@sixb/core 0.1.17 → 0.1.18

package/dist/{chunk-6wbm6ymz.js → chunk-fe52eczz.js}

@@ -3,7 +3,10 @@ import {
   isActionDefinition2,
   SYSTEM_PRINCIPAL2,
   principalsEqual2
-} from "./chunk-svabwqdq.js";
+} from "./chunk-6h5m9xjx.js";
+import {
+  captureSixbFailure2
+} from "./chunk-6fsr7y93.js";
 import {
   agentServiceAccountId2,
   assertObjectReadOutputWithinLimit2,
@@ -15,6 +18,7 @@ import {
   isAllowed2,
   assertAuthorized2,
   isRuntimeAllowed2,
+  assertRuntimeAuthorizationBound2,
   assertCanManageConnector2,
   assertPrivileged2,
   assertProviderAccess2,
@@ -25,20 +29,31 @@ import {
   canViewPipelineRun2,
   canViewProjectionRun2,
   canViewProjection2
-} from "./chunk-5be2ath4.js";
+} from "./chunk-qkbx3tf6.js";
 import {
-  captureSixbFailure2
-} from "./chunk-6fsr7y93.js";
+  canonicalMediaType2,
+  isFileRef2,
+  isValidFileRef,
+  supportsDirectUpload2,
+  supportsRangeRead2
+} from "./chunk-jhm3zsa7.js";
 import {
+  assertValidFileRefs2,
   isRecord2,
   normalizeSchemaValue2,
   coerceSchemaValueToTyped2,
   assertObjectTypeRegistered2
-} from "./chunk-rpxz486p.js";
+} from "./chunk-y05543x6.js";
 import {
   isObjectRefSchema2,
   validateSchemaOrRefValue2
-} from "./chunk-rx7h5fdx.js";
+} from "./chunk-rt9p8m9t.js";
+import {
+  WorkflowRunError2,
+  missingClearanceRedactions,
+  resolvePropertyClearance,
+  redactDomainEvent
+} from "./chunk-d0eb5yy6.js";
 import {
   isModelReasoning2,
   modelReasoningSupportIssue2
@@ -54,20 +69,17 @@ import {
   DecisionModelResponseError2,
   estimateModelCall,
   rateModelCall2
-} from "./chunk-s7ftxrdr.js";
+} from "./chunk-29yx306f.js";
 import {
   AgentStorageError2,
   AGENT_REASONING_LEVELS2
-} from "./chunk-69266efg.js";
+} from "./chunk-s54c868q.js";
 import {
   ExecutionStorageError2
 } from "./chunk-tw03bsmb.js";
 import {
   WORKFLOW_RUN_FAILURE_CODES2
-} from "./chunk-5yd8cchh.js";
-import {
-  WorkflowRunError2
-} from "./chunk-t9shqx3w.js";
+} from "./chunk-qq90g05n.js";
 import {
   assertParamUsersActive,
   assertAuthorizedObjectReaderBinding,
@@ -75,7 +87,7 @@ import {
   canDelegationAccessActionRun,
   requestAction3,
   requestActionAndWait2
-} from "./chunk-10styjgk.js";
+} from "./chunk-fx93hd2n.js";
 import {
   shareSixbErrorReporter2,
   reportRunFailure2
@@ -89,47 +101,47 @@ import {
 import {
   AgentRequestError2,
   normalizeAgentContextEntries2
-} from "./chunk-dmn70ztd.js";
+} from "./chunk-pfp1txq2.js";
 import {
   publishAgentRunActivity2
-} from "./chunk-4gmng3vf.js";
+} from "./chunk-22v5bpz3.js";
 import {
   createFileDownloadUrl,
   revokeFileDownloadUrl
-} from "./chunk-4ra628t7.js";
+} from "./chunk-3zxk45er.js";
 import {
   registerConnectorConnectionsRuntime
 } from "./chunk-5a4a52tq.js";
 import {
   createConnectorRuntime
-} from "./chunk-jnfxmr3f.js";
+} from "./chunk-f1zxad2t.js";
 import {
   writeDataset2
-} from "./chunk-91kcnbf0.js";
+} from "./chunk-6gmfggss.js";
 import {
   shareOntologyMutationRuntime2
 } from "./chunk-85cd7e8c.js";
 import {
   SyncValidationError2,
   requestSyncRun2
-} from "./chunk-k4g51s47.js";
+} from "./chunk-yv9czyfr.js";
 import {
   compileShareAccessPlan
-} from "./chunk-vre348sb.js";
+} from "./chunk-za5yd58j.js";
 import {
   PipelineError2,
   requestPipelineRun2
-} from "./chunk-e67ynxcr.js";
+} from "./chunk-v6xpd60t.js";
 import {
   ModelExecutionSession
-} from "./chunk-52c5zb0z.js";
+} from "./chunk-k6hrnf35.js";
 import {
   resolveLanguageModel2
-} from "./chunk-c2rga5cx.js";
+} from "./chunk-mfs23znk.js";
 import {
   AI_MODEL_CALL_OUTPUT_TOKEN_ALLOWANCE,
   aiModelCallOutputTokenAllowance
-} from "./chunk-7ecp4v7a.js";
+} from "./chunk-ny3xyvcn.js";
 import {
   getTelemetryHistoryBatch2,
   getLatestTelemetryPoint,
@@ -141,30 +153,30 @@ import {
   upsertObject3,
   upsertObjectBatch3,
   appendTelemetry
-} from "./chunk-tjjgy3z4.js";
+} from "./chunk-qxvp5epv.js";
 import {
   schemaRecordToJsonSchema2
