@sixb/core 0.0.1

package/dist/chunk-0fygrz37.js

@@ -0,0 +1,354 @@
+// @bun
+import {
+  projectionTargetOf
+} from "./chunk-btpe64e4.js";
+
+// src/authorization/errors.ts
+class AuthorizationError extends Error {
+  grantKey;
+  name = "AuthorizationError";
+  constructor(grantKey, message) {
+    super(message);
+    this.grantKey = grantKey;
+  }
+}
+
+// src/authorization/decision.ts
+function atomsFor(request) {
+  switch (request.kind) {
+    case "application.access":
+      return [{ kind: "access:application", id: request.audience }];
+    case "object.view":
+      return [{ kind: "view:object", id: request.objectTypeId }];
+    case "dataset.view":
+      return [{ kind: "view:dataset", id: request.datasetId }];
+    case "object.edit":
+      return [{ kind: "edit:object", id: request.objectTypeId }];
+    case "telemetry.append":
+      return [{ kind: "append:telemetry", id: request.objectTypeId }];
+    case "action.apply":
+      return [{ kind: "apply:action", id: request.actionId }];
+    case "workflow.run":
+      return [{ kind: "run:workflow", id: request.workflowId }];
+    case "sync.run":
+      return [{ kind: "run:sync", id: request.syncId }];
+    case "pipeline.run":
+      return [{ kind: "run:pipeline", id: request.pipelineId }];
+    case "agent.run":
+      return [{ kind: "run:agent", id: request.agentId }];
+    case "logs.observe":
+      return [{ kind: "observe:logs", id: "logs" }];
+    case "object.query":
+      return request.touchedObjectTypeIds.map((id) => ({ kind: "view:object", id }));
+  }
+}
+function atomKey(atom) {
+  if (atom.kind === "observe:logs")
+    return atom.kind;
+  return `${atom.kind}:${atom.id}`;
+}
+function holds(grants, atom) {
+  return grants[atom.kind].has(atom.id);
+}
+function evaluate(authorization, request) {
+  const atoms = atomsFor(request);
+  const requirements = atoms.map(atomKey);
+  const missing = authorization ? atoms.filter((atom) => !holds(authorization.grants, atom)).map(atomKey) : [];
+  return { allowed: missing.length === 0, requirements, missing };
+}
+function isAllowed(authorization, request) {
+  return evaluate(authorization, request).allowed;
+}
+function assertAuthorized(runtime, request) {
+  const decision = evaluate(runtime.authorization, request);
+  if (decision.allowed) {
+    return;
+  }
+  throw new AuthorizationError(decision.missing[0] ?? request.kind, deniedMessage(runtime.authorization, request));
+}
+function assertCanEdit(runtime, objectTypeId) {
+  assertAuthorized(runtime, { kind: "object.view", objectTypeId });
+  assertAuthorized(runtime, { kind: "object.edit", objectTypeId });
+}
+function assertCanAppendTelemetry(runtime, objectTypeId) {
+  assertAuthorized(runtime, { kind: "telemetry.append", objectTypeId });
+}
+function assertPrivileged(runtime, operation) {
+  if (!runtime.authorization) {
+    return;
+  }
+  throw new AuthorizationError(`privileged:${operation}`, `[Sixb] Operation '${operation}' is not covered by scoped authorization grants.`);
+}
+function deniedMessage(authorization, request) {
+  const principalId = authorization?.principal.id ?? "unknown";
+  switch (request.kind) {
+    case "application.access":
+      return `[Sixb] Principal '${principalId}' is not allowed to access application '${request.audience}'.`;
+    case "object.view":
+      return `[Sixb] Principal '${principalId}' is not allowed to view object type '${request.objectTypeId}'.`;
+    case "dataset.view":
+      return `[Sixb] Principal '${principalId}' is not allowed to view dataset '${request.datasetId}'.`;
+    case "object.edit":
+      return `[Sixb] Principal '${principalId}' is not allowed to write object type '${request.objectTypeId}'.`;
+    case "telemetry.append":
+      return `[Sixb] Principal '${principalId}' is not allowed to append telemetry for object type '${request.objectTypeId}'.`;
+    case "action.apply":
+      return `[Sixb] Principal '${principalId}' is not allowed to apply action '${request.actionId}'.`;
+    case "workflow.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to run workflow '${request.workflowId}'.`;
+    case "sync.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to run sync '${request.syncId}'.`;
+    case "pipeline.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to run pipeline '${request.pipelineId}'.`;
+    case "agent.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to run agent '${request.agentId}'.`;
+    case "logs.observe":
+      return `[Sixb] Principal '${principalId}' is not allowed to observe project logs.`;
+    case "object.query": {
+      const blocked = request.touchedObjectTypeIds.find((objectTypeId) => !isAllowed(authorization, { kind: "object.view", objectTypeId }));
+      return `[Sixb] Principal '${principalId}' is not allowed to view object type '${blocked}'.`;
+    }
+  }
+}
+
+// src/authorization/application-access.ts
+function isApplicationAccessControlled(roles, audience) {
+  return roles.some((role) => role.grants["access:application"].has(audience));
+}
+function canAccessApplication(authorization, roles, audience) {
+  return !isApplicationAccessControlled(roles, audience) || isAllowed(authorization, { kind: "application.access", audience });
+}
+// src/authorization/event-visibility.ts
+function canViewEvent(authorization, event) {
+  if (!authorization) {
+    return true;
+  }
+  switch (event.topic) {
+    case "objects":
+    case "telemetry":
+      return isAllowed(authorization, {
+        kind: "object.view",
+        objectTypeId: event.payload.objectTypeId
+      });
+    case "links":
+      return isAllowed(authorization, {
+        kind: "object.view",
+        objectTypeId: event.payload.sourceTypeId
+      }) && isAllowed(authorization, { kind: "object.view", objectTypeId: event.payload.targetTypeId });
+    case "actions": {
+      if (!isAllowed(authorization, { kind: "action.apply", actionId: event.payload.actionId })) {
+        return false;
+      }
+      const subject = event.payload.subject;
+      return subject.kind === "object" ? isAllowed(authorization, { kind: "object.view", objectTypeId: subject.objectTypeId }) : true;
+    }
+    case "workflows":
+      return isAllowed(authorization, {
+        kind: "workflow.run",
+        workflowId: event.payload.workflowId
+      });
+    case "rules":
+      return isAllowed(authorization, {
+        kind: "object.view",
+        objectTypeId: event.payload.subject.objectTypeId
+      });
+    case "syncs":
+      return isAllowed(authorization, {
+        kind: "sync.run",
+        syncId: event.payload.syncId
+      });
+    case "pipelines":
+      return isAllowed(authorization, {
+        kind: "pipeline.run",
+        pipelineId: event.payload.pipelineId
+      });
+    case "schedules":
+      return true;
+    case "datasets":
+      return isAllowed(authorization, {
+        kind: "dataset.view",
+        datasetId: event.payload.datasetId
+      });
+    default:
+      return false;
+  }
+}
+// src/authorization/grant-kinds.ts
+var GRANT_KINDS = {
+  "access:application": {
+    universeKey: "applicationIds",
+    subject: "application",
+    fix: "Use an application exported from '@sixb/core'."
