@sixb/core 0.1.6 → 0.1.8

package/dist/chunk-fe5ev6mr.js.map

@@ -1,11 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/storage/workflow-runs/errors.ts", "../src/storage/workflow-runs/provider.ts"],
-  "sourcesContent": [
-    "/**\n * Base error for workflow-run storage operations.\n */\nexport class WorkflowRunError extends Error {\n  readonly name = \"WorkflowRunError\"\n}\n",
-    "import { agentServiceAccountId } from \"../../agents/authority\"\nimport type { ExecutionStorage } from \"../executions\"\nimport { findAgentRunExecution, findPrimitiveRunExecution } from \"../executions/run-link\"\nimport { WorkflowRunError } from \"./errors\"\n\n/** Validate the semantic link between a durable workflow run and its immutable execution. */\nexport async function assertWorkflowRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly runId: string\n  readonly workflowId: string\n}): Promise<void> {\n  const execution = await findPrimitiveRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    primitive: { kind: \"workflow\", id: input.workflowId, runId: input.runId },\n    sourceTypes: [\"execution\", \"schedule\", \"event\"],\n  })\n  if (!execution) {\n    invalidExecution(input.executionId, input.runId)\n  }\n\n  if (execution.source.type === \"schedule\" || execution.source.type === \"event\") {\n    if (execution.requestedBy !== undefined) {\n      invalidExecution(input.executionId, input.runId)\n    }\n    return\n  }\n\n  // ExecutionStorage already validates the immutable parent reference, correlation id, and\n  // requested-by propagation. This boundary only owns the workflow-specific source restriction.\n  if (execution.source.type !== \"execution\") {\n    invalidExecution(input.executionId, input.runId)\n  }\n}\n\n/** Validate the semantic link between a Workflow Agent-node run and its child execution. */\nexport async function assertWorkflowAgentNodeRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly nodeRunId: string\n  readonly agentId: string\n  readonly workflowExecutionId: string\n}): Promise<void> {\n  const execution = await findAgentRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    runId: input.nodeRunId,\n    serviceAccountId: agentServiceAccountId(input.agentId),\n  })\n  if (\n    !execution ||\n    execution.source.type !== \"execution\" ||\n    execution.source.executionId !== input.workflowExecutionId\n  ) {\n    throw new WorkflowRunError(\n      `[Sixb] Execution '${input.executionId}' does not authorize Workflow Agent-node run '${input.nodeRunId}'.`\n    )\n  }\n}\n\nfunction invalidExecution(executionId: string, runId: string): never {\n  throw new WorkflowRunError(\n    `[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`\n  )\n}\n"
-  ],
-  "mappings": ";;;;;;;;;;AAGO,MAAM,yBAAyB,MAAM;AAAA,EACjC,OAAO;AAClB;;;ACCA,eAAsB,0BAA0B,CAAC,OAM/B;AAAA,EAChB,MAAM,YAAY,MAAM,0BAA0B;AAAA,IAChD,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,EAAE,MAAM,YAAY,IAAI,MAAM,YAAY,OAAO,MAAM,MAAM;AAAA,IACxE,aAAa,CAAC,aAAa,YAAY,OAAO;AAAA,EAChD,CAAC;AAAA,EACD,IAAI,CAAC,WAAW;AAAA,IACd,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA,EAEA,IAAI,UAAU,OAAO,SAAS,cAAc,UAAU,OAAO,SAAS,SAAS;AAAA,IAC7E,IAAI,UAAU,gBAAgB,WAAW;AAAA,MACvC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AAAA,EAIA,IAAI,UAAU,OAAO,SAAS,aAAa;AAAA,IACzC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA;AAIF,eAAsB,mCAAmC,CAAC,OAOxC;AAAA,EAChB,MAAM,YAAY,MAAM,sBAAsB;AAAA,IAC5C,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,OAAO,MAAM;AAAA,IACb,kBAAkB,sBAAsB,MAAM,OAAO;AAAA,EACvD,CAAC;AAAA,EACD,IACE,CAAC,aACD,UAAU,OAAO,SAAS,eAC1B,UAAU,OAAO,gBAAgB,MAAM,qBACvC;AAAA,IACA,MAAM,IAAI,iBACR,qBAAqB,MAAM,4DAA4D,MAAM,aAC/F;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CAAC,aAAqB,OAAsB;AAAA,EACnE,MAAM,IAAI,iBACR,qBAAqB,iDAAiD,SACxE;AAAA;",
-  "debugId": "2817C9DE019D4AC264756E2164756E21",
-  "names": []
-}

package/dist/chunk-h9kxd41f.js.map

@@ -1,11 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/storage/executions/errors.ts", "../src/storage/executions/validation.ts"],
-  "sourcesContent": [
-    "export type ExecutionStorageErrorCode =\n  | \"duplicate_execution\"\n  | \"invalid_credential\"\n  | \"invalid_input\"\n  | \"invalid_parent_execution\"\n  | \"missing_credential\"\n  | \"missing_parent_execution\"\n  | \"missing_principal\"\n\n/** Stable error raised when an execution record would violate ledger invariants. */\nexport class ExecutionStorageError extends Error {\n  readonly name = \"ExecutionStorageError\"\n\n  constructor(\n    readonly code: ExecutionStorageErrorCode,\n    message: string,\n    options: ErrorOptions = {}\n  ) {\n    super(message, options)\n  }\n}\n",
