@sixb/core 0.1.16 → 0.1.18

package/dist/{chunk-91kcnbf0.js → chunk-6gmfggss.js}

@@ -1,17 +1,27 @@
 // @bun
+import {
+  isFileRef2,
+  isValidFileRef
+} from "./chunk-jhm3zsa7.js";
 import {
   getDatasetRowValidationFailure
-} from "./chunk-cd234ba4.js";
+} from "./chunk-rz53yb4v.js";
 import {
   getDatasetMergeChangeValidationError2
-} from "./chunk-rb143ggb.js";
-import {
-  isFileRef2
-} from "./chunk-h3v76ams.js";
+} from "./chunk-bwjcehza.js";
 
 // src/datasets/write.ts
+function lakeDatasetDefinition2(dataset) {
+  if (!dataset.schema.columns.some((column) => column.markings))
+    return dataset;
+  return {
+    ...dataset,
+    schema: { columns: dataset.schema.columns.map(({ markings: _markings, ...column }) => column) }
+  };
+}
 async function writeDataset2(input) {
-  const { lakeStorage, dataset, signal } = input;
+  const { lakeStorage, signal } = input;
+  const dataset = lakeDatasetDefinition2(input.dataset);
   let abortWrite;
   let rowsRead = 0;
   const onRead = () => {
@@ -115,8 +125,11 @@ async function verifyRowFileRefs(row, input, itemIndex) {
   }
 }
 async function verifyFileRef(fileRef, input, columnName, itemIndex) {
-  const blobInfo = await input.blobStorage.stat(fileRef.blobId);
   const context = `${sourceLabel(input)} returned row ${itemIndex} with dataset '${input.dataset.id}' column '${columnName}'`;
+  if (!isValidFileRef(fileRef)) {
+    throw new Error(`${context} with an invalid mediaType; use one media type, such as "application/pdf".`);
+  }
+  const blobInfo = await input.blobStorage.stat(fileRef.blobId);
   if (!blobInfo) {
     throw new Error(`${context} referencing unknown blob '${fileRef.blobId}'.`);
   }
@@ -137,6 +150,6 @@ function throwIfAborted(signal) {
   throw error;
 }
 
-export { writeDataset2 };
+export { lakeDatasetDefinition2, writeDataset2 };
 
-//# debugId=013E5C6E3459B8F964756E2164756E21
+//# debugId=CDE5D84B182CBD5A64756E2164756E21

package/dist/chunk-6gmfggss.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/datasets/write.ts"],
+  "sourcesContent": [
+    "import type { BlobStorage, FileRef } from \"../blob-storage\"\nimport { isFileRef } from \"../blob-storage\"\nimport { isValidFileRef } from \"../blob-storage/validation\"\nimport type { DatasetMergeCommitResult } from \"../lake-storage/merge\"\nimport { getDatasetMergeChangeValidationError } from \"../lake-storage/merge-validation\"\nimport type {\n  DatasetProducer,\n  DatasetRow,\n  DatasetWriteMode,\n  LakeStorage,\n} from \"../lake-storage/types\"\nimport type { MergeChange } from \"./changes\"\nimport type { DatasetDefinition } from \"./types\"\nimport { getDatasetRowValidationFailure } from \"./validation\"\n\nexport interface DatasetWriteValue {\n  readonly value: unknown\n}\n\nexport interface WriteDatasetInput<TValue extends DatasetWriteValue = DatasetWriteValue> {\n  readonly lakeStorage: LakeStorage\n  readonly blobStorage: Pick<BlobStorage, \"stat\">\n  readonly dataset: DatasetDefinition\n  readonly mode: DatasetWriteMode | \"merge\"\n  readonly signal: AbortSignal\n  /** Lazy so a merge's latest-version guard is checked before fetching source data. */\n  readValues(): Promise<Iterable<TValue> | AsyncIterable<TValue>>\n  readonly producer?: DatasetProducer\n  readonly expectedLatestVersionId?: string\n  readonly commitMessage?: string\n  /** Diagnostic label for the caller, including its component prefix. */\n  readonly sourceLabel?: string\n  /** Progress includes validated values even if the operation subsequently fails. */\n  onRead?(rowsRead: number): void\n  /** Attach caller-owned source provenance to a validation failure. */\n  mapValidationError?(error: unknown, value: TValue, itemIndex: number): unknown\n}\n\nexport type WriteDatasetResult = DatasetMergeCommitResult & { readonly rowsRead: number }\n\n/**\n * The definition the lake receives. Markings are enforced from the registered definition and never\n * stored, so a stored schema cannot keep a classification the code has since changed.\n */\nexport function lakeDatasetDefinition(dataset: DatasetDefinition): DatasetDefinition {\n  if (!dataset.schema.columns.some((column) => column.markings)) return dataset\n  return {\n    ...dataset,\n    schema: { columns: dataset.schema.columns.map(({ markings: _markings, ...column }) => column) },\n  }\n}\n\n/**\n * Validate, stage, and commit one dataset write using existing lake sessions.\n *\n * The caller owns fetching/cancelling its source, execution bookkeeping, and publishing the\n * dataset-update notification for a `created` result. This operation returns immediately after\n * the lake commit; it does not wait for downstream pipelines or projections.\n */\nexport async function writeDataset<TValue extends DatasetWriteValue>(\n  input: WriteDatasetInput<TValue>\n): Promise<WriteDatasetResult> {\n  const { lakeStorage, signal } = input\n  const dataset = lakeDatasetDefinition(input.dataset)\n  let abortWrite: (() => Promise<void>) | undefined\n  let rowsRead = 0\n  const onRead = () => {\n    rowsRead += 1\n    input.onRead?.