@sixb/core 0.1.1 → 0.1.2

package/dist/chunk-34bqh420.js

@@ -0,0 +1,1168 @@
+// @bun
+import {
+  createSixbError
+} from "./chunk-0172wgm9.js";
+import {
+  compareStrings
+} from "./chunk-t8t39h7v.js";
+
+// src/authorization/grant-kinds.ts
+var GRANT_KINDS = {
+  "access:application": {
+    universeKey: "applicationIds",
+    subject: "application",
+    fix: "Use an application exported from '@sixb/core'."
+  },
+  "view:object": {
+    universeKey: "objectTypeIds",
+    subject: "object type",
+    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies }).",
+    expandsSubtypes: true
+  },
+  "view:dataset": {
+    universeKey: "datasetIds",
+    subject: "dataset",
+    fix: "Add it to 'datasets/' or pass it to createSixb({ datasets })."
+  },
+  "edit:object": {
+    universeKey: "objectTypeIds",
+    subject: "object type",
+    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies })."
+  },
+  "append:telemetry": {
+    universeKey: "objectTypeIds",
+    subject: "object type",
+    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies })."
+  },
+  "apply:action": {
+    universeKey: "actionIds",
+    subject: "action",
+    fix: "Add it to 'actions/' or pass it to createSixb({ actions })."
+  },
+  "run:workflow": {
+    universeKey: "workflowIds",
+    subject: "workflow",
+    fix: "Add it to 'workflows/' or pass it to createSixb({ workflows })."
+  },
+  "run:sync": {
+    universeKey: "syncIds",
+    subject: "sync",
+    fix: "Add it to 'syncs/' or pass it to createSixb({ syncs })."
+  },
+  "run:pipeline": {
+    universeKey: "pipelineIds",
+    subject: "pipeline",
+    fix: "Add it to 'pipelines/' or pass it to createSixb({ pipelines })."
+  },
+  "run:agent": {
+    universeKey: "agentIds",
+    subject: "agent",
+    fix: "Add it to 'agents/' or pass it to createSixb({ agents })."
+  },
+  "observe:logs": {
+    universeKey: "observableIds",
+    subject: "observability surface",
+    fix: 'Use can.observe("logs").'
+  },
+  "manage:connector": {
+    universeKey: "connectorIds",
+    subject: "connector",
+    fix: "Add it to 'connectors/' or pass it to createSixb({ connectors })."
+  }
+};
+var GRANT_KIND_KEYS = Object.keys(GRANT_KINDS);
+function grantKindOf(grant) {
+  switch (grant.capability) {
+    case "access":
+      return "access:application";
+    case "view":
+      return `view:${grant.target}`;
+    case "edit":
+      return "edit:object";
+    case "append":
+      return "append:telemetry";
+    case "apply":
+      return "apply:action";
+    case "run":
+      return `run:${grant.target}`;
+    case "observe":
+      return "observe:logs";
+    case "manage":
+      return "manage:connector";
+  }
+}
+function emptyGrantSets() {
+  const sets = {};
+  for (const kind of GRANT_KIND_KEYS) {
+    sets[kind] = new Set;
+  }
+  return sets;
+}
+
+// src/execution/types.ts
+class RuntimeAuthorizationCapability {
+  #runtimeAuthorization = true;
+  constructor() {}
+  static create() {
+    const capability = new RuntimeAuthorizationCapability;
+    Object.freeze(capability);
+    return capability;
+  }
+  static is(value) {
+    return typeof value === "object" && value !== null && #runtimeAuthorization in value;
+  }
+}
+function createRuntimeAuthorizationCapability() {
+  return RuntimeAuthorizationCapability.create();
+}
+function isRuntimeAuthorizationCapability(value) {
+  return RuntimeAuthorizationCapability.is(value);
+}
+
+// src/execution/authorization.ts
+var registeredAuthorizations = new WeakMap;
+function createPrincipalRuntimeAuthorization(input) {
+  return createRegisteredPrincipalAuthorization(input);
+}
+function createAgentRuntimeAuthorization(input) {
+  if (input.context.principal.type !== "serviceAccount") {
+    throw new Error("[Sixb] Agent execution authority must belong to a service account.");
+  }
+  assertNonEmpty(input.executionId, "Execution id");
+  assertNonEmpty(input.agentId, "Agent id");
+  assertNonEmpty(input.runId, "Agent run id");
+  return createRegisteredPrincipalAuthorization(input, {
+    type: "agent",
+    executionId: input.executionId,
+    agentId: input.agentId,
+    runId: input.runId
+  });
+}
+function createRegisteredPrincipalAuthorization(input, executionBinding) {
+  const context = snapshotAuthorizationContext(input.context);
+  const credential = input.credential ? snapshotCredential(input.credential) : undefined;
+  assertCredentialMatchesContext(context, credential);
+  const ref = Object.freeze({
+    type: "principal",
+    principal: context.principal,
+    ...credential === undefined ? {} : { credential }
+  });
+  return register({
+    type: "principal",
+    projectId: input.projectId,
+    context,
+    ref,
+    ...executionBinding === undefined ? {} : { executionBinding: Object.freeze({ ...executionBinding }) }
+  });
+}
+function createDisabledRuntimeAuthorization(projectId) {
+  return register({ type: "unrestricted", projectId, ref: Object.freeze({ type: "disabled" }) });
+}
+function createTrustedPrimitiveRuntimeAuthorization(input) {
+  const primitive = snapshotTrustedPrimitive(input.primitive);
+  return register({
+    type: "unrestricted",
+    projectId: input.projectId,
+    ref: Object.freeze({ type: "trustedPrimitive", primitive })
+  });
+}
+function resolveRuntimeAuthorization(authorization) {
+  if (!isRuntimeAuthorizationCapability(authorization)) {
+    return { type: "denied" };
+  }
+  return registeredAuthorizations.get(authorization) ?? { type: "denied" };
+}
+function getAuthorizationRef(authorization) {
+  const resolved = resolveRuntimeAuthorization(authorization);
+  if (resolved.type === "denied") {
+    throw new Error("[Sixb] Runtime authorization is not a registered Core capability.");
+  }
+  return cloneAuthorizationRef(resolved.ref);
+}
+function assertExecutionScopeProject(projectId, scope) {
+  assertNonEmpty(projectId, "Project id");
+  if (scope.execution.projectId !== projectId) {
+    throw createSixbError("internal.unexpected", `[Sixb] Execution scope belongs to project '${scope.execution.projectId}', not '${projectId}'.`, {
+      details: {
+        executionId: scope.execution.id,
+        expectedProjectId: projectId,
+        scopeProjectId: scope.execution.projectId
+      }
+    });
+  }
+  const resolved = resolveRuntimeAuthorization(scope.authorization);
+  if (resolved.type === "denied") {
