@sixb/core 0.1.20 → 0.1.22

package/dist/{chunk-jhm3zsa7.js.map → chunk-wkv3h3q7.js.map}

@@ -3,10 +3,10 @@
   "sources": ["../src/blob-storage/derive.ts", "../src/blob-storage/media-type.ts", "../src/blob-storage/validation.ts"],
   "sourcesContent": [
     "import type { BlobDigest } from \"./types\"\n\n// Pure, crypto-free derivations of blob identity from a digest. Kept out of\n// `utils.ts` (which imports `node:crypto`) so the browser-safe `./browser`\n// barrel can reuse them without dragging Node crypto into the client bundle.\n\nexport function blobDigestHex(digest: BlobDigest): string {\n  return digest.slice(\"sha256:\".length)\n}\n\nexport function blobIdFromDigest(digest: BlobDigest): string {\n  return `blob_${blobDigestHex(digest)}`\n}\n",
-    "// One media type as RFC 9110 defines it: `type/subtype`, each a token, then optional\n// `;name=value` parameters whose value is a token or a quoted string. Stricter than the RFC where\n// leniency only invites a second reading: no surrounding whitespace, no empty parameters, no\n// escapes, and no comma anywhere. Browsers read a comma-separated value as a list of types and\n// use the last valid one, so a value with a comma can mean something other than its first type.\nconst TOKEN = \"[!#$%&'*+.^_`|~0-9A-Za-z-]+\"\nconst QUOTED_STRING = '\"[\\\\t\\\\x20\\\\x21\\\\x23-\\\\x2b\\\\x2d-\\\\x5b\\\\x5d-\\\\x7e]*\"'\nconst PARAMETER = `[\\\\t ]*;[\\\\t ]*(${TOKEN})=(${TOKEN}|${QUOTED_STRING})`\nconst MEDIA_TYPE_PATTERN = new RegExp(`^(${TOKEN})/(${TOKEN})((?:${PARAMETER})*)$`)\nconst PARAMETER_PATTERN = new RegExp(PARAMETER, \"g\")\n\n/**\n * The canonical form of a single well-formed media type, or `null` for anything else.\n *\n * Type, subtype, and parameter names are case-insensitive, so they are lowercased; parameter\n * values keep their case. `\"Text/Plain; Charset=UTF-8\"` becomes `\"text/plain;charset=UTF-8\"`.\n */\nexport function canonicalMediaType(value: unknown): string | null {\n  if (typeof value !== \"string\") return null\n  const match = MEDIA_TYPE_PATTERN.exec(value)\n  if (!match) return null\n\n  const [, type, subtype, parameters] = match\n  let canonical = `${type.toLowerCase()}/${subtype.toLowerCase()}`\n  for (const [, name, parameterValue] of parameters.matchAll(PARAMETER_PATTERN)) {\n    canonical += `;${name.toLowerCase()}=${parameterValue}`\n  }\n  return canonical\n}\n",
+    "// One media type as RFC 9110 defines it: `type/subtype`, each a token, then optional\n// `;name=value` parameters whose value is a token or a quoted string. Stricter than the RFC where\n// leniency only invites a second reading: no surrounding whitespace, no empty parameters, no\n// escapes, and no comma anywhere. Browsers read a comma-separated value as a list of types and\n// use the last valid one, so a value with a comma can mean something other than its first type.\nconst TOKEN = \"[!#$%&'*+.^_`|~0-9A-Za-z-]+\"\nconst QUOTED_STRING = '\"[\\\\t\\\\x20\\\\x21\\\\x23-\\\\x2b\\\\x2d-\\\\x5b\\\\x5d-\\\\x7e]*\"'\nconst PARAMETER = `[\\\\t ]*;[\\\\t ]*(${TOKEN})=(${TOKEN}|${QUOTED_STRING})`\nconst MEDIA_TYPE_PATTERN = new RegExp(`^(${TOKEN})/(${TOKEN})((?:${PARAMETER})*)$`)\nconst PARAMETER_PATTERN = new RegExp(PARAMETER, \"g\")\n\n/**\n * The canonical form of a single well-formed media type, or `null` for anything else.\n *\n * Type, subtype, and parameter names are case-insensitive, so they are lowercased; parameter\n * values keep their case. `\"Text/Plain; Charset=UTF-8\"` becomes `\"text/plain;charset=UTF-8\"`.\n */\nexport function canonicalMediaType(value: unknown): string | null {\n  if (typeof value !== \"string\") return null\n  const match = MEDIA_TYPE_PATTERN.exec(value)\n  if (!match) return null\n\n  const [, type, subtype, parameters] = match\n  let canonical = `${type.toLowerCase()}/${subtype.toLowerCase()}`\n  for (const [, name, parameterValue] of parameters.matchAll(PARAMETER_PATTERN)) {\n    canonical += `;${name.toLowerCase()}=${parameterValue}`\n  }\n  return canonical\n}\n\n/**\n * The media type a file's bytes declare by their leading signature, or `undefined` when they carry\n * none this function knows. Only formats with an unambiguous signature are recognized; text formats\n * have none and are left to the file name.\n */\nexport function sniffFileMediaType(bytes: Uint8Array): string | undefined {\n  if (startsWith(bytes, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])) return \"image/png\"\n  if (startsWith(bytes, [0xff, 0xd8, 0xff])) return \"image/jpeg\"\n  if (asciiAt(bytes, 0, \"GIF87a\") || asciiAt(bytes, 0, \"GIF89a\")) return \"image/gif\"\n  if (asciiAt(bytes, 0, \"RIFF\") && asciiAt(bytes, 8, \"WEBP\")) return \"image/webp\"\n  if (asciiAt(bytes, 0, \"%PDF-\")) return \"application/pdf\"\n  return undefined\n}\n\n/**\n * The media type of a file handed over without one: its bytes' signature when they have one, else\n * its extension, else `application/octet-stream`. Every place that classifies a sandbox or tool file\n * goes through this one table, so the same file gets the same type wherever it comes from.\n */\nexport function inferFileMediaType(fileName: string, bytes?: Uint8Array): string {\n  const sniffed = bytes === undefined ? undefined : sniffFileMediaType(bytes)\n  if (sniffed) return sniffed\n  const dot = fileName.lastIndexOf(\".\")\n  const extension = dot < 0 ? \"\" : fileName.slice(dot).toLowerCase()\n  return EXTENSION_MEDIA_TYPES[extension] ?? \"application/octet-stream\"\n}\n\nconst EXTENSION_MEDIA_TYPES: Readonly<Record<string, string>> = {\n  \".bmp\": \"image/bmp\",\n  \".css\": \"text/css\",\n  \".csv\": \"text/csv\",\n  \".docx\": \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n  \".gif\": \"image/gif\",\n  \".htm\": \"text/html\",\n  \".html\": \"text/html\",\n  \".jpeg\": \"image/jpeg\",\n  \".jpg\": \"image/jpeg\",\n  \".js\": \"application/javascript\",\n  \".json\": \"application/json\",\n  \".jsonl\": \"application/x-ndjson\",\n  \".markdown\": \"text/markdown\",\n  \".md\": \"text/markdown\",\n  \".mjs\": \"application/javascript\",\n  \".pdf\": \"application/pdf\",\n  \".png\": \"image/png\",\n  \".pptx\": \"application/vnd.openxmlformats-officedocument.presentationml.presentation\",\n  \".svg\": \"image/svg+xml\",\n  \".tsv\": \"text/tab-separated-values\",\n  \".txt\": \"text/plain\",\n  \".webp\": \"image/webp\",\n  \".xlsx\": \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n  \".xml\": \"application/xml\",\n  \".yaml\": \"application/yaml\",\n  \".yml\": \"application/yaml\",\n  \".zip\": \"application/zip\",\n}\n\nfunction startsWith(bytes: Uint8Array, signature: readonly number[]): boolean {\n  return signature.every((byte, index) => bytes[index] === byte)\n}\n\nfunction asciiAt(bytes: Uint8Array, offset: number, value: string): boolean {\n  if (bytes.byteLength < offset + value.length) return false\n  for (let index = 0; index < value.length; index += 1) {\n    if (bytes[offset + index] !== value.charCodeAt(index)) return false\n  }\n  return true\n}\n",