(rowsRead)\n  }\n\n  throwIfAborted(signal)\n  await lakeStorage.createDataset(dataset)\n  try {\n    throwIfAborted(signal)\n    const reconcileSnapshot = dataset.sequenceBy !== undefined && input.mode === \"snapshot\"\n    if (input.mode === \"merge\" || reconcileSnapshot) {\n      const session = await lakeStorage.beginMerge({\n        dataset,\n        expectedLatestVersionId: input.expectedLatestVersionId,\n        producer: input.producer,\n      })\n      abortWrite = () => session.abort()\n      throwIfAborted(signal)\n      const values = await input.readValues()\n      throwIfAborted(signal)\n      await session.writeChanges(\n        validatedValues(\n          input,\n          values,\n          async (value, itemIndex) =>\n            reconcileSnapshot\n              ? { kind: \"upsert\" as const, row: await validateRow(value, input, itemIndex) }\n              : validateMergeChange(value, input, itemIndex),\n          onRead\n        )\n      )\n      throwIfAborted(signal)\n      const result = await session.commit({\n        commitMessage: input.commitMessage,\n        createInitialVersion: reconcileSnapshot,\n        retryOnConflict: dataset.sequenceBy !== undefined,\n        signal,\n      })\n      return { ...result, rowsRead }\n    }\n\n    const values = await input.readValues()\n    throwIfAborted(signal)\n    const session = await lakeStorage.beginWrite({\n      dataset,\n      mode: input.mode,\n      producer: input.producer,\n    })\n    abortWrite = () => session.abort()\n    await session.writeRows(\n      validatedValues(\n        input,\n        values,\n        (value, itemIndex) => validateRow(value, input, itemIndex),\n        onRead\n      )\n    )\n    throwIfAborted(signal)\n\n    // Preserve sync semantics: an empty append must not invent an initial dataset version.\n    if (rowsRead === 0 && input.mode === \"append\") {\n      const version = await lakeStorage.getLatestVersion(dataset.id)\n      await session.abort()\n      return { outcome: \"unchanged\", version, rowsRead }\n    }\n\n    const { outcome, ...version } = await session.commit({\n      expectedLatestVersionId: input.expectedLatestVersionId,\n      commitMessage: input.commitMessage,\n    })\n    return { outcome, version, rowsRead }\n  } catch (error) {\n    // Cleanup must not replace the source, validation, cancellation, or commit failure.\n    await abortWrite?.().catch(() => {})\n    throw error\n  }\n}\n\nasync function* validatedValues<TValue extends DatasetWriteValue, TResult>(\n  input: WriteDatasetInput<TValue>,\n  values: Iterable<TValue> | AsyncIterable<TValue>,\n  validate: (value: unknown, itemIndex: number) => Promise<TResult>,\n  onRead: () => void\n): AsyncIterable<TResult> {\n  let itemIndex = 0\n  for await (const sourceValue of values) {\n    throwIfAborted(input.signal)\n    itemIndex += 1\n    let value: TResult\n    try {\n      value = await validate(sourceValue.value, itemIndex)\n    } catch (error) {\n      throw input.mapValidationError\n        ? input.mapValidationError(error, sourceValue, itemIndex)\n        : error\n    }\n    onRead()\n    yield value\n  }\n}\n\nfunction sourceLabel(input: Pick<WriteDatasetInput, \"dataset\" | \"sourceLabel\">): string {\n  return input.sourceLabel ?? `[Sixb] Dataset '${input.dataset.id}' writer`\n}\n\nasync function validateRow(\n  value: unknown,\n  input: WriteDatasetInput,\n  itemIndex: number\n): Promise<DatasetRow> {\n  const validationError = getDatasetRowValidationFailure(value, input.dataset)\n  if (validationError) {\n    throw new Error(\n      `${sourceLabel(input)} returned an invalid row at item ${itemIndex}. ${validationError.message}`,\n      { cause: validationError }\n    )\n  }\n  // The validator above establishes the row shape.\n  const row = value as DatasetRow\n  await verifyRowFileRefs(row, input, itemIndex)\n  return row\n}\n\nasync function validateMergeChange(\n  value: unknown,\n  input: WriteDatasetInput,\n  itemIndex: number\n): Promise<MergeChange<DatasetRow, DatasetRow>> {\n  const validationError = getDatasetMergeChangeValidationError(value, input.dataset)\n  if (validationError) {\n    throw new Error(\n      `${sourceLabel(input)} returned an invalid merge change at item ${itemIndex}. ${validationError}`\n    )\n  }\n  const change = value as MergeChange<DatasetRow, DatasetRow>\n  if (change.kind === \"upsert\") await verifyRowFileRefs(change.row, input, itemIndex)\n  return change\n}\n\nasync function verifyRowFileRefs(\n  row: DatasetRow,\n  input: WriteDatasetInput,\n  itemIndex: number\n): Promise<void> {\n  for (const column of input.dataset.schema.columns) {\n    if (column.type !