@sixb/core 0.1.13 → 0.1.15

package/dist/testing/ontology-storage-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ontology-storage-contract.d.ts","sourceRoot":"","sources":["../../src/testing/ontology-storage-contract.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EAOL,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAA;AAGpC,MAAM,WAAW,8BAA+B,SAAQ,uBAAuB;IAC7E,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;CAC9C;AAED,MAAM,WAAW,mCAAmC,CAClD,QAAQ,SAAS,8BAA8B,GAAG,8BAA8B;IAEhF,4FAA4F;IAC5F,QAAQ,CAAC,aAAa,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1D,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5D,kFAAkF;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/D;AAkDD;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,SAAS,8BAA8B,EAC7F,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mCAAmC,CAAC,QAAQ,CAAC,GACrD,IAAI,CA+vBN"}
+{"version":3,"file":"ontology-storage-contract.d.ts","sourceRoot":"","sources":["../../src/testing/ontology-storage-contract.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EAOL,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAA;AAGpC,MAAM,WAAW,8BAA+B,SAAQ,uBAAuB;IAC7E,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;CAC9C;AAED,MAAM,WAAW,mCAAmC,CAClD,QAAQ,SAAS,8BAA8B,GAAG,8BAA8B;IAEhF,4FAA4F;IAC5F,QAAQ,CAAC,aAAa,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1D,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5D,kFAAkF;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/D;AAkDD;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,SAAS,8BAA8B,EAC7F,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,mCAAmC,CAAC,QAAQ,CAAC,GACrD,IAAI,CA63BN"}

package/dist/testing/projection-run-storage-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projection-run-storage-contract.d.ts","sourceRoot":"","sources":["../../src/testing/projection-run-storage-contract.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAGV,oBAAoB,EAGrB,MAAM,4BAA4B,CAAA;AAEnC,MAAM,WAAW,mCAAmC,CAClD,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB;IAE5D,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;CACtC;AAED,MAAM,WAAW,wCAAwC,CACvD,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB;IAE5D,wFAAwF;IACxF,QAAQ,CAAC,aAAa,EAAE,MACpB,mCAAmC,CAAC,QAAQ,CAAC,GAC7C,OAAO,CAAC,mCAAmC,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,mCAAmC,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjG,QAAQ,CAAC,OAAO,CAAC,EAAE,CACjB,OAAO,EAAE,mCAAmC,CAAC,QAAQ,CAAC,KACnD,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1B;AAyCD,mFAAmF;AACnF,wBAAgB,oCAAoC,CAAC,QAAQ,SAAS,oBAAoB,EACxF,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wCAAwC,CAAC,QAAQ,CAAC,GAC1D,IAAI,CA0dN"}
+{"version":3,"file":"projection-run-storage-contract.d.ts","sourceRoot":"","sources":["../../src/testing/projection-run-storage-contract.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAGV,oBAAoB,EAGrB,MAAM,4BAA4B,CAAA;AAEnC,MAAM,WAAW,mCAAmC,CAClD,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB;IAE5D,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;CACtC;AAED,MAAM,WAAW,wCAAwC,CACvD,QAAQ,SAAS,oBAAoB,GAAG,oBAAoB;IAE5D,wFAAwF;IACxF,QAAQ,CAAC,aAAa,EAAE,MACpB,mCAAmC,CAAC,QAAQ,CAAC,GAC7C,OAAO,CAAC,mCAAmC,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,mCAAmC,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjG,QAAQ,CAAC,OAAO,CAAC,EAAE,CACjB,OAAO,EAAE,mCAAmC,CAAC,QAAQ,CAAC,KACnD,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1B;AAgDD,mFAAmF;AACnF,wBAAgB,oCAAoC,CAAC,QAAQ,SAAS,oBAAoB,EACxF,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wCAAwC,CAAC,QAAQ,CAAC,GAC1D,IAAI,CAomBN"}

