@sixb/core 0.1.20 → 0.1.22

package/dist/chunk-rrzt8jdy.js.map

@@ -1,14 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/security/redactions.ts", "../src/objects/property-clearance.ts", "../src/agents/authority.ts", "../src/storage/workflow-runs/errors.ts", "../src/storage/workflow-runs/provider.ts"],
-  "sourcesContent": [
-    "import type { Redactions } from \"./types\"\n\n/** List the values hidden from a reader that lacks a clearance for their markings. */\nexport function missingClearanceRedactions(ids: Iterable<string>): Redactions {\n  return Object.fromEntries([...ids].map((id) => [id, { reason: \"missing_clearance\" }] as const))\n}\n",
-    "import { AuthorizationError } from \"../authorization/errors\"\nimport type { StoredDomainEvent } from \"../events/types\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport { missingClearanceRedactions } from \"../security/redactions\"\nimport type { ExpandedLinkValue, ExpandedObjectRow, ObjectRow } from \"../storage\"\nimport type {\n  ObjectQueryAdmissionState,\n  ObjectQueryPropertyUse,\n  ObjectQuerySemanticAdmission,\n} from \"./query/validate\"\n\n/**\n * The marked properties one reader cannot read, resolved once from its clearances.\n *\n * A property is readable when the reader clears every one of its markings. Unreadable properties\n * are omitted from rows and cannot be used to select, order, or aggregate objects.\n */\nexport interface PropertyClearance {\n  /** Marked properties of this object type the reader cannot read. */\n  hiddenPropertyIds(objectTypeId: string): ReadonlySet<string>\n  /** First marking on the property that the reader is not cleared for. */\n  missingMarking(objectTypeId: string, propertyId: string): string | undefined\n}\n\nconst NO_PROPERTIES: ReadonlySet<string> = new Set()\n\n// Readers are built per execution, but few distinct clearance sets exist per ontology.\nconst clearancesByOntology = new WeakMap<\n  OntologyDefinitionCatalog,\n  Map<string, PropertyClearance | undefined>\n>()\n\n/**\n * Resolve what a reader with these clearances cannot read. Returns `undefined` when it can read\n * every property, so callers skip redaction entirely.\n */\nexport function resolvePropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  clearances: ReadonlySet<string>\n): PropertyClearance | undefined {\n  let resolved = clearancesByOntology.get(ontology)\n  if (!resolved) {\n    resolved = new Map()\n    clearancesByOntology.set(ontology, resolved)\n  }\n  const key = JSON.stringify([...clearances].sort())\n  if (!resolved.has(key)) resolved.set(key, createPropertyClearance(ontology, clearances))\n  return resolved.get(key)\n}\n\nfunction createPropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  clearances: ReadonlySet<string>\n): PropertyClearance | undefined {\n  const missingByType = new Map<string, ReadonlyMap<string, string>>()\n  for (const objectType of ontology.listObjectTypes()) {\n    const missing = new Map<string, string>()\n    for (const property of objectType.properties) {\n      const marking = property.markings?.find((markingId) => !clearances.has(markingId))\n      if (marking !== undefined) missing.set(property.id, marking)\n    }\n    if (missing.size > 0) missingByType.set(objectType.id, missing)\n  }\n  if (missingByType.size === 0) return undefined\n\n  const hiddenByType = new Map(\n    [...missingByType].map(([objectTypeId, missing]) => [objectTypeId, new Set(missing.keys())])\n  )\n  return Object.freeze({\n    hiddenPropertyIds: (objectTypeId: string) => hiddenByType.get(objectTypeId) ?? NO_PROPERTIES,\n    missingMarking: (objectTypeId: string, propertyId: string) =>\n      missingByType.get(objectTypeId)?.get(propertyId),\n  })\n}\n\n/**\n * Omit unreadable properties from a row and the objects expanded under it.\n *\n * Every hidden property of the type is listed in `redactions`, whether or not the row holds a\n * value: listing only present values would reveal which hidden properties are empty.\n */\nexport function redactObjectRow<TRow extends ObjectRow>(\n  row: TRow,\n  clearance: PropertyClearance\n): TRow {\n  const hidden = clearance.hiddenPropertyIds(row.objectTypeId)\n  const links = row.links\n  if (hidden.size === 0 && links === undefined) return row\n\n  const redacted: TRow = { ...row }\n  if (hidden.size > 0) {\n    redacted.properties = withoutKeys(row.properties, hidden)\n    redacted.redactions = missingClearanceRedactions(hidden)\n  }\n  if (links !== undefined) {\n    redacted.links = Object.fromEntries(\n      Object.entries(links).map(([linkId, value]) => [linkId, redactLinkValue(value, clearance)])\n    )\n  }\n  return redacted\n}\n\nfunction redactLinkValue(\n  value: ExpandedLinkValue,\n  clearance: PropertyClearance\n): ExpandedLinkValue {\n  if (value === null) return null\n  if (Array.isArray(value)) return value.map((row) => redactObjectRow(row, clearance))\n  // Array.isArray does not narrow a readonly[] away, so assert the single-object case.\n  return redactObjectRow(value as ExpandedObjectRow, clearance)\n}\n\n/**\n * Omit unreadable properties from an object event, under the same contract as rows. Other events\n * carry no markable value: link properties and telemetry properties cannot be marked.\n */\nexport function redactDomainEvent(\n  event: StoredDomainEvent,\n  clearance: PropertyClearance\n): StoredDomainEvent {\n  if (event.topic !== \"objects\") return event\n  const hidden = clearance.hiddenPropertyIds(event.payload.objectTypeId)\n  if (hidden.size === 0) return event\n\n  const payload = {\n    ...event.payload,\n    propertyChanges: withoutKeys(event.payload.propertyChanges, hidden),\n    redactions: missingClearanceRedactions(hidden),\n  }\n  if (event.type === \"object.deleted\") return { ...event, payload }\n  return {\n    ...event,\n    payload: { ...payload, properties: withoutKeys(event.payload.properties, hidden) },\n  }\n}\n\nfunction withoutKeys<TValue>(\n  record: Readonly<Record<string, TValue>>,\n  hidden: ReadonlySet<string>\n): Record<string, TValue> {\n  const kept: Record<string, TValue> = {}\n  for (const [key, value] of Object.entries(record)) {\n    if (!hidden.has(key)) kept[key] = value\n  }\n  return kept\n}\n\n/**\n * Reject every query use of a property the reader cannot read, except projection.\n *\n * Filtering, ordering, searching, or faceting by a hidden value would reveal it through which\n * objects match and in what order. Projection only shapes the output, which is redacted anyway.\n */\nexport function createClearanceQueryAdmission(\n  clearance: PropertyClearance\n): ObjectQuerySemanticAdmission {\n  // Each state stands for the object types a query has reached so far. A property without an\n  // explicit type is checked against all of them.\n  const reachedTypes = new WeakMap<ObjectQueryAdmissionState, readonly string[]>()\n  const state = (objectTypeIds: readonly string[]): ObjectQueryAdmissionState => {\n    const created = Object.freeze({})\n    reachedTypes.set(created, Object.freeze([...objectTypeIds]))\n    return created\n  }\n  const reached = (input: ObjectQueryAdmissionState): readonly string[] => {\n    const objectTypeIds = reachedTypes.get(input)\n    if (!objectTypeIds) {\n      throw new Error(\"[Sixb] Clearance query admission received a state it did not create.\")\n    }\n    return objectTypeIds\n  }\n  const empty = state([])\n\n  const admission: ObjectQuerySemanticAdmission = {\n    empty: () => empty,\n    source: (input) => ({ state: state(input.result.objectTypeIds) }),\n    edge: (input) => ({ state: state(input.result.objectTypeIds) }),\n    // A difference only returns objects of its first input.\n    set: (input) =>\n      input.op === \"subtract\"\n        ? (input.states[0] ?? empty)\n        : state([...new Set(input.states.flatMap(reached))]),\n    property: (input) => {\n      if (input.use === \"project\") return undefined\n      const objectTypeIds =\n        input.objectTypeId === undefined ? reached(input.state) : [input.objectTypeId]\n      for (const objectTypeId of objectTypeIds) {\n        const marking = clearance.missingMarking(objectTypeId, input.propertyId)\n        if (marking === undefined) continue\n        return new AuthorizationError(\n          `clearance:marking:${marking}`,\n          `[Sixb] Cannot ${PROPERTY_USE_VERBS[input.use]} '${objectTypeId}.${input.propertyId}' at '${input.path}': it requires clearance for marking '${marking}'.`\n        )\n      }\n      return undefined\n    },\n  }\n  return Object.freeze(admission)\n}\n\nconst PROPERTY_USE_VERBS: Readonly<Record<ObjectQueryPropertyUse, string>> = {\n  filter: \"filter by\",\n  text: \"search\",\n  vector: \"run a vector search over\",\n  sort: \"sort by\",\n  project: \"project\",\n  \"expand.orderBy\": \"order expanded objects by\",\n  facet: \"facet by\",\n}\n",