== \"fileRef\") continue\n    const value = row[column.name]\n    if (isFileRef(value)) await verifyFileRef(value, input, column.name, itemIndex)\n  }\n}\n\nasync function verifyFileRef(\n  fileRef: FileRef,\n  input: WriteDatasetInput,\n  columnName: string,\n  itemIndex: number\n): Promise<void> {\n  const context = `${sourceLabel(input)} returned row ${itemIndex} with dataset '${input.dataset.id}' column '${columnName}'`\n  if (!isValidFileRef(fileRef)) {\n    throw new Error(\n      `${context} with an invalid mediaType; use one media type, such as \"application/pdf\".`\n    )\n  }\n  const blobInfo = await input.blobStorage.stat(fileRef.blobId)\n  if (!blobInfo) {\n    throw new Error(`${context} referencing unknown blob '${fileRef.blobId}'.`)\n  }\n  if (blobInfo.digest !== fileRef.digest) {\n    throw new Error(\n      `${context} referencing blob '${fileRef.blobId}' with digest '${fileRef.digest}', but blob storage has '${blobInfo.digest}'.`\n    )\n  }\n  if (blobInfo.sizeBytes !== fileRef.sizeBytes) {\n    throw new Error(\n      `${context} referencing blob '${fileRef.blobId}' with size ${fileRef.sizeBytes}, but blob storage has ${blobInfo.sizeBytes}.`\n    )\n  }\n}\n\nfunction throwIfAborted(signal: AbortSignal): void {\n  if (!signal.aborted) return\n  if (signal.reason instanceof Error) throw signal.reason\n  const error = new Error(\n    typeof signal.reason === \"string\" && signal.reason.length > 0\n      ? signal.reason\n      : \"[Sixb] Dataset write was cancelled.\"\n  )\n  error.name = \"AbortError\"\n  throw error\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;AA4CO,SAAS,sBAAqB,CAAC,SAA+C;AAAA,EACnF,IAAI,CAAC,QAAQ,OAAO,QAAQ,KAAK,CAAC,WAAW,OAAO,QAAQ;AAAA,IAAG,OAAO;AAAA,EACtE,OAAO;AAAA,OACF;AAAA,IACH,QAAQ,EAAE,SAAS,QAAQ,OAAO,QAAQ,IAAI,GAAG,UAAU,cAAc,aAAa,MAAM,EAAE;AAAA,EAChG;AAAA;AAUF,eAAsB,aAA8C,CAClE,OAC6B;AAAA,EAC7B,QAAQ,aAAa,WAAW;AAAA,EAChC,MAAM,UAAU,uBAAsB,MAAM,OAAO;AAAA,EACnD,IAAI;AAAA,EACJ,IAAI,WAAW;AAAA,EACf,MAAM,SAAS,MAAM;AAAA,IACnB,YAAY;AAAA,IACZ,MAAM,SAAS,QAAQ;AAAA;AAAA,EAGzB,eAAe,MAAM;AAAA,EACrB,MAAM,YAAY,cAAc,OAAO;AAAA,EACvC,IAAI;AAAA,IACF,eAAe,MAAM;AAAA,IACrB,MAAM,oBAAoB,QAAQ,eAAe,aAAa,MAAM,SAAS;AAAA,IAC7E,IAAI,MAAM,SAAS,WAAW,mBAAmB;AAAA,MAC/C,MAAM,UAAU,MAAM,YAAY,WAAW;AAAA,QAC3C;AAAA,QACA,yBAAyB,MAAM;AAAA,QAC/B,UAAU,MAAM;AAAA,MAClB,CAAC;AAAA,MACD,aAAa,MAAM,QAAQ,MAAM;AAAA,MACjC,eAAe,MAAM;AAAA,MACrB,MAAM,SAAS,MAAM,MAAM,WAAW;AAAA,MACtC,eAAe,MAAM;AAAA,MACrB,MAAM,QAAQ,aACZ,gBACE,OACA,QACA,OAAO,OAAO,cACZ,oBACI,EAAE,MAAM,UAAmB,KAAK,MAAM,YAAY,OAAO,OAAO,SAAS,EAAE,IAC3E,oBAAoB,OAAO,OAAO,SAAS,GACjD,MACF,CACF;AAAA,MACA,eAAe,MAAM;AAAA,MACrB,MAAM,SAAS,MAAM,QAAQ,OAAO;AAAA,QAClC,eAAe,MAAM;AAAA,QACrB,sBAAsB;AAAA,QACtB,iBAAiB,QAAQ,eAAe;AAAA,QACxC;AAAA,MACF,CAAC;AAAA,MACD,OAAO,KAAK,QAAQ,SAAS;AAAA,IAC/B;AAAA,IAEA,MAAM,SAAS,MAAM,MAAM,WAAW;AAAA,IACtC,eAAe,MAAM;AAAA,IACrB,MAAM,UAAU,MAAM,YAAY,WAAW;AAAA,MAC3C;AAAA,MACA,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,IAClB,CAAC;AAAA,IACD,aAAa,MAAM,QAAQ,MAAM;AAAA,IACjC,MAAM,QAAQ,UACZ,gBACE,OACA,QACA,CAAC,OAAO,cAAc,YAAY,OAAO,OAAO,SAAS,GACzD,MACF,CACF;AAAA,IACA,eAAe,MAAM;AAAA,IAGrB,IAAI,aAAa,KAAK,MAAM,SAAS,UAAU;AAAA,MAC7C,MAAM,UAAU,MAAM,YAAY,iBAAiB,QAAQ,EAAE;AAAA,MAC7D,MAAM,QAAQ,MAAM;AAAA,MACpB,OAAO,EAAE,SAAS,aAAa,SAAS,SAAS;AAAA,IACnD;AAAA,IAEA,QAAQ,YAAY,YAAY,MAAM,QAAQ,OAAO;AAAA,MACnD,yBAAyB,MAAM;AAAA,MAC/B,eAAe,MAAM;AAAA,IACvB,CAAC;AAAA,IACD,OAAO,EAAE,SAAS,SAAS,SAAS;AAAA,IACpC,OAAO,OAAO;AAAA,IAEd,MAAM,aAAa,EAAE,MAAM,MAAM,EAAE;AAAA,IACnC,MAAM;AAAA;AAAA;AAIV,gBAAgB,eAA0D,CACxE,OACA,QACA,UACA,QACwB;AAAA,EACxB,IAAI,YAAY;AAAA,EAChB,iBAAiB,eAAe,QAAQ;AAAA,IACtC,eAAe,MAAM,MAAM;AAAA,IAC3B,aAAa;AAAA,IACb,IAAI;AAAA,IACJ,IAAI;AAAA,MACF,QAAQ,MAAM,SAAS,YAAY,OAAO,SAAS;AAAA,MACnD,OAAO,OAAO;AAAA,MACd,MAAM,MAAM,qBACR,MAAM,mBAAmB,OAAO,aAAa,SAAS,IACtD;AAAA;AAAA,IAEN,OAAO;AAAA,IACP,MAAM;AAAA,EACR;AAAA;AAGF,SAAS,WAAW,CAAC,OAAmE;AAAA,EACtF,OAAO,MAAM,eAAe,mBAAmB,MAAM,QAAQ;AAAA;AAG/D,eAAe,WAAW,CACxB,OACA,OACA,WACqB;AAAA,EACrB,MAAM,kBAAkB,+BAA+B,OAAO,MAAM,OAAO;AAAA,EAC3E,IAAI,iBAAiB;AAAA,IACnB,MAAM,IAAI,MACR,GAAG,YAAY,KAAK,qCAAqC,cAAc,gBAAgB,WACvF,EAAE,OAAO,gBAAgB,CAC3B;AAAA,EACF;AAAA,EAEA,MAAM,MAAM;AAAA,EACZ,MAAM,kBAAkB,KAAK,OAAO,SAAS;AAAA,EAC7C,OAAO;AAAA;AAGT,eAAe,mBAAmB,CAChC,OACA,OACA,WAC8C;AAAA,EAC9C,MAAM,kBAAkB,sCAAqC,OAAO,MAAM,OAAO;AAAA,EACjF,IAAI,iBAAiB;AAAA,IACnB,MAAM,IAAI,MACR,GAAG,YAAY,KAAK,8CAA8C,cAAc,iBAClF;AAAA,EACF;AAAA,EACA,MAAM,SAAS;AAAA,EACf,IAAI,OAAO,SAAS;AAAA,IAAU,MAAM,kBAAkB,OAAO,KAAK,OAAO,SAAS;AAAA,EAClF,OAAO;AAAA;AAGT,eAAe,iBAAiB,CAC9B,KACA,OACA,WACe;AAAA,EACf,WAAW,UAAU,MAAM,QAAQ,OAAO,SAAS;AAAA,IACjD,IAAI,OAAO,SAAS;AAAA,MAAW;AAAA,IAC/B,MAAM,QAAQ,IAAI,OAAO;AAAA,IACzB,IAAI,WAAU,KAAK;AAAA,MAAG,MAAM,cAAc,OAAO,OAAO,OAAO,MAAM,SAAS;AAAA,EAChF;AAAA;AAGF,eAAe,aAAa,CAC1B,SACA,OACA,YACA,WACe;AAAA,EACf,MAAM,UAAU,GAAG,YAAY,KAAK,kBAAkB,2BAA2B,MAAM,QAAQ,eAAe;AAAA,EAC9G,IAAI,CAAC,eAAe,OAAO,GAAG;AAAA,IAC5B,MAAM,IAAI,MACR,GAAG,mFACL;AAAA,EACF;AAAA,EACA,MAAM,WAAW,MAAM,MAAM,YAAY,KAAK,QAAQ,MAAM;AAAA,EAC5D,IAAI,CAAC,UAAU;AAAA,IACb,MAAM,IAAI,MAAM,GAAG,qCAAqC,QAAQ,UAAU;AAAA,EAC5E;AAAA,EACA,IAAI,SAAS,WAAW,QAAQ,QAAQ;AAAA,IACtC,MAAM,IAAI,MACR,GAAG,6BAA6B,QAAQ,wBAAwB,QAAQ,kCAAkC,SAAS,UACrH;AAAA,EACF;AAAA,EACA,IAAI,SAAS,cAAc,QAAQ,WAAW;AAAA,IAC5C,MAAM,IAAI,MACR,GAAG,6BAA6B,QAAQ,qBAAqB,QAAQ,mCAAmC,SAAS,YACnH;AAAA,EACF;AAAA;AAGF,SAAS,cAAc,CAAC,QAA2B;AAAA,EACjD,IAAI,CAAC,OAAO;AAAA,IAAS;AAAA,EACrB,IAAI,OAAO,kBAAkB;AAAA,IAAO,MAAM,OAAO;AAAA,EACjD,MAAM,QAAQ,IAAI,MAChB,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,SAAS,IACxD,OAAO,SACP,qCACN;AAAA,EACA,MAAM,OAAO;AAAA,EACb,MAAM;AAAA;",
