@sixb/core 0.1.20 → 0.1.22

package/dist/chunk-d2m879s4.js

@@ -0,0 +1,288 @@
+// @bun
+import {
+  isPrimitiveSchema
+} from "./chunk-65pyhyas.js";
+import {
+  normalizeParams,
+  coerceParamsToTyped
+} from "./chunk-6n69k945.js";
+import {
+  isPlainRecord
+} from "./chunk-wy0qdqfm.js";
+
+// src/sandboxes/errors.ts
+class SandboxError2 extends Error {
+  name = "SandboxError";
+}
+
+class SandboxStateUnavailableError2 extends SandboxError2 {
+  name = "SandboxStateUnavailableError";
+}
+
+class SandboxNotRunningError2 extends SandboxError2 {
+  name = "SandboxNotRunningError";
+}
+
+class SandboxTimeoutError2 extends SandboxError2 {
+  name = "SandboxTimeoutError";
+}
+
+class SandboxIsolationUnavailableError2 extends SandboxError2 {
+  name = "SandboxIsolationUnavailableError";
+}
+
+// src/ontology/validation/definition.ts
+function assertValidSchema(schema, path, invalid, visiting = new Set) {
+  if (typeof schema === "string") {
+    if (isPrimitiveSchema(schema)) {
+      return;
+    }
+    throw invalid(path);
+  }
+  if (!isPlainRecord(schema) || typeof schema.type !== "string" || visiting.has(schema)) {
+    throw invalid(path);
+  }
+  visiting.add(schema);
+  switch (schema.type) {
+    case "enum": {
+      const values = schema.values;
+      const validValues = isValidEnumValues(values, schema.valueType);
+      if (!validValues || new Set(values).size !== values.length) {
+        throw invalid(path);
+      }
+      break;
+    }
+    case "array":
+      assertValidSchema(schema.items, `${path}.items`, invalid, visiting);
+      break;
+    case "map":
+      if (schema.keySchema !== "string") {
+        throw invalid(path);
+      }
+      assertValidSchema(schema.valueSchema, `${path}.valueSchema`, invalid, visiting);
+      break;
+    case "object": {
+      if (!isPlainRecord(schema.properties)) {
+        throw invalid(path);
+      }
+      for (const [fieldId, field] of Object.entries(schema.properties)) {
+        if (!fieldId.trim() || !isPlainRecord(field) || !("schema" in field)) {
+          throw invalid(`${path}.properties.${fieldId}`);
+        }
+        if (field.required !== undefined && typeof field.required !== "boolean" || field.nullable !== undefined && typeof field.nullable !== "boolean" || field.description !== undefined && (typeof field.description !== "string" || !field.description.trim())) {
+          throw invalid(`${path}.properties.${fieldId}`);
+        }
+        assertValidSchema(field.schema, `${path}.properties.${fieldId}.schema`, invalid, visiting);
+      }
+      break;
+    }
+    case "valueTypeRef":
+      if (typeof schema.valueTypeId !== "string" || !schema.valueTypeId.trim()) {
+        throw invalid(path);
+      }
+      if (schema._resolved !== undefined) {
+        assertValidSchema(schema._resolved, `${path}._resolved`, invalid, visiting);
+      }
+      break;
+    default:
+      throw invalid(path);
+  }
+  visiting.delete(schema);
+}
+function isValidEnumValues(values, valueType) {
+  if (!Array.isArray(values) || values.length === 0) {
+    return false;
+  }
+  for (let index = 0;index < values.length; index += 1) {
+    if (!Object.hasOwn(values, index)) {
+      return false;
+    }
+    const value = values[index];
+    if (valueType === "string" ? typeof value !== "string" : valueType !== "integer" || typeof value !== "number" || !Number.isInteger(value)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+// src/sandboxes/configuration.ts
+function createSandboxDefinition(config, ontology) {
+  const raw = config;
+  if (!isPlainRecord(raw) || config.params !== undefined && !isPlainRecord(raw.params) || config.resolve !== undefined && typeof config.resolve !== "function") {
+    throw new SandboxError2("[Sixb] Sandbox configuration requires a params object and a callable resolver when provided.");
+  }
+  for (const key of Object.keys(config)) {
+    if (!["params", "resolve", "source", "setup", "env", "network", "auth"].includes(key)) {
+      throw new SandboxError2("[Sixb] Unknown sandbox configuration field.");
+    }
+  }
+  if (config.auth !== undefined && typeof config.auth?.authorize !== "function") {
+    throw new SandboxError2("[Sixb] sandboxes.auth requires an authorize function.");
+  }
+  if (config.params !== undefined && config.resolve === undefined) {
+    throw new SandboxError2("[Sixb] Sandbox params require a resolve function.");
+  }
+  if (config.resolve !== undefined && (config.source !== undefined || config.setup !== undefined)) {
+    throw new SandboxError2("[Sixb] Use either static source/setup or resolve, not both.");
+  }
+  const invalid = (path) => new SandboxError2(`[Sixb] ${path} must be a valid parameter declaration; use param(schema).`);
+  for (const [id, value] of Object.entries(config.params ?? {})) {
+    const path = `sandboxes.params.${id}`;
+    if (!id.trim() || !isPlainRecord(value))
+      throw invalid(path);
+    for (const key of Object.keys(value)) {
+      if (!["schema", "required", "nullable", "description", "semanticType"].includes(key)) {
+        throw invalid(path);
+      }
+    }
+    if (value.required !== undefined && typeof value.required !== "boolean" || value.nullable !== undefined && typeof value.nullable !== "boolean" || value.description !== undefined && typeof value.description !== "string" || value.semanticType !== undefined && typeof value.semanticType !== "string")
+      throw invalid(path);
+    const schema = value.schema;
+    if (isPlainRecord(schema) && schema.type === "objectRef") {
+      if (typeof schema.objectTypeId !== "string" || !ontology.getObjectTypesById().has(schema.objectTypeId)) {
+        throw invalid(path);
+      }
+    } else {
+      assertValidSchema(schema, `${path}.schema`, invalid);
+    }
+  }
+  const params = structuredClone(config.params ?? {});
+  const environment = staticSandboxRecipe2(config);
+  const resolve = config.resolve;
+  const authorize = config.auth?.authorize.bind(config.auth);
+  deepFreeze(params);
+  return Object.freeze({
+    params,
+    ...authorize ? { auth: Object.freeze({ authorize }) } : {},
+    resolve: async ({ params: input, sixb }) => {
+      const binding = normalizeParams(ontology.getValueTypesById(), params, input, {
+        kind: "sandbox",
+        id: "sandboxes",
+        path: "sandbox"
+      });
+      const typed = coerceParamsToTyped(params, binding, ontology.getValueTypesById());
+      if (!resolve)
+        return structuredClone(environment);
+      const resolved = captureEnvironment(await resolve({ params: typed, sixb }));
+      return {
+        ...structuredClone(environment),
+        ...resolved,
+        env: { ...environment.env, ...resolved.env }
+      };
+    }
+  });
+}
+function sandboxCredentialIssue2(input) {
+  const { supportsRequestCredentials, auth, source } = input;
+  if (source?.access === "write" && auth === undefined) {
+    return 'Sandbox write access needs source auth: add auth to the sandbox factory or use access "read".';
+  }
+  if (auth !== undefined && !supportsRequestCredentials) {
+    return "Sandbox source auth needs a provider that injects request credentials outside the sandbox: use @sixb/sandboxes-vercel, or remove auth.";
+  }
+  return;
+}
+function staticSandboxRecipe2(configuration) {
+  const { source, setup, env, network } = configuration;
+  return captureEnvironment({
+    ...source === undefined ? {} : { source },
+    ...setup === undefined ? {} : { setup },
+    ...env === undefined ? {} : { env },
+    ...network === undefined ? {} : { network }
+  });
+}
+function captureEnvironment(value) {
+  if (!isPlainRecord(value) || Object.keys(value).some((key) => !["source", "setup", "env", "network"].includes(key))) {
+    return fail("environment");
+  }
+  if (value.source !== undefined)
+    validateSource(value.source);
+  if (value.setup !== undefined)
+    validateSetup(value.setup);
+  if (value.env !== undefined)
+    validateEnv(value.env);
+  if (value.network !== undefined)
+    validateNetwork(value.network);
+  return structuredClone(value);
+}
+function fail(field) {
+  throw new SandboxError2(`[Sixb] Invalid sandbox ${field}.`);
+}
+function validateSource(source) {
+  if (!isPlainRecord(source) || source.type !== "git" || typeof source.url !== "string" || Object.keys(source).some((key) => !["type", "url", "revision", "access"].includes(key))) {
+    fail("source");
+  }
+  const url = parseUrl(source.url, "source URL");
+  if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash) {
+    fail("source URL: expected credential-free HTTPS");
+  }
+  if (url.hostname.includes("*"))
+    fail("source URL: wildcard hosts are not allowed");
+  if (source.revision !== undefined && (typeof source.revision !== "string" || !source.revision.trim() || source.revision.startsWith("-") || /[\x00-\x1f]/.test(source.revision))) {
+    fail("source revision");
+  }
+  if (source.access !== undefined && source.access !== "read" && source.access !== "write") {
+    fail("source access");
+  }
+}
+function validateSetup(setup) {
+  if (!Array.isArray(setup) || setup.some((command) => typeof command !== "string" || !command.trim() || command.includes("\x00"))) {
+    fail("setup");
+  }
+}
+function captureSandboxEnv2(value) {
+  validateEnv(value);
+  return structuredClone(value);
+}
+function validateEnv(env) {
+  if (!isPlainRecord(env) || Object.entries(env).some(([key, entry]) => !key || /[=\0]/.test(key) || typeof entry !== "string" || entry.includes("\x00"))) {
+    fail("env");
+  }
+}
+function validateNetwork(network) {
+  if (!isPlainRecord(network))
+    fail("network");
+  if (network.mode === "restricted") {
+    if (Object.keys(network).some((key) => key !== "mode" && key !== "allow") || !Array.isArray(network.allow)) {
+      fail("network");
+    }
+    for (const target of network.allow)
+      validateNetworkTarget(target);
+    return;
+  }
+  if (network.mode !== "none" && network.mode !== "all" || Object.keys(network).some((key) => key !== "mode")) {
+    fail("network");
+  }
+}
+function validateNetworkTarget(target) {
+  if (!isPlainRecord(target) || typeof target.name !== "string" || !target.name.trim() || typeof target.origin !== "string" || Object.keys(target).some((key) => key !== "name" && key !== "origin")) {
+    fail("network target");
+  }
+  const url = parseUrl(target.origin, "network origin");
+  if (!["http:", "https:"].includes(url.protocol) || url.origin !== target.origin) {
+    fail("network origin");
+  }
+  if (url.hostname.includes("*"))
+    fail("network origin: wildcard hosts are not allowed");
+}
+function parseUrl(value, field) {
+  try {
+    return new URL(value);
+  } catch {
+    return fail(field);
+  }
+}
+function deepFreeze(value, seen = new Set) {
+  if (seen.has(value))
+    return;
+  seen.add(value);
+  for (const child of Object.values(value)) {
+    if (child !== null && typeof child === "object")
+      deepFreeze(child, seen);
+  }
+  Object.freeze(value);
+}
+
+export { assertValidSchema, SandboxError2, SandboxStateUnavailableError2, SandboxNotRunningError2, SandboxTimeoutError2, SandboxIsolationUnavailableError2, createSandboxDefinition, sandboxCredentialIssue2, staticSandboxRecipe2, captureEnvironment, captureSandboxEnv2 };
+
+//# debugId=365C30ED7D7790B264756E2164756E21

