@sixb/core 0.1.20 → 0.1.22

package/src/testing/webhook-execution.ts

@@ -3,7 +3,7 @@ import type { StartWebhookRunInput, Storage, WebhookRunRecord } from "../storage
 import type { ExecutionStorage } from "../storage/executions"
 
 /** Create the durable execution required by a Webhook-run storage fixture. */
-export async function createTestWebhookExecution(
+async function createTestWebhookExecution(
   executions: ExecutionStorage,
   input: {
     readonly projectId: string

package/src/testing/webhook-run-storage-contract.ts

@@ -129,23 +129,20 @@ export function runWebhookRunStorageContractSuite<
         await expect(
           storage.webhookRuns.restart({ projectId, id: started.id })
         ).rejects.toMatchObject({ code: "invalid_transition" })
-      })
-    })
 
-    test("does not reopen a terminal client rejection", async () => {
-      await withStorage(async (storage) => {
-        const run = await startTestWebhookRun(storage, runInput("delivery-rejected"))
+        // A terminal client rejection is not reopened either.
+        const rejected = await startTestWebhookRun(storage, runInput("delivery-rejected"))
         await storage.webhookRuns.finish({
           projectId,
-          id: run.id,
+          id: rejected.id,
           status: "failed",
           finishedAt,
           responseStatus: 422,
           error: rejectedFailure,
         })
-        await expect(storage.webhookRuns.restart({ projectId, id: run.id })).rejects.toMatchObject({
-          code: "invalid_transition",
-        })
+        await expect(
+          storage.webhookRuns.restart({ projectId, id: rejected.id })
+        ).rejects.toMatchObject({ code: "invalid_transition" })
       })
     })
 

package/src/users/execution.ts

@@ -0,0 +1,131 @@
+import { assertAuthorized } from "../authorization"
+import { isUserRef, type UserRef } from "../ontology/user-ref"
+import type { SixbRuntimeContext } from "../runtime/types"
+import type { UserRecord, UserStatus } from "../storage"
+
+const DEFAULT_LIMIT = 50
+const MAX_LIMIT = 200
+const MAX_SEARCH_LENGTH = 200
+
+/** A member as the directory shows them. Read from auth storage, never from what a writer stored. */
+export interface UserProfile {
+  readonly id: string
+  readonly email: string
+  readonly displayName?: string
+  readonly avatarUrl?: string
+  readonly status: UserStatus
+}
+
+export interface ListUsersInput {
+  /** Which members to list. Defaults to `"active"`. */
+  readonly status?: UserStatus | "all"
+  /**
+   * Keep members whose display name or email contains this text, ignoring case. At most 200
+   * characters.
+   */
+  readonly search?: string
+  /** From 1 to 200. Defaults to 50. */
+  readonly limit?: number
+  readonly offset?: number
+}
+
+/** One page of members, oldest first. */
+export interface UsersPage {
+  readonly users: readonly UserProfile[]
+  readonly hasMore: boolean
+  /** Every member matching the filters, across all pages. */
+  readonly total: number
+}
+
+/** The project's member directory. Reading it requires `can.view(project.users)`. */
+export interface UsersRuntime {
+  /** The member's profile, suspended or not, or `null` when no member has this id. */
+  get(user: UserRef): Promise<UserProfile | null>
+  list(input?: ListUsersInput): Promise<UsersPage>
+}
+
+export function createUsersRuntime(runtime: SixbRuntimeContext): UsersRuntime {
+  const assertReadable = () => assertAuthorized(runtime, { kind: "users.view" })
+
+  return {
+    get: async (user) => {
+      assertReadable()
+
+      if (!isUserRef(user)) {
+        throw new Error("[Sixb] users.get expects a user reference, such as userRef(id).")
+      }
+
+      const users = runtime.storage.auth?.users
+      if (!users) return null
+
+      const record = await users.getById({ projectId: runtime.projectId, id: user.id })
+      return record ? toUserProfile(record) : null
+    },
+
+    list: async (input = {}) => {
+      assertReadable()
+
+      const limit = listLimit(input.limit)
+      const offset = listOffset(input.offset)
+      const search = listSearch(input.search)
+
+      const users = runtime.storage.auth?.users
+      if (!users) return { users: [], hasMore: false, total: 0 }
+
+      const page = await users.list({
+        projectId: runtime.projectId,
+        ...statusFilter(input.status),
+        ...(search === undefined ? {} : { search }),
+        limit,
+        offset,
+        order: "asc",
+      })
+
+      return {
+        users: page.users.map(toUserProfile),
+        hasMore: page.hasMore,
+        total: page.total,
+      }
+    },
+  }
+}
+
+/** Only the fields the directory shows: no project id, no timestamps. */
+export function toUserProfile(record: UserRecord): UserProfile {
+  return {
+    id: record.id,
+    email: record.email,
+    ...(record.displayName === undefined ? {} : { displayName: record.displayName }),
+    ...(record.avatarUrl === undefined ? {} : { avatarUrl: record.avatarUrl }),
+    status: record.status,
+  }
+}
+
+function statusFilter(status: ListUsersInput["status"] = "active") {
+  if (status === "all") return {}
+  if (status === "active" || status === "suspended") return { statuses: [status] }
+
+  throw new Error(`[Sixb] users.list status must be "active", "suspended", or "all".`)
+}
+
+function listSearch(search: string | undefined): string | undefined {
+  const trimmed = search?.trim()
+  if (!trimmed) return undefined
+  if (trimmed.length <= MAX_SEARCH_LENGTH) return trimmed
+
+  throw new Error(`[Sixb] users.list search must be at most ${MAX_SEARCH_LENGTH} characters.`)
+}
+
+function listLimit(limit: number | undefined): number {
+  if (limit === undefined) return DEFAULT_LIMIT
+  if (Number.isInteger(limit) && limit >= 1 && limit <= MAX_LIMIT) return limit
+
+  throw new Error(`[Sixb] users.list limit must be an integer from 1 to ${MAX_LIMIT}.`)
+}
+
+function listOffset(offset: number | undefined): number {
+  if (offset === undefined) return 0
+  if (Number.isInteger(offset) && offset >= 0) return offset
+
+  throw new Error("[Sixb] users.list offset must be a non-negative integer.")
+}

