@opengeni/db 5.0.1 → 6.0.0

package/dist/chunk-PJI4MUZ7.js

@@ -0,0 +1,131 @@
+import {
+  lockSessionEventWriteRows
+} from "./chunk-GABXCG3N.js";
+import {
+  withSessionActivityRlsContext
+} from "./chunk-CJI6G254.js";
+import {
+  sandboxRetainedProcesses,
+  sessionBackgroundCommands,
+  sessionEvents,
+  sessions
+} from "./chunk-MN5PZMEK.js";
+import {
+  fromPostgresLosslessJson,
+  withLosslessContentWriteVersion
+} from "./chunk-S2TZ3F4L.js";
+
+// src/session-command-output.ts
+import { and, eq } from "drizzle-orm";
+async function appendSessionCommandOutput(db, input) {
+  if (!input.chunkId || input.chunkId.length > 200)
+    throw new Error("Invalid command output chunk ID");
+  if (!input.chunk) return [];
+  return await withSessionActivityRlsContext(db, input, async (tx) => {
+    const events = [];
+    const locks = await lockSessionEventWriteRows(tx, {
+      workspaceId: input.workspaceId,
+      controlLock: "share",
+      sessionIds: [input.sessionId]
+    });
+    const session = locks.sessions[0];
+    if (!session || session.accountId !== input.accountId)
+      throw new Error("Command output session not found");
+    const [command] = await tx.select({ id: sessionBackgroundCommands.id }).from(sessionBackgroundCommands).where(
+      and(
+        eq(sessionBackgroundCommands.accountId, input.accountId),
+        eq(sessionBackgroundCommands.workspaceId, input.workspaceId),
+        eq(sessionBackgroundCommands.sessionId, input.sessionId),
+        eq(sessionBackgroundCommands.id, input.commandId)
+      )
+    ).limit(1);
+    if (!command) {
+      const [process] = await tx.select({ id: sandboxRetainedProcesses.id }).from(sandboxRetainedProcesses).where(
+        and(
+          eq(sandboxRetainedProcesses.accountId, input.accountId),
+          eq(sandboxRetainedProcesses.workspaceId, input.workspaceId),
+          eq(sandboxRetainedProcesses.sessionId, input.sessionId),
+          eq(sandboxRetainedProcesses.id, input.commandId)
+        )
+      ).limit(1);
+      if (!process) throw new Error("Command output has no retained command identity");
+    }
+    let sequence = session.lastSequence;
+    let part = 0;
+    for (let offset = 0; offset < input.chunk.length; ) {
+      let end = Math.min(offset + 16384, input.chunk.length);
+      if (end < input.chunk.length && /[\uD800-\uDBFF]/u.test(input.chunk[end - 1])) end -= 1;
+      const clientEventId = `command-output:${input.commandId}:${input.chunkId}:${input.stream}:${part++}`;
+      const chunk = input.chunk.slice(offset, end);
+      offset = end;
+      const [existing] = await tx.select({
+        payload: sessionEvents.payload,
+        version: sessionEvents.payloadCodecVersion
+      }).from(sessionEvents).where(
+        and(
+          eq(sessionEvents.workspaceId, input.workspaceId),
+          eq(sessionEvents.sessionId, input.sessionId),
+          eq(sessionEvents.clientEventId, clientEventId)
+        )
+      ).limit(1);
+      if (existing) {
+        const payload = fromPostgresLosslessJson(existing.payload, existing.version);
+        if (payload.chunk !== chunk || payload.commandId !== input.commandId || payload.stream !== input.stream) {
+          throw new Error("Command output retry changed the captured chunk");
+        }
+        continue;
+      }
+      const [inserted] = await tx.insert(sessionEvents).values(
+        withLosslessContentWriteVersion(
+          {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            sessionId: input.sessionId,
+            sequence: ++sequence,
+            type: "sandbox.command.output.delta",
+            clientEventId,
+            payload: {
+              commandId: input.commandId,
+              stream: input.stream,
+              streamFidelity: input.streamFidelity ?? "separate",
+              chunk
+            }
+          },
+          "payload",
+          "payloadCodecVersion"
+        )
+      ).returning();
+      if (inserted)
+        events.push({
+          id: inserted.id,
+          workspaceId: input.workspaceId,
+          sessionId: input.sessionId,
+          sequence: inserted.sequence,
+          type: "sandbox.command.output.delta",
+          payload: fromPostgresLosslessJson(inserted.payload, inserted.payloadCodecVersion),
+          occurredAt: inserted.occurredAt.toISOString(),
+          clientEventId,
+          turnId: null,
+          turnGeneration: null,
+          turnAttemptId: null,
+          turnAssociation: null,
+          duplicateOfEventId: null,
+          duplicateReason: null
+        });
+    }
+    if (sequence !== session.lastSequence) {
+      await tx.update(sessions).set({ lastSequence: sequence }).where(
+        and(