package/dist/webhooks/internal.js

@@ -1,18 +1,18 @@
 // @bun
-import"../chunk-rzkr70gr.js";
+import"../chunk-6fsr7y93.js";
 import"../chunk-z3y5kg1x.js";
-import"../chunk-rzcjp5m2.js";
+import"../chunk-8fjmqjyx.js";
 import"../chunk-v4jbb3rs.js";
 import"../chunk-d8yes9yx.js";
 import {
   createConnectorCodedError,
   getConnectorExecutionSourceResolver
-} from "../chunk-cbn96bve.js";
-import"../chunk-xgptywp0.js";
+} from "../chunk-r5sc1d2b.js";
+import"../chunk-y2aq6ag9.js";
 import"../chunk-fc5zfxy1.js";
-import"../chunk-9pfw47qx.js";
+import"../chunk-qne45xqq.js";
 import"../chunk-drz59ve0.js";
-import"../chunk-0321g649.js";
+import"../chunk-2jntasmh.js";
 import"../chunk-pqajwytd.js";
 import"../chunk-ky7zpbtt.js";
 import"../chunk-gfdh9kqa.js";
@@ -21,36 +21,36 @@ import"../chunk-69266efg.js";
 import"../chunk-xnx96gfy.js";
 import"../chunk-jgwb25gc.js";
 import"../chunk-h89wz928.js";
-import"../chunk-n33e8dz8.js";
+import"../chunk-p0nbkys4.js";
 import {
   ExecutionStorageError2
 } from "../chunk-tw03bsmb.js";
 import"../chunk-3nx8vj5a.js";
-import"../chunk-ht4a7mjg.js";
+import"../chunk-g4rbm4a6.js";
 import {
   canRetryWebhookRun2
-} from "../chunk-gc226ten.js";
+} from "../chunk-fjw417jf.js";
 import"../chunk-7ytf06d3.js";
 import"../chunk-mr60an99.js";
 import"../chunk-mmagke4x.js";
-import"../chunk-qma80ych.js";
-import"../chunk-znw0zvy4.js";
+import"../chunk-hn2r7z41.js";
+import"../chunk-4wn7bxxa.js";
 import"../chunk-jmfet9r4.js";
 import {
   WebhookRunError2
 } from "../chunk-qf954wje.js";
-import"../chunk-darm7eeg.js";
+import"../chunk-xr7y35yj.js";
 import {
   isOAuthConnectorDefinition2,
   isStaticConnectorDefinition2
 } from "../chunk-9x8dybsb.js";
 import {
   createPrimitiveExecutionRecord
-} from "../chunk-m8zkvep1.js";
+} from "../chunk-8w27xf9e.js";
+import"../chunk-br3k6qbf.js";
 import {
   isStorageSerializationFailure2
 } from "../chunk-zdkcdshk.js";
-import"../chunk-br3k6qbf.js";
 import"../chunk-s3csryxe.js";
 import"../chunk-2fv8sajb.js";
 // src/webhooks/connections.ts
@@ -195,4 +195,4 @@ export {
   isStaticConnectorDefinition2 as isStaticConnectorDefinition
 };
 
-//# debugId=527D07AF48367BAF64756E2164756E21
+//# debugId=1B87474FA26986F164756E2164756E21

