@sixb/core 0.1.16 → 0.1.18

package/dist/{chunk-3q7z9hd4.js → chunk-fe52eczz.js}

@@ -3,7 +3,10 @@ import {
   isActionDefinition2,
   SYSTEM_PRINCIPAL2,
   principalsEqual2
-} from "./chunk-2xvgy3x5.js";
+} from "./chunk-6h5m9xjx.js";
+import {
+  captureSixbFailure2
+} from "./chunk-6fsr7y93.js";
 import {
   agentServiceAccountId2,
   assertObjectReadOutputWithinLimit2,
@@ -15,6 +18,7 @@ import {
   isAllowed2,
   assertAuthorized2,
   isRuntimeAllowed2,
+  assertRuntimeAuthorizationBound2,
   assertCanManageConnector2,
   assertPrivileged2,
   assertProviderAccess2,
@@ -25,25 +29,38 @@ import {
   canViewPipelineRun2,
   canViewProjectionRun2,
   canViewProjection2
-} from "./chunk-69kt9q43.js";
+} from "./chunk-qkbx3tf6.js";
 import {
-  captureSixbFailure2
-} from "./chunk-6fsr7y93.js";
+  canonicalMediaType2,
+  isFileRef2,
+  isValidFileRef,
+  supportsDirectUpload2,
+  supportsRangeRead2
+} from "./chunk-jhm3zsa7.js";
 import {
+  assertValidFileRefs2,
   isRecord2,
   normalizeSchemaValue2,
   coerceSchemaValueToTyped2,
   assertObjectTypeRegistered2
-} from "./chunk-swxzncrv.js";
+} from "./chunk-y05543x6.js";
 import {
   isObjectRefSchema2,
   validateSchemaOrRefValue2
-} from "./chunk-tkdbge6v.js";
+} from "./chunk-rt9p8m9t.js";
+import {
+  WorkflowRunError2,
+  missingClearanceRedactions,
+  resolvePropertyClearance,
+  redactDomainEvent
+} from "./chunk-d0eb5yy6.js";
 import {
   isModelReasoning2,
   modelReasoningSupportIssue2
 } from "./chunk-pqajwytd.js";
 import {
+  TranscriptionModelResponseError2,
+  assertTranscriptionModel,
   assertDecisionContent,
   assertDecisionQuestions,
   assertDecisionModel,
@@ -52,20 +69,17 @@ import {
   DecisionModelResponseError2,
   estimateModelCall,
   rateModelCall2
-} from "./chunk-tnvafr7g.js";
+} from "./chunk-29yx306f.js";
 import {
   AgentStorageError2,
   AGENT_REASONING_LEVELS2
-} from "./chunk-69266efg.js";
+} from "./chunk-s54c868q.js";
 import {
   ExecutionStorageError2
 } from "./chunk-tw03bsmb.js";
 import {
   WORKFLOW_RUN_FAILURE_CODES2
-} from "./chunk-6z1q7j19.js";
-import {
-  WorkflowRunError2
-} from "./chunk-667x4drs.js";
+} from "./chunk-qq90g05n.js";
 import {
   assertParamUsersActive,
   assertAuthorizedObjectReaderBinding,
@@ -73,7 +87,7 @@ import {
   canDelegationAccessActionRun,
   requestAction3,
   requestActionAndWait2
-} from "./chunk-8x74221e.js";
+} from "./chunk-fx93hd2n.js";
 import {
   shareSixbErrorReporter2,
   reportRunFailure2
@@ -83,43 +97,51 @@ import {
   applicableAiLimitPolicyStatuses2,
   aiUsageLimitExceededError2,
   aiUsageLimitUnavailableError2
-} from "./chunk-fj1dvp37.js";
+} from "./chunk-2vhg6ysa.js";
 import {
   AgentRequestError2,
   normalizeAgentContextEntries2
-} from "./chunk-dmn70ztd.js";
+} from "./chunk-pfp1txq2.js";
 import {
   publishAgentRunActivity2
-} from "./chunk-4gmng3vf.js";
+} from "./chunk-22v5bpz3.js";
+import {
+  createFileDownloadUrl,
+  revokeFileDownloadUrl
+} from "./chunk-3zxk45er.js";
 import {
   registerConnectorConnectionsRuntime
 } from "./chunk-5a4a52tq.js";
 import {
   createConnectorRuntime
-} from "./chunk-nvymebc1.js";
+} from "./chunk-f1zxad2t.js";
 import {
   writeDataset2
-} from "./chunk-91kcnbf0.js";
+} from "./chunk-6gmfggss.js";
 import {
   shareOntologyMutationRuntime2
 } from "./chunk-85cd7e8c.js";
 import {
   SyncValidationError2,
   requestSyncRun2
-} from "./chunk-nkbev3tr.js";
+} from "./chunk-yv9czyfr.js";
 import {
   compileShareAccessPlan
-} from "./chunk-cxj8y8t0.js";
+} from "./chunk-za5yd58j.js";
+import {
+  PipelineError2,
+  requestPipelineRun2
+} from "./chunk-v6xpd60t.js";
 import {
   ModelExecutionSession
-} from "./chunk-chdg6eqq.js";
+} from "./chunk-k6hrnf35.js";
 import {
   resolveLanguageModel2
-} from "./chunk-b9y8hcm2.js";
+} from "./chunk-mfs23znk.js";
 import {
   AI_MODEL_CALL_OUTPUT_TOKEN_ALLOWANCE,
   aiModelCallOutputTokenAllowance
-} from "./chunk-kvysp909.js";
+} from "./chunk-ny3xyvcn.js";
 import {
   getTelemetryHistoryBatch2,
   getLatestTelemetryPoint,
@@ -131,47 +153,39 @@ import {
   upsertObject3,
   upsertObjectBatch3,
   appendTelemetry
-} from "./chunk-40qb8wpe.js";
+} from "./chunk-qxvp5epv.js";
 import {
   schemaRecordToJsonSchema2
 } from "./chunk-6x0pqh32.js";
-import {
-  PipelineError2,
-  requestPipelineRun2
-} from "./chunk-sbcm1b92.js";
 import {
   getDatasetPrimaryKeyColumns2
-} from "./chunk-rb143ggb.js";
+} from "./chunk-bwjcehza.js";
 import {
   executionRecordInputFromRuntime,
   ensureExecutionRecord2,
   createPrimitiveExecutionRecord
-} from "./chunk-7g2gjvah.js";
+} from "./chunk-ex496vct.js";
 import {
   ShareGrantStorageError2
 } from "./chunk-br3k6qbf.js";
 import {
   ObjectNotFoundError2
-} from "./chunk-zdkcdshk.js";
+} from "./chunk-y9jmd7e5.js";
 import {
   RuntimeError2
 } from "./chunk-m4ehq95f.js";
 import {
   normalizeParams
-} from "./chunk-qnd7ehe5.js";
+} from "./chunk-vx2yp45y.js";
+import {
+  OntologyValidationError2
+} from "./chunk-cqr3acm1.js";
 import {
   ModelProviderError2,
   ModelStreamError2,
   UnsupportedModelFeatureError2,
   StructuredOutputError2
 } from "./chunk-kyjcwqz6.js";
-import {
-  OntologyValidationError2
-} from "./chunk-cqr3acm1.js";
-import {
-  supportsDirectUpload2,
-  supportsRangeRead2
-} from "./chunk-h3v76ams.js";
 import {
   isJsonValue2,
   assertJsonValue2,
@@ -181,6 +195,22 @@ import {
   isPlainRecord
 } from "./chunk-wy0qdqfm.js";
 
