@sixb/core 0.1.7 → 0.1.9

package/dist/chunk-hpr1r6av.js

@@ -0,0 +1,4006 @@
+// @bun
+import {
+  agentServiceAccountId2,
+  assertObjectReadOutputWithinLimit2,
+  createAgentRuntimeAuthorization,
+  resolveRuntimeAuthorizationForProject,
+  getAuthorizationRef,
+  resolveExecutionScopeAuthorization,
+  AuthorizationError2,
+  isAllowed2,
+  assertAuthorized2,
+  isRuntimeAllowed2,
+  assertCanManageConnector2,
+  assertPrivileged2,
+  assertProviderAccess2,
+  canViewEvent2,
+  canViewActionRun2,
+  canViewWorkflowRun2,
+  canViewWorkflowIntervention2,
+  canViewPipelineRun2,
+  canViewProjectionRun2,
+  canViewProjection2
+} from "./chunk-dz5h08xv.js";
+import {
+  captureSixbFailure2
+} from "./chunk-f4w3yp4f.js";
+import {
+  isRecord2,
+  normalizeSchemaValue2,
+  coerceSchemaValueToTyped2,
+  assertObjectTypeRegistered2
+} from "./chunk-ms2tmn1k.js";
+import {
+  isActionDefinition2,
+  SYSTEM_PRINCIPAL2,
+  principalsEqual2
+} from "./chunk-g00bfdq6.js";
+import {
+  isModelReasoning2,
+  modelReasoningSupportIssue2
+} from "./chunk-pqajwytd.js";
+import {
+  RuntimeError2,
+  ModelProviderError2,
+  ModelStreamError2,
+  UnsupportedModelFeatureError2,
+  StructuredOutputError2,
+  estimateModelCall,
+  rateModelCall2
+} from "./chunk-e0d1rzef.js";
+import {
+  AgentStorageError2,
+  AGENT_REASONING_LEVELS2
+} from "./chunk-7bs40fe1.js";
+import {
+  ObjectNotFoundError2
+} from "./chunk-8vj0rjgs.js";
+import {
+  ExecutionStorageError2
+} from "./chunk-93csa55g.js";
+import {
+  WORKFLOW_RUN_FAILURE_CODES2
+} from "./chunk-mjbk2djy.js";
+import {
+  WorkflowRunError2
+} from "./chunk-pr2h4bv4.js";
+import {
+  assertAuthorizedObjectReaderBinding,
+  getAuthorizedOntologyView,
+  canDelegationAccessActionRun,
+  requestAction3,
+  requestActionAndWait2
+} from "./chunk-ypbtykv6.js";
+import {
+  shareSixbErrorReporter2,
+  reportRunFailure2
+} from "./chunk-7apz6hg4.js";
+import {
+  aiLimitSubjectsFromAttribution2,
+  applicableAiLimitPolicyStatuses2,
+  aiUsageLimitExceededError2,
+  aiUsageLimitUnavailableError2
+} from "./chunk-0y39rgsb.js";
+import {
+  AgentRequestError2,
+  normalizeAgentContextEntries2
+} from "./chunk-dmn70ztd.js";
+import {
+  publishAgentRunActivity2
+} from "./chunk-92vk7gta.js";
+import {
+  registerConnectorConnectionsRuntime
+} from "./chunk-5a4a52tq.js";
+import {
+  createConnectorRuntime,
+  SyncValidationError2,
+  requestSyncRun2
+} from "./chunk-emyyk7dx.js";
+import {
+  writeDataset2
+} from "./chunk-mrp7k0pw.js";
+import {
+  shareOntologyMutationRuntime2
+} from "./chunk-zcnq6105.js";
+import {
+  compileShareAccessPlan
+} from "./chunk-awbhdqyc.js";
+import {
+  getTelemetryHistoryBatch2,
+  getLatestTelemetryPoint,
+  createObjectSet2,
+  upsertLink3,
+  upsertLinkBatch3,
+  removeLink3,
+  listObjects,
+  upsertObject3,
+  upsertObjectBatch3,
+  appendTelemetry
+} from "./chunk-1enhpacz.js";
+import {
+  schemaRecordToJsonSchema2
+} from "./chunk-7zgecwy1.js";
+import {
+  PipelineError2,
+  requestPipelineRun2
+} from "./chunk-jjy0fhrn.js";
+import {
+  requireAccountingCapabilities,
+  aiModelCallOutputTokenAllowance,
+  createAiModelCallLimitController2,
+  AiModelCallRecorder2,
+  enqueueAiModelCallRecovery2,
+  resolveLanguageModel2
+} from "./chunk-h1gfhhbh.js";
+import {
+  getDatasetPrimaryKeyColumns2
+} from "./chunk-9qsh3p5y.js";
+import {
+  executionRecordInputFromRuntime,
+  ensureExecutionRecord2,
+  createPrimitiveExecutionRecord
+} from "./chunk-17kfctj6.js";
+import {
+  ShareGrantStorageError2
+} from "./chunk-br3k6qbf.js";
+import {
+  isObjectRefSchema2,
+  validateSchemaOrRefValue2
+} from "./chunk-f0rwz2vh.js";
+import {
+  supportsDirectUpload2,
+  supportsRangeRead2
+} from "./chunk-h3v76ams.js";
+import {
+  isJsonValue2,
+  assertJsonValue2,
+  assertJsonObject2,
+  isPlainRecord
+} from "./chunk-wy0qdqfm.js";
+
+// src/actions/descriptor.ts
+function snapshotActionDescriptor(action) {
+  const params = Object.fromEntries(Object.entries(action.params).map(([id, config]) => [id, structuredClone(config)]));
+  return deepFreeze({
+    id: action.id,
+    ...action.description === undefined ? {} : { description: action.description },
+    binding: action.binding.kind === "global" ? { kind: "global" } : { kind: "object", objectTypeId: action.binding.objectType.id },
+    params,
+    phases: {
+      validate: action.phases.validate.length > 0,
+      writeback: action.phases.writeback !== undefined,
+      edits: action.phases.edits !== undefined,
+      effects: action.phases.effects !== undefined
+    }
+  });
+}
+function deepFreeze(value, seen = new Set) {
+  if (typeof value !== "object" || value === null || seen.has(value))
+    return value;
+  seen.add(value);
+  for (const key of Reflect.ownKeys(value)) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor && "value" in descriptor)
+      deepFreeze(descriptor.value, seen);
+  }
+  return Object.freeze(value);
+}
+
+// src/actions/execution.ts
+function createActionsRuntime(runtime, execution) {
+  const projectId = runtime.projectId;
+  const runtimeAuthorization = runtime.runtimeAuthorization;
+  const objectReader = runtime.objectReader;
+  assertAuthorizedObjectReaderBinding({
+    reader: objectReader,
+    scope: { execution, authorization: runtimeAuthorization }
+  });
+  const authorization = resolveRuntimeAuthorizationForProject({
+    projectId,
+    runtimeAuthorization
+  });
+  const canList = (action) => {
+    if (authorization.type === "denied")
+      return false;
+    if (authorization.type === "delegated") {
+      const binding = action.binding;
+      return binding.kind === "object" && authorization.actionApply.some((target) => target.actionId === action.id && target.subject.objectTypeId === binding.objectType.id) && getAuthorizedOntologyView(objectReader).getObjectTypeById(binding.objectType.id) !== null;
+    }
+    if (authorization.type === "unrestricted")
+      return true;
+    return isAllowed2(authorization.context, { kind: "action.apply", actionId: action.id }) && (action.binding.kind === "global" || isAllowed2(authorization.context, {
+      kind: "object.view",
+      objectTypeId: action.binding.objectType.id
+    }));
+  };
+  const release = (value) => {
+    if (authorization.type === "delegated") {
+      assertObjectReadOutputWithinLimit2(value, authorization.objectRead.limits);
+    }
+    return value;
+  };
+  const describeAll = (actions) => release(actions.filter(canList).map(snapshotActionDescriptor));
+  return {
+    list: () => describeAll(runtime.actionRegistry.list()),
+    getById: (actionId) => {
+      const action = runtime.actionRegistry.getById(actionId);
+      return release(action && canList(action) ? snapshotActionDescriptor(action) : null);
+    },
+    listGlobal: () => describeAll(runtime.actionRegistry.listGlobal()),
+    listForType: (objectType) => describeAll(runtime.actionRegistry.listForType(objectType).filter((action) => authorization.type !== "delegated" || action.binding.kind === "object" && action.binding.objectType.id === objectType.id)),
+    request: (input) => requestAction3(runtime, execution, input),
+    requestAndWait: (input) => requestActionAndWait2(runtime, execution, input),
+    runs: {
+      getById: async (runId) => {
+        if (authorization.type === "denied" || authorization.type === "delegated" && (!authorization.delegation || authorization.actionApply.length === 0))
+          return null;
+        const run = await runtime.storage.actionRuns?.getById({
+          projectId,
+          id: runId
+        }) ?? null;
+        return run && (authorization.type === "unrestricted" || authorization.type === "principal" && canViewActionRun2(authorization.context, run) || authorization.type === "delegated" && await canDelegationAccessActionRun({
+          storage: runtime.storage,
+          projectId,
+          authority: authorization,
+          run
+        })) ? release(run) : null;
+      },
+      list: (input = {}) => {
+        if (authorization.type === "denied" || authorization.type === "delegated") {
+          return Promise.resolve({ runs: [], hasMore: false, total: 0 });
+        }
+        const storage = runtime.storage.actionRuns;
+        if (!storage)
+          return Promise.resolve({ runs: [], hasMore: false, total: 0 });
+        return storage.list({
+          ...input,
+          projectId,
+          actionIds: authorization.type === "principal" ? [...authorization.context.grants["apply:action"]] : undefined,
+          objectTypeIds: authorization.type === "principal" ? [...authorization.context.grants["view:object"]] : undefined
+        });
+      }
+    }
+  };
+}
+
+// src/runtime/ai-cost.ts
+async function resolveExecutionCosts(input) {
+  if (input.executionIds.length === 0)
+    return [];
+  if (!input.storage)
+    return input.executionIds.map(() => {
+      return;
+    });
+  return input.storage.summarizeExecutions({
+    projectId: input.projectId,
+    executionIds: input.executionIds
+  });
+}
+
+// src/runtime/ai-usage.ts
+async function resolveExecutionUsage(input) {
+  if (input.executionIds.length === 0)
+    return [];
+  if (!input.storage)
+    return input.executionIds.map(() => {
+      return;
+    });
+  const summaries = await input.storage.summarizeExecutions({
+    projectId: input.projectId,
+    executionIds: input.executionIds
+  });
+  return summaries.map((summary) => summary.modelCallCount === 0 ? undefined : summary.usage);
+}
+
+// src/agents/ids.ts
+import { createHash, randomUUID } from "crypto";
+function createAgentThreadId2() {
+  return `agt_thr_${randomUUID()}`;
+}
+function createAgentRunId2() {
+  return `agt_run_${randomUUID()}`;
+}
+function createSubagentRunId2(parentRunId, spawnKey) {
+  const digest = createHash("sha256").update(parentRunId).update("\x00").update(spawnKey).digest("hex");
+  return `agt_run_child_${digest}`;
+}
+function createSubagentExecutionId2(runId) {
+  return `exec_${runId}`;
+}
+function createAgentMessageId2() {
+  return `agt_msg_${randomUUID()}`;
+}
+function agentContextCheckpointId2(runId) {
+  return `agt_ctx_${runId}`;
+}
+function createAgentRunExecutionToken2() {
+  return `agt_exec_${randomUUID()}`;
+}
+
+// src/agents/request.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
+// src/agents/context-resolution.ts
+async function resolveAgentContextParts2(runtime, input) {
+  const entries = normalizeAgentContextEntries2(input);
+  for (const entry of entries) {
+    if (entry.context.kind !== "object")
+      continue;
+    const { objectTypeId, primaryId } = entry.context.ref;
+    try {
+      runtime.ontology.resolveObjectType(objectTypeId);
+    } catch {
+      invalidContext(`context references an unknown object type '${objectTypeId}'`);
+    }
+    const object = await runtime.objectReader.getByPrimaryId({
+      objectTypeId,
+      primaryId
+    });
+    if (!object) {
+      invalidContext(`context references an unknown object '${objectTypeId}:${primaryId}'`);
+    }
+  }
+  return entries.map((entry) => ({ type: "context", ...entry }));
+}
+function invalidContext(message) {
+  throw new AgentRequestError2("invalid_context", `[Sixb] Invalid agent context: ${message}.`);
+}
+
+// src/agents/dispatch.ts
+function agentRunQueueJobId2(runId) {
+  return `agt_job_${runId}`;
+}
+function subagentRunQueueJobId2(runId) {
+  return `agt_child_job_${runId}`;
+}
+function workflowAgentNodeQueueJobId2(nodeRunId) {
+  return `wfa_job_${nodeRunId}`;
+}
+async function dispatchQueuedAgentRuns2(input) {
+  const limit = normalizeLimit(input.limit);
+  const runs = input.runIds ? await input.storage.runs.getByIds({
+    projectId: input.projectId,
+    ids: [...new Set(input.runIds)].slice(0, limit)
+  }) : (await input.storage.runs.list({
+    projectId: input.projectId,
+    kinds: ["conversation"],
+    statuses: ["queued"],
+    order: "asc",
+    limit
+  })).runs;
+  const queued = runs.filter((run) => run.kind === "conversation" && run.status === "queued");
+  if (queued.length === 0) {
+    return { scanned: 0, dispatched: [], failures: [] };
+  }
+  try {
+    const jobs = await input.queue.enqueue({
+      projectId: input.projectId,
+      jobs: queued.map((run) => ({
+        id: agentRunQueueJobId2(run.id),
+        type: "agent.run.requested",
+        payload: { runId: run.id }
+      }))
+    });
+    const jobsById = new Map(jobs.map((job) => [job.id, job]));
+    const dispatched = queued.map((run) => {
+      const jobId = agentRunQueueJobId2(run.id);
+      if (!jobsById.has(jobId)) {
+        throw new Error(`[Sixb] Agent queue did not return job '${jobId}'.`);
+      }
+      return { runId: run.id, jobId };
+    });
+    return { scanned: queued.length, dispatched, failures: [] };
+  } catch (error) {
+    return {
+      scanned: queued.length,
+      dispatched: [],
+      failures: queued.map((run) => ({ runId: run.id, error }))
+    };
+  }
+}
+async function dispatchQueuedSubagentRuns2(input) {
+  const limit = normalizeLimit(input.limit);
+  const runs = input.runIds ? await input.storage.runs.getByIds({
+    projectId: input.projectId,
+    ids: [...new Set(input.runIds)].slice(0, limit)
+  }) : (await input.storage.runs.list({
+    projectId: input.projectId,
+    kinds: ["subagent"],
+    statuses: ["queued"],
+    order: "asc",
+    limit
+  })).runs;
+  const queued = runs.filter((run) => run.kind === "subagent" && run.status === "queued");
+  if (queued.length === 0)
+    return { scanned: 0, dispatched: [], failures: [] };
+  try {
+    const jobs = await input.queue.enqueue({
+      projectId: input.projectId,
+      jobs: queued.map((run) => ({
+        id: subagentRunQueueJobId2(run.id),
+        type: "agent.subagent-run.requested",
+        payload: { runId: run.id }
+      }))
+    });
+    const jobsById = new Set(jobs.map((job) => job.id));
+    const dispatched = queued.map((run) => {
+      const jobId = subagentRunQueueJobId2(run.id);
+      if (!jobsById.has(jobId)) {
+        throw new Error(`[Sixb] Subagent queue did not return job '${jobId}'.`);
+      }
+      return { runId: run.id, jobId };
+    });
+    return { scanned: queued.length, dispatched, failures: [] };
+  } catch (error) {
+    return {
+      scanned: queued.length,
+      dispatched: [],
+      failures: queued.map((run) => ({ runId: run.id, error }))
+    };
+  }
+}
+function normalizeLimit(value) {
+  if (value === undefined)
+    return 100;
+  if (!Number.isFinite(value) || value < 1) {
+    throw new Error("[Sixb] Agent dispatch limit must be at least 1.");
+  }
+  return Math.floor(value);
+}
+
+// src/agents/retired-config.ts
+function assertNoAgentDefinitions(input) {
+  if ("agents" in input) {
+    throw new RuntimeError2("[Sixb] Agent definitions are no longer supported. Configure 'models' and 'tools' on createSixb() instead.");
+  }
+}
+function assertNoAgentSelector(input) {
+  if ("agentId" in input || "agentIds" in input) {
+    throw new AgentRequestError2("agent_selector_removed", "[Sixb] There is one project Agent. Remove the agentId selector and use sixb.agent.");
+  }
+}
+
+// src/agents/request.ts
+async function requestAgentRun2(runtime, execution, models, input) {
+  const authority = resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization
+  });
+  assertNoAgentSelector(input);
+  assertAuthorized2(runtime, { kind: "agent.run" });
+  assertRequestAuthorityCanRunAgent(runtime);
+  const spec = resolveConversationRunSpec({ models, input });
+  const contextParts = await resolveAgentContextParts2(runtime, input.context);
+  const agents = requireAgentStorage(runtime);
+  const projectId = runtime.projectId;
+  const principal = authority.type === "principal" ? authority.context.principal : input.principal ?? SYSTEM_PRINCIPAL2;
+  const runId = createAgentRunId2();
+  const durableExecution = await prepareDurableAgentExecution(runtime, execution, runId);
+  await assertAiLimitPreflight(runtime, durableExecution);
+  const { thread, createdThread } = await resolveThread(agents, {
+    projectId,
+    threadId: input.threadId,
+    title: input.title,
+    principal
+  });
+  if (thread.activeRunId !== null) {
+    throw new AgentRequestError2("active_run_exists", `[Sixb] Agent thread '${thread.id}' already has an active run '${thread.activeRunId}'.`);
+  }
+  const triggerMessageId = input.messageId ?? createAgentMessageId2();
+  let run;
+  try {
+    run = await runtime.storage.transaction(async (tx) => {
+      const agents = tx.agents;
+      if (!agents) {
+        throw new AgentRequestError2("storage_unavailable", "[Sixb] Agent storage is not configured.");
+      }
+      await tx.executions.create(durableExecution);
+      await agents.messages.append({
+        id: triggerMessageId,
+        projectId,
+        threadId: thread.id,
+        runId: null,
+        role: "user",
+        parts: [
+          ...contextParts,
+          { type: "text", text: input.text },
+          ...(input.attachments ?? []).map((fileRef) => ({ type: "file", fileRef }))
+        ],
+        authorPrincipal: principal
+      });
+      return agents.runs.create({
+        id: runId,
+        projectId,
+        executionId: durableExecution.id,
+        threadId: thread.id,
+        triggerMessageId,
+        spec
+      });
+    });
+  } catch (error) {
+    if (error instanceof AgentStorageError2 && error.code === "active_run_exists") {
+      throw new AgentRequestError2("active_run_exists", error.message);
+    }
+    throw error;
+  }
+  await publishRunActivity(runtime, run);
+  const jobId = await dispatchAgentRun(runtime, agents, runId);
+  return {
+    run,
+    ...jobId ? { jobId } : {},
+    createdThread
+  };
+}
+async function retryAgentRun2(runtime, execution, models, failedRun) {
+  resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization
+  });
+  assertAuthorized2(runtime, { kind: "agent.run" });
+  assertRequestAuthorityCanRunAgent(runtime);
+  if (failedRun.status !== "failed") {
+    throw new AgentRequestError2("run_not_retryable", `[Sixb] Only failed Agent runs can be retried.`);
+  }
+  const agents = requireAgentStorage(runtime);
+  const thread = await agents.threads.getById({
+    projectId: runtime.projectId,
+    id: failedRun.threadId
+  });
+  if (!thread) {
+    throw new AgentRequestError2("thread_not_found", `[Sixb] Agent thread '${failedRun.threadId}' was not found.`);
+  }
+  const runId = createAgentRunId2();
+  const durableExecution = await prepareDurableAgentExecution(runtime, execution, runId);
+  await assertAiLimitPreflight(runtime, durableExecution);
+  const run = await runtime.storage.transaction(async (tx) => {
+    const agents = tx.agents;
+    if (!agents) {
+      throw new AgentRequestError2("storage_unavailable", "[Sixb] Agent storage is not configured.");
+    }
+    await agents.messages.deleteByRunId({
+      projectId: runtime.projectId,
+      threadId: failedRun.threadId,
+      runId: failedRun.id
+    });
+    await tx.executions.create(durableExecution);
+    return agents.runs.create({
+      id: runId,
+      projectId: runtime.projectId,
+      executionId: durableExecution.id,
+      threadId: failedRun.threadId,
+      triggerMessageId: failedRun.triggerMessageId,
+      spec: failedRun.spec ?? resolveConversationRunSpec({
+        models,
+        input: {}
+      })
+    });
+  });
