@sixb/core 0.1.5 → 0.1.7

package/dist/authorization/decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/authorization/decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EACL,KAAK,4BAA4B,EAElC,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAGhF,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,SAAS,CAAA;AAE/D,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAEvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;CAC9C;AAmDD,oEAAoE;AACpE,wBAAgB,QAAQ,CACtB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,aAAa,CAOf;AAED,wBAAgB,SAAS,CACvB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,OAAO,CAET;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAYxF;AAED,2FAA2F;AAC3F,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CASpE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAGpF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/F;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUpF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,MAAM,GAChB,IAAI,CAsBN"}
+{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/authorization/decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EACL,KAAK,4BAA4B,EAElC,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAGhF,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,SAAS,CAAA;AAE/D,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAEvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;CAC9C;AA8DD,oEAAoE;AACpE,wBAAgB,QAAQ,CACtB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,aAAa,CAOf;AAED,wBAAgB,SAAS,CACvB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,OAAO,CAET;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAYxF;AAED,2FAA2F;AAC3F,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CASpE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAGpF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/F;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUpF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,MAAM,GAChB,IAAI,CAsBN"}

package/dist/authorization/grant-kinds.d.ts

@@ -7,8 +7,10 @@
  * resolved `GrantIndex` all key off it, so adding a grant family is a single
  * entry in `GRANT_KINDS` plus the compile errors that forces at every consumer.
  */
-import type { GrantDefinition } from "../security/types";
-export type GrantKind = "access:application" | "view:object" | "view:dataset" | "edit:object" | "append:telemetry" | "apply:action" | "run:workflow" | "run:sync" | "run:pipeline" | "run:agent" | "observe:logs" | "manage:connector";
+import type { AgentRunGrant, GrantDefinition } from "../security/types";
+export type GrantKind = "access:application" | "view:object" | "view:dataset" | "edit:object" | "append:telemetry" | "apply:action" | "run:workflow" | "run:sync" | "run:pipeline" | "run:agent" | "observe:logs" | "observe:aiUsage" | "manage:connector" | "manage:aiUsage";
+export type SingletonGrantKind = "run:agent";
+export type TargetedGrantKind = Exclude<GrantKind, SingletonGrantKind>;
 /** Registered id universes a grant kind ranges over, plus subtype expansion. */
 export interface GrantUniverse {
     readonly applicationIds: ReadonlySet<string>;
@@ -18,14 +20,14 @@ export interface GrantUniverse {
     readonly workflowIds: ReadonlySet<string>;
     readonly syncIds: ReadonlySet<string>;
     readonly pipelineIds: ReadonlySet<string>;
-    readonly agentIds: ReadonlySet<string>;
     readonly observableIds: ReadonlySet<string>;
     readonly connectorIds: ReadonlySet<string>;
+    readonly manageableIds: ReadonlySet<string>;
     readonly getSubTypes: (objectTypeId: string) => readonly string[];
 }
 /** The registered-id sets a grant kind validates against (no subtype hook). */
 export type GrantUniverseKey = Exclude<keyof GrantUniverse, "getSubTypes">;
-interface GrantKindSpec {
+interface TargetedGrantKindSpec {
     /** Registered universe the grant's ids must belong to. */
     readonly universeKey: GrantUniverseKey;
     /** Subject noun used in validation errors ("unknown <subject> '<id>'"). */
@@ -35,15 +37,29 @@ interface GrantKindSpec {
     /** Only object-type grants also expand to subtypes. */
     readonly expandsSubtypes?: true;
 }
+interface SingletonGrantKindSpec {
+    /** Project-wide capability with no resource selection; resolves to a boolean. */
+    readonly singleton: true;
+    readonly subject: string;
+    readonly fix: string;
+}
 /**
  * The exhaustive grant-kind table. A new grant family is one entry here; the
- * `Record<GrantKind, …>` makes every omission a compile error.
+ * mapped type makes every omission a compile error.
  */
-export declare const GRANT_KINDS: Record<GrantKind, GrantKindSpec>;
+export declare const GRANT_KINDS: {
+    readonly [TKind in GrantKind]: TKind extends SingletonGrantKind ? SingletonGrantKindSpec : TargetedGrantKindSpec;
+};
 export declare const GRANT_KIND_KEYS: readonly GrantKind[];
+export declare const TARGETED_GRANT_KIND_KEYS: TargetedGrantKind[];
 /** The grant kind a stored grant resolves to. */
+export declare function grantKindOf(grant: AgentRunGrant): SingletonGrantKind;
+export declare function grantKindOf(grant: Exclude<GrantDefinition, AgentRunGrant>): TargetedGrantKind;
 export declare function grantKindOf(grant: GrantDefinition): GrantKind;
-/** A fresh, mutable grant index with one empty id set per kind. */
-export declare function emptyGrantSets(): Record<GrantKind, Set<string>>;
+/** Mutable grant index: booleans for singleton capabilities, id sets for selected resources. */
+export type MutableGrantIndex = {
+    [TKind in GrantKind]: TKind extends SingletonGrantKind ? boolean : Set<string>;
+};
+export declare function emptyGrantSets(): MutableGrantIndex;
 export {};
 //# sourceMappingURL=grant-kinds.d.ts.map

