@sixb/core 0.1.10 → 0.1.12

package/dist/chunk-y0v18c2j.js

@@ -0,0 +1,363 @@
+// @bun
+import {
+  assertValidSchema
+} from "./chunk-p6r1ex7t.js";
+import {
+  normalizeParams,
+  coerceParamsToTyped
+} from "./chunk-y3ev53cq.js";
+import {
+  isPlainRecord
+} from "./chunk-wy0qdqfm.js";
+
+// src/sandboxes/errors.ts
+class SandboxError2 extends Error {
+  name = "SandboxError";
+}
+
+class SandboxStateUnavailableError2 extends SandboxError2 {
+  name = "SandboxStateUnavailableError";
+}
+
+class SandboxNotRunningError2 extends SandboxError2 {
+  name = "SandboxNotRunningError";
+}
+
+class SandboxTimeoutError2 extends SandboxError2 {
+  name = "SandboxTimeoutError";
+}
+
+class SandboxIsolationUnavailableError2 extends SandboxError2 {
+  name = "SandboxIsolationUnavailableError";
+}
+
+// src/sandboxes/configuration.ts
+function createSandboxDefinition(config, ontology) {
+  const raw = config;
+  if (!isPlainRecord(raw) || config.params !== undefined && !isPlainRecord(raw.params) || config.resolve !== undefined && typeof config.resolve !== "function") {
+    throw new SandboxError2("[Sixb] Sandbox configuration requires a params object and a callable resolver when provided.");
+  }
+  for (const key of Object.keys(config)) {
+    if (!["params", "resolve", "source", "setup", "env", "network", "auth"].includes(key)) {
+      throw new SandboxError2("[Sixb] Unknown sandbox configuration field.");
+    }
+  }
+  if (config.auth !== undefined && typeof config.auth?.authorize !== "function") {
+    throw new SandboxError2("[Sixb] sandboxes.auth requires an authorize function.");
+  }
+  if (config.params !== undefined && config.resolve === undefined) {
+    throw new SandboxError2("[Sixb] Sandbox params require a resolve function.");
+  }
+  if (config.resolve !== undefined && (config.source !== undefined || config.setup !== undefined)) {
+    throw new SandboxError2("[Sixb] Use either static source/setup or resolve, not both.");
+  }
+  const invalid = (path) => new SandboxError2(`[Sixb] ${path} must be a valid parameter declaration; use param(schema).`);
+  for (const [id, value] of Object.entries(config.params ?? {})) {
+    const path = `sandboxes.params.${id}`;
+    if (!id.trim() || !isPlainRecord(value))
+      throw invalid(path);
+    for (const key of Object.keys(value)) {
+      if (!["schema", "required", "nullable", "description", "semanticType"].includes(key)) {
+        throw invalid(path);
+      }
+    }
+    if (value.required !== undefined && typeof value.required !== "boolean" || value.nullable !== undefined && typeof value.nullable !== "boolean" || value.description !== undefined && typeof value.description !== "string" || value.semanticType !== undefined && typeof value.semanticType !== "string")
+      throw invalid(path);
+    const schema = value.schema;
+    if (isPlainRecord(schema) && schema.type === "objectRef") {
+      if (typeof schema.objectTypeId !== "string" || !ontology.getObjectTypesById().has(schema.objectTypeId)) {
+        throw invalid(path);
+      }
+    } else {
+      assertValidSchema(schema, `${path}.schema`, invalid);
+    }
+  }
+  const params = structuredClone(config.params ?? {});
+  const environment = captureEnvironment({
+    ...config.source === undefined ? {} : { source: config.source },
+    ...config.setup === undefined ? {} : { setup: config.setup },
+    ...config.env === undefined ? {} : { env: config.env },
+    ...config.network === undefined ? {} : { network: config.network }
+  });
+  const resolve = config.resolve;
+  const authorize = config.auth?.authorize.bind(config.auth);
+  deepFreeze(params);
+  return Object.freeze({
+    params,
+    ...authorize ? { auth: Object.freeze({ authorize }) } : {},
+    resolve: async ({ params: input, sixb }) => {
+      const binding = normalizeParams(ontology.getValueTypesById(), params, input, {
+        kind: "sandbox",
+        id: "sandboxes",
+        path: "sandbox"
+      });
+      const typed = coerceParamsToTyped(params, binding, ontology.getValueTypesById());
+      if (!resolve)
+        return structuredClone(environment);
+      const resolved = captureEnvironment(await resolve({ params: typed, sixb }));
+      return {
+        ...structuredClone(environment),
+        ...resolved,
+        env: { ...environment.env, ...resolved.env }
+      };
+    }
+  });
+}
+function captureEnvironment(value) {
+  if (!isPlainRecord(value) || Object.keys(value).some((key) => !["source", "setup", "env", "network"].includes(key))) {
+    return fail("environment");
+  }
+  if (value.source !== undefined)
+    validateSource(value.source);
+  if (value.setup !== undefined)
+    validateSetup(value.setup);
+  if (value.env !== undefined)
+    validateEnv(value.env);
+  if (value.network !== undefined)
+    validateNetwork(value.network);
+  return structuredClone(value);
+}
+function fail(field) {
+  throw new SandboxError2(`[Sixb] Invalid sandbox ${field}.`);
+}
+function validateSource(source) {
+  if (!isPlainRecord(source) || source.type !== "git" || typeof source.url !== "string" || Object.keys(source).some((key) => !["type", "url", "revision", "access"].includes(key))) {
+    fail("source");
+  }
+  const url = parseUrl(source.url, "source URL");
+  if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash) {
+    fail("source URL: expected credential-free HTTPS");
+  }
+  if (source.revision !== undefined && (typeof source.revision !== "string" || !source.revision.trim() || source.revision.startsWith("-") || /[\x00-\x1f]/.test(source.revision))) {
+    fail("source revision");
+  }
+  if (source.access !== undefined && source.access !== "read" && source.access !== "write") {
+    fail("source access");
+  }
+}
+function validateSetup(setup) {
+  if (!Array.isArray(setup) || setup.some((command) => typeof command !== "string" || !command.trim() || command.includes("\x00"))) {
+    fail("setup");
+  }
+}
+function validateEnv(env) {
+  if (!isPlainRecord(env) || Object.entries(env).some(([key, entry]) => !key || /[=\0]/.test(key) || typeof entry !== "string" || entry.includes("\x00"))) {
+    fail("env");
+  }
+}
+function validateNetwork(network) {
+  if (!isPlainRecord(network))
+    fail("network");
+  if (network.mode === "restricted") {
+    if (Object.keys(network).some((key) => key !== "mode" && key !== "allow") || !Array.isArray(network.allow)) {
+      fail("network");
+    }
+    for (const target of network.allow)
+      validateNetworkTarget(target);
+    return;
+  }
+  if (network.mode !== "none" && network.mode !== "all" || Object.keys(network).some((key) => key !== "mode")) {
+    fail("network");
+  }
+}
+function validateNetworkTarget(target) {
+  if (!isPlainRecord(target) || typeof target.name !== "string" || !target.name.trim() || typeof target.origin !== "string" || Object.keys(target).some((key) => key !== "name" && key !== "origin")) {
+    fail("network target");
+  }
+  const url = parseUrl(target.origin, "network origin");
+  if (!["http:", "https:"].includes(url.protocol) || url.origin !== target.origin) {
+    fail("network origin");
+  }
+}
+function parseUrl(value, field) {
+  try {
+    return new URL(value);
+  } catch {
+    return fail(field);
+  }
+}
+function deepFreeze(value, seen = new Set) {
+  if (seen.has(value))
+    return;
+  seen.add(value);
+  for (const child of Object.values(value)) {
+    if (child !== null && typeof child === "object")
+      deepFreeze(child, seen);
+  }
+  Object.freeze(value);
+}
+
+// src/sandboxes/config.ts
+function sandboxConfig2(options) {
+  if (options.auth !== undefined && typeof options.auth?.authorize !== "function") {
+    throw new SandboxError2("[Sixb] sandboxes.auth requires an authorize function.");
+  }
+  const authorize = options.auth?.authorize.bind(options.auth);
+  if (options.params !== undefined && options.resolve === undefined) {
+    throw new SandboxError2("[Sixb] Sandbox params require a resolve function.");
+  }
+  if (options.resolve !== undefined && typeof options.resolve !== "function") {
+    throw new SandboxError2("[Sixb] Sandbox resolve must be a function.");
+  }
+  if (options.resolve !== undefined && (options.source !== undefined || options.setup !== undefined)) {
+    throw new SandboxError2("[Sixb] Use either static source/setup or resolve, not both.");
+  }
+  const environment = captureEnvironment({
+    ...options.source === undefined ? {} : { source: options.source },
+    ...options.setup === undefined ? {} : { setup: options.setup },
+    ...options.env === undefined ? {} : { env: options.env },
+    ...options.network === undefined ? {} : { network: options.network }
+  });
+  return Object.freeze({
+    ...authorize ? { auth: Object.freeze({ authorize }) } : {},
+    ...environment,
+    ...options.params === undefined ? {} : { params: structuredClone(options.params) },
+    ...options.resolve === undefined ? {} : { resolve: options.resolve }
+  });
+}
+// src/sandboxes/environment.ts
+import { posix } from "path";
+function sandboxCreationEnvironment2(configuration, options) {
+  if (options.environment === undefined && configuration.resolve !== undefined) {
+    throw new SandboxError2("[Sixb] Dynamic sandbox configuration requires an execution-resolved environment.");
+  }
+  const environment = captureEnvironment(options.environment !== undefined ? options.environment : {
+    ...configuration.source === undefined ? {} : { source: configuration.source },
+    ...configuration.setup === undefined ? {} : { setup: configuration.setup }
+  });
+  if (environment.env !== undefined || environment.network !== undefined) {
+    throw new SandboxError2("[Sixb] Pass env and network as sandbox session options, not environment.");
+  }
+  if (environment.source) {
+    if ((configuration.auth !== undefined || environment.source.access === "write") && !options.requestCredentials?.length) {
+      throw new SandboxError2("[Sixb] Sandbox source authentication requires execution-prepared request credentials.");
+    }
+    const network = options.network ?? configuration.network ?? { mode: "none" };
+    const origin = new URL(environment.source.url).origin;
+    if (network.mode === "none" || network.mode === "restricted" && !network.allow.some((target) => target.origin === origin)) {