+  await publishRunActivity(runtime, run);
+  const jobId = await dispatchAgentRun(runtime, agents, runId);
+  return { run, ...jobId ? { jobId } : {}, createdThread: false };
+}
+async function assertAiLimitPreflight(runtime, execution) {
+  const limits = runtime.storage.aiLimits;
+  if (!limits)
+    throw aiUsageLimitUnavailableError2(["limitStorageUnavailable"]);
+  const subjects = aiLimitSubjectsFromAttribution2(execution.requestedBy, execution.requesterGroupIds);
+  let applicable;
+  try {
+    applicable = applicableAiLimitPolicyStatuses2(await limits.listPolicyStatuses({ projectId: runtime.projectId }), subjects);
+  } catch {
+    throw aiUsageLimitUnavailableError2(["limitStorageUnavailable"]);
+  }
+  const unavailable = applicable.filter((status) => status.accountingStatus === "unavailable");
+  if (unavailable.length > 0) {
+    throw aiUsageLimitUnavailableError2(["incompleteAccounting"]);
+  }
+  const exhausted = applicable.filter((status) => status.exhausted);
+  if (exhausted.length > 0) {
+    const resetAt = new Date(Math.min(...exhausted.map((status) => status.period.resetAt.getTime())));
+    throw aiUsageLimitExceededError2(resetAt);
+  }
+}
+function resolveConversationRunSpec(input) {
+  if (!input.models) {
+    throw new AgentRequestError2("model_not_found", "[Sixb] Configure models.language before starting the Agent.");
+  }
+  const selected = input.input.model ?? input.models.default;
+  const model = input.models.getByRef(selected);
+  if (model === null) {
+    throw new AgentRequestError2("model_not_found", `[Sixb] Language model '${selected.provider}/${selected.modelId}' is not in the project model catalog.`);
+  }
+  const reasoning = input.input.reasoning;
+  if (reasoning !== undefined && !isModelReasoning2(reasoning)) {
+    throw new AgentRequestError2("invalid_model_selection", `[Sixb] Agent reasoning must be one of: ${AGENT_REASONING_LEVELS2.join(", ")}, or a nonnegative budgetTokens object.`);
+  }
+  return Object.freeze({
+    model: Object.freeze({ provider: selected.provider, modelId: selected.modelId }),
+    ...reasoning === undefined ? {} : { reasoning }
+  });
+}
+async function prepareDurableAgentExecution(runtime, execution, runId) {
+  const parent = await ensureExecutionRecord2(runtime.storage.executions, executionRecordInputFromRuntime({
+    execution,
+    runtimeAuthorization: runtime.runtimeAuthorization
+  }));
+  return createInheritedAgentExecutionRecord2({
+    id: `exec_${randomUUID2()}`,
+    parent,
+    runId
+  });
+}
+function assertRequestAuthorityCanRunAgent(runtime) {
+  if (!canInheritAgentRequestAuthorization2(runtime.runtimeAuthorization)) {
+    throw new AgentRequestError2("authority_not_inheritable", "[Sixb] The Agent requires an authenticated user request or disabled authorization.");
+  }
+}
+async function dispatchAgentRun(runtime, agents, runId) {
+  try {
+    const dispatch = await dispatchQueuedAgentRuns2({
+      projectId: runtime.projectId,
+      storage: agents,
+      queue: runtime.queues.agents,
+      runIds: [runId]
+    });
+    const failure = dispatch.failures[0];
+    if (failure) {
+      console.error(`[Sixb] Could not dispatch queued agent run '${runId}'; retrying later.`, failure.error);
+    }
+    return dispatch.dispatched[0]?.jobId;
+  } catch (error) {
+    console.error(`[Sixb] Could not dispatch queued agent run '${runId}'; retrying later.`, error);
+    return;
+  }
+}
+async function publishRunActivity(runtime, run) {
+  try {
+    await publishAgentRunActivity2(runtime.broker, run);
+  } catch (error) {
+    console.error(`[Sixb] Agent run '${run.id}' activity stream publish failed:`, error);
+  }
+}
+async function resolveThread(agents, params) {
+  if (params.threadId) {
+    const existing = await agents.threads.getById({
+      projectId: params.projectId,
+      id: params.threadId
+    });
+    if (existing) {
+      return { thread: existing, createdThread: false };
+    }
+  }
+  const thread = await agents.threads.create({
+    id: params.threadId ?? createAgentThreadId2(),
+    projectId: params.projectId,
+    ownerPrincipal: params.principal,
+    ...params.title === undefined ? {} : { title: params.title }
+  });
+  return { thread, createdThread: true };
+}
+function requireAgentStorage(runtime) {
+  const agents = runtime.storage.agents;
+  if (!agents) {
+    throw new AgentRequestError2("storage_unavailable", "[Sixb] Agent storage is not configured.");
+  }
+  return agents;
+}
+
+// src/agents/execution.ts
+function createAgentRuntime(runtime, execution, models) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const principal = authority.type === "principal" ? authority.context.principal : SYSTEM_PRINCIPAL2;
+  const allowed = () => isRuntimeAllowed2(runtime, { kind: "agent.run" });
+  const getVisibleThreadRecord = async (threadId) => {
+    if (authority.type === "denied" || authority.type === "delegated")
+      return null;
+    const thread = await runtime.storage.agents?.threads.getById({
+      projectId: runtime.projectId,
+      id: threadId
+    }) ?? null;
+    if (!thread || !allowed())
+      return null;
+    return authority.type === "principal" && !principalsEqual2(principal, thread.ownerPrincipal) ? null : thread;
+  };
+  const getAgent = () => {
+    if (authority.type === "denied" || authority.type === "delegated")
+      return null;
+    const model = models?.language.default;
+    if (!model || !allowed())
+      return null;
+    return {
+      name: "Sixb",
+      model: { provider: model.provider, modelId: model.modelId }
+    };
+  };
+  const getVisibleRunRecord = async (runId) => {
+    if (authority.type === "denied" || authority.type === "delegated")
+      return null;
+    const run = await runtime.storage.agents?.runs.getById({
+      projectId: runtime.projectId,
+      id: runId
+    }) ?? null;
+    if (!run || run.kind !== "conversation")
+      return null;
+    const thread = await getVisibleThreadRecord(run.threadId);
+    return thread ? run : null;
+  };
+  const getRun = async (runId) => {
+    const run = await getVisibleRunRecord(runId);
+    return run ? attachRunView(runtime, run) : null;
+  };
+  return {
+    get: getAgent,
+    threads: {
+      create: async (input) => {
+        assertNoAgentSelector(input);
+        const agent = getAgent();
+        if (!agent) {
+          throw new AgentRequestError2("agent_not_found", "[Sixb] The project Agent is unavailable.");
+        }
+        const storage = runtime.storage.agents;
+        if (!storage) {
+          throw new AgentRequestError2("storage_unavailable", "[Sixb] Agent storage is not configured.");
+        }
+        return storage.threads.create({
+          id: input.id ?? createAgentThreadId2(),
+          projectId: runtime.projectId,
+          ownerPrincipal: principal,
+          ...input.title === undefined ? {} : { title: input.title }
+        });
+      },
+      getById: getVisibleThreadRecord,
+      list: async (input = {}) => {
+        assertNoAgentSelector(input);
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return { threads: [], hasMore: false, total: 0 };
+        }
+        const storage = runtime.storage.agents;
+        if (!storage || !allowed())
+          return { threads: [], hasMore: false, total: 0 };
+        return storage.threads.list({
+          ...input,
+          projectId: runtime.projectId,
+          ownerPrincipal: authority.type === "principal" ? principal : undefined
+        });
+      }
+    },
+    runs: {
+      request: async (input) => {
+        assertNoAgentSelector(input);
+        const agent = getAgent();
+        if (!agent) {
+          throw new AgentRequestError2("agent_not_found", "[Sixb] The project Agent is unavailable.");
+        }
+        assertAuthorized2(runtime, { kind: "agent.run" });
+        if (input.threadId && !await getVisibleThreadRecord(input.threadId)) {
+          throw new AgentRequestError2("thread_not_found", `[Sixb] Agent thread '${input.threadId}' not found.`);
+        }
+        const result = await requestAgentRun2(runtime, execution, models?.language, {
+          ...input,
+          principal
+        });
+        return { ...result, run: await attachRunView(runtime, result.run) };
+      },
+      retry: async (runId) => {
+        const failedRun = await getVisibleRunRecord(runId);
+        if (!failedRun) {
+          throw new AgentRequestError2("run_not_found", `[Sixb] Agent run '${runId}' was not found.`);
+        }
+        const agent = getAgent();
+        if (!agent) {
+          throw new AgentRequestError2("agent_not_found", "[Sixb] The project Agent is unavailable.");
+        }
+        const result = await retryAgentRun2(runtime, execution, models?.language, failedRun);
+        return { ...result, run: await attachRunView(runtime, result.run) };
+      },
+      getById: getRun,
+      listForThread: async (threadId, input = {}) => {
+        assertNoAgentSelector(input);
+        const storage = runtime.storage.agents;
+        if (!storage || !await getVisibleThreadRecord(threadId))
+          return null;
+        const result = await storage.runs.list({
+          ...input,
+          projectId: runtime.projectId,
+          threadId
+        });
+        return {
+          ...result,
+          runs: await attachRunViews(runtime, result.runs.filter((run) => run.kind === "conversation"))
+        };
+      }
+    }
+  };
+}
+async function attachRunView(runtime, run) {
+  const [view] = await attachRunViews(runtime, [run]);
+  if (!view)
+    throw new Error(`[Sixb] Could not build Agent run '${run.id}' view.`);
+  return view;
+}
+async function attachRunViews(runtime, runs) {
+  const executionIds = runs.map((run) => run.executionId);
+  const [executions, usages, costs] = await Promise.all([
+    Promise.all(runs.map((run) => runtime.storage.executions.getById({
+      projectId: runtime.projectId,
+      id: run.executionId
+    }))),
+    resolveExecutionUsage({
+      storage: runtime.storage.aiUsage,
+      projectId: runtime.projectId,
+      executionIds
+    }),
+    resolveExecutionCosts({
+      storage: runtime.storage.aiCosts,
+      projectId: runtime.projectId,
+      executionIds
+    })
+  ]);
+  return runs.map((run, index) => {
+    const execution = executions[index];
+    if (!execution) {
+      throw new Error(`[Sixb] Agent run '${run.id}' references missing execution '${run.executionId}'.`);
+    }
+    const usage = usages[index];
+    const cost = usage === undefined ? undefined : costs[index];
+    return {
+      ...run,
+      ...execution.requestedBy === undefined ? {} : { requestedBy: structuredClone(execution.requestedBy) },
+      ...usage === undefined ? {} : { usage },
+      ...cost === undefined ? {} : { cost }
+    };
+  });
+}
+
+// src/ai-usage/execution.ts
+import { randomUUID as randomUUID3 } from "crypto";
+function createAiUsageRuntime(runtime, security) {
+  const assertObservable = () => assertAuthorized2(runtime, { kind: "aiUsage.observe" });
+  const assertManageable = () => assertAuthorized2(runtime, { kind: "aiUsage.manage" });
+  const assertPolicyReadable = () => {
+    if (!isRuntimeAllowed2(runtime, { kind: "aiUsage.observe" }) && !isRuntimeAllowed2(runtime, { kind: "aiUsage.manage" })) {
+      assertObservable();
+    }
+  };
+  const requireCosts = () => {
+    if (!runtime.storage.aiCosts) {
+      throw new Error("[Sixb] AI cost storage is not configured.");
+    }
+    return runtime.storage.aiCosts;
+  };
+  const requireLimits = () => {
+    if (!runtime.storage.aiLimits) {
+      throw new Error("[Sixb] AI limit storage is not configured.");
+    }
+    return runtime.storage.aiLimits;
+  };
+  return {
+    accountingConfigured: runtime.storage.aiCosts !== undefined,
+    limitsConfigured: runtime.storage.aiLimits !== undefined,
+    assertObservable,
+    assertManageable,
+    canManageLimits: () => isRuntimeAllowed2(runtime, { kind: "aiUsage.manage" }),
+    queryOverview: (input) => {
+      assertObservable();
+      return requireCosts().queryProjectOverview({ ...input, projectId: runtime.projectId });
+    },
+    listModelCalls: (input) => {
+      assertObservable();
+      return requireCosts().listModelCalls({ ...input, projectId: runtime.projectId });
+    },
+    listModelCallGroups: (input) => {
+      assertObservable();
+      return requireCosts().listModelCallGroups({ ...input, projectId: runtime.projectId });
+    },
+    listLimitPolicies: (input = {}) => {
+      assertPolicyReadable();
+      return requireLimits().listPolicies({ ...input, projectId: runtime.projectId });
+    },
+    listLimitStatuses: (input = {}) => {
+      assertObservable();
+      return requireLimits().listPolicyStatuses({
+        ...input.includeDisabled === undefined ? {} : { includeDisabled: input.includeDisabled },
+        projectId: runtime.projectId,
+        existingGroupIds: security.listGroups().map((group) => group.id)
+      });
+    },
+    listLimitSubjectOptions: async () => {
+      assertManageable();
+      const groups = security.listGroups().map((group) => ({
+        id: group.id,
+        ...group.label === undefined ? {} : { label: group.label },
+        ...group.description === undefined ? {} : { description: group.description }
+      }));
+      const auth = runtime.storage.auth;
+      if (!auth)
+        return { groups, users: [], serviceAccounts: [] };
+      const [users, serviceAccounts] = await Promise.all([
+        auth.users.list({ projectId: runtime.projectId, order: "asc" }),
+        auth.serviceAccounts.list({ projectId: runtime.projectId, order: "asc" })
+      ]);
+      return {
+        groups,
+        users: users.users.map((user) => ({
+          id: user.id,
+          email: user.email,
+          ...user.displayName === undefined ? {} : { displayName: user.displayName },
+          status: user.status
+        })),
+        serviceAccounts: serviceAccounts.serviceAccounts.map((serviceAccount) => ({
+          id: serviceAccount.id,
+          name: serviceAccount.name,
+          ...serviceAccount.description === undefined ? {} : { description: serviceAccount.description },
+          status: serviceAccount.status
+        }))
+      };
+    },
+    createLimitPolicy: (input) => {
+      assertManageable();
+      return requireLimits().createPolicy({
+        ...input,
+        id: input.id ?? `ailim_${randomUUID3()}`,
+        projectId: runtime.projectId
+      });
+    },
+    updateLimitPolicy: (input) => {
+      assertManageable();
+      return requireLimits().updatePolicy({ ...input, projectId: runtime.projectId });
+    },
+    deleteLimitPolicy: (id) => {
+      assertManageable();
+      return requireLimits().deletePolicy({ id, projectId: runtime.projectId });
+    }
+  };
+}
+// src/blob-storage/execution.ts
+function createBlobsRuntime(runtime, execution, blobStorage) {
+  const assertAccess = () => assertProviderAccess2(runtime, execution, "blobs.access");
+  const executionBlobs = {
+    put: (input) => {
+      assertAccess();
+      return blobStorage.put(input);
+    },
+    open: (blobId) => {
+      assertAccess();
+      return blobStorage.open(blobId);
+    },
+    stat: (blobId) => {
+      assertAccess();
+      return blobStorage.stat(blobId);
+    }
+  };
+  if (supportsRangeRead2(blobStorage)) {
+    executionBlobs.openRange = (blobId, range) => {
+      assertAccess();
+      return blobStorage.openRange(blobId, range);
+    };
+  }
+  if (supportsDirectUpload2(blobStorage)) {
+    executionBlobs.createUpload = (input) => {
+      assertAccess();
+      return blobStorage.createUpload(input);
+    };
+    executionBlobs.signUploadPart = (input) => {
+      assertAccess();
+      return blobStorage.signUploadPart(input);
+    };
+    executionBlobs.completeUpload = (input) => {
+      assertAccess();
+      return blobStorage.completeUpload(input);
+    };
+    executionBlobs.abortUpload = (input) => {
+      assertAccess();
+      return blobStorage.abortUpload(input);
+    };
+  }
+  return Object.freeze(executionBlobs);
+}
+
+// src/connectors/connections/execution.ts
+function createConnectorConnectionsRuntime(runtime, execution, process) {
+  const contextFor = (connectorId) => commandContext(runtime, execution, connectorId);
+  const connections = {
+    listConnections: (connectorId) => process.listConnections(contextFor(connectorId), connectorId),
+    startConnectionRun: (connectorId, input) => process.startConnectionRun(contextFor(connectorId), connectorId, input),
+    addConnection: (connectorId, input) => process.addConnection(contextFor(connectorId), connectorId, input),
+    getConnectionRun: (connectorId, runId) => process.getConnectionRun(contextFor(connectorId), connectorId, runId),
+    selectConnectionRunAccount: (connectorId, input) => process.selectConnectionRunAccount(contextFor(connectorId), connectorId, input),
+    startReauthorization: (connectorId, connectionId, input) => process.startReauthorization(contextFor(connectorId), connectorId, connectionId, input),
+    revokeConnection: (connectorId, connectionId) => process.revokeConnection(contextFor(connectorId), connectorId, connectionId),
+    startAuthorization: (connectorId, input) => process.startAuthorization(contextFor(connectorId), connectorId, input),
+    completeAuthorization: (connectorId, input) => process.completeAuthorization(contextFor(connectorId), connectorId, input),
+    selectAccount: (connectorId, input) => process.selectAccount(contextFor(connectorId), connectorId, input),
+    disconnect: (connectorId, connectionId) => process.disconnect(contextFor(connectorId), connectorId, connectionId),
+    revokeAuthorization: (connectorId, authorizationId) => process.revokeAuthorization(contextFor(connectorId), connectorId, authorizationId)
+  };
+  return Object.freeze(connections);
+}
+function commandContext(runtime, execution, connectorId) {
+  const resolved = resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization
+  });
+  if (execution.executor.type !== "request" || resolved.type !== "principal" || resolved.ref.type !== "principal") {
+    throw new AuthorizationError2(`manage:connector:${connectorId}`, "[Sixb] Connector connections can only be managed by an authenticated request.");
+  }
+  if (!resolved.ref.credential) {
+    throw new AuthorizationError2(`manage:connector:${connectorId}`, "[Sixb] Connector connection management requires a session or access token.");
+  }
+  assertCanManageConnector2(runtime, connectorId);
+  return Object.freeze({
+    execution: Object.freeze(executionRecordInputFromRuntime({
+      execution,
+      runtimeAuthorization: runtime.runtimeAuthorization
+    }))
+  });
+}
+
+// src/datasets/execution.ts
+function createDatasetsRuntime(runtime, execution, source, lakeStorage, blobStorage) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const allowed = (datasetId) => isRuntimeAllowed2(runtime, { kind: "dataset.view", datasetId });
+  return {
+    list: () => authority.type === "denied" || authority.type === "delegated" ? [] : source.list().filter((dataset) => allowed(dataset.id)),
+    getById: (datasetId) => {
+      if (authority.type === "denied" || authority.type === "delegated")
+        return null;
+      const dataset = source.getById(datasetId);
+      return dataset && allowed(datasetId) ? dataset : null;
