@sixb/core 0.1.7 → 0.1.8

package/dist/chunk-n4khvw9n.js

@@ -0,0 +1,111 @@
+// @bun
+import {
+  getDatasetRowValidationError,
+  getDatasetSequenceValidationError
+} from "./chunk-pc7ys28c.js";
+import {
+  isPlainRecord
+} from "./chunk-n6jxh8sw.js";
+
+// src/lake-storage/errors.ts
+class LakeStorageError extends Error {
+  name = "LakeStorageError";
+}
+
+class LakeConcurrencyError extends LakeStorageError {
+  name = "LakeConcurrencyError";
+}
+
+// src/lake-storage/merge-validation.ts
+function getDatasetPrimaryKeyColumns(dataset) {
+  if (dataset.primaryKey === undefined) {
+    return null;
+  }
+  return typeof dataset.primaryKey === "string" ? [dataset.primaryKey] : [...dataset.primaryKey];
+}
+function encodeDatasetPrimaryKey(dataset, value) {
+  const columns = getDatasetPrimaryKeyColumns(dataset);
+  if (columns === null) {
+    throw new LakeStorageError(`[SixbLake] Dataset '${dataset.id}' must define a primaryKey before rows can be keyed.`);
+  }
+  const values = columns.map((columnName) => {
+    const columnValue = value[columnName];
+    if (typeof columnValue !== "string") {
+      throw new LakeStorageError(`[SixbLake] Dataset '${dataset.id}' primary-key column '${columnName}' must be a string.`);
+    }
+    return columnValue;
+  });
+  return JSON.stringify(values);
+}
+function getDatasetMergeChangeValidationError(change, dataset) {
+  const primaryKeyColumns = getDatasetPrimaryKeyColumns(dataset);
+  if (primaryKeyColumns === null) {
+    return `Dataset '${dataset.id}' must define a primaryKey before it can be merged.`;
+  }
+  if (!isPlainRecord(change)) {
+    return `Dataset '${dataset.id}' merge changes must be plain objects.`;
+  }
+  if (change.kind === "upsert") {
+    const shapeError = getChangeShapeError(change, dataset, "row");
+    if (shapeError) {
+      return shapeError;
+    }
+    return getDatasetRowValidationError(change.row, dataset);
+  }
+  if (change.kind === "delete") {
+    const shapeError = getChangeShapeError(change, dataset, "key");
+    if (shapeError) {
+      return shapeError;
+    }
+    const keyError = getDeleteKeyValidationError(change.key, dataset, primaryKeyColumns);
+    if (keyError)
+      return keyError;
+    return dataset.sequenceBy === undefined ? null : getDatasetSequenceValidationError(dataset, change.sequence);
+  }
+  return `Dataset '${dataset.id}' merge change kind must be 'upsert' or 'delete'.`;
+}
+function cloneDatasetMergeChange(change) {
+  return change.kind === "upsert" ? { kind: "upsert", row: structuredClone(change.row) } : {
+    kind: "delete",
+    key: structuredClone(change.key),
+    ...change.sequence !== undefined ? { sequence: structuredClone(change.sequence) } : {}
+  };
+}
+function getChangeShapeError(change, dataset, payloadField) {
+  const allowedFields = new Set(["kind", payloadField]);
+  if (payloadField === "key" && dataset.sequenceBy !== undefined)
+    allowedFields.add("sequence");
+  for (const field of Object.keys(change)) {
+    if (!allowedFields.has(field)) {
+      return `Dataset '${dataset.id}' ${change.kind} change contains unknown field '${field}'.`;
+    }
+  }
+  if (!Object.hasOwn(change, payloadField)) {
+    return `Dataset '${dataset.id}' ${change.kind} change is missing '${payloadField}'.`;
+  }
+  return null;
+}
+function getDeleteKeyValidationError(key, dataset, primaryKeyColumns) {
+  if (!isPlainRecord(key)) {
+    return `Dataset '${dataset.id}' delete keys must be plain objects.`;
+  }
+  const expectedColumns = new Set(primaryKeyColumns);
+  for (const columnName of Object.keys(key)) {
+    if (!expectedColumns.has(columnName)) {
+      return `Dataset '${dataset.id}' delete key contains unknown column '${columnName}'.`;
+    }
+  }
+  for (const columnName of primaryKeyColumns) {
+    if (!Object.hasOwn(key, columnName)) {
+      return `Dataset '${dataset.id}' delete key is missing primary-key column '${columnName}'.`;
+    }
+    if (typeof key[columnName] !== "string") {
+      return `Dataset '${dataset.id}' delete key column '${columnName}' must be a string.`;
+    }
+  }
+  return null;
+}
+
+export { LakeStorageError, LakeConcurrencyError, getDatasetPrimaryKeyColumns, encodeDatasetPrimaryKey, getDatasetMergeChangeValidationError, cloneDatasetMergeChange };
+
+//# debugId=0FE512D8DB52E81F64756E2164756E21

package/dist/chunk-n4khvw9n.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/lake-storage/errors.ts", "../src/lake-storage/merge-validation.ts"],
