@sixb/core 0.1.1 → 0.1.3

package/dist/connectors/connections/views.d.ts

@@ -0,0 +1,7 @@
+import type { ConnectorAuthorizationRecord, ConnectorConnectionRecord } from "../../storage";
+import type { ConnectorConnectionSelector } from "../types";
+import type { ConnectorConnectionView } from "./contracts";
+/** V1 accepts only project-owned slots; future owner kinds remain explicit extensions. */
+export declare function assertConnectorConnectionSelector(selector: ConnectorConnectionSelector): void;
+export declare function connectorConnectionView(connection: ConnectorConnectionRecord, status: ConnectorAuthorizationRecord["status"]): ConnectorConnectionView;
+//# sourceMappingURL=views.d.ts.map

package/dist/connectors/connections/views.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"views.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/views.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAA;AAE5F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAA;AAC3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAG1D,0FAA0F;AAC1F,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,2BAA2B,GAAG,IAAI,CAQ7F;AAED,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,yBAAyB,EACrC,MAAM,EAAE,4BAA4B,CAAC,QAAQ,CAAC,GAC7C,uBAAuB,CAgBzB"}

package/dist/connectors/credentials.d.ts

@@ -0,0 +1,25 @@
+export type ConnectorCredentialPurpose = "oauth-authorization" | "pkce-verifier";
+/** Immutable identity authenticated alongside one sealed connector credential. */
+export interface ConnectorCredentialContext {
+    readonly projectId: string;
+    readonly connectorId: string;
+    readonly recordId: string;
+    readonly purpose: ConnectorCredentialPurpose;
+}
+/** Versioned AEAD envelope safe to persist. */
+export interface SealedConnectorCredential {
+    readonly version: 1;
+    readonly algorithm: "A256GCM";
+    readonly nonce: string;
+    readonly ciphertext: string;
+    readonly tag: string;
+}
+/** Pluggable at-rest protection for connector OAuth credentials and transient PKCE secrets. */
+export interface ConnectorCredentialProtector {
+    seal(plaintext: Uint8Array, context: ConnectorCredentialContext): Promise<SealedConnectorCredential>;
+    open(envelope: SealedConnectorCredential, context: ConnectorCredentialContext): Promise<Uint8Array>;
+}
+/** Create credential protection from the base64url key exposed by Sixb configuration. */
+export declare function createConnectorCredentialProtectorFromKey(encodedKey: string): ConnectorCredentialProtector;
+export declare function createEphemeralConnectorCredentialProtector(): ConnectorCredentialProtector;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/connectors/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/connectors/credentials.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,0BAA0B,GAAG,qBAAqB,GAAG,eAAe,CAAA;AAEhF,kFAAkF;AAClF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAA;CAC7C;AAED,+CAA+C;AAC/C,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,+FAA+F;AAC/F,MAAM,WAAW,4BAA4B;IAC3C,IAAI,CACF,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACrC,IAAI,CACF,QAAQ,EAAE,yBAAyB,EACnC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,UAAU,CAAC,CAAA;CACvB;AAED,yFAAyF;AACzF,wBAAgB,yCAAyC,CACvD,UAAU,EAAE,MAAM,GACjB,4BAA4B,CAkB9B;AA+DD,wBAAgB,2CAA2C,IAAI,4BAA4B,CAE1F"}

package/dist/connectors/errors.d.ts

@@ -1,7 +1,13 @@
+import { type SixbCodedError, type SixbErrorOptions } from "../errors/internal";
+import type { SixbErrorCode } from "../errors/types";
+import { ConnectorConnectionStorageError } from "../storage/connector-connections/errors";
+type ConnectorCodedErrorCode = Extract<SixbErrorCode, `connector.${string}`> | "internal.unexpected";
 /**
- * Base error for the connectors module. Specific subclasses extend this
- * so callers can catch any connector-scoped failure with a single
- * `instanceof ConnectorError` check.
+ * Legacy authoring error for static connector definitions and lookup.
+ *
+ * Persistent connection lifecycle failures use the global `SixbErrorCode` contract instead.
+ * `ConnectorOAuthError` remains a class because adapters and Core need `instanceof` control flow at
+ * the provider-effect boundary.
  */
 export declare class ConnectorError extends Error {
     readonly name: string;
@@ -11,4 +17,30 @@ export declare class ConnectorNotFoundError extends ConnectorError {
     readonly name = "ConnectorNotFoundError";
     constructor(connectorId: string);
 }
+/**
+ * Provider mutation outcome reported by an OAuth adapter.
+ *
+ * `retryable` guarantees that the provider made no change. `terminal` means the current grant can
+ * no longer progress. `ambiguous` means the provider may have changed state; Core fails closed.
+ * This classifies the provider effect, not the final Sixb error retry policy: Core also accounts for
+ * one-use state, consumed authorization codes, and durable mutation phase before choosing a code.
+ */
+export type ConnectorOAuthErrorKind = "retryable" | "terminal" | "ambiguous";
+/** Adapter signal used by Core to decide whether a provider operation can be retried safely. */
+export declare class ConnectorOAuthError extends ConnectorError {
+    readonly kind: ConnectorOAuthErrorKind;
+    readonly name = "ConnectorOAuthError";
+    constructor(kind: ConnectorOAuthErrorKind, message: string, options?: ErrorOptions);
+}
+/** Internal factory for connector failures that cross a Sixb boundary. */
+export declare function createConnectorCodedError(code: ConnectorCodedErrorCode, message: string, options?: SixbErrorOptions): SixbCodedError;
+/** Internal failure used when a provider operation may have completed after Core lost its fence. */
+export declare function createAmbiguousProviderOperationError(options?: SixbErrorOptions): SixbCodedError;
+export declare function oauthErrorKind(error: unknown): ConnectorOAuthErrorKind;
+export declare function providerFailureCode(error: unknown): "connector.provider_failed" | "connector.provider_unavailable";
+export declare function providerBoundaryError(error: unknown, code: "connector.provider_failed" | "connector.provider_unavailable", message: string): Error;
+export declare function isConnectorStorageError(error: unknown, code?: ConnectorConnectionStorageError["code"]): error is ConnectorConnectionStorageError;
+export declare function storageBoundaryError(error: unknown, message: string): SixbCodedError;
+export declare function recoverConnectorFailure<T>(primaryError: unknown, message: string, recovery: () => Promise<T>): Promise<T>;
+export {};
 //# sourceMappingURL=errors.d.ts.map