     "import { isPlainRecord } from \"../json\"\nimport { blobIdFromDigest } from \"./derive\"\nimport { canonicalMediaType } from \"./media-type\"\nimport type {\n  BlobDigest,\n  BlobStorage,\n  DirectUploadBlobStorage,\n  FileRef,\n  RangeReadableBlobStorage,\n} from \"./types\"\n\nexport function isBlobDigest(value: unknown): value is BlobDigest {\n  return typeof value === \"string\" && value.startsWith(\"sha256:\") && value.length > \"sha256:\".length\n}\n\nexport function isFileRef(value: unknown): value is FileRef {\n  return (\n    isPlainRecord(value) &&\n    typeof value.blobId === \"string\" &&\n    value.blobId.trim().length > 0 &&\n    isBlobDigest(value.digest) &&\n    // Blob identity is content-addressed: the id must be derivable from the digest.\n    // Rejecting a mismatch guards against tampered or malformed references.\n    value.blobId === blobIdFromDigest(value.digest) &&\n    typeof value.sizeBytes === \"number\" &&\n    Number.isInteger(value.sizeBytes) &&\n    value.sizeBytes >= 0 &&\n    (value.fileName === undefined || typeof value.fileName === \"string\") &&\n    (value.mediaType === undefined || typeof value.mediaType === \"string\") &&\n    (value.logicalPath === undefined || typeof value.logicalPath === \"string\")\n  )\n}\n\n/**\n * `isFileRef`, plus a `mediaType` that, when present, is exactly one media type. Paths that store\n * a reference a caller hands them use this. Reads keep `isFileRef`, so references stored before\n * the rule still load; file routes re-parse the type before serving it.\n */\nexport function isValidFileRef(value: unknown): value is FileRef {\n  return (\n    isFileRef(value) &&\n    (value.mediaType === undefined || canonicalMediaType(value.mediaType) !== null)\n  )\n}\n\nexport function supportsDirectUpload(\n  storage: BlobStorage\n): storage is BlobStorage & DirectUploadBlobStorage {\n  const candidate = storage as Partial<DirectUploadBlobStorage>\n  return (\n    typeof candidate.createUpload === \"function\" &&\n    typeof candidate.signUploadPart === \"function\" &&\n    typeof candidate.completeUpload === \"function\" &&\n    typeof candidate.abortUpload === \"function\"\n  )\n}\n\nexport function supportsRangeRead(\n  storage: BlobStorage\n): storage is BlobStorage & RangeReadableBlobStorage {\n  const candidate = storage as Partial<RangeReadableBlobStorage>\n  return typeof candidate.openRange === \"function\"\n}\n"
   ],
-  "mappings": ";;;;;;AAMO,SAAS,cAAa,CAAC,QAA4B;AAAA,EACxD,OAAO,OAAO,MAAM,UAAU,MAAM;AAAA;AAG/B,SAAS,iBAAgB,CAAC,QAA4B;AAAA,EAC3D,OAAO,QAAQ,eAAc,MAAM;AAAA;;;ACNrC,IAAM,QAAQ;AACd,IAAM,gBAAgB;AACtB,IAAM,YAAY,mBAAmB,WAAW,SAAS;AACzD,IAAM,qBAAqB,IAAI,OAAO,KAAK,WAAW,aAAa,eAAe;AAClF,IAAM,oBAAoB,IAAI,OAAO,WAAW,GAAG;AAQ5C,SAAS,mBAAkB,CAAC,OAA+B;AAAA,EAChE,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,QAAQ,mBAAmB,KAAK,KAAK;AAAA,EAC3C,IAAI,CAAC;AAAA,IAAO,OAAO;AAAA,EAEnB,SAAS,MAAM,SAAS,cAAc;AAAA,EACtC,IAAI,YAAY,GAAG,KAAK,YAAY,KAAK,QAAQ,YAAY;AAAA,EAC7D,cAAc,MAAM,mBAAmB,WAAW,SAAS,iBAAiB,GAAG;AAAA,IAC7E,aAAa,IAAI,KAAK,YAAY,KAAK;AAAA,EACzC;AAAA,EACA,OAAO;AAAA;;;AChBF,SAAS,aAAY,CAAC,OAAqC;AAAA,EAChE,OAAO,OAAO,UAAU,YAAY,MAAM,WAAW,SAAS,KAAK,MAAM,SAAS,UAAU;AAAA;AAGvF,SAAS,UAAS,CAAC,OAAkC;AAAA,EAC1D,OACE,cAAc,KAAK,KACnB,OAAO,MAAM,WAAW,YACxB,MAAM,OAAO,KAAK,EAAE,SAAS,KAC7B,cAAa,MAAM,MAAM,KAGzB,MAAM,WAAW,kBAAiB,MAAM,MAAM,KAC9C,OAAO,MAAM,cAAc,YAC3B,OAAO,UAAU,MAAM,SAAS,KAChC,MAAM,aAAa,MAClB,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,cAC1D,MAAM,cAAc,aAAa,OAAO,MAAM,cAAc,cAC5D,MAAM,gBAAgB,aAAa,OAAO,MAAM,gBAAgB;AAAA;AAS9D,SAAS,cAAc,CAAC,OAAkC;AAAA,EAC/D,OACE,WAAU,KAAK,MACd,MAAM,cAAc,aAAa,oBAAmB,MAAM,SAAS,MAAM;AAAA;AAIvE,SAAS,qBAAoB,CAClC,SACkD;AAAA,EAClD,MAAM,YAAY;AAAA,EAClB,OACE,OAAO,UAAU,iBAAiB,cAClC,OAAO,UAAU,mBAAmB,cACpC,OAAO,UAAU,mBAAmB,cACpC,OAAO,UAAU,gBAAgB;AAAA;AAI9B,SAAS,kBAAiB,CAC/B,SACmD;AAAA,EACnD,MAAM,YAAY;AAAA,EAClB,OAAO,OAAO,UAAU,cAAc;AAAA;",
-  "debugId": "91CB77087AB7E2E164756E2164756E21",
+  "mappings": ";;;;;;AAMO,SAAS,cAAa,CAAC,QAA4B;AAAA,EACxD,OAAO,OAAO,MAAM,UAAU,MAAM;AAAA;AAG/B,SAAS,iBAAgB,CAAC,QAA4B;AAAA,EAC3D,OAAO,QAAQ,eAAc,MAAM;AAAA;;;ACNrC,IAAM,QAAQ;AACd,IAAM,gBAAgB;AACtB,IAAM,YAAY,mBAAmB,WAAW,SAAS;AACzD,IAAM,qBAAqB,IAAI,OAAO,KAAK,WAAW,aAAa,eAAe;AAClF,IAAM,oBAAoB,IAAI,OAAO,WAAW,GAAG;AAQ5C,SAAS,mBAAkB,CAAC,OAA+B;AAAA,EAChE,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,QAAQ,mBAAmB,KAAK,KAAK;AAAA,EAC3C,IAAI,CAAC;AAAA,IAAO,OAAO;AAAA,EAEnB,SAAS,MAAM,SAAS,cAAc;AAAA,EACtC,IAAI,YAAY,GAAG,KAAK,YAAY,KAAK,QAAQ,YAAY;AAAA,EAC7D,cAAc,MAAM,mBAAmB,WAAW,SAAS,iBAAiB,GAAG;AAAA,IAC7E,aAAa,IAAI,KAAK,YAAY,KAAK;AAAA,EACzC;AAAA,EACA,OAAO;AAAA;AAQF,SAAS,mBAAkB,CAAC,OAAuC;AAAA,EACxE,IAAI,WAAW,OAAO,CAAC,KAAM,IAAM,IAAM,IAAM,IAAM,IAAM,IAAM,EAAI,CAAC;AAAA,IAAG,OAAO;AAAA,EAChF,IAAI,WAAW,OAAO,CAAC,KAAM,KAAM,GAAI,CAAC;AAAA,IAAG,OAAO;AAAA,EAClD,IAAI,QAAQ,OAAO,GAAG,QAAQ,KAAK,QAAQ,OAAO,GAAG,QAAQ;AAAA,IAAG,OAAO;AAAA,EACvE,IAAI,QAAQ,OAAO,GAAG,MAAM,KAAK,QAAQ,OAAO,GAAG,MAAM;AAAA,IAAG,OAAO;AAAA,EACnE,IAAI,QAAQ,OAAO,GAAG,OAAO;AAAA,IAAG,OAAO;AAAA,EACvC;AAAA;AAQK,SAAS,mBAAkB,CAAC,UAAkB,OAA4B;AAAA,EAC/E,MAAM,UAAU,UAAU,YAAY,YAAY,oBAAmB,KAAK;AAAA,EAC1E,IAAI;AAAA,IAAS,OAAO;AAAA,EACpB,MAAM,MAAM,SAAS,YAAY,GAAG;AAAA,EACpC,MAAM,YAAY,MAAM,IAAI,KAAK,SAAS,MAAM,GAAG,EAAE,YAAY;AAAA,EACjE,OAAO,sBAAsB,cAAc;AAAA;AAG7C,IAAM,wBAA0D;AAAA,EAC9D,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,SAAS;AAAA,EACT,UAAU;AAAA,EACV,aAAa;AAAA,EACb,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AACV;AAEA,SAAS,UAAU,CAAC,OAAmB,WAAuC;AAAA,EAC5E,OAAO,UAAU,MAAM,CAAC,MAAM,UAAU,MAAM,WAAW,IAAI;AAAA;AAG/D,SAAS,OAAO,CAAC,OAAmB,QAAgB,OAAwB;AAAA,EAC1E,IAAI,MAAM,aAAa,SAAS,MAAM;AAAA,IAAQ,OAAO;AAAA,EACrD,SAAS,QAAQ,EAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AAAA,IACpD,IAAI,MAAM,SAAS,WAAW,MAAM,WAAW,KAAK;AAAA,MAAG,OAAO;AAAA,EAChE;AAAA,EACA,OAAO;AAAA;;;ACrFF,SAAS,aAAY,CAAC,OAAqC;AAAA,EAChE,OAAO,OAAO,UAAU,YAAY,MAAM,WAAW,SAAS,KAAK,MAAM,SAAS,UAAU;AAAA;AAGvF,SAAS,UAAS,CAAC,OAAkC;AAAA,EAC1D,OACE,cAAc,KAAK,KACnB,OAAO,MAAM,WAAW,YACxB,MAAM,OAAO,KAAK,EAAE,SAAS,KAC7B,cAAa,MAAM,MAAM,KAGzB,MAAM,WAAW,kBAAiB,MAAM,MAAM,KAC9C,OAAO,MAAM,cAAc,YAC3B,OAAO,UAAU,MAAM,SAAS,KAChC,MAAM,aAAa,MAClB,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,cAC1D,MAAM,cAAc,aAAa,OAAO,MAAM,cAAc,cAC5D,MAAM,gBAAgB,aAAa,OAAO,MAAM,gBAAgB;AAAA;AAS9D,SAAS,cAAc,CAAC,OAAkC;AAAA,EAC/D,OACE,WAAU,KAAK,MACd,MAAM,cAAc,aAAa,oBAAmB,MAAM,SAAS,MAAM;AAAA;AAIvE,SAAS,qBAAoB,CAClC,SACkD;AAAA,EAClD,MAAM,YAAY;AAAA,EAClB,OACE,OAAO,UAAU,iBAAiB,cAClC,OAAO,UAAU,mBAAmB,cACpC,OAAO,UAAU,mBAAmB,cACpC,OAAO,UAAU,gBAAgB;AAAA;AAI9B,SAAS,kBAAiB,CAC/B,SACmD;AAAA,EACnD,MAAM,YAAY;AAAA,EAClB,OAAO,OAAO,UAAU,cAAc;AAAA;",
+  "debugId": "04A3170175DBD12C64756E2164756E21",
   "names": []
 }

