@sixb/core 0.1.20 → 0.1.21

package/dist/chunk-9gyp8hg1.js

@@ -1,363 +0,0 @@
-// @bun
-import {
-  assertValidSchema
-} from "./chunk-1k89ecfr.js";
-import {
-  normalizeParams,
-  coerceParamsToTyped
-} from "./chunk-c85m1hyj.js";
-import {
-  isPlainRecord
-} from "./chunk-wy0qdqfm.js";
-
-// src/sandboxes/errors.ts
-class SandboxError2 extends Error {
-  name = "SandboxError";
-}
-
-class SandboxStateUnavailableError2 extends SandboxError2 {
-  name = "SandboxStateUnavailableError";
-}
-
-class SandboxNotRunningError2 extends SandboxError2 {
-  name = "SandboxNotRunningError";
-}
-
-class SandboxTimeoutError2 extends SandboxError2 {
-  name = "SandboxTimeoutError";
-}
-
-class SandboxIsolationUnavailableError2 extends SandboxError2 {
-  name = "SandboxIsolationUnavailableError";
-}
-
-// src/sandboxes/configuration.ts
-function createSandboxDefinition(config, ontology) {
-  const raw = config;
-  if (!isPlainRecord(raw) || config.params !== undefined && !isPlainRecord(raw.params) || config.resolve !== undefined && typeof config.resolve !== "function") {
-    throw new SandboxError2("[Sixb] Sandbox configuration requires a params object and a callable resolver when provided.");
-  }
-  for (const key of Object.keys(config)) {
-    if (!["params", "resolve", "source", "setup", "env", "network", "auth"].includes(key)) {
-      throw new SandboxError2("[Sixb] Unknown sandbox configuration field.");
-    }
-  }
-  if (config.auth !== undefined && typeof config.auth?.authorize !== "function") {
-    throw new SandboxError2("[Sixb] sandboxes.auth requires an authorize function.");
-  }
-  if (config.params !== undefined && config.resolve === undefined) {
-    throw new SandboxError2("[Sixb] Sandbox params require a resolve function.");
-  }
-  if (config.resolve !== undefined && (config.source !== undefined || config.setup !== undefined)) {
-    throw new SandboxError2("[Sixb] Use either static source/setup or resolve, not both.");
-  }
-  const invalid = (path) => new SandboxError2(`[Sixb] ${path} must be a valid parameter declaration; use param(schema).`);
-  for (const [id, value] of Object.entries(config.params ?? {})) {
-    const path = `sandboxes.params.${id}`;
-    if (!id.trim() || !isPlainRecord(value))
-      throw invalid(path);
-    for (const key of Object.keys(value)) {
-      if (!["schema", "required", "nullable", "description", "semanticType"].includes(key)) {
-        throw invalid(path);
-      }
-    }
-    if (value.required !== undefined && typeof value.required !== "boolean" || value.nullable !== undefined && typeof value.nullable !== "boolean" || value.description !== undefined && typeof value.description !== "string" || value.semanticType !== undefined && typeof value.semanticType !== "string")
-      throw invalid(path);
-    const schema = value.schema;
-    if (isPlainRecord(schema) && schema.type === "objectRef") {
-      if (typeof schema.objectTypeId !== "string" || !ontology.getObjectTypesById().has(schema.objectTypeId)) {
-        throw invalid(path);
-      }
-    } else {
-      assertValidSchema(schema, `${path}.schema`, invalid);
-    }
-  }
-  const params = structuredClone(config.params ?? {});
-  const environment = captureEnvironment({
-    ...config.source === undefined ? {} : { source: config.source },
-    ...config.setup === undefined ? {} : { setup: config.setup },
-    ...config.env === undefined ? {} : { env: config.env },
-    ...config.network === undefined ? {} : { network: config.network }
-  });
-  const resolve = config.resolve;
-  const authorize = config.auth?.authorize.bind(config.auth);
-  deepFreeze(params);
-  return Object.freeze({
-    params,
-    ...authorize ? { auth: Object.freeze({ authorize }) } : {},
-    resolve: async ({ params: input, sixb }) => {
-      const binding = normalizeParams(ontology.getValueTypesById(), params, input, {
-        kind: "sandbox",
-        id: "sandboxes",
-        path: "sandbox"
-      });
-      const typed = coerceParamsToTyped(params, binding, ontology.getValueTypesById());
-      if (!resolve)
-        return structuredClone(environment);
-      const resolved = captureEnvironment(await resolve({ params: typed, sixb }));
-      return {
-        ...structuredClone(environment),
-        ...resolved,
-        env: { ...environment.env, ...resolved.env }
-      };
-    }
-  });
-}
-function captureEnvironment(value) {
-  if (!isPlainRecord(value) || Object.keys(value).some((key) => !["source", "setup", "env", "network"].includes(key))) {
-    return fail("environment");
-  }
-  if (value.source !== undefined)
-    validateSource(value.source);
-  if (value.setup !== undefined)
-    validateSetup(value.setup);
-  if (value.env !== undefined)
-    validateEnv(value.env);
-  if (value.network !== undefined)
-    validateNetwork(value.network);
-  return structuredClone(value);
-}
-function fail(field) {
-  throw new SandboxError2(`[Sixb] Invalid sandbox ${field}.`);
-}
-function validateSource(source) {
-  if (!isPlainRecord(source) || source.type !== "git" || typeof source.url !== "string" || Object.keys(source).some((key) => !["type", "url", "revision", "access"].includes(key))) {
-    fail("source");
-  }
-  const url = parseUrl(source.url, "source URL");
-  if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash) {
-    fail("source URL: expected credential-free HTTPS");
-  }
-  if (source.revision !== undefined && (typeof source.revision !== "string" || !source.revision.trim() || source.revision.startsWith("-") || /[\x00-\x1f]/.test(source.revision))) {
-    fail("source revision");
-  }
-  if (source.access !== undefined && source.access !== "read" && source.access !== "write") {
-    fail("source access");
-  }
-}
-function validateSetup(setup) {
-  if (!Array.isArray(setup) || setup.some((command) => typeof command !== "string" || !command.trim() || command.includes("\x00"))) {
-    fail("setup");
-  }
-}
-function validateEnv(env) {
-  if (!isPlainRecord(env) || Object.entries(env).some(([key, entry]) => !key || /[=\0]/.test(key) || typeof entry !== "string" || entry.includes("\x00"))) {
-    fail("env");
-  }
-}
-function validateNetwork(network) {
-  if (!isPlainRecord(network))
-    fail("network");
-  if (network.mode === "restricted") {
-    if (Object.keys(network).some((key) => key !== "mode" && key !== "allow") || !Array.isArray(network.allow)) {
-      fail("network");
-    }
-    for (const target of network.allow)
-      validateNetworkTarget(target);
-    return;
-  }
-  if (network.mode !== "none" && network.mode !== "all" || Object.keys(network).some((key) => key !== "mode")) {
-    fail("network");
-  }
-}
-function validateNetworkTarget(target) {
-  if (!isPlainRecord(target) || typeof target.name !== "string" || !target.name.trim() || typeof target.origin !== "string" || Object.keys(target).some((key) => key !== "name" && key !== "origin")) {
-    fail("network target");
-  }
-  const url = parseUrl(target.origin, "network origin");
-  if (!["http:", "https:"].includes(url.protocol) || url.origin !== target.origin) {
-    fail("network origin");
-  }
-}
-function parseUrl(value, field) {
-  try {
-    return new URL(value);
-  } catch {
-    return fail(field);
-  }
-}
-function deepFreeze(value, seen = new Set) {
-  if (seen.has(value))
-    return;
-  seen.add(value);
-  for (const child of Object.values(value)) {
-    if (child !== null && typeof child === "object")
-      deepFreeze(child, seen);
-  }
-  Object.freeze(value);
-}
-
-// src/sandboxes/config.ts
-function sandboxConfig2(options) {
-  if (options.auth !== undefined && typeof options.auth?.authorize !== "function") {
-    throw new SandboxError2("[Sixb] sandboxes.auth requires an authorize function.");
-  }
-  const authorize = options.auth?.authorize.bind(options.auth);
-  if (options.params !== undefined && options.resolve === undefined) {
-    throw new SandboxError2("[Sixb] Sandbox params require a resolve function.");
-  }
-  if (options.resolve !== undefined && typeof options.resolve !== "function") {
-    throw new SandboxError2("[Sixb] Sandbox resolve must be a function.");
-  }
-  if (options.resolve !== undefined && (options.source !== undefined || options.setup !== undefined)) {
-    throw new SandboxError2("[Sixb] Use either static source/setup or resolve, not both.");
-  }
-  const environment = captureEnvironment({
-    ...options.source === undefined ? {} : { source: options.source },
-    ...options.setup === undefined ? {} : { setup: options.setup },
-    ...options.env === undefined ? {} : { env: options.env },
-    ...options.network === undefined ? {} : { network: options.network }
-  });
-  return Object.freeze({
-    ...authorize ? { auth: Object.freeze({ authorize }) } : {},
-    ...environment,
-    ...options.params === undefined ? {} : { params: structuredClone(options.params) },
-    ...options.resolve === undefined ? {} : { resolve: options.resolve }
-  });
-}
-// src/sandboxes/environment.ts
-import { posix } from "path";
-function sandboxCreationEnvironment2(configuration, options) {
-  if (options.environment === undefined && configuration.resolve !== undefined) {
-    throw new SandboxError2("[Sixb] Dynamic sandbox configuration requires an execution-resolved environment.");
-  }
-  const environment = captureEnvironment(options.environment !== undefined ? options.environment : {
-    ...configuration.source === undefined ? {} : { source: configuration.source },
-    ...configuration.setup === undefined ? {} : { setup: configuration.setup }
-  });
-  if (environment.env !== undefined || environment.network !== undefined) {
-    throw new SandboxError2("[Sixb] Pass env and network as sandbox session options, not environment.");
-  }
-  if (environment.source) {
-    if ((configuration.auth !== undefined || environment.source.access === "write") && !options.requestCredentials?.length) {
-      throw new SandboxError2("[Sixb] Sandbox source authentication requires execution-prepared request credentials.");
-    }
-    const network = options.network ?? configuration.network ?? { mode: "none" };
-    const origin = new URL(environment.source.url).origin;
-    if (network.mode === "none" || network.mode === "restricted" && !network.allow.some((target) => target.origin === origin)) {
-      throw new SandboxError2("[Sixb] Sandbox network policy denies the source origin.");
-    }
-  }
-  options.signal?.throwIfAborted();
-  return environment;
-}
-function sandboxProjectDirectory2(session, hasSource) {
-  if (!hasSource)
-    return session;
-  const workingDirectory = posix.join(session.workingDirectory, "repository");
-  return {
-    id: session.id,
-    provider: session.provider,
-    get status() {
-      return session.status;
-    },
-    workingDirectory,
-    ...session.setRequestCredentials ? { setRequestCredentials: session.setRequestCredentials.bind(session) } : {},
-    runCommand: (command, args, options) => session.runCommand(command, args, { ...options, cwd: options?.cwd ?? workingDirectory }),
-    writeFiles: (files) => session.writeFiles(files.map((file) => ({
-      ...file,
-      path: posix.isAbsolute(file.path) ? file.path : posix.join(workingDirectory, file.path)
-    }))),
-    stop: () => session.stop(),
-    destroy: () => session.destroy()
-  };
-}
-async function initializeSandboxEnvironment2(session, environment, signal) {
-  environment = captureEnvironment(environment);
-  const run = async (sandbox, command, args) => {
-    signal?.throwIfAborted();
-    const result = await sandbox.runCommand(command, args, { timeout: 120000, signal });
