}
+	if (predicate.op === "not" || predicate.op === "ne") return;
+	if (predicate.op === "like" || predicate.op === "ilike") {
+		if (!isField(predicate.left) || predicate.left.path.length !== 1 || typeof predicate.right !== "string") return;
+		return convertLikeFilter([...predicate.left.path], predicate.right, true).query;
+	}
+	if (predicate.op === "contains") {
+		if (predicate.left.path.length !== 1 || isField(predicate.right) || predicate.right == null || typeof predicate.right === "bigint") return;
+		return {
+			type: "contains",
+			field: predicate.left.path[0],
+			value: scalar(predicate.right)
+		};
+	}
+	let left = predicate.left;
+	if (predicate.op === "in") {
+		if (!isField(left) || left.path.length !== 1 || predicate.values.some((value) => value == null || typeof value === "bigint")) return;
+		return {
+			type: "in",
+			field: left.path[0],
+			value: predicate.values.map(scalar)
+		};
+	}
+	let right = predicate.right;
+	let operation = predicate.op;
+	if (isField(right) && !isField(left)) {
+		[left, right] = [right, left];
+		operation = {
+			eq: "eq",
+			gt: "lt",
+			gte: "lte",
+			lt: "gt",
+			lte: "gte"
+		}[operation];
+	}
+	if (!isField(left) || isField(right) || left.path.length !== 1 || right == null || typeof right === "bigint") return;
+	const query = {
+		type: operation,
+		field: left.path[0],
+		value: scalar(right)
+	};
+	return operation === "eq" ? query : {
+		type: "or",
+		value: [query, {
+			type: "isNull",
+			field: left.path[0],
+			value: true
+		}]
+	};
+}
+const subsetFilter = (predicate) => predicate ? translate(predicate) : void 0;
+/** Report effective placement, including supported OR branches that could not safely be sent. */
+function analyzeSubsetFilter(predicate) {
+	const translated = /* @__PURE__ */ new Map();
+	const visit = (predicate) => {
+		const query = translate(predicate, visit);
+		translated.set(predicate, query);
+		return query;
+	};
+	const query = predicate ? visit(predicate) : void 0;
+	const predicates = [];
+	const report = (predicate, path, allowed) => {
+		const sent = allowed && translated.get(predicate) !== void 0;
+		if (predicate.op === "and" || predicate.op === "or") predicate.predicates.forEach((child, index) => report(child, [...path, index], sent));
+		else if (predicate.op === "not") report(predicate.predicate, [...path, 0], false);
+		else predicates.push({
+			path,
+			execution: !sent ? "adapter" : [
+				"like",
+				"ilike",
+				"gt",
+				"gte",
+				"lt",
+				"lte"
+			].includes(predicate.op) ? "candidate" : "source"
+		});
+	};
+	if (predicate) report(predicate, [], true);
+	return {
+		query,
+		predicates
+	};
+}
+//#endregion
+export { analyzeSubsetFilter, subsetFilter };
+
+//# sourceMappingURL=subsetFilter.js.map

