@sixb/core 0.1.1 → 0.1.3

package/dist/agents/streams.js

@@ -1,32 +1,51 @@
 // @bun
 import {
+  AGENT_ACTIVITY_STREAM_ID,
+  AGENT_ACTIVITY_STREAM_SCHEMA_VERSION,
   AGENT_RUN_CANCEL_RECORD,
   AGENT_RUN_STREAM_SCHEMA_VERSION,
+  DEFAULT_AGENT_ACTIVITY_STREAM_RETENTION,
   DEFAULT_AGENT_RUN_STREAM_RETENTION,
+  agentActivityStreamDefinition,
+  agentRunActivityEvent,
   agentRunControlStreamDefinition,
   agentRunControlStreamId,
   agentRunFinishedEvent,
   agentRunStreamDefinition,
   agentRunStreamId,
   agentRunStreamIdempotencyKey,
+  isAgentRunActivityEvent,
+  isAgentRunStreamEvent,
+  publishAgentRunActivity,
   publishAgentRunCancel,
   publishAgentRunFinished,
   subscribeAgentRunCancel
-} from "../chunk-k25jm1x5.js";
+} from "../chunk-zpw39qhj.js";
+import"../chunk-t0jjkep3.js";
+import"../chunk-0172wgm9.js";
+import"../chunk-t8t39h7v.js";
 import"../chunk-y64skrwp.js";
 export {
   subscribeAgentRunCancel,
   publishAgentRunFinished,
   publishAgentRunCancel,
+  publishAgentRunActivity,
+  isAgentRunStreamEvent,
+  isAgentRunActivityEvent,
   agentRunStreamIdempotencyKey,
   agentRunStreamId,
   agentRunStreamDefinition,
   agentRunFinishedEvent,
   agentRunControlStreamId,
   agentRunControlStreamDefinition,
+  agentRunActivityEvent,
+  agentActivityStreamDefinition,
   DEFAULT_AGENT_RUN_STREAM_RETENTION,
+  DEFAULT_AGENT_ACTIVITY_STREAM_RETENTION,
   AGENT_RUN_STREAM_SCHEMA_VERSION,
-  AGENT_RUN_CANCEL_RECORD
+  AGENT_RUN_CANCEL_RECORD,
+  AGENT_ACTIVITY_STREAM_SCHEMA_VERSION,
+  AGENT_ACTIVITY_STREAM_ID
 };
 
-//# debugId=4CAEB501F3A25A6C64756E2164756E21
+//# debugId=9EC67E598672F93464756E2164756E21

package/dist/agents/streams.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "4CAEB501F3A25A6C64756E2164756E21",
+  "debugId": "9EC67E598672F93464756E2164756E21",
   "names": []
 }

package/dist/agents/thread-context-projection.d.ts

@@ -0,0 +1,19 @@
+import type { AgentContextCheckpointRecord, AgentMessageRecord } from "../storage/agents/types";
+import type { AgentMessage } from "./message";
+/** A model-only message. Persisted tail messages carry `id`; the synthetic summary does not. */
+export interface AgentThreadModelContextMessage extends AgentMessage {
+    readonly id?: string;
+}
+export interface ProjectAgentThreadModelContextInput {
+    readonly checkpoint: AgentContextCheckpointRecord | null;
+    /** Complete retained tail, ordered by ascending per-thread sequence. */
+    readonly messages: readonly AgentMessageRecord[];
+}
+/**
+ * Build the bounded, model-only view of a durable thread.
+ *
+ * The function is deliberately pure: storage chooses the latest checkpoint and reads its retained
+ * tail; this function validates that projection and prepends one synthetic user-role summary.
+ */
+export declare function projectAgentThreadModelContext(input: ProjectAgentThreadModelContextInput): readonly AgentThreadModelContextMessage[];
+//# sourceMappingURL=thread-context-projection.d.ts.map

package/dist/agents/thread-context-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"thread-context-projection.d.ts","sourceRoot":"","sources":["../../src/agents/thread-context-projection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC/F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAE7C,gGAAgG;AAChG,MAAM,WAAW,8BAA+B,SAAQ,YAAY;IAClE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,UAAU,EAAE,4BAA4B,GAAG,IAAI,CAAA;IACxD,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAA;CACjD;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,mCAAmC,GACzC,SAAS,8BAA8B,EAAE,CAY3C"}

package/dist/agents/tool-definition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-definition.d.ts","sourceRoot":"","sources":["../../src/agents/tool-definition.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,SAAS,CAAA;AAWhB,wBAAgB,yBAAyB,CACvC,KAAK,CAAC,KAAK,SAAS,MAAM,EAC1B,KAAK,CAAC,MAAM,SAAS,oBAAoB,EACzC,UAAU,EAAE;IACZ,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAA;CACtE,GAAG,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CA+BrC;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,mBAAmB,EAAE,GAAG,SAAS,GAChD,SAAS,mBAAmB,EAAE,CAiBhC"}
+{"version":3,"file":"tool-definition.d.ts","sourceRoot":"","sources":["../../src/agents/tool-definition.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,SAAS,CAAA;AAWhB,wBAAgB,yBAAyB,CACvC,KAAK,CAAC,KAAK,SAAS,MAAM,EAC1B,KAAK,CAAC,MAAM,SAAS,oBAAoB,EACzC,UAAU,EAAE;IACZ,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAA;CACtE,GAAG,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAwCrC;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,mBAAmB,EAAE,GAAG,SAAS,GAChD,SAAS,mBAAmB,EAAE,CAiBhC"}

package/dist/agents/tool-result.d.ts

@@ -0,0 +1,6 @@
+import type { AgentToolResult } from "./types";
+/** Narrow a durable JSON tool output to Sixb's file-aware result envelope. */
+export declare function isAgentToolResult(value: unknown): value is AgentToolResult;
+/** Return a precise path when a tagged result does not satisfy the public rich-result contract. */
+export declare function getInvalidAgentToolResultReason(value: unknown): string | undefined;
+//# sourceMappingURL=tool-result.d.ts.map

package/dist/agents/tool-result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-result.d.ts","sourceRoot":"","sources":["../../src/agents/tool-result.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAE9C,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAM1E;AAED,mGAAmG;AACnG,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CA8ClF"}