+// src/models/execution/binding.ts
+var bindings = new WeakMap;
+function registerModelExecutionBinding(models, bind) {
+  bindings.set(models, bind);
+}
+function bindModelExecutionAttempt(models, input) {
+  const bind = bindings.get(models);
+  if (!bind)
+    throw new Error("[SixbModels] Model runtime has no execution binding.");
+  if (!Number.isSafeInteger(input.attempt) || input.attempt < 1) {
+    throw new TypeError("[SixbModels] Execution attempt must be a positive safe integer.");
+  }
+  bind(input);
+  bindings.delete(models);
+}
+
 // src/actions/descriptor.ts
 function snapshotActionDescriptor(action) {
   const params = Object.fromEntries(Object.entries(action.params).map(([id, config]) => [id, structuredClone(config)]));
@@ -347,6 +377,29 @@ function createAgentRunExecutionToken2() {
 // src/agents/request.ts
 import { randomUUID as randomUUID2 } from "crypto";
 
+// src/runtime/locale.ts
+var DEFAULT_PROJECT_LOCALE = "en";
+var DEFAULT_PROJECT_TIME_ZONE = "UTC";
+function canonicalLocale(value) {
+  if (typeof value !== "string")
+    return;
+  try {
+    const [locale] = Intl.getCanonicalLocales(value);
+    return locale;
+  } catch {
+    return;
+  }
+}
+function canonicalTimeZone(value) {
+  if (typeof value !== "string" || value.trim() !== value || value === "")
+    return;
+  try {
+    return new Intl.DateTimeFormat("en-US", { timeZone: value }).resolvedOptions().timeZone;
+  } catch {
+    return;
+  }
+}
+
 // src/agents/context-resolution.ts
 async function resolveAgentContextParts2(runtime, input) {
   const entries = normalizeAgentContextEntries2(input);
@@ -496,7 +549,17 @@ async function requestAgentRun2(runtime, execution, models, input) {
   assertNoAgentSelector(input);
   assertAuthorized2(runtime, { kind: "agent.run" });
   assertRequestAuthorityCanRunAgent(runtime);
-  const spec = resolveConversationRunSpec({ models, input });
+  const trigger = triggerParts(input);
+  const continued = input.continue ? await continuedSelection(runtime, models, input) : {};
+  const spec = await resolveConversationRunSpec({
+    models,
+    input: {
+      ...input,
+      model: input.model ?? continued.model,
+      reasoning: input.reasoning ?? continued.reasoning
+    }
+  });
+  assertAttachments(input.attachments);
   const contextParts = await resolveAgentContextParts2(runtime, input.context);
   const agents = requireAgentStorage(runtime);
   const projectId = runtime.projectId;
@@ -531,7 +594,7 @@ async function requestAgentRun2(runtime, execution, models, input) {
         role: "user",
         parts: [
           ...contextParts,
-          { type: "text", text: input.text },
+          ...trigger,
           ...(input.attachments ?? []).map((fileRef) => ({ type: "file", fileRef }))
         ],
         authorPrincipal: principal
@@ -559,6 +622,9 @@ async function requestAgentRun2(runtime, execution, models, input) {
     createdThread
   };
 }
+function isRetryableAgentRun2(run) {
+  return run.status === "failed" || run.status === "cancelled" && run.finishReason === "interrupted";
+}
 async function retryAgentRun2(runtime, execution, models, failedRun) {
   resolveExecutionScopeAuthorization(runtime.projectId, {
     execution,
@@ -566,8 +632,8 @@ async function retryAgentRun2(runtime, execution, models, failedRun) {
   });
   assertAuthorized2(runtime, { kind: "agent.run" });
   assertRequestAuthorityCanRunAgent(runtime);
-  if (failedRun.status !== "failed") {
-    throw new AgentRequestError2("run_not_retryable", `[Sixb] Only failed Agent runs can be retried.`);
+  if (!isRetryableAgentRun2(failedRun)) {
+    throw new AgentRequestError2("run_not_retryable", `[Sixb] Only failed or interrupted Agent runs can be retried.`);
   }
   const agents = requireAgentStorage(runtime);
   const thread = await agents.threads.getById({
@@ -598,7 +664,7 @@ async function retryAgentRun2(runtime, execution, models, failedRun) {
       executionId: durableExecution.id,
       threadId: failedRun.threadId,
       triggerMessageId: failedRun.triggerMessageId,
-      spec: failedRun.spec ?? resolveConversationRunSpec({
+      spec: failedRun.spec ?? await resolveConversationRunSpec({
         models,
         input: {}
       })
@@ -608,6 +674,48 @@ async function retryAgentRun2(runtime, execution, models, failedRun) {
   const jobId = await dispatchAgentRun(runtime, agents, runId);
   return { run, ...jobId ? { jobId } : {}, createdThread: false };
 }
+async function continuedSelection(runtime, models, input) {
+  const agents = requireAgentStorage(runtime);
+  const threadId = input.threadId ?? "";
+  if (!await agents.threads.getById({ projectId: runtime.projectId, id: threadId })) {
+    throw new AgentRequestError2("thread_not_found", "[Sixb] An Agent continuation needs an existing thread.");
+  }
+  if (input.model !== undefined || input.reasoning !== undefined)
+    return {};
+  const { runs } = await agents.runs.list({
+    projectId: runtime.projectId,
+    threadId,
+    kinds: ["conversation"],
+    order: "desc",
+    limit: 1
+  });
+  const spec = runs[0]?.kind === "conversation" ? runs[0].spec : undefined;
+  if (!spec || !models?.getByRef(spec.model))
+    return {};
+  return {
+    model: spec.model,
+    ...spec.reasoning === undefined ? {} : { reasoning: spec.reasoning }
+  };
+}
+function triggerParts(input) {
+  if (input.continue === true) {
+    if (input.text !== undefined || input.attachments?.length || input.context?.length) {
+      throw new AgentRequestError2("invalid_message", "[Sixb] An Agent continuation carries no text, attachments, or context.");
+    }
+    return [{ type: "continuation" }];
+  }
+  if (typeof input.text !== "string" || input.text.trim().length === 0) {
+    throw new AgentRequestError2("invalid_message", "[Sixb] An Agent message needs text, or `continue: true` to continue the previous answer.");
+  }
+  return [{ type: "text", text: input.text }];
+}
