@sixb/core 0.1.6 → 0.1.8

package/dist/chunk-qewtks41.js.map

@@ -1,11 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/http/api-routes.ts", "../src/http/route-pattern.ts"],
-  "sourcesContent": [
-    "/**\n * The single source of truth for the Sixb HTTP API surface and its auth capabilities.\n *\n * Two views are derived from this one table:\n * - `AGENT_API_ROUTES` (@sixb/core agent gateway) = the `agentApi` rows, projected to {method, path}.\n * - `ACCESS_TOKEN_ROUTES` (@sixb/server bearer boundary) = the `accessToken` rows, with operationId.\n *\n * Because both views are projections of this table, the agent gateway allow-list is structurally a\n * subset of the bearer boundary — the invariant below enforces `agentApi ⇒ accessToken` at load\n * time. This table lives in @sixb/core (never @sixb/server) because @sixb/server depends on core,\n * not the reverse; the operationId strings are opaque here.\n */\nexport interface SixbApiRoute {\n  /** OpenAPI operationId — the server keys its bearer security requirement off this. */\n  readonly operationId: string\n  readonly method: string\n  readonly path: string\n  /** The route accepts a bearer access token (enforced by the server access-token boundary). */\n  readonly accessToken: boolean\n  /** The route is proxied by the agent API gateway (a strict subset of the accessToken routes). */\n  readonly agentApi: boolean\n}\n\nexport const SIXB_API_ROUTES: readonly SixbApiRoute[] = [\n  {\n    operationId: \"getProjectInfo\",\n    method: \"GET\",\n    path: \"/api/project\",\n    accessToken: true,\n    agentApi: true,\n  },\n  // Token and service-account management is bearer-capable so the CLI can authenticate with a\n  // personal access token. It is NOT exposed to agents. The runtime still confines every operation\n  // to the caller's own groups, and service-account tokens are rejected (only user principals may\n  // manage credentials).\n  {\n    operationId: \"getAuthAccessManagementOptions\",\n    method: \"GET\",\n    path: \"/api/auth/access-management-options\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAuthAccessTokens\",\n    method: \"GET\",\n    path: \"/api/auth/access-tokens\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"createAuthPersonalAccessToken\",\n    method: \"POST\",\n    path: \"/api/auth/access-tokens\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"revokeAuthAccessToken\",\n    method: \"POST\",\n    path: \"/api/auth/access-tokens/:tokenId/revoke\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAuthServiceAccounts\",\n    method: \"GET\",\n    path: \"/api/auth/service-accounts\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"createAuthServiceAccount\",\n    method: \"POST\",\n    path: \"/api/auth/service-accounts\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"disableAuthServiceAccount\",\n    method: \"POST\",\n    path: \"/api/auth/service-accounts/:serviceAccountId/disable\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAuthServiceAccountAccessTokens\",\n    method: \"GET\",\n    path: \"/api/auth/service-accounts/:serviceAccountId/access-tokens\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"createAuthServiceAccountAccessToken\",\n    method: \"POST\",\n    path: \"/api/auth/service-accounts/:serviceAccountId/access-tokens\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"revokeAuthServiceAccountAccessToken\",\n    method: \"POST\",\n    path: \"/api/auth/service-accounts/:serviceAccountId/access-tokens/:tokenId/revoke\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listObjectTypes\",\n    method: \"GET\",\n    path: \"/api/object-types\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getObjectType\",\n    method: \"GET\",\n    path: \"/api/object-types/:objectTypeId\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"listObjects\",\n    method: \"GET\",\n    path: \"/api/objects\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"queryObjects\",\n    method: \"POST\",\n    path: \"/api/objects/query\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"queryObjectLinks\",\n    method: \"POST\",\n    path: \"/api/objects/query/links\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"countObjects\",\n    method: \"POST\",\n    path: \"/api/objects/query/count\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"existsObjects\",\n    method: \"POST\",\n    path: \"/api/objects/query/exists\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"facetObjects\",\n    method: \"POST\",\n    path: \"/api/objects/query/facets\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getObject\",\n    method: \"GET\",\n    path: \"/api/objects/:objectTypeId/:objectId\",\n    accessToken: true,\n    agentApi: true,\n  },\n  // The four write routes. Bearer-capable because their execution facade enforces authorization\n  // (`edit:object` / `append:telemetry`), which is exactly the precondition this table requires.\n  // NOT agent-proxied: letting an agent turn write objects on its own is a separate decision, and\n  // the gateway already hands routes an execution SDK, so flipping `agentApi` later needs no\n  // authorization work — only that decision.\n  {\n    operationId: \"upsertObject\",\n    method: \"PUT\",\n    path: \"/api/objects/:objectTypeId/:objectId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"upsertObjectLink\",\n    method: \"PUT\",\n    path: \"/api/objects/:objectTypeId/:objectId/links/:linkId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"removeObjectLink\",\n    method: \"DELETE\",\n    path: \"/api/objects/:objectTypeId/:objectId/links/:linkId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"appendTelemetry\",\n    method: \"POST\",\n    path: \"/api/objects/:objectTypeId/:objectId/telemetry/:propertyId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getBulkTelemetryHistory\",\n    method: \"POST\",\n    path: \"/api/telemetry/history\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getTelemetryHistory\",\n    method: \"GET\",\n    path: \"/api/objects/:objectTypeId/:objectId/telemetry/:propertyId/history\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getLatestTelemetry\",\n    method: \"GET\",\n    path: \"/api/objects/:objectTypeId/:objectId/telemetry/:propertyId/latest\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getObjectFileContent\",\n    method: \"GET\",\n    path: \"/api/objects/:objectTypeId/:objectId/files/content\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    // Bearer-capable (CLI/programmatic existence + range probes) but NOT agent-proxied: the agent\n    // API gateway only forwards GET/POST, and an agent gains nothing from HEAD over GET (a file's\n    // size already travels in its FileRef). Keeping this agentApi:true would throw at gateway\n    // registration (\"Unsupported agent API gateway method 'HEAD'\") and stop the server booting.\n    operationId: \"headObjectFileContent\",\n    method: \"HEAD\",\n    path: \"/api/objects/:objectTypeId/:objectId/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listActions\",\n    method: \"GET\",\n    path: \"/api/actions\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getAction\",\n    method: \"GET\",\n    path: \"/api/actions/:actionId\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"requestAction\",\n    method: \"POST\",\n    path: \"/api/actions/:actionId\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"uploadFileRaw\",\n    method: \"POST\",\n    path: \"/api/files\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"listActionRuns\",\n    method: \"GET\",\n    path: \"/api/action-runs\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getActionRun\",\n    method: \"GET\",\n    path: \"/api/action-runs/:runId\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getActionRunFileContent\",\n    method: \"GET\",\n    path: \"/api/action-runs/:runId/files/content\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"headActionRunFileContent\",\n    method: \"HEAD\",\n    path: \"/api/action-runs/:runId/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listWorkflows\",\n    method: \"GET\",\n    path: \"/api/workflows\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getWorkflow\",\n    method: \"GET\",\n    path: \"/api/workflows/:workflowId\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"requestWorkflowRun\",\n    method: \"POST\",\n    path: \"/api/workflows/:workflowId/runs\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"listWorkflowRuns\",\n    method: \"GET\",\n    path: \"/api/workflow-runs\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getWorkflowRun\",\n    method: \"GET\",\n    path: \"/api/workflow-runs/:runId\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"cancelWorkflowRun\",\n    method: \"POST\",\n    path: \"/api/workflow-runs/:runId/cancel\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getWorkflowAgentNodeExecution\",\n    method: \"GET\",\n    path: \"/api/workflow-runs/:runId/nodes/:nodeKey/agent-execution\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getWorkflowRunFileContent\",\n    method: \"GET\",\n    path: \"/api/workflow-runs/:runId/files/content\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"headWorkflowRunFileContent\",\n    method: \"HEAD\",\n    path: \"/api/workflow-runs/:runId/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getWorkflowNodeRunFileContent\",\n    method: \"GET\",\n    path: \"/api/workflow-runs/:runId/nodes/:nodeKey/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"headWorkflowNodeRunFileContent\",\n    method: \"HEAD\",\n    path: \"/api/workflow-runs/:runId/nodes/:nodeKey/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getAgentMessageFileContent\",\n    method: \"GET\",\n    path: \"/api/agent-threads/:threadId/messages/:messageId/files/content\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"headAgentMessageFileContent\",\n    method: \"HEAD\",\n    path: \"/api/agent-threads/:threadId/messages/:messageId/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"searchObjects\",\n    method: \"GET\",\n    path: \"/api/objects/search\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"listEvents\",\n    method: \"GET\",\n    path: \"/api/events\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listLogs\",\n    method: \"GET\",\n    path: \"/api/logs\",\n    accessToken: true,\n    agentApi: false,\n  },\n]\n\n// Enforce the subset invariant at module load: a gateway-proxied route must also be a bearer route,\n// or the gateway would expose a surface the access-token boundary does not recognize.\nfor (const route of SIXB_API_ROUTES) {\n  if (route.agentApi && !route.accessToken) {\n    throw new Error(\n      `[Sixb] agent API route '${route.method} ${route.path}' must also be an access-token route.`\n    )\n  }\n}\n",
-    "/**\n * Shared HTTP route-pattern matching. Used by both the agent API gateway allow-list (@sixb/core)\n * and the server's access-token boundary (@sixb/server) so the two never drift.\n */\n\n/** Split a path into its non-empty segments (drops leading/trailing/empty parts). */\nexport function pathSegmentsFor(pathname: string): string[] {\n  return pathname.split(\"/\").filter(Boolean)\n}\n\n/**\n * Match a concrete pathname against a route pattern. A `:param` pattern segment matches any single\n * non-empty segment; every other segment must match exactly. Segment counts must be equal.\n */\nexport function matchesPathPattern(pathname: string, pattern: string): boolean {\n  const pathSegments = pathSegmentsFor(pathname)\n  const patternSegments = pathSegmentsFor(pattern)\n\n  if (pathSegments.length !== patternSegments.length) {\n    return false\n  }\n\n  return patternSegments.every((patternSegment, index) => {\n    if (patternSegment.startsWith(\":\")) {\n      return pathSegments[index] !== \"\"\n    }\n    return patternSegment === pathSegments[index]\n  })\n}\n\n/** Strip a single trailing slash so `/api/foo` and `/api/foo/` compare equal (leaves \"/\" alone). */\nexport function normalizeRoutePath(pathname: string): string {\n  if (pathname.length > 1 && pathname.endsWith(\"/\")) {\n    return pathname.slice(0, -1)\n  }\n  return pathname\n}\n"
-  ],
-  "mappings": ";;AAuBO,IAAM,kBAA2C;AAAA,EACtD;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EAKA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EAMA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IAKE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AACF;AAIA,WAAW,SAAS,iBAAiB;AAAA,EACnC,IAAI,MAAM,YAAY,CAAC,MAAM,aAAa;AAAA,IACxC,MAAM,IAAI,MACR,2BAA2B,MAAM,UAAU,MAAM,2CACnD;AAAA,EACF;AACF;;;AC5ZO,SAAS,eAAe,CAAC,UAA4B;AAAA,EAC1D,OAAO,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AAAA;AAOpC,SAAS,kBAAkB,CAAC,UAAkB,SAA0B;AAAA,EAC7E,MAAM,eAAe,gBAAgB,QAAQ;AAAA,EAC7C,MAAM,kBAAkB,gBAAgB,OAAO;AAAA,EAE/C,IAAI,aAAa,WAAW,gBAAgB,QAAQ;AAAA,IAClD,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,gBAAgB,MAAM,CAAC,gBAAgB,UAAU;AAAA,IACtD,IAAI,eAAe,WAAW,GAAG,GAAG;AAAA,MAClC,OAAO,aAAa,WAAW;AAAA,IACjC;AAAA,IACA,OAAO,mBAAmB,aAAa;AAAA,GACxC;AAAA;AAII,SAAS,kBAAkB,CAAC,UAA0B;AAAA,EAC3D,IAAI,SAAS,SAAS,KAAK,SAAS,SAAS,GAAG,GAAG;AAAA,IACjD,OAAO,SAAS,MAAM,GAAG,EAAE;AAAA,EAC7B;AAAA,EACA,OAAO;AAAA;",
