@sixb/core 0.1.17 → 0.1.18

package/dist/{chunk-f1xh7a32.js → chunk-7hpdd6r9.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   ProjectionValidationError2
-} from "./chunk-5be2ath4.js";
+} from "./chunk-qkbx3tf6.js";
 import {
   sha256Canonical2
 } from "./chunk-b9affek3.js";
@@ -12,7 +12,7 @@ import {
 } from "./chunk-4wn7bxxa.js";
 import {
   createPrimitiveExecutionRecord
-} from "./chunk-a7er86jd.js";
+} from "./chunk-ex496vct.js";
 import {
   findPrimitiveRunExecution
 } from "./chunk-ey1nk510.js";

package/dist/{chunk-xyvy73tj.js → chunk-bs7sqkre.js}

@@ -3,7 +3,10 @@ import {
   validatePrimaryProperties2,
   validatePropertyDefinitions2,
   validateQueryMetadata2
-} from "./chunk-rpxz486p.js";
+} from "./chunk-y05543x6.js";
+import {
+  markingIdsFrom
+} from "./chunk-xt1zt7gv.js";
 import {
   createPropertyTokenMap2,
   createLinkTokenMap2
@@ -382,11 +385,13 @@ function defineInterface2(input) {
   };
 }
 function prop2(id, schema, options) {
+  const { markings, ...rest } = options ?? {};
   return {
     id,
     name: options?.name ?? id,
     schema,
-    ...options
+    ...rest,
+    ...markings && markings.length > 0 ? { markings: markingIdsFrom(markings, `Property '${id}' markings`) } : {}
   };
 }
 function isObjectTypeLike(value) {
@@ -462,4 +467,4 @@ function integerEnum2(values) {
 }
 export { snapshotVectorProfiles, OntologyRegistry2, defineObjectType2, defineOntology2, defineValueType2, defineInterface2, prop2, link2, valueTypeRef2, stringEnum2, integerEnum2 };
 
-//# debugId=655678819609AD1364756E2164756E21
+//# debugId=1FDC7067D5F81E0664756E2164756E21