package/lib/adapter/subsetFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subsetFilter.js","names":[],"sources":["../../src/adapter/subsetFilter.ts"],"sourcesContent":["import { isField } from \"@party-stack/ontology-storage/tables\";\nimport { convertLikeFilter } from \"./likeFilter.js\";\nimport type { SearchJsonQueryV2 } from \"@osdk/foundry.ontologies\";\nimport type { SourceQueryPlan } from \"@party-stack/ontology-backend\";\nimport type { Predicate, Scalar } from \"@party-stack/ontology-storage\";\n\nconst scalar = (value: Scalar): unknown =>\n    value instanceof Date\n        ? value.toISOString()\n        : typeof value === \"object\" && value !== null && \"toString\" in value\n          ? value.toString()\n          : value;\n\n/** Conservative candidate filtering shared by HTTP reads and WebSocket watches.\n * Unsupported terms broaden membership, including unverified negation semantics.\n * Sort/limit/cursors stay local so watches include future window entrants.\n */\nfunction translate(\n    predicate: Predicate,\n    recurse: (predicate: Predicate) => SearchJsonQueryV2 | undefined = translate\n): SearchJsonQueryV2 | undefined {\n    if (predicate.op === \"and\" || predicate.op === \"or\") {\n        const children = predicate.predicates.map((child) => recurse(child));\n        if (predicate.op === \"or\" && children.some((child) => !child)) return;\n        const supported = children.filter((child): child is SearchJsonQueryV2 => child !== undefined);\n        if (!supported.length) return;\n        return { type: predicate.op, value: supported };\n    }\n    if (predicate.op === \"not\" || predicate.op === \"ne\") return;\n    if (predicate.op === \"like\" || predicate.op === \"ilike\") {\n        if (\n            !isField(predicate.left) ||\n            predicate.left.path.length !== 1 ||\n            typeof predicate.right !== \"string\"\n        )\n            return;\n        // Portable LIKE follows TanStack's literal-backslash semantics. Foundry\n        // may overfetch; exact storage evaluation still precedes pagination.\n        return convertLikeFilter([...predicate.left.path], predicate.right, true).query;\n    }\n    if (predicate.op === \"contains\") {\n        if (\n            predicate.left.path.length !== 1 ||\n            isField(predicate.right) ||\n            predicate.right == null ||\n            typeof predicate.right === \"bigint\"\n        )\n            return;\n        return { type: \"contains\", field: predicate.left.path[0]!, value: scalar(predicate.right) };\n    }\n    let left = predicate.left;\n    if (predicate.op === \"in\") {\n        if (\n            !isField(left) ||\n            left.path.length !== 1 ||\n            predicate.values.some((value) => value == null || typeof value === \"bigint\")\n        )\n            return;\n        return { type: \"in\", field: left.path[0]!, value: predicate.values.map(scalar) };\n    }\n    let right = predicate.right;\n    let operation = predicate.op;\n    if (isField(right) && !isField(left)) {\n        [left, right] = [right, left];\n        operation = { eq: \"eq\", gt: \"lt\", gte: \"lte\", lt: \"gt\", lte: \"gte\" }[operation] as typeof operation;\n    }\n    if (\n        !isField(left) ||\n        isField(right) ||\n        left.path.length !== 1 ||\n        right == null ||\n        typeof right === \"bigint\"\n    )\n        return;\n    const query: SearchJsonQueryV2 = { type: operation, field: left.path[0]!, value: scalar(right) };\n    // Storage has an explicit ordering for missing/nullish values; provider range\n    // filters need not share it. Including nulls preserves a candidate superset.\n    return operation === \"eq\"\n        ? query\n        : { type: \"or\", value: [query, { type: \"isNull\", field: left.path[0]!, value: true }] };\n}\n\nexport const subsetFilter = (predicate: Predicate | undefined): SearchJsonQueryV2 | undefined =>\n    predicate ? translate(predicate) : undefined;\n\n/** Report effective placement, including supported OR branches that could not safely be sent. */\nexport function analyzeSubsetFilter(predicate: Predicate | undefined) {\n    const translated = new Map<Predicate, SearchJsonQueryV2 | undefined>();\n    const visit = (predicate: Predicate): SearchJsonQueryV2 | undefined => {\n        const query = translate(predicate, visit);\n        translated.set(predicate, query);\n        return query;\n    };\n    const query = predicate ? visit(predicate) : undefined;\n    const predicates: SourceQueryPlan[\"predicates\"][number][] = [];\n    const report = (predicate: Predicate, path: readonly number[], allowed: boolean): void => {\n        const sent = allowed && translated.get(predicate) !== undefined;\n        if (predicate.op === \"and\" || predicate.op === \"or\") {\n            predicate.predicates.forEach((child, index) => report(child, [...path, index], sent));\n        } else if (predicate.op === \"not\") {\n            report(predicate.predicate, [...path, 0], false);\n        } else {\n            predicates.push({\n                path,\n                execution: !sent\n                    ? \"adapter\"\n                    : [\"like\", \"ilike\", \"gt\", \"gte\", \"lt\", \"lte\"].includes(predicate.op)\n                      ? \"candidate\"\n                      : \"source\",\n            });\n        }\n    };\n    if (predicate) report(predicate, [], true);\n    return { query, predicates };\n}\n"],"mappings":";;;AAMA,MAAM,UAAU,UACZ,iBAAiB,OACX,MAAM,YAAY,IAClB,OAAO,UAAU,YAAY,UAAU,QAAQ,cAAc,QAC3D,MAAM,SAAS,IACf;;;;;AAMZ,SAAS,UACL,WACA,UAAmE,WACtC;CAC7B,IAAI,UAAU,OAAO,SAAS,UAAU,OAAO,MAAM;EACjD,MAAM,WAAW,UAAU,WAAW,KAAK,UAAU,QAAQ,KAAK,CAAC;EACnE,IAAI,UAAU,OAAO,QAAQ,SAAS,MAAM,UAAU,CAAC,KAAK,GAAG;EAC/D,MAAM,YAAY,SAAS,QAAQ,UAAsC,UAAU,KAAA,CAAS;EAC5F,IAAI,CAAC,UAAU,QAAQ;EACvB,OAAO;GAAE,MAAM,UAAU;GAAI,OAAO;EAAU;CAClD;CACA,IAAI,UAAU,OAAO,SAAS,UAAU,OAAO,MAAM;CACrD,IAAI,UAAU,OAAO,UAAU,UAAU,OAAO,SAAS;EACrD,IACI,CAAC,QAAQ,UAAU,IAAI,KACvB,UAAU,KAAK,KAAK,WAAW,KAC/B,OAAO,UAAU,UAAU,UAE3B;EAGJ,OAAO,kBAAkB,CAAC,GAAG,UAAU,KAAK,IAAI,GAAG,UAAU,OAAO,IAAI,CAAC,CAAC;CAC9E;CACA,IAAI,UAAU,OAAO,YAAY;EAC7B,IACI,UAAU,KAAK,KAAK,WAAW,KAC/B,QAAQ,UAAU,KAAK,KACvB,UAAU,SAAS,QACnB,OAAO,UAAU,UAAU,UAE3B;EACJ,OAAO;GAAE,MAAM;GAAY,OAAO,UAAU,KAAK,KAAK;GAAK,OAAO,OAAO,UAAU,KAAK;EAAE;CAC9F;CACA,IAAI,OAAO,UAAU;CACrB,IAAI,UAAU,OAAO,MAAM;EACvB,IACI,CAAC,QAAQ,IAAI,KACb,KAAK,KAAK,WAAW,KACrB,UAAU,OAAO,MAAM,UAAU,SAAS,QAAQ,OAAO,UAAU,QAAQ,GAE3E;EACJ,OAAO;GAAE,MAAM;GAAM,OAAO,KAAK,KAAK;GAAK,OAAO,UAAU,OAAO,IAAI,MAAM;EAAE;CACnF;CACA,IAAI,QAAQ,UAAU;CACtB,IAAI,YAAY,UAAU;CAC1B,IAAI,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,GAAG;EAClC,CAAC,MAAM,SAAS,CAAC,OAAO,IAAI;EAC5B,YAAY;GAAE,IAAI;GAAM,IAAI;GAAM,KAAK;GAAO,IAAI;GAAM,KAAK;EAAM,EAAE;CACzE;CACA,IACI,CAAC,QAAQ,IAAI,KACb,QAAQ,KAAK,KACb,KAAK,KAAK,WAAW,KACrB,SAAS,QACT,OAAO,UAAU,UAEjB;CACJ,MAAM,QAA2B;EAAE,MAAM;EAAW,OAAO,KAAK,KAAK;EAAK,OAAO,OAAO,KAAK;CAAE;CAG/F,OAAO,cAAc,OACf,QACA;EAAE,MAAM;EAAM,OAAO,CAAC,OAAO;GAAE,MAAM;GAAU,OAAO,KAAK,KAAK;GAAK,OAAO;EAAK,CAAC;CAAE;AAC9F;AAEA,MAAa,gBAAgB,cACzB,YAAY,UAAU,SAAS,IAAI,KAAA;;AAGvC,SAAgB,oBAAoB,WAAkC;CAClE,MAAM,6BAAa,IAAI,IAA8C;CACrE,MAAM,SAAS,cAAwD;EACnE,MAAM,QAAQ,UAAU,WAAW,KAAK;EACxC,WAAW,IAAI,WAAW,KAAK;EAC/B,OAAO;CACX;CACA,MAAM,QAAQ,YAAY,MAAM,SAAS,IAAI,KAAA;CAC7C,MAAM,aAAsD,CAAC;CAC7D,MAAM,UAAU,WAAsB,MAAyB,YAA2B;EACtF,MAAM,OAAO,WAAW,WAAW,IAAI,SAAS,MAAM,KAAA;EACtD,IAAI,UAAU,OAAO,SAAS,UAAU,OAAO,MAC3C,UAAU,WAAW,SAAS,OAAO,UAAU,OAAO,OAAO,CAAC,GAAG,MAAM,KAAK,GAAG,IAAI,CAAC;OACjF,IAAI,UAAU,OAAO,OACxB,OAAO,UAAU,WAAW,CAAC,GAAG,MAAM,CAAC,GAAG,KAAK;OAE/C,WAAW,KAAK;GACZ;GACA,WAAW,CAAC,OACN,YACA;IAAC;IAAQ;IAAS;IAAM;IAAO;IAAM;GAAK,CAAC,CAAC,SAAS,UAAU,EAAE,IAC/D,cACA;EACZ,CAAC;CAET;CACA,IAAI,WAAW,OAAO,WAAW,CAAC,GAAG,IAAI;CACzC,OAAO;EAAE;EAAO;CAAW;AAC/B"}

package/lib/adapter/uploads.d.ts

@@ -0,0 +1,25 @@
+import { OntologyClient } from "@party-stack/foundry-client";
+import { ByteInput } from "@party-stack/ontology-storage/blobs";
+//#region src/adapter/uploads.d.ts
+export declare function uploadFoundryMedia(client: OntologyClient, input: ByteInput, options: {
+  filename: string;
+  signal?: AbortSignal;
+}): Promise<{
+  readonly mimeType: string;
+  readonly reference: {
+    readonly type: "mediaSetViewItem";
+    readonly mediaSetViewItem: {
+      readonly mediaSetRid: string;
+      readonly mediaSetViewRid: string;
+      readonly mediaItemRid: string;
+      readonly token?: string | undefined;
+    };
+  };
+}>;
+export declare function uploadFoundryAttachment(client: OntologyClient, input: ByteInput, options: {
+  filename: string;
+  rid?: string;
+  signal?: AbortSignal;
+}): Promise<import("@osdk/foundry.ontologies").AttachmentV2>;
+//#endregion
+//# sourceMappingURL=uploads.d.ts.map

package/lib/adapter/uploads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploads.d.ts","names":[],"sources":["../../src/adapter/uploads.ts"],"mappings":";;;wBAsEsB,mBAClB,QAAQ,gBACR,OAAO,WACP;EAAW;EAAkB,SAAS;IAAa;;;;;;;;;;;;wBAgBjC,wBAClB,QAAQ,gBACR,OAAO,WACP;EAAW;EAAkB;EAAc,SAAS;IAAa,2CAAA"}