-  "debugId": "F7C55438F878304564756E2164756E21",
-  "names": []
-}

package/dist/chunk-t0jjkep3.js.map

@@ -1,10 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/storage/agents/types.ts"],
-  "sourcesContent": [
-    "import type { AgentMessage, AgentMessagePart, AgentMessageRole } from \"../../agents/message\"\nimport type { Principal } from \"../../auth\"\nimport type { SixbErrorCode, SixbFailure } from \"../../errors/types\"\nimport type { JsonValue } from \"../../json\"\n\n// ── agent_threads — one conversation with an agent ──────────────────────────────────────────────\n\nexport type AgentThreadStatus = \"active\" | \"archived\"\n\nexport interface AgentThreadRecord {\n  readonly id: string\n  readonly projectId: string\n  readonly agentId: string\n  /** Who owns/opened the thread. Reuses the canonical auth principal (gains `agent` later for free). */\n  readonly ownerPrincipal: Principal\n  readonly title?: string\n  readonly status: AgentThreadStatus\n  /** Single-flight anchor: the id of the one run currently allowed to write, or `null` when idle. */\n  readonly activeRunId: string | null\n  readonly lastMessageAt?: Date\n  readonly messageCount: number\n  readonly createdAt: Date\n  readonly updatedAt: Date\n}\n\nexport interface CreateAgentThreadInput {\n  readonly id: string\n  readonly projectId: string\n  readonly agentId: string\n  readonly ownerPrincipal: Principal\n  readonly title?: string\n  readonly status?: AgentThreadStatus\n  readonly createdAt?: Date\n  readonly updatedAt?: Date\n}\n\nexport interface ListAgentThreadsInput {\n  readonly projectId: string\n  readonly agentId?: string\n  /** Optional allowlist intersected with `agentId` when both are provided. Empty means no rows. */\n  readonly agentIds?: readonly string[]\n  readonly statuses?: readonly AgentThreadStatus[]\n  readonly ownerPrincipal?: Principal\n  readonly limit?: number\n  readonly offset?: number\n  readonly order?: \"asc\" | \"desc\"\n}\n\nexport interface ListAgentThreadsResult {\n  readonly threads: readonly AgentThreadRecord[]\n  readonly hasMore: boolean\n  readonly total: number\n}\n\n// ── agent_runs — one loop execution (the worker job; attribution + fencing) ───────────────────\n\n/** Lifecycle shared by every durable agent execution, conversational or workflow-owned. */\nexport type AgentExecutionStatus = \"queued\" | \"running\" | \"succeeded\" | \"failed\" | \"cancelled\"\n\nexport type AgentRunStatus = AgentExecutionStatus\n\n/** Error codes an agent execution can persist and expose through its public contract. */\nexport const AGENT_RUN_FAILURE_CODES = [\n  \"internal.unexpected\",\n  \"runtime.cancelled\",\n  \"agent.execution_failed\",\n] as const satisfies readonly [SixbErrorCode, ...SixbErrorCode[]]\n\nexport type AgentRunFailureCode = (typeof AGENT_RUN_FAILURE_CODES)[number]\n\n/**\n * Why a run ended — our own SDK-independent vocabulary. It includes the AI SDK's unified finish\n * reasons plus platform-level endings such as `timeout`, so reads are typed and exhaustive without\n * core depending on `ai`. `other`/`unknown` are catch-alls: an unrecognised provider value still\n * records *that* the run ended.\n */\nexport const AGENT_RUN_FINISH_REASONS = [\n  \"stop\",\n  \"length\",\n  \"content-filter\",\n  \"tool-calls\",\n  \"timeout\",\n  \"error\",\n  \"other\",\n  \"unknown\",\n] as const\n\nexport type AgentRunFinishReason = (typeof AGENT_RUN_FINISH_REASONS)[number]\n\n/**\n * Coerce an external finish-reason string — a DB column or an SDK value — to {@link\n * AgentRunFinishReason}. An unrecognised value becomes `\"unknown\"` rather than being dropped.