 } from "./chunk-6x0pqh32.js";
 import {
   getDatasetPrimaryKeyColumns2
-} from "./chunk-rb143ggb.js";
+} from "./chunk-bwjcehza.js";
 import {
   executionRecordInputFromRuntime,
   ensureExecutionRecord2,
   createPrimitiveExecutionRecord
-} from "./chunk-a7er86jd.js";
+} from "./chunk-ex496vct.js";
 import {
   ShareGrantStorageError2
 } from "./chunk-br3k6qbf.js";
 import {
   ObjectNotFoundError2
-} from "./chunk-aq39q04r.js";
+} from "./chunk-y9jmd7e5.js";
 import {
   RuntimeError2
 } from "./chunk-m4ehq95f.js";
 import {
   normalizeParams
-} from "./chunk-5thzcb8g.js";
+} from "./chunk-vx2yp45y.js";
 import {
   OntologyValidationError2
 } from "./chunk-cqr3acm1.js";
@@ -174,11 +186,6 @@ import {
   UnsupportedModelFeatureError2,
   StructuredOutputError2
 } from "./chunk-kyjcwqz6.js";
-import {
-  isFileRef2,
-  supportsDirectUpload2,
-  supportsRangeRead2
-} from "./chunk-h3v76ams.js";
 import {
   isJsonValue2,
   assertJsonValue2,
@@ -188,6 +195,22 @@ import {
   isPlainRecord
 } from "./chunk-wy0qdqfm.js";
 
+// src/models/execution/binding.ts
+var bindings = new WeakMap;
+function registerModelExecutionBinding(models, bind) {
+  bindings.set(models, bind);
+}
+function bindModelExecutionAttempt(models, input) {
+  const bind = bindings.get(models);
+  if (!bind)
+    throw new Error("[SixbModels] Model runtime has no execution binding.");
+  if (!Number.isSafeInteger(input.attempt) || input.attempt < 1) {
+    throw new TypeError("[SixbModels] Execution attempt must be a positive safe integer.");
+  }
+  bind(input);
+  bindings.delete(models);
+}
+
 // src/actions/descriptor.ts
 function snapshotActionDescriptor(action) {
   const params = Object.fromEntries(Object.entries(action.params).map(([id, config]) => [id, structuredClone(config)]));
@@ -354,6 +377,29 @@ function createAgentRunExecutionToken2() {
 // src/agents/request.ts
 import { randomUUID as randomUUID2 } from "crypto";
 
+// src/runtime/locale.ts
+var DEFAULT_PROJECT_LOCALE = "en";
+var DEFAULT_PROJECT_TIME_ZONE = "UTC";
+function canonicalLocale(value) {
+  if (typeof value !== "string")
+    return;
+  try {
+    const [locale] = Intl.getCanonicalLocales(value);
+    return locale;
+  } catch {
+    return;
+  }
+}
+function canonicalTimeZone(value) {
+  if (typeof value !== "string" || value.trim() !== value || value === "")
+    return;
+  try {
+    return new Intl.DateTimeFormat("en-US", { timeZone: value }).resolvedOptions().timeZone;
+  } catch {
+    return;
+  }
+}
+
 // src/agents/context-resolution.ts
 async function resolveAgentContextParts2(runtime, input) {
   const entries = normalizeAgentContextEntries2(input);
@@ -503,7 +549,17 @@ async function requestAgentRun2(runtime, execution, models, input) {
   assertNoAgentSelector(input);
   assertAuthorized2(runtime, { kind: "agent.run" });
   assertRequestAuthorityCanRunAgent(runtime);
-  const spec = resolveConversationRunSpec({ models, input });
+  const trigger = triggerParts(input);
+  const continued = input.continue ? await continuedSelection(runtime, models, input) : {};
+  const spec = await resolveConversationRunSpec({
+    models,
+    input: {
+      ...input,
+      model: input.model ?? continued.model,
+      reasoning: input.reasoning ?? continued.reasoning
+    }
+  });
+  assertAttachments(input.attachments);
   const contextParts = await resolveAgentContextParts2(runtime, input.context);
   const agents = requireAgentStorage(runtime);
   const projectId = runtime.projectId;
@@ -538,7 +594,7 @@ async function requestAgentRun2(runtime, execution, models, input) {
         role: "user",
         parts: [
           ...contextParts,
-          { type: "text", text: input.text },
+          ...trigger,
           ...(input.attachments ?? []).map((fileRef) => ({ type: "file", fileRef }))
         ],
         authorPrincipal: principal
@@ -566,6 +622,9 @@ async function requestAgentRun2(runtime, execution, models, input) {
     createdThread
   };
