@sixb/core 0.1.16 → 0.1.18

package/dist/{chunk-667x4drs.js → chunk-d0eb5yy6.js}

@@ -3,20 +3,156 @@ import {
   AuthStorageError2,
   SYSTEM_PRINCIPAL2,
   principalsEqual2
-} from "./chunk-2xvgy3x5.js";
-import {
-  agentServiceAccountId2,
-  resolveAuthorizationContext2
-} from "./chunk-69kt9q43.js";
+} from "./chunk-6h5m9xjx.js";
 import {
   createSixbError2
 } from "./chunk-6fsr7y93.js";
+import {
+  agentServiceAccountId2,
+  AuthorizationError2,
+  resolveAuthorizationContext2
+} from "./chunk-qkbx3tf6.js";
 import {
   findPrimitiveRunExecution,
   findAgentRunExecution
 } from "./chunk-ey1nk510.js";
 
+// src/security/redactions.ts
+function missingClearanceRedactions(ids) {
+  return Object.fromEntries([...ids].map((id) => [id, { reason: "missing_clearance" }]));
+}
+
+// src/objects/property-clearance.ts
+var NO_PROPERTIES = new Set;
+var clearancesByOntology = new WeakMap;
+function resolvePropertyClearance(ontology, clearances) {
+  let resolved = clearancesByOntology.get(ontology);
+  if (!resolved) {
+    resolved = new Map;
+    clearancesByOntology.set(ontology, resolved);
+  }
+  const key = JSON.stringify([...clearances].sort());
+  if (!resolved.has(key))
+    resolved.set(key, createPropertyClearance(ontology, clearances));
+  return resolved.get(key);
+}
+function createPropertyClearance(ontology, clearances) {
+  const missingByType = new Map;
+  for (const objectType of ontology.listObjectTypes()) {
+    const missing = new Map;
+    for (const property of objectType.properties) {
+      const marking = property.markings?.find((markingId) => !clearances.has(markingId));
+      if (marking !== undefined)
+        missing.set(property.id, marking);
+    }
+    if (missing.size > 0)
+      missingByType.set(objectType.id, missing);
+  }
+  if (missingByType.size === 0)
+    return;
+  const hiddenByType = new Map([...missingByType].map(([objectTypeId, missing]) => [objectTypeId, new Set(missing.keys())]));
+  return Object.freeze({
+    hiddenPropertyIds: (objectTypeId) => hiddenByType.get(objectTypeId) ?? NO_PROPERTIES,
+    missingMarking: (objectTypeId, propertyId) => missingByType.get(objectTypeId)?.get(propertyId)
+  });
+}
+function redactObjectRow(row, clearance) {
+  const hidden = clearance.hiddenPropertyIds(row.objectTypeId);
+  const links = row.links;
+  if (hidden.size === 0 && links === undefined)
+    return row;
+  const redacted = { ...row };
+  if (hidden.size > 0) {
+    redacted.properties = withoutKeys(row.properties, hidden);
+    redacted.redactions = missingClearanceRedactions(hidden);
+  }
+  if (links !== undefined) {
+    redacted.links = Object.fromEntries(Object.entries(links).map(([linkId, value]) => [linkId, redactLinkValue(value, clearance)]));
+  }
+  return redacted;
+}
+function redactLinkValue(value, clearance) {
+  if (value === null)
+    return null;
+  if (Array.isArray(value))
+    return value.map((row) => redactObjectRow(row, clearance));
+  return redactObjectRow(value, clearance);
+}
+function redactDomainEvent(event, clearance) {
+  if (event.topic !== "objects")
+    return event;
+  const hidden = clearance.hiddenPropertyIds(event.payload.objectTypeId);
+  if (hidden.size === 0)
+    return event;
+  const payload = {
+    ...event.payload,
+    propertyChanges: withoutKeys(event.payload.propertyChanges, hidden),
+    redactions: missingClearanceRedactions(hidden)
+  };
+  if (event.type === "object.deleted")
+    return { ...event, payload };
+  return {
+    ...event,
+    payload: { ...payload, properties: withoutKeys(event.payload.properties, hidden) }
+  };
+}
+function withoutKeys(record, hidden) {
+  const kept = {};
+  for (const [key, value] of Object.entries(record)) {
+    if (!hidden.has(key))
+      kept[key] = value;
+  }
+  return kept;
+}
+function createClearanceQueryAdmission(clearance) {
+  const reachedTypes = new WeakMap;
+  const state = (objectTypeIds) => {
+    const created = Object.freeze({});
+    reachedTypes.set(created, Object.freeze([...objectTypeIds]));
+    return created;
+  };
+  const reached = (input) => {
+    const objectTypeIds = reachedTypes.get(input);
+    if (!objectTypeIds) {
+      throw new Error("[Sixb] Clearance query admission received a state it did not create.");
+    }
+    return objectTypeIds;
+  };
+  const empty = state([]);
+  const admission = {
+    empty: () => empty,
+    source: (input) => ({ state: state(input.result.objectTypeIds) }),
+    edge: (input) => ({ state: state(input.result.objectTypeIds) }),
+    set: (input) => input.op === "subtract" ? input.states[0] ?? empty : state([...new Set(input.states.flatMap(reached))]),
+    property: (input) => {
+      if (input.use === "project")
+        return;
+      const objectTypeIds = input.objectTypeId === undefined ? reached(input.state) : [input.objectTypeId];
+      for (const objectTypeId of objectTypeIds) {
+        const marking = clearance.missingMarking(objectTypeId, input.propertyId);
+        if (marking === undefined)
+          continue;
+        return new AuthorizationError2(`clearance:marking:${marking}`, `[Sixb] Cannot ${PROPERTY_USE_VERBS[input.use]} '${objectTypeId}.${input.propertyId}' at '${input.path}': it requires clearance for marking '${marking}'.`);
+      }
+      return;
+    }
+  };
+  return Object.freeze(admission);
+}
+var PROPERTY_USE_VERBS = {
+  filter: "filter by",
+  text: "search",
+  vector: "run a vector search over",
+  sort: "sort by",
+  project: "project",
+  "expand.orderBy": "order expanded objects by",
+  facet: "facet by"
+};
+
 // src/agents/authority.ts
+function resolveAgentPropertyClearance2(ontology, authorization) {
+  return authorization.type === "principal" ? resolvePropertyClearance(ontology, authorization.context.clearances ?? new Set) : undefined;
+}
 async function ensureManagedAgentExecutionIdentity2(input) {
   const auth = requireAuthStorage(input.auth);
   const id = agentServiceAccountId2(input.actorId);
@@ -279,6 +415,6 @@ function invalidExecution(executionId, runId) {
   throw new WorkflowRunError2(`[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`);
 }
 
-export { WorkflowRunError2, ensureManagedAgentExecutionIdentity2, resolveAgentExecutionAuthorization2, resolveInheritedAgentExecutionAuthorization2, assertWorkflowRunExecution2, assertWorkflowAgentNodeRunExecution2 };
+export { WorkflowRunError2, missingClearanceRedactions, resolvePropertyClearance, redactObjectRow, redactDomainEvent, createClearanceQueryAdmission, resolveAgentPropertyClearance2, ensureManagedAgentExecutionIdentity2, resolveAgentExecutionAuthorization2, resolveInheritedAgentExecutionAuthorization2, assertWorkflowRunExecution2, assertWorkflowAgentNodeRunExecution2 };
 
-//# debugId=F5DA9E9C95A4C18E64756E2164756E21
+//# debugId=D9BE414225D935D664756E2164756E21

