@sixb/core 0.1.7 → 0.1.9

package/dist/{chunk-qv38twt8.js → chunk-52hbv0ak.js}

@@ -1,117 +1,122 @@
 // @bun
 import {
-  SchedulerRuntime
-} from "./chunk-9t8f5xfx.js";
+  OntologyRegistry2
+} from "./chunk-ap0g1g74.js";
 import {
-  registerProjectionRegistry
-} from "./chunk-64sr682n.js";
+  ProjectionRegistry2,
+  createOntologyMaterializer2
+} from "./chunk-an5tt9y0.js";
 import {
-  LoggingService
-} from "./chunk-s5y30bc9.js";
+  captureSixbFailure2,
+  isSixbError2
+} from "./chunk-f4w3yp4f.js";
 import {
-  OntologyOutboxDispatcher,
-  createDomainEventService
-} from "./chunk-n2w475r0.js";
+  captureExecutionScope,
+  resolveExecutionScopeAuthorization,
+  AuthorizationError2
+} from "./chunk-dz5h08xv.js";
 import {
-  discoverOntologySources,
-  discoverProjectDefinitions,
-  validateRulesAtStartup
-} from "./chunk-2b5qtban.js";
+  SecurityRegistry,
+  AuthRuntime2
+} from "./chunk-g00bfdq6.js";
 import {
-  validateSchedulesAtStartup
-} from "./chunk-5sz8ta9r.js";
+  AuthRuntimeError2,
+  isMagicLinkAuthStrategy2,
+  isOidcAuthStrategy2
+} from "./chunk-q5gz3g2j.js";
 import {
-  assertDatasetDefinition
-} from "./chunk-tn7xcs2n.js";
+  RuntimeError2,
+  createModelCatalog2
+} from "./chunk-e0d1rzef.js";
 import {
-  toolsFromProjectConfig
-} from "./chunk-n2arzn6e.js";
+  isMigrationCapableStorage2,
+  checkStorageSchema2
+} from "./chunk-mjbk2djy.js";
 import {
-  assertNoAgentDefinitions,
-  createBoundSixb,
-  validateWorkflowAgentStepGroupReferences,
-  validateWorkflowsAtStartup
-} from "./chunk-h0knpbz5.js";
+  createAuthorizedObjectReader
+} from "./chunk-ypbtykv6.js";
 import {
-  ConnectorError,
-  ConnectorNotFoundError,
-  SyncValidationError,
-  createAmbiguousProviderOperationError,
+  attachSixbErrorReporter2,
+  shareSixbErrorReporter2
+} from "./chunk-7apz6hg4.js";
+import {
+  ActionRegistry2
+} from "./chunk-vf691g1r.js";
+import {
+  assertDatasetDefinition2
+} from "./chunk-860dwwy0.js";
+import {
+  OntologyOutboxDispatcher2,
+  createDomainEventService2
+} from "./chunk-3tgwrcyh.js";
+import {
+  validateSchedulesAtStartup2
+} from "./chunk-e1c18xjx.js";
+import {
+  ConnectorError2,
+  ConnectorNotFoundError2,
   createConnectorCodedError,
-  isConnectorStorageError,
+  createAmbiguousProviderOperationError,
   oauthErrorKind,
-  providerBoundaryError,
   providerFailureCode,
+  providerBoundaryError,
+  isConnectorStorageError,
+  storageBoundaryError,
   recoverConnectorFailure,
-  storageBoundaryError
-} from "./chunk-ha58tjtt.js";
+  SyncValidationError2
+} from "./chunk-emyyk7dx.js";
 import {
-  createOntologyMutationRuntime,
-  registerOntologyMutationRuntime
-} from "./chunk-xhy826cz.js";
+  toolsFromProjectConfig
+} from "./chunk-skz0hst3.js";
 import {
-  isOAuthConnectorDefinition,
-  isStaticConnectorDefinition
-} from "./chunk-8m5ejdpn.js";
+  assertNoAgentDefinitions,
+  validateWorkflowsAtStartup2,
+  validateWorkflowAgentStepGroupReferences2,
+  createBoundSixb
+} from "./chunk-hpr1r6av.js";
 import {
   registerConnectorConnectionCallbackProcess
-} from "./chunk-nf4r78r4.js";
-import {
-  ActionRegistry
-} from "./chunk-d2ndstdf.js";
-import {
-  ProjectionRegistry,
-  createOntologyMaterializer
-} from "./chunk-9aehf39w.js";
+} from "./chunk-5a4a52tq.js";
 import {
-  ensureExecutionRecord
-} from "./chunk-hdz94br2.js";
+  registerOntologyMutationRuntime2,
+  createOntologyMutationRuntime2
+} from "./chunk-zcnq6105.js";
 import {
-  checkStorageSchema,
-  isMigrationCapableStorage
-} from "./chunk-6ed5bwnd.js";
+  SchedulerRuntime2
+} from "./chunk-z5rnrmz1.js";
 import {
-  CONNECTOR_CONNECTION_RUN_FAILURE_CODES,
-  ConnectorConnectionStorageError
-} from "./chunk-5gd7tpv6.js";
+  validateRulesAtStartup,
+  validateSharesAtStartup,
+  discoverOntologySources2,
+  discoverProjectDefinitions2
+} from "./chunk-r4tfx1sf.js";
 import {
-  OntologyRegistry
-} from "./chunk-x0qhkqje.js";
+  LoggingService2
+} from "./chunk-kxwa347f.js";
 import {
-  RuntimeError,
-  createModelCatalog
-} from "./chunk-p2vqaxkc.js";
+  registerProjectionRegistry2
+} from "./chunk-k3cqkkn2.js";
 import {
-  attachSixbErrorReporter,
-  shareSixbErrorReporter
-} from "./chunk-jq43kdvk.js";
-import {
-  reportEventDeliveryFailure
-} from "./chunk-qw9gvjv5.js";
-import {
-  AuthRuntime,
-  SecurityRegistry
-} from "./chunk-rre42skh.js";
+  isOAuthConnectorDefinition2,
+  isStaticConnectorDefinition
+} from "./chunk-3f7veca0.js";
 import {
-  AuthRuntimeError,
-  isMagicLinkAuthStrategy,
-  isOidcAuthStrategy
-} from "./chunk-xwnf87e1.js";
