@sixb/core 0.1.6 → 0.1.7

package/dist/{chunk-n4spznws.js → chunk-qjycjdj6.js}

@@ -2,23 +2,38 @@
 import {
   isScheduleDefinition
 } from "./chunk-5sz8ta9r.js";
+import {
+  isAgentToolDefinition
+} from "./chunk-n2arzn6e.js";
 import {
   WorkflowDefinitionError,
   assertNonEmpty,
-  isAgentDefinition,
   isAgentStepDefinition,
   isInterventionDefinition,
   isStepDefinition
-} from "./chunk-nva1xkjz.js";
+} from "./chunk-h0knpbz5.js";
 import {
   isActionDefinition
-} from "./chunk-a44d5zgd.js";
+} from "./chunk-y35ma3mj.js";
+import {
+  AGENT_REASONING_LEVELS
+} from "./chunk-08twe8m6.js";
+import {
+  isModelReasoning
+} from "./chunk-trxxmgnf.js";
+import {
+  isGroupDefinition
+} from "./chunk-rre42skh.js";
 import {
   createSixbError,
   isSixbError,
   summarizeErrorMessage
-} from "./chunk-0172wgm9.js";
+} from "./chunk-2xns679x.js";
 
+// src/workflows/agent-step-identity.ts
+function workflowAgentStepActorId(workflowId, stepId) {
+  return `workflow:${encodeURIComponent(workflowId)}:step:${encodeURIComponent(stepId)}`;
+}
 // src/workflows/builders.ts
 function interventionField(schema, options) {
   return {
@@ -49,11 +64,20 @@ function defineWorkflowStep(id) {
     }
   };
 }
-function defineAgentStep(id, agent) {
+function defineAgentStep(id, config) {
   assertNonEmpty(id, "Agent step", "id");
-  if (!isAgentDefinition(agent)) {
-    throw new WorkflowDefinitionError(`Agent step "${id}" references an invalid agent.`);
+  if (!isRecord(config)) {
+    throw new WorkflowDefinitionError(`Agent step "${id}" config must be an object.`);
+  }
+  if (typeof config.instructions !== "string" || !config.instructions.trim()) {
+    throw new WorkflowDefinitionError(`Agent step "${id}" instructions must not be empty.`);
   }
+  if (config.reasoning !== undefined && !isModelReasoning(config.reasoning)) {
+    throw new WorkflowDefinitionError(`Agent step "${id}" reasoning must be one of: ${AGENT_REASONING_LEVELS.join(", ")}, or a nonnegative budgetTokens object.`);
+  }
+  const { model, reasoning, instructions } = config;
+  const groupIds = groupIdsFromAgentStepConfig(id, config);
+  const toolNames = toolNamesFromAgentStepConfig(id, config);
   return {
     input(input) {
       return {
@@ -63,7 +87,18 @@ function defineAgentStep(id, agent) {
               if (typeof prompt !== "function") {
                 throw new WorkflowDefinitionError(`Agent step "${id}" prompt must be a function.`);
               }
-              return { kind: "agentStep", id, agent, input, output, prompt };
+              return {
+                kind: "agentStep",
+                id,
+                ...model === undefined ? {} : { model },
+                ...reasoning === undefined ? {} : { reasoning },
+                instructions,
+                groupIds,
+                toolNames,
+                input,
+                output,
+                prompt
+              };
             }
           };
         }
@@ -71,6 +106,41 @@ function defineAgentStep(id, agent) {
     }
   };
 }
+function groupIdsFromAgentStepConfig(stepId, config) {
+  if (config.groups !== undefined && !Array.isArray(config.groups)) {
+    throw new WorkflowDefinitionError(`Agent step "${stepId}" groups must be an array of group definitions.`);
+  }
+  const groupIds = Array.from(config.groups ?? [], (group) => {
+    if (!isGroupDefinition(group)) {
+      throw new WorkflowDefinitionError(`Agent step "${stepId}" groups must contain only group definitions.`);
+    }
+    return group.id;
+  });
+  assertUniqueAgentStepValues(stepId, "group", groupIds);
+  return Object.freeze(groupIds);
+}
+function toolNamesFromAgentStepConfig(stepId, config) {
+  if (config.tools !== undefined && !Array.isArray(config.tools)) {
+    throw new WorkflowDefinitionError(`Agent step "${stepId}" tools must be an array of agent tool definitions.`);
+  }
+  const toolNames = Array.from(config.tools ?? [], (tool) => {
+    if (!isAgentToolDefinition(tool)) {
+      throw new WorkflowDefinitionError(`Agent step "${stepId}" tools must contain only agent tool definitions.`);
+    }
+    return tool.name;
+  });
+  assertUniqueAgentStepValues(stepId, "tool", toolNames);
+  return Object.freeze(toolNames);
+}
+function assertUniqueAgentStepValues(stepId, kind, values) {
+  const seen = new Set;
+  for (const value of values) {
+    if (seen.has(value)) {
+      throw new WorkflowDefinitionError(`Agent step "${stepId}" ${kind}s contains duplicate ${kind} '${value}'.`);
+    }
+    seen.add(value);
+  }
+}
 function defineIntervention(id, options) {
   assertNonEmpty(id, "Intervention", "id");
   return {
@@ -280,6 +350,9 @@ function isRuntimeWorkflowMapper(value) {
 function isRuntimeWorkflowScheduleMapper(value) {
   return typeof value === "function";
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 // src/workflows/failure.ts
 function createWorkflowNodeFailure(error, identity) {
   return createSixbError("workflow.node_failed", summarizeErrorMessage(error, "Workflow node execution failed."), {
@@ -307,11 +380,11 @@ function workflowNodeFailureDetails(identity) {
         ...identity.child.actionRunId ? { actionRunId: identity.child.actionRunId } : {}
       };
     case "agent":
-      return { ...base, agentId: identity.child.agentId };
+      return { ...base, agentStepId: identity.child.agentStepId };
     case "intervention":
       return { ...base, interventionId: identity.child.interventionId };
   }
 }
-export { interventionField, defineWorkflowStep, defineAgentStep, defineIntervention, defineWorkflow, createWorkflowNodeFailure, unwrapWorkflowNodeFailure };
+export { workflowAgentStepActorId, interventionField, defineWorkflowStep, defineAgentStep, defineIntervention, defineWorkflow, createWorkflowNodeFailure, unwrapWorkflowNodeFailure };
 
-//# debugId=5C2B621CC3B063C864756E2164756E21
+//# debugId=F5A50788BC271A9364756E2164756E21

package/dist/chunk-qjycjdj6.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/workflows/agent-step-identity.ts", "../src/workflows/builders.ts", "../src/workflows/failure.ts"],
+  "sourcesContent": [
+    "/** Stable internal actor id for one workflow Agent step. */\nexport function workflowAgentStepActorId(workflowId: string, stepId: string): string {\n  return `workflow:${encodeURIComponent(workflowId)}:step:${encodeURIComponent(stepId)}`\n}\n",
+    "import type { ActionDefinition } from \"../actions\"\nimport { isActionDefinition } from \"../actions\"\nimport { AGENT_REASONING_LEVELS, isAgentToolDefinition } from \"../agents\"\nimport { isModelReasoning } from \"../models/language-model\"\nimport type { SchemaOrRef } from \"../ontology\"\nimport type { ScheduleDefinition, ScheduleDefinitionForEvent } from \"../schedules\"\nimport { isScheduleDefinition } from \"../schedules\"\nimport { isGroupDefinition } from \"../security\"\nimport { WorkflowDefinitionError } from \"./errors\"\nimport type {\n  AgentStepBuilder,\n  AgentStepDefinition,\n  DefineAgentStepConfig,\n  InterventionBuilder,\n  InterventionDefaultsRuntimeHandler,\n  InterventionDefinition,\n  InterventionFieldConfig,\n  StepBuilder,\n  StepDefinition,\n  StepHandler,\n  WorkflowBuilder,\n  WorkflowChainDefinition,\n  WorkflowNodeDefinition,\n  WorkflowScheduleMapper,\n  WorkflowTriggerDefinition,\n} from \"./types\"\nimport {\n  assertNonEmpty,\n  isAgentStepDefinition,\n  isInterventionDefinition,\n  isStepDefinition,\n} from \"./validation\"\n\ntype InterventionOptions = {\n  description?: string\n}\n\ntype RuntimeWorkflowInput = Record<string, SchemaOrRef>\ntype RuntimeWorkflowValueInput = Record<string, unknown>\ntype RuntimeWorkflowMapper = (...args: never[]) => unknown\ntype RuntimeWorkflowScheduleMapper = WorkflowScheduleMapper<unknown, RuntimeWorkflowValueInput>\ntype RuntimeWorkflowThenDefinition =\n  | StepDefinition\n  | InterventionDefinition\n  | ActionDefinition\n  | AgentStepDefinition\ntype RuntimeWorkflowThen = (\n  nodeDefinition: RuntimeWorkflowThenDefinition,\n  mapper?: RuntimeWorkflowMapper\n) => WorkflowChainDefinition\ntype RuntimeWorkflowDraftBuilder = {\n  when(schedule: ScheduleDefinition): RuntimeWorkflowDraftBuilder\n  when(\n    schedule: ScheduleDefinitionForEvent,\n    mapper: RuntimeWorkflowScheduleMapper\n  ): RuntimeWorkflowDraftBuilder\n  readonly then: RuntimeWorkflowThen\n}\n\n/**\n * See the action-param helper for why widened booleans are rejected. Optional\n * response fields must be an explicit literal decision so inference stays honest.