 }
+function isRetryableAgentRun2(run) {
+  return run.status === "failed" || run.status === "cancelled" && run.finishReason === "interrupted";
+}
 async function retryAgentRun2(runtime, execution, models, failedRun) {
   resolveExecutionScopeAuthorization(runtime.projectId, {
     execution,
@@ -573,8 +632,8 @@ async function retryAgentRun2(runtime, execution, models, failedRun) {
   });
   assertAuthorized2(runtime, { kind: "agent.run" });
   assertRequestAuthorityCanRunAgent(runtime);
-  if (failedRun.status !== "failed") {
-    throw new AgentRequestError2("run_not_retryable", `[Sixb] Only failed Agent runs can be retried.`);
+  if (!isRetryableAgentRun2(failedRun)) {
+    throw new AgentRequestError2("run_not_retryable", `[Sixb] Only failed or interrupted Agent runs can be retried.`);
   }
   const agents = requireAgentStorage(runtime);
   const thread = await agents.threads.getById({
@@ -605,7 +664,7 @@ async function retryAgentRun2(runtime, execution, models, failedRun) {
       executionId: durableExecution.id,
       threadId: failedRun.threadId,
       triggerMessageId: failedRun.triggerMessageId,
-      spec: failedRun.spec ?? resolveConversationRunSpec({
+      spec: failedRun.spec ?? await resolveConversationRunSpec({
         models,
         input: {}
       })
@@ -615,6 +674,48 @@ async function retryAgentRun2(runtime, execution, models, failedRun) {
   const jobId = await dispatchAgentRun(runtime, agents, runId);
   return { run, ...jobId ? { jobId } : {}, createdThread: false };
 }
+async function continuedSelection(runtime, models, input) {
+  const agents = requireAgentStorage(runtime);
+  const threadId = input.threadId ?? "";
+  if (!await agents.threads.getById({ projectId: runtime.projectId, id: threadId })) {
+    throw new AgentRequestError2("thread_not_found", "[Sixb] An Agent continuation needs an existing thread.");
+  }
+  if (input.model !== undefined || input.reasoning !== undefined)
+    return {};
+  const { runs } = await agents.runs.list({
+    projectId: runtime.projectId,
+    threadId,
+    kinds: ["conversation"],
+    order: "desc",
+    limit: 1
+  });
+  const spec = runs[0]?.kind === "conversation" ? runs[0].spec : undefined;
+  if (!spec || !models?.getByRef(spec.model))
+    return {};
+  return {
+    model: spec.model,
+    ...spec.reasoning === undefined ? {} : { reasoning: spec.reasoning }
+  };
+}
+function triggerParts(input) {
+  if (input.continue === true) {
+    if (input.text !== undefined || input.attachments?.length || input.context?.length) {
+      throw new AgentRequestError2("invalid_message", "[Sixb] An Agent continuation carries no text, attachments, or context.");
+    }
+    return [{ type: "continuation" }];
+  }
+  if (typeof input.text !== "string" || input.text.trim().length === 0) {
+    throw new AgentRequestError2("invalid_message", "[Sixb] An Agent message needs text, or `continue: true` to continue the previous answer.");
+  }
+  return [{ type: "text", text: input.text }];
+}
+function assertAttachments(attachments) {
+  for (const [index, attachment] of (attachments ?? []).entries()) {
+    if (!isValidFileRef(attachment)) {
+      throw new AgentRequestError2("invalid_attachment", `[Sixb] Attachment ${index} is not a valid file reference.`);
+    }
+  }
+}
 function assertSandboxExecutionAvailable(thread) {
   if (thread.sandboxState && !["new", "ready"].includes(thread.sandboxState.status)) {
     throw new AgentRequestError2("sandbox_execution_unavailable", "[Sixb] Sandbox recovery is required before another run. Reload the thread and explicitly recreate it to start fresh.");
@@ -641,7 +742,7 @@ async function assertAiLimitPreflight(runtime, execution) {
     throw aiUsageLimitExceededError2(resetAt);
   }
 }
-function resolveConversationRunSpec(input) {
+async function resolveConversationRunSpec(input) {
   if (!input.models) {
     throw new AgentRequestError2("model_not_found", "[Sixb] Configure models.language before starting the Agent.");