+  ensureExecutionRecord2
+} from "./chunk-17kfctj6.js";
 import {
-  AuthorizationError,
-  resolveExecutionScopeAuthorization
-} from "./chunk-37wk412q.js";
+  ConnectorConnectionStorageError2,
+  CONNECTOR_CONNECTION_RUN_FAILURE_CODES2
+} from "./chunk-2c4j899j.js";
 import {
-  captureSixbFailure,
-  isSixbError
-} from "./chunk-2xns679x.js";
+  reportEventDeliveryFailure3
+} from "./chunk-72w2pxk7.js";
 // src/webhooks/errors.ts
-class WebhookValidationError extends Error {
+class WebhookValidationError2 extends Error {
   name = "WebhookValidationError";
 }
 
 // src/webhooks/builders.ts
-function defineWebhook(id) {
+function defineWebhook2(id) {
   assertNonEmpty(id, "Webhook id");
   return new WebhookMethodBuilder(id);
 }
@@ -135,7 +140,7 @@ class WebhookBodyBuilder {
   }
   json(schema) {
     if (schema !== undefined && typeof schema.parse !== "function") {
-      throw new WebhookValidationError("[Sixb] Webhook JSON schema must provide parse(value).");
+      throw new WebhookValidationError2("[Sixb] Webhook JSON schema must provide parse(value).");
     }
     return new WebhookBuilder({
       id: this.id,
@@ -187,7 +192,7 @@ class WebhookBuilder {
   }
   verify(verify) {
     if (typeof verify !== "function") {
-      throw new WebhookValidationError("[Sixb] Webhook verify must be a function.");
+      throw new WebhookValidationError2("[Sixb] Webhook verify must be a function.");
     }
     return new WebhookBuilder({
       ...this.draft,
@@ -196,7 +201,7 @@ class WebhookBuilder {
   }
   idempotencyKey(resolver) {
     if (typeof resolver !== "function") {
-      throw new WebhookValidationError("[Sixb] Webhook idempotencyKey must be a function.");
+      throw new WebhookValidationError2("[Sixb] Webhook idempotencyKey must be a function.");
     }
     return new WebhookBuilder({
       ...this.draft,
@@ -205,7 +210,7 @@ class WebhookBuilder {
   }
   handle(handle) {
     if (typeof handle !== "function") {
-      throw new WebhookValidationError("[Sixb] Webhook handle must be a function.");
+      throw new WebhookValidationError2("[Sixb] Webhook handle must be a function.");
     }
     return {
       kind: "webhook",
@@ -220,11 +225,11 @@ class WebhookBuilder {
 }
 function assertNonEmpty(value, field) {
   if (!value.trim()) {
-    throw new WebhookValidationError(`[Sixb] ${field} must not be empty.`);
+    throw new WebhookValidationError2(`[Sixb] ${field} must not be empty.`);
   }
 }
 // src/webhooks/connector.ts
-function webhookConnector(options) {
+function webhookConnector2(options) {
   return {
     type: "webhook",
     webhooks: options.webhooks,
@@ -244,19 +249,19 @@ class WebhookRegistry {
         continue;
       const webhooks = connector.adapter.webhooks ?? [];
       if (!Array.isArray(webhooks)) {
-        throw new WebhookValidationError(`[Sixb] Connector '${connector.id}' webhooks must be an array when provided.`);
+        throw new WebhookValidationError2(`[Sixb] Connector '${connector.id}' webhooks must be an array when provided.`);
       }
       const ids = new Set;
       for (const webhook of webhooks) {
         assertValidWebhook(connector.id, webhook);
         if (ids.has(webhook.id)) {
-          throw new WebhookValidationError(`[Sixb] Duplicate webhook id '${webhook.id}' for connector '${connector.id}'.`);
+          throw new WebhookValidationError2(`[Sixb] Duplicate webhook id '${webhook.id}' for connector '${connector.id}'.`);
         }
         ids.add(webhook.id);
         const route = webhookRoute(connector.id, webhook.id);
         const duplicate = this.byRoute.get(route);
         if (duplicate) {
-          throw new WebhookValidationError(`[Sixb] Duplicate webhook route '${route}' for connectors '${duplicate.connector.id}' and '${connector.id}'.`);
+          throw new WebhookValidationError2(`[Sixb] Duplicate webhook route '${route}' for connectors '${duplicate.connector.id}' and '${connector.id}'.`);
         }
         const registeredWebhook = {
           connector,
@@ -284,52 +289,52 @@ function webhookRoute(connectorId, webhookId) {
 }
 function assertValidWebhook(connectorId, webhook) {
   if (!isRecord(webhook)) {
-    throw new WebhookValidationError(`[Sixb] Connector '${connectorId}' has an invalid webhook.`);
+    throw new WebhookValidationError2(`[Sixb] Connector '${connectorId}' has an invalid webhook.`);
   }
   if (webhook.kind !== "webhook") {
-    throw new WebhookValidationError(`[Sixb] Connector '${connectorId}' webhook must be created with defineWebhook(...).`);