+          eq(sessions.workspaceId, input.workspaceId),
+          eq(sessions.id, input.sessionId)
+        )
+      );
+    }
+    return events;
+  });
+}
+
+export {
+  appendSessionCommandOutput
+};
+//# sourceMappingURL=chunk-PJI4MUZ7.js.map

package/dist/chunk-PJI4MUZ7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/session-command-output.ts"],"sourcesContent":["import { and, eq } from \"drizzle-orm\";\nimport type { SessionEvent } from \"@opengeni/contracts\";\nimport type { Database } from \"./database\";\nimport { withSessionActivityRlsContext } from \"./database\";\nimport { lockSessionEventWriteRows } from \"./session-control\";\nimport { fromPostgresLosslessJson, withLosslessContentWriteVersion } from \"./lossless-json\";\nimport * as schema from \"./schema\";\n\nexport type SessionCommandOutputInput = {\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  commandId: string;\n  /** Stable identity of this consumed provider chunk, reused on persistence retry. */\n  chunkId: string;\n  stream: \"stdout\" | \"stderr\";\n  streamFidelity?: \"separate\" | \"merged\";\n  chunk: string;\n};\n\n/** Capture is independent of terminal observation and remains valid after the\n * launching attempt ends. Only an exact retained process/background command in\n * this session is eligible; this helper never creates command authority. */\nexport async function appendSessionCommandOutput(\n  db: Database,\n  input: SessionCommandOutputInput,\n): Promise<SessionEvent[]> {\n  if (!input.chunkId || input.chunkId.length > 200)\n    throw new Error(\"Invalid command output chunk ID\");\n  if (!input.chunk) return [];\n  return await withSessionActivityRlsContext(db, input, async (tx) => {\n    const events: SessionEvent[] = [];\n    const locks = await lockSessionEventWriteRows(tx, {\n      workspaceId: input.workspaceId,\n      controlLock: \"share\",\n      sessionIds: [input.sessionId],\n    });\n    const session = locks.sessions[0];\n    if (!session || session.accountId !== input.accountId)\n      throw new Error(\"Command output session not found\");\n    const [command] = await tx\n      .select({ id: schema.sessionBackgroundCommands.id })\n      .from(schema.sessionBackgroundCommands)\n      .where(\n        and(\n          eq(schema.sessionBackgroundCommands.accountId, input.accountId),\n          eq(schema.sessionBackgroundCommands.workspaceId, input.workspaceId),\n          eq(schema.sessionBackgroundCommands.sessionId, input.sessionId),\n          eq(schema.sessionBackgroundCommands.id, input.commandId),\n        ),\n      )\n      .limit(1);\n    if (!command) {\n      const [process] = await tx\n        .select({ id: schema.sandboxRetainedProcesses.id })\n        .from(schema.sandboxRetainedProcesses)\n        .where(\n          and(\n            eq(schema.sandboxRetainedProcesses.accountId, input.accountId),\n            eq(schema.sandboxRetainedProcesses.workspaceId, input.workspaceId),\n            eq(schema.sandboxRetainedProcesses.sessionId, input.sessionId),\n            eq(schema.sandboxRetainedProcesses.id, input.commandId),\n          ),\n        )\n        .limit(1);\n      if (!process) throw new Error(\"Command output has no retained command identity\");\n    }\n    let sequence = session.lastSequence;\n    let part = 0;\n    for (let offset = 0; offset < input.chunk.length;) {\n      let end = Math.min(offset + 16_384, input.chunk.length);\n      if (end < input.chunk.length && /[\\uD800-\\uDBFF]/u.test(input.chunk[end - 1]!)) end -= 1;\n      const clientEventId = `command-output:${input.commandId}:${input.chunkId}:${input.stream}:${part++}`;\n      const chunk = input.chunk.slice(offset, end);\n      offset = end;\n      const [existing] = await tx\n        .select({\n          payload: schema.sessionEvents.payload,\n          version: schema.sessionEvents.payloadCodecVersion,\n        })\n        .from(schema.sessionEvents)\n        .where(\n          and(\n            eq(schema.sessionEvents.workspaceId, input.workspaceId),\n            eq(schema.sessionEvents.sessionId, input.sessionId),\n            eq(schema.sessionEvents.clientEventId, clientEventId),\n          ),\n        )\n        .limit(1);\n      if (existing) {\n        const payload = fromPostgresLosslessJson(existing.payload, existing.version) as Record<\n          string,\n          unknown\n        >;\n        if (\n          payload.chunk !== chunk ||\n          payload.commandId !== input.commandId ||\n          payload.stream !