@sixb/core 0.1.6 → 0.1.8

package/dist/{chunk-f2rt4vkh.js → chunk-n2w475r0.js}

@@ -5,15 +5,15 @@ import {
 import {
   SixbErrorReporter,
   reportEventDeliveryFailure
-} from "./chunk-bhxaq2nn.js";
+} from "./chunk-qw9gvjv5.js";
 import {
   createSixbError,
   serializeSixbFailure,
   toSixbFailure
-} from "./chunk-0172wgm9.js";
+} from "./chunk-2xns679x.js";
 import {
   getInvalidJsonValueReason
-} from "./chunk-t8t39h7v.js";
+} from "./chunk-n6jxh8sw.js";
 
 // src/events/errors.ts
 class EventsError extends Error {

package/dist/chunk-n4khvw9n.js

@@ -0,0 +1,111 @@
+// @bun
+import {
+  getDatasetRowValidationError,
+  getDatasetSequenceValidationError
+} from "./chunk-pc7ys28c.js";
+import {
+  isPlainRecord
+} from "./chunk-n6jxh8sw.js";
+
+// src/lake-storage/errors.ts
+class LakeStorageError extends Error {
+  name = "LakeStorageError";
+}
+
+class LakeConcurrencyError extends LakeStorageError {
+  name = "LakeConcurrencyError";
+}
+
+// src/lake-storage/merge-validation.ts
+function getDatasetPrimaryKeyColumns(dataset) {
+  if (dataset.primaryKey === undefined) {
+    return null;
+  }
+  return typeof dataset.primaryKey === "string" ? [dataset.primaryKey] : [...dataset.primaryKey];
+}
+function encodeDatasetPrimaryKey(dataset, value) {
+  const columns = getDatasetPrimaryKeyColumns(dataset);
+  if (columns === null) {
+    throw new LakeStorageError(`[SixbLake] Dataset '${dataset.id}' must define a primaryKey before rows can be keyed.`);
+  }
+  const values = columns.map((columnName) => {
+    const columnValue = value[columnName];
+    if (typeof columnValue !== "string") {
+      throw new LakeStorageError(`[SixbLake] Dataset '${dataset.id}' primary-key column '${columnName}' must be a string.`);
+    }
+    return columnValue;
+  });
+  return JSON.stringify(values);
+}
+function getDatasetMergeChangeValidationError(change, dataset) {
+  const primaryKeyColumns = getDatasetPrimaryKeyColumns(dataset);
+  if (primaryKeyColumns === null) {
+    return `Dataset '${dataset.id}' must define a primaryKey before it can be merged.`;
+  }
+  if (!isPlainRecord(change)) {
+    return `Dataset '${dataset.id}' merge changes must be plain objects.`;
+  }
+  if (change.kind === "upsert") {
+    const shapeError = getChangeShapeError(change, dataset, "row");
+    if (shapeError) {
+      return shapeError;
+    }
+    return getDatasetRowValidationError(change.row, dataset);
+  }
+  if (change.kind === "delete") {
+    const shapeError = getChangeShapeError(change, dataset, "key");
+    if (shapeError) {
+      return shapeError;
+    }
+    const keyError = getDeleteKeyValidationError(change.key, dataset, primaryKeyColumns);
+    if (keyError)
+      return keyError;
+    return dataset.sequenceBy === undefined ? null : getDatasetSequenceValidationError(dataset, change.sequence);
+  }
+  return `Dataset '${dataset.id}' merge change kind must be 'upsert' or 'delete'.`;
+}
+function cloneDatasetMergeChange(change) {
+  return change.kind === "upsert" ? { kind: "upsert", row: structuredClone(change.row) } : {
+    kind: "delete",
+    key: structuredClone(change.key),
+    ...change.sequence !== undefined ? { sequence: structuredClone(change.sequence) } : {}
+  };
+}
+function getChangeShapeError(change, dataset, payloadField) {
+  const allowedFields = new Set(["kind", payloadField]);
+  if (payloadField === "key" && dataset.sequenceBy !== undefined)
+    allowedFields.add("sequence");
+  for (const field of Object.keys(change)) {
+    if (!allowedFields.has(field)) {
+      return `Dataset '${dataset.id}' ${change.kind} change contains unknown field '${field}'.`;
+    }
+  }
+  if (!Object.hasOwn(change, payloadField)) {
+    return `Dataset '${dataset.id}' ${change.kind} change is missing '${payloadField}'.`;
+  }
+  return null;
+}
+function getDeleteKeyValidationError(key, dataset, primaryKeyColumns) {
+  if (!isPlainRecord(key)) {
+    return `Dataset '${dataset.id}' delete keys must be plain objects.`;
+  }
+  const expectedColumns = new Set(primaryKeyColumns);
+  for (const columnName of Object.keys(key)) {
+    if (!expectedColumns.has(columnName)) {
+      return `Dataset '${dataset.id}' delete key contains unknown column '${columnName}'.`;
+    }
+  }
+  for (const columnName of primaryKeyColumns) {
+    if (!Object.hasOwn(key, columnName)) {
+      return `Dataset '${dataset.id}' delete key is missing primary-key column '${columnName}'.`;
+    }
+    if (typeof key[columnName] !== "string") {
+      return `Dataset '${dataset.id}' delete key column '${columnName}' must be a string.`;
+    }
+  }
+  return null;
+}
+
+export { LakeStorageError, LakeConcurrencyError, getDatasetPrimaryKeyColumns, encodeDatasetPrimaryKey, getDatasetMergeChangeValidationError, cloneDatasetMergeChange };
+
+//# debugId=0FE512D8DB52E81F64756E2164756E21

package/dist/chunk-n4khvw9n.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/lake-storage/errors.ts", "../src/lake-storage/merge-validation.ts"],
+  "sourcesContent": [
+    "/**\n * Error for lake-storage invariants and invalid lake operations.\n */\nexport class LakeStorageError extends Error {\n  readonly name: string = \"LakeStorageError\"\n}\n\n/** A known, uncommitted version/transaction conflict; safe to retry staged changes. */\nexport class LakeConcurrencyError extends LakeStorageError {\n  override readonly name = \"LakeConcurrencyError\"\n}\n",
+    "import type { DatasetDefinition, MergeChange } from \"../datasets\"\nimport { getDatasetRowValidationError } from \"../datasets\"\nimport { getDatasetSequenceValidationError } from \"../datasets/sequence\"\nimport { isPlainRecord } from \"../json\"\nimport { LakeStorageError } from \"./errors\"\nimport type { DatasetRow } from \"./types\"\n\n/** Return a new ordered primary-key column list, or `null` for an unkeyed dataset. */\nexport function getDatasetPrimaryKeyColumns(dataset: DatasetDefinition): readonly string[] | null {\n  if (dataset.primaryKey === undefined) {\n    return null\n  }\n  return typeof dataset.primaryKey === \"string\" ? [dataset.primaryKey] : [...dataset.primaryKey]\n}\n\n/** Collision-safe internal identity for a validated row or delete-key object. */\nexport function encodeDatasetPrimaryKey(dataset: DatasetDefinition, value: DatasetRow): string {\n  const columns = getDatasetPrimaryKeyColumns(dataset)\n  if (columns === null) {\n    throw new LakeStorageError(\n      `[SixbLake] Dataset '${dataset.id}' must define a primaryKey before rows can be keyed.`\n    )\n  }\n\n  const values = columns.map((columnName) => {\n    const columnValue = value[columnName]\n    if (typeof columnValue !== \"string\") {\n      throw new LakeStorageError(\n        `[SixbLake] Dataset '${dataset.id}' primary-key column '${columnName}' must be a string.