package/dist/webhooks/internal.js.map

@@ -6,6 +6,6 @@
     "import { randomUUID } from \"node:crypto\"\nimport { createPrimitiveExecutionRecord } from \"../execution/durable\"\nimport type { ExecutionRecord, Storage, WebhookRunRecord } from \"../storage\"\nimport {\n  canRetryWebhookRun,\n  ExecutionStorageError,\n  isStorageSerializationFailure,\n  WebhookRunError,\n} from \"../storage\"\n\nconst MAX_ADMISSION_ATTEMPTS = 3\n\nexport interface AdmitWebhookRunInput {\n  readonly projectId: string\n  readonly storage: Storage\n  readonly runId: string\n  readonly connectorId: string\n  readonly webhookId: string\n  readonly method: string\n  readonly route: string\n  readonly requestBodyBytes: number\n  readonly requestBodySha256: string\n  readonly idempotencyKey?: string\n}\n\nexport type AdmitWebhookRunResult =\n  | {\n      readonly status: \"admitted\"\n      readonly run: WebhookRunRecord\n      readonly execution: ExecutionRecord\n      readonly retried: boolean\n    }\n  | {\n      readonly status: \"duplicate\" | \"in_progress\"\n      readonly run: WebhookRunRecord\n    }\n\n/** Persist or reclaim one verified Webhook delivery before its protected handler executes. */\nexport async function admitWebhookRun(input: AdmitWebhookRunInput): Promise<AdmitWebhookRunResult> {\n  assertAdmissionInput(input)\n  let attempt = 0\n\n  // Concurrent deliveries may both observe no run before one transaction commits. Retry only\n  // serialization and uniqueness races so the loser can reload the winning run; every other error\n  // fails immediately, and repeated contention remains bounded by MAX_ADMISSION_ATTEMPTS.\n  while (true) {\n    attempt += 1\n    try {\n      return await input.storage.transaction((tx) => admitWebhookRunTransaction(tx, input), {\n        isolation: \"serializable\",\n      })\n    } catch (error) {\n      if (attempt >= MAX_ADMISSION_ATTEMPTS || !isConcurrentAdmissionConflict(error)) {\n        throw error\n      }\n    }\n  }\n}\n\nasync function admitWebhookRunTransaction(\n  storage: Storage,\n  input: AdmitWebhookRunInput\n): Promise<AdmitWebhookRunResult> {\n  const runs = requireWebhookRunStorage(storage)\n  const existing = input.idempotencyKey\n    ? await runs.getByDelivery({\n        projectId: input.projectId,\n        connectorId: input.connectorId,\n        webhookId: input.webhookId,\n        idempotencyKey: input.idempotencyKey,\n      })\n    : null\n\n  if (existing) {\n    assertSameDelivery(existing, input)\n    if (existing.status === \"running\") return { status: \"in_progress\", run: existing }\n    if (!canRetryWebhookRun(existing)) return { status: \"duplicate\", run: existing }\n\n    const execution = await requireWebhookExecution(storage, existing)\n    const run = await runs.restart({\n      projectId: input.projectId,\n      id: existing.id,\n    })\n    return { status: \"admitted\", run, execution, retried: true }\n  }\n\n  const executionInput = createPrimitiveExecutionRecord({\n    id: `exec_${randomUUID()}`,\n    primitive: { kind: \"webhook\", id: input.route, runId: input.runId },\n    origin: {\n      type: \"automatic\",\n      projectId: input.projectId,\n      source: { type: \"webhook\", deliveryId: input.runId },\n      correlationId: input.runId,\n    },\n  })\n  const execution = await storage.executions.create(executionInput)\n  const run = await runs.start({\n    id: input.runId,\n    projectId: input.projectId,\n    executionId: execution.id,\n    connectorId: input.connectorId,\n    webhookId: input.webhookId,\n    method: input.method,\n    route: input.route,\n    requestBodyBytes: input.requestBodyBytes,\n    requestBodySha256: input.requestBodySha256,\n    idempotencyKey: input.idempotencyKey,\n  })\n  return { status: \"admitted\", run, execution, retried: false }\n}\n\nfunction assertSameDelivery(existing: WebhookRunRecord, input: AdmitWebhookRunInput): void {\n  if (\n    existing.connectorId !== input.connectorId ||\n    existing.webhookId !== input.webhookId ||\n    existing.method !== input.method ||\n    existing.route !== input.route ||\n    existing.requestBodyBytes !== input.requestBodyBytes ||\n    existing.requestBodySha256 !== input.requestBodySha256\n  ) {\n    throw new WebhookRunError(\n      `[Sixb] Webhook delivery '${input.idempotencyKey}' conflicts with run '${existing.id}'.`,\n      \"delivery_conflict\"\n    )\n  }\n}\n\nasync function requireWebhookExecution(\n  storage: Storage,\n  run: WebhookRunRecord\n): Promise<ExecutionRecord> {\n  const execution = await storage.executions.getById({\n    projectId: run.projectId,\n    id: run.executionId,\n  })\n  if (!execution) {\n    throw new WebhookRunError(\n      `[Sixb] Execution '${run.executionId}' for Webhook run '${run.id}' was not found.