+      throw new SandboxError2("[Sixb] Sandbox network policy denies the source origin.");
+    }
+  }
+  options.signal?.throwIfAborted();
+  return environment;
+}
+function sandboxProjectDirectory2(session, hasSource) {
+  if (!hasSource)
+    return session;
+  const workingDirectory = posix.join(session.workingDirectory, "repository");
+  return {
+    id: session.id,
+    provider: session.provider,
+    get status() {
+      return session.status;
+    },
+    workingDirectory,
+    ...session.setRequestCredentials ? { setRequestCredentials: session.setRequestCredentials.bind(session) } : {},
+    runCommand: (command, args, options) => session.runCommand(command, args, { ...options, cwd: options?.cwd ?? workingDirectory }),
+    writeFiles: (files) => session.writeFiles(files.map((file) => ({
+      ...file,
+      path: posix.isAbsolute(file.path) ? file.path : posix.join(workingDirectory, file.path)
+    }))),
+    stop: () => session.stop(),
+    destroy: () => session.destroy()
+  };
+}
+async function initializeSandboxEnvironment2(session, environment, signal) {
+  environment = captureEnvironment(environment);
+  const run = async (sandbox, command, args) => {
+    signal?.throwIfAborted();
+    const result = await sandbox.runCommand(command, args, { timeout: 120000, signal });
+    if (result.exitCode !== 0 || result.timedOut) {
+      throw new SandboxError2("[Sixb] Sandbox environment initialization failed.");
+    }
+  };
+  signal?.throwIfAborted();
+  const sandbox = sandboxProjectDirectory2(session, environment.source !== undefined);
+  if (environment.source) {
+    await run(session, "git", ["clone", "--", environment.source.url, "repository"]);
+    if (environment.source.revision) {
+      await run(sandbox, "git", ["checkout", environment.source.revision, "--"]);
+    }
+  }
+  for (const command of environment.setup ?? [])
+    await run(sandbox, "bash", ["-lc", command]);
+  return sandbox;
+}
+// src/sandboxes/exec.ts
+var DEFAULT_KILL_EXIT_CODE = 137;
+async function exec2(options) {
+  const start = Date.now();
+  const [head, ...rest] = options.argv;
+  if (!head) {
+    return {
+      exitCode: 1,
+      stdout: "",
+      stderr: "[Sandbox] empty argv",
+      durationMs: 0
+    };
+  }
+  let proc;
+  try {
+    proc = Bun.spawn([head, ...rest], {
+      cwd: options.cwd,
+      env: options.env,
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+  } catch (error) {
+    return {
+      exitCode: 127,
+      stdout: "",
+      stderr: error instanceof Error ? error.message : String(error),
+      durationMs: Date.now() - start
+    };
+  }
+  let timedOut = false;
+  let killed = false;
+  const timer = options.timeoutMs !== undefined && options.timeoutMs > 0 ? setTimeout(() => {
+    timedOut = true;
+    killed = true;
+    proc.kill("SIGKILL");
+  }, options.timeoutMs) : undefined;
+  const onAbort = () => {
+    if (!killed) {
+      killed = true;
+      proc.kill("SIGKILL");
+    }
+  };
+  options.signal?.addEventListener("abort", onAbort);
+  if (options.signal?.aborted) {
+    onAbort();
+  }
+  let stdout = "";
+  let stderr = "";
+  let exitCode = 0;
+  try {
+    const [stdoutText, stderrText, code] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited
+    ]);
+    stdout = stdoutText;
+    stderr = stderrText;
+    exitCode = typeof code === "number" ? code : DEFAULT_KILL_EXIT_CODE;
+  } finally {
+    if (timer !== undefined)
+      clearTimeout(timer);
+    options.signal?.removeEventListener("abort", onAbort);
+  }
+  if (killed && exitCode === 0) {
+    exitCode = DEFAULT_KILL_EXIT_CODE;
+  }
+  return {
+    exitCode,
+    stdout,
+    stderr,
+    durationMs: Date.now() - start,
+    ...timedOut ? { timedOut: true } : {}
+  };
+}
+export { SandboxError2, SandboxStateUnavailableError2, SandboxNotRunningError2, SandboxTimeoutError2, SandboxIsolationUnavailableError2, createSandboxDefinition, sandboxConfig2, sandboxCreationEnvironment2, sandboxProjectDirectory2, initializeSandboxEnvironment2, exec2 };
+
+//# debugId=C3376C4D866A438264756E2164756E21

package/dist/chunk-y0v18c2j.js.map

@@ -0,0 +1,14 @@
+{
+  "version": 3,
+  "sources": ["../src/sandboxes/errors.ts", "../src/sandboxes/configuration.ts", "../src/sandboxes/config.ts", "../src/sandboxes/environment.ts", "../src/sandboxes/exec.ts"],
+  "sourcesContent": [
+    "/**\n * Errors thrown by sandbox providers. Hosts can catch SandboxError at the\n * audit boundary while still distinguishing recoverable provider states.\n */\nexport class SandboxError extends Error {\n  readonly name: string = \"SandboxError\"\n}\n\n/** Confirmed missing/expired state. Never use for transport, authorization or session setup errors. */\nexport class SandboxStateUnavailableError extends SandboxError {\n  override readonly name = \"SandboxStateUnavailableError\"\n}\n\n/** runCommand / stop / destroy called after the sandbox is stopped or destroyed. */\nexport class SandboxNotRunningError extends SandboxError {\n  override readonly name = \"SandboxNotRunningError\"\n}\n\n/** Command exceeded its timeout and was killed. */\nexport class SandboxTimeoutError extends SandboxError {\n  override readonly name = \"SandboxTimeoutError\"\n}\n\n/** Requested isolation backend is not available on the host. */\nexport class SandboxIsolationUnavailableError extends SandboxError {\n  override readonly name = \"SandboxIsolationUnavailableError\"\n}\n",
+    "import { isPlainRecord } from \"../json\"\nimport type { OntologyRegistry } from \"../ontology/registry\"\nimport { assertValidSchema } from \"../ontology/validation/definition\"\nimport type { Sixb } from \"../runtime/sixb\"\nimport type { InferParams, ParamsConfig } from \"../shared/params/types\"\nimport { coerceParamsToTyped, normalizeParams } from \"../shared/params/validation\"\nimport type { SandboxSourceAuth } from \"./auth\"\nimport { SandboxError } from \"./errors\"\nimport type { SandboxNetworkPolicy } from \"./sandbox\"\n\n/** Static recipes accept an empty parameter record, not arbitrary undeclared keys. */\nexport type InferSandboxParams<TParams extends ParamsConfig> = keyof TParams extends never\n  ? Record<string, never>\n  : InferParams<TParams>\n\n/** Initial project contents, independent from the provider's runtime image or saved state. */\nexport interface SandboxSource {\n  readonly type: \"git\"\n  readonly url: string\n  readonly revision?: string\n  readonly access?: \"read\" | \"write\"\n}\n\n/** Host-side recipe. Environment values are guest-readable, never a Git credential channel. */\nexport interface SandboxEnvironment {\n  readonly source?: SandboxSource\n  readonly setup?: readonly string[]\n  readonly env?: Readonly<Record<string, string>>\n  readonly network?: SandboxNetworkPolicy\n}\n\nexport interface SandboxResolveContext<TParams = Record<string, unknown>> {\n  readonly params: TParams\n  /** Bound to the current execution; a stored binding is not authorization. */\n  readonly sixb: Sixb\n}\n\n// The recipe both declares and consumes this schema: keep it invariant instead of asking\n// TypeScript to compare the recursive ontology inference through callback variance.\n// Provider option interfaces must preserve this annotation when extending the config.\nexport interface SandboxConfig<in out TParams extends ParamsConfig = ParamsConfig>\n  extends SandboxEnvironment {\n  readonly auth?: SandboxSourceAuth\n  readonly params?: TParams\n  readonly resolve?: (\n    context: SandboxResolveContext<InferParams<NoInfer<TParams>>>\n  ) => SandboxEnvironment | Promise<SandboxEnvironment>\n}\n\n/** Registered project recipe; only thread params cross the durable boundary. */\nexport interface SandboxDefinition {\n  readonly auth?: SandboxSourceAuth\n  readonly params: ParamsConfig\n  readonly resolve: (context: SandboxResolveContext) => Promise<SandboxEnvironment>\n}\n\nexport function createSandboxDefinition<TParams extends ParamsConfig>(\n  config: SandboxConfig<TParams>,\n  ontology: OntologyRegistry\n): SandboxDefinition {\n  const raw: unknown = config\n  if (\n    !isPlainRecord(raw) ||\n    (config.params !== undefined && !isPlainRecord(raw.params)) ||\n    (config.resolve !== undefined && typeof config.resolve !== \"function\")\n  ) {\n    throw new SandboxError(\n      \"[Sixb] Sandbox configuration requires a params object and a callable resolver when provided.\"\n    )\n  }\n  for (const key of Object.keys(config)) {\n    if (![\"params\", \"resolve\", \"source\", \"setup\", \"env\", \"network\", \"auth\"].includes(key)) {\n      throw new SandboxError(\"[Sixb] Unknown sandbox configuration field.\")\n    }\n  }\n  if (config.auth !== undefined && typeof config.auth?.authorize !== \"function\") {\n    throw new SandboxError(\"[Sixb] sandboxes.auth requires an authorize function.\")\n  }\n  if (config.params !== undefined && config.resolve === undefined) {\n    throw new SandboxError(\"[Sixb] Sandbox params require a resolve function.\")\n  }\n  if (config.resolve !== undefined && (config.source !== undefined || config.setup !== undefined)) {\n    throw new SandboxError(\"[Sixb] Use either static source/setup or resolve, not both.\")\n  }\n  const invalid = (path: string) =>\n    new SandboxError(`[Sixb] ${path} must be a valid parameter declaration; use param(schema).`)\n  for (const [id, value] of Object.entries(config.params ?? {})) {\n    const path = `sandboxes.params.${id}`\n    if (!id.trim() || !isPlainRecord(value)) throw invalid(path)\n    for (const key of Object.keys(value)) {\n      if (![\"schema\", \"required\", \"nullable\", \"description\", \"semanticType\"].includes(key)) {\n        throw invalid(path)\n      }\n    }\n    if (\n      (value.required !== undefined && typeof value.required !== \"boolean\") ||\n      (value.nullable !== undefined && typeof value.nullable !== \"boolean\") ||\n      (value.description !== undefined && typeof value.description !== \"string\") ||\n      (value.semanticType !== undefined && typeof value.semanticType !== \"string\")\n    )\n      throw invalid(path)\n    const schema: unknown = value.schema\n    if (isPlainRecord(schema) && schema.type === \"objectRef\") {\n      if (\n        typeof schema.objectTypeId !