`\n      )\n    }\n    return columnValue\n  })\n  return JSON.stringify(values)\n}\n\nexport function getDatasetMergeChangeValidationError(\n  change: unknown,\n  dataset: DatasetDefinition\n): string | null {\n  const primaryKeyColumns = getDatasetPrimaryKeyColumns(dataset)\n  if (primaryKeyColumns === null) {\n    return `Dataset '${dataset.id}' must define a primaryKey before it can be merged.`\n  }\n  if (!isPlainRecord(change)) {\n    return `Dataset '${dataset.id}' merge changes must be plain objects.`\n  }\n\n  if (change.kind === \"upsert\") {\n    const shapeError = getChangeShapeError(change, dataset, \"row\")\n    if (shapeError) {\n      return shapeError\n    }\n    return getDatasetRowValidationError(change.row, dataset)\n  }\n\n  if (change.kind === \"delete\") {\n    const shapeError = getChangeShapeError(change, dataset, \"key\")\n    if (shapeError) {\n      return shapeError\n    }\n    const keyError = getDeleteKeyValidationError(change.key, dataset, primaryKeyColumns)\n    if (keyError) return keyError\n    return dataset.sequenceBy === undefined\n      ? null\n      : getDatasetSequenceValidationError(dataset, change.sequence)\n  }\n\n  return `Dataset '${dataset.id}' merge change kind must be 'upsert' or 'delete'.`\n}\n\n/** Clone a validated change before a provider stages it beyond the caller's ownership. */\nexport function cloneDatasetMergeChange(\n  change: MergeChange<DatasetRow, DatasetRow>\n): MergeChange<DatasetRow, DatasetRow> {\n  return change.kind === \"upsert\"\n    ? { kind: \"upsert\", row: structuredClone(change.row) }\n    : {\n        kind: \"delete\",\n        key: structuredClone(change.key),\n        ...(change.sequence !== undefined ? { sequence: structuredClone(change.sequence) } : {}),\n      }\n}\n\nfunction getChangeShapeError(\n  change: Record<string, unknown>,\n  dataset: DatasetDefinition,\n  payloadField: \"row\" | \"key\"\n): string | null {\n  const allowedFields = new Set([\"kind\", payloadField])\n  if (payloadField === \"key\" && dataset.sequenceBy !== undefined) allowedFields.add(\"sequence\")\n  for (const field of Object.keys(change)) {\n    if (!allowedFields.has(field)) {\n      return `Dataset '${dataset.id}' ${change.kind as string} change contains unknown field '${field}'.`\n    }\n  }\n  if (!Object.hasOwn(change, payloadField)) {\n    return `Dataset '${dataset.id}' ${change.kind as string} change is missing '${payloadField}'.`\n  }\n  return null\n}\n\nfunction getDeleteKeyValidationError(\n  key: unknown,\n  dataset: DatasetDefinition,\n  primaryKeyColumns: readonly string[]\n): string | null {\n  if (!isPlainRecord(key)) {\n    return `Dataset '${dataset.id}' delete keys must be plain objects.`\n  }\n\n  const expectedColumns = new Set(primaryKeyColumns)\n  for (const columnName of Object.keys(key)) {\n    if (!expectedColumns.has(columnName)) {\n      return `Dataset '${dataset.id}' delete key contains unknown column '${columnName}'.`\n    }\n  }\n  for (const columnName of primaryKeyColumns) {\n    if (!Object.hasOwn(key, columnName)) {\n      return `Dataset '${dataset.id}' delete key is missing primary-key column '${columnName}'.`\n    }\n    if (typeof key[columnName] !== \"string\") {\n      return `Dataset '${dataset.id}' delete key column '${columnName}' must be a string.`\n    }\n  }\n  return null\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;AAGO,MAAM,yBAAyB,MAAM;AAAA,EACjC,OAAe;AAC1B;AAAA;AAGO,MAAM,6BAA6B,iBAAiB;AAAA,EACvC,OAAO;AAC3B;;;ACFO,SAAS,2BAA2B,CAAC,SAAsD;AAAA,EAChG,IAAI,QAAQ,eAAe,WAAW;AAAA,IACpC,OAAO;AAAA,EACT;AAAA,EACA,OAAO,OAAO,QAAQ,eAAe,WAAW,CAAC,QAAQ,UAAU,IAAI,CAAC,GAAG,QAAQ,UAAU;AAAA;AAIxF,SAAS,uBAAuB,CAAC,SAA4B,OAA2B;AAAA,EAC7F,MAAM,UAAU,4BAA4B,OAAO;AAAA,EACnD,IAAI,YAAY,MAAM;AAAA,IACpB,MAAM,IAAI,iBACR,uBAAuB,QAAQ,wDACjC;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,QAAQ,IAAI,CAAC,eAAe;AAAA,IACzC,MAAM,cAAc,MAAM;AAAA,IAC1B,IAAI,OAAO,gBAAgB,UAAU;AAAA,MACnC,MAAM,IAAI,iBACR,uBAAuB,QAAQ,2BAA2B,+BAC5D;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,OAAO,KAAK,UAAU,MAAM;AAAA;AAGvB,SAAS,oCAAoC,CAClD,QACA,SACe;AAAA,EACf,MAAM,oBAAoB,4BAA4B,OAAO;AAAA,EAC7D,IAAI,sBAAsB,MAAM;AAAA,IAC9B,OAAO,YAAY,QAAQ;AAAA,EAC7B;AAAA,EACA,IAAI,CAAC,cAAc,MAAM,GAAG;AAAA,IAC1B,OAAO,YAAY,QAAQ;AAAA,EAC7B;AAAA,EAEA,IAAI,OAAO,SAAS,UAAU;AAAA,IAC5B,MAAM,aAAa,oBAAoB,QAAQ,SAAS,KAAK;AAAA,IAC7D,IAAI,YAAY;AAAA,MACd,OAAO;AAAA,IACT;AAAA,IACA,OAAO,6BAA6B,OAAO,KAAK,OAAO;AAAA,EACzD;AAAA,EAEA,IAAI,OAAO,SAAS,UAAU;AAAA,IAC5B,MAAM,aAAa,oBAAoB,QAAQ,SAAS,KAAK;AAAA,IAC7D,IAAI,YAAY;AAAA,MACd,OAAO;AAAA,IACT;AAAA,IACA,MAAM,WAAW,4BAA4B,OAAO,KAAK,SAAS,iBAAiB;AAAA,IACnF,IAAI;AAAA,MAAU,OAAO;AAAA,IACrB,OAAO,QAAQ,eAAe,YAC1B,OACA,kCAAkC,SAAS,OAAO,QAAQ;AAAA,EAChE;AAAA,EAEA,OAAO,YAAY,QAAQ;AAAA;AAItB,SAAS,uBAAuB,CACrC,QACqC;AAAA,EACrC,OAAO,OAAO,SAAS,WACnB,EAAE,MAAM,UAAU,KAAK,gBAAgB,OAAO,GAAG,EAAE,IACnD;AAAA,IACE,MAAM;AAAA,IACN,KAAK,gBAAgB,OAAO,GAAG;AAAA,OAC3B,OAAO,aAAa,YAAY,EAAE,UAAU,gBAAgB,OAAO,QAAQ,EAAE,IAAI,CAAC;AAAA,EACxF;AAAA;AAGN,SAAS,mBAAmB,CAC1B,QACA,SACA,cACe;AAAA,EACf,MAAM,gBAAgB,IAAI,IAAI,CAAC,QAAQ,YAAY,CAAC;AAAA,EACpD,IAAI,iBAAiB,SAAS,QAAQ,eAAe;AAAA,IAAW,cAAc,IAAI,UAAU;AAAA,EAC5F,WAAW,SAAS,OAAO,KAAK,MAAM,GAAG;AAAA,IACvC,IAAI,CAAC,cAAc,IAAI,KAAK,GAAG;AAAA,MAC7B,OAAO,YAAY,QAAQ,OAAO,OAAO,uCAAiD;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,IAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,GAAG;AAAA,IACxC,OAAO,YAAY,QAAQ,OAAO,OAAO,2BAAqC;AAAA,EAChF;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,2BAA2B,CAClC,KACA,SACA,mBACe;AAAA,EACf,IAAI,CAAC,cAAc,GAAG,GAAG;AAAA,IACvB,OAAO,YAAY,QAAQ;AAAA,EAC7B;AAAA,EAEA,MAAM,kBAAkB,IAAI,IAAI,iBAAiB;AAAA,EACjD,WAAW,cAAc,OAAO,KAAK,GAAG,GAAG;AAAA,IACzC,IAAI,CAAC,gBAAgB,IAAI,UAAU,GAAG;AAAA,MACpC,OAAO,YAAY,QAAQ,2CAA2C;AAAA,IACxE;AAAA,EACF;AAAA,EACA,WAAW,cAAc,mBAAmB;AAAA,IAC1C,IAAI,CAAC,OAAO,OAAO,KAAK,UAAU,GAAG;AAAA,MACnC,OAAO,YAAY,QAAQ,iDAAiD;AAAA,IAC9E;AAAA,IACA,IAAI,OAAO,IAAI,gBAAgB,UAAU;AAAA,MACvC,OAAO,YAAY,QAAQ,0BAA0B;AAAA,IACvD;AAAA,EACF;AAAA,EACA,OAAO;AAAA;",
+  "debugId": "0FE512D8DB52E81F64756E2164756E21",
+  "names": []
+}

package/dist/{chunk-t8t39h7v.js → chunk-n6jxh8sw.js}

@@ -9,6 +9,14 @@ function assertJsonValue(value, label = "value") {
     throw new Error(`[Sixb] ${label} must be a JSON value; ${reason}`);
   }
 }
+function isJsonObject(value) {
+  return isPlainRecord(value) && isJsonValue(value);
+}
+function assertJsonObject(value, label = "value") {
+  assertJsonValue(value, label);
+  if (!isPlainRecord(value))
+    throw new Error(`[Sixb] ${label} must be a JSON object.`);
+}
 function cloneJsonValue(value, label = "value") {
   assertJsonValue(value, label);
   return JSON.parse(JSON.stringify(value));
@@ -104,6 +112,6 @@ function describeNonJsonValue(value) {
   return type;
 }
 
-export { isJsonValue, assertJsonValue, cloneJsonValue, stableJsonStringify, compareStrings, getInvalidJsonValueReason, isPlainRecord };