package/dist/chunk-d0eb5yy6.js.map

@@ -0,0 +1,14 @@
+{
+  "version": 3,
+  "sources": ["../src/security/redactions.ts", "../src/objects/property-clearance.ts", "../src/agents/authority.ts", "../src/storage/workflow-runs/errors.ts", "../src/storage/workflow-runs/provider.ts"],
+  "sourcesContent": [
+    "import type { Redactions } from \"./types\"\n\n/** List the values hidden from a reader that lacks a clearance for their markings. */\nexport function missingClearanceRedactions(ids: Iterable<string>): Redactions {\n  return Object.fromEntries([...ids].map((id) => [id, { reason: \"missing_clearance\" }] as const))\n}\n",
+    "import { AuthorizationError } from \"../authorization/errors\"\nimport type { StoredDomainEvent } from \"../events/types\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport { missingClearanceRedactions } from \"../security/redactions\"\nimport type { ExpandedLinkValue, ExpandedObjectRow, ObjectRow } from \"../storage\"\nimport type {\n  ObjectQueryAdmissionState,\n  ObjectQueryPropertyUse,\n  ObjectQuerySemanticAdmission,\n} from \"./query/validate\"\n\n/**\n * The marked properties one reader cannot read, resolved once from its clearances.\n *\n * A property is readable when the reader clears every one of its markings. Unreadable properties\n * are omitted from rows and cannot be used to select, order, or aggregate objects.\n */\nexport interface PropertyClearance {\n  /** Marked properties of this object type the reader cannot read. */\n  hiddenPropertyIds(objectTypeId: string): ReadonlySet<string>\n  /** First marking on the property that the reader is not cleared for. */\n  missingMarking(objectTypeId: string, propertyId: string): string | undefined\n}\n\nconst NO_PROPERTIES: ReadonlySet<string> = new Set()\n\n// Readers are built per execution, but few distinct clearance sets exist per ontology.\nconst clearancesByOntology = new WeakMap<\n  OntologyDefinitionCatalog,\n  Map<string, PropertyClearance | undefined>\n>()\n\n/**\n * Resolve what a reader with these clearances cannot read. Returns `undefined` when it can read\n * every property, so callers skip redaction entirely.\n */\nexport function resolvePropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  clearances: ReadonlySet<string>\n): PropertyClearance | undefined {\n  let resolved = clearancesByOntology.get(ontology)\n  if (!resolved) {\n    resolved = new Map()\n    clearancesByOntology.set(ontology, resolved)\n  }\n  const key = JSON.stringify([...clearances].sort())\n  if (!resolved.has(key)) resolved.set(key, createPropertyClearance(ontology, clearances))\n  return resolved.get(key)\n}\n\nfunction createPropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  clearances: ReadonlySet<string>\n): PropertyClearance | undefined {\n  const missingByType = new Map<string, ReadonlyMap<string, string>>()\n  for (const objectType of ontology.listObjectTypes()) {\n    const missing = new Map<string, string>()\n    for (const property of objectType.properties) {\n      const marking = property.markings?.find((markingId) => !clearances.has(markingId))\n      if (marking !== undefined) missing.set(property.id, marking)\n    }\n    if (missing.size > 0) missingByType.set(objectType.id, missing)\n  }\n  if (missingByType.size === 0) return undefined\n\n  const hiddenByType = new Map(\n    [...missingByType].map(([objectTypeId, missing]) => [objectTypeId, new Set(missing.keys())])\n  )\n  return Object.freeze({\n    hiddenPropertyIds: (objectTypeId: string) => hiddenByType.get(objectTypeId) ?? NO_PROPERTIES,\n    missingMarking: (objectTypeId: string, propertyId: string) =>\n      missingByType.get(objectTypeId)?.get(propertyId),\n  })\n}\n\n/**\n * Omit unreadable properties from a row and the objects expanded under it.\n *\n * Every hidden property of the type is listed in `redactions`, whether or not the row holds a\n * value: listing only present values would reveal which hidden properties are empty.\n */\nexport function redactObjectRow<TRow extends ObjectRow>(\n  row: TRow,\n  clearance: PropertyClearance\n): TRow {\n  const hidden = clearance.hiddenPropertyIds(row.objectTypeId)\n  const links = row.links\n  if (hidden.size === 0 && links === undefined) return row\n\n  const redacted: TRow = { ...row }\n  if (hidden.size > 0) {\n    redacted.properties = withoutKeys(row.properties, hidden)\n    redacted.redactions = missingClearanceRedactions(hidden)\n  }\n  if (links !== undefined) {\n    redacted.links = Object.fromEntries(\n      Object.entries(links).map(([linkId, value]) => [linkId, redactLinkValue(value, clearance)])\n    )\n  }\n  return redacted\n}\n\nfunction redactLinkValue(\n  value: ExpandedLinkValue,\n  clearance: PropertyClearance\n): ExpandedLinkValue {\n  if (value === null) return null\n  if (Array.isArray(value)) return value.map((row) => redactObjectRow(row, clearance))\n  // Array.isArray does not narrow a readonly[] away, so assert the single-object case.\n  return redactObjectRow(value as ExpandedObjectRow, clearance)\n}\n\n/**\n * Omit unreadable properties from an object event, under the same contract as rows. Other events\n * carry no markable value: link properties and telemetry properties cannot be marked.\n */\nexport function redactDomainEvent(\n  event: StoredDomainEvent,\n  clearance: PropertyClearance\n): StoredDomainEvent {\n  if (event.topic !== \"objects\") return event\n  const hidden = clearance.hiddenPropertyIds(event.payload.objectTypeId)\n  if (hidden.size === 0) return event\n\n  const payload = {\n    ...event.payload,\n    propertyChanges: withoutKeys(event.payload.propertyChanges, hidden),\n    redactions: missingClearanceRedactions(hidden),\n  }\n  if (event.type === \"object.deleted\") return { ...event, payload }\n  return {\n    ...event,\n    payload: { ...payload, properties: withoutKeys(event.payload.properties, hidden) },\n  }\n}\n\nfunction withoutKeys<TValue>(\n  record: Readonly<Record<string, TValue>>,\n  hidden: ReadonlySet<string>\n): Record<string, TValue> {\n  const kept: Record<string, TValue> = {}\n  for (const [key, value] of Object.entries(record)) {\n    if (!hidden.has(key)) kept[key] = value\n  }\n  return kept\n}\n\n/**\n * Reject every query use of a property the reader cannot read, except projection.\n *\n * Filtering, ordering, searching, or faceting by a hidden value would reveal it through which\n * objects match and in what order. Projection only shapes the output, which is redacted anyway.\n */\nexport function createClearanceQueryAdmission(\n  clearance: PropertyClearance\n): ObjectQuerySemanticAdmission {\n  // Each state stands for the object types a query has reached so far. A property without an\n  // explicit type is checked against all of them.\n  const reachedTypes = new WeakMap<ObjectQueryAdmissionState, readonly string[]>()\n  const state = (objectTypeIds: readonly string[]): ObjectQueryAdmissionState => {\n    const created = Object.freeze({})\n    reachedTypes.set(created, Object.freeze([...objectTypeIds]))\n    return created\n  }\n  const reached = (input: ObjectQueryAdmissionState): readonly string[] => {\n    const objectTypeIds = reachedTypes.get(input)\n    if (!objectTypeIds) {\n      throw new Error(\"[Sixb] Clearance query admission received a state it did not create.\")\n    }\n    return objectTypeIds\n  }\n  const empty = state([])\n\n  const admission: ObjectQuerySemanticAdmission = {\n    empty: () => empty,\n    source: (input) => ({ state: state(input.result.objectTypeIds) }),\n    edge: (input) => ({ state: state(input.result.objectTypeIds) }),\n    // A difference only returns objects of its first input.\n    set: (input) =>\n      input.op === \"subtract\"\n        ? (input.states[0] ?? empty)\n        : state([...new Set(input.states.flatMap(reached))]),\n    property: (input) => {\n      if (input.use === \"project\") return undefined\n      const objectTypeIds =\n        input.objectTypeId === undefined ? reached(input.state) : [input.objectTypeId]\n      for (const objectTypeId of objectTypeIds) {\n        const marking = clearance.missingMarking(objectTypeId, input.propertyId)\n        if (marking === undefined) continue\n        return new AuthorizationError(\n          `clearance:marking:${marking}`,\n          `[Sixb] Cannot ${PROPERTY_USE_VERBS[input.use]} '${objectTypeId}.${input.propertyId}' at '${input.path}': it requires clearance for marking '${marking}'.`\n        )\n      }\n      return undefined\n    },\n  }\n  return Object.freeze(admission)\n}\n\nconst PROPERTY_USE_VERBS: Readonly<Record<ObjectQueryPropertyUse, string>> = {\n  filter: \"filter by\",\n  text: \"search\",\n  vector: \"run a vector search over\",\n  sort: \"sort by\",\n  project: \"project\",\n  \"expand.orderBy\": \"order expanded objects by\",\n  facet: \"facet by\",\n}\n",
+    "import { principalsEqual, SYSTEM_PRINCIPAL } from \"../auth\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport { resolveAuthorizationContext } from \"../authorization\"\nimport { createSixbError } from \"../errors/internal\"\nimport type { AuthorizablePrincipal, AuthorizationRef } from \"../execution\"\nimport { type PropertyClearance, resolvePropertyClearance } from \"../objects/property-clearance\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport type { SecurityDefinitionCatalog } from \"../security\"\nimport type {\n  AccessTokenRecord,\n  AuthStorage,\n  ServiceAccountGroupMembershipRecord,\n  ServiceAccountRecord,\n  SessionRecord,\n  UserRecord,\n} from \"../storage/auth\"\nimport { AuthStorageError } from \"../storage/auth\"\nimport { agentServiceAccountId } from \"./identity\"\n\nexport type AgentExecutionAuthorization =\n  | { readonly type: \"principal\"; readonly context: AuthorizationContext }\n  | { readonly type: \"disabled\" }\n\n/**\n * The marked properties an Agent execution cannot read, resolved exactly as its object reader\n * resolves them. Disabled authorization reads everything.\n */\nexport function resolveAgentPropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  authorization: AgentExecutionAuthorization\n): PropertyClearance | undefined {\n  return authorization.type === \"principal\"\n    ? resolvePropertyClearance(ontology, authorization.context.clearances ?? new Set())\n    : undefined\n}\n\ntype UserCredentialRef = NonNullable<\n  Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n>\n\ninterface CredentialedUserAuthorizationRef {\n  readonly type: \"principal\"\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"user\" }>\n  readonly credential: UserCredentialRef\n}\n\nexport { agentServiceAccountId } from \"./identity\"\n\nexport interface AgentExecutionIdentity {\n  readonly serviceAccount: ServiceAccountRecord\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"serviceAccount\" }>\n  readonly groupMemberships: readonly ServiceAccountGroupMembershipRecord[]\n}\n\n/** Ensure a framework-managed Agent actor exists with exactly its declared group memberships. */\nexport async function ensureManagedAgentExecutionIdentity(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly name: string\n  readonly description: string\n  readonly groupIds: readonly string[]\n}): Promise<AgentExecutionIdentity> {\n  const auth = requireAuthStorage(input.auth)\n  const id = agentServiceAccountId(input.actorId)\n  const now = new Date()\n  const loaded = await loadOrCreateAgentServiceAccount(auth, {\n    id,\n    projectId: input.projectId,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertFrameworkManagedAgentServiceAccount(input.actorId, loaded)\n  assertActiveAgentServiceAccount(input.actorId, loaded)\n  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {\n    existing: loaded,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertActiveAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: id,\n      groupIds: input.groupIds,\n      source: \"agent\",\n      updatedAt: now,\n    })\n  )\n\n  return {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id },\n    groupMemberships,\n  }\n}\n\n/** Load the managed identity, recovering only the expected concurrent-create race. */\nasync function loadOrCreateAgentServiceAccount(\n  auth: AuthStorage,\n  input: {\n    readonly id: string\n    readonly projectId: string\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  const existing = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: input.id,\n  })\n  if (existing) return existing\n\n  try {\n    return await auth.serviceAccounts.create({\n      id: input.id,\n      projectId: input.projectId,\n      name: input.name,\n      description: input.description,\n      status: \"active\",\n      createdByPrincipal: SYSTEM_PRINCIPAL,\n      createdAt: input.updatedAt,\n      updatedAt: input.updatedAt,\n    })\n  } catch (error) {\n    if (!(error instanceof AuthStorageError) || error.code !== \"duplicate_service_account\") {\n      throw error\n    }\n    const concurrent = await auth.serviceAccounts.getById({\n      projectId: input.projectId,\n      id: input.id,\n    })\n    if (!concurrent) throw error\n    return concurrent\n  }\n}\n\nfunction assertActiveAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (serviceAccount.status === \"suspended\") {\n    throw new Error(\n      `[Sixb] Agent '${actorId}' service account '${serviceAccount.id}' is suspended.`\n    )\n  }\n}\n\nfunction assertFrameworkManagedAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (\n    serviceAccount.createdByPrincipal === undefined ||\n    !principalsEqual(serviceAccount.createdByPrincipal, SYSTEM_PRINCIPAL)\n  ) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' cannot use service account '${serviceAccount.id}' because it is not managed by Sixb.`,\n      { details: { actorId, serviceAccountId: serviceAccount.id } }\n    )\n  }\n}\n\nfunction requireDefinitionOwnedGroupMemberships(\n  actorId: string,\n  memberships: readonly ServiceAccountGroupMembershipRecord[]\n): readonly ServiceAccountGroupMembershipRecord[] {\n  const externalGroupIds = memberships\n    .filter((membership) => membership.source !== \"agent\")\n    .map((membership) => membership.groupId)\n  if (externalGroupIds.length > 0) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' service account has group memberships not managed by its definition: ${externalGroupIds.join(\", \")}.`,\n      { details: { actorId, externalGroupIds } }\n    )\n  }\n  return memberships\n}\n\n/** Resolve current grants for the service account referenced by a durable Agent execution. */\nexport async function resolveAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n}): Promise<{ readonly identity: AgentExecutionIdentity; readonly context: AuthorizationContext }> {\n  const auth = requireAuthStorage(input.auth)\n  const expectedId = agentServiceAccountId(input.actorId)\n  const principal =\n    input.authorizationRef.type === \"principal\" ? input.authorizationRef.principal : null\n  if (principal?.type !== \"serviceAccount\" || principal.id !== expectedId) {\n    throw new Error(\n      `[Sixb] Agent '${input.actorId}' execution authority must reference service account '${expectedId}'.`\n    )\n  }\n\n  const serviceAccount = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: principal.id,\n  })\n  if (!serviceAccount || serviceAccount.status !== \"active\") {\n    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`)\n  }\n  assertFrameworkManagedAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.listForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: principal.id,\n    })\n  )\n  const identity: AgentExecutionIdentity = {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id: principal.id },\n    groupMemberships,\n  }\n  return {\n    identity,\n    context: resolveAuthorizationContext({\n      principal: identity.principal,\n      groupIds: groupMemberships.map((membership) => membership.groupId),\n      roles: input.security.listResolvedRoles(),\n    }),\n  }\n}\n\n/** Revalidate the durable user authority inherited by a conversational or child Agent. */\nexport async function resolveInheritedAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n  readonly now?: Date\n}): Promise<AgentExecutionAuthorization> {\n  if (input.authorizationRef.type === \"disabled\") return { type: \"disabled\" }\n\n  const ref = requireCredentialedUserAuthority(input.authorizationRef)\n  const auth = requireAuthStorage(input.auth)\n  const now = input.now ?? new Date()\n  const user = await requireActiveUser(auth, input.projectId, ref.principal.id)\n  const memberships = await auth.groupMemberships.listForUser({\n    projectId: input.projectId,\n    userId: user.id,\n  })\n  const credential = await revalidateUserCredential({\n    auth,\n    projectId: input.projectId,\n    userId: user.id,\n    credential: ref.credential,\n    currentGroupIds: memberships.map((membership) => membership.groupId),\n    now,\n  })\n\n  return {\n    type: \"principal\",\n    context: resolveAuthorizationContext({\n      principal: ref.principal,\n      groupIds: credential.groupIds,\n      roles: input.security.listResolvedRoles(),\n      ...(credential.sessionId === undefined ? {} : { sessionId: credential.sessionId }),\n    }),\n  }\n}\n\nfunction requireCredentialedUserAuthority(ref: AuthorizationRef): CredentialedUserAuthorizationRef {\n  if (ref.type !== \"principal\" || ref.principal.type !== \"user\" || ref.credential === undefined) {\n    throw invalidInheritedAuthority(\"the durable reference is not a credentialed user\")\n  }\n  return {\n    type: \"principal\",\n    principal: { type: \"user\", id: ref.principal.id },\n    credential: { type: ref.credential.type, id: ref.credential.id },\n  }\n}\n\nasync function requireActiveUser(\n  auth: AuthStorage,\n  projectId: string,\n  userId: string\n): Promise<UserRecord> {\n  const user = await auth.users.getById({ projectId, id: userId })\n  if (!user || user.status !== \"active\") {\n    throw invalidInheritedAuthority(`user '${userId}' is not active`)\n  }\n  return user\n}\n\nasync function revalidateUserCredential(input: {\n  readonly auth: AuthStorage\n  readonly projectId: string\n  readonly userId: string\n  readonly credential: UserCredentialRef\n  readonly currentGroupIds: readonly string[]\n  readonly now: Date\n}): Promise<{ readonly groupIds: readonly string[]; readonly sessionId?: string }> {\n  if (input.credential.type === \"session\") {\n    const session = await input.auth.sessions.getById({\n      projectId: input.projectId,\n      id: input.credential.id,\n    })\n    if (!isUsableUserSession(session, input.userId, input.now)) {\n      throw invalidInheritedAuthority(\"the inherited session is no longer valid\")\n    }\n    return { groupIds: input.currentGroupIds, sessionId: session.id }\n  }\n\n  const accessToken = await input.auth.accessTokens.getById({\n    projectId: input.projectId,\n    id: input.credential.id,\n  })\n  if (!isUsableUserAccessToken(accessToken, input.userId, input.now)) {\n    throw invalidInheritedAuthority(\"the inherited access token is no longer valid\")\n  }\n  if (accessToken.groupIds === undefined) return { groupIds: input.currentGroupIds }\n\n  const allowedGroupIds = new Set(accessToken.groupIds)\n  return {\n    groupIds: input.currentGroupIds.filter((groupId) => allowedGroupIds.has(groupId)),\n  }\n}\n\nfunction isUsableUserSession(\n  session: SessionRecord | null,\n  userId: string,\n  now: Date\n): session is SessionRecord {\n  if (!session || session.userId !== userId || session.revokedAt !== undefined) return false\n  if (session.expiresAt.getTime() <= now.getTime()) return false\n  return (\n    session.absoluteExpiresAt === undefined || session.absoluteExpiresAt.getTime() > now.getTime()\n  )\n}\n\nfunction isUsableUserAccessToken(\n  token: AccessTokenRecord | null,\n  userId: string,\n  now: Date\n): token is AccessTokenRecord {\n  if (!token || !principalsEqual(token.subject, { type: \"user\", id: userId })) return false\n  return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime()\n}\n\nfunction invalidInheritedAuthority(reason: string): Error {\n  return createSixbError(\n    \"agent.execution_failed\",\n    `[Sixb] The Agent execution cannot restore its inherited authority: ${reason}.`\n  )\n}\n\nfunction requireAuthStorage(auth: AuthStorage | undefined): AuthStorage {\n  if (!auth) {\n    throw new Error(\"[Sixb] Agent executions require auth storage.\")\n  }\n  return auth\n}\n\nasync function updateAgentServiceAccountMetadata(\n  auth: AuthStorage,\n  input: {\n    readonly existing: ServiceAccountRecord\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  if (input.existing.name === input.name && input.existing.description === input.description) {\n    return input.existing\n  }\n  return auth.serviceAccounts.update({\n    projectId: input.existing.projectId,\n    id: input.existing.id,\n    name: input.name,\n    description: input.description,\n    updatedAt: input.updatedAt,\n  })\n}\n",
+    "/**\n * Base error for workflow-run storage operations.\n */\nexport class WorkflowRunError extends Error {\n  readonly name = \"WorkflowRunError\"\n}\n",
+    "import { agentServiceAccountId } from \"../../agents/authority\"\nimport type { ExecutionStorage } from \"../executions\"\nimport { findAgentRunExecution, findPrimitiveRunExecution } from \"../executions/run-link\"\nimport { WorkflowRunError } from \"./errors\"\n\n/** Validate the semantic link between a durable workflow run and its immutable execution. */\nexport async function assertWorkflowRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly runId: string\n  readonly workflowId: string\n}): Promise<void> {\n  const execution = await findPrimitiveRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    primitive: { kind: \"workflow\", id: input.workflowId, runId: input.runId },\n    sourceTypes: [\"execution\", \"schedule\", \"event\"],\n  })\n  if (!execution) {\n    invalidExecution(input.executionId, input.runId)\n  }\n\n  if (execution.source.type === \"schedule\" || execution.source.type === \"event\") {\n    if (execution.requestedBy !== undefined) {\n      invalidExecution(input.executionId, input.runId)\n    }\n    return\n  }\n\n  // ExecutionStorage already validates the immutable parent reference, correlation id, and\n  // requested-by propagation. This boundary only owns the workflow-specific source restriction.\n  if (execution.source.type !== \"execution\") {\n    invalidExecution(input.executionId, input.runId)\n  }\n}\n\n/** Validate the semantic link between a Workflow Agent-node run and its child execution. */\nexport async function assertWorkflowAgentNodeRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly nodeRunId: string\n  readonly actorId: string\n  readonly workflowExecutionId: string\n}): Promise<void> {\n  const execution = await findAgentRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    runId: input.nodeRunId,\n    authority: { type: \"managed\", serviceAccountId: agentServiceAccountId(input.actorId) },\n  })\n  if (\n    !execution ||\n    execution.source.type !== \"execution\" ||\n    execution.source.executionId !== input.workflowExecutionId\n  ) {\n    throw new WorkflowRunError(\n      `[Sixb] Execution '${input.executionId}' does not authorize Workflow Agent-node run '${input.nodeRunId}'.`\n    )\n  }\n}\n\nfunction invalidExecution(executionId: string, runId: string): never {\n  throw new WorkflowRunError(\n    `[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`\n  )\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AAGO,SAAS,0BAA0B,CAAC,KAAmC;AAAA,EAC5E,OAAO,OAAO,YAAY,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,oBAAoB,CAAC,CAAU,CAAC;AAAA;;;ACoBhG,IAAM,gBAAqC,IAAI;AAG/C,IAAM,uBAAuB,IAAI;AAS1B,SAAS,wBAAwB,CACtC,UACA,YAC+B;AAAA,EAC/B,IAAI,WAAW,qBAAqB,IAAI,QAAQ;AAAA,EAChD,IAAI,CAAC,UAAU;AAAA,IACb,WAAW,IAAI;AAAA,IACf,qBAAqB,IAAI,UAAU,QAAQ;AAAA,EAC7C;AAAA,EACA,MAAM,MAAM,KAAK,UAAU,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC;AAAA,EACjD,IAAI,CAAC,SAAS,IAAI,GAAG;AAAA,IAAG,SAAS,IAAI,KAAK,wBAAwB,UAAU,UAAU,CAAC;AAAA,EACvF,OAAO,SAAS,IAAI,GAAG;AAAA;AAGzB,SAAS,uBAAuB,CAC9B,UACA,YAC+B;AAAA,EAC/B,MAAM,gBAAgB,IAAI;AAAA,EAC1B,WAAW,cAAc,SAAS,gBAAgB,GAAG;AAAA,IACnD,MAAM,UAAU,IAAI;AAAA,IACpB,WAAW,YAAY,WAAW,YAAY;AAAA,MAC5C,MAAM,UAAU,SAAS,UAAU,KAAK,CAAC,cAAc,CAAC,WAAW,IAAI,SAAS,CAAC;AAAA,MACjF,IAAI,YAAY;AAAA,QAAW,QAAQ,IAAI,SAAS,IAAI,OAAO;AAAA,IAC7D;AAAA,IACA,IAAI,QAAQ,OAAO;AAAA,MAAG,cAAc,IAAI,WAAW,IAAI,OAAO;AAAA,EAChE;AAAA,EACA,IAAI,cAAc,SAAS;AAAA,IAAG;AAAA,EAE9B,MAAM,eAAe,IAAI,IACvB,CAAC,GAAG,aAAa,EAAE,IAAI,EAAE,cAAc,aAAa,CAAC,cAAc,IAAI,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAC7F;AAAA,EACA,OAAO,OAAO,OAAO;AAAA,IACnB,mBAAmB,CAAC,iBAAyB,aAAa,IAAI,YAAY,KAAK;AAAA,IAC/E,gBAAgB,CAAC,cAAsB,eACrC,cAAc,IAAI,YAAY,GAAG,IAAI,UAAU;AAAA,EACnD,CAAC;AAAA;AASI,SAAS,eAAuC,CACrD,KACA,WACM;AAAA,EACN,MAAM,SAAS,UAAU,kBAAkB,IAAI,YAAY;AAAA,EAC3D,MAAM,QAAQ,IAAI;AAAA,EAClB,IAAI,OAAO,SAAS,KAAK,UAAU;AAAA,IAAW,OAAO;AAAA,EAErD,MAAM,WAAiB,KAAK,IAAI;AAAA,EAChC,IAAI,OAAO,OAAO,GAAG;AAAA,IACnB,SAAS,aAAa,YAAY,IAAI,YAAY,MAAM;AAAA,IACxD,SAAS,aAAa,2BAA2B,MAAM;AAAA,EACzD;AAAA,EACA,IAAI,UAAU,WAAW;AAAA,IACvB,SAAS,QAAQ,OAAO,YACtB,OAAO,QAAQ,KAAK,EAAE,IAAI,EAAE,QAAQ,WAAW,CAAC,QAAQ,gBAAgB,OAAO,SAAS,CAAC,CAAC,CAC5F;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,eAAe,CACtB,OACA,WACmB;AAAA,EACnB,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO,MAAM,IAAI,CAAC,QAAQ,gBAAgB,KAAK,SAAS,CAAC;AAAA,EAEnF,OAAO,gBAAgB,OAA4B,SAAS;AAAA;AAOvD,SAAS,iBAAiB,CAC/B,OACA,WACmB;AAAA,EACnB,IAAI,MAAM,UAAU;AAAA,IAAW,OAAO;AAAA,EACtC,MAAM,SAAS,UAAU,kBAAkB,MAAM,QAAQ,YAAY;AAAA,EACrE,IAAI,OAAO,SAAS;AAAA,IAAG,OAAO;AAAA,EAE9B,MAAM,UAAU;AAAA,OACX,MAAM;AAAA,IACT,iBAAiB,YAAY,MAAM,QAAQ,iBAAiB,MAAM;AAAA,IAClE,YAAY,2BAA2B,MAAM;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,SAAS;AAAA,IAAkB,OAAO,KAAK,OAAO,QAAQ;AAAA,EAChE,OAAO;AAAA,OACF;AAAA,IACH,SAAS,KAAK,SAAS,YAAY,YAAY,MAAM,QAAQ,YAAY,MAAM,EAAE;AAAA,EACnF;AAAA;AAGF,SAAS,WAAmB,CAC1B,QACA,QACwB;AAAA,EACxB,MAAM,OAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;AAAA,IACjD,IAAI,CAAC,OAAO,IAAI,GAAG;AAAA,MAAG,KAAK,OAAO;AAAA,EACpC;AAAA,EACA,OAAO;AAAA;AASF,SAAS,6BAA6B,CAC3C,WAC8B;AAAA,EAG9B,MAAM,eAAe,IAAI;AAAA,EACzB,MAAM,QAAQ,CAAC,kBAAgE;AAAA,IAC7E,MAAM,UAAU,OAAO,OAAO,CAAC,CAAC;AAAA,IAChC,aAAa,IAAI,SAAS,OAAO,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;AAAA,IAC3D,OAAO;AAAA;AAAA,EAET,MAAM,UAAU,CAAC,UAAwD;AAAA,IACvE,MAAM,gBAAgB,aAAa,IAAI,KAAK;AAAA,IAC5C,IAAI,CAAC,eAAe;AAAA,MAClB,MAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AAAA,IACA,OAAO;AAAA;AAAA,EAET,MAAM,QAAQ,MAAM,CAAC,CAAC;AAAA,EAEtB,MAAM,YAA0C;AAAA,IAC9C,OAAO,MAAM;AAAA,IACb,QAAQ,CAAC,WAAW,EAAE,OAAO,MAAM,MAAM,OAAO,aAAa,EAAE;AAAA,IAC/D,MAAM,CAAC,WAAW,EAAE,OAAO,MAAM,MAAM,OAAO,aAAa,EAAE;AAAA,IAE7D,KAAK,CAAC,UACJ,MAAM,OAAO,aACR,MAAM,OAAO,MAAM,QACpB,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,OAAO,QAAQ,OAAO,CAAC,CAAC,CAAC;AAAA,IACvD,UAAU,CAAC,UAAU;AAAA,MACnB,IAAI,MAAM,QAAQ;AAAA,QAAW;AAAA,MAC7B,MAAM,gBACJ,MAAM,iBAAiB,YAAY,QAAQ,MAAM,KAAK,IAAI,CAAC,MAAM,YAAY;AAAA,MAC/E,WAAW,gBAAgB,eAAe;AAAA,QACxC,MAAM,UAAU,UAAU,eAAe,cAAc,MAAM,UAAU;AAAA,QACvE,IAAI,YAAY;AAAA,UAAW;AAAA,QAC3B,OAAO,IAAI,oBACT,qBAAqB,WACrB,iBAAiB,mBAAmB,MAAM,SAAS,gBAAgB,MAAM,mBAAmB,MAAM,6CAA6C,WACjJ;AAAA,MACF;AAAA,MACA;AAAA;AAAA,EAEJ;AAAA,EACA,OAAO,OAAO,OAAO,SAAS;AAAA;AAGhC,IAAM,qBAAuE;AAAA,EAC3E,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,OAAO;AACT;;;ACrLO,SAAS,8BAA6B,CAC3C,UACA,eAC+B;AAAA,EAC/B,OAAO,cAAc,SAAS,cAC1B,yBAAyB,UAAU,cAAc,QAAQ,cAAc,IAAI,GAAK,IAChF;AAAA;AAsBN,eAAsB,oCAAmC,CAAC,OAOtB;AAAA,EAClC,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,KAAK,uBAAsB,MAAM,OAAO;AAAA,EAC9C,MAAM,MAAM,IAAI;AAAA,EAChB,MAAM,SAAS,MAAM,gCAAgC,MAAM;AAAA,IACzD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,0CAA0C,MAAM,SAAS,MAAM;AAAA,EAC/D,gCAAgC,MAAM,SAAS,MAAM;AAAA,EACrD,MAAM,iBAAiB,MAAM,kCAAkC,MAAM;AAAA,IACnE,UAAU;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,gCAAgC,MAAM,SAAS,cAAc;AAAA,EAE7D,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,2BAA2B;AAAA,IACnE,WAAW,MAAM;AAAA,IACjB,kBAAkB;AAAA,IAClB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC,CACH;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,GAAG;AAAA,IACxC;AAAA,EACF;AAAA;AAIF,eAAe,+BAA+B,CAC5C,MACA,OAO+B;AAAA,EAC/B,MAAM,WAAW,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,IAAI;AAAA,IAAU,OAAO;AAAA,EAErB,IAAI;AAAA,IACF,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAAA,MACvC,IAAI,MAAM;AAAA,MACV,WAAW,MAAM;AAAA,MACjB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,QAAQ;AAAA,MACR,oBAAoB;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,EAAE,iBAAiB,sBAAqB,MAAM,SAAS,6BAA6B;AAAA,MACtF,MAAM;AAAA,IACR;AAAA,IACA,MAAM,aAAa,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM;AAAA,IACZ,CAAC;AAAA,IACD,IAAI,CAAC;AAAA,MAAY,MAAM;AAAA,IACvB,OAAO;AAAA;AAAA;AAIX,SAAS,+BAA+B,CACtC,SACA,gBACM;AAAA,EACN,IAAI,eAAe,WAAW,aAAa;AAAA,IACzC,MAAM,IAAI,MACR,iBAAiB,6BAA6B,eAAe,mBAC/D;AAAA,EACF;AAAA;AAGF,SAAS,yCAAyC,CAChD,SACA,gBACM;AAAA,EACN,IACE,eAAe,uBAAuB,aACtC,CAAC,iBAAgB,eAAe,oBAAoB,iBAAgB,GACpE;AAAA,IACA,MAAM,iBACJ,0BACA,iBAAiB,wCAAwC,eAAe,0CACxE,EAAE,SAAS,EAAE,SAAS,kBAAkB,eAAe,GAAG,EAAE,CAC9D;AAAA,EACF;AAAA;AAGF,SAAS,sCAAsC,CAC7C,SACA,aACgD;AAAA,EAChD,MAAM,mBAAmB,YACtB,OAAO,CAAC,eAAe,WAAW,WAAW,OAAO,EACpD,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,EACzC,IAAI,iBAAiB,SAAS,GAAG;AAAA,IAC/B,MAAM,iBACJ,0BACA,iBAAiB,iFAAiF,iBAAiB,KAAK,IAAI,MAC5H,EAAE,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAC3C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIT,eAAsB,mCAAkC,CAAC,OAM0C;AAAA,EACjG,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,aAAa,uBAAsB,MAAM,OAAO;AAAA,EACtD,MAAM,YACJ,MAAM,iBAAiB,SAAS,cAAc,MAAM,iBAAiB,YAAY;AAAA,EACnF,IAAI,WAAW,SAAS,oBAAoB,UAAU,OAAO,YAAY;AAAA,IACvE,MAAM,IAAI,MACR,iBAAiB,MAAM,gEAAgE,cACzF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,UAAU;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,CAAC,kBAAkB,eAAe,WAAW,UAAU;AAAA,IACzD,MAAM,IAAI,MAAM,iCAAiC,UAAU,oBAAoB;AAAA,EACjF;AAAA,EACA,0CAA0C,MAAM,SAAS,cAAc;AAAA,EAEvE,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,sBAAsB;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,kBAAkB,UAAU;AAAA,EAC9B,CAAC,CACH;AAAA,EACA,MAAM,WAAmC;AAAA,IACvC;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,IAAI,UAAU,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,6BAA4B;AAAA,MACnC,WAAW,SAAS;AAAA,MACpB,UAAU,iBAAiB,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,MACjE,OAAO,MAAM,SAAS,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA;AAIF,eAAsB,4CAA2C,CAAC,OAMzB;AAAA,EACvC,IAAI,MAAM,iBAAiB,SAAS;AAAA,IAAY,OAAO,EAAE,MAAM,WAAW;AAAA,EAE1E,MAAM,MAAM,iCAAiC,MAAM,gBAAgB;AAAA,EACnE,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,MAAM,MAAM,OAAO,IAAI;AAAA,EAC7B,MAAM,OAAO,MAAM,kBAAkB,MAAM,MAAM,WAAW,IAAI,UAAU,EAAE;AAAA,EAC5E,MAAM,cAAc,MAAM,KAAK,iBAAiB,YAAY;AAAA,IAC1D,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,EACf,CAAC;AAAA,EACD,MAAM,aAAa,MAAM,yBAAyB;AAAA,IAChD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,YAAY,IAAI;AAAA,IAChB,iBAAiB,YAAY,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,IACnE;AAAA,EACF,CAAC;AAAA,EAED,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,6BAA4B;AAAA,MACnC,WAAW,IAAI;AAAA,MACf,UAAU,WAAW;AAAA,MACrB,OAAO,MAAM,SAAS,kBAAkB;AAAA,SACpC,WAAW,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,WAAW,UAAU;AAAA,IAClF,CAAC;AAAA,EACH;AAAA;AAGF,SAAS,gCAAgC,CAAC,KAAyD;AAAA,EACjG,IAAI,IAAI,SAAS,eAAe,IAAI,UAAU,SAAS,UAAU,IAAI,eAAe,WAAW;AAAA,IAC7F,MAAM,0BAA0B,kDAAkD;AAAA,EACpF;AAAA,EACA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,EAAE,MAAM,QAAQ,IAAI,IAAI,UAAU,GAAG;AAAA,IAChD,YAAY,EAAE,MAAM,IAAI,WAAW,MAAM,IAAI,IAAI,WAAW,GAAG;AAAA,EACjE;AAAA;AAGF,eAAe,iBAAiB,CAC9B,MACA,WACA,QACqB;AAAA,EACrB,MAAM,OAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,WAAW,IAAI,OAAO,CAAC;AAAA,EAC/D,IAAI,CAAC,QAAQ,KAAK,WAAW,UAAU;AAAA,IACrC,MAAM,0BAA0B,SAAS,uBAAuB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,wBAAwB,CAAC,OAO2C;AAAA,EACjF,IAAI,MAAM,WAAW,SAAS,WAAW;AAAA,IACvC,MAAM,UAAU,MAAM,MAAM,KAAK,SAAS,QAAQ;AAAA,MAChD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM,WAAW;AAAA,IACvB,CAAC;AAAA,IACD,IAAI,CAAC,oBAAoB,SAAS,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,MAC1D,MAAM,0BAA0B,0CAA0C;AAAA,IAC5E;AAAA,IACA,OAAO,EAAE,UAAU,MAAM,iBAAiB,WAAW,QAAQ,GAAG;AAAA,EAClE;AAAA,EAEA,MAAM,cAAc,MAAM,MAAM,KAAK,aAAa,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM,WAAW;AAAA,EACvB,CAAC;AAAA,EACD,IAAI,CAAC,wBAAwB,aAAa,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,IAClE,MAAM,0BAA0B,+CAA+C;AAAA,EACjF;AAAA,EACA,IAAI,YAAY,aAAa;AAAA,IAAW,OAAO,EAAE,UAAU,MAAM,gBAAgB;AAAA,EAEjF,MAAM,kBAAkB,IAAI,IAAI,YAAY,QAAQ;AAAA,EACpD,OAAO;AAAA,IACL,UAAU,MAAM,gBAAgB,OAAO,CAAC,YAAY,gBAAgB,IAAI,OAAO,CAAC;AAAA,EAClF;AAAA;AAGF,SAAS,mBAAmB,CAC1B,SACA,QACA,KAC0B;AAAA,EAC1B,IAAI,CAAC,WAAW,QAAQ,WAAW,UAAU,QAAQ,cAAc;AAAA,IAAW,OAAO;AAAA,EACrF,IAAI,QAAQ,UAAU,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAAG,OAAO;AAAA,EACzD,OACE,QAAQ,sBAAsB,aAAa,QAAQ,kBAAkB,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAIjG,SAAS,uBAAuB,CAC9B,OACA,QACA,KAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,CAAC,iBAAgB,MAAM,SAAS,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAAA,IAAG,OAAO;AAAA,EACpF,OAAO,MAAM,cAAc,aAAa,MAAM,UAAU,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAGlF,SAAS,yBAAyB,CAAC,QAAuB;AAAA,EACxD,OAAO,iBACL,0BACA,sEAAsE,SACxE;AAAA;AAGF,SAAS,kBAAkB,CAAC,MAA4C;AAAA,EACtE,IAAI,CAAC,MAAM;AAAA,IACT,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,iCAAiC,CAC9C,MACA,OAM+B;AAAA,EAC/B,IAAI,MAAM,SAAS,SAAS,MAAM,QAAQ,MAAM,SAAS,gBAAgB,MAAM,aAAa;AAAA,IAC1F,OAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,KAAK,gBAAgB,OAAO;AAAA,IACjC,WAAW,MAAM,SAAS;AAAA,IAC1B,IAAI,MAAM,SAAS;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,EACnB,CAAC;AAAA;;;AC5XI,MAAM,0BAAyB,MAAM;AAAA,EACjC,OAAO;AAClB;;;ACCA,eAAsB,2BAA0B,CAAC,OAM/B;AAAA,EAChB,MAAM,YAAY,MAAM,0BAA0B;AAAA,IAChD,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,EAAE,MAAM,YAAY,IAAI,MAAM,YAAY,OAAO,MAAM,MAAM;AAAA,IACxE,aAAa,CAAC,aAAa,YAAY,OAAO;AAAA,EAChD,CAAC;AAAA,EACD,IAAI,CAAC,WAAW;AAAA,IACd,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA,EAEA,IAAI,UAAU,OAAO,SAAS,cAAc,UAAU,OAAO,SAAS,SAAS;AAAA,IAC7E,IAAI,UAAU,gBAAgB,WAAW;AAAA,MACvC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AAAA,EAIA,IAAI,UAAU,OAAO,SAAS,aAAa;AAAA,IACzC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA;AAIF,eAAsB,oCAAmC,CAAC,OAOxC;AAAA,EAChB,MAAM,YAAY,MAAM,sBAAsB;AAAA,IAC5C,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,OAAO,MAAM;AAAA,IACb,WAAW,EAAE,MAAM,WAAW,kBAAkB,uBAAsB,MAAM,OAAO,EAAE;AAAA,EACvF,CAAC;AAAA,EACD,IACE,CAAC,aACD,UAAU,OAAO,SAAS,eAC1B,UAAU,OAAO,gBAAgB,MAAM,qBACvC;AAAA,IACA,MAAM,IAAI,kBACR,qBAAqB,MAAM,4DAA4D,MAAM,aAC/F;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CAAC,aAAqB,OAAsB;AAAA,EACnE,MAAM,IAAI,kBACR,qBAAqB,iDAAiD,SACxE;AAAA;",
+  "debugId": "D9BE414225D935D664756E2164756E21",
+  "names": []
+}