+function assertAttachments(attachments) {
+  for (const [index, attachment] of (attachments ?? []).entries()) {
+    if (!isValidFileRef(attachment)) {
+      throw new AgentRequestError2("invalid_attachment", `[Sixb] Attachment ${index} is not a valid file reference.`);
+    }
+  }
+}
 function assertSandboxExecutionAvailable(thread) {
   if (thread.sandboxState && !["new", "ready"].includes(thread.sandboxState.status)) {
     throw new AgentRequestError2("sandbox_execution_unavailable", "[Sixb] Sandbox recovery is required before another run. Reload the thread and explicitly recreate it to start fresh.");
@@ -634,7 +742,7 @@ async function assertAiLimitPreflight(runtime, execution) {
     throw aiUsageLimitExceededError2(resetAt);
   }
 }
-function resolveConversationRunSpec(input) {
+async function resolveConversationRunSpec(input) {
   if (!input.models) {
     throw new AgentRequestError2("model_not_found", "[Sixb] Configure models.language before starting the Agent.");
   }
@@ -643,15 +751,41 @@ function resolveConversationRunSpec(input) {
   if (model === null) {
     throw new AgentRequestError2("model_not_found", `[Sixb] Language model '${selected.provider}/${selected.modelId}' is not in the project model catalog.`);
   }
-  const reasoning = input.input.reasoning;
-  if (reasoning !== undefined && !isModelReasoning2(reasoning)) {
-    throw new AgentRequestError2("invalid_model_selection", `[Sixb] Agent reasoning must be one of: ${AGENT_REASONING_LEVELS2.join(", ")}, or a nonnegative budgetTokens object.`);
+  const explicitReasoning = input.input.reasoning;
+  if (explicitReasoning !== undefined) {
+    await assertModelSupportsReasoning(model, explicitReasoning);
   }
+  const reasoning = explicitReasoning ?? model.model.defaultReasoning;
+  const timeZone = requestedSetting("timeZone", input.input.timeZone, canonicalTimeZone, "an IANA time zone");
+  const locale = requestedSetting("locale", input.input.locale, canonicalLocale, "a BCP 47 language tag");
   return Object.freeze({
     model: Object.freeze({ provider: selected.provider, modelId: selected.modelId }),
-    ...reasoning === undefined ? {} : { reasoning }
+    ...reasoning === undefined ? {} : { reasoning },
+    ...timeZone === undefined ? {} : { timeZone },
+    ...locale === undefined ? {} : { locale }
   });
 }
+function requestedSetting(field, value, canonical, expected) {
+  if (value === undefined)
+    return;
+  const resolved = canonical(value);
+  if (resolved === undefined) {
+    throw new AgentRequestError2("invalid_locale", `[Sixb] Agent request '${field}' must be ${expected}; received ${JSON.stringify(value)}.`);
+  }
+  return resolved;
+}
+async function assertModelSupportsReasoning(entry, reasoning) {
+  if (!isModelReasoning2(reasoning)) {
+    throw new AgentRequestError2("invalid_model_selection", `[Sixb] Agent reasoning must be one of: ${AGENT_REASONING_LEVELS2.join(", ")}, or a nonnegative budgetTokens object.`);
+  }
+  if (reasoning === "provider-default")
+    return;
+  const model = await resolveLanguageModel2(entry.model);
+  const issue = modelReasoningSupportIssue2(model.definition.capabilities.reasoning, reasoning);
+  if (issue !== undefined) {
+    throw new AgentRequestError2("invalid_model_selection", `[Sixb] Language model '${entry.provider}/${entry.modelId}' cannot use this reasoning: ${issue}.`);
+  }
+}
 async function prepareDurableAgentExecution(runtime, execution, runId) {
   const parent = await ensureExecutionRecord2(runtime.storage.executions, executionRecordInputFromRuntime({
     execution,
@@ -1038,11 +1172,19 @@ function createAiUsageRuntime(runtime, security) {
   };
 }
 // src/blob-storage/execution.ts
-function createBlobsRuntime(runtime, execution, blobStorage) {
+function createBlobsRuntime(runtime, execution, blobStorage, apiPublicOrigin) {
   const assertAccess = () => assertProviderAccess2(runtime, execution, "blobs.access");
+  const downloadUrlContext = () => ({
+    projectId: runtime.projectId,
+    storage: runtime.storage,
+    blobStorage,
+    executionId: execution.id,
+    apiPublicOrigin: apiPublicOrigin()
+  });
   const executionBlobs = {
     put: (input) => {
       assertAccess();
+      assertMediaType("put", input.mediaType);
       return blobStorage.put(input);
     },
     open: (blobId) => {
@@ -1052,6 +1194,14 @@ function createBlobsRuntime(runtime, execution, blobStorage) {
     stat: (blobId) => {
       assertAccess();
       return blobStorage.stat(blobId);
+    },
+    createDownloadUrl: async (file, options) => {
+      assertAccess();
+      return createFileDownloadUrl(downloadUrlContext(), file, options);
+    },
+    revokeDownloadUrl: async (id) => {
+      assertAccess();
+      return revokeFileDownloadUrl(downloadUrlContext(), id);
     }
   };
   if (supportsRangeRead2(blobStorage)) {
@@ -1063,6 +1213,7 @@ function createBlobsRuntime(runtime, execution, blobStorage) {
   if (supportsDirectUpload2(blobStorage)) {
     executionBlobs.createUpload = (input) => {
       assertAccess();
+      assertMediaType("createUpload", input.mediaType);
       return blobStorage.createUpload(input);
     };
     executionBlobs.signUploadPart = (input) => {
@@ -1071,6 +1222,7 @@ function createBlobsRuntime(runtime, execution, blobStorage) {
     };
     executionBlobs.completeUpload = (input) => {
       assertAccess();
+      assertMediaType("completeUpload", input.mediaType);
       return blobStorage.completeUpload(input);
     };
     executionBlobs.abortUpload = (input) => {
@@ -1080,6 +1232,11 @@ function createBlobsRuntime(runtime, execution, blobStorage) {
   }
   return Object.freeze(executionBlobs);
 }
+function assertMediaType(method, mediaType) {
+  if (mediaType !== undefined && canonicalMediaType2(mediaType) === null) {
+    throw new Error(`[Sixb] blobs.${method}() mediaType must be one media type, such as "application/pdf". Received ${JSON.stringify(mediaType)}.`);
+  }
+}
 
