@sixb/core 0.1.8 → 0.1.10

package/dist/{chunk-mwsxn98e.js → chunk-r7fj830t.js}

@@ -1,122 +1,126 @@
 // @bun
 import {
-  SchedulerRuntime
-} from "./chunk-9t8f5xfx.js";
+  OntologyRegistry2
+} from "./chunk-ap0g1g74.js";
 import {
-  registerProjectionRegistry
-} from "./chunk-ajnan18g.js";
+  ProjectionRegistry2,
+  createOntologyMaterializer2
+} from "./chunk-ftv470j8.js";
 import {
-  LoggingService
-} from "./chunk-s5y30bc9.js";
+  captureSixbFailure2,
+  isSixbError2
+} from "./chunk-f4w3yp4f.js";
 import {
-  OntologyOutboxDispatcher,
-  createDomainEventService
-} from "./chunk-n2w475r0.js";
+  captureExecutionScope,
+  resolveExecutionScopeAuthorization,
+  AuthorizationError2
+} from "./chunk-dz5h08xv.js";
 import {
-  discoverOntologySources,
-  discoverProjectDefinitions,
-  validateRulesAtStartup,
-  validateSharesAtStartup
-} from "./chunk-3xep5cjx.js";
+  SecurityRegistry,
+  AuthRuntime2
+} from "./chunk-g00bfdq6.js";
 import {
-  validateSchedulesAtStartup
-} from "./chunk-5sz8ta9r.js";
+  AuthRuntimeError2,
+  isMagicLinkAuthStrategy2,
+  isOidcAuthStrategy2
+} from "./chunk-q5gz3g2j.js";
 import {
-  toolsFromProjectConfig
-} from "./chunk-4qfkag59.js";
+  RuntimeError2,
+  createModelCatalog2
+} from "./chunk-e0d1rzef.js";
 import {
-  assertNoAgentDefinitions,
-  createBoundSixb,
-  validateWorkflowAgentStepGroupReferences,
-  validateWorkflowsAtStartup
-} from "./chunk-xajtptbw.js";
+  isMigrationCapableStorage2,
+  checkStorageSchema2
+} from "./chunk-p6a4npdx.js";
 import {
-  ConnectorError,
-  ConnectorNotFoundError,
-  SyncValidationError,
-  createAmbiguousProviderOperationError,
-  createConnectorCodedError,
-  isConnectorStorageError,
-  oauthErrorKind,
-  providerBoundaryError,
-  providerFailureCode,
-  recoverConnectorFailure,
-  storageBoundaryError
-} from "./chunk-wtf06et8.js";
+  createAuthorizedObjectReader
+} from "./chunk-nmbxcaqx.js";
 import {
-  createOntologyMutationRuntime,
-  registerOntologyMutationRuntime
-} from "./chunk-xhy826cz.js";
+  attachSixbErrorReporter2,
+  shareSixbErrorReporter2
+} from "./chunk-7apz6hg4.js";
 import {
-  isOAuthConnectorDefinition,
-  isStaticConnectorDefinition
-} from "./chunk-8m5ejdpn.js";
+  ActionRegistry2
+} from "./chunk-p5vcsw9c.js";
 import {
-  registerConnectorConnectionCallbackProcess
-} from "./chunk-nf4r78r4.js";
+  assertDatasetDefinition2
+} from "./chunk-860dwwy0.js";
 import {
-  assertDatasetDefinition
-} from "./chunk-pc7ys28c.js";
+  OntologyOutboxDispatcher2,
+  createDomainEventService2
+} from "./chunk-nt99sxd6.js";
 import {
-  ActionRegistry
-} from "./chunk-v1xppd0y.js";
+  validateSchedulesAtStartup2
+} from "./chunk-e1c18xjx.js";
 import {
-  createAuthorizedObjectReader
-} from "./chunk-h5vqbfmd.js";
+  ConnectorError2,
+  ConnectorNotFoundError2,
+  createConnectorCodedError,
+  createAmbiguousProviderOperationError,
+  oauthErrorKind,
+  providerFailureCode,
+  providerBoundaryError,
+  isConnectorStorageError,
+  storageBoundaryError,
+  recoverConnectorFailure
+} from "./chunk-v2vcg0w6.js";
 import {
-  ProjectionRegistry,
-  createOntologyMaterializer
-} from "./chunk-f26bck4t.js";
+  toolsFromProjectConfig
+} from "./chunk-skz0hst3.js";
 import {
-  ensureExecutionRecord
-} from "./chunk-k522z7v6.js";
+  assertNoAgentDefinitions,
+  validateWorkflowsAtStartup2,
+  validateWorkflowAgentStepGroupReferences2,
+  createBoundSixb
+} from "./chunk-5p1v802y.js";
 import {
-  checkStorageSchema,
-  isMigrationCapableStorage
-} from "./chunk-sbzzr4kx.js";
+  registerConnectorConnectionCallbackProcess
+} from "./chunk-5a4a52tq.js";
 import {
-  CONNECTOR_CONNECTION_RUN_FAILURE_CODES,
-  ConnectorConnectionStorageError
-} from "./chunk-5gd7tpv6.js";
+  registerOntologyMutationRuntime2,
+  createOntologyMutationRuntime2
+} from "./chunk-85cd7e8c.js";
 import {
-  RuntimeError,
-  createModelCatalog
-} from "./chunk-p2vqaxkc.js";
+  SchedulerRuntime2
+} from "./chunk-z5rnrmz1.js";
 import {
-  attachSixbErrorReporter,
-  shareSixbErrorReporter
-} from "./chunk-jq43kdvk.js";
+  validateRulesAtStartup,
+  validateSharesAtStartup,
+  discoverOntologySources2,
+  discoverProjectDefinitions2
+} from "./chunk-agbbygvh.js";
 import {
-  reportEventDeliveryFailure
-} from "./chunk-qw9gvjv5.js";
+  LoggingService2
+} from "./chunk-3qms4nax.js";
 import {
-  AuthRuntime,
-  SecurityRegistry
-} from "./chunk-4sm0aznx.js";
+  registerProjectionRegistry2
+} from "./chunk-1824gssz.js";
 import {
-  OntologyRegistry
-} from "./chunk-2dw777qw.js";
+  SyncValidationError2
+} from "./chunk-5c7ga8zz.js";
 import {
-  AuthRuntimeError,
-  isMagicLinkAuthStrategy,
-  isOidcAuthStrategy
-} from "./chunk-xwnf87e1.js";
+  isOAuthConnectorDefinition2
+} from "./chunk-9x8dybsb.js";
 import {
-  AuthorizationError,
-  captureExecutionScope,
-  resolveExecutionScopeAuthorization
-} from "./chunk-p1x242ad.js";
+  ensureExecutionRecord2
+} from "./chunk-17kfctj6.js";
+import {
+  ConnectorConnectionStorageError2,
+  CONNECTOR_CONNECTION_RUN_FAILURE_CODES2
+} from "./chunk-2c4j899j.js";
 import {
-  captureSixbFailure,
-  isSixbError
-} from "./chunk-2xns679x.js";
+  reportEventDeliveryFailure3
+} from "./chunk-72w2pxk7.js";
+import {
+  isJsonObject2
+} from "./chunk-wy0qdqfm.js";
 // src/webhooks/errors.ts
-class WebhookValidationError extends Error {
+class WebhookValidationError2 extends Error {
   name = "WebhookValidationError";
 }
 
 // src/webhooks/builders.ts
-function defineWebhook(id) {
+function defineWebhook2(id) {
   assertNonEmpty(id, "Webhook id");
   return new WebhookMethodBuilder(id);
 }
@@ -140,7 +144,7 @@ class WebhookBodyBuilder {
   }
   json(schema) {
     if (schema !== undefined && typeof schema.parse !== "function") {
-      throw new WebhookValidationError("[Sixb] Webhook JSON schema must provide parse(value).");
+      throw new WebhookValidationError2("[Sixb] Webhook JSON schema must provide parse(value).");
     }
     return new WebhookBuilder({
       id: this.id,
@@ -192,7 +196,7 @@ class WebhookBuilder {
   }
   verify(verify) {
     if (typeof verify !== "function") {
-      throw new WebhookValidationError("[Sixb] Webhook verify must be a function.");
+      throw new WebhookValidationError2("[Sixb] Webhook verify must be a function.");
     }
     return new WebhookBuilder({
       ...this.draft,
@@ -201,7 +205,7 @@ class WebhookBuilder {
   }
   idempotencyKey(resolver) {
     if (typeof resolver !== "function") {
-      throw new WebhookValidationError("[Sixb] Webhook idempotencyKey must be a function.");