-    "import { principalsEqual, SYSTEM_PRINCIPAL } from \"../auth\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport { resolveAuthorizationContext } from \"../authorization\"\nimport { createSixbError } from \"../errors/internal\"\nimport type { AuthorizablePrincipal, AuthorizationRef } from \"../execution\"\nimport { type PropertyClearance, resolvePropertyClearance } from \"../objects/property-clearance\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport type { SecurityDefinitionCatalog } from \"../security\"\nimport type {\n  AccessTokenRecord,\n  AuthStorage,\n  ServiceAccountGroupMembershipRecord,\n  ServiceAccountRecord,\n  SessionRecord,\n  UserRecord,\n} from \"../storage/auth\"\nimport { AuthStorageError } from \"../storage/auth\"\nimport { agentServiceAccountId } from \"./identity\"\n\nexport type AgentExecutionAuthorization =\n  | { readonly type: \"principal\"; readonly context: AuthorizationContext }\n  | { readonly type: \"disabled\" }\n\n/**\n * The marked properties an Agent execution cannot read, resolved exactly as its object reader\n * resolves them. Disabled authorization reads everything.\n */\nexport function resolveAgentPropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  authorization: AgentExecutionAuthorization\n): PropertyClearance | undefined {\n  return authorization.type === \"principal\"\n    ? resolvePropertyClearance(ontology, authorization.context.clearances ?? new Set())\n    : undefined\n}\n\ntype UserCredentialRef = NonNullable<\n  Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n>\n\ninterface CredentialedUserAuthorizationRef {\n  readonly type: \"principal\"\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"user\" }>\n  readonly credential: UserCredentialRef\n}\n\nexport { agentServiceAccountId } from \"./identity\"\n\nexport interface AgentExecutionIdentity {\n  readonly serviceAccount: ServiceAccountRecord\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"serviceAccount\" }>\n  readonly groupMemberships: readonly ServiceAccountGroupMembershipRecord[]\n}\n\n/** Ensure a framework-managed Agent actor exists with exactly its declared group memberships. */\nexport async function ensureManagedAgentExecutionIdentity(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly name: string\n  readonly description: string\n  readonly groupIds: readonly string[]\n}): Promise<AgentExecutionIdentity> {\n  const auth = requireAuthStorage(input.auth)\n  const id = agentServiceAccountId(input.actorId)\n  const now = new Date()\n  const loaded = await loadOrCreateAgentServiceAccount(auth, {\n    id,\n    projectId: input.projectId,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertFrameworkManagedAgentServiceAccount(input.actorId, loaded)\n  assertActiveAgentServiceAccount(input.actorId, loaded)\n  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {\n    existing: loaded,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertActiveAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: id,\n      groupIds: input.groupIds,\n      source: \"agent\",\n      updatedAt: now,\n    })\n  )\n\n  return {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id },\n    groupMemberships,\n  }\n}\n\n/** Load the managed identity, recovering only the expected concurrent-create race. */\nasync function loadOrCreateAgentServiceAccount(\n  auth: AuthStorage,\n  input: {\n    readonly id: string\n    readonly projectId: string\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  const existing = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: input.id,\n  })\n  if (existing) return existing\n\n  try {\n    return await auth.serviceAccounts.create({\n      id: input.id,\n      projectId: input.projectId,\n      name: input.name,\n      description: input.description,\n      status: \"active\",\n      createdByPrincipal: SYSTEM_PRINCIPAL,\n      createdAt: input.updatedAt,\n      updatedAt: input.updatedAt,\n    })\n  } catch (error) {\n    if (!(error instanceof AuthStorageError) || error.code !== \"duplicate_service_account\") {\n      throw error\n    }\n    const concurrent = await auth.serviceAccounts.getById({\n      projectId: input.projectId,\n      id: input.id,\n    })\n    if (!concurrent) throw error\n    return concurrent\n  }\n}\n\nfunction assertActiveAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (serviceAccount.status === \"suspended\") {\n    throw new Error(\n      `[Sixb] Agent '${actorId}' service account '${serviceAccount.id}' is suspended.`\n    )\n  }\n}\n\nfunction assertFrameworkManagedAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (\n    serviceAccount.createdByPrincipal === undefined ||\n    !principalsEqual(serviceAccount.createdByPrincipal, SYSTEM_PRINCIPAL)\n  ) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' cannot use service account '${serviceAccount.id}' because it is not managed by Sixb.`,\n      { details: { actorId, serviceAccountId: serviceAccount.id } }\n    )\n  }\n}\n\nfunction requireDefinitionOwnedGroupMemberships(\n  actorId: string,\n  memberships: readonly ServiceAccountGroupMembershipRecord[]\n): readonly ServiceAccountGroupMembershipRecord[] {\n  const externalGroupIds = memberships\n    .filter((membership) => membership.source !== \"agent\")\n    .map((membership) => membership.groupId)\n  if (externalGroupIds.length > 0) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' service account has group memberships not managed by its definition: ${externalGroupIds.join(\", \")}.`,\n      { details: { actorId, externalGroupIds } }\n    )\n  }\n  return memberships\n}\n\n/** Resolve current grants for the service account referenced by a durable Agent execution. */\nexport async function resolveAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n}): Promise<{ readonly identity: AgentExecutionIdentity; readonly context: AuthorizationContext }> {\n  const auth = requireAuthStorage(input.auth)\n  const expectedId = agentServiceAccountId(input.actorId)\n  const principal =\n    input.authorizationRef.type === \"principal\" ? input.authorizationRef.principal : null\n  if (principal?.type !== \"serviceAccount\" || principal.id !== expectedId) {\n    throw new Error(\n      `[Sixb] Agent '${input.actorId}' execution authority must reference service account '${expectedId}'.`\n    )\n  }\n\n  const serviceAccount = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: principal.id,\n  })\n  if (!serviceAccount || serviceAccount.status !== \"active\") {\n    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`)\n  }\n  assertFrameworkManagedAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.listForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: principal.id,\n    })\n  )\n  const identity: AgentExecutionIdentity = {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id: principal.id },\n    groupMemberships,\n  }\n  return {\n    identity,\n    context: resolveAuthorizationContext({\n      principal: identity.principal,\n      groupIds: groupMemberships.map((membership) => membership.groupId),\n      roles: input.security.listResolvedRoles(),\n    }),\n  }\n}\n\n/** Revalidate the durable user authority inherited by a conversational or child Agent. */\nexport async function resolveInheritedAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n  readonly now?: Date\n}): Promise<AgentExecutionAuthorization> {\n  if (input.authorizationRef.type === \"disabled\") return { type: \"disabled\" }\n\n  const ref = requireCredentialedUserAuthority(input.authorizationRef)\n  const auth = requireAuthStorage(input.auth)\n  const now = input.now ?? new Date()\n  const user = await requireActiveUser(auth, input.projectId, ref.principal.id)\n  const memberships = await auth.groupMemberships.listForUser({\n    projectId: input.projectId,\n    userId: user.id,\n  })\n  const credential = await revalidateUserCredential({\n    auth,\n    projectId: input.projectId,\n    userId: user.id,\n    credential: ref.credential,\n    currentGroupIds: memberships.map((membership) => membership.groupId),\n    now,\n  })\n\n  return {\n    type: \"principal\",\n    context: resolveAuthorizationContext({\n      principal: ref.principal,\n      groupIds: credential.groupIds,\n      roles: input.security.listResolvedRoles(),\n      ...