@sixb/core 0.1.12 → 0.1.13

package/dist/chunk-bbaa1fet.js.map

@@ -1,25 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/execution/authorization.ts", "../src/agents/identity.ts", "../src/authorization/grant-kinds.ts", "../src/storage/objects/execution-limits.ts", "../src/execution/types.ts", "../src/authorization/errors.ts", "../src/authorization/decision.ts", "../src/authorization/application-access.ts", "../src/authorization/event-visibility.ts", "../src/authorization/resolve.ts", "../src/projections/errors.ts", "../src/projections/ownership.ts", "../src/projections/validation.ts", "../src/projections/builders.ts", "../src/authorization/run-visibility.ts", "../src/authorization/types.ts"],
-  "sourcesContent": [
-    "import { isDeepStrictEqual } from \"node:util\"\nimport { agentServiceAccountId } from \"../agents/identity\"\nimport type { Principal } from \"../auth\"\nimport { TARGETED_GRANT_KIND_KEYS, type TargetedGrantKind } from \"../authorization/grant-kinds\"\nimport type { AuthorizationContext, GrantIndex } from \"../authorization/types\"\nimport { createSixbError } from \"../errors/internal\"\nimport type { ObjectRef } from \"../ontology\"\nimport {\n  type ObjectReadExecutionLimits,\n  snapshotObjectReadExecutionLimits,\n} from \"../storage/objects/execution-limits\"\nimport { compileSelectedObjectReadScope } from \"../storage/objects/read-scope\"\nimport type {\n  CompiledSelectedObjectReadScope,\n  SelectedObjectReadScope,\n} from \"../storage/objects/types\"\nimport { kernelOperationFromId, kernelOperationId } from \"./kernel-operation\"\nimport {\n  type AuthorizablePrincipal,\n  type AuthorizationRef,\n  createRuntimeAuthorizationCapability,\n  type ExecutionContext,\n  type ExecutionScope,\n  isRuntimeAuthorizationCapability,\n  type KernelOperation,\n  type RuntimeAuthorization,\n  type TrustedPrimitiveKind,\n  type TrustedPrimitiveRef,\n} from \"./types\"\n\nexport type ResolvedRuntimeAuthorization =\n  | {\n      readonly type: \"principal\"\n      readonly projectId: string\n      readonly context: AuthorizationContext\n      readonly ref: Extract<AuthorizationRef, { readonly type: \"principal\" }>\n    }\n  | {\n      readonly type: \"unrestricted\"\n      readonly projectId: string\n      readonly ref: Exclude<AuthorizationRef, { readonly type: \"principal\" | \"delegated\" }>\n    }\n  | {\n      readonly type: \"delegated\"\n      readonly projectId: string\n      readonly objectRead: DelegatedObjectReadAuthorization\n      readonly actionApply: readonly DelegatedActionApplyTarget[]\n      readonly delegation?: Extract<AuthorizationRef, { readonly type: \"delegated\" }>[\"delegation\"]\n    }\n  | { readonly type: \"denied\" }\n\n/** Immutable process-local object-read authority. It has no durable representation. */\nexport interface DelegatedObjectReadAuthorization {\n  readonly scope: CompiledSelectedObjectReadScope\n  readonly limits: ObjectReadExecutionLimits\n}\n\n/** One exact object-bound Action target carried by process-local delegated authority. */\nexport interface DelegatedActionApplyTarget {\n  readonly actionId: string\n  readonly subject: ObjectRef\n}\n\ntype RegisteredRuntimeAuthorization = Exclude<\n  ResolvedRuntimeAuthorization,\n  { readonly type: \"denied\" }\n>\n\ntype PrincipalAuthorizationContext = Omit<AuthorizationContext, \"principal\"> & {\n  readonly principal: AuthorizablePrincipal\n}\n\ninterface RuntimeAuthorizationRegistration {\n  readonly resolved: RegisteredRuntimeAuthorization\n  readonly execution: ExecutionContext\n}\n\nconst registeredAuthorizations = new WeakMap<\n  RuntimeAuthorization,\n  RuntimeAuthorizationRegistration\n>()\n\nconst MAX_DELEGATED_ACTION_APPLY_TARGETS = 4_096\nconst MAX_DELEGATED_ACTION_IDENTIFIER_CHARACTERS = 1_000_000\n\nexport function createPrincipalRuntimeAuthorization(input: {\n  readonly execution: ExecutionContext\n  readonly context: AuthorizationContext\n  readonly credential?: Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n}): RuntimeAuthorization {\n  if (input.execution.executor.type !== \"request\") {\n    throw new Error(\"[Sixb] Principal runtime authorization requires a request execution.\")\n  }\n  return createRegisteredPrincipalAuthorization(input)\n}\n\n/** Register restored authority bound to one exact agent run. */\nexport function createAgentRuntimeAuthorization(input: {\n  readonly execution: ExecutionContext\n  readonly authority:\n    | {\n        readonly type: \"principal\"\n        readonly context: AuthorizationContext\n        readonly credential?: Extract<\n          AuthorizationRef,\n          { readonly type: \"principal\" }\n        >[\"credential\"]\n      }\n    | { readonly type: \"disabled\" }\n}): RuntimeAuthorization {\n  if (input.execution.executor.type !== \"agent\") {\n    throw new Error(\"[Sixb] Agent runtime authorization requires an Agent execution.\")\n  }\n\n  if (input.authority.type === \"principal\") {\n    return createRegisteredPrincipalAuthorization({\n      execution: input.execution,\n      context: input.authority.context,\n      ...(input.authority.credential === undefined\n        ? {}\n        : { credential: input.authority.credential }),\n    })\n  }\n\n  return register(input.execution, {\n    type: \"unrestricted\",\n    projectId: input.execution.projectId,\n    ref: Object.freeze({ type: \"disabled\" }),\n  })\n}\n\nfunction createRegisteredPrincipalAuthorization(input: {\n  readonly execution: ExecutionContext\n  readonly context: AuthorizationContext\n  readonly credential?: Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n}): RuntimeAuthorization {\n  const context = snapshotAuthorizationContext(input.context)\n  const credential = input.credential ? snapshotCredential(input.credential) : undefined\n  assertCredentialMatchesContext(context, credential)\n  const ref: Extract<AuthorizationRef, { readonly type: \"principal\" }> = Object.freeze({\n    type: \"principal\",\n    principal: context.principal,\n    ...(credential === undefined ? {} : { credential }),\n  })\n  return register(input.execution, {\n    type: \"principal\",\n    projectId: input.execution.projectId,\n    context,\n    ref,\n  })\n}\n\nexport function createDisabledRuntimeAuthorization(\n  execution: ExecutionContext\n): RuntimeAuthorization {\n  return register(execution, {\n    type: \"unrestricted\",\n    projectId: execution.projectId,\n    ref: Object.freeze({ type: \"disabled\" }),\n  })\n}\n\n/** Register exact object-read authority without fabricating a principal identity. */\nexport function createDelegatedRuntimeAuthorization(input: {\n  readonly execution: ExecutionContext\n  readonly objectRead: {\n    readonly selection: SelectedObjectReadScope\n    readonly limits: ObjectReadExecutionLimits\n  }\n  readonly actionApply?: readonly DelegatedActionApplyTarget[]\n  readonly delegation?: Extract<AuthorizationRef, { readonly type: \"delegated\" }>[\"delegation\"]\n}): RuntimeAuthorization {\n  const execution = input.execution\n  const objectReadInput = input.objectRead\n  const actionApplyInput = input.actionApply\n  const delegationInput = input.delegation\n  const delegation =\n    delegationInput === undefined ? undefined : snapshotSharedDelegation(delegationInput)\n  if (execution.executor.type !== \"request\" || execution.requestedBy !== undefined) {\n    throw new Error(\n      \"[Sixb] Delegated runtime authorization requires a request execution without a principal.\"\n    )\n  }\n\n  const objectRead = Object.freeze({\n    scope: compileSelectedObjectReadScope(objectReadInput.selection),\n    limits: snapshotObjectReadExecutionLimits(objectReadInput.limits),\n  })\n  return register(execution, {\n    type: \"delegated\",\n    projectId: execution.projectId,\n    objectRead,\n    actionApply: snapshotDelegatedActionApply(actionApplyInput ?? []),\n    ...(delegation === undefined ? {} : { delegation }),\n  })\n}\n\nexport function createTrustedPrimitiveRuntimeAuthorization(input: {\n  readonly execution: ExecutionContext\n  readonly primitive: TrustedPrimitiveRef\n}): RuntimeAuthorization {\n  const primitive = snapshotTrustedPrimitive(input.primitive)\n  return register(input.execution, {\n    type: \"unrestricted\",\n    projectId: input.execution.projectId,\n    ref: Object.freeze({ type: \"trustedPrimitive\", primitive }),\n  })\n}\n\nexport function createKernelRuntimeAuthorization(input: {\n  readonly execution: ExecutionContext\n  readonly operation: KernelOperation\n}): RuntimeAuthorization {\n  const operation = snapshotKernelOperation(input.operation)\n  return register(input.execution, {\n    type: \"unrestricted\",\n    projectId: input.execution.projectId,\n    ref: Object.freeze({ type: \"kernel\", operation }),\n  })\n}\n\nexport function resolveRuntimeAuthorization(authorization: unknown): ResolvedRuntimeAuthorization {\n  if (!isRuntimeAuthorizationCapability(authorization)) {\n    return { type: \"denied\" }\n  }\n  return registeredAuthorizations.get(authorization)?.resolved ?? { type: \"denied\" }\n}\n\n/**\n * Resolve authority from a runtime already admitted by `SixbHost.withScope`.\n *\n * Bound runtime facades carry no second execution value to recombine. Any lower-level boundary\n * that receives an `ExecutionContext` separately must use `resolveExecutionScopeAuthorization`.\n */\nexport function resolveRuntimeAuthorizationForProject(input: {\n  readonly projectId: unknown\n  readonly runtimeAuthorization?: unknown\n}): ResolvedRuntimeAuthorization {\n  const resolved = resolveRuntimeAuthorization(input.runtimeAuthorization)\n  if (\n    resolved.type === \"denied\" ||\n    typeof input.projectId !== \"string\" ||\n    resolved.projectId !== input.projectId\n  ) {\n    return { type: \"denied\" }\n  }\n  return resolved\n}\n\nexport function getAuthorizationRef(authorization: RuntimeAuthorization): AuthorizationRef {\n  const resolved = resolveRuntimeAuthorization(authorization)\n  if (resolved.type === \"denied\") {\n    throw new Error(\"[Sixb] Runtime authorization is not a registered Core capability.\")\n  }\n  if (resolved.type === \"delegated\") {\n    if (resolved.delegation) {\n      return { type: \"delegated\", delegation: { ...resolved.delegation } }\n    }\n    throw new Error(\n      \"[Sixb] Delegated runtime authorization cannot cross a durable execution boundary.\"\n    )\n  }\n  return cloneAuthorizationRef(resolved.ref)\n}\n\nfunction snapshotSharedDelegation(\n  input: Extract<AuthorizationRef, { readonly type: \"delegated\" }>[\"delegation\"]\n): Extract<AuthorizationRef, { readonly type: \"delegated\" }>[\"delegation\"] {\n  const kind = input.kind\n  const grantId = input.grantId\n  const sessionId = input.sessionId\n  if (kind !== \"share\") throw new Error(\"[Sixb] Unknown delegated authority provenance.\")\n  assertNonEmpty(grantId, \"Share grant id\")\n  assertNonEmpty(sessionId, \"Share session id\")\n  return Object.freeze({ kind, grantId, sessionId })\n}\n\nexport function assertExecutionScopeProject(projectId: string, scope: ExecutionScope): void {\n  assertNonEmpty(projectId, \"Project id\")\n  if (scope.execution.projectId !== projectId) {\n    throw createSixbError(\n      \"internal.unexpected\",\n      `[Sixb] Execution scope belongs to project '${scope.execution.projectId}', not '${projectId}'.`,\n      {\n        details: {\n          executionId: scope.execution.id,\n          expectedProjectId: projectId,\n          scopeProjectId: scope.execution.projectId,\n        },\n      }\n    )\n  }\n\n  const resolved = resolveRuntimeAuthorization(scope.authorization)\n  if (resolved.type === \"denied\") {\n    throw createSixbError(\n      \"internal.unexpected\",\n      \"[Sixb] Execution scope carries unregistered runtime authorization.\",\n      { details: { executionId: scope.execution.id, projectId } }\n    )\n  }\n  if (resolved.projectId !== projectId) {\n    throw createSixbError(\n      \"internal.unexpected\",\n      `[Sixb] Execution authorization belongs to project '${resolved.projectId}', not '${projectId}'.`,\n      {\n        details: {\n          authorizationProjectId: resolved.projectId,\n          executionId: scope.execution.id,\n          expectedProjectId: projectId,\n        },\n      }\n    )\n  }\n}\n\n/**\n * Capture the two opaque capabilities carried by a scope exactly once.\n *\n * Security-sensitive boundaries must not resolve a caller-owned wrapper and then read it again:\n * accessor-backed inputs could otherwise substitute a different execution or authority between\n * those operations.\n */\nexport function captureExecutionScope(scope: ExecutionScope): ExecutionScope {\n  const execution = scope.execution\n  const authorization = scope.authorization\n  return Object.freeze({ execution, authorization })\n}\n\n/** Validate that one registered authority belongs to the exact execution it accompanies. */\nexport function resolveExecutionScopeAuthorization(\n  projectId: string,\n  scope: ExecutionScope\n): RegisteredRuntimeAuthorization {\n  const capturedScope = captureExecutionScope(scope)\n  assertExecutionScopeProject(projectId, capturedScope)\n  const resolved = resolveRuntimeAuthorization(capturedScope.authorization)\n  if (resolved.type === \"denied\") {\n    throw createSixbError(\n      \"internal.unexpected\",\n      \"[Sixb] Execution scope carries unregistered runtime authorization.\",\n      { details: { executionId: capturedScope.execution.id, projectId } }\n    )\n  }\n\n  const registration = registeredAuthorizations.get(capturedScope.authorization)\n  if (!registration || !executionMatchesBinding(registration.execution, capturedScope.execution)) {\n    throw invalidExecutionAuthority(\n      capturedScope.execution.id,\n      \"authority is bound to different execution provenance\"\n    )\n  }\n\n  assertResolvedAuthorizationMatchesExecution(resolved, capturedScope.execution)\n  return resolved\n}\n\nfunction assertResolvedAuthorizationMatchesExecution(\n  resolved: RegisteredRuntimeAuthorization,\n  execution: ExecutionContext\n): void {\n  switch (execution.executor.type) {\n    case \"request\":\n      if (\n        execution.source.type !== \"http\" ||\n        execution.source.requestId !== execution.executor.requestId\n      ) {\n        throw invalidExecutionAuthority(execution.id, \"request source does not match its executor\")\n      }\n      if (resolved.type === \"principal\") {\n        if (!principalsEqual(execution.requestedBy, resolved.ref.principal)) {\n          throw invalidExecutionAuthority(\n            execution.id,\n            \"request authority does not match its requested-by principal\"\n          )\n        }\n        return\n      }\n      if (\n        resolved.type === \"unrestricted\" &&\n        resolved.ref.type === \"disabled\" &&\n        execution.requestedBy === undefined\n      ) {\n        return\n      }\n      if (resolved.type === \"delegated\" && execution.requestedBy === undefined) return\n      throw invalidExecutionAuthority(\n        execution.id,\n        \"request execution requires principal, delegated, or explicitly disabled authority\"\n      )\n\n    case \"primitive\":\n      if (\n        resolved.type !== \"unrestricted\" ||\n        resolved.ref.type !== \"trustedPrimitive\" ||\n        resolved.ref.primitive.kind !== execution.executor.kind ||\n        resolved.ref.primitive.id !== execution.executor.id ||\n        resolved.ref.primitive.runId !== execution.executor.runId\n      ) {\n        throw invalidExecutionAuthority(\n          execution.id,\n          \"trusted primitive authority does not match its executor\"\n        )\n      }\n      return\n\n    case \"agent\":\n      if (execution.source.type !== \"execution\") {\n        throw invalidExecutionAuthority(\n          execution.id,\n          \"agent execution requires an execution source\"\n        )\n      }\n      if (resolved.type === \"principal\" && resolved.ref.type === \"principal\") {\n        if (resolved.ref.principal.type === \"serviceAccount\") {\n          const actorId = execution.executor.actorId\n          if (\n            actorId === undefined ||\n            resolved.ref.principal.id !== agentServiceAccountId(actorId) ||\n            resolved.ref.credential !== undefined\n          ) {\n            throw invalidExecutionAuthority(\n              execution.id,\n              \"agent authority must reference its managed service account\"\n            )\n          }\n        } else if (resolved.ref.credential === undefined) {\n          throw invalidExecutionAuthority(\n            execution.id,\n            \"inherited user agent authority requires a credential\"\n          )\n        }\n        return\n      }\n      if (resolved.type === \"unrestricted\" && resolved.ref.type === \"disabled\") return\n      throw invalidExecutionAuthority(\n        execution.id,\n        \"agent authority must be principal or explicitly disabled\"\n      )\n\n    case \"kernel\":\n      if (\n        resolved.type !== \"unrestricted\" ||\n        resolved.ref.type !== \"kernel\" ||\n        execution.requestedBy !== undefined ||\n        resolved.ref.operation.type !== execution.executor.operation.type ||\n        kernelOperationId(resolved.ref.operation) !==\n          kernelOperationId(execution.executor.operation)\n      ) {\n        throw invalidExecutionAuthority(\n          execution.id,\n          \"kernel authority does not match its executor\"\n        )\n      }\n      return\n  }\n}\n\nfunction principalsEqual(\n  left: AuthorizablePrincipal | undefined,\n  right: AuthorizablePrincipal | undefined\n): boolean {\n  return left?.type === right?.type && left?.id === right?.id\n}\n\nfunction invalidExecutionAuthority(executionId: string, reason: string): Error {\n  return createSixbError(\n    \"internal.unexpected\",\n    `[Sixb] Execution '${executionId}' is incompatible with its authority: ${reason}.`,\n    { details: { executionId, reason } }\n  )\n}\n\nfunction register(\n  execution: ExecutionContext,\n  input: RegisteredRuntimeAuthorization\n): RuntimeAuthorization {\n  assertNonEmpty(input.projectId, \"Authorization project id\")\n  const executionBinding = snapshotExecutionContext(execution)\n  if (input.projectId !== executionBinding.projectId) {\n    throw new Error(\n      `[Sixb] Runtime authorization belongs to project '${input.projectId}', not execution project '${executionBinding.projectId}'.`\n    )\n  }\n  assertResolvedAuthorizationMatchesExecution(input, executionBinding)\n  const authorization = createRuntimeAuthorizationCapability()\n  registeredAuthorizations.set(\n    authorization,\n    Object.freeze({ resolved: Object.freeze(input), execution: executionBinding })\n  )\n  return authorization\n}\n\nfunction executionMatchesBinding(binding: ExecutionContext, execution: ExecutionContext): boolean {\n  try {\n    return isDeepStrictEqual(binding, snapshotExecutionContext(execution))\n  } catch {\n    return false\n  }\n}\n\nfunction snapshotExecutionContext(execution: ExecutionContext): ExecutionContext {\n  assertNonEmpty(execution.id, \"Execution id\")\n  assertNonEmpty(execution.projectId, \"Execution project id\")\n  assertNonEmpty(execution.correlationId, \"Execution correlation id\")\n  return Object.freeze({\n    id: execution.id,\n    projectId: execution.projectId,\n    ...(execution.requestedBy === undefined\n      ? {}\n      : { requestedBy: snapshotAuthorizablePrincipal(execution.requestedBy) }),\n    executor: snapshotExecutionExecutor(execution.executor),\n    source: snapshotExecutionSource(execution.source),\n    correlationId: execution.correlationId,\n  })\n}\n\nfunction snapshotExecutionExecutor(\n  executor: ExecutionContext[\"executor\"]\n): ExecutionContext[\"executor\"] {\n  switch (executor.type) {\n    case \"request\":\n      assertNonEmpty(executor.requestId, \"Execution request id\")\n      return Object.freeze({ type: \"request\", requestId: executor.requestId })\n    case \"primitive\": {\n      const primitive = snapshotTrustedPrimitive(executor)\n      return Object.freeze({ type: \"primitive\", ...primitive })\n    }\n    case \"agent\":\n      if (executor.actorId !== undefined)\n        assertNonEmpty(executor.actorId, \"Execution Agent actor id\")\n      assertNonEmpty(executor.runId, \"Execution Agent run id\")\n      return Object.freeze({\n        type: \"agent\",\n        ...(executor.actorId === undefined ? {} : { actorId: executor.actorId }),\n        runId: executor.runId,\n      })\n    case \"kernel\":\n      return Object.freeze({\n        type: \"kernel\",\n        operation: snapshotKernelOperation(executor.operation),\n      })\n  }\n  throw new Error(\n    `[Sixb] Unknown execution executor type '${String((executor as { type?: unknown }).type)}'.