+    throw createSixbError("internal.unexpected", "[Sixb] Execution scope carries unregistered runtime authorization.", { details: { executionId: scope.execution.id, projectId } });
+  }
+  if (resolved.projectId !== projectId) {
+    throw createSixbError("internal.unexpected", `[Sixb] Execution authorization belongs to project '${resolved.projectId}', not '${projectId}'.`, {
+      details: {
+        authorizationProjectId: resolved.projectId,
+        executionId: scope.execution.id,
+        expectedProjectId: projectId
+      }
+    });
+  }
+}
+function resolveExecutionScopeAuthorization(projectId, scope) {
+  assertExecutionScopeProject(projectId, scope);
+  const resolved = resolveRuntimeAuthorization(scope.authorization);
+  if (resolved.type === "denied") {
+    throw createSixbError("internal.unexpected", "[Sixb] Execution scope carries unregistered runtime authorization.", { details: { executionId: scope.execution.id, projectId } });
+  }
+  const { execution } = scope;
+  switch (execution.executor.type) {
+    case "request":
+      if (execution.source.type !== "http" || execution.source.requestId !== execution.executor.requestId) {
+        throw invalidExecutionAuthority(execution.id, "request source does not match its executor");
+      }
+      if (resolved.ref.type === "principal") {
+        if (resolved.type !== "principal" || resolved.executionBinding !== undefined || !principalsEqual(execution.requestedBy, resolved.ref.principal)) {
+          throw invalidExecutionAuthority(execution.id, "request authority does not match its requested-by principal");
+        }
+        return resolved;
+      }
+      if (resolved.ref.type === "disabled" && execution.requestedBy === undefined)
+        return resolved;
+      throw invalidExecutionAuthority(execution.id, "request execution requires principal or explicitly disabled authority");
+    case "primitive":
+      if (resolved.ref.type !== "trustedPrimitive" || resolved.ref.primitive.kind !== execution.executor.kind || resolved.ref.primitive.id !== execution.executor.id || resolved.ref.primitive.runId !== execution.executor.runId) {
+        throw invalidExecutionAuthority(execution.id, "trusted primitive authority does not match its executor");
+      }
+      return resolved;
+    case "agent":
+      if (resolved.type !== "principal" || resolved.ref.type !== "principal" || resolved.ref.principal.type !== "serviceAccount" || resolved.ref.credential !== undefined || resolved.executionBinding?.type !== "agent" || resolved.executionBinding.executionId !== execution.id || resolved.executionBinding.agentId !== execution.executor.agentId || resolved.executionBinding.runId !== execution.executor.runId) {
+        throw invalidExecutionAuthority(execution.id, "agent authority does not match its execution binding");
+      }
+      return resolved;
+    case "kernel":
+      if (resolved.ref.type !== "kernel" || execution.requestedBy !== undefined || resolved.ref.operation.type !== execution.executor.operation.type || resolved.ref.operation.recoveryId !== execution.executor.operation.recoveryId) {
+        throw invalidExecutionAuthority(execution.id, "kernel authority does not match its executor");
+      }
+      return resolved;
+  }
+}
+function principalsEqual(left, right) {
+  return left?.type === right?.type && left?.id === right?.id;
+}
+function invalidExecutionAuthority(executionId, reason) {
+  return createSixbError("internal.unexpected", `[Sixb] Execution '${executionId}' is incompatible with its authority: ${reason}.`, { details: { executionId, reason } });
+}
+function register(input) {
+  assertNonEmpty(input.projectId, "Authorization project id");
+  const authorization = createRuntimeAuthorizationCapability();
+  registeredAuthorizations.set(authorization, Object.freeze(input));
+  return authorization;
+}
+function snapshotAuthorizationContext(context) {
+  const principal = snapshotAuthorizablePrincipal(context.principal);
+  const grants = emptyGrantSets();
+  for (const kind of GRANT_KIND_KEYS) {
+    grants[kind] = new Set(context.grants[kind]);
+  }
+  const frozenGrants = Object.freeze(grants);
+  return Object.freeze({
+    principal,
+    ...context.sessionId === undefined ? {} : { sessionId: context.sessionId },
+    groupIds: Object.freeze([...context.groupIds]),
+    roleIds: Object.freeze([...context.roleIds]),
+    grants: frozenGrants
+  });
+}
+function snapshotAuthorizablePrincipal(principal) {
+  if (principal.type !== "user" && principal.type !== "serviceAccount") {
+    throw new Error(`[Sixb] Principal type '${principal.type}' cannot hold runtime authorization.`);
+  }
+  assertNonEmpty(principal.id, "Authorization principal id");
+  return Object.freeze({ type: principal.type, id: principal.id });
+}
+function snapshotCredential(credential) {
+  assertNonEmpty(credential.id, "Authorization credential id");
+  if (credential.type !== "session" && credential.type !== "accessToken") {
+    const credentialType = credential.type;
+    throw new Error(`[Sixb] Unknown authorization credential type '${credentialType}'.`);
+  }
+  return Object.freeze({ type: credential.type, id: credential.id });
+}
+function assertCredentialMatchesContext(context, credential) {
+  if (credential?.type === "session") {
+    if (context.sessionId !== credential.id) {
+      throw new Error("[Sixb] Session credential id must match the authorization context session id.");
+    }
+    return;
+  }
+  if (context.sessionId !== undefined) {
+    throw new Error("[Sixb] Authorization context session requires a matching session credential.");
+  }
+}
+function snapshotTrustedPrimitive(primitive) {
+  if (!isTrustedPrimitiveKind(primitive.kind)) {
+    throw new Error(`[Sixb] Unknown trusted primitive kind '${primitive.kind}'.`);
+  }
+  assertNonEmpty(primitive.id, "Trusted primitive id");
+  assertNonEmpty(primitive.runId, "Trusted primitive run id");
+  return Object.freeze({ kind: primitive.kind, id: primitive.id, runId: primitive.runId });
+}
+function cloneAuthorizationRef(ref) {
+  switch (ref.type) {
+    case "principal":
+      return {
+        type: "principal",
+        principal: { ...ref.principal },
+        ...ref.credential === undefined ? {} : { credential: { ...ref.credential } }
+      };
+    case "trustedPrimitive":
+      return { type: "trustedPrimitive", primitive: { ...ref.primitive } };
+    case "kernel":
