@sixb/core 0.1.17 → 0.1.19

package/dist/{chunk-svabwqdq.js → chunk-3gnrh4ve.js}

@@ -1,11 +1,19 @@
 // @bun
 import {
-  GRANT_KINDS,
-  grantKindOf,
   canAccessApplication2,
   resolveRoleGrants2,
   resolveAuthorizationContext2
-} from "./chunk-5be2ath4.js";
+} from "./chunk-y7rqfrgg.js";
+import {
+  assertValidFileRefs2
+} from "./chunk-hvsb78a1.js";
+import {
+  SecurityValidationError2,
+  resolveMembershipPolicyScope,
+  canPerformMembershipOperation,
+  missingMembershipGroupIds,
+  validateSecurityDefinitionsAtStartup
+} from "./chunk-xt1zt7gv.js";
 import {
   AuthRuntimeError2,
   DEFAULT_AUTH_SESSION_AUDIENCE2,
@@ -21,7 +29,7 @@ import {
 import {
   normalizeParams,
   coerceParamsToTyped
-} from "./chunk-5thzcb8g.js";
+} from "./chunk-c85m1hyj.js";
 import {
   snapshotLinkPathSelection
 } from "./chunk-t6f3tdnr.js";
@@ -160,405 +168,6 @@ var applications2 = {
   app: { kind: "application", id: "app", label: "Custom app" }
 };
 var APPLICATION_IDS = new Set(Object.values(applications2).map((application) => application.id));
-// src/security/errors.ts
-class SecurityValidationError2 extends Error {
-  name = "SecurityValidationError";
-}
-
-// src/security/membership-policies.ts
-var MEMBERSHIP_OPERATIONS = ["invite", "assignGroups", "suspend"];
-function resolveMembershipPolicyScope(input) {
-  const callerGroups = new Set(input.callerGroupIds);
-  const policyIds = [];
-  const operations = createEmptyOperationScopes();
-  for (const policy of input.membershipPolicies) {
-    if (!policy.grantedToGroupIds.some((groupId) => callerGroups.has(groupId))) {
-      continue;
-    }
-    policyIds.push(policy.id);
-    for (const operation of policy.can) {
-      operations[operation].policyIds.push(policy.id);
-      for (const groupId of policy.scopeGroupIds) {
-        operations[operation].groupIds.add(groupId);
-      }
-    }
-  }
-  return {
-    policyIds,
-    operations: {
-      invite: freezeOperationScope(operations.invite),
-      assignGroups: freezeOperationScope(operations.assignGroups),
-      suspend: freezeOperationScope(operations.suspend)
-    }
-  };
-}
-function canPerformMembershipOperation(scope, operation, groupIds) {
-  const operationScope = scope.operations[operation];
-  if (operationScope.policyIds.length === 0) {
-    return false;
-  }
-  if (groupIds.length === 0) {
-    return true;
-  }
-  return groupIds.every((groupId) => operationScope.groupIds.has(groupId));
-}
-function missingMembershipGroupIds(scope, operation, groupIds) {
-  if (groupIds.length === 0) {
-    return [];
-  }
-  const operationScope = scope.operations[operation];
-  return groupIds.filter((groupId) => !operationScope.groupIds.has(groupId));
-}
-function createEmptyOperationScopes() {
-  return {
-    invite: { policyIds: [], groupIds: new Set },
-    assignGroups: { policyIds: [], groupIds: new Set },
-    suspend: { policyIds: [], groupIds: new Set }
-  };
-}
-function freezeOperationScope(input) {
-  return {
-    policyIds: [...input.policyIds],
-    groupIds: new Set(input.groupIds)
-  };
-}
-function isMembershipOperation(value) {
-  return MEMBERSHIP_OPERATIONS.includes(value);
-}
-
-// src/security/validation.ts
-var GRANT_CAPABILITIES = Object.keys({
-  access: true,
-  view: true,
-  edit: true,
-  append: true,
-  apply: true,
-  share: true,
-  run: true,
-  observe: true,
-  manage: true
-});
-function formatAlternatives(values) {
-  const quoted = values.map((value) => `'${value}'`);
-  const last = quoted.at(-1);
-  return quoted.length < 2 ? last ?? "" : `${quoted.slice(0, -1).join(", ")}, or ${last}`;
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function assertNonEmptyString(value, field, createError = (message) => new SecurityValidationError2(message)) {
-  if (typeof value !== "string" || value.trim().length === 0) {
-    throw createError(`[Sixb] ${field} must not be empty.`);
-  }
-}
-function assertOptionalString(value, field, createError = (message) => new SecurityValidationError2(message)) {
-  if (value === undefined) {