-    if (result.exitCode !== 0 || result.timedOut) {
-      throw new SandboxError2("[Sixb] Sandbox environment initialization failed.");
-    }
-  };
-  signal?.throwIfAborted();
-  const sandbox = sandboxProjectDirectory2(session, environment.source !== undefined);
-  if (environment.source) {
-    await run(session, "git", ["clone", "--", environment.source.url, "repository"]);
-    if (environment.source.revision) {
-      await run(sandbox, "git", ["checkout", environment.source.revision, "--"]);
-    }
-  }
-  for (const command of environment.setup ?? [])
-    await run(sandbox, "bash", ["-lc", command]);
-  return sandbox;
-}
-// src/sandboxes/exec.ts
-var DEFAULT_KILL_EXIT_CODE = 137;
-async function exec2(options) {
-  const start = Date.now();
-  const [head, ...rest] = options.argv;
-  if (!head) {
-    return {
-      exitCode: 1,
-      stdout: "",
-      stderr: "[Sandbox] empty argv",
-      durationMs: 0
-    };
-  }
-  let proc;
-  try {
-    proc = Bun.spawn([head, ...rest], {
-      cwd: options.cwd,
-      env: options.env,
-      stdin: "ignore",
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-  } catch (error) {
-    return {
-      exitCode: 127,
-      stdout: "",
-      stderr: error instanceof Error ? error.message : String(error),
-      durationMs: Date.now() - start
-    };
-  }
-  let timedOut = false;
-  let killed = false;
-  const timer = options.timeoutMs !== undefined && options.timeoutMs > 0 ? setTimeout(() => {
-    timedOut = true;
-    killed = true;
-    proc.kill("SIGKILL");
-  }, options.timeoutMs) : undefined;
-  const onAbort = () => {
-    if (!killed) {
-      killed = true;
-      proc.kill("SIGKILL");
-    }
-  };
-  options.signal?.addEventListener("abort", onAbort);
-  if (options.signal?.aborted) {
-    onAbort();
-  }
-  let stdout = "";
-  let stderr = "";
-  let exitCode = 0;
-  try {
-    const [stdoutText, stderrText, code] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-      proc.exited
-    ]);
-    stdout = stdoutText;
-    stderr = stderrText;
-    exitCode = typeof code === "number" ? code : DEFAULT_KILL_EXIT_CODE;
-  } finally {
-    if (timer !== undefined)
-      clearTimeout(timer);
-    options.signal?.removeEventListener("abort", onAbort);
-  }
-  if (killed && exitCode === 0) {
-    exitCode = DEFAULT_KILL_EXIT_CODE;
-  }
-  return {
-    exitCode,
-    stdout,
-    stderr,
-    durationMs: Date.now() - start,
-    ...timedOut ? { timedOut: true } : {}
-  };
-}
-export { SandboxError2, SandboxStateUnavailableError2, SandboxNotRunningError2, SandboxTimeoutError2, SandboxIsolationUnavailableError2, createSandboxDefinition, sandboxConfig2, sandboxCreationEnvironment2, sandboxProjectDirectory2, initializeSandboxEnvironment2, exec2 };
-
-//# debugId=C3376C4D866A438264756E2164756E21

package/dist/chunk-9gyp8hg1.js.map

@@ -1,14 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/sandboxes/errors.ts", "../src/sandboxes/configuration.ts", "../src/sandboxes/config.ts", "../src/sandboxes/environment.ts", "../src/sandboxes/exec.ts"],
-  "sourcesContent": [
-    "/**\n * Errors thrown by sandbox providers. Hosts can catch SandboxError at the\n * audit boundary while still distinguishing recoverable provider states.\n */\nexport class SandboxError extends Error {\n  readonly name: string = \"SandboxError\"\n}\n\n/** Confirmed missing/expired state. Never use for transport, authorization or session setup errors. */\nexport class SandboxStateUnavailableError extends SandboxError {\n  override readonly name = \"SandboxStateUnavailableError\"\n}\n\n/** runCommand / stop / destroy called after the sandbox is stopped or destroyed. */\nexport class SandboxNotRunningError extends SandboxError {\n  override readonly name = \"SandboxNotRunningError\"\n}\n\n/** Command exceeded its timeout and was killed. */\nexport class SandboxTimeoutError extends SandboxError {\n  override readonly name = \"SandboxTimeoutError\"\n}\n\n/** Requested isolation backend is not available on the host. */\nexport class SandboxIsolationUnavailableError extends SandboxError {\n  override readonly name = \"SandboxIsolationUnavailableError\"\n}\n",
-    "import { isPlainRecord } from \"../json\"\nimport type { OntologyRegistry } from \"../ontology/registry\"\nimport { assertValidSchema } from \"../ontology/validation/definition\"\nimport type { Sixb } from \"../runtime/sixb\"\nimport type { InferParams, ParamsConfig } from \"../shared/params/types\"\nimport { coerceParamsToTyped, normalizeParams } from \"../shared/params/validation\"\nimport type { SandboxSourceAuth } from \"./auth\"\nimport { SandboxError } from \"./errors\"\nimport type { SandboxNetworkPolicy } from \"./sandbox\"\n\n/** Static recipes accept an empty parameter record, not arbitrary undeclared keys. */\nexport type InferSandboxParams<TParams extends ParamsConfig> = keyof TParams extends never\n  ? Record<string, never>\n  : InferParams<TParams>\n\n/** Initial project contents, independent from the provider's runtime image or saved state. */\nexport interface SandboxSource {\n  readonly type: \"git\"\n  readonly url: string\n  readonly revision?: string\n  readonly access?: \"read\" | \"write\"\n}\n\n/** Host-side recipe. Environment values are guest-readable, never a Git credential channel. */\nexport interface SandboxEnvironment {\n  readonly source?: SandboxSource\n  readonly setup?: readonly string[]\n  readonly env?: Readonly<Record<string, string>>\n  readonly network?: SandboxNetworkPolicy\n}\n\nexport interface SandboxResolveContext<TParams = Record<string, unknown>> {\n  readonly params: TParams\n  /** Bound to the current execution; a stored binding is not authorization. */\n  readonly sixb: Sixb\n}\n\n// The recipe both declares and consumes this schema: keep it invariant instead of asking\n// TypeScript to compare the recursive ontology inference through callback variance.\n// Provider option interfaces must preserve this annotation when extending the config.\nexport interface SandboxConfig<in out TParams extends ParamsConfig = ParamsConfig>\n  extends SandboxEnvironment {\n  readonly auth?: SandboxSourceAuth\n  readonly params?: TParams\n  readonly resolve?: (\n    context: SandboxResolveContext<InferParams<NoInfer<TParams>>>\n  ) => SandboxEnvironment | Promise<SandboxEnvironment>\n}\n\n/** Registered project recipe; only thread params cross the durable boundary. */\nexport interface SandboxDefinition {\n  readonly auth?: SandboxSourceAuth\n  readonly params: ParamsConfig\n  readonly resolve: (context: SandboxResolveContext) => Promise<SandboxEnvironment>\n}\n\nexport function createSandboxDefinition<TParams extends ParamsConfig>(\n  config: SandboxConfig<TParams>,\n  ontology: OntologyRegistry\n): SandboxDefinition {\n  const raw: unknown = config\n  if (\n    !isPlainRecord(raw) ||\n    (config.params !== undefined && !isPlainRecord(raw.params)) ||\n    (config.resolve !== undefined && typeof config.resolve !== \"function\")\n  ) {\n    throw new SandboxError(\n      \"[Sixb] Sandbox configuration requires a params object and a callable resolver when provided.\"\n    )\n  }\n  for (const key of Object.keys(config)) {\n    if (![\"params\", \"resolve\", \"source\", \"setup\", \"env\", \"network\", \"auth\"].includes(key)) {\n      throw new SandboxError(\"[Sixb] Unknown sandbox configuration field.\")\n    }\n  }\n  if (config.auth !== undefined && typeof config.auth?.authorize !== \"function\") {\n    throw new SandboxError(\"[Sixb] sandboxes.auth requires an authorize function.\")\n  }\n  if (config.params !== undefined && config.resolve === undefined) {\n    throw new SandboxError(\"[Sixb] Sandbox params require a resolve function.\")\n  }\n  if (config.resolve !== undefined && (config.source !== undefined || config.setup !== undefined)) {\n    throw new SandboxError(\"[Sixb] Use either static source/setup or resolve, not both.\")\n  }\n  const invalid = (path: string) =>\n    new SandboxError(`[Sixb] ${path} must be a valid parameter declaration; use param(schema).`)\n  for (const [id, value] of Object.entries(config.params ?? {})) {\n    const path = `sandboxes.params.${id}`\n    if (!id.trim() || !isPlainRecord(value)) throw invalid(path)\n    for (const key of Object.keys(value)) {\n      if (![\"schema\", \"required\", \"nullable\", \"description\", \"semanticType\"].includes(key)) {\n        throw invalid(path)\n      }\n    }\n    if (\n      (value.required !== undefined && typeof value.required !== \"boolean\") ||\n      (value.nullable !== undefined && typeof value.nullable !== \"boolean\") ||\n      (value.description !== undefined && typeof value.description !== \"string\") ||\n      (value.semanticType !== undefined && typeof value.semanticType !== \"string\")\n    )\n      throw invalid(path)\n    const schema: unknown = value.schema\n    if (isPlainRecord(schema) && schema.type === \"objectRef\") {\n      if (\n        typeof schema.objectTypeId !== \"string\" ||\n        !ontology.getObjectTypesById().has(schema.objectTypeId)\n      ) {\n        throw invalid(path)\n      }\n    } else {\n      assertValidSchema(schema, `${path}.schema`, invalid)\n    }\n  }\n  const params = structuredClone(config.params ?? {}) as ParamsConfig\n  const environment = captureEnvironment({\n    ...(config.source === undefined ? {} : { source: config.source }),\n    ...(config.setup === undefined ? {} : { setup: config.setup }),\n    ...(config.env === undefined ? {} : { env: config.env }),\n    ...(config.network === undefined ? {} : { network: config.network }),\n  })\n  // Capture the function too: later mutation of application config must not change this host.\n  // Erase inference only after capturing its schema; every invocation validates and coerces below.\n  const resolve = config.resolve as SandboxConfig[\"resolve\"]\n  const authorize = config.auth?.authorize.bind(config.auth)\n  deepFreeze(params)\n  return Object.freeze({\n    params,\n    ...(authorize ? { auth: Object.freeze({ authorize }) } : {}),\n    resolve: async ({ params: input, sixb }: SandboxResolveContext) => {\n      const binding = normalizeParams(ontology.getValueTypesById(), params, input, {\n        kind: \"sandbox\",\n        id: \"sandboxes\",\n        path: \"sandbox\",\n      })\n      const typed = coerceParamsToTyped(params, binding, ontology.getValueTypesById())\n      if (!resolve) return structuredClone(environment)\n      const resolved = captureEnvironment(await resolve({ params: typed, sixb }))\n      return {\n        ...structuredClone(environment),\n        ...resolved,\n        env: { ...environment.env, ...resolved.env },\n      }\n    },\n  })\n}\n\n/** Capture declarative data only; never retain caller-owned objects or include values in errors. */\nexport function captureEnvironment(value: unknown): SandboxEnvironment {\n  if (\n    !isPlainRecord(value) ||\n    Object.keys(value).some((key) => ![\"source\", \"setup\", \"env\", \"network\"].includes(key))\n  ) {\n    return fail(\"environment\")\n  }\n  if (value.source !== undefined) validateSource(value.source)\n  if (value.setup !== undefined) validateSetup(value.setup)\n  if (value.env !== undefined) validateEnv(value.env)\n  if (value.network !== undefined) validateNetwork(value.network)\n  // Every field and discriminant has been checked above; return only an isolated snapshot.\n  return structuredClone(value) as SandboxEnvironment\n}\n\nfunction fail(field: string): never {\n  throw new SandboxError(`[Sixb] Invalid sandbox ${field}.`)\n}\n\nfunction validateSource(source: unknown): void {\n  if (\n    !isPlainRecord(source) ||\n    source.type !