package/src/users/index.ts

@@ -0,0 +1,2 @@
+export type { ListUsersInput, UserProfile, UsersPage, UsersRuntime } from "./execution"
+export { createUsersRuntime } from "./execution"

package/src/workers/queue-worker.ts

@@ -55,8 +55,6 @@ export abstract class QueueWorker<
   TFailureCodes extends QueueWorkerFailureCodes,
 > extends Worker {
   protected readonly config: Required<QueueWorkerConfig<TJob, TFailureCodes>>
-  /** Pause after a failed claim. Overridable so tests do not wait out real backoffs. */
-  protected readonly claimFailureDelayMs: number = CLAIM_FAILURE_DELAY_MS
   private consecutiveClaimFailures = 0
 
   constructor(config: QueueWorkerConfig<TJob, TFailureCodes>) {
@@ -168,7 +166,7 @@ export abstract class QueueWorker<
           { cause: error }
         )
       }
-      await sleep(this.claimFailureDelayMs, signal).catch(() => {})
+      await sleep(CLAIM_FAILURE_DELAY_MS, signal).catch(() => {})
       return []
     }
   }

package/src/workers/worker.ts

@@ -9,8 +9,6 @@ const STABLE_RUN_MS = 60_000
 
 /** Base worker lifecycle with bounded restart supervision. */
 export abstract class Worker {
-  /** Base restart backoff. Overridable so budget-exhaustion tests do not wait out real backoffs. */
-  protected readonly restartBackoffMs: number = RESTART_BACKOFF_MS
   private controller: AbortController | null = null
   private running: Promise<void> | null = null
 
@@ -66,7 +64,7 @@ export abstract class Worker {
         throw new WorkerUnhealthyError(this.constructor.name, restartCount, { cause: failure })
       }
 
-      const delayMs = Math.min(this.restartBackoffMs * 2 ** restartCount, MAX_RESTART_BACKOFF_MS)
+      const delayMs = Math.min(RESTART_BACKOFF_MS * 2 ** restartCount, MAX_RESTART_BACKOFF_MS)
       restartCount += 1
       await waitForAbort(delayMs, signal)
     }