+    },
+    async ingest(dataset, input) {
+      assertPrivileged2(runtime, "datasets.ingest");
+      const registered = source.getById(dataset.id);
+      if (!registered)
+        throw new Error(`[Sixb] Dataset '${dataset.id}' is not registered.`);
+      if (getDatasetPrimaryKeyColumns2(registered) === null) {
+        throw new Error(`[Sixb] Dataset '${dataset.id}' must define a primaryKey before ingestion.`);
+      }
+      if (typeof lakeStorage.beginMerge !== "function") {
+        throw new Error("[Sixb] Dataset ingestion requires a lake provider with merge support.");
+      }
+      const producer = { kind: "ingest", id: execution.id };
+      const result = await writeDataset2({
+        lakeStorage,
+        blobStorage,
+        dataset: registered,
+        mode: "merge",
+        signal: input.signal ?? new AbortController().signal,
+        producer,
+        readValues: async () => async function* () {
+          for await (const value of input.changes)
+            yield { value };
+        }()
+      });
+      if (result.outcome === "created") {
+        await runtime.events.emit({
+          events: [
+            {
+              type: "dataset.version.committed",
+              payload: {
+                datasetId: registered.id,
+                versionId: result.version.versionId,
+                createdAt: result.version.createdAt.toISOString(),
+                producer
+              }
+            }
+          ],
+          correlationId: execution.correlationId
+        }, { source: "SixbDatasets" });
+      }
+      return result;
+    }
+  };
+}
+
+// src/events/execution.ts
+function createEventsRuntime(runtime) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const visibleEvents = (events) => {
+    switch (authority.type) {
+      case "denied":
+      case "delegated":
+        return [];
+      case "principal":
+        return events.filter((event) => canViewEvent2(authority.context, event));
+      case "unrestricted":
+        return [...events];
+    }
+  };
+  return {
+    canRead: (event) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return false;
+        case "principal":
+          return canViewEvent2(authority.context, event);
+        case "unrestricted":
+          return true;
+      }
+    },
+    append: (input) => {
+      assertPrivileged2(runtime, "events.append");
+      return runtime.events.append(input);
+    },
+    emit: (input, options) => {
+      assertPrivileged2(runtime, "events.emit");
+      return runtime.events.emit(input, options);
+    },
+    read: async (input) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return [];
+        case "principal":
+        case "unrestricted":
+          break;
+      }
+      const events = await runtime.events.read(input);
+      return visibleEvents(events);
+    },
+    latestCursor: () => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return Promise.resolve(undefined);
+        case "principal":
+        case "unrestricted":
+          return runtime.events.latestCursor();
+      }
+    },
+    subscribe: (input, handler) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return Promise.resolve(() => {});
+        case "principal":
+        case "unrestricted":
+          break;
+      }
+      return runtime.events.subscribe(input, (events) => {
+        const visible = visibleEvents(events);
+        if (visible.length > 0)
+          handler(visible);
+      });
+    }
+  };
+}
+
+// src/logging/execution.ts
+function createLogsRuntime(runtime, source) {
+  const assertObservable = () => assertAuthorized2(runtime, { kind: "logs.observe" });
+  return {
+    assertObservable,
+    read: (input) => {
+      assertObservable();
+      return source.read(input);
+    },
+    tail: (input) => {
+      assertObservable();
+      return source.tail(input);
+    }
+  };
+}
+
+// src/agents/model-loop.ts
+import { randomUUID as randomUUID4 } from "crypto";
+var MAX_PROVIDER_DATA_BYTES = 256 * 1024;
+async function runModelLoop2(input) {
+  assertLoopInput(input);
+  const tools = indexTools(input.tools ?? []);
+  const toolSpecifications = [...tools.values()].map((tool) => ({
+    name: tool.name,
+    description: tool.description,
+    inputSchema: tool.inputSchema
+  }));
+  let messages = [...input.messages];
+  const steps = [];
+  const generateCallId = input.generateCallId ?? (() => `model_call_${randomUUID4()}`);
+  const callIds = new Set;
+  for (let stepIndex = 0;stepIndex < input.maxSteps; stepIndex += 1) {
+    if (input.signal.aborted) {
+      return { status: "aborted", steps, partialContent: [] };
+    }
+    await input.onEvent?.({ type: "start-step" });
+    let requestMessages;
+    try {
+      const prepared = await input.prepareStep?.({
+        stepIndex,
+        messages,
+        model: input.model,
+        signal: input.signal
+      });
+      requestMessages = prepared?.messages ?? messages;
+    } catch (error) {
+      if (!input.signal.aborted && !isAbortError(error))
+        throw error;
+      return { status: "aborted", steps, partialContent: [] };
+    }
+    if (input.signal.aborted) {
+      return { status: "aborted", steps, partialContent: [] };
+    }
+    let requestTools = toolSpecifications;
+    if (input.finalStepInstruction !== undefined && stepIndex === input.maxSteps - 1) {
+      requestMessages = [
+        ...requestMessages,
+        { role: "user", content: [{ type: "text", text: input.finalStepInstruction }] }
+      ];
+      requestTools = [];
+    }
+    const callId = generateCallId();
+    if (!callId || callIds.has(callId)) {
+      throw new ModelStreamError2(`[SixbModels] Model call IDs must be nonempty and unique.`);
+    }
+    callIds.add(callId);
+    const accumulator = new StreamAccumulator(input.onEvent);
+    let accepted = false;
+    let cost = { status: "unpriceable", reason: "missing-usage" };
+    let terminalStreamError;
+    try {
+      const stream = await input.model.stream({
+        callId,
+        messages: requestMessages,
+        tools: requestTools,
+        ...input.reasoning === undefined ? {} : { reasoning: input.reasoning },
+        ...input.maxOutputTokens === undefined ? {} : { maxOutputTokens: input.maxOutputTokens },
+        ...input.caching === undefined ? {} : { caching: input.caching },
+        ...input.output === undefined ? {} : {
+          responseFormat: {
+            type: "json",
+            name: input.output.name,
+            ...input.output.description === undefined ? {} : { description: input.output.description },
+            schema: input.output.schema
+          }
+        },
+        signal: input.signal
+      });
+      accepted = true;
+      for await (const event of stream.events) {
+        await accumulator.accept(event);
+      }
+    } catch (error) {
+      const aborted = input.signal.aborted || isAbortError(error);
+      if (accumulator.isFinished()) {
+        if (!aborted)
+          terminalStreamError = { error };
+      } else if (!aborted) {
+        throw error;
+      } else {
+        return {
+          status: "aborted",
+          steps,
+          partialContent: accumulator.partialContent()
+        };
+      }
+    } finally {
+      if (accepted) {
+        const facts = accumulator.accounting();
+        const estimate = accumulator.isFinished() ? estimateModelCall(input.model, facts) : cost;
+        cost = facts.reportedCost ? rateModelCall2({ usage: facts.usage, reported: facts.reportedCost }) : estimate;
+        await input.onModelCallEnd?.({
+          callId,
+          providerId: input.model.providerId,
+          modelId: input.model.modelId,
+          responseId: facts.responseId ?? `${callId}:response`,
+          providerIds: facts.providerIds,
+          responseModelId: facts.responseModelId,
+          usage: facts.usage,
+          cost,
+          ...facts.reportedCost === undefined ? {} : { estimate },
+          ...input.reasoning === undefined ? {} : { requestedReasoning: input.reasoning },
+          ...facts.route === undefined ? {} : { route: facts.route }
+        });
+      }
+    }
+    if (input.signal.aborted && !accumulator.isFinished()) {
+      return { status: "aborted", steps, partialContent: accumulator.partialContent() };
+    }
+    const response = accumulator.complete();
+    const responseId = response.responseId ?? `${callId}:response`;
+    if (terminalStreamError)
+      throw terminalStreamError.error;
+    if (response.projectionError)
+      throw response.projectionError;
+    if (input.signal.aborted) {
+      return { status: "aborted", steps, partialContent: response.content };
+    }
+    const localCalls = response.toolCalls.filter((call) => call.part.providerExecuted !== true);
+    if (input.rejectLocalToolCalls && (localCalls.length > 0 || response.finishReason === "tool-calls")) {
+      throw new ModelStreamError2("[SixbModels] Direct generation cannot continue local tool calls.");
+    }
+    if (response.finishReason === "pause" && localCalls.length === 0) {
+      const step = modelStep(response, responseId, response.content, cost);
+      steps.push(step);
+      await input.onStepEnd?.(step);
+      messages = [...requestMessages, { role: "assistant", content: response.content }];
+      if (stepIndex + 1 === input.maxSteps) {
+        throw new ModelStreamError2("[SixbModels] Model reached the step limit while a provider continuation was pending.");
+      }
+      continue;
+    }
+    if (localCalls.length === 0) {
+      const step = modelStep(response, responseId, response.content, cost);
+      steps.push(step);
+      await input.onStepEnd?.(step);
+      if (input.output) {
+        const text = responseText(response);
+        if (response.finishReason !== "stop") {
+          throw new StructuredOutputError2(`[SixbModels] Structured output did not complete successfully (${response.finishReason}).`, structuredOutputErrorContext(input, response, responseId, cost, text));
+        }
+        let raw;
+        try {
+          raw = JSON.parse(text);
+        } catch (error) {
+          throw new StructuredOutputError2("[SixbModels] Model did not produce valid JSON output.", {
+            cause: error,
+            ...structuredOutputErrorContext(input, response, responseId, cost, text)
+          });
+        }
+        try {
+          return {
+            status: "completed",
+            output: input.output.validate(raw),
+            steps,
+            finishReason: response.finishReason
+          };
+        } catch (error) {
+          throw new StructuredOutputError2("[SixbModels] Structured output validation failed.", {
+            cause: error,
+            ...structuredOutputErrorContext(input, response, responseId, cost, text)
+          });
+        }
+      }
+      const output = responseText(response);
+      return { status: "completed", output, steps, finishReason: response.finishReason };
+    }
+    const toolResults = await Promise.all(localCalls.map((call) => executeToolCall(call, tools, callId, input.signal, input.onEvent)));
+    const step = modelStep(response, responseId, [...response.content, ...toolResults], cost);
+    steps.push(step);
+    await input.onStepEnd?.(step);
+    if (input.signal.aborted) {
+      return {
+        status: "aborted",
+        steps,
+        partialContent: []
+      };
+    }
+    const assistantContent = response.content.filter((part) => part.type !== "tool-result" || part.providerExecuted === true);
+    messages = [
+      ...requestMessages,
+      { role: "assistant", content: assistantContent },
+      { role: "tool", content: toolResults }
+    ];
+    if (stepIndex + 1 === input.maxSteps) {
+      if (input.output) {
+        throw new StructuredOutputError2("[SixbModels] Model reached the step limit without structured output.", structuredOutputErrorContext(input, response, responseId, cost, responseText(response)));
+      }
+      const output = responseText(response);
+      return { status: "completed", output, steps, finishReason: response.finishReason };
+    }
+  }
+  throw new ModelStreamError2("[SixbModels] Model loop exited without a terminal result.");
+}
+function assertLoopInput(input) {
+  if (input.maxOutputTokens !== undefined && (!Number.isSafeInteger(input.maxOutputTokens) || input.maxOutputTokens <= 0)) {
+    throw new TypeError("[SixbModels] maxOutputTokens must be a positive safe integer.");
+  }
+  if (!Number.isInteger(input.maxSteps) || input.maxSteps <= 0) {
+    throw new TypeError("[SixbModels] maxSteps must be a positive integer.");
+  }
+  if (!input.model.providerId.trim() || !input.model.modelId.trim()) {
+    throw new TypeError("[SixbModels] Model providerId and modelId must not be empty.");
+  }
+  if (input.model.definition.providerId !== input.model.providerId || input.model.definition.modelId !== input.model.modelId) {
+    throw new TypeError(`[SixbModels] Model definition for '${input.model.providerId}/${input.model.modelId}' has a different identity.`);
+  }
+  if (input.output) {
+    if (!input.output.name.trim()) {
+      throw new TypeError("[SixbModels] Structured output names must not be empty.");
+    }
+    assertJsonObject2(input.output.schema, "structured output schema");
+  }
+}
+function indexTools(tools) {
+  const result = new Map;
+  for (const tool of tools) {
+    if (!tool.name.trim())
+      throw new TypeError("[SixbModels] Tool names must not be empty.");
+    if (result.has(tool.name)) {
+      throw new TypeError(`[SixbModels] Duplicate tool name '${tool.name}'.`);
+    }
+    assertJsonObject2(tool.inputSchema, `tool '${tool.name}' input schema`);
+    result.set(tool.name, tool);
+  }
+  return result;
+}
+function responseText(response) {
+  return response.content.filter((part) => part.type === "text").map((part) => part.text).join("");
+}
+function structuredOutputErrorContext(input, response, responseId, cost, text) {
+  return {
+    text,
+    providerId: input.model.providerId,
+    modelId: input.model.modelId,
+    responseId,
+    ...response.responseModelId === undefined ? {} : { responseModelId: response.responseModelId },
+    finishReason: response.finishReason,
+    usage: response.usage,
+    cost
+  };
+}
+function modelStep(response, responseId, content, cost) {
+  return {
+    content,
+    finishReason: response.finishReason,
+    ...response.rawFinishReason === undefined ? {} : { rawFinishReason: response.rawFinishReason },
+    usage: response.usage,
+    responseId,
+    ...response.responseModelId === undefined ? {} : { responseModelId: response.responseModelId },
+    cost,
+    ...response.route === undefined ? {} : { route: response.route }
+  };
+}
+async function executeToolCall(call, tools, callId, signal, onEvent) {
+  const { part } = call;
+  if (call.inputError) {
+    const errorText = `Tool input is not valid JSON: ${call.inputError.message}`;
+    await onEvent?.({
+      type: "tool-input-error",
+      toolCallId: part.toolCallId,
+      toolName: part.toolName,
+      input: part.input,
+      errorText
+    });
+    return toolErrorResult(part, errorText);
+  }
+  const tool = tools.get(part.toolName);
+  if (!tool) {
+    const errorText = `Tool '${part.toolName}' is not available.`;
+    await onEvent?.({
+      type: "tool-output-error",
+      toolCallId: part.toolCallId,
+      toolName: part.toolName,
+      errorText
+    });
+    return toolErrorResult(part, errorText);
+  }
+  let parsed;
+  try {
+    parsed = tool.parseInput(part.input);
+  } catch (error) {
+    const errorText = error instanceof Error ? error.message : "Tool input validation failed.";
+    await onEvent?.({
+      type: "tool-input-error",
+      toolCallId: part.toolCallId,
+      toolName: part.toolName,
+      input: part.input,
+      errorText
+    });
+    return toolErrorResult(part, errorText);
+  }
+  await onEvent?.({
+    type: "tool-input-available",
+    toolCallId: part.toolCallId,
+    toolName: part.toolName,
+    input: part.input
+  });
+  let output;
+  let modelOutput;
+  try {
+    const context = { signal, callId, toolCallId: part.toolCallId };
+    output = await tool.execute(parsed, context);
+    assertJsonValue2(output, `tool '${part.toolName}' output`);
+    modelOutput = tool.toModelOutput ? await tool.toModelOutput(output, context) : modelToolOutput(output);
+    validateModelToolOutput(modelOutput, part.toolName);
+  } catch (error) {
+    const errorText = tool.errorText(error);
+    await onEvent?.({
+      type: "tool-output-error",
+      toolCallId: part.toolCallId,
+      toolName: part.toolName,
+      errorText
+    });
+    return toolErrorResult(part, errorText);
+  }
+  await onEvent?.({
+    type: "tool-output-available",
+    toolCallId: part.toolCallId,
+    toolName: part.toolName,
+    output
+  });
+  return {
+    type: "tool-result",
+    toolCallId: part.toolCallId,
+    toolName: part.toolName,
+    output: modelOutput,
+    ...modelOutputMatchesOriginal(modelOutput, output) ? {} : { originalOutput: output }
+  };
+}
+function validateModelToolOutput(output, toolName) {
+  if (output.type === "text" || output.type === "error-text") {
+    if (typeof output.value !== "string") {
+      throw new TypeError(`[SixbModels] Tool '${toolName}' model output must contain text.`);
+    }
+    return;
+  }
+  if (output.type !== "json" && output.type !== "error-json") {
+    throw new TypeError(`[SixbModels] Tool '${toolName}' returned an unsupported model output type.`);
+  }
+  assertJsonValue2(output.value, `tool '${toolName}' model output`);
+}
+function modelOutputMatchesOriginal(output, original) {
+  if (output.type === "text")
+    return typeof original === "string" && output.value === original;
+  if (output.type === "json")
+    return output.value === original;
+  return false;
+}
+function modelToolOutput(value) {
+  return typeof value === "string" ? { type: "text", value } : { type: "json", value };
+}
+function toolErrorResult(part, errorText) {
+  if (typeof errorText !== "string") {
+    throw new TypeError(`[SixbModels] Tool '${part.toolName}' error text must be a string.`);
+  }
+  return {
+    type: "tool-result",
+    toolCallId: part.toolCallId,
+    toolName: part.toolName,
+    output: { type: "error-text", value: errorText }
+  };
+}
+
+class StreamAccumulator {
+  onEvent;
+  parts = [];
+  spans = new Map;
+  toolCalls = new Map;
+  started = false;
+  finished = false;
+  finishReason;
+  rawFinishReason;
+  usage = {};
+  responseId;
+  providerIds;
+  responseModelId;
+  projectionError;
+  reportedCost;
+  route;
+  constructor(onEvent) {
+    this.onEvent = onEvent;
+  }
+  isFinished() {
+    return this.finished;
+  }
+  async accept(event) {
+    if (this.finished) {
+      throw new ModelStreamError2(`[SixbModels] Received '${event.type}' after stream finish.`);
+    }
+    switch (event.type) {
+      case "stream-start":
+        if (this.started)
+          throw new ModelStreamError2("[SixbModels] Duplicate stream-start event.");
+        this.started = true;
+        return;
+      case "response-metadata":
+        this.requireStarted(event.type);
+        this.responseId = event.id ?? this.responseId;
+        if (event.providerIds)
+          this.providerIds = { ...this.providerIds, ...event.providerIds };