   }
@@ -650,15 +751,41 @@ function resolveConversationRunSpec(input) {
   if (model === null) {
     throw new AgentRequestError2("model_not_found", `[Sixb] Language model '${selected.provider}/${selected.modelId}' is not in the project model catalog.`);
   }
-  const reasoning = input.input.reasoning;
-  if (reasoning !== undefined && !isModelReasoning2(reasoning)) {
-    throw new AgentRequestError2("invalid_model_selection", `[Sixb] Agent reasoning must be one of: ${AGENT_REASONING_LEVELS2.join(", ")}, or a nonnegative budgetTokens object.`);
+  const explicitReasoning = input.input.reasoning;
+  if (explicitReasoning !== undefined) {
+    await assertModelSupportsReasoning(model, explicitReasoning);
   }
+  const reasoning = explicitReasoning ?? model.model.defaultReasoning;
+  const timeZone = requestedSetting("timeZone", input.input.timeZone, canonicalTimeZone, "an IANA time zone");
+  const locale = requestedSetting("locale", input.input.locale, canonicalLocale, "a BCP 47 language tag");
   return Object.freeze({
     model: Object.freeze({ provider: selected.provider, modelId: selected.modelId }),
-    ...reasoning === undefined ? {} : { reasoning }
+    ...reasoning === undefined ? {} : { reasoning },
+    ...timeZone === undefined ? {} : { timeZone },
+    ...locale === undefined ? {} : { locale }
   });
 }
+function requestedSetting(field, value, canonical, expected) {
+  if (value === undefined)
+    return;
+  const resolved = canonical(value);
+  if (resolved === undefined) {
+    throw new AgentRequestError2("invalid_locale", `[Sixb] Agent request '${field}' must be ${expected}; received ${JSON.stringify(value)}.`);
+  }
+  return resolved;
+}
+async function assertModelSupportsReasoning(entry, reasoning) {
+  if (!isModelReasoning2(reasoning)) {
+    throw new AgentRequestError2("invalid_model_selection", `[Sixb] Agent reasoning must be one of: ${AGENT_REASONING_LEVELS2.join(", ")}, or a nonnegative budgetTokens object.`);
+  }
+  if (reasoning === "provider-default")
+    return;
+  const model = await resolveLanguageModel2(entry.model);
+  const issue = modelReasoningSupportIssue2(model.definition.capabilities.reasoning, reasoning);
+  if (issue !== undefined) {
+    throw new AgentRequestError2("invalid_model_selection", `[Sixb] Language model '${entry.provider}/${entry.modelId}' cannot use this reasoning: ${issue}.`);
+  }
+}
 async function prepareDurableAgentExecution(runtime, execution, runId) {
   const parent = await ensureExecutionRecord2(runtime.storage.executions, executionRecordInputFromRuntime({
     execution,
@@ -1057,6 +1184,7 @@ function createBlobsRuntime(runtime, execution, blobStorage, apiPublicOrigin) {
   const executionBlobs = {
     put: (input) => {
       assertAccess();
+      assertMediaType("put", input.mediaType);
       return blobStorage.put(input);
     },
     open: (blobId) => {
@@ -1085,6 +1213,7 @@ function createBlobsRuntime(runtime, execution, blobStorage, apiPublicOrigin) {
   if (supportsDirectUpload2(blobStorage)) {
     executionBlobs.createUpload = (input) => {
       assertAccess();
+      assertMediaType("createUpload", input.mediaType);
       return blobStorage.createUpload(input);
     };
     executionBlobs.signUploadPart = (input) => {
@@ -1093,6 +1222,7 @@ function createBlobsRuntime(runtime, execution, blobStorage, apiPublicOrigin) {
     };
     executionBlobs.completeUpload = (input) => {
       assertAccess();
+      assertMediaType("completeUpload", input.mediaType);
       return blobStorage.completeUpload(input);
     };
     executionBlobs.abortUpload = (input) => {
@@ -1102,6 +1232,11 @@ function createBlobsRuntime(runtime, execution, blobStorage, apiPublicOrigin) {
   }
   return Object.freeze(executionBlobs);
 }
+function assertMediaType(method, mediaType) {
+  if (mediaType !== undefined && canonicalMediaType2(mediaType) === null) {
