@sixb/core 0.1.7 → 0.1.9

package/dist/security/every.d.ts

@@ -15,11 +15,12 @@ import type { ConnectorDefinition } from "../connectors";
 import type { DatasetDefinition } from "../datasets";
 import type { ObjectType } from "../ontology";
 import type { PipelineDefinition } from "../pipelines";
+import type { ShareDefinition } from "../shares";
 import type { SyncDefinition } from "../syncs";
 import type { WorkflowDefinition } from "../workflows/types";
 import type { ApplicationDefinition } from "./types";
 /** Capability targets a breadth selector can range over. */
-export declare const BREADTH_TARGETS: readonly ["object", "dataset", "action", "workflow", "sync", "pipeline", "application", "connector"];
+export declare const BREADTH_TARGETS: readonly ["object", "dataset", "action", "workflow", "sync", "pipeline", "application", "connector", "share"];
 export type BreadthTarget = (typeof BREADTH_TARGETS)[number];
 interface BreadthTargetInput {
     object: ObjectType;
@@ -30,6 +31,7 @@ interface BreadthTargetInput {
     pipeline: PipelineDefinition;
     application: ApplicationDefinition;
     connector: ConnectorDefinition;
+    share: ShareDefinition;
 }
 /**
  * An "all except" selection over a capability target. Branded by `target` so
@@ -63,6 +65,7 @@ export declare const every: {
     pipeline: () => BreadthSelector<"pipeline">;
     application: () => BreadthSelector<"application">;
     connector: () => BreadthSelector<"connector">;
+    share: () => BreadthSelector<"share">;
 };
 export {};
 //# sourceMappingURL=every.d.ts.map

package/dist/security/every.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"every.d.ts","sourceRoot":"","sources":["../../src/security/every.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AAEpD,4DAA4D;AAC5D,eAAO,MAAM,eAAe,sGASlB,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAA;AAE5D,UAAU,kBAAkB;IAC1B,MAAM,EAAE,UAAU,CAAA;IAClB,OAAO,EAAE,iBAAiB,CAAA;IAC1B,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,IAAI,EAAE,cAAc,CAAA;IACpB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,EAAE,qBAAqB,CAAA;IAClC,SAAS,EAAE,mBAAmB,CAAA;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe,CAAC,OAAO,SAAS,aAAa,GAAG,aAAa;IAC5E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IAC9E,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,SAAS,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;CAChF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAQ1E;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKrF;AAkBD;;;;;GAKG;AACH,eAAO,MAAM,KAAK;kBACJ,eAAe,CAAC,QAAQ,CAAC;mBACxB,eAAe,CAAC,SAAS,CAAC;kBAC3B,eAAe,CAAC,QAAQ,CAAC;oBACvB,eAAe,CAAC,UAAU,CAAC;gBAC/B,eAAe,CAAC,MAAM,CAAC;oBACnB,eAAe,CAAC,UAAU,CAAC;uBACxB,eAAe,CAAC,aAAa,CAAC;qBAChC,eAAe,CAAC,WAAW,CAAC;CAC5C,CAAA"}
+{"version":3,"file":"every.d.ts","sourceRoot":"","sources":["../../src/security/every.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AAEpD,4DAA4D;AAC5D,eAAO,MAAM,eAAe,+GAUlB,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAA;AAE5D,UAAU,kBAAkB;IAC1B,MAAM,EAAE,UAAU,CAAA;IAClB,OAAO,EAAE,iBAAiB,CAAA;IAC1B,MAAM,EAAE,gBAAgB,CAAA;IACxB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,IAAI,EAAE,cAAc,CAAA;IACpB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,WAAW,EAAE,qBAAqB,CAAA;IAClC,SAAS,EAAE,mBAAmB,CAAA;IAC9B,KAAK,EAAE,eAAe,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe,CAAC,OAAO,SAAS,aAAa,GAAG,aAAa;IAC5E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;IAC9E,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,SAAS,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;CAChF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAQ1E;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKrF;AAkBD;;;;;GAKG;AACH,eAAO,MAAM,KAAK;kBACJ,eAAe,CAAC,QAAQ,CAAC;mBACxB,eAAe,CAAC,SAAS,CAAC;kBAC3B,eAAe,CAAC,QAAQ,CAAC;oBACvB,eAAe,CAAC,UAAU,CAAC;gBAC/B,eAAe,CAAC,MAAM,CAAC;oBACnB,eAAe,CAAC,UAAU,CAAC;uBACxB,eAAe,CAAC,aAAa,CAAC;qBAChC,eAAe,CAAC,WAAW,CAAC;iBAChC,eAAe,CAAC,OAAO,CAAC;CACpC,CAAA"}

