@sixb/core 0.1.6 → 0.1.8

package/dist/auth/index.js

@@ -20,11 +20,13 @@ import {
   parseSessionCookieValue,
   principalsEqual,
   verifyDoubleSubmitCsrf
-} from "../chunk-1e8m6yn3.js";
+} from "../chunk-4sm0aznx.js";
 import {
   normalizeRequesterGroupIds,
   snapshotRequesterGroupIds
-} from "../chunk-rhrbz7d4.js";
+} from "../chunk-4a849fr1.js";
+import"../chunk-2dw777qw.js";
+import"../chunk-19jp6g9d.js";
 import {
   AuthRuntimeError,
   DEFAULT_AUTH_INVITATION_TTL_MS,
@@ -51,13 +53,14 @@ import {
   serializeCookie,
   shouldUseSecureCookies
 } from "../chunk-xwnf87e1.js";
-import"../chunk-f83ka50g.js";
-import"../chunk-rnshztfq.js";
-import"../chunk-04b07a9q.js";
+import"../chunk-p1x242ad.js";
+import"../chunk-r8jrnexe.js";
+import"../chunk-h0k55pc7.js";
 import"../chunk-dktq02ne.js";
-import"../chunk-zqysyfjt.js";
-import"../chunk-0172wgm9.js";
-import"../chunk-t8t39h7v.js";
+import"../chunk-04b07a9q.js";
+import"../chunk-08m3b6w8.js";
+import"../chunk-2xns679x.js";
+import"../chunk-n6jxh8sw.js";
 import"../chunk-y64skrwp.js";
 export {
   verifyDoubleSubmitCsrf,
@@ -108,4 +111,4 @@ export {
   AuthRuntime
 };
 
-//# debugId=D2293CB7FAECA67264756E2164756E21
+//# debugId=FD3E006271290B0164756E2164756E21

package/dist/auth/index.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "D2293CB7FAECA67264756E2164756E21",
+  "debugId": "FD3E006271290B0164756E2164756E21",
   "names": []
 }

package/dist/authorization/decision.d.ts

@@ -32,6 +32,9 @@ export type AuthzRequest = {
 } | {
     readonly kind: "action.apply";
     readonly actionId: string;
+} | {
+    readonly kind: "share.manage";
+    readonly shareId: string;
 } | {
     readonly kind: "workflow.run";
     readonly workflowId: string;
@@ -43,9 +46,12 @@ export type AuthzRequest = {
     readonly pipelineId: string;
 } | {
     readonly kind: "agent.run";
-    readonly agentId: string;
 } | {
     readonly kind: "logs.observe";
+} | {
+    readonly kind: "aiUsage.observe";
+} | {
+    readonly kind: "aiUsage.manage";
 } | {
     readonly kind: "connector.manage";
     readonly connectorId: string;
@@ -61,6 +67,7 @@ export interface AuthzDecision {
     readonly missing: readonly string[];
 }
 interface AuthorizedRuntime {
+    readonly projectId: string;
     readonly runtimeAuthorization?: RuntimeAuthorization;
     readonly authorization?: AuthorizationContext;
 }
@@ -68,6 +75,8 @@ interface AuthorizedRuntime {
 export declare function evaluate(authorization: AuthorizationContext | null | undefined, request: AuthzRequest): AuthzDecision;
 export declare function isAllowed(authorization: AuthorizationContext | null | undefined, request: AuthzRequest): boolean;
 export declare function assertAuthorized(runtime: AuthorizedRuntime, request: AuthzRequest): void;
+/** Runtime catalogs never infer unrestricted access from an absent principal context. */
+export declare function isRuntimeAllowed(runtime: AuthorizedRuntime, request: AuthzRequest): boolean;
 /** Resolve registered process-local authority before a protected leaf makes a decision. */
 export declare function assertRuntimeAuthorizationBound(runtime: AuthorizedRuntime): Exclude<ResolvedRuntimeAuthorization, {
     readonly type: "denied";
@@ -110,8 +119,10 @@ export declare function assertPrivileged(runtime: AuthorizedRuntime, operation:
  * Assert access to process providers that trusted executions and genuine agent runs may use.
  *
  * Agent provenance alone is not authority: the registered capability must be bound to the exact
- * same agent and run before this check succeeds.
+ * same immutable execution before this check succeeds.
  */
-export declare function assertProviderAccess(runtime: AuthorizedRuntime, execution: ExecutionContext, operation: string): void;
+export declare function assertProviderAccess(runtime: AuthorizedRuntime & {
+    readonly runtimeAuthorization: RuntimeAuthorization;
+}, execution: ExecutionContext, operation: string): void;
 export {};
 //# sourceMappingURL=decision.d.ts.map