package/lib/adapter/uploads.js

@@ -0,0 +1,78 @@
+import { Effect, Schema, Stream } from "effect";
+import { Attachments } from "@osdk/foundry.ontologies";
+import { byteChunks, collectByteBlob } from "@party-stack/ontology-storage/blobs";
+//#region src/adapter/uploads.ts
+const MediaReference = Schema.Struct({
+	mimeType: Schema.String,
+	reference: Schema.Struct({
+		type: Schema.Literal("mediaSetViewItem"),
+		mediaSetViewItem: Schema.Struct({
+			mediaSetRid: Schema.String,
+			mediaSetViewRid: Schema.String,
+			mediaItemRid: Schema.String,
+			token: Schema.optional(Schema.String)
+		})
+	})
+});
+const ApiFailure = Schema.Struct({
+	errorName: Schema.optional(Schema.String),
+	errorCode: Schema.optional(Schema.String),
+	errorInstanceId: Schema.optional(Schema.String),
+	parameters: Schema.optional(Schema.Unknown)
+});
+/** The generated SDK only accepts Blob and JSON-encodes other bodies. Use the same authenticated fetch. */
+async function uploadBinary(client, input, options) {
+	const url = new URL(options.path, client.baseUrl.endsWith("/") ? client.baseUrl : `${client.baseUrl}/`);
+	url.searchParams.set("filename", options.filename);
+	if (options.preview) url.searchParams.set("preview", "true");
+	const headers = new Headers({
+		"Content-Type": options.contentType,
+		Accept: "application/json"
+	});
+	const stream = input instanceof Blob ? void 0 : Stream.toReadableStream(byteChunks(input));
+	const body = input instanceof Blob ? input : stream;
+	const init = {
+		method: options.method,
+		headers,
+		body,
+		...stream ? { duplex: "half" } : {},
+		signal: options.signal
+	};
+	try {
+		const response = await client.fetch(url, init);
+		if (!response.ok) {
+			const details = Schema.decodeUnknownOption(ApiFailure)(await response.json().catch(() => void 0));
+			throw Object.assign(/* @__PURE__ */ new Error("Foundry upload failed."), details._tag === "Some" ? details.value : {}, { statusCode: response.status });
+		}
+		return await response.json();
+	} finally {
+		if (stream && !stream.locked) await stream.cancel().catch(() => void 0);
+	}
+}
+async function uploadFoundryMedia(client, input, options) {
+	return Schema.decodeUnknownSync(MediaReference)(await uploadBinary(client, input, {
+		...options,
+		path: "api/v2/mediasets/media/upload",
+		method: "PUT",
+		contentType: "application/octet-stream"
+	}));
+}
+async function uploadFoundryAttachment(client, input, options) {
+	const blob = input instanceof Blob ? input : await Effect.runPromise(collectByteBlob(input), { signal: options.signal });
+	const signal = options.signal;
+	const uploadClient = signal ? {
+		...client,
+		fetch: (input, init) => client.fetch(input, {
+			...init,
+			signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal
+		})
+	} : client;
+	return options.rid ? Attachments.uploadWithRid(uploadClient, options.rid, blob, {
+		filename: options.filename,
+		preview: true
+	}) : Attachments.upload(uploadClient, blob, { filename: options.filename });
+}
+//#endregion
+export { uploadFoundryAttachment, uploadFoundryMedia };
+
+//# sourceMappingURL=uploads.js.map

package/lib/adapter/uploads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploads.js","names":[],"sources":["../../src/adapter/uploads.ts"],"sourcesContent":["import { Attachments } from \"@osdk/foundry.ontologies\";\nimport { byteChunks, collectByteBlob, type ByteInput } from \"@party-stack/ontology-storage/blobs\";\nimport { Effect, Schema, Stream } from \"effect\";\nimport type { OntologyClient } from \"@party-stack/foundry-client\";\n\nconst MediaReference = Schema.Struct({\n    mimeType: Schema.String,\n    reference: Schema.Struct({\n        type: Schema.Literal(\"mediaSetViewItem\"),\n        mediaSetViewItem: Schema.Struct({\n            mediaSetRid: Schema.String,\n            mediaSetViewRid: Schema.String,\n            mediaItemRid: Schema.String,\n            token: Schema.optional(Schema.String),\n        }),\n    }),\n});\nconst ApiFailure = Schema.Struct({\n    errorName: Schema.optional(Schema.String),\n    errorCode: Schema.optional(Schema.String),\n    errorInstanceId: Schema.optional(Schema.String),\n    parameters: Schema.optional(Schema.Unknown),\n});\n\n/** The generated SDK only accepts Blob and JSON-encodes other bodies. Use the same authenticated fetch. */\nasync function uploadBinary(\n    client: OntologyClient,\n    input: ByteInput,\n    options: {\n        path: string;\n        method: \"POST\" | \"PUT\";\n        filename: string;\n        contentType: string;\n        preview?: boolean;\n        signal?: AbortSignal;\n    }\n): Promise<unknown> {\n    const url = new URL(options.path, client.baseUrl.endsWith(\"/\") ? client.baseUrl : `${client.baseUrl}/`);\n    url.searchParams.set(\"filename\", options.filename);\n    if (options.preview) url.searchParams.set(\"preview\", \"true\");\n    const headers = new Headers({ \"Content-Type\": options.contentType, Accept: \"application/json\" });\n    const stream = input instanceof Blob ? undefined : Stream.toReadableStream(byteChunks(input));\n    const body = input instanceof Blob ? input : stream!;\n    const init: RequestInit & { duplex?: \"half\" } = {\n        method: options.method,\n        headers,\n        body,\n        ...(stream ? { duplex: \"half\" as const } : {}),\n        signal: options.signal,\n    };\n    try {\n        const response = await client.fetch(url, init);\n        if (!response.ok) {\n            const details = Schema.decodeUnknownOption(ApiFailure)(\n                await response.json().catch(() => undefined)\n            );\n            throw Object.assign(\n                new Error(\"Foundry upload failed.\"),\n                details._tag === \"Some\" ? details.value : {},\n                {\n                    statusCode: response.status,\n                }\n            );\n        }\n        return await response.json();\n    } finally {\n        if (stream && !stream.locked) await stream.cancel().catch(() => undefined);\n    }\n}\n\nexport async function uploadFoundryMedia(\n    client: OntologyClient,\n    input: ByteInput,\n    options: { filename: string; signal?: AbortSignal }\n) {\n    // Live browser/SharedWorker smoke test (2026-11-02): this endpoint accepted\n    // a ReadableStream with application/octet-stream and no Content-Length (200).\n    // Keep streaming here: the ordinary attachment endpoint behaved differently.\n    // See specs/2026-10-19-effect-tables-replica/blob-future-work.md for the controls.\n    return Schema.decodeUnknownSync(MediaReference)(\n        await uploadBinary(client, input, {\n            ...options,\n            path: \"api/v2/mediasets/media/upload\",\n            method: \"PUT\",\n            contentType: \"application/octet-stream\",\n        })\n    );\n}\n\nexport async function uploadFoundryAttachment(\n    client: OntologyClient,\n    input: ByteInput,\n    options: { filename: string; rid?: string; signal?: AbortSignal }\n) {\n    // Live browser/SharedWorker smoke test (2026-11-02): streamed bodies failed\n    // with 400 Default:InvalidArgument for both octet-stream and PNG Content-Type;\n    // Blob and SDK controls succeeded. Media uploads above accepted streaming.\n    // The docs do not state a length requirement, so revisit with a provider test.\n    // For now use the SDK's Blob path, materializing only at this boundary within\n    // collectByteBlob's size limit. Browser fetch forbids setting Content-Length\n    // manually. Do not add a Blob/File capability to storage or RPC for this fix.\n    const blob =\n        input instanceof Blob\n            ? input\n            : await Effect.runPromise(collectByteBlob(input), { signal: options.signal });\n    const signal = options.signal;\n    const uploadClient = signal\n        ? {\n              ...client,\n              fetch: (input: RequestInfo | URL, init?: RequestInit) =>\n                  client.fetch(input, {\n                      ...init,\n                      signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal,\n                  }),\n          }\n        : client;\n    return options.rid\n        ? Attachments.uploadWithRid(uploadClient, options.rid, blob, {\n              filename: options.filename,\n              preview: true,\n          })\n        : Attachments.upload(uploadClient, blob, { filename: options.filename });\n}\n"],"mappings":";;;;AAKA,MAAM,iBAAiB,OAAO,OAAO;CACjC,UAAU,OAAO;CACjB,WAAW,OAAO,OAAO;EACrB,MAAM,OAAO,QAAQ,kBAAkB;EACvC,kBAAkB,OAAO,OAAO;GAC5B,aAAa,OAAO;GACpB,iBAAiB,OAAO;GACxB,cAAc,OAAO;GACrB,OAAO,OAAO,SAAS,OAAO,MAAM;EACxC,CAAC;CACL,CAAC;AACL,CAAC;AACD,MAAM,aAAa,OAAO,OAAO;CAC7B,WAAW,OAAO,SAAS,OAAO,MAAM;CACxC,WAAW,OAAO,SAAS,OAAO,MAAM;CACxC,iBAAiB,OAAO,SAAS,OAAO,MAAM;CAC9C,YAAY,OAAO,SAAS,OAAO,OAAO;AAC9C,CAAC;;AAGD,eAAe,aACX,QACA,OACA,SAQgB;CAChB,MAAM,MAAM,IAAI,IAAI,QAAQ,MAAM,OAAO,QAAQ,SAAS,GAAG,IAAI,OAAO,UAAU,GAAG,OAAO,QAAQ,EAAE;CACtG,IAAI,aAAa,IAAI,YAAY,QAAQ,QAAQ;CACjD,IAAI,QAAQ,SAAS,IAAI,aAAa,IAAI,WAAW,MAAM;CAC3D,MAAM,UAAU,IAAI,QAAQ;EAAE,gBAAgB,QAAQ;EAAa,QAAQ;CAAmB,CAAC;CAC/F,MAAM,SAAS,iBAAiB,OAAO,KAAA,IAAY,OAAO,iBAAiB,WAAW,KAAK,CAAC;CAC5F,MAAM,OAAO,iBAAiB,OAAO,QAAQ;CAC7C,MAAM,OAA0C;EAC5C,QAAQ,QAAQ;EAChB;EACA;EACA,GAAI,SAAS,EAAE,QAAQ,OAAgB,IAAI,CAAC;EAC5C,QAAQ,QAAQ;CACpB;CACA,IAAI;EACA,MAAM,WAAW,MAAM,OAAO,MAAM,KAAK,IAAI;EAC7C,IAAI,CAAC,SAAS,IAAI;GACd,MAAM,UAAU,OAAO,oBAAoB,UAAU,CAAC,CAClD,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS,CAC/C;GACA,MAAM,OAAO,uBACT,IAAI,MAAM,wBAAwB,GAClC,QAAQ,SAAS,SAAS,QAAQ,QAAQ,CAAC,GAC3C,EACI,YAAY,SAAS,OACzB,CACJ;EACJ;EACA,OAAO,MAAM,SAAS,KAAK;CAC/B,UAAU;EACN,IAAI,UAAU,CAAC,OAAO,QAAQ,MAAM,OAAO,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;CAC7E;AACJ;AAEA,eAAsB,mBAClB,QACA,OACA,SACF;CAKE,OAAO,OAAO,kBAAkB,cAAc,CAAC,CAC3C,MAAM,aAAa,QAAQ,OAAO;EAC9B,GAAG;EACH,MAAM;EACN,QAAQ;EACR,aAAa;CACjB,CAAC,CACL;AACJ;AAEA,eAAsB,wBAClB,QACA,OACA,SACF;CAQE,MAAM,OACF,iBAAiB,OACX,QACA,MAAM,OAAO,WAAW,gBAAgB,KAAK,GAAG,EAAE,QAAQ,QAAQ,OAAO,CAAC;CACpF,MAAM,SAAS,QAAQ;CACvB,MAAM,eAAe,SACf;EACI,GAAG;EACH,QAAQ,OAA0B,SAC9B,OAAO,MAAM,OAAO;GAChB,GAAG;GACH,QAAQ,MAAM,SAAS,YAAY,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI;EACpE,CAAC;CACT,IACA;CACN,OAAO,QAAQ,MACT,YAAY,cAAc,cAAc,QAAQ,KAAK,MAAM;EACvD,UAAU,QAAQ;EAClB,SAAS;CACb,CAAC,IACD,YAAY,OAAO,cAAc,MAAM,EAAE,UAAU,QAAQ,SAAS,CAAC;AAC/E"}