package/dist/security/grants.d.ts

@@ -6,23 +6,27 @@
  * each grant's selection into per-principal id sets at startup, so runtime
  * checks stay simple `set.has(id)` lookups.
  */
-import type { ActionDefinition } from "../actions/types";
+import type { ActionDefinition, ObjectActionDefinition } from "../actions/types";
 import type { AgentReference, AgentUsageReference } from "../agents/types";
 import type { ConnectorDefinition } from "../connectors";
 import type { DatasetDefinition } from "../datasets";
 import type { ObjectType } from "../ontology";
 import type { PipelineDefinition } from "../pipelines";
+import type { ShareActionGrantBuilder, ShareDefinition, ShareTarget, ShareViewGrantBuilder } from "../shares/types";
 import type { SyncDefinition } from "../syncs";
 import type { WorkflowDefinition } from "../workflows/types";
 import { type BreadthSelector, type BreadthTarget } from "./every";
-import type { AccessGrant, AgentRunGrant, AppendGrant, ApplicationDefinition, ApplyGrant, EditGrant, ManageGrant, ObserveGrant, RunGrant, ViewGrant } from "./types";
+import type { AccessGrant, AgentRunGrant, AppendGrant, ApplicationDefinition, ApplyGrant, EditGrant, ManageGrant, ObserveGrant, RunGrant, ShareGrant, ViewGrant } from "./types";
 type GrantInput<TDefinition, TTarget extends BreadthTarget> = TDefinition | readonly TDefinition[] | BreadthSelector<TTarget>;
 declare function access(input: GrantInput<ApplicationDefinition, "application">): AccessGrant;
+declare function view<const TObjectTypeId extends string>(input: ShareTarget<TObjectTypeId>): ShareViewGrantBuilder<TObjectTypeId>;
 declare function view(input: GrantInput<ObjectType, "object">): ViewGrant<"object">;
 declare function view(input: GrantInput<DatasetDefinition, "dataset">): ViewGrant<"dataset">;
 declare function edit(input: GrantInput<ObjectType, "object">): EditGrant;
 declare function append(input: GrantInput<ObjectType, "object">): AppendGrant;
+declare function apply<const TAction extends ObjectActionDefinition>(input: TAction): ApplyGrant & ShareActionGrantBuilder<TAction>;
 declare function apply(input: GrantInput<ActionDefinition, "action">): ApplyGrant;
+declare function share(input: GrantInput<ShareDefinition, "share">): ShareGrant;
 declare function run(input: GrantInput<WorkflowDefinition, "workflow">): RunGrant<"workflow">;
 declare function run(input: GrantInput<SyncDefinition, "sync">): RunGrant<"sync">;
 declare function run(input: GrantInput<PipelineDefinition, "pipeline">): RunGrant<"pipeline">;
@@ -36,6 +40,7 @@ export declare const can: {
     edit: typeof edit;
     append: typeof append;
     apply: typeof apply;
+    share: typeof share;
     run: typeof run;
     observe: typeof observe;
     manage: typeof manage;

package/dist/security/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/security/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAGnB,MAAM,SAAS,CAAA;AAChB,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,qBAAqB,EACrB,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EAER,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,KAAK,UAAU,CAAC,WAAW,EAAE,OAAO,SAAS,aAAa,IACtD,WAAW,GACX,SAAS,WAAW,EAAE,GACtB,eAAe,CAAC,OAAO,CAAC,CAAA;AA6G5B,iBAAS,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,qBAAqB,EAAE,aAAa,CAAC,GAAG,WAAW,CAGpF;AAED,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAC3E,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;AAMpF,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,SAAS,CAMhE;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,WAAW,CAMpE;AAED,iBAAS,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG,UAAU,CAMxE;AAED,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;AACrF,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;AACzE,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;AACrF,iBAAS,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAAA;AAsClD,iBAAS,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,YAAY,CAWlE;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;AAC9F,iBAAS,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;AAoBnE,eAAO,MAAM,GAAG;;;;;;;;;CASf,CAAA"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/security/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEhF,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,WAAW,EACX,qBAAqB,EACtB,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAGnB,MAAM,SAAS,CAAA;AAChB,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,qBAAqB,EACrB,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EAER,UAAU,EACV,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,KAAK,UAAU,CAAC,WAAW,EAAE,OAAO,SAAS,aAAa,IACtD,WAAW,GACX,SAAS,WAAW,EAAE,GACtB,eAAe,CAAC,OAAO,CAAC,CAAA;AA8G5B,iBAAS,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,qBAAqB,EAAE,aAAa,CAAC,GAAG,WAAW,CAGpF;AAED,iBAAS,IAAI,CAAC,KAAK,CAAC,aAAa,SAAS,MAAM,EAC9C,KAAK,EAAE,WAAW,CAAC,aAAa,CAAC,GAChC,qBAAqB,CAAC,aAAa,CAAC,CAAA;AACvC,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAC3E,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;AASpF,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,SAAS,CAMhE;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,WAAW,CAMpE;AAED,iBAAS,KAAK,CAAC,KAAK,CAAC,OAAO,SAAS,sBAAsB,EACzD,KAAK,EAAE,OAAO,GACb,UAAU,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;AAChD,iBAAS,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAA;AAsBzE,iBAAS,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,eAAe,EAAE,OAAO,CAAC,GAAG,UAAU,CAMtE;AAED,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;AACrF,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;AACzE,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;AACrF,iBAAS,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAAA;AAsClD,iBAAS,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,YAAY,CAWlE;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;AAC9F,iBAAS,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;AAoBnE,eAAO,MAAM,GAAG;;;;;;;;;;CAUf,CAAA"}