`\n  )\n}\n\nfunction snapshotExecutionSource(source: ExecutionContext[\"source\"]): ExecutionContext[\"source\"] {\n  switch (source.type) {\n    case \"ontologyCommit\":\n      assertNonEmpty(source.commitId, \"Execution source commit id\")\n      return Object.freeze({ type: source.type, commitId: source.commitId })\n    case \"http\":\n      assertNonEmpty(source.requestId, \"Execution source request id\")\n      return Object.freeze({ type: \"http\", requestId: source.requestId })\n    case \"webhook\":\n      assertNonEmpty(source.deliveryId, \"Execution source delivery id\")\n      return Object.freeze({ type: \"webhook\", deliveryId: source.deliveryId })\n    case \"schedule\":\n    case \"event\":\n      assertNonEmpty(source.eventId, \"Execution source event id\")\n      return Object.freeze({ type: source.type, eventId: source.eventId })\n    case \"datasetVersion\":\n      assertNonEmpty(source.datasetId, \"Execution source dataset id\")\n      assertNonEmpty(source.versionId, \"Execution source dataset version id\")\n      return Object.freeze({\n        type: \"datasetVersion\",\n        datasetId: source.datasetId,\n        versionId: source.versionId,\n      })\n    case \"execution\":\n      assertNonEmpty(source.executionId, \"Execution source execution id\")\n      return Object.freeze({ type: \"execution\", executionId: source.executionId })\n  }\n  throw new Error(\n    `[Sixb] Unknown execution source type '${String((source as { type?: unknown }).type)}'.`\n  )\n}\n\nfunction snapshotAuthorizationContext(\n  context: AuthorizationContext\n): PrincipalAuthorizationContext {\n  const principal = snapshotAuthorizablePrincipal(context.principal)\n  const grants = {} as Record<TargetedGrantKind, ReadonlySet<string>>\n  for (const kind of TARGETED_GRANT_KIND_KEYS) {\n    grants[kind] = new ImmutableGrantSet(context.grants[kind])\n  }\n  const frozenGrants: GrantIndex = Object.freeze({\n    ...grants,\n    \"run:agent\": context.grants[\"run:agent\"],\n  })\n  return Object.freeze({\n    principal,\n    ...(context.sessionId === undefined ? {} : { sessionId: context.sessionId }),\n    groupIds: Object.freeze([...context.groupIds]),\n    roleIds: Object.freeze([...context.roleIds]),\n    grants: frozenGrants,\n  })\n}\n\n/** Read-only Set semantics with no mutable handle hidden behind the TypeScript interface. */\nclass ImmutableGrantSet implements ReadonlySet<string> {\n  readonly #values: Set<string>\n  readonly [Symbol.toStringTag] = \"Set\"\n\n  constructor(values: Iterable<string>) {\n    this.#values = new Set(values)\n    Object.freeze(this)\n  }\n\n  get size(): number {\n    return this.#values.size\n  }\n\n  has(value: string): boolean {\n    return this.#values.has(value)\n  }\n\n  entries(): ReturnType<Set<string>[\"entries\"]> {\n    return this.#values.entries()\n  }\n\n  keys(): ReturnType<Set<string>[\"keys\"]> {\n    return this.#values.keys()\n  }\n\n  values(): ReturnType<Set<string>[\"values\"]> {\n    return this.#values.values()\n  }\n\n  [Symbol.iterator](): ReturnType<Set<string>[typeof Symbol.iterator]> {\n    return this.#values[Symbol.iterator]()\n  }\n\n  forEach(\n    callback: (value: string, valueAgain: string, set: ReadonlySet<string>) => void,\n    thisArg?: unknown\n  ): void {\n    for (const value of this.#values) {\n      callback.call(thisArg, value, value, this)\n    }\n  }\n\n  add(_value: string): never {\n    throw immutableGrantSetMutation()\n  }\n\n  delete(_value: string): never {\n    throw immutableGrantSetMutation()\n  }\n\n  clear(): never {\n    throw immutableGrantSetMutation()\n  }\n}\n\nObject.freeze(ImmutableGrantSet.prototype)\n\nfunction immutableGrantSetMutation(): Error {\n  return new Error(\"[Sixb] Runtime authorization grants are immutable.\")\n}\n\nfunction snapshotAuthorizablePrincipal(principal: Principal): AuthorizablePrincipal {\n  if (principal.type !== \"user\" && principal.type !== \"serviceAccount\") {\n    throw new Error(`[Sixb] Principal type '${principal.type}' cannot hold runtime authorization.`)\n  }\n  assertNonEmpty(principal.id, \"Authorization principal id\")\n  return Object.freeze({ type: principal.type, id: principal.id })\n}\n\nfunction snapshotCredential(\n  credential: NonNullable<Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]>\n): NonNullable<Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]> {\n  assertNonEmpty(credential.id, \"Authorization credential id\")\n  if (credential.type !== \"session\" && credential.type !== \"accessToken\") {\n    const credentialType = (credential as { readonly type: string }).type\n    throw new Error(`[Sixb] Unknown authorization credential type '${credentialType}'.`)\n  }\n  return Object.freeze({ type: credential.type, id: credential.id })\n}\n\nfunction assertCredentialMatchesContext(\n  context: PrincipalAuthorizationContext,\n  credential:\n    | NonNullable<Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]>\n    | undefined\n): void {\n  if (credential?.type === \"session\") {\n    if (context.sessionId !== credential.id) {\n      throw new Error(\n        \"[Sixb] Session credential id must match the authorization context session id.\"\n      )\n    }\n    return\n  }\n  if (context.sessionId !== undefined) {\n    throw new Error(\"[Sixb] Authorization context session requires a matching session credential.\")\n  }\n}\n\nfunction snapshotTrustedPrimitive(primitive: TrustedPrimitiveRef): TrustedPrimitiveRef {\n  if (!isTrustedPrimitiveKind(primitive.kind)) {\n    throw new Error(`[Sixb] Unknown trusted primitive kind '${primitive.kind}'.`)\n  }\n  assertNonEmpty(primitive.id, \"Trusted primitive id\")\n  assertNonEmpty(primitive.runId, \"Trusted primitive run id\")\n  return Object.freeze({ kind: primitive.kind, id: primitive.id, runId: primitive.runId })\n}\n\nfunction snapshotKernelOperation(operation: KernelOperation): KernelOperation {\n  if (operation.type !== \"ontology.recover\" && operation.type !== \"ontology.indexVectors\") {\n    throw new Error(\n      `[Sixb] Unknown kernel operation '${String((operation as { type?: unknown }).type)}'.`\n    )\n  }\n  assertNonEmpty(kernelOperationId(operation), \"Kernel operation id\")\n  return Object.freeze(kernelOperationFromId(operation.type, kernelOperationId(operation)))\n}\n\n/** Validate, bound, and detach exact delegated Action targets before registering authority. */\nfunction snapshotDelegatedActionApply(\n  input: readonly DelegatedActionApplyTarget[]\n): readonly DelegatedActionApplyTarget[] {\n  if (!Array.isArray(input)) {\n    throw new Error(\"[Sixb] Delegated Action targets must be an array.\")\n  }\n\n  const targetCount = input.length\n  if (targetCount > MAX_DELEGATED_ACTION_APPLY_TARGETS) {\n    throw new Error(\n      `[Sixb] Delegated authority exceeds the maximum of ${MAX_DELEGATED_ACTION_APPLY_TARGETS} Action targets.`\n    )\n  }\n\n  let identifierCharacters = 0\n  const targets: DelegatedActionApplyTarget[] = []\n  for (let index = 0; index < targetCount; index += 1) {\n    const authoredTarget = input[index]\n    if (!isRecord(authoredTarget)) {\n      throw new Error(`[Sixb] Delegated Action target ${index} must be an object.`)\n    }\n\n    const authoredActionId = authoredTarget.actionId\n    const authoredSubject = authoredTarget.subject\n    if (!isRecord(authoredSubject)) {\n      throw new Error(`[Sixb] Delegated Action target ${index} subject must be an ObjectRef.`)\n    }\n\n    const actionId = delegatedActionIdentifier(\n      authoredActionId,\n      `Delegated Action target ${index} action id`\n    )\n    const objectTypeId = delegatedActionIdentifier(\n      authoredSubject.objectTypeId,\n      `Delegated Action target ${index} subject object type id`\n    )\n    const primaryId = delegatedActionIdentifier(\n      authoredSubject.primaryId,\n      `Delegated Action target ${index} subject primary id`\n    )\n    identifierCharacters += actionId.length + objectTypeId.length + primaryId.length\n    if (identifierCharacters > MAX_DELEGATED_ACTION_IDENTIFIER_CHARACTERS) {\n      throw new Error(\n        `[Sixb] Delegated authority exceeds the maximum of ${MAX_DELEGATED_ACTION_IDENTIFIER_CHARACTERS} Action identifier characters.`\n      )\n    }\n\n    targets.push(\n      Object.freeze({\n        actionId,\n        subject: Object.freeze({ objectTypeId, primaryId }),\n      })\n    )\n  }\n\n  return Object.freeze(targets)\n}\n\nfunction delegatedActionIdentifier(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !value.trim()) {\n    throw new Error(`[Sixb] ${label} must not be empty.`)\n  }\n  return value\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction cloneAuthorizationRef(ref: AuthorizationRef): AuthorizationRef {\n  switch (ref.type) {\n    case \"principal\":\n      return {\n        type: \"principal\",\n        principal: { ...ref.principal },\n        ...(ref.credential === undefined ? {} : { credential: { ...ref.credential } }),\n      }\n    case \"trustedPrimitive\":\n      return { type: \"trustedPrimitive\", primitive: { ...ref.primitive } }\n    case \"delegated\":\n      return { type: \"delegated\", delegation: { ...ref.delegation } }\n    case \"kernel\":\n      return { type: \"kernel\", operation: { ...ref.operation } }\n    case \"disabled\":\n      return { type: \"disabled\" }\n  }\n}\n\nfunction isTrustedPrimitiveKind(value: string): value is TrustedPrimitiveKind {\n  return (\n    value === \"action\" ||\n    value === \"pipeline\" ||\n    value === \"projection\" ||\n    value === \"rule\" ||\n    value === \"sync\" ||\n    value === \"webhook\" ||\n    value === \"workflow\"\n  )\n}\n\nfunction assertNonEmpty(value: string, label: string): void {\n  if (!value.trim()) {\n    throw new Error(`[Sixb] ${label} must not be empty.`)\n  }\n}\n",
-    "/** Deterministic managed service-account id owned by one framework Agent actor. */\nexport function agentServiceAccountId(actorId: string): string {\n  return `svc_agent_${actorId}`\n}\n",
-    "/**\n * Grant kinds: the single source of truth for the (capability, target) space.\n *\n * Every grant collapses to one `GrantKind` discriminant — the same\n * `capability:target` string the decision engine uses as a grant key (e.g.\n * `view:object`, `run:sync`). Resolution, validation, enforcement, and the\n * resolved `GrantIndex` all key off it, so adding a grant family is a single\n * entry in `GRANT_KINDS` plus the compile errors that forces at every consumer.\n */\n\nimport type { AgentRunGrant, GrantDefinition } from \"../security/types\"\n\nexport type GrantKind =\n  | \"access:application\"\n  | \"view:object\"\n  | \"view:dataset\"\n  | \"edit:object\"\n  | \"append:telemetry\"\n  | \"apply:action\"\n  | \"share:share\"\n  | \"run:workflow\"\n  | \"run:sync\"\n  | \"run:pipeline\"\n  | \"run:agent\"\n  | \"observe:logs\"\n  | \"observe:aiUsage\"\n  | \"manage:connector\"\n  | \"manage:aiUsage\"\n\nexport type SingletonGrantKind = \"run:agent\"\nexport type TargetedGrantKind = Exclude<GrantKind, SingletonGrantKind>\n\n/** Registered id universes a grant kind ranges over, plus subtype expansion. */\nexport interface GrantUniverse {\n  readonly applicationIds: ReadonlySet<string>\n  readonly objectTypeIds: ReadonlySet<string>\n  readonly datasetIds: ReadonlySet<string>\n  readonly actionIds: ReadonlySet<string>\n  readonly shareIds: ReadonlySet<string>\n  readonly workflowIds: ReadonlySet<string>\n  readonly syncIds: ReadonlySet<string>\n  readonly pipelineIds: ReadonlySet<string>\n  readonly observableIds: ReadonlySet<string>\n  readonly connectorIds: ReadonlySet<string>\n  readonly manageableIds: ReadonlySet<string>\n  readonly getSubTypes: (objectTypeId: string) => readonly string[]\n}\n\n/** The registered-id sets a grant kind validates against (no subtype hook). */\nexport type GrantUniverseKey = Exclude<keyof GrantUniverse, \"getSubTypes\">\n\ninterface TargetedGrantKindSpec {\n  /** Registered universe the grant's ids must belong to. */\n  readonly universeKey: GrantUniverseKey\n  /** Subject noun used in validation errors (\"unknown <subject> '<id>'\"). */\n  readonly subject: string\n  /** Actionable hint appended to the \"unknown <subject>\" error. */\n  readonly fix: string\n  /** Only object-type grants also expand to subtypes. */\n  readonly expandsSubtypes?: true\n}\n\ninterface SingletonGrantKindSpec {\n  /** Project-wide capability with no resource selection; resolves to a boolean. */\n  readonly singleton: true\n  readonly subject: string\n  readonly fix: string\n}\n\n/**\n * The exhaustive grant-kind table. A new grant family is one entry here; the\n * mapped type makes every omission a compile error.\n */\nexport const GRANT_KINDS: {\n  readonly [TKind in GrantKind]: TKind extends SingletonGrantKind\n    ? SingletonGrantKindSpec\n    : TargetedGrantKindSpec\n} = {\n  \"access:application\": {\n    universeKey: \"applicationIds\",\n    subject: \"application\",\n    fix: \"Use an application exported from '@sixb/core'.\",\n  },\n  \"view:object\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n    expandsSubtypes: true,\n  },\n  \"view:dataset\": {\n    universeKey: \"datasetIds\",\n    subject: \"dataset\",\n    fix: \"Add it to 'datasets/' or pass it to createSixb({ datasets }).\",\n  },\n  // Deliberately no `expandsSubtypes`: granting writes on a parent type must not\n  // silently extend to types added under it later. `view:object` expands because\n  // a read of a subtype reveals nothing the parent's grant did not already cover.\n  \"edit:object\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n  },\n  \"append:telemetry\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n  },\n  \"apply:action\": {\n    universeKey: \"actionIds\",\n    subject: \"action\",\n    fix: \"Add it to 'actions/' or pass it to createSixb({ actions }).\",\n  },\n  \"share:share\": {\n    universeKey: \"shareIds\",\n    subject: \"share\",\n    fix: \"Add it to 'shares/' or pass it to createSixb({ shares }).\",\n  },\n  \"run:workflow\": {\n    universeKey: \"workflowIds\",\n    subject: \"workflow\",\n    fix: \"Add it to 'workflows/' or pass it to createSixb({ workflows }).\",\n  },\n  \"run:sync\": {\n    universeKey: \"syncIds\",\n    subject: \"sync\",\n    fix: \"Add it to 'syncs/' or pass it to createSixb({ syncs }).\",\n  },\n  \"run:pipeline\": {\n    universeKey: \"pipelineIds\",\n    subject: \"pipeline\",\n    fix: \"Add it to 'pipelines/' or pass it to createSixb({ pipelines }).\",\n  },\n  \"run:agent\": {\n    singleton: true,\n    subject: \"agent\",\n    fix: \"Configure models.language and use the exported agent reference in can.run(agent).\",\n  },\n  \"observe:logs\": {\n    universeKey: \"observableIds\",\n    subject: \"observability surface\",\n    fix: 'Use can.observe(\"logs\").',\n  },\n  \"observe:aiUsage\": {\n    universeKey: \"observableIds\",\n    subject: \"observability surface\",\n    fix: \"Use can.observe(agent.usage).\",\n  },\n  \"manage:connector\": {\n    universeKey: \"connectorIds\",\n    subject: \"connector\",\n    fix: \"Add it to 'connectors/' or pass it to createSixb({ connectors }).\",\n  },\n  \"manage:aiUsage\": {\n    universeKey: \"manageableIds\",\n    subject: \"management surface\",\n    fix: \"Use can.manage(agent.usage).\",\n  },\n}\n\nexport const GRANT_KIND_KEYS = Object.keys(GRANT_KINDS) as readonly GrantKind[]\nexport const TARGETED_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter(\n  (kind): kind is TargetedGrantKind => kind !== \"run:agent\"\n)\n\n/** The grant kind a stored grant resolves to. */\nexport function grantKindOf(grant: AgentRunGrant): SingletonGrantKind\nexport function grantKindOf(grant: Exclude<GrantDefinition, AgentRunGrant>): TargetedGrantKind\nexport function grantKindOf(grant: GrantDefinition): GrantKind\nexport function grantKindOf(grant: GrantDefinition): GrantKind {\n  switch (grant.capability) {\n    case \"access\":\n      return \"access:application\"\n    case \"view\":\n      return `view:${grant.target}`\n    case \"edit\":\n      return \"edit:object\"\n    case \"append\":\n      return \"append:telemetry\"\n    case \"apply\":\n      return \"apply:action\"\n    case \"share\":\n      return \"share:share\"\n    case \"run\":\n      return `run:${grant.target}`\n    case \"observe\":\n      return `observe:${grant.target}`\n    case \"manage\":\n      return `manage:${grant.target}`\n  }\n}\n\n/** Mutable grant index: booleans for singleton capabilities, id sets for selected resources. */\nexport type MutableGrantIndex = {\n  [TKind in GrantKind]: TKind extends SingletonGrantKind ? boolean : Set<string>\n}\n\nexport function emptyGrantSets(): MutableGrantIndex {\n  return {\n    \"access:application\": new Set(),\n    \"view:object\": new Set(),\n    \"view:dataset\": new Set(),\n    \"edit:object\": new Set(),\n    \"append:telemetry\": new Set(),\n    \"apply:action\": new Set(),\n    \"share:share\": new Set(),\n    \"run:workflow\": new Set(),\n    \"run:sync\": new Set(),\n    \"run:pipeline\": new Set(),\n    \"run:agent\": false,\n    \"observe:logs\": new Set(),\n    \"observe:aiUsage\": new Set(),\n    \"manage:connector\": new Set(),\n    \"manage:aiUsage\": new Set(),\n  }\n}\n",
-    "/** Provider-side limits for one selected object-read operation. */\nexport interface ObjectReadExecutionLimits {\n  /** Maximum number of live roots and selected edge occurrences resolved by one operation. */\n  readonly maxTraversalFacts: number\n  /** Maximum UTF-8 JSON size released by one operation. */\n  readonly maxOutputJsonBytes: number\n}\n\nexport type ObjectReadLimitMetric = \"traversalFacts\" | \"outputJsonBytes\"\n\n/** Cross-provider admission bound for one selected-reader facet terminal. */\nexport const MAX_OBJECT_READ_FACETS = 16\n\nconst MAX_OUTPUT_JSON_DEPTH = 64\n\n/** Stable, provider-neutral failure raised when an object-read budget is exhausted. */\nexport class ObjectReadLimitExceededError extends Error {\n  readonly name = \"ObjectReadLimitExceededError\"\n  readonly code = \"object_read_limit_exceeded\"\n\n  constructor(\n    readonly metric: ObjectReadLimitMetric,\n    readonly limit: number\n  ) {\n    super(`[Sixb] Object read exceeded its ${metric} limit (${limit}).`)\n  }\n}\n\n/** Validate and detach limits at the provider boundary. */\nexport function snapshotObjectReadExecutionLimits(\n  limits: ObjectReadExecutionLimits\n): ObjectReadExecutionLimits {\n  if (typeof limits !== \"object\" || limits === null) {\n    throw new Error(\"[Sixb] Object read execution limits must be provided.\")\n  }\n  return Object.freeze({\n    maxTraversalFacts: positiveSafeInteger(limits.maxTraversalFacts, \"maxTraversalFacts\"),\n    maxOutputJsonBytes: positiveSafeInteger(limits.maxOutputJsonBytes, \"maxOutputJsonBytes\"),\n  })\n}\n\n/** Reject facet fan-out before a provider resolves the selected universe. */\nexport function assertObjectReadFacetCount(count: number): void {\n  if (!Number.isSafeInteger(count) || count < 0 || count > MAX_OBJECT_READ_FACETS) {\n    throw new Error(\n      `[Sixb] An object read supports between 0 and ${MAX_OBJECT_READ_FACETS} facets.`\n    )\n  }\n}\n\n/** Fail before a selected reader releases an oversized value to its caller. */\nexport function assertObjectReadOutputWithinLimit(\n  value: unknown,\n  limits: Pick<ObjectReadExecutionLimits, \"maxOutputJsonBytes\">\n): void {\n  const fail = (): never => {\n    throw new ObjectReadLimitExceededError(\"outputJsonBytes\", limits.maxOutputJsonBytes)\n  }\n  const stack: Array<{ value: object; serializedChildren: number }> = []\n  let bytes = 0\n  const addBytes = (count: number): void => {\n    bytes += count\n    if (bytes > limits.maxOutputJsonBytes) fail()\n  }\n  const addPrimitiveBytes = (primitive: boolean | number | string): void => {\n    switch (typeof primitive) {\n      case \"string\":\n        addBytes(jsonStringUtf8Length(primitive))\n        break\n      case \"number\":\n        addBytes(\n          Number.isFinite(primitive) ? (Object.is(primitive, -0) ? 1 : String(primitive).length) : 4\n        )\n        break\n      case \"boolean\":\n        addBytes(primitive ? 