@sixb/core 0.1.7 → 0.1.8

package/dist/{chunk-rre42skh.js → chunk-4sm0aznx.js}

@@ -1,4 +1,10 @@
 // @bun
+import {
+  validateSchemaOrRefValue
+} from "./chunk-2dw777qw.js";
+import {
+  snapshotLinkPathSelection
+} from "./chunk-19jp6g9d.js";
 import {
   AuthRuntimeError,
   assertNonEmpty,
@@ -17,7 +23,14 @@ import {
   grantKindOf,
   resolveAuthorizationContext,
   resolveRoleGrants
-} from "./chunk-37wk412q.js";
+} from "./chunk-p1x242ad.js";
+import {
+  coerceSchemaValueToTyped,
+  normalizeSchemaValue
+} from "./chunk-h0k55pc7.js";
+import {
+  OntologyValidationError
+} from "./chunk-dktq02ne.js";
 
 // src/auth/access-tokens.ts
 import { createHash, randomBytes, randomUUID } from "crypto";
@@ -210,6 +223,7 @@ var GRANT_CAPABILITIES = Object.keys({
   edit: true,
   append: true,
   apply: true,
+  share: true,
   run: true,
   observe: true,
   manage: true
@@ -544,7 +558,8 @@ var BREADTH_TARGETS = [
   "sync",
   "pipeline",
   "application",
-  "connector"
+  "connector",
+  "share"
 ];
 function isBreadthSelector(value) {
   if (typeof value !== "object" || value === null)
@@ -578,8 +593,405 @@ var every = {
   sync: () => all("sync"),
   pipeline: () => all("pipeline"),
   application: () => all("application"),
-  connector: () => all("connector")
+  connector: () => all("connector"),
+  share: () => all("share")
 };
+// src/actions/errors.ts
+class ActionDefinitionError extends Error {
+  name = "ActionDefinitionError";
+}
+
+class ActionEditCommitError extends Error {
+  name = "ActionEditCommitError";
+}
+function missingActionMutationMessage(actionId) {
+  return `Action "${actionId}" must declare .writeback(...) or .edits(...).`;
+}
+function effectsWithoutEditsMessage(actionId) {
+  return `Action "${actionId}" cannot declare .effects(...) without .edits(...).`;
+}
+
+// src/actions/validation.ts
+function assertNonEmpty2(value, field) {
+  if (!value.trim()) {
+    throw new ActionDefinitionError(`Action ${field} must not be empty.`);
+  }
+}
+function isActionDefinition(value) {
+  const binding = value?.binding;
+  return typeof value === "object" && value !== null && value.kind === "action" && (binding?.kind === "global" || binding?.kind === "object");
+}
+function isGlobalActionDefinition(value) {
+  return value.binding.kind === "global";
+}
+function isObjectActionDefinition(value) {
+  return value.binding.kind === "object";
+}
+function normalizeActionParams(runtime, paramsConfig, params, pathPrefix) {
+  const knownParamIds = new Set(Object.keys(paramsConfig));
+  const normalized = {};
+  for (const paramId of Object.keys(params)) {
+    if (!knownParamIds.has(paramId)) {
+      throw new OntologyValidationError(`Unknown param '${paramId}' for action '${pathPrefix}'`);
+    }
+  }
+  for (const [paramId, paramDef] of Object.entries(paramsConfig)) {
+    const value = params[paramId];
+    if (value === undefined) {
+      if (paramDef.required) {
+        throw new OntologyValidationError(`Missing required param '${paramId}' for action '${pathPrefix}'`);
+      }
+      continue;
+    }
+    if (value === null) {
+      if (!paramDef.nullable) {
+        throw new OntologyValidationError(`[Sixb] Action param ${pathPrefix}.${paramId} cannot be null`);
+      }
+      normalized[paramId] = null;
+      continue;
+    }
+    validateSchemaOrRefValue(paramDef.schema, value, `${pathPrefix}.${paramId}`, runtime.ontology.getValueTypesById());
+    normalized[paramId] = normalizeSchemaOrRefValue(paramDef.schema, value, `${pathPrefix}.${paramId}`, runtime.ontology.getValueTypesById());
+  }
+  return normalized;
+}
+function coerceActionParamsToTyped(paramsConfig, params, valueTypesById) {
+  const coerced = { ...params };
+  for (const [paramId, paramDef] of Object.entries(paramsConfig)) {
+    const value = params[paramId];
+    if (value === undefined)
+      continue;
+    const schema = paramDef.schema;
+    if (typeof schema === "object" && schema !== null && schema.type === "objectRef") {
+      continue;
+    }
+    coerced[paramId] = coerceSchemaValueToTyped(schema, value, valueTypesById);
+  }
+  return coerced;
+}
+function validateActionSubject(action, subject) {
+  if (isGlobalActionDefinition(action) && subject.kind !== "none") {
+    throw new OntologyValidationError(`Action '${action.id}' does not accept an object subject.`);
+  }
+}
+function resolveObjectActionSubject(params) {
+  const { runtime, action, subject } = params;
+  if (subject.kind !== "object") {
+    throw new OntologyValidationError(`Action '${action.id}' requires an object subject.`);
+  }
+  const objectType = runtime.ontology.resolveObjectType(subject.objectTypeId);
+  if (!actionAppliesToObjectType(runtime, action, objectType)) {
+    throw new OntologyValidationError(`Action '${action.id}' is not valid for object type '${objectType.id}'.`);