== input.stream\n        ) {\n          throw new Error(\"Command output retry changed the captured chunk\");\n        }\n        continue;\n      }\n      const [inserted] = await tx\n        .insert(schema.sessionEvents)\n        .values(\n          withLosslessContentWriteVersion(\n            {\n              accountId: input.accountId,\n              workspaceId: input.workspaceId,\n              sessionId: input.sessionId,\n              sequence: ++sequence,\n              type: \"sandbox.command.output.delta\",\n              clientEventId,\n              payload: {\n                commandId: input.commandId,\n                stream: input.stream,\n                streamFidelity: input.streamFidelity ?? \"separate\",\n                chunk,\n              },\n            },\n            \"payload\",\n            \"payloadCodecVersion\",\n          ),\n        )\n        .returning();\n      if (inserted)\n        events.push({\n          id: inserted.id,\n          workspaceId: input.workspaceId,\n          sessionId: input.sessionId,\n          sequence: inserted.sequence,\n          type: \"sandbox.command.output.delta\",\n          payload: fromPostgresLosslessJson(inserted.payload, inserted.payloadCodecVersion),\n          occurredAt: inserted.occurredAt.toISOString(),\n          clientEventId,\n          turnId: null,\n          turnGeneration: null,\n          turnAttemptId: null,\n          turnAssociation: null,\n          duplicateOfEventId: null,\n          duplicateReason: null,\n        });\n    }\n    if (sequence !== session.lastSequence) {\n      await tx\n        .update(schema.sessions)\n        .set({ lastSequence: sequence })\n        .where(\n          and(\n            eq(schema.sessions.workspaceId, input.workspaceId),\n            eq(schema.sessions.id, input.sessionId),\n          ),\n        );\n    }\n    return events;\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAS,KAAK,UAAU;AAuBxB,eAAsB,2BACpB,IACA,OACyB;AACzB,MAAI,CAAC,MAAM,WAAW,MAAM,QAAQ,SAAS;AAC3C,UAAM,IAAI,MAAM,iCAAiC;AACnD,MAAI,CAAC,MAAM,MAAO,QAAO,CAAC;AAC1B,SAAO,MAAM,8BAA8B,IAAI,OAAO,OAAO,OAAO;AAClE,UAAM,SAAyB,CAAC;AAChC,UAAM,QAAQ,MAAM,0BAA0B,IAAI;AAAA,MAChD,aAAa,MAAM;AAAA,MACnB,aAAa;AAAA,MACb,YAAY,CAAC,MAAM,SAAS;AAAA,IAC9B,CAAC;AACD,UAAM,UAAU,MAAM,SAAS,CAAC;AAChC,QAAI,CAAC,WAAW,QAAQ,cAAc,MAAM;AAC1C,YAAM,IAAI,MAAM,kCAAkC;AACpD,UAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAO,EAAE,IAAW,0BAA0B,GAAG,CAAC,EAClD,KAAY,yBAAyB,EACrC;AAAA,MACC;AAAA,QACE,GAAU,0BAA0B,WAAW,MAAM,SAAS;AAAA,QAC9D,GAAU,0BAA0B,aAAa,MAAM,WAAW;AAAA,QAClE,GAAU,0BAA0B,WAAW,MAAM,SAAS;AAAA,QAC9D,GAAU,0BAA0B,IAAI,MAAM,SAAS;AAAA,MACzD;AAAA,IACF,EACC,MAAM,CAAC;AACV,QAAI,CAAC,SAAS;AACZ,YAAM,CAAC,OAAO,IAAI,MAAM,GACrB,OAAO,EAAE,IAAW,yBAAyB,GAAG,CAAC,EACjD,KAAY,wBAAwB,EACpC;AAAA,QACC;AAAA,UACE,GAAU,yBAAyB,WAAW,MAAM,SAAS;AAAA,UAC7D,GAAU,yBAAyB,aAAa,MAAM,WAAW;AAAA,UACjE,GAAU,yBAAyB,WAAW,MAAM,SAAS;AAAA,UAC7D,GAAU,yBAAyB,IAAI,MAAM,SAAS;AAAA,QACxD;AAAA,MACF,EACC,MAAM,CAAC;AACV,UAAI,CAAC,QAAS,OAAM,IAAI,MAAM,iDAAiD;AAAA,IACjF;AACA,QAAI,WAAW,QAAQ;AACvB,QAAI,OAAO;AACX,aAAS,SAAS,GAAG,SAAS,MAAM,MAAM,UAAS;AACjD,UAAI,MAAM,KAAK,IAAI,SAAS,OAAQ,MAAM,MAAM,MAAM;AACtD,UAAI,MAAM,MAAM,MAAM,UAAU,mBAAmB,KAAK,MAAM,MAAM,MAAM,CAAC,CAAE,EAAG,QAAO;AACvF,YAAM,gBAAgB,kBAAkB,MAAM,SAAS,IAAI,MAAM,OAAO,IAAI,MAAM,MAAM,IAAI,MAAM;AAClG,YAAM,QAAQ,MAAM,MAAM,MAAM,QAAQ,GAAG;AAC3C,eAAS;AACT,YAAM,CAAC,QAAQ,IAAI,MAAM,GACtB,OAAO;AAAA,QACN,SAAgB,cAAc;AAAA,QAC9B,SAAgB,cAAc;AAAA,MAChC,CAAC,EACA,KAAY,aAAa,EACzB;AAAA,QACC;AAAA,UACE,GAAU,cAAc,aAAa,MAAM,WAAW;AAAA,UACtD,GAAU,cAAc,WAAW,MAAM,SAAS;AAAA,UAClD,GAAU,cAAc,eAAe,aAAa;AAAA,QACtD;AAAA,MACF,EACC,MAAM,CAAC;AACV,UAAI,UAAU;AACZ,cAAM,UAAU,yBAAyB,SAAS,SAAS,SAAS,OAAO;AAI3E,YACE,QAAQ,UAAU,SAClB,QAAQ,cAAc,MAAM,aAC5B,QAAQ,WAAW,MAAM,QACzB;AACA,gBAAM,IAAI,MAAM,iDAAiD;AAAA,QACnE;AACA;AAAA,MACF;AACA,YAAM,CAAC,QAAQ,IAAI,MAAM,GACtB,OAAc,aAAa,EAC3B;AAAA,QACC;AAAA,UACE;AAAA,YACE,WAAW,MAAM;AAAA,YACjB,aAAa,MAAM;AAAA,YACnB,WAAW,MAAM;AAAA,YACjB,UAAU,EAAE;AAAA,YACZ,MAAM;AAAA,YACN;AAAA,YACA,SAAS;AAAA,cACP,WAAW,MAAM;AAAA,cACjB,QAAQ,MAAM;AAAA,cACd,gBAAgB,MAAM,kBAAkB;AAAA,cACxC;AAAA,YACF;AAAA,UACF;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF,EACC,UAAU;AACb,UAAI;AACF,eAAO,KAAK;AAAA,UACV,IAAI,SAAS;AAAA,UACb,aAAa,MAAM;AAAA,UACnB,WAAW,MAAM;AAAA,UACjB,UAAU,SAAS;AAAA,UACnB,MAAM;AAAA,UACN,SAAS,yBAAyB,SAAS,SAAS,SAAS,mBAAmB;AAAA,UAChF,YAAY,SAAS,WAAW,YAAY;AAAA,UAC5C;AAAA,UACA,QAAQ;AAAA,UACR,gBAAgB;AAAA,UAChB,eAAe;AAAA,UACf,iBAAiB;AAAA,UACjB,oBAAoB;AAAA,UACpB,iBAAiB;AAAA,QACnB,CAAC;AAAA,IACL;AACA,QAAI,aAAa,QAAQ,cAAc;AACrC,YAAM,GACH,OAAc,QAAQ,EACtB,IAAI,EAAE,cAAc,SAAS,CAAC,EAC9B;AAAA,QACC;AAAA,UACE,GAAU,SAAS,aAAa,MAAM,WAAW;AAAA,UACjD,GAAU,SAAS,IAAI,MAAM,SAAS;AAAA,QACxC;AAAA,MACF;AAAA,IACJ;AACA,WAAO;AAAA,EACT,CAAC;AACH;","names":[]}

package/dist/{chunk-T6BWIGWJ.js → chunk-RIYHP2WU.js}

@@ -5,7 +5,7 @@ import {
   withWorkspaceRls,
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls
-} from "./chunk-DPONPYJD.js";
