@sixb/core 0.1.19 → 0.1.21

package/src/workflows/builders.ts

@@ -3,6 +3,7 @@ import { isActionDefinition } from "../actions"
 import { AGENT_REASONING_LEVELS, isAgentToolDefinition } from "../agents"
 import { isModelReasoning } from "../models/language-model"
 import type { SchemaOrRef } from "../ontology"
+import type { SandboxFactory } from "../sandboxes"
 import type { ScheduleDefinition, ScheduleDefinitionForEvent } from "../schedules"
 import { isScheduleDefinition } from "../schedules"
 import { isGroupDefinition } from "../security"
@@ -25,6 +26,7 @@ import type {
   WorkflowTriggerDefinition,
 } from "./types"
 import {
+  assertAgentStepSandbox,
   assertNonEmpty,
   isAgentStepDefinition,
   isInterventionDefinition,
@@ -137,6 +139,7 @@ export function defineAgentStep<const TId extends string>(
   const groupIds = groupIdsFromAgentStepConfig(id, config)
   const toolNames = toolNamesFromAgentStepConfig(id, config)
   const skillNames = skillNamesFromAgentStepConfig(id, config)
+  const sandbox = sandboxFromAgentStepConfig(id, config)
 
   return {
     input(input: RuntimeWorkflowInput): unknown {
@@ -156,6 +159,7 @@ export function defineAgentStep<const TId extends string>(
                 groupIds,
                 toolNames,
                 skillNames,
+                ...(sandbox === undefined ? {} : { sandbox }),
                 input,
                 output,
                 prompt,
@@ -231,6 +235,16 @@ function skillNamesFromAgentStepConfig(
   return Object.freeze(skillNames)
 }
 
+function sandboxFromAgentStepConfig(
+  stepId: string,
+  config: DefineAgentStepConfig
+): SandboxFactory | undefined {
+  if (config.sandbox === undefined) return undefined
+
+  assertAgentStepSandbox(config.sandbox, `Agent step "${stepId}"`)
+  return config.sandbox
+}
+
 function assertUniqueAgentStepValues(
   stepId: string,
   kind: "group" | "tool" | "skill",

package/src/workflows/types.ts

@@ -22,6 +22,7 @@ import type { InferSchemaOrRef, ObjectRef, SchemaOrRef } from "../ontology"
 import type { PipelinesRuntime } from "../pipelines/execution"
 import type { ProjectionsRuntime } from "../projections/execution"
 import type { RulesRuntime } from "../rules/execution"
+import type { SandboxFactory } from "../sandboxes"
 import type { ScheduleDefinition, ScheduleDefinitionForEvent } from "../schedules"
 import type { SchedulesRuntime } from "../schedules/execution"
 import type { GroupDefinition } from "../security"
@@ -147,6 +148,13 @@ export interface DefineAgentStepConfig {
   readonly tools?: readonly AgentToolDefinition[]
   /** Names of the project Agent Skills (`skills/<name>/`) this workflow task may use. Defaults to none. */
   readonly skills?: readonly string[]
+  /**
+   * The step's own sandbox: each run gets a fresh one from this factory's static recipe (source,
+   * setup, env, network and auth), destroyed when the run ends. Without it, each run gets an empty
+   * sandbox from the project's `sandboxes` that reaches only the Sixb API. Factories with `params`
+   * or `resolve` are not supported.
+   */
+  readonly sandbox?: SandboxFactory
 }
 
 export interface AgentStepDefinition<
@@ -164,6 +172,7 @@ export interface AgentStepDefinition<
   readonly groupIds: readonly string[]
   readonly toolNames: readonly string[]
   readonly skillNames: readonly string[]
+  readonly sandbox?: SandboxFactory
   readonly input: TInput
   readonly output: TOutput
   readonly prompt: AgentStepPrompt<Record<string, unknown>>

package/src/workflows/validation.ts

@@ -4,6 +4,13 @@ import type { ModelCatalog } from "../models"
 import { isModelReasoning, modelReasoningSupportIssue } from "../models/language-model"
 import type { SchemaOrRef, ValueType } from "../ontology"
 import { validateSchemaOrRefValue } from "../ontology/refs"
+import type { SandboxFactory } from "../sandboxes"
+import {
+  type SandboxEnvironment,
+  sandboxCredentialIssue,
+  staticSandboxRecipe,
+} from "../sandboxes/configuration"
+import { SandboxError } from "../sandboxes/errors"
 import type { ScheduleDefinition } from "../schedules"
 import type { SecurityDefinitionCatalog } from "../security"
 import { WorkflowDefinitionError, WorkflowValidationError } from "./errors"
@@ -413,6 +420,15 @@ function validateAgentNodeDefinition(workflowId: string, node: WorkflowAgentNode
   assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "group", node.agentStep.groupIds)
   assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "tool", node.agentStep.toolNames)
   assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "skill", node.agentStep.skillNames)
+
+  // A hand-built node skips defineAgentStep, so its sandbox is checked again here.
+  if (node.agentStep.sandbox !== undefined) {
+    assertAgentStepSandbox(
+      node.agentStep.sandbox,
+      `Workflow "${workflowId}" agent step "${node.id}"`
+    )
+  }
+
   if (node.mapper !== undefined && typeof node.mapper !== "function") {
     throw new WorkflowDefinitionError(
       `Workflow "${workflowId}" agent node "${node.id}" mapper must be a function.`
@@ -420,6 +436,62 @@ function validateAgentNodeDefinition(workflowId: string, node: WorkflowAgentNode
   }
 }
 
+/**
+ * Reject a value that cannot be an Agent step's sandbox; `step` names it in the error. A step has
+ * no thread to bind params to, so only a static recipe applies. Its network must let the agent
+ * reach the Sixb API. Its source access must pass the rule a project factory passes at startup.
+ */
+export function assertAgentStepSandbox(
+  value: unknown,
+  step: string
+): asserts value is SandboxFactory {
+  const fail = (issue: string, cause?: unknown): never => {
+    throw new WorkflowDefinitionError(
+      `${step} sandbox ${issue}`,
+      cause === undefined ? undefined : { cause }
+    )
+  }
+
+  if (!isRecord(value) || typeof value.create !== "function") {
+    return fail("must be a sandbox factory with a create function.")
+  }
+
+  const { configuration } = value
+  if (configuration === undefined) return
+  if (!isRecord(configuration)) return fail("configuration must be a sandbox recipe object.")
+  if (configuration.params !== undefined || configuration.resolve !== undefined) {
+    return fail("must use a static recipe: params and resolve are not supported in workflow steps.")
+  }
+
+  let recipe: SandboxEnvironment
+  try {
+    recipe = staticSandboxRecipe(configuration)
+  } catch (error) {
+    if (!(error instanceof SandboxError)) throw error
+    // Recipe validation names the invalid field, never its value.
+    return fail(`recipe is invalid: ${error.message.replace(/^\[Sixb\] /, "")}`, error)
+  }
+
+  // Sixb adds its API to every other policy when the step runs, so only none cannot reach it.
+  if (recipe.network?.mode === "none") {
+    return fail(
+      'network mode "none" cannot run an agent: the agent needs the Sixb API. Use { mode: "restricted", allow: [...] } with the origins the project needs; Sixb adds its own.'
+    )
+  }
+
+  const { auth } = configuration
+  if (auth !== undefined && !(isRecord(auth) && typeof auth.authorize === "function")) {
+    return fail("auth requires an authorize function.")
+  }
+
+  const credentialIssue = sandboxCredentialIssue({
+    supportsRequestCredentials: value.supportsRequestCredentials === true,
+    auth,
+    source: recipe.source,
+  })
+  if (credentialIssue) fail(`is invalid: ${credentialIssue}`)
+}
+
 function assertUniqueNonEmptyAgentStepValues(
   workflowId: string,
   stepId: string,

package/dist/auth/audience.d.ts

@@ -1,8 +0,0 @@
-export declare const DEFAULT_AUTH_SESSION_AUDIENCE = "atlas";
-export type AuthSessionAudience = typeof DEFAULT_AUTH_SESSION_AUDIENCE | "app";
-export interface AuthSessionAudienceOptions {
-    readonly audience?: AuthSessionAudience;
-}
-export declare function isValidAuthSessionAudience(value: string): value is AuthSessionAudience;
-export declare function resolveAuthSessionAudience(value: AuthSessionAudience | undefined): AuthSessionAudience;
-//# sourceMappingURL=audience.d.ts.map

package/dist/auth/audience.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"audience.d.ts","sourceRoot":"","sources":["../../src/auth/audience.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,6BAA6B,UAAU,CAAA;AAEpD,MAAM,MAAM,mBAAmB,GAAG,OAAO,6BAA6B,GAAG,KAAK,CAAA;AAE9E,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CACxC;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,mBAAmB,CAEtF;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,mBAAmB,GAAG,SAAS,GACrC,mBAAmB,CAWrB"}

package/dist/authorization/application-access.d.ts

@@ -1,18 +0,0 @@
-import type { AuthSessionAudience } from "../auth/audience";
-import type { AuthorizationContext, ResolvedRole } from "./types";
-/** Whether declaring roles has enabled an allowlist for an application. */
-export declare function isApplicationAccessControlled(roles: readonly ResolvedRole[], audience: AuthSessionAudience): boolean;
-/**
- * Whether this principal may open this application.
- *
- * KNOWN LIMITATION (0.1.x): application access is the one capability that is **not** deny-by-default.
- * While no role mentions an application, every authenticated principal may open it; the allowlist only
- * switches on once some role grants it. Every other capability — `view`, `apply`, `run`, `observe` —
- * denies unless granted, so this is the single asymmetry in the model.
- *
- * It is deliberate for now: flipping it would lock every project out of Atlas until it declares a role,
- * including projects with no security definitions at all. Closing it means shipping a default grant with
- * the scaffold first, and it is a breaking change for any project relying on the open default.
- */
-export declare function canAccessApplication(authorization: AuthorizationContext, roles: readonly ResolvedRole[], audience: AuthSessionAudience): boolean;
-//# sourceMappingURL=application-access.d.ts.map

package/dist/authorization/application-access.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"application-access.d.ts","sourceRoot":"","sources":["../../src/authorization/application-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAE3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAEjE,2EAA2E;AAC3E,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAET;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,oBAAoB,EACnC,KAAK,EAAE,SAAS,YAAY,EAAE,EAC9B,QAAQ,EAAE,mBAAmB,GAC5B,OAAO,CAKT"}

