@sixb/core 0.1.12 → 0.1.14

package/dist/{chunk-qm535afa.js → chunk-dv4ct8mp.js}

@@ -2,7 +2,7 @@
 import {
   assertPropertyTokenBelongsToObjectType2,
   assertTelemetryProperty2
-} from "./chunk-vsg0g7h9.js";
+} from "./chunk-d8yes9yx.js";
 import {
   lowerEditBatch2
 } from "./chunk-wr8qp979.js";
@@ -13,10 +13,10 @@ import {
 } from "./chunk-7ytf06d3.js";
 import {
   createLinkScopeFingerprint2
-} from "./chunk-m7cx05vp.js";
+} from "./chunk-00pfcqh4.js";
 import {
   ActionValidationError2
-} from "./chunk-hzw7yv5g.js";
+} from "./chunk-rzkr70gr.js";
 import {
   ActionDefinitionError2,
   ActionEditCommitError2,
@@ -24,10 +24,13 @@ import {
   effectsWithoutEditsMessage,
   assertNonEmpty2,
   isObjectActionDefinition2
-} from "./chunk-2cxv584m.js";
+} from "./chunk-6rzb1g6h.js";
+import {
+  decorateObjectQueryExecutor
+} from "./chunk-k4kkp58d.js";
 import {
   RuntimeError2
-} from "./chunk-2h63nrde.js";
+} from "./chunk-m4ehq95f.js";
 import {
   OntologyValidationError2
 } from "./chunk-cqr3acm1.js";
@@ -256,6 +259,14 @@ class ActionReadRecorder2 {
       lastCommitId: row.lastCommitId
     });
   }
+  observeObjectRows(rows) {
+    for (const row of rows) {
+      this.observeObject({ objectTypeId: row.objectTypeId, primaryId: row.primaryId }, row);
+      for (const value of Object.values(row.links ?? {})) {
+        this.observeObjectRows(expandedRows(value));
+      }
+    }
+  }
   observeLinkScopes(source, linkIds, rows) {
     const snapshotsByLinkId = new Map;
     for (const linkId of linkIds)
@@ -302,14 +313,14 @@ class ActionReadRecorder2 {
     };
   }
 }
-function createActionReadFacade2(createObjectSet, options) {
-  const facade = {
+function createActionReadFacade2(reader, options) {
+  return {
     telemetry: createActionTelemetryReadFacade(options?.telemetry),
     objects(objectType) {
-      return createActionReadObjectSetAdapter(objectType, createObjectSet(objectType), options);
+      const objectSet = reader.objects(objectType);
+      return options ? recordObjectReads(objectType, objectSet, options) : objectSet;
     }
   };
-  return facade;
 }
 function createActionTelemetryReadFacade(source) {
   const facade = {
@@ -367,37 +378,68 @@ function assertTelemetryBatchResultMatchesRequest(requested, results) {
     }
   }
 }
-function createActionReadObjectSetAdapter(objectType, objectSet, options) {
-  async function readObject(id, read) {
-    const row = await read();
-    options?.recorder.observeObject({ objectTypeId: objectType.id, primaryId: id }, row ?? null);
-    return row;
-  }
+function recordObjectReads(objectType, objectSet, options) {
+  const { recorder } = options;
+  const ref = (primaryId) => ({
+    objectTypeId: objectType.id,
+    primaryId
+  });
   return {
-    get(id) {
-      return readObject(id, () => objectSet.get(id));
+    async get(id) {
+      const row = await objectSet.get(id);
+      recorder.observeObject(ref(id), row && storageRow(row));
+      return row;
     },
     query() {
-      return objectSet.query();
+      return decorateObjectQueryExecutor(objectSet.query(), (executor) => recordingExecutor(executor, recorder));
     },
-    list(input) {
-      return objectSet.list(input);
+    async list(input) {
+      const result = await objectSet.list(input);
+      recorder.observeObjectRows(result.objects.map(storageRow));
+      return result;
     },
     byId(id) {
       const handle = objectSet.byId(id);
       return {
-        get() {
-          return readObject(id, () => handle.get());
+        async get() {
+          const row = await handle.get();
+          recorder.observeObject(ref(id), row && storageRow(row));
+          return row;
         },
         async listLinks(link) {
           const rows = await handle.listLinks(link);
-          options?.recorder.observeLinkScopes({ objectTypeId: objectType.id, primaryId: id }, link ? [link.id] : options.resolveLinkIds(objectType.id), rows);
+          recorder.observeLinkScopes(ref(id), link ? [link.id] : options.resolveLinkIds(objectType.id), rows);
           return rows;
         }
       };
     }
   };
 }
+function recordingExecutor(executor, recorder) {
+  return {
+    async list(query, listOptions) {
+      const result = await executor.list(query, listOptions);
+      recorder.observeObjectRows(result.objects.map(storageRow));
+      return result;
+    },
+    count: (query) => executor.count(query),
+    exists: (query) => executor.exists(query),
+    facets: (query, facets) => executor.facets(query, facets),
+    validate: executor.validate?.bind(executor),
+    explain: executor.explain?.bind(executor)
+  };
+}
+function storageRow(row) {
+  return row;
+}
+function expandedRows(value) {
+  if (value === null)
+    return [];
+  return isExpandedRowList(value) ? value : [value];
+}
+function isExpandedRowList(value) {
+  return Array.isArray(value);
+}
 function toLinkSnapshot(row) {
   if (row.lastCommitId === undefined)
     return null;
@@ -547,4 +589,4 @@ function isValidatorErrorResult(value) {
 }
 export { defineAction2, param2, optional2, commitActionEdits2, findActionEditCommit2, ActionReadRecorder2, createActionReadFacade2, ActionRegistry2, runActionValidators2 };
 
-//# debugId=4C98929E6278211764756E2164756E21
+//# debugId=1D163836FC4D0FDC64756E2164756E21

