@sixb/core 0.0.1

package/dist/schedules/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/schedules/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3F,OAAO,KAAK,EACV,cAAc,EACd,wBAAwB,EACxB,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACzB,MAAM,eAAe,CAAA;AAEtB,OAAO,CAAC,MAAM,iBAAiB,EAAE,OAAO,MAAM,CAAA;AAE9C,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,8BAA8B,CAC7C,SAAS,SAAS,iBAAiB,CAAC,OAAO,CAAC,GAAG,iBAAiB;IAEhE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAA;CAC5C;AAED,MAAM,MAAM,yBAAyB,GACjC,6BAA6B,GAC7B,8BAA8B,CAAA;AAElC,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAU9E;AAED,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,MAAM,GAAG,OAAO;IAC/E,QAAQ,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;CAC5C;AAED,MAAM,MAAM,sBAAsB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG;IACjG,QAAQ,CAAC,OAAO,EAAE,6BAA6B,CAAA;CAChD,CAAA;AAED,MAAM,MAAM,uBAAuB,CACjC,GAAG,SAAS,MAAM,GAAG,MAAM,EAC3B,SAAS,SAAS,iBAAiB,CAAC,OAAO,CAAC,GAAG,iBAAiB,IAC9D,kBAAkB,CAAC,GAAG,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC,GAAG;IAChE,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAC,SAAS,CAAC,CAAA;CAC5D,CAAA;AAED,MAAM,MAAM,0BAA0B,CAAC,MAAM,GAAG,OAAO,IAAI,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IAC9F,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAA;CACjD,CAAA;AAED,MAAM,MAAM,kBAAkB,CAAC,SAAS,IAAI,SAAS,SAAS;IAC5D,QAAQ,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5C,GACG,WAAW,CAAC,MAAM,CAAC,GACnB,KAAK,CAAA;AAET,MAAM,WAAW,mBAAmB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC9D,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAA;CACvF;AAED,MAAM,WAAW,oBAAoB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC/D,EAAE,CAAC,KAAK,CAAC,SAAS,SAAS,iBAAiB,CAAC,OAAO,CAAC,EACnD,QAAQ,EAAE,SAAS,GAClB,0BAA0B,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;CAC9C;AAED,MAAM,WAAW,eAAe,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,CAC1D,SAAQ,mBAAmB,CAAC,GAAG,CAAC,EAC9B,oBAAoB,CAAC,GAAG,CAAC;CAAG;AAEhC,MAAM,MAAM,0BAA0B,CACpC,GAAG,SAAS,MAAM,EAClB,SAAS,SAAS,iBAAiB,CAAC,OAAO,CAAC,IAE5C,yBAAyB,CAAC,SAAS,CAAC,SAAS,0BAA0B,GAAG,wBAAwB,GAC9F,yBAAyB,CAAC,GAAG,EAAE,SAAS,CAAC,GACzC,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;AAE7C,MAAM,MAAM,yBAAyB,CACnC,GAAG,SAAS,MAAM,EAClB,SAAS,SAAS,iBAAiB,CAAC,OAAO,CAAC,IAC1C,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG;IAC5C,KAAK,CACH,SAAS,EAAE,CACT,KAAK,EAAE,6BAA6B,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,KACvE,sBAAsB,GAC1B,uBAAuB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;CAC3C,CAAA;AAED,MAAM,MAAM,2BAA2B,GAAG,cAAc,GAAG,YAAY,CAAA;AAEvE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,2BAA2B,CAAA;IAC3C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,4BAA4B,GAAG,sBAAsB,CAAA;AAEjE,MAAM,MAAM,6BAA6B,CAAC,QAAQ,IAChD,QAAQ,SAAS,0BAA0B,CAAC,MAAM,WAAW,CAAC,GAC1D;IAAE,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,WAAW,CAAC,CAAA;CAAE,GACrE,QAAQ,SAAS,wBAAwB,CAAC,MAAM,WAAW,EAAE,MAAM,KAAK,CAAC,GACvE;IACE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;IACpE,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC,KAAK,CAAC,CAAA;CAC5D,GACD,KAAK,CAAA;AAEb,MAAM,MAAM,mCAAmC,CAAC,WAAW,SAAS,oBAAoB,IACtF,6BAA6B,CAAC,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;AAEjE,MAAM,MAAM,iCAAiC,CAC3C,YAAY,SAAS,oBAAoB,EACzC,KAAK,SAAS,SAAS,IACrB,6BAA6B,CAAC,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAA;AAE1E,MAAM,MAAM,mCAAmC,CAAC,KAAK,SAAS,SAAS,IAAI;IACzE,EAAE,CACA,UAAU,EAAE,oBAAoB,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAA;KAAE,GAC7E,yBAAyB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;IAC1D,QAAQ,CAAC,EAAE,EAAE;QACX,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,yBAAyB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;KAC3E,CAAA;CACF,CAAA;AAED,MAAM,MAAM,6BAA6B,CACvC,MAAM,SAAS,2BAA2B,EAC1C,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,IAC3C;IACF,QAAQ,CAAC,CAAC,EAAE;QACV,QAAQ,EAAE,WAAW,IAAI,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,aAAa,CACjF,MAAM,EACN,MAAM,EACN,MAAM,SAAS,CAChB,GACG,qCAAqC,CAAC,MAAM,EAAE,SAAS,CAAC,GACxD,KAAK;KACV,CAAA;IACD,GAAG,CAAC,GAAG,UAAU,EAAE,sBAAsB,EAAE,GAAG,sBAAsB,CAAA;IACpE,GAAG,CAAC,GAAG,UAAU,EAAE,sBAAsB,EAAE,GAAG,sBAAsB,CAAA;IACpE,GAAG,CAAC,SAAS,EAAE,sBAAsB,GAAG,sBAAsB,CAAA;CAC/D,CAAA;AAED,MAAM,MAAM,qCAAqC,CAC/C,MAAM,SAAS,2BAA2B,GAAG,2BAA2B,EACxE,SAAS,SAAS,QAAQ,GAAG,QAAQ,IACnC,wBAAwB,CAAC,SAAS,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAA;AAE1E,MAAM,MAAM,yBAAyB,CACnC,MAAM,SAAS,2BAA2B,EAC1C,UAAU,SAAS,SAAS,GAAG,iBAAiB,IAC9C,sBAAsB,GAAG;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,8BAA8B,CAAC,SAAS,SAAS,QAAQ,IACnE,iBAAiB,CAAC,SAAS,CAAC,CAAA;AAE9B,MAAM,MAAM,yBAAyB,CAAC,SAAS,SAAS,QAAQ,IAC9D,wBAAwB,CAAC,SAAS,CAAC,CAAA;AAErC,KAAK,kBAAkB,CAAC,KAAK,SAAS,SAAS,IAC7C,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS,SAAS,QAAQ,EAAE,GAChE;IACE,QAAQ,EAAE,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,aAAa,CACxF,KAAK,CAAC,cAAc,CAAC,EACrB,CAAC,CAAC,IAAI,CAAC,EACP,CAAC,CACF;CACF,GACD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAE1B,KAAK,mBAAmB,CAAC,OAAO,IAAI,OAAO,SAAS,SAAS,MAAM,EAAE,GACjE,OAAO,CAAC,MAAM,CAAC,GACf,OAAO,SAAS,MAAM,GACpB,OAAO,GACP,MAAM,CAAA;AAEZ,KAAK,mBAAmB,CAAC,KAAK,SAAS,SAAS,IAC9C,GAAG,SAAS,mBAAmB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,GACxD,MAAM,GACN,mBAAmB,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAA"}

