@sixb/core 0.1.12 → 0.1.14

package/dist/{chunk-y3ev53cq.js → chunk-2fv8sajb.js}

@@ -2,10 +2,10 @@
 import {
   normalizeSchemaValue2,
   coerceSchemaValueToTyped2
-} from "./chunk-vsg0g7h9.js";
+} from "./chunk-d8yes9yx.js";
 import {
   validateSchemaOrRefValue2
-} from "./chunk-vpxss818.js";
+} from "./chunk-drz59ve0.js";
 import {
   OntologyValidationError2
 } from "./chunk-cqr3acm1.js";

package/dist/{chunk-q5gz3g2j.js → chunk-2jntasmh.js}

@@ -9,6 +9,17 @@ class AuthRuntimeError2 extends Error {
   }
 }
 
+class SignInRefusedError2 extends Error {
+  reason;
+  email;
+  name = "SignInRefusedError";
+  constructor(reason, message, email) {
+    super(message);
+    this.reason = reason;
+    this.email = email;
+  }
+}
+
 // src/auth/audience.ts
 var DEFAULT_AUTH_SESSION_AUDIENCE2 = "atlas";
 function isValidAuthSessionAudience2(value) {
@@ -226,20 +237,6 @@ function resolveInvitationExpiresAt(value, now) {
   }
   return expiresAt;
 }
-function sanitizeReturnTo(value) {
-  if (!value || !value.startsWith("/") || value.startsWith("//")) {
-    return "/";
-  }
-  try {
-    const parsed = new URL(value, "http://sixb.local");
-    if (parsed.origin !== "http://sixb.local") {
-      return "/";
-    }
-    return `${parsed.pathname}${parsed.search}${parsed.hash}`;
-  } catch {
-    return "/";
-  }
-}
 function assertNonEmpty3(value, label) {
   const normalized = value.trim();
   if (!normalized) {
@@ -319,6 +316,6 @@ function assertValidStrategy(strategy) {
   }
 }
 
-export { AuthRuntimeError2, DEFAULT_AUTH_SESSION_AUDIENCE2, isValidAuthSessionAudience2, resolveAuthSessionAudience2, DEFAULT_SESSION_COOKIE_NAME2, DEFAULT_CSRF_COOKIE_NAME2, resolveAuthCookieOptions2, resolveAuthCookieOptionsForAudience, parseCookieHeader2, getCookie2, serializeCookie2, shouldUseSecureCookies2, createSessionCookieHeader2, createCsrfCookieHeader2, clearSessionCookieHeader2, clearCsrfCookieHeader2, DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS2, DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS2, DEFAULT_AUTH_INVITATION_TTL_MS2, MAX_AUTH_INVITATION_TTL_MS2, DEFAULT_AUTH_SESSION_CACHE_TTL_MS2, resolveAuthConfig2, resolveInvitationExpiresAt, sanitizeReturnTo, assertNonEmpty3, normalizePagination, isMagicLinkAuthStrategy2, isInvitationDeliveryAuthStrategy2, isOidcAuthStrategy2 };
+export { AuthRuntimeError2, SignInRefusedError2, DEFAULT_AUTH_SESSION_AUDIENCE2, isValidAuthSessionAudience2, resolveAuthSessionAudience2, DEFAULT_SESSION_COOKIE_NAME2, DEFAULT_CSRF_COOKIE_NAME2, resolveAuthCookieOptions2, resolveAuthCookieOptionsForAudience, parseCookieHeader2, getCookie2, serializeCookie2, shouldUseSecureCookies2, createSessionCookieHeader2, createCsrfCookieHeader2, clearSessionCookieHeader2, clearCsrfCookieHeader2, DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS2, DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS2, DEFAULT_AUTH_INVITATION_TTL_MS2, MAX_AUTH_INVITATION_TTL_MS2, DEFAULT_AUTH_SESSION_CACHE_TTL_MS2, resolveAuthConfig2, resolveInvitationExpiresAt, assertNonEmpty3, normalizePagination, isMagicLinkAuthStrategy2, isInvitationDeliveryAuthStrategy2, isOidcAuthStrategy2 };
 
-//# debugId=7267F9BBB8A83CDF64756E2164756E21
+//# debugId=E4EC0B2B5EB9DD3264756E2164756E21

package/dist/{chunk-q5gz3g2j.js.map → chunk-2jntasmh.js.map}

@@ -2,12 +2,12 @@
   "version": 3,
   "sources": ["../src/auth/errors.ts", "../src/auth/audience.ts", "../src/auth/cookies.ts", "../src/auth/validation.ts"],
   "sourcesContent": [
-    "export type AuthRuntimeErrorCode =\n  | \"authentication_required\"\n  | \"auth_storage_missing\"\n  | \"authorization_denied\"\n  | \"invalid_auth_input\"\n  | \"invalid_auth_config\"\n  | \"rate_limited\"\n  | \"production_auth_required\"\n\nexport class AuthRuntimeError extends Error {\n  readonly name = \"AuthRuntimeError\"\n\n  constructor(\n    readonly code: AuthRuntimeErrorCode,\n    message: string\n  ) {\n    super(message)\n  }\n}\n",
+    "export type AuthRuntimeErrorCode =\n  | \"authentication_required\"\n  | \"auth_storage_missing\"\n  | \"authorization_denied\"\n  | \"invalid_auth_input\"\n  | \"invalid_auth_config\"\n  | \"rate_limited\"\n  | \"production_auth_required\"\n\nexport class AuthRuntimeError extends Error {\n  readonly name = \"AuthRuntimeError\"\n\n  constructor(\n    readonly code: AuthRuntimeErrorCode,\n    message: string\n  ) {\n    super(message)\n  }\n}\n\n/** Why a strategy refused someone who authenticated. Each is something a person can act on. */\nexport type SignInRefusalReason =\n  | \"not_invited\"\n  | \"suspended\"\n  | \"domain_not_allowed\"\n  | \"no_trusted_address\"\n\n/**\n * Thrown by a strategy that refuses a sign-in for a known reason. The sign-in page tells the\n * person which reason, naming `email` when there is one; `message` is for the server log.\n */\nexport class SignInRefusedError extends Error {\n  readonly name = \"SignInRefusedError\"\n\n  constructor(\n    readonly reason: SignInRefusalReason,\n    message: string,\n    readonly email?: string\n  ) {\n    super(message)\n  }\n}\n",
     "import { AuthRuntimeError } from \"./errors\"\n\nexport const DEFAULT_AUTH_SESSION_AUDIENCE = \"atlas\"\n\nexport type AuthSessionAudience = typeof DEFAULT_AUTH_SESSION_AUDIENCE | \"app\"\n\nexport interface AuthSessionAudienceOptions {\n  readonly audience?: AuthSessionAudience\n}\n\nexport function isValidAuthSessionAudience(value: string): value is AuthSessionAudience {\n  return value === \"atlas\" || value === \"app\"\n}\n\nexport function resolveAuthSessionAudience(\n  value: AuthSessionAudience | undefined\n): AuthSessionAudience {\n  const audience = value ?? DEFAULT_AUTH_SESSION_AUDIENCE\n\n  if (!isValidAuthSessionAudience(audience)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      `[Sixb] Auth session audience '${audience}' is invalid. Expected 'atlas' or 'app'.`\n    )\n  }\n\n  return audience\n}\n",
     "import type { AuthSessionAudience } from \"./audience\"\nimport { DEFAULT_AUTH_SESSION_AUDIENCE, resolveAuthSessionAudience } from \"./audience\"\nimport type { AuthCookieOptions } from \"./types\"\n\nexport const DEFAULT_SESSION_COOKIE_NAME = \"sixb_session\"\nexport const DEFAULT_CSRF_COOKIE_NAME = \"sixb_csrf\"\n\nexport interface ResolvedAuthCookieOptions {\n  readonly sessionCookieName: string\n  readonly csrfCookieName: string\n  readonly domain?: string\n  readonly secure: boolean | \"auto\"\n  readonly sameSite: \"strict\"\n  readonly csrfHttpOnly: boolean\n}\n\ninterface CookieSerializationOptions {\n  readonly name: string\n  readonly value: string\n  readonly httpOnly?: boolean\n  readonly maxAge?: number\n  readonly expires?: Date\n  readonly domain?: string\n  readonly secure?: boolean\n  readonly sameSite: \"strict\"\n}\n\nexport function resolveAuthCookieOptions(\n  options: AuthCookieOptions | undefined\n): ResolvedAuthCookieOptions {\n  const resolved = {\n    sessionCookieName: options?.sessionCookieName ?? DEFAULT_SESSION_COOKIE_NAME,\n    csrfCookieName: options?.csrfCookieName ?? DEFAULT_CSRF_COOKIE_NAME,\n    domain: options?.cookieDomain,\n    secure: options?.secure ?? \"auto\",\n    sameSite: options?.sameSite ?? \"strict\",\n    csrfHttpOnly: options?.csrfHttpOnly ?? false,\n  }\n\n  assertValidCookieOptions(resolved)\n  return resolved\n}\n\nexport function resolveAuthCookieOptionsForAudience(\n  options: ResolvedAuthCookieOptions,\n  audience: AuthSessionAudience | undefined\n): ResolvedAuthCookieOptions {\n  const resolvedAudience = resolveAuthSessionAudience(audience)\n  if (resolvedAudience === DEFAULT_AUTH_SESSION_AUDIENCE) {\n    return options\n  }\n\n  return {\n    ...options,\n    sessionCookieName: `${options.sessionCookieName}_${resolvedAudience}`,\n    csrfCookieName: `${options.csrfCookieName}_${resolvedAudience}`,\n  }\n}\n\nexport function parseCookieHeader(header: string | null): ReadonlyMap<string, string> {\n  const cookies = new Map<string, string>()\n  if (!header) {\n    return cookies\n  }\n\n  for (const part of header.split(\";\")) {\n    const separator = part.indexOf(\"=\")\n    if (separator <= 0) {\n      continue\n    }\n\n    const name = part.slice(0, separator).trim()\n    if (!name || cookies.has(name)) {\n      continue\n    }\n\n    const value = part.slice(separator + 1).trim()\n    cookies.set(name, value)\n  }\n\n  return cookies\n}\n\nexport function getCookie(request: Request, name: string): string | undefined {\n  return parseCookieHeader(request.headers.get(\"cookie\")).get(name)\n}\n\nexport function serializeCookie(options: CookieSerializationOptions): string {\n  const parts = [`${options.name}=${options.value}`]\n\n  parts.push(\"Path=/\")\n  parts.push(\"SameSite=Strict\")\n\n  if (options.domain) {\n    parts.push(`Domain=${options.domain}`)\n  }\n\n  if (options.httpOnly) {\n    parts.push(\"HttpOnly\")\n  }\n\n  if (options.secure) {\n    parts.push(\"Secure\")\n  }\n\n  if (options.maxAge !== undefined) {\n    parts.push(`Max-Age=${Math.trunc(options.maxAge)}`)\n  }\n\n  if (options.expires) {\n    parts.push(`Expires=${options.expires.toUTCString()}`)\n  }\n\n  return parts.join(\"; \")\n}\n\nexport function shouldUseSecureCookies(\n  request: Request,\n  options: ResolvedAuthCookieOptions\n): boolean {\n  if (\n    requiresSecureCookieName(options.sessionCookieName) ||\n    requiresSecureCookieName(options.csrfCookieName)\n  ) {\n    return true\n  }\n\n  if (typeof options.secure === \"boolean\") {\n    return options.secure\n  }\n\n  const url = new URL(request.url)\n  if (isLocalhost(url.hostname)) {\n    return false\n  }\n\n  return url.protocol === \"https:\" || process.env.NODE_ENV === \"production\"\n}\n\nexport function createSessionCookieHeader(params: {\n  readonly request: Request\n  readonly value: string\n  readonly expiresAt: Date\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  const lifetime = resolveCookieLifetime(params.expiresAt)\n  return serializeCookie({\n    name: params.options.sessionCookieName,\n    value: params.value,\n    httpOnly: true,\n    ...lifetime,\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nexport function createCsrfCookieHeader(params: {\n  readonly request: Request\n  readonly value: string\n  readonly expiresAt: Date\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  const lifetime = resolveCookieLifetime(params.expiresAt)\n  return serializeCookie({\n    name: params.options.csrfCookieName,\n    value: params.value,\n    httpOnly: params.options.csrfHttpOnly,\n    ...lifetime,\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nfunction resolveCookieLifetime(expiresAt: Date): {\n  readonly maxAge: number\n  readonly expires: Date\n} {\n  const expiresAtMs = expiresAt.getTime()\n  if (!Number.isFinite(expiresAtMs)) {\n    throw new Error(\"[Sixb] Auth cookie expiresAt must be a valid date.\")\n  }\n\n  return {\n    maxAge: Math.max(0, Math.floor((expiresAtMs - Date.now()) / 1000)),\n    expires: new Date(expiresAtMs),\n  }\n}\n\nexport function clearSessionCookieHeader(params: {\n  readonly request: Request\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  return serializeCookie({\n    name: params.options.sessionCookieName,\n    value: \"\",\n    httpOnly: true,\n    maxAge: 0,\n    expires: new Date(0),\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nexport function clearCsrfCookieHeader(params: {\n  readonly request: Request\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  return serializeCookie({\n    name: params.options.csrfCookieName,\n    value: \"\",\n    maxAge: 0,\n    expires: new Date(0),\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nfunction isLocalhost(hostname: string): boolean {\n  return hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n}\n\nfunction assertValidCookieOptions(options: ResolvedAuthCookieOptions): void {\n  assertValidCookieName(options.sessionCookieName, \"sessionCookieName\")\n  assertValidCookieName(options.csrfCookieName, \"csrfCookieName\")\n\n  if (options.sameSite !== \"strict\") {\n    throw new Error(\"[Sixb] Auth cookie sameSite must be 'strict'.\")\n  }\n\n  if (\n    options.domain &&\n    (isHostPrefixedCookieName(options.sessionCookieName) ||\n      isHostPrefixedCookieName(options.csrfCookieName))\n  ) {\n    throw new Error(\"[Sixb] __Host- auth cookies cannot be configured with cookieDomain.\")\n  }\n\n  if (\n    options.secure === false &&\n    (requiresSecureCookieName(options.sessionCookieName) ||\n      requiresSecureCookieName(options.csrfCookieName))\n  ) {\n    throw new Error(\"[Sixb] __Host- auth cookies require secure cookies.\")\n  }\n}\n\nfunction assertValidCookieName(name: string, label: string): void {\n  if (!/^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/.test(name)) {\n    throw new Error(`[Sixb] Auth cookie ${label} '${name}' is not a valid cookie name.`)\n  }\n}\n\nfunction isHostPrefixedCookieName(name: string): boolean {\n  return name.startsWith(\"__Host-\")\n}\n\nfunction requiresSecureCookieName(name: string): boolean {\n  return isHostPrefixedCookieName(name) || name.startsWith(\"__Secure-\")\n}\n",
     "import { resolveAuthCookieOptions } from \"./cookies\"\nimport { AuthRuntimeError } from \"./errors\"\nimport type {\n  AuthSessionOptions,\n  AuthStrategy,\n  InvitationDeliveryAuthStrategy,\n  MagicLinkAuthStrategy,\n  OidcAuthStrategy,\n  ResolvedAuthConfig,\n  SixbAuthConfig,\n} from \"./types\"\n\nconst DAY = 24 * 60 * 60 * 1000\n\nexport const DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS = 30 * DAY\nexport const DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS = 7 * DAY\nexport const DEFAULT_AUTH_INVITATION_TTL_MS = 7 * DAY\nexport const MAX_AUTH_INVITATION_TTL_MS = 30 * DAY\n/**\n * Default in-process session cache window. Short enough that a revoked session lingers\n * only briefly, long enough to collapse a burst of requests to a single auth resolution.\n */\nexport const DEFAULT_AUTH_SESSION_CACHE_TTL_MS = 5_000\n\nexport { resolveAuthSessionAudience } from \"./audience\"\n\nexport function resolveAuthConfig(config: SixbAuthConfig | undefined): ResolvedAuthConfig {\n  if (!config) {\n    return {\n      strategy: null,\n      session: resolveAuthSessionOptions(undefined),\n      cookies: resolveAuthCookieOptions(undefined),\n    }\n  }\n\n  const strategy = \"strategy\" in config ? config.strategy : config\n  assertValidStrategy(strategy)\n\n  return {\n    strategy,\n    session: resolveAuthSessionOptions(\"strategy\" in config ? config.session : undefined),\n    cookies: resolveAuthCookieOptions(\"strategy\" in config ? config.cookies : undefined),\n  }\n}\n\nexport function resolveInvitationExpiresAt(value: Date | undefined, now: Date): Date {\n  const expiresAt = value\n    ? new Date(value)\n    : new Date(now.getTime() + DEFAULT_AUTH_INVITATION_TTL_MS)\n  const expiresAtTime = expiresAt.getTime()\n\n  if (!Number.isFinite(expiresAtTime)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation expiresAt must be a valid date.\"\n    )\n  }\n\n  if (expiresAtTime <= now.getTime()) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation expiresAt must be in the future.\"\n    )\n  }\n\n  if (expiresAtTime > now.getTime() + MAX_AUTH_INVITATION_TTL_MS) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation expiresAt must be no more than 30 days in the future.