+      throw new WebhookValidationError2("[Sixb] Webhook idempotencyKey must be a function.");
     }
     return new WebhookBuilder({
       ...this.draft,
@@ -210,7 +214,7 @@ class WebhookBuilder {
   }
   handle(handle) {
     if (typeof handle !== "function") {
-      throw new WebhookValidationError("[Sixb] Webhook handle must be a function.");
+      throw new WebhookValidationError2("[Sixb] Webhook handle must be a function.");
     }
     return {
       kind: "webhook",
@@ -225,11 +229,11 @@ class WebhookBuilder {
 }
 function assertNonEmpty(value, field) {
   if (!value.trim()) {
-    throw new WebhookValidationError(`[Sixb] ${field} must not be empty.`);
+    throw new WebhookValidationError2(`[Sixb] ${field} must not be empty.`);
   }
 }
 // src/webhooks/connector.ts
-function webhookConnector(options) {
+function webhookConnector2(options) {
   return {
     type: "webhook",
     webhooks: options.webhooks,
@@ -245,23 +249,21 @@ class WebhookRegistry {
   constructor(options) {
     const registered = [];
     for (const connector of options.connectors) {
-      if (!isStaticConnectorDefinition(connector))
-        continue;
       const webhooks = connector.adapter.webhooks ?? [];
       if (!Array.isArray(webhooks)) {
-        throw new WebhookValidationError(`[Sixb] Connector '${connector.id}' webhooks must be an array when provided.`);
+        throw new WebhookValidationError2(`[Sixb] Connector '${connector.id}' webhooks must be an array when provided.`);
       }
       const ids = new Set;
       for (const webhook of webhooks) {
         assertValidWebhook(connector.id, webhook);
         if (ids.has(webhook.id)) {
-          throw new WebhookValidationError(`[Sixb] Duplicate webhook id '${webhook.id}' for connector '${connector.id}'.`);
+          throw new WebhookValidationError2(`[Sixb] Duplicate webhook id '${webhook.id}' for connector '${connector.id}'.`);
         }
         ids.add(webhook.id);
         const route = webhookRoute(connector.id, webhook.id);
         const duplicate = this.byRoute.get(route);
         if (duplicate) {
-          throw new WebhookValidationError(`[Sixb] Duplicate webhook route '${route}' for connectors '${duplicate.connector.id}' and '${connector.id}'.`);
+          throw new WebhookValidationError2(`[Sixb] Duplicate webhook route '${route}' for connectors '${duplicate.connector.id}' and '${connector.id}'.`);
         }
         const registeredWebhook = {
           connector,
@@ -289,52 +291,52 @@ function webhookRoute(connectorId, webhookId) {
 }
 function assertValidWebhook(connectorId, webhook) {
   if (!isRecord(webhook)) {
-    throw new WebhookValidationError(`[Sixb] Connector '${connectorId}' has an invalid webhook.`);
+    throw new WebhookValidationError2(`[Sixb] Connector '${connectorId}' has an invalid webhook.`);
   }
   if (webhook.kind !== "webhook") {
-    throw new WebhookValidationError(`[Sixb] Connector '${connectorId}' webhook must be created with defineWebhook(...).`);
+    throw new WebhookValidationError2(`[Sixb] Connector '${connectorId}' webhook must be created with defineWebhook(...).`);
   }
   if (typeof webhook.id !== "string" || !webhook.id.trim()) {
-    throw new WebhookValidationError(`[Sixb] Connector '${connectorId}' webhook id must not be empty.`);
+    throw new WebhookValidationError2(`[Sixb] Connector '${connectorId}' webhook id must not be empty.`);
   }
   if (webhook.method !== "POST") {
-    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' must use method POST.`);
+    throw new WebhookValidationError2(`[Sixb] Webhook '${connectorId}/${webhook.id}' must use method POST.`);
   }
   if (!isRecord(webhook.body)) {
-    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' body is required.`);
+    throw new WebhookValidationError2(`[Sixb] Webhook '${connectorId}/${webhook.id}' body is required.`);
   }
   if (webhook.body.format !== "json" && webhook.body.format !== "text" && webhook.body.format !== "raw") {
-    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' body format must be json, text, or raw.`);
+    throw new WebhookValidationError2(`[Sixb] Webhook '${connectorId}/${webhook.id}' body format must be json, text, or raw.`);
   }
   if (typeof webhook.body.parse !== "function") {
-    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' body parser must provide parse(value).`);
+    throw new WebhookValidationError2(`[Sixb] Webhook '${connectorId}/${webhook.id}' body parser must provide parse(value).`);
   }
   if (webhook.verify !== undefined && typeof webhook.verify !== "function") {
-    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' verify must be a function.`);
+    throw new WebhookValidationError2(`[Sixb] Webhook '${connectorId}/${webhook.id}' verify must be a function.`);
   }
   if (webhook.idempotencyKey !== undefined && typeof webhook.idempotencyKey !== "function") {
-    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' idempotencyKey must be a function.`);
+    throw new WebhookValidationError2(`[Sixb] Webhook '${connectorId}/${webhook.id}' idempotencyKey must be a function.`);
   }
   if (typeof webhook.handle !== "function") {
-    throw new WebhookValidationError(`[Sixb] Webhook '${connectorId}/${webhook.id}' handle must be a function.`);
+    throw new WebhookValidationError2(`[Sixb] Webhook '${connectorId}/${webhook.id}' handle must be a function.`);
   }
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 // src/webhooks/unverified.ts
-class UnverifiedWebhookError extends Error {
+class UnverifiedWebhookError2 extends Error {
   name = "UnverifiedWebhookError";
 }
-function resolveWebhookVerification(subject, options) {
+function resolveWebhookVerification2(subject, options) {
   if (options.credential)
     return { credential: options.credential };
   if (!options.allowUnverified) {
-    throw new UnverifiedWebhookError(`[${subject.connector}] This webhook has no credential, so ${subject.verifies} cannot be ` + `checked and the route would accept unverified requests from anyone who can reach it. ` + `Set ${subject.credentialOption}, or pass ${subject.allowOption} to accept that.`);
+    throw new UnverifiedWebhookError2(`[${subject.connector}] This webhook has no credential, so ${subject.verifies} cannot be ` + `checked and the route would accept unverified requests from anyone who can reach it. ` + `Set ${subject.credentialOption}, or pass ${subject.allowOption} to accept that.`);
   }