package/dist/chunk-wsc1brye.js

@@ -0,0 +1,27 @@
+// @bun
+// src/objects/query/explain-format.ts
+function formatObjectQueryExplanation2(explanation) {
+  const lines = [];
+  const status = explanation.valid === undefined ? "not validated" : explanation.valid ? "valid" : "invalid";
+  const result = explanation.result ? ` result=${explanation.result.objectTypeIds.join(" | ")}` : "";
+  lines.push(`ObjectQuery ${status}${result}`);
+  appendNodeLines(explanation.tree, lines, 0);
+  if (explanation.issues.length > 0) {
+    lines.push("Issues:");
+    for (const issue of explanation.issues) {
+      lines.push(`- ${issue.path} [${issue.code}] ${issue.message}`);
+    }
+  }
+  return lines.join(`
+`);
+}
+function appendNodeLines(node, lines, depth) {
+  lines.push(`${"  ".repeat(depth)}- ${node.path} ${node.summary}`);
+  for (const child of node.children) {
+    appendNodeLines(child, lines, depth + 1);
+  }
+}
+
+export { formatObjectQueryExplanation2 };
+
+//# debugId=E9F55A280397751064756E2164756E21

package/dist/chunk-wsc1brye.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/objects/query/explain-format.ts"],
+  "sourcesContent": [
+    "/**\n * Formatting for object query explanations.\n *\n * Lives apart from `explain.ts` so the fluent builder (and browser bundles\n * built on it) can import the formatter without pulling in the explanation\n * builder and its validation machinery.\n */\nimport type { ObjectQueryExplainNode, ObjectQueryExplanation } from \"./explain\"\n\nexport function formatObjectQueryExplanation(explanation: ObjectQueryExplanation): string {\n  const lines: string[] = []\n  const status =\n    explanation.valid === undefined ? \"not validated\" : explanation.valid ? \"valid\" : \"invalid\"\n  const result = explanation.result ? ` result=${explanation.result.objectTypeIds.join(\" | \")}` : \"\"\n\n  lines.push(`ObjectQuery ${status}${result}`)\n  appendNodeLines(explanation.tree, lines, 0)\n\n  if (explanation.issues.length > 0) {\n    lines.push(\"Issues:\")\n    for (const issue of explanation.issues) {\n      lines.push(`- ${issue.path} [${issue.code}] ${issue.message}`)\n    }\n  }\n\n  return lines.join(\"\\n\")\n}\n\nfunction appendNodeLines(node: ObjectQueryExplainNode, lines: string[], depth: number): void {\n  lines.push(`${\"  \".repeat(depth)}- ${node.path} ${node.summary}`)\n  for (const child of node.children) {\n    appendNodeLines(child, lines, depth + 1)\n  }\n}\n"
+  ],
+  "mappings": ";;AASO,SAAS,6BAA4B,CAAC,aAA6C;AAAA,EACxF,MAAM,QAAkB,CAAC;AAAA,EACzB,MAAM,SACJ,YAAY,UAAU,YAAY,kBAAkB,YAAY,QAAQ,UAAU;AAAA,EACpF,MAAM,SAAS,YAAY,SAAS,WAAW,YAAY,OAAO,cAAc,KAAK,KAAK,MAAM;AAAA,EAEhG,MAAM,KAAK,eAAe,SAAS,QAAQ;AAAA,EAC3C,gBAAgB,YAAY,MAAM,OAAO,CAAC;AAAA,EAE1C,IAAI,YAAY,OAAO,SAAS,GAAG;AAAA,IACjC,MAAM,KAAK,SAAS;AAAA,IACpB,WAAW,SAAS,YAAY,QAAQ;AAAA,MACtC,MAAM,KAAK,KAAK,MAAM,SAAS,MAAM,SAAS,MAAM,SAAS;AAAA,IAC/D;AAAA,EACF;AAAA,EAEA,OAAO,MAAM,KAAK;AAAA,CAAI;AAAA;AAGxB,SAAS,eAAe,CAAC,MAA8B,OAAiB,OAAqB;AAAA,EAC3F,MAAM,KAAK,GAAG,KAAK,OAAO,KAAK,MAAM,KAAK,QAAQ,KAAK,SAAS;AAAA,EAChE,WAAW,SAAS,KAAK,UAAU;AAAA,IACjC,gBAAgB,OAAO,OAAO,QAAQ,CAAC;AAAA,EACzC;AAAA;",
+  "debugId": "E9F55A280397751064756E2164756E21",
+  "names": []
+}

