@sixb/core 0.1.19 → 0.1.20

package/dist/chunk-es1gxsbf.js.map

@@ -0,0 +1,13 @@
+{
+  "version": 3,
+  "sources": ["../src/security/errors.ts", "../src/security/membership-policies.ts", "../src/security/validation.ts", "../src/security/builders.ts"],
+  "sourcesContent": [
+    "export class SecurityValidationError extends Error {\n  readonly name = \"SecurityValidationError\"\n}\n",
+    "import type { MembershipOperation, MembershipPolicyDefinition } from \"./types\"\n\nexport interface MembershipOperationScope {\n  readonly policyIds: readonly string[]\n  readonly groupIds: ReadonlySet<string>\n}\n\nexport interface MembershipPolicyScope {\n  readonly policyIds: readonly string[]\n  readonly operations: Readonly<Record<MembershipOperation, MembershipOperationScope>>\n}\n\nconst MEMBERSHIP_OPERATIONS = [\"invite\", \"assignGroups\", \"suspend\", \"serviceAccounts\"] as const\n\nexport function resolveMembershipPolicyScope(input: {\n  readonly membershipPolicies: readonly MembershipPolicyDefinition[]\n  readonly callerGroupIds: readonly string[]\n}): MembershipPolicyScope {\n  const callerGroups = new Set(input.callerGroupIds)\n  const policyIds: string[] = []\n  const operations = createEmptyOperationScopes()\n\n  for (const policy of input.membershipPolicies) {\n    if (!policy.grantedToGroupIds.some((groupId) => callerGroups.has(groupId))) {\n      continue\n    }\n\n    policyIds.push(policy.id)\n    for (const operation of policy.can) {\n      operations[operation].policyIds.push(policy.id)\n      for (const groupId of policy.scopeGroupIds) {\n        operations[operation].groupIds.add(groupId)\n      }\n    }\n  }\n\n  return {\n    policyIds,\n    operations: {\n      invite: freezeOperationScope(operations.invite),\n      assignGroups: freezeOperationScope(operations.assignGroups),\n      suspend: freezeOperationScope(operations.suspend),\n      serviceAccounts: freezeOperationScope(operations.serviceAccounts),\n    },\n  }\n}\n\nexport function canPerformMembershipOperation(\n  scope: MembershipPolicyScope,\n  operation: MembershipOperation,\n  groupIds: readonly string[]\n): boolean {\n  const operationScope = scope.operations[operation]\n\n  if (operationScope.policyIds.length === 0) {\n    return false\n  }\n\n  if (groupIds.length === 0) {\n    return true\n  }\n\n  return groupIds.every((groupId) => operationScope.groupIds.has(groupId))\n}\n\nexport function missingMembershipGroupIds(\n  scope: MembershipPolicyScope,\n  operation: MembershipOperation,\n  groupIds: readonly string[]\n): readonly string[] {\n  if (groupIds.length === 0) {\n    return []\n  }\n\n  const operationScope = scope.operations[operation]\n  return groupIds.filter((groupId) => !operationScope.groupIds.has(groupId))\n}\n\nfunction createEmptyOperationScopes(): Record<\n  MembershipOperation,\n  { policyIds: string[]; groupIds: Set<string> }\n> {\n  return {\n    invite: { policyIds: [], groupIds: new Set<string>() },\n    assignGroups: { policyIds: [], groupIds: new Set<string>() },\n    suspend: { policyIds: [], groupIds: new Set<string>() },\n    serviceAccounts: { policyIds: [], groupIds: new Set<string>() },\n  }\n}\n\nfunction freezeOperationScope(input: {\n  readonly policyIds: readonly string[]\n  readonly groupIds: ReadonlySet<string>\n}): MembershipOperationScope {\n  return {\n    policyIds: [...input.policyIds],\n    groupIds: new Set(input.groupIds),\n  }\n}\n\nexport function isMembershipOperation(value: unknown): value is MembershipOperation {\n  return MEMBERSHIP_OPERATIONS.includes(value as MembershipOperation)\n}\n",
+    "import {\n  GRANT_KINDS,\n  type GrantUniverseKey,\n  grantKindOf,\n  isSingletonGrantKind,\n} from \"../authorization/grant-kinds\"\nimport { SecurityValidationError } from \"./errors\"\nimport { isMembershipOperation } from \"./membership-policies\"\nimport type {\n  GrantCapability,\n  GrantDefinition,\n  GroupDefinition,\n  MarkingDefinition,\n  MembershipPolicyDefinition,\n  RegisteredSecurityDefinitions,\n  RoleDefinition,\n  Selection,\n} from \"./types\"\n\n/** Registered id universes and singleton capabilities available to role grants. */\ntype RegisteredUniverses = Partial<Record<GrantUniverseKey, ReadonlySet<string>>> & {\n  readonly agentAvailable?: boolean\n}\n\n/**\n * Every grant capability, for validating grants that arrive from untyped code.\n *\n * Written as a total `Record<GrantCapability, true>` rather than a bare array so a capability added\n * to `GrantDefinition` is a compile error here — the same discipline `GRANT_KINDS` uses. The\n * hand-written `capability !== \"view\" && …` chain this replaces would have accepted the new\n * capability at startup and then died on `GRANT_KINDS[kind].universeKey`.\n */\nconst GRANT_CAPABILITIES = Object.keys({\n  view: true,\n  edit: true,\n  append: true,\n  apply: true,\n  share: true,\n  run: true,\n  observe: true,\n  manage: true,\n} satisfies Record<GrantCapability, true>) as readonly GrantCapability[]\n\n/** \"'a', 'b', or 'c'\" — the shape the security errors already use. */\nfunction formatAlternatives(values: readonly string[]): string {\n  const quoted = values.map((value) => `'${value}'`)\n  const last = quoted.at(-1)\n  return quoted.length < 2 ? (last ?? \"\") : `${quoted.slice(0, -1).join(\", \")}, or ${last}`\n}\n\nexport type CreateSecurityError = (message: string) => Error\n\n// Shared, single-source validation primitives. The builders reuse these too, so\n// authoring-time and startup-time checks can never drift apart.\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nexport function assertNonEmptyString(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is string {\n  if (typeof value !== \"string\" || value.trim().length === 0) {\n    throw createError(`[Sixb] ${field} must not be empty.`)\n  }\n}\n\nexport function assertOptionalString(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is string | undefined {\n  if (value === undefined) {\n    return\n  }\n\n  if (typeof value !== \"string\") {\n    throw createError(`[Sixb] ${field} must be a string.`)\n  }\n}\n\nfunction assertStringArray(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is readonly string[] {\n  if (!Array.isArray(value)) {\n    throw createError(`[Sixb] ${field} must be an array of group ids.`)\n  }\n\n  for (const item of value) {\n    assertNonEmptyString(item, `${field} item`, createError)\n  }\n}\n\nfunction assertMembershipOperationArray(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is MembershipPolicyDefinition[\"can\"] {\n  if (!Array.isArray(value)) {\n    throw createError(`[Sixb] ${field} must be an array of membership operations.`)\n  }\n\n  for (const item of value) {\n    if (!isMembershipOperation(item)) {\n      throw createError(\n        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`\n      )\n    }\n  }\n}\n\nfunction assertNoDuplicateIds(ids: readonly string[], field: string): void {\n  const seen = new Set<string>()\n  for (const id of ids) {\n    if (seen.has(id)) {\n      throw new SecurityValidationError(`[Sixb] ${field} contains duplicate group id '${id}'.`)\n    }\n    seen.add(id)\n  }\n}\n\nfunction assertNoDuplicateOperations(\n  operations: readonly MembershipPolicyDefinition[\"can\"][number][],\n  field: string\n): void {\n  const seen = new Set<string>()\n  for (const operation of operations) {\n    if (seen.has(operation)) {\n      throw new SecurityValidationError(\n        `[Sixb] ${field} contains duplicate operation '${operation}'.`\n      )\n    }\n    seen.add(operation)\n  }\n}\n\nexport function assertMarkingDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is MarkingDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Marking definition must be an object.\")\n  }\n\n  if (value.kind !== \"marking\") {\n    throw createError(\"[Sixb] Marking definition kind must be 'marking'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Marking id\", createError)\n  assertOptionalString(value.label, `Marking '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Marking '${value.id}' description`, createError)\n}\n\nexport function isMarkingDefinition(value: unknown): value is MarkingDefinition {\n  try {\n    assertMarkingDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertGroupDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is GroupDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Group definition must be an object.\")\n  }\n\n  if (value.kind !== \"group\") {\n    throw createError(\"[Sixb] Group definition kind must be 'group'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Group id\", createError)\n  assertOptionalString(value.label, `Group '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Group '${value.id}' description`, createError)\n}\n\nexport function isGroupDefinition(value: unknown): value is GroupDefinition {\n  try {\n    assertGroupDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertMembershipPolicyDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is MembershipPolicyDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Membership policy definition must be an object.\")\n  }\n\n  if (value.kind !== \"membershipPolicy\") {\n    throw createError(\"[Sixb] Membership policy definition kind must be 'membershipPolicy'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Membership policy id\", createError)\n  assertStringArray(\n    value.grantedToGroupIds,\n    `Membership policy '${value.id}' grantedTo`,\n    createError\n  )\n  assertStringArray(value.scopeGroupIds, `Membership policy '${value.id}' scope`, createError)\n  assertMembershipOperationArray(value.can, `Membership policy '${value.id}' can`, createError)\n}\n\nexport function isMembershipPolicyDefinition(value: unknown): value is MembershipPolicyDefinition {\n  try {\n    assertMembershipPolicyDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertGrantDefinition(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is GrantDefinition {\n  if (!isRecord(value) || value.kind !== \"grant\") {\n    throw createError(`[Sixb] ${field} must contain only grant definitions from 'can'.`)\n  }\n\n  if (!GRANT_CAPABILITIES.includes(value.capability as GrantCapability)) {\n    throw createError(\n      `[Sixb] ${field} grant capability must be ${formatAlternatives(GRANT_CAPABILITIES)}.`\n    )\n  }\n\n  if (value.capability === \"view\" && value.target !== \"object\" && value.target !== \"dataset\") {\n    throw createError(`[Sixb] ${field} view grant target must be 'object' or 'dataset'.`)\n  }\n\n  if (\n    value.capability === \"run\" &&\n    value.target !== \"workflow\" &&\n    value.target !== \"sync\" &&\n    value.target !== \"pipeline\" &&\n    value.target !== \"agent\"\n  ) {\n    throw createError(\n      `[Sixb] ${field} run grant target must be 'workflow', 'sync', 'pipeline', or 'agent'.`\n    )\n  }\n\n  if (value.capability === \"observe\" && value.target !== \"logs\" && value.target !== \"aiUsage\") {\n    throw createError(`[Sixb] ${field} observe grant target must be 'logs' or 'aiUsage'.`)\n  }\n\n  if (value.capability === \"manage\" && value.target !== \"connector\" && value.target !== \"aiUsage\") {\n    throw createError(`[Sixb] ${field} manage grant target must be 'connector' or 'aiUsage'.`)\n  }\n\n  // The agent, logs and AI usage are one surface each, so their grants select nothing. The checks\n  // above settled the capability and target, so the kind is known.\n  if (isSingletonGrantKind(grantKindOf(value as unknown as GrantDefinition))) {\n    if (value.selection !== undefined) {\n      throw createError(\n        `[Sixb] ${field} ${value.capability} grant on '${value.target}' must not declare a selection.`\n      )\n    }\n    return\n  }\n\n  assertSelection(value.selection, field, createError)\n}\n\nfunction assertSelection(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is Selection {\n  if (!isRecord(value) || typeof value.all !== \"boolean\") {\n    throw createError(`[Sixb] ${field} grant must carry a selection from 'can' or a scope.`)\n  }\n\n  const ids = value.all ? value.except : value.ids\n  if (!Array.isArray(ids)) {\n    throw createError(`[Sixb] ${field} grant selection must list ids.`)\n  }\n\n  for (const id of ids) {\n    assertNonEmptyString(id, `${field} grant selection id`, createError)\n  }\n}\n\nexport function assertRoleDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is RoleDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Role definition must be an object.\")\n  }\n\n  if (value.kind !== \"role\") {\n    throw createError(\"[Sixb] Role definition kind must be 'role'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Role id\", createError)\n  assertOptionalString(value.label, `Role '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Role '${value.id}' description`, createError)\n  assertStringArray(value.grantedToGroupIds, `Role '${value.id}' grantedTo`, createError)\n\n  if (!Array.isArray(value.grants)) {\n    throw createError(`[Sixb] Role '${value.id}' grants must be an array.