@sixb/core 0.1.21 → 0.1.22

package/dist/{chunk-hwksyjks.js → chunk-661ezhks.js}

@@ -129,6 +129,7 @@ var SIXB_API_ROUTES2 = [
     path: "/api/objects/query",
     accessToken: true,
     agentApi: true,
+    agentEffect: "read",
     sharedSession: true
   },
   {
@@ -137,6 +138,7 @@ var SIXB_API_ROUTES2 = [
     path: "/api/objects/query/links",
     accessToken: true,
     agentApi: true,
+    agentEffect: "read",
     sharedSession: true
   },
   {
@@ -145,6 +147,7 @@ var SIXB_API_ROUTES2 = [
     path: "/api/objects/query/count",
     accessToken: true,
     agentApi: true,
+    agentEffect: "read",
     sharedSession: true
   },
   {
@@ -153,6 +156,7 @@ var SIXB_API_ROUTES2 = [
     path: "/api/objects/query/exists",
     accessToken: true,
     agentApi: true,
+    agentEffect: "read",
     sharedSession: true
   },
   {
@@ -161,6 +165,7 @@ var SIXB_API_ROUTES2 = [
     path: "/api/objects/query/facets",
     accessToken: true,
     agentApi: true,
+    agentEffect: "read",
     sharedSession: true
   },
   {
@@ -171,6 +176,15 @@ var SIXB_API_ROUTES2 = [
     agentApi: true,
     sharedSession: true
   },
+  {
+    operationId: "getObjectByUniqueProperty",
+    method: "POST",
+    path: "/api/objects/:objectTypeId/by/:propertyId",
+    accessToken: true,
+    agentApi: true,
+    agentEffect: "read",
+    sharedSession: true
+  },
   {
     operationId: "upsertObject",
     method: "PUT",
@@ -205,6 +219,7 @@ var SIXB_API_ROUTES2 = [
     path: "/api/telemetry/history",
     accessToken: true,
     agentApi: true,
+    agentEffect: "read",
     sharedSession: true
   },
   {
@@ -261,6 +276,7 @@ var SIXB_API_ROUTES2 = [
     path: "/api/actions/:actionId",
     accessToken: true,
     agentApi: true,
+    agentEffect: "action",
     sharedSession: true
   },
   {
@@ -268,7 +284,8 @@ var SIXB_API_ROUTES2 = [
     method: "POST",
     path: "/api/files",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    agentEffect: "file"
   },
   {
     operationId: "listActionRuns",
@@ -318,7 +335,8 @@ var SIXB_API_ROUTES2 = [
     method: "POST",
     path: "/api/workflows/:workflowId/runs",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    agentEffect: "workflow"
   },
   {
     operationId: "listWorkflowRuns",
@@ -390,6 +408,49 @@ var SIXB_API_ROUTES2 = [
     accessToken: true,
     agentApi: false
   },
+  {
+    operationId: "getAgentChildFileContent",
+    method: "GET",
+    path: "/api/agent-threads/:threadId/child-files/content",
+    accessToken: true,
+    agentApi: false
+  },
+  {
+    operationId: "headAgentChildFileContent",
+    method: "HEAD",
+    path: "/api/agent-threads/:threadId/child-files/content",
+    accessToken: true,
+    agentApi: false
+  },
+  {
+    operationId: "getAgentMemory",
+    method: "GET",
+    path: "/api/agent-memory/:repo",
+    accessToken: true,
+    agentApi: true
+  },
+  {
+    operationId: "listAgentMemoryRevisions",
+    method: "GET",
+    path: "/api/agent-memory/:repo/revisions",
+    accessToken: true,
+    agentApi: false
+  },
+  {
+    operationId: "saveAgentMemory",
+    method: "POST",
+    path: "/api/agent-memory/:repo/revisions",
+    accessToken: true,
+    agentApi: true,
+    agentEffect: "memory"
+  },
+  {
+    operationId: "deleteAgentMemory",
+    method: "DELETE",
+    path: "/api/agent-memory/:repo",
+    accessToken: true,
+    agentApi: false
+  },
   {
     operationId: "listArtifacts",
     method: "GET",
@@ -418,6 +479,34 @@ var SIXB_API_ROUTES2 = [
     accessToken: true,
     agentApi: false
   },
+  {
+    operationId: "getArtifactState",
+    method: "GET",
+    path: "/api/artifacts/:artifactId/state",
+    accessToken: true,
+    agentApi: false
+  },
+  {
+    operationId: "clearArtifactState",
+    method: "DELETE",
+    path: "/api/artifacts/:artifactId/state",
+    accessToken: true,
+    agentApi: false
+  },
+  {
+    operationId: "setArtifactState",
+    method: "PUT",
+    path: "/api/artifacts/:artifactId/state/:key",
+    accessToken: true,
+    agentApi: false
+  },
+  {
+    operationId: "deleteArtifactStateValue",
+    method: "DELETE",
+    path: "/api/artifacts/:artifactId/state/:key",
+    accessToken: true,
+    agentApi: false
+  },
   {
     operationId: "publishArtifactVersion",
     method: "POST",
@@ -432,6 +521,13 @@ var SIXB_API_ROUTES2 = [
     accessToken: true,
     agentApi: false
   },
+  {
+    operationId: "getArtifactQuery",
+    method: "GET",
+    path: "/api/artifacts/:artifactId/versions/:version/queries/:name",
+    accessToken: true,
+    agentApi: false
+  },
   {
     operationId: "createArtifactFrame",
     method: "POST",
@@ -533,6 +629,59 @@ var SIXB_API_ROUTES2 = [
     accessToken: true,
     agentApi: false
   },
+  {
+    operationId: "listUsers",
+    method: "GET",
+    path: "/api/users",
+    accessToken: true,
+    agentApi: true
+  },
+  {
+    operationId: "getUser",
+    method: "GET",
+    path: "/api/users/:userId",
+    accessToken: true,
+    agentApi: true
+  },
+  {
+    operationId: "listModels",
+    method: "GET",
+    path: "/api/models",
+    accessToken: true,
+    agentApi: true
+  },
+  {
+    operationId: "generateText",
+    method: "POST",
+    path: "/api/models/language/generations",
+    accessToken: true,
+    agentApi: true,
+    agentEffect: "model"
+  },
+  {
+    operationId: "generateImages",
+    method: "POST",
+    path: "/api/models/image/generations",
+    accessToken: true,
+    agentApi: true,
+    agentEffect: "model"
+  },
+  {
+    operationId: "generateSpeech",
+    method: "POST",
+    path: "/api/models/audio/speech",
+    accessToken: true,
+    agentApi: true,
+    agentEffect: "model"
+  },
+  {
+    operationId: "transcribeAudio",
+    method: "POST",
+    path: "/api/models/audio/transcriptions",
+    accessToken: true,
+    agentApi: true,
+    agentEffect: "model"
+  },
   {
     operationId: "getAiAccountingOverview",
     method: "GET",
@@ -547,6 +696,27 @@ var SIXB_API_ROUTES2 = [
     accessToken: true,
     agentApi: false
   },
+  {
+    operationId: "getAiModelCallFiles",
+    method: "GET",
+    path: "/api/ai/model-calls/:callId/files",
+    accessToken: true,
+    agentApi: true
+  },
+  {
+    operationId: "getAiModelCallFileContent",
+    method: "GET",
+    path: "/api/ai/model-calls/:callId/files/content",
+    accessToken: true,
+    agentApi: true
+  },
+  {
+    operationId: "headAiModelCallFileContent",
+    method: "HEAD",
+    path: "/api/ai/model-calls/:callId/files/content",
+    accessToken: true,
+    agentApi: false
+  },
   {
     operationId: "listAiModelCallGroups",
     method: "GET",
@@ -597,11 +767,17 @@ var SIXB_API_ROUTES2 = [
     agentApi: false
   }
 ];
-for (const route of SIXB_API_ROUTES2) {
-  if (route.agentApi && !route.accessToken) {
-    throw new Error(`[Sixb] agent API route '${route.method} ${route.path}' must also be an access-token route.`);
+function assertSixbApiRoutes(routes) {
+  for (const route of routes) {
+    if (route.agentApi && !route.accessToken) {
+      throw new Error(`[Sixb] agent API route '${route.method} ${route.path}' must also be an access-token route.`);
+    }
+    if (route.agentApi && route.method !== "GET" && route.agentEffect === undefined) {
+      throw new Error(`[Sixb] agent API route '${route.method} ${route.path}' must declare its agentEffect.`);
+    }
   }
 }
+assertSixbApiRoutes(SIXB_API_ROUTES2);
 
 // src/http/route-pattern.ts
 function pathSegmentsFor2(pathname) {
@@ -629,4 +805,4 @@ function normalizeRoutePath2(pathname) {
 
 export { SIXB_API_ROUTES2, pathSegmentsFor2, matchesPathPattern2, normalizeRoutePath2 };
 