package/dist/schedules/validation.d.ts

@@ -0,0 +1,13 @@
+import type { OntologyRegistry } from "../ontology";
+import type { ScheduleDefinition } from "./types";
+export interface ValidateSchedulesAtStartupOptions {
+    readonly registeredRuleIds?: ReadonlySet<string>;
+    readonly registeredActionIds?: ReadonlySet<string>;
+    readonly registeredDatasetIds?: ReadonlySet<string>;
+    readonly registeredSyncIds?: ReadonlySet<string>;
+    readonly registeredPipelineIds?: ReadonlySet<string>;
+}
+export declare function assertScheduleDefinition(value: unknown, createError?: (message: string) => Error): asserts value is ScheduleDefinition;
+export declare function isScheduleDefinition(value: unknown): value is ScheduleDefinition;
+export declare function validateSchedulesAtStartup(schedules: readonly ScheduleDefinition[], ontology: OntologyRegistry, options?: ValidateSchedulesAtStartupOptions): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/schedules/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/schedules/validation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA0B,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAI3E,OAAO,KAAK,EAAmD,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAYlG,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAChD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAClD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAChD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACrD;AAgBD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,KAAyD,GAC1F,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAkCrC;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAOhF;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,SAAS,kBAAkB,EAAE,EACxC,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,iCAAsC,GAC9C,IAAI,CAkBN"}

package/dist/security/applications.d.ts

@@ -0,0 +1,15 @@
+/** Browser applications that can be protected by role grants. */
+export declare const applications: {
+    readonly atlas: {
+        readonly kind: "application";
+        readonly id: "atlas";
+        readonly label: "Atlas";
+    };
+    readonly app: {
+        readonly kind: "application";
+        readonly id: "app";
+        readonly label: "Custom app";
+    };
+};
+export declare const APPLICATION_IDS: ReadonlySet<string>;
+//# sourceMappingURL=applications.d.ts.map

package/dist/security/applications.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applications.d.ts","sourceRoot":"","sources":["../../src/security/applications.ts"],"names":[],"mappings":"AAEA,iEAAiE;AACjE,eAAO,MAAM,YAAY;;;;;;;;;;;CAG2C,CAAA;AAEpE,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAE/C,CAAA"}

package/dist/security/builders.d.ts

@@ -0,0 +1,20 @@
+import type { GrantDefinition, GroupDefinition, MembershipOperation, MembershipPolicyDefinition, RoleDefinition } from "./types";
+export interface DefineGroupOptions {
+    readonly label?: string;
+    readonly description?: string;
+}
+export interface DefineRoleOptions {
+    readonly label?: string;
+    readonly description?: string;
+    readonly grantedTo: readonly GroupDefinition[];
+    readonly grants: readonly GrantDefinition[];
+}
+export interface DefineMembershipPolicyOptions {
+    readonly grantedTo: readonly GroupDefinition[];
+    readonly scope: readonly GroupDefinition[];
+    readonly can: readonly MembershipOperation[];
+}
+export declare function defineGroup<const TId extends string>(id: TId, options?: DefineGroupOptions): GroupDefinition<TId>;
+export declare function defineRole<const TId extends string>(id: TId, options: DefineRoleOptions): RoleDefinition<TId>;
+export declare function defineMembershipPolicy<const TId extends string>(id: TId, options: DefineMembershipPolicyOptions): MembershipPolicyDefinition<TId>;
+//# sourceMappingURL=builders.d.ts.map