`)\n  }\n\n  for (const grant of value.grants) {\n    assertGrantDefinition(grant, `Role '${value.id}' grants`, createError)\n  }\n\n  if (value.clearances !== undefined) {\n    assertStringArray(value.clearances, `Role '${value.id}' clearances`, createError)\n  }\n}\n\nexport function isRoleDefinition(value: unknown): value is RoleDefinition {\n  try {\n    assertRoleDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function validateSecurityDefinitionsAtStartup(input: {\n  readonly markings?: readonly MarkingDefinition[]\n  readonly groups: readonly GroupDefinition[]\n  readonly membershipPolicies: readonly MembershipPolicyDefinition[]\n  readonly roles?: readonly RoleDefinition[]\n  /** Registered object type ids — when provided, view grants must reference them. */\n  readonly objectTypeIds?: ReadonlySet<string>\n  /** Registered dataset ids — when provided, dataset view grants must reference them. */\n  readonly datasetIds?: ReadonlySet<string>\n  /** Registered action ids — when provided, apply grants must reference them. */\n  readonly actionIds?: ReadonlySet<string>\n  /** Registered workflow ids — when provided, run grants must reference them. */\n  readonly workflowIds?: ReadonlySet<string>\n  /** Registered sync ids — when provided, sync run grants must reference them. */\n  readonly syncIds?: ReadonlySet<string>\n  /** Registered pipeline ids — when provided, pipeline run grants must reference them. */\n  readonly pipelineIds?: ReadonlySet<string>\n  /** Whether the project's single conversational Agent is configured. */\n  readonly agentAvailable?: boolean\n  /** Registered connector ids — when provided, manage grants must reference them. */\n  readonly connectorIds?: ReadonlySet<string>\n  /** Registered Share ids — when provided, share grants must reference them. */\n  readonly shareIds?: ReadonlySet<string>\n}): RegisteredSecurityDefinitions {\n  const markingsById = new Map<string, MarkingDefinition>()\n  const groupsById = new Map<string, GroupDefinition>()\n  const rolesById = new Map<string, RoleDefinition>()\n  const membershipPoliciesById = new Map<string, MembershipPolicyDefinition>()\n\n  for (const marking of input.markings ?? []) {\n    assertMarkingDefinition(marking)\n\n    if (markingsById.has(marking.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate marking id: ${marking.id}`)\n    }\n\n    markingsById.set(marking.id, marking)\n  }\n\n  for (const group of input.groups) {\n    assertGroupDefinition(group)\n\n    if (groupsById.has(group.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate group id: ${group.id}`)\n    }\n\n    groupsById.set(group.id, group)\n  }\n\n  for (const role of input.roles ?? []) {\n    assertRoleDefinition(role)\n\n    if (rolesById.has(role.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate role id: ${role.id}`)\n    }\n\n    if (role.grantedToGroupIds.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${role.id}' must be granted to at least one group.`\n      )\n    }\n\n    const clearances = role.clearances ?? []\n    if (role.grants.length === 0 && clearances.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${role.id}' must declare at least one grant or clearance.`\n      )\n    }\n\n    assertNoDuplicateIds(role.grantedToGroupIds, `Role '${role.id}' grantedTo`)\n    assertNoDuplicateIds(clearances, `Role '${role.id}' clearances`)\n\n    for (const markingId of clearances) {\n      if (!markingsById.has(markingId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Role '${role.id}' clearances reference unknown marking '${markingId}'. Add it to 'security/markings/' or pass it to createSixb({ markings }).`\n        )\n      }\n    }\n\n    for (const groupId of role.grantedToGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Role '${role.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    for (const grant of role.grants) {\n      assertGrantReferences(role.id, grant, input)\n    }\n\n    rolesById.set(role.id, role)\n  }\n\n  for (const policy of input.membershipPolicies) {\n    assertMembershipPolicyDefinition(policy)\n\n    if (membershipPoliciesById.has(policy.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate membership policy id: ${policy.id}`)\n    }\n\n    if (policy.grantedToGroupIds.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Membership policy '${policy.id}' must grant membership authority to at least one group.`\n      )\n    }\n\n    if (policy.can.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Membership policy '${policy.id}' must declare at least one operation.`\n      )\n    }\n\n    assertNoDuplicateIds(policy.grantedToGroupIds, `Membership policy '${policy.id}' grantedTo`)\n    assertNoDuplicateIds(policy.scopeGroupIds, `Membership policy '${policy.id}' scope`)\n    assertNoDuplicateOperations(policy.can, `Membership policy '${policy.id}' can`)\n\n    for (const groupId of policy.grantedToGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Membership policy '${policy.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    for (const groupId of policy.scopeGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Membership policy '${policy.id}' scope references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    membershipPoliciesById.set(policy.id, policy)\n  }\n\n  return {\n    markings: [...markingsById.values()],\n    markingsById,\n    groups: [...groupsById.values()],\n    groupsById,\n    roles: [...rolesById.values()],\n    rolesById,\n    membershipPolicies: [...membershipPoliciesById.values()],\n    membershipPoliciesById,\n  }\n}\n\nfunction assertGrantReferences(\n  roleId: string,\n  grant: GrantDefinition,\n  registered: RegisteredUniverses\n): void {\n  if (grant.capability === \"run\" && grant.target === \"agent\") {\n    const spec = GRANT_KINDS[grantKindOf(grant)]\n    if (!registered.agentAvailable) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${roleId}' grants ${grant.capability} on the project Agent, but it is unavailable. ${spec.fix}`\n      )\n    }\n    return\n  }\n  // Logs and AI usage are always there; only targeted grants name ids to check.\n  if (!(\"selection\" in grant)) return\n  const kind = grantKindOf(grant)\n  if (isSingletonGrantKind(kind)) return\n  const spec = GRANT_KINDS[kind]\n  const universe = registered[spec.universeKey]\n\n  if (!universe) {\n    return\n  }\n\n  // Explicit selections list ids to include; \"all except\" selections list ids\n  // to exclude. Either way every named id must be registered — an unknown id is\n  // a typo that would silently widen or no-op the grant.\n  const ids = grant.selection.all ? grant.selection.except : grant.selection.ids\n\n  for (const id of ids) {\n    if (!universe.has(id)) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${roleId}' grants ${grant.capability} on unknown ${spec.subject} '${id}'. ${spec.fix}`\n      )\n    }\n  }\n}\n",
+    "import { SecurityValidationError } from \"./errors\"\nimport type {\n  GrantDefinition,\n  GroupDefinition,\n  MarkingDefinition,\n  MembershipOperation,\n  MembershipPolicyDefinition,\n  RoleDefinition,\n} from \"./types\"\nimport {\n  assertGrantDefinition,\n  assertNonEmptyString,\n  assertOptionalString,\n  isRecord,\n} from \"./validation\"\n\nexport interface DefineGroupOptions {\n  readonly label?: string\n  readonly description?: string\n}\n\nexport interface DefineMarkingOptions {\n  readonly label?: string\n  readonly description?: string\n}\n\nexport interface DefineRoleOptions {\n  readonly label?: string\n  readonly description?: string\n  readonly grantedTo: readonly GroupDefinition[]\n  readonly grants?: readonly GrantDefinition[]\n  /** Markings this role's members may read. */\n  readonly clearances?: readonly MarkingDefinition[]\n}\n\nexport interface DefineMembershipPolicyOptions {\n  readonly grantedTo: readonly GroupDefinition[]\n  readonly scope: readonly GroupDefinition[]\n  readonly can: readonly MembershipOperation[]\n}\n\nconst MEMBERSHIP_OPERATIONS = new Set<MembershipOperation>([\n  \"invite\",\n  \"assignGroups\",\n  \"suspend\",\n  \"serviceAccounts\",\n])\n\nfunction assertNonEmptyArray<T>(value: readonly T[], field: string): void {\n  if (value.length === 0) {\n    throw new SecurityValidationError(`[Sixb] ${field} must not be empty.`)\n  }\n}\n\nfunction groupIdsFrom(groups: readonly GroupDefinition[], field: string): readonly string[] {\n  return groups.map((group) => {\n    if (!isRecord(group) || group.kind !== \"group\") {\n      throw new SecurityValidationError(`[Sixb] ${field} must contain only group definitions.`)\n    }\n\n    assertNonEmptyString(group.id, `${field} group id`)\n    return group.id\n  })\n}\n\nfunction membershipOperationsFrom(\n  operations: readonly MembershipOperation[],\n  field: string\n): readonly MembershipOperation[] {\n  return operations.map((operation) => {\n    if (!MEMBERSHIP_OPERATIONS.has(operation)) {\n      throw new SecurityValidationError(\n        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`\n      )\n    }\n\n    return operation\n  })\n}\n\nexport function defineGroup<const TId extends string>(\n  id: TId,\n  options: DefineGroupOptions = {}\n): GroupDefinition<TId> {\n  assertNonEmptyString(id, \"Group id\")\n  assertOptionalString(options.label, `Group '${id}' label`)\n  assertOptionalString(options.description, `Group '${id}' description`)\n\n  return {\n    kind: \"group\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n  }\n}\n\n/** Read the ids of marking definitions, rejecting anything else such as a bare id. */\nexport function markingIdsFrom(\n  markings: readonly MarkingDefinition[],\n  field: string\n): readonly string[] {\n  return markings.map((marking) => {\n    if (!isRecord(marking) || marking.kind !== \"marking\") {\n      throw new SecurityValidationError(`[Sixb] ${field} must contain only marking definitions.`)\n    }\n\n    assertNonEmptyString(marking.id, `${field} marking id`)\n    return marking.id\n  })\n}\n\nexport function defineMarking<const TId extends string>(\n  id: TId,\n  options: DefineMarkingOptions = {}\n): MarkingDefinition<TId> {\n  assertNonEmptyString(id, \"Marking id\")\n  assertOptionalString(options.label, `Marking '${id}' label`)\n  assertOptionalString(options.description, `Marking '${id}' description`)\n\n  return {\n    kind: \"marking\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n  }\n}\n\nexport function defineRole<const TId extends string>(\n  id: TId,\n  options: DefineRoleOptions\n): RoleDefinition<TId> {\n  assertNonEmptyString(id, \"Role id\")\n  assertOptionalString(options.label, `Role '${id}' label`)\n  assertOptionalString(options.description, `Role '${id}' description`)\n  assertNonEmptyArray(options.grantedTo, `Role '${id}' grantedTo`)\n\n  const grantedToGroupIds = groupIdsFrom(options.grantedTo, `Role '${id}' grantedTo`)\n  const grants = options.grants ?? []\n  const clearances = markingIdsFrom(options.clearances ?? [], `Role '${id}' clearances`)\n\n  for (const grant of grants) {\n    assertGrantDefinition(grant, `Role '${id}' grants`)\n  }\n\n  if (grants.length === 0 && clearances.length === 0) {\n    throw new SecurityValidationError(\n      `[Sixb] Role '${id}' must declare at least one grant or clearance.`\n    )\n  }\n\n  return {\n    kind: \"role\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n    grantedToGroupIds,\n    grants,\n    ...(clearances.length > 0 ? { clearances } : {}),\n  }\n}\n\nexport function defineMembershipPolicy<const TId extends string>(\n  id: TId,\n  options: DefineMembershipPolicyOptions\n): MembershipPolicyDefinition<TId> {\n  assertNonEmptyString(id, \"Membership policy id\")\n  assertNonEmptyArray(options.grantedTo, `Membership policy '${id}' grantedTo`)\n  assertNonEmptyArray(options.can, `Membership policy '${id}' can`)\n\n  return {\n    kind: \"membershipPolicy\",\n    id,\n    grantedToGroupIds: groupIdsFrom(options.grantedTo, `Membership policy '${id}' grantedTo`),\n    scopeGroupIds: groupIdsFrom(options.scope, `Membership policy '${id}' scope`),\n    can: membershipOperationsFrom(options.can, `Membership policy '${id}' can`),\n  }\n}\n"
+  ],