package/dist/authorization/decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/authorization/decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EACL,KAAK,4BAA4B,EAElC,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAGhF,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,SAAS,CAAA;AAE/D,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAEvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;CAC9C;AAmDD,oEAAoE;AACpE,wBAAgB,QAAQ,CACtB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,aAAa,CAOf;AAED,wBAAgB,SAAS,CACvB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,OAAO,CAET;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAYxF;AAED,2FAA2F;AAC3F,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CASpE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAGpF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/F;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUpF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,MAAM,GAChB,IAAI,CAsBN"}
+{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/authorization/decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EACL,KAAK,4BAA4B,EAGlC,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAGhF,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,SAAS,CAAA;AAE/D,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAEvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,UAAU,iBAAiB;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;CAC9C;AAgED,oEAAoE;AACpE,wBAAgB,QAAQ,CACtB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,aAAa,CAOf;AAED,wBAAgB,SAAS,CACvB,aAAa,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACtD,OAAO,EAAE,YAAY,GACpB,OAAO,CAET;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAkBxF;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAI3F;AAED,2FAA2F;AAC3F,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,4BAA4B,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CASpE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAGpF;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAE/F;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAUpF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,iBAAiB,GAAG;IAAE,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAA;CAAE,EACpF,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,MAAM,GAChB,IAAI,CAiBN"}

