@sixb/core 0.1.17 → 0.1.18

package/dist/authorization/types.d.ts

@@ -36,6 +36,8 @@ export interface ResolvedRole {
     readonly id: string;
     readonly grantedToGroupIds: readonly string[];
     readonly grants: GrantIndex;
+    /** Marking ids this role clears. Absent means none. */
+    readonly clearances?: ReadonlySet<string>;
 }
 export interface AuthorizationContext {
     readonly principal: Principal;
@@ -44,5 +46,10 @@ export interface AuthorizationContext {
     /** Roles whose grantedTo groups intersect the principal's memberships. */
     readonly roleIds: readonly string[];
     readonly grants: GrantIndex;
+    /**
+     * Marking ids the principal may read, unioned from its roles. Absent means none: a context built
+     * without clearances reads no marked property.
+     */
+    readonly clearances?: ReadonlySet<string>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/authorization/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAkB,KAAK,SAAS,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC;KAC/B,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAAG,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC;CACvF,CAAC,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,IAAI,UAAU,CAE5C;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAkB,KAAK,SAAS,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC;KAC/B,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAAG,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC;CACvF,CAAC,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,IAAI,UAAU,CAE5C;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAC1C"}

package/dist/blob-storage/browser.js

@@ -8,7 +8,7 @@ import {
   blobIdFromDigest2,
   isBlobDigest2,
   isFileRef2
-} from "../chunk-h3v76ams.js";
+} from "../chunk-jhm3zsa7.js";
 export {
   DEFAULT_SIMPLE_FILE_UPLOAD_BYTES2 as DEFAULT_SIMPLE_FILE_UPLOAD_BYTES,
   blobDigestHex2 as blobDigestHex,

package/dist/blob-storage/execution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../src/blob-storage/execution.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EACL,KAAK,4BAA4B,EAEjC,KAAK,eAAe,EAGrB,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACb,QAAQ,EACR,WAAW,EACX,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,OAAO,EACP,YAAY,EACZ,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,SAAS,CAAA;AAGhB,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;IAC9C;;;OAGG;IACH,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,4BAA4B,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IAClG,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;IACrF,YAAY,CAAC,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACvE,cAAc,CAAC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC9E,cAAc,CAAC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjE,WAAW,CAAC,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzD;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,WAAW,EAAE,WAAW,EACxB,eAAe,EAAE,MAAM,MAAM,GAAG,SAAS,GACxC,YAAY,CA2Dd"}
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../src/blob-storage/execution.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EACL,KAAK,4BAA4B,EAEjC,KAAK,eAAe,EAGrB,MAAM,iBAAiB,CAAA;AAExB,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACb,QAAQ,EACR,WAAW,EACX,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,OAAO,EACP,YAAY,EACZ,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,SAAS,CAAA;AAGhB,4FAA4F;AAC5F,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;IAC9C;;;OAGG;IACH,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,4BAA4B,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;IAClG,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;IACrF,YAAY,CAAC,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACvE,cAAc,CAAC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC9E,cAAc,CAAC,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjE,WAAW,CAAC,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzD;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,WAAW,EAAE,WAAW,EACxB,eAAe,EAAE,MAAM,MAAM,GAAG,SAAS,GACxC,YAAY,CA8Dd"}

package/dist/blob-storage/file-content.d.ts

@@ -0,0 +1,18 @@
+import type { BlobInfo, BlobStorage, FileRef, OpenedFileRef } from "./types";
+/**
+ * A file is served only through the record that references it: the caller reads that record with
+ * its own authority, resolves the FileRef inside it, then checks the FileRef against the stored
+ * blob. File content routes and the SDK's `file().open()` share these steps.
+ */
+/** The FileRef at a JSON Pointer in an authorized record, or null when none is there. */
+export declare function resolveFileRefAtPath(root: unknown, path: string): FileRef | null;
+/** The stored blob a FileRef names, or null when it is absent or no longer matches it. */
+export declare function statFileRef(blobStorage: Pick<BlobStorage, "stat">, fileRef: FileRef): Promise<BlobInfo | null>;
+/**
+ * Open a FileRef resolved from an authorized record, or return null when its blob is gone. The
+ * blob itself is opened on the body's first read, so a body nobody reads holds nothing.
+ */
+export declare function openFileRef(blobStorage: Pick<BlobStorage, "stat" | "open">, fileRef: FileRef): Promise<OpenedFileRef | null>;
+/** Escape one segment of a JSON Pointer. */
+export declare function jsonPointerSegment(segment: string | number): string;
+//# sourceMappingURL=file-content.d.ts.map