+} from "./chunk-CJI6G254.js";
 
 // src/session-tenancy.ts
 import { createHash } from "crypto";
@@ -502,4 +502,4 @@ export {
   forkSessionContent,
   replayAppliedSessionFork
 };
-//# sourceMappingURL=chunk-T6BWIGWJ.js.map
+//# sourceMappingURL=chunk-RIYHP2WU.js.map

package/dist/{chunk-7HMK3B45.js → chunk-RL2MUXM3.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-DPONPYJD.js";
+} from "./chunk-CJI6G254.js";
 
 // src/canonical-human-identities.ts
 import { createHash } from "crypto";
@@ -159,6 +159,7 @@ async function synchronizeCanonicalHumanLoginBindings(db, authUserId) {
       const existing = projection.loginBindings.find(
         (binding) => binding.providerId === account.providerId && binding.providerAccountId === account.providerAccountId
       );
+      if (existing && existing.status !== "active") break;
       if (existing?.status === "active") {
         authority = {
           identityId: projection.activeIdentity.id,
@@ -244,16 +245,24 @@ async function getCanonicalHumanIdentityProjection(db, authUserId) {
 }
 async function applyCanonicalHumanIdentityOperation(db, input) {
   try {
-    if (input.actorFence) {
+    if (input.actorFence || input.verifiedRecovery) {
       return await db.transaction(async (tx) => {
         const txDb = tx;
-        await rawRows(
-          txDb,
-          sql`select managed_auth_actor_mutation_fence(
+        if (input.actorFence)
+          await rawRows(
+            txDb,
+            sql`select managed_auth_actor_mutation_fence(
             ${input.actorFence.authorityHash}, ${input.actorFence.actorEpoch}::bigint,
             ${input.actorFence.requestId}::uuid
           )`
-        );
+          );
+        if (input.verifiedRecovery)
+          await rawRows(
+            txDb,
+            sql`select assert_managed_sign_in_recovery(
+          ${input.authUserId},${input.verifiedRecovery.authSessionId},${input.bindingId}::uuid,
+          ${JSON.stringify({ operationId: input.operationId, expectedIdentityRevision: input.expectedIdentityRevision, requestDigest: input.verifiedRecovery.requestDigest })}::jsonb)`
+          );
         return await applyCanonicalHumanIdentityOperationInner(txDb, input);
       });
     }
@@ -309,4 +318,4 @@ export {
   getCanonicalHumanIdentityProjection,
   applyCanonicalHumanIdentityOperation
 };
-//# sourceMappingURL=chunk-7HMK3B45.js.map
+//# sourceMappingURL=chunk-RL2MUXM3.js.map

package/dist/chunk-RL2MUXM3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/canonical-human-identities.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport {\n  CanonicalHumanIdentityMutationResponse,\n  CanonicalHumanIdentityProjection,\n  type CanonicalHumanIdentityMutationOutcome,\n  type CanonicalHumanIdentityMutationResponse as CanonicalHumanIdentityMutationResponseType,\n  type CanonicalHumanIdentityProjection as CanonicalHumanIdentityProjectionType,\n} from \"@opengeni/contracts/canonical-human-identities\";\nimport { sql } from \"drizzle-orm\";\nimport type { Database } from \"./database\";\nimport { rawRows } from \"./database\";\nimport { nestedPostgresSqlState } from \"./persistence-errors\";\n\nexport type CanonicalHumanSessionAuthority = {\n  identityId: string;\n  identityRevision: number;\n  authRevision: number;\n  identityStatus: \"active\" | \"recovery_required\" | \"disputed\" | \"disabled\";\n};\n\nexport type CanonicalHumanExactLoginBinding = {\n  id: string;\n  identityId: string;\n  revision: number;\n  status: \"active\" | \"recovery_pending\" | \"stale\" | \"disputed\" | \"revoked\";\n};\n\nexport async function getCanonicalHumanExactLoginBindingForAuthUser(\n  db: Database,\n  input: { authUserId: string; providerId: string },\n): Promise<CanonicalHumanExactLoginBinding> {\n  const [row] = await rawRows<{\n    result:\n      | (Omit<CanonicalHumanExactLoginBinding, \"revision\"> & { revision: number | string })\n      | null;\n  }>(\n    db,\n    sql`\n      select get_canonical_human_exact_login_binding(\n        ${input.authUserId}, ${input.providerId}\n      ) as result\n    `,\n  );\n  if (!row?.result) {\n    throw new CanonicalHumanIdentityAuthorityError(\n      \"Authentication did not prove exactly one canonical login binding\",\n    );\n  }\n  return { ...row.result, revision: Number(row.result.revision) };\n}\n\nexport class CanonicalHumanIdentityConflictError extends Error {\n  readonly name = \"CanonicalHumanIdentityConflictError\";\n  readonly code = \"CANONICAL_HUMAN_IDENTITY_CONFLICT\";\n\n  constructor() {\n    super(\"The canonical human identity changed in another request\");\n  }\n}\n\nexport class CanonicalHumanIdentityOperationReuseError extends Error {\n  readonly name = \"CanonicalHumanIdentityOperationReuseError\";\n  