== \"git\" ||\n    typeof source.url !== \"string\" ||\n    Object.keys(source).some((key) => ![\"type\", \"url\", \"revision\", \"access\"].includes(key))\n  ) {\n    fail(\"source\")\n  }\n  const url = parseUrl(source.url, \"source URL\")\n  if (url.protocol !== \"https:\" || url.username || url.password || url.search || url.hash) {\n    fail(\"source URL: expected credential-free HTTPS\")\n  }\n  if (\n    source.revision !== undefined &&\n    (typeof source.revision !== \"string\" ||\n      !source.revision.trim() ||\n      source.revision.startsWith(\"-\") ||\n      /[\\x00-\\x1f]/.test(source.revision))\n  ) {\n    fail(\"source revision\")\n  }\n  if (source.access !== undefined && source.access !== \"read\" && source.access !== \"write\") {\n    fail(\"source access\")\n  }\n}\n\nfunction validateSetup(setup: unknown): void {\n  if (\n    !Array.isArray(setup) ||\n    setup.some(\n      (command) => typeof command !== \"string\" || !command.trim() || command.includes(\"\\0\")\n    )\n  ) {\n    fail(\"setup\")\n  }\n}\n\nfunction validateEnv(env: unknown): void {\n  if (\n    !isPlainRecord(env) ||\n    Object.entries(env).some(\n      ([key, entry]) =>\n        !key || /[=\\0]/.test(key) || typeof entry !== \"string\" || entry.includes(\"\\0\")\n    )\n  ) {\n    fail(\"env\")\n  }\n}\n\nfunction validateNetwork(network: unknown): void {\n  if (!isPlainRecord(network)) fail(\"network\")\n  if (network.mode === \"restricted\") {\n    if (\n      Object.keys(network).some((key) => key !== \"mode\" && key !== \"allow\") ||\n      !Array.isArray(network.allow)\n    ) {\n      fail(\"network\")\n    }\n    for (const target of network.allow) validateNetworkTarget(target)\n    return\n  }\n  if (\n    (network.mode !== \"none\" && network.mode !== \"all\") ||\n    Object.keys(network).some((key) => key !== \"mode\")\n  ) {\n    fail(\"network\")\n  }\n}\n\nfunction validateNetworkTarget(target: unknown): void {\n  if (\n    !isPlainRecord(target) ||\n    typeof target.name !== \"string\" ||\n    !target.name.trim() ||\n    typeof target.origin !== \"string\" ||\n    Object.keys(target).some((key) => key !== \"name\" && key !== \"origin\")\n  ) {\n    fail(\"network target\")\n  }\n  const url = parseUrl(target.origin, \"network origin\")\n  if (![\"http:\", \"https:\"].includes(url.protocol) || url.origin !== target.origin) {\n    fail(\"network origin\")\n  }\n}\n\nfunction parseUrl(value: string, field: string): URL {\n  try {\n    return new URL(value)\n  } catch {\n    return fail(field)\n  }\n}\n\nfunction deepFreeze(value: object, seen = new Set<object>()): void {\n  if (seen.has(value)) return\n  seen.add(value)\n  for (const child of Object.values(value)) {\n    if (child !== null && typeof child === \"object\") deepFreeze(child, seen)\n  }\n  Object.freeze(value)\n}\n",
-    "import type { ParamsConfig } from \"../shared/params/types\"\nimport { captureEnvironment, type SandboxConfig } from \"./configuration\"\nimport { SandboxError } from \"./errors\"\n\n/** Extract only the common recipe; provider credentials and infrastructure stay on the factory. */\nexport function sandboxConfig<TParams extends ParamsConfig>(\n  options: SandboxConfig<TParams>\n): SandboxConfig<TParams> {\n  if (options.auth !== undefined && typeof options.auth?.authorize !== \"function\") {\n    throw new SandboxError(\"[Sixb] sandboxes.auth requires an authorize function.\")\n  }\n  const authorize = options.auth?.authorize.bind(options.auth)\n  if (options.params !== undefined && options.resolve === undefined) {\n    throw new SandboxError(\"[Sixb] Sandbox params require a resolve function.\")\n  }\n  if (options.resolve !== undefined && typeof options.resolve !== \"function\") {\n    throw new SandboxError(\"[Sixb] Sandbox resolve must be a function.\")\n  }\n  if (\n    options.resolve !== undefined &&\n    (options.source !== undefined || options.setup !== undefined)\n  ) {\n    throw new SandboxError(\"[Sixb] Use either static source/setup or resolve, not both.\")\n  }\n  const environment = captureEnvironment({\n    ...(options.source === undefined ? {} : { source: options.source }),\n    ...(options.setup === undefined ? {} : { setup: options.setup }),\n    ...(options.env === undefined ? {} : { env: options.env }),\n    ...(options.network === undefined ? {} : { network: options.network }),\n  })\n  return Object.freeze({\n    ...(authorize ? { auth: Object.freeze({ authorize }) } : {}),\n    ...environment,\n    ...(options.params === undefined ? {} : { params: structuredClone(options.params) }),\n    ...(options.resolve === undefined ? {} : { resolve: options.resolve }),\n  })\n}\n",
-    "import { posix } from \"node:path\"\nimport type { ParamsConfig } from \"../shared/params/types\"\nimport type { SandboxConfig } from \"./configuration\"\nimport { captureEnvironment, type SandboxEnvironment } from \"./configuration\"\nimport { SandboxError } from \"./errors\"\nimport type { CreateSandboxOptions, Sandbox } from \"./sandbox\"\n\n/** Select and validate before provisioning. Only the execution runtime may resolve a recipe. */\nexport function sandboxCreationEnvironment<TParams extends ParamsConfig>(\n  configuration: SandboxConfig<TParams>,\n  options: CreateSandboxOptions\n): Pick<SandboxEnvironment, \"source\" | \"setup\"> {\n  if (options.environment === undefined && configuration.resolve !== undefined) {\n    throw new SandboxError(\n      \"[Sixb] Dynamic sandbox configuration requires an execution-resolved environment.\"\n    )\n  }\n  const environment = captureEnvironment(\n    options.environment !== undefined\n      ? options.environment\n      : {\n          ...(configuration.source === undefined ? {} : { source: configuration.source }),\n          ...(configuration.setup === undefined ? {} : { setup: configuration.setup }),\n        }\n  )\n  if (environment.env !== undefined || environment.network !== undefined) {\n    throw new SandboxError(\n      \"[Sixb] Pass env and network as sandbox session options, not environment.\"\n    )\n  }\n  if (environment.source) {\n    if (\n      (configuration.auth !== undefined || environment.source.access === \"write\") &&\n      !options.requestCredentials?.length\n    ) {\n      throw new SandboxError(\n        \"[Sixb] Sandbox source authentication requires execution-prepared request credentials.\"\n      )\n    }\n    const network = options.network ?? configuration.network ?? { mode: \"none\" }\n    const origin = new URL(environment.source.url).origin\n    if (\n      network.mode === \"none\" ||\n      (network.mode === \"restricted\" && !network.allow.some((target) => target.origin === origin))\n    ) {\n      throw new SandboxError(\"[Sixb] Sandbox network policy denies the source origin.\")\n    }\n  }\n  options.signal?.throwIfAborted()\n  return environment\n}\n\n/** Select the same project directory on creation and resume without touching saved files. */\nexport function sandboxProjectDirectory(session: Sandbox, hasSource: boolean): Sandbox {\n  if (!hasSource) return session\n  const workingDirectory = posix.join(session.workingDirectory, \"repository\")\n  return {\n    id: session.id,\n    provider: session.provider,\n    get status() {\n      return session.status\n    },\n    workingDirectory,\n    ...(session.setRequestCredentials\n      ? { setRequestCredentials: session.setRequestCredentials.bind(session) }\n      : {}),\n    runCommand: (command, args, options) =>\n      session.runCommand(command, args, { ...options, cwd: options?.cwd ?? workingDirectory }),\n    writeFiles: (files) =>\n      session.writeFiles(\n        files.map((file) => ({\n          ...file,\n          path: posix.isAbsolute(file.path) ? file.path : posix.join(workingDirectory, file.path),\n        }))\n      ),\n    stop: () => session.stop(),\n    destroy: () => session.destroy(),\n  }\n}\n\n/** Provider-side initialization, after the session network/credentials have been applied.\n * Call only on fresh creation. The caller owns cleanup if any command fails.\n */\nexport async function initializeSandboxEnvironment(\n  session: Sandbox,\n  environment: Pick<SandboxEnvironment, \"source\" | \"setup\">,\n  signal?: AbortSignal\n): Promise<Sandbox> {\n  environment = captureEnvironment(environment)\n  const run = async (sandbox: Sandbox, command: string, args: readonly string[]) => {\n    signal?.throwIfAborted()\n    const result = await sandbox.runCommand(command, args, { timeout: 120_000, signal })\n    if (result.exitCode !== 0 || result.timedOut) {\n      throw new SandboxError(\"[Sixb] Sandbox environment initialization failed.\")\n    }\n  }\n  signal?.throwIfAborted()\n  const sandbox = sandboxProjectDirectory(session, environment.source !== undefined)\n  if (environment.source) {\n    await run(session, \"git\", [\"clone\", \"--\", environment.source.url, \"repository\"])\n    if (environment.source.revision) {\n      await run(sandbox, \"git\", [\"checkout\", environment.source.revision, \"--\"])\n    }\n  }\n  for (const command of environment.setup ?? []) await run(sandbox, \"bash\", [\"-lc\", command])\n  return sandbox\n}\n",
-    "import type { CommandResult } from \"./sandbox\"\n\nexport interface ExecOptions {\n  readonly argv: readonly string[]\n  readonly cwd: string\n  readonly env: Readonly<Record<string, string>>\n  readonly timeoutMs?: number\n  readonly signal?: AbortSignal\n}\n\nconst DEFAULT_KILL_EXIT_CODE = 137\n\n/**\n * Spawn a child process and gather its {@link CommandResult}. Wraps Bun.spawn with timeout and\n * AbortSignal handling, and never throws. Command-agnostic: the wrapper makes no assumptions about\n * what it spawns, so sandbox providers share it. On timeout/abort it SIGKILLs the spawned process;\n * any provider whose spawned process merely fronts a longer-lived resource (e.g. a VM) is\n * responsible for reaping that resource in its own stop()/destroy().\n */\nexport async function exec(options: ExecOptions): Promise<CommandResult> {\n  const start = Date.now()\n\n  const [head, ...rest] = options.argv\n  if (!head) {\n    return {\n      exitCode: 1,\n      stdout: \"\",\n      stderr: \"[Sandbox] empty argv\",\n      durationMs: 0,\n    }\n  }\n\n  let proc: ReturnType<typeof Bun.spawn>\n  try {\n    proc = Bun.spawn([head, ...rest], {\n      cwd: options.cwd,\n      env: options.env,\n      stdin: \"ignore\",\n      stdout: \"pipe\",\n      stderr: \"pipe\",\n    })\n  } catch (error) {\n    return {\n      exitCode: 127,\n      stdout: \"\",\n      stderr: error instanceof Error ? error.message : String(error),\n      durationMs: Date.now() - start,\n    }\n  }\n\n  let timedOut = false\n  let killed = false\n\n  const timer =\n    options.timeoutMs !== undefined && options.timeoutMs > 0\n      ? setTimeout(() => {\n          timedOut = true\n          killed = true\n          proc.kill(\"SIGKILL\")\n        }, options.timeoutMs)\n      : undefined\n\n  const onAbort = (): void => {\n    if (!killed) {\n      killed = true\n      proc.kill(\"SIGKILL\")\n    }\n  }\n  options.signal?.addEventListener(\"abort\", onAbort)\n  if (options.signal?.aborted) {\n    onAbort()\n  }\n\n  let stdout = \"\"\n  let stderr = \"\"\n  let exitCode = 0\n  try {\n    const [stdoutText, stderrText, code] = await Promise.all([\n      new Response(proc.stdout as ReadableStream<Uint8Array>).text(),\n      new Response(proc.stderr as ReadableStream<Uint8Array>).text(),\n      proc.exited,\n    ])\n    stdout = stdoutText\n    stderr = stderrText\n    exitCode = typeof code === \"number\" ? code : DEFAULT_KILL_EXIT_CODE\n  } finally {\n    if (timer !== undefined) clearTimeout(timer)\n    options.signal?.removeEventListener(\"abort\", onAbort)\n  }\n\n  if (killed && exitCode === 0) {\n    exitCode = DEFAULT_KILL_EXIT_CODE\n  }\n\n  return {\n    exitCode,\n    stdout,\n    stderr,\n    durationMs: Date.now() - start,\n    ...(timedOut ? { timedOut: true } : {}),\n  }\n}\n"