package/dist/security/index.d.ts

@@ -9,6 +9,6 @@ export type { MembershipOperationScope, MembershipPolicyScope } from "./membersh
 export { canPerformMembershipOperation, isMembershipOperation, missingMembershipGroupIds, resolveMembershipPolicyScope, } from "./membership-policies";
 export type { SecurityDefinitionCatalog, SecurityRegistryOptions } from "./registry";
 export { SecurityRegistry } from "./registry";
-export type { AccessGrant, AgentRunGrant, AppendGrant, ApplicationDefinition, ApplyGrant, EditGrant, GrantCapability, GrantDefinition, GroupDefinition, GroupReference, ManageGrant, ManageGrantTarget, MembershipOperation, MembershipPolicyDefinition, ObserveGrant, ObserveGrantTarget, RegisteredSecurityDefinitions, RoleDefinition, RunGrant, RunGrantTarget, Selection, ViewGrant, ViewGrantTarget, } from "./types";
+export type { AccessGrant, AgentRunGrant, AppendGrant, ApplicationDefinition, ApplyGrant, EditGrant, GrantCapability, GrantDefinition, GroupDefinition, GroupReference, ManageGrant, ManageGrantTarget, MembershipOperation, MembershipPolicyDefinition, ObserveGrant, ObserveGrantTarget, RegisteredSecurityDefinitions, RoleDefinition, RunGrant, RunGrantTarget, Selection, ShareGrant, ViewGrant, ViewGrantTarget, } from "./types";
 export { assertGrantDefinition, assertGroupDefinition, assertMembershipPolicyDefinition, assertRoleDefinition, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, validateSecurityDefinitionsAtStartup, } from "./validation";
 //# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,YAAY,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC5F,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,YAAY,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,qBAAqB,EACrB,UAAU,EACV,SAAS,EACT,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,QAAQ,EACR,cAAc,EACd,SAAS,EACT,SAAS,EACT,eAAe,GAChB,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,gCAAgC,EAChC,oBAAoB,EACpB,iBAAiB,EACjB,4BAA4B,EAC5B,gBAAgB,EAChB,oCAAoC,GACrC,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,YAAY,EACV,kBAAkB,EAClB,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,YAAY,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC5F,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,YAAY,EACV,WAAW,EACX,aAAa,EACb,WAAW,EACX,qBAAqB,EACrB,UAAU,EACV,SAAS,EACT,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,kBAAkB,EAClB,6BAA6B,EAC7B,cAAc,EACd,QAAQ,EACR,cAAc,EACd,SAAS,EACT,UAAU,EACV,SAAS,EACT,eAAe,GAChB,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,gCAAgC,EAChC,oBAAoB,EACpB,iBAAiB,EACjB,4BAA4B,EAC5B,gBAAgB,EAChB,oCAAoC,GACrC,MAAM,cAAc,CAAA"}

package/dist/security/registry.d.ts

@@ -23,6 +23,7 @@ export interface SecurityRegistryOptions {
     readonly pipelineIds?: ReadonlySet<string>;
     readonly agentAvailable?: boolean;
     readonly connectorIds?: ReadonlySet<string>;
+    readonly shareIds?: ReadonlySet<string>;
     readonly getSubTypes?: (objectTypeId: string) => readonly string[];
 }
 export declare class SecurityRegistry implements SecurityDefinitionCatalog {

package/dist/security/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/security/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAqB,MAAM,kBAAkB,CAAA;AAEvE,OAAO,KAAK,EAAE,eAAe,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAG1F,mFAAmF;AACnF,MAAM,WAAW,yBAAyB;IACxC,UAAU,IAAI,SAAS,eAAe,EAAE,CAAA;IACxC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAAA;IACrD,SAAS,IAAI,SAAS,cAAc,EAAE,CAAA;IACtC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAA;IAClD,iBAAiB,IAAI,SAAS,YAAY,EAAE,CAAA;IAC5C,sBAAsB,IAAI,SAAS,0BAA0B,EAAE,CAAA;IAC/D,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI,CAAA;CAC7E;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;IACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CACnE;AAED,qBAAa,gBAAiB,YAAW,yBAAyB;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsC;IACjE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAC/D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAiD;IACxF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;gBAE3C,KAAK,EAAE,uBAAuB;IA0C1C,UAAU,IAAI,SAAS,eAAe,EAAE;IAIxC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAIrD,SAAS,IAAI,SAAS,cAAc,EAAE;IAItC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAIlD,iBAAiB,IAAI,SAAS,YAAY,EAAE;IAI5C,sBAAsB,IAAI,SAAS,0BAA0B,EAAE;IAI/D,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI;CAG7E"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/security/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAqB,MAAM,kBAAkB,CAAA;AAEvE,OAAO,KAAK,EAAE,eAAe,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAG1F,mFAAmF;AACnF,MAAM,WAAW,yBAAyB;IACxC,UAAU,IAAI,SAAS,eAAe,EAAE,CAAA;IACxC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAAA;IACrD,SAAS,IAAI,SAAS,cAAc,EAAE,CAAA;IACtC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAA;IAClD,iBAAiB,IAAI,SAAS,YAAY,EAAE,CAAA;IAC5C,sBAAsB,IAAI,SAAS,0BAA0B,EAAE,CAAA;IAC/D,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI,CAAA;CAC7E;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;IACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7C,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CACnE;AAED,qBAAa,gBAAiB,YAAW,yBAAyB;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsC;IACjE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAC/D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAiD;IACxF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;gBAE3C,KAAK,EAAE,uBAAuB;IA4C1C,UAAU,IAAI,SAAS,eAAe,EAAE;IAIxC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAIrD,SAAS,IAAI,SAAS,cAAc,EAAE;IAItC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAIlD,iBAAiB,IAAI,SAAS,YAAY,EAAE;IAI5C,sBAAsB,IAAI,SAAS,0BAA0B,EAAE;IAI/D,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI;CAG7E"}

package/dist/security/types.d.ts

@@ -79,6 +79,12 @@ export interface ApplyGrant {
     readonly capability: "apply";
     readonly selection: Selection;
 }
+/** Issue, list, and revoke grants created from the selected Share definitions. */
+export interface ShareGrant {
+    readonly kind: "grant";
+    readonly capability: "share";
+    readonly selection: Selection;
+}
 export type RunGrantTarget = "workflow" | "sync" | "pipeline";
 export interface RunGrant<TTarget extends RunGrantTarget = RunGrantTarget> {
     readonly kind: "grant";
@@ -107,7 +113,7 @@ export interface ManageGrant<TTarget extends ManageGrantTarget = ManageGrantTarg
     readonly target: TTarget;
     readonly selection: Selection;
 }
-export type GrantDefinition = AccessGrant | ViewGrant | EditGrant | AppendGrant | ApplyGrant | RunGrant | AgentRunGrant | ObserveGrant | ManageGrant;
+export type GrantDefinition = AccessGrant | ViewGrant | EditGrant | AppendGrant | ApplyGrant | ShareGrant | RunGrant | AgentRunGrant | ObserveGrant | ManageGrant;
 export type GrantCapability = GrantDefinition["capability"];
 export interface RoleDefinition<TId extends string = string> {
     readonly kind: "role";