package/dist/authorization/grant-kinds.d.ts

@@ -7,25 +7,28 @@
  * resolved `GrantIndex` all key off it, so adding a grant family is a single
  * entry in `GRANT_KINDS` plus the compile errors that forces at every consumer.
  */
-import type { GrantDefinition } from "../security/types";
-export type GrantKind = "access:application" | "view:object" | "view:dataset" | "edit:object" | "append:telemetry" | "apply:action" | "run:workflow" | "run:sync" | "run:pipeline" | "run:agent" | "observe:logs" | "manage:connector";
+import type { AgentRunGrant, GrantDefinition } from "../security/types";
+export type GrantKind = "access:application" | "view:object" | "view:dataset" | "edit:object" | "append:telemetry" | "apply:action" | "share:share" | "run:workflow" | "run:sync" | "run:pipeline" | "run:agent" | "observe:logs" | "observe:aiUsage" | "manage:connector" | "manage:aiUsage";
+export type SingletonGrantKind = "run:agent";
+export type TargetedGrantKind = Exclude<GrantKind, SingletonGrantKind>;
 /** Registered id universes a grant kind ranges over, plus subtype expansion. */
 export interface GrantUniverse {
     readonly applicationIds: ReadonlySet<string>;
     readonly objectTypeIds: ReadonlySet<string>;
     readonly datasetIds: ReadonlySet<string>;
     readonly actionIds: ReadonlySet<string>;
+    readonly shareIds: ReadonlySet<string>;
     readonly workflowIds: ReadonlySet<string>;
     readonly syncIds: ReadonlySet<string>;
     readonly pipelineIds: ReadonlySet<string>;
-    readonly agentIds: ReadonlySet<string>;
     readonly observableIds: ReadonlySet<string>;
     readonly connectorIds: ReadonlySet<string>;
+    readonly manageableIds: ReadonlySet<string>;
     readonly getSubTypes: (objectTypeId: string) => readonly string[];
 }
 /** The registered-id sets a grant kind validates against (no subtype hook). */
 export type GrantUniverseKey = Exclude<keyof GrantUniverse, "getSubTypes">;
-interface GrantKindSpec {
+interface TargetedGrantKindSpec {
     /** Registered universe the grant's ids must belong to. */
     readonly universeKey: GrantUniverseKey;
     /** Subject noun used in validation errors ("unknown <subject> '<id>'"). */
@@ -35,15 +38,29 @@ interface GrantKindSpec {
     /** Only object-type grants also expand to subtypes. */
     readonly expandsSubtypes?: true;
 }
+interface SingletonGrantKindSpec {
+    /** Project-wide capability with no resource selection; resolves to a boolean. */
+    readonly singleton: true;
+    readonly subject: string;
+    readonly fix: string;
+}
 /**
  * The exhaustive grant-kind table. A new grant family is one entry here; the
- * `Record<GrantKind, …>` makes every omission a compile error.
+ * mapped type makes every omission a compile error.
  */
-export declare const GRANT_KINDS: Record<GrantKind, GrantKindSpec>;
+export declare const GRANT_KINDS: {
+    readonly [TKind in GrantKind]: TKind extends SingletonGrantKind ? SingletonGrantKindSpec : TargetedGrantKindSpec;
+};
 export declare const GRANT_KIND_KEYS: readonly GrantKind[];
+export declare const TARGETED_GRANT_KIND_KEYS: TargetedGrantKind[];
 /** The grant kind a stored grant resolves to. */
+export declare function grantKindOf(grant: AgentRunGrant): SingletonGrantKind;
+export declare function grantKindOf(grant: Exclude<GrantDefinition, AgentRunGrant>): TargetedGrantKind;
 export declare function grantKindOf(grant: GrantDefinition): GrantKind;
-/** A fresh, mutable grant index with one empty id set per kind. */
-export declare function emptyGrantSets(): Record<GrantKind, Set<string>>;
+/** Mutable grant index: booleans for singleton capabilities, id sets for selected resources. */
+export type MutableGrantIndex = {
+    [TKind in GrantKind]: TKind extends SingletonGrantKind ? boolean : Set<string>;
+};
+export declare function emptyGrantSets(): MutableGrantIndex;
 export {};
 //# sourceMappingURL=grant-kinds.d.ts.map

package/dist/authorization/grant-kinds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-kinds.d.ts","sourceRoot":"","sources":["../../src/authorization/grant-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,aAAa,GACb,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,cAAc,GACd,UAAU,GACV,cAAc,GACd,WAAW,GACX,cAAc,GACd,kBAAkB,CAAA;AAEtB,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CAClE;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,aAAa,EAAE,aAAa,CAAC,CAAA;AAE1E,UAAU,aAAa;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAChC;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,CAiExD,CAAA;AAED,eAAO,MAAM,eAAe,EAA+B,SAAS,SAAS,EAAE,CAAA;AAE/E,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,CAmB7D;AAED,mEAAmE;AACnE,wBAAgB,cAAc,IAAI,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAM/D"}
+{"version":3,"file":"grant-kinds.d.ts","sourceRoot":"","sources":["../../src/authorization/grant-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEvE,MAAM,MAAM,SAAS,GACjB,oBAAoB,GACpB,aAAa,GACb,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,aAAa,GACb,cAAc,GACd,UAAU,GACV,cAAc,GACd,WAAW,GACX,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,gBAAgB,CAAA;AAEpB,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAC5C,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAA;AAEtE,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CAClE;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,aAAa,EAAE,aAAa,CAAC,CAAA;AAE1E,UAAU,qBAAqB;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,iEAAiE;IACjE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,uDAAuD;IACvD,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAA;CAChC;AAED,UAAU,sBAAsB;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE;IACxB,QAAQ,EAAE,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAC3D,sBAAsB,GACtB,qBAAqB;CAiF1B,CAAA;AAED,eAAO,MAAM,eAAe,EAA+B,SAAS,SAAS,EAAE,CAAA;AAC/E,eAAO,MAAM,wBAAwB,qBAEpC,CAAA;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,kBAAkB,CAAA;AACrE,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,aAAa,CAAC,GAAG,iBAAiB,CAAA;AAC9F,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,CAAA;AAwB9D,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG;KAC7B,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAAG,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC;CAC/E,CAAA;AAED,wBAAgB,cAAc,IAAI,iBAAiB,CAkBlD"}