-//# debugId=08B4515E499E9E6B64756E2164756E21
+//# debugId=417CCDE96E10FD7D64756E2164756E21

package/dist/chunk-661ezhks.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/http/api-routes.ts", "../src/http/route-pattern.ts"],
+  "sourcesContent": [
+    "/**\n * The single source of truth for the Sixb HTTP API surface and its auth capabilities.\n *\n * Two views are derived from this one table:\n * - `AGENT_API_ROUTES` (@sixb/core agent gateway) = the `agentApi` rows, projected to {method, path}.\n * - `ACCESS_TOKEN_ROUTES` (@sixb/server bearer boundary) = the `accessToken` rows, with operationId.\n *\n * Because both views are projections of this table, the agent gateway allow-list is structurally a\n * subset of the bearer boundary — the invariant below enforces `agentApi ⇒ accessToken` at load\n * time. This table lives in @sixb/core (never @sixb/server) because @sixb/server depends on core,\n * not the reverse; the operationId strings are opaque here.\n */\nexport interface SixbApiRoute {\n  /** OpenAPI operationId — the server keys its bearer security requirement off this. */\n  readonly operationId: string\n  readonly method: string\n  readonly path: string\n  /** The route accepts a bearer access token (enforced by the server access-token boundary). */\n  readonly accessToken: boolean\n  /** The route is proxied by the agent API gateway (a strict subset of the accessToken routes). */\n  readonly agentApi: boolean\n  /**\n   * What the route changes when the Agent calls it, for every `agentApi` route but a GET. The\n   * gateway holds `action` and `workflow` calls for the requester's approval when their mode asks.\n   */\n  readonly agentEffect?: AgentApiEffect\n  /** The canonical handler may run under an explicitly selected shared session. */\n  readonly sharedSession?: boolean\n}\n\n/**\n * `read` changes nothing (a read sent as POST); `memory` writes the Agent's own notes; `file` stores\n * a blob nothing points at yet; `model` costs what AI limits already bound.\n */\nexport type AgentApiEffect = \"read\" | \"action\" | \"workflow\" | \"memory\" | \"file\" | \"model\"\n\nexport const SIXB_API_ROUTES: readonly SixbApiRoute[] = [\n  {\n    operationId: \"getProjectInfo\",\n    method: \"GET\",\n    path: \"/api/project\",\n    accessToken: true,\n    agentApi: true,\n  },\n  // Token and service-account management is bearer-capable so the CLI can authenticate with a\n  // personal access token. It is NOT exposed to agents. The runtime still confines every operation\n  // to the caller's own groups, and service-account tokens are rejected (only user principals may\n  // manage credentials). Creating a token is the exception: it takes a signed-in session, so no\n  // access token can mint one broader or longer-lived than itself.\n  {\n    operationId: \"getAuthAccessManagementOptions\",\n    method: \"GET\",\n    path: \"/api/auth/access-management-options\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAuthAccessTokens\",\n    method: \"GET\",\n    path: \"/api/auth/access-tokens\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"createAuthPersonalAccessToken\",\n    method: \"POST\",\n    path: \"/api/auth/access-tokens\",\n    accessToken: false,\n    agentApi: false,\n  },\n  {\n    operationId: \"revokeAuthAccessToken\",\n    method: \"POST\",\n    path: \"/api/auth/access-tokens/:tokenId/revoke\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAuthServiceAccounts\",\n    method: \"GET\",\n    path: \"/api/auth/service-accounts\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"createAuthServiceAccount\",\n    method: \"POST\",\n    path: \"/api/auth/service-accounts\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"disableAuthServiceAccount\",\n    method: \"POST\",\n    path: \"/api/auth/service-accounts/:serviceAccountId/disable\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAuthServiceAccountAccessTokens\",\n    method: \"GET\",\n    path: \"/api/auth/service-accounts/:serviceAccountId/access-tokens\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"createAuthServiceAccountAccessToken\",\n    method: \"POST\",\n    path: \"/api/auth/service-accounts/:serviceAccountId/access-tokens\",\n    accessToken: false,\n    agentApi: false,\n  },\n  {\n    operationId: \"revokeAuthServiceAccountAccessToken\",\n    method: \"POST\",\n    path: \"/api/auth/service-accounts/:serviceAccountId/access-tokens/:tokenId/revoke\",\n    accessToken: true,\n    agentApi: false,\n  },\n  // Share lifecycle management is bearer-capable for programmatic administration but never\n  // agent-proxied. Shared sessions themselves use the canonical object/action routes and land in\n  // the request boundary separately.\n  {\n    operationId: \"issueSharedAccessGrant\",\n    method: \"POST\",\n    path: \"/api/share-grants\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listSharedAccessGrants\",\n    method: \"GET\",\n    path: \"/api/share-grants\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"revokeSharedAccessGrant\",\n    method: \"DELETE\",\n    path: \"/api/share-grants/:grantId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listObjectTypes\",\n    method: \"GET\",\n    path: \"/api/object-types\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"getObjectType\",\n    method: \"GET\",\n    path: \"/api/object-types/:objectTypeId\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"listObjects\",\n    method: \"GET\",\n    path: \"/api/objects\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"queryObjects\",\n    method: \"POST\",\n    path: \"/api/objects/query\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"read\",\n    sharedSession: true,\n  },\n  {\n    operationId: \"queryObjectLinks\",\n    method: \"POST\",\n    path: \"/api/objects/query/links\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"read\",\n    sharedSession: true,\n  },\n  {\n    operationId: \"countObjects\",\n    method: \"POST\",\n    path: \"/api/objects/query/count\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"read\",\n    sharedSession: true,\n  },\n  {\n    operationId: \"existsObjects\",\n    method: \"POST\",\n    path: \"/api/objects/query/exists\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"read\",\n    sharedSession: true,\n  },\n  {\n    operationId: \"facetObjects\",\n    method: \"POST\",\n    path: \"/api/objects/query/facets\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"read\",\n    sharedSession: true,\n  },\n  {\n    operationId: \"getObject\",\n    method: \"GET\",\n    path: \"/api/objects/:objectTypeId/:objectId\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  // A read: POST only so the value, an email say, stays out of URLs and their logs.\n  {\n    operationId: \"getObjectByUniqueProperty\",\n    method: \"POST\",\n    path: \"/api/objects/:objectTypeId/by/:propertyId\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"read\",\n    sharedSession: true,\n  },\n  // The four write routes. Bearer-capable because their execution facade enforces authorization\n  // (`edit:object` / `append:telemetry`), which is exactly the precondition this table requires.\n  // NOT agent-proxied: letting an agent turn write objects on its own is a separate decision, and\n  // the gateway already hands routes an execution SDK, so flipping `agentApi` later needs no\n  // authorization work — only that decision.\n  {\n    operationId: \"upsertObject\",\n    method: \"PUT\",\n    path: \"/api/objects/:objectTypeId/:objectId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"upsertObjectLink\",\n    method: \"PUT\",\n    path: \"/api/objects/:objectTypeId/:objectId/links/:linkId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"removeObjectLink\",\n    method: \"DELETE\",\n    path: \"/api/objects/:objectTypeId/:objectId/links/:linkId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"appendTelemetry\",\n    method: \"POST\",\n    path: \"/api/objects/:objectTypeId/:objectId/telemetry/:propertyId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getBulkTelemetryHistory\",\n    method: \"POST\",\n    path: \"/api/telemetry/history\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"read\",\n    sharedSession: true,\n  },\n  {\n    operationId: \"getTelemetryHistory\",\n    method: \"GET\",\n    path: \"/api/objects/:objectTypeId/:objectId/telemetry/:propertyId/history\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"getLatestTelemetry\",\n    method: \"GET\",\n    path: \"/api/objects/:objectTypeId/:objectId/telemetry/:propertyId/latest\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"getObjectFileContent\",\n    method: \"GET\",\n    path: \"/api/objects/:objectTypeId/:objectId/files/content\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    // Bearer-capable (CLI/programmatic existence + range probes) but NOT agent-proxied: the agent\n    // API gateway only forwards GET/POST, and an agent gains nothing from HEAD over GET (a file's\n    // size already travels in its FileRef). Keeping this agentApi:true would throw at gateway\n    // registration (\"Unsupported agent API gateway method 'HEAD'\") and stop the server booting.\n    operationId: \"headObjectFileContent\",\n    method: \"HEAD\",\n    path: \"/api/objects/:objectTypeId/:objectId/files/content\",\n    accessToken: true,\n    agentApi: false,\n    sharedSession: true,\n  },\n  {\n    operationId: \"listActions\",\n    method: \"GET\",\n    path: \"/api/actions\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"getAction\",\n    method: \"GET\",\n    path: \"/api/actions/:actionId\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"requestAction\",\n    method: \"POST\",\n    path: \"/api/actions/:actionId\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"action\",\n    sharedSession: true,\n  },\n  {\n    operationId: \"uploadFileRaw\",\n    method: \"POST\",\n    path: \"/api/files\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"file\",\n  },\n  {\n    operationId: \"listActionRuns\",\n    method: \"GET\",\n    path: \"/api/action-runs\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getActionRun\",\n    method: \"GET\",\n    path: \"/api/action-runs/:runId\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"getActionRunFileContent\",\n    method: \"GET\",\n    path: \"/api/action-runs/:runId/files/content\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"headActionRunFileContent\",\n    method: \"HEAD\",\n    path: \"/api/action-runs/:runId/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listWorkflows\",\n    method: \"GET\",\n    path: \"/api/workflows\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getWorkflow\",\n    method: \"GET\",\n    path: \"/api/workflows/:workflowId\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"requestWorkflowRun\",\n    method: \"POST\",\n    path: \"/api/workflows/:workflowId/runs\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"workflow\",\n  },\n  {\n    operationId: \"listWorkflowRuns\",\n    method: \"GET\",\n    path: \"/api/workflow-runs\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getWorkflowRun\",\n    method: \"GET\",\n    path: \"/api/workflow-runs/:runId\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"cancelWorkflowRun\",\n    method: \"POST\",\n    path: \"/api/workflow-runs/:runId/cancel\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getWorkflowAgentNodeExecution\",\n    method: \"GET\",\n    path: \"/api/workflow-runs/:runId/nodes/:nodeKey/agent-execution\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getWorkflowRunFileContent\",\n    method: \"GET\",\n    path: \"/api/workflow-runs/:runId/files/content\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"headWorkflowRunFileContent\",\n    method: \"HEAD\",\n    path: \"/api/workflow-runs/:runId/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getWorkflowNodeRunFileContent\",\n    method: \"GET\",\n    path: \"/api/workflow-runs/:runId/nodes/:nodeKey/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"headWorkflowNodeRunFileContent\",\n    method: \"HEAD\",\n    path: \"/api/workflow-runs/:runId/nodes/:nodeKey/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getAgentMessageFileContent\",\n    method: \"GET\",\n    path: \"/api/agent-threads/:threadId/messages/:messageId/files/content\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"headAgentMessageFileContent\",\n    method: \"HEAD\",\n    path: \"/api/agent-threads/:threadId/messages/:messageId/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  // A sub-agent's files are for people reading its conversation; its parent got them from\n  // `wait_agent`.