@sixb/core 0.0.1

package/dist/chunk-xqbtf4wn.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/storage/operation-scope.ts"],
+  "sourcesContent": [
+    "import { AsyncLocalStorage } from \"node:async_hooks\"\nimport type { AgentStorage } from \"./agents\"\nimport type { AuthStorage } from \"./auth\"\nimport type { OntologyStorage } from \"./ontology\"\nimport type { WorkflowRunStorage } from \"./workflow-runs\"\n\nexport type StorageOperationRunner = <TResult>(\n  run: () => Promise<TResult> | TResult\n) => Promise<TResult>\n\n/** Provider-owned execution boundary for root storage operations. */\nexport interface StorageOperationScope {\n  assertAvailable(): void\n  run<TResult>(operation: () => Promise<TResult> | TResult): Promise<TResult>\n}\n\nexport function createStorageOperationScope(\n  run: StorageOperationRunner,\n  assertAvailable: () => void = () => undefined\n): StorageOperationScope {\n  const executions = new AsyncLocalStorage<{ active: boolean }>()\n  return {\n    assertAvailable,\n    async run(operation) {\n      const inherited = executions.getStore()\n      if (inherited?.active) {\n        assertAvailable()\n        return operation()\n      }\n\n      const execution = { active: true }\n      try {\n        return await executions.run(execution, () => run(operation))\n      } finally {\n        execution.active = false\n      }\n    },\n  }\n}\n\nconst operationScopeTargets = new WeakMap<object, object>()\n\n/**\n * Give every async operation exposed by a store one provider-owned execution scope.\n *\n * Storage contracts use `async` methods for I/O and reserve synchronous methods for local\n * capabilities such as `queryCapabilities()`. Discovering the former from their implementation\n * removes the second, manually synchronized method registry that previously coupled every storage\n * primitive to the SQLite/InMemory lock.\n */\nexport function createOperationScopedFacade<T extends object>(\n  target: T,\n  scope: StorageOperationScope,\n  propertyOverrides: Partial<T> = {}\n): T {\n  const methodKinds = discoverMethodKinds(target)\n  const overrideKeys = new Set(Reflect.ownKeys(propertyOverrides))\n  const methodCache = new Map<\n    PropertyKey,\n    { implementation: (...args: unknown[]) => unknown; exposed: (...args: unknown[]) => unknown }\n  >()\n\n  const facade = new Proxy(target, {\n    get(current, property) {\n      if (overrideKeys.has(property)) {\n        return Reflect.get(propertyOverrides, property, propertyOverrides)\n      }\n\n      const value = Reflect.get(current, property, current)\n      const kind = methodKinds.get(property)\n      if (!kind || typeof value !== \"function\") return value\n      const implementation = value as (...args: unknown[]) => unknown\n\n      const cached = methodCache.get(property)\n      if (cached?.implementation === implementation) return cached.exposed\n\n      const exposed = scopeMethod(implementation, kind, current, scope)\n      methodCache.set(property, { implementation, exposed })\n      return exposed\n    },\n    set(current, property, value) {\n      if (overrideKeys.has(property)) return false\n      return Reflect.set(current, property, value, current)\n    },\n    defineProperty(current, property, attributes) {\n      if (overrideKeys.has(property)) return false\n      return Reflect.defineProperty(current, property, attributes)\n    },\n    deleteProperty(current, property) {\n      if (overrideKeys.has(property)) return false\n      return Reflect.deleteProperty(current, property)\n    },\n  })\n  operationScopeTargets.set(facade, target)\n  return facade\n}\n\ntype StorageMethod = (...args: never[]) => unknown\ntype StorageMethodKey<T> = {\n  [TKey in keyof T]-?: T[TKey] extends StorageMethod ? TKey : never\n}[keyof T]\n\n/** Replace a provider method behind its scoped facade without exposing the raw provider. */\nexport function decorateOperationScopedMethodForTesting<\n  T extends object,\n  TKey extends StorageMethodKey<T>,\n>(\n  facade: T,\n  property: TKey,\n  decorate: (implementation: Extract<T[TKey], StorageMethod>) => Extract<T[TKey], StorageMethod>\n): () => void {\n  const target = operationScopeTargets.get(facade)\n  if (!target) throw new Error(\"[Sixb] Expected an operation-scoped storage facade.\")\n\n  const previousDescriptor = Reflect.getOwnPropertyDescriptor(target, property)\n  const implementation = Reflect.get(target, property, target)\n  if (typeof implementation !== \"function\") {\n    throw new Error(`[Sixb] Storage property '${String(property)}' is not a method.`)\n  }\n\n  const boundImplementation = ((...args: never[]) =>\n    Reflect.apply(implementation, target, args)) as Extract<T[TKey], StorageMethod>\n  const decorated = decorate(boundImplementation)\n  Reflect.defineProperty(target, property, {\n    configurable: true,\n    enumerable: previousDescriptor?.enumerable ?? false,\n    writable: true,\n    value: decorated,\n  })\n\n  return () => {\n    if (previousDescriptor) {\n      Reflect.defineProperty(target, property, previousDescriptor)\n    } else {\n      Reflect.deleteProperty(target, property)\n    }\n  }\n}\n\ntype StorageMethodKind = \"async\" | \"async-generator\" | \"sync\"\n\nfunction discoverMethodKinds(target: object): ReadonlyMap<PropertyKey, StorageMethodKind> {\n  const methodKeys = new Set<PropertyKey>()\n  for (\n    let current: object | null = target;\n    current && current !== Object.prototype;\n    current = Object.getPrototypeOf(current)\n  ) {\n    for (const property of Reflect.ownKeys(current)) {\n      if (property !== \"constructor\") methodKeys.add(property)\n    }\n  }\n\n  const methodKinds = new Map<PropertyKey, StorageMethodKind>()\n  for (const property of methodKeys) {\n    const implementation = Reflect.get(target, property, target)\n    if (typeof implementation !== \"function\") continue\n    methodKinds.set(property, methodKind(implementation))\n  }\n  return methodKinds\n}\n\nfunction methodKind(implementation: (...args: unknown[]) => unknown): StorageMethodKind {\n  if (isAsyncFunction(implementation)) return \"async\"\n  if (isAsyncGeneratorFunction(implementation)) return \"async-generator\"\n  return \"sync\"\n}\n\nfunction scopeMethod(\n  implementation: (...args: unknown[]) => unknown,\n  kind: StorageMethodKind,\n  target: object,\n  scope: StorageOperationScope\n): (...args: unknown[]) => unknown {\n  if (kind === \"async\") {\n    return (...args: unknown[]) => scope.run(() => Reflect.apply(implementation, target, args))\n  }\n\n  if (kind === \"async-generator\") {\n    return (...args: unknown[]) => {\n      scope.assertAvailable()\n      return Reflect.apply(implementation, target, args)\n    }\n  }\n\n  return implementation.bind(target)\n}\n\nexport function createAuthOperationScope<T extends AuthStorage>(\n  target: T,\n  scope: StorageOperationScope\n): T {\n  return createOperationScopedFacade<AuthStorage>(target, scope, {\n    users: createOperationScopedFacade(target.users, scope),\n    identities: createOperationScopedFacade(target.identities, scope),\n    serviceAccounts: createOperationScopedFacade(target.serviceAccounts, scope),\n    serviceAccountGroupMemberships: createOperationScopedFacade(\n      target.serviceAccountGroupMemberships,\n      scope\n    ),\n    sessions: createOperationScopedFacade(target.sessions, scope),\n    