@sixb/core 0.1.17 → 0.1.18

package/dist/{chunk-sk0hcjsz.js → chunk-qkvz64nd.js}

@@ -5,10 +5,10 @@ import {
 } from "./chunk-e1c18xjx.js";
 import {
   isDatasetDefinition2
-} from "./chunk-cd234ba4.js";
+} from "./chunk-rz53yb4v.js";
 import {
   PipelineError2
-} from "./chunk-e67ynxcr.js";
+} from "./chunk-v6xpd60t.js";
 
 // src/lake-storage/sql-transforms.ts
 var SQL_DIALECT = {

package/dist/{chunk-w9yycd3t.js → chunk-qmnnhde6.js}

@@ -3,7 +3,7 @@ import {
   createPrincipalRuntimeAuthorization,
   createDisabledRuntimeAuthorization,
   createDelegatedRuntimeAuthorization
-} from "./chunk-5be2ath4.js";
+} from "./chunk-qkbx3tf6.js";
 
 // src/execution/scopes.ts
 import { randomUUID } from "crypto";
@@ -60,12 +60,8 @@ function createTestingScope(input) {
   });
 }
 function withoutSession(context) {
-  return {
-    principal: context.principal,
-    groupIds: context.groupIds,
-    roleIds: context.roleIds,
-    grants: context.grants
-  };
+  const { sessionId: _sessionId, ...withoutSessionId } = context;
+  return withoutSessionId;
 }
 function createRequestExecution(input) {
   assertNonEmpty(input.projectId, "Execution project id");
@@ -103,4 +99,4 @@ function assertNonEmpty(value, label) {
 
 export { createPrincipalRequestScope, createDisabledRequestScope, createDelegatedRequestScope, createTestingScope };
 
-//# debugId=D67EDA8B3AA3264264756E2164756E21
+//# debugId=1E19649F1CE57F6964756E2164756E21