package/dist/chunk-dv4ct8mp.js.map

@@ -0,0 +1,15 @@
+{
+  "version": 3,
+  "sources": ["../src/actions/builders/define-action.ts", "../src/shared/params/builders.ts", "../src/actions/commit-edits.ts", "../src/actions/read-facade.ts", "../src/actions/registry.ts", "../src/actions/validators.ts"],
+  "sourcesContent": [
+    "import type { ObjectTypeWithPropertyTokens } from \"../../ontology/tokens\"\nimport { ActionDefinitionError, effectsWithoutEditsMessage } from \"../errors\"\nimport type {\n  ActionBuilder,\n  ActionEditsHandler,\n  ActionEffectsHandler,\n  ActionParamsConfig,\n  ActionValidator,\n  ActionWritebackHandler,\n  GlobalActionDefinition,\n  GlobalActionEditsHandler,\n  GlobalActionEffectsHandler,\n  GlobalActionPhaseBuilder,\n  GlobalActionValidator,\n  GlobalActionWritebackHandler,\n  ObjectActionDefinition,\n  ObjectActionPhaseBuilder,\n} from \"../types\"\nimport { assertNonEmpty } from \"../validation\"\n\ntype ActionOptions = {\n  description?: string\n}\n\nexport function defineAction<const TId extends string>(\n  id: TId,\n  options?: ActionOptions\n): ActionBuilder<TId> {\n  assertNonEmpty(id, \"id\")\n\n  return asPublicActionType<ActionBuilder<TId>>(createActionBuilder(id, options))\n}\n\nfunction createActionBuilder(id: string, options?: ActionOptions) {\n  const builder = {\n    params(params: ActionParamsConfig) {\n      return createGlobalActionPhaseBuilder(id, params, options)\n    },\n    on(objectType: ObjectTypeWithPropertyTokens) {\n      assertNonEmpty(objectType.id, \"target id\")\n      return createObjectActionParamsBuilder(id, objectType, options)\n    },\n  }\n\n  return builder\n}\n\nfunction createGlobalActionPhaseBuilder(\n  id: string,\n  params: ActionParamsConfig,\n  options?: ActionOptions\n): GlobalActionPhaseBuilder<string, ActionParamsConfig> {\n  const validators: GlobalActionValidator<Record<string, unknown>>[] = []\n\n  const builder = {\n    validate(validator: GlobalActionValidator<Record<string, unknown>>) {\n      validators.push(validator)\n      return builder\n    },\n    writeback(handler: GlobalActionWritebackHandler<Record<string, unknown>, unknown>) {\n      return createGlobalDefinition({\n        id,\n        params,\n        description: options?.description,\n        validators,\n        writeback: handler,\n      })\n    },\n    edits(handler: GlobalActionEditsHandler<Record<string, unknown>, undefined>) {\n      return createGlobalDefinition({\n        id,\n        params,\n        description: options?.description,\n        validators,\n        edits: handler,\n      })\n    },\n  }\n\n  return asPublicActionType<GlobalActionPhaseBuilder<string, ActionParamsConfig>>(builder)\n}\n\nfunction createObjectActionParamsBuilder(\n  id: string,\n  objectType: ObjectTypeWithPropertyTokens,\n  options?: ActionOptions\n) {\n  return {\n    params(params: ActionParamsConfig) {\n      return createObjectActionPhaseBuilder(id, objectType, params, options)\n    },\n  }\n}\n\nfunction createObjectActionPhaseBuilder(\n  id: string,\n  objectType: ObjectTypeWithPropertyTokens,\n  params: ActionParamsConfig,\n  options?: ActionOptions\n): ObjectActionPhaseBuilder<string, ObjectTypeWithPropertyTokens, ActionParamsConfig> {\n  const validators: ActionValidator<ObjectTypeWithPropertyTokens, Record<string, unknown>>[] = []\n\n  const builder = {\n    validate(validator: ActionValidator<ObjectTypeWithPropertyTokens, Record<string, unknown>>) {\n      validators.push(validator)\n      return builder\n    },\n    writeback(\n      handler: ActionWritebackHandler<\n        ObjectTypeWithPropertyTokens,\n        Record<string, unknown>,\n        unknown\n      >\n    ) {\n      return createObjectDefinition({\n        id,\n        objectType,\n        params,\n        description: options?.description,\n        validators,\n        writeback: handler,\n      })\n    },\n    edits(\n      handler: ActionEditsHandler<ObjectTypeWithPropertyTokens, Record<string, unknown>, undefined>\n    ) {\n      return createObjectDefinition({\n        id,\n        objectType,\n        params,\n        description: options?.description,\n        validators,\n        edits: handler,\n      })\n    },\n  }\n\n  return asPublicActionType<\n    ObjectActionPhaseBuilder<string, ObjectTypeWithPropertyTokens, ActionParamsConfig>\n  >(builder)\n}\n\nfunction createGlobalDefinition(input: {\n  readonly id: string\n  readonly params: ActionParamsConfig\n  readonly description?: string\n  readonly validators: readonly unknown[]\n  readonly writeback?: unknown\n  readonly edits?: unknown\n  readonly effects?: unknown\n}): GlobalActionDefinition {\n  const definition = {\n    kind: \"action\",\n    id: input.id,\n    binding: { kind: \"global\" },\n    params: input.params,\n    phases: {\n      validate: [...input.validators],\n      ...(input.writeback ? { writeback: input.writeback } : {}),\n      ...(input.edits ? { edits: input.edits } : {}),\n      ...(input.effects ? { effects: input.effects } : {}),\n    },\n    ...(input.description !== undefined ? { description: input.description } : {}),\n  }\n\n  return asPublicActionType<GlobalActionDefinition>(\n    Object.assign(definition, {\n      edits(handler: GlobalActionEditsHandler<Record<string, unknown>, unknown>) {\n        return createGlobalDefinition({\n          ...input,\n          edits: handler,\n        })\n      },\n      effects(handler: GlobalActionEffectsHandler<Record<string, unknown>, unknown>) {\n        if (!input.edits) {\n          throw new ActionDefinitionError(effectsWithoutEditsMessage(input.id))\n        }\n        return createGlobalDefinition({\n          ...input,\n          effects: handler,\n        })\n      },\n    })\n  )\n}\n\nfunction createObjectDefinition(input: {\n  readonly id: string\n  readonly objectType: ObjectTypeWithPropertyTokens\n  readonly params: ActionParamsConfig\n  readonly description?: string\n  readonly validators: readonly unknown[]\n  readonly writeback?: unknown\n  readonly edits?: unknown\n  readonly effects?: unknown\n}): ObjectActionDefinition {\n  const definition = {\n    kind: \"action\",\n    id: input.id,\n    binding: { kind: \"object\", objectType: input.objectType },\n    params: input.params,\n    phases: {\n      validate: [...input.validators],\n      ...(input.writeback ? { writeback: input.writeback } : {}),\n      ...(input.edits ? { edits: input.edits } : {}),\n      ...(input.effects ? { effects: input.effects } : {}),\n    },\n    ...(input.description !== undefined ? { description: input.description } : {}),\n  }\n\n  return asPublicActionType<ObjectActionDefinition>(\n    Object.assign(definition, {\n      edits(\n        handler: ActionEditsHandler<ObjectTypeWithPropertyTokens, Record<string, unknown>, unknown>\n      ) {\n        return createObjectDefinition({\n          ...input,\n          edits: handler,\n        })\n      },\n      effects(\n        handler: ActionEffectsHandler<\n          ObjectTypeWithPropertyTokens,\n          Record<string, unknown>,\n          unknown\n        >\n      ) {\n        if (!input.edits) {\n          throw new ActionDefinitionError(effectsWithoutEditsMessage(input.id))\n        }\n        return createObjectDefinition({\n          ...input,\n          effects: handler,\n        })\n      },\n    })\n  )\n}\n\n// Runtime builders are plain objects; public builder types carry phase-order inference.\nfunction asPublicActionType<TPublic>(value: unknown): TPublic {\n  return value as TPublic\n}\n",
+    "import type { SchemaOrRef } from \"../../ontology\"\nimport type { QuantitativeTypeId } from \"../../ontology/units\"\nimport type { ParamConfig } from \"./types\"\n\nexport interface ParamOptions {\n  readonly description?: string\n  readonly semanticType?: QuantitativeTypeId\n  readonly nullable?: boolean\n}\n\ntype FieldFromOptions<TOptions, TKey extends string, TFallback> =\n  TOptions extends Record<TKey, infer TValue>\n    ? { [K in TKey]: TValue }\n    : { [K in TKey]?: TFallback }\n\ntype ParamResult<\n  TSchema extends SchemaOrRef,\n  TRequired extends boolean,\n  TOptions extends ParamOptions | undefined,\n> = {\n  schema: TSchema\n  required: TRequired\n} & FieldFromOptions<TOptions, \"description\", string> &\n  FieldFromOptions<TOptions, \"semanticType\", QuantitativeTypeId> &\n  FieldFromOptions<TOptions, \"nullable\", boolean>\n\n/** Declare one required parameter. */\nexport function param<\n  const TSchema extends SchemaOrRef,\n  const TOptions extends ParamOptions | undefined = undefined,\n>(schema: TSchema, options?: TOptions): ParamResult<TSchema, true, TOptions> {\n  const result: ParamConfig & { required: true } = {\n    schema,\n    required: true,\n    ...(options?.description !== undefined ? { description: options.description } : {}),\n    ...(options?.semanticType !== undefined ? { semanticType: options.semanticType } : {}),\n    ...(options?.nullable !== undefined ? { nullable: options.nullable } : {}),\n  }\n  return result as ParamResult<TSchema, true, TOptions>\n}\n\n/** Derive an optional parameter without changing its schema or metadata. */\nexport function optional<const TParam extends ParamConfig>(\n  paramConfig: TParam\n): Omit<TParam, \"required\"> & { readonly required: false } {\n  return {\n    ...paramConfig,\n    required: false,\n  }\n}\n",
+    "import type { EditBatch } from \"../edits\"\nimport { lowerEditBatch } from \"../edits\"\nimport type {\n  EditCommitResult,\n  EffectiveLinkChange,\n  EffectiveObjectChange,\n  ExpectedLinkRevision,\n  ExpectedLinkScopeRevision,\n  ExpectedObjectRevision,\n  OntologyOperationOutcome,\n} from \"../materializer\"\nimport type { OntologyMutationRuntime } from \"../runtime/ontology-mutations\"\nimport type { Storage } from \"../storage/types\"\nimport { ActionEditCommitError } from \"./errors\"\n\n/** Exact reads an Action handler depended on, protected by row-level CAS at commit time. */\nexport interface ActionReadDependencies {\n  readonly objects: readonly ExpectedObjectRevision[]\n  readonly links: readonly ExpectedLinkRevision[]\n  readonly linkScopes: readonly ExpectedLinkScopeRevision[]\n}\n\nconst NO_READ_DEPENDENCIES: ActionReadDependencies = { objects: [], links: [], linkScopes: [] }\n\nexport interface CommitActionEditsInput {\n  readonly mutations: Pick<OntologyMutationRuntime, \"commitEdits\">\n  readonly projectId: string\n  readonly runId: string\n  readonly actionId: string\n  readonly batch: EditBatch\n  readonly dependencies?: ActionReadDependencies\n}\n\n/** The authoritative ontology commit an Action run produced. */\nexport interface ActionEditCommitResult {\n  readonly commitId: string\n  readonly created: boolean\n  readonly eventCount: number\n  readonly outcomes: readonly OntologyOperationOutcome[]\n  readonly changes: {\n    readonly objects: readonly EffectiveObjectChange[]\n    readonly links: readonly EffectiveLinkChange[]\n  }\n  readonly committedAt: Date\n}\n\nexport interface FindActionEditCommitInput {\n  readonly storage: Pick<Storage, \"ontology\">\n  readonly projectId: string\n  readonly runId: string\n}\n\n/**\n * Commits one Action run's recorded edits as a single atomic ontology commit.\n *\n * The batch lowers to canonical Materializer operations and the Materializer validates the Action run\n * identity, applies managed authority, resolves effective state, writes the authoritative commit, and\n * inserts outbox facts in one transaction. Repeating the call for the same run replays that commit;\n * a divergent request for the same run is a typed idempotency conflict.\n */\nexport async function commitActionEdits(\n  input: CommitActionEditsInput\n): Promise<ActionEditCommitResult> {\n  const dependencies = input.dependencies ?? NO_READ_DEPENDENCIES\n  const commit = await input.mutations.commitEdits({\n    mode: \"atomic\",\n    source: { kind: \"action\", actionId: input.actionId, runId: input.runId },\n    operations: lowerEditBatch(input.batch),\n    expectedObjects: dependencies.objects,\n    expectedLinks: dependencies.links,\n    expectedLinkScopes: dependencies.linkScopes,\n  })\n  return toActionEditCommitResult(commit)\n}\n\n/**\n * Resolves the authoritative commit an Action run already produced, if any.\n *\n * Resume uses the exact `{ actionRunId }` origin instead of rerunning handlers, so a redelivered run\n * returns the persisted result without recomputing an idempotency hash.\n */\nexport async function findActionEditCommit(\n  input: FindActionEditCommitInput\n): Promise<ActionEditCommitResult | null> {\n  const record = await input.storage.ontology.commits.getByOrigin({\n    projectId: input.projectId,\n    origin: { kind: \"action\", actionRunId: input.runId },\n  })\n  if (!record) return null\n  if (record.result.kind !== \"edit\") {\n    throw new ActionEditCommitError(\n      `[Sixb] Action run '${input.runId}' resolved a '${record.result.kind}' commit instead of an edit commit.`\n    )\n  }\n  return toActionEditCommitResult({ ...record.result, created: false })\n}\n\nfunction toActionEditCommitResult(commit: EditCommitResult): ActionEditCommitResult {\n  return {\n    commitId: commit.commitId,\n    created: commit.created,\n    eventCount: commit.eventCount,\n    outcomes: commit.outcomes,\n    changes: commit.changes,\n    committedAt: new Date(commit.committedAt),\n  }\n}\n",
+    "import { linkRefKey, linkScopeKey, objectRefKey } from \"../materialization/refs\"\nimport type {\n  EffectiveLinkSnapshot,\n  ExpectedLinkRevision,\n  ExpectedLinkScopeRevision,\n  ExpectedObjectRevision,\n  OntologyLinkRef,\n  OntologyObjectRef,\n} from \"../materializer\"\nimport { createLinkScopeFingerprint } from \"../materializer\"\nimport { decorateObjectQueryExecutor } from \"../objects/sdk/query-builder\"\nimport type { ObjectQueryExecutor } from \"../objects/sdk/query-executor\"\nimport { OntologyValidationError } from \"../ontology/errors\"\nimport type { ObjectTypeWithPropertyTokens } from \"../ontology/tokens\"\nimport {\n  assertPropertyTokenBelongsToObjectType,\n  assertTelemetryProperty,\n} from \"../ontology/validation\"\nimport { RuntimeError } from \"../runtime/errors\"\nimport type { ObjectReader, ObjectReadSet } from \"../runtime/types\"\nimport type {\n  ExpandedLinkValue,\n  ExpandedObjectRow,\n  ObjectLinkRow,\n  ObjectRow,\n  TimeseriesHistoryBatchInput,\n  TimeseriesHistoryBatchResult,\n} from \"../storage\"\nimport type { ActionReadDependencies } from \"./commit-edits\"\nimport type {\n  ActionReadFacade,\n  ActionTelemetryHistorySeriesInput,\n  ActionTelemetryReadFacade,\n} from \"./types\"\n\n/** Runtime leaves used by the Action telemetry read adapter. */\nexport interface ActionTelemetryReadSource {\n  readonly resolveObjectType: (objectTypeId: string) => ObjectTypeWithPropertyTokens\n  readonly getHistoryBatch: (\n    input: Omit<TimeseriesHistoryBatchInput, \"projectId\">\n  ) => Promise<readonly TimeseriesHistoryBatchResult[]>\n}\n\n/**\n * Records the exact state an Action handler observed while reading.\n *\n * A handler that reads one dependency twice keeps the first observation: the commit must fail when\n * current state no longer matches what the decision was made against, and the later read may already\n * reflect the handler's own intent. Objects returned by `list()` and `query()` are fenced like\n * concrete reads, but query membership is not yet: an object that starts matching a query after the\n * read, and aggregate results (`count()`, `exists()`, `facets()`), stay unfenced. Telemetry history\n * is also a call-level snapshot, not an edit dependency.\n */\nexport class ActionReadRecorder {\n  private readonly objects = new Map<string, ExpectedObjectRevision>()\n  private readonly links = new Map<string, ExpectedLinkRevision>()\n  private readonly linkScopes = new Map<string, ExpectedLinkScopeRevision>()\n\n  /** Records a concrete object read, including exact absence. */\n  observeObject(ref: OntologyObjectRef, row: ObjectRow | null): void {\n    const key = objectRefKey(ref)\n    if (this.objects.has(key)) return\n    if (!row) {\n      this.objects.set(key, { ref, exists: false })\n      return\n    }\n    // Rows without materializer provenance predate the commit ledger and cannot be fenced.