\"\n    )\n  }\n\n  return expiresAt\n}\n\nexport function sanitizeReturnTo(value: string | undefined): string {\n  if (!value || !value.startsWith(\"/\") || value.startsWith(\"//\")) {\n    return \"/\"\n  }\n\n  try {\n    const parsed = new URL(value, \"http://sixb.local\")\n    if (parsed.origin !== \"http://sixb.local\") {\n      return \"/\"\n    }\n\n    return `${parsed.pathname}${parsed.search}${parsed.hash}`\n  } catch {\n    return \"/\"\n  }\n}\n\nexport function assertNonEmpty(value: string, label: string): string {\n  const normalized = value.trim()\n  if (!normalized) {\n    throw new AuthRuntimeError(\"invalid_auth_input\", `[Sixb] ${label} must be a non-empty string.`)\n  }\n  return normalized\n}\n\nexport function normalizePagination(input: { readonly limit?: number; readonly offset?: number }): {\n  readonly limit?: number\n  readonly offset: number\n} {\n  if (input.limit !== undefined && (!Number.isInteger(input.limit) || input.limit < 0)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation list limit must be a non-negative integer.\"\n    )\n  }\n\n  if (input.offset !== undefined && (!Number.isInteger(input.offset) || input.offset < 0)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation list offset must be a non-negative integer.\"\n    )\n  }\n\n  return {\n    limit: input.limit,\n    offset: input.offset ?? 0,\n  }\n}\n\nfunction resolveAuthSessionOptions(\n  options: AuthSessionOptions | undefined\n): ResolvedAuthConfig[\"session\"] {\n  const idleTimeoutMs = options?.idleTimeoutMs ?? DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS\n  if (!Number.isFinite(idleTimeoutMs) || idleTimeoutMs <= 0) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session idleTimeoutMs must be a positive finite number.\"\n    )\n  }\n\n  const renewalWindowMs = options?.renewalWindowMs ?? DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS\n  if (!Number.isFinite(renewalWindowMs) || renewalWindowMs <= 0) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session renewalWindowMs must be a positive finite number.\"\n    )\n  }\n  if (renewalWindowMs >= idleTimeoutMs) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session renewalWindowMs must be less than idleTimeoutMs.\"\n    )\n  }\n\n  const absoluteTimeoutMs = options?.absoluteTimeoutMs\n  if (\n    absoluteTimeoutMs !== undefined &&\n    (!Number.isFinite(absoluteTimeoutMs) || absoluteTimeoutMs <= 0)\n  ) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session absoluteTimeoutMs must be a positive finite number when configured.\"\n    )\n  }\n  if (absoluteTimeoutMs !== undefined && absoluteTimeoutMs < idleTimeoutMs) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session absoluteTimeoutMs must be greater than or equal to idleTimeoutMs.\"\n    )\n  }\n\n  const cacheTtlMs = options?.cacheTtlMs ?? DEFAULT_AUTH_SESSION_CACHE_TTL_MS\n  if (!Number.isFinite(cacheTtlMs) || cacheTtlMs < 0) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session cacheTtlMs must be a non-negative finite number.\"\n    )\n  }\n  if (cacheTtlMs >= renewalWindowMs) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session cacheTtlMs must be less than renewalWindowMs.\"\n    )\n  }\n\n  return {\n    idleTimeoutMs,\n    renewalWindowMs,\n    ...(absoluteTimeoutMs === undefined ? {} : { absoluteTimeoutMs }),\n    cacheTtlMs,\n  }\n}\n\nexport function isMagicLinkAuthStrategy(\n  strategy: AuthStrategy | null\n): strategy is MagicLinkAuthStrategy {\n  if (!strategy || strategy.kind !== \"magicLink\") {\n    return false\n  }\n\n  const candidate = strategy as {\n    readonly requestMagicLink?: unknown\n    readonly completeMagicLinkSignIn?: unknown\n  }\n\n  return (\n    typeof candidate.requestMagicLink === \"function\" &&\n    typeof candidate.completeMagicLinkSignIn === \"function\"\n  )\n}\n\nexport function isInvitationDeliveryAuthStrategy(\n  strategy: AuthStrategy | null\n): strategy is InvitationDeliveryAuthStrategy {\n  if (!strategy) {\n    return false\n  }\n\n  const candidate = strategy as {\n    readonly deliverInvitation?: unknown\n  }\n\n  return typeof candidate.deliverInvitation === \"function\"\n}\n\nexport function isOidcAuthStrategy(strategy: AuthStrategy | null): strategy is OidcAuthStrategy {\n  if (!strategy || strategy.kind !== \"oidc\") {\n    return false\n  }\n\n  const candidate = strategy as {\n    readonly startOidcSignIn?: unknown\n    readonly completeOidcSignIn?: unknown\n  }\n\n  return (\n    typeof candidate.startOidcSignIn === \"function\" &&\n    typeof candidate.completeOidcSignIn === \"function\"\n  )\n}\n\nfunction assertValidStrategy(strategy: AuthStrategy): void {\n  if (!strategy.id.trim()) {\n    throw new AuthRuntimeError(\"invalid_auth_config\", \"[Sixb] Auth strategy id is required.\")\n  }\n}\n"
   ],
-  "mappings": ";;AASO,MAAM,0BAAyB,MAAM;AAAA,EAI/B;AAAA,EAHF,OAAO;AAAA,EAEhB,WAAW,CACA,MACT,SACA;AAAA,IACA,MAAM,OAAO;AAAA,IAHJ;AAAA;AAKb;;;AChBO,IAAM,iCAAgC;AAQtC,SAAS,2BAA0B,CAAC,OAA6C;AAAA,EACtF,OAAO,UAAU,WAAW,UAAU;AAAA;AAGjC,SAAS,2BAA0B,CACxC,OACqB;AAAA,EACrB,MAAM,WAAW,SAAS;AAAA,EAE1B,IAAI,CAAC,4BAA2B,QAAQ,GAAG;AAAA,IACzC,MAAM,IAAI,kBACR,uBACA,iCAAiC,kDACnC;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;;;ACtBF,IAAM,+BAA8B;AACpC,IAAM,4BAA2B;AAsBjC,SAAS,yBAAwB,CACtC,SAC2B;AAAA,EAC3B,MAAM,WAAW;AAAA,IACf,mBAAmB,SAAS,qBAAqB;AAAA,IACjD,gBAAgB,SAAS,kBAAkB;AAAA,IAC3C,QAAQ,SAAS;AAAA,IACjB,QAAQ,SAAS,UAAU;AAAA,IAC3B,UAAU,SAAS,YAAY;AAAA,IAC/B,cAAc,SAAS,gBAAgB;AAAA,EACzC;AAAA,EAEA,yBAAyB,QAAQ;AAAA,EACjC,OAAO;AAAA;AAGF,SAAS,mCAAmC,CACjD,SACA,UAC2B;AAAA,EAC3B,MAAM,mBAAmB,4BAA2B,QAAQ;AAAA,EAC5D,IAAI,qBAAqB,gCAA+B;AAAA,IACtD,OAAO;AAAA,EACT;AAAA,EAEA,OAAO;AAAA,OACF;AAAA,IACH,mBAAmB,GAAG,QAAQ,qBAAqB;AAAA,IACnD,gBAAgB,GAAG,QAAQ,kBAAkB;AAAA,EAC/C;AAAA;AAGK,SAAS,kBAAiB,CAAC,QAAoD;AAAA,EACpF,MAAM,UAAU,IAAI;AAAA,EACpB,IAAI,CAAC,QAAQ;AAAA,IACX,OAAO;AAAA,EACT;AAAA,EAEA,WAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AAAA,IACpC,MAAM,YAAY,KAAK,QAAQ,GAAG;AAAA,IAClC,IAAI,aAAa,GAAG;AAAA,MAClB;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK;AAAA,IAC3C,IAAI,CAAC,QAAQ,QAAQ,IAAI,IAAI,GAAG;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,MAAM,QAAQ,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK;AAAA,IAC7C,QAAQ,IAAI,MAAM,KAAK;AAAA,EACzB;AAAA,EAEA,OAAO;AAAA;AAGF,SAAS,UAAS,CAAC,SAAkB,MAAkC;AAAA,EAC5E,OAAO,mBAAkB,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,IAAI;AAAA;AAG3D,SAAS,gBAAe,CAAC,SAA6C;AAAA,EAC3E,MAAM,QAAQ,CAAC,GAAG,QAAQ,QAAQ,QAAQ,OAAO;AAAA,EAEjD,MAAM,KAAK,QAAQ;AAAA,EACnB,MAAM,KAAK,iBAAiB;AAAA,EAE5B,IAAI,QAAQ,QAAQ;AAAA,IAClB,MAAM,KAAK,UAAU,QAAQ,QAAQ;AAAA,EACvC;AAAA,EAEA,IAAI,QAAQ,UAAU;AAAA,IACpB,MAAM,KAAK,UAAU;AAAA,EACvB;AAAA,EAEA,IAAI,QAAQ,QAAQ;AAAA,IAClB,MAAM,KAAK,QAAQ;AAAA,EACrB;AAAA,EAEA,IAAI,QAAQ,WAAW,WAAW;AAAA,IAChC,MAAM,KAAK,WAAW,KAAK,MAAM,QAAQ,MAAM,GAAG;AAAA,EACpD;AAAA,EAEA,IAAI,QAAQ,SAAS;AAAA,IACnB,MAAM,KAAK,WAAW,QAAQ,QAAQ,YAAY,GAAG;AAAA,EACvD;AAAA,EAEA,OAAO,MAAM,KAAK,IAAI;AAAA;AAGjB,SAAS,uBAAsB,CACpC,SACA,SACS;AAAA,EACT,IACE,yBAAyB,QAAQ,iBAAiB,KAClD,yBAAyB,QAAQ,cAAc,GAC/C;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,OAAO,QAAQ,WAAW,WAAW;AAAA,IACvC,OAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAAA,EAC/B,IAAI,YAAY,IAAI,QAAQ,GAAG;AAAA,IAC7B,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,IAAI,aAAa,YAAY;AAAA;AAG/B,SAAS,0BAAyB,CAAC,QAK/B;AAAA,EACT,MAAM,WAAW,sBAAsB,OAAO,SAAS;AAAA,EACvD,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO,OAAO;AAAA,IACd,UAAU;AAAA,OACP;AAAA,IACH,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGI,SAAS,uBAAsB,CAAC,QAK5B;AAAA,EACT,MAAM,WAAW,sBAAsB,OAAO,SAAS;AAAA,EACvD,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO,OAAO;AAAA,IACd,UAAU,OAAO,QAAQ;AAAA,OACtB;AAAA,IACH,