package/src/workflows/builders.ts

@@ -1,8 +1,10 @@
 import type { ActionDefinition } from "../actions"
 import { isActionDefinition } from "../actions"
 import { AGENT_REASONING_LEVELS, isAgentToolDefinition } from "../agents"
+import { formatLanguageModelTiers, isLanguageModelTier } from "../models/catalog"
 import { isModelReasoning } from "../models/language-model"
 import type { SchemaOrRef } from "../ontology"
+import type { SandboxFactory } from "../sandboxes"
 import type { ScheduleDefinition, ScheduleDefinitionForEvent } from "../schedules"
 import { isScheduleDefinition } from "../schedules"
 import { isGroupDefinition } from "../security"
@@ -25,6 +27,7 @@ import type {
   WorkflowTriggerDefinition,
 } from "./types"
 import {
+  assertAgentStepSandbox,
   assertNonEmpty,
   isAgentStepDefinition,
   isInterventionDefinition,
@@ -128,6 +131,11 @@ export function defineAgentStep<const TId extends string>(
   if (typeof config.instructions !== "string" || !config.instructions.trim()) {
     throw new WorkflowDefinitionError(`Agent step "${id}" instructions must not be empty.`)
   }
+  if (typeof config.model === "string" && !isLanguageModelTier(config.model)) {
+    throw new WorkflowDefinitionError(
+      `Agent step "${id}" has unknown model tier "${config.model}". Use ${formatLanguageModelTiers()}, or pass a model.`
+    )
+  }
   if (config.reasoning !== undefined && !isModelReasoning(config.reasoning)) {
     throw new WorkflowDefinitionError(
       `Agent step "${id}" reasoning must be one of: ${AGENT_REASONING_LEVELS.join(", ")}, or a nonnegative budgetTokens object.`
@@ -137,6 +145,7 @@ export function defineAgentStep<const TId extends string>(
   const groupIds = groupIdsFromAgentStepConfig(id, config)
   const toolNames = toolNamesFromAgentStepConfig(id, config)
   const skillNames = skillNamesFromAgentStepConfig(id, config)
+  const sandbox = sandboxFromAgentStepConfig(id, config)
 
   return {
     input(input: RuntimeWorkflowInput): unknown {
@@ -156,6 +165,7 @@ export function defineAgentStep<const TId extends string>(
                 groupIds,
                 toolNames,
                 skillNames,
+                ...(sandbox === undefined ? {} : { sandbox }),
                 input,
                 output,
                 prompt,
@@ -231,6 +241,16 @@ function skillNamesFromAgentStepConfig(
   return Object.freeze(skillNames)
 }
 
+function sandboxFromAgentStepConfig(
+  stepId: string,
+  config: DefineAgentStepConfig
+): SandboxFactory | undefined {
+  if (config.sandbox === undefined) return undefined
+
+  assertAgentStepSandbox(config.sandbox, `Agent step "${stepId}"`)
+  return config.sandbox
+}
+
 function assertUniqueAgentStepValues(
   stepId: string,
   kind: "group" | "tool" | "skill",

package/src/workflows/request.ts

@@ -9,7 +9,8 @@ import type { ExecutionContext } from "../execution/types"
 import { assertValidFileRefs } from "../ontology/validation"
 import type { SixbRuntimeContext } from "../runtime/types"
 import { dispatchWorkflowRun } from "./run-dispatch"
-import type { WorkflowDefinition, WorkflowRunSource } from "./types"
+import { snapshotWorkflowInput } from "./snapshot"
+import type { WorkflowDefinition, WorkflowIOSnapshot, WorkflowRunSource } from "./types"
 
