@sixb/core 0.1.7 → 0.1.9

package/dist/chunk-awbhdqyc.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/shares/compiler.ts"],
+  "sourcesContent": [
+    "import type { ActionDefinitionCatalog } from \"../actions\"\nimport type { LinkPathSelection, LinkPathSelectionMode, ObjectRef } from \"../ontology\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport type { ObjectLink, ObjectType } from \"../ontology/types\"\nimport type {\n  ObjectReadLinkDefinitionSelection,\n  ObjectReadLinkSelection,\n  ObjectReadNode,\n  ObjectReadObjectSelection,\n  ObjectReadRoot,\n} from \"../storage/objects/types\"\nimport { type ShareAccessPlan, snapshotShareAccessPlan } from \"./access-plan\"\nimport { snapshotShareDefinition } from \"./builders\"\nimport { ShareDefinitionError } from \"./errors\"\nimport type { ShareDefinition, ShareViewGrant } from \"./types\"\n\nexport interface CompileShareAccessPlanInput {\n  readonly share: ShareDefinition\n  readonly target: ObjectRef\n  readonly ontology: OntologyDefinitionCatalog\n  readonly actions: ActionDefinitionCatalog\n}\n\n/** Compile one current Share definition and exact target into M01 delegated authority. */\nexport function compileShareAccessPlan(input: CompileShareAccessPlanInput): ShareAccessPlan {\n  const share = snapshotShareDefinition(input.share)\n  const targetObjectTypeId = share.target.objectTypeId\n  if (\n    input.target.objectTypeId !== targetObjectTypeId ||\n    typeof input.target.primaryId !== \"string\" ||\n    !input.target.primaryId.trim()\n  ) {\n    throw invalid(`Share '${share.id}' requires an exact '${targetObjectTypeId}' object reference.`)\n  }\n  if (!input.ontology.getObjectTypeById(targetObjectTypeId)) {\n    throw invalid(\n      `Share '${share.id}' targets unknown object type '${targetObjectTypeId}'. Register it in the ontology before this Share.`\n    )\n  }\n\n  const view = share.grants.find((grant): grant is ShareViewGrant => grant.kind === \"object.view\")\n  if (!view) {\n    throw invalid(`Share '${share.id}' must contain one view grant.`)\n  }\n\n  const root: ObjectReadRoot = {\n    anchor: {\n      objectTypeId: targetObjectTypeId,\n      primaryId: input.target.primaryId,\n    },\n    node: compileNode(input.ontology, [targetObjectTypeId], view.links, share.id),\n  }\n\n  const grants: ShareAccessPlan[\"grants\"][number][] = [\n    {\n      kind: \"object.view\",\n      selection: { kind: \"selected\", roots: [root] },\n    },\n  ]\n\n  for (const grant of share.grants) {\n    if (grant.kind !== \"action.apply\") continue\n    const action = input.actions.getById(grant.actionId)\n    if (!action || action.binding.kind !== \"object\") {\n      throw invalid(`Share '${share.id}' references unknown or global Action '${grant.actionId}'.`)\n    }\n    if (\n      action.binding.objectType.id !== targetObjectTypeId ||\n      grant.subjectObjectTypeId !== targetObjectTypeId\n    ) {\n      throw invalid(\n        `Share '${share.id}' Action '${grant.actionId}' must be defined exactly on '${targetObjectTypeId}'. Shared Actions do not inherit in V1.`\n      )\n    }\n    assertShareableActionParams({\n      ontology: input.ontology,\n      params: action.params,\n      shareId: share.id,\n      actionId: action.id,\n    })\n    grants.push({\n      kind: \"action.apply\",\n      actionId: action.id,\n      subjects: [{ ...input.target }],\n    })\n  }\n\n  return snapshotShareAccessPlan({ grants })\n}\n\nconst SHAREABLE_PRIMITIVE_SCHEMAS = new Set([\n  \"string\",\n  \"integer\",\n  \"double\",\n  \"decimal\",\n  \"boolean\",\n  \"date\",\n  \"timestamp\",\n  \"uuid\",\n])\n\n/**\n * V1 deliberately excludes references from shared Action params. A delegated caller cannot yet be\n * authorized to resolve arbitrary object or blob references supplied at invocation time.\n */\nfunction assertShareableActionParams(input: {\n  readonly ontology: OntologyDefinitionCatalog\n  readonly params: Readonly<Record<string, { readonly schema: unknown }>>\n  readonly shareId: string\n  readonly actionId: string\n}): void {\n  const seenSchemas = new WeakSet<object>()\n  const resolvingValueTypes = new Set<string>()\n\n  const reject = (path: string, kind: \"objectRef\" | \"fileRef\"): never => {\n    throw invalid(\n      `Share '${input.shareId}' Action '${input.actionId}' parameter '${path}' uses ${kind}. Shared Action parameters cannot contain objectRef or fileRef in V1.`\n    )\n  }\n\n  const malformed = (path: string): never => {\n    throw invalid(\n      `Share '${input.shareId}' Action '${input.actionId}' parameter '${path}' has a schema that cannot be inspected safely.`\n    )\n  }\n\n  const walk = (schema: unknown, path: string): void => {\n    if (typeof schema === \"string\") {\n      if (schema === \"fileRef\") reject(path, \"fileRef\")\n      if (!SHAREABLE_PRIMITIVE_SCHEMAS.has(schema)) malformed(path)\n      return\n    }\n    if (!isRecord(schema)) throw malformed(path)\n    if (seenSchemas.has(schema)) return\n    seenSchemas.add(schema)\n\n    switch (schema.type) {\n      case \"objectRef\":\n        reject(path, \"objectRef\")\n        break\n      case \"enum\":\n        return\n      case \"object\": {\n        if (!isRecord(schema.properties)) throw malformed(path)\n        for (const [fieldId, field] of Object.entries(schema.properties)) {\n          if (!isRecord(field) || !(\"schema\" in field)) {\n            throw malformed(`${path}.${fieldId}`)\n          }\n          walk(field.schema, `${path}.${fieldId}`)\n        }\n        return\n      }\n      case \"array\":\n        if (!(\"items\" in schema)) throw malformed(path)\n        walk(schema.items, `${path}[]`)\n        return\n      case \"map\":\n        if (!(\"valueSchema\" in schema)) throw malformed(path)\n        walk(schema.valueSchema, `${path}{}`)\n        return\n      case \"valueTypeRef\": {\n        if (typeof schema.valueTypeId !== \"string\" || !schema.valueTypeId.trim()) {\n          throw malformed(path)\n        }\n        const valueTypeId = schema.valueTypeId\n        if (resolvingValueTypes.has(valueTypeId)) {\n          // Recursive inline resolutions are still untrusted. Inspect one when present; the\n          // schema-identity guard terminates honest self-reference while catching a forged second\n          // resolution that hides a reference-bearing payload behind the same id.\n          if (schema._resolved !