\n */\ntype StrictBoolean<T extends boolean> = boolean extends T ? never : T\n\ntype InterventionFieldResult<TSchema extends SchemaOrRef, TRequired extends boolean> = {\n  readonly schema: TSchema\n  readonly required: TRequired\n  readonly description?: string\n}\n\nexport function interventionField<const TSchema extends SchemaOrRef>(\n  schema: TSchema\n): InterventionFieldResult<TSchema, true>\nexport function interventionField<\n  const TSchema extends SchemaOrRef,\n  const TRequired extends boolean = true,\n>(\n  schema: TSchema,\n  options: {\n    required?: StrictBoolean<TRequired>\n    description?: string\n  }\n): InterventionFieldResult<TSchema, TRequired>\nexport function interventionField(\n  schema: SchemaOrRef,\n  options?: { required?: boolean; description?: string }\n): InterventionFieldConfig {\n  return {\n    schema,\n    required: options?.required ?? true,\n    ...(options?.description !== undefined ? { description: options.description } : {}),\n  }\n}\n\nexport function defineWorkflowStep<const TId extends string>(id: TId): StepBuilder<TId> {\n  assertNonEmpty(id, \"Step\", \"id\")\n\n  return {\n    input(input: RuntimeWorkflowInput): unknown {\n      return {\n        output(output: RuntimeWorkflowInput): unknown {\n          return {\n            run(handler: StepHandler<Record<string, unknown>, Record<string, unknown>>): unknown {\n              return {\n                kind: \"step\",\n                id,\n                input,\n                output,\n                handler,\n              }\n            },\n          }\n        },\n      }\n    },\n  } as unknown as StepBuilder<TId>\n}\n\nexport function defineAgentStep<const TId extends string>(\n  id: TId,\n  config: DefineAgentStepConfig\n): AgentStepBuilder<TId> {\n  assertNonEmpty(id, \"Agent step\", \"id\")\n  if (!isRecord(config)) {\n    throw new WorkflowDefinitionError(`Agent step \"${id}\" config must be an object.`)\n  }\n  if (typeof config.instructions !== \"string\" || !config.instructions.trim()) {\n    throw new WorkflowDefinitionError(`Agent step \"${id}\" instructions must not be empty.`)\n  }\n  if (config.reasoning !== undefined && !isModelReasoning(config.reasoning)) {\n    throw new WorkflowDefinitionError(\n      `Agent step \"${id}\" reasoning must be one of: ${AGENT_REASONING_LEVELS.join(\", \")}, or a nonnegative budgetTokens object.`\n    )\n  }\n  const { model, reasoning, instructions } = config\n  const groupIds = groupIdsFromAgentStepConfig(id, config)\n  const toolNames = toolNamesFromAgentStepConfig(id, config)\n\n  return {\n    input(input: RuntimeWorkflowInput): unknown {\n      return {\n        output(output: RuntimeWorkflowInput): unknown {\n          return {\n            prompt(prompt: unknown): unknown {\n              if (typeof prompt !== \"function\") {\n                throw new WorkflowDefinitionError(`Agent step \"${id}\" prompt must be a function.`)\n              }\n              return {\n                kind: \"agentStep\",\n                id,\n                ...(model === undefined ? {} : { model }),\n                ...(reasoning === undefined ? {} : { reasoning }),\n                instructions,\n                groupIds,\n                toolNames,\n                input,\n                output,\n                prompt,\n              }\n            },\n          }\n        },\n      }\n    },\n  } as unknown as AgentStepBuilder<TId>\n}\n\nfunction groupIdsFromAgentStepConfig(\n  stepId: string,\n  config: DefineAgentStepConfig\n): readonly string[] {\n  if (config.groups !== undefined && !Array.isArray(config.groups)) {\n    throw new WorkflowDefinitionError(\n      `Agent step \"${stepId}\" groups must be an array of group definitions.`\n    )\n  }\n  const groupIds = Array.from(config.groups ?? [], (group) => {\n    if (!isGroupDefinition(group)) {\n      throw new WorkflowDefinitionError(\n        `Agent step \"${stepId}\" groups must contain only group definitions.`\n      )\n    }\n    return group.id\n  })\n  assertUniqueAgentStepValues(stepId, \"group\", groupIds)\n  return Object.freeze(groupIds)\n}\n\nfunction toolNamesFromAgentStepConfig(\n  stepId: string,\n  config: DefineAgentStepConfig\n): readonly string[] {\n  if (config.tools !== undefined && !Array.isArray(config.tools)) {\n    throw new WorkflowDefinitionError(\n      `Agent step \"${stepId}\" tools must be an array of agent tool definitions.`\n    )\n  }\n  const toolNames = Array.from(config.tools ?? [], (tool) => {\n    if (!isAgentToolDefinition(tool)) {\n      throw new WorkflowDefinitionError(\n        `Agent step \"${stepId}\" tools must contain only agent tool definitions.`\n      )\n    }\n    return tool.name\n  })\n  assertUniqueAgentStepValues(stepId, \"tool\", toolNames)\n  return Object.freeze(toolNames)\n}\n\nfunction assertUniqueAgentStepValues(\n  stepId: string,\n  kind: \"group\" | \"tool\",\n  values: readonly string[]\n): void {\n  const seen = new Set<string>()\n  for (const value of values) {\n    if (seen.has(value)) {\n      throw new WorkflowDefinitionError(\n        `Agent step \"${stepId}\" ${kind}s contains duplicate ${kind} '${value}'.`\n      )\n    }\n    seen.add(value)\n  }\n}\n\nexport function defineIntervention<const TId extends string>(\n  id: TId,\n  options?: InterventionOptions\n): InterventionBuilder<TId> {\n  assertNonEmpty(id, \"Intervention\", \"id\")\n\n  return {\n    input(input: RuntimeWorkflowInput): unknown {\n      return {\n        response(response: Record<string, unknown>): unknown {\n          return createInterventionDefinition({\n            id,\n            input,\n            response,\n            description: options?.description,\n          })\n        },\n      }\n    },\n  } as unknown as InterventionBuilder<TId>\n}\n\nexport function defineWorkflow<const TId extends string>(id: TId): WorkflowBuilder<TId> {\n  assertNonEmpty(id, \"Workflow\", \"id\")\n\n  return {\n    input(input: RuntimeWorkflowInput): unknown {\n      return createWorkflowDraftBuilder(id, input)\n    },\n  } as unknown as WorkflowBuilder<TId>\n}\n\nfunction createWorkflowDraftBuilder(\n  id: string,\n  input: RuntimeWorkflowInput\n): RuntimeWorkflowDraftBuilder {\n  const triggers: WorkflowTriggerDefinition[] = []\n  const nodes: WorkflowNodeDefinition[] = []\n  let definition: WorkflowChainDefinition | null = null\n\n  const appendNode = (\n    nodeDefinition: unknown,\n    mapper?: unknown,\n    ...extraArgs: unknown[]\n  ): WorkflowChainDefinition => {\n    if (extraArgs.length > 0) {\n      throw new WorkflowDefinitionError(`Invalid workflow \"${id}\" .then(...) call.`)\n    }\n\n    if (isStepDefinition(nodeDefinition)) {\n      if (mapper !== undefined && !isRuntimeWorkflowMapper(mapper)) {\n        throw new WorkflowDefinitionError(`Invalid workflow \"${id}\" .then(...) call.`)\n      }\n\n      nodes.push(createStepNode(id, nodes, nodeDefinition, mapper))\n      definition ??= createWorkflowDefinition(id, input, triggers, nodes, appendNode)\n      return definition\n    }\n\n    if (isAgentStepDefinition(nodeDefinition)) {\n      if (mapper !== undefined && !isRuntimeWorkflowMapper(mapper)) {\n        throw new WorkflowDefinitionError(`Invalid workflow \"${id}\" .then(...) call.`)\n      }\n\n      nodes.push(createAgentNode(id, nodes, nodeDefinition, mapper))\n      definition ??= createWorkflowDefinition(id, input, triggers, nodes, appendNode)\n      return definition\n    }\n\n    if (isInterventionDefinition(nodeDefinition)) {\n      if (mapper !== undefined && !isRuntimeWorkflowMapper(mapper)) {\n        throw new WorkflowDefinitionError(`Invalid workflow \"${id}\" .then(...) call.`)\n      }\n\n      nodes.push(createInterventionNode(id, nodes, nodeDefinition, mapper))\n      definition ??= createWorkflowDefinition(id, input, triggers, nodes, appendNode)\n      return definition\n    }\n\n    if (isActionDefinition(nodeDefinition)) {\n      if (mapper !== undefined && !isRuntimeWorkflowMapper(mapper)) {\n        throw new WorkflowDefinitionError(`Invalid workflow \"${id}\" .then(...) call.`)\n      }\n\n      nodes.push(createActionNode(id, nodes, nodeDefinition, mapper))\n      definition ??= createWorkflowDefinition(id, input, triggers, nodes, appendNode)\n      return definition\n    }\n\n    throw new WorkflowDefinitionError(`Invalid workflow \"${id}\" .then(...) call.