effect-agent 0.1.0-beta.16 → 0.1.0-beta.160

package/dist/durable/GitHubWorkflowSource.mjs

@@ -0,0 +1,209 @@
+import { u as strictSchema } from "../FailureDiagnostic-BElLOoED.mjs";
+import { SubscriptionSourceError } from "./Subscription.mjs";
+import { makeEventSource } from "./EventSource.mjs";
+import { SubscriptionIntake } from "./Subscriptions.mjs";
+import { ByteSize, Context, Effect, Encoding, Layer, Redacted, Schema } from "effect";
+import { HttpClient, HttpClientRequest, HttpIncomingMessage } from "effect/unstable/http";
+//#region src/durable/GitHubWorkflowSource.ts
+const PositiveId = Schema.Int.check(Schema.isGreaterThan(0));
+const GitHubName = Schema.NonEmptyString.check(Schema.isMaxLength(100), Schema.isPattern(/^[A-Za-z0-9_.-]+$/));
+const GitCommitSha = Schema.String.check(Schema.isPattern(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/));
+const GitHubConclusion = Schema.NonEmptyString.check(Schema.isMaxLength(64));
+const GitHubStatus = Schema.NonEmptyString.check(Schema.isMaxLength(32));
+/** One repository whose identity and credentials are selected by the host. */
+const GitHubRepository = Schema.Struct({
+	id: PositiveId,
+	owner: GitHubName,
+	name: GitHubName
+}).pipe(strictSchema);
+/** Exact workflow attempt requested by an Agent through a host-permitted source. */
+const GitHubWorkflowRunWatch = Schema.Struct({
+	runId: PositiveId,
+	attempt: PositiveId,
+	expectedHeadSha: GitCommitSha
+}).pipe(strictSchema);
+/**
+* Small canonical completion shared by webhook intake and REST reconciliation. Provider delivery
+* IDs, URLs, actors, and mutable metadata are deliberately omitted from durable event identity.
+*/
+const GitHubWorkflowRunCompletion = Schema.Struct({
+	repositoryId: PositiveId,
+	runId: PositiveId,
+	attempt: PositiveId,
+	headSha: GitCommitSha,
+	conclusion: GitHubConclusion
+}).pipe(strictSchema);
+const GitHubWorkflowRunWire = Schema.Struct({
+	id: PositiveId,
+	run_attempt: PositiveId,
+	head_sha: GitCommitSha,
+	status: GitHubStatus,
+	conclusion: Schema.NullOr(GitHubConclusion),
+	repository: Schema.Struct({ id: PositiveId })
+});
+const GitHubWorkflowRunWebhook = Schema.Struct({
+	action: Schema.Literal("completed"),
+	repository: Schema.Struct({ id: PositiveId }),
+	workflow_run: GitHubWorkflowRunWire
+});
+const GitHubWorkflowRunAttempt = GitHubWorkflowRunWire;
+const GitHubWorkflowRunSourceVersion = {
+	name: "github-workflow-run-completed",
+	version: "1"
+};
+var GitHubWorkflowRunsError = class extends Schema.TaggedError()("GitHubWorkflowRunsError", {
+	reason: Schema.Literals([
+		"rate-limited",
+		"unavailable",
+		"unauthorized",
+		"not-found",
+		"invalid-response"
+	]),
+	retryable: Schema.Boolean
+}) {};
+/**
+* Credentialed, read-only GitHub boundary. Implementations must authorize the repository and read
+* the exact attempt endpoint; the source never receives or persists a credential.
+*/
+var GitHubWorkflowRuns = class extends Context.Service()("@effect-agent/thread/GitHubWorkflowRuns") {};
+const httpFailure = (reason, retryable) => GitHubWorkflowRunsError.make({
+	reason,
+	retryable
+});
+/**
+* GitHub REST adapter for `GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt}`.
+* It performs one bounded read. Scheduling retries and backoff remain owned by SubscriptionDriver.
+*/
+const githubWorkflowRunsHttpLayer = (options) => Layer.effect(GitHubWorkflowRuns, Effect.gen(function* () {
+	const client = yield* HttpClient.HttpClient;
+	const permittedRepository = yield* Schema.decodeEffect(GitHubRepository, { onExcessProperty: "error" })(options.repository).pipe(Effect.mapError(() => httpFailure("invalid-response", false)));
+	const apiUrl = (options.apiUrl ?? "https://api.github.com").replace(/\/$/, "");
+	const getAttempt = Effect.fn("GitHubWorkflowRuns.getAttempt")(function* (request) {
+		const repository = yield* Schema.decodeEffect(GitHubRepository, { onExcessProperty: "error" })(request.repository).pipe(Effect.mapError(() => httpFailure("invalid-response", false)));
+		if (repository.id !== permittedRepository.id || repository.owner !== permittedRepository.owner || repository.name !== permittedRepository.name) return yield* httpFailure("unauthorized", false);
+		const watch = yield* Schema.decodeEffect(GitHubWorkflowRunWatch, { onExcessProperty: "error" })({
+			runId: request.runId,
+			attempt: request.attempt,
+			expectedHeadSha: "0".repeat(40)
+		}).pipe(Effect.mapError(() => httpFailure("invalid-response", false)));
+		const url = `${apiUrl}/repos/${repository.owner}/${repository.name}/actions/runs/${String(watch.runId)}/attempts/${String(watch.attempt)}`;
+		const response = yield* client.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.setHeaders({
+			Accept: "application/vnd.github+json",
+			"X-GitHub-Api-Version": "2026-03-10",
+			"User-Agent": options.userAgent ?? "effect-agent-subscriptions"
+		}), HttpClientRequest.bearerToken(options.token))).pipe(Effect.mapError(() => httpFailure("unavailable", true)));
+		if (response.status === 429 || response.status === 403 && (response.headers["x-ratelimit-remaining"] === "0" || response.headers["retry-after"] !== void 0)) return yield* httpFailure("rate-limited", true);
+		if (response.status === 401 || response.status === 403) return yield* httpFailure("unauthorized", false);
+		if (response.status === 404) return yield* httpFailure("not-found", true);
+		if (response.status < 200 || response.status >= 300) return yield* httpFailure("unavailable", response.status >= 500);
+		return yield* response.json.pipe(Effect.provideService(HttpIncomingMessage.MaxBodySize, ByteSize.mebibytes(1)), Effect.mapError(() => httpFailure("invalid-response", false)), Effect.flatMap(Schema.decodeUnknownEffect(GitHubWorkflowRunAttempt)), Effect.mapError(() => httpFailure("invalid-response", false)));
+	});
+	return GitHubWorkflowRuns.of({ getAttempt });
+}));
+const sourceError = (code, retryable) => SubscriptionSourceError.make({
+	code,
+	retryable
+});
+const completionIdentity = (completion) => `github-workflow-run:${String(completion.repositoryId)}:${String(completion.runId)}:${String(completion.attempt)}:completed`;
+const watchIdentity = (repositoryId, watch) => `github-workflow-run:${String(repositoryId)}:${String(watch.runId)}:${String(watch.attempt)}:completed`;
+const completionFromWire = Effect.fn("GitHubWorkflowRun.completionFromWire")(function* (repository, watch, wire) {
+	if (wire.repository.id !== repository.id || wire.id !== watch.runId || wire.run_attempt !== watch.attempt || wire.head_sha !== watch.expectedHeadSha) return yield* sourceError("github-identity-mismatch", false);
+	if (wire.status !== "completed") return null;
+	if (wire.conclusion === null) return yield* sourceError("github-completed-without-conclusion", false);
+	return GitHubWorkflowRunCompletion.make({
+		repositoryId: repository.id,
+		runId: wire.id,
+		attempt: wire.run_attempt,
+		headSha: wire.head_sha,
+		conclusion: wire.conclusion
+	});
+});
+/**
+* Build the exact-attempt completion source, shared by all destination Agents in this partition.
+* Reconciliation depends on GitHub retaining a readable exact attempt.
+*/
+const makeGitHubWorkflowRunSource = Effect.fn("makeGitHubWorkflowRunSource")(function* (options) {
+	const repository = yield* Schema.decodeEffect(GitHubRepository, { onExcessProperty: "error" })(options.repository).pipe(Effect.mapError(() => sourceError("github-repository-configuration", false)));
+	const runs = yield* GitHubWorkflowRuns;
+	return yield* makeEventSource({
+		source: GitHubWorkflowRunSourceVersion,
+		continuity: "Webhook delivery is not replayed by GitHub; reconciliation can recover only while the exact workflow run attempt remains readable and authorized.",
+		event: GitHubWorkflowRunCompletion.check(Schema.makeFilter((completion) => completion.repositoryId === repository.id, { title: "GitHub completion belongs to the host-bound repository" })),
+		parameters: GitHubWorkflowRunWatch,
+		identity: completionIdentity,
+		eventKey: completionIdentity,
+		parameterKey: (watch) => watchIdentity(repository.id, watch),
+		matches: (completion, watch) => completion.repositoryId === repository.id && completion.runId === watch.runId && completion.attempt === watch.attempt && completion.headSha === watch.expectedHeadSha,
+		reconcile: (watch) => runs.getAttempt({
+			repository,
+			runId: watch.runId,
+			attempt: watch.attempt
+		}).pipe(Effect.mapError((error) => sourceError(`github-${error.reason}`, error.retryable)), Effect.flatMap((wire) => completionFromWire(repository, watch, wire)))
+	});
+});
+var GitHubWebhookVerificationError = class extends Schema.TaggedError()("GitHubWebhookVerificationError", { reason: Schema.Literals([
+	"invalid-signature",
+	"invalid-event",
+	"invalid-payload",
+	"payload-too-large",
+	"crypto-unavailable"
+]) }) {};
+/** Host-held webhook secret verification; callers cannot bypass it by supplying parsed JSON. */
+var GitHubWebhookSignatureVerifier = class extends Context.Service()("@effect-agent/thread/GitHubWebhookSignatureVerifier") {};
+/** GitHub-compatible HMAC-SHA256 verifier over the exact raw request bytes. */
+const webCryptoGitHubWebhookSignatureVerifierLayer = (secret, subtle) => Layer.effect(GitHubWebhookSignatureVerifier, Effect.sync(() => {
+	const verify = Effect.fn("GitHubWebhookSignatureVerifier.verify")(function* (body, signature) {
+		if (!/^sha256=[0-9a-f]{64}$/.test(signature)) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-signature" });
+		const signatureBytes = yield* Effect.fromResult(Encoding.decodeHex(signature.slice(7))).pipe(Effect.mapError(() => GitHubWebhookVerificationError.make({ reason: "invalid-signature" })));
+		const keyBytes = new TextEncoder().encode(Redacted.value(secret));
+		const keyBuffer = new ArrayBuffer(keyBytes.byteLength);
+		new Uint8Array(keyBuffer).set(keyBytes);
+		const key = yield* Effect.tryPromise({
+			try: () => subtle.importKey("raw", keyBuffer, {
+				name: "HMAC",
+				hash: "SHA-256"
+			}, false, ["verify"]),
+			catch: () => GitHubWebhookVerificationError.make({ reason: "crypto-unavailable" })
+		});
+		const signatureBuffer = new ArrayBuffer(signatureBytes.byteLength);
+		new Uint8Array(signatureBuffer).set(signatureBytes);
+		const bodyBuffer = new ArrayBuffer(body.byteLength);
+		new Uint8Array(bodyBuffer).set(body);
+		if (!(yield* Effect.tryPromise({
+			try: () => subtle.verify("HMAC", key, signatureBuffer, bodyBuffer),
+			catch: () => GitHubWebhookVerificationError.make({ reason: "crypto-unavailable" })
+		}))) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-signature" });
+	});
+	return GitHubWebhookSignatureVerifier.of({ verify });
+}));
+/**
+* Verify raw ingress, decode only a completed `workflow_run`, and hand its canonical completion to
+* durable intake. The acknowledgement means routing work is retained; it is not a Submission Receipt.