 export interface WorkflowRunRequestOptions {
   readonly input?: Readonly<Record<string, unknown>>
@@ -45,13 +46,7 @@ export async function requestWorkflowRun(
   workflow: WorkflowDefinition,
   options: WorkflowRunRequestOptions = {}
 ): Promise<WorkflowRunRequestResult> {
-  resolveExecutionScopeAuthorization(runtime.projectId, {
-    execution,
-    authorization: runtime.runtimeAuthorization,
-  })
-  assertAuthorized(runtime, { kind: "workflow.run", workflowId: workflow.id })
-  // Only caller input: automatic runs carry stored data, which may predate the rule.
-  assertValidFileRefs(options.input, `Workflow "${workflow.id}" input`)
+  admitWorkflowRequest(runtime, execution, workflow, options.input)
   return dispatchWorkflowRun({
     errorReporterHost: runtime,
     projectId: runtime.projectId,
@@ -79,3 +74,46 @@ export async function requestWorkflowRun(
     },
   })
 }
+
+/** A workflow start as it would run: authorized, with its input as the run would snapshot it. */
+export interface PreparedWorkflowRequest {
+  readonly workflowId: string
+  readonly input: WorkflowIOSnapshot
+}
+
+/**
+ * Admit a workflow start without starting it: the checks `requestWorkflowRun` applies, and the
+ * input snapshot the run would store. The agent API gateway prepares the starts it holds for
+ * approval.
+ */
+export function prepareWorkflowRequest(
+  runtime: SixbRuntimeContext,
+  execution: ExecutionContext,
+  workflow: WorkflowDefinition,
+  input: Readonly<Record<string, unknown>> = {}
+): PreparedWorkflowRequest {
+  admitWorkflowRequest(runtime, execution, workflow, input)
+  return {
+    workflowId: workflow.id,
+    input: snapshotWorkflowInput({
+      workflow,
+      value: input,
+      valueTypesById: runtime.ontology.getValueTypesById(),
+    }),
+  }
+}
+
+function admitWorkflowRequest(
+  runtime: SixbRuntimeContext,
+  execution: ExecutionContext,
+  workflow: WorkflowDefinition,
+  input: Readonly<Record<string, unknown>> | undefined
+): void {
+  resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization,
+  })
+  assertAuthorized(runtime, { kind: "workflow.run", workflowId: workflow.id })
+  // Only caller input: automatic runs carry stored data, which may predate the rule.
+  assertValidFileRefs(input, `Workflow "${workflow.id}" input`)
+}

package/src/workflows/types.ts

@@ -15,6 +15,7 @@ import type { EventsRuntime } from "../events/execution"
 import type { JsonValue } from "../json"
 import type { Logger } from "../logging"
 import type { LogsRuntime } from "../logging/execution"
+import type { LanguageModelTier } from "../models/catalog"
 import type { ModelsRuntime } from "../models/generation-types"
 import type { LanguageModel } from "../models/language-model"
 import type { ObjectsRuntime } from "../objects/execution"
@@ -22,10 +23,12 @@ import type { InferSchemaOrRef, ObjectRef, SchemaOrRef } from "../ontology"
 import type { PipelinesRuntime } from "../pipelines/execution"
 import type { ProjectionsRuntime } from "../projections/execution"
 import type { RulesRuntime } from "../rules/execution"
+import type { SandboxFactory } from "../sandboxes"
 import type { ScheduleDefinition, ScheduleDefinitionForEvent } from "../schedules"
 import type { SchedulesRuntime } from "../schedules/execution"
 import type { GroupDefinition } from "../security"
 import type { SyncsRuntime } from "../syncs/execution"
+import type { UsersRuntime } from "../users"
 import type { WorkflowsRuntime } from "./execution"
 
 type Simplify<T> = { [K in keyof T]: T[K] } & {}
@@ -74,6 +77,7 @@ export interface WorkflowRuntimeFacade {
   readonly events: EventsRuntime
   readonly logs: LogsRuntime
   readonly schedules: SchedulesRuntime
+  readonly users: UsersRuntime
   readonly connector: ConnectorRuntime
   readonly blobs: BlobsRuntime
 }
@@ -139,7 +143,8 @@ export type AgentStepPrompt<TInput extends Record<string, unknown>> = (
 
 /** Runtime configuration owned directly by a workflow Agent step. */
 export interface DefineAgentStepConfig {
-  readonly model?: LanguageModel
+  /** A model runs as given; a tier runs that tier's model from `models.language`. */
+  readonly model?: LanguageModel | LanguageModelTier
   readonly reasoning?: AgentReasoning
   readonly instructions: string
   readonly groups?: readonly GroupDefinition[]
@@ -147,6 +152,13 @@ export interface DefineAgentStepConfig {
   readonly tools?: readonly AgentToolDefinition[]
   /** Names of the project Agent Skills (`skills/<name>/`) this workflow task may use. Defaults to none. */
   readonly skills?: readonly string[]
+  /**
+   * The step's own sandbox: each run gets a fresh one from this factory's static recipe (source,
+   * setup, env, network and auth), destroyed when the run ends. Without it, each run gets an empty
+   * sandbox from the project's `sandboxes` that reaches only the Sixb API. Factories with `params`
+   * or `resolve` are not supported.
+   */
+  readonly sandbox?: SandboxFactory
 }
 