package/lib/backend.d.ts

@@ -0,0 +1,80 @@
+import { FoundryUsersIntegration } from "./adapter/makeFoundryOntologyBackend.js";
+import { FoundryOAuthConnectionOptions } from "./connectionOptions.js";
+import { makeFoundryServiceConnector } from "./serviceConnector.js";
+import { ConnectionEgress } from "@party-stack/connect";
+import { Effect } from "effect";
+import { OntologyIR } from "@party-stack/ontology-spec";
+//#region src/backend.d.ts
+/** Use the selected Connect egress; credentials remain at its authority. */
+export declare const makeFoundryConnectionClient: (options: {
+  baseUrl: string;
+  ontologyId: string;
+  egress: ConnectionEgress;
+}) => Effect.Effect<import("@party-stack/foundry-client").OntologyClient, never, import("effect/Scope").Scope>;
+export declare const makeFoundryBackend: (options: {
+  baseUrl: string;
+  ontologyId: string;
+  egress: ConnectionEgress;
+  ir: OntologyIR;
+  context: Record<string, unknown>;
+  users?: FoundryUsersIntegration;
+  watch?: boolean;
+}) => Effect.Effect<{
+  name: string;
+  sourceId: string;
+  supportsIdempotency: boolean;
+  maintenance?: Effect.Effect<void, import("@party-stack/ontology-backend").BackendError>;
+  loadSubset: (subset: import("@party-stack/ontology-spec/query").ObjectSubset) => Effect.Effect<import("@party-stack/ontology-backend").BackendSnapshot, import("@party-stack/ontology-backend").BackendError>;
+  query: (document: import("@party-stack/ontology-spec").QueryDocument, options?: {
+    readonly inputs?: Record<string, unknown>;
+  }) => Effect.Effect<Record<string, unknown>, import("@party-stack/ontology-backend").BackendError>;
+  subscribeSelection?: (selection: import("@party-stack/ontology-backend").ObjectSelection, policy?: import("@party-stack/ontology-backend/delivery").DeliveryPolicy, resume?: import("@party-stack/ontology-backend/delivery").DeliveryPosition) => Effect.Effect<import("@party-stack/ontology-backend/delivery").DeliverySubscription, import("@party-stack/ontology-backend").BackendError, import("effect/Scope").Scope>;
+  acknowledgeDelivery?: (position: import("@party-stack/ontology-backend/delivery").DeliveryPosition) => Effect.Effect<void, import("@party-stack/ontology-backend").BackendError>;
+  resolveActionParameters?: (name: string, parameters: Record<string, unknown>) => Effect.Effect<Record<string, unknown>, import("@party-stack/ontology-backend").BackendError>;
+  watchSubset?: (subset: import("@party-stack/ontology-spec/query").ObjectSubset) => Effect.Effect<import("effect/Stream").Stream<import("@party-stack/ontology-backend").SubsetWatchEvent, import("@party-stack/ontology-backend").BackendError>, import("@party-stack/ontology-backend").BackendError, import("effect/Scope").Scope> | undefined;
+  refresh?: (subset: import("@party-stack/ontology-spec/query").ObjectSubset) => {
+    readonly pollIntervalMs?: number | false;
+    readonly maxCoverageAgeMs?: number;
+  } | undefined;
+  applyAction: (invocation: import("@party-stack/ontology-backend").ActionRequest) => Effect.Effect<import("@party-stack/ontology-backend").ActionReceipt, import("@party-stack/ontology-backend").BackendError>;
+  queryFunction: (name: string, parameters: Record<string, unknown>) => Effect.Effect<unknown, import("@party-stack/ontology-backend").BackendError>;
+  changes?: {
+    readonly pull: (options: {
+      readonly cursor?: string;
+      readonly limit?: number;
+    }) => Effect.Effect<import("@party-stack/ontology-backend").BackendChangePage, import("@party-stack/ontology-backend").BackendError>;
+    readonly watch?: Effect.Effect<import("effect/Stream").Stream<void, import("@party-stack/ontology-backend").BackendError>, import("@party-stack/ontology-backend").BackendError, import("effect/Scope").Scope>;
+  };
+  attachments?: import("@party-stack/ontology-backend").BackendAttachments;
+  encrypted?: import("@party-stack/ontology-backend").BackendEncryptedValues;
+  validateAction: (name: string, parameters: Record<string, unknown>, settings?: {
+    readonly knownParameters?: readonly string[];
+  }) => Effect.Effect<{
+    readonly certain: false;
+  } | {
+    readonly certain: true;
+    readonly value: {
+      readonly kind: "ok";
+      readonly value: void;
+    } | {
+      readonly kind: "err";
+      readonly value: readonly {
+        readonly message: string;
+        readonly path?: readonly (string | number)[] | undefined;
+        readonly code?: string | undefined;
+        readonly category?: "custom" | "input" | "reference" | undefined;
+        readonly source?: "parameter" | "submission" | "user-facing" | undefined;
+        readonly messageSource?: "configured" | "standard" | undefined;
+      }[];
+    };
+  }, import("@party-stack/ontology-backend").BackendError<"Conflict" | "Forbidden" | "HistoryExpired" | "Internal" | "InvalidConfiguration" | "InvalidRequest" | "InvalidResponse" | "NotFound" | "NotImplemented" | "RateLimited" | "ResultExpired" | "SchemaMismatch" | "SessionExpired" | "SessionReplaced" | "SourceMismatch" | "Unauthenticated" | "Unavailable" | "ValidationFailed" | "ViewReplaced">, never>;
+}, import("@party-stack/ontology-backend").BackendError<"Conflict" | "Forbidden" | "HistoryExpired" | "Internal" | "InvalidConfiguration" | "InvalidRequest" | "InvalidResponse" | "NotFound" | "NotImplemented" | "RateLimited" | "ResultExpired" | "SchemaMismatch" | "SessionExpired" | "SessionReplaced" | "SourceMismatch" | "Unauthenticated" | "Unavailable" | "ValidationFailed" | "ViewReplaced">, import("effect/Scope").Scope>;
+export declare const makeFoundryMetadataBackend: (options: {
+  baseUrl: string;
+  ontologyId: string;
+  egress: ConnectionEgress;
+  refetchInterval?: number | false;
+}) => Effect.Effect<import("@party-stack/ontology-backend").OntologyBackendService, never, import("effect/Scope").Scope>;
+//#endregion
+export { type FoundryOAuthConnectionOptions, makeFoundryServiceConnector };
+//# sourceMappingURL=backend.d.ts.map