package/dist/security/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,MAAM,WAAW,eAAe,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC1D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,MAAM,CAAA;AAErD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAE5D,MAAM,WAAW,qBAAqB,CAAC,GAAG,SAAS,mBAAmB,GAAG,mBAAmB;IAC1F,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,CAAA;AAElD,MAAM,WAAW,SAAS,CAAC,OAAO,SAAS,eAAe,GAAG,eAAe;IAC1E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAA;AAE7D,MAAM,WAAW,QAAQ,CAAC,OAAO,SAAS,cAAc,GAAG,cAAc;IACvE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAAA;AAEnD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,SAAS,CAAA;AAEvD,4EAA4E;AAC5E,MAAM,WAAW,WAAW,CAAC,OAAO,SAAS,iBAAiB,GAAG,iBAAiB;IAChF,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,SAAS,GACT,SAAS,GACT,WAAW,GACX,UAAU,GACV,QAAQ,GACR,aAAa,GACb,YAAY,GACZ,WAAW,CAAA;AAEf,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;AAE3D,MAAM,WAAW,cAAc,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;CAC5C;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,CAAA;AAEvE,MAAM,WAAW,0BAA0B,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IACrE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAC7C;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACzD,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACvD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;CACjF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,MAAM,WAAW,eAAe,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC1D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,MAAM,CAAA;AAErD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAE5D,MAAM,WAAW,qBAAqB,CAAC,GAAG,SAAS,mBAAmB,GAAG,mBAAmB;IAC1F,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,CAAA;AAElD,MAAM,WAAW,SAAS,CAAC,OAAO,SAAS,eAAe,GAAG,eAAe;IAC1E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAA;AAE7D,MAAM,WAAW,QAAQ,CAAC,OAAO,SAAS,cAAc,GAAG,cAAc;IACvE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAAA;AAEnD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,SAAS,CAAA;AAEvD,4EAA4E;AAC5E,MAAM,WAAW,WAAW,CAAC,OAAO,SAAS,iBAAiB,GAAG,iBAAiB;IAChF,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,SAAS,GACT,SAAS,GACT,WAAW,GACX,UAAU,GACV,UAAU,GACV,QAAQ,GACR,aAAa,GACb,YAAY,GACZ,WAAW,CAAA;AAEf,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;AAE3D,MAAM,WAAW,cAAc,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;CAC5C;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,CAAA;AAEvE,MAAM,WAAW,0BAA0B,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IACrE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAC7C;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACzD,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACvD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;CACjF"}

package/dist/security/validation.d.ts

@@ -36,5 +36,7 @@ export declare function validateSecurityDefinitionsAtStartup(input: {
     readonly manageableIds?: ReadonlySet<string>;
     /** Registered connector ids — when provided, manage grants must reference them. */
     readonly connectorIds?: ReadonlySet<string>;
+    /** Registered Share ids — when provided, share grants must reference them. */
+    readonly shareIds?: ReadonlySet<string>;
 }): RegisteredSecurityDefinitions;
 //# sourceMappingURL=validation.d.ts.map

package/dist/security/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/security/validation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEV,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,6BAA6B,EAC7B,cAAc,EAEf,MAAM,SAAS,CAAA;AAiChB,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,KAAK,CAAA;AAI5D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,MAAM,CAIzB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,MAAM,GAAG,SAAS,CAQrC;AA2DD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,eAAe,CAYlC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAO1E;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,0BAA0B,CAiB7C;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,0BAA0B,CAOhG;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,eAAe,CA+ClC;AAqBD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,cAAc,CAqBjC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAOxE;AAED,wBAAgB,oCAAoC,CAAC,KAAK,EAAE;IAC1D,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7C,mFAAmF;IACnF,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,uEAAuE;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,yCAAyC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,gDAAgD;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAC5C,GAAG,6BAA6B,CAmGhC"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/security/validation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEV,eAAe,EACf,eAAe,EACf,0BAA0B,EAC1B,6BAA6B,EAC7B,cAAc,EAEf,MAAM,SAAS,CAAA;AAkChB,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,KAAK,CAAA;AAI5D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,MAAM,CAIzB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,MAAM,GAAG,SAAS,CAQrC;AA2DD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,eAAe,CAYlC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAO1E;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,0BAA0B,CAiB7C;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,0BAA0B,CAOhG;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,eAAe,CA+ClC;AAqBD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,cAAc,CAqBjC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAOxE;AAED,wBAAgB,oCAAoC,CAAC,KAAK,EAAE;IAC1D,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7C,mFAAmF;IACnF,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,uEAAuE;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,yCAAyC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,gDAAgD;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACxC,GAAG,6BAA6B,CAmGhC"}