+    throw new WebhookValidationError2(`[Sixb] Connector '${connectorId}' webhook must be created with defineWebhook(...).`);
   }
   if (typeof webhook.id !== "string" || !webhook.id.trim()) {
-    throw new WebhookValidationError(`[Sixb] Connector '${connectorId}' webhook id must not be empty.`);
+    throw new WebhookValidationError2(`[Sixb] Connector '${connectorId}' webhook id must not be empty.`);
   }
   if (webhook.method !== "POST") {
-    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' must use method POST.`);
+    throw new WebhookValidationError2(`[Sixb] Webhook '${connectorId}/${webhook.id}' must use method POST.`);
   }
   if (!isRecord(webhook.body)) {
-    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' body is required.`);
+    throw new WebhookValidationError2(`[Sixb] Webhook '${connectorId}/${webhook.id}' body is required.`);
   }
   if (webhook.body.format !== "json" && webhook.body.format !== "text" && webhook.body.format !== "raw") {
-    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' body format must be json, text, or raw.`);
+    throw new WebhookValidationError2(`[Sixb] Webhook '${connectorId}/${webhook.id}' body format must be json, text, or raw.`);
   }
   if (typeof webhook.body.parse !== "function") {
-    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' body parser must provide parse(value).`);
+    throw new WebhookValidationError2(`[Sixb] Webhook '${connectorId}/${webhook.id}' body parser must provide parse(value).`);
   }
   if (webhook.verify !== undefined && typeof webhook.verify !== "function") {
-    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' verify must be a function.`);
+    throw new WebhookValidationError2(`[Sixb] Webhook '${connectorId}/${webhook.id}' verify must be a function.`);
   }
   if (webhook.idempotencyKey !== undefined && typeof webhook.idempotencyKey !== "function") {
-    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' idempotencyKey must be a function.`);
+    throw new WebhookValidationError2(`[Sixb] Webhook '${connectorId}/${webhook.id}' idempotencyKey must be a function.`);
   }
   if (typeof webhook.handle !== "function") {
-    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' handle must be a function.`);
+    throw new WebhookValidationError2(`[Sixb] Webhook '${connectorId}/${webhook.id}' handle must be a function.`);
   }
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 // src/webhooks/unverified.ts
-class UnverifiedWebhookError extends Error {
+class UnverifiedWebhookError2 extends Error {
   name = "UnverifiedWebhookError";
 }
-function resolveWebhookVerification(subject, options) {
+function resolveWebhookVerification2(subject, options) {
   if (options.credential)
     return { credential: options.credential };
   if (!options.allowUnverified) {
-    throw new UnverifiedWebhookError(`[${subject.connector}] This webhook has no credential, so ${subject.verifies} cannot be ` + `checked and the route would accept unverified requests from anyone who can reach it. ` + `Set ${subject.credentialOption}, or pass ${subject.allowOption} to accept that.`);
+    throw new UnverifiedWebhookError2(`[${subject.connector}] This webhook has no credential, so ${subject.verifies} cannot be ` + `checked and the route would accept unverified requests from anyone who can reach it. ` + `Set ${subject.credentialOption}, or pass ${subject.allowOption} to accept that.`);
   }
   return { allowUnverified: true };
 }
-function warnUnverifiedWebhook(subject, verification) {
+function warnUnverifiedWebhook2(subject, verification) {
   if (verification.credential)
     return;
   console.warn(`[${subject.connector}] ${subject.allowOption}, so ${subject.verifies} is not checked ` + `and this route accepts unverified requests from anyone who can reach it. ` + `Set ${subject.credentialOption} before exposing it.`);
@@ -1328,7 +1333,7 @@ class DefaultConnectorAuthorizationLifecycle {
     try {
       await this.revokeAuthorization({ definition, authorizationId, principal });
     } catch (cleanupError) {
-      if (isSixbError(cleanupError) && cleanupError.code === "connector.revocation_pending")
+      if (isSixbError2(cleanupError) && cleanupError.code === "connector.revocation_pending")
         return;
       throw createConnectorCodedError("internal.unexpected", "Unused connector credentials could not be scheduled for revocation.", {
         cause: new AggregateError([primaryError, cleanupError], "Connector authorization failed and cleanup could not be secured.")