+  "debugId": "CDE5D84B182CBD5A64756E2164756E21",
+  "names": []
+}

package/dist/{chunk-2xvgy3x5.js → chunk-6h5m9xjx.js}

@@ -1,11 +1,19 @@
 // @bun
 import {
-  GRANT_KINDS,
-  grantKindOf,
   canAccessApplication2,
   resolveRoleGrants2,
   resolveAuthorizationContext2
-} from "./chunk-69kt9q43.js";
+} from "./chunk-qkbx3tf6.js";
+import {
+  assertValidFileRefs2
+} from "./chunk-y05543x6.js";
+import {
+  SecurityValidationError2,
+  resolveMembershipPolicyScope,
+  canPerformMembershipOperation,
+  missingMembershipGroupIds,
+  validateSecurityDefinitionsAtStartup
+} from "./chunk-xt1zt7gv.js";
 import {
   AuthRuntimeError2,
   DEFAULT_AUTH_SESSION_AUDIENCE2,
@@ -21,7 +29,7 @@ import {
 import {
   normalizeParams,
   coerceParamsToTyped
-} from "./chunk-qnd7ehe5.js";
+} from "./chunk-vx2yp45y.js";
 import {
   snapshotLinkPathSelection
 } from "./chunk-t6f3tdnr.js";
@@ -160,405 +168,6 @@ var applications2 = {
   app: { kind: "application", id: "app", label: "Custom app" }
 };
 var APPLICATION_IDS = new Set(Object.values(applications2).map((application) => application.id));
-// src/security/errors.ts
-class SecurityValidationError2 extends Error {
-  name = "SecurityValidationError";
-}
-
-// src/security/membership-policies.ts
-var MEMBERSHIP_OPERATIONS = ["invite", "assignGroups", "suspend"];
-function resolveMembershipPolicyScope(input) {
-  const callerGroups = new Set(input.callerGroupIds);
-  const policyIds = [];
-  const operations = createEmptyOperationScopes();
-  for (const policy of input.membershipPolicies) {
-    if (!policy.grantedToGroupIds.some((groupId) => callerGroups.has(groupId))) {
-      continue;
-    }
-    policyIds.push(policy.id);
-    for (const operation of policy.can) {
-      operations[operation].policyIds.push(policy.id);
-      for (const groupId of policy.scopeGroupIds) {
-        operations[operation].groupIds.add(groupId);
-      }
-    }
-  }
-  return {
-    policyIds,
-    operations: {
-      invite: freezeOperationScope(operations.invite),
-      assignGroups: freezeOperationScope(operations.assignGroups),
-      suspend: freezeOperationScope(operations.suspend)
-    }
-  };
-}
-function canPerformMembershipOperation(scope, operation, groupIds) {
-  const operationScope = scope.operations[operation];
-  if (operationScope.policyIds.length === 0) {
-    return false;
-  }
-  if (groupIds.length === 0) {
-    return true;
-  }
-  return groupIds.every((groupId) => operationScope.groupIds.has(groupId));
-}
-function missingMembershipGroupIds(scope, operation, groupIds) {
-  if (groupIds.length === 0) {
-    return [];
-  }
-  const operationScope = scope.operations[operation];
-  return groupIds.filter((groupId) => !operationScope.groupIds.has(groupId));
-}
-function createEmptyOperationScopes() {
-  return {
-    invite: { policyIds: [], groupIds: new Set },
-    assignGroups: { policyIds: [], groupIds: new Set },
-    suspend: { policyIds: [], groupIds: new Set }
-  };
-}
-function freezeOperationScope(input) {
-  return {
-    policyIds: [...input.policyIds],
-    groupIds: new Set(input.groupIds)
-  };
-}
-function isMembershipOperation(value) {
-  return MEMBERSHIP_OPERATIONS.includes(value);
-}
-
-// src/security/validation.ts
-var GRANT_CAPABILITIES = Object.keys({
-  access: true,
-  view: true,
-  edit: true,
-  append: true,
-  apply: true,
-  share: true,
-  run: true,
-  observe: true,
-  manage: true
-});
-function formatAlternatives(values) {
-  const quoted = values.map((value) => `'${value}'`);
-  const last = quoted.at(-1);
-  return quoted.length < 2 ? last ?? "" : `${quoted.slice(0, -1).join(", ")}, or ${last}`;
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function assertNonEmptyString(value, field, createError = (message) => new SecurityValidationError2(message)) {
-  if (typeof value !== "string" || value.trim().length === 0) {
-    throw createError(`[Sixb] ${field} must not be empty.`);
-  }
-}
-function assertOptionalString(value, field, createError = (message) => new SecurityValidationError2(message)) {
-  if (value === undefined) {
-    return;
-  }
-  if (typeof value !== "string") {
-    throw createError(`[Sixb] ${field} must be a string.`);
-  }
-}
-function assertStringArray(value, field, createError) {
-  if (!Array.isArray(value)) {