package/dist/blob-storage/file-content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-content.d.ts","sourceRoot":"","sources":["../../src/blob-storage/file-content.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAG5E;;;;GAIG;AAEH,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAGhF;AAED,0FAA0F;AAC1F,wBAAsB,WAAW,CAC/B,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EACtC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQ1B;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,EAC/C,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAI/B;AAwBD,4CAA4C;AAC5C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEnE"}

package/dist/blob-storage/index.d.ts

@@ -2,7 +2,7 @@ export type { BlobDigest, BlobInfo, FileRef } from "./browser";
 export { blobDigestHex, blobIdFromDigest, DEFAULT_SIMPLE_FILE_UPLOAD_BYTES, fileNameFor, isBlobDigest, isFileRef, } from "./browser";
 export { BlobStorageError } from "./errors";
 export { InMemoryBlobStorage } from "./in-memory";
-export type { AbortBlobUploadInput, BlobBody, BlobByteRange, BlobStorage, BlobUploadPart, BlobUploadSession, CompleteBlobUploadInput, CreateBlobUploadInput, DirectPutBlobUploadSession, DirectUploadBlobStorage, MultipartBlobUploadSession, PutBlobInput, RangeReadableBlobStorage, SignBlobUploadPartInput, SignedBlobUploadPart, } from "./types";
+export type { AbortBlobUploadInput, BlobBody, BlobByteRange, BlobStorage, BlobUploadPart, BlobUploadSession, CompleteBlobUploadInput, CreateBlobUploadInput, DirectPutBlobUploadSession, DirectUploadBlobStorage, MultipartBlobUploadSession, OpenedFileRef, PutBlobInput, RangeReadableBlobStorage, SignBlobUploadPartInput, SignedBlobUploadPart, } from "./types";
 export { assertExpectedBlobSize, assertValidExpectedBlobSize, computeBlobDigest, createFileRef, readBlobBody, streamBlobBody, } from "./utils";
 export { supportsDirectUpload, supportsRangeRead } from "./validation";
 //# sourceMappingURL=index.d.ts.map

package/dist/blob-storage/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/blob-storage/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,gCAAgC,EAChC,WAAW,EACX,YAAY,EACZ,SAAS,GACV,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,QAAQ,EACR,aAAa,EACb,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,EACvB,0BAA0B,EAC1B,YAAY,EACZ,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/blob-storage/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC9D,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,gCAAgC,EAChC,WAAW,EACX,YAAY,EACZ,SAAS,GACV,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,YAAY,EACV,oBAAoB,EACpB,QAAQ,EACR,aAAa,EACb,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,EACvB,0BAA0B,EAC1B,aAAa,EACb,YAAY,EACZ,wBAAwB,EACxB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,cAAc,GACf,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA"}

package/dist/blob-storage/index.js

@@ -7,7 +7,7 @@ import {
   computeBlobDigest2,
   createFileRef2,
   InMemoryBlobStorage2
-} from "../chunk-9se093qz.js";
+} from "../chunk-gc4ntf7d.js";
 import {
   DEFAULT_SIMPLE_FILE_UPLOAD_BYTES2,
   fileNameFor2
@@ -22,7 +22,7 @@ import {
   isFileRef2,
   supportsDirectUpload2,
   supportsRangeRead2
-} from "../chunk-h3v76ams.js";
+} from "../chunk-jhm3zsa7.js";
 export {
   BlobStorageError2 as BlobStorageError,
   DEFAULT_SIMPLE_FILE_UPLOAD_BYTES2 as DEFAULT_SIMPLE_FILE_UPLOAD_BYTES,