accessTokens: createOperationScopedFacade(target.accessTokens, scope),\n    invitations: createOperationScopedFacade(target.invitations, scope),\n    groupMemberships: createOperationScopedFacade(target.groupMemberships, scope),\n    magicLinks: createOperationScopedFacade(target.magicLinks, scope),\n    oidcAuthorizationAttempts: createOperationScopedFacade(target.oidcAuthorizationAttempts, scope),\n  }) as T\n}\n\nexport function createAgentOperationScope<T extends AgentStorage>(\n  target: T,\n  scope: StorageOperationScope\n): T {\n  return createOperationScopedFacade<AgentStorage>(target, scope, {\n    threads: createOperationScopedFacade(target.threads, scope),\n    runs: createOperationScopedFacade(target.runs, scope),\n    messages: createOperationScopedFacade(target.messages, scope),\n  }) as T\n}\n\nexport function createOntologyOperationScope<T extends OntologyStorage>(\n  target: T,\n  scope: StorageOperationScope\n): T {\n  return createOperationScopedFacade<OntologyStorage>(target, scope, {\n    commits: createOperationScopedFacade(target.commits, scope),\n    sources: createOperationScopedFacade(target.sources, scope),\n    materializations: createOperationScopedFacade(target.materializations, scope),\n    outbox: createOperationScopedFacade(target.outbox, scope),\n  }) as T\n}\n\nexport function createWorkflowRunOperationScope<T extends WorkflowRunStorage>(\n  target: T,\n  scope: StorageOperationScope\n): T {\n  return createOperationScopedFacade<WorkflowRunStorage>(target, scope, {\n    nodes: createOperationScopedFacade(target.nodes, scope),\n  }) as T\n}\n\nfunction isAsyncFunction(value: unknown): value is (...args: unknown[]) => Promise<unknown> {\n  return typeof value === \"function\" && value.constructor.name === \"AsyncFunction\"\n}\n\nfunction isAsyncGeneratorFunction(value: unknown): boolean {\n  return typeof value === \"function\" && value.constructor.name === \"AsyncGeneratorFunction\"\n}\n"
+  ],
+  "mappings": ";;AAAA;AAgBO,SAAS,2BAA2B,CACzC,KACA,kBAA8B,MAAG;AAAA,EAAG;AAAA,GACb;AAAA,EACvB,MAAM,aAAa,IAAI;AAAA,EACvB,OAAO;AAAA,IACL;AAAA,SACM,IAAG,CAAC,WAAW;AAAA,MACnB,MAAM,YAAY,WAAW,SAAS;AAAA,MACtC,IAAI,WAAW,QAAQ;AAAA,QACrB,gBAAgB;AAAA,QAChB,OAAO,UAAU;AAAA,MACnB;AAAA,MAEA,MAAM,YAAY,EAAE,QAAQ,KAAK;AAAA,MACjC,IAAI;AAAA,QACF,OAAO,MAAM,WAAW,IAAI,WAAW,MAAM,IAAI,SAAS,CAAC;AAAA,gBAC3D;AAAA,QACA,UAAU,SAAS;AAAA;AAAA;AAAA,EAGzB;AAAA;AAGF,IAAM,wBAAwB,IAAI;AAU3B,SAAS,2BAA6C,CAC3D,QACA,OACA,oBAAgC,CAAC,GAC9B;AAAA,EACH,MAAM,cAAc,oBAAoB,MAAM;AAAA,EAC9C,MAAM,eAAe,IAAI,IAAI,QAAQ,QAAQ,iBAAiB,CAAC;AAAA,EAC/D,MAAM,cAAc,IAAI;AAAA,EAKxB,MAAM,SAAS,IAAI,MAAM,QAAQ;AAAA,IAC/B,GAAG,CAAC,SAAS,UAAU;AAAA,MACrB,IAAI,aAAa,IAAI,QAAQ,GAAG;AAAA,QAC9B,OAAO,QAAQ,IAAI,mBAAmB,UAAU,iBAAiB;AAAA,MACnE;AAAA,MAEA,MAAM,QAAQ,QAAQ,IAAI,SAAS,UAAU,OAAO;AAAA,MACpD,MAAM,OAAO,YAAY,IAAI,QAAQ;AAAA,MACrC,IAAI,CAAC,QAAQ,OAAO,UAAU;AAAA,QAAY,OAAO;AAAA,MACjD,MAAM,iBAAiB;AAAA,MAEvB,MAAM,SAAS,YAAY,IAAI,QAAQ;AAAA,MACvC,IAAI,QAAQ,mBAAmB;AAAA,QAAgB,OAAO,OAAO;AAAA,MAE7D,MAAM,UAAU,YAAY,gBAAgB,MAAM,SAAS,KAAK;AAAA,MAChE,YAAY,IAAI,UAAU,EAAE,gBAAgB,QAAQ,CAAC;AAAA,MACrD,OAAO;AAAA;AAAA,IAET,GAAG,CAAC,SAAS,UAAU,OAAO;AAAA,MAC5B,IAAI,aAAa,IAAI,QAAQ;AAAA,QAAG,OAAO;AAAA,MACvC,OAAO,QAAQ,IAAI,SAAS,UAAU,OAAO,OAAO;AAAA;AAAA,IAEtD,cAAc,CAAC,SAAS,UAAU,YAAY;AAAA,MAC5C,IAAI,aAAa,IAAI,QAAQ;AAAA,QAAG,OAAO;AAAA,MACvC,OAAO,QAAQ,eAAe,SAAS,UAAU,UAAU;AAAA;AAAA,IAE7D,cAAc,CAAC,SAAS,UAAU;AAAA,MAChC,IAAI,aAAa,IAAI,QAAQ;AAAA,QAAG,OAAO;AAAA,MACvC,OAAO,QAAQ,eAAe,SAAS,QAAQ;AAAA;AAAA,EAEnD,CAAC;AAAA,EACD,sBAAsB,IAAI,QAAQ,MAAM;AAAA,EACxC,OAAO;AAAA;AASF,SAAS,uCAGf,CACC,QACA,UACA,UACY;AAAA,EACZ,MAAM,SAAS,sBAAsB,IAAI,MAAM;AAAA,EAC/C,IAAI,CAAC;AAAA,IAAQ,MAAM,IAAI,MAAM,qDAAqD;AAAA,EAElF,MAAM,qBAAqB,QAAQ,yBAAyB,QAAQ,QAAQ;AAAA,EAC5E,MAAM,iBAAiB,QAAQ,IAAI,QAAQ,UAAU,MAAM;AAAA,EAC3D,IAAI,OAAO,mBAAmB,YAAY;AAAA,IACxC,MAAM,IAAI,MAAM,4BAA4B,OAAO,QAAQ,qBAAqB;AAAA,EAClF;AAAA,EAEA,MAAM,sBAAuB,IAAI,SAC/B,QAAQ,MAAM,gBAAgB,QAAQ,IAAI;AAAA,EAC5C,MAAM,YAAY,SAAS,mBAAmB;AAAA,EAC9C,QAAQ,eAAe,QAAQ,UAAU;AAAA,IACvC,cAAc;AAAA,IACd,YAAY,oBAAoB,cAAc;AAAA,IAC9C,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAAA,EAED,OAAO,MAAM;AAAA,IACX,IAAI,oBAAoB;AAAA,MACtB,QAAQ,eAAe,QAAQ,UAAU,kBAAkB;AAAA,IAC7D,EAAO;AAAA,MACL,QAAQ,eAAe,QAAQ,QAAQ;AAAA;AAAA;AAAA;AAO7C,SAAS,mBAAmB,CAAC,QAA6D;AAAA,EACxF,MAAM,aAAa,IAAI;AAAA,EACvB,SACM,UAAyB,OAC7B,WAAW,YAAY,OAAO,WAC9B,UAAU,OAAO,eAAe,OAAO,GACvC;AAAA,IACA,WAAW,YAAY,QAAQ,QAAQ,OAAO,GAAG;AAAA,MAC/C,IAAI,aAAa;AAAA,QAAe,WAAW,IAAI,QAAQ;AAAA,IACzD;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,IAAI;AAAA,EACxB,WAAW,YAAY,YAAY;AAAA,IACjC,MAAM,iBAAiB,QAAQ,IAAI,QAAQ,UAAU,MAAM;AAAA,IAC3D,IAAI,OAAO,mBAAmB;AAAA,MAAY;AAAA,IAC1C,YAAY,IAAI,UAAU,WAAW,cAAc,CAAC;AAAA,EACtD;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,UAAU,CAAC,gBAAoE;AAAA,EACtF,IAAI,gBAAgB,cAAc;AAAA,IAAG,OAAO;AAAA,EAC5C,IAAI,yBAAyB,cAAc;AAAA,IAAG,OAAO;AAAA,EACrD,OAAO;AAAA;AAGT,SAAS,WAAW,CAClB,gBACA,MACA,QACA,OACiC;AAAA,EACjC,IAAI,SAAS,SAAS;AAAA,IACpB,OAAO,IAAI,SAAoB,MAAM,IAAI,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAAA,EAEA,IAAI,SAAS,mBAAmB;AAAA,IAC9B,OAAO,IAAI,SAAoB;AAAA,MAC7B,MAAM,gBAAgB;AAAA,MACtB,OAAO,QAAQ,MAAM,gBAAgB,QAAQ,IAAI;AAAA;AAAA,EAErD;AAAA,EAEA,OAAO,eAAe,KAAK,MAAM;AAAA;AAG5B,SAAS,wBAA+C,CAC7D,QACA,OACG;AAAA,EACH,OAAO,4BAAyC,QAAQ,OAAO;AAAA,IAC7D,OAAO,4BAA4B,OAAO,OAAO,KAAK;AAAA,IACtD,YAAY,4BAA4B,OAAO,YAAY,KAAK;AAAA,IAChE,iBAAiB,4BAA4B,OAAO,iBAAiB,KAAK;AAAA,IAC1E,gCAAgC,4BAC9B,OAAO,gCACP,KACF;AAAA,IACA,UAAU,4BAA4B,OAAO,UAAU,KAAK;AAAA,IAC5D,cAAc,4BAA4B,OAAO,cAAc,KAAK;AAAA,IACpE,aAAa,4BAA4B,OAAO,aAAa,KAAK;AAAA,IAClE,kBAAkB,4BAA4B,OAAO,kBAAkB,KAAK;AAAA,IAC5E,YAAY,4BAA4B,OAAO,YAAY,KAAK;AAAA,IAChE,2BAA2B,4BAA4B,OAAO,2BAA2B,KAAK;AAAA,EAChG,CAAC;AAAA;AAGI,SAAS,yBAAiD,CAC/D,QACA,OACG;AAAA,EACH,OAAO,4BAA0C,QAAQ,OAAO;AAAA,IAC9D,SAAS,4BAA4B,OAAO,SAAS,KAAK;AAAA,IAC1D,MAAM,4BAA4B,OAAO,MAAM,KAAK;AAAA,IACpD,UAAU,4BAA4B,OAAO,UAAU,KAAK;AAAA,EAC9D,CAAC;AAAA;AAGI,SAAS,4BAAuD,CACrE,QACA,OACG;AAAA,EACH,OAAO,4BAA6C,QAAQ,OAAO;AAAA,IACjE,SAAS,4BAA4B,OAAO,SAAS,KAAK;AAAA,IAC1D,SAAS,4BAA4B,OAAO,SAAS,KAAK;AAAA,IAC1D,kBAAkB,4BAA4B,OAAO,kBAAkB,KAAK;AAAA,IAC5E,QAAQ,4BAA4B,OAAO,QAAQ,KAAK;AAAA,EAC1D,CAAC;AAAA;AAGI,SAAS,+BAA6D,CAC3E,QACA,OACG;AAAA,EACH,OAAO,4BAAgD,QAAQ,OAAO;AAAA,IACpE,OAAO,4BAA4B,OAAO,OAAO,KAAK;AAAA,EACxD,CAAC;AAAA;AAGH,SAAS,eAAe,CAAC,OAAmE;AAAA,EAC1F,OAAO,OAAO,UAAU,cAAc,MAAM,YAAY,SAAS;AAAA;AAGnE,SAAS,wBAAwB,CAAC,OAAyB;AAAA,EACzD,OAAO,OAAO,UAAU,cAAc,MAAM,YAAY,SAAS;AAAA;",
+  "debugId": "E8631615DFADF55464756E2164756E21",
+  "names": []
+}

package/dist/chunk-xwnf87e1.js

@@ -0,0 +1,324 @@
+// @bun
+// src/auth/errors.ts
+class AuthRuntimeError extends Error {
+  code;
+  name = "AuthRuntimeError";
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+
+// src/auth/audience.ts
+var DEFAULT_AUTH_SESSION_AUDIENCE = "atlas";
+function isValidAuthSessionAudience(value) {
+  return value === "atlas" || value === "app";
+}
+function resolveAuthSessionAudience(value) {
+  const audience = value ?? DEFAULT_AUTH_SESSION_AUDIENCE;
+  if (!isValidAuthSessionAudience(audience)) {
+    throw new AuthRuntimeError("invalid_auth_config", `[Sixb] Auth session audience '${audience}' is invalid. Expected 'atlas' or 'app'.`);
+  }
+  return audience;
+}
+
+// src/auth/cookies.ts
+var DEFAULT_SESSION_COOKIE_NAME = "sixb_session";
+var DEFAULT_CSRF_COOKIE_NAME = "sixb_csrf";
+function resolveAuthCookieOptions(options) {