package/dist/authorization/grant-kinds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-kinds.d.ts","sourceRoot":"","sources":["../../src/authorization/grant-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,aAAa,GACb,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,cAAc,GACd,UAAU,GACV,cAAc,GACd,WAAW,GACX,cAAc,GACd,kBAAkB,CAAA;AAEtB,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CAClE;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,aAAa,EAAE,aAAa,CAAC,CAAA;AAE1E,UAAU,aAAa;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAChC;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,CAiExD,CAAA;AAED,eAAO,MAAM,eAAe,EAA+B,SAAS,SAAS,EAAE,CAAA;AAE/E,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,CAmB7D;AAED,mEAAmE;AACnE,wBAAgB,cAAc,IAAI,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAM/D"}
+{"version":3,"file":"grant-kinds.d.ts","sourceRoot":"","sources":["../../src/authorization/grant-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEvE,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,aAAa,GACb,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,cAAc,GACd,UAAU,GACV,cAAc,GACd,WAAW,GACX,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,CAAA;AAEpB,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAC5C,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;AAEtE,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CAClE;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,aAAa,EAAE,aAAa,CAAC,CAAA;AAE1E,UAAU,qBAAqB;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAChC;AAED,UAAU,sBAAsB;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE;IACxB,QAAQ,EAAE,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAC3D,sBAAsB,GACtB,qBAAqB;CA4E1B,CAAA;AAED,eAAO,MAAM,eAAe,EAA+B,SAAS,SAAS,EAAE,CAAA;AAC/E,eAAO,MAAM,wBAAwB,qBAEpC,CAAA;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,kBAAkB,CAAA;AACrE,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,iBAAiB,CAAA;AAC9F,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,CAAA;AAsB9D,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG;KAC7B,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAAG,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC;CAC/E,CAAA;AAED,wBAAgB,cAAc,IAAI,iBAAiB,CAiBlD"}

package/dist/authorization/index.d.ts

@@ -1,6 +1,6 @@
 export { canAccessApplication, isApplicationAccessControlled } from "./application-access";
 export type { AuthzDecision, AuthzRequest } from "./decision";
-export { assertAuthorized, assertCanAppendTelemetry, assertCanEdit, assertCanManageConnector, assertPrivileged, assertProviderAccess, evaluate, isAllowed, } from "./decision";
+export { assertAuthorized, assertCanAppendTelemetry, assertCanEdit, assertCanManageConnector, assertPrivileged, assertProviderAccess, assertRuntimeAuthorizationBound, evaluate, isAllowed, } from "./decision";
 export { AuthorizationError } from "./errors";
 export { canViewEvent } from "./event-visibility";
 export type { GrantKind, GrantUniverse } from "./grant-kinds";

package/dist/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AAC1F,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,QAAQ,EACR,SAAS,GACV,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AAC1F,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,+BAA+B,EAC/B,QAAQ,EACR,SAAS,GACV,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/authorization/index.js