package/dist/shares/access-plan.d.ts

@@ -0,0 +1,22 @@
+import type { ObjectRef } from "../ontology";
+import type { SelectedObjectReadScope } from "../storage/objects/types";
+/** One capability paired with the exact resources it authorizes. */
+export type ShareScopedGrant = ShareScopedViewGrant | ShareScopedActionGrant;
+export interface ShareScopedViewGrant {
+    readonly kind: "object.view";
+    readonly selection: SelectedObjectReadScope;
+}
+export interface ShareScopedActionGrant {
+    readonly kind: "action.apply";
+    readonly actionId: string;
+    readonly subjects: readonly ObjectRef[];
+}
+/** Internal authority compiled from a delegation such as a shared-access grant. */
+export interface ShareAccessPlan {
+    readonly grants: readonly ShareScopedGrant[];
+}
+/** Validate and detach an access plan before registering process-local authority. */
+export declare function snapshotShareAccessPlan(input: ShareAccessPlan): ShareAccessPlan;
+/** Merge view grants only; capability/resource pairing remains intact for every other grant. */
+export declare function objectReadScopeForAccessPlan(plan: ShareAccessPlan): SelectedObjectReadScope;
+//# sourceMappingURL=access-plan.d.ts.map

package/dist/shares/access-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-plan.d.ts","sourceRoot":"","sources":["../../src/shares/access-plan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAK5C,OAAO,KAAK,EAAkB,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAOvF,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,sBAAsB,CAAA;AAE5E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAA;CAC5C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,SAAS,EAAE,CAAA;CACxC;AAED,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAC7C;AAeD,qFAAqF;AACrF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,eAAe,CAI/E;AA0JD,gGAAgG;AAChG,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,eAAe,GAAG,uBAAuB,CAS3F"}

package/dist/shares/builders.d.ts

@@ -0,0 +1,14 @@
+import type { ObjectActionDefinition } from "../actions";
+import type { ObjectTypeWithPropertyTokens } from "../ontology";
+import type { DefineShareOptions, ShareActionGrant, ShareDefinition, ShareScopeGrant, ShareTarget, ShareViewGrantBuilder } from "./types";
+export declare function defineShare<const TId extends string, const TTarget extends ObjectTypeWithPropertyTokens, const TGrants extends readonly ShareScopeGrant[]>(id: TId, options: DefineShareOptions<TTarget, TGrants>): ShareDefinition<TId, TTarget["id"]>;
+export declare function isShareDefinition(value: unknown): value is ShareDefinition;
+/** @internal Validate, canonicalize, and detach a definition before runtime registration/use. */
+export declare function snapshotShareDefinition(value: unknown): ShareDefinition;
+/** @internal Contextual overload used by `can.view(target)`. */
+export declare function isShareTarget(value: unknown): value is ShareTarget;
+/** @internal Contextual overload used by `can.view(target)`. */
+export declare function createShareViewGrant<TObjectTypeId extends string>(target: ShareTarget<TObjectTypeId>): ShareViewGrantBuilder<TObjectTypeId>;
+/** @internal Contextual overload used by `can.apply(action).on(target)`. */
+export declare function createShareActionGrant<TAction extends ObjectActionDefinition>(action: TAction, target: ShareTarget<TAction["binding"]["objectType"]["id"]>): ShareActionGrant<TAction["id"], TAction["binding"]["objectType"]["id"]>;
+//# sourceMappingURL=builders.d.ts.map

package/dist/shares/builders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/shares/builders.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACxD,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAQ/D,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,WAAW,EAEX,qBAAqB,EACtB,MAAM,SAAS,CAAA;AAIhB,wBAAgB,WAAW,CACzB,KAAK,CAAC,GAAG,SAAS,MAAM,EACxB,KAAK,CAAC,OAAO,SAAS,4BAA4B,EAClD,KAAK,CAAC,OAAO,SAAS,SAAS,eAAe,EAAE,EAChD,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAiC7F;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAU1E;AAED,iGAAiG;AACjG,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CA0CvE;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAElE;AAED,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,aAAa,SAAS,MAAM,EAC/D,MAAM,EAAE,WAAW,CAAC,aAAa,CAAC,GACjC,qBAAqB,CAAC,aAAa,CAAC,CAGtC;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,CAAC,OAAO,SAAS,sBAAsB,EAC3E,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAC1D,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAazE"}

package/dist/shares/compiler.d.ts

@@ -0,0 +1,14 @@
+import type { ActionDefinitionCatalog } from "../actions";
+import type { ObjectRef } from "../ontology";
+import type { OntologyDefinitionCatalog } from "../ontology/registry";
+import { type ShareAccessPlan } from "./access-plan";
+import type { ShareDefinition } from "./types";
+export interface CompileShareAccessPlanInput {
+    readonly share: ShareDefinition;
+    readonly target: ObjectRef;
+    readonly ontology: OntologyDefinitionCatalog;
+    readonly actions: ActionDefinitionCatalog;
+}
+/** Compile one current Share definition and exact target into M01 delegated authority. */
+export declare function compileShareAccessPlan(input: CompileShareAccessPlanInput): ShareAccessPlan;
+//# sourceMappingURL=compiler.d.ts.map

package/dist/shares/compiler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compiler.d.ts","sourceRoot":"","sources":["../../src/shares/compiler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,KAAK,EAA4C,SAAS,EAAE,MAAM,aAAa,CAAA;AACtF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AASrE,OAAO,EAAE,KAAK,eAAe,EAA2B,MAAM,eAAe,CAAA;AAG7E,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAA;AAE9D,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAA;IAC5C,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;CAC1C;AAED,0FAA0F;AAC1F,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,eAAe,CAgE1F"}

package/dist/shares/errors.d.ts

@@ -0,0 +1,4 @@
+export declare class ShareDefinitionError extends Error {
+    readonly name = "ShareDefinitionError";
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/shares/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/shares/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,0BAAyB;CACvC"}