== undefined) {\n            walk(schema._resolved, `${path}<${valueTypeId}>`)\n          }\n          return\n        }\n        // The registered ValueType is authoritative. `_resolved` supports inference and\n        // auto-registration; it must not override the current ontology under the same id.\n        const resolved =\n          input.ontology.getValueTypesById().get(valueTypeId)?.schema ?? schema._resolved\n        if (resolved === undefined) {\n          throw invalid(\n            `Share '${input.shareId}' Action '${input.actionId}' parameter '${path}' references unknown ValueType '${valueTypeId}', so it cannot be inspected safely.`\n          )\n        }\n        resolvingValueTypes.add(valueTypeId)\n        try {\n          walk(resolved, `${path}<${valueTypeId}>`)\n        } finally {\n          resolvingValueTypes.delete(valueTypeId)\n        }\n        return\n      }\n      default:\n        throw malformed(path)\n    }\n  }\n\n  for (const [paramId, param] of Object.entries(input.params)) {\n    if (!isRecord(param) || !(\"schema\" in param)) throw malformed(paramId)\n    walk(param.schema, paramId)\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction compileNode(\n  ontology: OntologyDefinitionCatalog,\n  authoredObjectTypeIds: readonly string[],\n  links: LinkPathSelectionMode,\n  shareId: string\n): ObjectReadNode {\n  const objectTypeIds = uniqueSorted(authoredObjectTypeIds)\n  const objectTypes = objectTypeIds.map((id) => ontology.resolveObjectType(id))\n  const objects: ObjectReadObjectSelection[] = objectTypes.map((objectType) => ({\n    objectTypeId: objectType.id,\n    propertyIds: uniqueSorted(objectType.properties.map((property) => property.id)),\n  }))\n\n  const selectedLinks =\n    links.kind === \"none\"\n      ? []\n      : links.kind === \"all\"\n        ? allDirectLinks(ontology, objectTypes)\n        : links.links\n\n  const compiledLinks = selectedLinks.map((selection) =>\n    compileLinkSelection({ ontology, parentObjectTypeIds: objectTypeIds, selection, shareId })\n  )\n\n  return { objects, links: compiledLinks }\n}\n\nfunction allDirectLinks(\n  ontology: OntologyDefinitionCatalog,\n  objectTypes: readonly ObjectType[]\n): readonly LinkPathSelection[] {\n  const selections: LinkPathSelection[] = []\n  const sortedObjectTypes = [...objectTypes].sort((a, b) => a.id.localeCompare(b.id))\n  const descendantIdsByType = new Map(\n    sortedObjectTypes.map((objectType) => [\n      objectType.id,\n      new Set(ontology.listSubTypes(objectType.id)),\n    ])\n  )\n\n  for (const objectType of sortedObjectTypes) {\n    for (const link of [...objectType.links].sort((a, b) => a.id.localeCompare(b.id))) {\n      const inheritedSelectionAlreadyCoversLink = sortedObjectTypes.some(\n        (candidate) =>\n          candidate.id !== objectType.id &&\n          descendantIdsByType.get(candidate.id)?.has(objectType.id) === true &&\n          candidate.links.some((candidateLink) => candidateLink.id === link.id)\n      )\n      if (inheritedSelectionAlreadyCoversLink) continue\n      selections.push({\n        kind: \"linkPathSelection\",\n        sourceObjectTypeId: objectType.id,\n        linkId: link.id,\n        targetObjectTypeId: link.targetObjectTypeId,\n        selection: { kind: \"none\" },\n      })\n    }\n  }\n  return selections\n}\n\nfunction compileLinkSelection(input: {\n  readonly ontology: OntologyDefinitionCatalog\n  readonly parentObjectTypeIds: readonly string[]\n  readonly selection: LinkPathSelection\n  readonly shareId: string\n}): ObjectReadLinkSelection {\n  const selectorSource = input.ontology.getObjectTypeById(input.selection.sourceObjectTypeId)\n  if (!selectorSource) {\n    throw invalid(\n      `Share '${input.shareId}' selects link '${input.selection.sourceObjectTypeId}.${input.selection.linkId}' on an unknown object type.`\n    )\n  }\n  const eligibleSourceIds = new Set([\n    selectorSource.id,\n    ...input.ontology.listSubTypes(selectorSource.id),\n  ])\n  const definitions: ObjectReadLinkDefinitionSelection[] = []\n  const targetObjectTypeIds = new Set<string>()\n\n  for (const sourceObjectTypeId of input.parentObjectTypeIds) {\n    if (!eligibleSourceIds.has(sourceObjectTypeId)) continue\n    const source = input.ontology.resolveObjectType(sourceObjectTypeId)\n    const link = source.links.find((candidate) => candidate.id === input.selection.linkId)\n    if (!link) continue\n    const concreteTargetIds = expandLinkTargets(input.ontology, link, input.shareId, source.id)\n    for (const id of concreteTargetIds) targetObjectTypeIds.add(id)\n    definitions.push({\n      sourceObjectTypeId: source.id,\n      linkId: link.id,\n      targetObjectTypeIds: concreteTargetIds,\n      propertyIds: uniqueSorted((link.properties ?? []).map((property) => property.id)),\n    })\n  }\n\n  if (definitions.length === 0) {\n    throw invalid(\n      `Share '${input.shareId}' link '${input.selection.sourceObjectTypeId}.${input.selection.linkId}' is not available at this path.`\n    )\n  }\n\n  return {\n    definitions: definitions.sort(compareLinkDefinitions),\n    target: compileNode(\n      input.ontology,\n      [...targetObjectTypeIds],\n      input.selection.selection,\n      input.shareId\n    ),\n  }\n}\n\nfunction expandLinkTargets(\n  ontology: OntologyDefinitionCatalog,\n  link: ObjectLink,\n  shareId: string,\n  sourceObjectTypeId: string\n): readonly string[] {\n  if (link.targetObjectTypeId === \"*\") {\n    return uniqueSorted(ontology.listObjectTypes().map((objectType) => objectType.id))\n  }\n  const authoredIds = Array.isArray(link.targetObjectTypeId)\n    ? link.targetObjectTypeId\n    : [link.targetObjectTypeId]\n  const result: string[] = []\n  for (const objectTypeId of authoredIds) {\n    if (!ontology.getObjectTypeById(objectTypeId)) {\n      throw invalid(\n        `Share '${shareId}' link '${sourceObjectTypeId}.${link.id}' targets unknown object type '${objectTypeId}'.