@@ -7,6 +7,7 @@ import {
   assertCanManageConnector,
   assertPrivileged,
   assertProviderAccess,
+  assertRuntimeAuthorizationBound,
   canAccessApplication,
   canViewActionRun,
   canViewEvent,
@@ -21,13 +22,13 @@ import {
   isApplicationAccessControlled,
   resolveAuthorizationContext,
   resolveRoleGrants
-} from "../chunk-f83ka50g.js";
-import"../chunk-rnshztfq.js";
+} from "../chunk-37wk412q.js";
+import"../chunk-d63tybny.js";
 import"../chunk-04b07a9q.js";
 import"../chunk-dktq02ne.js";
-import"../chunk-zqysyfjt.js";
-import"../chunk-0172wgm9.js";
-import"../chunk-t8t39h7v.js";
+import"../chunk-08m3b6w8.js";
+import"../chunk-2xns679x.js";
+import"../chunk-n6jxh8sw.js";
 import"../chunk-y64skrwp.js";
 export {
   resolveRoleGrants,
@@ -44,6 +45,7 @@ export {
   canViewEvent,
   canViewActionRun,
   canAccessApplication,
+  assertRuntimeAuthorizationBound,
   assertProviderAccess,
   assertPrivileged,
   assertCanManageConnector,
@@ -53,4 +55,4 @@ export {
   AuthorizationError
 };
 
-//# debugId=4F829428F4D4A05C64756E2164756E21
+//# debugId=B639BE7F6042DEDB64756E2164756E21

package/dist/authorization/index.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "4F829428F4D4A05C64756E2164756E21",
+  "debugId": "B639BE7F6042DEDB64756E2164756E21",
   "names": []
 }

package/dist/authorization/resolve.d.ts

@@ -3,11 +3,11 @@ import type { RoleDefinition } from "../security";
 import { type GrantUniverse } from "./grant-kinds";
 import type { AuthorizationContext, GrantIndex, ResolvedRole } from "./types";
 /**
- * Expand a role's grants into concrete id sets once at startup.
+ * Resolve a role's grants once at startup.
  *
  * Broad grants (`every.object().except([...])`) expand against the registered
- * universe; object-type grants also expand to subtypes. The result holds only
- * `Set`s, so per-request resolution and runtime checks stay simple `set.has`.
+ * universe; object-type grants also expand to subtypes. Resource grants become
+ * id sets; the project Agent grant becomes a boolean.
  * The per-kind universe and subtype rules come from the `GRANT_KINDS` table, so
  * this loop never enumerates targets by hand.
  */

package/dist/authorization/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/authorization/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,aAAa,CAAA;AAC5D,OAAO,EAIL,KAAK,aAAa,EAEnB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE7E;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,GAAG,UAAU,CAe3F;AA4BD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CACxC,GAAG,oBAAoB,CAyBvB"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/authorization/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,aAAa,CAAA;AAC5D,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE7E;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,GAAG,UAAU,CAmB3F;AA4BD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CACxC,GAAG,oBAAoB,CA4BvB"}

package/dist/authorization/types.d.ts

@@ -7,15 +7,17 @@
  * Group and role ids are retained so decisions stay explainable.
  */
 import type { Principal } from "../auth/types";
-import { type GrantKind } from "./grant-kinds";
+import { type GrantKind, type SingletonGrantKind } from "./grant-kinds";
 /**
- * Grants resolved to concrete id sets, keyed by grant kind (`view:object`,
- * `run:sync`, …). Broad grants and object subtypes are already expanded, so
- * enforcement is a single `grants[kind].has(id)` lookup. Keyed by `GrantKind`
+ * Grants keyed by kind (`view:object`, `run:sync`, …). Resource selections resolve
+ * to id sets; project-wide singleton capabilities resolve to booleans.
+ * Broad grants and object subtypes are already expanded. Keyed by `GrantKind`
  * so a new grant family adds one key, not a new bucket every consumer must
  * learn.
  */
-export type GrantIndex = Readonly<Record<GrantKind, ReadonlySet<string>>>;
+export type GrantIndex = Readonly<{
+    [TKind in GrantKind]: TKind extends SingletonGrantKind ? boolean : ReadonlySet<string>;
+}>;
 /**
  * A grant index that grants nothing, as the base for a hand-built context — typically in tests.
  *