+  }
+  return objectType;
+}
+function actionAppliesToObjectType(runtime, action, objectType) {
+  return runtime.actionRegistry.listForType(objectType).some((candidate) => candidate.id === action.id);
+}
+function normalizeSchemaOrRefValue(schema, value, path, valueTypesById) {
+  if (typeof schema === "object" && schema !== null && schema.type === "objectRef") {
+    const refValue = value;
+    return {
+      objectTypeId: refValue.objectTypeId,
+      primaryId: refValue.primaryId
+    };
+  }
+  return normalizeSchemaValue(schema, value, path, valueTypesById);
+}
+
+// src/shares/errors.ts
+class ShareDefinitionError extends Error {
+  name = "ShareDefinitionError";
+}
+
+// src/shares/builders.ts
+var shareTargets = new WeakSet;
+function defineShare(id, options) {
+  assertNonEmpty3(id, "Share id");
+  if (!isObjectType(options.target)) {
+    throw invalid(`Share '${id}' target must be an object type.`);
+  }
+  if (typeof options.grants !== "function") {
+    throw invalid(`Share '${id}' grants must be a function.`);
+  }
+  if (options.description !== undefined && typeof options.description !== "string") {
+    throw invalid(`Share '${id}' description must be a string.`);
+  }
+  const target = createShareTarget(options.target.id);
+  let authoredGrants;
+  try {
+    authoredGrants = options.grants({ target });
+  } catch (error) {
+    if (error instanceof ShareDefinitionError)
+      throw error;
+    const reason = error instanceof Error ? error.message.replace(/^\[Sixb\] /, "") : String(error);
+    throw invalid(`Share '${id}' grants are invalid: ${reason}`);
+  }
+  if (!Array.isArray(authoredGrants) || authoredGrants.length === 0) {
+    throw invalid(`Share '${id}' must declare at least one grant.`);
+  }
+  const grants = snapshotShareGrants(id, options.target.id, authoredGrants);
+  return Object.freeze({
+    kind: "share",
+    id,
+    target: Object.freeze({ kind: "object", objectTypeId: options.target.id }),
+    grants,
+    ...options.description === undefined ? {} : { description: options.description }
+  });
+}
+function isShareDefinition(value) {
+  if (!isRecord2(value) || value.kind !== "share" || !isNonEmpty(value.id))
+    return false;
+  if (!isRecord2(value.target) || value.target.kind !== "object" || !isNonEmpty(value.target.objectTypeId)) {
+    return false;
+  }
+  return Array.isArray(value.grants);
+}
+function snapshotShareDefinition(value) {
+  try {
+    if (!isRecord2(value)) {
+      throw invalid("Share definition kind must be 'share'.");
+    }
+    const kind = value.kind;
+    const authoredId = value.id;
+    const target = value.target;
+    const authoredGrants = value.grants;
+    const description = value.description;
+    if (kind !== "share") {
+      throw invalid("Share definition kind must be 'share'.");
+    }
+    const id = nonEmpty(authoredId, "Share id");
+    if (!isRecord2(target)) {
+      throw invalid(`Share '${id}' target must be an object type.`);
+    }
+    const targetKind = target.kind;
+    const authoredObjectTypeId = target.objectTypeId;
+    if (targetKind !== "object" || !isNonEmpty(authoredObjectTypeId)) {
+      throw invalid(`Share '${id}' target must be an object type.`);
+    }
+    if (!Array.isArray(authoredGrants) || authoredGrants.length === 0) {
+      throw invalid(`Share '${id}' must declare grants.`);
+    }
+    if (description !== undefined && typeof description !== "string") {
+      throw invalid(`Share '${id}' description must be a string.`);
+    }
+    const objectTypeId = authoredObjectTypeId;
+    return Object.freeze({
+      kind: "share",
+      id,
+      target: Object.freeze({ kind: "object", objectTypeId }),
+      grants: snapshotShareGrants(id, objectTypeId, authoredGrants),
+      ...description === undefined ? {} : { description }
+    });
+  } catch (error) {
+    if (error instanceof ShareDefinitionError)
+      throw error;
+    const reason = error instanceof Error ? error.message.replace(/^\[Sixb\] /, "") : String(error);
+    throw invalid(`Share definition is invalid: ${reason}`);
+  }
+}
+function isShareTarget(value) {
+  return typeof value === "object" && value !== null && shareTargets.has(value);
+}
+function createShareViewGrant(target) {
+  assertShareTarget(target);
+  return createShareViewGrantWithLinks(target.objectTypeId, Object.freeze({ kind: "none" }));
+}
+function createShareActionGrant(action, target) {
+  assertShareTarget(target);
+  const objectTypeId = action.binding.objectType.id;
+  if (target.objectTypeId !== objectTypeId) {
+    throw invalid(`Action '${action.id}' is defined on '${objectTypeId}', not Share target '${target.objectTypeId}'. Shared Actions are exact-type only in V1.`);
+  }
+  return Object.freeze({
+    kind: "action.apply",
+    actionId: action.id,