package/dist/security/builders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/security/builders.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACf,MAAM,SAAS,CAAA;AAQhB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAA;IAC9C,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;CAC5C;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAA;IAC9C,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAA;IAC1C,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAC7C;AAoCD,wBAAgB,WAAW,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EAClD,EAAE,EAAE,GAAG,EACP,OAAO,GAAE,kBAAuB,GAC/B,eAAe,CAAC,GAAG,CAAC,CAWtB;AAED,wBAAgB,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACjD,EAAE,EAAE,GAAG,EACP,OAAO,EAAE,iBAAiB,GACzB,cAAc,CAAC,GAAG,CAAC,CAwBrB;AAED,wBAAgB,sBAAsB,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EAC7D,EAAE,EAAE,GAAG,EACP,OAAO,EAAE,6BAA6B,GACrC,0BAA0B,CAAC,GAAG,CAAC,CAYjC"}

package/dist/security/errors.d.ts

@@ -0,0 +1,4 @@
+export declare class SecurityValidationError extends Error {
+    readonly name = "SecurityValidationError";
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/security/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/security/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,6BAA4B;CAC1C"}

package/dist/security/every.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Breadth selectors for role grants.
+ *
+ * `every.object()`, `every.action()`, and friends select a capability's whole registered universe;
+ * `.except([...])` removes specific definitions. They are plain data carrying no enforcement logic —
+ * `can.view/apply/run/access` turn them into grants, and the authorization engine expands them to
+ * concrete id sets at startup (after applying `except`).
+ *
+ * They live under one `every` namespace on purpose. Spending seven of the best identifiers in
+ * `@sixb/core` — `actions`, `workflows`, `syncs`, … — on an auxiliary subsystem collided with the
+ * primitives themselves and with `events.actions()` / `logs.actions()` on the client.
+ */
+import type { ActionDefinition } from "../actions/types";
+import type { AgentDefinition } from "../agents/types";
+import type { DatasetDefinition } from "../datasets";
+import type { ObjectType } from "../ontology";
+import type { PipelineDefinition } from "../pipelines";
+import type { SyncDefinition } from "../syncs";
+import type { WorkflowDefinition } from "../workflows/types";
+import type { ApplicationDefinition } from "./types";
+/** Capability targets a breadth selector can range over. */
+export declare const BREADTH_TARGETS: readonly ["object", "dataset", "action", "workflow", "sync", "pipeline", "agent", "application"];
+export type BreadthTarget = (typeof BREADTH_TARGETS)[number];
+interface BreadthTargetInput {
+    object: ObjectType;
+    dataset: DatasetDefinition;
+    action: ActionDefinition;
+    workflow: WorkflowDefinition;
+    sync: SyncDefinition;
+    pipeline: PipelineDefinition;
+    agent: AgentDefinition;
+    application: ApplicationDefinition;
+}
+/**
+ * An "all except" selection over a capability target. Branded by `target` so
+ * `can.view(every.action())` fails to typecheck.
+ */
+export interface BreadthSelector<TTarget extends BreadthTarget = BreadthTarget> {
+    readonly target: TTarget;
+    readonly selection: {
+        readonly all: true;
+        readonly except: readonly string[];
+    };
+    /** Exclude specific definitions from an otherwise-complete selection. */
+    except(items: readonly BreadthTargetInput[TTarget][]): BreadthSelector<TTarget>;
+}
+export declare function isBreadthSelector(value: unknown): value is BreadthSelector;
+export declare function definitionIdOf(item: {
+    readonly id?: unknown;
+}, label: string): string;
+/**
+ * The whole registered universe of one capability target.
+ *
+ * Singular by design: `every.action()` reads as a breadth, where `every.actions()` would just echo
+ * the primitive's plural name back.
+ */
+export declare const every: {
+    object: () => BreadthSelector<"object">;
+    dataset: () => BreadthSelector<"dataset">;
+    action: () => BreadthSelector<"action">;
+    workflow: () => BreadthSelector<"workflow">;
+    sync: () => BreadthSelector<"sync">;
+    pipeline: () => BreadthSelector<"pipeline">;
+    agent: () => BreadthSelector<"agent">;
+    application: () => BreadthSelector<"application">;
+};
+export {};
+//# sourceMappingURL=every.d.ts.map

