@sixb/core 0.1.0 → 0.1.2

package/src/runtime/scoped.ts

@@ -1,436 +0,0 @@
-/**
- * Scoped SDK surface returned by `sixb.as(context)`.
- *
- * The scoped types are masks over the full SDK types — derived from the same
- * declarations, never copies — so signatures cannot drift and new surface area
- * stays hidden until its grants are enforceable end to end. The runtime values
- * are the same factories running over an authorization-carrying runtime
- * context; leaf asserts and query planning enforce the grants.
- */
-
-import type {
-  ActionDefinition,
-  RequestActionAndWaitInput,
-  RequestActionInput,
-  RequestActionResult,
-} from "../actions"
-import {
-  requestAction as requestRuntimeAction,
-  requestActionAndWait as requestRuntimeActionAndWait,
-} from "../actions/request"
-import type {
-  AgentDefinition,
-  AgentsRuntime,
-  RequestAgentRunInput,
-  RequestAgentRunResult,
-  ScopedListAgentThreadsInput,
-} from "../agents"
-import {
-  type AuthorizationContext,
-  type AuthzRequest,
-  assertAuthorized,
-  canViewEvent,
-  isAllowed,
-} from "../authorization"
-import type { DatasetDefinition } from "../datasets"
-import type { EventsReadInput, StoredDomainEvent } from "../events"
-import { createObjectSet, objectService } from "../objects"
-import type { ListObjectsParams } from "../objects/service"
-import type { ValueType } from "../ontology"
-import { assertObjectTypeRegistered } from "../ontology"
-import type { ObjectTypeWithPropertyTokens } from "../ontology/tokens"
-import type { PipelineDefinition } from "../pipelines"
-import { PipelineError } from "../pipelines"
-import {
-  type PipelineRunRequestResult,
-  type RequestPipelineRunInput,
-  requestPipelineRun,
-} from "../pipelines/request"
-import type { ObjectRow } from "../storage"
-import type { ActionRunRecord } from "../storage/action-runs"
-import type { AgentThreadRecord, ListAgentThreadsResult } from "../storage/agents"
-import type { SyncDefinition } from "../syncs"
-import { SyncValidationError } from "../syncs"
-import {
-  type RequestSyncRunInput,
-  requestSyncRun,
-  type SyncRunRequestResult,
-} from "../syncs/request"
-import type {
-  RequestWorkflowRunInput,
-  WorkflowDefinition,
-  WorkflowRunRequestResult,
-  WorkflowsRuntime,
-} from "../workflows"
-import type {
-  ListResult,
-  ObjectByIdHandle,
-  ObjectSet,
-  OntologySource,
-  RegisteredObjectType,
-  RegisteredValueTypes,
-  SixbInstance,
-  SixbRuntimeContext,
-} from "./types"
-
-// Scoped members are indexed accesses of the full SDK types rather than
-// `Pick`s: signatures stay single-sourced (no drift), while indexed access
-// stays lazy — mapped types would eagerly materialize every method's deep
-// query/telemetry conditionals and blow the instantiation depth limit.
-export interface ScopedObjectByIdHandle<
-  TObjectType extends ObjectTypeWithPropertyTokens,
-  TValueTypes extends readonly ValueType[],
-> {
-  get: ObjectByIdHandle<TObjectType, TValueTypes>["get"]
-  requestAction: ObjectByIdHandle<TObjectType, TValueTypes>["requestAction"]
-  requestActionAndWait: ObjectByIdHandle<TObjectType, TValueTypes>["requestActionAndWait"]
-  /** Requires `edit:object` on this type and `view:object` on the link target. */
-  link: ObjectByIdHandle<TObjectType, TValueTypes>["link"]
-  /** Requires `edit:object` on this type and `view:object` on the link target. */
-  unlink: ObjectByIdHandle<TObjectType, TValueTypes>["unlink"]
-  /** Requires `edit:object`. */
-  delete: ObjectByIdHandle<TObjectType, TValueTypes>["delete"]
-  /** Requires `edit:object`. */
-  restore: ObjectByIdHandle<TObjectType, TValueTypes>["restore"]
-  /** `append()` requires `append:telemetry`; `history()` requires `view:object`. */
-  telemetry: ObjectByIdHandle<TObjectType, TValueTypes>["telemetry"]
-  // `listLinks` stays off this surface: its rows name target types that no read grant covers.