+  },
+  "view:object": {
+    universeKey: "objectTypeIds",
+    subject: "object type",
+    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies }).",
+    expandsSubtypes: true
+  },
+  "view:dataset": {
+    universeKey: "datasetIds",
+    subject: "dataset",
+    fix: "Add it to 'datasets/' or pass it to createSixb({ datasets })."
+  },
+  "edit:object": {
+    universeKey: "objectTypeIds",
+    subject: "object type",
+    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies })."
+  },
+  "append:telemetry": {
+    universeKey: "objectTypeIds",
+    subject: "object type",
+    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies })."
+  },
+  "apply:action": {
+    universeKey: "actionIds",
+    subject: "action",
+    fix: "Add it to 'actions/' or pass it to createSixb({ actions })."
+  },
+  "run:workflow": {
+    universeKey: "workflowIds",
+    subject: "workflow",
+    fix: "Add it to 'workflows/' or pass it to createSixb({ workflows })."
+  },
+  "run:sync": {
+    universeKey: "syncIds",
+    subject: "sync",
+    fix: "Add it to 'syncs/' or pass it to createSixb({ syncs })."
+  },
+  "run:pipeline": {
+    universeKey: "pipelineIds",
+    subject: "pipeline",
+    fix: "Add it to 'pipelines/' or pass it to createSixb({ pipelines })."
+  },
+  "run:agent": {
+    universeKey: "agentIds",
+    subject: "agent",
+    fix: "Add it to 'agents/' or pass it to createSixb({ agents })."
+  },
+  "observe:logs": {
+    universeKey: "observableIds",
+    subject: "observability surface",
+    fix: 'Use can.observe("logs").'
+  }
+};
+var GRANT_KIND_KEYS = Object.keys(GRANT_KINDS);
+function grantKindOf(grant) {
+  switch (grant.capability) {
+    case "access":
+      return "access:application";
+    case "view":
+      return `view:${grant.target}`;
+    case "edit":
+      return "edit:object";
+    case "append":
+      return "append:telemetry";
+    case "apply":
+      return "apply:action";
+    case "run":
+      return `run:${grant.target}`;
+    case "observe":
+      return "observe:logs";
+  }
+}
+function emptyGrantSets() {
+  const sets = {};
+  for (const kind of GRANT_KIND_KEYS) {
+    sets[kind] = new Set;
+  }
+  return sets;
+}
+
+// src/authorization/resolve.ts
+function resolveRoleGrants(role, universe) {
+  const grants = emptyGrantSets();
+  for (const grant of role.grants) {
+    const kind = grantKindOf(grant);
+    const spec = GRANT_KINDS[kind];
+    expandSelection(grant.selection, universe[spec.universeKey], grants[kind], spec.expandsSubtypes ? universe.getSubTypes : undefined);
+  }
+  return grants;
+}
+function expandSelection(selection, universe, into, expand) {
+  if (selection.all) {
+    const except = new Set(selection.except);
+    for (const id of universe) {
+      if (!except.has(id)) {
+        into.add(id);
+      }
+    }
+    return;
+  }
+  for (const id of selection.ids) {
+    into.add(id);
+    if (expand) {
+      for (const subTypeId of expand(id)) {
+        into.add(subTypeId);
+      }
+    }
+  }
+}
+function resolveAuthorizationContext(input) {
+  const memberGroupIds = new Set(input.groupIds);
+  const roleIds = [];
+  const grants = emptyGrantSets();
+  for (const role of input.roles) {
+    if (!role.grantedToGroupIds.some((groupId) => memberGroupIds.has(groupId))) {
+      continue;
+    }
+    roleIds.push(role.id);
+    for (const kind of GRANT_KIND_KEYS) {
+      for (const id of role.grants[kind]) {
+        grants[kind].add(id);
+      }
+    }
+  }
+  return {
+    principal: input.principal,
+    ...input.sessionId !== undefined ? { sessionId: input.sessionId } : {},
+    groupIds: input.groupIds,
+    roleIds,
+    grants
+  };
+}
+// src/authorization/run-visibility.ts
+function canViewActionRun(authorization, run) {
+  if (!authorization) {
+    return true;
+  }
+  if (!isAllowed(authorization, { kind: "action.apply", actionId: run.actionId })) {
+    return false;
+  }
+  return run.subject.kind !== "object" ? true : isAllowed(authorization, {
+    kind: "object.view",
+    objectTypeId: run.subject.objectTypeId
+  });
+}
+function canViewWorkflowRun(authorization, run) {
+  return !authorization || isAllowed(authorization, { kind: "workflow.run", workflowId: run.workflowId });
+}
+function canViewWorkflowIntervention(authorization, intervention) {
+  return !authorization || isAllowed(authorization, { kind: "workflow.run", workflowId: intervention.workflowId });
+}
+function canViewPipelineRun(authorization, run) {
+  return !authorization || isAllowed(authorization, { kind: "pipeline.run", pipelineId: run.pipelineId });
+}
+function canViewProjectionRun(authorization, target) {
+  if (!authorization)
+    return true;
+  const canView = (objectTypeId) => isAllowed(authorization, { kind: "object.view", objectTypeId });
+  if ("sourceObjectTypeId" in target) {
+    return canView(target.sourceObjectTypeId) && canView(target.targetObjectTypeId);
+  }
+  return canView(target.objectTypeId);
+}
+function canViewProjection(authorization, projection) {
+  return canViewProjectionRun(authorization, projectionTargetOf(projection));
+}
+// src/authorization/types.ts
+function emptyGrantIndex() {
+  return emptyGrantSets();
+}
+export { AuthorizationError, evaluate, isAllowed, assertAuthorized, assertCanEdit, assertCanAppendTelemetry, assertPrivileged, isApplicationAccessControlled, canAccessApplication, canViewEvent, GRANT_KINDS, grantKindOf, resolveRoleGrants, resolveAuthorizationContext, canViewActionRun, canViewWorkflowRun, canViewWorkflowIntervention, canViewPipelineRun, canViewProjectionRun, canViewProjection, emptyGrantIndex };
+
+//# debugId=9E384F7E3DAB4DE464756E2164756E21

package/dist/chunk-0fygrz37.js.map

@@ -0,0 +1,17 @@
+{
+  "version": 3,
+  "sources": ["../src/authorization/errors.ts", "../src/authorization/decision.ts", "../src/authorization/application-access.ts", "../src/authorization/event-visibility.ts", "../src/authorization/grant-kinds.ts", "../src/authorization/resolve.ts", "../src/authorization/run-visibility.ts", "../src/authorization/types.ts"],