package/dist/shares/execution.d.ts

@@ -0,0 +1,57 @@
+import type { ExecutionContext } from "../execution";
+import type { ObjectRef } from "../ontology";
+import type { DefinitionCatalog } from "../runtime/definitions";
+import type { SixbRuntimeContext } from "../runtime/types";
+import { type ShareGrantRecord } from "../storage";
+import type { ShareDefinition } from "./types";
+export type ShareErrorReason = "invalid_input" | "not_found" | "unauthenticated" | "storage_unavailable" | "storage_failure";
+export declare class ShareError extends Error {
+    readonly reason: ShareErrorReason;
+    readonly name = "ShareError";
+    constructor(reason: ShareErrorReason, message: string, options?: ErrorOptions);
+}
+type ShareTargetObjectTypeId<TDefinition extends ShareDefinition> = TDefinition["target"]["objectTypeId"];
+/** Public lifecycle view. Durable secrets and authority internals never cross this boundary. */
+export type SharedAccessGrant = Omit<ShareGrantRecord, "projectId" | "authoritySnapshot" | "authorityDigest" | "tokenHash">;
+export interface SharedAccessInvitation {
+    readonly grant: SharedAccessGrant;
+    /** Returned once. Storage retains only its SHA-256 digest. */
+    readonly secret: string;
+}
+export interface IssueSharedAccessInput<TDefinition extends ShareDefinition = ShareDefinition> {
+    readonly target: ObjectRef<NoInfer<ShareTargetObjectTypeId<TDefinition>>>;
+    readonly destinationPath: string;
+    readonly expiresAt: Date;
+}
+export interface IssueSharedAccessByIdInput extends IssueSharedAccessInput {
+    readonly definitionId: string;
+}
+export interface ListSharedAccessInput<TDefinition extends ShareDefinition = ShareDefinition> {
+    readonly target?: ObjectRef<NoInfer<ShareTargetObjectTypeId<TDefinition>>>;
+    readonly includeRevoked?: boolean;
+    readonly includeExpired?: boolean;
+    readonly limit?: number;
+    readonly offset?: number;
+}
+export interface ListSharedAccessByIdInput extends Omit<ListSharedAccessInput, "target"> {
+    readonly definitionId: string;
+    /** Filter within the definition's target Object Type. */
+    readonly primaryId?: string;
+}
+export interface SharedAccessGrantListResult {
+    readonly grants: readonly SharedAccessGrant[];
+    readonly total: number;
+    readonly hasMore: boolean;
+}
+export interface SharesRuntime {
+    listDefinitions(): readonly ShareDefinition[];
+    getDefinitionById(definitionId: string): ShareDefinition | null;
+    issue<const TDefinition extends ShareDefinition>(definition: TDefinition, input: IssueSharedAccessInput<TDefinition>): Promise<SharedAccessInvitation>;
+    issueById(input: IssueSharedAccessByIdInput): Promise<SharedAccessInvitation>;
+    list<const TDefinition extends ShareDefinition>(definition: TDefinition, input?: ListSharedAccessInput<TDefinition>): Promise<SharedAccessGrantListResult>;
+    listById(input: ListSharedAccessByIdInput): Promise<SharedAccessGrantListResult>;
+    revoke(grantId: string): Promise<SharedAccessGrant | null>;
+}
+export declare function createSharesRuntime(runtime: SixbRuntimeContext, execution: ExecutionContext, definitions: DefinitionCatalog<ShareDefinition>): SharesRuntime;
+export {};
+//# sourceMappingURL=execution.d.ts.map

package/dist/shares/execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../src/shares/execution.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAE3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EAAuB,KAAK,gBAAgB,EAA0B,MAAM,YAAY,CAAA;AAE/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAI9C,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,WAAW,GACX,iBAAiB,GACjB,qBAAqB,GACrB,iBAAiB,CAAA;AAErB,qBAAa,UAAW,SAAQ,KAAK;IAIjC,QAAQ,CAAC,MAAM,EAAE,gBAAgB;IAHnC,QAAQ,CAAC,IAAI,gBAAe;gBAGjB,MAAM,EAAE,gBAAgB,EACjC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY;CAIzB;AAED,KAAK,uBAAuB,CAAC,WAAW,SAAS,eAAe,IAC9D,WAAW,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,CAAA;AAEvC,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,gBAAgB,EAChB,WAAW,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,WAAW,CACpE,CAAA;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,sBAAsB,CAAC,WAAW,SAAS,eAAe,GAAG,eAAe;IAC3F,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IACzE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,0BAA2B,SAAQ,sBAAsB;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,qBAAqB,CAAC,WAAW,SAAS,eAAe,GAAG,eAAe;IAC1F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IAC1E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,yBAA0B,SAAQ,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC;IACtF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,eAAe,IAAI,SAAS,eAAe,EAAE,CAAA;IAC7C,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAAA;IAC/D,KAAK,CAAC,KAAK,CAAC,WAAW,SAAS,eAAe,EAC7C,UAAU,EAAE,WAAW,EACvB,KAAK,EAAE,sBAAsB,CAAC,WAAW,CAAC,GACzC,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAClC,SAAS,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC7E,IAAI,CAAC,KAAK,CAAC,WAAW,SAAS,eAAe,EAC5C,UAAU,EAAE,WAAW,EACvB,KAAK,CAAC,EAAE,qBAAqB,CAAC,WAAW,CAAC,GACzC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAA;IAChF,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;CAC3D;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,WAAW,EAAE,iBAAiB,CAAC,eAAe,CAAC,GAC9C,aAAa,CAyMf"}