package/dist/chunk-d2m879s4.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/sandboxes/errors.ts", "../src/ontology/validation/definition.ts", "../src/sandboxes/configuration.ts"],
+  "sourcesContent": [
+    "/**\n * Errors thrown by sandbox providers. Hosts can catch SandboxError at the\n * audit boundary while still distinguishing recoverable provider states.\n */\nexport class SandboxError extends Error {\n  readonly name: string = \"SandboxError\"\n}\n\n/** Confirmed missing/expired state. Never use for transport, authorization or session setup errors. */\nexport class SandboxStateUnavailableError extends SandboxError {\n  override readonly name = \"SandboxStateUnavailableError\"\n}\n\n/** runCommand / stop / destroy called after the sandbox is stopped or destroyed. */\nexport class SandboxNotRunningError extends SandboxError {\n  override readonly name = \"SandboxNotRunningError\"\n}\n\n/** Command exceeded its timeout and was killed. */\nexport class SandboxTimeoutError extends SandboxError {\n  override readonly name = \"SandboxTimeoutError\"\n}\n\n/** Requested isolation backend is not available on the host. */\nexport class SandboxIsolationUnavailableError extends SandboxError {\n  override readonly name = \"SandboxIsolationUnavailableError\"\n}\n",
+    "import { isPlainRecord } from \"../../json\"\nimport { isPrimitiveSchema } from \"../primitives\"\n\n/** Validate a declarative schema's shape independently of the primitive that consumes it. */\nexport function assertValidSchema(\n  schema: unknown,\n  path: string,\n  invalid: (path: string) => Error,\n  visiting: Set<object> = new Set()\n): void {\n  if (typeof schema === \"string\") {\n    if (isPrimitiveSchema(schema)) {\n      return\n    }\n    throw invalid(path)\n  }\n  if (!isPlainRecord(schema) || typeof schema.type !== \"string\" || visiting.has(schema)) {\n    throw invalid(path)\n  }\n\n  visiting.add(schema)\n  switch (schema.type) {\n    case \"enum\": {\n      const values = schema.values\n      const validValues = isValidEnumValues(values, schema.valueType)\n      if (!validValues || new Set(values).size !== values.length) {\n        throw invalid(path)\n      }\n      break\n    }\n    case \"array\":\n      assertValidSchema(schema.items, `${path}.items`, invalid, visiting)\n      break\n    case \"map\":\n      if (schema.keySchema !== \"string\") {\n        throw invalid(path)\n      }\n      assertValidSchema(schema.valueSchema, `${path}.valueSchema`, invalid, visiting)\n      break\n    case \"object\": {\n      if (!isPlainRecord(schema.properties)) {\n        throw invalid(path)\n      }\n      for (const [fieldId, field] of Object.entries(schema.properties)) {\n        if (!fieldId.trim() || !isPlainRecord(field) || !(\"schema\" in field)) {\n          throw invalid(`${path}.properties.${fieldId}`)\n        }\n        if (\n          (field.required !== undefined && typeof field.required !== \"boolean\") ||\n          (field.nullable !== undefined && typeof field.nullable !== \"boolean\") ||\n          (field.description !== undefined &&\n            (typeof field.description !== \"string\" || !field.description.trim()))\n        ) {\n          throw invalid(`${path}.properties.${fieldId}`)\n        }\n        assertValidSchema(field.schema, `${path}.properties.${fieldId}.schema`, invalid, visiting)\n      }\n      break\n    }\n    case \"valueTypeRef\":\n      if (typeof schema.valueTypeId !== \"string\" || !schema.valueTypeId.trim()) {\n        throw invalid(path)\n      }\n      if (schema._resolved !== undefined) {\n        assertValidSchema(schema._resolved, `${path}._resolved`, invalid, visiting)\n      }\n      break\n    default:\n      throw invalid(path)\n  }\n  visiting.delete(schema)\n}\n\nfunction isValidEnumValues(values: unknown, valueType: unknown): values is unknown[] {\n  if (!Array.isArray(values) || values.length === 0) {\n    return false\n  }\n\n  for (let index = 0; index < values.length; index += 1) {\n    if (!Object.hasOwn(values, index)) {\n      return false\n    }\n    const value = values[index]\n    if (\n      valueType === \"string\"\n        ? typeof value !== \"string\"\n        : valueType !== \"integer\" || typeof value !== \"number\" || !Number.isInteger(value)\n    ) {\n      return false\n    }\n  }\n  return true\n}\n",
+    "import { isPlainRecord } from \"../json\"\nimport type { OntologyRegistry } from \"../ontology/registry\"\nimport { assertValidSchema } from \"../ontology/validation/definition\"\nimport type { Sixb } from \"../runtime/sixb\"\nimport type { InferParams, ParamsConfig } from \"../shared/params/types\"\nimport { coerceParamsToTyped, normalizeParams } from \"../shared/params/validation\"\nimport type { SandboxSourceAuth } from \"./auth\"\nimport { SandboxError } from \"./errors\"\nimport type { SandboxNetworkPolicy } from \"./sandbox\"\n\n/** Static recipes accept an empty parameter record, not arbitrary undeclared keys. */\nexport type InferSandboxParams<TParams extends ParamsConfig> = keyof TParams extends never\n  ? Record<string, never>\n  : InferParams<TParams>\n\n/** Initial project contents, independent from the provider's runtime image or saved state. */\nexport interface SandboxSource {\n  readonly type: \"git\"\n  readonly url: string\n  readonly revision?: string\n  readonly access?: \"read\" | \"write\"\n}\n\n/** Host-side recipe. Environment values are guest-readable, never a Git credential channel. */\nexport interface SandboxEnvironment {\n  readonly source?: SandboxSource\n  readonly setup?: readonly string[]\n  readonly env?: Readonly<Record<string, string>>\n  readonly network?: SandboxNetworkPolicy\n}\n\nexport interface SandboxResolveContext<TParams = Record<string, unknown>> {\n  readonly params: TParams\n  /** Bound to the current execution; a stored binding is not authorization. */\n  readonly sixb: Sixb\n}\n\n// The recipe both declares and consumes this schema: keep it invariant instead of asking\n// TypeScript to compare the recursive ontology inference through callback variance.\n// Provider option interfaces must preserve this annotation when extending the config.