package/dist/authorization/index.d.ts

@@ -1,6 +1,6 @@
 export { canAccessApplication, isApplicationAccessControlled } from "./application-access";
 export type { AuthzDecision, AuthzRequest } from "./decision";
-export { assertAuthorized, assertCanAppendTelemetry, assertCanEdit, assertCanManageConnector, assertPrivileged, assertProviderAccess, evaluate, isAllowed, } from "./decision";
+export { assertAuthorized, assertCanAppendTelemetry, assertCanEdit, assertCanManageConnector, assertPrivileged, assertProviderAccess, assertRuntimeAuthorizationBound, evaluate, isAllowed, isRuntimeAllowed, } from "./decision";
 export { AuthorizationError } from "./errors";
 export { canViewEvent } from "./event-visibility";
 export type { GrantKind, GrantUniverse } from "./grant-kinds";

package/dist/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AAC1F,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,QAAQ,EACR,SAAS,GACV,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AAC1F,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,+BAA+B,EAC/B,QAAQ,EACR,SAAS,EACT,gBAAgB,GACjB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7D,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA"}

package/dist/authorization/index.js

@@ -7,6 +7,7 @@ import {
   assertCanManageConnector,
   assertPrivileged,
   assertProviderAccess,
+  assertRuntimeAuthorizationBound,
   canAccessApplication,
   canViewActionRun,
   canViewEvent,
@@ -19,19 +20,22 @@ import {
   evaluate,
   isAllowed,
   isApplicationAccessControlled,
+  isRuntimeAllowed,
   resolveAuthorizationContext,
   resolveRoleGrants
-} from "../chunk-f83ka50g.js";
-import"../chunk-rnshztfq.js";
-import"../chunk-04b07a9q.js";
+} from "../chunk-p1x242ad.js";
+import"../chunk-r8jrnexe.js";
+import"../chunk-h0k55pc7.js";
 import"../chunk-dktq02ne.js";
-import"../chunk-zqysyfjt.js";
-import"../chunk-0172wgm9.js";
-import"../chunk-t8t39h7v.js";
+import"../chunk-04b07a9q.js";
+import"../chunk-08m3b6w8.js";
+import"../chunk-2xns679x.js";
+import"../chunk-n6jxh8sw.js";
 import"../chunk-y64skrwp.js";
 export {
   resolveRoleGrants,
   resolveAuthorizationContext,
+  isRuntimeAllowed,
   isApplicationAccessControlled,
   isAllowed,
   evaluate,
@@ -44,6 +48,7 @@ export {
   canViewEvent,
   canViewActionRun,
   canAccessApplication,
+  assertRuntimeAuthorizationBound,
   assertProviderAccess,
   assertPrivileged,
   assertCanManageConnector,
@@ -53,4 +58,4 @@ export {
   AuthorizationError
 };
 
-//# debugId=4F829428F4D4A05C64756E2164756E21
+//# debugId=6EFA804B875F8FF764756E2164756E21

package/dist/authorization/index.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "4F829428F4D4A05C64756E2164756E21",
+  "debugId": "6EFA804B875F8FF764756E2164756E21",
   "names": []
 }

package/dist/authorization/resolve.d.ts

@@ -3,11 +3,11 @@ import type { RoleDefinition } from "../security";
 import { type GrantUniverse } from "./grant-kinds";
 import type { AuthorizationContext, GrantIndex, ResolvedRole } from "./types";
 /**
- * Expand a role's grants into concrete id sets once at startup.
+ * Resolve a role's grants once at startup.
  *
  * Broad grants (`every.object().except([...])`) expand against the registered
- * universe; object-type grants also expand to subtypes. The result holds only
- * `Set`s, so per-request resolution and runtime checks stay simple `set.has`.
+ * universe; object-type grants also expand to subtypes. Resource grants become
+ * id sets; the project Agent grant becomes a boolean.
  * The per-kind universe and subtype rules come from the `GRANT_KINDS` table, so
  * this loop never enumerates targets by hand.
  */