+        this.responseModelId = event.modelId ?? this.responseModelId;
+        return;
+      case "text-start":
+        await this.startText(event);
+        return;
+      case "text-delta":
+        await this.appendText(event, "text");
+        return;
+      case "text-end":
+        await this.endText(event, "text");
+        return;
+      case "reasoning-start":
+        await this.startReasoning(event);
+        return;
+      case "reasoning-delta":
+        await this.appendText(event, "reasoning");
+        return;
+      case "reasoning-end":
+        await this.endText(event, "reasoning");
+        return;
+      case "tool-input-start":
+        await this.startTool(event);
+        return;
+      case "tool-input-delta":
+        await this.appendTool(event);
+        return;
+      case "tool-input-end":
+        this.endTool(event);
+        return;
+      case "tool-call":
+        await this.completeTool(event);
+        return;
+      case "tool-result":
+        this.addProviderToolResult(event);
+        return;
+      case "provider-state":
+        if (typeof event.providerId !== "string" || event.providerId.length === 0) {
+          this.captureProjectionError(new ModelStreamError2("[SixbModels] Provider state requires a nonempty provider ID."));
+          return;
+        }
+        if (this.captureProviderState(event.data)) {
+          this.parts.push({
+            type: "provider-state",
+            providerId: event.providerId,
+            data: event.data
+          });
+        }
+        return;
+      case "finish":
+        this.requireStarted(event.type);
+        validateUsage(event.usage);
+        this.captureProviderData(event.providerData);
+        this.finished = true;
+        this.finishReason = event.finishReason;
+        this.rawFinishReason = event.rawFinishReason;
+        this.usage = event.usage;
+        this.reportedCost = event.reportedCost;
+        this.route = event.route;
+        return;
+      case "error":
+        throw event.error instanceof Error ? event.error : new ModelProviderError2("[SixbModels] Provider stream failed.", "unknown", "unknown", {
+          cause: event.error
+        });
+    }
+  }
+  complete() {
+    if (!this.started)
+      throw new ModelStreamError2("[SixbModels] Stream did not start.");
+    if (!this.finished || !this.finishReason) {
+      throw new ModelStreamError2("[SixbModels] Stream ended without a finish event.");
+    }
+    for (const part of this.parts) {
+      if ("complete" in part && !part.complete) {
+        throw new ModelStreamError2(`[SixbModels] Stream finished with incomplete ${part.type} content.`);
+      }
+    }
+    const parsed = this.parseParts(false);
+    return {
+      content: parsed.content,
+      toolCalls: parsed.toolCalls,
+      finishReason: this.finishReason,
+      ...this.rawFinishReason === undefined ? {} : { rawFinishReason: this.rawFinishReason },
+      ...this.accounting(),
+      ...this.projectionError === undefined ? {} : { projectionError: this.projectionError }
+    };
+  }
+  accounting() {
+    return {
+      usage: this.usage,
+      ...this.responseId === undefined ? {} : { responseId: this.responseId },
+      ...this.providerIds === undefined ? {} : { providerIds: this.providerIds },
+      ...this.responseModelId === undefined ? {} : { responseModelId: this.responseModelId },
+      ...this.reportedCost === undefined ? {} : { reportedCost: this.reportedCost },
+      ...this.route === undefined ? {} : { route: this.route }
+    };
+  }
+  partialContent() {
+    return this.parseParts(true).content;
+  }
+  parseParts(partial) {
+    const content = [];
+    const toolCalls = [];
+    for (const part of this.parts) {
+      if (part.type === "text") {
+        if ((!partial || part.text.length > 0) && (part.complete || partial)) {
+          content.push({
+            type: "text",
+            text: part.text,
+            ...part.providerData === undefined ? {} : { providerData: part.providerData }
+          });
+        }
+      } else if (part.type === "reasoning") {
+        if (part.complete) {
+          content.push({
+            type: "reasoning",
+            text: part.text,
+            ...part.providerData === undefined ? {} : { providerData: part.providerData }
+          });
+        }
+      } else if (part.type === "tool-call") {
+        if (!part.complete)
+          continue;
+        let value = null;
+        let inputError;
+        try {
+          const parsed = JSON.parse(part.inputText);
+          if (!isJsonValue2(parsed))
+            throw new TypeError("input is not a JSON value");
+          value = parsed;
+        } catch (error) {
+          inputError = error instanceof Error ? error : new Error(String(error));
+        }
+        const call = {
+          type: "tool-call",
+          toolCallId: part.toolCallId,
+          toolName: part.toolName,
+          input: value,
+          ...part.providerData === undefined ? {} : { providerData: part.providerData },
+          ...part.providerExecuted === undefined ? {} : { providerExecuted: part.providerExecuted },
+          ...part.dynamic === undefined ? {} : { dynamic: part.dynamic }
+        };
+        content.push(call);
+        toolCalls.push({ part: call, ...inputError === undefined ? {} : { inputError } });
+      } else {
+        content.push(part);
+      }
+    }
+    return { content, toolCalls };
+  }
+  async startText(event) {
+    this.requireStarted(event.type);
+    this.assertNewSpan(event.id);
+    const providerData = this.captureProviderData(event.providerData);
+    const part = {
+      type: "text",
+      text: "",
+      complete: false,
+      ...providerData === undefined ? {} : { providerData }
+    };
+    this.spans.set(event.id, part);
+    this.parts.push(part);
+    await this.onEvent?.({ type: "text-start", id: event.id });
+  }
+  async startReasoning(event) {
+    this.requireStarted(event.type);
+    this.assertNewSpan(event.id);
+    const providerData = this.captureProviderData(event.providerData);
+    const part = {
+      type: "reasoning",
+      text: "",
+      complete: false,
+      ...providerData === undefined ? {} : { providerData }
+    };
+    this.spans.set(event.id, part);
+    this.parts.push(part);
+    await this.onEvent?.({ type: "reasoning-start", id: event.id });
+  }
+  async appendText(event, expected) {
+    const part = this.spans.get(event.id);
+    if (!part || part.type !== expected || part.complete) {
+      throw new ModelStreamError2(`[SixbModels] ${event.type} references unopened ${expected} span '${event.id}'.`);
+    }
+    part.text += event.delta;
+    await this.onEvent?.({ type: event.type, id: event.id, delta: event.delta });
+  }
+  async endText(event, expected) {
+    const part = this.spans.get(event.id);
+    if (!part || part.type !== expected || part.complete) {
+      throw new ModelStreamError2(`[SixbModels] ${event.type} references unopened ${expected} span '${event.id}'.`);
+    }
+    part.providerData = mergeProviderData(part.providerData, this.captureProviderData(event.providerData));
+    part.complete = true;
+    this.spans.delete(event.id);
+    await this.onEvent?.({ type: event.type, id: event.id });
+  }
+  async startTool(event) {
+    this.requireStarted(event.type);
+    if (typeof event.id !== "string" || !event.id || typeof event.toolName !== "string" || !event.toolName) {
+      throw new ModelStreamError2("[SixbModels] Tool calls require nonempty IDs and names.");
+    }
+    if (this.toolCalls.has(event.id)) {
+      throw new ModelStreamError2(`[SixbModels] Duplicate tool call ID '${event.id}'.`);
+    }
+    const providerData = this.captureProviderData(event.providerData);
+    const part = {
+      type: "tool-call",
+      toolCallId: event.id,
+      toolName: event.toolName,
+      inputText: "",
+      complete: false,
+      ...providerData === undefined ? {} : { providerData },
+      ...event.providerExecuted === undefined ? {} : { providerExecuted: event.providerExecuted },
+      ...event.dynamic === undefined ? {} : { dynamic: event.dynamic }
+    };
+    this.toolCalls.set(event.id, part);
+    this.parts.push(part);
+    await this.onEvent?.({
+      type: "tool-input-start",
+      toolCallId: event.id,
+      toolName: event.toolName
+    });
+  }
+  async appendTool(event) {
+    const part = this.toolCalls.get(event.id);
+    if (!part || part.complete) {
+      throw new ModelStreamError2(`[SixbModels] tool-input-delta references unopened tool call '${event.id}'.`);
+    }
+    part.inputText += event.delta;
+    await this.onEvent?.({
+      type: "tool-input-delta",
+      toolCallId: event.id,
+      toolName: part.toolName,
+      inputTextDelta: event.delta
+    });
+  }
+  endTool(event) {
+    const part = this.toolCalls.get(event.id);
+    if (!part || part.complete) {
+      throw new ModelStreamError2(`[SixbModels] tool-input-end references unopened tool call '${event.id}'.`);
+    }
+    part.providerData = mergeProviderData(part.providerData, this.captureProviderData(event.providerData));
+    part.complete = true;
+  }
+  async completeTool(event) {
+    await this.startTool({
+      type: "tool-input-start",
+      id: event.toolCallId,
+      toolName: event.toolName,
+      ...event.providerData === undefined ? {} : { providerData: event.providerData },
+      ...event.providerExecuted === undefined ? {} : { providerExecuted: event.providerExecuted },
+      ...event.dynamic === undefined ? {} : { dynamic: event.dynamic }
+    });
+    const part = this.toolCalls.get(event.toolCallId);
+    if (!part)
+      throw new ModelStreamError2("[SixbModels] Failed to index completed tool call.");
+    part.inputText = event.input;
+    part.complete = true;
+  }
+  addProviderToolResult(event) {
+    if (!this.captureJsonValue(event.output, "provider tool result"))
+      return;
+    const providerData = this.captureProviderData(event.providerData);
+    this.parts.push({
+      type: "tool-result",
+      toolCallId: event.toolCallId,
+      toolName: event.toolName,
+      output: event.isError ? { type: "error-json", value: event.output } : modelToolOutput(event.output),
+      providerExecuted: event.providerExecuted ?? true,
+      ...event.dynamic === undefined ? {} : { dynamic: event.dynamic },
+      ...providerData === undefined ? {} : { providerData }
+    });
+  }
+  captureProviderData(data) {
+    if (data === undefined)
+      return;
+    try {
+      return normalizeProviderData(data);
+    } catch (error) {
+      this.captureProjectionError(error);
+      return;
+    }
+  }
+  captureProviderState(value) {
+    if (!this.captureJsonValue(value, "provider state"))
+      return false;
+    if (JSON.stringify(value).length > MAX_PROVIDER_DATA_BYTES) {
+      this.captureProjectionError(new ModelStreamError2(`[SixbModels] Provider state exceeds the ${MAX_PROVIDER_DATA_BYTES}-byte response limit.`));
+      return false;
+    }
+    return true;
+  }
+  captureJsonValue(value, label) {
+    try {
+      assertJsonValue2(value, label);
+      return true;
+    } catch (error) {
+      this.captureProjectionError(error);
+      return false;
+    }
+  }
+  captureProjectionError(error) {
+    this.projectionError ??= error instanceof Error ? error : new Error(String(error));
+  }
+  requireStarted(type) {
+    if (!this.started) {
+      throw new ModelStreamError2(`[SixbModels] Received '${type}' before stream-start.`);
+    }
+  }
+  assertNewSpan(id) {
+    if (!id)
+      throw new ModelStreamError2("[SixbModels] Content span IDs must not be empty.");
+    if (this.spans.has(id)) {
+      throw new ModelStreamError2(`[SixbModels] Duplicate open content span '${id}'.`);
+    }
+  }
+}
+function validateUsage(usage) {
+  for (const [key, value] of Object.entries(usage)) {
+    if (key === "raw") {
+      if (value !== undefined)
+        assertJsonValue2(value, "raw model usage");
+      continue;
+    }
+    if (value !== undefined && (!Number.isSafeInteger(value) || value < 0)) {
+      throw new ModelStreamError2(`[SixbModels] Usage field '${key}' must be a nonnegative integer.`);
+    }
+  }
+}
+function normalizeProviderData(value) {
+  const data = omitUndefinedObjectProperties(value);
+  assertJsonValue2(data, "provider data");
+  if (typeof data !== "object" || data === null || Array.isArray(data)) {
+    throw new TypeError("[SixbModels] provider data must be a JSON object.");
+  }
+  if (JSON.stringify(data).length > MAX_PROVIDER_DATA_BYTES) {
+    throw new ModelStreamError2(`[SixbModels] Provider data exceeds the ${MAX_PROVIDER_DATA_BYTES}-byte response limit.`);
+  }
+  return data;
+}
+function omitUndefinedObjectProperties(value, seen = new Set) {
+  if (typeof value !== "object" || value === null || seen.has(value))
+    return value;
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return value.map((entry) => omitUndefinedObjectProperties(entry, seen));
+    }
+    if (!isPlainRecord(value))
+      return value;
+    return Object.fromEntries(Reflect.ownKeys(value).filter((key) => Object.prototype.propertyIsEnumerable.call(value, key)).map((key) => [key, Reflect.get(value, key)]).filter(([, entry]) => entry !== undefined).map(([key, entry]) => [key, omitUndefinedObjectProperties(entry, seen)]));
+  } finally {
+    seen.delete(value);
+  }
+}
+function mergeProviderData(first, second) {
+  if (first === undefined)
+    return second;
+  if (second === undefined)
+    return first;
+  return { ...first, ...second };
+}
+function isAbortError(error) {
+  return error instanceof DOMException && error.name === "AbortError" || error instanceof Error && error.name === "AbortError";
+}
+
+// src/models/execution/binding.ts
+var bindings = new WeakMap;
+function registerModelExecutionBinding(models, bind) {
+  bindings.set(models, bind);
+}
+function bindModelExecutionAttempt(models, input) {
+  const bind = bindings.get(models);
+  if (!bind)
+    throw new Error("[SixbModels] Model runtime has no execution binding.");
+  if (!Number.isSafeInteger(input.attempt) || input.attempt < 1) {
+    throw new TypeError("[SixbModels] Execution attempt must be a positive safe integer.");
+  }
+  bind(input);
+  bindings.delete(models);
+}
+
+// src/models/output.ts
+function languageModelOutput(shape, valueTypesById) {
+  if (!isRecord2(shape))
+    throw new TypeError("[SixbModels] output must be a Sixb schema record.");
+  const schema = schemaRecordToJsonSchema2({ shape, valueTypesById });
+  assertJsonObject2(schema, "model output schema");
+  return {
+    name: "sixb_output",
+    schema,
+    validate(value) {
+      if (!isRecord2(value))
+        throw new TypeError("[SixbModels] Output must be an object.");
+      for (const key of Object.keys(value)) {
+        if (!Object.hasOwn(shape, key)) {
+          throw new TypeError(`[SixbModels] Unknown output field '${key}'.`);
+        }
+      }
+      return Object.fromEntries(Object.entries(shape).map(([key, field]) => {
+        if (!Object.hasOwn(value, key)) {
+          throw new TypeError(`[SixbModels] Missing output field '${key}'.`);
+        }
+        validateSchemaOrRefValue2(field, value[key], `output.${key}`, valueTypesById);
+        const output = isObjectRefSchema2(field) ? value[key] : coerceSchemaValueToTyped2(field, normalizeSchemaValue2(field, value[key], `output.${key}`, valueTypesById), valueTypesById);
+        return [key, output];
+      }));
+    }
+  };
+}
+
+// src/models/execution.ts
+function createModelsRuntime(runtime, execution, catalog) {
+  let binding;
+  let recorder;
+  async function createRecorder() {
+    const storage = {
+      ...requireAccountingCapabilities(runtime.storage),
+      transaction: runtime.storage.transaction.bind(runtime.storage)
+    };
+    if (!binding) {
+      throw new Error("[SixbModels] Generation requires a bound request or worker execution attempt.");
+    }
+    const { requesterGroupIds } = await ensureExecutionRecord2(runtime.storage.executions, executionRecordInputFromRuntime({
+      execution,
+      runtimeAuthorization: runtime.runtimeAuthorization
+    }));
+    return new AiModelCallRecorder2({
+      storage,
+      projectId: runtime.projectId,
+      executionId: execution.id,
+      attempt: binding.attempt,
+      requesterGroupIds,
+      limits: createAiModelCallLimitController2({
+        storage,
+        projectId: runtime.projectId,
+        requestedBy: execution.requestedBy,
+        requesterGroupIds
+      }),
+      recoverAiModelCall: (input) => enqueueAiModelCallRecovery2(runtime.queues.agents, input)
+    });
+  }
+  async function generate(input) {
+    assertProviderAccess2(runtime, execution, "models.language.generate");
+    const messages = generationMessages(input);
+    if (!binding) {
+      throw new Error("[SixbModels] Generation requires a bound request or worker execution attempt.");
+    }
+    const signal = input.signal ? AbortSignal.any([binding.signal, input.signal]) : binding.signal;
+    signal.throwIfAborted();
+    const selected = input.model ? catalog ? catalog.language.getByRef({
+      provider: input.model.providerId,
+      modelId: input.model.modelId
+    })?.model : input.model : catalog?.language.default.model;
+    if (!selected) {
+      throw new Error(input.model ? `[SixbModels] Model '${input.model.providerId}/${input.model.modelId}' is not configured in models.language.` : "[SixbModels] Configure models.language in createSixb() or supply a model to generate().");
+    }
+    const output = input.output === undefined ? undefined : languageModelOutput(input.output, runtime.ontology.getValueTypesById());
+    const model = await resolveLanguageModel2(selected);
+    const reasoningIssue = modelReasoningSupportIssue2(model.definition.capabilities.reasoning, input.reasoning);
+    if (reasoningIssue)
+      throw new UnsupportedModelFeatureError2(`[SixbModels] ${reasoningIssue}.`);
+    if (output && model.definition.capabilities.nativeStructuredOutput === false) {
+      throw new UnsupportedModelFeatureError2("[SixbModels] Model does not support native structured output.");
+    }
+    const maxOutputTokens = Math.min(aiModelCallOutputTokenAllowance(input.maxOutputTokens ?? model.definition.maxOutputTokens), model.definition.maxOutputTokens ?? Infinity);
+    if (typeof input.reasoning === "object" && input.reasoning.budgetTokens >= maxOutputTokens) {
+      throw new TypeError("[SixbModels] Output allowance must exceed the reasoning token budget.");
+    }
+    recorder ??= createRecorder();
+    const accounting = await recorder;
+    accounting.assertHealthy();
+    signal.throwIfAborted();
+    let event;
+    const options = {
+      model: accounting.wrapModel(model),
+      messages,
+      maxSteps: 1,
+      rejectLocalToolCalls: true,
+      maxOutputTokens,
+      reasoning: input.reasoning,
+      caching: input.caching,
+      signal,
+      onModelCallEnd: async (completed) => {
+        await accounting.onModelCallEnd(completed);
+        event = completed;
+      }
+    };
+    const result = output ? await runModelLoop2({ ...options, output }) : await runModelLoop2(options);
+    if (result.status === "aborted") {
+      signal.throwIfAborted();
+      throw new DOMException("Model generation aborted", "AbortError");
+    }