`)\n  }\n\n  let draft: RuntimeWorkflowDraftBuilder\n\n  function when(schedule: ScheduleDefinition): RuntimeWorkflowDraftBuilder\n  function when(\n    schedule: ScheduleDefinitionForEvent,\n    mapper: RuntimeWorkflowScheduleMapper\n  ): RuntimeWorkflowDraftBuilder\n  function when(\n    schedule: unknown,\n    mapper?: unknown,\n    ...extraArgs: unknown[]\n  ): RuntimeWorkflowDraftBuilder {\n    if (extraArgs.length > 0) {\n      throw new WorkflowDefinitionError(`Invalid workflow \"${id}\" .when(...) call.`)\n    }\n\n    if (isScheduleDefinition(schedule)) {\n      if (mapper !== undefined && schedule.trigger.type !== \"event\") {\n        throw new WorkflowDefinitionError(`Workflow \"${id}\" cron schedules do not accept a mapper.`)\n      }\n      if (mapper !== undefined && !isRuntimeWorkflowScheduleMapper(mapper)) {\n        throw new WorkflowDefinitionError(`Invalid workflow \"${id}\" .when(...) schedule mapper.`)\n      }\n\n      triggers.push({\n        type: \"schedule\",\n        scheduleId: schedule.id,\n        ...(mapper !== undefined ? { mapper } : {}),\n      })\n      return draft\n    }\n\n    throw new WorkflowDefinitionError(`Workflow \"${id}\" .when(...) only accepts schedules.`)\n  }\n\n  draft = {\n    when,\n    // biome-ignore lint/suspicious/noThenProperty: Workflows intentionally expose a chainable .then(...) DSL.\n    then: appendNode,\n  }\n\n  return draft\n}\n\nfunction createWorkflowDefinition(\n  id: string,\n  input: RuntimeWorkflowInput,\n  triggers: readonly WorkflowTriggerDefinition[],\n  nodes: readonly WorkflowNodeDefinition[],\n  then: (\n    nodeDefinition: unknown,\n    mapper?: unknown,\n    ...extraArgs: unknown[]\n  ) => WorkflowChainDefinition\n): WorkflowChainDefinition {\n  return {\n    kind: \"workflow\",\n    id,\n    input,\n    triggers,\n    nodes,\n    then,\n  } as unknown as WorkflowChainDefinition\n}\n\nfunction createStepNode(\n  workflowId: string,\n  nodes: readonly WorkflowNodeDefinition[],\n  step: StepDefinition,\n  mapper: RuntimeWorkflowMapper | undefined\n): WorkflowNodeDefinition {\n  const key = deriveWorkflowNodeKey(step.id)\n  assertNodeKey(workflowId, step.id, key)\n  assertUniqueNode(workflowId, nodes, step.id, key)\n\n  return {\n    type: \"step\",\n    id: step.id,\n    key,\n    step,\n    ...(mapper !== undefined ? { mapper } : {}),\n  }\n}\n\nfunction createAgentNode(\n  workflowId: string,\n  nodes: readonly WorkflowNodeDefinition[],\n  agentStep: AgentStepDefinition,\n  mapper: RuntimeWorkflowMapper | undefined\n): WorkflowNodeDefinition {\n  const key = deriveWorkflowNodeKey(agentStep.id)\n  assertNodeKey(workflowId, agentStep.id, key)\n  assertUniqueNode(workflowId, nodes, agentStep.id, key)\n\n  return {\n    type: \"agent\",\n    id: agentStep.id,\n    key,\n    agentStep,\n    ...(mapper !== undefined ? { mapper } : {}),\n  }\n}\n\nfunction createInterventionDefinition(input: {\n  readonly id: string\n  readonly input: RuntimeWorkflowInput\n  readonly response: Record<string, unknown>\n  readonly description?: string\n}): unknown {\n  const base = {\n    kind: \"intervention\" as const,\n    id: input.id,\n    input: input.input,\n    response: input.response,\n    ...(input.description !== undefined ? { description: input.description } : {}),\n  }\n\n  const defaults = (handlerOrContext: unknown) => {\n    if (typeof handlerOrContext === \"function\") {\n      return {\n        ...base,\n        defaults: handlerOrContext as InterventionDefaultsRuntimeHandler,\n      }\n    }\n\n    // A no-defaults intervention is still usable as a definition immediately after\n    // `.response(...)`. Treating the builder method as an empty default handler keeps\n    // future executor code simple if it calls `definition.defaults?.(ctx) ?? {}`.\n    return {}\n  }\n\n  Object.defineProperty(base, \"defaults\", {\n    value: defaults,\n    enumerable: false,\n  })\n\n  return base\n}\n\nfunction createActionNode(\n  workflowId: string,\n  nodes: readonly WorkflowNodeDefinition[],\n  action: ActionDefinition,\n  mapper: RuntimeWorkflowMapper | undefined\n): WorkflowNodeDefinition {\n  const key = deriveWorkflowNodeKey(action.id)\n  assertNodeKey(workflowId, action.id, key)\n  assertUniqueNode(workflowId, nodes, action.id, key)\n\n  return {\n    type: \"action\",\n    id: action.id,\n    key,\n    action,\n    ...(mapper !== undefined ? { mapper } : {}),\n  }\n}\n\nfunction createInterventionNode(\n  workflowId: string,\n  nodes: readonly WorkflowNodeDefinition[],\n  intervention: InterventionDefinition,\n  mapper: RuntimeWorkflowMapper | undefined\n): WorkflowNodeDefinition {\n  const key = deriveWorkflowNodeKey(intervention.id)\n  assertNodeKey(workflowId, intervention.id, key)\n  assertUniqueNode(workflowId, nodes, intervention.id, key)\n\n  return {\n    type: \"intervention\",\n    id: intervention.id,\n    key,\n    intervention,\n    ...(mapper !== undefined ? { mapper } : {}),\n  } as WorkflowNodeDefinition\n}\n\nfunction assertNodeKey(workflowId: string, nodeId: string, key: string): void {\n  if (key.length === 0) {\n    throw new WorkflowDefinitionError(\n      `Workflow \"${workflowId}\" node id \"${nodeId}\" must contain at least one letter or number.`\n    )\n  }\n}\n\nfunction assertUniqueNode(\n  workflowId: string,\n  nodes: readonly WorkflowNodeDefinition[],\n  nodeId: string,\n  key: string\n): void {\n  const duplicateId = nodes.find((node) => node.id === nodeId)\n  if (duplicateId) {\n    throw new WorkflowDefinitionError(\n      `Duplicate workflow node id \"${nodeId}\" in workflow \"${workflowId}\".`\n    )\n  }\n\n  const duplicateKey = nodes.find((node) => node.key === key)\n  if (duplicateKey) {\n    throw new WorkflowDefinitionError(\n      `Duplicate workflow node key \"${key}\" in workflow \"${workflowId}\". Node ids \"${duplicateKey.id}\" and \"${nodeId}\" derive the same key.`\n    )\n  }\n}\n\nfunction deriveWorkflowNodeKey(id: string): string {\n  const segments = id\n    .trim()\n    .split(/[^A-Za-z0-9]+/)\n    .filter((segment) => segment.length > 0)\n\n  return segments\n    .map((segment, index) => {\n      const normalized = uncapitalize(segment)\n      return index === 0 ? normalized : capitalize(normalized)\n    })\n    .join(\"\")\n}\n\nfunction uncapitalize(value: string): string {\n  return value.length === 0 ? value : `${value[0].toLowerCase()}${value.slice(1)}`\n}\n\nfunction capitalize(value: string): string {\n  return value.length === 0 ? value : `${value[0].toUpperCase()}${value.slice(1)}`\n}\n\nfunction isRuntimeWorkflowMapper(value: unknown): value is RuntimeWorkflowMapper {\n  return typeof value === \"function\"\n}\n\nfunction isRuntimeWorkflowScheduleMapper(value: unknown): value is RuntimeWorkflowScheduleMapper {\n  return typeof value === \"function\"\n}\n\nfunction isRecord(value: unknown): value is Readonly<Record<string, unknown>> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n",
+    "import { createSixbError, isSixbError, summarizeErrorMessage } from \"../errors/internal\"\n\ninterface WorkflowNodeFailureIdentityBase {\n  readonly workflowId: string\n  readonly workflowRunId: string\n  readonly nodeId: string\n  readonly nodeRunId?: string\n}\n\nexport interface WorkflowNodeFailureIdentity extends WorkflowNodeFailureIdentityBase {\n  readonly child:\n    | { readonly type: \"step\"; readonly stepId: string }\n    | {\n        readonly type: \"action\"\n        readonly actionId: string\n        readonly actionRunId?: string\n      }\n    | { readonly type: \"agent\"; readonly agentStepId: string }\n    | { readonly type: \"intervention\"; readonly interventionId: string }\n}\n\n/** Translate a node-local failure into the workflow primitive's durable vocabulary. */\nexport function createWorkflowNodeFailure(error: unknown, identity: WorkflowNodeFailureIdentity) {\n  return createSixbError(\n    \"workflow.node_failed\",\n    summarizeErrorMessage(error, \"Workflow node execution failed.\"),\n    {\n      cause: error,\n      details: workflowNodeFailureDetails(identity),\n    }\n  )\n}\n\n/** Recover the native child error for direct callers and error-monitoring integrations. */\nexport function unwrapWorkflowNodeFailure(error: unknown): unknown {\n  return isSixbError(error) && error.code === \"workflow.node_failed\" && error.cause !== undefined\n    ? error.cause\n    : error\n}\n\nfunction workflowNodeFailureDetails(identity: WorkflowNodeFailureIdentity) {\n  const base = {\n    workflowId: identity.workflowId,\n    workflowRunId: identity.workflowRunId,\n    nodeId: identity.nodeId,\n    ...