(credential.sessionId === undefined ? {} : { sessionId: credential.sessionId }),\n    }),\n  }\n}\n\nfunction requireCredentialedUserAuthority(ref: AuthorizationRef): CredentialedUserAuthorizationRef {\n  if (ref.type !== \"principal\" || ref.principal.type !== \"user\" || ref.credential === undefined) {\n    throw invalidInheritedAuthority(\"the durable reference is not a credentialed user\")\n  }\n  return {\n    type: \"principal\",\n    principal: { type: \"user\", id: ref.principal.id },\n    credential: { type: ref.credential.type, id: ref.credential.id },\n  }\n}\n\nasync function requireActiveUser(\n  auth: AuthStorage,\n  projectId: string,\n  userId: string\n): Promise<UserRecord> {\n  const user = await auth.users.getById({ projectId, id: userId })\n  if (!user || user.status !== \"active\") {\n    throw invalidInheritedAuthority(`user '${userId}' is not active`)\n  }\n  return user\n}\n\nasync function revalidateUserCredential(input: {\n  readonly auth: AuthStorage\n  readonly projectId: string\n  readonly userId: string\n  readonly credential: UserCredentialRef\n  readonly currentGroupIds: readonly string[]\n  readonly now: Date\n}): Promise<{ readonly groupIds: readonly string[]; readonly sessionId?: string }> {\n  if (input.credential.type === \"session\") {\n    const session = await input.auth.sessions.getById({\n      projectId: input.projectId,\n      id: input.credential.id,\n    })\n    if (!isUsableUserSession(session, input.userId, input.now)) {\n      throw invalidInheritedAuthority(\"the inherited session is no longer valid\")\n    }\n    return { groupIds: input.currentGroupIds, sessionId: session.id }\n  }\n\n  const accessToken = await input.auth.accessTokens.getById({\n    projectId: input.projectId,\n    id: input.credential.id,\n  })\n  if (!isUsableUserAccessToken(accessToken, input.userId, input.now)) {\n    throw invalidInheritedAuthority(\"the inherited access token is no longer valid\")\n  }\n  if (accessToken.groupIds === undefined) return { groupIds: input.currentGroupIds }\n\n  const allowedGroupIds = new Set(accessToken.groupIds)\n  return {\n    groupIds: input.currentGroupIds.filter((groupId) => allowedGroupIds.has(groupId)),\n  }\n}\n\nfunction isUsableUserSession(\n  session: SessionRecord | null,\n  userId: string,\n  now: Date\n): session is SessionRecord {\n  if (!session || session.userId !== userId || session.revokedAt !== undefined) return false\n  if (session.expiresAt.getTime() <= now.getTime()) return false\n  return (\n    session.absoluteExpiresAt === undefined || session.absoluteExpiresAt.getTime() > now.getTime()\n  )\n}\n\nfunction isUsableUserAccessToken(\n  token: AccessTokenRecord | null,\n  userId: string,\n  now: Date\n): token is AccessTokenRecord {\n  if (!token || !principalsEqual(token.subject, { type: \"user\", id: userId })) return false\n  return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime()\n}\n\nfunction invalidInheritedAuthority(reason: string): Error {\n  return createSixbError(\n    \"agent.execution_failed\",\n    `[Sixb] The Agent execution cannot restore its inherited authority: ${reason}.`\n  )\n}\n\nfunction requireAuthStorage(auth: AuthStorage | undefined): AuthStorage {\n  if (!auth) {\n    throw new Error(\"[Sixb] Agent executions require auth storage.\")\n  }\n  return auth\n}\n\nasync function updateAgentServiceAccountMetadata(\n  auth: AuthStorage,\n  input: {\n    readonly existing: ServiceAccountRecord\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  if (input.existing.name === input.name && input.existing.description === input.description) {\n    return input.existing\n  }\n  return auth.serviceAccounts.update({\n    projectId: input.existing.projectId,\n    id: input.existing.id,\n    name: input.name,\n    description: input.description,\n    updatedAt: input.updatedAt,\n  })\n}\n",
-    "/**\n * Base error for workflow-run storage operations.\n */\nexport class WorkflowRunError extends Error {\n  readonly name = \"WorkflowRunError\"\n}\n",
-    "import { agentServiceAccountId } from \"../../agents/authority\"\nimport type { ExecutionStorage } from \"../executions\"\nimport { findAgentRunExecution, findPrimitiveRunExecution } from \"../executions/run-link\"\nimport { WorkflowRunError } from \"./errors\"\n\n/** Validate the semantic link between a durable workflow run and its immutable execution. */\nexport async function assertWorkflowRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly runId: string\n  readonly workflowId: string\n}): Promise<void> {\n  const execution = await findPrimitiveRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    primitive: { kind: \"workflow\", id: input.workflowId, runId: input.runId },\n    sourceTypes: [\"execution\", \"schedule\", \"event\"],\n  })\n  if (!execution) {\n    invalidExecution(input.executionId, input.runId)\n  }\n\n  if (execution.source.type === \"schedule\" || execution.source.type === \"event\") {\n    if (execution.requestedBy !== undefined) {\n      invalidExecution(input.executionId, input.runId)\n    }\n    return\n  }\n\n  // ExecutionStorage already validates the immutable parent reference, correlation id, and\n  // requested-by propagation. This boundary only owns the workflow-specific source restriction.\n  if (execution.source.type !== \"execution\") {\n    invalidExecution(input.executionId, input.runId)\n  }\n}\n\n/** Validate the semantic link between a Workflow Agent-node run and its child execution. */\nexport async function assertWorkflowAgentNodeRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly nodeRunId: string\n  readonly actorId: string\n  readonly workflowExecutionId: string\n}): Promise<void> {\n  const execution = await findAgentRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    runId: input.nodeRunId,\n    authority: { type: \"managed\", serviceAccountId: agentServiceAccountId(input.actorId) },\n  })\n  if (\n    !execution ||\n    execution.source.type !== \"execution\" ||\n    execution.source.executionId !== input.workflowExecutionId\n  ) {\n    throw new WorkflowRunError(\n      `[Sixb] Execution '${input.executionId}' does not authorize Workflow Agent-node run '${input.nodeRunId}'.`\n    )\n  }\n}\n\nfunction invalidExecution(executionId: string, runId: string): never {\n  throw new WorkflowRunError(\n    `[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`\n  )\n}\n"