-}
-
-export interface ScopedObjectSet<
-  TObjectType extends ObjectTypeWithPropertyTokens,
-  TValueTypes extends readonly ValueType[],
-  TRegisteredObjectTypes extends ObjectTypeWithPropertyTokens = TObjectType,
-> {
-  get: ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes>["get"]
-  list: ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes>["list"]
-  query: ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes>["query"]
-  requestAction: ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes>["requestAction"]
-  requestActionAndWait: ObjectSet<
-    TObjectType,
-    TValueTypes,
-    TRegisteredObjectTypes
-  >["requestActionAndWait"]
-  /** Requires `view:object` and `edit:object`. */
-  upsert: ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes>["upsert"]
-  /** Requires `edit:object` on this type and `view:object` on the link target. */
-  upsertLink: ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes>["upsertLink"]
-  /** Requires `edit:object` on this type and `view:object` on the link target. */
-  removeLink: ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes>["removeLink"]
-  /** Requires `append:telemetry` — and notably not `view:object`. */
-  appendTelemetryBatch: ObjectSet<
-    TObjectType,
-    TValueTypes,
-    TRegisteredObjectTypes
-  >["appendTelemetryBatch"]
-
-  /** Bind read, write, and action operations to a specific object id. */
-  byId(id: string): ScopedObjectByIdHandle<TObjectType, TValueTypes>
-}
-
-/**
- * Principal-scoped runtime surface.
- *
- * Exposes only operations whose grants are enforceable end to end (`can.view`, `can.edit`,
- * `can.append`, `can.apply`, `can.run`, `can.observe`). Infra handles, lifecycle, auth
- * administration, and `listLinks` stay on the privileged runtime.
- */
-export interface ScopedSixb<TOntologySources extends readonly OntologySource[]> {
-  /** The authorization context this SDK instance enforces. */
-  readonly authorization: AuthorizationContext
-
-  /** Type-safe ObjectSet narrowed to grant-enforceable operations. */
-  objects<TObjectType extends RegisteredObjectType<TOntologySources>>(
-    objectType: TObjectType
-  ): ScopedObjectSet<
-    TObjectType,
-    RegisteredValueTypes<TOntologySources>,
-    RegisteredObjectType<TOntologySources>
-  >
-
-  /** Cross-type listing narrowed to the principal's viewable object types. */
-  list(params: ListObjectsParams): Promise<ListResult<ObjectRow>>
-
-  /** Get an object by type id and primary id (server / dynamic contexts). */
-  getObject(objectTypeId: string, primaryId: string): Promise<ObjectRow | null>
-
-  /**
-   * The primary property of a type the principal may view.
-   *
-   * Asserts before it looks the type up, which is the whole point of having it here: the privileged
-   * lookup answers "unknown type" for an unregistered id and a primary property for a registered
-   * one, so a caller that reaches it before any grant check can tell the two apart. Every other
-   * ontology read is grant-filtered — `listObjectTypes` returns only viewable types — and this
-   * matches them.
-   */
-  getPrimaryPropertyId: SixbInstance<TOntologySources>["getPrimaryPropertyId"]
-
-  // The string-based write entry points, indexed off the full runtime rather than restated, so the
-  // surface that now carries authorization cannot drift from the one it delegates to.