package/dist/authorization/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AAEzE;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,IAAI,UAAU,CAE5C;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAkB,KAAK,SAAS,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC;KAC/B,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAAG,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC;CACvF,CAAC,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,IAAI,UAAU,CAE5C;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B"}

package/dist/blob-storage/browser.js

@@ -8,8 +8,8 @@ import {
   blobIdFromDigest,
   isBlobDigest,
   isFileRef
-} from "../chunk-zqysyfjt.js";
-import"../chunk-t8t39h7v.js";
+} from "../chunk-08m3b6w8.js";
+import"../chunk-n6jxh8sw.js";
 import"../chunk-y64skrwp.js";
 export {
   isFileRef,

package/dist/blob-storage/index.js

@@ -8,7 +8,7 @@ import {
   createFileRef,
   readBlobBody,
   streamBlobBody
-} from "../chunk-8b55ygje.js";
+} from "../chunk-w3e09qqk.js";
 import {
   DEFAULT_SIMPLE_FILE_UPLOAD_BYTES,
   fileNameFor
@@ -20,8 +20,8 @@ import {
   isFileRef,
   supportsDirectUpload,
   supportsRangeRead
-} from "../chunk-zqysyfjt.js";
-import"../chunk-t8t39h7v.js";
+} from "../chunk-08m3b6w8.js";
+import"../chunk-n6jxh8sw.js";
 import"../chunk-y64skrwp.js";
 export {
   supportsRangeRead,

package/dist/bootstrap/discovery.d.ts

@@ -6,7 +6,6 @@
  * for the `Sixb` constructor.
  */
 import { isActionDefinition } from "../actions";
-import { isAgentDefinition } from "../agents";
 import { isConnectorDefinition } from "../connectors";
 import { isDatasetDefinition } from "../datasets";
 import type { OntologySource } from "../ontology/registry";
@@ -18,7 +17,7 @@ import { isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition } fro
 import { isSyncDefinition } from "../syncs";
 import { isWorkflowDefinition } from "../workflows";
 export declare function discoverOntologySources(projectRoot: string): Promise<readonly OntologySource[]>;
-type DiscoveryModuleKind = "action" | "agent" | "connector" | "dataset" | "group" | "membershipPolicy" | "ontology" | "pipeline" | "projection" | "role" | "rule" | "schedule" | "sync" | "workflow";
+type DiscoveryModuleKind = "action" | "connector" | "dataset" | "group" | "membershipPolicy" | "ontology" | "pipeline" | "projection" | "role" | "rule" | "schedule" | "sync" | "workflow";
 interface DefinitionDiscoveryFamily<TDefinition> {
     readonly directory: readonly string[];
     readonly kind: Exclude<DiscoveryModuleKind, "ontology">;
@@ -85,11 +84,6 @@ declare const definitionDiscoveryRegistry: {
         readonly kind: "membershipPolicy";
         readonly isDefinition: typeof isMembershipPolicyDefinition;
     };
-    readonly agents: {
-        readonly directory: readonly ["agents"];
-        readonly kind: "agent";
-        readonly isDefinition: typeof isAgentDefinition;
-    };
 };
 type DefinitionFromFamily<TFamily> = TFamily extends DefinitionDiscoveryFamily<infer TDefinition> ? TDefinition : never;
 export type DiscoveredProjectDefinitions = {

