@sixb/core 0.1.0 → 0.1.2

package/dist/{chunk-5yny9z0e.js → chunk-z3zp0bj1.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   isJsonValue
-} from "./chunk-1vffvydj.js";
+} from "./chunk-t8t39h7v.js";
 
 // src/logging/types.ts
 var LOG_LEVELS = ["debug", "info", "warn", "error"];

package/dist/chunk-zcnhxkvd.js

@@ -0,0 +1,7 @@
+// @bun
+// src/storage/ontology/outbox.ts
+var ONTOLOGY_OUTBOX_FAILURE_CODES = ["event.delivery_failed"];
+
+export { ONTOLOGY_OUTBOX_FAILURE_CODES };
+
+//# debugId=68A4A6A822D3D56964756E2164756E21

package/dist/chunk-zcnhxkvd.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/storage/ontology/outbox.ts"],
+  "sourcesContent": [
+    "import type { SixbErrorCode, SixbFailure } from \"../../errors/types\"\nimport type { OntologyMaterializationEvent } from \"../../materialization/events\"\n\nexport type {\n  OntologyMaterializationEvent,\n  OntologyMaterializationEventDraft,\n} from \"../../materialization/events\"\n\nexport interface OntologyOutboxWrite {\n  /** Providers may index envelope identity fields, but the envelope remains authoritative. */\n  readonly envelope: OntologyMaterializationEvent\n  readonly availableAt: string\n  readonly createdAt: string\n}\n\n/** Error codes a durable ontology outbox delivery can persist. */\nexport const ONTOLOGY_OUTBOX_FAILURE_CODES = [\"event.delivery_failed\"] as const satisfies readonly [\n  SixbErrorCode,\n  ...SixbErrorCode[],\n]\n\nexport type OntologyOutboxFailureCode = (typeof ONTOLOGY_OUTBOX_FAILURE_CODES)[number]\nexport type OntologyOutboxFailure = SixbFailure<OntologyOutboxFailureCode>\n\nexport interface OntologyOutboxRecord {\n  readonly envelope: OntologyMaterializationEvent\n  readonly availableAt: string\n  readonly attempts: number\n  readonly leaseId: string | null\n  readonly leaseExpiresAt: string | null\n  readonly publishedAt: string | null\n  readonly lastFailure: OntologyOutboxFailure | null\n  readonly createdAt: string\n}\n\nexport interface ClaimOntologyOutboxInput {\n  readonly projectId: string\n  readonly now: string\n  readonly limit: number\n  readonly leaseId: string\n  readonly leaseExpiresAt: string\n}\n\nexport interface ClaimedOntologyOutboxRow extends OntologyOutboxRecord {\n  readonly leaseId: string\n  readonly leaseExpiresAt: string\n}\n\nexport interface CompleteOntologyOutboxLeaseInput {\n  readonly projectId: string\n  readonly ids: readonly string[]\n  readonly leaseId: string\n  readonly publishedAt: string\n}\n\nexport interface RescheduleOntologyOutboxLeaseInput {\n  readonly projectId: string\n  readonly ids: readonly string[]\n  readonly leaseId: string\n  readonly availableAt: string\n  /** The delivery failure that caused this retry. Omitted for lifecycle-only rescheduling. */\n  readonly failure?: OntologyOutboxFailure\n}\n\nexport interface PurgePublishedOntologyOutboxInput {\n  readonly projectId: string\n  readonly publishedBefore: string\n  readonly limit: number\n}\n\nexport interface SummarizeOntologyOutboxInput {\n  readonly projectId: string\n}\n\nexport interface OntologyOutboxSummary {\n  readonly pendingCount: number\n  readonly oldestPendingAt: string | null\n  /** Pending rows that have already been claimed at least once. */\n  readonly retryingCount: number\n  readonly maxAttempts: number\n}\n\nexport interface OntologyOutboxStorage {\n  /** Selects each claimed batch deterministically; concurrent publishers may complete out of order. */\n  claim(input: ClaimOntologyOutboxInput): Promise<readonly ClaimedOntologyOutboxRow[]>\n  markPublished(input: CompleteOntologyOutboxLeaseInput): Promise<void>\n  reschedule(input: RescheduleOntologyOutboxLeaseInput): Promise<void>\n  purgePublished(input: PurgePublishedOntologyOutboxInput): Promise<number>\n  summarize(input: SummarizeOntologyOutboxInput): Promise<OntologyOutboxSummary>\n}\n"
+  ],
+  "mappings": ";;AAgBO,IAAM,gCAAgC,CAAC,uBAAuB;",
+  "debugId": "68A4A6A822D3D56964756E2164756E21",
+  "names": []
+}