== \"string\" ||\n        !ontology.getObjectTypesById().has(schema.objectTypeId)\n      ) {\n        throw invalid(path)\n      }\n    } else {\n      assertValidSchema(schema, `${path}.schema`, invalid)\n    }\n  }\n  const params = structuredClone(config.params ?? {}) as ParamsConfig\n  const environment = captureEnvironment({\n    ...(config.source === undefined ? {} : { source: config.source }),\n    ...(config.setup === undefined ? {} : { setup: config.setup }),\n    ...(config.env === undefined ? {} : { env: config.env }),\n    ...(config.network === undefined ? {} : { network: config.network }),\n  })\n  // Capture the function too: later mutation of application config must not change this host.\n  // Erase inference only after capturing its schema; every invocation validates and coerces below.\n  const resolve = config.resolve as SandboxConfig[\"resolve\"]\n  const authorize = config.auth?.authorize.bind(config.auth)\n  deepFreeze(params)\n  return Object.freeze({\n    params,\n    ...(authorize ? { auth: Object.freeze({ authorize }) } : {}),\n    resolve: async ({ params: input, sixb }: SandboxResolveContext) => {\n      const binding = normalizeParams(ontology.getValueTypesById(), params, input, {\n        kind: \"sandbox\",\n        id: \"sandboxes\",\n        path: \"sandbox\",\n      })\n      const typed = coerceParamsToTyped(params, binding, ontology.getValueTypesById())\n      if (!resolve) return structuredClone(environment)\n      const resolved = captureEnvironment(await resolve({ params: typed, sixb }))\n      return {\n        ...structuredClone(environment),\n        ...resolved,\n        env: { ...environment.env, ...resolved.env },\n      }\n    },\n  })\n}\n\n/** Capture declarative data only; never retain caller-owned objects or include values in errors. */\nexport function captureEnvironment(value: unknown): SandboxEnvironment {\n  if (\n    !isPlainRecord(value) ||\n    Object.keys(value).some((key) => ![\"source\", \"setup\", \"env\", \"network\"].includes(key))\n  ) {\n    return fail(\"environment\")\n  }\n  if (value.source !== undefined) validateSource(value.source)\n  if (value.setup !== undefined) validateSetup(value.setup)\n  if (value.env !== undefined) validateEnv(value.env)\n  if (value.network !== undefined) validateNetwork(value.network)\n  // Every field and discriminant has been checked above; return only an isolated snapshot.\n  return structuredClone(value) as SandboxEnvironment\n}\n\nfunction fail(field: string): never {\n  throw new SandboxError(`[Sixb] Invalid sandbox ${field}.`)\n}\n\nfunction validateSource(source: unknown): void {\n  if (\n    !isPlainRecord(source) ||\n    source.type !== \"git\" ||\n    typeof source.url !== \"string\" ||\n    Object.keys(source).some((key) => ![\"type\", \"url\", \"revision\", \"access\"].includes(key))\n  ) {\n    fail(\"source\")\n  }\n  const url = parseUrl(source.url, \"source URL\")\n  if (url.protocol !== \"https:\" || url.username || url.password || url.search || url.hash) {\n    fail(\"source URL: expected credential-free HTTPS\")\n  }\n  if (\n    source.revision !== undefined &&\n    (typeof source.revision !== \"string\" ||\n      !source.revision.trim() ||\n      source.revision.startsWith(\"-\") ||\n      /[\\x00-\\x1f]/.test(source.revision))\n  ) {\n    fail(\"source revision\")\n  }\n  if (source.access !== undefined && source.access !== \"read\" && source.access !== \"write\") {\n    fail(\"source access\")\n  }\n}\n\nfunction validateSetup(setup: unknown): void {\n  if (\n    !Array.isArray(setup) ||\n    setup.some(\n      (command) => typeof command !== \"string\" || !command.trim() || command.includes(\"\\0\")\n    )\n  ) {\n    fail(\"setup\")\n  }\n}\n\nfunction validateEnv(env: unknown): void {\n  if (\n    !isPlainRecord(env) ||\n    Object.entries(env).some(\n      ([key, entry]) =>\n        !key || /[=\\0]/.test(key) || typeof entry !== \"string\" || entry.includes(\"\\0\")\n    )\n  ) {\n    fail(\"env\")\n  }\n}\n\nfunction validateNetwork(network: unknown): void {\n  if (!isPlainRecord(network)) fail(\"network\")\n  if (network.mode === \"restricted\") {\n    if (\n      Object.keys(network).some((key) => key !== \"mode\" && key !== \"allow\") ||\n      !Array.isArray(network.allow)\n    ) {\n      fail(\"network\")\n    }\n    for (const target of network.allow) validateNetworkTarget(target)\n    return\n  }\n  if (\n    (network.mode !== \"none\" && network.mode !== \"all\") ||\n    Object.keys(network).some((key) => key !== \"mode\")\n  ) {\n    fail(\"network\")\n  }\n}\n\nfunction validateNetworkTarget(target: unknown): void {\n  if (\n    !isPlainRecord(target) ||\n    typeof target.name !== \"string\" ||\n    !target.name.trim() ||\n    typeof target.origin !== \"string\" ||\n    Object.keys(target).some((key) => key !== \"name\" && key !== \"origin\")\n  ) {\n    fail(\"network target\")\n  }\n  const url = parseUrl(target.origin, \"network origin\")\n  if (![\"http:\", \"https:\"].includes(url.protocol) || url.origin !== target.origin) {\n    fail(\"network origin\")\n  }\n}\n\nfunction parseUrl(value: string, field: string): URL {\n  try {\n    return new URL(value)\n  } catch {\n    return fail(field)\n  }\n}\n\nfunction deepFreeze(value: object, seen = new Set<object>()): void {\n  if (seen.has(value)) return\n  seen.add(value)\n  for (const child of Object.values(value)) {\n    if (child !== null && typeof child === \"object\") deepFreeze(child, seen)\n  }\n  Object.freeze(value)\n}\n",
+    "import type { ParamsConfig } from \"../shared/params/types\"\nimport { captureEnvironment, type SandboxConfig } from \"./configuration\"\nimport { SandboxError } from \"./errors\"\n\n/** Extract only the common recipe; provider credentials and infrastructure stay on the factory. */\nexport function sandboxConfig<TParams extends ParamsConfig>(\n  options: SandboxConfig<TParams>\n): SandboxConfig<TParams> {\n  if (options.auth !== undefined && typeof options.auth?.authorize !== \"function\") {\n    throw new SandboxError(\"[Sixb] sandboxes.auth requires an authorize function.\")\n  }\n  const authorize = options.auth?.authorize.bind(options.auth)\n  if (options.params !== undefined && options.resolve === undefined) {\n    throw new SandboxError(\"[Sixb] Sandbox params require a resolve function.\")\n  }\n  if (options.resolve !== undefined && typeof options.resolve !== \"function\") {\n    throw new SandboxError(\"[Sixb] Sandbox resolve must be a function.\")\n  }\n  if (\n    options.resolve !== undefined &&\n    (options.source !== undefined || options.setup !== undefined)\n  ) {\n    throw new SandboxError(\"[Sixb] Use either static source/setup or resolve, not both.\")\n  }\n  const environment = captureEnvironment({\n    ...(options.source === undefined ? {} : { source: options.source }),\n    ...(options.setup === undefined ? {} : { setup: options.setup }),\n    ...(options.env === undefined ? {} : { env: options.env }),\n    ...(options.network === undefined ? {} : { network: options.network }),\n  })\n  return Object.freeze({\n    ...(authorize ? { auth: Object.freeze({ authorize }) } : {}),\n    ...environment,\n    ...(options.params === undefined ? {} : { params: structuredClone(options.params) }),\n    ...(options.resolve === undefined ? {} : { resolve: options.resolve }),\n  })\n}\n",
+    "import { posix } from \"node:path\"\nimport type { ParamsConfig } from \"../shared/params/types\"\nimport type { SandboxConfig } from \"./configuration\"\nimport { captureEnvironment, type SandboxEnvironment } from \"./configuration\"\nimport { SandboxError } from \"./errors\"\nimport type { CreateSandboxOptions, Sandbox } from \"./sandbox\"\n\n/** Select and validate before provisioning. Only the execution runtime may resolve a recipe. */\nexport function sandboxCreationEnvironment<TParams extends ParamsConfig>(\n  configuration: SandboxConfig<TParams>,\n  options: CreateSandboxOptions\n): Pick<SandboxEnvironment, \"source\" | \"setup\"> {\n  if (options.environment === undefined && configuration.resolve !== undefined) {\n    throw new SandboxError(\n      \"[Sixb] Dynamic sandbox configuration requires an execution-resolved environment.\"\n    )\n  }\n  const environment = captureEnvironment(\n    options.environment !== undefined\n      ? options.environment\n      : {\n          ...(configuration.source === undefined ? {} : { source: configuration.source }),\n          ...(configuration.setup === undefined ? {} : { setup: configuration.setup }),\n        }\n  )\n  if (environment.env !== undefined || environment.network !== undefined) {\n    throw new SandboxError(\n      \"[Sixb] Pass env and network as sandbox session options, not environment.\"\n    )\n  }\n  if (environment.source) {\n    if (\n      (configuration.auth !== undefined || environment.source.access === \"write\") &&\n      !options.requestCredentials?.length\n    ) {\n      throw new SandboxError(\n        \"[Sixb] Sandbox source authentication requires execution-prepared request credentials.\"\n      )\n    }\n    const network = options.network ?? configuration.network ?? { mode: \"none\" }\n    const origin = new URL(environment.source.url).origin\n    if (\n      network.mode === \"none\" ||\n      (network.mode === \"restricted\" && !network.allow.some((target) => target.origin === origin))\n    ) {\n      throw new SandboxError(\"[Sixb] Sandbox network policy denies the source origin.\")\n    }\n  }\n  options.signal?.throwIfAborted()\n  return environment\n}\n\n/** Select the same project directory on creation and resume without touching saved files. */\nexport function sandboxProjectDirectory(session: Sandbox, hasSource: boolean): Sandbox {\n  if (!hasSource) return session\n  const workingDirectory = posix.join(session.workingDirectory, \"repository\")\n  return {\n    id: session.id,\n    provider: session.provider,\n    get status() {\n      return session.status\n    },\n    workingDirectory,\n    ...(session.setRequestCredentials\n      ? { setRequestCredentials: session.setRequestCredentials.bind(session) }\n      : {}),\n    runCommand: (command, args, options) =>\n      session.runCommand(command, args, { ...options, cwd: options?.cwd ?? workingDirectory }),\n    writeFiles: (files) =>\n      session.writeFiles(\n        files.map((file) => ({\n          ...file,\n          path: posix.isAbsolute(file.path) ? file.path : posix.join(workingDirectory, file.path),\n        }))\n      ),\n    stop: () => session.stop(),\n    destroy: () => session.destroy(),\n  }\n}\n\n/** Provider-side initialization, after the session network/credentials have been applied.\n * Call only on fresh creation. The caller owns cleanup if any command fails.\n */\nexport async function initializeSandboxEnvironment(\n  session: Sandbox,\n  environment: Pick<SandboxEnvironment, \"source\" | \"setup\">,\n  signal?: AbortSignal\n): Promise<Sandbox> {\n  environment = captureEnvironment(environment)\n  const run = async (sandbox: Sandbox, command: string, args: readonly string[]) => {\n    signal?.throwIfAborted()\n    const result = await sandbox.runCommand(command, args, { timeout: 120_000, signal })\n    if (result.exitCode !== 0 || result.timedOut) {\n      throw new SandboxError(\"[Sixb] Sandbox environment initialization failed.\")\n    }\n  }\n  signal?.throwIfAborted()\n  const sandbox = sandboxProjectDirectory(session, environment.source !== undefined)\n  if (environment.source) {\n    await run(session, \"git\", [\"clone\", \"--\", environment.source.url, \"repository\"])\n    if (environment.source.revision) {\n      await run(sandbox, \"git\", [\"checkout\", environment.source.revision, \"--\"])\n    }\n  }\n  for (const command of environment.setup ?? []) await run(sandbox, \"bash\", [\"-lc\", command])\n  return sandbox\n}\n",