-    "import type {\n  AuthorizablePrincipal,\n  AuthorizationRef,\n  KernelOperation,\n} from \"../../execution/types\"\nimport type { AuthStorage } from \"../auth\"\nimport { ExecutionStorageError } from \"./errors\"\nimport type {\n  CreateExecutionInput,\n  DurableExecutionExecutor,\n  DurableExecutionSource,\n  ExecutionRecord,\n} from \"./types\"\n\nexport interface ExecutionValidationLookup {\n  readonly auth: AuthStorage\n  getExecution(params: {\n    readonly projectId: string\n    readonly id: string\n  }): Promise<ExecutionRecord | null>\n}\n\nexport function normalizeExecutionRecord(\n  input: CreateExecutionInput,\n  createdAt: Date = new Date()\n): ExecutionRecord {\n  const record: ExecutionRecord = {\n    id: input.id,\n    projectId: input.projectId,\n    ...(input.requestedBy === undefined ? {} : { requestedBy: structuredClone(input.requestedBy) }),\n    executor: structuredClone(input.executor),\n    source: structuredClone(input.source),\n    correlationId: input.correlationId,\n    authorizationRef: structuredClone(input.authorizationRef),\n    createdAt: new Date(createdAt),\n  }\n\n  assertRecordShape(record)\n  assertExecutorAuthority(record)\n  return record\n}\n\nexport async function validateExecutionRecordReferences(\n  record: ExecutionRecord,\n  lookup: ExecutionValidationLookup\n): Promise<void> {\n  await validatePrincipal(record.requestedBy, record.projectId, \"Requested-by principal\", lookup)\n\n  if (record.authorizationRef.type === \"principal\") {\n    await validatePrincipal(\n      record.authorizationRef.principal,\n      record.projectId,\n      \"Authority principal\",\n      lookup\n    )\n    await validateCredential(record, lookup)\n  }\n\n  await validateParent(record, lookup)\n}\n\nexport function cloneExecutionRecord(record: ExecutionRecord): ExecutionRecord {\n  return structuredClone(record)\n}\n\nfunction assertRecordShape(record: ExecutionRecord): void {\n  assertNonBlank(record.id, \"Execution id\")\n  assertNonBlank(record.projectId, \"Execution project id\")\n  assertNonBlank(record.correlationId, \"Execution correlation id\")\n  assertValidDate(record.createdAt, \"Execution createdAt\")\n\n  if (record.requestedBy) {\n    assertPrincipal(record.requestedBy, \"Requested-by principal\")\n  }\n\n  assertExecutor(record.executor)\n  assertSource(record.source)\n  assertAuthorizationRef(record.authorizationRef)\n}\n\nfunction assertExecutor(executor: DurableExecutionExecutor): void {\n  switch (executor.type) {\n    case \"request\":\n      assertNonBlank(executor.requestId, \"Executor request id\")\n      return\n    case \"primitive\":\n      assertTrustedPrimitiveKind(executor.kind, \"Executor primitive kind\")\n      assertNonBlank(executor.runId, \"Executor primitive run id\")\n      return\n    case \"agent\":\n      assertNonBlank(executor.runId, \"Executor agent run id\")\n      return\n    case \"kernel\":\n      assertKernelOperation(executor.operation, \"Executor kernel operation\")\n      return\n    default:\n      invalid(`Unknown execution executor type '${String((executor as { type?: unknown }).type)}'.`)\n  }\n}\n\nfunction assertSource(source: DurableExecutionSource): void {\n  switch (source.type) {\n    case \"http\":\n      assertNonBlank(source.requestId, \"Execution source request id\")\n      return\n    case \"webhook\":\n      assertNonBlank(source.deliveryId, \"Execution source delivery id\")\n      return\n    case \"schedule\":\n    case \"event\":\n      assertNonBlank(source.eventId, \"Execution source event id\")\n      return\n    case \"datasetVersion\":\n      assertNonBlank(source.datasetId, \"Execution source dataset id\")\n      assertNonBlank(source.versionId, \"Execution source dataset version id\")\n      return\n    case \"execution\":\n      assertNonBlank(source.executionId, \"Execution source execution id\")\n      return\n    default:\n      invalid(\n        `Execution source type '${String((source as { type?: unknown }).type)}' is not durable.`\n      )\n  }\n}\n\nfunction assertAuthorizationRef(ref: AuthorizationRef): void {\n  switch (ref.type) {\n    case \"principal\":\n      assertPrincipal(ref.principal, \"Authority principal\")\n      if (ref.credential) {\n        if (ref.credential.type !== \"session\" && ref.credential.type !== \"accessToken\") {\n          invalid(\n            `Unknown authority credential type '${String(\n              (ref.credential as { type?: unknown }).type\n            )}'.