   return { allowUnverified: true };
 }
-function warnUnverifiedWebhook(subject, verification) {
+function warnUnverifiedWebhook2(subject, verification) {
   if (verification.credential)
     return;
   console.warn(`[${subject.connector}] ${subject.allowOption}, so ${subject.verifies} is not checked ` + `and this route accepts unverified requests from anyone who can reach it. ` + `Set ${subject.credentialOption} before exposing it.`);
@@ -467,6 +469,12 @@ function validateCredentials(credentials) {
     }
     normalized.expiresAt = new Date(credentials.expiresAt);
   }
+  if (credentials.authorizationContext !== undefined) {
+    if (!isJsonObject2(credentials.authorizationContext)) {
+      throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector adapter returned invalid authorization context; expected a JSON object.");
+    }
+    normalized.authorizationContext = structuredClone(credentials.authorizationContext);
+  }
   return normalized;
 }
 function validateAccounts(accounts) {
@@ -500,7 +508,8 @@ function serializeCredentials(credentials) {
     ...credentials.refreshToken === undefined ? {} : { refreshToken: credentials.refreshToken },
     ...credentials.tokenType === undefined ? {} : { tokenType: credentials.tokenType },
     ...credentials.scopes === undefined ? {} : { scopes: credentials.scopes },
-    ...credentials.expiresAt === undefined ? {} : { expiresAt: credentials.expiresAt.toISOString() }
+    ...credentials.expiresAt === undefined ? {} : { expiresAt: credentials.expiresAt.toISOString() },
+    ...credentials.authorizationContext === undefined ? {} : { authorizationContext: credentials.authorizationContext }
   });
 }
 function parseCredentials(serialized) {
@@ -513,7 +522,7 @@ function parseCredentials(serialized) {
   if (!isRecord2(value) || value.version !== 1 || typeof value.accessToken !== "string") {
     throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are invalid.");
   }
-  if (value.refreshToken !== undefined && typeof value.refreshToken !== "string" || value.tokenType !== undefined && typeof value.tokenType !== "string" || value.scopes !== undefined && (!Array.isArray(value.scopes) || value.scopes.some((scope) => typeof scope !== "string")) || value.expiresAt !== undefined && typeof value.expiresAt !== "string") {
+  if (value.refreshToken !== undefined && typeof value.refreshToken !== "string" || value.tokenType !== undefined && typeof value.tokenType !== "string" || value.scopes !== undefined && (!Array.isArray(value.scopes) || value.scopes.some((scope) => typeof scope !== "string")) || value.expiresAt !== undefined && typeof value.expiresAt !== "string" || value.authorizationContext !== undefined && !isJsonObject2(value.authorizationContext)) {
     throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are invalid.");
   }
   const expiresAt = value.expiresAt === undefined ? undefined : new Date(value.expiresAt);
@@ -523,7 +532,8 @@ function parseCredentials(serialized) {
       ...value.refreshToken === undefined ? {} : { refreshToken: value.refreshToken },
       ...value.tokenType === undefined ? {} : { tokenType: value.tokenType },
       ...value.scopes === undefined ? {} : { scopes: value.scopes },
-      ...expiresAt === undefined ? {} : { expiresAt }
+      ...expiresAt === undefined ? {} : { expiresAt },
+      ...value.authorizationContext === undefined ? {} : { authorizationContext: value.authorizationContext }
     });
   } catch (error) {
     throw createConnectorCodedError("connector.credentials_unavailable", "Stored connector credentials are invalid.", { cause: error });
@@ -567,9 +577,44 @@ function normalizedHttpUrl(value, field, code = "connector.configuration_invalid
 }
 function assertAuthorizationUrlParameters(authorizationUrl, expected) {
   const parameters = new URL(authorizationUrl).searchParams;
-  if (!sameSingleParameter(parameters, "state", expected.state) || !sameSingleParameter(parameters, "code_challenge", expected.codeChallenge) || !sameSingleParameter(parameters, "code_challenge_method", "S256")) {
-    throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector authorization URL must preserve the framework-provided state and PKCE S256 parameters.");
-  }
+  if (!sameSingleParameter(parameters, "state", expected.state) || (expected.codeChallenge === undefined ? parameters.has("code_challenge") || parameters.has("code_challenge_method") : !sameSingleParameter(parameters, "code_challenge", expected.codeChallenge) || !sameSingleParameter(parameters, "code_challenge_method", "S256"))) {
+    throw createConnectorCodedError("connector.adapter_invalid", expected.codeChallenge === undefined ? "OAuth connector authorization URL must preserve the framework-provided state and omit disabled PKCE parameters." : "OAuth connector authorization URL must preserve the framework-provided state and PKCE S256 parameters.");
+  }
+}
+function connectorPkceEnabled(pkce) {
+  if (pkce === undefined || pkce === "S256")
+    return true;
+  if (pkce === "disabled")
+    return false;
+  throw createConnectorCodedError("connector.adapter_invalid", "OAuth connector PKCE must be S256 or disabled.");
+}
+var reservedCallbackParameters = new Set([
+  "state",
+  "code",
+  "auth_code",
+  "error",
+  "error_description",
+  "error_uri"
+]);
+function validateCallbackParameterNames(names = []) {
+  if (!Array.isArray(names) || names.some((name) => typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(name) || reservedCallbackParameters.has(name)) || new Set(names).size !== names.length) {
+    throw createConnectorCodedError("connector.adapter_invalid", "OAuth callback parameter names must be unique, non-reserved parameter names.");
+  }
+}
+function selectCallbackParameters(names = [], parameters = {}) {
+  validateCallbackParameterNames(names);
+  if (!isRecord2(parameters)) {
+    throw createConnectorCodedError("connector.authorization_invalid", "OAuth provider callback parameters must be an object.");
+  }
+  return Object.fromEntries(names.flatMap((name) => {
+    if (!Object.hasOwn(parameters, name))
+      return [];
+    const value = parameters[name];
+    if (typeof value !== "string") {
+      throw createConnectorCodedError("connector.authorization_invalid", "OAuth provider callback parameters must have a single string value.");
+    }
+    return [[name, value]];
+  }));
 }
 function nonblank(value, field, code = "connector.configuration_invalid") {
   if (typeof value !== "string" || !value.trim()) {