+    "import type { CommandResult } from \"./sandbox\"\n\nexport interface ExecOptions {\n  readonly argv: readonly string[]\n  readonly cwd: string\n  readonly env: Readonly<Record<string, string>>\n  readonly timeoutMs?: number\n  readonly signal?: AbortSignal\n}\n\nconst DEFAULT_KILL_EXIT_CODE = 137\n\n/**\n * Spawn a child process and gather its {@link CommandResult}. Wraps Bun.spawn with timeout and\n * AbortSignal handling, and never throws. Command-agnostic: the wrapper makes no assumptions about\n * what it spawns, so sandbox providers share it. On timeout/abort it SIGKILLs the spawned process;\n * any provider whose spawned process merely fronts a longer-lived resource (e.g. a VM) is\n * responsible for reaping that resource in its own stop()/destroy().\n */\nexport async function exec(options: ExecOptions): Promise<CommandResult> {\n  const start = Date.now()\n\n  const [head, ...rest] = options.argv\n  if (!head) {\n    return {\n      exitCode: 1,\n      stdout: \"\",\n      stderr: \"[Sandbox] empty argv\",\n      durationMs: 0,\n    }\n  }\n\n  let proc: ReturnType<typeof Bun.spawn>\n  try {\n    proc = Bun.spawn([head, ...rest], {\n      cwd: options.cwd,\n      env: options.env,\n      stdin: \"ignore\",\n      stdout: \"pipe\",\n      stderr: \"pipe\",\n    })\n  } catch (error) {\n    return {\n      exitCode: 127,\n      stdout: \"\",\n      stderr: error instanceof Error ? error.message : String(error),\n      durationMs: Date.now() - start,\n    }\n  }\n\n  let timedOut = false\n  let killed = false\n\n  const timer =\n    options.timeoutMs !== undefined && options.timeoutMs > 0\n      ? setTimeout(() => {\n          timedOut = true\n          killed = true\n          proc.kill(\"SIGKILL\")\n        }, options.timeoutMs)\n      : undefined\n\n  const onAbort = (): void => {\n    if (!killed) {\n      killed = true\n      proc.kill(\"SIGKILL\")\n    }\n  }\n  options.signal?.addEventListener(\"abort\", onAbort)\n  if (options.signal?.aborted) {\n    onAbort()\n  }\n\n  let stdout = \"\"\n  let stderr = \"\"\n  let exitCode = 0\n  try {\n    const [stdoutText, stderrText, code] = await Promise.all([\n      new Response(proc.stdout as ReadableStream<Uint8Array>).text(),\n      new Response(proc.stderr as ReadableStream<Uint8Array>).text(),\n      proc.exited,\n    ])\n    stdout = stdoutText\n    stderr = stderrText\n    exitCode = typeof code === \"number\" ? code : DEFAULT_KILL_EXIT_CODE\n  } finally {\n    if (timer !== undefined) clearTimeout(timer)\n    options.signal?.removeEventListener(\"abort\", onAbort)\n  }\n\n  if (killed && exitCode === 0) {\n    exitCode = DEFAULT_KILL_EXIT_CODE\n  }\n\n  return {\n    exitCode,\n    stdout,\n    stderr,\n    durationMs: Date.now() - start,\n    ...(timedOut ? { timedOut: true } : {}),\n  }\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;AAIO,MAAM,sBAAqB,MAAM;AAAA,EAC7B,OAAe;AAC1B;AAAA;AAGO,MAAM,sCAAqC,cAAa;AAAA,EAC3C,OAAO;AAC3B;AAAA;AAGO,MAAM,gCAA+B,cAAa;AAAA,EACrC,OAAO;AAC3B;AAAA;AAGO,MAAM,6BAA4B,cAAa;AAAA,EAClC,OAAO;AAC3B;AAAA;AAGO,MAAM,0CAAyC,cAAa;AAAA,EAC/C,OAAO;AAC3B;;;AC8BO,SAAS,uBAAqD,CACnE,QACA,UACmB;AAAA,EACnB,MAAM,MAAe;AAAA,EACrB,IACE,CAAC,cAAc,GAAG,KACjB,OAAO,WAAW,aAAa,CAAC,cAAc,IAAI,MAAM,KACxD,OAAO,YAAY,aAAa,OAAO,OAAO,YAAY,YAC3D;AAAA,IACA,MAAM,IAAI,cACR,8FACF;AAAA,EACF;AAAA,EACA,WAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AAAA,IACrC,IAAI,CAAC,CAAC,UAAU,WAAW,UAAU,SAAS,OAAO,WAAW,MAAM,EAAE,SAAS,GAAG,GAAG;AAAA,MACrF,MAAM,IAAI,cAAa,6CAA6C;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,OAAO,SAAS,aAAa,OAAO,OAAO,MAAM,cAAc,YAAY;AAAA,IAC7E,MAAM,IAAI,cAAa,uDAAuD;AAAA,EAChF;AAAA,EACA,IAAI,OAAO,WAAW,aAAa,OAAO,YAAY,WAAW;AAAA,IAC/D,MAAM,IAAI,cAAa,mDAAmD;AAAA,EAC5E;AAAA,EACA,IAAI,OAAO,YAAY,cAAc,OAAO,WAAW,aAAa,OAAO,UAAU,YAAY;AAAA,IAC/F,MAAM,IAAI,cAAa,6DAA6D;AAAA,EACtF;AAAA,EACA,MAAM,UAAU,CAAC,SACf,IAAI,cAAa,UAAU,gEAAgE;AAAA,EAC7F,YAAY,IAAI,UAAU,OAAO,QAAQ,OAAO,UAAU,CAAC,CAAC,GAAG;AAAA,IAC7D,MAAM,OAAO,oBAAoB;AAAA,IACjC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,cAAc,KAAK;AAAA,MAAG,MAAM,QAAQ,IAAI;AAAA,IAC3D,WAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AAAA,MACpC,IAAI,CAAC,CAAC,UAAU,YAAY,YAAY,eAAe,cAAc,EAAE,SAAS,GAAG,GAAG;AAAA,QACpF,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,IACF;AAAA,IACA,IACG,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,aAC1D,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,aAC1D,MAAM,gBAAgB,aAAa,OAAO,MAAM,gBAAgB,YAChE,MAAM,iBAAiB,aAAa,OAAO,MAAM,iBAAiB;AAAA,MAEnE,MAAM,QAAQ,IAAI;AAAA,IACpB,MAAM,SAAkB,MAAM;AAAA,IAC9B,IAAI,cAAc,MAAM,KAAK,OAAO,SAAS,aAAa;AAAA,MACxD,IACE,OAAO,OAAO,iBAAiB,YAC/B,CAAC,SAAS,mBAAmB,EAAE,IAAI,OAAO,YAAY,GACtD;AAAA,QACA,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,IACF,EAAO;AAAA,MACL,kBAAkB,QAAQ,GAAG,eAAe,OAAO;AAAA;AAAA,EAEvD;AAAA,EACA,MAAM,SAAS,gBAAgB,OAAO,UAAU,CAAC,CAAC;AAAA,EAClD,MAAM,cAAc,mBAAmB;AAAA,OACjC,OAAO,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,OAAO;AAAA,OAC3D,OAAO,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;AAAA,OACxD,OAAO,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,IAAI;AAAA,OAClD,OAAO,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;AAAA,EACpE,CAAC;AAAA,EAGD,MAAM,UAAU,OAAO;AAAA,EACvB,MAAM,YAAY,OAAO,MAAM,UAAU,KAAK,OAAO,IAAI;AAAA,EACzD,WAAW,MAAM;AAAA,EACjB,OAAO,OAAO,OAAO;AAAA,IACnB;AAAA,OACI,YAAY,EAAE,MAAM,OAAO,OAAO,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC;AAAA,IAC1D,SAAS,SAAS,QAAQ,OAAO,WAAkC;AAAA,MACjE,MAAM,UAAU,gBAAgB,SAAS,kBAAkB,GAAG,QAAQ,OAAO;AAAA,QAC3E,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,MAAM;AAAA,MACR,CAAC;AAAA,MACD,MAAM,QAAQ,oBAAoB,QAAQ,SAAS,SAAS,kBAAkB,CAAC;AAAA,MAC/E,IAAI,CAAC;AAAA,QAAS,OAAO,gBAAgB,WAAW;AAAA,MAChD,MAAM,WAAW,mBAAmB,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,CAAC,CAAC;AAAA,MAC1E,OAAO;AAAA,WACF,gBAAgB,WAAW;AAAA,WAC3B;AAAA,QACH,KAAK,KAAK,YAAY,QAAQ,SAAS,IAAI;AAAA,MAC7C;AAAA;AAAA,EAEJ,CAAC;AAAA;AAII,SAAS,kBAAkB,CAAC,OAAoC;AAAA,EACrE,IACE,CAAC,cAAc,KAAK,KACpB,OAAO,KAAK,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,UAAU,SAAS,OAAO,SAAS,EAAE,SAAS,GAAG,CAAC,GACrF;AAAA,IACA,OAAO,KAAK,aAAa;AAAA,EAC3B;AAAA,EACA,IAAI,MAAM,WAAW;AAAA,IAAW,eAAe,MAAM,MAAM;AAAA,EAC3D,IAAI,MAAM,UAAU;AAAA,IAAW,cAAc,MAAM,KAAK;AAAA,EACxD,IAAI,MAAM,QAAQ;AAAA,IAAW,YAAY,MAAM,GAAG;AAAA,EAClD,IAAI,MAAM,YAAY;AAAA,IAAW,gBAAgB,MAAM,OAAO;AAAA,EAE9D,OAAO,gBAAgB,KAAK;AAAA;AAG9B,SAAS,IAAI,CAAC,OAAsB;AAAA,EAClC,MAAM,IAAI,cAAa,0BAA0B,QAAQ;AAAA;AAG3D,SAAS,cAAc,CAAC,QAAuB;AAAA,EAC7C,IACE,CAAC,cAAc,MAAM,KACrB,OAAO,SAAS,SAChB,OAAO,OAAO,QAAQ,YACtB,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,OAAO,YAAY,QAAQ,EAAE,SAAS,GAAG,CAAC,GACtF;AAAA,IACA,KAAK,QAAQ;AAAA,EACf;AAAA,EACA,MAAM,MAAM,SAAS,OAAO,KAAK,YAAY;AAAA,EAC7C,IAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,MAAM;AAAA,IACvF,KAAK,4CAA4C;AAAA,EACnD;AAAA,EACA,IACE,OAAO,aAAa,cACnB,OAAO,OAAO,aAAa,YAC1B,CAAC,OAAO,SAAS,KAAK,KACtB,OAAO,SAAS,WAAW,GAAG,KAC9B,cAAc,KAAK,OAAO,QAAQ,IACpC;AAAA,IACA,KAAK,iBAAiB;AAAA,EACxB;AAAA,EACA,IAAI,OAAO,WAAW,aAAa,OAAO,WAAW,UAAU,OAAO,WAAW,SAAS;AAAA,IACxF,KAAK,eAAe;AAAA,EACtB;AAAA;AAGF,SAAS,aAAa,CAAC,OAAsB;AAAA,EAC3C,IACE,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,KACJ,CAAC,YAAY,OAAO,YAAY,YAAY,CAAC,QAAQ,KAAK,KAAK,QAAQ,SAAS,MAAI,CACtF,GACA;AAAA,IACA,KAAK,OAAO;AAAA,EACd;AAAA;AAGF,SAAS,WAAW,CAAC,KAAoB;AAAA,EACvC,IACE,CAAC,cAAc,GAAG,KAClB,OAAO,QAAQ,GAAG,EAAE,KAClB,EAAE,KAAK,WACL,CAAC,OAAO,QAAQ,KAAK,GAAG,KAAK,OAAO,UAAU,YAAY,MAAM,SAAS,MAAI,CACjF,GACA;AAAA,IACA,KAAK,KAAK;AAAA,EACZ;AAAA;AAGF,SAAS,eAAe,CAAC,SAAwB;AAAA,EAC/C,IAAI,CAAC,cAAc,OAAO;AAAA,IAAG,KAAK,SAAS;AAAA,EAC3C,IAAI,QAAQ,SAAS,cAAc;AAAA,IACjC,IACE,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,UAAU,QAAQ,OAAO,KACpE,CAAC,MAAM,QAAQ,QAAQ,KAAK,GAC5B;AAAA,MACA,KAAK,SAAS;AAAA,IAChB;AAAA,IACA,WAAW,UAAU,QAAQ;AAAA,MAAO,sBAAsB,MAAM;AAAA,IAChE;AAAA,EACF;AAAA,EACA,IACG,QAAQ,SAAS,UAAU,QAAQ,SAAS,SAC7C,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,MAAM,GACjD;AAAA,IACA,KAAK,SAAS;AAAA,EAChB;AAAA;AAGF,SAAS,qBAAqB,CAAC,QAAuB;AAAA,EACpD,IACE,CAAC,cAAc,MAAM,KACrB,OAAO,OAAO,SAAS,YACvB,CAAC,OAAO,KAAK,KAAK,KAClB,OAAO,OAAO,WAAW,YACzB,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,QAAQ,QAAQ,UAAU,QAAQ,QAAQ,GACpE;AAAA,IACA,KAAK,gBAAgB;AAAA,EACvB;AAAA,EACA,MAAM,MAAM,SAAS,OAAO,QAAQ,gBAAgB;AAAA,EACpD,IAAI,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAAK,IAAI,WAAW,OAAO,QAAQ;AAAA,IAC/E,KAAK,gBAAgB;AAAA,EACvB;AAAA;AAGF,SAAS,QAAQ,CAAC,OAAe,OAAoB;AAAA,EACnD,IAAI;AAAA,IACF,OAAO,IAAI,IAAI,KAAK;AAAA,IACpB,MAAM;AAAA,IACN,OAAO,KAAK,KAAK;AAAA;AAAA;AAIrB,SAAS,UAAU,CAAC,OAAe,OAAO,IAAI,KAAqB;AAAA,EACjE,IAAI,KAAK,IAAI,KAAK;AAAA,IAAG;AAAA,EACrB,KAAK,IAAI,KAAK;AAAA,EACd,WAAW,SAAS,OAAO,OAAO,KAAK,GAAG;AAAA,IACxC,IAAI,UAAU,QAAQ,OAAO,UAAU;AAAA,MAAU,WAAW,OAAO,IAAI;AAAA,EACzE;AAAA,EACA,OAAO,OAAO,KAAK;AAAA;;;ACrQd,SAAS,cAA2C,CACzD,SACwB;AAAA,EACxB,IAAI,QAAQ,SAAS,aAAa,OAAO,QAAQ,MAAM,cAAc,YAAY;AAAA,IAC/E,MAAM,IAAI,cAAa,uDAAuD;AAAA,EAChF;AAAA,EACA,MAAM,YAAY,QAAQ,MAAM,UAAU,KAAK,QAAQ,IAAI;AAAA,EAC3D,IAAI,QAAQ,WAAW,aAAa,QAAQ,