@sixb/core 0.1.7 → 0.1.8

package/dist/chunk-4yqmp43v.js

@@ -0,0 +1,159 @@
+// @bun
+// src/storage/share-sessions/errors.ts
+class ShareSessionStorageError extends Error {
+  code;
+  name = "ShareSessionStorageError";
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+  }
+}
+
+// src/storage/share-sessions/record.ts
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+function normalizeShareSessionCreate(input) {
+  if (!isRecord(input))
+    throw invalidInput("Share session create input must be an object.");
+  const createdAt = inputDate(input.createdAt, "Share session creation time");
+  const expiresAt = inputDate(input.expiresAt, "Share session inactivity expiry");
+  const absoluteExpiresAt = inputDate(input.absoluteExpiresAt, "Share session absolute expiry");
+  if (expiresAt.getTime() <= createdAt.getTime()) {
+    throw invalidInput("Share session inactivity expiry must be later than creation time.");
+  }
+  if (absoluteExpiresAt.getTime() <= createdAt.getTime()) {
+    throw invalidInput("Share session absolute expiry must be later than creation time.");
+  }
+  if (expiresAt.getTime() > absoluteExpiresAt.getTime()) {
+    throw invalidInput("Share session inactivity expiry must not exceed its absolute expiry.");
+  }
+  return {
+    id: identifier(input.id, "Share session id"),
+    projectId: identifier(input.projectId, "Project id"),
+    grantId: identifier(input.grantId, "Share grant id"),
+    tokenHash: sha256(input.tokenHash, "Share session token hash"),
+    createdAt,
+    expiresAt,
+    absoluteExpiresAt
+  };
+}
+function parseShareSessionRecord(input) {
+  if (!isRecord(input))
+    throw invalidRecord("Share session row must be an object.");
+  try {
+    const createdAt = storedDate(input.createdAt, "Share session creation time");
+    const expiresAt = storedDate(input.expiresAt, "Share session inactivity expiry");
+    const absoluteExpiresAt = storedDate(input.absoluteExpiresAt, "Share session absolute expiry");
+    if (expiresAt.getTime() <= createdAt.getTime()) {
+      throw invalidRecord("Share session inactivity expiry must be later than creation time.");
+    }
+    if (absoluteExpiresAt.getTime() <= createdAt.getTime()) {
+      throw invalidRecord("Share session absolute expiry must be later than creation time.");
+    }
+    if (expiresAt.getTime() > absoluteExpiresAt.getTime()) {
+      throw invalidRecord("Share session inactivity expiry exceeds its absolute expiry.");
+    }
+    const revokedAtValue = input.revokedAt;
+    if (revokedAtValue === null) {
+      throw invalidRecord("Share session revocation time must be omitted rather than null.");
+    }
+    const revokedAt = revokedAtValue === undefined ? undefined : storedDate(revokedAtValue, "Share session revocation time");
+    if (revokedAt && revokedAt.getTime() < createdAt.getTime()) {
+      throw invalidRecord("Share session revocation time must not precede creation time.");
+    }
+    return {
+      id: identifier(input.id, "Share session id"),
+      projectId: identifier(input.projectId, "Project id"),
+      grantId: identifier(input.grantId, "Share grant id"),
+      tokenHash: sha256(input.tokenHash, "Share session token hash"),
+      createdAt,
+      expiresAt,
+      absoluteExpiresAt,
+      ...revokedAt === undefined ? {} : { revokedAt }
+    };
+  } catch (error) {
+    if (error instanceof ShareSessionStorageError) {
+      if (error.code === "invalid_record")
+        throw error;
+      throw invalidRecord(error.message.replace(/^\[Sixb\] /, ""), error);
+    }
+    throw error;
+  }
+}
+function normalizeGetShareSessionByIdInput(input) {
+  if (!isRecord(input))
+    throw invalidInput("Share session lookup input must be an object.");
+  return {
+    projectId: identifier(input.projectId, "Project id"),
+    id: identifier(input.id, "Share session id")
+  };
+}
+function normalizeRenewShareSessionIfValidInput(input) {
+  if (!isRecord(input))
+    throw invalidInput("Share session renewal input must be an object.");
+  const now = inputDate(input.now, "Share session renewal time");
+  const expiresAt = inputDate(input.expiresAt, "Requested Share session expiry");
+  if (expiresAt.getTime() <= now.getTime()) {
+    throw invalidInput("Requested Share session expiry must be later than renewal time.");
+  }
+  return {
+    projectId: identifier(input.projectId, "Project id"),
+    id: identifier(input.id, "Share session id"),
+    grantId: identifier(input.grantId, "Share grant id"),
+    tokenHash: sha256(input.tokenHash, "Share session token hash"),
+    now,
+    expiresAt
+  };
+}
+function normalizeRevokeShareSessionInput(input, createdAt) {
+  if (!isRecord(input))
+    throw invalidInput("Share session revocation input must be an object.");
+  const normalized = {
+    projectId: identifier(input.projectId, "Project id"),
+    id: identifier(input.id, "Share session id"),
+    revokedAt: inputDate(input.revokedAt, "Share session revocation time")
+  };
+  if (createdAt && normalized.revokedAt.getTime() < createdAt.getTime()) {
+    throw invalidInput("Share session revocation time must not precede creation time.");
+  }
+  return normalized;
+}
+function cloneShareSessionRecord(input) {
+  return structuredClone(input);
+}
+function identifier(value, label) {
+  if (typeof value !== "string" || value.trim().length === 0 || value.includes("\x00")) {
+    throw invalidInput(`${label} must be a non-empty string without NUL bytes.`);
+  }
+  return value;
+}
+function sha256(value, label) {
+  if (typeof value !== "string" || !SHA256_HEX.test(value)) {
+    throw invalidInput(`${label} must be a lowercase SHA-256 hex digest.`);
+  }
+  return value;
+}
+function inputDate(value, label) {
+  if (!(value instanceof Date) || !Number.isFinite(value.getTime())) {
+    throw invalidInput(`${label} must be a valid Date.`);
+  }
+  return new Date(value);
+}
+function storedDate(value, label) {
+  const parsed = value instanceof Date ? new Date(value) : typeof value === "string" ? new Date(value) : new Date(Number.NaN);
+  if (!Number.isFinite(parsed.getTime()))
+    throw invalidRecord(`${label} is invalid.`);
+  return parsed;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function invalidInput(message, cause) {
+  return new ShareSessionStorageError("invalid_input", `[Sixb] ${message}`, { cause });
+}
+function invalidRecord(message, cause) {
+  return new ShareSessionStorageError("invalid_record", `[Sixb] ${message}`, { cause });
+}
+
+export { ShareSessionStorageError, normalizeShareSessionCreate, parseShareSessionRecord, normalizeGetShareSessionByIdInput, normalizeRenewShareSessionIfValidInput, normalizeRevokeShareSessionInput, cloneShareSessionRecord };
+
+//# debugId=D3828EEEA2F9B76B64756E2164756E21