(identity.nodeRunId ? { nodeRunId: identity.nodeRunId } : {}),\n  }\n\n  switch (identity.child.type) {\n    case \"step\":\n      return { ...base, stepId: identity.child.stepId }\n    case \"action\":\n      return {\n        ...base,\n        actionId: identity.child.actionId,\n        ...(identity.child.actionRunId ? { actionRunId: identity.child.actionRunId } : {}),\n      }\n    case \"agent\":\n      return { ...base, agentStepId: identity.child.agentStepId }\n    case \"intervention\":\n      return { ...base, interventionId: identity.child.interventionId }\n  }\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACO,SAAS,wBAAwB,CAAC,YAAoB,QAAwB;AAAA,EACnF,OAAO,YAAY,mBAAmB,UAAU,UAAU,mBAAmB,MAAM;AAAA;;ACkF9E,SAAS,iBAAiB,CAC/B,QACA,SACyB;AAAA,EACzB,OAAO;AAAA,IACL;AAAA,IACA,UAAU,SAAS,YAAY;AAAA,OAC3B,SAAS,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EACnF;AAAA;AAGK,SAAS,kBAA4C,CAAC,IAA2B;AAAA,EACtF,eAAe,IAAI,QAAQ,IAAI;AAAA,EAE/B,OAAO;AAAA,IACL,KAAK,CAAC,OAAsC;AAAA,MAC1C,OAAO;AAAA,QACL,MAAM,CAAC,QAAuC;AAAA,UAC5C,OAAO;AAAA,YACL,GAAG,CAAC,SAAiF;AAAA,cACnF,OAAO;AAAA,gBACL,MAAM;AAAA,gBACN;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA;AAAA,UAEJ;AAAA;AAAA,MAEJ;AAAA;AAAA,EAEJ;AAAA;AAGK,SAAS,eAAyC,CACvD,IACA,QACuB;AAAA,EACvB,eAAe,IAAI,cAAc,IAAI;AAAA,EACrC,IAAI,CAAC,SAAS,MAAM,GAAG;AAAA,IACrB,MAAM,IAAI,wBAAwB,eAAe,+BAA+B;AAAA,EAClF;AAAA,EACA,IAAI,OAAO,OAAO,iBAAiB,YAAY,CAAC,OAAO,aAAa,KAAK,GAAG;AAAA,IAC1E,MAAM,IAAI,wBAAwB,eAAe,qCAAqC;AAAA,EACxF;AAAA,EACA,IAAI,OAAO,cAAc,aAAa,CAAC,iBAAiB,OAAO,SAAS,GAAG;AAAA,IACzE,MAAM,IAAI,wBACR,eAAe,iCAAiC,uBAAuB,KAAK,IAAI,0CAClF;AAAA,EACF;AAAA,EACA,QAAQ,OAAO,WAAW,iBAAiB;AAAA,EAC3C,MAAM,WAAW,4BAA4B,IAAI,MAAM;AAAA,EACvD,MAAM,YAAY,6BAA6B,IAAI,MAAM;AAAA,EAEzD,OAAO;AAAA,IACL,KAAK,CAAC,OAAsC;AAAA,MAC1C,OAAO;AAAA,QACL,MAAM,CAAC,QAAuC;AAAA,UAC5C,OAAO;AAAA,YACL,MAAM,CAAC,QAA0B;AAAA,cAC/B,IAAI,OAAO,WAAW,YAAY;AAAA,gBAChC,MAAM,IAAI,wBAAwB,eAAe,gCAAgC;AAAA,cACnF;AAAA,cACA,OAAO;AAAA,gBACL,MAAM;AAAA,gBACN;AAAA,mBACI,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM;AAAA,mBACnC,cAAc,YAAY,CAAC,IAAI,EAAE,UAAU;AAAA,gBAC/C;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cACF;AAAA;AAAA,UAEJ;AAAA;AAAA,MAEJ;AAAA;AAAA,EAEJ;AAAA;AAGF,SAAS,2BAA2B,CAClC,QACA,QACmB;AAAA,EACnB,IAAI,OAAO,WAAW,aAAa,CAAC,MAAM,QAAQ,OAAO,MAAM,GAAG;AAAA,IAChE,MAAM,IAAI,wBACR,eAAe,uDACjB;AAAA,EACF;AAAA,EACA,MAAM,WAAW,MAAM,KAAK,OAAO,UAAU,CAAC,GAAG,CAAC,UAAU;AAAA,IAC1D,IAAI,CAAC,kBAAkB,KAAK,GAAG;AAAA,MAC7B,MAAM,IAAI,wBACR,eAAe,qDACjB;AAAA,IACF;AAAA,IACA,OAAO,MAAM;AAAA,GACd;AAAA,EACD,4BAA4B,QAAQ,SAAS,QAAQ;AAAA,EACrD,OAAO,OAAO,OAAO,QAAQ;AAAA;AAG/B,SAAS,4BAA4B,CACnC,QACA,QACmB;AAAA,EACnB,IAAI,OAAO,UAAU,aAAa,CAAC,MAAM,QAAQ,OAAO,KAAK,GAAG;AAAA,IAC9D,MAAM,IAAI,wBACR,eAAe,2DACjB;AAAA,EACF;AAAA,EACA,MAAM,YAAY,MAAM,KAAK,OAAO,SAAS,CAAC,GAAG,CAAC,SAAS;AAAA,IACzD,IAAI,CAAC,sBAAsB,IAAI,GAAG;AAAA,MAChC,MAAM,IAAI,wBACR,eAAe,yDACjB;AAAA,IACF;AAAA,IACA,OAAO,KAAK;AAAA,GACb;AAAA,EACD,4BAA4B,QAAQ,QAAQ,SAAS;AAAA,EACrD,OAAO,OAAO,OAAO,SAAS;AAAA;AAGhC,SAAS,2BAA2B,CAClC,QACA,MACA,QACM;AAAA,EACN,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,SAAS,QAAQ;AAAA,IAC1B,IAAI,KAAK,IAAI,KAAK,GAAG;AAAA,MACnB,MAAM,IAAI,wBACR,eAAe,WAAW,4BAA4B,SAAS,SACjE;AAAA,IACF;AAAA,IACA,KAAK,IAAI,KAAK;AAAA,EAChB;AAAA;AAGK,SAAS,kBAA4C,CAC1D,IACA,SAC0B;AAAA,EAC1B,eAAe,IAAI,gBAAgB,IAAI;AAAA,EAEvC,OAAO;AAAA,IACL,KAAK,CAAC,OAAsC;AAAA,MAC1C,OAAO;AAAA,QACL,QAAQ,CAAC,UAA4C;AAAA,UACnD,OAAO,6BAA6B;AAAA,YAClC;AAAA,YACA;AAAA,YACA;AAAA,YACA,aAAa,SAAS;AAAA,UACxB,CAAC;AAAA;AAAA,MAEL;AAAA;AAAA,EAEJ;AAAA;AAGK,SAAS,cAAwC,CAAC,IAA+B;AAAA,EACtF,eAAe,IAAI,YAAY,IAAI;AAAA,EAEnC,OAAO;AAAA,IACL,KAAK,CAAC,OAAsC;AAAA,MAC1C,OAAO,2BAA2B,IAAI,KAAK;AAAA;AAAA,EAE/C;AAAA;AAGF,SAAS,0BAA0B,CACjC,IACA,OAC6B;AAAA,EAC7B,MAAM,WAAwC,CAAC;AAAA,EAC/C,MAAM,QAAkC,CAAC;AAAA,EACzC,IAAI,aAA6C;AAAA,EAEjD,MAAM,aAAa,CACjB,gBACA,WACG,cACyB;AAAA,IAC5B,IAAI,UAAU,SAAS,GAAG;AAAA,MACxB,MAAM,IAAI,wBAAwB,qBAAqB,sBAAsB;AAAA,IAC/E;AAAA,IAEA,IAAI,iBAAiB,cAAc,GAAG;AAAA,MACpC,IAAI,WAAW,aAAa,CAAC,wBAAwB,MAAM,GAAG;AAAA,QAC5D,MAAM,IAAI,wBAAwB,qBAAqB,sBAAsB;AAAA,MAC/E;AAAA,MAEA,MAAM,KAAK,eAAe,IAAI,OAAO,gBAAgB,MAAM,CAAC;AAAA,MAC5D,eAAe,yBAAyB,IAAI,OAAO,UAAU,OAAO,UAAU;AAAA,MAC9E,OAAO;AAAA,IACT;AAAA,IAEA,IAAI,sBAAsB,cAAc,GAAG;AAAA,MACzC,IAAI,WAAW,aAAa,CAAC,wBAAwB,MAAM,GAAG;AAAA,QAC5D,MAAM,IAAI,wBAAwB,qBAAqB,sBAAsB;AAAA,MAC/E;AAAA,MAEA,MAAM,KAAK,gBAAgB,IAAI,OAAO,gBAAgB,MAAM,CAAC;AAAA,MAC7D,eAAe,yBAAyB,IAAI,OAAO,UAAU,OAAO,UAAU;AAAA,MAC9E,OAAO;AAAA,IACT;AAAA,IAEA,IAAI,yBAAyB,cAAc,GAAG;AAAA,MAC5C,IAAI,WAAW,aAAa,CAAC,wBAAwB,MAAM,GAAG;AAAA,QAC5D,MAAM,IAAI,wBAAwB,qBAAqB,sBAAsB;AAAA,MAC/E;AAAA,MAEA,MAAM,KAAK,uBAAuB,IAAI,OAAO,gBAAgB,MAAM,CAAC;AAAA,MACpE,eAAe,yBAAyB,IAAI,OAAO,UAAU,OAAO,UAAU;AAAA,MAC9E,OAAO;AAAA,IACT;AAAA,IAEA,IAAI,mBAAmB,cAAc,GAAG;AAAA,MACtC,IAAI,WAAW,aAAa,CAAC,wBAAwB,MAAM,GAAG;AAAA,QAC5D,MAAM,IAAI,wBAAwB,qBAAqB,sBAAsB;AAAA,MAC/E;AAAA,MAEA,MAAM,KAAK,iBAAiB,IAAI,OAAO,gBAAgB,MAAM,CAAC;AAAA,MAC9D,eAAe,yBAAyB,IAAI,OAAO,UAAU,OAAO,UAAU;AAAA,MAC9E,OAAO;AAAA,IACT;AAAA,IAEA,MAAM,IAAI,wBAAwB,qBAAqB,sBAAsB;AAAA;AAAA,EAG/E,IAAI;AAAA,EAOJ,SAAS,IAAI,CACX,UACA,WACG,WAC0B;AAAA,IAC7B,IAAI,UAAU,SAAS,GAAG;AAAA,MACxB,MAAM,IAAI,wBAAwB,qBAAqB,sBAAsB;AAAA,IAC/E;AAAA,IAEA,IAAI,qBAAqB,QAAQ,GAAG;AAAA,MAClC,IAAI,WAAW,aAAa,SAAS,QAAQ,SAAS,SAAS;AAAA,QAC7D,MAAM,IAAI,wBAAwB,aAAa,4CAA4C;AAAA,MAC7F;AAAA,MACA,IAAI,WAAW,aAAa,CAAC,gCAAgC,MAAM,GAAG;AAAA,QACpE,MAAM,IAAI,wBAAwB,qBAAqB,iCAAiC;AAAA,MAC1F;AAAA,MAEA,SAAS,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,YAAY,SAAS;AAAA,WACjB,WAAW,YAAY,EAAE,OAAO,IAAI,CAAC;AAAA,MAC3C,CAAC;AAAA,MACD,OAAO;AAAA,IACT;AAAA,IAEA,MAAM,IAAI,wBAAwB,aAAa,wCAAwC;AAAA;AAAA,EAGzF,QAAQ;AAAA,IACN;AAAA,IAEA,MAAM;AAAA,EACR;AAAA,EAEA,OAAO;AAAA;AAGT,SAAS,wBAAwB,CAC/B,IACA,OACA,UACA,OACA,MAKyB;AAAA,EACzB,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA;AAGF,SAAS,cAAc,CACrB,YACA,OACA,MACA,QACwB;AAAA,EACxB,MAAM,MAAM,sBAAsB,KAAK,EAAE;AAAA,EACzC,cAAc,YAAY,KAAK,IAAI,GAAG;AAAA,EACtC,iBAAiB,YAAY,OAAO,KAAK,IAAI,GAAG;AAAA,EAEhD,OAAO;AAAA,IACL,MAAM;AAAA,IACN,IAAI,KAAK;AAAA,IACT;AAAA,IACA;AAAA,OACI,WAAW,YAAY,EAAE,OAAO,IAAI,CAAC;AAAA,EAC3C;AAAA;AAGF,SAAS,eAAe,CACtB,YACA,OACA,WACA,QACwB;AAAA,EACxB,MAAM,MAAM,sBAAsB,UAAU,EAAE;AAAA,EAC9C,cAAc,YAAY,UAAU,IAAI,GAAG;AAAA,EAC3C,iBAAiB,YAAY,OAAO,UAAU,IAAI,GAAG;AAAA,EAErD,OAAO;AAAA,IACL,MAAM;AAAA,IACN,IAAI,UAAU;AAAA,IACd;AAAA,IACA;AAAA,OACI,WAAW,YAAY,EAAE,OAAO,IAAI,CAAC;AAAA,EAC3C;AAAA;AAGF,SAAS,4BAA4B,CAAC,OAK1B;AAAA,EACV,MAAM,OAAO;AAAA,IACX,MAAM;AAAA,IACN,IAAI,MAAM;AAAA,IACV,OAAO,MAAM;AAAA,IACb,UAAU,MAAM;AAAA,OACZ,MAAM,gBAAgB,YAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,EAC9E;AAAA,EAEA,MAAM,WAAW,CAAC,qBAA8B;AAAA,IAC9C,IAAI,OAAO,qBAAqB,YAAY;AAAA,MAC1C,OAAO;AAAA,WACF;AAAA,QACH,UAAU;AAAA,MACZ;AAAA,IACF;AAAA,IAKA,OAAO,CAAC;AAAA;AAAA,EAGV,OAAO,eAAe,MAAM,YAAY;AAAA,IACtC,OAAO;AAAA,IACP,YAAY;AAAA,EACd,CAAC;AAAA,EAED,OAAO;AAAA;AAGT,SAAS,gBAAgB,CACvB,YACA,OACA,QACA,QACwB;AAAA,EACxB,MAAM,MAAM,sBAAsB,OAAO,EAAE;AAAA,EAC3C,cAAc,YAAY,OAAO,IAAI,GAAG;AAAA,EACxC,iBAAiB,YAAY,OAAO,OAAO,IAAI,GAAG;AAAA,EAElD,OAAO;AAAA,IACL,MAAM;AAAA,IACN,IAAI,OAAO;AAAA,IACX;AAAA,IACA;AAAA,OACI,WAAW,YAAY,EAAE,OAAO,IAAI,CAAC;AAAA,EAC3C;AAAA;AAGF,SAAS,sBAAsB,CAC7B,YACA,OACA,cACA,QACwB;AAAA,EACxB,MAAM,MAAM,sBAAsB,aAAa,EAAE;AAAA,EACjD,cAAc,YAAY,aAAa,IAAI,GAAG;AAAA,EAC9C,iBAAiB,YAAY,OAAO,aAAa,IAAI,GAAG;AAAA,EAExD,OAAO;AAAA,IACL,MAAM;AAAA,IACN,IAAI,aAAa;AAAA,IACjB;AAAA,IACA;AAAA,OACI,WAAW,YAAY,EAAE,OAAO,IAAI,CAAC;AAAA,EAC3C;AAAA;AAGF,SAAS,aAAa,CAAC,YAAoB,QAAgB,KAAmB;AAAA,EAC5E,IAAI,IAAI,WAAW,GAAG;AAAA,IACpB,MAAM,IAAI,wBACR,aAAa,wBAAwB,qDACvC;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CACvB,YACA,OACA,QACA,KACM;AAAA,EACN,MAAM,cAAc,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,MAAM;AAAA,EAC3D,IAAI,aAAa;AAAA,IACf,MAAM,IAAI,wBACR,+BAA+B,wBAAwB,cACzD;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,MAAM,KAAK,CAAC,SAAS,KAAK,QAAQ,GAAG;AAAA,EAC1D,IAAI,cAAc;AAAA,IAChB,MAAM,IAAI,wBACR,gCAAgC,qBAAqB,0BAA0B,aAAa,YAAY,8BAC1G;AAAA,EACF;AAAA;AAGF,SAAS,qBAAqB,CAAC,IAAoB;AAAA,EACjD,MAAM,WAAW,GACd,KAAK,EACL,MAAM,eAAe,EACrB,OAAO,CAAC,YAAY,QAAQ,SAAS,CAAC;AAAA,EAEzC,OAAO,SACJ,IAAI,CAAC,SAAS,UAAU;AAAA,IACvB,MAAM,aAAa,aAAa,OAAO;AAAA,IACvC,OAAO,UAAU,IAAI,aAAa,WAAW,UAAU;AAAA,GACxD,EACA,KAAK,EAAE;AAAA;AAGZ,SAAS,YAAY,CAAC,OAAuB;AAAA,EAC3C,OAAO,MAAM,WAAW,IAAI,QAAQ,GAAG,MAAM,GAAG,YAAY,IAAI,MAAM,MAAM,CAAC;AAAA;AAG/E,SAAS,UAAU,CAAC,OAAuB;AAAA,EACzC,OAAO,MAAM,WAAW,IAAI,QAAQ,GAAG,MAAM,GAAG,YAAY,IAAI,MAAM,MAAM,CAAC;AAAA;AAG/E,SAAS,uBAAuB,CAAC,OAAgD;AAAA,EAC/E,OAAO,OAAO,UAAU;AAAA;AAG1B,SAAS,+BAA+B,CAAC,OAAwD;AAAA,EAC/F,OAAO,OAAO,UAAU;AAAA;AAG1B,SAAS,QAAQ,CAAC,OAA4D;AAAA,EAC5E,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA;;ACrhBrE,SAAS,yBAAyB,CAAC,OAAgB,UAAuC;AAAA,EAC/F,OAAO,gBACL,wBACA,sBAAsB,OAAO,iCAAiC,GAC9D;AAAA,IACE,OAAO;AAAA,IACP,SAAS,2BAA2B,QAAQ;AAAA,EAC9C,CACF;AAAA;AAIK,SAAS,yBAAyB,CAAC,OAAyB;AAAA,EACjE,OAAO,YAAY,KAAK,KAAK,MAAM,SAAS,0BAA0B,MAAM,UAAU,YAClF,MAAM,QACN;AAAA;AAGN,SAAS,0BAA0B,CAAC,UAAuC;AAAA,EACzE,MAAM,OAAO;AAAA,IACX,YAAY,SAAS;AAAA,IACrB,eAAe,SAAS;AAAA,IACxB,QAAQ,SAAS;AAAA,OACb,SAAS,YAAY,EAAE,WAAW,SAAS,UAAU,IAAI,CAAC;AAAA,EAChE;AAAA,EAEA,QAAQ,SAAS,MAAM;AAAA,SAChB;AAAA,MACH,OAAO,KAAK,MAAM,QAAQ,SAAS,MAAM,OAAO;AAAA,SAC7C;AAAA,MACH,OAAO;AAAA,WACF;AAAA,QACH,UAAU,SAAS,MAAM;AAAA,WACrB,SAAS,MAAM,cAAc,EAAE,aAAa,SAAS,MAAM,YAAY,IAAI,CAAC;AAAA,MAClF;AAAA,SACG;AAAA,MACH,OAAO,KAAK,MAAM,aAAa,SAAS,MAAM,YAAY;AAAA,SACvD;AAAA,MACH,OAAO,KAAK,MAAM,gBAAgB,SAAS,MAAM,eAAe;AAAA;AAAA;",