+*/
+const acceptVerifiedGitHubWorkflowRunWebhook = Effect.fn("acceptVerifiedGitHubWorkflowRunWebhook")(function* (request) {
+	if (request.body.byteLength > 1048576) return yield* GitHubWebhookVerificationError.make({ reason: "payload-too-large" });
+	if (request.eventHeader !== "workflow_run" || request.signatureHeader === void 0) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-event" });
+	yield* (yield* GitHubWebhookSignatureVerifier).verify(request.body, request.signatureHeader);
+	const text = yield* Effect.try({
+		try: () => new TextDecoder("utf-8", {
+			fatal: true,
+			ignoreBOM: false
+		}).decode(request.body),
+		catch: () => GitHubWebhookVerificationError.make({ reason: "invalid-payload" })
+	});
+	const webhook = yield* Schema.decodeEffect(Schema.fromJsonString(GitHubWorkflowRunWebhook))(text).pipe(Effect.mapError(() => GitHubWebhookVerificationError.make({ reason: "invalid-payload" })));
+	if (webhook.repository.id !== webhook.workflow_run.repository.id) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-payload" });
+	if (webhook.workflow_run.status !== "completed" || webhook.workflow_run.conclusion === null) return yield* GitHubWebhookVerificationError.make({ reason: "invalid-payload" });
+	const completion = GitHubWorkflowRunCompletion.make({
+		repositoryId: webhook.repository.id,
+		runId: webhook.workflow_run.id,
+		attempt: webhook.workflow_run.run_attempt,
+		headSha: webhook.workflow_run.head_sha,
+		conclusion: webhook.workflow_run.conclusion
+	});
+	return yield* (yield* SubscriptionIntake).accept(request.principal, GitHubWorkflowRunSourceVersion, completion);
+});
+//#endregion
+export { GitHubRepository, GitHubWebhookSignatureVerifier, GitHubWebhookVerificationError, GitHubWorkflowRunAttempt, GitHubWorkflowRunCompletion, GitHubWorkflowRunSourceVersion, GitHubWorkflowRunWatch, GitHubWorkflowRunWebhook, GitHubWorkflowRuns, GitHubWorkflowRunsError, acceptVerifiedGitHubWorkflowRunWebhook, githubWorkflowRunsHttpLayer, makeGitHubWorkflowRunSource, webCryptoGitHubWebhookSignatureVerifierLayer };
+
+//# sourceMappingURL=GitHubWorkflowSource.mjs.map

package/dist/durable/GitHubWorkflowSource.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitHubWorkflowSource.mjs","names":[],"sources":["../../src/durable/GitHubWorkflowSource.ts"],"sourcesContent":["import { Context, Effect, Encoding, ByteSize, Layer, Redacted, Schema } from \"effect\";\nimport { HttpClient, HttpIncomingMessage, HttpClientRequest } from \"effect/unstable/http\";\n\nimport { strictSchema } from \"../core/internal/strict-schema.ts\";\nimport { makeEventSource, type EventSource } from \"./EventSource.ts\";\nimport type { Principal } from \"./SubmissionLedger.ts\";\nimport type { EventAcknowledgement } from \"./Subscription.ts\";\nimport { SubscriptionSourceError } from \"./Subscription.ts\";\nimport { SubscriptionIntake } from \"./Subscriptions.ts\";\n\nconst PositiveId = Schema.Int.check(Schema.isGreaterThan(0));\n\nconst GitHubName = Schema.NonEmptyString.check(\n  Schema.isMaxLength(100),\n  Schema.isPattern(/^[A-Za-z0-9_.-]+$/),\n);\n\nconst GitCommitSha = Schema.String.check(Schema.isPattern(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/));\nconst GitHubConclusion = Schema.NonEmptyString.check(Schema.isMaxLength(64));\nconst GitHubStatus = Schema.NonEmptyString.check(Schema.isMaxLength(32));\n\n/** One repository whose identity and credentials are selected by the host. */\nexport const GitHubRepository = Schema.Struct({\n  id: PositiveId,\n  owner: GitHubName,\n  name: GitHubName,\n}).pipe(strictSchema);\n\nexport type GitHubRepository = typeof GitHubRepository.Type;\n\n/** Exact workflow attempt requested by an Agent through a host-permitted source. */\nexport const GitHubWorkflowRunWatch = Schema.Struct({\n  runId: PositiveId,\n  attempt: PositiveId,\n  expectedHeadSha: GitCommitSha,\n}).pipe(strictSchema);\n\nexport type GitHubWorkflowRunWatch = typeof GitHubWorkflowRunWatch.Type;\n\n/**\n * Small canonical completion shared by webhook intake and REST reconciliation. Provider delivery\n * IDs, URLs, actors, and mutable metadata are deliberately omitted from durable event identity.\n */\nexport const GitHubWorkflowRunCompletion = Schema.Struct({\n  repositoryId: PositiveId,\n  runId: PositiveId,\n  attempt: PositiveId,\n  headSha: GitCommitSha,\n  conclusion: GitHubConclusion,\n}).pipe(strictSchema);\n\nexport type GitHubWorkflowRunCompletion = typeof GitHubWorkflowRunCompletion.Type;\n\n// Provider wire payloads intentionally project the fields we own. GitHub adds many fields and\n// may add more; canonical values below remain strict after this projection.\nconst GitHubWorkflowRunWire = Schema.Struct({\n  id: PositiveId,\n  run_attempt: PositiveId,\n  head_sha: GitCommitSha,\n  status: GitHubStatus,\n  conclusion: Schema.NullOr(GitHubConclusion),\n  repository: Schema.Struct({ id: PositiveId }),\n});\n\nexport const GitHubWorkflowRunWebhook = Schema.Struct({\n  action: Schema.Literal(\"completed\"),\n  repository: Schema.Struct({ id: PositiveId }),\n  workflow_run: GitHubWorkflowRunWire,\n});\n\nexport type GitHubWorkflowRunWebhook = typeof GitHubWorkflowRunWebhook.Type;\n\nexport const GitHubWorkflowRunAttempt = GitHubWorkflowRunWire;\nexport type GitHubWorkflowRunAttempt = typeof GitHubWorkflowRunAttempt.Type;\n\nexport const GitHubWorkflowRunSourceVersion = {\n  name: \"github-workflow-run-completed\",\n  version: \"1\",\n} as const;\n\nexport class GitHubWorkflowRunsError extends Schema.TaggedError<GitHubWorkflowRunsError>()(\n  \"GitHubWorkflowRunsError\",\n  {\n    reason: Schema.Literals([\n      \"rate-limited\",\n      \"unavailable\",\n      \"unauthorized\",\n      \"not-found\",\n      \"invalid-response\",\n    ]),\n    retryable: Schema.Boolean,\n  },\n) {}\n\nexport interface GitHubWorkflowRunAttemptRequest {\n  readonly repository: GitHubRepository;\n  readonly runId: number;\n  readonly attempt: number;\n}\n\n/**\n * Credentialed, read-only GitHub boundary. Implementations must authorize the repository and read\n * the exact attempt endpoint; the source never receives or persists a credential.\n */\nexport class GitHubWorkflowRuns extends Context.Service<\n  GitHubWorkflowRuns,\n  {\n    readonly getAttempt: (\n      request: GitHubWorkflowRunAttemptRequest,\n    ) => Effect.Effect<GitHubWorkflowRunAttempt, GitHubWorkflowRunsError>;\n  }\n>()(\"@effect-agent/thread/GitHubWorkflowRuns\") {}\n\nexport interface GitHubWorkflowRunsHttpOptions {\n  /** Repository this credentialed adapter is authorized to read. */\n  readonly repository: GitHubRepository;\n  readonly token: Redacted.Redacted<string>;\n  readonly apiUrl?: string | undefined;\n  readonly userAgent?: string | undefined;\n}\n\nconst httpFailure = (\n  reason: GitHubWorkflowRunsError[\"reason\"],\n  retryable: boolean,\n): GitHubWorkflowRunsError => GitHubWorkflowRunsError.make({ reason, retryable });\n\n/**\n * GitHub REST adapter for `GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt}`.\n * It performs one bounded read. Scheduling retries and backoff remain owned by SubscriptionDriver.\n */\nexport const githubWorkflowRunsHttpLayer = (\n  options: GitHubWorkflowRunsHttpOptions,\n): Layer.Layer<GitHubWorkflowRuns, GitHubWorkflowRunsError, HttpClient.HttpClient> =>\n  Layer.effect(\n    GitHubWorkflowRuns,\n    Effect.gen(function* () {\n      const client = yield* HttpClient.HttpClient;\n\n      const permittedRepository = yield* Schema.decodeEffect(GitHubRepository, {\n        onExcessProperty: \"error\",\n      })(options.repository).pipe(Effect.mapError(() => httpFailure(\"invalid-response\", false)));\n\n      const apiUrl = (options.apiUrl ?? \"https://api.github.com\").replace(/\\/$/, \"\");\n\n      const getAttempt = Effect.fn(\"GitHubWorkflowRuns.getAttempt\")(function* (\n        request: GitHubWorkflowRunAttemptRequest,\n      ) {\n        const repository = yield* Schema.decodeEffect(GitHubRepository, {\n          onExcessProperty: \"error\",\n        })(request.repository).pipe(Effect.mapError(() => httpFailure(\"invalid-response\", false)));\n\n        if (\n          repository.id !