+export { isJsonValue, assertJsonValue, isJsonObject, assertJsonObject, cloneJsonValue, stableJsonStringify, compareStrings, getInvalidJsonValueReason, isPlainRecord };
 
-//# debugId=E0916AE00DB731CC64756E2164756E21
+//# debugId=DE3FF6E3579329D364756E2164756E21

package/dist/chunk-n6jxh8sw.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/json.ts"],
+  "sourcesContent": [
+    "export type JsonPrimitive = string | number | boolean | null\nexport type JsonObject = { [key: string]: JsonValue }\nexport type JsonArray = JsonValue[]\nexport type JsonValue = JsonPrimitive | JsonObject | JsonArray\n\n/** JSON-compatible input that also accepts readonly containers from typed application code. */\nexport type ReadonlyJsonObject = {\n  readonly [key: string]: ReadonlyJsonValue\n}\nexport type ReadonlyJsonArray = readonly ReadonlyJsonValue[]\nexport type ReadonlyJsonValue = JsonPrimitive | ReadonlyJsonObject | ReadonlyJsonArray\n\nexport function isJsonValue(value: unknown): value is JsonValue {\n  return getInvalidJsonValueReason(value) === undefined\n}\n\nexport function assertJsonValue(value: unknown, label = \"value\"): asserts value is JsonValue {\n  const reason = getInvalidJsonValueReason(value, label)\n  if (reason) {\n    throw new Error(`[Sixb] ${label} must be a JSON value; ${reason}`)\n  }\n}\n\nexport function isJsonObject(value: unknown): value is JsonObject {\n  return isPlainRecord(value) && isJsonValue(value)\n}\n\nexport function assertJsonObject(value: unknown, label = \"value\"): asserts value is JsonObject {\n  assertJsonValue(value, label)\n  if (!isPlainRecord(value)) throw new Error(`[Sixb] ${label} must be a JSON object.`)\n}\n\nexport function cloneJsonValue(value: ReadonlyJsonValue, label = \"value\"): JsonValue {\n  assertJsonValue(value, label)\n  return JSON.parse(JSON.stringify(value)) as JsonValue\n}\n\nexport function stableJsonStringify(value: unknown): string {\n  if (value === undefined) return \"undefined\"\n  if (value === null || typeof value !== \"object\") return JSON.stringify(value)\n  if (Array.isArray(value)) return `[${value.map(stableJsonStringify).join(\",\")}]`\n  return `{${Object.entries(value as Record<string, unknown>)\n    .sort(([left], [right]) => compareStrings(left, right))\n    .map(([key, entry]) => `${JSON.stringify(key)}:${stableJsonStringify(entry)}`)\n    .join(\",\")}}`\n}\n\nexport function compareStrings(left: string, right: string): number {\n  if (left < right) return -1\n  if (left > right) return 1\n  return 0\n}\n\nexport function getInvalidJsonValueReason(\n  value: unknown,\n  label = \"value\",\n  seen: Set<object> = new Set()\n): string | undefined {\n  if (value === null || typeof value === \"string\" || typeof value === \"boolean\") {\n    return undefined\n  }\n\n  if (typeof value === \"number\") {\n    return Number.isFinite(value) ? undefined : `${label} is not a finite number`\n  }\n\n  if (Array.isArray(value)) {\n    if (seen.has(value)) {\n      return `${label} contains a circular reference`\n    }\n\n    seen.add(value)\n    for (let index = 0; index < value.length; index += 1) {\n      if (!Object.hasOwn(value, index)) {\n        seen.delete(value)\n        return `${label}[${index}] is a sparse array slot`\n      }\n\n      const reason = getInvalidJsonValueReason(value[index], `${label}[${index}]`, seen)\n      if (reason) {\n        seen.delete(value)\n        return reason\n      }\n    }\n    seen.delete(value)\n    return undefined\n  }\n\n  if (isPlainRecord(value)) {\n    if (seen.has(value)) {\n      return `${label} contains a circular reference`\n    }\n\n    const symbolKeys = Object.getOwnPropertySymbols(value).filter((key) =>\n      Object.prototype.propertyIsEnumerable.call(value, key)\n    )\n    if (symbolKeys.length > 0) {\n      return `${label} has an enumerable symbol key`\n    }\n\n    seen.add(value)\n    for (const [key, entry] of Object.entries(value)) {\n      const reason = getInvalidJsonValueReason(entry, jsonChildPath(label, key), seen)\n      if (reason) {\n        seen.delete(value)\n        return reason\n      }\n    }\n    seen.delete(value)\n    return undefined\n  }\n\n  return `${label} is ${describeNonJsonValue(value)}`\n}\n\nexport function isPlainRecord(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    return false\n  }\n\n  const prototype = Object.getPrototypeOf(value)\n  return prototype === Object.prototype || prototype === null\n}\n\nfunction jsonChildPath(parent: string, key: string): string {\n  return /^[A-Za-z_$][\\w$]*$/.test(key) ? `${parent}.${key}` : `${parent}[${JSON.stringify(key)}]`\n}\n\nfunction describeNonJsonValue(value: unknown): string {\n  if (value === undefined) {\n    return \"undefined\"\n  }\n\n  if (value instanceof Date) {\n    return \"a Date\"\n  }\n\n  const type = typeof value\n  if (type === \"bigint\" || type === \"function\" || type === \"symbol\") {\n    return `a ${type}`\n  }\n\n  if (typeof value === \"object\" && value !== null) {\n    const name = value.constructor?.name\n    return name ? `a ${name}` : \"a non-plain object\"\n  }\n\n  return type\n}\n"
+  ],
+  "mappings": ";;AAYO,SAAS,WAAW,CAAC,OAAoC;AAAA,EAC9D,OAAO,0BAA0B,KAAK,MAAM;AAAA;AAGvC,SAAS,eAAe,CAAC,OAAgB,QAAQ,SAAqC;AAAA,EAC3F,MAAM,SAAS,0BAA0B,OAAO,KAAK;AAAA,EACrD,IAAI,QAAQ;AAAA,IACV,MAAM,IAAI,MAAM,UAAU,+BAA+B,QAAQ;AAAA,EACnE;AAAA;AAGK,SAAS,YAAY,CAAC,OAAqC;AAAA,EAChE,OAAO,cAAc,KAAK,KAAK,YAAY,KAAK;AAAA;AAG3C,SAAS,gBAAgB,CAAC,OAAgB,QAAQ,SAAsC;AAAA,EAC7F,gBAAgB,OAAO,KAAK;AAAA,EAC5B,IAAI,CAAC,cAAc,KAAK;AAAA,IAAG,MAAM,IAAI,MAAM,UAAU,8BAA8B;AAAA;AAG9E,SAAS,cAAc,CAAC,OAA0B,QAAQ,SAAoB;AAAA,EACnF,gBAAgB,OAAO,KAAK;AAAA,EAC5B,OAAO,KAAK,MAAM,KAAK,UAAU,KAAK,CAAC;AAAA;AAGlC,SAAS,mBAAmB,CAAC,OAAwB;AAAA,EAC1D,IAAI,UAAU;AAAA,IAAW,OAAO;AAAA,EAChC,IAAI,UAAU,QAAQ,OAAO,UAAU;AAAA,IAAU,OAAO,KAAK,UAAU,KAAK;AAAA,EAC5E,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO,IAAI,MAAM,IAAI,mBAAmB,EAAE,KAAK,GAAG;AAAA,EAC5E,OAAO,IAAI,OAAO,QAAQ,KAAgC,EACvD,KAAK,EAAE,QAAQ,WAAW,eAAe,MAAM,KAAK,CAAC,EACrD,IAAI,EAAE,KAAK,WAAW,GAAG,KAAK,UAAU,GAAG,KAAK,oBAAoB,KAAK,GAAG,EAC5E,KAAK,GAAG;AAAA;AAGN,SAAS,cAAc,CAAC,MAAc,OAAuB;AAAA,EAClE,IAAI,OAAO;AAAA,IAAO,OAAO;AAAA,EACzB,IAAI,OAAO;AAAA,IAAO,OAAO;AAAA,EACzB,OAAO;AAAA;AAGF,SAAS,yBAAyB,CACvC,OACA,QAAQ,SACR,OAAoB,IAAI,KACJ;AAAA,EACpB,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,UAAU,WAAW;AAAA,IAC7E;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,OAAO,OAAO,SAAS,KAAK,IAAI,YAAY,GAAG;AAAA,EACjD;AAAA,EAEA,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,IAAI,KAAK,IAAI,KAAK,GAAG;AAAA,MACnB,OAAO,GAAG;AAAA,IACZ;AAAA,IAEA,KAAK,IAAI,KAAK;AAAA,IACd,SAAS,QAAQ,EAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AAAA,MACpD,IAAI,CAAC,OAAO,OAAO,OAAO,KAAK,GAAG;AAAA,QAChC,KAAK,OAAO,KAAK;AAAA,QACjB,OAAO,GAAG,SAAS;AAAA,MACrB;AAAA,MAEA,MAAM,SAAS,0BAA0B,MAAM,QAAQ,GAAG,SAAS,UAAU,IAAI;AAAA,MACjF,IAAI,QAAQ;AAAA,QACV,KAAK,OAAO,KAAK;AAAA,QACjB,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,KAAK,OAAO,KAAK;AAAA,IACjB;AAAA,EACF;AAAA,EAEA,IAAI,cAAc,KAAK,GAAG;AAAA,IACxB,IAAI,KAAK,IAAI,KAAK,GAAG;AAAA,MACnB,OAAO,GAAG;AAAA,IACZ;AAAA,IAEA,MAAM,aAAa,OAAO,sBAAsB,KAAK,EAAE,OAAO,CAAC,QAC7D,OAAO,UAAU,qBAAqB,KAAK,OAAO,GAAG,CACvD;AAAA,IACA,IAAI,WAAW,SAAS,GAAG;AAAA,MACzB,OAAO,GAAG;AAAA,IACZ;AAAA,IAEA,KAAK,IAAI,KAAK;AAAA,IACd,YAAY,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;AAAA,MAChD,MAAM,SAAS,0BAA0B,OAAO,cAAc,OAAO,GAAG,GAAG,IAAI;AAAA,MAC/E,IAAI,QAAQ;AAAA,QACV,KAAK,OAAO,KAAK;AAAA,QACjB,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,KAAK,OAAO,KAAK;AAAA,IACjB;AAAA,EACF;AAAA,EAEA,OAAO,GAAG,YAAY,qBAAqB,KAAK;AAAA;AAG3C,SAAS,aAAa,CAAC,OAAkD;AAAA,EAC9E,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AAAA,IACvE,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,OAAO,eAAe,KAAK;AAAA,EAC7C,OAAO,cAAc,OAAO,aAAa,cAAc;AAAA;AAGzD,SAAS,aAAa,CAAC,QAAgB,KAAqB;AAAA,EAC1D,OAAO,qBAAqB,KAAK,GAAG,IAAI,GAAG,UAAU,QAAQ,GAAG,UAAU,KAAK,UAAU,GAAG;AAAA;AAG9F,SAAS,oBAAoB,CAAC,OAAwB;AAAA,EACpD,IAAI,UAAU,WAAW;AAAA,IACvB,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,iBAAiB,MAAM;AAAA,IACzB,OAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,OAAO;AAAA,EACpB,IAAI,SAAS,YAAY,SAAS,cAAc,SAAS,UAAU;AAAA,IACjE,OAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC/C,MAAM,OAAO,MAAM,aAAa;AAAA,IAChC,OAAO,OAAO,KAAK,SAAS;AAAA,EAC9B;AAAA,EAEA,OAAO;AAAA;",
+  "debugId": "DE3FF6E3579329D364756E2164756E21",
+  "names": []
+}

package/dist/chunk-nn0tekr1.js

@@ -0,0 +1,284 @@
+// @bun
+import {
+  findAgentRunExecution,
+  findPrimitiveRunExecution
+} from "./chunk-j1sbhm7p.js";
+import {
+  AuthStorageError,
+  SYSTEM_PRINCIPAL,
+  principalsEqual
+} from "./chunk-4sm0aznx.js";
+import {
+  agentServiceAccountId,
+  resolveAuthorizationContext
+} from "./chunk-p1x242ad.js";
+import {
+  createSixbError
+} from "./chunk-2xns679x.js";
+
+// src/agents/authority.ts
+async function ensureManagedAgentExecutionIdentity(input) {
+  const auth = requireAuthStorage(input.auth);
+  const id = agentServiceAccountId(input.actorId);
+  const now = new Date;
+  const loaded = await loadOrCreateAgentServiceAccount(auth, {
+    id,
+    projectId: input.projectId,
+    name: input.name,
+    description: input.description,
+    updatedAt: now
+  });
+  assertFrameworkManagedAgentServiceAccount(input.actorId, loaded);
+  assertActiveAgentServiceAccount(input.actorId, loaded);
+  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {
+    existing: loaded,
+    name: input.name,
+    description: input.description,
+    updatedAt: now
+  });
+  assertActiveAgentServiceAccount(input.actorId, serviceAccount);
+  const groupMemberships = requireDefinitionOwnedGroupMemberships(input.actorId, await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({
+    projectId: input.projectId,
+    serviceAccountId: id,
+    groupIds: input.groupIds,
+    source: "agent",
+    updatedAt: now
+  }));
+  return {
+    serviceAccount,
+    principal: { type: "serviceAccount", id },
+    groupMemberships
+  };
+}
+async function loadOrCreateAgentServiceAccount(auth, input) {
+  const existing = await auth.serviceAccounts.getById({
+    projectId: input.projectId,
+    id: input.id
+  });
+  if (existing)
+    return existing;
+  try {
+    return await auth.serviceAccounts.create({
+      id: input.id,
+      projectId: input.projectId,
+      name: input.name,
+      description: input.description,
+      status: "active",
+      createdByPrincipal: SYSTEM_PRINCIPAL,
+      createdAt: input.updatedAt,
+      updatedAt: input.updatedAt
+    });
+  } catch (error) {
+    if (!(error instanceof AuthStorageError) || error.code !== "duplicate_service_account") {
+      throw error;
+    }
+    const concurrent = await auth.serviceAccounts.getById({
+      projectId: input.projectId,
+      id: input.id
+    });
+    if (!concurrent)
+      throw error;
+    return concurrent;
+  }
+}
+function assertActiveAgentServiceAccount(actorId, serviceAccount) {
+  if (serviceAccount.status === "suspended") {
+    throw new Error(`[Sixb] Agent '${actorId}' service account '${serviceAccount.id}' is suspended.`);
+  }
+}
+function assertFrameworkManagedAgentServiceAccount(actorId, serviceAccount) {
+  if (serviceAccount.createdByPrincipal === undefined || !principalsEqual(serviceAccount.createdByPrincipal, SYSTEM_PRINCIPAL)) {
+    throw createSixbError("agent.execution_failed", `[Sixb] Agent '${actorId}' cannot use service account '${serviceAccount.id}' because it is not managed by Sixb.`, { details: { actorId, serviceAccountId: serviceAccount.id } });
+  }
+}
+function requireDefinitionOwnedGroupMemberships(actorId, memberships) {
+  const externalGroupIds = memberships.filter((membership) => membership.source !== "agent").map((membership) => membership.groupId);
+  if (externalGroupIds.length > 0) {
+    throw createSixbError("agent.execution_failed", `[Sixb] Agent '${actorId}' service account has group memberships not managed by its definition: ${externalGroupIds.join(", ")}.`, { details: { actorId, externalGroupIds } });
+  }
+  return memberships;
+}
+async function resolveAgentExecutionAuthorization(input) {
+  const auth = requireAuthStorage(input.auth);
+  const expectedId = agentServiceAccountId(input.actorId);
+  const principal = input.authorizationRef.type === "principal" ? input.authorizationRef.principal : null;
+  if (principal?.type !== "serviceAccount" || principal.id !== expectedId) {
+    throw new Error(`[Sixb] Agent '${input.actorId}' execution authority must reference service account '${expectedId}'.`);
+  }
+  const serviceAccount = await auth.serviceAccounts.getById({
+    projectId: input.projectId,
+    id: principal.id
+  });
+  if (!serviceAccount || serviceAccount.status !== "active") {
+    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`);
+  }
+  assertFrameworkManagedAgentServiceAccount(input.actorId, serviceAccount);
+  const groupMemberships = requireDefinitionOwnedGroupMemberships(input.actorId, await auth.serviceAccountGroupMemberships.listForServiceAccount({
+    projectId: input.projectId,
+    serviceAccountId: principal.id
+  }));
+  const identity = {
+    serviceAccount,
+    principal: { type: "serviceAccount", id: principal.id },
+    groupMemberships
+  };
+  return {
+    identity,
+    context: resolveAuthorizationContext({
+      principal: identity.principal,
+      groupIds: groupMemberships.map((membership) => membership.groupId),
+      roles: input.security.listResolvedRoles()
+    })
+  };
+}
+async function resolveInheritedAgentExecutionAuthorization(input) {
+  if (input.authorizationRef.type === "disabled")
+    return { type: "disabled" };
+  const ref = requireCredentialedUserAuthority(input.authorizationRef);
+  const auth = requireAuthStorage(input.auth);