package/dist/agents/types.d.ts

@@ -1,5 +1,6 @@
 import type { LanguageModelV4, LanguageModelV4CallOptions } from "@ai-sdk/provider";
-import type { ConnectorAdapter, ConnectorClient, ConnectorDefinition } from "../connectors";
+import type { BlobBody, FileRef } from "../blob-storage";
+import type { ConnectorRuntime } from "../connectors";
 import type { JsonPrimitive, JsonValue, ReadonlyJsonValue } from "../json";
 import type { Logger } from "../logging";
 import type { InferSchema } from "../ontology/inference";
@@ -36,16 +37,51 @@ export interface AgentToolRunInfo {
     readonly agentId: string;
     readonly threadId?: string;
 }
+/** Input accepted by the run-scoped artifact publisher exposed to agent tools. */
+export interface AgentToolArtifactPutInput {
+    readonly body: BlobBody;
+    readonly fileName: string;
+    readonly mediaType?: string;
+}
+/** A durable artifact and its path inside the current run sandbox. */
+export interface AgentToolArtifact {
+    readonly fileRef: FileRef;
+    readonly sandboxPath: string;
+}
+/** The narrow artifact-writing surface available to an agent tool call. */
+export interface AgentToolArtifacts {
+    put(input: AgentToolArtifactPutInput): Promise<AgentToolArtifact>;
+}
+export type AgentToolTextContent = {
+    readonly type: "text";
+    readonly text: string;
+};
+export type AgentToolFileContent = {
+    readonly type: "file";
+    readonly fileRef: FileRef;
+};
+/** Durable model-facing content returned by a file-aware tool. */
+export type AgentToolContent = AgentToolTextContent | AgentToolFileContent;
+/**
+ * A file-aware tool result. The tag distinguishes this envelope from an ordinary JSON result while
+ * keeping the whole value safe to persist in the durable tool-call trace.
+ */
+export type AgentToolResult = {
+    readonly kind: "agentToolResult";
+    readonly content: readonly AgentToolContent[];
+};
 /** The narrow, run-scoped surface passed to an agent tool handler. */
 export interface AgentToolRunContext<TInput extends Readonly<Record<string, unknown>> = Readonly<Record<string, unknown>>> {
     readonly input: TInput;
+    readonly toolCallId: string;
     readonly signal: AbortSignal;
     readonly run: AgentToolRunInfo;
-    connector<TAdapter extends ConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>): Promise<ConnectorClient<TAdapter>>;
+    readonly connector: ConnectorRuntime;
     readonly logger: Logger;
+    readonly artifacts: AgentToolArtifacts;
 }
 /** Agent tool handlers may return only values safe to persist in agent messages. */
-export type AgentToolHandlerResult = ReadonlyJsonValue | Promise<ReadonlyJsonValue>;
+export type AgentToolHandlerResult = ReadonlyJsonValue | AgentToolResult | Promise<ReadonlyJsonValue | AgentToolResult>;
 export type AgentToolHandler<TInput extends Readonly<Record<string, unknown>>> = (context: AgentToolRunContext<TInput>) => AgentToolHandlerResult;
 /**
  * Runtime definitions are stored heterogeneously. Keep variance erasure at this

package/dist/agents/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agents/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAA;AACnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAElB,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC,CAAA;AAEtF,eAAO,MAAM,sBAAsB,oFAQgB,CAAA;AAEnD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAC3B,CAAA;CACF;AAED,KAAK,QAAQ,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,GAAG,EAAE,CAAA;AAChD,KAAK,qBAAqB,CAAC,CAAC,IAAI,OAAO,SAAS,CAAC,GAC7C,iBAAiB,GACjB,CAAC,SAAS,IAAI,GACZ,MAAM,GACN,CAAC,SAAS,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,GAChC,SAAS,qBAAqB,CAAC,KAAK,CAAC,EAAE,GACvC,CAAC,SAAS,aAAa,GACrB,CAAC,GACD,CAAC,SAAS,MAAM,GACd;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACxD,KAAK,CAAA;AAEjB,oEAAoE;AACpE,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAEnE,mEAAmE;AACnE,MAAM,MAAM,yBAAyB,CAAC,MAAM,SAAS,oBAAoB,IACvE,MAAM,SAAS,MAAM,MAAM,GACvB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACjC,QAAQ,CAAC;IACP,QAAQ,EAAE,CAAC,IAAI,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;CAC5E,CAAC,CAAA;AAER,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB,CAClC,MAAM,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEpF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAA;IAC9B,SAAS,CAAC,QAAQ,SAAS,gBAAgB,EACzC,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,GAChD,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,oFAAoF;AACpF,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;AAEnF,MAAM,MAAM,gBAAgB,CAAC,MAAM,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAC/E,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,KACjC,sBAAsB,CAAA;AAE3B;;;GAGG;AACH,KAAK,sBAAsB,CAAC,MAAM,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI;IAC9E,cAAc,CAAC,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;CACrF,CAAC,gBAAgB,CAAC,CAAA;AAEnB,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB,CAClC,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,MAAM,SAAS,oBAAoB,GAAG,oBAAoB;IAE1D,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAA;CAC5E;AAED,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,CAAC,KAAK,SAAS,mBAAmB,IAAI,yBAAyB,CAC5F,KAAK,CAAC,OAAO,CAAC,CACf,CAAA;AAED,MAAM,WAAW,mBAAmB,CAAC,KAAK,SAAS,MAAM,EAAE,MAAM,SAAS,oBAAoB;IAC5F,GAAG,CACD,OAAO,EAAE,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,GAC3D,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;CACtC;AAED,MAAM,WAAW,qBAAqB,CAAC,KAAK,SAAS,MAAM;IACzD,KAAK,CAAC,KAAK,CAAC,MAAM,SAAS,oBAAoB,EAC7C,KAAK,EAAE,MAAM,GACZ,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;CACtC;AAED,MAAM,WAAW,2BAA2B,CAAC,KAAK,SAAS,MAAM;IAC/D,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;CAC/D;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,0BAA0B,CAAC,iBAAiB,CAAC,CAAA;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAA;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC1D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,0BAA0B,CAAC,iBAAiB,CAAC,CAAA;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAA;IAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAA;CAChC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agents/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAA;AACnF,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAElB,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC,CAAA;AAEtF,eAAO,MAAM,sBAAsB,oFAQgB,CAAA;AAEnD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAC3B,CAAA;CACF;AAED,KAAK,QAAQ,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,GAAG,EAAE,CAAA;AAChD,KAAK,qBAAqB,CAAC,CAAC,IAAI,OAAO,SAAS,CAAC,GAC7C,iBAAiB,GACjB,CAAC,SAAS,IAAI,GACZ,MAAM,GACN,CAAC,SAAS,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,GAChC,SAAS,qBAAqB,CAAC,KAAK,CAAC,EAAE,GACvC,CAAC,SAAS,aAAa,GACrB,CAAC,GACD,CAAC,SAAS,MAAM,GACd;IAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,GACxD,KAAK,CAAA;AAEjB,oEAAoE;AACpE,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAEnE,mEAAmE;AACnE,MAAM,MAAM,yBAAyB,CAAC,MAAM,SAAS,oBAAoB,IACvE,MAAM,SAAS,MAAM,MAAM,GACvB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACjC,QAAQ,CAAC;IACP,QAAQ,EAAE,CAAC,IAAI,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;CAC5E,CAAC,CAAA;AAER,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,kFAAkF;AAClF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CAClE;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,kEAAkE;AAClE,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,oBAAoB,CAAA;AAE1E;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC9C,CAAA;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB,CAClC,MAAM,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEpF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAA;CACvC;AAED,oFAAoF;AACpF,MAAM,MAAM,sBAAsB,GAC9B,iBAAiB,GACjB,eAAe,GACf,OAAO,CAAC,iBAAiB,GAAG,eAAe,CAAC,CAAA;AAEhD,MAAM,MAAM,gBAAgB,CAAC,MAAM,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAC/E,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,KACjC,sBAAsB,CAAA;AAE3B;;;GAGG;AACH,KAAK,sBAAsB,CAAC,MAAM,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI;IAC9E,cAAc,CAAC,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;CACrF,CAAC,gBAAgB,CAAC,CAAA;AAEnB,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB,CAClC,KAAK,SAAS,MAAM,GAAG,MAAM,EAC7B,MAAM,SAAS,oBAAoB,GAAG,oBAAoB;IAE1D,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAA;CAC5E;AAED,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,CAAC,KAAK,SAAS,mBAAmB,IAAI,yBAAyB,CAC5F,KAAK,CAAC,OAAO,CAAC,CACf,CAAA;AAED,MAAM,WAAW,mBAAmB,CAAC,KAAK,SAAS,MAAM,EAAE,MAAM,SAAS,oBAAoB;IAC5F,GAAG,CACD,OAAO,EAAE,gBAAgB,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,GAC3D,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;CACtC;AAED,MAAM,WAAW,qBAAqB,CAAC,KAAK,SAAS,MAAM;IACzD,KAAK,CAAC,KAAK,CAAC,MAAM,SAAS,oBAAoB,EAC7C,KAAK,EAAE,MAAM,GACZ,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;CACtC;AAED,MAAM,WAAW,2BAA2B,CAAC,KAAK,SAAS,MAAM;IAC/D,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;CAC/D;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,0BAA0B,CAAC,iBAAiB,CAAC,CAAA;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAA;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC1D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,0BAA0B,CAAC,iBAAiB,CAAC,CAAA;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAA;IAC9C,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAA;CAChC"}