`,\n      \"invalid_execution\"\n    )\n  }\n  return execution\n}\n\nfunction requireWebhookRunStorage(storage: Storage): NonNullable<Storage[\"webhookRuns\"]> {\n  if (!storage.webhookRuns) {\n    throw new WebhookRunError(\"[Sixb] Webhook run storage is not configured.\")\n  }\n  return storage.webhookRuns\n}\n\nfunction assertAdmissionInput(input: AdmitWebhookRunInput): void {\n  if (input.idempotencyKey !== undefined && !input.idempotencyKey.trim()) {\n    throw new WebhookRunError(\"[Sixb] Webhook idempotency key must not be empty.\")\n  }\n  if (!Number.isSafeInteger(input.requestBodyBytes) || input.requestBodyBytes < 0) {\n    throw new WebhookRunError(\"[Sixb] Webhook request body bytes must be a non-negative integer.\")\n  }\n  if (!/^[a-f0-9]{64}$/.test(input.requestBodySha256)) {\n    throw new WebhookRunError(\"[Sixb] Webhook request body SHA-256 must be lowercase hexadecimal.\")\n  }\n}\n\nfunction isConcurrentAdmissionConflict(error: unknown): boolean {\n  return (\n    isStorageSerializationFailure(error) ||\n    (error instanceof ExecutionStorageError && error.code === \"duplicate_execution\") ||\n    (error instanceof WebhookRunError &&\n      (error.code === \"duplicate_run\" || error.code === \"invalid_transition\"))\n  )\n}\n"
   ],
   "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMO,SAAS,wBAAwB,CACtC,SACA,YACoB;AAAA,EACpB,OAAO;AAAA,SACC,WAAU,CAAC,WAAW;AAAA,MAC1B,IAAI,CAAC,4BAA2B,UAAU,GAAG;AAAA,QAC3C,MAAM,0BACJ,mCACA,sEACF;AAAA,MACF;AAAA,MACA,IAAI,OAAO,cAAc,YAAY,CAAC,UAAU,KAAK,GAAG;AAAA,QACtD,MAAM,0BACJ,mCACA,gDACF;AAAA,MACF;AAAA,MACA,MAAM,WAAW,oCAAoC,OAAO;AAAA,MAC5D,MAAM,UAAU,MAAM,SAAS,KAAK,UAAU;AAAA,MAC9C,OAAO,QAAQ,QAAQ,CAAC,WAAW;AAAA,QACjC,MAAM,aAAa,OAAO;AAAA,QAC1B,IAAI,CAAC,cAAc,WAAW,QAAQ,OAAO;AAAA,UAAW,OAAO,CAAC;AAAA,QAChE,MAAM,eAAe,WAAW;AAAA,QAChC,IAAI;AAAA,QACJ,OAAO;AAAA,UACL;AAAA,YACE;AAAA,YACA,MAAM,GAAG;AAAA,cACP,mBAAmB,YAAY;AAAA,gBAC7B,MAAM,WAAW,MAAM,SAAS,KAAK,UAAU,GAAG,KAChD,CAAC,cACC,UAAU,YAAY,OAAO,gBAC7B,UAAU,WAAW,QAAQ,OAAO,SACxC;AAAA,gBACA,IAAI,CAAC;AAAA,kBACH,MAAM,0BACJ,uBACA,0DACF;AAAA,gBACF,OAAO,QAAQ,QAAQ,IAAI,gBAAgB,EAAE,MAAM;AAAA,iBAClD;AAAA,cACH,OAAO;AAAA;AAAA,UAEX;AAAA,QACF;AAAA,OACD;AAAA;AAAA,EAEL;AAAA;;ACtDF;AAUA,IAAM,yBAAyB;AA4B/B,eAAsB,eAAe,CAAC,OAA6D;AAAA,EACjG,qBAAqB,KAAK;AAAA,EAC1B,IAAI,UAAU;AAAA,EAKd,OAAO,MAAM;AAAA,IACX,WAAW;AAAA,IACX,IAAI;AAAA,MACF,OAAO,MAAM,MAAM,QAAQ,YAAY,CAAC,OAAO,2BAA2B,IAAI,KAAK,GAAG;AAAA,QACpF,WAAW;AAAA,MACb,CAAC;AAAA,MACD,OAAO,OAAO;AAAA,MACd,IAAI,WAAW,0BAA0B,CAAC,8BAA8B,KAAK,GAAG;AAAA,QAC9E,MAAM;AAAA,MACR;AAAA;AAAA,EAEJ;AAAA;AAGF,eAAe,0BAA0B,CACvC,SACA,OACgC;AAAA,EAChC,MAAM,OAAO,yBAAyB,OAAO;AAAA,EAC7C,MAAM,WAAW,MAAM,iBACnB,MAAM,KAAK,cAAc;AAAA,IACvB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,gBAAgB,MAAM;AAAA,EACxB,CAAC,IACD;AAAA,EAEJ,IAAI,UAAU;AAAA,IACZ,mBAAmB,UAAU,KAAK;AAAA,IAClC,IAAI,SAAS,WAAW;AAAA,MAAW,OAAO,EAAE,QAAQ,eAAe,KAAK,SAAS;AAAA,IACjF,IAAI,CAAC,oBAAmB,QAAQ;AAAA,MAAG,OAAO,EAAE,QAAQ,aAAa,KAAK,SAAS;AAAA,IAE/E,MAAM,YAAY,MAAM,wBAAwB,SAAS,QAAQ;AAAA,IACjE,MAAM,MAAM,MAAM,KAAK,QAAQ;AAAA,MAC7B,WAAW,MAAM;AAAA,MACjB,IAAI,SAAS;AAAA,IACf,CAAC;AAAA,IACD,OAAO,EAAE,QAAQ,YAAY,KAAK,WAAW,SAAS,KAAK;AAAA,EAC7D;AAAA,EAEA,MAAM,iBAAiB,+BAA+B;AAAA,IACpD,IAAI,QAAQ,WAAW;AAAA,IACvB,WAAW,EAAE,MAAM,WAAW,IAAI,MAAM,OAAO,OAAO,MAAM,MAAM;AAAA,IAClE,QAAQ;AAAA,MACN,MAAM;AAAA,MACN,WAAW,MAAM;AAAA,MACjB,QAAQ,EAAE,MAAM,WAAW,YAAY,MAAM,MAAM;AAAA,MACnD,eAAe,MAAM;AAAA,IACvB;AAAA,EACF,CAAC;AAAA,EACD,MAAM,YAAY,MAAM,QAAQ,WAAW,OAAO,cAAc;AAAA,EAChE,MAAM,MAAM,MAAM,KAAK,MAAM;AAAA,IAC3B,IAAI,MAAM;AAAA,IACV,WAAW,MAAM;AAAA,IACjB,aAAa,UAAU;AAAA,IACvB,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,IACb,kBAAkB,MAAM;AAAA,IACxB,mBAAmB,MAAM;AAAA,IACzB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AAAA,EACD,OAAO,EAAE,QAAQ,YAAY,KAAK,WAAW,SAAS,MAAM;AAAA;AAG9D,SAAS,kBAAkB,CAAC,UAA4B,OAAmC;AAAA,EACzF,IACE,SAAS,gBAAgB,MAAM,eAC/B,SAAS,cAAc,MAAM,aAC7B,SAAS,WAAW,MAAM,UAC1B,SAAS,UAAU,MAAM,SACzB,SAAS,qBAAqB,MAAM,oBACpC,SAAS,sBAAsB,MAAM,mBACrC;AAAA,IACA,MAAM,IAAI,iBACR,4BAA4B,MAAM,uCAAuC,SAAS,QAClF,mBACF;AAAA,EACF;AAAA;AAGF,eAAe,uBAAuB,CACpC,SACA,KAC0B;AAAA,EAC1B,MAAM,YAAY,MAAM,QAAQ,WAAW,QAAQ;AAAA,IACjD,WAAW,IAAI;AAAA,IACf,IAAI,IAAI;AAAA,EACV,CAAC;AAAA,EACD,IAAI,CAAC,WAAW;AAAA,IACd,MAAM,IAAI,iBACR,qBAAqB,IAAI,iCAAiC,IAAI,sBAC9D,mBACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,wBAAwB,CAAC,SAAuD;AAAA,EACvF,IAAI,CAAC,QAAQ,aAAa;AAAA,IACxB,MAAM,IAAI,iBAAgB,+CAA+C;AAAA,EAC3E;AAAA,EACA,OAAO,QAAQ;AAAA;AAGjB,SAAS,oBAAoB,CAAC,OAAmC;AAAA,EAC/D,IAAI,MAAM,mBAAmB,aAAa,CAAC,MAAM,eAAe,KAAK,GAAG;AAAA,IACtE,MAAM,IAAI,iBAAgB,mDAAmD;AAAA,EAC/E;AAAA,EACA,IAAI,CAAC,OAAO,cAAc,MAAM,gBAAgB,KAAK,MAAM,mBAAmB,GAAG;AAAA,IAC/E,MAAM,IAAI,iBAAgB,mEAAmE;AAAA,EAC/F;AAAA,EACA,IAAI,CAAC,iBAAiB,KAAK,MAAM,iBAAiB,GAAG;AAAA,IACnD,MAAM,IAAI,iBAAgB,oEAAoE;AAAA,EAChG;AAAA;AAGF,SAAS,6BAA6B,CAAC,OAAyB;AAAA,EAC9D,OACE,+BAA8B,KAAK,KAClC,iBAAiB,0BAAyB,MAAM,SAAS,yBACzD,iBAAiB,qBACf,MAAM,SAAS,mBAAmB,MAAM,SAAS;AAAA;",
-  "debugId": "527D07AF48367BAF64756E2164756E21",
+  "debugId": "1B87474FA26986F164756E2164756E21",
   "names": []
 }