+    subjectObjectTypeId: target.objectTypeId
+  });
+}
+function createShareTarget(objectTypeId) {
+  const target = { objectTypeId };
+  shareTargets.add(target);
+  return Object.freeze(target);
+}
+function createShareViewGrantWithLinks(targetObjectTypeId, links) {
+  const grant = {
+    kind: "object.view",
+    targetObjectTypeId,
+    links
+  };
+  Object.defineProperty(grant, "withLinks", {
+    configurable: false,
+    enumerable: false,
+    writable: false,
+    value: (...args) => {
+      if (args.length === 0) {
+        return freezeViewGrant(targetObjectTypeId, Object.freeze({ kind: "all" }));
+      }
+      const selected = args[0];
+      if (!Array.isArray(selected)) {
+        throw invalid("withLinks(...) expects an array, or no argument for every direct link.");
+      }
+      return freezeViewGrant(targetObjectTypeId, Object.freeze({
+        kind: "selected",
+        links: Object.freeze(selected.map(snapshotLinkPathSelection))
+      }));
+    }
+  });
+  return Object.freeze(grant);
+}
+function freezeViewGrant(targetObjectTypeId, links) {
+  return Object.freeze({ kind: "object.view", targetObjectTypeId, links });
+}
+function snapshotShareGrants(shareId, targetObjectTypeId, authored) {
+  const grants = [];
+  const actionIds = new Set;
+  let viewCount = 0;
+  for (let index = 0;index < authored.length; index += 1) {
+    const grant = authored[index];
+    if (!isRecord2(grant)) {
+      throw invalid(`Share '${shareId}' grant ${index} must come from 'can'.`);
+    }
+    const kind = grant.kind;
+    if (kind === "object.view") {
+      const authoredTargetObjectTypeId = grant.targetObjectTypeId;
+      const links = grant.links;
+      if (authoredTargetObjectTypeId !== targetObjectTypeId) {
+        throw invalid(`Share '${shareId}' view grant must use its contextual target.`);
+      }
+      viewCount += 1;
+      if (viewCount > 1) {
+        throw invalid(`Share '${shareId}' must declare exactly one view grant.`);
+      }
+      grants.push(Object.freeze({
+        kind: "object.view",
+        targetObjectTypeId,
+        links: snapshotLinkMode(links)
+      }));
+      continue;
+    }
+    if (kind === "action.apply") {
+      const actionId = grant.actionId;
+      const subjectObjectTypeId = grant.subjectObjectTypeId;
+      if (!isNonEmpty(actionId) || subjectObjectTypeId !== targetObjectTypeId) {
+        throw invalid(`Share '${shareId}' action grant must apply to its contextual target.`);
+      }
+      if (actionIds.has(actionId)) {
+        throw invalid(`Share '${shareId}' contains duplicate action '${actionId}'.`);
+      }
+      actionIds.add(actionId);
+      grants.push(Object.freeze({
+        kind: "action.apply",
+        actionId,
+        subjectObjectTypeId: targetObjectTypeId
+      }));
+      continue;
+    }
+    throw invalid(`Share '${shareId}' grant ${index} must come from 'can'.`);
+  }
+  if (viewCount !== 1) {
+    throw invalid(`Share '${shareId}' must declare exactly one can.view(target) grant.`);
+  }
+  return Object.freeze(grants);
+}
+function snapshotLinkMode(value) {
+  if (!isRecord2(value))
+    throw invalid("Share link selection must be an object.");
+  const kind = value.kind;
+  const links = value.links;
+  if (kind === "none" || kind === "all") {
+    return Object.freeze({ kind });
+  }
+  if (kind !== "selected" || !Array.isArray(links)) {
+    throw invalid("Share link selection must be none, all, or selected links.");
+  }
+  if (links.length === 0) {
+    throw invalid("withLinks([]) is empty; omit withLinks() when no links should be shared.");
+  }
+  try {
+    return Object.freeze({
+      kind: "selected",
+      links: snapshotLinkPaths(links)
+    });
+  } catch (error) {
+    if (error instanceof ShareDefinitionError)
+      throw error;
+    const reason = error instanceof Error ? error.message.replace(/^\[Sixb\] /, "") : String(error);
+    throw invalid(`Share link selection is invalid: ${reason}`);
+  }
+}
+function snapshotLinkPaths(values) {
+  const byKey = new Map;
+  for (const value of values) {
+    const captured = canonicalizeLinkPath(snapshotLinkPathSelection(value));
+    const key = JSON.stringify([captured.sourceObjectTypeId, captured.linkId]);
+    const current = byKey.get(key);
+    if (!current) {
+      byKey.set(key, captured);
+      continue;
+    }
+    if (!sameLinkTargets(current.targetObjectTypeId, captured.targetObjectTypeId)) {
+      throw invalid(`Link '${captured.sourceObjectTypeId}.${captured.linkId}' declares inconsistent targets.`);
+    }
+    byKey.set(key, Object.freeze({
+      ...current,
+      selection: mergeLinkModes(current.selection, captured.selection)
+    }));
+  }
+  return Object.freeze([...byKey.values()]);
+}
+function canonicalizeLinkPath(value) {
+  return Object.freeze({
+    ...value,