package/dist/chunk-1f7wpmyp.js.map

@@ -1,14 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/security/redactions.ts", "../src/objects/property-clearance.ts", "../src/agents/authority.ts", "../src/storage/workflow-runs/errors.ts", "../src/storage/workflow-runs/provider.ts"],
-  "sourcesContent": [
-    "import type { Redactions } from \"./types\"\n\n/** List the values hidden from a reader that lacks a clearance for their markings. */\nexport function missingClearanceRedactions(ids: Iterable<string>): Redactions {\n  return Object.fromEntries([...ids].map((id) => [id, { reason: \"missing_clearance\" }] as const))\n}\n",
-    "import { AuthorizationError } from \"../authorization/errors\"\nimport type { StoredDomainEvent } from \"../events/types\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport { missingClearanceRedactions } from \"../security/redactions\"\nimport type { ExpandedLinkValue, ExpandedObjectRow, ObjectRow } from \"../storage\"\nimport type {\n  ObjectQueryAdmissionState,\n  ObjectQueryPropertyUse,\n  ObjectQuerySemanticAdmission,\n} from \"./query/validate\"\n\n/**\n * The marked properties one reader cannot read, resolved once from its clearances.\n *\n * A property is readable when the reader clears every one of its markings. Unreadable properties\n * are omitted from rows and cannot be used to select, order, or aggregate objects.\n */\nexport interface PropertyClearance {\n  /** Marked properties of this object type the reader cannot read. */\n  hiddenPropertyIds(objectTypeId: string): ReadonlySet<string>\n  /** First marking on the property that the reader is not cleared for. */\n  missingMarking(objectTypeId: string, propertyId: string): string | undefined\n}\n\nconst NO_PROPERTIES: ReadonlySet<string> = new Set()\n\n// Readers are built per execution, but few distinct clearance sets exist per ontology.\nconst clearancesByOntology = new WeakMap<\n  OntologyDefinitionCatalog,\n  Map<string, PropertyClearance | undefined>\n>()\n\n/**\n * Resolve what a reader with these clearances cannot read. Returns `undefined` when it can read\n * every property, so callers skip redaction entirely.\n */\nexport function resolvePropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  clearances: ReadonlySet<string>\n): PropertyClearance | undefined {\n  let resolved = clearancesByOntology.get(ontology)\n  if (!resolved) {\n    resolved = new Map()\n    clearancesByOntology.set(ontology, resolved)\n  }\n  const key = JSON.stringify([...clearances].sort())\n  if (!resolved.has(key)) resolved.set(key, createPropertyClearance(ontology, clearances))\n  return resolved.get(key)\n}\n\nfunction createPropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  clearances: ReadonlySet<string>\n): PropertyClearance | undefined {\n  const missingByType = new Map<string, ReadonlyMap<string, string>>()\n  for (const objectType of ontology.listObjectTypes()) {\n    const missing = new Map<string, string>()\n    for (const property of objectType.properties) {\n      const marking = property.markings?.find((markingId) => !clearances.has(markingId))\n      if (marking !== undefined) missing.set(property.id, marking)\n    }\n    if (missing.size > 0) missingByType.set(objectType.id, missing)\n  }\n  if (missingByType.size === 0) return undefined\n\n  const hiddenByType = new Map(\n    [...missingByType].map(([objectTypeId, missing]) => [objectTypeId, new Set(missing.keys())])\n  )\n  return Object.freeze({\n    hiddenPropertyIds: (objectTypeId: string) => hiddenByType.get(objectTypeId) ?? NO_PROPERTIES,\n    missingMarking: (objectTypeId: string, propertyId: string) =>\n      missingByType.get(objectTypeId)?.get(propertyId),\n  })\n}\n\n/**\n * Omit unreadable properties from a row and the objects expanded under it.\n *\n * Every hidden property of the type is listed in `redactions`, whether or not the row holds a\n * value: listing only present values would reveal which hidden properties are empty.\n */\nexport function redactObjectRow<TRow extends ObjectRow>(\n  row: TRow,\n  clearance: PropertyClearance\n): TRow {\n  const hidden = clearance.hiddenPropertyIds(row.objectTypeId)\n  const links = row.links\n  if (hidden.size === 0 && links === undefined) return row\n\n  const redacted: TRow = { ...row }\n  if (hidden.size > 0) {\n    redacted.properties = withoutKeys(row.properties, hidden)\n    redacted.redactions = missingClearanceRedactions(hidden)\n  }\n  if (links !== undefined) {\n    redacted.links = Object.fromEntries(\n      Object.entries(links).map(([linkId, value]) => [linkId, redactLinkValue(value, clearance)])\n    )\n  }\n  return redacted\n}\n\nfunction redactLinkValue(\n  value: ExpandedLinkValue,\n  clearance: PropertyClearance\n): ExpandedLinkValue {\n  if (value === null) return null\n  if (Array.isArray(value)) return value.map((row) => redactObjectRow(row, clearance))\n  // Array.isArray does not narrow a readonly[] away, so assert the single-object case.\n  return redactObjectRow(value as ExpandedObjectRow, clearance)\n}\n\n/**\n * Omit unreadable properties from an object event, under the same contract as rows. Other events\n * carry no markable value: link properties and telemetry properties cannot be marked.\n */\nexport function redactDomainEvent(\n  event: StoredDomainEvent,\n  clearance: PropertyClearance\n): StoredDomainEvent {\n  if (event.topic !== \"objects\") return event\n  const hidden = clearance.hiddenPropertyIds(event.payload.objectTypeId)\n  if (hidden.size === 0) return event\n\n  const payload = {\n    ...event.payload,\n    propertyChanges: withoutKeys(event.payload.propertyChanges, hidden),\n    redactions: missingClearanceRedactions(hidden),\n  }\n  if (event.type === \"object.deleted\") return { ...event, payload }\n  return {\n    ...event,\n    payload: { ...payload, properties: withoutKeys(event.payload.properties, hidden) },\n  }\n}\n\nfunction withoutKeys<TValue>(\n  record: Readonly<Record<string, TValue>>,\n  hidden: ReadonlySet<string>\n): Record<string, TValue> {\n  const kept: Record<string, TValue> = {}\n  for (const [key, value] of Object.entries(record)) {\n    if (!hidden.has(key)) kept[key] = value\n  }\n  return kept\n}\n\n/**\n * Reject every query use of a property the reader cannot read, except projection.\n *\n * Filtering, ordering, searching, or faceting by a hidden value would reveal it through which\n * objects match and in what order. Projection only shapes the output, which is redacted anyway.\n */\nexport function createClearanceQueryAdmission(\n  clearance: PropertyClearance\n): ObjectQuerySemanticAdmission {\n  // Each state stands for the object types a query has reached so far. A property without an\n  // explicit type is checked against all of them.\n  const reachedTypes = new WeakMap<ObjectQueryAdmissionState, readonly string[]>()\n  const state = (objectTypeIds: readonly string[]): ObjectQueryAdmissionState => {\n    const created = Object.freeze({})\n    reachedTypes.set(created, Object.freeze([...objectTypeIds]))\n    return created\n  }\n  const reached = (input: ObjectQueryAdmissionState): readonly string[] => {\n    const objectTypeIds = reachedTypes.get(input)\n    if (!objectTypeIds) {\n      throw new Error(\"[Sixb] Clearance query admission received a state it did not create.\")\n    }\n    return objectTypeIds\n  }\n  const empty = state([])\n\n  const admission: ObjectQuerySemanticAdmission = {\n    empty: () => empty,\n    source: (input) => ({ state: state(input.result.objectTypeIds) }),\n    edge: (input) => ({ state: state(input.result.objectTypeIds) }),\n    // A difference only returns objects of its first input.\n    set: (input) =>\n      input.op === \"subtract\"\n        ? (input.states[0] ?? empty)\n        : state([...new Set(input.states.flatMap(reached))]),\n    property: (input) => {\n      if (input.use === \"project\") return undefined\n      const objectTypeIds =\n        input.objectTypeId === undefined ? reached(input.state) : [input.objectTypeId]\n      for (const objectTypeId of objectTypeIds) {\n        const marking = clearance.missingMarking(objectTypeId, input.propertyId)\n        if (marking === undefined) continue\n        return new AuthorizationError(\n          `clearance:marking:${marking}`,\n          `[Sixb] Cannot ${PROPERTY_USE_VERBS[input.use]} '${objectTypeId}.${input.propertyId}' at '${input.path}': it requires clearance for marking '${marking}'.`\n        )\n      }\n      return undefined\n    },\n  }\n  return Object.freeze(admission)\n}\n\nconst PROPERTY_USE_VERBS: Readonly<Record<ObjectQueryPropertyUse, string>> = {\n  filter: \"filter by\",\n  text: \"search\",\n  vector: \"run a vector search over\",\n  sort: \"sort by\",\n  project: \"project\",\n  \"expand.orderBy\": \"order expanded objects by\",\n  facet: \"facet by\",\n}\n",
-    "import { principalsEqual, SYSTEM_PRINCIPAL } from \"../auth\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport { resolveAuthorizationContext } from \"../authorization\"\nimport { createSixbError } from \"../errors/internal\"\nimport type { AuthorizablePrincipal, AuthorizationRef } from \"../execution\"\nimport { type PropertyClearance, resolvePropertyClearance } from \"../objects/property-clearance\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport type { SecurityDefinitionCatalog } from \"../security\"\nimport type {\n  AccessTokenRecord,\n  AuthStorage,\n  ServiceAccountGroupMembershipRecord,\n  ServiceAccountRecord,\n  SessionRecord,\n  UserRecord,\n} from \"../storage/auth\"\nimport { AuthStorageError } from \"../storage/auth\"\nimport { agentServiceAccountId } from \"./identity\"\n\nexport type AgentExecutionAuthorization =\n  | { readonly type: \"principal\"; readonly context: AuthorizationContext }\n  | { readonly type: \"disabled\" }\n\n/**\n * The marked properties an Agent execution cannot read, resolved exactly as its object reader\n * resolves them. Disabled authorization reads everything.\n */\nexport function resolveAgentPropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  authorization: AgentExecutionAuthorization\n): PropertyClearance | undefined {\n  return authorization.type === \"principal\"\n    ? resolvePropertyClearance(ontology, authorization.context.clearances ?? new Set())\n    : undefined\n}\n\ntype UserCredentialRef = NonNullable<\n  Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n>\n\ninterface CredentialedUserAuthorizationRef {\n  readonly type: \"principal\"\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"user\" }>\n  readonly credential: UserCredentialRef\n}\n\nexport { agentServiceAccountId } from \"./identity\"\n\nexport interface AgentExecutionIdentity {\n  readonly serviceAccount: ServiceAccountRecord\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"serviceAccount\" }>\n  readonly groupMemberships: readonly ServiceAccountGroupMembershipRecord[]\n}\n\n/** Ensure a framework-managed Agent actor exists with exactly its declared group memberships. */\nexport async function ensureManagedAgentExecutionIdentity(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly name: string\n  readonly description: string\n  readonly groupIds: readonly string[]\n}): Promise<AgentExecutionIdentity> {\n  const auth = requireAuthStorage(input.auth)\n  const id = agentServiceAccountId(input.actorId)\n  const now = new Date()\n  const loaded = await loadOrCreateAgentServiceAccount(auth, {\n    id,\n    projectId: input.projectId,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertFrameworkManagedAgentServiceAccount(input.actorId, loaded)\n  assertActiveAgentServiceAccount(input.actorId, loaded)\n  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {\n    existing: loaded,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertActiveAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: id,\n      groupIds: input.groupIds,\n      source: \"agent\",\n      updatedAt: now,\n    })\n  )\n\n  return {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id },\n    groupMemberships,\n  }\n}\n\n/** Load the managed identity, recovering only the expected concurrent-create race. */\nasync function loadOrCreateAgentServiceAccount(\n  auth: AuthStorage,\n  input: {\n    readonly id: string\n    readonly projectId: string\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  const existing = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: input.id,\n  })\n  if (existing) return existing\n\n  try {\n    return await auth.serviceAccounts.create({\n      id: input.id,\n      projectId: input.projectId,\n      name: input.name,\n      description: input.description,\n      status: \"active\",\n      createdByPrincipal: SYSTEM_PRINCIPAL,\n      createdAt: input.updatedAt,\n      updatedAt: input.updatedAt,\n    })\n  } catch (error) {\n    if (!