\nexport interface SandboxConfig<in out TParams extends ParamsConfig = ParamsConfig>\n  extends SandboxEnvironment {\n  readonly auth?: SandboxSourceAuth\n  readonly params?: TParams\n  readonly resolve?: (\n    context: SandboxResolveContext<InferParams<NoInfer<TParams>>>\n  ) => SandboxEnvironment | Promise<SandboxEnvironment>\n}\n\n/** Registered project recipe; only thread params cross the durable boundary. */\nexport interface SandboxDefinition {\n  readonly auth?: SandboxSourceAuth\n  readonly params: ParamsConfig\n  readonly resolve: (context: SandboxResolveContext) => Promise<SandboxEnvironment>\n}\n\nexport function createSandboxDefinition<TParams extends ParamsConfig>(\n  config: SandboxConfig<TParams>,\n  ontology: OntologyRegistry\n): SandboxDefinition {\n  const raw: unknown = config\n  if (\n    !isPlainRecord(raw) ||\n    (config.params !== undefined && !isPlainRecord(raw.params)) ||\n    (config.resolve !== undefined && typeof config.resolve !== \"function\")\n  ) {\n    throw new SandboxError(\n      \"[Sixb] Sandbox configuration requires a params object and a callable resolver when provided.\"\n    )\n  }\n  for (const key of Object.keys(config)) {\n    if (![\"params\", \"resolve\", \"source\", \"setup\", \"env\", \"network\", \"auth\"].includes(key)) {\n      throw new SandboxError(\"[Sixb] Unknown sandbox configuration field.\")\n    }\n  }\n  if (config.auth !== undefined && typeof config.auth?.authorize !== \"function\") {\n    throw new SandboxError(\"[Sixb] sandboxes.auth requires an authorize function.\")\n  }\n  if (config.params !== undefined && config.resolve === undefined) {\n    throw new SandboxError(\"[Sixb] Sandbox params require a resolve function.\")\n  }\n  if (config.resolve !== undefined && (config.source !== undefined || config.setup !== undefined)) {\n    throw new SandboxError(\"[Sixb] Use either static source/setup or resolve, not both.\")\n  }\n  const invalid = (path: string) =>\n    new SandboxError(`[Sixb] ${path} must be a valid parameter declaration; use param(schema).`)\n  for (const [id, value] of Object.entries(config.params ?? {})) {\n    const path = `sandboxes.params.${id}`\n    if (!id.trim() || !isPlainRecord(value)) throw invalid(path)\n    for (const key of Object.keys(value)) {\n      if (![\"schema\", \"required\", \"nullable\", \"description\", \"semanticType\"].includes(key)) {\n        throw invalid(path)\n      }\n    }\n    if (\n      (value.required !== undefined && typeof value.required !== \"boolean\") ||\n      (value.nullable !== undefined && typeof value.nullable !== \"boolean\") ||\n      (value.description !== undefined && typeof value.description !== \"string\") ||\n      (value.semanticType !== undefined && typeof value.semanticType !== \"string\")\n    )\n      throw invalid(path)\n    const schema: unknown = value.schema\n    if (isPlainRecord(schema) && schema.type === \"objectRef\") {\n      if (\n        typeof schema.objectTypeId !== \"string\" ||\n        !ontology.getObjectTypesById().has(schema.objectTypeId)\n      ) {\n        throw invalid(path)\n      }\n    } else {\n      assertValidSchema(schema, `${path}.schema`, invalid)\n    }\n  }\n  const params = structuredClone(config.params ?? {}) as ParamsConfig\n  const environment = staticSandboxRecipe(config)\n  // Capture the function too: later mutation of application config must not change this host.\n  // Erase inference only after capturing its schema; every invocation validates and coerces below.\n  const resolve = config.resolve as SandboxConfig[\"resolve\"]\n  const authorize = config.auth?.authorize.bind(config.auth)\n  deepFreeze(params)\n  return Object.freeze({\n    params,\n    ...(authorize ? { auth: Object.freeze({ authorize }) } : {}),\n    resolve: async ({ params: input, sixb }: SandboxResolveContext) => {\n      const binding = normalizeParams(ontology.getValueTypesById(), params, input, {\n        kind: \"sandbox\",\n        id: \"sandboxes\",\n        path: \"sandbox\",\n      })\n      const typed = coerceParamsToTyped(params, binding, ontology.getValueTypesById())\n      if (!resolve) return structuredClone(environment)\n      const resolved = captureEnvironment(await resolve({ params: typed, sixb }))\n      return {\n        ...structuredClone(environment),\n        ...resolved,\n        env: { ...environment.env, ...resolved.env },\n      }\n    },\n  })\n}\n\n/** What the source access rule reads: the provider's capability and one recipe's source. */\ninterface SandboxCredentialRuleInput {\n  readonly supportsRequestCredentials?: boolean\n  /** The factory's source auth; it applies to every recipe the factory resolves. */\n  readonly auth?: unknown\n  readonly source?: SandboxSource\n}\n\n/**\n * Why a recipe cannot get the source access it declares, as a whole message, or undefined.\n *\n * Write access needs source auth. Source auth needs a provider that injects request credentials\n * outside the sandbox, even for a recipe without a source: auth is the factory's, so startup and\n * every run give the same answer. Source auth without a source is otherwise fine; that recipe\n * does not use it.\n */\nexport function sandboxCredentialIssue(input: SandboxCredentialRuleInput): string | undefined {\n  const { supportsRequestCredentials, auth, source } = input\n\n  if (source?.access === \"write\" && auth === undefined) {\n    return 'Sandbox write access needs source auth: add auth to the sandbox factory or use access \"read\".'\n  }\n  if (auth !== undefined && !supportsRequestCredentials) {\n    return \"Sandbox source auth needs a provider that injects request credentials outside the sandbox: use @sixb/sandboxes-vercel, or remove auth.\"\n  }\n\n  return undefined\n}\n\n/** The static part of a recipe, captured: all a run without thread params can apply. */\nexport function staticSandboxRecipe(configuration: {\n  readonly source?: unknown\n  readonly setup?: unknown\n  readonly env?: unknown\n  readonly network?: unknown\n}): SandboxEnvironment {\n  const { source, setup, env, network } = configuration\n  return captureEnvironment({\n    ...(source === undefined ? {} : { source }),\n    ...(setup === undefined ? {} : { setup }),\n    ...(env === undefined ? {} : { env }),\n    ...(network === undefined ? {} : { network }),\n  })\n}\n\n/** Capture declarative data only; never retain caller-owned objects or include values in errors. */\nexport function captureEnvironment(value: unknown): SandboxEnvironment {\n  if (\n    !isPlainRecord(value) ||\n    Object.keys(value).some((key) => ![\"source\", \"setup\", \"env\", \"network\"].includes(key))\n  ) {\n    return fail(\"environment\")\n  }\n  if (value.source !