package/lib/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","names":[],"sources":["../src/backend.ts"],"mappings":";;;;;;;;qBAYa,8BAA2B;EAC3B;EACG;EACJ,QAAA;MASV,OAAA,6CAAA,8CAAA;qBACW,qBAAkB;EAClB;EACG;EACJ,QAAA;EACJ,IAAA;EACK,SAAA;EACD,QAAA;EACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CAOV,wXAAA;qBACW,6BAA0B;EAC1B;EACG;EACJ,QAAA;EACU;MAMpB,OAAA,+CAAA,sDAAA"}

package/lib/backend.js

@@ -0,0 +1,34 @@
+import { makeFoundryOntologyBackend } from "./adapter/makeFoundryOntologyBackend.js";
+import { makeFoundryMetadataBackend as makeFoundryMetadataBackend$1 } from "./meta/backend.js";
+import { makeFoundryServiceConnector } from "./serviceConnector.js";
+import { toWebEgress } from "@party-stack/connect";
+import { createOntologyClient } from "@party-stack/foundry-client";
+import { Effect } from "effect";
+//#region src/backend.ts
+/** Use the selected Connect egress; credentials remain at its authority. */
+const makeFoundryConnectionClient = Effect.fnUntraced(function* (options) {
+	const web = yield* toWebEgress(options.egress);
+	return createOntologyClient({
+		baseUrl: options.baseUrl,
+		ontologyRid: options.ontologyId,
+		fetch: web.fetch,
+		createWebSocket: web.createWebSocket
+	});
+});
+const makeFoundryBackend = Effect.fnUntraced(function* (options) {
+	return yield* makeFoundryOntologyBackend({
+		...options,
+		client: yield* makeFoundryConnectionClient(options),
+		context: options.context
+	});
+});
+const makeFoundryMetadataBackend = Effect.fnUntraced(function* (options) {
+	return makeFoundryMetadataBackend$1({
+		client: yield* makeFoundryConnectionClient(options),
+		refetchInterval: options.refetchInterval
+	});
+});
+//#endregion
+export { makeFoundryBackend, makeFoundryConnectionClient, makeFoundryMetadataBackend, makeFoundryServiceConnector };
+
+//# sourceMappingURL=backend.js.map

package/lib/backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.js","names":["makeMetadataBackend"],"sources":["../src/backend.ts"],"sourcesContent":["import { toWebEgress } from \"@party-stack/connect\";\nimport { createOntologyClient } from \"@party-stack/foundry-client\";\nimport { Effect } from \"effect\";\nimport { makeFoundryOntologyBackend } from \"./adapter/makeFoundryOntologyBackend.js\";\nimport { makeFoundryMetadataBackend as makeMetadataBackend } from \"./meta/backend.js\";\nimport type { FoundryUsersIntegration } from \"./adapter/makeFoundryOntologyBackend.js\";\nimport type { ConnectionEgress } from \"@party-stack/connect\";\nimport type { OntologyIR } from \"@party-stack/ontology-spec\";\n\nexport type { FoundryOAuthConnectionOptions } from \"./connectionOptions.js\";\n\n/** Use the selected Connect egress; credentials remain at its authority. */\nexport const makeFoundryConnectionClient = Effect.fnUntraced(function* (options: {\n    baseUrl: string;\n    ontologyId: string;\n    egress: ConnectionEgress;\n}) {\n    const web = yield* toWebEgress(options.egress);\n    return createOntologyClient({\n        baseUrl: options.baseUrl,\n        ontologyRid: options.ontologyId,\n        fetch: web.fetch,\n        createWebSocket: web.createWebSocket,\n    });\n});\nexport const makeFoundryBackend = Effect.fnUntraced(function* (options: {\n    baseUrl: string;\n    ontologyId: string;\n    egress: ConnectionEgress;\n    ir: OntologyIR;\n    context: Record<string, unknown>;\n    users?: FoundryUsersIntegration;\n    watch?: boolean;\n}) {\n    return yield* makeFoundryOntologyBackend({\n        ...options,\n        client: yield* makeFoundryConnectionClient(options),\n        context: options.context,\n    });\n});\nexport const makeFoundryMetadataBackend = Effect.fnUntraced(function* (options: {\n    baseUrl: string;\n    ontologyId: string;\n    egress: ConnectionEgress;\n    refetchInterval?: number | false;\n}) {\n    return makeMetadataBackend({\n        client: yield* makeFoundryConnectionClient(options),\n        refetchInterval: options.refetchInterval,\n    });\n});\n\nexport { makeFoundryServiceConnector } from \"./serviceConnector.js\";\n"],"mappings":";;;;;;;;AAYA,MAAa,8BAA8B,OAAO,WAAW,WAAW,SAIrE;CACC,MAAM,MAAM,OAAO,YAAY,QAAQ,MAAM;CAC7C,OAAO,qBAAqB;EACxB,SAAS,QAAQ;EACjB,aAAa,QAAQ;EACrB,OAAO,IAAI;EACX,iBAAiB,IAAI;CACzB,CAAC;AACL,CAAC;AACD,MAAa,qBAAqB,OAAO,WAAW,WAAW,SAQ5D;CACC,OAAO,OAAO,2BAA2B;EACrC,GAAG;EACH,QAAQ,OAAO,4BAA4B,OAAO;EAClD,SAAS,QAAQ;CACrB,CAAC;AACL,CAAC;AACD,MAAa,6BAA6B,OAAO,WAAW,WAAW,SAKpE;CACC,OAAOA,6BAAoB;EACvB,QAAQ,OAAO,4BAA4B,OAAO;EAClD,iBAAiB,QAAQ;CAC7B,CAAC;AACL,CAAC"}