package/dist/blob-storage/internal.d.ts

@@ -1,2 +1,4 @@
 export { FILE_DOWNLOAD_ROUTE_PREFIX, resolveFileDownload } from "./download-urls";
+export { jsonPointerSegment, openFileRef, resolveFileRefAtPath, statFileRef, } from "./file-content";
+export { canonicalMediaType } from "./media-type";
 //# sourceMappingURL=internal.d.ts.map

package/dist/blob-storage/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../src/blob-storage/internal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../src/blob-storage/internal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACjF,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,oBAAoB,EACpB,WAAW,GACZ,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA"}

package/dist/blob-storage/internal.js

@@ -1,11 +1,23 @@
 // @bun
 import {
   FILE_DOWNLOAD_ROUTE_PREFIX2,
-  resolveFileDownload2
-} from "../chunk-4ra628t7.js";
+  resolveFileDownload2,
+  resolveFileRefAtPath2,
+  statFileRef2,
+  openFileRef2,
+  jsonPointerSegment2
+} from "../chunk-3zxk45er.js";
+import {
+  canonicalMediaType2
+} from "../chunk-jhm3zsa7.js";
 export {
   FILE_DOWNLOAD_ROUTE_PREFIX2 as FILE_DOWNLOAD_ROUTE_PREFIX,
-  resolveFileDownload2 as resolveFileDownload
+  canonicalMediaType2 as canonicalMediaType,
+  jsonPointerSegment2 as jsonPointerSegment,
+  openFileRef2 as openFileRef,
+  resolveFileDownload2 as resolveFileDownload,
+  resolveFileRefAtPath2 as resolveFileRefAtPath,
+  statFileRef2 as statFileRef
 };
 
-//# debugId=3466D0726FF996DE64756E2164756E21
+//# debugId=778CDFDFB23C55CA64756E2164756E21

package/dist/blob-storage/internal.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "3466D0726FF996DE64756E2164756E21",
+  "debugId": "778CDFDFB23C55CA64756E2164756E21",
   "names": []
 }

package/dist/blob-storage/media-type.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The canonical form of a single well-formed media type, or `null` for anything else.
+ *
+ * Type, subtype, and parameter names are case-insensitive, so they are lowercased; parameter
+ * values keep their case. `"Text/Plain; Charset=UTF-8"` becomes `"text/plain;charset=UTF-8"`.
+ */
+export declare function canonicalMediaType(value: unknown): string | null;
+//# sourceMappingURL=media-type.d.ts.map

package/dist/blob-storage/media-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-type.d.ts","sourceRoot":"","sources":["../../src/blob-storage/media-type.ts"],"names":[],"mappings":"AAWA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWhE"}

package/dist/blob-storage/types.d.ts

@@ -6,7 +6,9 @@ export type BlobDigest = `sha256:${string}`;
  * `blobId` is always `blob_<sha256 hex>` derived from `digest`. `fileName`,
  * `mediaType`, and `logicalPath` are caller-supplied per-reference metadata (not
  * part of blob identity) and are untrusted — consumers must sanitize them before
- * using them for paths, headers, or rendering.
+ * using them for paths, headers, or rendering. A caller storing a reference must give a
+ * single media type such as `image/png` (`isValidFileRef`); references stored earlier may
+ * hold anything, so file routes re-parse it before serving.
  */
 export interface FileRef {
     readonly blobId: string;
@@ -17,6 +19,15 @@ export interface FileRef {
     readonly logicalPath?: string;
 }
 export type BlobBody = ArrayBuffer | Uint8Array | Blob | ReadableStream<Uint8Array>;
+/** A FileRef opened through the record that references it. */
+export interface OpenedFileRef {
+    readonly fileRef: FileRef;
+    /**
+     * The file's bytes. The stored blob is opened on the first read: read the body to its end or
+     * cancel it, and a body never read holds nothing.
+     */
+    readonly body: ReadableStream<Uint8Array>;
+}
 export interface PutBlobInput {
     readonly body: BlobBody;
     /** Reject the write when the consumed byte count differs from this value. */