package/dist/chunk-bs7sqkre.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/ontology/vector-profiles.ts", "../src/ontology/registry.ts", "../src/ontology/builders.ts"],
+  "sourcesContent": [
+    "import type { ObjectVectorSearchProfile } from \"./types\"\n\n/** Metadata-only copy. Executable provider objects and credentials never leave the host. */\nexport function snapshotVectorProfiles(\n  profiles: Readonly<Record<string, ObjectVectorSearchProfile>>\n): Readonly<Record<string, ObjectVectorSearchProfile>> {\n  const snapshot: Record<string, ObjectVectorSearchProfile> = Object.create(null)\n  for (const [name, profileDefinition] of Object.entries(profiles)) {\n    const { providerId, modelId, definition } = profileDefinition.model\n    snapshot[name] = Object.freeze({\n      source: Object.freeze([...profileDefinition.source]),\n      model: Object.freeze({\n        providerId,\n        modelId,\n        definition: Object.freeze({\n          kind: \"embedding\" as const,\n          providerId,\n          modelId,\n          dimensions: definition.dimensions,\n          ...(definition.inputMode ? { inputMode: definition.inputMode } : {}),\n          ...(definition.representation\n            ? {\n                representation: Object.freeze({\n                  name: definition.representation.name,\n                  ...(definition.representation.version === undefined\n                    ? {}\n                    : { version: definition.representation.version }),\n                }),\n              }\n            : {}),\n        }),\n      }),\n    })\n  }\n  return Object.freeze(snapshot)\n}\n",
+    "/**\n * Standalone ontology registry — owns all type state and resolution logic.\n *\n * Zero infrastructure dependencies: imports only from the `ontology/` module.\n * Other modules depend on its read-only catalog instead of coupling to the full\n * `Sixb` facade.\n */\n\nimport {\n  formatUnknownObjectTypeMessage,\n  OntologyNotFoundError,\n  OntologyValidationError,\n} from \"./errors\"\nimport type { ObjectTypeWithPropertyTokens } from \"./tokens\"\nimport { createLinkTokenMap, createPropertyTokenMap } from \"./tokens\"\nimport type { ObjectType, Schema, ValueType } from \"./types\"\nimport {\n  validatePrimaryProperties,\n  validatePropertyDefinitions,\n  validateQueryMetadata,\n} from \"./validation\"\nimport { snapshotVectorProfiles } from \"./vector-profiles\"\n\n// ── Input types ──────────────────────────────────────────────\n\n/** Typed wrapper used by `createSixb` to register full ontology documents. */\nexport type OntologyDocumentInput = {\n  readonly id: string\n  readonly version: string\n  readonly objectTypes: readonly ObjectTypeWithPropertyTokens[]\n  readonly valueTypes?: readonly ValueType[]\n}\n\n/**\n * Runtime accepts either full ontology documents or individual object types.\n * This keeps setup flexible while preserving strict typing.\n */\nexport type OntologySource = ObjectTypeWithPropertyTokens | OntologyDocumentInput\n\nexport interface OntologyRegistryOptions {\n  readonly sources: readonly OntologySource[]\n}\n\n/** Read-only access to the host's validated ontology definitions and type graph. */\nexport interface OntologyDefinitionCatalog {\n  listObjectTypes(): readonly ObjectTypeWithPropertyTokens[]\n  getObjectTypeById(objectTypeId: string): ObjectTypeWithPropertyTokens | null\n  resolveObjectType(objectTypeId: string): ObjectTypeWithPropertyTokens\n  getPrimaryPropertyId(objectTypeId: string): string\n  listSubTypes(objectTypeId: string): string[]\n  listAncestorChain(objectType: ObjectType): readonly ObjectTypeWithPropertyTokens[]\n  isValidLinkTarget(expected: string | string[], actual: string): boolean\n  getObjectTypesById(): ReadonlyMap<string, ObjectTypeWithPropertyTokens>\n  getValueTypesById(): ReadonlyMap<string, ValueType>\n  getPrimaryByTypeId(): ReadonlyMap<string, string>\n}\n\n// ── Private helpers ──────────────────────────────────────────\n\nfunction isOntologyDocumentSource(\n  source: OntologySource\n): source is Exclude<OntologySource, ObjectTypeWithPropertyTokens> {\n  return \"objectTypes\" in source\n}\n\n/**\n * Recursively walk a schema tree and collect ValueTypes discovered\n * via `valueTypeRef` nodes that carry a `_resolved` schema.\n *\n * This enables auto-registration: when codegen emits `valueTypeRef(VT)`,\n * it stores the resolved schema (and the semantic type, if any) inline. We\n * extract them here so the runtime `valueTypesById` registry is populated\n * without requiring users to pass ValueTypes explicitly. Unit validation reads\n * the semantic type from that registry, so dropping it would make a\n * unit-bearing value type reject every unit.\n */\nfunction extractValueTypesFromSchema(\n  schema: Schema,\n  collected: Map<string, ValueType>,\n  seen: Set<string>\n): void {\n  if (typeof schema === \"string\") return\n\n  if (schema.type === \"valueTypeRef\") {\n    if (schema._resolved && !seen.has(schema.valueTypeId)) {\n      seen.add(schema.valueTypeId)\n      const localName = schema.valueTypeId.includes(\":\")\n        ? schema.valueTypeId.slice(schema.valueTypeId.indexOf(\":\") + 1)\n        : schema.valueTypeId\n      collected.set(schema.valueTypeId, {\n        id: schema.valueTypeId,\n        name: localName,\n        schema: schema._resolved,\n        ...(schema._semanticType === undefined ? {} : { semanticType: schema._semanticType }),\n      })\n      extractValueTypesFromSchema(schema._resolved, collected, seen)\n    }\n    return\n  }\n\n  if (schema.type === \"object\") {\n    for (const field of Object.values(schema.properties)) {\n      extractValueTypesFromSchema(field.schema, collected, seen)\n    }\n    return\n  }\n\n  if (schema.type === \"array\") {\n    extractValueTypesFromSchema(schema.items, collected, seen)\n    return\n  }\n\n  if (schema.type === \"map\") {\n    extractValueTypesFromSchema(schema.valueSchema, collected, seen)\n  }\n}\n\nfunction collectOntology(sources: readonly OntologySource[]): {\n  objectTypes: ObjectTypeWithPropertyTokens[]\n  valueTypes: ValueType[]\n} {\n  const objectTypes: ObjectTypeWithPropertyTokens[] = []\n  const valueTypes: ValueType[] = []\n  const seenObjectTypes = new Set<ObjectTypeWithPropertyTokens>()\n\n  for (const source of sources) {\n    if (isOntologyDocumentSource(source)) {\n      for (const ot of source.objectTypes) {\n        if (!seenObjectTypes.has(ot)) {\n          seenObjectTypes.add(ot)\n          objectTypes.push(ot)\n        }\n      }\n      valueTypes.push(...(source.valueTypes ?? []))\n    } else {\n      if (!seenObjectTypes.has(source)) {\n        seenObjectTypes.add(source)\n        objectTypes.push(source)\n      }\n    }\n  }\n\n  // Auto-discover ValueTypes embedded in ObjectType schemas via _resolved.\n  // Explicit ValueTypes (from OntologyDocumentInput) take priority.\n  const explicitIds = new Set(valueTypes.map((vt) => vt.id))\n  const discovered = new Map<string, ValueType>()\n\n  for (const objectType of objectTypes) {\n    for (const property of objectType.properties) {\n      extractValueTypesFromSchema(property.schema, discovered, explicitIds)\n    }\n    for (const linkDef of objectType.links) {\n      if (linkDef.properties) {\n        for (const property of linkDef.properties) {\n          extractValueTypesFromSchema(property.schema, discovered, explicitIds)\n        }\n      }\n    }\n  }\n\n  valueTypes.push(...discovered.values())\n\n  return { objectTypes, valueTypes }\n}\n\n// ── OntologyRegistry ─────────────────────────────────────────\n\n/**\n * Self-contained registry for ontology types.\n *\n * Holds all object types, value types, the subtype graph, and the primary\n * property mapping. Validates inheritance chains and flattens inherited\n * properties at construction time.\n *\n * Exposes read-only accessors so consumers never mutate ontology state.\n */\nexport class OntologyRegistry implements OntologyDefinitionCatalog {\n  private readonly objectTypesById = new Map<string, ObjectTypeWithPropertyTokens>()\n  private readonly valueTypesById = new Map<string, ValueType>()\n  private readonly subTypesById = new Map<string, Set<string>>()\n  private readonly primaryByTypeId: Map<string, string>\n\n  constructor(options: OntologyRegistryOptions) {\n    const { objectTypes, valueTypes } = collectOntology(options.sources)\n\n    for (const objectType of objectTypes) {\n      if (this.objectTypesById.has(objectType.id)) {\n        throw new OntologyValidationError(`Duplicate object type id: ${objectType.id}`)\n      }\n      this.objectTypesById.set(objectType.id, objectType)\n    }\n\n    for (const valueType of valueTypes) {\n      if (this.valueTypesById.has(valueType.id)) {\n        throw new OntologyValidationError(`Duplicate value type id: ${valueType.id}`)\n      }\n      this.valueTypesById.set(valueType.id, valueType)\n    }\n\n    this.validateAndBuildExtendsRegistry()\n    this.resolveInheritedProperties()\n    validatePropertyDefinitions(this.objectTypesById, this.valueTypesById)\n    validateQueryMetadata(this.objectTypesById, this.valueTypesById)\n    for (const [id, type] of this.objectTypesById) {\n      if (type.search?.vectors)\n        this.objectTypesById.set(id, {\n          ...type,\n          search: { ...type.search, vectors: snapshotVectorProfiles(type.search.vectors) },\n        })\n    }\n    this.primaryByTypeId = validatePrimaryProperties(this.objectTypesById)\n  }\n\n  // ── Public read API ──────────────────────────────────────\n\n  /** All registered object types. */\n  listObjectTypes(): readonly ObjectTypeWithPropertyTokens[] {\n    return [...this.objectTypesById.values()]\n  }\n\n  /** Lookup an object type by id. Returns `null` if not found. */\n  getObjectTypeById(objectTypeId: string): ObjectTypeWithPropertyTokens | null {\n    return this.objectTypesById.get(objectTypeId) ?? null\n  }\n\n  /**\n   * Lookup an object type by id, throwing if it does not exist.\n   *\n   * Use this when the caller requires the type to exist and should fail\n   * loudly on unknown types (e.g., write operations receiving a type id).\n   */\n  resolveObjectType(objectTypeId: string): ObjectTypeWithPropertyTokens {\n    const objectType = this.objectTypesById.get(objectTypeId)\n    if (!objectType) {\n      throw new OntologyNotFoundError(formatUnknownObjectTypeMessage(objectTypeId))\n    }\n    return objectType\n  }\n\n  /** Get the primary property id for a given object type. Throws if unknown. */\n  getPrimaryPropertyId(objectTypeId: string): string {\n    const id = this.primaryByTypeId.get(objectTypeId)\n    if (!id) throw new OntologyNotFoundError(formatUnknownObjectTypeMessage(objectTypeId))\n    return id\n  }\n\n  /** Collect all transitive sub-types of the given object type id. */\n  listSubTypes(objectTypeId: string): string[] {\n    const result: string[] = []\n    const collect = (typeId: string): void => {\n      const children = this.subTypesById.get(typeId)\n      if (!children) return\n      for (const childId of children) {\n        result.push(childId)\n        collect(childId)\n      }\n    }\n    collect(objectTypeId)\n    return result\n  }\n\n  /** Get the structural extends chain from root ancestor to the provided type. */\n  listAncestorChain(objectType: ObjectType): readonly ObjectTypeWithPropertyTokens[] {\n    const chain: ObjectTypeWithPropertyTokens[] = []\n    let current: ObjectTypeWithPropertyTokens | null = this.resolveObjectType(objectType.id)\n    const seen = new Set<string>()\n\n    while (current) {\n      if (seen.has(current.id)) {\n        throw new OntologyValidationError(\n          `Circular extends chain detected while resolving ancestors for \"${objectType.id}\".`\n        )\n      }\n      seen.add(current.id)\n      chain.push(current)\n      current = current.extends ? this.resolveObjectType(current.extends) : null\n    }\n\n    return chain.reverse()\n  }\n\n  /**\n   * Check whether `actual` is a valid target for a link expecting `expected`.\n   *\n   * Supports wildcard `\"*\"`, single concrete types, and arrays. A type\n   * matches if it equals the expected type or is a transitive subtype.\n   */\n  isValidLinkTarget(expected: string | string[], actual: string): boolean {\n    if (expected === \"*\") return true\n    const types = Array.isArray(expected) ? expected : [expected]\n    if (types.includes(\"*\")) return true\n    for (const type of types) {\n      if (actual === type || this.listSubTypes(type).includes(actual)) return true\n    }\n    return false\n  }\n\n  // ── Map accessors (read-only views) ──────────────────────\n\n  /** Read-only view of all object types by id. */\n  getObjectTypesById(): ReadonlyMap<string, ObjectTypeWithPropertyTokens> {\n    return this.objectTypesById\n  }\n\n  /** Read-only view of all value types by id. */\n  getValueTypesById(): ReadonlyMap<string, ValueType> {\n    return this.valueTypesById\n  }\n\n  /** Read-only view of primary property ids by object type id. */\n  getPrimaryByTypeId(): ReadonlyMap<string, string> {\n    return this.primaryByTypeId\n  }\n\n  // ── Private initialization ───────────────────────────────\n\n  /**\n   * Build the subtype graph from `extends` and `parents` declarations.\n   *\n   * Validates that parent types exist and detects circular `extends` chains.\n   */\n  private validateAndBuildExtendsRegistry(): void {\n    const resolving = new Set<string>()\n    const resolved = new Set<string>()\n\n    const registerChild = (parentId: string, childId: string): void => {\n      let children = this.subTypesById.get(parentId)\n      if (!children) {\n        children = new Set()\n        this.subTypesById.set(parentId, children)\n      }\n      children.add(childId)\n    }\n\n    const visit = (typeId: string, chain: string[]): void => {\n      if (resolved.has(typeId)) return\n\n      const objectType = this.objectTypesById.get(typeId)\n      if (!objectType || !objectType.extends) {\n        resolved.add(typeId)\n        return\n      }\n\n      const parentId = objectType.extends\n\n      if (!this.objectTypesById.has(parentId)) {\n        throw new OntologyValidationError(\n          `ObjectType \"${typeId}\" extends unknown type \"${parentId}\". If \"${parentId}\" comes from an external ontology, add it to 'ontologies' in createSixb().`\n        )\n      }\n\n      if (resolving.has(typeId)) {\n        throw new OntologyValidationError(\n          `Circular extends chain detected: ${[...chain, typeId].join(\" → \")}`\n        )\n      }\n\n      resolving.add(typeId)\n      visit(parentId, [...chain, typeId])\n\n      registerChild(parentId, typeId)\n\n      resolving.delete(typeId)\n      resolved.add(typeId)\n    }\n\n    for (const typeId of this.objectTypesById.keys()) {\n      visit(typeId, [])\n    }\n\n    for (const [typeId, objectType] of this.objectTypesById) {\n      if (!objectType.parents) continue\n      for (const parentId of objectType.parents) {\n        if (parentId === objectType.extends) continue\n        if (!this.objectTypesById.has(parentId)) {\n          throw new OntologyValidationError(\n            `ObjectType \"${typeId}\" lists unknown parent \"${parentId}\" in parents. If \"${parentId}\" comes from an external ontology, add it to 'ontologies' in createSixb().`\n          )\n        }\n        registerChild(parentId, typeId)\n      }\n    }\n  }\n\n  /**\n   * For types with string `extends`, merge parent properties/links\n   * and rebuild tokens. Idempotent: no-op if already flattened (codegen case).\n   */\n  private resolveInheritedProperties(): void {\n    const resolved = new Set<string>()\n\n    const resolve = (typeId: string): void => {\n      if (resolved.has(typeId)) return\n      const objectType = this.objectTypesById.get(typeId)!\n\n      if (!objectType.extends) {\n        resolved.add(typeId)\n        return\n      }\n\n      resolve(objectType.extends)\n      const parent = this.objectTypesById.get(objectType.extends)!\n\n      const mergeById = <T extends { id: string }>(\n        parentItems: readonly T[],\n        childItems: readonly T[]\n      ): T[] => {\n        const childIds = new Set(childItems.map((item) => item.id))\n        const fromParent = parentItems.filter((item) => !childIds.has(item.id))\n        return [...fromParent, ...childItems]\n      }\n\n      const mergedProperties = mergeById(parent.properties, objectType.properties)\n      const mergedLinks = mergeById(parent.links, objectType.links)\n\n      const changed =\n        mergedProperties.length !== objectType.properties.length ||\n        mergedLinks.length !== objectType.links.length\n\n      if (changed) {\n        const merged: ObjectType = {\n          ...objectType,\n          properties: mergedProperties,\n          links: mergedLinks,\n        }\n        const withTokens: ObjectTypeWithPropertyTokens = {\n          ...merged,\n          p: createPropertyTokenMap(merged),\n        }\n        ;(withTokens as ObjectTypeWithPropertyTokens & { l: unknown }).l =\n          createLinkTokenMap(merged)\n        this.objectTypesById.set(typeId, withTokens)\n      }\n\n      resolved.add(typeId)\n    }\n\n    for (const typeId of this.objectTypesById.keys()) {\n      resolve(typeId)\n    }\n  }\n}\n",