@@ -1408,7 +1413,7 @@ class DefaultConnectorAuthorizationLifecycle {
 }
 function assertConnectorAuthorizationActor(authorization, principal) {
   if (authorization.authorizedBy.type !== principal.type || authorization.authorizedBy.id !== principal.id) {
-    throw new AuthorizationError(`authorization:connector:${authorization.connectorId}`, "[Sixb] This connector authorization can only be changed by its authorizing principal.");
+    throw new AuthorizationError2(`authorization:connector:${authorization.connectorId}`, "[Sixb] This connector authorization can only be changed by its authorizing principal.");
   }
 }
 function assertReauthorizationRevision(authorization, expectedRevision) {
@@ -1422,18 +1427,18 @@ function requireConnectorConnectionCommandActor(execution, projectId) {
   const actor = connectorConnectionActorFromExecution(execution, projectId);
   if (actor)
     return actor;
-  throw new AuthorizationError("manage:connector", "[Sixb] Connector connection commands require an authenticated request execution.");
+  throw new AuthorizationError2("manage:connector", "[Sixb] Connector connection commands require an authenticated request execution.");
 }
 function assertConnectorAuthorizationAttemptInitiator(execution, current) {
   const initiating = execution ? connectorConnectionActorFromExecution(execution, execution.projectId) : null;
   if (!initiating || !sameConnectorConnectionCommandActor(initiating, current)) {
-    throw new ConnectorConnectionStorageError("attempt_invalid", "[Sixb] Connector authorization attempt is invalid, expired, or already used.");
+    throw new ConnectorConnectionStorageError2("attempt_invalid", "[Sixb] Connector authorization attempt is invalid, expired, or already used.");
   }
 }
 function assertConnectorConnectionRunInitiator(execution, current, connectorId) {
   const initiating = execution ? connectorConnectionActorFromExecution(execution, execution.projectId) : null;
   if (!initiating || !sameConnectorConnectionCommandActor(initiating, current)) {
-    throw new AuthorizationError(`connection-run:connector:${connectorId}`, "[Sixb] This connector connection run can only be accessed by its initiating actor.");
+    throw new AuthorizationError2(`connection-run:connector:${connectorId}`, "[Sixb] This connector connection run can only be accessed by its initiating actor.");
   }
 }
 function connectorConnectionActorFromExecution(execution, projectId) {
@@ -1498,7 +1503,7 @@ class ConnectorAuthorizationRequestHandler {
     const prepared = await this.prepareAuthorizationRequest(command, connectorId, input);
     try {
       await this.storage.transaction(async (tx) => {
-        await ensureExecutionRecord(tx.executions, command.execution);
+        await ensureExecutionRecord2(tx.executions, command.execution);
         await requireConnectorConnectionStorage(tx).createAuthorizationAttempt(prepared.attempt);
       }, { isolation: "serializable" });
     } catch (error) {
@@ -1717,7 +1722,7 @@ class ConnectorConnectionRunService {
     let run;
     try {
       run = await this.storage.transaction(async (tx) => {
-        await ensureExecutionRecord(tx.executions, command.execution);
+        await ensureExecutionRecord2(tx.executions, command.execution);
         return requireConnectorConnectionStorage2(tx).createConnectionSelectionRun({
           id: runId,
           projectId: this.projectId,
@@ -1743,7 +1748,7 @@ class ConnectorConnectionRunService {
     let expiresAt;
     try {
       expiresAt = await this.storage.transaction(async (tx) => {
-        await ensureExecutionRecord(tx.executions, command.execution);
+        await ensureExecutionRecord2(tx.executions, command.execution);
         const connections = requireConnectorConnectionStorage2(tx);
         await connections.createConnectionRun({
           id: runId,
@@ -1972,8 +1977,8 @@ class ConnectorConnectionRunService {
       processingId: run.processingId,
       status: "failed",
       ...authorizationId === undefined ? {} : { authorizationId },
-      error: captureSixbFailure(error, {
-        allowedCodes: CONNECTOR_CONNECTION_RUN_FAILURE_CODES,
+      error: captureSixbFailure2(error, {
+        allowedCodes: CONNECTOR_CONNECTION_RUN_FAILURE_CODES2,
         defaultCode: "internal.unexpected",
         at: this.now()
       })
@@ -2085,7 +2090,7 @@ class ConnectorConnectionRunService {
       await this.authorizations.continuePendingRevocation(this.resolveDefinition(connectorId), authorizationId);
       return true;
     } catch (error) {
-      if (isSixbError(error) && error.code === "connector.revocation_pending")
+      if (isSixbError2(error) && error.code === "connector.revocation_pending")
         return false;
       throw error;
     }
@@ -2440,7 +2445,7 @@ class ConnectorConnectionService {
     if (!definition) {
       throw createConnectorCodedError("connector.not_found", `Unknown connector '${connectorId}'.`);