package/dist/authorization/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/authorization/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,aAAa,CAAA;AAC5D,OAAO,EAIL,KAAK,aAAa,EAEnB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE7E;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,GAAG,UAAU,CAe3F;AA4BD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CACxC,GAAG,oBAAoB,CAyBvB"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/authorization/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,aAAa,CAAA;AAC5D,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE7E;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,aAAa,GAAG,UAAU,CAmB3F;AA4BD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;CACxC,GAAG,oBAAoB,CA4BvB"}

package/dist/authorization/types.d.ts

@@ -7,15 +7,17 @@
  * Group and role ids are retained so decisions stay explainable.
  */
 import type { Principal } from "../auth/types";
-import { type GrantKind } from "./grant-kinds";
+import { type GrantKind, type SingletonGrantKind } from "./grant-kinds";
 /**
- * Grants resolved to concrete id sets, keyed by grant kind (`view:object`,
- * `run:sync`, …). Broad grants and object subtypes are already expanded, so
- * enforcement is a single `grants[kind].has(id)` lookup. Keyed by `GrantKind`
+ * Grants keyed by kind (`view:object`, `run:sync`, …). Resource selections resolve
+ * to id sets; project-wide singleton capabilities resolve to booleans.
+ * Broad grants and object subtypes are already expanded. Keyed by `GrantKind`
  * so a new grant family adds one key, not a new bucket every consumer must
  * learn.
  */
-export type GrantIndex = Readonly<Record<GrantKind, ReadonlySet<string>>>;
+export type GrantIndex = Readonly<{
+    [TKind in GrantKind]: TKind extends SingletonGrantKind ? boolean : ReadonlySet<string>;
+}>;
 /**
  * A grant index that grants nothing, as the base for a hand-built context — typically in tests.
  *

package/dist/authorization/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AAEzE;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,IAAI,UAAU,CAE5C;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAkB,KAAK,SAAS,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC;KAC/B,KAAK,IAAI,SAAS,GAAG,KAAK,SAAS,kBAAkB,GAAG,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC;CACvF,CAAC,CAAA;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,IAAI,UAAU,CAE5C;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAC5B"}

package/dist/blob-storage/browser.js

@@ -8,8 +8,8 @@ import {
   blobIdFromDigest,
   isBlobDigest,
   isFileRef
-} from "../chunk-zqysyfjt.js";
-import"../chunk-t8t39h7v.js";
+} from "../chunk-08m3b6w8.js";
+import"../chunk-n6jxh8sw.js";
 import"../chunk-y64skrwp.js";
 export {
   isFileRef,

package/dist/blob-storage/index.js

@@ -8,7 +8,7 @@ import {
   createFileRef,
   readBlobBody,
   streamBlobBody
-} from "../chunk-8b55ygje.js";
+} from "../chunk-w3e09qqk.js";
 import {
   DEFAULT_SIMPLE_FILE_UPLOAD_BYTES,
   fileNameFor
@@ -20,8 +20,8 @@ import {
   isFileRef,
   supportsDirectUpload,
   supportsRangeRead
-} from "../chunk-zqysyfjt.js";
-import"../chunk-t8t39h7v.js";
+} from "../chunk-08m3b6w8.js";
+import"../chunk-n6jxh8sw.js";
 import"../chunk-y64skrwp.js";
 export {
   supportsRangeRead,