readonly code = \"CANONICAL_HUMAN_IDENTITY_OPERATION_REUSED\";\n\n  constructor() {\n    super(\"The canonical human identity operation id was already used for another request\");\n  }\n}\n\nexport class CanonicalHumanIdentityMutationInFlightError extends Error {\n  readonly name = \"CanonicalHumanIdentityMutationInFlightError\";\n  readonly code = \"CANONICAL_HUMAN_IDENTITY_MUTATION_IN_FLIGHT\";\n\n  constructor() {\n    super(\"Another request is still using this browser actor\");\n  }\n}\n\nexport class CanonicalHumanIdentityNotFoundError extends Error {\n  readonly name = \"CanonicalHumanIdentityNotFoundError\";\n\n  constructor(message = \"Canonical human identity was not found\") {\n    super(message);\n  }\n}\n\nexport class CanonicalHumanIdentityAuthorityError extends Error {\n  readonly name = \"CanonicalHumanIdentityAuthorityError\";\n}\n\nfunction deterministicOperationId(seed: string): string {\n  const bytes = createHash(\"sha256\").update(seed, \"utf8\").digest().subarray(0, 16);\n  bytes[6] = (bytes[6]! & 0x0f) | 0x50;\n  bytes[8] = (bytes[8]! & 0x3f) | 0x80;\n  const hex = bytes.toString(\"hex\");\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\nfunction projectionValue(value: unknown): unknown {\n  if (typeof value === \"string\") return JSON.parse(value);\n  return value;\n}\n\nfunction mapSqlError(error: unknown): never {\n  const state = nestedPostgresSqlState(error);\n  if (state === \"40001\") throw new CanonicalHumanIdentityConflictError();\n  if (state === \"23505\") throw new CanonicalHumanIdentityOperationReuseError();\n  if (state === \"55P03\") throw new CanonicalHumanIdentityMutationInFlightError();\n  if (state === \"P0002\") throw new CanonicalHumanIdentityNotFoundError();\n  if (state === \"42501\") {\n    throw new CanonicalHumanIdentityAuthorityError(\n      error instanceof Error ? error.message : \"Canonical human identity authority denied\",\n    );\n  }\n  throw error;\n}\n\nexport async function ensureCanonicalHumanIdentity(\n  db: Database,\n  input: { authUserId: string; displayName: string },\n): Promise<CanonicalHumanSessionAuthority> {\n  try {\n    const [row] = await rawRows<{\n      identityId: string;\n      identityRevision: number | string;\n      authRevision: number | string;\n      identityStatus: CanonicalHumanSessionAuthority[\"identityStatus\"];\n    }>(\n      db,\n      sql`\n        select\n          identity_id as \"identityId\",\n          identity_revision as \"identityRevision\",\n          auth_revision as \"authRevision\",\n          identity_status as \"identityStatus\"\n        from ensure_canonical_human_identity(${input.authUserId}, ${input.displayName})\n      `,\n    );\n    if (!row) throw new CanonicalHumanIdentityNotFoundError();\n    return {\n      identityId: row.identityId,\n      identityRevision: Number(row.identityRevision),\n      authRevision: Number(row.authRevision),\n      identityStatus: row.identityStatus,\n    };\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function ensureCanonicalHumanIdentityForAuthUser(\n  db: Database,\n  authUserId: string,\n): Promise<CanonicalHumanSessionAuthority> {\n  try {\n    const existing = await getCanonicalHumanIdentityProjection(db, authUserId);\n    return {\n      identityId: existing.activeIdentity.id,\n      identityRevision: existing.activeIdentity.identityRevision,\n      authRevision: existing.activeIdentity.authRevision,\n      identityStatus: existing.activeIdentity.status,\n    };\n  } catch (error) {\n    if (!(error instanceof CanonicalHumanIdentityNotFoundError)) throw error;\n  }\n  const [user] = await rawRows<{ displayName: string }>(\n    db,\n    sql`\n      select coalesce(nullif(btrim(name), ''), email) as \"displayName\"\n      from auth_users\n      where id = ${authUserId}\n      limit 1\n    `,\n  );\n  if (!user) throw new CanonicalHumanIdentityNotFoundError(\"Authentication user was not found\");\n  return await ensureCanonicalHumanIdentity(db, {\n    authUserId,\n    displayName: user.displayName,\n  });\n}\n\nexport async function synchronizeCanonicalHumanLoginBindings(\n  db: Database,\n  authUserId: string,\n): Promise<CanonicalHumanSessionAuthority> {\n  let authority = await ensureCanonicalHumanIdentityForAuthUser(db, authUserId);\n  const accounts = await rawRows<{\n    id: string;\n    providerId: string;\n    providerAccountId: string;\n  }>(\n    db,\n    sql`\n      select\n        id,\n        lower(provider_id) as \"providerId\",\n        account_id as \"providerAccountId\"\n      from auth_identities\n      where user_id = ${authUserId}\n      order by created_at, id\n    `,\n  );\n\n  for (const account of accounts) {\n    for (let attempt = 0; attempt < 4; attempt += 1) {\n      const projection = await getCanonicalHumanIdentityProjection(db, authUserId);\n      if (projection.activeIdentity.status !