package/dist/bootstrap/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/bootstrap/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAInD,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAwCpC;AAED,KAAK,mBAAmB,GACpB,QAAQ,GACR,OAAO,GACP,WAAW,GACX,SAAS,GACT,OAAO,GACP,kBAAkB,GAClB,UAAU,GACV,UAAU,GACV,YAAY,GACZ,MAAM,GACN,MAAM,GACN,UAAU,GACV,MAAM,GACN,UAAU,CAAA;AAEd,UAAU,yBAAyB,CAAC,WAAW;IAC7C,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAA;IACvD,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,WAAW,CAAA;CAChE;AAED,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8CsC,CAAA;AAEvE,KAAK,oBAAoB,CAAC,OAAO,IAC/B,OAAO,SAAS,yBAAyB,CAAC,MAAM,WAAW,CAAC,GAAG,WAAW,GAAG,KAAK,CAAA;AAEpF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,IAAI,IAAI,MAAM,OAAO,2BAA2B,GAAG,SAAS,oBAAoB,CACxF,CAAC,OAAO,2BAA2B,CAAC,CAAC,IAAI,CAAC,CAC3C,EAAE;CACJ,CAAA;AAED,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,4BAA4B,CAAC,CAWvC"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/bootstrap/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAInD,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAwCpC;AAED,KAAK,mBAAmB,GACpB,QAAQ,GACR,WAAW,GACX,SAAS,GACT,OAAO,GACP,kBAAkB,GAClB,UAAU,GACV,UAAU,GACV,YAAY,GACZ,MAAM,GACN,MAAM,GACN,UAAU,GACV,MAAM,GACN,UAAU,CAAA;AAEd,UAAU,yBAAyB,CAAC,WAAW;IAC7C,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAA;IACvD,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,WAAW,CAAA;CAChE;AAED,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6CsC,CAAA;AAEvE,KAAK,oBAAoB,CAAC,OAAO,IAC/B,OAAO,SAAS,yBAAyB,CAAC,MAAM,WAAW,CAAC,GAAG,WAAW,GAAG,KAAK,CAAA;AAEpF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,IAAI,IAAI,MAAM,OAAO,2BAA2B,GAAG,SAAS,oBAAoB,CACxF,CAAC,OAAO,2BAA2B,CAAC,CAAC,IAAI,CAAC,CAC3C,EAAE;CACJ,CAAA;AAED,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,4BAA4B,CAAC,CAWvC"}