package/dist/agents/validation.d.ts

@@ -1,8 +1,8 @@
 import { type JsonValue } from "../json";
 import { type ValueType } from "../ontology";
-import type { GroupDefinition, SecurityRegistry } from "../security";
+import type { GroupDefinition, SecurityDefinitionCatalog } from "../security";
 import { type AgentDefinition, type AgentLoopConfig, type AgentReasoningLevel, type AgentToolDefinition, type AgentToolInputSchema, type DefineAgentConfig } from "./types";
-export declare const AGENT_RESERVED_TOOL_NAMES: readonly ["bash"];
+export declare const AGENT_RESERVED_TOOL_NAMES: readonly ["bash", "read", "view_file"];
 export declare function assertNonEmpty(value: string, field: string): void;
 export declare function isAgentDefinition(value: unknown): value is AgentDefinition;
 export declare function isAgentToolDefinition(value: unknown): value is AgentToolDefinition;
@@ -18,6 +18,6 @@ export declare function assertValidLoopConfig(loop: AgentLoopConfig | undefined)
 export declare function assertValidReasoningLevel(reasoning: AgentReasoningLevel | undefined): void;
 export declare function assertValidProviderOptions(providerOptions: DefineAgentConfig["providerOptions"]): void;
 export declare function groupIdsFromDefinitions(agentId: string, groups: readonly GroupDefinition[] | undefined): readonly string[];
-export declare function validateAgentGroupReferences(agents: readonly AgentDefinition[], security: SecurityRegistry): void;
+export declare function validateAgentGroupReferences(agents: readonly AgentDefinition[], security: SecurityDefinitionCatalog): void;
 export declare function assertValidAgentToolDefinitions(agentId: string, tools: readonly AgentToolDefinition[]): void;
 //# sourceMappingURL=validation.d.ts.map

package/dist/agents/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/agents/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,KAAK,SAAS,EAAE,MAAM,SAAS,CAAA;AAClF,OAAO,EAIL,KAAK,SAAS,EAEf,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEpE,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACvB,MAAM,SAAS,CAAA;AAehB,eAAO,MAAM,yBAAyB,mBAAoB,CAAA;AAE1D,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIjE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAY1E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CASlF;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAS9E;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,IAAI,CAIxF;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAa5E;AAED,wBAAgB,iCAAiC,CAAC,MAAM,SAAS,oBAAoB,EACnF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,MAAM,CASR;AAED,+FAA+F;AAC/F,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,OAAO,EACd,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,GAC7C,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAwB3B;AAED,6EAA6E;AAC7E,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,IAAI,CAcpF;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAU7E;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,mBAAmB,GAAG,SAAS,GAAG,IAAI,CAS1F;AAED,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,GACpD,IAAI,CAyBN;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,SAAS,GAC7C,SAAS,MAAM,EAAE,CAcnB;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,SAAS,eAAe,EAAE,EAClC,QAAQ,EAAE,gBAAgB,GACzB,IAAI,CAWN;AA6HD,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,mBAAmB,EAAE,GACpC,IAAI,CAoBN"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/agents/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,KAAK,SAAS,EAAE,MAAM,SAAS,CAAA;AAClF,OAAO,EAIL,KAAK,SAAS,EAEf,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAA;AAE7E,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACvB,MAAM,SAAS,CAAA;AAehB,eAAO,MAAM,yBAAyB,wCAAyC,CAAA;AAE/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIjE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAY1E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CASlF;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAS9E;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,GAAG,IAAI,CAIxF;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAa5E;AAED,wBAAgB,iCAAiC,CAAC,MAAM,SAAS,oBAAoB,EACnF,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,MAAM,CASR;AAED,+FAA+F;AAC/F,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,oBAAoB,EAC3B,KAAK,EAAE,OAAO,EACd,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,GAC7C,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAwB3B;AAED,6EAA6E;AAC7E,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,IAAI,CAcpF;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAU7E;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,mBAAmB,GAAG,SAAS,GAAG,IAAI,CAS1F;AAED,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,GACpD,IAAI,CAyBN;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,SAAS,GAC7C,SAAS,MAAM,EAAE,CAcnB;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,SAAS,eAAe,EAAE,EAClC,QAAQ,EAAE,yBAAyB,GAClC,IAAI,CAWN;AA6HD,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,mBAAmB,EAAE,GACpC,IAAI,CAoBN"}