+  "mappings": ";;;;;;;;AAAO,MAAM,iCAAgC,MAAM;AAAA,EACxC,OAAO;AAClB;;;ACUA,IAAM,wBAAwB,CAAC,UAAU,gBAAgB,WAAW,iBAAiB;AAE9E,SAAS,4BAA4B,CAAC,OAGnB;AAAA,EACxB,MAAM,eAAe,IAAI,IAAI,MAAM,cAAc;AAAA,EACjD,MAAM,YAAsB,CAAC;AAAA,EAC7B,MAAM,aAAa,2BAA2B;AAAA,EAE9C,WAAW,UAAU,MAAM,oBAAoB;AAAA,IAC7C,IAAI,CAAC,OAAO,kBAAkB,KAAK,CAAC,YAAY,aAAa,IAAI,OAAO,CAAC,GAAG;AAAA,MAC1E;AAAA,IACF;AAAA,IAEA,UAAU,KAAK,OAAO,EAAE;AAAA,IACxB,WAAW,aAAa,OAAO,KAAK;AAAA,MAClC,WAAW,WAAW,UAAU,KAAK,OAAO,EAAE;AAAA,MAC9C,WAAW,WAAW,OAAO,eAAe;AAAA,QAC1C,WAAW,WAAW,SAAS,IAAI,OAAO;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,YAAY;AAAA,MACV,QAAQ,qBAAqB,WAAW,MAAM;AAAA,MAC9C,cAAc,qBAAqB,WAAW,YAAY;AAAA,MAC1D,SAAS,qBAAqB,WAAW,OAAO;AAAA,MAChD,iBAAiB,qBAAqB,WAAW,eAAe;AAAA,IAClE;AAAA,EACF;AAAA;AAGK,SAAS,6BAA6B,CAC3C,OACA,WACA,UACS;AAAA,EACT,MAAM,iBAAiB,MAAM,WAAW;AAAA,EAExC,IAAI,eAAe,UAAU,WAAW,GAAG;AAAA,IACzC,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,SAAS,MAAM,CAAC,YAAY,eAAe,SAAS,IAAI,OAAO,CAAC;AAAA;AAGlE,SAAS,yBAAyB,CACvC,OACA,WACA,UACmB;AAAA,EACnB,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,OAAO,CAAC;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,MAAM,WAAW;AAAA,EACxC,OAAO,SAAS,OAAO,CAAC,YAAY,CAAC,eAAe,SAAS,IAAI,OAAO,CAAC;AAAA;AAG3E,SAAS,0BAA0B,GAGjC;AAAA,EACA,OAAO;AAAA,IACL,QAAQ,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IACrD,cAAc,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IAC3D,SAAS,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IACtD,iBAAiB,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,EAChE;AAAA;AAGF,SAAS,oBAAoB,CAAC,OAGD;AAAA,EAC3B,OAAO;AAAA,IACL,WAAW,CAAC,GAAG,MAAM,SAAS;AAAA,IAC9B,UAAU,IAAI,IAAI,MAAM,QAAQ;AAAA,EAClC;AAAA;AAGK,SAAS,qBAAqB,CAAC,OAA8C;AAAA,EAClF,OAAO,sBAAsB,SAAS,KAA4B;AAAA;;;ACrEpE,IAAM,qBAAqB,OAAO,KAAK;AAAA,EACrC,MAAM;AAAA,EACN,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AAAA,EACP,KAAK;AAAA,EACL,SAAS;AAAA,EACT,QAAQ;AACV,CAAyC;AAGzC,SAAS,kBAAkB,CAAC,QAAmC;AAAA,EAC7D,MAAM,SAAS,OAAO,IAAI,CAAC,UAAU,IAAI,QAAQ;AAAA,EACjD,MAAM,OAAO,OAAO,GAAG,EAAE;AAAA,EACzB,OAAO,OAAO,SAAS,IAAK,QAAQ,KAAM,GAAG,OAAO,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,SAAS;AAAA;AAO9E,SAAS,QAAQ,CAAC,OAAkD;AAAA,EACzE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA;AAGrE,SAAS,oBAAoB,CAClC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC1D;AAAA,EACzB,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAAA,IAC1D,MAAM,YAAY,UAAU,0BAA0B;AAAA,EACxD;AAAA;AAGK,SAAS,oBAAoB,CAClC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC9C;AAAA,EACrC,IAAI,UAAU,WAAW;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,MAAM,YAAY,UAAU,yBAAyB;AAAA,EACvD;AAAA;AAGF,SAAS,iBAAiB,CACxB,OACA,OACA,aACoC;AAAA,EACpC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzB,MAAM,YAAY,UAAU,sCAAsC;AAAA,EACpE;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,qBAAqB,MAAM,GAAG,cAAc,WAAW;AAAA,EACzD;AAAA;AAGF,SAAS,8BAA8B,CACrC,OACA,OACA,aACoD;AAAA,EACpD,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzB,MAAM,YAAY,UAAU,kDAAkD;AAAA,EAChF;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,CAAC,sBAAsB,IAAI,GAAG;AAAA,MAChC,MAAM,YACJ,UAAU,gGACZ;AAAA,IACF;AAAA,EACF;AAAA;AAGF,SAAS,oBAAoB,CAAC,KAAwB,OAAqB;AAAA,EACzE,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,KAAK,IAAI,EAAE,GAAG;AAAA,MAChB,MAAM,IAAI,yBAAwB,UAAU,sCAAsC,MAAM;AAAA,IAC1F;AAAA,IACA,KAAK,IAAI,EAAE;AAAA,EACb;AAAA;AAGF,SAAS,2BAA2B,CAClC,YACA,OACM;AAAA,EACN,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,aAAa,YAAY;AAAA,IAClC,IAAI,KAAK,IAAI,SAAS,GAAG;AAAA,MACvB,MAAM,IAAI,yBACR,UAAU,uCAAuC,aACnD;AAAA,IACF;AAAA,IACA,KAAK,IAAI,SAAS;AAAA,EACpB;AAAA;AAGK,SAAS,uBAAuB,CACrC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC/C;AAAA,EACpC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,8CAA8C;AAAA,EAClE;AAAA,EAEA,IAAI,MAAM,SAAS,WAAW;AAAA,IAC5B,MAAM,YAAY,mDAAmD;AAAA,EACvE;AAAA,EAEA,qBAAqB,MAAM,IAAI,cAAc,WAAW;AAAA,EACxD,qBAAqB,MAAM,OAAO,YAAY,MAAM,aAAa,WAAW;AAAA,EAC5E,qBAAqB,MAAM,aAAa,YAAY,MAAM,mBAAmB,WAAW;AAAA;AAGnF,SAAS,mBAAmB,CAAC,OAA4C;AAAA,EAC9E,IAAI;AAAA,IACF,wBAAwB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC9D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,qBAAqB,CACnC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACjD;AAAA,EAClC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,4CAA4C;AAAA,EAChE;AAAA,EAEA,IAAI,MAAM,SAAS,SAAS;AAAA,IAC1B,MAAM,YAAY,+CAA+C;AAAA,EACnE;AAAA,EAEA,qBAAqB,MAAM,IAAI,YAAY,WAAW;AAAA,EACtD,qBAAqB,MAAM,OAAO,UAAU,MAAM,aAAa,WAAW;AAAA,EAC1E,qBAAqB,MAAM,aAAa,UAAU,MAAM,mBAAmB,WAAW;AAAA;AAGjF,SAAS,iBAAiB,CAAC,OAA0C;AAAA,EAC1E,IAAI;AAAA,IACF,sBAAsB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC5D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,gCAAgC,CAC9C,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACtC;AAAA,EAC7C,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,wDAAwD;AAAA,EAC5E;AAAA,EAEA,IAAI,MAAM,SAAS,oBAAoB;AAAA,IACrC,MAAM,YAAY,sEAAsE;AAAA,EAC1F;AAAA,EAEA,qBAAqB,MAAM,IAAI,wBAAwB,WAAW;AAAA,EAClE,kBACE,MAAM,mBACN,sBAAsB,MAAM,iBAC5B,WACF;AAAA,EACA,kBAAkB,MAAM,eAAe,sBAAsB,MAAM,aAAa,WAAW;AAAA,EAC3F,+BAA+B,MAAM,KAAK,sBAAsB,MAAM,WAAW,WAAW;AAAA;AAGvF,SAAS,4BAA4B,CAAC,OAAqD;AAAA,EAChG,IAAI;AAAA,IACF,iCAAiC,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IACvE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,qBAAqB,CACnC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACjD;AAAA,EAClC,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS;AAAA,IAC9C,MAAM,YAAY,UAAU,uDAAuD;AAAA,EACrF;AAAA,EAEA,IAAI,CAAC,mBAAmB,SAAS,MAAM,UAA6B,GAAG;AAAA,IACrE,MAAM,YACJ,UAAU,kCAAkC,mBAAmB,kBAAkB,IACnF;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,eAAe,UAAU,MAAM,WAAW,YAAY,MAAM,WAAW,WAAW;AAAA,IAC1F,MAAM,YAAY,UAAU,wDAAwD;AAAA,EACtF;AAAA,EAEA,IACE,MAAM,eAAe,SACrB,MAAM,WAAW,cACjB,MAAM,WAAW,UACjB,MAAM,WAAW,cACjB,MAAM,WAAW,SACjB;AAAA,IACA,MAAM,YACJ,UAAU,4EACZ;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,eAAe,aAAa,MAAM,WAAW,UAAU,MAAM,WAAW,WAAW;AAAA,IAC3F,MAAM,YAAY,UAAU,yDAAyD;AAAA,EACvF;AAAA,EAEA,IAAI,MAAM,eAAe,YAAY,MAAM,WAAW,eAAe,MAAM,WAAW,WAAW;AAAA,IAC/F,MAAM,YAAY,UAAU,6DAA6D;AAAA,EAC3F;AAAA,EAIA,IAAI,qBAAqB,YAAY,KAAmC,CAAC,GAAG;AAAA,IAC1E,IAAI,MAAM,cAAc,WAAW;AAAA,MACjC,MAAM,YACJ,UAAU,SAAS,MAAM,wBAAwB,MAAM,uCACzD;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,gBAAgB,MAAM,WAAW,OAAO,WAAW;AAAA;AAGrD,SAAS,eAAe,CACtB,OACA,OACA,aAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,KAAK,KAAK,OAAO,MAAM,QAAQ,WAAW;AAAA,IACtD,MAAM,YAAY,UAAU,2DAA2D;AAAA,EACzF;AAAA,EAEA,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,MAAM;AAAA,EAC7C,IAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AAAA,IACvB,MAAM,YAAY,UAAU,sCAAsC;AAAA,EACpE;AAAA,EAEA,WAAW,MAAM,KAAK;AAAA,IACpB,qBAAqB,IAAI,GAAG,4BAA4B,WAAW;AAAA,EACrE;AAAA;AAGK,SAAS,oBAAoB,CAClC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAClD;AAAA,EACjC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,2CAA2C;AAAA,EAC/D;AAAA,EAEA,IAAI,MAAM,SAAS,QAAQ;AAAA,IACzB,MAAM,YAAY,6CAA6C;AAAA,EACjE;AAAA,EAEA,qBAAqB,MAAM,IAAI,WAAW,WAAW;AAAA,EACrD,qBAAqB,MAAM,OAAO,SAAS,MAAM,aAAa,WAAW;AAAA,EACzE,qBAAqB,MAAM,aAAa,SAAS,MAAM,mBAAmB,WAAW;AAAA,EACrF,kBAAkB,MAAM,mBAAmB,SAAS,MAAM,iBAAiB,WAAW;AAAA,EAEtF,IAAI,CAAC,MAAM,QAAQ,MAAM,MAAM,GAAG;AAAA,IAChC,MAAM,YAAY,gBAAgB,MAAM,8BAA8B;AAAA,EACxE;AAAA,EAEA,WAAW,SAAS,MAAM,QAAQ;AAAA,IAChC,sBAAsB,OAAO,SAAS,MAAM,cAAc,WAAW;AAAA,EACvE;AAAA,EAEA,IAAI,MAAM,eAAe,WAAW;AAAA,IAClC,kBAAkB,MAAM,YAAY,SAAS,MAAM,kBAAkB,WAAW;AAAA,EAClF;AAAA;AAGK,SAAS,gBAAgB,CAAC,OAAyC;AAAA,EACxE,IAAI;AAAA,IACF,qBAAqB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC3D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,oCAAoC,CAAC,OAuBnB;AAAA,EAChC,MAAM,eAAe,IAAI;AAAA,EACzB,MAAM,aAAa,IAAI;AAAA,EACvB,MAAM,YAAY,IAAI;AAAA,EACtB,MAAM,yBAAyB,IAAI;AAAA,EAEnC,WAAW,WAAW,MAAM,YAAY,CAAC,GAAG;AAAA,IAC1C,wBAAwB,OAAO;AAAA,IAE/B,IAAI,aAAa,IAAI,QAAQ,EAAE,GAAG;AAAA,MAChC,MAAM,IAAI,yBAAwB,gCAAgC,QAAQ,IAAI;AAAA,IAChF;AAAA,IAEA,aAAa,IAAI,QAAQ,IAAI,OAAO;AAAA,EACtC;AAAA,EAEA,WAAW,SAAS,MAAM,QAAQ;AAAA,IAChC,sBAAsB,KAAK;AAAA,IAE3B,IAAI,WAAW,IAAI,MAAM,EAAE,GAAG;AAAA,MAC5B,MAAM,IAAI,yBAAwB,8BAA8B,MAAM,IAAI;AAAA,IAC5E;AAAA,IAEA,WAAW,IAAI,MAAM,IAAI,KAAK;AAAA,EAChC;AAAA,EAEA,WAAW,QAAQ,MAAM,SAAS,CAAC,GAAG;AAAA,IACpC,qBAAqB,IAAI;AAAA,IAEzB,IAAI,UAAU,IAAI,KAAK,EAAE,GAAG;AAAA,MAC1B,MAAM,IAAI,yBAAwB,6BAA6B,KAAK,IAAI;AAAA,IAC1E;AAAA,IAEA,IAAI,KAAK,kBAAkB,WAAW,GAAG;AAAA,MACvC,MAAM,IAAI,yBACR,gBAAgB,KAAK,4CACvB;AAAA,IACF;AAAA,IAEA,MAAM,aAAa,KAAK,cAAc,CAAC;AAAA,IACvC,IAAI,KAAK,OAAO,WAAW,KAAK,WAAW,WAAW,GAAG;AAAA,MACvD,MAAM,IAAI,yBACR,gBAAgB,KAAK,mDACvB;AAAA,IACF;AAAA,IAEA,qBAAqB,KAAK,mBAAmB,SAAS,KAAK,eAAe;AAAA,IAC1E,qBAAqB,YAAY,SAAS,KAAK,gBAAgB;AAAA,IAE/D,WAAW,aAAa,YAAY;AAAA,MAClC,IAAI,CAAC,aAAa,IAAI,SAAS,GAAG;AAAA,QAChC,MAAM,IAAI,yBACR,gBAAgB,KAAK,6CAA6C,oFACpE;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,WAAW,KAAK,mBAAmB;AAAA,MAC5C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,gBAAgB,KAAK,2CAA2C,8EAClE;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,SAAS,KAAK,QAAQ;AAAA,MAC/B,sBAAsB,KAAK,IAAI,OAAO,KAAK;AAAA,IAC7C;AAAA,IAEA,UAAU,IAAI,KAAK,IAAI,IAAI;AAAA,EAC7B;AAAA,EAEA,WAAW,UAAU,MAAM,oBAAoB;AAAA,IAC7C,iCAAiC,MAAM;AAAA,IAEvC,IAAI,uBAAuB,IAAI,OAAO,EAAE,GAAG;AAAA,MACzC,MAAM,IAAI,yBAAwB,0CAA0C,OAAO,IAAI;AAAA,IACzF;AAAA,IAEA,IAAI,OAAO,kBAAkB,WAAW,GAAG;AAAA,MACzC,MAAM,IAAI,yBACR,6BAA6B,OAAO,4DACtC;AAAA,IACF;AAAA,IAEA,IAAI,OAAO,IAAI,WAAW,GAAG;AAAA,MAC3B,MAAM,IAAI,yBACR,6BAA6B,OAAO,0CACtC;AAAA,IACF;AAAA,IAEA,qBAAqB,OAAO,mBAAmB,sBAAsB,OAAO,eAAe;AAAA,IAC3F,qBAAqB,OAAO,eAAe,sBAAsB,OAAO,WAAW;AAAA,IACnF,4BAA4B,OAAO,KAAK,sBAAsB,OAAO,SAAS;AAAA,IAE9E,WAAW,WAAW,OAAO,mBAAmB;AAAA,MAC9C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,6BAA6B,OAAO,2CAA2C,8EACjF;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,WAAW,OAAO,eAAe;AAAA,MAC1C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,6BAA6B,OAAO,uCAAuC,8EAC7E;AAAA,MACF;AAAA,IACF;AAAA,IAEA,uBAAuB,IAAI,OAAO,IAAI,MAAM;AAAA,EAC9C;AAAA,EAEA,OAAO;AAAA,IACL,UAAU,CAAC,GAAG,aAAa,OAAO,CAAC;AAAA,IACnC;AAAA,IACA,QAAQ,CAAC,GAAG,WAAW,OAAO,CAAC;AAAA,IAC/B;AAAA,IACA,OAAO,CAAC,GAAG,UAAU,OAAO,CAAC;AAAA,IAC7B;AAAA,IACA,oBAAoB,CAAC,GAAG,uBAAuB,OAAO,CAAC;AAAA,IACvD;AAAA,EACF;AAAA;AAGF,SAAS,qBAAqB,CAC5B,QACA,OACA,YACM;AAAA,EACN,IAAI,MAAM,eAAe,SAAS,MAAM,WAAW,SAAS;AAAA,IAC1D,MAAM,OAAO,YAAY,YAAY,KAAK;AAAA,IAC1C,IAAI,CAAC,WAAW,gBAAgB;AAAA,MAC9B,MAAM,IAAI,yBACR,gBAAgB,kBAAkB,MAAM,2DAA2D,KAAK,KAC1G;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,IAAI,EAAE,eAAe;AAAA,IAAQ;AAAA,EAC7B,MAAM,OAAO,YAAY,KAAK;AAAA,EAC9B,IAAI,qBAAqB,IAAI;AAAA,IAAG;AAAA,EAChC,MAAM,OAAO,YAAY;AAAA,EACzB,MAAM,WAAW,WAAW,KAAK;AAAA,EAEjC,IAAI,CAAC,UAAU;AAAA,IACb;AAAA,EACF;AAAA,EAKA,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM,UAAU,SAAS,MAAM,UAAU;AAAA,EAE3E,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,CAAC,SAAS,IAAI,EAAE,GAAG;AAAA,MACrB,MAAM,IAAI,yBACR,gBAAgB,kBAAkB,MAAM,yBAAyB,KAAK,YAAY,QAAQ,KAAK,KACjG;AAAA,IACF;AAAA,EACF;AAAA;;;AC7dF,IAAM,yBAAwB,IAAI,IAAyB;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,mBAAsB,CAAC,OAAqB,OAAqB;AAAA,EACxE,IAAI,MAAM,WAAW,GAAG;AAAA,IACtB,MAAM,IAAI,yBAAwB,UAAU,0BAA0B;AAAA,EACxE;AAAA;AAGF,SAAS,YAAY,CAAC,QAAoC,OAAkC;AAAA,EAC1F,OAAO,OAAO,IAAI,CAAC,UAAU;AAAA,IAC3B,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS;AAAA,MAC9C,MAAM,IAAI,yBAAwB,UAAU,4CAA4C;AAAA,IAC1F;AAAA,IAEA,qBAAqB,MAAM,IAAI,GAAG,gBAAgB;AAAA,IAClD,OAAO,MAAM;AAAA,GACd;AAAA;AAGH,SAAS,wBAAwB,CAC/B,YACA,OACgC;AAAA,EAChC,OAAO,WAAW,IAAI,CAAC,cAAc;AAAA,IACnC,IAAI,CAAC,uBAAsB,IAAI,SAAS,GAAG;AAAA,MACzC,MAAM,IAAI,yBACR,UAAU,gGACZ;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,GACR;AAAA;AAGI,SAAS,YAAqC,CACnD,IACA,UAA8B,CAAC,GACT;AAAA,EACtB,qBAAqB,IAAI,UAAU;AAAA,EACnC,qBAAqB,QAAQ,OAAO,UAAU,WAAW;AAAA,EACzD,qBAAqB,QAAQ,aAAa,UAAU,iBAAiB;AAAA,EAErE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EAClF;AAAA;AAIK,SAAS,cAAc,CAC5B,UACA,OACmB;AAAA,EACnB,OAAO,SAAS,IAAI,CAAC,YAAY;AAAA,IAC/B,IAAI,CAAC,SAAS,OAAO,KAAK,QAAQ,SAAS,WAAW;AAAA,MACpD,MAAM,IAAI,yBAAwB,UAAU,8CAA8C;AAAA,IAC5F;AAAA,IAEA,qBAAqB,QAAQ,IAAI,GAAG,kBAAkB;AAAA,IACtD,OAAO,QAAQ;AAAA,GAChB;AAAA;AAGI,SAAS,cAAuC,CACrD,IACA,UAAgC,CAAC,GACT;AAAA,EACxB,qBAAqB,IAAI,YAAY;AAAA,EACrC,qBAAqB,QAAQ,OAAO,YAAY,WAAW;AAAA,EAC3D,qBAAqB,QAAQ,aAAa,YAAY,iBAAiB;AAAA,EAEvE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EAClF;AAAA;AAGK,SAAS,WAAoC,CAClD,IACA,SACqB;AAAA,EACrB,qBAAqB,IAAI,SAAS;AAAA,EAClC,qBAAqB,QAAQ,OAAO,SAAS,WAAW;AAAA,EACxD,qBAAqB,QAAQ,aAAa,SAAS,iBAAiB;AAAA,EACpE,oBAAoB,QAAQ,WAAW,SAAS,eAAe;AAAA,EAE/D,MAAM,oBAAoB,aAAa,QAAQ,WAAW,SAAS,eAAe;AAAA,EAClF,MAAM,SAAS,QAAQ,UAAU,CAAC;AAAA,EAClC,MAAM,aAAa,eAAe,QAAQ,cAAc,CAAC,GAAG,SAAS,gBAAgB;AAAA,EAErF,WAAW,SAAS,QAAQ;AAAA,IAC1B,sBAAsB,OAAO,SAAS,YAAY;AAAA,EACpD;AAAA,EAEA,IAAI,OAAO,WAAW,KAAK,WAAW,WAAW,GAAG;AAAA,IAClD,MAAM,IAAI,yBACR,gBAAgB,mDAClB;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,IAChF;AAAA,IACA;AAAA,OACI,WAAW,SAAS,IAAI,EAAE,WAAW,IAAI,CAAC;AAAA,EAChD;AAAA;AAGK,SAAS,uBAAgD,CAC9D,IACA,SACiC;AAAA,EACjC,qBAAqB,IAAI,sBAAsB;AAAA,EAC/C,oBAAoB,QAAQ,WAAW,sBAAsB,eAAe;AAAA,EAC5E,oBAAoB,QAAQ,KAAK,sBAAsB,SAAS;AAAA,EAEhE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,mBAAmB,aAAa,QAAQ,WAAW,sBAAsB,eAAe;AAAA,IACxF,eAAe,aAAa,QAAQ,OAAO,sBAAsB,WAAW;AAAA,IAC5E,KAAK,yBAAyB,QAAQ,KAAK,sBAAsB,SAAS;AAAA,EAC5E;AAAA;",
+  "debugId": "5079B2E8C73E746064756E2164756E21",
+  "names": []
+}