`\n      )\n    }\n    result.push(objectTypeId, ...ontology.listSubTypes(objectTypeId))\n  }\n  return uniqueSorted(result)\n}\n\nfunction compareLinkDefinitions(\n  left: ObjectReadLinkDefinitionSelection,\n  right: ObjectReadLinkDefinitionSelection\n): number {\n  return (\n    left.sourceObjectTypeId.localeCompare(right.sourceObjectTypeId) ||\n    left.linkId.localeCompare(right.linkId)\n  )\n}\n\nfunction uniqueSorted(values: readonly string[]): string[] {\n  return [...new Set(values)].sort((a, b) => a.localeCompare(b))\n}\n\nfunction invalid(message: string): ShareDefinitionError {\n  return new ShareDefinitionError(`[Sixb] ${message}`)\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;AAwBO,SAAS,sBAAsB,CAAC,OAAqD;AAAA,EAC1F,MAAM,QAAQ,wBAAwB,MAAM,KAAK;AAAA,EACjD,MAAM,qBAAqB,MAAM,OAAO;AAAA,EACxC,IACE,MAAM,OAAO,iBAAiB,sBAC9B,OAAO,MAAM,OAAO,cAAc,YAClC,CAAC,MAAM,OAAO,UAAU,KAAK,GAC7B;AAAA,IACA,MAAM,QAAQ,UAAU,MAAM,0BAA0B,uCAAuC;AAAA,EACjG;AAAA,EACA,IAAI,CAAC,MAAM,SAAS,kBAAkB,kBAAkB,GAAG;AAAA,IACzD,MAAM,QACJ,UAAU,MAAM,oCAAoC,qEACtD;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,MAAM,OAAO,KAAK,CAAC,UAAmC,MAAM,SAAS,aAAa;AAAA,EAC/F,IAAI,CAAC,MAAM;AAAA,IACT,MAAM,QAAQ,UAAU,MAAM,kCAAkC;AAAA,EAClE;AAAA,EAEA,MAAM,OAAuB;AAAA,IAC3B,QAAQ;AAAA,MACN,cAAc;AAAA,MACd,WAAW,MAAM,OAAO;AAAA,IAC1B;AAAA,IACA,MAAM,YAAY,MAAM,UAAU,CAAC,kBAAkB,GAAG,KAAK,OAAO,MAAM,EAAE;AAAA,EAC9E;AAAA,EAEA,MAAM,SAA8C;AAAA,IAClD;AAAA,MACE,MAAM;AAAA,MACN,WAAW,EAAE,MAAM,YAAY,OAAO,CAAC,IAAI,EAAE;AAAA,IAC/C;AAAA,EACF;AAAA,EAEA,WAAW,SAAS,MAAM,QAAQ;AAAA,IAChC,IAAI,MAAM,SAAS;AAAA,MAAgB;AAAA,IACnC,MAAM,SAAS,MAAM,QAAQ,QAAQ,MAAM,QAAQ;AAAA,IACnD,IAAI,CAAC,UAAU,OAAO,QAAQ,SAAS,UAAU;AAAA,MAC/C,MAAM,QAAQ,UAAU,MAAM,4CAA4C,MAAM,YAAY;AAAA,IAC9F;AAAA,IACA,IACE,OAAO,QAAQ,WAAW,OAAO,sBACjC,MAAM,wBAAwB,oBAC9B;AAAA,MACA,MAAM,QACJ,UAAU,MAAM,eAAe,MAAM,yCAAyC,2DAChF;AAAA,IACF;AAAA,IACA,4BAA4B;AAAA,MAC1B,UAAU,MAAM;AAAA,MAChB,QAAQ,OAAO;AAAA,MACf,SAAS,MAAM;AAAA,MACf,UAAU,OAAO;AAAA,IACnB,CAAC;AAAA,IACD,OAAO,KAAK;AAAA,MACV,MAAM;AAAA,MACN,UAAU,OAAO;AAAA,MACjB,UAAU,CAAC,KAAK,MAAM,OAAO,CAAC;AAAA,IAChC,CAAC;AAAA,EACH;AAAA,EAEA,OAAO,wBAAwB,EAAE,OAAO,CAAC;AAAA;AAG3C,IAAM,8BAA8B,IAAI,IAAI;AAAA,EAC1C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMD,SAAS,2BAA2B,CAAC,OAK5B;AAAA,EACP,MAAM,cAAc,IAAI;AAAA,EACxB,MAAM,sBAAsB,IAAI;AAAA,EAEhC,MAAM,SAAS,CAAC,MAAc,SAAyC;AAAA,IACrE,MAAM,QACJ,UAAU,MAAM,oBAAoB,MAAM,wBAAwB,cAAc,2EAClF;AAAA;AAAA,EAGF,MAAM,YAAY,CAAC,SAAwB;AAAA,IACzC,MAAM,QACJ,UAAU,MAAM,oBAAoB,MAAM,wBAAwB,qDACpE;AAAA;AAAA,EAGF,MAAM,OAAO,CAAC,QAAiB,SAAuB;AAAA,IACpD,IAAI,OAAO,WAAW,UAAU;AAAA,MAC9B,IAAI,WAAW;AAAA,QAAW,OAAO,MAAM,SAAS;AAAA,MAChD,IAAI,CAAC,4BAA4B,IAAI,MAAM;AAAA,QAAG,UAAU,IAAI;AAAA,MAC5D;AAAA,IACF;AAAA,IACA,IAAI,CAAC,SAAS,MAAM;AAAA,MAAG,MAAM,UAAU,IAAI;AAAA,IAC3C,IAAI,YAAY,IAAI,MAAM;AAAA,MAAG;AAAA,IAC7B,YAAY,IAAI,MAAM;AAAA,IAEtB,QAAQ,OAAO;AAAA,WACR;AAAA,QACH,OAAO,MAAM,WAAW;AAAA,QACxB;AAAA,WACG;AAAA,QACH;AAAA,WACG,UAAU;AAAA,QACb,IAAI,CAAC,SAAS,OAAO,UAAU;AAAA,UAAG,MAAM,UAAU,IAAI;AAAA,QACtD,YAAY,SAAS,UAAU,OAAO,QAAQ,OAAO,UAAU,GAAG;AAAA,UAChE,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,YAAY,QAAQ;AAAA,YAC5C,MAAM,UAAU,GAAG,QAAQ,SAAS;AAAA,UACtC;AAAA,UACA,KAAK,MAAM,QAAQ,GAAG,QAAQ,SAAS;AAAA,QACzC;AAAA,QACA;AAAA,MACF;AAAA,WACK;AAAA,QACH,IAAI,EAAE,WAAW;AAAA,UAAS,MAAM,UAAU,IAAI;AAAA,QAC9C,KAAK,OAAO,OAAO,GAAG,QAAQ;AAAA,QAC9B;AAAA,WACG;AAAA,QACH,IAAI,EAAE,iBAAiB;AAAA,UAAS,MAAM,UAAU,IAAI;AAAA,QACpD,KAAK,OAAO,aAAa,GAAG,QAAQ;AAAA,QACpC;AAAA,WACG,gBAAgB;AAAA,QACnB,IAAI,OAAO,OAAO,gBAAgB,YAAY,CAAC,OAAO,YAAY,KAAK,GAAG;AAAA,UACxE,MAAM,UAAU,IAAI;AAAA,QACtB;AAAA,QACA,MAAM,cAAc,OAAO;AAAA,QAC3B,IAAI,oBAAoB,IAAI,WAAW,GAAG;AAAA,UAIxC,IAAI,OAAO,cAAc,WAAW;AAAA,YAClC,KAAK,OAAO,WAAW,GAAG,QAAQ,cAAc;AAAA,UAClD;AAAA,UACA;AAAA,QACF;AAAA,QAGA,MAAM,WACJ,MAAM,SAAS,kBAAkB,EAAE,IAAI,WAAW,GAAG,UAAU,OAAO;AAAA,QACxE,IAAI,aAAa,WAAW;AAAA,UAC1B,MAAM,QACJ,UAAU,MAAM,oBAAoB,MAAM,wBAAwB,uCAAuC,iDAC3G;AAAA,QACF;AAAA,QACA,oBAAoB,IAAI,WAAW;AAAA,QACnC,IAAI;AAAA,UACF,KAAK,UAAU,GAAG,QAAQ,cAAc;AAAA,kBACxC;AAAA,UACA,oBAAoB,OAAO,WAAW;AAAA;AAAA,QAExC;AAAA,MACF;AAAA;AAAA,QAEE,MAAM,UAAU,IAAI;AAAA;AAAA;AAAA,EAI1B,YAAY,SAAS,UAAU,OAAO,QAAQ,MAAM,MAAM,GAAG;AAAA,IAC3D,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,YAAY;AAAA,MAAQ,MAAM,UAAU,OAAO;AAAA,IACrE,KAAK,MAAM,QAAQ,OAAO;AAAA,EAC5B;AAAA;AAGF,SAAS,QAAQ,CAAC,OAAkD;AAAA,EAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA;AAG5E,SAAS,WAAW,CAClB,UACA,uBACA,OACA,SACgB;AAAA,EAChB,MAAM,gBAAgB,aAAa,qBAAqB;AAAA,EACxD,MAAM,cAAc,cAAc,IAAI,CAAC,OAAO,SAAS,kBAAkB,EAAE,CAAC;AAAA,EAC5E,MAAM,UAAuC,YAAY,IAAI,CAAC,gBAAgB;AAAA,IAC5E,cAAc,WAAW;AAAA,IACzB,aAAa,aAAa,WAAW,WAAW,IAAI,CAAC,aAAa,SAAS,EAAE,CAAC;AAAA,EAChF,EAAE;AAAA,EAEF,MAAM,gBACJ,MAAM,SAAS,SACX,CAAC,IACD,MAAM,SAAS,QACb,eAAe,UAAU,WAAW,IACpC,MAAM;AAAA,EAEd,MAAM,gBAAgB,cAAc,IAAI,CAAC,cACvC,qBAAqB,EAAE,UAAU,qBAAqB,eAAe,WAAW,QAAQ,CAAC,CAC3F;AAAA,EAEA,OAAO,EAAE,SAAS,OAAO,cAAc;AAAA;AAGzC,SAAS,cAAc,CACrB,UACA,aAC8B;AAAA,EAC9B,MAAM,aAAkC,CAAC;AAAA,EACzC,MAAM,oBAAoB,CAAC,GAAG,WAAW,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AAAA,EAClF,MAAM,sBAAsB,IAAI,IAC9B,kBAAkB,IAAI,CAAC,eAAe;AAAA,IACpC,WAAW;AAAA,IACX,IAAI,IAAI,SAAS,aAAa,WAAW,EAAE,CAAC;AAAA,EAC9C,CAAC,CACH;AAAA,EAEA,WAAW,cAAc,mBAAmB;AAAA,IAC1C,WAAW,QAAQ,CAAC,GAAG,WAAW,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC,GAAG;AAAA,MACjF,MAAM,sCAAsC,kBAAkB,KAC5D,CAAC,cACC,UAAU,OAAO,WAAW,MAC5B,oBAAoB,IAAI,UAAU,EAAE,GAAG,IAAI,WAAW,EAAE,MAAM,QAC9D,UAAU,MAAM,KAAK,CAAC,kBAAkB,cAAc,OAAO,KAAK,EAAE,CACxE;AAAA,MACA,IAAI;AAAA,QAAqC;AAAA,MACzC,WAAW,KAAK;AAAA,QACd,MAAM;AAAA,QACN,oBAAoB,WAAW;AAAA,QAC/B,QAAQ,KAAK;AAAA,QACb,oBAAoB,KAAK;AAAA,QACzB,WAAW,EAAE,MAAM,OAAO;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,oBAAoB,CAAC,OAKF;AAAA,EAC1B,MAAM,iBAAiB,MAAM,SAAS,kBAAkB,MAAM,UAAU,kBAAkB;AAAA,EAC1F,IAAI,CAAC,gBAAgB;AAAA,IACnB,MAAM,QACJ,UAAU,MAAM,0BAA0B,MAAM,UAAU,sBAAsB,MAAM,UAAU,oCAClG;AAAA,EACF;AAAA,EACA,MAAM,oBAAoB,IAAI,IAAI;AAAA,IAChC,eAAe;AAAA,IACf,GAAG,MAAM,SAAS,aAAa,eAAe,EAAE;AAAA,EAClD,CAAC;AAAA,EACD,MAAM,cAAmD,CAAC;AAAA,EAC1D,MAAM,sBAAsB,IAAI;AAAA,EAEhC,WAAW,sBAAsB,MAAM,qBAAqB;AAAA,IAC1D,IAAI,CAAC,kBAAkB,IAAI,kBAAkB;AAAA,MAAG;AAAA,IAChD,MAAM,SAAS,MAAM,SAAS,kBAAkB,kBAAkB;AAAA,IAClE,MAAM,OAAO,OAAO,MAAM,KAAK,CAAC,cAAc,UAAU,OAAO,MAAM,UAAU,MAAM;AAAA,IACrF,IAAI,CAAC;AAAA,MAAM;AAAA,IACX,MAAM,oBAAoB,kBAAkB,MAAM,UAAU,MAAM,MAAM,SAAS,OAAO,EAAE;AAAA,IAC1F,WAAW,MAAM;AAAA,MAAmB,oBAAoB,IAAI,EAAE;AAAA,IAC9D,YAAY,KAAK;AAAA,MACf,oBAAoB,OAAO;AAAA,MAC3B,QAAQ,KAAK;AAAA,MACb,qBAAqB;AAAA,MACrB,aAAa,cAAc,KAAK,cAAc,CAAC,GAAG,IAAI,CAAC,aAAa,SAAS,EAAE,CAAC;AAAA,IAClF,CAAC;AAAA,EACH;AAAA,EAEA,IAAI,YAAY,WAAW,GAAG;AAAA,IAC5B,MAAM,QACJ,UAAU,MAAM,kBAAkB,MAAM,UAAU,sBAAsB,MAAM,UAAU,wCAC1F;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,aAAa,YAAY,KAAK,sBAAsB;AAAA,IACpD,QAAQ,YACN,MAAM,UACN,CAAC,GAAG,mBAAmB,GACvB,MAAM,UAAU,WAChB,MAAM,OACR;AAAA,EACF;AAAA;AAGF,SAAS,iBAAiB,CACxB,UACA,MACA,SACA,oBACmB;AAAA,EACnB,IAAI,KAAK,uBAAuB,KAAK;AAAA,IACnC,OAAO,aAAa,SAAS,gBAAgB,EAAE,IAAI,CAAC,eAAe,WAAW,EAAE,CAAC;AAAA,EACnF;AAAA,EACA,MAAM,cAAc,MAAM,QAAQ,KAAK,kBAAkB,IACrD,KAAK,qBACL,CAAC,KAAK,kBAAkB;AAAA,EAC5B,MAAM,SAAmB,CAAC;AAAA,EAC1B,WAAW,gBAAgB,aAAa;AAAA,IACtC,IAAI,CAAC,SAAS,kBAAkB,YAAY,GAAG;AAAA,MAC7C,MAAM,QACJ,UAAU,kBAAkB,sBAAsB,KAAK,oCAAoC,gBAC7F;AAAA,IACF;AAAA,IACA,OAAO,KAAK,cAAc,GAAG,SAAS,aAAa,YAAY,CAAC;AAAA,EAClE;AAAA,EACA,OAAO,aAAa,MAAM;AAAA;AAG5B,SAAS,sBAAsB,CAC7B,MACA,OACQ;AAAA,EACR,OACE,KAAK,mBAAmB,cAAc,MAAM,kBAAkB,KAC9D,KAAK,OAAO,cAAc,MAAM,MAAM;AAAA;AAI1C,SAAS,YAAY,CAAC,QAAqC;AAAA,EACzD,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AAAA;AAG/D,SAAS,OAAO,CAAC,SAAuC;AAAA,EACtD,OAAO,IAAI,sBAAqB,UAAU,SAAS;AAAA;",