package/dist/auth/attribution.d.ts

@@ -0,0 +1,17 @@
+import type { AuthStorage } from "../storage/auth";
+import type { Principal } from "./types";
+/**
+ * Resolve the durable group-membership snapshot used to attribute admitted work.
+ *
+ * Authorization contexts can carry a token-restricted subset of the principal's groups, so they
+ * are deliberately not accepted here. Accounting attribution comes from auth storage whenever it
+ * is configured. A system principal, or a runtime with no durable auth storage, has no groups.
+ */
+export declare function snapshotRequesterGroupIds(input: {
+    readonly auth: AuthStorage | undefined;
+    readonly projectId: string;
+    readonly principal: Principal;
+}): Promise<readonly string[]>;
+/** Validate and canonicalize an immutable requester-group snapshot at a storage boundary. */
+export declare function normalizeRequesterGroupIds(groupIds: readonly string[]): readonly string[];
+//# sourceMappingURL=attribution.d.ts.map

package/dist/auth/attribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attribution.d.ts","sourceRoot":"","sources":["../../src/auth/attribution.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAExC;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAiB7B;AAED,6FAA6F;AAC7F,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM,EAAE,CAYzF"}

package/dist/auth/index.d.ts

@@ -1,5 +1,6 @@
 export type { AccessTokenCredential, AccessTokenKind, AccessTokenParts } from "./access-tokens";
 export { createAccessTokenCredential, formatAccessTokenValue, generateAccessTokenSecret, getBearerAccessTokenValue, hashAccessTokenSecret, PERSONAL_ACCESS_TOKEN_PREFIX, parseAccessTokenValue, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, } from "./access-tokens";
+export { normalizeRequesterGroupIds, snapshotRequesterGroupIds } from "./attribution";
 export type { AuthSessionAudience, AuthSessionAudienceOptions } from "./audience";
 export { DEFAULT_AUTH_SESSION_AUDIENCE, isValidAuthSessionAudience, resolveAuthSessionAudience, } from "./audience";
 export { clearCsrfCookieHeader, clearSessionCookieHeader, createCsrfCookieHeader, createSessionCookieHeader, DEFAULT_CSRF_COOKIE_NAME, DEFAULT_SESSION_COOKIE_NAME, getCookie, parseCookieHeader, resolveAuthCookieOptions, serializeCookie, shouldUseSecureCookies, } from "./cookies";

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAC/F,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EACrB,mCAAmC,GACpC,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AACjF,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,2BAA2B,EAC3B,SAAS,EACT,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,sBAAsB,GACvB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,QAAQ,CAAA;AACf,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,YAAY,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EACL,WAAW,EACX,8BAA8B,EAC9B,iCAAiC,EACjC,oCAAoC,EACpC,sCAAsC,EACtC,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,6CAA6C,EAC7C,mCAAmC,EACnC,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EACvB,0BAA0B,EAC1B,8BAA8B,EAC9B,oCAAoC,EACpC,qCAAqC,EACrC,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAC1B,8BAA8B,EAC9B,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,kCAAkC,EAClC,kCAAkC,EAClC,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,+BAA+B,EAC/B,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,SAAS,EACT,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,8BAA8B,EAC9B,oCAAoC,EACpC,qCAAqC,EACrC,eAAe,EACf,wBAAwB,EACxB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,EACL,gCAAgC,EAChC,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAC/F,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EACrB,mCAAmC,GACpC,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAA;AACrF,YAAY,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AACjF,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,2BAA2B,EAC3B,SAAS,EACT,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,sBAAsB,GACvB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,QAAQ,CAAA;AACf,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,YAAY,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EACL,WAAW,EACX,8BAA8B,EAC9B,iCAAiC,EACjC,oCAAoC,EACpC,sCAAsC,EACtC,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,6CAA6C,EAC7C,mCAAmC,EACnC,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EACvB,0BAA0B,EAC1B,8BAA8B,EAC9B,oCAAoC,EACpC,qCAAqC,EACrC,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAC1B,8BAA8B,EAC9B,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,kCAAkC,EAClC,kCAAkC,EAClC,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,+BAA+B,EAC/B,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,SAAS,EACT,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,8BAA8B,EAC9B,oCAAoC,EACpC,qCAAqC,EACrC,eAAe,EACf,wBAAwB,EACxB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,EACL,gCAAgC,EAChC,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,cAAc,CAAA"}

package/dist/auth/index.js

@@ -20,7 +20,11 @@ import {
   parseSessionCookieValue,
   principalsEqual,
   verifyDoubleSubmitCsrf
-} from "../chunk-xt6qx9sh.js";
+} from "../chunk-d2adj15j.js";
+import {
+  normalizeRequesterGroupIds,
+  snapshotRequesterGroupIds
+} from "../chunk-rhrbz7d4.js";
 import {
   AuthRuntimeError,
   DEFAULT_AUTH_INVITATION_TTL_MS,
@@ -47,12 +51,13 @@ import {
   serializeCookie,
   shouldUseSecureCookies
 } from "../chunk-xwnf87e1.js";
-import"../chunk-exrfbt2d.js";
-import"../chunk-m9w0artv.js";
-import"../chunk-be9vm29v.js";
+import"../chunk-4z3n1dzt.js";
+import"../chunk-0172wgm9.js";
+import"../chunk-t8t39h7v.js";
 import"../chunk-y64skrwp.js";
 export {
   verifyDoubleSubmitCsrf,
+  snapshotRequesterGroupIds,
   shouldUseSecureCookies,
   serializeCookie,
   resolveAuthSessionAudience,
@@ -62,6 +67,7 @@ export {
   parseSessionCookieValue,
   parseCookieHeader,
   parseAccessTokenValue,
+  normalizeRequesterGroupIds,
   isValidAuthSessionAudience,
   isOidcAuthStrategy,
   isMagicLinkAuthStrategy,
@@ -98,4 +104,4 @@ export {
   AuthRuntime
 };
 