package/dist/{chunk-52bk93x8.js → chunk-fkgc1wt8.js}

@@ -6,7 +6,7 @@ import {
 import {
   ShareDefinitionError2,
   snapshotShareDefinition
-} from "./chunk-3gnrh4ve.js";
+} from "./chunk-vpq4shxz.js";
 import {
   snapshotShareAccessPlan
 } from "./chunk-br3k6qbf.js";

package/dist/{chunk-enpsx8k5.js → chunk-gsjm1wms.js}

@@ -1,11 +1,6 @@
 // @bun
 // src/authorization/grant-kinds.ts
 var GRANT_KINDS = {
-  "access:application": {
-    universeKey: "applicationIds",
-    subject: "application",
-    fix: "Use an application exported from '@sixb/core'."
-  },
   "view:object": {
     universeKey: "objectTypeIds",
     subject: "object type",
@@ -58,13 +53,13 @@ var GRANT_KINDS = {
     fix: "Configure models.language and use the exported agent reference in can.run(agent)."
   },
   "observe:logs": {
-    universeKey: "observableIds",
-    subject: "observability surface",
+    singleton: true,
+    subject: "logs",
     fix: 'Use can.observe("logs").'
   },
   "observe:aiUsage": {
-    universeKey: "observableIds",
-    subject: "observability surface",
+    singleton: true,
+    subject: "AI usage",
     fix: "Use can.observe(agent.usage)."
   },
   "manage:connector": {
@@ -73,17 +68,19 @@ var GRANT_KINDS = {
     fix: "Add it to 'connectors/' or pass it to createSixb({ connectors })."
   },
   "manage:aiUsage": {
-    universeKey: "manageableIds",
-    subject: "management surface",
+    singleton: true,
+    subject: "AI usage",
     fix: "Use can.manage(agent.usage)."
   }
 };
 var GRANT_KIND_KEYS = Object.keys(GRANT_KINDS);
-var TARGETED_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter((kind) => kind !== "run:agent");
+var SINGLETON_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter((kind) => ("singleton" in GRANT_KINDS[kind]));
+var TARGETED_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter((kind) => !("singleton" in GRANT_KINDS[kind]));
+function isSingletonGrantKind(kind) {
+  return "singleton" in GRANT_KINDS[kind];
+}
 function grantKindOf(grant) {
   switch (grant.capability) {
-    case "access":
-      return "access:application";
     case "view":
       return `view:${grant.target}`;
     case "edit":
@@ -104,7 +101,6 @@ function grantKindOf(grant) {
 }
 function emptyGrantSets() {
   return {
-    "access:application": new Set,
     "view:object": new Set,
     "view:dataset": new Set,
     "edit:object": new Set,
@@ -115,13 +111,13 @@ function emptyGrantSets() {
     "run:sync": new Set,
     "run:pipeline": new Set,
     "run:agent": false,
-    "observe:logs": new Set,
-    "observe:aiUsage": new Set,
+    "observe:logs": false,
+    "observe:aiUsage": false,
     "manage:connector": new Set,
-    "manage:aiUsage": new Set
+    "manage:aiUsage": false
   };
 }
 
-export { GRANT_KINDS, TARGETED_GRANT_KIND_KEYS, grantKindOf, emptyGrantSets };
+export { GRANT_KINDS, SINGLETON_GRANT_KIND_KEYS, TARGETED_GRANT_KIND_KEYS, isSingletonGrantKind, grantKindOf, emptyGrantSets };
 