-  ],
-  "mappings": ";;;;;;;;;;;;;AAIO,MAAM,sBAAqB,MAAM;AAAA,EAC7B,OAAe;AAC1B;AAAA;AAGO,MAAM,sCAAqC,cAAa;AAAA,EAC3C,OAAO;AAC3B;AAAA;AAGO,MAAM,gCAA+B,cAAa;AAAA,EACrC,OAAO;AAC3B;AAAA;AAGO,MAAM,6BAA4B,cAAa;AAAA,EAClC,OAAO;AAC3B;AAAA;AAGO,MAAM,0CAAyC,cAAa;AAAA,EAC/C,OAAO;AAC3B;;;AC8BO,SAAS,uBAAqD,CACnE,QACA,UACmB;AAAA,EACnB,MAAM,MAAe;AAAA,EACrB,IACE,CAAC,cAAc,GAAG,KACjB,OAAO,WAAW,aAAa,CAAC,cAAc,IAAI,MAAM,KACxD,OAAO,YAAY,aAAa,OAAO,OAAO,YAAY,YAC3D;AAAA,IACA,MAAM,IAAI,cACR,8FACF;AAAA,EACF;AAAA,EACA,WAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AAAA,IACrC,IAAI,CAAC,CAAC,UAAU,WAAW,UAAU,SAAS,OAAO,WAAW,MAAM,EAAE,SAAS,GAAG,GAAG;AAAA,MACrF,MAAM,IAAI,cAAa,6CAA6C;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,OAAO,SAAS,aAAa,OAAO,OAAO,MAAM,cAAc,YAAY;AAAA,IAC7E,MAAM,IAAI,cAAa,uDAAuD;AAAA,EAChF;AAAA,EACA,IAAI,OAAO,WAAW,aAAa,OAAO,YAAY,WAAW;AAAA,IAC/D,MAAM,IAAI,cAAa,mDAAmD;AAAA,EAC5E;AAAA,EACA,IAAI,OAAO,YAAY,cAAc,OAAO,WAAW,aAAa,OAAO,UAAU,YAAY;AAAA,IAC/F,MAAM,IAAI,cAAa,6DAA6D;AAAA,EACtF;AAAA,EACA,MAAM,UAAU,CAAC,SACf,IAAI,cAAa,UAAU,gEAAgE;AAAA,EAC7F,YAAY,IAAI,UAAU,OAAO,QAAQ,OAAO,UAAU,CAAC,CAAC,GAAG;AAAA,IAC7D,MAAM,OAAO,oBAAoB;AAAA,IACjC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,cAAc,KAAK;AAAA,MAAG,MAAM,QAAQ,IAAI;AAAA,IAC3D,WAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AAAA,MACpC,IAAI,CAAC,CAAC,UAAU,YAAY,YAAY,eAAe,cAAc,EAAE,SAAS,GAAG,GAAG;AAAA,QACpF,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,IACF;AAAA,IACA,IACG,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,aAC1D,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,aAC1D,MAAM,gBAAgB,aAAa,OAAO,MAAM,gBAAgB,YAChE,MAAM,iBAAiB,aAAa,OAAO,MAAM,iBAAiB;AAAA,MAEnE,MAAM,QAAQ,IAAI;AAAA,IACpB,MAAM,SAAkB,MAAM;AAAA,IAC9B,IAAI,cAAc,MAAM,KAAK,OAAO,SAAS,aAAa;AAAA,MACxD,IACE,OAAO,OAAO,iBAAiB,YAC/B,CAAC,SAAS,mBAAmB,EAAE,IAAI,OAAO,YAAY,GACtD;AAAA,QACA,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,IACF,EAAO;AAAA,MACL,kBAAkB,QAAQ,GAAG,eAAe,OAAO;AAAA;AAAA,EAEvD;AAAA,EACA,MAAM,SAAS,gBAAgB,OAAO,UAAU,CAAC,CAAC;AAAA,EAClD,MAAM,cAAc,mBAAmB;AAAA,OACjC,OAAO,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,OAAO,OAAO;AAAA,OAC3D,OAAO,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;AAAA,OACxD,OAAO,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,OAAO,IAAI;AAAA,OAClD,OAAO,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;AAAA,EACpE,CAAC;AAAA,EAGD,MAAM,UAAU,OAAO;AAAA,EACvB,MAAM,YAAY,OAAO,MAAM,UAAU,KAAK,OAAO,IAAI;AAAA,EACzD,WAAW,MAAM;AAAA,EACjB,OAAO,OAAO,OAAO;AAAA,IACnB;AAAA,OACI,YAAY,EAAE,MAAM,OAAO,OAAO,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC;AAAA,IAC1D,SAAS,SAAS,QAAQ,OAAO,WAAkC;AAAA,MACjE,MAAM,UAAU,gBAAgB,SAAS,kBAAkB,GAAG,QAAQ,OAAO;AAAA,QAC3E,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,MAAM;AAAA,MACR,CAAC;AAAA,MACD,MAAM,QAAQ,oBAAoB,QAAQ,SAAS,SAAS,kBAAkB,CAAC;AAAA,MAC/E,IAAI,CAAC;AAAA,QAAS,OAAO,gBAAgB,WAAW;AAAA,MAChD,MAAM,WAAW,mBAAmB,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,CAAC,CAAC;AAAA,MAC1E,OAAO;AAAA,WACF,gBAAgB,WAAW;AAAA,WAC3B;AAAA,QACH,KAAK,KAAK,YAAY,QAAQ,SAAS,IAAI;AAAA,MAC7C;AAAA;AAAA,EAEJ,CAAC;AAAA;AAII,SAAS,kBAAkB,CAAC,OAAoC;AAAA,EACrE,IACE,CAAC,cAAc,KAAK,KACpB,OAAO,KAAK,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,UAAU,SAAS,OAAO,SAAS,EAAE,SAAS,GAAG,CAAC,GACrF;AAAA,IACA,OAAO,KAAK,aAAa;AAAA,EAC3B;AAAA,EACA,IAAI,MAAM,WAAW;AAAA,IAAW,eAAe,MAAM,MAAM;AAAA,EAC3D,IAAI,MAAM,UAAU;AAAA,IAAW,cAAc,MAAM,KAAK;AAAA,EACxD,IAAI,MAAM,QAAQ;AAAA,IAAW,YAAY,MAAM,GAAG;AAAA,EAClD,IAAI,MAAM,YAAY;AAAA,IAAW,gBAAgB,MAAM,OAAO;AAAA,EAE9D,OAAO,gBAAgB,KAAK;AAAA;AAG9B,SAAS,IAAI,CAAC,OAAsB;AAAA,EAClC,MAAM,IAAI,cAAa,0BAA0B,QAAQ;AAAA;AAG3D,SAAS,cAAc,CAAC,QAAuB;AAAA,EAC7C,IACE,CAAC,cAAc,MAAM,KACrB,OAAO,SAAS,SAChB,OAAO,OAAO,QAAQ,YACtB,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,OAAO,YAAY,QAAQ,EAAE,SAAS,GAAG,CAAC,GACtF;AAAA,IACA,KAAK,QAAQ;AAAA,EACf;AAAA,EACA,MAAM,MAAM,SAAS,OAAO,KAAK,YAAY;AAAA,EAC7C,IAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,MAAM;AAAA,IACvF,KAAK,4CAA4C;AAAA,EACnD;AAAA,EACA,IACE,OAAO,aAAa,cACnB,OAAO,OAAO,aAAa,YAC1B,CAAC,OAAO,SAAS,KAAK,KACtB,OAAO,SAAS,WAAW,GAAG,KAC9B,cAAc,KAAK,OAAO,QAAQ,IACpC;AAAA,IACA,KAAK,iBAAiB;AAAA,EACxB;AAAA,EACA,IAAI,OAAO,WAAW,aAAa,OAAO,WAAW,UAAU,OAAO,WAAW,SAAS;AAAA,IACxF,KAAK,eAAe;AAAA,EACtB;AAAA;AAGF,SAAS,aAAa,CAAC,OAAsB;AAAA,EAC3C,IACE,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,KACJ,CAAC,YAAY,OAAO,YAAY,YAAY,CAAC,QAAQ,KAAK,KAAK,QAAQ,SAAS,MAAI,CACtF,GACA;AAAA,IACA,KAAK,OAAO;AAAA,EACd;AAAA;AAGF,SAAS,WAAW,CAAC,KAAoB;AAAA,EACvC,IACE,CAAC,cAAc,GAAG,KAClB,OAAO,QAAQ,GAAG,EAAE,KAClB,EAAE,KAAK,WACL,CAAC,OAAO,QAAQ,KAAK,GAAG,KAAK,OAAO,UAAU,YAAY,MAAM,SAAS,MAAI,CACjF,GACA;AAAA,IACA,KAAK,KAAK;AAAA,EACZ;AAAA;AAGF,SAAS,eAAe,CAAC,SAAwB;AAAA,EAC/C,IAAI,CAAC,cAAc,OAAO;AAAA,IAAG,KAAK,SAAS;AAAA,EAC3C,IAAI,QAAQ,SAAS,cAAc;AAAA,IACjC,IACE,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,UAAU,QAAQ,OAAO,KACpE,CAAC,MAAM,QAAQ,QAAQ,KAAK,GAC5B;AAAA,MACA,KAAK,SAAS;AAAA,IAChB;AAAA,IACA,WAAW,UAAU,QAAQ;AAAA,MAAO,sBAAsB,MAAM;AAAA,IAChE;AAAA,EACF;AAAA,EACA,IACG,QAAQ,SAAS,UAAU,QAAQ,SAAS,SAC7C,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,MAAM,GACjD;AAAA,IACA,KAAK,SAAS;AAAA,EAChB;AAAA;AAGF,SAAS,qBAAqB,CAAC,QAAuB;AAAA,EACpD,IACE,CAAC,cAAc,MAAM,KACrB,OAAO,OAAO,SAAS,YACvB,CAAC,OAAO,KAAK,KAAK,KAClB,OAAO,OAAO,WAAW,YACzB,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,QAAQ,QAAQ,UAAU,QAAQ,QAAQ,GACpE;AAAA,IACA,KAAK,gBAAgB;AAAA,EACvB;AAAA,EACA,MAAM,MAAM,SAAS,OAAO,QAAQ,gBAAgB;AAAA,EACpD,IAAI,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAAK,IAAI,WAAW,OAAO,QAAQ;AAAA,IAC/E,KAAK,gBAAgB;AAAA,EACvB;AAAA;AAGF,SAAS,QAAQ,CAAC,OAAe,OAAoB;AAAA,EACnD,IAAI;AAAA,IACF,OAAO,IAAI,IAAI,KAAK;AAAA,IACpB,MAAM;AAAA,IACN,OAAO,KAAK,KAAK;AAAA;AAAA;AAIrB,SAAS,UAAU,CAAC,OAAe,OAAO,IAAI,KAAqB;AAAA,EACjE,IAAI,KAAK,IAAI,KAAK;AAAA,IAAG;AAAA,EACrB,KAAK,IAAI,KAAK;AAAA,EACd,WAAW,SAAS,OAAO,OAAO,KAAK,GAAG;AAAA,IACxC,IAAI,UAAU,QAAQ,OAAO,UAAU;AAAA,MAAU,WAAW,OAAO,IAAI;AAAA,EACzE;AAAA,EACA,OAAO,OAAO,KAAK;AAAA;;;ACrQd,SAAS,cAA2C,CACzD,SACwB;AAAA,EACxB,IAAI,QAAQ,SAAS,aAAa,OAAO,QAAQ,MAAM,cAAc,YAAY;AAAA,IAC/E,MAAM,IAAI,cAAa,uDAAuD;AAAA,EAChF;AAAA,EACA,MAAM,YAAY,QAAQ,MAAM,UAAU,KAAK,QAAQ,IAAI;AAAA,EAC3D,IAAI,QAAQ,WAAW,aAAa,QAAQ,YAAY,WAAW;AAAA,IACjE,MAAM,IAAI,cAAa,mDAAmD;AAAA,EAC5E;AAAA,EACA,IAAI,QAAQ,YAAY,aAAa,OAAO,QAAQ,YAAY,YAAY;AAAA,IAC1E,MAAM,IAAI,cAAa,4CAA4C;AAAA,EACrE;AAAA,EACA,IACE,QAAQ,YAAY,cACnB,QAAQ,WAAW,aAAa,QAAQ,UAAU,YACnD;AAAA,IACA,MAAM,IAAI,cAAa,6DAA6D;AAAA,EACtF;AAAA,EACA,MAAM,cAAc,mBAAmB;AAAA,OACjC,QAAQ,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,QAAQ,OAAO;AAAA,OAC7D,QAAQ,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;AAAA,OAC1D,QAAQ,QAAQ,YAAY,CAAC,IAAI,EAAE,KAAK,QAAQ,IAAI;AAAA,OACpD,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE,CAAC;AAAA,EACD,OAAO,OAAO,OAAO;AAAA,OACf,YAAY,EAAE,MAAM,OAAO,OAAO,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC;AAAA,OACvD;AAAA,OACC,QAAQ,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,gBAAgB,QAAQ,MAAM,EAAE;AAAA,OAC9E,QAAQ,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACtE,CAAC;AAAA;;ACnCH;AAQO,SAAS,2BAAwD,CACtE,eACA,SAC8C;AAAA,EAC9C,IAAI,QAAQ,gBAAgB,aAAa,cAAc,YAAY,WAAW;AAAA,IAC5E,MAAM,IAAI,cACR,kFACF;AAAA,EACF;AAAA,EACA,MAAM,cAAc,mBAClB,QAAQ,gBAAgB,YACpB,QAAQ,cACR;AAAA,OACM,cAAc,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,cAAc,OAAO;AAAA,OACzE,cAAc,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,cAAc,MAAM;AAAA,EAC5E,CACN;AAAA,EACA,IAAI,YAAY,QAAQ,aAAa,YAAY,YAAY,WAAW;AAAA,IACtE,MAAM,IAAI,cACR,0EACF;AAAA,EACF;AAAA,EACA,IAAI,YAAY,QAAQ;AAAA,IACtB,KACG,cAAc,SAAS,aAAa,YAAY,OAAO,WAAW,YACnE,CAAC,QAAQ,oBAAoB,QAC7B;AAAA,MACA,MAAM,IAAI,cACR,uFACF;AAAA,IACF;AAAA,IACA,MAAM,UAAU,QAAQ,WAAW,cAAc,WAAW,EAAE,MAAM,OAAO;AAAA,IAC3E,MAAM,SAAS,IAAI,IAAI,YAAY,OAAO,GAAG,EAAE;AAAA,IAC/C,IACE,QAAQ,SAAS,UAChB,QAAQ,SAAS,gBAAgB,CAAC,QAAQ,MAAM,KAAK,CAAC,WAAW,OAAO,WAAW,MAAM,GAC1F;AAAA,MACA,MAAM,IAAI,cAAa,yDAAyD;AAAA,IAClF;AAAA,EACF;AAAA,EACA,QAAQ,QAAQ,eAAe;AAAA,EAC/B,OAAO;AAAA;AAIF,SAAS,wBAAuB,CAAC,SAAkB,WAA6B;AAAA,EACrF,IAAI,CAAC;AAAA,IAAW,OAAO;AAAA,EACvB,MAAM,mBAAmB,MAAM,KAAK,QAAQ,kBAAkB,YAAY;AAAA,EAC1E,OAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,UAAU,QAAQ;AAAA,QACd,MAAM,GAAG;AAAA,MACX,OAAO,QAAQ;AAAA;AAAA,IAEjB;AAAA,OACI,QAAQ,wBACR,EAAE,uBAAuB,QAAQ,sBAAsB,KAAK,OAAO,EAAE,IACrE,CAAC;AAAA,IACL,YAAY,CAAC,SAAS,MAAM,YAC1B,QAAQ,WAAW,SAAS,MAAM,KAAK,SAAS,KAAK,SAAS,OAAO,iBAAiB,CAAC;AAAA,IACzF,YAAY,CAAC,UACX,QAAQ,WACN,MAAM,IAAI,CAAC,UAAU;AAAA,SAChB;AAAA,MACH,MAAM,MAAM,WAAW,KAAK,IAAI,IAAI,KAAK,OAAO,MAAM,KAAK,kBAAkB,KAAK,IAAI;AAAA,IACxF,EAAE,CACJ;AAAA,IACF,MAAM,MAAM,QAAQ,KAAK;AAAA,IACzB,SAAS,MAAM,QAAQ,QAAQ;AAAA,EACjC;AAAA;AAMF,eAAsB,6BAA4B,CAChD,SACA,aACA,QACkB;AAAA,EAClB,cAAc,mBAAmB,WAAW;AAAA,EAC5C,MAAM,MAAM,OAAO,SAAkB,SAAiB,SAA4B;AAAA,IAChF,QAAQ,eAAe;AAAA,IACvB,MAAM,SAAS,MAAM,QAAQ,WAAW,SAAS,MAAM,EAAE,SAAS,QAAS,OAAO,CAAC;AAAA,IACnF,IAAI,OAAO,aAAa,KAAK,OAAO,UAAU;AAAA,MAC5C,MAAM,IAAI,cAAa,mDAAmD;AAAA,IAC5E;AAAA;AAAA,EAEF,QAAQ,eAAe;AAAA,EACvB,MAAM,UAAU,yBAAwB,SAAS,YAAY,WAAW,SAAS;AAAA,EACjF,IAAI,YAAY,QAAQ;AAAA,IACtB,MAAM,IAAI,SAAS,OAAO,CAAC,SAAS,MAAM,YAAY,OAAO,KAAK,YAAY,CAAC;AAAA,IAC/E,IAAI,YAAY,OAAO,UAAU;AAAA,MAC/B,MAAM,IAAI,SAAS,OAAO,CAAC,YAAY,YAAY,OAAO,UAAU,IAAI,CAAC;AAAA,IAC3E;AAAA,EACF;AAAA,EACA,WAAW,WAAW,YAAY,SAAS,CAAC;AAAA,IAAG,MAAM,IAAI,SAAS,QAAQ,CAAC,OAAO,OAAO,CAAC;AAAA,EAC1F,OAAO;AAAA;;AC/FT,IAAM,yBAAyB;AAS/B,eAAsB,KAAI,CAAC,SAA8C;AAAA,EACvE,MAAM,QAAQ,KAAK,IAAI;AAAA,EAEvB,OAAO,SAAS,QAAQ,QAAQ;AAAA,EAChC,IAAI,CAAC,MAAM;AAAA,IACT,OAAO;AAAA,MACL,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,YAAY;AAAA,IACd;AAAA,EACF;AAAA,EAEA,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG;AAAA,MAChC,KAAK,QAAQ;AAAA,MACb,KAAK,QAAQ;AAAA,MACb,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,OAAO;AAAA,MACL,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC7D,YAAY,KAAK,IAAI,IAAI;AAAA,IAC3B;AAAA;AAAA,EAGF,IAAI,WAAW;AAAA,EACf,IAAI,SAAS;AAAA,EAEb,MAAM,QACJ,QAAQ,cAAc,aAAa,QAAQ,YAAY,IACnD,WAAW,MAAM;AAAA,IACf,WAAW;AAAA,IACX,SAAS;AAAA,IACT,KAAK,KAAK,SAAS;AAAA,KAClB,QAAQ,SAAS,IACpB;AAAA,EAEN,MAAM,UAAU,MAAY;AAAA,IAC1B,IAAI,CAAC,QAAQ;AAAA,MACX,SAAS;AAAA,MACT,KAAK,KAAK,SAAS;AAAA,IACrB;AAAA;AAAA,EAEF,QAAQ,QAAQ,iBAAiB,SAAS,OAAO;AAAA,EACjD,IAAI,QAAQ,QAAQ,SAAS;AAAA,IAC3B,QAAQ;AAAA,EACV;AAAA,EAEA,IAAI,SAAS;AAAA,EACb,IAAI,SAAS;AAAA,EACb,IAAI,WAAW;AAAA,EACf,IAAI;AAAA,IACF,OAAO,YAAY,YAAY,QAAQ,MAAM,QAAQ,IAAI;AAAA,MACvD,IAAI,SAAS,KAAK,MAAoC,EAAE,KAAK;AAAA,MAC7D,IAAI,SAAS,KAAK,MAAoC,EAAE,KAAK;AAAA,MAC7D,KAAK;AAAA,IACP,CAAC;AAAA,IACD,SAAS;AAAA,IACT,SAAS;AAAA,IACT,WAAW,OAAO,SAAS,WAAW,OAAO;AAAA,YAC7C;AAAA,IACA,IAAI,UAAU;AAAA,MAAW,aAAa,KAAK;AAAA,IAC3C,QAAQ,QAAQ,oBAAoB,SAAS,OAAO;AAAA;AAAA,EAGtD,IAAI,UAAU,aAAa,GAAG;AAAA,IAC5B,WAAW;AAAA,EACb;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,KAAK,IAAI,IAAI;AAAA,OACrB,WAAW,EAAE,UAAU,KAAK,IAAI,CAAC;AAAA,EACvC;AAAA;",
-  "debugId": "C3376C4D866A438264756E2164756E21",
-  "names": []
-}

package/dist/chunk-es1gxsbf.js.map

@@ -1,13 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/security/errors.ts", "../src/security/membership-policies.ts", "../src/security/validation.ts", "../src/security/builders.ts"],
-  "sourcesContent": [
-    "export class SecurityValidationError extends Error {\n  readonly name = \"SecurityValidationError\"\n}\n",