\n    if (row.lastCommitId === undefined) return\n    this.objects.set(key, {\n      ref,\n      exists: true,\n      version: row.version,\n      lastCommitId: row.lastCommitId,\n    })\n  }\n\n  /**\n   * Records every object a listing or query returned, including the objects its expansions attached.\n   *\n   * Rows are keyed by their own type: a traversal or subtype query returns objects of a type other\n   * than the one the query started from, and the commit checks each row under its exact identity.\n   */\n  observeObjectRows(rows: readonly ObjectRow[]): void {\n    for (const row of rows) {\n      this.observeObject({ objectTypeId: row.objectTypeId, primaryId: row.primaryId }, row)\n      for (const value of Object.values(row.links ?? {})) {\n        this.observeObjectRows(expandedRows(value))\n      }\n    }\n  }\n\n  /**\n   * Records the complete `(source, linkId)` scopes a link listing observed.\n   *\n   * `linkIds` names every scope the read covered so an empty scope is recorded as an empty\n   * fingerprint rather than being silently omitted.\n   */\n  observeLinkScopes(\n    source: OntologyObjectRef,\n    linkIds: readonly string[],\n    rows: readonly ObjectLinkRow[]\n  ): void {\n    const snapshotsByLinkId = new Map<string, EffectiveLinkSnapshot[]>()\n    for (const linkId of linkIds) snapshotsByLinkId.set(linkId, [])\n    /** Scopes holding a row that cannot be fenced, so no expectation may be recorded for them. */\n    const unfenceable = new Set<string>()\n\n    for (const row of rows) {\n      if (row.sourceTypeId !== source.objectTypeId || row.sourceId !== source.primaryId) continue\n      const snapshots = snapshotsByLinkId.get(row.linkId)\n      if (!snapshots) continue\n      const snapshot = toLinkSnapshot(row)\n      if (!snapshot) {\n        // Same rule `observeObject` applies to rows without materializer provenance: record no\n        // expectation at all. A fingerprint computed over the remaining rows would describe a scope\n        // the store can never reproduce, turning every such read into a guaranteed conflict.\n        unfenceable.add(row.linkId)\n        continue\n      }\n      snapshots.push(snapshot)\n      this.observeLink(snapshot.ref, snapshot)\n    }\n\n    for (const [linkId, snapshots] of snapshotsByLinkId) {\n      if (unfenceable.has(linkId)) continue\n      const key = linkScopeKey(source, linkId)\n      if (this.linkScopes.has(key)) continue\n      this.linkScopes.set(key, {\n        source,\n        linkId,\n        fingerprint: createLinkScopeFingerprint(snapshots),\n      })\n    }\n  }\n\n  /** Records a concrete link read, including exact absence. */\n  observeLink(ref: OntologyLinkRef, snapshot: EffectiveLinkSnapshot | null): void {\n    const key = linkRefKey(ref)\n    if (this.links.has(key)) return\n    this.links.set(\n      key,\n      snapshot ? { ref, exists: true, lastCommitId: snapshot.lastCommitId } : { ref, exists: false }\n    )\n  }\n\n  dependencies(): ActionReadDependencies {\n    return {\n      objects: [...this.objects.values()],\n      links: [...this.links.values()],\n      linkScopes: [...this.linkScopes.values()],\n    }\n  }\n}\n\nexport interface ActionReadFacadeOptions {\n  /** Records what the handler observed, so the commit can be fenced against it. */\n  readonly recorder: ActionReadRecorder\n  /**\n   * Every link the object type carries, inherited links included.\n   *\n   * Inheritance is resolved by the Ontology registry, not by the imported definition, so an\n   * `extends` type would otherwise report only its own links and drop inherited ones from the\n   * recorded scopes.\n   */\n  readonly resolveLinkIds: (objectTypeId: string) => readonly string[]\n  /** Canonical authorized telemetry history leaf. Omitted only by isolated facade consumers. */\n  readonly telemetry?: ActionTelemetryReadSource\n}\n\n/** Exposes `reader`'s object reads to an Action handler; with `options`, each read is recorded. */\nexport function createActionReadFacade(\n  reader: ObjectReader,\n  options?: ActionReadFacadeOptions\n): ActionReadFacade {\n  return {\n    telemetry: createActionTelemetryReadFacade(options?.telemetry),\n    objects<const TObjectType extends ObjectTypeWithPropertyTokens>(objectType: TObjectType) {\n      const objectSet = reader.objects(objectType)\n      return options ? recordObjectReads(objectType, objectSet, options) : objectSet\n    },\n  }\n}\n\nfunction createActionTelemetryReadFacade(\n  source: ActionTelemetryReadSource | undefined\n): ActionTelemetryReadFacade {\n  const facade = {\n    async historyBatch(input: {\n      readonly series: readonly ActionTelemetryHistorySeriesInput[]\n      readonly from?: Date\n      readonly to?: Date\n      readonly limitPerSeries?: number\n      readonly order?: \"asc\" | \"desc\"\n    }) {\n      if (!source) {\n        throw new RuntimeError(\n          \"[Sixb] Action telemetry history requires a configured telemetry read source.\"\n        )\n      }\n      if (input.series.length === 0) {\n        return []\n      }\n\n      const requestedSeries = input.series.map((entry) => {\n        const objectType = source.resolveObjectType(entry.property.objectTypeId)\n        assertPropertyTokenBelongsToObjectType(objectType, entry.property)\n        const registeredProperty = objectType.properties.find(\n          (property) => property.id === entry.property.id\n        )\n        if (!registeredProperty) {\n          throw new OntologyValidationError(\n            `[Sixb] Unknown property '${entry.property.id}' for object type '${objectType.id}'`\n          )\n        }\n        assertTelemetryProperty(registeredProperty)\n        return {\n          objectTypeId: objectType.id,\n          objectId: entry.objectId,\n          propertyId: registeredProperty.id,\n        }\n      })\n\n      const results = await source.getHistoryBatch({\n        series: requestedSeries,\n        ...(input.from !== undefined ? { from: input.from } : {}),\n        ...(input.to !== undefined ? { to: input.to } : {}),\n        ...(input.limitPerSeries !== undefined ? { limitPerSeries: input.limitPerSeries } : {}),\n        ...(input.order !== undefined ? { order: input.order } : {}),\n      })\n      assertTelemetryBatchResultMatchesRequest(requestedSeries, results)\n\n      return input.series.map((entry, index) => ({\n        objectId: entry.objectId,\n        property: entry.property,\n        points: results[index].points.map((point) => ({\n          value: point.value,\n          at: point.at,\n          ...(point.unit !== undefined ? { unit: point.unit } : {}),\n        })),\n      }))\n    },\n  }\n\n  // Cast needed at the generic token boundary: the implementation deliberately manipulates raw\n  // provider values while the public facade maps every tuple position back to its property token.\n  return facade as unknown as ActionTelemetryReadFacade\n}\n\nfunction assertTelemetryBatchResultMatchesRequest(\n  requested: readonly {\n    readonly objectTypeId: string\n    readonly objectId: string\n    readonly propertyId: string\n  }[],\n  results: readonly TimeseriesHistoryBatchResult[]\n): void {\n  if (results.length !== requested.length) {\n    throw new RuntimeError(\n      `[Sixb] Telemetry history provider returned ${results.length} batch results for ${requested.length} requested series.`\n    )\n  }\n\n  for (let index = 0; index < requested.length; index += 1) {\n    const expected = requested[index]\n    const actual = results[index]\n    if (\n      actual.objectTypeId !== expected.objectTypeId ||\n      actual.objectId !== expected.objectId ||\n      actual.propertyId !== expected.propertyId\n    ) {\n      throw new RuntimeError(\n        `[Sixb] Telemetry history provider returned an unexpected series at batch index ${index}.`\n      )\n    }\n  }\n}\n\nfunction recordObjectReads<TObjectType extends ObjectTypeWithPropertyTokens>(\n  objectType: TObjectType,\n  objectSet: ObjectReadSet<TObjectType>,\n  options: ActionReadFacadeOptions\n): ObjectReadSet<TObjectType> {\n  const { recorder } = options\n  const ref = (primaryId: string): OntologyObjectRef => ({\n    objectTypeId: objectType.id,\n    primaryId,\n  })\n\n  return {\n    async get(id) {\n      const row = await objectSet.get(id)\n      recorder.observeObject(ref(id), row && storageRow(row))\n      return row\n    },\n    query() {\n      // Recording at the executor covers every terminal of every refinement, present and future.\n      return decorateObjectQueryExecutor(objectSet.query(), (executor) =>\n        recordingExecutor(executor, recorder)\n      )\n    },\n    async list(input) {\n      const result = await objectSet.list(input)\n      recorder.observeObjectRows(result.objects.map(storageRow))\n      return result\n    },\n    byId(id) {\n      const handle = objectSet.byId(id)\n      return {\n        async get() {\n          const row = await handle.get()\n          recorder.observeObject(ref(id), row && storageRow(row))\n          return row\n        },\n        async listLinks(link) {\n          const rows = await handle.listLinks(link)\n          recorder.observeLinkScopes(\n            ref(id),\n            link ? [link.id] : options.resolveLinkIds(objectType.id),\n            rows\n          )\n          return rows\n        },\n      }\n    },\n  }\n}\n\n/**\n * Delegates to `executor` and records the objects its row queries return.\n *\n * Aggregates (`count()`, `exists()`, `facets()`) return no rows to fence; protecting their result\n * needs query-level dependencies.\n */\nfunction recordingExecutor(\n  executor: ObjectQueryExecutor,\n  recorder: ActionReadRecorder\n): ObjectQueryExecutor {\n  return {\n    async list(query, listOptions) {\n      const result = await executor.list(query, listOptions)\n      recorder.observeObjectRows(result.objects.map(storageRow))\n      return result\n    },\n    count: (query) => executor.count(query),\n    exists: (query) => executor.exists(query),\n    facets: (query, facets) => executor.facets(query, facets),\n    validate: executor.validate?.bind(executor),\n    explain: executor.explain?.bind(executor),\n  }\n}\n\n/**\n * Runtime reads return storage rows; the SDK row types only leave out the commit fields a fence\n * needs.\n */\nfunction storageRow(row: object): ObjectRow {\n  return row as ObjectRow\n}\n\nfunction expandedRows(value: ExpandedLinkValue): readonly ObjectRow[] {\n  if (value === null) return []\n  return isExpandedRowList(value) ? value : [value]\n}\n\n// `Array.isArray` does not narrow a readonly array out of a union.\nfunction isExpandedRowList(value: ExpandedLinkValue): value is readonly ExpandedObjectRow[] {\n  return Array.isArray(value)\n}\n\nfunction toLinkSnapshot(row: ObjectLinkRow): EffectiveLinkSnapshot | null {\n  // Rows without materializer provenance predate the commit ledger and cannot be fenced.\n  if (row.lastCommitId === undefined) return null\n  return {\n    ref: {\n      source: { objectTypeId: row.sourceTypeId, primaryId: row.sourceId },\n      linkId: row.linkId,\n      target: { objectTypeId: row.targetTypeId, primaryId: row.targetId },\n    },\n    ...(row.properties !== undefined\n      ? { properties: row.properties as EffectiveLinkSnapshot[\"properties\"] }\n      : {}),\n    createdAt: row.createdAt.toISOString(),\n    updatedAt: row.updatedAt.toISOString(),\n    lastCommitId: row.lastCommitId,\n  }\n}\n",
+    "import type { ObjectType, OntologyDefinitionCatalog } from \"../ontology\"\nimport {\n  ActionDefinitionError,\n  effectsWithoutEditsMessage,\n  missingActionMutationMessage,\n} from \"./errors\"\nimport type { ActionDefinition, ObjectActionDefinition } from \"./types\"\nimport { isObjectActionDefinition } from \"./validation\"\n\nexport interface ActionDefinitionCatalog {\n  list(): readonly ActionDefinition[]\n  getById(id: string): ActionDefinition | null\n  listGlobal(): readonly ActionDefinition[]\n  listForType(type: ObjectType): readonly ObjectActionDefinition[]\n}\n\nexport interface ActionRegistryOptions {\n  readonly actions: readonly ActionDefinition[]\n  readonly ontology: OntologyDefinitionCatalog\n}\n\nexport class ActionRegistry implements ActionDefinitionCatalog {\n  private readonly byId = new Map<string, ActionDefinition>()\n  private readonly globalActions: ActionDefinition[] = []\n  private readonly byTargetId = new Map<string, ObjectActionDefinition[]>()\n\n  private readonly ontology: OntologyDefinitionCatalog\n\n  constructor(options: ActionRegistryOptions) {\n    this.ontology = options.ontology\n\n    for (const action of options.actions) {\n      const previous = this.byId.get(action.id)\n      if (previous) {\n        const chainDuplicate = this.getInheritanceDuplicate(action, previous)\n        if (chainDuplicate) {\n          throw new ActionDefinitionError(\n            `Duplicate action id \"${action.id}\" in inheritance chain of \"${chainDuplicate.objectTypeId}\": defined on both \"${chainDuplicate.firstTargetId}\" and \"${chainDuplicate.secondTargetId}\".`\n          )\n        }\n\n        throw new ActionDefinitionError(\n          `Duplicate action id \"${action.id}\" declared in multiple files.`\n        )\n      }\n\n      this.validatePhases(action)\n      this.byId.set(action.id, action)\n\n      if (!isObjectActionDefinition(action)) {\n        this.globalActions.push(action)\n        continue\n      }\n\n      const objectType = action.binding.objectType\n      const target = this.ontology.getObjectTypeById(objectType.id)\n      if (!target) {\n        throw new ActionDefinitionError(\n          `Action \"${action.id}\" targets unknown object type \"${objectType.id}\". Add the object type to ontology before registering the action.`\n        )\n      }\n\n      const bucket = this.byTargetId.get(objectType.id) ?? []\n      bucket.push(action)\n      this.byTargetId.set(objectType.id, bucket)\n    }\n  }\n\n  private validatePhases(action: ActionDefinition): void {\n    const hasWriteback = action.phases.writeback !== undefined\n    const hasEdits = action.phases.edits !== undefined\n    const hasEffects = action.phases.effects !== undefined\n\n    if (!hasWriteback && !hasEdits) {\n      throw new ActionDefinitionError(missingActionMutationMessage(action.id))\n    }\n\n    if (hasEffects && !hasEdits) {\n      throw new ActionDefinitionError(effectsWithoutEditsMessage(action.id))\n    }\n  }\n\n  list(): readonly ActionDefinition[] {\n    return [...this.byId.values()]\n  }\n\n  getById(id: string): ActionDefinition | null {\n    return this.byId.get(id) ?? null\n  }\n\n  listGlobal(): readonly ActionDefinition[] {\n    return [...this.globalActions]\n  }\n\n  listForType(type: ObjectType): readonly ObjectActionDefinition[] {\n    this.ontology.resolveObjectType(type.id)\n\n    const seen = new Set<string>()\n    const result: ObjectActionDefinition[] = []\n\n    for (const ancestor of this.ontology.listAncestorChain(type)) {\n      for (const action of this.byTargetId.get(ancestor.id) ?? []) {\n        if (seen.has(action.id)) continue\n        seen.add(action.id)\n        result.push(action)\n      }\n    }\n\n    return result\n  }\n\n  private getInheritanceDuplicate(\n    action: ActionDefinition,\n    previous: ActionDefinition\n  ): { objectTypeId: string; firstTargetId: string; secondTargetId: string } | null {\n    if (!isObjectActionDefinition(action) || !isObjectActionDefinition(previous)) {\n      return null\n    }\n\n    const actionObjectType = action.binding.objectType\n    const previousObjectType = previous.binding.objectType\n\n    if (actionObjectType.id === previousObjectType.id) {\n      return null\n    }\n\n    const actionChain = this.ontology.listAncestorChain(actionObjectType)\n    if (actionChain.some((ancestor) => ancestor.id === previousObjectType.id)) {\n      return {\n        objectTypeId: actionObjectType.id,\n        firstTargetId: previousObjectType.id,\n        secondTargetId: actionObjectType.id,\n      }\n    }\n\n    const previousChain = this.ontology.listAncestorChain(previousObjectType)\n    if (previousChain.some((ancestor) => ancestor.id === actionObjectType.id)) {\n      return {\n        objectTypeId: previousObjectType.id,\n        firstTargetId: actionObjectType.id,\n        secondTargetId: previousObjectType.id,\n      }\n    }\n\n    return null\n  }\n}\n",