package/dist/bootstrap/index.js

@@ -4,73 +4,77 @@ import {
   discoverOntologyTypeManifest,
   discoverProjectDefinitions,
   generateOntologyTypeManifest
-} from "../chunk-h6h91mfy.js";
-import"../chunk-4h947jd8.js";
-import"../chunk-gadsm794.js";
-import"../chunk-ea73pzk7.js";
+} from "../chunk-2b5qtban.js";
+import"../chunk-kt81c11h.js";
+import"../chunk-qjycjdj6.js";
+import"../chunk-vjjv9mrb.js";
 import"../chunk-5sz8ta9r.js";
 import"../chunk-979ww6b3.js";
 import"../chunk-2ab72m2h.js";
-import"../chunk-a31h57d5.js";
+import"../chunk-tn7xcs2n.js";
 import"../chunk-74drx9gd.js";
 import"../chunk-b49dgvsj.js";
-import"../chunk-84h6qhmp.js";
-import"../chunk-zp2v2rv6.js";
-import"../chunk-r0rry8dn.js";
-import"../chunk-z3ga9q5m.js";
+import"../chunk-n2arzn6e.js";
+import"../chunk-h0knpbz5.js";
+import"../chunk-ha58tjtt.js";
+import"../chunk-c15dr03f.js";
+import"../chunk-rp1mvzb4.js";
+import"../chunk-e4rvtvpw.js";
 import"../chunk-4rh2m6zg.js";
 import"../chunk-xhy826cz.js";
-import"../chunk-6d5xdj1q.js";
+import"../chunk-3fqt22c4.js";
 import"../chunk-rte5sm3z.js";
-import"../chunk-qewtks41.js";
-import"../chunk-8b55ygje.js";
-import"../chunk-51fjndv0.js";
+import"../chunk-z2sery1b.js";
 import"../chunk-8m5ejdpn.js";
 import"../chunk-nf4r78r4.js";
-import"../chunk-78c6xvyr.js";
-import"../chunk-1q02e95s.js";
-import"../chunk-tbv03sx2.js";
+import"../chunk-d2ndstdf.js";
+import"../chunk-y35ma3mj.js";
+import"../chunk-9aehf39w.js";
 import"../chunk-96swp2wd.js";
-import"../chunk-f6erf2vv.js";
-import"../chunk-v0egge8b.js";
-import"../chunk-72q2y8hn.js";
-import"../chunk-xc7hq65b.js";
-import"../chunk-cy0n5dms.js";
-import"../chunk-dysw7nsm.js";
-import"../chunk-62c7t4jc.js";
-import"../chunk-ezake7g1.js";
-import"../chunk-a09jx26t.js";
-import"../chunk-htq0qh7z.js";
-import"../chunk-xkthy56g.js";
-import"../chunk-xdf9yswn.js";
-import"../chunk-nzw7sm3b.js";
-import"../chunk-t9xghkva.js";
-import"../chunk-drjqm1aa.js";
+import"../chunk-hdz94br2.js";
+import"../chunk-6ed5bwnd.js";
+import"../chunk-4nxeacx7.js";
+import"../chunk-agsvg9ar.js";
+import"../chunk-qjzp9xyb.js";
 import"../chunk-5gd7tpv6.js";
-import"../chunk-h9kxd41f.js";
+import"../chunk-gbrpsx4m.js";
+import"../chunk-8tsf6dmc.js";
+import"../chunk-xc7hq65b.js";
+import"../chunk-5jcdmjam.js";
+import"../chunk-xdpwpkha.js";
+import"../chunk-ka3a2ft3.js";
+import"../chunk-1kamz6j0.js";
+import"../chunk-08twe8m6.js";
+import"../chunk-3kv70xwp.js";
+import"../chunk-p03r0h5s.js";
+import"../chunk-jecn6t54.js";
+import"../chunk-x0qhkqje.js";
+import"../chunk-dqn23610.js";
 import"../chunk-9dzba0f2.js";
-import"../chunk-vybf6pkp.js";
+import"../chunk-dbc80ad7.js";
 import"../chunk-ry24jbr1.js";
-import"../chunk-3j7573mj.js";
-import"../chunk-4gz41why.js";
+import"../chunk-p2vqaxkc.js";
+import"../chunk-trxxmgnf.js";
 import"../chunk-zcnhxkvd.js";
+import"../chunk-w3e09qqk.js";
+import"../chunk-51fjndv0.js";
 import"../chunk-1evzqhks.js";
-import"../chunk-dsrkgtnh.js";
-import"../chunk-bhxaq2nn.js";
+import"../chunk-jq43kdvk.js";
+import"../chunk-qw9gvjv5.js";
 import"../chunk-yt8wphsx.js";
-import"../chunk-rdeagz6b.js";
-import"../chunk-dm72y8wt.js";
-import"../chunk-t0jjkep3.js";
-import"../chunk-tkdscva6.js";
-import"../chunk-rhrbz7d4.js";
+import"../chunk-atmkaf60.js";
+import"../chunk-7y0f6rf1.js";
+import"../chunk-d8qkxt2v.js";
+import"../chunk-rre42skh.js";
+import"../chunk-4a849fr1.js";
 import"../chunk-xwnf87e1.js";
-import"../chunk-f83ka50g.js";
-import"../chunk-rnshztfq.js";
+import"../chunk-37wk412q.js";
+import"../chunk-d63tybny.js";
 import"../chunk-04b07a9q.js";
 import"../chunk-dktq02ne.js";
-import"../chunk-zqysyfjt.js";
-import"../chunk-0172wgm9.js";
-import"../chunk-t8t39h7v.js";
+import"../chunk-08m3b6w8.js";
+import"../chunk-2xns679x.js";
+import"../chunk-n6jxh8sw.js";
 import"../chunk-y64skrwp.js";
 export {
   generateOntologyTypeManifest,
@@ -79,4 +83,4 @@ export {
   discoverOntologySources
 };
 
-//# debugId=251CC8CF1CBD616C64756E2164756E21
+//# debugId=0634F9D9427C543A64756E2164756E21

package/dist/bootstrap/index.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "251CC8CF1CBD616C64756E2164756E21",
+  "debugId": "0634F9D9427C543A64756E2164756E21",
   "names": []
 }

package/dist/broker/index.js

@@ -3,8 +3,8 @@ import {
   BrokerCursorExpiredError,
   BrokerError,
   InMemoryBroker
-} from "../chunk-wtmzkcht.js";
-import"../chunk-t8t39h7v.js";
+} from "../chunk-k34z5rvh.js";
+import"../chunk-n6jxh8sw.js";
 import"../chunk-y64skrwp.js";
 export {
   InMemoryBroker,

package/dist/{chunk-zqysyfjt.js → chunk-08m3b6w8.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   isPlainRecord
-} from "./chunk-t8t39h7v.js";
+} from "./chunk-n6jxh8sw.js";
 