-    "import type { MembershipOperation, MembershipPolicyDefinition } from \"./types\"\n\nexport interface MembershipOperationScope {\n  readonly policyIds: readonly string[]\n  readonly groupIds: ReadonlySet<string>\n}\n\nexport interface MembershipPolicyScope {\n  readonly policyIds: readonly string[]\n  readonly operations: Readonly<Record<MembershipOperation, MembershipOperationScope>>\n}\n\nconst MEMBERSHIP_OPERATIONS = [\"invite\", \"assignGroups\", \"suspend\", \"serviceAccounts\"] as const\n\nexport function resolveMembershipPolicyScope(input: {\n  readonly membershipPolicies: readonly MembershipPolicyDefinition[]\n  readonly callerGroupIds: readonly string[]\n}): MembershipPolicyScope {\n  const callerGroups = new Set(input.callerGroupIds)\n  const policyIds: string[] = []\n  const operations = createEmptyOperationScopes()\n\n  for (const policy of input.membershipPolicies) {\n    if (!policy.grantedToGroupIds.some((groupId) => callerGroups.has(groupId))) {\n      continue\n    }\n\n    policyIds.push(policy.id)\n    for (const operation of policy.can) {\n      operations[operation].policyIds.push(policy.id)\n      for (const groupId of policy.scopeGroupIds) {\n        operations[operation].groupIds.add(groupId)\n      }\n    }\n  }\n\n  return {\n    policyIds,\n    operations: {\n      invite: freezeOperationScope(operations.invite),\n      assignGroups: freezeOperationScope(operations.assignGroups),\n      suspend: freezeOperationScope(operations.suspend),\n      serviceAccounts: freezeOperationScope(operations.serviceAccounts),\n    },\n  }\n}\n\nexport function canPerformMembershipOperation(\n  scope: MembershipPolicyScope,\n  operation: MembershipOperation,\n  groupIds: readonly string[]\n): boolean {\n  const operationScope = scope.operations[operation]\n\n  if (operationScope.policyIds.length === 0) {\n    return false\n  }\n\n  if (groupIds.length === 0) {\n    return true\n  }\n\n  return groupIds.every((groupId) => operationScope.groupIds.has(groupId))\n}\n\nexport function missingMembershipGroupIds(\n  scope: MembershipPolicyScope,\n  operation: MembershipOperation,\n  groupIds: readonly string[]\n): readonly string[] {\n  if (groupIds.length === 0) {\n    return []\n  }\n\n  const operationScope = scope.operations[operation]\n  return groupIds.filter((groupId) => !operationScope.groupIds.has(groupId))\n}\n\nfunction createEmptyOperationScopes(): Record<\n  MembershipOperation,\n  { policyIds: string[]; groupIds: Set<string> }\n> {\n  return {\n    invite: { policyIds: [], groupIds: new Set<string>() },\n    assignGroups: { policyIds: [], groupIds: new Set<string>() },\n    suspend: { policyIds: [], groupIds: new Set<string>() },\n    serviceAccounts: { policyIds: [], groupIds: new Set<string>() },\n  }\n}\n\nfunction freezeOperationScope(input: {\n  readonly policyIds: readonly string[]\n  readonly groupIds: ReadonlySet<string>\n}): MembershipOperationScope {\n  return {\n    policyIds: [...input.policyIds],\n    groupIds: new Set(input.groupIds),\n  }\n}\n\nexport function isMembershipOperation(value: unknown): value is MembershipOperation {\n  return MEMBERSHIP_OPERATIONS.includes(value as MembershipOperation)\n}\n",
-    "import {\n  GRANT_KINDS,\n  type GrantUniverseKey,\n  grantKindOf,\n  isSingletonGrantKind,\n} from \"../authorization/grant-kinds\"\nimport { SecurityValidationError } from \"./errors\"\nimport { isMembershipOperation } from \"./membership-policies\"\nimport type {\n  GrantCapability,\n  GrantDefinition,\n  GroupDefinition,\n  MarkingDefinition,\n  MembershipPolicyDefinition,\n  RegisteredSecurityDefinitions,\n  RoleDefinition,\n  Selection,\n} from \"./types\"\n\n/** Registered id universes and singleton capabilities available to role grants. */\ntype RegisteredUniverses = Partial<Record<GrantUniverseKey, ReadonlySet<string>>> & {\n  readonly agentAvailable?: boolean\n}\n\n/**\n * Every grant capability, for validating grants that arrive from untyped code.\n *\n * Written as a total `Record<GrantCapability, true>` rather than a bare array so a capability added\n * to `GrantDefinition` is a compile error here — the same discipline `GRANT_KINDS` uses. The\n * hand-written `capability !== \"view\" && …` chain this replaces would have accepted the new\n * capability at startup and then died on `GRANT_KINDS[kind].universeKey`.\n */\nconst GRANT_CAPABILITIES = Object.keys({\n  view: true,\n  edit: true,\n  append: true,\n  apply: true,\n  share: true,\n  run: true,\n  observe: true,\n  manage: true,\n} satisfies Record<GrantCapability, true>) as readonly GrantCapability[]\n\n/** \"'a', 'b', or 'c'\" — the shape the security errors already use. */\nfunction formatAlternatives(values: readonly string[]): string {\n  const quoted = values.map((value) => `'${value}'`)\n  const last = quoted.at(-1)\n  return quoted.length < 2 ? (last ?? \"\") : `${quoted.slice(0, -1).join(\", \")}, or ${last}`\n}\n\nexport type CreateSecurityError = (message: string) => Error\n\n// Shared, single-source validation primitives. The builders reuse these too, so\n// authoring-time and startup-time checks can never drift apart.\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nexport function assertNonEmptyString(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is string {\n  if (typeof value !== \"string\" || value.trim().length === 0) {\n    throw createError(`[Sixb] ${field} must not be empty.`)\n  }\n}\n\nexport function assertOptionalString(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is string | undefined {\n  if (value === undefined) {\n    return\n  }\n\n  if (typeof value !== \"string\") {\n    throw createError(`[Sixb] ${field} must be a string.`)\n  }\n}\n\nfunction assertStringArray(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is readonly string[] {\n  if (!Array.isArray(value)) {\n    throw createError(`[Sixb] ${field} must be an array of group ids.`)\n  }\n\n  for (const item of value) {\n    assertNonEmptyString(item, `${field} item`, createError)\n  }\n}\n\nfunction assertMembershipOperationArray(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is MembershipPolicyDefinition[\"can\"] {\n  if (!Array.isArray(value)) {\n    throw createError(`[Sixb] ${field} must be an array of membership operations.`)\n  }\n\n  for (const item of value) {\n    if (!isMembershipOperation(item)) {\n      throw createError(\n        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`\n      )\n    }\n  }\n}\n\nfunction assertNoDuplicateIds(ids: readonly string[], field: string): void {\n  const seen = new Set<string>()\n  for (const id of ids) {\n    if (seen.has(id)) {\n      throw new SecurityValidationError(`[Sixb] ${field} contains duplicate group id '${id}'.`)\n    }\n    seen.add(id)\n  }\n}\n\nfunction assertNoDuplicateOperations(\n  operations: readonly MembershipPolicyDefinition[\"can\"][number][],\n  field: string\n): void {\n  const seen = new Set<string>()\n  for (const operation of operations) {\n    if (seen.has(operation)) {\n      throw new SecurityValidationError(\n        `[Sixb] ${field} contains duplicate operation '${operation}'.`\n      )\n    }\n    seen.add(operation)\n  }\n}\n\nexport function assertMarkingDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is MarkingDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Marking definition must be an object.\")\n  }\n\n  if (value.kind !== \"marking\") {\n    throw createError(\"[Sixb] Marking definition kind must be 'marking'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Marking id\", createError)\n  assertOptionalString(value.label, `Marking '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Marking '${value.id}' description`, createError)\n}\n\nexport function isMarkingDefinition(value: unknown): value is MarkingDefinition {\n  try {\n    assertMarkingDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertGroupDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is GroupDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Group definition must be an object.\")\n  }\n\n  if (value.kind !== \"group\") {\n    throw createError(\"[Sixb] Group definition kind must be 'group'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Group id\", createError)\n  assertOptionalString(value.label, `Group '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Group '${value.id}' description`, createError)\n}\n\nexport function isGroupDefinition(value: unknown): value is GroupDefinition {\n  try {\n    assertGroupDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertMembershipPolicyDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is MembershipPolicyDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Membership policy definition must be an object.\")\n  }\n\n  if (value.kind !== \"membershipPolicy\") {\n    throw createError(\"[Sixb] Membership policy definition kind must be 'membershipPolicy'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Membership policy id\", createError)\n  assertStringArray(\n    value.grantedToGroupIds,\n    `Membership policy '${value.id}' grantedTo`,\n    createError\n  )\n  assertStringArray(value.scopeGroupIds, `Membership policy '${value.id}' scope`, createError)\n  assertMembershipOperationArray(value.can, `Membership policy '${value.id}' can`, createError)\n}\n\nexport function isMembershipPolicyDefinition(value: unknown): value is MembershipPolicyDefinition {\n  try {\n    assertMembershipPolicyDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertGrantDefinition(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is GrantDefinition {\n  if (!isRecord(value) || value.kind !== \"grant\") {\n    throw createError(`[Sixb] ${field} must contain only grant definitions from 'can'.`)\n  }\n\n  if (!GRANT_CAPABILITIES.includes(value.capability as GrantCapability)) {\n    throw createError(\n      `[Sixb] ${field} grant capability must be ${formatAlternatives(GRANT_CAPABILITIES)}.`\n    )\n  }\n\n  if (value.capability === \"view\" && value.target !== \"object\" && value.target !== \"dataset\") {\n    throw createError(`[Sixb] ${field} view grant target must be 'object' or 'dataset'.`)\n  }\n\n  if (\n    value.capability === \"run\" &&\n    value.target !== \"workflow\" &&\n    value.target !== \"sync\" &&\n    value.target !== \"pipeline\" &&\n    value.target !== \"agent\"\n  ) {\n    throw createError(\n      `[Sixb] ${field} run grant target must be 'workflow', 'sync', 'pipeline', or 'agent'.`\n    )\n  }\n\n  if (value.capability === \"observe\" && value.target !== \"logs\" && value.target !== \"aiUsage\") {\n    throw createError(`[Sixb] ${field} observe grant target must be 'logs' or 'aiUsage'.`)\n  }\n\n  if (value.capability === \"manage\" && value.target !== \"connector\" && value.target !== \"aiUsage\") {\n    throw createError(`[Sixb] ${field} manage grant target must be 'connector' or 'aiUsage'.`)\n  }\n\n  // The agent, logs and AI usage are one surface each, so their grants select nothing. The checks\n  // above settled the capability and target, so the kind is known.\n  if (isSingletonGrantKind(grantKindOf(value as unknown as GrantDefinition))) {\n    if (value.selection !== undefined) {\n      throw createError(\n        `[Sixb] ${field} ${value.capability} grant on '${value.target}' must not declare a selection.`\n      )\n    }\n    return\n  }\n\n  assertSelection(value.selection, field, createError)\n}\n\nfunction assertSelection(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is Selection {\n  if (!isRecord(value) || typeof value.all !== \"boolean\") {\n    throw createError(`[Sixb] ${field} grant must carry a selection from 'can' or a scope.`)\n  }\n\n  const ids = value.all ? value.except : value.ids\n  if (!Array.isArray(ids)) {\n    throw createError(`[Sixb] ${field} grant selection must list ids.