 // src/connectors/connections/execution.ts
 function createConnectorConnectionsRuntime(runtime, execution, process) {
@@ -1133,6 +1290,33 @@ function createDatasetsRuntime(runtime, execution, source, lakeStorage, blobStor
       const dataset = source.getById(datasetId);
       return dataset && allowed(datasetId) ? dataset : null;
     },
+    async readRows(dataset, input = {}) {
+      assertAuthorized2(runtime, { kind: "dataset.view", datasetId: dataset.id });
+      const registered = source.getById(dataset.id);
+      if (!registered)
+        throw new Error(`[Sixb] Dataset '${dataset.id}' is not registered.`);
+      const version = input.versionId === undefined ? await lakeStorage.getLatestVersion(registered.id) : await lakeStorage.getVersion(registered.id, input.versionId);
+      if (!version)
+        return null;
+      const redacted = redactedColumns(registered, assertRuntimeAuthorizationBound2(runtime));
+      const selected = selectColumns(version, input.columns);
+      const columns = selected.filter((column) => !redacted.has(column));
+      const read = (readColumns) => lakeStorage.readRows({
+        datasetId: registered.id,
+        versionId: version.versionId,
+        columns: readColumns,
+        limit: input.limit,
+        offset: input.offset,
+        signal: input.signal
+      });
+      const rows = columns.length === selected.length ? read(input.columns) : columns.length > 0 ? read(columns) : emptyRows(read(selected.slice(0, 1)));
+      return {
+        version,
+        columns,
+        ...redacted.size > 0 ? { redactions: missingClearanceRedactions(redacted) } : {},
+        rows
+      };
+    },
     async ingest(dataset, input) {
       assertPrivileged2(runtime, "datasets.ingest");
       const registered = source.getById(dataset.id);
@@ -1177,33 +1361,48 @@ function createDatasetsRuntime(runtime, execution, source, lakeStorage, blobStor
     }
   };
 }
+function selectColumns(version, requested) {
+  const available = version.schema.columns.map((column) => column.name);
+  if (requested === undefined || requested.length === 0)
+    return available;
+  for (const column of requested) {
+    if (!available.includes(column)) {
+      throw new Error(`[Sixb] Dataset '${version.datasetId}' does not have column '${column}' at version '${version.versionId}'.`);
+    }
+  }
+  return [...requested];
+}
+function redactedColumns(dataset, authority) {
+  if (authority.type === "unrestricted")
+    return new Set;
+  const clearances = authority.type === "principal" ? authority.context.clearances ?? new Set : new Set;
+  return new Set(dataset.schema.columns.filter((column) => column.markings?.some((markingId) => !clearances.has(markingId))).map((column) => column.name));
+}
+async function* emptyRows(rows) {
+  for await (const _row of rows)
+    yield {};
+}
 
 // src/events/execution.ts
 function createEventsRuntime(runtime) {
   const authority = resolveRuntimeAuthorizationForProject(runtime);
-  const visibleEvents = (events) => {
+  const clearance = authority.type === "principal" ? resolvePropertyClearance(runtime.ontology, authority.context.clearances ?? new Set) : undefined;
+  const readable = (event) => {
     switch (authority.type) {
       case "denied":
       case "delegated":
-        return [];
+        return;
       case "principal":
-        return events.filter((event) => canViewEvent2(authority.context, event));
+        if (!canViewEvent2(authority.context, event))
+          return;
+        return clearance ? redactDomainEvent(event, clearance) : event;
       case "unrestricted":
-        return [...events];
+        return event;
     }
   };
+  const visibleEvents = (events) => events.flatMap((event) => readable(event) ?? []);
   return {
-    canRead: (event) => {
-      switch (authority.type) {
-        case "denied":
-        case "delegated":
-          return false;
-        case "principal":
-          return canViewEvent2(authority.context, event);
-        case "unrestricted":
-          return true;
-      }
-    },
+    readable,
     append: (input) => {
       assertPrivileged2(runtime, "events.append");
       return runtime.events.append(input);
@@ -2041,8 +2240,179 @@ function isAbortError(error) {
   return error instanceof DOMException && error.name === "AbortError" || error instanceof Error && error.name === "AbortError";
 }
 
-// src/models/decision/runtime.ts
+// src/models/audio/runtime.ts
 import { randomUUID as randomUUID5 } from "crypto";
+
+// src/models/audio/file.ts
+import { createHash as createHash2 } from "crypto";
+function prepareTranscriptionFile(input) {
+  if (!isFileRef2(input) || !Number.isSafeInteger(input.sizeBytes) || input.sizeBytes <= 0) {
+    throw new TypeError("[SixbModels] Transcription requires a nonempty FileRef.");
+  }
+  const audio = { ...input };
+  const mediaType = audio.mediaType?.split(";", 1)[0]?.trim().toLowerCase();
+  if (!mediaType || !/^audio\/[a-z0-9.+-]+$/.test(mediaType)) {
+    throw new TypeError("[SixbModels] Audio FileRef must declare an audio mediaType.");
+  }
+  return { audio, mediaType };
+}
+async function readTranscriptionFile(storage, file, signal) {
+  const info = await storage.stat(file.blobId);
+  signal.throwIfAborted();
+  if (!info || info.blobId !== file.blobId || info.digest !== file.digest || info.sizeBytes !== file.sizeBytes) {
+    throw new Error("[SixbModels] Audio reference does not match the stored file.");
+  }
+  const stream = await storage.open(file.blobId);
+  const reader = stream.getReader();
+  const cancel = () => {
+    reader.cancel(signal.reason).catch(() => {
+      return;
+    });
+  };
+  signal.addEventListener("abort", cancel, { once: true });
+  let complete = false;
+  try {
+    signal.throwIfAborted();
+    const bytes = new Uint8Array(file.sizeBytes);
+    const hash = createHash2("sha256");
+    let offset = 0;
+    while (true) {
+      const { value, done } = await reader.read();
+      signal.throwIfAborted();
+      if (done)
+        break;
+      if (!(value instanceof Uint8Array) || value.byteLength > bytes.byteLength - offset) {
+        throw new Error("[SixbModels] Audio stream exceeds its declared size.");
+      }
+      bytes.set(value, offset);
+      hash.update(value);
+      offset += value.byteLength;
+    }
+    if (offset !== file.sizeBytes || `sha256:${hash.digest("hex")}` !== file.digest) {
+      throw new Error("[SixbModels] Audio stream does not match its content-addressed reference.");
+    }
+    complete = true;
+    return bytes;
+  } finally {
+    signal.removeEventListener("abort", cancel);
+    if (!complete) {
+      reader.cancel().catch(() => {
+        return;
+      });
+    }
+    reader.releaseLock();
+  }
+}
+
+// src/models/audio/runtime.ts
+function createAudioRuntime(runtime, execution, catalog, session, blobs) {
+  return {
+    async transcribe(input) {
+      assertProviderAccess2(runtime, execution, "models.audio.transcribe");
+      const { audio, mediaType } = prepareTranscriptionFile(input.audio);
+      if (!blobs) {
+        throw new Error("[SixbModels] Transcription requires blob storage.");
+      }
+      const signal = session.signal(input.signal);
+      signal.throwIfAborted();
+      const binding = selectModel(catalog, input.model);
+      assertTranscriptionModel(binding);
+      assertFileSupport(binding, audio.sizeBytes, mediaType);
+      const accounting = await session.accounting();
+      accounting.assertHealthy();
+      const model = binding.resolve ? await binding.resolve() : binding;
+      assertTranscriptionModel(model);
+      if (model.providerId !== binding.providerId || model.modelId !== binding.modelId) {
+        throw new TypeError("[SixbModels] Resolved transcription model identity does not match the selected model.");
+      }
+      assertFileSupport(model, audio.sizeBytes, mediaType);
+      signal.throwIfAborted();
+      const bytes = await readTranscriptionFile(blobs, audio, signal);
+      accounting.assertHealthy();
+      const reservationCost = estimateReservationCost(model, bytes.byteLength, mediaType);
+      const callId = `call_${randomUUID5()}`;
+      await accounting.admitCall({
+        callId,
+        providerId: model.providerId,
+        modelId: model.modelId,
+        modelKind: "transcription",
+        inputTokens: { status: "unavailable", reason: "nonTextInput" },
+        outputTokenAllowance: 0,
+        reservationCost
+      });
+      let result;
+      try {
+        signal.throwIfAborted();
+        result = await model.transcribe({ audio: bytes, mediaType, signal });
+      } catch (error) {
+        await recordTranscription(accounting, model, callId, error instanceof TranscriptionModelResponseError2 ? error.metadata : {});
+        throw error;
+      }
+      const event = await recordTranscription(accounting, model, callId, result ?? {});
+      signal.throwIfAborted();
+      if (typeof result?.output?.text !== "string") {
+        throw new TranscriptionModelResponseError2("[SixbModels] Invalid transcription response.", model.providerId, model.modelId, result ?? {});
+      }
+      return {
+        output: { text: result.output.text },
+        usage: event.usage,
+        cost: event.cost,
+        callId
+      };
+    }
+  };
+}
+function selectModel(catalog, requested) {
+  if (!catalog && requested)
+    return requested;
+  const transcribers = catalog?.audio?.transcription;
+  const selected = requested ? transcribers?.getByRef({ provider: requested.providerId, modelId: requested.modelId })?.model : transcribers?.default.model;
+  if (!selected) {
+    throw new Error("[SixbModels] Configure the selected model in models.audio.transcription, or supply a model when no catalog is configured.");
+  }
+  return selected;
+}
+function assertFileSupport(model, sizeBytes, mediaType) {
+  if (sizeBytes > model.definition.maxInputBytes) {
+    throw new RangeError(`[SixbModels] Audio exceeds the model's ${model.definition.maxInputBytes}-byte input limit.`);
+  }
+  if (model.definition.mediaTypes && !model.definition.mediaTypes.includes(mediaType)) {
+    throw new TypeError(`[SixbModels] Audio media type '${mediaType}' is not supported by the selected model.`);
+  }
+}
+function estimateReservationCost(model, sizeBytes, mediaType) {
+  try {
+    return model.costEstimator?.estimateReservation?.({ sizeBytes, mediaType });
+  } catch {
+    return;
+  }
+}
+async function recordTranscription(accounting, model, callId, metadata) {
+  const usage = metadata.usage ?? {};
+  const estimate = estimateModelCall(model, {
+    usage,
+    route: metadata.route,
+    responseModelId: metadata.responseModelId
+  });
+  const event = {
+    callId,
+    modelKind: "transcription",
+    providerId: model.providerId,
+    modelId: model.modelId,
+    responseId: metadata.providerIds?.responseId ?? callId,
+    providerIds: metadata.providerIds,
+    responseModelId: metadata.responseModelId,
+    usage,
+    cost: metadata.reportedCost ? { status: "reported", ...metadata.reportedCost } : estimate,
+    ...metadata.reportedCost ? { estimate } : {},
+    route: metadata.route
+  };
+  await accounting.onModelCallEnd(event);
+  return event;
+}
+
+// src/models/decision/runtime.ts
+import { randomUUID as randomUUID6 } from "crypto";
 function createDecisionRuntime(runtime, execution, catalog, session) {
   return {
     async evaluate(input) {
@@ -2116,7 +2486,7 @@ function resolveDecisionModel(catalog, requested) {
   return entry.model;
 }
 async function admitDecisionCall(accounting, model, request) {
-  const callId = `call_${randomUUID5()}`;
+  const callId = `call_${randomUUID6()}`;
   const serialized = JSON.stringify({ input: request.input, questions: request.questions });
   const tokens = Math.ceil(new TextEncoder().encode(serialized).byteLength / 4);
   const outputTokenAllowance = AI_MODEL_CALL_OUTPUT_TOKEN_ALLOWANCE;
@@ -2154,22 +2524,6 @@ async function recordDecision(accounting, model, callId, metadata) {
   return event;
 }
 