+    selection: value.selection.kind === "selected" ? Object.freeze({
+      kind: "selected",
+      links: snapshotLinkPaths(value.selection.links)
+    }) : value.selection
+  });
+}
+function mergeLinkModes(left, right) {
+  if (left.kind === "all" || right.kind === "all")
+    return Object.freeze({ kind: "all" });
+  if (left.kind === "none")
+    return right;
+  if (right.kind === "none")
+    return left;
+  return Object.freeze({
+    kind: "selected",
+    links: snapshotLinkPaths([...left.links, ...right.links])
+  });
+}
+function sameLinkTargets(left, right) {
+  if (typeof left === "string" || typeof right === "string")
+    return left === right;
+  return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function assertShareTarget(value) {
+  if (!isShareTarget(value)) {
+    throw invalid("Shared grants must use the target provided by defineShare(...).");
+  }
+}
+function isObjectType(value) {
+  return isRecord2(value) && isNonEmpty(value.id) && Array.isArray(value.properties) && Array.isArray(value.links);
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmpty(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function assertNonEmpty3(value, field) {
+  if (!isNonEmpty(value))
+    throw invalid(`${field} must not be empty.`);
+}
+function nonEmpty(value, field) {
+  assertNonEmpty3(value, field);
+  return value;
+}
+function invalid(message) {
+  return new ShareDefinitionError(`[Sixb] ${message}`);
+}
+
 // src/security/grants.ts
 var VIEW_TARGETS = ["object", "dataset"];
 var RUN_TARGETS = ["workflow", "sync", "pipeline"];
@@ -589,7 +1001,8 @@ var TARGET_BY_DEFINITION_KIND = {
   pipeline: "pipeline",
   workflow: "workflow",
   application: "application",
-  connector: "connector"
+  connector: "connector",
+  share: "share"
 };
 var UNDISCRIMINATED_TARGETS = ["object", "action"];
 function targetOfDefinition(item, label, allowedTargets) {
@@ -640,6 +1053,8 @@ function access(input) {
   return { kind: "grant", capability: "access", target: "application", selection };
 }
 function view(input) {
+  if (isShareTarget(input))
+    return createShareViewGrant(input);
   const { target, selection } = resolveGrant(input, "can.view", VIEW_TARGETS);
   return { kind: "grant", capability: "view", target, selection };
 }
@@ -658,11 +1073,28 @@ function append(input) {
   };
 }
 function apply(input) {
-  return {
+  const grant = {
     kind: "grant",
     capability: "apply",
     selection: resolveGrant(input, "can.apply", ["action"]).selection
   };
+  const one = Array.isArray(input) || isBreadthSelector(input) ? undefined : input;
+  if (one && isObjectActionDefinition(one)) {
+    Object.defineProperty(grant, "on", {
+      configurable: false,
+      enumerable: false,
+      writable: false,
+      value: (target) => createShareActionGrant(one, target)
+    });
+  }
+  return grant;
+}
+function share(input) {
+  return {
+    kind: "grant",
+    capability: "share",
+    selection: resolveGrant(input, "can.share", ["share"]).selection
+  };
 }
 function run(input) {
   if (isAgentReference(input)) {
@@ -711,6 +1143,7 @@ var can = {
   edit,
   append,
   apply,
+  share,
   run,
   observe,
   manage
@@ -736,7 +1169,8 @@ class SecurityRegistry {
       agentAvailable: input.agentAvailable,
       connectorIds: input.connectorIds,
       observableIds: new Set(["logs", "aiUsage"]),
-      manageableIds: new Set(["aiUsage"])
+      manageableIds: new Set(["aiUsage"]),
+      shareIds: input.shareIds
     });
     const universe = {
       applicationIds: input.applicationIds ?? APPLICATION_IDS,
@@ -749,6 +1183,7 @@ class SecurityRegistry {
       connectorIds: input.connectorIds ?? new Set,
       observableIds: new Set(["logs", "aiUsage"]),
       manageableIds: new Set(["aiUsage"]),
+      shareIds: input.shareIds ?? new Set,
       getSubTypes: input.getSubTypes ?? (() => [])
     };
     this.groupsById = definitions.groupsById;
@@ -855,7 +1290,7 @@ function cloneDate(value) {
 function dateOrNow(value) {
   return value ? cloneDate(value) : new Date;
 }
-function assertNonEmpty2(value, label) {
+function assertNonEmpty4(value, label) {
   const normalized = value.trim();
   if (!normalized) {
     throw new AuthStorageError("invalid_input", `[Sixb] ${label} must be a non-empty string.`);
@@ -863,10 +1298,10 @@ function assertNonEmpty2(value, label) {
   return normalized;
 }
 function normalizeEmail(email) {
-  return assertNonEmpty2(email, "Email").toLowerCase();
+  return assertNonEmpty4(email, "Email").toLowerCase();
 }
 function normalizeGroupIds(groupIds) {
-  return [...new Set((groupIds ?? []).map((groupId) => assertNonEmpty2(groupId, "Group id")))];
+  return [...new Set((groupIds ?? []).map((groupId) => assertNonEmpty4(groupId, "Group id")))];
 }
 function normalizeOptionalGroupIds(groupIds) {