 // src/blob-storage/derive.ts
 function blobDigestHex(digest) {

package/dist/{chunk-xdf9yswn.js → chunk-08twe8m6.js}

@@ -1,10 +1,20 @@
 // @bun
-import {
-  agentServiceAccountId
-} from "./chunk-nzw7sm3b.js";
 import {
   findAgentRunExecution
-} from "./chunk-t9xghkva.js";
+} from "./chunk-3kv70xwp.js";
+import {
+  MODEL_REASONING_LEVELS,
+  isModelReasoning
+} from "./chunk-trxxmgnf.js";
+import {
+  isFileRef
+} from "./chunk-08m3b6w8.js";
+
+// src/storage/agents/provider.ts
+import { isDeepStrictEqual } from "util";
+
+// src/agents/types.ts
+var AGENT_REASONING_LEVELS = MODEL_REASONING_LEVELS;
 
 // src/storage/agents/errors.ts
 class AgentStorageError extends Error {
@@ -17,17 +27,92 @@ class AgentStorageError extends Error {
 }
 
 // src/storage/agents/provider.ts
+function assertConversationAgentRunSpec(spec, prefix = "Sixb") {
+  if (!isRecord(spec) || !isRecord(spec.model)) {
+    throw new AgentStorageError("invalid_input", `[${prefix}] Conversational Agent run spec must contain a model reference.`);
+  }
+  for (const [name, value] of [
+    ["model.provider", spec.model.provider],
+    ["model.modelId", spec.model.modelId]
+  ]) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+      throw new AgentStorageError("invalid_input", `[${prefix}] Conversational Agent run '${name}' must not be empty.`);
+    }
+  }
+  if (spec.reasoning !== undefined && !isModelReasoning(spec.reasoning)) {
+    throw new AgentStorageError("invalid_input", `[${prefix}] Conversational Agent reasoning must be one of: ${AGENT_REASONING_LEVELS.join(", ")}, or a nonnegative budgetTokens object.`);
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 async function assertAgentRunExecution(input) {
   const execution = await findAgentRunExecution({
     executions: input.executions,
     projectId: input.projectId,
     executionId: input.executionId,
     runId: input.runId,
-    serviceAccountId: agentServiceAccountId(input.agentId)
+    authority: { type: "inherited" }
   });
   if (!execution) {
     throw new AgentStorageError("invalid_input", `[Sixb] Execution '${input.executionId}' does not authorize Agent run '${input.runId}'.`);
   }
+  return execution;
+}
+function assertCreateSubagentRunInput(input, prefix = "Sixb") {
+  for (const [name, value] of [
+    ["id", input.id],
+    ["projectId", input.projectId],
+    ["executionId", input.executionId],
+    ["parentRunId", input.parentRunId],
+    ["parentExecutionToken", input.parentExecutionToken],
+    ["spawnKey", input.spawnKey],
+    ["model.provider", input.spec.model.provider],
+    ["model.modelId", input.spec.model.modelId],
+    ["task", input.spec.task]
+  ]) {
+    if (value.trim().length === 0) {
+      throw new AgentStorageError("invalid_input", `[${prefix}] Subagent run '${name}' must not be empty.`);
+    }
+  }
+  if (input.spawnKey.length > 128) {
+    throw new AgentStorageError("invalid_input", `[${prefix}] Subagent spawn key must not exceed 128 characters.`);
+  }
+  for (const [name, value] of [
+    ["maxActiveChildren", input.maxActiveChildren],
+    ["spec.maxSteps", input.spec.maxSteps]
+  ]) {
+    if (!Number.isSafeInteger(value) || value < 1) {
+      throw new AgentStorageError("invalid_input", `[${prefix}] Subagent run '${name}' must be a positive safe integer.`);
+    }
+  }
+  if (new Set(input.spec.toolNames).size !== input.spec.toolNames.length) {
+    throw new AgentStorageError("invalid_input", `[${prefix}] Subagent run tool names must be unique.`);
+  }
+  if (input.spec.reasoning !== undefined && !isModelReasoning(input.spec.reasoning)) {