package/dist/blob-storage/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/blob-storage/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,UAAU,MAAM,EAAE,CAAA;AAE3C;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;AAEnF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;IAE9C,gFAAgF;IAChF,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;CACrF;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAA;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,GAAG,0BAA0B,CAAA;AAEvF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAA;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;CAC3C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACtE,cAAc,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC7E,cAAc,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChE,WAAW,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/blob-storage/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,UAAU,MAAM,EAAE,CAAA;AAE3C;;;;;;;;;;GAUG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;AAEnF,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,CAAA;CAC1C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;IAE9C,gFAAgF;IAChF,KAAK,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAA;CACrF;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAA;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,GAAG,0BAA0B,CAAA;AAEvF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,CAAA;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;CAC3C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACtE,cAAc,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC7E,cAAc,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChE,WAAW,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxD"}

package/dist/blob-storage/validation.d.ts

@@ -1,6 +1,12 @@
 import type { BlobDigest, BlobStorage, DirectUploadBlobStorage, FileRef, RangeReadableBlobStorage } from "./types";
 export declare function isBlobDigest(value: unknown): value is BlobDigest;
 export declare function isFileRef(value: unknown): value is FileRef;
+/**
+ * `isFileRef`, plus a `mediaType` that, when present, is exactly one media type. Paths that store
+ * a reference a caller hands them use this. Reads keep `isFileRef`, so references stored before
+ * the rule still load; file routes re-parse the type before serving it.
+ */
+export declare function isValidFileRef(value: unknown): value is FileRef;
 export declare function supportsDirectUpload(storage: BlobStorage): storage is BlobStorage & DirectUploadBlobStorage;
 export declare function supportsRangeRead(storage: BlobStorage): storage is BlobStorage & RangeReadableBlobStorage;
 //# sourceMappingURL=validation.d.ts.map

package/dist/blob-storage/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/blob-storage/validation.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACX,uBAAuB,EACvB,OAAO,EACP,wBAAwB,EACzB,MAAM,SAAS,CAAA;AAEhB,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAgB1D;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,GACnB,OAAO,IAAI,WAAW,GAAG,uBAAuB,CAQlD;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,IAAI,WAAW,GAAG,wBAAwB,CAGnD"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/blob-storage/validation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACX,uBAAuB,EACvB,OAAO,EACP,wBAAwB,EACzB,MAAM,SAAS,CAAA;AAEhB,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAgB1D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAK/D;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,GACnB,OAAO,IAAI,WAAW,GAAG,uBAAuB,CAQlD;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,IAAI,WAAW,GAAG,wBAAwB,CAGnD"}

package/dist/bootstrap/agent-context.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Discovery of the project files the Agent reads: Agent Skills under `skills/`, the conversational
+ * Agent's instructions in `SIXB.md`, and the hand-written docs and scripts under `ontology/`.
+ *
+ * Contents are read here, once, so the Agent receives exactly what was validated. Built projects
+ * run from their project root with the committed tree, so the same reads work after `sixb build`.
+ */
+import type { AgentProjectFile, AgentSkillDefinition } from "../agents/skills";
+import type { OntologyDoc } from "../ontology/docs";
+/** The project's instructions for the conversational Agent, at the project root. */
+export declare const PROJECT_INSTRUCTIONS_FILE = "SIXB.md";
+/**
+ * Whether a project file, by its POSIX path relative to the project root, is one the Agent reads.
+ * `sixb dev` restarts when one changes.
+ */
+export declare function isAgentContextPath(path: string): boolean;
+/** Files and folders the Agent never receives, wherever they appear in its directories. */
+export declare function isIgnoredAgentContextName(name: string): boolean;
+/** A `scripts/` directory anywhere under `ontology/` holds Agent scripts: mounted, never imported. */
+export declare function isOntologyScriptsDirectory(name: string): boolean;
+export interface DiscoveredOntologyFiles {
+    /** Markdown under `ontology/`, outside `scripts/` directories. */
+    readonly docs: readonly OntologyDoc[];
+    /** Every file in a `scripts/` directory under `ontology/`. */
+    readonly scripts: readonly AgentProjectFile[];
+}
+/** Read the hand-written docs and scripts under `ontology/`. Paths are relative to `ontology/`. */
+export declare function discoverOntologyFiles(projectRoot: string): Promise<DiscoveredOntologyFiles>;
+/** Read and validate every `skills/<name>/` directory. A missing `skills/` has no skills. */
+export declare function discoverAgentSkills(projectRoot: string): Promise<readonly AgentSkillDefinition[]>;
+/** Read `SIXB.md` when the project has one. */
+export declare function discoverProjectInstructions(projectRoot: string): Promise<string | undefined>;
+//# sourceMappingURL=agent-context.d.ts.map