package/dist/chunk-zg9yryhz.js

@@ -0,0 +1,252 @@
+// @bun
+import {
+  createPrimitiveExecutionRecord,
+  ensureExecutionRecord,
+  executionRecordInputFromRuntime
+} from "./chunk-8ryen3p3.js";
+import {
+  PIPELINE_RUN_FAILURE_CODES
+} from "./chunk-ys1nse2v.js";
+import {
+  PipelineRunError
+} from "./chunk-cy0n5dms.js";
+import {
+  reportRunFailure
+} from "./chunk-dsrkgtnh.js";
+import {
+  assertAuthorized
+} from "./chunk-34bqh420.js";
+import {
+  createSixbError,
+  toSixbFailure
+} from "./chunk-0172wgm9.js";
+
+// src/pipelines/errors.ts
+class PipelineError extends Error {
+  name = "PipelineError";
+}
+
+// src/pipelines/run-dispatch.ts
+import { randomUUID } from "crypto";
+class PipelineRunDispatcher {
+  dependencies;
+  constructor(dependencies) {
+    this.dependencies = dependencies;
+  }
+  async dispatch(input) {
+    assertAutomaticDispatchInput(input);
+    const pipeline = this.dependencies.definitions.pipelines.getById(input.pipelineId);
+    if (!pipeline)
+      throw new PipelineError(`[Sixb] Unknown pipeline '${input.pipelineId}'`);
+    return dispatchPipelineRun({
+      errorReporterHost: this.dependencies,
+      projectId: this.dependencies.id,
+      pipeline,
+      storage: this.dependencies.storage,
+      queue: this.dependencies.queues.pipelines,
+      runId: input.runId,
+      metadata: input.metadata,
+      validateExistingRun: (run, storage) => assertAutomaticExecutionIdentity(storage, this.dependencies.id, input, run),
+      createExecution: async (executionId, runId) => createPrimitiveExecutionRecord({
+        id: executionId,
+        primitive: { kind: "pipeline", id: pipeline.id, runId },
+        origin: {
+          type: "automatic",
+          projectId: this.dependencies.id,
+          source: input.source,
+          correlationId: input.correlationId
+        }
+      })
+    });
+  }
+}
+async function dispatchPipelineRun(input) {
+  const runId = createPipelineRunId(input.runId);
+  const persisted = await persistPipelineRun(input, runId);
+  if (!persisted.publish)
+    return existingPipelineRunResult(persisted.run);
+  return publishPipelineRun(input, persisted);
+}
+async function persistPipelineRun(input, runId) {
+  const pipelineRuns = requirePipelineRunStorage(input.storage);
+  const existing = await pipelineRuns.getById({ projectId: input.projectId, id: runId });
+  if (existing)
+    return reusePipelineRun(input, existing);
+  const execution = await input.createExecution(`exec_${randomUUID()}`, runId);
+  const queuedAt = new Date;
+  try {
+    return await input.storage.transaction(async (tx) => {
+      const transactionalRuns = requirePipelineRunStorage(tx);
+      const raced = await transactionalRuns.getById({ projectId: input.projectId, id: runId });
+      if (raced) {
+        assertExistingRunMatchesRequest(raced, input);
+        await input.validateExistingRun?.(raced, tx);
+        return { publish: false, run: raced };
+      }
+      await tx.executions.create(execution);
+      const run = await transactionalRuns.queue({
+        projectId: input.projectId,
+        id: runId,
+        executionId: execution.id,
+        pipelineId: input.pipeline.id,
+        queuedAt
+      });
+      return { publish: true, run, execution, queuedAt, created: true };
+    }, { isolation: "serializable" });
+  } catch (error) {
+    if (!(error instanceof PipelineRunError))
+      throw error;
+    const raced = await pipelineRuns.getById({ projectId: input.projectId, id: runId });
+    if (!raced)
+      throw error;
+    assertExistingRunMatchesRequest(raced, input);
+    await input.validateExistingRun?.(raced, input.storage);
+    return { publish: false, run: raced };
+  }
+}
+async function reusePipelineRun(input, existing) {
+  assertExistingRunMatchesRequest(existing, input);
+  await input.validateExistingRun?.(existing, input.storage);
+  if (existing.status !== "failed" || existing.error?.code !== "queue.enqueue_failed" || !existing.error.retryable) {
+    return { publish: false, run: existing };
+  }
+  const execution = await input.storage.executions.getById({
+    projectId: input.projectId,
+    id: existing.executionId
+  });
+  if (!execution) {
+    throw new PipelineRunError(`[Sixb] Execution '${existing.executionId}' for Pipeline run '${existing.id}' was not found.`);
+  }
+  const queuedAt = new Date;
+  const run = await requirePipelineRunStorage(input.storage).queue({
+    projectId: input.projectId,
+    id: existing.id,
+    executionId: existing.executionId,
+    pipelineId: existing.pipelineId,
+    queuedAt
+  });
+  return { publish: true, run, execution, queuedAt, created: false };
+}
+async function publishPipelineRun(input, persisted) {
+  try {
+    const [job] = await input.queue.enqueue({
+      projectId: input.projectId,
+      jobs: [
+        {
+          id: persisted.run.id,
+          type: "pipeline.run.requested",
+          payload: { runId: persisted.run.id },
+          ...input.metadata === undefined ? {} : { metadata: input.metadata }
+        }
+      ]
+    });
+    return {
+      pipelineId: persisted.run.pipelineId,
+      runId: persisted.run.id,
+      queuedAt: persisted.queuedAt.toISOString(),
+      ...job?.id ? { jobId: job.id } : {},
+      created: persisted.created
+    };
+  } catch (error) {
+    const failedAt = new Date;
+    const failure = toEnqueueFailure(error, persisted.run, failedAt);
+    const failed = await requirePipelineRunStorage(input.storage).finish({
+      projectId: input.projectId,
+      id: persisted.run.id,
+      status: "failed",
+      finishedAt: failedAt,
+      error: failure
+    });
+    reportRunFailure(input.errorReporterHost, error, {
+      projectId: input.projectId,
+      runKind: "pipeline",
+      run: { runId: failed.id, pipelineId: failed.pipelineId },
+      failure
+    });
+    throw error;
+  }
+}
+function assertExistingRunMatchesRequest(existing, input) {
+  if (existing.pipelineId !== input.pipeline.id) {
+    throw new PipelineRunError(`[Sixb] Pipeline run '${existing.id}' already exists with a different request payload.`);
+  }
+}
+function existingPipelineRunResult(existing) {
+  return {
+    pipelineId: existing.pipelineId,
+    runId: existing.id,
+    queuedAt: existing.queuedAt.toISOString(),
+    created: false
+  };
+}
+function requirePipelineRunStorage(storage) {
+  if (!storage.pipelineRuns) {
+    throw new PipelineError("[Sixb] Pipeline run storage is not configured.");
+  }
+  return storage.pipelineRuns;
+}
+function createPipelineRunId(runId) {
+  if (runId === undefined)
+    return `run_${randomUUID()}`;
+  if (!runId.trim())
+    throw new PipelineError("[Sixb] Pipeline run id must not be empty");
+  return runId;
+}
+function assertAutomaticDispatchInput(input) {
+  assertNonBlank(input.pipelineId, "Pipeline id");
+  assertNonBlank(input.runId, "Pipeline run id");
+  assertNonBlank(input.source.eventId, "Pipeline source event id");
+  assertNonBlank(input.correlationId, "Pipeline correlation id");
+}
+async function assertAutomaticExecutionIdentity(storage, projectId, input, run) {
+  const execution = await storage.executions.getById({ projectId, id: run.executionId });
+  if (!execution || execution.source.type !== input.source.type || execution.source.eventId !== input.source.eventId || execution.correlationId !== input.correlationId || execution.requestedBy !== undefined) {
+    throw new PipelineError(`[Sixb] Pipeline run '${run.id}' already exists with different automatic provenance.`);
+  }
+}
+function toEnqueueFailure(error, run, at) {
+  const enqueueError = createSixbError("queue.enqueue_failed", `[Sixb] Could not enqueue Pipeline run '${run.id}'.`, {
+    cause: error,
+    details: { pipelineId: run.pipelineId, runId: run.id, phase: "enqueue" }
+  });
+  return toSixbFailure(enqueueError, { allowedCodes: PIPELINE_RUN_FAILURE_CODES, at });
+}
+function assertNonBlank(value, label) {
+  if (!value.trim())
+    throw new PipelineError(`[Sixb] ${label} must not be empty.`);
+}
+
+// src/pipelines/request.ts
+async function requestPipelineRun(runtime, execution, pipeline, options = {}) {
+  assertAuthorized(runtime, { kind: "pipeline.run", pipelineId: pipeline.id });
+  if (!runtime.storage.pipelineRuns) {
+    throw new PipelineError("[Sixb] Pipeline run storage is not configured.");
+  }
+  const queue = runtime.queues.pipelines;
+  if (!queue) {
+    throw new PipelineError("[Sixb] Pipeline run queue is not configured.");
+  }
+  return dispatchPipelineRun({
+    errorReporterHost: runtime,
+    projectId: runtime.projectId,
+    pipeline,
+    storage: runtime.storage,
+    queue,
+    ...options,
+    createExecution: async (executionId, runId) => {
+      const caller = await ensureExecutionRecord(runtime.storage.executions, executionRecordInputFromRuntime({
+        execution,
+        runtimeAuthorization: runtime.runtimeAuthorization
+      }));
+      return createPrimitiveExecutionRecord({
+        id: executionId,
+        primitive: { kind: "pipeline", id: pipeline.id, runId },
+        origin: { type: "execution", parent: caller }
+      });
+    }
+  });
+}
+
+export { PipelineError, PipelineRunDispatcher, requestPipelineRun };
+
+//# debugId=80B62AEE05E80FC964756E2164756E21