   return groupIds === undefined ? undefined : normalizeGroupIds(groupIds);
@@ -953,18 +1388,18 @@ function assertSessionIdAvailable(state, projectId, sessionId) {
   }
 }
 function validateCompleteSessionInput(state, projectId, session) {
-  const sessionId = assertNonEmpty2(session.id, "Session id");
-  assertNonEmpty2(session.audience, "Session audience");
-  assertNonEmpty2(session.tokenHash, "Session token hash");
+  const sessionId = assertNonEmpty4(session.id, "Session id");
+  assertNonEmpty4(session.audience, "Session audience");
+  assertNonEmpty4(session.tokenHash, "Session token hash");
   assertSessionIdAvailable(state, projectId, sessionId);
 }
 function createSessionRecord(state, input) {
-  const id = assertNonEmpty2(input.id, "Session id");
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const userId = assertNonEmpty2(input.userId, "User id");
-  const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
+  const id = assertNonEmpty4(input.id, "Session id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const userId = assertNonEmpty4(input.userId, "User id");
+  const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
   const audience = resolveAuthSessionAudience(input.audience);
-  const tokenHash = assertNonEmpty2(input.tokenHash, "Session token hash");
+  const tokenHash = assertNonEmpty4(input.tokenHash, "Session token hash");
   assertSessionIdAvailable(state, projectId, id);
   const session = {
     id,
@@ -983,9 +1418,9 @@ function createSessionRecord(state, input) {
   return session;
 }
 function createServiceAccountRecord(state, input) {
-  const id = assertNonEmpty2(input.id, "Service account id");
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const name = assertNonEmpty2(input.name, "Service account name");
+  const id = assertNonEmpty4(input.id, "Service account id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const name = assertNonEmpty4(input.name, "Service account name");
   const key = serviceAccountKey(projectId, id);
   if (state.serviceAccounts.has(key)) {
     throw new AuthStorageError("duplicate_service_account", `[Sixb] Service account '${id}' already exists for project '${projectId}'.`);
@@ -1006,9 +1441,9 @@ function createServiceAccountRecord(state, input) {
   return serviceAccount;
 }
 function upsertServiceAccountGroupMembershipRecord(state, input) {
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const serviceAccountId = assertNonEmpty2(input.serviceAccountId, "Service account id");
-  const groupId = assertNonEmpty2(input.groupId, "Group id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const serviceAccountId = assertNonEmpty4(input.serviceAccountId, "Service account id");
+  const groupId = assertNonEmpty4(input.groupId, "Group id");
   if (!state.serviceAccounts.has(serviceAccountKey(projectId, serviceAccountId))) {
     throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
   }
@@ -1028,11 +1463,11 @@ function upsertServiceAccountGroupMembershipRecord(state, input) {
   return membership;
 }
 function createAccessTokenRecord(state, input) {
-  const id = assertNonEmpty2(input.id, "Access token id");
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const name = assertNonEmpty2(input.name, "Access token name");
-  const subjectId = assertNonEmpty2(input.subjectId, "Access token subject id");
-  const tokenHash = assertNonEmpty2(input.tokenHash, "Access token hash");
+  const id = assertNonEmpty4(input.id, "Access token id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const name = assertNonEmpty4(input.name, "Access token name");
+  const subjectId = assertNonEmpty4(input.subjectId, "Access token subject id");
+  const tokenHash = assertNonEmpty4(input.tokenHash, "Access token hash");
   assertAccessTokenSubject(input.kind, input.subjectType);
   assertAccessTokenSubjectExists(state, projectId, input.subjectType, subjectId);
   const key = accessTokenKey(projectId, id);
@@ -1057,9 +1492,9 @@ function createAccessTokenRecord(state, input) {
   return token;
 }
 function upsertGroupMembershipRecord(state, input) {
-  const projectId = assertNonEmpty2(input.projectId, "Project id");
-  const userId = assertNonEmpty2(input.userId, "User id");
-  const groupId = assertNonEmpty2(input.groupId, "Group id");
+  const projectId = assertNonEmpty4(input.projectId, "Project id");
+  const userId = assertNonEmpty4(input.userId, "User id");
+  const groupId = assertNonEmpty4(input.groupId, "Group id");
   if (!state.users.has(userKey(projectId, userId))) {
     throw new AuthStorageError("missing_user", `[Sixb] User '${userId}' not found for project '${projectId}'.`);
   }
@@ -1079,9 +1514,9 @@ function upsertGroupMembershipRecord(state, input) {
   return membership;
 }
 function removeGroupMembershipRecord(state, params) {
-  const projectId = assertNonEmpty2(params.projectId, "Project id");