== permittedRepository.id ||\n          repository.owner !== permittedRepository.owner ||\n          repository.name !== permittedRepository.name\n        ) {\n          return yield* httpFailure(\"unauthorized\", false);\n        }\n\n        const watch = yield* Schema.decodeEffect(GitHubWorkflowRunWatch, {\n          onExcessProperty: \"error\",\n        })({\n          runId: request.runId,\n          attempt: request.attempt,\n          expectedHeadSha: \"0\".repeat(40),\n        }).pipe(Effect.mapError(() => httpFailure(\"invalid-response\", false)));\n\n        const url = `${apiUrl}/repos/${repository.owner}/${repository.name}/actions/runs/${String(watch.runId)}/attempts/${String(watch.attempt)}`;\n\n        const response = yield* client\n          .execute(\n            HttpClientRequest.get(url).pipe(\n              HttpClientRequest.setHeaders({\n                Accept: \"application/vnd.github+json\",\n                \"X-GitHub-Api-Version\": \"2026-03-10\",\n                \"User-Agent\": options.userAgent ?? \"effect-agent-subscriptions\",\n              }),\n              HttpClientRequest.bearerToken(options.token),\n            ),\n          )\n          .pipe(Effect.mapError(() => httpFailure(\"unavailable\", true)));\n\n        if (\n          response.status === 429 ||\n          (response.status === 403 &&\n            (response.headers[\"x-ratelimit-remaining\"] === \"0\" ||\n              response.headers[\"retry-after\"] !== undefined))\n        ) {\n          return yield* httpFailure(\"rate-limited\", true);\n        }\n        if (response.status === 401 || response.status === 403) {\n          return yield* httpFailure(\"unauthorized\", false);\n        }\n        if (response.status === 404) return yield* httpFailure(\"not-found\", true);\n        if (response.status < 200 || response.status >= 300) {\n          return yield* httpFailure(\"unavailable\", response.status >= 500);\n        }\n\n        return yield* response.json.pipe(\n          Effect.provideService(HttpIncomingMessage.MaxBodySize, ByteSize.mebibytes(1)),\n          Effect.mapError(() => httpFailure(\"invalid-response\", false)),\n          Effect.flatMap(Schema.decodeUnknownEffect(GitHubWorkflowRunAttempt)),\n          Effect.mapError(() => httpFailure(\"invalid-response\", false)),\n        );\n      });\n\n      return GitHubWorkflowRuns.of({ getAttempt });\n    }),\n  );\n\nconst sourceError = (code: string, retryable: boolean) =>\n  SubscriptionSourceError.make({ code, retryable });\n\nconst completionIdentity = (completion: GitHubWorkflowRunCompletion): string =>\n  `github-workflow-run:${String(completion.repositoryId)}:${String(completion.runId)}:${String(completion.attempt)}:completed`;\n\nconst watchIdentity = (repositoryId: number, watch: GitHubWorkflowRunWatch): string =>\n  `github-workflow-run:${String(repositoryId)}:${String(watch.runId)}:${String(watch.attempt)}:completed`;\n\nconst completionFromWire = Effect.fn(\"GitHubWorkflowRun.completionFromWire\")(function* (\n  repository: GitHubRepository,\n  watch: GitHubWorkflowRunWatch,\n  wire: GitHubWorkflowRunAttempt,\n) {\n  if (\n    wire.repository.id !== repository.id ||\n    wire.id !== watch.runId ||\n    wire.run_attempt !== watch.attempt ||\n    wire.head_sha !== watch.expectedHeadSha\n  ) {\n    return yield* sourceError(\"github-identity-mismatch\", false);\n  }\n  if (wire.status !== \"completed\") return null;\n  if (wire.conclusion === null) {\n    return yield* sourceError(\"github-completed-without-conclusion\", false);\n  }\n\n  return GitHubWorkflowRunCompletion.make({\n    repositoryId: repository.id,\n    runId: wire.id,\n    attempt: wire.run_attempt,\n    headSha: wire.head_sha,\n    conclusion: wire.conclusion,\n  });\n});\n\nexport interface GitHubWorkflowRunSourceOptions {\n  readonly repository: GitHubRepository;\n}\n\n/**\n * Build the exact-attempt completion source, shared by all destination Agents in this partition.\n * Reconciliation depends on GitHub retaining a readable exact attempt.\n */\nexport const makeGitHubWorkflowRunSource = Effect.fn(\"makeGitHubWorkflowRunSource\")(function* (\n  options: GitHubWorkflowRunSourceOptions,\n): Effect.fn.Return<EventSource, SubscriptionSourceError, GitHubWorkflowRuns> {\n  const repository = yield* Schema.decodeEffect(GitHubRepository, { onExcessProperty: \"error\" })(\n    options.repository,\n  ).pipe(Effect.mapError(() => sourceError(\"github-repository-configuration\", false)));\n\n  const runs = yield* GitHubWorkflowRuns;\n\n  return yield* makeEventSource({\n    source: GitHubWorkflowRunSourceVersion,\n    continuity:\n      \"Webhook delivery is not replayed by GitHub; reconciliation can recover only while the exact workflow run attempt remains readable and authorized.\",\n    event: GitHubWorkflowRunCompletion.check(\n      Schema.makeFilter((completion) => completion.repositoryId === repository.id, {\n        title: \"GitHub completion belongs to the host-bound repository\",\n      }),\n    ),\n    parameters: GitHubWorkflowRunWatch,\n    identity: completionIdentity,\n    eventKey: completionIdentity,\n    parameterKey: (watch) => watchIdentity(repository.id, watch),\n    matches: (completion, watch) =>\n      completion.repositoryId === repository.id &&\n      completion.runId === watch.runId &&\n      completion.attempt === watch.attempt &&\n      completion.headSha === watch.expectedHeadSha,\n    reconcile: (watch) =>\n      runs.getAttempt({ repository, runId: watch.runId, attempt: watch.attempt }).pipe(\n        Effect.mapError((error) => sourceError(`github-${error.reason}`, error.retryable)),\n        Effect.flatMap((wire) => completionFromWire(repository, watch, wire)),\n      ),\n  });\n});\n\nexport class GitHubWebhookVerificationError extends Schema.TaggedError<GitHubWebhookVerificationError>()(\n  \"GitHubWebhookVerificationError\",\n  {\n    reason: Schema.Literals([\n      \"invalid-signature\",\n      \"invalid-event\",\n      \"invalid-payload\",\n      \"payload-too-large\",\n      \"crypto-unavailable\",\n    ]),\n  },\n) {}\n\n/** Host-held webhook secret verification; callers cannot bypass it by supplying parsed JSON. */\nexport class GitHubWebhookSignatureVerifier extends Context.Service<\n  GitHubWebhookSignatureVerifier,\n  {\n    readonly verify: (\n      body: Uint8Array,\n      signature: string,\n    ) => Effect.Effect<void, GitHubWebhookVerificationError>;\n  }\n>()(\"@effect-agent/thread/GitHubWebhookSignatureVerifier\") {}\n\n/** Narrow host WebCrypto capability used for GitHub HMAC-SHA256 verification. */\nexport interface GitHubWebhookSubtleCrypto<Key> {\n  readonly importKey: (\n    format: \"raw\",\n    keyData: ArrayBuffer,\n    algorithm: { readonly name: \"HMAC\"; readonly hash: \"SHA-256\" },\n    extractable: false,\n    usages: [\"verify\"],\n  ) => PromiseLike<Key>;\n  readonly verify: (\n    algorithm: \"HMAC\",\n    key: Key,\n    signature: ArrayBuffer,\n    data: ArrayBuffer,\n  ) => PromiseLike<boolean>;\n}\n\n/** GitHub-compatible HMAC-SHA256 verifier over the exact raw request bytes. */\nexport const webCryptoGitHubWebhookSignatureVerifierLayer = <Key>(\n  secret: Redacted.Redacted<string>,\n  subtle: GitHubWebhookSubtleCrypto<Key>,\n): Layer.Layer<GitHubWebhookSignatureVerifier> =>\n  Layer.effect(\n    GitHubWebhookSignatureVerifier,\n    Effect.sync(() => {\n      const verify = Effect.fn(\"GitHubWebhookSignatureVerifier.verify\")(function* (\n        body: Uint8Array,\n        signature: string,\n      ) {\n        if (!