-//# debugId=C6044AB9EC3A569764756E2164756E21
+//# debugId=1C6F3FFB2BACAB1F64756E2164756E21

package/dist/chunk-gsjm1wms.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/authorization/grant-kinds.ts"],
+  "sourcesContent": [
+    "/**\n * Grant kinds: the single source of truth for the (capability, target) space.\n *\n * Every grant collapses to one `GrantKind` discriminant — the same\n * `capability:target` string the decision engine uses as a grant key (e.g.\n * `view:object`, `run:sync`). Resolution, validation, enforcement, and the\n * resolved `GrantIndex` all key off it, so adding a grant family is a single\n * entry in `GRANT_KINDS` plus the compile errors that forces at every consumer.\n */\n\nimport type { GrantDefinition } from \"../security/types\"\n\nexport type GrantKind =\n  | \"view:object\"\n  | \"view:dataset\"\n  | \"edit:object\"\n  | \"append:telemetry\"\n  | \"apply:action\"\n  | \"share:share\"\n  | \"run:workflow\"\n  | \"run:sync\"\n  | \"run:pipeline\"\n  | \"run:agent\"\n  | \"observe:logs\"\n  | \"observe:aiUsage\"\n  | \"manage:connector\"\n  | \"manage:aiUsage\"\n\n/** Capabilities over one project-wide surface: held or not, with no ids to select. */\nexport type SingletonGrantKind = \"run:agent\" | \"observe:logs\" | \"observe:aiUsage\" | \"manage:aiUsage\"\nexport type TargetedGrantKind = Exclude<GrantKind, SingletonGrantKind>\n\n/** Registered id universes a grant kind ranges over, plus subtype expansion. */\nexport interface GrantUniverse {\n  readonly objectTypeIds: ReadonlySet<string>\n  readonly datasetIds: ReadonlySet<string>\n  readonly actionIds: ReadonlySet<string>\n  readonly shareIds: ReadonlySet<string>\n  readonly workflowIds: ReadonlySet<string>\n  readonly syncIds: ReadonlySet<string>\n  readonly pipelineIds: ReadonlySet<string>\n  readonly connectorIds: ReadonlySet<string>\n  readonly getSubTypes: (objectTypeId: string) => readonly string[]\n}\n\n/** The registered-id sets a grant kind validates against (no subtype hook). */\nexport type GrantUniverseKey = Exclude<keyof GrantUniverse, \"getSubTypes\">\n\ninterface TargetedGrantKindSpec {\n  /** Registered universe the grant's ids must belong to. */\n  readonly universeKey: GrantUniverseKey\n  /** Subject noun used in validation errors (\"unknown <subject> '<id>'\"). */\n  readonly subject: string\n  /** Actionable hint appended to the \"unknown <subject>\" error. */\n  readonly fix: string\n  /** Only object-type grants also expand to subtypes. */\n  readonly expandsSubtypes?: true\n}\n\ninterface SingletonGrantKindSpec {\n  /** Project-wide capability with no resource selection; resolves to a boolean. */\n  readonly singleton: true\n  readonly subject: string\n  readonly fix: string\n}\n\n/**\n * The exhaustive grant-kind table. A new grant family is one entry here; the\n * mapped type makes every omission a compile error.\n */\nexport const GRANT_KINDS: {\n  readonly [TKind in GrantKind]: TKind extends SingletonGrantKind\n    ? SingletonGrantKindSpec\n    : TargetedGrantKindSpec\n} = {\n  \"view:object\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n    expandsSubtypes: true,\n  },\n  \"view:dataset\": {\n    universeKey: \"datasetIds\",\n    subject: \"dataset\",\n    fix: \"Add it to 'datasets/' or pass it to createSixb({ datasets }).\",\n  },\n  // Deliberately no `expandsSubtypes`: granting writes on a parent type must not\n  // silently extend to types added under it later. `view:object` expands because\n  // a read of a subtype reveals nothing the parent's grant did not already cover.\n  \"edit:object\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n  },\n  \"append:telemetry\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n  },\n  \"apply:action\": {\n    universeKey: \"actionIds\",\n    subject: \"action\",\n    fix: \"Add it to 'actions/' or pass it to createSixb({ actions }).\",\n  },\n  \"share:share\": {\n    universeKey: \"shareIds\",\n    subject: \"share\",\n    fix: \"Add it to 'shares/' or pass it to createSixb({ shares }).\",\n  },\n  \"run:workflow\": {\n    universeKey: \"workflowIds\",\n    subject: \"workflow\",\n    fix: \"Add it to 'workflows/' or pass it to createSixb({ workflows }).\",\n  },\n  \"run:sync\": {\n    universeKey: \"syncIds\",\n    subject: \"sync\",\n    fix: \"Add it to 'syncs/' or pass it to createSixb({ syncs }).\",\n  },\n  \"run:pipeline\": {\n    universeKey: \"pipelineIds\",\n    subject: \"pipeline\",\n    fix: \"Add it to 'pipelines/' or pass it to createSixb({ pipelines }).\",\n  },\n  \"run:agent\": {\n    singleton: true,\n    subject: \"agent\",\n    fix: \"Configure models.language and use the exported agent reference in can.run(agent).\",\n  },\n  \"observe:logs\": {\n    singleton: true,\n    subject: \"logs\",\n    fix: 'Use can.observe(\"logs\").',\n  },\n  \"observe:aiUsage\": {\n    singleton: true,\n    subject: \"AI usage\",\n    fix: \"Use can.observe(agent.usage).\",\n  },\n  \"manage:connector\": {\n    universeKey: \"connectorIds\",\n    subject: \"connector\",\n    fix: \"Add it to 'connectors/' or pass it to createSixb({ connectors }).\",\n  },\n  \"manage:aiUsage\": {\n    singleton: true,\n    subject: \"AI usage\",\n    fix: \"Use can.manage(agent.usage).\",\n  },\n}\n\nexport const GRANT_KIND_KEYS = Object.keys(GRANT_KINDS) as readonly GrantKind[]\nexport const SINGLETON_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter(\n  (kind): kind is SingletonGrantKind => \"singleton\" in GRANT_KINDS[kind]\n)\nexport const TARGETED_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter(\n  (kind): kind is TargetedGrantKind => !(\"singleton\" in GRANT_KINDS[kind])\n)\n\nexport function isSingletonGrantKind(kind: GrantKind): kind is SingletonGrantKind {\n  return \"singleton\" in GRANT_KINDS[kind]\n}\n\n/** The grant kind a stored grant resolves to. */\nexport function grantKindOf(grant: GrantDefinition): GrantKind {\n  switch (grant.capability) {\n    case \"view\":\n      return `view:${grant.target}`\n    case \"edit\":\n      return \"edit:object\"\n    case \"append\":\n      return \"append:telemetry\"\n    case \"apply\":\n      return \"apply:action\"\n    case \"share\":\n      return \"share:share\"\n    case \"run\":\n      return `run:${grant.target}`\n    case \"observe\":\n      return `observe:${grant.target}`\n    case \"manage\":\n      return `manage:${grant.target}`\n  }\n}\n\n/** Mutable grant index: booleans for singleton capabilities, id sets for selected resources. */\nexport type MutableGrantIndex = {\n  [TKind in GrantKind]: TKind extends SingletonGrantKind ? boolean : Set<string>\n}\n\nexport function emptyGrantSets(): MutableGrantIndex {\n  return {\n    \"view:object\": new Set(),\n    \"view:dataset\": new Set(),\n    \"edit:object\": new Set(),\n    \"append:telemetry\": new Set(),\n    \"apply:action\": new Set(),\n    \"share:share\": new Set(),\n    \"run:workflow\": new Set(),\n    \"run:sync\": new Set(),\n    \"run:pipeline\": new Set(),\n    \"run:agent\": false,\n    \"observe:logs\": false,\n    \"observe:aiUsage\": false,\n    \"manage:connector\": new Set(),\n    \"manage:aiUsage\": false,\n  }\n}\n"
+  ],
+  "mappings": ";;AAsEO,IAAM,cAIT;AAAA,EACF,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,IACL,iBAAiB;AAAA,EACnB;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EAIA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,YAAY;AAAA,IACV,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,aAAa;AAAA,IACX,WAAW;AAAA,IACX,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,WAAW;AAAA,IACX,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,mBAAmB;AAAA,IACjB,WAAW;AAAA,IACX,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,kBAAkB;AAAA,IAChB,WAAW;AAAA,IACX,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AACF;AAEO,IAAM,kBAAkB,OAAO,KAAK,WAAW;AAC/C,IAAM,4BAA4B,gBAAgB,OACvD,CAAC,UAAqC,eAAe,YAAY,MACnE;AACO,IAAM,2BAA2B,gBAAgB,OACtD,CAAC,SAAoC,EAAE,eAAe,YAAY,MACpE;AAEO,SAAS,oBAAoB,CAAC,MAA6C;AAAA,EAChF,OAAO,eAAe,YAAY;AAAA;AAI7B,SAAS,WAAW,CAAC,OAAmC;AAAA,EAC7D,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,QAAQ,MAAM;AAAA,SAClB;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO,OAAO,MAAM;AAAA,SACjB;AAAA,MACH,OAAO,WAAW,MAAM;AAAA,SACrB;AAAA,MACH,OAAO,UAAU,MAAM;AAAA;AAAA;AAStB,SAAS,cAAc,GAAsB;AAAA,EAClD,OAAO;AAAA,IACL,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,eAAe,IAAI;AAAA,IACnB,oBAAoB,IAAI;AAAA,IACxB,gBAAgB,IAAI;AAAA,IACpB,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,YAAY,IAAI;AAAA,IAChB,gBAAgB,IAAI;AAAA,IACpB,aAAa;AAAA,IACb,gBAAgB;AAAA,IAChB,mBAAmB;AAAA,IACnB,oBAAoB,IAAI;AAAA,IACxB,kBAAkB;AAAA,EACpB;AAAA;",
+  "debugId": "1C6F3FFB2BACAB1F64756E2164756E21",
+  "names": []
+}

package/dist/{chunk-2jntasmh.js → chunk-hcbyfxbe.js}

@@ -1,41 +1,7 @@
 // @bun
-// src/auth/errors.ts
-class AuthRuntimeError2 extends Error {
-  code;
-  name = "AuthRuntimeError";
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-  }
-}
-
-class SignInRefusedError2 extends Error {
-  reason;
-  email;
-  name = "SignInRefusedError";
-  constructor(reason, message, email) {
-    super(message);
-    this.reason = reason;
-    this.email = email;
-  }
-}
-
-// src/auth/audience.ts
-var DEFAULT_AUTH_SESSION_AUDIENCE2 = "atlas";
-function isValidAuthSessionAudience2(value) {
-  return value === "atlas" || value === "app";
-}
-function resolveAuthSessionAudience2(value) {
-  const audience = value ?? DEFAULT_AUTH_SESSION_AUDIENCE2;
-  if (!isValidAuthSessionAudience2(audience)) {
-    throw new AuthRuntimeError2("invalid_auth_config", `[Sixb] Auth session audience '${audience}' is invalid. Expected 'atlas' or 'app'.`);
-  }
-  return audience;
-}
-
 // src/auth/cookies.ts
-var DEFAULT_SESSION_COOKIE_NAME2 = "sixb_session";
-var DEFAULT_CSRF_COOKIE_NAME2 = "sixb_csrf";
+var DEFAULT_SESSION_COOKIE_NAME2 = "sixb_session_app";
+var DEFAULT_CSRF_COOKIE_NAME2 = "sixb_csrf_app";
 function resolveAuthCookieOptions2(options) {
   const resolved = {
     sessionCookieName: options?.sessionCookieName ?? DEFAULT_SESSION_COOKIE_NAME2,
@@ -48,17 +14,6 @@ function resolveAuthCookieOptions2(options) {
   assertValidCookieOptions(resolved);
   return resolved;
 }
-function resolveAuthCookieOptionsForAudience(options, audience) {
-  const resolvedAudience = resolveAuthSessionAudience2(audience);
-  if (resolvedAudience === DEFAULT_AUTH_SESSION_AUDIENCE2) {
-    return options;
-  }
-  return {
-    ...options,
-    sessionCookieName: `${options.sessionCookieName}_${resolvedAudience}`,
-    csrfCookieName: `${options.csrfCookieName}_${resolvedAudience}`
-  };
-}
 function parseCookieHeader2(header) {
   const cookies = new Map;
   if (!header) {
@@ -200,6 +155,27 @@ function requiresSecureCookieName(name) {
   return isHostPrefixedCookieName(name) || name.startsWith("__Secure-");
 }
 
+// src/auth/errors.ts
+class AuthRuntimeError2 extends Error {
+  code;
+  name = "AuthRuntimeError";
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+
+class SignInRefusedError2 extends Error {
+  reason;
+  email;
+  name = "SignInRefusedError";
+  constructor(reason, message, email) {
+    super(message);
+    this.reason = reason;
+    this.email = email;
+  }
+}
+
 // src/auth/validation.ts
 var DAY = 24 * 60 * 60 * 1000;
 var DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS2 = 30 * DAY;
@@ -316,6 +292,6 @@ function assertValidStrategy(strategy) {
   }
 }
 
-export { AuthRuntimeError2, SignInRefusedError2, DEFAULT_AUTH_SESSION_AUDIENCE2, isValidAuthSessionAudience2, resolveAuthSessionAudience2, DEFAULT_SESSION_COOKIE_NAME2, DEFAULT_CSRF_COOKIE_NAME2, resolveAuthCookieOptions2, resolveAuthCookieOptionsForAudience, parseCookieHeader2, getCookie2, serializeCookie2, shouldUseSecureCookies2, createSessionCookieHeader2, createCsrfCookieHeader2, clearSessionCookieHeader2, clearCsrfCookieHeader2, DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS2, DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS2, DEFAULT_AUTH_INVITATION_TTL_MS2, MAX_AUTH_INVITATION_TTL_MS2, DEFAULT_AUTH_SESSION_CACHE_TTL_MS2, resolveAuthConfig2, resolveInvitationExpiresAt, assertNonEmpty3, normalizePagination, isMagicLinkAuthStrategy2, isInvitationDeliveryAuthStrategy2, isOidcAuthStrategy2 };
+export { DEFAULT_SESSION_COOKIE_NAME2, DEFAULT_CSRF_COOKIE_NAME2, resolveAuthCookieOptions2, parseCookieHeader2, getCookie2, serializeCookie2, shouldUseSecureCookies2, createSessionCookieHeader2, createCsrfCookieHeader2, clearSessionCookieHeader2, clearCsrfCookieHeader2, AuthRuntimeError2, SignInRefusedError2, DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS2, DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS2, DEFAULT_AUTH_INVITATION_TTL_MS2, MAX_AUTH_INVITATION_TTL_MS2, DEFAULT_AUTH_SESSION_CACHE_TTL_MS2, resolveAuthConfig2, resolveInvitationExpiresAt, assertNonEmpty3, normalizePagination, isMagicLinkAuthStrategy2, isInvitationDeliveryAuthStrategy2, isOidcAuthStrategy2 };
 
-//# debugId=E4EC0B2B5EB9DD3264756E2164756E21
+//# debugId=D416279B4950C46864756E2164756E21