+  "sourcesContent": [
+    "/** Thrown when a scoped operation is not covered by the principal's grants. Maps to HTTP 403. */\nexport class AuthorizationError extends Error {\n  readonly name = \"AuthorizationError\"\n\n  constructor(\n    /** Stable key of the missing grant, e.g. `view:object:Contract`. */\n    readonly grantKey: string,\n    message: string\n  ) {\n    super(message)\n  }\n}\n",
+    "/**\n * Authorization decisions for the core data path.\n *\n * `evaluate` is the single place that maps a request to the resolved grant\n * index. `can` (boolean) and `assertAuthorized` (throw) are the two ways to\n * consume a decision; every enforcement site goes through one of them.\n *\n * A missing authorization context means a privileged caller (raw `sixb`,\n * syncs, workers, tests) — everything is allowed. Scoped contexts are\n * default-deny: a request without a covering grant is denied.\n *\n * SECURITY — this makes \"privileged\" the silent default: any caller that\n * reaches a leaf without an authorization context bypasses all grant checks.\n * That is intended for internal callers, but it means HTTP routes serving\n * authenticated principals must go through the scoped runtime (`sixb.as(ctx)`),\n * never the raw runtime. See `RequestAuthState` in the server for the rule.\n */\n\nimport type { AuthSessionAudience } from \"../auth/audience\"\nimport { AuthorizationError } from \"./errors\"\nimport type { GrantKind } from \"./grant-kinds\"\nimport type { AuthorizationContext, GrantIndex } from \"./types\"\n\n/** Something a principal may attempt, paired with the resource it targets. */\nexport type AuthzRequest =\n  | { readonly kind: \"application.access\"; readonly audience: AuthSessionAudience }\n  | { readonly kind: \"object.view\"; readonly objectTypeId: string }\n  | { readonly kind: \"dataset.view\"; readonly datasetId: string }\n  | { readonly kind: \"object.edit\"; readonly objectTypeId: string }\n  | { readonly kind: \"telemetry.append\"; readonly objectTypeId: string }\n  | { readonly kind: \"action.apply\"; readonly actionId: string }\n  | { readonly kind: \"workflow.run\"; readonly workflowId: string }\n  | { readonly kind: \"sync.run\"; readonly syncId: string }\n  | { readonly kind: \"pipeline.run\"; readonly pipelineId: string }\n  | { readonly kind: \"agent.run\"; readonly agentId: string }\n  | { readonly kind: \"logs.observe\" }\n  | { readonly kind: \"object.query\"; readonly touchedObjectTypeIds: readonly string[] }\n\nexport interface AuthzDecision {\n  readonly allowed: boolean\n  /** Grant keys the request needs, e.g. `view:object:quote`. */\n  readonly requirements: readonly string[]\n  /** Required keys the principal lacks; empty when allowed. */\n  readonly missing: readonly string[]\n}\n\ninterface AuthorizedRuntime {\n  readonly authorization?: AuthorizationContext\n}\n\n// A request expands to one or more atomic (grant kind, id) checks. The atom is\n// the single unit that both names a requirement and tests the grant index, so\n// the two can never drift. `kind` is the resolved-index key, so enforcement is\n// a direct lookup with no per-target dispatch.\ninterface Atom {\n  readonly kind: GrantKind\n  readonly id: string\n}\n\nfunction atomsFor(request: AuthzRequest): readonly Atom[] {\n  switch (request.kind) {\n    case \"application.access\":\n      return [{ kind: \"access:application\", id: request.audience }]\n    case \"object.view\":\n      return [{ kind: \"view:object\", id: request.objectTypeId }]\n    case \"dataset.view\":\n      return [{ kind: \"view:dataset\", id: request.datasetId }]\n    case \"object.edit\":\n      return [{ kind: \"edit:object\", id: request.objectTypeId }]\n    case \"telemetry.append\":\n      return [{ kind: \"append:telemetry\", id: request.objectTypeId }]\n    case \"action.apply\":\n      return [{ kind: \"apply:action\", id: request.actionId }]\n    case \"workflow.run\":\n      return [{ kind: \"run:workflow\", id: request.workflowId }]\n    case \"sync.run\":\n      return [{ kind: \"run:sync\", id: request.syncId }]\n    case \"pipeline.run\":\n      return [{ kind: \"run:pipeline\", id: request.pipelineId }]\n    case \"agent.run\":\n      return [{ kind: \"run:agent\", id: request.agentId }]\n    case \"logs.observe\":\n      return [{ kind: \"observe:logs\", id: \"logs\" }]\n    case \"object.query\":\n      return request.touchedObjectTypeIds.map((id) => ({ kind: \"view:object\", id }))\n  }\n}\n\nfunction atomKey(atom: Atom): string {\n  if (atom.kind === \"observe:logs\") return atom.kind\n  return `${atom.kind}:${atom.id}`\n}\n\nfunction holds(grants: GrantIndex, atom: Atom): boolean {\n  return grants[atom.kind].has(atom.id)\n}\n\n/** Resolve a request against a principal's grants. Never throws. */\nexport function evaluate(\n  authorization: AuthorizationContext | null | undefined,\n  request: AuthzRequest\n): AuthzDecision {\n  const atoms = atomsFor(request)\n  const requirements = atoms.map(atomKey)\n  const missing = authorization\n    ? atoms.filter((atom) => !holds(authorization.grants, atom)).map(atomKey)\n    : []\n  return { allowed: missing.length === 0, requirements, missing }\n}\n\nexport function isAllowed(\n  authorization: AuthorizationContext | null | undefined,\n  request: AuthzRequest\n): boolean {\n  return evaluate(authorization, request).allowed\n}\n\nexport function assertAuthorized(runtime: AuthorizedRuntime, request: AuthzRequest): void {\n  const decision = evaluate(runtime.authorization, request)\n  if (decision.allowed) {\n    return\n  }\n\n  throw new AuthorizationError(\n    decision.missing[0] ?? request.kind,\n    deniedMessage(runtime.authorization, request)\n  )\n}\n\n/**\n * Assert a principal may write objects of this type.\n *\n * Requires `view:object` as well as `edit:object`, and that is not belt-and-braces: an upsert\n * returns the *merged* row, which the Materializer reconciles against source authority, so the\n * response can carry properties the caller never sent. Granting the write without the read would\n * leak them.