+  const now = input.now ?? new Date;
+  const user = await requireActiveUser(auth, input.projectId, ref.principal.id);
+  const memberships = await auth.groupMemberships.listForUser({
+    projectId: input.projectId,
+    userId: user.id
+  });
+  const credential = await revalidateUserCredential({
+    auth,
+    projectId: input.projectId,
+    userId: user.id,
+    credential: ref.credential,
+    currentGroupIds: memberships.map((membership) => membership.groupId),
+    now
+  });
+  return {
+    type: "principal",
+    context: resolveAuthorizationContext({
+      principal: ref.principal,
+      groupIds: credential.groupIds,
+      roles: input.security.listResolvedRoles(),
+      ...credential.sessionId === undefined ? {} : { sessionId: credential.sessionId }
+    })
+  };
+}
+function requireCredentialedUserAuthority(ref) {
+  if (ref.type !== "principal" || ref.principal.type !== "user" || ref.credential === undefined) {
+    throw invalidInheritedAuthority("the durable reference is not a credentialed user");
+  }
+  return {
+    type: "principal",
+    principal: { type: "user", id: ref.principal.id },
+    credential: { type: ref.credential.type, id: ref.credential.id }
+  };
+}
+async function requireActiveUser(auth, projectId, userId) {
+  const user = await auth.users.getById({ projectId, id: userId });
+  if (!user || user.status !== "active") {
+    throw invalidInheritedAuthority(`user '${userId}' is not active`);
+  }
+  return user;
+}
+async function revalidateUserCredential(input) {
+  if (input.credential.type === "session") {
+    const session = await input.auth.sessions.getById({
+      projectId: input.projectId,
+      id: input.credential.id
+    });
+    if (!isUsableUserSession(session, input.userId, input.now)) {
+      throw invalidInheritedAuthority("the inherited session is no longer valid");
+    }
+    return { groupIds: input.currentGroupIds, sessionId: session.id };
+  }
+  const accessToken = await input.auth.accessTokens.getById({
+    projectId: input.projectId,
+    id: input.credential.id
+  });
+  if (!isUsableUserAccessToken(accessToken, input.userId, input.now)) {
+    throw invalidInheritedAuthority("the inherited access token is no longer valid");
+  }
+  if (accessToken.groupIds === undefined)
+    return { groupIds: input.currentGroupIds };
+  const allowedGroupIds = new Set(accessToken.groupIds);
+  return {
+    groupIds: input.currentGroupIds.filter((groupId) => allowedGroupIds.has(groupId))
+  };
+}
+function isUsableUserSession(session, userId, now) {
+  if (!session || session.userId !== userId || session.revokedAt !== undefined)
+    return false;
+  if (session.expiresAt.getTime() <= now.getTime())
+    return false;
+  return session.absoluteExpiresAt === undefined || session.absoluteExpiresAt.getTime() > now.getTime();
+}
+function isUsableUserAccessToken(token, userId, now) {
+  if (!token || token.subjectType !== "user" || token.subjectId !== userId)
+    return false;
+  return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime();
+}
+function invalidInheritedAuthority(reason) {
+  return createSixbError("agent.execution_failed", `[Sixb] The Agent execution cannot restore its inherited authority: ${reason}.`);
+}
+function requireAuthStorage(auth) {
+  if (!auth) {
+    throw new Error("[Sixb] Agent executions require auth storage.");
+  }
+  return auth;
+}
+async function updateAgentServiceAccountMetadata(auth, input) {
+  if (input.existing.name === input.name && input.existing.description === input.description) {
+    return input.existing;
+  }
+  return auth.serviceAccounts.update({
+    projectId: input.existing.projectId,
+    id: input.existing.id,
+    name: input.name,
+    description: input.description,
+    updatedAt: input.updatedAt
+  });
+}
+
+// src/storage/workflow-runs/errors.ts
+class WorkflowRunError extends Error {
+  name = "WorkflowRunError";
+}
+
+// src/storage/workflow-runs/provider.ts
+async function assertWorkflowRunExecution(input) {
+  const execution = await findPrimitiveRunExecution({
+    executions: input.executions,
+    projectId: input.projectId,
+    executionId: input.executionId,
+    primitive: { kind: "workflow", id: input.workflowId, runId: input.runId },
+    sourceTypes: ["execution", "schedule", "event"]
+  });
+  if (!execution) {
+    invalidExecution(input.executionId, input.runId);
+  }
+  if (execution.source.type === "schedule" || execution.source.type === "event") {
+    if (execution.requestedBy !== undefined) {
+      invalidExecution(input.executionId, input.runId);
+    }
+    return;
+  }
+  if (execution.source.type !== "execution") {
+    invalidExecution(input.executionId, input.runId);
+  }
+}
+async function assertWorkflowAgentNodeRunExecution(input) {
+  const execution = await findAgentRunExecution({
+    executions: input.executions,
+    projectId: input.projectId,
+    executionId: input.executionId,
+    runId: input.nodeRunId,
+    authority: { type: "managed", serviceAccountId: agentServiceAccountId(input.actorId) }
+  });
+  if (!execution || execution.source.type !== "execution" || execution.source.executionId !== input.workflowExecutionId) {
+    throw new WorkflowRunError(`[Sixb] Execution '${input.executionId}' does not authorize Workflow Agent-node run '${input.nodeRunId}'.`);
+  }
+}
+function invalidExecution(executionId, runId) {
+  throw new WorkflowRunError(`[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`);
+}
+
+export { WorkflowRunError, ensureManagedAgentExecutionIdentity, resolveAgentExecutionAuthorization, resolveInheritedAgentExecutionAuthorization, assertWorkflowRunExecution, assertWorkflowAgentNodeRunExecution };
+
+//# debugId=22475541B2F1C1A864756E2164756E21

package/dist/chunk-nn0tekr1.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/agents/authority.ts", "../src/storage/workflow-runs/errors.ts", "../src/storage/workflow-runs/provider.ts"],
+  "sourcesContent": [