package/dist/chunk-d62kjtbg.js.map

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../src/storage/ontology/outbox.ts"],
   "sourcesContent": [
-    "import type { SixbErrorCode, SixbFailure } from \"../../errors/types\"\nimport type { OntologyMaterializationEvent } from \"../../materialization/events\"\n\nexport type {\n  OntologyMaterializationEvent,\n  OntologyMaterializationEventDraft,\n} from \"../../materialization/events\"\n\nexport interface OntologyOutboxWrite {\n  /** Providers may index envelope identity fields, but the envelope remains authoritative. */\n  readonly envelope: OntologyMaterializationEvent\n  readonly availableAt: string\n  readonly createdAt: string\n}\n\n/** Error codes a durable ontology outbox delivery can persist. */\nexport const ONTOLOGY_OUTBOX_FAILURE_CODES = [\"event.delivery_failed\"] as const satisfies readonly [\n  SixbErrorCode,\n  ...SixbErrorCode[],\n]\n\nexport type OntologyOutboxFailureCode = (typeof ONTOLOGY_OUTBOX_FAILURE_CODES)[number]\nexport type OntologyOutboxFailure = SixbFailure<OntologyOutboxFailureCode>\n\nexport interface OntologyOutboxRecord {\n  readonly envelope: OntologyMaterializationEvent\n  readonly availableAt: string\n  readonly attempts: number\n  readonly leaseId: string | null\n  readonly leaseExpiresAt: string | null\n  readonly publishedAt: string | null\n  readonly lastFailure: OntologyOutboxFailure | null\n  readonly createdAt: string\n}\n\nexport interface ClaimOntologyOutboxInput {\n  readonly projectId: string\n  readonly now: string\n  readonly limit: number\n  readonly leaseId: string\n  readonly leaseExpiresAt: string\n}\n\nexport interface ClaimedOntologyOutboxRow extends OntologyOutboxRecord {\n  readonly leaseId: string\n  readonly leaseExpiresAt: string\n}\n\nexport interface CompleteOntologyOutboxLeaseInput {\n  readonly projectId: string\n  readonly ids: readonly string[]\n  readonly leaseId: string\n  readonly publishedAt: string\n}\n\nexport interface RescheduleOntologyOutboxLeaseInput {\n  readonly projectId: string\n  readonly ids: readonly string[]\n  readonly leaseId: string\n  readonly availableAt: string\n  /** The delivery failure that caused this retry. Omitted for lifecycle-only rescheduling. */\n  readonly failure?: OntologyOutboxFailure\n}\n\nexport interface PurgePublishedOntologyOutboxInput {\n  readonly projectId: string\n  readonly publishedBefore: string\n  readonly limit: number\n}\n\nexport interface SummarizeOntologyOutboxInput {\n  readonly projectId: string\n}\n\nexport interface OntologyOutboxSummary {\n  readonly pendingCount: number\n  readonly oldestPendingAt: string | null\n  /** Pending rows that have already been claimed at least once. */\n  readonly retryingCount: number\n  readonly maxAttempts: number\n}\n\n/** Each method is atomic on its own, including validation of the entire lease batch. */\nexport interface OntologyOutboxStorage {\n  /** Selects each claimed batch deterministically; concurrent publishers may complete out of order. */\n  claim(input: ClaimOntologyOutboxInput): Promise<readonly ClaimedOntologyOutboxRow[]>\n  markPublished(input: CompleteOntologyOutboxLeaseInput): Promise<void>\n  reschedule(input: RescheduleOntologyOutboxLeaseInput): Promise<void>\n  purgePublished(input: PurgePublishedOntologyOutboxInput): Promise<number>\n  summarize(input: SummarizeOntologyOutboxInput): Promise<OntologyOutboxSummary>\n}\n"
+    "import type { SixbErrorCode, SixbFailure } from \"../../errors/types\"\nimport type { OntologyMaterializationEvent } from \"../../materialization/events\"\n\nexport type {\n  OntologyMaterializationEvent,\n  OntologyMaterializationEventDraft,\n} from \"../../materialization/events\"\n\n/** Error codes a durable ontology outbox delivery can persist. */\nexport const ONTOLOGY_OUTBOX_FAILURE_CODES = [\"event.delivery_failed\"] as const satisfies readonly [\n  SixbErrorCode,\n  ...SixbErrorCode[],\n]\n\nexport type OntologyOutboxFailureCode = (typeof ONTOLOGY_OUTBOX_FAILURE_CODES)[number]\nexport type OntologyOutboxFailure = SixbFailure<OntologyOutboxFailureCode>\n\nexport interface OntologyOutboxRecord {\n  /**\n   * The event as consumers receive it. Providers store only its draft and rebuild the rest from\n   * its commit.\n   */\n  readonly envelope: OntologyMaterializationEvent\n  readonly availableAt: string\n  readonly attempts: number\n  readonly leaseId: string | null\n  readonly leaseExpiresAt: string | null\n  readonly publishedAt: string | null\n  readonly lastFailure: OntologyOutboxFailure | null\n  readonly createdAt: string\n}\n\nexport interface ClaimOntologyOutboxInput {\n  readonly projectId: string\n  readonly now: string\n  readonly limit: number\n  readonly leaseId: string\n  readonly leaseExpiresAt: string\n}\n\nexport interface ClaimedOntologyOutboxRow extends OntologyOutboxRecord {\n  readonly leaseId: string\n  readonly leaseExpiresAt: string\n}\n\nexport interface CompleteOntologyOutboxLeaseInput {\n  readonly projectId: string\n  readonly ids: readonly string[]\n  readonly leaseId: string\n  readonly publishedAt: string\n}\n\nexport interface RescheduleOntologyOutboxLeaseInput {\n  readonly projectId: string\n  readonly ids: readonly string[]\n  readonly leaseId: string\n  readonly availableAt: string\n  /** The delivery failure that caused this retry. Omitted for lifecycle-only rescheduling. */\n  readonly failure?: OntologyOutboxFailure\n}\n\nexport interface PurgePublishedOntologyOutboxInput {\n  readonly projectId: string\n  readonly publishedBefore: string\n  readonly limit: number\n}\n\nexport interface SummarizeOntologyOutboxInput {\n  readonly projectId: string\n}\n\nexport interface OntologyOutboxSummary {\n  readonly pendingCount: number\n  readonly oldestPendingAt: string | null\n  /** Pending rows that have already been claimed at least once. */\n  readonly retryingCount: number\n  readonly maxAttempts: number\n}\n\n/** Each method is atomic on its own, including validation of the entire lease batch. */\nexport interface OntologyOutboxStorage {\n  /** Selects each claimed batch deterministically; concurrent publishers may complete out of order. */\n  claim(input: ClaimOntologyOutboxInput): Promise<readonly ClaimedOntologyOutboxRow[]>\n  markPublished(input: CompleteOntologyOutboxLeaseInput): Promise<void>\n  reschedule(input: RescheduleOntologyOutboxLeaseInput): Promise<void>\n  purgePublished(input: PurgePublishedOntologyOutboxInput): Promise<number>\n  summarize(input: SummarizeOntologyOutboxInput): Promise<OntologyOutboxSummary>\n}\n"
   ],
-  "mappings": ";;AAgBO,IAAM,iCAAgC,CAAC,uBAAuB;",
+  "mappings": ";;AASO,IAAM,iCAAgC,CAAC,uBAAuB;",
   "debugId": "6CB44AB153CCE5CD64756E2164756E21",
   "names": []
 }

package/dist/{chunk-gkxsenvp.js → chunk-de4z2bj6.js}

@@ -9,23 +9,23 @@ import {
 } from "./chunk-vjcd8d27.js";
 import {
   createKernelRuntimeAuthorization
-} from "./chunk-69kt9q43.js";
+} from "./chunk-qkbx3tf6.js";
 import {
   estimateModelCall
-} from "./chunk-tnvafr7g.js";
+} from "./chunk-29yx306f.js";
 import {
   vectorConfiguration,
   vectorSources,
   normalizeVector2,
   VECTOR_INDEXING_FAILURE_CODES2
-} from "./chunk-6z1q7j19.js";
+} from "./chunk-qq90g05n.js";
 import {
   ModelExecutionSession
-} from "./chunk-chdg6eqq.js";
+} from "./chunk-k6hrnf35.js";
 import {
   executionRecordInputFromRuntime,
   ensureExecutionRecord2
-} from "./chunk-7g2gjvah.js";
+} from "./chunk-ex496vct.js";
 import {
   MaterializationConflictError2
 } from "./chunk-96yw3pwd.js";
@@ -555,6 +555,30 @@ function getVectorIndexingRuntime2(host) {
   return runtime;
 }
 