\n  {\n    operationId: \"getAgentChildFileContent\",\n    method: \"GET\",\n    path: \"/api/agent-threads/:threadId/child-files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"headAgentChildFileContent\",\n    method: \"HEAD\",\n    path: \"/api/agent-threads/:threadId/child-files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  // The Agent reads and saves its memory with `sixb memory` in its sandbox. Its history and deleting\n  // a repo are for people, so they stay off the gateway.\n  {\n    operationId: \"getAgentMemory\",\n    method: \"GET\",\n    path: \"/api/agent-memory/:repo\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"listAgentMemoryRevisions\",\n    method: \"GET\",\n    path: \"/api/agent-memory/:repo/revisions\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"saveAgentMemory\",\n    method: \"POST\",\n    path: \"/api/agent-memory/:repo/revisions\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"memory\",\n  },\n  {\n    operationId: \"deleteAgentMemory\",\n    method: \"DELETE\",\n    path: \"/api/agent-memory/:repo\",\n    accessToken: true,\n    agentApi: false,\n  },\n  // Artifacts are reachable with an access token, so the CLI and integrations can publish them. The\n  // Agent publishes through its own tool, not the gateway.\n  {\n    operationId: \"listArtifacts\",\n    method: \"GET\",\n    path: \"/api/artifacts\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"createArtifact\",\n    method: \"POST\",\n    path: \"/api/artifacts\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getArtifact\",\n    method: \"GET\",\n    path: \"/api/artifacts/:artifactId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"deleteArtifact\",\n    method: \"DELETE\",\n    path: \"/api/artifacts/:artifactId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getArtifactState\",\n    method: \"GET\",\n    path: \"/api/artifacts/:artifactId/state\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"clearArtifactState\",\n    method: \"DELETE\",\n    path: \"/api/artifacts/:artifactId/state\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"setArtifactState\",\n    method: \"PUT\",\n    path: \"/api/artifacts/:artifactId/state/:key\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"deleteArtifactStateValue\",\n    method: \"DELETE\",\n    path: \"/api/artifacts/:artifactId/state/:key\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"publishArtifactVersion\",\n    method: \"POST\",\n    path: \"/api/artifacts/:artifactId/versions\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getArtifactVersion\",\n    method: \"GET\",\n    path: \"/api/artifacts/:artifactId/versions/:version\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getArtifactQuery\",\n    method: \"GET\",\n    path: \"/api/artifacts/:artifactId/versions/:version/queries/:name\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"createArtifactFrame\",\n    method: \"POST\",\n    path: \"/api/artifacts/:artifactId/versions/:version/frame\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getArtifactFileContent\",\n    method: \"GET\",\n    path: \"/api/artifacts/:artifactId/versions/:version/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"headArtifactFileContent\",\n    method: \"HEAD\",\n    path: \"/api/artifacts/:artifactId/versions/:version/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"searchObjects\",\n    method: \"GET\",\n    path: \"/api/objects/search\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"listEvents\",\n    method: \"GET\",\n    path: \"/api/events\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listLogs\",\n    method: \"GET\",\n    path: \"/api/logs\",\n    accessToken: true,\n    agentApi: false,\n  },\n  // A browser records its own activity, signed in or through a shared link. Access tokens never\n  // do: a script is not a visit.\n  {\n    operationId: \"getActivityCaptureConfig\",\n    method: \"GET\",\n    path: \"/api/activity/capture-config\",\n    accessToken: false,\n    agentApi: false,\n    sharedSession: true,\n  },\n  {\n    operationId: \"captureActivity\",\n    method: \"POST\",\n    path: \"/api/activity/events\",\n    accessToken: false,\n    agentApi: false,\n    sharedSession: true,\n  },\n  {\n    operationId: \"listActivityVisits\",\n    method: \"GET\",\n    path: \"/api/activity/visits\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listActivityUsers\",\n    method: \"GET\",\n    path: \"/api/activity/users\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getActivitySummary\",\n    method: \"GET\",\n    path: \"/api/activity/summary\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getActivityCalendar\",\n    method: \"GET\",\n    path: \"/api/activity/calendar\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getActivityVisitTimeline\",\n    method: \"GET\",\n    path: \"/api/activity/visits/:visitId/timeline\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listActivityConnections\",\n    method: \"GET\",\n    path: \"/api/activity/connections\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listUsers\",\n    method: \"GET\",\n    path: \"/api/users\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getUser\",\n    method: \"GET\",\n    path: \"/api/users/:userId\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"listModels\",\n    method: \"GET\",\n    path: \"/api/models\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"generateText\",\n    method: \"POST\",\n    path: \"/api/models/language/generations\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"model\",\n  },\n  {\n    operationId: \"generateImages\",\n    method: \"POST\",\n    path: \"/api/models/image/generations\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"model\",\n  },\n  {\n    operationId: \"generateSpeech\",\n    method: \"POST\",\n    path: \"/api/models/audio/speech\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"model\",\n  },\n  {\n    operationId: \"transcribeAudio\",\n    method: \"POST\",\n    path: \"/api/models/audio/transcriptions\",\n    accessToken: true,\n    agentApi: true,\n    agentEffect: \"model\",\n  },\n  {\n    operationId: \"getAiAccountingOverview\",\n    method: \"GET\",\n    path: \"/api/ai/accounting/overview\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAiModelCalls\",\n    method: \"GET\",\n    path: \"/api/ai/model-calls\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getAiModelCallFiles\",\n    method: \"GET\",\n    path: \"/api/ai/model-calls/:callId/files\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getAiModelCallFileContent\",\n    method: \"GET\",\n    path: \"/api/ai/model-calls/:callId/files/content\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"headAiModelCallFileContent\",\n    method: \"HEAD\",\n    path: \"/api/ai/model-calls/:callId/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAiModelCallGroups\",\n    method: \"GET\",\n    path: \"/api/ai/model-call-groups\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAiLimitPolicies\",\n    method: \"GET\",\n    path: \"/api/ai/limits\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getAiLimitStatus\",\n    method: \"GET\",\n    path: \"/api/ai/limits/status\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getAiLimitSubjectOptions\",\n    method: \"GET\",\n    path: \"/api/ai/limits/subjects\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"createAiLimitPolicy\",\n    method: \"POST\",\n    path: \"/api/ai/limits\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"updateAiLimitPolicy\",\n    method: \"PUT\",\n    path: \"/api/ai/limits/:limitId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"deleteAiLimitPolicy\",\n    method: \"DELETE\",\n    path: \"/api/ai/limits/:limitId\",\n    accessToken: true,\n    agentApi: false,\n  },\n]\n\n/**\n * The table's invariants, enforced at module load. A gateway-proxied route must also be a bearer\n * route, or the gateway would expose a surface the access-token boundary does not recognize. A\n * gateway-proxied route that can change state names what it changes, so a route added later cannot\n * skip the approval gate by accident.\n */\nexport function assertSixbApiRoutes(routes: readonly SixbApiRoute[]): void {\n  for (const route of routes) {\n    if (route.agentApi && !route.accessToken) {\n      throw new Error(\n        `[Sixb] agent API route '${route.method} ${route.path}' must also be an access-token route.`\n      )\n    }\n    if (route.agentApi && route.method !== \"GET\" && route.agentEffect === undefined) {\n      throw new Error(\n        `[Sixb] agent API route '${route.method} ${route.path}' must declare its agentEffect.`\n      )\n    }\n  }\n}\n\nassertSixbApiRoutes(SIXB_API_ROUTES)\n",
+    "/**\n * Shared HTTP route-pattern matching. Used by both the agent API gateway allow-list (@sixb/core)\n * and the server's access-token boundary (@sixb/server) so the two never drift.\n */\n\n/** Split a path into its non-empty segments (drops leading/trailing/empty parts). */\nexport function pathSegmentsFor(pathname: string): string[] {\n  return pathname.split(\"/\").filter(Boolean)\n}\n\n/**\n * Match a concrete pathname against a route pattern. A `:param` pattern segment matches any single\n * non-empty segment; every other segment must match exactly. Segment counts must be equal.\n */\nexport function matchesPathPattern(pathname: string, pattern: string): boolean {\n  const pathSegments = pathSegmentsFor(pathname)\n  const patternSegments = pathSegmentsFor(pattern)\n\n  if (pathSegments.length !== patternSegments.length) {\n    return false\n  }\n\n  return patternSegments.every((patternSegment, index) => {\n    if (patternSegment.startsWith(\":\")) {\n      return pathSegments[index] !== \"\"\n    }\n    return patternSegment === pathSegments[index]\n  })\n}\n\n/** Strip a single trailing slash so `/api/foo` and `/api/foo/` compare equal (leaves \"/\" alone). */\nexport function normalizeRoutePath(pathname: string): string {\n  if (pathname.length > 1 && pathname.endsWith(\"/\")) {\n    return pathname.slice(0, -1)\n  }\n  return pathname\n}\n"
+  ],
+  "mappings": ";;AAoCO,IAAM,mBAA2C;AAAA,EACtD;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EAMA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EAIA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EAEA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EAMA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IAKE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,IACb,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EAGA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EAGA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EAGA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EAGA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AACF;AAQO,SAAS,mBAAmB,CAAC,QAAuC;AAAA,EACzE,WAAW,SAAS,QAAQ;AAAA,IAC1B,IAAI,MAAM,YAAY,CAAC,MAAM,aAAa;AAAA,MACxC,MAAM,IAAI,MACR,2BAA2B,MAAM,UAAU,MAAM,2CACnD;AAAA,IACF;AAAA,IACA,IAAI,MAAM,YAAY,MAAM,WAAW,SAAS,MAAM,gBAAgB,WAAW;AAAA,MAC/E,MAAM,IAAI,MACR,2BAA2B,MAAM,UAAU,MAAM,qCACnD;AAAA,IACF;AAAA,EACF;AAAA;AAGF,oBAAoB,gBAAe;;;AC70B5B,SAAS,gBAAe,CAAC,UAA4B;AAAA,EAC1D,OAAO,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AAAA;AAOpC,SAAS,mBAAkB,CAAC,UAAkB,SAA0B;AAAA,EAC7E,MAAM,eAAe,iBAAgB,QAAQ;AAAA,EAC7C,MAAM,kBAAkB,iBAAgB,OAAO;AAAA,EAE/C,IAAI,aAAa,WAAW,gBAAgB,QAAQ;AAAA,IAClD,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,gBAAgB,MAAM,CAAC,gBAAgB,UAAU;AAAA,IACtD,IAAI,eAAe,WAAW,GAAG,GAAG;AAAA,MAClC,OAAO,aAAa,WAAW;AAAA,IACjC;AAAA,IACA,OAAO,mBAAmB,aAAa;AAAA,GACxC;AAAA;AAII,SAAS,mBAAkB,CAAC,UAA0B;AAAA,EAC3D,IAAI,SAAS,SAAS,KAAK,SAAS,SAAS,GAAG,GAAG;AAAA,IACjD,OAAO,SAAS,MAAM,GAAG,EAAE;AAAA,EAC7B;AAAA,EACA,OAAO;AAAA;",
+  "debugId": "417CCDE96E10FD7D64756E2164756E21",
+  "names": []
+}