 export interface AgentStepDefinition<
@@ -158,12 +170,13 @@ export interface AgentStepDefinition<
 > {
   readonly kind: "agentStep"
   readonly id: TId
-  readonly model?: LanguageModel
+  readonly model?: LanguageModel | LanguageModelTier
   readonly reasoning?: AgentReasoning
   readonly instructions: string
   readonly groupIds: readonly string[]
   readonly toolNames: readonly string[]
   readonly skillNames: readonly string[]
+  readonly sandbox?: SandboxFactory
   readonly input: TInput
   readonly output: TOutput
   readonly prompt: AgentStepPrompt<Record<string, unknown>>

package/src/workflows/validation.ts

@@ -1,9 +1,21 @@
 import { isActionDefinition } from "../actions"
 import type { AgentSkillCatalog, AgentToolCatalog } from "../agents"
 import type { ModelCatalog } from "../models"
+import {
+  assertValidLanguageModel,
+  isLanguageModelTier,
+  selectLanguageModel,
+} from "../models/catalog"
 import { isModelReasoning, modelReasoningSupportIssue } from "../models/language-model"
 import type { SchemaOrRef, ValueType } from "../ontology"
 import { validateSchemaOrRefValue } from "../ontology/refs"
+import type { SandboxFactory } from "../sandboxes"
+import {
+  type SandboxEnvironment,
+  sandboxCredentialIssue,
+  staticSandboxRecipe,
+} from "../sandboxes/configuration"
+import { SandboxError } from "../sandboxes/errors"
 import type { ScheduleDefinition } from "../schedules"
 import type { SecurityDefinitionCatalog } from "../security"
 import { WorkflowDefinitionError, WorkflowValidationError } from "./errors"
@@ -48,7 +60,9 @@ export function isAgentStepDefinition(value: unknown): value is AgentStepDefinit
     isRecord(value) &&
     value.kind === "agentStep" &&
     typeof value.id === "string" &&
-    (value.model === undefined || isLanguageModel(value.model)) &&
+    (value.model === undefined ||
+      isLanguageModelTier(value.model) ||
+      isLanguageModel(value.model)) &&
     (value.reasoning === undefined || isModelReasoning(value.reasoning)) &&
     typeof value.instructions === "string" &&
     isStringArray(value.groupIds) &&
@@ -183,17 +197,24 @@ function validateWorkflowAgentStepRuntimeReferences(
       `Workflow "${workflowId}" agent step "${step.id}" needs a model. Configure 'models.language' or pass 'model' to defineAgentStep().`
     )
   }
-  if (step.model !== undefined && options.models !== undefined) {
-    const ref = { provider: step.model.providerId, modelId: step.model.modelId }
-    if (options.models.language?.getByRef(ref) == null) {
-      throw new WorkflowDefinitionError(
-        `Workflow "${workflowId}" agent step "${step.id}" uses unknown language model "${ref.provider}/${ref.modelId}". Add it to 'models.language' in createSixb().`
-      )
-    }
+  if (typeof step.model === "string" && options.models?.language === undefined) {
+    throw new WorkflowDefinitionError(
+      `Workflow "${workflowId}" agent step "${step.id}" needs a model for tier "${step.model}". Configure 'models.language' or pass a model to defineAgentStep().`
+    )
+  }
+  // The step's own model runs as given, so it passes the checks a catalog model passes.
+  if (step.model !== undefined && typeof step.model !== "string") {
+    assertValidLanguageModel(
+      step.model,
+      (detail) =>
+        new WorkflowDefinitionError(
+          `Workflow "${workflowId}" agent step "${step.id}" has an invalid language model: ${detail}.`
+        )
+    )
   }
   // Same rule as a catalog default: checked against the capabilities the model declares, so an
   // effort or token budget outside them fails at startup rather than on the step's first run.
-  const model = step.model ?? options.models?.language?.default?.model
+  const model = selectLanguageModel(options.models?.language, step.model)
   if (step.reasoning !== undefined && model !== undefined) {
     const issue = modelReasoningSupportIssue(
       model.definition.capabilities.reasoning,
@@ -413,6 +434,15 @@ function validateAgentNodeDefinition(workflowId: string, node: WorkflowAgentNode
   assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "group", node.agentStep.groupIds)
   assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "tool", node.agentStep.toolNames)
   assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "skill", node.agentStep.skillNames)
+
+  // A hand-built node skips defineAgentStep, so its sandbox is checked again here.
+  if (node.agentStep.sandbox !== undefined) {
+    assertAgentStepSandbox(
+      node.agentStep.sandbox,
+      `Workflow "${workflowId}" agent step "${node.id}"`
+    )
+  }
+
   if (node.mapper !== undefined && typeof node.mapper !== "function") {
     throw new WorkflowDefinitionError(
       `Workflow "${workflowId}" agent node "${node.id}" mapper must be a function.`
@@ -420,6 +450,62 @@ function validateAgentNodeDefinition(workflowId: string, node: WorkflowAgentNode
   }
 }
 