package/dist/chunk-zg9yryhz.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/pipelines/errors.ts", "../src/pipelines/run-dispatch.ts", "../src/pipelines/request.ts"],
+  "sourcesContent": [
+    "export class PipelineError extends Error {\n  readonly name = \"PipelineError\"\n}\n",
+    "import { randomUUID } from \"node:crypto\"\nimport { reportRunFailure } from \"../error-reporting/capability\"\nimport { createSixbError, toSixbFailure } from \"../errors/internal\"\nimport type { SixbFailure } from \"../errors/types\"\nimport type { RunDispatcher } from \"../execution/dispatch\"\nimport { createPrimitiveExecutionRecord } from \"../execution/durable\"\nimport type { Queues } from \"../queues\"\nimport type { SixbDefinitions } from \"../runtime/definitions\"\nimport type {\n  CreateExecutionInput,\n  PipelineRunFailureCode,\n  PipelineRunRecord,\n  Storage,\n} from \"../storage\"\nimport { PIPELINE_RUN_FAILURE_CODES, PipelineRunError } from \"../storage\"\nimport { PipelineError } from \"./errors\"\nimport type { PipelineRunRequestOptions, PipelineRunRequestResult } from \"./request\"\nimport type { PipelineDefinition } from \"./types\"\n\nexport type AutomaticPipelineExecutionSource =\n  | { readonly type: \"schedule\"; readonly eventId: string }\n  | { readonly type: \"event\"; readonly eventId: string }\n\nexport interface AutomaticPipelineRunDispatchInput extends PipelineRunRequestOptions {\n  readonly pipelineId: string\n  readonly runId: string\n  readonly source: AutomaticPipelineExecutionSource\n  readonly correlationId: string\n  readonly metadata?: Readonly<Record<string, string>>\n}\n\nexport type PipelineRunDispatchPort = RunDispatcher<\n  AutomaticPipelineRunDispatchInput,\n  PipelineRunRequestResult\n>\n\nexport interface PipelineRunDispatcherDependencies {\n  readonly id: string\n  readonly definitions: Pick<SixbDefinitions, \"pipelines\">\n  readonly storage: Storage\n  readonly queues: Pick<Queues, \"pipelines\">\n}\n\ninterface DispatchPipelineRunInput extends PipelineRunRequestOptions {\n  readonly errorReporterHost: object\n  readonly projectId: string\n  readonly pipeline: PipelineDefinition\n  readonly storage: Storage\n  readonly queue: Queues[\"pipelines\"]\n  readonly metadata?: Readonly<Record<string, string>>\n  readonly createExecution: (executionId: string, runId: string) => Promise<CreateExecutionInput>\n  readonly validateExistingRun?: (run: PipelineRunRecord, storage: Storage) => Promise<void>\n}\n\ntype PersistedPipelineRun =\n  | { readonly publish: false; readonly run: PipelineRunRecord }\n  | {\n      readonly publish: true\n      readonly run: PipelineRunRecord\n      readonly execution: CreateExecutionInput\n      readonly queuedAt: Date\n      readonly created: boolean\n    }\n\n/** Core-owned durable dispatch boundary used by automatic Pipeline triggers. */\nexport class PipelineRunDispatcher implements PipelineRunDispatchPort {\n  constructor(private readonly dependencies: PipelineRunDispatcherDependencies) {}\n\n  async dispatch(input: AutomaticPipelineRunDispatchInput): Promise<PipelineRunRequestResult> {\n    assertAutomaticDispatchInput(input)\n    const pipeline = this.dependencies.definitions.pipelines.getById(input.pipelineId)\n    if (!pipeline) throw new PipelineError(`[Sixb] Unknown pipeline '${input.pipelineId}'`)\n\n    return dispatchPipelineRun({\n      errorReporterHost: this.dependencies,\n      projectId: this.dependencies.id,\n      pipeline,\n      storage: this.dependencies.storage,\n      queue: this.dependencies.queues.pipelines,\n      runId: input.runId,\n      metadata: input.metadata,\n      validateExistingRun: (run, storage) =>\n        assertAutomaticExecutionIdentity(storage, this.dependencies.id, input, run),\n      createExecution: async (executionId, runId) =>\n        createPrimitiveExecutionRecord({\n          id: executionId,\n          primitive: { kind: \"pipeline\", id: pipeline.id, runId },\n          origin: {\n            type: \"automatic\",\n            projectId: this.dependencies.id,\n            source: input.source,\n            correlationId: input.correlationId,\n          },\n        }),\n    })\n  }\n}\n\n/** Persist a Pipeline execution and queued run before publishing its queue job. */\nexport async function dispatchPipelineRun(\n  input: DispatchPipelineRunInput\n): Promise<PipelineRunRequestResult> {\n  const runId = createPipelineRunId(input.runId)\n  const persisted = await persistPipelineRun(input, runId)\n  if (!persisted.publish) return existingPipelineRunResult(persisted.run)\n  return publishPipelineRun(input, persisted)\n}\n\nasync function persistPipelineRun(\n  input: DispatchPipelineRunInput,\n  runId: string\n): Promise<PersistedPipelineRun> {\n  const pipelineRuns = requirePipelineRunStorage(input.storage)\n  const existing = await pipelineRuns.getById({ projectId: input.projectId, id: runId })\n  if (existing) return reusePipelineRun(input, existing)\n\n  const execution = await input.createExecution(`exec_${randomUUID()}`, runId)\n  const queuedAt = new Date()\n  try {\n    return await input.storage.transaction(\n      async (tx): Promise<PersistedPipelineRun> => {\n        const transactionalRuns = requirePipelineRunStorage(tx)\n        const raced = await transactionalRuns.getById({ projectId: input.projectId, id: runId })\n        if (raced) {\n          assertExistingRunMatchesRequest(raced, input)\n          await input.validateExistingRun?.(raced, tx)\n          return { publish: false, run: raced }\n        }\n\n        await tx.executions.create(execution)\n        const run = await transactionalRuns.queue({\n          projectId: input.projectId,\n          id: runId,\n          executionId: execution.id,\n          pipelineId: input.pipeline.id,\n          queuedAt,\n        })\n        return { publish: true, run, execution, queuedAt, created: true }\n      },\n      { isolation: \"serializable\" }\n    )\n  } catch (error) {\n    if (!(error instanceof PipelineRunError)) throw error\n    const raced = await pipelineRuns.getById({ projectId: input.projectId, id: runId })\n    if (!raced) throw error\n    assertExistingRunMatchesRequest(raced, input)\n    await input.validateExistingRun?.(raced, input.storage)\n    return { publish: false, run: raced }\n  }\n}\n\nasync function reusePipelineRun(\n  input: DispatchPipelineRunInput,\n  existing: PipelineRunRecord\n): Promise<PersistedPipelineRun> {\n  assertExistingRunMatchesRequest(existing, input)\n  await input.validateExistingRun?.(existing, input.storage)\n  if (\n    existing.status !== \"failed\" ||\n    existing.error?.code !