+    "/**\n * Builder helpers for ontology modeling.\n *\n * These functions provide shorthand for constructing `ObjectType`, `ValueType`,\n * `Interface`, `Property`, `ObjectLink`, and `EnumSchema` values with sensible\n * defaults so you can focus on the semantics rather than boilerplate.\n *\n * ```ts\n * import { defineObjectType, prop, link, stringEnum } from \"@sixb/core\"\n *\n * const thermostat = defineObjectType({\n *   id: \"thermostat\",\n *   name: \"Thermostat\",\n *   properties: [\n *     prop(\"currentTemperature\", \"double\", {\n *       name: \"Current Temperature\",\n *       semanticType: \"Temperature\",\n *       required: true,\n *     }),\n *     prop(\"mode\", stringEnum([\"off\", \"heat\", \"cool\", \"auto\"])),\n *   ],\n *   links: [\n *     link.ref(\"controls\", \"hvacZone\", { cardinality: \"one\" }),\n *   ],\n * })\n * ```\n */\n\nimport { markingIdsFrom } from \"../security/builders\"\nimport type { MarkingDefinition } from \"../security/types\"\nimport type { ObjectTypeWithPropertyTokens, ObjectTypeWithTokens } from \"./tokens\"\nimport { createLinkTokenMap, createPropertyTokenMap } from \"./tokens\"\nimport type {\n  EnumSchema,\n  Interface,\n  LinkCardinality,\n  ObjectLink,\n  ObjectLinkTargetMetadata,\n  ObjectType,\n  ObjectVectorSearchProfile,\n  Ontology,\n  Property,\n  PropertyMode,\n  PropertyQueryMetadata,\n  Schema,\n  ValueType,\n  ValueTypeRefSchema,\n} from \"./types\"\nimport type { QuantitativeTypeId } from \"./units\"\n\ntype NameFromOptions<TId extends string, TOptions> = TOptions extends {\n  name: infer TName extends string\n}\n  ? TName\n  : TId\n\n/**\n * Preserve literal option values when an option key is provided.\n *\n * Why this exists:\n * - `prop(\"x\", \"string\", { required: true })` should keep `required` as literal `true`\n *   (not widen to `boolean`) so downstream inference can treat the field as required.\n */\ntype FieldFromOptions<TOptions, TKey extends string, TFallback> =\n  TOptions extends Record<TKey, infer TValue>\n    ? { [K in TKey]: TValue }\n    : { [K in TKey]?: TFallback }\n\nconst selfLinkTargetObjectTypeId = \"__sixb.self__\"\ntype SelfLinkTargetObjectTypeId = typeof selfLinkTargetObjectTypeId\n\ntype NormalizeSelfLink<TObjectTypeId extends string, TLink> = TLink extends {\n  targetObjectTypeId: SelfLinkTargetObjectTypeId\n}\n  ? Omit<TLink, \"targetObjectTypeId\"> & { targetObjectTypeId: TObjectTypeId }\n  : TLink\n\ntype NormalizeSelfLinks<TObjectTypeId extends string, TLinks extends readonly ObjectLink[]> = {\n  -readonly [K in keyof TLinks]: NormalizeSelfLink<TObjectTypeId, TLinks[K]>\n}\n\n// ── Extends type utilities ───────────────────────────────────\n\n/**\n * Merge parent + child collections by id. Uses built-in `Exclude` on\n * the element union — no recursion, no \"excessively deep\" errors.\n */\ntype MergedCollection<\n  TParent extends readonly { id: string }[],\n  TChild extends readonly { id: string }[],\n> = Array<Exclude<TParent[number], { id: TChild[number][\"id\"] }> | TChild[number]>\n\n/**\n * Extract child's own collection, normalized as a mutable tuple. Falls back to [].\n */\ntype OwnCollection<TInput, TKey extends string, TItem> =\n  TInput extends Record<TKey, infer T extends readonly TItem[]> ? [...T] : []\n\ntype OwnLinks<TInput> = TInput extends { id: infer TObjectTypeId extends string }\n  ? TInput extends Record<\"links\", infer TLinks extends readonly ObjectLink[]>\n    ? NormalizeSelfLinks<TObjectTypeId, TLinks>\n    : []\n  : []\n\n/**\n * Merge two arrays by id: parent items first, child items override by id.\n */\nfunction mergeById<T extends { id: string }>(parent: readonly T[], child: readonly T[]): T[] {\n  const childIds = new Set(child.map((item) => item.id))\n  const fromParent = parent.filter((item) => !childIds.has(item.id))\n  return [...fromParent, ...child]\n}\n\n// ── Object Type ─────────────────────────────────────────────\n\ntype DefineObjectTypeBase = Omit<ObjectType, \"properties\" | \"links\" | \"extends\" | \"parents\">\n\n/**\n * Structural constraint for the `extends` field.\n *\n * We require only the data needed for merge (id + collections), not the\n * full `ObjectTypeWithTokens<ObjectType>`. The latter requires\n * `LinkTokenMap<ObjectType>` with a `{ [id: string]: LinkToken }` index\n * signature, which is incompatible with the literal-keyed maps produced by\n * concrete `defineObjectType()` calls.\n */\ntype DefineObjectTypeInput = DefineObjectTypeBase & {\n  extends?:\n    | string\n    | {\n        readonly id: string\n        readonly properties: readonly Property[]\n        readonly links: readonly ObjectLink[]\n      }\n  parents?: readonly string[]\n  properties?: readonly Property[]\n  links?: readonly ObjectLink[]\n}\n\n/**\n * Normalize `parents` from readonly tuple to mutable `string[] | undefined`.\n */\ntype NormalizeParents<TInput> = TInput extends { parents: infer P extends readonly string[] }\n  ? { parents: [...P] }\n  : { parents?: undefined }\n\ntype DefineObjectTypeResult<TInput extends DefineObjectTypeInput> = Omit<\n  TInput,\n  \"properties\" | \"links\" | \"extends\" | \"parents\"\n> &\n  (TInput extends {\n    extends: infer TParent extends {\n      id: string\n      properties: readonly Property[]\n      links: readonly ObjectLink[]\n    }\n  }\n    ? NormalizeParents<TInput> & {\n        extends: TParent[\"id\"]\n        properties: MergedCollection<\n          TParent[\"properties\"],\n          OwnCollection<TInput, \"properties\", Property>\n        >\n        links: MergedCollection<TParent[\"links\"], OwnLinks<TInput>>\n      }\n    : TInput extends { extends: infer TParentId extends string }\n      ? {\n          extends: TParentId\n          parents: string[]\n          properties: OwnCollection<TInput, \"properties\", Property>\n          links: OwnLinks<TInput>\n        }\n      : NormalizeParents<TInput> & {\n          extends: undefined\n          properties: OwnCollection<TInput, \"properties\", Property>\n          links: OwnLinks<TInput>\n        })\n\ntype DefineObjectTypeWithTokensResult<TInput extends DefineObjectTypeInput> = ObjectTypeWithTokens<\n  DefineObjectTypeResult<TInput>\n>\n\n/**\n * Define an object type with sensible defaults.\n *\n * `properties` and `links` default to `[]` so you can define\n * a bare object type with just `id` and `name`.\n */\nexport function defineObjectType<const TInput extends DefineObjectTypeInput>(\n  input: TInput\n): DefineObjectTypeWithTokensResult<TInput>\nexport function defineObjectType(input: DefineObjectTypeInput): ObjectTypeWithTokens<ObjectType> {\n  const ext = input.extends\n\n  const ownProperties = input.properties ? [...input.properties] : []\n  const ownLinks = input.links\n    ? input.links.map((link) => normalizeSelfLinkTarget(input.id, link))\n    : []\n\n  let extendsId: string | undefined\n  let parentIds: string[] | undefined\n  let properties: Property[]\n  let links: ObjectLink[]\n\n  if (typeof ext === \"string\") {\n    // Pre-flattened: string extends — no merge, properties/links taken as-is\n    extendsId = ext\n    parentIds = [ext, ...(input.parents ?? []).filter((id) => id !== ext)]\n    properties = ownProperties\n    links = ownLinks\n  } else if (ext != null) {\n    // Object extends — merge parent collections\n    extendsId = ext.id\n    parentIds = [ext.id, ...(input.parents ?? []).filter((id) => id !== ext.id)]\n    properties = mergeById(ext.properties, ownProperties)\n    links = mergeById([...ext.links], ownLinks)\n  } else {\n    // No extends\n    extendsId = undefined\n    parentIds = input.parents ? [...input.parents] : undefined\n    properties = ownProperties\n    links = ownLinks\n  }\n\n  const objectType: ObjectType = {\n    id: input.id,\n    name: input.name,\n    description: input.description,\n    quantityKind: input.quantityKind,\n    seeAlso: input.seeAlso,\n    extends: extendsId,\n    parents: parentIds,\n    implements: input.implements,\n    properties,\n    links,\n    search: input.search,\n    query: input.query,\n  }\n\n  return {\n    ...objectType,\n    l: createLinkTokenMap(objectType),\n    p: createPropertyTokenMap(objectType),\n  }\n}\n\nfunction normalizeSelfLinkTarget(objectTypeId: string, link: ObjectLink): ObjectLink {\n  if (link.targetObjectTypeId !== selfLinkTargetObjectTypeId) {\n    return link\n  }\n\n  return {\n    ...link,\n    targetObjectTypeId: objectTypeId,\n  }\n}\n\n// ── Ontology ────────────────────────────────────────────────\n\ntype DefineOntologyBase = Omit<Ontology, \"objectTypes\" | \"valueTypes\" | \"interfaces\">\n\ntype DefineOntologyInput = DefineOntologyBase & {\n  objectTypes?: readonly ObjectType[]\n  valueTypes?: readonly ValueType[]\n  interfaces?: readonly Interface[]\n}\n\ntype DefineOntologyResult<TInput extends DefineOntologyInput> = Omit<\n  TInput,\n  \"objectTypes\" | \"valueTypes\" | \"interfaces\"\n> & {\n  objectTypes: TInput extends { objectTypes: infer TObjectTypes extends readonly ObjectType[] }\n    ? [...TObjectTypes]\n    : []\n  valueTypes: TInput extends { valueTypes: infer TValueTypes extends readonly ValueType[] }\n    ? [...TValueTypes]\n    : []\n  interfaces: TInput extends { interfaces: infer TInterfaces extends readonly Interface[] }\n    ? [...TInterfaces]\n    : []\n}\n\n/**\n * Define a complete ontology document.\n *\n * `objectTypes`, `valueTypes`, and `interfaces` default to `[]`.\n */\nexport function defineOntology<const TInput extends DefineOntologyInput>(\n  input: TInput\n): DefineOntologyResult<TInput>\nexport function defineOntology(input: DefineOntologyInput): Ontology {\n  return {\n    ...input,\n    objectTypes: input.objectTypes ? [...input.objectTypes] : [],\n    valueTypes: input.valueTypes ? [...input.valueTypes] : [],\n    interfaces: input.interfaces ? [...input.interfaces] : [],\n  }\n}\n\n// ── Value Type ──────────────────────────────────────────────\n\n/**\n * Define a reusable value type.\n *\n * Identity function for type inference and discoverability — the `define*`\n * prefix makes it easy to find all ontology builders.\n */\nexport function defineValueType<const TValueType extends ValueType>(input: TValueType): TValueType {\n  return input\n}\n\n// ── Interface ───────────────────────────────────────────────\n\ntype DefineInterfaceBase = Omit<Interface, \"properties\" | \"links\">\n\ntype DefineInterfaceInput = DefineInterfaceBase & {\n  properties?: readonly Property[]\n  links?: readonly ObjectLink[]\n}\n\ntype DefineInterfaceResult<TInput extends DefineInterfaceInput> = Omit<\n  TInput,\n  \"properties\" | \"links\"\n> & {\n  properties: TInput extends { properties: infer TProperties extends readonly Property[] }\n    ? [...TProperties]\n    : []\n  links: TInput extends { links: infer TLinks extends readonly ObjectLink[] } ? [...TLinks] : []\n}\n\n/**\n * Define a reusable interface contract.\n *\n * `properties` and `links` default to `[]`.\n */\nexport function defineInterface<const TInput extends DefineInterfaceInput>(\n  input: TInput\n): DefineInterfaceResult<TInput>\nexport function defineInterface(input: DefineInterfaceInput): Interface {\n  return {\n    ...input,\n    properties: input.properties ? [...input.properties] : [],\n    links: input.links ? [...input.links] : [],\n  }\n}\n\n// ── Property shorthand ──────────────────────────────────────\n\ntype PropertyOptions = {\n  name?: string\n  description?: string\n  required?: boolean\n  nullable?: boolean\n  primary?: true\n  mode?: PropertyMode\n  semanticType?: QuantitativeTypeId\n  query?: PropertyQueryMetadata\n  /** Readers need a clearance for every marking to receive this property's value. */\n  markings?: readonly MarkingDefinition[]\n}\n\n/** The property records marking ids; only a declared, non-empty list marks it. */\ntype MarkingsFromOptions<TOptions> = TOptions extends {\n  markings: readonly [MarkingDefinition, ...MarkingDefinition[]]\n}\n  ? { markings: readonly string[] }\n  : { markings?: readonly string[] }\n\ntype PropertyResult<\n  TId extends string,\n  TSchema extends Schema,\n  TOptions extends PropertyOptions | undefined,\n> = {\n  id: TId\n  name: NameFromOptions<TId, TOptions>\n  schema: TSchema\n} & FieldFromOptions<TOptions, \"description\", string> &\n  FieldFromOptions<TOptions, \"required\", boolean> &\n  FieldFromOptions<TOptions, \"nullable\", boolean> &\n  FieldFromOptions<TOptions, \"primary\", true> &\n  FieldFromOptions<TOptions, \"mode\", PropertyMode> &\n  FieldFromOptions<TOptions, \"semanticType\", QuantitativeTypeId> &\n  FieldFromOptions<TOptions, \"query\", PropertyQueryMetadata> &\n  MarkingsFromOptions<TOptions>\n\n/**\n * Shorthand for creating a {@link Property}.\n *\n * `name` defaults to `id` — override via `options.name` when you need\n * a separate display name.\n *\n * ```ts\n * prop(\"currentTemperature\", \"double\", {\n *   name: \"Current Temperature\",\n *   semanticType: \"Temperature\",\n *   required: true,\n * })\n * ```\n */\n// Overloads keep option literals (e.g. `required: true`, `mode: \"telemetry\"`) intact.\nexport function prop<const TId extends string, const TSchema extends Schema>(\n  id: TId,\n  schema: TSchema\n): PropertyResult<TId, TSchema, undefined>\nexport function prop<\n  const TId extends string,\n  const TSchema extends Schema,\n  const TOptions extends PropertyOptions,\n>(id: TId, schema: TSchema, options: TOptions): PropertyResult<TId, TSchema, TOptions>\nexport function prop(id: string, schema: Schema, options?: PropertyOptions): Property {\n  const { markings, ...rest } = options ?? {}\n  return {\n    id,\n    name: options?.name ?? id,\n    schema,\n    ...rest,\n    ...(markings && markings.length > 0\n      ? { markings: markingIdsFrom(markings, `Property '${id}' markings`) }\n      : {}),\n  }\n}\n\n// ── Link shorthand ──────────────────────────────────────────\n\n/**\n * Runtime check: does a value look like an ObjectType?\n *\n * Discriminates ObjectType from LinkOptions by checking for `properties` and `links`\n * arrays — ObjectType always has them, LinkOptions never does.\n */\nfunction isObjectTypeLike(value: unknown): value is ObjectType {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    Array.isArray((value as Record<string, unknown>).properties) &&\n    Array.isArray((value as Record<string, unknown>).links)\n  )\n}\n\ntype LinkOptions = {\n  name?: string\n  description?: string\n  cardinality?: LinkCardinality\n  properties?: Property[]\n}\n\ntype LinkResult<\n  TId extends string,\n  TTargetObjectTypeId,\n  TOptions extends LinkOptions | undefined,\n> = {\n  id: TId\n  name: NameFromOptions<TId, TOptions>\n  targetObjectTypeId: TTargetObjectTypeId\n} & FieldFromOptions<TOptions, \"description\", string> &\n  FieldFromOptions<TOptions, \"cardinality\", LinkCardinality> &\n  FieldFromOptions<TOptions, \"properties\", Property[]>\n\nexport type DirectLinkResult<\n  TId extends string,\n  TTargetObjectTypeId,\n  TOptions extends LinkOptions | undefined,\n  TTarget,\n> = LinkResult<TId, TTargetObjectTypeId, TOptions> & ObjectLinkTargetMetadata<TTarget>\n\ntype ObjectTypeIdArray<TTargets extends readonly ObjectType[]> = Array<TTargets[number][\"id\"]>\n/** Keep profile names without carrying provider types through every linked declaration. */\nexport type DirectLinkTarget<\n  TId extends string,\n  TName extends string,\n  TProperties extends Property[],\n  TVectorProfiles extends string = never,\n> = ObjectTypeWithPropertyTokens<\n  {\n    id: TId\n    name: TName\n    properties: TProperties\n    links: ObjectLink[]\n  } & ([TVectorProfiles] extends [never]\n    ? unknown\n    : { search: { vectors: Record<TVectorProfiles, ObjectVectorSearchProfile> } })\n>\n\ntype DirectLinkTargetFor<TTarget extends ObjectType> = TTarget extends ObjectTypeWithPropertyTokens\n  ? DirectLinkTarget<\n      TTarget[\"id\"],\n      TTarget[\"name\"],\n      TTarget[\"properties\"],\n      TTarget extends { search: { vectors: infer TProfiles } }\n        ? Extract<keyof TProfiles, string>\n        : never\n    >\n  : TTarget\n\n/**\n * Shorthand for creating an {@link ObjectLink}.\n *\n * `link(...)` accepts direct ObjectType targets and preserves their type for\n * query authoring. Use `link.ref(...)` for id-only references, `link.self(...)`\n * for recursive links, and `link.any(...)` for wildcard links.