-    throw createError(`[Sixb] ${field} must be an array of group ids.`);
-  }
-  for (const item of value) {
-    assertNonEmptyString(item, `${field} item`, createError);
-  }
-}
-function assertMembershipOperationArray(value, field, createError) {
-  if (!Array.isArray(value)) {
-    throw createError(`[Sixb] ${field} must be an array of membership operations.`);
-  }
-  for (const item of value) {
-    if (!isMembershipOperation(item)) {
-      throw createError(`[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`);
-    }
-  }
-}
-function assertNoDuplicateIds(ids, field) {
-  const seen = new Set;
-  for (const id of ids) {
-    if (seen.has(id)) {
-      throw new SecurityValidationError2(`[Sixb] ${field} contains duplicate group id '${id}'.`);
-    }
-    seen.add(id);
-  }
-}
-function assertNoDuplicateOperations(operations, field) {
-  const seen = new Set;
-  for (const operation of operations) {
-    if (seen.has(operation)) {
-      throw new SecurityValidationError2(`[Sixb] ${field} contains duplicate operation '${operation}'.`);
-    }
-    seen.add(operation);
-  }
-}
-function assertGroupDefinition(value, createError = (message) => new SecurityValidationError2(message)) {
-  if (!isRecord(value)) {
-    throw createError("[Sixb] Group definition must be an object.");
-  }
-  if (value.kind !== "group") {
-    throw createError("[Sixb] Group definition kind must be 'group'.");
-  }
-  assertNonEmptyString(value.id, "Group id", createError);
-  assertOptionalString(value.label, `Group '${value.id}' label`, createError);
-  assertOptionalString(value.description, `Group '${value.id}' description`, createError);
-}
-function isGroupDefinition(value) {
-  try {
-    assertGroupDefinition(value, (message) => new Error(message));
-    return true;
-  } catch {
-    return false;
-  }
-}
-function assertMembershipPolicyDefinition(value, createError = (message) => new SecurityValidationError2(message)) {
-  if (!isRecord(value)) {
-    throw createError("[Sixb] Membership policy definition must be an object.");
-  }
-  if (value.kind !== "membershipPolicy") {
-    throw createError("[Sixb] Membership policy definition kind must be 'membershipPolicy'.");
-  }
-  assertNonEmptyString(value.id, "Membership policy id", createError);
-  assertStringArray(value.grantedToGroupIds, `Membership policy '${value.id}' grantedTo`, createError);
-  assertStringArray(value.scopeGroupIds, `Membership policy '${value.id}' scope`, createError);
-  assertMembershipOperationArray(value.can, `Membership policy '${value.id}' can`, createError);
-}
-function isMembershipPolicyDefinition(value) {
-  try {
-    assertMembershipPolicyDefinition(value, (message) => new Error(message));
-    return true;
-  } catch {
-    return false;
-  }
-}
-function assertGrantDefinition(value, field, createError = (message) => new SecurityValidationError2(message)) {
-  if (!isRecord(value) || value.kind !== "grant") {
-    throw createError(`[Sixb] ${field} must contain only grant definitions from 'can'.`);
-  }
-  if (!GRANT_CAPABILITIES.includes(value.capability)) {
-    throw createError(`[Sixb] ${field} grant capability must be ${formatAlternatives(GRANT_CAPABILITIES)}.`);
-  }
-  if (value.capability === "access" && value.target !== "application") {
-    throw createError(`[Sixb] ${field} access grant target must be 'application'.`);
-  }
-  if (value.capability === "view" && value.target !== "object" && value.target !== "dataset") {
-    throw createError(`[Sixb] ${field} view grant target must be 'object' or 'dataset'.`);
-  }
-  if (value.capability === "run" && value.target !== "workflow" && value.target !== "sync" && value.target !== "pipeline" && value.target !== "agent") {
-    throw createError(`[Sixb] ${field} run grant target must be 'workflow', 'sync', 'pipeline', or 'agent'.`);
-  }
-  if (value.capability === "observe" && value.target !== "logs" && value.target !== "aiUsage") {
-    throw createError(`[Sixb] ${field} observe grant target must be 'logs' or 'aiUsage'.`);
-  }
-  if (value.capability === "manage" && value.target !== "connector" && value.target !== "aiUsage") {
-    throw createError(`[Sixb] ${field} manage grant target must be 'connector' or 'aiUsage'.`);
-  }
-  if (value.capability === "run" && value.target === "agent") {
-    if (value.selection !== undefined) {
-      throw createError(`[Sixb] ${field} agent run grant must not declare a selection.`);
-    }
-    return;
-  }
-  assertSelection(value.selection, field, createError);
-}
-function assertSelection(value, field, createError) {
-  if (!isRecord(value) || typeof value.all !== "boolean") {
-    throw createError(`[Sixb] ${field} grant must carry a selection from 'can' or a scope.`);
-  }
-  const ids = value.all ? value.except : value.ids;
-  if (!Array.isArray(ids)) {
-    throw createError(`[Sixb] ${field} grant selection must list ids.`);