== \"queue.enqueue_failed\" ||\n    !existing.error.retryable\n  ) {\n    return { publish: false, run: existing }\n  }\n\n  const execution = await input.storage.executions.getById({\n    projectId: input.projectId,\n    id: existing.executionId,\n  })\n  if (!execution) {\n    throw new PipelineRunError(\n      `[Sixb] Execution '${existing.executionId}' for Pipeline run '${existing.id}' was not found.`\n    )\n  }\n\n  const queuedAt = new Date()\n  const run = await requirePipelineRunStorage(input.storage).queue({\n    projectId: input.projectId,\n    id: existing.id,\n    executionId: existing.executionId,\n    pipelineId: existing.pipelineId,\n    queuedAt,\n  })\n  return { publish: true, run, execution, queuedAt, created: false }\n}\n\nasync function publishPipelineRun(\n  input: DispatchPipelineRunInput,\n  persisted: Extract<PersistedPipelineRun, { readonly publish: true }>\n): Promise<PipelineRunRequestResult> {\n  try {\n    const [job] = await input.queue.enqueue({\n      projectId: input.projectId,\n      jobs: [\n        {\n          id: persisted.run.id,\n          type: \"pipeline.run.requested\",\n          payload: { runId: persisted.run.id },\n          ...(input.metadata === undefined ? {} : { metadata: input.metadata }),\n        },\n      ],\n    })\n    return {\n      pipelineId: persisted.run.pipelineId,\n      runId: persisted.run.id,\n      queuedAt: persisted.queuedAt.toISOString(),\n      ...(job?.id ? { jobId: job.id } : {}),\n      created: persisted.created,\n    }\n  } catch (error) {\n    const failedAt = new Date()\n    const failure = toEnqueueFailure(error, persisted.run, failedAt)\n    const failed = await requirePipelineRunStorage(input.storage).finish({\n      projectId: input.projectId,\n      id: persisted.run.id,\n      status: \"failed\",\n      finishedAt: failedAt,\n      error: failure,\n    })\n    reportRunFailure(input.errorReporterHost, error, {\n      projectId: input.projectId,\n      runKind: \"pipeline\",\n      run: { runId: failed.id, pipelineId: failed.pipelineId },\n      failure,\n    })\n    throw error\n  }\n}\n\nfunction assertExistingRunMatchesRequest(\n  existing: PipelineRunRecord,\n  input: Pick<DispatchPipelineRunInput, \"pipeline\">\n): void {\n  if (existing.pipelineId !== input.pipeline.id) {\n    throw new PipelineRunError(\n      `[Sixb] Pipeline run '${existing.id}' already exists with a different request payload.`\n    )\n  }\n}\n\nfunction existingPipelineRunResult(existing: PipelineRunRecord): PipelineRunRequestResult {\n  return {\n    pipelineId: existing.pipelineId,\n    runId: existing.id,\n    queuedAt: existing.queuedAt.toISOString(),\n    created: false,\n  }\n}\n\nfunction requirePipelineRunStorage(storage: Storage): NonNullable<Storage[\"pipelineRuns\"]> {\n  if (!storage.pipelineRuns) {\n    throw new PipelineError(\"[Sixb] Pipeline run storage is not configured.\")\n  }\n  return storage.pipelineRuns\n}\n\nfunction createPipelineRunId(runId: string | undefined): string {\n  if (runId === undefined) return `run_${randomUUID()}`\n  if (!runId.trim()) throw new PipelineError(\"[Sixb] Pipeline run id must not be empty\")\n  return runId\n}\n\nfunction assertAutomaticDispatchInput(input: AutomaticPipelineRunDispatchInput): void {\n  assertNonBlank(input.pipelineId, \"Pipeline id\")\n  assertNonBlank(input.runId, \"Pipeline run id\")\n  assertNonBlank(input.source.eventId, \"Pipeline source event id\")\n  assertNonBlank(input.correlationId, \"Pipeline correlation id\")\n}\n\nasync function assertAutomaticExecutionIdentity(\n  storage: Storage,\n  projectId: string,\n  input: AutomaticPipelineRunDispatchInput,\n  run: PipelineRunRecord\n): Promise<void> {\n  const execution = await storage.executions.getById({ projectId, id: run.executionId })\n  if (\n    !execution ||\n    execution.source.type !== input.source.type ||\n    execution.source.eventId !== input.source.eventId ||\n    execution.correlationId !== input.correlationId ||\n    execution.requestedBy !== undefined\n  ) {\n    throw new PipelineError(\n      `[Sixb] Pipeline run '${run.id}' already exists with different automatic provenance.`\n    )\n  }\n}\n\nfunction toEnqueueFailure(\n  error: unknown,\n  run: PipelineRunRecord,\n  at: Date\n): SixbFailure<PipelineRunFailureCode> {\n  const enqueueError = createSixbError(\n    \"queue.enqueue_failed\",\n    `[Sixb] Could not enqueue Pipeline run '${run.id}'.`,\n    {\n      cause: error,\n      details: { pipelineId: run.pipelineId, runId: run.id, phase: \"enqueue\" },\n    }\n  )\n  return toSixbFailure(enqueueError, { allowedCodes: PIPELINE_RUN_FAILURE_CODES, at })\n}\n\nfunction assertNonBlank(value: string, label: string): void {\n  if (!value.trim()) throw new PipelineError(`[Sixb] ${label} must not be empty.`)\n}\n",
+    "import { assertAuthorized } from \"../authorization\"\nimport {\n  createPrimitiveExecutionRecord,\n  ensureExecutionRecord,\n  executionRecordInputFromRuntime,\n} from \"../execution/durable\"\nimport type { ExecutionContext } from \"../execution/types\"\nimport type { SixbRuntimeContext } from \"../runtime/types\"\nimport { PipelineError } from \"./errors\"\nimport { dispatchPipelineRun } from \"./run-dispatch\"\nimport type { PipelineDefinition } from \"./types\"\n\nexport interface PipelineRunRequestOptions {\n  /** Stable identity used to make dispatch idempotent. */\n  readonly runId?: string\n}\n\nexport interface RequestPipelineRunInput extends PipelineRunRequestOptions {\n  readonly pipelineId: string\n}\n\nexport interface PipelineRunRequestResult {\n  readonly pipelineId: string\n  readonly runId: string\n  /** Durable time at which the run entered the queue. */\n  readonly queuedAt: string\n  readonly jobId?: string\n  readonly created: boolean\n}\n\n/**\n * Authorize and queue a pipeline run request.\n *\n * Operates on an already-resolved definition and the shared runtime context, so the HTTP route and\n * the runtime verb cannot drift apart.\n *\n * The immutable child execution and queued run are persisted before queue publication.\n */\nexport async function requestPipelineRun(\n  runtime: SixbRuntimeContext,\n  execution: ExecutionContext,\n  pipeline: PipelineDefinition,\n  options: PipelineRunRequestOptions = {}\n): Promise<PipelineRunRequestResult> {\n  assertAuthorized(runtime, { kind: \"pipeline.run\", pipelineId: pipeline.id })\n  if (!runtime.storage.pipelineRuns) {\n    throw new PipelineError(\"[Sixb] Pipeline run storage is not configured.\")\n  }\n\n  const queue = runtime.queues.pipelines\n  if (!queue) {\n    throw new PipelineError(\"[Sixb] Pipeline run queue is not configured.