     }
-    if (!isOAuthConnectorDefinition(definition)) {
+    if (!isOAuthConnectorDefinition2(definition)) {
       throw createConnectorCodedError("connector.configuration_invalid", `Connector '${connectorId}' does not use OAuth authentication.`);
     }
     return definition;
@@ -2455,7 +2460,7 @@ class ConnectorConnectionService {
     try {
       await this.authorizations.continuePendingRevocation(definition, authorizationId);
     } catch (error) {
-      if (isSixbError(error) && error.code === "connector.revocation_pending")
+      if (isSixbError2(error) && error.code === "connector.revocation_pending")
         return;
       throw error;
     }
@@ -2497,7 +2502,7 @@ class ConnectorService {
   constructor(projectId, definitions, options = {}) {
     this.projectId = projectId;
     this.definitionsById = new Map(definitions.map((definition) => [definition.id, definition]));
-    if (definitions.some(isOAuthConnectorDefinition)) {
+    if (definitions.some(isOAuthConnectorDefinition2)) {
       this.connections = new ConnectorConnectionService(projectId, definitions, options);
     }
   }
@@ -2546,9 +2551,9 @@ class ConnectorService {
   assertRegistered(definition) {
     const registeredDefinition = this.definitionsById.get(definition.id);
     if (!registeredDefinition)
-      throw new ConnectorNotFoundError(definition.id);
+      throw new ConnectorNotFoundError2(definition.id);
     if (registeredDefinition !== definition) {
-      throw new ConnectorError(`Connector '${definition.id}' is not the registered definition instance.`);
+      throw new ConnectorError2(`Connector '${definition.id}' is not the registered definition instance.`);
     }
   }
   requireConnections() {
@@ -2821,7 +2826,7 @@ function validateKeyedDatasetWriterTopology(input) {
   for (const sync of input.syncs) {
     const dataset = input.datasetsById.get(sync.target.dataset.id);
     if (sync.config.mode === "merge" && dataset?.primaryKey === undefined) {
-      throw new SyncValidationError(`[Sixb] Merge sync '${sync.id}' targets dataset '${sync.target.dataset.id}', which must define a primaryKey.`);
+      throw new SyncValidationError2(`[Sixb] Merge sync '${sync.id}' targets dataset '${sync.target.dataset.id}', which must define a primaryKey.`);
     }
   }
   const firstWriterByDataset = new Map;
@@ -2834,7 +2839,7 @@ function validateKeyedDatasetWriterTopology(input) {
       firstWriterByDataset.set(writer.datasetId, writer);
       continue;
     }
-    throw new SyncValidationError(`[Sixb] Keyed dataset '${writer.datasetId}' has multiple registered writers: ${first.label} and ${writer.label}. V1 allows one writer per keyed dataset.`);
+    throw new SyncValidationError2(`[Sixb] Keyed dataset '${writer.datasetId}' has multiple registered writers: ${first.label} and ${writer.label}. V1 allows one writer per keyed dataset.`);
   }
 }
 function validateMergeSyncProjectionSafety(input) {
@@ -2843,7 +2848,7 @@ function validateMergeSyncProjectionSafety(input) {
     const sync = mergeSyncByDataset.get(projection.datasetId);
     if (!sync)
       continue;
-    throw new SyncValidationError(`[Sixb] Telemetry projection '${projection.id}' cannot read merge-written dataset '${projection.datasetId}' from sync '${sync.id}'. V1 merge syncs support object and link replacement projections only.`);
+    throw new SyncValidationError2(`[Sixb] Telemetry projection '${projection.id}' cannot read merge-written dataset '${projection.datasetId}' from sync '${sync.id}'. V1 merge syncs support object and link replacement projections only.`);
   }
 }
 function* datasetWriters(syncs, pipelines) {
@@ -2871,15 +2876,20 @@ function createDefinitionCatalog(definitionsById) {
 // src/runtime/resolve-definitions.ts
 function resolveDefinitions(options) {
   assertNoAgentDefinitions(options);
-  const ontology = new OntologyRegistry({ sources: options.ontology });
-  const actionRegistry = new ActionRegistry({ actions: options.actions ?? [], ontology });
+  const ontology = new OntologyRegistry2({ sources: options.ontology });
+  const actionRegistry = new ActionRegistry2({ actions: options.actions ?? [], ontology });
   const registeredActionIds = new Set(actionRegistry.list().map((action) => action.id));
-  const models = options.models === undefined ? undefined : createModelCatalog(options.models);
+  const sharesById = validateSharesAtStartup({
+    shares: options.shares ?? [],
+    ontology,
+    actions: actionRegistry
+  });
+  const models = options.models === undefined ? undefined : createModelCatalog2(options.models);
   const tools = createAgentToolCatalog(options.tools);
   const connectorsById = indexUniqueDefinitions("connector", options.connectors ?? []);
   const datasetsById = new Map;
   for (const dataset of options.datasets ?? []) {
-    assertDatasetDefinition(dataset, (message) => new RuntimeError(message));
+    assertDatasetDefinition2(dataset, (message) => new RuntimeError2(message));