4 : 5)\n        break\n    }\n  }\n\n  try {\n    JSON.stringify(value, function (this: unknown, key, current: unknown) {\n      const parent = isObject(this) ? this : undefined\n      let parentFrameIndex = -1\n      if (parent) {\n        for (let index = stack.length - 1; index >= 0; index -= 1) {\n          if (stack[index]?.value === parent) {\n            parentFrameIndex = index\n            break\n          }\n        }\n      }\n      const isRoot = parentFrameIndex === -1\n      if (isRoot) {\n        stack.length = 0\n      } else {\n        stack.length = parentFrameIndex + 1\n      }\n      const parentFrame = isRoot ? undefined : stack[parentFrameIndex]\n      const parentIsArray = Array.isArray(parent)\n      const unsupported =\n        current === undefined || typeof current === \"function\" || typeof current === \"symbol\"\n\n      if (!isRoot) {\n        if (!parentIsArray && unsupported) return current\n        if (!parentFrame) return fail()\n        if (parentFrame.serializedChildren > 0) addBytes(1)\n        parentFrame.serializedChildren += 1\n        if (!parentIsArray) addBytes(jsonStringUtf8Length(key) + 1)\n      } else if (unsupported) {\n        return current\n      }\n\n      if (parentIsArray && unsupported) {\n        addBytes(4)\n        return current\n      }\n\n      if (isObject(current)) {\n        // JSON.stringify handles primitive wrappers and raw JSON specially after the replacer.\n        // Return an already-coerced primitive so custom Number/String coercion runs exactly once.\n        const special = inspectJsonSpecialObject(current)\n        switch (special.kind) {\n          case \"primitive\":\n            addPrimitiveBytes(special.value)\n            return special.value\n          case \"bigint\":\n            throw new TypeError(\"BigInt is not JSON serializable\")\n          case \"raw\":\n            addBytes(rawJsonUtf8Length(special.value))\n            return current\n          case \"ordinary\":\n            break\n        }\n      }\n\n      switch (typeof current) {\n        case \"string\":\n          addPrimitiveBytes(current)\n          break\n        case \"number\":\n          addPrimitiveBytes(current)\n          break\n        case \"boolean\":\n          addPrimitiveBytes(current)\n          break\n        case \"bigint\":\n          throw new TypeError(\"BigInt is not JSON serializable\")\n        case \"object\":\n          if (current === null) {\n            addBytes(4)\n            break\n          }\n          if (stack.some((frame) => frame.value === current)) {\n            throw new TypeError(\"Cyclic object value\")\n          }\n          if (stack.length + 1 > MAX_OUTPUT_JSON_DEPTH) fail()\n          addBytes(2)\n          stack.push({ value: current, serializedChildren: 0 })\n          break\n      }\n      return current\n    })\n  } catch (error) {\n    if (error instanceof ObjectReadLimitExceededError) throw error\n    if (error instanceof RangeError || error instanceof TypeError) fail()\n    throw error\n  }\n}\n\ntype JsonSpecialObject =\n  | { readonly kind: \"ordinary\" }\n  | { readonly kind: \"primitive\"; readonly value: boolean | number | string }\n  | { readonly kind: \"bigint\" }\n  | { readonly kind: \"raw\"; readonly value: string }\n\nconst jsonWithRawJson = JSON as JSON & {\n  isRawJSON?: (value: unknown) => boolean\n}\nconst isRawJson = jsonWithRawJson.isRawJSON?.bind(jsonWithRawJson)\nconst booleanValueOf = bindValueOf(Boolean.prototype.valueOf)\nconst numberValueOf = bindValueOf(Number.prototype.valueOf)\nconst stringValueOf = bindValueOf(String.prototype.valueOf)\nconst bigintValueOf = bindValueOf(BigInt.prototype.valueOf)\nconst toStringValue = String\n\nfunction inspectJsonSpecialObject(value: object): JsonSpecialObject {\n  if (isRawJson?.(value)) {\n    const raw = (value as { readonly rawJSON?: unknown }).rawJSON\n    if (typeof raw !== \"string\") return { kind: \"ordinary\" }\n    return { kind: \"raw\", value: raw }\n  }\n\n  const boolean = unbox(value, booleanValueOf)\n  if (boolean.matched) return { kind: \"primitive\", value: boolean.value }\n  const number = unbox(value, numberValueOf)\n  if (number.matched) return { kind: \"primitive\", value: +(value as unknown as number) }\n  const string = unbox(value, stringValueOf)\n  if (string.matched) return { kind: \"primitive\", value: toStringValue(value) }\n  if (unbox(value, bigintValueOf).matched) return { kind: \"bigint\" }\n  return { kind: \"ordinary\" }\n}\n\nfunction bindValueOf<T>(unboxer: (this: object) => T): (value: object) => T {\n  return Function.prototype.call.bind(unboxer) as (value: object) => T\n}\n\nfunction unbox<T>(\n  value: object,\n  unboxer: (value: object) => T\n): { readonly matched: true; readonly value: T } | { readonly matched: false } {\n  try {\n    return { matched: true, value: unboxer(value) }\n  } catch {\n    return { matched: false }\n  }\n}\n\nfunction rawJsonUtf8Length(value: string): number {\n  // Raw JSON is already escaped source text. Count its encoded bytes directly without allocating\n  // a second encoded buffer proportional to the caller-controlled payload.\n  let bytes = 0\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index)\n    if (code <= 0x7f) {\n      bytes += 1\n    } else if (code <= 0x7ff) {\n      bytes += 2\n    } else if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1)\n      if (next >= 0xdc00 && next <= 0xdfff) {\n        bytes += 4\n        index += 1\n      } else {\n        bytes += 3\n      }\n    } else {\n      bytes += 3\n    }\n  }\n  return bytes\n}\n\nfunction jsonStringUtf8Length(value: string): number {\n  let bytes = 2\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index)\n    if (code === 0x22 || code === 0x5c) {\n      bytes += 2\n    } else if (code <= 0x1f) {\n      bytes +=\n        code === 0x08 || code === 0x09 || code === 0x0a || code === 0x0c || code === 0x0d ? 2 : 6\n    } else if (code <= 0x7f) {\n      bytes += 1\n    } else if (code <= 0x7ff) {\n      bytes += 2\n    } else if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1)\n      if (next >= 0xdc00 && next <= 0xdfff) {\n        bytes += 4\n        index += 1\n      } else {\n        bytes += 6\n      }\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      bytes += 6\n    } else {\n      bytes += 3\n    }\n  }\n  return bytes\n}\n\nfunction isObject(value: unknown): value is object {\n  return typeof value === \"object\" && value !== null\n}\n\nfunction positiveSafeInteger(value: unknown, name: string): number {\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value <= 0) {\n    throw new Error(`[Sixb] ${name} must be a positive safe integer.`)\n  }\n  return value\n}\n",
-    "import type { Principal } from \"../auth/types\"\n\n/** User or service account that may initiate or authorize an execution. */\nexport type AuthorizablePrincipal = Extract<Principal, { readonly type: \"user\" | \"serviceAccount\" }>\n\n/** Registered primitive kinds that may receive internal trusted authority. */\nexport type TrustedPrimitiveKind =\n  | \"action\"\n  | \"pipeline\"\n  | \"projection\"\n  | \"rule\"\n  | \"sync\"\n  | \"webhook\"\n  | \"workflow\"\n\nexport interface TrustedPrimitiveRef {\n  readonly kind: TrustedPrimitiveKind\n  readonly id: string\n  readonly runId: string\n}\n\n/** Durable provenance for authority delegated by one shared-access browser session. */\nexport interface SharedAccessDelegationRef {\n  readonly kind: \"share\"\n  readonly grantId: string\n  readonly sessionId: string\n}\n\nexport type KernelOperation =\n  | { readonly type: \"ontology.recover\"; readonly recoveryId: string }\n  | { readonly type: \"ontology.indexVectors\"; readonly indexingId: string }\n\n/** Workload currently executing. This is provenance and never grants authority by itself. */\nexport type ExecutionExecutor =\n  | { readonly type: \"request\"; readonly requestId: string }\n  | {\n      readonly type: \"primitive\"\n      readonly kind: TrustedPrimitiveKind\n      readonly id: string\n      readonly runId: string\n    }\n  | { readonly type: \"agent\"; readonly actorId?: string; readonly runId: string }\n  | { readonly type: \"kernel\"; readonly operation: KernelOperation }\n\n/**\n * Occurrence that directly triggered an execution.\n *\n * An `execution` source is the single logical parent of a nested execution.\n */\nexport type ExecutionSource =\n  | { readonly type: \"ontologyCommit\"; readonly commitId: string }\n  | { readonly type: \"http\"; readonly requestId: string }\n  | { readonly type: \"webhook\"; readonly deliveryId: string }\n  | { readonly type: \"schedule\"; readonly eventId: string }\n  | { readonly type: \"event\"; readonly eventId: string }\n  | { readonly type: \"datasetVersion\"; readonly datasetId: string; readonly versionId: string }\n  | { readonly type: \"execution\"; readonly executionId: string }\n\n/** Immutable provenance for one request, primitive run, agent run, or kernel operation. */\nexport interface ExecutionContext {\n  readonly id: string\n  readonly projectId: string\n  readonly requestedBy?: AuthorizablePrincipal\n  readonly executor: ExecutionExecutor\n  readonly source: ExecutionSource\n  readonly correlationId: string\n}\n\n/** Durable descriptor used to rebuild authority. A reference is never authoritative by itself. */\nexport type AuthorizationRef =\n  | {\n      readonly type: \"principal\"\n      readonly principal: AuthorizablePrincipal\n      readonly credential?:\n        | { readonly type: \"session\"; readonly id: string }\n        | { readonly type: \"accessToken\"; readonly id: string }\n    }\n  | { readonly type: \"trustedPrimitive\"; readonly primitive: TrustedPrimitiveRef }\n  | { readonly type: \"delegated\"; readonly delegation: SharedAccessDelegationRef }\n  | { readonly type: \"kernel\"; readonly operation: KernelOperation }\n  | { readonly type: \"disabled\" }\n\nclass RuntimeAuthorizationCapability {\n  readonly #runtimeAuthorization = true\n\n  private constructor() {}\n\n  static create(): RuntimeAuthorizationCapability {\n    const capability = new RuntimeAuthorizationCapability()\n    Object.freeze(capability)\n    return capability\n  }\n\n  static is(value: unknown): value is RuntimeAuthorizationCapability {\n    return typeof value === \"object\" && value !== null && #runtimeAuthorization in value\n  }\n}\n\n/**\n * Opaque, process-local authority.\n *\n * The private class makes it nominal in TypeScript; Core registry membership makes it authoritative\n * at runtime. The capability itself is never persisted.\n */\nexport type RuntimeAuthorization = RuntimeAuthorizationCapability\n\n/** Execution provenance paired with the process-local authority that permits its operations. */\nexport interface ExecutionScope {\n  readonly execution: ExecutionContext\n  readonly authorization: RuntimeAuthorization\n}\n\n/** Internal constructor; the package root exports only the opaque type. */\nexport function createRuntimeAuthorizationCapability(): RuntimeAuthorization {\n  return RuntimeAuthorizationCapability.create()\n}\n\n/** Internal runtime guard; registry membership remains the source of authority. */\nexport function isRuntimeAuthorizationCapability(value: unknown): value is RuntimeAuthorization {\n  return RuntimeAuthorizationCapability.is(value)\n}\n",
-    "/** Thrown when a scoped operation is not covered by the principal's grants. Maps to HTTP 403. */\nexport class AuthorizationError extends Error {\n  readonly name = \"AuthorizationError\"\n\n  constructor(\n    /** Stable key of the missing grant, e.g. `view:object:Contract`. */\n    readonly grantKey: string,\n    message: string\n  ) {\n    super(message)\n  }\n}\n",
-    "/**\n * Authorization decisions for the core data path.\n *\n * `evaluate` is the single place that maps a request to the resolved grant\n * index. `can` (boolean) and `assertAuthorized` (throw) are the two ways to\n * consume a decision; every enforcement site goes through one of them.\n *\n * Every protected leaf first resolves the opaque runtime capability. Missing, forged, or\n * unregistered authority is denied; only an explicitly registered trusted or disabled execution\n * is unrestricted.\n */\n\nimport type { AuthSessionAudience } from \"../auth/audience\"\nimport {\n  type ResolvedRuntimeAuthorization,\n  resolveExecutionScopeAuthorization,\n  resolveRuntimeAuthorizationForProject,\n} from \"../execution/authorization\"\nimport type { ExecutionContext, RuntimeAuthorization } from \"../execution/types\"\nimport { AuthorizationError } from \"./errors\"\nimport type { GrantKind } from \"./grant-kinds\"\nimport type { AuthorizationContext, GrantIndex } from \"./types\"\n\n/** Something a principal may attempt, paired with the resource it targets. */\nexport type AuthzRequest =\n  | { readonly kind: \"application.access\"; readonly audience: AuthSessionAudience }\n  | { readonly kind: \"object.view\"; readonly objectTypeId: string }\n  | { readonly kind: \"dataset.view\"; readonly datasetId: string }\n  | { readonly kind: \"object.edit\"; readonly objectTypeId: string }\n  | { readonly kind: \"telemetry.append\"; readonly objectTypeId: string }\n  | { readonly kind: \"action.apply\"; readonly actionId: string }\n  | { readonly kind: \"share.manage\"; readonly shareId: string }\n  | { readonly kind: \"workflow.run\"; readonly workflowId: string }\n  | { readonly kind: \"sync.run\"; readonly syncId: string }\n  | { readonly kind: \"pipeline.run\"; readonly pipelineId: string }\n  | { readonly kind: \"agent.run\" }\n  | { readonly kind: \"logs.observe\" }\n  | { readonly kind: \"aiUsage.observe\" }\n  | { readonly kind: \"aiUsage.manage\" }\n  | { readonly kind: \"connector.manage\"; readonly connectorId: string }\n  | { readonly kind: \"object.query\"; readonly touchedObjectTypeIds: readonly string[] }\n\nexport interface AuthzDecision {\n  readonly allowed: boolean\n  /** Grant keys the request needs, e.g. `view:object:quote`. */\n  readonly requirements: readonly string[]\n  /** Required keys the principal lacks; empty when allowed. */\n  readonly missing: readonly string[]\n}\n\ninterface AuthorizedRuntime {\n  readonly projectId: string\n  readonly runtimeAuthorization?: RuntimeAuthorization\n  readonly authorization?: AuthorizationContext\n}\n\n// A request expands to one or more atomic (grant kind, id) checks. The atom is\n// the single unit that both names a requirement and tests the grant index, so\n// the two can never drift. `kind` is the resolved-index key, so enforcement is\n// a direct lookup with no per-target dispatch.\ntype Atom =\n  | { readonly kind: \"run:agent\" }\n  | { readonly kind: Exclude<GrantKind, \"run:agent\">; readonly id: string }\n\nfunction atomsFor(request: AuthzRequest): readonly Atom[] {\n  switch (request.kind) {\n    case \"application.access\":\n      return [{ kind: \"access:application\", id: request.audience }]\n    case \"object.view\":\n      return [{ kind: \"view:object\", id: request.objectTypeId }]\n    case \"dataset.view\":\n      return [{ kind: \"view:dataset\", id: request.datasetId }]\n    case \"object.edit\":\n      return [{ kind: \"edit:object\", id: request.objectTypeId }]\n    case \"telemetry.append\":\n      return [{ kind: \"append:telemetry\", id: request.objectTypeId }]\n    case \"action.apply\":\n      return [{ kind: \"apply:action\", id: request.actionId }]\n    case \"share.manage\":\n      return [{ kind: \"share:share\", id: request.shareId }]\n    case \"workflow.run\":\n      return [{ kind: \"run:workflow\", id: request.workflowId }]\n    case \"sync.run\":\n      return [{ kind: \"run:sync\", id: request.syncId }]\n    case \"pipeline.run\":\n      return [{ kind: \"run:pipeline\", id: request.pipelineId }]\n    case \"agent.run\":\n      return [{ kind: \"run:agent\" }]\n    case \"logs.observe\":\n      return [{ kind: \"observe:logs\", id: \"logs\" }]\n    case \"aiUsage.observe\":\n      return [{ kind: \"observe:aiUsage\", id: \"aiUsage\" }]\n    case \"aiUsage.manage\":\n      return [{ kind: \"manage:aiUsage\", id: \"aiUsage\" }]\n    case \"connector.manage\":\n      return [{ kind: \"manage:connector\", id: request.connectorId }]\n    case \"object.query\":\n      return request.touchedObjectTypeIds.map((id) => ({ kind: \"view:object\", id }))\n  }\n}\n\nfunction atomKey(atom: Atom): string {\n  if (atom.kind === \"run:agent\") return atom.kind\n  if (\n    atom.kind === \"observe:logs\" ||\n    atom.kind === \"observe:aiUsage\" ||\n    atom.kind === \"manage:aiUsage\"\n  ) {\n    return atom.kind\n  }\n  return `${atom.kind}:${atom.id}`\n}\n\nfunction holds(grants: GrantIndex, atom: Atom): boolean {\n  if (atom.kind === \"run:agent\") return grants[atom.kind]\n  return grants[atom.kind].has(atom.id)\n}\n\n/** Resolve a request against a principal's grants. Never throws. */\nexport function evaluate(\n  authorization: AuthorizationContext | null | undefined,\n  request: AuthzRequest\n): AuthzDecision {\n  const atoms = atomsFor(request)\n  const requirements = atoms.map(atomKey)\n  const missing = authorization\n    ? atoms.filter((atom) => !holds(authorization.grants, atom)).map(atomKey)\n    : []\n  return { allowed: missing.length === 0, requirements, missing }\n}\n\nexport function isAllowed(\n  authorization: AuthorizationContext | null | undefined,\n  request: AuthzRequest\n): boolean {\n  return evaluate(authorization, request).allowed\n}\n\nexport function assertAuthorized(runtime: AuthorizedRuntime, request: AuthzRequest): void {\n  const resolved = assertRuntimeAuthorizationBound(runtime)\n  if (resolved.type === \"delegated\") {\n    throw new AuthorizationError(\n      `delegated:${request.kind}`,\n      `[Sixb] Operation '${request.kind}' is not covered by delegated authorization.`\n    )\n  }\n  const authorization = resolved.type === \"principal\" ? resolved.context : undefined\n  const decision = evaluate(authorization, request)\n  if (decision.allowed) {\n    return\n  }\n\n  throw new AuthorizationError(\n    decision.missing[0] ?? request.kind,\n    deniedMessage(authorization, request)\n  )\n}\n\n/** Runtime catalogs never infer unrestricted access from an absent principal context. */\nexport function isRuntimeAllowed(runtime: AuthorizedRuntime, request: AuthzRequest): boolean {\n  const authority = resolveRuntimeAuthorizationForProject(runtime)\n  if (authority.type === \"denied\" || authority.type === \"delegated\") return false\n  return authority.type === \"unrestricted\" || isAllowed(authority.context, request)\n}\n\n/** Resolve registered process-local authority before a protected leaf makes a decision. */\nexport function assertRuntimeAuthorizationBound(\n  runtime: AuthorizedRuntime\n): Exclude<ResolvedRuntimeAuthorization, { readonly type: \"denied\" }> {\n  const resolved = resolveRuntimeAuthorizationForProject(runtime)\n  if (resolved.type === \"denied\") {\n    throw new AuthorizationError(\n      \"runtime:unbound\",\n      \"[Sixb] Protected operations require a registered execution scope.\"\n    )\n  }\n  return resolved\n}\n\n/**\n * Assert a principal may write objects of this type.\n *\n * Requires `view:object` as well as `edit:object`, and that is not belt-and-braces: an upsert\n * returns the *merged* row, which the Materializer reconciles against source authority, so the\n * response can carry properties the caller never sent. Granting the write without the read would\n * leak them.\n *\n * The pairing is asserted here rather than implied during resolution: `resolveRoleGrants` has no\n * notion of one grant entailing another, and giving it one would put ids in the resolved index that\n * no role granted — an index that no longer answers \"what was actually granted\".\n *\n * Telemetry append is deliberately *not* paired this way; see {@link assertCanAppendTelemetry}.\n */\nexport function assertCanEdit(runtime: AuthorizedRuntime, objectTypeId: string): void {\n  assertAuthorized(runtime, { kind: \"object.view\", objectTypeId })\n  assertAuthorized(runtime, { kind: \"object.edit\", objectTypeId })\n}\n\n/**\n * Assert a principal may append telemetry points to objects of this type.\n *\n * No `view:object` requirement, unlike {@link assertCanEdit}: an append answers with no object\n * state, so there is nothing to leak. That is what makes a write-only principal — a device, an\n * ingestion service — expressible at all, and it is the reason telemetry has its own grant.\n */\nexport function assertCanAppendTelemetry(runtime: AuthorizedRuntime, objectTypeId: string): void {\n  assertAuthorized(runtime, { kind: \"telemetry.append\", objectTypeId })\n}\n\n/** Assert a principal may manage lifecycle state for this connector definition. */\nexport function assertCanManageConnector(runtime: AuthorizedRuntime, connectorId: string): void {\n  assertAuthorized(runtime, { kind: \"connector.manage\", connectorId })\n}\n\n/**\n * Fail closed for operations that have no grant semantics yet.\n *\n * One caller left — `listLinks`, whose rows reveal target types that no read grant covers. Object,\n * link, and telemetry writes moved to {@link assertCanEdit} / {@link assertCanAppendTelemetry}.\n * Keeps unsupported surfaces denied even if a principal-bound runtime context reaches a code path\n * the execution SDK does not expose.