+    if (result.finishReason === "error" || result.finishReason === "content-filter") {
+      throw new ModelProviderError2(`[SixbModels] Generation ended with '${result.finishReason}'.`, model.providerId, model.modelId);
+    }
+    if (!event)
+      throw new ModelStreamError2("[SixbModels] Generation completed without accounting metadata.");
+    return {
+      output: result.output,
+      usage: event.usage,
+      cost: event.cost,
+      callId: event.callId,
+      finishReason: result.finishReason
+    };
+  }
+  const models = {
+    language: { generate }
+  };
+  registerModelExecutionBinding(models, (input) => {
+    binding = { attempt: input.attempt, signal: input.signal };
+  });
+  return models;
+}
+function generationMessages(input) {
+  if (input.prompt === undefined === (input.messages === undefined)) {
+    throw new TypeError("[SixbModels] Supply exactly one of prompt or messages.");
+  }
+  if (input.prompt !== undefined && typeof input.prompt !== "string") {
+    throw new TypeError("[SixbModels] prompt must be a string.");
+  }
+  if (input.messages !== undefined && !Array.isArray(input.messages)) {
+    throw new TypeError("[SixbModels] messages must be an array.");
+  }
+  if (input.instructions !== undefined && typeof input.instructions !== "string") {
+    throw new TypeError("[SixbModels] instructions must be a string.");
+  }
+  if (input.maxOutputTokens !== undefined && (!Number.isSafeInteger(input.maxOutputTokens) || input.maxOutputTokens <= 0)) {
+    throw new TypeError("[SixbModels] maxOutputTokens must be a positive safe integer.");
+  }
+  if (input.caching !== undefined && input.caching !== "auto" && input.caching !== "off") {
+    throw new TypeError("[SixbModels] caching must be 'auto' or 'off'.");
+  }
+  return [
+    ...input.instructions === undefined ? [] : [{ role: "system", content: input.instructions }],
+    ...input.prompt !== undefined ? [{ role: "user", content: [{ type: "text", text: input.prompt }] }] : input.messages ?? []
+  ];
+}
+
+// src/objects/execution.ts
+function createObjectsRuntime(runtime, execution) {
+  const runtimeAuthorization = runtime.runtimeAuthorization;
+  const objectReader = runtime.objectReader;
+  assertAuthorizedObjectReaderBinding({
+    reader: objectReader,
+    scope: { execution, authorization: runtimeAuthorization }
+  });
+  const authorization = runtime.authorization;
+  const capturedRuntime = {
+    projectId: runtime.projectId,
+    broker: runtime.broker,
+    ontology: runtime.ontology,
+    actionRegistry: runtime.actionRegistry,
+    events: runtime.events,
+    storage: runtime.storage,
+    queues: runtime.queues,
+    runtimeAuthorization,
+    objectReader,
+    ...authorization === undefined ? {} : { authorization }
+  };
+  shareOntologyMutationRuntime2(runtime, capturedRuntime);
+  shareSixbErrorReporter2(runtime, capturedRuntime);
+  Object.freeze(capturedRuntime);
+  const ontologyView = () => getAuthorizedOntologyView(objectReader);
+  const objects = Object.assign((objectType) => {
+    assertObjectTypeRegistered2(capturedRuntime.ontology.getObjectTypesById(), objectType);
+    return createObjectSet2({ ...capturedRuntime, execution, objectType });
+  }, {
+    listTypes: () => ontologyView().listObjectTypes(),
+    getTypeById: (objectTypeId) => ontologyView().getObjectTypeById(objectTypeId),
+    resolveType: (objectTypeId) => ontologyView().resolveObjectType(objectTypeId),
+    getValueTypesById: () => ontologyView().getValueTypesById(),
+    listSubTypes: (objectTypeId) => ontologyView().listSubTypes(objectTypeId),
+    isValidLinkTarget: (expected, actual) => ontologyView().isValidLinkTarget(expected, actual),
+    executeQuery: (input) => objectReader.executeQuery(input),
+    queryLinks: (input) => objectReader.queryLinks(input),
+    count: (input) => objectReader.count(input),
+    exists: (input) => objectReader.exists(input),
+    facet: (input) => objectReader.facet(input),
+    listLinks: async (input) => {
+      return objectReader.listLinks(input);
+    },
+    getTelemetryHistoryBatch: (input) => {
+      const timeseries = capturedRuntime.storage.timeseries;
+      return getTelemetryHistoryBatch2(input, { storage: timeseries, objectReader });
+    },
+    getTelemetryHistory: async (input) => {
+      const timeseries = capturedRuntime.storage.timeseries;
+      const objectTypeId = input.objectTypeId;
+      const objectId = input.objectId;
+      const propertyId = input.propertyId;
+      const from = input.from;
+      const to = input.to;
+      const limit = input.limit;
+      const order = input.order;
+      const [result] = await getTelemetryHistoryBatch2({
+        series: [{ objectTypeId, objectId, propertyId }],
+        ...from === undefined ? {} : { from },
+        ...to === undefined ? {} : { to },
+        ...limit === undefined ? {} : { limitPerSeries: limit },
+        ...order === undefined ? {} : { order }
+      }, { storage: timeseries, objectReader });
+      return result?.points ?? [];
+    },
+    getLatestTelemetry: async (input) => {
+      const timeseries = capturedRuntime.storage.timeseries;
+      const objectTypeId = input.objectTypeId;
+      const objectId = input.objectId;
+      const propertyId = input.propertyId;
+      return getLatestTelemetryPoint({ objectTypeId, objectId, propertyId }, { storage: timeseries, objectReader });
+    },
+    list: (params) => listObjects(capturedRuntime, params),
+    get: (objectTypeId, primaryId) => objectReader.getByPrimaryId({ objectTypeId, primaryId }),
+    getPrimaryPropertyId: (objectTypeId) => {
+      return ontologyView().getPrimaryPropertyId(objectTypeId);
+    },
+    upsert: (objectTypeId, properties) => upsertObject3(capturedRuntime, objectTypeId, properties),
+    upsertBatch: (objectTypeId, items) => upsertObjectBatch3(capturedRuntime, objectTypeId, items),
+    upsertLink: (objectTypeId, sourceId, linkId, target) => upsertLink3(capturedRuntime, objectTypeId, sourceId, linkId, target),
+    upsertLinkBatch: (items) => upsertLinkBatch3(capturedRuntime, items),
+    removeLink: (objectTypeId, sourceId, linkId, target) => removeLink3(capturedRuntime, objectTypeId, sourceId, linkId, target),
+    appendTelemetry: (objectTypeId, items) => appendTelemetry(capturedRuntime, objectTypeId, items)
+  });
+  return objects;
+}
+
+// src/pipelines/execution.ts
+function createPipelinesRuntime(runtime, execution, source) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const allowed = (pipelineId) => isRuntimeAllowed2(runtime, { kind: "pipeline.run", pipelineId });
+  const visibleIds = () => source.list().filter((pipeline) => allowed(pipeline.id)).map((pipeline) => pipeline.id);
+  const historyFilterIds = () => authority.type === "unrestricted" ? undefined : authority.type === "principal" ? visibleIds() : [];
+  const getRun = async (runId) => {
+    if (authority.type === "denied" || authority.type === "delegated")
+      return null;
+    const run = await runtime.storage.pipelineRuns?.getById({
+      projectId: runtime.projectId,
+      id: runId
+    }) ?? null;
+    if (!run)
+      return null;
+    return authority.type === "unrestricted" || canViewPipelineRun2(authority.context, run) ? run : null;
+  };
+  return {
+    list: () => authority.type === "denied" || authority.type === "delegated" ? [] : source.list().filter((pipeline) => allowed(pipeline.id)),
+    getById: (pipelineId) => {
+      if (authority.type === "denied" || authority.type === "delegated")
+        return null;
+      const pipeline = source.getById(pipelineId);
+      return pipeline && allowed(pipelineId) ? pipeline : null;
+    },
+    request: async (input) => {
+      assertAuthorized2(runtime, { kind: "pipeline.run", pipelineId: input.pipelineId });
+      const pipeline = source.getById(input.pipelineId);
+      if (!pipeline)
+        throw new PipelineError2(`[Sixb] Unknown pipeline '${input.pipelineId}'`);
+      return requestPipelineRun2(runtime, execution, pipeline, input);
+    },
+    runs: {
+      getById: getRun,
+      list: (input = {}) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ runs: [], hasMore: false, total: 0 });
+        }
+        const storage = runtime.storage.pipelineRuns;
+        if (!storage)
+          return Promise.resolve({ runs: [], hasMore: false, total: 0 });
+        return storage.list({
+          ...input,
+          pipelineIds: historyFilterIds(),
+          projectId: runtime.projectId
+        });
+      },
+      listLatest: (pipelineIds) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ runs: [] });
+        }
+        const storage = runtime.storage.pipelineRuns;
+        if (!storage || pipelineIds.length === 0)
+          return Promise.resolve({ runs: [] });
+        const allowedIds = pipelineIds.filter(allowed);
+        return allowedIds.length === 0 ? Promise.resolve({ runs: [] }) : storage.listLatestByPipelineIds({
+          projectId: runtime.projectId,
+          pipelineIds: allowedIds
+        });
+      },
+      listSteps: async (runId, input = {}) => {
+        const storage = runtime.storage.pipelineRuns;
+        if (!storage || !await getRun(runId))
+          return null;
+        return storage.listSteps({
+          ...input,
+          pipelineRunId: runId,
+          projectId: runtime.projectId
+        });
+      }
+    }
+  };
+}
+
+// src/projections/execution.ts
+function createProjectionsRuntime(runtime, source) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const listVisible = (list) => {
+    switch (authority.type) {
+      case "denied":
+      case "delegated":
+        return [];
+      case "principal":
+        return list().filter((projection) => canViewProjection2(authority.context, projection));
+      case "unrestricted":
+        return [...list()];
+    }
+  };
+  const visible = (projection) => {
+    switch (authority.type) {
+      case "denied":
+      case "delegated":
+        return false;
+      case "principal":
+        return canViewProjection2(authority.context, projection);
+      case "unrestricted":
+        return true;
+    }
+  };
+  const visibleIds = (projectionIds) => projectionIds.filter((projectionId) => {
+    const projection = source.getById(projectionId);
+    return projection !== null && visible(projection);
+  });
+  return {
+    list: () => listVisible(() => source.list()),
+    listObjects: () => listVisible(() => source.listObjects()),
+    listLinks: () => listVisible(() => source.listLinks()),
+    listTelemetry: () => listVisible(() => source.listTelemetry()),
+    getById: (projectionId) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return null;
+        case "principal":
+        case "unrestricted":
+          break;
+      }
+      const projection = source.getById(projectionId);
+      return projection && visible(projection) ? projection : null;
+    },
+    runs: {
+      getById: async (runId) => {
+        switch (authority.type) {
+          case "denied":
+          case "delegated":
+            return null;
+          case "principal":
+          case "unrestricted":
+            break;
+        }
+        const run = await runtime.storage.projectionRuns?.getById({
+          projectId: runtime.projectId,
+          id: runId
+        }) ?? null;
+        if (!run)
+          return null;
+        return authority.type === "unrestricted" || canViewProjectionRun2(authority.context, run.target) ? run : null;
+      },
+      list: (input = {}) => {
+        switch (authority.type) {
+          case "denied":
+          case "delegated":
+            return Promise.resolve({ runs: [], hasMore: false, total: 0 });
+          case "principal":
+          case "unrestricted":
+            break;
+        }
+        const storage = runtime.storage.projectionRuns;
+        if (!storage)
+          return Promise.resolve({ runs: [], hasMore: false, total: 0 });
+        return storage.list({
+          ...input,
+          objectTypeIds: authority.type === "principal" ? [...authority.context.grants["view:object"]] : undefined,
+          projectId: runtime.projectId
+        });
+      },
+      listLatest: (projectionIds) => {
+        switch (authority.type) {
+          case "denied":
+          case "delegated":
+            return Promise.resolve({ runs: [] });
+          case "principal":
+          case "unrestricted":
+            break;
+        }
+        const storage = runtime.storage.projectionRuns;
+        if (!storage || projectionIds.length === 0)
+          return Promise.resolve({ runs: [] });
+        const ids = visibleIds(projectionIds);
+        return ids.length === 0 ? Promise.resolve({ runs: [] }) : storage.listLatestByProjectionIds({ projectId: runtime.projectId, projectionIds: ids });
+      }
+    }
+  };
+}
+
+// src/rules/execution.ts
+function createRulesRuntime(runtime, source) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const visible = (rule) => {
+    if (authority.type === "denied" || authority.type === "delegated")
+      return false;
+    return isRuntimeAllowed2(runtime, {
+      kind: "object.view",
+      objectTypeId: rule.subject.objectTypeId
+    });
+  };
+  return {
+    list: () => authority.type === "denied" || authority.type === "delegated" ? [] : source.list().filter(visible),
+    getById: (ruleId) => {
+      if (authority.type === "denied" || authority.type === "delegated")
+        return null;
+      const rule = source.getById(ruleId);
+      return rule && visible(rule) ? rule : null;
+    },
+    states: {
+      list: (input = {}) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ states: [], hasMore: false, total: 0 });
+        }
+        const storage = runtime.storage.rules;
+        if (!storage)
+          return Promise.resolve({ states: [], hasMore: false, total: 0 });
+        return storage.listActive({
+          ...input,
+          objectTypeIds: authority.type === "principal" ? [...authority.context.grants["view:object"]] : undefined,
+          projectId: runtime.projectId
+        });
+      }
+    }
+  };
+}
+
+// src/schedules/execution.ts
+function createSchedulesRuntime(runtime, schedules) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  return {
+    list: () => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return [];
+        case "principal":
+        case "unrestricted":
+          return schedules.list();
+      }
+    },
+    getById: (scheduleId) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return null;
+        case "principal":
+        case "unrestricted":
+          return schedules.getById(scheduleId);
+      }
+    }
+  };
+}
+
+// src/shares/execution.ts
+import { createHash as createHash2, randomBytes, randomUUID as randomUUID5 } from "crypto";
+var MAX_CREATE_ATTEMPTS = 5;
+
+class ShareError2 extends Error {
+  reason;
+  name = "ShareError";
+  constructor(reason, message, options) {
+    super(message, options);
+    this.reason = reason;
+  }
+}
+function createSharesRuntime(runtime, execution, definitions) {
+  const managementPrincipal = () => {
+    const authority = resolveExecutionScopeAuthorization(runtime.projectId, {
+      execution,
+      authorization: runtime.runtimeAuthorization
+    });
+    if (authority.type !== "principal" || authority.context.principal.type === "system") {
+      throw new ShareError2("unauthenticated", "[Sixb] Shared access grants require user or service-account authority.");
+    }
+    return {
+      type: authority.context.principal.type,
+      id: authority.context.principal.id
+    };
+  };
+  const canManage = (shareId) => {
+    try {
+      managementPrincipal();
+      return isRuntimeAllowed2(runtime, { kind: "share.manage", shareId });
+    } catch {
+      return false;
+    }
+  };
+  const resolveManageableDefinition = (definitionId) => {
+    const id = validDefinitionId(definitionId);
+    managementPrincipal();
+    assertCanManage(runtime, id);
+    return resolveDefinition(definitions, id);
+  };
+  const issueByDefinition = async (definition, input) => {
+    assertInputObject(input, "Shared access issue input");
+    const issuer = managementPrincipal();
+    assertCanManage(runtime, definition.id);
+    const storage = requireShareStorage(runtime);
+    const createdAt = new Date;
+    const expiresAt = validFutureDate(input.expiresAt, createdAt);
+    const target = exactTarget(definition, input.target);
+    const object = await runtime.objectReader.getByPrimaryId({
+      objectTypeId: target.objectTypeId,
+      primaryId: target.primaryId
+    });
+    if (!object) {
+      throw new ObjectNotFoundError2(target.objectTypeId, target.primaryId, "Share target not found");
+    }
+    const authoritySnapshot = {
+      version: 1,
+      access: compileShareAccessPlan({
+        share: definition,
+        target,
+        ontology: runtime.ontology,
+        actions: runtime.actionRegistry
+      })
+    };
+    for (let attempt = 0;attempt < MAX_CREATE_ATTEMPTS; attempt += 1) {
+      const secret = randomBytes(32).toString("base64url");
+      try {
+        const grant = await storage.create({
+          id: `shr_${randomUUID5()}`,
+          projectId: runtime.projectId,
+          definitionId: definition.id,
+          target,
+          issuedBy: issuer,
+          authoritySnapshot,
+          tokenHash: sha256(secret),
+          destinationPath: input.destinationPath,
+          createdAt,
+          expiresAt
+        });
+        return { grant: publicGrant(grant), secret };
+      } catch (error) {
+        if (error instanceof ShareGrantStorageError2 && error.code === "invalid_input") {
+          throw new ShareError2("invalid_input", error.message, { cause: error });
+        }
+        if (!(error instanceof ShareGrantStorageError2) || error.code !== "duplicate" || attempt === MAX_CREATE_ATTEMPTS - 1) {
+          throw storageFailure("issue", error);
+        }
+      }
+    }
+    throw storageFailure("issue");
+  };
+  const listByDefinition = async (definition, input = {}) => {
+    assertInputObject(input, "Shared access list input");
+    managementPrincipal();
+    assertCanManage(runtime, definition.id);
+    const storage = requireShareStorage(runtime);
+    const target = input.target === undefined ? undefined : exactTarget(definition, input.target);
+    try {
+      const result = await storage.list({
+        projectId: runtime.projectId,
+        definitionId: definition.id,
+        ...target === undefined ? {} : { target },
+        includeRevoked: input.includeRevoked,
+        includeExpired: input.includeExpired,
+        now: new Date,
+        limit: input.limit,
+        offset: input.offset
+      });
+      return { ...result, grants: result.grants.map(publicGrant) };
+    } catch (error) {
+      if (error instanceof ShareGrantStorageError2 && error.code === "invalid_input") {
+        throw new ShareError2("invalid_input", error.message, { cause: error });
+      }
+      throw storageFailure("list", error);
+    }
+  };
+  return {
+    listDefinitions: () => definitions.list().filter((definition) => canManage(definition.id)),
+    getDefinitionById: (definitionId) => {
+      const definition = definitions.getById(definitionId);
+      return definition && canManage(definition.id) ? definition : null;
+    },
+    async issue(definition, input) {