-//# debugId=9FA99CC2ECAE9D7264756E2164756E21
+//# debugId=C5D50240BE5BE5E564756E2164756E21

package/dist/auth/index.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "9FA99CC2ECAE9D7264756E2164756E21",
+  "debugId": "C5D50240BE5BE5E564756E2164756E21",
   "names": []
 }

package/dist/auth/runtime.d.ts

@@ -1,5 +1,5 @@
 import { type AuthorizationContext } from "../authorization";
-import { type GroupReference, type SecurityRegistry } from "../security";
+import { type GroupReference, type SecurityDefinitionCatalog } from "../security";
 import type { Storage } from "../storage";
 import { type ResolvedAuthCookieOptions } from "./cookies";
 import type { AuthenticatedAuthSession, AuthenticatedRequestAuthSession, AuthenticatedUserRequestSession, AuthRequestResult, AuthSessionResolutionOptions, AuthSessionResult, AuthStrategy, CreateAccessTokenResult, CreatePersonalAccessTokenInput, CreateServiceAccountAccessTokenInput, CreateServiceAccountAccessTokenResult, CreateServiceAccountInput, CreateServiceAccountResult, DisableServiceAccountInput, DisableServiceAccountResult, GetInvitationOptionsResult, GetMembershipOptionsResult, InviteUserInput, InviteUserOptions, InviteUserResult, ListInvitationsInput, ListInvitationsResult, ListMembersInput, ListMembersResult, ListPersonalAccessTokensResult, ListServiceAccountAccessTokensInput, ListServiceAccountAccessTokensResult, ListServiceAccountsResult, MembershipCapabilities, Principal, ReactivateMemberInput, ReactivateMemberResult, RevokeAccessTokenResult, RevokeInvitationInput, RevokeInvitationResult, RevokePersonalAccessTokenInput, RevokeServiceAccountAccessTokenInput, RevokeServiceAccountAccessTokenResult, SecurityContext, SixbAuthConfig, SuspendMemberInput, SuspendMemberResult, UpdateMemberGroupsInput, UpdateMemberGroupsResult } from "./types";
@@ -7,7 +7,7 @@ export { DEFAULT_AUTH_INVITATION_TTL_MS, DEFAULT_AUTH_SESSION_CACHE_TTL_MS, DEFA
 export interface AuthRuntimeOptions {
     readonly projectId: string;
     readonly storage: Storage;
-    readonly security: SecurityRegistry;
+    readonly security: SecurityDefinitionCatalog;
     readonly config?: SixbAuthConfig;
 }
 export declare class AuthRuntime {
@@ -52,8 +52,8 @@ export declare class AuthRuntime {
     /**
      * Resolve the authenticated principal's authorization context for a request.
      *
-     * Grants resolve eagerly (`groups -> roles -> grants`, subtype-expanded), so
-     * the returned context supports synchronous set-lookup checks and `sixb.as()`.
+     * Grants resolve eagerly (`groups -> roles -> grants`, subtype-expanded), so the returned
+     * context supports synchronous checks when Core binds a request execution SDK.
      */
     createAuthorizationContext(request: Request, options?: AuthSessionResolutionOptions): Promise<AuthorizationContext>;
     /**