YAAY,WAAW;AAAA,IACjE,MAAM,IAAI,cAAa,mDAAmD;AAAA,EAC5E;AAAA,EACA,IAAI,QAAQ,YAAY,aAAa,OAAO,QAAQ,YAAY,YAAY;AAAA,IAC1E,MAAM,IAAI,cAAa,4CAA4C;AAAA,EACrE;AAAA,EACA,IACE,QAAQ,YAAY,cACnB,QAAQ,WAAW,aAAa,QAAQ,UAAU,YACnD;AAAA,IACA,MAAM,IAAI,cAAa,6DAA6D;AAAA,EACtF;AAAA,EACA,MAAM,cAAc,mBAAmB;AAAA,OACjC,QAAQ,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,OAC7D,QAAQ,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;AAAA,OAC1D,QAAQ,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI;AAAA,OACpD,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE,CAAC;AAAA,EACD,OAAO,OAAO,OAAO;AAAA,OACf,YAAY,EAAE,MAAM,OAAO,OAAO,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC;AAAA,OACvD;AAAA,OACC,QAAQ,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,gBAAgB,QAAQ,MAAM,EAAE;AAAA,OAC9E,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE,CAAC;AAAA;;ACnCH;AAQO,SAAS,2BAAwD,CACtE,eACA,SAC8C;AAAA,EAC9C,IAAI,QAAQ,gBAAgB,aAAa,cAAc,YAAY,WAAW;AAAA,IAC5E,MAAM,IAAI,cACR,kFACF;AAAA,EACF;AAAA,EACA,MAAM,cAAc,mBAClB,QAAQ,gBAAgB,YACpB,QAAQ,cACR;AAAA,OACM,cAAc,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,cAAc,OAAO;AAAA,OACzE,cAAc,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,cAAc,MAAM;AAAA,EAC5E,CACN;AAAA,EACA,IAAI,YAAY,QAAQ,aAAa,YAAY,YAAY,WAAW;AAAA,IACtE,MAAM,IAAI,cACR,0EACF;AAAA,EACF;AAAA,EACA,IAAI,YAAY,QAAQ;AAAA,IACtB,KACG,cAAc,SAAS,aAAa,YAAY,OAAO,WAAW,YACnE,CAAC,QAAQ,oBAAoB,QAC7B;AAAA,MACA,MAAM,IAAI,cACR,uFACF;AAAA,IACF;AAAA,IACA,MAAM,UAAU,QAAQ,WAAW,cAAc,WAAW,EAAE,MAAM,OAAO;AAAA,IAC3E,MAAM,SAAS,IAAI,IAAI,YAAY,OAAO,GAAG,EAAE;AAAA,IAC/C,IACE,QAAQ,SAAS,UAChB,QAAQ,SAAS,gBAAgB,CAAC,QAAQ,MAAM,KAAK,CAAC,WAAW,OAAO,WAAW,MAAM,GAC1F;AAAA,MACA,MAAM,IAAI,cAAa,yDAAyD;AAAA,IAClF;AAAA,EACF;AAAA,EACA,QAAQ,QAAQ,eAAe;AAAA,EAC/B,OAAO;AAAA;AAIF,SAAS,wBAAuB,CAAC,SAAkB,WAA6B;AAAA,EACrF,IAAI,CAAC;AAAA,IAAW,OAAO;AAAA,EACvB,MAAM,mBAAmB,MAAM,KAAK,QAAQ,kBAAkB,YAAY;AAAA,EAC1E,OAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,UAAU,QAAQ;AAAA,QACd,MAAM,GAAG;AAAA,MACX,OAAO,QAAQ;AAAA;AAAA,IAEjB;AAAA,OACI,QAAQ,wBACR,EAAE,uBAAuB,QAAQ,sBAAsB,KAAK,OAAO,EAAE,IACrE,CAAC;AAAA,IACL,YAAY,CAAC,SAAS,MAAM,YAC1B,QAAQ,WAAW,SAAS,MAAM,KAAK,SAAS,KAAK,SAAS,OAAO,iBAAiB,CAAC;AAAA,IACzF,YAAY,CAAC,UACX,QAAQ,WACN,MAAM,IAAI,CAAC,UAAU;AAAA,SAChB;AAAA,MACH,MAAM,MAAM,WAAW,KAAK,IAAI,IAAI,KAAK,OAAO,MAAM,KAAK,kBAAkB,KAAK,IAAI;AAAA,IACxF,EAAE,CACJ;AAAA,IACF,MAAM,MAAM,QAAQ,KAAK;AAAA,IACzB,SAAS,MAAM,QAAQ,QAAQ;AAAA,EACjC;AAAA;AAMF,eAAsB,6BAA4B,CAChD,SACA,aACA,QACkB;AAAA,EAClB,cAAc,mBAAmB,WAAW;AAAA,EAC5C,MAAM,MAAM,OAAO,SAAkB,SAAiB,SAA4B;AAAA,IAChF,QAAQ,eAAe;AAAA,IACvB,MAAM,SAAS,MAAM,QAAQ,WAAW,SAAS,MAAM,EAAE,SAAS,QAAS,OAAO,CAAC;AAAA,IACnF,IAAI,OAAO,aAAa,KAAK,OAAO,UAAU;AAAA,MAC5C,MAAM,IAAI,cAAa,mDAAmD;AAAA,IAC5E;AAAA;AAAA,EAEF,QAAQ,eAAe;AAAA,EACvB,MAAM,UAAU,yBAAwB,SAAS,YAAY,WAAW,SAAS;AAAA,EACjF,IAAI,YAAY,QAAQ;AAAA,IACtB,MAAM,IAAI,SAAS,OAAO,CAAC,SAAS,MAAM,YAAY,OAAO,KAAK,YAAY,CAAC;AAAA,IAC/E,IAAI,YAAY,OAAO,UAAU;AAAA,MAC/B,MAAM,IAAI,SAAS,OAAO,CAAC,YAAY,YAAY,OAAO,UAAU,IAAI,CAAC;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,WAAW,WAAW,YAAY,SAAS,CAAC;AAAA,IAAG,MAAM,IAAI,SAAS,QAAQ,CAAC,OAAO,OAAO,CAAC;AAAA,EAC1F,OAAO;AAAA;;AC/FT,IAAM,yBAAyB;AAS/B,eAAsB,KAAI,CAAC,SAA8C;AAAA,EACvE,MAAM,QAAQ,KAAK,IAAI;AAAA,EAEvB,OAAO,SAAS,QAAQ,QAAQ;AAAA,EAChC,IAAI,CAAC,MAAM;AAAA,IACT,OAAO;AAAA,MACL,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,YAAY;AAAA,IACd;AAAA,EACF;AAAA,EAEA,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG;AAAA,MAChC,KAAK,QAAQ;AAAA,MACb,KAAK,QAAQ;AAAA,MACb,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,OAAO;AAAA,MACL,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC7D,YAAY,KAAK,IAAI,IAAI;AAAA,IAC3B;AAAA;AAAA,EAGF,IAAI,WAAW;AAAA,EACf,IAAI,SAAS;AAAA,EAEb,MAAM,QACJ,QAAQ,cAAc,aAAa,QAAQ,YAAY,IACnD,WAAW,MAAM;AAAA,IACf,WAAW;AAAA,IACX,SAAS;AAAA,IACT,KAAK,KAAK,SAAS;AAAA,KAClB,QAAQ,SAAS,IACpB;AAAA,EAEN,MAAM,UAAU,MAAY;AAAA,IAC1B,IAAI,CAAC,QAAQ;AAAA,MACX,SAAS;AAAA,MACT,KAAK,KAAK,SAAS;AAAA,IACrB;AAAA;AAAA,EAEF,QAAQ,QAAQ,iBAAiB,SAAS,OAAO;AAAA,EACjD,IAAI,QAAQ,QAAQ,SAAS;AAAA,IAC3B,QAAQ;AAAA,EACV;AAAA,EAEA,IAAI,SAAS;AAAA,EACb,IAAI,SAAS;AAAA,EACb,IAAI,WAAW;AAAA,EACf,IAAI;AAAA,IACF,OAAO,YAAY,YAAY,QAAQ,MAAM,QAAQ,IAAI;AAAA,MACvD,IAAI,SAAS,KAAK,MAAoC,EAAE,KAAK;AAAA,MAC7D,IAAI,SAAS,KAAK,MAAoC,EAAE,KAAK;AAAA,MAC7D,KAAK;AAAA,IACP,CAAC;AAAA,IACD,SAAS;AAAA,IACT,SAAS;AAAA,IACT,WAAW,OAAO,SAAS,WAAW,OAAO;AAAA,YAC7C;AAAA,IACA,IAAI,UAAU;AAAA,MAAW,aAAa,KAAK;AAAA,IAC3C,QAAQ,QAAQ,oBAAoB,SAAS,OAAO;AAAA;AAAA,EAGtD,IAAI,UAAU,aAAa,GAAG;AAAA,IAC5B,WAAW;AAAA,EACb;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,KAAK,IAAI,IAAI;AAAA,OACrB,WAAW,EAAE,UAAU,KAAK,IAAI,CAAC;AAAA,EACvC;AAAA;",
+  "debugId": "C3376C4D866A438264756E2164756E21",
+  "names": []
+}

package/dist/{chunk-72w2pxk7.js → chunk-y1ahv8b7.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   captureSixbFailure2
-} from "./chunk-f4w3yp4f.js";
+} from "./chunk-hzw7yv5g.js";
 
 // src/error-reporting/normalize.ts
 function safeString(value) {
@@ -178,7 +178,15 @@ function reportRuleEvaluationFailure3(reporter, error, input) {
     ...input.subject === undefined ? {} : { subject: input.subject }
   });
 }
+function reportVectorIndexingFailure2(reporter, error, input) {
+  reporter.report(error, {
+    ...input,
+    type: "vector.indexing.failed",
+    occurredAt: input.failure.at,
+    notificationId: `vector-indexing:${input.projectId}:${input.indexingId}`
+  });
+}
 
-export { normalizeReportedError2, SixbErrorReporter2, reportRunFailure3, reportActionPhaseFailure3, reportEventDeliveryFailure3, reportRuleEvaluationFailure3 };
+export { normalizeReportedError2, SixbErrorReporter2, reportRunFailure3, reportActionPhaseFailure3, reportEventDeliveryFailure3, reportRuleEvaluationFailure3, reportVectorIndexingFailure2 };
 
-//# debugId=866F2695F864388E64756E2164756E21
+//# debugId=7DDB4B995793DF2C64756E2164756E21

package/dist/{chunk-72w2pxk7.js.map → chunk-y1ahv8b7.js.map}

@@ -4,9 +4,9 @@
   "sourcesContent": [
     "function safeString(value: unknown): string {\n  try {\n    return String(value)\n  } catch {\n    return \"Unknown thrown value\"\n  }\n}\n\n/** Preserve native errors and safely wrap arbitrary thrown values. */\nexport function normalizeReportedError(value: unknown): Error {\n  if (value instanceof Error) {\n    return value\n  }\n\n  if (typeof value === \"object\" && value !== null) {\n    let message: unknown\n    let name: unknown\n    try {\n      message = Reflect.get(value, \"message\")\n      name = Reflect.get(value, \"name\")\n    } catch {\n      return new Error(\"Unknown thrown value\")\n    }\n\n    if (typeof message === \"string\") {\n      const error = new Error(message)\n      if (typeof name === \"string\" && name.trim()) {\n        error.name = name\n      }\n      return error\n    }\n  }\n\n  return new Error(safeString(value))\n}\n",
     "import { normalizeReportedError } from \"./normalize\"\nimport type { SixbErrorContext, SixbErrorHandler } from \"./types\"\n\nconst DEFAULT_FLUSH_TIMEOUT_MS = 5_000\n\nexport interface ErrorReporter {\n  report(error: unknown, context: SixbErrorContext): void\n}\n\n/** Failure-isolated, non-blocking adapter around the configured callback. */\nexport class SixbErrorReporter implements ErrorReporter {\n  private readonly pending = new Set<Promise<void>>()\n\n  constructor(private readonly handler?: SixbErrorHandler) {}\n\n  report(error: unknown, context: SixbErrorContext): void {\n    const normalizedError = normalizeReportedError(error)\n    if (!this.handler) {\n      reportToConsole(normalizedError, context)\n      return\n    }\n\n    const invocation = Promise.resolve()\n      .then(() => this.handler?.(normalizedError, context))\n      .then(() => undefined)\n      .catch((handlerError) => {\n        try {\n          console.error(\"[Sixb] onError handler failed:\", handlerError)\n        } catch {\n          // Error reporting must never escape back into framework execution.\n        }\n      })\n\n    const tracked = invocation.finally(() => {\n      this.pending.delete(tracked)\n    })\n    this.pending.add(tracked)\n  }\n\n  async flush(timeoutMs = DEFAULT_FLUSH_TIMEOUT_MS): Promise<void> {\n    const deadline = Date.now() + Math.max(0, timeoutMs)\n    while (this.pending.size > 0) {\n      const remainingMs = deadline - Date.now()\n      if (remainingMs <= 0 || !(await settleWithin([...this.pending], remainingMs))) {\n        try {\n          console.error(\n            `[Sixb] Timed out after ${timeoutMs}ms waiting for ${this.pending.size} onError handler(s).`\n          )\n        } catch {\n          // Error reporting must never escape back into framework shutdown.\n        }\n        return\n      }\n    }\n  }\n}\n\nfunction reportToConsole(error: Error, context: SixbErrorContext): void {\n  try {\n    console.error(`[Sixb] Unhandled ${context.type}:`, error, context)\n  } catch {\n    // Error reporting must never escape back into framework execution.\n  }\n}\n\nasync function settleWithin(\n  promises: readonly Promise<void>[],\n  timeoutMs: number\n): Promise<boolean> {\n  let timeout: ReturnType<typeof setTimeout> | undefined\n  try {\n    return await Promise.race([\n      Promise.allSettled(promises).then(() => true),\n      new Promise<false>((resolve) => {\n        timeout = setTimeout(() => resolve(false), timeoutMs)\n      }),\n    ])\n  } finally {\n    if (timeout) clearTimeout(timeout)\n  }\n}\n",