package/dist/chunk-4yqmp43v.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/storage/share-sessions/errors.ts", "../src/storage/share-sessions/record.ts"],
+  "sourcesContent": [
+    "export type ShareSessionStorageErrorCode = \"duplicate\" | \"invalid_input\" | \"invalid_record\"\n\n/** Provider-level control signal for durable Share session persistence. */\nexport class ShareSessionStorageError extends Error {\n  readonly name = \"ShareSessionStorageError\"\n\n  constructor(\n    readonly code: ShareSessionStorageErrorCode,\n    message: string,\n    options?: ErrorOptions\n  ) {\n    super(message, options)\n  }\n}\n",
+    "import { ShareSessionStorageError } from \"./errors\"\nimport type {\n  CreateShareSessionInput,\n  GetShareSessionByIdInput,\n  RenewShareSessionIfValidInput,\n  RevokeShareSessionInput,\n  ShareSessionRecord,\n} from \"./types\"\n\nconst SHA256_HEX = /^[0-9a-f]{64}$/\n\nexport function normalizeShareSessionCreate(input: CreateShareSessionInput): ShareSessionRecord {\n  if (!isRecord(input)) throw invalidInput(\"Share session create input must be an object.\")\n  const createdAt = inputDate(input.createdAt, \"Share session creation time\")\n  const expiresAt = inputDate(input.expiresAt, \"Share session inactivity expiry\")\n  const absoluteExpiresAt = inputDate(input.absoluteExpiresAt, \"Share session absolute expiry\")\n  if (expiresAt.getTime() <= createdAt.getTime()) {\n    throw invalidInput(\"Share session inactivity expiry must be later than creation time.\")\n  }\n  if (absoluteExpiresAt.getTime() <= createdAt.getTime()) {\n    throw invalidInput(\"Share session absolute expiry must be later than creation time.\")\n  }\n  if (expiresAt.getTime() > absoluteExpiresAt.getTime()) {\n    throw invalidInput(\"Share session inactivity expiry must not exceed its absolute expiry.\")\n  }\n\n  return {\n    id: identifier(input.id, \"Share session id\"),\n    projectId: identifier(input.projectId, \"Project id\"),\n    grantId: identifier(input.grantId, \"Share grant id\"),\n    tokenHash: sha256(input.tokenHash, \"Share session token hash\"),\n    createdAt,\n    expiresAt,\n    absoluteExpiresAt,\n  }\n}\n\nexport function parseShareSessionRecord(input: unknown): ShareSessionRecord {\n  if (!isRecord(input)) throw invalidRecord(\"Share session row must be an object.\")\n  try {\n    const createdAt = storedDate(input.createdAt, \"Share session creation time\")\n    const expiresAt = storedDate(input.expiresAt, \"Share session inactivity expiry\")\n    const absoluteExpiresAt = storedDate(input.absoluteExpiresAt, \"Share session absolute expiry\")\n    if (expiresAt.getTime() <= createdAt.getTime()) {\n      throw invalidRecord(\"Share session inactivity expiry must be later than creation time.\")\n    }\n    if (absoluteExpiresAt.getTime() <= createdAt.getTime()) {\n      throw invalidRecord(\"Share session absolute expiry must be later than creation time.\")\n    }\n    if (expiresAt.getTime() > absoluteExpiresAt.getTime()) {\n      throw invalidRecord(\"Share session inactivity expiry exceeds its absolute expiry.\")\n    }\n\n    const revokedAtValue = input.revokedAt\n    if (revokedAtValue === null) {\n      throw invalidRecord(\"Share session revocation time must be omitted rather than null.\")\n    }\n    const revokedAt =\n      revokedAtValue === undefined\n        ? undefined\n        : storedDate(revokedAtValue, \"Share session revocation time\")\n    if (revokedAt && revokedAt.getTime() < createdAt.getTime()) {\n      throw invalidRecord(\"Share session revocation time must not precede creation time.\")\n    }\n\n    return {\n      id: identifier(input.id, \"Share session id\"),\n      projectId: identifier(input.projectId, \"Project id\"),\n      grantId: identifier(input.grantId, \"Share grant id\"),\n      tokenHash: sha256(input.tokenHash, \"Share session token hash\"),\n      createdAt,\n      expiresAt,\n      absoluteExpiresAt,\n      ...(revokedAt === undefined ? {} : { revokedAt }),\n    }\n  } catch (error) {\n    if (error instanceof ShareSessionStorageError) {\n      if (error.code === \"invalid_record\") throw error\n      throw invalidRecord(error.message.replace(/^\\[Sixb\\] /, \"\"), error)\n    }\n    throw error\n  }\n}\n\nexport function normalizeGetShareSessionByIdInput(\n  input: GetShareSessionByIdInput\n): GetShareSessionByIdInput {\n  if (!isRecord(input)) throw invalidInput(\"Share session lookup input must be an object.\")\n  return {\n    projectId: identifier(input.projectId, \"Project id\"),\n    id: identifier(input.id, \"Share session id\"),\n  }\n}\n\nexport function normalizeRenewShareSessionIfValidInput(\n  input: RenewShareSessionIfValidInput\n): RenewShareSessionIfValidInput {\n  if (!isRecord(input)) throw invalidInput(\"Share session renewal input must be an object.\")\n  const now = inputDate(input.now, \"Share session renewal time\")\n  const expiresAt = inputDate(input.expiresAt, \"Requested Share session expiry\")\n  if (expiresAt.getTime() <= now.getTime()) {\n    throw invalidInput(\"Requested Share session expiry must be later than renewal time.\")\n  }\n  return {\n    projectId: identifier(input.projectId, \"Project id\"),\n    id: identifier(input.id, \"Share session id\"),\n    grantId: identifier(input.grantId, \"Share grant id\"),\n    tokenHash: sha256(input.tokenHash, \"Share session token hash\"),\n    now,\n    expiresAt,\n  }\n}\n\nexport function normalizeRevokeShareSessionInput(\n  input: RevokeShareSessionInput,\n  createdAt?: Date\n): RevokeShareSessionInput {\n  if (!isRecord(input)) throw invalidInput(\"Share session revocation input must be an object.\")\n  const normalized = {\n    projectId: identifier(input.projectId, \"Project id\"),\n    id: identifier(input.id, \"Share session id\"),\n    revokedAt: inputDate(input.revokedAt, \"Share session revocation time\"),\n  }\n  if (createdAt && normalized.revokedAt.getTime() < createdAt.getTime()) {\n    throw invalidInput(\"Share session revocation time must not precede creation time.