+  "debugId": "5F055D742F48F79B64756E2164756E21",
+  "names": []
+}

package/dist/{chunk-ka3a2ft3.js → chunk-b19g04jk.js}

@@ -1,13 +1,13 @@
 // @bun
 import {
-  parseSixbFailure
-} from "./chunk-2xns679x.js";
+  parseSixbFailure2
+} from "./chunk-f4w3yp4f.js";
 import {
   isPlainRecord
-} from "./chunk-n6jxh8sw.js";
+} from "./chunk-wy0qdqfm.js";
 
 // src/storage/action-runs/types.ts
-var ACTION_RUN_PHASES = [
+var ACTION_RUN_PHASES2 = [
   "request",
   "enqueue",
   "validation",
@@ -17,7 +17,7 @@ var ACTION_RUN_PHASES = [
   "effects",
   "cancelled"
 ];
-var ACTION_RUN_FAILURE_CODES = [
+var ACTION_RUN_FAILURE_CODES2 = [
   "internal.unexpected",
   "runtime.cancelled",
   "queue.enqueue_failed",
@@ -25,15 +25,15 @@ var ACTION_RUN_FAILURE_CODES = [
 ];
 
 // src/storage/action-runs/failure.ts
-function serializeActionRunFailure(failure, expectedPhase) {
-  const parsed = expectedPhase === undefined ? parseActionRunFailure(failure) : parseActionRunFailure(failure, expectedPhase);
+function serializeActionRunFailure2(failure, expectedPhase) {
+  const parsed = expectedPhase === undefined ? parseActionRunFailure2(failure) : parseActionRunFailure2(failure, expectedPhase);
   return JSON.stringify(parsed);
 }
-function parseActionRunFailure(value, expectedPhase) {
+function parseActionRunFailure2(value, expectedPhase) {
   const candidate = parseStoredActionRunFailureValue(value);
-  const failure = parseSixbFailure(candidate, ACTION_RUN_FAILURE_CODES);
+  const failure = parseSixbFailure2(candidate, ACTION_RUN_FAILURE_CODES2);
   const details = failure.details;
-  if (!isPlainRecord(details) || typeof details.actionId !== "string" || typeof details.runId !== "string" || typeof details.phase !== "string" || !ACTION_RUN_PHASES.includes(details.phase)) {
+  if (!isPlainRecord(details) || typeof details.actionId !== "string" || typeof details.runId !== "string" || typeof details.phase !== "string" || !ACTION_RUN_PHASES2.includes(details.phase)) {
     throw new Error("[Sixb] Stored failure is invalid: Action details must contain actionId, runId, and a known phase.");
   }
   if (expectedPhase !== undefined && details.phase !== expectedPhase) {
@@ -54,6 +54,6 @@ function parseStoredActionRunFailureValue(value) {
   }
 }
 
-export { ACTION_RUN_PHASES, ACTION_RUN_FAILURE_CODES, serializeActionRunFailure, parseActionRunFailure };
+export { ACTION_RUN_PHASES2, ACTION_RUN_FAILURE_CODES2, serializeActionRunFailure2, parseActionRunFailure2 };
 
-//# debugId=C0AEB0A8D7FE678664756E2164756E21
+//# debugId=10E96C378A97739664756E2164756E21

package/dist/{chunk-ka3a2ft3.js.map → chunk-b19g04jk.js.map}

@@ -5,7 +5,7 @@
     "import type { ActionSubject } from \"../../actions\"\nimport type { SixbErrorCode, SixbFailure } from \"../../errors/types\"\nimport type { JsonValue } from \"../../json\"\n\nexport type ActionRunStatus = \"queued\" | \"running\" | \"succeeded\" | \"failed\" | \"cancelled\"\n\nexport const ACTION_RUN_PHASES = [\n  \"request\",\n  \"enqueue\",\n  \"validation\",\n  \"writeback\",\n  \"edits\",\n  \"commit\",\n  \"effects\",\n  \"cancelled\",\n] as const\n\nexport type ActionRunPhase = (typeof ACTION_RUN_PHASES)[number]\n\nexport type ActionRunParams = Readonly<Record<string, JsonValue>>\n\nexport type ActionRunPhaseStatus = \"succeeded\" | \"failed\"\n\n/** Error codes an action run or phase record can persist and expose. */\nexport const ACTION_RUN_FAILURE_CODES = [\n  \"internal.unexpected\",\n  \"runtime.cancelled\",\n  \"queue.enqueue_failed\",\n  \"action.phase_failed\",\n] as const satisfies readonly [SixbErrorCode, ...SixbErrorCode[]]\n\nexport type ActionRunFailureCode = (typeof ACTION_RUN_FAILURE_CODES)[number]\n\nexport interface ActionRunFailureDetails<TPhase extends ActionRunPhase = ActionRunPhase> {\n  readonly actionId: string\n  readonly runId: string\n  readonly phase: TPhase\n}\n\n/** Portable failure record with Action's required correlation details. */\nexport interface ActionRunFailure<TPhase extends ActionRunPhase = ActionRunPhase>\n  extends Omit<SixbFailure<ActionRunFailureCode>, \"details\"> {\n  readonly details: ActionRunFailureDetails<TPhase>\n}\n\nexport type ActionRunWritebackRecord =\n  | {\n      readonly status: \"succeeded\"\n      readonly completedAt: Date\n      readonly result: JsonValue\n      readonly error?: never\n    }\n  | {\n      readonly status: \"failed\"\n      readonly completedAt: Date\n      readonly result?: never\n      readonly error: ActionRunFailure<\"writeback\">\n    }\n\nexport type ActionRunEffectsRecord =\n  | {\n      readonly status: \"succeeded\"\n      readonly completedAt: Date\n      readonly error?: never\n    }\n  | {\n      readonly status: \"failed\"\n      readonly completedAt: Date\n      readonly error: ActionRunFailure<\"effects\">\n    }\n\nexport interface ActionRunRecord {\n  readonly id: string\n  readonly projectId: string\n  readonly executionId: string\n  readonly actionId: string\n  readonly subject: ActionSubject\n  readonly status: ActionRunStatus\n  readonly phase?: ActionRunPhase\n  readonly queuedAt: Date\n  readonly startedAt?: Date\n  readonly finishedAt?: Date\n  readonly params: ActionRunParams\n  readonly idempotencyKey: string\n  readonly writeback?: ActionRunWritebackRecord\n  readonly effects?: ActionRunEffectsRecord\n  readonly error?: ActionRunFailure\n}\n\nexport interface QueueActionRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly executionId: string\n  readonly actionId: string\n  readonly subject: ActionSubject\n  readonly params: ActionRunParams\n  readonly idempotencyKey: string\n  readonly queuedAt?: Date\n}\n\nexport interface StartActionRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly startedAt?: Date\n  readonly phase?: Extract<ActionRunPhase, \"validation\">\n}\n\nexport interface EnterActionRunPhaseInput {\n  readonly id: string\n  readonly projectId: string\n  readonly phase: Extract<\n    ActionRunPhase,\n    \"validation\" | \"writeback\" | \"edits\" | \"commit\" | \"effects\"\n  >\n}\n\nexport type RecordActionWritebackInput =\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"succeeded\"\n      readonly completedAt?: Date\n      readonly result: JsonValue\n    }\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"failed\"\n      readonly completedAt?: Date\n      readonly error: ActionRunFailure<\"writeback\">\n    }\n\nexport type RecordActionEffectsInput =\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"succeeded\"\n      readonly completedAt?: Date\n    }\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"failed\"\n      readonly completedAt?: Date\n      readonly error: ActionRunFailure<\"effects\">\n    }\n\nexport type FinishActionRunInput =\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"succeeded\"\n      readonly finishedAt?: Date\n      readonly phase?: ActionRunPhase\n    }\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"failed\" | \"cancelled\"\n      readonly finishedAt?: Date\n      readonly error: ActionRunFailure\n    }\n\nexport interface ListActionRunsInput {\n  readonly projectId: string\n  readonly actionId?: string\n  readonly actionIds?: readonly string[]\n  readonly subject?: ActionSubject\n  readonly objectTypeId?: string\n  readonly objectTypeIds?: readonly string[]\n  readonly primaryId?: string\n  readonly statuses?: readonly ActionRunStatus[]\n  readonly startedAfter?: Date\n  readonly startedBefore?: Date\n  readonly limit?: number\n  readonly offset?: number\n  readonly order?: \"asc\" | \"desc\"\n}\n\nexport interface ListActionRunsResult {\n  readonly runs: readonly ActionRunRecord[]\n  readonly hasMore: boolean\n  readonly total: number\n}\n\nexport interface LockActionMaterializationRunInput {\n  readonly projectId: string\n  readonly actionId: string\n  readonly runId: string\n}\n\nexport interface ActionRunStorage {\n  /** Transactional fence for Action identity and running state before a new ontology commit. */\n  lockForMaterialization(input: LockActionMaterializationRunInput): Promise<ActionRunRecord>\n  queue(input: QueueActionRunInput): Promise<ActionRunRecord>\n  start(input: StartActionRunInput): Promise<ActionRunRecord>\n  enterPhase(input: EnterActionRunPhaseInput): Promise<ActionRunRecord>\n  recordWriteback(input: RecordActionWritebackInput): Promise<ActionRunRecord>\n  recordEffects(input: RecordActionEffectsInput): Promise<ActionRunRecord>\n  finish(input: FinishActionRunInput): Promise<ActionRunRecord>\n  getById(params: { projectId: string; id: string }): Promise<ActionRunRecord | null>\n  list(input: ListActionRunsInput): Promise<ListActionRunsResult>\n}\n",
     "import { parseSixbFailure } from \"../../errors/internal\"\nimport { isPlainRecord } from \"../../json\"\nimport {\n  ACTION_RUN_FAILURE_CODES,\n  ACTION_RUN_PHASES,\n  type ActionRunFailure,\n  type ActionRunFailureDetails,\n  type ActionRunPhase,\n} from \"./types\"\n\n/** Serializes the canonical failure plus Action's typed lifecycle extension. */\nexport function serializeActionRunFailure<TPhase extends ActionRunPhase>(\n  failure: ActionRunFailure<TPhase>,\n  expectedPhase?: TPhase\n): string {\n  const parsed =\n    expectedPhase === undefined\n      ? parseActionRunFailure(failure)\n      : parseActionRunFailure(failure, expectedPhase)\n  return JSON.stringify(parsed)\n}\n\n/** Validates and detaches an Action failure read from a storage boundary. */\nexport function parseActionRunFailure<TPhase extends ActionRunPhase>(\n  value: unknown,\n  expectedPhase: TPhase\n): ActionRunFailure<TPhase>\nexport function parseActionRunFailure(value: unknown): ActionRunFailure\nexport function parseActionRunFailure(\n  value: unknown,\n  expectedPhase?: ActionRunPhase\n): ActionRunFailure {\n  const candidate = parseStoredActionRunFailureValue(value)\n  const failure = parseSixbFailure(candidate, ACTION_RUN_FAILURE_CODES)\n  const details = failure.details\n  if (\n    !isPlainRecord(details) ||\n    typeof details.actionId !== \"string\" ||\n    typeof details.runId !== \"string\" ||\n    typeof details.phase !== \"string\" ||\n    !(ACTION_RUN_PHASES as readonly string[]).includes(details.phase)\n  ) {\n    throw new Error(\n      \"[Sixb] Stored failure is invalid: Action details must contain actionId, runId, and a known phase.\"\n    )\n  }\n  if (expectedPhase !== undefined && details.phase !== expectedPhase) {\n    throw new Error(`[Sixb] Stored Action ${expectedPhase} failure has phase '${details.phase}'.`)\n  }\n\n  return {\n    ...failure,\n    details: details as unknown as ActionRunFailureDetails,\n  }\n}\n\nfunction parseStoredActionRunFailureValue(value: unknown): unknown {\n  if (typeof value !== \"string\") return value\n  try {\n    return JSON.parse(value) as unknown\n  } catch {\n    throw new Error(\"[Sixb] Stored failure is invalid: value is not valid JSON.\")\n  }\n}\n"
   ],
-  "mappings": ";;;;;;;;;AAMO,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASO,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;AClBO,SAAS,yBAAwD,CACtE,SACA,eACQ;AAAA,EACR,MAAM,SACJ,kBAAkB,YACd,sBAAsB,OAAO,IAC7B,sBAAsB,SAAS,aAAa;AAAA,EAClD,OAAO,KAAK,UAAU,MAAM;AAAA;AASvB,SAAS,qBAAqB,CACnC,OACA,eACkB;AAAA,EAClB,MAAM,YAAY,iCAAiC,KAAK;AAAA,EACxD,MAAM,UAAU,iBAAiB,WAAW,wBAAwB;AAAA,EACpE,MAAM,UAAU,QAAQ;AAAA,EACxB,IACE,CAAC,cAAc,OAAO,KACtB,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,UAAU,YACzB,OAAO,QAAQ,UAAU,YACzB,CAAE,kBAAwC,SAAS,QAAQ,KAAK,GAChE;AAAA,IACA,MAAM,IAAI,MACR,mGACF;AAAA,EACF;AAAA,EACA,IAAI,kBAAkB,aAAa,QAAQ,UAAU,eAAe;AAAA,IAClE,MAAM,IAAI,MAAM,wBAAwB,oCAAoC,QAAQ,SAAS;AAAA,EAC/F;AAAA,EAEA,OAAO;AAAA,OACF;AAAA,IACH;AAAA,EACF;AAAA;AAGF,SAAS,gCAAgC,CAAC,OAAyB;AAAA,EACjE,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,IAAI;AAAA,IACF,OAAO,KAAK,MAAM,KAAK;AAAA,IACvB,MAAM;AAAA,IACN,MAAM,IAAI,MAAM,4DAA4D;AAAA;AAAA;",
-  "debugId": "C0AEB0A8D7FE678664756E2164756E21",