+/**
+ * Reject a value that cannot be an Agent step's sandbox; `step` names it in the error. A step has
+ * no thread to bind params to, so only a static recipe applies. Its network must let the agent
+ * reach the Sixb API. Its source access must pass the rule a project factory passes at startup.
+ */
+export function assertAgentStepSandbox(
+  value: unknown,
+  step: string
+): asserts value is SandboxFactory {
+  const fail = (issue: string, cause?: unknown): never => {
+    throw new WorkflowDefinitionError(
+      `${step} sandbox ${issue}`,
+      cause === undefined ? undefined : { cause }
+    )
+  }
+
+  if (!isRecord(value) || typeof value.create !== "function") {
+    return fail("must be a sandbox factory with a create function.")
+  }
+
+  const { configuration } = value
+  if (configuration === undefined) return
+  if (!isRecord(configuration)) return fail("configuration must be a sandbox recipe object.")
+  if (configuration.params !== undefined || configuration.resolve !== undefined) {
+    return fail("must use a static recipe: params and resolve are not supported in workflow steps.")
+  }
+
+  let recipe: SandboxEnvironment
+  try {
+    recipe = staticSandboxRecipe(configuration)
+  } catch (error) {
+    if (!(error instanceof SandboxError)) throw error
+    // Recipe validation names the invalid field, never its value.
+    return fail(`recipe is invalid: ${error.message.replace(/^\[Sixb\] /, "")}`, error)
+  }
+
+  // Sixb adds its API to every other policy when the step runs, so only none cannot reach it.
+  if (recipe.network?.mode === "none") {
+    return fail(
+      'network mode "none" cannot run an agent: the agent needs the Sixb API. Use { mode: "restricted", allow: [...] } with the origins the project needs; Sixb adds its own.'
+    )
+  }
+
+  const { auth } = configuration
+  if (auth !== undefined && !(isRecord(auth) && typeof auth.authorize === "function")) {
+    return fail("auth requires an authorize function.")
+  }
+
+  const credentialIssue = sandboxCredentialIssue({
+    supportsRequestCredentials: value.supportsRequestCredentials === true,
+    auth,
+    source: recipe.source,
+  })
+  if (credentialIssue) fail(`is invalid: ${credentialIssue}`)
+}
+
 function assertUniqueNonEmptyAgentStepValues(
   workflowId: string,
   stepId: string,

package/dist/chunk-1k89ecfr.js

@@ -1,85 +0,0 @@
-// @bun
-import {
-  isPrimitiveSchema
-} from "./chunk-hvsb78a1.js";
-import {
-  isPlainRecord
-} from "./chunk-wy0qdqfm.js";
-
-// src/ontology/validation/definition.ts
-function assertValidSchema(schema, path, invalid, visiting = new Set) {
-  if (typeof schema === "string") {
-    if (isPrimitiveSchema(schema)) {
-      return;
-    }
-    throw invalid(path);
-  }
-  if (!isPlainRecord(schema) || typeof schema.type !== "string" || visiting.has(schema)) {
-    throw invalid(path);
-  }
-  visiting.add(schema);
-  switch (schema.type) {
-    case "enum": {
-      const values = schema.values;
-      const validValues = isValidEnumValues(values, schema.valueType);
-      if (!validValues || new Set(values).size !== values.length) {
-        throw invalid(path);
-      }
-      break;
-    }
-    case "array":
-      assertValidSchema(schema.items, `${path}.items`, invalid, visiting);
-      break;
-    case "map":
-      if (schema.keySchema !== "string") {
-        throw invalid(path);
-      }
-      assertValidSchema(schema.valueSchema, `${path}.valueSchema`, invalid, visiting);
-      break;
-    case "object": {
-      if (!isPlainRecord(schema.properties)) {
-        throw invalid(path);
-      }
-      for (const [fieldId, field] of Object.entries(schema.properties)) {
-        if (!fieldId.trim() || !isPlainRecord(field) || !("schema" in field)) {
-          throw invalid(`${path}.properties.${fieldId}`);
-        }
-        if (field.required !== undefined && typeof field.required !== "boolean" || field.nullable !== undefined && typeof field.nullable !== "boolean" || field.description !== undefined && (typeof field.description !== "string" || !field.description.trim())) {
-          throw invalid(`${path}.properties.${fieldId}`);
-        }
-        assertValidSchema(field.schema, `${path}.properties.${fieldId}.schema`, invalid, visiting);
-      }
-      break;
-    }
-    case "valueTypeRef":
-      if (typeof schema.valueTypeId !== "string" || !schema.valueTypeId.trim()) {
-        throw invalid(path);
-      }
-      if (schema._resolved !== undefined) {
-        assertValidSchema(schema._resolved, `${path}._resolved`, invalid, visiting);
-      }
-      break;
-    default:
-      throw invalid(path);
-  }
-  visiting.delete(schema);
-}
-function isValidEnumValues(values, valueType) {
-  if (!Array.isArray(values) || values.length === 0) {
-    return false;
-  }
-  for (let index = 0;index < values.length; index += 1) {
-    if (!Object.hasOwn(values, index)) {
-      return false;
-    }
-    const value = values[index];
-    if (valueType === "string" ? typeof value !== "string" : valueType !== "integer" || typeof value !== "number" || !Number.isInteger(value)) {
-      return false;
-    }
-  }
-  return true;
-}
-
-export { assertValidSchema };
-
-//# debugId=6F187C1748947F4164756E2164756E21