+    throw new Error(`[Sixb] blobs.${method}() mediaType must be one media type, such as "application/pdf". Received ${JSON.stringify(mediaType)}.`);
+  }
+}
 
 // src/connectors/connections/execution.ts
 function createConnectorConnectionsRuntime(runtime, execution, process) {
@@ -1155,6 +1290,33 @@ function createDatasetsRuntime(runtime, execution, source, lakeStorage, blobStor
       const dataset = source.getById(datasetId);
       return dataset && allowed(datasetId) ? dataset : null;
     },
+    async readRows(dataset, input = {}) {
+      assertAuthorized2(runtime, { kind: "dataset.view", datasetId: dataset.id });
+      const registered = source.getById(dataset.id);
+      if (!registered)
+        throw new Error(`[Sixb] Dataset '${dataset.id}' is not registered.`);
+      const version = input.versionId === undefined ? await lakeStorage.getLatestVersion(registered.id) : await lakeStorage.getVersion(registered.id, input.versionId);
+      if (!version)
+        return null;
+      const redacted = redactedColumns(registered, assertRuntimeAuthorizationBound2(runtime));
+      const selected = selectColumns(version, input.columns);
+      const columns = selected.filter((column) => !redacted.has(column));
+      const read = (readColumns) => lakeStorage.readRows({
+        datasetId: registered.id,
+        versionId: version.versionId,
+        columns: readColumns,
+        limit: input.limit,
+        offset: input.offset,
+        signal: input.signal
+      });
+      const rows = columns.length === selected.length ? read(input.columns) : columns.length > 0 ? read(columns) : emptyRows(read(selected.slice(0, 1)));
+      return {
+        version,
+        columns,
+        ...redacted.size > 0 ? { redactions: missingClearanceRedactions(redacted) } : {},
+        rows
+      };
+    },
     async ingest(dataset, input) {
       assertPrivileged2(runtime, "datasets.ingest");
       const registered = source.getById(dataset.id);
@@ -1199,33 +1361,48 @@ function createDatasetsRuntime(runtime, execution, source, lakeStorage, blobStor
     }
   };
 }
+function selectColumns(version, requested) {
+  const available = version.schema.columns.map((column) => column.name);
+  if (requested === undefined || requested.length === 0)
+    return available;
+  for (const column of requested) {
+    if (!available.includes(column)) {
+      throw new Error(`[Sixb] Dataset '${version.datasetId}' does not have column '${column}' at version '${version.versionId}'.`);
+    }
+  }
+  return [...requested];
+}
+function redactedColumns(dataset, authority) {
+  if (authority.type === "unrestricted")
+    return new Set;
+  const clearances = authority.type === "principal" ? authority.context.clearances ?? new Set : new Set;
+  return new Set(dataset.schema.columns.filter((column) => column.markings?.some((markingId) => !clearances.has(markingId))).map((column) => column.name));
+}
+async function* emptyRows(rows) {
+  for await (const _row of rows)
+    yield {};
+}
 
 // src/events/execution.ts
 function createEventsRuntime(runtime) {
   const authority = resolveRuntimeAuthorizationForProject(runtime);
-  const visibleEvents = (events) => {
+  const clearance = authority.type === "principal" ? resolvePropertyClearance(runtime.ontology, authority.context.clearances ?? new Set) : undefined;
+  const readable = (event) => {
     switch (authority.type) {
       case "denied":
       case "delegated":
-        return [];
+        return;
       case "principal":
-        return events.filter((event) => canViewEvent2(authority.context, event));
+        if (!canViewEvent2(authority.context, event))
+          return;
+        return clearance ? redactDomainEvent(event, clearance) : event;
       case "unrestricted":
-        return [...events];
+        return event;
     }
   };
+  const visibleEvents = (events) => events.flatMap((event) => readable(event) ?? []);
   return {
-    canRead: (event) => {
-      switch (authority.type) {