package/dist/{chunk-w9yycd3t.js.map → chunk-qmnnhde6.js.map}

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../src/execution/scopes.ts"],
   "sourcesContent": [
-    "import { randomUUID } from \"node:crypto\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport type { ObjectReadExecutionLimits, SelectedObjectReadScope } from \"../storage\"\nimport {\n  createDelegatedRuntimeAuthorization,\n  createDisabledRuntimeAuthorization,\n  createKernelRuntimeAuthorization,\n  createPrincipalRuntimeAuthorization,\n  type DelegatedActionApplyTarget,\n} from \"./authorization\"\nimport type {\n  AuthorizablePrincipal,\n  AuthorizationRef,\n  ExecutionContext,\n  ExecutionScope,\n  ExecutionSource,\n  KernelOperation,\n} from \"./types\"\n\nexport function createPrincipalRequestScope(input: {\n  readonly projectId: string\n  readonly requestId: string\n  readonly correlationId: string\n  readonly context: AuthorizationContext\n  readonly credential?: Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n}): ExecutionScope {\n  const execution = createRequestExecution({\n    projectId: input.projectId,\n    requestId: input.requestId,\n    correlationId: input.correlationId,\n    requestedBy: asAuthorizablePrincipal(input.context.principal),\n  })\n\n  return Object.freeze({\n    execution,\n    authorization: createPrincipalRuntimeAuthorization({\n      execution,\n      context: input.context,\n      ...(input.credential === undefined ? {} : { credential: input.credential }),\n    }),\n  })\n}\n\nexport function createDisabledRequestScope(input: {\n  readonly projectId: string\n  readonly requestId: string\n  readonly correlationId: string\n}): ExecutionScope {\n  const execution = createRequestExecution(input)\n  return Object.freeze({\n    execution,\n    authorization: createDisabledRuntimeAuthorization(execution),\n  })\n}\n\n/** Internal request scope carrying only a finite object-read selection. */\nexport function createDelegatedRequestScope(input: {\n  readonly projectId: string\n  readonly requestId: string\n  readonly correlationId: string\n  readonly objectRead: {\n    readonly selection: SelectedObjectReadScope\n    readonly limits: ObjectReadExecutionLimits\n  }\n  readonly actionApply?: readonly DelegatedActionApplyTarget[]\n  readonly delegation?: Extract<AuthorizationRef, { readonly type: \"delegated\" }>[\"delegation\"]\n}): ExecutionScope {\n  const execution = createRequestExecution(input)\n  const actionApply = input.actionApply\n  const delegation = input.delegation\n  return Object.freeze({\n    execution,\n    authorization: createDelegatedRuntimeAuthorization({\n      execution,\n      objectRead: input.objectRead,\n      ...(actionApply === undefined ? {} : { actionApply }),\n      ...(delegation === undefined ? {} : { delegation }),\n    }),\n  })\n}\n\nexport function createKernelScope(input: {\n  readonly projectId: string\n  readonly operation: KernelOperation\n  readonly source: ExecutionSource\n  readonly correlationId?: string\n}): ExecutionScope {\n  const operation = Object.freeze({ ...input.operation })\n  const execution = createKernelExecution({\n    projectId: input.projectId,\n    operation,\n    source: input.source,\n    correlationId: input.correlationId,\n  })\n  return Object.freeze({\n    execution,\n    authorization: createKernelRuntimeAuthorization({ execution, operation }),\n  })\n}\n\nfunction createKernelExecution(input: {\n  readonly projectId: string\n  readonly operation: KernelOperation\n  readonly source: ExecutionSource\n  readonly correlationId?: string\n}): ExecutionContext {\n  const source = snapshotExecutionSource(input.source)\n  assertNestedProvenance(source, input.correlationId)\n  return freezeExecution({\n    id: `exec_${randomUUID()}`,\n    projectId: input.projectId,\n    executor: Object.freeze({ type: \"kernel\", operation: input.operation }),\n    source,\n    correlationId: input.correlationId ?? `corr_${randomUUID()}`,\n  })\n}\n\nfunction assertNestedProvenance(source: ExecutionSource, correlationId: string | undefined): void {\n  if (source.type === \"execution\" && correlationId === undefined) {\n    throw new Error(\"[Sixb] Nested execution must preserve its parent correlation id.\")\n  }\n}\n\nexport function createTestingScope(input: {\n  readonly projectId: string\n  readonly context?: AuthorizationContext\n  readonly executionId?: string\n  readonly requestId?: string\n  readonly correlationId?: string\n}): ExecutionScope {\n  const context = input.context ? withoutSession(input.context) : undefined\n  const requestId = input.requestId ?? `test_request_${randomUUID()}`\n  const execution = createRequestExecution({\n    projectId: input.projectId,\n    requestId,\n    correlationId: input.correlationId ?? `test_correlation_${randomUUID()}`,\n    ...(context === undefined ? {} : { requestedBy: asAuthorizablePrincipal(context.principal) }),\n    executionId: input.executionId,\n  })\n  return Object.freeze({\n    execution,\n    authorization: context\n      ? createPrincipalRuntimeAuthorization({ execution, context })\n      : createDisabledRuntimeAuthorization(execution),\n  })\n}\n\nfunction withoutSession(context: AuthorizationContext): AuthorizationContext {\n  return {\n    principal: context.principal,\n    groupIds: context.groupIds,\n    roleIds: context.roleIds,\n    grants: context.grants,\n  }\n}\n\nfunction createRequestExecution(input: {\n  readonly projectId: string\n  readonly requestId: string\n  readonly correlationId: string\n  readonly requestedBy?: AuthorizablePrincipal\n  readonly executionId?: string\n}): ExecutionContext {\n  assertNonEmpty(input.projectId, \"Execution project id\")\n  assertNonEmpty(input.requestId, \"Execution request id\")\n  assertNonEmpty(input.correlationId, \"Execution correlation id\")\n  const id = input.executionId ?? `exec_${randomUUID()}`\n  assertNonEmpty(id, \"Execution id\")\n  return freezeExecution({\n    id,\n    projectId: input.projectId,\n    ...(input.requestedBy === undefined ? {} : { requestedBy: input.requestedBy }),\n    executor: Object.freeze({ type: \"request\", requestId: input.requestId }),\n    source: Object.freeze({ type: \"http\", requestId: input.requestId }),\n    correlationId: input.correlationId,\n  })\n}\n\nfunction freezeExecution(execution: ExecutionContext): ExecutionContext {\n  assertNonEmpty(execution.id, \"Execution id\")\n  assertNonEmpty(execution.projectId, \"Execution project id\")\n  assertNonEmpty(execution.correlationId, \"Execution correlation id\")\n  return Object.freeze(execution)\n}\n\nfunction snapshotExecutionSource(source: ExecutionSource): ExecutionSource {\n  const field = sourceIdentifier(source)\n  assertNonEmpty(field.value, field.label)\n  if (source.type === \"datasetVersion\") {\n    assertNonEmpty(source.datasetId, \"Execution source dataset id\")\n  }\n  return Object.freeze({ ...source })\n}\n\nfunction sourceIdentifier(source: ExecutionSource): {\n  readonly label: string\n  readonly value: string\n} {\n  switch (source.type) {\n    case \"ontologyCommit\":\n      return { label: \"Execution source commit id\", value: source.commitId }\n    case \"http\":\n      return { label: \"Execution source request id\", value: source.requestId }\n    case \"webhook\":\n      return { label: \"Execution source delivery id\", value: source.deliveryId }\n    case \"schedule\":\n    case \"event\":\n      return { label: \"Execution source event id\", value: source.eventId }\n    case \"datasetVersion\":\n      return { label: \"Execution source dataset version id\", value: source.versionId }\n    case \"execution\":\n      return { label: \"Execution source execution id\", value: source.executionId }\n  }\n}\n\nfunction asAuthorizablePrincipal(\n  principal: AuthorizationContext[\"principal\"]\n): AuthorizablePrincipal {\n  if (principal.type !== \"user\" && principal.type !== \"serviceAccount\") {\n    throw new Error(`[Sixb] Principal type '${principal.type}' cannot hold runtime authorization.`)\n  }\n  assertNonEmpty(principal.id, \"Execution principal id\")\n  return Object.freeze({ type: principal.type, id: principal.id })\n}\n\nfunction assertNonEmpty(value: string, label: string): void {\n  if (!value.trim()) {\n    throw new Error(`[Sixb] ${label} must not be empty.`)\n  }\n}\n"
+    "import { randomUUID } from \"node:crypto\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport type { ObjectReadExecutionLimits, SelectedObjectReadScope } from \"../storage\"\nimport {\n  createDelegatedRuntimeAuthorization,\n  createDisabledRuntimeAuthorization,\n  createKernelRuntimeAuthorization,\n  createPrincipalRuntimeAuthorization,\n  type DelegatedActionApplyTarget,\n} from \"./authorization\"\nimport type {\n  AuthorizablePrincipal,\n  AuthorizationRef,\n  ExecutionContext,\n  ExecutionScope,\n  ExecutionSource,\n  KernelOperation,\n} from \"./types\"\n\nexport function createPrincipalRequestScope(input: {\n  readonly projectId: string\n  readonly requestId: string\n  readonly correlationId: string\n  readonly context: AuthorizationContext\n  readonly credential?: Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n}): ExecutionScope {\n  const execution = createRequestExecution({\n    projectId: input.projectId,\n    requestId: input.requestId,\n    correlationId: input.correlationId,\n    requestedBy: asAuthorizablePrincipal(input.context.principal),\n  })\n\n  return Object.freeze({\n    execution,\n    authorization: createPrincipalRuntimeAuthorization({\n      execution,\n      context: input.context,\n      ...(input.credential === undefined ? {} : { credential: input.credential }),\n    }),\n  })\n}\n\nexport function createDisabledRequestScope(input: {\n  readonly projectId: string\n  readonly requestId: string\n  readonly correlationId: string\n}): ExecutionScope {\n  const execution = createRequestExecution(input)\n  return Object.freeze({\n    execution,\n    authorization: createDisabledRuntimeAuthorization(execution),\n  })\n}\n\n/** Internal request scope carrying only a finite object-read selection. */\nexport function createDelegatedRequestScope(input: {\n  readonly projectId: string\n  readonly requestId: string\n  readonly correlationId: string\n  readonly objectRead: {\n    readonly selection: SelectedObjectReadScope\n    readonly limits: ObjectReadExecutionLimits\n  }\n  readonly actionApply?: readonly DelegatedActionApplyTarget[]\n  readonly delegation?: Extract<AuthorizationRef, { readonly type: \"delegated\" }>[\"delegation\"]\n}): ExecutionScope {\n  const execution = createRequestExecution(input)\n  const actionApply = input.actionApply\n  const delegation = input.delegation\n  return Object.freeze({\n    execution,\n    authorization: createDelegatedRuntimeAuthorization({\n      execution,\n      objectRead: input.objectRead,\n      ...(actionApply === undefined ? {} : { actionApply }),\n      ...(delegation === undefined ? {} : { delegation }),\n    }),\n  })\n}\n\nexport function createKernelScope(input: {\n  readonly projectId: string\n  readonly operation: KernelOperation\n  readonly source: ExecutionSource\n  readonly correlationId?: string\n}): ExecutionScope {\n  const operation = Object.freeze({ ...input.operation })\n  const execution = createKernelExecution({\n    projectId: input.projectId,\n    operation,\n    source: input.source,\n    correlationId: input.correlationId,\n  })\n  return Object.freeze({\n    execution,\n    authorization: createKernelRuntimeAuthorization({ execution, operation }),\n  })\n}\n\nfunction createKernelExecution(input: {\n  readonly projectId: string\n  readonly operation: KernelOperation\n  readonly source: ExecutionSource\n  readonly correlationId?: string\n}): ExecutionContext {\n  const source = snapshotExecutionSource(input.source)\n  assertNestedProvenance(source, input.correlationId)\n  return freezeExecution({\n    id: `exec_${randomUUID()}`,\n    projectId: input.projectId,\n    executor: Object.freeze({ type: \"kernel\", operation: input.operation }),\n    source,\n    correlationId: input.correlationId ?? `corr_${randomUUID()}`,\n  })\n}\n\nfunction assertNestedProvenance(source: ExecutionSource, correlationId: string | undefined): void {\n  if (source.type === \"execution\" && correlationId === undefined) {\n    throw new Error(\"[Sixb] Nested execution must preserve its parent correlation id.\")\n  }\n}\n\nexport function createTestingScope(input: {\n  readonly projectId: string\n  readonly context?: AuthorizationContext\n  readonly executionId?: string\n  readonly requestId?: string\n  readonly correlationId?: string\n}): ExecutionScope {\n  const context = input.context ? withoutSession(input.context) : undefined\n  const requestId = input.requestId ?? `test_request_${randomUUID()}`\n  const execution = createRequestExecution({\n    projectId: input.projectId,\n    requestId,\n    correlationId: input.correlationId ?? `test_correlation_${randomUUID()}`,\n    ...(context === undefined ? {} : { requestedBy: asAuthorizablePrincipal(context.principal) }),\n    executionId: input.executionId,\n  })\n  return Object.freeze({\n    execution,\n    authorization: context\n      ? createPrincipalRuntimeAuthorization({ execution, context })\n      : createDisabledRuntimeAuthorization(execution),\n  })\n}\n\nfunction withoutSession(context: AuthorizationContext): AuthorizationContext {\n  const { sessionId: _sessionId, ...withoutSessionId } = context\n  return withoutSessionId\n}\n\nfunction createRequestExecution(input: {\n  readonly projectId: string\n  readonly requestId: string\n  readonly correlationId: string\n  readonly requestedBy?: AuthorizablePrincipal\n  readonly executionId?: string\n}): ExecutionContext {\n  assertNonEmpty(input.projectId, \"Execution project id\")\n  assertNonEmpty(input.requestId, \"Execution request id\")\n  assertNonEmpty(input.correlationId, \"Execution correlation id\")\n  const id = input.executionId ?? `exec_${randomUUID()}`\n  assertNonEmpty(id, \"Execution id\")\n  return freezeExecution({\n    id,\n    projectId: input.projectId,\n    ...(input.requestedBy === undefined ? {} : { requestedBy: input.requestedBy }),\n    executor: Object.freeze({ type: \"request\", requestId: input.requestId }),\n    source: Object.freeze({ type: \"http\", requestId: input.requestId }),\n    correlationId: input.correlationId,\n  })\n}\n\nfunction freezeExecution(execution: ExecutionContext): ExecutionContext {\n  assertNonEmpty(execution.id, \"Execution id\")\n  assertNonEmpty(execution.projectId, \"Execution project id\")\n  assertNonEmpty(execution.correlationId, \"Execution correlation id\")\n  return Object.freeze(execution)\n}\n\nfunction snapshotExecutionSource(source: ExecutionSource): ExecutionSource {\n  const field = sourceIdentifier(source)\n  assertNonEmpty(field.value, field.label)\n  if (source.type === \"datasetVersion\") {\n    assertNonEmpty(source.datasetId, \"Execution source dataset id\")\n  }\n  return Object.freeze({ ...source })\n}\n\nfunction sourceIdentifier(source: ExecutionSource): {\n  readonly label: string\n  readonly value: string\n} {\n  switch (source.type) {\n    case \"ontologyCommit\":\n      return { label: \"Execution source commit id\", value: source.commitId }\n    case \"http\":\n      return { label: \"Execution source request id\", value: source.requestId }\n    case \"webhook\":\n      return { label: \"Execution source delivery id\", value: source.deliveryId }\n    case \"schedule\":\n    case \"event\":\n      return { label: \"Execution source event id\", value: source.eventId }\n    case \"datasetVersion\":\n      return { label: \"Execution source dataset version id\", value: source.versionId }\n    case \"execution\":\n      return { label: \"Execution source execution id\", value: source.executionId }\n  }\n}\n\nfunction asAuthorizablePrincipal(\n  principal: AuthorizationContext[\"principal\"]\n): AuthorizablePrincipal {\n  if (principal.type !== \"user\" && principal.type !== \"serviceAccount\") {\n    throw new Error(`[Sixb] Principal type '${principal.type}' cannot hold runtime authorization.`)\n  }\n  assertNonEmpty(principal.id, \"Execution principal id\")\n  return Object.freeze({ type: principal.type, id: principal.id })\n}\n\nfunction assertNonEmpty(value: string, label: string): void {\n  if (!value.trim()) {\n    throw new Error(`[Sixb] ${label} must not be empty.`)\n  }\n}\n"
   ],
-  "mappings": ";;;;;;;;AAAA;AAmBO,SAAS,2BAA2B,CAAC,OAMzB;AAAA,EACjB,MAAM,YAAY,uBAAuB;AAAA,IACvC,WAAW,MAAM;AAAA,IACjB,WAAW,MAAM;AAAA,IACjB,eAAe,MAAM;AAAA,IACrB,aAAa,wBAAwB,MAAM,QAAQ,SAAS;AAAA,EAC9D,CAAC;AAAA,EAED,OAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,eAAe,oCAAoC;AAAA,MACjD;AAAA,MACA,SAAS,MAAM;AAAA,SACX,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,IAC3E,CAAC;AAAA,EACH,CAAC;AAAA;AAGI,SAAS,0BAA0B,CAAC,OAIxB;AAAA,EACjB,MAAM,YAAY,uBAAuB,KAAK;AAAA,EAC9C,OAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,eAAe,mCAAmC,SAAS;AAAA,EAC7D,CAAC;AAAA;AAII,SAAS,2BAA2B,CAAC,OAUzB;AAAA,EACjB,MAAM,YAAY,uBAAuB,KAAK;AAAA,EAC9C,MAAM,cAAc,MAAM;AAAA,EAC1B,MAAM,aAAa,MAAM;AAAA,EACzB,OAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,eAAe,oCAAoC;AAAA,MACjD;AAAA,MACA,YAAY,MAAM;AAAA,SACd,gBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY;AAAA,SAC/C,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AAAA,IACnD,CAAC;AAAA,EACH,CAAC;AAAA;AA6CI,SAAS,kBAAkB,CAAC,OAMhB;AAAA,EACjB,MAAM,UAAU,MAAM,UAAU,eAAe,MAAM,OAAO,IAAI;AAAA,EAChE,MAAM,YAAY,MAAM,aAAa,gBAAgB,WAAW;AAAA,EAChE,MAAM,YAAY,uBAAuB;AAAA,IACvC,WAAW,MAAM;AAAA,IACjB;AAAA,IACA,eAAe,MAAM,iBAAiB,oBAAoB,WAAW;AAAA,OACjE,YAAY,YAAY,CAAC,IAAI,EAAE,aAAa,wBAAwB,QAAQ,SAAS,EAAE;AAAA,IAC3F,aAAa,MAAM;AAAA,EACrB,CAAC;AAAA,EACD,OAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,eAAe,UACX,oCAAoC,EAAE,WAAW,QAAQ,CAAC,IAC1D,mCAAmC,SAAS;AAAA,EAClD,CAAC;AAAA;AAGH,SAAS,cAAc,CAAC,SAAqD;AAAA,EAC3E,OAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,UAAU,QAAQ;AAAA,IAClB,SAAS,QAAQ;AAAA,IACjB,QAAQ,QAAQ;AAAA,EAClB;AAAA;AAGF,SAAS,sBAAsB,CAAC,OAMX;AAAA,EACnB,eAAe,MAAM,WAAW,sBAAsB;AAAA,EACtD,eAAe,MAAM,WAAW,sBAAsB;AAAA,EACtD,eAAe,MAAM,eAAe,0BAA0B;AAAA,EAC9D,MAAM,KAAK,MAAM,eAAe,QAAQ,WAAW;AAAA,EACnD,eAAe,IAAI,cAAc;AAAA,EACjC,OAAO,gBAAgB;AAAA,IACrB;AAAA,IACA,WAAW,MAAM;AAAA,OACb,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,IAC5E,UAAU,OAAO,OAAO,EAAE,MAAM,WAAW,WAAW,MAAM,UAAU,CAAC;AAAA,IACvE,QAAQ,OAAO,OAAO,EAAE,MAAM,QAAQ,WAAW,MAAM,UAAU,CAAC;AAAA,IAClE,eAAe,MAAM;AAAA,EACvB,CAAC;AAAA;AAGH,SAAS,eAAe,CAAC,WAA+C;AAAA,EACtE,eAAe,UAAU,IAAI,cAAc;AAAA,EAC3C,eAAe,UAAU,WAAW,sBAAsB;AAAA,EAC1D,eAAe,UAAU,eAAe,0BAA0B;AAAA,EAClE,OAAO,OAAO,OAAO,SAAS;AAAA;AAiChC,SAAS,uBAAuB,CAC9B,WACuB;AAAA,EACvB,IAAI,UAAU,SAAS,UAAU,UAAU,SAAS,kBAAkB;AAAA,IACpE,MAAM,IAAI,MAAM,0BAA0B,UAAU,0CAA0C;AAAA,EAChG;AAAA,EACA,eAAe,UAAU,IAAI,wBAAwB;AAAA,EACrD,OAAO,OAAO,OAAO,EAAE,MAAM,UAAU,MAAM,IAAI,UAAU,GAAG,CAAC;AAAA;AAGjE,SAAS,cAAc,CAAC,OAAe,OAAqB;AAAA,EAC1D,IAAI,CAAC,MAAM,KAAK,GAAG;AAAA,IACjB,MAAM,IAAI,MAAM,UAAU,0BAA0B;AAAA,EACtD;AAAA;",
-  "debugId": "D67EDA8B3AA3264264756E2164756E21",
+  "mappings": ";;;;;;;;AAAA;AAmBO,SAAS,2BAA2B,CAAC,OAMzB;AAAA,EACjB,MAAM,YAAY,uBAAuB;AAAA,IACvC,WAAW,MAAM;AAAA,IACjB,WAAW,MAAM;AAAA,IACjB,eAAe,MAAM;AAAA,IACrB,aAAa,wBAAwB,MAAM,QAAQ,SAAS;AAAA,EAC9D,CAAC;AAAA,EAED,OAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,eAAe,oCAAoC;AAAA,MACjD;AAAA,MACA,SAAS,MAAM;AAAA,SACX,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,IAC3E,CAAC;AAAA,EACH,CAAC;AAAA;AAGI,SAAS,0BAA0B,CAAC,OAIxB;AAAA,EACjB,MAAM,YAAY,uBAAuB,KAAK;AAAA,EAC9C,OAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,eAAe,mCAAmC,SAAS;AAAA,EAC7D,CAAC;AAAA;AAII,SAAS,2BAA2B,CAAC,OAUzB;AAAA,EACjB,MAAM,YAAY,uBAAuB,KAAK;AAAA,EAC9C,MAAM,cAAc,MAAM;AAAA,EAC1B,MAAM,aAAa,MAAM;AAAA,EACzB,OAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,eAAe,oCAAoC;AAAA,MACjD;AAAA,MACA,YAAY,MAAM;AAAA,SACd,gBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY;AAAA,SAC/C,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AAAA,IACnD,CAAC;AAAA,EACH,CAAC;AAAA;AA6CI,SAAS,kBAAkB,CAAC,OAMhB;AAAA,EACjB,MAAM,UAAU,MAAM,UAAU,eAAe,MAAM,OAAO,IAAI;AAAA,EAChE,MAAM,YAAY,MAAM,aAAa,gBAAgB,WAAW;AAAA,EAChE,MAAM,YAAY,uBAAuB;AAAA,IACvC,WAAW,MAAM;AAAA,IACjB;AAAA,IACA,eAAe,MAAM,iBAAiB,oBAAoB,WAAW;AAAA,OACjE,YAAY,YAAY,CAAC,IAAI,EAAE,aAAa,wBAAwB,QAAQ,SAAS,EAAE;AAAA,IAC3F,aAAa,MAAM;AAAA,EACrB,CAAC;AAAA,EACD,OAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,eAAe,UACX,oCAAoC,EAAE,WAAW,QAAQ,CAAC,IAC1D,mCAAmC,SAAS;AAAA,EAClD,CAAC;AAAA;AAGH,SAAS,cAAc,CAAC,SAAqD;AAAA,EAC3E,QAAQ,WAAW,eAAe,qBAAqB;AAAA,EACvD,OAAO;AAAA;AAGT,SAAS,sBAAsB,CAAC,OAMX;AAAA,EACnB,eAAe,MAAM,WAAW,sBAAsB;AAAA,EACtD,eAAe,MAAM,WAAW,sBAAsB;AAAA,EACtD,eAAe,MAAM,eAAe,0BAA0B;AAAA,EAC9D,MAAM,KAAK,MAAM,eAAe,QAAQ,WAAW;AAAA,EACnD,eAAe,IAAI,cAAc;AAAA,EACjC,OAAO,gBAAgB;AAAA,IACrB;AAAA,IACA,WAAW,MAAM;AAAA,OACb,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,IAC5E,UAAU,OAAO,OAAO,EAAE,MAAM,WAAW,WAAW,MAAM,UAAU,CAAC;AAAA,IACvE,QAAQ,OAAO,OAAO,EAAE,MAAM,QAAQ,WAAW,MAAM,UAAU,CAAC;AAAA,IAClE,eAAe,MAAM;AAAA,EACvB,CAAC;AAAA;AAGH,SAAS,eAAe,CAAC,WAA+C;AAAA,EACtE,eAAe,UAAU,IAAI,cAAc;AAAA,EAC3C,eAAe,UAAU,WAAW,sBAAsB;AAAA,EAC1D,eAAe,UAAU,eAAe,0BAA0B;AAAA,EAClE,OAAO,OAAO,OAAO,SAAS;AAAA;AAiChC,SAAS,uBAAuB,CAC9B,WACuB;AAAA,EACvB,IAAI,UAAU,SAAS,UAAU,UAAU,SAAS,kBAAkB;AAAA,IACpE,MAAM,IAAI,MAAM,0BAA0B,UAAU,0CAA0C;AAAA,EAChG;AAAA,EACA,eAAe,UAAU,IAAI,wBAAwB;AAAA,EACrD,OAAO,OAAO,OAAO,EAAE,MAAM,UAAU,MAAM,IAAI,UAAU,GAAG,CAAC;AAAA;AAGjE,SAAS,cAAc,CAAC,OAAe,OAAqB;AAAA,EAC1D,IAAI,CAAC,MAAM,KAAK,GAAG;AAAA,IACjB,MAAM,IAAI,MAAM,UAAU,0BAA0B;AAAA,EACtD;AAAA;",
+  "debugId": "1E19649F1CE57F6964756E2164756E21",
   "names": []
 }