package/dist/{chunk-447a5c0p.js → chunk-6n69k945.js}

@@ -2,10 +2,10 @@
 import {
   normalizeSchemaValue2,
   coerceSchemaValueToTyped2
-} from "./chunk-8frc8a4j.js";
+} from "./chunk-65pyhyas.js";
 import {
   validateSchemaOrRefValue2
-} from "./chunk-s7jg7pmn.js";
+} from "./chunk-bab05bhg.js";
 import {
   OntologyValidationError2
 } from "./chunk-cqr3acm1.js";

package/dist/{chunk-0bphap9y.js → chunk-6p0pastb.js}

@@ -2,17 +2,17 @@
 import {
   createSixbError2,
   toSixbFailure2
-} from "./chunk-dvd2fp9q.js";
+} from "./chunk-zbc929zg.js";
 import {
   reportRunFailure2
-} from "./chunk-cy4mbddw.js";
+} from "./chunk-48jezz3j.js";
 import {
   resolveExecutionScopeAuthorization,
   assertAuthorized2
-} from "./chunk-6vb4st8k.js";
+} from "./chunk-yc9ners4.js";
 import {
   SYNC_RUN_FAILURE_CODES2
-} from "./chunk-918wwnaa.js";
+} from "./chunk-ezne9wc9.js";
 import {
   SyncRunError2
 } from "./chunk-jmfet9r4.js";
@@ -20,7 +20,7 @@ import {
   executionRecordInputFromRuntime,
   ensureExecutionRecord2,
   createPrimitiveExecutionRecord
-} from "./chunk-vf57cr4t.js";
+} from "./chunk-hyesv9dv.js";
 
 // src/syncs/errors.ts
 class SyncValidationError2 extends Error {

package/dist/{chunk-9j4jw7as.js → chunk-6rrtzea3.js}

@@ -3,15 +3,16 @@ import {
   AuthStorageError2,
   SYSTEM_PRINCIPAL2,
   principalsEqual2
-} from "./chunk-nn5xnx3s.js";
+} from "./chunk-h3pbv7n8.js";
 import {
   createSixbError2
-} from "./chunk-dvd2fp9q.js";
+} from "./chunk-zbc929zg.js";
 import {
   agentServiceAccountId2,
   AuthorizationError2,
+  isAllowed2,
   resolveAuthorizationContext2
-} from "./chunk-6vb4st8k.js";
+} from "./chunk-yc9ners4.js";
 import {
   appliedLinkKey,
   NO_APPLIED_MARKINGS
@@ -260,6 +261,18 @@ async function resolveAgentExecutionAuthorization2(input) {
     })
   };
 }
+async function userCanRunAgent2(input) {
+  const memberships = await input.auth.groupMemberships.listForUser({
+    projectId: input.projectId,
+    userId: input.userId
+  });
+  const context = resolveAuthorizationContext2({
+    principal: { type: "user", id: input.userId },
+    groupIds: memberships.map((membership) => membership.groupId),
+    roles: input.security.listResolvedRoles()
+  });
+  return isAllowed2(context, { kind: "agent.run" });
+}
 async function resolveInheritedAgentExecutionAuthorization2(input) {
   if (input.authorizationRef.type === "disabled")
     return { type: "disabled" };
@@ -408,6 +421,6 @@ function invalidExecution(executionId, runId) {
   throw new WorkflowRunError2(`[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`);
 }
 
-export { missingClearanceRedactions, unreadableError, resolvePropertyClearance, WorkflowRunError2, resolveAgentPropertyClearance2, ensureManagedAgentExecutionIdentity2, resolveAgentExecutionAuthorization2, resolveInheritedAgentExecutionAuthorization2, assertWorkflowRunExecution2, assertWorkflowAgentNodeRunExecution2 };
+export { WorkflowRunError2, missingClearanceRedactions, unreadableError, resolvePropertyClearance, resolveAgentPropertyClearance2, ensureManagedAgentExecutionIdentity2, resolveAgentExecutionAuthorization2, userCanRunAgent2, resolveInheritedAgentExecutionAuthorization2, assertWorkflowRunExecution2, assertWorkflowAgentNodeRunExecution2 };
 
-//# debugId=EF48F11D7BDB825E64756E2164756E21
+//# debugId=C3E7FA1E69C6C30464756E2164756E21