+    throw new AgentStorageError("invalid_input", `[${prefix}] Subagent reasoning must be one of: ${AGENT_REASONING_LEVELS.join(", ")}, or a nonnegative budgetTokens object.`);
+  }
+  if (input.spec.toolNames.some((name) => !name.trim())) {
+    throw new AgentStorageError("invalid_input", `[${prefix}] Subagent run tool names must not be empty.`);
+  }
+  if (input.createdAt && !Number.isFinite(input.createdAt.getTime())) {
+    throw new AgentStorageError("invalid_input", `[${prefix}] Subagent run createdAt must be a valid date.`);
+  }
+}
+function subagentRunMatchesCreateInput(run, input) {
+  return run.kind === "subagent" && run.id === input.id && run.projectId === input.projectId && run.executionId === input.executionId && run.parentRunId === input.parentRunId && run.spawnKey === input.spawnKey && isDeepStrictEqual(run.spec, input.spec);
+}
+function assertSubagentRunResult(result, runId, prefix = "Sixb") {
+  const text = result?.text;
+  const files = result?.files;
+  const hasText = typeof text === "string" && text.trim().length > 0;
+  const hasFiles = Array.isArray(files) && files.length > 0 && files.every(isFileRef);
+  if (!result || !hasText && !hasFiles) {
+    throw new AgentStorageError("invalid_input", `[${prefix}] Succeeded subagent run '${runId}' requires text or files.`);
+  }
+  if (text !== undefined && !hasText || files !== undefined && !hasFiles) {
+    throw new AgentStorageError("invalid_input", `[${prefix}] Subagent run '${runId}' has an invalid result.`);
+  }
 }
 function assertCreateAgentContextCheckpointInput(input, prefix = "Sixb") {
   for (const [name, value] of [
@@ -82,7 +167,7 @@ function assertAgentContextCheckpointAuthority(input) {
   if (!thread) {
     throw new AgentStorageError("thread_not_found", `[${prefix}] Agent thread '${create.threadId}' not found for project '${create.projectId}'.`);
   }
-  if (run.threadId !== create.threadId) {
+  if (run.kind !== "conversation" || run.threadId !== create.threadId) {
     throw new AgentStorageError("invalid_input", `[${prefix}] Agent run '${run.id}' does not belong to thread '${create.threadId}'.`);
   }
   if (run.status !== "running") {
@@ -128,6 +213,6 @@ function agentContextCheckpointMatchesCreateInput(record, input) {
   return record.id === input.id && record.projectId === input.projectId && record.threadId === input.threadId && record.createdByRunId === input.createdByRunId && (record.previousCheckpointId ?? null) === input.expectedPreviousCheckpointId && record.reason === input.reason && record.summary === input.summary && record.summaryFormatVersion === input.summaryFormatVersion && record.summarizedThroughSeq === input.summarizedThroughSeq && record.observedHeadSeq === input.observedHeadSeq && record.estimatedInputTokensBefore === input.estimatedInputTokensBefore && record.estimatedInputTokensAfter === input.estimatedInputTokensAfter && record.summaryModelId === input.summaryModelId;
 }
 
-export { AgentStorageError, assertAgentRunExecution, assertCreateAgentContextCheckpointInput, assertAgentContextCheckpointAuthority, assertAgentContextCheckpointAnchors, assertAgentContextCheckpointReplayState, agentContextCheckpointMatchesCreateInput };
+export { AgentStorageError, AGENT_REASONING_LEVELS, assertConversationAgentRunSpec, assertAgentRunExecution, assertCreateSubagentRunInput, subagentRunMatchesCreateInput, assertSubagentRunResult, assertCreateAgentContextCheckpointInput, assertAgentContextCheckpointAuthority, assertAgentContextCheckpointAnchors, assertAgentContextCheckpointReplayState, agentContextCheckpointMatchesCreateInput };
 
-//# debugId=C4E16AF3EE9252A464756E2164756E21
+//# debugId=FCE91CC06B8ED83764756E2164756E21