package/dist/{chunk-5yd8cchh.js → chunk-qq90g05n.js}

@@ -15,13 +15,13 @@ import {
   paginate,
   InMemoryAuthStorage2,
   principalsEqual2
-} from "./chunk-svabwqdq.js";
+} from "./chunk-6h5m9xjx.js";
 import {
   ObjectReadLimitExceededError2,
   snapshotObjectReadExecutionLimits2,
   assertObjectReadFacetCount2,
   assertObjectReadOutputWithinLimit2
-} from "./chunk-5be2ath4.js";
+} from "./chunk-qkbx3tf6.js";
 import {
   assertObjectReaderProject2
 } from "./chunk-v4jbb3rs.js";
@@ -29,7 +29,7 @@ import {
   queryScalarKindForSchema,
   resolvePropertyQueryCapabilities2,
   resolveQuerySchema
-} from "./chunk-rpxz486p.js";
+} from "./chunk-y05543x6.js";
 import {
   AgentStorageError2,
   transitionAgentThreadSandbox2,
@@ -44,7 +44,7 @@ import {
   assertAgentContextCheckpointAnchors2,
   assertAgentContextCheckpointReplayState2,
   agentContextCheckpointMatchesCreateInput2
-} from "./chunk-69266efg.js";
+} from "./chunk-s54c868q.js";
 import {
   InMemoryAiUsageStorage2,
   buildAiAccountingOverview,
@@ -86,7 +86,7 @@ import {
 } from "./chunk-h89wz928.js";
 import {
   DurableFileUploadSessions2
-} from "./chunk-33saed7g.js";
+} from "./chunk-zxawp1n2.js";
 import {
   ExecutionStorageError2,
   prepareExecutionRecord2,
@@ -203,7 +203,7 @@ import {
   WorkflowRunError2,
   assertWorkflowRunExecution2,
   assertWorkflowAgentNodeRunExecution2
-} from "./chunk-t9shqx3w.js";
+} from "./chunk-d0eb5yy6.js";
 import {
   ShareGrantStorageError2,
   normalizeShareGrantCreate2,
@@ -237,7 +237,7 @@ import {
   canRequeueSyncRunAfterEnqueueFailure2,
   createTransactionStorageProxy2,
   throwNestedStorageTransaction2
-} from "./chunk-aq39q04r.js";
+} from "./chunk-y9jmd7e5.js";
 import {
   assertPinnedDatasetWatermark2
 } from "./chunk-6aawea28.js";
@@ -247,7 +247,7 @@ import {
 } from "./chunk-96yw3pwd.js";
 import {
   AGENT_RUN_FAILURE_CODES2
-} from "./chunk-98cw09sw.js";
+} from "./chunk-hkc3jct7.js";
 import {
   compareDecimalValues2
 } from "./chunk-3bh94gbw.js";