-  /** Upsert an object by type id. Requires `view:object` and `edit:object`. */
-  upsertObject: SixbInstance<TOntologySources>["upsertObject"]
-  /** Batch upsert objects of one type. Requires `view:object` and `edit:object`. */
-  upsertObjectBatch: SixbInstance<TOntologySources>["upsertObjectBatch"]
-  /** Create or update a link. Requires `edit:object` on the source, `view:object` on the target. */
-  upsertLink: SixbInstance<TOntologySources>["upsertLink"]
-  /** Batch upsert links. Asserted for every item before anything commits. */
-  upsertLinkBatch: SixbInstance<TOntologySources>["upsertLinkBatch"]
-  /** Remove a link. Requires `edit:object` on the source, `view:object` on the target. */
-  removeLink: SixbInstance<TOntologySources>["removeLink"]
-  /** Append telemetry. Requires `append:telemetry` — and notably not `view:object`. */
-  appendTelemetry: SixbInstance<TOntologySources>["appendTelemetry"]
-
-  /** Dataset definitions the principal may view. */
-  listDatasets(): readonly DatasetDefinition[]
-
-  /** Look up a viewable dataset definition; null hides ungranted datasets. */
-  getDatasetById(datasetId: string): DatasetDefinition | null
-
-  /** Action definitions the principal may apply. */
-  listActions(): readonly ActionDefinition[]
-
-  /** Look up an applicable action definition; null hides ungranted actions. */
-  getActionById(actionId: string): ActionDefinition | null
-
-  /** Request an action by id (server / dynamic contexts). Requires `can.apply`. */
-  requestAction(input: RequestActionInput): Promise<RequestActionResult>
-
-  /** Request an action by id and wait for the run to settle. Requires `can.apply`. */
-  requestActionAndWait(input: RequestActionAndWaitInput): Promise<ActionRunRecord>
-
-  /** Workflow definitions the principal may run. */
-  listWorkflows(): readonly WorkflowDefinition[]
-
-  /** Look up a runnable workflow definition; null hides workflows the principal cannot run. */
-  getWorkflowById(workflowId: string): WorkflowDefinition | null
-
-  /** Queue a workflow run. Requires `can.run`. */
-  requestWorkflowRun(input: RequestWorkflowRunInput): Promise<WorkflowRunRequestResult>
-
-  /** Sync definitions the principal may run. */
-  listSyncs(): readonly SyncDefinition[]
-
-  /** Look up a runnable sync definition; null hides syncs the principal cannot run. */
-  getSyncById(syncId: string): SyncDefinition | null
-
-  /** Queue a sync run. Requires `can.run`. */
-  requestSyncRun(input: RequestSyncRunInput): Promise<SyncRunRequestResult>
-
-  /** Pipeline definitions the principal may run. */
-  listPipelines(): readonly PipelineDefinition[]
-
-  /** Look up a runnable pipeline definition; null hides pipelines the principal cannot run. */
-  getPipelineById(pipelineId: string): PipelineDefinition | null
-
-  /** Queue a pipeline run. Requires `can.run`. */
-  requestPipelineRun(input: RequestPipelineRunInput): Promise<PipelineRunRequestResult>
-
-  /** Agent definitions the principal may run. */
-  listAgents(): readonly AgentDefinition[]
-
-  /** Look up a runnable agent definition; null hides agents the principal cannot run. */
-  getAgentById(agentId: string): AgentDefinition | null
-
-  /** Request an agent turn. Requires `can.run`. */
-  requestAgentRun(input: RequestAgentRunInput): Promise<RequestAgentRunResult>
-
-  /** List agent threads the principal owns and may run (owner + `run:agent` filtered). */
-  listThreads(input?: ScopedListAgentThreadsInput): Promise<ListAgentThreadsResult>
-
-  /** Read one agent thread the principal owns and may run; null hides inaccessible threads. */
-  getThread(threadId: string): Promise<AgentThreadRecord | null>
-
-  /** Read the domain events the principal is allowed to see (derived from grants). */
-  readEvents(input?: EventsReadInput): Promise<readonly StoredDomainEvent[]>
-}
-
-export function createScopedSixb<TOntologySources extends readonly OntologySource[]>(
-  runtime: SixbRuntimeContext & { readonly authorization: AuthorizationContext },
-  deps: {
-    readonly datasets: {
-      readonly list: () => readonly DatasetDefinition[]
-      readonly getById: (datasetId: string) => DatasetDefinition | null
-    }
-    readonly syncs: {
-      readonly list: () => readonly SyncDefinition[]
-      readonly getById: (syncId: string) => SyncDefinition | null
-    }
-    readonly pipelines: {
-      readonly list: () => readonly PipelineDefinition[]
-      readonly getById: (pipelineId: string) => PipelineDefinition | null
-    }
-    readonly workflows: WorkflowsRuntime
-    readonly agents: AgentsRuntime
-  }
-): ScopedSixb<TOntologySources> {
-  const canListAction = (action: ActionDefinition) =>
-    isAllowed(runtime.authorization, { kind: "action.apply", actionId: action.id }) &&
-    (action.binding.kind === "global" ||
-      isAllowed(runtime.authorization, {
-        kind: "object.view",
-        objectTypeId: action.binding.objectType.id,
-      }))
-
-  // A scoped catalog narrows a definition source to what the principal may see.