-export { bindEmbeddingModels, VectorIndexingDeferred2, createVectorIndexingRuntime, registerVectorIndexingRuntime, getVectorIndexingRuntime2 };
+// src/runtime/public-origin.ts
+var apiPublicOrigins = new WeakMap;
+function setApiPublicOrigin2(host, origin) {
+  apiPublicOrigins.set(host, normalizeOrigin(origin));
+}
+function getApiPublicOrigin(host) {
+  return apiPublicOrigins.get(host);
+}
+function normalizeOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`[Sixb] Invalid API public origin: '${value}'.`);
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("[Sixb] The API public origin must use http or https.");
+  }
+  if (url.pathname !== "/" || url.search || url.hash) {
+    throw new Error("[Sixb] The API public origin must be an origin, not a full URL.");
+  }
+  return url.origin;
+}
+
+export { bindEmbeddingModels, VectorIndexingDeferred2, createVectorIndexingRuntime, registerVectorIndexingRuntime, getVectorIndexingRuntime2, setApiPublicOrigin2, getApiPublicOrigin };
 
-//# debugId=B3DAC5AAE8C25E2B64756E2164756E21
+//# debugId=2C71EF9B86846F7764756E2164756E21

package/dist/{chunk-gkxsenvp.js.map → chunk-de4z2bj6.js.map}

@@ -1,6 +1,6 @@
 {
   "version": 3,
-  "sources": ["../src/objects/vectors/indexing-shared.ts", "../src/models/execution/embedding.ts", "../src/objects/vectors/indexing-generate.ts", "../src/objects/vectors/indexing-single.ts", "../src/objects/vectors/indexing-store-batch.ts", "../src/objects/vectors/indexing-batch.ts", "../src/objects/vectors/indexing.ts", "../src/objects/vectors/indexing-runtime.ts"],
+  "sources": ["../src/objects/vectors/indexing-shared.ts", "../src/models/execution/embedding.ts", "../src/objects/vectors/indexing-generate.ts", "../src/objects/vectors/indexing-single.ts", "../src/objects/vectors/indexing-store-batch.ts", "../src/objects/vectors/indexing-batch.ts", "../src/objects/vectors/indexing.ts", "../src/objects/vectors/indexing-runtime.ts", "../src/runtime/public-origin.ts"],
   "sourcesContent": [
     "import { randomUUID } from \"node:crypto\"\nimport { reportVectorIndexingFailure } from \"../../error-reporting/capability\"\nimport { captureSixbFailure } from \"../../errors/internal\"\nimport { createKernelRuntimeAuthorization } from \"../../execution/authorization\"\nimport { ensureExecutionRecord, executionRecordInputFromRuntime } from \"../../execution/durable\"\nimport type { ExecutionContext, ExecutionScope } from \"../../execution/types\"\nimport { MaterializationConflictError } from \"../../materialization/errors\"\nimport type { ObjectVectorWrite, PreparedObjectVector } from \"../../materialization/vectors\"\nimport type { OntologyMaterializerContract } from \"../../materializer/materializer\"\nimport type { SixbHostContext } from \"../../runtime/types\"\nimport {\n  type OntologyVectorIndexingStorage,\n  VECTOR_INDEXING_FAILURE_CODES,\n  type VectorIndexingWork,\n} from \"../../storage/ontology/vector-indexing\"\nimport { vectorConfiguration, vectorSources } from \"./profile\"\n\n/** Return null when the requested representation is obsolete or already stored. */\nexport async function prepare(\n  runtime: SixbHostContext,\n  work: VectorIndexingWork\n): Promise<PreparedObjectVector | null> {\n  const profile = runtime.ontology.getObjectTypeById(work.ref.objectTypeId)?.search?.vectors?.[\n    work.profile\n  ]\n  if (!profile || vectorConfiguration(profile) !== work.configuration) return null\n\n  const row = await runtime.storage.objects.getByPrimaryId({\n    projectId: runtime.projectId,\n    ...work.ref,\n  })\n  if (!row) return null\n\n  const sources = vectorSources(profile.source, row.properties)\n  if (sources.sourceFingerprint !== work.sourceFingerprint) return null\n\n  const storedVectors = await runtime.storage.ontology.vectors!.list({\n    projectId: runtime.projectId,\n    ref: work.ref,\n  })\n  const currentVector = storedVectors.find((entry) => entry.profile === work.profile)\n  const alreadyIndexed =\n    currentVector?.configuration === work.configuration &&\n    currentVector.sourceFingerprint === work.sourceFingerprint\n\n  if (alreadyIndexed) return null\n\n  return {\n    projectId: runtime.projectId,\n    ref: work.ref,\n    profile: work.profile,\n    configuration: work.configuration,\n    ...sources,\n    expectedObject: {\n      ref: work.ref,\n      exists: true,\n      version: row.version,\n      lastCommitId: row.lastCommitId,\n    },\n    expectedVectorCommitId: currentVector?.lastCommitId ?? null,\n  }\n}\n\nexport async function storeVector(\n  runtime: SixbHostContext,\n  materializer: OntologyMaterializerContract,\n  work: VectorIndexingWork,\n  scope: ExecutionScope,\n  signal: AbortSignal\n): Promise<void> {\n  const indexing = runtime.storage.ontology.vectorIndexing!\n  const identity = { projectId: runtime.projectId, id: work.id }\n\n  // Unrelated property changes renew the object fence without repeating a paid inference.\n  for (let attempt = 0; attempt < 3; attempt++) {\n    signal.throwIfAborted()\n    const prepared = await prepare(runtime, work)\n\n    if (!prepared) {\n      await indexing.remove(identity)\n      return\n    }\n\n    try {\n      await commitPreparedVectors(materializer, scope, [{ input: prepared, values: work.values! }])\n      await indexing.remove(identity)\n      return\n    } catch (error) {\n      if (!(error instanceof MaterializationConflictError)) throw error\n\n      const currentWork = await indexing.get(identity)\n      if (!currentWork) return\n    }\n  }\n\n  throw new VectorIndexingDeferred(new Date(Date.now() + 1000).toISOString())\n}\n\nexport async function commitPreparedVectors(\n  materializer: OntologyMaterializerContract,\n  scope: ExecutionScope,\n  writes: readonly ObjectVectorWrite[]\n): Promise<void> {\n  await materializer.edits.commit({\n    scope,\n    input: {\n      mode: \"atomic\",\n      source: { kind: \"runtime\", requestId: randomUUID() },\n      operations: [],\n      vectorWrites: writes,\n      expectedObjects: writes.map((write) => write.input.expectedObject),\n      expectedLinks: [],\n      expectedLinkScopes: [],\n    },\n  })\n}\n\nexport async function indexingScope(\n  runtime: SixbHostContext,\n  work: VectorIndexingWork,\n  indexingId = work.id\n): Promise<ExecutionScope> {\n  const operation = { type: \"ontology.indexVectors\", indexingId } as const\n  const execution: ExecutionContext = {\n    id: `exec_vector_${indexingId}`,\n    projectId: runtime.projectId,\n    executor: { type: \"kernel\", operation },\n    source: { type: \"ontologyCommit\", commitId: work.sourceCommitId },\n    correlationId: `vector_${indexingId}`,\n  }\n  const authorization = createKernelRuntimeAuthorization({ execution, operation })\n\n  await ensureExecutionRecord(runtime.storage.executions, {\n    ...executionRecordInputFromRuntime({ execution, runtimeAuthorization: authorization }),\n    requesterGroupIds: [],\n  })\n\n  return { execution, authorization }\n}\n\nexport async function fail(\n  runtime: SixbHostContext,\n  indexing: OntologyVectorIndexingStorage,\n  work: VectorIndexingWork,\n  error: unknown\n): Promise<void> {\n  const failure = captureSixbFailure(error, {\n    allowedCodes: VECTOR_INDEXING_FAILURE_CODES,\n    defaultCode: \"internal.unexpected\",\n  })\n\n  const recorded = await indexing.update({\n    projectId: runtime.projectId,\n    id: work.id,\n    expectedStatus: work.status,\n    status: \"failed\",\n    availableAt: new Date().toISOString(),\n    error: failure,\n  })\n\n  if (!recorded) return\n\n  reportVectorIndexingFailure(runtime, error, {\n    projectId: runtime.projectId,\n    indexingId: work.id,\n    failure,\n    ...work.ref,\n    profile: work.profile,\n  })\n}\n\nexport function retryAt(details: unknown): string {\n  const resetAt =\n    details && typeof details === \"object\" && \"resetAt\" in details ? details.resetAt : undefined\n  const resetTimestamp = typeof resetAt === \"string\" ? Date.parse(resetAt) : Number.NaN\n\n  const minimumRetryTimestamp = Date.now() + 60_000\n  const budgetResetTimestamp = Number.isFinite(resetTimestamp) ? resetTimestamp : 0\n  const retryTimestamp = Math.max(minimumRetryTimestamp, budgetResetTimestamp)\n\n  return new Date(retryTimestamp).toISOString()\n}\n\nexport class VectorIndexingDeferred extends Error {\n  constructor(readonly availableAt: string) {\n    super(\"[Sixb] Vector indexing is deferred.\")\n  }\n}\n",
     "import { randomUUID } from \"node:crypto\"\nimport type { EmbeddingModelCatalog, EmbeddingModelEntry, ModelRef } from \"../catalog\"\nimport {\n  assertEmbeddingModel,\n  type EmbeddingModel,\n  type EmbeddingModelRequest,\n  EmbeddingModelResponseError,\n  type EmbeddingModelResponseMetadata,\n  type EmbeddingModelResult,\n  sameEmbeddingModel,\n} from \"../embedding-model\"\nimport { estimateModelCall } from \"../pricing\"\nimport type { AiModelCallRecorder } from \"./model-call-recorder\"\nimport type { ModelExecutionSession } from \"./session\"\n\n/** Scope the configured bindings without changing profile identity or object permissions. */\nexport function bindEmbeddingModels(\n  catalog: EmbeddingModelCatalog | undefined,\n  session: ModelExecutionSession\n): EmbeddingModelCatalog | undefined {\n  if (!catalog) return undefined\n  const entries: readonly EmbeddingModelEntry[] = Object.freeze(\n    catalog.list().map((entry) =>\n      Object.freeze({\n        ...entry,\n        model: Object.freeze({\n          providerId: entry.model.providerId,\n          modelId: entry.model.modelId,\n          definition: entry.model.definition,\n          batching: entry.model.batching && Object.freeze({ ...entry.model.batching }),\n          embed: (input: EmbeddingModelRequest) => executeEmbedding(session, entry.model, input),\n        }),\n      })\n    )\n  )\n  const byRef = new Map(\n    entries.map((entry) => [JSON.stringify([entry.provider, entry.modelId]), entry])\n  )\n  return Object.freeze({\n    list: () => entries,\n    getByRef: (ref: ModelRef) => byRef.get(JSON.stringify([ref.provider, ref.modelId])) ?? null,\n  })\n}\n\nasync function executeEmbedding(\n  session: ModelExecutionSession,\n  binding: EmbeddingModel,\n  input: EmbeddingModelRequest\n) {\n  if (\n    !Array.isArray(input.texts) ||\n    input.texts.some((text) => typeof text !== \"string\" || !text.trim())\n  ) {\n    throw new TypeError(\"[SixbModels] Embedding inputs must be nonempty strings.\")\n  }\n  const texts = [...input.texts]\n  const purpose = input.purpose\n  if (purpose !== undefined && purpose !== \"document\" && purpose !== \"query\") {\n    throw new TypeError(\"[SixbModels] Embedding purpose must be 'document' or 'query'.\")\n  }\n  const signal = session.signal(input.signal)\n  const requestSignal = AbortSignal.any([signal, AbortSignal.timeout(30_000)])\n  requestSignal.throwIfAborted()\n  if (!texts.length) return { vectors: [] }\n\n  const accounting = await session.accounting()\n  accounting.assertHealthy()\n  const model = (await binding.resolve?.()) ?? binding\n  assertEmbeddingModel(model)\n  if (!sameEmbeddingModel(model, binding)) {\n    throw new TypeError(\n      \"[SixbModels] Resolved embedding model identity does not match the selected model.\"\n    )\n  }\n  requestSignal.throwIfAborted()\n  const callId = `call_${randomUUID()}`\n  const tokens = texts.reduce(\n    (sum, text) => sum + Math.ceil(new TextEncoder().encode(text).byteLength / 4),\n    0\n  )\n  await session.admitEmbeddingCall(() =>\n    accounting.admitCall({\n      callId,\n      providerId: model.providerId,\n      modelId: model.modelId,\n      costEstimator: model.costEstimator,\n      inputTokens: { status: \"estimated\", tokens, method: \"utf8BytesDividedByFour\" },\n      outputTokenAllowance: 0,\n      estimatedTotalTokens: tokens,\n    })\n  )\n\n  let result: EmbeddingModelResult\n  try {\n    requestSignal.throwIfAborted()\n    result = await model.embed({ texts, purpose, signal: requestSignal })\n  } catch (error) {\n    if (error instanceof EmbeddingModelResponseError) {\n      await recordEmbedding(accounting, model, callId, error.metadata)\n    } else {\n      // The provider may have accepted the request. Never retry inference or release its budget.\n      await recordEmbedding(accounting, model, callId, {})\n    }\n    throw error\n  }\n  // Account before cancellation, vector validation or the materializer's optimistic write.\n  await recordEmbedding(accounting, model, callId, result ?? {})\n  requestSignal.throwIfAborted()\n  return result\n}\n\nasync function recordEmbedding(\n  accounting: AiModelCallRecorder,\n  model: EmbeddingModel,\n  callId: string,\n  metadata: EmbeddingModelResponseMetadata\n): Promise<void> {\n  // Embeddings produce no output tokens; missing INPUT usage must remain unknown.\n  const usage = { ...metadata.usage, outputTokens: 0 }\n  const estimate = estimateModelCall(model, {\n    usage,\n    route: metadata.route,\n    responseModelId: metadata.responseModelId,\n  })\n  await accounting.onModelCallEnd({\n    callId,\n    providerId: model.providerId,\n    modelId: model.modelId,\n    responseId: metadata.providerIds?.responseId ?? callId,\n    responseModelId: metadata.responseModelId,\n    providerIds: metadata.providerIds,\n    usage,\n    cost: metadata.reportedCost ? { status: \"reported\", ...metadata.reportedCost } : estimate,\n    ...(metadata.reportedCost ? { estimate } : {}),\n    route: metadata.route,\n  })\n}\n",
@@ -9,9 +9,10 @@