+  "sourcesContent": [
+    "/**\n * Error for lake-storage invariants and invalid lake operations.\n */\nexport class LakeStorageError extends Error {\n  readonly name: string = \"LakeStorageError\"\n}\n\n/** A known, uncommitted version/transaction conflict; safe to retry staged changes. */\nexport class LakeConcurrencyError extends LakeStorageError {\n  override readonly name = \"LakeConcurrencyError\"\n}\n",
+    "import type { DatasetDefinition, MergeChange } from \"../datasets\"\nimport { getDatasetRowValidationError } from \"../datasets\"\nimport { getDatasetSequenceValidationError } from \"../datasets/sequence\"\nimport { isPlainRecord } from \"../json\"\nimport { LakeStorageError } from \"./errors\"\nimport type { DatasetRow } from \"./types\"\n\n/** Return a new ordered primary-key column list, or `null` for an unkeyed dataset. */\nexport function getDatasetPrimaryKeyColumns(dataset: DatasetDefinition): readonly string[] | null {\n  if (dataset.primaryKey === undefined) {\n    return null\n  }\n  return typeof dataset.primaryKey === \"string\" ? [dataset.primaryKey] : [...dataset.primaryKey]\n}\n\n/** Collision-safe internal identity for a validated row or delete-key object. */\nexport function encodeDatasetPrimaryKey(dataset: DatasetDefinition, value: DatasetRow): string {\n  const columns = getDatasetPrimaryKeyColumns(dataset)\n  if (columns === null) {\n    throw new LakeStorageError(\n      `[SixbLake] Dataset '${dataset.id}' must define a primaryKey before rows can be keyed.`\n    )\n  }\n\n  const values = columns.map((columnName) => {\n    const columnValue = value[columnName]\n    if (typeof columnValue !== \"string\") {\n      throw new LakeStorageError(\n        `[SixbLake] Dataset '${dataset.id}' primary-key column '${columnName}' must be a string.`\n      )\n    }\n    return columnValue\n  })\n  return JSON.stringify(values)\n}\n\nexport function getDatasetMergeChangeValidationError(\n  change: unknown,\n  dataset: DatasetDefinition\n): string | null {\n  const primaryKeyColumns = getDatasetPrimaryKeyColumns(dataset)\n  if (primaryKeyColumns === null) {\n    return `Dataset '${dataset.id}' must define a primaryKey before it can be merged.`\n  }\n  if (!isPlainRecord(change)) {\n    return `Dataset '${dataset.id}' merge changes must be plain objects.`\n  }\n\n  if (change.kind === \"upsert\") {\n    const shapeError = getChangeShapeError(change, dataset, \"row\")\n    if (shapeError) {\n      return shapeError\n    }\n    return getDatasetRowValidationError(change.row, dataset)\n  }\n\n  if (change.kind === \"delete\") {\n    const shapeError = getChangeShapeError(change, dataset, \"key\")\n    if (shapeError) {\n      return shapeError\n    }\n    const keyError = getDeleteKeyValidationError(change.key, dataset, primaryKeyColumns)\n    if (keyError) return keyError\n    return dataset.sequenceBy === undefined\n      ? null\n      : getDatasetSequenceValidationError(dataset, change.sequence)\n  }\n\n  return `Dataset '${dataset.id}' merge change kind must be 'upsert' or 'delete'.`\n}\n\n/** Clone a validated change before a provider stages it beyond the caller's ownership. */\nexport function cloneDatasetMergeChange(\n  change: MergeChange<DatasetRow, DatasetRow>\n): MergeChange<DatasetRow, DatasetRow> {\n  return change.kind === \"upsert\"\n    ? { kind: \"upsert\", row: structuredClone(change.row) }\n    : {\n        kind: \"delete\",\n        key: structuredClone(change.key),\n        ...(change.sequence !== undefined ? { sequence: structuredClone(change.sequence) } : {}),\n      }\n}\n\nfunction getChangeShapeError(\n  change: Record<string, unknown>,\n  dataset: DatasetDefinition,\n  payloadField: \"row\" | \"key\"\n): string | null {\n  const allowedFields = new Set([\"kind\", payloadField])\n  if (payloadField === \"key\" && dataset.sequenceBy !== undefined) allowedFields.add(\"sequence\")\n  for (const field of Object.keys(change)) {\n    if (!allowedFields.has(field)) {\n      return `Dataset '${dataset.id}' ${change.kind as string} change contains unknown field '${field}'.`\n    }\n  }\n  if (!Object.hasOwn(change, payloadField)) {\n    return `Dataset '${dataset.id}' ${change.kind as string} change is missing '${payloadField}'.`\n  }\n  return null\n}\n\nfunction getDeleteKeyValidationError(\n  key: unknown,\n  dataset: DatasetDefinition,\n  primaryKeyColumns: readonly string[]\n): string | null {\n  if (!isPlainRecord(key)) {\n    return `Dataset '${dataset.id}' delete keys must be plain objects.