+      return { type: "kernel", operation: { ...ref.operation } };
+    case "disabled":
+      return { type: "disabled" };
+  }
+}
+function isTrustedPrimitiveKind(value) {
+  return value === "action" || value === "pipeline" || value === "projection" || value === "rule" || value === "sync" || value === "webhook" || value === "workflow";
+}
+function assertNonEmpty(value, label) {
+  if (!value.trim()) {
+    throw new Error(`[Sixb] ${label} must not be empty.`);
+  }
+}
+
+// src/authorization/errors.ts
+class AuthorizationError extends Error {
+  grantKey;
+  name = "AuthorizationError";
+  constructor(grantKey, message) {
+    super(message);
+    this.grantKey = grantKey;
+  }
+}
+
+// src/authorization/decision.ts
+function atomsFor(request) {
+  switch (request.kind) {
+    case "application.access":
+      return [{ kind: "access:application", id: request.audience }];
+    case "object.view":
+      return [{ kind: "view:object", id: request.objectTypeId }];
+    case "dataset.view":
+      return [{ kind: "view:dataset", id: request.datasetId }];
+    case "object.edit":
+      return [{ kind: "edit:object", id: request.objectTypeId }];
+    case "telemetry.append":
+      return [{ kind: "append:telemetry", id: request.objectTypeId }];
+    case "action.apply":
+      return [{ kind: "apply:action", id: request.actionId }];
+    case "workflow.run":
+      return [{ kind: "run:workflow", id: request.workflowId }];
+    case "sync.run":
+      return [{ kind: "run:sync", id: request.syncId }];
+    case "pipeline.run":
+      return [{ kind: "run:pipeline", id: request.pipelineId }];
+    case "agent.run":
+      return [{ kind: "run:agent", id: request.agentId }];
+    case "logs.observe":
+      return [{ kind: "observe:logs", id: "logs" }];
+    case "connector.manage":
+      return [{ kind: "manage:connector", id: request.connectorId }];
+    case "object.query":
+      return request.touchedObjectTypeIds.map((id) => ({ kind: "view:object", id }));
+  }
+}
+function atomKey(atom) {
+  if (atom.kind === "observe:logs")
+    return atom.kind;
+  return `${atom.kind}:${atom.id}`;
+}
+function holds(grants, atom) {
+  return grants[atom.kind].has(atom.id);
+}
+function evaluate(authorization, request) {
+  const atoms = atomsFor(request);
+  const requirements = atoms.map(atomKey);
+  const missing = authorization ? atoms.filter((atom) => !holds(authorization.grants, atom)).map(atomKey) : [];
+  return { allowed: missing.length === 0, requirements, missing };
+}
+function isAllowed(authorization, request) {
+  return evaluate(authorization, request).allowed;
+}
+function assertAuthorized(runtime, request) {
+  const resolved = assertRuntimeAuthorizationBound(runtime);
+  const authorization = resolved.type === "principal" ? resolved.context : undefined;
+  const decision = evaluate(authorization, request);
+  if (decision.allowed) {
+    return;
+  }
+  throw new AuthorizationError(decision.missing[0] ?? request.kind, deniedMessage(authorization, request));
+}
+function assertRuntimeAuthorizationBound(runtime) {
+  const resolved = resolveRuntimeAuthorization(runtime.runtimeAuthorization);
+  if (resolved.type === "denied") {
+    throw new AuthorizationError("runtime:unbound", "[Sixb] Protected operations require a registered execution scope.");
+  }
+  return resolved;
+}
+function assertCanEdit(runtime, objectTypeId) {
+  assertAuthorized(runtime, { kind: "object.view", objectTypeId });
+  assertAuthorized(runtime, { kind: "object.edit", objectTypeId });
+}
+function assertCanAppendTelemetry(runtime, objectTypeId) {
+  assertAuthorized(runtime, { kind: "telemetry.append", objectTypeId });
+}
+function assertCanManageConnector(runtime, connectorId) {
+  assertAuthorized(runtime, { kind: "connector.manage", connectorId });
+}
+function assertPrivileged(runtime, operation) {
+  const resolved = assertRuntimeAuthorizationBound(runtime);
+  if (resolved.type === "unrestricted") {
+    return;
+  }
+  throw new AuthorizationError(`privileged:${operation}`, `[Sixb] Operation '${operation}' is not covered by scoped authorization grants.`);
+}
+function assertProviderAccess(runtime, execution, operation) {
+  const resolved = assertRuntimeAuthorizationBound(runtime);
+  if (resolved.type === "unrestricted") {
+    return;
+  }
+  const binding = resolved.executionBinding;
+  const executor = execution.executor;
+  if (binding?.type === "agent" && executor.type === "agent" && binding.executionId === execution.id && binding.agentId === executor.agentId && binding.runId === executor.runId) {
+    return;
+  }
+  throw new AuthorizationError(`privileged:${operation}`, `[Sixb] Operation '${operation}' is not covered by scoped authorization grants.`);
+}
+function deniedMessage(authorization, request) {
+  const principalId = authorization?.principal.id ?? "unknown";
+  switch (request.kind) {
+    case "application.access":
+      return `[Sixb] Principal '${principalId}' is not allowed to access application '${request.audience}'.`;
+    case "object.view":
+      return `[Sixb] Principal '${principalId}' is not allowed to view object type '${request.objectTypeId}'.`;
+    case "dataset.view":
+      return `[Sixb] Principal '${principalId}' is not allowed to view dataset '${request.datasetId}'.`;
+    case "object.edit":
+      return `[Sixb] Principal '${principalId}' is not allowed to write object type '${request.objectTypeId}'.`;
+    case "telemetry.append":
+      return `[Sixb] Principal '${principalId}' is not allowed to append telemetry for object type '${request.objectTypeId}'.`;
+    case "action.apply":
+      return `[Sixb] Principal '${principalId}' is not allowed to apply action '${request.actionId}'.`;
+    case "workflow.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to run workflow '${request.workflowId}'.`;
+    case "sync.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to run sync '${request.syncId}'.`;
+    case "pipeline.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to run pipeline '${request.pipelineId}'.`;
+    case "agent.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to run agent '${request.agentId}'.`;
+    case "logs.observe":
+      return `[Sixb] Principal '${principalId}' is not allowed to observe project logs.`;
+    case "connector.manage":
+      return `[Sixb] Principal '${principalId}' is not allowed to manage connector '${request.connectorId}'.`;