-  // The run/view grant doubles as catalog visibility: a definition the principal
-  // cannot run/view is not worth surfacing, and hiding it also hides the
-  // (possibly ungranted) resources its shape references.
-  const scopedCatalog = <T extends { readonly id: string }>(
-    source: { list(): readonly T[]; getById(id: string): T | null },
-    toRequest: (id: string) => AuthzRequest
-  ) => {
-    const allowed = (id: string) => isAllowed(runtime.authorization, toRequest(id))
-    return {
-      list: () => source.list().filter((item) => allowed(item.id)),
-      getById: (id: string) => {
-        const item = source.getById(id)
-        return item && allowed(id) ? item : null
-      },
-    }
-  }
-
-  const datasets = scopedCatalog(deps.datasets, (datasetId) => ({
-    kind: "dataset.view",
-    datasetId,
-  }))
-  const syncs = scopedCatalog(deps.syncs, (syncId) => ({ kind: "sync.run", syncId }))
-  const pipelines = scopedCatalog(deps.pipelines, (pipelineId) => ({
-    kind: "pipeline.run",
-    pipelineId,
-  }))
-  const workflows = scopedCatalog(deps.workflows, (workflowId) => ({
-    kind: "workflow.run",
-    workflowId,
-  }))
-  const agents = scopedCatalog(deps.agents, (agentId) => ({ kind: "agent.run", agentId }))
-
-  const scoped = {
-    authorization: runtime.authorization,
-
-    objects<TObjectType extends RegisteredObjectType<TOntologySources>>(objectType: TObjectType) {
-      assertObjectTypeRegistered(runtime.ontology.getObjectTypesById(), objectType)
-
-      return createObjectSet<
-        TObjectType,
-        RegisteredObjectType<TOntologySources>,
-        RegisteredValueTypes<TOntologySources>
-      >({ ...runtime, objectType })
-    },
-
-    list: (params: ListObjectsParams) => objectService.listObjects(runtime, params),
-
-    getObject: async (objectTypeId: string, primaryId: string) => {
-      assertAuthorized(runtime, { kind: "object.view", objectTypeId })
-      return runtime.storage.objects.getByPrimaryId({
-        projectId: runtime.projectId,
-        objectTypeId,
-        primaryId,
-      })
-    },
-
-    getPrimaryPropertyId: (objectTypeId: string) => {
-      assertAuthorized(runtime, { kind: "object.view", objectTypeId })
-      return runtime.ontology.getPrimaryPropertyId(objectTypeId)
-    },
-
-    // Same delegation as the privileged runtime's own methods; the leaves assert the grants off
-    // `runtime.authorization`, which is present here by construction.