     assertUniqueDefinitionId("dataset", dataset.id, datasetsById);
     datasetsById.set(dataset.id, dataset);
   }
@@ -2888,7 +2898,7 @@ function resolveDefinitions(options) {
   for (const sync of options.syncs ?? []) {
     assertUniqueDefinitionId("sync", sync.id, syncsById);
     if (!datasetsById.has(sync.target.dataset.id)) {
-      throw new RuntimeError(`Sync '${sync.id}' targets unknown dataset '${sync.target.dataset.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+      throw new RuntimeError2(`Sync '${sync.id}' targets unknown dataset '${sync.target.dataset.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
     }
     syncsById.set(sync.id, sync);
   }
@@ -2905,7 +2915,7 @@ function resolveDefinitions(options) {
   const rules = options.rules ?? [];
   validateRulesAtStartup(rules, ontology);
   const rulesById = indexUniqueDefinitions("rule", rules);
-  validateSchedulesAtStartup(schedules, ontology, {
+  validateSchedulesAtStartup2(schedules, ontology, {
     registeredRuleIds: new Set(rulesById.keys()),
     registeredActionIds,
     registeredDatasetIds: new Set(datasetsById.keys()),
@@ -2918,7 +2928,7 @@ function resolveDefinitions(options) {
   for (const pipeline of pipelines) {
     validateScheduleReferences("Pipeline", pipeline.id, pipeline.triggers, schedulesById);
   }
-  const workflows = validateWorkflowsAtStartup({
+  const workflows = validateWorkflowsAtStartup2({
     workflows: options.workflows ?? [],
     registeredSchedules: schedulesById,
     registeredActionIds,
@@ -2938,10 +2948,11 @@ function resolveDefinitions(options) {
     pipelineIds: new Set(pipelinesById.keys()),
     agentAvailable: models !== undefined,
     connectorIds: new Set(connectorsById.keys()),
+    shareIds: new Set(sharesById.keys()),
     getSubTypes: (objectTypeId) => ontology.listSubTypes(objectTypeId)
   });
-  validateWorkflowAgentStepGroupReferences(workflows, security);
-  const projectionRegistry = new ProjectionRegistry({
+  validateWorkflowAgentStepGroupReferences2(workflows, security);
+  const projectionRegistry = new ProjectionRegistry2({
     projections: options.projections ?? [],
     ontology,
     datasetsById
@@ -2962,6 +2973,7 @@ function resolveDefinitions(options) {
     rules: createDefinitionCatalog(rulesById),
     schedules: createDefinitionCatalog(schedulesById),
     security,
+    shares: createDefinitionCatalog(sharesById),
     syncs: createDefinitionCatalog(syncsById),
     workflows: createDefinitionCatalog(workflowsById)
   });
@@ -2976,34 +2988,34 @@ function indexUniqueDefinitions(kind, definitions) {
 }
 function assertUniqueDefinitionId(kind, id, definitionsById) {
   if (definitionsById.has(id)) {
-    throw new RuntimeError(`Duplicate ${kind} id: ${id}`);
+    throw new RuntimeError2(`Duplicate ${kind} id: ${id}`);
   }
 }
 function validatePipelineDatasets(pipeline, datasetsById) {
   if (pipeline.graph.nodes.length === 0) {
-    throw new RuntimeError(`Pipeline '${pipeline.id}' must contain at least one step.`);
+    throw new RuntimeError2(`Pipeline '${pipeline.id}' must contain at least one step.`);
   }
   const stepIds = new Set;
   for (const node of pipeline.graph.nodes) {
     const { step } = node;
     if (stepIds.has(step.id)) {
-      throw new RuntimeError(`Pipeline '${pipeline.id}' contains duplicate step id '${step.id}'.`);
+      throw new RuntimeError2(`Pipeline '${pipeline.id}' contains duplicate step id '${step.id}'.`);
     }
     stepIds.add(step.id);
     for (const [inputName, dataset] of Object.entries(step.inputs)) {
       if (!datasetsById.has(dataset.id)) {
-        throw new RuntimeError(`Pipeline '${pipeline.id}' step '${step.id}' input '${inputName}' references unknown dataset '${dataset.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+        throw new RuntimeError2(`Pipeline '${pipeline.id}' step '${step.id}' input '${inputName}' references unknown dataset '${dataset.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
       }
     }
     if (!datasetsById.has(step.output.id)) {
-      throw new RuntimeError(`Pipeline '${pipeline.id}' step '${step.id}' outputs unknown dataset '${step.output.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+      throw new RuntimeError2(`Pipeline '${pipeline.id}' step '${step.id}' outputs unknown dataset '${step.output.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
     }
   }
 }
 function validateScheduleReferences(consumerKind, consumerId, references, schedulesById) {
   for (const reference of references) {
     if (!schedulesById.has(reference.scheduleId)) {
-      throw new RuntimeError(`${consumerKind} '${consumerId}' references unknown schedule '${reference.scheduleId}'. Add it to 'schedules' in createSixb() or export it from 'schedules/'.`);
+      throw new RuntimeError2(`${consumerKind} '${consumerId}' references unknown schedule '${reference.scheduleId}'. Add it to 'schedules' in createSixb() or export it from 'schedules/'.`);