+    case "object.query": {
+      const blocked = request.touchedObjectTypeIds.find((objectTypeId) => !isAllowed(authorization, { kind: "object.view", objectTypeId }));
+      return `[Sixb] Principal '${principalId}' is not allowed to view object type '${blocked}'.`;
+    }
+  }
+}
+
+// src/authorization/application-access.ts
+function isApplicationAccessControlled(roles, audience) {
+  return roles.some((role) => role.grants["access:application"].has(audience));
+}
+function canAccessApplication(authorization, roles, audience) {
+  return !isApplicationAccessControlled(roles, audience) || isAllowed(authorization, { kind: "application.access", audience });
+}
+// src/authorization/event-visibility.ts
+function canViewEvent(authorization, event) {
+  if (!authorization) {
+    return true;
+  }
+  switch (event.topic) {
+    case "objects":
+    case "telemetry":
+      return isAllowed(authorization, {
+        kind: "object.view",
+        objectTypeId: event.payload.objectTypeId
+      });
+    case "links":
+      return isAllowed(authorization, {
+        kind: "object.view",
+        objectTypeId: event.payload.sourceTypeId
+      }) && isAllowed(authorization, { kind: "object.view", objectTypeId: event.payload.targetTypeId });
+    case "actions": {
+      if (!isAllowed(authorization, { kind: "action.apply", actionId: event.payload.actionId })) {
+        return false;
+      }
+      const subject = event.payload.subject;
+      return subject.kind === "object" ? isAllowed(authorization, { kind: "object.view", objectTypeId: subject.objectTypeId }) : true;
+    }
+    case "workflows":
+      return isAllowed(authorization, {
+        kind: "workflow.run",
+        workflowId: event.payload.workflowId
+      });
+    case "rules":
+      return isAllowed(authorization, {
+        kind: "object.view",
+        objectTypeId: event.payload.subject.objectTypeId
+      });
+    case "syncs":
+      return isAllowed(authorization, {
+        kind: "sync.run",
+        syncId: event.payload.syncId
+      });
+    case "pipelines":
+      return isAllowed(authorization, {
+        kind: "pipeline.run",
+        pipelineId: event.payload.pipelineId
+      });
+    case "schedules":
+      return true;
+    case "datasets":
+      return isAllowed(authorization, {
+        kind: "dataset.view",
+        datasetId: event.payload.datasetId
+      });
+    default:
+      return false;
+  }
+}
+// src/authorization/resolve.ts
+function resolveRoleGrants(role, universe) {
+  const grants = emptyGrantSets();
+  for (const grant of role.grants) {
+    const kind = grantKindOf(grant);
+    const spec = GRANT_KINDS[kind];
+    expandSelection(grant.selection, universe[spec.universeKey], grants[kind], spec.expandsSubtypes ? universe.getSubTypes : undefined);
+  }
+  return grants;
+}
+function expandSelection(selection, universe, into, expand) {
+  if (selection.all) {
+    const except = new Set(selection.except);
+    for (const id of universe) {
+      if (!except.has(id)) {
+        into.add(id);
+      }
+    }
+    return;
+  }
+  for (const id of selection.ids) {
+    into.add(id);
+    if (expand) {
+      for (const subTypeId of expand(id)) {
+        into.add(subTypeId);
+      }
+    }
+  }
+}
+function resolveAuthorizationContext(input) {
+  const memberGroupIds = new Set(input.groupIds);
+  const roleIds = [];
+  const grants = emptyGrantSets();
+  for (const role of input.roles) {
+    if (!role.grantedToGroupIds.some((groupId) => memberGroupIds.has(groupId))) {
+      continue;
+    }
+    roleIds.push(role.id);
+    for (const kind of GRANT_KIND_KEYS) {
+      for (const id of role.grants[kind]) {
+        grants[kind].add(id);
+      }
+    }
+  }
+  return {
+    principal: input.principal,
+    ...input.sessionId !== undefined ? { sessionId: input.sessionId } : {},
+    groupIds: input.groupIds,
+    roleIds,
+    grants
+  };
+}
+// src/projections/errors.ts
+class ProjectionValidationError extends Error {
+  name = "ProjectionValidationError";
+}
+
+// src/projections/ownership.ts
+function computeProjectionOwnership(projection, ontology) {
+  if (projection._tag === "ObjectProjectionDefinition") {
+    const primaryId = ontology.getPrimaryPropertyId(projection.objectTypeId);
+    return freezeOwnership({
+      objects: [
+        {
+          objectTypeId: projection.objectTypeId,
+          existence: true,
+          propertyIds: Object.keys(projection.properties).filter((propertyId) => propertyId !== primaryId).sort(compareStrings)
+        }
+      ],
+      links: Object.keys(projection.links).sort(compareStrings).map((linkId) => ({ sourceObjectTypeId: projection.objectTypeId, linkId })),
+      telemetry: []
+    });
+  }
+  if (projection._tag === "LinkProjectionDefinition") {
+    return freezeOwnership({
+      objects: [],
+      links: [
+        {
+          sourceObjectTypeId: projection.sourceObjectTypeId,
+          linkId: projection.linkId
+        }
+      ],
+      telemetry: []
+    });
+  }
+  return freezeOwnership({
+    objects: [],
+    links: [],
+    telemetry: [
+      {
+        objectTypeId: projection.objectTypeId,
+        propertyId: projection.propertyId
+      }
+    ]
+  });
+}
+function validateProjectionOwnership(projections) {
+  const existenceOwners = new Map;
+  const propertyOwners = new Map;
+  const linkOwners = new Map;
+  const telemetryOwners = new Map;
+  for (const { definition, ownership } of projections) {
+    for (const object of ownership.objects) {
+      if (object.existence) {
+        registerOwner(existenceOwners, object.objectTypeId, definition.id, `object type '${object.objectTypeId}' existence`);
+      }
+      for (const propertyId of object.propertyIds) {
+        registerOwner(propertyOwners, JSON.stringify([object.objectTypeId, propertyId]), definition.id, `property '${object.objectTypeId}.${propertyId}'`);
+      }
+    }
+    for (const link of ownership.links) {
+      registerOwner(linkOwners, JSON.stringify([link.sourceObjectTypeId, link.linkId]), definition.id, `link scope '${link.sourceObjectTypeId}.${link.linkId}'`);
+    }
+    for (const telemetry of ownership.telemetry) {
+      registerOwner(telemetryOwners, JSON.stringify([telemetry.objectTypeId, telemetry.propertyId]), definition.id, `telemetry source '${telemetry.objectTypeId}.${telemetry.propertyId}'`);
+    }
+  }
+}