+  "debugId": "F5A50788BC271A9364756E2164756E21",
+  "names": []
+}

package/dist/chunk-qjzp9xyb.js

@@ -0,0 +1,286 @@
+// @bun
+import {
+  findAgentRunExecution,
+  findPrimitiveRunExecution
+} from "./chunk-3kv70xwp.js";
+import {
+  AuthStorageError,
+  SYSTEM_PRINCIPAL,
+  principalsEqual
+} from "./chunk-rre42skh.js";
+import {
+  resolveAuthorizationContext
+} from "./chunk-37wk412q.js";
+import {
+  createSixbError
+} from "./chunk-2xns679x.js";
+
+// src/agents/authority.ts
+function agentServiceAccountId(actorId) {
+  return `svc_agent_${actorId}`;
+}
+async function ensureManagedAgentExecutionIdentity(input) {
+  const auth = requireAuthStorage(input.auth);
+  const id = agentServiceAccountId(input.actorId);
+  const now = new Date;
+  const loaded = await loadOrCreateAgentServiceAccount(auth, {
+    id,
+    projectId: input.projectId,
+    name: input.name,
+    description: input.description,
+    updatedAt: now
+  });
+  assertFrameworkManagedAgentServiceAccount(input.actorId, loaded);
+  assertActiveAgentServiceAccount(input.actorId, loaded);
+  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {
+    existing: loaded,
+    name: input.name,
+    description: input.description,
+    updatedAt: now
+  });
+  assertActiveAgentServiceAccount(input.actorId, serviceAccount);
+  const groupMemberships = requireDefinitionOwnedGroupMemberships(input.actorId, await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({
+    projectId: input.projectId,
+    serviceAccountId: id,
+    groupIds: input.groupIds,
+    source: "agent",
+    updatedAt: now
+  }));
+  return {
+    serviceAccount,
+    principal: { type: "serviceAccount", id },
+    groupMemberships
+  };
+}
+async function loadOrCreateAgentServiceAccount(auth, input) {
+  const existing = await auth.serviceAccounts.getById({
+    projectId: input.projectId,
+    id: input.id
+  });
+  if (existing)
+    return existing;
+  try {
+    return await auth.serviceAccounts.create({
+      id: input.id,
+      projectId: input.projectId,
+      name: input.name,
+      description: input.description,
+      status: "active",
+      createdByPrincipal: SYSTEM_PRINCIPAL,
+      createdAt: input.updatedAt,
+      updatedAt: input.updatedAt
+    });
+  } catch (error) {
+    if (!(error instanceof AuthStorageError) || error.code !== "duplicate_service_account") {
+      throw error;
+    }
+    const concurrent = await auth.serviceAccounts.getById({
+      projectId: input.projectId,
+      id: input.id
+    });
+    if (!concurrent)
+      throw error;
+    return concurrent;
+  }
+}
+function assertActiveAgentServiceAccount(actorId, serviceAccount) {
+  if (serviceAccount.status === "suspended") {
+    throw new Error(`[Sixb] Agent '${actorId}' service account '${serviceAccount.id}' is suspended.`);
+  }
+}
+function assertFrameworkManagedAgentServiceAccount(actorId, serviceAccount) {
+  if (serviceAccount.createdByPrincipal === undefined || !principalsEqual(serviceAccount.createdByPrincipal, SYSTEM_PRINCIPAL)) {
+    throw createSixbError("agent.execution_failed", `[Sixb] Agent '${actorId}' cannot use service account '${serviceAccount.id}' because it is not managed by Sixb.`, { details: { actorId, serviceAccountId: serviceAccount.id } });
+  }
+}
+function requireDefinitionOwnedGroupMemberships(actorId, memberships) {
+  const externalGroupIds = memberships.filter((membership) => membership.source !== "agent").map((membership) => membership.groupId);
+  if (externalGroupIds.length > 0) {
+    throw createSixbError("agent.execution_failed", `[Sixb] Agent '${actorId}' service account has group memberships not managed by its definition: ${externalGroupIds.join(", ")}.`, { details: { actorId, externalGroupIds } });
+  }
+  return memberships;
+}
+async function resolveAgentExecutionAuthorization(input) {
+  const auth = requireAuthStorage(input.auth);
+  const expectedId = agentServiceAccountId(input.actorId);
+  const principal = input.authorizationRef.type === "principal" ? input.authorizationRef.principal : null;
+  if (principal?.type !== "serviceAccount" || principal.id !== expectedId) {
+    throw new Error(`[Sixb] Agent '${input.actorId}' execution authority must reference service account '${expectedId}'.`);
+  }
+  const serviceAccount = await auth.serviceAccounts.getById({
+    projectId: input.projectId,
+    id: principal.id
+  });
+  if (!serviceAccount || serviceAccount.status !== "active") {
+    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`);
+  }
+  assertFrameworkManagedAgentServiceAccount(input.actorId, serviceAccount);
+  const groupMemberships = requireDefinitionOwnedGroupMemberships(input.actorId, await auth.serviceAccountGroupMemberships.listForServiceAccount({
+    projectId: input.projectId,
+    serviceAccountId: principal.id
+  }));
+  const identity = {
+    serviceAccount,
+    principal: { type: "serviceAccount", id: principal.id },
+    groupMemberships
+  };
+  return {
+    identity,
+    context: resolveAuthorizationContext({
+      principal: identity.principal,
+      groupIds: groupMemberships.map((membership) => membership.groupId),
+      roles: input.security.listResolvedRoles()
+    })
+  };
+}
+async function resolveInheritedAgentExecutionAuthorization(input) {
+  if (input.authorizationRef.type === "disabled")
+    return { type: "disabled" };
+  const ref = requireCredentialedUserAuthority(input.authorizationRef);
+  const auth = requireAuthStorage(input.auth);
+  const now = input.now ?? new Date;
+  const user = await requireActiveUser(auth, input.projectId, ref.principal.id);
+  const memberships = await auth.groupMemberships.listForUser({
+    projectId: input.projectId,
+    userId: user.id
+  });
+  const credential = await revalidateUserCredential({
+    auth,
+    projectId: input.projectId,
+    userId: user.id,
+    credential: ref.credential,
+    currentGroupIds: memberships.map((membership) => membership.groupId),
+    now
+  });
+  return {
+    type: "principal",
+    context: resolveAuthorizationContext({
+      principal: ref.principal,
+      groupIds: credential.groupIds,
+      roles: input.security.listResolvedRoles(),
+      ...credential.sessionId === undefined ? {} : { sessionId: credential.sessionId }
+    })
+  };
+}
+function requireCredentialedUserAuthority(ref) {
+  if (ref.type !== "principal" || ref.principal.type !== "user" || ref.credential === undefined) {
+    throw invalidInheritedAuthority("the durable reference is not a credentialed user");
+  }
+  return {
+    type: "principal",
+    principal: { type: "user", id: ref.principal.id },
+    credential: { type: ref.credential.type, id: ref.credential.id }
+  };
+}
+async function requireActiveUser(auth, projectId, userId) {
+  const user = await auth.users.getById({ projectId, id: userId });
+  if (!user || user.status !== "active") {
+    throw invalidInheritedAuthority(`user '${userId}' is not active`);
+  }
+  return user;
+}
+async function revalidateUserCredential(input) {
+  if (input.credential.type === "session") {
+    const session = await input.auth.sessions.getById({
+      projectId: input.projectId,
+      id: input.credential.id
+    });
+    if (!isUsableUserSession(session, input.userId, input.now)) {
+      throw invalidInheritedAuthority("the inherited session is no longer valid");
+    }
+    return { groupIds: input.currentGroupIds, sessionId: session.id };
+  }
+  const accessToken = await input.auth.accessTokens.getById({
+    projectId: input.projectId,
+    id: input.credential.id
+  });