`\n          )\n        }\n        assertNonBlank(ref.credential.id, \"Authority credential id\")\n      }\n      return\n    case \"trustedPrimitive\":\n      assertTrustedPrimitiveKind(ref.primitive.kind, \"Authority primitive kind\")\n      assertNonBlank(ref.primitive.id, \"Authority primitive id\")\n      assertNonBlank(ref.primitive.runId, \"Authority primitive run id\")\n      return\n    case \"kernel\":\n      assertKernelOperation(ref.operation, \"Authority kernel operation\")\n      return\n    case \"disabled\":\n      return\n    default:\n      invalid(`Unknown authorization reference type '${String((ref as { type?: unknown }).type)}'.`)\n  }\n}\n\nfunction assertExecutorAuthority(record: ExecutionRecord): void {\n  const { executor, authorizationRef, requestedBy, source } = record\n\n  switch (executor.type) {\n    case \"request\": {\n      if (source.type !== \"http\" || source.requestId !== executor.requestId) {\n        invalid(\"Request executions require a matching HTTP source request id.\")\n      }\n      if (authorizationRef.type === \"principal\") {\n        if (!principalsEqual(requestedBy, authorizationRef.principal)) {\n          invalid(\"Request authority must match its requested-by principal.\")\n        }\n        return\n      }\n      if (authorizationRef.type === \"disabled\") {\n        if (requestedBy !== undefined) {\n          invalid(\"Auth-disabled request executions cannot have a requested-by principal.\")\n        }\n        return\n      }\n      invalid(\"Request executions require principal or explicitly disabled authority.\")\n      break\n    }\n    case \"primitive\": {\n      if (authorizationRef.type !== \"trustedPrimitive\") {\n        invalid(\"Primitive executions require trusted primitive authority.\")\n      }\n      if (\n        authorizationRef.primitive.kind !== executor.kind ||\n        authorizationRef.primitive.runId !== executor.runId\n      ) {\n        invalid(\"Trusted primitive authority must match the executor kind and run id.\")\n      }\n      return\n    }\n    case \"agent\": {\n      if (\n        authorizationRef.type !== \"principal\" ||\n        authorizationRef.principal.type !== \"serviceAccount\"\n      ) {\n        invalid(\"Agent executions require service-account authority.\")\n      }\n      if (authorizationRef.credential !== undefined) {\n        invalid(\"Agent execution authority cannot carry an external credential.\")\n      }\n      return\n    }\n    case \"kernel\": {\n      if (\n        authorizationRef.type !== \"kernel\" ||\n        !kernelOperationsEqual(authorizationRef.operation, executor.operation)\n      ) {\n        invalid(\"Kernel authority must match the executor operation.\")\n      }\n      if (requestedBy !== undefined) {\n        invalid(\"Kernel executions cannot have a requested-by principal.\")\n      }\n      return\n    }\n  }\n}\n\nasync function validatePrincipal(\n  principal: AuthorizablePrincipal | undefined,\n  projectId: string,\n  label: string,\n  lookup: ExecutionValidationLookup\n): Promise<void> {\n  if (!principal) return\n\n  const record =\n    principal.type === \"user\"\n      ? await lookup.auth.users.getById({ projectId, id: principal.id })\n      : await lookup.auth.serviceAccounts.getById({ projectId, id: principal.id })\n  if (!record) {\n    throw new ExecutionStorageError(\n      \"missing_principal\",\n      `[Sixb] ${label} '${principal.id}' does not exist in project '${projectId}'.`\n    )\n  }\n}\n\nasync function validateCredential(\n  record: ExecutionRecord,\n  lookup: ExecutionValidationLookup\n): Promise<void> {\n  if (record.authorizationRef.type !== \"principal\" || !record.authorizationRef.credential) return\n\n  const { principal, credential } = record.authorizationRef\n  if (credential.type === \"session\") {\n    const session = await lookup.auth.sessions.getById({\n      projectId: record.projectId,\n      id: credential.id,\n    })\n    if (!session) {\n      throw new ExecutionStorageError(\n        \"missing_credential\",\n        `[Sixb] Authority session '${credential.id}' does not exist in project '${record.projectId}'.`\n      )\n    }\n    if (principal.type !== \"user\" || session.userId !== principal.id) {\n      throw new ExecutionStorageError(\n        \"invalid_credential\",\n        `[Sixb] Authority session '${credential.id}' does not belong to principal '${principal.id}'.`\n      )\n    }\n    return\n  }\n\n  const token = await lookup.auth.accessTokens.getById({\n    projectId: record.projectId,\n    id: credential.id,\n  })\n  if (!token) {\n    throw new ExecutionStorageError(\n      \"missing_credential\",\n      `[Sixb] Authority access token '${credential.id}' does not exist in project '${record.projectId}'.