package/dist/bootstrap/discovery.d.ts

@@ -6,7 +6,6 @@
  * for the `Sixb` constructor.
  */
 import { isActionDefinition } from "../actions";
-import { isAgentDefinition } from "../agents";
 import { isConnectorDefinition } from "../connectors";
 import { isDatasetDefinition } from "../datasets";
 import type { OntologySource } from "../ontology/registry";
@@ -15,10 +14,11 @@ import { isProjectionDefinition } from "../projections/builders";
 import { isRuleDefinition } from "../rules";
 import { isScheduleDefinition } from "../schedules";
 import { isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition } from "../security";
+import { isShareDefinition } from "../shares";
 import { isSyncDefinition } from "../syncs";
 import { isWorkflowDefinition } from "../workflows";
 export declare function discoverOntologySources(projectRoot: string): Promise<readonly OntologySource[]>;
-type DiscoveryModuleKind = "action" | "agent" | "connector" | "dataset" | "group" | "membershipPolicy" | "ontology" | "pipeline" | "projection" | "role" | "rule" | "schedule" | "sync" | "workflow";
+type DiscoveryModuleKind = "action" | "connector" | "dataset" | "group" | "membershipPolicy" | "ontology" | "pipeline" | "projection" | "role" | "rule" | "schedule" | "share" | "sync" | "workflow";
 interface DefinitionDiscoveryFamily<TDefinition> {
     readonly directory: readonly string[];
     readonly kind: Exclude<DiscoveryModuleKind, "ontology">;
@@ -85,10 +85,10 @@ declare const definitionDiscoveryRegistry: {
         readonly kind: "membershipPolicy";
         readonly isDefinition: typeof isMembershipPolicyDefinition;
     };
-    readonly agents: {
-        readonly directory: readonly ["agents"];
-        readonly kind: "agent";
-        readonly isDefinition: typeof isAgentDefinition;
+    readonly shares: {
+        readonly directory: readonly ["shares"];
+        readonly kind: "share";
+        readonly isDefinition: typeof isShareDefinition;
     };
 };
 type DefinitionFromFamily<TFamily> = TFamily extends DefinitionDiscoveryFamily<infer TDefinition> ? TDefinition : never;

package/dist/bootstrap/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/bootstrap/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAInD,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAwCpC;AAED,KAAK,mBAAmB,GACpB,QAAQ,GACR,OAAO,GACP,WAAW,GACX,SAAS,GACT,OAAO,GACP,kBAAkB,GAClB,UAAU,GACV,UAAU,GACV,YAAY,GACZ,MAAM,GACN,MAAM,GACN,UAAU,GACV,MAAM,GACN,UAAU,CAAA;AAEd,UAAU,yBAAyB,CAAC,WAAW;IAC7C,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAA;IACvD,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,WAAW,CAAA;CAChE;AAED,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8CsC,CAAA;AAEvE,KAAK,oBAAoB,CAAC,OAAO,IAC/B,OAAO,SAAS,yBAAyB,CAAC,MAAM,WAAW,CAAC,GAAG,WAAW,GAAG,KAAK,CAAA;AAEpF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,IAAI,IAAI,MAAM,OAAO,2BAA2B,GAAG,SAAS,oBAAoB,CACxF,CAAC,OAAO,2BAA2B,CAAC,CAAC,IAAI,CAAC,CAC3C,EAAE;CACJ,CAAA;AAED,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,4BAA4B,CAAC,CAWvC"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/bootstrap/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAInD,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAwCpC;AAED,KAAK,mBAAmB,GACpB,QAAQ,GACR,WAAW,GACX,SAAS,GACT,OAAO,GACP,kBAAkB,GAClB,UAAU,GACV,UAAU,GACV,YAAY,GACZ,MAAM,GACN,MAAM,GACN,UAAU,GACV,OAAO,GACP,MAAM,GACN,UAAU,CAAA;AAEd,UAAU,yBAAyB,CAAC,WAAW;IAC7C,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAA;IACvD,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,WAAW,CAAA;CAChE;AAED,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8CsC,CAAA;AAEvE,KAAK,oBAAoB,CAAC,OAAO,IAC/B,OAAO,SAAS,yBAAyB,CAAC,MAAM,WAAW,CAAC,GAAG,WAAW,GAAG,KAAK,CAAA;AAEpF,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,EAAE,IAAI,IAAI,MAAM,OAAO,2BAA2B,GAAG,SAAS,oBAAoB,CACxF,CAAC,OAAO,2BAA2B,CAAC,CAAC,IAAI,CAAC,CAC3C,EAAE;CACJ,CAAA;AAED,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,4BAA4B,CAAC,CAWvC"}