\n */\nexport function assertPrivileged(runtime: AuthorizedRuntime, operation: string): void {\n  const resolved = assertRuntimeAuthorizationBound(runtime)\n  if (resolved.type === \"unrestricted\") {\n    return\n  }\n\n  throw new AuthorizationError(\n    `privileged:${operation}`,\n    `[Sixb] Operation '${operation}' is not covered by scoped authorization grants.`\n  )\n}\n\n/**\n * Assert access to process providers that trusted executions and genuine agent runs may use.\n *\n * Agent provenance alone is not authority: the registered capability must be bound to the exact\n * same immutable execution before this check succeeds.\n */\nexport function assertProviderAccess(\n  runtime: AuthorizedRuntime & { readonly runtimeAuthorization: RuntimeAuthorization },\n  execution: ExecutionContext,\n  operation: string\n): void {\n  const resolved = resolveExecutionScopeAuthorization(runtime.projectId, {\n    execution,\n    authorization: runtime.runtimeAuthorization,\n  })\n  if (resolved.type === \"unrestricted\") {\n    return\n  }\n\n  if (execution.executor.type === \"agent\") {\n    return\n  }\n\n  throw new AuthorizationError(\n    `privileged:${operation}`,\n    `[Sixb] Operation '${operation}' is not covered by scoped authorization grants.`\n  )\n}\n\nfunction deniedMessage(\n  authorization: AuthorizationContext | null | undefined,\n  request: AuthzRequest\n): string {\n  const principalId = authorization?.principal.id ?? \"unknown\"\n  switch (request.kind) {\n    case \"application.access\":\n      return `[Sixb] Principal '${principalId}' is not allowed to access application '${request.audience}'.`\n    case \"object.view\":\n      return `[Sixb] Principal '${principalId}' is not allowed to view object type '${request.objectTypeId}'.`\n    case \"dataset.view\":\n      return `[Sixb] Principal '${principalId}' is not allowed to view dataset '${request.datasetId}'.`\n    case \"object.edit\":\n      return `[Sixb] Principal '${principalId}' is not allowed to write object type '${request.objectTypeId}'.`\n    case \"telemetry.append\":\n      return `[Sixb] Principal '${principalId}' is not allowed to append telemetry for object type '${request.objectTypeId}'.`\n    case \"action.apply\":\n      return `[Sixb] Principal '${principalId}' is not allowed to apply action '${request.actionId}'.`\n    case \"share.manage\":\n      return `[Sixb] Principal '${principalId}' is not allowed to manage Share '${request.shareId}'.`\n    case \"workflow.run\":\n      return `[Sixb] Principal '${principalId}' is not allowed to run workflow '${request.workflowId}'.`\n    case \"sync.run\":\n      return `[Sixb] Principal '${principalId}' is not allowed to run sync '${request.syncId}'.`\n    case \"pipeline.run\":\n      return `[Sixb] Principal '${principalId}' is not allowed to run pipeline '${request.pipelineId}'.`\n    case \"agent.run\":\n      return `[Sixb] Principal '${principalId}' is not allowed to run the project Agent.`\n    case \"logs.observe\":\n      return `[Sixb] Principal '${principalId}' is not allowed to observe project logs.`\n    case \"aiUsage.observe\":\n      return `[Sixb] Principal '${principalId}' is not allowed to observe project AI usage.`\n    case \"aiUsage.manage\":\n      return `[Sixb] Principal '${principalId}' is not allowed to manage project AI usage limits.`\n    case \"connector.manage\":\n      return `[Sixb] Principal '${principalId}' is not allowed to manage connector '${request.connectorId}'.`\n    case \"object.query\": {\n      // Name the first touched type the principal cannot view.\n      const blocked = request.touchedObjectTypeIds.find(\n        (objectTypeId) => !isAllowed(authorization, { kind: \"object.view\", objectTypeId })\n      )\n      return `[Sixb] Principal '${principalId}' is not allowed to view object type '${blocked}'.`\n    }\n  }\n}\n",
-    "import type { AuthSessionAudience } from \"../auth/audience\"\nimport { isAllowed } from \"./decision\"\nimport type { AuthorizationContext, ResolvedRole } from \"./types\"\n\n/** Whether declaring roles has enabled an allowlist for an application. */\nexport function isApplicationAccessControlled(\n  roles: readonly ResolvedRole[],\n  audience: AuthSessionAudience\n): boolean {\n  return roles.some((role) => role.grants[\"access:application\"].has(audience))\n}\n\n/**\n * Whether this principal may open this application.\n *\n * KNOWN LIMITATION (0.1.x): application access is the one capability that is **not** deny-by-default.\n * While no role mentions an application, every authenticated principal may open it; the allowlist only\n * switches on once some role grants it. Every other capability — `view`, `apply`, `run`, `observe` —\n * denies unless granted, so this is the single asymmetry in the model.\n *\n * It is deliberate for now: flipping it would lock every project out of Atlas until it declares a role,\n * including projects with no security definitions at all. Closing it means shipping a default grant with\n * the scaffold first, and it is a breaking change for any project relying on the open default.\n */\nexport function canAccessApplication(\n  authorization: AuthorizationContext,\n  roles: readonly ResolvedRole[],\n  audience: AuthSessionAudience\n): boolean {\n  return (\n    !isApplicationAccessControlled(roles, audience) ||\n    isAllowed(authorization, { kind: \"application.access\", audience })\n  )\n}\n",
-    "/**\n * Event visibility derived from grants.\n *\n * There is no standalone \"view events\" capability: a principal sees a domain\n * event only when it can view/apply/run the event's subject. A privileged\n * caller (no authorization context) sees everything.\n *\n * The topic switch is fail-closed: an unrecognized topic is hidden, because a\n * topic we don't yet model may carry a subject the principal is not allowed to\n * see. Adding an event topic therefore requires an explicit visibility decision\n * here, never a silent default.\n */\n\nimport type { StoredDomainEvent } from \"../events\"\nimport { isAllowed } from \"./decision\"\nimport type { AuthorizationContext } from \"./types\"\n\nexport function canViewEvent(\n  authorization: AuthorizationContext | null | undefined,\n  event: StoredDomainEvent\n): boolean {\n  if (!authorization) {\n    return true\n  }\n\n  switch (event.topic) {\n    case \"objects\":\n    case \"telemetry\":\n      return isAllowed(authorization, {\n        kind: \"object.view\",\n        objectTypeId: event.payload.objectTypeId,\n      })\n    case \"links\":\n      return (\n        isAllowed(authorization, {\n          kind: \"object.view\",\n          objectTypeId: event.payload.sourceTypeId,\n        }) &&\n        isAllowed(authorization, { kind: \"object.view\", objectTypeId: event.payload.targetTypeId })\n      )\n    case \"actions\": {\n      // Apply is necessary; for object-bound actions the principal must also be\n      // able to view the subject type, or the event would leak a hidden\n      // object's id/type — mirroring the rule in `canListAction`.\n      if (!isAllowed(authorization, { kind: \"action.apply\", actionId: event.payload.actionId })) {\n        return false\n      }\n      const subject = event.payload.subject\n      return subject.kind === \"object\"\n        ? isAllowed(authorization, { kind: \"object.view\", objectTypeId: subject.objectTypeId })\n        : true\n    }\n    case \"workflows\":\n      return isAllowed(authorization, {\n        kind: \"workflow.run\",\n        workflowId: event.payload.workflowId,\n      })\n    case \"rules\":\n      // Rule events carry the object they fired on, so gate on viewing it —\n      // otherwise they leak the existence and id of hidden-type objects.\n      return isAllowed(authorization, {\n        kind: \"object.view\",\n        objectTypeId: event.payload.subject.objectTypeId,\n      })\n    // Run grant gates the operational stream. These payloads may also carry the\n    // produced datasetId/versionId; that target is already visible to a runner\n    // through the sync/pipeline catalog (`sync.target.dataset`), so surfacing it\n    // here discloses nothing new.\n    case \"syncs\":\n      return isAllowed(authorization, {\n        kind: \"sync.run\",\n        syncId: event.payload.syncId,\n      })\n    case \"pipelines\":\n      return isAllowed(authorization, {\n        kind: \"pipeline.run\",\n        pipelineId: event.payload.pipelineId,\n      })\n    case \"schedules\":\n      // Infra topics with no object/action/workflow/dataset subject: no grant\n      // governs them yet, so they stay visible to any authorized reader. When\n      // they gain their own grants, add the checks here.\n      return true\n    case \"datasets\":\n      // dataset.view alone. The payload's `producer` (the sync/pipeline that\n      // produced the version, plus its runId) is intentionally visible to any\n      // dataset viewer as provenance — the same identity the versions API\n      // already serializes for that principal. This is distinct from the\n      // operational `references` in the dataset catalog (which syncs/pipelines\n      // are wired to a dataset), which stays gated on the run grants.\n      return isAllowed(authorization, {\n        kind: \"dataset.view\",\n        datasetId: event.payload.datasetId,\n      })\n    default:\n      // Fail closed: an unmodeled topic may carry a subject we don't yet gate.\n      return false\n  }\n}\n",
-    "import type { Principal } from \"../auth/types\"\nimport type { RoleDefinition, Selection } from \"../security\"\nimport {\n  emptyGrantSets,\n  GRANT_KINDS,\n  type GrantUniverse,\n  grantKindOf,\n  TARGETED_GRANT_KIND_KEYS,\n} from \"./grant-kinds\"\nimport type { AuthorizationContext, GrantIndex, ResolvedRole } from \"./types\"\n\n/**\n * Resolve a role's grants once at startup.\n *\n * Broad grants (`every.object().except([...])`) expand against the registered\n * universe; object-type grants also expand to subtypes. Resource grants become\n * id sets; the project Agent grant becomes a boolean.\n * The per-kind universe and subtype rules come from the `GRANT_KINDS` table, so\n * this loop never enumerates targets by hand.\n */\nexport function resolveRoleGrants(role: RoleDefinition, universe: GrantUniverse): GrantIndex {\n  const grants = emptyGrantSets()\n\n  for (const grant of role.grants) {\n    if (grant.capability === \"run\" && grant.target === \"agent\") {\n      grants[\"run:agent\"] = true\n      continue\n    }\n    const kind = grantKindOf(grant)\n    const spec = GRANT_KINDS[kind]\n    expandSelection(\n      grant.selection,\n      universe[spec.universeKey],\n      grants[kind],\n      spec.expandsSubtypes ? universe.getSubTypes : undefined\n    )\n  }\n\n  return grants\n}\n\nfunction expandSelection(\n  selection: Selection,\n  universe: ReadonlySet<string>,\n  into: Set<string>,\n  expand?: (id: string) => readonly string[]\n): void {\n  if (selection.all) {\n    const except = new Set(selection.except)\n    for (const id of universe) {\n      if (!except.has(id)) {\n        into.add(id)\n      }\n    }\n    return\n  }\n\n  for (const id of selection.ids) {\n    into.add(id)\n    if (expand) {\n      for (const subTypeId of expand(id)) {\n        into.add(subTypeId)\n      }\n    }\n  }\n}\n\n/**\n * Resolve a principal's authorization context from its group memberships.\n *\n * Pure set-union over pre-resolved roles: roles match when their grantedTo\n * groups intersect the principal's memberships, and their concrete id sets\n * union into the principal's grant index.\n */\nexport function resolveAuthorizationContext(input: {\n  readonly principal: Principal\n  readonly sessionId?: string\n  readonly groupIds: readonly string[]\n  readonly roles: readonly ResolvedRole[]\n}): AuthorizationContext {\n  const memberGroupIds = new Set(input.groupIds)\n  const roleIds: string[] = []\n  const grants = emptyGrantSets()\n\n  for (const role of input.roles) {\n    if (!role.grantedToGroupIds.some((groupId) => memberGroupIds.has(groupId))) {\n      continue\n    }\n\n    roleIds.push(role.id)\n    if (role.grants[\"run:agent\"]) {\n      grants[\"run:agent\"] = true\n    }\n    for (const kind of TARGETED_GRANT_KIND_KEYS) {\n      for (const id of role.grants[kind]) {\n        grants[kind].add(id)\n      }\n    }\n  }\n\n  return {\n    principal: input.principal,\n    ...(input.sessionId !== undefined ? { sessionId: input.sessionId } : {}),\n    groupIds: input.groupIds,\n    roleIds,\n    grants,\n  }\n}\n",
-    "export class ProjectionValidationError extends Error {\n  readonly name = \"ProjectionValidationError\"\n}\n",
-    "import { compareStrings } from \"../json\"\nimport type { OntologyDefinitionCatalog } from \"../ontology\"\nimport { ProjectionValidationError } from \"./errors\"\nimport type { ProjectionDefinition, ProjectionOwnership } from \"./types\"\n\nexport function computeProjectionOwnership(\n  projection: ProjectionDefinition,\n  ontology: OntologyDefinitionCatalog\n): ProjectionOwnership {\n  if (projection._tag === \"ObjectProjectionDefinition\") {\n    const primaryId = ontology.getPrimaryPropertyId(projection.objectTypeId)\n    return freezeOwnership({\n      objects: [\n        {\n          objectTypeId: projection.objectTypeId,\n          existence: true,\n          propertyIds: Object.keys(projection.properties)\n            .filter((propertyId) => propertyId !== primaryId)\n            .sort(compareStrings),\n        },\n      ],\n      links: Object.keys(projection.links)\n        .sort(compareStrings)\n        .map((linkId) => ({ sourceObjectTypeId: projection.objectTypeId, linkId })),\n      telemetry: [],\n    })\n  }\n\n  if (projection._tag === \"LinkProjectionDefinition\") {\n    return freezeOwnership({\n      objects: [],\n      links: [\n        {\n          sourceObjectTypeId: projection.sourceObjectTypeId,\n          linkId: projection.linkId,\n        },\n      ],\n      telemetry: [],\n    })\n  }\n\n  return freezeOwnership({\n    objects: [],\n    links: [],\n    telemetry: Object.keys(projection.properties)\n      .sort(compareStrings)\n      .map((propertyId) => ({\n        objectTypeId: projection.objectTypeId,\n        propertyId,\n      })),\n  })\n}\n\nexport interface ProjectionOwnershipRecord<\n  TDefinition extends ProjectionDefinition = ProjectionDefinition,\n> {\n  readonly definition: TDefinition\n  readonly ownership: ProjectionOwnership\n}\n\nexport function validateProjectionOwnership(\n  projections: readonly ProjectionOwnershipRecord[]\n): void {\n  const existenceOwners = new Map<string, string>()\n  const propertyOwners = new Map<string, string>()\n  const linkOwners = new Map<string, string>()\n  const telemetryOwners = new Map<string, string>()\n\n  for (const { definition, ownership } of projections) {\n    for (const object of ownership.objects) {\n      if (object.existence) {\n        registerOwner(\n          existenceOwners,\n          object.objectTypeId,\n          definition.id,\n          `object type '${object.objectTypeId}' existence`\n        )\n      }\n      for (const propertyId of object.propertyIds) {\n        registerOwner(\n          propertyOwners,\n          JSON.stringify([object.objectTypeId, propertyId]),\n          definition.id,\n          `property '${object.objectTypeId}.${propertyId}'`\n        )\n      }\n    }\n    for (const link of ownership.links) {\n      registerOwner(\n        linkOwners,\n        JSON.stringify([link.sourceObjectTypeId, link.linkId]),\n        definition.id,\n        `link scope '${link.sourceObjectTypeId}.${link.linkId}'`\n      )\n    }\n    for (const telemetry of ownership.telemetry) {\n      registerOwner(\n        telemetryOwners,\n        JSON.stringify([telemetry.objectTypeId, telemetry.propertyId]),\n        definition.id,\n        `telemetry source '${telemetry.objectTypeId}.${telemetry.propertyId}'`\n      )\n    }\n  }\n}\n\nfunction registerOwner(\n  owners: Map<string, string>,\n  key: string,\n  projectionId: string,\n  description: string\n): void {\n  const existing = owners.get(key)\n  if (existing !== undefined) {\n    throw new ProjectionValidationError(\n      `[Sixb] Projection '${projectionId}' overlaps ${description} owned by projection '${existing}'.`\n    )\n  }\n  owners.set(key, projectionId)\n}\n\nfunction freezeOwnership(ownership: ProjectionOwnership): ProjectionOwnership {\n  return Object.freeze({\n    objects: Object.freeze(\n      ownership.objects.map((object) =>\n        Object.freeze({ ...object, propertyIds: Object.freeze([...object.propertyIds]) })\n      )\n    ),\n    links: Object.freeze(ownership.links.map((link) => Object.freeze({ ...link }))),\n    telemetry: Object.freeze(\n      ownership.telemetry.map((telemetry) => Object.freeze({ ...telemetry }))\n    ),\n  })\n}\n",
-    "/**\n * Build-time validation helpers for projection definitions.\n *\n * These run eagerly inside builder calls (not deferred to `.build()`).\n * They are also reusable by Increment 7 for startup validation.\n */\n\nimport type { DatasetDefinition } from \"../datasets\"\nimport type { OntologyDefinitionCatalog } from \"../ontology\"\nimport type { ObjectType, Property, ValueType } from \"../ontology/types\"\nimport { resolveSemanticType } from \"../ontology/validation\"\nimport { ProjectionValidationError } from \"./errors\"\nimport {\n  computeProjectionOwnership,\n  type ProjectionOwnershipRecord,\n  validateProjectionOwnership,\n} from \"./ownership\"\nimport type {\n  ForeignKeyDescriptor,\n  LinkProjectionDefinition,\n  ObjectProjectionDefinition,\n  ProjectionDefinition,\n  TelemetryProjectionDefinition,\n} from \"./types\"\n\n/**\n * Validates the property mapping for an object projection.\n *\n * Rules:\n * 1. All keys must be valid property ids on the object type.\n * 2. The object type must have exactly one primary property.\n * 3. The primary property must be included in the mapping.\n */\nexport function validatePropertyMapping(\n  objectType: ObjectType,\n  mapping: Record<string, string>\n): void {\n  const propertyIds = new Set(objectType.properties.map((p) => p.id))\n  const mappingKeys = Object.keys(mapping)\n\n  // Rule 1: all keys are valid property ids\n  for (const key of mappingKeys) {\n    if (!propertyIds.has(key)) {\n      const available = [...propertyIds].sort().join(\", \")\n      throw new ProjectionValidationError(\n        `Property '${key}' does not exist on object type '${objectType.id}'. ` +\n          `Available properties: ${available}`\n      )\n    }\n  }\n\n  // Rule 2: exactly one primary property\n  const primaryProperties = objectType.properties.filter((p) => p.primary === true)\n  if (primaryProperties.length !== 1) {\n    throw new ProjectionValidationError(\n      `Object type '${objectType.id}' must have exactly one primary property, ` +\n        `found ${primaryProperties.length}.`\n    )\n  }\n\n  // Rule 3: primary property is in the mapping\n  const primaryId = primaryProperties[0].id\n  if (!(primaryId in mapping)) {\n    throw new ProjectionValidationError(\n      `Primary property '${primaryId}' of object type '${objectType.id}' ` +\n        `must be included in the property mapping.`\n    )\n  }\n}\n\n/**\n * Validates the link mapping for an object projection and returns a validated copy.\n *\n * Rules:\n * 1. All keys must be valid link ids on the object type.\n * 2. Record key must match descriptor.linkId.\n * 3. Link target must be a single concrete type (not polymorphic or wildcard).\n * 4. The descriptor must use exactly one source: sourcePropertyId or sourceField.\n * 5. Source properties must exist and be present in the property mapping.\n *    Source fields are validated later against the projection dataset.\n */\nexport function validateAndLowerLinkMapping(\n  objectType: ObjectType,\n  linkMapping: Record<string, ForeignKeyDescriptor>,\n  propertyMapping: Record<string, string>\n): Record<string, ForeignKeyDescriptor> {\n  const linkIds = new Set(objectType.links.map((l) => l.id))\n  const linksById = new Map(objectType.links.map((l) => [l.id, l]))\n  const propertyIds = new Set(objectType.properties.map((p) => p.id))\n\n  for (const [key, descriptor] of Object.entries(linkMapping)) {\n    // Rule 1: valid link id\n    if (!linkIds.has(key)) {\n      const available = [...linkIds].sort().join(\", \")\n      throw new ProjectionValidationError(\n        `Link '${key}' does not exist on object type '${objectType.id}'. ` +\n          `Available links: ${available}`\n      )\n    }\n\n    // Rule 2: key matches descriptor.linkId\n    if (key !== descriptor.linkId) {\n      throw new ProjectionValidationError(\n        `Link mapping key '${key}' does not match descriptor linkId '${descriptor.linkId}'.