package/dist/connectors/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/connectors/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAmB;CACzC;AAED,qBAAa,sBAAuB,SAAQ,cAAc;IAE5C,QAAQ,CAAC,WAAW,EAAE,MAAM;IADxC,SAAkB,IAAI,4BAA2B;gBAC5B,WAAW,EAAE,MAAM;CAGzC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/connectors/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAA;AAEzF,KAAK,uBAAuB,GAAG,OAAO,CAAC,aAAa,EAAE,aAAa,MAAM,EAAE,CAAC,GAAG,qBAAqB,CAAA;AAEpG;;;;;;GAMG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAmB;CACzC;AAED,qBAAa,sBAAuB,SAAQ,cAAc;IAE5C,QAAQ,CAAC,WAAW,EAAE,MAAM;IADxC,SAAkB,IAAI,4BAA2B;gBAC5B,WAAW,EAAE,MAAM;CAGzC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,UAAU,GAAG,WAAW,CAAA;AAE5E,gGAAgG;AAChG,qBAAa,mBAAoB,SAAQ,cAAc;IAInD,QAAQ,CAAC,IAAI,EAAE,uBAAuB;IAHxC,SAAkB,IAAI,yBAAwB;gBAGnC,IAAI,EAAE,uBAAuB,EACtC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY;CAIzB;AAED,0EAA0E;AAC1E,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,uBAAuB,EAC7B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,gBAAqB,GAC7B,cAAc,CAMhB;AAED,oGAAoG;AACpG,wBAAgB,qCAAqC,CACnD,OAAO,GAAE,gBAAqB,GAC7B,cAAc,CAMhB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAEtE;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,2BAA2B,GAAG,gCAAgC,CAIhE;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,2BAA2B,GAAG,gCAAgC,EACpE,OAAO,EAAE,MAAM,GACd,KAAK,CAGP;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,IAAI,CAAC,EAAE,+BAA+B,CAAC,MAAM,CAAC,GAC7C,KAAK,IAAI,+BAA+B,CAI1C;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAEpF;AAED,wBAAsB,uBAAuB,CAAC,CAAC,EAC7C,YAAY,EAAE,OAAO,EACrB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACzB,OAAO,CAAC,CAAC,CAAC,CAQZ"}

package/dist/connectors/execution.d.ts

@@ -0,0 +1,19 @@
+import type { ExecutionContext } from "../execution";
+import type { SixbRuntimeContext } from "../runtime/types";
+import type { ConnectorService } from "./service";
+import type { AnyConnectorAdapter, ConnectorAdapter, ConnectorClient, ConnectorConnectionMetadata, ConnectorConnectionSelector, ConnectorDefinition, OAuthConnectorAdapter } from "./types";
+/** Resolve a registered connector through one authorized execution. */
+export interface ConnectorRuntime {
+    <TAdapter extends ConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>): Promise<ConnectorClient<TAdapter>>;
+    <TAdapter extends OAuthConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>, selector: ConnectorConnectionSelector): Promise<ConnectorClient<TAdapter>>;
+}
+export interface ConnectorExecutionSource<TAdapter extends AnyConnectorAdapter = AnyConnectorAdapter> {
+    readonly connection?: ConnectorConnectionMetadata;
+    connect(signal: AbortSignal): Promise<ConnectorClient<TAdapter>>;
+}
+export interface ConnectorExecutionSourceResolver {
+    list<TAdapter extends AnyConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>): Promise<readonly ConnectorExecutionSource<TAdapter>[]>;
+}
+export declare function createConnectorRuntime(runtime: SixbRuntimeContext, execution: ExecutionContext, service: ConnectorService): ConnectorRuntime;
+export declare function getConnectorExecutionSourceResolver(connector: ConnectorRuntime): ConnectorExecutionSourceResolver;
+//# sourceMappingURL=execution.d.ts.map