+  const resolved = {
+    sessionCookieName: options?.sessionCookieName ?? DEFAULT_SESSION_COOKIE_NAME,
+    csrfCookieName: options?.csrfCookieName ?? DEFAULT_CSRF_COOKIE_NAME,
+    domain: options?.cookieDomain,
+    secure: options?.secure ?? "auto",
+    sameSite: options?.sameSite ?? "strict",
+    csrfHttpOnly: options?.csrfHttpOnly ?? false
+  };
+  assertValidCookieOptions(resolved);
+  return resolved;
+}
+function resolveAuthCookieOptionsForAudience(options, audience) {
+  const resolvedAudience = resolveAuthSessionAudience(audience);
+  if (resolvedAudience === DEFAULT_AUTH_SESSION_AUDIENCE) {
+    return options;
+  }
+  return {
+    ...options,
+    sessionCookieName: `${options.sessionCookieName}_${resolvedAudience}`,
+    csrfCookieName: `${options.csrfCookieName}_${resolvedAudience}`
+  };
+}
+function parseCookieHeader(header) {
+  const cookies = new Map;
+  if (!header) {
+    return cookies;
+  }
+  for (const part of header.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator <= 0) {
+      continue;
+    }
+    const name = part.slice(0, separator).trim();
+    if (!name || cookies.has(name)) {
+      continue;
+    }
+    const value = part.slice(separator + 1).trim();
+    cookies.set(name, value);
+  }
+  return cookies;
+}
+function getCookie(request, name) {
+  return parseCookieHeader(request.headers.get("cookie")).get(name);
+}
+function serializeCookie(options) {
+  const parts = [`${options.name}=${options.value}`];
+  parts.push("Path=/");
+  parts.push("SameSite=Strict");
+  if (options.domain) {
+    parts.push(`Domain=${options.domain}`);
+  }
+  if (options.httpOnly) {
+    parts.push("HttpOnly");
+  }
+  if (options.secure) {
+    parts.push("Secure");
+  }
+  if (options.maxAge !== undefined) {
+    parts.push(`Max-Age=${Math.trunc(options.maxAge)}`);
+  }
+  if (options.expires) {
+    parts.push(`Expires=${options.expires.toUTCString()}`);
+  }
+  return parts.join("; ");
+}
+function shouldUseSecureCookies(request, options) {
+  if (requiresSecureCookieName(options.sessionCookieName) || requiresSecureCookieName(options.csrfCookieName)) {
+    return true;
+  }
+  if (typeof options.secure === "boolean") {
+    return options.secure;
+  }
+  const url = new URL(request.url);
+  if (isLocalhost(url.hostname)) {
+    return false;
+  }
+  return url.protocol === "https:" || true;
+}
+function createSessionCookieHeader(params) {
+  const lifetime = resolveCookieLifetime(params.expiresAt);
+  return serializeCookie({
+    name: params.options.sessionCookieName,
+    value: params.value,
+    httpOnly: true,
+    ...lifetime,
+    domain: params.options.domain,
+    secure: shouldUseSecureCookies(params.request, params.options),
+    sameSite: params.options.sameSite
+  });
+}
+function createCsrfCookieHeader(params) {
+  const lifetime = resolveCookieLifetime(params.expiresAt);
+  return serializeCookie({
+    name: params.options.csrfCookieName,
+    value: params.value,
+    httpOnly: params.options.csrfHttpOnly,
+    ...lifetime,
+    domain: params.options.domain,
+    secure: shouldUseSecureCookies(params.request, params.options),
+    sameSite: params.options.sameSite
+  });
+}
+function resolveCookieLifetime(expiresAt) {
+  const expiresAtMs = expiresAt.getTime();
+  if (!Number.isFinite(expiresAtMs)) {
+    throw new Error("[Sixb] Auth cookie expiresAt must be a valid date.");
+  }
+  return {
+    maxAge: Math.max(0, Math.floor((expiresAtMs - Date.now()) / 1000)),
+    expires: new Date(expiresAtMs)
+  };
+}
+function clearSessionCookieHeader(params) {
+  return serializeCookie({
+    name: params.options.sessionCookieName,
+    value: "",
+    httpOnly: true,
+    maxAge: 0,
+    expires: new Date(0),
+    domain: params.options.domain,
+    secure: shouldUseSecureCookies(params.request, params.options),
+    sameSite: params.options.sameSite
+  });
+}
+function clearCsrfCookieHeader(params) {
+  return serializeCookie({
+    name: params.options.csrfCookieName,
+    value: "",
+    maxAge: 0,
+    expires: new Date(0),
+    domain: params.options.domain,
+    secure: shouldUseSecureCookies(params.request, params.options),
+    sameSite: params.options.sameSite
+  });
+}
+function isLocalhost(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+}
+function assertValidCookieOptions(options) {
+  assertValidCookieName(options.sessionCookieName, "sessionCookieName");
+  assertValidCookieName(options.csrfCookieName, "csrfCookieName");
+  if (options.sameSite !== "strict") {
+    throw new Error("[Sixb] Auth cookie sameSite must be 'strict'.");
+  }
+  if (options.domain && (isHostPrefixedCookieName(options.sessionCookieName) || isHostPrefixedCookieName(options.csrfCookieName))) {
+    throw new Error("[Sixb] __Host- auth cookies cannot be configured with cookieDomain.");
+  }
+  if (options.secure === false && (requiresSecureCookieName(options.sessionCookieName) || requiresSecureCookieName(options.csrfCookieName))) {
+    throw new Error("[Sixb] __Host- auth cookies require secure cookies.");
+  }
+}
+function assertValidCookieName(name, label) {
+  if (!/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name)) {
+    throw new Error(`[Sixb] Auth cookie ${label} '${name}' is not a valid cookie name.`);
+  }
+}
+function isHostPrefixedCookieName(name) {
+  return name.startsWith("__Host-");
+}
+function requiresSecureCookieName(name) {
+  return isHostPrefixedCookieName(name) || name.startsWith("__Secure-");
+}
+
+// src/auth/validation.ts
+var DAY = 24 * 60 * 60 * 1000;
+var DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS = 30 * DAY;
+var DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS = 7 * DAY;
+var DEFAULT_AUTH_INVITATION_TTL_MS = 7 * DAY;
+var MAX_AUTH_INVITATION_TTL_MS = 30 * DAY;
+var DEFAULT_AUTH_SESSION_CACHE_TTL_MS = 5000;
+function resolveAuthConfig(config) {
+  if (!config) {
+    return {
+      strategy: null,
+      session: resolveAuthSessionOptions(undefined),
+      cookies: resolveAuthCookieOptions(undefined)
+    };
+  }
+  const strategy = "strategy" in config ? config.strategy : config;
+  assertValidStrategy(strategy);
+  return {
+    strategy,
+    session: resolveAuthSessionOptions("strategy" in config ? config.session : undefined),
+    cookies: resolveAuthCookieOptions("strategy" in config ? config.cookies : undefined)
+  };
+}
+function resolveInvitationExpiresAt(value, now) {
+  const expiresAt = value ? new Date(value) : new Date(now.getTime() + DEFAULT_AUTH_INVITATION_TTL_MS);
+  const expiresAtTime = expiresAt.getTime();
+  if (!Number.isFinite(expiresAtTime)) {
+    throw new AuthRuntimeError("invalid_auth_input", "[Sixb] Invitation expiresAt must be a valid date.");
+  }
+  if (expiresAtTime <= now.getTime()) {
+    throw new AuthRuntimeError("invalid_auth_input", "[Sixb] Invitation expiresAt must be in the future.");
+  }
+  if (expiresAtTime > now.getTime() + MAX_AUTH_INVITATION_TTL_MS) {
+    throw new AuthRuntimeError("invalid_auth_input", "[Sixb] Invitation expiresAt must be no more than 30 days in the future.");
+  }
+  return expiresAt;
+}
+function sanitizeReturnTo(value) {
+  if (!value || !value.startsWith("/") || value.startsWith("//")) {
+    return "/";
+  }
+  try {
+    const parsed = new URL(value, "http://sixb.local");
+    if (parsed.origin !== "http://sixb.local") {
+      return "/";
+    }