\n *\n * The pairing is asserted here rather than implied during resolution: `resolveRoleGrants` has no\n * notion of one grant entailing another, and giving it one would put ids in the resolved index that\n * no role granted — an index that no longer answers \"what was actually granted\".\n *\n * Telemetry append is deliberately *not* paired this way; see {@link assertCanAppendTelemetry}.\n */\nexport function assertCanEdit(runtime: AuthorizedRuntime, objectTypeId: string): void {\n  assertAuthorized(runtime, { kind: \"object.view\", objectTypeId })\n  assertAuthorized(runtime, { kind: \"object.edit\", objectTypeId })\n}\n\n/**\n * Assert a principal may append telemetry points to objects of this type.\n *\n * No `view:object` requirement, unlike {@link assertCanEdit}: an append answers with no object\n * state, so there is nothing to leak. That is what makes a write-only principal — a device, an\n * ingestion service — expressible at all, and it is the reason telemetry has its own grant.\n */\nexport function assertCanAppendTelemetry(runtime: AuthorizedRuntime, objectTypeId: string): void {\n  assertAuthorized(runtime, { kind: \"telemetry.append\", objectTypeId })\n}\n\n/**\n * Fail closed for operations that have no grant semantics yet.\n *\n * One caller left — `listLinks`, whose rows reveal target types that no read grant covers. Object,\n * link, and telemetry writes moved to {@link assertCanEdit} / {@link assertCanAppendTelemetry}.\n * Keeps unsupported surfaces denied even if a scoped runtime context reaches a code path the scoped\n * SDK does not expose.\n */\nexport function assertPrivileged(runtime: AuthorizedRuntime, operation: string): void {\n  if (!runtime.authorization) {\n    return\n  }\n\n  throw new AuthorizationError(\n    `privileged:${operation}`,\n    `[Sixb] Operation '${operation}' is not covered by scoped authorization grants.`\n  )\n}\n\nfunction deniedMessage(\n  authorization: AuthorizationContext | null | undefined,\n  request: AuthzRequest\n): string {\n  const principalId = authorization?.principal.id ?? \"unknown\"\n  switch (request.kind) {\n    case \"application.access\":\n      return `[Sixb] Principal '${principalId}' is not allowed to access application '${request.audience}'.`\n    case \"object.view\":\n      return `[Sixb] Principal '${principalId}' is not allowed to view object type '${request.objectTypeId}'.`\n    case \"dataset.view\":\n      return `[Sixb] Principal '${principalId}' is not allowed to view dataset '${request.datasetId}'.`\n    case \"object.edit\":\n      return `[Sixb] Principal '${principalId}' is not allowed to write object type '${request.objectTypeId}'.`\n    case \"telemetry.append\":\n      return `[Sixb] Principal '${principalId}' is not allowed to append telemetry for object type '${request.objectTypeId}'.`\n    case \"action.apply\":\n      return `[Sixb] Principal '${principalId}' is not allowed to apply action '${request.actionId}'.`\n    case \"workflow.run\":\n      return `[Sixb] Principal '${principalId}' is not allowed to run workflow '${request.workflowId}'.`\n    case \"sync.run\":\n      return `[Sixb] Principal '${principalId}' is not allowed to run sync '${request.syncId}'.`\n    case \"pipeline.run\":\n      return `[Sixb] Principal '${principalId}' is not allowed to run pipeline '${request.pipelineId}'.`\n    case \"agent.run\":\n      return `[Sixb] Principal '${principalId}' is not allowed to run agent '${request.agentId}'.`\n    case \"logs.observe\":\n      return `[Sixb] Principal '${principalId}' is not allowed to observe project logs.`\n    case \"object.query\": {\n      // Name the first touched type the principal cannot view.\n      const blocked = request.touchedObjectTypeIds.find(\n        (objectTypeId) => !isAllowed(authorization, { kind: \"object.view\", objectTypeId })\n      )\n      return `[Sixb] Principal '${principalId}' is not allowed to view object type '${blocked}'.`\n    }\n  }\n}\n",
+    "import type { AuthSessionAudience } from \"../auth/audience\"\nimport { isAllowed } from \"./decision\"\nimport type { AuthorizationContext, ResolvedRole } from \"./types\"\n\n/** Whether declaring roles has enabled an allowlist for an application. */\nexport function isApplicationAccessControlled(\n  roles: readonly ResolvedRole[],\n  audience: AuthSessionAudience\n): boolean {\n  return roles.some((role) => role.grants[\"access:application\"].has(audience))\n}\n\n/**\n * Whether this principal may open this application.\n *\n * KNOWN LIMITATION (0.1.x): application access is the one capability that is **not** deny-by-default.\n * While no role mentions an application, every authenticated principal may open it; the allowlist only\n * switches on once some role grants it. Every other capability — `view`, `apply`, `run`, `observe` —\n * denies unless granted, so this is the single asymmetry in the model.\n *\n * It is deliberate for now: flipping it would lock every project out of Atlas until it declares a role,\n * including projects with no security definitions at all. Closing it means shipping a default grant with\n * the scaffold first, and it is a breaking change for any project relying on the open default.\n */\nexport function canAccessApplication(\n  authorization: AuthorizationContext,\n  roles: readonly ResolvedRole[],\n  audience: AuthSessionAudience\n): boolean {\n  return (\n    !isApplicationAccessControlled(roles, audience) ||\n    isAllowed(authorization, { kind: \"application.access\", audience })\n  )\n}\n",