package/dist/connectors/execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../src/connectors/execution.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAEpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AACjD,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,SAAS,CAAA;AAGhB,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,CAAC,QAAQ,SAAS,gBAAgB,EAChC,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,GAChD,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAA;IACrC,CAAC,QAAQ,SAAS,qBAAqB,EACrC,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,EACjD,QAAQ,EAAE,2BAA2B,GACpC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAA;CACtC;AAED,MAAM,WAAW,wBAAwB,CACvC,QAAQ,SAAS,mBAAmB,GAAG,mBAAmB;IAE1D,QAAQ,CAAC,UAAU,CAAC,EAAE,2BAA2B,CAAA;IACjD,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,gCAAgC;IAC/C,IAAI,CAAC,QAAQ,SAAS,mBAAmB,EACvC,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,GAChD,OAAO,CAAC,SAAS,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;CAC1D;AAID,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,gBAAgB,GACxB,gBAAgB,CAuDlB;AAaD,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,gBAAgB,GAC1B,gCAAgC,CAwBlC"}

package/dist/connectors/index.d.ts

@@ -1,5 +1,7 @@
 export { defineConnector } from "./builders";
-export { ConnectorError, ConnectorNotFoundError } from "./errors";
-export type { ConnectorAdapter, ConnectorClient, ConnectorContext, ConnectorDefinition, } from "./types";
-export { isConnectorDefinition } from "./types";
+export type { ConnectorOAuthErrorKind } from "./errors";
+export { ConnectorError, ConnectorNotFoundError, ConnectorOAuthError } from "./errors";
+export type { ConnectorRuntime } from "./execution";
+export type { AnyConnectorAdapter, ConnectorAccessToken, ConnectorAccountCandidate, ConnectorAdapter, ConnectorClient, ConnectorConnectionClientContext, ConnectorConnectionMetadata, ConnectorConnectionOptions, ConnectorConnectionOwner, ConnectorConnectionSelector, ConnectorContext, ConnectorDefinition, ConnectorOAuth2Authentication, ConnectorOAuthCredentials, ConnectorTokenSource, OAuthConnectorAdapter, OAuthConnectorAuthorizationContext, OAuthConnectorAuthorizationUrlInput, OAuthConnectorCodeExchangeInput, ProjectConnectorConnectionOwner, StaticConnectorDefinition, } from "./types";
+export { isConnectorDefinition, isOAuthConnectorAdapter, isOAuthConnectorDefinition, isStaticConnectorDefinition, } from "./types";
 //# sourceMappingURL=index.d.ts.map

package/dist/connectors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connectors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AACjE,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connectors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,YAAY,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACtF,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,gCAAgC,EAChC,2BAA2B,EAC3B,0BAA0B,EAC1B,wBAAwB,EACxB,2BAA2B,EAC3B,gBAAgB,EAChB,mBAAmB,EACnB,6BAA6B,EAC7B,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,kCAAkC,EAClC,mCAAmC,EACnC,+BAA+B,EAC/B,+BAA+B,EAC/B,yBAAyB,GAC1B,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,SAAS,CAAA"}

package/dist/connectors/service.d.ts

@@ -0,0 +1,23 @@
+import type { ConnectorConnectionRecord } from "../storage";
+import type { ConnectorConnectionProcess } from "./connections/contracts";
+import { type ConnectorConnectionServiceOptions } from "./connections/service";
+import type { ConnectorAdapter, ConnectorClient, ConnectorConnectionSelector, ConnectorDefinition, OAuthConnectorAdapter } from "./types";
+export type ConnectorServiceOptions = ConnectorConnectionServiceOptions;
+/** Process-owned facade for static clients and persistent connector connections. */
+export declare class ConnectorService {
+    private readonly projectId;
+    private readonly definitionsById;
+    private readonly staticConnectionStates;
+    private readonly connections?;
+    constructor(projectId: string, definitions: readonly ConnectorDefinition[], options?: ConnectorServiceOptions);
+    connect<TAdapter extends ConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>): Promise<ConnectorClient<TAdapter>>;
+    connectConnection<TAdapter extends OAuthConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>, selector: ConnectorConnectionSelector): Promise<ConnectorClient<TAdapter>>;
+    listExecutionConnections<TAdapter extends OAuthConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>): Promise<readonly ConnectorConnectionRecord[]>;
+    connectExecutionConnection<TAdapter extends OAuthConnectorAdapter>(definition: ConnectorDefinition<string, TAdapter>, connection: ConnectorConnectionRecord, signal?: AbortSignal): Promise<ConnectorClient<TAdapter>>;
+    get connectionProcess(): ConnectorConnectionProcess | undefined;
+    close(): Promise<void>;
+    private assertRegistered;
+    private requireConnections;
+    private disconnectStaticState;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/connectors/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/connectors/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA;AAC3D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,SAAS,CAAA;AAGhB,MAAM,MAAM,uBAAuB,GAAG,iCAAiC,CAAA;AAOvE,oFAAoF;AACpF,qBAAa,gBAAgB;IASzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAR5B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAGpC;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAA4B;gBAGtC,SAAS,EAAE,MAAM,EAClC,WAAW,EAAE,SAAS,mBAAmB,EAAE,EAC3C,OAAO,GAAE,uBAA4B;IAQjC,OAAO,CAAC,QAAQ,SAAS,gBAAgB,EAC7C,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,GAChD,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IA2BrC,iBAAiB,CAAC,QAAQ,SAAS,qBAAqB,EACtD,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,EACjD,QAAQ,EAAE,2BAA2B,GACpC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAIrC,wBAAwB,CAAC,QAAQ,SAAS,qBAAqB,EAC7D,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,GAChD,OAAO,CAAC,SAAS,yBAAyB,EAAE,CAAC;IAIhD,0BAA0B,CAAC,QAAQ,SAAS,qBAAqB,EAC/D,UAAU,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,EACjD,UAAU,EAAE,yBAAyB,EACrC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAIrC,IAAI,iBAAiB,IAAI,0BAA0B,GAAG,SAAS,CAE9D;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,kBAAkB;YAUZ,qBAAqB;CAepC"}