-    "import { randomUUID } from \"node:crypto\"\nimport { captureSixbFailure } from \"../errors/internal\"\nimport type { SixbFailure } from \"../errors/types\"\nimport type { ActionRunFailure } from \"../storage/action-runs\"\nimport type { ErrorReporter } from \"./reporter\"\nimport type { SixbFailedRun } from \"./types\"\n\nfunction resolveOccurredAt(occurredAt?: Date | string): string {\n  if (occurredAt instanceof Date) return occurredAt.toISOString()\n  return occurredAt ?? new Date().toISOString()\n}\n\nexport type ReportRunFailureInput = SixbFailedRun & {\n  readonly projectId: string\n  readonly attempt?: number\n}\n\nexport function reportRunFailure(\n  reporter: ErrorReporter,\n  error: unknown,\n  input: ReportRunFailureInput\n): void {\n  const occurredAt = input.failure.at\n  reporter.report(error, {\n    ...input,\n    type: \"run.failed\",\n    notificationId: `project:${input.projectId}:run:${input.runKind}:${input.run.runId}:failed:${occurredAt}`,\n    occurredAt,\n  })\n}\n\nexport interface ReportActionPhaseFailureInput {\n  readonly projectId: string\n  readonly actionId: string\n  readonly runId: string\n  readonly phase: \"effects\"\n  readonly failure: ActionRunFailure<\"effects\">\n}\n\nexport function reportActionPhaseFailure(\n  reporter: ErrorReporter,\n  error: unknown,\n  input: ReportActionPhaseFailureInput\n): void {\n  reporter.report(error, {\n    type: \"action.phase.failed\",\n    notificationId: `project:${input.projectId}:action:${input.actionId}:run:${input.runId}:phase:${input.phase}:failed:${input.failure.at}`,\n    projectId: input.projectId,\n    occurredAt: input.failure.at,\n    actionId: input.actionId,\n    runId: input.runId,\n    phase: input.phase,\n    failure: input.failure,\n  })\n}\n\nexport interface ReportEventDeliveryFailureInput {\n  readonly projectId: string\n  /** Exact durable failure when this delivery was persisted by the ontology outbox. */\n  readonly failure?: SixbFailure<\"event.delivery_failed\">\n  /** Event types that never reached subscribers. Payloads must not be passed in. */\n  readonly eventTypes: readonly string[]\n  readonly occurredAt?: Date | string\n  /** Delivery attempts so far. Defaults to 1, which is right for a rejected emit. */\n  readonly attempts?: number\n  /** Envelope ids, when the events were persisted before delivery failed. */\n  readonly eventIds?: readonly string[]\n  /**\n   * Identity of this loss, used only when nothing was persisted. Defaults to a fresh id; pass one to\n   * make a report reproducible in a test.\n   */\n  readonly occurrenceId?: string\n}\n\n/**\n * Report that domain events were lost.\n *\n * Both delivery paths land here: the outbox dispatcher, which has persisted envelope ids and retries,\n * and a rejected `events.emit()`, which has only the types. Reporting must work for both — an earlier\n * version returned early on an empty `eventIds`, which silently dropped exactly the case this exists\n * to surface.\n *\n * Each path keys on the strongest identity it has. The outbox persisted its envelopes, so the ids plus\n * the attempt number name the loss exactly and stay stable if one report is delivered twice. A rejected\n * emit persisted nothing and is always terminal at attempt 1, so the type list alone was its whole\n * correlation — and two schedules losing `schedule.triggered` in the same broker outage are dispatched\n * concurrently, land in the same millisecond, and were therefore one notification. A timestamp does not\n * fix that; an identity does.\n */\nexport function reportEventDeliveryFailure(\n  reporter: ErrorReporter,\n  error: unknown,\n  input: ReportEventDeliveryFailureInput\n): void {\n  const occurredAt = input.failure?.at ?? resolveOccurredAt(input.occurredAt)\n  const attempts = input.attempts ?? 1\n  const eventIds = input.eventIds === undefined ? undefined : [...input.eventIds].sort()\n  const eventTypes = [...input.eventTypes]\n  const failure =\n    input.failure ??\n    captureSixbFailure(error, {\n      allowedCodes: [\"event.delivery_failed\"],\n      defaultCode: \"event.delivery_failed\",\n      details: {\n        attempts,\n        eventTypes,\n        ...(eventIds === undefined ? {} : { eventIds }),\n      },\n      at: new Date(occurredAt),\n    })\n  const firstEventId = eventIds?.[0]\n  const occurrence = firstEventId\n    ? `events:${firstEventId}:attempt:${attempts}`\n    : `emit:${input.occurrenceId ?? randomUUID()}`\n  reporter.report(error, {\n    type: \"event.delivery.failed\",\n    notificationId: `project:${input.projectId}:event-delivery:${occurrence}`,\n    projectId: input.projectId,\n    occurredAt,\n    failure,\n    attempts,\n    eventTypes,\n    ...(eventIds === undefined ? {} : { eventIds }),\n  })\n}\n\nexport interface ReportRuleEvaluationFailureInput {\n  readonly projectId: string\n  readonly source: \"live\" | \"reconciliation\"\n  readonly eventIds?: readonly string[]\n  readonly occurredAt?: Date | string\n  /** Set when the failure could be attributed to one rule/subject candidate. */\n  readonly ruleId?: string\n  readonly subject?: { readonly objectTypeId: string; readonly primaryId: string }\n}\n\nexport function reportRuleEvaluationFailure(\n  reporter: ErrorReporter,\n  error: unknown,\n  input: ReportRuleEvaluationFailureInput\n): void {\n  const occurredAt = resolveOccurredAt(input.occurredAt)\n  const eventIds = [...(input.eventIds ?? [])].sort()\n  const failure = captureSixbFailure(error, {\n    allowedCodes: [\"internal.unexpected\"],\n    defaultCode: \"internal.unexpected\",\n    details: {\n      source: input.source,\n      eventIds,\n      ...(input.ruleId === undefined ? {} : { ruleId: input.ruleId }),\n      ...(input.subject === undefined ? {} : { subject: input.subject }),\n    },\n    at: new Date(occurredAt),\n  })\n  // A candidate-level failure keys on the candidate, so two rules failing over the same batch stay\n  // two notifications rather than collapsing into one.\n  const occurrence =\n    input.ruleId && input.subject\n      ? `${input.ruleId}:${input.subject.objectTypeId}:${input.subject.primaryId}`\n      : (eventIds[0] ?? \"current-state\")\n  reporter.report(error, {\n    type: \"rule.evaluation.failed\",\n    notificationId: `project:${input.projectId}:rule-evaluation:${input.source}:${occurrence}:failed:${occurredAt}`,\n    projectId: input.projectId,\n    occurredAt,\n    failure,\n    source: input.source,\n    eventIds,\n    ...(input.ruleId === undefined ? {} : { ruleId: input.ruleId }),\n    ...(input.subject === undefined ? {} : { subject: input.subject }),\n  })\n}\n"
+    "import { randomUUID } from \"node:crypto\"\nimport { captureSixbFailure } from \"../errors/internal\"\nimport type { SixbFailure } from \"../errors/types\"\nimport type { ActionRunFailure } from \"../storage/action-runs\"\nimport type { VectorIndexingFailureCode } from \"../storage/ontology/vector-indexing\"\nimport type { ErrorReporter } from \"./reporter\"\nimport type { SixbFailedRun } from \"./types\"\n\nfunction resolveOccurredAt(occurredAt?: Date | string): string {\n  if (occurredAt instanceof Date) return occurredAt.toISOString()\n  return occurredAt ?? new Date().toISOString()\n}\n\nexport type ReportRunFailureInput = SixbFailedRun & {\n  readonly projectId: string\n  readonly attempt?: number\n}\n\nexport function reportRunFailure(\n  reporter: ErrorReporter,\n  error: unknown,\n  input: ReportRunFailureInput\n): void {\n  const occurredAt = input.failure.at\n  reporter.report(error, {\n    ...input,\n    type: \"run.failed\",\n    notificationId: `project:${input.projectId}:run:${input.runKind}:${input.run.runId}:failed:${occurredAt}`,\n    occurredAt,\n  })\n}\n\nexport interface ReportActionPhaseFailureInput {\n  readonly projectId: string\n  readonly actionId: string\n  readonly runId: string\n  readonly phase: \"effects\"\n  readonly failure: ActionRunFailure<\"effects\">\n}\n\nexport function reportActionPhaseFailure(\n  reporter: ErrorReporter,\n  error: unknown,\n  input: ReportActionPhaseFailureInput\n): void {\n  reporter.report(error, {\n    type: \"action.phase.failed\",\n    notificationId: `project:${input.projectId}:action:${input.actionId}:run:${input.runId}:phase:${input.phase}:failed:${input.failure.at}`,\n    projectId: input.projectId,\n    occurredAt: input.failure.at,\n    actionId: input.actionId,\n    runId: input.runId,\n    phase: input.phase,\n    failure: input.failure,\n  })\n}\n\nexport interface ReportEventDeliveryFailureInput {\n  readonly projectId: string\n  /** Exact durable failure when this delivery was persisted by the ontology outbox. */\n  readonly failure?: SixbFailure<\"event.delivery_failed\">\n  /** Event types that never reached subscribers. Payloads must not be passed in. */\n  readonly eventTypes: readonly string[]\n  readonly occurredAt?: Date | string\n  /** Delivery attempts so far. Defaults to 1, which is right for a rejected emit. */\n  readonly attempts?: number\n  /** Envelope ids, when the events were persisted before delivery failed. */\n  readonly eventIds?: readonly string[]\n  /**\n   * Identity of this loss, used only when nothing was persisted. Defaults to a fresh id; pass one to\n   * make a report reproducible in a test.\n   */\n  readonly occurrenceId?: string\n}\n\n/**\n * Report that domain events were lost.\n *\n * Both delivery paths land here: the outbox dispatcher, which has persisted envelope ids and retries,\n * and a rejected `events.emit()`, which has only the types. Reporting must work for both — an earlier\n * version returned early on an empty `eventIds`, which silently dropped exactly the case this exists\n * to surface.\n *\n * Each path keys on the strongest identity it has. The outbox persisted its envelopes, so the ids plus\n * the attempt number name the loss exactly and stay stable if one report is delivered twice. A rejected\n * emit persisted nothing and is always terminal at attempt 1, so the type list alone was its whole\n * correlation — and two schedules losing `schedule.triggered` in the same broker outage are dispatched\n * concurrently, land in the same millisecond, and were therefore one notification. A timestamp does not\n * fix that; an identity does.\n */\nexport function reportEventDeliveryFailure(\n  reporter: ErrorReporter,\n  error: unknown,\n  input: ReportEventDeliveryFailureInput\n): void {\n  const occurredAt = input.failure?.at ?? resolveOccurredAt(input.occurredAt)\n  const attempts = input.attempts ?? 1\n  const eventIds = input.eventIds === undefined ? undefined : [...input.eventIds].sort()\n  const eventTypes = [...input.eventTypes]\n  const failure =\n    input.failure ??\n    captureSixbFailure(error, {\n      allowedCodes: [\"event.delivery_failed\"],\n      defaultCode: \"event.delivery_failed\",\n      details: {\n        attempts,\n        eventTypes,\n        ...(eventIds === undefined ? {} : { eventIds }),\n      },\n      at: new Date(occurredAt),\n    })\n  const firstEventId = eventIds?.[0]\n  const occurrence = firstEventId\n    ? `events:${firstEventId}:attempt:${attempts}`\n    : `emit:${input.occurrenceId ?? randomUUID()}`\n  reporter.report(error, {\n    type: \"event.delivery.failed\",\n    notificationId: `project:${input.projectId}:event-delivery:${occurrence}`,\n    projectId: input.projectId,\n    occurredAt,\n    failure,\n    attempts,\n    eventTypes,\n    ...