-        case "denied":
-        case "delegated":
-          return false;
-        case "principal":
-          return canViewEvent2(authority.context, event);
-        case "unrestricted":
-          return true;
-      }
-    },
+    readable,
     append: (input) => {
       assertPrivileged2(runtime, "events.append");
       return runtime.events.append(input);
@@ -2347,22 +2524,6 @@ async function recordDecision(accounting, model, callId, metadata) {
   return event;
 }
 
-// src/models/execution/binding.ts
-var bindings = new WeakMap;
-function registerModelExecutionBinding(models, bind) {
-  bindings.set(models, bind);
-}
-function bindModelExecutionAttempt(models, input) {
-  const bind = bindings.get(models);
-  if (!bind)
-    throw new Error("[SixbModels] Model runtime has no execution binding.");
-  if (!Number.isSafeInteger(input.attempt) || input.attempt < 1) {
-    throw new TypeError("[SixbModels] Execution attempt must be a positive safe integer.");
-  }
-  bind(input);
-  bindings.delete(models);
-}
-
 // src/models/output.ts
 function languageModelOutput(shape, valueTypesById) {
   if (!isRecord2(shape))
@@ -2412,11 +2573,12 @@ function createModelsRuntime(runtime, execution, catalog, blobs) {
     const reasoningIssue = modelReasoningSupportIssue2(model.definition.capabilities.reasoning, input.reasoning);
     if (reasoningIssue)
       throw new UnsupportedModelFeatureError2(`[SixbModels] ${reasoningIssue}.`);
+    const reasoning = input.reasoning ?? selected.defaultReasoning;
     if (output && model.definition.capabilities.nativeStructuredOutput === false) {
       throw new UnsupportedModelFeatureError2("[SixbModels] Model does not support native structured output.");
     }
     const maxOutputTokens = Math.min(aiModelCallOutputTokenAllowance(input.maxOutputTokens ?? model.definition.maxOutputTokens), model.definition.maxOutputTokens ?? Infinity);
-    if (typeof input.reasoning === "object" && input.reasoning.budgetTokens >= maxOutputTokens) {
+    if (typeof reasoning === "object" && reasoning.budgetTokens >= maxOutputTokens) {
       throw new TypeError("[SixbModels] Output allowance must exceed the reasoning token budget.");
     }
     const accounting = await session.accounting();
@@ -2429,7 +2591,7 @@ function createModelsRuntime(runtime, execution, catalog, blobs) {
       maxSteps: 1,
       rejectLocalToolCalls: true,
       maxOutputTokens,
-      reasoning: input.reasoning,
+      reasoning,
       caching: input.caching,
       signal,
       onModelCallEnd: async (completed) => {
@@ -2491,7 +2653,7 @@ function generationMessages(input) {
 }
 
 // src/objects/execution.ts
-function createObjectsRuntime(runtime, execution) {
+function createObjectsRuntime(runtime, execution, blobStorage) {
   const runtimeAuthorization = runtime.runtimeAuthorization;
   const objectReader = runtime.objectReader;
   assertAuthorizedObjectReaderBinding({
@@ -2521,7 +2683,8 @@ function createObjectsRuntime(runtime, execution) {
     return createObjectSet2({
       ...capturedRuntime,
       execution,
-      objectType
+      objectType,
+      blobStorage
     });
   }, {
     listTypes: () => ontologyView().listObjectTypes(),
@@ -3158,7 +3321,7 @@ function isStepDefinition2(value) {
   return isRecord(value) && value.kind === "step" && typeof value.id === "string" && isRecord(value.input) && isRecord(value.output) && typeof value.handler === "function";
 }
 function isAgentStepDefinition2(value) {
-  return isRecord(value) && value.kind === "agentStep" && typeof value.id === "string" && (value.model === undefined || isLanguageModel(value.model)) && (value.reasoning === undefined || isModelReasoning2(value.reasoning)) && typeof value.instructions === "string" && isStringArray(value.groupIds) && isStringArray(value.toolNames) && isRecord(value.input) && isRecord(value.output) && typeof value.prompt === "function";