-    upsertObject: (objectTypeId: string, properties: Record<string, unknown>) =>
-      objectService.upsertObject(runtime, objectTypeId, properties),
-
-    upsertObjectBatch: (
-      objectTypeId: string,
-      items: readonly { properties: Record<string, unknown> }[]
-    ) => objectService.upsertObjectBatch(runtime, objectTypeId, items),
-
-    upsertLink: (
-      objectTypeId: string,
-      sourceId: string,
-      linkId: string,
-      target: { targetTypeId: string; targetId: string; properties?: Record<string, unknown> }
-    ) => objectService.upsertLink(runtime, objectTypeId, sourceId, linkId, target),
-
-    upsertLinkBatch: (
-      items: readonly {
-        objectTypeId: string
-        sourceId: string
-        linkId: string
-        target: { targetTypeId: string; targetId: string; properties?: Record<string, unknown> }
-      }[]
-    ) => objectService.upsertLinkBatch(runtime, items),
-
-    removeLink: (
-      objectTypeId: string,
-      sourceId: string,
-      linkId: string,
-      target: { targetTypeId: string; targetId: string }
-    ) => objectService.removeLink(runtime, objectTypeId, sourceId, linkId, target),
-
-    appendTelemetry: (
-      objectTypeId: string,
-      items: readonly { id: string; properties: Record<string, unknown>; at?: Date }[]
-    ) => objectService.appendTelemetry(runtime, objectTypeId, items),
-
-    listDatasets: datasets.list,
-    getDatasetById: datasets.getById,
-
-    listActions: () => runtime.actionRegistry.list().filter((action) => canListAction(action)),
-
-    getActionById: (actionId: string) => {
-      const action = runtime.actionRegistry.getById(actionId)
-      return action && canListAction(action) ? action : null
-    },
-
-    requestAction: (input: RequestActionInput) => requestRuntimeAction(runtime, input),
-
-    // Gated by the same `can.apply` assertion: `requestActionAndWait` requests through
-    // `requestAction` and then only reads the run it just created.
-    requestActionAndWait: (input: RequestActionAndWaitInput) =>
-      requestRuntimeActionAndWait(runtime, input),
-
-    listWorkflows: workflows.list,
-    getWorkflowById: workflows.getById,
-
-    requestWorkflowRun: (input: RequestWorkflowRunInput) =>
-      deps.workflows.requestByIdAs(runtime, input),
-
-    listSyncs: syncs.list,
-    getSyncById: syncs.getById,
-    requestSyncRun: async (input: RequestSyncRunInput) => {
-      // Resolve against the full registry, not the grant-filtered one: an existing sync the caller
-      // may not run has to report "forbidden", the same as `requestAction`. Only a genuinely unknown
-      // id is "unknown". `requestSyncRun` asserts the grant.
-      const sync = deps.syncs.getById(input.syncId)
-      if (!sync) throw new SyncValidationError(`[Sixb] Unknown sync '${input.syncId}'`)
-      return requestSyncRun(runtime, sync, input)
-    },
-
-    listPipelines: pipelines.list,
-    getPipelineById: pipelines.getById,
-    requestPipelineRun: async (input: RequestPipelineRunInput) => {
-      const pipeline = deps.pipelines.getById(input.pipelineId)
-      if (!pipeline) throw new PipelineError(`[Sixb] Unknown pipeline '${input.pipelineId}'`)
-      return requestPipelineRun(runtime, pipeline, input)
-    },
-
-    listAgents: agents.list,
-    getAgentById: agents.getById,
-    requestAgentRun: (input: RequestAgentRunInput) => deps.agents.requestAs(runtime, input),
-    listThreads: (input?: ScopedListAgentThreadsInput) => deps.agents.listThreadsAs(runtime, input),
-    getThread: (threadId: string) => deps.agents.getThreadAs(runtime, threadId),
-
-    // No standalone events grant: the stream is filtered to events whose
-    // subject the principal may view/apply/run. `limit` applies before this
-    // filter, so a page may return fewer events than requested — acceptable for
-    // a best-effort recent log (storage-level filtering is the planned fix).
-    readEvents: async (input?: EventsReadInput) => {
-      const events = await runtime.events.read(input)
-      return events.filter((event) => canViewEvent(runtime.authorization, event))
-    },
-  }
-
-  // Boundary cast: checking the literal against ScopedSixb<TOntologySources>
-  // triggers excessively deep ObjectSet instantiation (same constraint noted
-  // on SixbInstance). The mask only hides members of the full SDK values.