== undefined) validateSource(value.source)\n  if (value.setup !== undefined) validateSetup(value.setup)\n  if (value.env !== undefined) validateEnv(value.env)\n  if (value.network !== undefined) validateNetwork(value.network)\n  // Every field and discriminant has been checked above; return only an isolated snapshot.\n  return structuredClone(value) as SandboxEnvironment\n}\n\nfunction fail(field: string): never {\n  throw new SandboxError(`[Sixb] Invalid sandbox ${field}.`)\n}\n\nfunction validateSource(source: unknown): void {\n  if (\n    !isPlainRecord(source) ||\n    source.type !== \"git\" ||\n    typeof source.url !== \"string\" ||\n    Object.keys(source).some((key) => ![\"type\", \"url\", \"revision\", \"access\"].includes(key))\n  ) {\n    fail(\"source\")\n  }\n  const url = parseUrl(source.url, \"source URL\")\n  if (url.protocol !== \"https:\" || url.username || url.password || url.search || url.hash) {\n    fail(\"source URL: expected credential-free HTTPS\")\n  }\n\n  // The repository host joins the run's network, where \"*\" would open every matching domain.\n  if (url.hostname.includes(\"*\")) fail(\"source URL: wildcard hosts are not allowed\")\n\n  if (\n    source.revision !== undefined &&\n    (typeof source.revision !== \"string\" ||\n      !source.revision.trim() ||\n      source.revision.startsWith(\"-\") ||\n      /[\\x00-\\x1f]/.test(source.revision))\n  ) {\n    fail(\"source revision\")\n  }\n  if (source.access !== undefined && source.access !== \"read\" && source.access !== \"write\") {\n    fail(\"source access\")\n  }\n}\n\nfunction validateSetup(setup: unknown): void {\n  if (\n    !Array.isArray(setup) ||\n    setup.some(\n      (command) => typeof command !== \"string\" || !command.trim() || command.includes(\"\\0\")\n    )\n  ) {\n    fail(\"setup\")\n  }\n}\n\n/** Snapshot guest-readable variables under the recipe `env` rules; never include values in errors. */\nexport function captureSandboxEnv(value: unknown): Readonly<Record<string, string>> {\n  validateEnv(value)\n  return structuredClone(value)\n}\n\nfunction validateEnv(env: unknown): asserts env is Record<string, string> {\n  if (\n    !isPlainRecord(env) ||\n    Object.entries(env).some(\n      ([key, entry]) =>\n        !key || /[=\\0]/.test(key) || typeof entry !== \"string\" || entry.includes(\"\\0\")\n    )\n  ) {\n    fail(\"env\")\n  }\n}\n\nfunction validateNetwork(network: unknown): void {\n  if (!isPlainRecord(network)) fail(\"network\")\n  if (network.mode === \"restricted\") {\n    if (\n      Object.keys(network).some((key) => key !== \"mode\" && key !== \"allow\") ||\n      !Array.isArray(network.allow)\n    ) {\n      fail(\"network\")\n    }\n    for (const target of network.allow) validateNetworkTarget(target)\n    return\n  }\n  if (\n    (network.mode !== \"none\" && network.mode !== \"all\") ||\n    Object.keys(network).some((key) => key !== \"mode\")\n  ) {\n    fail(\"network\")\n  }\n}\n\nfunction validateNetworkTarget(target: unknown): void {\n  if (\n    !isPlainRecord(target) ||\n    typeof target.name !== \"string\" ||\n    !target.name.trim() ||\n    typeof target.origin !== \"string\" ||\n    Object.keys(target).some((key) => key !== \"name\" && key !== \"origin\")\n  ) {\n    fail(\"network target\")\n  }\n  const url = parseUrl(target.origin, \"network origin\")\n  if (![\"http:\", \"https:\"].includes(url.protocol) || url.origin !== target.origin) {\n    fail(\"network origin\")\n  }\n\n  // Providers such as Vercel read \"*\" in a domain as a wildcard: one target would open every\n  // matching domain. List each domain instead.\n  if (url.hostname.includes(\"*\")) fail(\"network origin: wildcard hosts are not allowed\")\n}\n\nfunction parseUrl(value: string, field: string): URL {\n  try {\n    return new URL(value)\n  } catch {\n    return fail(field)\n  }\n}\n\nfunction deepFreeze(value: object, seen = new Set<object>()): void {\n  if (seen.has(value)) return\n  seen.add(value)\n  for (const child of Object.values(value)) {\n    if (child !== null && typeof child === \"object\") deepFreeze(child, seen)\n  }\n  Object.freeze(value)\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;AAIO,MAAM,sBAAqB,MAAM;AAAA,EAC7B,OAAe;AAC1B;AAAA;AAGO,MAAM,sCAAqC,cAAa;AAAA,EAC3C,OAAO;AAC3B;AAAA;AAGO,MAAM,gCAA+B,cAAa;AAAA,EACrC,OAAO;AAC3B;AAAA;AAGO,MAAM,6BAA4B,cAAa;AAAA,EAClC,OAAO;AAC3B;AAAA;AAGO,MAAM,0CAAyC,cAAa;AAAA,EAC/C,OAAO;AAC3B;;;ACtBO,SAAS,iBAAiB,CAC/B,QACA,MACA,SACA,WAAwB,IAAI,KACtB;AAAA,EACN,IAAI,OAAO,WAAW,UAAU;AAAA,IAC9B,IAAI,kBAAkB,MAAM,GAAG;AAAA,MAC7B;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,IAAI;AAAA,EACpB;AAAA,EACA,IAAI,CAAC,cAAc,MAAM,KAAK,OAAO,OAAO,SAAS,YAAY,SAAS,IAAI,MAAM,GAAG;AAAA,IACrF,MAAM,QAAQ,IAAI;AAAA,EACpB;AAAA,EAEA,SAAS,IAAI,MAAM;AAAA,EACnB,QAAQ,OAAO;AAAA,SACR,QAAQ;AAAA,MACX,MAAM,SAAS,OAAO;AAAA,MACtB,MAAM,cAAc,kBAAkB,QAAQ,OAAO,SAAS;AAAA,MAC9D,IAAI,CAAC,eAAe,IAAI,IAAI,MAAM,EAAE,SAAS,OAAO,QAAQ;AAAA,QAC1D,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,IACF;AAAA,SACK;AAAA,MACH,kBAAkB,OAAO,OAAO,GAAG,cAAc,SAAS,QAAQ;AAAA,MAClE;AAAA,SACG;AAAA,MACH,IAAI,OAAO,cAAc,UAAU;AAAA,QACjC,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA,kBAAkB,OAAO,aAAa,GAAG,oBAAoB,SAAS,QAAQ;AAAA,MAC9E;AAAA,SACG,UAAU;AAAA,MACb,IAAI,CAAC,cAAc,OAAO,UAAU,GAAG;AAAA,QACrC,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA,YAAY,SAAS,UAAU,OAAO,QAAQ,OAAO,UAAU,GAAG;AAAA,QAChE,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,cAAc,KAAK,KAAK,EAAE,YAAY,QAAQ;AAAA,UACpE,MAAM,QAAQ,GAAG,mBAAmB,SAAS;AAAA,QAC/C;AAAA,QACA,IACG,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,aAC1D,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,aAC1D,MAAM,gBAAgB,cACpB,OAAO,MAAM,gBAAgB,YAAY,CAAC,MAAM,YAAY,KAAK,IACpE;AAAA,UACA,MAAM,QAAQ,GAAG,mBAAmB,SAAS;AAAA,QAC/C;AAAA,QACA,kBAAkB,MAAM,QAAQ,GAAG,mBAAmB,kBAAkB,SAAS,QAAQ;AAAA,MAC3F;AAAA,MACA;AAAA,IACF;AAAA,SACK;AAAA,MACH,IAAI,OAAO,OAAO,gBAAgB,YAAY,CAAC,OAAO,YAAY,KAAK,GAAG;AAAA,QACxE,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA,IAAI,OAAO,cAAc,WAAW;AAAA,QAClC,kBAAkB,OAAO,WAAW,GAAG,kBAAkB,SAAS,QAAQ;AAAA,MAC5E;AAAA,MACA;AAAA;AAAA,MAEA,MAAM,QAAQ,IAAI;AAAA;AAAA,EAEtB,SAAS,OAAO,MAAM;AAAA;AAGxB,SAAS,iBAAiB,CAAC,QAAiB,WAAyC;AAAA,EACnF,IAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG;AAAA,IACjD,OAAO;AAAA,EACT;AAAA,EAEA,SAAS,QAAQ,EAAG,QAAQ,OAAO,QAAQ,SAAS,GAAG;AAAA,IACrD,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,GAAG;AAAA,MACjC,OAAO;AAAA,IACT;AAAA,IACA,MAAM,QAAQ,OAAO;AAAA,IACrB,IACE,cAAc,WACV,OAAO,UAAU,WACjB,cAAc,aAAa,OAAO,UAAU,YAAY,CAAC,OAAO,UAAU,KAAK,GACnF;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,OAAO;AAAA;;;ACnCF,SAAS,uBAAqD,CACnE,QACA,UACmB;AAAA,EACnB,MAAM,MAAe;AAAA,EACrB,IACE,CAAC,cAAc,GAAG,KACjB,OAAO,WAAW,aAAa,CAAC,cAAc,IAAI,MAAM,KACxD,OAAO,YAAY,aAAa,OAAO,OAAO,YAAY,YAC3D;AAAA,IACA,MAAM,IAAI,cACR,8FACF;AAAA,EACF;AAAA,EACA,WAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AAAA,IACrC,IAAI,CAAC,CAAC,UAAU,WAAW,UAAU,SAAS,OAAO,WAAW,MAAM,EAAE,SAAS,GAAG,GAAG;AAAA,MACrF,MAAM,IAAI,cAAa,6CAA6C;AAAA,IACtE;AAAA,EACF;AAAA,EACA,IAAI,OAAO,SAAS,aAAa,OAAO,OAAO,MAAM,cAAc,YAAY;AAAA,IAC7E,MAAM,IAAI,cAAa,uDAAuD;AAAA,EAChF;AAAA,EACA,IAAI,OAAO,WAAW,aAAa,OAAO,YAAY,WAAW;AAAA,IAC/D,MAAM,IAAI,cAAa,mDAAmD;AAAA,EAC5E;AAAA,EACA,IAAI,OAAO,YAAY,cAAc,OAAO,WAAW,aAAa,OAAO,UAAU,YAAY;AAAA,IAC/F,MAAM,IAAI,cAAa,6DAA6D;AAAA,EACtF;AAAA,EACA,MAAM,UAAU,CAAC,SACf,IAAI,cAAa,UAAU,gEAAgE;AAAA,EAC7F,YAAY,IAAI,UAAU,OAAO,QAAQ,OAAO,UAAU,CAAC,CAAC,GAAG;AAAA,IAC7D,MAAM,OAAO,oBAAoB;AAAA,IACjC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,cAAc,KAAK;AAAA,MAAG,MAAM,QAAQ,IAAI;AAAA,IAC3D,WAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AAAA,MACpC,IAAI,CAAC,CAAC,UAAU,YAAY,YAAY,eAAe,cAAc,EAAE,SAAS,GAAG,GAAG;AAAA,QACpF,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,IACF;AAAA,IACA,IACG,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,aAC1D,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,aAC1D,MAAM,gBAAgB,aAAa,OAAO,MAAM,gBAAgB,YAChE,MAAM,iBAAiB,aAAa,OAAO,MAAM,iBAAiB;AAAA,MAEnE,MAAM,QAAQ,IAAI;AAAA,IACpB,MAAM,SAAkB,MAAM;AAAA,IAC9B,IAAI,cAAc,MAAM,KAAK,OAAO,SAAS,aAAa;AAAA,MACxD,IACE,OAAO,OAAO,iBAAiB,YAC/B,CAAC,SAAS,mBAAmB,EAAE,IAAI,OAAO,YAAY,GACtD;AAAA,QACA,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,IACF,EAAO;AAAA,MACL,kBAAkB,QAAQ,GAAG,eAAe,OAAO;AAAA;AAAA,EAEvD;AAAA,EACA,MAAM,SAAS,gBAAgB,OAAO,UAAU,CAAC,CAAC;AAAA,EAClD,MAAM,cAAc,qBAAoB,MAAM;AAAA,EAG9C,MAAM,UAAU,OAAO;AAAA,EACvB,MAAM,YAAY,OAAO,MAAM,UAAU,KAAK,OAAO,IAAI;AAAA,EACzD,WAAW,MAAM;AAAA,EACjB,OAAO,OAAO,OAAO;AAAA,IACnB;AAAA,OACI,YAAY,EAAE,MAAM,OAAO,OAAO,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC;AAAA,IAC1D,SAAS,SAAS,QAAQ,OAAO,WAAkC;AAAA,MACjE,MAAM,UAAU,gBAAgB,SAAS,kBAAkB,GAAG,QAAQ,OAAO;AAAA,QAC3E,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,MAAM;AAAA,MACR,CAAC;AAAA,MACD,MAAM,QAAQ,oBAAoB,QAAQ,SAAS,SAAS,kBAAkB,CAAC;AAAA,MAC/E,IAAI,CAAC;AAAA,QAAS,OAAO,gBAAgB,WAAW;AAAA,MAChD,MAAM,WAAW,mBAAmB,MAAM,QAAQ,EAAE,QAAQ,OAAO,KAAK,CAAC,CAAC;AAAA,MAC1E,OAAO;AAAA,WACF,gBAAgB,WAAW;AAAA,WAC3B;AAAA,QACH,KAAK,KAAK,YAAY,QAAQ,SAAS,IAAI;AAAA,MAC7C;AAAA;AAAA,EAEJ,CAAC;AAAA;AAmBI,SAAS,uBAAsB,CAAC,OAAuD;AAAA,EAC5F,QAAQ,4BAA4B,MAAM,WAAW;AAAA,EAErD,IAAI,QAAQ,WAAW,WAAW,SAAS,WAAW;AAAA,IACpD,OAAO;AAAA,EACT;AAAA,EACA,IAAI,SAAS,aAAa,CAAC,4BAA4B;AAAA,IACrD,OAAO;AAAA,EACT;AAAA,EAEA;AAAA;AAIK,SAAS,oBAAmB,CAAC,eAKb;AAAA,EACrB,QAAQ,QAAQ,OAAO,KAAK,YAAY;AAAA,EACxC,OAAO,mBAAmB;AAAA,OACpB,WAAW,YAAY,CAAC,IAAI,EAAE,OAAO;AAAA,OACrC,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM;AAAA,OACnC,QAAQ,YAAY,CAAC,IAAI,EAAE,IAAI;AAAA,OAC/B,YAAY,YAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,EAC7C,CAAC;AAAA;AAII,SAAS,kBAAkB,CAAC,OAAoC;AAAA,EACrE,IACE,CAAC,cAAc,KAAK,KACpB,OAAO,KAAK,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,UAAU,SAAS,OAAO,SAAS,EAAE,SAAS,GAAG,CAAC,GACrF;AAAA,IACA,OAAO,KAAK,aAAa;AAAA,EAC3B;AAAA,EACA,IAAI,MAAM,WAAW;AAAA,IAAW,eAAe,MAAM,MAAM;AAAA,EAC3D,IAAI,MAAM,UAAU;AAAA,IAAW,cAAc,MAAM,KAAK;AAAA,EACxD,IAAI,MAAM,QAAQ;AAAA,IAAW,YAAY,MAAM,GAAG;AAAA,EAClD,IAAI,MAAM,YAAY;AAAA,IAAW,gBAAgB,MAAM,OAAO;AAAA,EAE9D,OAAO,gBAAgB,KAAK;AAAA;AAG9B,SAAS,IAAI,CAAC,OAAsB;AAAA,EAClC,MAAM,IAAI,cAAa,0BAA0B,QAAQ;AAAA;AAG3D,SAAS,cAAc,CAAC,QAAuB;AAAA,EAC7C,IACE,CAAC,cAAc,MAAM,KACrB,OAAO,SAAS,SAChB,OAAO,OAAO,QAAQ,YACtB,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,OAAO,YAAY,QAAQ,EAAE,SAAS,GAAG,CAAC,GACtF;AAAA,IACA,KAAK,QAAQ;AAAA,EACf;AAAA,EACA,MAAM,MAAM,SAAS,OAAO,KAAK,YAAY;AAAA,EAC7C,IAAI,IAAI,aAAa,YAAY,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,MAAM;AAAA,IACvF,KAAK,4CAA4C;AAAA,EACnD;AAAA,EAGA,IAAI,IAAI,SAAS,SAAS,GAAG;AAAA,IAAG,KAAK,4CAA4C;AAAA,EAEjF,IACE,OAAO,aAAa,cACnB,OAAO,OAAO,aAAa,YAC1B,CAAC,OAAO,SAAS,KAAK,KACtB,OAAO,SAAS,WAAW,GAAG,KAC9B,cAAc,KAAK,OAAO,QAAQ,IACpC;AAAA,IACA,KAAK,iBAAiB;AAAA,EACxB;AAAA,EACA,IAAI,OAAO,WAAW,aAAa,OAAO,WAAW,UAAU,OAAO,WAAW,SAAS;AAAA,IACxF,KAAK,eAAe;AAAA,EACtB;AAAA;AAGF,SAAS,aAAa,CAAC,OAAsB;AAAA,EAC3C,IACE,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,KACJ,CAAC,YAAY,OAAO,YAAY,YAAY,CAAC,QAAQ,KAAK,KAAK,QAAQ,SAAS,MAAI,CACtF,GACA;AAAA,IACA,KAAK,OAAO;AAAA,EACd;AAAA;AAIK,SAAS,kBAAiB,CAAC,OAAkD;AAAA,EAClF,YAAY,KAAK;AAAA,EACjB,OAAO,gBAAgB,KAAK;AAAA;AAG9B,SAAS,WAAW,CAAC,KAAqD;AAAA,EACxE,IACE,CAAC,cAAc,GAAG,KAClB,OAAO,QAAQ,GAAG,EAAE,KAClB,EAAE,KAAK,WACL,CAAC,OAAO,QAAQ,KAAK,GAAG,KAAK,OAAO,UAAU,YAAY,MAAM,SAAS,MAAI,CACjF,GACA;AAAA,IACA,KAAK,KAAK;AAAA,EACZ;AAAA;AAGF,SAAS,eAAe,CAAC,SAAwB;AAAA,EAC/C,IAAI,CAAC,cAAc,OAAO;AAAA,IAAG,KAAK,SAAS;AAAA,EAC3C,IAAI,QAAQ,SAAS,cAAc;AAAA,IACjC,IACE,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,UAAU,QAAQ,OAAO,KACpE,CAAC,MAAM,QAAQ,QAAQ,KAAK,GAC5B;AAAA,MACA,KAAK,SAAS;AAAA,IAChB;AAAA,IACA,WAAW,UAAU,QAAQ;AAAA,MAAO,sBAAsB,MAAM;AAAA,IAChE;AAAA,EACF;AAAA,EACA,IACG,QAAQ,SAAS,UAAU,QAAQ,SAAS,SAC7C,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,MAAM,GACjD;AAAA,IACA,KAAK,SAAS;AAAA,EAChB;AAAA;AAGF,SAAS,qBAAqB,CAAC,QAAuB;AAAA,EACpD,IACE,CAAC,cAAc,MAAM,KACrB,OAAO,OAAO,SAAS,YACvB,CAAC,OAAO,KAAK,KAAK,KAClB,OAAO,OAAO,WAAW,YACzB,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,QAAQ,QAAQ,UAAU,QAAQ,QAAQ,GACpE;AAAA,IACA,KAAK,gBAAgB;AAAA,EACvB;AAAA,EACA,MAAM,MAAM,SAAS,OAAO,QAAQ,gBAAgB;AAAA,EACpD,IAAI,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAAK,IAAI,WAAW,OAAO,QAAQ;AAAA,IAC/E,KAAK,gBAAgB;AAAA,EACvB;AAAA,EAIA,IAAI,IAAI,SAAS,SAAS,GAAG;AAAA,IAAG,KAAK,gDAAgD;AAAA;AAGvF,SAAS,QAAQ,CAAC,OAAe,OAAoB;AAAA,EACnD,IAAI;AAAA,IACF,OAAO,IAAI,IAAI,KAAK;AAAA,IACpB,MAAM;AAAA,IACN,OAAO,KAAK,KAAK;AAAA;AAAA;AAIrB,SAAS,UAAU,CAAC,OAAe,OAAO,IAAI,KAAqB;AAAA,EACjE,IAAI,KAAK,IAAI,KAAK;AAAA,IAAG;AAAA,EACrB,KAAK,IAAI,KAAK;AAAA,EACd,WAAW,SAAS,OAAO,OAAO,KAAK,GAAG;AAAA,IACxC,IAAI,UAAU,QAAQ,OAAO,UAAU;AAAA,MAAU,WAAW,OAAO,IAAI;AAAA,EACzE;AAAA,EACA,OAAO,OAAO,KAAK;AAAA;",
+  "debugId": "365C30ED7D7790B264756E2164756E21",
+  "names": []
+}