package/dist/chunk-6rrtzea3.js.map

@@ -0,0 +1,14 @@
+{
+  "version": 3,
+  "sources": ["../src/security/redactions.ts", "../src/objects/property-clearance.ts", "../src/agents/authority.ts", "../src/storage/workflow-runs/errors.ts", "../src/storage/workflow-runs/provider.ts"],
+  "sourcesContent": [
+    "import type { Redactions } from \"./types\"\n\nconst MISSING_CLEARANCE = Object.freeze({ reason: \"missing_clearance\" } as const)\n\n/**\n * List the values hidden from a reader that lacks a clearance for their markings. Deeply frozen,\n * so every row and event redacted the same way can share it.\n */\nexport function missingClearanceRedactions(ids: Iterable<string>): Redactions {\n  return Object.freeze(Object.fromEntries([...ids].map((id) => [id, MISSING_CLEARANCE] as const)))\n}\n",
+    "import { AuthorizationError } from \"../authorization/errors\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport {\n  type AppliedMarkingsSnapshot,\n  type AppliedSeal,\n  appliedLinkKey,\n  NO_APPLIED_MARKINGS,\n} from \"../security/applied-markings-snapshot\"\nimport { missingClearanceRedactions } from \"../security/redactions\"\nimport type { Redactions } from \"../security/types\"\n\n/**\n * The marked properties one reader cannot read, resolved once from its clearances.\n *\n * A property is readable when the reader clears every one of its markings. Unreadable properties\n * are omitted from rows and cannot be used to select, order, or aggregate objects.\n *\n * Markings a projection's applied dataset version still carries extend this: its properties keep\n * them, and an object type or link whose key column carries markings the reader lacks is\n * unreadable, like a type it has no view grant for.\n */\nexport interface PropertyClearance {\n  /** What the reader cannot read on this object type; `undefined` when it reads every property. */\n  hiddenProperties(objectTypeId: string): HiddenProperties | undefined\n  /** First marking on the property that the reader is not cleared for. */\n  missingMarking(objectTypeId: string, propertyId: string): string | undefined\n  /** Why the reader cannot read this object type at all; `undefined` when it can. */\n  unreadableType(objectTypeId: string): Unreadable | undefined\n  /** Why the reader cannot read this link, keyed by its source type; `undefined` when it can. */\n  unreadableLink(objectTypeId: string, linkId: string): Unreadable | undefined\n  /** Every object type and link the reader cannot read, for link queries that name none. */\n  unreadable(): UnreadableTargets\n}\n\n/** A marking the reader lacks on what makes an object type or link unreadable, and why. */\nexport interface Unreadable {\n  readonly marking: string\n  readonly message: string\n}\n\nexport interface UnreadableTargets {\n  readonly types: ReadonlyMap<string, Unreadable>\n  readonly links: readonly (Unreadable & {\n    readonly objectTypeId: string\n    readonly linkId: string\n    readonly targetObjectTypeId: string\n  })[]\n}\n\n/** The error a read of an unreadable object type or link fails with: a 403. */\nexport function unreadableError(unreadable: Unreadable): AuthorizationError {\n  return new AuthorizationError(`clearance:marking:${unreadable.marking}`, unreadable.message)\n}\n\n/**\n * The properties of one object type a clearance set hides. It depends only on the type and the\n * clearances, so it is computed once and shared by every row and event redacted with it.\n */\nexport interface HiddenProperties {\n  readonly ids: ReadonlySet<string>\n  /**\n   * The `redactions` record of a redacted row or event. It lists every hidden property, whether or\n   * not a row holds a value: listing only present values would reveal which ones are empty.\n   *\n   * Deeply frozen, because every redacted row and event shares it.\n   */\n  readonly redactions: Redactions\n}\n\n// Readers are built per execution, but few distinct clearance sets exist per ontology.\nconst clearancesByOntology = new WeakMap<\n  OntologyDefinitionCatalog,\n  Map<string, PropertyClearance | undefined>\n>()\n// Applied markings change rarely, and a snapshot is replaced only when its content changes.\nconst appliedClearancesByOntology = new WeakMap<\n  OntologyDefinitionCatalog,\n  WeakMap<AppliedMarkingsSnapshot, Map<string, PropertyClearance | undefined>>\n>()\n\nconst NO_UNREADABLE_TARGETS: UnreadableTargets = Object.freeze({\n  types: new Map(),\n  links: Object.freeze([]),\n})\n\n/**\n * Resolve what a reader with these clearances cannot read. Returns `undefined` when it can read\n * every property, so callers skip redaction entirely.\n *\n * A reader cleared for every marking the applied versions add receives the clearance of the code\n * alone, the same object whatever the snapshot.\n */\nexport function resolvePropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  clearances: ReadonlySet<string>,\n  applied: AppliedMarkingsSnapshot = NO_APPLIED_MARKINGS\n): PropertyClearance | undefined {\n  const key = JSON.stringify([...clearances].sort())\n\n  if (applied === NO_APPLIED_MARKINGS || clearsEvery(clearances, applied.markings)) {\n    let resolved = clearancesByOntology.get(ontology)\n    if (!resolved) {\n      resolved = new Map()\n      clearancesByOntology.set(ontology, resolved)\n    }\n\n    if (!resolved.has(key)) resolved.set(key, createPropertyClearance(ontology, clearances))\n    return resolved.get(key)\n  }\n\n  let bySnapshot = appliedClearancesByOntology.get(ontology)\n  if (!bySnapshot) {\n    bySnapshot = new WeakMap()\n    appliedClearancesByOntology.set(ontology, bySnapshot)\n  }\n\n  let resolved = bySnapshot.get(applied)\n  if (!resolved) {\n    resolved = new Map()\n    bySnapshot.set(applied, resolved)\n  }\n\n  if (!resolved.has(key)) {\n    resolved.set(key, createPropertyClearance(ontology, clearances, applied))\n  }\n  return resolved.get(key)\n}\n\nfunction clearsEvery(clearances: ReadonlySet<string>, markings: ReadonlySet<string>): boolean {\n  for (const markingId of markings) if (!clearances.has(markingId)) return false\n  return true\n}\n\nfunction createPropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  clearances: ReadonlySet<string>,\n  applied: AppliedMarkingsSnapshot = NO_APPLIED_MARKINGS\n): PropertyClearance | undefined {\n  const missingByType = new Map<string, ReadonlyMap<string, string>>()\n  const hiddenByType = new Map<string, HiddenProperties>()\n  for (const objectType of ontology.listObjectTypes()) {\n    const surplus = applied.properties.get(objectType.id)\n    const missing = new Map<string, string>()\n    for (const property of objectType.properties) {\n      const marking =\n        property.markings?.find((markingId) => !clearances.has(markingId)) ??\n        firstMissing(surplus?.get(property.id), clearances)\n      if (marking !== undefined) missing.set(property.id, marking)\n    }\n\n    if (missing.size === 0) continue\n\n    missingByType.set(objectType.id, missing)\n    hiddenByType.set(\n      objectType.id,\n      Object.freeze({\n        ids: new Set(missing.keys()),\n        redactions: missingClearanceRedactions(missing.keys()),\n      })\n    )\n  }\n\n  const types = new Map<string, Unreadable>()\n  for (const [objectTypeId, seals] of applied.types) {\n    const unreadable = unreadableBy(seals, clearances, `'${objectTypeId}'`)\n    if (unreadable) types.set(objectTypeId, unreadable)\n  }\n\n  const links: UnreadableTargets[\"links\"][number][] = []\n  const linksByKey = new Map<string, Unreadable>()\n  for (const [key, link] of applied.links) {\n    const name = `link '${link.objectTypeId}.${link.linkId}'`\n    const unreadable = unreadableBy(link.seals, clearances, name)\n    if (!unreadable) continue\n\n    linksByKey.set(key, unreadable)\n    links.push(\n      Object.freeze({\n        ...unreadable,\n        objectTypeId: link.objectTypeId,\n        linkId: link.linkId,\n        targetObjectTypeId: link.targetObjectTypeId,\n      })\n    )\n  }\n\n  if (hiddenByType.size === 0 && types.size === 0 && links.length === 0) return undefined\n\n  const unreadable: UnreadableTargets =\n    types.size === 0 && links.length === 0\n      ? NO_UNREADABLE_TARGETS\n      : Object.freeze({ types, links: Object.freeze(links) })\n  return Object.freeze({\n    hiddenProperties: (objectTypeId: string) => hiddenByType.get(objectTypeId),\n    missingMarking: (objectTypeId: string, propertyId: string) =>\n      missingByType.get(objectTypeId)?.get(propertyId),\n    unreadableType: (objectTypeId: string) => types.get(objectTypeId),\n    unreadableLink: (objectTypeId: string, linkId: string) =>\n      linksByKey.get(appliedLinkKey(objectTypeId, linkId)),\n    unreadable: () => unreadable,\n  })\n}\n\nfunction firstMissing(\n  markings: ReadonlySet<string> | undefined,\n  clearances: ReadonlySet<string>\n): string | undefined {\n  if (!markings) return undefined\n  for (const markingId of [...markings].sort()) if (!clearances.has(markingId)) return markingId\n  return undefined\n}\n\n/** The first seal the reader lacks a marking for, as the message a denied read returns. */\nfunction unreadableBy(\n  seals: readonly AppliedSeal[],\n  clearances: ReadonlySet<string>,\n  name: string\n): Unreadable | undefined {\n  for (const seal of seals) {\n    const marking = firstMissing(seal.markings, clearances)\n    if (marking === undefined) continue\n    return Object.freeze({\n      marking,\n      message: `[Sixb] Cannot read ${name} until projection '${seal.projectionId}' applies a compliant version: ${seal.reason} carries marking '${marking}'.`,\n    })\n  }\n  return undefined\n}\n",