`\n  }\n\n  const expectedColumns = new Set(primaryKeyColumns)\n  for (const columnName of Object.keys(key)) {\n    if (!expectedColumns.has(columnName)) {\n      return `Dataset '${dataset.id}' delete key contains unknown column '${columnName}'.`\n    }\n  }\n  for (const columnName of primaryKeyColumns) {\n    if (!Object.hasOwn(key, columnName)) {\n      return `Dataset '${dataset.id}' delete key is missing primary-key column '${columnName}'.`\n    }\n    if (typeof key[columnName] !== \"string\") {\n      return `Dataset '${dataset.id}' delete key column '${columnName}' must be a string.`\n    }\n  }\n  return null\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;AAGO,MAAM,yBAAyB,MAAM;AAAA,EACjC,OAAe;AAC1B;AAAA;AAGO,MAAM,6BAA6B,iBAAiB;AAAA,EACvC,OAAO;AAC3B;;;ACFO,SAAS,2BAA2B,CAAC,SAAsD;AAAA,EAChG,IAAI,QAAQ,eAAe,WAAW;AAAA,IACpC,OAAO;AAAA,EACT;AAAA,EACA,OAAO,OAAO,QAAQ,eAAe,WAAW,CAAC,QAAQ,UAAU,IAAI,CAAC,GAAG,QAAQ,UAAU;AAAA;AAIxF,SAAS,uBAAuB,CAAC,SAA4B,OAA2B;AAAA,EAC7F,MAAM,UAAU,4BAA4B,OAAO;AAAA,EACnD,IAAI,YAAY,MAAM;AAAA,IACpB,MAAM,IAAI,iBACR,uBAAuB,QAAQ,wDACjC;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,QAAQ,IAAI,CAAC,eAAe;AAAA,IACzC,MAAM,cAAc,MAAM;AAAA,IAC1B,IAAI,OAAO,gBAAgB,UAAU;AAAA,MACnC,MAAM,IAAI,iBACR,uBAAuB,QAAQ,2BAA2B,+BAC5D;AAAA,IACF;AAAA,IACA,OAAO;AAAA,GACR;AAAA,EACD,OAAO,KAAK,UAAU,MAAM;AAAA;AAGvB,SAAS,oCAAoC,CAClD,QACA,SACe;AAAA,EACf,MAAM,oBAAoB,4BAA4B,OAAO;AAAA,EAC7D,IAAI,sBAAsB,MAAM;AAAA,IAC9B,OAAO,YAAY,QAAQ;AAAA,EAC7B;AAAA,EACA,IAAI,CAAC,cAAc,MAAM,GAAG;AAAA,IAC1B,OAAO,YAAY,QAAQ;AAAA,EAC7B;AAAA,EAEA,IAAI,OAAO,SAAS,UAAU;AAAA,IAC5B,MAAM,aAAa,oBAAoB,QAAQ,SAAS,KAAK;AAAA,IAC7D,IAAI,YAAY;AAAA,MACd,OAAO;AAAA,IACT;AAAA,IACA,OAAO,6BAA6B,OAAO,KAAK,OAAO;AAAA,EACzD;AAAA,EAEA,IAAI,OAAO,SAAS,UAAU;AAAA,IAC5B,MAAM,aAAa,oBAAoB,QAAQ,SAAS,KAAK;AAAA,IAC7D,IAAI,YAAY;AAAA,MACd,OAAO;AAAA,IACT;AAAA,IACA,MAAM,WAAW,4BAA4B,OAAO,KAAK,SAAS,iBAAiB;AAAA,IACnF,IAAI;AAAA,MAAU,OAAO;AAAA,IACrB,OAAO,QAAQ,eAAe,YAC1B,OACA,kCAAkC,SAAS,OAAO,QAAQ;AAAA,EAChE;AAAA,EAEA,OAAO,YAAY,QAAQ;AAAA;AAItB,SAAS,uBAAuB,CACrC,QACqC;AAAA,EACrC,OAAO,OAAO,SAAS,WACnB,EAAE,MAAM,UAAU,KAAK,gBAAgB,OAAO,GAAG,EAAE,IACnD;AAAA,IACE,MAAM;AAAA,IACN,KAAK,gBAAgB,OAAO,GAAG;AAAA,OAC3B,OAAO,aAAa,YAAY,EAAE,UAAU,gBAAgB,OAAO,QAAQ,EAAE,IAAI,CAAC;AAAA,EACxF;AAAA;AAGN,SAAS,mBAAmB,CAC1B,QACA,SACA,cACe;AAAA,EACf,MAAM,gBAAgB,IAAI,IAAI,CAAC,QAAQ,YAAY,CAAC;AAAA,EACpD,IAAI,iBAAiB,SAAS,QAAQ,eAAe;AAAA,IAAW,cAAc,IAAI,UAAU;AAAA,EAC5F,WAAW,SAAS,OAAO,KAAK,MAAM,GAAG;AAAA,IACvC,IAAI,CAAC,cAAc,IAAI,KAAK,GAAG;AAAA,MAC7B,OAAO,YAAY,QAAQ,OAAO,OAAO,uCAAiD;AAAA,IAC5F;AAAA,EACF;AAAA,EACA,IAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,GAAG;AAAA,IACxC,OAAO,YAAY,QAAQ,OAAO,OAAO,2BAAqC;AAAA,EAChF;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,2BAA2B,CAClC,KACA,SACA,mBACe;AAAA,EACf,IAAI,CAAC,cAAc,GAAG,GAAG;AAAA,IACvB,OAAO,YAAY,QAAQ;AAAA,EAC7B;AAAA,EAEA,MAAM,kBAAkB,IAAI,IAAI,iBAAiB;AAAA,EACjD,WAAW,cAAc,OAAO,KAAK,GAAG,GAAG;AAAA,IACzC,IAAI,CAAC,gBAAgB,IAAI,UAAU,GAAG;AAAA,MACpC,OAAO,YAAY,QAAQ,2CAA2C;AAAA,IACxE;AAAA,EACF;AAAA,EACA,WAAW,cAAc,mBAAmB;AAAA,IAC1C,IAAI,CAAC,OAAO,OAAO,KAAK,UAAU,GAAG;AAAA,MACnC,OAAO,YAAY,QAAQ,iDAAiD;AAAA,IAC9E;AAAA,IACA,IAAI,OAAO,IAAI,gBAAgB,UAAU;AAAA,MACvC,OAAO,YAAY,QAAQ,0BAA0B;AAAA,IACvD;AAAA,EACF;AAAA,EACA,OAAO;AAAA;",
+  "debugId": "0FE512D8DB52E81F64756E2164756E21",
+  "names": []
+}

package/dist/{chunk-qjzp9xyb.js → chunk-nn0tekr1.js}

@@ -2,23 +2,21 @@
 import {
   findAgentRunExecution,
   findPrimitiveRunExecution
-} from "./chunk-3kv70xwp.js";
+} from "./chunk-j1sbhm7p.js";
 import {
   AuthStorageError,
   SYSTEM_PRINCIPAL,
   principalsEqual
-} from "./chunk-rre42skh.js";
+} from "./chunk-4sm0aznx.js";
 import {
+  agentServiceAccountId,
   resolveAuthorizationContext
-} from "./chunk-37wk412q.js";
+} from "./chunk-p1x242ad.js";
 import {
   createSixbError
 } from "./chunk-2xns679x.js";
 
 // src/agents/authority.ts
-function agentServiceAccountId(actorId) {
-  return `svc_agent_${actorId}`;
-}
 async function ensureManagedAgentExecutionIdentity(input) {
   const auth = requireAuthStorage(input.auth);
   const id = agentServiceAccountId(input.actorId);
@@ -281,6 +279,6 @@ function invalidExecution(executionId, runId) {
   throw new WorkflowRunError(`[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`);
 }
 