`\n      )\n    }\n\n    // Rule 3: single concrete target\n    const link = linksById.get(key)!\n    if (Array.isArray(link.targetObjectTypeId)) {\n      throw new ProjectionValidationError(\n        `Link '${key}' on object type '${objectType.id}' has a polymorphic target. ` +\n          `FK projection of polymorphic links is not yet supported.`\n      )\n    }\n    if (link.targetObjectTypeId === \"*\") {\n      throw new ProjectionValidationError(\n        `Link '${key}' on object type '${objectType.id}' has a wildcard target. ` +\n          `FK projection of wildcard links is not supported.`\n      )\n    }\n\n    const sourcePropertyId = descriptor.sourcePropertyId\n    const sourceField = descriptor.sourceField\n    if (sourcePropertyId && sourceField) {\n      throw new ProjectionValidationError(\n        `FK link '${key}' must use either sourceProperty or sourceField, not both.`\n      )\n    }\n    if (!sourcePropertyId && !sourceField) {\n      throw new ProjectionValidationError(\n        `FK link '${key}' must declare sourceProperty or sourceField.`\n      )\n    }\n\n    if (!sourcePropertyId) {\n      continue\n    }\n\n    // Rule 4: source property exists on the type\n    if (!propertyIds.has(sourcePropertyId)) {\n      const available = [...propertyIds].sort().join(\", \")\n      throw new ProjectionValidationError(\n        `Source property '${sourcePropertyId}' does not exist on ` +\n          `object type '${objectType.id}'. Available properties: ${available}`\n      )\n    }\n\n    // Rule 5: source property is in the property mapping\n    if (!(sourcePropertyId in propertyMapping)) {\n      throw new ProjectionValidationError(\n        `Source property '${sourcePropertyId}' for link '${key}' ` +\n          `must be included in the property mapping.`\n      )\n    }\n  }\n\n  return Object.fromEntries(\n    Object.entries(linkMapping).map(([linkId, descriptor]) => [\n      linkId,\n      {\n        linkId: descriptor.linkId,\n        ...(descriptor.sourcePropertyId !== undefined\n          ? { sourcePropertyId: descriptor.sourcePropertyId }\n          : {}),\n        ...(descriptor.sourceField !== undefined ? { sourceField: descriptor.sourceField } : {}),\n        targetObjectTypeId: descriptor.targetObjectTypeId,\n      },\n    ])\n  )\n}\n\n/**\n * Validates that a link token points to a single concrete target type.\n *\n * Rules:\n * 1. Not an array (polymorphic).\n * 2. Not wildcard (\"*\").\n */\nexport function validateLinkProjectionTarget(linkToken: {\n  readonly id: string\n  readonly targetObjectTypeId: string | readonly string[]\n}): void {\n  if (Array.isArray(linkToken.targetObjectTypeId)) {\n    throw new ProjectionValidationError(\n      `Link '${linkToken.id}' has a polymorphic target. ` +\n        `Link projection of polymorphic links is not yet supported.`\n    )\n  }\n  if (linkToken.targetObjectTypeId === \"*\") {\n    throw new ProjectionValidationError(\n      `Link '${linkToken.id}' has a wildcard target. ` +\n        `Link projection of wildcard links is not supported.`\n    )\n  }\n}\n\n/**\n * Validates a telemetry projection's field mapping against its dataset columns\n * and object type: every mapped property exists and is telemetry-enabled, and\n * every mapped field (objectId/at/value/unit) resolves to a real dataset column.\n *\n * Owned here so startup validation and the projection worker's pre-execution\n * check share one implementation and cannot drift; the worker layers\n * dataset-version column type compatibility on top of these rules. Returns the\n * resolved telemetry properties for callers that need their schemas.\n */\nexport function validateTelemetryProjectionFieldMapping(\n  projection: TelemetryProjectionDefinition,\n  objectType: { readonly id: string; readonly properties: readonly Property[] },\n  datasetColumnNames: ReadonlySet<string>,\n  valueTypesById: ReadonlyMap<string, ValueType>,\n  prefix: string\n): ReadonlyMap<string, Property> {\n  const mappedProperties = Object.entries(projection.properties)\n  if (mappedProperties.length === 0) {\n    throw new ProjectionValidationError(`${prefix}: must map at least one telemetry property`)\n  }\n\n  const mappedFields = [\n    [\"objectId\", projection.objectIdField],\n    [\"at\", projection.atField],\n  ] as const\n  for (const [fieldRole, columnName] of mappedFields) {\n    if (!datasetColumnNames.has(columnName)) {\n      throw new ProjectionValidationError(\n        `${prefix}: ${fieldRole} field \"${columnName}\" references unknown dataset column ` +\n          `on dataset \"${projection.datasetId}\"`\n      )\n    }\n  }\n\n  const propertiesById = new Map(objectType.properties.map((property) => [property.id, property]))\n  const resolvedProperties = new Map<string, Property>()\n  for (const [propertyId, mapping] of mappedProperties) {\n    const property = propertiesById.get(propertyId)\n    if (!property) {\n      throw new ProjectionValidationError(\n        `${prefix}: unknown property \"${propertyId}\" on type \"${projection.objectTypeId}\"`\n      )\n    }\n    if (property.mode !== \"telemetry\") {\n      throw new ProjectionValidationError(\n        `${prefix}: property \"${propertyId}\" on type \"${projection.objectTypeId}\" must be telemetry-enabled`\n      )\n    }\n\n    for (const [fieldRole, columnName] of [\n      [\"value\", mapping.valueField],\n      ...(mapping.unitField !== undefined ? ([[\"unit\", mapping.unitField]] as const) : []),\n    ] as const) {\n      if (!datasetColumnNames.has(columnName)) {\n        throw new ProjectionValidationError(\n          `${prefix}: property \"${propertyId}\" ${fieldRole} field \"${columnName}\" references ` +\n            `unknown dataset column on dataset \"${projection.datasetId}\"`\n        )\n      }\n    }\n\n    const semanticType = resolveSemanticType(property, valueTypesById)\n    if (semanticType !== undefined && mapping.unitField === undefined) {\n      throw new ProjectionValidationError(\n        `${prefix}: property \"${propertyId}\" requires a unit field because it uses semantic type \"${semanticType}\"`\n      )\n    }\n    if (semanticType === undefined && mapping.unitField !== undefined) {\n      throw new ProjectionValidationError(\n        `${prefix}: property \"${propertyId}\" cannot map a unit field because it has no semantic type`\n      )\n    }\n\n    resolvedProperties.set(propertyId, property)\n  }\n\n  return resolvedProperties\n}\n\n/**\n * Validates all registered projections against the ontology at startup.\n *\n * For object projections:\n * 1. `datasetId` exists in the dataset registry.\n * 2. `objectTypeId` exists in the type registry.\n * 3. All property mapping keys are valid property ids on the type.\n * 4. All mapped dataset columns exist in the referenced dataset.\n * 5. The primary property is included in the property mapping.\n * 6. FK link descriptors reference valid links, valid source properties (present in mapping),\n *    and valid target types with primaries.\n *\n * For link projections:\n * 1. `datasetId` exists in the dataset registry.\n * 2. Source and target types exist.\n * 3. The link exists on the source type.\n * 4. Source and target fields exist in the referenced dataset.\n * 5. Both source and target types have primary properties.\n *\n * For telemetry projections:\n * 1. `datasetId` exists in the dataset registry.\n * 2. `objectTypeId` exists in the type registry.\n * 3. Every mapped property exists on the object type and is telemetry-enabled.\n * 4. Point mapping fields exist in the referenced dataset.\n * 5. Unit mappings match each property's semantic type requirements.\n */\nexport interface ValidatedProjectionRecord<TDefinition extends ProjectionDefinition>\n  extends ProjectionOwnershipRecord<TDefinition> {\n  readonly dataset: DatasetDefinition\n}\n\nexport interface ProjectionValidationInput {\n  readonly objectProjections: readonly ObjectProjectionDefinition[]\n  readonly linkProjections: readonly LinkProjectionDefinition[]\n  readonly telemetryProjections: readonly TelemetryProjectionDefinition[]\n}\n\nexport interface ValidatedProjectionCatalog {\n  readonly objectProjections: readonly ValidatedProjectionRecord<ObjectProjectionDefinition>[]\n  readonly linkProjections: readonly ValidatedProjectionRecord<LinkProjectionDefinition>[]\n  readonly telemetryProjections: readonly ValidatedProjectionRecord<TelemetryProjectionDefinition>[]\n}\n\nexport function validateProjectionsAtStartup(\n  projections: ProjectionValidationInput,\n  ontology: OntologyDefinitionCatalog,\n  datasetsById: ReadonlyMap<string, DatasetDefinition>\n): ValidatedProjectionCatalog {\n  const { objectProjections, linkProjections, telemetryProjections } = projections\n  const objectTypesById = ontology.getObjectTypesById()\n  const primaryByTypeId = ontology.getPrimaryByTypeId()\n  const validatedObjectProjections: ValidatedProjectionRecord<ObjectProjectionDefinition>[] = []\n  const validatedLinkProjections: ValidatedProjectionRecord<LinkProjectionDefinition>[] = []\n  const validatedTelemetryProjections: ValidatedProjectionRecord<TelemetryProjectionDefinition>[] =\n    []\n\n  validateMaterializationOntologyConstraints(ontology)\n\n  for (const projection of objectProjections) {\n    const prefix = `Projection \"${projection.id}\"`\n    const dataset = datasetsById.get(projection.datasetId)\n    if (!dataset) {\n      throw new ProjectionValidationError(\n        `${prefix}: unknown dataset \"${projection.datasetId}\". ` +\n          `Add it to 'datasets' in createSixb() or export it from 'datasets/'.`\n      )\n    }\n\n    const objectType = objectTypesById.get(projection.objectTypeId)\n    if (!objectType) {\n      throw new ProjectionValidationError(\n        `${prefix}: unknown object type \"${projection.objectTypeId}\"`\n      )\n    }\n\n    const datasetColumnNames = new Set(dataset.schema.columns.map((column) => column.name))\n    const conflictResolution = projection.conflictResolution ?? { strategy: \"editsWin\" }\n    if (conflictResolution.strategy === \"mostRecent\") {\n      const sourceTimestamp = dataset.schema.columns.find(\n        (column) => column.name === conflictResolution.sourceTimestamp\n      )\n      if (!sourceTimestamp) {\n        throw new ProjectionValidationError(\n          `${prefix}: source timestamp \"${conflictResolution.sourceTimestamp}\" references unknown ` +\n            `dataset column on dataset \"${projection.datasetId}\"`\n        )\n      }\n      if (sourceTimestamp.type !== \"timestamp\") {\n        throw new ProjectionValidationError(\n          `${prefix}: source timestamp \"${conflictResolution.sourceTimestamp}\" must reference a ` +\n            `timestamp dataset column`\n        )\n      }\n      if (sourceTimestamp.nullable === true) {\n        throw new ProjectionValidationError(\n          `${prefix}: source timestamp \"${conflictResolution.sourceTimestamp}\" must reference a ` +\n            `non-null timestamp dataset column`\n        )\n      }\n    }\n    const propertyIds = new Set(objectType.properties.map((p) => p.id))\n    for (const [propId, columnName] of Object.entries(projection.properties)) {\n      if (!propertyIds.has(propId)) {\n        throw new ProjectionValidationError(\n          `${prefix}: unknown property \"${propId}\" on type \"${projection.objectTypeId}\"`\n        )\n      }\n      if (!datasetColumnNames.has(columnName)) {\n        throw new ProjectionValidationError(\n          `${prefix}: property \"${propId}\" references unknown dataset column \"${columnName}\" ` +\n            `on dataset \"${projection.datasetId}\"`\n        )\n      }\n      const property = objectType.properties.find((candidate) => candidate.id === propId)\n      if (property?.mode === \"telemetry\") {\n        throw new ProjectionValidationError(\n          `[Sixb] ${prefix}: source mappings cannot own telemetry property \"${projection.objectTypeId}.${propId}\"`\n        )\n      }\n    }\n\n    const primaryId = primaryByTypeId.get(projection.objectTypeId)!\n    if (!(primaryId in projection.properties)) {\n      throw new ProjectionValidationError(\n        `${prefix}: primary property \"${primaryId}\" must be in property mapping`\n      )\n    }\n\n    const linkIds = new Set(objectType.links.map((l) => l.id))\n    for (const [linkId, fk] of Object.entries(projection.links)) {\n      if (!linkIds.has(linkId)) {\n        throw new ProjectionValidationError(\n          `${prefix}: FK link \"${linkId}\" references unknown link on type \"${projection.objectTypeId}\"`\n        )\n      }\n      if (fk.linkId !== linkId) {\n        throw new ProjectionValidationError(\n          `${prefix}: FK link mapping key \"${linkId}\" does not match descriptor linkId \"${fk.linkId}\"`\n        )\n      }\n      const sourcePropertyId = fk.sourcePropertyId\n      const sourceField = fk.sourceField\n      if (sourcePropertyId && sourceField) {\n        throw new ProjectionValidationError(\n          `${prefix}: FK link \"${linkId}\" must use either sourcePropertyId or sourceField, not both`\n        )\n      }\n      if (!sourcePropertyId && !sourceField) {\n        throw new ProjectionValidationError(\n          `${prefix}: FK link \"${linkId}\" must declare sourcePropertyId or sourceField`\n        )\n      }\n      if (sourcePropertyId && !propertyIds.has(sourcePropertyId)) {\n        throw new ProjectionValidationError(\n          `${prefix}: FK link \"${linkId}\" source property \"${sourcePropertyId}\" does not exist on type \"${projection.objectTypeId}\"`\n        )\n      }\n      if (sourcePropertyId && !(sourcePropertyId in projection.properties)) {\n        throw new ProjectionValidationError(\n          `${prefix}: FK link \"${linkId}\" source property \"${sourcePropertyId}\" must be in property mapping`\n        )\n      }\n      if (sourceField && !datasetColumnNames.has(sourceField)) {\n        throw new ProjectionValidationError(\n          `${prefix}: FK link \"${linkId}\" source field \"${sourceField}\" references unknown dataset column on dataset \"${projection.datasetId}\"`\n        )\n      }\n      if (!objectTypesById.has(fk.targetObjectTypeId)) {\n        throw new ProjectionValidationError(\n          `${prefix}: FK link \"${linkId}\" target type \"${fk.targetObjectTypeId}\" is unknown`\n        )\n      }\n      if (!primaryByTypeId.has(fk.targetObjectTypeId)) {\n        throw new ProjectionValidationError(\n          `${prefix}: FK link \"${linkId}\" target type \"${fk.targetObjectTypeId}\" has no primary property`\n        )\n      }\n      const link = objectType.links.find((candidate) => candidate.id === linkId)!\n      if (!ontology.isValidLinkTarget(link.targetObjectTypeId, fk.targetObjectTypeId)) {\n        throw new ProjectionValidationError(\n          `${prefix}: FK link \"${linkId}\" target type \"${fk.targetObjectTypeId}\" is not compatible with its declared target`\n        )\n      }\n    }\n\n    validatedObjectProjections.push({\n      definition: projection,\n      dataset,\n      ownership: computeProjectionOwnership(projection, ontology),\n    })\n  }\n\n  for (const projection of linkProjections) {\n    const prefix = `Projection \"${projection.id}\"`\n    const dataset = datasetsById.get(projection.datasetId)\n    if (!dataset) {\n      throw new ProjectionValidationError(\n        `${prefix}: unknown dataset \"${projection.datasetId}\". ` +\n          `Add it to 'datasets' in createSixb() or export it from 'datasets/'.`\n      )\n    }\n\n    if (!objectTypesById.has(projection.sourceObjectTypeId)) {\n      throw new ProjectionValidationError(\n        `${prefix}: unknown source type \"${projection.sourceObjectTypeId}\"`\n      )\n    }\n    if (!objectTypesById.has(projection.targetObjectTypeId)) {\n      throw new ProjectionValidationError(\n        `${prefix}: unknown target type \"${projection.targetObjectTypeId}\"`\n      )\n    }\n    const sourceType = objectTypesById.get(projection.sourceObjectTypeId)!\n    const link = sourceType.links.find((candidate) => candidate.id === projection.linkId)\n    if (!link) {\n      throw new ProjectionValidationError(\n        `${prefix}: link \"${projection.linkId}\" does not exist on source type \"${projection.sourceObjectTypeId}\"`\n      )\n    }\n    if (!ontology.isValidLinkTarget(link.targetObjectTypeId, projection.targetObjectTypeId)) {\n      throw new ProjectionValidationError(\n        `${prefix}: target type \"${projection.targetObjectTypeId}\" is not compatible with link \"${projection.linkId}\"`\n      )\n    }\n    const datasetColumnNames = new Set(dataset.schema.columns.map((column) => column.name))\n    if (!datasetColumnNames.has(projection.sourceField)) {\n      throw new ProjectionValidationError(\n        `${prefix}: source field \"${projection.sourceField}\" references unknown dataset column ` +\n          `on dataset \"${projection.datasetId}\"`\n      )\n    }\n    if (!datasetColumnNames.has(projection.targetField)) {\n      throw new ProjectionValidationError(\n        `${prefix}: target field \"${projection.targetField}\" references unknown dataset column ` +\n          `on dataset \"${projection.datasetId}\"`\n      )\n    }\n    if (!primaryByTypeId.has(projection.sourceObjectTypeId)) {\n      throw new ProjectionValidationError(\n        `${prefix}: source type \"${projection.sourceObjectTypeId}\" has no primary property`\n      )\n    }\n    if (!primaryByTypeId.has(projection.targetObjectTypeId)) {\n      throw new ProjectionValidationError(\n        `${prefix}: target type \"${projection.targetObjectTypeId}\" has no primary property`\n      )\n    }\n\n    validatedLinkProjections.push({\n      definition: projection,\n      dataset,\n      ownership: computeProjectionOwnership(projection, ontology),\n    })\n  }\n\n  for (const projection of telemetryProjections) {\n    const prefix = `Projection \"${projection.id}\"`\n    const dataset = datasetsById.get(projection.datasetId)\n    if (!dataset) {\n      throw new ProjectionValidationError(\n        `${prefix}: unknown dataset \"${projection.datasetId}\". ` +\n          `Add it to 'datasets' in createSixb() or export it from 'datasets/'.`\n      )\n    }\n\n    const objectType = objectTypesById.get(projection.objectTypeId)\n    if (!objectType) {\n      throw new ProjectionValidationError(\n        `${prefix}: unknown object type \"${projection.objectTypeId}\"`\n      )\n    }\n\n    const datasetColumnNames = new Set(dataset.schema.columns.map((column) => column.name))\n    validateTelemetryProjectionFieldMapping(\n      projection,\n      objectType,\n      datasetColumnNames,\n      ontology.getValueTypesById(),\n      prefix\n    )\n    validatedTelemetryProjections.push({\n      definition: projection,\n      dataset,\n      ownership: computeProjectionOwnership(projection, ontology),\n    })\n  }\n\n  const validatedProjections = [\n    ...validatedObjectProjections,\n    ...validatedLinkProjections,\n    ...validatedTelemetryProjections,\n  ]\n  validateProjectionOwnership(validatedProjections)\n  return {\n    objectProjections: validatedObjectProjections,\n    linkProjections: validatedLinkProjections,\n    telemetryProjections: validatedTelemetryProjections,\n  }\n}\n\nfunction validateMaterializationOntologyConstraints(ontology: OntologyDefinitionCatalog): void {\n  for (const objectType of ontology.getObjectTypesById().values()) {\n    for (const property of objectType.properties) {\n      if (property.mode === \"telemetry\" && property.required === true) {\n        throw new ProjectionValidationError(\n          `[Sixb] Telemetry property '${objectType.id}.${property.id}' cannot be required.`\n        )\n      }\n    }\n    for (const link of objectType.links) {\n      for (const property of link.properties ?? []) {\n        if (property.mode === \"telemetry\") {\n          throw new ProjectionValidationError(\n            `[Sixb] Link property '${objectType.id}.${link.id}.${property.id}' cannot use telemetry mode.`\n          )\n        }\n      }\n    }\n  }\n}\n",