-// src/models/execution/binding.ts
-var bindings = new WeakMap;
-function registerModelExecutionBinding(models, bind) {
-  bindings.set(models, bind);
-}
-function bindModelExecutionAttempt(models, input) {
-  const bind = bindings.get(models);
-  if (!bind)
-    throw new Error("[SixbModels] Model runtime has no execution binding.");
-  if (!Number.isSafeInteger(input.attempt) || input.attempt < 1) {
-    throw new TypeError("[SixbModels] Execution attempt must be a positive safe integer.");
-  }
-  bind(input);
-  bindings.delete(models);
-}
-
 // src/models/output.ts
 function languageModelOutput(shape, valueTypesById) {
   if (!isRecord2(shape))
@@ -2200,7 +2554,7 @@ function languageModelOutput(shape, valueTypesById) {
 }
 
 // src/models/execution.ts
-function createModelsRuntime(runtime, execution, catalog) {
+function createModelsRuntime(runtime, execution, catalog, blobs) {
   const session = runtime.modelExecution ?? new ModelExecutionSession(runtime, execution);
   async function generate(input) {
     assertProviderAccess2(runtime, execution, "models.language.generate");
@@ -2219,11 +2573,12 @@ function createModelsRuntime(runtime, execution, catalog) {
     const reasoningIssue = modelReasoningSupportIssue2(model.definition.capabilities.reasoning, input.reasoning);
     if (reasoningIssue)
       throw new UnsupportedModelFeatureError2(`[SixbModels] ${reasoningIssue}.`);
+    const reasoning = input.reasoning ?? selected.defaultReasoning;
     if (output && model.definition.capabilities.nativeStructuredOutput === false) {
       throw new UnsupportedModelFeatureError2("[SixbModels] Model does not support native structured output.");
     }
     const maxOutputTokens = Math.min(aiModelCallOutputTokenAllowance(input.maxOutputTokens ?? model.definition.maxOutputTokens), model.definition.maxOutputTokens ?? Infinity);
-    if (typeof input.reasoning === "object" && input.reasoning.budgetTokens >= maxOutputTokens) {
+    if (typeof reasoning === "object" && reasoning.budgetTokens >= maxOutputTokens) {
       throw new TypeError("[SixbModels] Output allowance must exceed the reasoning token budget.");
     }
     const accounting = await session.accounting();
@@ -2236,7 +2591,7 @@ function createModelsRuntime(runtime, execution, catalog) {
       maxSteps: 1,
       rejectLocalToolCalls: true,
       maxOutputTokens,
-      reasoning: input.reasoning,
+      reasoning,
       caching: input.caching,
       signal,
       onModelCallEnd: async (completed) => {
@@ -2264,7 +2619,8 @@ function createModelsRuntime(runtime, execution, catalog) {
   }
   const models = {
     language: { generate },
-    decision: createDecisionRuntime(runtime, execution, catalog, session)
+    decision: createDecisionRuntime(runtime, execution, catalog, session),
+    audio: createAudioRuntime(runtime, execution, catalog, session, blobs)
   };
   registerModelExecutionBinding(models, (input) => {
     session.bind(input);
@@ -2297,7 +2653,7 @@ function generationMessages(input) {
 }
 
 // src/objects/execution.ts
-function createObjectsRuntime(runtime, execution) {
+function createObjectsRuntime(runtime, execution, blobStorage) {
   const runtimeAuthorization = runtime.runtimeAuthorization;
   const objectReader = runtime.objectReader;
   assertAuthorizedObjectReaderBinding({
@@ -2327,7 +2683,8 @@ function createObjectsRuntime(runtime, execution) {
     return createObjectSet2({
       ...capturedRuntime,
       execution,
-      objectType
+      objectType,
+      blobStorage
     });
   }, {
     listTypes: () => ontologyView().listObjectTypes(),
@@ -2628,7 +2985,7 @@ function createSchedulesRuntime(runtime, schedules) {
 }
 