package/dist/auth/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/auth/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,oBAAoB,EAG1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAEL,KAAK,cAAc,EAKnB,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAmBzC,OAAO,EAEL,KAAK,yBAAyB,EAE/B,MAAM,WAAW,CAAA;AAIlB,OAAO,KAAK,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAC/B,iBAAiB,EACjB,4BAA4B,EAC5B,iBAAiB,EACjB,YAAY,EACZ,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,qCAAqC,EACrC,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAM1B,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,yBAAyB,EAEzB,sBAAsB,EACtB,SAAS,EACT,qBAAqB,EACrB,sBAAsB,EAEtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,8BAA8B,EAC9B,oCAAoC,EACpC,qCAAqC,EACrC,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,SAAS,CAAA;AAWhB,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,oCAAoC,EACpC,sCAAsC,EACtC,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,cAAc,CAAA;AAOrB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;CACjC;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;gBAEtC,OAAO,EAAE,kBAAkB;IAgBvC,SAAS,IAAI,OAAO;IAKpB,WAAW,IAAI,YAAY,GAAG,IAAI;IAIlC,sBAAsB,CAAC,GAAG,EAAE,IAAI,GAAG;QACjC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;QACxB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAA;KAClC;IAUD,gBAAgB,CAAC,OAAO,GAAE,4BAAiC,GAAG,yBAAyB;IAIvF,kBAAkB,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IAgC5D,UAAU,CACd,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,4BAA4B,GAAG;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAA;KAAE,GACjF,OAAO,CAAC,iBAAiB,CAAC;IACvB,UAAU,CACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,4BAA4B,GAAG;QAAE,QAAQ,CAAC,gBAAgB,EAAE,aAAa,GAAG,KAAK,CAAA;KAAE,GAC3F,OAAO,CAAC,iBAAiB,CAAC;IACvB,UAAU,CACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,iBAAiB,CAAC;YA+Bf,oBAAoB;IA4GlC,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,0BAA0B;YASpB,yBAAyB;IAwFvC;;;OAGG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;YAM5B,oBAAoB;YAgBpB,wBAAwB;IAwBhC,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,SAAS,CAAC;IASf,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,wBAAwB,CAAC;IAS9B,kBAAkB,CACtB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,+BAA+B,CAAC;IAarC,qBAAqB,CACzB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,eAAe,CAAC;IAU3B;;;;;OAKG;IACG,0BAA0B,CAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,oBAAoB,CAAC;IAShC;;;;OAIG;IACH,kBAAkB,CAAC,OAAO,EAAE,+BAA+B,GAAG,oBAAoB;IAS5E,wBAAwB,CAC5B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,8BAA8B,CAAC;IAgBpC,yBAAyB,CAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,uBAAuB,CAAC;IA0B7B,yBAAyB,CAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,uBAAuB,CAAC;IA2B7B,mBAAmB,CACvB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,yBAAyB,CAAC;IAwB/B,oBAAoB,CACxB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,yBAAyB,EAChC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,0BAA0B,CAAC;IAmChC,qBAAqB,CACzB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,0BAA0B,EACjC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,2BAA2B,CAAC;IAkBjC,8BAA8B,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,mCAAmC,EAC1C,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,oCAAoC,CAAC;IAqB1C,+BAA+B,CACnC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,oCAAoC,EAC3C,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,qCAAqC,CAAC;IAsC3C,+BAA+B,CACnC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,oCAAoC,EAC3C,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,qCAAqC,CAAC;IA+BjD;;;;;;;;;OASG;YACW,+BAA+B;YA0B/B,0BAA0B;IAWlC,oBAAoB,CACxB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,0BAA0B,CAAC;IAkBtC;;;;;;;OAOG;IACH,yBAAyB,CAAC,KAAK,EAAE;QAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,cAAc,EAAE,CAAA;KACjD,GAAG,sBAAsB;IAMpB,oBAAoB,CACxB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,0BAA0B,CAAC;IAWhC,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,KAAK,GAAE,gBAAqB,EAC5B,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,iBAAiB,CAAC;IA4CvB,kBAAkB,CACtB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,uBAAuB,EAC9B,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,wBAAwB,CAAC;IAqE9B,aAAa,CACjB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,mBAAmB,CAAC;IA0BzB,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,qBAAqB,EAC5B,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,sBAAsB,CAAC;IAkBlC,2EAA2E;IAC3E,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI5C,OAAO,CAAC,kBAAkB;IAW1B;;;;;;;OAOG;YACW,uBAAuB;IAuBrC,OAAO,CAAC,qBAAqB;IAavB,MAAM,CACV,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC;IA6DtB,eAAe,CACnB,OAAO,EAAE,OAAO,EAChB,KAAK,GAAE,oBAAyB,EAChC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,qBAAqB,CAAC;IAuB3B,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,qBAAqB,EAC5B,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,sBAAsB,CAAC;IAkClC,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,qBAAqB;IAwB7B,OAAO,CAAC,mCAAmC;IAO3C,OAAO,CAAC,iCAAiC;IAczC,OAAO,CAAC,iCAAiC;YAqB3B,wBAAwB;YAwBxB,oCAAoC;IAYlD,OAAO,CAAC,6BAA6B;IAgBrC,OAAO,CAAC,+BAA+B;CAuBxC"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/auth/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,oBAAoB,EAG1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAEL,KAAK,cAAc,EAKnB,KAAK,yBAAyB,EAC/B,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAmBzC,OAAO,EAEL,KAAK,yBAAyB,EAE/B,MAAM,WAAW,CAAA;AAIlB,OAAO,KAAK,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAC/B,iBAAiB,EACjB,4BAA4B,EAC5B,iBAAiB,EACjB,YAAY,EACZ,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,qCAAqC,EACrC,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAM1B,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,yBAAyB,EAEzB,sBAAsB,EACtB,SAAS,EACT,qBAAqB,EACrB,sBAAsB,EAEtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,8BAA8B,EAC9B,oCAAoC,EACpC,qCAAqC,EACrC,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,SAAS,CAAA;AAWhB,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,oCAAoC,EACpC,sCAAsC,EACtC,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,cAAc,CAAA;AAOrB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAA;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;CACjC;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2B;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;gBAEtC,OAAO,EAAE,kBAAkB;IAgBvC,SAAS,IAAI,OAAO;IAKpB,WAAW,IAAI,YAAY,GAAG,IAAI;IAIlC,sBAAsB,CAAC,GAAG,EAAE,IAAI,GAAG;QACjC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;QACxB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAA;KAClC;IAUD,gBAAgB,CAAC,OAAO,GAAE,4BAAiC,GAAG,yBAAyB;IAIvF,kBAAkB,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IAgC5D,UAAU,CACd,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,4BAA4B,GAAG;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAA;KAAE,GACjF,OAAO,CAAC,iBAAiB,CAAC;IACvB,UAAU,CACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,4BAA4B,GAAG;QAAE,QAAQ,CAAC,gBAAgB,EAAE,aAAa,GAAG,KAAK,CAAA;KAAE,GAC3F,OAAO,CAAC,iBAAiB,CAAC;IACvB,UAAU,CACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,iBAAiB,CAAC;YA+Bf,oBAAoB;IA4GlC,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,0BAA0B;YASpB,yBAAyB;IAwFvC;;;OAGG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;YAM5B,oBAAoB;YAgBpB,wBAAwB;IAwBhC,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,SAAS,CAAC;IASf,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,wBAAwB,CAAC;IAS9B,kBAAkB,CACtB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,+BAA+B,CAAC;IAarC,qBAAqB,CACzB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,eAAe,CAAC;IAU3B;;;;;OAKG;IACG,0BAA0B,CAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,oBAAoB,CAAC;IAShC;;;;OAIG;IACH,kBAAkB,CAAC,OAAO,EAAE,+BAA+B,GAAG,oBAAoB;IAS5E,wBAAwB,CAC5B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,8BAA8B,CAAC;IAgBpC,yBAAyB,CAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,uBAAuB,CAAC;IA0B7B,yBAAyB,CAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,uBAAuB,CAAC;IA2B7B,mBAAmB,CACvB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,yBAAyB,CAAC;IAwB/B,oBAAoB,CACxB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,yBAAyB,EAChC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,0BAA0B,CAAC;IAmChC,qBAAqB,CACzB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,0BAA0B,EACjC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,2BAA2B,CAAC;IAkBjC,8BAA8B,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,mCAAmC,EAC1C,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,oCAAoC,CAAC;IAqB1C,+BAA+B,CACnC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,oCAAoC,EAC3C,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,qCAAqC,CAAC;IAsC3C,+BAA+B,CACnC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,oCAAoC,EAC3C,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,qCAAqC,CAAC;IA+BjD;;;;;;;;;OASG;YACW,+BAA+B;YA0B/B,0BAA0B;IAWlC,oBAAoB,CACxB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,0BAA0B,CAAC;IAkBtC;;;;;;;OAOG;IACH,yBAAyB,CAAC,KAAK,EAAE;QAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,cAAc,EAAE,CAAA;KACjD,GAAG,sBAAsB;IAMpB,oBAAoB,CACxB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,0BAA0B,CAAC;IAWhC,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,KAAK,GAAE,gBAAqB,EAC5B,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,iBAAiB,CAAC;IA4CvB,kBAAkB,CACtB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,uBAAuB,EAC9B,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,wBAAwB,CAAC;IAqE9B,aAAa,CACjB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,mBAAmB,CAAC;IA0BzB,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,qBAAqB,EAC5B,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,sBAAsB,CAAC;IAkBlC,2EAA2E;IAC3E,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI5C,OAAO,CAAC,kBAAkB;IAW1B;;;;;;;OAOG;YACW,uBAAuB;IAuBrC,OAAO,CAAC,qBAAqB;IAavB,MAAM,CACV,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC;IA6DtB,eAAe,CACnB,OAAO,EAAE,OAAO,EAChB,KAAK,GAAE,oBAAyB,EAChC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,qBAAqB,CAAC;IAuB3B,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,qBAAqB,EAC5B,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,sBAAsB,CAAC;IAkClC,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,qBAAqB;IAwB7B,OAAO,CAAC,mCAAmC;IAO3C,OAAO,CAAC,iCAAiC;IAczC,OAAO,CAAC,iCAAiC;YAqB3B,wBAAwB;YAwBxB,oCAAoC;IAYlD,OAAO,CAAC,6BAA6B;IAgBrC,OAAO,CAAC,+BAA+B;CAuBxC"}