-    "/**\n * Projection DSL builders, helpers, and type guards.\n *\n * Uses the same fluent builder style as the other definition APIs.\n */\n\nimport type {\n  DatasetColumnDefinitionOf,\n  DatasetColumnNameOf,\n  DatasetColumnType,\n  DatasetColumnTypeOf,\n  DatasetDefinition,\n} from \"../datasets\"\nimport type { LinkToken, PropertyToken } from \"../ontology/tokens\"\nimport type { ObjectLink, ObjectType, Property, Schema } from \"../ontology/types\"\nimport { ProjectionValidationError } from \"./errors\"\nimport type {\n  ForeignKeyDescriptor,\n  LinkProjectionDefinition,\n  LinkProjectionTarget,\n  ObjectProjectionDefinition,\n  ObjectProjectionTarget,\n  ProjectionDefinition,\n  ProjectionTarget,\n  SourceEditConflictResolution,\n  TelemetryProjectionDefinition,\n  TelemetryProjectionPropertyMapping,\n} from \"./types\"\nimport {\n  validateAndLowerLinkMapping,\n  validateLinkProjectionTarget,\n  validatePropertyMapping,\n} from \"./validation\"\n\n// ── Internal helpers ─────────────────────────────────────────\n\nfunction assertNonEmpty(value: string, field: string): void {\n  if (!value.trim()) {\n    throw new ProjectionValidationError(`Projection ${field} must not be empty.`)\n  }\n}\n\nfunction assertProjectionDataset(dataset: DatasetDefinition): void {\n  if (!dataset || dataset.kind !== \"dataset\" || typeof dataset.id !== \"string\") {\n    throw new ProjectionValidationError(\"Projection dataset must be a dataset definition.\")\n  }\n  assertNonEmpty(dataset.id, \"dataset id\")\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\n// ── Type utilities ───────────────────────────────────────────\n\n/** Union of property ids from an ObjectType. */\ntype PropertyIdOf<T extends ObjectType> = T[\"properties\"][number][\"id\"]\n\n/** Property definition by id from an ObjectType. */\ntype PropertyById<T extends ObjectType, TPropertyId extends PropertyIdOf<T>> = Extract<\n  T[\"properties\"][number],\n  { id: TPropertyId }\n>\n\n/** Union of link ids from an ObjectType. */\ntype LinkIdOf<T extends ObjectType> = T[\"links\"][number][\"id\"]\n\ntype LinkById<T extends ObjectType, TLinkId extends LinkIdOf<T>> = Extract<\n  T[\"links\"][number],\n  { id: TLinkId }\n>\n\ntype SingleTargetIdOf<TLink extends ObjectLink> = TLink[\"targetObjectTypeId\"] extends string\n  ? TLink[\"targetObjectTypeId\"]\n  : never\n\ntype ResolvedProjectionSchema<TSchema extends Schema> = TSchema extends {\n  type: \"valueTypeRef\"\n  _resolved: infer TResolved extends Schema\n}\n  ? ResolvedProjectionSchema<TResolved>\n  : TSchema extends { type: \"valueTypeRef\" }\n    ? never\n    : TSchema\n\ntype StringCompatibleProjectionSchema =\n  | \"string\"\n  | \"uuid\"\n  | { type: \"enum\"; values: readonly string[] }\n\ntype IntegerCompatibleProjectionSchema =\n  | \"integer\"\n  | \"double\"\n  | \"decimal\"\n  | { type: \"enum\"; values: readonly number[] }\n\ntype JsonCompatibleProjectionSchema = { type: \"object\" | \"array\" | \"map\" | \"enum\" }\n\ntype ProjectionSchemaByDatasetColumnType = {\n  readonly string: StringCompatibleProjectionSchema\n  readonly boolean: \"boolean\"\n  readonly int64: IntegerCompatibleProjectionSchema\n  readonly float64: \"double\"\n  readonly decimal: \"decimal\" | \"double\"\n  readonly date: \"date\"\n  readonly timestamp: \"timestamp\"\n  readonly json: JsonCompatibleProjectionSchema\n  readonly fileRef: \"fileRef\"\n}\n\ntype DatasetColumnCompatibleWithSchema<\n  TColumnType extends DatasetColumnType,\n  TSchema extends Schema,\n> = [ResolvedProjectionSchema<TSchema>] extends [never]\n  ? false\n  : ResolvedProjectionSchema<TSchema> extends ProjectionSchemaByDatasetColumnType[TColumnType]\n    ? true\n    : false\n\ntype DatasetColumnNameCompatibleWithSchema<\n  TDataset extends DatasetDefinition,\n  TSchema extends Schema,\n> =\n  string extends DatasetColumnNameOf<TDataset>\n    ? string\n    : {\n        [TColumnName in DatasetColumnNameOf<TDataset>]: DatasetColumnCompatibleWithSchema<\n          DatasetColumnTypeOf<TDataset, TColumnName>,\n          TSchema\n        > extends true\n          ? TColumnName\n          : never\n      }[DatasetColumnNameOf<TDataset>]\n\ntype StringDatasetColumnNameOf<TDataset extends DatasetDefinition> =\n  string extends DatasetColumnNameOf<TDataset>\n    ? string\n    : {\n        [TColumnName in DatasetColumnNameOf<TDataset>]: DatasetColumnTypeOf<\n          TDataset,\n          TColumnName\n        > extends \"string\"\n          ? TColumnName\n          : never\n      }[DatasetColumnNameOf<TDataset>]\n\ntype DateLikeDatasetColumnNameOf<TDataset extends DatasetDefinition> =\n  string extends DatasetColumnNameOf<TDataset>\n    ? string\n    : {\n        [TColumnName in DatasetColumnNameOf<TDataset>]: DatasetColumnTypeOf<\n          TDataset,\n          TColumnName\n        > extends \"string\" | \"date\" | \"timestamp\"\n          ? TColumnName\n          : never\n      }[DatasetColumnNameOf<TDataset>]\n\ntype TimestampDatasetColumnNameOf<TDataset extends DatasetDefinition> =\n  string extends DatasetColumnNameOf<TDataset>\n    ? string\n    : {\n        [TColumnName in DatasetColumnNameOf<TDataset>]: DatasetColumnTypeOf<\n          TDataset,\n          TColumnName\n        > extends \"timestamp\"\n          ? DatasetColumnDefinitionOf<TDataset, TColumnName> extends { readonly nullable: true }\n            ? never\n            : TColumnName\n          : never\n      }[DatasetColumnNameOf<TDataset>]\n\ntype ProjectionMappingFor<TObjectType extends ObjectType, TDataset extends DatasetDefinition> = {\n  readonly [TPropertyId in PropertyIdOf<TObjectType>]?: DatasetColumnNameCompatibleWithSchema<\n    TDataset,\n    PropertyById<TObjectType, TPropertyId>[\"schema\"]\n  >\n}\n\ntype ExactProjectionMapping<TObjectType extends ObjectType, TMapping> = TMapping & {\n  readonly [TKey in Exclude<keyof TMapping, PropertyIdOf<TObjectType>>]: never\n}\n\ntype TelemetryPropertyToken<TObjectTypeId extends string = string> = PropertyToken<\n  TObjectTypeId,\n  string,\n  Property & { readonly mode: \"telemetry\" }\n>\n\ntype TelemetryPropertyOf<TObjectType extends ObjectType> = Extract<\n  TObjectType[\"properties\"][number],\n  { readonly mode: \"telemetry\" }\n>\n\ntype TelemetryPropertyIdOf<TObjectType extends ObjectType> = TelemetryPropertyOf<TObjectType>[\"id\"]\n\ntype TelemetryPropertyById<\n  TObjectType extends ObjectType,\n  TPropertyId extends TelemetryPropertyIdOf<TObjectType>,\n> = Extract<TelemetryPropertyOf<TObjectType>, { readonly id: TPropertyId }>\n\ntype TelemetryProjectionPointMapping<\n  TPropertyToken extends TelemetryPropertyToken,\n  TDataset extends DatasetDefinition,\n> = {\n  readonly objectId: StringDatasetColumnNameOf<TDataset>\n  readonly at: DateLikeDatasetColumnNameOf<TDataset>\n  readonly value: DatasetColumnNameCompatibleWithSchema<\n    TDataset,\n    TPropertyToken[\"property\"][\"schema\"]\n  >\n  readonly unit?: StringDatasetColumnNameOf<TDataset>\n}\n\ntype ExactTelemetryProjectionPointMapping<TMapping> = TMapping & {\n  readonly [TKey in Exclude<keyof TMapping, \"objectId\" | \"at\" | \"value\" | \"unit\">]: never\n}\n\ntype TelemetryProjectionPropertyInput<\n  TProperty extends Property,\n  TDataset extends DatasetDefinition,\n> =\n  | DatasetColumnNameCompatibleWithSchema<TDataset, TProperty[\"schema\"]>\n  | {\n      readonly value: DatasetColumnNameCompatibleWithSchema<TDataset, TProperty[\"schema\"]>\n      readonly unit: StringDatasetColumnNameOf<TDataset>\n    }\n\ntype TelemetryProjectionPropertiesMapping<\n  TObjectType extends ObjectType,\n  TDataset extends DatasetDefinition,\n> = {\n  readonly [TPropertyId in TelemetryPropertyIdOf<TObjectType>]?: TelemetryProjectionPropertyInput<\n    TelemetryPropertyById<TObjectType, TPropertyId>,\n    TDataset\n  >\n}\n\ntype ExactTelemetryProjectionPropertiesMapping<\n  TObjectType extends ObjectType,\n  TMapping,\n> = TMapping & {\n  readonly [TKey in Exclude<keyof TMapping, TelemetryPropertyIdOf<TObjectType>>]: never\n}\n\ntype ExactTelemetryProjectionPropertyInputs<TMapping> = {\n  readonly [TPropertyId in keyof TMapping]: TMapping[TPropertyId] extends object\n    ? TMapping[TPropertyId] & {\n        readonly [TKey in Exclude<keyof TMapping[TPropertyId], \"value\" | \"unit\">]: never\n      }\n    : TMapping[TPropertyId]\n}\n\ntype NonEmptyTelemetryProjectionProperties<TMapping> = keyof TMapping extends never\n  ? never\n  : TMapping\n\ntype TelemetryProjectionPropertiesPointMapping<\n  TObjectType extends ObjectType,\n  TDataset extends DatasetDefinition,\n  TProperties,\n> = {\n  readonly objectId: StringDatasetColumnNameOf<TDataset>\n  readonly at: DateLikeDatasetColumnNameOf<TDataset>\n  readonly properties: NonEmptyTelemetryProjectionProperties<\n    ExactTelemetryProjectionPropertiesMapping<TObjectType, TProperties> &\n      ExactTelemetryProjectionPropertyInputs<TProperties>\n  >\n}\n\ntype ForeignKeyFromSourceProperty = Omit<\n  ForeignKeyDescriptor,\n  \"sourcePropertyId\" | \"sourceField\"\n> & {\n  readonly sourcePropertyId: string\n  readonly sourceField?: never\n}\n\ntype ForeignKeyFromSourceField<TSourceField extends string = string> = Omit<\n  ForeignKeyDescriptor,\n  \"sourcePropertyId\" | \"sourceField\"\n> & {\n  readonly sourcePropertyId?: never\n  readonly sourceField: TSourceField\n}\n\ntype ProjectionForeignKeyDescriptor<TDataset extends DatasetDefinition> =\n  | ForeignKeyFromSourceProperty\n  | ForeignKeyFromSourceField<StringDatasetColumnNameOf<TDataset>>\n\ntype ProjectionForeignKeyTokenInput<\n  TObjectType extends ObjectType,\n  TDataset extends DatasetDefinition,\n  TLinkId extends LinkIdOf<TObjectType>,\n> =\n  | {\n      readonly link: LinkToken<\n        TObjectType[\"id\"],\n        TLinkId,\n        SingleTargetIdOf<LinkById<TObjectType, TLinkId>>\n      >\n      readonly sourceProperty: PropertyToken<TObjectType[\"id\"]>\n      readonly target: ObjectType &\n        (\n          | { id: NoInfer<SingleTargetIdOf<LinkById<TObjectType, TLinkId>>> }\n          | { extends: NoInfer<SingleTargetIdOf<LinkById<TObjectType, TLinkId>>> }\n        )\n    }\n  | {\n      readonly link: LinkToken<\n        TObjectType[\"id\"],\n        TLinkId,\n        SingleTargetIdOf<LinkById<TObjectType, TLinkId>>\n      >\n      readonly sourceField: StringDatasetColumnNameOf<TDataset>\n      readonly target: ObjectType &\n        (\n          | { id: NoInfer<SingleTargetIdOf<LinkById<TObjectType, TLinkId>>> }\n          | { extends: NoInfer<SingleTargetIdOf<LinkById<TObjectType, TLinkId>>> }\n        )\n    }\n\nexport type ProjectionForeignKeyInput<\n  TObjectType extends ObjectType,\n  TDataset extends DatasetDefinition,\n  TLinkId extends LinkIdOf<TObjectType>,\n> =\n  | ProjectionForeignKeyDescriptor<TDataset>\n  | ProjectionForeignKeyTokenInput<TObjectType, TDataset, TLinkId>\n\nfunction lowerForeignKeyMapping<TObjectType extends ObjectType, TDataset extends DatasetDefinition>(\n  mapping: {\n    [K in LinkIdOf<TObjectType>]?: ProjectionForeignKeyInput<TObjectType, TDataset, K>\n  }\n): Record<string, ForeignKeyDescriptor> {\n  const lowered: Record<string, ForeignKeyDescriptor> = {}\n  for (const [linkId, descriptor] of Object.entries(mapping)) {\n    if (!descriptor) continue\n    lowered[linkId] = isForeignKeyDescriptor(descriptor)\n      ? descriptor\n      : fromForeignKey(descriptor as Parameters<typeof fromForeignKey>[0])\n  }\n  return lowered\n}\n\nfunction isForeignKeyDescriptor(value: unknown): value is ForeignKeyDescriptor {\n  return isRecord(value) && typeof value.linkId === \"string\"\n}\n\n// ── defineProjection ─────────────────────────────────────────\n\ninterface ObjectTypeProjectionSourceBuilder<TObjectType extends ObjectType> {\n  fromDataset<const TDataset extends DatasetDefinition>(\n    dataset: TDataset\n  ): ObjectTypeProjectionDatasetBuilder<TObjectType, TDataset>\n}\n\ninterface ObjectTypeProjectionDatasetBuilder<\n  TObjectType extends ObjectType,\n  TDataset extends DatasetDefinition,\n> {\n  properties<const TMapping extends ProjectionMappingFor<TObjectType, TDataset>>(\n    mapping: ExactProjectionMapping<TObjectType, TMapping>\n  ): ObjectProjectionBuilder<TObjectType, TDataset>\n  points<const TProperties extends TelemetryProjectionPropertiesMapping<TObjectType, TDataset>>(\n    mapping: TelemetryProjectionPropertiesPointMapping<TObjectType, TDataset, TProperties>\n  ): TelemetryProjectionDefinition\n}\n\nexport type ObjectProjectionConflictResolution<TDataset extends DatasetDefinition> =\n  | { readonly strategy: \"editsWin\" }\n  | {\n      readonly strategy: \"mostRecent\"\n      readonly sourceTimestamp: TimestampDatasetColumnNameOf<TDataset>\n    }\n\nexport interface ObjectProjectionBuilder<\n  TObjectType extends ObjectType,\n  TDataset extends DatasetDefinition,\n> extends ObjectProjectionDefinition {\n  readonly conflictResolution: SourceEditConflictResolution\n  withLinks(\n    mapping: { [K in LinkIdOf<TObjectType>]?: ProjectionForeignKeyInput<TObjectType, TDataset, K> }\n  ): ObjectProjectionBuilder<TObjectType, TDataset>\n  resolveConflicts(\n    resolution: ObjectProjectionConflictResolution<TDataset>\n  ): ObjectProjectionBuilder<TObjectType, TDataset>\n}\n\n/**\n * Defines an object, link, or telemetry projection from its ontology target.\n *\n * ```ts\n * defineProjection(\"room-projection\", Room)\n *   .fromDataset(canonicalRoomsDataset)\n *   .properties({ id: \"room_id\", name: \"room_name\" })\n *   .withLinks({\n *     inBuilding: {\n *       link: Room.l.inBuilding,\n *       sourceField: \"building_id\",\n *       target: Building,\n *     },\n *   })\n * ```\n */\nexport function defineProjection<const TObjectType extends ObjectType>(\n  id: string,\n  objectType: TObjectType\n): ObjectTypeProjectionSourceBuilder<TObjectType>\nexport function defineProjection<\n  TObjectTypeId extends string,\n  TLinkId extends string,\n  TTargetObjectTypeId extends string,\n>(\n  id: string,\n  linkToken: LinkToken<TObjectTypeId, TLinkId, TTargetObjectTypeId>\n): LinkProjectionSourceBuilder\nexport function defineProjection<const TPropertyToken extends TelemetryPropertyToken>(\n  id: string,\n  propertyToken: TPropertyToken\n): TelemetryProjectionSourceBuilder<TPropertyToken>\nexport function defineProjection(\n  id: string,\n  target: ObjectType | LinkToken<string, string, string> | TelemetryPropertyToken\n):\n  | ObjectTypeProjectionSourceBuilder<ObjectType>\n  | LinkProjectionSourceBuilder\n  | TelemetryProjectionSourceBuilder<TelemetryPropertyToken> {\n  if (\"link\" in target) return buildLinkProjection(id, target)\n  if (\"property\" in target) return buildTelemetryProjection(id, target)\n  return buildObjectTypeProjection(id, target)\n}\n\nfunction buildObjectTypeProjection<const TObjectType extends ObjectType>(\n  id: string,\n  objectType: TObjectType\n): ObjectTypeProjectionSourceBuilder<TObjectType> {\n  assertNonEmpty(id, \"id\")\n\n  return {\n    fromDataset<const TDataset extends DatasetDefinition>(\n      dataset: TDataset\n    ): ObjectTypeProjectionDatasetBuilder<TObjectType, TDataset> {\n      assertProjectionDataset(dataset)\n      const datasetId = dataset.id\n\n      return {\n        properties<const TMapping extends ProjectionMappingFor<TObjectType, TDataset>>(\n          mapping: ExactProjectionMapping<TObjectType, TMapping>\n        ): ObjectProjectionBuilder<TObjectType, TDataset> {\n          const propertyMapping = mapping as Record<string, string>\n          validatePropertyMapping(objectType, propertyMapping)\n\n          return objectProjectionBuilder({\n            id,\n            objectType,\n            datasetId,\n            propertyMapping,\n            links: {},\n            conflictResolution: { strategy: \"editsWin\" },\n          })\n        },\n        points<\n          const TProperties extends TelemetryProjectionPropertiesMapping<TObjectType, TDataset>,\n        >(\n          mapping: TelemetryProjectionPropertiesPointMapping<TObjectType, TDataset, TProperties>\n        ): TelemetryProjectionDefinition {\n          const pointMapping = lowerTelemetryPropertiesPointMapping(\n            objectType,\n            mapping as {\n              readonly objectId?: string\n              readonly at?: string\n              readonly properties?: Readonly<Record<string, unknown>>\n            }\n          )\n          return {\n            _tag: \"TelemetryProjectionDefinition\",\n            id,\n            objectTypeId: objectType.id,\n            datasetId,\n            objectIdField: pointMapping.objectId,\n            atField: pointMapping.at,\n            properties: pointMapping.properties,\n          }\n        },\n      }\n    },\n  }\n}\n\nfunction objectProjectionBuilder<\n  TObjectType extends ObjectType,\n  TDataset extends DatasetDefinition,\n>(input: {\n  readonly id: string\n  readonly objectType: TObjectType\n  readonly datasetId: string\n  readonly propertyMapping: Readonly<Record<string, string>>\n  readonly links: Readonly<Record<string, ForeignKeyDescriptor>>\n  readonly conflictResolution: SourceEditConflictResolution\n}): ObjectProjectionBuilder<TObjectType, TDataset> {\n  const definition: ObjectProjectionDefinition & {\n    readonly conflictResolution: SourceEditConflictResolution\n  } = {\n    _tag: \"ObjectProjectionDefinition\",\n    id: input.id,\n    objectTypeId: input.objectType.id,\n    datasetId: input.datasetId,\n    properties: { ...input.propertyMapping },\n    links: { ...input.links },\n    conflictResolution: { ...input.conflictResolution },\n  }\n\n  return Object.assign(definition, {\n    withLinks(\n      linkMapping: {\n        [K in LinkIdOf<TObjectType>]?: ProjectionForeignKeyInput<TObjectType, TDataset, K>\n      }\n    ): ObjectProjectionBuilder<TObjectType, TDataset> {\n      const loweredLinkMapping = lowerForeignKeyMapping(linkMapping)\n      const validatedLinks = validateAndLowerLinkMapping(\n        input.objectType,\n        loweredLinkMapping,\n        input.propertyMapping as Record<string, string>\n      )\n      return objectProjectionBuilder({ ...input, links: validatedLinks })\n    },\n    resolveConflicts(\n      resolution: ObjectProjectionConflictResolution<TDataset>\n    ): ObjectProjectionBuilder<TObjectType, TDataset> {\n      validateConflictResolution(resolution)\n      return objectProjectionBuilder({\n        ...input,\n        conflictResolution: resolution as SourceEditConflictResolution,\n      })\n    },\n  })\n}\n\nfunction validateConflictResolution(resolution: SourceEditConflictResolution): void {\n  if (resolution.strategy === \"editsWin\") return\n  assertNonEmpty(resolution.sourceTimestamp, \"source timestamp field\")\n}\n\n// ── Telemetry projection ────────────────────────────────────\n\ninterface TelemetryProjectionSourceBuilder<TPropertyToken extends TelemetryPropertyToken> {\n  fromDataset<const TDataset extends DatasetDefinition>(\n    dataset: TDataset\n  ): TelemetryProjectionMappingBuilder<TPropertyToken, TDataset>\n}\n\ninterface TelemetryProjectionMappingBuilder<\n  TPropertyToken extends TelemetryPropertyToken,\n  TDataset extends DatasetDefinition,\n> {\n  points<const TMapping extends TelemetryProjectionPointMapping<TPropertyToken, TDataset>>(\n    mapping: ExactTelemetryProjectionPointMapping<TMapping>\n  ): TelemetryProjectionDefinition\n}\n\n/**\n * Fluent builder for {@link TelemetryProjectionDefinition}.\n *\n * ```ts\n * defineProjection(\"room-temperatures\", Room.p.temperature)\n *   .fromDataset(roomReadingsDataset)\n *   .points({\n *     objectId: \"room_id\",\n *     at: \"observed_at\",\n *     value: \"temperature\",\n *     unit: \"unit\",\n *   })\n * ```\n */\nfunction buildTelemetryProjection<const TPropertyToken extends TelemetryPropertyToken>(\n  id: string,\n  propertyToken: TPropertyToken\n): TelemetryProjectionSourceBuilder<TPropertyToken> {\n  assertNonEmpty(id, \"id\")\n  validateTelemetryProjectionProperty(propertyToken)\n\n  return {\n    fromDataset<const TDataset extends DatasetDefinition>(\n      dataset: TDataset\n    ): TelemetryProjectionMappingBuilder<TPropertyToken, TDataset> {\n      assertProjectionDataset(dataset)\n      const datasetId = dataset.id\n\n      return {\n        points<const TMapping extends TelemetryProjectionPointMapping<TPropertyToken, TDataset>>(\n          mapping: ExactTelemetryProjectionPointMapping<TMapping>\n        ): TelemetryProjectionDefinition {\n          const pointMapping = lowerTelemetryPointMapping(mapping)\n          return {\n            _tag: \"TelemetryProjectionDefinition\",\n            id,\n            objectTypeId: propertyToken.objectTypeId,\n            datasetId,\n            objectIdField: pointMapping.objectId,\n            atField: pointMapping.at,\n            properties: {\n              [propertyToken.id]: {\n                valueField: pointMapping.value,\n                ...(pointMapping.unit !== undefined ? { unitField: pointMapping.unit } : {}),\n              },\n            },\n          }\n        },\n      }\n    },\n  }\n}\n\nfunction validateTelemetryProjectionProperty(propertyToken: PropertyToken): void {\n  if (propertyToken.property.mode !== \"telemetry\") {\n    throw new ProjectionValidationError(\n      `Projection property '${propertyToken.objectTypeId}.${propertyToken.id}' must be telemetry-enabled.