(eventIds === undefined ? {} : { eventIds }),\n  })\n}\n\nexport interface ReportRuleEvaluationFailureInput {\n  readonly projectId: string\n  readonly source: \"live\" | \"reconciliation\"\n  readonly eventIds?: readonly string[]\n  readonly occurredAt?: Date | string\n  /** Set when the failure could be attributed to one rule/subject candidate. */\n  readonly ruleId?: string\n  readonly subject?: { readonly objectTypeId: string; readonly primaryId: string }\n}\n\nexport function reportRuleEvaluationFailure(\n  reporter: ErrorReporter,\n  error: unknown,\n  input: ReportRuleEvaluationFailureInput\n): void {\n  const occurredAt = resolveOccurredAt(input.occurredAt)\n  const eventIds = [...(input.eventIds ?? [])].sort()\n  const failure = captureSixbFailure(error, {\n    allowedCodes: [\"internal.unexpected\"],\n    defaultCode: \"internal.unexpected\",\n    details: {\n      source: input.source,\n      eventIds,\n      ...(input.ruleId === undefined ? {} : { ruleId: input.ruleId }),\n      ...(input.subject === undefined ? {} : { subject: input.subject }),\n    },\n    at: new Date(occurredAt),\n  })\n  // A candidate-level failure keys on the candidate, so two rules failing over the same batch stay\n  // two notifications rather than collapsing into one.\n  const occurrence =\n    input.ruleId && input.subject\n      ? `${input.ruleId}:${input.subject.objectTypeId}:${input.subject.primaryId}`\n      : (eventIds[0] ?? \"current-state\")\n  reporter.report(error, {\n    type: \"rule.evaluation.failed\",\n    notificationId: `project:${input.projectId}:rule-evaluation:${input.source}:${occurrence}:failed:${occurredAt}`,\n    projectId: input.projectId,\n    occurredAt,\n    failure,\n    source: input.source,\n    eventIds,\n    ...(input.ruleId === undefined ? {} : { ruleId: input.ruleId }),\n    ...(input.subject === undefined ? {} : { subject: input.subject }),\n  })\n}\n\nexport interface ReportVectorIndexingFailureInput {\n  readonly projectId: string\n  readonly indexingId: string\n  readonly failure: SixbFailure<VectorIndexingFailureCode>\n  readonly objectTypeId: string\n  readonly primaryId: string\n  readonly profile: string\n}\n\nexport function reportVectorIndexingFailure(\n  reporter: ErrorReporter,\n  error: unknown,\n  input: ReportVectorIndexingFailureInput\n): void {\n  reporter.report(error, {\n    ...input,\n    type: \"vector.indexing.failed\",\n    occurredAt: input.failure.at,\n    notificationId: `vector-indexing:${input.projectId}:${input.indexingId}`,\n  })\n}\n"
   ],
-  "mappings": ";;;;;;AAAA,SAAS,UAAU,CAAC,OAAwB;AAAA,EAC1C,IAAI;AAAA,IACF,OAAO,OAAO,KAAK;AAAA,IACnB,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAKJ,SAAS,uBAAsB,CAAC,OAAuB;AAAA,EAC5D,IAAI,iBAAiB,OAAO;AAAA,IAC1B,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,IAAI;AAAA,MACF,UAAU,QAAQ,IAAI,OAAO,SAAS;AAAA,MACtC,OAAO,QAAQ,IAAI,OAAO,MAAM;AAAA,MAChC,MAAM;AAAA,MACN,OAAO,IAAI,MAAM,sBAAsB;AAAA;AAAA,IAGzC,IAAI,OAAO,YAAY,UAAU;AAAA,MAC/B,MAAM,QAAQ,IAAI,MAAM,OAAO;AAAA,MAC/B,IAAI,OAAO,SAAS,YAAY,KAAK,KAAK,GAAG;AAAA,QAC3C,MAAM,OAAO;AAAA,MACf;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,OAAO,IAAI,MAAM,WAAW,KAAK,CAAC;AAAA;;;AC9BpC,IAAM,2BAA2B;AAAA;AAO1B,MAAM,mBAA2C;AAAA,EAGzB;AAAA,EAFZ,UAAU,IAAI;AAAA,EAE/B,WAAW,CAAkB,SAA4B;AAAA,IAA5B;AAAA;AAAA,EAE7B,MAAM,CAAC,OAAgB,SAAiC;AAAA,IACtD,MAAM,kBAAkB,wBAAuB,KAAK;AAAA,IACpD,IAAI,CAAC,KAAK,SAAS;AAAA,MACjB,gBAAgB,iBAAiB,OAAO;AAAA,MACxC;AAAA,IACF;AAAA,IAEA,MAAM,aAAa,QAAQ,QAAQ,EAChC,KAAK,MAAM,KAAK,UAAU,iBAAiB,OAAO,CAAC,EACnD,KAAK,MAAG;AAAA,MAAG;AAAA,KAAS,EACpB,MAAM,CAAC,iBAAiB;AAAA,MACvB,IAAI;AAAA,QACF,QAAQ,MAAM,kCAAkC,YAAY;AAAA,QAC5D,MAAM;AAAA,KAGT;AAAA,IAEH,MAAM,UAAU,WAAW,QAAQ,MAAM;AAAA,MACvC,KAAK,QAAQ,OAAO,OAAO;AAAA,KAC5B;AAAA,IACD,KAAK,QAAQ,IAAI,OAAO;AAAA;AAAA,OAGpB,MAAK,CAAC,YAAY,0BAAyC;AAAA,IAC/D,MAAM,WAAW,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,SAAS;AAAA,IACnD,OAAO,KAAK,QAAQ,OAAO,GAAG;AAAA,MAC5B,MAAM,cAAc,WAAW,KAAK,IAAI;AAAA,MACxC,IAAI,eAAe,KAAK,CAAE,MAAM,aAAa,CAAC,GAAG,KAAK,OAAO,GAAG,WAAW,GAAI;AAAA,QAC7E,IAAI;AAAA,UACF,QAAQ,MACN,0BAA0B,2BAA2B,KAAK,QAAQ,0BACpE;AAAA,UACA,MAAM;AAAA,QAGR;AAAA,MACF;AAAA,IACF;AAAA;AAEJ;AAEA,SAAS,eAAe,CAAC,OAAc,SAAiC;AAAA,EACtE,IAAI;AAAA,IACF,QAAQ,MAAM,oBAAoB,QAAQ,SAAS,OAAO,OAAO;AAAA,IACjE,MAAM;AAAA;AAKV,eAAe,YAAY,CACzB,UACA,WACkB;AAAA,EAClB,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,OAAO,MAAM,QAAQ,KAAK;AAAA,MACxB,QAAQ,WAAW,QAAQ,EAAE,KAAK,MAAM,IAAI;AAAA,MAC5C,IAAI,QAAe,CAAC,YAAY;AAAA,QAC9B,UAAU,WAAW,MAAM,QAAQ,KAAK,GAAG,SAAS;AAAA,OACrD;AAAA,IACH,CAAC;AAAA,YACD;AAAA,IACA,IAAI;AAAA,MAAS,aAAa,OAAO;AAAA;AAAA;;;AC9ErC;AAOA,SAAS,iBAAiB,CAAC,YAAoC;AAAA,EAC7D,IAAI,sBAAsB;AAAA,IAAM,OAAO,WAAW,YAAY;AAAA,EAC9D,OAAO,cAAc,IAAI,KAAK,EAAE,YAAY;AAAA;AAQvC,SAAS,iBAAgB,CAC9B,UACA,OACA,OACM;AAAA,EACN,MAAM,aAAa,MAAM,QAAQ;AAAA,EACjC,SAAS,OAAO,OAAO;AAAA,OAClB;AAAA,IACH,MAAM;AAAA,IACN,gBAAgB,WAAW,MAAM,iBAAiB,MAAM,WAAW,MAAM,IAAI,gBAAgB;AAAA,IAC7F;AAAA,EACF,CAAC;AAAA;AAWI,SAAS,yBAAwB,CACtC,UACA,OACA,OACM;AAAA,EACN,SAAS,OAAO,OAAO;AAAA,IACrB,MAAM;AAAA,IACN,gBAAgB,WAAW,MAAM,oBAAoB,MAAM,gBAAgB,MAAM,eAAe,MAAM,gBAAgB,MAAM,QAAQ;AAAA,IACpI,WAAW,MAAM;AAAA,IACjB,YAAY,MAAM,QAAQ;AAAA,IAC1B,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM;AAAA,IACb,OAAO,MAAM;AAAA,IACb,SAAS,MAAM;AAAA,EACjB,CAAC;AAAA;AAoCI,SAAS,2BAA0B,CACxC,UACA,OACA,OACM;AAAA,EACN,MAAM,aAAa,MAAM,SAAS,MAAM,kBAAkB,MAAM,UAAU;AAAA,EAC1E,MAAM,WAAW,MAAM,YAAY;AAAA,EACnC,MAAM,WAAW,MAAM,aAAa,YAAY,YAAY,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK;AAAA,EACrF,MAAM,aAAa,CAAC,GAAG,MAAM,UAAU;AAAA,EACvC,MAAM,UACJ,MAAM,WACN,oBAAmB,OAAO;AAAA,IACxB,cAAc,CAAC,uBAAuB;AAAA,IACtC,aAAa;AAAA,IACb,SAAS;AAAA,MACP;AAAA,MACA;AAAA,SACI,aAAa,YAAY,CAAC,IAAI,EAAE,SAAS;AAAA,IAC/C;AAAA,IACA,IAAI,IAAI,KAAK,UAAU;AAAA,EACzB,CAAC;AAAA,EACH,MAAM,eAAe,WAAW;AAAA,EAChC,MAAM,aAAa,eACf,UAAU,wBAAwB,aAClC,QAAQ,MAAM,gBAAgB,WAAW;AAAA,EAC7C,SAAS,OAAO,OAAO;AAAA,IACrB,MAAM;AAAA,IACN,gBAAgB,WAAW,MAAM,4BAA4B;AAAA,IAC7D,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,OACI,aAAa,YAAY,CAAC,IAAI,EAAE,SAAS;AAAA,EAC/C,CAAC;AAAA;AAaI,SAAS,4BAA2B,CACzC,UACA,OACA,OACM;AAAA,EACN,MAAM,aAAa,kBAAkB,MAAM,UAAU;AAAA,EACrD,MAAM,WAAW,CAAC,GAAI,MAAM,YAAY,CAAC,CAAE,EAAE,KAAK;AAAA,EAClD,MAAM,UAAU,oBAAmB,OAAO;AAAA,IACxC,cAAc,CAAC,qBAAqB;AAAA,IACpC,aAAa;AAAA,IACb,SAAS;AAAA,MACP,QAAQ,MAAM;AAAA,MACd;AAAA,SACI,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,SACzD,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,IAClE;AAAA,IACA,IAAI,IAAI,KAAK,UAAU;AAAA,EACzB,CAAC;AAAA,EAGD,MAAM,aACJ,MAAM,UAAU,MAAM,UAClB,GAAG,MAAM,UAAU,MAAM,QAAQ,gBAAgB,MAAM,QAAQ,cAC9D,SAAS,MAAM;AAAA,EACtB,SAAS,OAAO,OAAO;AAAA,IACrB,MAAM;AAAA,IACN,gBAAgB,WAAW,MAAM,6BAA6B,MAAM,UAAU,qBAAqB;AAAA,IACnG,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,QAAQ,MAAM;AAAA,IACd;AAAA,OACI,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,OACzD,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,EAClE,CAAC;AAAA;",
-  "debugId": "866F2695F864388E64756E2164756E21",
+  "mappings": ";;;;;;AAAA,SAAS,UAAU,CAAC,OAAwB;AAAA,EAC1C,IAAI;AAAA,IACF,OAAO,OAAO,KAAK;AAAA,IACnB,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAKJ,SAAS,uBAAsB,CAAC,OAAuB;AAAA,EAC5D,IAAI,iBAAiB,OAAO;AAAA,IAC1B,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,IAAI;AAAA,MACF,UAAU,QAAQ,IAAI,OAAO,SAAS;AAAA,MACtC,OAAO,QAAQ,IAAI,OAAO,MAAM;AAAA,MAChC,MAAM;AAAA,MACN,OAAO,IAAI,MAAM,sBAAsB;AAAA;AAAA,IAGzC,IAAI,OAAO,YAAY,UAAU;AAAA,MAC/B,MAAM,QAAQ,IAAI,MAAM,OAAO;AAAA,MAC/B,IAAI,OAAO,SAAS,YAAY,KAAK,KAAK,GAAG;AAAA,QAC3C,MAAM,OAAO;AAAA,MACf;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,OAAO,IAAI,MAAM,WAAW,KAAK,CAAC;AAAA;;;AC9BpC,IAAM,2BAA2B;AAAA;AAO1B,MAAM,mBAA2C;AAAA,EAGzB;AAAA,EAFZ,UAAU,IAAI;AAAA,EAE/B,WAAW,CAAkB,SAA4B;AAAA,IAA5B;AAAA;AAAA,EAE7B,MAAM,CAAC,OAAgB,SAAiC;AAAA,IACtD,MAAM,kBAAkB,wBAAuB,KAAK;AAAA,IACpD,IAAI,CAAC,KAAK,SAAS;AAAA,MACjB,gBAAgB,iBAAiB,OAAO;AAAA,MACxC;AAAA,IACF;AAAA,IAEA,MAAM,aAAa,QAAQ,QAAQ,EAChC,KAAK,MAAM,KAAK,UAAU,iBAAiB,OAAO,CAAC,EACnD,KAAK,MAAG;AAAA,MAAG;AAAA,KAAS,EACpB,MAAM,CAAC,iBAAiB;AAAA,MACvB,IAAI;AAAA,QACF,QAAQ,MAAM,kCAAkC,YAAY;AAAA,QAC5D,MAAM;AAAA,KAGT;AAAA,IAEH,MAAM,UAAU,WAAW,QAAQ,MAAM;AAAA,MACvC,KAAK,QAAQ,OAAO,OAAO;AAAA,KAC5B;AAAA,IACD,KAAK,QAAQ,IAAI,OAAO;AAAA;AAAA,OAGpB,MAAK,CAAC,YAAY,0BAAyC;AAAA,IAC/D,MAAM,WAAW,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,SAAS;AAAA,IACnD,OAAO,KAAK,QAAQ,OAAO,GAAG;AAAA,MAC5B,MAAM,cAAc,WAAW,KAAK,IAAI;AAAA,MACxC,IAAI,eAAe,KAAK,CAAE,MAAM,aAAa,CAAC,GAAG,KAAK,OAAO,GAAG,WAAW,GAAI;AAAA,QAC7E,IAAI;AAAA,UACF,QAAQ,MACN,0BAA0B,2BAA2B,KAAK,QAAQ,0BACpE;AAAA,UACA,MAAM;AAAA,QAGR;AAAA,MACF;AAAA,IACF;AAAA;AAEJ;AAEA,SAAS,eAAe,CAAC,OAAc,SAAiC;AAAA,EACtE,IAAI;AAAA,IACF,QAAQ,MAAM,oBAAoB,QAAQ,SAAS,OAAO,OAAO;AAAA,IACjE,MAAM;AAAA;AAKV,eAAe,YAAY,CACzB,UACA,WACkB;AAAA,EAClB,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,OAAO,MAAM,QAAQ,KAAK;AAAA,MACxB,QAAQ,WAAW,QAAQ,EAAE,KAAK,MAAM,IAAI;AAAA,MAC5C,IAAI,QAAe,CAAC,YAAY;AAAA,QAC9B,UAAU,WAAW,MAAM,QAAQ,KAAK,GAAG,SAAS;AAAA,OACrD;AAAA,IACH,CAAC;AAAA,YACD;AAAA,IACA,IAAI;AAAA,MAAS,aAAa,OAAO;AAAA;AAAA;;;AC9ErC;AAQA,SAAS,iBAAiB,CAAC,YAAoC;AAAA,EAC7D,IAAI,sBAAsB;AAAA,IAAM,OAAO,WAAW,YAAY;AAAA,EAC9D,OAAO,cAAc,IAAI,KAAK,EAAE,YAAY;AAAA;AAQvC,SAAS,iBAAgB,CAC9B,UACA,OACA,OACM;AAAA,EACN,MAAM,aAAa,MAAM,QAAQ;AAAA,EACjC,SAAS,OAAO,OAAO;AAAA,OAClB;AAAA,IACH,MAAM;AAAA,IACN,gBAAgB,WAAW,MAAM,iBAAiB,MAAM,WAAW,MAAM,IAAI,gBAAgB;AAAA,IAC7F;AAAA,EACF,CAAC;AAAA;AAWI,SAAS,yBAAwB,CACtC,UACA,OACA,OACM;AAAA,EACN,SAAS,OAAO,OAAO;AAAA,IACrB,MAAM;AAAA,IACN,gBAAgB,WAAW,MAAM,oBAAoB,MAAM,gBAAgB,MAAM,eAAe,MAAM,gBAAgB,MAAM,QAAQ;AAAA,IACpI,WAAW,MAAM;AAAA,IACjB,YAAY,MAAM,QAAQ;AAAA,IAC1B,UAAU,MAAM;AAAA,IAChB,OAAO,MAAM;AAAA,IACb,OAAO,MAAM;AAAA,IACb,SAAS,MAAM;AAAA,EACjB,CAAC;AAAA;AAoCI,SAAS,2BAA0B,CACxC,UACA,OACA,OACM;AAAA,EACN,MAAM,aAAa,MAAM,SAAS,MAAM,kBAAkB,MAAM,UAAU;AAAA,EAC1E,MAAM,WAAW,MAAM,YAAY;AAAA,EACnC,MAAM,WAAW,MAAM,aAAa,YAAY,YAAY,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK;AAAA,EACrF,MAAM,aAAa,CAAC,GAAG,MAAM,UAAU;AAAA,EACvC,MAAM,UACJ,MAAM,WACN,oBAAmB,OAAO;AAAA,IACxB,cAAc,CAAC,uBAAuB;AAAA,IACtC,aAAa;AAAA,IACb,SAAS;AAAA,MACP;AAAA,MACA;AAAA,SACI,aAAa,YAAY,CAAC,IAAI,EAAE,SAAS;AAAA,IAC/C;AAAA,IACA,IAAI,IAAI,KAAK,UAAU;AAAA,EACzB,CAAC;AAAA,EACH,MAAM,eAAe,WAAW;AAAA,EAChC,MAAM,aAAa,eACf,UAAU,wBAAwB,aAClC,QAAQ,MAAM,gBAAgB,WAAW;AAAA,EAC7C,SAAS,OAAO,OAAO;AAAA,IACrB,MAAM;AAAA,IACN,gBAAgB,WAAW,MAAM,4BAA4B;AAAA,IAC7D,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,OACI,aAAa,YAAY,CAAC,IAAI,EAAE,SAAS;AAAA,EAC/C,CAAC;AAAA;AAaI,SAAS,4BAA2B,CACzC,UACA,OACA,OACM;AAAA,EACN,MAAM,aAAa,kBAAkB,MAAM,UAAU;AAAA,EACrD,MAAM,WAAW,CAAC,GAAI,MAAM,YAAY,CAAC,CAAE,EAAE,KAAK;AAAA,EAClD,MAAM,UAAU,oBAAmB,OAAO;AAAA,IACxC,cAAc,CAAC,qBAAqB;AAAA,IACpC,aAAa;AAAA,IACb,SAAS;AAAA,MACP,QAAQ,MAAM;AAAA,MACd;AAAA,SACI,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,SACzD,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,IAClE;AAAA,IACA,IAAI,IAAI,KAAK,UAAU;AAAA,EACzB,CAAC;AAAA,EAGD,MAAM,aACJ,MAAM,UAAU,MAAM,UAClB,GAAG,MAAM,UAAU,MAAM,QAAQ,gBAAgB,MAAM,QAAQ,cAC9D,SAAS,MAAM;AAAA,EACtB,SAAS,OAAO,OAAO;AAAA,IACrB,MAAM;AAAA,IACN,gBAAgB,WAAW,MAAM,6BAA6B,MAAM,UAAU,qBAAqB;AAAA,IACnG,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,QAAQ,MAAM;AAAA,IACd;AAAA,OACI,MAAM,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,OACzD,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,EAClE,CAAC;AAAA;AAYI,SAAS,4BAA2B,CACzC,UACA,OACA,OACM;AAAA,EACN,SAAS,OAAO,OAAO;AAAA,OAClB;AAAA,IACH,MAAM;AAAA,IACN,YAAY,MAAM,QAAQ;AAAA,IAC1B,gBAAgB,mBAAmB,MAAM,aAAa,MAAM;AAAA,EAC9D,CAAC;AAAA;",