+    return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+  } catch {
+    return "/";
+  }
+}
+function assertNonEmpty(value, label) {
+  const normalized = value.trim();
+  if (!normalized) {
+    throw new AuthRuntimeError("invalid_auth_input", `[Sixb] ${label} must be a non-empty string.`);
+  }
+  return normalized;
+}
+function normalizePagination(input) {
+  if (input.limit !== undefined && (!Number.isInteger(input.limit) || input.limit < 0)) {
+    throw new AuthRuntimeError("invalid_auth_input", "[Sixb] Invitation list limit must be a non-negative integer.");
+  }
+  if (input.offset !== undefined && (!Number.isInteger(input.offset) || input.offset < 0)) {
+    throw new AuthRuntimeError("invalid_auth_input", "[Sixb] Invitation list offset must be a non-negative integer.");
+  }
+  return {
+    limit: input.limit,
+    offset: input.offset ?? 0
+  };
+}
+function resolveAuthSessionOptions(options) {
+  const idleTimeoutMs = options?.idleTimeoutMs ?? DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS;
+  if (!Number.isFinite(idleTimeoutMs) || idleTimeoutMs <= 0) {
+    throw new AuthRuntimeError("invalid_auth_config", "[Sixb] Auth session idleTimeoutMs must be a positive finite number.");
+  }
+  const renewalWindowMs = options?.renewalWindowMs ?? DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS;
+  if (!Number.isFinite(renewalWindowMs) || renewalWindowMs <= 0) {
+    throw new AuthRuntimeError("invalid_auth_config", "[Sixb] Auth session renewalWindowMs must be a positive finite number.");
+  }
+  if (renewalWindowMs >= idleTimeoutMs) {
+    throw new AuthRuntimeError("invalid_auth_config", "[Sixb] Auth session renewalWindowMs must be less than idleTimeoutMs.");
+  }
+  const absoluteTimeoutMs = options?.absoluteTimeoutMs;
+  if (absoluteTimeoutMs !== undefined && (!Number.isFinite(absoluteTimeoutMs) || absoluteTimeoutMs <= 0)) {
+    throw new AuthRuntimeError("invalid_auth_config", "[Sixb] Auth session absoluteTimeoutMs must be a positive finite number when configured.");
+  }
+  if (absoluteTimeoutMs !== undefined && absoluteTimeoutMs < idleTimeoutMs) {
+    throw new AuthRuntimeError("invalid_auth_config", "[Sixb] Auth session absoluteTimeoutMs must be greater than or equal to idleTimeoutMs.");
+  }
+  const cacheTtlMs = options?.cacheTtlMs ?? DEFAULT_AUTH_SESSION_CACHE_TTL_MS;
+  if (!Number.isFinite(cacheTtlMs) || cacheTtlMs < 0) {
+    throw new AuthRuntimeError("invalid_auth_config", "[Sixb] Auth session cacheTtlMs must be a non-negative finite number.");
+  }
+  if (cacheTtlMs >= renewalWindowMs) {
+    throw new AuthRuntimeError("invalid_auth_config", "[Sixb] Auth session cacheTtlMs must be less than renewalWindowMs.");
+  }
+  return {
+    idleTimeoutMs,
+    renewalWindowMs,
+    ...absoluteTimeoutMs === undefined ? {} : { absoluteTimeoutMs },
+    cacheTtlMs
+  };
+}
+function isMagicLinkAuthStrategy(strategy) {
+  if (!strategy || strategy.kind !== "magicLink") {
+    return false;
+  }
+  const candidate = strategy;
+  return typeof candidate.requestMagicLink === "function" && typeof candidate.completeMagicLinkSignIn === "function";
+}
+function isInvitationDeliveryAuthStrategy(strategy) {
+  if (!strategy) {
+    return false;
+  }
+  const candidate = strategy;
+  return typeof candidate.deliverInvitation === "function";
+}
+function isOidcAuthStrategy(strategy) {
+  if (!strategy || strategy.kind !== "oidc") {
+    return false;
+  }
+  const candidate = strategy;
+  return typeof candidate.startOidcSignIn === "function" && typeof candidate.completeOidcSignIn === "function";
+}
+function assertValidStrategy(strategy) {
+  if (!strategy.id.trim()) {
+    throw new AuthRuntimeError("invalid_auth_config", "[Sixb] Auth strategy id is required.");
+  }
+}
+
+export { AuthRuntimeError, DEFAULT_AUTH_SESSION_AUDIENCE, isValidAuthSessionAudience, resolveAuthSessionAudience, DEFAULT_SESSION_COOKIE_NAME, DEFAULT_CSRF_COOKIE_NAME, resolveAuthCookieOptions, resolveAuthCookieOptionsForAudience, parseCookieHeader, getCookie, serializeCookie, shouldUseSecureCookies, createSessionCookieHeader, createCsrfCookieHeader, clearSessionCookieHeader, clearCsrfCookieHeader, DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS, DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS, DEFAULT_AUTH_INVITATION_TTL_MS, MAX_AUTH_INVITATION_TTL_MS, DEFAULT_AUTH_SESSION_CACHE_TTL_MS, resolveAuthConfig, resolveInvitationExpiresAt, sanitizeReturnTo, assertNonEmpty, normalizePagination, isMagicLinkAuthStrategy, isInvitationDeliveryAuthStrategy, isOidcAuthStrategy };
+
+//# debugId=2A406F7EC52A3A9A64756E2164756E21

package/dist/chunk-xwnf87e1.js.map

@@ -0,0 +1,13 @@
+{
+  "version": 3,
+  "sources": ["../src/auth/errors.ts", "../src/auth/audience.ts", "../src/auth/cookies.ts", "../src/auth/validation.ts"],
+  "sourcesContent": [
+    "export type AuthRuntimeErrorCode =\n  | \"authentication_required\"\n  | \"auth_storage_missing\"\n  | \"authorization_denied\"\n  | \"invalid_auth_input\"\n  | \"invalid_auth_config\"\n  | \"rate_limited\"\n  | \"production_auth_required\"\n\nexport class AuthRuntimeError extends Error {\n  readonly name = \"AuthRuntimeError\"\n\n  constructor(\n    readonly code: AuthRuntimeErrorCode,\n    message: string\n  ) {\n    super(message)\n  }\n}\n",
+    "import { AuthRuntimeError } from \"./errors\"\n\nexport const DEFAULT_AUTH_SESSION_AUDIENCE = \"atlas\"\n\nexport type AuthSessionAudience = typeof DEFAULT_AUTH_SESSION_AUDIENCE | \"app\"\n\nexport interface AuthSessionAudienceOptions {\n  readonly audience?: AuthSessionAudience\n}\n\nexport function isValidAuthSessionAudience(value: string): value is AuthSessionAudience {\n  return value === \"atlas\" || value === \"app\"\n}\n\nexport function resolveAuthSessionAudience(\n  value: AuthSessionAudience | undefined\n): AuthSessionAudience {\n  const audience = value ?? DEFAULT_AUTH_SESSION_AUDIENCE\n\n  if (!isValidAuthSessionAudience(audience)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      `[Sixb] Auth session audience '${audience}' is invalid. Expected 'atlas' or 'app'.`\n    )\n  }\n\n  return audience\n}\n",
+    "import type { AuthSessionAudience } from \"./audience\"\nimport { DEFAULT_AUTH_SESSION_AUDIENCE, resolveAuthSessionAudience } from \"./audience\"\nimport type { AuthCookieOptions } from \"./types\"\n\nexport const DEFAULT_SESSION_COOKIE_NAME = \"sixb_session\"\nexport const DEFAULT_CSRF_COOKIE_NAME = \"sixb_csrf\"\n\nexport interface ResolvedAuthCookieOptions {\n  readonly sessionCookieName: string\n  readonly csrfCookieName: string\n  readonly domain?: string\n  readonly secure: boolean | \"auto\"\n  readonly sameSite: \"strict\"\n  readonly csrfHttpOnly: boolean\n}\n\ninterface CookieSerializationOptions {\n  readonly name: string\n  readonly value: string\n  readonly httpOnly?: boolean\n  readonly maxAge?: number\n  readonly expires?: Date\n  readonly domain?: string\n  readonly secure?: boolean\n  readonly sameSite: \"strict\"\n}\n\nexport function resolveAuthCookieOptions(\n  options: AuthCookieOptions | undefined\n): ResolvedAuthCookieOptions {\n  const resolved = {\n    sessionCookieName: options?.sessionCookieName ?? DEFAULT_SESSION_COOKIE_NAME,\n    csrfCookieName: options?.csrfCookieName ?? DEFAULT_CSRF_COOKIE_NAME,\n    domain: options?.cookieDomain,\n    secure: options?.secure ?? \"auto\",\n    sameSite: options?.sameSite ?? \"strict\",\n    csrfHttpOnly: options?.csrfHttpOnly ?? false,\n  }\n\n  assertValidCookieOptions(resolved)\n  return resolved\n}\n\nexport function resolveAuthCookieOptionsForAudience(\n  options: ResolvedAuthCookieOptions,\n  audience: AuthSessionAudience | undefined\n): ResolvedAuthCookieOptions {\n  const resolvedAudience = resolveAuthSessionAudience(audience)\n  if (resolvedAudience === DEFAULT_AUTH_SESSION_AUDIENCE) {\n    return options\n  }\n\n  return {\n    ...options,\n    sessionCookieName: `${options.sessionCookieName}_${resolvedAudience}`,\n    csrfCookieName: `${options.csrfCookieName}_${resolvedAudience}`,\n  }\n}\n\nexport function parseCookieHeader(header: string | null): ReadonlyMap<string, string> {\n  const cookies = new Map<string, string>()\n  if (!header) {\n    return cookies\n  }\n\n  for (const part of header.split(\";\")) {\n    const separator = part.indexOf(\"=\")\n    if (separator <= 0) {\n      continue\n    }\n\n    const name = part.slice(0, separator).trim()\n    if (!name || cookies.has(name)) {\n      continue\n    }\n\n    const value = part.slice(separator + 1).trim()\n    cookies.set(name, value)\n  }\n\n  return cookies\n}\n\nexport function getCookie(request: Request, name: string): string | undefined {\n  return parseCookieHeader(request.headers.get(\"cookie\")).get(name)\n}\n\nexport function serializeCookie(options: CookieSerializationOptions): string {\n  const parts = [`${options.name}=${options.value}`]\n\n  parts.push(\"Path=/\")\n  parts.push(\"SameSite=Strict\")\n\n  if (options.domain) {\n    parts.push(`Domain=${options.domain}`)\n  }\n\n  if (options.httpOnly) {\n    parts.push(\"HttpOnly\")\n  }\n\n  if (options.secure) {\n    parts.push(\"Secure\")\n  }\n\n  if (options.maxAge !== undefined) {\n    parts.push(`Max-Age=${Math.trunc(options.maxAge)}`)\n  }\n\n  if (options.expires) {\n    parts.push(`Expires=${options.expires.toUTCString()}`)\n  }\n\n  return parts.join(\"; \")\n}\n\nexport function shouldUseSecureCookies(\n  request: Request,\n  options: ResolvedAuthCookieOptions\n): boolean {\n  if (\n    requiresSecureCookieName(options.sessionCookieName) ||\n    requiresSecureCookieName(options.csrfCookieName)\n  ) {\n    return true\n  }\n\n  if (typeof options.secure === \"boolean\") {\n    return options.secure\n  }\n\n  const url = new URL(request.url)\n  if (isLocalhost(url.hostname)) {\n    return false\n  }\n\n  return url.protocol === \"https:\" || process.env.NODE_ENV === \"production\"\n}\n\nexport function createSessionCookieHeader(params: {\n  readonly request: Request\n  readonly value: string\n  readonly expiresAt: Date\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  const lifetime = resolveCookieLifetime(params.expiresAt)\n  return serializeCookie({\n    name: params.options.sessionCookieName,\n    value: params.value,\n    httpOnly: true,\n    ...lifetime,\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nexport function createCsrfCookieHeader(params: {\n  readonly request: Request\n  readonly value: string\n  readonly expiresAt: Date\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  const lifetime = resolveCookieLifetime(params.expiresAt)\n  return serializeCookie({\n    name: params.options.csrfCookieName,\n    value: params.value,\n    httpOnly: params.options.csrfHttpOnly,\n    ...lifetime,\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nfunction resolveCookieLifetime(expiresAt: Date): {\n  readonly maxAge: number\n  readonly expires: Date\n} {\n  const expiresAtMs = expiresAt.getTime()\n  if (!Number.isFinite(expiresAtMs)) {\n    throw new Error(\"[Sixb] Auth cookie expiresAt must be a valid date.\")\n  }\n\n  return {\n    maxAge: Math.max(0, Math.floor((expiresAtMs - Date.now()) / 1000)),\n    expires: new Date(expiresAtMs),\n  }\n}\n\nexport function clearSessionCookieHeader(params: {\n  readonly request: Request\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  return serializeCookie({\n    name: params.options.sessionCookieName,\n    value: \"\",\n    httpOnly: true,\n    maxAge: 0,\n    expires: new Date(0),\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nexport function clearCsrfCookieHeader(params: {\n  readonly request: Request\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  return serializeCookie({\n    name: params.options.csrfCookieName,\n    value: \"\",\n    maxAge: 0,\n    expires: new Date(0),\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nfunction isLocalhost(hostname: string): boolean {\n  return hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n}\n\nfunction assertValidCookieOptions(options: ResolvedAuthCookieOptions): void {\n  assertValidCookieName(options.sessionCookieName, \"sessionCookieName\")\n  assertValidCookieName(options.csrfCookieName, \"csrfCookieName\")\n\n  if (options.sameSite !== \"strict\") {\n    throw new Error(\"[Sixb] Auth cookie sameSite must be 'strict'.\")\n  }\n\n  if (\n    options.domain &&\n    (isHostPrefixedCookieName(options.sessionCookieName) ||\n      isHostPrefixedCookieName(options.csrfCookieName))\n  ) {\n    throw new Error(\"[Sixb] __Host- auth cookies cannot be configured with cookieDomain.\")\n  }\n\n  if (\n    options.secure === false &&\n    (requiresSecureCookieName(options.sessionCookieName) ||\n      requiresSecureCookieName(options.csrfCookieName))\n  ) {\n    throw new Error(\"[Sixb] __Host- auth cookies require secure cookies.\")\n  }\n}\n\nfunction assertValidCookieName(name: string, label: string): void {\n  if (!/^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/.test(name)) {\n    throw new Error(`[Sixb] Auth cookie ${label} '${name}' is not a valid cookie name.`)\n  }\n}\n\nfunction isHostPrefixedCookieName(name: string): boolean {\n  return name.startsWith(\"__Host-\")\n}\n\nfunction requiresSecureCookieName(name: string): boolean {\n  return isHostPrefixedCookieName(name) || name.startsWith(\"__Secure-\")\n}\n",
+    "import { resolveAuthCookieOptions } from \"./cookies\"\nimport { AuthRuntimeError } from \"./errors\"\nimport type {\n  AuthSessionOptions,\n  AuthStrategy,\n  InvitationDeliveryAuthStrategy,\n  MagicLinkAuthStrategy,\n  OidcAuthStrategy,\n  ResolvedAuthConfig,\n  SixbAuthConfig,\n} from \"./types\"\n\nconst DAY = 24 * 60 * 60 * 1000\n\nexport const DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS = 30 * DAY\nexport const DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS = 7 * DAY\nexport const DEFAULT_AUTH_INVITATION_TTL_MS = 7 * DAY\nexport const MAX_AUTH_INVITATION_TTL_MS = 30 * DAY\n/**\n * Default in-process session cache window. Short enough that a revoked session lingers\n * only briefly, long enough to collapse a burst of requests to a single auth resolution.\n */\nexport const DEFAULT_AUTH_SESSION_CACHE_TTL_MS = 5_000\n\nexport { resolveAuthSessionAudience } from \"./audience\"\n\nexport function resolveAuthConfig(config: SixbAuthConfig | undefined): ResolvedAuthConfig {\n  if (!config) {\n    return {\n      strategy: null,\n      session: resolveAuthSessionOptions(undefined),\n      cookies: resolveAuthCookieOptions(undefined),\n    }\n  }\n\n  const strategy = \"strategy\" in config ? config.strategy : config\n  assertValidStrategy(strategy)\n\n  return {\n    strategy,\n    session: resolveAuthSessionOptions(\"strategy\" in config ? config.session : undefined),\n    cookies: resolveAuthCookieOptions(\"strategy\" in config ? config.cookies : undefined),\n  }\n}\n\nexport function resolveInvitationExpiresAt(value: Date | undefined, now: Date): Date {\n  const expiresAt = value\n    ? new Date(value)\n    : new Date(now.getTime() + DEFAULT_AUTH_INVITATION_TTL_MS)\n  const expiresAtTime = expiresAt.getTime()\n\n  if (!Number.isFinite(expiresAtTime)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation expiresAt must be a valid date.