\")\n  }\n\n  return dispatchPipelineRun({\n    errorReporterHost: runtime,\n    projectId: runtime.projectId,\n    pipeline,\n    storage: runtime.storage,\n    queue,\n    ...options,\n    createExecution: async (executionId, runId) => {\n      const caller = await ensureExecutionRecord(\n        runtime.storage.executions,\n        executionRecordInputFromRuntime({\n          execution,\n          runtimeAuthorization: runtime.runtimeAuthorization,\n        })\n      )\n      return createPrimitiveExecutionRecord({\n        id: executionId,\n        primitive: { kind: \"pipeline\", id: pipeline.id, runId },\n        origin: { type: \"execution\", parent: caller },\n      })\n    },\n  })\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;AAAO,MAAM,sBAAsB,MAAM;AAAA,EAC9B,OAAO;AAClB;;;ACFA;AAiEO,MAAM,sBAAyD;AAAA,EACvC;AAAA,EAA7B,WAAW,CAAkB,cAAiD;AAAA,IAAjD;AAAA;AAAA,OAEvB,SAAQ,CAAC,OAA6E;AAAA,IAC1F,6BAA6B,KAAK;AAAA,IAClC,MAAM,WAAW,KAAK,aAAa,YAAY,UAAU,QAAQ,MAAM,UAAU;AAAA,IACjF,IAAI,CAAC;AAAA,MAAU,MAAM,IAAI,cAAc,4BAA4B,MAAM,aAAa;AAAA,IAEtF,OAAO,oBAAoB;AAAA,MACzB,mBAAmB,KAAK;AAAA,MACxB,WAAW,KAAK,aAAa;AAAA,MAC7B;AAAA,MACA,SAAS,KAAK,aAAa;AAAA,MAC3B,OAAO,KAAK,aAAa,OAAO;AAAA,MAChC,OAAO,MAAM;AAAA,MACb,UAAU,MAAM;AAAA,MAChB,qBAAqB,CAAC,KAAK,YACzB,iCAAiC,SAAS,KAAK,aAAa,IAAI,OAAO,GAAG;AAAA,MAC5E,iBAAiB,OAAO,aAAa,UACnC,+BAA+B;AAAA,QAC7B,IAAI;AAAA,QACJ,WAAW,EAAE,MAAM,YAAY,IAAI,SAAS,IAAI,MAAM;AAAA,QACtD,QAAQ;AAAA,UACN,MAAM;AAAA,UACN,WAAW,KAAK,aAAa;AAAA,UAC7B,QAAQ,MAAM;AAAA,UACd,eAAe,MAAM;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACL,CAAC;AAAA;AAEL;AAGA,eAAsB,mBAAmB,CACvC,OACmC;AAAA,EACnC,MAAM,QAAQ,oBAAoB,MAAM,KAAK;AAAA,EAC7C,MAAM,YAAY,MAAM,mBAAmB,OAAO,KAAK;AAAA,EACvD,IAAI,CAAC,UAAU;AAAA,IAAS,OAAO,0BAA0B,UAAU,GAAG;AAAA,EACtE,OAAO,mBAAmB,OAAO,SAAS;AAAA;AAG5C,eAAe,kBAAkB,CAC/B,OACA,OAC+B;AAAA,EAC/B,MAAM,eAAe,0BAA0B,MAAM,OAAO;AAAA,EAC5D,MAAM,WAAW,MAAM,aAAa,QAAQ,EAAE,WAAW,MAAM,WAAW,IAAI,MAAM,CAAC;AAAA,EACrF,IAAI;AAAA,IAAU,OAAO,iBAAiB,OAAO,QAAQ;AAAA,EAErD,MAAM,YAAY,MAAM,MAAM,gBAAgB,QAAQ,WAAW,KAAK,KAAK;AAAA,EAC3E,MAAM,WAAW,IAAI;AAAA,EACrB,IAAI;AAAA,IACF,OAAO,MAAM,MAAM,QAAQ,YACzB,OAAO,OAAsC;AAAA,MAC3C,MAAM,oBAAoB,0BAA0B,EAAE;AAAA,MACtD,MAAM,QAAQ,MAAM,kBAAkB,QAAQ,EAAE,WAAW,MAAM,WAAW,IAAI,MAAM,CAAC;AAAA,MACvF,IAAI,OAAO;AAAA,QACT,gCAAgC,OAAO,KAAK;AAAA,QAC5C,MAAM,MAAM,sBAAsB,OAAO,EAAE;AAAA,QAC3C,OAAO,EAAE,SAAS,OAAO,KAAK,MAAM;AAAA,MACtC;AAAA,MAEA,MAAM,GAAG,WAAW,OAAO,SAAS;AAAA,MACpC,MAAM,MAAM,MAAM,kBAAkB,MAAM;AAAA,QACxC,WAAW,MAAM;AAAA,QACjB,IAAI;AAAA,QACJ,aAAa,UAAU;AAAA,QACvB,YAAY,MAAM,SAAS;AAAA,QAC3B;AAAA,MACF,CAAC;AAAA,MACD,OAAO,EAAE,SAAS,MAAM,KAAK,WAAW,UAAU,SAAS,KAAK;AAAA,OAElE,EAAE,WAAW,eAAe,CAC9B;AAAA,IACA,OAAO,OAAO;AAAA,IACd,IAAI,EAAE,iBAAiB;AAAA,MAAmB,MAAM;AAAA,IAChD,MAAM,QAAQ,MAAM,aAAa,QAAQ,EAAE,WAAW,MAAM,WAAW,IAAI,MAAM,CAAC;AAAA,IAClF,IAAI,CAAC;AAAA,MAAO,MAAM;AAAA,IAClB,gCAAgC,OAAO,KAAK;AAAA,IAC5C,MAAM,MAAM,sBAAsB,OAAO,MAAM,OAAO;AAAA,IACtD,OAAO,EAAE,SAAS,OAAO,KAAK,MAAM;AAAA;AAAA;AAIxC,eAAe,gBAAgB,CAC7B,OACA,UAC+B;AAAA,EAC/B,gCAAgC,UAAU,KAAK;AAAA,EAC/C,MAAM,MAAM,sBAAsB,UAAU,MAAM,OAAO;AAAA,EACzD,IACE,SAAS,WAAW,YACpB,SAAS,OAAO,SAAS,0BACzB,CAAC,SAAS,MAAM,WAChB;AAAA,IACA,OAAO,EAAE,SAAS,OAAO,KAAK,SAAS;AAAA,EACzC;AAAA,EAEA,MAAM,YAAY,MAAM,MAAM,QAAQ,WAAW,QAAQ;AAAA,IACvD,WAAW,MAAM;AAAA,IACjB,IAAI,SAAS;AAAA,EACf,CAAC;AAAA,EACD,IAAI,CAAC,WAAW;AAAA,IACd,MAAM,IAAI,iBACR,qBAAqB,SAAS,kCAAkC,SAAS,oBAC3E;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,IAAI;AAAA,EACrB,MAAM,MAAM,MAAM,0BAA0B,MAAM,OAAO,EAAE,MAAM;AAAA,IAC/D,WAAW,MAAM;AAAA,IACjB,IAAI,SAAS;AAAA,IACb,aAAa,SAAS;AAAA,IACtB,YAAY,SAAS;AAAA,IACrB;AAAA,EACF,CAAC;AAAA,EACD,OAAO,EAAE,SAAS,MAAM,KAAK,WAAW,UAAU,SAAS,MAAM;AAAA;AAGnE,eAAe,kBAAkB,CAC/B,OACA,WACmC;AAAA,EACnC,IAAI;AAAA,IACF,OAAO,OAAO,MAAM,MAAM,MAAM,QAAQ;AAAA,MACtC,WAAW,MAAM;AAAA,MACjB,MAAM;AAAA,QACJ;AAAA,UACE,IAAI,UAAU,IAAI;AAAA,UAClB,MAAM;AAAA,UACN,SAAS,EAAE,OAAO,UAAU,IAAI,GAAG;AAAA,aAC/B,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,QACrE;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,OAAO;AAAA,MACL,YAAY,UAAU,IAAI;AAAA,MAC1B,OAAO,UAAU,IAAI;AAAA,MACrB,UAAU,UAAU,SAAS,YAAY;AAAA,SACrC,KAAK,KAAK,EAAE,OAAO,IAAI,GAAG,IAAI,CAAC;AAAA,MACnC,SAAS,UAAU;AAAA,IACrB;AAAA,IACA,OAAO,OAAO;AAAA,IACd,MAAM,WAAW,IAAI;AAAA,IACrB,MAAM,UAAU,iBAAiB,OAAO,UAAU,KAAK,QAAQ;AAAA,IAC/D,MAAM,SAAS,MAAM,0BAA0B,MAAM,OAAO,EAAE,OAAO;AAAA,MACnE,WAAW,MAAM;AAAA,MACjB,IAAI,UAAU,IAAI;AAAA,MAClB,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,OAAO;AAAA,IACT,CAAC;AAAA,IACD,iBAAiB,MAAM,mBAAmB,OAAO;AAAA,MAC/C,WAAW,MAAM;AAAA,MACjB,SAAS;AAAA,MACT,KAAK,EAAE,OAAO,OAAO,IAAI,YAAY,OAAO,WAAW;AAAA,MACvD;AAAA,IACF,CAAC;AAAA,IACD,MAAM;AAAA;AAAA;AAIV,SAAS,+BAA+B,CACtC,UACA,OACM;AAAA,EACN,IAAI,SAAS,eAAe,MAAM,SAAS,IAAI;AAAA,IAC7C,MAAM,IAAI,iBACR,wBAAwB,SAAS,sDACnC;AAAA,EACF;AAAA;AAGF,SAAS,yBAAyB,CAAC,UAAuD;AAAA,EACxF,OAAO;AAAA,IACL,YAAY,SAAS;AAAA,IACrB,OAAO,SAAS;AAAA,IAChB,UAAU,SAAS,SAAS,YAAY;AAAA,IACxC,SAAS;AAAA,EACX;AAAA;AAGF,SAAS,yBAAyB,CAAC,SAAwD;AAAA,EACzF,IAAI,CAAC,QAAQ,cAAc;AAAA,IACzB,MAAM,IAAI,cAAc,gDAAgD;AAAA,EAC1E;AAAA,EACA,OAAO,QAAQ;AAAA;AAGjB,SAAS,mBAAmB,CAAC,OAAmC;AAAA,EAC9D,IAAI,UAAU;AAAA,IAAW,OAAO,OAAO,WAAW;AAAA,EAClD,IAAI,CAAC,MAAM,KAAK;AAAA,IAAG,MAAM,IAAI,cAAc,0CAA0C;AAAA,EACrF,OAAO;AAAA;AAGT,SAAS,4BAA4B,CAAC,OAAgD;AAAA,EACpF,eAAe,MAAM,YAAY,aAAa;AAAA,EAC9C,eAAe,MAAM,OAAO,iBAAiB;AAAA,EAC7C,eAAe,MAAM,OAAO,SAAS,0BAA0B;AAAA,EAC/D,eAAe,MAAM,eAAe,yBAAyB;AAAA;AAG/D,eAAe,gCAAgC,CAC7C,SACA,WACA,OACA,KACe;AAAA,EACf,MAAM,YAAY,MAAM,QAAQ,WAAW,QAAQ,EAAE,WAAW,IAAI,IAAI,YAAY,CAAC;AAAA,EACrF,IACE,CAAC,aACD,UAAU,OAAO,SAAS,MAAM,OAAO,QACvC,UAAU,OAAO,YAAY,MAAM,OAAO,WAC1C,UAAU,kBAAkB,MAAM,iBAClC,UAAU,gBAAgB,WAC1B;AAAA,IACA,MAAM,IAAI,cACR,wBAAwB,IAAI,yDAC9B;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CACvB,OACA,KACA,IACqC;AAAA,EACrC,MAAM,eAAe,gBACnB,wBACA,0CAA0C,IAAI,QAC9C;AAAA,IACE,OAAO;AAAA,IACP,SAAS,EAAE,YAAY,IAAI,YAAY,OAAO,IAAI,IAAI,OAAO,UAAU;AAAA,EACzE,CACF;AAAA,EACA,OAAO,cAAc,cAAc,EAAE,cAAc,4BAA4B,GAAG,CAAC;AAAA;AAGrF,SAAS,cAAc,CAAC,OAAe,OAAqB;AAAA,EAC1D,IAAI,CAAC,MAAM,KAAK;AAAA,IAAG,MAAM,IAAI,cAAc,UAAU,0BAA0B;AAAA;;;AC5QjF,eAAsB,kBAAkB,CACtC,SACA,WACA,UACA,UAAqC,CAAC,GACH;AAAA,EACnC,iBAAiB,SAAS,EAAE,MAAM,gBAAgB,YAAY,SAAS,GAAG,CAAC;AAAA,EAC3E,IAAI,CAAC,QAAQ,QAAQ,cAAc;AAAA,IACjC,MAAM,IAAI,cAAc,gDAAgD;AAAA,EAC1E;AAAA,EAEA,MAAM,QAAQ,QAAQ,OAAO;AAAA,EAC7B,IAAI,CAAC,OAAO;AAAA,IACV,MAAM,IAAI,cAAc,8CAA8C;AAAA,EACxE;AAAA,EAEA,OAAO,oBAAoB;AAAA,IACzB,mBAAmB;AAAA,IACnB,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA,SAAS,QAAQ;AAAA,IACjB;AAAA,OACG;AAAA,IACH,iBAAiB,OAAO,aAAa,UAAU;AAAA,MAC7C,MAAM,SAAS,MAAM,sBACnB,QAAQ,QAAQ,YAChB,gCAAgC;AAAA,QAC9B;AAAA,QACA,sBAAsB,QAAQ;AAAA,MAChC,CAAC,CACH;AAAA,MACA,OAAO,+BAA+B;AAAA,QACpC,IAAI;AAAA,QACJ,WAAW,EAAE,MAAM,YAAY,IAAI,SAAS,IAAI,MAAM;AAAA,QACtD,QAAQ,EAAE,MAAM,aAAa,QAAQ,OAAO;AAAA,MAC9C,CAAC;AAAA;AAAA,EAEL,CAAC;AAAA;",
+  "debugId": "80B62AEE05E80FC964756E2164756E21",
+  "names": []
+}