@@ -1069,7 +1114,8 @@ class ConnectorTokenAccess {
             ...refreshed,
             ...refreshed.refreshToken === undefined ? { refreshToken: current.refreshToken } : {},
             ...refreshed.tokenType === undefined && current.tokenType !== undefined ? { tokenType: current.tokenType } : {},
-            scopes: refreshed.scopes ?? current.scopes ?? authorization.scopes
+            scopes: refreshed.scopes ?? current.scopes ?? authorization.scopes,
+            ...refreshed.authorizationContext === undefined && current.authorizationContext !== undefined ? { authorizationContext: current.authorizationContext } : {}
           };
           const envelope = await this.credentials.seal(definition.id, authorization.id, normalized);
           return this.mutations.stageCredentialMutationCredentials(executing, signal, {
@@ -1200,7 +1246,7 @@ class DefaultConnectorAuthorizationLifecycle {
   async completeNewAuthorization(input) {
     this.assertRegistered(input.definition);
     const authorizationId = `cau_${randomUUID2()}`;
-    const credentials = await this.exchangeAuthorizationCode(input.definition, input.code, input.codeVerifier, input.redirectUri);
+    const credentials = await this.exchangeAuthorizationCode(input.definition, input.code, input.codeVerifier, input.redirectUri, input.callbackParameters);
     const credentialsEnvelope = await this.credentials.seal(input.definition.id, authorizationId, credentials);
     let pending;
     try {
@@ -1333,7 +1379,7 @@ class DefaultConnectorAuthorizationLifecycle {
     try {
       await this.revokeAuthorization({ definition, authorizationId, principal });
     } catch (cleanupError) {
-      if (isSixbError(cleanupError) && cleanupError.code === "connector.revocation_pending")
+      if (isSixbError2(cleanupError) && cleanupError.code === "connector.revocation_pending")
         return;
       throw createConnectorCodedError("internal.unexpected", "Unused connector credentials could not be scheduled for revocation.", {
         cause: new AggregateError([primaryError, cleanupError], "Connector authorization failed and cleanup could not be secured.")
@@ -1358,7 +1404,11 @@ class DefaultConnectorAuthorizationLifecycle {
     const { claim } = claimOutcome;
     try {
       await this.mutations.executeCredentialMutation(claim.authorization, async (executing, signal) => {
-        const credentials = validateCredentials(await input.definition.adapter.authentication.exchangeCode(this.authorizationAdapterContext(input.definition.id, input.redirectUri, signal), { code: input.code, codeVerifier: input.codeVerifier }));
+        const credentials = validateCredentials(await input.definition.adapter.authentication.exchangeCode(this.authorizationAdapterContext(input.definition.id, input.redirectUri, signal), {
+          code: input.code,
+          ...input.codeVerifier === undefined ? {} : { codeVerifier: input.codeVerifier },
+          callbackParameters: input.callbackParameters
+        }));
         assertCredentialMutationOperationActive(signal);
         const envelope = await this.credentials.seal(input.definition.id, input.authorizationId, credentials);
         return this.mutations.stageCredentialMutationCredentials(executing, signal, {
@@ -1382,9 +1432,9 @@ class DefaultConnectorAuthorizationLifecycle {
     const staged = await this.requireAuthorization(input.definition.id, input.authorizationId);
     return this.mutations.finalizeStagedMutation(staged);
   }
-  async exchangeAuthorizationCode(definition, code, codeVerifier, redirectUri) {
+  async exchangeAuthorizationCode(definition, code, codeVerifier, redirectUri, callbackParameters) {
     try {
-      return validateCredentials(await this.mutations.withBoundedProviderSignal((signal) => definition.adapter.authentication.exchangeCode(this.authorizationAdapterContext(definition.id, redirectUri, signal), { code, codeVerifier })));
+      return validateCredentials(await this.mutations.withBoundedProviderSignal((signal) => definition.adapter.authentication.exchangeCode(this.authorizationAdapterContext(definition.id, redirectUri, signal), { code, ...codeVerifier === undefined ? {} : { codeVerifier }, callbackParameters })));
     } catch (error) {
       throw providerBoundaryError(error, "connector.provider_failed", "Connector authorization code exchange failed.");
     }
@@ -1413,7 +1463,7 @@ class DefaultConnectorAuthorizationLifecycle {
 }
 function assertConnectorAuthorizationActor(authorization, principal) {
   if (authorization.authorizedBy.type !== principal.type || authorization.authorizedBy.id !== principal.id) {
-    throw new AuthorizationError(`authorization:connector:${authorization.connectorId}`, "[Sixb] This connector authorization can only be changed by its authorizing principal.");
+    throw new AuthorizationError2(`authorization:connector:${authorization.connectorId}`, "[Sixb] This connector authorization can only be changed by its authorizing principal.");
   }
 }
 function assertReauthorizationRevision(authorization, expectedRevision) {
@@ -1427,18 +1477,18 @@ function requireConnectorConnectionCommandActor(execution, projectId) {
   const actor = connectorConnectionActorFromExecution(execution, projectId);
   if (actor)
     return actor;
-  throw new AuthorizationError("manage:connector", "[Sixb] Connector connection commands require an authenticated request execution.");
+  throw new AuthorizationError2("manage:connector", "[Sixb] Connector connection commands require an authenticated request execution.");
 }
 function assertConnectorAuthorizationAttemptInitiator(execution, current) {
   const initiating = execution ? connectorConnectionActorFromExecution(execution, execution.projectId) : null;
   if (!initiating || !sameConnectorConnectionCommandActor(initiating, current)) {
-    throw new ConnectorConnectionStorageError("attempt_invalid", "[Sixb] Connector authorization attempt is invalid, expired, or already used.");
+    throw new ConnectorConnectionStorageError2("attempt_invalid", "[Sixb] Connector authorization attempt is invalid, expired, or already used.");
   }
 }
 function assertConnectorConnectionRunInitiator(execution, current, connectorId) {
   const initiating = execution ? connectorConnectionActorFromExecution(execution, execution.projectId) : null;
   if (!initiating || !sameConnectorConnectionCommandActor(initiating, current)) {
-    throw new AuthorizationError(`connection-run:connector:${connectorId}`, "[Sixb] This connector connection run can only be accessed by its initiating actor.");