-export { WorkflowRunError, agentServiceAccountId, ensureManagedAgentExecutionIdentity, resolveAgentExecutionAuthorization, resolveInheritedAgentExecutionAuthorization, assertWorkflowRunExecution, assertWorkflowAgentNodeRunExecution };
+export { WorkflowRunError, ensureManagedAgentExecutionIdentity, resolveAgentExecutionAuthorization, resolveInheritedAgentExecutionAuthorization, assertWorkflowRunExecution, assertWorkflowAgentNodeRunExecution };
 
-//# debugId=77624CF2336F235864756E2164756E21
+//# debugId=22475541B2F1C1A864756E2164756E21

package/dist/chunk-nn0tekr1.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/agents/authority.ts", "../src/storage/workflow-runs/errors.ts", "../src/storage/workflow-runs/provider.ts"],
+  "sourcesContent": [
+    "import { principalsEqual, SYSTEM_PRINCIPAL } from \"../auth\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport { resolveAuthorizationContext } from \"../authorization\"\nimport { createSixbError } from \"../errors/internal\"\nimport type { AuthorizablePrincipal, AuthorizationRef } from \"../execution\"\nimport type { SecurityDefinitionCatalog } from \"../security\"\nimport type {\n  AccessTokenRecord,\n  AuthStorage,\n  ServiceAccountGroupMembershipRecord,\n  ServiceAccountRecord,\n  SessionRecord,\n  UserRecord,\n} from \"../storage/auth\"\nimport { AuthStorageError } from \"../storage/auth\"\nimport { agentServiceAccountId } from \"./identity\"\n\nexport type AgentExecutionAuthorization =\n  | { readonly type: \"principal\"; readonly context: AuthorizationContext }\n  | { readonly type: \"disabled\" }\n\ntype UserCredentialRef = NonNullable<\n  Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n>\n\ninterface CredentialedUserAuthorizationRef {\n  readonly type: \"principal\"\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"user\" }>\n  readonly credential: UserCredentialRef\n}\n\nexport { agentServiceAccountId } from \"./identity\"\n\nexport interface AgentExecutionIdentity {\n  readonly serviceAccount: ServiceAccountRecord\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"serviceAccount\" }>\n  readonly groupMemberships: readonly ServiceAccountGroupMembershipRecord[]\n}\n\n/** Ensure a framework-managed Agent actor exists with exactly its declared group memberships. */\nexport async function ensureManagedAgentExecutionIdentity(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly name: string\n  readonly description: string\n  readonly groupIds: readonly string[]\n}): Promise<AgentExecutionIdentity> {\n  const auth = requireAuthStorage(input.auth)\n  const id = agentServiceAccountId(input.actorId)\n  const now = new Date()\n  const loaded = await loadOrCreateAgentServiceAccount(auth, {\n    id,\n    projectId: input.projectId,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertFrameworkManagedAgentServiceAccount(input.actorId, loaded)\n  assertActiveAgentServiceAccount(input.actorId, loaded)\n  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {\n    existing: loaded,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertActiveAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: id,\n      groupIds: input.groupIds,\n      source: \"agent\",\n      updatedAt: now,\n    })\n  )\n\n  return {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id },\n    groupMemberships,\n  }\n}\n\n/** Load the managed identity, recovering only the expected concurrent-create race. */\nasync function loadOrCreateAgentServiceAccount(\n  auth: AuthStorage,\n  input: {\n    readonly id: string\n    readonly projectId: string\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  const existing = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: input.id,\n  })\n  if (existing) return existing\n\n  try {\n    return await auth.serviceAccounts.create({\n      id: input.id,\n      projectId: input.projectId,\n      name: input.name,\n      description: input.description,\n      status: \"active\",\n      createdByPrincipal: SYSTEM_PRINCIPAL,\n      createdAt: input.updatedAt,\n      updatedAt: input.updatedAt,\n    })\n  } catch (error) {\n    if (!(error instanceof AuthStorageError) || error.code !== \"duplicate_service_account\") {\n      throw error\n    }\n    const concurrent = await auth.serviceAccounts.getById({\n      projectId: input.projectId,\n      id: input.id,\n    })\n    if (!concurrent) throw error\n    return concurrent\n  }\n}\n\nfunction assertActiveAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (serviceAccount.status === \"suspended\") {\n    throw new Error(\n      `[Sixb] Agent '${actorId}' service account '${serviceAccount.id}' is suspended.