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGH,SAAS,qBAAqB,CAAC,WAG7B;AAAA,EACA,MAAM,cAAc,UAAU,QAAQ;AAAA,EACtC,IAAI,CAAC,OAAO,SAAS,WAAW,GAAG;AAAA,IACjC,MAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AAAA,EAEA,OAAO;AAAA,IACL,QAAQ,KAAK,IAAI,GAAG,KAAK,OAAO,cAAc,KAAK,IAAI,KAAK,IAAI,CAAC;AAAA,IACjE,SAAS,IAAI,KAAK,WAAW;AAAA,EAC/B;AAAA;AAGK,SAAS,yBAAwB,CAAC,QAG9B;AAAA,EACT,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO;AAAA,IACP,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,SAAS,IAAI,KAAK,CAAC;AAAA,IACnB,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGI,SAAS,sBAAqB,CAAC,QAG3B;AAAA,EACT,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS,IAAI,KAAK,CAAC;AAAA,IACnB,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGH,SAAS,WAAW,CAAC,UAA2B;AAAA,EAC9C,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAAA;AAG9E,SAAS,wBAAwB,CAAC,SAA0C;AAAA,EAC1E,sBAAsB,QAAQ,mBAAmB,mBAAmB;AAAA,EACpE,sBAAsB,QAAQ,gBAAgB,gBAAgB;AAAA,EAE9D,IAAI,QAAQ,aAAa,UAAU;AAAA,IACjC,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EAEA,IACE,QAAQ,WACP,yBAAyB,QAAQ,iBAAiB,KACjD,yBAAyB,QAAQ,cAAc,IACjD;AAAA,IACA,MAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAAA,EAEA,IACE,QAAQ,WAAW,UAClB,yBAAyB,QAAQ,iBAAiB,KACjD,yBAAyB,QAAQ,cAAc,IACjD;AAAA,IACA,MAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AAAA;AAGF,SAAS,qBAAqB,CAAC,MAAc,OAAqB;AAAA,EAChE,IAAI,CAAC,iCAAiC,KAAK,IAAI,GAAG;AAAA,IAChD,MAAM,IAAI,MAAM,sBAAsB,UAAU,mCAAmC;AAAA,EACrF;AAAA;AAGF,SAAS,wBAAwB,CAAC,MAAuB;AAAA,EACvD,OAAO,KAAK,WAAW,SAAS;AAAA;AAGlC,SAAS,wBAAwB,CAAC,MAAuB;AAAA,EACvD,OAAO,yBAAyB,IAAI,KAAK,KAAK,WAAW,WAAW;AAAA;;;ACzPtE,IAAM,MAAM,KAAK,KAAK,KAAK;AAEpB,IAAM,wCAAuC,KAAK;AAClD,IAAM,0CAAyC,IAAI;AACnD,IAAM,kCAAiC,IAAI;AAC3C,IAAM,8BAA6B,KAAK;AAKxC,IAAM,qCAAoC;AAI1C,SAAS,kBAAiB,CAAC,QAAwD;AAAA,EACxF,IAAI,CAAC,QAAQ;AAAA,IACX,OAAO;AAAA,MACL,UAAU;AAAA,MACV,SAAS,0BAA0B,SAAS;AAAA,MAC5C,SAAS,0BAAyB,SAAS;AAAA,IAC7C;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,cAAc,SAAS,OAAO,WAAW;AAAA,EAC1D,oBAAoB,QAAQ;AAAA,EAE5B,OAAO;AAAA,IACL;AAAA,IACA,SAAS,0BAA0B,cAAc,SAAS,OAAO,UAAU,SAAS;AAAA,IACpF,SAAS,0BAAyB,cAAc,SAAS,OAAO,UAAU,SAAS;AAAA,EACrF;AAAA;AAGK,SAAS,0BAA0B,CAAC,OAAyB,KAAiB;AAAA,EACnF,MAAM,YAAY,QACd,IAAI,KAAK,KAAK,IACd,IAAI,KAAK,IAAI,QAAQ,IAAI,+BAA8B;AAAA,EAC3D,MAAM,gBAAgB,UAAU,QAAQ;AAAA,EAExC,IAAI,CAAC,OAAO,SAAS,aAAa,GAAG;AAAA,IACnC,MAAM,IAAI,kBACR,sBACA,mDACF;AAAA,EACF;AAAA,EAEA,IAAI,iBAAiB,IAAI,QAAQ,GAAG;AAAA,IAClC,MAAM,IAAI,kBACR,sBACA,oDACF;AAAA,EACF;AAAA,EAEA,IAAI,gBAAgB,IAAI,QAAQ,IAAI,6BAA4B;AAAA,IAC9D,MAAM,IAAI,kBACR,sBACA,yEACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;AAGF,SAAS,gBAAgB,CAAC,OAAmC;AAAA,EAClE,IAAI,CAAC,SAAS,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,GAAG;AAAA,IAC9D,OAAO;AAAA,EACT;AAAA,EAEA,IAAI;AAAA,IACF,MAAM,SAAS,IAAI,IAAI,OAAO,mBAAmB;AAAA,IACjD,IAAI,OAAO,WAAW,qBAAqB;AAAA,MACzC,OAAO;AAAA,IACT;AAAA,IAEA,OAAO,GAAG,OAAO,WAAW,OAAO,SAAS,OAAO;AAAA,IACnD,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,eAAc,CAAC,OAAe,OAAuB;AAAA,EACnE,MAAM,aAAa,MAAM,KAAK;AAAA,EAC9B,IAAI,CAAC,YAAY;AAAA,IACf,MAAM,IAAI,kBAAiB,sBAAsB,UAAU,mCAAmC;AAAA,EAChG;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,mBAAmB,CAAC,OAGlC;AAAA,EACA,IAAI,MAAM,UAAU,cAAc,CAAC,OAAO,UAAU,MAAM,KAAK,KAAK,MAAM,QAAQ,IAAI;AAAA,IACpF,MAAM,IAAI,kBACR,sBACA,8DACF;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,WAAW,cAAc,CAAC,OAAO,UAAU,MAAM,MAAM,KAAK,MAAM,SAAS,IAAI;AAAA,IACvF,MAAM,IAAI,kBACR,sBACA,+DACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,QAAQ,MAAM,UAAU;AAAA,EAC1B;AAAA;AAGF,SAAS,yBAAyB,CAChC,SAC+B;AAAA,EAC/B,MAAM,gBAAgB,SAAS,iBAAiB;AAAA,EAChD,IAAI,CAAC,OAAO,SAAS,aAAa,KAAK,iBAAiB,GAAG;AAAA,IACzD,MAAM,IAAI,kBACR,uBACA,qEACF;AAAA,EACF;AAAA,EAEA,MAAM,kBAAkB,SAAS,mBAAmB;AAAA,EACpD,IAAI,CAAC,OAAO,SAAS,eAAe,KAAK,mBAAmB,GAAG;AAAA,IAC7D,MAAM,IAAI,kBACR,uBACA,uEACF;AAAA,EACF;AAAA,EACA,IAAI,mBAAmB,eAAe;AAAA,IACpC,MAAM,IAAI,kBACR,uBACA,sEACF;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,SAAS;AAAA,EACnC,IACE,sBAAsB,cACrB,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,IAC7D;AAAA,IACA,MAAM,IAAI,kBACR,uBACA,yFACF;AAAA,EACF;AAAA,EACA,IAAI,sBAAsB,aAAa,oBAAoB,eAAe;AAAA,IACxE,MAAM,IAAI,kBACR,uBACA,uFACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAAS,cAAc;AAAA,EAC1C,IAAI,CAAC,OAAO,SAAS,UAAU,KAAK,aAAa,GAAG;AAAA,IAClD,MAAM,IAAI,kBACR,uBACA,sEACF;AAAA,EACF;AAAA,EACA,IAAI,cAAc,iBAAiB;AAAA,IACjC,MAAM,IAAI,kBACR,uBACA,mEACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,OACI,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB;AAAA,IAC/D;AAAA,EACF;AAAA;AAGK,SAAS,wBAAuB,CACrC,UACmC;AAAA,EACnC,IAAI,CAAC,YAAY,SAAS,SAAS,aAAa;AAAA,IAC9C,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAKlB,OACE,OAAO,UAAU,qBAAqB,cACtC,OAAO,UAAU,4BAA4B;AAAA;AAI1C,SAAS,iCAAgC,CAC9C,UAC4C;AAAA,EAC5C,IAAI,CAAC,UAAU;AAAA,IACb,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAIlB,OAAO,OAAO,UAAU,sBAAsB;AAAA;AAGzC,SAAS,mBAAkB,CAAC,UAA6D;AAAA,EAC9F,IAAI,CAAC,YAAY,SAAS,SAAS,QAAQ;AAAA,IACzC,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAKlB,OACE,OAAO,UAAU,oBAAoB,cACrC,OAAO,UAAU,uBAAuB;AAAA;AAI5C,SAAS,mBAAmB,CAAC,UAA8B;AAAA,EACzD,IAAI,CAAC,SAAS,GAAG,KAAK,GAAG;AAAA,IACvB,MAAM,IAAI,kBAAiB,uBAAuB,sCAAsC;AAAA,EAC1F;AAAA;",
-  "debugId": "7267F9BBB8A83CDF64756E2164756E21",
+  "mappings": ";;AASO,MAAM,0BAAyB,MAAM;AAAA,EAI/B;AAAA,EAHF,OAAO;AAAA,EAEhB,WAAW,CACA,MACT,SACA;AAAA,IACA,MAAM,OAAO;AAAA,IAHJ;AAAA;AAKb;AAAA;AAaO,MAAM,4BAA2B,MAAM;AAAA,EAIjC;AAAA,EAEA;AAAA,EALF,OAAO;AAAA,EAEhB,WAAW,CACA,QACT,SACS,OACT;AAAA,IACA,MAAM,OAAO;AAAA,IAJJ;AAAA,IAEA;AAAA;AAIb;;;ACvCO,IAAM,iCAAgC;AAQtC,SAAS,2BAA0B,CAAC,OAA6C;AAAA,EACtF,OAAO,UAAU,WAAW,UAAU;AAAA;AAGjC,SAAS,2BAA0B,CACxC,OACqB;AAAA,EACrB,MAAM,WAAW,SAAS;AAAA,EAE1B,IAAI,CAAC,4BAA2B,QAAQ,GAAG;AAAA,IACzC,MAAM,IAAI,kBACR,uBACA,iCAAiC,kDACnC;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;;;ACtBF,IAAM,+BAA8B;AACpC,IAAM,4BAA2B;AAsBjC,SAAS,yBAAwB,CACtC,SAC2B;AAAA,EAC3B,MAAM,WAAW;AAAA,IACf,mBAAmB,SAAS,qBAAqB;AAAA,IACjD,gBAAgB,SAAS,kBAAkB;AAAA,IAC3C,QAAQ,SAAS;AAAA,IACjB,QAAQ,SAAS,UAAU;AAAA,IAC3B,UAAU,SAAS,YAAY;AAAA,IAC/B,cAAc,SAAS,gBAAgB;AAAA,EACzC;AAAA,EAEA,yBAAyB,QAAQ;AAAA,EACjC,OAAO;AAAA;AAGF,SAAS,mCAAmC,CACjD,SACA,UAC2B;AAAA,EAC3B,MAAM,mBAAmB,4BAA2B,QAAQ;AAAA,EAC5D,IAAI,qBAAqB,gCAA+B;AAAA,IACtD,OAAO;AAAA,EACT;AAAA,EAEA,OAAO;AAAA,OACF;AAAA,IACH,mBAAmB,GAAG,QAAQ,qBAAqB;AAAA,IACnD,gBAAgB,GAAG,QAAQ,kBAAkB;AAAA,EAC/C;AAAA;AAGK,SAAS,kBAAiB,CAAC,QAAoD;AAAA,EACpF,MAAM,UAAU,IAAI;AAAA,EACpB,IAAI,CAAC,QAAQ;AAAA,IACX,OAAO;AAAA,EACT;AAAA,EAEA,WAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AAAA,IACpC,MAAM,YAAY,KAAK,QAAQ,GAAG;AAAA,IAClC,IAAI,aAAa,GAAG;AAAA,MAClB;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK;AAAA,IAC3C,IAAI,CAAC,QAAQ,QAAQ,IAAI,IAAI,GAAG;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,MAAM,QAAQ,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK;AAAA,IAC7C,QAAQ,IAAI,MAAM,KAAK;AAAA,EACzB;AAAA,EAEA,OAAO;AAAA;AAGF,SAAS,UAAS,CAAC,SAAkB,MAAkC;AAAA,EAC5E,OAAO,mBAAkB,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,IAAI;AAAA;AAG3D,SAAS,gBAAe,CAAC,SAA6C;AAAA,EAC3E,MAAM,QAAQ,CAAC,GAAG,QAAQ,QAAQ,QAAQ,OAAO;AAAA,EAEjD,MAAM,KAAK,QAAQ;AAAA,EACnB,MAAM,KAAK,iBAAiB;AAAA,EAE5B,IAAI,QAAQ,QAAQ;AAAA,IAClB,MAAM,KAAK,UAAU,QAAQ,QAAQ;AAAA,EACvC;AAAA,EAEA,IAAI,QAAQ,UAAU;AAAA,IACpB,MAAM,KAAK,UAAU;AAAA,EACvB;AAAA,EAEA,IAAI,QAAQ,QAAQ;AAAA,IAClB,MAAM,KAAK,QAAQ;AAAA,EACrB;AAAA,EAEA,IAAI,QAAQ,WAAW,WAAW;AAAA,IAChC,MAAM,KAAK,WAAW,KAAK,MAAM,QAAQ,MAAM,GAAG;AAAA,EACpD;AAAA,EAEA,IAAI,QAAQ,SAAS;AAAA,IACnB,MAAM,KAAK,WAAW,QAAQ,QAAQ,YAAY,GAAG;AAAA,EACvD;AAAA,EAEA,OAAO,MAAM,KAAK,IAAI;AAAA;AAGjB,SAAS,uBAAsB,CACpC,SACA,SACS;AAAA,EACT,IACE,yBAAyB,QAAQ,iBAAiB,KAClD,yBAAyB,QAAQ,cAAc,GAC/C;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,OAAO,QAAQ,WAAW,WAAW;AAAA,IACvC,OAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAAA,EAC/B,IAAI,YAAY,IAAI,QAAQ,GAAG;AAAA,IAC7B,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,IAAI,aAAa,YAAY;AAAA;AAG/B,SAAS,0BAAyB,CAAC,QAK/B;AAAA,EACT,MAAM,WAAW,sBAAsB,OAAO,SAAS;AAAA,EACvD,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO,OAAO;AAAA,IACd,UAAU;AAAA,OACP;AAAA,IACH,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGI,SAAS,uBAAsB,CAAC,QAK5B;AAAA,EACT,MAAM,WAAW,sBAAsB,OAAO,SAAS;AAAA,EACvD,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO,OAAO;AAAA,IACd,UAAU,OAAO,QAAQ;AAAA,OACtB;AAAA,IACH,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGH,SAAS,qBAAqB,CAAC,WAG7B;AAAA,EACA,MAAM,cAAc,UAAU,QAAQ;AAAA,EACtC,IAAI,CAAC,OAAO,SAAS,WAAW,GAAG;AAAA,IACjC,MAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AAAA,EAEA,OAAO;AAAA,IACL,QAAQ,KAAK,IAAI,GAAG,KAAK,OAAO,cAAc,KAAK,IAAI,KAAK,IAAI,CAAC;AAAA,IACjE,SAAS,IAAI,KAAK,WAAW;AAAA,EAC/B;AAAA;AAGK,SAAS,yBAAwB,CAAC,QAG9B;AAAA,EACT,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO;AAAA,IACP,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,SAAS,IAAI,KAAK,CAAC;AAAA,IACnB,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGI,SAAS,sBAAqB,CAAC,QAG3B;AAAA,EACT,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS,IAAI,KAAK,CAAC;AAAA,IACnB,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGH,SAAS,WAAW,CAAC,UAA2B;AAAA,EAC9C,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAAA;AAG9E,SAAS,wBAAwB,CAAC,SAA0C;AAAA,EAC1E,sBAAsB,QAAQ,mBAAmB,mBAAmB;AAAA,EACpE,sBAAsB,QAAQ,gBAAgB,gBAAgB;AAAA,EAE9D,IAAI,QAAQ,aAAa,UAAU;AAAA,IACjC,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EAEA,IACE,QAAQ,WACP,yBAAyB,QAAQ,iBAAiB,KACjD,yBAAyB,QAAQ,cAAc,IACjD;AAAA,IACA,MAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAAA,EAEA,IACE,QAAQ,WAAW,UAClB,yBAAyB,QAAQ,iBAAiB,KACjD,yBAAyB,QAAQ,cAAc,IACjD;AAAA,IACA,MAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AAAA;AAGF,SAAS,qBAAqB,CAAC,MAAc,OAAqB;AAAA,EAChE,IAAI,CAAC,iCAAiC,KAAK,IAAI,GAAG;AAAA,IAChD,MAAM,IAAI,MAAM,sBAAsB,UAAU,mCAAmC;AAAA,EACrF;AAAA;AAGF,SAAS,wBAAwB,CAAC,MAAuB;AAAA,EACvD,OAAO,KAAK,WAAW,SAAS;AAAA;AAGlC,SAAS,wBAAwB,CAAC,MAAuB;AAAA,EACvD,OAAO,yBAAyB,IAAI,KAAK,KAAK,WAAW,WAAW;AAAA;;;ACzPtE,IAAM,MAAM,KAAK,KAAK,KAAK;AAEpB,IAAM,wCAAuC,KAAK;AAClD,IAAM,0CAAyC,IAAI;AACnD,IAAM,kCAAiC,IAAI;AAC3C,IAAM,8BAA6B,KAAK;AAKxC,IAAM,qCAAoC;AAI1C,SAAS,kBAAiB,CAAC,QAAwD;AAAA,EACxF,IAAI,CAAC,QAAQ;AAAA,IACX,OAAO;AAAA,MACL,UAAU;AAAA,MACV,SAAS,0BAA0B,SAAS;AAAA,MAC5C,SAAS,0BAAyB,SAAS;AAAA,IAC7C;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,cAAc,SAAS,OAAO,WAAW;AAAA,EAC1D,oBAAoB,QAAQ;AAAA,EAE5B,OAAO;AAAA,IACL;AAAA,IACA,SAAS,0BAA0B,cAAc,SAAS,OAAO,UAAU,SAAS;AAAA,IACpF,SAAS,0BAAyB,cAAc,SAAS,OAAO,UAAU,SAAS;AAAA,EACrF;AAAA;AAGK,SAAS,0BAA0B,CAAC,OAAyB,KAAiB;AAAA,EACnF,MAAM,YAAY,QACd,IAAI,KAAK,KAAK,IACd,IAAI,KAAK,IAAI,QAAQ,IAAI,+BAA8B;AAAA,EAC3D,MAAM,gBAAgB,UAAU,QAAQ;AAAA,EAExC,IAAI,CAAC,OAAO,SAAS,aAAa,GAAG;AAAA,IACnC,MAAM,IAAI,kBACR,sBACA,mDACF;AAAA,EACF;AAAA,EAEA,IAAI,iBAAiB,IAAI,QAAQ,GAAG;AAAA,IAClC,MAAM,IAAI,kBACR,sBACA,oDACF;AAAA,EACF;AAAA,EAEA,IAAI,gBAAgB,IAAI,QAAQ,IAAI,6BAA4B;AAAA,IAC9D,MAAM,IAAI,kBACR,sBACA,yEACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;AAoBF,SAAS,eAAc,CAAC,OAAe,OAAuB;AAAA,EACnE,MAAM,aAAa,MAAM,KAAK;AAAA,EAC9B,IAAI,CAAC,YAAY;AAAA,IACf,MAAM,IAAI,kBAAiB,sBAAsB,UAAU,mCAAmC;AAAA,EAChG;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,mBAAmB,CAAC,OAGlC;AAAA,EACA,IAAI,MAAM,UAAU,cAAc,CAAC,OAAO,UAAU,MAAM,KAAK,KAAK,MAAM,QAAQ,IAAI;AAAA,IACpF,MAAM,IAAI,kBACR,sBACA,8DACF;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,WAAW,cAAc,CAAC,OAAO,UAAU,MAAM,MAAM,KAAK,MAAM,SAAS,IAAI;AAAA,IACvF,MAAM,IAAI,kBACR,sBACA,+DACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,QAAQ,MAAM,UAAU;AAAA,EAC1B;AAAA;AAGF,SAAS,yBAAyB,CAChC,SAC+B;AAAA,EAC/B,MAAM,gBAAgB,SAAS,iBAAiB;AAAA,EAChD,IAAI,CAAC,OAAO,SAAS,aAAa,KAAK,iBAAiB,GAAG;AAAA,IACzD,MAAM,IAAI,kBACR,uBACA,qEACF;AAAA,EACF;AAAA,EAEA,MAAM,kBAAkB,SAAS,mBAAmB;AAAA,EACpD,IAAI,CAAC,OAAO,SAAS,eAAe,KAAK,mBAAmB,GAAG;AAAA,IAC7D,MAAM,IAAI,kBACR,uBACA,uEACF;AAAA,EACF;AAAA,EACA,IAAI,mBAAmB,eAAe;AAAA,IACpC,MAAM,IAAI,kBACR,uBACA,sEACF;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,SAAS;AAAA,EACnC,IACE,sBAAsB,cACrB,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,IAC7D;AAAA,IACA,MAAM,IAAI,kBACR,uBACA,yFACF;AAAA,EACF;AAAA,EACA,IAAI,sBAAsB,aAAa,oBAAoB,eAAe;AAAA,IACxE,MAAM,IAAI,kBACR,uBACA,uFACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAAS,cAAc;AAAA,EAC1C,IAAI,CAAC,OAAO,SAAS,UAAU,KAAK,aAAa,GAAG;AAAA,IAClD,MAAM,IAAI,kBACR,uBACA,sEACF;AAAA,EACF;AAAA,EACA,IAAI,cAAc,iBAAiB;AAAA,IACjC,MAAM,IAAI,kBACR,uBACA,mEACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,OACI,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB;AAAA,IAC/D;AAAA,EACF;AAAA;AAGK,SAAS,wBAAuB,CACrC,UACmC;AAAA,EACnC,IAAI,CAAC,YAAY,SAAS,SAAS,aAAa;AAAA,IAC9C,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAKlB,OACE,OAAO,UAAU,qBAAqB,cACtC,OAAO,UAAU,4BAA4B;AAAA;AAI1C,SAAS,iCAAgC,CAC9C,UAC4C;AAAA,EAC5C,IAAI,CAAC,UAAU;AAAA,IACb,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAIlB,OAAO,OAAO,UAAU,sBAAsB;AAAA;AAGzC,SAAS,mBAAkB,CAAC,UAA6D;AAAA,EAC9F,IAAI,CAAC,YAAY,SAAS,SAAS,QAAQ;AAAA,IACzC,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAKlB,OACE,OAAO,UAAU,oBAAoB,cACrC,OAAO,UAAU,uBAAuB;AAAA;AAI5C,SAAS,mBAAmB,CAAC,UAA8B;AAAA,EACzD,IAAI,CAAC,SAAS,GAAG,KAAK,GAAG;AAAA,IACvB,MAAM,IAAI,kBAAiB,uBAAuB,sCAAsC;AAAA,EAC1F;AAAA;",
+  "debugId": "E4EC0B2B5EB9DD3264756E2164756E21",
   "names": []
 }

package/dist/chunk-3a338wrp.js

@@ -0,0 +1,191 @@
+// @bun
+import {
+  principalsEqual2
+} from "./chunk-6rzb1g6h.js";
+import {
+  createFileUploadId2,
+  isFileUploadSessionExpired,
+  isTerminalFileUploadSessionExpired
+} from "./chunk-h89wz928.js";
+
+// src/storage/file-upload-sessions/errors.ts
+class FileUploadSessionError2 extends Error {
+  reason;
+  name = "FileUploadSessionError";
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+  }
+}
+
+// src/storage/file-upload-sessions/provider.ts
+class DurableFileUploadSessions2 {
+  backend;
+  constructor(backend) {
+    this.backend = backend;
+  }
+  async create(input) {
+    return this.backend.transaction(async (persistence) => {
+      const session = {
+        id: input.id ?? createFileUploadId2(),
+        projectId: input.projectId,
+        principal: input.principal,
+        strategy: input.strategy,
+        status: "pending",
+        ...input.fileName === undefined ? {} : { fileName: input.fileName },
+        ...input.mediaType === undefined ? {} : { mediaType: input.mediaType },
+        ...input.logicalPath === undefined ? {} : { logicalPath: input.logicalPath },
+        ...input.expectedSizeBytes === undefined ? {} : { expectedSizeBytes: input.expectedSizeBytes },
+        ...input.expectedDigest === undefined ? {} : { expectedDigest: input.expectedDigest },
+        ...input.providerUpload === undefined ? {} : { providerUpload: input.providerUpload },
+        signedParts: [],
+        createdAt: await persistence.now(),
+        expiresAt: input.expiresAt
+      };
+      if (!await persistence.insert(session)) {
+        throw new Error(`[Sixb] File upload session '${session.id}' already exists.`);
+      }
+      return session;
+    });
+  }
+  async getForPrincipal(uploadId, principal) {
+    return this.backend.read(async (persistence) => {
+      const session = await persistence.get(uploadId);
+      if (!session || !principalsEqual2(session.principal, principal)) {
+        throw new FileUploadSessionError2("not_found", "File upload session not found.");
+      }
+      const nowMs = (await persistence.now()).getTime();
+      if (isFileUploadSessionExpired(session, nowMs)) {