+    throw new AuthorizationError2(`connection-run:connector:${connectorId}`, "[Sixb] This connector connection run can only be accessed by its initiating actor.");
   }
 }
 function connectorConnectionActorFromExecution(execution, projectId) {
@@ -1503,7 +1553,7 @@ class ConnectorAuthorizationRequestHandler {
     const prepared = await this.prepareAuthorizationRequest(command, connectorId, input);
     try {
       await this.storage.transaction(async (tx) => {
-        await ensureExecutionRecord(tx.executions, command.execution);
+        await ensureExecutionRecord2(tx.executions, command.execution);
         await requireConnectorConnectionStorage(tx).createAuthorizationAttempt(prepared.attempt);
       }, { isolation: "serializable" });
     } catch (error) {
@@ -1518,12 +1568,13 @@ class ConnectorAuthorizationRequestHandler {
     const definition = this.resolveDefinition(nonblank(connectorId, "connector id"));
     const actor = requireConnectorConnectionCommandActor(command.execution, this.projectId);
     assertConnectorConnectionSelector(input);
+    validateCallbackParameterNames(definition.adapter.authentication.callbackParameters);
     const redirectUri = normalizedHttpUrl(input.redirectUri, "OAuth callback URL");
     const reauthorization = await this.prepareReauthorization(definition, actor, input.reauthorizationId);
     const attemptId = `cat_${randomUUID3()}`;
     const state = `${attemptId}.${randomBytes2(32).toString("base64url")}`;
-    const codeVerifier = randomBytes2(32).toString("base64url");
-    const codeChallenge = createHash2("sha256").update(codeVerifier).digest("base64url");
+    const codeVerifier = connectorPkceEnabled(definition.adapter.authentication.pkce) ? randomBytes2(32).toString("base64url") : undefined;
+    const codeChallenge = codeVerifier === undefined ? undefined : createHash2("sha256").update(codeVerifier).digest("base64url");
     let authorizationUrlInput;
     try {
       authorizationUrlInput = await runBoundedConnectorProviderOperation({
@@ -1534,13 +1585,16 @@ class ConnectorAuthorizationRequestHandler {
         connectorId: definition.id,
         redirectUri,
         signal
-      }, { state, codeChallenge, codeChallengeMethod: "S256" }), () => createConnectorCodedError("connector.provider_unavailable", "Connector authorization URL generation did not complete."));
+      }, {
+        state,
+        ...codeChallenge === undefined ? {} : { codeChallenge, codeChallengeMethod: "S256" }
+      }), () => createConnectorCodedError("connector.provider_unavailable", "Connector authorization URL generation did not complete."));
     } catch (error) {
       throw providerBoundaryError(error, providerFailureCode(error), "Connector authorization could not be started.");
     }
     const authorizationUrl = normalizedHttpUrl(authorizationUrlInput, "provider authorization URL", "connector.adapter_invalid");
     assertAuthorizationUrlParameters(authorizationUrl, { state, codeChallenge });
-    const codeVerifierEnvelope = await this.credentialProtector.seal(textEncoder2.encode(codeVerifier), {
+    const codeVerifierEnvelope = codeVerifier === undefined ? undefined : await this.credentialProtector.seal(textEncoder2.encode(codeVerifier), {
       projectId: this.projectId,
       connectorId: definition.id,
       recordId: attemptId,
@@ -1559,7 +1613,7 @@ class ConnectorAuthorizationRequestHandler {
         slot: input.slot,
         initiatedByExecutionId: command.execution.id,
         stateHash: hashSecret(state),
-        codeVerifier: codeVerifierEnvelope,
+        ...codeVerifierEnvelope === undefined ? {} : { codeVerifier: codeVerifierEnvelope },
         redirectUri,
         ...reauthorization === undefined ? {} : {
           reauthorizationId: reauthorization.authorization.id,
@@ -1583,7 +1637,8 @@ class ConnectorAuthorizationRequestHandler {
       attempt,
       principal: actor.principal,
       code,
-      redirectUri
+      redirectUri,
+      callbackParameters: input.callbackParameters
     });
     return {
       authorizationId: completed.id,
@@ -1593,7 +1648,11 @@ class ConnectorAuthorizationRequestHandler {
     };
   }
   async completeAuthorizationAttempt(input) {
-    const verifierBytes = await this.credentialProtector.open(input.attempt.codeVerifier, {
+    const enabled = connectorPkceEnabled(input.definition.adapter.authentication.pkce);
+    if (enabled !== (input.attempt.codeVerifier !== undefined)) {
+      throw createConnectorCodedError("connector.authorization_invalid", "OAuth connector PKCE configuration changed; restart authorization.");
+    }
+    const verifierBytes = input.attempt.codeVerifier === undefined ? undefined : await this.credentialProtector.open(input.attempt.codeVerifier, {
       projectId: this.projectId,
       connectorId: input.definition.id,
       recordId: input.attempt.id,
@@ -1601,7 +1660,8 @@ class ConnectorAuthorizationRequestHandler {
     });
     return this.completeGrant({
       ...input,
-      codeVerifier: textDecoder2.decode(verifierBytes)
+      callbackParameters: selectCallbackParameters(input.definition.adapter.authentication.callbackParameters, input.callbackParameters),
+      ...verifierBytes === undefined ? {} : { codeVerifier: textDecoder2.decode(verifierBytes) }
     });
   }
   async prepareReauthorization(definition, actor, reauthorizationId) {
@@ -1664,6 +1724,7 @@ class ConnectorAuthorizationRequestHandler {
         principal: input.principal,
         code: input.code,
         codeVerifier: input.codeVerifier,
+        callbackParameters: input.callbackParameters,
         redirectUri: input.redirectUri,
         ...input.onAuthorizationPersisted === undefined ? {} : { onAuthorizationPersisted: input.onAuthorizationPersisted }
       });
@@ -1680,6 +1741,7 @@ class ConnectorAuthorizationRequestHandler {
       principal: input.principal,
       code: input.code,
       codeVerifier: input.codeVerifier,
+      callbackParameters: input.callbackParameters,
       redirectUri: input.redirectUri
     });
   }
@@ -1722,7 +1784,7 @@ class ConnectorConnectionRunService {
     let run;
     try {
       run = await this.storage.transaction(async (tx) => {
-        await ensureExecutionRecord(tx.executions, command.execution);
+        await ensureExecutionRecord2(tx.executions, command.execution);
         return requireConnectorConnectionStorage2(tx).createConnectionSelectionRun({
           id: runId,