`\n    )\n  }\n}\n\nfunction lowerTelemetryPointMapping(mapping: {\n  readonly objectId?: string\n  readonly at?: string\n  readonly value?: string\n  readonly unit?: string\n}): {\n  readonly objectId: string\n  readonly at: string\n  readonly value: string\n  readonly unit?: string\n} {\n  const allowedKeys = new Set([\"objectId\", \"at\", \"value\", \"unit\"])\n  for (const key of Object.keys(mapping)) {\n    if (!allowedKeys.has(key)) {\n      throw new ProjectionValidationError(\n        `Telemetry projection point mapping contains unknown key '${key}'.`\n      )\n    }\n  }\n\n  if (mapping.objectId === undefined) {\n    throw new ProjectionValidationError(\"Telemetry projection point mapping requires objectId.\")\n  }\n  if (mapping.at === undefined) {\n    throw new ProjectionValidationError(\"Telemetry projection point mapping requires at.\")\n  }\n  if (mapping.value === undefined) {\n    throw new ProjectionValidationError(\"Telemetry projection point mapping requires value.\")\n  }\n\n  assertNonEmpty(mapping.objectId, \"objectId field\")\n  assertNonEmpty(mapping.at, \"at field\")\n  assertNonEmpty(mapping.value, \"value field\")\n  if (mapping.unit !== undefined) {\n    assertNonEmpty(mapping.unit, \"unit field\")\n  }\n\n  return {\n    objectId: mapping.objectId,\n    at: mapping.at,\n    value: mapping.value,\n    ...(mapping.unit !== undefined ? { unit: mapping.unit } : {}),\n  }\n}\n\nfunction lowerTelemetryPropertiesPointMapping(\n  objectType: ObjectType,\n  mapping: {\n    readonly objectId?: string\n    readonly at?: string\n    readonly properties?: Readonly<Record<string, unknown>>\n  }\n): {\n  readonly objectId: string\n  readonly at: string\n  readonly properties: Readonly<Record<string, TelemetryProjectionPropertyMapping>>\n} {\n  const allowedKeys = new Set([\"objectId\", \"at\", \"properties\"])\n  for (const key of Object.keys(mapping)) {\n    if (!allowedKeys.has(key)) {\n      throw new ProjectionValidationError(\n        `Telemetry projection point mapping contains unknown key '${key}'.`\n      )\n    }\n  }\n\n  if (mapping.objectId === undefined) {\n    throw new ProjectionValidationError(\"Telemetry projection point mapping requires objectId.\")\n  }\n  if (mapping.at === undefined) {\n    throw new ProjectionValidationError(\"Telemetry projection point mapping requires at.\")\n  }\n  if (mapping.properties === undefined) {\n    throw new ProjectionValidationError(\"Telemetry projection point mapping requires properties.\")\n  }\n  if (!isRecord(mapping.properties)) {\n    throw new ProjectionValidationError(\n      \"Telemetry projection point mapping properties must be an object.\"\n    )\n  }\n\n  assertNonEmpty(mapping.objectId, \"objectId field\")\n  assertNonEmpty(mapping.at, \"at field\")\n\n  const propertyEntries = Object.entries(mapping.properties)\n  if (propertyEntries.length === 0) {\n    throw new ProjectionValidationError(\n      \"Telemetry projection point mapping requires at least one property.\"\n    )\n  }\n\n  const propertiesById = new Map(objectType.properties.map((property) => [property.id, property]))\n  const properties: Record<string, TelemetryProjectionPropertyMapping> = {}\n  for (const [propertyId, input] of propertyEntries) {\n    const property = propertiesById.get(propertyId)\n    if (!property) {\n      throw new ProjectionValidationError(\n        `Property '${propertyId}' does not exist on object type '${objectType.id}'.`\n      )\n    }\n    if (property.mode !== \"telemetry\") {\n      throw new ProjectionValidationError(\n        `Projection property '${objectType.id}.${propertyId}' must be telemetry-enabled.`\n      )\n    }\n    properties[propertyId] = lowerTelemetryPropertyMapping(propertyId, input)\n  }\n\n  return { objectId: mapping.objectId, at: mapping.at, properties }\n}\n\nfunction lowerTelemetryPropertyMapping(\n  propertyId: string,\n  input: unknown\n): TelemetryProjectionPropertyMapping {\n  if (typeof input === \"string\") {\n    assertNonEmpty(input, `property '${propertyId}' value field`)\n    return { valueField: input }\n  }\n  if (!isRecord(input)) {\n    throw new ProjectionValidationError(\n      `Telemetry projection property '${propertyId}' must map a value column or value/unit columns.`\n    )\n  }\n\n  const allowedKeys = new Set([\"value\", \"unit\"])\n  for (const key of Object.keys(input)) {\n    if (!allowedKeys.has(key)) {\n      throw new ProjectionValidationError(\n        `Telemetry projection property '${propertyId}' contains unknown key '${key}'.`\n      )\n    }\n  }\n  if (typeof input.value !== \"string\") {\n    throw new ProjectionValidationError(\n      `Telemetry projection property '${propertyId}' requires a value field.`\n    )\n  }\n  if (typeof input.unit !== \"string\") {\n    throw new ProjectionValidationError(\n      `Telemetry projection property '${propertyId}' requires a unit field.`\n    )\n  }\n  assertNonEmpty(input.value, `property '${propertyId}' value field`)\n  assertNonEmpty(input.unit, `property '${propertyId}' unit field`)\n  return { valueField: input.value, unitField: input.unit }\n}\n\n// ── fromForeignKey ───────────────────────────────────────────\n\n/**\n * Creates a {@link ForeignKeyDescriptor} from typed tokens.\n *\n * Compile-time constraints:\n * - `TObjectTypeId` ties `link` and `sourceProperty` to the same object type\n *   when a projected source property is used.\n * - `TTargetObjectTypeId` (inferred from the link token) constrains `target`\n *   to an ObjectType whose `id` or `extends` matches the link's declared target.\n *   This covers exact type match and direct subtypes. Multi-level inheritance\n *   is validated at Sixb startup when the full type graph is available.\n *\n * ```ts\n * fromForeignKey({\n *   link: Room.l.inBuilding,\n *   sourceProperty: Room.p.buildingRef,\n *   target: Building,\n * })\n * ```\n */\nexport function fromForeignKey<\n  TObjectTypeId extends string,\n  TTargetObjectTypeId extends string,\n>(input: {\n  link: LinkToken<TObjectTypeId, string, TTargetObjectTypeId>\n  sourceProperty: PropertyToken<TObjectTypeId>\n  target: ObjectType &\n    ({ id: NoInfer<TTargetObjectTypeId> } | { extends: NoInfer<TTargetObjectTypeId> })\n}): ForeignKeyFromSourceProperty\nexport function fromForeignKey<\n  TObjectTypeId extends string,\n  TTargetObjectTypeId extends string,\n  const TSourceField extends string,\n>(input: {\n  link: LinkToken<TObjectTypeId, string, TTargetObjectTypeId>\n  sourceField: TSourceField\n  target: ObjectType &\n    ({ id: NoInfer<TTargetObjectTypeId> } | { extends: NoInfer<TTargetObjectTypeId> })\n}): ForeignKeyFromSourceField<TSourceField>\nexport function fromForeignKey<\n  TObjectTypeId extends string,\n  TTargetObjectTypeId extends string,\n>(input: {\n  link: LinkToken<TObjectTypeId, string, TTargetObjectTypeId>\n  sourceProperty?: PropertyToken<TObjectTypeId>\n  sourceField?: string\n  target: ObjectType &\n    ({ id: NoInfer<TTargetObjectTypeId> } | { extends: NoInfer<TTargetObjectTypeId> })\n}): ForeignKeyDescriptor {\n  validateLinkProjectionTarget(input.link)\n\n  if (input.sourceProperty) {\n    return {\n      linkId: input.link.id,\n      sourcePropertyId: input.sourceProperty.id,\n      targetObjectTypeId: input.target.id,\n    }\n  }\n\n  if (input.sourceField === undefined) {\n    throw new ProjectionValidationError(\"Foreign key sourceField is required.\")\n  }\n  assertNonEmpty(input.sourceField, \"source field\")\n  return {\n    linkId: input.link.id,\n    sourceField: input.sourceField,\n    targetObjectTypeId: input.target.id,\n  }\n}\n\n// ── Link projection ─────────────────────────────────────────\n\ninterface LinkProjectionSourceBuilder {\n  fromDataset<const TDataset extends DatasetDefinition>(\n    dataset: TDataset\n  ): LinkProjectionFieldBuilder<TDataset>\n}\n\ninterface LinkProjectionFieldBuilder<TDataset extends DatasetDefinition> {\n  sourceField(\n    columnName: StringDatasetColumnNameOf<TDataset>\n  ): LinkProjectionTargetBuilder<TDataset>\n}\n\ninterface LinkProjectionTargetBuilder<TDataset extends DatasetDefinition> {\n  targetField(columnName: StringDatasetColumnNameOf<TDataset>): LinkProjectionDefinition\n}\n\n/**\n * Fluent builder for {@link LinkProjectionDefinition} (many-to-many join datasets).\n *\n * ```ts\n * defineProjection(\"room-sensor-links\", Room.l.hasSensors)\n *   .fromDataset(roomSensorsDataset)\n *   .sourceField(\"room_id\")\n *   .targetField(\"sensor_id\")\n * ```\n */\nfunction buildLinkProjection<\n  TObjectTypeId extends string,\n  TLinkId extends string,\n  TTargetObjectTypeId extends string,\n>(\n  id: string,\n  linkToken: LinkToken<TObjectTypeId, TLinkId, TTargetObjectTypeId>\n): LinkProjectionSourceBuilder {\n  assertNonEmpty(id, \"id\")\n  validateLinkProjectionTarget(linkToken)\n\n  return {\n    fromDataset<const TDataset extends DatasetDefinition>(\n      dataset: TDataset\n    ): LinkProjectionFieldBuilder<TDataset> {\n      assertProjectionDataset(dataset)\n      const datasetId = dataset.id\n\n      return {\n        sourceField(\n          columnName: StringDatasetColumnNameOf<TDataset>\n        ): LinkProjectionTargetBuilder<TDataset> {\n          assertNonEmpty(columnName, \"source field\")\n\n          return {\n            targetField(\n              targetColumnName: StringDatasetColumnNameOf<TDataset>\n            ): LinkProjectionDefinition {\n              assertNonEmpty(targetColumnName, \"target field\")\n\n              return {\n                _tag: \"LinkProjectionDefinition\",\n                id,\n                linkId: linkToken.id,\n                sourceObjectTypeId: linkToken.objectTypeId,\n                targetObjectTypeId: linkToken.targetObjectTypeId as string,\n                datasetId,\n                sourceField: columnName,\n                targetField: targetColumnName,\n              }\n            },\n          }\n        },\n      }\n    },\n  }\n}\n\n// ── Type guards ──────────────────────────────────────────────\n\n/** Runtime type guard for {@link ObjectProjectionDefinition}. */\nexport function isObjectProjectionDefinition(value: unknown): value is ObjectProjectionDefinition {\n  if (!isRecord(value)) return false\n  return (\n    value._tag === \"ObjectProjectionDefinition\" &&\n    typeof value.id === \"string\" &&\n    typeof value.objectTypeId === \"string\" &&\n    typeof value.datasetId === \"string\" &&\n    isRecord(value.properties) &&\n    isRecord(value.links) &&\n    isSourceEditConflictResolution(value.conflictResolution)\n  )\n}\n\nfunction isSourceEditConflictResolution(value: unknown): boolean {\n  if (value === undefined) return true\n  if (!isRecord(value) || typeof value.strategy !== \"string\") return false\n  if (value.strategy === \"editsWin\") return value.sourceTimestamp === undefined\n  return value.strategy === \"mostRecent\" && typeof value.sourceTimestamp === \"string\"\n}\n\n/** Runtime type guard for {@link LinkProjectionDefinition}. */\nexport function isLinkProjectionDefinition(value: unknown): value is LinkProjectionDefinition {\n  if (!isRecord(value)) return false\n  return (\n    value._tag === \"LinkProjectionDefinition\" &&\n    typeof value.id === \"string\" &&\n    typeof value.linkId === \"string\" &&\n    typeof value.sourceObjectTypeId === \"string\" &&\n    typeof value.targetObjectTypeId === \"string\" &&\n    typeof value.datasetId === \"string\" &&\n    typeof value.sourceField === \"string\" &&\n    typeof value.targetField === \"string\"\n  )\n}\n\n/** Runtime type guard for {@link TelemetryProjectionDefinition}. */\nexport function isTelemetryProjectionDefinition(\n  value: unknown\n): value is TelemetryProjectionDefinition {\n  if (!isRecord(value)) return false\n  return (\n    value._tag === \"TelemetryProjectionDefinition\" &&\n    typeof value.id === \"string\" &&\n    typeof value.objectTypeId === \"string\" &&\n    typeof value.datasetId === \"string\" &&\n    typeof value.objectIdField === \"string\" &&\n    typeof value.atField === \"string\" &&\n    isTelemetryProjectionProperties(value.properties)\n  )\n}\n\nfunction isTelemetryProjectionProperties(value: unknown): boolean {\n  if (!isRecord(value) || Object.keys(value).length === 0) return false\n  return Object.values(value).every(\n    (mapping) =>\n      isRecord(mapping) &&\n      typeof mapping.valueField === \"string\" &&\n      (mapping.unitField === undefined || typeof mapping.unitField === \"string\")\n  )\n}\n\n/** Runtime type guard for any {@link ProjectionDefinition}. */\nexport function isProjectionDefinition(value: unknown): value is ProjectionDefinition {\n  return (\n    isObjectProjectionDefinition(value) ||\n    isLinkProjectionDefinition(value) ||\n    isTelemetryProjectionDefinition(value)\n  )\n}\n\n/**\n * Extracts the object type id(s) a projection targets, used to authorize run\n * visibility (`object.view`). Link projections require both ends; object and\n * telemetry projections target a single type.\n */\nexport function projectionTargetOf(projection: LinkProjectionDefinition): LinkProjectionTarget\nexport function projectionTargetOf(\n  projection: ObjectProjectionDefinition | TelemetryProjectionDefinition\n): ObjectProjectionTarget\nexport function projectionTargetOf(projection: ProjectionDefinition): ProjectionTarget\nexport function projectionTargetOf(projection: ProjectionDefinition): ProjectionTarget {\n  return projection._tag === \"LinkProjectionDefinition\"\n    ? {\n        sourceObjectTypeId: projection.sourceObjectTypeId,\n        targetObjectTypeId: projection.targetObjectTypeId,\n      }\n    : { objectTypeId: projection.objectTypeId }\n}\n\n// ── Categorization ──────────────────────────────────────────\n\n/** Splits a mixed list of projection definitions into typed arrays by tag. */\nexport function categorizeProjections(projections: readonly ProjectionDefinition[]): {\n  objectProjections: ObjectProjectionDefinition[]\n  linkProjections: LinkProjectionDefinition[]\n  telemetryProjections: TelemetryProjectionDefinition[]\n} {\n  const objectProjections: ObjectProjectionDefinition[] = []\n  const linkProjections: LinkProjectionDefinition[] = []\n  const telemetryProjections: TelemetryProjectionDefinition[] = []\n  for (const projection of projections) {\n    if (isObjectProjectionDefinition(projection)) {\n      objectProjections.push(projection)\n    } else if (isLinkProjectionDefinition(projection)) {\n      linkProjections.push(projection)\n    } else if (isTelemetryProjectionDefinition(projection)) {\n      telemetryProjections.push(projection)\n    }\n  }\n  return { objectProjections, linkProjections, telemetryProjections }\n}\n",
-    "import type { ProjectionDefinition, ProjectionTarget } from \"../projections\"\nimport { projectionTargetOf } from \"../projections/builders\"\nimport type { ActionRunRecord } from \"../storage/action-runs\"\nimport type { PipelineRunRecord } from \"../storage/pipeline-runs\"\nimport type { WorkflowInterventionRecord } from \"../storage/workflow-interventions\"\nimport type { WorkflowRunRecord } from \"../storage/workflow-runs\"\nimport { isAllowed } from \"./decision\"\nimport type { AuthorizationContext } from \"./types\"\n\nexport function canViewActionRun(\n  authorization: AuthorizationContext | null | undefined,\n  run: Pick<ActionRunRecord, \"actionId\" | \"subject\">\n): boolean {\n  if (!authorization) {\n    return true\n  }\n\n  if (!isAllowed(authorization, { kind: \"action.apply\", actionId: run.actionId })) {\n    return false\n  }\n\n  return run.subject.kind !== \"object\"\n    ? true\n    : isAllowed(authorization, {\n        kind: \"object.view\",\n        objectTypeId: run.subject.objectTypeId,\n      })\n}\n\nexport function canViewWorkflowRun(\n  authorization: AuthorizationContext | null | undefined,\n  run: Pick<WorkflowRunRecord, \"workflowId\">\n): boolean {\n  return (\n    !authorization || isAllowed(authorization, { kind: \"workflow.run\", workflowId: run.workflowId })\n  )\n}\n\nexport function canViewWorkflowIntervention(\n  authorization: AuthorizationContext | null | undefined,\n  intervention: Pick<WorkflowInterventionRecord, \"workflowId\">\n): boolean {\n  return (\n    !authorization ||\n    isAllowed(authorization, { kind: \"workflow.run\", workflowId: intervention.workflowId })\n  )\n}\n\nexport function canViewPipelineRun(\n  authorization: AuthorizationContext | null | undefined,\n  run: Pick<PipelineRunRecord, \"pipelineId\">\n): boolean {\n  return (\n    !authorization || isAllowed(authorization, { kind: \"pipeline.run\", pipelineId: run.pipelineId })\n  )\n}\n\n/** A projection run is viewable when its target object type(s) are viewable. */\nexport function canViewProjectionRun(\n  authorization: AuthorizationContext | null | undefined,\n  target: ProjectionTarget\n): boolean {\n  if (!authorization) return true\n  const canView = (objectTypeId: string) =>\n    isAllowed(authorization, { kind: \"object.view\", objectTypeId })\n  if (\"sourceObjectTypeId\" in target) {\n    return canView(target.sourceObjectTypeId) && canView(target.targetObjectTypeId)\n  }\n  return canView(target.objectTypeId)\n}\n\n/** Whether a principal may see a projection definition (and its run history). */\nexport function canViewProjection(\n  authorization: AuthorizationContext | null | undefined,\n  projection: ProjectionDefinition\n): boolean {\n  return canViewProjectionRun(authorization, projectionTargetOf(projection))\n}\n",
-    "/**\n * Authorization context types.\n *\n * The context is plain, immutable data resolved once per request\n * (`principal -> groups -> roles -> grants`). Grants resolve eagerly into set\n * lookups so enforcement on the hot path is synchronous and allocation-free.\n * Group and role ids are retained so decisions stay explainable.\n */\n\nimport type { Principal } from \"../auth/types\"\nimport { emptyGrantSets, type GrantKind, type SingletonGrantKind } from \"./grant-kinds\"\n\n/**\n * Grants keyed by kind (`view:object`, `run:sync`, …). Resource selections resolve\n * to id sets; project-wide singleton capabilities resolve to booleans.\n * Broad grants and object subtypes are already expanded. Keyed by `GrantKind`\n * so a new grant family adds one key, not a new bucket every consumer must\n * learn.\n */\nexport type GrantIndex = Readonly<{\n  [TKind in GrantKind]: TKind extends SingletonGrantKind ? boolean : ReadonlySet<string>\n}>\n\n/**\n * A grant index that grants nothing, as the base for a hand-built context — typically in tests.\n *\n * This is the read-only face of `emptyGrantSets()`, the mutable builder resolution fills in and which\n * stays internal. A factory rather than a shared constant, because the sets are only `ReadonlySet` to\n * the type system: one frozen instance would be aliased into every context that spreads it.\n *\n * Writing the literal by hand is what this avoids. `GrantIndex` is deliberately a total `Record` so\n * that `grants[kind].has(id)` cannot be misspelled into a silent `undefined` — with an optional index\n * every enforcement site would read `?.has(id) ?? false`, where a typo denies instead of failing to\n * compile. The cost of totality is that a literal breaks whenever a grant family is added.\n */\nexport function emptyGrantIndex(): GrantIndex {\n  return emptyGrantSets()\n}\n\n/** A role with its grants pre-expanded to concrete id sets at startup. */\nexport interface ResolvedRole {\n  readonly id: string\n  readonly grantedToGroupIds: readonly string[]\n  readonly grants: GrantIndex\n}\n\nexport interface AuthorizationContext {\n  readonly principal: Principal\n  readonly sessionId?: string\n  readonly groupIds: readonly string[]\n  /** Roles whose grantedTo groups intersect the principal's memberships. */\n  readonly roleIds: readonly string[]\n  readonly grants: GrantIndex\n}\n"