`)\n  }\n\n  for (const id of ids) {\n    assertNonEmptyString(id, `${field} grant selection id`, createError)\n  }\n}\n\nexport function assertRoleDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is RoleDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Role definition must be an object.\")\n  }\n\n  if (value.kind !== \"role\") {\n    throw createError(\"[Sixb] Role definition kind must be 'role'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Role id\", createError)\n  assertOptionalString(value.label, `Role '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Role '${value.id}' description`, createError)\n  assertStringArray(value.grantedToGroupIds, `Role '${value.id}' grantedTo`, createError)\n\n  if (!Array.isArray(value.grants)) {\n    throw createError(`[Sixb] Role '${value.id}' grants must be an array.`)\n  }\n\n  for (const grant of value.grants) {\n    assertGrantDefinition(grant, `Role '${value.id}' grants`, createError)\n  }\n\n  if (value.clearances !== undefined) {\n    assertStringArray(value.clearances, `Role '${value.id}' clearances`, createError)\n  }\n}\n\nexport function isRoleDefinition(value: unknown): value is RoleDefinition {\n  try {\n    assertRoleDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function validateSecurityDefinitionsAtStartup(input: {\n  readonly markings?: readonly MarkingDefinition[]\n  readonly groups: readonly GroupDefinition[]\n  readonly membershipPolicies: readonly MembershipPolicyDefinition[]\n  readonly roles?: readonly RoleDefinition[]\n  /** Registered object type ids — when provided, view grants must reference them. */\n  readonly objectTypeIds?: ReadonlySet<string>\n  /** Registered dataset ids — when provided, dataset view grants must reference them. */\n  readonly datasetIds?: ReadonlySet<string>\n  /** Registered action ids — when provided, apply grants must reference them. */\n  readonly actionIds?: ReadonlySet<string>\n  /** Registered workflow ids — when provided, run grants must reference them. */\n  readonly workflowIds?: ReadonlySet<string>\n  /** Registered sync ids — when provided, sync run grants must reference them. */\n  readonly syncIds?: ReadonlySet<string>\n  /** Registered pipeline ids — when provided, pipeline run grants must reference them. */\n  readonly pipelineIds?: ReadonlySet<string>\n  /** Whether the project's single conversational Agent is configured. */\n  readonly agentAvailable?: boolean\n  /** Registered connector ids — when provided, manage grants must reference them. */\n  readonly connectorIds?: ReadonlySet<string>\n  /** Registered Share ids — when provided, share grants must reference them. */\n  readonly shareIds?: ReadonlySet<string>\n}): RegisteredSecurityDefinitions {\n  const markingsById = new Map<string, MarkingDefinition>()\n  const groupsById = new Map<string, GroupDefinition>()\n  const rolesById = new Map<string, RoleDefinition>()\n  const membershipPoliciesById = new Map<string, MembershipPolicyDefinition>()\n\n  for (const marking of input.markings ?? []) {\n    assertMarkingDefinition(marking)\n\n    if (markingsById.has(marking.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate marking id: ${marking.id}`)\n    }\n\n    markingsById.set(marking.id, marking)\n  }\n\n  for (const group of input.groups) {\n    assertGroupDefinition(group)\n\n    if (groupsById.has(group.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate group id: ${group.id}`)\n    }\n\n    groupsById.set(group.id, group)\n  }\n\n  for (const role of input.roles ?? []) {\n    assertRoleDefinition(role)\n\n    if (rolesById.has(role.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate role id: ${role.id}`)\n    }\n\n    if (role.grantedToGroupIds.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${role.id}' must be granted to at least one group.`\n      )\n    }\n\n    const clearances = role.clearances ?? []\n    if (role.grants.length === 0 && clearances.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${role.id}' must declare at least one grant or clearance.`\n      )\n    }\n\n    assertNoDuplicateIds(role.grantedToGroupIds, `Role '${role.id}' grantedTo`)\n    assertNoDuplicateIds(clearances, `Role '${role.id}' clearances`)\n\n    for (const markingId of clearances) {\n      if (!markingsById.has(markingId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Role '${role.id}' clearances reference unknown marking '${markingId}'. Add it to 'security/markings/' or pass it to createSixb({ markings }).`\n        )\n      }\n    }\n\n    for (const groupId of role.grantedToGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Role '${role.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    for (const grant of role.grants) {\n      assertGrantReferences(role.id, grant, input)\n    }\n\n    rolesById.set(role.id, role)\n  }\n\n  for (const policy of input.membershipPolicies) {\n    assertMembershipPolicyDefinition(policy)\n\n    if (membershipPoliciesById.has(policy.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate membership policy id: ${policy.id}`)\n    }\n\n    if (policy.grantedToGroupIds.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Membership policy '${policy.id}' must grant membership authority to at least one group.`\n      )\n    }\n\n    if (policy.can.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Membership policy '${policy.id}' must declare at least one operation.`\n      )\n    }\n\n    assertNoDuplicateIds(policy.grantedToGroupIds, `Membership policy '${policy.id}' grantedTo`)\n    assertNoDuplicateIds(policy.scopeGroupIds, `Membership policy '${policy.id}' scope`)\n    assertNoDuplicateOperations(policy.can, `Membership policy '${policy.id}' can`)\n\n    for (const groupId of policy.grantedToGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Membership policy '${policy.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    for (const groupId of policy.scopeGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Membership policy '${policy.id}' scope references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    membershipPoliciesById.set(policy.id, policy)\n  }\n\n  return {\n    markings: [...markingsById.values()],\n    markingsById,\n    groups: [...groupsById.values()],\n    groupsById,\n    roles: [...rolesById.values()],\n    rolesById,\n    membershipPolicies: [...membershipPoliciesById.values()],\n    membershipPoliciesById,\n  }\n}\n\nfunction assertGrantReferences(\n  roleId: string,\n  grant: GrantDefinition,\n  registered: RegisteredUniverses\n): void {\n  if (grant.capability === \"run\" && grant.target === \"agent\") {\n    const spec = GRANT_KINDS[grantKindOf(grant)]\n    if (!registered.agentAvailable) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${roleId}' grants ${grant.capability} on the project Agent, but it is unavailable. ${spec.fix}`\n      )\n    }\n    return\n  }\n  // Logs and AI usage are always there; only targeted grants name ids to check.\n  if (!(\"selection\" in grant)) return\n  const kind = grantKindOf(grant)\n  if (isSingletonGrantKind(kind)) return\n  const spec = GRANT_KINDS[kind]\n  const universe = registered[spec.universeKey]\n\n  if (!universe) {\n    return\n  }\n\n  // Explicit selections list ids to include; \"all except\" selections list ids\n  // to exclude. Either way every named id must be registered — an unknown id is\n  // a typo that would silently widen or no-op the grant.\n  const ids = grant.selection.all ? grant.selection.except : grant.selection.ids\n\n  for (const id of ids) {\n    if (!universe.has(id)) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${roleId}' grants ${grant.capability} on unknown ${spec.subject} '${id}'. ${spec.fix}`\n      )\n    }\n  }\n}\n",
-    "import { SecurityValidationError } from \"./errors\"\nimport type {\n  GrantDefinition,\n  GroupDefinition,\n  MarkingDefinition,\n  MembershipOperation,\n  MembershipPolicyDefinition,\n  RoleDefinition,\n} from \"./types\"\nimport {\n  assertGrantDefinition,\n  assertNonEmptyString,\n  assertOptionalString,\n  isRecord,\n} from \"./validation\"\n\nexport interface DefineGroupOptions {\n  readonly label?: string\n  readonly description?: string\n}\n\nexport interface DefineMarkingOptions {\n  readonly label?: string\n  readonly description?: string\n}\n\nexport interface DefineRoleOptions {\n  readonly label?: string\n  readonly description?: string\n  readonly grantedTo: readonly GroupDefinition[]\n  readonly grants?: readonly GrantDefinition[]\n  /** Markings this role's members may read. */\n  readonly clearances?: readonly MarkingDefinition[]\n}\n\nexport interface DefineMembershipPolicyOptions {\n  readonly grantedTo: readonly GroupDefinition[]\n  readonly scope: readonly GroupDefinition[]\n  readonly can: readonly MembershipOperation[]\n}\n\nconst MEMBERSHIP_OPERATIONS = new Set<MembershipOperation>([\n  \"invite\",\n  \"assignGroups\",\n  \"suspend\",\n  \"serviceAccounts\",\n])\n\nfunction assertNonEmptyArray<T>(value: readonly T[], field: string): void {\n  if (value.length === 0) {\n    throw new SecurityValidationError(`[Sixb] ${field} must not be empty.`)\n  }\n}\n\nfunction groupIdsFrom(groups: readonly GroupDefinition[], field: string): readonly string[] {\n  return groups.map((group) => {\n    if (!isRecord(group) || group.kind !== \"group\") {\n      throw new SecurityValidationError(`[Sixb] ${field} must contain only group definitions.`)\n    }\n\n    assertNonEmptyString(group.id, `${field} group id`)\n    return group.id\n  })\n}\n\nfunction membershipOperationsFrom(\n  operations: readonly MembershipOperation[],\n  field: string\n): readonly MembershipOperation[] {\n  return operations.map((operation) => {\n    if (!MEMBERSHIP_OPERATIONS.has(operation)) {\n      throw new SecurityValidationError(\n        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`\n      )\n    }\n\n    return operation\n  })\n}\n\nexport function defineGroup<const TId extends string>(\n  id: TId,\n  options: DefineGroupOptions = {}\n): GroupDefinition<TId> {\n  assertNonEmptyString(id, \"Group id\")\n  assertOptionalString(options.label, `Group '${id}' label`)\n  assertOptionalString(options.description, `Group '${id}' description`)\n\n  return {\n    kind: \"group\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n  }\n}\n\n/** Read the ids of marking definitions, rejecting anything else such as a bare id. */\nexport function markingIdsFrom(\n  markings: readonly MarkingDefinition[],\n  field: string\n): readonly string[] {\n  return markings.map((marking) => {\n    if (!isRecord(marking) || marking.kind !== \"marking\") {\n      throw new SecurityValidationError(`[Sixb] ${field} must contain only marking definitions.`)\n    }\n\n    assertNonEmptyString(marking.id, `${field} marking id`)\n    return marking.id\n  })\n}\n\nexport function defineMarking<const TId extends string>(\n  id: TId,\n  options: DefineMarkingOptions = {}\n): MarkingDefinition<TId> {\n  assertNonEmptyString(id, \"Marking id\")\n  assertOptionalString(options.label, `Marking '${id}' label`)\n  assertOptionalString(options.description, `Marking '${id}' description`)\n\n  return {\n    kind: \"marking\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n  }\n}\n\nexport function defineRole<const TId extends string>(\n  id: TId,\n  options: DefineRoleOptions\n): RoleDefinition<TId> {\n  assertNonEmptyString(id, \"Role id\")\n  assertOptionalString(options.label, `Role '${id}' label`)\n  assertOptionalString(options.description, `Role '${id}' description`)\n  assertNonEmptyArray(options.grantedTo, `Role '${id}' grantedTo`)\n\n  const grantedToGroupIds = groupIdsFrom(options.grantedTo, `Role '${id}' grantedTo`)\n  const grants = options.grants ?? []\n  const clearances = markingIdsFrom(options.clearances ?? [], `Role '${id}' clearances`)\n\n  for (const grant of grants) {\n    assertGrantDefinition(grant, `Role '${id}' grants`)\n  }\n\n  if (grants.length === 0 && clearances.length === 0) {\n    throw new SecurityValidationError(\n      `[Sixb] Role '${id}' must declare at least one grant or clearance.`\n    )\n  }\n\n  return {\n    kind: \"role\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n    grantedToGroupIds,\n    grants,\n    ...(clearances.length > 0 ? { clearances } : {}),\n  }\n}\n\nexport function defineMembershipPolicy<const TId extends string>(\n  id: TId,\n  options: DefineMembershipPolicyOptions\n): MembershipPolicyDefinition<TId> {\n  assertNonEmptyString(id, \"Membership policy id\")\n  assertNonEmptyArray(options.grantedTo, `Membership policy '${id}' grantedTo`)\n  assertNonEmptyArray(options.can, `Membership policy '${id}' can`)\n\n  return {\n    kind: \"membershipPolicy\",\n    id,\n    grantedToGroupIds: groupIdsFrom(options.grantedTo, `Membership policy '${id}' grantedTo`),\n    scopeGroupIds: groupIdsFrom(options.scope, `Membership policy '${id}' scope`),\n    can: membershipOperationsFrom(options.can, `Membership policy '${id}' can`),\n  }\n}\n"