package/dist/chunk-zqqz8052.js

@@ -0,0 +1,3 @@
+// @bun
+
+//# debugId=92619866D6E6BE9764756E2164756E21

package/dist/{storage/projection-runs/lifecycle.js.map → chunk-zqqz8052.js.map}

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "4D890EEDF4DFAB0264756E2164756E21",
+  "debugId": "92619866D6E6BE9764756E2164756E21",
   "names": []
 }

package/dist/{chunk-4pycxcj3.js → chunk-zqysyfjt.js}

@@ -1,4 +1,8 @@
 // @bun
+import {
+  isPlainRecord
+} from "./chunk-t8t39h7v.js";
+
 // src/blob-storage/derive.ts
 function blobDigestHex(digest) {
   return digest.slice("sha256:".length);
@@ -8,18 +12,11 @@ function blobIdFromDigest(digest) {
 }
 
 // src/blob-storage/validation.ts
-function isPlainObject(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return false;
-  }
-  const prototype = Object.getPrototypeOf(value);
-  return prototype === Object.prototype || prototype === null;
-}
 function isBlobDigest(value) {
   return typeof value === "string" && value.startsWith("sha256:") && value.length > "sha256:".length;
 }
 function isFileRef(value) {
-  return isPlainObject(value) && typeof value.blobId === "string" && value.blobId.trim().length > 0 && isBlobDigest(value.digest) && value.blobId === blobIdFromDigest(value.digest) && typeof value.sizeBytes === "number" && Number.isInteger(value.sizeBytes) && value.sizeBytes >= 0 && (value.fileName === undefined || typeof value.fileName === "string") && (value.mediaType === undefined || typeof value.mediaType === "string") && (value.logicalPath === undefined || typeof value.logicalPath === "string");
+  return isPlainRecord(value) && typeof value.blobId === "string" && value.blobId.trim().length > 0 && isBlobDigest(value.digest) && value.blobId === blobIdFromDigest(value.digest) && typeof value.sizeBytes === "number" && Number.isInteger(value.sizeBytes) && value.sizeBytes >= 0 && (value.fileName === undefined || typeof value.fileName === "string") && (value.mediaType === undefined || typeof value.mediaType === "string") && (value.logicalPath === undefined || typeof value.logicalPath === "string");
 }
 function supportsDirectUpload(storage) {
   const candidate = storage;
@@ -32,4 +29,4 @@ function supportsRangeRead(storage) {
 
 export { blobDigestHex, blobIdFromDigest, isBlobDigest, isFileRef, supportsDirectUpload, supportsRangeRead };
 
-//# debugId=67B4834FB7B6EE4A64756E2164756E21
+//# debugId=CBADD015FD5B0A0D64756E2164756E21