package/dist/connectors/types.d.ts

@@ -18,22 +18,114 @@ export interface ConnectorContext {
  */
 export interface ConnectorAdapter<TType extends string = string, TClient = unknown> {
     readonly type: TType;
+    readonly authentication?: never;
     readonly webhooks?: readonly WebhookDefinition<unknown, TClient>[];
     connect(context: ConnectorContext): Promise<TClient> | TClient;
     disconnect?(client: TClient): Promise<void> | void;
 }
+/** One OAuth token set normalized by an OAuth connector adapter. */
+export interface ConnectorOAuthCredentials {
+    readonly accessToken: string;
+    readonly refreshToken?: string;
+    readonly tokenType?: string;
+    readonly scopes?: readonly string[];
+    readonly expiresAt?: Date;
+}
+/** Public, non-secret account information returned for framework-owned selection UI. */
+export interface ConnectorAccountCandidate {
+    readonly id: string;
+    readonly label: string;
+    readonly description?: string;
+    readonly avatarUrl?: string;
+}
+/** V1 intentionally supports project-owned connector connections only. */
+export interface ProjectConnectorConnectionOwner {
+    readonly type: "project";
+}
+export type ConnectorConnectionOwner = ProjectConnectorConnectionOwner;
+/** Stable application-defined lookup key for one connector connection. */
+export interface ConnectorConnectionSelector {
+    readonly owner: ConnectorConnectionOwner;
+    readonly slot: string;
+}
+/** Stable, non-secret metadata shared by connector connection consumers. */
+export interface ConnectorConnectionMetadata extends ConnectorConnectionSelector {
+    readonly id: string;
+    readonly connectorId: string;
+    readonly account: ConnectorAccountCandidate;
+}
+/** Credential protection required when an OAuth connector uses durable connection storage. */
+export interface ConnectorConnectionOptions {
+    /** Canonical base64url encoding of exactly 32 random bytes, shared by storage replicas. */
+    readonly encryptionKey: string;
+}
+export interface OAuthConnectorAuthorizationContext extends ConnectorContext {
+    readonly redirectUri: string;
+}
+export interface OAuthConnectorAuthorizationUrlInput {
+    readonly state: string;
+    readonly codeChallenge: string;
+    readonly codeChallengeMethod: "S256";
+}
+export interface OAuthConnectorCodeExchangeInput {
+    readonly code: string;
+    readonly codeVerifier: string;
+}
+export interface ConnectorConnectionClientContext extends ConnectorContext {
+    readonly connectionId: string;
+    readonly account: ConnectorAccountCandidate;
+    readonly tokenSource: ConnectorTokenSource;
+}
+/** One delivered token, bound to the credential revision that produced it. */
+export interface ConnectorAccessToken {
+    readonly accessToken: string;
+    readonly tokenType?: string;
+    /** Report this exact token as rejected so Sixb can refresh only its credential revision. */
+    invalidate(): void;
+}
+/** Live credential source owned by Sixb. Adapters must resolve a token for each request. */
+export interface ConnectorTokenSource {
+    get(): Promise<ConnectorAccessToken>;
+}
+/**
+ * OAuth-backed connector adapter. Sixb owns persistence, OAuth state, refresh coordination and UI;
+ * the adapter owns provider protocol details and typed client creation.
+ */
+export interface ConnectorOAuth2Authentication {
+    readonly type: "oauth2";
+    authorizationUrl(context: OAuthConnectorAuthorizationContext, input: OAuthConnectorAuthorizationUrlInput): Promise<string | URL> | string | URL;
+    exchangeCode(context: OAuthConnectorAuthorizationContext, input: OAuthConnectorCodeExchangeInput): Promise<ConnectorOAuthCredentials> | ConnectorOAuthCredentials;
+    refresh(context: ConnectorContext, credentials: ConnectorOAuthCredentials): Promise<ConnectorOAuthCredentials> | ConnectorOAuthCredentials;
+    /**
+     * Revokes the grant idempotently. An already revoked or invalid grant must resolve successfully
+     * so Sixb can converge after losing an earlier provider response.
+     */
+    revoke?(context: ConnectorContext, credentials: ConnectorOAuthCredentials): Promise<void> | void;
+}
+export interface OAuthConnectorAdapter<TType extends string = string, TClient = unknown> {
+    readonly type: TType;
+    readonly authentication: ConnectorOAuth2Authentication;
+    readonly webhooks?: undefined;
+    discoverAccounts(context: ConnectorContext, credentials: ConnectorOAuthCredentials): Promise<readonly ConnectorAccountCandidate[]> | readonly ConnectorAccountCandidate[];
+    connect(context: ConnectorConnectionClientContext): Promise<TClient> | TClient;
+}
+export type AnyConnectorAdapter = ConnectorAdapter | OAuthConnectorAdapter;
 /**
  * Inert connector definition registered with Sixb.
  *
  * Definitions are safe to export from `connectors/` modules. The runtime turns them into
  * live clients when `sixb.connector(...)` is called.
  */
-export interface ConnectorDefinition<TId extends string = string, TAdapter extends ConnectorAdapter = ConnectorAdapter> {
+export interface ConnectorDefinition<TId extends string = string, TAdapter extends AnyConnectorAdapter = AnyConnectorAdapter> {
     readonly kind: "connector";
     readonly id: TId;
     readonly adapter: TAdapter;
 }
+export type StaticConnectorDefinition = ConnectorDefinition<string, ConnectorAdapter>;
 /** Infer the connected client type returned by a connector adapter. */
-export type ConnectorClient<TAdapter extends ConnectorAdapter> = Awaited<ReturnType<TAdapter["connect"]>>;
+export type ConnectorClient<TAdapter extends AnyConnectorAdapter> = Awaited<ReturnType<TAdapter["connect"]>>;
+export declare function isOAuthConnectorAdapter(value: AnyConnectorAdapter): value is OAuthConnectorAdapter;
+export declare function isOAuthConnectorDefinition(value: ConnectorDefinition): value is ConnectorDefinition<string, OAuthConnectorAdapter>;
+export declare function isStaticConnectorDefinition(value: ConnectorDefinition): value is StaticConnectorDefinition;
 export declare function isConnectorDefinition(value: unknown): value is ConnectorDefinition;
 //# sourceMappingURL=types.d.ts.map