\")\n  }\n  return normalized\n}\n\nexport function cloneShareSessionRecord(input: ShareSessionRecord): ShareSessionRecord {\n  return structuredClone(input)\n}\n\nfunction identifier(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || value.trim().length === 0 || value.includes(\"\\0\")) {\n    throw invalidInput(`${label} must be a non-empty string without NUL bytes.`)\n  }\n  return value\n}\n\nfunction sha256(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !SHA256_HEX.test(value)) {\n    throw invalidInput(`${label} must be a lowercase SHA-256 hex digest.`)\n  }\n  return value\n}\n\nfunction inputDate(value: unknown, label: string): Date {\n  if (!(value instanceof Date) || !Number.isFinite(value.getTime())) {\n    throw invalidInput(`${label} must be a valid Date.`)\n  }\n  return new Date(value)\n}\n\nfunction storedDate(value: unknown, label: string): Date {\n  const parsed =\n    value instanceof Date\n      ? new Date(value)\n      : typeof value === \"string\"\n        ? new Date(value)\n        : new Date(Number.NaN)\n  if (!Number.isFinite(parsed.getTime())) throw invalidRecord(`${label} is invalid.`)\n  return parsed\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction invalidInput(message: string, cause?: unknown): ShareSessionStorageError {\n  return new ShareSessionStorageError(\"invalid_input\", `[Sixb] ${message}`, { cause })\n}\n\nfunction invalidRecord(message: string, cause?: unknown): ShareSessionStorageError {\n  return new ShareSessionStorageError(\"invalid_record\", `[Sixb] ${message}`, { cause })\n}\n"
+  ],
+  "mappings": ";;AAGO,MAAM,iCAAiC,MAAM;AAAA,EAIvC;AAAA,EAHF,OAAO;AAAA,EAEhB,WAAW,CACA,MACT,SACA,SACA;AAAA,IACA,MAAM,SAAS,OAAO;AAAA,IAJb;AAAA;AAMb;;;ACJA,IAAM,aAAa;AAEZ,SAAS,2BAA2B,CAAC,OAAoD;AAAA,EAC9F,IAAI,CAAC,SAAS,KAAK;AAAA,IAAG,MAAM,aAAa,+CAA+C;AAAA,EACxF,MAAM,YAAY,UAAU,MAAM,WAAW,6BAA6B;AAAA,EAC1E,MAAM,YAAY,UAAU,MAAM,WAAW,iCAAiC;AAAA,EAC9E,MAAM,oBAAoB,UAAU,MAAM,mBAAmB,+BAA+B;AAAA,EAC5F,IAAI,UAAU,QAAQ,KAAK,UAAU,QAAQ,GAAG;AAAA,IAC9C,MAAM,aAAa,mEAAmE;AAAA,EACxF;AAAA,EACA,IAAI,kBAAkB,QAAQ,KAAK,UAAU,QAAQ,GAAG;AAAA,IACtD,MAAM,aAAa,iEAAiE;AAAA,EACtF;AAAA,EACA,IAAI,UAAU,QAAQ,IAAI,kBAAkB,QAAQ,GAAG;AAAA,IACrD,MAAM,aAAa,sEAAsE;AAAA,EAC3F;AAAA,EAEA,OAAO;AAAA,IACL,IAAI,WAAW,MAAM,IAAI,kBAAkB;AAAA,IAC3C,WAAW,WAAW,MAAM,WAAW,YAAY;AAAA,IACnD,SAAS,WAAW,MAAM,SAAS,gBAAgB;AAAA,IACnD,WAAW,OAAO,MAAM,WAAW,0BAA0B;AAAA,IAC7D;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA;AAGK,SAAS,uBAAuB,CAAC,OAAoC;AAAA,EAC1E,IAAI,CAAC,SAAS,KAAK;AAAA,IAAG,MAAM,cAAc,sCAAsC;AAAA,EAChF,IAAI;AAAA,IACF,MAAM,YAAY,WAAW,MAAM,WAAW,6BAA6B;AAAA,IAC3E,MAAM,YAAY,WAAW,MAAM,WAAW,iCAAiC;AAAA,IAC/E,MAAM,oBAAoB,WAAW,MAAM,mBAAmB,+BAA+B;AAAA,IAC7F,IAAI,UAAU,QAAQ,KAAK,UAAU,QAAQ,GAAG;AAAA,MAC9C,MAAM,cAAc,mEAAmE;AAAA,IACzF;AAAA,IACA,IAAI,kBAAkB,QAAQ,KAAK,UAAU,QAAQ,GAAG;AAAA,MACtD,MAAM,cAAc,iEAAiE;AAAA,IACvF;AAAA,IACA,IAAI,UAAU,QAAQ,IAAI,kBAAkB,QAAQ,GAAG;AAAA,MACrD,MAAM,cAAc,8DAA8D;AAAA,IACpF;AAAA,IAEA,MAAM,iBAAiB,MAAM;AAAA,IAC7B,IAAI,mBAAmB,MAAM;AAAA,MAC3B,MAAM,cAAc,iEAAiE;AAAA,IACvF;AAAA,IACA,MAAM,YACJ,mBAAmB,YACf,YACA,WAAW,gBAAgB,+BAA+B;AAAA,IAChE,IAAI,aAAa,UAAU,QAAQ,IAAI,UAAU,QAAQ,GAAG;AAAA,MAC1D,MAAM,cAAc,+DAA+D;AAAA,IACrF;AAAA,IAEA,OAAO;AAAA,MACL,IAAI,WAAW,MAAM,IAAI,kBAAkB;AAAA,MAC3C,WAAW,WAAW,MAAM,WAAW,YAAY;AAAA,MACnD,SAAS,WAAW,MAAM,SAAS,gBAAgB;AAAA,MACnD,WAAW,OAAO,MAAM,WAAW,0BAA0B;AAAA,MAC7D;AAAA,MACA;AAAA,MACA;AAAA,SACI,cAAc,YAAY,CAAC,IAAI,EAAE,UAAU;AAAA,IACjD;AAAA,IACA,OAAO,OAAO;AAAA,IACd,IAAI,iBAAiB,0BAA0B;AAAA,MAC7C,IAAI,MAAM,SAAS;AAAA,QAAkB,MAAM;AAAA,MAC3C,MAAM,cAAc,MAAM,QAAQ,QAAQ,cAAc,EAAE,GAAG,KAAK;AAAA,IACpE;AAAA,IACA,MAAM;AAAA;AAAA;AAIH,SAAS,iCAAiC,CAC/C,OAC0B;AAAA,EAC1B,IAAI,CAAC,SAAS,KAAK;AAAA,IAAG,MAAM,aAAa,+CAA+C;AAAA,EACxF,OAAO;AAAA,IACL,WAAW,WAAW,MAAM,WAAW,YAAY;AAAA,IACnD,IAAI,WAAW,MAAM,IAAI,kBAAkB;AAAA,EAC7C;AAAA;AAGK,SAAS,sCAAsC,CACpD,OAC+B;AAAA,EAC/B,IAAI,CAAC,SAAS,KAAK;AAAA,IAAG,MAAM,aAAa,gDAAgD;AAAA,EACzF,MAAM,MAAM,UAAU,MAAM,KAAK,4BAA4B;AAAA,EAC7D,MAAM,YAAY,UAAU,MAAM,WAAW,gCAAgC;AAAA,EAC7E,IAAI,UAAU,QAAQ,KAAK,IAAI,QAAQ,GAAG;AAAA,IACxC,MAAM,aAAa,iEAAiE;AAAA,EACtF;AAAA,EACA,OAAO;AAAA,IACL,WAAW,WAAW,MAAM,WAAW,YAAY;AAAA,IACnD,IAAI,WAAW,MAAM,IAAI,kBAAkB;AAAA,IAC3C,SAAS,WAAW,MAAM,SAAS,gBAAgB;AAAA,IACnD,WAAW,OAAO,MAAM,WAAW,0BAA0B;AAAA,IAC7D;AAAA,IACA;AAAA,EACF;AAAA;AAGK,SAAS,gCAAgC,CAC9C,OACA,WACyB;AAAA,EACzB,IAAI,CAAC,SAAS,KAAK;AAAA,IAAG,MAAM,aAAa,mDAAmD;AAAA,EAC5F,MAAM,aAAa;AAAA,IACjB,WAAW,WAAW,MAAM,WAAW,YAAY;AAAA,IACnD,IAAI,WAAW,MAAM,IAAI,kBAAkB;AAAA,IAC3C,WAAW,UAAU,MAAM,WAAW,+BAA+B;AAAA,EACvE;AAAA,EACA,IAAI,aAAa,WAAW,UAAU,QAAQ,IAAI,UAAU,QAAQ,GAAG;AAAA,IACrE,MAAM,aAAa,+DAA+D;AAAA,EACpF;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,uBAAuB,CAAC,OAA+C;AAAA,EACrF,OAAO,gBAAgB,KAAK;AAAA;AAG9B,SAAS,UAAU,CAAC,OAAgB,OAAuB;AAAA,EACzD,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,KAAK,MAAM,SAAS,MAAI,GAAG;AAAA,IAClF,MAAM,aAAa,GAAG,qDAAqD;AAAA,EAC7E;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,MAAM,CAAC,OAAgB,OAAuB;AAAA,EACrD,IAAI,OAAO,UAAU,YAAY,CAAC,WAAW,KAAK,KAAK,GAAG;AAAA,IACxD,MAAM,aAAa,GAAG,+CAA+C;AAAA,EACvE;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,SAAS,CAAC,OAAgB,OAAqB;AAAA,EACtD,IAAI,EAAE,iBAAiB,SAAS,CAAC,OAAO,SAAS,MAAM,QAAQ,CAAC,GAAG;AAAA,IACjE,MAAM,aAAa,GAAG,6BAA6B;AAAA,EACrD;AAAA,EACA,OAAO,IAAI,KAAK,KAAK;AAAA;AAGvB,SAAS,UAAU,CAAC,OAAgB,OAAqB;AAAA,EACvD,MAAM,SACJ,iBAAiB,OACb,IAAI,KAAK,KAAK,IACd,OAAO,UAAU,WACf,IAAI,KAAK,KAAK,IACd,IAAI,KAAK,OAAO,GAAG;AAAA,EAC3B,IAAI,CAAC,OAAO,SAAS,OAAO,QAAQ,CAAC;AAAA,IAAG,MAAM,cAAc,GAAG,mBAAmB;AAAA,EAClF,OAAO;AAAA;AAGT,SAAS,QAAQ,CAAC,OAAkD;AAAA,EAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA;AAG5E,SAAS,YAAY,CAAC,SAAiB,OAA2C;AAAA,EAChF,OAAO,IAAI,yBAAyB,iBAAiB,UAAU,WAAW,EAAE,MAAM,CAAC;AAAA;AAGrF,SAAS,aAAa,CAAC,SAAiB,OAA2C;AAAA,EACjF,OAAO,IAAI,yBAAyB,kBAAkB,UAAU,WAAW,EAAE,MAAM,CAAC;AAAA;",
+  "debugId": "D3828EEEA2F9B76B64756E2164756E21",
+  "names": []
+}