== \"active\") {\n        return {\n          identityId: projection.activeIdentity.id,\n          identityRevision: projection.activeIdentity.identityRevision,\n          authRevision: projection.activeIdentity.authRevision,\n          identityStatus: projection.activeIdentity.status,\n        };\n      }\n      const existing = projection.loginBindings.find(\n        (binding) =>\n          binding.providerId === account.providerId &&\n          binding.providerAccountId === account.providerAccountId,\n      );\n      // A revoked/recovery binding is not an invitation to relink. Reconnection\n      // belongs to the explicit OAuth-proof transaction, never a session hook.\n      if (existing && existing.status !== \"active\") break;\n      if (existing?.status === \"active\") {\n        authority = {\n          identityId: projection.activeIdentity.id,\n          identityRevision: projection.activeIdentity.identityRevision,\n          authRevision: projection.activeIdentity.authRevision,\n          identityStatus: projection.activeIdentity.status,\n        };\n        break;\n      }\n      try {\n        const result = await applyCanonicalHumanIdentityOperation(db, {\n          operationId: deterministicOperationId(\n            `canonical-human-account-link\\n${account.id}\\n${projection.activeIdentity.identityRevision}`,\n          ),\n          authUserId,\n          expectedIdentityRevision: projection.activeIdentity.identityRevision,\n          operationType: \"link\",\n          providerId: account.providerId,\n          providerAccountId: account.providerAccountId,\n          reason: \"Synchronize verified authentication account\",\n        });\n        authority = {\n          identityId: result.identity.activeIdentity.id,\n          identityRevision: result.identity.activeIdentity.identityRevision,\n          authRevision: result.identity.activeIdentity.authRevision,\n          identityStatus: result.identity.activeIdentity.status,\n        };\n        break;\n      } catch (error) {\n        if (error instanceof CanonicalHumanIdentityConflictError && attempt < 3) continue;\n        if (error instanceof CanonicalHumanIdentityAuthorityError) {\n          const currentProjection = await getCanonicalHumanIdentityProjection(db, authUserId);\n          if (currentProjection.activeIdentity.status !== \"active\") {\n            return {\n              identityId: currentProjection.activeIdentity.id,\n              identityRevision: currentProjection.activeIdentity.identityRevision,\n              authRevision: currentProjection.activeIdentity.authRevision,\n              identityStatus: currentProjection.activeIdentity.status,\n            };\n          }\n        }\n        throw error;\n      }\n    }\n  }\n  return authority;\n}\n\nexport async function validateCanonicalHumanSession(\n  db: Database,\n  input: { authSessionId: string; authUserId: string; allowRecovery?: boolean },\n): Promise<boolean> {\n  try {\n    const [row] = await rawRows<{ valid: boolean }>(\n      db,\n      sql`\n        select validate_canonical_human_session(\n          ${input.authSessionId},\n          ${input.authUserId},\n          ${input.allowRecovery ?? false}\n        ) as valid\n      `,\n    );\n    return row?.valid === true;\n  } catch (error) {\n    mapSqlError(error);\n  }\n}\n\nexport async function getCanonicalHumanIdentityProjection(\n  db: Database,\n  authUserId: string,\n): Promise<CanonicalHumanIdentityProjectionType> {\n  try {\n    const [row] = await rawRows<{ projection: unknown }>(\n      db,\n      sql`\n        select get_canonical_human_identity_projection(${authUserId}) as projection\n      `,\n    );\n    if (row?.projection === null || row?.projection === undefined) {\n      throw new CanonicalHumanIdentityNotFoundError();\n    }\n    return CanonicalHumanIdentityProjection.parse(projectionValue(row.projection));\n  } catch (error) {\n    if (error instanceof CanonicalHumanIdentityNotFoundError) throw error;\n    mapSqlError(error);\n  }\n}\n\nexport type ApplyCanonicalHumanIdentityOperationInput = {\n  operationId: string;\n  authUserId: string;\n  expectedIdentityRevision: number;\n  operationType: \"link\" | \"unlink\" | \"begin_recovery\" | \"recover\";\n  bindingId?: string | null;\n  providerId?: string | null;\n  providerAccountId?: string | null;\n  reason: string;\n  verifiedRecovery?: { authSessionId: string; requestDigest: string };\n  actorFence?: {\n    authorityHash: string;\n    actorEpoch: string;\n    requestId: string;\n  };\n};\n\nexport async function