package/dist/chunk-hcbyfxbe.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/auth/cookies.ts", "../src/auth/errors.ts", "../src/auth/validation.ts"],
+  "sourcesContent": [
+    "import type { AuthCookieOptions } from \"./types\"\n\n// The names the app's cookies had beside Atlas's, so its sessions survived Atlas leaving.\nexport const DEFAULT_SESSION_COOKIE_NAME = \"sixb_session_app\"\nexport const DEFAULT_CSRF_COOKIE_NAME = \"sixb_csrf_app\"\n\nexport interface ResolvedAuthCookieOptions {\n  readonly sessionCookieName: string\n  readonly csrfCookieName: string\n  readonly domain?: string\n  readonly secure: boolean | \"auto\"\n  readonly sameSite: \"strict\"\n  readonly csrfHttpOnly: boolean\n}\n\ninterface CookieSerializationOptions {\n  readonly name: string\n  readonly value: string\n  readonly httpOnly?: boolean\n  readonly maxAge?: number\n  readonly expires?: Date\n  readonly domain?: string\n  readonly secure?: boolean\n  readonly sameSite: \"strict\"\n}\n\nexport function resolveAuthCookieOptions(\n  options: AuthCookieOptions | undefined\n): ResolvedAuthCookieOptions {\n  const resolved = {\n    sessionCookieName: options?.sessionCookieName ?? DEFAULT_SESSION_COOKIE_NAME,\n    csrfCookieName: options?.csrfCookieName ?? DEFAULT_CSRF_COOKIE_NAME,\n    domain: options?.cookieDomain,\n    secure: options?.secure ?? \"auto\",\n    sameSite: options?.sameSite ?? \"strict\",\n    csrfHttpOnly: options?.csrfHttpOnly ?? false,\n  }\n\n  assertValidCookieOptions(resolved)\n  return resolved\n}\n\nexport function parseCookieHeader(header: string | null): ReadonlyMap<string, string> {\n  const cookies = new Map<string, string>()\n  if (!header) {\n    return cookies\n  }\n\n  for (const part of header.split(\";\")) {\n    const separator = part.indexOf(\"=\")\n    if (separator <= 0) {\n      continue\n    }\n\n    const name = part.slice(0, separator).trim()\n    if (!name || cookies.has(name)) {\n      continue\n    }\n\n    const value = part.slice(separator + 1).trim()\n    cookies.set(name, value)\n  }\n\n  return cookies\n}\n\nexport function getCookie(request: Request, name: string): string | undefined {\n  return parseCookieHeader(request.headers.get(\"cookie\")).get(name)\n}\n\nexport function serializeCookie(options: CookieSerializationOptions): string {\n  const parts = [`${options.name}=${options.value}`]\n\n  parts.push(\"Path=/\")\n  parts.push(\"SameSite=Strict\")\n\n  if (options.domain) {\n    parts.push(`Domain=${options.domain}`)\n  }\n\n  if (options.httpOnly) {\n    parts.push(\"HttpOnly\")\n  }\n\n  if (options.secure) {\n    parts.push(\"Secure\")\n  }\n\n  if (options.maxAge !== undefined) {\n    parts.push(`Max-Age=${Math.trunc(options.maxAge)}`)\n  }\n\n  if (options.expires) {\n    parts.push(`Expires=${options.expires.toUTCString()}`)\n  }\n\n  return parts.join(\"; \")\n}\n\nexport function shouldUseSecureCookies(\n  request: Request,\n  options: ResolvedAuthCookieOptions\n): boolean {\n  if (\n    requiresSecureCookieName(options.sessionCookieName) ||\n    requiresSecureCookieName(options.csrfCookieName)\n  ) {\n    return true\n  }\n\n  if (typeof options.secure === \"boolean\") {\n    return options.secure\n  }\n\n  const url = new URL(request.url)\n  if (isLocalhost(url.hostname)) {\n    return false\n  }\n\n  return url.protocol === \"https:\" || process.env.NODE_ENV === \"production\"\n}\n\nexport function createSessionCookieHeader(params: {\n  readonly request: Request\n  readonly value: string\n  readonly expiresAt: Date\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  const lifetime = resolveCookieLifetime(params.expiresAt)\n  return serializeCookie({\n    name: params.options.sessionCookieName,\n    value: params.value,\n    httpOnly: true,\n    ...lifetime,\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nexport function createCsrfCookieHeader(params: {\n  readonly request: Request\n  readonly value: string\n  readonly expiresAt: Date\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  const lifetime = resolveCookieLifetime(params.expiresAt)\n  return serializeCookie({\n    name: params.options.csrfCookieName,\n    value: params.value,\n    httpOnly: params.options.csrfHttpOnly,\n    ...lifetime,\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nfunction resolveCookieLifetime(expiresAt: Date): {\n  readonly maxAge: number\n  readonly expires: Date\n} {\n  const expiresAtMs = expiresAt.getTime()\n  if (!Number.isFinite(expiresAtMs)) {\n    throw new Error(\"[Sixb] Auth cookie expiresAt must be a valid date.\")\n  }\n\n  return {\n    maxAge: Math.max(0, Math.floor((expiresAtMs - Date.now()) / 1000)),\n    expires: new Date(expiresAtMs),\n  }\n}\n\nexport function clearSessionCookieHeader(params: {\n  readonly request: Request\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  return serializeCookie({\n    name: params.options.sessionCookieName,\n    value: \"\",\n    httpOnly: true,\n    maxAge: 0,\n    expires: new Date(0),\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nexport function clearCsrfCookieHeader(params: {\n  readonly request: Request\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  return serializeCookie({\n    name: params.options.csrfCookieName,\n    value: \"\",\n    maxAge: 0,\n    expires: new Date(0),\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nfunction isLocalhost(hostname: string): boolean {\n  return hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n}\n\nfunction assertValidCookieOptions(options: ResolvedAuthCookieOptions): void {\n  assertValidCookieName(options.sessionCookieName, \"sessionCookieName\")\n  assertValidCookieName(options.csrfCookieName, \"csrfCookieName\")\n\n  if (options.sameSite !== \"strict\") {\n    throw new Error(\"[Sixb] Auth cookie sameSite must be 'strict'.\")\n  }\n\n  if (\n    options.domain &&\n    (isHostPrefixedCookieName(options.sessionCookieName) ||\n      isHostPrefixedCookieName(options.csrfCookieName))\n  ) {\n    throw new Error(\"[Sixb] __Host- auth cookies cannot be configured with cookieDomain.\")\n  }\n\n  if (\n    options.secure === false &&\n    (requiresSecureCookieName(options.sessionCookieName) ||\n      requiresSecureCookieName(options.csrfCookieName))\n  ) {\n    throw new Error(\"[Sixb] __Host- auth cookies require secure cookies.\")\n  }\n}\n\nfunction assertValidCookieName(name: string, label: string): void {\n  if (!/^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/.test(name)) {\n    throw new Error(`[Sixb] Auth cookie ${label} '${name}' is not a valid cookie name.`)\n  }\n}\n\nfunction isHostPrefixedCookieName(name: string): boolean {\n  return name.startsWith(\"__Host-\")\n}\n\nfunction requiresSecureCookieName(name: string): boolean {\n  return isHostPrefixedCookieName(name) || name.startsWith(\"__Secure-\")\n}\n",
+    "export type AuthRuntimeErrorCode =\n  | \"authentication_required\"\n  | \"auth_storage_missing\"\n  | \"authorization_denied\"\n  | \"invalid_auth_input\"\n  | \"invalid_auth_config\"\n  | \"rate_limited\"\n  | \"production_auth_required\"\n\nexport class AuthRuntimeError extends Error {\n  readonly name = \"AuthRuntimeError\"\n\n  constructor(\n    readonly code: AuthRuntimeErrorCode,\n    message: string\n  ) {\n    super(message)\n  }\n}\n\n/** Why a strategy refused someone who authenticated. Each is something a person can act on. */\nexport type SignInRefusalReason =\n  | \"not_invited\"\n  | \"suspended\"\n  | \"domain_not_allowed\"\n  | \"no_trusted_address\"\n\n/**\n * Thrown by a strategy that refuses a sign-in for a known reason. The sign-in page tells the\n * person which reason, naming `email` when there is one; `message` is for the server log.\n */\nexport class SignInRefusedError extends Error {\n  readonly name = \"SignInRefusedError\"\n\n  constructor(\n    readonly reason: SignInRefusalReason,\n    message: string,\n    readonly email?: string\n  ) {\n    super(message)\n  }\n}\n",
+    "import { resolveAuthCookieOptions } from \"./cookies\"\nimport { AuthRuntimeError } from \"./errors\"\nimport type {\n  AuthSessionOptions,\n  AuthStrategy,\n  InvitationDeliveryAuthStrategy,\n  MagicLinkAuthStrategy,\n  OidcAuthStrategy,\n  ResolvedAuthConfig,\n  SixbAuthConfig,\n} from \"./types\"\n\nconst DAY = 24 * 60 * 60 * 1000\n\nexport const DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS = 30 * DAY\nexport const DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS = 7 * DAY\nexport const DEFAULT_AUTH_INVITATION_TTL_MS = 7 * DAY\nexport const MAX_AUTH_INVITATION_TTL_MS = 30 * DAY\n/**\n * Default in-process session cache window. Short enough that a revoked session lingers\n * only briefly, long enough to collapse a burst of requests to a single auth resolution.\n */\nexport const DEFAULT_AUTH_SESSION_CACHE_TTL_MS = 5_000\n\nexport function resolveAuthConfig(config: SixbAuthConfig | undefined): ResolvedAuthConfig {\n  if (!config) {\n    return {\n      strategy: null,\n      session: resolveAuthSessionOptions(undefined),\n      cookies: resolveAuthCookieOptions(undefined),\n    }\n  }\n\n  const strategy = \"strategy\" in config ? config.strategy : config\n  assertValidStrategy(strategy)\n\n  return {\n    strategy,\n    session: resolveAuthSessionOptions(\"strategy\" in config ? config.session : undefined),\n    cookies: resolveAuthCookieOptions(\"strategy\" in config ? config.cookies : undefined),\n  }\n}\n\nexport function resolveInvitationExpiresAt(value: Date | undefined, now: Date): Date {\n  const expiresAt = value\n    ? new Date(value)\n    : new Date(now.getTime() + DEFAULT_AUTH_INVITATION_TTL_MS)\n  const expiresAtTime = expiresAt.getTime()\n\n  if (!Number.isFinite(expiresAtTime)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation expiresAt must be a valid date.\"\n    )\n  }\n\n  if (expiresAtTime <= now.getTime()) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation expiresAt must be in the future.\"\n    )\n  }\n\n  if (expiresAtTime > now.getTime() + MAX_AUTH_INVITATION_TTL_MS) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation expiresAt must be no more than 30 days in the future.\"\n    )\n  }\n\n  return expiresAt\n}\n\nexport function sanitizeReturnTo(value: string | undefined): string {\n  if (!value || !value.startsWith(\"/\") || value.startsWith(\"//\")) {\n    return \"/\"\n  }\n\n  try {\n    const parsed = new URL(value, \"http://sixb.local\")\n    if (parsed.origin !== \"http://sixb.local\") {\n      return \"/\"\n    }\n\n    return `${parsed.pathname}${parsed.search}${parsed.hash}`\n  } catch {\n    return \"/\"\n  }\n}\n\nexport function assertNonEmpty(value: string, label: string): string {\n  const normalized = value.trim()\n  if (!normalized) {\n    throw new AuthRuntimeError(\"invalid_auth_input\", `[Sixb] ${label} must be a non-empty string.`)\n  }\n  return normalized\n}\n\nexport function normalizePagination(input: { readonly limit?: number; readonly offset?: number }): {\n  readonly limit?: number\n  readonly offset: number\n} {\n  if (input.limit !== undefined && (!Number.isInteger(input.limit) || input.limit < 0)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation list limit must be a non-negative integer.\"\n    )\n  }\n\n  if (input.offset !== undefined && (!Number.isInteger(input.offset) || input.offset < 0)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation list offset must be a non-negative integer.\"\n    )\n  }\n\n  return {\n    limit: input.limit,\n    offset: input.offset ?? 0,\n  }\n}\n\nfunction resolveAuthSessionOptions(\n  options: AuthSessionOptions | undefined\n): ResolvedAuthConfig[\"session\"] {\n  const idleTimeoutMs = options?.idleTimeoutMs ?? DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS\n  if (!Number.isFinite(idleTimeoutMs) || idleTimeoutMs <= 0) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session idleTimeoutMs must be a positive finite number.\"\n    )\n  }\n\n  const renewalWindowMs = options?.renewalWindowMs ?? DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS\n  if (!Number.isFinite(renewalWindowMs) || renewalWindowMs <= 0) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session renewalWindowMs must be a positive finite number.\"\n    )\n  }\n  if (renewalWindowMs >= idleTimeoutMs) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session renewalWindowMs must be less than idleTimeoutMs.\"\n    )\n  }\n\n  const absoluteTimeoutMs = options?.absoluteTimeoutMs\n  if (\n    absoluteTimeoutMs !== undefined &&\n    (!Number.isFinite(absoluteTimeoutMs) || absoluteTimeoutMs <= 0)\n  ) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session absoluteTimeoutMs must be a positive finite number when configured.\"\n    )\n  }\n  if (absoluteTimeoutMs !== undefined && absoluteTimeoutMs < idleTimeoutMs) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session absoluteTimeoutMs must be greater than or equal to idleTimeoutMs.\"\n    )\n  }\n\n  const cacheTtlMs = options?.cacheTtlMs ?? DEFAULT_AUTH_SESSION_CACHE_TTL_MS\n  if (!Number.isFinite(cacheTtlMs) || cacheTtlMs < 0) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session cacheTtlMs must be a non-negative finite number.\"\n    )\n  }\n  if (cacheTtlMs >= renewalWindowMs) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session cacheTtlMs must be less than renewalWindowMs.\"\n    )\n  }\n\n  return {\n    idleTimeoutMs,\n    renewalWindowMs,\n    ...(absoluteTimeoutMs === undefined ? {} : { absoluteTimeoutMs }),\n    cacheTtlMs,\n  }\n}\n\nexport function isMagicLinkAuthStrategy(\n  strategy: AuthStrategy | null\n): strategy is MagicLinkAuthStrategy {\n  if (!strategy || strategy.kind !== \"magicLink\") {\n    return false\n  }\n\n  const candidate = strategy as {\n    readonly requestMagicLink?: unknown\n    readonly completeMagicLinkSignIn?: unknown\n  }\n\n  return (\n    typeof candidate.requestMagicLink === \"function\" &&\n    typeof candidate.completeMagicLinkSignIn === \"function\"\n  )\n}\n\nexport function isInvitationDeliveryAuthStrategy(\n  strategy: AuthStrategy | null\n): strategy is InvitationDeliveryAuthStrategy {\n  if (!strategy) {\n    return false\n  }\n\n  const candidate = strategy as {\n    readonly deliverInvitation?: unknown\n  }\n\n  return typeof candidate.deliverInvitation === \"function\"\n}\n\nexport function isOidcAuthStrategy(strategy: AuthStrategy | null): strategy is OidcAuthStrategy {\n  if (!strategy || strategy.kind !== \"oidc\") {\n    return false\n  }\n\n  const candidate = strategy as {\n    readonly startOidcSignIn?: unknown\n    readonly completeOidcSignIn?: unknown\n  }\n\n  return (\n    typeof candidate.startOidcSignIn === \"function\" &&\n    typeof candidate.completeOidcSignIn === \"function\"\n  )\n}\n\nfunction assertValidStrategy(strategy: AuthStrategy): void {\n  if (!strategy.id.trim()) {\n    throw new AuthRuntimeError(\"invalid_auth_config\", \"[Sixb] Auth strategy id is required.\")\n  }\n}\n"
+  ],
+  "mappings": ";;AAGO,IAAM,+BAA8B;AACpC,IAAM,4BAA2B;AAsBjC,SAAS,yBAAwB,CACtC,SAC2B;AAAA,EAC3B,MAAM,WAAW;AAAA,IACf,mBAAmB,SAAS,qBAAqB;AAAA,IACjD,gBAAgB,SAAS,kBAAkB;AAAA,IAC3C,QAAQ,SAAS;AAAA,IACjB,QAAQ,SAAS,UAAU;AAAA,IAC3B,UAAU,SAAS,YAAY;AAAA,IAC/B,cAAc,SAAS,gBAAgB;AAAA,EACzC;AAAA,EAEA,yBAAyB,QAAQ;AAAA,EACjC,OAAO;AAAA;AAGF,SAAS,kBAAiB,CAAC,QAAoD;AAAA,EACpF,MAAM,UAAU,IAAI;AAAA,EACpB,IAAI,CAAC,QAAQ;AAAA,IACX,OAAO;AAAA,EACT;AAAA,EAEA,WAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AAAA,IACpC,MAAM,YAAY,KAAK,QAAQ,GAAG;AAAA,IAClC,IAAI,aAAa,GAAG;AAAA,MAClB;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK;AAAA,IAC3C,IAAI,CAAC,QAAQ,QAAQ,IAAI,IAAI,GAAG;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,MAAM,QAAQ,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK;AAAA,IAC7C,QAAQ,IAAI,MAAM,KAAK;AAAA,EACzB;AAAA,EAEA,OAAO;AAAA;AAGF,SAAS,UAAS,CAAC,SAAkB,MAAkC;AAAA,EAC5E,OAAO,mBAAkB,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,IAAI;AAAA;AAG3D,SAAS,gBAAe,CAAC,SAA6C;AAAA,EAC3E,MAAM,QAAQ,CAAC,GAAG,QAAQ,QAAQ,QAAQ,OAAO;AAAA,EAEjD,MAAM,KAAK,QAAQ;AAAA,EACnB,MAAM,KAAK,iBAAiB;AAAA,EAE5B,IAAI,QAAQ,QAAQ;AAAA,IAClB,MAAM,KAAK,UAAU,QAAQ,QAAQ;AAAA,EACvC;AAAA,EAEA,IAAI,QAAQ,UAAU;AAAA,IACpB,MAAM,KAAK,UAAU;AAAA,EACvB;AAAA,EAEA,IAAI,QAAQ,QAAQ;AAAA,IAClB,MAAM,KAAK,QAAQ;AAAA,EACrB;AAAA,EAEA,IAAI,QAAQ,WAAW,WAAW;AAAA,IAChC,MAAM,KAAK,WAAW,KAAK,MAAM,QAAQ,MAAM,GAAG;AAAA,EACpD;AAAA,EAEA,IAAI,QAAQ,SAAS;AAAA,IACnB,MAAM,KAAK,WAAW,QAAQ,QAAQ,YAAY,GAAG;AAAA,EACvD;AAAA,EAEA,OAAO,MAAM,KAAK,IAAI;AAAA;AAGjB,SAAS,uBAAsB,CACpC,SACA,SACS;AAAA,EACT,IACE,yBAAyB,QAAQ,iBAAiB,KAClD,yBAAyB,QAAQ,cAAc,GAC/C;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,OAAO,QAAQ,WAAW,WAAW;AAAA,IACvC,OAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAAA,EAC/B,IAAI,YAAY,IAAI,QAAQ,GAAG;AAAA,IAC7B,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,IAAI,aAAa,YAAY;AAAA;AAG/B,SAAS,0BAAyB,CAAC,QAK/B;AAAA,EACT,MAAM,WAAW,sBAAsB,OAAO,SAAS;AAAA,EACvD,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO,OAAO;AAAA,IACd,UAAU;AAAA,OACP;AAAA,IACH,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGI,SAAS,uBAAsB,CAAC,QAK5B;AAAA,EACT,MAAM,WAAW,sBAAsB,OAAO,SAAS;AAAA,EACvD,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO,OAAO;AAAA,IACd,UAAU,OAAO,QAAQ;AAAA,OACtB;AAAA,IACH,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGH,SAAS,qBAAqB,CAAC,WAG7B;AAAA,EACA,MAAM,cAAc,UAAU,QAAQ;AAAA,EACtC,IAAI,CAAC,OAAO,SAAS,WAAW,GAAG;AAAA,IACjC,MAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AAAA,EAEA,OAAO;AAAA,IACL,QAAQ,KAAK,IAAI,GAAG,KAAK,OAAO,cAAc,KAAK,IAAI,KAAK,IAAI,CAAC;AAAA,IACjE,SAAS,IAAI,KAAK,WAAW;AAAA,EAC/B;AAAA;AAGK,SAAS,yBAAwB,CAAC,QAG9B;AAAA,EACT,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO;AAAA,IACP,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,SAAS,IAAI,KAAK,CAAC;AAAA,IACnB,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGI,SAAS,sBAAqB,CAAC,QAG3B;AAAA,EACT,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS,IAAI,KAAK,CAAC;AAAA,IACnB,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGH,SAAS,WAAW,CAAC,UAA2B;AAAA,EAC9C,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAAA;AAG9E,SAAS,wBAAwB,CAAC,SAA0C;AAAA,EAC1E,sBAAsB,QAAQ,mBAAmB,mBAAmB;AAAA,EACpE,sBAAsB,QAAQ,gBAAgB,gBAAgB;AAAA,EAE9D,IAAI,QAAQ,aAAa,UAAU;AAAA,IACjC,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EAEA,IACE,QAAQ,WACP,yBAAyB,QAAQ,iBAAiB,KACjD,yBAAyB,QAAQ,cAAc,IACjD;AAAA,IACA,MAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAAA,EAEA,IACE,QAAQ,WAAW,UAClB,yBAAyB,QAAQ,iBAAiB,KACjD,yBAAyB,QAAQ,cAAc,IACjD;AAAA,IACA,MAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AAAA;AAGF,SAAS,qBAAqB,CAAC,MAAc,OAAqB;AAAA,EAChE,IAAI,CAAC,iCAAiC,KAAK,IAAI,GAAG;AAAA,IAChD,MAAM,IAAI,MAAM,sBAAsB,UAAU,mCAAmC;AAAA,EACrF;AAAA;AAGF,SAAS,wBAAwB,CAAC,MAAuB;AAAA,EACvD,OAAO,KAAK,WAAW,SAAS;AAAA;AAGlC,SAAS,wBAAwB,CAAC,MAAuB;AAAA,EACvD,OAAO,yBAAyB,IAAI,KAAK,KAAK,WAAW,WAAW;AAAA;;;AC3O/D,MAAM,0BAAyB,MAAM;AAAA,EAI/B;AAAA,EAHF,OAAO;AAAA,EAEhB,WAAW,CACA,MACT,SACA;AAAA,IACA,MAAM,OAAO;AAAA,IAHJ;AAAA;AAKb;AAAA;AAaO,MAAM,4BAA2B,MAAM;AAAA,EAIjC;AAAA,EAEA;AAAA,EALF,OAAO;AAAA,EAEhB,WAAW,CACA,QACT,SACS,OACT;AAAA,IACA,MAAM,OAAO;AAAA,IAJJ;AAAA,IAEA;AAAA;AAIb;;;AC7BA,IAAM,MAAM,KAAK,KAAK,KAAK;AAEpB,IAAM,wCAAuC,KAAK;AAClD,IAAM,0CAAyC,IAAI;AACnD,IAAM,kCAAiC,IAAI;AAC3C,IAAM,8BAA6B,KAAK;AAKxC,IAAM,qCAAoC;AAE1C,SAAS,kBAAiB,CAAC,QAAwD;AAAA,EACxF,IAAI,CAAC,QAAQ;AAAA,IACX,OAAO;AAAA,MACL,UAAU;AAAA,MACV,SAAS,0BAA0B,SAAS;AAAA,MAC5C,SAAS,0BAAyB,SAAS;AAAA,IAC7C;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,cAAc,SAAS,OAAO,WAAW;AAAA,EAC1D,oBAAoB,QAAQ;AAAA,EAE5B,OAAO;AAAA,IACL;AAAA,IACA,SAAS,0BAA0B,cAAc,SAAS,OAAO,UAAU,SAAS;AAAA,IACpF,SAAS,0BAAyB,cAAc,SAAS,OAAO,UAAU,SAAS;AAAA,EACrF;AAAA;AAGK,SAAS,0BAA0B,CAAC,OAAyB,KAAiB;AAAA,EACnF,MAAM,YAAY,QACd,IAAI,KAAK,KAAK,IACd,IAAI,KAAK,IAAI,QAAQ,IAAI,+BAA8B;AAAA,EAC3D,MAAM,gBAAgB,UAAU,QAAQ;AAAA,EAExC,IAAI,CAAC,OAAO,SAAS,aAAa,GAAG;AAAA,IACnC,MAAM,IAAI,kBACR,sBACA,mDACF;AAAA,EACF;AAAA,EAEA,IAAI,iBAAiB,IAAI,QAAQ,GAAG;AAAA,IAClC,MAAM,IAAI,kBACR,sBACA,oDACF;AAAA,EACF;AAAA,EAEA,IAAI,gBAAgB,IAAI,QAAQ,IAAI,6BAA4B;AAAA,IAC9D,MAAM,IAAI,kBACR,sBACA,yEACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;AAoBF,SAAS,eAAc,CAAC,OAAe,OAAuB;AAAA,EACnE,MAAM,aAAa,MAAM,KAAK;AAAA,EAC9B,IAAI,CAAC,YAAY;AAAA,IACf,MAAM,IAAI,kBAAiB,sBAAsB,UAAU,mCAAmC;AAAA,EAChG;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,mBAAmB,CAAC,OAGlC;AAAA,EACA,IAAI,MAAM,UAAU,cAAc,CAAC,OAAO,UAAU,MAAM,KAAK,KAAK,MAAM,QAAQ,IAAI;AAAA,IACpF,MAAM,IAAI,kBACR,sBACA,8DACF;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,WAAW,cAAc,CAAC,OAAO,UAAU,MAAM,MAAM,KAAK,MAAM,SAAS,IAAI;AAAA,IACvF,MAAM,IAAI,kBACR,sBACA,+DACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,QAAQ,MAAM,UAAU;AAAA,EAC1B;AAAA;AAGF,SAAS,yBAAyB,CAChC,SAC+B;AAAA,EAC/B,MAAM,gBAAgB,SAAS,iBAAiB;AAAA,EAChD,IAAI,CAAC,OAAO,SAAS,aAAa,KAAK,iBAAiB,GAAG;AAAA,IACzD,MAAM,IAAI,kBACR,uBACA,qEACF;AAAA,EACF;AAAA,EAEA,MAAM,kBAAkB,SAAS,mBAAmB;AAAA,EACpD,IAAI,CAAC,OAAO,SAAS,eAAe,KAAK,mBAAmB,GAAG;AAAA,IAC7D,MAAM,IAAI,kBACR,uBACA,uEACF;AAAA,EACF;AAAA,EACA,IAAI,mBAAmB,eAAe;AAAA,IACpC,MAAM,IAAI,kBACR,uBACA,sEACF;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,SAAS;AAAA,EACnC,IACE,sBAAsB,cACrB,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,IAC7D;AAAA,IACA,MAAM,IAAI,kBACR,uBACA,yFACF;AAAA,EACF;AAAA,EACA,IAAI,sBAAsB,aAAa,oBAAoB,eAAe;AAAA,IACxE,MAAM,IAAI,kBACR,uBACA,uFACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAAS,cAAc;AAAA,EAC1C,IAAI,CAAC,OAAO,SAAS,UAAU,KAAK,aAAa,GAAG;AAAA,IAClD,MAAM,IAAI,kBACR,uBACA,sEACF;AAAA,EACF;AAAA,EACA,IAAI,cAAc,iBAAiB;AAAA,IACjC,MAAM,IAAI,kBACR,uBACA,mEACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,OACI,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB;AAAA,IAC/D;AAAA,EACF;AAAA;AAGK,SAAS,wBAAuB,CACrC,UACmC;AAAA,EACnC,IAAI,CAAC,YAAY,SAAS,SAAS,aAAa;AAAA,IAC9C,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAKlB,OACE,OAAO,UAAU,qBAAqB,cACtC,OAAO,UAAU,4BAA4B;AAAA;AAI1C,SAAS,iCAAgC,CAC9C,UAC4C;AAAA,EAC5C,IAAI,CAAC,UAAU;AAAA,IACb,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAIlB,OAAO,OAAO,UAAU,sBAAsB;AAAA;AAGzC,SAAS,mBAAkB,CAAC,UAA6D;AAAA,EAC9F,IAAI,CAAC,YAAY,SAAS,SAAS,QAAQ;AAAA,IACzC,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAKlB,OACE,OAAO,UAAU,oBAAoB,cACrC,OAAO,UAAU,uBAAuB;AAAA;AAI5C,SAAS,mBAAmB,CAAC,UAA8B;AAAA,EACzD,IAAI,CAAC,SAAS,GAAG,KAAK,GAAG;AAAA,IACvB,MAAM,IAAI,kBAAiB,uBAAuB,sCAAsC;AAAA,EAC1F;AAAA;",
+  "debugId": "D416279B4950C46864756E2164756E21",
+  "names": []
+}