package/dist/security/every.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"every.d.ts","sourceRoot":"","sources":["../../src/security/every.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AAEpD,4DAA4D;AAC5D,eAAO,MAAM,eAAe,kGASlB,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAA;AAE5D,UAAU,kBAAkB;IAC1B,MAAM,EAAE,UAAU,CAAA;IAClB,OAAO,EAAE,iBAAiB,CAAA;IAC1B,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,IAAI,EAAE,cAAc,CAAA;IACpB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,KAAK,EAAE,eAAe,CAAA;IACtB,WAAW,EAAE,qBAAqB,CAAA;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe,CAAC,OAAO,SAAS,aAAa,GAAG,aAAa;IAC5E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IAC9E,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,SAAS,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;CAChF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAQ1E;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKrF;AAkBD;;;;;GAKG;AACH,eAAO,MAAM,KAAK;kBACJ,eAAe,CAAC,QAAQ,CAAC;mBACxB,eAAe,CAAC,SAAS,CAAC;kBAC3B,eAAe,CAAC,QAAQ,CAAC;oBACvB,eAAe,CAAC,UAAU,CAAC;gBAC/B,eAAe,CAAC,MAAM,CAAC;oBACnB,eAAe,CAAC,UAAU,CAAC;iBAC9B,eAAe,CAAC,OAAO,CAAC;uBAClB,eAAe,CAAC,aAAa,CAAC;CAChD,CAAA"}

package/dist/security/grants.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Grant builders for role definitions.
+ *
+ * Grants are plain data referencing application and runtime definitions
+ * by id. They carry no enforcement logic — the authorization engine expands
+ * each grant's selection into per-principal id sets at startup, so runtime
+ * checks stay simple `set.has(id)` lookups.
+ */
+import type { ActionDefinition } from "../actions/types";
+import type { AgentDefinition } from "../agents/types";
+import type { DatasetDefinition } from "../datasets";
+import type { ObjectType } from "../ontology";
+import type { PipelineDefinition } from "../pipelines";
+import type { SyncDefinition } from "../syncs";
+import type { WorkflowDefinition } from "../workflows/types";
+import { type BreadthSelector, type BreadthTarget } from "./every";
+import type { AccessGrant, AppendGrant, ApplicationDefinition, ApplyGrant, EditGrant, ObserveGrant, RunGrant, ViewGrant } from "./types";
+type GrantInput<TDefinition, TTarget extends BreadthTarget> = TDefinition | readonly TDefinition[] | BreadthSelector<TTarget>;
+declare function access(input: GrantInput<ApplicationDefinition, "application">): AccessGrant;
+declare function view(input: GrantInput<ObjectType, "object">): ViewGrant<"object">;
+declare function view(input: GrantInput<DatasetDefinition, "dataset">): ViewGrant<"dataset">;
+declare function edit(input: GrantInput<ObjectType, "object">): EditGrant;
+declare function append(input: GrantInput<ObjectType, "object">): AppendGrant;
+declare function apply(input: GrantInput<ActionDefinition, "action">): ApplyGrant;
+declare function run(input: GrantInput<WorkflowDefinition, "workflow">): RunGrant<"workflow">;
+declare function run(input: GrantInput<SyncDefinition, "sync">): RunGrant<"sync">;
+declare function run(input: GrantInput<PipelineDefinition, "pipeline">): RunGrant<"pipeline">;
+declare function run(input: GrantInput<AgentDefinition, "agent">): RunGrant<"agent">;
+declare function observe(target: "logs"): ObserveGrant;
+export declare const can: {
+    access: typeof access;
+    view: typeof view;
+    edit: typeof edit;
+    append: typeof append;
+    apply: typeof apply;
+    run: typeof run;
+    observe: typeof observe;
+};
+export {};
+//# sourceMappingURL=grants.d.ts.map

package/dist/security/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/security/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAGnB,MAAM,SAAS,CAAA;AAChB,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,qBAAqB,EACrB,UAAU,EACV,SAAS,EACT,YAAY,EACZ,QAAQ,EAER,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,KAAK,UAAU,CAAC,WAAW,EAAE,OAAO,SAAS,aAAa,IACtD,WAAW,GACX,SAAS,WAAW,EAAE,GACtB,eAAe,CAAC,OAAO,CAAC,CAAA;AA6G5B,iBAAS,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,qBAAqB,EAAE,aAAa,CAAC,GAAG,WAAW,CAGpF;AAED,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAC3E,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;AAMpF,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,SAAS,CAMhE;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,WAAW,CAMpE;AAED,iBAAS,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG,UAAU,CAMxE;AAED,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;AACrF,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;AACzE,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;AACrF,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,eAAe,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;AAW5E,iBAAS,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAO7C;AAED,eAAO,MAAM,GAAG;;;;;;;;CAQf,CAAA"}

package/dist/security/index.d.ts

@@ -0,0 +1,12 @@
+export { applications } from "./applications";
+export type { DefineGroupOptions, DefineMembershipPolicyOptions, DefineRoleOptions, } from "./builders";
+export { defineGroup, defineMembershipPolicy, defineRole } from "./builders";
+export { SecurityValidationError } from "./errors";
+export type { BreadthSelector, BreadthTarget } from "./every";
+export { every } from "./every";
+export { can } from "./grants";
+export type { MembershipOperationScope, MembershipPolicyScope } from "./membership-policies";
+export { canPerformMembershipOperation, isMembershipOperation, missingMembershipGroupIds, resolveMembershipPolicyScope, } from "./membership-policies";
+export type { AccessGrant, AppendGrant, ApplicationDefinition, ApplyGrant, EditGrant, GrantCapability, GrantDefinition, GroupDefinition, GroupReference, MembershipOperation, MembershipPolicyDefinition, ObserveGrant, ObserveGrantTarget, RegisteredSecurityDefinitions, RoleDefinition, RunGrant, RunGrantTarget, SecurityRegistry, Selection, ViewGrant, ViewGrantTarget, } from "./types";
+export { assertGrantDefinition, assertGroupDefinition, assertMembershipPolicyDefinition, assertRoleDefinition, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, validateSecurityDefinitionsAtStartup, } from "./validation";
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,YAAY,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC5F,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EACV,WAAW,EACX,WAAW,EACX,qBAAqB,EACrB,UAAU,EACV,SAAS,EACT,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,SAAS,EACT,eAAe,GAChB,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,gCAAgC,EAChC,oBAAoB,EACpB,iBAAiB,EACjB,4BAA4B,EAC5B,gBAAgB,EAChB,oCAAoC,GACrC,MAAM,cAAc,CAAA"}