package/dist/authorization/decision.d.ts

@@ -5,17 +5,13 @@
  * index. `can` (boolean) and `assertAuthorized` (throw) are the two ways to
  * consume a decision; every enforcement site goes through one of them.
  *
- * A missing authorization context means a privileged caller (raw `sixb`,
- * syncs, workers, tests) — everything is allowed. Scoped contexts are
- * default-deny: a request without a covering grant is denied.
- *
- * SECURITY — this makes "privileged" the silent default: any caller that
- * reaches a leaf without an authorization context bypasses all grant checks.
- * That is intended for internal callers, but it means HTTP routes serving
- * authenticated principals must go through the scoped runtime (`sixb.as(ctx)`),
- * never the raw runtime. See `RequestAuthState` in the server for the rule.
+ * Every protected leaf first resolves the opaque runtime capability. Missing, forged, or
+ * unregistered authority is denied; only an explicitly registered trusted or disabled execution
+ * is unrestricted.
  */
 import type { AuthSessionAudience } from "../auth/audience";
+import { type ResolvedRuntimeAuthorization } from "../execution/authorization";
+import type { ExecutionContext, RuntimeAuthorization } from "../execution/types";
 import type { AuthorizationContext } from "./types";
 /** Something a principal may attempt, paired with the resource it targets. */
 export type AuthzRequest = {
@@ -50,6 +46,9 @@ export type AuthzRequest = {
     readonly agentId: string;
 } | {
     readonly kind: "logs.observe";
+} | {
+    readonly kind: "connector.manage";
+    readonly connectorId: string;
 } | {
     readonly kind: "object.query";
     readonly touchedObjectTypeIds: readonly string[];
@@ -62,12 +61,17 @@ export interface AuthzDecision {
     readonly missing: readonly string[];
 }
 interface AuthorizedRuntime {
+    readonly runtimeAuthorization?: RuntimeAuthorization;
     readonly authorization?: AuthorizationContext;
 }
 /** Resolve a request against a principal's grants. Never throws. */
 export declare function evaluate(authorization: AuthorizationContext | null | undefined, request: AuthzRequest): AuthzDecision;
 export declare function isAllowed(authorization: AuthorizationContext | null | undefined, request: AuthzRequest): boolean;
 export declare function assertAuthorized(runtime: AuthorizedRuntime, request: AuthzRequest): void;
+/** Resolve registered process-local authority before a protected leaf makes a decision. */
+export declare function assertRuntimeAuthorizationBound(runtime: AuthorizedRuntime): Exclude<ResolvedRuntimeAuthorization, {
+    readonly type: "denied";
+}>;
 /**
  * Assert a principal may write objects of this type.
  *
@@ -91,14 +95,23 @@ export declare function assertCanEdit(runtime: AuthorizedRuntime, objectTypeId:
  * ingestion service — expressible at all, and it is the reason telemetry has its own grant.
  */
 export declare function assertCanAppendTelemetry(runtime: AuthorizedRuntime, objectTypeId: string): void;
+/** Assert a principal may manage lifecycle state for this connector definition. */
+export declare function assertCanManageConnector(runtime: AuthorizedRuntime, connectorId: string): void;
 /**
  * Fail closed for operations that have no grant semantics yet.
  *
  * One caller left — `listLinks`, whose rows reveal target types that no read grant covers. Object,
  * link, and telemetry writes moved to {@link assertCanEdit} / {@link assertCanAppendTelemetry}.
- * Keeps unsupported surfaces denied even if a scoped runtime context reaches a code path the scoped
- * SDK does not expose.
+ * Keeps unsupported surfaces denied even if a principal-bound runtime context reaches a code path
+ * the execution SDK does not expose.
  */
 export declare function assertPrivileged(runtime: AuthorizedRuntime, operation: string): void;
+/**
+ * Assert access to process providers that trusted executions and genuine agent runs may use.
+ *
+ * Agent provenance alone is not authority: the registered capability must be bound to the exact
+ * same agent and run before this check succeeds.
+ */
+export declare function assertProviderAccess(runtime: AuthorizedRuntime, execution: ExecutionContext, operation: string): void;
 export {};
 //# sourceMappingURL=decision.d.ts.map

package/dist/authorization/decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/authorization/decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAG3D,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,SAAS,CAAA;AAE/D,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAEvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;CAC9C;AAiDD,oEAAoE;AACpE,wBAAgB,QAAQ,CACtB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,aAAa,CAOf;AAED,wBAAgB,SAAS,CACvB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,OAAO,CAET;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAUxF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAGpF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/F;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CASpF"}
+{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/authorization/decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EACL,KAAK,4BAA4B,EAElC,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAGhF,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,SAAS,CAAA;AAE/D,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAEvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;CAC9C;AAmDD,oEAAoE;AACpE,wBAAgB,QAAQ,CACtB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,aAAa,CAOf;AAED,wBAAgB,SAAS,CACvB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,OAAO,CAET;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAYxF;AAED,2FAA2F;AAC3F,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CASpE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAGpF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/F;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUpF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,MAAM,GAChB,IAAI,CAsBN"}

package/dist/authorization/grant-kinds.d.ts

@@ -8,7 +8,7 @@
  * entry in `GRANT_KINDS` plus the compile errors that forces at every consumer.
  */
 import type { GrantDefinition } from "../security/types";
-export type GrantKind = "access:application" | "view:object" | "view:dataset" | "edit:object" | "append:telemetry" | "apply:action" | "run:workflow" | "run:sync" | "run:pipeline" | "run:agent" | "observe:logs";
+export type GrantKind = "access:application" | "view:object" | "view:dataset" | "edit:object" | "append:telemetry" | "apply:action" | "run:workflow" | "run:sync" | "run:pipeline" | "run:agent" | "observe:logs" | "manage:connector";
 /** Registered id universes a grant kind ranges over, plus subtype expansion. */
 export interface GrantUniverse {
     readonly applicationIds: ReadonlySet<string>;
@@ -20,6 +20,7 @@ export interface GrantUniverse {
     readonly pipelineIds: ReadonlySet<string>;
     readonly agentIds: ReadonlySet<string>;
     readonly observableIds: ReadonlySet<string>;
+    readonly connectorIds: ReadonlySet<string>;
     readonly getSubTypes: (objectTypeId: string) => readonly string[];
 }
 /** The registered-id sets a grant kind validates against (no subtype hook). */