package/dist/{chunk-atmkaf60.js → chunk-5e3pq99w.js}

@@ -10,10 +10,6 @@ class AgentDefinitionError extends Error {
   name = "AgentDefinitionError";
 }
 
-class AgentMessageAdapterError extends Error {
-  name = "AgentMessageAdapterError";
-}
-
 class AgentToolPublicError extends Error {
   name = "AgentToolPublicError";
 }
@@ -151,6 +147,6 @@ function invalidContext(message) {
   throw new AgentRequestError("invalid_context", `[Sixb] Invalid agent context: ${message}.`);
 }
 
-export { AgentDefinitionError, AgentMessageAdapterError, AgentToolPublicError, AgentToolResultValidationError, AgentRequestError, MAX_AGENT_CONTEXT_ENTRIES, MAX_AGENT_APP_STATE_ENTRY_BYTES, MAX_AGENT_APP_STATE_TOTAL_BYTES, agentContext, agentContextIdentity, agentContextFingerprint, normalizeAgentContextEntries };
+export { AgentDefinitionError, AgentToolPublicError, AgentToolResultValidationError, AgentRequestError, MAX_AGENT_CONTEXT_ENTRIES, MAX_AGENT_APP_STATE_ENTRY_BYTES, MAX_AGENT_APP_STATE_TOTAL_BYTES, agentContext, agentContextIdentity, agentContextFingerprint, normalizeAgentContextEntries };
 