package/dist/security/membership-policies.d.ts

@@ -0,0 +1,17 @@
+import type { MembershipOperation, MembershipPolicyDefinition } from "./types";
+export interface MembershipOperationScope {
+    readonly policyIds: readonly string[];
+    readonly groupIds: ReadonlySet<string>;
+}
+export interface MembershipPolicyScope {
+    readonly policyIds: readonly string[];
+    readonly operations: Readonly<Record<MembershipOperation, MembershipOperationScope>>;
+}
+export declare function resolveMembershipPolicyScope(input: {
+    readonly membershipPolicies: readonly MembershipPolicyDefinition[];
+    readonly callerGroupIds: readonly string[];
+}): MembershipPolicyScope;
+export declare function canPerformMembershipOperation(scope: MembershipPolicyScope, operation: MembershipOperation, groupIds: readonly string[]): boolean;
+export declare function missingMembershipGroupIds(scope: MembershipPolicyScope, operation: MembershipOperation, groupIds: readonly string[]): readonly string[];
+export declare function isMembershipOperation(value: unknown): value is MembershipOperation;
+//# sourceMappingURL=membership-policies.d.ts.map

package/dist/security/membership-policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership-policies.d.ts","sourceRoot":"","sources":["../../src/security/membership-policies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAA;AAE9E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC,CAAA;CACrF;AAID,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAC3C,GAAG,qBAAqB,CA2BxB;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,qBAAqB,EAC5B,SAAS,EAAE,mBAAmB,EAC9B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,OAAO,CAYT;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,qBAAqB,EAC5B,SAAS,EAAE,mBAAmB,EAC9B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,SAAS,MAAM,EAAE,CAOnB;AAuBD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAElF"}

package/dist/security/runtime.d.ts

@@ -0,0 +1,16 @@
+import type { GroupDefinition, MembershipPolicyDefinition, RoleDefinition, SecurityRegistry } from "./types";
+export declare function createRuntimeSecurityRegistry(input: {
+    readonly groups?: readonly GroupDefinition[];
+    readonly roles?: readonly RoleDefinition[];
+    readonly membershipPolicies?: readonly MembershipPolicyDefinition[];
+    readonly applicationIds?: ReadonlySet<string>;
+    readonly objectTypeIds?: ReadonlySet<string>;
+    readonly datasetIds?: ReadonlySet<string>;
+    readonly actionIds?: ReadonlySet<string>;
+    readonly workflowIds?: ReadonlySet<string>;
+    readonly syncIds?: ReadonlySet<string>;
+    readonly pipelineIds?: ReadonlySet<string>;
+    readonly agentIds?: ReadonlySet<string>;
+    readonly getSubTypes?: (objectTypeId: string) => readonly string[];
+}): SecurityRegistry;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/security/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/security/runtime.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,eAAe,EACf,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,EACjB,MAAM,SAAS,CAAA;AAwChB,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;IACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CACnE,GAAG,gBAAgB,CAwCnB"}