package/dist/workers/index.js

@@ -1,7 +1,7 @@
 // @bun
 import {
   captureSixbFailure2
-} from "../chunk-rzkr70gr.js";
+} from "../chunk-6fsr7y93.js";
 import"../chunk-z3y5kg1x.js";
 
 // src/workers/errors.ts

package/dist/workflows/index.js

@@ -8,7 +8,7 @@ import {
   defineWorkflow2,
   createWorkflowNodeFailure2,
   unwrapWorkflowNodeFailure2
-} from "../chunk-s24qbp32.js";
+} from "../chunk-7jc21943.js";
 import"../chunk-e1c18xjx.js";
 import"../chunk-fb3feg1e.js";
 import"../chunk-dfm066qg.js";
@@ -45,67 +45,67 @@ import {
   snapshotWorkflowActionInput2,
   WorkflowRunDispatcher2,
   requestWorkflowRun2
-} from "../chunk-cvrbhvtr.js";
-import"../chunk-a69fkrtr.js";
-import"../chunk-cbn96bve.js";
-import"../chunk-bep5rrdq.js";
-import"../chunk-gmt22nxx.js";
-import"../chunk-91wthfwe.js";
-import"../chunk-85cd7e8c.js";
-import"../chunk-w9bp61e7.js";
+} from "../chunk-2tz5vnvz.js";
+import"../chunk-y0zmae99.js";
+import"../chunk-r5sc1d2b.js";
+import"../chunk-adbve9zt.js";
+import"../chunk-mmac1mp6.js";
 import"../chunk-bxx3ms5t.js";
-import"../chunk-04h4t2b5.js";
+import"../chunk-py2dw8cw.js";
 import"../chunk-f85hpqnm.js";
-import"../chunk-4tnrzqqh.js";
+import"../chunk-fj1dvp37.js";
+import"../chunk-4jph1t3v.js";
+import"../chunk-85cd7e8c.js";
+import"../chunk-n5t4mq6z.js";
 import"../chunk-5a4a52tq.js";
 import"../chunk-91kcnbf0.js";
 import"../chunk-rb143ggb.js";
 import"../chunk-cd234ba4.js";
-import"../chunk-693f3zn8.js";
-import"../chunk-63fp9x3q.js";
-import"../chunk-898y24dd.js";
-import"../chunk-rqtdtm43.js";
-import"../chunk-m8zkvep1.js";
-import"../chunk-gc226ten.js";
+import"../chunk-1jvq82rp.js";
+import"../chunk-wem5vqjw.js";
+import"../chunk-z708gemf.js";
+import"../chunk-3c90jvfj.js";
+import"../chunk-8w27xf9e.js";
+import"../chunk-fjw417jf.js";
+import"../chunk-br3k6qbf.js";
 import"../chunk-jmfet9r4.js";
 import"../chunk-qf954wje.js";
-import"../chunk-darm7eeg.js";
+import"../chunk-xr7y35yj.js";
+import"../chunk-tw03bsmb.js";
+import"../chunk-p0nbkys4.js";
 import"../chunk-zdkcdshk.js";
-import"../chunk-ht4a7mjg.js";
+import"../chunk-h89wz928.js";
+import"../chunk-g4rbm4a6.js";
 import"../chunk-mr60an99.js";
 import"../chunk-mmagke4x.js";
-import"../chunk-znw0zvy4.js";
-import"../chunk-qma80ych.js";
-import"../chunk-br3k6qbf.js";
+import"../chunk-4wn7bxxa.js";
+import"../chunk-hn2r7z41.js";
+import"../chunk-y2aq6ag9.js";
 import"../chunk-fc5zfxy1.js";
 import"../chunk-69266efg.js";
 import"../chunk-xnx96gfy.js";
 import"../chunk-s3csryxe.js";
 import"../chunk-jgwb25gc.js";
-import"../chunk-tw03bsmb.js";
-import"../chunk-n33e8dz8.js";
-import"../chunk-h89wz928.js";
-import"../chunk-xgptywp0.js";
 import"../chunk-ky7zpbtt.js";
 import"../chunk-pqajwytd.js";
 import"../chunk-3nx8vj5a.js";
 import"../chunk-7ytf06d3.js";
-import"../chunk-y6vnvayj.js";
-import"../chunk-bdhfn0ww.js";
+import"../chunk-wr8qp979.js";
+import"../chunk-vjcd8d27.js";
+import"../chunk-kkqwzy6h.js";
 import"../chunk-39tqv9hz.js";
 import"../chunk-gfdh9kqa.js";
-import"../chunk-wr8qp979.js";
 import"../chunk-dmn70ztd.js";
-import"../chunk-vn3yh259.js";
-import"../chunk-9pfw47qx.js";
+import"../chunk-4gmng3vf.js";
+import"../chunk-qne45xqq.js";
 import"../chunk-2fv8sajb.js";
 import"../chunk-drz59ve0.js";
-import"../chunk-rzcjp5m2.js";
+import"../chunk-8fjmqjyx.js";
 import"../chunk-v4jbb3rs.js";
 import"../chunk-d8yes9yx.js";
-import"../chunk-rzkr70gr.js";
+import"../chunk-6fsr7y93.js";
 import"../chunk-z3y5kg1x.js";
-import"../chunk-0321g649.js";
+import"../chunk-2jntasmh.js";
 export {
   WorkflowDefinitionError2 as WorkflowDefinitionError,
   WorkflowRunDispatcher2 as WorkflowRunDispatcher,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sixb/core",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "The ontology-first runtime for Sixb — objects, links, telemetry, actions, and provider contracts",
   "keywords": [
     "sixb",
@@ -65,6 +65,12 @@
       "import": "./dist/broker/index.js",
       "default": "./dist/broker/index.js"
     },
+    "./deploy": {
+      "types": "./dist/deploy/index.d.ts",
+      "bun": "./src/deploy/index.ts",
+      "import": "./dist/deploy/index.js",
+      "default": "./dist/deploy/index.js"
+    },
     "./events/selectors": {
       "types": "./dist/events/selectors/index.d.ts",
       "bun": "./src/events/selectors/index.ts",
@@ -185,6 +191,12 @@
       "import": "./dist/datasets/write.js",
       "default": "./dist/datasets/write.js"
     },
+    "./internal/deploy": {
+      "types": "./dist/deploy/internal.d.ts",
+      "bun": "./src/deploy/internal.ts",
+      "import": "./dist/deploy/internal.js",
+      "default": "./dist/deploy/internal.js"
+    },
     "./internal/edits": {
       "types": "./dist/edits/index.d.ts",
       "bun": "./src/edits/index.ts",