applyCanonicalHumanIdentityOperation(\n  db: Database,\n  input: ApplyCanonicalHumanIdentityOperationInput,\n): Promise<CanonicalHumanIdentityMutationResponseType> {\n  try {\n    if (input.actorFence || input.verifiedRecovery) {\n      return await db.transaction(async (tx) => {\n        const txDb = tx as unknown as Database;\n        if (input.actorFence)\n          await rawRows(\n            txDb,\n            sql`select managed_auth_actor_mutation_fence(\n            ${input.actorFence!.authorityHash}, ${input.actorFence!.actorEpoch}::bigint,\n            ${input.actorFence!.requestId}::uuid\n          )`,\n          );\n        if (input.verifiedRecovery)\n          await rawRows(\n            txDb,\n            sql`select assert_managed_sign_in_recovery(\n          ${input.authUserId},${input.verifiedRecovery.authSessionId},${input.bindingId}::uuid,\n          ${JSON.stringify({ operationId: input.operationId, expectedIdentityRevision: input.expectedIdentityRevision, requestDigest: input.verifiedRecovery.requestDigest })}::jsonb)`,\n          );\n        return await applyCanonicalHumanIdentityOperationInner(txDb, input);\n      });\n    }\n    return await applyCanonicalHumanIdentityOperationInner(db, input);\n  } catch (error) {\n    if (\n      error instanceof CanonicalHumanIdentityConflictError ||\n      error instanceof CanonicalHumanIdentityOperationReuseError ||\n      error instanceof CanonicalHumanIdentityMutationInFlightError ||\n      error instanceof CanonicalHumanIdentityNotFoundError ||\n      error instanceof CanonicalHumanIdentityAuthorityError\n    ) {\n      throw error;\n    }\n    mapSqlError(error);\n  }\n}\n\nasync function applyCanonicalHumanIdentityOperationInner(\n  db: Database,\n  input: ApplyCanonicalHumanIdentityOperationInput,\n): Promise<CanonicalHumanIdentityMutationResponseType> {\n  const [row] = await rawRows<{\n    outcome: CanonicalHumanIdentityMutationOutcome;\n    identityId: string;\n    identityRevision: number | string;\n    authRevision: number | string;\n  }>(\n    db,\n    sql`\n        select\n          outcome,\n          identity_id as \"identityId\",\n          identity_revision as \"identityRevision\",\n          auth_revision as \"authRevision\"\n        from apply_canonical_human_identity_operation(\n          ${input.operationId},\n          ${input.authUserId},\n          ${input.expectedIdentityRevision},\n          ${input.operationType},\n          ${input.bindingId ?? null},\n          ${input.providerId ?? null},\n          ${input.providerAccountId ?? null},\n          ${input.reason}\n        )\n      `,\n  );\n  if (!row) throw new CanonicalHumanIdentityNotFoundError();\n  const identity = await getCanonicalHumanIdentityProjection(db, input.authUserId);\n  return CanonicalHumanIdentityMutationResponse.parse({\n    outcome: row.outcome,\n    operationId: input.operationId,\n    identity,\n  });\n}\n"],"mappings":";;;;;;AAAA,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP,SAAS,WAAW;AAmBpB,eAAsB,8CACpB,IACA,OAC0C;AAC1C,QAAM,CAAC,GAAG,IAAI,MAAM;AAAA,IAKlB;AAAA,IACA;AAAA;AAAA,UAEM,MAAM,UAAU,KAAK,MAAM,UAAU;AAAA;AAAA;AAAA,EAG7C;AACA,MAAI,CAAC,KAAK,QAAQ;AAChB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,GAAG,IAAI,QAAQ,UAAU,OAAO,IAAI,OAAO,QAAQ,EAAE;AAChE;AAEO,IAAM,sCAAN,cAAkD,MAAM;AAAA,EACpD,OAAO;AAAA,EACP,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,yDAAyD;AAAA,EACjE;AACF;AAEO,IAAM,4CAAN,cAAwD,MAAM;AAAA,EAC1D,OAAO;AAAA,EACP,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,gFAAgF;AAAA,EACxF;AACF;AAEO,IAAM,8CAAN,cAA0D,MAAM;AAAA,EAC5D,OAAO;AAAA,EACP,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,mDAAmD;AAAA,EAC3D;AACF;AAEO,IAAM,sCAAN,cAAkD,MAAM;AAAA,EACpD,OAAO;AAAA,EAEhB,YAAY,UAAU,0CAA0C;AAC9D,UAAM,OAAO;AAAA,EACf;AACF;AAEO,IAAM,uCAAN,cAAmD,MAAM;AAAA,EACrD,OAAO;AAClB;AAEA,SAAS,yBAAyB,MAAsB;AACtD,QAAM,QAAQ,WAAW,QAAQ,EAAE,OAAO,MAAM,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,EAAE;AAC/E,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,CAAC,IAAK,MAAM,CAAC,IAAK,KAAQ;AAChC,QAAM,MAAM,MAAM,SAAS,KAAK;AAChC,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC1G;AAEA,SAAS,gBAAgB,OAAyB;AAChD,MAAI,OAAO,UAAU,SAAU,QAAO,KAAK,MAAM,KAAK;AACtD,SAAO;AACT;AAEA,SAAS,YAAY,OAAuB;AAC1C,QAAM,QAAQ,uBAAuB,KAAK;AAC1C,MAAI,UAAU,QAAS,OAAM,IAAI,oCAAoC;AACrE,MAAI,UAAU,QAAS,OAAM,IAAI,0CAA0C;AAC3E,MAAI,UAAU,QAAS,OAAM,IAAI,4CAA4C;AAC7E,MAAI,UAAU,QAAS,OAAM,IAAI,oCAAoC;AACrE,MAAI,UAAU,SAAS;AACrB,UAAM,IAAI;AAAA,MACR,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAC3C;AAAA,EACF;AACA,QAAM;AACR;AAEA,eAAsB,6BACpB,IACA,OACyC;AACzC,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAMlB;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+CAMyC,MAAM,UAAU,KAAK,