package/dist/security/types.d.ts

@@ -0,0 +1,133 @@
+import type { AuthSessionAudience } from "../auth/audience";
+import type { ResolvedRole } from "../authorization/types";
+export interface GroupDefinition<TId extends string = string> {
+    readonly kind: "group";
+    readonly id: TId;
+    readonly label?: string;
+    readonly description?: string;
+}
+/**
+ * A group named either by its definition or by its id.
+ *
+ * Both forms are unavoidable. Sessions and stored memberships hand you ids, so a runtime caller has
+ * nothing else to pass; code that knows the group at authoring time has the definition, and naming it
+ * makes a rename a compile error instead of a silent miss. Runtime entry points normalize to ids.
+ */
+export type GroupReference = GroupDefinition | string;
+/**
+ * A capability's reach over its target's id space. Either the whole registered
+ * universe minus an exclusion list (`every.object().except([...])`) or an
+ * explicit set of ids (`can.view([A, B])`). Both forms expand to a concrete set
+ * of ids at startup, so the resolved index only ever holds plain `Set`s.
+ */
+export type Selection = {
+    readonly all: true;
+    readonly except: readonly string[];
+} | {
+    readonly all: false;
+    readonly ids: readonly string[];
+};
+export interface ApplicationDefinition<TId extends AuthSessionAudience = AuthSessionAudience> {
+    readonly kind: "application";
+    readonly id: TId;
+    readonly label: string;
+}
+export interface AccessGrant {
+    readonly kind: "grant";
+    readonly capability: "access";
+    readonly target: "application";
+    readonly selection: Selection;
+}
+export type ViewGrantTarget = "object" | "dataset";
+export interface ViewGrant<TTarget extends ViewGrantTarget = ViewGrantTarget> {
+    readonly kind: "grant";
+    readonly capability: "view";
+    readonly target: TTarget;
+    readonly selection: Selection;
+}
+/**
+ * Write objects of the selected types: properties, links, delete, and restore.
+ *
+ * Carries no `target` — like {@link ApplyGrant}, the capability names its one target family, so
+ * `grantKindOf` stays a constant and the selection cannot disagree with a redundant field.
+ *
+ * Takes effect alongside `view:object`: an upsert returns the *merged* row, which the Materializer
+ * reconciles against source authority, so a write can surface properties the caller never sent.
+ * Enforced explicitly at the write leaves rather than implied here — the resolved index holds only
+ * ids somebody granted.
+ */
+export interface EditGrant {
+    readonly kind: "grant";
+    readonly capability: "edit";
+    readonly selection: Selection;
+}
+/**
+ * Append telemetry points to objects of the selected types. Append-only: it cannot change a
+ * property, delete anything, or violate a state machine.
+ *
+ * Separate from {@link EditGrant} because it serves a different class of principal — a device or an
+ * ingestion service pushes points and must never reach properties. It is also the only write that
+ * needs no `view:object`, since the response carries no object state; that is what makes a
+ * genuinely write-only principal expressible.
+ */
+export interface AppendGrant {
+    readonly kind: "grant";
+    readonly capability: "append";
+    readonly selection: Selection;
+}
+export interface ApplyGrant {
+    readonly kind: "grant";
+    readonly capability: "apply";
+    readonly selection: Selection;
+}
+export type RunGrantTarget = "workflow" | "sync" | "pipeline" | "agent";
+export interface RunGrant<TTarget extends RunGrantTarget = RunGrantTarget> {
+    readonly kind: "grant";
+    readonly capability: "run";
+    readonly target: TTarget;
+    readonly selection: Selection;
+}
+export type ObserveGrantTarget = "logs";
+export interface ObserveGrant {
+    readonly kind: "grant";
+    readonly capability: "observe";
+    readonly target: ObserveGrantTarget;
+    readonly selection: Selection;
+}
+export type GrantDefinition = AccessGrant | ViewGrant | EditGrant | AppendGrant | ApplyGrant | RunGrant | ObserveGrant;
+export type GrantCapability = GrantDefinition["capability"];
+export interface RoleDefinition<TId extends string = string> {
+    readonly kind: "role";
+    readonly id: TId;
+    readonly label?: string;
+    readonly description?: string;
+    readonly grantedToGroupIds: readonly string[];
+    readonly grants: readonly GrantDefinition[];
+}
+export type MembershipOperation = "invite" | "assignGroups" | "suspend";
+export interface MembershipPolicyDefinition<TId extends string = string> {
+    readonly kind: "membershipPolicy";
+    readonly id: TId;
+    readonly grantedToGroupIds: readonly string[];
+    readonly scopeGroupIds: readonly string[];
+    readonly can: readonly MembershipOperation[];
+}
+export interface RegisteredSecurityDefinitions {
+    readonly groups: readonly GroupDefinition[];
+    readonly groupsById: ReadonlyMap<string, GroupDefinition>;
+    readonly roles: readonly RoleDefinition[];
+    readonly rolesById: ReadonlyMap<string, RoleDefinition>;
+    readonly membershipPolicies: readonly MembershipPolicyDefinition[];
+    readonly membershipPoliciesById: ReadonlyMap<string, MembershipPolicyDefinition>;
+}
+export interface SecurityRegistry {
+    listGroups(): readonly GroupDefinition[];
+    getGroupById(groupId: string): GroupDefinition | null;
+    listRoles(): readonly RoleDefinition[];
+    getRoleById(roleId: string): RoleDefinition | null;
+    /** Roles with their grants pre-expanded to concrete id sets for resolution. */
+    listResolvedRoles(): readonly ResolvedRole[];
+    listMembershipPolicies(): readonly MembershipPolicyDefinition[];
+    getMembershipPolicyById(policyId: string): MembershipPolicyDefinition | null;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/security/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAE1D,MAAM,WAAW,eAAe,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC1D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,MAAM,CAAA;AAErD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAE5D,MAAM,WAAW,qBAAqB,CAAC,GAAG,SAAS,mBAAmB,GAAG,mBAAmB;IAC1F,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,CAAA;AAElD,MAAM,WAAW,SAAS,CAAC,OAAO,SAAS,eAAe,GAAG,eAAe;IAC1E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAA;AAEvE,MAAM,WAAW,QAAQ,CAAC,OAAO,SAAS,cAAc,GAAG,cAAc;IACvE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAEvC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,SAAS,GACT,SAAS,GACT,WAAW,GACX,UAAU,GACV,QAAQ,GACR,YAAY,CAAA;AAEhB,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;AAE3D,MAAM,WAAW,cAAc,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;CAC5C;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,CAAA;AAEvE,MAAM,WAAW,0BAA0B,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IACrE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAC7C;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACzD,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACvD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;CACjF;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,IAAI,SAAS,eAAe,EAAE,CAAA;IACxC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAAA;IACrD,SAAS,IAAI,SAAS,cAAc,EAAE,CAAA;IACtC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAA;IAClD,+EAA+E;IAC/E,iBAAiB,IAAI,SAAS,YAAY,EAAE,CAAA;IAC5C,sBAAsB,IAAI,SAAS,0BAA0B,EAAE,CAAA;IAC/D,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI,CAAA;CAC7E"}