package/dist/{chunk-4pycxcj3.js.map → chunk-zqysyfjt.js.map}

@@ -3,9 +3,9 @@
   "sources": ["../src/blob-storage/derive.ts", "../src/blob-storage/validation.ts"],
   "sourcesContent": [
     "import type { BlobDigest } from \"./types\"\n\n// Pure, crypto-free derivations of blob identity from a digest. Kept out of\n// `utils.ts` (which imports `node:crypto`) so the browser-safe `./browser`\n// barrel can reuse them without dragging Node crypto into the client bundle.\n\nexport function blobDigestHex(digest: BlobDigest): string {\n  return digest.slice(\"sha256:\".length)\n}\n\nexport function blobIdFromDigest(digest: BlobDigest): string {\n  return `blob_${blobDigestHex(digest)}`\n}\n",
-    "import { blobIdFromDigest } from \"./derive\"\nimport type {\n  BlobDigest,\n  BlobStorage,\n  DirectUploadBlobStorage,\n  FileRef,\n  RangeReadableBlobStorage,\n} from \"./types\"\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    return false\n  }\n\n  const prototype = Object.getPrototypeOf(value)\n  return prototype === Object.prototype || prototype === null\n}\n\nexport function isBlobDigest(value: unknown): value is BlobDigest {\n  return typeof value === \"string\" && value.startsWith(\"sha256:\") && value.length > \"sha256:\".length\n}\n\nexport function isFileRef(value: unknown): value is FileRef {\n  return (\n    isPlainObject(value) &&\n    typeof value.blobId === \"string\" &&\n    value.blobId.trim().length > 0 &&\n    isBlobDigest(value.digest) &&\n    // Blob identity is content-addressed: the id must be derivable from the digest.\n    // Rejecting a mismatch guards against tampered or malformed references.\n    value.blobId === blobIdFromDigest(value.digest) &&\n    typeof value.sizeBytes === \"number\" &&\n    Number.isInteger(value.sizeBytes) &&\n    value.sizeBytes >= 0 &&\n    (value.fileName === undefined || typeof value.fileName === \"string\") &&\n    (value.mediaType === undefined || typeof value.mediaType === \"string\") &&\n    (value.logicalPath === undefined || typeof value.logicalPath === \"string\")\n  )\n}\n\nexport function supportsDirectUpload(\n  storage: BlobStorage\n): storage is BlobStorage & DirectUploadBlobStorage {\n  const candidate = storage as Partial<DirectUploadBlobStorage>\n  return (\n    typeof candidate.createUpload === \"function\" &&\n    typeof candidate.signUploadPart === \"function\" &&\n    typeof candidate.completeUpload === \"function\" &&\n    typeof candidate.abortUpload === \"function\"\n  )\n}\n\nexport function supportsRangeRead(\n  storage: BlobStorage\n): storage is BlobStorage & RangeReadableBlobStorage {\n  const candidate = storage as Partial<RangeReadableBlobStorage>\n  return typeof candidate.openRange === \"function\"\n}\n"
+    "import { isPlainRecord } from \"../json\"\nimport { blobIdFromDigest } from \"./derive\"\nimport type {\n  BlobDigest,\n  BlobStorage,\n  DirectUploadBlobStorage,\n  FileRef,\n  RangeReadableBlobStorage,\n} from \"./types\"\n\nexport function isBlobDigest(value: unknown): value is BlobDigest {\n  return typeof value === \"string\" && value.startsWith(\"sha256:\") && value.length > \"sha256:\".length\n}\n\nexport function isFileRef(value: unknown): value is FileRef {\n  return (\n    isPlainRecord(value) &&\n    typeof value.blobId === \"string\" &&\n    value.blobId.trim().length > 0 &&\n    isBlobDigest(value.digest) &&\n    // Blob identity is content-addressed: the id must be derivable from the digest.\n    // Rejecting a mismatch guards against tampered or malformed references.\n    value.blobId === blobIdFromDigest(value.digest) &&\n    typeof value.sizeBytes === \"number\" &&\n    Number.isInteger(value.sizeBytes) &&\n    value.sizeBytes >= 0 &&\n    (value.fileName === undefined || typeof value.fileName === \"string\") &&\n    (value.mediaType === undefined || typeof value.mediaType === \"string\") &&\n    (value.logicalPath === undefined || typeof value.logicalPath === \"string\")\n  )\n}\n\nexport function supportsDirectUpload(\n  storage: BlobStorage\n): storage is BlobStorage & DirectUploadBlobStorage {\n  const candidate = storage as Partial<DirectUploadBlobStorage>\n  return (\n    typeof candidate.createUpload === \"function\" &&\n    typeof candidate.signUploadPart === \"function\" &&\n    typeof candidate.completeUpload === \"function\" &&\n    typeof candidate.abortUpload === \"function\"\n  )\n}\n\nexport function supportsRangeRead(\n  storage: BlobStorage\n): storage is BlobStorage & RangeReadableBlobStorage {\n  const candidate = storage as Partial<RangeReadableBlobStorage>\n  return typeof candidate.openRange === \"function\"\n}\n"
   ],
-  "mappings": ";;AAMO,SAAS,aAAa,CAAC,QAA4B;AAAA,EACxD,OAAO,OAAO,MAAM,UAAU,MAAM;AAAA;AAG/B,SAAS,gBAAgB,CAAC,QAA4B;AAAA,EAC3D,OAAO,QAAQ,cAAc,MAAM;AAAA;;;ACFrC,SAAS,aAAa,CAAC,OAAkD;AAAA,EACvE,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AAAA,IACvE,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,OAAO,eAAe,KAAK;AAAA,EAC7C,OAAO,cAAc,OAAO,aAAa,cAAc;AAAA;AAGlD,SAAS,YAAY,CAAC,OAAqC;AAAA,EAChE,OAAO,OAAO,UAAU,YAAY,MAAM,WAAW,SAAS,KAAK,MAAM,SAAS,UAAU;AAAA;AAGvF,SAAS,SAAS,CAAC,OAAkC;AAAA,EAC1D,OACE,cAAc,KAAK,KACnB,OAAO,MAAM,WAAW,YACxB,MAAM,OAAO,KAAK,EAAE,SAAS,KAC7B,aAAa,MAAM,MAAM,KAGzB,MAAM,WAAW,iBAAiB,MAAM,MAAM,KAC9C,OAAO,MAAM,cAAc,YAC3B,OAAO,UAAU,MAAM,SAAS,KAChC,MAAM,aAAa,MAClB,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,cAC1D,MAAM,cAAc,aAAa,OAAO,MAAM,cAAc,cAC5D,MAAM,gBAAgB,aAAa,OAAO,MAAM,gBAAgB;AAAA;AAI9D,SAAS,oBAAoB,CAClC,SACkD;AAAA,EAClD,MAAM,YAAY;AAAA,EAClB,OACE,OAAO,UAAU,iBAAiB,cAClC,OAAO,UAAU,mBAAmB,cACpC,OAAO,UAAU,mBAAmB,cACpC,OAAO,UAAU,gBAAgB;AAAA;AAI9B,SAAS,iBAAiB,CAC/B,SACmD;AAAA,EACnD,MAAM,YAAY;AAAA,EAClB,OAAO,OAAO,UAAU,cAAc;AAAA;",
-  "debugId": "67B4834FB7B6EE4A64756E2164756E21",
+  "mappings": ";;;;;;AAMO,SAAS,aAAa,CAAC,QAA4B;AAAA,EACxD,OAAO,OAAO,MAAM,UAAU,MAAM;AAAA;AAG/B,SAAS,gBAAgB,CAAC,QAA4B;AAAA,EAC3D,OAAO,QAAQ,cAAc,MAAM;AAAA;;;ACD9B,SAAS,YAAY,CAAC,OAAqC;AAAA,EAChE,OAAO,OAAO,UAAU,YAAY,MAAM,WAAW,SAAS,KAAK,MAAM,SAAS,UAAU;AAAA;AAGvF,SAAS,SAAS,CAAC,OAAkC;AAAA,EAC1D,OACE,cAAc,KAAK,KACnB,OAAO,MAAM,WAAW,YACxB,MAAM,OAAO,KAAK,EAAE,SAAS,KAC7B,aAAa,MAAM,MAAM,KAGzB,MAAM,WAAW,iBAAiB,MAAM,MAAM,KAC9C,OAAO,MAAM,cAAc,YAC3B,OAAO,UAAU,MAAM,SAAS,KAChC,MAAM,aAAa,MAClB,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,cAC1D,MAAM,cAAc,aAAa,OAAO,MAAM,cAAc,cAC5D,MAAM,gBAAgB,aAAa,OAAO,MAAM,gBAAgB;AAAA;AAI9D,SAAS,oBAAoB,CAClC,SACkD;AAAA,EAClD,MAAM,YAAY;AAAA,EAClB,OACE,OAAO,UAAU,iBAAiB,cAClC,OAAO,UAAU,mBAAmB,cACpC,OAAO,UAAU,mBAAmB,cACpC,OAAO,UAAU,gBAAgB;AAAA;AAI9B,SAAS,iBAAiB,CAC/B,SACmD;AAAA,EACnD,MAAM,YAAY;AAAA,EAClB,OAAO,OAAO,UAAU,cAAc;AAAA;",
+  "debugId": "CBADD015FD5B0A0D64756E2164756E21",
   "names": []
 }

package/dist/connectors/builders.d.ts

@@ -1,4 +1,4 @@
-import type { ConnectorAdapter, ConnectorDefinition } from "./types";
+import type { ConnectorAdapter, ConnectorDefinition, OAuthConnectorAdapter } from "./types";
 /**
  * Define a connector instance for an external system.
  *
@@ -6,5 +6,6 @@ import type { ConnectorAdapter, ConnectorDefinition } from "./types";
  * `connectors/` module. Use `await sixb.connector(definition)` at runtime to
  * resolve it to a connected client.
  */
+export declare function defineConnector<TId extends string, TAdapter extends OAuthConnectorAdapter>(id: TId, adapter: TAdapter): ConnectorDefinition<TId, TAdapter>;
 export declare function defineConnector<TId extends string, TAdapter extends ConnectorAdapter>(id: TId, adapter: TAdapter): ConnectorDefinition<TId, TAdapter>;
 //# sourceMappingURL=builders.d.ts.map

package/dist/connectors/builders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/connectors/builders.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAQpE;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,SAAS,MAAM,EAAE,QAAQ,SAAS,gBAAgB,EACnF,EAAE,EAAE,GAAG,EACP,OAAO,EAAE,QAAQ,GAChB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAapC"}
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/connectors/builders.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,SAAS,CAAA;AAShB;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,SAAS,MAAM,EAAE,QAAQ,SAAS,qBAAqB,EACxF,EAAE,EAAE,GAAG,EACP,OAAO,EAAE,QAAQ,GAChB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AACrC,wBAAgB,eAAe,CAAC,GAAG,SAAS,MAAM,EAAE,QAAQ,SAAS,gBAAgB,EACnF,EAAE,EAAE,GAAG,EACP,OAAO,EAAE,QAAQ,GAChB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA"}