package/src/auth/errors.ts

@@ -17,3 +17,26 @@ export class AuthRuntimeError extends Error {
     super(message)
   }
 }
+
+/** Why a strategy refused someone who authenticated. Each is something a person can act on. */
+export type SignInRefusalReason =
+  | "not_invited"
+  | "suspended"
+  | "domain_not_allowed"
+  | "no_trusted_address"
+
+/**
+ * Thrown by a strategy that refuses a sign-in for a known reason. The sign-in page tells the
+ * person which reason, naming `email` when there is one; `message` is for the server log.
+ */
+export class SignInRefusedError extends Error {
+  readonly name = "SignInRefusedError"
+
+  constructor(
+    readonly reason: SignInRefusalReason,
+    message: string,
+    readonly email?: string
+  ) {
+    super(message)
+  }
+}

package/src/auth/index.ts

@@ -37,7 +37,7 @@ export {
   verifyDoubleSubmitCsrf,
 } from "./csrf"
 export type { AuthRuntimeErrorCode } from "./errors"
-export { AuthRuntimeError } from "./errors"
+export { AuthRuntimeError, SignInRefusedError } from "./errors"
 export type { AuthRuntimeOptions } from "./runtime"
 export {
   AuthRuntime,

package/src/auth/runtime.ts

@@ -19,6 +19,7 @@ import {
   type AuthStorage,
   AuthStorageError,
   type CompleteDeviceAuthorizationInput,
+  type GroupMembershipRecord,
   type InvitationRecord,
   type ServiceAccountGroupMembershipRecord,
   type ServiceAccountRecord,
@@ -991,9 +992,9 @@ export class AuthRuntime {
 
     const members: MemberSummary[] = []
     for (const user of result.users) {
-      const groupIds = (
+      const { groupIds, managedGroupIds } = memberGroups(
         await storage.groupMemberships.listForUser({ projectId: this.projectId, userId: user.id })
-      ).map((membership) => membership.groupId)
+      )
 
       // Visibility is scope-based: a member is listed when the caller can assign
       // groups or suspend over the member's current groups. This keeps out-of-scope
@@ -1008,6 +1009,7 @@ export class AuthRuntime {
       members.push({
         user,
         groupIds,
+        managedGroupIds,
         capabilities: {
           assignGroups: canAssignGroups,
           // A caller cannot suspend themselves; reactivation only applies to a
@@ -1033,12 +1035,11 @@ export class AuthRuntime {
     // The target must exist and every group it currently holds must be assignable
     // by the caller. Missing and out-of-scope targets raise the same error so a
     // caller cannot probe which users exist.
-    const { user, groupIds: currentGroupIds } = await this.requireManageableMember(
-      storage,
-      scope,
-      "assignGroups",
-      userId
-    )
+    const {
+      user,
+      groupIds: currentGroupIds,
+      managedGroupIds: currentManagedGroupIds,
+    } = await this.requireManageableMember(storage, scope, "assignGroups", userId)
 
     const requestedGroupIds = this.resolveMemberGroupIds(input.groupIds)
     // Every requested group must fall within the caller's assign scope.
@@ -1055,6 +1056,15 @@ export class AuthRuntime {
     const additions = requestedGroupIds.filter((groupId) => !current.has(groupId))
     const removals = currentGroupIds.filter((groupId) => !requested.has(groupId))
 