package/dist/security/validation.d.ts

@@ -0,0 +1,36 @@
+import type { GrantDefinition, GroupDefinition, MembershipPolicyDefinition, RegisteredSecurityDefinitions, RoleDefinition } from "./types";
+export type CreateSecurityError = (message: string) => Error;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function assertNonEmptyString(value: unknown, field: string, createError?: CreateSecurityError): asserts value is string;
+export declare function assertOptionalString(value: unknown, field: string, createError?: CreateSecurityError): asserts value is string | undefined;
+export declare function assertGroupDefinition(value: unknown, createError?: CreateSecurityError): asserts value is GroupDefinition;
+export declare function isGroupDefinition(value: unknown): value is GroupDefinition;
+export declare function assertMembershipPolicyDefinition(value: unknown, createError?: CreateSecurityError): asserts value is MembershipPolicyDefinition;
+export declare function isMembershipPolicyDefinition(value: unknown): value is MembershipPolicyDefinition;
+export declare function assertGrantDefinition(value: unknown, field: string, createError?: CreateSecurityError): asserts value is GrantDefinition;
+export declare function assertRoleDefinition(value: unknown, createError?: CreateSecurityError): asserts value is RoleDefinition;
+export declare function isRoleDefinition(value: unknown): value is RoleDefinition;
+export declare function validateSecurityDefinitionsAtStartup(input: {
+    readonly groups: readonly GroupDefinition[];
+    readonly membershipPolicies: readonly MembershipPolicyDefinition[];
+    readonly roles?: readonly RoleDefinition[];
+    /** Registered browser application ids — when provided, access grants must reference them. */
+    readonly applicationIds?: ReadonlySet<string>;
+    /** Registered object type ids — when provided, view grants must reference them. */
+    readonly objectTypeIds?: ReadonlySet<string>;
+    /** Registered dataset ids — when provided, dataset view grants must reference them. */
+    readonly datasetIds?: ReadonlySet<string>;
+    /** Registered action ids — when provided, apply grants must reference them. */
+    readonly actionIds?: ReadonlySet<string>;
+    /** Registered workflow ids — when provided, run grants must reference them. */
+    readonly workflowIds?: ReadonlySet<string>;
+    /** Registered sync ids — when provided, sync run grants must reference them. */
+    readonly syncIds?: ReadonlySet<string>;
+    /** Registered pipeline ids — when provided, pipeline run grants must reference them. */
+    readonly pipelineIds?: ReadonlySet<string>;
+    /** Registered agent ids — when provided, agent run grants must reference them. */
+    readonly agentIds?: ReadonlySet<string>;
+    /** Registered observability surfaces. */
+    readonly observableIds?: ReadonlySet<string>;
+}): RegisteredSecurityDefinitions;
+//# sourceMappingURL=validation.d.ts.map

package/dist/security/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/security/validation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEV,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,6BAA6B,EAC7B,cAAc,EACf,MAAM,SAAS,CAAA;AA8BhB,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,KAAK,CAAA;AAI5D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,MAAM,CAIzB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,MAAM,GAAG,SAAS,CAQrC;AA2DD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,eAAe,CAYlC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAO1E;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,0BAA0B,CAiB7C;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,0BAA0B,CAOhG;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,eAAe,CAoClC;AAqBD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,cAAc,CAqBjC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAOxE;AAED,wBAAgB,oCAAoC,CAAC,KAAK,EAAE;IAC1D,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7C,mFAAmF;IACnF,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,yCAAyC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAC7C,GAAG,6BAA6B,CAmGhC"}

package/dist/storage/action-runs/errors.d.ts

@@ -0,0 +1,10 @@
+import { MaterializationConflictError } from "../../materialization/errors";
+/**
+ * Base error for action-run storage operations. Callers can use this to catch
+ * domain-specific failures without relying on message text.
+ */
+export declare class ActionRunError extends MaterializationConflictError {
+    readonly name = "ActionRunError";
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/storage/action-runs/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/storage/action-runs/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAA;AAE3E;;;GAGG;AACH,qBAAa,cAAe,SAAQ,4BAA4B;IAC9D,QAAQ,CAAC,IAAI,oBAAmB;gBAEpB,OAAO,EAAE,MAAM;CAG5B"}

package/dist/storage/action-runs/idempotency.d.ts

@@ -0,0 +1,10 @@
+import type { ActionSubject } from "../../actions";
+import type { ActionRunEffectsRecord, ActionRunPhase, ActionRunRecord, ActionRunWritebackRecord, FinishActionRunInput, QueueActionRunInput } from "./types";
+export declare function actionSubjectsEqual(left: ActionSubject, right: ActionSubject): boolean;
+export declare function actionRunParamsEqual(left: unknown, right: unknown): boolean;
+export type ActionRunPhaseRecord = ActionRunWritebackRecord | ActionRunEffectsRecord;
+export declare function actionRunPhaseRecordsEqual(left: ActionRunPhaseRecord, right: ActionRunPhaseRecord): boolean;
+export declare function finishActionRunPhase(input: FinishActionRunInput, current: ActionRunPhase | null | undefined): ActionRunPhase;
+export declare function canRequeueActionRunAfterEnqueueFailure(existing: ActionRunRecord, input: QueueActionRunInput): boolean;
+export declare function isTerminalActionRun(record: Pick<ActionRunRecord, "status">): boolean;
+//# sourceMappingURL=idempotency.d.ts.map