package/dist/{chunk-5yd8cchh.js.map → chunk-qq90g05n.js.map}

@@ -3,7 +3,7 @@
   "sources": ["../src/storage/action-runs/in-memory.ts", "../src/agents/message.ts", "../src/storage/agents/in-memory.ts", "../src/storage/ai-cost/errors.ts", "../src/storage/ai-cost/in-memory.ts", "../src/storage/ai-limits/in-memory.ts", "../src/storage/connector-connections/in-memory.ts", "../src/storage/file-upload-sessions/in-memory.ts", "../src/storage/in-memory/index.ts", "../src/storage/executions/in-memory.ts", "../src/storage/file-download-grants/in-memory.ts", "../src/objects/vectors/query.ts", "../src/storage/objects/keys.ts", "../src/storage/objects/in-memory/keys.ts", "../src/objects/query/scalar-values.ts", "../src/objects/vectors/profile.ts", "../src/storage/objects/in-memory/query.ts", "../src/storage/objects/in-memory/read-scope.ts", "../src/storage/objects/in-memory/selected-reader.ts", "../src/storage/objects/in-memory/storage.ts", "../src/storage/ontology/in-memory/shared-state.ts", "../src/storage/ontology/in-memory/commits.ts", "../src/storage/timeseries/store.ts", "../src/storage/ontology/in-memory/materializations-state.ts", "../src/storage/ontology/in-memory/materializations-work.ts", "../src/storage/ontology/in-memory/materializations-finalization.ts", "../src/storage/ontology/in-memory/source-roots.ts", "../src/storage/ontology/in-memory/replacement-plans.ts", "../src/storage/ontology/in-memory/vectors.ts", "../src/storage/ontology/in-memory/materializations.ts", "../src/storage/ontology/in-memory/outbox.ts", "../src/storage/ontology/in-memory/sources.ts", "../src/storage/ontology/in-memory/state-reader.ts", "../src/storage/ontology/in-memory/testing.ts", "../src/storage/ontology/in-memory/vector-indexing.ts", "../src/storage/ontology/in-memory/index.ts", "../src/storage/run-listing.ts", "../src/storage/pipeline-runs/types.ts", "../src/storage/pipeline-runs/in-memory.ts", "../src/storage/projection-runs/in-memory.ts", "../src/storage/rules/in-memory.ts", "../src/storage/share-grants/in-memory.ts", "../src/storage/share-sessions/in-memory.ts", "../src/storage/sync-runs/types.ts", "../src/storage/sync-runs/in-memory.ts", "../src/storage/webhook-runs/types.ts", "../src/storage/webhook-runs/in-memory.ts", "../src/storage/workflow-interventions/errors.ts", "../src/storage/workflow-interventions/in-memory.ts", "../src/storage/workflow-runs/types.ts", "../src/storage/workflow-runs/in-memory.ts", "../src/storage/in-memory/testing.ts", "../src/storage/objects/query-preparation.ts", "../src/storage/migrations/migrate-storage.ts", "../src/storage/migrations/check-schema.ts", "../src/storage/migrations/migration-set.ts", "../src/storage/ontology/vector-indexing.ts"],
   "sourcesContent": [
     "import type { ExecutionStorage } from \"../executions\"\nimport { ActionRunError } from \"./errors\"\nimport { parseActionRunFailure } from \"./failure\"\nimport {\n  actionRunPhaseRecordsEqual,\n  actionSubjectsEqual,\n  canRequeueActionRunAfterEnqueueFailure,\n  isTerminalActionRun,\n} from \"./idempotency\"\nimport { assertActionRunExecution } from \"./provider\"\nimport type {\n  ActionRunEffectsRecord,\n  ActionRunFailure,\n  ActionRunParams,\n  ActionRunPhase,\n  ActionRunRecord,\n  ActionRunStorage,\n  ActionRunWritebackRecord,\n  EnterActionRunPhaseInput,\n  FinishActionRunInput,\n  ListActionRunsInput,\n  ListActionRunsResult,\n  LockActionMaterializationRunInput,\n  QueueActionRunInput,\n  RecordActionEffectsInput,\n  RecordActionWritebackInput,\n  StartActionRunInput,\n} from \"./types\"\n\ntype RunRootOperation = <T>(run: () => Promise<T> | T) => Promise<T>\n\nconst runDirectly: RunRootOperation = async <T>(run: () => Promise<T> | T): Promise<T> => run()\n\nfunction actionRunKey(projectId: string, id: string): string {\n  return JSON.stringify([projectId, id])\n}\n\nfunction assertNonBlank(value: string, fieldName: string): void {\n  if (typeof value !== \"string\" || value.trim().length === 0) {\n    throw new ActionRunError(`[Sixb] Action materialization ${fieldName} must be nonblank.`)\n  }\n}\n\nfunction cloneActionRunRecord(record: ActionRunRecord): ActionRunRecord {\n  return structuredClone(record)\n}\n\nfunction normalizeParams(params: ActionRunParams): ActionRunParams {\n  return structuredClone(params)\n}\n\nfunction normalizeSubject(subject: QueueActionRunInput[\"subject\"]): QueueActionRunInput[\"subject\"] {\n  return structuredClone(subject)\n}\n\nfunction normalizeError<TPhase extends ActionRunPhase>(\n  error: ActionRunFailure<TPhase>,\n  expectedPhase?: TPhase\n): ActionRunFailure<TPhase> {\n  return expectedPhase === undefined\n    ? (parseActionRunFailure(error) as ActionRunFailure<TPhase>)\n    : parseActionRunFailure(error, expectedPhase)\n}\n\nfunction normalizeWriteback(\n  input: RecordActionWritebackInput,\n  completedAt: Date\n): ActionRunWritebackRecord {\n  if (input.status === \"succeeded\") {\n    return {\n      status: \"succeeded\",\n      completedAt,\n      result: structuredClone(input.result),\n    }\n  }\n\n  return {\n    status: \"failed\",\n    completedAt,\n    error: normalizeError(input.error, \"writeback\"),\n  }\n}\n\nfunction normalizeEffects(\n  input: RecordActionEffectsInput,\n  completedAt: Date\n): ActionRunEffectsRecord {\n  if (input.status === \"succeeded\") {\n    return {\n      status: \"succeeded\",\n      completedAt,\n    }\n  }\n\n  return {\n    status: \"failed\",\n    completedAt,\n    error: normalizeError(input.error, \"effects\"),\n  }\n}\n\nfunction compareRuns(a: ActionRunRecord, b: ActionRunRecord, order: \"asc\" | \"desc\"): number {\n  const leftAt = a.startedAt ?? a.queuedAt\n  const rightAt = b.startedAt ?? b.queuedAt\n  const delta = leftAt.getTime() - rightAt.getTime()\n  if (delta !== 0) {\n    return order === \"asc\" ? delta : -delta\n  }\n\n  if (a.id === b.id) {\n    return 0\n  }\n\n  return order === \"asc\" ? a.id.localeCompare(b.id) : b.id.localeCompare(a.id)\n}\n\nexport class InMemoryActionRunStorage implements ActionRunStorage {\n  private readonly rows = new Map<string, ActionRunRecord>()\n  private readonly runRootOperation: RunRootOperation\n\n  constructor(\n    private readonly executions: ExecutionStorage,\n    input: { readonly runRootOperation?: RunRootOperation } = {}\n  ) {\n    this.runRootOperation = input.runRootOperation ?? runDirectly\n  }\n\n  snapshot(): InMemoryActionRunStorageSnapshot {\n    return structuredClone(this.rows)\n  }\n\n  restore(snapshot: InMemoryActionRunStorageSnapshot): void {\n    this.rows.clear()\n    for (const [key, record] of structuredClone(snapshot)) {\n      this.rows.set(key, record)\n    }\n  }\n\n  async lockForMaterialization(input: LockActionMaterializationRunInput): Promise<ActionRunRecord> {\n    return this.runRootOperation(() => cloneActionRunRecord(this.requireMaterializationRun(input)))\n  }\n\n  async queue(input: QueueActionRunInput): Promise<ActionRunRecord> {\n    return this.runRootOperation(async () => {\n      const key = actionRunKey(input.projectId, input.id)\n      const existing = this.rows.get(key)\n      if (existing && !canRequeueActionRunAfterEnqueueFailure(existing, input)) {\n        throw new ActionRunError(\n          `[Sixb] Action run '${input.id}' already exists for project '${input.projectId}'.`\n        )\n      }\n      if (\n        [...this.rows.values()].some(\n          (run) =>\n            run.projectId === input.projectId &&\n            run.id !== input.id &&\n            run.executionId === input.executionId\n        )\n      ) {\n        throw new ActionRunError(\n          `[Sixb] Execution '${input.executionId}' already belongs to another Action run.`\n        )\n      }\n      await assertActionRunExecution({\n        executions: this.executions,\n        projectId: input.projectId,\n        executionId: input.executionId,\n        runId: input.id,\n        actionId: input.actionId,\n      })\n\n      const record: ActionRunRecord = {\n        id: input.id,\n        projectId: input.projectId,\n        executionId: input.executionId,\n        actionId: input.actionId,\n        subject: normalizeSubject(input.subject),\n        status: \"queued\",\n        phase: \"request\",\n        queuedAt: new Date(input.queuedAt ?? new Date()),\n        params: normalizeParams(input.params),\n        idempotencyKey: input.idempotencyKey,\n      }\n\n      if (existing) {\n        const next: ActionRunRecord = {\n          ...existing,\n          status: \"queued\",\n          phase: \"request\",\n          queuedAt: record.queuedAt,\n          startedAt: undefined,\n          finishedAt: undefined,\n          error: undefined,\n          writeback: undefined,\n          effects: undefined,\n        }\n        this.rows.set(key, structuredClone(next))\n        return cloneActionRunRecord(next)\n      }\n\n      this.rows.set(key, structuredClone(record))\n      return cloneActionRunRecord(record)\n    })\n  }\n\n  async start(input: StartActionRunInput): Promise<ActionRunRecord> {\n    return this.runRootOperation(() => {\n      const key = actionRunKey(input.projectId, input.id)\n      const existing = this.rows.get(key)\n\n      if (!existing) {\n        throw new ActionRunError(\n          `[Sixb] Action run '${input.id}' not found for project '${input.projectId}'.`\n        )\n      }\n\n      if (existing.status !== \"queued\") {\n        throw new ActionRunError(\n          `[Sixb] Action run '${input.id}' cannot start from status '${existing.status}'.`\n        )\n      }\n\n      const next: ActionRunRecord = {\n        ...existing,\n        status: \"running\",\n        phase: input.phase ?? \"validation\",\n        startedAt: new Date(input.startedAt ?? new Date()),\n        error: undefined,\n      }\n\n      this.rows.set(key, structuredClone(next))\n      return cloneActionRunRecord(next)\n    })\n  }\n\n  async enterPhase(input: EnterActionRunPhaseInput): Promise<ActionRunRecord> {\n    return this.runRootOperation(() => {\n      const key = actionRunKey(input.projectId, input.id)\n      const existing = this.requireRunningRun(key, input.projectId, input.id, \"enter phase\")\n      const next: ActionRunRecord = {\n        ...existing,\n        phase: input.phase,\n      }\n\n      this.rows.set(key, structuredClone(next))\n      return cloneActionRunRecord(next)\n    })\n  }\n\n  async recordWriteback(input: RecordActionWritebackInput): Promise<ActionRunRecord> {\n    return this.runRootOperation(() => {\n      const key = actionRunKey(input.projectId, input.id)\n      const existing = this.requireRunningRun(key, input.projectId, input.id, \"record writeback\")\n      const writeback = normalizeWriteback(input, new Date(input.completedAt ?? new Date()))\n\n      if (existing.writeback) {\n        if (actionRunPhaseRecordsEqual(existing.writeback, writeback)) {\n          return cloneActionRunRecord(existing)\n        }\n\n        throw new ActionRunError(\n          `[Sixb] Action run '${input.id}' already has a different writeback record.`\n        )\n      }\n\n      const next: ActionRunRecord = {\n        ...existing,\n        phase: \"writeback\",\n        writeback,\n      }\n\n      this.rows.set(key, structuredClone(next))\n      return cloneActionRunRecord(next)\n    })\n  }\n\n  async recordEffects(input: RecordActionEffectsInput): Promise<ActionRunRecord> {\n    return this.runRootOperation(() => {\n      const key = actionRunKey(input.projectId, input.id)\n      const existing = this.requireRunningRun(key, input.projectId, input.id, \"record effects\")\n      const effects = normalizeEffects(input, new Date(input.completedAt ?? new Date()))\n\n      if (existing.effects) {\n        if (actionRunPhaseRecordsEqual(existing.effects, effects)) {\n          return cloneActionRunRecord(existing)\n        }\n\n        throw new ActionRunError(\n          `[Sixb] Action run '${input.id}' already has a different effects record.`\n        )\n      }\n\n      const next: ActionRunRecord = {\n        ...existing,\n        phase: \"effects\",\n        effects,\n      }\n\n      this.rows.set(key, structuredClone(next))\n      return cloneActionRunRecord(next)\n    })\n  }\n\n  async finish(input: FinishActionRunInput): Promise<ActionRunRecord> {\n    return this.runRootOperation(() => {\n      const key = actionRunKey(input.projectId, input.id)\n      const existing = this.rows.get(key)\n\n      if (!existing) {\n        throw new ActionRunError(\n          `[Sixb] Action run '${input.id}' not found for project '${input.projectId}'.`\n        )\n      }\n\n      if (isTerminalActionRun(existing)) {\n        throw new ActionRunError(\n          `[Sixb] Action run '${input.id}' cannot finish from terminal status '${existing.status}'.`\n        )\n      }\n\n      const phase =\n        input.status === \"succeeded\" ? (input.phase ?? existing.phase) : input.error.details.phase\n\n      const base: ActionRunRecord = {\n        ...existing,\n        status: input.status,\n        phase,\n        finishedAt: new Date(input.finishedAt ?? new Date()),\n      }\n\n      const next: ActionRunRecord =\n        input.status === \"succeeded\"\n          ? {\n              ...base,\n              error: undefined,\n            }\n          : {\n              ...base,\n              error: normalizeError(input.error),\n            }\n\n      this.rows.set(key, structuredClone(next))\n      return cloneActionRunRecord(next)\n    })\n  }\n\n  private requireRunningRun(\n    key: string,\n    projectId: string,\n    id: string,\n    operation: string\n  ): ActionRunRecord {\n    const existing = this.rows.get(key)\n\n    if (!existing) {\n      throw new ActionRunError(`[Sixb] Action run '${id}' not found for project '${projectId}'.`)\n    }\n\n    if (existing.status !== \"running\") {\n      throw new ActionRunError(\n        `[Sixb] Action run '${id}' cannot ${operation} from status '${existing.status}'.`\n      )\n    }\n\n    return existing\n  }\n\n  async getById(params: { projectId: string; id: string }): Promise<ActionRunRecord | null> {\n    return this.runRootOperation(() => {\n      const record = this.rows.get(actionRunKey(params.projectId, params.id))\n      return record ? cloneActionRunRecord(record) : null\n    })\n  }\n\n  async list(input: ListActionRunsInput): Promise<ListActionRunsResult> {\n    return this.runRootOperation(() => {\n      if (input.actionIds?.length === 0) {\n        return { runs: [], hasMore: false, total: 0 }\n      }\n\n      const order = input.order ?? \"desc\"\n      const offset = input.offset ?? 0\n      const limit = input.limit ?? this.rows.size\n      const actionIds = input.actionIds ? new Set(input.actionIds) : null\n      const objectTypeIds = input.objectTypeIds ? new Set(input.objectTypeIds) : null\n      const statuses = input.statuses ? new Set(input.statuses) : null\n\n      const filtered = [...this.rows.values()]\n        .filter((record) => record.projectId === input.projectId)\n        .filter((record) => (input.actionId ? record.actionId === input.actionId : true))\n        .filter((record) => (actionIds ? actionIds.has(record.actionId) : true))\n        .filter((record) =>\n          objectTypeIds\n            ? record.subject.kind !== \"object\" || objectTypeIds.has(record.subject.objectTypeId)\n            : true\n        )\n        .filter((record) =>\n          input.subject ? actionSubjectsEqual(record.subject, input.subject) : true\n        )\n        .filter((record) =>\n          input.objectTypeId\n            ? record.subject.kind === \"object\" && record.subject.objectTypeId === input.objectTypeId\n            : true\n        )\n        .filter((record) =>\n          input.primaryId\n            ? record.subject.kind === \"object\" && record.subject.primaryId === input.primaryId\n            : true\n        )\n        .filter((record) => (statuses ? statuses.has(record.status) : true))\n        .filter((record) =>\n          input.startedAfter ? (record.startedAt ?? record.queuedAt) >= input.startedAfter : true\n        )\n        .filter((record) =>\n          input.startedBefore ? (record.startedAt ?? record.queuedAt) <= input.startedBefore : true\n        )\n        .sort((a, b) => compareRuns(a, b, order))\n\n      const total = filtered.length\n      const runs = filtered.slice(offset, offset + limit).map(cloneActionRunRecord)\n      return { runs, hasMore: offset + runs.length < total, total }\n    })\n  }\n\n  private requireMaterializationRun(input: LockActionMaterializationRunInput): ActionRunRecord {\n    assertNonBlank(input.projectId, \"projectId\")\n    assertNonBlank(input.runId, \"runId\")\n    assertNonBlank(input.actionId, \"actionId\")\n\n    const existing = this.rows.get(actionRunKey(input.projectId, input.runId))\n    if (!existing) {\n      throw new ActionRunError(\n        `[Sixb] Action run '${input.runId}' not found for project '${input.projectId}'.`\n      )\n    }\n    if (existing.actionId !== input.actionId) {\n      throw new ActionRunError(\n        `[Sixb] Action run '${input.runId}' does not belong to action '${input.actionId}'.`\n      )\n    }\n    if (existing.status !== \"running\") {\n      throw new ActionRunError(\n        `[Sixb] Action run '${input.runId}' cannot materialize from status '${existing.status}'.`\n      )\n    }\n    return existing\n  }\n}\n\nexport type InMemoryActionRunStorageSnapshot = Map<string, ActionRunRecord>\n",