+function registerOwner(owners, key, projectionId, description) {
+  const existing = owners.get(key);
+  if (existing !== undefined) {
+    throw new ProjectionValidationError(`[Sixb] Projection '${projectionId}' overlaps ${description} owned by projection '${existing}'.`);
+  }
+  owners.set(key, projectionId);
+}
+function freezeOwnership(ownership) {
+  return Object.freeze({
+    objects: Object.freeze(ownership.objects.map((object) => Object.freeze({ ...object, propertyIds: Object.freeze([...object.propertyIds]) }))),
+    links: Object.freeze(ownership.links.map((link) => Object.freeze({ ...link }))),
+    telemetry: Object.freeze(ownership.telemetry.map((telemetry) => Object.freeze({ ...telemetry })))
+  });
+}
+
+// src/projections/validation.ts
+function validatePropertyMapping(objectType, mapping) {
+  const propertyIds = new Set(objectType.properties.map((p) => p.id));
+  const mappingKeys = Object.keys(mapping);
+  for (const key of mappingKeys) {
+    if (!propertyIds.has(key)) {
+      const available = [...propertyIds].sort().join(", ");
+      throw new ProjectionValidationError(`Property '${key}' does not exist on object type '${objectType.id}'. ` + `Available properties: ${available}`);
+    }
+  }
+  const primaryProperties = objectType.properties.filter((p) => p.primary === true);
+  if (primaryProperties.length !== 1) {
+    throw new ProjectionValidationError(`Object type '${objectType.id}' must have exactly one primary property, ` + `found ${primaryProperties.length}.`);
+  }
+  const primaryId = primaryProperties[0].id;
+  if (!(primaryId in mapping)) {
+    throw new ProjectionValidationError(`Primary property '${primaryId}' of object type '${objectType.id}' ` + `must be included in the property mapping.`);
+  }
+}
+function validateAndLowerLinkMapping(objectType, linkMapping, propertyMapping) {
+  const linkIds = new Set(objectType.links.map((l) => l.id));
+  const linksById = new Map(objectType.links.map((l) => [l.id, l]));
+  const propertyIds = new Set(objectType.properties.map((p) => p.id));
+  for (const [key, descriptor] of Object.entries(linkMapping)) {
+    if (!linkIds.has(key)) {
+      const available = [...linkIds].sort().join(", ");
+      throw new ProjectionValidationError(`Link '${key}' does not exist on object type '${objectType.id}'. ` + `Available links: ${available}`);
+    }
+    if (key !== descriptor.linkId) {
+      throw new ProjectionValidationError(`Link mapping key '${key}' does not match descriptor linkId '${descriptor.linkId}'.`);
+    }
+    const link = linksById.get(key);
+    if (Array.isArray(link.targetObjectTypeId)) {
+      throw new ProjectionValidationError(`Link '${key}' on object type '${objectType.id}' has a polymorphic target. ` + `FK projection of polymorphic links is not yet supported.`);
+    }
+    if (link.targetObjectTypeId === "*") {
+      throw new ProjectionValidationError(`Link '${key}' on object type '${objectType.id}' has a wildcard target. ` + `FK projection of wildcard links is not supported.`);
+    }
+    const sourcePropertyId = descriptor.sourcePropertyId;
+    const sourceField = descriptor.sourceField;
+    if (sourcePropertyId && sourceField) {
+      throw new ProjectionValidationError(`FK link '${key}' must use either sourceProperty or sourceField, not both.`);
+    }
+    if (!sourcePropertyId && !sourceField) {
+      throw new ProjectionValidationError(`FK link '${key}' must declare sourceProperty or sourceField.`);
+    }
+    if (!sourcePropertyId) {
+      continue;
+    }
+    if (!propertyIds.has(sourcePropertyId)) {
+      const available = [...propertyIds].sort().join(", ");
+      throw new ProjectionValidationError(`Source property '${sourcePropertyId}' does not exist on ` + `object type '${objectType.id}'. Available properties: ${available}`);
+    }
+    if (!(sourcePropertyId in propertyMapping)) {
+      throw new ProjectionValidationError(`Source property '${sourcePropertyId}' for link '${key}' ` + `must be included in the property mapping.`);
+    }
+  }
+  return Object.fromEntries(Object.entries(linkMapping).map(([linkId, descriptor]) => [
+    linkId,
+    {
+      linkId: descriptor.linkId,
+      ...descriptor.sourcePropertyId !== undefined ? { sourcePropertyId: descriptor.sourcePropertyId } : {},
+      ...descriptor.sourceField !== undefined ? { sourceField: descriptor.sourceField } : {},
+      targetObjectTypeId: descriptor.targetObjectTypeId
+    }
+  ]));
+}
+function validateLinkProjectionTarget(linkToken) {
+  if (Array.isArray(linkToken.targetObjectTypeId)) {
+    throw new ProjectionValidationError(`Link '${linkToken.id}' has a polymorphic target. ` + `Link projection of polymorphic links is not yet supported.`);
+  }
+  if (linkToken.targetObjectTypeId === "*") {
+    throw new ProjectionValidationError(`Link '${linkToken.id}' has a wildcard target. ` + `Link projection of wildcard links is not supported.`);
+  }
+}
+function validateTelemetryProjectionFieldMapping(projection, objectType, datasetColumnNames, prefix) {
+  const property = objectType.properties.find((candidate) => candidate.id === projection.propertyId);
+  if (!property) {
+    throw new ProjectionValidationError(`${prefix}: unknown property "${projection.propertyId}" on type "${projection.objectTypeId}"`);
+  }
+  if (property.mode !== "telemetry") {
+    throw new ProjectionValidationError(`${prefix}: property "${projection.propertyId}" on type "${projection.objectTypeId}" must be telemetry-enabled`);
+  }
+  const mappedFields = [
+    ["objectId", projection.objectIdField],
+    ["at", projection.atField],
+    ["value", projection.valueField],
+    ...projection.unitField !== undefined ? [["unit", projection.unitField]] : []
+  ];
+  for (const [fieldRole, columnName] of mappedFields) {
+    if (!datasetColumnNames.has(columnName)) {
+      throw new ProjectionValidationError(`${prefix}: ${fieldRole} field "${columnName}" references unknown dataset column ` + `on dataset "${projection.datasetId}"`);
+    }
+  }
+  return property;
+}
+function validateProjectionsAtStartup(projections, ontology, datasetsById) {
+  const { objectProjections, linkProjections, telemetryProjections } = projections;
+  const objectTypesById = ontology.getObjectTypesById();
+  const primaryByTypeId = ontology.getPrimaryByTypeId();
+  const validatedObjectProjections = [];
+  const validatedLinkProjections = [];