package/dist/connectors/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/connectors/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM,EAAE,OAAO,GAAG,OAAO;IAChF,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAA;IAClE,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAC9D,UAAU,CAAC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CACnD;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB,CAClC,GAAG,SAAS,MAAM,GAAG,MAAM,EAC3B,QAAQ,SAAS,gBAAgB,GAAG,gBAAgB;IAEpD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAC3B;AAED,uEAAuE;AACvE,MAAM,MAAM,eAAe,CAAC,QAAQ,SAAS,gBAAgB,IAAI,OAAO,CACtE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAChC,CAAA;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAYlF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/connectors/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM,EAAE,OAAO,GAAG,OAAO;IAChF,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,cAAc,CAAC,EAAE,KAAK,CAAA;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAA;IAClE,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAC9D,UAAU,CAAC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CACnD;AAED,oEAAoE;AACpE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAA;CAC1B;AAED,wFAAwF;AACxF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,0EAA0E;AAC1E,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CACzB;AAED,MAAM,MAAM,wBAAwB,GAAG,+BAA+B,CAAA;AAEtE,0EAA0E;AAC1E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAA;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,2BAA4B,SAAQ,2BAA2B;IAC9E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;CAC5C;AAED,8FAA8F;AAC9F,MAAM,WAAW,0BAA0B;IACzC,2FAA2F;IAC3F,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,kCAAmC,SAAQ,gBAAgB;IAC1E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;CACrC;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,gCAAiC,SAAQ,gBAAgB;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;IAC3C,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAA;CAC3C;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,4FAA4F;IAC5F,UAAU,IAAI,IAAI,CAAA;CACnB;AAED,4FAA4F;AAC5F,MAAM,WAAW,oBAAoB;IACnC,GAAG,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAA;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,gBAAgB,CACd,OAAO,EAAE,kCAAkC,EAC3C,KAAK,EAAE,mCAAmC,GACzC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,GAAG,GAAG,CAAA;IACvC,YAAY,CACV,OAAO,EAAE,kCAAkC,EAC3C,KAAK,EAAE,+BAA+B,GACrC,OAAO,CAAC,yBAAyB,CAAC,GAAG,yBAAyB,CAAA;IACjE,OAAO,CACL,OAAO,EAAE,gBAAgB,EACzB,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAAC,yBAAyB,CAAC,GAAG,yBAAyB,CAAA;IACjE;;;OAGG;IACH,MAAM,CAAC,CAAC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CACjG;AAED,MAAM,WAAW,qBAAqB,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM,EAAE,OAAO,GAAG,OAAO;IACrF,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,cAAc,EAAE,6BAA6B,CAAA;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;IAC7B,gBAAgB,CACd,OAAO,EAAE,gBAAgB,EACzB,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAAC,SAAS,yBAAyB,EAAE,CAAC,GAAG,SAAS,yBAAyB,EAAE,CAAA;IACvF,OAAO,CAAC,OAAO,EAAE,gCAAgC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;CAC/E;AAED,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,qBAAqB,CAAA;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB,CAClC,GAAG,SAAS,MAAM,GAAG,MAAM,EAC3B,QAAQ,SAAS,mBAAmB,GAAG,mBAAmB;IAE1D,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAC3B;AAED,MAAM,MAAM,yBAAyB,GAAG,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;AAErF,uEAAuE;AACvE,MAAM,MAAM,eAAe,CAAC,QAAQ,SAAS,mBAAmB,IAAI,OAAO,CACzE,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAChC,CAAA;AAED,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,mBAAmB,GACzB,KAAK,IAAI,qBAAqB,CAEhC;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,mBAAmB,GACzB,KAAK,IAAI,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAE7D;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,mBAAmB,GACzB,KAAK,IAAI,yBAAyB,CAEpC;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAyBlF"}