+    "/**\n * Event visibility derived from grants.\n *\n * There is no standalone \"view events\" capability: a principal sees a domain\n * event only when it can view/apply/run the event's subject. A privileged\n * caller (no authorization context) sees everything.\n *\n * The topic switch is fail-closed: an unrecognized topic is hidden, because a\n * topic we don't yet model may carry a subject the principal is not allowed to\n * see. Adding an event topic therefore requires an explicit visibility decision\n * here, never a silent default.\n */\n\nimport type { StoredDomainEvent } from \"../events\"\nimport { isAllowed } from \"./decision\"\nimport type { AuthorizationContext } from \"./types\"\n\nexport function canViewEvent(\n  authorization: AuthorizationContext | null | undefined,\n  event: StoredDomainEvent\n): boolean {\n  if (!authorization) {\n    return true\n  }\n\n  switch (event.topic) {\n    case \"objects\":\n    case \"telemetry\":\n      return isAllowed(authorization, {\n        kind: \"object.view\",\n        objectTypeId: event.payload.objectTypeId,\n      })\n    case \"links\":\n      return (\n        isAllowed(authorization, {\n          kind: \"object.view\",\n          objectTypeId: event.payload.sourceTypeId,\n        }) &&\n        isAllowed(authorization, { kind: \"object.view\", objectTypeId: event.payload.targetTypeId })\n      )\n    case \"actions\": {\n      // Apply is necessary; for object-bound actions the principal must also be\n      // able to view the subject type, or the event would leak a hidden\n      // object's id/type — mirroring the rule in `canListAction`.\n      if (!isAllowed(authorization, { kind: \"action.apply\", actionId: event.payload.actionId })) {\n        return false\n      }\n      const subject = event.payload.subject\n      return subject.kind === \"object\"\n        ? isAllowed(authorization, { kind: \"object.view\", objectTypeId: subject.objectTypeId })\n        : true\n    }\n    case \"workflows\":\n      return isAllowed(authorization, {\n        kind: \"workflow.run\",\n        workflowId: event.payload.workflowId,\n      })\n    case \"rules\":\n      // Rule events carry the object they fired on, so gate on viewing it —\n      // otherwise they leak the existence and id of hidden-type objects.\n      return isAllowed(authorization, {\n        kind: \"object.view\",\n        objectTypeId: event.payload.subject.objectTypeId,\n      })\n    // Run grant gates the operational stream. These payloads may also carry the\n    // produced datasetId/versionId; that target is already visible to a runner\n    // through the sync/pipeline catalog (`sync.target.dataset`), so surfacing it\n    // here discloses nothing new.\n    case \"syncs\":\n      return isAllowed(authorization, {\n        kind: \"sync.run\",\n        syncId: event.payload.syncId,\n      })\n    case \"pipelines\":\n      return isAllowed(authorization, {\n        kind: \"pipeline.run\",\n        pipelineId: event.payload.pipelineId,\n      })\n    case \"schedules\":\n      // Infra topics with no object/action/workflow/dataset subject: no grant\n      // governs them yet, so they stay visible to any authorized reader. When\n      // they gain their own grants, add the checks here.\n      return true\n    case \"datasets\":\n      // dataset.view alone. The payload's `producer` (the sync/pipeline that\n      // produced the version, plus its runId) is intentionally visible to any\n      // dataset viewer as provenance — the same identity the versions API\n      // already serializes for that principal. This is distinct from the\n      // operational `references` in the dataset catalog (which syncs/pipelines\n      // are wired to a dataset), which stays gated on the run grants.\n      return isAllowed(authorization, {\n        kind: \"dataset.view\",\n        datasetId: event.payload.datasetId,\n      })\n    default:\n      // Fail closed: an unmodeled topic may carry a subject we don't yet gate.\n      return false\n  }\n}\n",
+    "/**\n * Grant kinds: the single source of truth for the (capability, target) space.\n *\n * Every grant collapses to one `GrantKind` discriminant — the same\n * `capability:target` string the decision engine uses as a grant key (e.g.\n * `view:object`, `run:sync`). Resolution, validation, enforcement, and the\n * resolved `GrantIndex` all key off it, so adding a grant family is a single\n * entry in `GRANT_KINDS` plus the compile errors that forces at every consumer.\n */\n\nimport type { GrantDefinition } from \"../security/types\"\n\nexport type GrantKind =\n  | \"access:application\"\n  | \"view:object\"\n  | \"view:dataset\"\n  | \"edit:object\"\n  | \"append:telemetry\"\n  | \"apply:action\"\n  | \"run:workflow\"\n  | \"run:sync\"\n  | \"run:pipeline\"\n  | \"run:agent\"\n  | \"observe:logs\"\n\n/** Registered id universes a grant kind ranges over, plus subtype expansion. */\nexport interface GrantUniverse {\n  readonly applicationIds: ReadonlySet<string>\n  readonly objectTypeIds: ReadonlySet<string>\n  readonly datasetIds: ReadonlySet<string>\n  readonly actionIds: ReadonlySet<string>\n  readonly workflowIds: ReadonlySet<string>\n  readonly syncIds: ReadonlySet<string>\n  readonly pipelineIds: ReadonlySet<string>\n  readonly agentIds: ReadonlySet<string>\n  readonly observableIds: ReadonlySet<string>\n  readonly getSubTypes: (objectTypeId: string) => readonly string[]\n}\n\n/** The registered-id sets a grant kind validates against (no subtype hook). */\nexport type GrantUniverseKey = Exclude<keyof GrantUniverse, \"getSubTypes\">\n\ninterface GrantKindSpec {\n  /** Registered universe the grant's ids must belong to. */\n  readonly universeKey: GrantUniverseKey\n  /** Subject noun used in validation errors (\"unknown <subject> '<id>'\"). */\n  readonly subject: string\n  /** Actionable hint appended to the \"unknown <subject>\" error. */\n  readonly fix: string\n  /** Only object-type grants also expand to subtypes. */\n  readonly expandsSubtypes?: true\n}\n\n/**\n * The exhaustive grant-kind table. A new grant family is one entry here; the\n * `Record<GrantKind, …>` makes every omission a compile error.\n */\nexport const GRANT_KINDS: Record<GrantKind, GrantKindSpec> = {\n  \"access:application\": {\n    universeKey: \"applicationIds\",\n    subject: \"application\",\n    fix: \"Use an application exported from '@sixb/core'.\",\n  },\n  \"view:object\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n    expandsSubtypes: true,\n  },\n  \"view:dataset\": {\n    universeKey: \"datasetIds\",\n    subject: \"dataset\",\n    fix: \"Add it to 'datasets/' or pass it to createSixb({ datasets }).