`\n    )\n  }\n}\n\nfunction assertFrameworkManagedAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (\n    serviceAccount.createdByPrincipal === undefined ||\n    !principalsEqual(serviceAccount.createdByPrincipal, SYSTEM_PRINCIPAL)\n  ) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' cannot use service account '${serviceAccount.id}' because it is not managed by Sixb.`,\n      { details: { actorId, serviceAccountId: serviceAccount.id } }\n    )\n  }\n}\n\nfunction requireDefinitionOwnedGroupMemberships(\n  actorId: string,\n  memberships: readonly ServiceAccountGroupMembershipRecord[]\n): readonly ServiceAccountGroupMembershipRecord[] {\n  const externalGroupIds = memberships\n    .filter((membership) => membership.source !== \"agent\")\n    .map((membership) => membership.groupId)\n  if (externalGroupIds.length > 0) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' service account has group memberships not managed by its definition: ${externalGroupIds.join(\", \")}.`,\n      { details: { actorId, externalGroupIds } }\n    )\n  }\n  return memberships\n}\n\n/** Resolve current grants for the service account referenced by a durable Agent execution. */\nexport async function resolveAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n}): Promise<{ readonly identity: AgentExecutionIdentity; readonly context: AuthorizationContext }> {\n  const auth = requireAuthStorage(input.auth)\n  const expectedId = agentServiceAccountId(input.actorId)\n  const principal =\n    input.authorizationRef.type === \"principal\" ? input.authorizationRef.principal : null\n  if (principal?.type !== \"serviceAccount\" || principal.id !== expectedId) {\n    throw new Error(\n      `[Sixb] Agent '${input.actorId}' execution authority must reference service account '${expectedId}'.`\n    )\n  }\n\n  const serviceAccount = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: principal.id,\n  })\n  if (!serviceAccount || serviceAccount.status !== \"active\") {\n    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`)\n  }\n  assertFrameworkManagedAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.listForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: principal.id,\n    })\n  )\n  const identity: AgentExecutionIdentity = {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id: principal.id },\n    groupMemberships,\n  }\n  return {\n    identity,\n    context: resolveAuthorizationContext({\n      principal: identity.principal,\n      groupIds: groupMemberships.map((membership) => membership.groupId),\n      roles: input.security.listResolvedRoles(),\n    }),\n  }\n}\n\n/** Revalidate the durable user authority inherited by a conversational or child Agent. */\nexport async function resolveInheritedAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n  readonly now?: Date\n}): Promise<AgentExecutionAuthorization> {\n  if (input.authorizationRef.type === \"disabled\") return { type: \"disabled\" }\n\n  const ref = requireCredentialedUserAuthority(input.authorizationRef)\n  const auth = requireAuthStorage(input.auth)\n  const now = input.now ?? new Date()\n  const user = await requireActiveUser(auth, input.projectId, ref.principal.id)\n  const memberships = await auth.groupMemberships.listForUser({\n    projectId: input.projectId,\n    userId: user.id,\n  })\n  const credential = await revalidateUserCredential({\n    auth,\n    projectId: input.projectId,\n    userId: user.id,\n    credential: ref.credential,\n    currentGroupIds: memberships.map((membership) => membership.groupId),\n    now,\n  })\n\n  return {\n    type: \"principal\",\n    context: resolveAuthorizationContext({\n      principal: ref.principal,\n      groupIds: credential.groupIds,\n      roles: input.security.listResolvedRoles(),\n      ...(credential.sessionId === undefined ? {} : { sessionId: credential.sessionId }),\n    }),\n  }\n}\n\nfunction requireCredentialedUserAuthority(ref: AuthorizationRef): CredentialedUserAuthorizationRef {\n  if (ref.type !== \"principal\" || ref.principal.type !== \"user\" || ref.credential === undefined) {\n    throw invalidInheritedAuthority(\"the durable reference is not a credentialed user\")\n  }\n  return {\n    type: \"principal\",\n    principal: { type: \"user\", id: ref.principal.id },\n    credential: { type: ref.credential.type, id: ref.credential.id },\n  }\n}\n\nasync function requireActiveUser(\n  auth: AuthStorage,\n  projectId: string,\n  userId: string\n): Promise<UserRecord> {\n  const user = await auth.users.getById({ projectId, id: userId })\n  if (!user || user.status !