-  ],
-  "mappings": ";;;;;;;;AAAO,MAAM,iCAAgC,MAAM;AAAA,EACxC,OAAO;AAClB;;;ACUA,IAAM,wBAAwB,CAAC,UAAU,gBAAgB,WAAW,iBAAiB;AAE9E,SAAS,4BAA4B,CAAC,OAGnB;AAAA,EACxB,MAAM,eAAe,IAAI,IAAI,MAAM,cAAc;AAAA,EACjD,MAAM,YAAsB,CAAC;AAAA,EAC7B,MAAM,aAAa,2BAA2B;AAAA,EAE9C,WAAW,UAAU,MAAM,oBAAoB;AAAA,IAC7C,IAAI,CAAC,OAAO,kBAAkB,KAAK,CAAC,YAAY,aAAa,IAAI,OAAO,CAAC,GAAG;AAAA,MAC1E;AAAA,IACF;AAAA,IAEA,UAAU,KAAK,OAAO,EAAE;AAAA,IACxB,WAAW,aAAa,OAAO,KAAK;AAAA,MAClC,WAAW,WAAW,UAAU,KAAK,OAAO,EAAE;AAAA,MAC9C,WAAW,WAAW,OAAO,eAAe;AAAA,QAC1C,WAAW,WAAW,SAAS,IAAI,OAAO;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,YAAY;AAAA,MACV,QAAQ,qBAAqB,WAAW,MAAM;AAAA,MAC9C,cAAc,qBAAqB,WAAW,YAAY;AAAA,MAC1D,SAAS,qBAAqB,WAAW,OAAO;AAAA,MAChD,iBAAiB,qBAAqB,WAAW,eAAe;AAAA,IAClE;AAAA,EACF;AAAA;AAGK,SAAS,6BAA6B,CAC3C,OACA,WACA,UACS;AAAA,EACT,MAAM,iBAAiB,MAAM,WAAW;AAAA,EAExC,IAAI,eAAe,UAAU,WAAW,GAAG;AAAA,IACzC,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,SAAS,MAAM,CAAC,YAAY,eAAe,SAAS,IAAI,OAAO,CAAC;AAAA;AAGlE,SAAS,yBAAyB,CACvC,OACA,WACA,UACmB;AAAA,EACnB,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,OAAO,CAAC;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,MAAM,WAAW;AAAA,EACxC,OAAO,SAAS,OAAO,CAAC,YAAY,CAAC,eAAe,SAAS,IAAI,OAAO,CAAC;AAAA;AAG3E,SAAS,0BAA0B,GAGjC;AAAA,EACA,OAAO;AAAA,IACL,QAAQ,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IACrD,cAAc,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IAC3D,SAAS,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IACtD,iBAAiB,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,EAChE;AAAA;AAGF,SAAS,oBAAoB,CAAC,OAGD;AAAA,EAC3B,OAAO;AAAA,IACL,WAAW,CAAC,GAAG,MAAM,SAAS;AAAA,IAC9B,UAAU,IAAI,IAAI,MAAM,QAAQ;AAAA,EAClC;AAAA;AAGK,SAAS,qBAAqB,CAAC,OAA8C;AAAA,EAClF,OAAO,sBAAsB,SAAS,KAA4B;AAAA;;;ACrEpE,IAAM,qBAAqB,OAAO,KAAK;AAAA,EACrC,MAAM;AAAA,EACN,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AAAA,EACP,KAAK;AAAA,EACL,SAAS;AAAA,EACT,QAAQ;AACV,CAAyC;AAGzC,SAAS,kBAAkB,CAAC,QAAmC;AAAA,EAC7D,MAAM,SAAS,OAAO,IAAI,CAAC,UAAU,IAAI,QAAQ;AAAA,EACjD,MAAM,OAAO,OAAO,GAAG,EAAE;AAAA,EACzB,OAAO,OAAO,SAAS,IAAK,QAAQ,KAAM,GAAG,OAAO,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,SAAS;AAAA;AAO9E,SAAS,QAAQ,CAAC,OAAkD;AAAA,EACzE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA;AAGrE,SAAS,oBAAoB,CAClC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC1D;AAAA,EACzB,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAAA,IAC1D,MAAM,YAAY,UAAU,0BAA0B;AAAA,EACxD;AAAA;AAGK,SAAS,oBAAoB,CAClC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC9C;AAAA,EACrC,IAAI,UAAU,WAAW;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,MAAM,YAAY,UAAU,yBAAyB;AAAA,EACvD;AAAA;AAGF,SAAS,iBAAiB,CACxB,OACA,OACA,aACoC;AAAA,EACpC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzB,MAAM,YAAY,UAAU,sCAAsC;AAAA,EACpE;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,qBAAqB,MAAM,GAAG,cAAc,WAAW;AAAA,EACzD;AAAA;AAGF,SAAS,8BAA8B,CACrC,OACA,OACA,aACoD;AAAA,EACpD,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzB,MAAM,YAAY,UAAU,kDAAkD;AAAA,EAChF;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,CAAC,sBAAsB,IAAI,GAAG;AAAA,MAChC,MAAM,YACJ,UAAU,gGACZ;AAAA,IACF;AAAA,EACF;AAAA;AAGF,SAAS,oBAAoB,CAAC,KAAwB,OAAqB;AAAA,EACzE,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,KAAK,IAAI,EAAE,GAAG;AAAA,MAChB,MAAM,IAAI,yBAAwB,UAAU,sCAAsC,MAAM;AAAA,IAC1F;AAAA,IACA,KAAK,IAAI,EAAE;AAAA,EACb;AAAA;AAGF,SAAS,2BAA2B,CAClC,YACA,OACM;AAAA,EACN,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,aAAa,YAAY;AAAA,IAClC,IAAI,KAAK,IAAI,SAAS,GAAG;AAAA,MACvB,MAAM,IAAI,yBACR,UAAU,uCAAuC,aACnD;AAAA,IACF;AAAA,IACA,KAAK,IAAI,SAAS;AAAA,EACpB;AAAA;AAGK,SAAS,uBAAuB,CACrC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC/C;AAAA,EACpC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,8CAA8C;AAAA,EAClE;AAAA,EAEA,IAAI,MAAM,SAAS,WAAW;AAAA,IAC5B,MAAM,YAAY,mDAAmD;AAAA,EACvE;AAAA,EAEA,qBAAqB,MAAM,IAAI,cAAc,WAAW;AAAA,EACxD,qBAAqB,MAAM,OAAO,YAAY,MAAM,aAAa,WAAW;AAAA,EAC5E,qBAAqB,MAAM,aAAa,YAAY,MAAM,mBAAmB,WAAW;AAAA;AAGnF,SAAS,mBAAmB,CAAC,OAA4C;AAAA,EAC9E,IAAI;AAAA,IACF,wBAAwB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC9D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,qBAAqB,CACnC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACjD;AAAA,EAClC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,4CAA4C;AAAA,EAChE;AAAA,EAEA,IAAI,MAAM,SAAS,SAAS;AAAA,IAC1B,MAAM,YAAY,+CAA+C;AAAA,EACnE;AAAA,EAEA,qBAAqB,MAAM,IAAI,YAAY,WAAW;AAAA,EACtD,qBAAqB,MAAM,OAAO,UAAU,MAAM,aAAa,WAAW;AAAA,EAC1E,qBAAqB,MAAM,aAAa,UAAU,MAAM,mBAAmB,WAAW;AAAA;AAGjF,SAAS,iBAAiB,CAAC,OAA0C;AAAA,EAC1E,IAAI;AAAA,IACF,sBAAsB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC5D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,gCAAgC,CAC9C,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACtC;AAAA,EAC7C,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,wDAAwD;AAAA,EAC5E;AAAA,EAEA,IAAI,MAAM,SAAS,oBAAoB;AAAA,IACrC,MAAM,YAAY,sEAAsE;AAAA,EAC1F;AAAA,EAEA,qBAAqB,MAAM,IAAI,wBAAwB,WAAW;AAAA,EAClE,kBACE,MAAM,mBACN,sBAAsB,MAAM,iBAC5B,WACF;AAAA,EACA,kBAAkB,MAAM,eAAe,sBAAsB,MAAM,aAAa,WAAW;AAAA,EAC3F,+BAA+B,MAAM,KAAK,sBAAsB,MAAM,WAAW,WAAW;AAAA;AAGvF,SAAS,4BAA4B,CAAC,OAAqD;AAAA,EAChG,IAAI;AAAA,IACF,iCAAiC,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IACvE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,qBAAqB,CACnC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACjD;AAAA,EAClC,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS;AAAA,IAC9C,MAAM,YAAY,UAAU,uDAAuD;AAAA,EACrF;AAAA,EAEA,IAAI,CAAC,mBAAmB,SAAS,MAAM,UAA6B,GAAG;AAAA,IACrE,MAAM,YACJ,UAAU,kCAAkC,mBAAmB,kBAAkB,IACnF;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,eAAe,UAAU,MAAM,WAAW,YAAY,MAAM,WAAW,WAAW;AAAA,IAC1F,MAAM,YAAY,UAAU,wDAAwD;AAAA,EACtF;AAAA,EAEA,IACE,MAAM,eAAe,SACrB,MAAM,WAAW,cACjB,MAAM,WAAW,UACjB,MAAM,WAAW,cACjB,MAAM,WAAW,SACjB;AAAA,IACA,MAAM,YACJ,UAAU,4EACZ;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,eAAe,aAAa,MAAM,WAAW,UAAU,MAAM,WAAW,WAAW;AAAA,IAC3F,MAAM,YAAY,UAAU,yDAAyD;AAAA,EACvF;AAAA,EAEA,IAAI,MAAM,eAAe,YAAY,MAAM,WAAW,eAAe,MAAM,WAAW,WAAW;AAAA,IAC/F,MAAM,YAAY,UAAU,6DAA6D;AAAA,EAC3F;AAAA,EAIA,IAAI,qBAAqB,YAAY,KAAmC,CAAC,GAAG;AAAA,IAC1E,IAAI,MAAM,cAAc,WAAW;AAAA,MACjC,MAAM,YACJ,UAAU,SAAS,MAAM,wBAAwB,MAAM,uCACzD;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,gBAAgB,MAAM,WAAW,OAAO,WAAW;AAAA;AAGrD,SAAS,eAAe,CACtB,OACA,OACA,aAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,KAAK,KAAK,OAAO,MAAM,QAAQ,WAAW;AAAA,IACtD,MAAM,YAAY,UAAU,2DAA2D;AAAA,EACzF;AAAA,EAEA,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,MAAM;AAAA,EAC7C,IAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AAAA,IACvB,MAAM,YAAY,UAAU,sCAAsC;AAAA,EACpE;AAAA,EAEA,WAAW,MAAM,KAAK;AAAA,IACpB,qBAAqB,IAAI,GAAG,4BAA4B,WAAW;AAAA,EACrE;AAAA;AAGK,SAAS,oBAAoB,CAClC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAClD;AAAA,EACjC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,2CAA2C;AAAA,EAC/D;AAAA,EAEA,IAAI,MAAM,SAAS,QAAQ;AAAA,IACzB,MAAM,YAAY,6CAA6C;AAAA,EACjE;AAAA,EAEA,qBAAqB,MAAM,IAAI,WAAW,WAAW;AAAA,EACrD,qBAAqB,MAAM,OAAO,SAAS,MAAM,aAAa,WAAW;AAAA,EACzE,qBAAqB,MAAM,aAAa,SAAS,MAAM,mBAAmB,WAAW;AAAA,EACrF,kBAAkB,MAAM,mBAAmB,SAAS,MAAM,iBAAiB,WAAW;AAAA,EAEtF,IAAI,CAAC,MAAM,QAAQ,MAAM,MAAM,GAAG;AAAA,IAChC,MAAM,YAAY,gBAAgB,MAAM,8BAA8B;AAAA,EACxE;AAAA,EAEA,WAAW,SAAS,MAAM,QAAQ;AAAA,IAChC,sBAAsB,OAAO,SAAS,MAAM,cAAc,WAAW;AAAA,EACvE;AAAA,EAEA,IAAI,MAAM,eAAe,WAAW;AAAA,IAClC,kBAAkB,MAAM,YAAY,SAAS,MAAM,kBAAkB,WAAW;AAAA,EAClF;AAAA;AAGK,SAAS,gBAAgB,CAAC,OAAyC;AAAA,EACxE,IAAI;AAAA,IACF,qBAAqB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC3D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,oCAAoC,CAAC,OAuBnB;AAAA,EAChC,MAAM,eAAe,IAAI;AAAA,EACzB,MAAM,aAAa,IAAI;AAAA,EACvB,MAAM,YAAY,IAAI;AAAA,EACtB,MAAM,yBAAyB,IAAI;AAAA,EAEnC,WAAW,WAAW,MAAM,YAAY,CAAC,GAAG;AAAA,IAC1C,wBAAwB,OAAO;AAAA,IAE/B,IAAI,aAAa,IAAI,QAAQ,EAAE,GAAG;AAAA,MAChC,MAAM,IAAI,yBAAwB,gCAAgC,QAAQ,IAAI;AAAA,IAChF;AAAA,IAEA,aAAa,IAAI,QAAQ,IAAI,OAAO;AAAA,EACtC;AAAA,EAEA,WAAW,SAAS,MAAM,QAAQ;AAAA,IAChC,sBAAsB,KAAK;AAAA,IAE3B,IAAI,WAAW,IAAI,MAAM,EAAE,GAAG;AAAA,MAC5B,MAAM,IAAI,yBAAwB,8BAA8B,MAAM,IAAI;AAAA,IAC5E;AAAA,IAEA,WAAW,IAAI,MAAM,IAAI,KAAK;AAAA,EAChC;AAAA,EAEA,WAAW,QAAQ,MAAM,SAAS,CAAC,GAAG;AAAA,IACpC,qBAAqB,IAAI;AAAA,IAEzB,IAAI,UAAU,IAAI,KAAK,EAAE,GAAG;AAAA,MAC1B,MAAM,IAAI,yBAAwB,6BAA6B,KAAK,IAAI;AAAA,IAC1E;AAAA,IAEA,IAAI,KAAK,kBAAkB,WAAW,GAAG;AAAA,MACvC,MAAM,IAAI,yBACR,gBAAgB,KAAK,4CACvB;AAAA,IACF;AAAA,IAEA,MAAM,aAAa,KAAK,cAAc,CAAC;AAAA,IACvC,IAAI,KAAK,OAAO,WAAW,KAAK,WAAW,WAAW,GAAG;AAAA,MACvD,MAAM,IAAI,yBACR,gBAAgB,KAAK,mDACvB;AAAA,IACF;AAAA,IAEA,qBAAqB,KAAK,mBAAmB,SAAS,KAAK,eAAe;AAAA,IAC1E,qBAAqB,YAAY,SAAS,KAAK,gBAAgB;AAAA,IAE/D,WAAW,aAAa,YAAY;AAAA,MAClC,IAAI,CAAC,aAAa,IAAI,SAAS,GAAG;AAAA,QAChC,MAAM,IAAI,yBACR,gBAAgB,KAAK,6CAA6C,oFACpE;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,WAAW,KAAK,mBAAmB;AAAA,MAC5C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,gBAAgB,KAAK,2CAA2C,8EAClE;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,SAAS,KAAK,QAAQ;AAAA,MAC/B,sBAAsB,KAAK,IAAI,OAAO,KAAK;AAAA,IAC7C;AAAA,IAEA,UAAU,IAAI,KAAK,IAAI,IAAI;AAAA,EAC7B;AAAA,EAEA,WAAW,UAAU,MAAM,oBAAoB;AAAA,IAC7C,iCAAiC,MAAM;AAAA,IAEvC,IAAI,uBAAuB,IAAI,OAAO,EAAE,GAAG;AAAA,MACzC,MAAM,IAAI,yBAAwB,0CAA0C,OAAO,IAAI;AAAA,IACzF;AAAA,IAEA,IAAI,OAAO,kBAAkB,WAAW,GAAG;AAAA,MACzC,MAAM,IAAI,yBACR,6BAA6B,OAAO,4DACtC;AAAA,IACF;AAAA,IAEA,IAAI,OAAO,IAAI,WAAW,GAAG;AAAA,MAC3B,MAAM,IAAI,yBACR,6BAA6B,OAAO,0CACtC;AAAA,IACF;AAAA,IAEA,qBAAqB,OAAO,mBAAmB,sBAAsB,OAAO,eAAe;AAAA,IAC3F,qBAAqB,OAAO,eAAe,sBAAsB,OAAO,WAAW;AAAA,IACnF,4BAA4B,OAAO,KAAK,sBAAsB,OAAO,SAAS;AAAA,IAE9E,WAAW,WAAW,OAAO,mBAAmB;AAAA,MAC9C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,6BAA6B,OAAO,2CAA2C,8EACjF;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,WAAW,OAAO,eAAe;AAAA,MAC1C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,6BAA6B,OAAO,uCAAuC,8EAC7E;AAAA,MACF;AAAA,IACF;AAAA,IAEA,uBAAuB,IAAI,OAAO,IAAI,MAAM;AAAA,EAC9C;AAAA,EAEA,OAAO;AAAA,IACL,UAAU,CAAC,GAAG,aAAa,OAAO,CAAC;AAAA,IACnC;AAAA,IACA,QAAQ,CAAC,GAAG,WAAW,OAAO,CAAC;AAAA,IAC/B;AAAA,IACA,OAAO,CAAC,GAAG,UAAU,OAAO,CAAC;AAAA,IAC7B;AAAA,IACA,oBAAoB,CAAC,GAAG,uBAAuB,OAAO,CAAC;AAAA,IACvD;AAAA,EACF;AAAA;AAGF,SAAS,qBAAqB,CAC5B,QACA,OACA,YACM;AAAA,EACN,IAAI,MAAM,eAAe,SAAS,MAAM,WAAW,SAAS;AAAA,IAC1D,MAAM,OAAO,YAAY,YAAY,KAAK;AAAA,IAC1C,IAAI,CAAC,WAAW