package/dist/chunk-d7vyc7k6.js

@@ -0,0 +1,10 @@
+// @bun
+// src/artifacts/kinds.ts
+var ARTIFACT_KINDS2 = ["document", "sheet", "slides", "page", "canvas", "file"];
+function isArtifactKind(value) {
+  return typeof value === "string" && ARTIFACT_KINDS2.includes(value);
+}
+
+export { ARTIFACT_KINDS2, isArtifactKind };
+
+//# debugId=3BDE53AC75FAAD3364756E2164756E21

package/dist/chunk-d7vyc7k6.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/artifacts/kinds.ts"],
+  "sourcesContent": [
+    "/** The kinds of artifact Sixb renders. An artifact's kind is fixed when it is created. */\nexport const ARTIFACT_KINDS = [\"document\", \"sheet\", \"slides\", \"page\", \"canvas\", \"file\"] as const\n\nexport type ArtifactKind = (typeof ARTIFACT_KINDS)[number]\n\nexport function isArtifactKind(value: unknown): value is ArtifactKind {\n  return typeof value === \"string\" && (ARTIFACT_KINDS as readonly string[]).includes(value)\n}\n"
+  ],
+  "mappings": ";;AACO,IAAM,kBAAiB,CAAC,YAAY,SAAS,UAAU,QAAQ,UAAU,MAAM;AAI/E,SAAS,cAAc,CAAC,OAAuC;AAAA,EACpE,OAAO,OAAO,UAAU,YAAa,gBAAqC,SAAS,KAAK;AAAA;",
+  "debugId": "3BDE53AC75FAAD3364756E2164756E21",
+  "names": []
+}

package/dist/{chunk-vyf9kfqf.js → chunk-dp0cdtj2.js}

@@ -1,10 +1,10 @@
 // @bun
 import {
   createSixbError2
-} from "./chunk-8mx7qw3y.js";
+} from "./chunk-zbc929zg.js";
 import {
   aiLimitSubjectKey2
-} from "./chunk-4as3wt1c.js";
+} from "./chunk-4ymrcdbm.js";
 