+  if (!isUsableUserAccessToken(accessToken, input.userId, input.now)) {
+    throw invalidInheritedAuthority("the inherited access token is no longer valid");
+  }
+  if (accessToken.groupIds === undefined)
+    return { groupIds: input.currentGroupIds };
+  const allowedGroupIds = new Set(accessToken.groupIds);
+  return {
+    groupIds: input.currentGroupIds.filter((groupId) => allowedGroupIds.has(groupId))
+  };
+}
+function isUsableUserSession(session, userId, now) {
+  if (!session || session.userId !== userId || session.revokedAt !== undefined)
+    return false;
+  if (session.expiresAt.getTime() <= now.getTime())
+    return false;
+  return session.absoluteExpiresAt === undefined || session.absoluteExpiresAt.getTime() > now.getTime();
+}
+function isUsableUserAccessToken(token, userId, now) {
+  if (!token || token.subjectType !== "user" || token.subjectId !== userId)
+    return false;
+  return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime();
+}
+function invalidInheritedAuthority(reason) {
+  return createSixbError("agent.execution_failed", `[Sixb] The Agent execution cannot restore its inherited authority: ${reason}.`);
+}
+function requireAuthStorage(auth) {
+  if (!auth) {
+    throw new Error("[Sixb] Agent executions require auth storage.");
+  }
+  return auth;
+}
+async function updateAgentServiceAccountMetadata(auth, input) {
+  if (input.existing.name === input.name && input.existing.description === input.description) {
+    return input.existing;
+  }
+  return auth.serviceAccounts.update({
+    projectId: input.existing.projectId,
+    id: input.existing.id,
+    name: input.name,
+    description: input.description,
+    updatedAt: input.updatedAt
+  });
+}
+
+// src/storage/workflow-runs/errors.ts
+class WorkflowRunError extends Error {
+  name = "WorkflowRunError";
+}
+
+// src/storage/workflow-runs/provider.ts
+async function assertWorkflowRunExecution(input) {
+  const execution = await findPrimitiveRunExecution({
+    executions: input.executions,
+    projectId: input.projectId,
+    executionId: input.executionId,
+    primitive: { kind: "workflow", id: input.workflowId, runId: input.runId },
+    sourceTypes: ["execution", "schedule", "event"]
+  });
+  if (!execution) {
+    invalidExecution(input.executionId, input.runId);
+  }
+  if (execution.source.type === "schedule" || execution.source.type === "event") {
+    if (execution.requestedBy !== undefined) {
+      invalidExecution(input.executionId, input.runId);
+    }
+    return;
+  }
+  if (execution.source.type !== "execution") {
+    invalidExecution(input.executionId, input.runId);
+  }
+}
+async function assertWorkflowAgentNodeRunExecution(input) {
+  const execution = await findAgentRunExecution({
+    executions: input.executions,
+    projectId: input.projectId,
+    executionId: input.executionId,
+    runId: input.nodeRunId,
+    authority: { type: "managed", serviceAccountId: agentServiceAccountId(input.actorId) }
+  });
+  if (!execution || execution.source.type !== "execution" || execution.source.executionId !== input.workflowExecutionId) {
+    throw new WorkflowRunError(`[Sixb] Execution '${input.executionId}' does not authorize Workflow Agent-node run '${input.nodeRunId}'.`);
+  }
+}
+function invalidExecution(executionId, runId) {
+  throw new WorkflowRunError(`[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`);
+}
+
+export { WorkflowRunError, agentServiceAccountId, ensureManagedAgentExecutionIdentity, resolveAgentExecutionAuthorization, resolveInheritedAgentExecutionAuthorization, assertWorkflowRunExecution, assertWorkflowAgentNodeRunExecution };
+
+//# debugId=77624CF2336F235864756E2164756E21

package/dist/chunk-qjzp9xyb.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/agents/authority.ts", "../src/storage/workflow-runs/errors.ts", "../src/storage/workflow-runs/provider.ts"],
+  "sourcesContent": [
+    "import { principalsEqual, SYSTEM_PRINCIPAL } from \"../auth\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport { resolveAuthorizationContext } from \"../authorization\"\nimport { createSixbError } from \"../errors/internal\"\nimport type { AuthorizablePrincipal, AuthorizationRef } from \"../execution\"\nimport type { SecurityDefinitionCatalog } from \"../security\"\nimport type {\n  AccessTokenRecord,\n  AuthStorage,\n  ServiceAccountGroupMembershipRecord,\n  ServiceAccountRecord,\n  SessionRecord,\n  UserRecord,\n} from \"../storage/auth\"\nimport { AuthStorageError } from \"../storage/auth\"\n\nexport type AgentExecutionAuthorization =\n  | { readonly type: \"principal\"; readonly context: AuthorizationContext }\n  | { readonly type: \"disabled\" }\n\ntype UserCredentialRef = NonNullable<\n  Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n>\n\ninterface CredentialedUserAuthorizationRef {\n  readonly type: \"principal\"\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"user\" }>\n  readonly credential: UserCredentialRef\n}\n\nexport interface AgentExecutionIdentity {\n  readonly serviceAccount: ServiceAccountRecord\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"serviceAccount\" }>\n  readonly groupMemberships: readonly ServiceAccountGroupMembershipRecord[]\n}\n\nexport function agentServiceAccountId(actorId: string): string {\n  return `svc_agent_${actorId}`\n}\n\n/** Ensure a framework-managed Agent actor exists with exactly its declared group memberships. */\nexport async function ensureManagedAgentExecutionIdentity(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly name: string\n  readonly description: string\n  readonly groupIds: readonly string[]\n}): Promise<AgentExecutionIdentity> {\n  const auth = requireAuthStorage(input.auth)\n  const id = agentServiceAccountId(input.actorId)\n  const now = new Date()\n  const loaded = await loadOrCreateAgentServiceAccount(auth, {\n    id,\n    projectId: input.projectId,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertFrameworkManagedAgentServiceAccount(input.actorId, loaded)\n  assertActiveAgentServiceAccount(input.actorId, loaded)\n  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {\n    existing: loaded,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertActiveAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: id,\n      groupIds: input.groupIds,\n      source: \"agent\",\n      updatedAt: now,\n    })\n  )\n\n  return {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id },\n    groupMemberships,\n  }\n}\n\n/** Load the managed identity, recovering only the expected concurrent-create race. */\nasync function loadOrCreateAgentServiceAccount(\n  auth: AuthStorage,\n  input: {\n    readonly id: string\n    readonly projectId: string\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  const existing = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: input.id,\n  })\n  if (existing) return existing\n\n  try {\n    return await auth.serviceAccounts.create({\n      id: input.id,\n      projectId: input.projectId,\n      name: input.name,\n      description: input.description,\n      status: \"active\",\n      createdByPrincipal: SYSTEM_PRINCIPAL,\n      createdAt: input.updatedAt,\n      updatedAt: input.updatedAt,\n    })\n  } catch (error) {\n    if (!(error instanceof AuthStorageError) || error.code !== \"duplicate_service_account\") {\n      throw error\n    }\n    const concurrent = await auth.serviceAccounts.getById({\n      projectId: input.projectId,\n      id: input.id,\n    })\n    if (!concurrent) throw error\n    return concurrent\n  }\n}\n\nfunction assertActiveAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (serviceAccount.status === \"suspended\") {\n    throw new Error(\n      `[Sixb] Agent '${actorId}' service account '${serviceAccount.id}' is suspended.`\n    )\n  }\n}\n\nfunction assertFrameworkManagedAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (\n    serviceAccount.createdByPrincipal === undefined ||\n    !principalsEqual(serviceAccount.createdByPrincipal, SYSTEM_PRINCIPAL)\n  ) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' cannot use service account '${serviceAccount.id}' because it is not managed by Sixb.`,\n      { details: { actorId, serviceAccountId: serviceAccount.id } }\n    )\n  }\n}\n\nfunction requireDefinitionOwnedGroupMemberships(\n  actorId: string,\n  memberships: readonly ServiceAccountGroupMembershipRecord[]\n): readonly ServiceAccountGroupMembershipRecord[] {\n  const externalGroupIds = memberships\n    .filter((membership) => membership.source !