package/dist/bootstrap/index.js

@@ -4,73 +4,84 @@ import {
   discoverOntologyTypeManifest,
   discoverProjectDefinitions,
   generateOntologyTypeManifest
-} from "../chunk-dy311asx.js";
-import"../chunk-znagycq7.js";
-import"../chunk-n4spznws.js";
-import"../chunk-e42bc6m3.js";
+} from "../chunk-3xep5cjx.js";
+import"../chunk-3z1qec12.js";
+import"../chunk-gbejpkex.js";
+import"../chunk-z4ccwbkz.js";
+import"../chunk-gzasd5b6.js";
 import"../chunk-5sz8ta9r.js";
 import"../chunk-979ww6b3.js";
 import"../chunk-2ab72m2h.js";
-import"../chunk-a31h57d5.js";
 import"../chunk-74drx9gd.js";
 import"../chunk-b49dgvsj.js";
-import"../chunk-nva1xkjz.js";
-import"../chunk-tg5mee00.js";
-import"../chunk-8gv5z0zm.js";
-import"../chunk-5sxb1168.js";
-import"../chunk-4rh2m6zg.js";
+import"../chunk-4qfkag59.js";
+import"../chunk-xajtptbw.js";
+import"../chunk-wtf06et8.js";
+import"../chunk-c15dr03f.js";
+import"../chunk-v4en4jc2.js";
+import"../chunk-w9tg6yyb.js";
+import"../chunk-aa2pen2v.js";
 import"../chunk-xhy826cz.js";
-import"../chunk-md8k0r54.js";
-import"../chunk-rte5sm3z.js";
-import"../chunk-qewtks41.js";
-import"../chunk-8b55ygje.js";
-import"../chunk-51fjndv0.js";
+import"../chunk-4rh2m6zg.js";
+import"../chunk-9nbmsvn5.js";
 import"../chunk-8m5ejdpn.js";
 import"../chunk-nf4r78r4.js";
-import"../chunk-0hc5j867.js";
-import"../chunk-a44d5zgd.js";
-import"../chunk-nkbfrt0c.js";
+import"../chunk-359jm1jw.js";
+import"../chunk-n4khvw9n.js";
+import"../chunk-pc7ys28c.js";
+import"../chunk-v1xppd0y.js";
+import"../chunk-h5vqbfmd.js";
+import"../chunk-q0k9nc5a.js";
+import"../chunk-rte5sm3z.js";
+import"../chunk-f26bck4t.js";
 import"../chunk-96swp2wd.js";
-import"../chunk-f6erf2vv.js";
-import"../chunk-t624af60.js";
-import"../chunk-72q2y8hn.js";
-import"../chunk-xc7hq65b.js";
-import"../chunk-cy0n5dms.js";
-import"../chunk-dysw7nsm.js";
-import"../chunk-62c7t4jc.js";
-import"../chunk-ezake7g1.js";
-import"../chunk-fe5ev6mr.js";
-import"../chunk-htq0qh7z.js";
-import"../chunk-xkthy56g.js";
-import"../chunk-1g8negke.js";
-import"../chunk-hceck7dq.js";
-import"../chunk-t9xghkva.js";
-import"../chunk-drjqm1aa.js";
+import"../chunk-k522z7v6.js";
+import"../chunk-sbzzr4kx.js";
+import"../chunk-4jjp5k14.js";
+import"../chunk-rv2hkwwa.js";
+import"../chunk-nx7k8tpr.js";
+import"../chunk-4yqmp43v.js";
+import"../chunk-wdage1eb.js";
+import"../chunk-5ntny1qx.js";
+import"../chunk-nn0tekr1.js";
+import"../chunk-p03r0h5s.js";
+import"../chunk-jecn6t54.js";
 import"../chunk-5gd7tpv6.js";
-import"../chunk-h9kxd41f.js";
+import"../chunk-rafagrwr.js";
+import"../chunk-8tsf6dmc.js";
+import"../chunk-yp8ee62z.js";
+import"../chunk-ka3a2ft3.js";
+import"../chunk-w1tvjszy.js";
+import"../chunk-p1rzczbt.js";
+import"../chunk-j1sbhm7p.js";
 import"../chunk-9dzba0f2.js";
-import"../chunk-vybf6pkp.js";
+import"../chunk-dbc80ad7.js";
 import"../chunk-ry24jbr1.js";
-import"../chunk-3j7573mj.js";
-import"../chunk-4gz41why.js";
+import"../chunk-p2vqaxkc.js";
+import"../chunk-trxxmgnf.js";
 import"../chunk-zcnhxkvd.js";
+import"../chunk-w3e09qqk.js";
+import"../chunk-51fjndv0.js";
 import"../chunk-1evzqhks.js";
-import"../chunk-dsrkgtnh.js";
-import"../chunk-bhxaq2nn.js";
+import"../chunk-jq43kdvk.js";
+import"../chunk-qw9gvjv5.js";
 import"../chunk-yt8wphsx.js";
-import"../chunk-rdeagz6b.js";
-import"../chunk-dm72y8wt.js";
-import"../chunk-t0jjkep3.js";
-import"../chunk-1e8m6yn3.js";
-import"../chunk-rhrbz7d4.js";
+import"../chunk-5e3pq99w.js";
+import"../chunk-7y0f6rf1.js";
+import"../chunk-d8qkxt2v.js";
+import"../chunk-4sm0aznx.js";
+import"../chunk-4a849fr1.js";
+import"../chunk-2dw777qw.js";
+import"../chunk-19jp6g9d.js";
 import"../chunk-xwnf87e1.js";
-import"../chunk-f83ka50g.js";
-import"../chunk-rnshztfq.js";
-import"../chunk-04b07a9q.js";
+import"../chunk-p1x242ad.js";
+import"../chunk-r8jrnexe.js";
+import"../chunk-h0k55pc7.js";
 import"../chunk-dktq02ne.js";
-import"../chunk-zqysyfjt.js";
-import"../chunk-0172wgm9.js";
-import"../chunk-t8t39h7v.js";
+import"../chunk-04b07a9q.js";
+import"../chunk-08m3b6w8.js";
+import"../chunk-2xns679x.js";
+import"../chunk-n6jxh8sw.js";
 import"../chunk-y64skrwp.js";
 export {
   generateOntologyTypeManifest,
@@ -79,4 +90,4 @@ export {
   discoverOntologySources
 };
 