           projectId: this.projectId,
@@ -1748,7 +1810,7 @@ class ConnectorConnectionRunService {
     let expiresAt;
     try {
       expiresAt = await this.storage.transaction(async (tx) => {
-        await ensureExecutionRecord(tx.executions, command.execution);
+        await ensureExecutionRecord2(tx.executions, command.execution);
         const connections = requireConnectorConnectionStorage2(tx);
         await connections.createConnectionRun({
           id: runId,
@@ -1808,6 +1870,7 @@ class ConnectorConnectionRunService {
         attempt,
         principal,
         code: nonblank(input.code, "OAuth authorization code", "connector.authorization_invalid"),
+        callbackParameters: input.callbackParameters,
         redirectUri,
         onAuthorizationPersisted: async (persisted) => {
           authorizationId = persisted.id;
@@ -1977,8 +2040,8 @@ class ConnectorConnectionRunService {
       processingId: run.processingId,
       status: "failed",
       ...authorizationId === undefined ? {} : { authorizationId },
-      error: captureSixbFailure(error, {
-        allowedCodes: CONNECTOR_CONNECTION_RUN_FAILURE_CODES,
+      error: captureSixbFailure2(error, {
+        allowedCodes: CONNECTOR_CONNECTION_RUN_FAILURE_CODES2,
         defaultCode: "internal.unexpected",
         at: this.now()
       })
@@ -2090,7 +2153,7 @@ class ConnectorConnectionRunService {
       await this.authorizations.continuePendingRevocation(this.resolveDefinition(connectorId), authorizationId);
       return true;
     } catch (error) {
-      if (isSixbError(error) && error.code === "connector.revocation_pending")
+      if (isSixbError2(error) && error.code === "connector.revocation_pending")
         return false;
       throw error;
     }
@@ -2445,7 +2508,7 @@ class ConnectorConnectionService {
     if (!definition) {
       throw createConnectorCodedError("connector.not_found", `Unknown connector '${connectorId}'.`);
     }
-    if (!isOAuthConnectorDefinition(definition)) {
+    if (!isOAuthConnectorDefinition2(definition)) {
       throw createConnectorCodedError("connector.configuration_invalid", `Connector '${connectorId}' does not use OAuth authentication.`);
     }
     return definition;
@@ -2460,7 +2523,7 @@ class ConnectorConnectionService {
     try {
       await this.authorizations.continuePendingRevocation(definition, authorizationId);
     } catch (error) {
-      if (isSixbError(error) && error.code === "connector.revocation_pending")
+      if (isSixbError2(error) && error.code === "connector.revocation_pending")
         return;
       throw error;
     }
@@ -2502,7 +2565,7 @@ class ConnectorService {
   constructor(projectId, definitions, options = {}) {
     this.projectId = projectId;
     this.definitionsById = new Map(definitions.map((definition) => [definition.id, definition]));
-    if (definitions.some(isOAuthConnectorDefinition)) {
+    if (definitions.some(isOAuthConnectorDefinition2)) {
       this.connections = new ConnectorConnectionService(projectId, definitions, options);
     }
   }
@@ -2551,9 +2614,9 @@ class ConnectorService {
   assertRegistered(definition) {
     const registeredDefinition = this.definitionsById.get(definition.id);
     if (!registeredDefinition)
-      throw new ConnectorNotFoundError(definition.id);
+      throw new ConnectorNotFoundError2(definition.id);
     if (registeredDefinition !== definition) {
-      throw new ConnectorError(`Connector '${definition.id}' is not the registered definition instance.`);
+      throw new ConnectorError2(`Connector '${definition.id}' is not the registered definition instance.`);
     }
   }
   requireConnections() {
@@ -2826,7 +2889,7 @@ function validateKeyedDatasetWriterTopology(input) {
   for (const sync of input.syncs) {
     const dataset = input.datasetsById.get(sync.target.dataset.id);
     if (sync.config.mode === "merge" && dataset?.primaryKey === undefined) {
-      throw new SyncValidationError(`[Sixb] Merge sync '${sync.id}' targets dataset '${sync.target.dataset.id}', which must define a primaryKey.`);
+      throw new SyncValidationError2(`[Sixb] Merge sync '${sync.id}' targets dataset '${sync.target.dataset.id}', which must define a primaryKey.`);
     }
   }
   const firstWriterByDataset = new Map;
@@ -2839,7 +2902,7 @@ function validateKeyedDatasetWriterTopology(input) {
       firstWriterByDataset.set(writer.datasetId, writer);
       continue;
     }
-    throw new SyncValidationError(`[Sixb] Keyed dataset '${writer.datasetId}' has multiple registered writers: ${first.label} and ${writer.label}. V1 allows one writer per keyed dataset.`);
+    throw new SyncValidationError2(`[Sixb] Keyed dataset '${writer.datasetId}' has multiple registered writers: ${first.label} and ${writer.label}. V1 allows one writer per keyed dataset.`);
   }
 }
 function validateMergeSyncProjectionSafety(input) {
@@ -2848,7 +2911,7 @@ function validateMergeSyncProjectionSafety(input) {
     const sync = mergeSyncByDataset.get(projection.datasetId);
     if (!sync)
       continue;
-    throw new SyncValidationError(`[Sixb] Telemetry projection '${projection.id}' cannot read merge-written dataset '${projection.datasetId}' from sync '${sync.id}'. V1 merge syncs support object and link replacement projections only.`);
+    throw new SyncValidationError2(`[Sixb] Telemetry projection '${projection.id}' cannot read merge-written dataset '${projection.datasetId}' from sync '${sync.id}'. V1 merge syncs support object and link replacement projections only.`);
   }
 }
 function* datasetWriters(syncs, pipelines) {
@@ -2876,20 +2939,20 @@ function createDefinitionCatalog(definitionsById) {
 // src/runtime/resolve-definitions.ts
 function resolveDefinitions(options) {
   assertNoAgentDefinitions(options);
-  const ontology = new OntologyRegistry({ sources: options.ontology });
-  const actionRegistry = new ActionRegistry({ actions: options.actions ?? [], ontology });
+  const ontology = new OntologyRegistry2({ sources: options.ontology });
+  const actionRegistry = new ActionRegistry2({ actions: options.actions ?? [], ontology });
   const registeredActionIds = new Set(actionRegistry.list().map((action) => action.id));
   const sharesById = validateSharesAtStartup({
     shares: options.shares ?? [],
     ontology,
     actions: actionRegistry
   });
-  const models = options.models === undefined ? undefined : createModelCatalog(options.models);
+  const models = options.models === undefined ? undefined : createModelCatalog2(options.models);