+    "import { ActionValidationError } from \"../objects/action/errors\"\nimport type { ActionDefinition, ActionSubject, ActionTargetObject } from \"./types\"\nimport { isObjectActionDefinition } from \"./validation\"\n\ntype RuntimePhaseHandler = (ctx: unknown) => unknown | Promise<unknown>\n\nexport async function runActionValidators<TBaseContext extends object>(input: {\n  readonly action: ActionDefinition\n  readonly subject: ActionSubject\n  readonly baseContext: TBaseContext\n  readonly target?: ActionTargetObject | null\n}): Promise<void> {\n  const validators = input.action.phases.validate as readonly RuntimePhaseHandler[]\n  if (validators.length === 0) {\n    return\n  }\n\n  if (!isObjectActionDefinition(input.action)) {\n    for (const validator of validators) {\n      const result = await validator(input.baseContext)\n      if (isValidatorErrorResult(result)) {\n        throw new ActionValidationError(result.error, {\n          actionId: input.action.id,\n          subject: input.subject,\n        })\n      }\n    }\n    return\n  }\n\n  if (!input.target) {\n    throw new Error(`[Sixb] Action '${input.action.id}' requires an object target.`)\n  }\n\n  for (const validator of validators) {\n    const result = await validator({\n      ...input.baseContext,\n      target: input.target,\n    })\n    if (isValidatorErrorResult(result)) {\n      throw new ActionValidationError(result.error, {\n        actionId: input.action.id,\n        subject: input.subject,\n      })\n    }\n  }\n}\n\nfunction isValidatorErrorResult(value: unknown): value is { readonly error: string } {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    \"error\" in value &&\n    typeof value.error === \"string\"\n  )\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBO,SAAS,aAAsC,CACpD,IACA,SACoB;AAAA,EACpB,gBAAe,IAAI,IAAI;AAAA,EAEvB,OAAO,mBAAuC,oBAAoB,IAAI,OAAO,CAAC;AAAA;AAGhF,SAAS,mBAAmB,CAAC,IAAY,SAAyB;AAAA,EAChE,MAAM,UAAU;AAAA,IACd,MAAM,CAAC,QAA4B;AAAA,MACjC,OAAO,+BAA+B,IAAI,QAAQ,OAAO;AAAA;AAAA,IAE3D,EAAE,CAAC,YAA0C;AAAA,MAC3C,gBAAe,WAAW,IAAI,WAAW;AAAA,MACzC,OAAO,gCAAgC,IAAI,YAAY,OAAO;AAAA;AAAA,EAElE;AAAA,EAEA,OAAO;AAAA;AAGT,SAAS,8BAA8B,CACrC,IACA,QACA,SACsD;AAAA,EACtD,MAAM,aAA+D,CAAC;AAAA,EAEtE,MAAM,UAAU;AAAA,IACd,QAAQ,CAAC,WAA2D;AAAA,MAClE,WAAW,KAAK,SAAS;AAAA,MACzB,OAAO;AAAA;AAAA,IAET,SAAS,CAAC,SAAyE;AAAA,MACjF,OAAO,uBAAuB;AAAA,QAC5B;AAAA,QACA;AAAA,QACA,aAAa,SAAS;AAAA,QACtB;AAAA,QACA,WAAW;AAAA,MACb,CAAC;AAAA;AAAA,IAEH,KAAK,CAAC,SAAuE;AAAA,MAC3E,OAAO,uBAAuB;AAAA,QAC5B;AAAA,QACA;AAAA,QACA,aAAa,SAAS;AAAA,QACtB;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAAA;AAAA,EAEL;AAAA,EAEA,OAAO,mBAAyE,OAAO;AAAA;AAGzF,SAAS,+BAA+B,CACtC,IACA,YACA,SACA;AAAA,EACA,OAAO;AAAA,IACL,MAAM,CAAC,QAA4B;AAAA,MACjC,OAAO,+BAA+B,IAAI,YAAY,QAAQ,OAAO;AAAA;AAAA,EAEzE;AAAA;AAGF,SAAS,8BAA8B,CACrC,IACA,YACA,QACA,SACoF;AAAA,EACpF,MAAM,aAAuF,CAAC;AAAA,EAE9F,MAAM,UAAU;AAAA,IACd,QAAQ,CAAC,WAAmF;AAAA,MAC1F,WAAW,KAAK,SAAS;AAAA,MACzB,OAAO;AAAA;AAAA,IAET,SAAS,CACP,SAKA;AAAA,MACA,OAAO,uBAAuB;AAAA,QAC5B;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,SAAS;AAAA,QACtB;AAAA,QACA,WAAW;AAAA,MACb,CAAC;AAAA;AAAA,IAEH,KAAK,CACH,SACA;AAAA,MACA,OAAO,uBAAuB;AAAA,QAC5B;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,SAAS;AAAA,QACtB;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAAA;AAAA,EAEL;AAAA,EAEA,OAAO,mBAEL,OAAO;AAAA;AAGX,SAAS,sBAAsB,CAAC,OAQL;AAAA,EACzB,MAAM,aAAa;AAAA,IACjB,MAAM;AAAA,IACN,IAAI,MAAM;AAAA,IACV,SAAS,EAAE,MAAM,SAAS;AAAA,IAC1B,QAAQ,MAAM;AAAA,IACd,QAAQ;AAAA,MACN,UAAU,CAAC,GAAG,MAAM,UAAU;AAAA,SAC1B,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,SACpD,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,SACxC,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IACpD;AAAA,OACI,MAAM,gBAAgB,YAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,EAC9E;AAAA,EAEA,OAAO,mBACL,OAAO,OAAO,YAAY;AAAA,IACxB,KAAK,CAAC,SAAqE;AAAA,MACzE,OAAO,uBAAuB;AAAA,WACzB;AAAA,QACH,OAAO;AAAA,MACT,CAAC;AAAA;AAAA,IAEH,OAAO,CAAC,SAAuE;AAAA,MAC7E,IAAI,CAAC,MAAM,OAAO;AAAA,QAChB,MAAM,IAAI,uBAAsB,2BAA2B,MAAM,EAAE,CAAC;AAAA,MACtE;AAAA,MACA,OAAO,uBAAuB;AAAA,WACzB;AAAA,QACH,SAAS;AAAA,MACX,CAAC;AAAA;AAAA,EAEL,CAAC,CACH;AAAA;AAGF,SAAS,sBAAsB,CAAC,OASL;AAAA,EACzB,MAAM,aAAa;AAAA,IACjB,MAAM;AAAA,IACN,IAAI,MAAM;AAAA,IACV,SAAS,EAAE,MAAM,UAAU,YAAY,MAAM,WAAW;AAAA,IACxD,QAAQ,MAAM;AAAA,IACd,QAAQ;AAAA,MACN,UAAU,CAAC,GAAG,MAAM,UAAU;AAAA,SAC1B,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,SACpD,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,SACxC,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IACpD;AAAA,OACI,MAAM,gBAAgB,YAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,EAC9E;AAAA,EAEA,OAAO,mBACL,OAAO,OAAO,YAAY;AAAA,IACxB,KAAK,CACH,SACA;AAAA,MACA,OAAO,uBAAuB;AAAA,WACzB;AAAA,QACH,OAAO;AAAA,MACT,CAAC;AAAA;AAAA,IAEH,OAAO,CACL,SAKA;AAAA,MACA,IAAI,CAAC,MAAM,OAAO;AAAA,QAChB,MAAM,IAAI,uBAAsB,2BAA2B,MAAM,EAAE,CAAC;AAAA,MACtE;AAAA,MACA,OAAO,uBAAuB;AAAA,WACzB;AAAA,QACH,SAAS;AAAA,MACX,CAAC;AAAA;AAAA,EAEL,CAAC,CACH;AAAA;AAIF,SAAS,kBAA2B,CAAC,OAAyB;AAAA,EAC5D,OAAO;AAAA;;ACtNF,SAAS,MAGf,CAAC,QAAiB,SAA0D;AAAA,EAC3E,MAAM,SAA2C;AAAA,IAC/C;AAAA,IACA,UAAU;AAAA,OACN,SAAS,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,OAC7E,SAAS,iBAAiB,YAAY,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;AAAA,OAChF,SAAS,aAAa,YAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC1E;AAAA,EACA,OAAO;AAAA;AAIF,SAAS,SAA0C,CACxD,aACyD;AAAA,EACzD,OAAO;AAAA,OACF;AAAA,IACH,UAAU;AAAA,EACZ;AAAA;;AC1BF,IAAM,uBAA+C,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,YAAY,CAAC,EAAE;AAsC9F,eAAsB,kBAAiB,CACrC,OACiC;AAAA,EACjC,MAAM,eAAe,MAAM,gBAAgB;AAAA,EAC3C,MAAM,SAAS,MAAM,MAAM,UAAU,YAAY;AAAA,IAC/C,MAAM;AAAA,IACN,QAAQ,EAAE,MAAM,UAAU,UAAU,MAAM,UAAU,OAAO,MAAM,MAAM;AAAA,IACvE,YAAY,gBAAe,MAAM,KAAK;AAAA,IACtC,iBAAiB,aAAa;AAAA,IAC9B,eAAe,aAAa;AAAA,IAC5B,oBAAoB,aAAa;AAAA,EACnC,CAAC;AAAA,EACD,OAAO,yBAAyB,MAAM;AAAA;AASxC,eAAsB,qBAAoB,CACxC,OACwC;AAAA,EACxC,MAAM,SAAS,MAAM,MAAM,QAAQ,SAAS,QAAQ,YAAY;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,QAAQ,EAAE,MAAM,UAAU,aAAa,MAAM,MAAM;AAAA,EACrD,CAAC;AAAA,EACD,IAAI,CAAC;AAAA,IAAQ,OAAO;AAAA,EACpB,IAAI,OAAO,OAAO,SAAS,QAAQ;AAAA,IACjC,MAAM,IAAI,uBACR,sBAAsB,MAAM,sBAAsB,OAAO,OAAO,yCAClE;AAAA,EACF;AAAA,EACA,OAAO,yBAAyB,KAAK,OAAO,QAAQ,SAAS,MAAM,CAAC;AAAA;AAGtE,SAAS,wBAAwB,CAAC,QAAkD;AAAA,EAClF,OAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,SAAS,OAAO;AAAA,IAChB,YAAY,OAAO;AAAA,IACnB,UAAU,OAAO;AAAA,IACjB,SAAS,OAAO;AAAA,IAChB,aAAa,IAAI,KAAK,OAAO,WAAW;AAAA,EAC1C;AAAA;;ACpDK,MAAM,oBAAmB;AAAA,EACb,UAAU,IAAI;AAAA,EACd,QAAQ,IAAI;AAAA,EACZ,aAAa,IAAI;AAAA,EAGlC,aAAa,CAAC,KAAwB,KAA6B;AAAA,IACjE,MAAM,MAAM,cAAa,GAAG;AAAA,IAC5B,IAAI,KAAK,QAAQ,IAAI,GAAG;AAAA,MAAG;AAAA,IAC3B,IAAI,CAAC,KAAK;AAAA,MACR,KAAK,QAAQ,IAAI,KAAK,EAAE,KAAK,QAAQ,MAAM,CAAC;AAAA,MAC5C;AAAA,IACF;AAAA,IAEA,IAAI,IAAI,iBAAiB;AAAA,MAAW;AAAA,IACpC,KAAK,QAAQ,IAAI,KAAK;AAAA,MACpB;AAAA,MACA,QAAQ;AAAA,MACR,SAAS,IAAI;AAAA,MACb,cAAc,IAAI;AAAA,IACpB,CAAC;AAAA;AAAA,EASH,iBAAiB,CAAC,MAAkC;AAAA,IAClD,WAAW,OAAO,MAAM;AAAA,MACtB,KAAK,cAAc,EAAE,cAAc,IAAI,cAAc,WAAW,IAAI,UAAU,GAAG,GAAG;AAAA,MACpF,WAAW,SAAS,OAAO,OAAO,IAAI,SAAS,CAAC,CAAC,GAAG;AAAA,QAClD,KAAK,kBAAkB,aAAa,KAAK,CAAC;AAAA,MAC5C;AAAA,IACF;AAAA;AAAA,EASF,iBAAiB,CACf,QACA,SACA,MACM;AAAA,IACN,MAAM,oBAAoB,IAAI;AAAA,IAC9B,WAAW,UAAU;AAAA,MAAS,kBAAkB,IAAI,QAAQ,CAAC,CAAC;AAAA,IAE9D,MAAM,cAAc,IAAI;AAAA,IAExB,WAAW,OAAO,MAAM;AAAA,MACtB,IAAI,IAAI,iBAAiB,OAAO,gBAAgB,IAAI,aAAa,OAAO;AAAA,QAAW;AAAA,MACnF,MAAM,YAAY,kBAAkB,IAAI,IAAI,MAAM;AAAA,MAClD,IAAI,CAAC;AAAA,QAAW;AAAA,MAChB,MAAM,WAAW,eAAe,GAAG;AAAA,MACnC,IAAI,CAAC,UAAU;AAAA,QAIb,YAAY,IAAI,IAAI,MAAM;AAAA,QAC1B;AAAA,MACF;AAAA,MACA,UAAU,KAAK,QAAQ;AAAA,MACvB,KAAK,YAAY,SAAS,KAAK,QAAQ;AAAA,IACzC;AAAA,IAEA,YAAY,QAAQ,cAAc,mBAAmB;AAAA,MACnD,IAAI,YAAY,IAAI,MAAM;AAAA,QAAG;AAAA,MAC7B,MAAM,MAAM,aAAa,QAAQ,MAAM;AAAA,MACvC,IAAI,KAAK,WAAW,IAAI,GAAG;AAAA,QAAG;AAAA,MAC9B,KAAK,WAAW,IAAI,KAAK;AAAA,QACvB;AAAA,QACA;AAAA,QACA,aAAa,4BAA2B,SAAS;AAAA,MACnD,CAAC;AAAA,IACH;AAAA;AAAA,EAIF,WAAW,CAAC,KAAsB,UAA8C;AAAA,IAC9E,MAAM,MAAM,YAAW,GAAG;AAAA,IAC1B,IAAI,KAAK,MAAM,IAAI,GAAG;AAAA,MAAG;AAAA,IACzB,KAAK,MAAM,IACT,KACA,WAAW,EAAE,KAAK,QAAQ,MAAM,cAAc,SAAS,aAAa,IAAI,EAAE,KAAK,QAAQ,MAAM,CAC/F;AAAA;AAAA,EAGF,YAAY,GAA2B;AAAA,IACrC,OAAO;AAAA,MACL,SAAS,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC;AAAA,MAClC,OAAO,CAAC,GAAG,KAAK,MAAM,OAAO,CAAC;AAAA,MAC9B,YAAY,CAAC,GAAG,KAAK,WAAW,OAAO,CAAC;AAAA,IAC1C;AAAA;AAEJ;AAkBO,SAAS,uBAAsB,CACpC,QACA,SACkB;AAAA,EAClB,OAAO;AAAA,IACL,WAAW,gCAAgC,SAAS,SAAS;AAAA,IAC7D,OAA+D,CAAC,YAAyB;AAAA,MACvF,MAAM,YAAY,OAAO,QAAQ,UAAU;AAAA,MAC3C,OAAO,UAAU,kBAAkB,YAAY,WAAW,OAAO,IAAI;AAAA;AAAA,EAEzE;AAAA;AAGF,SAAS,+BAA+B,CACtC,QAC2B;AAAA,EAC3B,MAAM,SAAS;AAAA,SACP,aAAY,CAAC,OAMhB;AAAA,MACD,IAAI,CAAC,QAAQ;AAAA,QACX,MAAM,IAAI,cACR,8EACF;AAAA,MACF;AAAA,MACA,IAAI,MAAM,OAAO,WAAW,GAAG;AAAA,QAC7B,OAAO,CAAC;AAAA,MACV;AAAA,MAEA,MAAM,kBAAkB,MAAM,OAAO,IAAI,CAAC,UAAU;AAAA,QAClD,MAAM,aAAa,OAAO,kBAAkB,MAAM,SAAS,YAAY;AAAA,QACvE,wCAAuC,YAAY,MAAM,QAAQ;AAAA,QACjE,MAAM,qBAAqB,WAAW,WAAW,KAC/C,CAAC,aAAa,SAAS,OAAO,MAAM,SAAS,EAC/C;AAAA,QACA,IAAI,CAAC,oBAAoB;AAAA,UACvB,MAAM,IAAI,yBACR,4BAA4B,MAAM,SAAS,wBAAwB,WAAW,KAChF;AAAA,QACF;AAAA,QACA,yBAAwB,kBAAkB;AAAA,QAC1C,OAAO;AAAA,UACL,cAAc,WAAW;AAAA,UACzB,UAAU,MAAM;AAAA,UAChB,YAAY,mBAAmB;AAAA,QACjC;AAAA,OACD;AAAA,MAED,MAAM,UAAU,MAAM,OAAO,gBAAgB;AAAA,QAC3C,QAAQ;AAAA,WACJ,MAAM,SAAS,YAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,WACnD,MAAM,OAAO,YAAY,EAAE,IAAI,MAAM,GAAG,IAAI,CAAC;AAAA,WAC7C,MAAM,mBAAmB,YAAY,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,WACjF,MAAM,UAAU,YAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC5D,CAAC;AAAA,MACD,yCAAyC,iBAAiB,OAAO;AAAA,MAEjE,OAAO,MAAM,OAAO,IAAI,CAAC,OAAO,WAAW;AAAA,QACzC,UAAU,MAAM;AAAA,QAChB,UAAU,MAAM;AAAA,QAChB,QAAQ,QAAQ,OAAO,OAAO,IAAI,CAAC,WAAW;AAAA,UAC5C,OAAO,MAAM;AAAA,UACb,IAAI,MAAM;AAAA,aACN,MAAM,SAAS,YAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,QACzD,EAAE;AAAA,MACJ,EAAE;AAAA;AAAA,EAEN;AAAA,EAIA,OAAO;AAAA;AAGT,SAAS,wCAAwC,CAC/C,WAKA,SACM;AAAA,EACN,IAAI,QAAQ,WAAW,UAAU,QAAQ;AAAA,IACvC,MAAM,IAAI,cACR,8CAA8C,QAAQ,4BAA4B,UAAU,0BAC9F;AAAA,EACF;AAAA,EAEA,SAAS,QAAQ,EAAG,QAAQ,UAAU,QAAQ,SAAS,GAAG;AAAA,IACxD,MAAM,WAAW,UAAU;AAAA,IAC3B,MAAM,SAAS,QAAQ;AAAA,IACvB,IACE,OAAO,iBAAiB,SAAS,gBACjC,OAAO,aAAa,SAAS,YAC7B,OAAO,eAAe,SAAS,YAC/B;AAAA,MACA,MAAM,IAAI,cACR,kFAAkF,QACpF;AAAA,IACF;AAAA,EACF;AAAA;AAGF,SAAS,iBAAmE,CAC1E,YACA,WACA,SAC4B;AAAA,EAC5B,QAAQ,aAAa;AAAA,EACrB,MAAM,MAAM,CAAC,eAA0C;AAAA,IACrD,cAAc,WAAW;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,SACC,IAAG,CAAC,IAAI;AAAA,MACZ,MAAM,MAAM,MAAM,UAAU,IAAI,EAAE;AAAA,MAClC,SAAS,cAAc,IAAI,EAAE,GAAG,OAAO,WAAW,GAAG,CAAC;AAAA,MACtD,OAAO;AAAA;AAAA,IAET,KAAK,GAAG;AAAA,MAEN,OAAO,4BAA4B,UAAU,MAAM,GAAG,CAAC,aACrD,kBAAkB,UAAU,QAAQ,CACtC;AAAA;AAAA,SAEI,KAAI,CAAC,OAAO;AAAA,MAChB,MAAM,SAAS,MAAM,UAAU,KAAK,KAAK;AAAA,MACzC,SAAS,kBAAkB,OAAO,QAAQ,IAAI,UAAU,CAAC;AAAA,MACzD,OAAO;AAAA;AAAA,IAET,IAAI,CAAC,IAAI;AAAA,MACP,MAAM,SAAS,UAAU,KAAK,EAAE;AAAA,MAChC,OAAO;AAAA,aACC,IAAG,GAAG;AAAA,UACV,MAAM,MAAM,MAAM,OAAO,IAAI;AAAA,UAC7B,SAAS,cAAc,IAAI,EAAE,GAAG,OAAO,WAAW,GAAG,CAAC;AAAA,UACtD,OAAO;AAAA;AAAA,aAEH,UAAS,CAAC,MAAM;AAAA,UACpB,MAAM,OAAO,MAAM,OAAO,UAAU,IAAI;AAAA,UACxC,SAAS,kBACP,IAAI,EAAE,GACN,OAAO,CAAC,KAAK,EAAE,IAAI,QAAQ,eAAe,WAAW,EAAE,GACvD,IACF;AAAA,UACA,OAAO;AAAA;AAAA,MAEX;AAAA;AAAA,EAEJ;AAAA;AASF,SAAS,iBAAiB,CACxB,UACA,UACqB;AAAA,EACrB,OAAO;AAAA,SACC,KAAI,CAAC,OAAO,aAAa;AAAA,MAC7B,MAAM,SAAS,MAAM,SAAS,KAAK,OAAO,WAAW;AAAA,MACrD,SAAS,kBAAkB,OAAO,QAAQ,IAAI,UAAU,CAAC;AAAA,MACzD,OAAO;AAAA;AAAA,IAET,OAAO,CAAC,UAAU,SAAS,MAAM,KAAK;AAAA,IACtC,QAAQ,CAAC,UAAU,SAAS,OAAO,KAAK;AAAA,IACxC,QAAQ,CAAC,OAAO,WAAW,SAAS,OAAO,OAAO,MAAM;AAAA,IACxD,UAAU,SAAS,UAAU,KAAK,QAAQ;AAAA,IAC1C,SAAS,SAAS,SAAS,KAAK,QAAQ;AAAA,EAC1C;AAAA;AAOF,SAAS,UAAU,CAAC,KAAwB;AAAA,EAC1C,OAAO;AAAA;AAGT,SAAS,YAAY,CAAC,OAAgD;AAAA,EACpE,IAAI,UAAU;AAAA,IAAM,OAAO,CAAC;AAAA,EAC5B,OAAO,kBAAkB,KAAK,IAAI,QAAQ,CAAC,KAAK;AAAA;AAIlD,SAAS,iBAAiB,CAAC,OAAiE;AAAA,EAC1F,OAAO,MAAM,QAAQ,KAAK;AAAA;AAG5B,SAAS,cAAc,CAAC,KAAkD;AAAA,EAExE,IAAI,IAAI,iBAAiB;AAAA,IAAW,OAAO;AAAA,EAC3C,OAAO;AAAA,IACL,KAAK;AAAA,MACH,QAAQ,EAAE,cAAc,IAAI,cAAc,WAAW,IAAI,SAAS;AAAA,MAClE,QAAQ,IAAI;AAAA,MACZ,QAAQ,EAAE,cAAc,IAAI,cAAc,WAAW,IAAI,SAAS;AAAA,IACpE;AAAA,OACI,IAAI,eAAe,YACnB,EAAE,YAAY,IAAI,WAAkD,IACpE,CAAC;AAAA,IACL,WAAW,IAAI,UAAU,YAAY;AAAA,IACrC,WAAW,IAAI,UAAU,YAAY;AAAA,IACrC,cAAc,IAAI;AAAA,EACpB;AAAA;;AC3WK,MAAM,gBAAkD;AAAA,EAC5C,OAAO,IAAI;AAAA,EACX,gBAAoC,CAAC;AAAA,EACrC,aAAa,IAAI;AAAA,EAEjB;AAAA,EAEjB,WAAW,CAAC,SAAgC;AAAA,IAC1C,KAAK,WAAW,QAAQ;AAAA,IAExB,WAAW,UAAU,QAAQ,SAAS;AAAA,MACpC,MAAM,WAAW,KAAK,KAAK,IAAI,OAAO,EAAE;AAAA,MACxC,IAAI,UAAU;AAAA,QACZ,MAAM,iBAAiB,KAAK,wBAAwB,QAAQ,QAAQ;AAAA,QACpE,IAAI,gBAAgB;AAAA,UAClB,MAAM,IAAI,uBACR,wBAAwB,OAAO,gCAAgC,eAAe,mCAAmC,eAAe,uBAAuB,eAAe,kBACxK;AAAA,QACF;AAAA,QAEA,MAAM,IAAI,uBACR,wBAAwB,OAAO,iCACjC;AAAA,MACF;AAAA,MAEA,KAAK,eAAe,MAAM;AAAA,MAC1B,KAAK,KAAK,IAAI,OAAO,IAAI,MAAM;AAAA,MAE/B,IAAI,CAAC,0BAAyB,MAAM,GAAG;AAAA,QACrC,KAAK,cAAc,KAAK,MAAM;AAAA,QAC9B;AAAA,MACF;AAAA,MAEA,MAAM,aAAa,OAAO,QAAQ;AAAA,MAClC,MAAM,SAAS,KAAK,SAAS,kBAAkB,WAAW,EAAE;AAAA,MAC5D,IAAI,CAAC,QAAQ;AAAA,QACX,MAAM,IAAI,uBACR,WAAW,OAAO,oCAAoC,WAAW,qEACnE;AAAA,MACF;AAAA,MAEA,MAAM,SAAS,KAAK,WAAW,IAAI,WAAW,EAAE,KAAK,CAAC;AAAA,MACtD,OAAO,KAAK,MAAM;AAAA,MAClB,KAAK,WAAW,IAAI,WAAW,IAAI,MAAM;AAAA,IAC3C;AAAA;AAAA,EAGM,cAAc,CAAC,QAAgC;AAAA,IACrD,MAAM,eAAe,OAAO,OAAO,cAAc;AAAA,IACjD,MAAM,WAAW,OAAO,OAAO,UAAU;AAAA,IACzC,MAAM,aAAa,OAAO,OAAO,YAAY;AAAA,IAE7C,IAAI,CAAC,gBAAgB,CAAC,UAAU;AAAA,MAC9B,MAAM,IAAI,uBAAsB,6BAA6B,OAAO,EAAE,CAAC;AAAA,IACzE;AAAA,IAEA,IAAI,cAAc,CAAC,UAAU;AAAA,MAC3B,MAAM,IAAI,uBAAsB,2BAA2B,OAAO,EAAE,CAAC;AAAA,IACvE;AAAA;AAAA,EAGF,IAAI,GAAgC;AAAA,IAClC,OAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC;AAAA;AAAA,EAG/B,OAAO,CAAC,IAAqC;AAAA,IAC3C,OAAO,KAAK,KAAK,IAAI,EAAE,KAAK;AAAA;AAAA,EAG9B,UAAU,GAAgC;AAAA,IACxC,OAAO,CAAC,GAAG,KAAK,aAAa;AAAA;AAAA,EAG/B,WAAW,CAAC,MAAqD;AAAA,IAC/D,KAAK,SAAS,kBAAkB,KAAK,EAAE;AAAA,IAEvC,MAAM,OAAO,IAAI;AAAA,IACjB,MAAM,SAAmC,CAAC;AAAA,IAE1C,WAAW,YAAY,KAAK,SAAS,kBAAkB,IAAI,GAAG;AAAA,MAC5D,WAAW,UAAU,KAAK,WAAW,IAAI,SAAS,EAAE,KAAK,CAAC,GAAG;AAAA,QAC3D,IAAI,KAAK,IAAI,OAAO,EAAE;AAAA,UAAG;AAAA,QACzB,KAAK,IAAI,OAAO,EAAE;AAAA,QAClB,OAAO,KAAK,MAAM;AAAA,MACpB;AAAA,IACF;AAAA,IAEA,OAAO;AAAA;AAAA,EAGD,uBAAuB,CAC7B,QACA,UACgF;AAAA,IAChF,IAAI,CAAC,0BAAyB,MAAM,KAAK,CAAC,0BAAyB,QAAQ,GAAG;AAAA,MAC5E,OAAO;AAAA,IACT;AAAA,IAEA,MAAM,mBAAmB,OAAO,QAAQ;AAAA,IACxC,MAAM,qBAAqB,SAAS,QAAQ;AAAA,IAE5C,IAAI,iBAAiB,OAAO,mBAAmB,IAAI;AAAA,MACjD,OAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,KAAK,SAAS,kBAAkB,gBAAgB;AAAA,IACpE,IAAI,YAAY,KAAK,CAAC,aAAa,SAAS,OAAO,mBAAmB,EAAE,GAAG;AAAA,MACzE,OAAO;AAAA,QACL,cAAc,iBAAiB;AAAA,QAC/B,eAAe,mBAAmB;AAAA,QAClC,gBAAgB,iBAAiB;AAAA,MACnC;AAAA,IACF;AAAA,IAEA,MAAM,gBAAgB,KAAK,SAAS,kBAAkB,kBAAkB;AAAA,IACxE,IAAI,cAAc,KAAK,CAAC,aAAa,SAAS,OAAO,iBAAiB,EAAE,GAAG;AAAA,MACzE,OAAO;AAAA,QACL,cAAc,mBAAmB;AAAA,QACjC,eAAe,iBAAiB;AAAA,QAChC,gBAAgB,mBAAmB;AAAA,MACrC;AAAA,IACF;AAAA,IAEA,OAAO;AAAA;AAEX;;AC5IA,eAAsB,oBAAgD,CAAC,OAKrD;AAAA,EAChB,MAAM,aAAa,MAAM,OAAO,OAAO;AAAA,EACvC,IAAI,WAAW,WAAW,GAAG;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,IAAI,CAAC,0BAAyB,MAAM,MAAM,GAAG;AAAA,IAC3C,WAAW,aAAa,YAAY;AAAA,MAClC,MAAM,SAAS,MAAM,UAAU,MAAM,WAAW;AAAA,MAChD,IAAI,uBAAuB,MAAM,GAAG;AAAA,QAClC,MAAM,IAAI,uBAAsB,OAAO,OAAO;AAAA,UAC5C,UAAU,MAAM,OAAO;AAAA,UACvB,SAAS,MAAM;AAAA,QACjB,CAAC;AAAA,MACH;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,IAAI,CAAC,MAAM,QAAQ;AAAA,IACjB,MAAM,IAAI,MAAM,kBAAkB,MAAM,OAAO,gCAAgC;AAAA,EACjF;AAAA,EAEA,WAAW,aAAa,YAAY;AAAA,IAClC,MAAM,SAAS,MAAM,UAAU;AAAA,SAC1B,MAAM;AAAA,MACT,QAAQ,MAAM;AAAA,IAChB,CAAC;AAAA,IACD,IAAI,uBAAuB,MAAM,GAAG;AAAA,MAClC,MAAM,IAAI,uBAAsB,OAAO,OAAO;AAAA,QAC5C,UAAU,MAAM,OAAO;AAAA,QACvB,SAAS,MAAM;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAGF,SAAS,sBAAsB,CAAC,OAAqD;AAAA,EACnF,OACE,OAAO,UAAU,YACjB,UAAU,QACV,WAAW,SACX,OAAO,MAAM,UAAU;AAAA;",
+  "debugId": "1D163836FC4D0FDC64756E2164756E21",
+  "names": []
+}