+  "mappings": ";;;;;;;;;AAMO,IAAM,qBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASO,IAAM,4BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;AClBO,SAAS,0BAAwD,CACtE,SACA,eACQ;AAAA,EACR,MAAM,SACJ,kBAAkB,YACd,uBAAsB,OAAO,IAC7B,uBAAsB,SAAS,aAAa;AAAA,EAClD,OAAO,KAAK,UAAU,MAAM;AAAA;AASvB,SAAS,sBAAqB,CACnC,OACA,eACkB;AAAA,EAClB,MAAM,YAAY,iCAAiC,KAAK;AAAA,EACxD,MAAM,UAAU,kBAAiB,WAAW,yBAAwB;AAAA,EACpE,MAAM,UAAU,QAAQ;AAAA,EACxB,IACE,CAAC,cAAc,OAAO,KACtB,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,UAAU,YACzB,OAAO,QAAQ,UAAU,YACzB,CAAE,mBAAwC,SAAS,QAAQ,KAAK,GAChE;AAAA,IACA,MAAM,IAAI,MACR,mGACF;AAAA,EACF;AAAA,EACA,IAAI,kBAAkB,aAAa,QAAQ,UAAU,eAAe;AAAA,IAClE,MAAM,IAAI,MAAM,wBAAwB,oCAAoC,QAAQ,SAAS;AAAA,EAC/F;AAAA,EAEA,OAAO;AAAA,OACF;AAAA,IACH;AAAA,EACF;AAAA;AAGF,SAAS,gCAAgC,CAAC,OAAyB;AAAA,EACjE,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,IAAI;AAAA,IACF,OAAO,KAAK,MAAM,KAAK;AAAA,IACvB,MAAM;AAAA,IACN,MAAM,IAAI,MAAM,4DAA4D;AAAA;AAAA;",
+  "debugId": "10E96C378A97739664756E2164756E21",
   "names": []
 }

package/dist/chunk-br3k6qbf.js

@@ -0,0 +1,436 @@
+// @bun
+import {
+  compileSelectedObjectReadScope2,
+  captureSelectedObjectReadScope
+} from "./chunk-v4jbb3rs.js";
+import {
+  stableJsonStringify2
+} from "./chunk-wy0qdqfm.js";
+
+// src/storage/share-grants/errors.ts
+class ShareGrantStorageError2 extends Error {
+  code;
+  name = "ShareGrantStorageError";
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+  }
+}
+
+// src/shares/access-plan.ts
+var MAX_SCOPED_GRANTS = 1024;
+var MAX_SCOPED_VIEW_ROOTS_BEFORE_COMPILATION = 1024;
+var MAX_SCOPED_ACTION_SUBJECTS = 4096;
+var MAX_SCOPED_ACTION_IDENTIFIER_CHARACTERS = 1e6;
+function snapshotShareAccessPlan(input) {
+  const captured = captureAccessPlanGrants(input);
+  const selection = validateMergedViewSelection(captured.viewRoots);
+  return assembleAccessPlanSnapshot(captured.grants, selection);
+}
+function captureAccessPlanGrants(input) {
+  if (!isRecord(input)) {
+    throw new Error("[Sixb] Share access plan must contain scoped grants.");
+  }
+  const authoredGrants = input.grants;
+  if (!Array.isArray(authoredGrants)) {
+    throw new Error("[Sixb] Share access plan must contain scoped grants.");
+  }
+  const grantCount = authoredGrants.length;
+  if (grantCount > MAX_SCOPED_GRANTS) {
+    throw new Error(`[Sixb] Share access plan exceeds the maximum of ${MAX_SCOPED_GRANTS} scoped grants.`);
+  }
+  const budget = { subjectCount: 0, identifierCharacters: 0 };
+  const viewRoots = [];
+  const grants = [];
+  for (let index = 0;index < grantCount; index += 1) {
+    const grant = authoredGrants[index];
+    if (!isRecord(grant)) {
+      throw new Error(`[Sixb] Scoped grant ${index} must be an object.`);
+    }
+    const kind = grant.kind;
+    switch (kind) {
+      case "object.view":
+        grants.push(captureViewGrant(grant, index, viewRoots));
+        break;
+      case "action.apply":
+        grants.push(captureActionGrant(grant, index, budget));
+        break;
+      default:
+        throw new Error(`[Sixb] Unknown scoped grant kind '${String(kind)}'.`);
+    }
+  }
+  return { grants, viewRoots };
+}
+function captureViewGrant(grant, index, viewRoots) {
+  const selection = grant.selection;
+  if (!isRecord(selection)) {
+    throw new Error(`[Sixb] Scoped grant ${index} requires a selected object read scope.`);
+  }
+  const selectionKind = selection.kind;
+  const roots = selection.roots;
+  if (selectionKind !== "selected" || !Array.isArray(roots)) {
+    throw new Error(`[Sixb] Scoped grant ${index} requires a selected object read scope.`);
+  }
+  const rootCount = roots.length;
+  if (rootCount > MAX_SCOPED_VIEW_ROOTS_BEFORE_COMPILATION - viewRoots.length) {
+    throw new Error(`[Sixb] Share access plan exceeds the maximum of ${MAX_SCOPED_VIEW_ROOTS_BEFORE_COMPILATION} raw scoped view roots.`);
+  }
+  const rootStart = viewRoots.length;
+  for (let rootIndex = 0;rootIndex < rootCount; rootIndex += 1) {
+    viewRoots.push(roots[rootIndex]);
+  }
+  return { kind: "object.view", rootStart, rootCount };
+}
+function captureActionGrant(grant, index, budget) {
+  const authoredActionId = grant.actionId;
+  const authoredSubjects = grant.subjects;
+  const actionId = nonEmpty(authoredActionId, `Scoped grant ${index} action id`);
+  addActionIdentifierCharacters(budget, actionId.length);
+  if (!Array.isArray(authoredSubjects)) {
+    throw new Error(`[Sixb] Scoped grant ${index} action subjects must be an array.`);
+  }
+  const subjectCount = authoredSubjects.length;
+  budget.subjectCount += subjectCount;
+  if (budget.subjectCount > MAX_SCOPED_ACTION_SUBJECTS) {
+    throw new Error(`[Sixb] Share access plan exceeds the maximum of ${MAX_SCOPED_ACTION_SUBJECTS} scoped action subjects.`);
+  }
+  const subjects = [];
+  for (let subjectIndex = 0;subjectIndex < subjectCount; subjectIndex += 1) {
+    const subject = captureActionSubject(authoredSubjects[subjectIndex], index, subjectIndex);
+    addActionIdentifierCharacters(budget, subject.objectTypeId.length + subject.primaryId.length);
+    subjects.push(subject);
+  }
+  return Object.freeze({ kind: "action.apply", actionId, subjects: Object.freeze(subjects) });
+}
+function captureActionSubject(subject, grantIndex, subjectIndex) {
+  if (!isRecord(subject)) {
+    throw new Error(`[Sixb] Scoped grant ${grantIndex} subject ${subjectIndex} must be an object.`);
+  }
+  const authoredObjectTypeId = subject.objectTypeId;
+  const authoredPrimaryId = subject.primaryId;
+  const objectTypeId = nonEmpty(authoredObjectTypeId, `Scoped grant ${grantIndex} subject ${subjectIndex} object type id`);
+  const primaryId = nonEmpty(authoredPrimaryId, `Scoped grant ${grantIndex} subject ${subjectIndex} primary id`);
+  return Object.freeze({ objectTypeId, primaryId });
+}
+function addActionIdentifierCharacters(budget, count) {
+  budget.identifierCharacters += count;
+  if (budget.identifierCharacters > MAX_SCOPED_ACTION_IDENTIFIER_CHARACTERS) {
+    throw new Error(`[Sixb] Share access plan exceeds the maximum of ${MAX_SCOPED_ACTION_IDENTIFIER_CHARACTERS} scoped action identifier characters.`);
+  }
+}
+function validateMergedViewSelection(roots) {
+  const selection = captureSelectedObjectReadScope({ kind: "selected", roots });
+  compileSelectedObjectReadScope2(selection);
+  return selection;
+}
+function assembleAccessPlanSnapshot(capturedGrants, selection) {
+  const grants = capturedGrants.map((grant) => {
+    if (grant.kind === "action.apply")
+      return grant;