\n */\nexport function coerceAgentRunFinishReason(\n  value: string | null | undefined\n): AgentRunFinishReason | undefined {\n  if (value === null || value === undefined) {\n    return undefined\n  }\n  return (AGENT_RUN_FINISH_REASONS as readonly string[]).includes(value)\n    ? (value as AgentRunFinishReason)\n    : \"unknown\"\n}\n\n/** Stable, user-facing diagnostics emitted by the platform while executing a run. */\nexport const AGENT_RUN_DIAGNOSTIC_CODES = [\n  \"output_file_limit_exceeded\",\n  \"output_file_too_large\",\n  \"output_budget_exhausted\",\n  \"output_collection_failed\",\n  \"output_file_changed\",\n  \"output_storage_failed\",\n] as const\n\n/**\n * Closed on purpose, and the wire is closed with it.\n *\n * Sixb writes these codes and the generated client is what reads them, so an open union would only\n * be honest if the HTTP schema were open too — and that costs the OpenAPI enum, the client's\n * autocompletion, and Atlas's exhaustive `switch`. Sixb owns both ends, so a new code is a minor\n * version bump: cheap here, and a broken `switch` is better than a 500 from `z.enum`.\n */\nexport type AgentRunDiagnosticCode = (typeof AGENT_RUN_DIAGNOSTIC_CODES)[number]\nexport type AgentRunDiagnosticSeverity = \"warning\" | \"error\"\n\nexport interface AgentRunDiagnostic {\n  readonly code: AgentRunDiagnosticCode\n  readonly severity: AgentRunDiagnosticSeverity\n  readonly scope: \"output\"\n  /** Relative path inside the run's published output directory, when one file is involved. */\n  readonly path?: string\n  /** Sanitized, stable copy suitable for display to an end user. */\n  readonly message: string\n}\n\n/**\n * Authorization state for the current queue delivery.\n *\n * `queueLeaseExpiresAt` is a persisted projection of `ClaimedQueueJob.leaseExpiresAt`, not an\n * independently managed run lease. It may only be extended from a successful queue lease renewal.\n */\nexport interface AgentRunExecution {\n  readonly token: string\n  readonly queueLeaseExpiresAt: Date\n}\n\nexport interface AgentRunRecord {\n  readonly id: string\n  readonly projectId: string\n  readonly executionId: string\n  readonly threadId: string\n  readonly agentId: string\n  readonly triggerMessageId: string\n  /** Durable group memberships snapshotted when the run was admitted. */\n  readonly requesterGroupIds: readonly string[]\n  readonly status: AgentRunStatus\n  readonly modelId?: string\n  /** Why the run ended (our own SDK-independent enum). */\n  readonly finishReason?: AgentRunFinishReason\n  /** Platform diagnostics are transcript annotations, never agent-authored message content. */\n  readonly diagnostics?: readonly AgentRunDiagnostic[]\n  /** Portable failure snapshot when the run did not succeed. */\n  readonly error?: SixbFailure<AgentRunFailureCode>\n  /** Execution attempts: `0` while queued, `1` on first start, incremented on redelivery. */\n  readonly attempt: number\n  readonly execution?: AgentRunExecution\n  readonly createdAt: Date\n  readonly startedAt?: Date\n  readonly completedAt?: Date\n}\n\nexport interface CreateAgentRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly executionId: string\n  readonly threadId: string\n  readonly agentId: string\n  readonly triggerMessageId: string\n  readonly requesterGroupIds: readonly string[]\n  readonly createdAt?: Date\n}\n\nexport interface StartAgentRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly modelId?: string\n  readonly execution: AgentRunExecution\n  readonly startedAt?: Date\n}\n\nexport interface FinishQueuedAgentRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly status: \"failed\" | \"cancelled\"\n  readonly error?: SixbFailure<AgentRunFailureCode>\n  readonly completedAt?: Date\n}\n\nexport interface ReclaimAgentRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly execution: AgentRunExecution\n}\n\nexport interface ConfirmAgentRunExecutionOwnershipInput {\n  readonly id: string\n  readonly projectId: string\n  readonly executionToken: string\n  /** Exact expiration returned by the queue claim or its latest successful renewal. */\n  readonly queueLeaseExpiresAt: Date\n}\n\nexport type FinishAgentRunInput =\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly executionToken: string\n      readonly status: \"succeeded\"\n      readonly modelId?: string\n      readonly finishReason?: AgentRunFinishReason\n      readonly diagnostics?: readonly AgentRunDiagnostic[]\n      readonly completedAt?: Date\n    }\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly executionToken: string\n      readonly status: \"failed\" | \"cancelled\"\n      readonly modelId?: string\n      readonly finishReason?: AgentRunFinishReason\n      readonly diagnostics?: readonly AgentRunDiagnostic[]\n      readonly error?: SixbFailure<AgentRunFailureCode>\n      readonly completedAt?: Date\n    }\n\nexport interface ListAgentRunsInput {\n  readonly projectId: string\n  readonly threadId?: string\n  readonly agentId?: string\n  readonly statuses?: readonly AgentRunStatus[]\n  /** Effective start time; runs that never started use `createdAt`. */\n  readonly startedAfter?: Date\n  /** Effective start time; runs that never started use `createdAt`. */\n  readonly startedBefore?: Date\n  readonly limit?: number\n  readonly offset?: number\n  readonly order?: \"asc\" | \"desc\"\n}\n\nexport interface ListAgentRunsResult {\n  readonly runs: readonly AgentRunRecord[]\n  readonly hasMore: boolean\n  readonly total: number\n}\n\n// ── agent_messages — one message (assistant messages inserted only once finalized) ─────────────\n\nexport type { AgentMessageRole }\n\nexport interface AgentMessageRecord {\n  readonly id: string\n  readonly projectId: string\n  readonly threadId: string\n  /** The run that produced this message; `null` for user-authored messages. */\n  readonly runId: string | null\n  readonly role: AgentMessageRole\n  /** Principal that authored this persisted message: caller for user messages, agent identity later for assistant messages. */\n  readonly authorPrincipal?: Principal\n  /** Monotonic per thread, assigned by the store. */\n  readonly seq: number\n  /** Structured message content — text / reasoning / step boundaries / tool calls. */\n  readonly parts: readonly AgentMessagePart[]\n  /** Message-level metadata (mirrors `UIMessage.metadata`). */\n  readonly metadata?: JsonValue\n  /** Versions the `parts` shape so it can be migrated; stamped from `AGENT_MESSAGE_CONTENT_VERSION`. */\n  readonly contentVersion: number\n  readonly createdAt: Date\n  readonly completedAt?: Date\n}\n\n/** Append a message: a {@link AgentMessage} (role + parts + metadata) plus its storage identity. */\nexport interface AppendAgentMessageInput extends AgentMessage {\n  readonly id: string\n  readonly projectId: string\n  readonly threadId: string\n  readonly runId: string | null\n  readonly authorPrincipal?: Principal\n  readonly createdAt?: Date\n  readonly completedAt?: Date\n}\n\nexport interface DeleteAgentMessagesByRunInput {\n  readonly projectId: string\n  readonly threadId: string\n  readonly runId: string\n}\n\nexport interface ListAgentMessagesInput {\n  readonly projectId: string\n  readonly threadId: string\n  /** Return only messages whose per-thread sequence is greater than this retained boundary. */\n  readonly afterSeq?: number\n  readonly roles?: readonly AgentMessageRole[]\n  readonly limit?: number\n  readonly offset?: number\n  readonly order?: \"asc\" | \"desc\"\n}\n\nexport interface ListAgentMessagesResult {\n  readonly messages: readonly AgentMessageRecord[]\n  readonly hasMore: boolean\n  readonly total: number\n}\n\n// ── agent_context_checkpoints — append-only model-context boundaries ──────────────────────────\n\nexport type AgentContextCheckpointReason = \"threshold\" | \"overflow\"\n\n/**\n * A durable summary boundary used only when projecting a thread into model context.\n *\n * Checkpoints never replace or mutate transcript messages. Normal thread reads remain authoritative\n * and complete; the worker reads the latest checkpoint and only the retained message tail.\n */\nexport interface AgentContextCheckpointRecord {\n  readonly id: string\n  readonly projectId: string\n  readonly threadId: string\n  readonly createdByRunId: string\n  readonly previousCheckpointId?: string\n  readonly reason: AgentContextCheckpointReason\n  readonly summary: string\n  readonly summaryFormatVersion: 1\n  readonly summarizedThroughSeq: number\n  readonly observedHeadSeq: number\n  readonly estimatedInputTokensBefore: number\n  readonly estimatedInputTokensAfter: number\n  readonly summaryModelId: string\n  readonly createdAt: Date\n}\n\nexport interface CreateAgentContextCheckpointInput {\n  readonly id: string\n  readonly projectId: string\n  readonly threadId: string\n  readonly createdByRunId: string\n  /** Compare-and-swap