package/dist/{chunk-t7dzd1tm.js → chunk-e2c5yxfe.js}

@@ -7,13 +7,13 @@ import {
   ConnectorError2,
   createConnectorCodedError,
   getConnectorExecutionSourceResolver
-} from "./chunk-xtfryrfb.js";
+} from "./chunk-cbn96bve.js";
 import {
   isDatasetDefinition2
 } from "./chunk-cd234ba4.js";
 import {
   SyncValidationError2
-} from "./chunk-jjwhy3rs.js";
+} from "./chunk-q2xghyft.js";
 import {
   isOAuthConnectorAdapter,
   isConnectorDefinition

package/dist/{chunk-p6r1ex7t.js → chunk-ffwvdgk1.js}

@@ -1,23 +1,15 @@
 // @bun
+import {
+  isPrimitiveSchema
+} from "./chunk-d8yes9yx.js";
 import {
   isPlainRecord
 } from "./chunk-wy0qdqfm.js";
 
 // src/ontology/validation/definition.ts
-var PRIMITIVE_SCHEMAS = new Set([
-  "string",
-  "integer",
-  "double",
-  "decimal",
-  "boolean",
-  "date",
-  "timestamp",
-  "uuid",
-  "fileRef"
-]);
 function assertValidSchema(schema, path, invalid, visiting = new Set) {
   if (typeof schema === "string") {
-    if (PRIMITIVE_SCHEMAS.has(schema)) {
+    if (isPrimitiveSchema(schema)) {
       return;
     }
     throw invalid(path);
@@ -90,4 +82,4 @@ function isValidEnumValues(values, valueType) {
 
 export { assertValidSchema };
 
-//# debugId=3AF3C78456A4B4F964756E2164756E21
+//# debugId=6F187C1748947F4164756E2164756E21

package/dist/chunk-ffwvdgk1.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/ontology/validation/definition.ts"],
+  "sourcesContent": [
+    "import { isPlainRecord } from \"../../json\"\nimport { isPrimitiveSchema } from \"../primitives\"\n\n/** Validate a declarative schema's shape independently of the primitive that consumes it. */\nexport function assertValidSchema(\n  schema: unknown,\n  path: string,\n  invalid: (path: string) => Error,\n  visiting: Set<object> = new Set()\n): void {\n  if (typeof schema === \"string\") {\n    if (isPrimitiveSchema(schema)) {\n      return\n    }\n    throw invalid(path)\n  }\n  if (!isPlainRecord(schema) || typeof schema.type !== \"string\" || visiting.has(schema)) {\n    throw invalid(path)\n  }\n\n  visiting.add(schema)\n  switch (schema.type) {\n    case \"enum\": {\n      const values = schema.values\n      const validValues = isValidEnumValues(values, schema.valueType)\n      if (!validValues || new Set(values).size !== values.length) {\n        throw invalid(path)\n      }\n      break\n    }\n    case \"array\":\n      assertValidSchema(schema.items, `${path}.items`, invalid, visiting)\n      break\n    case \"map\":\n      if (schema.keySchema !== \"string\") {\n        throw invalid(path)\n      }\n      assertValidSchema(schema.valueSchema, `${path}.valueSchema`, invalid, visiting)\n      break\n    case \"object\": {\n      if (!isPlainRecord(schema.properties)) {\n        throw invalid(path)\n      }\n      for (const [fieldId, field] of Object.entries(schema.properties)) {\n        if (!fieldId.trim() || !isPlainRecord(field) || !(\"schema\" in field)) {\n          throw invalid(`${path}.properties.${fieldId}`)\n        }\n        if (\n          (field.required !== undefined && typeof field.required !== \"boolean\") ||\n          (field.nullable !== undefined && typeof field.nullable !== \"boolean\") ||\n          (field.description !== undefined &&\n            (typeof field.description !== \"string\" || !field.description.trim()))\n        ) {\n          throw invalid(`${path}.properties.${fieldId}`)\n        }\n        assertValidSchema(field.schema, `${path}.properties.${fieldId}.schema`, invalid, visiting)\n      }\n      break\n    }\n    case \"valueTypeRef\":\n      if (typeof schema.valueTypeId !== \"string\" || !schema.valueTypeId.trim()) {\n        throw invalid(path)\n      }\n      if (schema._resolved !== undefined) {\n        assertValidSchema(schema._resolved, `${path}._resolved`, invalid, visiting)\n      }\n      break\n    default:\n      throw invalid(path)\n  }\n  visiting.delete(schema)\n}\n\nfunction isValidEnumValues(values: unknown, valueType: unknown): values is unknown[] {\n  if (!Array.isArray(values) || values.length === 0) {\n    return false\n  }\n\n  for (let index = 0; index < values.length; index += 1) {\n    if (!Object.hasOwn(values, index)) {\n      return false\n    }\n    const value = values[index]\n    if (\n      valueType === \"string\"\n        ? typeof value !== \"string\"\n        : valueType !== \"integer\" || typeof value !== \"number\" || !Number.isInteger(value)\n    ) {\n      return false\n    }\n  }\n  return true\n}\n"
+  ],
+  "mappings": ";;;;;;;;;AAIO,SAAS,iBAAiB,CAC/B,QACA,MACA,SACA,WAAwB,IAAI,KACtB;AAAA,EACN,IAAI,OAAO,WAAW,UAAU;AAAA,IAC9B,IAAI,kBAAkB,MAAM,GAAG;AAAA,MAC7B;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,IAAI;AAAA,EACpB;AAAA,EACA,IAAI,CAAC,cAAc,MAAM,KAAK,OAAO,OAAO,SAAS,YAAY,SAAS,IAAI,MAAM,GAAG;AAAA,IACrF,MAAM,QAAQ,IAAI;AAAA,EACpB;AAAA,EAEA,SAAS,IAAI,MAAM;AAAA,EACnB,QAAQ,OAAO;AAAA,SACR,QAAQ;AAAA,MACX,MAAM,SAAS,OAAO;AAAA,MACtB,MAAM,cAAc,kBAAkB,QAAQ,OAAO,SAAS;AAAA,MAC9D,IAAI,CAAC,eAAe,IAAI,IAAI,MAAM,EAAE,SAAS,OAAO,QAAQ;AAAA,QAC1D,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,IACF;AAAA,SACK;AAAA,MACH,kBAAkB,OAAO,OAAO,GAAG,cAAc,SAAS,QAAQ;AAAA,MAClE;AAAA,SACG;AAAA,MACH,IAAI,OAAO,cAAc,UAAU;AAAA,QACjC,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA,kBAAkB,OAAO,aAAa,GAAG,oBAAoB,SAAS,QAAQ;AAAA,MAC9E;AAAA,SACG,UAAU;AAAA,MACb,IAAI,CAAC,cAAc,OAAO,UAAU,GAAG;AAAA,QACrC,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA,YAAY,SAAS,UAAU,OAAO,QAAQ,OAAO,UAAU,GAAG;AAAA,QAChE,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,cAAc,KAAK,KAAK,EAAE,YAAY,QAAQ;AAAA,UACpE,MAAM,QAAQ,GAAG,mBAAmB,SAAS;AAAA,QAC/C;AAAA,QACA,IACG,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,aAC1D,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,aAC1D,MAAM,gBAAgB,cACpB,OAAO,MAAM,gBAAgB,YAAY,CAAC,MAAM,YAAY,KAAK,IACpE;AAAA,UACA,MAAM,QAAQ,GAAG,mBAAmB,SAAS;AAAA,QAC/C;AAAA,QACA,kBAAkB,MAAM,QAAQ,GAAG,mBAAmB,kBAAkB,SAAS,QAAQ;AAAA,MAC3F;AAAA,MACA;AAAA,IACF;AAAA,SACK;AAAA,MACH,IAAI,OAAO,OAAO,gBAAgB,YAAY,CAAC,OAAO,YAAY,KAAK,GAAG;AAAA,QACxE,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA,IAAI,OAAO,cAAc,WAAW;AAAA,QAClC,kBAAkB,OAAO,WAAW,GAAG,kBAAkB,SAAS,QAAQ;AAAA,MAC5E;AAAA,MACA;AAAA;AAAA,MAEA,MAAM,QAAQ,IAAI;AAAA;AAAA,EAEtB,SAAS,OAAO,MAAM;AAAA;AAGxB,SAAS,iBAAiB,CAAC,QAAiB,WAAyC;AAAA,EACnF,IAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG;AAAA,IACjD,OAAO;AAAA,EACT;AAAA,EAEA,SAAS,QAAQ,EAAG,QAAQ,OAAO,QAAQ,SAAS,GAAG;AAAA,IACrD,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,GAAG;AAAA,MACjC,OAAO;AAAA,IACT;AAAA,IACA,MAAM,QAAQ,OAAO;AAAA,IACrB,IACE,cAAc,WACV,OAAO,UAAU,WACjB,cAAc,aAAa,OAAO,UAAU,YAAY,CAAC,OAAO,UAAU,KAAK,GACnF;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,OAAO;AAAA;",
+  "debugId": "6F187C1748947F4164756E2164756E21",
+  "names": []
+}

package/dist/{chunk-tg4g4zh0.js → chunk-gct3m1da.js}

@@ -1,16 +1,16 @@
 // @bun
+import {
+  AuthStorageError2,
+  SYSTEM_PRINCIPAL2,
+  principalsEqual2
+} from "./chunk-6rzb1g6h.js";
 import {
   agentServiceAccountId2,
   resolveAuthorizationContext2
-} from "./chunk-bbaa1fet.js";
+} from "./chunk-rzcjp5m2.js";
 import {
   createSixbError2
-} from "./chunk-hzw7yv5g.js";
-import {
-  AuthStorageError2,
-  SYSTEM_PRINCIPAL2,
-  principalsEqual2
-} from "./chunk-2cxv584m.js";
+} from "./chunk-rzkr70gr.js";
 import {
   findPrimitiveRunExecution,
   findAgentRunExecution
@@ -210,7 +210,7 @@ function isUsableUserSession(session, userId, now) {
   return session.absoluteExpiresAt === undefined || session.absoluteExpiresAt.getTime() > now.getTime();
 }
 function isUsableUserAccessToken(token, userId, now) {
-  if (!token || token.subjectType !== "user" || token.subjectId !== userId)
+  if (!token || !principalsEqual2(token.subject, { type: "user", id: userId }))
     return false;
   return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime();
 }
@@ -281,4 +281,4 @@ function invalidExecution(executionId, runId) {
 
 export { WorkflowRunError2, ensureManagedAgentExecutionIdentity2, resolveAgentExecutionAuthorization2, resolveInheritedAgentExecutionAuthorization2, assertWorkflowRunExecution2, assertWorkflowAgentNodeRunExecution2 };
 
-//# debugId=E7BAFA86A352672B64756E2164756E21
+//# debugId=F5DA9E9C95A4C18E64756E2164756E21