+    // The identity provider would restore these at the user's next sign-in.
+    const managedRemovals = removals.filter((groupId) => currentManagedGroupIds.includes(groupId))
+    if (managedRemovals.length > 0) {
+      throw new AuthRuntimeError(
+        "invalid_auth_input",
+        `[Sixb] Group(s) ${managedRemovals.join(", ")} are managed by the identity provider. Change them there; they sync at the user's next sign-in.`
+      )
+    }
+
     // Self-protection: a caller may add in-scope groups to themselves but may not
     // remove any of their own current groups, so they cannot lock themselves out.
     if (user.id === caller.user.id && removals.length > 0) {
@@ -1086,11 +1096,11 @@ export class AuthRuntime {
     // request resolves the updated membership.
     this.sessionCache?.invalidateUser(user.id)
 
-    const groupIds = (
+    const { groupIds, managedGroupIds } = memberGroups(
       await storage.groupMemberships.listForUser({ projectId: this.projectId, userId: user.id })
-    ).map((membership) => membership.groupId)
+    )
 
-    return { user, groupIds }
+    return { user, groupIds, managedGroupIds }
   }
 
   async suspendMember(
@@ -1100,7 +1110,12 @@ export class AuthRuntime {
     const storage = this.requireAuthStorage()
     const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds)
     const userId = assertNonEmpty(input.userId, "User id")
-    const { user, groupIds } = await this.requireManageableMember(storage, scope, "suspend", userId)
+    const { user, groupIds, managedGroupIds } = await this.requireManageableMember(
+      storage,
+      scope,
+      "suspend",
+      userId
+    )
 
     if (user.id === caller.user.id) {
       throw new AuthRuntimeError(
@@ -1118,7 +1133,7 @@ export class AuthRuntime {
     // user stops authenticating immediately.
     this.sessionCache?.invalidateUser(user.id)
 
-    return { user: suspended, groupIds }
+    return { user: suspended, groupIds, managedGroupIds }
   }
 
   async reactivateMember(
@@ -1128,7 +1143,12 @@ export class AuthRuntime {
     const storage = this.requireAuthStorage()
     const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds)
     const userId = assertNonEmpty(input.userId, "User id")
-    const { user, groupIds } = await this.requireManageableMember(storage, scope, "suspend", userId)
+    const { user, groupIds, managedGroupIds } = await this.requireManageableMember(
+      storage,
+      scope,
+      "suspend",
+      userId
+    )
 
     // Reactivation restores access but not sessions; the user signs in again.
     const reactivated = await storage.users.updateStatus({
@@ -1138,7 +1158,7 @@ export class AuthRuntime {
       updatedAt: new Date(),
     })
 
-    return { user: reactivated, groupIds }
+    return { user: reactivated, groupIds, managedGroupIds }
   }
 
   /** The caller's active sessions across every audience, most recently active first. */
@@ -1210,13 +1230,15 @@ export class AuthRuntime {
     scope: MembershipPolicyScope,
     operation: MembershipOperation,
     userId: string
-  ): Promise<{ readonly user: UserRecord; readonly groupIds: readonly string[] }> {
+  ): Promise<{
+    readonly user: UserRecord
+    readonly groupIds: readonly string[]
+    readonly managedGroupIds: readonly string[]
+  }> {
     const user = await storage.users.getById({ projectId: this.projectId, id: userId })
-    const groupIds = user
-      ? (await storage.groupMemberships.listForUser({ projectId: this.projectId, userId })).map(
-          (membership) => membership.groupId
-        )
-      : []
+    const { groupIds, managedGroupIds } = memberGroups(
+      user ? await storage.groupMemberships.listForUser({ projectId: this.projectId, userId }) : []
+    )
 
     if (!user || !canPerformMembershipOperation(scope, operation, groupIds)) {
       throw new AuthStorageError(
@@ -1225,7 +1247,7 @@ export class AuthRuntime {
       )
     }
 
-    return { user, groupIds }
+    return { user, groupIds, managedGroupIds }
   }
 
   private resolveMemberGroupIds(input: readonly string[]): readonly string[] {
@@ -1525,6 +1547,18 @@ export class AuthRuntime {
   }
 }
 
+function memberGroups(memberships: readonly GroupMembershipRecord[]): {
+  readonly groupIds: readonly string[]
+  readonly managedGroupIds: readonly string[]
+} {
+  return {
+    groupIds: memberships.map((membership) => membership.groupId),
+    managedGroupIds: memberships
+      .filter((membership) => membership.source === "directory")
+      .map((membership) => membership.groupId),
+  }
+}
+
 /** The interactive session a caller authenticated with, when it used one. */
 function callerSessionId(caller: AuthenticatedRequestAuthSession): string | undefined {
   return caller.credentialSource === "session" ? caller.session.id : undefined

package/src/auth/strategy.ts

@@ -7,6 +7,8 @@
  * entry plus the storage contracts from `@sixb/core/storage`.
  */
 