(error instanceof AuthStorageError) || error.code !== \"duplicate_service_account\") {\n      throw error\n    }\n    const concurrent = await auth.serviceAccounts.getById({\n      projectId: input.projectId,\n      id: input.id,\n    })\n    if (!concurrent) throw error\n    return concurrent\n  }\n}\n\nfunction assertActiveAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (serviceAccount.status === \"suspended\") {\n    throw new Error(\n      `[Sixb] Agent '${actorId}' service account '${serviceAccount.id}' is suspended.`\n    )\n  }\n}\n\nfunction assertFrameworkManagedAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (\n    serviceAccount.createdByPrincipal === undefined ||\n    !principalsEqual(serviceAccount.createdByPrincipal, SYSTEM_PRINCIPAL)\n  ) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' cannot use service account '${serviceAccount.id}' because it is not managed by Sixb.`,\n      { details: { actorId, serviceAccountId: serviceAccount.id } }\n    )\n  }\n}\n\nfunction requireDefinitionOwnedGroupMemberships(\n  actorId: string,\n  memberships: readonly ServiceAccountGroupMembershipRecord[]\n): readonly ServiceAccountGroupMembershipRecord[] {\n  const externalGroupIds = memberships\n    .filter((membership) => membership.source !== \"agent\")\n    .map((membership) => membership.groupId)\n  if (externalGroupIds.length > 0) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' service account has group memberships not managed by its definition: ${externalGroupIds.join(\", \")}.`,\n      { details: { actorId, externalGroupIds } }\n    )\n  }\n  return memberships\n}\n\n/** Resolve current grants for the service account referenced by a durable Agent execution. */\nexport async function resolveAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n}): Promise<{ readonly identity: AgentExecutionIdentity; readonly context: AuthorizationContext }> {\n  const auth = requireAuthStorage(input.auth)\n  const expectedId = agentServiceAccountId(input.actorId)\n  const principal =\n    input.authorizationRef.type === \"principal\" ? input.authorizationRef.principal : null\n  if (principal?.type !== \"serviceAccount\" || principal.id !== expectedId) {\n    throw new Error(\n      `[Sixb] Agent '${input.actorId}' execution authority must reference service account '${expectedId}'.`\n    )\n  }\n\n  const serviceAccount = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: principal.id,\n  })\n  if (!serviceAccount || serviceAccount.status !== \"active\") {\n    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`)\n  }\n  assertFrameworkManagedAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.listForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: principal.id,\n    })\n  )\n  const identity: AgentExecutionIdentity = {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id: principal.id },\n    groupMemberships,\n  }\n  return {\n    identity,\n    context: resolveAuthorizationContext({\n      principal: identity.principal,\n      groupIds: groupMemberships.map((membership) => membership.groupId),\n      roles: input.security.listResolvedRoles(),\n    }),\n  }\n}\n\n/** Revalidate the durable user authority inherited by a conversational or child Agent. */\nexport async function resolveInheritedAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n  readonly now?: Date\n}): Promise<AgentExecutionAuthorization> {\n  if (input.authorizationRef.type === \"disabled\") return { type: \"disabled\" }\n\n  const ref = requireCredentialedUserAuthority(input.authorizationRef)\n  const auth = requireAuthStorage(input.auth)\n  const now = input.now ?? new Date()\n  const user = await requireActiveUser(auth, input.projectId, ref.principal.id)\n  const memberships = await auth.groupMemberships.listForUser({\n    projectId: input.projectId,\n    userId: user.id,\n  })\n  const credential = await revalidateUserCredential({\n    auth,\n    projectId: input.projectId,\n    userId: user.id,\n    credential: ref.credential,\n    currentGroupIds: memberships.map((membership) => membership.groupId),\n    now,\n  })\n\n  return {\n    type: \"principal\",\n    context: resolveAuthorizationContext({\n      principal: ref.principal,\n      groupIds: credential.groupIds,\n      roles: input.security.listResolvedRoles(),\n      ...(credential.sessionId === undefined ? {} : { sessionId: credential.sessionId }),\n    }),\n  }\n}\n\nfunction requireCredentialedUserAuthority(ref: AuthorizationRef): CredentialedUserAuthorizationRef {\n  if (ref.type !== \"principal\" || ref.principal.type !== \"user\" || ref.credential === undefined) {\n    throw invalidInheritedAuthority(\"the durable reference is not a credentialed user\")\n  }\n  return {\n    type: \"principal\",\n    principal: { type: \"user\", id: ref.principal.id },\n    credential: { type: ref.credential.type, id: ref.credential.id },\n  }\n}\n\nasync function requireActiveUser(\n  auth: AuthStorage,\n  projectId: string,\n  userId: string\n): Promise<UserRecord> {\n  const user = await auth.users.getById({ projectId, id: userId })\n  if (!user || user.status !== \"active\") {\n    throw invalidInheritedAuthority(`user '${userId}' is not active`)\n  }\n  return user\n}\n\nasync function revalidateUserCredential(input: {\n  readonly auth: AuthStorage\n  readonly projectId: string\n  readonly userId: string\n  readonly credential: UserCredentialRef\n  readonly currentGroupIds: readonly string[]\n  readonly now: Date\n}): Promise<{ readonly groupIds: readonly string[]; readonly sessionId?: string }> {\n  if (input.credential.type === \"session\") {\n    const session = await input.auth.sessions.getById({\n      projectId: input.projectId,\n      id: input.credential.id,\n    })\n    if (!isUsableUserSession(session, input.userId, input.now)) {\n      throw invalidInheritedAuthority(\"the inherited session is no longer valid\")\n    }\n    return { groupIds: input.currentGroupIds, sessionId: session.id }\n  }\n\n  const accessToken = await input.auth.accessTokens.getById({\n    projectId: input.projectId,\n    id: input.credential.id,\n  })\n  if (!isUsableUserAccessToken(accessToken, input.userId, input.now)) {\n    throw invalidInheritedAuthority(\"the inherited access token is no longer valid\")\n  }\n  if (accessToken.groupIds === undefined) return { groupIds: input.currentGroupIds }\n\n  const allowedGroupIds = new Set(accessToken.groupIds)\n  return {\n    groupIds: input.currentGroupIds.filter((groupId) => allowedGroupIds.has(groupId)),\n  }\n}\n\nfunction isUsableUserSession(\n  session: SessionRecord | null,\n  userId: string,\n  now: Date\n): session is SessionRecord {\n  if (!session || session.userId !== userId || session.revokedAt !== undefined) return false\n  if (session.expiresAt.getTime() <= now.getTime()) return false\n  return (\n    session.absoluteExpiresAt === undefined || session.absoluteExpiresAt.getTime() > now.getTime()\n  )\n}\n\nfunction isUsableUserAccessToken(\n  token: AccessTokenRecord | null,\n  userId: string,\n  now: Date\n): token is AccessTokenRecord {\n  if (!token || !principalsEqual(token.subject, { type: \"user\", id: userId })) return false\n  return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime()\n}\n\nfunction invalidInheritedAuthority(reason: string): Error {\n  return createSixbError(\n    \"agent.execution_failed\",\n    `[Sixb] The Agent execution cannot restore its inherited authority: ${reason}.`\n  )\n}\n\nfunction requireAuthStorage(auth: AuthStorage | undefined): AuthStorage {\n  if (!auth) {\n    throw new Error(\"[Sixb] Agent executions require auth storage.\")\n  }\n  return auth\n}\n\nasync function updateAgentServiceAccountMetadata(\n  auth: AuthStorage,\n  input: {\n    readonly existing: ServiceAccountRecord\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  if (input.existing.name === input.name && input.existing.description === input.description) {\n    return input.existing\n  }\n  return auth.serviceAccounts.update({\n    projectId: input.existing.projectId,\n    id: input.existing.id,\n    name: input.name,\n    description: input.description,\n    updatedAt: input.updatedAt,\n  })\n}\n",
-    "/**\n * Base error for workflow-run storage operations.\n */\nexport class WorkflowRunError extends Error {\n  readonly name = \"WorkflowRunError\"\n}\n",
-    "import { agentServiceAccountId } from \"../../agents/authority\"\nimport type { ExecutionStorage } from \"../executions\"\nimport { findAgentRunExecution, findPrimitiveRunExecution } from \"../executions/run-link\"\nimport { WorkflowRunError } from \"./errors\"\n\n/** Validate the semantic link between a durable workflow run and its immutable execution. */\nexport async function assertWorkflowRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly runId: string\n  readonly workflowId: string\n}): Promise<void> {\n  const execution = await findPrimitiveRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    primitive: { kind: \"workflow\", id: input.workflowId, runId: input.runId },\n    sourceTypes: [\"execution\", \"schedule\", \"event\"],\n  })\n  if (!execution) {\n    invalidExecution(input.executionId, input.runId)\n  }\n\n  if (execution.source.type === \"schedule\" || execution.source.type === \"event\") {\n    if (execution.requestedBy !== undefined) {\n      invalidExecution(input.executionId, input.runId)\n    }\n    return\n  }\n\n  // ExecutionStorage already validates the immutable parent reference, correlation id, and\n  // requested-by propagation. This boundary only owns the workflow-specific source restriction.\n  if (execution.source.type !== \"execution\") {\n    invalidExecution(input.executionId, input.runId)\n  }\n}\n\n/** Validate the semantic link between a Workflow Agent-node run and its child execution. */\nexport async function assertWorkflowAgentNodeRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly nodeRunId: string\n  readonly actorId: string\n  readonly workflowExecutionId: string\n}): Promise<void> {\n  const execution = await findAgentRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    runId: input.nodeRunId,\n    authority: { type: \"managed\", serviceAccountId: agentServiceAccountId(input.actorId) },\n  })\n  if (\n    !execution ||\n    execution.source.type !== \"execution\" ||\n    execution.source.executionId !== input.workflowExecutionId\n  ) {\n    throw new WorkflowRunError(\n      `[Sixb] Execution '${input.executionId}' does not authorize Workflow Agent-node run '${input.nodeRunId}'.`\n    )\n  }\n}\n\nfunction invalidExecution(executionId: string, runId: string): never {\n  throw new WorkflowRunError(\n    `[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`\n  )\n}\n"