== \"active\") {\n    throw invalidInheritedAuthority(`user '${userId}' is not active`)\n  }\n  return user\n}\n\nasync function revalidateUserCredential(input: {\n  readonly auth: AuthStorage\n  readonly projectId: string\n  readonly userId: string\n  readonly credential: UserCredentialRef\n  readonly currentGroupIds: readonly string[]\n  readonly now: Date\n}): Promise<{ readonly groupIds: readonly string[]; readonly sessionId?: string }> {\n  if (input.credential.type === \"session\") {\n    const session = await input.auth.sessions.getById({\n      projectId: input.projectId,\n      id: input.credential.id,\n    })\n    if (!isUsableUserSession(session, input.userId, input.now)) {\n      throw invalidInheritedAuthority(\"the inherited session is no longer valid\")\n    }\n    return { groupIds: input.currentGroupIds, sessionId: session.id }\n  }\n\n  const accessToken = await input.auth.accessTokens.getById({\n    projectId: input.projectId,\n    id: input.credential.id,\n  })\n  if (!isUsableUserAccessToken(accessToken, input.userId, input.now)) {\n    throw invalidInheritedAuthority(\"the inherited access token is no longer valid\")\n  }\n  if (accessToken.groupIds === undefined) return { groupIds: input.currentGroupIds }\n\n  const allowedGroupIds = new Set(accessToken.groupIds)\n  return {\n    groupIds: input.currentGroupIds.filter((groupId) => allowedGroupIds.has(groupId)),\n  }\n}\n\nfunction isUsableUserSession(\n  session: SessionRecord | null,\n  userId: string,\n  now: Date\n): session is SessionRecord {\n  if (!session || session.userId !== userId || session.revokedAt !== undefined) return false\n  if (session.expiresAt.getTime() <= now.getTime()) return false\n  return (\n    session.absoluteExpiresAt === undefined || session.absoluteExpiresAt.getTime() > now.getTime()\n  )\n}\n\nfunction isUsableUserAccessToken(\n  token: AccessTokenRecord | null,\n  userId: string,\n  now: Date\n): token is AccessTokenRecord {\n  if (!token || token.subjectType !== \"user\" || token.subjectId !== userId) return false\n  return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime()\n}\n\nfunction invalidInheritedAuthority(reason: string): Error {\n  return createSixbError(\n    \"agent.execution_failed\",\n    `[Sixb] The Agent execution cannot restore its inherited authority: ${reason}.`\n  )\n}\n\nfunction requireAuthStorage(auth: AuthStorage | undefined): AuthStorage {\n  if (!auth) {\n    throw new Error(\"[Sixb] Agent executions require auth storage.\")\n  }\n  return auth\n}\n\nasync function updateAgentServiceAccountMetadata(\n  auth: AuthStorage,\n  input: {\n    readonly existing: ServiceAccountRecord\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  if (input.existing.name === input.name && input.existing.description === input.description) {\n    return input.existing\n  }\n  return auth.serviceAccounts.update({\n    projectId: input.existing.projectId,\n    id: input.existing.id,\n    name: input.name,\n    description: input.description,\n    updatedAt: input.updatedAt,\n  })\n}\n",
+    "/**\n * Base error for workflow-run storage operations.\n */\nexport class WorkflowRunError extends Error {\n  readonly name = \"WorkflowRunError\"\n}\n",
+    "import { agentServiceAccountId } from \"../../agents/authority\"\nimport type { ExecutionStorage } from \"../executions\"\nimport { findAgentRunExecution, findPrimitiveRunExecution } from \"../executions/run-link\"\nimport { WorkflowRunError } from \"./errors\"\n\n/** Validate the semantic link between a durable workflow run and its immutable execution. */\nexport async function assertWorkflowRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly runId: string\n  readonly workflowId: string\n}): Promise<void> {\n  const execution = await findPrimitiveRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    primitive: { kind: \"workflow\", id: input.workflowId, runId: input.runId },\n    sourceTypes: [\"execution\", \"schedule\", \"event\"],\n  })\n  if (!execution) {\n    invalidExecution(input.executionId, input.runId)\n  }\n\n  if (execution.source.type === \"schedule\" || execution.source.type === \"event\") {\n    if (execution.requestedBy !