+  return isRecord(value) && value.kind === "agentStep" && typeof value.id === "string" && (value.model === undefined || isLanguageModel(value.model)) && (value.reasoning === undefined || isModelReasoning2(value.reasoning)) && typeof value.instructions === "string" && isStringArray(value.groupIds) && isStringArray(value.toolNames) && isStringArray(value.skillNames) && isRecord(value.input) && isRecord(value.output) && typeof value.prompt === "function";
 }
 function isInterventionDefinition2(value) {
   return isRecord(value) && value.kind === "intervention" && typeof value.id === "string" && isRecord(value.input) && isRecord(value.response) && (value.defaults === undefined || typeof value.defaults === "function");
@@ -3228,11 +3391,23 @@ function validateWorkflowAgentStepRuntimeReferences(workflowId, step, options) {
       throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent step "${step.id}" uses unknown language model "${ref.provider}/${ref.modelId}". Add it to 'models.language' in createSixb().`);
     }
   }
+  const model = step.model ?? options.models?.language?.default?.model;
+  if (step.reasoning !== undefined && model !== undefined) {
+    const issue = modelReasoningSupportIssue2(model.definition.capabilities.reasoning, step.reasoning);
+    if (issue !== undefined) {
+      throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent step "${step.id}" cannot use its reasoning with language model "${model.providerId}/${model.modelId}": ${issue}.`);
+    }
+  }
   for (const toolName of step.toolNames) {
     if (options.tools.getByName(toolName) === null) {
       throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent step "${step.id}" uses unknown project tool "${toolName}". Add it to 'tools' in createSixb().`);
     }
   }
+  for (const skillName of step.skillNames) {
+    if (options.skills.getByName(skillName) === null) {
+      throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent step "${step.id}" uses unknown Agent Skill "${skillName}". Add it as 'skills/${skillName}/SKILL.md'.`);
+    }
+  }
 }
 function validateWorkflowInput2(params) {
   return validateWorkflowContractRecord({
@@ -3348,6 +3523,7 @@ function validateAgentNodeDefinition(workflowId, node) {
   }
   assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "group", node.agentStep.groupIds);
   assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "tool", node.agentStep.toolNames);
+  assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "skill", node.agentStep.skillNames);
   if (node.mapper !== undefined && typeof node.mapper !== "function") {
     throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent node "${node.id}" mapper must be a function.`);
   }
@@ -4013,6 +4189,7 @@ async function requestWorkflowRun2(runtime, execution, workflow, options = {}) {
     authorization: runtime.runtimeAuthorization
   });
   assertAuthorized2(runtime, { kind: "workflow.run", workflowId: workflow.id });
+  assertValidFileRefs2(options.input, `Workflow "${workflow.id}" input`);
   return dispatchWorkflowRun({
     errorReporterHost: runtime,
     projectId: runtime.projectId,
@@ -4265,7 +4442,7 @@ function isBoundSixb(value) {
 }
 function createExecutionFacades(runtime, execution, dependencies) {
   return {
-    objects: createObjectsRuntime(runtime, execution),
+    objects: createObjectsRuntime(runtime, execution, dependencies.blobStorage),
     actions: createActionsRuntime(runtime, execution),
     datasets: createDatasetsRuntime(runtime, execution, dependencies.definitions.datasets, dependencies.lakeStorage, dependencies.blobStorage),
     workflows: createWorkflowsRuntime(runtime, execution, dependencies.definitions.workflows),
@@ -4329,6 +4506,17 @@ function bindDurableAgentExecution2(host, input) {
   }
   return sixb;
 }
+function bindAgentModelExecution2(sixb, input) {
+  const { accounting } = input;
+  if (accounting.executionId !== sixb.execution.id) {