     }
   }
 }
@@ -3020,7 +3032,7 @@ class StorageReadiness {
     this.storage = storage;
     this.schemaRetryDelayMs = positiveInteger2(options.schemaRetryDelayMs ?? DEFAULT_SCHEMA_RETRY_DELAY_MS, "schemaRetryDelayMs");
     this.now = options.now ?? (() => new Date);
-    this.schema = isMigrationCapableStorage(storage) ? { status: "unchecked" } : { status: "valid" };
+    this.schema = isMigrationCapableStorage2(storage) ? { status: "unchecked" } : { status: "valid" };
   }
   startSchemaValidation() {
     if (this.schema.status === "checking" || this.schema.status === "valid")
@@ -3051,7 +3063,7 @@ class StorageReadiness {
     };
   }
   async validateSchema() {
-    const result = await checkStorageSchema(this.storage);
+    const result = await checkStorageSchema2(this.storage);
     this.schema = result.ok ? { status: "valid" } : this.invalidSchema(result.reason ?? "Storage schema is not usable.");
   }
   invalidSchema(reason) {
@@ -3070,7 +3082,7 @@ function positiveInteger2(value, name) {
 }
 
 // src/runtime/host.ts
-class SixbHost {
+class SixbHost2 {
   projectId;
   webhookRegistry;
   hostContext;
@@ -3093,16 +3105,16 @@ class SixbHost {
   scheduler;
   auth;
   constructor(options) {
-    const errorReporter = attachSixbErrorReporter(this, options.onError);
+    const errorReporter = attachSixbErrorReporter2(this, options.onError);
     this.projectId = options.id ?? "default";
     this.broker = options.broker;
-    this.eventService = createDomainEventService({
+    this.eventService = createDomainEventService2({
       projectId: this.projectId,
       broker: this.broker,
       errorReporter
     });
     this.events = this.eventService;
-    this.logging = new LoggingService({
+    this.logging = new LoggingService2({
       projectId: this.projectId,
       broker: this.broker,
       logger: options.logger,
@@ -3117,8 +3129,8 @@ class SixbHost {
     this.projectRoot = resolve(options.projectRoot ?? process.cwd());
     const definitions = resolveDefinitions(options);
     this.definitions = definitions;
-    registerProjectionRegistry(this, definitions.projections);
-    this.auth = new AuthRuntime({
+    registerProjectionRegistry2(this, definitions.projections);
+    this.auth = new AuthRuntime2({
       projectId: this.projectId,
       storage: this.storage,
       security: definitions.security,
@@ -3127,7 +3139,7 @@ class SixbHost {
     validateAuthStrategySecurityReferences(this.auth.getStrategy(), definitions.security);
     const connectors = definitions.connectors.list();
     assertConnectorConnectionSurfaces(connectors);
-    const hasOAuthConnectors = connectors.some(isOAuthConnectorDefinition);
+    const hasOAuthConnectors = connectors.some(isOAuthConnectorDefinition2);
     const credentialProtector = hasOAuthConnectors && options.connectorConnections?.encryptionKey !== undefined ? createConnectorCredentialProtectorFromKey(options.connectorConnections.encryptionKey) : undefined;
     this.connectorService = new ConnectorService(this.projectId, connectors, {
       storage: this.storage,
@@ -3138,17 +3150,17 @@ class SixbHost {
     }
     assertWebhookRunStorage(connectors, this.storage);
     this.webhookRegistry = new WebhookRegistry({ connectors });
-    this.materializer = createOntologyMaterializer({
+    this.materializer = createOntologyMaterializer2({
       projectId: this.projectId,
       ontology: definitions.ontology,
       projections: definitions.projections,
       storage: this.storage
     });
-    this.committedFacts = new OntologyOutboxDispatcher({
+    this.committedFacts = new OntologyOutboxDispatcher2({
       projectId: this.projectId,
       storage: this.storage,
       events: this.eventService,
-      onDeliveryFailure: (error, failure) => reportEventDeliveryFailure(errorReporter, error, {
+      onDeliveryFailure: (error, failure) => reportEventDeliveryFailure3(errorReporter, error, {
         projectId: this.projectId,
         ...failure
       })
@@ -3168,28 +3180,35 @@ class SixbHost {
       storage: this.storage,
       queues: this.queues
     };
-    registerProjectionRegistry(this.hostContext, definitions.projections);
-    shareSixbErrorReporter(this, this.hostContext);
-    this.scheduler = new SchedulerRuntime({
+    registerProjectionRegistry2(this.hostContext, definitions.projections);
+    shareSixbErrorReporter2(this, this.hostContext);
+    this.scheduler = new SchedulerRuntime2({
       schedules: definitions.schedules.list(),
       events: this.eventService
     });
   }
   withScope(scope) {
-    const authorization = resolveExecutionScopeAuthorization(this.projectId, scope);
-    if (authorization.ref.type === "kernel") {
+    const capturedScope = captureExecutionScope(scope);
+    const authorization = resolveExecutionScopeAuthorization(this.projectId, capturedScope);