\n *\n * ```ts\n * // ObjectType target — extracts .id at runtime and preserves the target type\n * link(\"controls\", HVACZone, { cardinality: \"one\" })\n *\n * // Id target — resolved by the generated ontology type manifest\n * link.ref(\"controls\", \"hvacZone\", { cardinality: \"one\" })\n *\n * // Self target — normalized to the source object type id by defineObjectType()\n * link.self(\"parent\", { cardinality: \"one\" })\n *\n * // Multiple targets\n * link(\"rel\", [TypeA, TypeB])\n *\n * // Wildcard — accepts any target type\n * link.any(\"anything\")\n * link.any(\"anything\", { cardinality: \"many\" })\n * ```\n */\ninterface LinkCallable {\n  <const TId extends string, const TTarget extends ObjectType>(\n    id: TId,\n    target: TTarget\n  ): DirectLinkResult<TId, TTarget[\"id\"], undefined, DirectLinkTargetFor<TTarget>>\n\n  <const TId extends string, const TTarget extends ObjectType, const TOptions extends LinkOptions>(\n    id: TId,\n    target: TTarget,\n    options: TOptions\n  ): DirectLinkResult<TId, TTarget[\"id\"], TOptions, DirectLinkTargetFor<TTarget>>\n\n  <const TId extends string, const TTargets extends readonly ObjectType[]>(\n    id: TId,\n    targets: TTargets\n  ): DirectLinkResult<\n    TId,\n    ObjectTypeIdArray<TTargets>,\n    undefined,\n    DirectLinkTargetFor<TTargets[number]>\n  >\n\n  <\n    const TId extends string,\n    const TTargets extends readonly ObjectType[],\n    const TOptions extends LinkOptions,\n  >(\n    id: TId,\n    targets: TTargets,\n    options: TOptions\n  ): DirectLinkResult<\n    TId,\n    ObjectTypeIdArray<TTargets>,\n    TOptions,\n    DirectLinkTargetFor<TTargets[number]>\n  >\n}\n\ninterface LinkBuilder extends LinkCallable {\n  ref: typeof linkRef\n  self: typeof linkSelf\n  any: typeof linkAny\n}\n\nconst linkImpl = ((\n  id: string,\n  targetOrTargets: ObjectType | readonly ObjectType[],\n  options?: LinkOptions\n): ObjectLink => {\n  if (Array.isArray(targetOrTargets)) {\n    return {\n      id,\n      name: options?.name ?? id,\n      targetObjectTypeId: targetOrTargets.map((target) => target.id),\n      ...options,\n    }\n  }\n\n  if (isObjectTypeLike(targetOrTargets)) {\n    return {\n      id,\n      name: options?.name ?? id,\n      targetObjectTypeId: targetOrTargets.id,\n      ...options,\n    }\n  }\n\n  throw new Error(\n    `[Sixb] link(\"${id}\", ...) requires an ObjectType target. Use link.ref(...) for id references, link.self(...) for self-links, or link.any(...) for wildcard links.`\n  )\n}) as LinkCallable\n\nfunction linkRef<\n  const TId extends string,\n  const TTargetObjectTypeId extends string | readonly string[],\n>(id: TId, targetObjectTypeId: TTargetObjectTypeId): LinkResult<TId, TTargetObjectTypeId, undefined>\nfunction linkRef<\n  const TId extends string,\n  const TTargetObjectTypeId extends string | readonly string[],\n  const TOptions extends LinkOptions,\n>(\n  id: TId,\n  targetObjectTypeId: TTargetObjectTypeId,\n  options: TOptions\n): LinkResult<TId, TTargetObjectTypeId, TOptions>\nfunction linkRef(\n  id: string,\n  targetObjectTypeId: string | readonly string[],\n  options?: LinkOptions\n): ObjectLink {\n  return {\n    id,\n    name: options?.name ?? id,\n    targetObjectTypeId:\n      typeof targetObjectTypeId === \"string\" ? targetObjectTypeId : [...targetObjectTypeId],\n    ...options,\n  }\n}\n\nfunction linkSelf<\n  const TId extends string,\n  const TOptions extends LinkOptions | undefined = undefined,\n>(id: TId, options?: TOptions): LinkResult<TId, SelfLinkTargetObjectTypeId, TOptions> {\n  return {\n    id,\n    name: options?.name ?? id,\n    targetObjectTypeId: selfLinkTargetObjectTypeId,\n    ...options,\n  } as LinkResult<TId, SelfLinkTargetObjectTypeId, TOptions>\n}\n\nfunction linkAny<\n  const TId extends string,\n  const TOptions extends LinkOptions | undefined = undefined,\n>(id: TId, options?: TOptions): LinkResult<TId, \"*\", TOptions> {\n  return {\n    id,\n    name: options?.name ?? id,\n    targetObjectTypeId: \"*\",\n    ...options,\n  } as LinkResult<TId, \"*\", TOptions>\n}\n\nexport const link: LinkBuilder = Object.assign(linkImpl, {\n  ref: linkRef,\n  self: linkSelf,\n  any: linkAny,\n})\n\n// ── ValueType ref shorthand ─────────────────────────────────\n\n/**\n * Create a value-type reference schema.\n *\n * ```ts\n * prop(\"azimuth\", valueTypeRef(\"bsh:AzimuthShape\"))\n * prop(\"area\", valueTypeRef(AreaShape))  // self-contained, no tuple needed\n * ```\n */\n// 1. String id only (existing behavior, no resolution)\nexport function valueTypeRef<const TId extends string>(\n  valueTypeId: TId\n): ValueTypeRefSchema & { valueTypeId: TId }\n// 2. ValueType object (concise, self-contained: carries the schema and the semantic type)\nexport function valueTypeRef<const TVT extends ValueType>(\n  valueType: TVT\n): TVT extends { semanticType: infer TSemanticType extends QuantitativeTypeId }\n  ? {\n      type: \"valueTypeRef\"\n      valueTypeId: TVT[\"id\"]\n      _resolved: TVT[\"schema\"]\n      _semanticType: TSemanticType\n    }\n  : { type: \"valueTypeRef\"; valueTypeId: TVT[\"id\"]; _resolved: TVT[\"schema\"] }\n// 3. String id + explicit schema (escape hatch)\nexport function valueTypeRef<const TId extends string, const TResolved extends Schema>(\n  valueTypeId: TId,\n  resolved: TResolved\n): { type: \"valueTypeRef\"; valueTypeId: TId; _resolved: TResolved }\n// Implementation\nexport function valueTypeRef(\n  idOrValueType: string | ValueType,\n  resolved?: Schema\n): ValueTypeRefSchema {\n  if (typeof idOrValueType === \"string\") {\n    if (resolved !== undefined) {\n      return { type: \"valueTypeRef\", valueTypeId: idOrValueType, _resolved: resolved }\n    }\n    return { type: \"valueTypeRef\", valueTypeId: idOrValueType }\n  }\n  return {\n    type: \"valueTypeRef\",\n    valueTypeId: idOrValueType.id,\n    _resolved: idOrValueType.schema,\n    ...(idOrValueType.semanticType === undefined\n      ? {}\n      : { _semanticType: idOrValueType.semanticType }),\n  }\n}\n\n// ── Enum helpers ────────────────────────────────────────────\n\n/**\n * Create a string enum schema.\n *\n * ```ts\n * prop(\"mode\", stringEnum([\"off\", \"heat\", \"cool\", \"auto\"]))\n * ```\n */\nexport function stringEnum<const V extends readonly string[]>(\n  values: V\n): EnumSchema & {\n  values: [...V]\n} {\n  return { type: \"enum\", valueType: \"string\", values: [...values] }\n}\n\n/**\n * Create an integer enum schema.\n *\n * ```ts\n * prop(\"fanSpeed\", integerEnum([1, 2, 3]))\n * ```\n */\nexport function integerEnum<const V extends readonly number[]>(\n  values: V\n): EnumSchema & {\n  values: [...V]\n} {\n  return { type: \"enum\", valueType: \"integer\", values: [...values] }\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;AAGO,SAAS,sBAAsB,CACpC,UACqD;AAAA,EACrD,MAAM,WAAsD,OAAO,OAAO,IAAI;AAAA,EAC9E,YAAY,MAAM,sBAAsB,OAAO,QAAQ,QAAQ,GAAG;AAAA,IAChE,QAAQ,YAAY,SAAS,eAAe,kBAAkB;AAAA,IAC9D,SAAS,QAAQ,OAAO,OAAO;AAAA,MAC7B,QAAQ,OAAO,OAAO,CAAC,GAAG,kBAAkB,MAAM,CAAC;AAAA,MACnD,OAAO,OAAO,OAAO;AAAA,QACnB;AAAA,QACA;AAAA,QACA,YAAY,OAAO,OAAO;AAAA,UACxB,MAAM;AAAA,UACN;AAAA,UACA;AAAA,UACA,YAAY,WAAW;AAAA,aACnB,WAAW,YAAY,EAAE,WAAW,WAAW,UAAU,IAAI,CAAC;AAAA,aAC9D,WAAW,iBACX;AAAA,YACE,gBAAgB,OAAO,OAAO;AAAA,cAC5B,MAAM,WAAW,eAAe;AAAA,iBAC5B,WAAW,eAAe,YAAY,YACtC,CAAC,IACD,EAAE,SAAS,WAAW,eAAe,QAAQ;AAAA,YACnD,CAAC;AAAA,UACH,IACA,CAAC;AAAA,QACP,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EACA,OAAO,OAAO,OAAO,QAAQ;AAAA;;;ACyB/B,SAAS,wBAAwB,CAC/B,QACiE;AAAA,EACjE,OAAO,iBAAiB;AAAA;AAc1B,SAAS,2BAA2B,CAClC,QACA,WACA,MACM;AAAA,EACN,IAAI,OAAO,WAAW;AAAA,IAAU;AAAA,EAEhC,IAAI,OAAO,SAAS,gBAAgB;AAAA,IAClC,IAAI,OAAO,aAAa,CAAC,KAAK,IAAI,OAAO,WAAW,GAAG;AAAA,MACrD,KAAK,IAAI,OAAO,WAAW;AAAA,MAC3B,MAAM,YAAY,OAAO,YAAY,SAAS,GAAG,IAC7C,OAAO,YAAY,MAAM,OAAO,YAAY,QAAQ,GAAG,IAAI,CAAC,IAC5D,OAAO;AAAA,MACX,UAAU,IAAI,OAAO,aAAa;AAAA,QAChC,IAAI,OAAO;AAAA,QACX,MAAM;AAAA,QACN,QAAQ,OAAO;AAAA,WACX,OAAO,kBAAkB,YAAY,CAAC,IAAI,EAAE,cAAc,OAAO,cAAc;AAAA,MACrF,CAAC;AAAA,MACD,4BAA4B,OAAO,WAAW,WAAW,IAAI;AAAA,IAC/D;AAAA,IACA;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,SAAS,UAAU;AAAA,IAC5B,WAAW,SAAS,OAAO,OAAO,OAAO,UAAU,GAAG;AAAA,MACpD,4BAA4B,MAAM,QAAQ,WAAW,IAAI;AAAA,IAC3D;AAAA,IACA;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,SAAS,SAAS;AAAA,IAC3B,4BAA4B,OAAO,OAAO,WAAW,IAAI;AAAA,IACzD;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,SAAS,OAAO;AAAA,IACzB,4BAA4B,OAAO,aAAa,WAAW,IAAI;AAAA,EACjE;AAAA;AAGF,SAAS,eAAe,CAAC,SAGvB;AAAA,EACA,MAAM,cAA8C,CAAC;AAAA,EACrD,MAAM,aAA0B,CAAC;AAAA,EACjC,MAAM,kBAAkB,IAAI;AAAA,EAE5B,WAAW,UAAU,SAAS;AAAA,IAC5B,IAAI,yBAAyB,MAAM,GAAG;AAAA,MACpC,WAAW,MAAM,OAAO,aAAa;AAAA,QACnC,IAAI,CAAC,gBAAgB,IAAI,EAAE,GAAG;AAAA,UAC5B,gBAAgB,IAAI,EAAE;AAAA,UACtB,YAAY,KAAK,EAAE;AAAA,QACrB;AAAA,MACF;AAAA,MACA,WAAW,KAAK,GAAI,OAAO,cAAc,CAAC,CAAE;AAAA,IAC9C,EAAO;AAAA,MACL,IAAI,CAAC,gBAAgB,IAAI,MAAM,GAAG;AAAA,QAChC,gBAAgB,IAAI,MAAM;AAAA,QAC1B,YAAY,KAAK,MAAM;AAAA,MACzB;AAAA;AAAA,EAEJ;AAAA,EAIA,MAAM,cAAc,IAAI,IAAI,WAAW,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;AAAA,EACzD,MAAM,aAAa,IAAI;AAAA,EAEvB,WAAW,cAAc,aAAa;AAAA,IACpC,WAAW,YAAY,WAAW,YAAY;AAAA,MAC5C,4BAA4B,SAAS,QAAQ,YAAY,WAAW;AAAA,IACtE;AAAA,IACA,WAAW,WAAW,WAAW,OAAO;AAAA,MACtC,IAAI,QAAQ,YAAY;AAAA,QACtB,WAAW,YAAY,QAAQ,YAAY;AAAA,UACzC,4BAA4B,SAAS,QAAQ,YAAY,WAAW;AAAA,QACtE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,WAAW,KAAK,GAAG,WAAW,OAAO,CAAC;AAAA,EAEtC,OAAO,EAAE,aAAa,WAAW;AAAA;AAAA;AAc5B,MAAM,kBAAsD;AAAA,EAChD,kBAAkB,IAAI;AAAA,EACtB,iBAAiB,IAAI;AAAA,EACrB,eAAe,IAAI;AAAA,EACnB;AAAA,EAEjB,WAAW,CAAC,SAAkC;AAAA,IAC5C,QAAQ,aAAa,eAAe,gBAAgB,QAAQ,OAAO;AAAA,IAEnE,WAAW,cAAc,aAAa;AAAA,MACpC,IAAI,KAAK,gBAAgB,IAAI,WAAW,EAAE,GAAG;AAAA,QAC3C,MAAM,IAAI,yBAAwB,6BAA6B,WAAW,IAAI;AAAA,MAChF;AAAA,MACA,KAAK,gBAAgB,IAAI,WAAW,IAAI,UAAU;AAAA,IACpD;AAAA,IAEA,WAAW,aAAa,YAAY;AAAA,MAClC,IAAI,KAAK,eAAe,IAAI,UAAU,EAAE,GAAG;AAAA,QACzC,MAAM,IAAI,yBAAwB,4BAA4B,UAAU,IAAI;AAAA,MAC9E;AAAA,MACA,KAAK,eAAe,IAAI,UAAU,IAAI,SAAS;AAAA,IACjD;AAAA,IAEA,KAAK,gCAAgC;AAAA,IACrC,KAAK,2BAA2B;AAAA,IAChC,6BAA4B,KAAK,iBAAiB,KAAK,cAAc;AAAA,IACrE,uBAAsB,KAAK,iBAAiB,KAAK,cAAc;AAAA,IAC/D,YAAY,IAAI,SAAS,KAAK,iBAAiB;AAAA,MAC7C,IAAI,KAAK,QAAQ;AAAA,QACf,KAAK,gBAAgB,IAAI,IAAI;AAAA,aACxB;AAAA,UACH,QAAQ,KAAK,KAAK,QAAQ,SAAS,uBAAuB,KAAK,OAAO,OAAO,EAAE;AAAA,QACjF,CAAC;AAAA,IACL;AAAA,IACA,KAAK,kBAAkB,2BAA0B,KAAK,eAAe;AAAA;AAAA,EAMvE,eAAe,GAA4C;AAAA,IACzD,OAAO,CAAC,GAAG,KAAK,gBAAgB,OAAO,CAAC;AAAA;AAAA,EAI1C,iBAAiB,CAAC,cAA2D;AAAA,IAC3E,OAAO,KAAK,gBAAgB,IAAI,YAAY,KAAK;AAAA;AAAA,EASnD,iBAAiB,CAAC,cAAoD;AAAA,IACpE,MAAM,aAAa,KAAK,gBAAgB,IAAI,YAAY;AAAA,IACxD,IAAI,CAAC,YAAY;AAAA,MACf,MAAM,IAAI,uBAAsB,+BAA+B,YAAY,CAAC;AAAA,IAC9E;AAAA,IACA,OAAO;AAAA;AAAA,EAIT,oBAAoB,CAAC,cAA8B;AAAA,IACjD,MAAM,KAAK,KAAK,gBAAgB,IAAI,YAAY;AAAA,IAChD,IAAI,CAAC;AAAA,MAAI,MAAM,IAAI,uBAAsB,+BAA+B,YAAY,CAAC;AAAA,IACrF,OAAO;AAAA;AAAA,EAIT,YAAY,CAAC,cAAgC;AAAA,IAC3C,MAAM,SAAmB,CAAC;AAAA,IAC1B,MAAM,UAAU,CAAC,WAAyB;AAAA,MACxC,MAAM,WAAW,KAAK,aAAa,IAAI,MAAM;AAAA,MAC7C,IAAI,CAAC;AAAA,QAAU;AAAA,MACf,WAAW,WAAW,UAAU;AAAA,QAC9B,OAAO,KAAK,OAAO;AAAA,QACnB,QAAQ,OAAO;AAAA,MACjB;AAAA;AAAA,IAEF,QAAQ,YAAY;AAAA,IACpB,OAAO;AAAA;AAAA,EAIT,iBAAiB,CAAC,YAAiE;AAAA,IACjF,MAAM,QAAwC,CAAC;AAAA,IAC/C,IAAI,UAA+C,KAAK,kBAAkB,WAAW,EAAE;AAAA,IACvF,MAAM,OAAO,IAAI;AAAA,IAEjB,OAAO,SAAS;AAAA,MACd,IAAI,KAAK,IAAI,QAAQ,EAAE,GAAG;AAAA,QACxB,MAAM,IAAI,yBACR,kEAAkE,WAAW,MAC/E;AAAA,MACF;AAAA,MACA,KAAK,IAAI,QAAQ,EAAE;AAAA,MACnB,MAAM,KAAK,OAAO;AAAA,MAClB,UAAU,QAAQ,UAAU,KAAK,kBAAkB,QAAQ,OAAO,IAAI;AAAA,IACxE;AAAA,IAEA,OAAO,MAAM,QAAQ;AAAA;AAAA,EASvB,iBAAiB,CAAC,UAA6B,QAAyB;AAAA,IACtE,IAAI,aAAa;AAAA,MAAK,OAAO;AAAA,IAC7B,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ;AAAA,IAC5D,IAAI,MAAM,SAAS,GAAG;AAAA,MAAG,OAAO;AAAA,IAChC,WAAW,QAAQ,OAAO;AAAA,MACxB,IAAI,WAAW,QAAQ,KAAK,aAAa,IAAI,EAAE,SAAS,MAAM;AAAA,QAAG,OAAO;AAAA,IAC1E;AAAA,IACA,OAAO;AAAA;AAAA,EAMT,kBAAkB,GAAsD;AAAA,IACtE,OAAO,KAAK;AAAA;AAAA,EAId,iBAAiB,GAAmC;AAAA,IAClD,OAAO,KAAK;AAAA;AAAA,EAId,kBAAkB,GAAgC;AAAA,IAChD,OAAO,KAAK;AAAA;AAAA,EAUN,+BAA+B,GAAS;AAAA,IAC9C,MAAM,YAAY,IAAI;AAAA,IACtB,MAAM,WAAW,IAAI;AAAA,IAErB,MAAM,gBAAgB,CAAC,UAAkB,YAA0B;AAAA,MACjE,IAAI,WAAW,KAAK,aAAa,IAAI,QAAQ;AAAA,MAC7C,IAAI,CAAC,UAAU;AAAA,QACb,WAAW,IAAI;AAAA,QACf,KAAK,aAAa,IAAI,UAAU,QAAQ;AAAA,MAC1C;AAAA,MACA,SAAS,IAAI,OAAO;AAAA;AAAA,IAGtB,MAAM,QAAQ,CAAC,QAAgB,UAA0B;AAAA,MACvD,IAAI,SAAS,IAAI,MAAM;AAAA,QAAG;AAAA,MAE1B,MAAM,aAAa,KAAK,gBAAgB,IAAI,MAAM;AAAA,MAClD,IAAI,CAAC,cAAc,CAAC,WAAW,SAAS;AAAA,QACtC,SAAS,IAAI,MAAM;AAAA,QACnB;AAAA,MACF;AAAA,MAEA,MAAM,WAAW,WAAW;AAAA,MAE5B,IAAI,CAAC,KAAK,gBAAgB,IAAI,QAAQ,GAAG;AAAA,QACvC,MAAM,IAAI,yBACR,eAAe,iCAAiC,kBAAkB,oFACpE;AAAA,MACF;AAAA,MAEA,IAAI,UAAU,IAAI,MAAM,GAAG;AAAA,QACzB,MAAM,IAAI,yBACR,oCAAoC,CAAC,GAAG,OAAO,MAAM,EAAE,KAAK,UAAK,GACnE;AAAA,MACF;AAAA,MAEA,UAAU,IAAI,MAAM;AAAA,MACpB,MAAM,UAAU,CAAC,GAAG,OAAO,MAAM,CAAC;AAAA,MAElC,cAAc,UAAU,MAAM;AAAA,MAE9B,UAAU,OAAO,MAAM;AAAA,MACvB,SAAS,IAAI,MAAM;AAAA;AAAA,IAGrB,WAAW,UAAU,KAAK,gBAAgB,KAAK,GAAG;AAAA,MAChD,MAAM,QAAQ,CAAC,CAAC;AAAA,IAClB;AAAA,IAEA,YAAY,QAAQ,eAAe,KAAK,iBAAiB;AAAA,MACvD,IAAI,CAAC,WAAW;AAAA,QAAS;AAAA,MACzB,WAAW,YAAY,WAAW,SAAS;AAAA,QACzC,IAAI,aAAa,WAAW;AAAA,UAAS;AAAA,QACrC,IAAI,CAAC,KAAK,gBAAgB,IAAI,QAAQ,GAAG;AAAA,UACvC,MAAM,IAAI,yBACR,eAAe,iCAAiC,6BAA6B,oFAC/E;AAAA,QACF;AAAA,QACA,cAAc,UAAU,MAAM;AAAA,MAChC;AAAA,IACF;AAAA;AAAA,EAOM,0BAA0B,GAAS;AAAA,IACzC,MAAM,WAAW,IAAI;AAAA,IAErB,MAAM,UAAU,CAAC,WAAyB;AAAA,MACxC,IAAI,SAAS,IAAI,MAAM;AAAA,QAAG;AAAA,MAC1B,MAAM,aAAa,KAAK,gBAAgB,IAAI,MAAM;AAAA,MAElD,IAAI,CAAC,WAAW,SAAS;AAAA,QACvB,SAAS,IAAI,MAAM;AAAA,QACnB;AAAA,MACF;AAAA,MAEA,QAAQ,WAAW,OAAO;AAAA,MAC1B,MAAM,SAAS,KAAK,gBAAgB,IAAI,WAAW,OAAO;AAAA,MAE1D,MAAM,YAAY,CAChB,aACA,eACQ;AAAA,QACR,MAAM,WAAW,IAAI,IAAI,WAAW,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AAAA,QAC1D,MAAM,aAAa,YAAY,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;AAAA,QACtE,OAAO,CAAC,GAAG,YAAY,GAAG,UAAU;AAAA;AAAA,MAGtC,MAAM,mBAAmB,UAAU,OAAO,YAAY,WAAW,UAAU;AAAA,MAC3E,MAAM,cAAc,UAAU,OAAO,OAAO,WAAW,KAAK;AAAA,MAE5D,MAAM,UACJ,iBAAiB,WAAW,WAAW,WAAW,UAClD,YAAY,WAAW,WAAW,MAAM;AAAA,MAE1C,IAAI,SAAS;AAAA,QACX,MAAM,SAAqB;AAAA,aACtB;AAAA,UACH,YAAY;AAAA,UACZ,OAAO;AAAA,QACT;AAAA,QACA,MAAM,aAA2C;AAAA,aAC5C;AAAA,UACH,GAAG,wBAAuB,MAAM;AAAA,QAClC;AAAA,QACE,WAA6D,IAC7D,oBAAmB,MAAM;AAAA,QAC3B,KAAK,gBAAgB,IAAI,QAAQ,UAAU;AAAA,MAC7C;AAAA,MAEA,SAAS,IAAI,MAAM;AAAA;AAAA,IAGrB,WAAW,UAAU,KAAK,gBAAgB,KAAK,GAAG;AAAA,MAChD,QAAQ,MAAM;AAAA,IAChB;AAAA;AAEJ;;ACrXA,IAAM,6BAA6B;AAuCnC,SAAS,SAAmC,CAAC,QAAsB,OAA0B;AAAA,EAC3F,MAAM,WAAW,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AAAA,EACrD,MAAM,aAAa,OAAO,OAAO,CAAC,SAAS,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;AAAA,EACjE,OAAO,CAAC,GAAG,YAAY,GAAG,KAAK;AAAA;AAiF1B,SAAS,iBAAgB,CAAC,OAAgE;AAAA,EAC/F,MAAM,MAAM,MAAM;AAAA,EAElB,MAAM,gBAAgB,MAAM,aAAa,CAAC,GAAG,MAAM,UAAU,IAAI,CAAC;AAAA,EAClE,MAAM,WAAW,MAAM,QACnB,MAAM,MAAM,IAAI,CAAC,SAAS,wBAAwB,MAAM,IAAI,IAAI,CAAC,IACjE,CAAC;AAAA,EAEL,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI;AAAA,EAEJ,IAAI,OAAO,QAAQ,UAAU;AAAA,IAE3B,YAAY;AAAA,IACZ,YAAY,CAAC,KAAK,IAAI,MAAM,WAAW,CAAC,GAAG,OAAO,CAAC,OAAO,OAAO,GAAG,CAAC;AAAA,IACrE,aAAa;AAAA,IACb,QAAQ;AAAA,EACV,EAAO,SAAI,OAAO,MAAM;AAAA,IAEtB,YAAY,IAAI;AAAA,IAChB,YAAY,CAAC,IAAI,IAAI,IAAI,MAAM,WAAW,CAAC,GAAG,OAAO,CAAC,OAAO,OAAO,IAAI,EAAE,CAAC;AAAA,IAC3E,aAAa,UAAU,IAAI,YAAY,aAAa;AAAA,IACpD,QAAQ,UAAU,CAAC,GAAG,IAAI,KAAK,GAAG,QAAQ;AAAA,EAC5C,EAAO;AAAA,IAEL,YAAY;AAAA,IACZ,YAAY,MAAM,UAAU,CAAC,GAAG,MAAM,OAAO,IAAI;AAAA,IACjD,aAAa;AAAA,IACb,QAAQ;AAAA;AAAA,EAGV,MAAM,aAAyB;AAAA,IAC7B,IAAI,MAAM;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM;AAAA,IACpB,SAAS,MAAM;AAAA,IACf,SAAS;AAAA,IACT,SAAS;AAAA,IACT,YAAY,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,EACf;AAAA,EAEA,OAAO;AAAA,OACF;AAAA,IACH,GAAG,oBAAmB,UAAU;AAAA,IAChC,GAAG,wBAAuB,UAAU;AAAA,EACtC;AAAA;AAGF,SAAS,uBAAuB,CAAC,cAAsB,MAA8B;AAAA,EACnF,IAAI,KAAK,uBAAuB,4BAA4B;AAAA,IAC1D,OAAO;AAAA,EACT;AAAA,EAEA,OAAO;AAAA,OACF;AAAA,IACH,oBAAoB;AAAA,EACtB;AAAA;AAoCK,SAAS,eAAc,CAAC,OAAsC;AAAA,EACnE,OAAO;AAAA,OACF;AAAA,IACH,aAAa,MAAM,cAAc,CAAC,GAAG,MAAM,WAAW,IAAI,CAAC;AAAA,IAC3D,YAAY,MAAM,aAAa,CAAC,GAAG,MAAM,UAAU,IAAI,CAAC;AAAA,IACxD,YAAY,MAAM,aAAa,CAAC,GAAG,MAAM,UAAU,IAAI,CAAC;AAAA,EAC1D;AAAA;AAWK,SAAS,gBAAmD,CAAC,OAA+B;AAAA,EACjG,OAAO;AAAA;AA8BF,SAAS,gBAAe,CAAC,OAAwC;AAAA,EACtE,OAAO;AAAA,OACF;AAAA,IACH,YAAY,MAAM,aAAa,CAAC,GAAG,MAAM,UAAU,IAAI,CAAC;AAAA,IACxD,OAAO,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK,IAAI,CAAC;AAAA,EAC3C;AAAA;AAkEK,SAAS,KAAI,CAAC,IAAY,QAAgB,SAAqC;AAAA,EACpF,QAAQ,aAAa,SAAS,WAAW,CAAC;AAAA,EAC1C,OAAO;AAAA,IACL;AAAA,IACA,MAAM,SAAS,QAAQ;AAAA,IACvB;AAAA,OACG;AAAA,OACC,YAAY,SAAS,SAAS,IAC9B,EAAE,UAAU,eAAe,UAAU,aAAa,cAAc,EAAE,IAClE,CAAC;AAAA,EACP;AAAA;AAWF,SAAS,gBAAgB,CAAC,OAAqC;AAAA,EAC7D,OACE,OAAO,UAAU,YACjB,UAAU,QACV,MAAM,QAAS,MAAkC,UAAU,KAC3D,MAAM,QAAS,MAAkC,KAAK;AAAA;AAgI1D,IAAM,WAAY,CAChB,IACA,iBACA,YACe;AAAA,EACf,IAAI,MAAM,QAAQ,eAAe,GAAG;AAAA,IAClC,OAAO;AAAA,MACL;AAAA,MACA,MAAM,SAAS,QAAQ;AAAA,MACvB,oBAAoB,gBAAgB,IAAI,CAAC,WAAW,OAAO,EAAE;AAAA,SAC1D;AAAA,IACL;AAAA,EACF;AAAA,EAEA,IAAI,iBAAiB,eAAe,GAAG;AAAA,IACrC,OAAO;AAAA,MACL;AAAA,MACA,MAAM,SAAS,QAAQ;AAAA,MACvB,oBAAoB,gBAAgB;AAAA,SACjC;AAAA,IACL;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,MACR,gBAAgB,mJAClB;AAAA;AAgBF,SAAS,OAAO,CACd,IACA,oBACA,SACY;AAAA,EACZ,OAAO;AAAA,IACL;AAAA,IACA,MAAM,SAAS,QAAQ;AAAA,IACvB,oBACE,OAAO,uBAAuB,WAAW,qBAAqB,CAAC,GAAG,kBAAkB;AAAA,OACnF;AAAA,EACL;AAAA;AAGF,SAAS,QAGR,CAAC,IAAS,SAA2E;AAAA,EACpF,OAAO;AAAA,IACL;AAAA,IACA,MAAM,SAAS,QAAQ;AAAA,IACvB,oBAAoB;AAAA,OACjB;AAAA,EACL;AAAA;AAGF,SAAS,OAGR,CAAC,IAAS,SAAoD;AAAA,EAC7D,OAAO;AAAA,IACL;AAAA,IACA,MAAM,SAAS,QAAQ;AAAA,IACvB,oBAAoB;AAAA,OACjB;AAAA,EACL;AAAA;AAGK,IAAM,QAAoB,OAAO,OAAO,UAAU;AAAA,EACvD,KAAK;AAAA,EACL,MAAM;AAAA,EACN,KAAK;AACP,CAAC;AAiCM,SAAS,aAAY,CAC1B,eACA,UACoB;AAAA,EACpB,IAAI,OAAO,kBAAkB,UAAU;AAAA,IACrC,IAAI,aAAa,WAAW;AAAA,MAC1B,OAAO,EAAE,MAAM,gBAAgB,aAAa,eAAe,WAAW,SAAS;AAAA,IACjF;AAAA,IACA,OAAO,EAAE,MAAM,gBAAgB,aAAa,cAAc;AAAA,EAC5D;AAAA,EACA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa,cAAc;AAAA,IAC3B,WAAW,cAAc;AAAA,OACrB,cAAc,iBAAiB,YAC/B,CAAC,IACD,EAAE,eAAe,cAAc,aAAa;AAAA,EAClD;AAAA;AAYK,SAAS,WAA6C,CAC3D,QAGA;AAAA,EACA,OAAO,EAAE,MAAM,QAAQ,WAAW,UAAU,QAAQ,CAAC,GAAG,MAAM,EAAE;AAAA;AAU3D,SAAS,YAA8C,CAC5D,QAGA;AAAA,EACA,OAAO,EAAE,MAAM,QAAQ,WAAW,WAAW,QAAQ,CAAC,GAAG,MAAM,EAAE;AAAA;",
+  "debugId": "1FDC7067D5F81E0664756E2164756E21",
+  "names": []
+}