-    return;
-  }
-  if (typeof value !== "string") {
-    throw createError(`[Sixb] ${field} must be a string.`);
-  }
-}
-function assertStringArray(value, field, createError) {
-  if (!Array.isArray(value)) {
-    throw createError(`[Sixb] ${field} must be an array of group ids.`);
-  }
-  for (const item of value) {
-    assertNonEmptyString(item, `${field} item`, createError);
-  }
-}
-function assertMembershipOperationArray(value, field, createError) {
-  if (!Array.isArray(value)) {
-    throw createError(`[Sixb] ${field} must be an array of membership operations.`);
-  }
-  for (const item of value) {
-    if (!isMembershipOperation(item)) {
-      throw createError(`[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`);
-    }
-  }
-}
-function assertNoDuplicateIds(ids, field) {
-  const seen = new Set;
-  for (const id of ids) {
-    if (seen.has(id)) {
-      throw new SecurityValidationError2(`[Sixb] ${field} contains duplicate group id '${id}'.`);
-    }
-    seen.add(id);
-  }
-}
-function assertNoDuplicateOperations(operations, field) {
-  const seen = new Set;
-  for (const operation of operations) {
-    if (seen.has(operation)) {
-      throw new SecurityValidationError2(`[Sixb] ${field} contains duplicate operation '${operation}'.`);
-    }
-    seen.add(operation);
-  }
-}
-function assertGroupDefinition(value, createError = (message) => new SecurityValidationError2(message)) {
-  if (!isRecord(value)) {
-    throw createError("[Sixb] Group definition must be an object.");
-  }
-  if (value.kind !== "group") {
-    throw createError("[Sixb] Group definition kind must be 'group'.");
-  }
-  assertNonEmptyString(value.id, "Group id", createError);
-  assertOptionalString(value.label, `Group '${value.id}' label`, createError);
-  assertOptionalString(value.description, `Group '${value.id}' description`, createError);
-}
-function isGroupDefinition(value) {
-  try {
-    assertGroupDefinition(value, (message) => new Error(message));
-    return true;
-  } catch {
-    return false;
-  }
-}
-function assertMembershipPolicyDefinition(value, createError = (message) => new SecurityValidationError2(message)) {
-  if (!isRecord(value)) {
-    throw createError("[Sixb] Membership policy definition must be an object.");
-  }
-  if (value.kind !== "membershipPolicy") {
-    throw createError("[Sixb] Membership policy definition kind must be 'membershipPolicy'.");
-  }
-  assertNonEmptyString(value.id, "Membership policy id", createError);
-  assertStringArray(value.grantedToGroupIds, `Membership policy '${value.id}' grantedTo`, createError);
-  assertStringArray(value.scopeGroupIds, `Membership policy '${value.id}' scope`, createError);
-  assertMembershipOperationArray(value.can, `Membership policy '${value.id}' can`, createError);
-}
-function isMembershipPolicyDefinition(value) {
-  try {
-    assertMembershipPolicyDefinition(value, (message) => new Error(message));
-    return true;
-  } catch {
-    return false;
-  }
-}
-function assertGrantDefinition(value, field, createError = (message) => new SecurityValidationError2(message)) {
-  if (!isRecord(value) || value.kind !== "grant") {
-    throw createError(`[Sixb] ${field} must contain only grant definitions from 'can'.`);
-  }
-  if (!GRANT_CAPABILITIES.includes(value.capability)) {
-    throw createError(`[Sixb] ${field} grant capability must be ${formatAlternatives(GRANT_CAPABILITIES)}.`);
-  }
-  if (value.capability === "access" && value.target !== "application") {
-    throw createError(`[Sixb] ${field} access grant target must be 'application'.`);
-  }
-  if (value.capability === "view" && value.target !== "object" && value.target !== "dataset") {
-    throw createError(`[Sixb] ${field} view grant target must be 'object' or 'dataset'.`);
-  }
-  if (value.capability === "run" && value.target !== "workflow" && value.target !== "sync" && value.target !== "pipeline" && value.target !== "agent") {
-    throw createError(`[Sixb] ${field} run grant target must be 'workflow', 'sync', 'pipeline', or 'agent'.`);