package/dist/bootstrap/agent-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-context.d.ts","sourceRoot":"","sources":["../../src/bootstrap/agent-context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAGnD,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,YAAY,CAAA;AAclD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMxD;AAED,2FAA2F;AAC3F,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,sGAAsG;AACtG,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAA;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC9C;AAED,mGAAmG;AACnG,wBAAsB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA4DjG;AAED,6FAA6F;AAC7F,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAuB1C;AAED,+CAA+C;AAC/C,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA2B7B"}

package/dist/bootstrap/discovery.d.ts

@@ -13,12 +13,22 @@ import { isPipelineDefinition } from "../pipelines";
 import { isProjectionDefinition } from "../projections/builders";
 import { isRuleDefinition } from "../rules";
 import { isScheduleDefinition } from "../schedules";
-import { isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition } from "../security";
+import { isGroupDefinition, isMarkingDefinition, isMembershipPolicyDefinition, isRoleDefinition } from "../security";
 import { isShareDefinition } from "../shares";
 import { isSyncDefinition } from "../syncs";
 import { isWorkflowDefinition } from "../workflows";
-export declare function discoverOntologySources(projectRoot: string): Promise<readonly OntologySource[]>;
-export type DiscoveryModuleKind = "action" | "connector" | "dataset" | "group" | "membershipPolicy" | "ontology" | "pipeline" | "projection" | "role" | "rule" | "schedule" | "share" | "sync" | "workflow";
+/** An `ontology/` module and the object types it exports, directly or re-exported. */
+export interface DiscoveredOntologyModule {
+    /** POSIX path relative to `ontology/`. */
+    readonly path: string;
+    readonly objectTypeIds: readonly string[];
+}
+export interface DiscoveredOntology {
+    readonly sources: readonly OntologySource[];
+    readonly modules: readonly DiscoveredOntologyModule[];
+}
+export declare function discoverOntologySources(projectRoot: string): Promise<DiscoveredOntology>;
+export type DiscoveryModuleKind = "action" | "connector" | "dataset" | "group" | "marking" | "membershipPolicy" | "ontology" | "pipeline" | "projection" | "role" | "rule" | "schedule" | "share" | "sync" | "workflow";
 /** Build-time inventory; paths are relative to the source project root. */
 export interface ProjectModule {
     readonly path: string;
@@ -81,6 +91,11 @@ declare const definitionDiscoveryRegistry: {
         readonly kind: "workflow";
         readonly isDefinition: typeof isWorkflowDefinition;
     };
+    readonly markings: {
+        readonly directory: readonly ["security", "markings"];
+        readonly kind: "marking";
+        readonly isDefinition: typeof isMarkingDefinition;
+    };
     readonly groups: {
         readonly directory: readonly ["security", "groups"];
         readonly kind: "group";
@@ -109,5 +124,10 @@ export type DiscoveredProjectDefinitions = {
     readonly [TKey in keyof typeof definitionDiscoveryRegistry]: readonly DefinitionFromFamily<(typeof definitionDiscoveryRegistry)[TKey]>[];
 };
 export declare function discoverProjectDefinitions(projectRoot: string): Promise<DiscoveredProjectDefinitions>;
+/**
+ * Every module file of the `ontology/` family, as absolute paths. `scripts/` directories hold the
+ * Agent's ontology scripts, not definitions, so they are never imported.
+ */
+export declare function listOntologyModuleFiles(projectRoot: string): Promise<string[]>;
 export {};
 //# sourceMappingURL=discovery.d.ts.map