     "import type { ExecutionScope } from \"../../execution/types\"\nimport { MaterializationConflictError } from \"../../materialization/errors\"\nimport type { ObjectVectorWrite } from \"../../materialization/vectors\"\nimport type { OntologyMaterializerContract } from \"../../materializer/materializer\"\nimport type { SixbHostContext } from \"../../runtime/types\"\nimport {\n  commitPreparedVectors,\n  prepare,\n  storeVector,\n  VectorIndexingDeferred,\n} from \"./indexing-shared\"\n\n/** Publish a current subset atomically; reprepare conflicts without repeating inference. */\nexport async function storeVectorBatch(\n  runtime: SixbHostContext,\n  materializer: OntologyMaterializerContract,\n  batchId: string,\n  scope: ExecutionScope,\n  signal: AbortSignal\n): Promise<void> {\n  const indexing = runtime.storage.ontology.vectorIndexing!\n  const identity = { projectId: runtime.projectId, batchId }\n\n  for (let attempt = 0; attempt < 3; attempt++) {\n    const ready = (await indexing.getBatch(identity)).filter((work) => work.status === \"ready\")\n    const writes: ObjectVectorWrite[] = []\n\n    for (const work of ready) {\n      signal.throwIfAborted()\n      const input = await prepare(runtime, work)\n      if (input) {\n        writes.push({ input, values: work.values! })\n      } else {\n        await indexing.remove({ projectId: runtime.projectId, id: work.id })\n      }\n    }\n\n    if (!writes.length) return\n\n    try {\n      signal.throwIfAborted()\n      await commitPreparedVectors(materializer, scope, writes)\n      return\n    } catch (error) {\n      if (!(error instanceof MaterializationConflictError)) throw error\n    }\n  }\n\n  // A continuously changing object must not keep stable peers from becoming searchable.\n  let deferred = false\n  for (const work of await indexing.getBatch(identity)) {\n    if (work.status !== \"ready\") continue\n    try {\n      await storeVector(runtime, materializer, work, scope, signal)\n    } catch (error) {\n      if (!(error instanceof VectorIndexingDeferred)) throw error\n      deferred = true\n    }\n  }\n\n  if (deferred) throw new VectorIndexingDeferred(new Date(Date.now() + 1000).toISOString())\n}\n",
     "import type { OntologyMaterializerContract } from \"../../materializer/materializer\"\nimport type { EmbeddingBatchLimits } from \"../../models/embedding-model\"\nimport type { SixbHostContext } from \"../../runtime/types\"\nimport type { VectorIndexingWork } from \"../../storage/ontology/vector-indexing\"\nimport { generateVectors, type PreparedIndexingWork } from \"./indexing-generate\"\nimport { indexingScope, prepare, VectorIndexingDeferred } from \"./indexing-shared\"\nimport { processVector } from \"./indexing-single\"\nimport { storeVectorBatch } from \"./indexing-store-batch\"\n\n/** Membership was persisted by one projection commit; there is no fill timer or memory queue. */\nexport async function processVectorBatch(\n  runtime: SixbHostContext,\n  materializer: OntologyMaterializerContract,\n  batchId: string,\n  batch: readonly VectorIndexingWork[],\n  attempt: number,\n  signal: AbortSignal\n): Promise<void> {\n  if (batch.some((work) => work.status !== \"pending\")) {\n    await resumeBatch(runtime, materializer, batchId, batch, attempt, signal)\n    return\n  }\n\n  const entries = await prepareBatch(runtime, batch, signal)\n  const first = entries[0]\n  if (!first) return\n\n  const limits = getBatchLimits(runtime, first.work)\n  if (!limits) {\n    // Unknown provider batch limits: embed each object/profile individually.\n    for (const { work } of entries) {\n      await processVector(runtime, materializer, work.id, attempt, signal)\n    }\n    return\n  }\n\n  assertCompatibleEntries(entries, first.work)\n  const scope = await indexingScope(runtime, first.work, batchId)\n\n  for (const group of partition(entries, limits)) {\n    if (group.length === 1) {\n      await processVector(runtime, materializer, group[0]!.work.id, attempt, signal)\n    } else {\n      await generateVectors(runtime, group, scope, attempt, signal)\n    }\n  }\n\n  await storeVectorBatch(runtime, materializer, batchId, scope, signal)\n}\n\n/** Resume storage or terminalize interrupted calls; never repeat paid inference. */\nasync function resumeBatch(\n  runtime: SixbHostContext,\n  materializer: OntologyMaterializerContract,\n  batchId: string,\n  batch: readonly VectorIndexingWork[],\n  attempt: number,\n  signal: AbortSignal\n): Promise<void> {\n  const ready = batch.find((work) => work.status === \"ready\")\n  if (ready) {\n    const scope = await indexingScope(runtime, ready, batchId)\n    await storeVectorBatch(runtime, materializer, batchId, scope, signal)\n  }\n\n  for (const work of batch) {\n    if (work.status !== \"ready\") {\n      await processVector(runtime, materializer, work.id, attempt, signal)\n    }\n  }\n}\n\nasync function prepareBatch(\n  runtime: SixbHostContext,\n  batch: readonly VectorIndexingWork[],\n  signal: AbortSignal\n): Promise<PreparedIndexingWork[]> {\n  const availableAt = batch.reduce(\n    (latest, work) => (work.availableAt > latest ? work.availableAt : latest),\n    \"\"\n  )\n  if (Date.parse(availableAt) > Date.now()) {\n    throw new VectorIndexingDeferred(availableAt)\n  }\n\n  const entries: PreparedIndexingWork[] = []\n  const indexing = runtime.storage.ontology.vectorIndexing!\n\n  for (const work of batch) {\n    signal.throwIfAborted()\n    const input = await prepare(runtime, work)\n\n    if (input) {\n      entries.push({ work, input })\n    } else {\n      await indexing.remove({ projectId: runtime.projectId, id: work.id })\n    }\n  }\n\n  return entries\n}\n\nfunction getBatchLimits(\n  runtime: SixbHostContext,\n  work: VectorIndexingWork\n): EmbeddingBatchLimits | undefined {\n  const profile = runtime.ontology.resolveObjectType(work.ref.objectTypeId).search!.vectors![\n    work.profile\n  ]!\n\n  return runtime.embeddingModels?.getByRef({\n    provider: profile.model.providerId,\n    modelId: profile.model.modelId,\n  })?.model.batching\n}\n\n/** Do not mix commits or configurations, even with malformed storage membership. */\nfunction assertCompatibleEntries(\n  entries: readonly PreparedIndexingWork[],\n  reference: VectorIndexingWork\n): void {\n  const incompatible = entries.some(\n    ({ work }) =>\n      work.sourceCommitId !== reference.sourceCommitId ||\n      work.ref.objectTypeId !== reference.ref.objectTypeId ||\n      work.profile !== reference.profile ||\n      work.configuration !== reference.configuration\n  )\n\n  if (incompatible) {\n    throw new Error(\"[Sixb] Incompatible vector batch membership.\")\n  }\n}\n\n/** Split an already durable, bounded page; never wait for more work or truncate input. */\nfunction* partition(entries: readonly PreparedIndexingWork[], limits: EmbeddingBatchLimits) {\n  let group: PreparedIndexingWork[] = []\n  let bytes = 0\n\n  for (const entry of entries) {\n    const size = Buffer.byteLength(entry.input.text)\n    const exceedsGroupLimit =\n      group.length >= limits.maxInputs ||\n      bytes + size > limits.maxTotalInputBytes ||\n      size > limits.maxInputBytes\n\n    if (group.length > 0 && exceedsGroupLimit) {\n      yield group\n      group = []\n      bytes = 0\n    }\n\n    if (size > limits.maxInputBytes || size > limits.maxTotalInputBytes) {\n      yield [entry]\n      continue\n    }\n\n    group.push(entry)\n    bytes += size\n  }\n\n  if (group.length > 0) yield group\n}\n",
     "import type { OntologyMaterializerContract } from \"../../materializer/materializer\"\nimport type { SixbHostContext } from \"../../runtime/types\"\nimport { processVectorBatch } from \"./indexing-batch\"\nimport type { VectorIndexingRuntime } from \"./indexing-runtime\"\nimport { processVector } from \"./indexing-single\"\n\nexport { VectorIndexingDeferred } from \"./indexing-shared\"\n\n/** Internal processing port; durable projection groups and individual requests share delivery. */\nexport function createVectorIndexingRuntime(\n  runtime: SixbHostContext,\n  materializer: OntologyMaterializerContract\n): VectorIndexingRuntime {\n  return {\n    async process(id, attempt, signal) {\n      const indexing = runtime.storage.ontology.vectorIndexing\n      if (!indexing) throw new Error(\"[Sixb] Storage does not support automatic vector indexing.\")\n      const batch = await indexing.getBatch({ projectId: runtime.projectId, batchId: id })\n      if (batch.length) await processVectorBatch(runtime, materializer, id, batch, attempt, signal)\n      else await processVector(runtime, materializer, id, attempt, signal)\n    },\n  }\n}\n",
-    "/** Internal worker entry point; it does not expose the host context or domain SDK. */\nexport interface VectorIndexingRuntime {\n  process(id: string, attempt: number, signal: AbortSignal): Promise<void>\n}\n\n// Associates each host with its service. Durable work lives in ontology storage, not this map.\nconst runtimes = new WeakMap<object, VectorIndexingRuntime>()\n\nexport function registerVectorIndexingRuntime(host: object, runtime: VectorIndexingRuntime): void {\n  runtimes.set(host, runtime)\n}\n\nexport function getVectorIndexingRuntime(host: object): VectorIndexingRuntime {\n  const runtime = runtimes.get(host)\n  if (!runtime) throw new Error(\"[Sixb] Vector indexing requires a configured Sixb host.\")\n  return runtime\n}\n"
+    "/** Internal worker entry point; it does not expose the host context or domain SDK. */\nexport interface VectorIndexingRuntime {\n  process(id: string, attempt: number, signal: AbortSignal): Promise<void>\n}\n\n// Associates each host with its service. Durable work lives in ontology storage, not this map.\nconst runtimes = new WeakMap<object, VectorIndexingRuntime>()\n\nexport function registerVectorIndexingRuntime(host: object, runtime: VectorIndexingRuntime): void {\n  runtimes.set(host, runtime)\n}\n\nexport function getVectorIndexingRuntime(host: object): VectorIndexingRuntime {\n  const runtime = runtimes.get(host)\n  if (!runtime) throw new Error(\"[Sixb] Vector indexing requires a configured Sixb host.\")\n  return runtime\n}\n",
+    "/**\n * The origin the API is reachable at from outside, for features that hand out absolute URLs a\n * third party will fetch. It is deployment topology, not app configuration: the API server\n * records the `publicOrigin` it was started with, and the CLI records `SIXB_API_PUBLIC_ORIGIN`\n * for worker processes. A process that never learns it cannot issue such URLs.\n */\n\nconst apiPublicOrigins = new WeakMap<object, string>()\n\n/** Record where the API is reachable. A host served by several servers keeps the latest one. */\nexport function setApiPublicOrigin(host: object, origin: string): void {\n  apiPublicOrigins.set(host, normalizeOrigin(origin))\n}\n\nexport function getApiPublicOrigin(host: object): string | undefined {\n  return apiPublicOrigins.get(host)\n}\n\nfunction normalizeOrigin(value: string): string {\n  let url: URL\n  try {\n    url = new URL(value)\n  } catch {\n    throw new Error(`[Sixb] Invalid API public origin: '${value}'.`)\n  }\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n    throw new Error(\"[Sixb] The API public origin must use http or https.\")\n  }\n  if (url.pathname !== \"/\" || url.search || url.hash) {\n    throw new Error(\"[Sixb] The API public origin must be an origin, not a full URL.\")\n  }\n  return url.origin\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAkBA,eAAsB,OAAO,CAC3B,SACA,MACsC;AAAA,EACtC,MAAM,UAAU,QAAQ,SAAS,kBAAkB,KAAK,IAAI,YAAY,GAAG,QAAQ,UACjF,KAAK;AAAA,EAEP,IAAI,CAAC,WAAW,oBAAoB,OAAO,MAAM,KAAK;AAAA,IAAe,OAAO;AAAA,EAE5E,MAAM,MAAM,MAAM,QAAQ,QAAQ,QAAQ,eAAe;AAAA,IACvD,WAAW,QAAQ;AAAA,OAChB,KAAK;AAAA,EACV,CAAC;AAAA,EACD,IAAI,CAAC;AAAA,IAAK,OAAO;AAAA,EAEjB,MAAM,UAAU,cAAc,QAAQ,QAAQ,IAAI,UAAU;AAAA,EAC5D,IAAI,QAAQ,sBAAsB,KAAK;AAAA,IAAmB,OAAO;AAAA,EAEjE,MAAM,gBAAgB,MAAM,QAAQ,QAAQ,SAAS,QAAS,KAAK;AAAA,IACjE,WAAW,QAAQ;AAAA,IACnB,KAAK,KAAK;AAAA,EACZ,CAAC;AAAA,EACD,MAAM,gBAAgB,cAAc,KAAK,CAAC,UAAU,MAAM,YAAY,KAAK,OAAO;AAAA,EAClF,MAAM,iBACJ,eAAe,kBAAkB,KAAK,iBACtC,cAAc,sBAAsB,KAAK;AAAA,EAE3C,IAAI;AAAA,IAAgB,OAAO;AAAA,EAE3B,OAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,KAAK,KAAK;AAAA,IACV,SAAS,KAAK;AAAA,IACd,eAAe,KAAK;AAAA,OACjB;AAAA,IACH,gBAAgB;AAAA,MACd,KAAK,KAAK;AAAA,MACV,QAAQ;AAAA,MACR,SAAS,IAAI;AAAA,MACb,cAAc,IAAI;AAAA,IACpB;AAAA,IACA,wBAAwB,eAAe,gBAAgB;AAAA,EACzD;AAAA;AAGF,eAAsB,WAAW,CAC/B,SACA,cACA,MACA,OACA,QACe;AAAA,EACf,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAC1C,MAAM,WAAW,EAAE,WAAW,QAAQ,WAAW,IAAI,KAAK,GAAG;AAAA,EAG7D,SAAS,UAAU,EAAG,UAAU,GAAG,WAAW;AAAA,IAC5C,OAAO,eAAe;AAAA,IACtB,MAAM,WAAW,MAAM,QAAQ,SAAS,IAAI;AAAA,IAE5C,IAAI,CAAC,UAAU;AAAA,MACb,MAAM,SAAS,OAAO,QAAQ;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,IAAI;AAAA,MACF,MAAM,sBAAsB,cAAc,OAAO,CAAC,EAAE,OAAO,UAAU,QAAQ,KAAK,OAAQ,CAAC,CAAC;AAAA,MAC5F,MAAM,SAAS,OAAO,QAAQ;AAAA,MAC9B;AAAA,MACA,OAAO,OAAO;AAAA,MACd,IAAI,EAAE,iBAAiB;AAAA,QAA+B,MAAM;AAAA,MAE5D,MAAM,cAAc,MAAM,SAAS,IAAI,QAAQ;AAAA,MAC/C,IAAI,CAAC;AAAA,QAAa;AAAA;AAAA,EAEtB;AAAA,EAEA,MAAM,IAAI,wBAAuB,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,EAAE,YAAY,CAAC;AAAA;AAG5E,eAAsB,qBAAqB,CACzC,cACA,OACA,QACe;AAAA,EACf,MAAM,aAAa,MAAM,OAAO;AAAA,IAC9B;AAAA,IACA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ,EAAE,MAAM,WAAW,WAAW,WAAW,EAAE;AAAA,MACnD,YAAY,CAAC;AAAA,MACb,cAAc;AAAA,MACd,iBAAiB,OAAO,IAAI,CAAC,UAAU,MAAM,MAAM,cAAc;AAAA,MACjE,eAAe,CAAC;AAAA,MAChB,oBAAoB,CAAC;AAAA,IACvB;AAAA,EACF,CAAC;AAAA;AAGH,eAAsB,aAAa,CACjC,SACA,MACA,aAAa,KAAK,IACO;AAAA,EACzB,MAAM,YAAY,EAAE,MAAM,yBAAyB,WAAW;AAAA,EAC9D,MAAM,YAA8B;AAAA,IAClC,IAAI,eAAe;AAAA,IACnB,WAAW,QAAQ;AAAA,IACnB,UAAU,EAAE,MAAM,UAAU,UAAU;AAAA,IACtC,QAAQ,EAAE,MAAM,kBAAkB,UAAU,KAAK,eAAe;AAAA,IAChE,eAAe,UAAU;AAAA,EAC3B;AAAA,EACA,MAAM,gBAAgB,iCAAiC,EAAE,WAAW,UAAU,CAAC;AAAA,EAE/E,MAAM,uBAAsB,QAAQ,QAAQ,YAAY;AAAA,OACnD,gCAAgC,EAAE,WAAW,sBAAsB,cAAc,CAAC;AAAA,IACrF,mBAAmB,CAAC;AAAA,EACtB,CAAC;AAAA,EAED,OAAO,EAAE,WAAW,cAAc;AAAA;AAGpC,eAAsB,IAAI,CACxB,SACA,UACA,MACA,OACe;AAAA,EACf,MAAM,UAAU,oBAAmB,OAAO;AAAA,IACxC,cAAc;AAAA,IACd,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,WAAW,MAAM,SAAS,OAAO;AAAA,IACrC,WAAW,QAAQ;AAAA,IACnB,IAAI,KAAK;AAAA,IACT,gBAAgB,KAAK;AAAA,IACrB,QAAQ;AAAA,IACR,aAAa,IAAI,KAAK,EAAE,YAAY;AAAA,IACpC,OAAO;AAAA,EACT,CAAC;AAAA,EAED,IAAI,CAAC;AAAA,IAAU;AAAA,EAEf,4BAA4B,SAAS,OAAO;AAAA,IAC1C,WAAW,QAAQ;AAAA,IACnB,YAAY,KAAK;AAAA,IACjB;AAAA,OACG