package/dist/{chunk-zrmy8zvw.js → chunk-hjzdd750.js}

@@ -41,13 +41,13 @@ import {
   ProjectionValidationError2,
   validateProjectionsAtStartup,
   isProjectionDefinition2
-} from "./chunk-y7rqfrgg.js";
+} from "./chunk-d0bqz29d.js";
 import {
   vectorConfiguration,
   vectorSources,
   normalizeVector2,
   objectBatchKey2
-} from "./chunk-j2bp5ryw.js";
+} from "./chunk-n33z5bjw.js";
 import {
   materializationApplyPhase2
 } from "./chunk-pbcbn83d.js";
@@ -57,7 +57,7 @@ import {
 import {
   executionRecordInputFromRuntime,
   ensureExecutionRecord2
-} from "./chunk-nre82s12.js";
+} from "./chunk-9dmt152s.js";
 import {
   isStorageSerializationFailure2
 } from "./chunk-s16apyk9.js";

package/dist/chunk-hkc3jct7.js.map

@@ -2,7 +2,7 @@
   "version": 3,
   "sources": ["../src/storage/agents/types.ts"],
   "sourcesContent": [
-    "import type { AgentMessage, AgentMessagePart, AgentMessageRole } from \"../../agents/message\"\nimport type { AgentReasoning } from \"../../agents/types\"\nimport type { Principal } from \"../../auth\"\nimport type { FileRef } from \"../../blob-storage\"\nimport type { SixbErrorCode, SixbFailure } from \"../../errors/types\"\nimport type { JsonValue } from \"../../json\"\nimport type { LanguageModelRef } from \"../../models\"\n\n// ── agent_threads — one conversation with an agent ──────────────────────────────────────────────\n\nexport type AgentThreadStatus = \"active\" | \"archived\"\n\n/** Immutable, non-secret application input. Never store resolved env or credentials here. */\nexport type AgentThreadSandboxParams = Readonly<Record<string, JsonValue>>\n\n/** Worker-owned state, independent from the immutable application binding. */\nexport interface AgentThreadSandboxState {\n  /** Exact name passed to the provider. Replacements always receive a fresh name. */\n  readonly name: string\n  readonly status: \"new\" | \"busy\" | \"ready\" | \"blocked\" | \"unavailable\"\n  readonly sourceFingerprint?: string\n  readonly initialized: boolean\n  /** Durable context boundary: local files from before this reset are no longer available. */\n  readonly resetAt?: string\n  /** Never expires automatically: a delayed provider operation must not reach a successor. */\n  readonly owner?: { readonly runId: string; readonly executionToken: string }\n}\n\nexport type TransitionAgentThreadSandboxInput = {\n  readonly projectId: string\n  readonly id: string\n} & (\n  | {\n      readonly action: \"acquire\"\n      readonly runId: string\n      readonly executionToken: string\n      readonly name: string\n      readonly sourceFingerprint: string\n    }\n  | {\n      readonly action: \"replace\"\n      readonly runId: string\n      readonly executionToken: string\n      readonly name: string\n      readonly nextName: string\n    }\n  | {\n      readonly action: \"settle\"\n      readonly runId: string\n      readonly executionToken: string\n      readonly name: string\n      readonly status: \"ready\" | \"blocked\" | \"unavailable\"\n      readonly initialized: boolean\n    }\n  | {\n      readonly action: \"recreate\"\n      readonly expectedSandboxName: string\n      readonly name: string\n    }\n)\n\nexport interface AgentThreadRecord {\n  readonly id: string\n  readonly projectId: string\n  /** Who owns/opened the thread. Reuses the canonical auth principal (gains `agent` later for free). */\n  readonly ownerPrincipal: Principal\n  readonly title?: string\n  readonly sandboxParams?: AgentThreadSandboxParams\n  readonly sandboxState?: AgentThreadSandboxState\n  readonly status: AgentThreadStatus\n  /** Single-flight anchor: the id of the one run currently allowed to write, or `null` when idle. */\n  readonly activeRunId: string | null\n  readonly lastMessageAt?: Date\n  readonly messageCount: number\n  readonly createdAt: Date\n  readonly updatedAt: Date\n}\n\nexport interface CreateAgentThreadInput {\n  readonly id: string\n  readonly projectId: string\n  readonly ownerPrincipal: Principal\n  readonly title?: string\n  readonly sandboxParams?: AgentThreadSandboxParams\n  readonly status?: AgentThreadStatus\n  readonly createdAt?: Date\n  readonly updatedAt?: Date\n}\n\nexport interface ListAgentThreadsInput {\n  readonly projectId: string\n  readonly statuses?: readonly AgentThreadStatus[]\n  readonly ownerPrincipal?: Principal\n  readonly limit?: number\n  readonly offset?: number\n  readonly order?: \"asc\" | \"desc\"\n}\n\nexport interface ListAgentThreadsResult {\n  readonly threads: readonly AgentThreadRecord[]\n  readonly hasMore: boolean\n  readonly total: number\n}\n\n// ── agent_runs — one loop execution (the worker job; attribution + fencing) ───────────────────\n\n/** Lifecycle shared by every durable agent execution, conversational or workflow-owned. */\nexport type AgentExecutionStatus = \"queued\" | \"running\" | \"succeeded\" | \"failed\" | \"cancelled\"\n\nexport type AgentRunStatus = AgentExecutionStatus\nexport type AgentRunKind = \"conversation\" | \"subagent\"\n\n/** Error codes an agent execution can persist and expose through its public contract. */\nexport const AGENT_RUN_FAILURE_CODES = [\n  \"internal.unexpected\",\n  \"runtime.cancelled\",\n  \"agent.execution_failed\",\n  \"ai.usage_limit_exceeded\",\n  \"ai.usage_limit_unavailable\",\n] as const satisfies readonly [SixbErrorCode, ...SixbErrorCode[]]\n\nexport type AgentRunFailureCode = (typeof AGENT_RUN_FAILURE_CODES)[number]\n\n/**\n * Why a run ended — Sixb's provider-independent vocabulary. It includes model-loop reasons plus\n * platform-level endings such as `timeout`, or `interrupted` for a turn whose worker died before\n * finishing it, so reads remain typed and exhaustive. `other` and `unknown` preserve terminal state\n * when a provider adds a new reason.\n */\nexport const AGENT_RUN_FINISH_REASONS = [\n  \"stop\",\n  \"length\",\n  \"content-filter\",\n  \"tool-calls\",\n  \"timeout\",\n  \"interrupted\",\n  \"error\",\n  \"other\",\n  \"unknown\",\n] as const\n\nexport type AgentRunFinishReason = (typeof AGENT_RUN_FINISH_REASONS)[number]\n\n/**\n * Coerce an external finish-reason string — a DB column or an SDK value — to {@link\n * AgentRunFinishReason}. An unrecognised value becomes `\"unknown\"` rather than being dropped.\n */\nexport function coerceAgentRunFinishReason(\n  value: string | null | undefined\n): AgentRunFinishReason | undefined {\n  if (value === null || value === undefined) {\n    return undefined\n  }\n  return (AGENT_RUN_FINISH_REASONS as readonly string[]).includes(value)\n    ? (value as AgentRunFinishReason)\n    : \"unknown\"\n}\n\n/** Stable, user-facing diagnostics emitted by the platform while executing a run. */\nexport const AGENT_RUN_DIAGNOSTIC_CODES = [\n  \"output_file_limit_exceeded\",\n  \"output_file_too_large\",\n  \"output_budget_exhausted\",\n  \"output_collection_failed\",\n  \"output_file_changed\",\n  \"output_storage_failed\",\n  \"step_limit_reached\",\n] as const\n\n/**\n * Closed on purpose, and the wire is closed with it.\n *\n * Sixb writes these codes and the generated client is what reads them, so an open union would only\n * be honest if the HTTP schema were open too — and that costs the OpenAPI enum, the client's\n * autocompletion, and Atlas's exhaustive `switch`. Sixb owns both ends, so a new code is a minor\n * version bump: cheap here, and a broken `switch` is better than a 500 from `z.enum`.\n */\nexport type AgentRunDiagnosticCode = (typeof AGENT_RUN_DIAGNOSTIC_CODES)[number]\nexport type AgentRunDiagnosticSeverity = \"warning\" | \"error\"\n\nexport interface AgentRunDiagnostic {\n  readonly code: AgentRunDiagnosticCode\n  readonly severity: AgentRunDiagnosticSeverity\n  /** `output` for published files, `run` for the turn as a whole. */\n  readonly scope: \"output\" | \"run\"\n  /** Relative path inside the run's published output directory, when one file is involved. */\n  readonly path?: string\n  /** Sanitized, stable copy suitable for display to an end user. */\n  readonly message: string\n}\n\n/**\n * Authorization state for the current queue delivery.\n *\n * `queueLeaseExpiresAt` is a persisted projection of `ClaimedQueueJob.leaseExpiresAt`, not an\n * independently managed run lease. It may only be extended from a successful queue lease renewal.\n */\nexport interface AgentRunExecution {\n  readonly token: string\n  readonly queueLeaseExpiresAt: Date\n}\n\ninterface AgentRunRecordBase {\n  readonly id: string\n  readonly projectId: string\n  readonly executionId: string\n  readonly status: AgentRunStatus\n  readonly modelId?: string\n  /** Why the run ended (our own SDK-independent enum). */\n  readonly finishReason?: AgentRunFinishReason\n  /** Platform diagnostics are transcript annotations, never agent-authored message content. */\n  readonly diagnostics?: readonly AgentRunDiagnostic[]\n  /** Portable failure snapshot when the run did not succeed. */\n  readonly error?: SixbFailure<AgentRunFailureCode>\n  /** Execution attempts: `0` while queued, `1` on first start, incremented on redelivery. */\n  readonly attempt: number\n  readonly execution?: AgentRunExecution\n  readonly createdAt: Date\n  readonly startedAt?: Date\n  readonly completedAt?: Date\n}\n\nexport interface ConversationAgentRunRecord extends AgentRunRecordBase {\n  readonly kind: \"conversation\"\n  readonly threadId: string\n  readonly triggerMessageId: string\n  /** Immutable model selection captured at admission. Absent only on runs predating this field. */\n  readonly spec?: ConversationAgentRunSpec\n}\n\n/** Immutable, serialisable model selection and requester settings for one conversational turn. */\nexport interface ConversationAgentRunSpec {\n  readonly model: LanguageModelRef\n  readonly reasoning?: AgentReasoning\n  /** Canonical IANA time zone of the requester. Absent uses the project time zone. */\n  readonly timeZone?: string\n  /** Canonical BCP 47 language of the requester. Absent uses the project locale. */\n  readonly locale?: string\n}\n\n/** Immutable, serialisable child configuration captured before dispatch. */\nexport interface SubagentRunSpec {\n  readonly model: LanguageModelRef\n  readonly reasoning?: AgentReasoning\n  /** Focused task supplied by the parent Agent. */\n  readonly task: string\n  /** Project tools available when the child was admitted. Runtime tools are injected separately. */\n  readonly toolNames: readonly string[]\n  readonly maxSteps: number\n}\n\n/** Durable child output returned to its parent by `wait_agent`. */\nexport interface SubagentRunResult {\n  readonly text?: string\n  readonly files?: readonly FileRef[]\n}\n\nexport interface SubagentRunRecord extends AgentRunRecordBase {\n  readonly kind: \"subagent\"\n  readonly parentRunId: string\n  /** Stable parent-selected key that makes repeated tool execution idempotent. */\n  readonly spawnKey: string\n  readonly spec: SubagentRunSpec\n  readonly result?: SubagentRunResult\n}\n\nexport type AgentRunRecord = ConversationAgentRunRecord | SubagentRunRecord\n\nexport interface CreateAgentRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly executionId: string\n  readonly threadId: string\n  readonly triggerMessageId: string\n  readonly spec: ConversationAgentRunSpec\n  readonly createdAt?: Date\n}\n\nexport interface CreateSubagentRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly executionId: string\n  readonly parentRunId: string\n  /** Current parent delivery token. New children are admitted only while that delivery owns it. */\n  readonly parentExecutionToken: string\n  readonly spawnKey: string\n  readonly spec: SubagentRunSpec\n  /** Internal safety bound enforced atomically across worker processes. */\n  readonly maxActiveChildren: number\n  readonly createdAt?: Date\n}\n\nexport interface StartAgentRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly modelId?: string\n  readonly execution: AgentRunExecution\n  readonly startedAt?: Date\n}\n\nexport interface FinishQueuedAgentRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly status: \"failed\" | \"cancelled\"\n  readonly error?: SixbFailure<AgentRunFailureCode>\n  readonly completedAt?: Date\n}\n\nexport interface ReclaimAgentRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly execution: AgentRunExecution\n}\n\nexport interface ConfirmAgentRunExecutionOwnershipInput {\n  readonly id: string\n  readonly projectId: string\n  readonly executionToken: string\n  /** Exact expiration returned by the queue claim or its latest successful renewal. */\n  readonly queueLeaseExpiresAt: Date\n}\n\nexport type FinishAgentRunInput =\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly executionToken: string\n      readonly status: \"succeeded\"\n      readonly modelId?: string\n      readonly finishReason?: AgentRunFinishReason\n      readonly diagnostics?: readonly AgentRunDiagnostic[]\n      readonly result?: SubagentRunResult\n      readonly completedAt?: Date\n    }\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly executionToken: string\n      readonly status: \"failed\" | \"cancelled\"\n      readonly modelId?: string\n      readonly finishReason?: AgentRunFinishReason\n      readonly diagnostics?: readonly AgentRunDiagnostic[]\n      readonly error?: SixbFailure<AgentRunFailureCode>\n      readonly completedAt?: Date\n    }\n\nexport interface ListAgentRunsInput {\n  readonly projectId: string\n  readonly kinds?: readonly AgentRunKind[]\n  readonly threadId?: string\n  readonly parentRunId?: string\n  readonly statuses?: readonly AgentRunStatus[]\n  /** Effective start time; runs that never started use `createdAt`. */\n  readonly startedAfter?: Date\n  /** Effective start time; runs that never started use `createdAt`. */\n  readonly startedBefore?: Date\n  readonly limit?: number\n  readonly offset?: number\n  readonly order?: \"asc\" | \"desc\"\n}\n\nexport interface ListAgentRunsResult {\n  readonly runs: readonly AgentRunRecord[]\n  readonly hasMore: boolean\n  readonly total: number\n}\n\n// ── agent_messages — one message (assistant messages inserted only once finalized) ─────────────\n\nexport type { AgentMessageRole }\n\nexport interface AgentMessageRecord {\n  readonly id: string\n  readonly projectId: string\n  readonly threadId: string\n  /** The run that produced this message; `null` for user-authored messages. */\n  readonly runId: string | null\n  readonly role: AgentMessageRole\n  /** Principal that authored this persisted message: caller for user messages, agent identity later for assistant messages. */\n  readonly authorPrincipal?: Principal\n  /** Monotonic per thread, assigned by the store. */\n  readonly seq: number\n  /** Structured message content — text / reasoning / step boundaries / tool calls. */\n  readonly parts: readonly AgentMessagePart[]\n  /** Message-level metadata (mirrors `UIMessage.metadata`). */\n  readonly metadata?: JsonValue\n  /** Versions the `parts` shape so it can be migrated; stamped from `AGENT_MESSAGE_CONTENT_VERSION`. */\n  readonly contentVersion: number\n  readonly createdAt: Date\n  readonly completedAt?: Date\n}\n\n/** Append a message: a {@link AgentMessage} (role + parts + metadata) plus its storage identity. */\nexport interface AppendAgentMessageInput extends AgentMessage {\n  readonly id: string\n  readonly projectId: string\n  readonly threadId: string\n  readonly runId: string | null\n  readonly authorPrincipal?: Principal\n  readonly createdAt?: Date\n  readonly completedAt?: Date\n}\n\nexport interface DeleteAgentMessagesByRunInput {\n  readonly projectId: string\n  readonly threadId: string\n  readonly runId: string\n}\n\nexport interface ListAgentMessagesInput {\n  readonly projectId: string\n  readonly threadId: string\n  /** Return only messages whose per-thread sequence is greater than this retained boundary. */\n  readonly afterSeq?: number\n  readonly roles?: readonly AgentMessageRole[]\n  readonly limit?: number\n  readonly offset?: number\n  readonly order?: \"asc\" | \"desc\"\n}\n\nexport interface ListAgentMessagesResult {\n  readonly messages: readonly AgentMessageRecord[]\n  readonly hasMore: boolean\n  readonly total: number\n}\n\n// ── agent_context_checkpoints — append-only model-context boundaries ──────────────────────────\n\nexport type AgentContextCheckpointReason = \"threshold\" | \"overflow\"\n\n/**\n * A durable summary boundary used only when projecting a thread into model context.\n *\n * Checkpoints never replace or mutate transcript messages. Normal thread reads remain authoritative\n * and complete; the worker reads the latest checkpoint and only the retained message tail.\n */\nexport interface AgentContextCheckpointRecord {\n  readonly id: string\n  readonly projectId: string\n  readonly threadId: string\n  readonly createdByRunId: string\n  readonly previousCheckpointId?: string\n  readonly reason: AgentContextCheckpointReason\n  readonly summary: string\n  readonly summaryFormatVersion: 1\n  readonly summarizedThroughSeq: number\n  readonly observedHeadSeq: number\n  readonly estimatedInputTokensBefore: number\n  readonly estimatedInputTokensAfter: number\n  readonly summaryModelId: string\n  readonly createdAt: Date\n}\n\nexport interface CreateAgentContextCheckpointInput {\n  readonly id: string\n  readonly projectId: string\n  readonly threadId: string\n  readonly createdByRunId: string\n  /** Compare-and-swap anchor. `null` means the thread must not have a prior checkpoint. */\n  readonly expectedPreviousCheckpointId: string | null\n  /** Compare-and-swap anchor for the complete transcript observed by the summarizer. */\n  readonly expectedHeadSeq: number\n  /** Current delivery token for `createdByRunId`; stale redeliveries must not write. */\n  readonly executionToken: string\n  readonly reason: AgentContextCheckpointReason\n  readonly summary: string\n  readonly summaryFormatVersion: 1\n  readonly summarizedThroughSeq: number\n  readonly observedHeadSeq: number\n  readonly estimatedInputTokensBefore: number\n  readonly estimatedInputTokensAfter: number\n  readonly summaryModelId: string\n  readonly createdAt?: Date\n}\n\n// ── Store ───────────────────────────────────────────────────────────────────────────────────────\n\nexport interface AgentThreadStore {\n  /** Atomic run-fenced transition, or explicit idle-thread recreation. */\n  transitionSandbox(input: TransitionAgentThreadSandboxInput): Promise<AgentThreadSandboxState>\n  create(input: CreateAgentThreadInput): Promise<AgentThreadRecord>\n  getById(params: { projectId: string; id: string }): Promise<AgentThreadRecord | null>\n  list(input: ListAgentThreadsInput): Promise<ListAgentThreadsResult>\n}\n\nexport interface AgentRunStore {\n  /** Persist a queued run and atomically claim the thread's single-flight slot. */\n  create(input: CreateAgentRunInput): Promise<ConversationAgentRunRecord>\n  /** Persist or replay one idempotent child run while atomically enforcing parent fan-out. */\n  createSubagent(input: CreateSubagentRunInput): Promise<SubagentRunRecord>\n  /** Transition a queued run to running and install the first delivery's execution token. */\n  start(input: StartAgentRunInput): Promise<AgentRunRecord>\n  /** Finish a queued run before execution and release the thread's single-flight slot. */\n  finishQueued(input: FinishQueuedAgentRunInput): Promise<AgentRunRecord>\n  /** Rotate the execution token for a redelivered running job (`attempt++`). */\n  reclaim(input: ReclaimAgentRunInput): Promise<AgentRunRecord>\n  /**\n   * Project the queue's latest confirmed ownership expiration onto the current execution.\n   * Implementations must fence by token and must never move the expiration backwards.\n   */\n  confirmExecutionOwnership(input: ConfirmAgentRunExecutionOwnershipInput): Promise<AgentRunRecord>\n  /** Finalize a run and release the thread's `activeRunId`. */\n  finish(input: FinishAgentRunInput): Promise<AgentRunRecord>\n  getById(params: { projectId: string; id: string }): Promise<AgentRunRecord | null>\n  getByIds(params: {\n    projectId: string\n    ids: readonly string[]\n  }): Promise<readonly AgentRunRecord[]>\n  list(input: ListAgentRunsInput): Promise<ListAgentRunsResult>\n}\n\nexport interface AgentMessageStore {\n  /** Insert a message (its `parts` are the canonical content) and bump thread stats. */\n  append(input: AppendAgentMessageInput): Promise<AgentMessageRecord>\n  /** Delete every message produced by one run and repair the thread's message stats. */\n  deleteByRunId(input: DeleteAgentMessagesByRunInput): Promise<number>\n  getById(params: { projectId: string; id: string }): Promise<AgentMessageRecord | null>\n  list(input: ListAgentMessagesInput): Promise<ListAgentMessagesResult>\n}\n\nexport interface AgentContextCheckpointStore {\n  /**\n   * Append one checkpoint after atomically validating run ownership and both transcript anchors.\n   * Repeating the same payload for the same creating run is idempotent.\n   */\n  create(input: CreateAgentContextCheckpointInput): Promise<AgentContextCheckpointRecord>\n  /** Return checkpoints created by the requested runs, in first-occurrence input order. */\n  getByRunIds(input: {\n    readonly projectId: string\n    readonly runIds: readonly string[]\n  }): Promise<readonly AgentContextCheckpointRecord[]>\n  getLatest(input: {\n    readonly projectId: string\n    readonly threadId: string\n  }): Promise<AgentContextCheckpointRecord | null>\n}\n\nexport interface AgentStorage {\n  readonly threads: AgentThreadStore\n  readonly runs: AgentRunStore\n  readonly messages: AgentMessageStore\n  readonly checkpoints: AgentContextCheckpointStore\n}\n"