+  "debugId": "7DDB4B995793DF2C64756E2164756E21",
   "names": []
 }

package/dist/chunk-y3ev53cq.js

@@ -0,0 +1,84 @@
+// @bun
+import {
+  normalizeSchemaValue2,
+  coerceSchemaValueToTyped2
+} from "./chunk-vsg0g7h9.js";
+import {
+  validateSchemaOrRefValue2
+} from "./chunk-vpxss818.js";
+import {
+  OntologyValidationError2
+} from "./chunk-cqr3acm1.js";
+import {
+  isPlainRecord
+} from "./chunk-wy0qdqfm.js";
+
+// src/shared/params/validation.ts
+function normalizeParams(valueTypesById, paramsConfig, params, owner) {
+  if (!isPlainRecord(params)) {
+    throw new OntologyValidationError2(`[Sixb] ${capitalize(owner.kind)} params must be an object.`);
+  }
+  const knownParamIds = new Set(Object.keys(paramsConfig));
+  const normalized = [];
+  for (const paramId of Object.keys(params)) {
+    if (!knownParamIds.has(paramId)) {
+      throw new OntologyValidationError2(`Unknown param '${paramId}' for ${owner.kind} '${owner.id}'`);
+    }
+  }
+  for (const [paramId, paramDef] of Object.entries(paramsConfig)) {
+    const value = Object.hasOwn(params, paramId) ? params[paramId] : undefined;
+    if (value === undefined) {
+      if (paramDef.required) {
+        throw new OntologyValidationError2(`Missing required param '${paramId}' for ${owner.kind} '${owner.id}'`);
+      }
+      continue;
+    }
+    const path = `${owner.path ?? owner.id}.${paramId}`;
+    if (value === null) {
+      if (!paramDef.nullable) {
+        throw new OntologyValidationError2(`[Sixb] ${capitalize(owner.kind)} param ${path} cannot be null`);
+      }
+      normalized.push([paramId, null]);
+      continue;
+    }
+    validateSchemaOrRefValue2(paramDef.schema, value, path, valueTypesById);
+    normalized.push([
+      paramId,
+      normalizeSchemaOrRefValue(paramDef.schema, value, path, valueTypesById)
+    ]);
+  }
+  return Object.fromEntries(normalized);
+}
+function coerceParamsToTyped(paramsConfig, params, valueTypesById) {
+  const coerced = { ...params };
+  for (const [paramId, paramDef] of Object.entries(paramsConfig)) {
+    if (!Object.hasOwn(params, paramId))
+      continue;
+    const value = params[paramId];
+    if (value === undefined)
+      continue;
+    const schema = paramDef.schema;
+    if (typeof schema === "object" && schema !== null && schema.type === "objectRef") {
+      continue;
+    }
+    coerced[paramId] = coerceSchemaValueToTyped2(schema, value, valueTypesById);
+  }
+  return coerced;
+}
+function normalizeSchemaOrRefValue(schema, value, path, valueTypesById) {
+  if (typeof schema === "object" && schema !== null && schema.type === "objectRef") {
+    const refValue = value;
+    return {
+      objectTypeId: refValue.objectTypeId,
+      primaryId: refValue.primaryId
+    };
+  }
+  return normalizeSchemaValue2(schema, value, path, valueTypesById);
+}
+function capitalize(value) {
+  return value.length === 0 ? value : `${value[0]?.toUpperCase()}${value.slice(1)}`;
+}
+
+export { normalizeParams, coerceParamsToTyped };
+
+//# debugId=D4E5B3AF980E36C164756E2164756E21

package/dist/chunk-y3ev53cq.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/shared/params/validation.ts"],
+  "sourcesContent": [
+    "import { isPlainRecord, type JsonValue } from \"../../json\"\nimport type { SchemaOrRef, ValueType } from \"../../ontology\"\nimport { OntologyValidationError } from \"../../ontology/errors\"\nimport { validateSchemaOrRefValue } from \"../../ontology/refs\"\nimport type { Schema } from \"../../ontology/types\"\nimport { coerceSchemaValueToTyped, normalizeSchemaValue } from \"../../ontology/validation\"\nimport type { ParamsConfig } from \"./types\"\n\nexport interface ParamsOwner {\n  /** Lowercase singular name used in validation errors, for example `action` or `agent`. */\n  readonly kind: string\n  readonly id: string\n  /** Stable value path passed to ontology validation. Defaults to `id`. */\n  readonly path?: string\n}\n\n/** Validate declarative params and normalize them to their durable JSON representation. */\nexport function normalizeParams(\n  valueTypesById: ReadonlyMap<string, ValueType>,\n  paramsConfig: ParamsConfig,\n  params: Record<string, unknown>,\n  owner: ParamsOwner\n): Record<string, JsonValue> {\n  if (!isPlainRecord(params)) {\n    throw new OntologyValidationError(`[Sixb] ${capitalize(owner.kind)} params must be an object.`)\n  }\n  const knownParamIds = new Set(Object.keys(paramsConfig))\n  const normalized: [string, JsonValue][] = []\n\n  for (const paramId of Object.keys(params)) {\n    if (!knownParamIds.has(paramId)) {\n      throw new OntologyValidationError(\n        `Unknown param '${paramId}' for ${owner.kind} '${owner.id}'`\n      )\n    }\n  }\n\n  for (const [paramId, paramDef] of Object.entries(paramsConfig)) {\n    const value = Object.hasOwn(params, paramId) ? params[paramId] : undefined\n\n    if (value === undefined) {\n      if (paramDef.required) {\n        throw new OntologyValidationError(\n          `Missing required param '${paramId}' for ${owner.kind} '${owner.id}'`\n        )\n      }\n      continue\n    }\n\n    const path = `${owner.path ?? owner.id}.${paramId}`\n    if (value === null) {\n      if (!paramDef.nullable) {\n        throw new OntologyValidationError(\n          `[Sixb] ${capitalize(owner.kind)} param ${path} cannot be null`\n        )\n      }\n      normalized.push([paramId, null])\n      continue\n    }\n\n    validateSchemaOrRefValue(paramDef.schema, value, path, valueTypesById)\n    normalized.push([\n      paramId,\n      normalizeSchemaOrRefValue(paramDef.schema, value, path, valueTypesById),\n    ])\n  }\n\n  return Object.fromEntries(normalized)\n}\n\n/** Re-hydrate normalized storage values for typed runtime consumers. */\nexport function coerceParamsToTyped(\n  paramsConfig: ParamsConfig,\n  params: Record<string, unknown>,\n  valueTypesById: ReadonlyMap<string, ValueType>\n): Record<string, unknown> {\n  const coerced: Record<string, unknown> = { ...params }\n\n  for (const [paramId, paramDef] of Object.entries(paramsConfig)) {\n    if (!Object.hasOwn(params, paramId)) continue\n    const value = params[paramId]\n    if (value === undefined) continue\n\n    const schema = paramDef.schema\n    if (typeof schema === \"object\" && schema !== null && schema.type === \"objectRef\") {\n      continue\n    }\n\n    coerced[paramId] = coerceSchemaValueToTyped(schema as Schema, value, valueTypesById)\n  }\n\n  return coerced\n}\n\nfunction normalizeSchemaOrRefValue(\n  schema: SchemaOrRef,\n  value: unknown,\n  path: string,\n  valueTypesById: ReadonlyMap<string, ValueType>\n): JsonValue {\n  if (typeof schema === \"object\" && schema !== null && schema.type === \"objectRef\") {\n    const refValue = value as { objectTypeId: string; primaryId: string }\n    return {\n      objectTypeId: refValue.objectTypeId,\n      primaryId: refValue.primaryId,\n    }\n  }\n\n  return normalizeSchemaValue(schema as Schema, value, path, valueTypesById)\n}\n\nfunction capitalize(value: string): string {\n  return value.length === 0 ? value : `${value[0]?.toUpperCase()}${value.slice(1)}`\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;AAiBO,SAAS,eAAe,CAC7B,gBACA,cACA,QACA,OAC2B;AAAA,EAC3B,IAAI,CAAC,cAAc,MAAM,GAAG;AAAA,IAC1B,MAAM,IAAI,yBAAwB,UAAU,WAAW,MAAM,IAAI,6BAA6B;AAAA,EAChG;AAAA,EACA,MAAM,gBAAgB,IAAI,IAAI,OAAO,KAAK,YAAY,CAAC;AAAA,EACvD,MAAM,aAAoC,CAAC;AAAA,EAE3C,WAAW,WAAW,OAAO,KAAK,MAAM,GAAG;AAAA,IACzC,IAAI,CAAC,cAAc,IAAI,OAAO,GAAG;AAAA,MAC/B,MAAM,IAAI,yBACR,kBAAkB,gBAAgB,MAAM,SAAS,MAAM,KACzD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,YAAY,SAAS,aAAa,OAAO,QAAQ,YAAY,GAAG;AAAA,IAC9D,MAAM,QAAQ,OAAO,OAAO,QAAQ,OAAO,IAAI,OAAO,WAAW;AAAA,IAEjE,IAAI,UAAU,WAAW;AAAA,MACvB,IAAI,SAAS,UAAU;AAAA,QACrB,MAAM,IAAI,yBACR,2BAA2B,gBAAgB,MAAM,SAAS,MAAM,KAClE;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,GAAG,MAAM,QAAQ,MAAM,MAAM;AAAA,IAC1C,IAAI,UAAU,MAAM;AAAA,MAClB,IAAI,CAAC,SAAS,UAAU;AAAA,QACtB,MAAM,IAAI,yBACR,UAAU,WAAW,MAAM,IAAI,WAAW,qBAC5C;AAAA,MACF;AAAA,MACA,WAAW,KAAK,CAAC,SAAS,IAAI,CAAC;AAAA,MAC/B;AAAA,IACF;AAAA,IAEA,0BAAyB,SAAS,QAAQ,OAAO,MAAM,cAAc;AAAA,IACrE,WAAW,KAAK;AAAA,MACd;AAAA,MACA,0BAA0B,SAAS,QAAQ,OAAO,MAAM,cAAc;AAAA,IACxE,CAAC;AAAA,EACH;AAAA,EAEA,OAAO,OAAO,YAAY,UAAU;AAAA;AAI/B,SAAS,mBAAmB,CACjC,cACA,QACA,gBACyB;AAAA,EACzB,MAAM,UAAmC,KAAK,OAAO;AAAA,EAErD,YAAY,SAAS,aAAa,OAAO,QAAQ,YAAY,GAAG;AAAA,IAC9D,IAAI,CAAC,OAAO,OAAO,QAAQ,OAAO;AAAA,MAAG;AAAA,IACrC,MAAM,QAAQ,OAAO;AAAA,IACrB,IAAI,UAAU;AAAA,MAAW;AAAA,IAEzB,MAAM,SAAS,SAAS;AAAA,IACxB,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,OAAO,SAAS,aAAa;AAAA,MAChF;AAAA,IACF;AAAA,IAEA,QAAQ,WAAW,0BAAyB,QAAkB,OAAO,cAAc;AAAA,EACrF;AAAA,EAEA,OAAO;AAAA;AAGT,SAAS,yBAAyB,CAChC,QACA,OACA,MACA,gBACW;AAAA,EACX,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,OAAO,SAAS,aAAa;AAAA,IAChF,MAAM,WAAW;AAAA,IACjB,OAAO;AAAA,MACL,cAAc,SAAS;AAAA,MACvB,WAAW,SAAS;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,OAAO,sBAAqB,QAAkB,OAAO,MAAM,cAAc;AAAA;AAG3E,SAAS,UAAU,CAAC,OAAuB;AAAA,EACzC,OAAO,MAAM,WAAW,IAAI,QAAQ,GAAG,MAAM,IAAI,YAAY,IAAI,MAAM,MAAM,CAAC;AAAA;",
+  "debugId": "D4E5B3AF980E36C164756E2164756E21",
+  "names": []
+}