package/dist/shares/index.d.ts

@@ -0,0 +1,10 @@
+export { defineShare, isShareDefinition } from "./builders";
+export type { CompileShareAccessPlanInput } from "./compiler";
+export { compileShareAccessPlan } from "./compiler";
+export { ShareDefinitionError } from "./errors";
+export type { IssueSharedAccessByIdInput, IssueSharedAccessInput, ListSharedAccessByIdInput, ListSharedAccessInput, SharedAccessGrant, SharedAccessGrantListResult, SharedAccessInvitation, ShareErrorReason, SharesRuntime, } from "./execution";
+export { ShareError } from "./execution";
+export { intersectShareAccessPlans } from "./intersection";
+export type { DefineShareOptions, ShareActionGrant, ShareActionGrantBuilder, ShareDefinition, ShareScopeGrant, ShareTarget, ShareViewGrant, ShareViewGrantBuilder, } from "./types";
+export { assertShareDefinitionEnvelope, validateSharesAtStartup } from "./validation";
+//# sourceMappingURL=index.d.ts.map

package/dist/shares/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/shares/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC3D,YAAY,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAC/C,YAAY,EACV,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,iBAAiB,EACjB,2BAA2B,EAC3B,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,GACd,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAA;AAC1D,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,eAAe,EACf,WAAW,EACX,cAAc,EACd,qBAAqB,GACtB,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,6BAA6B,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA"}

package/dist/shares/internal.d.ts

@@ -0,0 +1,3 @@
+export type { SharedSessionContext, SharedSessionCredential, SharedSessionProtocolOptions, } from "./session-protocol";
+export { DEFAULT_SHARED_SESSION_INACTIVITY_TTL_MS, SharedSessionProtocol, } from "./session-protocol";
+//# sourceMappingURL=internal.d.ts.map

package/dist/shares/internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../src/shares/internal.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,oBAAoB,EACpB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,wCAAwC,EACxC,qBAAqB,GACtB,MAAM,oBAAoB,CAAA"}