package/lib/config/index.d.ts

@@ -1,24 +1,20 @@
-import { FoundryAttachmentConstraintOverride } from "./applyAttachmentConstraintOverrides.js";
-import { FoundryAuthenticationClient, FoundryOAuthConnectionOptions } from "../connection.js";
-import { Lens, OntologyPullConfig, OntologyPullSource } from "@party-stack/ontology";
+import { FoundryOAuthConnectionOptions } from "../connectionOptions.js";
+import { Effect } from "effect";
+import { Runtimes } from "@party-stack/runtime";
+import { OntologyPullConfig } from "@party-stack/ontology-backend/meta";
 //#region src/config/index.d.ts
 export interface FoundryOntologyPullConnectionOptions {
   oauth?: FoundryOAuthConnectionOptions;
   token?: string;
   userId?: string;
 }
-export interface CreateFoundryOntologyPullSourceOptions {
+export interface FoundryPullBackendOptions {
   baseUrl: string;
   ontologyRid: string;
   connection: FoundryOntologyPullConnectionOptions;
-  attachmentConstraints?: FoundryAttachmentConstraintOverride[];
-  users?: {
-    objectType: string;
-    lens: Lens;
-  };
 }
-export declare function createFoundryOntologyPullSource(options: CreateFoundryOntologyPullSourceOptions): OntologyPullSource<FoundryAuthenticationClient>;
-export type FoundryOntologyPullConfig = OntologyPullConfig<FoundryAuthenticationClient>;
+/** Acquire an authenticated metadata backend for the duration of the pull. */
+export declare const makeFoundryPullBackend: (options: FoundryPullBackendOptions) => Effect.Effect<import("@party-stack/ontology-backend").OntologyBackendService, import("@party-stack/ontology-backend").BackendError<"Conflict" | "Forbidden" | "HistoryExpired" | "Internal" | "InvalidConfiguration" | "InvalidRequest" | "InvalidResponse" | "NotFound" | "NotImplemented" | "RateLimited" | "ResultExpired" | "SchemaMismatch" | "SessionExpired" | "SessionReplaced" | "SourceMismatch" | "Unauthenticated" | "Unavailable" | "ValidationFailed" | "ViewReplaced">, Runtimes | import("effect/Scope").Scope>;
+export type FoundryOntologyPullConfig = OntologyPullConfig<Runtimes>;
 //#endregion
-export type { FoundryAttachmentConstraintOverride };
 //# sourceMappingURL=index.d.ts.map

package/lib/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/config/index.ts"],"mappings":";;;;iBA4BiB;EACb,QAAQ;EACR;EACA;;iBAGa;EACb;EACA;EACA,YAAY;EACZ,wBAAwB;EACxB;IACI;IACA,MAAM;;;wBA4BE,gCACZ,SAAS,yCACV,mBAAmB;YAiEV,4BAA4B,mBAAmB"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/config/index.ts"],"mappings":";;;;;iBAgBiB;EACb,QAAQ;EACR;EACA;;iBAGa;EACb;EACA;EACA,YAAY;;;qBAIH,yBAAsB,SAAA,8BAAA,OAAA,+CAAA,gEAAA,iWAAA,kCAAA;YAmDvB,4BAA4B,mBAAmB"}

package/lib/config/index.js

@@ -1,7 +1,9 @@
-import { createFoundryBackendInstallation, createFoundryOntologyRoute } from "../installation/createFoundryBackendInstallation.js";
-import { applyAttachmentConstraintOverrides } from "./applyAttachmentConstraintOverrides.js";
-import { createFoundryUserObjectType } from "../users/foundryUser.js";
-import { o } from "@party-stack/ontology";
+import { makeFoundryServiceConnector } from "../serviceConnector.js";
+import { makeFoundryMetadataBackend } from "../backend.js";
+import { acquireConfiguredConnection, makeConnectManager } from "@party-stack/connect";
+import { Effect } from "effect";
+import { classifyBackendFailure } from "@party-stack/ontology-backend";
+import { Runtime, Runtimes } from "@party-stack/runtime";
 //#region src/config/index.ts
 const DEFAULT_FOUNDRY_SCOPES = [
 	"api:use-ontologies-read",
@@ -9,55 +11,50 @@ const DEFAULT_FOUNDRY_SCOPES = [
 	"ontology:view-unredacted-action-type",
 	"ontology:view-object-type"
 ];
-function addConfiguredUser(ontology, users) {
-	if (!users) return ontology;
-	const userObjectType = createFoundryUserObjectType(users.objectType, users.lens);
-	return {
-		...ontology,
-		objectTypes: [...ontology.objectTypes.filter((objectType) => objectType.name !== users.objectType), userObjectType],
-		contextType: o.struct({ fields: [{
-			name: "user",
-			displayName: "User",
-			type: o.objectReference({ objectType: users.objectType })
-		}] })
-	};
-}
-function createFoundryOntologyPullSource(options) {
-	return {
+/** Acquire an authenticated metadata backend for the duration of the pull. */
+const makeFoundryPullBackend = Effect.fn("Foundry.makePullBackend")(function* (options) {
+	const scopes = options.connection.oauth?.scopes ?? DEFAULT_FOUNDRY_SCOPES;
+	const oauth = options.connection.oauth;
+	const identity = `foundry:${options.baseUrl}:${oauth?.clientId ?? "api-key"}:${[...scopes].sort().join(",")}`;
+	const runtimes = yield* Runtimes;
+	const runtime = yield* runtimes.acquire({
+		owner: "connect",
+		namespace: identity
+	}).pipe(Effect.mapError((cause) => classifyBackendFailure("pull.runtime", cause)));
+	const manager = yield* makeConnectManager({ services: [{
+		connector: makeFoundryServiceConnector({ fetch: oauth?.fetch }),
+		instances: [{
+			id: options.baseUrl,
+			title: "Foundry",
+			instanceUrl: options.baseUrl,
+			OAuthApplications: oauth ? [{
+				id: oauth.clientId,
+				title: "Foundry",
+				clientId: oauth.clientId,
+				scopes,
+				redirectUrl: oauth.redirectUrl,
+				flow: "authorization-code"
+			}] : []
+		}]
+	}] }).pipe(Effect.provideService(Runtime, runtime));
+	const access = yield* acquireConfiguredConnection({
+		manager,
+		serviceInstanceId: options.baseUrl,
+		userId: options.connection.userId,
+		apiKey: options.connection.token,
+		oauth: oauth ? {
+			applicationId: oauth.clientId,
+			redirectUrl: oauth.redirectUrl
+		} : void 0,
+		browserAuthentication: runtimes.browserAuthentication ?? runtime.browserAuthentication
+	});
+	return yield* makeFoundryMetadataBackend({
+		baseUrl: options.baseUrl,
 		ontologyId: options.ontologyRid,
-		createInstallation: ({ runtime }) => {
-			const scopes = options.connection.oauth?.scopes ?? DEFAULT_FOUNDRY_SCOPES;
-			return createFoundryBackendInstallation({
-				installationId: `foundry-pull:${options.baseUrl}:${options.ontologyRid}:${[...scopes].sort().join(",")}`,
-				baseUrl: options.baseUrl,
-				runtime,
-				connections: {
-					token: options.connection.token,
-					oauth: options.connection.oauth ? {
-						...options.connection.oauth,
-						scopes
-					} : void 0
-				},
-				routes: [createFoundryOntologyRoute({ ontologyId: options.ontologyRid })]
-			});
-		},
-		async resolveConnection(installation) {
-			const configuredUserId = options.connection.userId;
-			const activeConnections = [...installation.connections.values()].filter((connection) => connection.state.status === "active").map((connection) => ({
-				userId: connection.userId,
-				state: connection.state
-			}));
-			if (!options.connection.token && !configuredUserId && activeConnections.length > 1) throw new Error("Multiple Foundry users are signed in for this project. Set connection.userId in the ontology pull source.");
-			let connection = options.connection.token ? await installation.authentication.signIn.apiToken() : configuredUserId ? activeConnections.find((candidate) => candidate.userId === configuredUserId) : activeConnections[0];
-			if (!connection && options.connection.oauth) connection = await installation.authentication.signIn.oauth();
-			if (!connection) throw new Error("Foundry ontology pull requires connection.oauth or connection.token.");
-			if (configuredUserId && connection.userId !== configuredUserId) throw new Error(`Foundry signed in as "${connection.userId}", but connection.userId is "${configuredUserId}".`);
-			return connection;
-		},
-		transformPulledOntology: (ontology) => addConfiguredUser(applyAttachmentConstraintOverrides(ontology, options.attachmentConstraints ?? []), options.users)
-	};
-}
+		egress: access.egress
+	});
+});
 //#endregion
-export { createFoundryOntologyPullSource };
+export { makeFoundryPullBackend };
 