anchor. `null` means the thread must not have a prior checkpoint. */\n  readonly expectedPreviousCheckpointId: string | null\n  /** Compare-and-swap anchor for the complete transcript observed by the summarizer. */\n  readonly expectedHeadSeq: number\n  /** Current delivery token for `createdByRunId`; stale redeliveries must not write. */\n  readonly executionToken: string\n  readonly reason: AgentContextCheckpointReason\n  readonly summary: string\n  readonly summaryFormatVersion: 1\n  readonly summarizedThroughSeq: number\n  readonly observedHeadSeq: number\n  readonly estimatedInputTokensBefore: number\n  readonly estimatedInputTokensAfter: number\n  readonly summaryModelId: string\n  readonly createdAt?: Date\n}\n\n// ── Store ───────────────────────────────────────────────────────────────────────────────────────\n\nexport interface AgentThreadStore {\n  create(input: CreateAgentThreadInput): Promise<AgentThreadRecord>\n  getById(params: { projectId: string; id: string }): Promise<AgentThreadRecord | null>\n  list(input: ListAgentThreadsInput): Promise<ListAgentThreadsResult>\n}\n\nexport interface AgentRunStore {\n  /** Persist a queued run and atomically claim the thread's single-flight slot. */\n  create(input: CreateAgentRunInput): Promise<AgentRunRecord>\n  /** Transition a queued run to running and install the first delivery's execution token. */\n  start(input: StartAgentRunInput): Promise<AgentRunRecord>\n  /** Finish a queued run before execution and release the thread's single-flight slot. */\n  finishQueued(input: FinishQueuedAgentRunInput): Promise<AgentRunRecord>\n  /** Rotate the execution token for a redelivered running job (`attempt++`). */\n  reclaim(input: ReclaimAgentRunInput): Promise<AgentRunRecord>\n  /**\n   * Project the queue's latest confirmed ownership expiration onto the current execution.\n   * Implementations must fence by token and must never move the expiration backwards.\n   */\n  confirmExecutionOwnership(input: ConfirmAgentRunExecutionOwnershipInput): Promise<AgentRunRecord>\n  /** Finalize a run and release the thread's `activeRunId`. */\n  finish(input: FinishAgentRunInput): Promise<AgentRunRecord>\n  getById(params: { projectId: string; id: string }): Promise<AgentRunRecord | null>\n  getByIds(params: {\n    projectId: string\n    ids: readonly string[]\n  }): Promise<readonly AgentRunRecord[]>\n  list(input: ListAgentRunsInput): Promise<ListAgentRunsResult>\n}\n\nexport interface AgentMessageStore {\n  /** Insert a message (its `parts` are the canonical content) and bump thread stats. */\n  append(input: AppendAgentMessageInput): Promise<AgentMessageRecord>\n  /** Delete every message produced by one run and repair the thread's message stats. */\n  deleteByRunId(input: DeleteAgentMessagesByRunInput): Promise<number>\n  getById(params: { projectId: string; id: string }): Promise<AgentMessageRecord | null>\n  list(input: ListAgentMessagesInput): Promise<ListAgentMessagesResult>\n}\n\nexport interface AgentContextCheckpointStore {\n  /**\n   * Append one checkpoint after atomically validating run ownership and both transcript anchors.\n   * Repeating the same payload for the same creating run is idempotent.\n   */\n  create(input: CreateAgentContextCheckpointInput): Promise<AgentContextCheckpointRecord>\n  /** Return checkpoints created by the requested runs, in first-occurrence input order. */\n  getByRunIds(input: {\n    readonly projectId: string\n    readonly runIds: readonly string[]\n  }): Promise<readonly AgentContextCheckpointRecord[]>\n  getLatest(input: {\n    readonly projectId: string\n    readonly threadId: string\n  }): Promise<AgentContextCheckpointRecord | null>\n}\n\nexport interface AgentStorage {\n  readonly threads: AgentThreadStore\n  readonly runs: AgentRunStore\n  readonly messages: AgentMessageStore\n  readonly checkpoints: AgentContextCheckpointStore\n}\n"
-  ],
-  "mappings": ";;AA8DO,IAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AACF;AAUO,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAQO,SAAS,0BAA0B,CACxC,OACkC;AAAA,EAClC,IAAI,UAAU,QAAQ,UAAU,WAAW;AAAA,IACzC;AAAA,EACF;AAAA,EACA,OAAQ,yBAA+C,SAAS,KAAK,IAChE,QACD;AAAA;AAIC,IAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
-  "debugId": "E6142794534A3A5D64756E2164756E21",
-  "names": []
-}