package/dist/datasets/execution.d.ts

@@ -0,0 +1,8 @@
+import type { SixbRuntimeContext } from "../runtime/types";
+import type { DatasetDefinition } from "./types";
+export interface DatasetsRuntime {
+    list(): readonly DatasetDefinition[];
+    getById(datasetId: string): DatasetDefinition | null;
+}
+export declare function createDatasetsRuntime(runtime: Pick<SixbRuntimeContext, "authorization">, source: Pick<DatasetsRuntime, "list" | "getById">): DatasetsRuntime;
+//# sourceMappingURL=execution.d.ts.map

package/dist/datasets/execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../src/datasets/execution.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAEhD,MAAM,WAAW,eAAe;IAC9B,IAAI,IAAI,SAAS,iBAAiB,EAAE,CAAA;IACpC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAAA;CACrD;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,EAClD,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC,GAChD,eAAe,CAWjB"}

package/dist/error-reporting/capability.d.ts

@@ -1,57 +1,12 @@
 import { SixbErrorReporter } from "./reporter";
-import type { SixbErrorHandler, SixbFailedRun } from "./types";
+import { type ReportActionPhaseFailureInput, type ReportEventDeliveryFailureInput, type ReportRuleEvaluationFailureInput, type ReportRunFailureInput } from "./reports";
+import type { SixbErrorHandler } from "./types";
 export declare function attachSixbErrorReporter(host: object, handler?: SixbErrorHandler): SixbErrorReporter;
 export declare function shareSixbErrorReporter(source: object, target: object): void;
-export interface ReportRunFailureInput {
-    readonly projectId: string;
-    readonly run: SixbFailedRun;
-    readonly occurredAt?: Date | string;
-    readonly attempt?: number;
-}
+export type { ReportActionPhaseFailureInput, ReportEventDeliveryFailureInput, ReportRuleEvaluationFailureInput, ReportRunFailureInput, };
+export declare function reportActionPhaseFailure(host: unknown, error: unknown, input: ReportActionPhaseFailureInput): void;
 export declare function reportRunFailure(host: unknown, error: unknown, input: ReportRunFailureInput): void;
-export interface ReportEventDeliveryFailureInput {
-    readonly projectId: string;
-    /** Event types that never reached subscribers. Payloads must not be passed in. */
-    readonly eventTypes: readonly string[];
-    readonly occurredAt?: Date | string;
-    /** Delivery attempts so far. Defaults to 1, which is right for a rejected emit. */
-    readonly attempts?: number;
-    /** Envelope ids, when the events were persisted before delivery failed. */
-    readonly eventIds?: readonly string[];
-    /**
-     * Identity of this loss, used only when nothing was persisted. Defaults to a fresh id; pass one to
-     * make a report reproducible in a test.
-     */
-    readonly occurrenceId?: string;
-}
-/**
- * Report that domain events were lost.
- *
- * Both delivery paths land here: the outbox dispatcher, which has persisted envelope ids and retries,
- * and a rejected `events.emit()`, which has only the types. Reporting must work for both — an earlier
- * version returned early on an empty `eventIds`, which silently dropped exactly the case this exists
- * to surface.
- *
- * Each path keys on the strongest identity it has. The outbox persisted its envelopes, so the ids plus
- * the attempt number name the loss exactly and stay stable if one report is delivered twice. A rejected
- * emit persisted nothing and is always terminal at attempt 1, so the type list alone was its whole
- * correlation — and two schedules losing `schedule.triggered` in the same broker outage are dispatched
- * concurrently, land in the same millisecond, and were therefore one notification. A timestamp does not
- * fix that; an identity does.
- */
 export declare function reportEventDeliveryFailure(host: unknown, error: unknown, input: ReportEventDeliveryFailureInput): void;
-export interface ReportRuleEvaluationFailureInput {
-    readonly projectId: string;
-    readonly source: "live" | "reconciliation";
-    readonly eventIds?: readonly string[];
-    readonly occurredAt?: Date | string;
-    /** Set when the failure could be attributed to one rule/subject candidate. */
-    readonly ruleId?: string;
-    readonly subject?: {
-        readonly objectTypeId: string;
-        readonly primaryId: string;
-    };
-}
 export declare function reportRuleEvaluationFailure(host: unknown, error: unknown, input: ReportRuleEvaluationFailureInput): void;
 export declare function flushSixbErrors(host: unknown, timeoutMs?: number): Promise<void>;
 //# sourceMappingURL=capability.d.ts.map