 //# sourceMappingURL=index.js.map

package/lib/config/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/config/index.ts"],"sourcesContent":["import {\n    o,\n    type Lens,\n    type OntologyPullSource,\n    type OntologyPullConfig,\n    type OntologyIR,\n} from \"@party-stack/ontology\";\nimport { type FoundryAuthenticationClient, type FoundryOAuthConnectionOptions } from \"../connection.js\";\nimport {\n    createFoundryBackendInstallation,\n    createFoundryOntologyRoute,\n} from \"../installation/createFoundryBackendInstallation.js\";\nimport { createFoundryUserObjectType } from \"../users/foundryUser.js\";\nimport {\n    applyAttachmentConstraintOverrides,\n    type FoundryAttachmentConstraintOverride,\n} from \"./applyAttachmentConstraintOverrides.js\";\nimport type { Connection } from \"@party-stack/connections\";\n\nexport type { FoundryAttachmentConstraintOverride } from \"./applyAttachmentConstraintOverrides.js\";\n\nconst DEFAULT_FOUNDRY_SCOPES = [\n    \"api:use-ontologies-read\",\n    \"offline_access\",\n    \"ontology:view-unredacted-action-type\",\n    \"ontology:view-object-type\",\n];\n\nexport interface FoundryOntologyPullConnectionOptions {\n    oauth?: FoundryOAuthConnectionOptions;\n    token?: string;\n    userId?: string;\n}\n\nexport interface CreateFoundryOntologyPullSourceOptions {\n    baseUrl: string;\n    ontologyRid: string;\n    connection: FoundryOntologyPullConnectionOptions;\n    attachmentConstraints?: FoundryAttachmentConstraintOverride[];\n    users?: {\n        objectType: string;\n        lens: Lens;\n    };\n}\n\nfunction addConfiguredUser(\n    ontology: OntologyIR,\n    users: CreateFoundryOntologyPullSourceOptions[\"users\"]\n): OntologyIR {\n    if (!users) return ontology;\n    const userObjectType = createFoundryUserObjectType(users.objectType, users.lens);\n    return {\n        ...ontology,\n        objectTypes: [\n            ...ontology.objectTypes.filter((objectType) => objectType.name !== users.objectType),\n            userObjectType,\n        ],\n        contextType: o.struct({\n            fields: [\n                {\n                    name: \"user\",\n                    displayName: \"User\",\n                    type: o.objectReference({ objectType: users.objectType }),\n                },\n            ],\n        }),\n    };\n}\n\nexport function createFoundryOntologyPullSource(\n    options: CreateFoundryOntologyPullSourceOptions\n): OntologyPullSource<FoundryAuthenticationClient> {\n    return {\n        ontologyId: options.ontologyRid,\n        createInstallation: ({ runtime }) => {\n            const scopes = options.connection.oauth?.scopes ?? DEFAULT_FOUNDRY_SCOPES;\n            return createFoundryBackendInstallation({\n                installationId: `foundry-pull:${options.baseUrl}:${options.ontologyRid}:${[...scopes].sort().join(\",\")}`,\n                baseUrl: options.baseUrl,\n                runtime,\n                connections: {\n                    token: options.connection.token,\n                    oauth: options.connection.oauth\n                        ? {\n                              ...options.connection.oauth,\n                              scopes,\n                          }\n                        : undefined,\n                },\n                routes: [\n                    createFoundryOntologyRoute({\n                        ontologyId: options.ontologyRid,\n                    }),\n                ],\n            });\n        },\n        async resolveConnection(installation) {\n            const configuredUserId = options.connection.userId;\n            const activeConnections = [...installation.connections.values()]\n                .filter((connection) => connection.state.status === \"active\")\n                .map((connection): Connection<\"active\"> => ({\n                    userId: connection.userId,\n                    state: connection.state as Connection<\"active\">[\"state\"],\n                }));\n\n            if (!options.connection.token && !configuredUserId && activeConnections.length > 1) {\n                throw new Error(\n                    \"Multiple Foundry users are signed in for this project. Set connection.userId in the ontology pull source.\"\n                );\n            }\n            let connection = options.connection.token\n                ? await installation.authentication.signIn.apiToken()\n                : configuredUserId\n                  ? activeConnections.find((candidate) => candidate.userId === configuredUserId)\n                  : activeConnections[0];\n            if (!connection && options.connection.oauth) {\n                connection = await installation.authentication.signIn.oauth();\n            }\n            if (!connection) {\n                throw new Error(\"Foundry ontology pull requires connection.oauth or connection.token.\");\n            }\n            if (configuredUserId && connection.userId !== configuredUserId) {\n                throw new Error(\n                    `Foundry signed in as \"${connection.userId}\", but connection.userId is \"${configuredUserId}\".`\n                );\n            }\n            return connection;\n        },\n        transformPulledOntology: (ontology) =>\n            addConfiguredUser(\n                applyAttachmentConstraintOverrides(ontology, options.attachmentConstraints ?? []),\n                options.users\n            ),\n    };\n}\n\nexport type FoundryOntologyPullConfig = OntologyPullConfig<FoundryAuthenticationClient>;\n"],"mappings":";;;;;AAqBA,MAAM,yBAAyB;CAC3B;CACA;CACA;CACA;AACJ;AAmBA,SAAS,kBACL,UACA,OACU;CACV,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,iBAAiB,4BAA4B,MAAM,YAAY,MAAM,IAAI;CAC/E,OAAO;EACH,GAAG;EACH,aAAa,CACT,GAAG,SAAS,YAAY,QAAQ,eAAe,WAAW,SAAS,MAAM,UAAU,GACnF,cACJ;EACA,aAAa,EAAE,OAAO,EAClB,QAAQ,CACJ;GACI,MAAM;GACN,aAAa;GACb,MAAM,EAAE,gBAAgB,EAAE,YAAY,MAAM,WAAW,CAAC;EAC5D,CACJ,EACJ,CAAC;CACL;AACJ;AAEA,SAAgB,gCACZ,SAC+C;CAC/C,OAAO;EACH,YAAY,QAAQ;EACpB,qBAAqB,EAAE,cAAc;GACjC,MAAM,SAAS,QAAQ,WAAW,OAAO,UAAU;GACnD,OAAO,iCAAiC;IACpC,gBAAgB,gBAAgB,QAAQ,QAAQ,GAAG,QAAQ,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG;IACrG,SAAS,QAAQ;IACjB;IACA,aAAa;KACT,OAAO,QAAQ,WAAW;KAC1B,OAAO,QAAQ,WAAW,QACpB;MACI,GAAG,QAAQ,WAAW;MACtB;KACJ,IACA,KAAA;IACV;IACA,QAAQ,CACJ,2BAA2B,EACvB,YAAY,QAAQ,YACxB,CAAC,CACL;GACJ,CAAC;EACL;EACA,MAAM,kBAAkB,cAAc;GAClC,MAAM,mBAAmB,QAAQ,WAAW;GAC5C,MAAM,oBAAoB,CAAC,GAAG,aAAa,YAAY,OAAO,CAAC,CAAC,CAC3D,QAAQ,eAAe,WAAW,MAAM,WAAW,QAAQ,CAAC,CAC5D,KAAK,gBAAsC;IACxC,QAAQ,WAAW;IACnB,OAAO,WAAW;GACtB,EAAE;GAEN,IAAI,CAAC,QAAQ,WAAW,SAAS,CAAC,oBAAoB,kBAAkB,SAAS,GAC7E,MAAM,IAAI,MACN,2GACJ;GAEJ,IAAI,aAAa,QAAQ,WAAW,QAC9B,MAAM,aAAa,eAAe,OAAO,SAAS,IAClD,mBACE,kBAAkB,MAAM,cAAc,UAAU,WAAW,gBAAgB,IAC3E,kBAAkB;GAC1B,IAAI,CAAC,cAAc,QAAQ,WAAW,OAClC,aAAa,MAAM,aAAa,eAAe,OAAO,MAAM;GAEhE,IAAI,CAAC,YACD,MAAM,IAAI,MAAM,sEAAsE;GAE1F,IAAI,oBAAoB,WAAW,WAAW,kBAC1C,MAAM,IAAI,MACN,yBAAyB,WAAW,OAAO,+BAA+B,iBAAiB,GAC/F;GAEJ,OAAO;EACX;EACA,0BAA0B,aACtB,kBACI,mCAAmC,UAAU,QAAQ,yBAAyB,CAAC,CAAC,GAChF,QAAQ,KACZ;CACR;AACJ"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/config/index.ts"],"sourcesContent":["import { makeConnectManager, acquireConfiguredConnection } from \"@party-stack/connect\";\nimport { classifyBackendFailure } from \"@party-stack/ontology-backend\";\nimport { Runtimes, Runtime } from \"@party-stack/runtime\";\nimport { Effect } from \"effect\";\nimport { makeFoundryMetadataBackend } from \"../backend.js\";\nimport { makeFoundryServiceConnector } from \"../serviceConnector.js\";\nimport type { FoundryOAuthConnectionOptions } from \"../connectionOptions.js\";\nimport type { OntologyPullConfig } from \"@party-stack/ontology-backend/meta\";\n\nconst DEFAULT_FOUNDRY_SCOPES = [\n    \"api:use-ontologies-read\",\n    \"offline_access\",\n    \"ontology:view-unredacted-action-type\",\n    \"ontology:view-object-type\",\n];\n\nexport interface FoundryOntologyPullConnectionOptions {\n    oauth?: FoundryOAuthConnectionOptions;\n    token?: string;\n    userId?: string;\n}\n\nexport interface FoundryPullBackendOptions {\n    baseUrl: string;\n    ontologyRid: string;\n    connection: FoundryOntologyPullConnectionOptions;\n}\n\n/** Acquire an authenticated metadata backend for the duration of the pull. */\nexport const makeFoundryPullBackend = Effect.fn(\"Foundry.makePullBackend\")(function* (\n    options: FoundryPullBackendOptions\n) {\n    const scopes = options.connection.oauth?.scopes ?? DEFAULT_FOUNDRY_SCOPES;\n    const oauth = options.connection.oauth;\n    const identity = `foundry:${options.baseUrl}:${oauth?.clientId ?? \"api-key\"}:${[...scopes].sort().join(\",\")}`;\n    const runtimes = yield* Runtimes;\n    const runtime = yield* runtimes\n        .acquire({ owner: \"connect\", namespace: identity })\n        .pipe(Effect.mapError((cause) => classifyBackendFailure(\"pull.runtime\", cause)));\n    const manager = yield* makeConnectManager({\n        services: [\n            {\n                connector: makeFoundryServiceConnector({ fetch: oauth?.fetch }),\n                instances: [\n                    {\n                        id: options.baseUrl,\n                        title: \"Foundry\",\n                        instanceUrl: options.baseUrl,\n                        OAuthApplications: oauth\n                            ? [\n                                  {\n                                      id: oauth.clientId,\n                                      title: \"Foundry\",\n                                      clientId: oauth.clientId,\n                                      scopes,\n                                      redirectUrl: oauth.redirectUrl,\n                                      flow: \"authorization-code\",\n                                  },\n                              ]\n                            : [],\n                    },\n                ],\n            },\n        ],\n    }).pipe(Effect.provideService(Runtime, runtime));\n    const access = yield* acquireConfiguredConnection({\n        manager,\n        serviceInstanceId: options.baseUrl,\n        userId: options.connection.userId,\n        apiKey: options.connection.token,\n        oauth: oauth ? { applicationId: oauth.clientId, redirectUrl: oauth.redirectUrl } : undefined,\n        browserAuthentication: runtimes.browserAuthentication ?? runtime.browserAuthentication,\n    });\n    return yield* makeFoundryMetadataBackend({\n        baseUrl: options.baseUrl,\n        ontologyId: options.ontologyRid,\n        egress: access.egress,\n    });\n});\n\nexport type FoundryOntologyPullConfig = OntologyPullConfig<Runtimes>;\n"],"mappings":";;;;;;;AASA,MAAM,yBAAyB;CAC3B;CACA;CACA;CACA;AACJ;;AAeA,MAAa,yBAAyB,OAAO,GAAG,yBAAyB,CAAC,CAAC,WACvE,SACF;CACE,MAAM,SAAS,QAAQ,WAAW,OAAO,UAAU;CACnD,MAAM,QAAQ,QAAQ,WAAW;CACjC,MAAM,WAAW,WAAW,QAAQ,QAAQ,GAAG,OAAO,YAAY,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG;CAC1G,MAAM,WAAW,OAAO;CACxB,MAAM,UAAU,OAAO,SAClB,QAAQ;EAAE,OAAO;EAAW,WAAW;CAAS,CAAC,CAAC,CAClD,KAAK,OAAO,UAAU,UAAU,uBAAuB,gBAAgB,KAAK,CAAC,CAAC;CACnF,MAAM,UAAU,OAAO,mBAAmB,EACtC,UAAU,CACN;EACI,WAAW,4BAA4B,EAAE,OAAO,OAAO,MAAM,CAAC;EAC9D,WAAW,CACP;GACI,IAAI,QAAQ;GACZ,OAAO;GACP,aAAa,QAAQ;GACrB,mBAAmB,QACb,CACI;IACI,IAAI,MAAM;IACV,OAAO;IACP,UAAU,MAAM;IAChB;IACA,aAAa,MAAM;IACnB,MAAM;GACV,CACJ,IACA,CAAC;EACX,CACJ;CACJ,CACJ,EACJ,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,SAAS,OAAO,CAAC;CAC/C,MAAM,SAAS,OAAO,4BAA4B;EAC9C;EACA,mBAAmB,QAAQ;EAC3B,QAAQ,QAAQ,WAAW;EAC3B,QAAQ,QAAQ,WAAW;EAC3B,OAAO,QAAQ;GAAE,eAAe,MAAM;GAAU,aAAa,MAAM;EAAY,IAAI,KAAA;EACnF,uBAAuB,SAAS,yBAAyB,QAAQ;CACrE,CAAC;CACD,OAAO,OAAO,2BAA2B;EACrC,SAAS,QAAQ;EACjB,YAAY,QAAQ;EACpB,QAAQ,OAAO;CACnB,CAAC;AACL,CAAC"}