,gBAAgB;AAAA,MAC9B,MAAM,IAAI,yBACR,gBAAgB,kBAAkB,MAAM,2DAA2D,KAAK,KAC1G;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,IAAI,EAAE,eAAe;AAAA,IAAQ;AAAA,EAC7B,MAAM,OAAO,YAAY,KAAK;AAAA,EAC9B,IAAI,qBAAqB,IAAI;AAAA,IAAG;AAAA,EAChC,MAAM,OAAO,YAAY;AAAA,EACzB,MAAM,WAAW,WAAW,KAAK;AAAA,EAEjC,IAAI,CAAC,UAAU;AAAA,IACb;AAAA,EACF;AAAA,EAKA,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM,UAAU,SAAS,MAAM,UAAU;AAAA,EAE3E,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,CAAC,SAAS,IAAI,EAAE,GAAG;AAAA,MACrB,MAAM,IAAI,yBACR,gBAAgB,kBAAkB,MAAM,yBAAyB,KAAK,YAAY,QAAQ,KAAK,KACjG;AAAA,IACF;AAAA,EACF;AAAA;;;AC7dF,IAAM,yBAAwB,IAAI,IAAyB;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,mBAAsB,CAAC,OAAqB,OAAqB;AAAA,EACxE,IAAI,MAAM,WAAW,GAAG;AAAA,IACtB,MAAM,IAAI,yBAAwB,UAAU,0BAA0B;AAAA,EACxE;AAAA;AAGF,SAAS,YAAY,CAAC,QAAoC,OAAkC;AAAA,EAC1F,OAAO,OAAO,IAAI,CAAC,UAAU;AAAA,IAC3B,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS;AAAA,MAC9C,MAAM,IAAI,yBAAwB,UAAU,4CAA4C;AAAA,IAC1F;AAAA,IAEA,qBAAqB,MAAM,IAAI,GAAG,gBAAgB;AAAA,IAClD,OAAO,MAAM;AAAA,GACd;AAAA;AAGH,SAAS,wBAAwB,CAC/B,YACA,OACgC;AAAA,EAChC,OAAO,WAAW,IAAI,CAAC,cAAc;AAAA,IACnC,IAAI,CAAC,uBAAsB,IAAI,SAAS,GAAG;AAAA,MACzC,MAAM,IAAI,yBACR,UAAU,gGACZ;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,GACR;AAAA;AAGI,SAAS,YAAqC,CACnD,IACA,UAA8B,CAAC,GACT;AAAA,EACtB,qBAAqB,IAAI,UAAU;AAAA,EACnC,qBAAqB,QAAQ,OAAO,UAAU,WAAW;AAAA,EACzD,qBAAqB,QAAQ,aAAa,UAAU,iBAAiB;AAAA,EAErE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EAClF;AAAA;AAIK,SAAS,cAAc,CAC5B,UACA,OACmB;AAAA,EACnB,OAAO,SAAS,IAAI,CAAC,YAAY;AAAA,IAC/B,IAAI,CAAC,SAAS,OAAO,KAAK,QAAQ,SAAS,WAAW;AAAA,MACpD,MAAM,IAAI,yBAAwB,UAAU,8CAA8C;AAAA,IAC5F;AAAA,IAEA,qBAAqB,QAAQ,IAAI,GAAG,kBAAkB;AAAA,IACtD,OAAO,QAAQ;AAAA,GAChB;AAAA;AAGI,SAAS,cAAuC,CACrD,IACA,UAAgC,CAAC,GACT;AAAA,EACxB,qBAAqB,IAAI,YAAY;AAAA,EACrC,qBAAqB,QAAQ,OAAO,YAAY,WAAW;AAAA,EAC3D,qBAAqB,QAAQ,aAAa,YAAY,iBAAiB;AAAA,EAEvE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EAClF;AAAA;AAGK,SAAS,WAAoC,CAClD,IACA,SACqB;AAAA,EACrB,qBAAqB,IAAI,SAAS;AAAA,EAClC,qBAAqB,QAAQ,OAAO,SAAS,WAAW;AAAA,EACxD,qBAAqB,QAAQ,aAAa,SAAS,iBAAiB;AAAA,EACpE,oBAAoB,QAAQ,WAAW,SAAS,eAAe;AAAA,EAE/D,MAAM,oBAAoB,aAAa,QAAQ,WAAW,SAAS,eAAe;AAAA,EAClF,MAAM,SAAS,QAAQ,UAAU,CAAC;AAAA,EAClC,MAAM,aAAa,eAAe,QAAQ,cAAc,CAAC,GAAG,SAAS,gBAAgB;AAAA,EAErF,WAAW,SAAS,QAAQ;AAAA,IAC1B,sBAAsB,OAAO,SAAS,YAAY;AAAA,EACpD;AAAA,EAEA,IAAI,OAAO,WAAW,KAAK,WAAW,WAAW,GAAG;AAAA,IAClD,MAAM,IAAI,yBACR,gBAAgB,mDAClB;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,IAChF;AAAA,IACA;AAAA,OACI,WAAW,SAAS,IAAI,EAAE,WAAW,IAAI,CAAC;AAAA,EAChD;AAAA;AAGK,SAAS,uBAAgD,CAC9D,IACA,SACiC;AAAA,EACjC,qBAAqB,IAAI,sBAAsB;AAAA,EAC/C,oBAAoB,QAAQ,WAAW,sBAAsB,eAAe;AAAA,EAC5E,oBAAoB,QAAQ,KAAK,sBAAsB,SAAS;AAAA,EAEhE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,mBAAmB,aAAa,QAAQ,WAAW,sBAAsB,eAAe;AAAA,IACxF,eAAe,aAAa,QAAQ,OAAO,sBAAsB,WAAW;AAAA,IAC5E,KAAK,yBAAyB,QAAQ,KAAK,sBAAsB,SAAS;AAAA,EAC5E;AAAA;",
-  "debugId": "5079B2E8C73E746064756E2164756E21",
-  "names": []
-}

package/dist/chunk-gsjm1wms.js.map

@@ -1,10 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/authorization/grant-kinds.ts"],
-  "sourcesContent": [
-    "/**\n * Grant kinds: the single source of truth for the (capability, target) space.\n *\n * Every grant collapses to one `GrantKind` discriminant — the same\n * `capability:target` string the decision engine uses as a grant key (e.g.\n * `view:object`, `run:sync`). Resolution, validation, enforcement, and the\n * resolved `GrantIndex` all key off it, so adding a grant family is a single\n * entry in `GRANT_KINDS` plus the compile errors that forces at every consumer.\n */\n\nimport type { GrantDefinition } from \"../security/types\"\n\nexport type GrantKind =\n  | \"view:object\"\n  | \"view:dataset\"\n  | \"edit:object\"\n  | \"append:telemetry\"\n  | \"apply:action\"\n  | \"share:share\"\n  | \"run:workflow\"\n  | \"run:sync\"\n  | \"run:pipeline\"\n  | \"run:agent\"\n  | \"observe:logs\"\n  | \"observe:aiUsage\"\n  | \"manage:connector\"\n  | \"manage:aiUsage\"\n\n/** Capabilities over one project-wide surface: held or not, with no ids to select. */\nexport type SingletonGrantKind = \"run:agent\" | \"observe:logs\" | \"observe:aiUsage\" | \"manage:aiUsage\"\nexport type TargetedGrantKind = Exclude<GrantKind, SingletonGrantKind>\n\n/** Registered id universes a grant kind ranges over, plus subtype expansion. */\nexport interface GrantUniverse {\n  readonly objectTypeIds: ReadonlySet<string>\n  readonly datasetIds: ReadonlySet<string>\n  readonly actionIds: ReadonlySet<string>\n  readonly shareIds: ReadonlySet<string>\n  readonly workflowIds: ReadonlySet<string>\n  readonly syncIds: ReadonlySet<string>\n  readonly pipelineIds: ReadonlySet<string>\n  readonly connectorIds: ReadonlySet<string>\n  readonly getSubTypes: (objectTypeId: string) => readonly string[]\n}\n\n/** The registered-id sets a grant kind validates against (no subtype hook). */\nexport type GrantUniverseKey = Exclude<keyof GrantUniverse, \"getSubTypes\">\n\ninterface TargetedGrantKindSpec {\n  /** Registered universe the grant's ids must belong to. */\n  readonly universeKey: GrantUniverseKey\n  /** Subject noun used in validation errors (\"unknown <subject> '<id>'\"). */\n  readonly subject: string\n  /** Actionable hint appended to the \"unknown <subject>\" error. */\n  readonly fix: string\n  /** Only object-type grants also expand to subtypes. */\n  readonly expandsSubtypes?: true\n}\n\ninterface SingletonGrantKindSpec {\n  /** Project-wide capability with no resource selection; resolves to a boolean. */\n  readonly singleton: true\n  readonly subject: string\n  readonly fix: string\n}\n\n/**\n * The exhaustive grant-kind table. A new grant family is one entry here; the\n * mapped type makes every omission a compile error.\n */\nexport const GRANT_KINDS: {\n  readonly [TKind in GrantKind]: TKind extends SingletonGrantKind\n    ? SingletonGrantKindSpec\n    : TargetedGrantKindSpec\n} = {\n  \"view:object\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n    expandsSubtypes: true,\n  },\n  \"view:dataset\": {\n    universeKey: \"datasetIds\",\n    subject: \"dataset\",\n    fix: \"Add it to 'datasets/' or pass it to createSixb({ datasets }).\",\n  },\n  // Deliberately no `expandsSubtypes`: granting writes on a parent type must not\n  // silently extend to types added under it later. `view:object` expands because\n  // a read of a subtype reveals nothing the parent's grant did not already cover.\n  \"edit:object\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n  },\n  \"append:telemetry\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n  },\n  \"apply:action\": {\n    universeKey: \"actionIds\",\n    subject: \"action\",\n    fix: \"Add it to 'actions/' or pass it to createSixb({ actions }).\",\n  },\n  \"share:share\": {\n    universeKey: \"shareIds\",\n    subject: \"share\",\n    fix: \"Add it to 'shares/' or pass it to createSixb({ shares }).\",\n  },\n  \"run:workflow\": {\n    universeKey: \"workflowIds\",\n    subject: \"workflow\",\n    fix: \"Add it to 'workflows/' or pass it to createSixb({ workflows }).\",\n  },\n  \"run:sync\": {\n    universeKey: \"syncIds\",\n    subject: \"sync\",\n    fix: \"Add it to 'syncs/' or pass it to createSixb({ syncs }).\",\n  },\n  \"run:pipeline\": {\n    universeKey: \"pipelineIds\",\n    subject: \"pipeline\",\n    fix: \"Add it to 'pipelines/' or pass it to createSixb({ pipelines }).\",\n  },\n  \"run:agent\": {\n    singleton: true,\n    subject: \"agent\",\n    fix: \"Configure models.language and use the exported agent reference in can.run(agent).\",\n  },\n  \"observe:logs\": {\n    singleton: true,\n    subject: \"logs\",\n    fix: 'Use can.observe(\"logs\").',\n  },\n  \"observe:aiUsage\": {\n    singleton: true,\n    subject: \"AI usage\",\n    fix: \"Use can.observe(agent.usage).\",\n  },\n  \"manage:connector\": {\n    universeKey: \"connectorIds\",\n    subject: \"connector\",\n    fix: \"Add it to 'connectors/' or pass it to createSixb({ connectors }).\",\n  },\n  \"manage:aiUsage\": {\n    singleton: true,\n    subject: \"AI usage\",\n    fix: \"Use can.manage(agent.usage).\",\n  },\n}\n\nexport const GRANT_KIND_KEYS = Object.keys(GRANT_KINDS) as readonly GrantKind[]\nexport const SINGLETON_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter(\n  (kind): kind is SingletonGrantKind => \"singleton\" in GRANT_KINDS[kind]\n)\nexport const TARGETED_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter(\n  (kind): kind is TargetedGrantKind => !(\"singleton\" in GRANT_KINDS[kind])\n)\n\nexport function isSingletonGrantKind(kind: GrantKind): kind is SingletonGrantKind {\n  return \"singleton\" in GRANT_KINDS[kind]\n}\n\n/** The grant kind a stored grant resolves to. */\nexport function grantKindOf(grant: GrantDefinition): GrantKind {\n  switch (grant.capability) {\n    case \"view\":\n      return `view:${grant.target}`\n    case \"edit\":\n      return \"edit:object\"\n    case \"append\":\n      return \"append:telemetry\"\n    case \"apply\":\n      return \"apply:action\"\n    case \"share\":\n      return \"share:share\"\n    case \"run\":\n      return `run:${grant.target}`\n    case \"observe\":\n      return `observe:${grant.target}`\n    case \"manage\":\n      return `manage:${grant.target}`\n  }\n}\n\n/** Mutable grant index: booleans for singleton capabilities, id sets for selected resources. */\nexport type MutableGrantIndex = {\n  [TKind in GrantKind]: TKind extends SingletonGrantKind ? boolean : Set<string>\n}\n\nexport function emptyGrantSets(): MutableGrantIndex {\n  return {\n    \"view:object\": new Set(),\n    \"view:dataset\": new Set(),\n    \"edit:object\": new Set(),\n    \"append:telemetry\": new Set(),\n    \"apply:action\": new Set(),\n    \"share:share\": new Set(),\n    \"run:workflow\": new Set(),\n    \"run:sync\": new Set(),\n    \"run:pipeline\": new Set(),\n    \"run:agent\": false,\n    \"observe:logs\": false,\n    \"observe:aiUsage\": false,\n    \"manage:connector\": new Set(),\n    \"manage:aiUsage\": false,\n  }\n}\n"
-  ],
-  "mappings": ";;AAsEO,IAAM,cAIT;AAAA,EACF,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,IACL,iBAAiB;AAAA,EACnB;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EAIA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,YAAY;AAAA,IACV,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,aAAa;AAAA,IACX,WAAW;AAAA,IACX,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,WAAW;AAAA,IACX,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,mBAAmB;AAAA,IACjB,WAAW;AAAA,IACX,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,kBAAkB;AAAA,IAChB,WAAW;AAAA,IACX,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AACF;AAEO,IAAM,kBAAkB,OAAO,KAAK,WAAW;AAC/C,IAAM,4BAA4B,gBAAgB,OACvD,CAAC,UAAqC,eAAe,YAAY,MACnE;AACO,IAAM,2BAA2B,gBAAgB,OACtD,CAAC,SAAoC,EAAE,eAAe,YAAY,MACpE;AAEO,SAAS,oBAAoB,CAAC,MAA6C;AAAA,EAChF,OAAO,eAAe,YAAY;AAAA;AAI7B,SAAS,WAAW,CAAC,OAAmC;AAAA,EAC7D,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO,QAAQ,MAAM;AAAA,SAClB;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO,OAAO,MAAM;AAAA,SACjB;AAAA,MACH,OAAO,WAAW,MAAM;AAAA,SACrB;AAAA,MACH,OAAO,UAAU,MAAM;AAAA;AAAA;AAStB,SAAS,cAAc,GAAsB;AAAA,EAClD,OAAO;AAAA,IACL,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,eAAe,IAAI;AAAA,IACnB,oBAAoB,IAAI;AAAA,IACxB,gBAAgB,IAAI;AAAA,IACpB,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,YAAY,IAAI;AAAA,IAChB,gBAAgB,IAAI;AAAA,IACpB,aAAa;AAAA,IACb,gBAAgB;AAAA,IAChB,mBAAmB;AAAA,IACnB,oBAAoB,IAAI;AAAA,IACxB,kBAAkB;AAAA,EACpB;AAAA;",
-  "debugId": "1C6F3FFB2BACAB1F64756E2164756E21",
-  "names": []
-}