+  const validatedTelemetryProjections = [];
+  validateMaterializationOntologyConstraints(ontology);
+  for (const projection of objectProjections) {
+    const prefix = `Projection "${projection.id}"`;
+    const dataset = datasetsById.get(projection.datasetId);
+    if (!dataset) {
+      throw new ProjectionValidationError(`${prefix}: unknown dataset "${projection.datasetId}". ` + `Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+    }
+    const objectType = objectTypesById.get(projection.objectTypeId);
+    if (!objectType) {
+      throw new ProjectionValidationError(`${prefix}: unknown object type "${projection.objectTypeId}"`);
+    }
+    const datasetColumnNames = new Set(dataset.schema.columns.map((column) => column.name));
+    const propertyIds = new Set(objectType.properties.map((p) => p.id));
+    for (const [propId, columnName] of Object.entries(projection.properties)) {
+      if (!propertyIds.has(propId)) {
+        throw new ProjectionValidationError(`${prefix}: unknown property "${propId}" on type "${projection.objectTypeId}"`);
+      }
+      if (!datasetColumnNames.has(columnName)) {
+        throw new ProjectionValidationError(`${prefix}: property "${propId}" references unknown dataset column "${columnName}" ` + `on dataset "${projection.datasetId}"`);
+      }
+      const property = objectType.properties.find((candidate) => candidate.id === propId);
+      if (property?.mode === "telemetry") {
+        throw new ProjectionValidationError(`[Sixb] ${prefix}: source mappings cannot own telemetry property "${projection.objectTypeId}.${propId}"`);
+      }
+    }
+    const primaryId = primaryByTypeId.get(projection.objectTypeId);
+    if (!(primaryId in projection.properties)) {
+      throw new ProjectionValidationError(`${prefix}: primary property "${primaryId}" must be in property mapping`);
+    }
+    const linkIds = new Set(objectType.links.map((l) => l.id));
+    for (const [linkId, fk] of Object.entries(projection.links)) {
+      if (!linkIds.has(linkId)) {
+        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" references unknown link on type "${projection.objectTypeId}"`);
+      }
+      if (fk.linkId !== linkId) {
+        throw new ProjectionValidationError(`${prefix}: FK link mapping key "${linkId}" does not match descriptor linkId "${fk.linkId}"`);
+      }
+      const sourcePropertyId = fk.sourcePropertyId;
+      const sourceField = fk.sourceField;
+      if (sourcePropertyId && sourceField) {
+        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" must use either sourcePropertyId or sourceField, not both`);
+      }
+      if (!sourcePropertyId && !sourceField) {
+        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" must declare sourcePropertyId or sourceField`);
+      }
+      if (sourcePropertyId && !propertyIds.has(sourcePropertyId)) {
+        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" source property "${sourcePropertyId}" does not exist on type "${projection.objectTypeId}"`);
+      }
+      if (sourcePropertyId && !(sourcePropertyId in projection.properties)) {
+        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" source property "${sourcePropertyId}" must be in property mapping`);
+      }
+      if (sourceField && !datasetColumnNames.has(sourceField)) {
+        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" source field "${sourceField}" references unknown dataset column on dataset "${projection.datasetId}"`);
+      }
+      if (!objectTypesById.has(fk.targetObjectTypeId)) {
+        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" target type "${fk.targetObjectTypeId}" is unknown`);
+      }
+      if (!primaryByTypeId.has(fk.targetObjectTypeId)) {
+        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" target type "${fk.targetObjectTypeId}" has no primary property`);
+      }
+      const link = objectType.links.find((candidate) => candidate.id === linkId);
+      if (!ontology.isValidLinkTarget(link.targetObjectTypeId, fk.targetObjectTypeId)) {
+        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" target type "${fk.targetObjectTypeId}" is not compatible with its declared target`);
+      }
+    }
+    validatedObjectProjections.push({
+      definition: projection,
+      dataset,
+      ownership: computeProjectionOwnership(projection, ontology)
+    });
+  }
+  for (const projection of linkProjections) {
+    const prefix = `Projection "${projection.id}"`;
+    const dataset = datasetsById.get(projection.datasetId);
+    if (!dataset) {
+      throw new ProjectionValidationError(`${prefix}: unknown dataset "${projection.datasetId}". ` + `Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+    }
+    if (!objectTypesById.has(projection.sourceObjectTypeId)) {
+      throw new ProjectionValidationError(`${prefix}: unknown source type "${projection.sourceObjectTypeId}"`);
+    }
+    if (!objectTypesById.has(projection.targetObjectTypeId)) {
+      throw new ProjectionValidationError(`${prefix}: unknown target type "${projection.targetObjectTypeId}"`);
+    }
+    const sourceType = objectTypesById.get(projection.sourceObjectTypeId);
+    const link = sourceType.links.find((candidate) => candidate.id === projection.linkId);
+    if (!link) {
+      throw new ProjectionValidationError(`${prefix}: link "${projection.linkId}" does not exist on source type "${projection.sourceObjectTypeId}"`);
+    }
+    if (!ontology.isValidLinkTarget(link.targetObjectTypeId, projection.targetObjectTypeId)) {
+      throw new ProjectionValidationError(`${prefix}: target type "${projection.targetObjectTypeId}" is not compatible with link "${projection.linkId}"`);
+    }
+    const datasetColumnNames = new Set(dataset.schema.columns.map((column) => column.name));
+    if (!datasetColumnNames.has(projection.sourceField)) {
+      throw new ProjectionValidationError(`${prefix}: source field "${projection.sourceField}" references unknown dataset column ` + `on dataset "${projection.datasetId}"`);
+    }
+    if (!datasetColumnNames.has(projection.targetField)) {
+      throw new ProjectionValidationError(`${prefix}: target field "${projection.targetField}" references unknown dataset column ` + `on dataset "${projection.datasetId}"`);
+    }
+    if (!primaryByTypeId.has(projection.sourceObjectTypeId)) {