package/dist/storage/action-runs/idempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../../src/storage/action-runs/idempotency.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElD,OAAO,KAAK,EACV,sBAAsB,EACtB,cAAc,EACd,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,SAAS,CAAA;AAEhB,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAKtF;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3E;AAED,MAAM,MAAM,oBAAoB,GAAG,wBAAwB,GAAG,sBAAsB,CAAA;AAEpF,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAET;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,GACzC,cAAc,CAMhB;AAED,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAST;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,GAAG,OAAO,CAIpF"}

package/dist/storage/action-runs/in-memory.d.ts

@@ -0,0 +1,28 @@
+import type { ActionRunRecord, ActionRunStorage, EnterActionRunPhaseInput, FinishActionRunInput, ListActionRunsInput, ListActionRunsResult, LockActionMaterializationRunInput, QueueActionRunInput, RecordActionEffectsInput, RecordActionWritebackInput, StartActionRunInput } from "./types";
+type RunRootOperation = <T>(run: () => Promise<T> | T) => Promise<T>;
+export declare class InMemoryActionRunStorage implements ActionRunStorage {
+    private readonly rows;
+    private readonly runRootOperation;
+    constructor(input?: {
+        readonly runRootOperation?: RunRootOperation;
+    });
+    snapshot(): InMemoryActionRunStorageSnapshot;
+    restore(snapshot: InMemoryActionRunStorageSnapshot): void;
+    lockForMaterialization(input: LockActionMaterializationRunInput): Promise<ActionRunRecord>;
+    queue(input: QueueActionRunInput): Promise<ActionRunRecord>;
+    start(input: StartActionRunInput): Promise<ActionRunRecord>;
+    enterPhase(input: EnterActionRunPhaseInput): Promise<ActionRunRecord>;
+    recordWriteback(input: RecordActionWritebackInput): Promise<ActionRunRecord>;
+    recordEffects(input: RecordActionEffectsInput): Promise<ActionRunRecord>;
+    finish(input: FinishActionRunInput): Promise<ActionRunRecord>;
+    private requireRunningRun;
+    getById(params: {
+        projectId: string;
+        id: string;
+    }): Promise<ActionRunRecord | null>;
+    list(input: ListActionRunsInput): Promise<ListActionRunsResult>;
+    private requireMaterializationRun;
+}
+export type InMemoryActionRunStorageSnapshot = Map<string, ActionRunRecord>;
+export {};
+//# sourceMappingURL=in-memory.d.ts.map

package/dist/storage/action-runs/in-memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory.d.ts","sourceRoot":"","sources":["../../../src/storage/action-runs/in-memory.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAIV,eAAe,EACf,gBAAgB,EAEhB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,mBAAmB,EACpB,MAAM,SAAS,CAAA;AAEhB,KAAK,gBAAgB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;AAkFpE,qBAAa,wBAAyB,YAAW,gBAAgB;IAC/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqC;IAC1D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAkB;gBAEvC,KAAK,GAAE;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;KAAO;IAIxE,QAAQ,IAAI,gCAAgC;IAI5C,OAAO,CAAC,QAAQ,EAAE,gCAAgC,GAAG,IAAI;IAOnD,sBAAsB,CAAC,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC,eAAe,CAAC;IAI1F,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC;IA2C3D,KAAK,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC;IA8B3D,UAAU,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,eAAe,CAAC;IAcrE,eAAe,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,eAAe,CAAC;IA2B5E,aAAa,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,eAAe,CAAC;IA2BxE,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IA6CnE,OAAO,CAAC,iBAAiB;IAqBnB,OAAO,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAOnF,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAkDrE,OAAO,CAAC,yBAAyB;CAuBlC;AAED,MAAM,MAAM,gCAAgC,GAAG,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA"}

package/dist/storage/action-runs/index.d.ts

@@ -0,0 +1,6 @@
+export { ActionRunError } from "./errors";
+export type { ActionRunPhaseRecord } from "./idempotency";
+export { actionRunParamsEqual, actionRunPhaseRecordsEqual, actionSubjectsEqual, canRequeueActionRunAfterEnqueueFailure, finishActionRunPhase, isTerminalActionRun, } from "./idempotency";
+export { InMemoryActionRunStorage } from "./in-memory";
+export type { ActionRunEffectsRecord, ActionRunFailure, ActionRunParams, ActionRunPhase, ActionRunPhaseStatus, ActionRunRecord, ActionRunStatus, ActionRunStorage, ActionRunWritebackRecord, EnterActionRunPhaseInput, FinishActionRunInput, ListActionRunsInput, ListActionRunsResult, LockActionMaterializationRunInput, QueueActionRunInput, RecordActionEffectsInput, RecordActionWritebackInput, StartActionRunInput, } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/storage/action-runs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/storage/action-runs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AACzC,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACzD,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,mBAAmB,EACnB,sCAAsC,EACtC,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AACtD,YAAY,EACV,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,mBAAmB,EACnB,wBAAwB,EACxB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,SAAS,CAAA"}