-  }
-  for (const id of ids) {
-    assertNonEmptyString(id, `${field} grant selection id`, createError);
-  }
-}
-function assertRoleDefinition(value, createError = (message) => new SecurityValidationError2(message)) {
-  if (!isRecord(value)) {
-    throw createError("[Sixb] Role definition must be an object.");
-  }
-  if (value.kind !== "role") {
-    throw createError("[Sixb] Role definition kind must be 'role'.");
-  }
-  assertNonEmptyString(value.id, "Role id", createError);
-  assertOptionalString(value.label, `Role '${value.id}' label`, createError);
-  assertOptionalString(value.description, `Role '${value.id}' description`, createError);
-  assertStringArray(value.grantedToGroupIds, `Role '${value.id}' grantedTo`, createError);
-  if (!Array.isArray(value.grants)) {
-    throw createError(`[Sixb] Role '${value.id}' grants must be an array.`);
-  }
-  for (const grant of value.grants) {
-    assertGrantDefinition(grant, `Role '${value.id}' grants`, createError);
-  }
-}
-function isRoleDefinition(value) {
-  try {
-    assertRoleDefinition(value, (message) => new Error(message));
-    return true;
-  } catch {
-    return false;
-  }
-}
-function validateSecurityDefinitionsAtStartup(input) {
-  const groupsById = new Map;
-  const rolesById = new Map;
-  const membershipPoliciesById = new Map;
-  for (const group of input.groups) {
-    assertGroupDefinition(group);
-    if (groupsById.has(group.id)) {
-      throw new SecurityValidationError2(`[Sixb] Duplicate group id: ${group.id}`);
-    }
-    groupsById.set(group.id, group);
-  }
-  for (const role of input.roles ?? []) {
-    assertRoleDefinition(role);
-    if (rolesById.has(role.id)) {
-      throw new SecurityValidationError2(`[Sixb] Duplicate role id: ${role.id}`);
-    }
-    if (role.grantedToGroupIds.length === 0) {
-      throw new SecurityValidationError2(`[Sixb] Role '${role.id}' must be granted to at least one group.`);
-    }
-    if (role.grants.length === 0) {
-      throw new SecurityValidationError2(`[Sixb] Role '${role.id}' must declare at least one grant.`);
-    }
-    assertNoDuplicateIds(role.grantedToGroupIds, `Role '${role.id}' grantedTo`);
-    for (const groupId of role.grantedToGroupIds) {
-      if (!groupsById.has(groupId)) {
-        throw new SecurityValidationError2(`[Sixb] Role '${role.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
-      }
-    }
-    for (const grant of role.grants) {
-      assertGrantReferences(role.id, grant, input);
-    }
-    rolesById.set(role.id, role);
-  }
-  for (const policy of input.membershipPolicies) {
-    assertMembershipPolicyDefinition(policy);
-    if (membershipPoliciesById.has(policy.id)) {
-      throw new SecurityValidationError2(`[Sixb] Duplicate membership policy id: ${policy.id}`);
-    }
-    if (policy.grantedToGroupIds.length === 0) {
-      throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' must grant membership authority to at least one group.`);
-    }
-    if (policy.can.length === 0) {
-      throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' must declare at least one operation.`);
-    }
-    assertNoDuplicateIds(policy.grantedToGroupIds, `Membership policy '${policy.id}' grantedTo`);
-    assertNoDuplicateIds(policy.scopeGroupIds, `Membership policy '${policy.id}' scope`);
-    assertNoDuplicateOperations(policy.can, `Membership policy '${policy.id}' can`);
-    for (const groupId of policy.grantedToGroupIds) {
-      if (!groupsById.has(groupId)) {
-        throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
-      }
-    }
-    for (const groupId of policy.scopeGroupIds) {
-      if (!groupsById.has(groupId)) {
-        throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' scope references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
-      }
-    }
-    membershipPoliciesById.set(policy.id, policy);
-  }
-  return {
-    groups: [...groupsById.values()],
-    groupsById,
-    roles: [...rolesById.values()],
-    rolesById,
-    membershipPolicies: [...membershipPoliciesById.values()],
-    membershipPoliciesById
-  };
-}
-function assertGrantReferences(roleId, grant, registered) {
-  if (grant.capability === "run" && grant.target === "agent") {
-    const spec = GRANT_KINDS[grantKindOf(grant)];
-    if (!registered.agentAvailable) {
-      throw new SecurityValidationError2(`[Sixb] Role '${roleId}' grants ${grant.capability} on the project Agent, but it is unavailable. ${spec.fix}`);
-    }
-    return;
-  }
-  const spec = GRANT_KINDS[grantKindOf(grant)];
-  const universe = registered[spec.universeKey];
-  if (!universe) {
-    return;
-  }
-  const ids = grant.selection.all ? grant.selection.except : grant.selection.ids;
-  for (const id of ids) {
-    if (!universe.has(id)) {
-      throw new SecurityValidationError2(`[Sixb] Role '${roleId}' grants ${grant.capability} on unknown ${spec.subject} '${id}'. ${spec.fix}`);