-  ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;AAGO,SAAS,0BAA0B,CAAC,KAAmC;AAAA,EAC5E,OAAO,OAAO,YAAY,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,oBAAoB,CAAC,CAAU,CAAC;AAAA;;;ACoBhG,IAAM,gBAAqC,IAAI;AAG/C,IAAM,uBAAuB,IAAI;AAS1B,SAAS,wBAAwB,CACtC,UACA,YAC+B;AAAA,EAC/B,IAAI,WAAW,qBAAqB,IAAI,QAAQ;AAAA,EAChD,IAAI,CAAC,UAAU;AAAA,IACb,WAAW,IAAI;AAAA,IACf,qBAAqB,IAAI,UAAU,QAAQ;AAAA,EAC7C;AAAA,EACA,MAAM,MAAM,KAAK,UAAU,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC;AAAA,EACjD,IAAI,CAAC,SAAS,IAAI,GAAG;AAAA,IAAG,SAAS,IAAI,KAAK,wBAAwB,UAAU,UAAU,CAAC;AAAA,EACvF,OAAO,SAAS,IAAI,GAAG;AAAA;AAGzB,SAAS,uBAAuB,CAC9B,UACA,YAC+B;AAAA,EAC/B,MAAM,gBAAgB,IAAI;AAAA,EAC1B,WAAW,cAAc,SAAS,gBAAgB,GAAG;AAAA,IACnD,MAAM,UAAU,IAAI;AAAA,IACpB,WAAW,YAAY,WAAW,YAAY;AAAA,MAC5C,MAAM,UAAU,SAAS,UAAU,KAAK,CAAC,cAAc,CAAC,WAAW,IAAI,SAAS,CAAC;AAAA,MACjF,IAAI,YAAY;AAAA,QAAW,QAAQ,IAAI,SAAS,IAAI,OAAO;AAAA,IAC7D;AAAA,IACA,IAAI,QAAQ,OAAO;AAAA,MAAG,cAAc,IAAI,WAAW,IAAI,OAAO;AAAA,EAChE;AAAA,EACA,IAAI,cAAc,SAAS;AAAA,IAAG;AAAA,EAE9B,MAAM,eAAe,IAAI,IACvB,CAAC,GAAG,aAAa,EAAE,IAAI,EAAE,cAAc,aAAa,CAAC,cAAc,IAAI,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAC7F;AAAA,EACA,OAAO,OAAO,OAAO;AAAA,IACnB,mBAAmB,CAAC,iBAAyB,aAAa,IAAI,YAAY,KAAK;AAAA,IAC/E,gBAAgB,CAAC,cAAsB,eACrC,cAAc,IAAI,YAAY,GAAG,IAAI,UAAU;AAAA,EACnD,CAAC;AAAA;AASI,SAAS,eAAuC,CACrD,KACA,WACM;AAAA,EACN,MAAM,SAAS,UAAU,kBAAkB,IAAI,YAAY;AAAA,EAC3D,MAAM,QAAQ,IAAI;AAAA,EAClB,IAAI,OAAO,SAAS,KAAK,UAAU;AAAA,IAAW,OAAO;AAAA,EAErD,MAAM,WAAiB,KAAK,IAAI;AAAA,EAChC,IAAI,OAAO,OAAO,GAAG;AAAA,IACnB,SAAS,aAAa,YAAY,IAAI,YAAY,MAAM;AAAA,IACxD,SAAS,aAAa,2BAA2B,MAAM;AAAA,EACzD;AAAA,EACA,IAAI,UAAU,WAAW;AAAA,IACvB,SAAS,QAAQ,OAAO,YACtB,OAAO,QAAQ,KAAK,EAAE,IAAI,EAAE,QAAQ,WAAW,CAAC,QAAQ,gBAAgB,OAAO,SAAS,CAAC,CAAC,CAC5F;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,eAAe,CACtB,OACA,WACmB;AAAA,EACnB,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO,MAAM,IAAI,CAAC,QAAQ,gBAAgB,KAAK,SAAS,CAAC;AAAA,EAEnF,OAAO,gBAAgB,OAA4B,SAAS;AAAA;AAOvD,SAAS,iBAAiB,CAC/B,OACA,WACmB;AAAA,EACnB,IAAI,MAAM,UAAU;AAAA,IAAW,OAAO;AAAA,EACtC,MAAM,SAAS,UAAU,kBAAkB,MAAM,QAAQ,YAAY;AAAA,EACrE,IAAI,OAAO,SAAS;AAAA,IAAG,OAAO;AAAA,EAE9B,MAAM,UAAU;AAAA,OACX,MAAM;AAAA,IACT,iBAAiB,YAAY,MAAM,QAAQ,iBAAiB,MAAM;AAAA,IAClE,YAAY,2BAA2B,MAAM;AAAA,EAC/C;AAAA,EACA,IAAI,MAAM,SAAS;AAAA,IAAkB,OAAO,KAAK,OAAO,QAAQ;AAAA,EAChE,OAAO;AAAA,OACF;AAAA,IACH,SAAS,KAAK,SAAS,YAAY,YAAY,MAAM,QAAQ,YAAY,MAAM,EAAE;AAAA,EACnF;AAAA;AAGF,SAAS,WAAmB,CAC1B,QACA,QACwB;AAAA,EACxB,MAAM,OAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;AAAA,IACjD,IAAI,CAAC,OAAO,IAAI,GAAG;AAAA,MAAG,KAAK,OAAO;AAAA,EACpC;AAAA,EACA,OAAO;AAAA;AASF,SAAS,6BAA6B,CAC3C,WAC8B;AAAA,EAG9B,MAAM,eAAe,IAAI;AAAA,EACzB,MAAM,QAAQ,CAAC,kBAAgE;AAAA,IAC7E,MAAM,UAAU,OAAO,OAAO,CAAC,CAAC;AAAA,IAChC,aAAa,IAAI,SAAS,OAAO,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;AAAA,IAC3D,OAAO;AAAA;AAAA,EAET,MAAM,UAAU,CAAC,UAAwD;AAAA,IACvE,MAAM,gBAAgB,aAAa,IAAI,KAAK;AAAA,IAC5C,IAAI,CAAC,eAAe;AAAA,MAClB,MAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AAAA,IACA,OAAO;AAAA;AAAA,EAET,MAAM,QAAQ,MAAM,CAAC,CAAC;AAAA,EAEtB,MAAM,YAA0C;AAAA,IAC9C,OAAO,MAAM;AAAA,IACb,QAAQ,CAAC,WAAW,EAAE,OAAO,MAAM,MAAM,OAAO,aAAa,EAAE;AAAA,IAC/D,MAAM,CAAC,WAAW,EAAE,OAAO,MAAM,MAAM,OAAO,aAAa,EAAE;AAAA,IAE7D,KAAK,CAAC,UACJ,MAAM,OAAO,aACR,MAAM,OAAO,MAAM,QACpB,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,OAAO,QAAQ,OAAO,CAAC,CAAC,CAAC;AAAA,IACvD,UAAU,CAAC,UAAU;AAAA,MACnB,IAAI,MAAM,QAAQ;AAAA,QAAW;AAAA,MAC7B,MAAM,gBACJ,MAAM,iBAAiB,YAAY,QAAQ,MAAM,KAAK,IAAI,CAAC,MAAM,YAAY;AAAA,MAC/E,WAAW,gBAAgB,eAAe;AAAA,QACxC,MAAM,UAAU,UAAU,eAAe,cAAc,MAAM,UAAU;AAAA,QACvE,IAAI,YAAY;AAAA,UAAW;AAAA,QAC3B,OAAO,IAAI,oBACT,qBAAqB,WACrB,iBAAiB,mBAAmB,MAAM,SAAS,gBAAgB,MAAM,mBAAmB,MAAM,6CAA6C,WACjJ;AAAA,MACF;AAAA,MACA;AAAA;AAAA,EAEJ;AAAA,EACA,OAAO,OAAO,OAAO,SAAS;AAAA;AAGhC,IAAM,qBAAuE;AAAA,EAC3E,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,OAAO;AACT;;;ACrLO,SAAS,8BAA6B,CAC3C,UACA,eAC+B;AAAA,EAC/B,OAAO,cAAc,SAAS,cAC1B,yBAAyB,UAAU,cAAc,QAAQ,cAAc,IAAI,GAAK,IAChF;AAAA;AAsBN,eAAsB,oCAAmC,CAAC,OAOtB;AAAA,EAClC,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,KAAK,uBAAsB,MAAM,OAAO;AAAA,EAC9C,MAAM,MAAM,IAAI;AAAA,EAChB,MAAM,SAAS,MAAM,gCAAgC,MAAM;AAAA,IACzD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,0CAA0C,MAAM,SAAS,MAAM;AAAA,EAC/D,gCAAgC,MAAM,SAAS,MAAM;AAAA,EACrD,MAAM,iBAAiB,MAAM,kCAAkC,MAAM;AAAA,IACnE,UAAU;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,gCAAgC,MAAM,SAAS,cAAc;AAAA,EAE7D,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,2BAA2B;AAAA,IACnE,WAAW,MAAM;AAAA,IACjB,kBAAkB;AAAA,IAClB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC,CACH;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,GAAG;AAAA,IACxC;AAAA,EACF;AAAA;AAIF,eAAe,+BAA+B,CAC5C,MACA,OAO+B;AAAA,EAC/B,MAAM,WAAW,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,IAAI;AAAA,IAAU,OAAO;AAAA,EAErB,IAAI;AAAA,IACF,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAAA,MACvC,IAAI,MAAM;AAAA,MACV,WAAW,MAAM;AAAA,MACjB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,QAAQ;AAAA,MACR,oBAAoB;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,EAAE,iBAAiB,sBAAqB,MAAM,SAAS,6BAA6B;AAAA,MACtF,MAAM;AAAA,IACR;AAAA,IACA,MAAM,aAAa,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM;AAAA,IACZ,CAAC;AAAA,IACD,IAAI,CAAC;AAAA,MAAY,MAAM;AAAA,IACvB,OAAO;AAAA;AAAA;AAIX,SAAS,+BAA+B,CACtC,SACA,gBACM;AAAA,EACN,IAAI,eAAe,WAAW,aAAa;AAAA,IACzC,MAAM,IAAI,MACR,iBAAiB,6BAA6B,eAAe,mBAC/D;AAAA,EACF;AAAA;AAGF,SAAS,yCAAyC,CAChD,SACA,gBACM;AAAA,EACN,IACE,eAAe,uBAAuB,aACtC,CAAC,iBAAgB,eAAe,oBAAoB,iBAAgB,GACpE;AAAA,IACA,MAAM,iBACJ,0BACA,iBAAiB,wCAAwC,eAAe,0CACxE,EAAE,SAAS,EAAE,SAAS,kBAAkB,eAAe,GAAG,EAAE,CAC9D;AAAA,EACF;AAAA;AAGF,SAAS,sCAAsC,CAC7C,SACA,aACgD;AAAA,EAChD,MAAM,mBAAmB,YACtB,OAAO,CAAC,eAAe,WAAW,WAAW,OAAO,EACpD,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,EACzC,IAAI,iBAAiB,SAAS,GAAG;AAAA,IAC/B,MAAM,iBACJ,0BACA,iBAAiB,iFAAiF,iBAAiB,KAAK,IAAI,MAC5H,EAAE,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAC3C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIT,eAAsB,mCAAkC,CAAC,OAM0C;AAAA,EACjG,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,aAAa,uBAAsB,MAAM,OAAO;AAAA,EACtD,MAAM,YACJ,MAAM,iBAAiB,SAAS,cAAc,MAAM,iBAAiB,YAAY;AAAA,EACnF,IAAI,WAAW,SAAS,oBAAoB,UAAU,OAAO,YAAY;AAAA,IACvE,MAAM,IAAI,MACR,iBAAiB,MAAM,gEAAgE,cACzF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,UAAU;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,CAAC,kBAAkB,eAAe,WAAW,UAAU;AAAA,IACzD,MAAM,IAAI,MAAM,iCAAiC,UAAU,oBAAoB;AAAA,EACjF;AAAA,EACA,0CAA0C,MAAM,SAAS,cAAc;AAAA,EAEvE,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,sBAAsB;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,kBAAkB,UAAU;AAAA,EAC9B,CAAC,CACH;AAAA,EACA,MAAM,WAAmC;AAAA,IACvC;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,IAAI,UAAU,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,6BAA4B;AAAA,MACnC,WAAW,SAAS;AAAA,MACpB,UAAU,iBAAiB,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,MACjE,OAAO,MAAM,SAAS,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA;AAIF,eAAsB,4CAA2C,CAAC,OAMzB;AAAA,EACvC,IAAI,MAAM,iBAAiB,SAAS;AAAA,IAAY,OAAO,EAAE,MAAM,WAAW;AAAA,EAE1E,MAAM,MAAM,iCAAiC,MAAM,gBAAgB;AAAA,EACnE,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,MAAM,MAAM,OAAO,IAAI;AAAA,EAC7B,MAAM,OAAO,MAAM,kBAAkB,MAAM,MAAM,WAAW,IAAI,UAAU,EAAE;AAAA,EAC5E,MAAM,cAAc,MAAM,KAAK,iBAAiB,YAAY;AAAA,IAC1D,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,EACf,CAAC;AAAA,EACD,MAAM,aAAa,MAAM,yBAAyB;AAAA,IAChD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,YAAY,IAAI;AAAA,IAChB,iBAAiB,YAAY,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,IACnE;AAAA,EACF,CAAC;AAAA,EAED,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,6BAA4B;AAAA,MACnC,WAAW,IAAI;AAAA,MACf,UAAU,WAAW;AAAA,MACrB,OAAO,MAAM,SAAS,kBAAkB;AAAA,SACpC,WAAW,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,WAAW,UAAU;AAAA,IAClF,CAAC;AAAA,EACH;AAAA;AAGF,SAAS,gCAAgC,CAAC,KAAyD;AAAA,EACjG,IAAI,IAAI,SAAS,eAAe,IAAI,UAAU,SAAS,UAAU,IAAI,eAAe,WAAW;AAAA,IAC7F,MAAM,0BAA0B,kDAAkD;AAAA,EACpF;AAAA,EACA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,EAAE,MAAM,QAAQ,IAAI,IAAI,UAAU,GAAG;AAAA,IAChD,YAAY,EAAE,MAAM,IAAI,WAAW,MAAM,IAAI,IAAI,WAAW,GAAG;AAAA,EACjE;AAAA;AAGF,eAAe,iBAAiB,CAC9B,MACA,WACA,QACqB;AAAA,EACrB,MAAM,OAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,WAAW,IAAI,OAAO,CAAC;AAAA,EAC/D,IAAI,CAAC,QAAQ,KAAK,WAAW,UAAU;AAAA,IACrC,MAAM,0BAA0B,SAAS,uBAAuB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,wBAAwB,CAAC,OAO2C;AAAA,EACjF,IAAI,MAAM,WAAW,SAAS,WAAW;AAAA,IACvC,MAAM,UAAU,MAAM,MAAM,KAAK,SAAS,QAAQ;AAAA,MAChD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM,WAAW;AAAA,IACvB,CAAC;AAAA,IACD,IAAI,CAAC,oBAAoB,SAAS,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,MAC1D,MAAM,0BAA0B,0CAA0C;AAAA,IAC5E;AAAA,IACA,OAAO,EAAE,UAAU,MAAM,iBAAiB,WAAW,QAAQ,GAAG;AAAA,EAClE;AAAA,EAEA,MAAM,cAAc,MAAM,MAAM,KAAK,aAAa,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM,WAAW;AAAA,EACvB,CAAC;AAAA,EACD,IAAI,CAAC,wBAAwB,aAAa,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,IAClE,MAAM,0BAA0B,+CAA+C;AAAA,EACjF;AAAA,EACA,IAAI,YAAY,aAAa;AAAA,IAAW,OAAO,EAAE,UAAU,MAAM,gBAAgB;AAAA,EAEjF,MAAM,kBAAkB,IAAI,IAAI,YAAY,QAAQ;AAAA,EACpD,OAAO;AAAA,IACL,UAAU,MAAM,gBAAgB,OAAO,CAAC,YAAY,gBAAgB,IAAI,OAAO,CAAC;AAAA,EAClF;AAAA;AAGF,SAAS,mBAAmB,CAC1B,SACA,QACA,KAC0B;AAAA,EAC1B,IAAI,CAAC,WAAW,QAAQ,WAAW,UAAU,QAAQ,cAAc;AAAA,IAAW,OAAO;AAAA,EACrF,IAAI,QAAQ,UAAU,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAAG,OAAO;AAAA,EACzD,OACE,QAAQ,sBAAsB,aAAa,QAAQ,kBAAkB,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAIjG,SAAS,uBAAuB,CAC9B,OACA,QACA,KAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,CAAC,iBAAgB,MAAM,SAAS,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAAA,IAAG,OAAO;AAAA,EACpF,OAAO,MAAM,cAAc,aAAa,MAAM,UAAU,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAGlF,SAAS,yBAAyB,CAAC,QAAuB;AAAA,EACxD,OAAO,iBACL,0BACA,sEAAsE,SACxE;AAAA;AAGF,SAAS,kBAAkB,CAAC,MAA4C;AAAA,EACtE,IAAI,CAAC,MAAM;AAAA,IACT,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,iCAAiC,CAC9C,MACA,OAM+B;AAAA,EAC/B,IAAI,MAAM,SAAS,SAAS,MAAM,QAAQ,MAAM,SAAS,gBAAgB,MAAM,aAAa;AAAA,IAC1F,OAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,KAAK,gBAAgB,OAAO;AAAA,IACjC,WAAW,MAAM,SAAS;AAAA,IAC1B,IAAI,MAAM,SAAS;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,EACnB,CAAC;AAAA;;;AC5XI,MAAM,0BAAyB,MAAM;AAAA,EACjC,OAAO;AAClB;;;ACCA,eAAsB,2BAA0B,CAAC,OAM/B;AAAA,EAChB,MAAM,YAAY,MAAM,0BAA0B;AAAA,IAChD,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,EAAE,MAAM,YAAY,IAAI,MAAM,YAAY,OAAO,MAAM,MAAM;AAAA,IACxE,aAAa,CAAC,aAAa,YAAY,OAAO;AAAA,EAChD,CAAC;AAAA,EACD,IAAI,CAAC,WAAW;AAAA,IACd,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA,EAEA,IAAI,UAAU,OAAO,SAAS,cAAc,UAAU,OAAO,SAAS,SAAS;AAAA,IAC7E,IAAI,UAAU,gBAAgB,WAAW;AAAA,MACvC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AAAA,EAIA,IAAI,UAAU,OAAO,SAAS,aAAa;AAAA,IACzC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA;AAIF,eAAsB,oCAAmC,CAAC,OAOxC;AAAA,EAChB,MAAM,YAAY,MAAM,sBAAsB;AAAA,IAC5C,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,OAAO,MAAM;AAAA,IACb,WAAW,EAAE,MAAM,WAAW,kBAAkB,uBAAsB,MAAM,OAAO,EAAE;AAAA,EACvF,CAAC;AAAA,EACD,IACE,CAAC,aACD,UAAU,OAAO,SAAS,eAC1B,UAAU,OAAO,gBAAgB,MAAM,qBACvC;AAAA,IACA,MAAM,IAAI,kBACR,qBAAqB,MAAM,4DAA4D,MAAM,aAC/F;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CAAC,aAAqB,OAAsB;AAAA,EACnE,MAAM,IAAI,kBACR,qBAAqB,iDAAiD,SACxE;AAAA;",
-  "debugId": "86420060B98AACE864756E2164756E21",
-  "names": []
-}

package/dist/chunk-s16apyk9.js

@@ -1,256 +0,0 @@
-// @bun
-import {
-  ACTION_RUN_PHASES2,
-  parseActionRunFailure2
-} from "./chunk-b38szspf.js";
-import {
-  isFileRef2
-} from "./chunk-jhm3zsa7.js";
-import {
-  createObjectOperationScope2
-} from "./chunk-qczk96d9.js";
-import {
-  ActionRunError2
-} from "./chunk-y0c4e6ex.js";
-import {
-  assertJsonValue2,
-  cloneJsonValue2,
-  stableJsonStringify2
-} from "./chunk-wy0qdqfm.js";
-
-// src/storage/action-runs/idempotency.ts
-function actionSubjectsEqual(left, right) {
-  if (left.kind !== right.kind)
-    return false;
-  if (left.kind === "none")
-    return true;
-  if (right.kind === "none")
-    return false;
-  return left.objectTypeId === right.objectTypeId && left.primaryId === right.primaryId;
-}
-function actionRunParamsEqual(left, right) {
-  return stableJsonStringify2(left) === stableJsonStringify2(right);
-}
-function actionRunRequestsEqual(left, right) {
-  return left.actionId === right.actionId && actionSubjectsEqual(left.subject, right.subject) && actionRunParamsEqual(left.params, right.params);
-}
-function actionRunPhaseRecordsEqual(left, right) {
-  return actionRunParamsEqual(stripPhaseRecordCompletedAt(left), stripPhaseRecordCompletedAt(right));
-}
-function stripPhaseRecordCompletedAt(record) {
-  const { completedAt: _completedAt, ...stableRecord } = record;
-  return stableRecord;
-}
-
-// src/storage/action-runs/record.ts
-function normalizeRecordActionRunInput2(input) {
-  const label = `[Sixb] Action run '${input.id}'`;
-  for (const field of ["id", "projectId", "executionId", "actionId", "idempotencyKey"]) {
-    if (typeof input[field] !== "string" || input[field].trim().length === 0) {
-      throw new ActionRunError2(`${label} must have a nonblank ${field}.`);
-    }
-  }
-  const status = input.status;
-  if (status !== "succeeded" && status !== "failed") {
-    throw new ActionRunError2(`${label} has unknown status '${status}'.`);
-  }
-  if (!ACTION_RUN_PHASES2.includes(input.phase)) {
-    throw new ActionRunError2(`${label} has unknown phase '${input.phase}'.`);
-  }
-  if (input.phase === "effects") {
-    throw new ActionRunError2(`${label} is recorded before its effects run.`);
-  }
-  const startedAt = requireDate(input.startedAt, `${label} startedAt`);
-  const finishedAt = requireDate(input.finishedAt, `${label} finishedAt`);
-  if (finishedAt < startedAt) {
-    throw new ActionRunError2(`${label} cannot finish before it started.`);
-  }
-  assertJsonValue2(input.params, `${label} params`);
-  const fields = {
-    id: input.id,
-    projectId: input.projectId,
-    executionId: input.executionId,
-    actionId: input.actionId,
-    subject: structuredClone(input.subject),
-    phase: input.phase,
-    startedAt,
-    finishedAt,
-    params: structuredClone(input.params),
-    idempotencyKey: input.idempotencyKey,
-    ...input.writeback === undefined ? {} : { writeback: normalizeWriteback(input.writeback, label) }
-  };
-  if (input.status === "succeeded") {
-    if (input.error !== undefined) {
-      throw new ActionRunError2(`${label} succeeded, so it cannot record a failure.`);
-    }
-    return { ...fields, status: "succeeded" };
-  }
-  const error = parseActionRunFailure2(input.error, input.phase);
-  if (error.details.runId !== input.id || error.details.actionId !== input.actionId) {
-    throw new ActionRunError2(`${label} records the failure of another run.`);
-  }
-  return { ...fields, status: "failed", error };
-}
-function resolveActionRunEffects2(existing, input) {
-  const label = `[Sixb] Action run '${input.id}'`;
-  if (!existing) {
-    throw new ActionRunError2(`${label} not found for project '${input.projectId}'.`);
-  }
-  const completedAt = requireDate(input.completedAt ?? new Date, `${label} effects`);
-  const effects = input.status === "succeeded" ? { status: "succeeded", completedAt } : { status: "failed", completedAt, error: parseActionRunFailure2(input.error, "effects") };
-  if (existing.effects) {
-    if (actionRunPhaseRecordsEqual(existing.effects, effects))
-      return { run: existing, effects: null };
-    throw new ActionRunError2(`${label} already has a different effects record.`);
-  }
-  if (existing.status !== "succeeded" || existing.phase !== "commit") {
-    throw new ActionRunError2(`${label} cannot record effects: it ended '${existing.status}' in phase '${existing.phase}'.`);
-  }
-  return { run: existing, effects };
-}
-function normalizeWriteback(writeback, label) {
-  const completedAt = requireDate(writeback.completedAt, `${label} writeback`);
-  if (writeback.status === "succeeded") {
-    assertJsonValue2(writeback.result, `${label} writeback result`);
-    return { status: "succeeded", completedAt, result: cloneJsonValue2(writeback.result) };
-  }
-  return {
-    status: "failed",
-    completedAt,
-    error: parseActionRunFailure2(writeback.error, "writeback")
-  };
-}
-function requireDate(value, label) {
-  const date = value instanceof Date ? new Date(value) : new Date(Number.NaN);
-  if (!Number.isFinite(date.getTime())) {
-    throw new ActionRunError2(`${label} must be a valid date.`);
-  }
-  return date;
-}
-
-// src/storage/errors.ts
-class ObjectNotFoundError2 extends Error {
-  objectTypeId;
-  primaryId;
-  context;
-  name = "ObjectNotFoundError";
-  constructor(objectTypeId, primaryId, context) {
-    super(`[Sixb] ${context}: ${objectTypeId}:${primaryId}`);
-    this.objectTypeId = objectTypeId;
-    this.primaryId = primaryId;
-    this.context = context;
-  }
-}
-
-class ObjectStorageError2 extends Error {
-  name = "ObjectStorageError";
-}
-
-class StorageTransactionError2 extends Error {
-  name = "StorageTransactionError";
-  code;
-  cause;
-  constructor(message, options = {}) {
-    super(message);
-    this.code = options.code;
-    this.cause = options.cause;
-  }
-}
-function isStorageSerializationFailure2(error) {
-  return error instanceof StorageTransactionError2 && error.code === "serialization_failure";
-}
-
-// src/storage/file-download-grants/record.ts
-function parseFileDownloadGrantRow2(row) {
-  const id = text(row.id, "id", String(row.id));
-  const file = typeof row.file === "string" ? JSON.parse(row.file) : row.file;