+    const roots = Object.freeze(selection.roots.slice(grant.rootStart, grant.rootStart + grant.rootCount));
+    return Object.freeze({
+      kind: "object.view",
+      selection: Object.freeze({ kind: "selected", roots })
+    });
+  });
+  return Object.freeze({ grants: Object.freeze(grants) });
+}
+function objectReadScopeForAccessPlan(plan) {
+  return Object.freeze({
+    kind: "selected",
+    roots: Object.freeze(plan.grants.flatMap((grant) => grant.kind === "object.view" ? [...grant.selection.roots] : []))
+  });
+}
+function nonEmpty(value, label) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`[Sixb] ${label} must not be empty.`);
+  }
+  return value;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// src/storage/share-grants/record.ts
+import { createHash } from "crypto";
+var DEFAULT_LIST_LIMIT = 50;
+var MAX_LIST_LIMIT = 200;
+var MAX_DESTINATION_PATH_LENGTH = 4096;
+var SHA256_HEX = /^[0-9a-f]{64}$/;
+var SHARED_APP_PATH_PREFIX = "/shared";
+function normalizeShareGrantCreate2(input) {
+  if (!isRecord2(input))
+    throw invalidInput("Share grant create input must be an object.");
+  const projectId = identifier(input.projectId, "Project id");
+  const id = identifier(input.id, "Share grant id");
+  const definitionId = identifier(input.definitionId, "Share definition id");
+  const target = normalizeObjectRef(input.target, "Share target");
+  const issuedBy = normalizeAuthorizablePrincipal(input.issuedBy, "Share issuer");
+  const authoritySnapshot = normalizeAuthoritySnapshot(input.authoritySnapshot, target);
+  const tokenHash = sha256(input.tokenHash, "Share token hash");
+  const destinationPath = normalizeDestinationPath(input.destinationPath);
+  const createdAt = inputDate(input.createdAt, "Share creation time");
+  const expiresAt = inputDate(input.expiresAt, "Share expiry time");
+  if (expiresAt.getTime() <= createdAt.getTime()) {
+    throw invalidInput("Share expiry time must be later than creation time.");
+  }
+  return {
+    id,
+    projectId,
+    definitionId,
+    target,
+    issuedBy,
+    authoritySnapshot,
+    authorityDigest: shareAuthorityDigest2(authoritySnapshot),
+    tokenHash,
+    destinationPath,
+    createdAt,
+    expiresAt
+  };
+}
+function parseShareGrantRecord2(input) {
+  if (!isRecord2(input))
+    throw invalidRecord("Share grant row must be an object.");
+  try {
+    const projectId = identifier(input.projectId, "Project id");
+    const id = identifier(input.id, "Share grant id");
+    const definitionId = identifier(input.definitionId, "Share definition id");
+    const target = normalizeObjectRef(input.target, "Share target");
+    const issuedBy = normalizeAuthorizablePrincipal(input.issuedBy, "Share issuer");
+    const authoritySnapshot = normalizeAuthoritySnapshot(input.authoritySnapshot, target);
+    const authorityDigest = sha256(input.authorityDigest, "Share authority digest");
+    const expectedDigest = shareAuthorityDigest2(authoritySnapshot);
+    if (authorityDigest !== expectedDigest) {
+      throw invalidRecord("Share authority digest does not match its snapshot.");
+    }
+    const tokenHash = sha256(input.tokenHash, "Share token hash");
+    const destinationPath = normalizeDestinationPath(input.destinationPath);
+    const createdAt = storedDate(input.createdAt, "Share creation time");
+    const expiresAt = storedDate(input.expiresAt, "Share expiry time");
+    if (expiresAt.getTime() <= createdAt.getTime()) {
+      throw invalidRecord("Share expiry time must be later than creation time.");
+    }
+    const revokedAtValue = input.revokedAt;
+    const revokedByValue = input.revokedBy;
+    if (revokedAtValue === undefined !== (revokedByValue === undefined)) {
+      throw invalidRecord("Share revocation time and actor must be stored together.");
+    }
+    if (revokedAtValue === null || revokedByValue === null) {
+      throw invalidRecord("Share revocation fields must be omitted rather than null.");
+    }
+    const revokedAt = revokedAtValue === undefined ? undefined : storedDate(revokedAtValue, "Share revocation time");
+    const revokedBy = revokedByValue === undefined ? undefined : normalizePrincipal(revokedByValue, "Share revocation actor");
+    if (revokedAt && revokedAt.getTime() < createdAt.getTime()) {
+      throw invalidRecord("Share revocation time must not precede creation time.");
+    }
+    return {
+      id,
+      projectId,
+      definitionId,
+      target,
+      issuedBy,
+      authoritySnapshot,
+      authorityDigest,
+      tokenHash,
+      destinationPath,
+      createdAt,
+      expiresAt,
+      ...revokedAt === undefined ? {} : { revokedAt },
+      ...revokedBy === undefined ? {} : { revokedBy }
+    };
+  } catch (error) {
+    if (error instanceof ShareGrantStorageError2) {
+      if (error.code === "invalid_record")
+        throw error;
+      throw invalidRecord(error.message.replace(/^\[Sixb\] /, ""), error);
+    }
+    throw error;
+  }
+}
+function normalizeGetShareGrantByIdInput2(input) {
+  if (!isRecord2(input))
+    throw invalidInput("Share grant lookup input must be an object.");
+  return {
+    projectId: identifier(input.projectId, "Project id"),
+    id: identifier(input.id, "Share grant id")
+  };
+}
+function normalizeListShareGrantsInput2(input) {
+  if (!isRecord2(input))
+    throw invalidInput("Share grant list input must be an object.");
+  const projectId = identifier(input.projectId, "Project id");
+  const definitionId = input.definitionId === undefined ? undefined : identifier(input.definitionId, "Share definition id");
+  const target = input.target === undefined ? undefined : normalizeObjectRef(input.target, "Share target");
+  const includeRevoked = optionalBoolean(input.includeRevoked, "includeRevoked");
+  const includeExpired = optionalBoolean(input.includeExpired, "includeExpired");
+  const now = inputDate(input.now, "Share grant list time");
+  const limit = safeInteger(input.limit ?? DEFAULT_LIST_LIMIT, "Share grant list limit", 1);
+  const offset = safeInteger(input.offset ?? 0, "Share grant list offset", 0);
+  if (limit > MAX_LIST_LIMIT) {
+    throw invalidInput(`Share grant list limit must not exceed ${MAX_LIST_LIMIT}.`);
+  }
+  return {
+    projectId,
+    ...definitionId === undefined ? {} : { definitionId },
+    ...target === undefined ? {} : { target },
+    includeRevoked,
+    includeExpired,
+    now,
+    limit,
+    offset