package/dist/chunk-x0v3jd47.js

@@ -0,0 +1,124 @@
+// @bun
+// src/security/applied-markings-snapshot.ts
+function appliedLinkKey(objectTypeId, linkId) {
+  return `${objectTypeId}\x00${linkId}`;
+}
+var NO_CONTRIBUTION = Object.freeze({
+  properties: Object.freeze([]),
+  seals: Object.freeze([])
+});
+var NO_APPLIED_MARKINGS = Object.freeze({
+  properties: readonlyMap(new Map),
+  types: readonlyMap(new Map),
+  links: readonlyMap(new Map),
+  markings: readonlySet(new Set),
+  notices: Object.freeze([])
+});
+function assembleAppliedMarkings(contributions) {
+  if (contributions.length === 0)
+    return NO_APPLIED_MARKINGS;
+  const properties = new Map;
+  const types = new Map;
+  const links = new Map;
+  const markings = new Set;
+  const notices = [];
+  for (const contribution of contributions) {
+    for (const { objectTypeId, propertyId, markings: added } of contribution.properties) {
+      const byProperty = properties.get(objectTypeId) ?? new Map;
+      properties.set(objectTypeId, byProperty);
+      const set = byProperty.get(propertyId) ?? new Set;
+      byProperty.set(propertyId, set);
+      for (const markingId of added) {
+        set.add(markingId);
+        markings.add(markingId);
+      }
+    }
+    for (const { target, seal: data } of contribution.seals) {
+      const seal = Object.freeze({
+        ...data,
+        markings: readonlySet(new Set(data.markings))
+      });
+      for (const markingId of data.markings)
+        markings.add(markingId);
+      if (target.kind === "type") {
+        types.set(target.objectTypeId, [...types.get(target.objectTypeId) ?? [], seal]);
+        continue;
+      }
+      const key = appliedLinkKey(target.objectTypeId, target.linkId);
+      const existing = links.get(key);
+      if (existing)
+        existing.seals.push(seal);
+      else {
+        links.set(key, {
+          objectTypeId: target.objectTypeId,
+          linkId: target.linkId,
+          targetObjectTypeId: target.targetObjectTypeId,
+          seals: [seal]
+        });
+      }
+    }
+    if (contribution.notice)
+      notices.push(Object.freeze({ ...contribution.notice }));
+  }
+  return Object.freeze({
+    properties: readonlyMap(new Map([...properties].map(([objectTypeId, byProperty]) => [
+      objectTypeId,
+      readonlyMap(new Map([...byProperty].map(([propertyId, set]) => [propertyId, readonlySet(set)])))
+    ]))),
+    types: readonlyMap(new Map([...types].map(([objectTypeId, seals]) => [objectTypeId, Object.freeze(seals)]))),
+    links: readonlyMap(new Map([...links].map(([key, link]) => [
+      key,
+      Object.freeze({ ...link, seals: Object.freeze(link.seals) })
+    ]))),
+    markings: readonlySet(markings),
+    notices: Object.freeze(notices)
+  });
+}
+function withPropertyMarkings(snapshot, added) {
+  if (added.length === 0)
+    return snapshot;
+  const properties = new Map([...snapshot.properties].map(([objectTypeId, byProperty]) => [
+    objectTypeId,
+    new Map([...byProperty].map(([propertyId, set]) => [propertyId, new Set(set)]))
+  ]));
+  const markings = new Set(snapshot.markings);
+  for (const { objectTypeId, propertyId, markings: ids } of added) {
+    const byProperty = properties.get(objectTypeId) ?? new Map;
+    properties.set(objectTypeId, byProperty);
+    const set = byProperty.get(propertyId) ?? new Set;
+    byProperty.set(propertyId, set);
+    for (const markingId of ids) {
+      set.add(markingId);
+      markings.add(markingId);
+    }
+  }
+  return Object.freeze({
+    ...snapshot,
+    properties: readonlyMap(new Map([...properties].map(([objectTypeId, byProperty]) => [
+      objectTypeId,
+      readonlyMap(new Map([...byProperty].map(([propertyId, set]) => [propertyId, readonlySet(set)])))
+    ]))),
+    markings: readonlySet(markings)
+  });
+}
+function readonlyMap(map) {
+  return Object.freeze(Object.defineProperties(map, {
+    set: { value: refuseWrite },
+    delete: { value: refuseWrite },
+    clear: { value: refuseWrite }
+  }));
+}
+function readonlySet(set) {
+  return Object.freeze(Object.defineProperties(set, {
+    add: { value: refuseWrite },
+    delete: { value: refuseWrite },
+    clear: { value: refuseWrite }
+  }));
+}
+function refuseWrite() {
+  throw new TypeError("[Sixb] Applied markings are immutable.");
+}
+
+export { appliedLinkKey, NO_CONTRIBUTION, NO_APPLIED_MARKINGS, assembleAppliedMarkings, withPropertyMarkings };
+
+//# debugId=DB55591ADC59310F64756E2164756E21