+    "import { principalsEqual, SYSTEM_PRINCIPAL } from \"../auth\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport { resolveAuthorizationContext } from \"../authorization\"\nimport { createSixbError } from \"../errors/internal\"\nimport type { AuthorizablePrincipal, AuthorizationRef } from \"../execution\"\nimport type { SecurityDefinitionCatalog } from \"../security\"\nimport type {\n  AccessTokenRecord,\n  AuthStorage,\n  ServiceAccountGroupMembershipRecord,\n  ServiceAccountRecord,\n  SessionRecord,\n  UserRecord,\n} from \"../storage/auth\"\nimport { AuthStorageError } from \"../storage/auth\"\nimport { agentServiceAccountId } from \"./identity\"\n\nexport type AgentExecutionAuthorization =\n  | { readonly type: \"principal\"; readonly context: AuthorizationContext }\n  | { readonly type: \"disabled\" }\n\ntype UserCredentialRef = NonNullable<\n  Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n>\n\ninterface CredentialedUserAuthorizationRef {\n  readonly type: \"principal\"\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"user\" }>\n  readonly credential: UserCredentialRef\n}\n\nexport { agentServiceAccountId } from \"./identity\"\n\nexport interface AgentExecutionIdentity {\n  readonly serviceAccount: ServiceAccountRecord\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"serviceAccount\" }>\n  readonly groupMemberships: readonly ServiceAccountGroupMembershipRecord[]\n}\n\n/** Ensure a framework-managed Agent actor exists with exactly its declared group memberships. */\nexport async function ensureManagedAgentExecutionIdentity(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly name: string\n  readonly description: string\n  readonly groupIds: readonly string[]\n}): Promise<AgentExecutionIdentity> {\n  const auth = requireAuthStorage(input.auth)\n  const id = agentServiceAccountId(input.actorId)\n  const now = new Date()\n  const loaded = await loadOrCreateAgentServiceAccount(auth, {\n    id,\n    projectId: input.projectId,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertFrameworkManagedAgentServiceAccount(input.actorId, loaded)\n  assertActiveAgentServiceAccount(input.actorId, loaded)\n  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {\n    existing: loaded,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertActiveAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: id,\n      groupIds: input.groupIds,\n      source: \"agent\",\n      updatedAt: now,\n    })\n  )\n\n  return {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id },\n    groupMemberships,\n  }\n}\n\n/** Load the managed identity, recovering only the expected concurrent-create race. */\nasync function loadOrCreateAgentServiceAccount(\n  auth: AuthStorage,\n  input: {\n    readonly id: string\n    readonly projectId: string\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  const existing = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: input.id,\n  })\n  if (existing) return existing\n\n  try {\n    return await auth.serviceAccounts.create({\n      id: input.id,\n      projectId: input.projectId,\n      name: input.name,\n      description: input.description,\n      status: \"active\",\n      createdByPrincipal: SYSTEM_PRINCIPAL,\n      createdAt: input.updatedAt,\n      updatedAt: input.updatedAt,\n    })\n  } catch (error) {\n    if (!(error instanceof AuthStorageError) || error.code !== \"duplicate_service_account\") {\n      throw error\n    }\n    const concurrent = await auth.serviceAccounts.getById({\n      projectId: input.projectId,\n      id: input.id,\n    })\n    if (!concurrent) throw error\n    return concurrent\n  }\n}\n\nfunction assertActiveAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (serviceAccount.status === \"suspended\") {\n    throw new Error(\n      `[Sixb] Agent '${actorId}' service account '${serviceAccount.id}' is suspended.`\n    )\n  }\n}\n\nfunction assertFrameworkManagedAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (\n    serviceAccount.createdByPrincipal === undefined ||\n    !principalsEqual(serviceAccount.createdByPrincipal, SYSTEM_PRINCIPAL)\n  ) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' cannot use service account '${serviceAccount.id}' because it is not managed by Sixb.`,\n      { details: { actorId, serviceAccountId: serviceAccount.id } }\n    )\n  }\n}\n\nfunction requireDefinitionOwnedGroupMemberships(\n  actorId: string,\n  memberships: readonly ServiceAccountGroupMembershipRecord[]\n): readonly ServiceAccountGroupMembershipRecord[] {\n  const externalGroupIds = memberships\n    .filter((membership) => membership.source !== \"agent\")\n    .map((membership) => membership.groupId)\n  if (externalGroupIds.length > 0) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' service account has group memberships not managed by its definition: ${externalGroupIds.join(\", \")}.`,\n      { details: { actorId, externalGroupIds } }\n    )\n  }\n  return memberships\n}\n\n/** Resolve current grants for the service account referenced by a durable Agent execution. */\nexport async function resolveAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n}): Promise<{ readonly identity: AgentExecutionIdentity; readonly context: AuthorizationContext }> {\n  const auth = requireAuthStorage(input.auth)\n  const expectedId = agentServiceAccountId(input.actorId)\n  const principal =\n    input.authorizationRef.type === \"principal\" ? input.authorizationRef.principal : null\n  if (principal?.type !== \"serviceAccount\" || principal.id !== expectedId) {\n    throw new Error(\n      `[Sixb] Agent '${input.actorId}' execution authority must reference service account '${expectedId}'.`\n    )\n  }\n\n  const serviceAccount = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: principal.id,\n  })\n  if (!serviceAccount || serviceAccount.status !== \"active\") {\n    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`)\n  }\n  assertFrameworkManagedAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.listForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: principal.id,\n    })\n  )\n  const identity: AgentExecutionIdentity = {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id: principal.id },\n    groupMemberships,\n  }\n  return {\n    identity,\n    context: resolveAuthorizationContext({\n      principal: identity.principal,\n      groupIds: groupMemberships.map((membership) => membership.groupId),\n      roles: input.security.listResolvedRoles(),\n    }),\n  }\n}\n\n/** Revalidate the durable user authority inherited by a conversational or child Agent. */\nexport async function resolveInheritedAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n  readonly now?: Date\n}): Promise<AgentExecutionAuthorization> {\n  if (input.authorizationRef.type === \"disabled\") return { type: \"disabled\" }\n\n  const ref = requireCredentialedUserAuthority(input.authorizationRef)\n  const auth = requireAuthStorage(input.auth)\n  const now = input.now ?? new Date()\n  const user = await requireActiveUser(auth, input.projectId, ref.principal.id)\n  const memberships = await auth.groupMemberships.listForUser({\n    projectId: input.projectId,\n    userId: user.id,\n  })\n  const credential = await revalidateUserCredential({\n    auth,\n    projectId: input.projectId,\n    userId: user.id,\n    credential: ref.credential,\n    currentGroupIds: memberships.map((membership) => membership.groupId),\n    now,\n  })\n\n  return {\n    type: \"principal\",\n    context: resolveAuthorizationContext({\n      principal: ref.principal,\n      groupIds: credential.groupIds,\n      roles: input.security.listResolvedRoles(),\n      ...(credential.sessionId === undefined ? {} : { sessionId: credential.sessionId }),\n    }),\n  }\n}\n\nfunction requireCredentialedUserAuthority(ref: AuthorizationRef): CredentialedUserAuthorizationRef {\n  if (ref.type !