package/dist/{chunk-tg4g4zh0.js.map → chunk-gct3m1da.js.map}

@@ -2,11 +2,11 @@
   "version": 3,
   "sources": ["../src/agents/authority.ts", "../src/storage/workflow-runs/errors.ts", "../src/storage/workflow-runs/provider.ts"],
   "sourcesContent": [
-    "import { principalsEqual, SYSTEM_PRINCIPAL } from \"../auth\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport { resolveAuthorizationContext } from \"../authorization\"\nimport { createSixbError } from \"../errors/internal\"\nimport type { AuthorizablePrincipal, AuthorizationRef } from \"../execution\"\nimport type { SecurityDefinitionCatalog } from \"../security\"\nimport type {\n  AccessTokenRecord,\n  AuthStorage,\n  ServiceAccountGroupMembershipRecord,\n  ServiceAccountRecord,\n  SessionRecord,\n  UserRecord,\n} from \"../storage/auth\"\nimport { AuthStorageError } from \"../storage/auth\"\nimport { agentServiceAccountId } from \"./identity\"\n\nexport type AgentExecutionAuthorization =\n  | { readonly type: \"principal\"; readonly context: AuthorizationContext }\n  | { readonly type: \"disabled\" }\n\ntype UserCredentialRef = NonNullable<\n  Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n>\n\ninterface CredentialedUserAuthorizationRef {\n  readonly type: \"principal\"\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"user\" }>\n  readonly credential: UserCredentialRef\n}\n\nexport { agentServiceAccountId } from \"./identity\"\n\nexport interface AgentExecutionIdentity {\n  readonly serviceAccount: ServiceAccountRecord\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"serviceAccount\" }>\n  readonly groupMemberships: readonly ServiceAccountGroupMembershipRecord[]\n}\n\n/** Ensure a framework-managed Agent actor exists with exactly its declared group memberships. */\nexport async function ensureManagedAgentExecutionIdentity(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly name: string\n  readonly description: string\n  readonly groupIds: readonly string[]\n}): Promise<AgentExecutionIdentity> {\n  const auth = requireAuthStorage(input.auth)\n  const id = agentServiceAccountId(input.actorId)\n  const now = new Date()\n  const loaded = await loadOrCreateAgentServiceAccount(auth, {\n    id,\n    projectId: input.projectId,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertFrameworkManagedAgentServiceAccount(input.actorId, loaded)\n  assertActiveAgentServiceAccount(input.actorId, loaded)\n  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {\n    existing: loaded,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertActiveAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: id,\n      groupIds: input.groupIds,\n      source: \"agent\",\n      updatedAt: now,\n    })\n  )\n\n  return {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id },\n    groupMemberships,\n  }\n}\n\n/** Load the managed identity, recovering only the expected concurrent-create race. */\nasync function loadOrCreateAgentServiceAccount(\n  auth: AuthStorage,\n  input: {\n    readonly id: string\n    readonly projectId: string\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  const existing = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: input.id,\n  })\n  if (existing) return existing\n\n  try {\n    return await auth.serviceAccounts.create({\n      id: input.id,\n      projectId: input.projectId,\n      name: input.name,\n      description: input.description,\n      status: \"active\",\n      createdByPrincipal: SYSTEM_PRINCIPAL,\n      createdAt: input.updatedAt,\n      updatedAt: input.updatedAt,\n    })\n  } catch (error) {\n    if (!(error instanceof AuthStorageError) || error.code !== \"duplicate_service_account\") {\n      throw error\n    }\n    const concurrent = await auth.serviceAccounts.getById({\n      projectId: input.projectId,\n      id: input.id,\n    })\n    if (!concurrent) throw error\n    return concurrent\n  }\n}\n\nfunction assertActiveAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (serviceAccount.status === \"suspended\") {\n    throw new Error(\n      `[Sixb] Agent '${actorId}' service account '${serviceAccount.id}' is suspended.`\n    )\n  }\n}\n\nfunction assertFrameworkManagedAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (\n    serviceAccount.createdByPrincipal === undefined ||\n    !principalsEqual(serviceAccount.createdByPrincipal, SYSTEM_PRINCIPAL)\n  ) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' cannot use service account '${serviceAccount.id}' because it is not managed by Sixb.`,\n      { details: { actorId, serviceAccountId: serviceAccount.id } }\n    )\n  }\n}\n\nfunction requireDefinitionOwnedGroupMemberships(\n  actorId: string,\n  memberships: readonly ServiceAccountGroupMembershipRecord[]\n): readonly ServiceAccountGroupMembershipRecord[] {\n  const externalGroupIds = memberships\n    .filter((membership) => membership.source !== \"agent\")\n    .map((membership) => membership.groupId)\n  if (externalGroupIds.length > 0) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' service account has group memberships not managed by its definition: ${externalGroupIds.join(\", \")}.`,\n      { details: { actorId, externalGroupIds } }\n    )\n  }\n  return memberships\n}\n\n/** Resolve current grants for the service account referenced by a durable Agent execution. */\nexport async function resolveAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n}): Promise<{ readonly identity: AgentExecutionIdentity; readonly context: AuthorizationContext }> {\n  const auth = requireAuthStorage(input.auth)\n  const expectedId = agentServiceAccountId(input.actorId)\n  const principal =\n    input.authorizationRef.type === \"principal\" ? input.authorizationRef.principal : null\n  if (principal?.type !== \"serviceAccount\" || principal.id !== expectedId) {\n    throw new Error(\n      `[Sixb] Agent '${input.actorId}' execution authority must reference service account '${expectedId}'.`\n    )\n  }\n\n  const serviceAccount = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: principal.id,\n  })\n  if (!serviceAccount || serviceAccount.status !== \"active\") {\n    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`)\n  }\n  assertFrameworkManagedAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.listForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: principal.id,\n    })\n  )\n  const identity: AgentExecutionIdentity = {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id: principal.id },\n    groupMemberships,\n  }\n  return {\n    identity,\n    context: resolveAuthorizationContext({\n      principal: identity.principal,\n      groupIds: groupMemberships.map((membership) => membership.groupId),\n      roles: input.security.listResolvedRoles(),\n    }),\n  }\n}\n\n/** Revalidate the durable user authority inherited by a conversational or child Agent. */\nexport async function resolveInheritedAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n  readonly now?: Date\n}): Promise<AgentExecutionAuthorization> {\n  if (input.authorizationRef.type === \"disabled\") return { type: \"disabled\" }\n\n  const ref = requireCredentialedUserAuthority(input.authorizationRef)\n  const auth = requireAuthStorage(input.auth)\n  const now = input.now ?? new Date()\n  const user = await requireActiveUser(auth, input.projectId, ref.principal.id)\n  const memberships = await auth.groupMemberships.listForUser({\n    projectId: input.projectId,\n    userId: user.id,\n  })\n  const credential = await revalidateUserCredential({\n    auth,\n    projectId: input.projectId,\n    userId: user.id,\n    credential: ref.credential,\n    currentGroupIds: memberships.map((membership) => membership.groupId),\n    now,\n  })\n\n  return {\n    type: \"principal\",\n    context: resolveAuthorizationContext({\n      principal: ref.principal,\n      groupIds: credential.groupIds,\n      roles: input.security.listResolvedRoles(),\n      ...(credential.sessionId === undefined ? {} : { sessionId: credential.sessionId }),\n    }),\n  }\n}\n\nfunction requireCredentialedUserAuthority(ref: AuthorizationRef): CredentialedUserAuthorizationRef {\n  if (ref.type !== \"principal\" || ref.principal.type !== \"user\" || ref.credential === undefined) {\n    throw invalidInheritedAuthority(\"the durable reference is not a credentialed user\")\n  }\n  return {\n    type: \"principal\",\n    principal: { type: \"user\", id: ref.principal.id },\n    credential: { type: ref.credential.type, id: ref.credential.id },\n  }\n}\n\nasync function requireActiveUser(\n  auth: AuthStorage,\n  projectId: string,\n  userId: string\n): Promise<UserRecord> {\n  const user = await auth.users.getById({ projectId, id: userId })\n  if (!user || user.status !== \"active\") {\n    throw invalidInheritedAuthority(`user '${userId}' is not active`)\n  }\n  return user\n}\n\nasync function revalidateUserCredential(input: {\n  readonly auth: AuthStorage\n  readonly projectId: string\n  readonly userId: string\n  readonly credential: UserCredentialRef\n  readonly currentGroupIds: readonly string[]\n  readonly now: Date\n}): Promise<{ readonly groupIds: readonly string[]; readonly sessionId?: string }> {\n  if (input.credential.type === \"session\") {\n    const session = await input.auth.sessions.getById({\n      projectId: input.projectId,\n      id: input.credential.id,\n    })\n    if (!isUsableUserSession(session, input.userId, input.now)) {\n      throw invalidInheritedAuthority(\"the inherited session is no longer valid\")\n    }\n    return { groupIds: input.currentGroupIds, sessionId: session.id }\n  }\n\n  const accessToken = await input.auth.accessTokens.getById({\n    projectId: input.projectId,\n    id: input.credential.id,\n  })\n  if (!isUsableUserAccessToken(accessToken, input.userId, input.now)) {\n    throw invalidInheritedAuthority(\"the inherited access token is no longer valid\")\n  }\n  if (accessToken.groupIds === undefined) return { groupIds: input.currentGroupIds }\n\n  const allowedGroupIds = new Set(accessToken.groupIds)\n  return {\n    groupIds: input.currentGroupIds.filter((groupId) => allowedGroupIds.has(groupId)),\n  }\n}\n\nfunction isUsableUserSession(\n  session: SessionRecord | null,\n  userId: string,\n  now: Date\n): session is SessionRecord {\n  if (!session || session.userId !== userId || session.revokedAt !== undefined) return false\n  if (session.expiresAt.getTime() <= now.getTime()) return false\n  return (\n    session.absoluteExpiresAt === undefined || session.absoluteExpiresAt.getTime() > now.getTime()\n  )\n}\n\nfunction isUsableUserAccessToken(\n  token: AccessTokenRecord | null,\n  userId: string,\n  now: Date\n): token is AccessTokenRecord {\n  if (!token || token.subjectType !== \"user\" || token.subjectId !== userId) return false\n  return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime()\n}\n\nfunction invalidInheritedAuthority(reason: string): Error {\n  return createSixbError(\n    \"agent.execution_failed\",\n    `[Sixb] The Agent execution cannot restore its inherited authority: ${reason}.`\n  )\n}\n\nfunction requireAuthStorage(auth: AuthStorage | undefined): AuthStorage {\n  if (!auth) {\n    throw new Error(\"[Sixb] Agent executions require auth storage.\")\n  }\n  return auth\n}\n\nasync function updateAgentServiceAccountMetadata(\n  auth: AuthStorage,\n  input: {\n    readonly existing: ServiceAccountRecord\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  if (input.existing.name === input.name && input.existing.description === input.description) {\n    return input.existing\n  }\n  return auth.serviceAccounts.update({\n    projectId: input.existing.projectId,\n    id: input.existing.id,\n    name: input.name,\n    description: input.description,\n    updatedAt: input.updatedAt,\n  })\n}\n",
+    "import { principalsEqual, SYSTEM_PRINCIPAL } from \"../auth\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport { resolveAuthorizationContext } from \"../authorization\"\nimport { createSixbError } from \"../errors/internal\"\nimport type { AuthorizablePrincipal, AuthorizationRef } from \"../execution\"\nimport type { SecurityDefinitionCatalog } from \"../security\"\nimport type {\n  AccessTokenRecord,\n  AuthStorage,\n  ServiceAccountGroupMembershipRecord,\n  ServiceAccountRecord,\n  SessionRecord,\n  UserRecord,\n} from \"../storage/auth\"\nimport { AuthStorageError } from \"../storage/auth\"\nimport { agentServiceAccountId } from \"./identity\"\n\nexport type AgentExecutionAuthorization =\n  | { readonly type: \"principal\"; readonly context: AuthorizationContext }\n  | { readonly type: \"disabled\" }\n\ntype UserCredentialRef = NonNullable<\n  Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n>\n\ninterface CredentialedUserAuthorizationRef {\n  readonly type: \"principal\"\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"user\" }>\n  readonly credential: UserCredentialRef\n}\n\nexport { agentServiceAccountId } from \"./identity\"\n\nexport interface AgentExecutionIdentity {\n  readonly serviceAccount: ServiceAccountRecord\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"serviceAccount\" }>\n  readonly groupMemberships: readonly ServiceAccountGroupMembershipRecord[]\n}\n\n/** Ensure a framework-managed Agent actor exists with exactly its declared group memberships. */\nexport async function ensureManagedAgentExecutionIdentity(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly name: string\n  readonly description: string\n  readonly groupIds: readonly string[]\n}): Promise<AgentExecutionIdentity> {\n  const auth = requireAuthStorage(input.auth)\n  const id = agentServiceAccountId(input.actorId)\n  const now = new Date()\n  const loaded = await loadOrCreateAgentServiceAccount(auth, {\n    id,\n    projectId: input.projectId,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertFrameworkManagedAgentServiceAccount(input.actorId, loaded)\n  assertActiveAgentServiceAccount(input.actorId, loaded)\n  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {\n    existing: loaded,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertActiveAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: id,\n      groupIds: input.groupIds,\n      source: \"agent\",\n      updatedAt: now,\n    })\n  )\n\n  return {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id },\n    groupMemberships,\n  }\n}\n\n/** Load the managed identity, recovering only the expected concurrent-create race. */\nasync function loadOrCreateAgentServiceAccount(\n  auth: AuthStorage,\n  input: {\n    readonly id: string\n    readonly projectId: string\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  const existing = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: input.id,\n  })\n  if (existing) return existing\n\n  try {\n    return await auth.serviceAccounts.create({\n      id: input.id,\n      projectId: input.projectId,\n      name: input.name,\n      description: input.description,\n      status: \"active\",\n      createdByPrincipal: SYSTEM_PRINCIPAL,\n      createdAt: input.updatedAt,\n      updatedAt: input.updatedAt,\n    })\n  } catch (error) {\n    if (!(error instanceof AuthStorageError) || error.code !== \"duplicate_service_account\") {\n      throw error\n    }\n    const concurrent = await auth.serviceAccounts.getById({\n      projectId: input.projectId,\n      id: input.id,\n    })\n    if (!concurrent) throw error\n    return concurrent\n  }\n}\n\nfunction assertActiveAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (serviceAccount.status === \"suspended\") {\n    throw new Error(\n      `[Sixb] Agent '${actorId}' service account '${serviceAccount.id}' is suspended.`\n    )\n  }\n}\n\nfunction assertFrameworkManagedAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (\n    serviceAccount.createdByPrincipal === undefined ||\n    !principalsEqual(serviceAccount.createdByPrincipal, SYSTEM_PRINCIPAL)\n  ) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' cannot use service account '${serviceAccount.id}' because it is not managed by Sixb.`,\n      { details: { actorId, serviceAccountId: serviceAccount.id } }\n    )\n  }\n}\n\nfunction requireDefinitionOwnedGroupMemberships(\n  actorId: string,\n  memberships: readonly ServiceAccountGroupMembershipRecord[]\n): readonly ServiceAccountGroupMembershipRecord[] {\n  const externalGroupIds = memberships\n    .filter((membership) => membership.source !== \"agent\")\n    .map((membership) => membership.groupId)\n  if (externalGroupIds.length > 0) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' service account has group memberships not managed by its definition: ${externalGroupIds.join(\", \")}.`,\n      { details: { actorId, externalGroupIds } }\n    )\n  }\n  return memberships\n}\n\n/** Resolve current grants for the service account referenced by a durable Agent execution. */\nexport async function resolveAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n}): Promise<{ readonly identity: AgentExecutionIdentity; readonly context: AuthorizationContext }> {\n  const auth = requireAuthStorage(input.auth)\n  const expectedId = agentServiceAccountId(input.actorId)\n  const principal =\n    input.authorizationRef.type === \"principal\" ? input.authorizationRef.principal : null\n  if (principal?.type !== \"serviceAccount\" || principal.id !== expectedId) {\n    throw new Error(\n      `[Sixb] Agent '${input.actorId}' execution authority must reference service account '${expectedId}'.`\n    )\n  }\n\n  const serviceAccount = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: principal.id,\n  })\n  if (!serviceAccount || serviceAccount.status !== \"active\") {\n    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`)\n  }\n  assertFrameworkManagedAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.listForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: principal.id,\n    })\n  )\n  const identity: AgentExecutionIdentity = {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id: principal.id },\n    groupMemberships,\n  }\n  return {\n    identity,\n    context: resolveAuthorizationContext({\n      principal: identity.principal,\n      groupIds: groupMemberships.map((membership) => membership.groupId),\n      roles: input.security.listResolvedRoles(),\n    }),\n  }\n}\n\n/** Revalidate the durable user authority inherited by a conversational or child Agent. */\nexport async function resolveInheritedAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n  readonly now?: Date\n}): Promise<AgentExecutionAuthorization> {\n  if (input.authorizationRef.type === \"disabled\") return { type: \"disabled\" }\n\n  const ref = requireCredentialedUserAuthority(input.authorizationRef)\n  const auth = requireAuthStorage(input.auth)\n  const now = input.now ?? new Date()\n  const user = await requireActiveUser(auth, input.projectId, ref.principal.id)\n  const memberships = await auth.groupMemberships.listForUser({\n    projectId: input.projectId,\n    userId: user.id,\n  })\n  const credential = await revalidateUserCredential({\n    auth,\n    projectId: input.projectId,\n    userId: user.id,\n    credential: ref.credential,\n    currentGroupIds: memberships.map((membership) => membership.groupId),\n    now,\n  })\n\n  return {\n    type: \"principal\",\n    context: resolveAuthorizationContext({\n      principal: ref.principal,\n      groupIds: credential.groupIds,\n      roles: input.security.listResolvedRoles(),\n      ...(credential.sessionId === undefined ? {} : { sessionId: credential.sessionId }),\n    }),\n  }\n}\n\nfunction requireCredentialedUserAuthority(ref: AuthorizationRef): CredentialedUserAuthorizationRef {\n  if (ref.type !== \"principal\" || ref.principal.type !== \"user\" || ref.credential === undefined) {\n    throw invalidInheritedAuthority(\"the durable reference is not a credentialed user\")\n  }\n  return {\n    type: \"principal\",\n    principal: { type: \"user\", id: ref.principal.id },\n    credential: { type: ref.credential.type, id: ref.credential.id },\n  }\n}\n\nasync function requireActiveUser(\n  auth: AuthStorage,\n  projectId: string,\n  userId: string\n): Promise<UserRecord> {\n  const user = await auth.users.getById({ projectId, id: userId })\n  if (!user || user.status !== \"active\") {\n    throw invalidInheritedAuthority(`user '${userId}' is not active`)\n  }\n  return user\n}\n\nasync function revalidateUserCredential(input: {\n  readonly auth: AuthStorage\n  readonly projectId: string\n  readonly userId: string\n  readonly credential: UserCredentialRef\n  readonly currentGroupIds: readonly string[]\n  readonly now: Date\n}): Promise<{ readonly groupIds: readonly string[]; readonly sessionId?: string }> {\n  if (input.credential.type === \"session\") {\n    const session = await input.auth.sessions.getById({\n      projectId: input.projectId,\n      id: input.credential.id,\n    })\n    if (!isUsableUserSession(session, input.userId, input.now)) {\n      throw invalidInheritedAuthority(\"the inherited session is no longer valid\")\n    }\n    return { groupIds: input.currentGroupIds, sessionId: session.id }\n  }\n\n  const accessToken = await input.auth.accessTokens.getById({\n    projectId: input.projectId,\n    id: input.credential.id,\n  })\n  if (!isUsableUserAccessToken(accessToken, input.userId, input.now)) {\n    throw invalidInheritedAuthority(\"the inherited access token is no longer valid\")\n  }\n  if (accessToken.groupIds === undefined) return { groupIds: input.currentGroupIds }\n\n  const allowedGroupIds = new Set(accessToken.groupIds)\n  return {\n    groupIds: input.currentGroupIds.filter((groupId) => allowedGroupIds.has(groupId)),\n  }\n}\n\nfunction isUsableUserSession(\n  session: SessionRecord | null,\n  userId: string,\n  now: Date\n): session is SessionRecord {\n  if (!session || session.userId !== userId || session.revokedAt !== undefined) return false\n  if (session.expiresAt.getTime() <= now.getTime()) return false\n  return (\n    session.absoluteExpiresAt === undefined || session.absoluteExpiresAt.getTime() > now.getTime()\n  )\n}\n\nfunction isUsableUserAccessToken(\n  token: AccessTokenRecord | null,\n  userId: string,\n  now: Date\n): token is AccessTokenRecord {\n  if (!token || !principalsEqual(token.subject, { type: \"user\", id: userId })) return false\n  return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime()\n}\n\nfunction invalidInheritedAuthority(reason: string): Error {\n  return createSixbError(\n    \"agent.execution_failed\",\n    `[Sixb] The Agent execution cannot restore its inherited authority: ${reason}.`\n  )\n}\n\nfunction requireAuthStorage(auth: AuthStorage | undefined): AuthStorage {\n  if (!auth) {\n    throw new Error(\"[Sixb] Agent executions require auth storage.\")\n  }\n  return auth\n}\n\nasync function updateAgentServiceAccountMetadata(\n  auth: AuthStorage,\n  input: {\n    readonly existing: ServiceAccountRecord\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  if (input.existing.name === input.name && input.existing.description === input.description) {\n    return input.existing\n  }\n  return auth.serviceAccounts.update({\n    projectId: input.existing.projectId,\n    id: input.existing.id,\n    name: input.name,\n    description: input.description,\n    updatedAt: input.updatedAt,\n  })\n}\n",