package/dist/authorization/grant-kinds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-kinds.d.ts","sourceRoot":"","sources":["../../src/authorization/grant-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,aAAa,GACb,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,cAAc,GACd,UAAU,GACV,cAAc,GACd,WAAW,GACX,cAAc,CAAA;AAElB,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CAClE;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,aAAa,EAAE,aAAa,CAAC,CAAA;AAE1E,UAAU,aAAa;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAChC;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,CA4DxD,CAAA;AAED,eAAO,MAAM,eAAe,EAA+B,SAAS,SAAS,EAAE,CAAA;AAE/E,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,CAiB7D;AAED,mEAAmE;AACnE,wBAAgB,cAAc,IAAI,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAM/D"}
+{"version":3,"file":"grant-kinds.d.ts","sourceRoot":"","sources":["../../src/authorization/grant-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,aAAa,GACb,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,cAAc,GACd,UAAU,GACV,cAAc,GACd,WAAW,GACX,cAAc,GACd,kBAAkB,CAAA;AAEtB,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CAClE;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,aAAa,EAAE,aAAa,CAAC,CAAA;AAE1E,UAAU,aAAa;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAChC;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,CAiExD,CAAA;AAED,eAAO,MAAM,eAAe,EAA+B,SAAS,SAAS,EAAE,CAAA;AAE/E,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,CAmB7D;AAED,mEAAmE;AACnE,wBAAgB,cAAc,IAAI,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAM/D"}

package/dist/authorization/index.d.ts

@@ -1,6 +1,6 @@
 export { canAccessApplication, isApplicationAccessControlled } from "./application-access";
 export type { AuthzDecision, AuthzRequest } from "./decision";
-export { assertAuthorized, assertCanAppendTelemetry, assertCanEdit, assertPrivileged, evaluate, isAllowed, } from "./decision";
+export { assertAuthorized, assertCanAppendTelemetry, assertCanEdit, assertCanManageConnector, assertPrivileged, assertProviderAccess, evaluate, isAllowed, } from "./decision";
 export { AuthorizationError } from "./errors";
 export { canViewEvent } from "./event-visibility";
 export type { GrantKind, GrantUniverse } from "./grant-kinds";

package/dist/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AAC1F,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,gBAAgB,EAChB,QAAQ,EACR,SAAS,GACV,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AAC1F,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,QAAQ,EACR,SAAS,GACV,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/authorization/index.js

@@ -4,7 +4,9 @@ import {
   assertAuthorized,
   assertCanAppendTelemetry,
   assertCanEdit,
+  assertCanManageConnector,
   assertPrivileged,
+  assertProviderAccess,
   canAccessApplication,
   canViewActionRun,
   canViewEvent,
@@ -19,9 +21,9 @@ import {
   isApplicationAccessControlled,
   resolveAuthorizationContext,
   resolveRoleGrants
-} from "../chunk-exrfbt2d.js";
-import"../chunk-m9w0artv.js";
-import"../chunk-be9vm29v.js";
+} from "../chunk-4z3n1dzt.js";
+import"../chunk-0172wgm9.js";
+import"../chunk-t8t39h7v.js";
 import"../chunk-y64skrwp.js";
 export {
   resolveRoleGrants,
@@ -38,11 +40,13 @@ export {
   canViewEvent,
   canViewActionRun,
   canAccessApplication,
+  assertProviderAccess,
   assertPrivileged,
+  assertCanManageConnector,
   assertCanEdit,
   assertCanAppendTelemetry,
   assertAuthorized,
   AuthorizationError
 };
 
-//# debugId=DAA8E258AFF4972564756E2164756E21
+//# debugId=DA0A7DB45C57EF1764756E2164756E21

package/dist/authorization/index.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "DAA8E258AFF4972564756E2164756E21",
+  "debugId": "DA0A7DB45C57EF1764756E2164756E21",
   "names": []
 }

package/dist/blob-storage/browser.js

@@ -8,8 +8,8 @@ import {
   blobIdFromDigest,
   isBlobDigest,
   isFileRef
-} from "../chunk-hz8m927w.js";
-import"../chunk-be9vm29v.js";
+} from "../chunk-zqysyfjt.js";
+import"../chunk-t8t39h7v.js";
 import"../chunk-y64skrwp.js";
 export {
   isFileRef,

package/dist/blob-storage/execution.d.ts

@@ -0,0 +1,16 @@
+import type { ExecutionContext } from "../execution";
+import type { SixbRuntimeContext } from "../runtime/types";
+import type { AbortBlobUploadInput, BlobByteRange, BlobInfo, BlobStorage, BlobUploadSession, CompleteBlobUploadInput, CreateBlobUploadInput, FileRef, PutBlobInput, SignBlobUploadPartInput, SignedBlobUploadPart } from "./types";
+/** Blob operations bound to one execution. Provider lifecycle is deliberately host-only. */
+export interface BlobsRuntime {
+    put(input: PutBlobInput): Promise<FileRef>;
+    open(blobId: string): Promise<ReadableStream<Uint8Array>>;
+    stat(blobId: string): Promise<BlobInfo | null>;
+    openRange?(blobId: string, range: BlobByteRange): Promise<ReadableStream<Uint8Array>>;
+    createUpload?(input: CreateBlobUploadInput): Promise<BlobUploadSession>;
+    signUploadPart?(input: SignBlobUploadPartInput): Promise<SignedBlobUploadPart>;
+    completeUpload?(input: CompleteBlobUploadInput): Promise<FileRef>;
+    abortUpload?(input: AbortBlobUploadInput): Promise<void>;
+}
+export declare function createBlobsRuntime(runtime: SixbRuntimeContext, execution: ExecutionContext, blobStorage: BlobStorage): BlobsRuntime;
+//# sourceMappingURL=execution.d.ts.map

package/dist/blob-storage/execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../src/blob-storage/execution.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACb,QAAQ,EACR,WAAW,EACX,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,OAAO,EACP,YAAY,EACZ,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,SAAS,CAAA;AAGhB,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;IAC9C,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;IACrF,YAAY,CAAC,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACvE,cAAc,CAAC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC9E,cAAc,CAAC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjE,WAAW,CAAC,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzD;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,WAAW,EAAE,WAAW,GACvB,YAAY,CA2Cd"}