package/dist/chunk-x0v3jd47.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/security/applied-markings-snapshot.ts"],
+  "sourcesContent": [
+    "import type { ProjectionKeyTarget } from \"./projection-markings\"\n\n/** Why readers lacking some markings cannot read an object type or a link. */\nexport interface AppliedSeal {\n  readonly projectionId: string\n  readonly markings: ReadonlySet<string>\n  /** What carries the marking, completed by \"carries marking 'm'\" in messages. */\n  readonly reason: string\n}\n\nexport interface AppliedLinkSeals {\n  readonly objectTypeId: string\n  readonly linkId: string\n  readonly targetObjectTypeId: string\n  readonly seals: readonly AppliedSeal[]\n}\n\nexport interface AppliedMarkingsNotice {\n  readonly projectionId: string\n  /** Whether the projection makes an object type or a link unreadable, not only properties. */\n  readonly sealed: boolean\n  readonly message: string\n}\n\n/**\n * What the applied versions add to the ontology's markings.\n *\n * Every reader of a host shares one snapshot and the clearances resolved for it, so a snapshot is\n * immutable all the way down: its maps and sets refuse writes.\n */\nexport interface AppliedMarkingsSnapshot {\n  /** Surplus markings by object type, then property. */\n  readonly properties: ReadonlyMap<string, ReadonlyMap<string, ReadonlySet<string>>>\n  /** Object types readers lacking a seal's markings cannot read. */\n  readonly types: ReadonlyMap<string, readonly AppliedSeal[]>\n  /** Links, by {@link appliedLinkKey}, readers lacking a seal's markings cannot read. */\n  readonly links: ReadonlyMap<string, AppliedLinkSeals>\n  /** Every marking above: a reader cleared for all of them reads what the code allows. */\n  readonly markings: ReadonlySet<string>\n  /** One per projection whose applied version adds markings, for diagnostics. */\n  readonly notices: readonly AppliedMarkingsNotice[]\n}\n\nexport function appliedLinkKey(objectTypeId: string, linkId: string): string {\n  return `${objectTypeId}\\0${linkId}`\n}\n\n/** What one applied version adds, as plain data so that equal results serialize equally. */\nexport interface AppliedContribution {\n  readonly properties: readonly {\n    readonly objectTypeId: string\n    readonly propertyId: string\n    readonly markings: readonly string[]\n  }[]\n  readonly seals: readonly {\n    readonly target: ProjectionKeyTarget\n    readonly seal: {\n      readonly projectionId: string\n      readonly markings: readonly string[]\n      readonly reason: string\n    }\n  }[]\n  readonly notice?: AppliedMarkingsNotice\n}\n\n/** An applied version that adds nothing. */\nexport const NO_CONTRIBUTION: AppliedContribution = Object.freeze({\n  properties: Object.freeze([]),\n  seals: Object.freeze([]),\n})\n\nexport const NO_APPLIED_MARKINGS: AppliedMarkingsSnapshot = Object.freeze({\n  properties: readonlyMap(new Map()),\n  types: readonlyMap(new Map()),\n  links: readonlyMap(new Map()),\n  markings: readonlySet(new Set<string>()),\n  notices: Object.freeze([]),\n})\n\n/** One snapshot from the contributions of every applied version, in projection order. */\nexport function assembleAppliedMarkings(\n  contributions: readonly AppliedContribution[]\n): AppliedMarkingsSnapshot {\n  if (contributions.length === 0) return NO_APPLIED_MARKINGS\n\n  const properties = new Map<string, Map<string, Set<string>>>()\n  const types = new Map<string, AppliedSeal[]>()\n  const links = new Map<string, AppliedLinkSeals & { seals: AppliedSeal[] }>()\n  const markings = new Set<string>()\n  const notices: AppliedMarkingsNotice[] = []\n\n  for (const contribution of contributions) {\n    for (const { objectTypeId, propertyId, markings: added } of contribution.properties) {\n      const byProperty = properties.get(objectTypeId) ?? new Map<string, Set<string>>()\n      properties.set(objectTypeId, byProperty)\n\n      const set = byProperty.get(propertyId) ?? new Set<string>()\n      byProperty.set(propertyId, set)\n\n      for (const markingId of added) {\n        set.add(markingId)\n        markings.add(markingId)\n      }\n    }\n\n    for (const { target, seal: data } of contribution.seals) {\n      const seal: AppliedSeal = Object.freeze({\n        ...data,\n        markings: readonlySet(new Set(data.markings)),\n      })\n\n      for (const markingId of data.markings) markings.add(markingId)\n\n      if (target.kind === \"type\") {\n        types.set(target.objectTypeId, [...(types.get(target.objectTypeId) ?? []), seal])\n        continue\n      }\n\n      const key = appliedLinkKey(target.objectTypeId, target.linkId)\n      const existing = links.get(key)\n      if (existing) existing.seals.push(seal)\n      else {\n        links.set(key, {\n          objectTypeId: target.objectTypeId,\n          linkId: target.linkId,\n          targetObjectTypeId: target.targetObjectTypeId,\n          seals: [seal],\n        })\n      }\n    }\n\n    if (contribution.notice) notices.push(Object.freeze({ ...contribution.notice }))\n  }\n\n  return Object.freeze({\n    properties: readonlyMap(\n      new Map(\n        [...properties].map(([objectTypeId, byProperty]) => [\n          objectTypeId,\n          readonlyMap(\n            new Map([...byProperty].map(([propertyId, set]) => [propertyId, readonlySet(set)]))\n          ),\n        ])\n      )\n    ),\n    types: readonlyMap(\n      new Map([...types].map(([objectTypeId, seals]) => [objectTypeId, Object.freeze(seals)]))\n    ),\n    links: readonlyMap(\n      new Map(\n        [...links].map(([key, link]) => [\n          key,\n          Object.freeze({ ...link, seals: Object.freeze(link.seals) }),\n        ])\n      )\n    ),\n    markings: readonlySet(markings),\n    notices: Object.freeze(notices),\n  })\n}\n\n/**\n * The snapshot with these properties' markings added: what an object event reads under, given the\n * markings its origin version carries on them.