 // src/storage/ai-limits/enforcement.ts
 function aiLimitSubjectsFromAttribution2(requestedBy, requesterGroupIds) {

package/dist/{chunk-6x0pqh32.js → chunk-e5wf5vz0.js}

@@ -4,6 +4,7 @@ import {
 } from "./chunk-cqr3acm1.js";
 
 // src/ontology/json-schema.ts
+var USER_REF_DESCRIPTION = 'A Sixb user, written {"type":"user","id":"<user-id>"}.';
 function schemaRecordToJsonSchema2(input) {
   return schemaFieldsToJsonSchema2({
     fields: Object.fromEntries(Object.entries(input.shape).map(([field, schema]) => [field, { schema, required: true }])),
@@ -72,6 +73,7 @@ function schemaJsonSchema(schema, valueTypesById, resolving) {
       case "userRef":
         return {
           type: "object",
+          description: USER_REF_DESCRIPTION,
           properties: {
             type: { type: "string", enum: ["user"] },
             id: { type: "string", minLength: 1 }
@@ -121,4 +123,4 @@ function schemaJsonSchema(schema, valueTypesById, resolving) {
 
 export { schemaRecordToJsonSchema2, schemaFieldsToJsonSchema2 };
 
-//# debugId=5F91F59559F72A6064756E2164756E21
+//# debugId=63DCFBB1C93FA8A864756E2164756E21