     "/**\n * Base error for workflow-run storage operations.\n */\nexport class WorkflowRunError extends Error {\n  readonly name = \"WorkflowRunError\"\n}\n",
     "import { agentServiceAccountId } from \"../../agents/authority\"\nimport type { ExecutionStorage } from \"../executions\"\nimport { findAgentRunExecution, findPrimitiveRunExecution } from \"../executions/run-link\"\nimport { WorkflowRunError } from \"./errors\"\n\n/** Validate the semantic link between a durable workflow run and its immutable execution. */\nexport async function assertWorkflowRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly runId: string\n  readonly workflowId: string\n}): Promise<void> {\n  const execution = await findPrimitiveRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    primitive: { kind: \"workflow\", id: input.workflowId, runId: input.runId },\n    sourceTypes: [\"execution\", \"schedule\", \"event\"],\n  })\n  if (!execution) {\n    invalidExecution(input.executionId, input.runId)\n  }\n\n  if (execution.source.type === \"schedule\" || execution.source.type === \"event\") {\n    if (execution.requestedBy !== undefined) {\n      invalidExecution(input.executionId, input.runId)\n    }\n    return\n  }\n\n  // ExecutionStorage already validates the immutable parent reference, correlation id, and\n  // requested-by propagation. This boundary only owns the workflow-specific source restriction.\n  if (execution.source.type !== \"execution\") {\n    invalidExecution(input.executionId, input.runId)\n  }\n}\n\n/** Validate the semantic link between a Workflow Agent-node run and its child execution. */\nexport async function assertWorkflowAgentNodeRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly nodeRunId: string\n  readonly actorId: string\n  readonly workflowExecutionId: string\n}): Promise<void> {\n  const execution = await findAgentRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    runId: input.nodeRunId,\n    authority: { type: \"managed\", serviceAccountId: agentServiceAccountId(input.actorId) },\n  })\n  if (\n    !execution ||\n    execution.source.type !== \"execution\" ||\n    execution.source.executionId !== input.workflowExecutionId\n  ) {\n    throw new WorkflowRunError(\n      `[Sixb] Execution '${input.executionId}' does not authorize Workflow Agent-node run '${input.nodeRunId}'.`\n    )\n  }\n}\n\nfunction invalidExecution(executionId: string, runId: string): never {\n  throw new WorkflowRunError(\n    `[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`\n  )\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;AAwCA,eAAsB,oCAAmC,CAAC,OAOtB;AAAA,EAClC,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,KAAK,uBAAsB,MAAM,OAAO;AAAA,EAC9C,MAAM,MAAM,IAAI;AAAA,EAChB,MAAM,SAAS,MAAM,gCAAgC,MAAM;AAAA,IACzD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,0CAA0C,MAAM,SAAS,MAAM;AAAA,EAC/D,gCAAgC,MAAM,SAAS,MAAM;AAAA,EACrD,MAAM,iBAAiB,MAAM,kCAAkC,MAAM;AAAA,IACnE,UAAU;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,gCAAgC,MAAM,SAAS,cAAc;AAAA,EAE7D,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,2BAA2B;AAAA,IACnE,WAAW,MAAM;AAAA,IACjB,kBAAkB;AAAA,IAClB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC,CACH;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,GAAG;AAAA,IACxC;AAAA,EACF;AAAA;AAIF,eAAe,+BAA+B,CAC5C,MACA,OAO+B;AAAA,EAC/B,MAAM,WAAW,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,IAAI;AAAA,IAAU,OAAO;AAAA,EAErB,IAAI;AAAA,IACF,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAAA,MACvC,IAAI,MAAM;AAAA,MACV,WAAW,MAAM;AAAA,MACjB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,QAAQ;AAAA,MACR,oBAAoB;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,EAAE,iBAAiB,sBAAqB,MAAM,SAAS,6BAA6B;AAAA,MACtF,MAAM;AAAA,IACR;AAAA,IACA,MAAM,aAAa,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM;AAAA,IACZ,CAAC;AAAA,IACD,IAAI,CAAC;AAAA,MAAY,MAAM;AAAA,IACvB,OAAO;AAAA;AAAA;AAIX,SAAS,+BAA+B,CACtC,SACA,gBACM;AAAA,EACN,IAAI,eAAe,WAAW,aAAa;AAAA,IACzC,MAAM,IAAI,MACR,iBAAiB,6BAA6B,eAAe,mBAC/D;AAAA,EACF;AAAA;AAGF,SAAS,yCAAyC,CAChD,SACA,gBACM;AAAA,EACN,IACE,eAAe,uBAAuB,aACtC,CAAC,iBAAgB,eAAe,oBAAoB,iBAAgB,GACpE;AAAA,IACA,MAAM,iBACJ,0BACA,iBAAiB,wCAAwC,eAAe,0CACxE,EAAE,SAAS,EAAE,SAAS,kBAAkB,eAAe,GAAG,EAAE,CAC9D;AAAA,EACF;AAAA;AAGF,SAAS,sCAAsC,CAC7C,SACA,aACgD;AAAA,EAChD,MAAM,mBAAmB,YACtB,OAAO,CAAC,eAAe,WAAW,WAAW,OAAO,EACpD,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,EACzC,IAAI,iBAAiB,SAAS,GAAG;AAAA,IAC/B,MAAM,iBACJ,0BACA,iBAAiB,iFAAiF,iBAAiB,KAAK,IAAI,MAC5H,EAAE,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAC3C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIT,eAAsB,mCAAkC,CAAC,OAM0C;AAAA,EACjG,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,aAAa,uBAAsB,MAAM,OAAO;AAAA,EACtD,MAAM,YACJ,MAAM,iBAAiB,SAAS,cAAc,MAAM,iBAAiB,YAAY;AAAA,EACnF,IAAI,WAAW,SAAS,oBAAoB,UAAU,OAAO,YAAY;AAAA,IACvE,MAAM,IAAI,MACR,iBAAiB,MAAM,gEAAgE,cACzF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,UAAU;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,CAAC,kBAAkB,eAAe,WAAW,UAAU;AAAA,IACzD,MAAM,IAAI,MAAM,iCAAiC,UAAU,oBAAoB;AAAA,EACjF;AAAA,EACA,0CAA0C,MAAM,SAAS,cAAc;AAAA,EAEvE,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,sBAAsB;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,kBAAkB,UAAU;AAAA,EAC9B,CAAC,CACH;AAAA,EACA,MAAM,WAAmC;AAAA,IACvC;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,IAAI,UAAU,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,6BAA4B;AAAA,MACnC,WAAW,SAAS;AAAA,MACpB,UAAU,iBAAiB,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,MACjE,OAAO,MAAM,SAAS,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA;AAIF,eAAsB,4CAA2C,CAAC,OAMzB;AAAA,EACvC,IAAI,MAAM,iBAAiB,SAAS;AAAA,IAAY,OAAO,EAAE,MAAM,WAAW;AAAA,EAE1E,MAAM,MAAM,iCAAiC,MAAM,gBAAgB;AAAA,EACnE,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,MAAM,MAAM,OAAO,IAAI;AAAA,EAC7B,MAAM,OAAO,MAAM,kBAAkB,MAAM,MAAM,WAAW,IAAI,UAAU,EAAE;AAAA,EAC5E,MAAM,cAAc,MAAM,KAAK,iBAAiB,YAAY;AAAA,IAC1D,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,EACf,CAAC;AAAA,EACD,MAAM,aAAa,MAAM,yBAAyB;AAAA,IAChD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,YAAY,IAAI;AAAA,IAChB,iBAAiB,YAAY,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,IACnE;AAAA,EACF,CAAC;AAAA,EAED,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,6BAA4B;AAAA,MACnC,WAAW,IAAI;AAAA,MACf,UAAU,WAAW;AAAA,MACrB,OAAO,MAAM,SAAS,kBAAkB;AAAA,SACpC,WAAW,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,WAAW,UAAU;AAAA,IAClF,CAAC;AAAA,EACH;AAAA;AAGF,SAAS,gCAAgC,CAAC,KAAyD;AAAA,EACjG,IAAI,IAAI,SAAS,eAAe,IAAI,UAAU,SAAS,UAAU,IAAI,eAAe,WAAW;AAAA,IAC7F,MAAM,0BAA0B,kDAAkD;AAAA,EACpF;AAAA,EACA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,EAAE,MAAM,QAAQ,IAAI,IAAI,UAAU,GAAG;AAAA,IAChD,YAAY,EAAE,MAAM,IAAI,WAAW,MAAM,IAAI,IAAI,WAAW,GAAG;AAAA,EACjE;AAAA;AAGF,eAAe,iBAAiB,CAC9B,MACA,WACA,QACqB;AAAA,EACrB,MAAM,OAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,WAAW,IAAI,OAAO,CAAC;AAAA,EAC/D,IAAI,CAAC,QAAQ,KAAK,WAAW,UAAU;AAAA,IACrC,MAAM,0BAA0B,SAAS,uBAAuB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,wBAAwB,CAAC,OAO2C;AAAA,EACjF,IAAI,MAAM,WAAW,SAAS,WAAW;AAAA,IACvC,MAAM,UAAU,MAAM,MAAM,KAAK,SAAS,QAAQ;AAAA,MAChD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM,WAAW;AAAA,IACvB,CAAC;AAAA,IACD,IAAI,CAAC,oBAAoB,SAAS,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,MAC1D,MAAM,0BAA0B,0CAA0C;AAAA,IAC5E;AAAA,IACA,OAAO,EAAE,UAAU,MAAM,iBAAiB,WAAW,QAAQ,GAAG;AAAA,EAClE;AAAA,EAEA,MAAM,cAAc,MAAM,MAAM,KAAK,aAAa,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM,WAAW;AAAA,EACvB,CAAC;AAAA,EACD,IAAI,CAAC,wBAAwB,aAAa,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,IAClE,MAAM,0BAA0B,+CAA+C;AAAA,EACjF;AAAA,EACA,IAAI,YAAY,aAAa;AAAA,IAAW,OAAO,EAAE,UAAU,MAAM,gBAAgB;AAAA,EAEjF,MAAM,kBAAkB,IAAI,IAAI,YAAY,QAAQ;AAAA,EACpD,OAAO;AAAA,IACL,UAAU,MAAM,gBAAgB,OAAO,CAAC,YAAY,gBAAgB,IAAI,OAAO,CAAC;AAAA,EAClF;AAAA;AAGF,SAAS,mBAAmB,CAC1B,SACA,QACA,KAC0B;AAAA,EAC1B,IAAI,CAAC,WAAW,QAAQ,WAAW,UAAU,QAAQ,cAAc;AAAA,IAAW,OAAO;AAAA,EACrF,IAAI,QAAQ,UAAU,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAAG,OAAO;AAAA,EACzD,OACE,QAAQ,sBAAsB,aAAa,QAAQ,kBAAkB,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAIjG,SAAS,uBAAuB,CAC9B,OACA,QACA,KAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,MAAM,gBAAgB,UAAU,MAAM,cAAc;AAAA,IAAQ,OAAO;AAAA,EACjF,OAAO,MAAM,cAAc,aAAa,MAAM,UAAU,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAGlF,SAAS,yBAAyB,CAAC,QAAuB;AAAA,EACxD,OAAO,iBACL,0BACA,sEAAsE,SACxE;AAAA;AAGF,SAAS,kBAAkB,CAAC,MAA4C;AAAA,EACtE,IAAI,CAAC,MAAM;AAAA,IACT,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,iCAAiC,CAC9C,MACA,OAM+B;AAAA,EAC/B,IAAI,MAAM,SAAS,SAAS,MAAM,QAAQ,MAAM,SAAS,gBAAgB,MAAM,aAAa;AAAA,IAC1F,OAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,KAAK,gBAAgB,OAAO;AAAA,IACjC,WAAW,MAAM,SAAS;AAAA,IAC1B,IAAI,MAAM,SAAS;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,EACnB,CAAC;AAAA;;;AC7WI,MAAM,0BAAyB,MAAM;AAAA,EACjC,OAAO;AAClB;;;ACCA,eAAsB,2BAA0B,CAAC,OAM/B;AAAA,EAChB,MAAM,YAAY,MAAM,0BAA0B;AAAA,IAChD,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,EAAE,MAAM,YAAY,IAAI,MAAM,YAAY,OAAO,MAAM,MAAM;AAAA,IACxE,aAAa,CAAC,aAAa,YAAY,OAAO;AAAA,EAChD,CAAC;AAAA,EACD,IAAI,CAAC,WAAW;AAAA,IACd,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA,EAEA,IAAI,UAAU,OAAO,SAAS,cAAc,UAAU,OAAO,SAAS,SAAS;AAAA,IAC7E,IAAI,UAAU,gBAAgB,WAAW;AAAA,MACvC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AAAA,EAIA,IAAI,UAAU,OAAO,SAAS,aAAa;AAAA,IACzC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA;AAIF,eAAsB,oCAAmC,CAAC,OAOxC;AAAA,EAChB,MAAM,YAAY,MAAM,sBAAsB;AAAA,IAC5C,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,OAAO,MAAM;AAAA,IACb,WAAW,EAAE,MAAM,WAAW,kBAAkB,uBAAsB,MAAM,OAAO,EAAE;AAAA,EACvF,CAAC;AAAA,EACD,IACE,CAAC,aACD,UAAU,OAAO,SAAS,eAC1B,UAAU,OAAO,gBAAgB,MAAM,qBACvC;AAAA,IACA,MAAM,IAAI,kBACR,qBAAqB,MAAM,4DAA4D,MAAM,aAC/F;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CAAC,aAAqB,OAAsB;AAAA,EACnE,MAAM,IAAI,kBACR,qBAAqB,iDAAiD,SACxE;AAAA;",
-  "debugId": "E7BAFA86A352672B64756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;;;AAwCA,eAAsB,oCAAmC,CAAC,OAOtB;AAAA,EAClC,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,KAAK,uBAAsB,MAAM,OAAO;AAAA,EAC9C,MAAM,MAAM,IAAI;AAAA,EAChB,MAAM,SAAS,MAAM,gCAAgC,MAAM;AAAA,IACzD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,0CAA0C,MAAM,SAAS,MAAM;AAAA,EAC/D,gCAAgC,MAAM,SAAS,MAAM;AAAA,EACrD,MAAM,iBAAiB,MAAM,kCAAkC,MAAM;AAAA,IACnE,UAAU;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,gCAAgC,MAAM,SAAS,cAAc;AAAA,EAE7D,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,2BAA2B;AAAA,IACnE,WAAW,MAAM;AAAA,IACjB,kBAAkB;AAAA,IAClB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC,CACH;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,GAAG;AAAA,IACxC;AAAA,EACF;AAAA;AAIF,eAAe,+BAA+B,CAC5C,MACA,OAO+B;AAAA,EAC/B,MAAM,WAAW,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,IAAI;AAAA,IAAU,OAAO;AAAA,EAErB,IAAI;AAAA,IACF,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAAA,MACvC,IAAI,MAAM;AAAA,MACV,WAAW,MAAM;AAAA,MACjB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,QAAQ;AAAA,MACR,oBAAoB;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,EAAE,iBAAiB,sBAAqB,MAAM,SAAS,6BAA6B;AAAA,MACtF,MAAM;AAAA,IACR;AAAA,IACA,MAAM,aAAa,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM;AAAA,IACZ,CAAC;AAAA,IACD,IAAI,CAAC;AAAA,MAAY,MAAM;AAAA,IACvB,OAAO;AAAA;AAAA;AAIX,SAAS,+BAA+B,CACtC,SACA,gBACM;AAAA,EACN,IAAI,eAAe,WAAW,aAAa;AAAA,IACzC,MAAM,IAAI,MACR,iBAAiB,6BAA6B,eAAe,mBAC/D;AAAA,EACF;AAAA;AAGF,SAAS,yCAAyC,CAChD,SACA,gBACM;AAAA,EACN,IACE,eAAe,uBAAuB,aACtC,CAAC,iBAAgB,eAAe,oBAAoB,iBAAgB,GACpE;AAAA,IACA,MAAM,iBACJ,0BACA,iBAAiB,wCAAwC,eAAe,0CACxE,EAAE,SAAS,EAAE,SAAS,kBAAkB,eAAe,GAAG,EAAE,CAC9D;AAAA,EACF;AAAA;AAGF,SAAS,sCAAsC,CAC7C,SACA,aACgD;AAAA,EAChD,MAAM,mBAAmB,YACtB,OAAO,CAAC,eAAe,WAAW,WAAW,OAAO,EACpD,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,EACzC,IAAI,iBAAiB,SAAS,GAAG;AAAA,IAC/B,MAAM,iBACJ,0BACA,iBAAiB,iFAAiF,iBAAiB,KAAK,IAAI,MAC5H,EAAE,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAC3C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIT,eAAsB,mCAAkC,CAAC,OAM0C;AAAA,EACjG,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,aAAa,uBAAsB,MAAM,OAAO;AAAA,EACtD,MAAM,YACJ,MAAM,iBAAiB,SAAS,cAAc,MAAM,iBAAiB,YAAY;AAAA,EACnF,IAAI,WAAW,SAAS,oBAAoB,UAAU,OAAO,YAAY;AAAA,IACvE,MAAM,IAAI,MACR,iBAAiB,MAAM,gEAAgE,cACzF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,UAAU;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,CAAC,kBAAkB,eAAe,WAAW,UAAU;AAAA,IACzD,MAAM,IAAI,MAAM,iCAAiC,UAAU,oBAAoB;AAAA,EACjF;AAAA,EACA,0CAA0C,MAAM,SAAS,cAAc;AAAA,EAEvE,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,sBAAsB;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,kBAAkB,UAAU;AAAA,EAC9B,CAAC,CACH;AAAA,EACA,MAAM,WAAmC;AAAA,IACvC;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,IAAI,UAAU,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,6BAA4B;AAAA,MACnC,WAAW,SAAS;AAAA,MACpB,UAAU,iBAAiB,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,MACjE,OAAO,MAAM,SAAS,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA;AAIF,eAAsB,4CAA2C,CAAC,OAMzB;AAAA,EACvC,IAAI,MAAM,iBAAiB,SAAS;AAAA,IAAY,OAAO,EAAE,MAAM,WAAW;AAAA,EAE1E,MAAM,MAAM,iCAAiC,MAAM,gBAAgB;AAAA,EACnE,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,MAAM,MAAM,OAAO,IAAI;AAAA,EAC7B,MAAM,OAAO,MAAM,kBAAkB,MAAM,MAAM,WAAW,IAAI,UAAU,EAAE;AAAA,EAC5E,MAAM,cAAc,MAAM,KAAK,iBAAiB,YAAY;AAAA,IAC1D,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,EACf,CAAC;AAAA,EACD,MAAM,aAAa,MAAM,yBAAyB;AAAA,IAChD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,YAAY,IAAI;AAAA,IAChB,iBAAiB,YAAY,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,IACnE;AAAA,EACF,CAAC;AAAA,EAED,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,6BAA4B;AAAA,MACnC,WAAW,IAAI;AAAA,MACf,UAAU,WAAW;AAAA,MACrB,OAAO,MAAM,SAAS,kBAAkB;AAAA,SACpC,WAAW,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,WAAW,UAAU;AAAA,IAClF,CAAC;AAAA,EACH;AAAA;AAGF,SAAS,gCAAgC,CAAC,KAAyD;AAAA,EACjG,IAAI,IAAI,SAAS,eAAe,IAAI,UAAU,SAAS,UAAU,IAAI,eAAe,WAAW;AAAA,IAC7F,MAAM,0BAA0B,kDAAkD;AAAA,EACpF;AAAA,EACA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,EAAE,MAAM,QAAQ,IAAI,IAAI,UAAU,GAAG;AAAA,IAChD,YAAY,EAAE,MAAM,IAAI,WAAW,MAAM,IAAI,IAAI,WAAW,GAAG;AAAA,EACjE;AAAA;AAGF,eAAe,iBAAiB,CAC9B,MACA,WACA,QACqB;AAAA,EACrB,MAAM,OAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,WAAW,IAAI,OAAO,CAAC;AAAA,EAC/D,IAAI,CAAC,QAAQ,KAAK,WAAW,UAAU;AAAA,IACrC,MAAM,0BAA0B,SAAS,uBAAuB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,wBAAwB,CAAC,OAO2C;AAAA,EACjF,IAAI,MAAM,WAAW,SAAS,WAAW;AAAA,IACvC,MAAM,UAAU,MAAM,MAAM,KAAK,SAAS,QAAQ;AAAA,MAChD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM,WAAW;AAAA,IACvB,CAAC;AAAA,IACD,IAAI,CAAC,oBAAoB,SAAS,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,MAC1D,MAAM,0BAA0B,0CAA0C;AAAA,IAC5E;AAAA,IACA,OAAO,EAAE,UAAU,MAAM,iBAAiB,WAAW,QAAQ,GAAG;AAAA,EAClE;AAAA,EAEA,MAAM,cAAc,MAAM,MAAM,KAAK,aAAa,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM,WAAW;AAAA,EACvB,CAAC;AAAA,EACD,IAAI,CAAC,wBAAwB,aAAa,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,IAClE,MAAM,0BAA0B,+CAA+C;AAAA,EACjF;AAAA,EACA,IAAI,YAAY,aAAa;AAAA,IAAW,OAAO,EAAE,UAAU,MAAM,gBAAgB;AAAA,EAEjF,MAAM,kBAAkB,IAAI,IAAI,YAAY,QAAQ;AAAA,EACpD,OAAO;AAAA,IACL,UAAU,MAAM,gBAAgB,OAAO,CAAC,YAAY,gBAAgB,IAAI,OAAO,CAAC;AAAA,EAClF;AAAA;AAGF,SAAS,mBAAmB,CAC1B,SACA,QACA,KAC0B;AAAA,EAC1B,IAAI,CAAC,WAAW,QAAQ,WAAW,UAAU,QAAQ,cAAc;AAAA,IAAW,OAAO;AAAA,EACrF,IAAI,QAAQ,UAAU,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAAG,OAAO;AAAA,EACzD,OACE,QAAQ,sBAAsB,aAAa,QAAQ,kBAAkB,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAIjG,SAAS,uBAAuB,CAC9B,OACA,QACA,KAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,CAAC,iBAAgB,MAAM,SAAS,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAAA,IAAG,OAAO;AAAA,EACpF,OAAO,MAAM,cAAc,aAAa,MAAM,UAAU,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAGlF,SAAS,yBAAyB,CAAC,QAAuB;AAAA,EACxD,OAAO,iBACL,0BACA,sEAAsE,SACxE;AAAA;AAGF,SAAS,kBAAkB,CAAC,MAA4C;AAAA,EACtE,IAAI,CAAC,MAAM;AAAA,IACT,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,iCAAiC,CAC9C,MACA,OAM+B;AAAA,EAC/B,IAAI,MAAM,SAAS,SAAS,MAAM,QAAQ,MAAM,SAAS,gBAAgB,MAAM,aAAa;AAAA,IAC1F,OAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,KAAK,gBAAgB,OAAO;AAAA,IACjC,WAAW,MAAM,SAAS;AAAA,IAC1B,IAAI,MAAM,SAAS;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,EACnB,CAAC;AAAA;;;AC7WI,MAAM,0BAAyB,MAAM;AAAA,EACjC,OAAO;AAClB;;;ACCA,eAAsB,2BAA0B,CAAC,OAM/B;AAAA,EAChB,MAAM,YAAY,MAAM,0BAA0B;AAAA,IAChD,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,EAAE,MAAM,YAAY,IAAI,MAAM,YAAY,OAAO,MAAM,MAAM;AAAA,IACxE,aAAa,CAAC,aAAa,YAAY,OAAO;AAAA,EAChD,CAAC;AAAA,EACD,IAAI,CAAC,WAAW;AAAA,IACd,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA,EAEA,IAAI,UAAU,OAAO,SAAS,cAAc,UAAU,OAAO,SAAS,SAAS;AAAA,IAC7E,IAAI,UAAU,gBAAgB,WAAW;AAAA,MACvC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AAAA,EAIA,IAAI,UAAU,OAAO,SAAS,aAAa;AAAA,IACzC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA;AAIF,eAAsB,oCAAmC,CAAC,OAOxC;AAAA,EAChB,MAAM,YAAY,MAAM,sBAAsB;AAAA,IAC5C,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,OAAO,MAAM;AAAA,IACb,WAAW,EAAE,MAAM,WAAW,kBAAkB,uBAAsB,MAAM,OAAO,EAAE;AAAA,EACvF,CAAC;AAAA,EACD,IACE,CAAC,aACD,UAAU,OAAO,SAAS,eAC1B,UAAU,OAAO,gBAAgB,MAAM,qBACvC;AAAA,IACA,MAAM,IAAI,kBACR,qBAAqB,MAAM,4DAA4D,MAAM,aAC/F;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CAAC,aAAqB,OAAsB;AAAA,EACnE,MAAM,IAAI,kBACR,qBAAqB,iDAAiD,SACxE;AAAA;",
+  "debugId": "F5DA9E9C95A4C18E64756E2164756E21",
   "names": []
 }