\n */\nexport function withPropertyMarkings(\n  snapshot: AppliedMarkingsSnapshot,\n  added: AppliedContribution[\"properties\"]\n): AppliedMarkingsSnapshot {\n  if (added.length === 0) return snapshot\n\n  const properties = new Map<string, Map<string, Set<string>>>(\n    [...snapshot.properties].map(([objectTypeId, byProperty]) => [\n      objectTypeId,\n      new Map([...byProperty].map(([propertyId, set]) => [propertyId, new Set(set)])),\n    ])\n  )\n\n  const markings = new Set(snapshot.markings)\n  for (const { objectTypeId, propertyId, markings: ids } of added) {\n    const byProperty = properties.get(objectTypeId) ?? new Map<string, Set<string>>()\n    properties.set(objectTypeId, byProperty)\n\n    const set = byProperty.get(propertyId) ?? new Set<string>()\n    byProperty.set(propertyId, set)\n\n    for (const markingId of ids) {\n      set.add(markingId)\n      markings.add(markingId)\n    }\n  }\n\n  return Object.freeze({\n    ...snapshot,\n    properties: readonlyMap(\n      new Map(\n        [...properties].map(([objectTypeId, byProperty]) => [\n          objectTypeId,\n          readonlyMap(\n            new Map([...byProperty].map(([propertyId, set]) => [propertyId, readonlySet(set)]))\n          ),\n        ])\n      )\n    ),\n    markings: readonlySet(markings),\n  })\n}\n\n/**\n * A map that refuses writes. `Object.freeze` alone leaves a map's entries writable through its\n * methods, so they are shadowed by ones that throw, and then frozen.\n */\nfunction readonlyMap<TKey, TValue>(map: Map<TKey, TValue>): ReadonlyMap<TKey, TValue> {\n  return Object.freeze(\n    Object.defineProperties(map, {\n      set: { value: refuseWrite },\n      delete: { value: refuseWrite },\n      clear: { value: refuseWrite },\n    })\n  )\n}\n\nfunction readonlySet<TValue>(set: Set<TValue>): ReadonlySet<TValue> {\n  return Object.freeze(\n    Object.defineProperties(set, {\n      add: { value: refuseWrite },\n      delete: { value: refuseWrite },\n      clear: { value: refuseWrite },\n    })\n  )\n}\n\nfunction refuseWrite(): never {\n  throw new TypeError(\"[Sixb] Applied markings are immutable.\")\n}\n"
+  ],
+  "mappings": ";;AA2CO,SAAS,cAAc,CAAC,cAAsB,QAAwB;AAAA,EAC3E,OAAO,GAAG,mBAAiB;AAAA;AAsBtB,IAAM,kBAAuC,OAAO,OAAO;AAAA,EAChE,YAAY,OAAO,OAAO,CAAC,CAAC;AAAA,EAC5B,OAAO,OAAO,OAAO,CAAC,CAAC;AACzB,CAAC;AAEM,IAAM,sBAA+C,OAAO,OAAO;AAAA,EACxE,YAAY,YAAY,IAAI,GAAK;AAAA,EACjC,OAAO,YAAY,IAAI,GAAK;AAAA,EAC5B,OAAO,YAAY,IAAI,GAAK;AAAA,EAC5B,UAAU,YAAY,IAAI,GAAa;AAAA,EACvC,SAAS,OAAO,OAAO,CAAC,CAAC;AAC3B,CAAC;AAGM,SAAS,uBAAuB,CACrC,eACyB;AAAA,EACzB,IAAI,cAAc,WAAW;AAAA,IAAG,OAAO;AAAA,EAEvC,MAAM,aAAa,IAAI;AAAA,EACvB,MAAM,QAAQ,IAAI;AAAA,EAClB,MAAM,QAAQ,IAAI;AAAA,EAClB,MAAM,WAAW,IAAI;AAAA,EACrB,MAAM,UAAmC,CAAC;AAAA,EAE1C,WAAW,gBAAgB,eAAe;AAAA,IACxC,aAAa,cAAc,YAAY,UAAU,WAAW,aAAa,YAAY;AAAA,MACnF,MAAM,aAAa,WAAW,IAAI,YAAY,KAAK,IAAI;AAAA,MACvD,WAAW,IAAI,cAAc,UAAU;AAAA,MAEvC,MAAM,MAAM,WAAW,IAAI,UAAU,KAAK,IAAI;AAAA,MAC9C,WAAW,IAAI,YAAY,GAAG;AAAA,MAE9B,WAAW,aAAa,OAAO;AAAA,QAC7B,IAAI,IAAI,SAAS;AAAA,QACjB,SAAS,IAAI,SAAS;AAAA,MACxB;AAAA,IACF;AAAA,IAEA,aAAa,QAAQ,MAAM,UAAU,aAAa,OAAO;AAAA,MACvD,MAAM,OAAoB,OAAO,OAAO;AAAA,WACnC;AAAA,QACH,UAAU,YAAY,IAAI,IAAI,KAAK,QAAQ,CAAC;AAAA,MAC9C,CAAC;AAAA,MAED,WAAW,aAAa,KAAK;AAAA,QAAU,SAAS,IAAI,SAAS;AAAA,MAE7D,IAAI,OAAO,SAAS,QAAQ;AAAA,QAC1B,MAAM,IAAI,OAAO,cAAc,CAAC,GAAI,MAAM,IAAI,OAAO,YAAY,KAAK,CAAC,GAAI,IAAI,CAAC;AAAA,QAChF;AAAA,MACF;AAAA,MAEA,MAAM,MAAM,eAAe,OAAO,cAAc,OAAO,MAAM;AAAA,MAC7D,MAAM,WAAW,MAAM,IAAI,GAAG;AAAA,MAC9B,IAAI;AAAA,QAAU,SAAS,MAAM,KAAK,IAAI;AAAA,MACjC;AAAA,QACH,MAAM,IAAI,KAAK;AAAA,UACb,cAAc,OAAO;AAAA,UACrB,QAAQ,OAAO;AAAA,UACf,oBAAoB,OAAO;AAAA,UAC3B,OAAO,CAAC,IAAI;AAAA,QACd,CAAC;AAAA;AAAA,IAEL;AAAA,IAEA,IAAI,aAAa;AAAA,MAAQ,QAAQ,KAAK,OAAO,OAAO,KAAK,aAAa,OAAO,CAAC,CAAC;AAAA,EACjF;AAAA,EAEA,OAAO,OAAO,OAAO;AAAA,IACnB,YAAY,YACV,IAAI,IACF,CAAC,GAAG,UAAU,EAAE,IAAI,EAAE,cAAc,gBAAgB;AAAA,MAClD;AAAA,MACA,YACE,IAAI,IAAI,CAAC,GAAG,UAAU,EAAE,IAAI,EAAE,YAAY,SAAS,CAAC,YAAY,YAAY,GAAG,CAAC,CAAC,CAAC,CACpF;AAAA,IACF,CAAC,CACH,CACF;AAAA,IACA,OAAO,YACL,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,cAAc,WAAW,CAAC,cAAc,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CACzF;AAAA,IACA,OAAO,YACL,IAAI,IACF,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA,OAAO,OAAO,KAAK,MAAM,OAAO,OAAO,OAAO,KAAK,KAAK,EAAE,CAAC;AAAA,IAC7D,CAAC,CACH,CACF;AAAA,IACA,UAAU,YAAY,QAAQ;AAAA,IAC9B,SAAS,OAAO,OAAO,OAAO;AAAA,EAChC,CAAC;AAAA;AAOI,SAAS,oBAAoB,CAClC,UACA,OACyB;AAAA,EACzB,IAAI,MAAM,WAAW;AAAA,IAAG,OAAO;AAAA,EAE/B,MAAM,aAAa,IAAI,IACrB,CAAC,GAAG,SAAS,UAAU,EAAE,IAAI,EAAE,cAAc,gBAAgB;AAAA,IAC3D;AAAA,IACA,IAAI,IAAI,CAAC,GAAG,UAAU,EAAE,IAAI,EAAE,YAAY,SAAS,CAAC,YAAY,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;AAAA,EAChF,CAAC,CACH;AAAA,EAEA,MAAM,WAAW,IAAI,IAAI,SAAS,QAAQ;AAAA,EAC1C,aAAa,cAAc,YAAY,UAAU,SAAS,OAAO;AAAA,IAC/D,MAAM,aAAa,WAAW,IAAI,YAAY,KAAK,IAAI;AAAA,IACvD,WAAW,IAAI,cAAc,UAAU;AAAA,IAEvC,MAAM,MAAM,WAAW,IAAI,UAAU,KAAK,IAAI;AAAA,IAC9C,WAAW,IAAI,YAAY,GAAG;AAAA,IAE9B,WAAW,aAAa,KAAK;AAAA,MAC3B,IAAI,IAAI,SAAS;AAAA,MACjB,SAAS,IAAI,SAAS;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,OAAO,OAAO,OAAO;AAAA,OAChB;AAAA,IACH,YAAY,YACV,IAAI,IACF,CAAC,GAAG,UAAU,EAAE,IAAI,EAAE,cAAc,gBAAgB;AAAA,MAClD;AAAA,MACA,YACE,IAAI,IAAI,CAAC,GAAG,UAAU,EAAE,IAAI,EAAE,YAAY,SAAS,CAAC,YAAY,YAAY,GAAG,CAAC,CAAC,CAAC,CACpF;AAAA,IACF,CAAC,CACH,CACF;AAAA,IACA,UAAU,YAAY,QAAQ;AAAA,EAChC,CAAC;AAAA;AAOH,SAAS,WAAyB,CAAC,KAAmD;AAAA,EACpF,OAAO,OAAO,OACZ,OAAO,iBAAiB,KAAK;AAAA,IAC3B,KAAK,EAAE,OAAO,YAAY;AAAA,IAC1B,QAAQ,EAAE,OAAO,YAAY;AAAA,IAC7B,OAAO,EAAE,OAAO,YAAY;AAAA,EAC9B,CAAC,CACH;AAAA;AAGF,SAAS,WAAmB,CAAC,KAAuC;AAAA,EAClE,OAAO,OAAO,OACZ,OAAO,iBAAiB,KAAK;AAAA,IAC3B,KAAK,EAAE,OAAO,YAAY;AAAA,IAC1B,QAAQ,EAAE,OAAO,YAAY;AAAA,IAC7B,OAAO,EAAE,OAAO,YAAY;AAAA,EAC9B,CAAC,CACH;AAAA;AAGF,SAAS,WAAW,GAAU;AAAA,EAC5B,MAAM,IAAI,UAAU,wCAAwC;AAAA;",
+  "debugId": "DB55591ADC59310F64756E2164756E21",
+  "names": []
+}