/^sha256=[0-9a-f]{64}$/.test(signature)) {\n          return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-signature\" });\n        }\n\n        const signatureBytes = yield* Effect.fromResult(\n          Encoding.decodeHex(signature.slice(\"sha256=\".length)),\n        ).pipe(\n          Effect.mapError(() =>\n            GitHubWebhookVerificationError.make({ reason: \"invalid-signature\" }),\n          ),\n        );\n\n        const keyBytes = new TextEncoder().encode(Redacted.value(secret));\n        const keyBuffer = new ArrayBuffer(keyBytes.byteLength);\n\n        new Uint8Array(keyBuffer).set(keyBytes);\n\n        const key = yield* Effect.tryPromise({\n          try: () =>\n            subtle.importKey(\"raw\", keyBuffer, { name: \"HMAC\", hash: \"SHA-256\" }, false, [\n              \"verify\",\n            ]),\n          catch: () => GitHubWebhookVerificationError.make({ reason: \"crypto-unavailable\" }),\n        });\n\n        const signatureBuffer = new ArrayBuffer(signatureBytes.byteLength);\n\n        new Uint8Array(signatureBuffer).set(signatureBytes);\n        const bodyBuffer = new ArrayBuffer(body.byteLength);\n\n        new Uint8Array(bodyBuffer).set(body);\n\n        const valid = yield* Effect.tryPromise({\n          try: () => subtle.verify(\"HMAC\", key, signatureBuffer, bodyBuffer),\n          catch: () => GitHubWebhookVerificationError.make({ reason: \"crypto-unavailable\" }),\n        });\n\n        if (!valid) {\n          return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-signature\" });\n        }\n      });\n\n      return GitHubWebhookSignatureVerifier.of({ verify });\n    }),\n  );\n\nexport interface VerifiedGitHubWorkflowRunWebhookRequest {\n  readonly body: Uint8Array;\n  readonly eventHeader: string | undefined;\n  readonly signatureHeader: string | undefined;\n  readonly principal: Principal;\n}\n\n/**\n * Verify raw ingress, decode only a completed `workflow_run`, and hand its canonical completion to\n * durable intake. The acknowledgement means routing work is retained; it is not a Submission Receipt.\n */\nexport const acceptVerifiedGitHubWorkflowRunWebhook = Effect.fn(\n  \"acceptVerifiedGitHubWorkflowRunWebhook\",\n)(function* (\n  request: VerifiedGitHubWorkflowRunWebhookRequest,\n): Effect.fn.Return<\n  EventAcknowledgement,\n  | GitHubWebhookVerificationError\n  | Effect.Error<ReturnType<SubscriptionIntake[\"Service\"][\"accept\"]>>,\n  GitHubWebhookSignatureVerifier | SubscriptionIntake\n> {\n  if (request.body.byteLength > 1024 * 1024) {\n    return yield* GitHubWebhookVerificationError.make({ reason: \"payload-too-large\" });\n  }\n  if (request.eventHeader !== \"workflow_run\" || request.signatureHeader === undefined) {\n    return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-event\" });\n  }\n  const verifier = yield* GitHubWebhookSignatureVerifier;\n\n  yield* verifier.verify(request.body, request.signatureHeader);\n\n  const text = yield* Effect.try({\n    try: () => new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: false }).decode(request.body),\n    catch: () => GitHubWebhookVerificationError.make({ reason: \"invalid-payload\" }),\n  });\n\n  const webhook = yield* Schema.decodeEffect(Schema.fromJsonString(GitHubWorkflowRunWebhook))(\n    text,\n  ).pipe(Effect.mapError(() => GitHubWebhookVerificationError.make({ reason: \"invalid-payload\" })));\n\n  if (webhook.repository.id !== webhook.workflow_run.repository.id) {\n    return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-payload\" });\n  }\n  if (webhook.workflow_run.status !== \"completed\" || webhook.workflow_run.conclusion === null) {\n    return yield* GitHubWebhookVerificationError.make({ reason: \"invalid-payload\" });\n  }\n\n  const completion = GitHubWorkflowRunCompletion.make({\n    repositoryId: webhook.repository.id,\n    runId: webhook.workflow_run.id,\n    attempt: webhook.workflow_run.run_attempt,\n    headSha: webhook.workflow_run.head_sha,\n    conclusion: webhook.workflow_run.conclusion,\n  });\n\n  const intake = yield* SubscriptionIntake;\n\n  return yield* intake.accept(request.principal, GitHubWorkflowRunSourceVersion, completion);\n});\n"],"mappings":";;;;;;;AAUA,MAAM,aAAa,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;AAE3D,MAAM,aAAa,OAAO,eAAe,MACvC,OAAO,YAAY,GAAG,GACtB,OAAO,UAAU,mBAAmB,CACtC;AAEA,MAAM,eAAe,OAAO,OAAO,MAAM,OAAO,UAAU,iCAAiC,CAAC;AAC5F,MAAM,mBAAmB,OAAO,eAAe,MAAM,OAAO,YAAY,EAAE,CAAC;AAC3E,MAAM,eAAe,OAAO,eAAe,MAAM,OAAO,YAAY,EAAE,CAAC;;AAGvE,MAAa,mBAAmB,OAAO,OAAO;CAC5C,IAAI;CACJ,OAAO;CACP,MAAM;AACR,CAAC,CAAC,CAAC,KAAK,YAAY;;AAKpB,MAAa,yBAAyB,OAAO,OAAO;CAClD,OAAO;CACP,SAAS;CACT,iBAAiB;AACnB,CAAC,CAAC,CAAC,KAAK,YAAY;;;;;AAQpB,MAAa,8BAA8B,OAAO,OAAO;CACvD,cAAc;CACd,OAAO;CACP,SAAS;CACT,SAAS;CACT,YAAY;AACd,CAAC,CAAC,CAAC,KAAK,YAAY;AAMpB,MAAM,wBAAwB,OAAO,OAAO;CAC1C,IAAI;CACJ,aAAa;CACb,UAAU;CACV,QAAQ;CACR,YAAY,OAAO,OAAO,gBAAgB;CAC1C,YAAY,OAAO,OAAO,EAAE,IAAI,WAAW,CAAC;AAC9C,CAAC;AAED,MAAa,2BAA2B,OAAO,OAAO;CACpD,QAAQ,OAAO,QAAQ,WAAW;CAClC,YAAY,OAAO,OAAO,EAAE,IAAI,WAAW,CAAC;CAC5C,cAAc;AAChB,CAAC;AAID,MAAa,2BAA2B;AAGxC,MAAa,iCAAiC;CAC5C,MAAM;CACN,SAAS;AACX;AAEA,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA;CACE,QAAQ,OAAO,SAAS;EACtB;EACA;EACA;EACA;EACA;CACF,CAAC;CACD,WAAW,OAAO;AACpB,CACF,CAAC,CAAC,CAAC;;;;;AAYH,IAAa,qBAAb,cAAwC,QAAQ,QAO9C,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC;AAUhD,MAAM,eACJ,QACA,cAC4B,wBAAwB,KAAK;CAAE;CAAQ;AAAU,CAAC;;;;;AAMhF,MAAa,+BACX,YAEA,MAAM,OACJ,oBACA,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,OAAO,WAAW;CAEjC,MAAM,sBAAsB,OAAO,OAAO,aAAa,kBAAkB,EACvE,kBAAkB,QACpB,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,CAAC,KAAK,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,CAAC;CAEzF,MAAM,UAAU,QAAQ,UAAU,yBAAA,CAA0B,QAAQ,OAAO,EAAE;CAE7E,MAAM,aAAa,OAAO,GAAG,+BAA+B,CAAC,CAAC,WAC5D,SACA;EACA,MAAM,aAAa,OAAO,OAAO,aAAa,kBAAkB,EAC9D,kBAAkB,QACpB,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,CAAC,KAAK,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,CAAC;EAEzF,IACE,WAAW,OAAO,oBAAoB,MACtC,WAAW,UAAU,oBAAoB,SACzC,WAAW,SAAS,oBAAoB,MAExC,OAAO,OAAO,YAAY,gBAAgB,KAAK;EAGjD,MAAM,QAAQ,OAAO,OAAO,aAAa,wBAAwB,EAC/D,kBAAkB,QACpB,CAAC,CAAC,CAAC;GACD,OAAO,QAAQ;GACf,SAAS,QAAQ;GACjB,iBAAiB,IAAI,OAAO,EAAE;EAChC,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,CAAC;EAErE,MAAM,MAAM,GAAG,OAAO,SAAS,WAAW,MAAM,GAAG,WAAW,KAAK,gBAAgB,OAAO,MAAM,KAAK,EAAE,YAAY,OAAO,MAAM,OAAO;EAEvI,MAAM,WAAW,OAAO,OACrB,QACC,kBAAkB,IAAI,GAAG,CAAC,CAAC,KACzB,kBAAkB,WAAW;GAC3B,QAAQ;GACR,wBAAwB;GACxB,cAAc,QAAQ,aAAa;EACrC,CAAC,GACD,kBAAkB,YAAY,QAAQ,KAAK,CAC7C,CACF,CAAC,CACA,KAAK,OAAO,eAAe,YAAY,eAAe,IAAI,CAAC,CAAC;EAE/D,IACE,SAAS,WAAW,OACnB,SAAS,WAAW,QAClB,SAAS,QAAQ,6BAA6B,OAC7C,SAAS,QAAQ,mBAAmB,KAAA,IAExC,OAAO,OAAO,YAAY,gBAAgB,IAAI;EAEhD,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,OAAO,YAAY,gBAAgB,KAAK;EAEjD,IAAI,SAAS,WAAW,KAAK,OAAO,OAAO,YAAY,aAAa,IAAI;EACxE,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAC9C,OAAO,OAAO,YAAY,eAAe,SAAS,UAAU,GAAG;EAGjE,OAAO,OAAO,SAAS,KAAK,KAC1B,OAAO,eAAe,oBAAoB,aAAa,SAAS,UAAU,CAAC,CAAC,GAC5E,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,GAC5D,OAAO,QAAQ,OAAO,oBAAoB,wBAAwB,CAAC,GACnE,OAAO,eAAe,YAAY,oBAAoB,KAAK,CAAC,CAC9D;CACF,CAAC;CAED,OAAO,mBAAmB,GAAG,EAAE,WAAW,CAAC;AAC7C,CAAC,CACH;AAEF,MAAM,eAAe,MAAc,cACjC,wBAAwB,KAAK;CAAE;CAAM;AAAU,CAAC;AAElD,MAAM,sBAAsB,eAC1B,uBAAuB,OAAO,WAAW,YAAY,EAAE,GAAG,OAAO,WAAW,KAAK,EAAE,GAAG,OAAO,WAAW,OAAO,EAAE;AAEnH,MAAM,iBAAiB,cAAsB,UAC3C,uBAAuB,OAAO,YAAY,EAAE,GAAG,OAAO,MAAM,KAAK,EAAE,GAAG,OAAO,MAAM,OAAO,EAAE;AAE9F,MAAM,qBAAqB,OAAO,GAAG,sCAAsC,CAAC,CAAC,WAC3E,YACA,OACA,MACA;CACA,IACE,KAAK,WAAW,OAAO,WAAW,MAClC,KAAK,OAAO,MAAM,SAClB,KAAK,gBAAgB,MAAM,WAC3B,KAAK,aAAa,MAAM,iBAExB,OAAO,OAAO,YAAY,4BAA4B,KAAK;CAE7D,IAAI,KAAK,WAAW,aAAa,OAAO;CACxC,IAAI,KAAK,eAAe,MACtB,OAAO,OAAO,YAAY,uCAAuC,KAAK;CAGxE,OAAO,4BAA4B,KAAK;EACtC,cAAc,WAAW;EACzB,OAAO,KAAK;EACZ,SAAS,KAAK;EACd,SAAS,KAAK;EACd,YAAY,KAAK;CACnB,CAAC;AACH,CAAC;;;;;AAUD,MAAa,8BAA8B,OAAO,GAAG,6BAA6B,CAAC,CAAC,WAClF,SAC4E;CAC5E,MAAM,aAAa,OAAO,OAAO,aAAa,kBAAkB,EAAE,kBAAkB,QAAQ,CAAC,CAAC,CAC5F,QAAQ,UACV,CAAC,CAAC,KAAK,OAAO,eAAe,YAAY,mCAAmC,KAAK,CAAC,CAAC;CAEnF,MAAM,OAAO,OAAO;CAEpB,OAAO,OAAO,gBAAgB;EAC5B,QAAQ;EACR,YACE;EACF,OAAO,4BAA4B,MACjC,OAAO,YAAY,eAAe,WAAW,iBAAiB,WAAW,IAAI,EAC3E,OAAO,yDACT,CAAC,CACH;EACA,YAAY;EACZ,UAAU;EACV,UAAU;EACV,eAAe,UAAU,cAAc,WAAW,IAAI,KAAK;EAC3D,UAAU,YAAY,UACpB,WAAW,iBAAiB,WAAW,MACvC,WAAW,UAAU,MAAM,SAC3B,WAAW,YAAY,MAAM,WAC7B,WAAW,YAAY,MAAM;EAC/B,YAAY,UACV,KAAK,WAAW;GAAE;GAAY,OAAO,MAAM;GAAO,SAAS,MAAM;EAAQ,CAAC,CAAC,CAAC,KAC1E,OAAO,UAAU,UAAU,YAAY,UAAU,MAAM,UAAU,MAAM,SAAS,CAAC,GACjF,OAAO,SAAS,SAAS,mBAAmB,YAAY,OAAO,IAAI,CAAC,CACtE;CACJ,CAAC;AACH,CAAC;AAED,IAAa,iCAAb,cAAoD,OAAO,YAA4C,CAAC,CACtG,kCACA,EACE,QAAQ,OAAO,SAAS;CACtB;CACA;CACA;CACA;CACA;AACF,CAAC,EACH,CACF,CAAC,CAAC,CAAC;;AAGH,IAAa,iCAAb,cAAoD,QAAQ,QAQ1D,CAAC,CAAC,qDAAqD,CAAC,CAAC,CAAC;;AAoB5D,MAAa,gDACX,QACA,WAEA,MAAM,OACJ,gCACA,OAAO,WAAW;CAChB,MAAM,SAAS,OAAO,GAAG,uCAAuC,CAAC,CAAC,WAChE,MACA,WACA;EACA,IAAI,CAAC,wBAAwB,KAAK,SAAS,GACzC,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,oBAAoB,CAAC;EAGnF,MAAM,iBAAiB,OAAO,OAAO,WACnC,SAAS,UAAU,UAAU,MAAM,CAAgB,CAAC,CACtD,CAAC,CAAC,KACA,OAAO,eACL,+BAA+B,KAAK,EAAE,QAAQ,oBAAoB,CAAC,CACrE,CACF;EAEA,MAAM,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,MAAM,MAAM,CAAC;EAChE,MAAM,YAAY,IAAI,YAAY,SAAS,UAAU;EAErD,IAAI,WAAW,SAAS,CAAC,CAAC,IAAI,QAAQ;EAEtC,MAAM,MAAM,OAAO,OAAO,WAAW;GACnC,WACE,OAAO,UAAU,OAAO,WAAW;IAAE,MAAM;IAAQ,MAAM;GAAU,GAAG,OAAO,CAC3E,QACF,CAAC;GACH,aAAa,+BAA+B,KAAK,EAAE,QAAQ,qBAAqB,CAAC;EACnF,CAAC;EAED,MAAM,kBAAkB,IAAI,YAAY,eAAe,UAAU;EAEjE,IAAI,WAAW,eAAe,CAAC,CAAC,IAAI,cAAc;EAClD,MAAM,aAAa,IAAI,YAAY,KAAK,UAAU;EAElD,IAAI,WAAW,UAAU,CAAC,CAAC,IAAI,IAAI;EAOnC,IAAI,EAAC,OALgB,OAAO,WAAW;GACrC,WAAW,OAAO,OAAO,QAAQ,KAAK,iBAAiB,UAAU;GACjE,aAAa,+BAA+B,KAAK,EAAE,QAAQ,qBAAqB,CAAC;EACnF,CAAC,IAGC,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,oBAAoB,CAAC;CAErF,CAAC;CAED,OAAO,+BAA+B,GAAG,EAAE,OAAO,CAAC;AACrD,CAAC,CACH;;;;;AAaF,MAAa,yCAAyC,OAAO,GAC3D,wCACF,CAAC,CAAC,WACA,SAMA;CACA,IAAI,QAAQ,KAAK,aAAa,SAC5B,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,oBAAoB,CAAC;CAEnF,IAAI,QAAQ,gBAAgB,kBAAkB,QAAQ,oBAAoB,KAAA,GACxE,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,gBAAgB,CAAC;CAI/E,QAAO,OAFiB,+BAAA,CAER,OAAO,QAAQ,MAAM,QAAQ,eAAe;CAE5D,MAAM,OAAO,OAAO,OAAO,IAAI;EAC7B,WAAW,IAAI,YAAY,SAAS;GAAE,OAAO;GAAM,WAAW;EAAM,CAAC,CAAC,CAAC,OAAO,QAAQ,IAAI;EAC1F,aAAa,+BAA+B,KAAK,EAAE,QAAQ,kBAAkB,CAAC;CAChF,CAAC;CAED,MAAM,UAAU,OAAO,OAAO,aAAa,OAAO,eAAe,wBAAwB,CAAC,CAAC,CACzF,IACF,CAAC,CAAC,KAAK,OAAO,eAAe,+BAA+B,KAAK,EAAE,QAAQ,kBAAkB,CAAC,CAAC,CAAC;CAEhG,IAAI,QAAQ,WAAW,OAAO,QAAQ,aAAa,WAAW,IAC5D,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,kBAAkB,CAAC;CAEjF,IAAI,QAAQ,aAAa,WAAW,eAAe,QAAQ,aAAa,eAAe,MACrF,OAAO,OAAO,+BAA+B,KAAK,EAAE,QAAQ,kBAAkB,CAAC;CAGjF,MAAM,aAAa,4BAA4B,KAAK;EAClD,cAAc,QAAQ,WAAW;EACjC,OAAO,QAAQ,aAAa;EAC5B,SAAS,QAAQ,aAAa;EAC9B,SAAS,QAAQ,aAAa;EAC9B,YAAY,QAAQ,aAAa;CACnC,CAAC;CAID,OAAO,QAAO,OAFQ,mBAAA,CAED,OAAO,QAAQ,WAAW,gCAAgC,UAAU;AAC3F,CAAC"}

package/dist/durable/LifecyclePublication.d.mts

@@ -0,0 +1,2 @@
+import { Ci as drainLifecyclePublications, Ti as lifecyclePublicationLayer, _i as LifecyclePublicationError, bi as LifecyclePublicationSource, gi as LifecyclePublicationConfig, hi as LifecyclePublicationBatch, mi as LifecyclePublication, vi as LifecyclePublicationFact, wi as lifecyclePublicationBatchMaxFacts, xi as LifecyclePublicationStorage, yi as LifecyclePublicationHandler } from "../Admin-Dirux8PR.mjs";
+export { LifecyclePublication, LifecyclePublicationBatch, LifecyclePublicationConfig, LifecyclePublicationError, LifecyclePublicationFact, LifecyclePublicationHandler, LifecyclePublicationSource, LifecyclePublicationStorage, drainLifecyclePublications, lifecyclePublicationBatchMaxFacts, lifecyclePublicationLayer };

package/dist/durable/LifecyclePublication.mjs

@@ -0,0 +1,189 @@
+import { t as __exportAll } from "../rolldown-runtime-D7D4PA-g.mjs";
+import { SubmissionId, ThreadId } from "../core/Identifiers.mjs";
+import { Receipt } from "../core/Receipt.mjs";
+import { n as AssignmentTerminal } from "../Worker-CfwzMZEK.mjs";
+import { AbortRequested, AgentUpdateEmitted, CanonicalSequence, RunStartedRecord, SubagentJoined, SubagentRequested, SubagentStarted, SubmissionSettledRecord, ToolApprovalDecided, ToolApprovalRequested, UserInputRecorded, WorkerInputCompleted, WorkerInputRequested, WorkerStopRequested } from "./Records.mjs";
+import { AbortIntent, Settlement, SubmissionLedger, SubmissionLookupById, SubmissionSnapshot, SuspensionReason } from "./SubmissionLedger.mjs";
+import { getRunInput } from "./ThreadStore.mjs";
+import { PreparedInput } from "./Subscription.mjs";
+import { MessageDeliveryKey } from "./MessageDelivery.mjs";
+import { Cause, Clock, Context, Crypto, Effect, Layer, Option, Schema } from "effect";
+//#region src/durable/LifecyclePublication.ts
+var LifecyclePublication_exports = /* @__PURE__ */ __exportAll({
+	LifecyclePublication: () => LifecyclePublication,
+	LifecyclePublicationBatch: () => LifecyclePublicationBatch,
+	LifecyclePublicationConfig: () => LifecyclePublicationConfig,
+	LifecyclePublicationError: () => LifecyclePublicationError,
+	LifecyclePublicationFact: () => LifecyclePublicationFact,
+	LifecyclePublicationHandler: () => LifecyclePublicationHandler,
+	LifecyclePublicationSource: () => LifecyclePublicationSource,
+	drainLifecyclePublications: () => drainLifecyclePublications,
+	lifecyclePublicationBatchMaxFacts: () => 8,
+	lifecyclePublicationLayer: () => lifecyclePublicationLayer
+});
+/** Immutable native admission evidence. It is private and grants no application authority. */
+const LifecyclePublicationSource = SubmissionSnapshot.mapFields((fields) => ({
+	submissionId: fields.submissionId,
+	threadId: fields.threadId,
+	queueSequence: fields.queueSequence,
+	principal: fields.principal,
+	idempotencyKey: fields.idempotencyKey,
+	agentId: fields.agentId,
+	agentDigests: fields.agentDigests,
+	inputPayload: fields.inputPayload,
+	inputDigest: fields.inputDigest,
+	receiptId: fields.receiptId,
+	parentLinkage: fields.parentLinkage,
+	workerAdmission: fields.workerAdmission,
+	messageAdmission: fields.messageAdmission,
+	createdAt: fields.createdAt
+}));
+/** Closed producer facts; model history, Tool payloads and diagnostics are not a publication API. */
+const LifecyclePublicationFact = Schema.Union([
+	Schema.TaggedStruct("DeliveryRetained", {
+		key: MessageDeliveryKey,
+		envelope: PreparedInput,
+		createdAtMillis: Schema.Natural
+	}),
+	Schema.TaggedStruct("DeliveryChanged", {
+		key: MessageDeliveryKey,
+		envelope: PreparedInput,
+		status: Schema.Literals([
+			"pending",
+			"accepted",
+			"processed",
+			"refused",
+			"parked"
+		]),
+		receipt: Schema.NullOr(Receipt),
+		settlement: Schema.NullOr(Settlement),
+		version: Schema.Natural
+	}),
+	Schema.TaggedStruct("WorkerInboxSealed", {
+		threadId: ThreadId,
+		activeSubmissionIds: Schema.Array(SubmissionId),
+		/** First native seal winner; null is an explicit stop rather than assignment completion. */
+		terminal: Schema.NullOr(AssignmentTerminal)
+	}),
+	Schema.TaggedStruct("SubmissionReady", { submissionId: SubmissionId }),
+	Schema.TaggedStruct("SubmissionSuspended", {
+		submissionId: SubmissionId,
+		reason: SuspensionReason
+	}),
+	Schema.TaggedStruct("SubmissionUnknown", { submissionId: SubmissionId }),
+	Schema.TaggedStruct("SubmissionResumed", { submissionId: SubmissionId }),
+	Schema.TaggedStruct("AbortIntentRecorded", { intent: AbortIntent }),
+	UserInputRecorded,
+	RunStartedRecord,
+	AgentUpdateEmitted,
+	ToolApprovalRequested,
+	ToolApprovalDecided,
+	AbortRequested,
+	WorkerInputCompleted,
+	WorkerInputRequested,
+	WorkerStopRequested,
+	SubagentRequested,
+	SubagentStarted,
+	SubagentJoined,
+	SubmissionSettledRecord
+]);
+/**
+* An exact undelivered native fact. `id` is stable across retries and lost acknowledgements.