package/dist/chunk-h89wz928.js

@@ -0,0 +1,42 @@
+// @bun
+// src/storage/file-upload-sessions/utils.ts
+import { randomUUID } from "crypto";
+var DEFAULT_FILE_UPLOAD_SESSION_TTL_MS2 = 60 * 60 * 1000;
+var DEFAULT_FILE_UPLOAD_TERMINAL_SESSION_TTL_MS2 = 15 * 60 * 1000;
+function createUploadExpiresAt2(now = Date.now()) {
+  return new Date(now + DEFAULT_FILE_UPLOAD_SESSION_TTL_MS2);
+}
+function createFileUploadId2() {
+  return `upload_${randomUUID().replaceAll("-", "")}`;
+}
+function isFileUploadSessionExpired(session, nowMs = Date.now()) {
+  return session.status === "pending" && session.expiresAt.getTime() <= nowMs;
+}
+function isAbandonedFileUploadSession(session, nowMs = Date.now()) {
+  return session.providerUpload !== undefined && isFileUploadSessionExpired(session, nowMs);
+}
+function fileUploadSessionReapAt2(session) {
+  if (session.status === "pending") {
+    return session.providerUpload === undefined ? session.expiresAt : null;
+  }
+  const terminalAt = session.completedAt ?? session.abortedAt;
+  return terminalAt ? new Date(terminalAt.getTime() + DEFAULT_FILE_UPLOAD_TERMINAL_SESSION_TTL_MS2) : null;
+}
+function shouldDeleteFileUploadSession(session, nowMs) {
+  const reapAt = fileUploadSessionReapAt2(session);
+  return reapAt !== null && reapAt.getTime() <= nowMs;
+}
+function isTerminalFileUploadSessionExpired(session, nowMs) {
+  if (session.status === "pending") {
+    return false;
+  }
+  const terminalAt = session.completedAt ?? session.abortedAt;
+  if (!terminalAt) {
+    return false;
+  }
+  return terminalAt.getTime() + DEFAULT_FILE_UPLOAD_TERMINAL_SESSION_TTL_MS2 <= nowMs;
+}
+
+export { DEFAULT_FILE_UPLOAD_SESSION_TTL_MS2, DEFAULT_FILE_UPLOAD_TERMINAL_SESSION_TTL_MS2, createUploadExpiresAt2, createFileUploadId2, isFileUploadSessionExpired, isAbandonedFileUploadSession, fileUploadSessionReapAt2, shouldDeleteFileUploadSession, isTerminalFileUploadSessionExpired };
+
+//# debugId=EAECD974E6F80CCB64756E2164756E21

package/dist/chunk-h89wz928.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/storage/file-upload-sessions/utils.ts"],
+  "sourcesContent": [
+    "import { randomUUID } from \"node:crypto\"\nimport type { FileUploadSession } from \"./types\"\n\nexport const DEFAULT_FILE_UPLOAD_SESSION_TTL_MS = 60 * 60 * 1000\nexport const DEFAULT_FILE_UPLOAD_TERMINAL_SESSION_TTL_MS = 15 * 60 * 1000\n\nexport function createUploadExpiresAt(now = Date.now()): Date {\n  return new Date(now + DEFAULT_FILE_UPLOAD_SESSION_TTL_MS)\n}\n\nexport function createFileUploadId(): string {\n  return `upload_${randomUUID().replaceAll(\"-\", \"\")}`\n}\n\nexport function isFileUploadSessionExpired(\n  session: FileUploadSession,\n  nowMs = Date.now()\n): boolean {\n  return session.status === \"pending\" && session.expiresAt.getTime() <= nowMs\n}\n\n/** Expired, still `pending`, and holding a provider upload only `abortUpload` can release. */\nexport function isAbandonedFileUploadSession(\n  session: FileUploadSession,\n  nowMs = Date.now()\n): boolean {\n  return session.providerUpload !== undefined && isFileUploadSessionExpired(session, nowMs)\n}\n\n/**\n * When a session may be deleted, or null when only a state change can make it deletable.\n * This is the single retention rule: durable providers persist it as `reap_at` and delete\n * `reap_at <= now`, so SQL never restates it.\n */\nexport function fileUploadSessionReapAt(session: FileUploadSession): Date | null {\n  if (session.status === \"pending\") {\n    return session.providerUpload === undefined ? session.expiresAt : null\n  }\n\n  const terminalAt = session.completedAt ?? session.abortedAt\n  return terminalAt\n    ? new Date(terminalAt.getTime() + DEFAULT_FILE_UPLOAD_TERMINAL_SESSION_TTL_MS)\n    : null\n}\n\nexport function shouldDeleteFileUploadSession(session: FileUploadSession, nowMs: number): boolean {\n  const reapAt = fileUploadSessionReapAt(session)\n  return reapAt !== null && reapAt.getTime() <= nowMs\n}\n\nexport function isTerminalFileUploadSessionExpired(\n  session: FileUploadSession,\n  nowMs: number\n): boolean {\n  if (session.status === \"pending\") {\n    return false\n  }\n\n  const terminalAt = session.completedAt ?? session.abortedAt\n  if (!terminalAt) {\n    return false\n  }\n\n  return terminalAt.getTime() + DEFAULT_FILE_UPLOAD_TERMINAL_SESSION_TTL_MS <= nowMs\n}\n"
+  ],
+  "mappings": ";;AAAA;AAGO,IAAM,sCAAqC,KAAK,KAAK;AACrD,IAAM,+CAA8C,KAAK,KAAK;AAE9D,SAAS,sBAAqB,CAAC,MAAM,KAAK,IAAI,GAAS;AAAA,EAC5D,OAAO,IAAI,KAAK,MAAM,mCAAkC;AAAA;AAGnD,SAAS,mBAAkB,GAAW;AAAA,EAC3C,OAAO,UAAU,WAAW,EAAE,WAAW,KAAK,EAAE;AAAA;AAG3C,SAAS,0BAA0B,CACxC,SACA,QAAQ,KAAK,IAAI,GACR;AAAA,EACT,OAAO,QAAQ,WAAW,aAAa,QAAQ,UAAU,QAAQ,KAAK;AAAA;AAIjE,SAAS,4BAA4B,CAC1C,SACA,QAAQ,KAAK,IAAI,GACR;AAAA,EACT,OAAO,QAAQ,mBAAmB,aAAa,2BAA2B,SAAS,KAAK;AAAA;AAQnF,SAAS,wBAAuB,CAAC,SAAyC;AAAA,EAC/E,IAAI,QAAQ,WAAW,WAAW;AAAA,IAChC,OAAO,QAAQ,mBAAmB,YAAY,QAAQ,YAAY;AAAA,EACpE;AAAA,EAEA,MAAM,aAAa,QAAQ,eAAe,QAAQ;AAAA,EAClD,OAAO,aACH,IAAI,KAAK,WAAW,QAAQ,IAAI,4CAA2C,IAC3E;AAAA;AAGC,SAAS,6BAA6B,CAAC,SAA4B,OAAwB;AAAA,EAChG,MAAM,SAAS,yBAAwB,OAAO;AAAA,EAC9C,OAAO,WAAW,QAAQ,OAAO,QAAQ,KAAK;AAAA;AAGzC,SAAS,kCAAkC,CAChD,SACA,OACS;AAAA,EACT,IAAI,QAAQ,WAAW,WAAW;AAAA,IAChC,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,QAAQ,eAAe,QAAQ;AAAA,EAClD,IAAI,CAAC,YAAY;AAAA,IACf,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,WAAW,QAAQ,IAAI,gDAA+C;AAAA;",
+  "debugId": "EAECD974E6F80CCB64756E2164756E21",
+  "names": []
+}