+  };
+}
+function normalizeRevokeShareGrantInput2(input, createdAt) {
+  if (!isRecord2(input))
+    throw invalidInput("Share grant revocation input must be an object.");
+  const normalized = {
+    projectId: identifier(input.projectId, "Project id"),
+    id: identifier(input.id, "Share grant id"),
+    revokedAt: inputDate(input.revokedAt, "Share revocation time"),
+    revokedBy: normalizePrincipal(input.revokedBy, "Share revocation actor")
+  };
+  if (createdAt && normalized.revokedAt.getTime() < createdAt.getTime()) {
+    throw invalidInput("Share revocation time must not precede creation time.");
+  }
+  return normalized;
+}
+function cloneShareGrantRecord2(input) {
+  return structuredClone(input);
+}
+function shareAuthorityDigest2(snapshot) {
+  return createHash("sha256").update(stableJsonStringify2(snapshot)).digest("hex");
+}
+function normalizeAuthoritySnapshot(value, target) {
+  if (!isRecord2(value) || value.version !== 1 || !isRecord2(value.access)) {
+    throw invalidInput("Share authority snapshot version is unsupported.");
+  }
+  let access;
+  try {
+    access = snapshotShareAccessPlan(value.access);
+  } catch (error) {
+    if (error instanceof ShareGrantStorageError2)
+      throw error;
+    const reason = error instanceof Error ? error.message.replace(/^\[Sixb\] /, "") : String(error);
+    throw invalidInput(`Share authority snapshot is invalid: ${reason}`, error);
+  }
+  assertAccessTargets(access, target);
+  return Object.freeze({ version: 1, access });
+}
+function assertAccessTargets(access, target) {
+  for (const grant of access.grants) {
+    if (grant.kind === "object.view") {
+      for (const root of grant.selection.roots) {
+        if (!sameObjectRef(root.anchor, target)) {
+          throw invalidInput("Every Share view root must match the exact Share target.");
+        }
+      }
+      continue;
+    }
+    for (const subject of grant.subjects) {
+      if (!sameObjectRef(subject, target)) {
+        throw invalidInput("Every shared Action subject must match the exact Share target.");
+      }
+    }
+  }
+}
+function sameObjectRef(left, right) {
+  return left.objectTypeId === right.objectTypeId && left.primaryId === right.primaryId;
+}
+function normalizeObjectRef(value, label) {
+  if (!isRecord2(value))
+    throw invalidInput(`${label} must be an exact object reference.`);
+  return Object.freeze({
+    objectTypeId: identifier(value.objectTypeId, `${label} object type id`),
+    primaryId: identifier(value.primaryId, `${label} primary id`)
+  });
+}
+function normalizeAuthorizablePrincipal(value, label) {
+  const principal = normalizePrincipal(value, label);
+  if (principal.type === "system") {
+    throw invalidInput(`${label} must be a user or service account.`);
+  }
+  return principal;
+}
+function normalizePrincipal(value, label) {
+  if (!isRecord2(value))
+    throw invalidInput(`${label} must be a principal.`);
+  if (value.type !== "user" && value.type !== "serviceAccount" && value.type !== "system") {
+    throw invalidInput(`${label} has an unsupported type.`);
+  }
+  return Object.freeze({ type: value.type, id: identifier(value.id, `${label} id`) });
+}
+function normalizeDestinationPath(value) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw invalidInput("Share destination path must not be empty.");
+  }
+  if (value.length > MAX_DESTINATION_PATH_LENGTH) {
+    throw invalidInput(`Share destination path must not exceed ${MAX_DESTINATION_PATH_LENGTH} characters.`);
+  }
+  if (!value.startsWith("/") || value.includes("//") || value.includes("?") || value.includes("#") || value.includes("\\") || value.includes("\x00")) {
+    throw invalidInput("Share destination path must be an absolute same-origin pathname without query or fragment.");
+  }
+  const normalized = new URL(value, "https://sixb.invalid").pathname;
+  if (normalized !== value) {
+    throw invalidInput("Share destination path must already be canonical.");
+  }
+  let decoded;
+  try {
+    decoded = decodeURIComponent(value).replaceAll("\\", "/");
+  } catch {
+    throw invalidInput("Share destination path must contain valid percent-encoding.");
+  }
+  if (decoded === SHARED_APP_PATH_PREFIX || decoded.startsWith(`${SHARED_APP_PATH_PREFIX}/`)) {
+    throw invalidInput("Share destination path must not use the framework-owned '/shared' namespace.");
+  }
+  return value;
+}
+function identifier(value, label) {
+  if (typeof value !== "string" || value.trim().length === 0 || value.includes("\x00")) {
+    throw invalidInput(`${label} must be a non-empty string without NUL bytes.`);
+  }
+  return value;
+}
+function sha256(value, label) {
+  if (typeof value !== "string" || !SHA256_HEX.test(value)) {
+    throw invalidInput(`${label} must be a lowercase SHA-256 hex digest.`);
+  }
+  return value;
+}
+function inputDate(value, label) {
+  if (!(value instanceof Date) || !Number.isFinite(value.getTime())) {
+    throw invalidInput(`${label} must be a valid Date.`);
+  }
+  return new Date(value);
+}
+function storedDate(value, label) {
+  const parsed = value instanceof Date ? new Date(value) : typeof value === "string" ? new Date(value) : new Date(Number.NaN);
+  if (!Number.isFinite(parsed.getTime()))
+    throw invalidRecord(`${label} is invalid.`);
+  return parsed;
+}
+function optionalBoolean(value, label) {
+  if (value === undefined)
+    return false;
+  if (typeof value !== "boolean")
+    throw invalidInput(`${label} must be a boolean.`);
+  return value;
+}
+function safeInteger(value, label, minimum) {
+  if (!Number.isSafeInteger(value) || value < minimum) {
+    throw invalidInput(`${label} must be a safe integer greater than or equal to ${minimum}.`);
+  }
+  return value;
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function invalidInput(message, cause) {
+  return new ShareGrantStorageError2("invalid_input", `[Sixb] ${message}`, { cause });
+}
+function invalidRecord(message, cause) {
+  return new ShareGrantStorageError2("invalid_record", `[Sixb] ${message}`, { cause });
+}
+
+export { ShareGrantStorageError2, snapshotShareAccessPlan, objectReadScopeForAccessPlan, normalizeShareGrantCreate2, parseShareGrantRecord2, normalizeGetShareGrantByIdInput2, normalizeListShareGrantsInput2, normalizeRevokeShareGrantInput2, cloneShareGrantRecord2, shareAuthorityDigest2 };
+
+//# debugId=9B16B0CFE0D7229264756E2164756E21