+* Ordinals order facts only within ownerThreadId. Accepted input order is source.queueSequence;
+* never compare ordinals from the launching Thread and its worker Thread.
+*/
+var LifecyclePublication = class extends Schema.Class("@effect-agent/thread/LifecyclePublication")({
+	id: Schema.NonEmptyString.check(Schema.isMaxLength(4096)),
+	ownerThreadId: ThreadId,
+	ordinal: Schema.Int.check(Schema.isGreaterThan(0)),
+	createdAt: Schema.DateTimeUtcFromString,
+	canonicalSequence: Schema.optionalKey(CanonicalSequence),
+	source: Schema.optionalKey(LifecyclePublicationSource),
+	fact: LifecyclePublicationFact
+}) {};
+var LifecyclePublicationError = class extends Schema.TaggedError()("LifecyclePublicationError", {
+	reason: Schema.Literals([
+		"unavailable",
+		"conflict",
+		"corrupt",
+		"capacity"
+	]),
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+/** Bound both retained facts and the immutable admission evidence resolved before dispatch. */
+const lifecyclePublicationBatchMaxFacts = 8;
+/** One owner's bounded pending prefix, strictly ordered by its durable ordinals. */
+const LifecyclePublicationBatch = Schema.NonEmptyArray(LifecyclePublication).check(Schema.isMaxLength(8), Schema.makeFilter((facts) => facts.every((fact, index) => {
+	const previous = facts[index - 1];
+	return fact.ownerThreadId === facts[0].ownerThreadId && (previous === void 0 || fact.ordinal > previous.ordinal);
+}), { expected: "One owner with strictly increasing publication ordinals" }));
+/**
+* Publish one owner's ordered batch in one idempotent host transaction, including authorization,
+* records, receipts and delivery intents. Larger backlogs continue in later batches.
+* Return only after the entire batch commits. Retries
+* may include already committed identities plus later facts; deduplicate each fact's `id`.
+* Private input/update/result fields remain private; select declared public fields explicitly.
+* Revocation/deletion is an acknowledged domain decision, not an infrastructure retry.
+*/
+var LifecyclePublicationHandler = class extends Context.Service()("@effect-agent/thread/LifecyclePublicationHandler") {};
+/** Adapter configuration; the opt-in layer captures its explicit Crypto requirement once. */
+const LifecyclePublicationConfig = Context.Reference("@effect-agent/thread/LifecyclePublicationConfig", { defaultValue: () => Option.none() });
+/** Enable native SQL obligations without changing dependencies of disabled storage assemblies. */
+const lifecyclePublicationLayer = Layer.effect(LifecyclePublicationConfig)(Effect.map(Crypto.Crypto, Option.some));
+/** Resolve immutable evidence by its exact native identity, never by scanning execution history. */
+const withSource = Effect.fn("LifecyclePublication.withSource")(function* (publication) {
+	if (publication.source !== void 0 || publication.fact._tag === "WorkerInputCompleted" && publication.fact.workerThreadId !== publication.ownerThreadId) return publication;
+	const fact = publication.fact;
+	let submissionId = fact._tag === "AbortIntentRecorded" ? fact.intent.submissionId : "submissionId" in fact ? fact.submissionId : void 0;
+	const runId = fact._tag === "AgentUpdateEmitted" ? fact.update.runId : "runId" in fact ? fact.runId : void 0;
+	if (submissionId === void 0 && runId !== void 0) {
+		const input = yield* getRunInput({
+			threadId: publication.ownerThreadId,
+			runId
+		});
+		if (Option.isNone(input) || input.value.record.payload._tag !== "UserInputRecorded") return yield* LifecyclePublicationError.make({ reason: "unavailable" });
+		submissionId = input.value.record.payload.submissionId;
+	}
+	if (submissionId === void 0) return publication;
+	const found = yield* (yield* SubmissionLedger).lookup(SubmissionLookupById.make({ submissionId }));
+	if (Option.isNone(found)) return yield* LifecyclePublicationError.make({ reason: "unavailable" });
+	const source = yield* Schema.decodeEffect(Schema.toType(LifecyclePublicationSource))(found.value);
+	return LifecyclePublication.make({
+		...publication,
+		source
+	});
+}, Effect.mapError((cause) => LifecyclePublicationError.make({
+	reason: "unavailable",
+	cause
+})));
+/**
+* One finite wave for the host's existing maintenance coordinator. Persist the next deadline
+* before dispatch, so interruption and process loss retain the same facts without another timer.
+* Finish independent owner batches before surfacing failures; interruption stops the wave.
+* Acknowledgements are exact and idempotent. No producer or external Tool is re-executed here.