package/lib/connectionOptions.d.ts

@@ -0,0 +1,9 @@
+//#region src/connectionOptions.d.ts
+export interface FoundryOAuthConnectionOptions {
+  clientId: string;
+  redirectUrl: string;
+  scopes?: string[];
+  fetch?: typeof globalThis.fetch;
+}
+//#endregion
+//# sourceMappingURL=connectionOptions.d.ts.map

package/lib/connectionOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectionOptions.d.ts","names":[],"sources":["../src/connectionOptions.ts"],"mappings":";iBAAiB;EACb;EACA;EACA;EACA,eAAe,WAAW"}

package/lib/connectionOptions.js

@@ -0,0 +1 @@
+export {};

package/lib/context.d.ts

@@ -0,0 +1,21 @@
+//#region src/context.d.ts
+export declare const FOUNDRY_CURRENT_USER_CONTEXT_FIELD = "userId";
+/** Foundry's currentUser action argument is the authenticated provider subject ID. */
+export declare const foundryContext: {
+  type: {
+    kind: "struct";
+    value: {
+      readonly fields: [{
+        readonly name: "userId";
+        readonly displayName: "User ID";
+        readonly type: {
+          kind: "string";
+          value: {};
+        };
+      }];
+    };
+  };
+  partition: string[][];
+};
+//#endregion
+//# sourceMappingURL=context.d.ts.map

package/lib/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","names":[],"sources":["../src/context.ts"],"mappings":";qBAEa;;qBAGA"}