MAAM,WAAW;AAAA;AAAA,IAEjF;AACA,QAAI,CAAC,IAAK,OAAM,IAAI,oCAAoC;AACxD,WAAO;AAAA,MACL,YAAY,IAAI;AAAA,MAChB,kBAAkB,OAAO,IAAI,gBAAgB;AAAA,MAC7C,cAAc,OAAO,IAAI,YAAY;AAAA,MACrC,gBAAgB,IAAI;AAAA,IACtB;AAAA,EACF,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,wCACpB,IACA,YACyC;AACzC,MAAI;AACF,UAAM,WAAW,MAAM,oCAAoC,IAAI,UAAU;AACzE,WAAO;AAAA,MACL,YAAY,SAAS,eAAe;AAAA,MACpC,kBAAkB,SAAS,eAAe;AAAA,MAC1C,cAAc,SAAS,eAAe;AAAA,MACtC,gBAAgB,SAAS,eAAe;AAAA,IAC1C;AAAA,EACF,SAAS,OAAO;AACd,QAAI,EAAE,iBAAiB,qCAAsC,OAAM;AAAA,EACrE;AACA,QAAM,CAAC,IAAI,IAAI,MAAM;AAAA,IACnB;AAAA,IACA;AAAA;AAAA;AAAA,mBAGe,UAAU;AAAA;AAAA;AAAA,EAG3B;AACA,MAAI,CAAC,KAAM,OAAM,IAAI,oCAAoC,mCAAmC;AAC5F,SAAO,MAAM,6BAA6B,IAAI;AAAA,IAC5C;AAAA,IACA,aAAa,KAAK;AAAA,EACpB,CAAC;AACH;AAEA,eAAsB,uCACpB,IACA,YACyC;AACzC,MAAI,YAAY,MAAM,wCAAwC,IAAI,UAAU;AAC5E,QAAM,WAAW,MAAM;AAAA,IAKrB;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAMoB,UAAU;AAAA;AAAA;AAAA,EAGhC;AAEA,aAAW,WAAW,UAAU;AAC9B,aAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,YAAM,aAAa,MAAM,oCAAoC,IAAI,UAAU;AAC3E,UAAI,WAAW,eAAe,WAAW,UAAU;AACjD,eAAO;AAAA,UACL,YAAY,WAAW,eAAe;AAAA,UACtC,kBAAkB,WAAW,eAAe;AAAA,UAC5C,cAAc,WAAW,eAAe;AAAA,UACxC,gBAAgB,WAAW,eAAe;AAAA,QAC5C;AAAA,MACF;AACA,YAAM,WAAW,WAAW,cAAc;AAAA,QACxC,CAAC,YACC,QAAQ,eAAe,QAAQ,cAC/B,QAAQ,sBAAsB,QAAQ;AAAA,MAC1C;AAGA,UAAI,YAAY,SAAS,WAAW,SAAU;AAC9C,UAAI,UAAU,WAAW,UAAU;AACjC,oBAAY;AAAA,UACV,YAAY,WAAW,eAAe;AAAA,UACtC,kBAAkB,WAAW,eAAe;AAAA,UAC5C,cAAc,WAAW,eAAe;AAAA,UACxC,gBAAgB,WAAW,eAAe;AAAA,QAC5C;AACA;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,MAAM,qCAAqC,IAAI;AAAA,UAC5D,aAAa;AAAA,YACX;AAAA,EAAiC,QAAQ,EAAE;AAAA,EAAK,WAAW,eAAe,gBAAgB;AAAA,UAC5F;AAAA,UACA;AAAA,UACA,0BAA0B,WAAW,eAAe;AAAA,UACpD,eAAe;AAAA,UACf,YAAY,QAAQ;AAAA,UACpB,mBAAmB,QAAQ;AAAA,UAC3B,QAAQ;AAAA,QACV,CAAC;AACD,oBAAY;AAAA,UACV,YAAY,OAAO,SAAS,eAAe;AAAA,UAC3C,kBAAkB,OAAO,SAAS,eAAe;AAAA,UACjD,cAAc,OAAO,SAAS,eAAe;AAAA,UAC7C,gBAAgB,OAAO,SAAS,eAAe;AAAA,QACjD;AACA;AAAA,MACF,SAAS,OAAO;AACd,YAAI,iBAAiB,uCAAuC,UAAU,EAAG;AACzE,YAAI,iBAAiB,sCAAsC;AACzD,gBAAM,oBAAoB,MAAM,oCAAoC,IAAI,UAAU;AAClF,cAAI,kBAAkB,eAAe,WAAW,UAAU;AACxD,mBAAO;AAAA,cACL,YAAY,kBAAkB,eAAe;AAAA,cAC7C,kBAAkB,kBAAkB,eAAe;AAAA,cACnD,cAAc,kBAAkB,eAAe;AAAA,cAC/C,gBAAgB,kBAAkB,eAAe;AAAA,YACnD;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,8BACpB,IACA,OACkB;AAClB,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAClB;AAAA,MACA;AAAA;AAAA,YAEM,MAAM,aAAa;AAAA,YACnB,MAAM,UAAU;AAAA,YAChB,MAAM,iBAAiB,KAAK;AAAA;AAAA;AAAA,IAGpC;AACA,WAAO,KAAK,UAAU;AAAA,EACxB,SAAS,OAAO;AACd,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAsB,oCACpB,IACA,YAC+C;AAC/C,MAAI;AACF,UAAM,CAAC,GAAG,IAAI,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,yDACmD,UAAU;AAAA;AAAA,IAE/D;AACA,QAAI,KAAK,eAAe,QAAQ,KAAK,eAAe,QAAW;AAC7D,YAAM,IAAI,oCAAoC;AAAA,IAChD;AACA,WAAO,iCAAiC,MAAM,gBAAgB,IAAI,UAAU,CAAC;AAAA,EAC/E,SAAS,OAAO;AACd,QAAI,iBAAiB,oCAAqC,OAAM;AAChE,gBAAY,KAAK;AAAA,EACnB;AACF;AAmBA,eAAsB,qCACpB,IACA,OACqD;AACrD,MAAI;AACF,QAAI,MAAM,cAAc,MAAM,kBAAkB;AAC9C,aAAO,MAAM,GAAG,YAAY,OAAO,OAAO;AACxC,cAAM,OAAO;AACb,YAAI,MAAM;AACR,gBAAM;AAAA,YACJ;AAAA,YACA;AAAA,cACE,MAAM,WAAY,aAAa,KAAK,MAAM,WAAY,UAAU;AAAA,cAChE,MAAM,WAAY,SAAS;AAAA;AAAA,UAE/B;AACF,YAAI,MAAM;AACR,gBAAM;AAAA,YACJ;AAAA,YACA;AAAA,YACA,MAAM,UAAU,IAAI,MAAM,iBAAiB,aAAa,IAAI,MAAM,SAAS;AAAA,YAC3E,KAAK,UAAU,EAAE,aAAa,MAAM,aAAa,0BAA0B,MAAM,0BAA0B,eAAe,MAAM,iBAAiB,cAAc,CAAC,CAAC;AAAA,UACnK;AACF,eAAO,MAAM,0CAA0C,MAAM,KAAK;AAAA,MACpE,CAAC;AAAA,IACH;AACA,WAAO,MAAM,0CAA0C,IAAI,KAAK;AAAA,EAClE,SAAS,OAAO;AACd,QACE,iBAAiB,uCACjB,iBAAiB,6CACjB,iBAAiB,+CACjB,iBAAiB,uCACjB,iBAAiB,sCACjB;AACA,YAAM;AAAA,IACR;AACA,gBAAY,KAAK;AAAA,EACnB;AACF;AAEA,eAAe,0CACb,IACA,OACqD;AACrD,QAAM,CAAC,GAAG,IAAI,MAAM;AAAA,IAMlB;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAOQ,MAAM,WAAW;AAAA,YACjB,MAAM,UAAU;AAAA,YAChB,MAAM,wBAAwB;AAAA,YAC9B,MAAM,aAAa;AAAA,YACnB,MAAM,aAAa,IAAI;AAAA,YACvB,MAAM,cAAc,IAAI;AAAA,YACxB,MAAM,qBAAqB,IAAI;AAAA,YAC/B,MAAM,MAAM;AAAA;AAAA;AAAA,EAGtB;AACA,MAAI,CAAC,IAAK,OAAM,IAAI,oCAAoC;AACxD,QAAM,WAAW,MAAM,oCAAoC,IAAI,MAAM,UAAU;AAC/E,SAAO,uCAAuC,MAAM;AAAA,IAClD,SAAS,IAAI;AAAA,IACb,aAAa,MAAM;AAAA,IACnB;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/{chunk-HQDVI2DB.js → chunk-SYKHLPTK.js}

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-DPONPYJD.js";
+} from "./chunk-CJI6G254.js";
 
 // src/editable-artifacts.ts
 import { createHash } from "crypto";
@@ -3538,6 +3538,7 @@ export {
   EDITABLE_ARTIFACT_KERNEL_TAIL_MAX_BYTES,
   PostgresEditableArtifactLiveTicketStore,
   PostgresEditableArtifactStore,
-  PostgresEditableArtifactLiveReadStore
+  PostgresEditableArtifactLiveReadStore,
+  transactionallyAuthorizeEditableArtifactActor
 };
-//# sourceMappingURL=chunk-HQDVI2DB.js.map
+//# sourceMappingURL=chunk-SYKHLPTK.js.map