-//# debugId=0BA2036A5CD1F1D964756E2164756E21
+//# debugId=202524EF09E2878864756E2164756E21

package/dist/{chunk-atmkaf60.js.map → chunk-5e3pq99w.js.map}

@@ -2,10 +2,10 @@
   "version": 3,
   "sources": ["../src/agents/errors.ts", "../src/agents/context.ts"],
   "sourcesContent": [
-    "/**\n * Base error for the agents module. Specific subclasses extend this so callers\n * can catch any agent-scoped failure with a single `instanceof AgentDefinitionError` check.\n */\nexport class AgentDefinitionError extends Error {\n  readonly name: string = \"AgentDefinitionError\"\n}\n\n/**\n * Raised by the message adapters. `fromUiMessage` is **total**: rather than silently dropping a part it\n * cannot model, it throws this — which both prevents data loss and pinpoints exactly when the\n * {@link AgentMessage} part union must be extended. It also fires on transient/streaming parts that\n * must never be persisted, and on out-of-contract (non-JSON) payloads.\n */\nexport class AgentMessageAdapterError extends Error {\n  readonly name = \"AgentMessageAdapterError\"\n}\n\n/**\n * An agent-tool failure whose message is intentionally safe to expose to the model and persist in\n * the durable trace. Tool authors must keep the message free of credentials and internal details;\n * unknown errors remain masked by the worker.\n */\nexport class AgentToolPublicError extends Error {\n  readonly name: string = \"AgentToolPublicError\"\n}\n\n/** Raised when an agent tool result cannot cross the durable message boundary. */\nexport class AgentToolResultValidationError extends Error {\n  readonly name = \"AgentToolResultValidationError\"\n\n  constructor(\n    readonly toolName: string,\n    readonly reason: string,\n    options?: ErrorOptions\n  ) {\n    super(`[Sixb] Agent tool '${toolName}' returned an invalid result; ${reason}.`, options)\n  }\n}\n\nexport type AgentRequestErrorCode =\n  | \"agent_selector_removed\"\n  | \"agent_not_found\"\n  | \"model_not_found\"\n  | \"invalid_model_selection\"\n  | \"run_not_found\"\n  | \"run_not_retryable\"\n  | \"thread_not_found\"\n  | \"active_run_exists\"\n  | \"authority_not_inheritable\"\n  | \"invalid_context\"\n  | \"storage_unavailable\"\n\n/**\n * Raised by {@link requestAgentRun} (the trigger). Callers branch on `code` rather than message text\n * — e.g. the HTTP layer maps `active_run_exists` to 409 and `agent_not_found` to 404.\n */\nexport class AgentRequestError extends Error {\n  readonly name = \"AgentRequestError\"\n\n  constructor(\n    readonly code: AgentRequestErrorCode,\n    message: string\n  ) {\n    super(message)\n  }\n}\n",
+    "/**\n * Base error for the agents module. Specific subclasses extend this so callers\n * can catch any agent-scoped failure with a single `instanceof AgentDefinitionError` check.\n */\nexport class AgentDefinitionError extends Error {\n  readonly name: string = \"AgentDefinitionError\"\n}\n\n/**\n * An agent-tool failure whose message is intentionally safe to expose to the model and persist in\n * the durable trace. Tool authors must keep the message free of credentials and internal details;\n * unknown errors remain masked by the worker.\n */\nexport class AgentToolPublicError extends Error {\n  readonly name: string = \"AgentToolPublicError\"\n}\n\n/** Raised when an agent tool result cannot cross the durable message boundary. */\nexport class AgentToolResultValidationError extends Error {\n  readonly name = \"AgentToolResultValidationError\"\n\n  constructor(\n    readonly toolName: string,\n    readonly reason: string,\n    options?: ErrorOptions\n  ) {\n    super(`[Sixb] Agent tool '${toolName}' returned an invalid result; ${reason}.`, options)\n  }\n}\n\nexport type AgentRequestErrorCode =\n  | \"agent_selector_removed\"\n  | \"agent_not_found\"\n  | \"model_not_found\"\n  | \"invalid_model_selection\"\n  | \"run_not_found\"\n  | \"run_not_retryable\"\n  | \"thread_not_found\"\n  | \"active_run_exists\"\n  | \"authority_not_inheritable\"\n  | \"invalid_context\"\n  | \"storage_unavailable\"\n\n/**\n * Raised by {@link requestAgentRun} (the trigger). Callers branch on `code` rather than message text\n * — e.g. the HTTP layer maps `active_run_exists` to 409 and `agent_not_found` to 404.\n */\nexport class AgentRequestError extends Error {\n  readonly name = \"AgentRequestError\"\n\n  constructor(\n    readonly code: AgentRequestErrorCode,\n    message: string\n  ) {\n    super(message)\n  }\n}\n",
     "import type { JsonValue } from \"../json\"\nimport { cloneJsonValue, getInvalidJsonValueReason, stableJsonStringify } from \"../json\"\nimport type { ObjectRef } from \"../ontology/refs\"\nimport { AgentRequestError } from \"./errors\"\n\nexport type AgentContextInput =\n  | { readonly kind: \"object\"; readonly ref: ObjectRef }\n  | {\n      readonly kind: \"app-state\"\n      readonly id: string\n      readonly label: string\n      readonly description: string\n      readonly value: JsonValue\n    }\n\nexport type AgentContextOrigin = \"ambient\" | \"explicit\"\n\nexport interface AgentContextEntryInput {\n  readonly context: AgentContextInput\n  readonly origin: AgentContextOrigin\n}\n\n/** Durable user-message part. Origin is display provenance, never an authorization grant. */\nexport interface AgentContextPart extends AgentContextEntryInput {\n  readonly type: \"context\"\n}\n\nexport const MAX_AGENT_CONTEXT_ENTRIES = 12\nexport const MAX_AGENT_APP_STATE_ENTRY_BYTES = 16 * 1024\nexport const MAX_AGENT_APP_STATE_TOTAL_BYTES = 64 * 1024\n\n/** Typed constructors for context values shared by custom apps and agent clients. */\nexport const agentContext = {\n  object<const TObjectTypeId extends string>(\n    objectType: { readonly id: TObjectTypeId },\n    primaryId: string\n  ) {\n    return {\n      kind: \"object\" as const,\n      ref: { objectTypeId: objectType.id, primaryId },\n    }\n  },\n\n  appState<const TValue extends JsonValue>(\n    id: string,\n    input: {\n      readonly label: string\n      readonly description: string\n      readonly value: TValue\n    }\n  ) {\n    return { kind: \"app-state\" as const, id, ...input }\n  },\n}\n\n/** Stable identity shared by core deduplication and context-aware clients. */\nexport function agentContextIdentity(context: AgentContextInput): string {\n  return context.kind === \"object\"\n    ? `object:${encodeURIComponent(context.ref.objectTypeId)}:${encodeURIComponent(context.ref.primaryId)}`\n    : `app-state:${encodeURIComponent(context.id)}`\n}\n\n/** Stable semantic key for client-side comparisons. */\nexport function agentContextFingerprint(context: AgentContextInput): string {\n  return stableJsonStringify(context)\n}\n\n/**\n * Validate transport-independent context rules and clone mutable app state before it can become\n * durable. Object existence and visibility are resolved separately because they require a runtime.\n */\nexport function normalizeAgentContextEntries(\n  input: readonly AgentContextEntryInput[] | undefined\n): readonly AgentContextEntryInput[] {\n  if (input === undefined) return []\n  if (!Array.isArray(input)) invalidContext(\"context must be an array\")\n  if (input.length > MAX_AGENT_CONTEXT_ENTRIES) {\n    invalidContext(`context cannot contain more than ${MAX_AGENT_CONTEXT_ENTRIES} entries`)\n  }\n\n  const entries: AgentContextEntryInput[] = []\n  const byIdentity = new Map<string, string>()\n  let totalAppStateBytes = 0\n\n  for (const [index, rawEntry] of input.entries()) {\n    const entry = normalizeEntry(rawEntry, index)\n    const identity = agentContextIdentity(entry.context)\n    const serialized = stableJsonStringify(entry)\n    const existing = byIdentity.get(identity)\n\n    if (existing !== undefined) {\n      if (existing === serialized) continue\n      invalidContext(`context contains conflicting entries for '${identity}'`)\n    }\n\n    if (entry.context.kind === \"app-state\") {\n      const bytes = utf8ByteLength(serialized)\n      if (bytes > MAX_AGENT_APP_STATE_ENTRY_BYTES) {\n        invalidContext(\n          `context entry '${identity}' exceeds the ${MAX_AGENT_APP_STATE_ENTRY_BYTES}-byte limit`\n        )\n      }\n      totalAppStateBytes += bytes\n      if (totalAppStateBytes > MAX_AGENT_APP_STATE_TOTAL_BYTES) {\n        invalidContext(\n          `app-state context exceeds the ${MAX_AGENT_APP_STATE_TOTAL_BYTES}-byte message limit`\n        )\n      }\n    }\n\n    byIdentity.set(identity, serialized)\n    entries.push(entry)\n  }\n\n  return entries\n}\n\nfunction normalizeEntry(rawEntry: unknown, index: number): AgentContextEntryInput {\n  if (!isRecord(rawEntry)) invalidContext(`context[${index}] must be an object`)\n  if (rawEntry.origin !== \"ambient\" && rawEntry.origin !