`\n    )\n  }\n  if (token.subjectType !== principal.type || token.subjectId !== principal.id) {\n    throw new ExecutionStorageError(\n      \"invalid_credential\",\n      `[Sixb] Authority access token '${credential.id}' does not belong to principal '${principal.id}'.`\n    )\n  }\n}\n\nasync function validateParent(\n  record: ExecutionRecord,\n  lookup: ExecutionValidationLookup\n): Promise<void> {\n  if (record.source.type !== \"execution\") return\n  const parentExecutionId = record.source.executionId\n\n  const parent = await lookup.getExecution({\n    projectId: record.projectId,\n    id: parentExecutionId,\n  })\n  if (!parent) {\n    throw new ExecutionStorageError(\n      \"missing_parent_execution\",\n      `[Sixb] Parent execution '${parentExecutionId}' does not exist in project '${record.projectId}'.`\n    )\n  }\n  if (parent.correlationId !== record.correlationId) {\n    throw new ExecutionStorageError(\n      \"invalid_parent_execution\",\n      `[Sixb] Child execution '${record.id}' must preserve its parent correlation id.`\n    )\n  }\n  if (!principalsEqual(parent.requestedBy, record.requestedBy)) {\n    throw new ExecutionStorageError(\n      \"invalid_parent_execution\",\n      `[Sixb] Child execution '${record.id}' must preserve its parent requested-by principal.`\n    )\n  }\n}\n\nfunction assertPrincipal(principal: AuthorizablePrincipal, label: string): void {\n  if (principal.type !== \"user\" && principal.type !== \"serviceAccount\") {\n    invalid(`${label} has unsupported type '${String((principal as { type?: unknown }).type)}'.`)\n  }\n  assertNonBlank(principal.id, `${label} id`)\n}\n\nfunction assertKernelOperation(operation: KernelOperation, label: string): void {\n  if (operation.type !== \"ontology.recover\") {\n    invalid(`${label} has unsupported type '${String((operation as { type?: unknown }).type)}'.`)\n  }\n  assertNonBlank(operation.recoveryId, `${label} recovery id`)\n}\n\nfunction assertTrustedPrimitiveKind(value: string, label: string): void {\n  if (!TRUSTED_PRIMITIVE_KINDS.has(value)) {\n    invalid(`${label} '${value}' is not supported.`)\n  }\n}\n\nfunction assertNonBlank(value: string, label: string): void {\n  if (typeof value !== \"string\" || !value.trim()) {\n    invalid(`${label} must be a non-empty string.`)\n  }\n}\n\nfunction assertValidDate(value: Date, label: string): void {\n  if (!(value instanceof Date) || !Number.isFinite(value.getTime())) {\n    invalid(`${label} must be a valid date.`)\n  }\n}\n\nfunction principalsEqual(\n  left: AuthorizablePrincipal | undefined,\n  right: AuthorizablePrincipal | undefined\n): boolean {\n  return left?.type === right?.type && left?.id === right?.id\n}\n\nfunction kernelOperationsEqual(left: KernelOperation, right: KernelOperation): boolean {\n  return left.type === right.type && left.recoveryId === right.recoveryId\n}\n\nfunction invalid(message: string): never {\n  throw new ExecutionStorageError(\"invalid_input\", `[Sixb] ${message}`)\n}\n\nconst TRUSTED_PRIMITIVE_KINDS = new Set([\n  \"action\",\n  \"pipeline\",\n  \"projection\",\n  \"rule\",\n  \"sync\",\n  \"webhook\",\n  \"workflow\",\n])\n"
-  ],
-  "mappings": ";;AAUO,MAAM,8BAA8B,MAAM;AAAA,EAIpC;AAAA,EAHF,OAAO;AAAA,EAEhB,WAAW,CACA,MACT,SACA,UAAwB,CAAC,GACzB;AAAA,IACA,MAAM,SAAS,OAAO;AAAA,IAJb;AAAA;AAMb;;;ACEO,SAAS,wBAAwB,CACtC,OACA,YAAkB,IAAI,MACL;AAAA,EACjB,MAAM,SAA0B;AAAA,IAC9B,IAAI,MAAM;AAAA,IACV,WAAW,MAAM;AAAA,OACb,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,gBAAgB,MAAM,WAAW,EAAE;AAAA,IAC7F,UAAU,gBAAgB,MAAM,QAAQ;AAAA,IACxC,QAAQ,gBAAgB,MAAM,MAAM;AAAA,IACpC,eAAe,MAAM;AAAA,IACrB,kBAAkB,gBAAgB,MAAM,gBAAgB;AAAA,IACxD,WAAW,IAAI,KAAK,SAAS;AAAA,EAC/B;AAAA,EAEA,kBAAkB,MAAM;AAAA,EACxB,wBAAwB,MAAM;AAAA,EAC9B,OAAO;AAAA;AAGT,eAAsB,iCAAiC,CACrD,QACA,QACe;AAAA,EACf,MAAM,kBAAkB,OAAO,aAAa,OAAO,WAAW,0BAA0B,MAAM;AAAA,EAE9F,IAAI,OAAO,iBAAiB,SAAS,aAAa;AAAA,IAChD,MAAM,kBACJ,OAAO,iBAAiB,WACxB,OAAO,WACP,uBACA,MACF;AAAA,IACA,MAAM,mBAAmB,QAAQ,MAAM;AAAA,EACzC;AAAA,EAEA,MAAM,eAAe,QAAQ,MAAM;AAAA;AAG9B,SAAS,oBAAoB,CAAC,QAA0C;AAAA,EAC7E,OAAO,gBAAgB,MAAM;AAAA;AAG/B,SAAS,iBAAiB,CAAC,QAA+B;AAAA,EACxD,eAAe,OAAO,IAAI,cAAc;AAAA,EACxC,eAAe,OAAO,WAAW,sBAAsB;AAAA,EACvD,eAAe,OAAO,eAAe,0BAA0B;AAAA,EAC/D,gBAAgB,OAAO,WAAW,qBAAqB;AAAA,EAEvD,IAAI,OAAO,aAAa;AAAA,IACtB,gBAAgB,OAAO,aAAa,wBAAwB;AAAA,EAC9D;AAAA,EAEA,eAAe,OAAO,QAAQ;AAAA,EAC9B,aAAa,OAAO,MAAM;AAAA,EAC1B,uBAAuB,OAAO,gBAAgB;AAAA;AAGhD,SAAS,cAAc,CAAC,UAA0C;AAAA,EAChE,QAAQ,SAAS;AAAA,SACV;AAAA,MACH,eAAe,SAAS,WAAW,qBAAqB;AAAA,MACxD;AAAA,SACG;AAAA,MACH,2BAA2B,SAAS,MAAM,yBAAyB;AAAA,MACnE,eAAe,SAAS,OAAO,2BAA2B;AAAA,MAC1D;AAAA,SACG;AAAA,MACH,eAAe,SAAS,OAAO,uBAAuB;AAAA,MACtD;AAAA,SACG;AAAA,MACH,sBAAsB,SAAS,WAAW,2BAA2B;AAAA,MACrE;AAAA;AAAA,MAEA,QAAQ,oCAAoC,OAAQ,SAAgC,IAAI,KAAK;AAAA;AAAA;AAInG,SAAS,YAAY,CAAC,QAAsC;AAAA,EAC1D,QAAQ,OAAO;AAAA,SACR;AAAA,MACH,eAAe,OAAO,WAAW,6BAA6B;AAAA,MAC9D;AAAA,SACG;AAAA,MACH,eAAe,OAAO,YAAY,8BAA8B;AAAA,MAChE;AAAA,SACG;AAAA,SACA;AAAA,MACH,eAAe,OAAO,SAAS,2BAA2B;AAAA,MAC1D;AAAA,SACG;AAAA,MACH,eAAe,OAAO,WAAW,6BAA6B;AAAA,MAC9D,eAAe,OAAO,WAAW,qCAAqC;AAAA,MACtE;AAAA,SACG;AAAA,MACH,eAAe,OAAO,aAAa,+BAA+B;AAAA,MAClE;AAAA;AAAA,MAEA,QACE,0BAA0B,OAAQ,OAA8B,IAAI,oBACtE;AAAA;AAAA;AAIN,SAAS,sBAAsB,CAAC,KAA6B;AAAA,EAC3D,QAAQ,IAAI;AAAA,SACL;AAAA,MACH,gBAAgB,IAAI,WAAW,qBAAqB;AAAA,MACpD,IAAI,IAAI,YAAY;AAAA,QAClB,IAAI,IAAI,WAAW,SAAS,aAAa,IAAI,WAAW,SAAS,eAAe;AAAA,UAC9E,QACE,sCAAsC,OACnC,IAAI,WAAkC,IACzC,KACF;AAAA,QACF;AAAA,QACA,eAAe,IAAI,WAAW,IAAI,yBAAyB;AAAA,MAC7D;AAAA,MACA;AAAA,SACG;AAAA,MACH,2BAA2B,IAAI,UAAU,MAAM,0BAA0B;AAAA,MACzE,eAAe,IAAI,UAAU,IAAI,wBAAwB;AAAA,MACzD,eAAe,IAAI,UAAU,OAAO,4BAA4B;AAAA,MAChE;AAAA,SACG;AAAA,MACH,sBAAsB,IAAI,WAAW,4BAA4B;AAAA,MACjE;AAAA,SACG;AAAA,MACH;AAAA;AAAA,MAEA,QAAQ,yCAAyC,OAAQ,IAA2B,IAAI,KAAK;AAAA;AAAA;AAInG,SAAS,uBAAuB,CAAC,QAA+B;AAAA,EAC9D,QAAQ,UAAU,kBAAkB,aAAa,WAAW;AAAA,EAE5D,QAAQ,SAAS;AAAA,SACV,WAAW;AAAA,MACd,IAAI,OAAO,SAAS,UAAU,OAAO,cAAc,SAAS,WAAW;AAAA,QACrE,QAAQ,+DAA+D;AAAA,MACzE;AAAA,MACA,IAAI,iBAAiB,SAAS,aAAa;AAAA,QACzC,IAAI,CAAC,gBAAgB,aAAa,iBAAiB,SAAS,GAAG;AAAA,UAC7D,QAAQ,0DAA0D;AAAA,QACpE;AAAA,QACA;AAAA,MACF;AAAA,MACA,IAAI,iBAAiB,SAAS,YAAY;AAAA,QACxC,IAAI,gBAAgB,WAAW;AAAA,UAC7B,QAAQ,wEAAwE;AAAA,QAClF;AAAA,QACA;AAAA,MACF;AAAA,MACA,QAAQ,wEAAwE;AAAA,MAChF;AAAA,IACF;AAAA,SACK,aAAa;AAAA,MAChB,IAAI,iBAAiB,SAAS,oBAAoB;AAAA,QAChD,QAAQ,2DAA2D;AAAA,MACrE;AAAA,MACA,IACE,iBAAiB,UAAU,SAAS,SAAS,QAC7C,iBAAiB,UAAU,UAAU,SAAS,OAC9C;AAAA,QACA,QAAQ,sEAAsE;AAAA,MAChF;AAAA,MACA;AAAA,IACF;AAAA,SACK,SAAS;AAAA,MACZ,IACE,iBAAiB,SAAS,eAC1B,iBAAiB,UAAU,SAAS,kBACpC;AAAA,QACA,QAAQ,qDAAqD;AAAA,MAC/D;AAAA,MACA,IAAI,iBAAiB,eAAe,WAAW;AAAA,QAC7C,QAAQ,gEAAgE;AAAA,MAC1E;AAAA,MACA;AAAA,IACF;AAAA,SACK,UAAU;AAAA,MACb,IACE,iBAAiB,SAAS,YAC1B,CAAC,sBAAsB,iBAAiB,WAAW,SAAS,SAAS,GACrE;AAAA,QACA,QAAQ,qDAAqD;AAAA,MAC/D;AAAA,MACA,IAAI,gBAAgB,WAAW;AAAA,QAC7B,QAAQ,yDAAyD;AAAA,MACnE;AAAA,MACA;AAAA,IACF;AAAA;AAAA;AAIJ,eAAe,iBAAiB,CAC9B,WACA,WACA,OACA,QACe;AAAA,EACf,IAAI,CAAC;AAAA,IAAW;AAAA,EAEhB,MAAM,SACJ,UAAU,SAAS,SACf,MAAM,OAAO,KAAK,MAAM,QAAQ,EAAE,WAAW,IAAI,UAAU,GAAG,CAAC,IAC/D,MAAM,OAAO,KAAK,gBAAgB,QAAQ,EAAE,WAAW,IAAI,UAAU,GAAG,CAAC;AAAA,EAC/E,IAAI,CAAC,QAAQ;AAAA,IACX,MAAM,IAAI,sBACR,qBACA,UAAU,UAAU,UAAU,kCAAkC,aAClE;AAAA,EACF;AAAA;AAGF,eAAe,kBAAkB,CAC/B,QACA,QACe;AAAA,EACf,IAAI,OAAO,iBAAiB,SAAS,eAAe,CAAC,OAAO,iBAAiB;AAAA,IAAY;AAAA,EAEzF,QAAQ,WAAW,eAAe,OAAO;AAAA,EACzC,IAAI,WAAW,SAAS,WAAW;AAAA,IACjC,MAAM,UAAU,MAAM,OAAO,KAAK,SAAS,QAAQ;AAAA,MACjD,WAAW,OAAO;AAAA,MAClB,IAAI,WAAW;AAAA,IACjB,CAAC;AAAA,IACD,IAAI,CAAC,SAAS;AAAA,MACZ,MAAM,IAAI,sBACR,sBACA,6BAA6B,WAAW,kCAAkC,OAAO,aACnF;AAAA,IACF;AAAA,IACA,IAAI,UAAU,SAAS,UAAU,QAAQ,WAAW,UAAU,IAAI;AAAA,MAChE,MAAM,IAAI,sBACR,sBACA,6BAA6B,WAAW,qCAAqC,UAAU,MACzF;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,MAAM,OAAO,KAAK,aAAa,QAAQ;AAAA,IACnD,WAAW,OAAO;AAAA,IAClB,IAAI,WAAW;AAAA,EACjB,CAAC;AAAA,EACD,IAAI,CAAC,OAAO;AAAA,IACV,MAAM,IAAI,sBACR,sBACA,kCAAkC,WAAW,kCAAkC,OAAO,aACxF;AAAA,EACF;AAAA,EACA,IAAI,MAAM,gBAAgB,UAAU,QAAQ,MAAM,cAAc,UAAU,IAAI;AAAA,IAC5E,MAAM,IAAI,sBACR,sBACA,kCAAkC,WAAW,qCAAqC,UAAU,MAC9F;AAAA,EACF;AAAA;AAGF,eAAe,cAAc,CAC3B,QACA,QACe;AAAA,EACf,IAAI,OAAO,OAAO,SAAS;AAAA,IAAa;AAAA,EACxC,MAAM,oBAAoB,OAAO,OAAO;AAAA,EAExC,MAAM,SAAS,MAAM,OAAO,aAAa;AAAA,IACvC,WAAW,OAAO;AAAA,IAClB,IAAI;AAAA,EACN,CAAC;AAAA,EACD,IAAI,CAAC,QAAQ;AAAA,IACX,MAAM,IAAI,sBACR,4BACA,4BAA4B,iDAAiD,OAAO,aACtF;AAAA,EACF;AAAA,EACA,IAAI,OAAO,kBAAkB,OAAO,eAAe;AAAA,IACjD,MAAM,IAAI,sBACR,4BACA,2BAA2B,OAAO,8CACpC;AAAA,EACF;AAAA,EACA,IAAI,CAAC,gBAAgB,OAAO,aAAa,OAAO,WAAW,GAAG;AAAA,IAC5D,MAAM,IAAI,sBACR,4BACA,2BAA2B,OAAO,sDACpC;AAAA,EACF;AAAA;AAGF,SAAS,eAAe,CAAC,WAAkC,OAAqB;AAAA,EAC9E,IAAI,UAAU,SAAS,UAAU,UAAU,SAAS,kBAAkB;AAAA,IACpE,QAAQ,GAAG,+BAA+B,OAAQ,UAAiC,IAAI,KAAK;AAAA,EAC9F;AAAA,EACA,eAAe,UAAU,IAAI,GAAG,UAAU;AAAA;AAG5C,SAAS,qBAAqB,CAAC,WAA4B,OAAqB;AAAA,EAC9E,IAAI,UAAU,SAAS,oBAAoB;AAAA,IACzC,QAAQ,GAAG,+BAA+B,OAAQ,UAAiC,IAAI,KAAK;AAAA,EAC9F;AAAA,EACA,eAAe,UAAU,YAAY,GAAG,mBAAmB;AAAA;AAG7D,SAAS,0BAA0B,CAAC,OAAe,OAAqB;AAAA,EACtE,IAAI,CAAC,wBAAwB,IAAI,KAAK,GAAG;AAAA,IACvC,QAAQ,GAAG,UAAU,0BAA0B;AAAA,EACjD;AAAA;AAGF,SAAS,cAAc,CAAC,OAAe,OAAqB;AAAA,EAC1D,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,GAAG;AAAA,IAC9C,QAAQ,GAAG,mCAAmC;AAAA,EAChD;AAAA;AAGF,SAAS,eAAe,CAAC,OAAa,OAAqB;AAAA,EACzD,IAAI,EAAE,iBAAiB,SAAS,CAAC,OAAO,SAAS,MAAM,QAAQ,CAAC,GAAG;AAAA,IACjE,QAAQ,GAAG,6BAA6B;AAAA,EAC1C;AAAA;AAGF,SAAS,eAAe,CACtB,MACA,OACS;AAAA,EACT,OAAO,MAAM,SAAS,OAAO,QAAQ,MAAM,OAAO,OAAO;AAAA;AAG3D,SAAS,qBAAqB,CAAC,MAAuB,OAAiC;AAAA,EACrF,OAAO,KAAK,SAAS,MAAM,QAAQ,KAAK,eAAe,MAAM;AAAA;AAG/D,SAAS,OAAO,CAAC,SAAwB;AAAA,EACvC,MAAM,IAAI,sBAAsB,iBAAiB,UAAU,SAAS;AAAA;AAGtE,IAAM,0BAA0B,IAAI,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;",