package/dist/error-reporting/capability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/error-reporting/capability.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAoB9D,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,gBAAgB,GACzB,iBAAiB,CAInB;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAG3E;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAA;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,qBAAqB,GAC3B,IAAI,CAaN;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;IACnC,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,+BAA+B,GACrC,IAAI,CAoBN;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAA;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;CACjF;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,gCAAgC,GACtC,IAAI,CAsBN;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtF"}
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/error-reporting/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,+BAA+B,EACpC,KAAK,gCAAgC,EACrC,KAAK,qBAAqB,EAK3B,MAAM,WAAW,CAAA;AAClB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAoB/C,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,gBAAgB,GACzB,iBAAiB,CAInB;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAG3E;AAED,YAAY,EACV,6BAA6B,EAC7B,+BAA+B,EAC/B,gCAAgC,EAChC,qBAAqB,GACtB,CAAA;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,6BAA6B,GACnC,IAAI,CAEN;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,qBAAqB,GAC3B,IAAI,CAEN;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,+BAA+B,GACrC,IAAI,CAEN;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,gCAAgC,GACtC,IAAI,CAEN;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtF"}

package/dist/error-reporting/internal.d.ts

@@ -1,4 +1,4 @@
-export { attachSixbErrorReporter, flushSixbErrors, type ReportEventDeliveryFailureInput, type ReportRuleEvaluationFailureInput, type ReportRunFailureInput, reportEventDeliveryFailure, reportRuleEvaluationFailure, reportRunFailure, shareSixbErrorReporter, } from "./capability";
+export { attachSixbErrorReporter, flushSixbErrors, type ReportActionPhaseFailureInput, type ReportEventDeliveryFailureInput, type ReportRuleEvaluationFailureInput, type ReportRunFailureInput, reportActionPhaseFailure, reportEventDeliveryFailure, reportRuleEvaluationFailure, reportRunFailure, shareSixbErrorReporter, } from "./capability";
 export { normalizeReportedError } from "./normalize";
-export { SixbErrorReporter } from "./reporter";
+export { type ErrorReporter, SixbErrorReporter } from "./reporter";
 //# sourceMappingURL=internal.d.ts.map

package/dist/error-reporting/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../src/error-reporting/internal.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,KAAK,+BAA+B,EACpC,KAAK,gCAAgC,EACrC,KAAK,qBAAqB,EAC1B,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../src/error-reporting/internal.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,KAAK,6BAA6B,EAClC,KAAK,+BAA+B,EACpC,KAAK,gCAAgC,EACrC,KAAK,qBAAqB,EAC1B,wBAAwB,EACxB,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,KAAK,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA"}

package/dist/error-reporting/internal.js

@@ -1,24 +1,30 @@
 // @bun
 import {
-  SixbErrorReporter,
   attachSixbErrorReporter,
   flushSixbErrors,
-  normalizeReportedError,
+  reportActionPhaseFailure,
   reportEventDeliveryFailure,
   reportRuleEvaluationFailure,
   reportRunFailure,
   shareSixbErrorReporter
-} from "../chunk-t72dvahb.js";
+} from "../chunk-dsrkgtnh.js";
+import {
+  SixbErrorReporter,
+  normalizeReportedError
+} from "../chunk-bhxaq2nn.js";
+import"../chunk-0172wgm9.js";
+import"../chunk-t8t39h7v.js";
 import"../chunk-y64skrwp.js";
 export {
   shareSixbErrorReporter,
   reportRunFailure,
   reportRuleEvaluationFailure,
   reportEventDeliveryFailure,
+  reportActionPhaseFailure,
   normalizeReportedError,
   flushSixbErrors,
   attachSixbErrorReporter,
   SixbErrorReporter
 };
 