package/dist/{chunk-rb143ggb.js → chunk-bwjcehza.js}

@@ -2,7 +2,7 @@
 import {
   getDatasetSequenceValidationError,
   getDatasetRowValidationError2
-} from "./chunk-cd234ba4.js";
+} from "./chunk-rz53yb4v.js";
 import {
   isPlainRecord
 } from "./chunk-wy0qdqfm.js";

package/dist/{chunk-t9shqx3w.js → chunk-d0eb5yy6.js}

@@ -3,20 +3,156 @@ import {
   AuthStorageError2,
   SYSTEM_PRINCIPAL2,
   principalsEqual2
-} from "./chunk-svabwqdq.js";
-import {
-  agentServiceAccountId2,
-  resolveAuthorizationContext2
-} from "./chunk-5be2ath4.js";
+} from "./chunk-6h5m9xjx.js";
 import {
   createSixbError2
 } from "./chunk-6fsr7y93.js";
+import {
+  agentServiceAccountId2,
+  AuthorizationError2,
+  resolveAuthorizationContext2
+} from "./chunk-qkbx3tf6.js";
 import {
   findPrimitiveRunExecution,
   findAgentRunExecution
 } from "./chunk-ey1nk510.js";
 
+// src/security/redactions.ts
+function missingClearanceRedactions(ids) {
+  return Object.fromEntries([...ids].map((id) => [id, { reason: "missing_clearance" }]));
+}
+
+// src/objects/property-clearance.ts
+var NO_PROPERTIES = new Set;
+var clearancesByOntology = new WeakMap;
+function resolvePropertyClearance(ontology, clearances) {
+  let resolved = clearancesByOntology.get(ontology);
+  if (!resolved) {
+    resolved = new Map;
+    clearancesByOntology.set(ontology, resolved);
+  }
+  const key = JSON.stringify([...clearances].sort());
+  if (!resolved.has(key))
+    resolved.set(key, createPropertyClearance(ontology, clearances));
+  return resolved.get(key);
+}
+function createPropertyClearance(ontology, clearances) {
+  const missingByType = new Map;
+  for (const objectType of ontology.listObjectTypes()) {
+    const missing = new Map;
+    for (const property of objectType.properties) {
+      const marking = property.markings?.find((markingId) => !clearances.has(markingId));
+      if (marking !== undefined)
+        missing.set(property.id, marking);
+    }
+    if (missing.size > 0)
+      missingByType.set(objectType.id, missing);
+  }
+  if (missingByType.size === 0)
+    return;
+  const hiddenByType = new Map([...missingByType].map(([objectTypeId, missing]) => [objectTypeId, new Set(missing.keys())]));
+  return Object.freeze({
+    hiddenPropertyIds: (objectTypeId) => hiddenByType.get(objectTypeId) ?? NO_PROPERTIES,
+    missingMarking: (objectTypeId, propertyId) => missingByType.get(objectTypeId)?.get(propertyId)
+  });
+}
+function redactObjectRow(row, clearance) {
+  const hidden = clearance.hiddenPropertyIds(row.objectTypeId);
+  const links = row.links;
+  if (hidden.size === 0 && links === undefined)
+    return row;
+  const redacted = { ...row };
+  if (hidden.size > 0) {
+    redacted.properties = withoutKeys(row.properties, hidden);
+    redacted.redactions = missingClearanceRedactions(hidden);
+  }
+  if (links !== undefined) {
+    redacted.links = Object.fromEntries(Object.entries(links).map(([linkId, value]) => [linkId, redactLinkValue(value, clearance)]));
+  }
+  return redacted;
+}
+function redactLinkValue(value, clearance) {
+  if (value === null)
+    return null;
+  if (Array.isArray(value))
+    return value.map((row) => redactObjectRow(row, clearance));
+  return redactObjectRow(value, clearance);
+}
+function redactDomainEvent(event, clearance) {
+  if (event.topic !== "objects")
+    return event;
+  const hidden = clearance.hiddenPropertyIds(event.payload.objectTypeId);
+  if (hidden.size === 0)
+    return event;
+  const payload = {
+    ...event.payload,
+    propertyChanges: withoutKeys(event.payload.propertyChanges, hidden),
+    redactions: missingClearanceRedactions(hidden)
+  };
+  if (event.type === "object.deleted")
+    return { ...event, payload };
+  return {
+    ...event,
+    payload: { ...payload, properties: withoutKeys(event.payload.properties, hidden) }
+  };
+}
+function withoutKeys(record, hidden) {
+  const kept = {};
+  for (const [key, value] of Object.entries(record)) {
+    if (!hidden.has(key))
+      kept[key] = value;
+  }
+  return kept;
+}
+function createClearanceQueryAdmission(clearance) {
+  const reachedTypes = new WeakMap;
+  const state = (objectTypeIds) => {
+    const created = Object.freeze({});
+    reachedTypes.set(created, Object.freeze([...objectTypeIds]));
+    return created;
+  };
+  const reached = (input) => {
+    const objectTypeIds = reachedTypes.get(input);
+    if (!objectTypeIds) {
+      throw new Error("[Sixb] Clearance query admission received a state it did not create.");
+    }
+    return objectTypeIds;
+  };
+  const empty = state([]);
+  const admission = {
+    empty: () => empty,
+    source: (input) => ({ state: state(input.result.objectTypeIds) }),
+    edge: (input) => ({ state: state(input.result.objectTypeIds) }),
+    set: (input) => input.op === "subtract" ? input.states[0] ?? empty : state([...new Set(input.states.flatMap(reached))]),
+    property: (input) => {
+      if (input.use === "project")
+        return;
+      const objectTypeIds = input.objectTypeId === undefined ? reached(input.state) : [input.objectTypeId];
+      for (const objectTypeId of objectTypeIds) {
+        const marking = clearance.missingMarking(objectTypeId, input.propertyId);
+        if (marking === undefined)
+          continue;
+        return new AuthorizationError2(`clearance:marking:${marking}`, `[Sixb] Cannot ${PROPERTY_USE_VERBS[input.use]} '${objectTypeId}.${input.propertyId}' at '${input.path}': it requires clearance for marking '${marking}'.`);
+      }
+      return;
+    }
+  };
+  return Object.freeze(admission);
+}
+var PROPERTY_USE_VERBS = {
+  filter: "filter by",
+  text: "search",
+  vector: "run a vector search over",
+  sort: "sort by",
+  project: "project",
+  "expand.orderBy": "order expanded objects by",
+  facet: "facet by"
+};
+
 // src/agents/authority.ts
+function resolveAgentPropertyClearance2(ontology, authorization) {
+  return authorization.type === "principal" ? resolvePropertyClearance(ontology, authorization.context.clearances ?? new Set) : undefined;
+}
 async function ensureManagedAgentExecutionIdentity2(input) {
   const auth = requireAuthStorage(input.auth);
   const id = agentServiceAccountId2(input.actorId);
@@ -279,6 +415,6 @@ function invalidExecution(executionId, runId) {
   throw new WorkflowRunError2(`[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`);
 }
 
-export { WorkflowRunError2, ensureManagedAgentExecutionIdentity2, resolveAgentExecutionAuthorization2, resolveInheritedAgentExecutionAuthorization2, assertWorkflowRunExecution2, assertWorkflowAgentNodeRunExecution2 };
+export { WorkflowRunError2, missingClearanceRedactions, resolvePropertyClearance, redactObjectRow, redactDomainEvent, createClearanceQueryAdmission, resolveAgentPropertyClearance2, ensureManagedAgentExecutionIdentity2, resolveAgentExecutionAuthorization2, resolveInheritedAgentExecutionAuthorization2, assertWorkflowRunExecution2, assertWorkflowAgentNodeRunExecution2 };
 