-  ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;AAGO,SAAS,0BAA0B,CAAC,KAAmC;AAAA,EAC5E,OAAO,OAAO,YAAY,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,oBAAoB,CAAC,CAAU,CAAC;AAAA;;;ACoBhG,IAAM,gBAAqC,IAAI;AAG/C,IAAM,uBAAuB,IAAI;AAS1B,SAAS,wBAAwB,CACtC,UACA,YAC+B;AAAA,EAC/B,IAAI,WAAW,qBAAqB,IAAI,QAAQ;AAAA,EAChD,IAAI,CAAC,UAAU;AAAA,IACb,WAAW,IAAI;AAAA,IACf,qBAAqB,IAAI,UAAU,QAAQ;AAAA,EAC7C;AAAA,EACA,MAAM,MAAM,KAAK,UAAU,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC;AAAA,EACjD,IAAI,CAAC,SAAS,IAAI,GAAG;AAAA,IAAG,SAAS,IAAI,KAAK,wBAAwB,UAAU,UAAU,CAAC;AAAA,EACvF,OAAO,SAAS,IAAI,GAAG;AAAA;AAGzB,SAAS,uBAAuB,CAC9B,UACA,YAC+B;AAAA,EAC/B,MAAM,gBAAgB,IAAI;AAAA,EAC1B,WAAW,cAAc,SAAS,gBAAgB,GAAG;AAAA,IACnD,MAAM,UAAU,IAAI;AAAA,IACpB,WAAW,YAAY,WAAW,YAAY;AAAA,MAC5C,MAAM,UAAU,SAAS,UAAU,KAAK,CAAC,cAAc,CAAC,WAAW,IAAI,SAAS,CAAC;AAAA,MACjF,IAAI,YAAY;AAAA,QAAW,QAAQ,IAAI,SAAS,IAAI,OAAO;AAAA,IAC7D;AAAA,IACA,IAAI,QAAQ,OAAO;AAAA,MAAG,cAAc,IAAI,WAAW,IAAI,OAAO;AAAA,EAChE;AAAA,EACA,IAAI,cAAc,SAAS;AAAA,IAAG;AAAA,EAE9B,MAAM,eAAe,IAAI,IACvB,CAAC,GAAG,aAAa,EAAE,IAAI,EAAE,cAAc,aAAa,CAAC,cAAc,IAAI,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAC7F;AAAA,EACA,OAAO,OAAO,OAAO;AAAA,IACnB,mBAAmB,CAAC,iBAAyB,aAAa,IAAI,YAAY,KAAK;AAAA,IAC/E,gBAAgB,CAAC,cAAsB,eACrC,cAAc,IAAI,YAAY,GAAG,IAAI,UAAU;AAAA,EACnD,CAAC;AAAA;AASI,SAAS,eAAuC,CACrD,KACA,WACM;AAAA,EACN,MAAM,SAAS,UAAU,kBAAkB,IAAI,YAAY;AAAA,EAC3D,MAAM,QAAQ,IAAI;AAAA,EAClB,IAAI,OAAO,SAAS,KAAK,UAAU;AAAA,IAAW,OAAO;AAAA,EAErD,MAAM,WAAiB,KAAK,IAAI;AAAA,EAChC,IAAI,OAAO,OAAO,GAAG;AAAA,IACnB,SAAS,aAAa,YAAY,IAAI,YAAY,MAAM;AAAA,IACxD,SAAS,aAAa,2BAA2B,MAAM;AAAA,EACzD;AAAA,EACA,IAAI,UAAU,WAAW;AAAA,IACvB,SAAS,QAAQ,OAAO,YACtB,OAAO,QAAQ,KAAK,EAAE,IAAI,EAAE,QAAQ,WAAW,CAAC,QAAQ,gBAAgB,OAAO,SAAS,CAAC,CAAC,CAC5F;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,eAAe,CACtB,OACA,WACmB;AAAA,EACnB,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO,MAAM,IAAI,CAAC,QAAQ,gBAAgB,KAAK,SAAS,CAAC;AAAA,EAEnF,OAAO,gBAAgB,OAA4B,SAAS;AAAA;AAOvD,SAAS,iBAAiB,CAC/B,OACA,WACmB;AAAA,EACnB,IAAI,MAAM,UAAU;AAAA,IAAW,OAAO;AAAA,EACtC,MAAM,SAAS,UAAU,kBAAkB,MAAM,QAAQ,YAAY;AAAA,EACrE,IAAI,OAAO,SAAS;AAAA,IAAG,OAAO;AAAA,EAE9B,MAAM,UAAU;AAAA,OACX,MAAM;AAAA,IACT,iBAAiB,YAAY,MAAM,QAAQ,iBAAiB,MAAM;AAAA,IAClE,YAAY,2BAA2B,MAAM;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,SAAS;AAAA,IAAkB,OAAO,KAAK,OAAO,QAAQ;AAAA,EAChE,OAAO;AAAA,OACF;AAAA,IACH,SAAS,KAAK,SAAS,YAAY,YAAY,MAAM,QAAQ,YAAY,MAAM,EAAE;AAAA,EACnF;AAAA;AAGF,SAAS,WAAmB,CAC1B,QACA,QACwB;AAAA,EACxB,MAAM,OAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;AAAA,IACjD,IAAI,CAAC,OAAO,IAAI,GAAG;AAAA,MAAG,KAAK,OAAO;AAAA,EACpC;AAAA,EACA,OAAO;AAAA;AASF,SAAS,6BAA6B,CAC3C,WAC8B;AAAA,EAG9B,MAAM,eAAe,IAAI;AAAA,EACzB,MAAM,QAAQ,CAAC,kBAAgE;AAAA,IAC7E,MAAM,UAAU,OAAO,OAAO,CAAC,CAAC;AAAA,IAChC,aAAa,IAAI,SAAS,OAAO,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;AAAA,IAC3D,OAAO;AAAA;AAAA,EAET,MAAM,UAAU,CAAC,UAAwD;AAAA,IACvE,MAAM,gBAAgB,aAAa,IAAI,KAAK;AAAA,IAC5C,IAAI,CAAC,eAAe;AAAA,MAClB,MAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AAAA,IACA,OAAO;AAAA;AAAA,EAET,MAAM,QAAQ,MAAM,CAAC,CAAC;AAAA,EAEtB,MAAM,YAA0C;AAAA,IAC9C,OAAO,MAAM;AAAA,IACb,QAAQ,CAAC,WAAW,EAAE,OAAO,MAAM,MAAM,OAAO,aAAa,EAAE;AAAA,IAC/D,MAAM,CAAC,WAAW,EAAE,OAAO,MAAM,MAAM,OAAO,aAAa,EAAE;AAAA,IAE7D,KAAK,CAAC,UACJ,MAAM,OAAO,aACR,MAAM,OAAO,MAAM,QACpB,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,OAAO,QAAQ,OAAO,CAAC,CAAC,CAAC;AAAA,IACvD,UAAU,CAAC,UAAU;AAAA,MACnB,IAAI,MAAM,QAAQ;AAAA,QAAW;AAAA,MAC7B,MAAM,gBACJ,MAAM,iBAAiB,YAAY,QAAQ,MAAM,KAAK,IAAI,CAAC,MAAM,YAAY;AAAA,MAC/E,WAAW,gBAAgB,eAAe;AAAA,QACxC,MAAM,UAAU,UAAU,eAAe,cAAc,MAAM,UAAU;AAAA,QACvE,IAAI,YAAY;AAAA,UAAW;AAAA,QAC3B,OAAO,IAAI,oBACT,qBAAqB,WACrB,iBAAiB,mBAAmB,MAAM,SAAS,gBAAgB,MAAM,mBAAmB,MAAM,6CAA6C,WACjJ;AAAA,MACF;AAAA,MACA;AAAA;AAAA,EAEJ;AAAA,EACA,OAAO,OAAO,OAAO,SAAS;AAAA;AAGhC,IAAM,qBAAuE;AAAA,EAC3E,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,OAAO;AACT;;;ACrLO,SAAS,8BAA6B,CAC3C,UACA,eAC+B;AAAA,EAC/B,OAAO,cAAc,SAAS,cAC1B,yBAAyB,UAAU,cAAc,QAAQ,cAAc,IAAI,GAAK,IAChF;AAAA;AAsBN,eAAsB,oCAAmC,CAAC,OAOtB;AAAA,EAClC,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,KAAK,uBAAsB,MAAM,OAAO;AAAA,EAC9C,MAAM,MAAM,IAAI;AAAA,EAChB,MAAM,SAAS,MAAM,gCAAgC,MAAM;AAAA,IACzD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,0CAA0C,MAAM,SAAS,MAAM;AAAA,EAC/D,gCAAgC,MAAM,SAAS,MAAM;AAAA,EACrD,MAAM,iBAAiB,MAAM,kCAAkC,MAAM;AAAA,IACnE,UAAU;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,gCAAgC,MAAM,SAAS,cAAc;AAAA,EAE7D,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,2BAA2B;AAAA,IACnE,WAAW,MAAM;AAAA,IACjB,kBAAkB;AAAA,IAClB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC,CACH;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,GAAG;AAAA,IACxC;AAAA,EACF;AAAA;AAIF,eAAe,+BAA+B,CAC5C,MACA,OAO+B;AAAA,EAC/B,MAAM,WAAW,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,IAAI;AAAA,IAAU,OAAO;AAAA,EAErB,IAAI;AAAA,IACF,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAAA,MACvC,IAAI,MAAM;AAAA,MACV,WAAW,MAAM;AAAA,MACjB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,QAAQ;AAAA,MACR,oBAAoB;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,EAAE,iBAAiB,sBAAqB,MAAM,SAAS,6BAA6B;AAAA,MACtF,MAAM;AAAA,IACR;AAAA,IACA,MAAM,aAAa,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM;AAAA,IACZ,CAAC;AAAA,IACD,IAAI,CAAC;AAAA,MAAY,MAAM;AAAA,IACvB,OAAO;AAAA;AAAA;AAIX,SAAS,+BAA+B,CACtC,SACA,gBACM;AAAA,EACN,IAAI,eAAe,WAAW,aAAa;AAAA,IACzC,MAAM,IAAI,MACR,iBAAiB,6BAA6B,eAAe,mBAC/D;AAAA,EACF;AAAA;AAGF,SAAS,yCAAyC,CAChD,SACA,gBACM;AAAA,EACN,IACE,eAAe,uBAAuB,aACtC,CAAC,iBAAgB,eAAe,oBAAoB,iBAAgB,GACpE;AAAA,IACA,MAAM,iBACJ,0BACA,iBAAiB,wCAAwC,eAAe,0CACxE,EAAE,SAAS,EAAE,SAAS,kBAAkB,eAAe,GAAG,EAAE,CAC9D;AAAA,EACF;AAAA;AAGF,SAAS,sCAAsC,CAC7C,SACA,aACgD;AAAA,EAChD,MAAM,mBAAmB,YACtB,OAAO,CAAC,eAAe,WAAW,WAAW,OAAO,EACpD,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,EACzC,IAAI,iBAAiB,SAAS,GAAG;AAAA,IAC/B,MAAM,iBACJ,0BACA,iBAAiB,iFAAiF,iBAAiB,KAAK,IAAI,MAC5H,EAAE,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAC3C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIT,eAAsB,mCAAkC,CAAC,OAM0C;AAAA,EACjG,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,aAAa,uBAAsB,MAAM,OAAO;AAAA,EACtD,MAAM,YACJ,MAAM,iBAAiB,SAAS,cAAc,MAAM,iBAAiB,YAAY;AAAA,EACnF,IAAI,WAAW,SAAS,oBAAoB,UAAU,OAAO,YAAY;AAAA,IACvE,MAAM,IAAI,MACR,iBAAiB,MAAM,gEAAgE,cACzF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,UAAU;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,CAAC,kBAAkB,eAAe,WAAW,UAAU;AAAA,IACzD,MAAM,IAAI,MAAM,iCAAiC,UAAU,oBAAoB;AAAA,EACjF;AAAA,EACA,0CAA0C,MAAM,SAAS,cAAc;AAAA,EAEvE,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,sBAAsB;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,kBAAkB,UAAU;AAAA,EAC9B,CAAC,CACH;AAAA,EACA,MAAM,WAAmC;AAAA,IACvC;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,IAAI,UAAU,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,6BAA4B;AAAA,MACnC,WAAW,SAAS;AAAA,MACpB,UAAU,iBAAiB,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,MACjE,OAAO,MAAM,SAAS,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA;AAIF,eAAsB,4CAA2C,CAAC,OAMzB;AAAA,EACvC,IAAI,MAAM,iBAAiB,SAAS;AAAA,IAAY,OAAO,EAAE,MAAM,WAAW;AAAA,EAE1E,MAAM,MAAM,iCAAiC,MAAM,gBAAgB;AAAA,EACnE,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,MAAM,MAAM,OAAO,IAAI;AAAA,EAC7B,MAAM,OAAO,MAAM,kBAAkB,MAAM,MAAM,WAAW,IAAI,UAAU,EAAE;AAAA,EAC5E,MAAM,cAAc,MAAM,KAAK,iBAAiB,YAAY;AAAA,IAC1D,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,EACf,CAAC;AAAA,EACD,MAAM,aAAa,MAAM,yBAAyB;AAAA,IAChD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,YAAY,IAAI;AAAA,IAChB,iBAAiB,YAAY,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,IACnE;AAAA,EACF,CAAC;AAAA,EAED,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,6BAA4B;AAAA,MACnC,WAAW,IAAI;AAAA,MACf,UAAU,WAAW;AAAA,MACrB,OAAO,MAAM,SAAS,kBAAkB;AAAA,SACpC,WAAW,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,WAAW,UAAU;AAAA,IAClF,CAAC;AAAA,EACH;AAAA;AAGF,SAAS,gCAAgC,CAAC,KAAyD;AAAA,EACjG,IAAI,IAAI,SAAS,eAAe,IAAI,UAAU,SAAS,UAAU,IAAI,eAAe,WAAW;AAAA,IAC7F,MAAM,0BAA0B,kDAAkD;AAAA,EACpF;AAAA,EACA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,EAAE,MAAM,QAAQ,IAAI,IAAI,UAAU,GAAG;AAAA,IAChD,YAAY,EAAE,MAAM,IAAI,WAAW,MAAM,IAAI,IAAI,WAAW,GAAG;AAAA,EACjE;AAAA;AAGF,eAAe,iBAAiB,CAC9B,MACA,WACA,QACqB;AAAA,EACrB,MAAM,OAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,WAAW,IAAI,OAAO,CAAC;AAAA,EAC/D,IAAI,CAAC,QAAQ,KAAK,WAAW,UAAU;AAAA,IACrC,MAAM,0BAA0B,SAAS,uBAAuB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,wBAAwB,CAAC,OAO2C;AAAA,EACjF,IAAI,MAAM,WAAW,SAAS,WAAW;AAAA,IACvC,MAAM,UAAU,MAAM,MAAM,KAAK,SAAS,QAAQ;AAAA,MAChD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM,WAAW;AAAA,IACvB,CAAC;AAAA,IACD,IAAI,CAAC,oBAAoB,SAAS,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,MAC1D,MAAM,0BAA0B,0CAA0C;AAAA,IAC5E;AAAA,IACA,OAAO,EAAE,UAAU,MAAM,iBAAiB,WAAW,QAAQ,GAAG;AAAA,EAClE;AAAA,EAEA,MAAM,cAAc,MAAM,MAAM,KAAK,aAAa,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM,WAAW;AAAA,EACvB,CAAC;AAAA,EACD,IAAI,CAAC,wBAAwB,aAAa,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,IAClE,MAAM,0BAA0B,+CAA+C;AAAA,EACjF;AAAA,EACA,IAAI,YAAY,aAAa;AAAA,IAAW,OAAO,EAAE,UAAU,MAAM,gBAAgB;AAAA,EAEjF,MAAM,kBAAkB,IAAI,IAAI,YAAY,QAAQ;AAAA,EACpD,OAAO;AAAA,IACL,UAAU,MAAM,gBAAgB,OAAO,CAAC,YAAY,gBAAgB,IAAI,OAAO,CAAC;AAAA,EAClF;AAAA;AAGF,SAAS,mBAAmB,CAC1B,SACA,QACA,KAC0B;AAAA,EAC1B,IAAI,CAAC,WAAW,QAAQ,WAAW,UAAU,QAAQ,cAAc;AAAA,IAAW,OAAO;AAAA,EACrF,IAAI,QAAQ,UAAU,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAAG,OAAO;AAAA,EACzD,OACE,QAAQ,sBAAsB,aAAa,QAAQ,kBAAkB,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAIjG,SAAS,uBAAuB,CAC9B,OACA,QACA,KAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,CAAC,iBAAgB,MAAM,SAAS,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAAA,IAAG,OAAO;AAAA,EACpF,OAAO,MAAM,cAAc,aAAa,MAAM,UAAU,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAGlF,SAAS,yBAAyB,CAAC,QAAuB;AAAA,EACxD,OAAO,iBACL,0BACA,sEAAsE,SACxE;AAAA;AAGF,SAAS,kBAAkB,CAAC,MAA4C;AAAA,EACtE,IAAI,CAAC,MAAM;AAAA,IACT,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,iCAAiC,CAC9C,MACA,OAM+B;AAAA,EAC/B,IAAI,MAAM,SAAS,SAAS,MAAM,QAAQ,MAAM,SAAS,gBAAgB,MAAM,aAAa;AAAA,IAC1F,OAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,KAAK,gBAAgB,OAAO;AAAA,IACjC,WAAW,MAAM,SAAS;AAAA,IAC1B,IAAI,MAAM,SAAS;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,EACnB,CAAC;AAAA;;;AC5XI,MAAM,0BAAyB,MAAM;AAAA,EACjC,OAAO;AAClB;;;ACCA,eAAsB,2BAA0B,CAAC,OAM/B;AAAA,EAChB,MAAM,YAAY,MAAM,0BAA0B;AAAA,IAChD,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,EAAE,MAAM,YAAY,IAAI,MAAM,YAAY,OAAO,MAAM,MAAM;AAAA,IACxE,aAAa,CAAC,aAAa,YAAY,OAAO;AAAA,EAChD,CAAC;AAAA,EACD,IAAI,CAAC,WAAW;AAAA,IACd,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA,EAEA,IAAI,UAAU,OAAO,SAAS,cAAc,UAAU,OAAO,SAAS,SAAS;AAAA,IAC7E,IAAI,UAAU,gBAAgB,WAAW;AAAA,MACvC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AAAA,EAIA,IAAI,UAAU,OAAO,SAAS,aAAa;AAAA,IACzC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA;AAIF,eAAsB,oCAAmC,CAAC,OAOxC;AAAA,EAChB,MAAM,YAAY,MAAM,sBAAsB;AAAA,IAC5C,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,OAAO,MAAM;AAAA,IACb,WAAW,EAAE,MAAM,WAAW,kBAAkB,uBAAsB,MAAM,OAAO,EAAE;AAAA,EACvF,CAAC;AAAA,EACD,IACE,CAAC,aACD,UAAU,OAAO,SAAS,eAC1B,UAAU,OAAO,gBAAgB,MAAM,qBACvC;AAAA,IACA,MAAM,IAAI,kBACR,qBAAqB,MAAM,4DAA4D,MAAM,aAC/F;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CAAC,aAAqB,OAAsB;AAAA,EACnE,MAAM,IAAI,kBACR,qBAAqB,iDAAiD,SACxE;AAAA;",
-  "debugId": "86420060B98AACE864756E2164756E21",
-  "names": []
-}