\",\n  },\n  // Deliberately no `expandsSubtypes`: granting writes on a parent type must not\n  // silently extend to types added under it later. `view:object` expands because\n  // a read of a subtype reveals nothing the parent's grant did not already cover.\n  \"edit:object\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n  },\n  \"append:telemetry\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n  },\n  \"apply:action\": {\n    universeKey: \"actionIds\",\n    subject: \"action\",\n    fix: \"Add it to 'actions/' or pass it to createSixb({ actions }).\",\n  },\n  \"run:workflow\": {\n    universeKey: \"workflowIds\",\n    subject: \"workflow\",\n    fix: \"Add it to 'workflows/' or pass it to createSixb({ workflows }).\",\n  },\n  \"run:sync\": {\n    universeKey: \"syncIds\",\n    subject: \"sync\",\n    fix: \"Add it to 'syncs/' or pass it to createSixb({ syncs }).\",\n  },\n  \"run:pipeline\": {\n    universeKey: \"pipelineIds\",\n    subject: \"pipeline\",\n    fix: \"Add it to 'pipelines/' or pass it to createSixb({ pipelines }).\",\n  },\n  \"run:agent\": {\n    universeKey: \"agentIds\",\n    subject: \"agent\",\n    fix: \"Add it to 'agents/' or pass it to createSixb({ agents }).\",\n  },\n  \"observe:logs\": {\n    universeKey: \"observableIds\",\n    subject: \"observability surface\",\n    fix: 'Use can.observe(\"logs\").',\n  },\n}\n\nexport const GRANT_KIND_KEYS = Object.keys(GRANT_KINDS) as readonly GrantKind[]\n\n/** The grant kind a stored grant resolves to. */\nexport function grantKindOf(grant: GrantDefinition): GrantKind {\n  switch (grant.capability) {\n    case \"access\":\n      return \"access:application\"\n    case \"view\":\n      return `view:${grant.target}`\n    case \"edit\":\n      return \"edit:object\"\n    case \"append\":\n      return \"append:telemetry\"\n    case \"apply\":\n      return \"apply:action\"\n    case \"run\":\n      return `run:${grant.target}`\n    case \"observe\":\n      return \"observe:logs\"\n  }\n}\n\n/** A fresh, mutable grant index with one empty id set per kind. */\nexport function emptyGrantSets(): Record<GrantKind, Set<string>> {\n  const sets = {} as Record<GrantKind, Set<string>>\n  for (const kind of GRANT_KIND_KEYS) {\n    sets[kind] = new Set<string>()\n  }\n  return sets\n}\n",
+    "import type { Principal } from \"../auth/types\"\nimport type { RoleDefinition, Selection } from \"../security\"\nimport {\n  emptyGrantSets,\n  GRANT_KIND_KEYS,\n  GRANT_KINDS,\n  type GrantUniverse,\n  grantKindOf,\n} from \"./grant-kinds\"\nimport type { AuthorizationContext, GrantIndex, ResolvedRole } from \"./types\"\n\n/**\n * Expand a role's grants into concrete id sets once at startup.\n *\n * Broad grants (`every.object().except([...])`) expand against the registered\n * universe; object-type grants also expand to subtypes. The result holds only\n * `Set`s, so per-request resolution and runtime checks stay simple `set.has`.\n * The per-kind universe and subtype rules come from the `GRANT_KINDS` table, so\n * this loop never enumerates targets by hand.\n */\nexport function resolveRoleGrants(role: RoleDefinition, universe: GrantUniverse): GrantIndex {\n  const grants = emptyGrantSets()\n\n  for (const grant of role.grants) {\n    const kind = grantKindOf(grant)\n    const spec = GRANT_KINDS[kind]\n    expandSelection(\n      grant.selection,\n      universe[spec.universeKey],\n      grants[kind],\n      spec.expandsSubtypes ? universe.getSubTypes : undefined\n    )\n  }\n\n  return grants\n}\n\nfunction expandSelection(\n  selection: Selection,\n  universe: ReadonlySet<string>,\n  into: Set<string>,\n  expand?: (id: string) => readonly string[]\n): void {\n  if (selection.all) {\n    const except = new Set(selection.except)\n    for (const id of universe) {\n      if (!except.has(id)) {\n        into.add(id)\n      }\n    }\n    return\n  }\n\n  for (const id of selection.ids) {\n    into.add(id)\n    if (expand) {\n      for (const subTypeId of expand(id)) {\n        into.add(subTypeId)\n      }\n    }\n  }\n}\n\n/**\n * Resolve a principal's authorization context from its group memberships.\n *\n * Pure set-union over pre-resolved roles: roles match when their grantedTo\n * groups intersect the principal's memberships, and their concrete id sets\n * union into the principal's grant index.\n */\nexport function resolveAuthorizationContext(input: {\n  readonly principal: Principal\n  readonly sessionId?: string\n  readonly groupIds: readonly string[]\n  readonly roles: readonly ResolvedRole[]\n}): AuthorizationContext {\n  const memberGroupIds = new Set(input.groupIds)\n  const roleIds: string[] = []\n  const grants = emptyGrantSets()\n\n  for (const role of input.roles) {\n    if (!role.grantedToGroupIds.some((groupId) => memberGroupIds.has(groupId))) {\n      continue\n    }\n\n    roleIds.push(role.id)\n    for (const kind of GRANT_KIND_KEYS) {\n      for (const id of role.grants[kind]) {\n        grants[kind].add(id)\n      }\n    }\n  }\n\n  return {\n    principal: input.principal,\n    ...(input.sessionId !== undefined ? { sessionId: input.sessionId } : {}),\n    groupIds: input.groupIds,\n    roleIds,\n    grants,\n  }\n}\n",