-  const userId = assertNonEmpty2(params.userId, "User id");
-  const groupId = assertNonEmpty2(params.groupId, "Group id");
+  const projectId = assertNonEmpty4(params.projectId, "Project id");
+  const userId = assertNonEmpty4(params.userId, "User id");
+  const groupId = assertNonEmpty4(params.groupId, "Group id");
   const key = groupMembershipKey(projectId, userId, groupId);
   const existing = state.groupMemberships.get(key);
   if (!existing) {
@@ -1107,9 +1542,9 @@ function assertAccessTokenSubjectExists(state, projectId, subjectType, subjectId
   throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${subjectId}' not found for project '${projectId}'.`);
 }
 function consumeMagicLinkRecord(state, params) {
-  const projectId = assertNonEmpty2(params.projectId, "Project id");
-  const id = assertNonEmpty2(params.id, "Magic link id");
-  const tokenHash = assertNonEmpty2(params.tokenHash, "Magic link token hash");
+  const projectId = assertNonEmpty4(params.projectId, "Project id");
+  const id = assertNonEmpty4(params.id, "Magic link id");
+  const tokenHash = assertNonEmpty4(params.tokenHash, "Magic link token hash");
   const key = magicLinkKey(projectId, id);
   const existing = state.magicLinks.get(key);
   if (!existing) {
@@ -1129,9 +1564,9 @@ function consumeMagicLinkRecord(state, params) {
   return consumed;
 }
 function consumeOidcAttemptRecord(state, params) {
-  const projectId = assertNonEmpty2(params.projectId, "Project id");
-  const id = assertNonEmpty2(params.id, "OIDC authorization attempt id");
-  const stateHash = assertNonEmpty2(params.stateHash, "OIDC state hash");
+  const projectId = assertNonEmpty4(params.projectId, "Project id");
+  const id = assertNonEmpty4(params.id, "OIDC authorization attempt id");
+  const stateHash = assertNonEmpty4(params.stateHash, "OIDC state hash");
   const key = oidcAttemptKey(projectId, id);
   const existing = state.oidcAuthorizationAttempts.get(key);
   if (!existing) {
@@ -1222,8 +1657,8 @@ class InMemoryAuthDeviceAuthorizationStore {
     this.state = state;
   }
   async create(input) {
-    const id = assertNonEmpty2(input.id, "Device authorization id");
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const id = assertNonEmpty4(input.id, "Device authorization id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
     for (const [key2, authorization] of this.state.deviceAuthorizations) {
       if (authorization.projectId === projectId && authorization.expiresAt <= input.createdAt) {
         this.state.deviceAuthorizations.delete(key2);
@@ -1240,10 +1675,10 @@ class InMemoryAuthDeviceAuthorizationStore {
     const record = {
       id,
       projectId,
-      deviceCodeHash: assertNonEmpty2(input.deviceCodeHash, "Device code hash"),
-      userCode: assertNonEmpty2(input.userCode, "User code"),
-      clientName: assertNonEmpty2(input.clientName, "Client name"),
-      tokenName: assertNonEmpty2(input.tokenName, "Token name"),
+      deviceCodeHash: assertNonEmpty4(input.deviceCodeHash, "Device code hash"),
+      userCode: assertNonEmpty4(input.userCode, "User code"),
+      clientName: assertNonEmpty4(input.clientName, "Client name"),
+      tokenName: assertNonEmpty4(input.tokenName, "Token name"),
       tokenExpiresAt: new Date(input.tokenExpiresAt),
       status: "pending",
       createdAt: new Date(input.createdAt),
@@ -1274,8 +1709,8 @@ class InMemoryAuthDeviceAuthorizationStore {
     const next = {
       ...record,
       status: "approved",
-      approvedUserId: assertNonEmpty2(params.userId, "Approved user id"),
-      approvedSessionId: assertNonEmpty2(params.sessionId, "Approved session id"),
+      approvedUserId: assertNonEmpty4(params.userId, "Approved user id"),
+      approvedSessionId: assertNonEmpty4(params.sessionId, "Approved session id"),
       approvedAt: new Date(params.approvedAt)
     };
     this.state.deviceAuthorizations.set(deviceAuthorizationKey(params.projectId, params.id), next);
@@ -1334,10 +1769,10 @@ class InMemoryAuthUserIdentityStore {
     this.state = state;
   }
   async upsert(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
-    const subject = assertNonEmpty2(input.subject, "Subject");
-    const userId = assertNonEmpty2(input.userId, "User id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
+    const subject = assertNonEmpty4(input.subject, "Subject");
+    const userId = assertNonEmpty4(input.userId, "User id");
     const key = identityKey(projectId, strategyId, subject);
     const existing = this.state.identities.get(key);
     const createdAt = existing?.createdAt ?? dateOrNow(input.createdAt);
@@ -1387,8 +1822,8 @@ class InMemoryAuthInvitationStore {
     this.state = state;
   }
   async createOrUpdateActive(input) {
-    const id = assertNonEmpty2(input.id, "Invitation id");