+      throw new ProjectionValidationError(`${prefix}: source type "${projection.sourceObjectTypeId}" has no primary property`);
+    }
+    if (!primaryByTypeId.has(projection.targetObjectTypeId)) {
+      throw new ProjectionValidationError(`${prefix}: target type "${projection.targetObjectTypeId}" has no primary property`);
+    }
+    validatedLinkProjections.push({
+      definition: projection,
+      dataset,
+      ownership: computeProjectionOwnership(projection, ontology)
+    });
+  }
+  for (const projection of telemetryProjections) {
+    const prefix = `Projection "${projection.id}"`;
+    const dataset = datasetsById.get(projection.datasetId);
+    if (!dataset) {
+      throw new ProjectionValidationError(`${prefix}: unknown dataset "${projection.datasetId}". ` + `Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+    }
+    const objectType = objectTypesById.get(projection.objectTypeId);
+    if (!objectType) {
+      throw new ProjectionValidationError(`${prefix}: unknown object type "${projection.objectTypeId}"`);
+    }
+    const datasetColumnNames = new Set(dataset.schema.columns.map((column) => column.name));
+    validateTelemetryProjectionFieldMapping(projection, objectType, datasetColumnNames, prefix);
+    validatedTelemetryProjections.push({
+      definition: projection,
+      dataset,
+      ownership: computeProjectionOwnership(projection, ontology)
+    });
+  }
+  const validatedProjections = [
+    ...validatedObjectProjections,
+    ...validatedLinkProjections,
+    ...validatedTelemetryProjections
+  ];
+  validateProjectionOwnership(validatedProjections);
+  return {
+    objectProjections: validatedObjectProjections,
+    linkProjections: validatedLinkProjections,
+    telemetryProjections: validatedTelemetryProjections
+  };
+}
+function validateMaterializationOntologyConstraints(ontology) {
+  for (const objectType of ontology.getObjectTypesById().values()) {
+    for (const property of objectType.properties) {
+      if (property.mode === "telemetry" && property.required === true) {
+        throw new ProjectionValidationError(`[Sixb] Telemetry property '${objectType.id}.${property.id}' cannot be required.`);
+      }
+    }
+    for (const link of objectType.links) {
+      for (const property of link.properties ?? []) {
+        if (property.mode === "telemetry") {
+          throw new ProjectionValidationError(`[Sixb] Link property '${objectType.id}.${link.id}.${property.id}' cannot use telemetry mode.`);
+        }
+      }
+    }
+  }
+}
+
+// src/projections/builders.ts
+function assertNonEmpty2(value, field) {
+  if (!value.trim()) {
+    throw new ProjectionValidationError(`Projection ${field} must not be empty.`);
+  }
+}
+function assertProjectionDataset(dataset) {
+  if (!dataset || dataset.kind !== "dataset" || typeof dataset.id !== "string") {
+    throw new ProjectionValidationError("Projection dataset must be a dataset definition.");
+  }
+  assertNonEmpty2(dataset.id, "dataset id");
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function lowerForeignKeyMapping(mapping) {
+  const lowered = {};
+  for (const [linkId, descriptor] of Object.entries(mapping)) {
+    if (!descriptor)
+      continue;
+    lowered[linkId] = isForeignKeyDescriptor(descriptor) ? descriptor : fromForeignKey(descriptor);
+  }
+  return lowered;
+}
+function isForeignKeyDescriptor(value) {
+  return isRecord(value) && typeof value.linkId === "string";
+}
+function defineProjection(id, target) {
+  if ("link" in target)
+    return buildLinkProjection(id, target);
+  if ("property" in target)
+    return buildTelemetryProjection(id, target);
+  return buildObjectProjection(id, target);
+}
+function buildObjectProjection(id, objectType) {
+  assertNonEmpty2(id, "id");
+  return {
+    fromDataset(dataset) {
+      assertProjectionDataset(dataset);
+      const datasetId = dataset.id;
+      return {
+        properties(mapping) {
+          const propertyMapping = mapping;
+          validatePropertyMapping(objectType, propertyMapping);
+          const definition = {
+            _tag: "ObjectProjectionDefinition",
+            id,
+            objectTypeId: objectType.id,
+            datasetId,
+            properties: { ...propertyMapping },
+            links: {}
+          };
+          return Object.assign(definition, {
+            withLinks(linkMapping) {
+              const loweredLinkMapping = lowerForeignKeyMapping(linkMapping);
+              const validatedLinks = validateAndLowerLinkMapping(objectType, loweredLinkMapping, propertyMapping);
+              return {
+                _tag: "ObjectProjectionDefinition",
+                id,
+                objectTypeId: objectType.id,
+                datasetId,
+                properties: { ...propertyMapping },
+                links: validatedLinks
+              };
+            }
+          });
+        }
+      };
+    }
+  };
+}
+function buildTelemetryProjection(id, propertyToken) {
+  assertNonEmpty2(id, "id");
+  validateTelemetryProjectionProperty(propertyToken);
+  return {
+    fromDataset(dataset) {
+      assertProjectionDataset(dataset);
+      const datasetId = dataset.id;
+      return {
+        points(mapping) {
+          const pointMapping = lowerTelemetryPointMapping(mapping);
+          return {
+            _tag: "TelemetryProjectionDefinition",
+            id,
+            objectTypeId: propertyToken.objectTypeId,
+            propertyId: propertyToken.id,
+            datasetId,
+            objectIdField: pointMapping.objectId,
+            atField: pointMapping.at,
+            valueField: pointMapping.value,
+            ...pointMapping.unit !== undefined ? { unitField: pointMapping.unit } : {}
+          };
+        }
+      };
+    }
+  };
+}
+function validateTelemetryProjectionProperty(propertyToken) {
+  if (propertyToken.property.mode !== "telemetry") {
+    throw new ProjectionValidationError(`Projection property '${propertyToken.objectTypeId}.${propertyToken.id}' must be telemetry-enabled.`);
+  }
+}
+function lowerTelemetryPointMapping(mapping) {
+  const allowedKeys = new Set(["objectId", "at", "value", "unit"]);
+  for (const key of Object.keys(mapping)) {
+    if (!allowedKeys.has(key)) {
+      throw new ProjectionValidationError(`Telemetry projection point mapping contains unknown key '${key}'.`);
+    }
+  }
+  if (mapping.objectId === undefined) {
+    throw new ProjectionValidationError("Telemetry projection point mapping requires objectId.");