-  return scoped as unknown as ScopedSixb<TOntologySources>
-}

package/src/security/runtime.ts

@@ -1,101 +0,0 @@
-import { type ResolvedRole, resolveRoleGrants } from "../authorization"
-import { APPLICATION_IDS } from "./applications"
-import type {
-  GroupDefinition,
-  MembershipPolicyDefinition,
-  RoleDefinition,
-  SecurityRegistry,
-} from "./types"
-import { validateSecurityDefinitionsAtStartup } from "./validation"
-
-class RuntimeSecurityRegistry implements SecurityRegistry {
-  constructor(
-    private readonly groupsById: ReadonlyMap<string, GroupDefinition>,
-    private readonly rolesById: ReadonlyMap<string, RoleDefinition>,
-    private readonly membershipPoliciesById: ReadonlyMap<string, MembershipPolicyDefinition>,
-    private readonly resolvedRoles: readonly ResolvedRole[]
-  ) {}
-
-  listGroups(): readonly GroupDefinition[] {
-    return [...this.groupsById.values()]
-  }
-
-  getGroupById(groupId: string): GroupDefinition | null {
-    return this.groupsById.get(groupId) ?? null
-  }
-
-  listRoles(): readonly RoleDefinition[] {
-    return [...this.rolesById.values()]
-  }
-
-  getRoleById(roleId: string): RoleDefinition | null {
-    return this.rolesById.get(roleId) ?? null
-  }
-
-  listResolvedRoles(): readonly ResolvedRole[] {
-    return this.resolvedRoles
-  }
-
-  listMembershipPolicies(): readonly MembershipPolicyDefinition[] {
-    return [...this.membershipPoliciesById.values()]
-  }
-
-  getMembershipPolicyById(policyId: string): MembershipPolicyDefinition | null {
-    return this.membershipPoliciesById.get(policyId) ?? null
-  }
-}
-
-export function createRuntimeSecurityRegistry(input: {
-  readonly groups?: readonly GroupDefinition[]
-  readonly roles?: readonly RoleDefinition[]
-  readonly membershipPolicies?: readonly MembershipPolicyDefinition[]
-  readonly applicationIds?: ReadonlySet<string>
-  readonly objectTypeIds?: ReadonlySet<string>
-  readonly datasetIds?: ReadonlySet<string>
-  readonly actionIds?: ReadonlySet<string>
-  readonly workflowIds?: ReadonlySet<string>
-  readonly syncIds?: ReadonlySet<string>
-  readonly pipelineIds?: ReadonlySet<string>
-  readonly agentIds?: ReadonlySet<string>
-  readonly getSubTypes?: (objectTypeId: string) => readonly string[]
-}): SecurityRegistry {
-  const securityDefinitions = validateSecurityDefinitionsAtStartup({
-    groups: input.groups ?? [],
-    roles: input.roles ?? [],
-    membershipPolicies: input.membershipPolicies ?? [],
-    applicationIds: input.applicationIds ?? APPLICATION_IDS,
-    objectTypeIds: input.objectTypeIds,
-    datasetIds: input.datasetIds,
-    actionIds: input.actionIds,
-    workflowIds: input.workflowIds,
-    syncIds: input.syncIds,
-    pipelineIds: input.pipelineIds,
-    agentIds: input.agentIds,
-    observableIds: new Set(["logs"]),
-  })
-
-  const universe = {
-    applicationIds: input.applicationIds ?? APPLICATION_IDS,
-    objectTypeIds: input.objectTypeIds ?? new Set<string>(),
-    datasetIds: input.datasetIds ?? new Set<string>(),
-    actionIds: input.actionIds ?? new Set<string>(),
-    workflowIds: input.workflowIds ?? new Set<string>(),
-    syncIds: input.syncIds ?? new Set<string>(),
-    pipelineIds: input.pipelineIds ?? new Set<string>(),
-    agentIds: input.agentIds ?? new Set<string>(),
-    observableIds: new Set(["logs"]),
-    getSubTypes: input.getSubTypes ?? (() => []),
-  }
-  const resolvedRoles = securityDefinitions.roles.map((role) => ({
-    id: role.id,
-    grantedToGroupIds: role.grantedToGroupIds,
-    grants: resolveRoleGrants(role, universe),
-  }))
-
-  return new RuntimeSecurityRegistry(
-    securityDefinitions.groupsById,
-    securityDefinitions.rolesById,