+      return issueByDefinition(resolveManageableDefinition(definitionIdFromReference(definition)), input);
+    },
+    async issueById(input) {
+      assertInputObject(input, "Shared access issue input");
+      return issueByDefinition(resolveManageableDefinition(input.definitionId), input);
+    },
+    async list(definition, input) {
+      return listByDefinition(resolveManageableDefinition(definitionIdFromReference(definition)), input);
+    },
+    async listById(input) {
+      assertInputObject(input, "Shared access list input");
+      const definition = resolveManageableDefinition(input.definitionId);
+      const { primaryId, includeRevoked, includeExpired, limit, offset } = input;
+      return listByDefinition(definition, {
+        ...primaryId === undefined ? {} : {
+          target: {
+            objectTypeId: definition.target.objectTypeId,
+            primaryId
+          }
+        },
+        includeRevoked,
+        includeExpired,
+        limit,
+        offset
+      });
+    },
+    revoke: async (grantId) => {
+      const actor = managementPrincipal();
+      const storage = requireShareStorage(runtime);
+      if (typeof grantId !== "string" || !grantId.trim()) {
+        throw new ShareError2("invalid_input", "[Sixb] Shared access grant id must not be empty.");
+      }
+      let current;
+      try {
+        current = await storage.getById({ projectId: runtime.projectId, id: grantId });
+      } catch (error) {
+        throw storageFailure("load for revocation", error);
+      }
+      if (!current)
+        return null;
+      if (!definitions.getById(current.definitionId) || !canManage(current.definitionId)) {
+        return null;
+      }
+      try {
+        const revoked = await storage.revoke({
+          projectId: runtime.projectId,
+          id: grantId,
+          revokedAt: new Date,
+          revokedBy: actor
+        });
+        return revoked ? publicGrant(revoked) : null;
+      } catch (error) {
+        throw storageFailure("revoke", error);
+      }
+    }
+  };
+}
+function definitionIdFromReference(value) {
+  return typeof value === "object" && value !== null ? value.id : undefined;
+}
+function assertInputObject(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new ShareError2("invalid_input", `[Sixb] ${label} must be an object.`);
+  }
+}
+function resolveDefinition(definitions, definitionId) {
+  const id = validDefinitionId(definitionId);
+  const definition = definitions.getById(id);
+  if (!definition) {
+    throw new ShareError2("not_found", `[Sixb] Unknown Share definition '${id}'.`);
+  }
+  return definition;
+}
+function validDefinitionId(value) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new ShareError2("invalid_input", "[Sixb] Share definition id must not be empty.");
+  }
+  return value;
+}
+function assertCanManage(runtime, shareId) {
+  assertAuthorized2(runtime, { kind: "share.manage", shareId });
+}
+function requireShareStorage(runtime) {
+  const storage = runtime.storage.shareGrants;
+  if (!storage) {
+    throw new ShareError2("storage_unavailable", "[Sixb] Share grant storage is not configured on this runtime.");
+  }
+  return storage;
+}
+function exactTarget(definition, value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new ShareError2("invalid_input", "[Sixb] Share target must be an exact object reference.");
+  }
+  const objectTypeId = value.objectTypeId;
+  const primaryId = value.primaryId;
+  if (typeof objectTypeId !== "string" || typeof primaryId !== "string" || !primaryId.trim()) {
+    throw new ShareError2("invalid_input", "[Sixb] Share target must be an exact object reference.");
+  }
+  if (objectTypeId !== definition.target.objectTypeId) {
+    throw new ShareError2("invalid_input", `[Sixb] Share '${definition.id}' targets '${definition.target.objectTypeId}', not '${objectTypeId}'.`);
+  }
+  return Object.freeze({ objectTypeId, primaryId });
+}
+function validFutureDate(value, now) {
+  if (!(value instanceof Date) || !Number.isFinite(value.getTime()) || value <= now) {
+    throw new ShareError2("invalid_input", "[Sixb] Shared access expiry must be a valid future date.");
+  }
+  return new Date(value);
+}
+function sha256(value) {
+  return createHash2("sha256").update(value).digest("hex");
+}
+function publicGrant(record) {
+  const {
+    projectId: _projectId,
+    authoritySnapshot: _authoritySnapshot,
+    authorityDigest: _authorityDigest,
+    tokenHash: _tokenHash,
+    ...grant
+  } = record;
+  return structuredClone(grant);
+}
+function storageFailure(operation, cause) {
+  return new ShareError2("storage_failure", `[Sixb] Share grant storage failed to ${operation}.`, {
+    cause
+  });
+}
+
+// src/syncs/execution.ts
+function createSyncsRuntime(runtime, execution, source) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const allowed = (syncId) => isRuntimeAllowed2(runtime, { kind: "sync.run", syncId });
+  const visibleIds = () => source.list().filter((sync) => allowed(sync.id)).map((sync) => sync.id);
+  const historyFilterIds = () => authority.type === "unrestricted" ? undefined : authority.type === "principal" ? visibleIds() : [];
+  return {
+    list: () => authority.type === "denied" || authority.type === "delegated" ? [] : source.list().filter((sync) => allowed(sync.id)),
+    getById: (syncId) => {
+      if (authority.type === "denied" || authority.type === "delegated")
+        return null;
+      const sync = source.getById(syncId);
+      return sync && allowed(syncId) ? sync : null;
+    },
+    request: async (input) => {
+      assertAuthorized2(runtime, { kind: "sync.run", syncId: input.syncId });
+      const sync = source.getById(input.syncId);
+      if (!sync)
+        throw new SyncValidationError2(`[Sixb] Unknown sync '${input.syncId}'`);
+      return requestSyncRun2(runtime, execution, sync, input);
+    },
+    runs: {
+      getById: async (runId) => {
+        if (authority.type === "denied" || authority.type === "delegated")
+          return null;
+        const run = await runtime.storage.syncRuns?.getById({
+          projectId: runtime.projectId,
+          id: runId
+        }) ?? null;
+        return run && allowed(run.syncId) ? run : null;
+      },
+      list: (input = {}) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ runs: [], hasMore: false, total: 0 });
+        }
+        const storage = runtime.storage.syncRuns;
+        if (!storage)
+          return Promise.resolve({ runs: [], hasMore: false, total: 0 });
+        return storage.list({
+          ...input,
+          syncIds: historyFilterIds(),
+          projectId: runtime.projectId
+        });
+      },
+      listLatest: (syncIds) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ runs: [] });
+        }
+        const storage = runtime.storage.syncRuns;
+        if (!storage || syncIds.length === 0)
+          return Promise.resolve({ runs: [] });
+        const allowedIds = syncIds.filter(allowed);
+        return allowedIds.length === 0 ? Promise.resolve({ runs: [] }) : storage.listLatestBySyncIds({ projectId: runtime.projectId, syncIds: allowedIds });
+      }
+    }
+  };
+}
+
+// src/workflows/errors.ts
+class WorkflowDefinitionError2 extends Error {
+  name = "WorkflowDefinitionError";
+}
+
+class WorkflowValidationError2 extends Error {
+  name = "WorkflowValidationError";
+  cause;
+  constructor(message, options) {
+    super(message);
+    this.cause = options?.cause;
+  }
+}
+
+// src/workflows/run-dispatch.ts
+import { randomUUID as randomUUID6 } from "crypto";
+import { isDeepStrictEqual } from "util";
+
+// src/workflows/validation.ts
+function assertNonEmpty(value, subject, field) {
+  if (!value.trim()) {
+    throw new WorkflowDefinitionError2(`${subject} ${field} must not be empty.`);
+  }
+}
+function isStepDefinition2(value) {
+  return isRecord(value) && value.kind === "step" && typeof value.id === "string" && isRecord(value.input) && isRecord(value.output) && typeof value.handler === "function";
+}
+function isAgentStepDefinition2(value) {
+  return isRecord(value) && value.kind === "agentStep" && typeof value.id === "string" && (value.model === undefined || isLanguageModel(value.model)) && (value.reasoning === undefined || isModelReasoning2(value.reasoning)) && typeof value.instructions === "string" && isStringArray(value.groupIds) && isStringArray(value.toolNames) && isRecord(value.input) && isRecord(value.output) && typeof value.prompt === "function";
+}
+function isInterventionDefinition2(value) {
+  return isRecord(value) && value.kind === "intervention" && typeof value.id === "string" && isRecord(value.input) && isRecord(value.response) && (value.defaults === undefined || typeof value.defaults === "function");
+}
+function isWorkflowDefinition2(value) {
+  return isRecord(value) && value.kind === "workflow" && typeof value.id === "string" && isRecord(value.input) && Array.isArray(value.triggers) && Array.isArray(value.nodes);
+}
+function validateWorkflowDefinition2(value) {
+  if (!isWorkflowDefinition2(value)) {
+    throw new WorkflowDefinitionError2("Invalid workflow definition.");
+  }
+  assertNonEmpty(value.id, "Workflow", "id");
+  if (value.nodes.length === 0) {
+    throw new WorkflowDefinitionError2(`Workflow "${value.id}" must contain at least one node.`);
+  }
+  const nodeIds = new Set;
+  const nodeKeys = new Set;
+  for (const node of value.nodes) {
+    validateWorkflowNodeDefinition(value.id, node);
+    if (nodeIds.has(node.id)) {
+      throw new WorkflowDefinitionError2(`Duplicate workflow node id "${node.id}" in workflow "${value.id}".`);
+    }
+    nodeIds.add(node.id);
+    if (nodeKeys.has(node.key)) {
+      throw new WorkflowDefinitionError2(`Duplicate workflow node key "${node.key}" in workflow "${value.id}".`);
+    }
+    nodeKeys.add(node.key);
+  }
+}
+function validateWorkflowsAtStartup2(options) {
+  for (const workflow of options.workflows) {
+    validateWorkflowDefinition2(workflow);
+    for (const trigger of workflow.triggers) {
+      validateWorkflowTriggerAtStartup(workflow.id, trigger, options.registeredSchedules, Object.keys(workflow.input));
+    }
+    for (const node of workflow.nodes) {
+      if (node.type === "action" && !options.registeredActionIds.has(node.action.id)) {
+        throw new WorkflowDefinitionError2(`Workflow "${workflow.id}" references unknown action "${node.action.id}". Add it to 'actions' in createSixb() or export it from 'actions/'.`);
+      }
+      if (node.type === "agent") {
+        validateWorkflowAgentStepRuntimeReferences(workflow.id, node.agentStep, options);
+      }
+    }
+  }
+  return options.workflows;
+}
+function validateWorkflowAgentStepGroupReferences2(workflows, security) {
+  for (const workflow of workflows) {
+    for (const node of workflow.nodes) {
+      if (node.type !== "agent")
+        continue;
+      for (const groupId of node.agentStep.groupIds) {
+        if (!security.getGroupById(groupId)) {
+          throw new WorkflowDefinitionError2(`Workflow "${workflow.id}" agent step "${node.id}" references unknown group "${groupId}". Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+        }
+      }
+    }
+  }
+}
+function validateWorkflowAgentStepRuntimeReferences(workflowId, step, options) {
+  if (step.model === undefined && options.models === undefined) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent step "${step.id}" needs a model. Configure 'models.language' or pass 'model' to defineAgentStep().`);
+  }
+  if (step.model !== undefined && options.models !== undefined) {
+    const ref = { provider: step.model.providerId, modelId: step.model.modelId };
+    if (options.models.language.getByRef(ref) === null) {
+      throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent step "${step.id}" uses unknown language model "${ref.provider}/${ref.modelId}". Add it to 'models.language' in createSixb().`);
+    }
+  }
+  for (const toolName of step.toolNames) {
+    if (options.tools.getByName(toolName) === null) {
+      throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent step "${step.id}" uses unknown project tool "${toolName}". Add it to 'tools' in createSixb().`);
+    }
+  }
+}
+function validateWorkflowInput2(params) {
+  return validateWorkflowContractRecord({
+    shape: params.workflow.input,
+    value: params.value,
+    path: `Workflow "${params.workflow.id}" input`,
+    valueTypesById: params.valueTypesById
+  });
+}
+function validateWorkflowStepInput2(params) {
+  return validateWorkflowContractRecord({
+    shape: params.step.input,
+    value: params.value,
+    path: `Workflow "${params.workflowId}" step "${params.step.id}" input`,
+    valueTypesById: params.valueTypesById
+  });
+}
+function validateWorkflowStepOutput2(params) {
+  return validateWorkflowContractRecord({
+    shape: params.step.output,
+    value: params.value,
+    path: `Workflow "${params.workflowId}" step "${params.step.id}" output`,
+    valueTypesById: params.valueTypesById
+  });
+}
+function validateWorkflowInterventionInput2(params) {
+  return validateWorkflowContractRecord({
+    shape: params.intervention.input,
+    value: params.value,
+    path: `Workflow "${params.workflowId}" intervention "${params.intervention.id}" input`,
+    valueTypesById: params.valueTypesById
+  });
+}
+function validateWorkflowInterventionResponse2(params) {
+  return validateWorkflowInterventionResponseRecord({
+    response: params.intervention.response,
+    value: params.value,
+    path: `Workflow "${params.workflowId}" intervention "${params.intervention.id}" response`,
+    partial: false,
+    valueTypesById: params.valueTypesById
+  });
+}
+function validateWorkflowInterventionDefaultResponse2(params) {
+  return validateWorkflowInterventionResponseRecord({
+    response: params.intervention.response,
+    value: params.value,
+    path: `Workflow "${params.workflowId}" intervention "${params.intervention.id}" defaultResponse`,
+    partial: true,
+    valueTypesById: params.valueTypesById
+  });
+}
+function validateWorkflowTriggerAtStartup(workflowId, trigger, registeredSchedules, inputFields) {
+  if (!isRecord(trigger) || trigger.type !== "schedule") {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains an unsupported trigger.`);
+  }
+  validateScheduleWorkflowTrigger(workflowId, trigger, registeredSchedules, inputFields);
+}
+function validateScheduleWorkflowTrigger(workflowId, trigger, registeredSchedules, inputFields) {
+  if (typeof trigger.scheduleId !== "string" || !trigger.scheduleId.trim()) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains a schedule trigger with an empty schedule id.`);
+  }
+  const schedule = registeredSchedules.get(trigger.scheduleId);
+  if (!schedule) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" references unknown schedule "${trigger.scheduleId}". Add it to 'schedules' in createSixb() or export it from 'schedules/'.`);
+  }
+  if (trigger.mapper !== undefined && typeof trigger.mapper !== "function") {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" schedule "${trigger.scheduleId}" mapper must be a function.`);
+  }
+  if (trigger.mapper !== undefined && schedule.trigger.type !== "event") {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" cron schedule "${trigger.scheduleId}" does not accept a mapper.`);
+  }
+  if (trigger.mapper === undefined && inputFields.length > 0) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" schedule "${trigger.scheduleId}" requires a mapper because workflow input is not empty: ${inputFields.join(", ")}.`);
+  }
+}
+function validateWorkflowNodeDefinition(workflowId, node) {
+  if (!isRecord(node)) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains an invalid node.`);
+  }
+  if (node.type === "step") {
+    validateStepNodeDefinition(workflowId, node);
+    return;
+  }
+  if (node.type === "agent") {
+    validateAgentNodeDefinition(workflowId, node);
+    return;
+  }
+  if (node.type === "intervention") {
+    validateInterventionNodeDefinition(workflowId, node);
+    return;
+  }
+  if (node.type === "action") {
+    validateActionNodeDefinition(workflowId, node);
+    return;
+  }
+  throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains an unsupported node type.`);
+}
+function validateAgentNodeDefinition(workflowId, node) {
+  if (typeof node.id !== "string" || !node.id.trim()) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains an agent step with an empty id.`);
+  }
+  if (typeof node.key !== "string" || !node.key.trim()) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains agent step "${node.id}" with an empty derived key.`);
+  }
+  if (!isAgentStepDefinition2(node.agentStep)) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains an invalid agent node "${node.id}".`);
+  }
+  if (node.id !== node.agentStep.id) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent node id "${node.id}" does not match agent step definition id "${node.agentStep.id}".`);
+  }
+  if (!node.agentStep.instructions.trim()) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent step "${node.id}" instructions must not be empty.`);
+  }
+  assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "group", node.agentStep.groupIds);
+  assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "tool", node.agentStep.toolNames);
+  if (node.mapper !== undefined && typeof node.mapper !== "function") {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent node "${node.id}" mapper must be a function.`);
+  }
+}
+function assertUniqueNonEmptyAgentStepValues(workflowId, stepId, kind, values) {
+  const seen = new Set;
+  for (const value of values) {
+    if (!value.trim()) {
+      throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent step "${stepId}" has an empty ${kind} id.`);
+    }
+    if (seen.has(value)) {
+      throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent step "${stepId}" has duplicate ${kind} '${value}'.`);
+    }
+    seen.add(value);
+  }
+}
+function isLanguageModel(value) {
+  return (typeof value === "object" || typeof value === "function") && value !== null;
+}
+function isStringArray(value) {
+  if (!Array.isArray(value))
+    return false;
+  for (let index = 0;index < value.length; index += 1) {
+    if (!Object.hasOwn(value, index) || typeof value[index] !== "string")
+      return false;
+  }
+  return true;
+}
+function validateWorkflowAgentStepInput2(params) {
+  return validateWorkflowContractRecord({
+    shape: params.agentStep.input,
+    value: params.value,
+    path: `Workflow "${params.workflowId}" agent step "${params.agentStep.id}" input`,
+    valueTypesById: params.valueTypesById
+  });
+}
+function validateWorkflowAgentStepOutput2(params) {
+  return validateWorkflowContractRecord({
+    shape: params.agentStep.output,
+    value: params.value,
+    path: `Workflow "${params.workflowId}" agent step "${params.agentStep.id}" output`,
+    valueTypesById: params.valueTypesById
+  });
+}
+function validateStepNodeDefinition(workflowId, node) {
+  if (typeof node.id !== "string" || !node.id.trim()) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains a step with an empty id.`);
+  }
+  if (typeof node.key !== "string" || !node.key.trim()) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains step "${node.id}" with an empty derived key.`);
+  }
+  if (!isStepDefinition2(node.step)) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains an invalid step node "${node.id}".`);