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const id = assertNonEmpty4(input.id, "Invitation id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
     const email = normalizeEmail(input.email);
     const groupIds = normalizeGroupIds(input.groupIds);
     const now = dateOrNow(input.updatedAt ?? input.createdAt);
@@ -1486,12 +1921,12 @@ class InMemoryAuthMagicLinkStore {
     this.state = state;
   }
   async create(input) {
-    const id = assertNonEmpty2(input.id, "Magic link id");
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
+    const id = assertNonEmpty4(input.id, "Magic link id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
     const audience = resolveAuthSessionAudience(input.audience);
     const email = normalizeEmail(input.email);
-    const tokenHash = assertNonEmpty2(input.tokenHash, "Magic link token hash");
+    const tokenHash = assertNonEmpty4(input.tokenHash, "Magic link token hash");
     const key = magicLinkKey(projectId, id);
     if (this.state.magicLinks.has(key)) {
       throw new AuthStorageError("duplicate_magic_link", `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`);
@@ -1535,13 +1970,13 @@ class InMemoryAuthOidcAuthorizationAttemptStore {
     this.state = state;
   }
   async create(input) {
-    const id = assertNonEmpty2(input.id, "OIDC authorization attempt id");
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const strategyId = assertNonEmpty2(input.strategyId, "Strategy id");
+    const id = assertNonEmpty4(input.id, "OIDC authorization attempt id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const strategyId = assertNonEmpty4(input.strategyId, "Strategy id");
     const audience = resolveAuthSessionAudience(input.audience);
-    const stateHash = assertNonEmpty2(input.stateHash, "OIDC state hash");
-    const nonceHash = assertNonEmpty2(input.nonceHash, "OIDC nonce hash");
-    const codeVerifier = assertNonEmpty2(input.codeVerifier, "OIDC code verifier");
+    const stateHash = assertNonEmpty4(input.stateHash, "OIDC state hash");
+    const nonceHash = assertNonEmpty4(input.nonceHash, "OIDC nonce hash");
+    const codeVerifier = assertNonEmpty4(input.codeVerifier, "OIDC code verifier");
     const key = oidcAttemptKey(projectId, id);
     if (this.state.oidcAuthorizationAttempts.has(key)) {
       throw new AuthStorageError("duplicate_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`);
@@ -1580,8 +2015,8 @@ class InMemoryAuthServiceAccountGroupMembershipStore {
     return cloneRecord(upsertServiceAccountGroupMembershipRecord(this.state, input));
   }
   async reconcileForServiceAccount(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const serviceAccountId = assertNonEmpty2(input.serviceAccountId, "Service account id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const serviceAccountId = assertNonEmpty4(input.serviceAccountId, "Service account id");
     if (!this.state.serviceAccounts.has(serviceAccountKey(projectId, serviceAccountId))) {
       throw new AuthStorageError("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
     }
@@ -1632,8 +2067,8 @@ class InMemoryAuthServiceAccountStore {
     return cloneOptionalRecord(record);
   }
   async update(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
-    const id = assertNonEmpty2(input.id, "Service account id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
+    const id = assertNonEmpty4(input.id, "Service account id");
     const key = serviceAccountKey(projectId, id);
     const existing = this.state.serviceAccounts.get(key);
     if (!existing) {
@@ -1641,7 +2076,7 @@ class InMemoryAuthServiceAccountStore {
     }
     const next = {
       ...existing,
-      name: input.name === undefined ? existing.name : assertNonEmpty2(input.name, "Service account name"),
+      name: input.name === undefined ? existing.name : assertNonEmpty4(input.name, "Service account name"),
       description: input.description === undefined ? existing.description : input.description,
       status: input.status ?? existing.status,
       updatedAt: input.updatedAt ? cloneDate(input.updatedAt) : new Date
@@ -1749,8 +2184,8 @@ class InMemoryAuthUserStore {
     this.state = state;
   }
   async create(input) {
-    const id = assertNonEmpty2(input.id, "User id");
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const id = assertNonEmpty4(input.id, "User id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
     const email = normalizeEmail(input.email);
     const key = userKey(projectId, id);
     if (this.state.users.has(key)) {
@@ -1898,7 +2333,7 @@ class InMemoryAuthStorage {
     return { authorization: cloneRecord(consumed), accessToken: cloneRecord(accessToken) };
   }
   async completeMagicLinkSignIn(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
     const completedAt = cloneDate(input.completedAt);