-//# debugId=F5DA9E9C95A4C18E64756E2164756E21
+//# debugId=D9BE414225D935D664756E2164756E21

package/dist/chunk-d0eb5yy6.js.map

@@ -0,0 +1,14 @@
+{
+  "version": 3,
+  "sources": ["../src/security/redactions.ts", "../src/objects/property-clearance.ts", "../src/agents/authority.ts", "../src/storage/workflow-runs/errors.ts", "../src/storage/workflow-runs/provider.ts"],
+  "sourcesContent": [
+    "import type { Redactions } from \"./types\"\n\n/** List the values hidden from a reader that lacks a clearance for their markings. */\nexport function missingClearanceRedactions(ids: Iterable<string>): Redactions {\n  return Object.fromEntries([...ids].map((id) => [id, { reason: \"missing_clearance\" }] as const))\n}\n",
+    "import { AuthorizationError } from \"../authorization/errors\"\nimport type { StoredDomainEvent } from \"../events/types\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport { missingClearanceRedactions } from \"../security/redactions\"\nimport type { ExpandedLinkValue, ExpandedObjectRow, ObjectRow } from \"../storage\"\nimport type {\n  ObjectQueryAdmissionState,\n  ObjectQueryPropertyUse,\n  ObjectQuerySemanticAdmission,\n} from \"./query/validate\"\n\n/**\n * The marked properties one reader cannot read, resolved once from its clearances.\n *\n * A property is readable when the reader clears every one of its markings. Unreadable properties\n * are omitted from rows and cannot be used to select, order, or aggregate objects.\n */\nexport interface PropertyClearance {\n  /** Marked properties of this object type the reader cannot read. */\n  hiddenPropertyIds(objectTypeId: string): ReadonlySet<string>\n  /** First marking on the property that the reader is not cleared for. */\n  missingMarking(objectTypeId: string, propertyId: string): string | undefined\n}\n\nconst NO_PROPERTIES: ReadonlySet<string> = new Set()\n\n// Readers are built per execution, but few distinct clearance sets exist per ontology.\nconst clearancesByOntology = new WeakMap<\n  OntologyDefinitionCatalog,\n  Map<string, PropertyClearance | undefined>\n>()\n\n/**\n * Resolve what a reader with these clearances cannot read. Returns `undefined` when it can read\n * every property, so callers skip redaction entirely.\n */\nexport function resolvePropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  clearances: ReadonlySet<string>\n): PropertyClearance | undefined {\n  let resolved = clearancesByOntology.get(ontology)\n  if (!resolved) {\n    resolved = new Map()\n    clearancesByOntology.set(ontology, resolved)\n  }\n  const key = JSON.stringify([...clearances].sort())\n  if (!resolved.has(key)) resolved.set(key, createPropertyClearance(ontology, clearances))\n  return resolved.get(key)\n}\n\nfunction createPropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  clearances: ReadonlySet<string>\n): PropertyClearance | undefined {\n  const missingByType = new Map<string, ReadonlyMap<string, string>>()\n  for (const objectType of ontology.listObjectTypes()) {\n    const missing = new Map<string, string>()\n    for (const property of objectType.properties) {\n      const marking = property.markings?.find((markingId) => !clearances.has(markingId))\n      if (marking !== undefined) missing.set(property.id, marking)\n    }\n    if (missing.size > 0) missingByType.set(objectType.id, missing)\n  }\n  if (missingByType.size === 0) return undefined\n\n  const hiddenByType = new Map(\n    [...missingByType].map(([objectTypeId, missing]) => [objectTypeId, new Set(missing.keys())])\n  )\n  return Object.freeze({\n    hiddenPropertyIds: (objectTypeId: string) => hiddenByType.get(objectTypeId) ?? NO_PROPERTIES,\n    missingMarking: (objectTypeId: string, propertyId: string) =>\n      missingByType.get(objectTypeId)?.get(propertyId),\n  })\n}\n\n/**\n * Omit unreadable properties from a row and the objects expanded under it.\n *\n * Every hidden property of the type is listed in `redactions`, whether or not the row holds a\n * value: listing only present values would reveal which hidden properties are empty.\n */\nexport function redactObjectRow<TRow extends ObjectRow>(\n  row: TRow,\n  clearance: PropertyClearance\n): TRow {\n  const hidden = clearance.hiddenPropertyIds(row.objectTypeId)\n  const links = row.links\n  if (hidden.size === 0 && links === undefined) return row\n\n  const redacted: TRow = { ...row }\n  if (hidden.size > 0) {\n    redacted.properties = withoutKeys(row.properties, hidden)\n    redacted.redactions = missingClearanceRedactions(hidden)\n  }\n  if (links !== undefined) {\n    redacted.links = Object.fromEntries(\n      Object.entries(links).map(([linkId, value]) => [linkId, redactLinkValue(value, clearance)])\n    )\n  }\n  return redacted\n}\n\nfunction redactLinkValue(\n  value: ExpandedLinkValue,\n  clearance: PropertyClearance\n): ExpandedLinkValue {\n  if (value === null) return null\n  if (Array.isArray(value)) return value.map((row) => redactObjectRow(row, clearance))\n  // Array.isArray does not narrow a readonly[] away, so assert the single-object case.\n  return redactObjectRow(value as ExpandedObjectRow, clearance)\n}\n\n/**\n * Omit unreadable properties from an object event, under the same contract as rows. Other events\n * carry no markable value: link properties and telemetry properties cannot be marked.\n */\nexport function redactDomainEvent(\n  event: StoredDomainEvent,\n  clearance: PropertyClearance\n): StoredDomainEvent {\n  if (event.topic !== \"objects\") return event\n  const hidden = clearance.hiddenPropertyIds(event.payload.objectTypeId)\n  if (hidden.size === 0) return event\n\n  const payload = {\n    ...event.payload,\n    propertyChanges: withoutKeys(event.payload.propertyChanges, hidden),\n    redactions: missingClearanceRedactions(hidden),\n  }\n  if (event.type === \"object.deleted\") return { ...event, payload }\n  return {\n    ...event,\n    payload: { ...payload, properties: withoutKeys(event.payload.properties, hidden) },\n  }\n}\n\nfunction withoutKeys<TValue>(\n  record: Readonly<Record<string, TValue>>,\n  hidden: ReadonlySet<string>\n): Record<string, TValue> {\n  const kept: Record<string, TValue> = {}\n  for (const [key, value] of Object.entries(record)) {\n    if (!hidden.has(key)) kept[key] = value\n  }\n  return kept\n}\n\n/**\n * Reject every query use of a property the reader cannot read, except projection.\n *\n * Filtering, ordering, searching, or faceting by a hidden value would reveal it through which\n * objects match and in what order. Projection only shapes the output, which is redacted anyway.\n */\nexport function createClearanceQueryAdmission(\n  clearance: PropertyClearance\n): ObjectQuerySemanticAdmission {\n  // Each state stands for the object types a query has reached so far. A property without an\n  // explicit type is checked against all of them.\n  const reachedTypes = new WeakMap<ObjectQueryAdmissionState, readonly string[]>()\n  const state = (objectTypeIds: readonly string[]): ObjectQueryAdmissionState => {\n    const created = Object.freeze({})\n    reachedTypes.set(created, Object.freeze([...objectTypeIds]))\n    return created\n  }\n  const reached = (input: ObjectQueryAdmissionState): readonly string[] => {\n    const objectTypeIds = reachedTypes.get(input)\n    if (!objectTypeIds) {\n      throw new Error(\"[Sixb] Clearance query admission received a state it did not create.\")\n    }\n    return objectTypeIds\n  }\n  const empty = state([])\n\n  const admission: ObjectQuerySemanticAdmission = {\n    empty: () => empty,\n    source: (input) => ({ state: state(input.result.objectTypeIds) }),\n    edge: (input) => ({ state: state(input.result.objectTypeIds) }),\n    // A difference only returns objects of its first input.\n    set: (input) =>\n      input.op === \"subtract\"\n        ? (input.states[0] ?? empty)\n        : state([...new Set(input.states.flatMap(reached))]),\n    property: (input) => {\n      if (input.use === \"project\") return undefined\n      const objectTypeIds =\n        input.objectTypeId === undefined ? reached(input.state) : [input.objectTypeId]\n      for (const objectTypeId of objectTypeIds) {\n        const marking = clearance.missingMarking(objectTypeId, input.propertyId)\n        if (marking === undefined) continue\n        return new AuthorizationError(\n          `clearance:marking:${marking}`,\n          `[Sixb] Cannot ${PROPERTY_USE_VERBS[input.use]} '${objectTypeId}.${input.propertyId}' at '${input.path}': it requires clearance for marking '${marking}'.`\n        )\n      }\n      return undefined\n    },\n  }\n  return Object.freeze(admission)\n}\n\nconst PROPERTY_USE_VERBS: Readonly<Record<ObjectQueryPropertyUse, string>> = {\n  filter: \"filter by\",\n  text: \"search\",\n  vector: \"run a vector search over\",\n  sort: \"sort by\",\n  project: \"project\",\n  \"expand.orderBy\": \"order expanded objects by\",\n  facet: \"facet by\",\n}\n",
+    "import { principalsEqual, SYSTEM_PRINCIPAL } from \"../auth\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport { resolveAuthorizationContext } from \"../authorization\"\nimport { createSixbError } from \"../errors/internal\"\nimport type { AuthorizablePrincipal, AuthorizationRef } from \"../execution\"\nimport { type PropertyClearance, resolvePropertyClearance } from \"../objects/property-clearance\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport type { SecurityDefinitionCatalog } from \"../security\"\nimport type {\n  AccessTokenRecord,\n  AuthStorage,\n  ServiceAccountGroupMembershipRecord,\n  ServiceAccountRecord,\n  SessionRecord,\n  UserRecord,\n} from \"../storage/auth\"\nimport { AuthStorageError } from \"../storage/auth\"\nimport { agentServiceAccountId } from \"./identity\"\n\nexport type AgentExecutionAuthorization =\n  | { readonly type: \"principal\"; readonly context: AuthorizationContext }\n  | { readonly type: \"disabled\" }\n\n/**\n * The marked properties an Agent execution cannot read, resolved exactly as its object reader\n * resolves them. Disabled authorization reads everything.\n */\nexport function resolveAgentPropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  authorization: AgentExecutionAuthorization\n): PropertyClearance | undefined {\n  return authorization.type === \"principal\"\n    ? resolvePropertyClearance(ontology, authorization.context.clearances ?? new Set())\n    : undefined\n}\n\ntype UserCredentialRef = NonNullable<\n  Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n>\n\ninterface CredentialedUserAuthorizationRef {\n  readonly type: \"principal\"\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"user\" }>\n  readonly credential: UserCredentialRef\n}\n\nexport { agentServiceAccountId } from \"./identity\"\n\nexport interface AgentExecutionIdentity {\n  readonly serviceAccount: ServiceAccountRecord\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"serviceAccount\" }>\n  readonly groupMemberships: readonly ServiceAccountGroupMembershipRecord[]\n}\n\n/** Ensure a framework-managed Agent actor exists with exactly its declared group memberships. */\nexport async function ensureManagedAgentExecutionIdentity(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly name: string\n  readonly description: string\n  readonly groupIds: readonly string[]\n}): Promise<AgentExecutionIdentity> {\n  const auth = requireAuthStorage(input.auth)\n  const id = agentServiceAccountId(input.actorId)\n  const now = new Date()\n  const loaded = await loadOrCreateAgentServiceAccount(auth, {\n    id,\n    projectId: input.projectId,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertFrameworkManagedAgentServiceAccount(input.actorId, loaded)\n  assertActiveAgentServiceAccount(input.actorId, loaded)\n  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {\n    existing: loaded,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertActiveAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: id,\n      groupIds: input.groupIds,\n      source: \"agent\",\n      updatedAt: now,\n    })\n  )\n\n  return {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id },\n    groupMemberships,\n  }\n}\n\n/** Load the managed identity, recovering only the expected concurrent-create race. */\nasync function loadOrCreateAgentServiceAccount(\n  auth: AuthStorage,\n  input: {\n    readonly id: string\n    readonly projectId: string\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  const existing = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: input.id,\n  })\n  if (existing) return existing\n\n  try {\n    return await auth.serviceAccounts.create({\n      id: input.id,\n      projectId: input.projectId,\n      name: input.name,\n      description: input.description,\n      status: \"active\",\n      createdByPrincipal: SYSTEM_PRINCIPAL,\n      createdAt: input.updatedAt,\n      updatedAt: input.updatedAt,\n    })\n  } catch (error) {\n    if (!(error instanceof AuthStorageError) || error.code !== \"duplicate_service_account\") {\n      throw error\n    }\n    const concurrent = await auth.serviceAccounts.getById({\n      projectId: input.projectId,\n      id: input.id,\n    })\n    if (!concurrent) throw error\n    return concurrent\n  }\n}\n\nfunction assertActiveAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (serviceAccount.status === \"suspended\") {\n    throw new Error(\n      `[Sixb] Agent '${actorId}' service account '${serviceAccount.id}' is suspended.`\n    )\n  }\n}\n\nfunction assertFrameworkManagedAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (\n    serviceAccount.createdByPrincipal === undefined ||\n    !principalsEqual(serviceAccount.createdByPrincipal, SYSTEM_PRINCIPAL)\n  ) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' cannot use service account '${serviceAccount.id}' because it is not managed by Sixb.`,\n      { details: { actorId, serviceAccountId: serviceAccount.id } }\n    )\n  }\n}\n\nfunction requireDefinitionOwnedGroupMemberships(\n  actorId: string,\n  memberships: readonly ServiceAccountGroupMembershipRecord[]\n): readonly ServiceAccountGroupMembershipRecord[] {\n  const externalGroupIds = memberships\n    .filter((membership) => membership.source !== \"agent\")\n    .map((membership) => membership.groupId)\n  if (externalGroupIds.length > 0) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' service account has group memberships not managed by its definition: ${externalGroupIds.join(\", \")}.`,\n      { details: { actorId, externalGroupIds } }\n    )\n  }\n  return memberships\n}\n\n/** Resolve current grants for the service account referenced by a durable Agent execution. */\nexport async function resolveAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n}): Promise<{ readonly identity: AgentExecutionIdentity; readonly context: AuthorizationContext }> {\n  const auth = requireAuthStorage(input.auth)\n  const expectedId = agentServiceAccountId(input.actorId)\n  const principal =\n    input.authorizationRef.type === \"principal\" ? input.authorizationRef.principal : null\n  if (principal?.type !== \"serviceAccount\" || principal.id !== expectedId) {\n    throw new Error(\n      `[Sixb] Agent '${input.actorId}' execution authority must reference service account '${expectedId}'.`\n    )\n  }\n\n  const serviceAccount = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: principal.id,\n  })\n  if (!serviceAccount || serviceAccount.status !== \"active\") {\n    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`)\n  }\n  assertFrameworkManagedAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.listForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: principal.id,\n    })\n  )\n  const identity: AgentExecutionIdentity = {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id: principal.id },\n    groupMemberships,\n  }\n  return {\n    identity,\n    context: resolveAuthorizationContext({\n      principal: identity.principal,\n      groupIds: groupMemberships.map((membership) => membership.groupId),\n      roles: input.security.listResolvedRoles(),\n    }),\n  }\n}\n\n/** Revalidate the durable user authority inherited by a conversational or child Agent. */\nexport async function resolveInheritedAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n  readonly now?: Date\n}): Promise<AgentExecutionAuthorization> {\n  if (input.authorizationRef.type === \"disabled\") return { type: \"disabled\" }\n\n  const ref = requireCredentialedUserAuthority(input.authorizationRef)\n  const auth = requireAuthStorage(input.auth)\n  const now = input.now ?? new Date()\n  const user = await requireActiveUser(auth, input.projectId, ref.principal.id)\n  const memberships = await auth.groupMemberships.listForUser({\n    projectId: input.projectId,\n    userId: user.id,\n  })\n  const credential = await revalidateUserCredential({\n    auth,\n    projectId: input.projectId,\n    userId: user.id,\n    credential: ref.credential,\n    currentGroupIds: memberships.map((membership) => membership.groupId),\n    now,\n  })\n\n  return {\n    type: \"principal\",\n    context: resolveAuthorizationContext({\n      principal: ref.principal,\n      groupIds: credential.groupIds,\n      roles: input.security.listResolvedRoles(),\n      ...(credential.sessionId === undefined ? {} : { sessionId: credential.sessionId }),\n    }),\n  }\n}\n\nfunction requireCredentialedUserAuthority(ref: AuthorizationRef): CredentialedUserAuthorizationRef {\n  if (ref.type !== \"principal\" || ref.principal.type !