-  }
-  if (value.capability === "observe" && value.target !== "logs" && value.target !== "aiUsage") {
-    throw createError(`[Sixb] ${field} observe grant target must be 'logs' or 'aiUsage'.`);
-  }
-  if (value.capability === "manage" && value.target !== "connector" && value.target !== "aiUsage") {
-    throw createError(`[Sixb] ${field} manage grant target must be 'connector' or 'aiUsage'.`);
-  }
-  if (value.capability === "run" && value.target === "agent") {
-    if (value.selection !== undefined) {
-      throw createError(`[Sixb] ${field} agent run grant must not declare a selection.`);
-    }
-    return;
-  }
-  assertSelection(value.selection, field, createError);
-}
-function assertSelection(value, field, createError) {
-  if (!isRecord(value) || typeof value.all !== "boolean") {
-    throw createError(`[Sixb] ${field} grant must carry a selection from 'can' or a scope.`);
-  }
-  const ids = value.all ? value.except : value.ids;
-  if (!Array.isArray(ids)) {
-    throw createError(`[Sixb] ${field} grant selection must list ids.`);
-  }
-  for (const id of ids) {
-    assertNonEmptyString(id, `${field} grant selection id`, createError);
-  }
-}
-function assertRoleDefinition(value, createError = (message) => new SecurityValidationError2(message)) {
-  if (!isRecord(value)) {
-    throw createError("[Sixb] Role definition must be an object.");
-  }
-  if (value.kind !== "role") {
-    throw createError("[Sixb] Role definition kind must be 'role'.");
-  }
-  assertNonEmptyString(value.id, "Role id", createError);
-  assertOptionalString(value.label, `Role '${value.id}' label`, createError);
-  assertOptionalString(value.description, `Role '${value.id}' description`, createError);
-  assertStringArray(value.grantedToGroupIds, `Role '${value.id}' grantedTo`, createError);
-  if (!Array.isArray(value.grants)) {
-    throw createError(`[Sixb] Role '${value.id}' grants must be an array.`);
-  }
-  for (const grant of value.grants) {
-    assertGrantDefinition(grant, `Role '${value.id}' grants`, createError);
-  }
-}
-function isRoleDefinition(value) {
-  try {
-    assertRoleDefinition(value, (message) => new Error(message));
-    return true;
-  } catch {
-    return false;
-  }
-}
-function validateSecurityDefinitionsAtStartup(input) {
-  const groupsById = new Map;
-  const rolesById = new Map;
-  const membershipPoliciesById = new Map;
-  for (const group of input.groups) {
-    assertGroupDefinition(group);
-    if (groupsById.has(group.id)) {
-      throw new SecurityValidationError2(`[Sixb] Duplicate group id: ${group.id}`);
-    }
-    groupsById.set(group.id, group);
-  }
-  for (const role of input.roles ?? []) {
-    assertRoleDefinition(role);
-    if (rolesById.has(role.id)) {
-      throw new SecurityValidationError2(`[Sixb] Duplicate role id: ${role.id}`);
-    }
-    if (role.grantedToGroupIds.length === 0) {
-      throw new SecurityValidationError2(`[Sixb] Role '${role.id}' must be granted to at least one group.`);
-    }
-    if (role.grants.length === 0) {
-      throw new SecurityValidationError2(`[Sixb] Role '${role.id}' must declare at least one grant.`);
-    }
-    assertNoDuplicateIds(role.grantedToGroupIds, `Role '${role.id}' grantedTo`);
-    for (const groupId of role.grantedToGroupIds) {
-      if (!groupsById.has(groupId)) {
-        throw new SecurityValidationError2(`[Sixb] Role '${role.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
-      }
-    }
-    for (const grant of role.grants) {
-      assertGrantReferences(role.id, grant, input);
-    }
-    rolesById.set(role.id, role);
-  }
-  for (const policy of input.membershipPolicies) {
-    assertMembershipPolicyDefinition(policy);
-    if (membershipPoliciesById.has(policy.id)) {
-      throw new SecurityValidationError2(`[Sixb] Duplicate membership policy id: ${policy.id}`);
-    }
-    if (policy.grantedToGroupIds.length === 0) {
-      throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' must grant membership authority to at least one group.`);