== \"agent\")\n    .map((membership) => membership.groupId)\n  if (externalGroupIds.length > 0) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' service account has group memberships not managed by its definition: ${externalGroupIds.join(\", \")}.`,\n      { details: { actorId, externalGroupIds } }\n    )\n  }\n  return memberships\n}\n\n/** Resolve current grants for the service account referenced by a durable Agent execution. */\nexport async function resolveAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n}): Promise<{ readonly identity: AgentExecutionIdentity; readonly context: AuthorizationContext }> {\n  const auth = requireAuthStorage(input.auth)\n  const expectedId = agentServiceAccountId(input.actorId)\n  const principal =\n    input.authorizationRef.type === \"principal\" ? input.authorizationRef.principal : null\n  if (principal?.type !== \"serviceAccount\" || principal.id !== expectedId) {\n    throw new Error(\n      `[Sixb] Agent '${input.actorId}' execution authority must reference service account '${expectedId}'.`\n    )\n  }\n\n  const serviceAccount = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: principal.id,\n  })\n  if (!serviceAccount || serviceAccount.status !== \"active\") {\n    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`)\n  }\n  assertFrameworkManagedAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.listForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: principal.id,\n    })\n  )\n  const identity: AgentExecutionIdentity = {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id: principal.id },\n    groupMemberships,\n  }\n  return {\n    identity,\n    context: resolveAuthorizationContext({\n      principal: identity.principal,\n      groupIds: groupMemberships.map((membership) => membership.groupId),\n      roles: input.security.listResolvedRoles(),\n    }),\n  }\n}\n\n/** Revalidate the durable user authority inherited by a conversational or child Agent. */\nexport async function resolveInheritedAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n  readonly now?: Date\n}): Promise<AgentExecutionAuthorization> {\n  if (input.authorizationRef.type === \"disabled\") return { type: \"disabled\" }\n\n  const ref = requireCredentialedUserAuthority(input.authorizationRef)\n  const auth = requireAuthStorage(input.auth)\n  const now = input.now ?? new Date()\n  const user = await requireActiveUser(auth, input.projectId, ref.principal.id)\n  const memberships = await auth.groupMemberships.listForUser({\n    projectId: input.projectId,\n    userId: user.id,\n  })\n  const credential = await revalidateUserCredential({\n    auth,\n    projectId: input.projectId,\n    userId: user.id,\n    credential: ref.credential,\n    currentGroupIds: memberships.map((membership) => membership.groupId),\n    now,\n  })\n\n  return {\n    type: \"principal\",\n    context: resolveAuthorizationContext({\n      principal: ref.principal,\n      groupIds: credential.groupIds,\n      roles: input.security.listResolvedRoles(),\n      ...(credential.sessionId === undefined ? {} : { sessionId: credential.sessionId }),\n    }),\n  }\n}\n\nfunction requireCredentialedUserAuthority(ref: AuthorizationRef): CredentialedUserAuthorizationRef {\n  if (ref.type !== \"principal\" || ref.principal.type !== \"user\" || ref.credential === undefined) {\n    throw invalidInheritedAuthority(\"the durable reference is not a credentialed user\")\n  }\n  return {\n    type: \"principal\",\n    principal: { type: \"user\", id: ref.principal.id },\n    credential: { type: ref.credential.type, id: ref.credential.id },\n  }\n}\n\nasync function requireActiveUser(\n  auth: AuthStorage,\n  projectId: string,\n  userId: string\n): Promise<UserRecord> {\n  const user = await auth.users.getById({ projectId, id: userId })\n  if (!user || user.status !== \"active\") {\n    throw invalidInheritedAuthority(`user '${userId}' is not active`)\n  }\n  return user\n}\n\nasync function revalidateUserCredential(input: {\n  readonly auth: AuthStorage\n  readonly projectId: string\n  readonly userId: string\n  readonly credential: UserCredentialRef\n  readonly currentGroupIds: readonly string[]\n  readonly now: Date\n}): Promise<{ readonly groupIds: readonly string[]; readonly sessionId?: string }> {\n  if (input.credential.type === \"session\") {\n    const session = await input.auth.sessions.getById({\n      projectId: input.projectId,\n      id: input.credential.id,\n    })\n    if (!isUsableUserSession(session, input.userId, input.now)) {\n      throw invalidInheritedAuthority(\"the inherited session is no longer valid\")\n    }\n    return { groupIds: input.currentGroupIds, sessionId: session.id }\n  }\n\n  const accessToken = await input.auth.accessTokens.getById({\n    projectId: input.projectId,\n    id: input.credential.id,\n  })\n  if (!isUsableUserAccessToken(accessToken, input.userId, input.now)) {\n    throw invalidInheritedAuthority(\"the inherited access token is no longer valid\")\n  }\n  if (accessToken.groupIds === undefined) return { groupIds: input.currentGroupIds }\n\n  const allowedGroupIds = new Set(accessToken.groupIds)\n  return {\n    groupIds: input.currentGroupIds.filter((groupId) => allowedGroupIds.has(groupId)),\n  }\n}\n\nfunction isUsableUserSession(\n  session: SessionRecord | null,\n  userId: string,\n  now: Date\n): session is SessionRecord {\n  if (!session || session.userId !== userId || session.revokedAt !== undefined) return false\n  if (session.expiresAt.getTime() <= now.getTime()) return false\n  return (\n    session.absoluteExpiresAt === undefined || session.absoluteExpiresAt.getTime() > now.getTime()\n  )\n}\n\nfunction isUsableUserAccessToken(\n  token: AccessTokenRecord | null,\n  userId: string,\n  now: Date\n): token is AccessTokenRecord {\n  if (!token || token.subjectType !== \"user\" || token.subjectId !== userId) return false\n  return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime()\n}\n\nfunction invalidInheritedAuthority(reason: string): Error {\n  return createSixbError(\n    \"agent.execution_failed\",\n    `[Sixb] The Agent execution cannot restore its inherited authority: ${reason}.`\n  )\n}\n\nfunction requireAuthStorage(auth: AuthStorage | undefined): AuthStorage {\n  if (!auth) {\n    throw new Error(\"[Sixb] Agent executions require auth storage.\")\n  }\n  return auth\n}\n\nasync function updateAgentServiceAccountMetadata(\n  auth: AuthStorage,\n  input: {\n    readonly existing: ServiceAccountRecord\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  if (input.existing.name === input.name && input.existing.description === input.description) {\n    return input.existing\n  }\n  return auth.serviceAccounts.update({\n    projectId: input.existing.projectId,\n    id: input.existing.id,\n    name: input.name,\n    description: input.description,\n    updatedAt: input.updatedAt,\n  })\n}\n",
+    "/**\n * Base error for workflow-run storage operations.\n */\nexport class WorkflowRunError extends Error {\n  readonly name = \"WorkflowRunError\"\n}\n",
+    "import { agentServiceAccountId } from \"../../agents/authority\"\nimport type { ExecutionStorage } from \"../executions\"\nimport { findAgentRunExecution, findPrimitiveRunExecution } from \"../executions/run-link\"\nimport { WorkflowRunError } from \"./errors\"\n\n/** Validate the semantic link between a durable workflow run and its immutable execution. */\nexport async function assertWorkflowRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly runId: string\n  readonly workflowId: string\n}): Promise<void> {\n  const execution = await findPrimitiveRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    primitive: { kind: \"workflow\", id: input.workflowId, runId: input.runId },\n    sourceTypes: [\"execution\", \"schedule\", \"event\"],\n  })\n  if (!execution) {\n    invalidExecution(input.executionId, input.runId)\n  }\n\n  if (execution.source.type === \"schedule\" || execution.source.type === \"event\") {\n    if (execution.requestedBy !== undefined) {\n      invalidExecution(input.executionId, input.runId)\n    }\n    return\n  }\n\n  // ExecutionStorage already validates the immutable parent reference, correlation id, and\n  // requested-by propagation. This boundary only owns the workflow-specific source restriction.\n  if (execution.source.type !