package/dist/bootstrap/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/bootstrap/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAInD,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAkCpC;AAED,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,GACR,WAAW,GACX,SAAS,GACT,OAAO,GACP,kBAAkB,GAClB,UAAU,GACV,UAAU,GACV,YAAY,GACZ,MAAM,GACN,MAAM,GACN,UAAU,GACV,OAAO,GACP,MAAM,GACN,UAAU,CAAA;AAEd,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CACnC;AAED,8FAA8F;AAC9F,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACtD;AAOD,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,SAAS,oBAAoB,EAAE,EACxC,GAAG,EAAE,MAAM,CAAC,GACX,CAAC,CAEH;AAED,UAAU,yBAAyB,CAAC,WAAW;IAC7C,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAA;IACvD,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,WAAW,CAAA;CAChE;AAED,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8CsC,CAAA;AAEvE,wEAAwE;AACxE,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAU/F;AAED,KAAK,oBAAoB,CAAC,OAAO,IAC/B,OAAO,SAAS,yBAAyB,CAAC,MAAM,WAAW,CAAC,GAAG,WAAW,GAAG,KAAK,CAAA;AAEpF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,IAAI,IAAI,MAAM,OAAO,2BAA2B,GAAG,SAAS,oBAAoB,CACxF,CAAC,OAAO,2BAA2B,CAAC,CAAC,IAAI,CAAC,CAC3C,EAAE;CACJ,CAAA;AAED,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,4BAA4B,CAAC,CAWvC"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/bootstrap/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,EACjB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAKnD,sFAAsF;AACtF,MAAM,WAAW,wBAAwB;IACvC,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;CAC1C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAA;IAC3C,QAAQ,CAAC,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAA;CACtD;AAED,wBAAsB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAgD9F;AAED,MAAM,MAAM,mBAAmB,GAC3B,QAAQ,GACR,WAAW,GACX,SAAS,GACT,OAAO,GACP,SAAS,GACT,kBAAkB,GAClB,UAAU,GACV,UAAU,GACV,YAAY,GACZ,MAAM,GACN,MAAM,GACN,UAAU,GACV,OAAO,GACP,MAAM,GACN,UAAU,CAAA;AAEd,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CACnC;AAED,8FAA8F;AAC9F,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACtD;AAOD,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,SAAS,oBAAoB,EAAE,EACxC,GAAG,EAAE,MAAM,CAAC,GACX,CAAC,CAEH;AAED,UAAU,yBAAyB,CAAC,WAAW;IAC7C,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAA;IACvD,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,WAAW,CAAA;CAChE;AAED,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDsC,CAAA;AAEvE,wEAAwE;AACxE,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAU/F;AAED,KAAK,oBAAoB,CAAC,OAAO,IAC/B,OAAO,SAAS,yBAAyB,CAAC,MAAM,WAAW,CAAC,GAAG,WAAW,GAAG,KAAK,CAAA;AAEpF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,IAAI,IAAI,MAAM,OAAO,2BAA2B,GAAG,SAAS,oBAAoB,CACxF,CAAC,OAAO,2BAA2B,CAAC,CAAC,IAAI,CAAC,CAC3C,EAAE;CACJ,CAAA;AAED,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,4BAA4B,CAAC,CAWvC;AAYD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE9E"}

package/dist/bootstrap/index.d.ts

@@ -1,5 +1,6 @@
+export { isAgentContextPath } from "./agent-context";
 export type { BundledProjectModule, DiscoveredProjectDefinitions, DiscoveryModuleKind, ProjectModule, } from "./discovery";
-export { discoverOntologySources, discoverProjectDefinitions, listProjectModules, withProjectModules, } from "./discovery";
+export { discoverProjectDefinitions, listProjectModules, withProjectModules, } from "./discovery";
 export type { GenerateOntologyTypeManifestOptions, GenerateOntologyTypeManifestResult, OntologyTypeManifestDiscovery, OntologyTypeManifestEntry, OntologyValueTypeManifestEntry, } from "./ontology-type-manifest";
 export { discoverOntologyTypeManifest, generateOntologyTypeManifest, } from "./ontology-type-manifest";
 //# sourceMappingURL=index.d.ts.map

package/dist/bootstrap/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bootstrap/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,oBAAoB,EACpB,4BAA4B,EAC5B,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,mCAAmC,EACnC,kCAAkC,EAClC,6BAA6B,EAC7B,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bootstrap/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AACpD,YAAY,EACV,oBAAoB,EACpB,4BAA4B,EAC5B,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,mCAAmC,EACnC,kCAAkC,EAClC,6BAA6B,EAC7B,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAA"}