-    "import type { FileRef } from \"../blob-storage\"\nimport type { JsonValue } from \"../json\"\nimport type { ProviderData } from \"../models\"\nimport type { AgentContextPart } from \"./context/entries\"\n\n/**\n * The agent's own, SDK-independent message. We store messages and threads — not an SDK transport —\n * so a message is just a `role` plus structured `parts` (and optional `metadata`). There is no\n * self-describing wrapper: the storage row owns the message's identity, and `contentVersion` (a\n * column) versions the parts shape so it can be migrated.\n *\n * The part union is intentionally focused on what agent runs actually produce (text, reasoning, step\n * boundaries, tool calls). The model loop validates and normalizes output before its steps are\n * projected into this union; storage validates the durable write contract independently.\n */\nexport const AGENT_MESSAGE_CONTENT_VERSION = 2 as const\n\nexport type AgentMessageRole = \"system\" | \"user\" | \"assistant\"\n\n/** A plain text part (assistant output, user input, or system text). */\nexport interface AgentTextPart {\n  readonly type: \"text\"\n  readonly text: string\n  /** Provider passthrough (kept because some providers require it on the next turn). */\n  readonly providerMetadata?: ProviderData\n}\n\n/**\n * A reasoning (\"thinking\") part. `providerMetadata` is load-bearing here: some providers require\n * the reasoning signature back on the following turn, so dropping it would break multi-step loops.\n */\nexport interface AgentReasoningPart {\n  readonly type: \"reasoning\"\n  readonly text: string\n  readonly providerMetadata?: ProviderData\n}\n\n/** A step boundary between assistant loop iterations. */\nexport interface AgentStepStartPart {\n  readonly type: \"step-start\"\n}\n\n/** A blob-backed file attached to a user message or produced by an agent/tool. */\nexport interface AgentFilePart {\n  readonly type: \"file\"\n  readonly fileRef: FileRef\n  /** Provider passthrough for future model-specific file handling. */\n  readonly providerMetadata?: ProviderData\n}\n\ninterface AgentToolCallBase {\n  readonly type: \"tool-call\"\n  readonly toolCallId: string\n  readonly toolName: string\n  /** `true` when the model identifies the call as a dynamic tool. */\n  readonly dynamic?: boolean\n  /** `true` when the provider executed the tool inline (steers model projection). */\n  readonly providerExecuted?: boolean\n  readonly input: JsonValue\n  readonly providerMetadata?: ProviderData\n}\n\n/** Ordered, hidden provider state required to replay a model response losslessly. */\nexport interface AgentProviderStatePart {\n  readonly type: \"provider-state\"\n  readonly providerId: string\n  readonly data: JsonValue\n}\n\n/**\n * A completed tool call. Only terminal states are modelled — transient states\n * (`input-streaming`, `input-available`, `approval-*`) are never persisted because messages are\n * written only once a run finishes.\n */\nexport type AgentToolCallPart = AgentToolCallBase &\n  (\n    | { readonly state: \"output-available\"; readonly output: JsonValue }\n    | { readonly state: \"output-error\"; readonly errorText: string }\n  )\n\nexport type AgentMessagePart =\n  | AgentTextPart\n  | AgentReasoningPart\n  | AgentStepStartPart\n  | AgentFilePart\n  | AgentContextPart\n  | AgentToolCallPart\n  | AgentProviderStatePart\n\nexport type AgentMessagePartType = AgentMessagePart[\"type\"]\nexport type AgentToolCallState = AgentToolCallPart[\"state\"]\n\n/** The logical agent message the adapters speak and the store persists (as columns). */\nexport interface AgentMessage {\n  readonly role: AgentMessageRole\n  readonly parts: readonly AgentMessagePart[]\n  /** Optional JSON metadata associated with the message. */\n  readonly metadata?: JsonValue\n}\n",
+    "import type { FileRef } from \"../blob-storage\"\nimport type { JsonValue } from \"../json\"\nimport type { ProviderData } from \"../models\"\nimport type { AgentContextPart } from \"./context/entries\"\n\n/**\n * The agent's own, SDK-independent message. We store messages and threads — not an SDK transport —\n * so a message is just a `role` plus structured `parts` (and optional `metadata`). There is no\n * self-describing wrapper: the storage row owns the message's identity, and `contentVersion` (a\n * column) versions the parts shape so it can be migrated.\n *\n * The part union is intentionally focused on what agent runs actually produce (text, reasoning, step\n * boundaries, tool calls). The model loop validates and normalizes output before its steps are\n * projected into this union; storage validates the durable write contract independently.\n */\nexport const AGENT_MESSAGE_CONTENT_VERSION = 2 as const\n\nexport type AgentMessageRole = \"system\" | \"user\" | \"assistant\"\n\n/** A plain text part (assistant output, user input, or system text). */\nexport interface AgentTextPart {\n  readonly type: \"text\"\n  readonly text: string\n  /** Provider passthrough (kept because some providers require it on the next turn). */\n  readonly providerMetadata?: ProviderData\n}\n\n/**\n * A reasoning (\"thinking\") part. `providerMetadata` is load-bearing here: some providers require\n * the reasoning signature back on the following turn, so dropping it would break multi-step loops.\n */\nexport interface AgentReasoningPart {\n  readonly type: \"reasoning\"\n  readonly text: string\n  readonly providerMetadata?: ProviderData\n}\n\n/** A step boundary between assistant loop iterations. */\nexport interface AgentStepStartPart {\n  readonly type: \"step-start\"\n}\n\n/** A blob-backed file attached to a user message or produced by an agent/tool. */\nexport interface AgentFilePart {\n  readonly type: \"file\"\n  readonly fileRef: FileRef\n  /** Provider passthrough for future model-specific file handling. */\n  readonly providerMetadata?: ProviderData\n}\n\ninterface AgentToolCallBase {\n  readonly type: \"tool-call\"\n  readonly toolCallId: string\n  readonly toolName: string\n  /** `true` when the model identifies the call as a dynamic tool. */\n  readonly dynamic?: boolean\n  /** `true` when the provider executed the tool inline (steers model projection). */\n  readonly providerExecuted?: boolean\n  readonly input: JsonValue\n  readonly providerMetadata?: ProviderData\n}\n\n/**\n * The user asked the Agent to continue an answer the turn limit cut short. Sixb writes the\n * instruction the model reads; chats show no message for it.\n */\nexport interface AgentContinuationPart {\n  readonly type: \"continuation\"\n}\n\n/** Ordered, hidden provider state required to replay a model response losslessly. */\nexport interface AgentProviderStatePart {\n  readonly type: \"provider-state\"\n  readonly providerId: string\n  readonly data: JsonValue\n}\n\n/**\n * A completed tool call. Only terminal states are modelled — transient states\n * (`input-streaming`, `input-available`, `approval-*`) are never persisted because messages are\n * written only once a run finishes.\n */\nexport type AgentToolCallPart = AgentToolCallBase &\n  (\n    | { readonly state: \"output-available\"; readonly output: JsonValue }\n    | { readonly state: \"output-error\"; readonly errorText: string }\n  )\n\nexport type AgentMessagePart =\n  | AgentTextPart\n  | AgentReasoningPart\n  | AgentStepStartPart\n  | AgentFilePart\n  | AgentContextPart\n  | AgentContinuationPart\n  | AgentToolCallPart\n  | AgentProviderStatePart\n\nexport type AgentMessagePartType = AgentMessagePart[\"type\"]\nexport type AgentToolCallState = AgentToolCallPart[\"state\"]\n\n/** The logical agent message the adapters speak and the store persists (as columns). */\nexport interface AgentMessage {\n  readonly role: AgentMessageRole\n  readonly parts: readonly AgentMessagePart[]\n  /** Optional JSON metadata associated with the message. */\n  readonly metadata?: JsonValue\n}\n",
     "import { AGENT_MESSAGE_CONTENT_VERSION } from \"../../agents/message\"\nimport { principalsEqual } from \"../../auth\"\nimport { parseSixbFailure } from \"../../errors/internal\"\nimport type { SixbFailure } from \"../../errors/types\"\nimport type { ExecutionStorage } from \"../executions\"\nimport { AgentStorageError } from \"./errors\"\nimport {\n  agentContextCheckpointMatchesCreateInput,\n  assertAgentContextCheckpointAnchors,\n  assertAgentContextCheckpointAuthority,\n  assertAgentContextCheckpointReplayState,\n  assertAgentRunExecution,\n  assertConversationAgentRunSpec,\n  assertCreateAgentContextCheckpointInput,\n  assertCreateSubagentRunInput,\n  assertSubagentRunResult,\n  snapshotAgentThreadSandboxParams,\n  subagentRunMatchesCreateInput,\n  transitionAgentThreadSandbox,\n} from \"./provider\"\nimport type {\n  AgentContextCheckpointRecord,\n  AgentContextCheckpointStore,\n  AgentMessageRecord,\n  AgentMessageStore,\n  AgentRunFailureCode,\n  AgentRunRecord,\n  AgentRunStore,\n  AgentStorage,\n  AgentThreadRecord,\n  AgentThreadSandboxState,\n  AgentThreadStore,\n  AppendAgentMessageInput,\n  ConfirmAgentRunExecutionOwnershipInput,\n  ConversationAgentRunRecord,\n  CreateAgentContextCheckpointInput,\n  CreateAgentRunInput,\n  CreateAgentThreadInput,\n  CreateSubagentRunInput,\n  DeleteAgentMessagesByRunInput,\n  FinishAgentRunInput,\n  FinishQueuedAgentRunInput,\n  ListAgentMessagesInput,\n  ListAgentMessagesResult,\n  ListAgentRunsInput,\n  ListAgentRunsResult,\n  ListAgentThreadsInput,\n  ListAgentThreadsResult,\n  ReclaimAgentRunInput,\n  StartAgentRunInput,\n  SubagentRunRecord,\n  TransitionAgentThreadSandboxInput,\n} from \"./types\"\nimport { AGENT_RUN_FAILURE_CODES } from \"./types\"\n\nfunction normalizeFailure(\n  failure: SixbFailure<AgentRunFailureCode> | undefined\n): SixbFailure<AgentRunFailureCode> | undefined {\n  return failure ? parseSixbFailure(failure, AGENT_RUN_FAILURE_CODES) : undefined\n}\n\nfunction key(projectId: string, id: string): string {\n  return JSON.stringify([projectId, id])\n}\n\nfunction clone<T>(value: T): T {\n  return structuredClone(value)\n}\n\nfunction compareByDate(\n  left: Date | undefined,\n  right: Date | undefined,\n  leftId: string,\n  rightId: string,\n  order: \"asc\" | \"desc\"\n): number {\n  const delta = (left?.getTime() ?? 0) - (right?.getTime() ?? 0)\n  if (delta !== 0) {\n    return order === \"asc\" ? delta : -delta\n  }\n  if (leftId === rightId) {\n    return 0\n  }\n  return order === \"asc\" ? leftId.localeCompare(rightId) : rightId.localeCompare(leftId)\n}\n\ninterface Window<T> {\n  readonly page: T[]\n  readonly hasMore: boolean\n  readonly total: number\n}\n\nfunction applyWindow<T>(rows: T[], offset = 0, limit?: number): Window<T> {\n  const total = rows.length\n  const end = limit === undefined ? total : offset + limit\n  const page = rows.slice(offset, end)\n  return { page, hasMore: offset + page.length < total, total }\n}\n\n/**\n * Shared in-memory state behind the four sub-stores. They are tiered for ergonomics\n * (`storage.runs.create(...)`), but several operations span tables — creating/finishing a run\n * updates the thread anchor, appending a message bumps thread stats, and checkpoint creation reads\n * run/thread/message anchors — so they all read and write the same maps through this object.\n */\ninterface AgentStoreState {\n  readonly threads: Map<string, AgentThreadRecord>\n  readonly runs: Map<string, AgentRunRecord>\n  readonly messages: Map<string, AgentMessageRecord>\n  readonly checkpoints: Map<string, AgentContextCheckpointRecord>\n}\n\nexport interface InMemoryAgentStorageSnapshot {\n  readonly threads: Map<string, AgentThreadRecord>\n  readonly runs: Map<string, AgentRunRecord>\n  readonly messages: Map<string, AgentMessageRecord>\n  readonly checkpoints: Map<string, AgentContextCheckpointRecord>\n}\n\n// ── threads ───────────────────────────────────────────────────────────────────────────────────\n\nclass InMemoryAgentThreadStore implements AgentThreadStore {\n  constructor(private readonly state: AgentStoreState) {}\n\n  async transitionSandbox(\n    input: TransitionAgentThreadSandboxInput\n  ): Promise<AgentThreadSandboxState> {\n    const threadKey = key(input.projectId, input.id)\n    const thread = this.state.threads.get(threadKey) ?? null\n    const run =\n      input.action === \"recreate\"\n        ? null\n        : (this.state.runs.get(key(input.projectId, input.runId)) ?? null)\n    const sandboxState = transitionAgentThreadSandbox(thread, run, input)\n    if (!thread) throw new AgentStorageError(\"thread_not_found\", \"[Sixb] Thread not found.\")\n    this.state.threads.set(threadKey, { ...thread, sandboxState: clone(sandboxState) })\n    return clone(sandboxState)\n  }\n\n  async create(input: CreateAgentThreadInput): Promise<AgentThreadRecord> {\n    const sandboxParams =\n      input.sandboxParams === undefined\n        ? undefined\n        : snapshotAgentThreadSandboxParams(input.sandboxParams)\n    const threadKey = key(input.projectId, input.id)\n    if (this.state.threads.has(threadKey)) {\n      throw new AgentStorageError(\n        \"duplicate_id\",\n        `[Sixb] Agent thread '${input.id}' already exists for project '${input.projectId}'.`\n      )\n    }\n\n    const createdAt = new Date(input.createdAt ?? new Date())\n    const record: AgentThreadRecord = {\n      id: input.id,\n      projectId: input.projectId,\n      ownerPrincipal: clone(input.ownerPrincipal),\n      ...(sandboxParams === undefined ? {} : { sandboxParams }),\n      ...