   const tools = createAgentToolCatalog(options.tools);
   const connectorsById = indexUniqueDefinitions("connector", options.connectors ?? []);
   const datasetsById = new Map;
   for (const dataset of options.datasets ?? []) {
-    assertDatasetDefinition(dataset, (message) => new RuntimeError(message));
+    assertDatasetDefinition2(dataset, (message) => new RuntimeError2(message));
     assertUniqueDefinitionId("dataset", dataset.id, datasetsById);
     datasetsById.set(dataset.id, dataset);
   }
@@ -2898,7 +2961,7 @@ function resolveDefinitions(options) {
   for (const sync of options.syncs ?? []) {
     assertUniqueDefinitionId("sync", sync.id, syncsById);
     if (!datasetsById.has(sync.target.dataset.id)) {
-      throw new RuntimeError(`Sync '${sync.id}' targets unknown dataset '${sync.target.dataset.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+      throw new RuntimeError2(`Sync '${sync.id}' targets unknown dataset '${sync.target.dataset.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
     }
     syncsById.set(sync.id, sync);
   }
@@ -2915,7 +2978,7 @@ function resolveDefinitions(options) {
   const rules = options.rules ?? [];
   validateRulesAtStartup(rules, ontology);
   const rulesById = indexUniqueDefinitions("rule", rules);
-  validateSchedulesAtStartup(schedules, ontology, {
+  validateSchedulesAtStartup2(schedules, ontology, {
     registeredRuleIds: new Set(rulesById.keys()),
     registeredActionIds,
     registeredDatasetIds: new Set(datasetsById.keys()),
@@ -2928,7 +2991,7 @@ function resolveDefinitions(options) {
   for (const pipeline of pipelines) {
     validateScheduleReferences("Pipeline", pipeline.id, pipeline.triggers, schedulesById);
   }
-  const workflows = validateWorkflowsAtStartup({
+  const workflows = validateWorkflowsAtStartup2({
     workflows: options.workflows ?? [],
     registeredSchedules: schedulesById,
     registeredActionIds,
@@ -2951,8 +3014,8 @@ function resolveDefinitions(options) {
     shareIds: new Set(sharesById.keys()),
     getSubTypes: (objectTypeId) => ontology.listSubTypes(objectTypeId)
   });
-  validateWorkflowAgentStepGroupReferences(workflows, security);
-  const projectionRegistry = new ProjectionRegistry({
+  validateWorkflowAgentStepGroupReferences2(workflows, security);
+  const projectionRegistry = new ProjectionRegistry2({
     projections: options.projections ?? [],
     ontology,
     datasetsById
@@ -2988,34 +3051,34 @@ function indexUniqueDefinitions(kind, definitions) {
 }
 function assertUniqueDefinitionId(kind, id, definitionsById) {
   if (definitionsById.has(id)) {
-    throw new RuntimeError(`Duplicate ${kind} id: ${id}`);
+    throw new RuntimeError2(`Duplicate ${kind} id: ${id}`);
   }
 }
 function validatePipelineDatasets(pipeline, datasetsById) {
   if (pipeline.graph.nodes.length === 0) {
-    throw new RuntimeError(`Pipeline '${pipeline.id}' must contain at least one step.`);
+    throw new RuntimeError2(`Pipeline '${pipeline.id}' must contain at least one step.`);
   }
   const stepIds = new Set;
   for (const node of pipeline.graph.nodes) {
     const { step } = node;
     if (stepIds.has(step.id)) {
-      throw new RuntimeError(`Pipeline '${pipeline.id}' contains duplicate step id '${step.id}'.`);
+      throw new RuntimeError2(`Pipeline '${pipeline.id}' contains duplicate step id '${step.id}'.`);
     }
     stepIds.add(step.id);
     for (const [inputName, dataset] of Object.entries(step.inputs)) {
       if (!datasetsById.has(dataset.id)) {
-        throw new RuntimeError(`Pipeline '${pipeline.id}' step '${step.id}' input '${inputName}' references unknown dataset '${dataset.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+        throw new RuntimeError2(`Pipeline '${pipeline.id}' step '${step.id}' input '${inputName}' references unknown dataset '${dataset.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
       }
     }
     if (!datasetsById.has(step.output.id)) {
-      throw new RuntimeError(`Pipeline '${pipeline.id}' step '${step.id}' outputs unknown dataset '${step.output.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+      throw new RuntimeError2(`Pipeline '${pipeline.id}' step '${step.id}' outputs unknown dataset '${step.output.id}'. Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
     }
   }
 }
 function validateScheduleReferences(consumerKind, consumerId, references, schedulesById) {
   for (const reference of references) {
     if (!schedulesById.has(reference.scheduleId)) {
-      throw new RuntimeError(`${consumerKind} '${consumerId}' references unknown schedule '${reference.scheduleId}'. Add it to 'schedules' in createSixb() or export it from 'schedules/'.`);
+      throw new RuntimeError2(`${consumerKind} '${consumerId}' references unknown schedule '${reference.scheduleId}'. Add it to 'schedules' in createSixb() or export it from 'schedules/'.`);
     }
   }
 }
@@ -3032,7 +3095,7 @@ class StorageReadiness {
     this.storage = storage;
     this.schemaRetryDelayMs = positiveInteger2(options.schemaRetryDelayMs ?? DEFAULT_SCHEMA_RETRY_DELAY_MS, "schemaRetryDelayMs");
     this.now = options.now ?? (() => new Date);
-    this.schema = isMigrationCapableStorage(storage) ? { status: "unchecked" } : { status: "valid" };
+    this.schema = isMigrationCapableStorage2(storage) ? { status: "unchecked" } : { status: "valid" };
   }
   startSchemaValidation() {
     if (this.schema.status === "checking" || this.schema.status === "valid")
@@ -3063,7 +3126,7 @@ class StorageReadiness {
     };
   }
   async validateSchema() {
-    const result = await checkStorageSchema(this.storage);
+    const result = await checkStorageSchema2(this.storage);
     this.schema = result.ok ? { status: "valid" } : this.invalidSchema(result.reason ?? "Storage schema is not usable.");
   }
   invalidSchema(reason) {
@@ -3082,7 +3145,7 @@ function positiveInteger2(value, name) {
 }
 
 // src/runtime/host.ts
-class SixbHost {
+class SixbHost2 {
   projectId;
   webhookRegistry;
   hostContext;
@@ -3105,16 +3168,16 @@ class SixbHost {
   scheduler;
   auth;
   constructor(options) {
-    const errorReporter = attachSixbErrorReporter(this, options.onError);
+    const errorReporter = attachSixbErrorReporter2(this, options.onError);
     this.projectId = options.id ?? "default";
     this.broker = options.broker;
-    this.eventService = createDomainEventService({
+    this.eventService = createDomainEventService2({
       projectId: this.projectId,