+*/
+const drainLifecyclePublications = Effect.fn("LifecyclePublication.drain")(function* (storage, timeoutMillis = 1e4, limit = 4, options) {
+	const handler = yield* LifecyclePublicationHandler;
+	const pending = yield* storage.pending(yield* Clock.currentTimeMillis, limit, options);
+	let failures = Cause.empty;
+	for (const batch of pending) yield* Effect.gen(function* () {
+		if (!(yield* storage.claim(batch, yield* Clock.currentTimeMillis, timeoutMillis))) return;
+		yield* Effect.scoped(Effect.gen(function* () {
+			const publications = yield* Effect.forEach(batch, withSource);
+			yield* handler.publish(publications);
+		})).pipe(Effect.timeoutOrElse({
+			duration: timeoutMillis,
+			orElse: () => LifecyclePublicationError.make({ reason: "unavailable" })
+		}));
+		yield* storage.acknowledge(batch);
+	}).pipe(Effect.catchCauseIf((cause) => !Cause.hasInterrupts(cause), (cause) => {
+		failures = Cause.combine(failures, cause);
+		return Effect.void;
+	}));
+	if (failures.reasons.length > 0) return yield* Effect.failCause(failures);
+	return pending.length;
+});
+//#endregion
+export { LifecyclePublication, LifecyclePublicationBatch, LifecyclePublicationConfig, LifecyclePublicationError, LifecyclePublicationFact, LifecyclePublicationHandler, LifecyclePublicationSource, drainLifecyclePublications, lifecyclePublicationBatchMaxFacts, lifecyclePublicationLayer, LifecyclePublication_exports as t };
+
+//# sourceMappingURL=LifecyclePublication.mjs.map

package/dist/durable/LifecyclePublication.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"LifecyclePublication.mjs","names":[],"sources":["../../src/durable/LifecyclePublication.ts"],"sourcesContent":["import { Cause, Clock, Context, Crypto, Effect, Layer, Option, Schema, type Scope } from \"effect\";\n\nimport { SubmissionId, ThreadId } from \"../core/Identifiers.ts\";\nimport { Receipt } from \"../core/Receipt.ts\";\nimport { AssignmentTerminal } from \"../core/Worker.ts\";\nimport { MessageDeliveryKey } from \"./MessageDelivery.ts\";\nimport {\n  AbortRequested,\n  AgentUpdateEmitted,\n  CanonicalSequence,\n  RunStartedRecord,\n  SubagentJoined,\n  SubagentRequested,\n  SubagentStarted,\n  SubmissionSettledRecord,\n  ToolApprovalDecided,\n  ToolApprovalRequested,\n  UserInputRecorded,\n  WorkerInputCompleted,\n  WorkerInputRequested,\n  WorkerStopRequested,\n} from \"./Records.ts\";\nimport {\n  AbortIntent,\n  Settlement,\n  SubmissionLedger,\n  SubmissionLookupById,\n  SubmissionSnapshot,\n  SuspensionReason,\n} from \"./SubmissionLedger.ts\";\nimport { PreparedInput } from \"./Subscription.ts\";\nimport { getRunInput } from \"./ThreadStore.ts\";\n\n/** Immutable native admission evidence. It is private and grants no application authority. */\nexport const LifecyclePublicationSource = SubmissionSnapshot.mapFields((fields) => ({\n  submissionId: fields.submissionId,\n  threadId: fields.threadId,\n  queueSequence: fields.queueSequence,\n  principal: fields.principal,\n  idempotencyKey: fields.idempotencyKey,\n  agentId: fields.agentId,\n  agentDigests: fields.agentDigests,\n  inputPayload: fields.inputPayload,\n  inputDigest: fields.inputDigest,\n  receiptId: fields.receiptId,\n  parentLinkage: fields.parentLinkage,\n  workerAdmission: fields.workerAdmission,\n  messageAdmission: fields.messageAdmission,\n  createdAt: fields.createdAt,\n}));\n\nexport type LifecyclePublicationSource = typeof LifecyclePublicationSource.Type;\n\n/** Closed producer facts; model history, Tool payloads and diagnostics are not a publication API. */\nexport const LifecyclePublicationFact = Schema.Union([\n  Schema.TaggedStruct(\"DeliveryRetained\", {\n    key: MessageDeliveryKey,\n    envelope: PreparedInput,\n    createdAtMillis: Schema.Natural,\n  }),\n  Schema.TaggedStruct(\"DeliveryChanged\", {\n    key: MessageDeliveryKey,\n    envelope: PreparedInput,\n    status: Schema.Literals([\"pending\", \"accepted\", \"processed\", \"refused\", \"parked\"]),\n    receipt: Schema.NullOr(Receipt),\n    settlement: Schema.NullOr(Settlement),\n    version: Schema.Natural,\n  }),\n  Schema.TaggedStruct(\"WorkerInboxSealed\", {\n    threadId: ThreadId,\n    activeSubmissionIds: Schema.Array(SubmissionId),\n    /** First native seal winner; null is an explicit stop rather than assignment completion. */\n    terminal: Schema.NullOr(AssignmentTerminal),\n  }),\n  Schema.TaggedStruct(\"SubmissionReady\", { submissionId: SubmissionId }),\n  Schema.TaggedStruct(\"SubmissionSuspended\", {\n    submissionId: SubmissionId,\n    reason: SuspensionReason,\n  }),\n  Schema.TaggedStruct(\"SubmissionUnknown\", { submissionId: SubmissionId }),\n  Schema.TaggedStruct(\"SubmissionResumed\", { submissionId: SubmissionId }),\n  Schema.TaggedStruct(\"AbortIntentRecorded\", { intent: AbortIntent }),\n  UserInputRecorded,\n  RunStartedRecord,\n  AgentUpdateEmitted,\n  ToolApprovalRequested,\n  ToolApprovalDecided,\n  AbortRequested,\n  WorkerInputCompleted,\n  WorkerInputRequested,\n  WorkerStopRequested,\n  SubagentRequested,\n  SubagentStarted,\n  SubagentJoined,\n  SubmissionSettledRecord,\n]);\n\nexport type LifecyclePublicationFact = typeof LifecyclePublicationFact.Type;\n\n/**\n * An exact undelivered native fact. `id` is stable across retries and lost acknowledgements.\n * Ordinals order facts only within ownerThreadId. Accepted input order is source.queueSequence;\n * never compare ordinals from the launching Thread and its worker Thread.\n */\nexport class LifecyclePublication extends Schema.Class<LifecyclePublication>(\n  \"@effect-agent/thread/LifecyclePublication\",\n)({\n  id: Schema.NonEmptyString.check(Schema.isMaxLength(4096)),\n  ownerThreadId: ThreadId,\n  ordinal: Schema.Int.check(Schema.isGreaterThan(0)),\n  createdAt: Schema.DateTimeUtcFromString,\n  canonicalSequence: Schema.optionalKey(CanonicalSequence),\n  source: Schema.optionalKey(LifecyclePublicationSource),\n  fact: LifecyclePublicationFact,\n}) {}\n\nexport class LifecyclePublicationError extends Schema.TaggedError<LifecyclePublicationError>()(\n  \"LifecyclePublicationError\",\n  {\n    reason: Schema.Literals([\"unavailable\", \"conflict\", \"corrupt\", \"capacity\"]),\n    cause: Schema.optionalKey(Schema.Defect()),\n  },\n) {}\n\n/** Bound both retained facts and the immutable admission evidence resolved before dispatch. */\nexport const lifecyclePublicationBatchMaxFacts = 8;\n\n/** One owner's bounded pending prefix, strictly ordered by its durable ordinals. */\nexport const LifecyclePublicationBatch = Schema.NonEmptyArray(LifecyclePublication).check(\n  Schema.isMaxLength(lifecyclePublicationBatchMaxFacts),\n  Schema.makeFilter(\n    (facts) =>\n      facts.every((fact, index) => {\n        const previous = facts[index - 1];\n\n        return (\n          fact.ownerThreadId === facts[0].ownerThreadId &&\n          (previous === undefined || fact.ordinal > previous.ordinal)\n        );\n      }),\n    { expected: \"One owner with strictly increasing publication ordinals\" },\n  ),\n);\n\nexport type LifecyclePublicationBatch = typeof LifecyclePublicationBatch.Type;\n\n/** Native recovery state, independent of Attempts. Hosts serialize drains per storage owner. */\nexport interface LifecyclePublicationStorage {\n  /** Select up to `limit` due owners, with a bounded pending prefix for each selected owner.\n   * `retainedOnly` excludes unmaterialized source facts, for a precommitted start prefix.\n   */\n  readonly pending: (\n    nowMillis: number,\n    limit: number,\n    options?: { readonly retainedOnly?: boolean },\n  ) => Effect.Effect<ReadonlyArray<LifecyclePublicationBatch>, LifecyclePublicationError>;\n  /** Atomically acknowledge the exact batch, retaining its identities and fingerprints. */\n  readonly acknowledge: (\n    publications: LifecyclePublicationBatch,\n  ) => Effect.Effect<void, LifecyclePublicationError>;\n  /**\n   * Claim a due owner batch and persist its retry before dispatch. Eight automatic attempts;\n   * 1s exponential backoff capped at 60s, after the dispatch timeout. The final attempt parks\n   * the payload before dispatch so process loss cannot renew its budget. False means not due.\n   */\n  readonly claim: (\n    publications: LifecyclePublicationBatch,\n    nowMillis: number,\n    timeoutMillis: number,\n  ) => Effect.Effect<boolean, LifecyclePublicationError>;\n  readonly pendingDeadline: Effect.Effect<Option.Option<number>, LifecyclePublicationError>;\n  /**\n   * Deadline for `pending(..., { retainedOnly: true })`, excluding unmaterialized source facts.\n   * Source-backed stores provide this when `pendingDeadline` also includes source intent.\n   * Otherwise `pendingDeadline` already describes retained work.