(input.title === undefined ? {} : { title: input.title }),\n      status: input.status ?? \"active\",\n      activeRunId: null,\n      messageCount: 0,\n      createdAt,\n      updatedAt: new Date(input.updatedAt ?? createdAt),\n    }\n\n    this.state.threads.set(threadKey, clone(record))\n    return clone(record)\n  }\n\n  async getById(params: { projectId: string; id: string }): Promise<AgentThreadRecord | null> {\n    const record = this.state.threads.get(key(params.projectId, params.id))\n    return record ? clone(record) : null\n  }\n\n  async list(input: ListAgentThreadsInput): Promise<ListAgentThreadsResult> {\n    const order = input.order ?? \"desc\"\n    const statuses = input.statuses ? new Set(input.statuses) : null\n    const filtered = [...this.state.threads.values()]\n      .filter((thread) => thread.projectId === input.projectId)\n      .filter((thread) => (statuses ? statuses.has(thread.status) : true))\n      .filter((thread) =>\n        input.ownerPrincipal ? principalsEqual(thread.ownerPrincipal, input.ownerPrincipal) : true\n      )\n      .sort((a, b) =>\n        compareByDate(\n          a.lastMessageAt ?? a.createdAt,\n          b.lastMessageAt ?? b.createdAt,\n          a.id,\n          b.id,\n          order\n        )\n      )\n\n    const { page, hasMore, total } = applyWindow(filtered, input.offset, input.limit)\n    return { threads: page.map(clone), hasMore, total }\n  }\n}\n\n// ── runs ──────────────────────────────────────────────────────────────────────────────────────\n\nclass InMemoryAgentRunStore implements AgentRunStore {\n  constructor(\n    private readonly state: AgentStoreState,\n    private readonly executions: ExecutionStorage\n  ) {}\n\n  async create(input: CreateAgentRunInput): Promise<ConversationAgentRunRecord> {\n    assertConversationAgentRunSpec(input.spec)\n    await assertAgentRunExecution({\n      executions: this.executions,\n      projectId: input.projectId,\n      executionId: input.executionId,\n      runId: input.id,\n    })\n    // No `await` between read and write: the in-memory critical section is atomic, so two concurrent\n    // queued runs on the same thread cannot both win — the second observes `activeRunId` set.\n    const threadKey = key(input.projectId, input.threadId)\n    const thread = this.state.threads.get(threadKey)\n    if (!thread) {\n      throw new AgentStorageError(\n        \"thread_not_found\",\n        `[Sixb] Agent thread '${input.threadId}' not found for project '${input.projectId}'.`\n      )\n    }\n    if (thread.activeRunId !== null) {\n      throw new AgentStorageError(\n        \"active_run_exists\",\n        `[Sixb] Agent thread '${input.threadId}' already has an active run '${thread.activeRunId}'.`\n      )\n    }\n\n    const runKey = key(input.projectId, input.id)\n    if (this.state.runs.has(runKey)) {\n      throw new AgentStorageError(\n        \"duplicate_id\",\n        `[Sixb] Agent run '${input.id}' already exists for project '${input.projectId}'.`\n      )\n    }\n    if (\n      [...this.state.runs.values()].some(\n        (run) => run.projectId === input.projectId && run.executionId === input.executionId\n      )\n    ) {\n      throw new AgentStorageError(\n        \"duplicate_id\",\n        `[Sixb] Execution '${input.executionId}' already belongs to another Agent run.`\n      )\n    }\n\n    const createdAt = new Date(input.createdAt ?? new Date())\n    const run: ConversationAgentRunRecord = {\n      kind: \"conversation\",\n      id: input.id,\n      projectId: input.projectId,\n      executionId: input.executionId,\n      threadId: input.threadId,\n      triggerMessageId: input.triggerMessageId,\n      spec: clone(input.spec),\n      status: \"queued\",\n      attempt: 0,\n      createdAt,\n    }\n    this.state.runs.set(runKey, clone(run))\n\n    const updatedThread: AgentThreadRecord = {\n      ...thread,\n      activeRunId: run.id,\n      updatedAt: createdAt,\n    }\n    this.state.threads.set(threadKey, clone(updatedThread))\n\n    return clone(run)\n  }\n\n  async createSubagent(input: CreateSubagentRunInput): Promise<SubagentRunRecord> {\n    assertCreateSubagentRunInput(input)\n    const execution = await assertAgentRunExecution({\n      executions: this.executions,\n      projectId: input.projectId,\n      executionId: input.executionId,\n      runId: input.id,\n    })\n\n    const runKey = key(input.projectId, input.id)\n    const existing = this.state.runs.get(runKey)\n    if (existing) {\n      if (subagentRunMatchesCreateInput(existing, input)) return clone(existing)\n      throw new AgentStorageError(\n        \"duplicate_id\",\n        `[Sixb] Subagent run '${input.id}' already exists with different immutable inputs.`\n      )\n    }\n\n    const parent = this.state.runs.get(key(input.projectId, input.parentRunId))\n    if (!parent || parent.kind !== \"conversation\") {\n      throw new AgentStorageError(\n        \"run_not_found\",\n        `[Sixb] Parent Agent run '${input.parentRunId}' was not found.`\n      )\n    }\n    if (parent.status !== \"running\") {\n      throw new AgentStorageError(\n        \"invalid_state\",\n        `[Sixb] Parent Agent run '${parent.id}' is not running (status '${parent.status}').`\n      )\n    }\n    if (\n      execution.source.type !== \"execution\" ||\n      execution.source.executionId !== parent.executionId\n    ) {\n      throw new AgentStorageError(\n        \"invalid_input\",\n        `[Sixb] Subagent execution '${execution.id}' is not a child of parent execution '${parent.executionId}'.`\n      )\n    }\n    if (parent.execution?.token !== input.parentExecutionToken) {\n      throw new AgentStorageError(\n        \"execution_lost\",\n        `[Sixb] Parent Agent run '${parent.id}' is no longer owned by this execution.`\n      )\n    }\n    const activeChildren = [...this.state.runs.values()].filter(\n      (run) =>\n        run.kind === \"subagent\" &&\n        run.projectId === input.projectId &&\n        run.parentRunId === parent.id &&\n        (run.status === \"queued\" || run.status === \"running\")\n    ).length\n    if (activeChildren >= input.maxActiveChildren) {\n      throw new AgentStorageError(\n        \"active_child_limit\",\n        `[Sixb] Agent run '${parent.id}' already has ${activeChildren} active subagents.`\n      )\n    }\n    if (\n      [...this.state.runs.values()].some(\n        (run) => run.projectId === input.projectId && run.executionId === input.executionId\n      )\n    ) {\n      throw new AgentStorageError(\n        \"duplicate_id\",\n        `[Sixb] Execution '${input.executionId}' already belongs to another Agent run.`\n      )\n    }\n\n    const run: SubagentRunRecord = {\n      kind: \"subagent\",\n      id: input.id,\n      projectId: input.projectId,\n      executionId: input.executionId,\n      parentRunId: input.parentRunId,\n      spawnKey: input.spawnKey,\n      spec: clone(input.spec),\n      status: \"queued\",\n      attempt: 0,\n      createdAt: new Date(input.createdAt ?? new Date()),\n    }\n    this.state.runs.set(runKey, clone(run))\n    return clone(run)\n  }\n\n  async start(input: StartAgentRunInput): Promise<AgentRunRecord> {\n    const run = this.requireStatus(input.projectId, input.id, \"queued\")\n    const startedAt = new Date(input.startedAt ?? new Date())\n    const next: AgentRunRecord = {\n      ...run,\n      status: \"running\",\n      ...(input.modelId === undefined ? {} : { modelId: input.modelId }),\n      attempt: 1,\n      execution: clone(input.execution),\n      startedAt,\n    }\n    this.state.runs.set(key(input.projectId, input.id), clone(next))\n    return clone(next)\n  }\n\n  async finishQueued(input: FinishQueuedAgentRunInput): Promise<AgentRunRecord> {\n    const run = this.requireStatus(input.projectId, input.id, \"queued\")\n    const completedAt = new Date(input.completedAt ?? new Date())\n    const next: AgentRunRecord = {\n      ...run,\n      status: input.status,\n      ...(input.error === undefined ? {} : { error: normalizeFailure(input.error) }),\n      completedAt,\n    }\n    this.state.runs.set(key(input.projectId, input.id), clone(next))\n    this.releaseThread(run, completedAt)\n    return clone(next)\n  }\n\n  async reclaim(input: ReclaimAgentRunInput): Promise<AgentRunRecord> {\n    const run = this.requireRunning(input.projectId, input.id)\n    const next: AgentRunRecord = {\n      ...run,\n      attempt: run.attempt + 1,\n      execution: clone(input.execution),\n    }\n    this.state.runs.set(key(input.projectId, input.id), clone(next))\n    return clone(next)\n  }\n\n  async confirmExecutionOwnership(\n    input: ConfirmAgentRunExecutionOwnershipInput\n  ): Promise<AgentRunRecord> {\n    const run = this.requireRunning(input.projectId, input.id)\n    if (!run.execution || run.execution.token !== input.executionToken) {\n      throw new AgentStorageError(\n        \"execution_lost\",\n        `[Sixb] Execution token is no longer current on agent run '${input.id}'.`\n      )\n    }\n\n    const next: AgentRunRecord = {\n      ...run,\n      execution: {\n        ...run.execution,\n        queueLeaseExpiresAt: new Date(\n          Math.max(run.execution.queueLeaseExpiresAt.getTime(), input.queueLeaseExpiresAt.getTime())\n        ),\n      },\n    }\n    this.state.runs.set(key(input.projectId, input.id), clone(next))\n    return clone(next)\n  }\n\n  async finish(input: FinishAgentRunInput): Promise<AgentRunRecord> {\n    const run = this.requireRunning(input.projectId, input.id)\n    if (!run.execution || run.execution.token !== input.executionToken) {\n      throw new AgentStorageError(\n        \"execution_lost\",\n        `[Sixb] Execution token is no longer current on agent run '${input.id}'.`\n      )\n    }\n    if (input.status === \"succeeded\" && run.kind === \"subagent\") {\n      assertSubagentRunResult(input.result, run.id)\n    }\n    if (input.status === \"succeeded\" && run.kind === \"conversation\" && input.result !== undefined) {\n      throw new AgentStorageError(\n        \"invalid_input\",\n        `[Sixb] Conversational Agent run '${run.id}' cannot persist a subagent result.`\n      )\n    }\n\n    const completedAt = new Date(input.completedAt ?? new Date())\n    const next: AgentRunRecord = {\n      ...run,\n      status: input.status,\n      ...(input.modelId === undefined ? {} : { modelId: input.modelId }),\n      ...(input.finishReason === undefined ? {} : { finishReason: input.finishReason }),\n      ...(input.diagnostics === undefined ? {} : { diagnostics: clone(input.diagnostics) }),\n      ...(input.status === \"succeeded\" && input.result !== undefined\n        ? { result: clone(input.result) }\n        : {}),\n      ...(input.status === \"succeeded\" || input.error === undefined\n        ? {}\n        : { error: normalizeFailure(input.error) }),\n      execution: undefined,\n      completedAt,\n    }\n    this.state.runs.set(key(input.projectId, input.id), clone(next))\n\n    this.releaseThread(run, completedAt)\n\n    return clone(next)\n  }\n\n  async getById(params: { projectId: string; id: string }): Promise<AgentRunRecord | null> {\n    const record = this.state.runs.get(key(params.projectId, params.id))\n    return record ? clone(record) : null\n  }\n\n  async getByIds(params: {\n    projectId: string\n    ids: readonly string[]\n  }): Promise<readonly AgentRunRecord[]> {\n    return [...new Set(params.ids)]\n      .map((id) => this.state.runs.get(key(params.projectId, id)))\n      .filter((record): record is AgentRunRecord => record !== undefined)\n      .map(clone)\n  }\n\n  async list(input: ListAgentRunsInput): Promise<ListAgentRunsResult> {\n    const order = input.order ?? \"desc\"\n    const statuses = input.statuses ? new Set(input.statuses) : null\n    const kinds = input.kinds ? new Set(input.kinds) : null\n\n    const filtered = [...this.state.runs.values()]\n      .filter((run) => run.projectId === input.projectId)\n      .filter((run) => (kinds ? kinds.has(run.kind) : true))\n      .filter((run) =>\n        input.threadId ? run.kind === \"conversation\" && run.threadId === input.threadId : true\n      )\n      .filter((run) =>\n        input.parentRunId ? run.kind === \"subagent\" && run.parentRunId === input.parentRunId : true\n      )\n      .filter((run) => (statuses ? statuses.has(run.status) : true))\n      .filter((run) =>\n        input.startedAfter ? (run.startedAt ?? run.createdAt) >= input.startedAfter : true\n      )\n      .filter((run) =>\n        input.startedBefore ? (run.startedAt ?? run.createdAt) <= input.startedBefore : true\n      )\n      .sort((a, b) =>\n        compareByDate(a.startedAt ?? a.createdAt, b.startedAt ?? b.createdAt, a.id, b.id, order)\n      )\n\n    const { page, hasMore, total } = applyWindow(filtered, input.offset, input.limit)\n    return { runs: page.map(clone), hasMore, total }\n  }\n\n  private requireRunning(projectId: string, id: string): AgentRunRecord {\n    return this.requireStatus(projectId, id, \"running\")\n  }\n\n  private requireStatus(\n    projectId: string,\n    id: string,\n    status: AgentRunRecord[\"status\"]\n  ): AgentRunRecord {\n    const run = this.state.runs.get(key(projectId, id))\n    if (!run) {\n      throw new AgentStorageError(\n        \"run_not_found\",\n        `[Sixb] Agent run '${id}' not found for project '${projectId}'.`\n      )\n    }\n    if (run.status !== status) {\n      throw new AgentStorageError(\n        \"invalid_state\",\n        `[Sixb] Agent run '${id}' is not ${status} (status '${run.status}').`\n      )\n    }\n    return run\n  }\n\n  private releaseThread(run: AgentRunRecord, completedAt: Date): void {\n    if (run.kind !== \"conversation\") return\n    const threadKey = key(run.projectId, run.threadId)\n    const thread = this.state.threads.get(threadKey)\n    if (thread && thread.activeRunId === run.id) {\n      this.state.threads.set(\n        threadKey,\n        clone({ ...thread, activeRunId: null, updatedAt: completedAt })\n      )\n    }\n  }\n}\n\n// ── messages ──────────────────────────────────────────────────────────────────────────────────\n\nclass InMemoryAgentMessageStore implements AgentMessageStore {\n  constructor(private readonly state: AgentStoreState) {}\n\n  async append(input: AppendAgentMessageInput): Promise<AgentMessageRecord> {\n    const threadKey = key(input.projectId, input.threadId)\n    const thread = this.state.threads.get(threadKey)\n    if (!thread) {\n      throw new AgentStorageError(\n        \"thread_not_found\",\n        `[Sixb] Agent thread '${input.threadId}' not found for project '${input.projectId}'.`\n      )\n    }\n\n    const messageKey = key(input.projectId, input.id)\n    if (this.state.messages.has(messageKey)) {\n      throw new AgentStorageError(\n        \"duplicate_id\",\n        `[Sixb] Agent message '${input.id}' already exists for project '${input.projectId}'.`\n      )\n    }\n\n    if (input.runId !== null && !this.state.runs.has(key(input.projectId, input.runId))) {\n      throw new AgentStorageError(\n        \"run_not_found\",\n        `[Sixb] Agent run '${input.runId}' not found for project '${input.projectId}'.`\n      )\n    }\n\n    const createdAt = new Date(input.createdAt ?? new Date())\n    const seq = this.nextSeq(input.projectId, input.threadId)\n    const message: AgentMessageRecord = {\n      id: input.id,\n      projectId: input.projectId,\n      threadId: input.threadId,\n      runId: input.runId,\n      role: input.role,\n      ...(input.authorPrincipal === undefined\n        ? {}\n        : { authorPrincipal: clone(input.authorPrincipal) }),\n      seq,\n      parts: clone(input.parts),\n      ...(input.metadata === undefined ? {} : { metadata: clone(input.metadata) }),\n      contentVersion: AGENT_MESSAGE_CONTENT_VERSION,\n      createdAt,\n      ...(input.completedAt === undefined ? {} : { completedAt: new Date(input.completedAt) }),\n    }\n    this.state.messages.set(messageKey, clone(message))\n\n    this.state.threads.set(\n      threadKey,\n      clone({\n        ...thread,\n        messageCount: thread.messageCount + 1,\n        lastMessageAt: createdAt,\n        updatedAt: createdAt,\n      })\n    )\n\n    return clone(message)\n  }\n\n  async deleteByRunId(input: DeleteAgentMessagesByRunInput): Promise<number> {\n    const threadKey = key(input.projectId, input.threadId)\n    const thread = this.state.threads.get(threadKey)\n    if (!thread) {\n      throw new AgentStorageError(\n        \"thread_not_found\",\n        `[Sixb] Agent thread '${input.threadId}' not found for project '${input.projectId}'.