== undefined) {\n      invalidExecution(input.executionId, input.runId)\n    }\n    return\n  }\n\n  // ExecutionStorage already validates the immutable parent reference, correlation id, and\n  // requested-by propagation. This boundary only owns the workflow-specific source restriction.\n  if (execution.source.type !== \"execution\") {\n    invalidExecution(input.executionId, input.runId)\n  }\n}\n\n/** Validate the semantic link between a Workflow Agent-node run and its child execution. */\nexport async function assertWorkflowAgentNodeRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly nodeRunId: string\n  readonly actorId: string\n  readonly workflowExecutionId: string\n}): Promise<void> {\n  const execution = await findAgentRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    runId: input.nodeRunId,\n    authority: { type: \"managed\", serviceAccountId: agentServiceAccountId(input.actorId) },\n  })\n  if (\n    !execution ||\n    execution.source.type !== \"execution\" ||\n    execution.source.executionId !== input.workflowExecutionId\n  ) {\n    throw new WorkflowRunError(\n      `[Sixb] Execution '${input.executionId}' does not authorize Workflow Agent-node run '${input.nodeRunId}'.`\n    )\n  }\n}\n\nfunction invalidExecution(executionId: string, runId: string): never {\n  throw new WorkflowRunError(\n    `[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`\n  )\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;AAwCA,eAAsB,mCAAmC,CAAC,OAOtB;AAAA,EAClC,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,KAAK,sBAAsB,MAAM,OAAO;AAAA,EAC9C,MAAM,MAAM,IAAI;AAAA,EAChB,MAAM,SAAS,MAAM,gCAAgC,MAAM;AAAA,IACzD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,0CAA0C,MAAM,SAAS,MAAM;AAAA,EAC/D,gCAAgC,MAAM,SAAS,MAAM;AAAA,EACrD,MAAM,iBAAiB,MAAM,kCAAkC,MAAM;AAAA,IACnE,UAAU;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,gCAAgC,MAAM,SAAS,cAAc;AAAA,EAE7D,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,2BAA2B;AAAA,IACnE,WAAW,MAAM;AAAA,IACjB,kBAAkB;AAAA,IAClB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC,CACH;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,GAAG;AAAA,IACxC;AAAA,EACF;AAAA;AAIF,eAAe,+BAA+B,CAC5C,MACA,OAO+B;AAAA,EAC/B,MAAM,WAAW,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,IAAI;AAAA,IAAU,OAAO;AAAA,EAErB,IAAI;AAAA,IACF,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAAA,MACvC,IAAI,MAAM;AAAA,MACV,WAAW,MAAM;AAAA,MACjB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,QAAQ;AAAA,MACR,oBAAoB;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,EAAE,iBAAiB,qBAAqB,MAAM,SAAS,6BAA6B;AAAA,MACtF,MAAM;AAAA,IACR;AAAA,IACA,MAAM,aAAa,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM;AAAA,IACZ,CAAC;AAAA,IACD,IAAI,CAAC;AAAA,MAAY,MAAM;AAAA,IACvB,OAAO;AAAA;AAAA;AAIX,SAAS,+BAA+B,CACtC,SACA,gBACM;AAAA,EACN,IAAI,eAAe,WAAW,aAAa;AAAA,IACzC,MAAM,IAAI,MACR,iBAAiB,6BAA6B,eAAe,mBAC/D;AAAA,EACF;AAAA;AAGF,SAAS,yCAAyC,CAChD,SACA,gBACM;AAAA,EACN,IACE,eAAe,uBAAuB,aACtC,CAAC,gBAAgB,eAAe,oBAAoB,gBAAgB,GACpE;AAAA,IACA,MAAM,gBACJ,0BACA,iBAAiB,wCAAwC,eAAe,0CACxE,EAAE,SAAS,EAAE,SAAS,kBAAkB,eAAe,GAAG,EAAE,CAC9D;AAAA,EACF;AAAA;AAGF,SAAS,sCAAsC,CAC7C,SACA,aACgD;AAAA,EAChD,MAAM,mBAAmB,YACtB,OAAO,CAAC,eAAe,WAAW,WAAW,OAAO,EACpD,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,EACzC,IAAI,iBAAiB,SAAS,GAAG;AAAA,IAC/B,MAAM,gBACJ,0BACA,iBAAiB,iFAAiF,iBAAiB,KAAK,IAAI,MAC5H,EAAE,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAC3C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIT,eAAsB,kCAAkC,CAAC,OAM0C;AAAA,EACjG,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,aAAa,sBAAsB,MAAM,OAAO;AAAA,EACtD,MAAM,YACJ,MAAM,iBAAiB,SAAS,cAAc,MAAM,iBAAiB,YAAY;AAAA,EACnF,IAAI,WAAW,SAAS,oBAAoB,UAAU,OAAO,YAAY;AAAA,IACvE,MAAM,IAAI,MACR,iBAAiB,MAAM,gEAAgE,cACzF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,UAAU;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,CAAC,kBAAkB,eAAe,WAAW,UAAU;AAAA,IACzD,MAAM,IAAI,MAAM,iCAAiC,UAAU,oBAAoB;AAAA,EACjF;AAAA,EACA,0CAA0C,MAAM,SAAS,cAAc;AAAA,EAEvE,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,sBAAsB;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,kBAAkB,UAAU;AAAA,EAC9B,CAAC,CACH;AAAA,EACA,MAAM,WAAmC;AAAA,IACvC;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,IAAI,UAAU,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,4BAA4B;AAAA,MACnC,WAAW,SAAS;AAAA,MACpB,UAAU,iBAAiB,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,MACjE,OAAO,MAAM,SAAS,