package/dist/chunk-1k89ecfr.js

@@ -1,85 +0,0 @@
-// @bun
-import {
-  isPrimitiveSchema
-} from "./chunk-hvsb78a1.js";
-import {
-  isPlainRecord
-} from "./chunk-wy0qdqfm.js";
-
-// src/ontology/validation/definition.ts
-function assertValidSchema(schema, path, invalid, visiting = new Set) {
-  if (typeof schema === "string") {
-    if (isPrimitiveSchema(schema)) {
-      return;
-    }
-    throw invalid(path);
-  }
-  if (!isPlainRecord(schema) || typeof schema.type !== "string" || visiting.has(schema)) {
-    throw invalid(path);
-  }
-  visiting.add(schema);
-  switch (schema.type) {
-    case "enum": {
-      const values = schema.values;
-      const validValues = isValidEnumValues(values, schema.valueType);
-      if (!validValues || new Set(values).size !== values.length) {
-        throw invalid(path);
-      }
-      break;
-    }
-    case "array":
-      assertValidSchema(schema.items, `${path}.items`, invalid, visiting);
-      break;
-    case "map":
-      if (schema.keySchema !== "string") {
-        throw invalid(path);
-      }
-      assertValidSchema(schema.valueSchema, `${path}.valueSchema`, invalid, visiting);
-      break;
-    case "object": {
-      if (!isPlainRecord(schema.properties)) {
-        throw invalid(path);
-      }
-      for (const [fieldId, field] of Object.entries(schema.properties)) {
-        if (!fieldId.trim() || !isPlainRecord(field) || !("schema" in field)) {
-          throw invalid(`${path}.properties.${fieldId}`);
-        }
-        if (field.required !== undefined && typeof field.required !== "boolean" || field.nullable !== undefined && typeof field.nullable !== "boolean" || field.description !== undefined && (typeof field.description !== "string" || !field.description.trim())) {
-          throw invalid(`${path}.properties.${fieldId}`);
-        }
-        assertValidSchema(field.schema, `${path}.properties.${fieldId}.schema`, invalid, visiting);
-      }
-      break;
-    }
-    case "valueTypeRef":
-      if (typeof schema.valueTypeId !== "string" || !schema.valueTypeId.trim()) {
-        throw invalid(path);
-      }
-      if (schema._resolved !== undefined) {
-        assertValidSchema(schema._resolved, `${path}._resolved`, invalid, visiting);
-      }
-      break;
-    default:
-      throw invalid(path);
-  }
-  visiting.delete(schema);
-}
-function isValidEnumValues(values, valueType) {
-  if (!Array.isArray(values) || values.length === 0) {
-    return false;
-  }
-  for (let index = 0;index < values.length; index += 1) {
-    if (!Object.hasOwn(values, index)) {
-      return false;
-    }
-    const value = values[index];
-    if (valueType === "string" ? typeof value !== "string" : valueType !== "integer" || typeof value !== "number" || !Number.isInteger(value)) {
-      return false;
-    }
-  }
-  return true;
-}
-
-export { assertValidSchema };
-
-//# debugId=6F187C1748947F4164756E2164756E21

package/dist/chunk-1k89ecfr.js.map

@@ -1,10 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/ontology/validation/definition.ts"],
-  "sourcesContent": [
-    "import { isPlainRecord } from \"../../json\"\nimport { isPrimitiveSchema } from \"../primitives\"\n\n/** Validate a declarative schema's shape independently of the primitive that consumes it. */\nexport function assertValidSchema(\n  schema: unknown,\n  path: string,\n  invalid: (path: string) => Error,\n  visiting: Set<object> = new Set()\n): void {\n  if (typeof schema === \"string\") {\n    if (isPrimitiveSchema(schema)) {\n      return\n    }\n    throw invalid(path)\n  }\n  if (!isPlainRecord(schema) || typeof schema.type !== \"string\" || visiting.has(schema)) {\n    throw invalid(path)\n  }\n\n  visiting.add(schema)\n  switch (schema.type) {\n    case \"enum\": {\n      const values = schema.values\n      const validValues = isValidEnumValues(values, schema.valueType)\n      if (!validValues || new Set(values).size !== values.length) {\n        throw invalid(path)\n      }\n      break\n    }\n    case \"array\":\n      assertValidSchema(schema.items, `${path}.items`, invalid, visiting)\n      break\n    case \"map\":\n      if (schema.keySchema !== \"string\") {\n        throw invalid(path)\n      }\n      assertValidSchema(schema.valueSchema, `${path}.valueSchema`, invalid, visiting)\n      break\n    case \"object\": {\n      if (!isPlainRecord(schema.properties)) {\n        throw invalid(path)\n      }\n      for (const [fieldId, field] of Object.entries(schema.properties)) {\n        if (!fieldId.trim() || !isPlainRecord(field) || !(\"schema\" in field)) {\n          throw invalid(`${path}.properties.${fieldId}`)\n        }\n        if (\n          (field.required !== undefined && typeof field.required !== \"boolean\") ||\n          (field.nullable !== undefined && typeof field.nullable !== \"boolean\") ||\n          (field.description !== undefined &&\n            (typeof field.description !== \"string\" || !field.description.trim()))\n        ) {\n          throw invalid(`${path}.properties.${fieldId}`)\n        }\n        assertValidSchema(field.schema, `${path}.properties.${fieldId}.schema`, invalid, visiting)\n      }\n      break\n    }\n    case \"valueTypeRef\":\n      if (typeof schema.valueTypeId !== \"string\" || !schema.valueTypeId.trim()) {\n        throw invalid(path)\n      }\n      if (schema._resolved !== undefined) {\n        assertValidSchema(schema._resolved, `${path}._resolved`, invalid, visiting)\n      }\n      break\n    default:\n      throw invalid(path)\n  }\n  visiting.delete(schema)\n}\n\nfunction isValidEnumValues(values: unknown, valueType: unknown): values is unknown[] {\n  if (!Array.isArray(values) || values.length === 0) {\n    return false\n  }\n\n  for (let index = 0; index < values.length; index += 1) {\n    if (!Object.hasOwn(values, index)) {\n      return false\n    }\n    const value = values[index]\n    if (\n      valueType === \"string\"\n        ? typeof value !== \"string\"\n        : valueType !== \"integer\" || typeof value !== \"number\" || !Number.isInteger(value)\n    ) {\n      return false\n    }\n  }\n  return true\n}\n"
-  ],
-  "mappings": ";;;;;;;;;AAIO,SAAS,iBAAiB,CAC/B,QACA,MACA,SACA,WAAwB,IAAI,KACtB;AAAA,EACN,IAAI,OAAO,WAAW,UAAU;AAAA,IAC9B,IAAI,kBAAkB,MAAM,GAAG;AAAA,MAC7B;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,IAAI;AAAA,EACpB;AAAA,EACA,IAAI,CAAC,cAAc,MAAM,KAAK,OAAO,OAAO,SAAS,YAAY,SAAS,IAAI,MAAM,GAAG;AAAA,IACrF,MAAM,QAAQ,IAAI;AAAA,EACpB;AAAA,EAEA,SAAS,IAAI,MAAM;AAAA,EACnB,QAAQ,OAAO;AAAA,SACR,QAAQ;AAAA,MACX,MAAM,SAAS,OAAO;AAAA,MACtB,MAAM,cAAc,kBAAkB,QAAQ,OAAO,SAAS;AAAA,MAC9D,IAAI,CAAC,eAAe,IAAI,IAAI,MAAM,EAAE,SAAS,OAAO,QAAQ;AAAA,QAC1D,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,IACF;AAAA,SACK;AAAA,MACH,kBAAkB,OAAO,OAAO,GAAG,cAAc,SAAS,QAAQ;AAAA,MAClE;AAAA,SACG;AAAA,MACH,IAAI,OAAO,cAAc,UAAU;AAAA,QACjC,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA,kBAAkB,OAAO,aAAa,GAAG,oBAAoB,SAAS,QAAQ;AAAA,MAC9E;AAAA,SACG,UAAU;AAAA,MACb,IAAI,CAAC,cAAc,OAAO,UAAU,GAAG;AAAA,QACrC,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA,YAAY,SAAS,UAAU,OAAO,QAAQ,OAAO,UAAU,GAAG;AAAA,QAChE,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,cAAc,KAAK,KAAK,EAAE,YAAY,QAAQ;AAAA,UACpE,MAAM,QAAQ,GAAG,mBAAmB,SAAS;AAAA,QAC/C;AAAA,QACA,IACG,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,aAC1D,MAAM,aAAa,aAAa,OAAO,MAAM,aAAa,aAC1D,MAAM,gBAAgB,cACpB,OAAO,MAAM,gBAAgB,YAAY,CAAC,MAAM,YAAY,KAAK,IACpE;AAAA,UACA,MAAM,QAAQ,GAAG,mBAAmB,SAAS;AAAA,QAC/C;AAAA,QACA,kBAAkB,MAAM,QAAQ,GAAG,mBAAmB,kBAAkB,SAAS,QAAQ;AAAA,MAC3F;AAAA,MACA;AAAA,IACF;AAAA,SACK;AAAA,MACH,IAAI,OAAO,OAAO,gBAAgB,YAAY,CAAC,OAAO,YAAY,KAAK,GAAG;AAAA,QACxE,MAAM,QAAQ,IAAI;AAAA,MACpB;AAAA,MACA,IAAI,OAAO,cAAc,WAAW;AAAA,QAClC,kBAAkB,OAAO,WAAW,GAAG,kBAAkB,SAAS,QAAQ;AAAA,MAC5E;AAAA,MACA;AAAA;AAAA,MAEA,MAAM,QAAQ,IAAI;AAAA;AAAA,EAEtB,SAAS,OAAO,MAAM;AAAA;AAGxB,SAAS,iBAAiB,CAAC,QAAiB,WAAyC;AAAA,EACnF,IAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAAG;AAAA,IACjD,OAAO;AAAA,EACT;AAAA,EAEA,SAAS,QAAQ,EAAG,QAAQ,OAAO,QAAQ,SAAS,GAAG;AAAA,IACrD,IAAI,CAAC,OAAO,OAAO,QAAQ,KAAK,GAAG;AAAA,MACjC,OAAO;AAAA,IACT;AAAA,IACA,MAAM,QAAQ,OAAO;AAAA,IACrB,IACE,cAAc,WACV,OAAO,UAAU,WACjB,cAAc,aAAa,OAAO,UAAU,YAAY,CAAC,OAAO,UAAU,KAAK,GACnF;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,OAAO;AAAA;",
-  "debugId": "6F187C1748947F4164756E2164756E21",
-  "names": []
-}