+  }
+  if (node.id !== node.step.id) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" step node id "${node.id}" does not match step definition id "${node.step.id}".`);
+  }
+  if (node.mapper !== undefined && typeof node.mapper !== "function") {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" step node "${node.id}" mapper must be a function.`);
+  }
+}
+function validateInterventionNodeDefinition(workflowId, node) {
+  if (typeof node.id !== "string" || !node.id.trim()) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains an intervention with an empty id.`);
+  }
+  if (typeof node.key !== "string" || !node.key.trim()) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains intervention "${node.id}" with an empty derived key.`);
+  }
+  if (!isInterventionDefinition2(node.intervention)) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains an invalid intervention node "${node.id}".`);
+  }
+  if (node.id !== node.intervention.id) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" intervention node id "${node.id}" does not match intervention definition id "${node.intervention.id}".`);
+  }
+  if (node.mapper !== undefined && typeof node.mapper !== "function") {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" intervention node "${node.id}" mapper must be a function.`);
+  }
+}
+function validateActionNodeDefinition(workflowId, node) {
+  if (typeof node.id !== "string" || !node.id.trim()) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains an action with an empty id.`);
+  }
+  if (typeof node.key !== "string" || !node.key.trim()) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains action "${node.id}" with an empty derived key.`);
+  }
+  if (!isActionDefinition2(node.action)) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" contains an invalid action node "${node.id}".`);
+  }
+  if (node.id !== node.action.id) {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" action node id "${node.id}" does not match action definition id "${node.action.id}".`);
+  }
+  if (node.mapper !== undefined && typeof node.mapper !== "function") {
+    throw new WorkflowDefinitionError2(`Workflow "${workflowId}" action node "${node.id}" mapper must be a function.`);
+  }
+}
+function validateWorkflowContractRecord(params) {
+  if (!isRecord(params.value)) {
+    throw new WorkflowValidationError2(`[Sixb] ${params.path} must be an object`);
+  }
+  const fieldIds = new Set(Object.keys(params.shape));
+  for (const fieldId of Object.keys(params.value)) {
+    if (!fieldIds.has(fieldId)) {
+      throw new WorkflowValidationError2(`[Sixb] Unknown field '${params.path}.${fieldId}'`);
+    }
+  }
+  for (const [fieldId, schema] of Object.entries(params.shape)) {
+    const fieldValue = params.value[fieldId];
+    if (fieldValue === undefined) {
+      throw new WorkflowValidationError2(`[Sixb] Missing required field '${params.path}.${fieldId}'`);
+    }
+    try {
+      validateSchemaOrRefValue2(schema, fieldValue, `${params.path}.${fieldId}`, params.valueTypesById);
+    } catch (error) {
+      throw toWorkflowValidationError(error);
+    }
+  }
+  return params.value;
+}
+function validateWorkflowInterventionResponseRecord(params) {
+  if (!isRecord(params.value)) {
+    throw new WorkflowValidationError2(`[Sixb] ${params.path} must be an object`);
+  }
+  const fieldIds = new Set(Object.keys(params.response));
+  for (const fieldId of Object.keys(params.value)) {
+    if (!fieldIds.has(fieldId)) {
+      throw new WorkflowValidationError2(`[Sixb] Unknown field '${params.path}.${fieldId}'`);
+    }
+  }
+  for (const [fieldId, field] of Object.entries(params.response)) {
+    const fieldValue = params.value[fieldId];
+    if (fieldValue === undefined) {
+      if (!params.partial && isInterventionResponseFieldRequired(field)) {
+        throw new WorkflowValidationError2(`[Sixb] Missing required field '${params.path}.${fieldId}'`);
+      }
+      continue;
+    }
+    try {
+      validateSchemaOrRefValue2(interventionResponseFieldSchema(field), fieldValue, `${params.path}.${fieldId}`, params.valueTypesById);
+    } catch (error) {
+      throw toWorkflowValidationError(error);
+    }
+  }
+  return params.value;
+}
+function isInterventionFieldConfig(value) {
+  return isRecord(value) && "schema" in value;
+}
+function interventionResponseFieldSchema(field) {
+  return isInterventionFieldConfig(field) ? field.schema : field;
+}
+function isInterventionResponseFieldRequired(field) {
+  return !isInterventionFieldConfig(field) || field.required !== false;
+}
+function toWorkflowValidationError(error) {
+  if (error instanceof WorkflowValidationError2) {
+    return error;
+  }
+  if (error instanceof Error) {
+    return new WorkflowValidationError2(error.message, { cause: error });
+  }
+  return new WorkflowValidationError2(String(error), { cause: error });
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/workflows/snapshot.ts
+function snapshotWorkflowAgentStepInput2(params) {
+  const value = validateWorkflowAgentStepInput2(params);
+  return snapshotWorkflowContractRecord({
+    shape: params.agentStep.input,
+    value,
+    path: `Workflow "${params.workflowId}" agent step "${params.agentStep.id}" input`,
+    valueTypesById: params.valueTypesById
+  });
+}
+function snapshotWorkflowAgentStepOutput2(params) {
+  const value = validateWorkflowAgentStepOutput2(params);
+  return snapshotWorkflowContractRecord({
+    shape: params.agentStep.output,
+    value,
+    path: `Workflow "${params.workflowId}" agent step "${params.agentStep.id}" output`,
+    valueTypesById: params.valueTypesById
+  });
+}
+function snapshotWorkflowInput2(params) {
+  const value = validateWorkflowInput2(params);
+  return snapshotWorkflowContractRecord({
+    shape: params.workflow.input,
+    value,
+    path: `Workflow "${params.workflow.id}" input`,
+    valueTypesById: params.valueTypesById
+  });
+}
+function snapshotWorkflowStepInput2(params) {
+  const value = validateWorkflowStepInput2(params);
+  return snapshotWorkflowContractRecord({
+    shape: params.step.input,
+    value,
+    path: `Workflow "${params.workflowId}" step "${params.step.id}" input`,
+    valueTypesById: params.valueTypesById
+  });
+}
+function snapshotWorkflowStepOutput2(params) {
+  const value = validateWorkflowStepOutput2(params);
+  return snapshotWorkflowContractRecord({
+    shape: params.step.output,
+    value,
+    path: `Workflow "${params.workflowId}" step "${params.step.id}" output`,
+    valueTypesById: params.valueTypesById
+  });
+}
+function snapshotWorkflowInterventionInput2(params) {
+  const value = validateWorkflowInterventionInput2(params);
+  return snapshotWorkflowContractRecord({
+    shape: params.intervention.input,
+    value,
+    path: `Workflow "${params.workflowId}" intervention "${params.intervention.id}" input`,
+    valueTypesById: params.valueTypesById
+  });
+}
+function snapshotWorkflowInterventionResponse2(params) {
+  const value = validateWorkflowInterventionResponse2(params);
+  return snapshotWorkflowInterventionResponseRecord({
+    response: params.intervention.response,
+    value,
+    path: `Workflow "${params.workflowId}" intervention "${params.intervention.id}" response`,
+    valueTypesById: params.valueTypesById
+  });
+}
+function snapshotWorkflowInterventionDefaultResponse2(params) {
+  const value = validateWorkflowInterventionDefaultResponse2(params);
+  return snapshotWorkflowInterventionResponseRecord({
+    response: params.intervention.response,
+    value,
+    path: `Workflow "${params.workflowId}" intervention "${params.intervention.id}" defaultResponse`,
+    valueTypesById: params.valueTypesById
+  });
+}
+function snapshotWorkflowActionInput2(params) {
+  const snapshot = {
+    params: snapshotJsonValue(params.params, "Workflow action params")
+  };
+  if (params.subject && params.subject.kind !== "none") {
+    snapshot.subject = snapshotJsonValue(params.subject, "Workflow action subject");
+  }
+  return snapshot;
+}
+function snapshotWorkflowContractRecord(params) {
+  const snapshot = {};
+  for (const [fieldId, schema] of Object.entries(params.shape)) {
+    snapshot[fieldId] = snapshotSchemaOrRefValue({
+      schema,
+      value: params.value[fieldId],
+      path: `${params.path}.${fieldId}`,
+      valueTypesById: params.valueTypesById
+    });
+  }
+  return snapshot;
+}
+function snapshotWorkflowInterventionResponseRecord(params) {
+  const snapshot = {};
+  for (const [fieldId, value] of Object.entries(params.value)) {
+    if (value === undefined) {
+      continue;
+    }
+    snapshot[fieldId] = snapshotSchemaOrRefValue({
+      schema: interventionResponseFieldSchema(params.response[fieldId]),
+      value,
+      path: `${params.path}.${fieldId}`,
+      valueTypesById: params.valueTypesById
+    });
+  }
+  return snapshot;
+}
+function snapshotSchemaOrRefValue(params) {
+  if (isObjectRefSchema2(params.schema)) {
+    if (!isRecord3(params.value)) {
+      throw cannotSerialize(params.path);
+    }
+    return {
+      objectTypeId: String(params.value.objectTypeId),
+      primaryId: String(params.value.primaryId)
+    };
+  }
+  return snapshotSchemaValue({
+    schema: params.schema,
+    value: params.value,
+    path: params.path,
+    valueTypesById: params.valueTypesById
+  });
+}
+function snapshotSchemaValue(params) {
+  const { schema, value, path, valueTypesById } = params;
+  if (typeof schema === "string") {
+    if (schema === "date" || schema === "timestamp") {
+      if (value instanceof Date) {
+        return snapshotDate(value, path);
+      }
+      return snapshotJsonValue(value, path);
+    }
+    return snapshotJsonValue(value, path);
+  }
+  if (schema.type === "enum") {
+    return snapshotJsonValue(value, path);
+  }
+  if (schema.type === "array") {
+    if (!Array.isArray(value)) {
+      throw cannotSerialize(path);
+    }
+    return value.map((item, index) => snapshotSchemaValue({
+      schema: schema.items,
+      value: item,
+      path: `${path}[${index}]`,
+      valueTypesById
+    }));
+  }
+  if (schema.type === "map") {
+    if (!isRecord3(value)) {
+      throw cannotSerialize(path);
+    }
+    const snapshot = {};
+    for (const [key, entry] of Object.entries(value)) {
+      snapshot[key] = snapshotSchemaValue({
+        schema: schema.valueSchema,
+        value: entry,
+        path: `${path}.${key}`,
+        valueTypesById
+      });
+    }
+    return snapshot;
+  }
+  if (schema.type === "object") {
+    if (!isRecord3(value)) {
+      throw cannotSerialize(path);
+    }
+    const snapshot = {};
+    for (const [fieldId, field] of Object.entries(schema.properties)) {
+      const fieldValue = value[fieldId];
+      if (fieldValue === undefined) {
+        continue;
+      }
+      if (fieldValue === null) {
+        snapshot[fieldId] = null;
+        continue;
+      }
+      snapshot[fieldId] = snapshotSchemaValue({
+        schema: field.schema,
+        value: fieldValue,
+        path: `${path}.${fieldId}`,
+        valueTypesById
+      });
+    }
+    return snapshot;
+  }
+  if (schema.type === "valueTypeRef") {
+    const valueType = valueTypesById.get(schema.valueTypeId);
+    if (!valueType) {
+      throw new WorkflowValidationError2(`[Sixb] Unknown valueTypeRef '${schema.valueTypeId}' at ${path}`);
+    }
+    return snapshotSchemaValue({
+      schema: valueType.schema,
+      value,
+      path,
+      valueTypesById
+    });
+  }
+  return snapshotJsonValue(value, path);
+}
+function snapshotJsonValue(value, path) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return value;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw cannotSerialize(path);
+    }
+    return value;
+  }
+  if (value instanceof Date) {
+    return snapshotDate(value, path);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item, index) => snapshotJsonValue(item, `${path}[${index}]`));
+  }
+  if (isPlainRecord(value)) {
+    const snapshot = {};
+    for (const [key, entry] of Object.entries(value)) {
+      snapshot[key] = snapshotJsonValue(entry, `${path}.${key}`);
+    }
+    return snapshot;
+  }
+  throw cannotSerialize(path);
+}
+function snapshotDate(value, path) {
+  if (Number.isNaN(value.getTime())) {
+    throw cannotSerialize(path);
+  }
+  return value.toISOString();
+}
+function cannotSerialize(path) {
+  return new WorkflowValidationError2(`[Sixb] ${path} cannot be serialized as workflow IO`);
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/workflows/run-dispatch.ts
+class WorkflowRunDispatcher2 {
+  dependencies;
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+  }
+  async dispatch(input) {
+    assertAutomaticDispatchInput(input);
+    const workflow = this.dependencies.definitions.workflows.getById(input.workflowId);
+    if (!workflow) {
+      throw new WorkflowValidationError2(`[Sixb] Unknown workflow '${input.workflowId}'`);
+    }
+    const result = await dispatchWorkflowRun({
+      errorReporterHost: this.dependencies,
+      projectId: this.dependencies.id,
+      workflow,
+      valueTypesById: this.dependencies.definitions.ontology.getValueTypesById(),
+      storage: this.dependencies.storage,
+      queue: this.dependencies.queues.workflows,
+      events: this.dependencies.events,
+      runId: input.runId,
+      input: input.input,
+      source: {
+        type: "schedule",
+        scheduleId: input.scheduleId,
+        eventId: input.source.eventId,
+        principal: SYSTEM_PRINCIPAL2
+      },
+      metadata: input.metadata,
+      queueJobId: input.runId,
+      createExecution: async (executionId, runId) => createPrimitiveExecutionRecord({
+        id: executionId,
+        primitive: { kind: "workflow", id: workflow.id, runId },
+        origin: {
+          type: "automatic",
+          projectId: this.dependencies.id,
+          source: input.source,
+          correlationId: input.correlationId
+        }
+      })
+    });
+    if (!result.created) {
+      await assertAutomaticExecutionIdentity(this.dependencies, input, result.runId);
+    }
+    return result;
+  }
+}
+async function dispatchWorkflowRun(input) {
+  const request = prepareWorkflowRun(input);
+  const persisted = await persistWorkflowRun(input, request);
+  if (!persisted.created)
+    return existingWorkflowRunResult(persisted.run);
+  return publishWorkflowRun(input, persisted);
+}
+function prepareWorkflowRun(input) {
+  const value = input.input ?? {};
+  return {
+    runId: resolveWorkflowRunId(input.runId),
+    snapshot: snapshotWorkflowInput2({
+      workflow: input.workflow,
+      value,
+      valueTypesById: input.valueTypesById
+    })
+  };
+}
+async function persistWorkflowRun(input, request) {
+  const workflowRuns = input.storage.workflowRuns;
+  if (!workflowRuns) {
+    throw new WorkflowValidationError2("[Sixb] Workflow run storage is not configured.");
+  }
+  const existing = await workflowRuns.getById({
+    projectId: input.projectId,
+    id: request.runId
+  });
+  if (existing) {
+    assertExistingWorkflowRun(existing, input.workflow.id, request.snapshot);
+    return { run: existing, created: false };
+  }
+  const execution = await input.createExecution(`exec_${randomUUID6()}`, request.runId);
+  const queuedAt = new Date;
+  try {
+    return await input.storage.transaction(async (tx) => {
+      const raced = await tx.workflowRuns?.getById({
+        projectId: input.projectId,
+        id: request.runId
+      });
+      if (raced) {
+        assertExistingWorkflowRun(raced, input.workflow.id, request.snapshot);
+        return { run: raced, created: false };
+      }
+      if (!tx.workflowRuns) {
+        throw new WorkflowValidationError2("[Sixb] Workflow run storage is not configured.");
+      }
+      await tx.executions.create(execution);
+      const run = await tx.workflowRuns.queue({
+        projectId: input.projectId,
+        id: request.runId,
+        executionId: execution.id,
+        workflowId: input.workflow.id,
+        input: request.snapshot,
+        queuedAt
+      });
+      return { run, execution, queuedAt, created: true };
+    }, { isolation: "serializable" });
+  } catch (error) {
+    if (!(error instanceof WorkflowRunError2))
+      throw error;
+    const raced = await workflowRuns.getById({
+      projectId: input.projectId,
+      id: request.runId
+    });
+    if (!raced)
+      throw error;
+    assertExistingWorkflowRun(raced, input.workflow.id, request.snapshot);
+    return { run: raced, created: false };
+  }
+}
+async function publishWorkflowRun(input, persisted) {
+  let job;
+  try {
+    const jobs = await input.queue.enqueue({
+      projectId: input.projectId,
+      jobs: [
+        {
+          ...input.queueJobId === undefined ? {} : { id: input.queueJobId },
+          type: "workflow.run.requested",
+          payload: { runId: persisted.run.id },
+          ...input.metadata === undefined ? {} : { metadata: input.metadata }
+        }
+      ]
+    });
+    job = jobs[0];
+  } catch (error) {
+    await failWorkflowRunPublication(input, persisted.run, error);
+    throw error;
+  }
+  await input.events.emit({
+    events: [
+      {
+        type: "workflow.run.queued",
+        payload: {
+          workflowId: persisted.run.workflowId,
+          runId: persisted.run.id,
+          queuedAt: persisted.queuedAt.toISOString(),
+          ...job?.id ? { jobId: job.id } : {},
+          ...input.source === undefined ? {} : { source: input.source }
+        }
+      }
+    ],
+    correlationId: persisted.execution.correlationId
+  }, { source: "Sixb" });
+  return {
+    workflowId: persisted.run.workflowId,
+    runId: persisted.run.id,
+    queuedAt: persisted.queuedAt.toISOString(),
+    jobId: job?.id,
+    created: true
+  };
+}
+async function failWorkflowRunPublication(input, run, error) {
+  const workflowRuns = input.storage.workflowRuns;
+  if (!workflowRuns) {
+    throw new WorkflowValidationError2("[Sixb] Workflow run storage is not configured.");
+  }
+  const failure = captureSixbFailure2(error, {
+    allowedCodes: WORKFLOW_RUN_FAILURE_CODES2,
+    defaultCode: "internal.unexpected",
+    details: { workflowId: run.workflowId, runId: run.id }
+  });
+  await workflowRuns.finish({
+    projectId: input.projectId,
+    id: run.id,
+    status: "failed",
+    error: failure
+  });
+  reportRunFailure2(input.errorReporterHost, error, {
+    projectId: input.projectId,
+    runKind: "workflow",
+    run: { runId: run.id, workflowId: run.workflowId },
+    failure
+  });
+}
+function resolveWorkflowRunId(runId) {
+  if (runId === undefined)
+    return `run_${randomUUID6()}`;
+  if (!runId.trim()) {
+    throw new WorkflowValidationError2("[Sixb] Workflow run id must not be empty");
+  }
+  return runId;
+}
+function assertExistingWorkflowRun(existing, workflowId, input) {
+  if (existing.workflowId !== workflowId || !isDeepStrictEqual(existing.input, input)) {
+    throw new WorkflowValidationError2(`[Sixb] Workflow run '${existing.id}' already exists with a different request payload.`);
+  }
+}
+function existingWorkflowRunResult(existing) {
+  return {
+    workflowId: existing.workflowId,
+    runId: existing.id,
+    queuedAt: (existing.queuedAt ?? existing.startedAt).toISOString(),
+    created: false
+  };
+}
+function assertAutomaticDispatchInput(input) {