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA;AAIF,eAAsB,2CAA2C,CAAC,OAMzB;AAAA,EACvC,IAAI,MAAM,iBAAiB,SAAS;AAAA,IAAY,OAAO,EAAE,MAAM,WAAW;AAAA,EAE1E,MAAM,MAAM,iCAAiC,MAAM,gBAAgB;AAAA,EACnE,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,MAAM,MAAM,OAAO,IAAI;AAAA,EAC7B,MAAM,OAAO,MAAM,kBAAkB,MAAM,MAAM,WAAW,IAAI,UAAU,EAAE;AAAA,EAC5E,MAAM,cAAc,MAAM,KAAK,iBAAiB,YAAY;AAAA,IAC1D,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,EACf,CAAC;AAAA,EACD,MAAM,aAAa,MAAM,yBAAyB;AAAA,IAChD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,YAAY,IAAI;AAAA,IAChB,iBAAiB,YAAY,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,IACnE;AAAA,EACF,CAAC;AAAA,EAED,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,4BAA4B;AAAA,MACnC,WAAW,IAAI;AAAA,MACf,UAAU,WAAW;AAAA,MACrB,OAAO,MAAM,SAAS,kBAAkB;AAAA,SACpC,WAAW,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,WAAW,UAAU;AAAA,IAClF,CAAC;AAAA,EACH;AAAA;AAGF,SAAS,gCAAgC,CAAC,KAAyD;AAAA,EACjG,IAAI,IAAI,SAAS,eAAe,IAAI,UAAU,SAAS,UAAU,IAAI,eAAe,WAAW;AAAA,IAC7F,MAAM,0BAA0B,kDAAkD;AAAA,EACpF;AAAA,EACA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,EAAE,MAAM,QAAQ,IAAI,IAAI,UAAU,GAAG;AAAA,IAChD,YAAY,EAAE,MAAM,IAAI,WAAW,MAAM,IAAI,IAAI,WAAW,GAAG;AAAA,EACjE;AAAA;AAGF,eAAe,iBAAiB,CAC9B,MACA,WACA,QACqB;AAAA,EACrB,MAAM,OAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,WAAW,IAAI,OAAO,CAAC;AAAA,EAC/D,IAAI,CAAC,QAAQ,KAAK,WAAW,UAAU;AAAA,IACrC,MAAM,0BAA0B,SAAS,uBAAuB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,wBAAwB,CAAC,OAO2C;AAAA,EACjF,IAAI,MAAM,WAAW,SAAS,WAAW;AAAA,IACvC,MAAM,UAAU,MAAM,MAAM,KAAK,SAAS,QAAQ;AAAA,MAChD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM,WAAW;AAAA,IACvB,CAAC;AAAA,IACD,IAAI,CAAC,oBAAoB,SAAS,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,MAC1D,MAAM,0BAA0B,0CAA0C;AAAA,IAC5E;AAAA,IACA,OAAO,EAAE,UAAU,MAAM,iBAAiB,WAAW,QAAQ,GAAG;AAAA,EAClE;AAAA,EAEA,MAAM,cAAc,MAAM,MAAM,KAAK,aAAa,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM,WAAW;AAAA,EACvB,CAAC;AAAA,EACD,IAAI,CAAC,wBAAwB,aAAa,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,IAClE,MAAM,0BAA0B,+CAA+C;AAAA,EACjF;AAAA,EACA,IAAI,YAAY,aAAa;AAAA,IAAW,OAAO,EAAE,UAAU,MAAM,gBAAgB;AAAA,EAEjF,MAAM,kBAAkB,IAAI,IAAI,YAAY,QAAQ;AAAA,EACpD,OAAO;AAAA,IACL,UAAU,MAAM,gBAAgB,OAAO,CAAC,YAAY,gBAAgB,IAAI,OAAO,CAAC;AAAA,EAClF;AAAA;AAGF,SAAS,mBAAmB,CAC1B,SACA,QACA,KAC0B;AAAA,EAC1B,IAAI,CAAC,WAAW,QAAQ,WAAW,UAAU,QAAQ,cAAc;AAAA,IAAW,OAAO;AAAA,EACrF,IAAI,QAAQ,UAAU,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAAG,OAAO;AAAA,EACzD,OACE,QAAQ,sBAAsB,aAAa,QAAQ,kBAAkB,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAIjG,SAAS,uBAAuB,CAC9B,OACA,QACA,KAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,MAAM,gBAAgB,UAAU,MAAM,cAAc;AAAA,IAAQ,OAAO;AAAA,EACjF,OAAO,MAAM,cAAc,aAAa,MAAM,UAAU,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAGlF,SAAS,yBAAyB,CAAC,QAAuB;AAAA,EACxD,OAAO,gBACL,0BACA,sEAAsE,SACxE;AAAA;AAGF,SAAS,kBAAkB,CAAC,MAA4C;AAAA,EACtE,IAAI,CAAC,MAAM;AAAA,IACT,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,iCAAiC,CAC9C,MACA,OAM+B;AAAA,EAC/B,IAAI,MAAM,SAAS,SAAS,MAAM,QAAQ,MAAM,SAAS,gBAAgB,MAAM,aAAa;AAAA,IAC1F,OAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,KAAK,gBAAgB,OAAO;AAAA,IACjC,WAAW,MAAM,SAAS;AAAA,IAC1B,IAAI,MAAM,SAAS;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,EACnB,CAAC;AAAA;;;AC7WI,MAAM,yBAAyB,MAAM;AAAA,EACjC,OAAO;AAClB;;;ACCA,eAAsB,0BAA0B,CAAC,OAM/B;AAAA,EAChB,MAAM,YAAY,MAAM,0BAA0B;AAAA,IAChD,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,EAAE,MAAM,YAAY,IAAI,MAAM,YAAY,OAAO,MAAM,MAAM;AAAA,IACxE,aAAa,CAAC,aAAa,YAAY,OAAO;AAAA,EAChD,CAAC;AAAA,EACD,IAAI,CAAC,WAAW;AAAA,IACd,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA,EAEA,IAAI,UAAU,OAAO,SAAS,cAAc,UAAU,OAAO,SAAS,SAAS;AAAA,IAC7E,IAAI,UAAU,gBAAgB,WAAW;AAAA,MACvC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AAAA,EAIA,IAAI,UAAU,OAAO,SAAS,aAAa;AAAA,IACzC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA;AAIF,eAAsB,mCAAmC,CAAC,OAOxC;AAAA,EAChB,MAAM,YAAY,MAAM,sBAAsB;AAAA,IAC5C,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,OAAO,MAAM;AAAA,IACb,WAAW,EAAE,MAAM,WAAW,kBAAkB,sBAAsB,MAAM,OAAO,EAAE;AAAA,EACvF,CAAC;AAAA,EACD,IACE,CAAC,aACD,UAAU,OAAO,SAAS,eAC1B,UAAU,OAAO,gBAAgB,MAAM,qBACvC;AAAA,IACA,MAAM,IAAI,iBACR,qBAAqB,MAAM,4DAA4D,MAAM,aAC/F;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CAAC,aAAqB,OAAsB;AAAA,EACnE,MAAM,IAAI,iBACR,qBAAqB,iDAAiD,SACxE;AAAA;",
+  "debugId": "22475541B2F1C1A864756E2164756E21",
+  "names": []
+}