+    "import type { AgentMessage, AgentMessagePart, AgentMessageRole } from \"../../agents/message\"\nimport type { AgentReasoning } from \"../../agents/types\"\nimport type { Principal } from \"../../auth\"\nimport type { FileRef } from \"../../blob-storage\"\nimport type { SixbErrorCode, SixbFailure } from \"../../errors/types\"\nimport type { JsonValue } from \"../../json\"\nimport type { LanguageModelRef } from \"../../models\"\n\n// ── agent_threads — one conversation with an agent ──────────────────────────────────────────────\n\nexport type AgentThreadStatus = \"active\" | \"archived\"\n\n/** Immutable, non-secret application input. Never store resolved env or credentials here. */\nexport type AgentThreadSandboxParams = Readonly<Record<string, JsonValue>>\n\n/** Worker-owned state, independent from the immutable application binding. */\nexport interface AgentThreadSandboxState {\n  /** Exact name passed to the provider. Replacements always receive a fresh name. */\n  readonly name: string\n  readonly status: \"new\" | \"busy\" | \"ready\" | \"blocked\" | \"unavailable\"\n  readonly sourceFingerprint?: string\n  readonly initialized: boolean\n  /** Durable context boundary: local files from before this reset are no longer available. */\n  readonly resetAt?: string\n  /** Never expires automatically: a delayed provider operation must not reach a successor. */\n  readonly owner?: { readonly runId: string; readonly executionToken: string }\n}\n\nexport type TransitionAgentThreadSandboxInput = {\n  readonly projectId: string\n  readonly id: string\n} & (\n  | {\n      readonly action: \"acquire\"\n      readonly runId: string\n      readonly executionToken: string\n      readonly name: string\n      readonly sourceFingerprint: string\n    }\n  | {\n      readonly action: \"replace\"\n      readonly runId: string\n      readonly executionToken: string\n      readonly name: string\n      readonly nextName: string\n    }\n  | {\n      readonly action: \"settle\"\n      readonly runId: string\n      readonly executionToken: string\n      readonly name: string\n      readonly status: \"ready\" | \"blocked\" | \"unavailable\"\n      readonly initialized: boolean\n    }\n  | {\n      readonly action: \"recreate\"\n      readonly expectedSandboxName: string\n      readonly name: string\n    }\n)\n\nexport interface AgentThreadRecord {\n  readonly id: string\n  readonly projectId: string\n  /** Who owns/opened the thread. Reuses the canonical auth principal (gains `agent` later for free). */\n  readonly ownerPrincipal: Principal\n  readonly title?: string\n  readonly sandboxParams?: AgentThreadSandboxParams\n  readonly sandboxState?: AgentThreadSandboxState\n  readonly status: AgentThreadStatus\n  /** Single-flight anchor: the id of the one run currently allowed to write, or `null` when idle. */\n  readonly activeRunId: string | null\n  readonly lastMessageAt?: Date\n  readonly messageCount: number\n  readonly createdAt: Date\n  readonly updatedAt: Date\n}\n\nexport interface CreateAgentThreadInput {\n  readonly id: string\n  readonly projectId: string\n  readonly ownerPrincipal: Principal\n  readonly title?: string\n  readonly sandboxParams?: AgentThreadSandboxParams\n  readonly status?: AgentThreadStatus\n  readonly createdAt?: Date\n  readonly updatedAt?: Date\n}\n\nexport interface ListAgentThreadsInput {\n  readonly projectId: string\n  readonly statuses?: readonly AgentThreadStatus[]\n  readonly ownerPrincipal?: Principal\n  readonly limit?: number\n  readonly offset?: number\n  readonly order?: \"asc\" | \"desc\"\n}\n\nexport interface ListAgentThreadsResult {\n  readonly threads: readonly AgentThreadRecord[]\n  readonly hasMore: boolean\n  readonly total: number\n}\n\n// ── agent_runs — one loop execution (the worker job; attribution + fencing) ───────────────────\n\n/** Lifecycle shared by every durable agent execution, conversational or workflow-owned. */\nexport type AgentExecutionStatus = \"queued\" | \"running\" | \"succeeded\" | \"failed\" | \"cancelled\"\n\nexport type AgentRunStatus = AgentExecutionStatus\nexport type AgentRunKind = \"conversation\" | \"subagent\"\n\n/** Error codes an agent execution can persist and expose through its public contract. */\nexport const AGENT_RUN_FAILURE_CODES = [\n  \"internal.unexpected\",\n  \"runtime.cancelled\",\n  \"agent.execution_failed\",\n  \"ai.usage_limit_exceeded\",\n  \"ai.usage_limit_unavailable\",\n] as const satisfies readonly [SixbErrorCode, ...SixbErrorCode[]]\n\nexport type AgentRunFailureCode = (typeof AGENT_RUN_FAILURE_CODES)[number]\n\n/**\n * Why a run ended — Sixb's provider-independent vocabulary. It includes model-loop reasons plus\n * platform-level endings such as `timeout`, or `interrupted` for a turn whose worker died before\n * finishing it, so reads remain typed and exhaustive. `other` and `unknown` preserve terminal state\n * when a provider adds a new reason.\n */\nexport const AGENT_RUN_FINISH_REASONS = [\n  \"stop\",\n  \"length\",\n  \"content-filter\",\n  \"tool-calls\",\n  \"timeout\",\n  \"interrupted\",\n  \"error\",\n  \"other\",\n  \"unknown\",\n] as const\n\nexport type AgentRunFinishReason = (typeof AGENT_RUN_FINISH_REASONS)[number]\n\n/**\n * Coerce an external finish-reason string — a DB column or an SDK value — to {@link\n * AgentRunFinishReason}. An unrecognised value becomes `\"unknown\"` rather than being dropped.\n */\nexport function coerceAgentRunFinishReason(\n  value: string | null | undefined\n): AgentRunFinishReason | undefined {\n  if (value === null || value === undefined) {\n    return undefined\n  }\n  return (AGENT_RUN_FINISH_REASONS as readonly string[]).includes(value)\n    ? (value as AgentRunFinishReason)\n    : \"unknown\"\n}\n\n/** Stable, user-facing diagnostics emitted by the platform while executing a run. */\nexport const AGENT_RUN_DIAGNOSTIC_CODES = [\n  \"output_file_limit_exceeded\",\n  \"output_file_too_large\",\n  \"output_budget_exhausted\",\n  \"output_collection_failed\",\n  \"output_file_changed\",\n  \"output_storage_failed\",\n  \"step_limit_reached\",\n] as const\n\n/**\n * Closed on purpose, and the wire is closed with it.\n *\n * Sixb writes these codes and the generated client is what reads them, so an open union would only\n * be honest if the HTTP schema were open too — and that costs the OpenAPI enum, the client's\n * autocompletion, and the app's exhaustive `switch`. Sixb owns both ends, so a new code is a minor\n * version bump: cheap here, and a broken `switch` is better than a 500 from `z.enum`.\n */\nexport type AgentRunDiagnosticCode = (typeof AGENT_RUN_DIAGNOSTIC_CODES)[number]\nexport type AgentRunDiagnosticSeverity = \"warning\" | \"error\"\n\nexport interface AgentRunDiagnostic {\n  readonly code: AgentRunDiagnosticCode\n  readonly severity: AgentRunDiagnosticSeverity\n  /** `output` for published files, `run` for the turn as a whole. */\n  readonly scope: \"output\" | \"run\"\n  /** Relative path inside the run's published output directory, when one file is involved. */\n  readonly path?: string\n  /** Sanitized, stable copy suitable for display to an end user. */\n  readonly message: string\n}\n\n/**\n * Authorization state for the current queue delivery.\n *\n * `queueLeaseExpiresAt` is a persisted projection of `ClaimedQueueJob.leaseExpiresAt`, not an\n * independently managed run lease. It may only be extended from a successful queue lease renewal.\n */\nexport interface AgentRunExecution {\n  readonly token: string\n  readonly queueLeaseExpiresAt: Date\n}\n\ninterface AgentRunRecordBase {\n  readonly id: string\n  readonly projectId: string\n  readonly executionId: string\n  readonly status: AgentRunStatus\n  readonly modelId?: string\n  /** Why the run ended (our own SDK-independent enum). */\n  readonly finishReason?: AgentRunFinishReason\n  /** Platform diagnostics are transcript annotations, never agent-authored message content. */\n  readonly diagnostics?: readonly AgentRunDiagnostic[]\n  /** Portable failure snapshot when the run did not succeed. */\n  readonly error?: SixbFailure<AgentRunFailureCode>\n  /** Execution attempts: `0` while queued, `1` on first start, incremented on redelivery. */\n  readonly attempt: number\n  readonly execution?: AgentRunExecution\n  readonly createdAt: Date\n  readonly startedAt?: Date\n  readonly completedAt?: Date\n}\n\nexport interface ConversationAgentRunRecord extends AgentRunRecordBase {\n  readonly kind: \"conversation\"\n  readonly threadId: string\n  readonly triggerMessageId: string\n  /** Immutable model selection captured at admission. Absent only on runs predating this field. */\n  readonly spec?: ConversationAgentRunSpec\n}\n\n/** Immutable, serialisable model selection and requester settings for one conversational turn. */\nexport interface ConversationAgentRunSpec {\n  readonly model: LanguageModelRef\n  readonly reasoning?: AgentReasoning\n  /** Canonical IANA time zone of the requester. Absent uses the project time zone. */\n  readonly timeZone?: string\n  /** Canonical BCP 47 language of the requester. Absent uses the project locale. */\n  readonly locale?: string\n}\n\n/** Immutable, serialisable child configuration captured before dispatch. */\nexport interface SubagentRunSpec {\n  readonly model: LanguageModelRef\n  readonly reasoning?: AgentReasoning\n  /** Focused task supplied by the parent Agent. */\n  readonly task: string\n  /** Project tools available when the child was admitted. Runtime tools are injected separately. */\n  readonly toolNames: readonly string[]\n  readonly maxSteps: number\n}\n\n/** Durable child output returned to its parent by `wait_agent`. */\nexport interface SubagentRunResult {\n  readonly text?: string\n  readonly files?: readonly FileRef[]\n}\n\nexport interface SubagentRunRecord extends AgentRunRecordBase {\n  readonly kind: \"subagent\"\n  readonly parentRunId: string\n  /** Stable parent-selected key that makes repeated tool execution idempotent. */\n  readonly spawnKey: string\n  readonly spec: SubagentRunSpec\n  readonly result?: SubagentRunResult\n}\n\nexport type AgentRunRecord = ConversationAgentRunRecord | SubagentRunRecord\n\nexport interface CreateAgentRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly executionId: string\n  readonly threadId: string\n  readonly triggerMessageId: string\n  readonly spec: ConversationAgentRunSpec\n  readonly createdAt?: Date\n}\n\nexport interface CreateSubagentRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly executionId: string\n  readonly parentRunId: string\n  /** Current parent delivery token. New children are admitted only while that delivery owns it. */\n  readonly parentExecutionToken: string\n  readonly spawnKey: string\n  readonly spec: SubagentRunSpec\n  /** Internal safety bound enforced atomically across worker processes. */\n  readonly maxActiveChildren: number\n  readonly createdAt?: Date\n}\n\nexport interface StartAgentRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly modelId?: string\n  readonly execution: AgentRunExecution\n  readonly startedAt?: Date\n}\n\nexport interface FinishQueuedAgentRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly status: \"failed\" | \"cancelled\"\n  readonly error?: SixbFailure<AgentRunFailureCode>\n  readonly completedAt?: Date\n}\n\nexport interface ReclaimAgentRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly execution: AgentRunExecution\n}\n\nexport interface ConfirmAgentRunExecutionOwnershipInput {\n  readonly id: string\n  readonly projectId: string\n  readonly executionToken: string\n  /** Exact expiration returned by the queue claim or its latest successful renewal. */\n  readonly queueLeaseExpiresAt: Date\n}\n\nexport type FinishAgentRunInput =\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly executionToken: string\n      readonly status: \"succeeded\"\n      readonly modelId?: string\n      readonly finishReason?: AgentRunFinishReason\n      readonly diagnostics?: readonly AgentRunDiagnostic[]\n      readonly result?: SubagentRunResult\n      readonly completedAt?: Date\n    }\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly executionToken: string\n      readonly status: \"failed\" | \"cancelled\"\n      readonly modelId?: string\n      readonly finishReason?: AgentRunFinishReason\n      readonly diagnostics?: readonly AgentRunDiagnostic[]\n      readonly error?: SixbFailure<AgentRunFailureCode>\n      readonly completedAt?: Date\n    }\n\nexport interface ListAgentRunsInput {\n  readonly projectId: string\n  readonly kinds?: readonly AgentRunKind[]\n  readonly threadId?: string\n  readonly parentRunId?: string\n  readonly statuses?: readonly AgentRunStatus[]\n  /** Effective start time; runs that never started use `createdAt`. */\n  readonly startedAfter?: Date\n  /** Effective start time; runs that never started use `createdAt`. */\n  readonly startedBefore?: Date\n  readonly limit?: number\n  readonly offset?: number\n  readonly order?: \"asc\" | \"desc\"\n}\n\nexport interface ListAgentRunsResult {\n  readonly runs: readonly AgentRunRecord[]\n  readonly hasMore: boolean\n  readonly total: number\n}\n\n// ── agent_messages — one message (assistant messages inserted only once finalized) ─────────────\n\nexport type { AgentMessageRole }\n\nexport interface AgentMessageRecord {\n  readonly id: string\n  readonly projectId: string\n  readonly threadId: string\n  /** The run that produced this message; `null` for user-authored messages. */\n  readonly runId: string | null\n  readonly role: AgentMessageRole\n  /** Principal that authored this persisted message: caller for user messages, agent identity later for assistant messages. */\n  readonly authorPrincipal?: Principal\n  /** Monotonic per thread, assigned by the store. */\n  readonly seq: number\n  /** Structured message content — text / reasoning / step boundaries / tool calls. */\n  readonly parts: readonly AgentMessagePart[]\n  /** Message-level metadata (mirrors `UIMessage.metadata`). */\n  readonly metadata?: JsonValue\n  /** Versions the `parts` shape so it can be migrated; stamped from `AGENT_MESSAGE_CONTENT_VERSION`. */\n  readonly contentVersion: number\n  readonly createdAt: Date\n  readonly completedAt?: Date\n}\n\n/** Append a message: a {@link AgentMessage} (role + parts + metadata) plus its storage identity. */\nexport interface AppendAgentMessageInput extends AgentMessage {\n  readonly id: string\n  readonly projectId: string\n  readonly threadId: string\n  readonly runId: string | null\n  readonly authorPrincipal?: Principal\n  readonly createdAt?: Date\n  readonly completedAt?: Date\n}\n\nexport interface DeleteAgentMessagesByRunInput {\n  readonly projectId: string\n  readonly threadId: string\n  readonly runId: string\n}\n\nexport interface ListAgentMessagesInput {\n  readonly projectId: string\n  readonly threadId: string\n  /** Return only messages whose per-thread sequence is greater than this retained boundary. */\n  readonly afterSeq?: number\n  readonly roles?: readonly AgentMessageRole[]\n  readonly limit?: number\n  readonly offset?: number\n  readonly order?: \"asc\" | \"desc\"\n}\n\nexport interface ListAgentMessagesResult {\n  readonly messages: readonly AgentMessageRecord[]\n  readonly hasMore: boolean\n  readonly total: number\n}\n\n// ── agent_context_checkpoints — append-only model-context boundaries ──────────────────────────\n\nexport type AgentContextCheckpointReason = \"threshold\" | \"overflow\"\n\n/**\n * A durable summary boundary used only when projecting a thread into model context.\n *\n * Checkpoints never replace or mutate transcript messages. Normal thread reads remain authoritative\n * and complete; the worker reads the latest checkpoint and only the retained message tail.\n */\nexport interface AgentContextCheckpointRecord {\n  readonly id: string\n  readonly projectId: string\n  readonly threadId: string\n  readonly createdByRunId: string\n  readonly previousCheckpointId?: string\n  readonly reason: AgentContextCheckpointReason\n  readonly summary: string\n  readonly summaryFormatVersion: 1\n  readonly summarizedThroughSeq: number\n  readonly observedHeadSeq: number\n  readonly estimatedInputTokensBefore: number\n  readonly estimatedInputTokensAfter: number\n  readonly summaryModelId: string\n  readonly createdAt: Date\n}\n\nexport interface CreateAgentContextCheckpointInput {\n  readonly id: string\n  readonly projectId: string\n  readonly threadId: string\n  readonly createdByRunId: string\n  /** Compare-and-swap anchor. `null` means the thread must not have a prior checkpoint. */\n  readonly expectedPreviousCheckpointId: string | null\n  /** Compare-and-swap anchor for the complete transcript observed by the summarizer. */\n  readonly expectedHeadSeq: number\n  /** Current delivery token for `createdByRunId`; stale redeliveries must not write. */\n  readonly executionToken: string\n  readonly reason: AgentContextCheckpointReason\n  readonly summary: string\n  readonly summaryFormatVersion: 1\n  readonly summarizedThroughSeq: number\n  readonly observedHeadSeq: number\n  readonly estimatedInputTokensBefore: number\n  readonly estimatedInputTokensAfter: number\n  readonly summaryModelId: string\n  readonly createdAt?: Date\n}\n\n// ── Store ───────────────────────────────────────────────────────────────────────────────────────\n\nexport interface AgentThreadStore {\n  /** Atomic run-fenced transition, or explicit idle-thread recreation. */\n  transitionSandbox(input: TransitionAgentThreadSandboxInput): Promise<AgentThreadSandboxState>\n  create(input: CreateAgentThreadInput): Promise<AgentThreadRecord>\n  getById(params: { projectId: string; id: string }): Promise<AgentThreadRecord | null>\n  list(input: ListAgentThreadsInput): Promise<ListAgentThreadsResult>\n}\n\nexport interface AgentRunStore {\n  /** Persist a queued run and atomically claim the thread's single-flight slot. */\n  create(input: CreateAgentRunInput): Promise<ConversationAgentRunRecord>\n  /** Persist or replay one idempotent child run while atomically enforcing parent fan-out. */\n  createSubagent(input: CreateSubagentRunInput): Promise<SubagentRunRecord>\n  /** Transition a queued run to running and install the first delivery's execution token. */\n  start(input: StartAgentRunInput): Promise<AgentRunRecord>\n  /** Finish a queued run before execution and release the thread's single-flight slot. */\n  finishQueued(input: FinishQueuedAgentRunInput): Promise<AgentRunRecord>\n  /** Rotate the execution token for a redelivered running job (`attempt++`). */\n  reclaim(input: ReclaimAgentRunInput): Promise<AgentRunRecord>\n  /**\n   * Project the queue's latest confirmed ownership expiration onto the current execution.\n   * Implementations must fence by token and must never move the expiration backwards.\n   */\n  confirmExecutionOwnership(input: ConfirmAgentRunExecutionOwnershipInput): Promise<AgentRunRecord>\n  /** Finalize a run and release the thread's `activeRunId`. */\n  finish(input: FinishAgentRunInput): Promise<AgentRunRecord>\n  getById(params: { projectId: string; id: string }): Promise<AgentRunRecord | null>\n  getByIds(params: {\n    projectId: string\n    ids: readonly string[]\n  }): Promise<readonly AgentRunRecord[]>\n  list(input: ListAgentRunsInput): Promise<ListAgentRunsResult>\n}\n\nexport interface AgentMessageStore {\n  /** Insert a message (its `parts` are the canonical content) and bump thread stats. */\n  append(input: AppendAgentMessageInput): Promise<AgentMessageRecord>\n  /** Delete every message produced by one run and repair the thread's message stats. */\n  deleteByRunId(input: DeleteAgentMessagesByRunInput): Promise<number>\n  getById(params: { projectId: string; id: string }): Promise<AgentMessageRecord | null>\n  list(input: ListAgentMessagesInput): Promise<ListAgentMessagesResult>\n}\n\nexport interface AgentContextCheckpointStore {\n  /**\n   * Append one checkpoint after atomically validating run ownership and both transcript anchors.\n   * Repeating the same payload for the same creating run is idempotent.\n   */\n  create(input: CreateAgentContextCheckpointInput): Promise<AgentContextCheckpointRecord>\n  /** Return checkpoints created by the requested runs, in first-occurrence input order. */\n  getByRunIds(input: {\n    readonly projectId: string\n    readonly runIds: readonly string[]\n  }): Promise<readonly AgentContextCheckpointRecord[]>\n  getLatest(input: {\n    readonly projectId: string\n    readonly threadId: string\n  }): Promise<AgentContextCheckpointRecord | null>\n}\n\nexport interface AgentStorage {\n  readonly threads: AgentThreadStore\n  readonly runs: AgentRunStore\n  readonly messages: AgentMessageStore\n  readonly checkpoints: AgentContextCheckpointStore\n}\n"
   ],
   "mappings": ";;AAiHO,IAAM,2BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAUO,IAAM,4BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAQO,SAAS,2BAA0B,CACxC,OACkC;AAAA,EAClC,IAAI,UAAU,QAAQ,UAAU,WAAW;AAAA,IACzC;AAAA,EACF;AAAA,EACA,OAAQ,0BAA+C,SAAS,KAAK,IAChE,QACD;AAAA;AAIC,IAAM,8BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
   "debugId": "DD020A3A47567D1D64756E2164756E21",

package/dist/{chunk-85yvv5n0.js → chunk-k6q3n2sc.js}

@@ -9,10 +9,10 @@ import {
 } from "./chunk-8mx7qw3y.js";
 import {
   isActionDefinition2
-} from "./chunk-3gnrh4ve.js";
+} from "./chunk-vpq4shxz.js";
 import {
   isGroupDefinition
-} from "./chunk-xt1zt7gv.js";
+} from "./chunk-es1gxsbf.js";
 import {
   isModelReasoning2
 } from "./chunk-pqajwytd.js";
@@ -25,7 +25,7 @@ import {
   isStepDefinition2,
   isAgentStepDefinition2,
   isInterventionDefinition2
-} from "./chunk-ey3pyej1.js";
+} from "./chunk-6c6sn0bh.js";
 import {
   isAgentToolDefinition2
 } from "./chunk-tpn40322.js";