\"\n    )\n  }\n\n  if (expiresAtTime <= now.getTime()) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation expiresAt must be in the future.\"\n    )\n  }\n\n  if (expiresAtTime > now.getTime() + MAX_AUTH_INVITATION_TTL_MS) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation expiresAt must be no more than 30 days in the future.\"\n    )\n  }\n\n  return expiresAt\n}\n\nexport function sanitizeReturnTo(value: string | undefined): string {\n  if (!value || !value.startsWith(\"/\") || value.startsWith(\"//\")) {\n    return \"/\"\n  }\n\n  try {\n    const parsed = new URL(value, \"http://sixb.local\")\n    if (parsed.origin !== \"http://sixb.local\") {\n      return \"/\"\n    }\n\n    return `${parsed.pathname}${parsed.search}${parsed.hash}`\n  } catch {\n    return \"/\"\n  }\n}\n\nexport function assertNonEmpty(value: string, label: string): string {\n  const normalized = value.trim()\n  if (!normalized) {\n    throw new AuthRuntimeError(\"invalid_auth_input\", `[Sixb] ${label} must be a non-empty string.`)\n  }\n  return normalized\n}\n\nexport function normalizePagination(input: { readonly limit?: number; readonly offset?: number }): {\n  readonly limit?: number\n  readonly offset: number\n} {\n  if (input.limit !== undefined && (!Number.isInteger(input.limit) || input.limit < 0)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation list limit must be a non-negative integer.\"\n    )\n  }\n\n  if (input.offset !== undefined && (!Number.isInteger(input.offset) || input.offset < 0)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation list offset must be a non-negative integer.\"\n    )\n  }\n\n  return {\n    limit: input.limit,\n    offset: input.offset ?? 0,\n  }\n}\n\nfunction resolveAuthSessionOptions(\n  options: AuthSessionOptions | undefined\n): ResolvedAuthConfig[\"session\"] {\n  const idleTimeoutMs = options?.idleTimeoutMs ?? DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS\n  if (!Number.isFinite(idleTimeoutMs) || idleTimeoutMs <= 0) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session idleTimeoutMs must be a positive finite number.\"\n    )\n  }\n\n  const renewalWindowMs = options?.renewalWindowMs ?? DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS\n  if (!Number.isFinite(renewalWindowMs) || renewalWindowMs <= 0) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session renewalWindowMs must be a positive finite number.\"\n    )\n  }\n  if (renewalWindowMs >= idleTimeoutMs) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session renewalWindowMs must be less than idleTimeoutMs.\"\n    )\n  }\n\n  const absoluteTimeoutMs = options?.absoluteTimeoutMs\n  if (\n    absoluteTimeoutMs !== undefined &&\n    (!Number.isFinite(absoluteTimeoutMs) || absoluteTimeoutMs <= 0)\n  ) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session absoluteTimeoutMs must be a positive finite number when configured.\"\n    )\n  }\n  if (absoluteTimeoutMs !== undefined && absoluteTimeoutMs < idleTimeoutMs) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session absoluteTimeoutMs must be greater than or equal to idleTimeoutMs.\"\n    )\n  }\n\n  const cacheTtlMs = options?.cacheTtlMs ?? DEFAULT_AUTH_SESSION_CACHE_TTL_MS\n  if (!Number.isFinite(cacheTtlMs) || cacheTtlMs < 0) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session cacheTtlMs must be a non-negative finite number.\"\n    )\n  }\n  if (cacheTtlMs >= renewalWindowMs) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session cacheTtlMs must be less than renewalWindowMs.\"\n    )\n  }\n\n  return {\n    idleTimeoutMs,\n    renewalWindowMs,\n    ...(absoluteTimeoutMs === undefined ? {} : { absoluteTimeoutMs }),\n    cacheTtlMs,\n  }\n}\n\nexport function isMagicLinkAuthStrategy(\n  strategy: AuthStrategy | null\n): strategy is MagicLinkAuthStrategy {\n  if (!strategy || strategy.kind !== \"magicLink\") {\n    return false\n  }\n\n  const candidate = strategy as {\n    readonly requestMagicLink?: unknown\n    readonly completeMagicLinkSignIn?: unknown\n  }\n\n  return (\n    typeof candidate.requestMagicLink === \"function\" &&\n    typeof candidate.completeMagicLinkSignIn === \"function\"\n  )\n}\n\nexport function isInvitationDeliveryAuthStrategy(\n  strategy: AuthStrategy | null\n): strategy is InvitationDeliveryAuthStrategy {\n  if (!strategy) {\n    return false\n  }\n\n  const candidate = strategy as {\n    readonly deliverInvitation?: unknown\n  }\n\n  return typeof candidate.deliverInvitation === \"function\"\n}\n\nexport function isOidcAuthStrategy(strategy: AuthStrategy | null): strategy is OidcAuthStrategy {\n  if (!strategy || strategy.kind !== \"oidc\") {\n    return false\n  }\n\n  const candidate = strategy as {\n    readonly startOidcSignIn?: unknown\n    readonly completeOidcSignIn?: unknown\n  }\n\n  return (\n    typeof candidate.startOidcSignIn === \"function\" &&\n    typeof candidate.completeOidcSignIn === \"function\"\n  )\n}\n\nfunction assertValidStrategy(strategy: AuthStrategy): void {\n  if (!strategy.id.trim()) {\n    throw new AuthRuntimeError(\"invalid_auth_config\", \"[Sixb] Auth strategy id is required.\")\n  }\n}\n"
+  ],
+  "mappings": ";;AASO,MAAM,yBAAyB,MAAM;AAAA,EAI/B;AAAA,EAHF,OAAO;AAAA,EAEhB,WAAW,CACA,MACT,SACA;AAAA,IACA,MAAM,OAAO;AAAA,IAHJ;AAAA;AAKb;;;AChBO,IAAM,gCAAgC;AAQtC,SAAS,0BAA0B,CAAC,OAA6C;AAAA,EACtF,OAAO,UAAU,WAAW,UAAU;AAAA;AAGjC,SAAS,0BAA0B,CACxC,OACqB;AAAA,EACrB,MAAM,WAAW,SAAS;AAAA,EAE1B,IAAI,CAAC,2BAA2B,QAAQ,GAAG;AAAA,IACzC,MAAM,IAAI,iBACR,uBACA,iCAAiC,kDACnC;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;;;ACtBF,IAAM,8BAA8B;AACpC,IAAM,2BAA2B;AAsBjC,SAAS,wBAAwB,CACtC,SAC2B;AAAA,EAC3B,MAAM,WAAW;AAAA,IACf,mBAAmB,SAAS,qBAAqB;AAAA,IACjD,gBAAgB,SAAS,kBAAkB;AAAA,IAC3C,QAAQ,SAAS;AAAA,IACjB,QAAQ,SAAS,UAAU;AAAA,IAC3B,UAAU,SAAS,YAAY;AAAA,IAC/B,cAAc,SAAS,gBAAgB;AAAA,EACzC;AAAA,EAEA,yBAAyB,QAAQ;AAAA,EACjC,OAAO;AAAA;AAGF,SAAS,mCAAmC,CACjD,SACA,UAC2B;AAAA,EAC3B,MAAM,mBAAmB,2BAA2B,QAAQ;AAAA,EAC5D,IAAI,qBAAqB,+BAA+B;AAAA,IACtD,OAAO;AAAA,EACT;AAAA,EAEA,OAAO;AAAA,OACF;AAAA,IACH,mBAAmB,GAAG,QAAQ,qBAAqB;AAAA,IACnD,gBAAgB,GAAG,QAAQ,kBAAkB;AAAA,EAC/C;AAAA;AAGK,SAAS,iBAAiB,CAAC,QAAoD;AAAA,EACpF,MAAM,UAAU,IAAI;AAAA,EACpB,IAAI,CAAC,QAAQ;AAAA,IACX,OAAO;AAAA,EACT;AAAA,EAEA,WAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AAAA,IACpC,MAAM,YAAY,KAAK,QAAQ,GAAG;AAAA,IAClC,IAAI,aAAa,GAAG;AAAA,MAClB;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK;AAAA,IAC3C,IAAI,CAAC,QAAQ,QAAQ,IAAI,IAAI,GAAG;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,MAAM,QAAQ,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK;AAAA,IAC7C,QAAQ,IAAI,MAAM,KAAK;AAAA,EACzB;AAAA,EAEA,OAAO;AAAA;AAGF,SAAS,SAAS,CAAC,SAAkB,MAAkC;AAAA,EAC5E,OAAO,kBAAkB,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,IAAI;AAAA;AAG3D,SAAS,eAAe,CAAC,SAA6C;AAAA,EAC3E,MAAM,QAAQ,CAAC,GAAG,QAAQ,QAAQ,QAAQ,OAAO;AAAA,EAEjD,MAAM,KAAK,QAAQ;AAAA,EACnB,MAAM,KAAK,iBAAiB;AAAA,EAE5B,IAAI,QAAQ,QAAQ;AAAA,IAClB,MAAM,KAAK,UAAU,QAAQ,QAAQ;AAAA,EACvC;AAAA,EAEA,IAAI,QAAQ,UAAU;AAAA,IACpB,MAAM,KAAK,UAAU;AAAA,EACvB;AAAA,EAEA,IAAI,QAAQ,QAAQ;AAAA,IAClB,MAAM,KAAK,QAAQ;AAAA,EACrB;AAAA,EAEA,IAAI,QAAQ,WAAW,WAAW;AAAA,IAChC,MAAM,KAAK,WAAW,KAAK,MAAM,QAAQ,MAAM,GAAG;AAAA,EACpD;AAAA,EAEA,IAAI,QAAQ,SAAS;AAAA,IACnB,MAAM,KAAK,WAAW,QAAQ,QAAQ,YAAY,GAAG;AAAA,EACvD;AAAA,EAEA,OAAO,MAAM,KAAK,IAAI;AAAA;AAGjB,SAAS,sBAAsB,CACpC,SACA,SACS;AAAA,EACT,IACE,yBAAyB,QAAQ,iBAAiB,KAClD,yBAAyB,QAAQ,cAAc,GAC/C;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,OAAO,QAAQ,WAAW,WAAW;AAAA,IACvC,OAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAAA,EAC/B,IAAI,YAAY,IAAI,QAAQ,GAAG;AAAA,IAC7B,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,IAAI,aAAa,YAAY;AAAA;AAG/B,SAAS,yBAAyB,CAAC,QAK/B;AAAA,EACT,MAAM,WAAW,sBAAsB,OAAO,SAAS;AAAA,EACvD,OAAO,gBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO,OAAO;AAAA,IACd,UAAU;AAAA,OACP;AAAA,IACH,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,uBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGI,SAAS,sBAAsB,CAAC,QAK5B;AAAA,EACT,MAAM,WAAW,sBAAsB,OAAO,SAAS;AAAA,EACvD,OAAO,gBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO,OAAO;AAAA,IACd,UAAU,OAAO,QAAQ;AAAA,OACtB;AAAA,IACH,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,uBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGH,SAAS,qBAAqB,CAAC,WAG7B;AAAA,EACA,MAAM,cAAc,UAAU,QAAQ;AAAA,EACtC,IAAI,CAAC,OAAO,SAAS,WAAW,GAAG;AAAA,IACjC,MAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AAAA,EAEA,OAAO;AAAA,IACL,QAAQ,KAAK,IAAI,GAAG,KAAK,OAAO,cAAc,KAAK,IAAI,KAAK,IAAI,CAAC;AAAA,IACjE,SAAS,IAAI,KAAK,WAAW;AAAA,EAC/B;AAAA;AAGK,SAAS,wBAAwB,CAAC,QAG9B;AAAA,EACT,OAAO,gBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO;AAAA,IACP,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,SAAS,IAAI,KAAK,CAAC;AAAA,IACnB,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,uBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGI,SAAS,qBAAqB,CAAC,QAG3B;AAAA,EACT,OAAO,gBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS,IAAI,KAAK,CAAC;AAAA,IACnB,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,uBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGH,SAAS,WAAW,CAAC,UAA2B;AAAA,EAC9C,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAAA;AAG9E,SAAS,wBAAwB,CAAC,SAA0C;AAAA,EAC1E,sBAAsB,QAAQ,mBAAmB,mBAAmB;AAAA,EACpE,sBAAsB,QAAQ,gBAAgB,gBAAgB;AAAA,EAE9D,IAAI,QAAQ,aAAa,UAAU;AAAA,IACjC,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EAEA,IACE,QAAQ,WACP,yBAAyB,QAAQ,iBAAiB,KACjD,yBAAyB,QAAQ,cAAc,IACjD;AAAA,IACA,MAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAAA,EAEA,IACE,QAAQ,WAAW,UAClB,yBAAyB,QAAQ,iBAAiB,KACjD,yBAAyB,QAAQ,cAAc,IACjD;AAAA,IACA,MAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AAAA;AAGF,SAAS,qBAAqB,CAAC,MAAc,OAAqB;AAAA,EAChE,IAAI,CAAC,iCAAiC,KAAK,IAAI,GAAG;AAAA,IAChD,MAAM,IAAI,MAAM,sBAAsB,UAAU,mCAAmC;AAAA,EACrF;AAAA;AAGF,SAAS,wBAAwB,CAAC,MAAuB;AAAA,EACvD,OAAO,KAAK,WAAW,SAAS;AAAA;AAGlC,SAAS,wBAAwB,CAAC,MAAuB;AAAA,EACvD,OAAO,yBAAyB,IAAI,KAAK,KAAK,WAAW,WAAW;AAAA;;;ACzPtE,IAAM,MAAM,KAAK,KAAK,KAAK;AAEpB,IAAM,uCAAuC,KAAK;AAClD,IAAM,yCAAyC,IAAI;AACnD,IAAM,iCAAiC,IAAI;AAC3C,IAAM,6BAA6B,KAAK;AAKxC,IAAM,oCAAoC;AAI1C,SAAS,iBAAiB,CAAC,QAAwD;AAAA,EACxF,IAAI,CAAC,QAAQ;AAAA,IACX,OAAO;AAAA,MACL,UAAU;AAAA,MACV,SAAS,0BAA0B,SAAS;AAAA,MAC5C,SAAS,yBAAyB,SAAS;AAAA,IAC7C;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,cAAc,SAAS,OAAO,WAAW;AAAA,EAC1D,oBAAoB,QAAQ;AAAA,EAE5B,OAAO;AAAA,IACL;AAAA,IACA,SAAS,0BAA0B,cAAc,SAAS,OAAO,UAAU,SAAS;AAAA,IACpF,SAAS,yBAAyB,cAAc,SAAS,OAAO,UAAU,SAAS;AAAA,EACrF;AAAA;AAGK,SAAS,0BAA0B,CAAC,OAAyB,KAAiB;AAAA,EACnF,MAAM,YAAY,QACd,IAAI,KAAK,KAAK,IACd,IAAI,KAAK,IAAI,QAAQ,IAAI,8BAA8B;AAAA,EAC3D,MAAM,gBAAgB,UAAU,QAAQ;AAAA,EAExC,IAAI,CAAC,OAAO,SAAS,aAAa,GAAG;AAAA,IACnC,MAAM,IAAI,iBACR,sBACA,mDACF;AAAA,EACF;AAAA,EAEA,IAAI,iBAAiB,IAAI,QAAQ,GAAG;AAAA,IAClC,MAAM,IAAI,iBACR,sBACA,oDACF;AAAA,EACF;AAAA,EAEA,IAAI,gBAAgB,IAAI,QAAQ,IAAI,4BAA4B;AAAA,IAC9D,MAAM,IAAI,iBACR,sBACA,yEACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;AAGF,SAAS,gBAAgB,CAAC,OAAmC;AAAA,EAClE,IAAI,CAAC,SAAS,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,GAAG;AAAA,IAC9D,OAAO;AAAA,EACT;AAAA,EAEA,IAAI;AAAA,IACF,MAAM,SAAS,IAAI,IAAI,OAAO,mBAAmB;AAAA,IACjD,IAAI,OAAO,WAAW,qBAAqB;AAAA,MACzC,OAAO;AAAA,IACT;AAAA,IAEA,OAAO,GAAG,OAAO,WAAW,OAAO,SAAS,OAAO;AAAA,IACnD,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,cAAc,CAAC,OAAe,OAAuB;AAAA,EACnE,MAAM,aAAa,MAAM,KAAK;AAAA,EAC9B,IAAI,CAAC,YAAY;AAAA,IACf,MAAM,IAAI,iBAAiB,sBAAsB,UAAU,mCAAmC;AAAA,EAChG;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,mBAAmB,CAAC,OAGlC;AAAA,EACA,IAAI,MAAM,UAAU,cAAc,CAAC,OAAO,UAAU,MAAM,KAAK,KAAK,MAAM,QAAQ,IAAI;AAAA,IACpF,MAAM,IAAI,iBACR,sBACA,8DACF;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,WAAW,cAAc,CAAC,OAAO,UAAU,MAAM,MAAM,KAAK,MAAM,SAAS,IAAI;AAAA,IACvF,MAAM,IAAI,iBACR,sBACA,+DACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,QAAQ,MAAM,UAAU;AAAA,EAC1B;AAAA;AAGF,SAAS,yBAAyB,CAChC,SAC+B;AAAA,EAC/B,MAAM,gBAAgB,SAAS,iBAAiB;AAAA,EAChD,IAAI,CAAC,OAAO,SAAS,aAAa,KAAK,iBAAiB,GAAG;AAAA,IACzD,MAAM,IAAI,iBACR,uBACA,qEACF;AAAA,EACF;AAAA,EAEA,MAAM,kBAAkB,SAAS,mBAAmB;AAAA,EACpD,IAAI,CAAC,OAAO,SAAS,eAAe,KAAK,mBAAmB,GAAG;AAAA,IAC7D,MAAM,IAAI,iBACR,uBACA,uEACF;AAAA,EACF;AAAA,EACA,IAAI,mBAAmB,eAAe;AAAA,IACpC,MAAM,IAAI,iBACR,uBACA,sEACF;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,SAAS;AAAA,EACnC,IACE,sBAAsB,cACrB,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,IAC7D;AAAA,IACA,MAAM,IAAI,iBACR,uBACA,yFACF;AAAA,EACF;AAAA,EACA,IAAI,sBAAsB,aAAa,oBAAoB,eAAe;AAAA,IACxE,MAAM,IAAI,iBACR,uBACA,uFACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAAS,cAAc;AAAA,EAC1C,IAAI,CAAC,OAAO,SAAS,UAAU,KAAK,aAAa,GAAG;AAAA,IAClD,MAAM,IAAI,iBACR,uBACA,sEACF;AAAA,EACF;AAAA,EACA,IAAI,cAAc,iBAAiB;AAAA,IACjC,MAAM,IAAI,iBACR,uBACA,mEACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,OACI,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB;AAAA,IAC/D;AAAA,EACF;AAAA;AAGK,SAAS,uBAAuB,CACrC,UACmC;AAAA,EACnC,IAAI,CAAC,YAAY,SAAS,SAAS,aAAa;AAAA,IAC9C,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAKlB,OACE,OAAO,UAAU,qBAAqB,cACtC,OAAO,UAAU,4BAA4B;AAAA;AAI1C,SAAS,gCAAgC,CAC9C,UAC4C;AAAA,EAC5C,IAAI,CAAC,UAAU;AAAA,IACb,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAIlB,OAAO,OAAO,UAAU,sBAAsB;AAAA;AAGzC,SAAS,kBAAkB,CAAC,UAA6D;AAAA,EAC9F,IAAI,CAAC,YAAY,SAAS,SAAS,QAAQ;AAAA,IACzC,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAKlB,OACE,OAAO,UAAU,oBAAoB,cACrC,OAAO,UAAU,uBAAuB;AAAA;AAI5C,SAAS,mBAAmB,CAAC,UAA8B;AAAA,EACzD,IAAI,CAAC,SAAS,GAAG,KAAK,GAAG;AAAA,IACvB,MAAM,IAAI,iBAAiB,uBAAuB,sCAAsC;AAAA,EAC1F;AAAA;",
+  "debugId": "2A406F7EC52A3A9A64756E2164756E21",
+  "names": []
+}

package/dist/chunk-xz5g49bp.js

@@ -0,0 +1,239 @@
+// @bun
+// src/queues/errors.ts
+class QueueError extends Error {
+  name = "QueueError";
+}
+// src/queues/in-memory.ts
+import { randomUUID } from "crypto";
+function assertNonEmpty(value, fieldName) {
+  if (value.trim().length === 0) {
+    throw new QueueError(`[Sixb] Queue ${fieldName} must not be empty`);
+  }
+}
+function parseTimestamp(value, fieldName) {
+  const timestamp = Date.parse(value);
+  if (Number.isNaN(timestamp)) {
+    throw new QueueError(`[Sixb] Queue ${fieldName} must be a valid timestamp`);
+  }
+  return timestamp;
+}
+function assertPositiveNumber(value, fieldName) {