== \"principal\" || ref.principal.type !== \"user\" || ref.credential === undefined) {\n    throw invalidInheritedAuthority(\"the durable reference is not a credentialed user\")\n  }\n  return {\n    type: \"principal\",\n    principal: { type: \"user\", id: ref.principal.id },\n    credential: { type: ref.credential.type, id: ref.credential.id },\n  }\n}\n\nasync function requireActiveUser(\n  auth: AuthStorage,\n  projectId: string,\n  userId: string\n): Promise<UserRecord> {\n  const user = await auth.users.getById({ projectId, id: userId })\n  if (!user || user.status !== \"active\") {\n    throw invalidInheritedAuthority(`user '${userId}' is not active`)\n  }\n  return user\n}\n\nasync function revalidateUserCredential(input: {\n  readonly auth: AuthStorage\n  readonly projectId: string\n  readonly userId: string\n  readonly credential: UserCredentialRef\n  readonly currentGroupIds: readonly string[]\n  readonly now: Date\n}): Promise<{ readonly groupIds: readonly string[]; readonly sessionId?: string }> {\n  if (input.credential.type === \"session\") {\n    const session = await input.auth.sessions.getById({\n      projectId: input.projectId,\n      id: input.credential.id,\n    })\n    if (!isUsableUserSession(session, input.userId, input.now)) {\n      throw invalidInheritedAuthority(\"the inherited session is no longer valid\")\n    }\n    return { groupIds: input.currentGroupIds, sessionId: session.id }\n  }\n\n  const accessToken = await input.auth.accessTokens.getById({\n    projectId: input.projectId,\n    id: input.credential.id,\n  })\n  if (!isUsableUserAccessToken(accessToken, input.userId, input.now)) {\n    throw invalidInheritedAuthority(\"the inherited access token is no longer valid\")\n  }\n  if (accessToken.groupIds === undefined) return { groupIds: input.currentGroupIds }\n\n  const allowedGroupIds = new Set(accessToken.groupIds)\n  return {\n    groupIds: input.currentGroupIds.filter((groupId) => allowedGroupIds.has(groupId)),\n  }\n}\n\nfunction isUsableUserSession(\n  session: SessionRecord | null,\n  userId: string,\n  now: Date\n): session is SessionRecord {\n  if (!session || session.userId !== userId || session.revokedAt !== undefined) return false\n  if (session.expiresAt.getTime() <= now.getTime()) return false\n  return (\n    session.absoluteExpiresAt === undefined || session.absoluteExpiresAt.getTime() > now.getTime()\n  )\n}\n\nfunction isUsableUserAccessToken(\n  token: AccessTokenRecord | null,\n  userId: string,\n  now: Date\n): token is AccessTokenRecord {\n  if (!token || token.subjectType !== \"user\" || token.subjectId !== userId) return false\n  return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime()\n}\n\nfunction invalidInheritedAuthority(reason: string): Error {\n  return createSixbError(\n    \"agent.execution_failed\",\n    `[Sixb] The Agent execution cannot restore its inherited authority: ${reason}.`\n  )\n}\n\nfunction requireAuthStorage(auth: AuthStorage | undefined): AuthStorage {\n  if (!auth) {\n    throw new Error(\"[Sixb] Agent executions require auth storage.\")\n  }\n  return auth\n}\n\nasync function updateAgentServiceAccountMetadata(\n  auth: AuthStorage,\n  input: {\n    readonly existing: ServiceAccountRecord\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  if (input.existing.name === input.name && input.existing.description === input.description) {\n    return input.existing\n  }\n  return auth.serviceAccounts.update({\n    projectId: input.existing.projectId,\n    id: input.existing.id,\n    name: input.name,\n    description: input.description,\n    updatedAt: input.updatedAt,\n  })\n}\n",
+    "/**\n * Base error for workflow-run storage operations.\n */\nexport class WorkflowRunError extends Error {\n  readonly name = \"WorkflowRunError\"\n}\n",
+    "import { agentServiceAccountId } from \"../../agents/authority\"\nimport type { ExecutionStorage } from \"../executions\"\nimport { findAgentRunExecution, findPrimitiveRunExecution } from \"../executions/run-link\"\nimport { WorkflowRunError } from \"./errors\"\n\n/** Validate the semantic link between a durable workflow run and its immutable execution. */\nexport async function assertWorkflowRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly runId: string\n  readonly workflowId: string\n}): Promise<void> {\n  const execution = await findPrimitiveRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    primitive: { kind: \"workflow\", id: input.workflowId, runId: input.runId },\n    sourceTypes: [\"execution\", \"schedule\", \"event\"],\n  })\n  if (!execution) {\n    invalidExecution(input.executionId, input.runId)\n  }\n\n  if (execution.source.type === \"schedule\" || execution.source.type === \"event\") {\n    if (execution.requestedBy !== undefined) {\n      invalidExecution(input.executionId, input.runId)\n    }\n    return\n  }\n\n  // ExecutionStorage already validates the immutable parent reference, correlation id, and\n  // requested-by propagation. This boundary only owns the workflow-specific source restriction.\n  if (execution.source.type !== \"execution\") {\n    invalidExecution(input.executionId, input.runId)\n  }\n}\n\n/** Validate the semantic link between a Workflow Agent-node run and its child execution. */\nexport async function assertWorkflowAgentNodeRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly nodeRunId: string\n  readonly actorId: string\n  readonly workflowExecutionId: string\n}): Promise<void> {\n  const execution = await findAgentRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    runId: input.nodeRunId,\n    authority: { type: \"managed\", serviceAccountId: agentServiceAccountId(input.actorId) },\n  })\n  if (\n    !execution ||\n    execution.source.type !== \"execution\" ||\n    execution.source.executionId !== input.workflowExecutionId\n  ) {\n    throw new WorkflowRunError(\n      `[Sixb] Execution '${input.executionId}' does not authorize Workflow Agent-node run '${input.nodeRunId}'.