-    }
-  }
-}
-
-// src/security/builders.ts
-var MEMBERSHIP_OPERATIONS2 = new Set(["invite", "assignGroups", "suspend"]);
-function assertNonEmptyArray(value, field) {
-  if (value.length === 0) {
-    throw new SecurityValidationError2(`[Sixb] ${field} must not be empty.`);
-  }
-}
-function groupIdsFrom(groups, field) {
-  return groups.map((group) => {
-    if (!isRecord(group) || group.kind !== "group") {
-      throw new SecurityValidationError2(`[Sixb] ${field} must contain only group definitions.`);
-    }
-    assertNonEmptyString(group.id, `${field} group id`);
-    return group.id;
-  });
-}
-function membershipOperationsFrom(operations, field) {
-  return operations.map((operation) => {
-    if (!MEMBERSHIP_OPERATIONS2.has(operation)) {
-      throw new SecurityValidationError2(`[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`);
-    }
-    return operation;
-  });
-}
-function defineGroup2(id, options = {}) {
-  assertNonEmptyString(id, "Group id");
-  assertOptionalString(options.label, `Group '${id}' label`);
-  assertOptionalString(options.description, `Group '${id}' description`);
-  return {
-    kind: "group",
-    id,
-    ...options.label !== undefined ? { label: options.label } : {},
-    ...options.description !== undefined ? { description: options.description } : {}
-  };
-}
-function defineRole2(id, options) {
-  assertNonEmptyString(id, "Role id");
-  assertOptionalString(options.label, `Role '${id}' label`);
-  assertOptionalString(options.description, `Role '${id}' description`);
-  assertNonEmptyArray(options.grantedTo, `Role '${id}' grantedTo`);
-  const grantedToGroupIds = groupIdsFrom(options.grantedTo, `Role '${id}' grantedTo`);
-  for (const grant of options.grants) {
-    assertGrantDefinition(grant, `Role '${id}' grants`);
-  }
-  if (options.grants.length === 0) {
-    throw new SecurityValidationError2(`[Sixb] Role '${id}' grants must not be empty.`);
-  }
-  return {
-    kind: "role",
-    id,
-    ...options.label !== undefined ? { label: options.label } : {},
-    ...options.description !== undefined ? { description: options.description } : {},
-    grantedToGroupIds,
-    grants: options.grants
-  };
-}
-function defineMembershipPolicy2(id, options) {
-  assertNonEmptyString(id, "Membership policy id");
-  assertNonEmptyArray(options.grantedTo, `Membership policy '${id}' grantedTo`);
-  assertNonEmptyArray(options.can, `Membership policy '${id}' can`);
-  return {
-    kind: "membershipPolicy",
-    id,
-    grantedToGroupIds: groupIdsFrom(options.grantedTo, `Membership policy '${id}' grantedTo`),
-    scopeGroupIds: groupIdsFrom(options.scope, `Membership policy '${id}' scope`),
-    can: membershipOperationsFrom(options.can, `Membership policy '${id}' can`)
-  };
-}
 // src/security/every.ts
 var BREADTH_TARGETS = [
   "object",
@@ -638,10 +247,12 @@ function isObjectActionDefinition2(value) {
   return value.binding.kind === "object";
 }
 function normalizeActionParams(runtime, paramsConfig, params, pathPrefix) {
-  return normalizeParams(runtime.ontology.getValueTypesById(), paramsConfig, params, {
+  const normalized = normalizeParams(runtime.ontology.getValueTypesById(), paramsConfig, params, {
     kind: "action",
     id: pathPrefix
   });
+  assertValidFileRefs2(normalized, pathPrefix);
+  return normalized;
 }
 function coerceActionParamsToTyped2(paramsConfig, params, valueTypesById) {
   return coerceParamsToTyped(paramsConfig, params, valueTypesById);
@@ -707,16 +318,16 @@ function defineShare2(id, options) {
   });
 }
 function isShareDefinition(value) {
-  if (!isRecord2(value) || value.kind !== "share" || !isNonEmpty(value.id))
+  if (!isRecord(value) || value.kind !== "share" || !isNonEmpty(value.id))
     return false;
-  if (!isRecord2(value.target) || value.target.kind !== "object" || !isNonEmpty(value.target.objectTypeId)) {
+  if (!isRecord(value.target) || value.target.kind !== "object" || !isNonEmpty(value.target.objectTypeId)) {
     return false;
   }
   return Array.isArray(value.grants);
 }
 function snapshotShareDefinition(value) {
   try {
-    if (!isRecord2(value)) {
+    if (!isRecord(value)) {
       throw invalid("Share definition kind must be 'share'.");
     }
     const kind = value.kind;
@@ -728,7 +339,7 @@ function snapshotShareDefinition(value) {
       throw invalid("Share definition kind must be 'share'.");
     }
     const id = nonEmpty(authoredId, "Share id");
-    if (!isRecord2(target)) {
+    if (!isRecord(target)) {
       throw invalid(`Share '${id}' target must be an object type.`);
     }
     const targetKind = target.kind;
@@ -816,7 +427,7 @@ function snapshotShareGrants(shareId, targetObjectTypeId, authored) {
   let viewCount = 0;
   for (let index = 0;index < authored.length; index += 1) {
     const grant = authored[index];
-    if (!isRecord2(grant)) {