== \"explicit\") {\n    invalidContext(`context[${index}].origin must be 'ambient' or 'explicit'`)\n  }\n  if (!isRecord(rawEntry.context)) invalidContext(`context[${index}].context must be an object`)\n\n  const context = rawEntry.context\n  if (context.kind === \"object\") {\n    if (!isRecord(context.ref)) invalidContext(`context[${index}].context.ref must be an object`)\n    const objectTypeId = requireNonEmptyString(\n      context.ref.objectTypeId,\n      `context[${index}].context.ref.objectTypeId`\n    )\n    const primaryId = requireNonEmptyString(\n      context.ref.primaryId,\n      `context[${index}].context.ref.primaryId`\n    )\n    return {\n      context: { kind: \"object\", ref: { objectTypeId, primaryId } },\n      origin: rawEntry.origin,\n    }\n  }\n\n  if (context.kind === \"app-state\") {\n    const id = requireNonEmptyString(context.id, `context[${index}].context.id`)\n    const label = requireNonEmptyString(context.label, `context[${index}].context.label`)\n    const description = requireNonEmptyString(\n      context.description,\n      `context[${index}].context.description`\n    )\n    const reason = getInvalidJsonValueReason(context.value, `context[${index}].context.value`)\n    if (reason) {\n      invalidContext(`context[${index}].context.value must be a JSON value; ${reason}`)\n    }\n    return {\n      context: {\n        kind: \"app-state\",\n        id,\n        label,\n        description,\n        value: cloneJsonValue(context.value as JsonValue),\n      },\n      origin: rawEntry.origin,\n    }\n  }\n\n  invalidContext(`context[${index}].context.kind must be 'object' or 'app-state'`)\n}\n\nfunction requireNonEmptyString(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || value.trim().length === 0) {\n    invalidContext(`${label} must be a non-empty string`)\n  }\n  return value\n}\n\nfunction utf8ByteLength(value: string): number {\n  return new TextEncoder().encode(value).byteLength\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction invalidContext(message: string): never {\n  throw new AgentRequestError(\"invalid_context\", `[Sixb] Invalid agent context: ${message}.`)\n}\n"
   ],
-  "mappings": ";;;;;;;;AAIO,MAAM,6BAA6B,MAAM;AAAA,EACrC,OAAe;AAC1B;AAAA;AAQO,MAAM,iCAAiC,MAAM;AAAA,EACzC,OAAO;AAClB;AAAA;AAOO,MAAM,6BAA6B,MAAM;AAAA,EACrC,OAAe;AAC1B;AAAA;AAGO,MAAM,uCAAuC,MAAM;AAAA,EAI7C;AAAA,EACA;AAAA,EAJF,OAAO;AAAA,EAEhB,WAAW,CACA,UACA,QACT,SACA;AAAA,IACA,MAAM,sBAAsB,yCAAyC,WAAW,OAAO;AAAA,IAJ9E;AAAA,IACA;AAAA;AAKb;AAAA;AAmBO,MAAM,0BAA0B,MAAM;AAAA,EAIhC;AAAA,EAHF,OAAO;AAAA,EAEhB,WAAW,CACA,MACT,SACA;AAAA,IACA,MAAM,OAAO;AAAA,IAHJ;AAAA;AAKb;;;ACvCO,IAAM,4BAA4B;AAClC,IAAM,kCAAkC,KAAK;AAC7C,IAAM,kCAAkC,KAAK;AAG7C,IAAM,eAAe;AAAA,EAC1B,MAA0C,CACxC,YACA,WACA;AAAA,IACA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,KAAK,EAAE,cAAc,WAAW,IAAI,UAAU;AAAA,IAChD;AAAA;AAAA,EAGF,QAAwC,CACtC,IACA,OAKA;AAAA,IACA,OAAO,EAAE,MAAM,aAAsB,OAAO,MAAM;AAAA;AAEtD;AAGO,SAAS,oBAAoB,CAAC,SAAoC;AAAA,EACvE,OAAO,QAAQ,SAAS,WACpB,UAAU,mBAAmB,QAAQ,IAAI,YAAY,KAAK,mBAAmB,QAAQ,IAAI,SAAS,MAClG,aAAa,mBAAmB,QAAQ,EAAE;AAAA;AAIzC,SAAS,uBAAuB,CAAC,SAAoC;AAAA,EAC1E,OAAO,oBAAoB,OAAO;AAAA;AAO7B,SAAS,4BAA4B,CAC1C,OACmC;AAAA,EACnC,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,CAAC,MAAM,QAAQ,KAAK;AAAA,IAAG,eAAe,0BAA0B;AAAA,EACpE,IAAI,MAAM,SAAS,2BAA2B;AAAA,IAC5C,eAAe,oCAAoC,mCAAmC;AAAA,EACxF;AAAA,EAEA,MAAM,UAAoC,CAAC;AAAA,EAC3C,MAAM,aAAa,IAAI;AAAA,EACvB,IAAI,qBAAqB;AAAA,EAEzB,YAAY,OAAO,aAAa,MAAM,QAAQ,GAAG;AAAA,IAC/C,MAAM,QAAQ,eAAe,UAAU,KAAK;AAAA,IAC5C,MAAM,WAAW,qBAAqB,MAAM,OAAO;AAAA,IACnD,MAAM,aAAa,oBAAoB,KAAK;AAAA,IAC5C,MAAM,WAAW,WAAW,IAAI,QAAQ;AAAA,IAExC,IAAI,aAAa,WAAW;AAAA,MAC1B,IAAI,aAAa;AAAA,QAAY;AAAA,MAC7B,eAAe,6CAA6C,WAAW;AAAA,IACzE;AAAA,IAEA,IAAI,MAAM,QAAQ,SAAS,aAAa;AAAA,MACtC,MAAM,QAAQ,eAAe,UAAU;AAAA,MACvC,IAAI,QAAQ,iCAAiC;AAAA,QAC3C,eACE,kBAAkB,yBAAyB,4CAC7C;AAAA,MACF;AAAA,MACA,sBAAsB;AAAA,MACtB,IAAI,qBAAqB,iCAAiC;AAAA,QACxD,eACE,iCAAiC,oDACnC;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,IAAI,UAAU,UAAU;AAAA,IACnC,QAAQ,KAAK,KAAK;AAAA,EACpB;AAAA,EAEA,OAAO;AAAA;AAGT,SAAS,cAAc,CAAC,UAAmB,OAAuC;AAAA,EAChF,IAAI,CAAC,SAAS,QAAQ;AAAA,IAAG,eAAe,WAAW,0BAA0B;AAAA,EAC7E,IAAI,SAAS,WAAW,aAAa,SAAS,WAAW,YAAY;AAAA,IACnE,eAAe,WAAW,+CAA+C;AAAA,EAC3E;AAAA,EACA,IAAI,CAAC,SAAS,SAAS,OAAO;AAAA,IAAG,eAAe,WAAW,kCAAkC;AAAA,EAE7F,MAAM,UAAU,SAAS;AAAA,EACzB,IAAI,QAAQ,SAAS,UAAU;AAAA,IAC7B,IAAI,CAAC,SAAS,QAAQ,GAAG;AAAA,MAAG,eAAe,WAAW,sCAAsC;AAAA,IAC5F,MAAM,eAAe,sBACnB,QAAQ,IAAI,cACZ,WAAW,iCACb;AAAA,IACA,MAAM,YAAY,sBAChB,QAAQ,IAAI,WACZ,WAAW,8BACb;AAAA,IACA,OAAO;AAAA,MACL,SAAS,EAAE,MAAM,UAAU,KAAK,EAAE,cAAc,UAAU,EAAE;AAAA,MAC5D,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,IAAI,QAAQ,SAAS,aAAa;AAAA,IAChC,MAAM,KAAK,sBAAsB,QAAQ,IAAI,WAAW,mBAAmB;AAAA,IAC3E,MAAM,QAAQ,sBAAsB,QAAQ,OAAO,WAAW,sBAAsB;AAAA,IACpF,MAAM,cAAc,sBAClB,QAAQ,aACR,WAAW,4BACb;AAAA,IACA,MAAM,SAAS,0BAA0B,QAAQ,OAAO,WAAW,sBAAsB;AAAA,IACzF,IAAI,QAAQ;AAAA,MACV,eAAe,WAAW,8CAA8C,QAAQ;AAAA,IAClF;AAAA,IACA,OAAO;AAAA,MACL,SAAS;AAAA,QACP,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,eAAe,QAAQ,KAAkB;AAAA,MAClD;AAAA,MACA,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,eAAe,WAAW,qDAAqD;AAAA;AAGjF,SAAS,qBAAqB,CAAC,OAAgB,OAAuB;AAAA,EACpE,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAAA,IAC1D,eAAe,GAAG,kCAAkC;AAAA,EACtD;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,cAAc,CAAC,OAAuB;AAAA,EAC7C,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AAAA;AAGzC,SAAS,QAAQ,CAAC,OAAkD;AAAA,EAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA;AAG5E,SAAS,cAAc,CAAC,SAAwB;AAAA,EAC9C,MAAM,IAAI,kBAAkB,mBAAmB,iCAAiC,UAAU;AAAA;",
-  "debugId": "0BA2036A5CD1F1D964756E2164756E21",
+  "mappings": ";;;;;;;;AAIO,MAAM,6BAA6B,MAAM;AAAA,EACrC,OAAe;AAC1B;AAAA;AAOO,MAAM,6BAA6B,MAAM;AAAA,EACrC,OAAe;AAC1B;AAAA;AAGO,MAAM,uCAAuC,MAAM;AAAA,EAI7C;AAAA,EACA;AAAA,EAJF,OAAO;AAAA,EAEhB,WAAW,CACA,UACA,QACT,SACA;AAAA,IACA,MAAM,sBAAsB,yCAAyC,WAAW,OAAO;AAAA,IAJ9E;AAAA,IACA;AAAA;AAKb;AAAA;AAmBO,MAAM,0BAA0B,MAAM;AAAA,EAIhC;AAAA,EAHF,OAAO;AAAA,EAEhB,WAAW,CACA,MACT,SACA;AAAA,IACA,MAAM,OAAO;AAAA,IAHJ;AAAA;AAKb;;;AC7BO,IAAM,4BAA4B;AAClC,IAAM,kCAAkC,KAAK;AAC7C,IAAM,kCAAkC,KAAK;AAG7C,IAAM,eAAe;AAAA,EAC1B,MAA0C,CACxC,YACA,WACA;AAAA,IACA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,KAAK,EAAE,cAAc,WAAW,IAAI,UAAU;AAAA,IAChD;AAAA;AAAA,EAGF,QAAwC,CACtC,IACA,OAKA;AAAA,IACA,OAAO,EAAE,MAAM,aAAsB,OAAO,MAAM;AAAA;AAEtD;AAGO,SAAS,oBAAoB,CAAC,SAAoC;AAAA,EACvE,OAAO,QAAQ,SAAS,WACpB,UAAU,mBAAmB,QAAQ,IAAI,YAAY,KAAK,mBAAmB,QAAQ,IAAI,SAAS,MAClG,aAAa,mBAAmB,QAAQ,EAAE;AAAA;AAIzC,SAAS,uBAAuB,CAAC,SAAoC;AAAA,EAC1E,OAAO,oBAAoB,OAAO;AAAA;AAO7B,SAAS,4BAA4B,CAC1C,OACmC;AAAA,EACnC,IAAI,UAAU;AAAA,IAAW,OAAO,CAAC;AAAA,EACjC,IAAI,CAAC,MAAM,QAAQ,KAAK;AAAA,IAAG,eAAe,0BAA0B;AAAA,EACpE,IAAI,MAAM,SAAS,2BAA2B;AAAA,IAC5C,eAAe,oCAAoC,mCAAmC;AAAA,EACxF;AAAA,EAEA,MAAM,UAAoC,CAAC;AAAA,EAC3C,MAAM,aAAa,IAAI;AAAA,EACvB,IAAI,qBAAqB;AAAA,EAEzB,YAAY,OAAO,aAAa,MAAM,QAAQ,GAAG;AAAA,IAC/C,MAAM,QAAQ,eAAe,UAAU,KAAK;AAAA,IAC5C,MAAM,WAAW,qBAAqB,MAAM,OAAO;AAAA,IACnD,MAAM,aAAa,oBAAoB,KAAK;AAAA,IAC5C,MAAM,WAAW,WAAW,IAAI,QAAQ;AAAA,IAExC,IAAI,aAAa,WAAW;AAAA,MAC1B,IAAI,aAAa;AAAA,QAAY;AAAA,MAC7B,eAAe,6CAA6C,WAAW;AAAA,IACzE;AAAA,IAEA,IAAI,MAAM,QAAQ,SAAS,aAAa;AAAA,MACtC,MAAM,QAAQ,eAAe,UAAU;AAAA,MACvC,IAAI,QAAQ,iCAAiC;AAAA,QAC3C,eACE,kBAAkB,yBAAyB,4CAC7C;AAAA,MACF;AAAA,MACA,sBAAsB;AAAA,MACtB,IAAI,qBAAqB,iCAAiC;AAAA,QACxD,eACE,iCAAiC,oDACnC;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,IAAI,UAAU,UAAU;AAAA,IACnC,QAAQ,KAAK,KAAK;AAAA,EACpB;AAAA,EAEA,OAAO;AAAA;AAGT,SAAS,cAAc,CAAC,UAAmB,OAAuC;AAAA,EAChF,IAAI,CAAC,SAAS,QAAQ;AAAA,IAAG,eAAe,WAAW,0BAA0B;AAAA,EAC7E,IAAI,SAAS,WAAW,aAAa,SAAS,WAAW,YAAY;AAAA,IACnE,eAAe,WAAW,+CAA+C;AAAA,EAC3E;AAAA,EACA,IAAI,CAAC,SAAS,SAAS,OAAO;AAAA,IAAG,eAAe,WAAW,kCAAkC;AAAA,EAE7F,MAAM,UAAU,SAAS;AAAA,EACzB,IAAI,QAAQ,SAAS,UAAU;AAAA,IAC7B,IAAI,CAAC,SAAS,QAAQ,GAAG;AAAA,MAAG,eAAe,WAAW,sCAAsC;AAAA,IAC5F,MAAM,eAAe,sBACnB,QAAQ,IAAI,cACZ,WAAW,iCACb;AAAA,IACA,MAAM,YAAY,sBAChB,QAAQ,IAAI,WACZ,WAAW,8BACb;AAAA,IACA,OAAO;AAAA,MACL,SAAS,EAAE,MAAM,UAAU,KAAK,EAAE,cAAc,UAAU,EAAE;AAAA,MAC5D,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,IAAI,QAAQ,SAAS,aAAa;AAAA,IAChC,MAAM,KAAK,sBAAsB,QAAQ,IAAI,WAAW,mBAAmB;AAAA,IAC3E,MAAM,QAAQ,sBAAsB,QAAQ,OAAO,WAAW,sBAAsB;AAAA,IACpF,MAAM,cAAc,sBAClB,QAAQ,aACR,WAAW,4BACb;AAAA,IACA,MAAM,SAAS,0BAA0B,QAAQ,OAAO,WAAW,sBAAsB;AAAA,IACzF,IAAI,QAAQ;AAAA,MACV,eAAe,WAAW,8CAA8C,QAAQ;AAAA,IAClF;AAAA,IACA,OAAO;AAAA,MACL,SAAS;AAAA,QACP,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,eAAe,QAAQ,KAAkB;AAAA,MAClD;AAAA,MACA,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,eAAe,WAAW,qDAAqD;AAAA;AAGjF,SAAS,qBAAqB,CAAC,OAAgB,OAAuB;AAAA,EACpE,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAAA,IAC1D,eAAe,GAAG,kCAAkC;AAAA,EACtD;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,cAAc,CAAC,OAAuB;AAAA,EAC7C,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE;AAAA;AAGzC,SAAS,QAAQ,CAAC,OAAkD;AAAA,EAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA;AAG5E,SAAS,cAAc,CAAC,SAAwB;AAAA,EAC9C,MAAM,IAAI,kBAAkB,mBAAmB,iCAAiC,UAAU;AAAA;",
+  "debugId": "202524EF09E2878864756E2164756E21",
   "names": []
 }