 // src/shares/execution.ts
-import { createHash as createHash2, randomBytes, randomUUID as randomUUID6 } from "crypto";
+import { createHash as createHash3, randomBytes, randomUUID as randomUUID7 } from "crypto";
 var MAX_CREATE_ATTEMPTS = 5;
 
 class ShareError2 extends Error {
@@ -2695,7 +3052,7 @@ function createSharesRuntime(runtime, execution, definitions) {
       const secret = randomBytes(32).toString("base64url");
       try {
         const grant = await storage.create({
-          id: `shr_${randomUUID6()}`,
+          id: `shr_${randomUUID7()}`,
           projectId: runtime.projectId,
           definitionId: definition.id,
           target,
@@ -2860,7 +3217,7 @@ function validFutureDate(value, now) {
   return new Date(value);
 }
 function sha256(value) {
-  return createHash2("sha256").update(value).digest("hex");
+  return createHash3("sha256").update(value).digest("hex");
 }
 function publicGrant(record) {
   const {
@@ -2951,7 +3308,7 @@ class WorkflowValidationError2 extends Error {
 }
 
 // src/workflows/run-dispatch.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import { isDeepStrictEqual } from "util";
 
 // src/workflows/validation.ts
@@ -2964,7 +3321,7 @@ function isStepDefinition2(value) {
   return isRecord(value) && value.kind === "step" && typeof value.id === "string" && isRecord(value.input) && isRecord(value.output) && typeof value.handler === "function";
 }
 function isAgentStepDefinition2(value) {
-  return isRecord(value) && value.kind === "agentStep" && typeof value.id === "string" && (value.model === undefined || isLanguageModel(value.model)) && (value.reasoning === undefined || isModelReasoning2(value.reasoning)) && typeof value.instructions === "string" && isStringArray(value.groupIds) && isStringArray(value.toolNames) && isRecord(value.input) && isRecord(value.output) && typeof value.prompt === "function";
+  return isRecord(value) && value.kind === "agentStep" && typeof value.id === "string" && (value.model === undefined || isLanguageModel(value.model)) && (value.reasoning === undefined || isModelReasoning2(value.reasoning)) && typeof value.instructions === "string" && isStringArray(value.groupIds) && isStringArray(value.toolNames) && isStringArray(value.skillNames) && isRecord(value.input) && isRecord(value.output) && typeof value.prompt === "function";
 }
 function isInterventionDefinition2(value) {
   return isRecord(value) && value.kind === "intervention" && typeof value.id === "string" && isRecord(value.input) && isRecord(value.response) && (value.defaults === undefined || typeof value.defaults === "function");
@@ -3034,11 +3391,23 @@ function validateWorkflowAgentStepRuntimeReferences(workflowId, step, options) {
       throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent step "${step.id}" uses unknown language model "${ref.provider}/${ref.modelId}". Add it to 'models.language' in createSixb().`);
     }
   }
+  const model = step.model ?? options.models?.language?.default?.model;
+  if (step.reasoning !== undefined && model !== undefined) {
+    const issue = modelReasoningSupportIssue2(model.definition.capabilities.reasoning, step.reasoning);
+    if (issue !== undefined) {
+      throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent step "${step.id}" cannot use its reasoning with language model "${model.providerId}/${model.modelId}": ${issue}.`);
+    }
+  }
   for (const toolName of step.toolNames) {
     if (options.tools.getByName(toolName) === null) {
       throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent step "${step.id}" uses unknown project tool "${toolName}". Add it to 'tools' in createSixb().`);
     }
   }
+  for (const skillName of step.skillNames) {
+    if (options.skills.getByName(skillName) === null) {
+      throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent step "${step.id}" uses unknown Agent Skill "${skillName}". Add it as 'skills/${skillName}/SKILL.md'.`);
+    }
+  }
 }
 function validateWorkflowInput2(params) {
   return validateWorkflowContractRecord({
@@ -3154,6 +3523,7 @@ function validateAgentNodeDefinition(workflowId, node) {
   }
   assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "group", node.agentStep.groupIds);
   assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "tool", node.agentStep.toolNames);
+  assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "skill", node.agentStep.skillNames);
   if (node.mapper !== undefined && typeof node.mapper !== "function") {
     throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent node "${node.id}" mapper must be a function.`);
   }
@@ -3659,7 +4029,7 @@ async function persistWorkflowRun(input, request) {
     describe: (fieldId) => `Workflow "${input.workflow.id}" input '${fieldId}'`,
     invalid: (message) => new WorkflowValidationError2(message)
   });
-  const execution = await input.createExecution(`exec_${randomUUID7()}`, request.runId);
+  const execution = await input.createExecution(`exec_${randomUUID8()}`, request.runId);
   const queuedAt = new Date;
   try {
     return await input.storage.transaction(async (tx) => {
@@ -3772,7 +4142,7 @@ async function failWorkflowRunPublication(input, run, error) {
 }
 function resolveWorkflowRunId(runId) {
   if (runId === undefined)
-    return `run_${randomUUID7()}`;
+    return `run_${randomUUID8()}`;
   if (!runId.trim()) {
     throw new WorkflowValidationError2("[Sixb] Workflow run id must not be empty");
   }
@@ -3819,6 +4189,7 @@ async function requestWorkflowRun2(runtime, execution, workflow, options = {}) {
     authorization: runtime.runtimeAuthorization
   });
   assertAuthorized2(runtime, { kind: "workflow.run", workflowId: workflow.id });
+  assertValidFileRefs2(options.input, `Workflow "${workflow.id}" input`);
   return dispatchWorkflowRun({
     errorReporterHost: runtime,
     projectId: runtime.projectId,
@@ -4071,7 +4442,7 @@ function isBoundSixb(value) {
 }
 function createExecutionFacades(runtime, execution, dependencies) {
   return {
-    objects: createObjectsRuntime(runtime, execution),
+    objects: createObjectsRuntime(runtime, execution, dependencies.blobStorage),
     actions: createActionsRuntime(runtime, execution),
     datasets: createDatasetsRuntime(runtime, execution, dependencies.definitions.datasets, dependencies.lakeStorage, dependencies.blobStorage),
     workflows: createWorkflowsRuntime(runtime, execution, dependencies.definitions.workflows),
@@ -4080,14 +4451,14 @@ function createExecutionFacades(runtime, execution, dependencies) {
     projections: createProjectionsRuntime(runtime, dependencies.definitions.projections),
     rules: createRulesRuntime(runtime, dependencies.definitions.rules),
     agent: createAgentRuntime(runtime, execution, dependencies.definitions.models, dependencies.sandbox),
-    models: createModelsRuntime(runtime, execution, dependencies.definitions.models),
+    models: createModelsRuntime(runtime, execution, dependencies.definitions.models, dependencies.blobStorage),
     aiUsage: createAiUsageRuntime(runtime, dependencies.definitions.security),
     events: createEventsRuntime(runtime),
     logs: createLogsRuntime(runtime, dependencies.logging),
     schedules: createSchedulesRuntime(runtime, dependencies.definitions.schedules),
     shares: createSharesRuntime(runtime, execution, dependencies.definitions.shares),
     connector: createConnectorRuntime(runtime, execution, dependencies.connectorService),
-    blobs: createBlobsRuntime(runtime, execution, dependencies.blobStorage)
+    blobs: createBlobsRuntime(runtime, execution, dependencies.blobStorage, dependencies.apiPublicOrigin)
   };
 }
 // src/execution/agent.ts
@@ -4135,6 +4506,17 @@ function bindDurableAgentExecution2(host, input) {
   }
   return sixb;
 }
+function bindAgentModelExecution2(sixb, input) {
+  const { accounting } = input;
+  if (accounting.executionId !== sixb.execution.id) {
+    throw new Error(`[Sixb] Agent execution '${sixb.execution.id}' cannot account its model calls to execution '${accounting.executionId}'.`);
+  }
+  bindModelExecutionAttempt(sixb.models, {
+    attempt: accounting.attempt,
+    signal: input.signal,
+    accounting
+  });
+}
 function restoreAgentExecutionScope2(input) {
   assertAgentExecutionRecord2(input);
   const context = Object.freeze({
@@ -4200,6 +4582,6 @@ function invalidAgentExecution(executionId, runId) {
   throw new ExecutionStorageError2("invalid_input", `[Sixb] Execution '${executionId}' does not authorize Agent run '${runId}'.`);
 }
 