package/dist/chunk-2jntasmh.js.map

@@ -1,13 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/auth/errors.ts", "../src/auth/audience.ts", "../src/auth/cookies.ts", "../src/auth/validation.ts"],
-  "sourcesContent": [
-    "export type AuthRuntimeErrorCode =\n  | \"authentication_required\"\n  | \"auth_storage_missing\"\n  | \"authorization_denied\"\n  | \"invalid_auth_input\"\n  | \"invalid_auth_config\"\n  | \"rate_limited\"\n  | \"production_auth_required\"\n\nexport class AuthRuntimeError extends Error {\n  readonly name = \"AuthRuntimeError\"\n\n  constructor(\n    readonly code: AuthRuntimeErrorCode,\n    message: string\n  ) {\n    super(message)\n  }\n}\n\n/** Why a strategy refused someone who authenticated. Each is something a person can act on. */\nexport type SignInRefusalReason =\n  | \"not_invited\"\n  | \"suspended\"\n  | \"domain_not_allowed\"\n  | \"no_trusted_address\"\n\n/**\n * Thrown by a strategy that refuses a sign-in for a known reason. The sign-in page tells the\n * person which reason, naming `email` when there is one; `message` is for the server log.\n */\nexport class SignInRefusedError extends Error {\n  readonly name = \"SignInRefusedError\"\n\n  constructor(\n    readonly reason: SignInRefusalReason,\n    message: string,\n    readonly email?: string\n  ) {\n    super(message)\n  }\n}\n",
-    "import { AuthRuntimeError } from \"./errors\"\n\nexport const DEFAULT_AUTH_SESSION_AUDIENCE = \"atlas\"\n\nexport type AuthSessionAudience = typeof DEFAULT_AUTH_SESSION_AUDIENCE | \"app\"\n\nexport interface AuthSessionAudienceOptions {\n  readonly audience?: AuthSessionAudience\n}\n\nexport function isValidAuthSessionAudience(value: string): value is AuthSessionAudience {\n  return value === \"atlas\" || value === \"app\"\n}\n\nexport function resolveAuthSessionAudience(\n  value: AuthSessionAudience | undefined\n): AuthSessionAudience {\n  const audience = value ?? DEFAULT_AUTH_SESSION_AUDIENCE\n\n  if (!isValidAuthSessionAudience(audience)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      `[Sixb] Auth session audience '${audience}' is invalid. Expected 'atlas' or 'app'.`\n    )\n  }\n\n  return audience\n}\n",
-    "import type { AuthSessionAudience } from \"./audience\"\nimport { DEFAULT_AUTH_SESSION_AUDIENCE, resolveAuthSessionAudience } from \"./audience\"\nimport type { AuthCookieOptions } from \"./types\"\n\nexport const DEFAULT_SESSION_COOKIE_NAME = \"sixb_session\"\nexport const DEFAULT_CSRF_COOKIE_NAME = \"sixb_csrf\"\n\nexport interface ResolvedAuthCookieOptions {\n  readonly sessionCookieName: string\n  readonly csrfCookieName: string\n  readonly domain?: string\n  readonly secure: boolean | \"auto\"\n  readonly sameSite: \"strict\"\n  readonly csrfHttpOnly: boolean\n}\n\ninterface CookieSerializationOptions {\n  readonly name: string\n  readonly value: string\n  readonly httpOnly?: boolean\n  readonly maxAge?: number\n  readonly expires?: Date\n  readonly domain?: string\n  readonly secure?: boolean\n  readonly sameSite: \"strict\"\n}\n\nexport function resolveAuthCookieOptions(\n  options: AuthCookieOptions | undefined\n): ResolvedAuthCookieOptions {\n  const resolved = {\n    sessionCookieName: options?.sessionCookieName ?? DEFAULT_SESSION_COOKIE_NAME,\n    csrfCookieName: options?.csrfCookieName ?? DEFAULT_CSRF_COOKIE_NAME,\n    domain: options?.cookieDomain,\n    secure: options?.secure ?? \"auto\",\n    sameSite: options?.sameSite ?? \"strict\",\n    csrfHttpOnly: options?.csrfHttpOnly ?? false,\n  }\n\n  assertValidCookieOptions(resolved)\n  return resolved\n}\n\nexport function resolveAuthCookieOptionsForAudience(\n  options: ResolvedAuthCookieOptions,\n  audience: AuthSessionAudience | undefined\n): ResolvedAuthCookieOptions {\n  const resolvedAudience = resolveAuthSessionAudience(audience)\n  if (resolvedAudience === DEFAULT_AUTH_SESSION_AUDIENCE) {\n    return options\n  }\n\n  return {\n    ...options,\n    sessionCookieName: `${options.sessionCookieName}_${resolvedAudience}`,\n    csrfCookieName: `${options.csrfCookieName}_${resolvedAudience}`,\n  }\n}\n\nexport function parseCookieHeader(header: string | null): ReadonlyMap<string, string> {\n  const cookies = new Map<string, string>()\n  if (!header) {\n    return cookies\n  }\n\n  for (const part of header.split(\";\")) {\n    const separator = part.indexOf(\"=\")\n    if (separator <= 0) {\n      continue\n    }\n\n    const name = part.slice(0, separator).trim()\n    if (!name || cookies.has(name)) {\n      continue\n    }\n\n    const value = part.slice(separator + 1).trim()\n    cookies.set(name, value)\n  }\n\n  return cookies\n}\n\nexport function getCookie(request: Request, name: string): string | undefined {\n  return parseCookieHeader(request.headers.get(\"cookie\")).get(name)\n}\n\nexport function serializeCookie(options: CookieSerializationOptions): string {\n  const parts = [`${options.name}=${options.value}`]\n\n  parts.push(\"Path=/\")\n  parts.push(\"SameSite=Strict\")\n\n  if (options.domain) {\n    parts.push(`Domain=${options.domain}`)\n  }\n\n  if (options.httpOnly) {\n    parts.push(\"HttpOnly\")\n  }\n\n  if (options.secure) {\n    parts.push(\"Secure\")\n  }\n\n  if (options.maxAge !== undefined) {\n    parts.push(`Max-Age=${Math.trunc(options.maxAge)}`)\n  }\n\n  if (options.expires) {\n    parts.push(`Expires=${options.expires.toUTCString()}`)\n  }\n\n  return parts.join(\"; \")\n}\n\nexport function shouldUseSecureCookies(\n  request: Request,\n  options: ResolvedAuthCookieOptions\n): boolean {\n  if (\n    requiresSecureCookieName(options.sessionCookieName) ||\n    requiresSecureCookieName(options.csrfCookieName)\n  ) {\n    return true\n  }\n\n  if (typeof options.secure === \"boolean\") {\n    return options.secure\n  }\n\n  const url = new URL(request.url)\n  if (isLocalhost(url.hostname)) {\n    return false\n  }\n\n  return url.protocol === \"https:\" || process.env.NODE_ENV === \"production\"\n}\n\nexport function createSessionCookieHeader(params: {\n  readonly request: Request\n  readonly value: string\n  readonly expiresAt: Date\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  const lifetime = resolveCookieLifetime(params.expiresAt)\n  return serializeCookie({\n    name: params.options.sessionCookieName,\n    value: params.value,\n    httpOnly: true,\n    ...lifetime,\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nexport function createCsrfCookieHeader(params: {\n  readonly request: Request\n  readonly value: string\n  readonly expiresAt: Date\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  const lifetime = resolveCookieLifetime(params.expiresAt)\n  return serializeCookie({\n    name: params.options.csrfCookieName,\n    value: params.value,\n    httpOnly: params.options.csrfHttpOnly,\n    ...lifetime,\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nfunction resolveCookieLifetime(expiresAt: Date): {\n  readonly maxAge: number\n  readonly expires: Date\n} {\n  const expiresAtMs = expiresAt.getTime()\n  if (!Number.isFinite(expiresAtMs)) {\n    throw new Error(\"[Sixb] Auth cookie expiresAt must be a valid date.\")\n  }\n\n  return {\n    maxAge: Math.max(0, Math.floor((expiresAtMs - Date.now()) / 1000)),\n    expires: new Date(expiresAtMs),\n  }\n}\n\nexport function clearSessionCookieHeader(params: {\n  readonly request: Request\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  return serializeCookie({\n    name: params.options.sessionCookieName,\n    value: \"\",\n    httpOnly: true,\n    maxAge: 0,\n    expires: new Date(0),\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nexport function clearCsrfCookieHeader(params: {\n  readonly request: Request\n  readonly options: ResolvedAuthCookieOptions\n}): string {\n  return serializeCookie({\n    name: params.options.csrfCookieName,\n    value: \"\",\n    maxAge: 0,\n    expires: new Date(0),\n    domain: params.options.domain,\n    secure: shouldUseSecureCookies(params.request, params.options),\n    sameSite: params.options.sameSite,\n  })\n}\n\nfunction isLocalhost(hostname: string): boolean {\n  return hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n}\n\nfunction assertValidCookieOptions(options: ResolvedAuthCookieOptions): void {\n  assertValidCookieName(options.sessionCookieName, \"sessionCookieName\")\n  assertValidCookieName(options.csrfCookieName, \"csrfCookieName\")\n\n  if (options.sameSite !