+        throw new FileUploadSessionError2("expired", "File upload session has expired.");
+      }
+      if (isTerminalFileUploadSessionExpired(session, nowMs)) {
+        throw new FileUploadSessionError2("not_found", "File upload session not found.");
+      }
+      return session;
+    });
+  }
+  async markUploaded(uploadId, fileRef) {
+    return this.transition(uploadId, (session) => ({ ...session, fileRef }));
+  }
+  async addSignedPart(uploadId, part) {
+    return this.transition(uploadId, (session) => ({
+      ...session,
+      signedParts: [
+        ...session.signedParts.filter((candidate) => candidate.partNumber !== part.partNumber),
+        part
+      ].sort((left, right) => left.partNumber - right.partNumber)
+    }));
+  }
+  async complete(uploadId, fileRef) {
+    return this.transition(uploadId, (session, now) => ({
+      ...session,
+      status: "completed",
+      fileRef,
+      completedAt: now
+    }));
+  }
+  async abort(uploadId) {
+    return this.transition(uploadId, (session, now) => ({
+      ...session,
+      status: "aborted",
+      abortedAt: now
+    }));
+  }
+  async listAbandoned(input) {
+    if (input.projectId.trim().length === 0) {
+      throw new Error("[Sixb] File upload session listAbandoned projectId must not be blank.");
+    }
+    if (!Number.isSafeInteger(input.limit) || input.limit <= 0) {
+      throw new Error("[Sixb] File upload session listAbandoned limit must be a positive integer.");
+    }
+    return this.backend.read((persistence) => persistence.listAbandoned(input));
+  }
+  async cleanupExpired(now) {
+    return this.backend.transaction(async (persistence) => persistence.deleteReapable(now ?? await persistence.now()));
+  }
+  transition(uploadId, next) {
+    return this.backend.transaction(async (persistence) => {
+      const session = await persistence.get(uploadId);
+      if (!session) {
+        throw new FileUploadSessionError2("not_found", "File upload session not found.");
+      }
+      if (session.status !== "pending") {
+        throw new FileUploadSessionError2(session.status === "completed" ? "already_completed" : "already_aborted", `File upload session is already ${session.status}.`);
+      }
+      const updated = next(session, await persistence.now());
+      await persistence.update(updated);
+      return updated;
+    });
+  }
+}
+var STRATEGIES = ["server", "direct-put", "multipart"];
+var STATUSES = ["pending", "completed", "aborted"];
+var PRINCIPAL_TYPES = ["user", "serviceAccount", "system"];
+function parseFileUploadSessionRow2(row) {
+  const id = text(row.id, "id", String(row.id));
+  const strategy = text(row.strategy, "strategy", id);
+  const status = text(row.status, "status", id);
+  if (!STRATEGIES.includes(strategy))
+    throw corrupt(id, `unknown strategy '${strategy}'`);
+  if (!STATUSES.includes(status))
+    throw corrupt(id, `unknown status '${status}'`);
+  const principalType = text(row.ownerPrincipalType, "ownerPrincipalType", id);
+  if (!PRINCIPAL_TYPES.includes(principalType)) {
+    throw corrupt(id, `unknown owner principal type '${principalType}'`);
+  }
+  const providerUpload = json(row.providerUpload);
+  const fileRef = json(row.fileRef);
+  const signedParts = json(row.signedParts);
+  if (!Array.isArray(signedParts))
+    throw corrupt(id, "signedParts is not an array");
+  const optional = (key, value) => value === null || value === undefined ? {} : { [key]: value };
+  return {
+    id,
+    projectId: text(row.projectId, "projectId", id),
+    principal: {
+      type: principalType,
+      id: text(row.ownerPrincipalId, "ownerPrincipalId", id)
+    },
+    strategy,
+    status,
+    ...optional("fileName", row.fileName),
+    ...optional("mediaType", row.mediaType),
+    ...optional("logicalPath", row.logicalPath),
+    ...optional("expectedSizeBytes", row.expectedSizeBytes === null || row.expectedSizeBytes === undefined ? null : Number(row.expectedSizeBytes)),
+    ...optional("expectedDigest", row.expectedDigest),
+    ...optional("providerUpload", providerUpload === null ? null : withExpiresAt(providerUpload, id)),
+    signedParts: signedParts.map((part) => withExpiresAt(part, id)),
+    ...optional("fileRef", fileRef),
+    createdAt: date(row.createdAt, "createdAt", id),
+    expiresAt: date(row.expiresAt, "expiresAt", id),
+    ...optional("completedAt", row.completedAt == null ? null : date(row.completedAt, "completedAt", id)),
+    ...optional("abortedAt", row.abortedAt == null ? null : date(row.abortedAt, "abortedAt", id))
+  };
+}
+function json(value) {
+  return typeof value === "string" ? JSON.parse(value) : value ?? null;
+}
+function withExpiresAt(value, id) {
+  if (typeof value !== "object" || value === null)
+    throw corrupt(id, "nested record is not an object");
+  const record = value;
+  return { ...record, expiresAt: date(record.expiresAt, "nested expiresAt", id) };
+}
+function text(value, column, id) {
+  if (typeof value !== "string" || value.length === 0)
+    throw corrupt(id, `${column} is not text`);
+  return value;
+}
+function date(value, column, id) {
+  const parsed = value instanceof Date || typeof value === "string" ? new Date(value) : null;
+  if (!parsed || !Number.isFinite(parsed.getTime()))
+    throw corrupt(id, `${column} is not a date`);
+  return parsed;
+}
+function corrupt(id, reason) {
+  return new Error(`[Sixb] Stored file upload session '${id}' is invalid: ${reason}.`);
+}
+
+export { FileUploadSessionError2, DurableFileUploadSessions2, parseFileUploadSessionRow2 };
+
+//# debugId=612366C739B9FA8F64756E2164756E21

package/dist/chunk-3a338wrp.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/storage/file-upload-sessions/errors.ts", "../src/storage/file-upload-sessions/provider.ts"],
+  "sourcesContent": [
+    "/**\n * Transport-agnostic reasons a file upload session operation can fail. Mapping a\n * reason to an HTTP status (or any other transport) is the responsibility of the\n * boundary that surfaces it, not of core.\n */\nexport type FileUploadSessionErrorReason =\n  | \"not_found\"\n  | \"expired\"\n  | \"already_completed\"\n  | \"already_aborted\"\n\n/**\n * Error for file upload session invariants and invalid state transitions.\n */\nexport class FileUploadSessionError extends Error {\n  readonly name = \"FileUploadSessionError\"\n\n  constructor(\n    readonly reason: FileUploadSessionErrorReason,\n    message: string\n  ) {\n    super(message)\n  }\n}\n",
+    "import { type Principal, principalsEqual } from \"../../auth\"\nimport type { FileRef, SignedBlobUploadPart } from \"../../blob-storage\"\nimport { FileUploadSessionError } from \"./errors\"\nimport type {\n  CreateFileUploadSessionInput,\n  FileUploadSession,\n  FileUploadSessionStore,\n  FileUploadStatus,\n  FileUploadStrategy,\n  ListAbandonedFileUploadSessionsInput,\n} from \"./types\"\nimport {\n  createFileUploadId,\n  isFileUploadSessionExpired,\n  isTerminalFileUploadSessionExpired,\n} from \"./utils\"\n\nexport { fileUploadSessionReapAt } from \"./utils\"\n\n/** Database-specific row access used by the shared upload session state machine. */\nexport interface FileUploadSessionPersistence {\n  now(): Promise<Date>\n  /** Returns false when the id already exists. */\n  insert(session: FileUploadSession): Promise<boolean>\n  /** Inside `transaction`, must lock the row until the transaction ends. */\n  get(uploadId: string): Promise<FileUploadSession | null>\n  update(session: FileUploadSession): Promise<void>\n  /** The project's `pending` rows holding a provider upload, `expires_at <= now`, oldest first. */\n  listAbandoned(input: ListAbandonedFileUploadSessionsInput): Promise<readonly FileUploadSession[]>\n  /** Deletes rows whose persisted `fileUploadSessionReapAt` is `<= now`. */\n  deleteReapable(now: Date): Promise<number>\n}\n\n/** Transaction and lock boundary supplied by a concrete durable storage provider. */\nexport interface FileUploadSessionPersistenceBackend {\n  read<T>(run: (persistence: FileUploadSessionPersistence) => Promise<T>): Promise<T>\n  transaction<T>(run: (persistence: FileUploadSessionPersistence) => Promise<T>): Promise<T>\n}\n\n/**\n * Shared durable implementation of the upload session lifecycle. Concrete providers own SQL,\n * transactions and database time; every transition and retention rule lives here so SQLite,\n * PostgreSQL and the in-memory reference cannot drift semantically.