-  if (!isFileRef2(file))
-    throw corrupt(id, "file is not a file reference");
-  return {
-    id,
-    projectId: text(row.projectId, "projectId", id),
-    tokenHash: text(row.tokenHash, "tokenHash", id),
-    file,
-    executionId: text(row.executionId, "executionId", id),
-    createdAt: date(row.createdAt, "createdAt", id),
-    expiresAt: date(row.expiresAt, "expiresAt", id),
-    ...row.revokedAt == null ? {} : { revokedAt: date(row.revokedAt, "revokedAt", id) }
-  };
-}
-function cloneFileDownloadGrantRecord(record) {
-  return structuredClone(record);
-}
-function text(value, column, id) {
-  if (typeof value !== "string" || value.length === 0)
-    throw corrupt(id, `${column} is not text`);
-  return value;
-}
-function date(value, column, id) {
-  const parsed = value instanceof Date || typeof value === "string" ? new Date(value) : null;
-  if (!parsed || !Number.isFinite(parsed.getTime()))
-    throw corrupt(id, `${column} is not a date`);
-  return parsed;
-}
-function corrupt(id, reason) {
-  return new Error(`[Sixb] Stored file download grant '${id}' is invalid: ${reason}.`);
-}
-
-// src/storage/pipeline-runs/idempotency.ts
-function canRequeuePipelineRunAfterEnqueueFailure2(existing, input) {
-  return existing.status === "failed" && existing.error?.code === "queue.enqueue_failed" && existing.error.retryable && existing.executionId === input.executionId && existing.pipelineId === input.pipelineId;
-}
-
-// src/storage/sync-runs/idempotency.ts
-function canRequeueSyncRunAfterEnqueueFailure2(existing, input) {
-  return existing.status === "failed" && existing.error?.code === "queue.enqueue_failed" && existing.error.retryable && existing.executionId === input.executionId && existing.syncId === input.syncId && existing.datasetId === input.datasetId && existing.mode === input.mode && existing.expectedLatestVersionId === input.expectedLatestVersionId && existing.commitMessage === input.commitMessage;
-}
-
-// src/storage/transaction.ts
-function createTransactionStorageProxy2(target, isActive) {
-  const proxies = new WeakMap;
-  const objectStorage = createObjectOperationScope2(target.objects, {
-    assertAvailable: () => assertTransactionActive2(isActive),
-    run: async (operation) => {
-      assertTransactionActive2(isActive);
-      return operation();
-    }
-  });
-  const wrap = (value) => {
-    const existing = proxies.get(value);
-    if (existing)
-      return existing;
-    const proxy = new Proxy(value, {
-      get(current, property, receiver) {
-        assertTransactionActive2(isActive);
-        const result = current === target && property === "objects" ? objectStorage : Reflect.get(current, property, receiver);
-        if (typeof result === "function") {
-          return (...args) => {
-            assertTransactionActive2(isActive);
-            return result.apply(current, args);
-          };
-        }
-        if (result && typeof result === "object") {
-          return wrap(result);
-        }
-        return result;
-      }
-    });
-    proxies.set(value, proxy);
-    return proxy;
-  };
-  return wrap(target);
-}
-function assertTransactionActive2(isActive) {
-  if (!isActive()) {
-    throw new StorageTransactionError2("[Sixb] Transaction storage cannot be used after transaction completion.", { code: "transaction_inactive" });
-  }
-}
-function throwNestedStorageTransaction2() {
-  throw new StorageTransactionError2("[Sixb] Nested storage transactions are not supported yet.", {
-    code: "nested_transaction"
-  });
-}
-
-export { actionSubjectsEqual, actionRunRequestsEqual, normalizeRecordActionRunInput2, resolveActionRunEffects2, ObjectNotFoundError2, ObjectStorageError2, StorageTransactionError2, isStorageSerializationFailure2, parseFileDownloadGrantRow2, cloneFileDownloadGrantRecord, canRequeuePipelineRunAfterEnqueueFailure2, canRequeueSyncRunAfterEnqueueFailure2, createTransactionStorageProxy2, assertTransactionActive2, throwNestedStorageTransaction2 };
-
-//# debugId=B710291DEE8F3A1864756E2164756E21

package/dist/chunk-s16apyk9.js.map

@@ -1,16 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/storage/action-runs/idempotency.ts", "../src/storage/action-runs/record.ts", "../src/storage/errors.ts", "../src/storage/file-download-grants/record.ts", "../src/storage/pipeline-runs/idempotency.ts", "../src/storage/sync-runs/idempotency.ts", "../src/storage/transaction.ts"],
-  "sourcesContent": [
-    "import type { ActionSubject } from \"../../actions\"\nimport { stableJsonStringify } from \"../../json\"\nimport type { ActionRunEffectsRecord, ActionRunRecord, ActionRunWritebackRecord } from \"./types\"\n\nexport function actionSubjectsEqual(left: ActionSubject, right: ActionSubject): boolean {\n  if (left.kind !== right.kind) return false\n  if (left.kind === \"none\") return true\n  if (right.kind === \"none\") return false\n  return left.objectTypeId === right.objectTypeId && left.primaryId === right.primaryId\n}\n\nexport function actionRunParamsEqual(left: unknown, right: unknown): boolean {\n  return stableJsonStringify(left) === stableJsonStringify(right)\n}\n\n/** Whether two runs carry the same request: the same Action, subject, and params. */\nexport function actionRunRequestsEqual(\n  left: Pick<ActionRunRecord, \"actionId\" | \"subject\" | \"params\">,\n  right: Pick<ActionRunRecord, \"actionId\" | \"subject\" | \"params\">\n): boolean {\n  return (\n    left.actionId === right.actionId &&\n    actionSubjectsEqual(left.subject, right.subject) &&\n    actionRunParamsEqual(left.params, right.params)\n  )\n}\n\nexport type ActionRunPhaseRecord = ActionRunWritebackRecord | ActionRunEffectsRecord\n\nexport function actionRunPhaseRecordsEqual(\n  left: ActionRunPhaseRecord,\n  right: ActionRunPhaseRecord\n): boolean {\n  return actionRunParamsEqual(stripPhaseRecordCompletedAt(left), stripPhaseRecordCompletedAt(right))\n}\n\nfunction stripPhaseRecordCompletedAt(\n  record: ActionRunPhaseRecord\n): Omit<ActionRunPhaseRecord, \"completedAt\"> {\n  const { completedAt: _completedAt, ...stableRecord } = record\n  return stableRecord\n}\n",
-    "import { assertJsonValue, cloneJsonValue } from \"../../json\"\nimport { ActionRunError } from \"./errors\"\nimport { parseActionRunFailure } from \"./failure\"\nimport { actionRunPhaseRecordsEqual } from \"./idempotency\"\nimport type {\n  ActionRunEffectsRecord,\n  ActionRunRecord,\n  ActionRunWritebackRecord,\n  RecordActionEffectsInput,\n  RecordActionRunInput,\n} from \"./types\"\nimport { ACTION_RUN_PHASES } from \"./types\"\n\n/**\n * Validate a terminal run record before a provider inserts it, and detach it from the caller.\n *\n * Every provider records through this, so a stored run always reads back as the record that was\n * written: a failed run carries the failure of the phase it ended in, and a succeeded one none. A\n * run is recorded before its effects run, so no record starts in the `effects` phase.\n */\nexport function normalizeRecordActionRunInput(input: RecordActionRunInput): RecordActionRunInput {\n  const label = `[Sixb] Action run '${input.id}'`\n  for (const field of [\"id\", \"projectId\", \"executionId\", \"actionId\", \"idempotencyKey\"] as const) {\n    if (typeof input[field] !== \"string\" || input[field].trim().length === 0) {\n      throw new ActionRunError(`${label} must have a nonblank ${field}.`)\n    }\n  }\n  const status: string = input.status\n  if (status !== \"succeeded\" && status !== \"failed\") {\n    throw new ActionRunError(`${label} has unknown status '${status}'.`)\n  }\n  if (!(ACTION_RUN_PHASES as readonly string[]).includes(input.phase)) {\n    throw new ActionRunError(`${label} has unknown phase '${input.phase}'.`)\n  }\n  if (input.phase === \"effects\") {\n    throw new ActionRunError(`${label} is recorded before its effects run.`)\n  }\n  const startedAt = requireDate(input.startedAt, `${label} startedAt`)\n  const finishedAt = requireDate(input.finishedAt, `${label} finishedAt`)\n  if (finishedAt < startedAt) {\n    throw new ActionRunError(`${label} cannot finish before it started.