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new QueueError(`[Sixb] Queue ${fieldName} must be greater than 0`);
+  }
+}
+function clearLease(record) {
+  record.leaseId = null;
+  record.claimedAt = null;
+  record.leaseExpiresAt = null;
+}
+function compareQueueRecords(left, right) {
+  const availableDifference = parseTimestamp(left.job.availableAt, "job.availableAt") - parseTimestamp(right.job.availableAt, "job.availableAt");
+  if (availableDifference !== 0) {
+    return availableDifference;
+  }
+  const createdDifference = parseTimestamp(left.job.createdAt, "job.createdAt") - parseTimestamp(right.job.createdAt, "job.createdAt");
+  if (createdDifference !== 0) {
+    return createdDifference;
+  }
+  return left.sequence - right.sequence;
+}
+function createQueueJob(projectId, newJob) {
+  const createdAt = new Date().toISOString();
+  const availableAt = newJob.availableAt ?? createdAt;
+  parseTimestamp(availableAt, "availableAt");
+  return {
+    id: newJob.id ?? randomUUID(),
+    projectId,
+    createdAt,
+    availableAt,
+    attempt: 0,
+    metadata: newJob.metadata ? structuredClone(newJob.metadata) : undefined,
+    type: newJob.type,
+    payload: structuredClone(newJob.payload)
+  };
+}
+function leaseExpiresAtMs(record) {
+  if (!record.leaseId || !record.leaseExpiresAt) {
+    return null;
+  }
+  return parseTimestamp(record.leaseExpiresAt, "leaseExpiresAt");
+}
+function toClaimedQueueJob(record) {
+  if (!record.leaseId || !record.claimedAt || !record.leaseExpiresAt) {
+    throw new QueueError(`[Sixb] Queue job '${record.job.id}' is not currently leased`);
+  }
+  return {
+    leaseId: record.leaseId,
+    claimedAt: record.claimedAt,
+    leaseExpiresAt: record.leaseExpiresAt,
+    job: structuredClone(record.job)
+  };
+}
+
+class InMemoryQueueStore {
+  recordsByProject = new Map;
+  nextSequence = 1;
+  add(projectId, queueId, job) {
+    const records = this.getOrCreateRecords(projectId);
+    records.push({
+      sequence: this.nextSequence,
+      queueId,
+      job,
+      state: "queued",
+      leaseId: null,
+      claimedAt: null,
+      leaseExpiresAt: null
+    });
+    this.nextSequence += 1;
+  }
+  list(projectId, queueId) {
+    const records = this.recordsByProject.get(projectId) ?? [];
+    return records.filter((record) => record.queueId === queueId);
+  }
+  find(projectId, queueId, jobId) {
+    return this.list(projectId, queueId).find((record) => record.job.id === jobId) ?? null;
+  }
+  getOrCreateRecords(projectId) {
+    const existing = this.recordsByProject.get(projectId);
+    if (existing) {
+      return existing;
+    }
+    const records = [];
+    this.recordsByProject.set(projectId, records);
+    return records;
+  }
+}
+
+class InMemoryQueue {
+  store;
+  queueId;
+  constructor(store, queueId) {
+    this.store = store;
+    this.queueId = queueId;
+    assertNonEmpty(queueId, "queueId");
+  }
+  async enqueue(params) {
+    assertNonEmpty(params.projectId, "projectId");
+    if (params.jobs.length === 0) {
+      return [];
+    }
+    const createdJobs = params.jobs.map((job) => {
+      if (job.id !== undefined)
+        assertNonEmpty(job.id, "job.id");
+      const existing = job.id ? this.store.find(params.projectId, this.queueId, job.id) : null;
+      if (existing)
+        return existing.job;
+      const created = createQueueJob(params.projectId, job);
+      this.store.add(params.projectId, this.queueId, created);
+      return created;
+    });
+    return createdJobs.map((job) => structuredClone(job));
+  }
+  async claim(params) {
+    assertNonEmpty(params.projectId, "projectId");
+    assertNonEmpty(params.workerId, "workerId");
+    const limit = params.limit ?? 1;
+    if (limit <= 0) {
+      return [];
+    }
+    const leaseMs = params.leaseMs ?? 30000;
+    assertPositiveNumber(leaseMs, "leaseMs");
+    const now = Date.now();
+    const claimable = this.store.list(params.projectId, this.queueId).filter((record) => {
+      if (record.state !== "queued") {
+        return false;
+      }
+      if (parseTimestamp(record.job.availableAt, "job.availableAt") > now) {
+        return false;
+      }
+      const expiresAt = leaseExpiresAtMs(record);
+      return expiresAt === null || expiresAt <= now;
+    }).sort(compareQueueRecords).slice(0, limit);
+    const claimedAt = new Date(now).toISOString();
+    return claimable.map((record) => {
+      record.job = {
+        ...record.job,
+        attempt: record.job.attempt + 1
+      };
+      record.leaseId = randomUUID();
+      record.claimedAt = claimedAt;
+      record.leaseExpiresAt = new Date(now + leaseMs).toISOString();
+      return toClaimedQueueJob(record);
+    });
+  }
+  async complete(params) {
+    const record = this.requireActiveLease(params);
+    record.state = "completed";
+    clearLease(record);
+  }
+  async retry(params) {
+    const record = this.requireActiveLease(params);
+    const availableAt = params.availableAt ?? new Date().toISOString();
+    parseTimestamp(availableAt, "availableAt");
+    record.job = {
+      ...record.job,
+      availableAt
+    };
+    clearLease(record);
+  }
+  async fail(params) {
+    const record = this.requireActiveLease(params);
+    record.state = "failed";
+    clearLease(record);
+  }
+  async renewLease(params) {
+    assertPositiveNumber(params.leaseMs, "leaseMs");
+    const record = this.store.find(params.projectId, this.queueId, params.jobId);
+    if (!record || record.state !== "queued") {
+      return null;
+    }
+    const now = Date.now();
+    const expiresAt = leaseExpiresAtMs(record);
+    if (record.leaseId !== params.leaseId || expiresAt === null) {
+      return null;
+    }
+    if (expiresAt <= now) {
+      return null;
+    }
+    record.leaseExpiresAt = new Date(now + params.leaseMs).toISOString();
+    return toClaimedQueueJob(record);
+  }
+  requireActiveLease(params) {
+    assertNonEmpty(params.projectId, "projectId");
+    assertNonEmpty(params.jobId, "jobId");
+    assertNonEmpty(params.leaseId, "leaseId");
+    const record = this.store.find(params.projectId, this.queueId, params.jobId);
+    if (!record) {
+      throw new QueueError(`[Sixb] Unknown queue job '${params.jobId}'`);
+    }
+    if (record.state !== "queued") {
+      throw new QueueError(`[Sixb] Queue job '${params.jobId}' is no longer active`);
+    }
+    if (record.leaseId !== params.leaseId || !record.leaseExpiresAt) {
+      throw new QueueError(`[Sixb] Lease mismatch for queue job '${params.jobId}'`);
+    }
+    const expiresAt = leaseExpiresAtMs(record);
+    if (expiresAt === null || expiresAt <= Date.now()) {
+      throw new QueueError(`[Sixb] Lease for queue job '${params.jobId}' has expired`);
+    }
+    return record;
+  }
+}
+
+class InMemoryQueues {
+  scope = "process";
+  store = new InMemoryQueueStore;
+  syncRuns = new InMemoryQueue(this.store, "sync.runs");
+  pipelines = new InMemoryQueue(this.store, "pipeline.runs");
+  projections = new InMemoryQueue(this.store, "projection.runs");
+  workflows = new InMemoryQueue(this.store, "workflow.runs");
+  actions = new InMemoryQueue(this.store, "action.runs");
+  agents = new InMemoryQueue(this.store, "agent.runs");
+  health() {
+    return Promise.resolve();
+  }
+}
+export { QueueError, InMemoryQueues };
+
+//# debugId=A071F89DCFCEC97464756E2164756E21