-    }
-    if (policy.can.length === 0) {
-      throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' must declare at least one operation.`);
-    }
-    assertNoDuplicateIds(policy.grantedToGroupIds, `Membership policy '${policy.id}' grantedTo`);
-    assertNoDuplicateIds(policy.scopeGroupIds, `Membership policy '${policy.id}' scope`);
-    assertNoDuplicateOperations(policy.can, `Membership policy '${policy.id}' can`);
-    for (const groupId of policy.grantedToGroupIds) {
-      if (!groupsById.has(groupId)) {
-        throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
-      }
-    }
-    for (const groupId of policy.scopeGroupIds) {
-      if (!groupsById.has(groupId)) {
-        throw new SecurityValidationError2(`[Sixb] Membership policy '${policy.id}' scope references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
-      }
-    }
-    membershipPoliciesById.set(policy.id, policy);
-  }
-  return {
-    groups: [...groupsById.values()],
-    groupsById,
-    roles: [...rolesById.values()],
-    rolesById,
-    membershipPolicies: [...membershipPoliciesById.values()],
-    membershipPoliciesById
-  };
-}
-function assertGrantReferences(roleId, grant, registered) {
-  if (grant.capability === "run" && grant.target === "agent") {
-    const spec = GRANT_KINDS[grantKindOf(grant)];
-    if (!registered.agentAvailable) {
-      throw new SecurityValidationError2(`[Sixb] Role '${roleId}' grants ${grant.capability} on the project Agent, but it is unavailable. ${spec.fix}`);
-    }
-    return;
-  }
-  const spec = GRANT_KINDS[grantKindOf(grant)];
-  const universe = registered[spec.universeKey];
-  if (!universe) {
-    return;
-  }
-  const ids = grant.selection.all ? grant.selection.except : grant.selection.ids;
-  for (const id of ids) {
-    if (!universe.has(id)) {
-      throw new SecurityValidationError2(`[Sixb] Role '${roleId}' grants ${grant.capability} on unknown ${spec.subject} '${id}'. ${spec.fix}`);
-    }
-  }
-}
-
-// src/security/builders.ts
-var MEMBERSHIP_OPERATIONS2 = new Set(["invite", "assignGroups", "suspend"]);
-function assertNonEmptyArray(value, field) {
-  if (value.length === 0) {
-    throw new SecurityValidationError2(`[Sixb] ${field} must not be empty.`);
-  }
-}
-function groupIdsFrom(groups, field) {
-  return groups.map((group) => {
-    if (!isRecord(group) || group.kind !== "group") {
-      throw new SecurityValidationError2(`[Sixb] ${field} must contain only group definitions.`);
-    }
-    assertNonEmptyString(group.id, `${field} group id`);
-    return group.id;
-  });
-}
-function membershipOperationsFrom(operations, field) {
-  return operations.map((operation) => {
-    if (!MEMBERSHIP_OPERATIONS2.has(operation)) {
-      throw new SecurityValidationError2(`[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`);
-    }
-    return operation;
-  });
-}
-function defineGroup2(id, options = {}) {
-  assertNonEmptyString(id, "Group id");
-  assertOptionalString(options.label, `Group '${id}' label`);
-  assertOptionalString(options.description, `Group '${id}' description`);
-  return {
-    kind: "group",
-    id,
-    ...options.label !== undefined ? { label: options.label } : {},
-    ...options.description !== undefined ? { description: options.description } : {}
-  };
-}
-function defineRole2(id, options) {
-  assertNonEmptyString(id, "Role id");
-  assertOptionalString(options.label, `Role '${id}' label`);
-  assertOptionalString(options.description, `Role '${id}' description`);
-  assertNonEmptyArray(options.grantedTo, `Role '${id}' grantedTo`);
-  const grantedToGroupIds = groupIdsFrom(options.grantedTo, `Role '${id}' grantedTo`);
-  for (const grant of options.grants) {
-    assertGrantDefinition(grant, `Role '${id}' grants`);
-  }
-  if (options.grants.length === 0) {
-    throw new SecurityValidationError2(`[Sixb] Role '${id}' grants must not be empty.`);
-  }
-  return {
-    kind: "role",
-    id,
-    ...options.label !== undefined ? { label: options.label } : {},