+export type { SignInRefusalReason } from "./errors"
+export { SignInRefusedError } from "./errors"
 export type {
   AuthEmailDeliveryStatus,
   AuthInvitationRecipientInput,

package/src/auth/types.ts

@@ -322,6 +322,11 @@ export interface MemberCapabilities {
 export interface MemberSummary {
   readonly user: UserRecord
   readonly groupIds: readonly string[]
+  /**
+   * The groups among `groupIds` that the identity provider manages. They sync at the user's next
+   * sign-in, so they cannot be removed here.
+   */
+  readonly managedGroupIds: readonly string[]
   readonly capabilities: MemberCapabilities
 }
 
@@ -340,6 +345,7 @@ export interface UpdateMemberGroupsInput {
 export interface UpdateMemberGroupsResult {
   readonly user: UserRecord
   readonly groupIds: readonly string[]
+  readonly managedGroupIds: readonly string[]
 }
 
 export interface SuspendMemberInput {
@@ -349,6 +355,7 @@ export interface SuspendMemberInput {
 export interface SuspendMemberResult {
   readonly user: UserRecord
   readonly groupIds: readonly string[]
+  readonly managedGroupIds: readonly string[]
 }
 
 export interface ReactivateMemberInput {
@@ -358,6 +365,7 @@ export interface ReactivateMemberInput {
 export interface ReactivateMemberResult {
   readonly user: UserRecord
   readonly groupIds: readonly string[]
+  readonly managedGroupIds: readonly string[]
 }
 
 /** `"session"` reads only the cookie; `"any"` reads a bearer access token, else the cookie. */

package/src/deploy/define.ts

@@ -0,0 +1,6 @@
+import type { DeployConfig } from "./types"
+
+/** Declares a deployment in `sixb.deploy.ts`. `sixb deploy` validates it when it loads the file. */
+export function defineDeploy<const TConfig extends DeployConfig>(config: TConfig): TConfig {
+  return config
+}

package/src/deploy/index.ts

@@ -0,0 +1,41 @@
+export { defineDeploy } from "./define"
+export type {
+  DeployAccess,
+  DeployAccessKey,
+  DeployCheck,
+  DeployCheckContext,
+  DeployCi,
+  DeployCiCredential,
+  DeployCommand,
+  DeployConfig,
+  DeployConfigurableWorkerType,
+  DeployContext,
+  DeployControlAction,
+  DeployEnv,
+  DeployEvent,
+  DeployHttpServiceConfig,
+  DeployHttpServiceName,
+  DeployListenAddress,
+  DeployLogsOptions,
+  DeployOperationContext,
+  DeployProcessDefinition,
+  DeployProcessOptions,
+  DeployProcessStatus,
+  DeployRecord,
+  DeployRelease,
+  DeployReleaseHttp,
+  DeployReleaseProcess,
+  DeployReleaseService,
+  DeployScalableProcessOptions,
+  DeployServiceName,
+  DeployServicesConfig,
+  DeploySetupContext,
+  DeploySingletonServiceConfig,
+  DeploySingletonServiceName,
+  DeploySource,
+  DeploySourceArchive,
+  DeployStatus,
+  DeployTarget,
+  DeployWorkersConfig,
+  DeployWorkerType,
+} from "./types"

package/src/deploy/internal.ts

@@ -0,0 +1,7 @@
+export {
+  DEPLOY_SERVICES,
+  DEPLOY_WORKER_TYPES,
+  isDeployHttpService,
+  isDeploySingletonService,
+} from "./services"
+export { validateDeployConfig } from "./validation"

package/src/deploy/services.ts

@@ -0,0 +1,51 @@
+import type {
+  DeployConfigurableWorkerType,
+  DeployHttpServiceName,
+  DeployServiceName,
+  DeploySingletonServiceName,
+  DeployWorkerType,
+} from "./types"
+
+// Records rather than arrays so that each list is total over its union: a service or worker type
+// added to the types does not compile until it is listed here, and validation accepts it.
+
+const SERVICES = {
+  api: "http",
+  atlas: "http",
+  app: "http",
+  orchestrator: "singleton",
+  scheduler: "singleton",
+  rules: "singleton",
+  workers: "workers",
+} as const satisfies Record<DeployServiceName, "http" | "singleton" | "workers">
+
+/** Whether each worker type's concurrency can be configured. */
+const WORKER_TYPES: {
+  readonly [Type in DeployWorkerType]: Type extends DeployConfigurableWorkerType ? true : false
+} = {
+  sync: true,
+  action: false,
+  agent: true,
+  pipeline: true,
+  projection: true,
+  workflow: true,
+}
+
+/** Every service, in the order a deployment lists them. */
+export const DEPLOY_SERVICES = Object.keys(SERVICES) as DeployServiceName[]
+
+export const DEPLOY_WORKER_TYPES = Object.keys(WORKER_TYPES) as DeployWorkerType[]
+
+export const DEPLOY_CONFIGURABLE_WORKER_TYPES = DEPLOY_WORKER_TYPES.filter(
+  (workerType): workerType is DeployConfigurableWorkerType => WORKER_TYPES[workerType]
+)
+
+export function isDeployHttpService(service: DeployServiceName): service is DeployHttpServiceName {
+  return SERVICES[service] === "http"
+}
+
+export function isDeploySingletonService(
+  service: DeployServiceName
+): service is DeploySingletonServiceName {
+  return SERVICES[service] === "singleton"
+}