+    if (authorization.type === "unrestricted" && authorization.ref.type === "kernel") {
       throw new Error("[Sixb] Kernel authority cannot be bound to the domain SDK.");
     }
+    const objectReader = createAuthorizedObjectReader({
+      scope: capturedScope,
+      ontology: this.hostContext.ontology,
+      objectStorage: this.storage.objects
+    });
     const runtime = {
       ...this.hostContext,
-      runtimeAuthorization: scope.authorization,
+      runtimeAuthorization: capturedScope.authorization,
+      objectReader,
       ...authorization.type === "principal" ? { authorization: authorization.context } : {}
     };
-    registerOntologyMutationRuntime(runtime, createOntologyMutationRuntime({
-      materializer: this.materializer.withScope(scope),
+    registerOntologyMutationRuntime2(runtime, createOntologyMutationRuntime2({
+      materializer: this.materializer.withScope(capturedScope),
       notifyCommittedFacts: () => this.committedFacts.notify()
     }));
-    return createBoundSixb(runtime, this.sixbDependencies(), scope.execution);
+    return createBoundSixb(runtime, this.sixbDependencies(), capturedScope.execution);
   }
   get id() {
     return this.projectId;
@@ -3230,17 +3249,18 @@ class SixbHost {
       logging: this.logging,
       connectorService: this.connectorService,
       ...this.connectorService.connectionProcess === undefined ? {} : { connectorConnections: this.connectorService.connectionProcess },
-      blobStorage: this.blobStorage
+      blobStorage: this.blobStorage,
+      lakeStorage: this.lakeStorage
     };
   }
 }
 function validateAuthStrategySecurityReferences(strategy, security) {
-  if (!isMagicLinkAuthStrategy(strategy) && !isOidcAuthStrategy(strategy)) {
+  if (!isMagicLinkAuthStrategy2(strategy) && !isOidcAuthStrategy2(strategy)) {
     return;
   }
   for (const groupId of strategy.bootstrapGroupIds ?? []) {
     if (!security.getGroupById(groupId)) {
-      throw new AuthRuntimeError("invalid_auth_config", `[Sixb] Auth bootstrapGroups references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+      throw new AuthRuntimeError2("invalid_auth_config", `[Sixb] Auth bootstrapGroups references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
     }
   }
 }
@@ -3251,13 +3271,13 @@ function assertWebhookRunStorage(connectors, storage) {
   for (const connector of connectors) {
     const webhooks = connector.adapter.webhooks;
     if (Array.isArray(webhooks) && webhooks.length > 0) {
-      throw new WebhookValidationError("[Sixb] Webhooks require storage.webhookRuns to be configured.");
+      throw new WebhookValidationError2("[Sixb] Webhooks require storage.webhookRuns to be configured.");
     }
   }
 }
 function assertConnectorConnectionSurfaces(connectors) {
   for (const connector of connectors) {
-    if (!isOAuthConnectorDefinition(connector))
+    if (!isOAuthConnectorDefinition2(connector))
       continue;
     if (connector.adapter.webhooks !== undefined) {
       throw createConnectorCodedError("connector.configuration_invalid", `OAuth connector '${connector.id}' cannot register webhooks until connection routing is defined.`);
@@ -3266,16 +3286,16 @@ function assertConnectorConnectionSurfaces(connectors) {
 }
 
 // src/runtime/create.ts
-async function createSixb(options) {
+async function createSixb2(options) {
   assertNoAgentDefinitions(options);
   const projectRoot = resolve2(options.projectRoot ?? process.cwd());
-  const discoveredOntology = await discoverOntologySources(projectRoot);
+  const discoveredOntology = await discoverOntologySources2(projectRoot);
   const allSources = [...options.ontologies ?? [], ...discoveredOntology];
   if (allSources.length === 0) {
-    throw new RuntimeError("No ontology found. Create an 'ontology/' folder or pass 'ontologies' to createSixb().");
+    throw new RuntimeError2("No ontology found. Create an 'ontology/' folder or pass 'ontologies' to createSixb().");
   }
-  const definitions = await discoverProjectDefinitions(projectRoot);
-  return new SixbHost({
+  const definitions = await discoverProjectDefinitions2(projectRoot);
+  return new SixbHost2({
     id: options.id,
     ontology: allSources,
     broker: options.broker,
@@ -3304,9 +3324,10 @@ async function createSixb(options) {
     membershipPolicies: [...options.membershipPolicies ?? [], ...definitions.membershipPolicies],
     models: options.models,
     tools: options.tools,
+    shares: [...options.shares ?? [], ...definitions.shares],
     auth: options.auth
   });
 }
-export { WebhookValidationError, defineWebhook, webhookConnector, UnverifiedWebhookError, resolveWebhookVerification, warnUnverifiedWebhook, SixbHost, createSixb };
+export { WebhookValidationError2, defineWebhook2, webhookConnector2, UnverifiedWebhookError2, resolveWebhookVerification2, warnUnverifiedWebhook2, SixbHost2, createSixb2 };
 
-//# debugId=CC06BD4B1FBA1D7664756E2164756E21
+//# debugId=37ED6E7D8337016564756E2164756E21