-export { resolveAgentContextParts2, agentRunQueueJobId2, subagentRunQueueJobId2, workflowAgentNodeQueueJobId2, dispatchQueuedAgentRuns2, dispatchQueuedSubagentRuns2, createAgentThreadId2, createAgentThreadSandboxName2, createAgentRunId2, createSubagentRunId2, createSubagentExecutionId2, createAgentMessageId2, agentContextCheckpointId2, createAgentRunExecutionToken2, runModelLoop2, assertNoAgentDefinitions, bindModelExecutionAttempt, ShareError2, WorkflowDefinitionError2, WorkflowValidationError2, assertNonEmpty, isStepDefinition2, isAgentStepDefinition2, isInterventionDefinition2, isWorkflowDefinition2, validateWorkflowDefinition2, validateWorkflowsAtStartup2, validateWorkflowAgentStepGroupReferences2, validateWorkflowInput2, validateWorkflowStepInput2, validateWorkflowStepOutput2, validateWorkflowInterventionInput2, validateWorkflowInterventionResponse2, validateWorkflowInterventionDefaultResponse2, validateWorkflowAgentStepInput2, validateWorkflowAgentStepOutput2, snapshotWorkflowAgentStepInput2, snapshotWorkflowAgentStepOutput2, snapshotWorkflowInput2, snapshotWorkflowStepInput2, snapshotWorkflowStepOutput2, snapshotWorkflowInterventionInput2, snapshotWorkflowInterventionResponse2, snapshotWorkflowInterventionDefaultResponse2, snapshotWorkflowActionInput2, WorkflowRunDispatcher2, requestWorkflowRun2, createBoundSixb, isBoundSixb, canInheritAgentRequestAuthorization2, createAgentExecutionRecord2, createInheritedAgentExecutionRecord2, bindDurableAgentExecution2, restoreAgentExecutionScope2, assertAgentExecutionRecord2, requestAgentRun2, retryAgentRun2 };
+export { resolveAgentContextParts2, agentRunQueueJobId2, subagentRunQueueJobId2, workflowAgentNodeQueueJobId2, dispatchQueuedAgentRuns2, dispatchQueuedSubagentRuns2, createAgentThreadId2, createAgentThreadSandboxName2, createAgentRunId2, createSubagentRunId2, createSubagentExecutionId2, createAgentMessageId2, agentContextCheckpointId2, createAgentRunExecutionToken2, runModelLoop2, bindModelExecutionAttempt, assertNoAgentDefinitions, ShareError2, WorkflowDefinitionError2, WorkflowValidationError2, assertNonEmpty, isStepDefinition2, isAgentStepDefinition2, isInterventionDefinition2, isWorkflowDefinition2, validateWorkflowDefinition2, validateWorkflowsAtStartup2, validateWorkflowAgentStepGroupReferences2, validateWorkflowInput2, validateWorkflowStepInput2, validateWorkflowStepOutput2, validateWorkflowInterventionInput2, validateWorkflowInterventionResponse2, validateWorkflowInterventionDefaultResponse2, validateWorkflowAgentStepInput2, validateWorkflowAgentStepOutput2, snapshotWorkflowAgentStepInput2, snapshotWorkflowAgentStepOutput2, snapshotWorkflowInput2, snapshotWorkflowStepInput2, snapshotWorkflowStepOutput2, snapshotWorkflowInterventionInput2, snapshotWorkflowInterventionResponse2, snapshotWorkflowInterventionDefaultResponse2, snapshotWorkflowActionInput2, WorkflowRunDispatcher2, requestWorkflowRun2, createBoundSixb, isBoundSixb, canInheritAgentRequestAuthorization2, createAgentExecutionRecord2, createInheritedAgentExecutionRecord2, bindDurableAgentExecution2, bindAgentModelExecution2, restoreAgentExecutionScope2, assertAgentExecutionRecord2, DEFAULT_PROJECT_LOCALE, DEFAULT_PROJECT_TIME_ZONE, canonicalLocale, canonicalTimeZone, requestAgentRun2, isRetryableAgentRun2, retryAgentRun2 };
 
-//# debugId=BFEC51F637946F6864756E2164756E21
+//# debugId=E150F65F48DA7B0364756E2164756E21