-  "debugId": "903A9A3201175C6C64756E2164756E21",
-  "names": []
-}

package/dist/chunk-hceck7dq.js

@@ -1,137 +0,0 @@
-// @bun
-import {
-  AuthStorageError,
-  SYSTEM_PRINCIPAL
-} from "./chunk-1e8m6yn3.js";
-import {
-  resolveAuthorizationContext
-} from "./chunk-f83ka50g.js";
-
-// src/agents/authority.ts
-function agentServiceAccountId(agentId) {
-  return `svc_agent_${agentId}`;
-}
-async function ensureAgentExecutionIdentity(input) {
-  const auth = requireAuthStorage(input.auth);
-  const id = agentServiceAccountId(input.agent.id);
-  const name = input.agent.name;
-  const description = `Managed service account for agent '${input.agent.id}'.`;
-  const now = new Date;
-  const loaded = await loadOrCreateAgentServiceAccount(auth, {
-    id,
-    projectId: input.projectId,
-    name,
-    description,
-    updatedAt: now
-  });
-  assertActiveAgentServiceAccount(input.agent.id, loaded);
-  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {
-    existing: loaded,
-    name,
-    description,
-    updatedAt: now
-  });
-  assertActiveAgentServiceAccount(input.agent.id, serviceAccount);
-  const groupMemberships = await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({
-    projectId: input.projectId,
-    serviceAccountId: id,
-    groupIds: input.agent.groupIds,
-    source: "agent",
-    updatedAt: now
-  });
-  return {
-    serviceAccount,
-    principal: { type: "serviceAccount", id },
-    groupMemberships
-  };
-}
-async function loadOrCreateAgentServiceAccount(auth, input) {
-  const existing = await auth.serviceAccounts.getById({
-    projectId: input.projectId,
-    id: input.id
-  });
-  if (existing)
-    return existing;
-  try {
-    return await auth.serviceAccounts.create({
-      id: input.id,
-      projectId: input.projectId,
-      name: input.name,
-      description: input.description,
-      status: "active",
-      createdByPrincipal: SYSTEM_PRINCIPAL,
-      createdAt: input.updatedAt,
-      updatedAt: input.updatedAt
-    });
-  } catch (error) {
-    if (!(error instanceof AuthStorageError) || error.code !== "duplicate_service_account") {
-      throw error;
-    }
-    const concurrent = await auth.serviceAccounts.getById({
-      projectId: input.projectId,
-      id: input.id
-    });
-    if (!concurrent)
-      throw error;
-    return concurrent;
-  }
-}
-function assertActiveAgentServiceAccount(agentId, serviceAccount) {
-  if (serviceAccount.status === "suspended") {
-    throw new Error(`[Sixb] Agent '${agentId}' service account '${serviceAccount.id}' is suspended.`);
-  }
-}
-async function resolveAgentExecutionAuthorization(input) {
-  const auth = requireAuthStorage(input.auth);
-  const expectedId = agentServiceAccountId(input.agentId);
-  const principal = input.authorizationRef.type === "principal" ? input.authorizationRef.principal : null;
-  if (principal?.type !== "serviceAccount" || principal.id !== expectedId) {
-    throw new Error(`[Sixb] Agent '${input.agentId}' execution authority must reference service account '${expectedId}'.`);
-  }
-  const serviceAccount = await auth.serviceAccounts.getById({
-    projectId: input.projectId,
-    id: principal.id
-  });
-  if (!serviceAccount || serviceAccount.status !== "active") {
-    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`);
-  }
-  const groupMemberships = await auth.serviceAccountGroupMemberships.listForServiceAccount({
-    projectId: input.projectId,
-    serviceAccountId: principal.id
-  });
-  const identity = {
-    serviceAccount,
-    principal: { type: "serviceAccount", id: principal.id },
-    groupMemberships
-  };
-  return {
-    identity,
-    context: resolveAuthorizationContext({
-      principal: identity.principal,
-      groupIds: groupMemberships.map((membership) => membership.groupId),
-      roles: input.security.listResolvedRoles()
-    })
-  };
-}
-function requireAuthStorage(auth) {
-  if (!auth) {
-    throw new Error("[Sixb] Agent executions require auth storage.");
-  }
-  return auth;
-}
-async function updateAgentServiceAccountMetadata(auth, input) {
-  if (input.existing.name === input.name && input.existing.description === input.description) {
-    return input.existing;
-  }
-  return auth.serviceAccounts.update({