package/dist/connectors/connections/authorizations.d.ts

@@ -0,0 +1,64 @@
+import type { AuthorizablePrincipal } from "../../execution";
+import type { ConnectorAuthorizationRecord, ConnectorConnectionRecord, ConnectorConnectionStorage } from "../../storage";
+import type { ConnectorCredentialProtector } from "../credentials";
+import type { ConnectorDefinition, ConnectorTokenSource, OAuthConnectorAdapter } from "../types";
+import type { CompleteConnectorReauthorizationInput, CompleteNewConnectorAuthorizationInput, ConnectorAuthorizationLifecycle, PrepareConnectorReauthorizationInput, PreparedConnectorReauthorization } from "./request";
+export type OAuthConnectorDefinition = ConnectorDefinition<string, OAuthConnectorAdapter>;
+export interface ConnectorAuthorizationLifecycleOptions {
+    readonly projectId: string;
+    readonly storage: ConnectorConnectionStorage;
+    readonly credentialProtector: ConnectorCredentialProtector;
+    readonly resolveDefinition: (connectorId: string) => OAuthConnectorDefinition;
+    readonly hostSignal: () => AbortSignal;
+    readonly accountSelectionTtlMs: number;
+    readonly credentialMutationLeaseMs: number;
+    readonly providerOperationTimeoutMs: number;
+    readonly refreshSkewMs: number;
+    readonly now: () => Date;
+}
+export interface RevokeConnectorAuthorizationInput {
+    readonly definition: OAuthConnectorDefinition;
+    readonly authorizationId: string;
+    readonly principal: AuthorizablePrincipal;
+}
+export interface ConnectorAuthorizationRevocation {
+    readonly disconnected: readonly ConnectorConnectionRecord[];
+}
+/**
+ * Owns OAuth grants and their encrypted credentials.
+ *
+ * Request authorization and attempt persistence stay in `request.ts`; provider-side mutations are
+ * fenced here through one shared coordinator. The host owns cancellation and exposes its current
+ * signal through a callback, so closing and restarting a host never leaves this lifecycle attached
+ * to a stale controller.
+ */
+export declare class DefaultConnectorAuthorizationLifecycle implements ConnectorAuthorizationLifecycle {
+    private readonly projectId;
+    private readonly storage;
+    private readonly resolveDefinition;
+    private readonly accountSelectionTtlMs;
+    private readonly mutations;
+    private readonly credentials;
+    private readonly tokens;
+    constructor(options: ConnectorAuthorizationLifecycleOptions);
+    prepareReauthorization(input: PrepareConnectorReauthorizationInput): Promise<PreparedConnectorReauthorization>;
+    completeNewAuthorization(input: CompleteNewConnectorAuthorizationInput): Promise<ConnectorAuthorizationRecord>;
+    completeReauthorization(input: CompleteConnectorReauthorizationInput): Promise<ConnectorAuthorizationRecord>;
+    revokeAuthorization(input: RevokeConnectorAuthorizationInput): Promise<ConnectorAuthorizationRevocation>;
+    /** Continues cleanup only after storage has already fenced the authorization from new usage. */
+    continuePendingRevocation(definition: OAuthConnectorDefinition, authorizationId: string): Promise<ConnectorAuthorizationRevocation>;
+    requireStableActiveAuthorization(definition: OAuthConnectorDefinition, authorizationId: string): Promise<ConnectorAuthorizationRecord>;
+    createTokenSource(definition: OAuthConnectorDefinition, authorizationId: string): ConnectorTokenSource;
+    requireAuthorization(connectorId: string, authorizationId: string): Promise<ConnectorAuthorizationRecord>;
+    private revokeAuthorizationRecord;
+    private revokeAbandonedAuthorization;
+    private completeReauthorizationMutation;
+    private exchangeAuthorizationCode;
+    private discoverAccounts;
+    private adapterContext;
+    private authorizationAdapterContext;
+    private definitionFor;
+    private assertRegistered;
+}
+export declare function assertConnectorAuthorizationActor(authorization: ConnectorAuthorizationRecord, principal: AuthorizablePrincipal): void;
+//# sourceMappingURL=authorizations.d.ts.map

package/dist/connectors/connections/authorizations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizations.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/authorizations.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,EACV,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAA;AAQlE,OAAO,KAAK,EAEV,mBAAmB,EAEnB,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,UAAU,CAAA;AAMjB,OAAO,KAAK,EACV,qCAAqC,EACrC,sCAAsC,EACtC,+BAA+B,EAC/B,oCAAoC,EACpC,gCAAgC,EACjC,MAAM,WAAW,CAAA;AAKlB,MAAM,MAAM,wBAAwB,GAAG,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAA;AAEzF,MAAM,WAAW,sCAAsC;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAA;IAC5C,QAAQ,CAAC,mBAAmB,EAAE,4BAA4B,CAAA;IAC1D,QAAQ,CAAC,iBAAiB,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,wBAAwB,CAAA;IAC7E,QAAQ,CAAC,UAAU,EAAE,MAAM,WAAW,CAAA;IACtC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAA;IAC1C,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAA;IAC3C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAA;CAC1C;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,YAAY,EAAE,SAAS,yBAAyB,EAAE,CAAA;CAC5D;AAED;;;;;;;GAOG;AACH,qBAAa,sCAAuC,YAAW,+BAA+B;IAC5F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmD;IACrF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAQ;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwC;IAClE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0B;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;gBAEjC,OAAO,EAAE,sCAAsC;IAsCrD,sBAAsB,CAC1B,KAAK,EAAE,oCAAoC,GAC1C,OAAO,CAAC,gCAAgC,CAAC;IA+BtC,wBAAwB,CAC5B,KAAK,EAAE,sCAAsC,GAC5C,OAAO,CAAC,4BAA4B,CAAC;IAqFlC,uBAAuB,CAC3B,KAAK,EAAE,qCAAqC,GAC3C,OAAO,CAAC,4BAA4B,CAAC;IAOlC,mBAAmB,CACvB,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,gCAAgC,CAAC;IAY5C,gGAAgG;IAC1F,yBAAyB,CAC7B,UAAU,EAAE,wBAAwB,EACpC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,gCAAgC,CAAC;IActC,gCAAgC,CACpC,UAAU,EAAE,wBAAwB,EACpC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,4BAA4B,CAAC;IAKxC,iBAAiB,CACf,UAAU,EAAE,wBAAwB,EACpC,eAAe,EAAE,MAAM,GACtB,oBAAoB;IAKjB,oBAAoB,CACxB,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,4BAA4B,CAAC;YAmB1B,yBAAyB;YA6FzB,4BAA4B;YAuB5B,+BAA+B;YA4G/B,yBAAyB;YAwBzB,gBAAgB;IAoB9B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,2BAA2B;IAQnC,OAAO,CAAC,aAAa;IAWrB,OAAO,CAAC,gBAAgB;CAQzB;AAED,wBAAgB,iCAAiC,CAC/C,aAAa,EAAE,4BAA4B,EAC3C,SAAS,EAAE,qBAAqB,GAC/B,IAAI,CAUN"}

package/dist/connectors/connections/capability.d.ts

@@ -0,0 +1,7 @@
+import type { ConnectorConnectionCallbackProcess } from "./contracts";
+import type { ConnectorConnectionsRuntime } from "./execution";
+export declare function registerConnectorConnectionsRuntime(owner: object, runtime: ConnectorConnectionsRuntime): void;
+export declare function getConnectorConnectionsRuntime(owner: object): ConnectorConnectionsRuntime;
+export declare function registerConnectorConnectionCallbackProcess(owner: object, process: ConnectorConnectionCallbackProcess): void;
+export declare function getConnectorConnectionCallbackProcess(owner: object): ConnectorConnectionCallbackProcess;
+//# sourceMappingURL=capability.d.ts.map

package/dist/connectors/connections/capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/capability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AAa9D,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,2BAA2B,GACnC,IAAI,CAWN;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,2BAA2B,CAIzF;AAED,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,kCAAkC,GAC1C,IAAI,CAWN;AAED,wBAAgB,qCAAqC,CACnD,KAAK,EAAE,MAAM,GACZ,kCAAkC,CAIpC"}

package/dist/connectors/connections/command-context.d.ts

@@ -0,0 +1,23 @@
+import type { AuthorizablePrincipal } from "../../execution";
+import type { CreateExecutionInput, ExecutionRecord } from "../../storage/executions";
+export interface ConnectorConnectionCommandActor {
+    readonly principal: AuthorizablePrincipal;
+    readonly credential: {
+        readonly type: "session";
+        readonly id: string;
+    } | {
+        readonly type: "accessToken";
+        readonly id: string;
+    };
+}
+/** Validate and recover the authenticated actor carried by one durable request execution. */
+export declare function requireConnectorConnectionCommandActor(execution: CreateExecutionInput, projectId: string): ConnectorConnectionCommandActor;
+/**
+ * Bind an OAuth callback to the same principal and credential that initiated its attempt.
+ *
+ * The storage error intentionally shares the regular invalid-attempt path: callers must not learn
+ * whether a valid state belongs to another authenticated actor.
+ */
+export declare function assertConnectorAuthorizationAttemptInitiator(execution: ExecutionRecord | null, current: ConnectorConnectionCommandActor): asserts execution is ExecutionRecord;
+export declare function assertConnectorConnectionRunInitiator(execution: ExecutionRecord | null, current: ConnectorConnectionCommandActor, connectorId: string): asserts execution is ExecutionRecord;
+//# sourceMappingURL=command-context.d.ts.map

package/dist/connectors/connections/command-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-context.d.ts","sourceRoot":"","sources":["../../../src/connectors/connections/command-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAE5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAErF,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAA;IACzC,QAAQ,CAAC,UAAU,EACf;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GACjD;QAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAC1D;AAED,6FAA6F;AAC7F,wBAAgB,sCAAsC,CACpD,SAAS,EAAE,oBAAoB,EAC/B,SAAS,EAAE,MAAM,GAChB,+BAA+B,CAQjC;AAED;;;;;GAKG;AACH,wBAAgB,4CAA4C,CAC1D,SAAS,EAAE,eAAe,GAAG,IAAI,EACjC,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,SAAS,IAAI,eAAe,CAUtC;AAED,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,eAAe,GAAG,IAAI,EACjC,OAAO,EAAE,+BAA+B,EACxC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,IAAI,eAAe,CAUtC"}