\n   */\n  readonly retainedPendingDeadline?: Effect.Effect<\n    Option.Option<number>,\n    LifecyclePublicationError\n  >;\n  /** Explicit operator retry after repairing a parked owner's destination. */\n  readonly retryParked: (\n    ownerThreadId: ThreadId,\n    nowMillis: number,\n  ) => Effect.Effect<void, LifecyclePublicationError>;\n}\n\n/**\n * Publish one owner's ordered batch in one idempotent host transaction, including authorization,\n * records, receipts and delivery intents. Larger backlogs continue in later batches.\n * Return only after the entire batch commits. Retries\n * may include already committed identities plus later facts; deduplicate each fact's `id`.\n * Private input/update/result fields remain private; select declared public fields explicitly.\n * Revocation/deletion is an acknowledged domain decision, not an infrastructure retry.\n */\nexport class LifecyclePublicationHandler extends Context.Service<\n  LifecyclePublicationHandler,\n  {\n    readonly publish: (\n      publications: LifecyclePublicationBatch,\n    ) => Effect.Effect<void, LifecyclePublicationError, Scope.Scope>;\n  }\n>()(\"@effect-agent/thread/LifecyclePublicationHandler\") {}\n\n/** Adapter configuration; the opt-in layer captures its explicit Crypto requirement once. */\nexport const LifecyclePublicationConfig = Context.Reference<Option.Option<Crypto.Crypto>>(\n  \"@effect-agent/thread/LifecyclePublicationConfig\",\n  { defaultValue: () => Option.none() },\n);\n\n/** Enable native SQL obligations without changing dependencies of disabled storage assemblies. */\nexport const lifecyclePublicationLayer = Layer.effect(LifecyclePublicationConfig)(\n  Effect.map(Crypto.Crypto, Option.some),\n);\n\n/** Resolve immutable evidence by its exact native identity, never by scanning execution history. */\nconst withSource = Effect.fn(\"LifecyclePublication.withSource\")(\n  function* (publication: LifecyclePublication) {\n    if (\n      publication.source !== undefined ||\n      (publication.fact._tag === \"WorkerInputCompleted\" &&\n        publication.fact.workerThreadId !== publication.ownerThreadId)\n    )\n      return publication;\n    const fact = publication.fact;\n\n    let submissionId =\n      fact._tag === \"AbortIntentRecorded\"\n        ? fact.intent.submissionId\n        : \"submissionId\" in fact\n          ? fact.submissionId\n          : undefined;\n\n    const runId =\n      fact._tag === \"AgentUpdateEmitted\"\n        ? fact.update.runId\n        : \"runId\" in fact\n          ? fact.runId\n          : undefined;\n\n    if (submissionId === undefined && runId !== undefined) {\n      const input = yield* getRunInput({ threadId: publication.ownerThreadId, runId });\n\n      if (Option.isNone(input) || input.value.record.payload._tag !== \"UserInputRecorded\")\n        return yield* LifecyclePublicationError.make({ reason: \"unavailable\" });\n      submissionId = input.value.record.payload.submissionId;\n    }\n    if (submissionId === undefined) return publication;\n    const ledger = yield* SubmissionLedger;\n    const found = yield* ledger.lookup(SubmissionLookupById.make({ submissionId }));\n\n    if (Option.isNone(found))\n      return yield* LifecyclePublicationError.make({ reason: \"unavailable\" });\n\n    const source = yield* Schema.decodeEffect(Schema.toType(LifecyclePublicationSource))(\n      found.value,\n    );\n\n    return LifecyclePublication.make({ ...publication, source });\n  },\n  Effect.mapError((cause) => LifecyclePublicationError.make({ reason: \"unavailable\", cause })),\n);\n\n/**\n * One finite wave for the host's existing maintenance coordinator. Persist the next deadline\n * before dispatch, so interruption and process loss retain the same facts without another timer.\n * Finish independent owner batches before surfacing failures; interruption stops the wave.\n * Acknowledgements are exact and idempotent. No producer or external Tool is re-executed here.\n */\nexport const drainLifecyclePublications = Effect.fn(\"LifecyclePublication.drain\")(function* (\n  storage: LifecyclePublicationStorage,\n  timeoutMillis = 10_000,\n  limit = 4,\n  options?: { readonly retainedOnly?: boolean },\n) {\n  const handler = yield* LifecyclePublicationHandler;\n  const pending = yield* storage.pending(yield* Clock.currentTimeMillis, limit, options);\n\n  let failures: Cause.Cause<LifecyclePublicationError> = Cause.empty;\n\n  for (const batch of pending) {\n    yield* Effect.gen(function* () {\n      if (!(yield* storage.claim(batch, yield* Clock.currentTimeMillis, timeoutMillis))) return;\n      yield* Effect.scoped(\n        Effect.gen(function* () {\n          const publications = yield* Effect.forEach(batch, withSource);\n\n          yield* handler.publish(publications);\n        }),\n      ).pipe(\n        Effect.timeoutOrElse({\n          duration: timeoutMillis,\n          orElse: () => LifecyclePublicationError.make({ reason: \"unavailable\" }),\n        }),\n      );\n      yield* storage.acknowledge(batch);\n    }).pipe(\n      Effect.catchCauseIf(\n        (cause) => !Cause.hasInterrupts(cause),\n        (cause) => {\n          failures = Cause.combine(failures, cause);\n\n          return Effect.void;\n        },\n      ),\n    );\n  }\n  if (failures.reasons.length > 0) return yield* Effect.failCause(failures);\n\n  return pending.length;\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAa,6BAA6B,mBAAmB,WAAW,YAAY;CAClF,cAAc,OAAO;CACrB,UAAU,OAAO;CACjB,eAAe,OAAO;CACtB,WAAW,OAAO;CAClB,gBAAgB,OAAO;CACvB,SAAS,OAAO;CAChB,cAAc,OAAO;CACrB,cAAc,OAAO;CACrB,aAAa,OAAO;CACpB,WAAW,OAAO;CAClB,eAAe,OAAO;CACtB,iBAAiB,OAAO;CACxB,kBAAkB,OAAO;CACzB,WAAW,OAAO;AACpB,EAAE;;AAKF,MAAa,2BAA2B,OAAO,MAAM;CACnD,OAAO,aAAa,oBAAoB;EACtC,KAAK;EACL,UAAU;EACV,iBAAiB,OAAO;CAC1B,CAAC;CACD,OAAO,aAAa,mBAAmB;EACrC,KAAK;EACL,UAAU;EACV,QAAQ,OAAO,SAAS;GAAC;GAAW;GAAY;GAAa;GAAW;EAAQ,CAAC;EACjF,SAAS,OAAO,OAAO,OAAO;EAC9B,YAAY,OAAO,OAAO,UAAU;EACpC,SAAS,OAAO;CAClB,CAAC;CACD,OAAO,aAAa,qBAAqB;EACvC,UAAU;EACV,qBAAqB,OAAO,MAAM,YAAY;;EAE9C,UAAU,OAAO,OAAO,kBAAkB;CAC5C,CAAC;CACD,OAAO,aAAa,mBAAmB,EAAE,cAAc,aAAa,CAAC;CACrE,OAAO,aAAa,uBAAuB;EACzC,cAAc;EACd,QAAQ;CACV,CAAC;CACD,OAAO,aAAa,qBAAqB,EAAE,cAAc,aAAa,CAAC;CACvE,OAAO,aAAa,qBAAqB,EAAE,cAAc,aAAa,CAAC;CACvE,OAAO,aAAa,uBAAuB,EAAE,QAAQ,YAAY,CAAC;CAClE;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AASD,IAAa,uBAAb,cAA0C,OAAO,MAC/C,2CACF,CAAC,CAAC;CACA,IAAI,OAAO,eAAe,MAAM,OAAO,YAAY,IAAI,CAAC;CACxD,eAAe;CACf,SAAS,OAAO,IAAI,MAAM,OAAO,cAAc,CAAC,CAAC;CACjD,WAAW,OAAO;CAClB,mBAAmB,OAAO,YAAY,iBAAiB;CACvD,QAAQ,OAAO,YAAY,0BAA0B;CACrD,MAAM;AACR,CAAC,CAAC,CAAC,CAAC;AAEJ,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC5F,6BACA;CACE,QAAQ,OAAO,SAAS;EAAC;EAAe;EAAY;EAAW;CAAU,CAAC;CAC1E,OAAO,OAAO,YAAY,OAAO,OAAO,CAAC;AAC3C,CACF,CAAC,CAAC,CAAC;;AAGH,MAAa,oCAAoC;;AAGjD,MAAa,4BAA4B,OAAO,cAAc,oBAAoB,CAAC,CAAC,MAClF,OAAO,YAAA,CAA6C,GACpD,OAAO,YACJ,UACC,MAAM,OAAO,MAAM,UAAU;CAC3B,MAAM,WAAW,MAAM,QAAQ;CAE/B,OACE,KAAK,kBAAkB,MAAM,EAAE,CAAC,kBAC/B,aAAa,KAAA,KAAa,KAAK,UAAU,SAAS;AAEvD,CAAC,GACH,EAAE,UAAU,0DAA0D,CACxE,CACF;;;;;;;;;AAqDA,IAAa,8BAAb,cAAiD,QAAQ,QAOvD,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC;;AAGzD,MAAa,6BAA6B,QAAQ,UAChD,mDACA,EAAE,oBAAoB,OAAO,KAAK,EAAE,CACtC;;AAGA,MAAa,4BAA4B,MAAM,OAAO,0BAA0B,CAAC,CAC/E,OAAO,IAAI,OAAO,QAAQ,OAAO,IAAI,CACvC;;AAGA,MAAM,aAAa,OAAO,GAAG,iCAAiC,CAAC,CAC7D,WAAW,aAAmC;CAC5C,IACE,YAAY,WAAW,KAAA,KACtB,YAAY,KAAK,SAAS,0BACzB,YAAY,KAAK,mBAAmB,YAAY,eAElD,OAAO;CACT,MAAM,OAAO,YAAY;CAEzB,IAAI,eACF,KAAK,SAAS,wBACV,KAAK,OAAO,eACZ,kBAAkB,OAChB,KAAK,eACL,KAAA;CAER,MAAM,QACJ,KAAK,SAAS,uBACV,KAAK,OAAO,QACZ,WAAW,OACT,KAAK,QACL,KAAA;CAER,IAAI,iBAAiB,KAAA,KAAa,UAAU,KAAA,GAAW;EACrD,MAAM,QAAQ,OAAO,YAAY;GAAE,UAAU,YAAY;GAAe;EAAM,CAAC;EAE/E,IAAI,OAAO,OAAO,KAAK,KAAK,MAAM,MAAM,OAAO,QAAQ,SAAS,qBAC9D,OAAO,OAAO,0BAA0B,KAAK,EAAE,QAAQ,cAAc,CAAC;EACxE,eAAe,MAAM,MAAM,OAAO,QAAQ;CAC5C;CACA,IAAI,iBAAiB,KAAA,GAAW,OAAO;CAEvC,MAAM,QAAQ,QAAO,OADC,iBAAA,CACM,OAAO,qBAAqB,KAAK,EAAE,aAAa,CAAC,CAAC;CAE9E,IAAI,OAAO,OAAO,KAAK,GACrB,OAAO,OAAO,0BAA0B,KAAK,EAAE,QAAQ,cAAc,CAAC;CAExE,MAAM,SAAS,OAAO,OAAO,aAAa,OAAO,OAAO,0BAA0B,CAAC,CAAC,CAClF,MAAM,KACR;CAEA,OAAO,qBAAqB,KAAK;EAAE,GAAG;EAAa;CAAO,CAAC;AAC7D,GACA,OAAO,UAAU,UAAU,0BAA0B,KAAK;CAAE,QAAQ;CAAe;AAAM,CAAC,CAAC,CAC7F;;;;;;;AAQA,MAAa,6BAA6B,OAAO,GAAG,4BAA4B,CAAC,CAAC,WAChF,SACA,gBAAgB,KAChB,QAAQ,GACR,SACA;CACA,MAAM,UAAU,OAAO;CACvB,MAAM,UAAU,OAAO,QAAQ,QAAQ,OAAO,MAAM,mBAAmB,OAAO,OAAO;CAErF,IAAI,WAAmD,MAAM;CAE7D,KAAK,MAAM,SAAS,SAClB,OAAO,OAAO,IAAI,aAAa;EAC7B,IAAI,EAAE,OAAO,QAAQ,MAAM,OAAO,OAAO,MAAM,mBAAmB,aAAa,IAAI;EACnF,OAAO,OAAO,OACZ,OAAO,IAAI,aAAa;GACtB,MAAM,eAAe,OAAO,OAAO,QAAQ,OAAO,UAAU;GAE5D,OAAO,QAAQ,QAAQ,YAAY;EACrC,CAAC,CACH,CAAC,CAAC,KACA,OAAO,cAAc;GACnB,UAAU;GACV,cAAc,0BAA0B,KAAK,EAAE,QAAQ,cAAc,CAAC;EACxE,CAAC,CACH;EACA,OAAO,QAAQ,YAAY,KAAK;CAClC,CAAC,CAAC,CAAC,KACD,OAAO,cACJ,UAAU,CAAC,MAAM,cAAc,KAAK,IACpC,UAAU;EACT,WAAW,MAAM,QAAQ,UAAU,KAAK;EAExC,OAAO,OAAO;CAChB,CACF,CACF;CAEF,IAAI,SAAS,QAAQ,SAAS,GAAG,OAAO,OAAO,OAAO,UAAU,QAAQ;CAExE,OAAO,QAAQ;AACjB,CAAC"}