`\n      )\n    }\n\n    const messages = [...this.state.messages.entries()].filter(\n      ([, message]) =>\n        message.projectId === input.projectId &&\n        message.threadId === input.threadId &&\n        message.runId === input.runId\n    )\n    if (messages.length === 0) {\n      return 0\n    }\n\n    for (const [messageKey] of messages) {\n      this.state.messages.delete(messageKey)\n    }\n\n    const remainingMessages = [...this.state.messages.values()]\n      .filter(\n        (message) => message.projectId === input.projectId && message.threadId === input.threadId\n      )\n      .sort((left, right) => right.seq - left.seq)\n    const latestMessage = remainingMessages[0]\n    const updatedAt = new Date()\n    this.state.threads.set(\n      threadKey,\n      clone({\n        ...thread,\n        messageCount: remainingMessages.length,\n        lastMessageAt: latestMessage?.createdAt,\n        updatedAt,\n      })\n    )\n\n    return messages.length\n  }\n\n  async getById(params: { projectId: string; id: string }): Promise<AgentMessageRecord | null> {\n    const record = this.state.messages.get(key(params.projectId, params.id))\n    return record ? clone(record) : null\n  }\n\n  async list(input: ListAgentMessagesInput): Promise<ListAgentMessagesResult> {\n    const order = input.order ?? \"asc\"\n    const roles = input.roles ? new Set(input.roles) : null\n\n    const filtered = [...this.state.messages.values()]\n      .filter((message) => message.projectId === input.projectId)\n      .filter((message) => message.threadId === input.threadId)\n      .filter((message) => (input.afterSeq === undefined ? true : message.seq > input.afterSeq))\n      .filter((message) => (roles ? roles.has(message.role) : true))\n      .sort((a, b) => (order === \"asc\" ? a.seq - b.seq : b.seq - a.seq))\n\n    const { page, hasMore, total } = applyWindow(filtered, input.offset, input.limit)\n    return { messages: page.map(clone), hasMore, total }\n  }\n\n  private nextSeq(projectId: string, threadId: string): number {\n    let max = 0\n    for (const message of this.state.messages.values()) {\n      if (message.projectId === projectId && message.threadId === threadId && message.seq > max) {\n        max = message.seq\n      }\n    }\n    return max + 1\n  }\n}\n\n// ── context checkpoints ──────────────────────────────────────────────────────────────────────\n\nclass InMemoryAgentContextCheckpointStore implements AgentContextCheckpointStore {\n  constructor(private readonly state: AgentStoreState) {}\n\n  async create(input: CreateAgentContextCheckpointInput): Promise<AgentContextCheckpointRecord> {\n    assertCreateAgentContextCheckpointInput(input)\n\n    // No `await` between authority checks and append: this is one in-memory critical section.\n    const run = this.state.runs.get(key(input.projectId, input.createdByRunId)) ?? null\n    const thread = this.state.threads.get(key(input.projectId, input.threadId)) ?? null\n    assertAgentContextCheckpointAuthority({ create: input, run, thread })\n\n    const messages = [...this.state.messages.values()].filter(\n      (message) => message.projectId === input.projectId && message.threadId === input.threadId\n    )\n    const headSeq = messages.reduce((head, message) => Math.max(head, message.seq), 0)\n    const latest = this.findLatest(input.projectId, input.threadId)\n\n    const existingForRun = [...this.state.checkpoints.values()].find(\n      (checkpoint) =>\n        checkpoint.projectId === input.projectId &&\n        checkpoint.createdByRunId === input.createdByRunId\n    )\n    if (existingForRun) {\n      if (agentContextCheckpointMatchesCreateInput(existingForRun, input)) {\n        assertAgentContextCheckpointReplayState({\n          create: input,\n          existing: existingForRun,\n          latest,\n          headSeq,\n        })\n        return clone(existingForRun)\n      }\n      throw new AgentStorageError(\n        \"invalid_state\",\n        `[Sixb] Agent run '${input.createdByRunId}' already created a different context checkpoint.`\n      )\n    }\n\n    if (this.state.checkpoints.has(key(input.projectId, input.id))) {\n      throw new AgentStorageError(\n        \"duplicate_id\",\n        `[Sixb] Agent context checkpoint '${input.id}' already exists for project '${input.projectId}'.`\n      )\n    }\n\n    const firstRetained =\n      messages\n        .filter((message) => message.seq > input.summarizedThroughSeq)\n        .sort((left, right) => left.seq - right.seq)[0] ?? null\n    assertAgentContextCheckpointAnchors({\n      create: input,\n      latest,\n      headSeq,\n      firstRetained,\n    })\n\n    const record: AgentContextCheckpointRecord = {\n      id: input.id,\n      projectId: input.projectId,\n      threadId: input.threadId,\n      createdByRunId: input.createdByRunId,\n      ...(input.expectedPreviousCheckpointId === null\n        ? {}\n        : { previousCheckpointId: input.expectedPreviousCheckpointId }),\n      reason: input.reason,\n      summary: input.summary,\n      summaryFormatVersion: input.summaryFormatVersion,\n      summarizedThroughSeq: input.summarizedThroughSeq,\n      observedHeadSeq: input.observedHeadSeq,\n      estimatedInputTokensBefore: input.estimatedInputTokensBefore,\n      estimatedInputTokensAfter: input.estimatedInputTokensAfter,\n      summaryModelId: input.summaryModelId,\n      createdAt: new Date(input.createdAt ?? new Date()),\n    }\n    this.state.checkpoints.set(key(input.projectId, input.id), clone(record))\n    return clone(record)\n  }\n\n  async getLatest(input: {\n    readonly projectId: string\n    readonly threadId: string\n  }): Promise<AgentContextCheckpointRecord | null> {\n    const record = this.findLatest(input.projectId, input.threadId)\n    return record ? clone(record) : null\n  }\n\n  async getByRunIds(input: {\n    readonly projectId: string\n    readonly runIds: readonly string[]\n  }): Promise<readonly AgentContextCheckpointRecord[]> {\n    const byRunId = new Map(\n      [...this.state.checkpoints.values()]\n        .filter((checkpoint) => checkpoint.projectId === input.projectId)\n        .map((checkpoint) => [checkpoint.createdByRunId, checkpoint] as const)\n    )\n    return [...new Set(input.runIds)].flatMap((runId) => {\n      const checkpoint = byRunId.get(runId)\n      return checkpoint ? [clone(checkpoint)] : []\n    })\n  }\n\n  private findLatest(projectId: string, threadId: string): AgentContextCheckpointRecord | null {\n    return (\n      [...this.state.checkpoints.values()]\n        .filter(\n          (checkpoint) => checkpoint.projectId === projectId && checkpoint.threadId === threadId\n        )\n        .sort(\n          (left, right) =>\n            right.summarizedThroughSeq - left.summarizedThroughSeq ||\n            right.createdAt.getTime() - left.createdAt.getTime() ||\n            right.id.localeCompare(left.id)\n        )[0] ?? null\n    )\n  }\n}\n\nexport class InMemoryAgentStorage implements AgentStorage {\n  private readonly state: AgentStoreState = {\n    threads: new Map(),\n    runs: new Map(),\n    messages: new Map(),\n    checkpoints: new Map(),\n  }\n\n  readonly threads: InMemoryAgentThreadStore\n  readonly runs: InMemoryAgentRunStore\n  readonly messages: InMemoryAgentMessageStore\n  readonly checkpoints: InMemoryAgentContextCheckpointStore\n\n  constructor(executions: ExecutionStorage) {\n    this.threads = new InMemoryAgentThreadStore(this.state)\n    this.runs = new InMemoryAgentRunStore(this.state, executions)\n    this.messages = new InMemoryAgentMessageStore(this.state)\n    this.checkpoints = new InMemoryAgentContextCheckpointStore(this.state)\n  }\n\n  snapshot(): InMemoryAgentStorageSnapshot {\n    return {\n      threads: structuredClone(this.state.threads),\n      runs: structuredClone(this.state.runs),\n      messages: structuredClone(this.state.messages),\n      checkpoints: structuredClone(this.state.checkpoints),\n    }\n  }\n\n  restore(snapshot: InMemoryAgentStorageSnapshot): void {\n    replace(this.state.threads, snapshot.threads)\n    replace(this.state.runs, snapshot.runs)\n    replace(this.state.messages, snapshot.messages)\n    replace(this.state.checkpoints, snapshot.checkpoints)\n  }\n}\n\nfunction replace<T>(target: Map<string, T>, source: Map<string, T>): void {\n  target.clear()\n  for (const [k, value] of structuredClone(source)) {\n    target.set(k, value)\n  }\n}\n",
     "export type AiCostStorageErrorCode = \"missing_usage\" | \"cost_mismatch\"\n\nexport class AiCostStorageError extends Error {\n  readonly name = \"AiCostStorageError\"\n\n  constructor(\n    readonly code: AiCostStorageErrorCode,\n    message: string\n  ) {\n    super(message)\n  }\n}\n",
     "import type { AiModelCallUsageRecord, InMemoryAiUsageStorageSnapshot } from \"../ai-usage\"\nimport type { AiAccountingRecordSetItem } from \"./analytics\"\nimport { buildAiAccountingOverview, buildAiModelCallAccountingList } from \"./analytics\"\nimport { AiCostStorageError } from \"./errors\"\nimport { type AiAccountingGroupIdentity, buildAiModelCallGroups } from \"./groups\"\nimport type {\n  AiAccountingAttribution,\n  AiAccountingOverview,\n  AiCostStorage,\n  AiCostSummary,\n  AiModelCallCostRecord,\n  AiMoney,\n  ListAiModelCallAccountingInput,\n  ListAiModelCallAccountingResult,\n  ListAiModelCallGroupsInput,\n  ListAiModelCallGroupsResult,\n  QueryAiAccountingOverviewInput,\n  SummarizeAiCostExecutionsInput,\n} from \"./types\"\nimport { aiModelCallCostMatchesUsage, normalizeAiModelCallCostRecord } from \"./validation\"\n\nexport interface InMemoryAiCostStorageSnapshot {\n  readonly recordsByUsage: Map<string, AiModelCallCostRecord>\n}\n\ninterface InMemoryAiCostUsageSource {\n  snapshot(): InMemoryAiUsageStorageSnapshot\n}\n\nexport interface InMemoryAiAccountingAttributionSource {\n  resolveGroup?(input: {\n    readonly projectId: string\n    readonly executionId: string\n  }): Promise<{ readonly executionId: string; readonly attribution?: AiAccountingAttribution }>\n  resolve(input: {\n    readonly projectId: string\n    readonly executionId: string\n  }): Promise<AiAccountingAttribution | undefined>\n}\n\n/** In-memory immutable model-call costs and accounting reads. */\nexport class InMemoryAiCostStorage implements AiCostStorage {\n  private readonly recordsByUsage = new Map<string, AiModelCallCostRecord>()\n\n  constructor(\n    private readonly usage: InMemoryAiCostUsageSource,\n    private readonly attribution?: InMemoryAiAccountingAttributionSource\n  ) {}\n\n  async recordModelCallCost(input: AiModelCallCostRecord): Promise<void> {\n    const record = normalizeAiModelCallCostRecord(input)\n    const usage = this.usageRecord(record.projectId, record.usageRecordId)\n    if (!usage) throw missingUsage(record)\n    if (!aiModelCallCostMatchesUsage(record, usage)) {\n      throw new AiCostStorageError(\n        \"cost_mismatch\",\n        `[Sixb] AI valuation for usage '${record.usageRecordId}' does not match its usage record.`\n      )\n    }\n    const key = usageRecordKey(record.projectId, record.usageRecordId)\n    if (!this.recordsByUsage.has(key)) this.recordsByUsage.set(key, structuredClone(record))\n  }\n\n  async summarizeExecutions(\n    input: SummarizeAiCostExecutionsInput\n  ): Promise<readonly AiCostSummary[]> {\n    assertNonBlank(input.projectId, \"cost summary projectId\")\n    for (const id of input.executionIds) assertNonBlank(id, \"cost summary executionId\")\n    const requested = new Set(input.executionIds)\n    const usageByExecution = new Map(input.executionIds.map((id) => [id, [] as string[]]))\n    for (const usage of this.usage.snapshot().records.values()) {\n      if (usage.projectId === input.projectId && requested.has(usage.executionId)) {\n        usageByExecution.get(usage.executionId)!.push(usage.id)\n      }\n    }\n    return input.executionIds.map((id) =>\n      this.summarizeUsageIds(input.projectId, usageByExecution.get(id) ?? [])\n    )\n  }\n\n  async queryProjectOverview(input: QueryAiAccountingOverviewInput): Promise<AiAccountingOverview> {\n    return buildAiAccountingOverview(input, await this.accountingItems())\n  }\n\n  async listModelCalls(\n    input: ListAiModelCallAccountingInput\n  ): Promise<ListAiModelCallAccountingResult> {\n    return buildAiModelCallAccountingList(input, await this.accountingItems())\n  }\n\n  snapshot(): InMemoryAiCostStorageSnapshot {\n    return structuredClone({ recordsByUsage: this.recordsByUsage })\n  }\n\n  async listModelCallGroups(\n    input: ListAiModelCallGroupsInput\n  ): Promise<ListAiModelCallGroupsResult> {\n    const items = await this.accountingItems()\n    const roots = new Map<string, Promise<AiAccountingGroupIdentity>>()\n    return buildAiModelCallGroups(\n      input,\n      await Promise.all(\n        items.map(async (item) => {\n          const key = usageRecordKey(item.usage.projectId, item.usage.executionId)\n          let root = roots.get(key)\n          if (!root) {\n            root =\n              this.attribution?.resolveGroup?.({\n                projectId: item.usage.projectId,\n                executionId: item.usage.executionId,\n              }) ??\n              Promise.resolve({\n                executionId: item.usage.executionId,\n                attribution: item.attribution,\n              })\n            roots.set(key, root)\n          }\n          return { ...item, root: await root }\n        })\n      )\n    )\n  }\n\n  restore(snapshot: InMemoryAiCostStorageSnapshot): void {\n    replaceMap(this.recordsByUsage, snapshot.recordsByUsage)\n  }\n\n  /** @internal Immutable accounting source used by in-memory AI limit enforcement. */\n  getRecord(projectId: string, usageRecordId: string): AiModelCallCostRecord | null {\n    const record = this.recordsByUsage.get(usageRecordKey(projectId, usageRecordId))\n    return record ? structuredClone(record) : null\n  }\n\n  private usageRecord(projectId: string, id: string): AiModelCallUsageRecord | undefined {\n    return [...this.usage.snapshot().records.values()].find(\n      (record) => record.projectId === projectId && record.id === id\n    )\n  }\n\n  private async accountingItems(): Promise<readonly AiAccountingRecordSetItem[]> {\n    return Promise.all(\n      [...this.usage.snapshot().records.values()].map(async (usage) => {\n        const cost = this.recordsByUsage.get(usageRecordKey(usage.projectId, usage.id))\n        const attribution = await this.attribution?.resolve({\n          projectId: usage.projectId,\n          executionId: usage.executionId,\n        })\n        return {\n          usage,\n          ...(attribution ? { attribution } : {}),\n          ...(cost ? { cost } : {}),\n        }\n      })\n    )\n  }\n\n  private summarizeUsageIds(projectId: string, ids: readonly string[]): AiCostSummary {\n    const amounts = new Map<string, bigint>()\n    let ratedCallCount = 0\n    let unpriceableCallCount = 0\n    let unvaluedCallCount = 0\n    for (const id of ids) {\n      const cost = this.recordsByUsage.get(usageRecordKey(projectId, id))\n      if (!cost) unvaluedCallCount += 1\n      else if (cost.status === \"unpriceable\") unpriceableCallCount += 1\n      else {\n        ratedCallCount += 1\n        addMoney(amounts, cost.money)\n      }\n    }\n    return {\n      amounts: [...amounts]\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([currency, amount]) => ({ currency, amountNanos: amount.toString() })),\n      ratedCallCount,\n      unpriceableCallCount,\n      unvaluedCallCount,\n    }\n  }\n}\n\nfunction missingUsage(record: { readonly projectId: string; readonly usageRecordId: string }) {\n  return new AiCostStorageError(\n    \"missing_usage\",\n    `[Sixb] AI usage '${record.usageRecordId}' does not exist in project '${record.projectId}'.`\n  )\n}\n\nfunction addMoney(amounts: Map<string, bigint>, money: AiMoney): void {\n  amounts.set(money.currency, (amounts.get(money.currency) ?? 0n) + BigInt(money.amountNanos))\n}\n\nfunction usageRecordKey(projectId: string, id: string): string {\n  return JSON.stringify([projectId, id])\n}\n\nfunction assertNonBlank(value: string, field: string): void {\n  if (typeof value !== \"string\" || value.trim().length === 0) {\n    throw new TypeError(`[Sixb] AI ${field} must be nonblank.`)\n  }\n}\n\nfunction replaceMap<TKey, TValue>(target: Map<TKey, TValue>, source: Map<TKey, TValue>): void {\n  target.clear()\n  for (const [key, value] of structuredClone(source)) target.set(key, value)\n}\n",