-//# debugId=2BF0D45A2FAF6DA264756E2164756E21
+//# debugId=8B5B580D1390CFC964756E2164756E21

package/dist/error-reporting/internal.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "2BF0D45A2FAF6DA264756E2164756E21",
+  "debugId": "8B5B580D1390CFC964756E2164756E21",
   "names": []
 }

package/dist/error-reporting/reporter.d.ts

@@ -1,6 +1,9 @@
 import type { SixbErrorContext, SixbErrorHandler } from "./types";
+export interface ErrorReporter {
+    report(error: unknown, context: SixbErrorContext): void;
+}
 /** Failure-isolated, non-blocking adapter around the configured callback. */
-export declare class SixbErrorReporter {
+export declare class SixbErrorReporter implements ErrorReporter {
     private readonly handler?;
     private readonly pending;
     constructor(handler?: SixbErrorHandler | undefined);

package/dist/error-reporting/reporter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reporter.d.ts","sourceRoot":"","sources":["../../src/error-reporting/reporter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAIjE,6EAA6E;AAC7E,qBAAa,iBAAiB;IAGhB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAFrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;gBAEtB,OAAO,CAAC,EAAE,gBAAgB,YAAA;IAEvD,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI;IAoBjD,KAAK,CAAC,SAAS,SAA2B,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBjE"}
+{"version":3,"file":"reporter.d.ts","sourceRoot":"","sources":["../../src/error-reporting/reporter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAIjE,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAA;CACxD;AAED,6EAA6E;AAC7E,qBAAa,iBAAkB,YAAW,aAAa;IAGzC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAFrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;gBAEtB,OAAO,CAAC,EAAE,gBAAgB,YAAA;IAEvD,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI;IAwBjD,KAAK,CAAC,SAAS,SAA2B,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBjE"}

package/dist/error-reporting/reports.d.ts

@@ -0,0 +1,64 @@
+import type { SixbFailure } from "../errors/types";
+import type { ActionRunFailure } from "../storage/action-runs";
+import type { ErrorReporter } from "./reporter";
+import type { SixbFailedRun } from "./types";
+export type ReportRunFailureInput = SixbFailedRun & {
+    readonly projectId: string;
+    readonly attempt?: number;
+};
+export declare function reportRunFailure(reporter: ErrorReporter, error: unknown, input: ReportRunFailureInput): void;
+export interface ReportActionPhaseFailureInput {
+    readonly projectId: string;
+    readonly actionId: string;
+    readonly runId: string;
+    readonly phase: "effects";
+    readonly failure: ActionRunFailure<"effects">;
+}
+export declare function reportActionPhaseFailure(reporter: ErrorReporter, error: unknown, input: ReportActionPhaseFailureInput): void;
+export interface ReportEventDeliveryFailureInput {
+    readonly projectId: string;
+    /** Exact durable failure when this delivery was persisted by the ontology outbox. */
+    readonly failure?: SixbFailure<"event.delivery_failed">;
+    /** Event types that never reached subscribers. Payloads must not be passed in. */
+    readonly eventTypes: readonly string[];
+    readonly occurredAt?: Date | string;
+    /** Delivery attempts so far. Defaults to 1, which is right for a rejected emit. */
+    readonly attempts?: number;
+    /** Envelope ids, when the events were persisted before delivery failed. */
+    readonly eventIds?: readonly string[];
+    /**
+     * Identity of this loss, used only when nothing was persisted. Defaults to a fresh id; pass one to
+     * make a report reproducible in a test.
+     */
+    readonly occurrenceId?: string;
+}
+/**
+ * Report that domain events were lost.
+ *
+ * Both delivery paths land here: the outbox dispatcher, which has persisted envelope ids and retries,
+ * and a rejected `events.emit()`, which has only the types. Reporting must work for both — an earlier
+ * version returned early on an empty `eventIds`, which silently dropped exactly the case this exists
+ * to surface.
+ *
+ * Each path keys on the strongest identity it has. The outbox persisted its envelopes, so the ids plus
+ * the attempt number name the loss exactly and stay stable if one report is delivered twice. A rejected
+ * emit persisted nothing and is always terminal at attempt 1, so the type list alone was its whole
+ * correlation — and two schedules losing `schedule.triggered` in the same broker outage are dispatched
+ * concurrently, land in the same millisecond, and were therefore one notification. A timestamp does not
+ * fix that; an identity does.
+ */
+export declare function reportEventDeliveryFailure(reporter: ErrorReporter, error: unknown, input: ReportEventDeliveryFailureInput): void;
+export interface ReportRuleEvaluationFailureInput {
+    readonly projectId: string;
+    readonly source: "live" | "reconciliation";
+    readonly eventIds?: readonly string[];
+    readonly occurredAt?: Date | string;
+    /** Set when the failure could be attributed to one rule/subject candidate. */
+    readonly ruleId?: string;
+    readonly subject?: {
+        readonly objectTypeId: string;
+        readonly primaryId: string;
+    };
+}
+export declare function reportRuleEvaluationFailure(reporter: ErrorReporter, error: unknown, input: ReportRuleEvaluationFailureInput): void;
+//# sourceMappingURL=reports.d.ts.map

package/dist/error-reporting/reports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reports.d.ts","sourceRoot":"","sources":["../../src/error-reporting/reports.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAO5C,MAAM,MAAM,qBAAqB,GAAG,aAAa,GAAG;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B,CAAA;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,qBAAqB,GAC3B,IAAI,CAQN;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAA;CAC9C;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,6BAA6B,GACnC,IAAI,CAWN;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,uBAAuB,CAAC,CAAA;IACvD,kFAAkF;IAClF,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;IACnC,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,+BAA+B,GACrC,IAAI,CA+BN;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAA;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;CACjF;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,gCAAgC,GACtC,IAAI,CA+BN"}