package/dist/chunk-1k89ecfr.js.map

@@ -1,10 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/ontology/validation/definition.ts"],
-  "sourcesContent": [
-    "import { isPlainRecord } from \"../../json\"\nimport { isPrimitiveSchema } from \"../primitives\"\n\n/** Validate a declarative schema's shape independently of the primitive that consumes it. */\nexport function assertValidSchema(\n  schema: unknown,\n  path: string,\n  invalid: (path: string) => Error,\n  visiting: Set<object> = new Set()\n): void {\n  if (typeof schema === \"string\") {\n    if (isPrimitiveSchema(schema)) {\n      return\n    }\n    throw invalid(path)\n  }\n  if (!isPlainRecord(schema) || typeof schema.type !== \"string\" || visiting.has(schema)) {\n    throw invalid(path)\n  }\n\n  visiting.add(schema)\n  switch (schema.type) {\n    case \"enum\": {\n      const values = schema.values\n      const validValues = isValidEnumValues(values, schema.valueType)\n      if (!validValues || new Set(values).size !== values.length) {\n        throw invalid(path)\n      }\n      break\n    }\n    case \"array\":\n      assertValidSchema(schema.items, `${path}.items`, invalid, visiting)\n      break\n    case \"map\":\n      if (schema.keySchema !== \"string\") {\n        throw invalid(path)\n      }\n      assertValidSchema(schema.valueSchema, `${path}.valueSchema`, invalid, visiting)\n      break\n    case \"object\": {\n      if (!isPlainRecord(schema.properties)) {\n        throw invalid(path)\n      }\n      for (const [fieldId, field] of Object.entries(schema.properties)) {\n        if (!fieldId.trim() || !isPlainRecord(field) || !(\"schema\" in field)) {\n          throw invalid(`${path}.properties.${fieldId}`)\n        }\n        if (\n          (field.required !== undefined && typeof field.required !== \"boolean\") ||\n          (field.nullable !== undefined && typeof field.nullable !== \"boolean\") ||\n          (field.description !== undefined &&\n            (typeof field.description !== \"string\" || !field.description.trim()))\n        ) {\n          throw invalid(`${path}.properties.${fieldId}`)\n        }\n        assertValidSchema(field.schema, `${path}.properties.${fieldId}.schema`, invalid, visiting)\n      }\n      break\n    }\n    case \"valueTypeRef\":\n      if (typeof schema.valueTypeId !== \"string\" || !schema.valueTypeId.trim()) {\n        throw invalid(path)\n      }\n      if (schema._resolved !== undefined) {\n        assertValidSchema(schema._resolved, `${path}._resolved`, invalid, visiting)\n      }\n      break\n    default:\n      throw invalid(path)\n  }\n  visiting.delete(schema)\n}\n\nfunction isValidEnumValues(values: unknown, valueType: unknown): values is unknown[] {\n  if (!Array.isArray(values) || values.length === 0) {\n    return false\n  }\n\n  for (let index = 0; index < values.length; index += 1) {\n    if (!Object.hasOwn(values, index)) {\n      return false\n    }\n    const value = values[index]\n    if (\n      valueType === \"string\"\n        ? typeof value !