,KAAK;AAAA,IACR,SAAS,KAAK;AAAA,EAChB,CAAC;AAAA;AAGI,SAAS,OAAO,CAAC,SAA0B;AAAA,EAChD,MAAM,UACJ,WAAW,OAAO,YAAY,YAAY,aAAa,UAAU,QAAQ,UAAU;AAAA,EACrF,MAAM,iBAAiB,OAAO,YAAY,WAAW,KAAK,MAAM,OAAO,IAAI,OAAO;AAAA,EAElF,MAAM,wBAAwB,KAAK,IAAI,IAAI;AAAA,EAC3C,MAAM,uBAAuB,OAAO,SAAS,cAAc,IAAI,iBAAiB;AAAA,EAChF,MAAM,iBAAiB,KAAK,IAAI,uBAAuB,oBAAoB;AAAA,EAE3E,OAAO,IAAI,KAAK,cAAc,EAAE,YAAY;AAAA;AAAA;AAGvC,MAAM,gCAA+B,MAAM;AAAA,EAC3B;AAAA,EAArB,WAAW,CAAU,aAAqB;AAAA,IACxC,MAAM,qCAAqC;AAAA,IADxB;AAAA;AAGvB;;;AC3LA,uBAAS;AAgBF,SAAS,mBAAmB,CACjC,SACA,SACmC;AAAA,EACnC,IAAI,CAAC;AAAA,IAAS;AAAA,EACd,MAAM,UAA0C,OAAO,OACrD,QAAQ,KAAK,EAAE,IAAI,CAAC,UAClB,OAAO,OAAO;AAAA,OACT;AAAA,IACH,OAAO,OAAO,OAAO;AAAA,MACnB,YAAY,MAAM,MAAM;AAAA,MACxB,SAAS,MAAM,MAAM;AAAA,MACrB,YAAY,MAAM,MAAM;AAAA,MACxB,UAAU,MAAM,MAAM,YAAY,OAAO,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAAA,MAC3E,OAAO,CAAC,UAAiC,iBAAiB,SAAS,MAAM,OAAO,KAAK;AAAA,IACvF,CAAC;AAAA,EACH,CAAC,CACH,CACF;AAAA,EACA,MAAM,QAAQ,IAAI,IAChB,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,UAAU,CAAC,MAAM,UAAU,MAAM,OAAO,CAAC,GAAG,KAAK,CAAC,CACjF;AAAA,EACA,OAAO,OAAO,OAAO;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,UAAU,CAAC,QAAkB,MAAM,IAAI,KAAK,UAAU,CAAC,IAAI,UAAU,IAAI,OAAO,CAAC,CAAC,KAAK;AAAA,EACzF,CAAC;AAAA;AAGH,eAAe,gBAAgB,CAC7B,SACA,SACA,OACA;AAAA,EACA,IACE,CAAC,MAAM,QAAQ,MAAM,KAAK,KAC1B,MAAM,MAAM,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,CAAC,KAAK,KAAK,CAAC,GACnE;AAAA,IACA,MAAM,IAAI,UAAU,yDAAyD;AAAA,EAC/E;AAAA,EACA,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK;AAAA,EAC7B,MAAM,UAAU,MAAM;AAAA,EACtB,IAAI,YAAY,aAAa,YAAY,cAAc,YAAY,SAAS;AAAA,IAC1E,MAAM,IAAI,UAAU,+DAA+D;AAAA,EACrF;AAAA,EACA,MAAM,SAAS,QAAQ,OAAO,MAAM,MAAM;AAAA,EAC1C,MAAM,gBAAgB,YAAY,IAAI,CAAC,QAAQ,YAAY,QAAQ,KAAM,CAAC,CAAC;AAAA,EAC3E,cAAc,eAAe;AAAA,EAC7B,IAAI,CAAC,MAAM;AAAA,IAAQ,OAAO,EAAE,SAAS,CAAC,EAAE;AAAA,EAExC,MAAM,aAAa,MAAM,QAAQ,WAAW;AAAA,EAC5C,WAAW,cAAc;AAAA,EACzB,MAAM,QAAS,MAAM,QAAQ,UAAU,KAAM;AAAA,EAC7C,qBAAqB,KAAK;AAAA,EAC1B,IAAI,CAAC,mBAAmB,OAAO,OAAO,GAAG;AAAA,IACvC,MAAM,IAAI,UACR,mFACF;AAAA,EACF;AAAA,EACA,cAAc,eAAe;AAAA,EAC7B,MAAM,SAAS,QAAQ,YAAW;AAAA,EAClC,MAAM,SAAS,MAAM,OACnB,CAAC,KAAK,SAAS,MAAM,KAAK,KAAK,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa,CAAC,GAC5E,CACF;AAAA,EACA,MAAM,QAAQ,mBAAmB,MAC/B,WAAW,UAAU;AAAA,IACnB;AAAA,IACA,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,eAAe,MAAM;AAAA,IACrB,aAAa,EAAE,QAAQ,aAAa,QAAQ,QAAQ,yBAAyB;AAAA,IAC7E,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,EACxB,CAAC,CACH;AAAA,EAEA,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,cAAc,eAAe;AAAA,IAC7B,SAAS,MAAM,MAAM,MAAM,EAAE,OAAO,SAAS,QAAQ,cAAc,CAAC;AAAA,IACpE,OAAO,OAAO;AAAA,IACd,IAAI,iBAAiB,8BAA6B;AAAA,MAChD,MAAM,gBAAgB,YAAY,OAAO,QAAQ,MAAM,QAAQ;AAAA,IACjE,EAAO;AAAA,MAEL,MAAM,gBAAgB,YAAY,OAAO,QAAQ,CAAC,CAAC;AAAA;AAAA,IAErD,MAAM;AAAA;AAAA,EAGR,MAAM,gBAAgB,YAAY,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,EAC7D,cAAc,eAAe;AAAA,EAC7B,OAAO;AAAA;AAGT,eAAe,eAAe,CAC5B,YACA,OACA,QACA,UACe;AAAA,EAEf,MAAM,QAAQ,KAAK,SAAS,OAAO,cAAc,EAAE;AAAA,EACnD,MAAM,WAAW,kBAAkB,OAAO;AAAA,IACxC;AAAA,IACA,OAAO,SAAS;AAAA,IAChB,iBAAiB,SAAS;AAAA,EAC5B,CAAC;AAAA,EACD,MAAM,WAAW,eAAe;AAAA,IAC9B;AAAA,IACA,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,YAAY,SAAS,aAAa,cAAc;AAAA,IAChD,iBAAiB,SAAS;AAAA,IAC1B,aAAa,SAAS;AAAA,IACtB;AAAA,IACA,MAAM,SAAS,eAAe,EAAE,QAAQ,eAAe,SAAS,aAAa,IAAI;AAAA,OAC7E,SAAS,eAAe,EAAE,SAAS,IAAI,CAAC;AAAA,IAC5C,OAAO,SAAS;AAAA,EAClB,CAAC;AAAA;;;AC1GH,eAAsB,eAAe,CACnC,SACA,SACA,OACA,SACA,QACe;AAAA,EACf,MAAM,QAAQ,QAAQ;AAAA,EACtB,MAAM,UAAU,QAAQ,SAAS,kBAAkB,MAAM,KAAK,IAAI,YAAY,EAAE,OAAQ,QACtF,MAAM,KAAK;AAAA,EAEb,MAAM,aAAgC,EAAE,SAAS,SAAS,QAAQ,OAAO,UAAU;AAAA,EAEnF,MAAM,UAAU,IAAI,sBAClB,KAAK,SAAS,sBAAsB,MAAM,cAAc,GACxD,MAAM,SACR;AAAA,EACA,QAAQ,KAAK;AAAA,IACX;AAAA,IACA;AAAA,IACA,oBAAoB,CAAC,UAAU,gBAAgB,YAAY,KAAK;AAAA,EAClE,CAAC;AAAA,EAED,IAAI;AAAA,IACF,MAAM,QAAQ,oBAAoB,QAAQ,iBAAiB,OAAO,GAAG,SAAS;AAAA,MAC5E,UAAU,QAAQ,MAAM;AAAA,MACxB,SAAS,QAAQ,MAAM;AAAA,IACzB,CAAC,GAAG;AAAA,IAEJ,IAAI,CAAC,SAAS,CAAC,mBAAmB,OAAO,QAAQ,KAAK,GAAG;AAAA,MACvD,MAAM,iBACJ,4BACA,2EACF;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,MAAM,MAAM,MAAM;AAAA,MAC/B,OAAO,QAAQ,IAAI,CAAC,UAAU,MAAM,MAAM,IAAI;AAAA,MAC9C,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IACD,MAAM,SAAS,yBACb,QACA,QAAQ,QACR,QAAQ,MAAM,WAAW,UAC3B;AAAA,IAGA,MAAM,QAAQ,QAAQ,SAAS,eAAgB,YAAY;AAAA,MACzD,WAAW,QAAQ;AAAA,MACnB,SAAS,QAAQ,IAAI,GAAG,QAAQ,WAAW;AAAA,QACzC,IAAI,KAAK;AAAA,QACT,gBAAgB;AAAA,QAChB,QAAQ;AAAA,QACR,QAAQ,OAAO;AAAA,QACf,aAAa,IAAI,KAAK,EAAE,YAAY;AAAA,MACtC,EAAE;AAAA,IACJ,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,MAAM,wBAAwB,YAAY,KAAK;AAAA;AAAA;AAInD,eAAe,eAAe,CAC5B,YACA,OACe;AAAA,EACf,WAAW,OAAO,eAAe;AAAA,EACjC,WAAW,QAAQ;AAAA,EAEnB,MAAM,UAAU,MAAM,eAAe,YAAY,WAAW,WAAW,EAAE,YAAY,KAAK,CAAC;AAAA,EAC3F,WAAW,QAAQ,UAAU,YAAY;AAAA,EAEzC,IAAI,CAAC,SAAS;AAAA,IACZ,IAAI,WAAW,QAAQ,WAAW,GAAG;AAAA,MACnC,MAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AAAA,IACA,MAAM,IAAI,wBAAuB,IAAI,KAAK,EAAE,YAAY,CAAC;AAAA,EAC3D;AAAA,EAEA,IAAI;AAAA,IACF,MAAM,MAAM;AAAA,IACZ,OAAO,OAAO;AAAA,IACd,MAAM,eAAe,YAAY,WAAW,SAAS;AAAA,IACrD,WAAW,QAAQ;AAAA,IACnB,MAAM;AAAA;AAAA;AAIV,SAAS,wBAAwB,CAC/B,QACA,OACA,YACgC;AAAA,EAChC,IAAI;AAAA,IACF,IAAI,CAAC,MAAM,QAAQ,QAAQ,OAAO,KAAK,OAAO,QAAQ,WAAW,OAAO;AAAA,MACtE,MAAM,IAAI,MAAM,yBAAyB;AAAA,IAC3C;AAAA,IAEA,OAAO,OAAO,QAAQ,IAAI,CAAC,WAAW,iBAAgB,QAAQ,UAAU,CAAC;AAAA,IACzE,OAAO,OAAO;AAAA,IACd,MAAM,iBAAgB,2BAA2B,4CAA4C;AAAA,MAC3F;AAAA,IACF,CAAC;AAAA;AAAA;AAIL,eAAe,uBAAuB,CACpC,YACA,OACe;AAAA,EAGf,IAAI,WAAW,UAAU,cAAc,iBAAiB,yBAAwB;AAAA,IAC9E,MAAM;AAAA,EACR;AAAA,EAEA,IAAI,WAAW,UAAU,WAAW;AAAA,IAClC,IACE,aAAY,KAAK,MAChB,MAAM,SAAS,6BAA6B,MAAM,SAAS,+BAC5D;AAAA,MACA,MAAM,cAAc,QAAQ,MAAM,OAAO;AAAA,MACzC,MAAM,eAAe,YAAY,WAAW,WAAW,EAAE,YAAY,CAAC;AAAA,MACtE,MAAM,IAAI,wBAAuB,WAAW;AAAA,IAC9C;AAAA,IAEA,IAAI,WAAW,OAAO;AAAA,MAAS,MAAM;AAAA,EACvC;AAAA,EAEA,MAAM,UACJ,iBAAiB,+BACb,iBAAgB,2BAA2B,4CAA4C;AAAA,IACrF,OAAO;AAAA,EACT,CAAC,IACD;AAAA,EACN,QAAQ,SAAS,YAAY;AAAA,EAC7B,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAE1C,aAAa,UAAU,SAAS;AAAA,IAC9B,MAAM,KAAK,SAAS,UAAU,KAAK,MAAM,QAAQ,WAAW,MAAM,GAAG,OAAO;AAAA,EAC9E;AAAA;AAGF,SAAS,cAAc,CACrB,YACA,gBACA,QACA,UAA0D,CAAC,GACzC;AAAA,EAClB,QAAQ,SAAS,YAAY;AAAA,EAC7B,MAAM,cAAc,QAAQ,eAAe,IAAI,KAAK,EAAE,YAAY;AAAA,EAElE,OAAO,QAAQ,QAAQ,SAAS,eAAgB,YAAY;AAAA,IAC1D,WAAW,QAAQ;AAAA,IACnB,YAAY,QAAQ,cAAc;AAAA,IAClC,SAAS,QAAQ,IAAI,GAAG,YAAY,EAAE,IAAI,KAAK,IAAI,gBAAgB,QAAQ,YAAY,EAAE;AAAA,EAC3F,CAAC;AAAA;;;AC9KH,eAAsB,aAAa,CACjC,SACA,cACA,IACA,SACA,QACe;AAAA,EACf,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAC1C,IAAI,CAAC;AAAA,IAAU,MAAM,IAAI,MAAM,4DAA4D;AAAA,EAC3F,MAAM,YAAY,QAAQ;AAAA,EAC1B,MAAM,OAAO,MAAM,SAAS,IAAI,EAAE,WAAW,GAAG,CAAC;AAAA,EACjD,IAAI,CAAC,QAAQ,KAAK,WAAW;AAAA,IAAU;AAAA,EACvC,IAAI,KAAK,WAAW,WAAW;AAAA,IAC7B,MAAM,KACJ,SACA,UACA,MACA,iBACE,0BACA,uFACF,CACF;AAAA,IACA;AAAA,EACF;AAAA,EACA,IAAI,KAAK,MAAM,KAAK,WAAW,IAAI,KAAK,IAAI;AAAA,IAAG,MAAM,IAAI,wBAAuB,KAAK,WAAW;AAAA,EAChG,MAAM,WAAW,MAAM,QAAQ,SAAS,IAAI;AAAA,EAC5C,IAAI,CAAC,UAAU;AAAA,IACb,MAAM,SAAS,OAAO,EAAE,WAAW,GAAG,CAAC;AAAA,IACvC;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,MAAM,cAAc,SAAS,MAAM,KAAK,WAAW,KAAK,EAAE;AAAA,EACxE,IAAI,KAAK,WAAW,SAAS;AAAA,IAC3B,MAAM,YAAY,SAAS,cAAc,MAAM,OAAO,MAAM;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,MAAM,gBAAgB,SAAS,CAAC,EAAE,MAAM,OAAO,SAAS,CAAC,GAAG,OAAO,SAAS,MAAM;AAAA,EAClF,MAAM,QAAQ,MAAM,SAAS,IAAI,EAAE,WAAW,GAAG,CAAC;AAAA,EAClD,IAAI,OAAO,WAAW;AAAA,IAAS,MAAM,YAAY,SAAS,cAAc,OAAO,OAAO,MAAM;AAAA;;;ACpC9F,eAAsB,gBAAgB,CACpC,SACA,cACA,SACA,OACA,QACe;AAAA,EACf,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAC1C,MAAM,WAAW,EAAE,WAAW,QAAQ,WAAW,QAAQ;AAAA,EAEzD,SAAS,UAAU,EAAG,UAAU,GAAG,WAAW;AAAA,IAC5C,MAAM,SAAS,MAAM,SAAS,SAAS,QAAQ,GAAG,OAAO,CAAC,SAAS,KAAK,WAAW,OAAO;AAAA,IAC1F,MAAM,SAA8B,CAAC;AAAA,IAErC,WAAW,QAAQ,OAAO;AAAA,MACxB,OAAO,eAAe;AAAA,MACtB,MAAM,QAAQ,MAAM,QAAQ,SAAS,IAAI;AAAA,MACzC,IAAI,OAAO;AAAA,QACT,OAAO,KAAK,EAAE,OAAO,QAAQ,KAAK,OAAQ,CAAC;AAAA,MAC7C,EAAO;AAAA,QACL,MAAM,SAAS,OAAO,EAAE,WAAW,QAAQ,WAAW,IAAI,KAAK,GAAG,CAAC;AAAA;AAAA,IAEvE;AAAA,IAEA,IAAI,CAAC,OAAO;AAAA,MAAQ;AAAA,IAEpB,IAAI;AAAA,MACF,OAAO,eAAe;AAAA,MACtB,MAAM,sBAAsB,cAAc,OAAO,MAAM;AAAA,MACvD;AAAA,MACA,OAAO,OAAO;AAAA,MACd,IAAI,EAAE,iBAAiB;AAAA,QAA+B,MAAM;AAAA;AAAA,EAEhE;AAAA,EAGA,IAAI,WAAW;AAAA,EACf,WAAW,QAAQ,MAAM,SAAS,SAAS,QAAQ,GAAG;AAAA,IACpD,IAAI,KAAK,WAAW;AAAA,MAAS;AAAA,IAC7B,IAAI;AAAA,MACF,MAAM,YAAY,SAAS,cAAc,MAAM,OAAO,MAAM;AAAA,MAC5D,OAAO,OAAO;AAAA,MACd,IAAI,EAAE,iBAAiB;AAAA,QAAyB,MAAM;AAAA,MACtD,WAAW;AAAA;AAAA,EAEf;AAAA,EAEA,IAAI;AAAA,IAAU,MAAM,IAAI,wBAAuB,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,EAAE,YAAY,CAAC;AAAA;;;AClD1F,eAAsB,kBAAkB,CACtC,SACA,cACA,SACA,OACA,SACA,QACe;AAAA,EACf,IAAI,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,SAAS,GAAG;AAAA,IACnD,MAAM,YAAY,SAAS,cAAc,SAAS,OAAO,SAAS,MAAM;AAAA,IACxE;AAAA,EACF;AAAA,EAEA,MAAM,UAAU,MAAM,aAAa,SAAS,OAAO,MAAM;AAAA,EACzD,MAAM,QAAQ,QAAQ;AAAA,EACtB,IAAI,CAAC;AAAA,IAAO;AAAA,EAEZ,MAAM,SAAS,eAAe,SAAS,MAAM,IAAI;AAAA,EACjD,IAAI,CAAC,QAAQ;AAAA,IAEX,aAAa,UAAU,SAAS;AAAA,MAC9B,MAAM,cAAc,SAAS,cAAc,KAAK,IAAI,SAAS,MAAM;AAAA,IACrE;AAAA,IACA;AAAA,EACF;AAAA,EAEA,wBAAwB,SAAS,MAAM,IAAI;AAAA,EAC3C,MAAM,QAAQ,MAAM,cAAc,SAAS,MAAM,MAAM,OAAO;AAAA,EAE9D,WAAW,SAAS,UAAU,SAAS,MAAM,GAAG;AAAA,IAC9C,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,MAAM,cAAc,SAAS,cAAc,MAAM,GAAI,KAAK,IAAI,SAAS,MAAM;AAAA,IAC/E,EAAO;AAAA,MACL,MAAM,gBAAgB,SAAS,OAAO,OAAO,SAAS,MAAM;AAAA;AAAA,EAEhE;AAAA,EAEA,MAAM,iBAAiB,SAAS,cAAc,SAAS,OAAO,MAAM;AAAA;AAItE,eAAe,WAAW,CACxB,SACA,cACA,SACA,OACA,SACA,QACe;AAAA,EACf,MAAM,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,OAAO;AAAA,EAC1D,IAAI,OAAO;AAAA,IACT,MAAM,QAAQ,MAAM,cAAc,SAAS,OAAO,OAAO;AAAA,IACzD,MAAM,iBAAiB,SAAS,cAAc,SAAS,OAAO,MAAM;AAAA,EACtE;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,KAAK,WAAW,SAAS;AAAA,MAC3B,MAAM,cAAc,SAAS,cAAc,KAAK,IAAI,SAAS,MAAM;AAAA,IACrE;AAAA,EACF;AAAA;AAGF,eAAe,YAAY,CACzB,SACA,OACA,QACiC;AAAA,EACjC,MAAM,cAAc,MAAM,OACxB,CAAC,QAAQ,SAAU,KAAK,cAAc,SAAS,KAAK,cAAc,QAClE,EACF;AAAA,EACA,IAAI,KAAK,MAAM,WAAW,IAAI,KAAK,IAAI,GAAG;AAAA,IACxC,MAAM,IAAI,wBAAuB,WAAW;AAAA,EAC9C;AAAA,EAEA,MAAM,UAAkC,CAAC;AAAA,EACzC,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAE1C,WAAW,QAAQ,OAAO;AAAA,IACxB,OAAO,eAAe;AAAA,IACtB,MAAM,QAAQ,MAAM,QAAQ,SAAS,IAAI;AAAA,IAEzC,IAAI,OAAO;AAAA,MACT,QAAQ,KAAK,EAAE,MAAM,MAAM,CAAC;AAAA,IAC9B,EAAO;AAAA,MACL,MAAM,SAAS,OAAO,EAAE,WAAW,QAAQ,WAAW,IAAI,KAAK,GAAG,CAAC;AAAA;AAAA,EAEvE;AAAA,EAEA,OAAO;AAAA;AAGT,SAAS,cAAc,CACrB,SACA,MACkC;AAAA,EAClC,MAAM,UAAU,QAAQ,SAAS,kBAAkB,KAAK,IAAI,YAAY,EAAE,OAAQ,QAChF,KAAK;AAAA,EAGP,OAAO,QAAQ,iBAAiB,SAAS;AAAA,IACvC,UAAU,QAAQ,MAAM;AAAA,IACxB,SAAS,QAAQ,MAAM;AAAA,EACzB,CAAC,GAAG,MAAM;AAAA;AAIZ,SAAS,uBAAuB,CAC9B,SACA,WACM;AAAA,EACN,MAAM,eAAe,QAAQ,KAC3B,GAAG,WACD,KAAK,mBAAmB,UAAU,kBAClC,KAAK,IAAI,iBAAiB,UAAU,IAAI,gBACxC,KAAK,YAAY,UAAU,WAC3B,KAAK,kBAAkB,UAAU,aACrC;AAAA,EAEA,IAAI,cAAc;AAAA,IAChB,MAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AAAA;AAIF,UAAU,SAAS,CAAC,SAA0C,QAA8B;AAAA,EAC1F,IAAI,QAAgC,CAAC;AAAA,EACrC,IAAI,QAAQ;AAAA,EAEZ,WAAW,SAAS,SAAS;AAAA,IAC3B,MAAM,OAAO,OAAO,WAAW,MAAM,MAAM,IAAI;AAAA,IAC/C,MAAM,oBACJ,MAAM,UAAU,OAAO,aACvB,QAAQ,OAAO,OAAO,sBACtB,OAAO,OAAO;AAAA,IAEhB,IAAI,MAAM,SAAS,KAAK,mBAAmB;AAAA,MACzC,MAAM;AAAA,MACN,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,IACV;AAAA,IAEA,IAAI,OAAO,OAAO,iBAAiB,OAAO,OAAO,oBAAoB;AAAA,MACnE,MAAM,CAAC,KAAK;AAAA,MACZ;AAAA,IACF;AAAA,IAEA,MAAM,KAAK,KAAK;AAAA,IAChB,SAAS;AAAA,EACX;AAAA,EAEA,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM;AAAA;;;ACxJvB,SAAS,2BAA2B,CACzC,SACA,cACuB;AAAA,EACvB,OAAO;AAAA,SACC,QAAO,CAAC,IAAI,SAAS,QAAQ;AAAA,MACjC,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,MAC1C,IAAI,CAAC;AAAA,QAAU,MAAM,IAAI,MAAM,4DAA4D;AAAA,MAC3F,MAAM,QAAQ,MAAM,SAAS,SAAS,EAAE,WAAW,QAAQ,WAAW,SAAS,GAAG,CAAC;AAAA,MACnF,IAAI,MAAM;AAAA,QAAQ,MAAM,mBAAmB,SAAS,cAAc,IAAI,OAAO,SAAS,MAAM;AAAA,MACvF;AAAA,cAAM,cAAc,SAAS,cAAc,IAAI,SAAS,MAAM;AAAA;AAAA,EAEvE;AAAA;;;ACfF,IAAM,WAAW,IAAI;AAEd,SAAS,6BAA6B,CAAC,MAAc,SAAsC;AAAA,EAChG,SAAS,IAAI,MAAM,OAAO;AAAA;AAGrB,SAAS,yBAAwB,CAAC,MAAqC;AAAA,EAC5E,MAAM,UAAU,SAAS,IAAI,IAAI;AAAA,EACjC,IAAI,CAAC;AAAA,IAAS,MAAM,IAAI,MAAM,yDAAyD;AAAA,EACvF,OAAO;AAAA;",