-    projectId: input.existing.projectId,
-    id: input.existing.id,
-    name: input.name,
-    description: input.description,
-    updatedAt: input.updatedAt
-  });
-}
-
-export { agentServiceAccountId, ensureAgentExecutionIdentity, resolveAgentExecutionAuthorization };
-
-//# debugId=BAD526CB9A059A9B64756E2164756E21

package/dist/chunk-hceck7dq.js.map

@@ -1,10 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/agents/authority.ts"],
-  "sourcesContent": [
-    "import { SYSTEM_PRINCIPAL } from \"../auth\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport { resolveAuthorizationContext } from \"../authorization\"\nimport type { AuthorizablePrincipal, AuthorizationRef } from \"../execution\"\nimport type { SecurityDefinitionCatalog } from \"../security\"\nimport type {\n  AuthStorage,\n  ServiceAccountGroupMembershipRecord,\n  ServiceAccountRecord,\n} from \"../storage/auth\"\nimport { AuthStorageError } from \"../storage/auth\"\nimport type { AgentDefinition } from \"./types\"\n\nexport interface AgentExecutionIdentity {\n  readonly serviceAccount: ServiceAccountRecord\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"serviceAccount\" }>\n  readonly groupMemberships: readonly ServiceAccountGroupMembershipRecord[]\n}\n\nexport function agentServiceAccountId(agentId: string): string {\n  return `svc_agent_${agentId}`\n}\n\n/** Ensure the definition-owned service account exists before an Agent execution is admitted. */\nexport async function ensureAgentExecutionIdentity(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly agent: AgentDefinition\n}): Promise<AgentExecutionIdentity> {\n  const auth = requireAuthStorage(input.auth)\n  const id = agentServiceAccountId(input.agent.id)\n  const name = input.agent.name\n  const description = `Managed service account for agent '${input.agent.id}'.`\n  const now = new Date()\n  const loaded = await loadOrCreateAgentServiceAccount(auth, {\n    id,\n    projectId: input.projectId,\n    name,\n    description,\n    updatedAt: now,\n  })\n  assertActiveAgentServiceAccount(input.agent.id, loaded)\n  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {\n    existing: loaded,\n    name,\n    description,\n    updatedAt: now,\n  })\n  assertActiveAgentServiceAccount(input.agent.id, serviceAccount)\n\n  const groupMemberships = await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({\n    projectId: input.projectId,\n    serviceAccountId: id,\n    groupIds: input.agent.groupIds,\n    source: \"agent\",\n    updatedAt: now,\n  })\n\n  return {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id },\n    groupMemberships,\n  }\n}\n\n/** Load the managed identity, recovering only the expected concurrent-create race. */\nasync function loadOrCreateAgentServiceAccount(\n  auth: AuthStorage,\n  input: {\n    readonly id: string\n    readonly projectId: string\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  const existing = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: input.id,\n  })\n  if (existing) return existing\n\n  try {\n    return await auth.serviceAccounts.create({\n      id: input.id,\n      projectId: input.projectId,\n      name: input.name,\n      description: input.description,\n      status: \"active\",\n      createdByPrincipal: SYSTEM_PRINCIPAL,\n      createdAt: input.updatedAt,\n      updatedAt: input.updatedAt,\n    })\n  } catch (error) {\n    if (!(error instanceof AuthStorageError) || error.code !== \"duplicate_service_account\") {\n      throw error\n    }\n    const concurrent = await auth.serviceAccounts.getById({\n      projectId: input.projectId,\n      id: input.id,\n    })\n    if (!concurrent) throw error\n    return concurrent\n  }\n}\n\nfunction assertActiveAgentServiceAccount(\n  agentId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (serviceAccount.status === \"suspended\") {\n    throw new Error(\n      `[Sixb] Agent '${agentId}' service account '${serviceAccount.id}' is suspended.`\n    )\n  }\n}\n\n/** Resolve current grants for the service account referenced by a durable Agent execution. */\nexport async function resolveAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly agentId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n}): Promise<{ readonly identity: AgentExecutionIdentity; readonly context: AuthorizationContext }> {\n  const auth = requireAuthStorage(input.auth)\n  const expectedId = agentServiceAccountId(input.agentId)\n  const principal =\n    input.authorizationRef.type === \"principal\" ? input.authorizationRef.principal : null\n  if (principal?.type !== \"serviceAccount\" || principal.id !