package/dist/{chunk-96yw3pwd.js → chunk-y7dbmaqh.js}

@@ -26,6 +26,32 @@ class MaterializationObjectNotFoundError2 extends MaterializationValidationError
   }
 }
 
+class UniqueValueViolationError2 extends MaterializationValidationError2 {
+  objectTypeId;
+  propertyId;
+  holderPrimaryId;
+  claimantPrimaryId;
+  name = "UniqueValueViolationError";
+  constructor(objectTypeId, propertyId, holderPrimaryId, claimantPrimaryId) {
+    super(`Another '${objectTypeId}' object already has this '${propertyId}'.`);
+    this.objectTypeId = objectTypeId;
+    this.propertyId = propertyId;
+    this.holderPrimaryId = holderPrimaryId;
+    this.claimantPrimaryId = claimantPrimaryId;
+  }
+}
+
+class UniquePropertyNotPreparedError extends Error {
+  objectTypeId;
+  propertyId;
+  name = "UniquePropertyNotPreparedError";
+  constructor(objectTypeId, propertyId) {
+    super(`[Sixb] Unique property '${objectTypeId}.${propertyId}' is not prepared. Run \`sixb db migrate\`.`);
+    this.objectTypeId = objectTypeId;
+    this.propertyId = propertyId;
+  }
+}
+
 class MaterializationCancellationError2 extends Error {
   name = "AbortError";
   constructor(message = "Materialization explicitly cancelled.", options) {
@@ -45,6 +71,6 @@ function isMaterializationConflictError2(error) {
   return error instanceof MaterializationConflictError2;
 }
 
-export { MaterializationValidationError2, MaterializationObjectNotFoundError2, MaterializationCancellationError2, MaterializationConflictError2, isMaterializationConflictError2 };
+export { MaterializationValidationError2, MaterializationObjectNotFoundError2, UniqueValueViolationError2, UniquePropertyNotPreparedError, MaterializationCancellationError2, MaterializationConflictError2, isMaterializationConflictError2 };
 
-//# debugId=617A1F8CD66AC39564756E2164756E21
+//# debugId=F880CF8C3343CEE064756E2164756E21

package/dist/chunk-y7dbmaqh.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/materialization/errors.ts"],
+  "sourcesContent": [
+    "import { OntologyValidationError } from \"../ontology/errors\"\n\nexport type MaterializationConflictKind =\n  | \"idempotency\"\n  | \"projection-fence\"\n  | \"source-materialization\"\n  | \"execution-lost\"\n  | \"run-correlation\"\n  | \"effective-state\"\n  /** A state the commit was told to expect (an Action's reads) no longer matches. */\n  | \"expectation\"\n  | \"timeseries-point\"\n  | \"outbox-lease\"\n\nfunction prefixMessage(message: string): string {\n  return message.startsWith(\"[Sixb]\") ? message : `[Sixb] ${message}`\n}\n\n/**\n * A validation failure raised inside the Materializer.\n *\n * Extends `OntologyValidationError` because it is the same class of failure a caller already\n * handles: batch writes surface it rewrapped as one, so a single write must not require a second\n * `instanceof` branch to catch the identical error.\n */\nexport class MaterializationValidationError extends OntologyValidationError {\n  readonly name: string = \"MaterializationValidationError\"\n\n  constructor(message: string, options?: ErrorOptions) {\n    super(prefixMessage(message), options)\n  }\n}\n\n/** Structured missing-object failure raised by Materializer telemetry validation. */\nexport class MaterializationObjectNotFoundError extends MaterializationValidationError {\n  override readonly name = \"MaterializationObjectNotFoundError\"\n\n  constructor(\n    readonly objectTypeId: string,\n    readonly primaryId: string\n  ) {\n    super(`Cannot append telemetry to missing object '${objectTypeId}:${primaryId}'.`)\n  }\n}\n\n/**\n * A unique property value that another object of the type already holds.\n *\n * The message names only the type and the property, so a caller learns that the value is taken\n * and nothing more. The holder and the claimant are kept for messages that may name them.\n */\nexport class UniqueValueViolationError extends MaterializationValidationError {\n  override readonly name = \"UniqueValueViolationError\"\n\n  constructor(\n    readonly objectTypeId: string,\n    readonly propertyId: string,\n    readonly holderPrimaryId: string,\n    readonly claimantPrimaryId: string\n  ) {\n    super(`Another '${objectTypeId}' object already has this '${propertyId}'.`)\n  }\n}\n\n/**\n * A write to a unique property whose stored values were never built, or were built with other\n * keys: `sixb db migrate` prepares them. Writes stay refused until then, rather than accept a\n * value they cannot check.\n */\nexport class UniquePropertyNotPreparedError extends Error {\n  readonly name = \"UniquePropertyNotPreparedError\"\n\n  constructor(\n    readonly objectTypeId: string,\n    readonly propertyId: string\n  ) {\n    super(\n      `[Sixb] Unique property '${objectTypeId}.${propertyId}' is not prepared. Run \\`sixb db migrate\\`.`\n    )\n  }\n}\n\n/**\n * Abort reason for an explicit, terminal cancellation of a materialization.\n *\n * Generic aborts (worker shutdown, delivery loss, timeout) remain retryable and preserve staged\n * source state. Passing this error as an AbortSignal reason authorizes that state to be abandoned.\n */\nexport class MaterializationCancellationError extends Error {\n  readonly name = \"AbortError\"\n\n  constructor(message = \"Materialization explicitly cancelled.\", options?: ErrorOptions) {\n    super(prefixMessage(message), options)\n  }\n}\n\nexport class MaterializationConflictError extends Error {\n  readonly name: string = \"MaterializationConflictError\"\n\n  constructor(\n    readonly kind: MaterializationConflictKind,\n    message: string\n  ) {\n    super(prefixMessage(message))\n  }\n}\n\nexport function isMaterializationConflictError(\n  error: unknown\n): error is MaterializationConflictError {\n  return error instanceof MaterializationConflictError\n}\n"
+  ],
+  "mappings": ";;;;;;AAcA,SAAS,aAAa,CAAC,SAAyB;AAAA,EAC9C,OAAO,QAAQ,WAAW,QAAQ,IAAI,UAAU,UAAU;AAAA;AAAA;AAUrD,MAAM,wCAAuC,yBAAwB;AAAA,EACjE,OAAe;AAAA,EAExB,WAAW,CAAC,SAAiB,SAAwB;AAAA,IACnD,MAAM,cAAc,OAAO,GAAG,OAAO;AAAA;AAEzC;AAAA;AAGO,MAAM,4CAA2C,gCAA+B;AAAA,EAI1E;AAAA,EACA;AAAA,EAJO,OAAO;AAAA,EAEzB,WAAW,CACA,cACA,WACT;AAAA,IACA,MAAM,8CAA8C,gBAAgB,aAAa;AAAA,IAHxE;AAAA,IACA;AAAA;AAIb;AAAA;AAQO,MAAM,mCAAkC,gCAA+B;AAAA,EAIjE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EANO,OAAO;AAAA,EAEzB,WAAW,CACA,cACA,YACA,iBACA,mBACT;AAAA,IACA,MAAM,YAAY,0CAA0C,cAAc;AAAA,IALjE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAIb;AAAA;AAOO,MAAM,uCAAuC,MAAM;AAAA,EAI7C;AAAA,EACA;AAAA,EAJF,OAAO;AAAA,EAEhB,WAAW,CACA,cACA,YACT;AAAA,IACA,MACE,2BAA2B,gBAAgB,uDAC7C;AAAA,IALS;AAAA,IACA;AAAA;AAMb;AAAA;AAQO,MAAM,0CAAyC,MAAM;AAAA,EACjD,OAAO;AAAA,EAEhB,WAAW,CAAC,UAAU,yCAAyC,SAAwB;AAAA,IACrF,MAAM,cAAc,OAAO,GAAG,OAAO;AAAA;AAEzC;AAAA;AAEO,MAAM,sCAAqC,MAAM;AAAA,EAI3C;AAAA,EAHF,OAAe;AAAA,EAExB,WAAW,CACA,MACT,SACA;AAAA,IACA,MAAM,cAAc,OAAO,CAAC;AAAA,IAHnB;AAAA;AAKb;AAEO,SAAS,+BAA8B,CAC5C,OACuC;AAAA,EACvC,OAAO,iBAAiB;AAAA;",
+  "debugId": "F880CF8C3343CEE064756E2164756E21",
+  "names": []
+}