       broker: this.broker,
       errorReporter
     });
     this.events = this.eventService;
-    this.logging = new LoggingService({
+    this.logging = new LoggingService2({
       projectId: this.projectId,
       broker: this.broker,
       logger: options.logger,
@@ -3129,8 +3192,8 @@ class SixbHost {
     this.projectRoot = resolve(options.projectRoot ?? process.cwd());
     const definitions = resolveDefinitions(options);
     this.definitions = definitions;
-    registerProjectionRegistry(this, definitions.projections);
-    this.auth = new AuthRuntime({
+    registerProjectionRegistry2(this, definitions.projections);
+    this.auth = new AuthRuntime2({
       projectId: this.projectId,
       storage: this.storage,
       security: definitions.security,
@@ -3138,8 +3201,7 @@ class SixbHost {
     });
     validateAuthStrategySecurityReferences(this.auth.getStrategy(), definitions.security);
     const connectors = definitions.connectors.list();
-    assertConnectorConnectionSurfaces(connectors);
-    const hasOAuthConnectors = connectors.some(isOAuthConnectorDefinition);
+    const hasOAuthConnectors = connectors.some(isOAuthConnectorDefinition2);
     const credentialProtector = hasOAuthConnectors && options.connectorConnections?.encryptionKey !== undefined ? createConnectorCredentialProtectorFromKey(options.connectorConnections.encryptionKey) : undefined;
     this.connectorService = new ConnectorService(this.projectId, connectors, {
       storage: this.storage,
@@ -3150,17 +3212,17 @@ class SixbHost {
     }
     assertWebhookRunStorage(connectors, this.storage);
     this.webhookRegistry = new WebhookRegistry({ connectors });
-    this.materializer = createOntologyMaterializer({
+    this.materializer = createOntologyMaterializer2({
       projectId: this.projectId,
       ontology: definitions.ontology,
       projections: definitions.projections,
       storage: this.storage
     });
-    this.committedFacts = new OntologyOutboxDispatcher({
+    this.committedFacts = new OntologyOutboxDispatcher2({
       projectId: this.projectId,
       storage: this.storage,
       events: this.eventService,
-      onDeliveryFailure: (error, failure) => reportEventDeliveryFailure(errorReporter, error, {
+      onDeliveryFailure: (error, failure) => reportEventDeliveryFailure3(errorReporter, error, {
         projectId: this.projectId,
         ...failure
       })
@@ -3180,9 +3242,9 @@ class SixbHost {
       storage: this.storage,
       queues: this.queues
     };
-    registerProjectionRegistry(this.hostContext, definitions.projections);
-    shareSixbErrorReporter(this, this.hostContext);
-    this.scheduler = new SchedulerRuntime({
+    registerProjectionRegistry2(this.hostContext, definitions.projections);
+    shareSixbErrorReporter2(this, this.hostContext);
+    this.scheduler = new SchedulerRuntime2({
       schedules: definitions.schedules.list(),
       events: this.eventService
     });
@@ -3204,7 +3266,7 @@ class SixbHost {
       objectReader,
       ...authorization.type === "principal" ? { authorization: authorization.context } : {}
     };
-    registerOntologyMutationRuntime(runtime, createOntologyMutationRuntime({
+    registerOntologyMutationRuntime2(runtime, createOntologyMutationRuntime2({
       materializer: this.materializer.withScope(capturedScope),
       notifyCommittedFacts: () => this.committedFacts.notify()
     }));
@@ -3255,12 +3317,12 @@ class SixbHost {
   }
 }
 function validateAuthStrategySecurityReferences(strategy, security) {
-  if (!isMagicLinkAuthStrategy(strategy) && !isOidcAuthStrategy(strategy)) {
+  if (!isMagicLinkAuthStrategy2(strategy) && !isOidcAuthStrategy2(strategy)) {
     return;
   }
   for (const groupId of strategy.bootstrapGroupIds ?? []) {
     if (!security.getGroupById(groupId)) {
-      throw new AuthRuntimeError("invalid_auth_config", `[Sixb] Auth bootstrapGroups references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
+      throw new AuthRuntimeError2("invalid_auth_config", `[Sixb] Auth bootstrapGroups references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`);
     }
   }
 }
@@ -3271,31 +3333,22 @@ function assertWebhookRunStorage(connectors, storage) {
   for (const connector of connectors) {
     const webhooks = connector.adapter.webhooks;
     if (Array.isArray(webhooks) && webhooks.length > 0) {
-      throw new WebhookValidationError("[Sixb] Webhooks require storage.webhookRuns to be configured.");
-    }
-  }
-}
-function assertConnectorConnectionSurfaces(connectors) {
-  for (const connector of connectors) {
-    if (!isOAuthConnectorDefinition(connector))
-      continue;
-    if (connector.adapter.webhooks !== undefined) {
-      throw createConnectorCodedError("connector.configuration_invalid", `OAuth connector '${connector.id}' cannot register webhooks until connection routing is defined.`);
+      throw new WebhookValidationError2("[Sixb] Webhooks require storage.webhookRuns to be configured.");
     }
   }
 }
 
 // src/runtime/create.ts
-async function createSixb(options) {
+async function createSixb2(options) {
   assertNoAgentDefinitions(options);
   const projectRoot = resolve2(options.projectRoot ?? process.cwd());
-  const discoveredOntology = await discoverOntologySources(projectRoot);
+  const discoveredOntology = await discoverOntologySources2(projectRoot);
   const allSources = [...options.ontologies ?? [], ...discoveredOntology];
   if (allSources.length === 0) {
-    throw new RuntimeError("No ontology found. Create an 'ontology/' folder or pass 'ontologies' to createSixb().");
+    throw new RuntimeError2("No ontology found. Create an 'ontology/' folder or pass 'ontologies' to createSixb().");
   }
-  const definitions = await discoverProjectDefinitions(projectRoot);
-  return new SixbHost({
+  const definitions = await discoverProjectDefinitions2(projectRoot);
+  return new SixbHost2({
     id: options.id,
     ontology: allSources,
     broker: options.broker,
@@ -3328,6 +3381,6 @@ async function createSixb(options) {
     auth: options.auth
   });
 }
-export { WebhookValidationError, defineWebhook, webhookConnector, UnverifiedWebhookError, resolveWebhookVerification, warnUnverifiedWebhook, SixbHost, createSixb };
+export { WebhookValidationError2, defineWebhook2, webhookConnector2, UnverifiedWebhookError2, resolveWebhookVerification2, warnUnverifiedWebhook2, SixbHost2, createSixb2 };
 
-//# debugId=34CB5AA96E2012A064756E2164756E21
+//# debugId=4CB6C5C3405BADC164756E2164756E21