== \"user\" || ref.credential === undefined) {\n    throw invalidInheritedAuthority(\"the durable reference is not a credentialed user\")\n  }\n  return {\n    type: \"principal\",\n    principal: { type: \"user\", id: ref.principal.id },\n    credential: { type: ref.credential.type, id: ref.credential.id },\n  }\n}\n\nasync function requireActiveUser(\n  auth: AuthStorage,\n  projectId: string,\n  userId: string\n): Promise<UserRecord> {\n  const user = await auth.users.getById({ projectId, id: userId })\n  if (!user || user.status !== \"active\") {\n    throw invalidInheritedAuthority(`user '${userId}' is not active`)\n  }\n  return user\n}\n\nasync function revalidateUserCredential(input: {\n  readonly auth: AuthStorage\n  readonly projectId: string\n  readonly userId: string\n  readonly credential: UserCredentialRef\n  readonly currentGroupIds: readonly string[]\n  readonly now: Date\n}): Promise<{ readonly groupIds: readonly string[]; readonly sessionId?: string }> {\n  if (input.credential.type === \"session\") {\n    const session = await input.auth.sessions.getById({\n      projectId: input.projectId,\n      id: input.credential.id,\n    })\n    if (!isUsableUserSession(session, input.userId, input.now)) {\n      throw invalidInheritedAuthority(\"the inherited session is no longer valid\")\n    }\n    return { groupIds: input.currentGroupIds, sessionId: session.id }\n  }\n\n  const accessToken = await input.auth.accessTokens.getById({\n    projectId: input.projectId,\n    id: input.credential.id,\n  })\n  if (!isUsableUserAccessToken(accessToken, input.userId, input.now)) {\n    throw invalidInheritedAuthority(\"the inherited access token is no longer valid\")\n  }\n  if (accessToken.groupIds === undefined) return { groupIds: input.currentGroupIds }\n\n  const allowedGroupIds = new Set(accessToken.groupIds)\n  return {\n    groupIds: input.currentGroupIds.filter((groupId) => allowedGroupIds.has(groupId)),\n  }\n}\n\nfunction isUsableUserSession(\n  session: SessionRecord | null,\n  userId: string,\n  now: Date\n): session is SessionRecord {\n  if (!session || session.userId !== userId || session.revokedAt !== undefined) return false\n  if (session.expiresAt.getTime() <= now.getTime()) return false\n  return (\n    session.absoluteExpiresAt === undefined || session.absoluteExpiresAt.getTime() > now.getTime()\n  )\n}\n\nfunction isUsableUserAccessToken(\n  token: AccessTokenRecord | null,\n  userId: string,\n  now: Date\n): token is AccessTokenRecord {\n  if (!token || !principalsEqual(token.subject, { type: \"user\", id: userId })) return false\n  return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime()\n}\n\nfunction invalidInheritedAuthority(reason: string): Error {\n  return createSixbError(\n    \"agent.execution_failed\",\n    `[Sixb] The Agent execution cannot restore its inherited authority: ${reason}.`\n  )\n}\n\nfunction requireAuthStorage(auth: AuthStorage | undefined): AuthStorage {\n  if (!auth) {\n    throw new Error(\"[Sixb] Agent executions require auth storage.\")\n  }\n  return auth\n}\n\nasync function updateAgentServiceAccountMetadata(\n  auth: AuthStorage,\n  input: {\n    readonly existing: ServiceAccountRecord\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  if (input.existing.name === input.name && input.existing.description === input.description) {\n    return input.existing\n  }\n  return auth.serviceAccounts.update({\n    projectId: input.existing.projectId,\n    id: input.existing.id,\n    name: input.name,\n    description: input.description,\n    updatedAt: input.updatedAt,\n  })\n}\n",
+    "/**\n * Base error for workflow-run storage operations.\n */\nexport class WorkflowRunError extends Error {\n  readonly name = \"WorkflowRunError\"\n}\n",
+    "import { agentServiceAccountId } from \"../../agents/authority\"\nimport type { ExecutionStorage } from \"../executions\"\nimport { findAgentRunExecution, findPrimitiveRunExecution } from \"../executions/run-link\"\nimport { WorkflowRunError } from \"./errors\"\n\n/** Validate the semantic link between a durable workflow run and its immutable execution. */\nexport async function assertWorkflowRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly runId: string\n  readonly workflowId: string\n}): Promise<void> {\n  const execution = await findPrimitiveRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    primitive: { kind: \"workflow\", id: input.workflowId, runId: input.runId },\n    sourceTypes: [\"execution\", \"schedule\", \"event\"],\n  })\n  if (!execution) {\n    invalidExecution(input.executionId, input.runId)\n  }\n\n  if (execution.source.type === \"schedule\" || execution.source.type === \"event\") {\n    if (execution.requestedBy !== undefined) {\n      invalidExecution(input.executionId, input.runId)\n    }\n    return\n  }\n\n  // ExecutionStorage already validates the immutable parent reference, correlation id, and\n  // requested-by propagation. This boundary only owns the workflow-specific source restriction.\n  if (execution.source.type !== \"execution\") {\n    invalidExecution(input.executionId, input.runId)\n  }\n}\n\n/** Validate the semantic link between a Workflow Agent-node run and its child execution. */\nexport async function assertWorkflowAgentNodeRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly nodeRunId: string\n  readonly actorId: string\n  readonly workflowExecutionId: string\n}): Promise<void> {\n  const execution = await findAgentRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    runId: input.nodeRunId,\n    authority: { type: \"managed\", serviceAccountId: agentServiceAccountId(input.actorId) },\n  })\n  if (\n    !execution ||\n    execution.source.type !== \"execution\" ||\n    execution.source.executionId !== input.workflowExecutionId\n  ) {\n    throw new WorkflowRunError(\n      `[Sixb] Execution '${input.executionId}' does not authorize Workflow Agent-node run '${input.nodeRunId}'.`\n    )\n  }\n}\n\nfunction invalidExecution(executionId: string, runId: string): never {\n  throw new WorkflowRunError(\n    `[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`\n  )\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AAGO,SAAS,0BAA0B,CAAC,KAAmC;AAAA,EAC5E,OAAO,OAAO,YAAY,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,oBAAoB,CAAC,CAAU,CAAC;AAAA;;;ACoBhG,IAAM,gBAAqC,IAAI;AAG/C,IAAM,uBAAuB,IAAI;AAS1B,SAAS,wBAAwB,CACtC,UACA,YAC+B;AAAA,EAC/B,IAAI,WAAW,qBAAqB,IAAI,QAAQ;AAAA,EAChD,IAAI,CAAC,UAAU;AAAA,IACb,WAAW,IAAI;AAAA,IACf,qBAAqB,IAAI,UAAU,QAAQ;AAAA,EAC7C;AAAA,EACA,MAAM,MAAM,KAAK,UAAU,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC;AAAA,EACjD,IAAI,CAAC,SAAS,IAAI,GAAG;AAAA,IAAG,SAAS,IAAI,KAAK,wBAAwB,UAAU,UAAU,CAAC;AAAA,EACvF,OAAO,SAAS,IAAI,GAAG;AAAA;AAGzB,SAAS,uBAAuB,CAC9B,UACA,YAC+B;AAAA,EAC/B,MAAM,gBAAgB,IAAI;AAAA,EAC1B,WAAW,cAAc,SAAS,gBAAgB,GAAG;AAAA,IACnD,MAAM,UAAU,IAAI;AAAA,IACpB,WAAW,YAAY,WAAW,YAAY;AAAA,MAC5C,MAAM,UAAU,SAAS,UAAU,KAAK,CAAC,cAAc,CAAC,WAAW,IAAI,SAAS,CAAC;AAAA,MACjF,IAAI,YAAY;AAAA,QAAW,QAAQ,IAAI,SAAS,IAAI,OAAO;AAAA,IAC7D;AAAA,IACA,IAAI,QAAQ,OAAO;AAAA,MAAG,cAAc,IAAI,WAAW,IAAI,OAAO;AAAA,EAChE;AAAA,EACA,IAAI,cAAc,SAAS;AAAA,IAAG;AAAA,EAE9B,MAAM,eAAe,IAAI,IACvB,CAAC,GAAG,aAAa,EAAE,IAAI,EAAE,cAAc,aAAa,CAAC,cAAc,IAAI,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAC7F;AAAA,EACA,OAAO,OAAO,OAAO;AAAA,IACnB,mBAAmB,CAAC,iBAAyB,aAAa,IAAI,YAAY,KAAK;AAAA,IAC/E,gBAAgB,CAAC,cAAsB,eACrC,cAAc,IAAI,YAAY,GAAG,IAAI,UAAU;AAAA,EACnD,CAAC;AAAA;AASI,SAAS,eAAuC,CACrD,KACA,WACM;AAAA,EACN,MAAM,SAAS,UAAU,kBAAkB,IAAI,YAAY;AAAA,EAC3D,MAAM,QAAQ,IAAI;AAAA,EAClB,IAAI,OAAO,SAAS,KAAK,UAAU;AAAA,IAAW,OAAO;AAAA,EAErD,MAAM,WAAiB,KAAK,IAAI;AAAA,EAChC,IAAI,OAAO,OAAO,GAAG;AAAA,IACnB,SAAS,aAAa,YAAY,IAAI,YAAY,MAAM;AAAA,IACxD,SAAS,aAAa,2BAA2B,MAAM;AAAA,EACzD;AAAA,EACA,IAAI,UAAU,WAAW;AAAA,IACvB,SAAS,QAAQ,OAAO,YACtB,OAAO,QAAQ,KAAK,EAAE,IAAI,EAAE,QAAQ,WAAW,CAAC,QAAQ,gBAAgB,OAAO,SAAS,CAAC,CAAC,CAC5F;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,eAAe,CACtB,OACA,WACmB;AAAA,EACnB,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO,MAAM,IAAI,CAAC,QAAQ,gBAAgB,KAAK,SAAS,CAAC;AAAA,EAEnF,OAAO,gBAAgB,OAA4B,SAAS;AAAA;AAOvD,SAAS,iBAAiB,CAC/B,OACA,WACmB;AAAA,EACnB,IAAI,MAAM,UAAU;AAAA,IAAW,OAAO;AAAA,EACtC,MAAM,SAAS,UAAU,kBAAkB,MAAM,QAAQ,YAAY;AAAA,EACrE,IAAI,OAAO,SAAS;AAAA,IAAG,OAAO;AAAA,EAE9B,MAAM,UAAU;AAAA,OACX,MAAM;AAAA,IACT,iBAAiB,YAAY,MAAM,QAAQ,iBAAiB,MAAM;AAAA,IAClE,YAAY,2BAA2B,MAAM;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,SAAS;AAAA,IAAkB,OAAO,KAAK,OAAO,QAAQ;AAAA,EAChE,OAAO;AAAA,OACF;AAAA,IACH,SAAS,KAAK,SAAS,YAAY,YAAY,MAAM,QAAQ,YAAY,MAAM,EAAE;AAAA,EACnF;AAAA;AAGF,SAAS,WAAmB,CAC1B,QACA,QACwB;AAAA,EACxB,MAAM,OAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;AAAA,IACjD,IAAI,CAAC,OAAO,IAAI,GAAG;AAAA,MAAG,KAAK,OAAO;AAAA,EACpC;AAAA,EACA,OAAO;AAAA;AASF,SAAS,6BAA6B,CAC3C,WAC8B;AAAA,EAG9B,MAAM,eAAe,IAAI;AAAA,EACzB,MAAM,QAAQ,CAAC,kBAAgE;AAAA,IAC7E,MAAM,UAAU,OAAO,OAAO,CAAC,CAAC;AAAA,IAChC,aAAa,IAAI,SAAS,OAAO,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;AAAA,IAC3D,OAAO;AAAA;AAAA,EAET,MAAM,UAAU,CAAC,UAAwD;AAAA,IACvE,MAAM,gBAAgB,aAAa,IAAI,KAAK;AAAA,IAC5C,IAAI,CAAC,eAAe;AAAA,MAClB,MAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AAAA,IACA,OAAO;AAAA;AAAA,EAET,MAAM,QAAQ,MAAM,CAAC,CAAC;AAAA,EAEtB,MAAM,YAA0C;AAAA,IAC9C,OAAO,MAAM;AAAA,IACb,QAAQ,CAAC,WAAW,EAAE,OAAO,MAAM,MAAM,OAAO,aAAa,EAAE;AAAA,IAC/D,MAAM,CAAC,WAAW,EAAE,OAAO,MAAM,MAAM,OAAO,aAAa,EAAE;AAAA,IAE7D,KAAK,CAAC,UACJ,MAAM,OAAO,aACR,MAAM,OAAO,MAAM,QACpB,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,OAAO,QAAQ,OAAO,CAAC,CAAC,CAAC;AAAA,IACvD,UAAU,CAAC,UAAU;AAAA,MACnB,IAAI,MAAM,QAAQ;AAAA,QAAW;AAAA,MAC7B,MAAM,gBACJ,MAAM,iBAAiB,YAAY,QAAQ,MAAM,KAAK,IAAI,CAAC,MAAM,YAAY;AAAA,MAC/E,WAAW,gBAAgB,eAAe;AAAA,QACxC,MAAM,UAAU,UAAU,eAAe,cAAc,MAAM,UAAU;AAAA,QACvE,IAAI,YAAY;AAAA,UAAW;AAAA,QAC3B,OAAO,IAAI,oBACT,qBAAqB,WACrB,iBAAiB,mBAAmB,MAAM,SAAS,gBAAgB,MAAM,mBAAmB,MAAM,6CAA6C,WACjJ;AAAA,MACF;AAAA,MACA;AAAA;AAAA,EAEJ;AAAA,EACA,OAAO,OAAO,OAAO,SAAS;AAAA;AAGhC,IAAM,qBAAuE;AAAA,EAC3E,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,OAAO;AACT;;;ACrLO,SAAS,8BAA6B,CAC3C,UACA,eAC+B;AAAA,EAC/B,OAAO,cAAc,SAAS,cAC1B,yBAAyB,UAAU,cAAc,QAAQ,cAAc,IAAI,GAAK,IAChF;AAAA;AAsBN,eAAsB,oCAAmC,CAAC,OAOtB;AAAA,EAClC,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,KAAK,uBAAsB,MAAM,OAAO;AAAA,EAC9C,MAAM,MAAM,IAAI;AAAA,EAChB,MAAM,SAAS,MAAM,gCAAgC,MAAM;AAAA,IACzD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,0CAA0C,MAAM,SAAS,MAAM;AAAA,EAC/D,gCAAgC,MAAM,SAAS,MAAM;AAAA,EACrD,MAAM,iBAAiB,MAAM,kCAAkC,MAAM;AAAA,IACnE,UAAU;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,gCAAgC,MAAM,SAAS,cAAc;AAAA,EAE7D,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,2BAA2B;AAAA,IACnE,WAAW,MAAM;AAAA,IACjB,kBAAkB;AAAA,IAClB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC,CACH;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,GAAG;AAAA,IACxC;AAAA,EACF;AAAA;AAIF,eAAe,+BAA+B,CAC5C,MACA,OAO+B;AAAA,EAC/B,MAAM,WAAW,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,IAAI;AAAA,IAAU,OAAO;AAAA,EAErB,IAAI;AAAA,IACF,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAAA,MACvC,IAAI,MAAM;AAAA,MACV,WAAW,MAAM;AAAA,MACjB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,QAAQ;AAAA,MACR,oBAAoB;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,EAAE,iBAAiB,sBAAqB,MAAM,SAAS,6BAA6B;AAAA,MACtF,MAAM;AAAA,IACR;AAAA,IACA,MAAM,aAAa,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM;AAAA,IACZ,CAAC;AAAA,IACD,IAAI,CAAC;AAAA,MAAY,MAAM;AAAA,IACvB,OAAO;AAAA;AAAA;AAIX,SAAS,+BAA+B,CACtC,SACA,gBACM;AAAA,EACN,IAAI,eAAe,WAAW,aAAa;AAAA,IACzC,MAAM,IAAI,MACR,iBAAiB,6BAA6B,eAAe,mBAC/D;AAAA,EACF;AAAA;AAGF,SAAS,yCAAyC,CAChD,SACA,gBACM;AAAA,EACN,IACE,eAAe,uBAAuB,aACtC,CAAC,iBAAgB,eAAe,oBAAoB,iBAAgB,GACpE;AAAA,IACA,MAAM,iBACJ,0BACA,iBAAiB,wCAAwC,eAAe,0CACxE,EAAE,SAAS,EAAE,SAAS,kBAAkB,eAAe,GAAG,EAAE,CAC9D;AAAA,EACF;AAAA;AAGF,SAAS,sCAAsC,CAC7C,SACA,aACgD;AAAA,EAChD,MAAM,mBAAmB,YACtB,OAAO,CAAC,eAAe,WAAW,WAAW,OAAO,EACpD,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,EACzC,IAAI,iBAAiB,SAAS,GAAG;AAAA,IAC/B,MAAM,iBACJ,0BACA,iBAAiB,iFAAiF,iBAAiB,KAAK,IAAI,MAC5H,EAAE,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAC3C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIT,eAAsB,mCAAkC,CAAC,OAM0C;AAAA,EACjG,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,aAAa,uBAAsB,MAAM,OAAO;AAAA,EACtD,MAAM,YACJ,MAAM,iBAAiB,SAAS,cAAc,MAAM,iBAAiB,YAAY;AAAA,EACnF,IAAI,WAAW,SAAS,oBAAoB,UAAU,OAAO,YAAY;AAAA,IACvE,MAAM,IAAI,MACR,iBAAiB,MAAM,gEAAgE,cACzF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,UAAU;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,CAAC,kBAAkB,eAAe,WAAW,UAAU;AAAA,IACzD,MAAM,IAAI,MAAM,iCAAiC,UAAU,oBAAoB;AAAA,EACjF;AAAA,EACA,0CAA0C,MAAM,SAAS,cAAc;AAAA,EAEvE,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,sBAAsB;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,kBAAkB,UAAU;AAAA,EAC9B,CAAC,CACH;AAAA,EACA,MAAM,WAAmC;AAAA,IACvC;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,IAAI,UAAU,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,6BAA4B;AAAA,MACnC,WAAW,SAAS;AAAA,MACpB,UAAU,iBAAiB,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,MACjE,OAAO,MAAM,SAAS,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA;AAIF,eAAsB,4CAA2C,CAAC,OAMzB;AAAA,EACvC,IAAI,MAAM,iBAAiB,SAAS;AAAA,IAAY,OAAO,EAAE,MAAM,WAAW;AAAA,EAE1E,MAAM,MAAM,iCAAiC,MAAM,gBAAgB;AAAA,EACnE,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,MAAM,MAAM,OAAO,IAAI;AAAA,EAC7B,MAAM,OAAO,MAAM,kBAAkB,MAAM,MAAM,WAAW,IAAI,UAAU,EAAE;AAAA,EAC5E,MAAM,cAAc,MAAM,KAAK,iBAAiB,YAAY;AAAA,IAC1D,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,EACf,CAAC;AAAA,EACD,MAAM,aAAa,MAAM,yBAAyB;AAAA,IAChD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,YAAY,IAAI;AAAA,IAChB,iBAAiB,YAAY,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,IACnE;AAAA,EACF,CAAC;AAAA,EAED,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,6BAA4B;AAAA,MACnC,WAAW,IAAI;AAAA,MACf,UAAU,WAAW;AAAA,MACrB,OAAO,MAAM,SAAS,kBAAkB;AAAA,SACpC,WAAW,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,WAAW,UAAU;AAAA,IAClF,CAAC;AAAA,EACH;AAAA;AAGF,SAAS,gCAAgC,CAAC,KAAyD;AAAA,EACjG,IAAI,IAAI,SAAS,eAAe,IAAI,UAAU,SAAS,UAAU,IAAI,eAAe,WAAW;AAAA,IAC7F,MAAM,0BAA0B,kDAAkD;AAAA,EACpF;AAAA,EACA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,EAAE,MAAM,QAAQ,IAAI,IAAI,UAAU,GAAG;AAAA,IAChD,YAAY,EAAE,MAAM,IAAI,WAAW,MAAM,IAAI,IAAI,WAAW,GAAG;AAAA,EACjE;AAAA;AAGF,eAAe,iBAAiB,CAC9B,MACA,WACA,QACqB;AAAA,EACrB,MAAM,OAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,WAAW,IAAI,OAAO,CAAC;AAAA,EAC/D,IAAI,CAAC,QAAQ,KAAK,WAAW,UAAU;AAAA,IACrC,MAAM,0BAA0B,SAAS,uBAAuB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,wBAAwB,CAAC,OAO2C;AAAA,EACjF,IAAI,MAAM,WAAW,SAAS,WAAW;AAAA,IACvC,MAAM,UAAU,MAAM,MAAM,KAAK,SAAS,QAAQ;AAAA,MAChD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM,WAAW;AAAA,IACvB,CAAC;AAAA,IACD,IAAI,CAAC,oBAAoB,SAAS,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,MAC1D,MAAM,0BAA0B,0CAA0C;AAAA,IAC5E;AAAA,IACA,OAAO,EAAE,UAAU,MAAM,iBAAiB,WAAW,QAAQ,GAAG;AAAA,EAClE;AAAA,EAEA,MAAM,cAAc,MAAM,MAAM,KAAK,aAAa,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM,WAAW;AAAA,EACvB,CAAC;AAAA,EACD,IAAI,CAAC,wBAAwB,aAAa,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,IAClE,MAAM,0BAA0B,+CAA+C;AAAA,EACjF;AAAA,EACA,IAAI,YAAY,aAAa;AAAA,IAAW,OAAO,EAAE,UAAU,MAAM,gBAAgB;AAAA,EAEjF,MAAM,kBAAkB,IAAI,IAAI,YAAY,QAAQ;AAAA,EACpD,OAAO;AAAA,IACL,UAAU,MAAM,gBAAgB,OAAO,CAAC,YAAY,gBAAgB,IAAI,OAAO,CAAC;AAAA,EAClF;AAAA;AAGF,SAAS,mBAAmB,CAC1B,SACA,QACA,KAC0B;AAAA,EAC1B,IAAI,CAAC,WAAW,QAAQ,WAAW,UAAU,QAAQ,cAAc;AAAA,IAAW,OAAO;AAAA,EACrF,IAAI,QAAQ,UAAU,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAAG,OAAO;AAAA,EACzD,OACE,QAAQ,sBAAsB,aAAa,QAAQ,kBAAkB,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAIjG,SAAS,uBAAuB,CAC9B,OACA,QACA,KAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,CAAC,iBAAgB,MAAM,SAAS,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAAA,IAAG,OAAO;AAAA,EACpF,OAAO,MAAM,cAAc,aAAa,MAAM,UAAU,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAGlF,SAAS,yBAAyB,CAAC,QAAuB;AAAA,EACxD,OAAO,iBACL,0BACA,sEAAsE,SACxE;AAAA;AAGF,SAAS,kBAAkB,CAAC,MAA4C;AAAA,EACtE,IAAI,CAAC,MAAM;AAAA,IACT,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,iCAAiC,CAC9C,MACA,OAM+B;AAAA,EAC/B,IAAI,MAAM,SAAS,SAAS,MAAM,QAAQ,MAAM,SAAS,gBAAgB,MAAM,aAAa;AAAA,IAC1F,OAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,KAAK,gBAAgB,OAAO;AAAA,IACjC,WAAW,MAAM,SAAS;AAAA,IAC1B,IAAI,MAAM,SAAS;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,EACnB,CAAC;AAAA;;;AC5XI,MAAM,0BAAyB,MAAM;AAAA,EACjC,OAAO;AAClB;;;ACCA,eAAsB,2BAA0B,CAAC,OAM/B;AAAA,EAChB,MAAM,YAAY,MAAM,0BAA0B;AAAA,IAChD,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,EAAE,MAAM,YAAY,IAAI,MAAM,YAAY,OAAO,MAAM,MAAM;AAAA,IACxE,aAAa,CAAC,aAAa,YAAY,OAAO;AAAA,EAChD,CAAC;AAAA,EACD,IAAI,CAAC,WAAW;AAAA,IACd,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA,EAEA,IAAI,UAAU,OAAO,SAAS,cAAc,UAAU,OAAO,SAAS,SAAS;AAAA,IAC7E,IAAI,UAAU,gBAAgB,WAAW;AAAA,MACvC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AAAA,EAIA,IAAI,UAAU,OAAO,SAAS,aAAa;AAAA,IACzC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA;AAIF,eAAsB,oCAAmC,CAAC,OAOxC;AAAA,EAChB,MAAM,YAAY,MAAM,sBAAsB;AAAA,IAC5C,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,OAAO,MAAM;AAAA,IACb,WAAW,EAAE,MAAM,WAAW,kBAAkB,uBAAsB,MAAM,OAAO,EAAE;AAAA,EACvF,CAAC;AAAA,EACD,IACE,CAAC,aACD,UAAU,OAAO,SAAS,eAC1B,UAAU,OAAO,gBAAgB,MAAM,qBACvC;AAAA,IACA,MAAM,IAAI,kBACR,qBAAqB,MAAM,4DAA4D,MAAM,aAC/F;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CAAC,aAAqB,OAAsB;AAAA,EACnE,MAAM,IAAI,kBACR,qBAAqB,iDAAiD,SACxE;AAAA;",
+  "debugId": "D9BE414225D935D664756E2164756E21",
+  "names": []
+}