+  assertNonBlank(input.workflowId, "Workflow id");
+  assertNonBlank(input.runId, "Workflow run id");
+  assertNonBlank(input.scheduleId, "Workflow schedule id");
+  assertNonBlank(input.source.eventId, "Workflow source event id");
+  assertNonBlank(input.correlationId, "Workflow correlation id");
+}
+async function assertAutomaticExecutionIdentity(dependencies, input, runId) {
+  const run = await dependencies.storage.workflowRuns?.getById({
+    projectId: dependencies.id,
+    id: runId
+  });
+  const execution = run ? await dependencies.storage.executions.getById({
+    projectId: dependencies.id,
+    id: run.executionId
+  }) : null;
+  if (!execution || execution.source.type !== input.source.type || execution.source.eventId !== input.source.eventId || execution.correlationId !== input.correlationId || execution.requestedBy !== undefined) {
+    throw new WorkflowValidationError2(`[Sixb] Workflow run '${runId}' already exists with different automatic provenance.`);
+  }
+}
+function assertNonBlank(value, label) {
+  if (!value.trim())
+    throw new WorkflowValidationError2(`[Sixb] ${label} must not be empty.`);
+}
+
+// src/workflows/request.ts
+async function requestWorkflowRun2(runtime, execution, workflow, options = {}) {
+  resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization
+  });
+  assertAuthorized2(runtime, { kind: "workflow.run", workflowId: workflow.id });
+  return dispatchWorkflowRun({
+    errorReporterHost: runtime,
+    projectId: runtime.projectId,
+    workflow,
+    valueTypesById: runtime.ontology.getValueTypesById(),
+    storage: runtime.storage,
+    queue: runtime.queues.workflows,
+    events: runtime.events,
+    runId: options.runId,
+    input: options.input,
+    source: options.source,
+    createExecution: async (executionId, runId) => {
+      const caller = await ensureExecutionRecord2(runtime.storage.executions, executionRecordInputFromRuntime({
+        execution,
+        runtimeAuthorization: runtime.runtimeAuthorization
+      }));
+      return createPrimitiveExecutionRecord({
+        id: executionId,
+        primitive: { kind: "workflow", id: workflow.id, runId },
+        origin: { type: "execution", parent: caller }
+      });
+    }
+  });
+}
+
+// src/workflows/execution.ts
+function createWorkflowsRuntime(runtime, execution, source) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const allowed = (workflowId) => isRuntimeAllowed2(runtime, { kind: "workflow.run", workflowId });
+  const canAccessHistory = (workflowId) => {
+    switch (authority.type) {
+      case "denied":
+      case "delegated":
+        return false;
+      case "unrestricted":
+        return true;
+      case "principal":
+        return allowed(workflowId) && source.getById(workflowId) !== null;
+    }
+  };
+  const visibleIds = () => source.list().filter((workflow) => allowed(workflow.id)).map((workflow) => workflow.id);
+  const historyFilterIds = () => authority.type === "unrestricted" ? undefined : authority.type === "principal" ? visibleIds() : [];
+  const getVisibleRunRecord = async (runId) => {
+    if (authority.type === "denied" || authority.type === "delegated")
+      return null;
+    const run = await runtime.storage.workflowRuns?.getById({
+      projectId: runtime.projectId,
+      id: runId
+    }) ?? null;
+    if (!run || !canAccessHistory(run.workflowId))
+      return null;
+    return authority.type === "unrestricted" || canViewWorkflowRun2(authority.context, run) ? run : null;
+  };
+  const getRun = async (runId) => {
+    const run = await getVisibleRunRecord(runId);
+    return run ? attachRequestedBy(runtime, run) : null;
+  };
+  const listNodes = async (runId, input = {}) => {
+    const storage = runtime.storage.workflowRuns;
+    if (!storage || !await getVisibleRunRecord(runId))
+      return null;
+    const result = await storage.nodes.list({
+      ...input,
+      workflowRunId: runId,
+      projectId: runtime.projectId
+    });
+    return {
+      ...result,
+      nodes: await attachWorkflowNodeViews(runtime, storage, result.nodes)
+    };
+  };
+  return {
+    list: () => authority.type === "denied" || authority.type === "delegated" ? [] : source.list().filter((workflow) => allowed(workflow.id)),
+    getById: (workflowId) => {
+      if (authority.type === "denied" || authority.type === "delegated")
+        return null;
+      const workflow = source.getById(workflowId);
+      return workflow && allowed(workflowId) ? workflow : null;
+    },
+    request: (workflow, options) => requestWorkflowRun2(runtime, execution, workflow, options),
+    requestById: async (input) => {
+      assertAuthorized2(runtime, { kind: "workflow.run", workflowId: input.workflowId });
+      const workflow = source.getById(input.workflowId);
+      if (!workflow) {
+        throw new WorkflowValidationError2(`[Sixb] Unknown workflow '${input.workflowId}'`);
+      }
+      return requestWorkflowRun2(runtime, execution, workflow, input);
+    },
+    runs: {
+      getById: getRun,
+      list: async (input = {}) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return { runs: [], hasMore: false, total: 0 };
+        }
+        const storage = runtime.storage.workflowRuns;
+        if (!storage)
+          return { runs: [], hasMore: false, total: 0 };
+        const result = await storage.list({
+          ...input,
+          workflowIds: historyFilterIds(),
+          projectId: runtime.projectId
+        });
+        return {
+          ...result,
+          runs: await Promise.all(result.runs.map((run) => attachRequestedBy(runtime, run)))
+        };
+      },
+      listLatest: async (workflowIds) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return { runs: [] };
+        }
+        const storage = runtime.storage.workflowRuns;
+        if (!storage || workflowIds.length === 0)
+          return { runs: [] };
+        const allowedIds = workflowIds.filter(canAccessHistory);
+        if (allowedIds.length === 0)
+          return { runs: [] };
+        const result = await storage.listLatestByWorkflowIds({
+          projectId: runtime.projectId,
+          workflowIds: allowedIds
+        });
+        return {
+          runs: await Promise.all(result.runs.map((run) => attachRequestedBy(runtime, run)))
+        };
+      },
+      listNodes
+    },
+    interventions: {
+      getById: async (interventionId) => {
+        if (authority.type === "denied" || authority.type === "delegated")
+          return null;
+        const intervention = await runtime.storage.workflowInterventions?.getById({
+          projectId: runtime.projectId,
+          id: interventionId
+        }) ?? null;
+        if (!intervention || !canAccessHistory(intervention.workflowId))
+          return null;
+        return authority.type === "unrestricted" || canViewWorkflowIntervention2(authority.context, intervention) ? intervention : null;
+      },
+      list: (input = {}) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ interventions: [], hasMore: false, total: 0 });
+        }
+        const storage = runtime.storage.workflowInterventions;
+        if (!storage)
+          return Promise.resolve({ interventions: [], hasMore: false, total: 0 });
+        return storage.list({
+          ...input,
+          workflowIds: historyFilterIds(),
+          projectId: runtime.projectId
+        });
+      }
+    }
+  };
+}
+async function attachWorkflowNodeViews(runtime, storage, nodes) {
+  const executions = await Promise.all(nodes.map((node) => node.nodeType === "agent" ? storage.agentNodes.getByNodeRunId({
+    projectId: runtime.projectId,
+    nodeRunId: node.id
+  }) : null));
+  const agentExecutions = executions.filter((execution) => execution !== null);
+  if (agentExecutions.length === 0)
+    return nodes;
+  const executionIds = agentExecutions.map((execution) => execution.executionId);
+  const [usages, costs] = await Promise.all([
+    resolveExecutionUsage({
+      storage: runtime.storage.aiUsage,
+      projectId: runtime.projectId,
+      executionIds
+    }),
+    resolveExecutionCosts({
+      storage: runtime.storage.aiCosts,
+      projectId: runtime.projectId,
+      executionIds
+    })
+  ]);
+  const accountingByExecutionId = new Map(agentExecutions.map((execution, index) => [
+    execution.executionId,
+    { usage: usages[index], cost: costs[index] }
+  ]));
+  return nodes.map((node, index) => {
+    const execution = executions[index];
+    if (!execution)
+      return node;
+    const accounting = accountingByExecutionId.get(execution.executionId);
+    return {
+      ...node,
+      agentExecution: toWorkflowAgentNodeRunView(execution, accounting?.usage, accounting?.usage === undefined ? undefined : accounting.cost)
+    };
+  });
+}
+function toWorkflowAgentNodeRunView(execution, usage, cost) {
+  return {
+    projectId: execution.projectId,
+    nodeRunId: execution.nodeRunId,
+    executionId: execution.executionId,
+    status: execution.status,
+    prompt: execution.prompt,
+    modelId: execution.modelId,
+    finishReason: execution.finishReason,
+    trace: execution.trace,
+    diagnostics: execution.diagnostics,
+    error: execution.error,
+    attempt: execution.attempt,
+    createdAt: execution.createdAt,
+    startedAt: execution.startedAt,
+    completedAt: execution.completedAt,
+    ...usage === undefined ? {} : { usage },
+    ...usage === undefined || cost === undefined ? {} : { cost }
+  };
+}
+async function attachRequestedBy(runtime, run) {
+  const execution = await runtime.storage.executions.getById({
+    projectId: runtime.projectId,
+    id: run.executionId
+  });
+  if (!execution) {
+    throw new Error(`[Sixb] Workflow run '${run.id}' references missing execution '${run.executionId}'.`);
+  }
+  return {
+    ...run,
+    ...execution.requestedBy === undefined ? {} : { requestedBy: structuredClone(execution.requestedBy) }
+  };
+}
+
+// src/runtime/sixb.ts
+var boundSixbInstances = new WeakSet;
+function createBoundSixb(runtime, dependencies, execution) {
+  resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization
+  });
+  assertAuthorizedObjectReaderBinding({
+    reader: runtime.objectReader,
+    scope: { execution, authorization: runtime.runtimeAuthorization }
+  });
+  const sixb = {
+    execution,
+    ...createExecutionFacades(runtime, execution, dependencies)
+  };
+  shareOntologyMutationRuntime2(runtime, sixb);
+  if (dependencies.connectorConnections) {
+    registerConnectorConnectionsRuntime(sixb, createConnectorConnectionsRuntime(runtime, execution, dependencies.connectorConnections));
+  }
+  boundSixbInstances.add(sixb);
+  return sixb;
+}
+function isBoundSixb(value) {
+  return typeof value === "object" && value !== null && boundSixbInstances.has(value);
+}
+function createExecutionFacades(runtime, execution, dependencies) {
+  return {
+    objects: createObjectsRuntime(runtime, execution),
+    actions: createActionsRuntime(runtime, execution),
+    datasets: createDatasetsRuntime(runtime, execution, dependencies.definitions.datasets, dependencies.lakeStorage, dependencies.blobStorage),
+    workflows: createWorkflowsRuntime(runtime, execution, dependencies.definitions.workflows),
+    syncs: createSyncsRuntime(runtime, execution, dependencies.definitions.syncs),
+    pipelines: createPipelinesRuntime(runtime, execution, dependencies.definitions.pipelines),
+    projections: createProjectionsRuntime(runtime, dependencies.definitions.projections),
+    rules: createRulesRuntime(runtime, dependencies.definitions.rules),
+    agent: createAgentRuntime(runtime, execution, dependencies.definitions.models),
+    models: createModelsRuntime(runtime, execution, dependencies.definitions.models),
+    aiUsage: createAiUsageRuntime(runtime, dependencies.definitions.security),
+    events: createEventsRuntime(runtime),
+    logs: createLogsRuntime(runtime, dependencies.logging),
+    schedules: createSchedulesRuntime(runtime, dependencies.definitions.schedules),
+    shares: createSharesRuntime(runtime, execution, dependencies.definitions.shares),
+    connector: createConnectorRuntime(runtime, execution, dependencies.connectorService),
+    blobs: createBlobsRuntime(runtime, execution, dependencies.blobStorage)
+  };
+}
+// src/execution/agent.ts
+function canInheritAgentRequestAuthorization2(authorization) {
+  const ref = getAuthorizationRef(authorization);
+  return ref.type === "disabled" || ref.type === "principal" && ref.principal.type === "user" && ref.credential !== undefined;
+}
+function createAgentExecutionRecord2(input) {
+  assertAgentPrincipal(input.actorId, input.principal);
+  return {
+    id: input.id,
+    projectId: input.parent.projectId,
+    requesterGroupIds: [...input.parent.requesterGroupIds],
+    ...input.parent.requestedBy === undefined ? {} : { requestedBy: structuredClone(input.parent.requestedBy) },
+    executor: { type: "agent", runId: input.runId },
+    source: { type: "execution", executionId: input.parent.id },
+    correlationId: input.parent.correlationId,
+    authorizationRef: {
+      type: "principal",
+      principal: structuredClone(input.principal)
+    }
+  };
+}
+function createInheritedAgentExecutionRecord2(input) {
+  const authority = input.parent.authorizationRef;
+  if (authority.type !== "disabled" && !(authority.type === "principal" && authority.principal.type === "user" && authority.credential !== undefined)) {
+    throw new ExecutionStorageError2("invalid_input", `[Sixb] Agent run '${input.runId}' requires inheritable user or auth-disabled authority.`);
+  }
+  return {
+    id: input.id,
+    projectId: input.parent.projectId,
+    requesterGroupIds: [...input.parent.requesterGroupIds],
+    ...input.parent.requestedBy === undefined ? {} : { requestedBy: structuredClone(input.parent.requestedBy) },
+    executor: { type: "agent", runId: input.runId },
+    source: { type: "execution", executionId: input.parent.id },
+    correlationId: input.parent.correlationId,
+    authorizationRef: structuredClone(authority)
+  };
+}
+function bindDurableAgentExecution2(host, input) {
+  const scope = restoreAgentExecutionScope2(input);
+  const sixb = host.withScope(scope);
+  if (!isBoundSixb(sixb)) {
+    throw new Error("[Sixb] Agent execution host returned an invalid bound SDK.");
+  }
+  return sixb;
+}
+function restoreAgentExecutionScope2(input) {
+  assertAgentExecutionRecord2(input);
+  const context = Object.freeze({
+    id: input.execution.id,
+    projectId: input.execution.projectId,
+    ...input.execution.requestedBy === undefined ? {} : { requestedBy: Object.freeze(structuredClone(input.execution.requestedBy)) },
+    executor: Object.freeze({
+      type: "agent",
+      ...input.actorId === undefined ? {} : { actorId: input.actorId },
+      runId: input.runId
+    }),
+    source: Object.freeze(structuredClone(input.execution.source)),
+    correlationId: input.execution.correlationId
+  });
+  return Object.freeze({
+    execution: context,
+    authorization: createAgentRuntimeAuthorization({
+      execution: context,
+      authority: input.authorization.type === "principal" ? {
+        type: "principal",
+        context: input.authorization.context,
+        ...input.execution.authorizationRef.type === "principal" && input.execution.authorizationRef.credential !== undefined ? { credential: input.execution.authorizationRef.credential } : {}
+      } : { type: "disabled" }
+    })
+  });
+}
+function assertAgentExecutionRecord2(input) {
+  const authority = input.execution.authorizationRef;
+  if (input.execution.executor.type !== "agent" || input.execution.executor.runId !== input.runId || input.execution.source.type !== "execution") {
+    invalidAgentExecution(input.execution.id, input.runId);
+  }
+  if (input.authorization.type === "disabled" || input.authorization.context.principal.type === "user") {
+    assertInheritedAgentAuthority(input.execution, input.runId, input.authorization);
+    return;
+  }
+  if (input.authorization.type !== "principal" || authority.type !== "principal" || authority.principal.type !== "serviceAccount" || input.authorization.context.principal.type !== "serviceAccount" || authority.principal.id !== input.authorization.context.principal.id || authority.credential !== undefined) {
+    invalidAgentExecution(input.execution.id, input.runId);
+  }
+  if (input.actorId === undefined) {
+    invalidAgentExecution(input.execution.id, input.runId);
+  }
+  assertAgentPrincipal(input.actorId, authority.principal);
+}
+function assertInheritedAgentAuthority(execution, runId, authorization) {
+  const authority = execution.authorizationRef;
+  if (authorization.type === "disabled") {
+    if (authority.type !== "disabled")
+      invalidAgentExecution(execution.id, runId);
+    return;
+  }
+  const principal = authorization.context.principal;
+  if (authority.type !== "principal" || authority.principal.type !== "user" || principal.type !== "user" || authority.principal.id !== principal.id || authority.credential === undefined || (authority.credential.type === "session" ? authorization.context.sessionId !== authority.credential.id : authorization.context.sessionId !== undefined)) {
+    invalidAgentExecution(execution.id, runId);
+  }
+}
+function assertAgentPrincipal(actorId, principal) {
+  const expectedId = agentServiceAccountId2(actorId);
+  if (principal.id !== expectedId) {
+    throw new ExecutionStorageError2("invalid_input", `[Sixb] Agent '${actorId}' execution authority must reference service account '${expectedId}'.`);
+  }
+}
+function invalidAgentExecution(executionId, runId) {
+  throw new ExecutionStorageError2("invalid_input", `[Sixb] Execution '${executionId}' does not authorize Agent run '${runId}'.`);
+}
+
+export { resolveAgentContextParts2, agentRunQueueJobId2, subagentRunQueueJobId2, workflowAgentNodeQueueJobId2, dispatchQueuedAgentRuns2, dispatchQueuedSubagentRuns2, createAgentThreadId2, createAgentRunId2, createSubagentRunId2, createSubagentExecutionId2, createAgentMessageId2, agentContextCheckpointId2, createAgentRunExecutionToken2, runModelLoop2, assertNoAgentDefinitions, bindModelExecutionAttempt, ShareError2, WorkflowDefinitionError2, WorkflowValidationError2, assertNonEmpty, isStepDefinition2, isAgentStepDefinition2, isInterventionDefinition2, isWorkflowDefinition2, validateWorkflowDefinition2, validateWorkflowsAtStartup2, validateWorkflowAgentStepGroupReferences2, validateWorkflowInput2, validateWorkflowStepInput2, validateWorkflowStepOutput2, validateWorkflowInterventionInput2, validateWorkflowInterventionResponse2, validateWorkflowInterventionDefaultResponse2, validateWorkflowAgentStepInput2, validateWorkflowAgentStepOutput2, snapshotWorkflowAgentStepInput2, snapshotWorkflowAgentStepOutput2, snapshotWorkflowInput2, snapshotWorkflowStepInput2, snapshotWorkflowStepOutput2, snapshotWorkflowInterventionInput2, snapshotWorkflowInterventionResponse2, snapshotWorkflowInterventionDefaultResponse2, snapshotWorkflowActionInput2, WorkflowRunDispatcher2, requestWorkflowRun2, createBoundSixb, isBoundSixb, canInheritAgentRequestAuthorization2, createAgentExecutionRecord2, createInheritedAgentExecutionRecord2, bindDurableAgentExecution2, restoreAgentExecutionScope2, assertAgentExecutionRecord2, requestAgentRun2, retryAgentRun2 };
+
+//# debugId=8A992C0F00F3BAC264756E2164756E21