package/dist/shares/internal.js

@@ -0,0 +1,231 @@
+// @bun
+import"../chunk-f4w3yp4f.js";
+import"../chunk-b19g04jk.js";
+import"../chunk-vsj3mdfj.js";
+import"../chunk-dz5h08xv.js";
+import"../chunk-v4jbb3rs.js";
+import"../chunk-ms2tmn1k.js";
+import {
+  formatSessionCookieValue2,
+  parseSessionCookieValue2
+} from "../chunk-g00bfdq6.js";
+import"../chunk-q5gz3g2j.js";
+import"../chunk-pqajwytd.js";
+import"../chunk-e0d1rzef.js";
+import"../chunk-gfdh9kqa.js";
+import"../chunk-39tqv9hz.js";
+import"../chunk-7bs40fe1.js";
+import"../chunk-g53f0e4j.js";
+import"../chunk-jgwb25gc.js";
+import"../chunk-8vj0rjgs.js";
+import"../chunk-93csa55g.js";
+import"../chunk-ap0g1g74.js";
+import"../chunk-mjbk2djy.js";
+import"../chunk-c5rkjrgp.js";
+import"../chunk-x57ycxq0.js";
+import"../chunk-z30bv4ga.js";
+import"../chunk-mmagke4x.js";
+import"../chunk-3frsnm7x.js";
+import"../chunk-ppytyr6w.js";
+import"../chunk-jmfet9r4.js";
+import"../chunk-qf954wje.js";
+import"../chunk-pr2h4bv4.js";
+import {
+  compileShareAccessPlan
+} from "../chunk-awbhdqyc.js";
+import {
+  intersectShareAccessPlans
+} from "../chunk-x9v4cx1d.js";
+import {
+  snapshotShareAccessPlan
+} from "../chunk-br3k6qbf.js";
+import {
+  ShareSessionStorageError2
+} from "../chunk-z8fx5cgb.js";
+import"../chunk-s3csryxe.js";
+import"../chunk-653vwrzr.js";
+import"../chunk-f0rwz2vh.js";
+
+// src/shares/session-protocol.ts
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "crypto";
+var DEFAULT_SHARED_SESSION_INACTIVITY_TTL_MS = 15 * 60000;
+var MAX_CREATE_ATTEMPTS = 5;
+var SECRET_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+
+class SharedSessionProtocol {
+  host;
+  inactivityTtlMs;
+  now;
+  constructor(options) {
+    if (!options.host.storage.shareGrants || !options.host.storage.shareSessions) {
+      throw new Error("[Sixb] Shared sessions require share grant and session storage.");
+    }
+    const inactivityTtlMs = options.inactivityTtlMs ?? DEFAULT_SHARED_SESSION_INACTIVITY_TTL_MS;
+    if (!Number.isSafeInteger(inactivityTtlMs) || inactivityTtlMs <= 0) {
+      throw new Error("[Sixb] Shared session inactivity TTL must be a positive integer.");
+    }
+    this.host = options.host;
+    this.inactivityTtlMs = inactivityTtlMs;
+    this.now = options.now ?? (() => new Date);
+  }
+  async exchange(grantId, secret) {
+    if (!validIdentifier(grantId) || !validSecret(secret))
+      return null;
+    const now = this.currentTime();
+    for (let attempt = 0;attempt < MAX_CREATE_ATTEMPTS; attempt += 1) {
+      const sessionSecret = randomBytes(32).toString("base64url");
+      const sessionId = `shs_${randomUUID()}`;
+      try {
+        const result = await this.host.storage.transaction(async (tx) => {
+          const grant = await activeGrant(tx, this.host.projectId, grantId, now);
+          const secretMatches = secretMatchesHash(secret, grant?.tokenHash ?? "");
+          if (!grant || !secretMatches)
+            return null;
+          const sessions = requireSessions(tx);
+          const absoluteExpiresAt = new Date(grant.expiresAt);
+          const session = await sessions.create({
+            id: sessionId,
+            projectId: this.host.projectId,
+            grantId: grant.id,
+            tokenHash: sha256(sessionSecret),
+            createdAt: now,
+            expiresAt: inactivityDeadline(now, absoluteExpiresAt, this.inactivityTtlMs),
+            absoluteExpiresAt
+          });
+          return { grant, session };
+        });
+        if (!result)
+          return null;
+        return {
+          context: this.context(result.grant, result.session),
+          cookieValue: formatSessionCookieValue2(sessionId, sessionSecret)
+        };
+      } catch (error) {
+        if (error instanceof ShareSessionStorageError2 && error.code === "duplicate" && attempt < MAX_CREATE_ATTEMPTS - 1) {
+          continue;
+        }
+        throw error;
+      }
+    }
+    return null;
+  }
+  async resolve(grantId, cookieValue, options = {}) {
+    if (!validIdentifier(grantId) || !validCookieValue(cookieValue))
+      return null;
+    const credential = parseSessionCookieValue2(cookieValue);
+    if (!credential || !validIdentifier(credential.sessionId) || !validSecret(credential.sessionSecret)) {
+      return null;
+    }
+    const now = this.currentTime();
+    const tokenHash = sha256(credential.sessionSecret);
+    const result = await this.host.storage.transaction(async (tx) => {
+      const sessions = requireSessions(tx);
+      const current = await sessions.getById({
+        projectId: this.host.projectId,
+        id: credential.sessionId
+      });
+      const secretMatches = secretMatchesHash(credential.sessionSecret, current?.tokenHash ?? "");
+      if (!current || current.grantId !== grantId || current.revokedAt !== undefined || current.expiresAt.getTime() <= now.getTime() || current.absoluteExpiresAt.getTime() <= now.getTime() || !secretMatches) {
+        return null;
+      }
+      const grant = await activeGrant(tx, this.host.projectId, grantId, now);
+      if (!grant || current.absoluteExpiresAt.getTime() !== grant.expiresAt.getTime()) {
+        return null;
+      }
+      if (options.activity !== "foreground")
+        return { grant, session: current };
+      const renewed = await sessions.renewIfValid({
+        projectId: this.host.projectId,
+        id: current.id,
+        grantId,
+        tokenHash,
+        now,
+        expiresAt: inactivityDeadline(now, current.absoluteExpiresAt, this.inactivityTtlMs)
+      });
+      return renewed ? { grant, session: renewed } : null;
+    });
+    return result ? this.context(result.grant, result.session) : null;
+  }
+  async revoke(context) {
+    const revokedAt = this.currentTime();
+    await this.host.storage.transaction(async (tx) => {
+      const session = await requireSessions(tx).getById({
+        projectId: this.host.projectId,
+        id: context.sessionId
+      });
+      if (!session || session.grantId !== context.grantId)
+        return;
+      await requireSessions(tx).revoke({
+        projectId: this.host.projectId,
+        id: context.sessionId,
+        revokedAt
+      });
+    });
+  }
+  context(grant, session) {
+    return {
+      grantId: grant.id,
+      sessionId: session.id,
+      destinationPath: grant.destinationPath,
+      access: effectiveAccess(this.host, grant),
+      expiresAt: new Date(session.expiresAt),
+      absoluteExpiresAt: new Date(session.absoluteExpiresAt)
+    };
+  }
+  currentTime() {
+    const now = this.now();
+    if (!(now instanceof Date) || !Number.isFinite(now.getTime())) {
+      throw new Error("[Sixb] Shared session clock returned an invalid date.");
+    }
+    return new Date(now);
+  }
+}
+function effectiveAccess(host, grant) {
+  const definition = host.definitions.shares.getById(grant.definitionId);
+  if (!definition || definition.target.objectTypeId !== grant.target.objectTypeId) {
+    return snapshotShareAccessPlan({ grants: [] });
+  }
+  const current = compileShareAccessPlan({
+    share: definition,
+    target: grant.target,
+    ontology: host.definitions.ontology,
+    actions: host.definitions.actions
+  });
+  return intersectShareAccessPlans(grant.authoritySnapshot.access, current);
+}
+async function activeGrant(storage, projectId, grantId, now) {
+  const grant = await storage.shareGrants?.getById({ projectId, id: grantId });
+  return !grant || grant.revokedAt !== undefined || grant.expiresAt.getTime() <= now.getTime() ? null : grant;
+}
+function requireSessions(storage) {
+  if (!storage.shareSessions) {
+    throw new Error("[Sixb] Shared session storage is not configured.");
+  }
+  return storage.shareSessions;
+}
+function inactivityDeadline(now, absolute, ttlMs) {
+  return new Date(Math.min(absolute.getTime(), now.getTime() + ttlMs));
+}
+function secretMatchesHash(secret, expectedHash) {
+  const actual = createHash("sha256").update(secret).digest();
+  const expected = /^[0-9a-f]{64}$/.test(expectedHash) ? Buffer.from(expectedHash, "hex") : Buffer.alloc(actual.length);
+  return timingSafeEqual(actual, expected);
+}
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function validIdentifier(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= 128 && value.trim() === value;
+}
+function validSecret(value) {
+  return typeof value === "string" && SECRET_PATTERN.test(value);
+}
+function validCookieValue(value) {
+  return typeof value === "string" && value.length <= 256;
+}
+export {
+  DEFAULT_SHARED_SESSION_INACTIVITY_TTL_MS,
+  SharedSessionProtocol
+};
+
+//# debugId=46DFFB880F951EAC64756E2164756E21