package/dist/{chunk-vp3z1ckh.js → chunk-de4z2bj6.js}

@@ -9,23 +9,23 @@ import {
 } from "./chunk-vjcd8d27.js";
 import {
   createKernelRuntimeAuthorization
-} from "./chunk-5be2ath4.js";
+} from "./chunk-qkbx3tf6.js";
 import {
   estimateModelCall
-} from "./chunk-s7ftxrdr.js";
+} from "./chunk-29yx306f.js";
 import {
   vectorConfiguration,
   vectorSources,
   normalizeVector2,
   VECTOR_INDEXING_FAILURE_CODES2
-} from "./chunk-5yd8cchh.js";
+} from "./chunk-qq90g05n.js";
 import {
   ModelExecutionSession
-} from "./chunk-52c5zb0z.js";
+} from "./chunk-k6hrnf35.js";
 import {
   executionRecordInputFromRuntime,
   ensureExecutionRecord2
-} from "./chunk-a7er86jd.js";
+} from "./chunk-ex496vct.js";
 import {
   MaterializationConflictError2
 } from "./chunk-96yw3pwd.js";

package/dist/{chunk-3rrezgyc.js → chunk-dnmadg9k.js}

@@ -3,7 +3,7 @@ import {
   datasetSequenceValue,
   assertDatasetDefinition2,
   getDatasetRowValidationFailure
-} from "./chunk-cd234ba4.js";
+} from "./chunk-rz53yb4v.js";
 import {
   LakeStorageError2,
   LakeConcurrencyError2,
@@ -11,7 +11,7 @@ import {
   encodeDatasetPrimaryKey2,
   getDatasetMergeChangeValidationError2,
   cloneDatasetMergeChange2
-} from "./chunk-rb143ggb.js";
+} from "./chunk-bwjcehza.js";
 import {
   normalizeDecimalValue2
 } from "./chunk-3bh94gbw.js";

package/dist/chunk-enpsx8k5.js

@@ -0,0 +1,127 @@
+// @bun
+// src/authorization/grant-kinds.ts
+var GRANT_KINDS = {
+  "access:application": {
+    universeKey: "applicationIds",
+    subject: "application",
+    fix: "Use an application exported from '@sixb/core'."
+  },
+  "view:object": {
+    universeKey: "objectTypeIds",
+    subject: "object type",
+    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies }).",
+    expandsSubtypes: true
+  },
+  "view:dataset": {
+    universeKey: "datasetIds",
+    subject: "dataset",
+    fix: "Add it to 'datasets/' or pass it to createSixb({ datasets })."
+  },
+  "edit:object": {
+    universeKey: "objectTypeIds",
+    subject: "object type",
+    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies })."
+  },
+  "append:telemetry": {
+    universeKey: "objectTypeIds",
+    subject: "object type",
+    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies })."
+  },
+  "apply:action": {
+    universeKey: "actionIds",
+    subject: "action",
+    fix: "Add it to 'actions/' or pass it to createSixb({ actions })."
+  },
+  "share:share": {
+    universeKey: "shareIds",
+    subject: "share",
+    fix: "Add it to 'shares/' or pass it to createSixb({ shares })."
+  },
+  "run:workflow": {
+    universeKey: "workflowIds",
+    subject: "workflow",
+    fix: "Add it to 'workflows/' or pass it to createSixb({ workflows })."
+  },
+  "run:sync": {
+    universeKey: "syncIds",
+    subject: "sync",
+    fix: "Add it to 'syncs/' or pass it to createSixb({ syncs })."
+  },
+  "run:pipeline": {
+    universeKey: "pipelineIds",
+    subject: "pipeline",
+    fix: "Add it to 'pipelines/' or pass it to createSixb({ pipelines })."
+  },
+  "run:agent": {
+    singleton: true,
+    subject: "agent",
+    fix: "Configure models.language and use the exported agent reference in can.run(agent)."
+  },
+  "observe:logs": {
+    universeKey: "observableIds",
+    subject: "observability surface",
+    fix: 'Use can.observe("logs").'
+  },
+  "observe:aiUsage": {
+    universeKey: "observableIds",
+    subject: "observability surface",
+    fix: "Use can.observe(agent.usage)."
+  },
+  "manage:connector": {
+    universeKey: "connectorIds",
+    subject: "connector",
+    fix: "Add it to 'connectors/' or pass it to createSixb({ connectors })."
+  },
+  "manage:aiUsage": {
+    universeKey: "manageableIds",
+    subject: "management surface",
+    fix: "Use can.manage(agent.usage)."
+  }
+};
+var GRANT_KIND_KEYS = Object.keys(GRANT_KINDS);
+var TARGETED_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter((kind) => kind !== "run:agent");
+function grantKindOf(grant) {
+  switch (grant.capability) {
+    case "access":
+      return "access:application";
+    case "view":
+      return `view:${grant.target}`;
+    case "edit":
+      return "edit:object";
+    case "append":
+      return "append:telemetry";
+    case "apply":
+      return "apply:action";
+    case "share":
+      return "share:share";
+    case "run":
+      return `run:${grant.target}`;
+    case "observe":
+      return `observe:${grant.target}`;
+    case "manage":
+      return `manage:${grant.target}`;
+  }
+}
+function emptyGrantSets() {
+  return {
+    "access:application": new Set,
+    "view:object": new Set,
+    "view:dataset": new Set,
+    "edit:object": new Set,
+    "append:telemetry": new Set,
+    "apply:action": new Set,
+    "share:share": new Set,
+    "run:workflow": new Set,
+    "run:sync": new Set,
+    "run:pipeline": new Set,
+    "run:agent": false,
+    "observe:logs": new Set,
+    "observe:aiUsage": new Set,
+    "manage:connector": new Set,
+    "manage:aiUsage": new Set
+  };
+}
+
+export { GRANT_KINDS, TARGETED_GRANT_KIND_KEYS, grantKindOf, emptyGrantSets };
+
+//# debugId=C6044AB9EC3A569764756E2164756E21