package/dist/chunk-e5wf5vz0.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/ontology/json-schema.ts"],
+  "sourcesContent": [
+    "import type { JsonObject } from \"../json\"\nimport { OntologyValidationError } from \"./errors\"\nimport type { SchemaOrRef } from \"./refs\"\nimport type { Schema, ValueType } from \"./types\"\n\n// A user reference carries no name, so whoever reads the schema is told how one is written.\nconst USER_REF_DESCRIPTION = 'A Sixb user, written {\"type\":\"user\",\"id\":\"<user-id>\"}.'\n\ntype DeepReadonly<T> = T extends object ? { readonly [K in keyof T]: DeepReadonly<T[K]> } : T\n\nexport interface SchemaJsonField {\n  readonly schema: DeepReadonly<SchemaOrRef>\n  readonly required?: boolean\n  readonly nullable?: boolean\n}\n\n/** Convert a record of Sixb schemas into the strict JSON object schema used by model outputs. */\nexport function schemaRecordToJsonSchema(input: {\n  readonly shape: Readonly<Record<string, DeepReadonly<SchemaOrRef>>>\n  readonly valueTypesById: ReadonlyMap<string, ValueType>\n}): JsonObject {\n  return schemaFieldsToJsonSchema({\n    fields: Object.fromEntries(\n      Object.entries(input.shape).map(([field, schema]) => [field, { schema, required: true }])\n    ),\n    valueTypesById: input.valueTypesById,\n  })\n}\n\n/** Convert configured fields into the strict JSON object schema accepted at runtime. */\nexport function schemaFieldsToJsonSchema(input: {\n  readonly fields: Readonly<Record<string, SchemaJsonField>>\n  readonly valueTypesById: ReadonlyMap<string, ValueType>\n}): JsonObject {\n  const required = Object.entries(input.fields)\n    .filter(([, field]) => field.required === true)\n    .map(([field]) => field)\n  return {\n    type: \"object\",\n    properties: Object.fromEntries(\n      Object.entries(input.fields).map(([fieldId, field]) => {\n        const fieldSchema = schemaOrRefJsonSchema(field.schema, input.valueTypesById, new Set())\n        return [fieldId, field.nullable ? { anyOf: [fieldSchema, { type: \"null\" }] } : fieldSchema]\n      })\n    ),\n    ...(required.length > 0 ? { required } : {}),\n    additionalProperties: false,\n  }\n}\n\nfunction schemaOrRefJsonSchema(\n  schema: DeepReadonly<SchemaOrRef>,\n  valueTypesById: ReadonlyMap<string, ValueType>,\n  resolving: ReadonlySet<string>\n): JsonObject {\n  if (typeof schema !== \"string\" && schema.type === \"objectRef\") {\n    return {\n      type: \"object\",\n      properties: {\n        objectTypeId: { type: \"string\", const: schema.objectTypeId },\n        primaryId: { type: \"string\" },\n      },\n      required: [\"objectTypeId\", \"primaryId\"],\n      additionalProperties: false,\n    }\n  }\n  return schemaJsonSchema(schema, valueTypesById, resolving)\n}\n\nfunction schemaJsonSchema(\n  schema: DeepReadonly<Schema>,\n  valueTypesById: ReadonlyMap<string, ValueType>,\n  resolving: ReadonlySet<string>\n): JsonObject {\n  if (typeof schema === \"string\") {\n    switch (schema) {\n      case \"string\":\n        return { type: \"string\" }\n      case \"integer\":\n        return { type: \"integer\" }\n      case \"double\":\n        return { type: \"number\" }\n      case \"decimal\":\n        return { type: \"string\", pattern: \"^[+-]?\\\\d+(?:\\\\.\\\\d+)?$\" }\n      case \"boolean\":\n        return { type: \"boolean\" }\n      case \"date\":\n        return { type: \"string\", format: \"date\" }\n      case \"timestamp\":\n        return { type: \"string\", format: \"date-time\" }\n      case \"uuid\":\n        return { type: \"string\", format: \"uuid\" }\n      case \"fileRef\":\n        return {\n          type: \"object\",\n          properties: {\n            blobId: { type: \"string\" },\n            digest: { type: \"string\", pattern: \"^sha256:[a-fA-F0-9]{64}$\" },\n            sizeBytes: { type: \"integer\", minimum: 0 },\n            fileName: { type: \"string\" },\n            mediaType: { type: \"string\" },\n            logicalPath: { type: \"string\" },\n          },\n          required: [\"blobId\", \"digest\", \"sizeBytes\"],\n          additionalProperties: false,\n        }\n      case \"userRef\":\n        return {\n          type: \"object\",\n          description: USER_REF_DESCRIPTION,\n          properties: {\n            type: { type: \"string\", enum: [\"user\"] },\n            id: { type: \"string\", minLength: 1 },\n          },\n          required: [\"type\", \"id\"],\n          additionalProperties: false,\n        }\n      default:\n        schema satisfies never\n    }\n  }\n\n  if (schema.type === \"enum\") return { enum: [...schema.values] }\n  if (schema.type === \"array\") {\n    return { type: \"array\", items: schemaJsonSchema(schema.items, valueTypesById, resolving) }\n  }\n  if (schema.type === \"map\") {\n    return {\n      type: \"object\",\n      additionalProperties: schemaJsonSchema(schema.valueSchema, valueTypesById, resolving),\n    }\n  }\n  if (schema.type === \"object\") {\n    const required: string[] = []\n    const properties = Object.fromEntries(\n      Object.entries(schema.properties).map(([fieldId, field]) => {\n        if (field.required) required.push(fieldId)\n        const fieldSchema = schemaJsonSchema(field.schema, valueTypesById, resolving)\n        return [fieldId, field.nullable ? { anyOf: [fieldSchema, { type: \"null\" }] } : fieldSchema]\n      })\n    )\n    return {\n      type: \"object\",\n      properties,\n      ...(required.length > 0 ? { required } : {}),\n      additionalProperties: false,\n    }\n  }\n\n  const valueTypeId = schema.valueTypeId\n  if (resolving.has(valueTypeId)) {\n    throw new OntologyValidationError(\n      `Structured output contains a recursive value type '${valueTypeId}'.`\n    )\n  }\n  const resolved = schema._resolved ?? valueTypesById.get(valueTypeId)?.schema\n  if (!resolved) {\n    throw new OntologyValidationError(\n      `Structured output references unknown value type '${valueTypeId}'.`\n    )\n  }\n  return schemaJsonSchema(resolved, valueTypesById, new Set([...resolving, valueTypeId]))\n}\n"
+  ],
+  "mappings": ";;;;;;AAMA,IAAM,uBAAuB;AAWtB,SAAS,yBAAwB,CAAC,OAG1B;AAAA,EACb,OAAO,0BAAyB;AAAA,IAC9B,QAAQ,OAAO,YACb,OAAO,QAAQ,MAAM,KAAK,EAAE,IAAI,EAAE,OAAO,YAAY,CAAC,OAAO,EAAE,QAAQ,UAAU,KAAK,CAAC,CAAC,CAC1F;AAAA,IACA,gBAAgB,MAAM;AAAA,EACxB,CAAC;AAAA;AAII,SAAS,yBAAwB,CAAC,OAG1B;AAAA,EACb,MAAM,WAAW,OAAO,QAAQ,MAAM,MAAM,EACzC,OAAO,IAAI,WAAW,MAAM,aAAa,IAAI,EAC7C,IAAI,EAAE,WAAW,KAAK;AAAA,EACzB,OAAO;AAAA,IACL,MAAM;AAAA,IACN,YAAY,OAAO,YACjB,OAAO,QAAQ,MAAM,MAAM,EAAE,IAAI,EAAE,SAAS,WAAW;AAAA,MACrD,MAAM,cAAc,sBAAsB,MAAM,QAAQ,MAAM,gBAAgB,IAAI,GAAK;AAAA,MACvF,OAAO,CAAC,SAAS,MAAM,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC,EAAE,IAAI,WAAW;AAAA,KAC3F,CACH;AAAA,OACI,SAAS,SAAS,IAAI,EAAE,SAAS,IAAI,CAAC;AAAA,IAC1C,sBAAsB;AAAA,EACxB;AAAA;AAGF,SAAS,qBAAqB,CAC5B,QACA,gBACA,WACY;AAAA,EACZ,IAAI,OAAO,WAAW,YAAY,OAAO,SAAS,aAAa;AAAA,IAC7D,OAAO;AAAA,MACL,MAAM;AAAA,MACN,YAAY;AAAA,QACV,cAAc,EAAE,MAAM,UAAU,OAAO,OAAO,aAAa;AAAA,QAC3D,WAAW,EAAE,MAAM,SAAS;AAAA,MAC9B;AAAA,MACA,UAAU,CAAC,gBAAgB,WAAW;AAAA,MACtC,sBAAsB;AAAA,IACxB;AAAA,EACF;AAAA,EACA,OAAO,iBAAiB,QAAQ,gBAAgB,SAAS;AAAA;AAG3D,SAAS,gBAAgB,CACvB,QACA,gBACA,WACY;AAAA,EACZ,IAAI,OAAO,WAAW,UAAU;AAAA,IAC9B,QAAQ;AAAA,WACD;AAAA,QACH,OAAO,EAAE,MAAM,SAAS;AAAA,WACrB;AAAA,QACH,OAAO,EAAE,MAAM,UAAU;AAAA,WACtB;AAAA,QACH,OAAO,EAAE,MAAM,SAAS;AAAA,WACrB;AAAA,QACH,OAAO,EAAE,MAAM,UAAU,SAAS,0BAA0B;AAAA,WACzD;AAAA,QACH,OAAO,EAAE,MAAM,UAAU;AAAA,WACtB;AAAA,QACH,OAAO,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,WACrC;AAAA,QACH,OAAO,EAAE,MAAM,UAAU,QAAQ,YAAY;AAAA,WAC1C;AAAA,QACH,OAAO,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,WACrC;AAAA,QACH,OAAO;AAAA,UACL,MAAM;AAAA,UACN,YAAY;AAAA,YACV,QAAQ,EAAE,MAAM,SAAS;AAAA,YACzB,QAAQ,EAAE,MAAM,UAAU,SAAS,2BAA2B;AAAA,YAC9D,WAAW,EAAE,MAAM,WAAW,SAAS,EAAE;AAAA,YACzC,UAAU,EAAE,MAAM,SAAS;AAAA,YAC3B,WAAW,EAAE,MAAM,SAAS;AAAA,YAC5B,aAAa,EAAE,MAAM,SAAS;AAAA,UAChC;AAAA,UACA,UAAU,CAAC,UAAU,UAAU,WAAW;AAAA,UAC1C,sBAAsB;AAAA,QACxB;AAAA,WACG;AAAA,QACH,OAAO;AAAA,UACL,MAAM;AAAA,UACN,aAAa;AAAA,UACb,YAAY;AAAA,YACV,MAAM,EAAE,MAAM,UAAU,MAAM,CAAC,MAAM,EAAE;AAAA,YACvC,IAAI,EAAE,MAAM,UAAU,WAAW,EAAE;AAAA,UACrC;AAAA,UACA,UAAU,CAAC,QAAQ,IAAI;AAAA,UACvB,sBAAsB;AAAA,QACxB;AAAA;AAAA;AAAA,EAIN;AAAA,EAEA,IAAI,OAAO,SAAS;AAAA,IAAQ,OAAO,EAAE,MAAM,CAAC,GAAG,OAAO,MAAM,EAAE;AAAA,EAC9D,IAAI,OAAO,SAAS,SAAS;AAAA,IAC3B,OAAO,EAAE,MAAM,SAAS,OAAO,iBAAiB,OAAO,OAAO,gBAAgB,SAAS,EAAE;AAAA,EAC3F;AAAA,EACA,IAAI,OAAO,SAAS,OAAO;AAAA,IACzB,OAAO;AAAA,MACL,MAAM;AAAA,MACN,sBAAsB,iBAAiB,OAAO,aAAa,gBAAgB,SAAS;AAAA,IACtF;AAAA,EACF;AAAA,EACA,IAAI,OAAO,SAAS,UAAU;AAAA,IAC5B,MAAM,WAAqB,CAAC;AAAA,IAC5B,MAAM,aAAa,OAAO,YACxB,OAAO,QAAQ,OAAO,UAAU,EAAE,IAAI,EAAE,SAAS,WAAW;AAAA,MAC1D,IAAI,MAAM;AAAA,QAAU,SAAS,KAAK,OAAO;AAAA,MACzC,MAAM,cAAc,iBAAiB,MAAM,QAAQ,gBAAgB,SAAS;AAAA,MAC5E,OAAO,CAAC,SAAS,MAAM,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC,EAAE,IAAI,WAAW;AAAA,KAC3F,CACH;AAAA,IACA,OAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,SACI,SAAS,SAAS,IAAI,EAAE,SAAS,IAAI,CAAC;AAAA,MAC1C,sBAAsB;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,OAAO;AAAA,EAC3B,IAAI,UAAU,IAAI,WAAW,GAAG;AAAA,IAC9B,MAAM,IAAI,yBACR,sDAAsD,eACxD;AAAA,EACF;AAAA,EACA,MAAM,WAAW,OAAO,aAAa,eAAe,IAAI,WAAW,GAAG;AAAA,EACtE,IAAI,CAAC,UAAU;AAAA,IACb,MAAM,IAAI,yBACR,oDAAoD,eACtD;AAAA,EACF;AAAA,EACA,OAAO,iBAAiB,UAAU,gBAAgB,IAAI,IAAI,CAAC,GAAG,WAAW,WAAW,CAAC,CAAC;AAAA;",
+  "debugId": "63DCFBB1C93FA8A864756E2164756E21",
+  "names": []
+}