-//# debugId=251CC8CF1CBD616C64756E2164756E21
+//# debugId=51F61CBD7257BAC864756E2164756E21

package/dist/bootstrap/index.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "251CC8CF1CBD616C64756E2164756E21",
+  "debugId": "51F61CBD7257BAC864756E2164756E21",
   "names": []
 }

package/dist/bootstrap/ontology-type-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ontology-type-manifest.d.ts","sourceRoot":"","sources":["../../src/bootstrap/ontology-type-manifest.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,yBAAyB,EAAE,CAAA;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,kCAAmC,SAAQ,6BAA6B;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,6BAA6B,CAAC,CAiCxC;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,kCAAkC,CAAC,CAwB7C"}
+{"version":3,"file":"ontology-type-manifest.d.ts","sourceRoot":"","sources":["../../src/bootstrap/ontology-type-manifest.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,SAAS,yBAAyB,EAAE,CAAA;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,kCAAmC,SAAQ,6BAA6B;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,6BAA6B,CAAC,CAiCxC;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,kCAAkC,CAAC,CA8B7C"}

package/dist/broker/index.js

@@ -3,8 +3,8 @@ import {
   BrokerCursorExpiredError,
   BrokerError,
   InMemoryBroker
-} from "../chunk-wtmzkcht.js";
-import"../chunk-t8t39h7v.js";
+} from "../chunk-k34z5rvh.js";
+import"../chunk-n6jxh8sw.js";
 import"../chunk-y64skrwp.js";
 export {
   InMemoryBroker,

package/dist/{chunk-zqysyfjt.js → chunk-08m3b6w8.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   isPlainRecord
-} from "./chunk-t8t39h7v.js";
+} from "./chunk-n6jxh8sw.js";
 
 // src/blob-storage/derive.ts
 function blobDigestHex(digest) {