+    throw new Error(`[Sixb] Agent execution '${sixb.execution.id}' cannot account its model calls to execution '${accounting.executionId}'.`);
+  }
+  bindModelExecutionAttempt(sixb.models, {
+    attempt: accounting.attempt,
+    signal: input.signal,
+    accounting
+  });
+}
 function restoreAgentExecutionScope2(input) {
   assertAgentExecutionRecord2(input);
   const context = Object.freeze({
@@ -4394,6 +4582,6 @@ function invalidAgentExecution(executionId, runId) {
   throw new ExecutionStorageError2("invalid_input", `[Sixb] Execution '${executionId}' does not authorize Agent run '${runId}'.`);
 }
 
-export { resolveAgentContextParts2, agentRunQueueJobId2, subagentRunQueueJobId2, workflowAgentNodeQueueJobId2, dispatchQueuedAgentRuns2, dispatchQueuedSubagentRuns2, createAgentThreadId2, createAgentThreadSandboxName2, createAgentRunId2, createSubagentRunId2, createSubagentExecutionId2, createAgentMessageId2, agentContextCheckpointId2, createAgentRunExecutionToken2, runModelLoop2, assertNoAgentDefinitions, bindModelExecutionAttempt, ShareError2, WorkflowDefinitionError2, WorkflowValidationError2, assertNonEmpty, isStepDefinition2, isAgentStepDefinition2, isInterventionDefinition2, isWorkflowDefinition2, validateWorkflowDefinition2, validateWorkflowsAtStartup2, validateWorkflowAgentStepGroupReferences2, validateWorkflowInput2, validateWorkflowStepInput2, validateWorkflowStepOutput2, validateWorkflowInterventionInput2, validateWorkflowInterventionResponse2, validateWorkflowInterventionDefaultResponse2, validateWorkflowAgentStepInput2, validateWorkflowAgentStepOutput2, snapshotWorkflowAgentStepInput2, snapshotWorkflowAgentStepOutput2, snapshotWorkflowInput2, snapshotWorkflowStepInput2, snapshotWorkflowStepOutput2, snapshotWorkflowInterventionInput2, snapshotWorkflowInterventionResponse2, snapshotWorkflowInterventionDefaultResponse2, snapshotWorkflowActionInput2, WorkflowRunDispatcher2, requestWorkflowRun2, createBoundSixb, isBoundSixb, canInheritAgentRequestAuthorization2, createAgentExecutionRecord2, createInheritedAgentExecutionRecord2, bindDurableAgentExecution2, restoreAgentExecutionScope2, assertAgentExecutionRecord2, requestAgentRun2, retryAgentRun2 };
+export { resolveAgentContextParts2, agentRunQueueJobId2, subagentRunQueueJobId2, workflowAgentNodeQueueJobId2, dispatchQueuedAgentRuns2, dispatchQueuedSubagentRuns2, createAgentThreadId2, createAgentThreadSandboxName2, createAgentRunId2, createSubagentRunId2, createSubagentExecutionId2, createAgentMessageId2, agentContextCheckpointId2, createAgentRunExecutionToken2, runModelLoop2, bindModelExecutionAttempt, assertNoAgentDefinitions, ShareError2, WorkflowDefinitionError2, WorkflowValidationError2, assertNonEmpty, isStepDefinition2, isAgentStepDefinition2, isInterventionDefinition2, isWorkflowDefinition2, validateWorkflowDefinition2, validateWorkflowsAtStartup2, validateWorkflowAgentStepGroupReferences2, validateWorkflowInput2, validateWorkflowStepInput2, validateWorkflowStepOutput2, validateWorkflowInterventionInput2, validateWorkflowInterventionResponse2, validateWorkflowInterventionDefaultResponse2, validateWorkflowAgentStepInput2, validateWorkflowAgentStepOutput2, snapshotWorkflowAgentStepInput2, snapshotWorkflowAgentStepOutput2, snapshotWorkflowInput2, snapshotWorkflowStepInput2, snapshotWorkflowStepOutput2, snapshotWorkflowInterventionInput2, snapshotWorkflowInterventionResponse2, snapshotWorkflowInterventionDefaultResponse2, snapshotWorkflowActionInput2, WorkflowRunDispatcher2, requestWorkflowRun2, createBoundSixb, isBoundSixb, canInheritAgentRequestAuthorization2, createAgentExecutionRecord2, createInheritedAgentExecutionRecord2, bindDurableAgentExecution2, bindAgentModelExecution2, restoreAgentExecutionScope2, assertAgentExecutionRecord2, DEFAULT_PROJECT_LOCALE, DEFAULT_PROJECT_TIME_ZONE, canonicalLocale, canonicalTimeZone, requestAgentRun2, isRetryableAgentRun2, retryAgentRun2 };
 
-//# debugId=BFCFBA45C8ABE88264756E2164756E21
+//# debugId=E150F65F48DA7B0364756E2164756E21