     const magicLink = this.state.magicLinks.get(magicLinkKey(projectId, input.magicLinkId));
     if (!magicLink) {
@@ -1945,7 +2380,7 @@ class InMemoryAuthStorage {
     assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
     let newUserId;
     if (shouldCreateUser) {
-      newUserId = assertNonEmpty2(input.newUserId, "User id");
+      newUserId = assertNonEmpty4(input.newUserId, "User id");
       if (this.state.users.has(userKey(projectId, newUserId))) {
         throw new AuthStorageError("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
       }
@@ -1959,7 +2394,7 @@ class InMemoryAuthStorage {
     let user = existingUser;
     if (!user) {
       user = {
-        id: newUserId ?? assertNonEmpty2(input.newUserId, "User id"),
+        id: newUserId ?? assertNonEmpty4(input.newUserId, "User id"),
         projectId,
         email: magicLink.email,
         displayName: input.newUserDisplayName,
@@ -1997,7 +2432,7 @@ class InMemoryAuthStorage {
     };
   }
   async completeOidcSignIn(input) {
-    const projectId = assertNonEmpty2(input.projectId, "Project id");
+    const projectId = assertNonEmpty4(input.projectId, "Project id");
     const completedAt = cloneDate(input.completedAt);
     const attempt = this.state.oidcAuthorizationAttempts.get(oidcAttemptKey(projectId, input.oidcAuthorizationAttemptId));
     if (!attempt) {
@@ -2009,7 +2444,7 @@ class InMemoryAuthStorage {
     if (attempt.expiresAt <= completedAt) {
       throw new AuthStorageError("expired_oidc_attempt", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' is expired for project '${projectId}'.`);
     }
-    const subject = assertNonEmpty2(input.subject, "Subject");
+    const subject = assertNonEmpty4(input.subject, "Subject");
     const email = normalizeEmail(input.email);
     const claims = normalizeClaims(input.claims);
     const identity = this.state.identities.get(identityKey(projectId, attempt.strategyId, subject));
@@ -2045,7 +2480,7 @@ class InMemoryAuthStorage {
     assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
     let newUserId;
     if (shouldCreateUser) {
-      newUserId = assertNonEmpty2(input.newUserId, "User id");
+      newUserId = assertNonEmpty4(input.newUserId, "User id");
       if (this.state.users.has(userKey(projectId, newUserId))) {
         throw new AuthStorageError("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
       }
@@ -2053,7 +2488,7 @@ class InMemoryAuthStorage {
     this.consumeOidcAttempt(input, completedAt, projectId);
     if (!user) {
       user = {
-        id: newUserId ?? assertNonEmpty2(input.newUserId, "User id"),
+        id: newUserId ?? assertNonEmpty4(input.newUserId, "User id"),
         projectId,
         email,
         displayName: input.displayName,
@@ -3200,6 +3635,6 @@ var SYSTEM_PRINCIPAL = { type: "system", id: "system" };
 function principalsEqual(left, right) {
   return left.type === right.type && left.id === right.id;
 }
-export { PERSONAL_ACCESS_TOKEN_PREFIX, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, generateAccessTokenSecret, hashAccessTokenSecret, formatAccessTokenValue, parseAccessTokenValue, getBearerAccessTokenValue, createAccessTokenCredential, CSRF_HEADER_NAME, generateCsrfToken, isCsrfExemptMethod, verifyDoubleSubmitCsrf, applications, SecurityValidationError, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup, defineRole, defineMembershipPolicy, every, can, SecurityRegistry, AuthStorageError, MAX_PENDING_DEVICE_AUTHORIZATIONS, paginate, InMemoryAuthStorage, generateSessionSecret, hashSessionSecret, formatSessionCookieValue, parseSessionCookieValue, createSessionCredential, AuthRuntime, SYSTEM_PRINCIPAL, principalsEqual };
+export { ActionDefinitionError, ActionEditCommitError, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2 as assertNonEmpty, isActionDefinition, isGlobalActionDefinition, isObjectActionDefinition, normalizeActionParams, coerceActionParamsToTyped, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, generateAccessTokenSecret, hashAccessTokenSecret, formatAccessTokenValue, parseAccessTokenValue, getBearerAccessTokenValue, createAccessTokenCredential, CSRF_HEADER_NAME, generateCsrfToken, isCsrfExemptMethod, verifyDoubleSubmitCsrf, applications, SecurityValidationError, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup, defineRole, defineMembershipPolicy, every, ShareDefinitionError, defineShare, isShareDefinition, snapshotShareDefinition, can, SecurityRegistry, AuthStorageError, MAX_PENDING_DEVICE_AUTHORIZATIONS, paginate, InMemoryAuthStorage, generateSessionSecret, hashSessionSecret, formatSessionCookieValue, parseSessionCookieValue, createSessionCredential, AuthRuntime, SYSTEM_PRINCIPAL, principalsEqual };
 
-//# debugId=D187F2B23E70181D64756E2164756E21
+//# debugId=883B08C31B88A92764756E2164756E21