== \"strict\") {\n    throw new Error(\"[Sixb] Auth cookie sameSite must be 'strict'.\")\n  }\n\n  if (\n    options.domain &&\n    (isHostPrefixedCookieName(options.sessionCookieName) ||\n      isHostPrefixedCookieName(options.csrfCookieName))\n  ) {\n    throw new Error(\"[Sixb] __Host- auth cookies cannot be configured with cookieDomain.\")\n  }\n\n  if (\n    options.secure === false &&\n    (requiresSecureCookieName(options.sessionCookieName) ||\n      requiresSecureCookieName(options.csrfCookieName))\n  ) {\n    throw new Error(\"[Sixb] __Host- auth cookies require secure cookies.\")\n  }\n}\n\nfunction assertValidCookieName(name: string, label: string): void {\n  if (!/^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/.test(name)) {\n    throw new Error(`[Sixb] Auth cookie ${label} '${name}' is not a valid cookie name.`)\n  }\n}\n\nfunction isHostPrefixedCookieName(name: string): boolean {\n  return name.startsWith(\"__Host-\")\n}\n\nfunction requiresSecureCookieName(name: string): boolean {\n  return isHostPrefixedCookieName(name) || name.startsWith(\"__Secure-\")\n}\n",
-    "import { resolveAuthCookieOptions } from \"./cookies\"\nimport { AuthRuntimeError } from \"./errors\"\nimport type {\n  AuthSessionOptions,\n  AuthStrategy,\n  InvitationDeliveryAuthStrategy,\n  MagicLinkAuthStrategy,\n  OidcAuthStrategy,\n  ResolvedAuthConfig,\n  SixbAuthConfig,\n} from \"./types\"\n\nconst DAY = 24 * 60 * 60 * 1000\n\nexport const DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS = 30 * DAY\nexport const DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS = 7 * DAY\nexport const DEFAULT_AUTH_INVITATION_TTL_MS = 7 * DAY\nexport const MAX_AUTH_INVITATION_TTL_MS = 30 * DAY\n/**\n * Default in-process session cache window. Short enough that a revoked session lingers\n * only briefly, long enough to collapse a burst of requests to a single auth resolution.\n */\nexport const DEFAULT_AUTH_SESSION_CACHE_TTL_MS = 5_000\n\nexport { resolveAuthSessionAudience } from \"./audience\"\n\nexport function resolveAuthConfig(config: SixbAuthConfig | undefined): ResolvedAuthConfig {\n  if (!config) {\n    return {\n      strategy: null,\n      session: resolveAuthSessionOptions(undefined),\n      cookies: resolveAuthCookieOptions(undefined),\n    }\n  }\n\n  const strategy = \"strategy\" in config ? config.strategy : config\n  assertValidStrategy(strategy)\n\n  return {\n    strategy,\n    session: resolveAuthSessionOptions(\"strategy\" in config ? config.session : undefined),\n    cookies: resolveAuthCookieOptions(\"strategy\" in config ? config.cookies : undefined),\n  }\n}\n\nexport function resolveInvitationExpiresAt(value: Date | undefined, now: Date): Date {\n  const expiresAt = value\n    ? new Date(value)\n    : new Date(now.getTime() + DEFAULT_AUTH_INVITATION_TTL_MS)\n  const expiresAtTime = expiresAt.getTime()\n\n  if (!Number.isFinite(expiresAtTime)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation expiresAt must be a valid date.\"\n    )\n  }\n\n  if (expiresAtTime <= now.getTime()) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation expiresAt must be in the future.\"\n    )\n  }\n\n  if (expiresAtTime > now.getTime() + MAX_AUTH_INVITATION_TTL_MS) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation expiresAt must be no more than 30 days in the future.\"\n    )\n  }\n\n  return expiresAt\n}\n\nexport function sanitizeReturnTo(value: string | undefined): string {\n  if (!value || !value.startsWith(\"/\") || value.startsWith(\"//\")) {\n    return \"/\"\n  }\n\n  try {\n    const parsed = new URL(value, \"http://sixb.local\")\n    if (parsed.origin !== \"http://sixb.local\") {\n      return \"/\"\n    }\n\n    return `${parsed.pathname}${parsed.search}${parsed.hash}`\n  } catch {\n    return \"/\"\n  }\n}\n\nexport function assertNonEmpty(value: string, label: string): string {\n  const normalized = value.trim()\n  if (!normalized) {\n    throw new AuthRuntimeError(\"invalid_auth_input\", `[Sixb] ${label} must be a non-empty string.`)\n  }\n  return normalized\n}\n\nexport function normalizePagination(input: { readonly limit?: number; readonly offset?: number }): {\n  readonly limit?: number\n  readonly offset: number\n} {\n  if (input.limit !== undefined && (!Number.isInteger(input.limit) || input.limit < 0)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation list limit must be a non-negative integer.\"\n    )\n  }\n\n  if (input.offset !== undefined && (!Number.isInteger(input.offset) || input.offset < 0)) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_input\",\n      \"[Sixb] Invitation list offset must be a non-negative integer.\"\n    )\n  }\n\n  return {\n    limit: input.limit,\n    offset: input.offset ?? 0,\n  }\n}\n\nfunction resolveAuthSessionOptions(\n  options: AuthSessionOptions | undefined\n): ResolvedAuthConfig[\"session\"] {\n  const idleTimeoutMs = options?.idleTimeoutMs ?? DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS\n  if (!Number.isFinite(idleTimeoutMs) || idleTimeoutMs <= 0) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session idleTimeoutMs must be a positive finite number.\"\n    )\n  }\n\n  const renewalWindowMs = options?.renewalWindowMs ?? DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS\n  if (!Number.isFinite(renewalWindowMs) || renewalWindowMs <= 0) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session renewalWindowMs must be a positive finite number.\"\n    )\n  }\n  if (renewalWindowMs >= idleTimeoutMs) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session renewalWindowMs must be less than idleTimeoutMs.\"\n    )\n  }\n\n  const absoluteTimeoutMs = options?.absoluteTimeoutMs\n  if (\n    absoluteTimeoutMs !== undefined &&\n    (!Number.isFinite(absoluteTimeoutMs) || absoluteTimeoutMs <= 0)\n  ) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session absoluteTimeoutMs must be a positive finite number when configured.\"\n    )\n  }\n  if (absoluteTimeoutMs !== undefined && absoluteTimeoutMs < idleTimeoutMs) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session absoluteTimeoutMs must be greater than or equal to idleTimeoutMs.\"\n    )\n  }\n\n  const cacheTtlMs = options?.cacheTtlMs ?? DEFAULT_AUTH_SESSION_CACHE_TTL_MS\n  if (!Number.isFinite(cacheTtlMs) || cacheTtlMs < 0) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session cacheTtlMs must be a non-negative finite number.\"\n    )\n  }\n  if (cacheTtlMs >= renewalWindowMs) {\n    throw new AuthRuntimeError(\n      \"invalid_auth_config\",\n      \"[Sixb] Auth session cacheTtlMs must be less than renewalWindowMs.\"\n    )\n  }\n\n  return {\n    idleTimeoutMs,\n    renewalWindowMs,\n    ...(absoluteTimeoutMs === undefined ? {} : { absoluteTimeoutMs }),\n    cacheTtlMs,\n  }\n}\n\nexport function isMagicLinkAuthStrategy(\n  strategy: AuthStrategy | null\n): strategy is MagicLinkAuthStrategy {\n  if (!strategy || strategy.kind !== \"magicLink\") {\n    return false\n  }\n\n  const candidate = strategy as {\n    readonly requestMagicLink?: unknown\n    readonly completeMagicLinkSignIn?: unknown\n  }\n\n  return (\n    typeof candidate.requestMagicLink === \"function\" &&\n    typeof candidate.completeMagicLinkSignIn === \"function\"\n  )\n}\n\nexport function isInvitationDeliveryAuthStrategy(\n  strategy: AuthStrategy | null\n): strategy is InvitationDeliveryAuthStrategy {\n  if (!strategy) {\n    return false\n  }\n\n  const candidate = strategy as {\n    readonly deliverInvitation?: unknown\n  }\n\n  return typeof candidate.deliverInvitation === \"function\"\n}\n\nexport function isOidcAuthStrategy(strategy: AuthStrategy | null): strategy is OidcAuthStrategy {\n  if (!strategy || strategy.kind !== \"oidc\") {\n    return false\n  }\n\n  const candidate = strategy as {\n    readonly startOidcSignIn?: unknown\n    readonly completeOidcSignIn?: unknown\n  }\n\n  return (\n    typeof candidate.startOidcSignIn === \"function\" &&\n    typeof candidate.completeOidcSignIn === \"function\"\n  )\n}\n\nfunction assertValidStrategy(strategy: AuthStrategy): void {\n  if (!strategy.id.trim()) {\n    throw new AuthRuntimeError(\"invalid_auth_config\", \"[Sixb] Auth strategy id is required.\")\n  }\n}\n"