== \"string\"\n        : valueType !== \"integer\" || typeof value !== \"number\" || !Number.isInteger(value)\n    ) {\n      return false\n    }\n  }\n  return true\n}\n"
-  ],
-  "mappings": ";;;;;;;;;AAIO,SAAS,iBAAiB,CAC/B,QACA,MACA,SACA,WAAwB,IAAI,KACtB;AAAA,EACN,IAAI,OAAO,WAAW,UAAU;AAAA,IAC9B,IAAI,kBAAkB,MAAM,GAAG;AAAA,MAC7B;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,IAAI;AAAA,EACpB;AAAA,EACA,IAAI,CAAC,cAAc,MAAM,KAAK,OAAO,OAAO,SAAS,YAAY,SAAS,IAAI,MAAM,GAAG;AAAA,IACrF,MAAM,QAAQ,IAAI;AAAA,EACpB;AAAA,EAEA,SAAS,IAAI,MAAM;AAAA,EACnB,QAAQ,OAAO;AAAA,SACR,QAAQ;AAAA,MACX,MAAM,SAAS,OAAO;AAAA,MACtB,MAAM,cAAc,kBAAkB,QAAQ,OAAO,SAAS;AAAA,MAC9D,IAAI,CAAC,eAAe,IAAI,IAAI,MAAM,EAAE,SAAS,OAAO,QAAQ;AAAA,QAC1D,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,IACF;AAAA,SACK;AAAA,MACH,kBAAkB,OAAO,OAAO,GAAG,cAAc,SAAS,QAAQ;AAAA,MAClE;AAAA,SACG;AAAA,MACH,IAAI,OAAO,cAAc,UAAU;AAAA,QACjC,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA,kBAAkB,OAAO,aAAa,GAAG,oBAAoB,SAAS,QAAQ;AAAA,MAC9E;AAAA,SACG,UAAU;AAAA,MACb,IAAI,CAAC,cAAc,OAAO,UAAU,GAAG;AAAA,QACrC,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA,YAAY,SAAS,UAAU,OAAO,QAAQ,OAAO,UAAU,GAAG;AAAA,QAChE,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,cAAc,KAAK,KAAK,EAAE,YAAY,QAAQ;AAAA,UACpE,MAAM,QAAQ,GAAG,mBAAmB,SAAS;AAAA,QAC/C;AAAA,QACA,IACG,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,aAC1D,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,aAC1D,MAAM,gBAAgB,cACpB,OAAO,MAAM,gBAAgB,YAAY,CAAC,MAAM,YAAY,KAAK,IACpE;AAAA,UACA,MAAM,QAAQ,GAAG,mBAAmB,SAAS;AAAA,QAC/C;AAAA,QACA,kBAAkB,MAAM,QAAQ,GAAG,mBAAmB,kBAAkB,SAAS,QAAQ;AAAA,MAC3F;AAAA,MACA;AAAA,IACF;AAAA,SACK;AAAA,MACH,IAAI,OAAO,OAAO,gBAAgB,YAAY,CAAC,OAAO,YAAY,KAAK,GAAG;AAAA,QACxE,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA,IAAI,OAAO,cAAc,WAAW;AAAA,QAClC,kBAAkB,OAAO,WAAW,GAAG,kBAAkB,SAAS,QAAQ;AAAA,MAC5E;AAAA,MACA;AAAA;AAAA,MAEA,MAAM,QAAQ,IAAI;AAAA;AAAA,EAEtB,SAAS,OAAO,MAAM;AAAA;AAGxB,SAAS,iBAAiB,CAAC,QAAiB,WAAyC;AAAA,EACnF,IAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG;AAAA,IACjD,OAAO;AAAA,EACT;AAAA,EAEA,SAAS,QAAQ,EAAG,QAAQ,OAAO,QAAQ,SAAS,GAAG;AAAA,IACrD,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,GAAG;AAAA,MACjC,OAAO;AAAA,IACT;AAAA,IACA,MAAM,QAAQ,OAAO;AAAA,IACrB,IACE,cAAc,WACV,OAAO,UAAU,WACjB,cAAc,aAAa,OAAO,UAAU,YAAY,CAAC,OAAO,UAAU,KAAK,GACnF;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,OAAO;AAAA;",
-  "debugId": "6F187C1748947F4164756E2164756E21",
-  "names": []
-}