package/dist/{chunk-d0bqz29d.js → chunk-yc9ners4.js}

@@ -6,17 +6,17 @@ import {
   isSingletonGrantKind,
   grantKindOf,
   emptyGrantSets
-} from "./chunk-gsjm1wms.js";
+} from "./chunk-vhbw5sqm.js";
 import {
   createSixbError2
-} from "./chunk-8mx7qw3y.js";
+} from "./chunk-zbc929zg.js";
 import {
   compileSelectedObjectReadScope2
-} from "./chunk-v4jbb3rs.js";
+} from "./chunk-rap5w0x0.js";
 import {
   findPrimitiveSchema,
   resolveSemanticType2
-} from "./chunk-hvsb78a1.js";
+} from "./chunk-65pyhyas.js";
 import {
   kernelOperationId,
   kernelOperationFromId
@@ -616,6 +616,7 @@ function snapshotAuthorizationContext(context) {
     groupIds: Object.freeze([...context.groupIds]),
     roleIds: Object.freeze([...context.roleIds]),
     grants: frozenGrants,
+    ...context.viewConditions === undefined ? {} : { viewConditions: new ImmutableViewConditions(context.viewConditions) },
     clearances: new ImmutableGrantSet(context.clearances ?? [])
   });
 }
@@ -664,6 +665,52 @@ Object.freeze(ImmutableGrantSet.prototype);
 function immutableGrantSetMutation() {
   return new Error("[Sixb] Runtime authorization grants are immutable.");
 }
+
+class ImmutableViewConditions {
+  #entries;
+  [Symbol.toStringTag] = "Map";
+  constructor(entries) {
+    this.#entries = new Map([...entries].map(([objectTypeId, predicates]) => [
+      objectTypeId,
+      deepFreeze(structuredClone([...predicates]))
+    ]));
+    Object.freeze(this);
+  }
+  get size() {
+    return this.#entries.size;
+  }
+  get(objectTypeId) {
+    return this.#entries.get(objectTypeId);
+  }
+  has(objectTypeId) {
+    return this.#entries.has(objectTypeId);
+  }
+  entries() {
+    return this.#entries.entries();
+  }
+  keys() {
+    return this.#entries.keys();
+  }
+  values() {
+    return this.#entries.values();
+  }
+  [Symbol.iterator]() {
+    return this.#entries.entries();
+  }
+  forEach(callback, thisArg) {
+    for (const [objectTypeId, predicates] of this.#entries) {
+      callback.call(thisArg, predicates, objectTypeId, this);
+    }
+  }
+}
+Object.freeze(ImmutableViewConditions.prototype);
+function deepFreeze(value) {
+  if (typeof value !== "object" || value === null)
+    return value;
+  for (const child of Object.values(value))
+    deepFreeze(child);
+  return Object.freeze(value);
+}
 function snapshotAuthorizablePrincipal(principal) {
   if (principal.type !== "user" && principal.type !== "serviceAccount") {
     throw new Error(`[Sixb] Principal type '${principal.type}' cannot hold runtime authorization.`);
@@ -792,6 +839,8 @@ function atomsFor(request) {
       return [{ kind: "view:object", id: request.objectTypeId }];
     case "dataset.view":
       return [{ kind: "view:dataset", id: request.datasetId }];
+    case "users.view":
+      return [{ kind: "view:users" }];
     case "object.edit":
       return [{ kind: "edit:object", id: request.objectTypeId }];
     case "telemetry.append":
@@ -808,12 +857,20 @@ function atomsFor(request) {
       return [{ kind: "run:pipeline", id: request.pipelineId }];
     case "agent.run":
       return [{ kind: "run:agent" }];
+    case "models.run":
+      return [{ kind: "run:models" }];
     case "logs.observe":
       return [{ kind: "observe:logs" }];
     case "aiUsage.observe":
       return [{ kind: "observe:aiUsage" }];
+    case "activity.observe":
+      return [{ kind: "observe:activity" }];
+    case "agentThreads.observe":
+      return [{ kind: "observe:agentThreads" }];
     case "aiUsage.manage":
       return [{ kind: "manage:aiUsage" }];
+    case "agentMemory.manage":
+      return [{ kind: "manage:agentMemory" }];
     case "connector.manage":
       return [{ kind: "manage:connector", id: request.connectorId }];
     case "object.query":
@@ -890,6 +947,20 @@ function assertProviderAccess2(runtime, execution, operation) {
   }
   throw new AuthorizationError2(`privileged:${operation}`, `[Sixb] Operation '${operation}' is not covered by scoped authorization grants.`);
 }
+function assertModelAccess2(runtime, execution, operation) {
+  const resolved = resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization
+  });
+  if (resolved.type === "unrestricted" || execution.executor.type === "agent")
+    return;
+  if (resolved.type === "principal") {
+    if (isAllowed2(resolved.context, { kind: "models.run" }))
+      return;
+    throw new AuthorizationError2("run:models", deniedMessage(resolved.context, { kind: "models.run" }));
+  }
+  throw new AuthorizationError2(`delegated:${operation}`, `[Sixb] Operation '${operation}' is not covered by delegated authorization.`);
+}
 function deniedMessage(authorization, request) {
   const principalId = authorization?.principal.id ?? "unknown";
   switch (request.kind) {
@@ -897,6 +968,8 @@ function deniedMessage(authorization, request) {
       return `[Sixb] Principal '${principalId}' is not allowed to view object type '${request.objectTypeId}'.`;
     case "dataset.view":
       return `[Sixb] Principal '${principalId}' is not allowed to view dataset '${request.datasetId}'.`;
+    case "users.view":
+      return `[Sixb] Principal '${principalId}' is not allowed to view the member directory.`;
     case "object.edit":
       return `[Sixb] Principal '${principalId}' is not allowed to write object type '${request.objectTypeId}'.`;
     case "telemetry.append":
@@ -913,12 +986,20 @@ function deniedMessage(authorization, request) {
       return `[Sixb] Principal '${principalId}' is not allowed to run pipeline '${request.pipelineId}'.`;
     case "agent.run":
       return `[Sixb] Principal '${principalId}' is not allowed to run the project Agent.`;
+    case "models.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to call the project's models.`;
     case "logs.observe":
       return `[Sixb] Principal '${principalId}' is not allowed to observe project logs.`;
     case "aiUsage.observe":
       return `[Sixb] Principal '${principalId}' is not allowed to observe project AI usage.`;
+    case "activity.observe":
+      return `[Sixb] Principal '${principalId}' is not allowed to observe project activity.`;
+    case "agentThreads.observe":
+      return `[Sixb] Principal '${principalId}' is not allowed to observe other users' Agent conversations.`;
     case "aiUsage.manage":
       return `[Sixb] Principal '${principalId}' is not allowed to manage project AI usage limits.`;
+    case "agentMemory.manage":
+      return `[Sixb] Principal '${principalId}' is not allowed to manage the project's Agent memory.`;
     case "connector.manage":
       return `[Sixb] Principal '${principalId}' is not allowed to manage connector '${request.connectorId}'.`;
     case "object.query": {
@@ -928,32 +1009,25 @@ function deniedMessage(authorization, request) {
   }
 }
 // src/authorization/event-visibility.ts
-function canViewEvent2(authorization, event) {
+var NO_CONDITIONS = new Set;
+function canViewEvent2(authorization, event, conditioned = NO_CONDITIONS) {
   if (!authorization) {
     return true;
   }
+  const viewsObjects = (objectTypeId) => conditioned.has(objectTypeId) || isAllowed2(authorization, { kind: "object.view", objectTypeId });
   switch (event.topic) {
     case "objects":
     case "telemetry":
-      return isAllowed2(authorization, {
-        kind: "object.view",
-        objectTypeId: event.payload.objectTypeId
-      });
+      return viewsObjects(event.payload.objectTypeId);
     case "links":
-      return isAllowed2(authorization, {
-        kind: "object.view",
-        objectTypeId: event.payload.sourceTypeId
-      }) && isAllowed2(authorization, { kind: "object.view", objectTypeId: event.payload.targetTypeId });
+      return viewsObjects(event.payload.sourceTypeId) && viewsObjects(event.payload.targetTypeId);
     case "workflows":
       return isAllowed2(authorization, {
         kind: "workflow.run",
         workflowId: event.payload.workflowId
       });
     case "rules":
-      return isAllowed2(authorization, {
-        kind: "object.view",
-        objectTypeId: event.payload.subject.objectTypeId
-      });
+      return viewsObjects(event.payload.subject.objectTypeId);
     case "syncs":
       return isAllowed2(authorization, {
         kind: "sync.run",
@@ -971,6 +1045,8 @@ function canViewEvent2(authorization, event) {
         kind: "dataset.view",
         datasetId: event.payload.datasetId
       });
+    case "users":
+      return isAllowed2(authorization, { kind: "users.view" });
     default:
       return false;
   }
@@ -979,6 +1055,8 @@ function canViewEvent2(authorization, event) {
 function resolveRoleGrants2(role, universe) {
   const grants = emptyGrantSets();
   for (const grant of role.grants) {
+    if ("condition" in grant && grant.condition !== undefined)
+      continue;
     const kind = grantKindOf(grant);
     if (isSingletonGrantKind(kind)) {
       grants[kind] = true;
@@ -991,6 +1069,25 @@ function resolveRoleGrants2(role, universe) {
   }
   return grants;
 }
+function resolveRoleViewConditions2(conditions, grants, universe) {
+  const byType = new Map;
+  for (const condition of conditions) {
+    const objectTypeIds = [condition.objectTypeId, ...universe.getSubTypes(condition.objectTypeId)];
+    for (const objectTypeId of objectTypeIds) {
+      if (grants["view:object"].has(objectTypeId))
+        continue;
+      const predicates = byType.get(objectTypeId) ?? [];
+      predicates.push(condition.predicate);
+      byType.set(objectTypeId, predicates);
+    }
+  }
+  return new Map([...byType].map(([objectTypeId, predicates]) => [objectTypeId, anyOf(predicates)]));
+}
+function anyOf(predicates) {
+  if (predicates.length === 1)
+    return predicates[0];
+  return Object.freeze({ op: "or", items: Object.freeze([...predicates]) });
+}
 function expandSelection(selection, universe, into, expand) {
   if (selection.all) {
     const except = new Set(selection.except);
@@ -1015,6 +1112,7 @@ function resolveAuthorizationContext2(input) {
   const roleIds = [];
   const grants = emptyGrantSets();
   const clearances = new Set;
+  const viewConditions = new Map;
   for (const role of input.roles) {
     if (!role.grantedToGroupIds.some((groupId) => memberGroupIds.has(groupId))) {
       continue;
@@ -1032,6 +1130,12 @@ function resolveAuthorizationContext2(input) {
     for (const markingId of role.clearances ?? []) {
       clearances.add(markingId);
     }
+    for (const [objectTypeId, predicate] of role.viewConditions ?? []) {
+      viewConditions.set(objectTypeId, [...viewConditions.get(objectTypeId) ?? [], predicate]);
+    }
+  }
+  for (const objectTypeId of grants["view:object"]) {
+    viewConditions.delete(objectTypeId);
   }
   return {
     principal: input.principal,
@@ -1039,6 +1143,7 @@ function resolveAuthorizationContext2(input) {
     groupIds: input.groupIds,
     roleIds,
     grants,
+    ...viewConditions.size > 0 ? { viewConditions } : {},
     clearances
   };
 }
@@ -1770,6 +1875,6 @@ function canViewProjection2(authorization, projection) {
 function emptyGrantIndex2() {
   return emptyGrantSets();
 }
-export { agentServiceAccountId2, MAX_OBJECT_READ_FACETS2, ObjectReadLimitExceededError2, snapshotObjectReadExecutionLimits2, assertObjectReadFacetCount2, assertObjectReadOutputWithinLimit2, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createDelegatedRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, createKernelRuntimeAuthorization, resolveRuntimeAuthorizationForProject, getAuthorizationRef, captureExecutionScope, resolveExecutionScopeAuthorization, AuthorizationError2, evaluate2, isAllowed2, assertAuthorized2, isRuntimeAllowed2, assertRuntimeAuthorizationBound2, assertCanEdit2, assertCanAppendTelemetry2, assertCanManageConnector2, assertPrivileged2, assertProviderAccess2, canViewEvent2, resolveRoleGrants2, resolveAuthorizationContext2, ProjectionValidationError2, computeProjectionOwnership2, validateProjectionOwnership2, validateTelemetryProjectionFieldMapping2, validateProjectionsAtStartup, defineProjection2, fromForeignKey2, isObjectProjectionDefinition2, isLinkProjectionDefinition2, isTelemetryProjectionDefinition2, isProjectionDefinition2, projectionTargetOf2, canViewActionRun2, canViewWorkflowRun2, canViewWorkflowIntervention2, canViewPipelineRun2, canViewProjectionRun2, canViewProjection2, emptyGrantIndex2 };
+export { agentServiceAccountId2, MAX_OBJECT_READ_FACETS2, ObjectReadLimitExceededError2, snapshotObjectReadExecutionLimits2, assertObjectReadFacetCount2, assertObjectReadOutputWithinLimit2, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createDelegatedRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, createKernelRuntimeAuthorization, resolveRuntimeAuthorizationForProject, getAuthorizationRef, captureExecutionScope, resolveExecutionScopeAuthorization, AuthorizationError2, evaluate2, isAllowed2, assertAuthorized2, isRuntimeAllowed2, assertRuntimeAuthorizationBound2, assertCanEdit2, assertCanAppendTelemetry2, assertCanManageConnector2, assertPrivileged2, assertProviderAccess2, assertModelAccess2, canViewEvent2, resolveRoleGrants2, resolveRoleViewConditions2, resolveAuthorizationContext2, ProjectionValidationError2, computeProjectionOwnership2, validateProjectionOwnership2, validateTelemetryProjectionFieldMapping2, validateProjectionsAtStartup, defineProjection2, fromForeignKey2, isObjectProjectionDefinition2, isLinkProjectionDefinition2, isTelemetryProjectionDefinition2, isProjectionDefinition2, projectionTargetOf2, canViewActionRun2, canViewWorkflowRun2, canViewWorkflowIntervention2, canViewPipelineRun2, canViewProjectionRun2, canViewProjection2, emptyGrantIndex2 };
 
-//# debugId=7FB5B723E597B3F364756E2164756E21
+//# debugId=4A557346A48D475E64756E2164756E21