-  ],
-  "mappings": ";;AASO,MAAM,0BAAyB,MAAM;AAAA,EAI/B;AAAA,EAHF,OAAO;AAAA,EAEhB,WAAW,CACA,MACT,SACA;AAAA,IACA,MAAM,OAAO;AAAA,IAHJ;AAAA;AAKb;AAAA;AAaO,MAAM,4BAA2B,MAAM;AAAA,EAIjC;AAAA,EAEA;AAAA,EALF,OAAO;AAAA,EAEhB,WAAW,CACA,QACT,SACS,OACT;AAAA,IACA,MAAM,OAAO;AAAA,IAJJ;AAAA,IAEA;AAAA;AAIb;;;ACvCO,IAAM,iCAAgC;AAQtC,SAAS,2BAA0B,CAAC,OAA6C;AAAA,EACtF,OAAO,UAAU,WAAW,UAAU;AAAA;AAGjC,SAAS,2BAA0B,CACxC,OACqB;AAAA,EACrB,MAAM,WAAW,SAAS;AAAA,EAE1B,IAAI,CAAC,4BAA2B,QAAQ,GAAG;AAAA,IACzC,MAAM,IAAI,kBACR,uBACA,iCAAiC,kDACnC;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;;;ACtBF,IAAM,+BAA8B;AACpC,IAAM,4BAA2B;AAsBjC,SAAS,yBAAwB,CACtC,SAC2B;AAAA,EAC3B,MAAM,WAAW;AAAA,IACf,mBAAmB,SAAS,qBAAqB;AAAA,IACjD,gBAAgB,SAAS,kBAAkB;AAAA,IAC3C,QAAQ,SAAS;AAAA,IACjB,QAAQ,SAAS,UAAU;AAAA,IAC3B,UAAU,SAAS,YAAY;AAAA,IAC/B,cAAc,SAAS,gBAAgB;AAAA,EACzC;AAAA,EAEA,yBAAyB,QAAQ;AAAA,EACjC,OAAO;AAAA;AAGF,SAAS,mCAAmC,CACjD,SACA,UAC2B;AAAA,EAC3B,MAAM,mBAAmB,4BAA2B,QAAQ;AAAA,EAC5D,IAAI,qBAAqB,gCAA+B;AAAA,IACtD,OAAO;AAAA,EACT;AAAA,EAEA,OAAO;AAAA,OACF;AAAA,IACH,mBAAmB,GAAG,QAAQ,qBAAqB;AAAA,IACnD,gBAAgB,GAAG,QAAQ,kBAAkB;AAAA,EAC/C;AAAA;AAGK,SAAS,kBAAiB,CAAC,QAAoD;AAAA,EACpF,MAAM,UAAU,IAAI;AAAA,EACpB,IAAI,CAAC,QAAQ;AAAA,IACX,OAAO;AAAA,EACT;AAAA,EAEA,WAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AAAA,IACpC,MAAM,YAAY,KAAK,QAAQ,GAAG;AAAA,IAClC,IAAI,aAAa,GAAG;AAAA,MAClB;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK;AAAA,IAC3C,IAAI,CAAC,QAAQ,QAAQ,IAAI,IAAI,GAAG;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,MAAM,QAAQ,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK;AAAA,IAC7C,QAAQ,IAAI,MAAM,KAAK;AAAA,EACzB;AAAA,EAEA,OAAO;AAAA;AAGF,SAAS,UAAS,CAAC,SAAkB,MAAkC;AAAA,EAC5E,OAAO,mBAAkB,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,IAAI;AAAA;AAG3D,SAAS,gBAAe,CAAC,SAA6C;AAAA,EAC3E,MAAM,QAAQ,CAAC,GAAG,QAAQ,QAAQ,QAAQ,OAAO;AAAA,EAEjD,MAAM,KAAK,QAAQ;AAAA,EACnB,MAAM,KAAK,iBAAiB;AAAA,EAE5B,IAAI,QAAQ,QAAQ;AAAA,IAClB,MAAM,KAAK,UAAU,QAAQ,QAAQ;AAAA,EACvC;AAAA,EAEA,IAAI,QAAQ,UAAU;AAAA,IACpB,MAAM,KAAK,UAAU;AAAA,EACvB;AAAA,EAEA,IAAI,QAAQ,QAAQ;AAAA,IAClB,MAAM,KAAK,QAAQ;AAAA,EACrB;AAAA,EAEA,IAAI,QAAQ,WAAW,WAAW;AAAA,IAChC,MAAM,KAAK,WAAW,KAAK,MAAM,QAAQ,MAAM,GAAG;AAAA,EACpD;AAAA,EAEA,IAAI,QAAQ,SAAS;AAAA,IACnB,MAAM,KAAK,WAAW,QAAQ,QAAQ,YAAY,GAAG;AAAA,EACvD;AAAA,EAEA,OAAO,MAAM,KAAK,IAAI;AAAA;AAGjB,SAAS,uBAAsB,CACpC,SACA,SACS;AAAA,EACT,IACE,yBAAyB,QAAQ,iBAAiB,KAClD,yBAAyB,QAAQ,cAAc,GAC/C;AAAA,IACA,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,OAAO,QAAQ,WAAW,WAAW;AAAA,IACvC,OAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAAA,EAC/B,IAAI,YAAY,IAAI,QAAQ,GAAG;AAAA,IAC7B,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,IAAI,aAAa,YAAY;AAAA;AAG/B,SAAS,0BAAyB,CAAC,QAK/B;AAAA,EACT,MAAM,WAAW,sBAAsB,OAAO,SAAS;AAAA,EACvD,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO,OAAO;AAAA,IACd,UAAU;AAAA,OACP;AAAA,IACH,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGI,SAAS,uBAAsB,CAAC,QAK5B;AAAA,EACT,MAAM,WAAW,sBAAsB,OAAO,SAAS;AAAA,EACvD,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO,OAAO;AAAA,IACd,UAAU,OAAO,QAAQ;AAAA,OACtB;AAAA,IACH,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGH,SAAS,qBAAqB,CAAC,WAG7B;AAAA,EACA,MAAM,cAAc,UAAU,QAAQ;AAAA,EACtC,IAAI,CAAC,OAAO,SAAS,WAAW,GAAG;AAAA,IACjC,MAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AAAA,EAEA,OAAO;AAAA,IACL,QAAQ,KAAK,IAAI,GAAG,KAAK,OAAO,cAAc,KAAK,IAAI,KAAK,IAAI,CAAC;AAAA,IACjE,SAAS,IAAI,KAAK,WAAW;AAAA,EAC/B;AAAA;AAGK,SAAS,yBAAwB,CAAC,QAG9B;AAAA,EACT,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO;AAAA,IACP,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,SAAS,IAAI,KAAK,CAAC;AAAA,IACnB,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGI,SAAS,sBAAqB,CAAC,QAG3B;AAAA,EACT,OAAO,iBAAgB;AAAA,IACrB,MAAM,OAAO,QAAQ;AAAA,IACrB,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS,IAAI,KAAK,CAAC;AAAA,IACnB,QAAQ,OAAO,QAAQ;AAAA,IACvB,QAAQ,wBAAuB,OAAO,SAAS,OAAO,OAAO;AAAA,IAC7D,UAAU,OAAO,QAAQ;AAAA,EAC3B,CAAC;AAAA;AAGH,SAAS,WAAW,CAAC,UAA2B;AAAA,EAC9C,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAAA;AAG9E,SAAS,wBAAwB,CAAC,SAA0C;AAAA,EAC1E,sBAAsB,QAAQ,mBAAmB,mBAAmB;AAAA,EACpE,sBAAsB,QAAQ,gBAAgB,gBAAgB;AAAA,EAE9D,IAAI,QAAQ,aAAa,UAAU;AAAA,IACjC,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EAEA,IACE,QAAQ,WACP,yBAAyB,QAAQ,iBAAiB,KACjD,yBAAyB,QAAQ,cAAc,IACjD;AAAA,IACA,MAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAAA,EAEA,IACE,QAAQ,WAAW,UAClB,yBAAyB,QAAQ,iBAAiB,KACjD,yBAAyB,QAAQ,cAAc,IACjD;AAAA,IACA,MAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AAAA;AAGF,SAAS,qBAAqB,CAAC,MAAc,OAAqB;AAAA,EAChE,IAAI,CAAC,iCAAiC,KAAK,IAAI,GAAG;AAAA,IAChD,MAAM,IAAI,MAAM,sBAAsB,UAAU,mCAAmC;AAAA,EACrF;AAAA;AAGF,SAAS,wBAAwB,CAAC,MAAuB;AAAA,EACvD,OAAO,KAAK,WAAW,SAAS;AAAA;AAGlC,SAAS,wBAAwB,CAAC,MAAuB;AAAA,EACvD,OAAO,yBAAyB,IAAI,KAAK,KAAK,WAAW,WAAW;AAAA;;;ACzPtE,IAAM,MAAM,KAAK,KAAK,KAAK;AAEpB,IAAM,wCAAuC,KAAK;AAClD,IAAM,0CAAyC,IAAI;AACnD,IAAM,kCAAiC,IAAI;AAC3C,IAAM,8BAA6B,KAAK;AAKxC,IAAM,qCAAoC;AAI1C,SAAS,kBAAiB,CAAC,QAAwD;AAAA,EACxF,IAAI,CAAC,QAAQ;AAAA,IACX,OAAO;AAAA,MACL,UAAU;AAAA,MACV,SAAS,0BAA0B,SAAS;AAAA,MAC5C,SAAS,0BAAyB,SAAS;AAAA,IAC7C;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,cAAc,SAAS,OAAO,WAAW;AAAA,EAC1D,oBAAoB,QAAQ;AAAA,EAE5B,OAAO;AAAA,IACL;AAAA,IACA,SAAS,0BAA0B,cAAc,SAAS,OAAO,UAAU,SAAS;AAAA,IACpF,SAAS,0BAAyB,cAAc,SAAS,OAAO,UAAU,SAAS;AAAA,EACrF;AAAA;AAGK,SAAS,0BAA0B,CAAC,OAAyB,KAAiB;AAAA,EACnF,MAAM,YAAY,QACd,IAAI,KAAK,KAAK,IACd,IAAI,KAAK,IAAI,QAAQ,IAAI,+BAA8B;AAAA,EAC3D,MAAM,gBAAgB,UAAU,QAAQ;AAAA,EAExC,IAAI,CAAC,OAAO,SAAS,aAAa,GAAG;AAAA,IACnC,MAAM,IAAI,kBACR,sBACA,mDACF;AAAA,EACF;AAAA,EAEA,IAAI,iBAAiB,IAAI,QAAQ,GAAG;AAAA,IAClC,MAAM,IAAI,kBACR,sBACA,oDACF;AAAA,EACF;AAAA,EAEA,IAAI,gBAAgB,IAAI,QAAQ,IAAI,6BAA4B;AAAA,IAC9D,MAAM,IAAI,kBACR,sBACA,yEACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;AAoBF,SAAS,eAAc,CAAC,OAAe,OAAuB;AAAA,EACnE,MAAM,aAAa,MAAM,KAAK;AAAA,EAC9B,IAAI,CAAC,YAAY;AAAA,IACf,MAAM,IAAI,kBAAiB,sBAAsB,UAAU,mCAAmC;AAAA,EAChG;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,mBAAmB,CAAC,OAGlC;AAAA,EACA,IAAI,MAAM,UAAU,cAAc,CAAC,OAAO,UAAU,MAAM,KAAK,KAAK,MAAM,QAAQ,IAAI;AAAA,IACpF,MAAM,IAAI,kBACR,sBACA,8DACF;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,WAAW,cAAc,CAAC,OAAO,UAAU,MAAM,MAAM,KAAK,MAAM,SAAS,IAAI;AAAA,IACvF,MAAM,IAAI,kBACR,sBACA,+DACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,QAAQ,MAAM,UAAU;AAAA,EAC1B;AAAA;AAGF,SAAS,yBAAyB,CAChC,SAC+B;AAAA,EAC/B,MAAM,gBAAgB,SAAS,iBAAiB;AAAA,EAChD,IAAI,CAAC,OAAO,SAAS,aAAa,KAAK,iBAAiB,GAAG;AAAA,IACzD,MAAM,IAAI,kBACR,uBACA,qEACF;AAAA,EACF;AAAA,EAEA,MAAM,kBAAkB,SAAS,mBAAmB;AAAA,EACpD,IAAI,CAAC,OAAO,SAAS,eAAe,KAAK,mBAAmB,GAAG;AAAA,IAC7D,MAAM,IAAI,kBACR,uBACA,uEACF;AAAA,EACF;AAAA,EACA,IAAI,mBAAmB,eAAe;AAAA,IACpC,MAAM,IAAI,kBACR,uBACA,sEACF;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,SAAS;AAAA,EACnC,IACE,sBAAsB,cACrB,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,IAC7D;AAAA,IACA,MAAM,IAAI,kBACR,uBACA,yFACF;AAAA,EACF;AAAA,EACA,IAAI,sBAAsB,aAAa,oBAAoB,eAAe;AAAA,IACxE,MAAM,IAAI,kBACR,uBACA,uFACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAAS,cAAc;AAAA,EAC1C,IAAI,CAAC,OAAO,SAAS,UAAU,KAAK,aAAa,GAAG;AAAA,IAClD,MAAM,IAAI,kBACR,uBACA,sEACF;AAAA,EACF;AAAA,EACA,IAAI,cAAc,iBAAiB;AAAA,IACjC,MAAM,IAAI,kBACR,uBACA,mEACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,OACI,sBAAsB,YAAY,CAAC,IAAI,EAAE,kBAAkB;AAAA,IAC/D;AAAA,EACF;AAAA;AAGK,SAAS,wBAAuB,CACrC,UACmC;AAAA,EACnC,IAAI,CAAC,YAAY,SAAS,SAAS,aAAa;AAAA,IAC9C,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAKlB,OACE,OAAO,UAAU,qBAAqB,cACtC,OAAO,UAAU,4BAA4B;AAAA;AAI1C,SAAS,iCAAgC,CAC9C,UAC4C;AAAA,EAC5C,IAAI,CAAC,UAAU;AAAA,IACb,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAIlB,OAAO,OAAO,UAAU,sBAAsB;AAAA;AAGzC,SAAS,mBAAkB,CAAC,UAA6D;AAAA,EAC9F,IAAI,CAAC,YAAY,SAAS,SAAS,QAAQ;AAAA,IACzC,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY;AAAA,EAKlB,OACE,OAAO,UAAU,oBAAoB,cACrC,OAAO,UAAU,uBAAuB;AAAA;AAI5C,SAAS,mBAAmB,CAAC,UAA8B;AAAA,EACzD,IAAI,CAAC,SAAS,GAAG,KAAK,GAAG;AAAA,IACvB,MAAM,IAAI,kBAAiB,uBAAuB,sCAAsC;AAAA,EAC1F;AAAA;",
-  "debugId": "E4EC0B2B5EB9DD3264756E2164756E21",
-  "names": []
-}