-    ...options.description !== undefined ? { description: options.description } : {},
-    grantedToGroupIds,
-    grants: options.grants
-  };
-}
-function defineMembershipPolicy2(id, options) {
-  assertNonEmptyString(id, "Membership policy id");
-  assertNonEmptyArray(options.grantedTo, `Membership policy '${id}' grantedTo`);
-  assertNonEmptyArray(options.can, `Membership policy '${id}' can`);
-  return {
-    kind: "membershipPolicy",
-    id,
-    grantedToGroupIds: groupIdsFrom(options.grantedTo, `Membership policy '${id}' grantedTo`),
-    scopeGroupIds: groupIdsFrom(options.scope, `Membership policy '${id}' scope`),
-    can: membershipOperationsFrom(options.can, `Membership policy '${id}' can`)
-  };
-}
 // src/security/every.ts
 var BREADTH_TARGETS = [
   "object",
@@ -610,10 +219,6 @@ var every2 = {
 class ActionDefinitionError2 extends Error {
   name = "ActionDefinitionError";
 }
-
-class ActionEditCommitError2 extends Error {
-  name = "ActionEditCommitError";
-}
 function missingActionMutationMessage(actionId) {
   return `Action "${actionId}" must declare .writeback(...) or .edits(...).`;
 }
@@ -638,12 +243,14 @@ function isObjectActionDefinition2(value) {
   return value.binding.kind === "object";
 }
 function normalizeActionParams(runtime, paramsConfig, params, pathPrefix) {
-  return normalizeParams(runtime.ontology.getValueTypesById(), paramsConfig, params, {
+  const normalized = normalizeParams(runtime.ontology.getValueTypesById(), paramsConfig, params, {
     kind: "action",
     id: pathPrefix
   });
+  assertValidFileRefs2(normalized, pathPrefix);
+  return normalized;
 }
-function coerceActionParamsToTyped2(paramsConfig, params, valueTypesById) {
+function coerceActionParamsToTyped(paramsConfig, params, valueTypesById) {
   return coerceParamsToTyped(paramsConfig, params, valueTypesById);
 }
 function validateActionSubject(action, subject) {
@@ -707,16 +314,16 @@ function defineShare2(id, options) {
   });
 }
 function isShareDefinition(value) {
-  if (!isRecord2(value) || value.kind !== "share" || !isNonEmpty(value.id))
+  if (!isRecord(value) || value.kind !== "share" || !isNonEmpty(value.id))
     return false;
-  if (!isRecord2(value.target) || value.target.kind !== "object" || !isNonEmpty(value.target.objectTypeId)) {
+  if (!isRecord(value.target) || value.target.kind !== "object" || !isNonEmpty(value.target.objectTypeId)) {
     return false;
   }
   return Array.isArray(value.grants);
 }
 function snapshotShareDefinition(value) {
   try {
-    if (!isRecord2(value)) {
+    if (!isRecord(value)) {
       throw invalid("Share definition kind must be 'share'.");
     }
     const kind = value.kind;
@@ -728,7 +335,7 @@ function snapshotShareDefinition(value) {
       throw invalid("Share definition kind must be 'share'.");
     }
     const id = nonEmpty(authoredId, "Share id");
-    if (!isRecord2(target)) {
+    if (!isRecord(target)) {
       throw invalid(`Share '${id}' target must be an object type.`);
     }
     const targetKind = target.kind;
@@ -816,7 +423,7 @@ function snapshotShareGrants(shareId, targetObjectTypeId, authored) {
   let viewCount = 0;
   for (let index = 0;index < authored.length; index += 1) {
     const grant = authored[index];
-    if (!isRecord2(grant)) {
+    if (!isRecord(grant)) {
       throw invalid(`Share '${shareId}' grant ${index} must come from 'can'.`);
     }
     const kind = grant.kind;
@@ -862,7 +469,7 @@ function snapshotShareGrants(shareId, targetObjectTypeId, authored) {
   return Object.freeze(grants);
 }
 function snapshotLinkMode(value) {
-  if (!isRecord2(value))
+  if (!isRecord(value))
     throw invalid("Share link selection must be an object.");
   const kind = value.kind;
   const links = value.links;
@@ -939,9 +546,9 @@ function assertShareTarget(value) {
   }
 }
 function isObjectType(value) {
-  return isRecord2(value) && isNonEmpty(value.id) && Array.isArray(value.properties) && Array.isArray(value.links);
+  return isRecord(value) && isNonEmpty(value.id) && Array.isArray(value.properties) && Array.isArray(value.links);