package/dist/{chunk-tjjgy3z4.js → chunk-qxvp5epv.js}

@@ -1,15 +1,16 @@
 // @bun
+import {
+  createSixbError2
+} from "./chunk-6fsr7y93.js";
 import {
   resolveRuntimeAuthorizationForProject,
   AuthorizationError2,
   assertAuthorized2,
   assertCanEdit2,
   assertCanAppendTelemetry2
-} from "./chunk-5be2ath4.js";
-import {
-  createSixbError2
-} from "./chunk-6fsr7y93.js";
+} from "./chunk-qkbx3tf6.js";
 import {
+  assertValidFileRefs2,
   normalizeObjectProperties2,
   assertPropertyTokenBelongsToObjectType2,
   assertLinkTokenBelongsToObjectType2,
@@ -19,7 +20,7 @@ import {
   normalizeLinkProperties2,
   validateLinkProperties2,
   assertTelemetryProperty2
-} from "./chunk-rpxz486p.js";
+} from "./chunk-y05543x6.js";
 import {
   linkRefKey2,
   telemetryPointKey2
@@ -29,27 +30,32 @@ import {
   vectorConfiguration,
   vectorSources,
   normalizeVector2
-} from "./chunk-5yd8cchh.js";
+} from "./chunk-qq90g05n.js";
 import {
   validateObjectQuery2,
   explainObjectQuery2
-} from "./chunk-pja9jfz6.js";
+} from "./chunk-htr6wjmv.js";
 import {
   assertAuthorizedObjectReaderBinding,
   getAuthorizedOntologyView,
   requestAction3,
   requestActionAndWait2
-} from "./chunk-10styjgk.js";
+} from "./chunk-fx93hd2n.js";
 import {
   shareSixbErrorReporter2
 } from "./chunk-vjcd8d27.js";
 import {
   normalizeJsonProperties2
-} from "./chunk-fggq3d9k.js";
+} from "./chunk-p0dqwj3n.js";
 import {
   getOntologyMutationRuntime2,
   shareOntologyMutationRuntime2
 } from "./chunk-85cd7e8c.js";
+import {
+  resolveFileRefAtPath2,
+  openFileRef2,
+  jsonPointerSegment2
+} from "./chunk-3zxk45er.js";
 import {
   createObjectQueryBuilder2
 } from "./chunk-ewqa58h9.js";
@@ -58,7 +64,7 @@ import {
 } from "./chunk-kpx7jrmn.js";
 import {
   ObjectNotFoundError2
-} from "./chunk-aq39q04r.js";
+} from "./chunk-y9jmd7e5.js";
 import {
   MaterializationValidationError2,
   MaterializationObjectNotFoundError2
@@ -166,6 +172,7 @@ function normalizeRuntimeObject(input) {
   const { objectType, primaryPropertyId, properties, valueTypesById } = input;
   assertKnownProperties2(objectType, properties);
   validateObjectProperties2(objectType, properties, valueTypesById);
+  assertValidFileRefs2(properties, objectType.id);
   const primaryValue = properties[primaryPropertyId];
   if (primaryValue === undefined || primaryValue === null) {
     throw new OntologyValidationError2(`[Sixb] Missing primary property '${primaryPropertyId}' in upsert for '${objectType.id}'`);
@@ -181,6 +188,7 @@ function normalizeRuntimeLink(input) {
   const { objectType, linkDefinition, linkId, targetTypeId, properties, valueTypesById } = input;
   assertLinkTargetType2(objectType.id, linkId, linkDefinition, targetTypeId, input.isValidLinkTarget);
   validateLinkProperties2(objectType, linkDefinition, properties, undefined, valueTypesById);
+  assertValidFileRefs2(properties, `${objectType.id}.${linkId}`);
   const normalized = normalizeLinkProperties2(objectType, linkDefinition, properties, valueTypesById);
   if (normalized === undefined)
     return;
@@ -469,7 +477,7 @@ async function upsertObject2(ctx, properties) {
   const commit = await commitRuntimeOperations(ctx, [
     objectUpsertOperation({ id: runtimeOperationId(0), ref, properties: normalized.properties })
   ]);
-  return toObjectRow(ctx.projectId, requireEffectiveObject(commit.outcomes[0]));
+  return ctx.objectReader.redactWrittenRow(toObjectRow(ctx.projectId, requireEffectiveObject(commit.outcomes[0])));
 }
 
 // src/objects/object/upsert-batch.ts
@@ -501,7 +509,7 @@ async function upsertObjectBatch2(ctx, items) {
         ]
       };
     },
-    value: ([outcome]) => toObjectRow(ctx.projectId, requireEffectiveObject(outcome))
+    value: ([outcome]) => ctx.objectReader.redactWrittenRow(toObjectRow(ctx.projectId, requireEffectiveObject(outcome)))
   });
 }
 // src/objects/telemetry/write-batch.ts
@@ -842,6 +850,48 @@ function createObjectVectorHandle(ctx, primaryId, profileName) {
   });
 }
 
+// src/objects/sdk/file-handle.ts
+function createObjectFileHandle(ctx, primaryId, property, index) {
+  const { objectType } = ctx;
+  assertPropertyTokenBelongsToObjectType2(objectType, property);
+  const registered = ctx.ontology.resolveObjectType(objectType.id).properties.find((candidate) => candidate.id === property.id);
+  if (!registered) {
+    throw new OntologyValidationError2(`[Sixb] Unknown property '${property.id}' for object type '${objectType.id}'`);
+  }
+  const path = filePropertyPath(objectType.id, registered, index);
+  return {
+    async open() {
+      const row = await ctx.objectReader.getByPrimaryId({ objectTypeId: objectType.id, primaryId });
+      if (!row)
+        return null;
+      if (row.redactions?.[property.id]) {
+        const markings = registered.markings ?? [];
+        const marking = markings.find((markingId) => !ctx.authorization?.clearances?.has(markingId)) ?? markings[0];
+        throw new AuthorizationError2(`clearance:marking:${marking}`, `[Sixb] Cannot open file '${objectType.id}.${property.id}': it requires clearance for marking '${marking}'.`);
+      }
+      const fileRef = resolveFileRefAtPath2(row, path);
+      return fileRef ? openFileRef2(ctx.blobStorage, fileRef) : null;
+    }
+  };
+}
+function filePropertyPath(objectTypeId, property, index) {
+  const { schema } = property;
+  const name = `${objectTypeId}.${property.id}`;
+  if (schema === "fileRef") {
+    if (index !== undefined) {
+      throw new OntologyValidationError2(`[Sixb] Property ${name} holds one file; omit the index.`);
+    }
+    return `/properties/${jsonPointerSegment2(property.id)}`;
+  }
+  if (typeof schema === "object" && schema.type === "array" && schema.items === "fileRef") {
+    if (index === undefined || !Number.isSafeInteger(index) || index < 0) {
+      throw new OntologyValidationError2(`[Sixb] Property ${name} holds a list of files; pass the index of the file to open.`);
+    }
+    return `/properties/${jsonPointerSegment2(property.id)}/${index}`;
+  }
+  throw new OntologyValidationError2(`[Sixb] Property ${name} is not a file: file() takes a "fileRef" property or a list of them.`);
+}
+
 // src/objects/sdk/telemetry-channel.ts
 function createTelemetryChannel(ctx, primaryId) {
   return (property) => {
@@ -969,7 +1019,8 @@ function createObjectByIdHandle(ctx, primaryId) {
         }
       });
     },
-    telemetry: createTelemetryChannel(ctx, primaryId)
+    telemetry: createTelemetryChannel(ctx, primaryId),
+    file: (property, index) => createObjectFileHandle(ctx, primaryId, property, index)
   };
   return objectHandle;
 }
@@ -1069,6 +1120,7 @@ function createObjectSet2(params) {
     runtimeAuthorization,
     authorization,
     execution,
+    blobStorage: params.blobStorage,
     objectType,
     primaryPropertyId
   };
@@ -1274,4 +1326,4 @@ async function appendTelemetry(runtime, objectTypeId, items) {
 }
 export { requestAction2, ObjectError2, removeLink2, upsertLink2, upsertLinkBatch2, deleteObject2, restoreObject2, upsertObject2, upsertObjectBatch2, writeTelemetryBatch2, appendTelemetryBatch2, getTelemetryHistoryBatch2, getLatestTelemetryPoint, requireLinkDefinition2, resolveObjectContext2, resolveLinkContext2, createObjectSet2, upsertLink3, upsertLinkBatch3, removeLink3, listObjects, upsertObject3, upsertObjectBatch3, appendTelemetry, exports_service };
 
-//# debugId=85F4AA13E1233E8364756E2164756E21
+//# debugId=90347800675626DB64756E2164756E21