\n *\n * Every method is `async`: a storage's operation-scoped facade serializes only async methods, and\n * a plain Promise-returning method would bypass it and join whatever SQLite transaction is open.\n */\nexport class DurableFileUploadSessions implements FileUploadSessionStore {\n  constructor(private readonly backend: FileUploadSessionPersistenceBackend) {}\n\n  async create(input: CreateFileUploadSessionInput): Promise<FileUploadSession> {\n    return this.backend.transaction(async (persistence) => {\n      const session: FileUploadSession = {\n        id: input.id ?? createFileUploadId(),\n        projectId: input.projectId,\n        principal: input.principal,\n        strategy: input.strategy,\n        status: \"pending\",\n        ...(input.fileName === undefined ? {} : { fileName: input.fileName }),\n        ...(input.mediaType === undefined ? {} : { mediaType: input.mediaType }),\n        ...(input.logicalPath === undefined ? {} : { logicalPath: input.logicalPath }),\n        ...(input.expectedSizeBytes === undefined\n          ? {}\n          : { expectedSizeBytes: input.expectedSizeBytes }),\n        ...(input.expectedDigest === undefined ? {} : { expectedDigest: input.expectedDigest }),\n        ...(input.providerUpload === undefined ? {} : { providerUpload: input.providerUpload }),\n        signedParts: [],\n        createdAt: await persistence.now(),\n        expiresAt: input.expiresAt,\n      }\n\n      if (!(await persistence.insert(session))) {\n        throw new Error(`[Sixb] File upload session '${session.id}' already exists.`)\n      }\n      return session\n    })\n  }\n\n  async getForPrincipal(uploadId: string, principal: Principal): Promise<FileUploadSession> {\n    return this.backend.read(async (persistence) => {\n      const session = await persistence.get(uploadId)\n      if (!session || !principalsEqual(session.principal, principal)) {\n        throw new FileUploadSessionError(\"not_found\", \"File upload session not found.\")\n      }\n\n      const nowMs = (await persistence.now()).getTime()\n      if (isFileUploadSessionExpired(session, nowMs)) {\n        throw new FileUploadSessionError(\"expired\", \"File upload session has expired.\")\n      }\n      if (isTerminalFileUploadSessionExpired(session, nowMs)) {\n        throw new FileUploadSessionError(\"not_found\", \"File upload session not found.\")\n      }\n      return session\n    })\n  }\n\n  async markUploaded(uploadId: string, fileRef: FileRef): Promise<FileUploadSession> {\n    return this.transition(uploadId, (session) => ({ ...session, fileRef }))\n  }\n\n  async addSignedPart(uploadId: string, part: SignedBlobUploadPart): Promise<FileUploadSession> {\n    return this.transition(uploadId, (session) => ({\n      ...session,\n      signedParts: [\n        ...session.signedParts.filter((candidate) => candidate.partNumber !== part.partNumber),\n        part,\n      ].sort((left, right) => left.partNumber - right.partNumber),\n    }))\n  }\n\n  async complete(uploadId: string, fileRef: FileRef): Promise<FileUploadSession> {\n    return this.transition(uploadId, (session, now) => ({\n      ...session,\n      status: \"completed\",\n      fileRef,\n      completedAt: now,\n    }))\n  }\n\n  async abort(uploadId: string): Promise<FileUploadSession> {\n    return this.transition(uploadId, (session, now) => ({\n      ...session,\n      status: \"aborted\",\n      abortedAt: now,\n    }))\n  }\n\n  async listAbandoned(\n    input: ListAbandonedFileUploadSessionsInput\n  ): Promise<readonly FileUploadSession[]> {\n    if (input.projectId.trim().length === 0) {\n      throw new Error(\"[Sixb] File upload session listAbandoned projectId must not be blank.\")\n    }\n    if (!Number.isSafeInteger(input.limit) || input.limit <= 0) {\n      throw new Error(\"[Sixb] File upload session listAbandoned limit must be a positive integer.\")\n    }\n    return this.backend.read((persistence) => persistence.listAbandoned(input))\n  }\n\n  async cleanupExpired(now?: Date): Promise<number> {\n    return this.backend.transaction(async (persistence) =>\n      persistence.deleteReapable(now ?? (await persistence.now()))\n    )\n  }\n\n  private transition(\n    uploadId: string,\n    next: (session: FileUploadSession, now: Date) => FileUploadSession\n  ): Promise<FileUploadSession> {\n    return this.backend.transaction(async (persistence) => {\n      const session = await persistence.get(uploadId)\n      if (!session) {\n        throw new FileUploadSessionError(\"not_found\", \"File upload session not found.\")\n      }\n      if (session.status !== \"pending\") {\n        throw new FileUploadSessionError(\n          session.status === \"completed\" ? \"already_completed\" : \"already_aborted\",\n          `File upload session is already ${session.status}.`\n        )\n      }\n\n      const updated = next(session, await persistence.now())\n      await persistence.update(updated)\n      return updated\n    })\n  }\n}\n\nconst STRATEGIES: readonly FileUploadStrategy[] = [\"server\", \"direct-put\", \"multipart\"]\nconst STATUSES: readonly FileUploadStatus[] = [\"pending\", \"completed\", \"aborted\"]\nconst PRINCIPAL_TYPES: readonly Principal[\"type\"][] = [\"user\", \"serviceAccount\", \"system\"]\n\n/**\n * Rebuilds a session from a provider row. JSON columns may arrive parsed (jsonb) or as text\n * (SQLite); nested `expiresAt` values are revived and every other nested field passes through,\n * so blob providers can extend `providerUpload` without a migration. Fails closed on corruption.\n */\nexport function parseFileUploadSessionRow(row: {\n  readonly [column: string]: unknown\n}): FileUploadSession {\n  const id = text(row.id, \"id\", String(row.id))\n  const strategy = text(row.strategy, \"strategy\", id) as FileUploadStrategy\n  const status = text(row.status, \"status\", id) as FileUploadStatus\n  if (!STRATEGIES.includes(strategy)) throw corrupt(id, `unknown strategy '${strategy}'`)\n  if (!STATUSES.includes(status)) throw corrupt(id, `unknown status '${status}'`)\n  const principalType = text(row.ownerPrincipalType, \"ownerPrincipalType\", id)\n  if (!PRINCIPAL_TYPES.includes(principalType as Principal[\"type\"])) {\n    throw corrupt(id, `unknown owner principal type '${principalType}'`)\n  }\n\n  const providerUpload = json(row.providerUpload)\n  const fileRef = json(row.fileRef)\n  const signedParts = json(row.signedParts)\n  if (!Array.isArray(signedParts)) throw corrupt(id, \"signedParts is not an array\")\n\n  const optional = <T>(key: string, value: T | null | undefined) =>\n    value === null || value === undefined ? {} : { [key]: value }\n\n  return {\n    id,\n    projectId: text(row.projectId, \"projectId\", id),\n    principal: {\n      type: principalType as Principal[\"type\"],\n      id: text(row.ownerPrincipalId, \"ownerPrincipalId\", id),\n    },\n    strategy,\n    status,\n    ...optional(\"fileName\", row.fileName as string | null),\n    ...optional(\"mediaType\", row.mediaType as string | null),\n    ...optional(\"logicalPath\", row.logicalPath as string | null),\n    ...optional(\n      \"expectedSizeBytes\",\n      row.expectedSizeBytes === null || row.expectedSizeBytes === undefined\n        ? null\n        : Number(row.expectedSizeBytes)\n    ),\n    ...optional(\"expectedDigest\", row.expectedDigest as string | null),\n    ...optional(\n      \"providerUpload\",\n      providerUpload === null ? null : withExpiresAt(providerUpload, id)\n    ),\n    signedParts: signedParts.map((part) => withExpiresAt(part, id)) as SignedBlobUploadPart[],\n    ...optional(\"fileRef\", fileRef as FileRef | null),\n    createdAt: date(row.createdAt, \"createdAt\", id),\n    expiresAt: date(row.expiresAt, \"expiresAt\", id),\n    ...optional(\n      \"completedAt\",\n      row.completedAt == null ? null : date(row.completedAt, \"completedAt\", id)\n    ),\n    ...optional(\"abortedAt\", row.abortedAt == null ? null : date(row.abortedAt, \"abortedAt\", id)),\n  } as FileUploadSession\n}\n\nfunction json(value: unknown): unknown {\n  return typeof value === \"string\" ? JSON.parse(value) : (value ?? null)\n}\n\nfunction withExpiresAt<T>(value: unknown, id: string): T {\n  if (typeof value !== \"object\" || value === null)\n    throw corrupt(id, \"nested record is not an object\")\n  const record = value as Record<string, unknown>\n  return { ...record, expiresAt: date(record.expiresAt, \"nested expiresAt\", id) } as T\n}\n\nfunction text(value: unknown, column: string, id: string): string {\n  if (typeof value !== \"string\" || value.length === 0) throw corrupt(id, `${column} is not text`)\n  return value\n}\n\nfunction date(value: unknown, column: string, id: string): Date {\n  const parsed = value instanceof Date || typeof value === \"string\" ? new Date(value) : null\n  if (!parsed || !Number.isFinite(parsed.getTime())) throw corrupt(id, `${column} is not a date`)\n  return parsed\n}\n\nfunction corrupt(id: string, reason: string): Error {\n  return new Error(`[Sixb] Stored file upload session '${id}' is invalid: ${reason}.`)\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;AAcO,MAAM,gCAA+B,MAAM;AAAA,EAIrC;AAAA,EAHF,OAAO;AAAA,EAEhB,WAAW,CACA,QACT,SACA;AAAA,IACA,MAAM,OAAO;AAAA,IAHJ;AAAA;AAKb;;;ACwBO,MAAM,2BAA4D;AAAA,EAC1C;AAAA,EAA7B,WAAW,CAAkB,SAA8C;AAAA,IAA9C;AAAA;AAAA,OAEvB,OAAM,CAAC,OAAiE;AAAA,IAC5E,OAAO,KAAK,QAAQ,YAAY,OAAO,gBAAgB;AAAA,MACrD,MAAM,UAA6B;AAAA,QACjC,IAAI,MAAM,MAAM,oBAAmB;AAAA,QACnC,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,UAAU,MAAM;AAAA,QAChB,QAAQ;AAAA,WACJ,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,WAC/D,MAAM,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,MAAM,UAAU;AAAA,WAClE,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,WACxE,MAAM,sBAAsB,YAC5B,CAAC,IACD,EAAE,mBAAmB,MAAM,kBAAkB;AAAA,WAC7C,MAAM,mBAAmB,YAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,eAAe;AAAA,WACjF,MAAM,mBAAmB,YAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,eAAe;AAAA,QACrF,aAAa,CAAC;AAAA,QACd,WAAW,MAAM,YAAY,IAAI;AAAA,QACjC,WAAW,MAAM;AAAA,MACnB;AAAA,MAEA,IAAI,CAAE,MAAM,YAAY,OAAO,OAAO,GAAI;AAAA,QACxC,MAAM,IAAI,MAAM,+BAA+B,QAAQ,qBAAqB;AAAA,MAC9E;AAAA,MACA,OAAO;AAAA,KACR;AAAA;AAAA,OAGG,gBAAe,CAAC,UAAkB,WAAkD;AAAA,IACxF,OAAO,KAAK,QAAQ,KAAK,OAAO,gBAAgB;AAAA,MAC9C,MAAM,UAAU,MAAM,YAAY,IAAI,QAAQ;AAAA,MAC9C,IAAI,CAAC,WAAW,CAAC,iBAAgB,QAAQ,WAAW,SAAS,GAAG;AAAA,QAC9D,MAAM,IAAI,wBAAuB,aAAa,gCAAgC;AAAA,MAChF;AAAA,MAEA,MAAM,SAAS,MAAM,YAAY,IAAI,GAAG,QAAQ;AAAA,MAChD,IAAI,2BAA2B,SAAS,KAAK,GAAG;AAAA,QAC9C,MAAM,IAAI,wBAAuB,WAAW,kCAAkC;AAAA,MAChF;AAAA,MACA,IAAI,mCAAmC,SAAS,KAAK,GAAG;AAAA,QACtD,MAAM,IAAI,wBAAuB,aAAa,gCAAgC;AAAA,MAChF;AAAA,MACA,OAAO;AAAA,KACR;AAAA;AAAA,OAGG,aAAY,CAAC,UAAkB,SAA8C;AAAA,IACjF,OAAO,KAAK,WAAW,UAAU,CAAC,aAAa,KAAK,SAAS,QAAQ,EAAE;AAAA;AAAA,OAGnE,cAAa,CAAC,UAAkB,MAAwD;AAAA,IAC5F,OAAO,KAAK,WAAW,UAAU,CAAC,aAAa;AAAA,SAC1C;AAAA,MACH,aAAa;AAAA,QACX,GAAG,QAAQ,YAAY,OAAO,CAAC,cAAc,UAAU,eAAe,KAAK,UAAU;AAAA,QACrF;AAAA,MACF,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,aAAa,MAAM,UAAU;AAAA,IAC5D,EAAE;AAAA;AAAA,OAGE,SAAQ,CAAC,UAAkB,SAA8C;AAAA,IAC7E,OAAO,KAAK,WAAW,UAAU,CAAC,SAAS,SAAS;AAAA,SAC/C;AAAA,MACH,QAAQ;AAAA,MACR;AAAA,MACA,aAAa;AAAA,IACf,EAAE;AAAA;AAAA,OAGE,MAAK,CAAC,UAA8C;AAAA,IACxD,OAAO,KAAK,WAAW,UAAU,CAAC,SAAS,SAAS;AAAA,SAC/C;AAAA,MACH,QAAQ;AAAA,MACR,WAAW;AAAA,IACb,EAAE;AAAA;AAAA,OAGE,cAAa,CACjB,OACuC;AAAA,IACvC,IAAI,MAAM,UAAU,KAAK,EAAE,WAAW,GAAG;AAAA,MACvC,MAAM,IAAI,MAAM,uEAAuE;AAAA,IACzF;AAAA,IACA,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,KAAK,MAAM,SAAS,GAAG;AAAA,MAC1D,MAAM,IAAI,MAAM,4EAA4E;AAAA,IAC9F;AAAA,IACA,OAAO,KAAK,QAAQ,KAAK,CAAC,gBAAgB,YAAY,cAAc,KAAK,CAAC;AAAA;AAAA,OAGtE,eAAc,CAAC,KAA6B;AAAA,IAChD,OAAO,KAAK,QAAQ,YAAY,OAAO,gBACrC,YAAY,eAAe,OAAQ,MAAM,YAAY,IAAI,CAAE,CAC7D;AAAA;AAAA,EAGM,UAAU,CAChB,UACA,MAC4B;AAAA,IAC5B,OAAO,KAAK,QAAQ,YAAY,OAAO,gBAAgB;AAAA,MACrD,MAAM,UAAU,MAAM,YAAY,IAAI,QAAQ;AAAA,MAC9C,IAAI,CAAC,SAAS;AAAA,QACZ,MAAM,IAAI,wBAAuB,aAAa,gCAAgC;AAAA,MAChF;AAAA,MACA,IAAI,QAAQ,WAAW,WAAW;AAAA,QAChC,MAAM,IAAI,wBACR,QAAQ,WAAW,cAAc,sBAAsB,mBACvD,kCAAkC,QAAQ,SAC5C;AAAA,MACF;AAAA,MAEA,MAAM,UAAU,KAAK,SAAS,MAAM,YAAY,IAAI,CAAC;AAAA,MACrD,MAAM,YAAY,OAAO,OAAO;AAAA,MAChC,OAAO;AAAA,KACR;AAAA;AAEL;AAEA,IAAM,aAA4C,CAAC,UAAU,cAAc,WAAW;AACtF,IAAM,WAAwC,CAAC,WAAW,aAAa,SAAS;AAChF,IAAM,kBAAgD,CAAC,QAAQ,kBAAkB,QAAQ;AAOlF,SAAS,0BAAyB,CAAC,KAEpB;AAAA,EACpB,MAAM,KAAK,KAAK,IAAI,IAAI,MAAM,OAAO,IAAI,EAAE,CAAC;AAAA,EAC5C,MAAM,WAAW,KAAK,IAAI,UAAU,YAAY,EAAE;AAAA,EAClD,MAAM,SAAS,KAAK,IAAI,QAAQ,UAAU,EAAE;AAAA,EAC5C,IAAI,CAAC,WAAW,SAAS,QAAQ;AAAA,IAAG,MAAM,QAAQ,IAAI,qBAAqB,WAAW;AAAA,EACtF,IAAI,CAAC,SAAS,SAAS,MAAM;AAAA,IAAG,MAAM,QAAQ,IAAI,mBAAmB,SAAS;AAAA,EAC9E,MAAM,gBAAgB,KAAK,IAAI,oBAAoB,sBAAsB,EAAE;AAAA,EAC3E,IAAI,CAAC,gBAAgB,SAAS,aAAkC,GAAG;AAAA,IACjE,MAAM,QAAQ,IAAI,iCAAiC,gBAAgB;AAAA,EACrE;AAAA,EAEA,MAAM,iBAAiB,KAAK,IAAI,cAAc;AAAA,EAC9C,MAAM,UAAU,KAAK,IAAI,OAAO;AAAA,EAChC,MAAM,cAAc,KAAK,IAAI,WAAW;AAAA,EACxC,IAAI,CAAC,MAAM,QAAQ,WAAW;AAAA,IAAG,MAAM,QAAQ,IAAI,6BAA6B;AAAA,EAEhF,MAAM,WAAW,CAAI,KAAa,UAChC,UAAU,QAAQ,UAAU,YAAY,CAAC,IAAI,GAAG,MAAM,MAAM;AAAA,EAE9D,OAAO;AAAA,IACL;AAAA,IACA,WAAW,KAAK,IAAI,WAAW,aAAa,EAAE;AAAA,IAC9C,WAAW;AAAA,MACT,MAAM;AAAA,MACN,IAAI,KAAK,IAAI,kBAAkB,oBAAoB,EAAE;AAAA,IACvD;AAAA,IACA;AAAA,IACA;AAAA,OACG,SAAS,YAAY,IAAI,QAAyB;AAAA,OAClD,SAAS,aAAa,IAAI,SAA0B;AAAA,OACpD,SAAS,eAAe,IAAI,WAA4B;AAAA,OACxD,SACD,qBACA,IAAI,sBAAsB,QAAQ,IAAI,sBAAsB,YACxD,OACA,OAAO,IAAI,iBAAiB,CAClC;AAAA,OACG,SAAS,kBAAkB,IAAI,cAA+B;AAAA,OAC9D,SACD,kBACA,mBAAmB,OAAO,OAAO,cAAc,gBAAgB,EAAE,CACnE;AAAA,IACA,aAAa,YAAY,IAAI,CAAC,SAAS,cAAc,MAAM,EAAE,CAAC;AAAA,OAC3D,SAAS,WAAW,OAAyB;AAAA,IAChD,WAAW,KAAK,IAAI,WAAW,aAAa,EAAE;AAAA,IAC9C,WAAW,KAAK,IAAI,WAAW,aAAa,EAAE;AAAA,OAC3C,SACD,eACA,IAAI,eAAe,OAAO,OAAO,KAAK,IAAI,aAAa,eAAe,EAAE,CAC1E;AAAA,OACG,SAAS,aAAa,IAAI,aAAa,OAAO,OAAO,KAAK,IAAI,WAAW,aAAa,EAAE,CAAC;AAAA,EAC9F;AAAA;AAGF,SAAS,IAAI,CAAC,OAAyB;AAAA,EACrC,OAAO,OAAO,UAAU,WAAW,KAAK,MAAM,KAAK,IAAK,SAAS;AAAA;AAGnE,SAAS,aAAgB,CAAC,OAAgB,IAAe;AAAA,EACvD,IAAI,OAAO,UAAU,YAAY,UAAU;AAAA,IACzC,MAAM,QAAQ,IAAI,gCAAgC;AAAA,EACpD,MAAM,SAAS;AAAA,EACf,OAAO,KAAK,QAAQ,WAAW,KAAK,OAAO,WAAW,oBAAoB,EAAE,EAAE;AAAA;AAGhF,SAAS,IAAI,CAAC,OAAgB,QAAgB,IAAoB;AAAA,EAChE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW;AAAA,IAAG,MAAM,QAAQ,IAAI,GAAG,oBAAoB;AAAA,EAC9F,OAAO;AAAA;AAGT,SAAS,IAAI,CAAC,OAAgB,QAAgB,IAAkB;AAAA,EAC9D,MAAM,SAAS,iBAAiB,QAAQ,OAAO,UAAU,WAAW,IAAI,KAAK,KAAK,IAAI;AAAA,EACtF,IAAI,CAAC,UAAU,CAAC,OAAO,SAAS,OAAO,QAAQ,CAAC;AAAA,IAAG,MAAM,QAAQ,IAAI,GAAG,sBAAsB;AAAA,EAC9F,OAAO;AAAA;AAGT,SAAS,OAAO,CAAC,IAAY,QAAuB;AAAA,EAClD,OAAO,IAAI,MAAM,sCAAsC,mBAAmB,SAAS;AAAA;",
+  "debugId": "612366C739B9FA8F64756E2164756E21",
+  "names": []
+}