`)\n  }\n  assertJsonValue(input.params, `${label} params`)\n\n  const fields = {\n    id: input.id,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    actionId: input.actionId,\n    subject: structuredClone(input.subject),\n    phase: input.phase,\n    startedAt,\n    finishedAt,\n    params: structuredClone(input.params),\n    idempotencyKey: input.idempotencyKey,\n    ...(input.writeback === undefined\n      ? {}\n      : { writeback: normalizeWriteback(input.writeback, label) }),\n  }\n\n  if (input.status === \"succeeded\") {\n    if (input.error !== undefined) {\n      throw new ActionRunError(`${label} succeeded, so it cannot record a failure.`)\n    }\n    return { ...fields, status: \"succeeded\" }\n  }\n  const error = parseActionRunFailure(input.error, input.phase)\n  if (error.details.runId !== input.id || error.details.actionId !== input.actionId) {\n    throw new ActionRunError(`${label} records the failure of another run.`)\n  }\n  return { ...fields, status: \"failed\", error }\n}\n\n/**\n * Resolve what recording effects does to the stored run: write `effects`, or nothing (`null`) when\n * an equal outcome is already recorded.\n *\n * Effects run only after a succeeded run committed its edits, and their outcome is recorded once.\n */\nexport function resolveActionRunEffects(\n  existing: ActionRunRecord | null,\n  input: RecordActionEffectsInput\n): { readonly run: ActionRunRecord; readonly effects: ActionRunEffectsRecord | null } {\n  const label = `[Sixb] Action run '${input.id}'`\n  if (!existing) {\n    throw new ActionRunError(`${label} not found for project '${input.projectId}'.`)\n  }\n  const completedAt = requireDate(input.completedAt ?? new Date(), `${label} effects`)\n  const effects: ActionRunEffectsRecord =\n    input.status === \"succeeded\"\n      ? { status: \"succeeded\", completedAt }\n      : { status: \"failed\", completedAt, error: parseActionRunFailure(input.error, \"effects\") }\n\n  if (existing.effects) {\n    if (actionRunPhaseRecordsEqual(existing.effects, effects))\n      return { run: existing, effects: null }\n    throw new ActionRunError(`${label} already has a different effects record.`)\n  }\n  if (existing.status !== \"succeeded\" || existing.phase !== \"commit\") {\n    throw new ActionRunError(\n      `${label} cannot record effects: it ended '${existing.status}' in phase '${existing.phase}'.`\n    )\n  }\n  return { run: existing, effects }\n}\n\nfunction normalizeWriteback(\n  writeback: ActionRunWritebackRecord,\n  label: string\n): ActionRunWritebackRecord {\n  const completedAt = requireDate(writeback.completedAt, `${label} writeback`)\n  if (writeback.status === \"succeeded\") {\n    assertJsonValue(writeback.result, `${label} writeback result`)\n    return { status: \"succeeded\", completedAt, result: cloneJsonValue(writeback.result) }\n  }\n  return {\n    status: \"failed\",\n    completedAt,\n    error: parseActionRunFailure(writeback.error, \"writeback\"),\n  }\n}\n\n/** A detached copy of `value`, which must be a valid date. */\nfunction requireDate(value: Date, label: string): Date {\n  const date = value instanceof Date ? new Date(value) : new Date(Number.NaN)\n  if (!Number.isFinite(date.getTime())) {\n    throw new ActionRunError(`${label} must be a valid date.`)\n  }\n  return date\n}\n",
-    "/**\n * Thrown when a storage lookup by primary ID finds no matching object.\n * Carries structured context so callers can discriminate without string parsing.\n */\nexport class ObjectNotFoundError extends Error {\n  readonly name = \"ObjectNotFoundError\"\n\n  constructor(\n    readonly objectTypeId: string,\n    readonly primaryId: string,\n    readonly context: string\n  ) {\n    super(`[Sixb] ${context}: ${objectTypeId}:${primaryId}`)\n  }\n}\n\nexport class ObjectStorageError extends Error {\n  readonly name = \"ObjectStorageError\"\n}\n\nexport type StorageTransactionErrorCode =\n  | \"nested_transaction\"\n  | \"serialization_failure\"\n  | \"transaction_inactive\"\n\nexport interface StorageTransactionErrorOptions {\n  readonly cause?: unknown\n  readonly code?: StorageTransactionErrorCode\n}\n\nexport class StorageTransactionError extends Error {\n  readonly name = \"StorageTransactionError\"\n  readonly code?: StorageTransactionErrorCode\n  override readonly cause?: unknown\n\n  constructor(message: string, options: StorageTransactionErrorOptions = {}) {\n    super(message)\n    this.code = options.code\n    this.cause = options.cause\n  }\n}\n\nexport function isStorageSerializationFailure(error: unknown): boolean {\n  return error instanceof StorageTransactionError && error.code === \"serialization_failure\"\n}\n",
-    "import { isFileRef } from \"../../blob-storage\"\nimport type { FileDownloadGrantRecord } from \"./types\"\n\n/**\n * Rebuilds a grant from a provider row with camelCase keys. `file` may arrive parsed (jsonb) or\n * as text (SQLite), and timestamps as `Date` or ISO text. Fails closed on corruption: a grant that\n * cannot be read must not serve a file.\n */\nexport function parseFileDownloadGrantRow(row: {\n  readonly [column: string]: unknown\n}): FileDownloadGrantRecord {\n  const id = text(row.id, \"id\", String(row.id))\n  const file = typeof row.file === \"string\" ? JSON.parse(row.file) : row.file\n  if (!isFileRef(file)) throw corrupt(id, \"file is not a file reference\")\n\n  return {\n    id,\n    projectId: text(row.projectId, \"projectId\", id),\n    tokenHash: text(row.tokenHash, \"tokenHash\", id),\n    file,\n    executionId: text(row.executionId, \"executionId\", id),\n    createdAt: date(row.createdAt, \"createdAt\", id),\n    expiresAt: date(row.expiresAt, \"expiresAt\", id),\n    ...(row.revokedAt == null ? {} : { revokedAt: date(row.revokedAt, \"revokedAt\", id) }),\n  }\n}\n\nexport function cloneFileDownloadGrantRecord(\n  record: FileDownloadGrantRecord\n): FileDownloadGrantRecord {\n  return structuredClone(record)\n}\n\nfunction text(value: unknown, column: string, id: string): string {\n  if (typeof value !== \"string\" || value.length === 0) throw corrupt(id, `${column} is not text`)\n  return value\n}\n\nfunction date(value: unknown, column: string, id: string): Date {\n  const parsed = value instanceof Date || typeof value === \"string\" ? new Date(value) : null\n  if (!parsed || !Number.isFinite(parsed.getTime())) throw corrupt(id, `${column} is not a date`)\n  return parsed\n}\n\nfunction corrupt(id: string, reason: string): Error {\n  return new Error(`[Sixb] Stored file download grant '${id}' is invalid: ${reason}.`)\n}\n",
-    "import type { PipelineRunRecord, QueuePipelineRunInput } from \"./types\"\n\nexport function canRequeuePipelineRunAfterEnqueueFailure(\n  existing: PipelineRunRecord,\n  input: QueuePipelineRunInput\n): boolean {\n  return (\n    existing.status === \"failed\" &&\n    existing.error?.code === \"queue.enqueue_failed\" &&\n    existing.error.retryable &&\n    existing.executionId === input.executionId &&\n    existing.pipelineId === input.pipelineId\n  )\n}\n",
-    "import type { QueueSyncRunInput, SyncRunRecord } from \"./types\"\n\nexport function canRequeueSyncRunAfterEnqueueFailure(\n  existing: SyncRunRecord,\n  input: QueueSyncRunInput\n): boolean {\n  return (\n    existing.status === \"failed\" &&\n    existing.error?.code === \"queue.enqueue_failed\" &&\n    existing.error.retryable &&\n    existing.executionId === input.executionId &&\n    existing.syncId === input.syncId &&\n    existing.datasetId === input.datasetId &&\n    existing.mode === input.mode &&\n    existing.expectedLatestVersionId === input.expectedLatestVersionId &&\n    existing.commitMessage === input.commitMessage\n  )\n}\n",