 }
-function isRecord2(value) {
+function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isNonEmpty(value) {
@@ -1117,12 +724,14 @@ var can2 = {
 };
 // src/security/registry.ts
 class SecurityRegistry {
+  markingsById;
   groupsById;
   rolesById;
   membershipPoliciesById;
   resolvedRoles;
   constructor(input) {
     const definitions = validateSecurityDefinitionsAtStartup({
+      markings: input.markings ?? [],
       groups: input.groups ?? [],
       roles: input.roles ?? [],
       membershipPolicies: input.membershipPolicies ?? [],
@@ -1153,15 +762,23 @@ class SecurityRegistry {
       shareIds: input.shareIds ?? new Set,
       getSubTypes: input.getSubTypes ?? (() => [])
     };
+    this.markingsById = definitions.markingsById;
     this.groupsById = definitions.groupsById;
     this.rolesById = definitions.rolesById;
     this.membershipPoliciesById = definitions.membershipPoliciesById;
     this.resolvedRoles = definitions.roles.map((role) => ({
       id: role.id,
       grantedToGroupIds: role.grantedToGroupIds,
-      grants: resolveRoleGrants2(role, universe)
+      grants: resolveRoleGrants2(role, universe),
+      clearances: new Set(role.clearances ?? [])
     }));
   }
+  listMarkings() {
+    return [...this.markingsById.values()];
+  }
+  getMarkingById(markingId) {
+    return this.markingsById.get(markingId) ?? null;
+  }
   listGroups() {
     return [...this.groupsById.values()];
   }
@@ -3093,6 +2710,7 @@ class AuthRuntime2 {
     return { accessTokens: result.accessTokens };
   }
   async createPersonalAccessToken(caller, input) {
+    assertSessionCaller(caller);
     const storage = this.requireAuthStorage();
     const groupIds = constrainRequestedGroupIds(input.groupIds, caller.groupIds, {
       subject: "personal access token"
@@ -3197,6 +2815,7 @@ class AuthRuntime2 {
     return { serviceAccount, accessTokens: result.accessTokens };
   }
   async createServiceAccountAccessToken(caller, input) {
+    assertSessionCaller(caller);
     const storage = this.requireAuthStorage();
     const { serviceAccount, groupIds: serviceAccountGroupIds } = await this.requireManageableServiceAccount(storage, caller.groupIds, input.serviceAccountId);
     if (serviceAccount.status === "suspended") {
@@ -3625,6 +3244,11 @@ function memberGroups(memberships) {
 function callerSessionId(caller) {
   return caller.credentialSource === "session" ? caller.session.id : undefined;
 }
+function assertSessionCaller(caller) {
+  if (caller.credentialSource !== "session") {
+    throw new AuthRuntimeError2("authorization_denied", "[Sixb] Access tokens can only be created from a signed-in session, not with another access token.");
+  }
+}
 function constrainTokenGroupIds(principalGroupIds, accessToken) {
   if (accessToken.groupIds === undefined) {
     return principalGroupIds;
@@ -3699,6 +3323,6 @@ var SYSTEM_PRINCIPAL2 = { type: "system", id: "system" };
 function principalsEqual2(left, right) {
   return left.type === right.type && left.id === right.id;
 }
-export { ActionDefinitionError2, ActionEditCommitError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped2, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, setRequestClientAddress2, getRequestClientAddress2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, verifyCsrfToken2, applications2, SecurityValidationError2, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup2, defineRole2, defineMembershipPolicy2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, can2, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
+export { ActionDefinitionError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, setRequestClientAddress2, getRequestClientAddress2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, verifyCsrfToken2, applications2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, can2, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
 
-//# debugId=73464FD9FDE5971364756E2164756E21
+//# debugId=910D62C713AA4DF964756E2164756E21