`\n    )\n  }\n}\n\nfunction invalidExecution(executionId: string, runId: string): never {\n  throw new WorkflowRunError(\n    `[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`\n  )\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;AAwCA,eAAsB,mCAAmC,CAAC,OAOtB;AAAA,EAClC,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,KAAK,sBAAsB,MAAM,OAAO;AAAA,EAC9C,MAAM,MAAM,IAAI;AAAA,EAChB,MAAM,SAAS,MAAM,gCAAgC,MAAM;AAAA,IACzD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,0CAA0C,MAAM,SAAS,MAAM;AAAA,EAC/D,gCAAgC,MAAM,SAAS,MAAM;AAAA,EACrD,MAAM,iBAAiB,MAAM,kCAAkC,MAAM;AAAA,IACnE,UAAU;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,gCAAgC,MAAM,SAAS,cAAc;AAAA,EAE7D,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,2BAA2B;AAAA,IACnE,WAAW,MAAM;AAAA,IACjB,kBAAkB;AAAA,IAClB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC,CACH;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,GAAG;AAAA,IACxC;AAAA,EACF;AAAA;AAIF,eAAe,+BAA+B,CAC5C,MACA,OAO+B;AAAA,EAC/B,MAAM,WAAW,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,IAAI;AAAA,IAAU,OAAO;AAAA,EAErB,IAAI;AAAA,IACF,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAAA,MACvC,IAAI,MAAM;AAAA,MACV,WAAW,MAAM;AAAA,MACjB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,QAAQ;AAAA,MACR,oBAAoB;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,EAAE,iBAAiB,qBAAqB,MAAM,SAAS,6BAA6B;AAAA,MACtF,MAAM;AAAA,IACR;AAAA,IACA,MAAM,aAAa,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM;AAAA,IACZ,CAAC;AAAA,IACD,IAAI,CAAC;AAAA,MAAY,MAAM;AAAA,IACvB,OAAO;AAAA;AAAA;AAIX,SAAS,+BAA+B,CACtC,SACA,gBACM;AAAA,EACN,IAAI,eAAe,WAAW,aAAa;AAAA,IACzC,MAAM,IAAI,MACR,iBAAiB,6BAA6B,eAAe,mBAC/D;AAAA,EACF;AAAA;AAGF,SAAS,yCAAyC,CAChD,SACA,gBACM;AAAA,EACN,IACE,eAAe,uBAAuB,aACtC,CAAC,gBAAgB,eAAe,oBAAoB,gBAAgB,GACpE;AAAA,IACA,MAAM,gBACJ,0BACA,iBAAiB,wCAAwC,eAAe,0CACxE,EAAE,SAAS,EAAE,SAAS,kBAAkB,eAAe,GAAG,EAAE,CAC9D;AAAA,EACF;AAAA;AAGF,SAAS,sCAAsC,CAC7C,SACA,aACgD;AAAA,EAChD,MAAM,mBAAmB,YACtB,OAAO,CAAC,eAAe,WAAW,WAAW,OAAO,EACpD,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,EACzC,IAAI,iBAAiB,SAAS,GAAG;AAAA,IAC/B,MAAM,gBACJ,0BACA,iBAAiB,iFAAiF,iBAAiB,KAAK,IAAI,MAC5H,EAAE,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAC3C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIT,eAAsB,kCAAkC,CAAC,OAM0C;AAAA,EACjG,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,aAAa,sBAAsB,MAAM,OAAO;AAAA,EACtD,MAAM,YACJ,MAAM,iBAAiB,SAAS,cAAc,MAAM,iBAAiB,YAAY;AAAA,EACnF,IAAI,WAAW,SAAS,oBAAoB,UAAU,OAAO,YAAY;AAAA,IACvE,MAAM,IAAI,MACR,iBAAiB,MAAM,gEAAgE,cACzF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,UAAU;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,CAAC,kBAAkB,eAAe,WAAW,UAAU;AAAA,IACzD,MAAM,IAAI,MAAM,iCAAiC,UAAU,oBAAoB;AAAA,EACjF;AAAA,EACA,0CAA0C,MAAM,SAAS,cAAc;AAAA,EAEvE,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,sBAAsB;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,kBAAkB,UAAU;AAAA,EAC9B,CAAC,CACH;AAAA,EACA,MAAM,WAAmC;AAAA,IACvC;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,IAAI,UAAU,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,4BAA4B;AAAA,MACnC,WAAW,SAAS;AAAA,MACpB,UAAU,iBAAiB,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,MACjE,OAAO,MAAM,SAAS,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA;AAIF,eAAsB,2CAA2C,CAAC,OAMzB;AAAA,EACvC,IAAI,MAAM,iBAAiB,SAAS;AAAA,IAAY,OAAO,EAAE,MAAM,WAAW;AAAA,EAE1E,MAAM,MAAM,iCAAiC,MAAM,gBAAgB;AAAA,EACnE,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,MAAM,MAAM,OAAO,IAAI;AAAA,EAC7B,MAAM,OAAO,MAAM,kBAAkB,MAAM,MAAM,WAAW,IAAI,UAAU,EAAE;AAAA,EAC5E,MAAM,cAAc,MAAM,KAAK,iBAAiB,YAAY;AAAA,IAC1D,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,EACf,CAAC;AAAA,EACD,MAAM,aAAa,MAAM,yBAAyB;AAAA,IAChD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,YAAY,IAAI;AAAA,IAChB,iBAAiB,YAAY,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,IACnE;AAAA,EACF,CAAC;AAAA,EAED,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,4BAA4B;AAAA,MACnC,WAAW,IAAI;AAAA,MACf,UAAU,WAAW;AAAA,MACrB,OAAO,MAAM,SAAS,kBAAkB;AAAA,SACpC,WAAW,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,WAAW,UAAU;AAAA,IAClF,CAAC;AAAA,EACH;AAAA;AAGF,SAAS,gCAAgC,CAAC,KAAyD;AAAA,EACjG,IAAI,IAAI,SAAS,eAAe,IAAI,UAAU,SAAS,UAAU,IAAI,eAAe,WAAW;AAAA,IAC7F,MAAM,0BAA0B,kDAAkD;AAAA,EACpF;AAAA,EACA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,EAAE,MAAM,QAAQ,IAAI,IAAI,UAAU,GAAG;AAAA,IAChD,YAAY,EAAE,MAAM,IAAI,WAAW,MAAM,IAAI,IAAI,WAAW,GAAG;AAAA,EACjE;AAAA;AAGF,eAAe,iBAAiB,CAC9B,MACA,WACA,QACqB;AAAA,EACrB,MAAM,OAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,WAAW,IAAI,OAAO,CAAC;AAAA,EAC/D,IAAI,CAAC,QAAQ,KAAK,WAAW,UAAU;AAAA,IACrC,MAAM,0BAA0B,SAAS,uBAAuB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,wBAAwB,CAAC,OAO2C;AAAA,EACjF,IAAI,MAAM,WAAW,SAAS,WAAW;AAAA,IACvC,MAAM,UAAU,MAAM,MAAM,KAAK,SAAS,QAAQ;AAAA,MAChD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM,WAAW;AAAA,IACvB,CAAC;AAAA,IACD,IAAI,CAAC,oBAAoB,SAAS,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,MAC1D,MAAM,0BAA0B,0CAA0C;AAAA,IAC5E;AAAA,IACA,OAAO,EAAE,UAAU,MAAM,iBAAiB,WAAW,QAAQ,GAAG;AAAA,EAClE;AAAA,EAEA,MAAM,cAAc,MAAM,MAAM,KAAK,aAAa,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM,WAAW;AAAA,EACvB,CAAC;AAAA,EACD,IAAI,CAAC,wBAAwB,aAAa,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,IAClE,MAAM,0BAA0B,+CAA+C;AAAA,EACjF;AAAA,EACA,IAAI,YAAY,aAAa;AAAA,IAAW,OAAO,EAAE,UAAU,MAAM,gBAAgB;AAAA,EAEjF,MAAM,kBAAkB,IAAI,IAAI,YAAY,QAAQ;AAAA,EACpD,OAAO;AAAA,IACL,UAAU,MAAM,gBAAgB,OAAO,CAAC,YAAY,gBAAgB,IAAI,OAAO,CAAC;AAAA,EAClF;AAAA;AAGF,SAAS,mBAAmB,CAC1B,SACA,QACA,KAC0B;AAAA,EAC1B,IAAI,CAAC,WAAW,QAAQ,WAAW,UAAU,QAAQ,cAAc;AAAA,IAAW,OAAO;AAAA,EACrF,IAAI,QAAQ,UAAU,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAAG,OAAO;AAAA,EACzD,OACE,QAAQ,sBAAsB,aAAa,QAAQ,kBAAkB,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAIjG,SAAS,uBAAuB,CAC9B,OACA,QACA,KAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,MAAM,gBAAgB,UAAU,MAAM,cAAc;AAAA,IAAQ,OAAO;AAAA,EACjF,OAAO,MAAM,cAAc,aAAa,MAAM,UAAU,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAGlF,SAAS,yBAAyB,CAAC,QAAuB;AAAA,EACxD,OAAO,gBACL,0BACA,sEAAsE,SACxE;AAAA;AAGF,SAAS,kBAAkB,CAAC,MAA4C;AAAA,EACtE,IAAI,CAAC,MAAM;AAAA,IACT,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,iCAAiC,CAC9C,MACA,OAM+B;AAAA,EAC/B,IAAI,MAAM,SAAS,SAAS,MAAM,QAAQ,MAAM,SAAS,gBAAgB,MAAM,aAAa;AAAA,IAC1F,OAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,KAAK,gBAAgB,OAAO;AAAA,IACjC,WAAW,MAAM,SAAS;AAAA,IAC1B,IAAI,MAAM,SAAS;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,EACnB,CAAC;AAAA;;;AC7WI,MAAM,yBAAyB,MAAM;AAAA,EACjC,OAAO;AAClB;;;ACCA,eAAsB,0BAA0B,CAAC,OAM/B;AAAA,EAChB,MAAM,YAAY,MAAM,0BAA0B;AAAA,IAChD,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,EAAE,MAAM,YAAY,IAAI,MAAM,YAAY,OAAO,MAAM,MAAM;AAAA,IACxE,aAAa,CAAC,aAAa,YAAY,OAAO;AAAA,EAChD,CAAC;AAAA,EACD,IAAI,CAAC,WAAW;AAAA,IACd,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA,EAEA,IAAI,UAAU,OAAO,SAAS,cAAc,UAAU,OAAO,SAAS,SAAS;AAAA,IAC7E,IAAI,UAAU,gBAAgB,WAAW;AAAA,MACvC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AAAA,EAIA,IAAI,UAAU,OAAO,SAAS,aAAa;AAAA,IACzC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA;AAIF,eAAsB,mCAAmC,CAAC,OAOxC;AAAA,EAChB,MAAM,YAAY,MAAM,sBAAsB;AAAA,IAC5C,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,OAAO,MAAM;AAAA,IACb,WAAW,EAAE,MAAM,WAAW,kBAAkB,sBAAsB,MAAM,OAAO,EAAE;AAAA,EACvF,CAAC;AAAA,EACD,IACE,CAAC,aACD,UAAU,OAAO,SAAS,eAC1B,UAAU,OAAO,gBAAgB,MAAM,qBACvC;AAAA,IACA,MAAM,IAAI,iBACR,qBAAqB,MAAM,4DAA4D,MAAM,aAC/F;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CAAC,aAAqB,OAAsB;AAAA,EACnE,MAAM,IAAI,iBACR,qBAAqB,iDAAiD,SACxE;AAAA;",
+  "debugId": "22475541B2F1C1A864756E2164756E21",
+  "names": []
+}