+    if (!isRecord(grant)) {
       throw invalid(`Share '${shareId}' grant ${index} must come from 'can'.`);
     }
     const kind = grant.kind;
@@ -862,7 +473,7 @@ function snapshotShareGrants(shareId, targetObjectTypeId, authored) {
   return Object.freeze(grants);
 }
 function snapshotLinkMode(value) {
-  if (!isRecord2(value))
+  if (!isRecord(value))
     throw invalid("Share link selection must be an object.");
   const kind = value.kind;
   const links = value.links;
@@ -939,9 +550,9 @@ function assertShareTarget(value) {
   }
 }
 function isObjectType(value) {
-  return isRecord2(value) && isNonEmpty(value.id) && Array.isArray(value.properties) && Array.isArray(value.links);
+  return isRecord(value) && isNonEmpty(value.id) && Array.isArray(value.properties) && Array.isArray(value.links);
 }
-function isRecord2(value) {
+function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isNonEmpty(value) {
@@ -1117,12 +728,14 @@ var can2 = {
 };
 // src/security/registry.ts
 class SecurityRegistry {
+  markingsById;
   groupsById;
   rolesById;
   membershipPoliciesById;
   resolvedRoles;
   constructor(input) {
     const definitions = validateSecurityDefinitionsAtStartup({
+      markings: input.markings ?? [],
       groups: input.groups ?? [],
       roles: input.roles ?? [],
       membershipPolicies: input.membershipPolicies ?? [],
@@ -1153,15 +766,23 @@ class SecurityRegistry {
       shareIds: input.shareIds ?? new Set,
       getSubTypes: input.getSubTypes ?? (() => [])
     };
+    this.markingsById = definitions.markingsById;
     this.groupsById = definitions.groupsById;
     this.rolesById = definitions.rolesById;
     this.membershipPoliciesById = definitions.membershipPoliciesById;
     this.resolvedRoles = definitions.roles.map((role) => ({
       id: role.id,
       grantedToGroupIds: role.grantedToGroupIds,
-      grants: resolveRoleGrants2(role, universe)
+      grants: resolveRoleGrants2(role, universe),
+      clearances: new Set(role.clearances ?? [])
     }));
   }
+  listMarkings() {
+    return [...this.markingsById.values()];
+  }
+  getMarkingById(markingId) {
+    return this.markingsById.get(markingId) ?? null;
+  }
   listGroups() {
     return [...this.groupsById.values()];
   }
@@ -3093,6 +2714,7 @@ class AuthRuntime2 {
     return { accessTokens: result.accessTokens };
   }
   async createPersonalAccessToken(caller, input) {
+    assertSessionCaller(caller);
     const storage = this.requireAuthStorage();
     const groupIds = constrainRequestedGroupIds(input.groupIds, caller.groupIds, {
       subject: "personal access token"
@@ -3197,6 +2819,7 @@ class AuthRuntime2 {
     return { serviceAccount, accessTokens: result.accessTokens };
   }
   async createServiceAccountAccessToken(caller, input) {
+    assertSessionCaller(caller);
     const storage = this.requireAuthStorage();
     const { serviceAccount, groupIds: serviceAccountGroupIds } = await this.requireManageableServiceAccount(storage, caller.groupIds, input.serviceAccountId);
     if (serviceAccount.status === "suspended") {
@@ -3625,6 +3248,11 @@ function memberGroups(memberships) {
 function callerSessionId(caller) {
   return caller.credentialSource === "session" ? caller.session.id : undefined;
 }
+function assertSessionCaller(caller) {
+  if (caller.credentialSource !== "session") {
+    throw new AuthRuntimeError2("authorization_denied", "[Sixb] Access tokens can only be created from a signed-in session, not with another access token.");
+  }
+}
 function constrainTokenGroupIds(principalGroupIds, accessToken) {
   if (accessToken.groupIds === undefined) {
     return principalGroupIds;
@@ -3699,6 +3327,6 @@ var SYSTEM_PRINCIPAL2 = { type: "system", id: "system" };
 function principalsEqual2(left, right) {
   return left.type === right.type && left.id === right.id;
 }
-export { ActionDefinitionError2, ActionEditCommitError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped2, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, setRequestClientAddress2, getRequestClientAddress2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, verifyCsrfToken2, applications2, SecurityValidationError2, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup2, defineRole2, defineMembershipPolicy2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, can2, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
+export { ActionDefinitionError2, ActionEditCommitError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped2, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, setRequestClientAddress2, getRequestClientAddress2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, verifyCsrfToken2, applications2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, can2, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
 
-//# debugId=73464FD9FDE5971364756E2164756E21
+//# debugId=E73F1E47F0D1834864756E2164756E21