+    "import { principalsEqual, SYSTEM_PRINCIPAL } from \"../auth\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport { isAllowed, resolveAuthorizationContext } from \"../authorization\"\nimport { createSixbError } from \"../errors/internal\"\nimport type { AuthorizablePrincipal, AuthorizationRef } from \"../execution\"\nimport { type PropertyClearance, resolvePropertyClearance } from \"../objects/property-clearance\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport type { SecurityDefinitionCatalog } from \"../security\"\nimport type {\n  AccessTokenRecord,\n  AuthStorage,\n  ServiceAccountGroupMembershipRecord,\n  ServiceAccountRecord,\n  SessionRecord,\n  UserRecord,\n} from \"../storage/auth\"\nimport { AuthStorageError } from \"../storage/auth\"\nimport { agentServiceAccountId } from \"./identity\"\n\nexport type AgentExecutionAuthorization =\n  | { readonly type: \"principal\"; readonly context: AuthorizationContext }\n  | { readonly type: \"disabled\" }\n\n/**\n * The marked properties an Agent execution cannot read, resolved exactly as its object reader\n * resolves them. Disabled authorization reads everything.\n */\nexport function resolveAgentPropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  authorization: AgentExecutionAuthorization\n): PropertyClearance | undefined {\n  return authorization.type === \"principal\"\n    ? resolvePropertyClearance(ontology, authorization.context.clearances ?? new Set())\n    : undefined\n}\n\ntype UserCredentialRef = NonNullable<\n  Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n>\n\ninterface CredentialedUserAuthorizationRef {\n  readonly type: \"principal\"\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"user\" }>\n  readonly credential: UserCredentialRef\n}\n\nexport { agentServiceAccountId } from \"./identity\"\n\nexport interface AgentExecutionIdentity {\n  readonly serviceAccount: ServiceAccountRecord\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"serviceAccount\" }>\n  readonly groupMemberships: readonly ServiceAccountGroupMembershipRecord[]\n}\n\n/** Ensure a framework-managed Agent actor exists with exactly its declared group memberships. */\nexport async function ensureManagedAgentExecutionIdentity(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly name: string\n  readonly description: string\n  readonly groupIds: readonly string[]\n}): Promise<AgentExecutionIdentity> {\n  const auth = requireAuthStorage(input.auth)\n  const id = agentServiceAccountId(input.actorId)\n  const now = new Date()\n  const loaded = await loadOrCreateAgentServiceAccount(auth, {\n    id,\n    projectId: input.projectId,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertFrameworkManagedAgentServiceAccount(input.actorId, loaded)\n  assertActiveAgentServiceAccount(input.actorId, loaded)\n  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {\n    existing: loaded,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertActiveAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: id,\n      groupIds: input.groupIds,\n      source: \"agent\",\n      updatedAt: now,\n    })\n  )\n\n  return {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id },\n    groupMemberships,\n  }\n}\n\n/** Load the managed identity, recovering only the expected concurrent-create race. */\nasync function loadOrCreateAgentServiceAccount(\n  auth: AuthStorage,\n  input: {\n    readonly id: string\n    readonly projectId: string\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  const existing = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: input.id,\n  })\n  if (existing) return existing\n\n  try {\n    return await auth.serviceAccounts.create({\n      id: input.id,\n      projectId: input.projectId,\n      name: input.name,\n      description: input.description,\n      status: \"active\",\n      createdByPrincipal: SYSTEM_PRINCIPAL,\n      createdAt: input.updatedAt,\n      updatedAt: input.updatedAt,\n    })\n  } catch (error) {\n    if (!(error instanceof AuthStorageError) || error.code !== \"duplicate_service_account\") {\n      throw error\n    }\n    const concurrent = await auth.serviceAccounts.getById({\n      projectId: input.projectId,\n      id: input.id,\n    })\n    if (!concurrent) throw error\n    return concurrent\n  }\n}\n\nfunction assertActiveAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (serviceAccount.status === \"suspended\") {\n    throw new Error(\n      `[Sixb] Agent '${actorId}' service account '${serviceAccount.id}' is suspended.`\n    )\n  }\n}\n\nfunction assertFrameworkManagedAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (\n    serviceAccount.createdByPrincipal === undefined ||\n    !principalsEqual(serviceAccount.createdByPrincipal, SYSTEM_PRINCIPAL)\n  ) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' cannot use service account '${serviceAccount.id}' because it is not managed by Sixb.`,\n      { details: { actorId, serviceAccountId: serviceAccount.id } }\n    )\n  }\n}\n\nfunction requireDefinitionOwnedGroupMemberships(\n  actorId: string,\n  memberships: readonly ServiceAccountGroupMembershipRecord[]\n): readonly ServiceAccountGroupMembershipRecord[] {\n  const externalGroupIds = memberships\n    .filter((membership) => membership.source !== \"agent\")\n    .map((membership) => membership.groupId)\n  if (externalGroupIds.length > 0) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' service account has group memberships not managed by its definition: ${externalGroupIds.join(\", \")}.`,\n      { details: { actorId, externalGroupIds } }\n    )\n  }\n  return memberships\n}\n\n/** Resolve current grants for the service account referenced by a durable Agent execution. */\nexport async function resolveAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n}): Promise<{ readonly identity: AgentExecutionIdentity; readonly context: AuthorizationContext }> {\n  const auth = requireAuthStorage(input.auth)\n  const expectedId = agentServiceAccountId(input.actorId)\n  const principal =\n    input.authorizationRef.type === \"principal\" ? input.authorizationRef.principal : null\n  if (principal?.type !== \"serviceAccount\" || principal.id !== expectedId) {\n    throw new Error(\n      `[Sixb] Agent '${input.actorId}' execution authority must reference service account '${expectedId}'.`\n    )\n  }\n\n  const serviceAccount = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: principal.id,\n  })\n  if (!serviceAccount || serviceAccount.status !== \"active\") {\n    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`)\n  }\n  assertFrameworkManagedAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.listForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: principal.id,\n    })\n  )\n  const identity: AgentExecutionIdentity = {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id: principal.id },\n    groupMemberships,\n  }\n  return {\n    identity,\n    context: resolveAuthorizationContext({\n      principal: identity.principal,\n      groupIds: groupMemberships.map((membership) => membership.groupId),\n      roles: input.security.listResolvedRoles(),\n    }),\n  }\n}\n\n/**\n * Whether a user may talk to the Agent now, through the groups they belong to and the project's\n * roles: who is added to a conversation, or named to the model as taking part in it.\n */\nexport async function userCanRunAgent(input: {\n  readonly auth: AuthStorage\n  readonly projectId: string\n  readonly userId: string\n  readonly security: SecurityDefinitionCatalog\n}): Promise<boolean> {\n  const memberships = await input.auth.groupMemberships.listForUser({\n    projectId: input.projectId,\n    userId: input.userId,\n  })\n\n  const context = resolveAuthorizationContext({\n    principal: { type: \"user\", id: input.userId },\n    groupIds: memberships.map((membership) => membership.groupId),\n    roles: input.security.listResolvedRoles(),\n  })\n  return isAllowed(context, { kind: \"agent.run\" })\n}\n\n/** Revalidate the durable user authority inherited by a conversational or child Agent. */\nexport async function resolveInheritedAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n  readonly now?: Date\n}): Promise<AgentExecutionAuthorization> {\n  if (input.authorizationRef.type === \"disabled\") return { type: \"disabled\" }\n\n  const ref = requireCredentialedUserAuthority(input.authorizationRef)\n  const auth = requireAuthStorage(input.auth)\n  const now = input.now ?? new Date()\n  const user = await requireActiveUser(auth, input.projectId, ref.principal.id)\n  const memberships = await auth.groupMemberships.listForUser({\n    projectId: input.projectId,\n    userId: user.id,\n  })\n  const credential = await revalidateUserCredential({\n    auth,\n    projectId: input.projectId,\n    userId: user.id,\n    credential: ref.credential,\n    currentGroupIds: memberships.map((membership) => membership.groupId),\n    now,\n  })\n\n  return {\n    type: \"principal\",\n    context: resolveAuthorizationContext({\n      principal: ref.principal,\n      groupIds: credential.groupIds,\n      roles: input.security.listResolvedRoles(),\n      ...