package/dist/{chunk-agsvg9ar.js → chunk-5ntny1qx.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   findPrimitiveRunExecution
-} from "./chunk-3kv70xwp.js";
+} from "./chunk-j1sbhm7p.js";
 
 // src/storage/webhook-runs/errors.ts
 class WebhookRunError extends Error {

package/dist/{chunk-z2sery1b.js → chunk-9nbmsvn5.js}

@@ -78,68 +78,98 @@ var SIXB_API_ROUTES = [
     accessToken: true,
     agentApi: false
   },
+  {
+    operationId: "issueSharedAccessGrant",
+    method: "POST",
+    path: "/api/share-grants",
+    accessToken: true,
+    agentApi: false
+  },
+  {
+    operationId: "listSharedAccessGrants",
+    method: "GET",
+    path: "/api/share-grants",
+    accessToken: true,
+    agentApi: false
+  },
+  {
+    operationId: "revokeSharedAccessGrant",
+    method: "DELETE",
+    path: "/api/share-grants/:grantId",
+    accessToken: true,
+    agentApi: false
+  },
   {
     operationId: "listObjectTypes",
     method: "GET",
     path: "/api/object-types",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "getObjectType",
     method: "GET",
     path: "/api/object-types/:objectTypeId",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "listObjects",
     method: "GET",
     path: "/api/objects",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "queryObjects",
     method: "POST",
     path: "/api/objects/query",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "queryObjectLinks",
     method: "POST",
     path: "/api/objects/query/links",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "countObjects",
     method: "POST",
     path: "/api/objects/query/count",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "existsObjects",
     method: "POST",
     path: "/api/objects/query/exists",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "facetObjects",
     method: "POST",
     path: "/api/objects/query/facets",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "getObject",
     method: "GET",
     path: "/api/objects/:objectTypeId/:objectId",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "upsertObject",
@@ -174,56 +204,64 @@ var SIXB_API_ROUTES = [
     method: "POST",
     path: "/api/telemetry/history",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "getTelemetryHistory",
     method: "GET",
     path: "/api/objects/:objectTypeId/:objectId/telemetry/:propertyId/history",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "getLatestTelemetry",
     method: "GET",
     path: "/api/objects/:objectTypeId/:objectId/telemetry/:propertyId/latest",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "getObjectFileContent",
     method: "GET",
     path: "/api/objects/:objectTypeId/:objectId/files/content",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "headObjectFileContent",
     method: "HEAD",
     path: "/api/objects/:objectTypeId/:objectId/files/content",
     accessToken: true,
-    agentApi: false
+    agentApi: false,
+    sharedSession: true
   },
   {
     operationId: "listActions",
     method: "GET",
     path: "/api/actions",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "getAction",
     method: "GET",
     path: "/api/actions/:actionId",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "requestAction",
     method: "POST",
     path: "/api/actions/:actionId",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "uploadFileRaw",
@@ -244,7 +282,8 @@ var SIXB_API_ROUTES = [
     method: "GET",
     path: "/api/action-runs/:runId",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "getActionRunFileContent",
@@ -356,7 +395,8 @@ var SIXB_API_ROUTES = [
     method: "GET",
     path: "/api/objects/search",
     accessToken: true,
-    agentApi: true
+    agentApi: true,
+    sharedSession: true
   },
   {
     operationId: "listEvents",
@@ -468,4 +508,4 @@ function normalizeRoutePath(pathname) {
 
 export { SIXB_API_ROUTES, pathSegmentsFor, matchesPathPattern, normalizeRoutePath };
 
-//# debugId=41C2B1BD60423DB364756E2164756E21
+//# debugId=27FCBA73C4A04A7064756E2164756E21