-  "debugId": "B3DAC5AAE8C25E2B64756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAkBA,eAAsB,OAAO,CAC3B,SACA,MACsC;AAAA,EACtC,MAAM,UAAU,QAAQ,SAAS,kBAAkB,KAAK,IAAI,YAAY,GAAG,QAAQ,UACjF,KAAK;AAAA,EAEP,IAAI,CAAC,WAAW,oBAAoB,OAAO,MAAM,KAAK;AAAA,IAAe,OAAO;AAAA,EAE5E,MAAM,MAAM,MAAM,QAAQ,QAAQ,QAAQ,eAAe;AAAA,IACvD,WAAW,QAAQ;AAAA,OAChB,KAAK;AAAA,EACV,CAAC;AAAA,EACD,IAAI,CAAC;AAAA,IAAK,OAAO;AAAA,EAEjB,MAAM,UAAU,cAAc,QAAQ,QAAQ,IAAI,UAAU;AAAA,EAC5D,IAAI,QAAQ,sBAAsB,KAAK;AAAA,IAAmB,OAAO;AAAA,EAEjE,MAAM,gBAAgB,MAAM,QAAQ,QAAQ,SAAS,QAAS,KAAK;AAAA,IACjE,WAAW,QAAQ;AAAA,IACnB,KAAK,KAAK;AAAA,EACZ,CAAC;AAAA,EACD,MAAM,gBAAgB,cAAc,KAAK,CAAC,UAAU,MAAM,YAAY,KAAK,OAAO;AAAA,EAClF,MAAM,iBACJ,eAAe,kBAAkB,KAAK,iBACtC,cAAc,sBAAsB,KAAK;AAAA,EAE3C,IAAI;AAAA,IAAgB,OAAO;AAAA,EAE3B,OAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,KAAK,KAAK;AAAA,IACV,SAAS,KAAK;AAAA,IACd,eAAe,KAAK;AAAA,OACjB;AAAA,IACH,gBAAgB;AAAA,MACd,KAAK,KAAK;AAAA,MACV,QAAQ;AAAA,MACR,SAAS,IAAI;AAAA,MACb,cAAc,IAAI;AAAA,IACpB;AAAA,IACA,wBAAwB,eAAe,gBAAgB;AAAA,EACzD;AAAA;AAGF,eAAsB,WAAW,CAC/B,SACA,cACA,MACA,OACA,QACe;AAAA,EACf,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAC1C,MAAM,WAAW,EAAE,WAAW,QAAQ,WAAW,IAAI,KAAK,GAAG;AAAA,EAG7D,SAAS,UAAU,EAAG,UAAU,GAAG,WAAW;AAAA,IAC5C,OAAO,eAAe;AAAA,IACtB,MAAM,WAAW,MAAM,QAAQ,SAAS,IAAI;AAAA,IAE5C,IAAI,CAAC,UAAU;AAAA,MACb,MAAM,SAAS,OAAO,QAAQ;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,IAAI;AAAA,MACF,MAAM,sBAAsB,cAAc,OAAO,CAAC,EAAE,OAAO,UAAU,QAAQ,KAAK,OAAQ,CAAC,CAAC;AAAA,MAC5F,MAAM,SAAS,OAAO,QAAQ;AAAA,MAC9B;AAAA,MACA,OAAO,OAAO;AAAA,MACd,IAAI,EAAE,iBAAiB;AAAA,QAA+B,MAAM;AAAA,MAE5D,MAAM,cAAc,MAAM,SAAS,IAAI,QAAQ;AAAA,MAC/C,IAAI,CAAC;AAAA,QAAa;AAAA;AAAA,EAEtB;AAAA,EAEA,MAAM,IAAI,wBAAuB,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,EAAE,YAAY,CAAC;AAAA;AAG5E,eAAsB,qBAAqB,CACzC,cACA,OACA,QACe;AAAA,EACf,MAAM,aAAa,MAAM,OAAO;AAAA,IAC9B;AAAA,IACA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ,EAAE,MAAM,WAAW,WAAW,WAAW,EAAE;AAAA,MACnD,YAAY,CAAC;AAAA,MACb,cAAc;AAAA,MACd,iBAAiB,OAAO,IAAI,CAAC,UAAU,MAAM,MAAM,cAAc;AAAA,MACjE,eAAe,CAAC;AAAA,MAChB,oBAAoB,CAAC;AAAA,IACvB;AAAA,EACF,CAAC;AAAA;AAGH,eAAsB,aAAa,CACjC,SACA,MACA,aAAa,KAAK,IACO;AAAA,EACzB,MAAM,YAAY,EAAE,MAAM,yBAAyB,WAAW;AAAA,EAC9D,MAAM,YAA8B;AAAA,IAClC,IAAI,eAAe;AAAA,IACnB,WAAW,QAAQ;AAAA,IACnB,UAAU,EAAE,MAAM,UAAU,UAAU;AAAA,IACtC,QAAQ,EAAE,MAAM,kBAAkB,UAAU,KAAK,eAAe;AAAA,IAChE,eAAe,UAAU;AAAA,EAC3B;AAAA,EACA,MAAM,gBAAgB,iCAAiC,EAAE,WAAW,UAAU,CAAC;AAAA,EAE/E,MAAM,uBAAsB,QAAQ,QAAQ,YAAY;AAAA,OACnD,gCAAgC,EAAE,WAAW,sBAAsB,cAAc,CAAC;AAAA,IACrF,mBAAmB,CAAC;AAAA,EACtB,CAAC;AAAA,EAED,OAAO,EAAE,WAAW,cAAc;AAAA;AAGpC,eAAsB,IAAI,CACxB,SACA,UACA,MACA,OACe;AAAA,EACf,MAAM,UAAU,oBAAmB,OAAO;AAAA,IACxC,cAAc;AAAA,IACd,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,WAAW,MAAM,SAAS,OAAO;AAAA,IACrC,WAAW,QAAQ;AAAA,IACnB,IAAI,KAAK;AAAA,IACT,gBAAgB,KAAK;AAAA,IACrB,QAAQ;AAAA,IACR,aAAa,IAAI,KAAK,EAAE,YAAY;AAAA,IACpC,OAAO;AAAA,EACT,CAAC;AAAA,EAED,IAAI,CAAC;AAAA,IAAU;AAAA,EAEf,4BAA4B,SAAS,OAAO;AAAA,IAC1C,WAAW,QAAQ;AAAA,IACnB,YAAY,KAAK;AAAA,IACjB;AAAA,OACG,KAAK;AAAA,IACR,SAAS,KAAK;AAAA,EAChB,CAAC;AAAA;AAGI,SAAS,OAAO,CAAC,SAA0B;AAAA,EAChD,MAAM,UACJ,WAAW,OAAO,YAAY,YAAY,aAAa,UAAU,QAAQ,UAAU;AAAA,EACrF,MAAM,iBAAiB,OAAO,YAAY,WAAW,KAAK,MAAM,OAAO,IAAI,OAAO;AAAA,EAElF,MAAM,wBAAwB,KAAK,IAAI,IAAI;AAAA,EAC3C,MAAM,uBAAuB,OAAO,SAAS,cAAc,IAAI,iBAAiB;AAAA,EAChF,MAAM,iBAAiB,KAAK,IAAI,uBAAuB,oBAAoB;AAAA,EAE3E,OAAO,IAAI,KAAK,cAAc,EAAE,YAAY;AAAA;AAAA;AAGvC,MAAM,gCAA+B,MAAM;AAAA,EAC3B;AAAA,EAArB,WAAW,CAAU,aAAqB;AAAA,IACxC,MAAM,qCAAqC;AAAA,IADxB;AAAA;AAGvB;;;AC3LA,uBAAS;AAgBF,SAAS,mBAAmB,CACjC,SACA,SACmC;AAAA,EACnC,IAAI,CAAC;AAAA,IAAS;AAAA,EACd,MAAM,UAA0C,OAAO,OACrD,QAAQ,KAAK,EAAE,IAAI,CAAC,UAClB,OAAO,OAAO;AAAA,OACT;AAAA,IACH,OAAO,OAAO,OAAO;AAAA,MACnB,YAAY,MAAM,MAAM;AAAA,MACxB,SAAS,MAAM,MAAM;AAAA,MACrB,YAAY,MAAM,MAAM;AAAA,MACxB,UAAU,MAAM,MAAM,YAAY,OAAO,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAAA,MAC3E,OAAO,CAAC,UAAiC,iBAAiB,SAAS,MAAM,OAAO,KAAK;AAAA,IACvF,CAAC;AAAA,EACH,CAAC,CACH,CACF;AAAA,EACA,MAAM,QAAQ,IAAI,IAChB,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,UAAU,CAAC,MAAM,UAAU,MAAM,OAAO,CAAC,GAAG,KAAK,CAAC,CACjF;AAAA,EACA,OAAO,OAAO,OAAO;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,UAAU,CAAC,QAAkB,MAAM,IAAI,KAAK,UAAU,CAAC,IAAI,UAAU,IAAI,OAAO,CAAC,CAAC,KAAK;AAAA,EACzF,CAAC;AAAA;AAGH,eAAe,gBAAgB,CAC7B,SACA,SACA,OACA;AAAA,EACA,IACE,CAAC,MAAM,QAAQ,MAAM,KAAK,KAC1B,MAAM,MAAM,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,CAAC,KAAK,KAAK,CAAC,GACnE;AAAA,IACA,MAAM,IAAI,UAAU,yDAAyD;AAAA,EAC/E;AAAA,EACA,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK;AAAA,EAC7B,MAAM,UAAU,MAAM;AAAA,EACtB,IAAI,YAAY,aAAa,YAAY,cAAc,YAAY,SAAS;AAAA,IAC1E,MAAM,IAAI,UAAU,+DAA+D;AAAA,EACrF;AAAA,EACA,MAAM,SAAS,QAAQ,OAAO,MAAM,MAAM;AAAA,EAC1C,MAAM,gBAAgB,YAAY,IAAI,CAAC,QAAQ,YAAY,QAAQ,KAAM,CAAC,CAAC;AAAA,EAC3E,cAAc,eAAe;AAAA,EAC7B,IAAI,CAAC,MAAM;AAAA,IAAQ,OAAO,EAAE,SAAS,CAAC,EAAE;AAAA,EAExC,MAAM,aAAa,MAAM,QAAQ,WAAW;AAAA,EAC5C,WAAW,cAAc;AAAA,EACzB,MAAM,QAAS,MAAM,QAAQ,UAAU,KAAM;AAAA,EAC7C,qBAAqB,KAAK;AAAA,EAC1B,IAAI,CAAC,mBAAmB,OAAO,OAAO,GAAG;AAAA,IACvC,MAAM,IAAI,UACR,mFACF;AAAA,EACF;AAAA,EACA,cAAc,eAAe;AAAA,EAC7B,MAAM,SAAS,QAAQ,YAAW;AAAA,EAClC,MAAM,SAAS,MAAM,OACnB,CAAC,KAAK,SAAS,MAAM,KAAK,KAAK,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa,CAAC,GAC5E,CACF;AAAA,EACA,MAAM,QAAQ,mBAAmB,MAC/B,WAAW,UAAU;AAAA,IACnB;AAAA,IACA,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,eAAe,MAAM;AAAA,IACrB,aAAa,EAAE,QAAQ,aAAa,QAAQ,QAAQ,yBAAyB;AAAA,IAC7E,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,EACxB,CAAC,CACH;AAAA,EAEA,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,cAAc,eAAe;AAAA,IAC7B,SAAS,MAAM,MAAM,MAAM,EAAE,OAAO,SAAS,QAAQ,cAAc,CAAC;AAAA,IACpE,OAAO,OAAO;AAAA,IACd,IAAI,iBAAiB,8BAA6B;AAAA,MAChD,MAAM,gBAAgB,YAAY,OAAO,QAAQ,MAAM,QAAQ;AAAA,IACjE,EAAO;AAAA,MAEL,MAAM,gBAAgB,YAAY,OAAO,QAAQ,CAAC,CAAC;AAAA;AAAA,IAErD,MAAM;AAAA;AAAA,EAGR,MAAM,gBAAgB,YAAY,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,EAC7D,cAAc,eAAe;AAAA,EAC7B,OAAO;AAAA;AAGT,eAAe,eAAe,CAC5B,YACA,OACA,QACA,UACe;AAAA,EAEf,MAAM,QAAQ,KAAK,SAAS,OAAO,cAAc,EAAE;AAAA,EACnD,MAAM,WAAW,kBAAkB,OAAO;AAAA,IACxC;AAAA,IACA,OAAO,SAAS;AAAA,IAChB,iBAAiB,SAAS;AAAA,EAC5B,CAAC;AAAA,EACD,MAAM,WAAW,eAAe;AAAA,IAC9B;AAAA,IACA,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,YAAY,SAAS,aAAa,cAAc;AAAA,IAChD,iBAAiB,SAAS;AAAA,IAC1B,aAAa,SAAS;AAAA,IACtB;AAAA,IACA,MAAM,SAAS,eAAe,EAAE,QAAQ,eAAe,SAAS,aAAa,IAAI;AAAA,OAC7E,SAAS,eAAe,EAAE,SAAS,IAAI,CAAC;AAAA,IAC5C,OAAO,SAAS;AAAA,EAClB,CAAC;AAAA;;;AC1GH,eAAsB,eAAe,CACnC,SACA,SACA,OACA,SACA,QACe;AAAA,EACf,MAAM,QAAQ,QAAQ;AAAA,EACtB,MAAM,UAAU,QAAQ,SAAS,kBAAkB,MAAM,KAAK,IAAI,YAAY,EAAE,OAAQ,QACtF,MAAM,KAAK;AAAA,EAEb,MAAM,aAAgC,EAAE,SAAS,SAAS,QAAQ,OAAO,UAAU;AAAA,EAEnF,MAAM,UAAU,IAAI,sBAClB,KAAK,SAAS,sBAAsB,MAAM,cAAc,GACxD,MAAM,SACR;AAAA,EACA,QAAQ,KAAK;AAAA,IACX;AAAA,IACA;AAAA,IACA,oBAAoB,CAAC,UAAU,gBAAgB,YAAY,KAAK;AAAA,EAClE,CAAC;AAAA,EAED,IAAI;AAAA,IACF,MAAM,QAAQ,oBAAoB,QAAQ,iBAAiB,OAAO,GAAG,SAAS;AAAA,MAC5E,UAAU,QAAQ,MAAM;AAAA,MACxB,SAAS,QAAQ,MAAM;AAAA,IACzB,CAAC,GAAG;AAAA,IAEJ,IAAI,CAAC,SAAS,CAAC,mBAAmB,OAAO,QAAQ,KAAK,GAAG;AAAA,MACvD,MAAM,iBACJ,4BACA,2EACF;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,MAAM,MAAM,MAAM;AAAA,MAC/B,OAAO,QAAQ,IAAI,CAAC,UAAU,MAAM,MAAM,IAAI;AAAA,MAC9C,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IACD,MAAM,SAAS,yBACb,QACA,QAAQ,QACR,QAAQ,MAAM,WAAW,UAC3B;AAAA,IAGA,MAAM,QAAQ,QAAQ,SAAS,eAAgB,YAAY;AAAA,MACzD,WAAW,QAAQ;AAAA,MACnB,SAAS,QAAQ,IAAI,GAAG,QAAQ,WAAW;AAAA,QACzC,IAAI,KAAK;AAAA,QACT,gBAAgB;AAAA,QAChB,QAAQ;AAAA,QACR,QAAQ,OAAO;AAAA,QACf,aAAa,IAAI,KAAK,EAAE,YAAY;AAAA,MACtC,EAAE;AAAA,IACJ,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,MAAM,wBAAwB,YAAY,KAAK;AAAA;AAAA;AAInD,eAAe,eAAe,CAC5B,YACA,OACe;AAAA,EACf,WAAW,OAAO,eAAe;AAAA,EACjC,WAAW,QAAQ;AAAA,EAEnB,MAAM,UAAU,MAAM,eAAe,YAAY,WAAW,WAAW,EAAE,YAAY,KAAK,CAAC;AAAA,EAC3F,WAAW,QAAQ,UAAU,YAAY;AAAA,EAEzC,IAAI,CAAC,SAAS;AAAA,IACZ,IAAI,WAAW,QAAQ,WAAW,GAAG;AAAA,MACnC,MAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AAAA,IACA,MAAM,IAAI,wBAAuB,IAAI,KAAK,EAAE,YAAY,CAAC;AAAA,EAC3D;AAAA,EAEA,IAAI;AAAA,IACF,MAAM,MAAM;AAAA,IACZ,OAAO,OAAO;AAAA,IACd,MAAM,eAAe,YAAY,WAAW,SAAS;AAAA,IACrD,WAAW,QAAQ;AAAA,IACnB,MAAM;AAAA;AAAA;AAIV,SAAS,wBAAwB,CAC/B,QACA,OACA,YACgC;AAAA,EAChC,IAAI;AAAA,IACF,IAAI,CAAC,MAAM,QAAQ,QAAQ,OAAO,KAAK,OAAO,QAAQ,WAAW,OAAO;AAAA,MACtE,MAAM,IAAI,MAAM,yBAAyB;AAAA,IAC3C;AAAA,IAEA,OAAO,OAAO,QAAQ,IAAI,CAAC,WAAW,iBAAgB,QAAQ,UAAU,CAAC;AAAA,IACzE,OAAO,OAAO;AAAA,IACd,MAAM,iBAAgB,2BAA2B,4CAA4C;AAAA,MAC3F;AAAA,IACF,CAAC;AAAA;AAAA;AAIL,eAAe,uBAAuB,CACpC,YACA,OACe;AAAA,EAGf,IAAI,WAAW,UAAU,cAAc,iBAAiB,yBAAwB;AAAA,IAC9E,MAAM;AAAA,EACR;AAAA,EAEA,IAAI,WAAW,UAAU,WAAW;AAAA,IAClC,IACE,aAAY,KAAK,MAChB,MAAM,SAAS,6BAA6B,MAAM,SAAS,+BAC5D;AAAA,MACA,MAAM,cAAc,QAAQ,MAAM,OAAO;AAAA,MACzC,MAAM,eAAe,YAAY,WAAW,WAAW,EAAE,YAAY,CAAC;AAAA,MACtE,MAAM,IAAI,wBAAuB,WAAW;AAAA,IAC9C;AAAA,IAEA,IAAI,WAAW,OAAO;AAAA,MAAS,MAAM;AAAA,EACvC;AAAA,EAEA,MAAM,UACJ,iBAAiB,+BACb,iBAAgB,2BAA2B,4CAA4C;AAAA,IACrF,OAAO;AAAA,EACT,CAAC,IACD;AAAA,EACN,QAAQ,SAAS,YAAY;AAAA,EAC7B,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAE1C,aAAa,UAAU,SAAS;AAAA,IAC9B,MAAM,KAAK,SAAS,UAAU,KAAK,MAAM,QAAQ,WAAW,MAAM,GAAG,OAAO;AAAA,EAC9E;AAAA;AAGF,SAAS,cAAc,CACrB,YACA,gBACA,QACA,UAA0D,CAAC,GACzC;AAAA,EAClB,QAAQ,SAAS,YAAY;AAAA,EAC7B,MAAM,cAAc,QAAQ,eAAe,IAAI,KAAK,EAAE,YAAY;AAAA,EAElE,OAAO,QAAQ,QAAQ,SAAS,eAAgB,YAAY;AAAA,IAC1D,WAAW,QAAQ;AAAA,IACnB,YAAY,QAAQ,cAAc;AAAA,IAClC,SAAS,QAAQ,IAAI,GAAG,YAAY,EAAE,IAAI,KAAK,IAAI,gBAAgB,QAAQ,YAAY,EAAE;AAAA,EAC3F,CAAC;AAAA;;;AC9KH,eAAsB,aAAa,CACjC,SACA,cACA,IACA,SACA,QACe;AAAA,EACf,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAC1C,IAAI,CAAC;AAAA,IAAU,MAAM,IAAI,MAAM,4DAA4D;AAAA,EAC3F,MAAM,YAAY,QAAQ;AAAA,EAC1B,MAAM,OAAO,MAAM,SAAS,IAAI,EAAE,WAAW,GAAG,CAAC;AAAA,EACjD,IAAI,CAAC,QAAQ,KAAK,WAAW;AAAA,IAAU;AAAA,EACvC,IAAI,KAAK,WAAW,WAAW;AAAA,IAC7B,MAAM,KACJ,SACA,UACA,MACA,iBACE,0BACA,uFACF,CACF;AAAA,IACA;AAAA,EACF;AAAA,EACA,IAAI,KAAK,MAAM,KAAK,WAAW,IAAI,KAAK,IAAI;AAAA,IAAG,MAAM,IAAI,wBAAuB,KAAK,WAAW;AAAA,EAChG,MAAM,WAAW,MAAM,QAAQ,SAAS,IAAI;AAAA,EAC5C,IAAI,CAAC,UAAU;AAAA,IACb,MAAM,SAAS,OAAO,EAAE,WAAW,GAAG,CAAC;AAAA,IACvC;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,MAAM,cAAc,SAAS,MAAM,KAAK,WAAW,KAAK,EAAE;AAAA,EACxE,IAAI,KAAK,WAAW,SAAS;AAAA,IAC3B,MAAM,YAAY,SAAS,cAAc,MAAM,OAAO,MAAM;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,MAAM,gBAAgB,SAAS,CAAC,EAAE,MAAM,OAAO,SAAS,CAAC,GAAG,OAAO,SAAS,MAAM;AAAA,EAClF,MAAM,QAAQ,MAAM,SAAS,IAAI,EAAE,WAAW,GAAG,CAAC;AAAA,EAClD,IAAI,OAAO,WAAW;AAAA,IAAS,MAAM,YAAY,SAAS,cAAc,OAAO,OAAO,MAAM;AAAA;;;ACpC9F,eAAsB,gBAAgB,CACpC,SACA,cACA,SACA,OACA,QACe;AAAA,EACf,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAC1C,MAAM,WAAW,EAAE,WAAW,QAAQ,WAAW,QAAQ;AAAA,EAEzD,SAAS,UAAU,EAAG,UAAU,GAAG,WAAW;AAAA,IAC5C,MAAM,SAAS,MAAM,SAAS,SAAS,QAAQ,GAAG,OAAO,CAAC,SAAS,KAAK,WAAW,OAAO;AAAA,IAC1F,MAAM,SAA8B,CAAC;AAAA,IAErC,WAAW,QAAQ,OAAO;AAAA,MACxB,OAAO,eAAe;AAAA,MACtB,MAAM,QAAQ,MAAM,QAAQ,SAAS,IAAI;AAAA,MACzC,IAAI,OAAO;AAAA,QACT,OAAO,KAAK,EAAE,OAAO,QAAQ,KAAK,OAAQ,CAAC;AAAA,MAC7C,EAAO;AAAA,QACL,MAAM,SAAS,OAAO,EAAE,WAAW,QAAQ,WAAW,IAAI,KAAK,GAAG,CAAC;AAAA;AAAA,IAEvE;AAAA,IAEA,IAAI,CAAC,OAAO;AAAA,MAAQ;AAAA,IAEpB,IAAI;AAAA,MACF,OAAO,eAAe;AAAA,MACtB,MAAM,sBAAsB,cAAc,OAAO,MAAM;AAAA,MACvD;AAAA,MACA,OAAO,OAAO;AAAA,MACd,IAAI,EAAE,iBAAiB;AAAA,QAA+B,MAAM;AAAA;AAAA,EAEhE;AAAA,EAGA,IAAI,WAAW;AAAA,EACf,WAAW,QAAQ,MAAM,SAAS,SAAS,QAAQ,GAAG;AAAA,IACpD,IAAI,KAAK,WAAW;AAAA,MAAS;AAAA,IAC7B,IAAI;AAAA,MACF,MAAM,YAAY,SAAS,cAAc,MAAM,OAAO,MAAM;AAAA,MAC5D,OAAO,OAAO;AAAA,MACd,IAAI,EAAE,iBAAiB;AAAA,QAAyB,MAAM;AAAA,MACtD,WAAW;AAAA;AAAA,EAEf;AAAA,EAEA,IAAI;AAAA,IAAU,MAAM,IAAI,wBAAuB,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,EAAE,YAAY,CAAC;AAAA;;;AClD1F,eAAsB,kBAAkB,CACtC,SACA,cACA,SACA,OACA,SACA,QACe;AAAA,EACf,IAAI,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,SAAS,GAAG;AAAA,IACnD,MAAM,YAAY,SAAS,cAAc,SAAS,OAAO,SAAS,MAAM;AAAA,IACxE;AAAA,EACF;AAAA,EAEA,MAAM,UAAU,MAAM,aAAa,SAAS,OAAO,MAAM;AAAA,EACzD,MAAM,QAAQ,QAAQ;AAAA,EACtB,IAAI,CAAC;AAAA,IAAO;AAAA,EAEZ,MAAM,SAAS,eAAe,SAAS,MAAM,IAAI;AAAA,EACjD,IAAI,CAAC,QAAQ;AAAA,IAEX,aAAa,UAAU,SAAS;AAAA,MAC9B,MAAM,cAAc,SAAS,cAAc,KAAK,IAAI,SAAS,MAAM;AAAA,IACrE;AAAA,IACA;AAAA,EACF;AAAA,EAEA,wBAAwB,SAAS,MAAM,IAAI;AAAA,EAC3C,MAAM,QAAQ,MAAM,cAAc,SAAS,MAAM,MAAM,OAAO;AAAA,EAE9D,WAAW,SAAS,UAAU,SAAS,MAAM,GAAG;AAAA,IAC9C,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,MAAM,cAAc,SAAS,cAAc,MAAM,GAAI,KAAK,IAAI,SAAS,MAAM;AAAA,IAC/E,EAAO;AAAA,MACL,MAAM,gBAAgB,SAAS,OAAO,OAAO,SAAS,MAAM;AAAA;AAAA,EAEhE;AAAA,EAEA,MAAM,iBAAiB,SAAS,cAAc,SAAS,OAAO,MAAM;AAAA;AAItE,eAAe,WAAW,CACxB,SACA,cACA,SACA,OACA,SACA,QACe;AAAA,EACf,MAAM,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,OAAO;AAAA,EAC1D,IAAI,OAAO;AAAA,IACT,MAAM,QAAQ,MAAM,cAAc,SAAS,OAAO,OAAO;AAAA,IACzD,MAAM,iBAAiB,SAAS,cAAc,SAAS,OAAO,MAAM;AAAA,EACtE;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,KAAK,WAAW,SAAS;AAAA,MAC3B,MAAM,cAAc,SAAS,cAAc,KAAK,IAAI,SAAS,MAAM;AAAA,IACrE;AAAA,EACF;AAAA;AAGF,eAAe,YAAY,CACzB,SACA,OACA,QACiC;AAAA,EACjC,MAAM,cAAc,MAAM,OACxB,CAAC,QAAQ,SAAU,KAAK,cAAc,SAAS,KAAK,cAAc,QAClE,EACF;AAAA,EACA,IAAI,KAAK,MAAM,WAAW,IAAI,KAAK,IAAI,GAAG;AAAA,IACxC,MAAM,IAAI,wBAAuB,WAAW;AAAA,EAC9C;AAAA,EAEA,MAAM,UAAkC,CAAC;AAAA,EACzC,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAE1C,WAAW,QAAQ,OAAO;AAAA,IACxB,OAAO,eAAe;AAAA,IACtB,MAAM,QAAQ,MAAM,QAAQ,SAAS,IAAI;AAAA,IAEzC,IAAI,OAAO;AAAA,MACT,QAAQ,KAAK,EAAE,MAAM,MAAM,CAAC;AAAA,IAC9B,EAAO;AAAA,MACL,MAAM,SAAS,OAAO,EAAE,WAAW,QAAQ,WAAW,IAAI,KAAK,GAAG,CAAC;AAAA;AAAA,EAEvE;AAAA,EAEA,OAAO;AAAA;AAGT,SAAS,cAAc,CACrB,SACA,MACkC;AAAA,EAClC,MAAM,UAAU,QAAQ,SAAS,kBAAkB,KAAK,IAAI,YAAY,EAAE,OAAQ,QAChF,KAAK;AAAA,EAGP,OAAO,QAAQ,iBAAiB,SAAS;AAAA,IACvC,UAAU,QAAQ,MAAM;AAAA,IACxB,SAAS,QAAQ,MAAM;AAAA,EACzB,CAAC,GAAG,MAAM;AAAA;AAIZ,SAAS,uBAAuB,CAC9B,SACA,WACM;AAAA,EACN,MAAM,eAAe,QAAQ,KAC3B,GAAG,WACD,KAAK,mBAAmB,UAAU,kBAClC,KAAK,IAAI,iBAAiB,UAAU,IAAI,gBACxC,KAAK,YAAY,UAAU,WAC3B,KAAK,kBAAkB,UAAU,aACrC;AAAA,EAEA,IAAI,cAAc;AAAA,IAChB,MAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AAAA;AAIF,UAAU,SAAS,CAAC,SAA0C,QAA8B;AAAA,EAC1F,IAAI,QAAgC,CAAC;AAAA,EACrC,IAAI,QAAQ;AAAA,EAEZ,WAAW,SAAS,SAAS;AAAA,IAC3B,MAAM,OAAO,OAAO,WAAW,MAAM,MAAM,IAAI;AAAA,IAC/C,MAAM,oBACJ,MAAM,UAAU,OAAO,aACvB,QAAQ,OAAO,OAAO,sBACtB,OAAO,OAAO;AAAA,IAEhB,IAAI,MAAM,SAAS,KAAK,mBAAmB;AAAA,MACzC,MAAM;AAAA,MACN,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,IACV;AAAA,IAEA,IAAI,OAAO,OAAO,iBAAiB,OAAO,OAAO,oBAAoB;AAAA,MACnE,MAAM,CAAC,KAAK;AAAA,MACZ;AAAA,IACF;AAAA,IAEA,MAAM,KAAK,KAAK;AAAA,IAChB,SAAS;AAAA,EACX;AAAA,EAEA,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM;AAAA;;;ACxJvB,SAAS,2BAA2B,CACzC,SACA,cACuB;AAAA,EACvB,OAAO;AAAA,SACC,QAAO,CAAC,IAAI,SAAS,QAAQ;AAAA,MACjC,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,MAC1C,IAAI,CAAC;AAAA,QAAU,MAAM,IAAI,MAAM,4DAA4D;AAAA,MAC3F,MAAM,QAAQ,MAAM,SAAS,SAAS,EAAE,WAAW,QAAQ,WAAW,SAAS,GAAG,CAAC;AAAA,MACnF,IAAI,MAAM;AAAA,QAAQ,MAAM,mBAAmB,SAAS,cAAc,IAAI,OAAO,SAAS,MAAM;AAAA,MACvF;AAAA,cAAM,cAAc,SAAS,cAAc,IAAI,SAAS,MAAM;AAAA;AAAA,EAEvE;AAAA;;;ACfF,IAAM,WAAW,IAAI;AAEd,SAAS,6BAA6B,CAAC,MAAc,SAAsC;AAAA,EAChG,SAAS,IAAI,MAAM,OAAO;AAAA;AAGrB,SAAS,yBAAwB,CAAC,MAAqC;AAAA,EAC5E,MAAM,UAAU,SAAS,IAAI,IAAI;AAAA,EACjC,IAAI,CAAC;AAAA,IAAS,MAAM,IAAI,MAAM,yDAAyD;AAAA,EACvF,OAAO;AAAA;;;ACRT,IAAM,mBAAmB,IAAI;AAGtB,SAAS,mBAAkB,CAAC,MAAc,QAAsB;AAAA,EACrE,iBAAiB,IAAI,MAAM,gBAAgB,MAAM,CAAC;AAAA;AAG7C,SAAS,kBAAkB,CAAC,MAAkC;AAAA,EACnE,OAAO,iBAAiB,IAAI,IAAI;AAAA;AAGlC,SAAS,eAAe,CAAC,OAAuB;AAAA,EAC9C,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,MAAM,IAAI,IAAI,KAAK;AAAA,IACnB,MAAM;AAAA,IACN,MAAM,IAAI,MAAM,sCAAsC,SAAS;AAAA;AAAA,EAEjE,IAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU;AAAA,IACzD,MAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAAA,EACA,IAAI,IAAI,aAAa,OAAO,IAAI,UAAU,IAAI,MAAM;AAAA,IAClD,MAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AAAA,EACA,OAAO,IAAI;AAAA;",
+  "debugId": "2C71EF9B86846F7764756E2164756E21",
   "names": []
 }