(credential.sessionId === undefined ? {} : { sessionId: credential.sessionId }),\n    }),\n  }\n}\n\nfunction requireCredentialedUserAuthority(ref: AuthorizationRef): CredentialedUserAuthorizationRef {\n  if (ref.type !== \"principal\" || ref.principal.type !== \"user\" || ref.credential === undefined) {\n    throw invalidInheritedAuthority(\"the durable reference is not a credentialed user\")\n  }\n  return {\n    type: \"principal\",\n    principal: { type: \"user\", id: ref.principal.id },\n    credential: { type: ref.credential.type, id: ref.credential.id },\n  }\n}\n\nasync function requireActiveUser(\n  auth: AuthStorage,\n  projectId: string,\n  userId: string\n): Promise<UserRecord> {\n  const user = await auth.users.getById({ projectId, id: userId })\n  if (!user || user.status !== \"active\") {\n    throw invalidInheritedAuthority(`user '${userId}' is not active`)\n  }\n  return user\n}\n\nasync function revalidateUserCredential(input: {\n  readonly auth: AuthStorage\n  readonly projectId: string\n  readonly userId: string\n  readonly credential: UserCredentialRef\n  readonly currentGroupIds: readonly string[]\n  readonly now: Date\n}): Promise<{ readonly groupIds: readonly string[]; readonly sessionId?: string }> {\n  if (input.credential.type === \"session\") {\n    const session = await input.auth.sessions.getById({\n      projectId: input.projectId,\n      id: input.credential.id,\n    })\n    if (!isUsableUserSession(session, input.userId, input.now)) {\n      throw invalidInheritedAuthority(\"the inherited session is no longer valid\")\n    }\n    return { groupIds: input.currentGroupIds, sessionId: session.id }\n  }\n\n  const accessToken = await input.auth.accessTokens.getById({\n    projectId: input.projectId,\n    id: input.credential.id,\n  })\n  if (!isUsableUserAccessToken(accessToken, input.userId, input.now)) {\n    throw invalidInheritedAuthority(\"the inherited access token is no longer valid\")\n  }\n  if (accessToken.groupIds === undefined) return { groupIds: input.currentGroupIds }\n\n  const allowedGroupIds = new Set(accessToken.groupIds)\n  return {\n    groupIds: input.currentGroupIds.filter((groupId) => allowedGroupIds.has(groupId)),\n  }\n}\n\nfunction isUsableUserSession(\n  session: SessionRecord | null,\n  userId: string,\n  now: Date\n): session is SessionRecord {\n  if (!session || session.userId !== userId || session.revokedAt !== undefined) return false\n  if (session.expiresAt.getTime() <= now.getTime()) return false\n  return (\n    session.absoluteExpiresAt === undefined || session.absoluteExpiresAt.getTime() > now.getTime()\n  )\n}\n\nfunction isUsableUserAccessToken(\n  token: AccessTokenRecord | null,\n  userId: string,\n  now: Date\n): token is AccessTokenRecord {\n  if (!token || !principalsEqual(token.subject, { type: \"user\", id: userId })) return false\n  return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime()\n}\n\nfunction invalidInheritedAuthority(reason: string): Error {\n  return createSixbError(\n    \"agent.execution_failed\",\n    `[Sixb] The Agent execution cannot restore its inherited authority: ${reason}.`\n  )\n}\n\nfunction requireAuthStorage(auth: AuthStorage | undefined): AuthStorage {\n  if (!auth) {\n    throw new Error(\"[Sixb] Agent executions require auth storage.\")\n  }\n  return auth\n}\n\nasync function updateAgentServiceAccountMetadata(\n  auth: AuthStorage,\n  input: {\n    readonly existing: ServiceAccountRecord\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  if (input.existing.name === input.name && input.existing.description === input.description) {\n    return input.existing\n  }\n  return auth.serviceAccounts.update({\n    projectId: input.existing.projectId,\n    id: input.existing.id,\n    name: input.name,\n    description: input.description,\n    updatedAt: input.updatedAt,\n  })\n}\n",
+    "/**\n * Base error for workflow-run storage operations.\n */\nexport class WorkflowRunError extends Error {\n  readonly name = \"WorkflowRunError\"\n}\n",
+    "import { agentServiceAccountId } from \"../../agents/authority\"\nimport type { ExecutionStorage } from \"../executions\"\nimport { findAgentRunExecution, findPrimitiveRunExecution } from \"../executions/run-link\"\nimport { WorkflowRunError } from \"./errors\"\n\n/** Validate the semantic link between a durable workflow run and its immutable execution. */\nexport async function assertWorkflowRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly runId: string\n  readonly workflowId: string\n}): Promise<void> {\n  const execution = await findPrimitiveRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    primitive: { kind: \"workflow\", id: input.workflowId, runId: input.runId },\n    sourceTypes: [\"execution\", \"schedule\", \"event\"],\n  })\n  if (!execution) {\n    invalidExecution(input.executionId, input.runId)\n  }\n\n  if (execution.source.type === \"schedule\" || execution.source.type === \"event\") {\n    if (execution.requestedBy !== undefined) {\n      invalidExecution(input.executionId, input.runId)\n    }\n    return\n  }\n\n  // ExecutionStorage already validates the immutable parent reference, correlation id, and\n  // requested-by propagation. This boundary only owns the workflow-specific source restriction.\n  if (execution.source.type !== \"execution\") {\n    invalidExecution(input.executionId, input.runId)\n  }\n}\n\n/** Validate the semantic link between a Workflow Agent-node run and its child execution. */\nexport async function assertWorkflowAgentNodeRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly nodeRunId: string\n  readonly actorId: string\n  readonly workflowExecutionId: string\n}): Promise<void> {\n  const execution = await findAgentRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    runId: input.nodeRunId,\n    authority: { type: \"managed\", serviceAccountId: agentServiceAccountId(input.actorId) },\n  })\n  if (\n    !execution ||\n    execution.source.type !== \"execution\" ||\n    execution.source.executionId !== input.workflowExecutionId\n  ) {\n    throw new WorkflowRunError(\n      `[Sixb] Execution '${input.executionId}' does not authorize Workflow Agent-node run '${input.nodeRunId}'.`\n    )\n  }\n}\n\nfunction invalidExecution(executionId: string, runId: string): never {\n  throw new WorkflowRunError(\n    `[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`\n  )\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAEA,IAAM,oBAAoB,OAAO,OAAO,EAAE,QAAQ,oBAAoB,CAAU;AAMzE,SAAS,0BAA0B,CAAC,KAAmC;AAAA,EAC5E,OAAO,OAAO,OAAO,OAAO,YAAY,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,iBAAiB,CAAU,CAAC,CAAC;AAAA;;;ACyC1F,SAAS,eAAe,CAAC,YAA4C;AAAA,EAC1E,OAAO,IAAI,oBAAmB,qBAAqB,WAAW,WAAW,WAAW,OAAO;AAAA;AAmB7F,IAAM,uBAAuB,IAAI;AAKjC,IAAM,8BAA8B,IAAI;AAKxC,IAAM,wBAA2C,OAAO,OAAO;AAAA,EAC7D,OAAO,IAAI;AAAA,EACX,OAAO,OAAO,OAAO,CAAC,CAAC;AACzB,CAAC;AASM,SAAS,wBAAwB,CACtC,UACA,YACA,UAAmC,qBACJ;AAAA,EAC/B,MAAM,MAAM,KAAK,UAAU,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC;AAAA,EAEjD,IAAI,YAAY,uBAAuB,YAAY,YAAY,QAAQ,QAAQ,GAAG;AAAA,IAChF,IAAI,WAAW,qBAAqB,IAAI,QAAQ;AAAA,IAChD,IAAI,CAAC,UAAU;AAAA,MACb,WAAW,IAAI;AAAA,MACf,qBAAqB,IAAI,UAAU,QAAQ;AAAA,IAC7C;AAAA,IAEA,IAAI,CAAC,SAAS,IAAI,GAAG;AAAA,MAAG,SAAS,IAAI,KAAK,wBAAwB,UAAU,UAAU,CAAC;AAAA,IACvF,OAAO,SAAS,IAAI,GAAG;AAAA,EACzB;AAAA,EAEA,IAAI,aAAa,4BAA4B,IAAI,QAAQ;AAAA,EACzD,IAAI,CAAC,YAAY;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,4BAA4B,IAAI,UAAU,UAAU;AAAA,EACtD;AAAA,EAEA,IAAI,WAAW,WAAW,IAAI,OAAO;AAAA,EACrC,IAAI,CAAC,UAAU;AAAA,IACb,WAAW,IAAI;AAAA,IACf,WAAW,IAAI,SAAS,QAAQ;AAAA,EAClC;AAAA,EAEA,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG;AAAA,IACtB,SAAS,IAAI,KAAK,wBAAwB,UAAU,YAAY,OAAO,CAAC;AAAA,EAC1E;AAAA,EACA,OAAO,SAAS,IAAI,GAAG;AAAA;AAGzB,SAAS,WAAW,CAAC,YAAiC,UAAwC;AAAA,EAC5F,WAAW,aAAa;AAAA,IAAU,IAAI,CAAC,WAAW,IAAI,SAAS;AAAA,MAAG,OAAO;AAAA,EACzE,OAAO;AAAA;AAGT,SAAS,uBAAuB,CAC9B,UACA,YACA,UAAmC,qBACJ;AAAA,EAC/B,MAAM,gBAAgB,IAAI;AAAA,EAC1B,MAAM,eAAe,IAAI;AAAA,EACzB,WAAW,cAAc,SAAS,gBAAgB,GAAG;AAAA,IACnD,MAAM,UAAU,QAAQ,WAAW,IAAI,WAAW,EAAE;AAAA,IACpD,MAAM,UAAU,IAAI;AAAA,IACpB,WAAW,YAAY,WAAW,YAAY;AAAA,MAC5C,MAAM,UACJ,SAAS,UAAU,KAAK,CAAC,cAAc,CAAC,WAAW,IAAI,SAAS,CAAC,KACjE,aAAa,SAAS,IAAI,SAAS,EAAE,GAAG,UAAU;AAAA,MACpD,IAAI,YAAY;AAAA,QAAW,QAAQ,IAAI,SAAS,IAAI,OAAO;AAAA,IAC7D;AAAA,IAEA,IAAI,QAAQ,SAAS;AAAA,MAAG;AAAA,IAExB,cAAc,IAAI,WAAW,IAAI,OAAO;AAAA,IACxC,aAAa,IACX,WAAW,IACX,OAAO,OAAO;AAAA,MACZ,KAAK,IAAI,IAAI,QAAQ,KAAK,CAAC;AAAA,MAC3B,YAAY,2BAA2B,QAAQ,KAAK,CAAC;AAAA,IACvD,CAAC,CACH;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,IAAI;AAAA,EAClB,YAAY,cAAc,UAAU,QAAQ,OAAO;AAAA,IACjD,MAAM,aAAa,aAAa,OAAO,YAAY,IAAI,eAAe;AAAA,IACtE,IAAI;AAAA,MAAY,MAAM,IAAI,cAAc,UAAU;AAAA,EACpD;AAAA,EAEA,MAAM,QAA8C,CAAC;AAAA,EACrD,MAAM,aAAa,IAAI;AAAA,EACvB,YAAY,KAAK,SAAS,QAAQ,OAAO;AAAA,IACvC,MAAM,OAAO,SAAS,KAAK,gBAAgB,KAAK;AAAA,IAChD,MAAM,aAAa,aAAa,KAAK,OAAO,YAAY,IAAI;AAAA,IAC5D,IAAI,CAAC;AAAA,MAAY;AAAA,IAEjB,WAAW,IAAI,KAAK,UAAU;AAAA,IAC9B,MAAM,KACJ,OAAO,OAAO;AAAA,SACT;AAAA,MACH,cAAc,KAAK;AAAA,MACnB,QAAQ,KAAK;AAAA,MACb,oBAAoB,KAAK;AAAA,IAC3B,CAAC,CACH;AAAA,EACF;AAAA,EAEA,IAAI,aAAa,SAAS,KAAK,MAAM,SAAS,KAAK,MAAM,WAAW;AAAA,IAAG;AAAA,EAEvE,MAAM,aACJ,MAAM,SAAS,KAAK,MAAM,WAAW,IACjC,wBACA,OAAO,OAAO,EAAE,OAAO,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,EAC1D,OAAO,OAAO,OAAO;AAAA,IACnB,kBAAkB,CAAC,iBAAyB,aAAa,IAAI,YAAY;AAAA,IACzE,gBAAgB,CAAC,cAAsB,eACrC,cAAc,IAAI,YAAY,GAAG,IAAI,UAAU;AAAA,IACjD,gBAAgB,CAAC,iBAAyB,MAAM,IAAI,YAAY;AAAA,IAChE,gBAAgB,CAAC,cAAsB,WACrC,WAAW,IAAI,eAAe,cAAc,MAAM,CAAC;AAAA,IACrD,YAAY,MAAM;AAAA,EACpB,CAAC;AAAA;AAGH,SAAS,YAAY,CACnB,UACA,YACoB;AAAA,EACpB,IAAI,CAAC;AAAA,IAAU;AAAA,EACf,WAAW,aAAa,CAAC,GAAG,QAAQ,EAAE,KAAK;AAAA,IAAG,IAAI,CAAC,WAAW,IAAI,SAAS;AAAA,MAAG,OAAO;AAAA,EACrF;AAAA;AAIF,SAAS,YAAY,CACnB,OACA,YACA,MACwB;AAAA,EACxB,WAAW,QAAQ,OAAO;AAAA,IACxB,MAAM,UAAU,aAAa,KAAK,UAAU,UAAU;AAAA,IACtD,IAAI,YAAY;AAAA,MAAW;AAAA,IAC3B,OAAO,OAAO,OAAO;AAAA,MACnB;AAAA,MACA,SAAS,sBAAsB,0BAA0B,KAAK,8CAA8C,KAAK,2BAA2B;AAAA,IAC9I,CAAC;AAAA,EACH;AAAA,EACA;AAAA;;;ACvMK,SAAS,8BAA6B,CAC3C,UACA,eAC+B;AAAA,EAC/B,OAAO,cAAc,SAAS,cAC1B,yBAAyB,UAAU,cAAc,QAAQ,cAAc,IAAI,GAAK,IAChF;AAAA;AAsBN,eAAsB,oCAAmC,CAAC,OAOtB;AAAA,EAClC,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,KAAK,uBAAsB,MAAM,OAAO;AAAA,EAC9C,MAAM,MAAM,IAAI;AAAA,EAChB,MAAM,SAAS,MAAM,gCAAgC,MAAM;AAAA,IACzD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,0CAA0C,MAAM,SAAS,MAAM;AAAA,EAC/D,gCAAgC,MAAM,SAAS,MAAM;AAAA,EACrD,MAAM,iBAAiB,MAAM,kCAAkC,MAAM;AAAA,IACnE,UAAU;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,gCAAgC,MAAM,SAAS,cAAc;AAAA,EAE7D,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,2BAA2B;AAAA,IACnE,WAAW,MAAM;AAAA,IACjB,kBAAkB;AAAA,IAClB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC,CACH;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,GAAG;AAAA,IACxC;AAAA,EACF;AAAA;AAIF,eAAe,+BAA+B,CAC5C,MACA,OAO+B;AAAA,EAC/B,MAAM,WAAW,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,IAAI;AAAA,IAAU,OAAO;AAAA,EAErB,IAAI;AAAA,IACF,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAAA,MACvC,IAAI,MAAM;AAAA,MACV,WAAW,MAAM;AAAA,MACjB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,QAAQ;AAAA,MACR,oBAAoB;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,EAAE,iBAAiB,sBAAqB,MAAM,SAAS,6BAA6B;AAAA,MACtF,MAAM;AAAA,IACR;AAAA,IACA,MAAM,aAAa,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM;AAAA,IACZ,CAAC;AAAA,IACD,IAAI,CAAC;AAAA,MAAY,MAAM;AAAA,IACvB,OAAO;AAAA;AAAA;AAIX,SAAS,+BAA+B,CACtC,SACA,gBACM;AAAA,EACN,IAAI,eAAe,WAAW,aAAa;AAAA,IACzC,MAAM,IAAI,MACR,iBAAiB,6BAA6B,eAAe,mBAC/D;AAAA,EACF;AAAA;AAGF,SAAS,yCAAyC,CAChD,SACA,gBACM;AAAA,EACN,IACE,eAAe,uBAAuB,aACtC,CAAC,iBAAgB,eAAe,oBAAoB,iBAAgB,GACpE;AAAA,IACA,MAAM,iBACJ,0BACA,iBAAiB,wCAAwC,eAAe,0CACxE,EAAE,SAAS,EAAE,SAAS,kBAAkB,eAAe,GAAG,EAAE,CAC9D;AAAA,EACF;AAAA;AAGF,SAAS,sCAAsC,CAC7C,SACA,aACgD;AAAA,EAChD,MAAM,mBAAmB,YACtB,OAAO,CAAC,eAAe,WAAW,WAAW,OAAO,EACpD,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,EACzC,IAAI,iBAAiB,SAAS,GAAG;AAAA,IAC/B,MAAM,iBACJ,0BACA,iBAAiB,iFAAiF,iBAAiB,KAAK,IAAI,MAC5H,EAAE,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAC3C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIT,eAAsB,mCAAkC,CAAC,OAM0C;AAAA,EACjG,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,aAAa,uBAAsB,MAAM,OAAO;AAAA,EACtD,MAAM,YACJ,MAAM,iBAAiB,SAAS,cAAc,MAAM,iBAAiB,YAAY;AAAA,EACnF,IAAI,WAAW,SAAS,oBAAoB,UAAU,OAAO,YAAY;AAAA,IACvE,MAAM,IAAI,MACR,iBAAiB,MAAM,gEAAgE,cACzF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,UAAU;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,CAAC,kBAAkB,eAAe,WAAW,UAAU;AAAA,IACzD,MAAM,IAAI,MAAM,iCAAiC,UAAU,oBAAoB;AAAA,EACjF;AAAA,EACA,0CAA0C,MAAM,SAAS,cAAc;AAAA,EAEvE,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,sBAAsB;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,kBAAkB,UAAU;AAAA,EAC9B,CAAC,CACH;AAAA,EACA,MAAM,WAAmC;AAAA,IACvC;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,IAAI,UAAU,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,6BAA4B;AAAA,MACnC,WAAW,SAAS;AAAA,MACpB,UAAU,iBAAiB,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,MACjE,OAAO,MAAM,SAAS,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA;AAOF,eAAsB,gBAAe,CAAC,OAKjB;AAAA,EACnB,MAAM,cAAc,MAAM,MAAM,KAAK,iBAAiB,YAAY;AAAA,IAChE,WAAW,MAAM;AAAA,IACjB,QAAQ,MAAM;AAAA,EAChB,CAAC;AAAA,EAED,MAAM,UAAU,6BAA4B;AAAA,IAC1C,WAAW,EAAE,MAAM,QAAQ,IAAI,MAAM,OAAO;AAAA,IAC5C,UAAU,YAAY,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,IAC5D,OAAO,MAAM,SAAS,kBAAkB;AAAA,EAC1C,CAAC;AAAA,EACD,OAAO,WAAU,SAAS,EAAE,MAAM,YAAY,CAAC;AAAA;AAIjD,eAAsB,4CAA2C,CAAC,OAMzB;AAAA,EACvC,IAAI,MAAM,iBAAiB,SAAS;AAAA,IAAY,OAAO,EAAE,MAAM,WAAW;AAAA,EAE1E,MAAM,MAAM,iCAAiC,MAAM,gBAAgB;AAAA,EACnE,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,MAAM,MAAM,OAAO,IAAI;AAAA,EAC7B,MAAM,OAAO,MAAM,kBAAkB,MAAM,MAAM,WAAW,IAAI,UAAU,EAAE;AAAA,EAC5E,MAAM,cAAc,MAAM,KAAK,iBAAiB,YAAY;AAAA,IAC1D,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,EACf,CAAC;AAAA,EACD,MAAM,aAAa,MAAM,yBAAyB;AAAA,IAChD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,YAAY,IAAI;AAAA,IAChB,iBAAiB,YAAY,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,IACnE;AAAA,EACF,CAAC;AAAA,EAED,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,6BAA4B;AAAA,MACnC,WAAW,IAAI;AAAA,MACf,UAAU,WAAW;AAAA,MACrB,OAAO,MAAM,SAAS,kBAAkB;AAAA,SACpC,WAAW,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,WAAW,UAAU;AAAA,IAClF,CAAC;AAAA,EACH;AAAA;AAGF,SAAS,gCAAgC,CAAC,KAAyD;AAAA,EACjG,IAAI,IAAI,SAAS,eAAe,IAAI,UAAU,SAAS,UAAU,IAAI,eAAe,WAAW;AAAA,IAC7F,MAAM,0BAA0B,kDAAkD;AAAA,EACpF;AAAA,EACA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,EAAE,MAAM,QAAQ,IAAI,IAAI,UAAU,GAAG;AAAA,IAChD,YAAY,EAAE,MAAM,IAAI,WAAW,MAAM,IAAI,IAAI,WAAW,GAAG;AAAA,EACjE;AAAA;AAGF,eAAe,iBAAiB,CAC9B,MACA,WACA,QACqB;AAAA,EACrB,MAAM,OAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,WAAW,IAAI,OAAO,CAAC;AAAA,EAC/D,IAAI,CAAC,QAAQ,KAAK,WAAW,UAAU;AAAA,IACrC,MAAM,0BAA0B,SAAS,uBAAuB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,wBAAwB,CAAC,OAO2C;AAAA,EACjF,IAAI,MAAM,WAAW,SAAS,WAAW;AAAA,IACvC,MAAM,UAAU,MAAM,MAAM,KAAK,SAAS,QAAQ;AAAA,MAChD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM,WAAW;AAAA,IACvB,CAAC;AAAA,IACD,IAAI,CAAC,oBAAoB,SAAS,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,MAC1D,MAAM,0BAA0B,0CAA0C;AAAA,IAC5E;AAAA,IACA,OAAO,EAAE,UAAU,MAAM,iBAAiB,WAAW,QAAQ,GAAG;AAAA,EAClE;AAAA,EAEA,MAAM,cAAc,MAAM,MAAM,KAAK,aAAa,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM,WAAW;AAAA,EACvB,CAAC;AAAA,EACD,IAAI,CAAC,wBAAwB,aAAa,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,IAClE,MAAM,0BAA0B,+CAA+C;AAAA,EACjF;AAAA,EACA,IAAI,YAAY,aAAa;AAAA,IAAW,OAAO,EAAE,UAAU,MAAM,gBAAgB;AAAA,EAEjF,MAAM,kBAAkB,IAAI,IAAI,YAAY,QAAQ;AAAA,EACpD,OAAO;AAAA,IACL,UAAU,MAAM,gBAAgB,OAAO,CAAC,YAAY,gBAAgB,IAAI,OAAO,CAAC;AAAA,EAClF;AAAA;AAGF,SAAS,mBAAmB,CAC1B,SACA,QACA,KAC0B;AAAA,EAC1B,IAAI,CAAC,WAAW,QAAQ,WAAW,UAAU,QAAQ,cAAc;AAAA,IAAW,OAAO;AAAA,EACrF,IAAI,QAAQ,UAAU,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAAG,OAAO;AAAA,EACzD,OACE,QAAQ,sBAAsB,aAAa,QAAQ,kBAAkB,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAIjG,SAAS,uBAAuB,CAC9B,OACA,QACA,KAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,CAAC,iBAAgB,MAAM,SAAS,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAAA,IAAG,OAAO;AAAA,EACpF,OAAO,MAAM,cAAc,aAAa,MAAM,UAAU,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAGlF,SAAS,yBAAyB,CAAC,QAAuB;AAAA,EACxD,OAAO,iBACL,0BACA,sEAAsE,SACxE;AAAA;AAGF,SAAS,kBAAkB,CAAC,MAA4C;AAAA,EACtE,IAAI,CAAC,MAAM;AAAA,IACT,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,iCAAiC,CAC9C,MACA,OAM+B;AAAA,EAC/B,IAAI,MAAM,SAAS,SAAS,MAAM,QAAQ,MAAM,SAAS,gBAAgB,MAAM,aAAa;AAAA,IAC1F,OAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,KAAK,gBAAgB,OAAO;AAAA,IACjC,WAAW,MAAM,SAAS;AAAA,IAC1B,IAAI,MAAM,SAAS;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,EACnB,CAAC;AAAA;;;ACnZI,MAAM,0BAAyB,MAAM;AAAA,EACjC,OAAO;AAClB;;;ACCA,eAAsB,2BAA0B,CAAC,OAM/B;AAAA,EAChB,MAAM,YAAY,MAAM,0BAA0B;AAAA,IAChD,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,EAAE,MAAM,YAAY,IAAI,MAAM,YAAY,OAAO,MAAM,MAAM;AAAA,IACxE,aAAa,CAAC,aAAa,YAAY,OAAO;AAAA,EAChD,CAAC;AAAA,EACD,IAAI,CAAC,WAAW;AAAA,IACd,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA,EAEA,IAAI,UAAU,OAAO,SAAS,cAAc,UAAU,OAAO,SAAS,SAAS;AAAA,IAC7E,IAAI,UAAU,gBAAgB,WAAW;AAAA,MACvC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AAAA,EAIA,IAAI,UAAU,OAAO,SAAS,aAAa;AAAA,IACzC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA;AAIF,eAAsB,oCAAmC,CAAC,OAOxC;AAAA,EAChB,MAAM,YAAY,MAAM,sBAAsB;AAAA,IAC5C,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,OAAO,MAAM;AAAA,IACb,WAAW,EAAE,MAAM,WAAW,kBAAkB,uBAAsB,MAAM,OAAO,EAAE;AAAA,EACvF,CAAC;AAAA,EACD,IACE,CAAC,aACD,UAAU,OAAO,SAAS,eAC1B,UAAU,OAAO,gBAAgB,MAAM,qBACvC;AAAA,IACA,MAAM,IAAI,kBACR,qBAAqB,MAAM,4DAA4D,MAAM,aAC/F;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CAAC,aAAqB,OAAsB;AAAA,EACnE,MAAM,IAAI,kBACR,qBAAqB,iDAAiD,SACxE;AAAA;",
+  "debugId": "C3E7FA1E69C6C30464756E2164756E21",
+  "names": []
+}

package/dist/{chunk-431pyp2c.js → chunk-6y0mkhex.js}

@@ -5,10 +5,10 @@ import {
 } from "./chunk-wkv3h3q7.js";
 import {
   getDatasetRowValidationFailure
-} from "./chunk-q5e5tv4b.js";
+} from "./chunk-c844dkwd.js";
 import {
   getDatasetMergeChangeValidationError2
-} from "./chunk-e17zdm62.js";
+} from "./chunk-1t6k1avb.js";
 
 // src/datasets/write.ts
 function lakeDatasetDefinition2(dataset) {