== expectedId) {\n    throw new Error(\n      `[Sixb] Agent '${input.agentId}' execution authority must reference service account '${expectedId}'.`\n    )\n  }\n\n  const serviceAccount = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: principal.id,\n  })\n  if (!serviceAccount || serviceAccount.status !== \"active\") {\n    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`)\n  }\n\n  const groupMemberships = await auth.serviceAccountGroupMemberships.listForServiceAccount({\n    projectId: input.projectId,\n    serviceAccountId: principal.id,\n  })\n  const identity: AgentExecutionIdentity = {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id: principal.id },\n    groupMemberships,\n  }\n  return {\n    identity,\n    context: resolveAuthorizationContext({\n      principal: identity.principal,\n      groupIds: groupMemberships.map((membership) => membership.groupId),\n      roles: input.security.listResolvedRoles(),\n    }),\n  }\n}\n\nfunction requireAuthStorage(auth: AuthStorage | undefined): AuthStorage {\n  if (!auth) {\n    throw new Error(\"[Sixb] Agent executions require auth storage.\")\n  }\n  return auth\n}\n\nasync function updateAgentServiceAccountMetadata(\n  auth: AuthStorage,\n  input: {\n    readonly existing: ServiceAccountRecord\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  if (input.existing.name === input.name && input.existing.description === input.description) {\n    return input.existing\n  }\n  return auth.serviceAccounts.update({\n    projectId: input.existing.projectId,\n    id: input.existing.id,\n    name: input.name,\n    description: input.description,\n    updatedAt: input.updatedAt,\n  })\n}\n"
-  ],
-  "mappings": ";;;;;;;;;;AAmBO,SAAS,qBAAqB,CAAC,SAAyB;AAAA,EAC7D,OAAO,aAAa;AAAA;AAItB,eAAsB,4BAA4B,CAAC,OAIf;AAAA,EAClC,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,KAAK,sBAAsB,MAAM,MAAM,EAAE;AAAA,EAC/C,MAAM,OAAO,MAAM,MAAM;AAAA,EACzB,MAAM,cAAc,sCAAsC,MAAM,MAAM;AAAA,EACtE,MAAM,MAAM,IAAI;AAAA,EAChB,MAAM,SAAS,MAAM,gCAAgC,MAAM;AAAA,IACzD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AAAA,EACD,gCAAgC,MAAM,MAAM,IAAI,MAAM;AAAA,EACtD,MAAM,iBAAiB,MAAM,kCAAkC,MAAM;AAAA,IACnE,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AAAA,EACD,gCAAgC,MAAM,MAAM,IAAI,cAAc;AAAA,EAE9D,MAAM,mBAAmB,MAAM,KAAK,+BAA+B,2BAA2B;AAAA,IAC5F,WAAW,MAAM;AAAA,IACjB,kBAAkB;AAAA,IAClB,UAAU,MAAM,MAAM;AAAA,IACtB,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC;AAAA,EAED,OAAO;AAAA,IACL;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,GAAG;AAAA,IACxC;AAAA,EACF;AAAA;AAIF,eAAe,+BAA+B,CAC5C,MACA,OAO+B;AAAA,EAC/B,MAAM,WAAW,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,IAAI;AAAA,IAAU,OAAO;AAAA,EAErB,IAAI;AAAA,IACF,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAAA,MACvC,IAAI,MAAM;AAAA,MACV,WAAW,MAAM;AAAA,MACjB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,QAAQ;AAAA,MACR,oBAAoB;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,EAAE,iBAAiB,qBAAqB,MAAM,SAAS,6BAA6B;AAAA,MACtF,MAAM;AAAA,IACR;AAAA,IACA,MAAM,aAAa,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM;AAAA,IACZ,CAAC;AAAA,IACD,IAAI,CAAC;AAAA,MAAY,MAAM;AAAA,IACvB,OAAO;AAAA;AAAA;AAIX,SAAS,+BAA+B,CACtC,SACA,gBACM;AAAA,EACN,IAAI,eAAe,WAAW,aAAa;AAAA,IACzC,MAAM,IAAI,MACR,iBAAiB,6BAA6B,eAAe,mBAC/D;AAAA,EACF;AAAA;AAIF,eAAsB,kCAAkC,CAAC,OAM0C;AAAA,EACjG,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,aAAa,sBAAsB,MAAM,OAAO;AAAA,EACtD,MAAM,YACJ,MAAM,iBAAiB,SAAS,cAAc,MAAM,iBAAiB,YAAY;AAAA,EACnF,IAAI,WAAW,SAAS,oBAAoB,UAAU,OAAO,YAAY;AAAA,IACvE,MAAM,IAAI,MACR,iBAAiB,MAAM,gEAAgE,cACzF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,UAAU;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,CAAC,kBAAkB,eAAe,WAAW,UAAU;AAAA,IACzD,MAAM,IAAI,MAAM,iCAAiC,UAAU,oBAAoB;AAAA,EACjF;AAAA,EAEA,MAAM,mBAAmB,MAAM,KAAK,+BAA+B,sBAAsB;AAAA,IACvF,WAAW,MAAM;AAAA,IACjB,kBAAkB,UAAU;AAAA,EAC9B,CAAC;AAAA,EACD,MAAM,WAAmC;AAAA,IACvC;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,IAAI,UAAU,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,4BAA4B;AAAA,MACnC,WAAW,SAAS;AAAA,MACpB,UAAU,iBAAiB,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,MACjE,OAAO,MAAM,SAAS,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA;AAGF,SAAS,kBAAkB,CAAC,MAA4C;AAAA,EACtE,IAAI,CAAC,MAAM;AAAA,IACT,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,iCAAiC,CAC9C,MACA,OAM+B;AAAA,EAC/B,IAAI,MAAM,SAAS,SAAS,MAAM,QAAQ,MAAM,SAAS,gBAAgB,MAAM,aAAa;AAAA,IAC1F,OAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,KAAK,gBAAgB,OAAO;AAAA,IACjC,WAAW,MAAM,SAAS;AAAA,IAC1B,IAAI,MAAM,SAAS;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,EACnB,CAAC;AAAA;",
-  "debugId": "BAD526CB9A059A9B64756E2164756E21",
-  "names": []
-}