+    "import type { ProjectionDefinition, ProjectionTarget } from \"../projections\"\nimport { projectionTargetOf } from \"../projections/builders\"\nimport type { ActionRunRecord } from \"../storage/action-runs\"\nimport type { PipelineRunRecord } from \"../storage/pipeline-runs\"\nimport type { WorkflowInterventionRecord } from \"../storage/workflow-interventions\"\nimport type { WorkflowRunRecord } from \"../storage/workflow-runs\"\nimport { isAllowed } from \"./decision\"\nimport type { AuthorizationContext } from \"./types\"\n\nexport function canViewActionRun(\n  authorization: AuthorizationContext | null | undefined,\n  run: Pick<ActionRunRecord, \"actionId\" | \"subject\">\n): boolean {\n  if (!authorization) {\n    return true\n  }\n\n  if (!isAllowed(authorization, { kind: \"action.apply\", actionId: run.actionId })) {\n    return false\n  }\n\n  return run.subject.kind !== \"object\"\n    ? true\n    : isAllowed(authorization, {\n        kind: \"object.view\",\n        objectTypeId: run.subject.objectTypeId,\n      })\n}\n\nexport function canViewWorkflowRun(\n  authorization: AuthorizationContext | null | undefined,\n  run: Pick<WorkflowRunRecord, \"workflowId\">\n): boolean {\n  return (\n    !authorization || isAllowed(authorization, { kind: \"workflow.run\", workflowId: run.workflowId })\n  )\n}\n\nexport function canViewWorkflowIntervention(\n  authorization: AuthorizationContext | null | undefined,\n  intervention: Pick<WorkflowInterventionRecord, \"workflowId\">\n): boolean {\n  return (\n    !authorization ||\n    isAllowed(authorization, { kind: \"workflow.run\", workflowId: intervention.workflowId })\n  )\n}\n\nexport function canViewPipelineRun(\n  authorization: AuthorizationContext | null | undefined,\n  run: Pick<PipelineRunRecord, \"pipelineId\">\n): boolean {\n  return (\n    !authorization || isAllowed(authorization, { kind: \"pipeline.run\", pipelineId: run.pipelineId })\n  )\n}\n\n/** A projection run is viewable when its target object type(s) are viewable. */\nexport function canViewProjectionRun(\n  authorization: AuthorizationContext | null | undefined,\n  target: ProjectionTarget\n): boolean {\n  if (!authorization) return true\n  const canView = (objectTypeId: string) =>\n    isAllowed(authorization, { kind: \"object.view\", objectTypeId })\n  if (\"sourceObjectTypeId\" in target) {\n    return canView(target.sourceObjectTypeId) && canView(target.targetObjectTypeId)\n  }\n  return canView(target.objectTypeId)\n}\n\n/** Whether a principal may see a projection definition (and its run history). */\nexport function canViewProjection(\n  authorization: AuthorizationContext | null | undefined,\n  projection: ProjectionDefinition\n): boolean {\n  return canViewProjectionRun(authorization, projectionTargetOf(projection))\n}\n",
+    "/**\n * Authorization context types.\n *\n * The context is plain, immutable data resolved once per request\n * (`principal -> groups -> roles -> grants`). Grants resolve eagerly into set\n * lookups so enforcement on the hot path is synchronous and allocation-free.\n * Group and role ids are retained so decisions stay explainable.\n */\n\nimport type { Principal } from \"../auth/types\"\nimport { emptyGrantSets, type GrantKind } from \"./grant-kinds\"\n\n/**\n * Grants resolved to concrete id sets, keyed by grant kind (`view:object`,\n * `run:sync`, …). Broad grants and object subtypes are already expanded, so\n * enforcement is a single `grants[kind].has(id)` lookup. Keyed by `GrantKind`\n * so a new grant family adds one key, not a new bucket every consumer must\n * learn.\n */\nexport type GrantIndex = Readonly<Record<GrantKind, ReadonlySet<string>>>\n\n/**\n * A grant index that grants nothing, as the base for a hand-built context — typically in tests.\n *\n * This is the read-only face of `emptyGrantSets()`, the mutable builder resolution fills in and which\n * stays internal. A factory rather than a shared constant, because the sets are only `ReadonlySet` to\n * the type system: one frozen instance would be aliased into every context that spreads it.\n *\n * Writing the literal by hand is what this avoids. `GrantIndex` is deliberately a total `Record` so\n * that `grants[kind].has(id)` cannot be misspelled into a silent `undefined` — with an optional index\n * every enforcement site would read `?.has(id) ?? false`, where a typo denies instead of failing to\n * compile. The cost of totality is that a literal breaks whenever a grant family is added.\n */\nexport function emptyGrantIndex(): GrantIndex {\n  return emptyGrantSets()\n}\n\n/** A role with its grants pre-expanded to concrete id sets at startup. */\nexport interface ResolvedRole {\n  readonly id: string\n  readonly grantedToGroupIds: readonly string[]\n  readonly grants: GrantIndex\n}\n\nexport interface AuthorizationContext {\n  readonly principal: Principal\n  readonly sessionId?: string\n  readonly groupIds: readonly string[]\n  /** Roles whose grantedTo groups intersect the principal's memberships. */\n  readonly roleIds: readonly string[]\n  readonly grants: GrantIndex\n}\n"
+  ],
+  "mappings": ";;;;;;AACO,MAAM,2BAA2B,MAAM;AAAA,EAKjC;AAAA,EAJF,OAAO;AAAA,EAEhB,WAAW,CAEA,UACT,SACA;AAAA,IACA,MAAM,OAAO;AAAA,IAHJ;AAAA;AAKb;;;ACgDA,SAAS,QAAQ,CAAC,SAAwC;AAAA,EACxD,QAAQ,QAAQ;AAAA,SACT;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,sBAAsB,IAAI,QAAQ,SAAS,CAAC;AAAA,SACzD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,eAAe,IAAI,QAAQ,aAAa,CAAC;AAAA,SACtD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,gBAAgB,IAAI,QAAQ,UAAU,CAAC;AAAA,SACpD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,eAAe,IAAI,QAAQ,aAAa,CAAC;AAAA,SACtD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,oBAAoB,IAAI,QAAQ,aAAa,CAAC;AAAA,SAC3D;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,gBAAgB,IAAI,QAAQ,SAAS,CAAC;AAAA,SACnD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,gBAAgB,IAAI,QAAQ,WAAW,CAAC;AAAA,SACrD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,YAAY,IAAI,QAAQ,OAAO,CAAC;AAAA,SAC7C;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,gBAAgB,IAAI,QAAQ,WAAW,CAAC;AAAA,SACrD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,aAAa,IAAI,QAAQ,QAAQ,CAAC;AAAA,SAC/C;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,gBAAgB,IAAI,OAAO,CAAC;AAAA,SACzC;AAAA,MACH,OAAO,QAAQ,qBAAqB,IAAI,CAAC,QAAQ,EAAE,MAAM,eAAe,GAAG,EAAE;AAAA;AAAA;AAInF,SAAS,OAAO,CAAC,MAAoB;AAAA,EACnC,IAAI,KAAK,SAAS;AAAA,IAAgB,OAAO,KAAK;AAAA,EAC9C,OAAO,GAAG,KAAK,QAAQ,KAAK;AAAA;AAG9B,SAAS,KAAK,CAAC,QAAoB,MAAqB;AAAA,EACtD,OAAO,OAAO,KAAK,MAAM,IAAI,KAAK,EAAE;AAAA;AAI/B,SAAS,QAAQ,CACtB,eACA,SACe;AAAA,EACf,MAAM,QAAQ,SAAS,OAAO;AAAA,EAC9B,MAAM,eAAe,MAAM,IAAI,OAAO;AAAA,EACtC,MAAM,UAAU,gBACZ,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,cAAc,QAAQ,IAAI,CAAC,EAAE,IAAI,OAAO,IACtE,CAAC;AAAA,EACL,OAAO,EAAE,SAAS,QAAQ,WAAW,GAAG,cAAc,QAAQ;AAAA;AAGzD,SAAS,SAAS,CACvB,eACA,SACS;AAAA,EACT,OAAO,SAAS,eAAe,OAAO,EAAE;AAAA;AAGnC,SAAS,gBAAgB,CAAC,SAA4B,SAA6B;AAAA,EACxF,MAAM,WAAW,SAAS,QAAQ,eAAe,OAAO;AAAA,EACxD,IAAI,SAAS,SAAS;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,mBACR,SAAS,QAAQ,MAAM,QAAQ,MAC/B,cAAc,QAAQ,eAAe,OAAO,CAC9C;AAAA;AAiBK,SAAS,aAAa,CAAC,SAA4B,cAA4B;AAAA,EACpF,iBAAiB,SAAS,EAAE,MAAM,eAAe,aAAa,CAAC;AAAA,EAC/D,iBAAiB,SAAS,EAAE,MAAM,eAAe,aAAa,CAAC;AAAA;AAU1D,SAAS,wBAAwB,CAAC,SAA4B,cAA4B;AAAA,EAC/F,iBAAiB,SAAS,EAAE,MAAM,oBAAoB,aAAa,CAAC;AAAA;AAW/D,SAAS,gBAAgB,CAAC,SAA4B,WAAyB;AAAA,EACpF,IAAI,CAAC,QAAQ,eAAe;AAAA,IAC1B;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,mBACR,cAAc,aACd,qBAAqB,2DACvB;AAAA;AAGF,SAAS,aAAa,CACpB,eACA,SACQ;AAAA,EACR,MAAM,cAAc,eAAe,UAAU,MAAM;AAAA,EACnD,QAAQ,QAAQ;AAAA,SACT;AAAA,MACH,OAAO,qBAAqB,sDAAsD,QAAQ;AAAA,SACvF;AAAA,MACH,OAAO,qBAAqB,oDAAoD,QAAQ;AAAA,SACrF;AAAA,MACH,OAAO,qBAAqB,gDAAgD,QAAQ;AAAA,SACjF;AAAA,MACH,OAAO,qBAAqB,qDAAqD,QAAQ;AAAA,SACtF;AAAA,MACH,OAAO,qBAAqB,oEAAoE,QAAQ;AAAA,SACrG;AAAA,MACH,OAAO,qBAAqB,gDAAgD,QAAQ;AAAA,SACjF;AAAA,MACH,OAAO,qBAAqB,gDAAgD,QAAQ;AAAA,SACjF;AAAA,MACH,OAAO,qBAAqB,4CAA4C,QAAQ;AAAA,SAC7E;AAAA,MACH,OAAO,qBAAqB,gDAAgD,QAAQ;AAAA,SACjF;AAAA,MACH,OAAO,qBAAqB,6CAA6C,QAAQ;AAAA,SAC9E;AAAA,MACH,OAAO,qBAAqB;AAAA,SACzB,gBAAgB;AAAA,MAEnB,MAAM,UAAU,QAAQ,qBAAqB,KAC3C,CAAC,iBAAiB,CAAC,UAAU,eAAe,EAAE,MAAM,eAAe,aAAa,CAAC,CACnF;AAAA,MACA,OAAO,qBAAqB,oDAAoD;AAAA,IAClF;AAAA;AAAA;;;AC/MG,SAAS,6BAA6B,CAC3C,OACA,UACS;AAAA,EACT,OAAO,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,sBAAsB,IAAI,QAAQ,CAAC;AAAA;AAetE,SAAS,oBAAoB,CAClC,eACA,OACA,UACS;AAAA,EACT,OACE,CAAC,8BAA8B,OAAO,QAAQ,KAC9C,UAAU,eAAe,EAAE,MAAM,sBAAsB,SAAS,CAAC;AAAA;;ACd9D,SAAS,YAAY,CAC1B,eACA,OACS;AAAA,EACT,IAAI,CAAC,eAAe;AAAA,IAClB,OAAO;AAAA,EACT;AAAA,EAEA,QAAQ,MAAM;AAAA,SACP;AAAA,SACA;AAAA,MACH,OAAO,UAAU,eAAe;AAAA,QAC9B,MAAM;AAAA,QACN,cAAc,MAAM,QAAQ;AAAA,MAC9B,CAAC;AAAA,SACE;AAAA,MACH,OACE,UAAU,eAAe;AAAA,QACvB,MAAM;AAAA,QACN,cAAc,MAAM,QAAQ;AAAA,MAC9B,CAAC,KACD,UAAU,eAAe,EAAE,MAAM,eAAe,cAAc,MAAM,QAAQ,aAAa,CAAC;AAAA,SAEzF,WAAW;AAAA,MAId,IAAI,CAAC,UAAU,eAAe,EAAE,MAAM,gBAAgB,UAAU,MAAM,QAAQ,SAAS,CAAC,GAAG;AAAA,QACzF,OAAO;AAAA,MACT;AAAA,MACA,MAAM,UAAU,MAAM,QAAQ;AAAA,MAC9B,OAAO,QAAQ,SAAS,WACpB,UAAU,eAAe,EAAE,MAAM,eAAe,cAAc,QAAQ,aAAa,CAAC,IACpF;AAAA,IACN;AAAA,SACK;AAAA,MACH,OAAO,UAAU,eAAe;AAAA,QAC9B,MAAM;AAAA,QACN,YAAY,MAAM,QAAQ;AAAA,MAC5B,CAAC;AAAA,SACE;AAAA,MAGH,OAAO,UAAU,eAAe;AAAA,QAC9B,MAAM;AAAA,QACN,cAAc,MAAM,QAAQ,QAAQ;AAAA,MACtC,CAAC;AAAA,SAKE;AAAA,MACH,OAAO,UAAU,eAAe;AAAA,QAC9B,MAAM;AAAA,QACN,QAAQ,MAAM,QAAQ;AAAA,MACxB,CAAC;AAAA,SACE;AAAA,MACH,OAAO,UAAU,eAAe;AAAA,QAC9B,MAAM;AAAA,QACN,YAAY,MAAM,QAAQ;AAAA,MAC5B,CAAC;AAAA,SACE;AAAA,MAIH,OAAO;AAAA,SACJ;AAAA,MAOH,OAAO,UAAU,eAAe;AAAA,QAC9B,MAAM;AAAA,QACN,WAAW,MAAM,QAAQ;AAAA,MAC3B,CAAC;AAAA;AAAA,MAGD,OAAO;AAAA;AAAA;;ACvCN,IAAM,cAAgD;AAAA,EAC3D,sBAAsB;AAAA,IACpB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,IACL,iBAAiB;AAAA,EACnB;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EAIA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,YAAY;AAAA,IACV,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,aAAa;AAAA,IACX,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AACF;AAEO,IAAM,kBAAkB,OAAO,KAAK,WAAW;AAG/C,SAAS,WAAW,CAAC,OAAmC;AAAA,EAC7D,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO,QAAQ,MAAM;AAAA,SAClB;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO,OAAO,MAAM;AAAA,SACjB;AAAA,MACH,OAAO;AAAA;AAAA;AAKN,SAAS,cAAc,GAAmC;AAAA,EAC/D,MAAM,OAAO,CAAC;AAAA,EACd,WAAW,QAAQ,iBAAiB;AAAA,IAClC,KAAK,QAAQ,IAAI;AAAA,EACnB;AAAA,EACA,OAAO;AAAA;;;AC/HF,SAAS,iBAAiB,CAAC,MAAsB,UAAqC;AAAA,EAC3F,MAAM,SAAS,eAAe;AAAA,EAE9B,WAAW,SAAS,KAAK,QAAQ;AAAA,IAC/B,MAAM,OAAO,YAAY,KAAK;AAAA,IAC9B,MAAM,OAAO,YAAY;AAAA,IACzB,gBACE,MAAM,WACN,SAAS,KAAK,cACd,OAAO,OACP,KAAK,kBAAkB,SAAS,cAAc,SAChD;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;AAGT,SAAS,eAAe,CACtB,WACA,UACA,MACA,QACM;AAAA,EACN,IAAI,UAAU,KAAK;AAAA,IACjB,MAAM,SAAS,IAAI,IAAI,UAAU,MAAM;AAAA,IACvC,WAAW,MAAM,UAAU;AAAA,MACzB,IAAI,CAAC,OAAO,IAAI,EAAE,GAAG;AAAA,QACnB,KAAK,IAAI,EAAE;AAAA,MACb;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,WAAW,MAAM,UAAU,KAAK;AAAA,IAC9B,KAAK,IAAI,EAAE;AAAA,IACX,IAAI,QAAQ;AAAA,MACV,WAAW,aAAa,OAAO,EAAE,GAAG;AAAA,QAClC,KAAK,IAAI,SAAS;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AAAA;AAUK,SAAS,2BAA2B,CAAC,OAKnB;AAAA,EACvB,MAAM,iBAAiB,IAAI,IAAI,MAAM,QAAQ;AAAA,EAC7C,MAAM,UAAoB,CAAC;AAAA,EAC3B,MAAM,SAAS,eAAe;AAAA,EAE9B,WAAW,QAAQ,MAAM,OAAO;AAAA,IAC9B,IAAI,CAAC,KAAK,kBAAkB,KAAK,CAAC,YAAY,eAAe,IAAI,OAAO,CAAC,GAAG;AAAA,MAC1E;AAAA,IACF;AAAA,IAEA,QAAQ,KAAK,KAAK,EAAE;AAAA,IACpB,WAAW,QAAQ,iBAAiB;AAAA,MAClC,WAAW,MAAM,KAAK,OAAO,OAAO;AAAA,QAClC,OAAO,MAAM,IAAI,EAAE;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,WAAW,MAAM;AAAA,OACb,MAAM,cAAc,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,IACtE,UAAU,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,EACF;AAAA;;AC1FK,SAAS,gBAAgB,CAC9B,eACA,KACS;AAAA,EACT,IAAI,CAAC,eAAe;AAAA,IAClB,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,CAAC,UAAU,eAAe,EAAE,MAAM,gBAAgB,UAAU,IAAI,SAAS,CAAC,GAAG;AAAA,IAC/E,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,IAAI,QAAQ,SAAS,WACxB,OACA,UAAU,eAAe;AAAA,IACvB,MAAM;AAAA,IACN,cAAc,IAAI,QAAQ;AAAA,EAC5B,CAAC;AAAA;AAGA,SAAS,kBAAkB,CAChC,eACA,KACS;AAAA,EACT,OACE,CAAC,iBAAiB,UAAU,eAAe,EAAE,MAAM,gBAAgB,YAAY,IAAI,WAAW,CAAC;AAAA;AAI5F,SAAS,2BAA2B,CACzC,eACA,cACS;AAAA,EACT,OACE,CAAC,iBACD,UAAU,eAAe,EAAE,MAAM,gBAAgB,YAAY,aAAa,WAAW,CAAC;AAAA;AAInF,SAAS,kBAAkB,CAChC,eACA,KACS;AAAA,EACT,OACE,CAAC,iBAAiB,UAAU,eAAe,EAAE,MAAM,gBAAgB,YAAY,IAAI,WAAW,CAAC;AAAA;AAK5F,SAAS,oBAAoB,CAClC,eACA,QACS;AAAA,EACT,IAAI,CAAC;AAAA,IAAe,OAAO;AAAA,EAC3B,MAAM,UAAU,CAAC,iBACf,UAAU,eAAe,EAAE,MAAM,eAAe,aAAa,CAAC;AAAA,EAChE,IAAI,wBAAwB,QAAQ;AAAA,IAClC,OAAO,QAAQ,OAAO,kBAAkB,KAAK,QAAQ,OAAO,kBAAkB;AAAA,EAChF;AAAA,EACA,OAAO,QAAQ,OAAO,YAAY;AAAA;AAI7B,SAAS,iBAAiB,CAC/B,eACA,YACS;AAAA,EACT,OAAO,qBAAqB,eAAe,mBAAmB,UAAU,CAAC;AAAA;;AC3CpE,SAAS,eAAe,GAAe;AAAA,EAC5C,OAAO,eAAe;AAAA;",
+  "debugId": "9E384F7E3DAB4DE464756E2164756E21",
+  "names": []
+}