package/dist/{chunk-mdnw7nj8.js → chunk-dnmadg9k.js}

@@ -3,7 +3,7 @@ import {
   datasetSequenceValue,
   assertDatasetDefinition2,
   getDatasetRowValidationFailure
-} from "./chunk-cd234ba4.js";
+} from "./chunk-rz53yb4v.js";
 import {
   LakeStorageError2,
   LakeConcurrencyError2,
@@ -11,7 +11,7 @@ import {
   encodeDatasetPrimaryKey2,
   getDatasetMergeChangeValidationError2,
   cloneDatasetMergeChange2
-} from "./chunk-rb143ggb.js";
+} from "./chunk-bwjcehza.js";
 import {
   normalizeDecimalValue2
 } from "./chunk-3bh94gbw.js";
@@ -281,6 +281,15 @@ function cloneDatasetVersion(version) {
     createdAt: new Date(version.createdAt)
   };
 }
+function latestVersionSummary(version) {
+  return {
+    datasetId: version.datasetId,
+    versionId: version.versionId,
+    mode: version.mode,
+    createdAt: version.createdAt,
+    ...version.rowCount !== undefined ? { rowCount: version.rowCount } : {}
+  };
+}
 function cloneRow(row) {
   return structuredClone(row);
 }
@@ -420,6 +429,8 @@ class InMemoryLakeStorage2 {
   sequencesByVersionId = new Map;
   latestVersionIdByDataset = new Map;
   commitLocks = new Map;
+  commitPosition = 0;
+  commitPositionByDataset = new Map;
   async createDataset(definition) {
     assertDatasetId(definition.id);
     const existing = this.datasets.get(definition.id);
@@ -470,13 +481,7 @@ ${details}`);
       return {
         datasetId,
         materialized: true,
-        latestVersion: latest ? {
-          datasetId: latest.datasetId,
-          versionId: latest.versionId,
-          mode: latest.mode,
-          createdAt: latest.createdAt,
-          ...latest.rowCount !== undefined ? { rowCount: latest.rowCount } : {}
-        } : null
+        latestVersion: latest ? latestVersionSummary(latest) : null
       };
     }));
   }
@@ -520,6 +525,24 @@ ${details}`);
     }
     return this.getVersion(datasetId, latestVersionId);
   }
+  async listLatestVersionsSince(input) {
+    const cursor = String(this.commitPosition);
+    if (input.cursor === null)
+      return { cursor, versions: [] };
+    if (!/^\d+$/.test(input.cursor) || Number(input.cursor) > this.commitPosition)
+      return null;
+    const after = Number(input.cursor);
+    const datasetIds = input.datasetIds ? new Set(input.datasetIds) : null;
+    const versions = [];
+    for (const [datasetId, position] of this.commitPositionByDataset) {
+      if (position <= after || datasetIds && !datasetIds.has(datasetId))
+        continue;
+      const latest = await this.getLatestVersion(datasetId);
+      if (latest)
+        versions.push(latestVersionSummary(latest));
+    }
+    return { cursor, versions };
+  }
   async getVersion(datasetId, versionId) {
     const versions = this.versionsByDataset.get(datasetId) ?? [];
     const version = versions.find((candidate) => candidate.versionId === versionId);
@@ -673,6 +696,7 @@ ${details}`);
       this.versionsByDataset.set(options.merge.dataset.id, versions);
       this.rowsByVersionId.set(versionId, visibleRows.map((row) => cloneRow(row)));
       this.latestVersionIdByDataset.set(options.merge.dataset.id, versionId);
+      this.commitPositionByDataset.set(options.merge.dataset.id, ++this.commitPosition);
       if (ordered)
         this.sequencesByVersionId.set(versionId, ordered.states);
       return { outcome: "created", version: cloneDatasetVersion(version) };
@@ -717,6 +741,7 @@ ${details}`);
     this.versionsByDataset.set(options.write.dataset.id, versions);
     this.rowsByVersionId.set(versionId, visibleRows.map((row) => cloneRow(row)));
     this.latestVersionIdByDataset.set(options.write.dataset.id, versionId);
+    this.commitPositionByDataset.set(options.write.dataset.id, ++this.commitPosition);
     return { ...cloneDatasetVersion(version), outcome: "created" };
   }
   isUnchangedWrite(mode, latestVersion, rows, schema) {
@@ -787,4 +812,4 @@ ${details}`);
 }
 export { resolveDatasetChangeColumns2, planDatasetDefinitionUpdate2, mergeStrictDatasetDefinition2, assertLakeDatasetDefinitionsCompatible2, retryDatasetMergeCommit2, datasetSequenceChange2, reconcileDatasetSequences2, assertUnsequencedDatasetWrite2, hasDatasetInputChanges2, InMemoryLakeStorage2 };
 
-//# debugId=50E77B9D51AA9AC164756E2164756E21
+//# debugId=504A6D0F5F95C2B164756E2164756E21