-    "import { StorageTransactionError } from \"./errors\"\nimport { createObjectOperationScope } from \"./operation-scope\"\nimport type { Storage } from \"./types\"\n\ntype ObjectLike = Record<PropertyKey, unknown>\n\nexport function createTransactionStorageProxy<T extends Storage>(\n  target: T,\n  isActive: () => boolean\n): T {\n  const proxies = new WeakMap<object, object>()\n  const objectStorage = createObjectOperationScope(target.objects, {\n    assertAvailable: () => assertTransactionActive(isActive),\n    run: async <TResult>(operation: () => Promise<TResult> | TResult): Promise<TResult> => {\n      assertTransactionActive(isActive)\n      return operation()\n    },\n  })\n\n  const wrap = <TValue extends object>(value: TValue): TValue => {\n    const existing = proxies.get(value)\n    if (existing) return existing as TValue\n\n    const proxy = new Proxy(value as ObjectLike, {\n      // The guard runs on property access and on call. Its purpose is to fail fast when a\n      // transaction handle (`tx`) leaks past the transaction's lifetime — using it afterward is a\n      // bug, not a recoverable state. Overhead is bounded: only the storage namespaces reachable\n      // from `tx` are wrapped (a handful), not the row/link data graph, and never per-record.\n      get(current, property, receiver) {\n        assertTransactionActive(isActive)\n        const result =\n          current === target && property === \"objects\"\n            ? objectStorage\n            : Reflect.get(current, property, receiver)\n        if (typeof result === \"function\") {\n          return (...args: unknown[]) => {\n            assertTransactionActive(isActive)\n            return result.apply(current, args)\n          }\n        }\n        if (result && typeof result === \"object\") {\n          return wrap(result)\n        }\n        return result\n      },\n    })\n\n    proxies.set(value, proxy)\n    return proxy as TValue\n  }\n\n  return wrap(target)\n}\n\nexport function assertTransactionActive(isActive: () => boolean): void {\n  if (!isActive()) {\n    throw new StorageTransactionError(\n      \"[Sixb] Transaction storage cannot be used after transaction completion.\",\n      { code: \"transaction_inactive\" }\n    )\n  }\n}\n\nexport function throwNestedStorageTransaction(): never {\n  throw new StorageTransactionError(\"[Sixb] Nested storage transactions are not supported yet.\", {\n    code: \"nested_transaction\",\n  })\n}\n"
-  ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;AAIO,SAAS,mBAAmB,CAAC,MAAqB,OAA+B;AAAA,EACtF,IAAI,KAAK,SAAS,MAAM;AAAA,IAAM,OAAO;AAAA,EACrC,IAAI,KAAK,SAAS;AAAA,IAAQ,OAAO;AAAA,EACjC,IAAI,MAAM,SAAS;AAAA,IAAQ,OAAO;AAAA,EAClC,OAAO,KAAK,iBAAiB,MAAM,gBAAgB,KAAK,cAAc,MAAM;AAAA;AAGvE,SAAS,oBAAoB,CAAC,MAAe,OAAyB;AAAA,EAC3E,OAAO,qBAAoB,IAAI,MAAM,qBAAoB,KAAK;AAAA;AAIzD,SAAS,sBAAsB,CACpC,MACA,OACS;AAAA,EACT,OACE,KAAK,aAAa,MAAM,YACxB,oBAAoB,KAAK,SAAS,MAAM,OAAO,KAC/C,qBAAqB,KAAK,QAAQ,MAAM,MAAM;AAAA;AAM3C,SAAS,0BAA0B,CACxC,MACA,OACS;AAAA,EACT,OAAO,qBAAqB,4BAA4B,IAAI,GAAG,4BAA4B,KAAK,CAAC;AAAA;AAGnG,SAAS,2BAA2B,CAClC,QAC2C;AAAA,EAC3C,QAAQ,aAAa,iBAAiB,iBAAiB;AAAA,EACvD,OAAO;AAAA;;;ACpBF,SAAS,8BAA6B,CAAC,OAAmD;AAAA,EAC/F,MAAM,QAAQ,sBAAsB,MAAM;AAAA,EAC1C,WAAW,SAAS,CAAC,MAAM,aAAa,eAAe,YAAY,gBAAgB,GAAY;AAAA,IAC7F,IAAI,OAAO,MAAM,WAAW,YAAY,MAAM,OAAO,KAAK,EAAE,WAAW,GAAG;AAAA,MACxE,MAAM,IAAI,gBAAe,GAAG,8BAA8B,QAAQ;AAAA,IACpE;AAAA,EACF;AAAA,EACA,MAAM,SAAiB,MAAM;AAAA,EAC7B,IAAI,WAAW,eAAe,WAAW,UAAU;AAAA,IACjD,MAAM,IAAI,gBAAe,GAAG,6BAA6B,UAAU;AAAA,EACrE;AAAA,EACA,IAAI,CAAE,mBAAwC,SAAS,MAAM,KAAK,GAAG;AAAA,IACnE,MAAM,IAAI,gBAAe,GAAG,4BAA4B,MAAM,SAAS;AAAA,EACzE;AAAA,EACA,IAAI,MAAM,UAAU,WAAW;AAAA,IAC7B,MAAM,IAAI,gBAAe,GAAG,2CAA2C;AAAA,EACzE;AAAA,EACA,MAAM,YAAY,YAAY,MAAM,WAAW,GAAG,iBAAiB;AAAA,EACnE,MAAM,aAAa,YAAY,MAAM,YAAY,GAAG,kBAAkB;AAAA,EACtE,IAAI,aAAa,WAAW;AAAA,IAC1B,MAAM,IAAI,gBAAe,GAAG,wCAAwC;AAAA,EACtE;AAAA,EACA,iBAAgB,MAAM,QAAQ,GAAG,cAAc;AAAA,EAE/C,MAAM,SAAS;AAAA,IACb,IAAI,MAAM;AAAA,IACV,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,SAAS,gBAAgB,MAAM,OAAO;AAAA,IACtC,OAAO,MAAM;AAAA,IACb;AAAA,IACA;AAAA,IACA,QAAQ,gBAAgB,MAAM,MAAM;AAAA,IACpC,gBAAgB,MAAM;AAAA,OAClB,MAAM,cAAc,YACpB,CAAC,IACD,EAAE,WAAW,mBAAmB,MAAM,WAAW,KAAK,EAAE;AAAA,EAC9D;AAAA,EAEA,IAAI,MAAM,WAAW,aAAa;AAAA,IAChC,IAAI,MAAM,UAAU,WAAW;AAAA,MAC7B,MAAM,IAAI,gBAAe,GAAG,iDAAiD;AAAA,IAC/E;AAAA,IACA,OAAO,KAAK,QAAQ,QAAQ,YAAY;AAAA,EAC1C;AAAA,EACA,MAAM,QAAQ,uBAAsB,MAAM,OAAO,MAAM,KAAK;AAAA,EAC5D,IAAI,MAAM,QAAQ,UAAU,MAAM,MAAM,MAAM,QAAQ,aAAa,MAAM,UAAU;AAAA,IACjF,MAAM,IAAI,gBAAe,GAAG,2CAA2C;AAAA,EACzE;AAAA,EACA,OAAO,KAAK,QAAQ,QAAQ,UAAU,MAAM;AAAA;AASvC,SAAS,wBAAuB,CACrC,UACA,OACoF;AAAA,EACpF,MAAM,QAAQ,sBAAsB,MAAM;AAAA,EAC1C,IAAI,CAAC,UAAU;AAAA,IACb,MAAM,IAAI,gBAAe,GAAG,gCAAgC,MAAM,aAAa;AAAA,EACjF;AAAA,EACA,MAAM,cAAc,YAAY,MAAM,eAAe,IAAI,MAAQ,GAAG,eAAe;AAAA,EACnF,MAAM,UACJ,MAAM,WAAW,cACb,EAAE,QAAQ,aAAa,YAAY,IACnC,EAAE,QAAQ,UAAU,aAAa,OAAO,uBAAsB,MAAM,OAAO,SAAS,EAAE;AAAA,EAE5F,IAAI,SAAS,SAAS;AAAA,IACpB,IAAI,2BAA2B,SAAS,SAAS,OAAO;AAAA,MACtD,OAAO,EAAE,KAAK,UAAU,SAAS,KAAK;AAAA,IACxC,MAAM,IAAI,gBAAe,GAAG,+CAA+C;AAAA,EAC7E;AAAA,EACA,IAAI,SAAS,WAAW,eAAe,SAAS,UAAU,UAAU;AAAA,IAClE,MAAM,IAAI,gBACR,GAAG,0CAA0C,SAAS,qBAAqB,SAAS,SACtF;AAAA,EACF;AAAA,EACA,OAAO,EAAE,KAAK,UAAU,QAAQ;AAAA;AAGlC,SAAS,kBAAkB,CACzB,WACA,OAC0B;AAAA,EAC1B,MAAM,cAAc,YAAY,UAAU,aAAa,GAAG,iBAAiB;AAAA,EAC3E,IAAI,UAAU,WAAW,aAAa;AAAA,IACpC,iBAAgB,UAAU,QAAQ,GAAG,wBAAwB;AAAA,IAC7D,OAAO,EAAE,QAAQ,aAAa,aAAa,QAAQ,gBAAe,UAAU,MAAM,EAAE;AAAA,EACtF;AAAA,EACA,OAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA,OAAO,uBAAsB,UAAU,OAAO,WAAW;AAAA,EAC3D;AAAA;AAIF,SAAS,WAAW,CAAC,OAAa,OAAqB;AAAA,EACrD,MAAM,OAAO,iBAAiB,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,GAAG;AAAA,EAC1E,IAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,GAAG;AAAA,IACpC,MAAM,IAAI,gBAAe,GAAG,6BAA6B;AAAA,EAC3D;AAAA,EACA,OAAO;AAAA;;;AC5HF,MAAM,6BAA4B,MAAM;AAAA,EAIlC;AAAA,EACA;AAAA,EACA;AAAA,EALF,OAAO;AAAA,EAEhB,WAAW,CACA,cACA,WACA,SACT;AAAA,IACA,MAAM,UAAU,YAAY,gBAAgB,WAAW;AAAA,IAJ9C;AAAA,IACA;AAAA,IACA;AAAA;AAIb;AAAA;AAEO,MAAM,4BAA2B,MAAM;AAAA,EACnC,OAAO;AAClB;AAAA;AAYO,MAAM,iCAAgC,MAAM;AAAA,EACxC,OAAO;AAAA,EACP;AAAA,EACS;AAAA,EAElB,WAAW,CAAC,SAAiB,UAA0C,CAAC,GAAG;AAAA,IACzE,MAAM,OAAO;AAAA,IACb,KAAK,OAAO,QAAQ;AAAA,IACpB,KAAK,QAAQ,QAAQ;AAAA;AAEzB;AAEO,SAAS,8BAA6B,CAAC,OAAyB;AAAA,EACrE,OAAO,iBAAiB,4BAA2B,MAAM,SAAS;AAAA;;;ACnC7D,SAAS,0BAAyB,CAAC,KAEd;AAAA,EAC1B,MAAM,KAAK,KAAK,IAAI,IAAI,MAAM,OAAO,IAAI,EAAE,CAAC;AAAA,EAC5C,MAAM,OAAO,OAAO,IAAI,SAAS,WAAW,KAAK,MAAM,IAAI,IAAI,IAAI,IAAI;AAAA,EACvE,IAAI,CAAC,WAAU,IAAI;AAAA,IAAG,MAAM,QAAQ,IAAI,8BAA8B;AAAA,EAEtE,OAAO;AAAA,IACL;AAAA,IACA,WAAW,KAAK,IAAI,WAAW,aAAa,EAAE;AAAA,IAC9C,WAAW,KAAK,IAAI,WAAW,aAAa,EAAE;AAAA,IAC9C;AAAA,IACA,aAAa,KAAK,IAAI,aAAa,eAAe,EAAE;AAAA,IACpD,WAAW,KAAK,IAAI,WAAW,aAAa,EAAE;AAAA,IAC9C,WAAW,KAAK,IAAI,WAAW,aAAa,EAAE;AAAA,OAC1C,IAAI,aAAa,OAAO,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,WAAW,aAAa,EAAE,EAAE;AAAA,EACrF;AAAA;AAGK,SAAS,4BAA4B,CAC1C,QACyB;AAAA,EACzB,OAAO,gBAAgB,MAAM;AAAA;AAG/B,SAAS,IAAI,CAAC,OAAgB,QAAgB,IAAoB;AAAA,EAChE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW;AAAA,IAAG,MAAM,QAAQ,IAAI,GAAG,oBAAoB;AAAA,EAC9F,OAAO;AAAA;AAGT,SAAS,IAAI,CAAC,OAAgB,QAAgB,IAAkB;AAAA,EAC9D,MAAM,SAAS,iBAAiB,QAAQ,OAAO,UAAU,WAAW,IAAI,KAAK,KAAK,IAAI;AAAA,EACtF,IAAI,CAAC,UAAU,CAAC,OAAO,SAAS,OAAO,QAAQ,CAAC;AAAA,IAAG,MAAM,QAAQ,IAAI,GAAG,sBAAsB;AAAA,EAC9F,OAAO;AAAA;AAGT,SAAS,OAAO,CAAC,IAAY,QAAuB;AAAA,EAClD,OAAO,IAAI,MAAM,sCAAsC,mBAAmB,SAAS;AAAA;;;AC3C9E,SAAS,yCAAwC,CACtD,UACA,OACS;AAAA,EACT,OACE,SAAS,WAAW,YACpB,SAAS,OAAO,SAAS,0BACzB,SAAS,MAAM,aACf,SAAS,gBAAgB,MAAM,eAC/B,SAAS,eAAe,MAAM;AAAA;;;ACT3B,SAAS,qCAAoC,CAClD,UACA,OACS;AAAA,EACT,OACE,SAAS,WAAW,YACpB,SAAS,OAAO,SAAS,0BACzB,SAAS,MAAM,aACf,SAAS,gBAAgB,MAAM,eAC/B,SAAS,WAAW,MAAM,UAC1B,SAAS,cAAc,MAAM,aAC7B,SAAS,SAAS,MAAM,QACxB,SAAS,4BAA4B,MAAM,2BAC3C,SAAS,kBAAkB,MAAM;AAAA;;;ACT9B,SAAS,8BAAgD,CAC9D,QACA,UACG;AAAA,EACH,MAAM,UAAU,IAAI;AAAA,EACpB,MAAM,gBAAgB,4BAA2B,OAAO,SAAS;AAAA,IAC/D,iBAAiB,MAAM,yBAAwB,QAAQ;AAAA,IACvD,KAAK,OAAgB,cAAkE;AAAA,MACrF,yBAAwB,QAAQ;AAAA,MAChC,OAAO,UAAU;AAAA;AAAA,EAErB,CAAC;AAAA,EAED,MAAM,OAAO,CAAwB,UAA0B;AAAA,IAC7D,MAAM,WAAW,QAAQ,IAAI,KAAK;AAAA,IAClC,IAAI;AAAA,MAAU,OAAO;AAAA,IAErB,MAAM,QAAQ,IAAI,MAAM,OAAqB;AAAA,MAK3C,GAAG,CAAC,SAAS,UAAU,UAAU;AAAA,QAC/B,yBAAwB,QAAQ;AAAA,QAChC,MAAM,SACJ,YAAY,UAAU,aAAa,YAC/B,gBACA,QAAQ,IAAI,SAAS,UAAU,QAAQ;AAAA,QAC7C,IAAI,OAAO,WAAW,YAAY;AAAA,UAChC,OAAO,IAAI,SAAoB;AAAA,YAC7B,yBAAwB,QAAQ;AAAA,YAChC,OAAO,OAAO,MAAM,SAAS,IAAI;AAAA;AAAA,QAErC;AAAA,QACA,IAAI,UAAU,OAAO,WAAW,UAAU;AAAA,UACxC,OAAO,KAAK,MAAM;AAAA,QACpB;AAAA,QACA,OAAO;AAAA;AAAA,IAEX,CAAC;AAAA,IAED,QAAQ,IAAI,OAAO,KAAK;AAAA,IACxB,OAAO;AAAA;AAAA,EAGT,OAAO,KAAK,MAAM;AAAA;AAGb,SAAS,wBAAuB,CAAC,UAA+B;AAAA,EACrE,IAAI,CAAC,SAAS,GAAG;AAAA,IACf,MAAM,IAAI,yBACR,2EACA,EAAE,MAAM,uBAAuB,CACjC;AAAA,EACF;AAAA;AAGK,SAAS,8BAA6B,GAAU;AAAA,EACrD,MAAM,IAAI,yBAAwB,6DAA6D;AAAA,IAC7F,MAAM;AAAA,EACR,CAAC;AAAA;",
-  "debugId": "B710291DEE8F3A1864756E2164756E21",
-  "names": []
-}