-    securityDefinitions.membershipPoliciesById,
-    resolvedRoles
-  )
-}

package/src/storage/webhook-deliveries/in-memory.ts

@@ -1,108 +0,0 @@
-import type {
-  WebhookDeliveryClaimRecord,
-  WebhookDeliveryKey,
-  WebhookDeliveryRecord,
-  WebhookDeliveryStorage,
-} from "./types"
-
-function cloneDeliveryRecord(record: WebhookDeliveryRecord): WebhookDeliveryRecord {
-  return structuredClone(record)
-}
-
-export class InMemoryWebhookDeliveryStorage implements WebhookDeliveryStorage {
-  private readonly deliveries = new Map<string, WebhookDeliveryRecord>()
-
-  snapshot(): InMemoryWebhookDeliveryStorageSnapshot {
-    return structuredClone(this.deliveries)
-  }
-
-  restore(snapshot: InMemoryWebhookDeliveryStorageSnapshot): void {
-    this.deliveries.clear()
-    for (const [key, record] of structuredClone(snapshot)) {
-      this.deliveries.set(key, record)
-    }
-  }
-
-  async claim(
-    input: WebhookDeliveryKey & { receivedAt: string }
-  ): Promise<WebhookDeliveryClaimRecord> {
-    const key = serializeKey(input)
-    const existing = this.deliveries.get(key)
-
-    if (existing?.status === "completed") {
-      return {
-        ...cloneDeliveryRecord(existing),
-        claimResult: "duplicate",
-      }
-    }
-
-    if (existing?.status === "in_progress") {
-      return {
-        ...cloneDeliveryRecord(existing),
-        claimResult: "in_progress",
-      }
-    }
-
-    // New and failed deliveries both get a fresh handler attempt.
-    const next: WebhookDeliveryRecord = {
-      projectId: input.projectId,
-      connectorId: input.connectorId,
-      webhookId: input.webhookId,
-      idempotencyKey: input.idempotencyKey,
-      status: "in_progress",
-      receivedAt: input.receivedAt,
-    }
-    this.deliveries.set(key, structuredClone(next))
-
-    return {
-      ...cloneDeliveryRecord(next),
-      claimResult: "claimed",
-    }
-  }
-
-  async complete(
-    input: WebhookDeliveryKey & { completedAt: string }
-  ): Promise<WebhookDeliveryRecord> {
-    const key = serializeKey(input)
-    const next: WebhookDeliveryRecord = {
-      projectId: input.projectId,
-      connectorId: input.connectorId,
-      webhookId: input.webhookId,
-      idempotencyKey: input.idempotencyKey,
-      ...this.deliveries.get(key),
-      status: "completed",
-      completedAt: input.completedAt,
-      failedAt: undefined,
-      error: undefined,
-    }
-
-    this.deliveries.set(key, structuredClone(next))
-    return cloneDeliveryRecord(next)
-  }
-
-  async fail(
-    input: WebhookDeliveryKey & { failedAt: string; error: string }
-  ): Promise<WebhookDeliveryRecord> {
-    const key = serializeKey(input)
-    const next: WebhookDeliveryRecord = {
-      projectId: input.projectId,
-      connectorId: input.connectorId,
-      webhookId: input.webhookId,
-      idempotencyKey: input.idempotencyKey,
-      ...this.deliveries.get(key),
-      status: "failed",
-      failedAt: input.failedAt,
-      error: input.error,
-      completedAt: undefined,
-    }
-
-    this.deliveries.set(key, structuredClone(next))
-    return cloneDeliveryRecord(next)
-  }
-}
-
-export type InMemoryWebhookDeliveryStorageSnapshot = Map<string, WebhookDeliveryRecord>
-
-function serializeKey(key: WebhookDeliveryKey): string {
-  return JSON.stringify([key.projectId, key.connectorId, key.webhookId, key.idempotencyKey])
-}

package/src/storage/webhook-deliveries/index.ts

@@ -1,9 +0,0 @@
-export { InMemoryWebhookDeliveryStorage } from "./in-memory"
-export type {
-  WebhookDeliveryClaimRecord,
-  WebhookDeliveryClaimResult,
-  WebhookDeliveryKey,
-  WebhookDeliveryRecord,
-  WebhookDeliveryStatus,
-  WebhookDeliveryStorage,
-} from "./types"