+  }
+  if (mapping.at === undefined) {
+    throw new ProjectionValidationError("Telemetry projection point mapping requires at.");
+  }
+  if (mapping.value === undefined) {
+    throw new ProjectionValidationError("Telemetry projection point mapping requires value.");
+  }
+  assertNonEmpty2(mapping.objectId, "objectId field");
+  assertNonEmpty2(mapping.at, "at field");
+  assertNonEmpty2(mapping.value, "value field");
+  if (mapping.unit !== undefined) {
+    assertNonEmpty2(mapping.unit, "unit field");
+  }
+  return {
+    objectId: mapping.objectId,
+    at: mapping.at,
+    value: mapping.value,
+    ...mapping.unit !== undefined ? { unit: mapping.unit } : {}
+  };
+}
+function fromForeignKey(input) {
+  validateLinkProjectionTarget(input.link);
+  if (input.sourceProperty) {
+    return {
+      linkId: input.link.id,
+      sourcePropertyId: input.sourceProperty.id,
+      targetObjectTypeId: input.target.id
+    };
+  }
+  if (input.sourceField === undefined) {
+    throw new ProjectionValidationError("Foreign key sourceField is required.");
+  }
+  assertNonEmpty2(input.sourceField, "source field");
+  return {
+    linkId: input.link.id,
+    sourceField: input.sourceField,
+    targetObjectTypeId: input.target.id
+  };
+}
+function buildLinkProjection(id, linkToken) {
+  assertNonEmpty2(id, "id");
+  validateLinkProjectionTarget(linkToken);
+  return {
+    fromDataset(dataset) {
+      assertProjectionDataset(dataset);
+      const datasetId = dataset.id;
+      return {
+        sourceField(columnName) {
+          assertNonEmpty2(columnName, "source field");
+          return {
+            targetField(targetColumnName) {
+              assertNonEmpty2(targetColumnName, "target field");
+              return {
+                _tag: "LinkProjectionDefinition",
+                id,
+                linkId: linkToken.id,
+                sourceObjectTypeId: linkToken.objectTypeId,
+                targetObjectTypeId: linkToken.targetObjectTypeId,
+                datasetId,
+                sourceField: columnName,
+                targetField: targetColumnName
+              };
+            }
+          };
+        }
+      };
+    }
+  };
+}
+function isObjectProjectionDefinition(value) {
+  if (!isRecord(value))
+    return false;
+  return value._tag === "ObjectProjectionDefinition" && typeof value.id === "string" && typeof value.objectTypeId === "string" && typeof value.datasetId === "string" && isRecord(value.properties) && isRecord(value.links);
+}
+function isLinkProjectionDefinition(value) {
+  if (!isRecord(value))
+    return false;
+  return value._tag === "LinkProjectionDefinition" && typeof value.id === "string" && typeof value.linkId === "string" && typeof value.sourceObjectTypeId === "string" && typeof value.targetObjectTypeId === "string" && typeof value.datasetId === "string" && typeof value.sourceField === "string" && typeof value.targetField === "string";
+}
+function isTelemetryProjectionDefinition(value) {
+  if (!isRecord(value))
+    return false;
+  return value._tag === "TelemetryProjectionDefinition" && typeof value.id === "string" && typeof value.objectTypeId === "string" && typeof value.propertyId === "string" && typeof value.datasetId === "string" && typeof value.objectIdField === "string" && typeof value.atField === "string" && typeof value.valueField === "string" && (value.unitField === undefined || typeof value.unitField === "string");
+}
+function isProjectionDefinition(value) {
+  return isObjectProjectionDefinition(value) || isLinkProjectionDefinition(value) || isTelemetryProjectionDefinition(value);
+}
+function projectionTargetOf(projection) {
+  return projection._tag === "LinkProjectionDefinition" ? {
+    sourceObjectTypeId: projection.sourceObjectTypeId,
+    targetObjectTypeId: projection.targetObjectTypeId
+  } : { objectTypeId: projection.objectTypeId };
+}
+
+// src/authorization/run-visibility.ts
+function canViewActionRun(authorization, run) {
+  if (!authorization) {
+    return true;
+  }
+  if (!isAllowed(authorization, { kind: "action.apply", actionId: run.actionId })) {
+    return false;
+  }
+  return run.subject.kind !== "object" ? true : isAllowed(authorization, {
+    kind: "object.view",
+    objectTypeId: run.subject.objectTypeId
+  });
+}
+function canViewWorkflowRun(authorization, run) {
+  return !authorization || isAllowed(authorization, { kind: "workflow.run", workflowId: run.workflowId });
+}
+function canViewWorkflowIntervention(authorization, intervention) {
+  return !authorization || isAllowed(authorization, { kind: "workflow.run", workflowId: intervention.workflowId });
+}
+function canViewPipelineRun(authorization, run) {
+  return !authorization || isAllowed(authorization, { kind: "pipeline.run", pipelineId: run.pipelineId });
+}
+function canViewProjectionRun(authorization, target) {
+  if (!authorization)
+    return true;
+  const canView = (objectTypeId) => isAllowed(authorization, { kind: "object.view", objectTypeId });
+  if ("sourceObjectTypeId" in target) {
+    return canView(target.sourceObjectTypeId) && canView(target.targetObjectTypeId);
+  }
+  return canView(target.objectTypeId);
+}
+function canViewProjection(authorization, projection) {
+  return canViewProjectionRun(authorization, projectionTargetOf(projection));
+}
+// src/authorization/types.ts
+function emptyGrantIndex() {
+  return emptyGrantSets();
+}
+export { ProjectionValidationError, computeProjectionOwnership, validateProjectionOwnership, validateTelemetryProjectionFieldMapping, validateProjectionsAtStartup, defineProjection, fromForeignKey, isObjectProjectionDefinition, isLinkProjectionDefinition, isTelemetryProjectionDefinition, isProjectionDefinition, projectionTargetOf, GRANT_KINDS, grantKindOf, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, getAuthorizationRef, resolveExecutionScopeAuthorization, AuthorizationError, evaluate, isAllowed, assertAuthorized, assertCanEdit, assertCanAppendTelemetry, assertCanManageConnector, assertPrivileged, assertProviderAccess, isApplicationAccessControlled, canAccessApplication, canViewEvent, resolveRoleGrants, resolveAuthorizationContext, canViewActionRun, canViewWorkflowRun, canViewWorkflowIntervention, canViewPipelineRun, canViewProjectionRun, canViewProjection, emptyGrantIndex };
+
+//# debugId=EA88C5F91530A04564756E2164756E21