== \"execution\") {\n    invalidExecution(input.executionId, input.runId)\n  }\n}\n\n/** Validate the semantic link between a Workflow Agent-node run and its child execution. */\nexport async function assertWorkflowAgentNodeRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly nodeRunId: string\n  readonly actorId: string\n  readonly workflowExecutionId: string\n}): Promise<void> {\n  const execution = await findAgentRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    runId: input.nodeRunId,\n    authority: { type: \"managed\", serviceAccountId: agentServiceAccountId(input.actorId) },\n  })\n  if (\n    !execution ||\n    execution.source.type !== \"execution\" ||\n    execution.source.executionId !== input.workflowExecutionId\n  ) {\n    throw new WorkflowRunError(\n      `[Sixb] Execution '${input.executionId}' does not authorize Workflow Agent-node run '${input.nodeRunId}'.`\n    )\n  }\n}\n\nfunction invalidExecution(executionId: string, runId: string): never {\n  throw new WorkflowRunError(\n    `[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`\n  )\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAoCO,SAAS,qBAAqB,CAAC,SAAyB;AAAA,EAC7D,OAAO,aAAa;AAAA;AAItB,eAAsB,mCAAmC,CAAC,OAOtB;AAAA,EAClC,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,KAAK,sBAAsB,MAAM,OAAO;AAAA,EAC9C,MAAM,MAAM,IAAI;AAAA,EAChB,MAAM,SAAS,MAAM,gCAAgC,MAAM;AAAA,IACzD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,0CAA0C,MAAM,SAAS,MAAM;AAAA,EAC/D,gCAAgC,MAAM,SAAS,MAAM;AAAA,EACrD,MAAM,iBAAiB,MAAM,kCAAkC,MAAM;AAAA,IACnE,UAAU;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,gCAAgC,MAAM,SAAS,cAAc;AAAA,EAE7D,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,2BAA2B;AAAA,IACnE,WAAW,MAAM;AAAA,IACjB,kBAAkB;AAAA,IAClB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC,CACH;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,GAAG;AAAA,IACxC;AAAA,EACF;AAAA;AAIF,eAAe,+BAA+B,CAC5C,MACA,OAO+B;AAAA,EAC/B,MAAM,WAAW,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,IAAI;AAAA,IAAU,OAAO;AAAA,EAErB,IAAI;AAAA,IACF,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAAA,MACvC,IAAI,MAAM;AAAA,MACV,WAAW,MAAM;AAAA,MACjB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,QAAQ;AAAA,MACR,oBAAoB;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,EAAE,iBAAiB,qBAAqB,MAAM,SAAS,6BAA6B;AAAA,MACtF,MAAM;AAAA,IACR;AAAA,IACA,MAAM,aAAa,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM;AAAA,IACZ,CAAC;AAAA,IACD,IAAI,CAAC;AAAA,MAAY,MAAM;AAAA,IACvB,OAAO;AAAA;AAAA;AAIX,SAAS,+BAA+B,CACtC,SACA,gBACM;AAAA,EACN,IAAI,eAAe,WAAW,aAAa;AAAA,IACzC,MAAM,IAAI,MACR,iBAAiB,6BAA6B,eAAe,mBAC/D;AAAA,EACF;AAAA;AAGF,SAAS,yCAAyC,CAChD,SACA,gBACM;AAAA,EACN,IACE,eAAe,uBAAuB,aACtC,CAAC,gBAAgB,eAAe,oBAAoB,gBAAgB,GACpE;AAAA,IACA,MAAM,gBACJ,0BACA,iBAAiB,wCAAwC,eAAe,0CACxE,EAAE,SAAS,EAAE,SAAS,kBAAkB,eAAe,GAAG,EAAE,CAC9D;AAAA,EACF;AAAA;AAGF,SAAS,sCAAsC,CAC7C,SACA,aACgD;AAAA,EAChD,MAAM,mBAAmB,YACtB,OAAO,CAAC,eAAe,WAAW,WAAW,OAAO,EACpD,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,EACzC,IAAI,iBAAiB,SAAS,GAAG;AAAA,IAC/B,MAAM,gBACJ,0BACA,iBAAiB,iFAAiF,iBAAiB,KAAK,IAAI,MAC5H,EAAE,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAC3C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIT,eAAsB,kCAAkC,CAAC,OAM0C;AAAA,EACjG,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,aAAa,sBAAsB,MAAM,OAAO;AAAA,EACtD,MAAM,YACJ,MAAM,iBAAiB,SAAS,cAAc,MAAM,iBAAiB,YAAY;AAAA,EACnF,IAAI,WAAW,SAAS,oBAAoB,UAAU,OAAO,YAAY;AAAA,IACvE,MAAM,IAAI,MACR,iBAAiB,MAAM,gEAAgE,cACzF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,UAAU;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,CAAC,kBAAkB,eAAe,WAAW,UAAU;AAAA,IACzD,MAAM,IAAI,MAAM,iCAAiC,UAAU,oBAAoB;AAAA,EACjF;AAAA,EACA,0CAA0C,MAAM,SAAS,cAAc;AAAA,EAEvE,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,sBAAsB;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,kBAAkB,UAAU;AAAA,EAC9B,CAAC,CACH;AAAA,EACA,MAAM,WAAmC;AAAA,IACvC;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,IAAI,UAAU,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,4BAA4B;AAAA,MACnC,WAAW,SAAS;AAAA,MACpB,UAAU,iBAAiB,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,MACjE,OAAO,MAAM,SAAS,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA;AAIF,eAAsB,2CAA2C,CAAC,OAMzB;AAAA,EACvC,IAAI,MAAM,iBAAiB,SAAS;AAAA,IAAY,OAAO,EAAE,MAAM,WAAW;AAAA,EAE1E,MAAM,MAAM,iCAAiC,MAAM,gBAAgB;AAAA,EACnE,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,MAAM,MAAM,OAAO,IAAI;AAAA,EAC7B,MAAM,OAAO,MAAM,kBAAkB,MAAM,MAAM,WAAW,IAAI,UAAU,EAAE;AAAA,EAC5E,MAAM,cAAc,MAAM,KAAK,iBAAiB,YAAY;AAAA,IAC1D,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,EACf,CAAC;AAAA,EACD,MAAM,aAAa,MAAM,yBAAyB;AAAA,IAChD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,YAAY,IAAI;AAAA,IAChB,iBAAiB,YAAY,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,IACnE;AAAA,EACF,CAAC;AAAA,EAED,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,4BAA4B;AAAA,MACnC,WAAW,IAAI;AAAA,MACf,UAAU,WAAW;AAAA,MACrB,OAAO,MAAM,SAAS,kBAAkB;AAAA,SACpC,WAAW,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,WAAW,UAAU;AAAA,IAClF,CAAC;AAAA,EACH;AAAA;AAGF,SAAS,gCAAgC,CAAC,KAAyD;AAAA,EACjG,IAAI,IAAI,SAAS,eAAe,IAAI,UAAU,SAAS,UAAU,IAAI,eAAe,WAAW;AAAA,IAC7F,MAAM,0BAA0B,kDAAkD;AAAA,EACpF;AAAA,EACA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,EAAE,MAAM,QAAQ,IAAI,IAAI,UAAU,GAAG;AAAA,IAChD,YAAY,EAAE,MAAM,IAAI,WAAW,MAAM,IAAI,IAAI,WAAW,GAAG;AAAA,EACjE;AAAA;AAGF,eAAe,iBAAiB,CAC9B,MACA,WACA,QACqB;AAAA,EACrB,MAAM,OAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,WAAW,IAAI,OAAO,CAAC;AAAA,EAC/D,IAAI,CAAC,QAAQ,KAAK,WAAW,UAAU;AAAA,IACrC,MAAM,0BAA0B,SAAS,uBAAuB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,wBAAwB,CAAC,OAO2C;AAAA,EACjF,IAAI,MAAM,WAAW,SAAS,WAAW;AAAA,IACvC,MAAM,UAAU,MAAM,MAAM,KAAK,SAAS,QAAQ;AAAA,MAChD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM,WAAW;AAAA,IACvB,CAAC;AAAA,IACD,IAAI,CAAC,oBAAoB,SAAS,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,MAC1D,MAAM,0BAA0B,0CAA0C;AAAA,IAC5E;AAAA,IACA,OAAO,EAAE,UAAU,MAAM,iBAAiB,WAAW,QAAQ,GAAG;AAAA,EAClE;AAAA,EAEA,MAAM,cAAc,MAAM,MAAM,KAAK,aAAa,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM,WAAW;AAAA,EACvB,CAAC;AAAA,EACD,IAAI,CAAC,wBAAwB,aAAa,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,IAClE,MAAM,0BAA0B,+CAA+C;AAAA,EACjF;AAAA,EACA,IAAI,YAAY,aAAa;AAAA,IAAW,OAAO,EAAE,UAAU,MAAM,gBAAgB;AAAA,EAEjF,MAAM,kBAAkB,IAAI,IAAI,YAAY,QAAQ;AAAA,EACpD,OAAO;AAAA,IACL,UAAU,MAAM,gBAAgB,OAAO,CAAC,YAAY,gBAAgB,IAAI,OAAO,CAAC;AAAA,EAClF;AAAA;AAGF,SAAS,mBAAmB,CAC1B,SACA,QACA,KAC0B;AAAA,EAC1B,IAAI,CAAC,WAAW,QAAQ,WAAW,UAAU,QAAQ,cAAc;AAAA,IAAW,OAAO;AAAA,EACrF,IAAI,QAAQ,UAAU,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAAG,OAAO;AAAA,EACzD,OACE,QAAQ,sBAAsB,aAAa,QAAQ,kBAAkB,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAIjG,SAAS,uBAAuB,CAC9B,OACA,QACA,KAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,MAAM,gBAAgB,UAAU,MAAM,cAAc;AAAA,IAAQ,OAAO;AAAA,EACjF,OAAO,MAAM,cAAc,aAAa,MAAM,UAAU,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAGlF,SAAS,yBAAyB,CAAC,QAAuB;AAAA,EACxD,OAAO,gBACL,0BACA,sEAAsE,SACxE;AAAA;AAGF,SAAS,kBAAkB,CAAC,MAA4C;AAAA,EACtE,IAAI,CAAC,MAAM;AAAA,IACT,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,iCAAiC,CAC9C,MACA,OAM+B;AAAA,EAC/B,IAAI,MAAM,SAAS,SAAS,MAAM,QAAQ,MAAM,SAAS,gBAAgB,MAAM,aAAa;AAAA,IAC1F,OAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,KAAK,gBAAgB,OAAO;AAAA,IACjC,WAAW,MAAM,SAAS;AAAA,IAC1B,IAAI,MAAM,SAAS;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,EACnB,CAAC;AAAA;;;AC9WI,MAAM,yBAAyB,MAAM;AAAA,EACjC,OAAO;AAClB;;;ACCA,eAAsB,0BAA0B,CAAC,OAM/B;AAAA,EAChB,MAAM,YAAY,MAAM,0BAA0B;AAAA,IAChD,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,EAAE,MAAM,YAAY,IAAI,MAAM,YAAY,OAAO,MAAM,MAAM;AAAA,IACxE,aAAa,CAAC,aAAa,YAAY,OAAO;AAAA,EAChD,CAAC;AAAA,EACD,IAAI,CAAC,WAAW;AAAA,IACd,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA,EAEA,IAAI,UAAU,OAAO,SAAS,cAAc,UAAU,OAAO,SAAS,SAAS;AAAA,IAC7E,IAAI,UAAU,gBAAgB,WAAW;AAAA,MACvC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AAAA,EAIA,IAAI,UAAU,OAAO,SAAS,aAAa;AAAA,IACzC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA;AAIF,eAAsB,mCAAmC,CAAC,OAOxC;AAAA,EAChB,MAAM,YAAY,MAAM,sBAAsB;AAAA,IAC5C,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,OAAO,MAAM;AAAA,IACb,WAAW,EAAE,MAAM,WAAW,kBAAkB,sBAAsB,MAAM,OAAO,EAAE;AAAA,EACvF,CAAC;AAAA,EACD,IACE,CAAC,aACD,UAAU,OAAO,SAAS,eAC1B,UAAU,OAAO,gBAAgB,MAAM,qBACvC;AAAA,IACA,MAAM,IAAI,iBACR,qBAAqB,MAAM,4DAA4D,MAAM,aAC/F;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CAAC,aAAqB,OAAsB;AAAA,EACnE,MAAM,IAAI,iBACR,qBAAqB,iDAAiD,SACxE;AAAA;",
+  "debugId": "77624CF2336F235864756E2164756E21",
+  "names": []
+}