package/dist/chunk-9nbmsvn5.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/http/api-routes.ts", "../src/http/route-pattern.ts"],
+  "sourcesContent": [
+    "/**\n * The single source of truth for the Sixb HTTP API surface and its auth capabilities.\n *\n * Two views are derived from this one table:\n * - `AGENT_API_ROUTES` (@sixb/core agent gateway) = the `agentApi` rows, projected to {method, path}.\n * - `ACCESS_TOKEN_ROUTES` (@sixb/server bearer boundary) = the `accessToken` rows, with operationId.\n *\n * Because both views are projections of this table, the agent gateway allow-list is structurally a\n * subset of the bearer boundary — the invariant below enforces `agentApi ⇒ accessToken` at load\n * time. This table lives in @sixb/core (never @sixb/server) because @sixb/server depends on core,\n * not the reverse; the operationId strings are opaque here.\n */\nexport interface SixbApiRoute {\n  /** OpenAPI operationId — the server keys its bearer security requirement off this. */\n  readonly operationId: string\n  readonly method: string\n  readonly path: string\n  /** The route accepts a bearer access token (enforced by the server access-token boundary). */\n  readonly accessToken: boolean\n  /** The route is proxied by the agent API gateway (a strict subset of the accessToken routes). */\n  readonly agentApi: boolean\n  /** The canonical handler may run under an explicitly selected shared session. */\n  readonly sharedSession?: boolean\n}\n\nexport const SIXB_API_ROUTES: readonly SixbApiRoute[] = [\n  {\n    operationId: \"getProjectInfo\",\n    method: \"GET\",\n    path: \"/api/project\",\n    accessToken: true,\n    agentApi: true,\n  },\n  // Token and service-account management is bearer-capable so the CLI can authenticate with a\n  // personal access token. It is NOT exposed to agents. The runtime still confines every operation\n  // to the caller's own groups, and service-account tokens are rejected (only user principals may\n  // manage credentials).\n  {\n    operationId: \"getAuthAccessManagementOptions\",\n    method: \"GET\",\n    path: \"/api/auth/access-management-options\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAuthAccessTokens\",\n    method: \"GET\",\n    path: \"/api/auth/access-tokens\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"createAuthPersonalAccessToken\",\n    method: \"POST\",\n    path: \"/api/auth/access-tokens\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"revokeAuthAccessToken\",\n    method: \"POST\",\n    path: \"/api/auth/access-tokens/:tokenId/revoke\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAuthServiceAccounts\",\n    method: \"GET\",\n    path: \"/api/auth/service-accounts\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"createAuthServiceAccount\",\n    method: \"POST\",\n    path: \"/api/auth/service-accounts\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"disableAuthServiceAccount\",\n    method: \"POST\",\n    path: \"/api/auth/service-accounts/:serviceAccountId/disable\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAuthServiceAccountAccessTokens\",\n    method: \"GET\",\n    path: \"/api/auth/service-accounts/:serviceAccountId/access-tokens\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"createAuthServiceAccountAccessToken\",\n    method: \"POST\",\n    path: \"/api/auth/service-accounts/:serviceAccountId/access-tokens\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"revokeAuthServiceAccountAccessToken\",\n    method: \"POST\",\n    path: \"/api/auth/service-accounts/:serviceAccountId/access-tokens/:tokenId/revoke\",\n    accessToken: true,\n    agentApi: false,\n  },\n  // Share lifecycle management is bearer-capable for programmatic administration but never\n  // agent-proxied. Shared sessions themselves use the canonical object/action routes and land in\n  // the request boundary separately.\n  {\n    operationId: \"issueSharedAccessGrant\",\n    method: \"POST\",\n    path: \"/api/share-grants\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listSharedAccessGrants\",\n    method: \"GET\",\n    path: \"/api/share-grants\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"revokeSharedAccessGrant\",\n    method: \"DELETE\",\n    path: \"/api/share-grants/:grantId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listObjectTypes\",\n    method: \"GET\",\n    path: \"/api/object-types\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"getObjectType\",\n    method: \"GET\",\n    path: \"/api/object-types/:objectTypeId\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"listObjects\",\n    method: \"GET\",\n    path: \"/api/objects\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"queryObjects\",\n    method: \"POST\",\n    path: \"/api/objects/query\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"queryObjectLinks\",\n    method: \"POST\",\n    path: \"/api/objects/query/links\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"countObjects\",\n    method: \"POST\",\n    path: \"/api/objects/query/count\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"existsObjects\",\n    method: \"POST\",\n    path: \"/api/objects/query/exists\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"facetObjects\",\n    method: \"POST\",\n    path: \"/api/objects/query/facets\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"getObject\",\n    method: \"GET\",\n    path: \"/api/objects/:objectTypeId/:objectId\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  // The four write routes. Bearer-capable because their execution facade enforces authorization\n  // (`edit:object` / `append:telemetry`), which is exactly the precondition this table requires.\n  // NOT agent-proxied: letting an agent turn write objects on its own is a separate decision, and\n  // the gateway already hands routes an execution SDK, so flipping `agentApi` later needs no\n  // authorization work — only that decision.\n  {\n    operationId: \"upsertObject\",\n    method: \"PUT\",\n    path: \"/api/objects/:objectTypeId/:objectId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"upsertObjectLink\",\n    method: \"PUT\",\n    path: \"/api/objects/:objectTypeId/:objectId/links/:linkId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"removeObjectLink\",\n    method: \"DELETE\",\n    path: \"/api/objects/:objectTypeId/:objectId/links/:linkId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"appendTelemetry\",\n    method: \"POST\",\n    path: \"/api/objects/:objectTypeId/:objectId/telemetry/:propertyId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getBulkTelemetryHistory\",\n    method: \"POST\",\n    path: \"/api/telemetry/history\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"getTelemetryHistory\",\n    method: \"GET\",\n    path: \"/api/objects/:objectTypeId/:objectId/telemetry/:propertyId/history\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"getLatestTelemetry\",\n    method: \"GET\",\n    path: \"/api/objects/:objectTypeId/:objectId/telemetry/:propertyId/latest\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"getObjectFileContent\",\n    method: \"GET\",\n    path: \"/api/objects/:objectTypeId/:objectId/files/content\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    // Bearer-capable (CLI/programmatic existence + range probes) but NOT agent-proxied: the agent\n    // API gateway only forwards GET/POST, and an agent gains nothing from HEAD over GET (a file's\n    // size already travels in its FileRef). Keeping this agentApi:true would throw at gateway\n    // registration (\"Unsupported agent API gateway method 'HEAD'\") and stop the server booting.\n    operationId: \"headObjectFileContent\",\n    method: \"HEAD\",\n    path: \"/api/objects/:objectTypeId/:objectId/files/content\",\n    accessToken: true,\n    agentApi: false,\n    sharedSession: true,\n  },\n  {\n    operationId: \"listActions\",\n    method: \"GET\",\n    path: \"/api/actions\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"getAction\",\n    method: \"GET\",\n    path: \"/api/actions/:actionId\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"requestAction\",\n    method: \"POST\",\n    path: \"/api/actions/:actionId\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"uploadFileRaw\",\n    method: \"POST\",\n    path: \"/api/files\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"listActionRuns\",\n    method: \"GET\",\n    path: \"/api/action-runs\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getActionRun\",\n    method: \"GET\",\n    path: \"/api/action-runs/:runId\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"getActionRunFileContent\",\n    method: \"GET\",\n    path: \"/api/action-runs/:runId/files/content\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"headActionRunFileContent\",\n    method: \"HEAD\",\n    path: \"/api/action-runs/:runId/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listWorkflows\",\n    method: \"GET\",\n    path: \"/api/workflows\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getWorkflow\",\n    method: \"GET\",\n    path: \"/api/workflows/:workflowId\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"requestWorkflowRun\",\n    method: \"POST\",\n    path: \"/api/workflows/:workflowId/runs\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"listWorkflowRuns\",\n    method: \"GET\",\n    path: \"/api/workflow-runs\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"getWorkflowRun\",\n    method: \"GET\",\n    path: \"/api/workflow-runs/:runId\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"cancelWorkflowRun\",\n    method: \"POST\",\n    path: \"/api/workflow-runs/:runId/cancel\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getWorkflowAgentNodeExecution\",\n    method: \"GET\",\n    path: \"/api/workflow-runs/:runId/nodes/:nodeKey/agent-execution\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getWorkflowRunFileContent\",\n    method: \"GET\",\n    path: \"/api/workflow-runs/:runId/files/content\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"headWorkflowRunFileContent\",\n    method: \"HEAD\",\n    path: \"/api/workflow-runs/:runId/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getWorkflowNodeRunFileContent\",\n    method: \"GET\",\n    path: \"/api/workflow-runs/:runId/nodes/:nodeKey/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"headWorkflowNodeRunFileContent\",\n    method: \"HEAD\",\n    path: \"/api/workflow-runs/:runId/nodes/:nodeKey/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getAgentMessageFileContent\",\n    method: \"GET\",\n    path: \"/api/agent-threads/:threadId/messages/:messageId/files/content\",\n    accessToken: true,\n    agentApi: true,\n  },\n  {\n    operationId: \"headAgentMessageFileContent\",\n    method: \"HEAD\",\n    path: \"/api/agent-threads/:threadId/messages/:messageId/files/content\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"searchObjects\",\n    method: \"GET\",\n    path: \"/api/objects/search\",\n    accessToken: true,\n    agentApi: true,\n    sharedSession: true,\n  },\n  {\n    operationId: \"listEvents\",\n    method: \"GET\",\n    path: \"/api/events\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listLogs\",\n    method: \"GET\",\n    path: \"/api/logs\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getAiAccountingOverview\",\n    method: \"GET\",\n    path: \"/api/ai/accounting/overview\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAiModelCalls\",\n    method: \"GET\",\n    path: \"/api/ai/model-calls\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAiModelCallGroups\",\n    method: \"GET\",\n    path: \"/api/ai/model-call-groups\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"listAiLimitPolicies\",\n    method: \"GET\",\n    path: \"/api/ai/limits\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getAiLimitStatus\",\n    method: \"GET\",\n    path: \"/api/ai/limits/status\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"getAiLimitSubjectOptions\",\n    method: \"GET\",\n    path: \"/api/ai/limits/subjects\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"createAiLimitPolicy\",\n    method: \"POST\",\n    path: \"/api/ai/limits\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"updateAiLimitPolicy\",\n    method: \"PUT\",\n    path: \"/api/ai/limits/:limitId\",\n    accessToken: true,\n    agentApi: false,\n  },\n  {\n    operationId: \"deleteAiLimitPolicy\",\n    method: \"DELETE\",\n    path: \"/api/ai/limits/:limitId\",\n    accessToken: true,\n    agentApi: false,\n  },\n]\n\n// Enforce the subset invariant at module load: a gateway-proxied route must also be a bearer route,\n// or the gateway would expose a surface the access-token boundary does not recognize.\nfor (const route of SIXB_API_ROUTES) {\n  if (route.agentApi && !route.accessToken) {\n    throw new Error(\n      `[Sixb] agent API route '${route.method} ${route.path}' must also be an access-token route.`\n    )\n  }\n}\n",
+    "/**\n * Shared HTTP route-pattern matching. Used by both the agent API gateway allow-list (@sixb/core)\n * and the server's access-token boundary (@sixb/server) so the two never drift.\n */\n\n/** Split a path into its non-empty segments (drops leading/trailing/empty parts). */\nexport function pathSegmentsFor(pathname: string): string[] {\n  return pathname.split(\"/\").filter(Boolean)\n}\n\n/**\n * Match a concrete pathname against a route pattern. A `:param` pattern segment matches any single\n * non-empty segment; every other segment must match exactly. Segment counts must be equal.\n */\nexport function matchesPathPattern(pathname: string, pattern: string): boolean {\n  const pathSegments = pathSegmentsFor(pathname)\n  const patternSegments = pathSegmentsFor(pattern)\n\n  if (pathSegments.length !== patternSegments.length) {\n    return false\n  }\n\n  return patternSegments.every((patternSegment, index) => {\n    if (patternSegment.startsWith(\":\")) {\n      return pathSegments[index] !== \"\"\n    }\n    return patternSegment === pathSegments[index]\n  })\n}\n\n/** Strip a single trailing slash so `/api/foo` and `/api/foo/` compare equal (leaves \"/\" alone). */\nexport function normalizeRoutePath(pathname: string): string {\n  if (pathname.length > 1 && pathname.endsWith(\"/\")) {\n    return pathname.slice(0, -1)\n  }\n  return pathname\n}\n"
+  ],
+  "mappings": ";;AAyBO,IAAM,kBAA2C;AAAA,EACtD;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EAKA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EAIA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EAMA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IAKE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AACF;AAIA,WAAW,SAAS,iBAAiB;AAAA,EACnC,IAAI,MAAM,YAAY,CAAC,MAAM,aAAa;AAAA,IACxC,MAAM,IAAI,MACR,2BAA2B,MAAM,UAAU,MAAM,2CACnD;AAAA,EACF;AACF;;;ACxgBO,SAAS,eAAe,CAAC,UAA4B;AAAA,EAC1D,OAAO,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AAAA;AAOpC,SAAS,kBAAkB,CAAC,UAAkB,SAA0B;AAAA,EAC7E,MAAM,eAAe,gBAAgB,QAAQ;AAAA,EAC7C,MAAM,kBAAkB,gBAAgB,OAAO;AAAA,EAE/C,IAAI,aAAa,WAAW,gBAAgB,QAAQ;AAAA,IAClD,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,gBAAgB,MAAM,CAAC,gBAAgB,UAAU;AAAA,IACtD,IAAI,eAAe,WAAW,GAAG,GAAG;AAAA,MAClC,OAAO,aAAa,WAAW;AAAA,IACjC;AAAA,IACA,OAAO,mBAAmB,aAAa;AAAA,GACxC;AAAA;AAII,SAAS,kBAAkB,CAAC,UAA0B;AAAA,EAC3D,IAAI,SAAS,SAAS,KAAK,SAAS,SAAS,GAAG,GAAG;AAAA,IACjD,OAAO,SAAS,MAAM,GAAG,EAAE;AAAA,EAC7B;AAAA,EACA,OAAO;AAAA;",
+  "debugId": "27FCBA73C4A04A7064756E2164756E21",
+  "names": []
+}