-  ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;AAAA;;;ACCO,SAAS,sBAAqB,CAAC,SAAyB;AAAA,EAC7D,OAAO,aAAa;AAAA;;;ACuEf,IAAM,cAIT;AAAA,EACF,sBAAsB;AAAA,IACpB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,IACL,iBAAiB;AAAA,EACnB;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EAIA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,YAAY;AAAA,IACV,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,aAAa;AAAA,IACX,WAAW;AAAA,IACX,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,mBAAmB;AAAA,IACjB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AACF;AAEO,IAAM,kBAAkB,OAAO,KAAK,WAAW;AAC/C,IAAM,2BAA2B,gBAAgB,OACtD,CAAC,SAAoC,SAAS,WAChD;AAMO,SAAS,WAAW,CAAC,OAAmC;AAAA,EAC7D,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO,QAAQ,MAAM;AAAA,SAClB;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO,OAAO,MAAM;AAAA,SACjB;AAAA,MACH,OAAO,WAAW,MAAM;AAAA,SACrB;AAAA,MACH,OAAO,UAAU,MAAM;AAAA;AAAA;AAStB,SAAS,cAAc,GAAsB;AAAA,EAClD,OAAO;AAAA,IACL,sBAAsB,IAAI;AAAA,IAC1B,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,eAAe,IAAI;AAAA,IACnB,oBAAoB,IAAI;AAAA,IACxB,gBAAgB,IAAI;AAAA,IACpB,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,YAAY,IAAI;AAAA,IAChB,gBAAgB,IAAI;AAAA,IACpB,aAAa;AAAA,IACb,gBAAgB,IAAI;AAAA,IACpB,mBAAmB,IAAI;AAAA,IACvB,oBAAoB,IAAI;AAAA,IACxB,kBAAkB,IAAI;AAAA,EACxB;AAAA;;;AC1MK,IAAM,0BAAyB;AAEtC,IAAM,wBAAwB;AAAA;AAGvB,MAAM,sCAAqC,MAAM;AAAA,EAK3C;AAAA,EACA;AAAA,EALF,OAAO;AAAA,EACP,OAAO;AAAA,EAEhB,WAAW,CACA,QACA,OACT;AAAA,IACA,MAAM,mCAAmC,iBAAiB,SAAS;AAAA,IAH1D;AAAA,IACA;AAAA;AAIb;AAGO,SAAS,kCAAiC,CAC/C,QAC2B;AAAA,EAC3B,IAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AAAA,IACjD,MAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAAA,EACA,OAAO,OAAO,OAAO;AAAA,IACnB,mBAAmB,oBAAoB,OAAO,mBAAmB,mBAAmB;AAAA,IACpF,oBAAoB,oBAAoB,OAAO,oBAAoB,oBAAoB;AAAA,EACzF,CAAC;AAAA;AAII,SAAS,2BAA0B,CAAC,OAAqB;AAAA,EAC9D,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,yBAAwB;AAAA,IAC/E,MAAM,IAAI,MACR,gDAAgD,iCAClD;AAAA,EACF;AAAA;AAIK,SAAS,kCAAiC,CAC/C,OACA,QACM;AAAA,EACN,MAAM,OAAO,MAAa;AAAA,IACxB,MAAM,IAAI,8BAA6B,mBAAmB,OAAO,kBAAkB;AAAA;AAAA,EAErF,MAAM,QAA8D,CAAC;AAAA,EACrE,IAAI,QAAQ;AAAA,EACZ,MAAM,WAAW,CAAC,UAAwB;AAAA,IACxC,SAAS;AAAA,IACT,IAAI,QAAQ,OAAO;AAAA,MAAoB,KAAK;AAAA;AAAA,EAE9C,MAAM,oBAAoB,CAAC,cAA+C;AAAA,IACxE,QAAQ,OAAO;AAAA,WACR;AAAA,QACH,SAAS,qBAAqB,SAAS,CAAC;AAAA,QACxC;AAAA,WACG;AAAA,QACH,SACE,OAAO,SAAS,SAAS,IAAK,OAAO,GAAG,WAAW,EAAE,IAAI,IAAI,OAAO,SAAS,EAAE,SAAU,CAC3F;AAAA,QACA;AAAA,WACG;AAAA,QACH,SAAS,YAAY,IAAI,CAAC;AAAA,QAC1B;AAAA;AAAA;AAAA,EAIN,IAAI;AAAA,IACF,KAAK,UAAU,OAAO,QAAS,CAAgB,KAAK,SAAkB;AAAA,MACpE,MAAM,SAAS,SAAS,IAAI,IAAI,OAAO;AAAA,MACvC,IAAI,mBAAmB;AAAA,MACvB,IAAI,QAAQ;AAAA,QACV,SAAS,QAAQ,MAAM,SAAS,EAAG,SAAS,GAAG,SAAS,GAAG;AAAA,UACzD,IAAI,MAAM,QAAQ,UAAU,QAAQ;AAAA,YAClC,mBAAmB;AAAA,YACnB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,MAAM,SAAS,qBAAqB;AAAA,MACpC,IAAI,QAAQ;AAAA,QACV,MAAM,SAAS;AAAA,MACjB,EAAO;AAAA,QACL,MAAM,SAAS,mBAAmB;AAAA;AAAA,MAEpC,MAAM,cAAc,SAAS,YAAY,MAAM;AAAA,MAC/C,MAAM,gBAAgB,MAAM,QAAQ,MAAM;AAAA,MAC1C,MAAM,cACJ,YAAY,aAAa,OAAO,YAAY,cAAc,OAAO,YAAY;AAAA,MAE/E,IAAI,CAAC,QAAQ;AAAA,QACX,IAAI,CAAC,iBAAiB;AAAA,UAAa,OAAO;AAAA,QAC1C,IAAI,CAAC;AAAA,UAAa,OAAO,KAAK;AAAA,QAC9B,IAAI,YAAY,qBAAqB;AAAA,UAAG,SAAS,CAAC;AAAA,QAClD,YAAY,sBAAsB;AAAA,QAClC,IAAI,CAAC;AAAA,UAAe,SAAS,qBAAqB,GAAG,IAAI,CAAC;AAAA,MAC5D,EAAO,SAAI,aAAa;AAAA,QACtB,OAAO;AAAA,MACT;AAAA,MAEA,IAAI,iBAAiB,aAAa;AAAA,QAChC,SAAS,CAAC;AAAA,QACV,OAAO;AAAA,MACT;AAAA,MAEA,IAAI,SAAS,OAAO,GAAG;AAAA,QAGrB,MAAM,UAAU,yBAAyB,OAAO;AAAA,QAChD,QAAQ,QAAQ;AAAA,eACT;AAAA,YACH,kBAAkB,QAAQ,KAAK;AAAA,YAC/B,OAAO,QAAQ;AAAA,eACZ;AAAA,YACH,MAAM,IAAI,UAAU,iCAAiC;AAAA,eAClD;AAAA,YACH,SAAS,kBAAkB,QAAQ,KAAK,CAAC;AAAA,YACzC,OAAO;AAAA,eACJ;AAAA,YACH;AAAA;AAAA,MAEN;AAAA,MAEA,QAAQ,OAAO;AAAA,aACR;AAAA,UACH,kBAAkB,OAAO;AAAA,UACzB;AAAA,aACG;AAAA,UACH,kBAAkB,OAAO;AAAA,UACzB;AAAA,aACG;AAAA,UACH,kBAAkB,OAAO;AAAA,UACzB;AAAA,aACG;AAAA,UACH,MAAM,IAAI,UAAU,iCAAiC;AAAA,aAClD;AAAA,UACH,IAAI,YAAY,MAAM;AAAA,YACpB,SAAS,CAAC;AAAA,YACV;AAAA,UACF;AAAA,UACA,IAAI,MAAM,KAAK,CAAC,UAAU,MAAM,UAAU,OAAO,GAAG;AAAA,YAClD,MAAM,IAAI,UAAU,qBAAqB;AAAA,UAC3C;AAAA,UACA,IAAI,MAAM,SAAS,IAAI;AAAA,YAAuB,KAAK;AAAA,UACnD,SAAS,CAAC;AAAA,UACV,MAAM,KAAK,EAAE,OAAO,SAAS,oBAAoB,EAAE,CAAC;AAAA,UACpD;AAAA;AAAA,MAEJ,OAAO;AAAA,KACR;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,iBAAiB;AAAA,MAA8B,MAAM;AAAA,IACzD,IAAI,iBAAiB,cAAc,iBAAiB;AAAA,MAAW,KAAK;AAAA,IACpE,MAAM;AAAA;AAAA;AAUV,IAAM,kBAAkB;AAGxB,IAAM,YAAY,gBAAgB,WAAW,KAAK,eAAe;AACjE,IAAM,iBAAiB,YAAY,QAAQ,UAAU,OAAO;AAC5D,IAAM,gBAAgB,YAAY,OAAO,UAAU,OAAO;AAC1D,IAAM,gBAAgB,YAAY,OAAO,UAAU,OAAO;AAC1D,IAAM,gBAAgB,YAAY,OAAO,UAAU,OAAO;AAC1D,IAAM,gBAAgB;AAEtB,SAAS,wBAAwB,CAAC,OAAkC;AAAA,EAClE,IAAI,YAAY,KAAK,GAAG;AAAA,IACtB,MAAM,MAAO,MAAyC;AAAA,IACtD,IAAI,OAAO,QAAQ;AAAA,MAAU,OAAO,EAAE,MAAM,WAAW;AAAA,IACvD,OAAO,EAAE,MAAM,OAAO,OAAO,IAAI;AAAA,EACnC;AAAA,EAEA,MAAM,UAAU,MAAM,OAAO,cAAc;AAAA,EAC3C,IAAI,QAAQ;AAAA,IAAS,OAAO,EAAE,MAAM,aAAa,OAAO,QAAQ,MAAM;AAAA,EACtE,MAAM,SAAS,MAAM,OAAO,aAAa;AAAA,EACzC,IAAI,OAAO;AAAA,IAAS,OAAO,EAAE,MAAM,aAAa,OAAO,CAAE,MAA4B;AAAA,EACrF,MAAM,SAAS,MAAM,OAAO,aAAa;AAAA,EACzC,IAAI,OAAO;AAAA,IAAS,OAAO,EAAE,MAAM,aAAa,OAAO,cAAc,KAAK,EAAE;AAAA,EAC5E,IAAI,MAAM,OAAO,aAAa,EAAE;AAAA,IAAS,OAAO,EAAE,MAAM,SAAS;AAAA,EACjE,OAAO,EAAE,MAAM,WAAW;AAAA;AAG5B,SAAS,WAAc,CAAC,SAAoD;AAAA,EAC1E,OAAO,SAAS,UAAU,KAAK,KAAK,OAAO;AAAA;AAG7C,SAAS,KAAQ,CACf,OACA,SAC6E;AAAA,EAC7E,IAAI;AAAA,IACF,OAAO,EAAE,SAAS,MAAM,OAAO,QAAQ,KAAK,EAAE;AAAA,IAC9C,MAAM;AAAA,IACN,OAAO,EAAE,SAAS,MAAM;AAAA;AAAA;AAI5B,SAAS,iBAAiB,CAAC,OAAuB;AAAA,EAGhD,IAAI,QAAQ;AAAA,EACZ,SAAS,QAAQ,EAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AAAA,IACpD,MAAM,OAAO,MAAM,WAAW,KAAK;AAAA,IACnC,IAAI,QAAQ,KAAM;AAAA,MAChB,SAAS;AAAA,IACX,EAAO,SAAI,QAAQ,MAAO;AAAA,MACxB,SAAS;AAAA,IACX,EAAO,SAAI,QAAQ,SAAU,QAAQ,OAAQ;AAAA,MAC3C,MAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AAAA,MACvC,IAAI,QAAQ,SAAU,QAAQ,OAAQ;AAAA,QACpC,SAAS;AAAA,QACT,SAAS;AAAA,MACX,EAAO;AAAA,QACL,SAAS;AAAA;AAAA,IAEb,EAAO;AAAA,MACL,SAAS;AAAA;AAAA,EAEb;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,oBAAoB,CAAC,OAAuB;AAAA,EACnD,IAAI,QAAQ;AAAA,EACZ,SAAS,QAAQ,EAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AAAA,IACpD,MAAM,OAAO,MAAM,WAAW,KAAK;AAAA,IACnC,IAAI,SAAS,MAAQ,SAAS,IAAM;AAAA,MAClC,SAAS;AAAA,IACX,EAAO,SAAI,QAAQ,IAAM;AAAA,MACvB,SACE,SAAS,KAAQ,SAAS,KAAQ,SAAS,MAAQ,SAAS,MAAQ,SAAS,KAAO,IAAI;AAAA,IAC5F,EAAO,SAAI,QAAQ,KAAM;AAAA,MACvB,SAAS;AAAA,IACX,EAAO,SAAI,QAAQ,MAAO;AAAA,MACxB,SAAS;AAAA,IACX,EAAO,SAAI,QAAQ,SAAU,QAAQ,OAAQ;AAAA,MAC3C,MAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AAAA,MACvC,IAAI,QAAQ,SAAU,QAAQ,OAAQ;AAAA,QACpC,SAAS;AAAA,QACT,SAAS;AAAA,MACX,EAAO;AAAA,QACL,SAAS;AAAA;AAAA,IAEb,EAAO,SAAI,QAAQ,SAAU,QAAQ,OAAQ;AAAA,MAC3C,SAAS;AAAA,IACX,EAAO;AAAA,MACL,SAAS;AAAA;AAAA,EAEb;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,QAAQ,CAAC,OAAiC;AAAA,EACjD,OAAO,OAAO,UAAU,YAAY,UAAU;AAAA;AAGhD,SAAS,mBAAmB,CAAC,OAAgB,MAAsB;AAAA,EACjE,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAAA,IAC3E,MAAM,IAAI,MAAM,UAAU,uCAAuC;AAAA,EACnE;AAAA,EACA,OAAO;AAAA;;;ACvMT,MAAM,+BAA+B;AAAA,EAC1B,wBAAwB;AAAA,EAEzB,WAAW,GAAG;AAAA,SAEf,MAAM,GAAmC;AAAA,IAC9C,MAAM,aAAa,IAAI;AAAA,IACvB,OAAO,OAAO,UAAU;AAAA,IACxB,OAAO;AAAA;AAAA,SAGF,EAAE,CAAC,OAAyD;AAAA,IACjE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,yBAAyB;AAAA;AAEnF;AAiBO,SAAS,oCAAoC,GAAyB;AAAA,EAC3E,OAAO,+BAA+B,OAAO;AAAA;AAIxC,SAAS,gCAAgC,CAAC,OAA+C;AAAA,EAC9F,OAAO,+BAA+B,GAAG,KAAK;AAAA;;;AJ1ChD,IAAM,2BAA2B,IAAI;AAKrC,IAAM,qCAAqC;AAC3C,IAAM,6CAA6C;AAE5C,SAAS,mCAAmC,CAAC,OAI3B;AAAA,EACvB,IAAI,MAAM,UAAU,SAAS,SAAS,WAAW;AAAA,IAC/C,MAAM,IAAI,MAAM,sEAAsE;AAAA,EACxF;AAAA,EACA,OAAO,uCAAuC,KAAK;AAAA;AAI9C,SAAS,+BAA+B,CAAC,OAYvB;AAAA,EACvB,IAAI,MAAM,UAAU,SAAS,SAAS,SAAS;AAAA,IAC7C,MAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AAAA,EAEA,IAAI,MAAM,UAAU,SAAS,aAAa;AAAA,IACxC,OAAO,uCAAuC;AAAA,MAC5C,WAAW,MAAM;AAAA,MACjB,SAAS,MAAM,UAAU;AAAA,SACrB,MAAM,UAAU,eAAe,YAC/B,CAAC,IACD,EAAE,YAAY,MAAM,UAAU,WAAW;AAAA,IAC/C,CAAC;AAAA,EACH;AAAA,EAEA,OAAO,SAAS,MAAM,WAAW;AAAA,IAC/B,MAAM;AAAA,IACN,WAAW,MAAM,UAAU;AAAA,IAC3B,KAAK,OAAO,OAAO,EAAE,MAAM,WAAW,CAAC;AAAA,EACzC,CAAC;AAAA;AAGH,SAAS,sCAAsC,CAAC,OAIvB;AAAA,EACvB,MAAM,UAAU,6BAA6B,MAAM,OAAO;AAAA,EAC1D,MAAM,aAAa,MAAM,aAAa,mBAAmB,MAAM,UAAU,IAAI;AAAA,EAC7E,+BAA+B,SAAS,UAAU;AAAA,EAClD,MAAM,MAAiE,OAAO,OAAO;AAAA,IACnF,MAAM;AAAA,IACN,WAAW,QAAQ;AAAA,OACf,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AAAA,EACnD,CAAC;AAAA,EACD,OAAO,SAAS,MAAM,WAAW;AAAA,IAC/B,MAAM;AAAA,IACN,WAAW,MAAM,UAAU;AAAA,IAC3B;AAAA,IACA;AAAA,EACF,CAAC;AAAA;AAGI,SAAS,kCAAkC,CAChD,WACsB;AAAA,EACtB,OAAO,SAAS,WAAW;AAAA,IACzB,MAAM;AAAA,IACN,WAAW,UAAU;AAAA,IACrB,KAAK,OAAO,OAAO,EAAE,MAAM,WAAW,CAAC;AAAA,EACzC,CAAC;AAAA;AAII,SAAS,mCAAmC,CAAC,OAQ3B;AAAA,EACvB,MAAM,YAAY,MAAM;AAAA,EACxB,MAAM,kBAAkB,MAAM;AAAA,EAC9B,MAAM,mBAAmB,MAAM;AAAA,EAC/B,MAAM,kBAAkB,MAAM;AAAA,EAC9B,MAAM,aACJ,oBAAoB,YAAY,YAAY,yBAAyB,eAAe;AAAA,EACtF,IAAI,UAAU,SAAS,SAAS,aAAa,UAAU,gBAAgB,WAAW;AAAA,IAChF,MAAM,IAAI,MACR,0FACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,OAAO,OAAO;AAAA,IAC/B,OAAO,gCAA+B,gBAAgB,SAAS;AAAA,IAC/D,QAAQ,mCAAkC,gBAAgB,MAAM;AAAA,EAClE,CAAC;AAAA,EACD,OAAO,SAAS,WAAW;AAAA,IACzB,MAAM;AAAA,IACN,WAAW,UAAU;AAAA,IACrB;AAAA,IACA,aAAa,6BAA6B,oBAAoB,CAAC,CAAC;AAAA,OAC5D,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AAAA,EACnD,CAAC;AAAA;AAGI,SAAS,0CAA0C,CAAC,OAGlC;AAAA,EACvB,MAAM,YAAY,yBAAyB,MAAM,SAAS;AAAA,EAC1D,OAAO,SAAS,MAAM,WAAW;AAAA,IAC/B,MAAM;AAAA,IACN,WAAW,MAAM,UAAU;AAAA,IAC3B,KAAK,OAAO,OAAO,EAAE,MAAM,oBAAoB,UAAU,CAAC;AAAA,EAC5D,CAAC;AAAA;AAGI,SAAS,gCAAgC,CAAC,OAGxB;AAAA,EACvB,MAAM,YAAY,wBAAwB,MAAM,SAAS;AAAA,EACzD,OAAO,SAAS,MAAM,WAAW;AAAA,IAC/B,MAAM;AAAA,IACN,WAAW,MAAM,UAAU;AAAA,IAC3B,KAAK,OAAO,OAAO,EAAE,MAAM,UAAU,UAAU,CAAC;AAAA,EAClD,CAAC;AAAA;AAGI,SAAS,2BAA2B,CAAC,eAAsD;AAAA,EAChG,IAAI,CAAC,iCAAiC,aAAa,GAAG;AAAA,IACpD,OAAO,EAAE,MAAM,SAAS;AAAA,EAC1B;AAAA,EACA,OAAO,yBAAyB,IAAI,aAAa,GAAG,YAAY,EAAE,MAAM,SAAS;AAAA;AAS5E,SAAS,qCAAqC,CAAC,OAGrB;AAAA,EAC/B,MAAM,WAAW,4BAA4B,MAAM,oBAAoB;AAAA,EACvE,IACE,SAAS,SAAS,YAClB,OAAO,MAAM,cAAc,YAC3B,SAAS,cAAc,MAAM,WAC7B;AAAA,IACA,OAAO,EAAE,MAAM,SAAS;AAAA,EAC1B;AAAA,EACA,OAAO;AAAA;AAGF,SAAS,mBAAmB,CAAC,eAAuD;AAAA,EACzF,MAAM,WAAW,4BAA4B,aAAa;AAAA,EAC1D,IAAI,SAAS,SAAS,UAAU;AAAA,IAC9B,MAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AAAA,EACA,IAAI,SAAS,SAAS,aAAa;AAAA,IACjC,IAAI,SAAS,YAAY;AAAA,MACvB,OAAO,EAAE,MAAM,aAAa,YAAY,KAAK,SAAS,WAAW,EAAE;AAAA,IACrE;AAAA,IACA,MAAM,IAAI,MACR,mFACF;AAAA,EACF;AAAA,EACA,OAAO,sBAAsB,SAAS,GAAG;AAAA;AAG3C,SAAS,wBAAwB,CAC/B,OACyE;AAAA,EACzE,MAAM,OAAO,MAAM;AAAA,EACnB,MAAM,UAAU,MAAM;AAAA,EACtB,MAAM,YAAY,MAAM;AAAA,EACxB,IAAI,SAAS;AAAA,IAAS,MAAM,IAAI,MAAM,gDAAgD;AAAA,EACtF,eAAe,SAAS,gBAAgB;AAAA,EACxC,eAAe,WAAW,kBAAkB;AAAA,EAC5C,OAAO,OAAO,OAAO,EAAE,MAAM,SAAS,UAAU,CAAC;AAAA;AAG5C,SAAS,2BAA2B,CAAC,WAAmB,OAA6B;AAAA,EAC1F,eAAe,WAAW,YAAY;AAAA,EACtC,IAAI,MAAM,UAAU,cAAc,WAAW;AAAA,IAC3C,MAAM,iBACJ,uBACA,8CAA8C,MAAM,UAAU,oBAAoB,eAClF;AAAA,MACE,SAAS;AAAA,QACP,aAAa,MAAM,UAAU;AAAA,QAC7B,mBAAmB;AAAA,QACnB,gBAAgB,MAAM,UAAU;AAAA,MAClC;AAAA,IACF,CACF;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,4BAA4B,MAAM,aAAa;AAAA,EAChE,IAAI,SAAS,SAAS,UAAU;AAAA,IAC9B,MAAM,iBACJ,uBACA,sEACA,EAAE,SAAS,EAAE,aAAa,MAAM,UAAU,IAAI,UAAU,EAAE,CAC5D;AAAA,EACF;AAAA,EACA,IAAI,SAAS,cAAc,WAAW;AAAA,IACpC,MAAM,iBACJ,uBACA,sDAAsD,SAAS,oBAAoB,eACnF;AAAA,MACE,SAAS;AAAA,QACP,wBAAwB,SAAS;AAAA,QACjC,aAAa,MAAM,UAAU;AAAA,QAC7B,mBAAmB;AAAA,MACrB;AAAA,IACF,CACF;AAAA,EACF;AAAA;AAUK,SAAS,qBAAqB,CAAC,OAAuC;AAAA,EAC3E,MAAM,YAAY,MAAM;AAAA,EACxB,MAAM,gBAAgB,MAAM;AAAA,EAC5B,OAAO,OAAO,OAAO,EAAE,WAAW,cAAc,CAAC;AAAA;AAI5C,SAAS,kCAAkC,CAChD,WACA,OACgC;AAAA,EAChC,MAAM,gBAAgB,sBAAsB,KAAK;AAAA,EACjD,4BAA4B,WAAW,aAAa;AAAA,EACpD,MAAM,WAAW,4BAA4B,cAAc,aAAa;AAAA,EACxE,IAAI,SAAS,SAAS,UAAU;AAAA,IAC9B,MAAM,iBACJ,uBACA,sEACA,EAAE,SAAS,EAAE,aAAa,cAAc,UAAU,IAAI,UAAU,EAAE,CACpE;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,yBAAyB,IAAI,cAAc,aAAa;AAAA,EAC7E,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,aAAa,WAAW,cAAc,SAAS,GAAG;AAAA,IAC9F,MAAM,0BACJ,cAAc,UAAU,IACxB,sDACF;AAAA,EACF;AAAA,EAEA,4CAA4C,UAAU,cAAc,SAAS;AAAA,EAC7E,OAAO;AAAA;AAGT,SAAS,2CAA2C,CAClD,UACA,WACM;AAAA,EACN,QAAQ,UAAU,SAAS;AAAA,SACpB;AAAA,MACH,IACE,UAAU,OAAO,SAAS,UAC1B,UAAU,OAAO,cAAc,UAAU,SAAS,WAClD;AAAA,QACA,MAAM,0BAA0B,UAAU,IAAI,4CAA4C;AAAA,MAC5F;AAAA,MACA,IAAI,SAAS,SAAS,aAAa;AAAA,QACjC,IAAI,CAAC,gBAAgB,UAAU,aAAa,SAAS,IAAI,SAAS,GAAG;AAAA,UACnE,MAAM,0BACJ,UAAU,IACV,6DACF;AAAA,QACF;AAAA,QACA;AAAA,MACF;AAAA,MACA,IACE,SAAS,SAAS,kBAClB,SAAS,IAAI,SAAS,cACtB,UAAU,gBAAgB,WAC1B;AAAA,QACA;AAAA,MACF;AAAA,MACA,IAAI,SAAS,SAAS,eAAe,UAAU,gBAAgB;AAAA,QAAW;AAAA,MAC1E,MAAM,0BACJ,UAAU,IACV,mFACF;AAAA,SAEG;AAAA,MACH,IACE,SAAS,SAAS,kBAClB,SAAS,IAAI,SAAS,sBACtB,SAAS,IAAI,UAAU,SAAS,UAAU,SAAS,QACnD,SAAS,IAAI,UAAU,OAAO,UAAU,SAAS,MACjD,SAAS,IAAI,UAAU,UAAU,UAAU,SAAS,OACpD;AAAA,QACA,MAAM,0BACJ,UAAU,IACV,yDACF;AAAA,MACF;AAAA,MACA;AAAA,SAEG;AAAA,MACH,IAAI,UAAU,OAAO,SAAS,aAAa;AAAA,QACzC,MAAM,0BACJ,UAAU,IACV,8CACF;AAAA,MACF;AAAA,MACA,IAAI,SAAS,SAAS,eAAe,SAAS,IAAI,SAAS,aAAa;AAAA,QACtE,IAAI,SAAS,IAAI,UAAU,SAAS,kBAAkB;AAAA,UACpD,MAAM,UAAU,UAAU,SAAS;AAAA,UACnC,IACE,YAAY,aACZ,SAAS,IAAI,UAAU,OAAO,uBAAsB,OAAO,KAC3D,SAAS,IAAI,eAAe,WAC5B;AAAA,YACA,MAAM,0BACJ,UAAU,IACV,4DACF;AAAA,UACF;AAAA,QACF,EAAO,SAAI,SAAS,IAAI,eAAe,WAAW;AAAA,UAChD,MAAM,0BACJ,UAAU,IACV,sDACF;AAAA,QACF;AAAA,QACA;AAAA,MACF;AAAA,MACA,IAAI,SAAS,SAAS,kBAAkB,SAAS,IAAI,SAAS;AAAA,QAAY;AAAA,MAC1E,MAAM,0BACJ,UAAU,IACV,0DACF;AAAA,SAEG;AAAA,MACH,IACE,SAAS,SAAS,kBAClB,SAAS,IAAI,SAAS,YACtB,UAAU,gBAAgB,aAC1B,SAAS,IAAI,UAAU,SAAS,UAAU,SAAS,UAAU,QAC7D,kBAAkB,SAAS,IAAI,SAAS,MACtC,kBAAkB,UAAU,SAAS,SAAS,GAChD;AAAA,QACA,MAAM,0BACJ,UAAU,IACV,8CACF;AAAA,MACF;AAAA,MACA;AAAA;AAAA;AAIN,SAAS,eAAe,CACtB,MACA,OACS;AAAA,EACT,OAAO,MAAM,SAAS,OAAO,QAAQ,MAAM,OAAO,OAAO;AAAA;AAG3D,SAAS,yBAAyB,CAAC,aAAqB,QAAuB;AAAA,EAC7E,OAAO,iBACL,uBACA,qBAAqB,oDAAoD,WACzE,EAAE,SAAS,EAAE,aAAa,OAAO,EAAE,CACrC;AAAA;AAGF,SAAS,QAAQ,CACf,WACA,OACsB;AAAA,EACtB,eAAe,MAAM,WAAW,0BAA0B;AAAA,EAC1D,MAAM,mBAAmB,yBAAyB,SAAS;AAAA,EAC3D,IAAI,MAAM,cAAc,iBAAiB,WAAW;AAAA,IAClD,MAAM,IAAI,MACR,oDAAoD,MAAM,sCAAsC,iBAAiB,aACnH;AAAA,EACF;AAAA,EACA,4CAA4C,OAAO,gBAAgB;AAAA,EACnE,MAAM,gBAAgB,qCAAqC;AAAA,EAC3D,yBAAyB,IACvB,eACA,OAAO,OAAO,EAAE,UAAU,OAAO,OAAO,KAAK,GAAG,WAAW,iBAAiB,CAAC,CAC/E;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,uBAAuB,CAAC,SAA2B,WAAsC;AAAA,EAChG,IAAI;AAAA,IACF,OAAO,kBAAkB,SAAS,yBAAyB,SAAS,CAAC;AAAA,IACrE,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIX,SAAS,wBAAwB,CAAC,WAA+C;AAAA,EAC/E,eAAe,UAAU,IAAI,cAAc;AAAA,EAC3C,eAAe,UAAU,WAAW,sBAAsB;AAAA,EAC1D,eAAe,UAAU,eAAe,0BAA0B;AAAA,EAClE,OAAO,OAAO,OAAO;AAAA,IACnB,IAAI,UAAU;AAAA,IACd,WAAW,UAAU;AAAA,OACjB,UAAU,gBAAgB,YAC1B,CAAC,IACD,EAAE,aAAa,8BAA8B,UAAU,WAAW,EAAE;AAAA,IACxE,UAAU,0BAA0B,UAAU,QAAQ;AAAA,IACtD,QAAQ,wBAAwB,UAAU,MAAM;AAAA,IAChD,eAAe,UAAU;AAAA,EAC3B,CAAC;AAAA;AAGH,SAAS,yBAAyB,CAChC,UAC8B;AAAA,EAC9B,QAAQ,SAAS;AAAA,SACV;AAAA,MACH,eAAe,SAAS,WAAW,sBAAsB;AAAA,MACzD,OAAO,OAAO,OAAO,EAAE,MAAM,WAAW,WAAW,SAAS,UAAU,CAAC;AAAA,SACpE,aAAa;AAAA,MAChB,MAAM,YAAY,yBAAyB,QAAQ;AAAA,MACnD,OAAO,OAAO,OAAO,EAAE,MAAM,gBAAgB,UAAU,CAAC;AAAA,IAC1D;AAAA,SACK;AAAA,MACH,IAAI,SAAS,YAAY;AAAA,QACvB,eAAe,SAAS,SAAS,0BAA0B;AAAA,MAC7D,eAAe,SAAS,OAAO,wBAAwB;AAAA,MACvD,OAAO,OAAO,OAAO;AAAA,QACnB,MAAM;AAAA,WACF,SAAS,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;AAAA,QACtE,OAAO,SAAS;AAAA,MAClB,CAAC;AAAA,SACE;AAAA,MACH,OAAO,OAAO,OAAO;AAAA,QACnB,MAAM;AAAA,QACN,WAAW,wBAAwB,SAAS,SAAS;AAAA,MACvD,CAAC;AAAA;AAAA,EAEL,MAAM,IAAI,MACR,2CAA2C,OAAQ,SAAgC,IAAI,KACzF;AAAA;AAGF,SAAS,uBAAuB,CAAC,QAAgE;AAAA,EAC/F,QAAQ,OAAO;AAAA,SACR;AAAA,MACH,eAAe,OAAO,UAAU,4BAA4B;AAAA,MAC5D,OAAO,OAAO,OAAO,EAAE,MAAM,OAAO,MAAM,UAAU,OAAO,SAAS,CAAC;AAAA,SAClE;AAAA,MACH,eAAe,OAAO,WAAW,6BAA6B;AAAA,MAC9D,OAAO,OAAO,OAAO,EAAE,MAAM,QAAQ,WAAW,OAAO,UAAU,CAAC;AAAA,SAC/D;AAAA,MACH,eAAe,OAAO,YAAY,8BAA8B;AAAA,MAChE,OAAO,OAAO,OAAO,EAAE,MAAM,WAAW,YAAY,OAAO,WAAW,CAAC;AAAA,SACpE;AAAA,SACA;AAAA,MACH,eAAe,OAAO,SAAS,2BAA2B;AAAA,MAC1D,OAAO,OAAO,OAAO,EAAE,MAAM,OAAO,MAAM,SAAS,OAAO,QAAQ,CAAC;AAAA,SAChE;AAAA,MACH,eAAe,OAAO,WAAW,6BAA6B;AAAA,MAC9D,eAAe,OAAO,WAAW,qCAAqC;AAAA,MACtE,OAAO,OAAO,OAAO;AAAA,QACnB,MAAM;AAAA,QACN,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,MACpB,CAAC;AAAA,SACE;AAAA,MACH,eAAe,OAAO,aAAa,+BAA+B;AAAA,MAClE,OAAO,OAAO,OAAO,EAAE,MAAM,aAAa,aAAa,OAAO,YAAY,CAAC;AAAA;AAAA,EAE/E,MAAM,IAAI,MACR,yCAAyC,OAAQ,OAA8B,IAAI,KACrF;AAAA;AAGF,SAAS,4BAA4B,CACnC,SAC+B;AAAA,EAC/B,MAAM,YAAY,8BAA8B,QAAQ,SAAS;AAAA,EACjE,MAAM,SAAS,CAAC;AAAA,EAChB,WAAW,QAAQ,0BAA0B;AAAA,IAC3C,OAAO,QAAQ,IAAI,kBAAkB,QAAQ,OAAO,KAAK;AAAA,EAC3D;AAAA,EACA,MAAM,eAA2B,OAAO,OAAO;AAAA,OAC1C;AAAA,IACH,aAAa,QAAQ,OAAO;AAAA,EAC9B,CAAC;AAAA,EACD,OAAO,OAAO,OAAO;AAAA,IACnB;AAAA,OACI,QAAQ,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,UAAU;AAAA,IAC1E,UAAU,OAAO,OAAO,CAAC,GAAG,QAAQ,QAAQ,CAAC;AAAA,IAC7C,SAAS,OAAO,OAAO,CAAC,GAAG,QAAQ,OAAO,CAAC;AAAA,IAC3C,QAAQ;AAAA,EACV,CAAC;AAAA;AAAA;AAIH,MAAM,kBAAiD;AAAA,EAC5C;AAAA,GACC,OAAO,eAAe;AAAA,EAEhC,WAAW,CAAC,QAA0B;AAAA,IACpC,KAAK,UAAU,IAAI,IAAI,MAAM;AAAA,IAC7B,OAAO,OAAO,IAAI;AAAA;AAAA,MAGhB,IAAI,GAAW;AAAA,IACjB,OAAO,KAAK,QAAQ;AAAA;AAAA,EAGtB,GAAG,CAAC,OAAwB;AAAA,IAC1B,OAAO,KAAK,QAAQ,IAAI,KAAK;AAAA;AAAA,EAG/B,OAAO,GAAuC;AAAA,IAC5C,OAAO,KAAK,QAAQ,QAAQ;AAAA;AAAA,EAG9B,IAAI,GAAoC;AAAA,IACtC,OAAO,KAAK,QAAQ,KAAK;AAAA;AAAA,EAG3B,MAAM,GAAsC;AAAA,IAC1C,OAAO,KAAK,QAAQ,OAAO;AAAA;AAAA,GAG5B,OAAO,SAAS,GAAoD;AAAA,IACnE,OAAO,KAAK,QAAQ,OAAO,UAAU;AAAA;AAAA,EAGvC,OAAO,CACL,UACA,SACM;AAAA,IACN,WAAW,SAAS,KAAK,SAAS;AAAA,MAChC,SAAS,KAAK,SAAS,OAAO,OAAO,IAAI;AAAA,IAC3C;AAAA;AAAA,EAGF,GAAG,CAAC,QAAuB;AAAA,IACzB,MAAM,0BAA0B;AAAA;AAAA,EAGlC,MAAM,CAAC,QAAuB;AAAA,IAC5B,MAAM,0BAA0B;AAAA;AAAA,EAGlC,KAAK,GAAU;AAAA,IACb,MAAM,0BAA0B;AAAA;AAEpC;AAEA,OAAO,OAAO,kBAAkB,SAAS;AAEzC,SAAS,yBAAyB,GAAU;AAAA,EAC1C,OAAO,IAAI,MAAM,oDAAoD;AAAA;AAGvE,SAAS,6BAA6B,CAAC,WAA6C;AAAA,EAClF,IAAI,UAAU,SAAS,UAAU,UAAU,SAAS,kBAAkB;AAAA,IACpE,MAAM,IAAI,MAAM,0BAA0B,UAAU,0CAA0C;AAAA,EAChG;AAAA,EACA,eAAe,UAAU,IAAI,4BAA4B;AAAA,EACzD,OAAO,OAAO,OAAO,EAAE,MAAM,UAAU,MAAM,IAAI,UAAU,GAAG,CAAC;AAAA;AAGjE,SAAS,kBAAkB,CACzB,YACsF;AAAA,EACtF,eAAe,WAAW,IAAI,6BAA6B;AAAA,EAC3D,IAAI,WAAW,SAAS,aAAa,WAAW,SAAS,eAAe;AAAA,IACtE,MAAM,iBAAkB,WAAyC;AAAA,IACjE,MAAM,IAAI,MAAM,iDAAiD,kBAAkB;AAAA,EACrF;AAAA,EACA,OAAO,OAAO,OAAO,EAAE,MAAM,WAAW,MAAM,IAAI,WAAW,GAAG,CAAC;AAAA;AAGnE,SAAS,8BAA8B,CACrC,SACA,YAGM;AAAA,EACN,IAAI,YAAY,SAAS,WAAW;AAAA,IAClC,IAAI,QAAQ,cAAc,WAAW,IAAI;AAAA,MACvC,MAAM,IAAI,MACR,+EACF;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EACA,IAAI,QAAQ,cAAc,WAAW;AAAA,IACnC,MAAM,IAAI,MAAM,8EAA8E;AAAA,EAChG;AAAA;AAGF,SAAS,wBAAwB,CAAC,WAAqD;AAAA,EACrF,IAAI,CAAC,uBAAuB,UAAU,IAAI,GAAG;AAAA,IAC3C,MAAM,IAAI,MAAM,0CAA0C,UAAU,QAAQ;AAAA,EAC9E;AAAA,EACA,eAAe,UAAU,IAAI,sBAAsB;AAAA,EACnD,eAAe,UAAU,OAAO,0BAA0B;AAAA,EAC1D,OAAO,OAAO,OAAO,EAAE,MAAM,UAAU,MAAM,IAAI,UAAU,IAAI,OAAO,UAAU,MAAM,CAAC;AAAA;AAGzF,SAAS,uBAAuB,CAAC,WAA6C;AAAA,EAC5E,IAAI,UAAU,SAAS,sBAAsB,UAAU,SAAS,yBAAyB;AAAA,IACvF,MAAM,IAAI,MACR,oCAAoC,OAAQ,UAAiC,IAAI,KACnF;AAAA,EACF;AAAA,EACA,eAAe,kBAAkB,SAAS,GAAG,qBAAqB;AAAA,EAClE,OAAO,OAAO,OAAO,sBAAsB,UAAU,MAAM,kBAAkB,SAAS,CAAC,CAAC;AAAA;AAI1F,SAAS,4BAA4B,CACnC,OACuC;AAAA,EACvC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzB,MAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AAAA,EAEA,MAAM,cAAc,MAAM;AAAA,EAC1B,IAAI,cAAc,oCAAoC;AAAA,IACpD,MAAM,IAAI,MACR,qDAAqD,oDACvD;AAAA,EACF;AAAA,EAEA,IAAI,uBAAuB;AAAA,EAC3B,MAAM,UAAwC,CAAC;AAAA,EAC/C,SAAS,QAAQ,EAAG,QAAQ,aAAa,SAAS,GAAG;AAAA,IACnD,MAAM,iBAAiB,MAAM;AAAA,IAC7B,IAAI,CAAC,SAAS,cAAc,GAAG;AAAA,MAC7B,MAAM,IAAI,MAAM,kCAAkC,0BAA0B;AAAA,IAC9E;AAAA,IAEA,MAAM,mBAAmB,eAAe;AAAA,IACxC,MAAM,kBAAkB,eAAe;AAAA,IACvC,IAAI,CAAC,SAAS,eAAe,GAAG;AAAA,MAC9B,MAAM,IAAI,MAAM,kCAAkC,qCAAqC;AAAA,IACzF;AAAA,IAEA,MAAM,WAAW,0BACf,kBACA,2BAA2B,iBAC7B;AAAA,IACA,MAAM,eAAe,0BACnB,gBAAgB,cAChB,2BAA2B,8BAC7B;AAAA,IACA,MAAM,YAAY,0BAChB,gBAAgB,WAChB,2BAA2B,0BAC7B;AAAA,IACA,wBAAwB,SAAS,SAAS,aAAa,SAAS,UAAU;AAAA,IAC1E,IAAI,uBAAuB,4CAA4C;AAAA,MACrE,MAAM,IAAI,MACR,qDAAqD,0EACvD;AAAA,IACF;AAAA,IAEA,QAAQ,KACN,OAAO,OAAO;AAAA,MACZ;AAAA,MACA,SAAS,OAAO,OAAO,EAAE,cAAc,UAAU,CAAC;AAAA,IACpD,CAAC,CACH;AAAA,EACF;AAAA,EAEA,OAAO,OAAO,OAAO,OAAO;AAAA;AAG9B,SAAS,yBAAyB,CAAC,OAAgB,OAAuB;AAAA,EACxE,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,GAAG;AAAA,IAC9C,MAAM,IAAI,MAAM,UAAU,0BAA0B;AAAA,EACtD;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,QAAQ,CAAC,OAAkD;AAAA,EAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA;AAG5E,SAAS,qBAAqB,CAAC,KAAyC;AAAA,EACtE,QAAQ,IAAI;AAAA,SACL;AAAA,MACH,OAAO;AAAA,QACL,MAAM;AAAA,QACN,WAAW,KAAK,IAAI,UAAU;AAAA,WAC1B,IAAI,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,WAAW,EAAE;AAAA,MAC9E;AAAA,SACG;AAAA,MACH,OAAO,EAAE,MAAM,oBAAoB,WAAW,KAAK,IAAI,UAAU,EAAE;AAAA,SAChE;AAAA,MACH,OAAO,EAAE,MAAM,aAAa,YAAY,KAAK,IAAI,WAAW,EAAE;AAAA,SAC3D;AAAA,MACH,OAAO,EAAE,MAAM,UAAU,WAAW,KAAK,IAAI,UAAU,EAAE;AAAA,SACtD;AAAA,MACH,OAAO,EAAE,MAAM,WAAW;AAAA;AAAA;AAIhC,SAAS,sBAAsB,CAAC,OAA8C;AAAA,EAC5E,OACE,UAAU,YACV,UAAU,cACV,UAAU,gBACV,UAAU,UACV,UAAU,UACV,UAAU,aACV,UAAU;AAAA;AAId,SAAS,cAAc,CAAC,OAAe,OAAqB;AAAA,EAC1D,IAAI,CAAC,MAAM,KAAK,GAAG;AAAA,IACjB,MAAM,IAAI,MAAM,UAAU,0BAA0B;AAAA,EACtD;AAAA;;;AKvzBK,MAAM,4BAA2B,MAAM;AAAA,EAKjC;AAAA,EAJF,OAAO;AAAA,EAEhB,WAAW,CAEA,UACT,SACA;AAAA,IACA,MAAM,OAAO;AAAA,IAHJ;AAAA;AAKb;;;ACqDA,SAAS,QAAQ,CAAC,SAAwC;AAAA,EACxD,QAAQ,QAAQ;AAAA,SACT;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,sBAAsB,IAAI,QAAQ,SAAS,CAAC;AAAA,SACzD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,eAAe,IAAI,QAAQ,aAAa,CAAC;AAAA,SACtD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,gBAAgB,IAAI,QAAQ,UAAU,CAAC;AAAA,SACpD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,eAAe,IAAI,QAAQ,aAAa,CAAC;AAAA,SACtD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,oBAAoB,IAAI,QAAQ,aAAa,CAAC;AAAA,SAC3D;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,gBAAgB,IAAI,QAAQ,SAAS,CAAC;AAAA,SACnD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,eAAe,IAAI,QAAQ,QAAQ,CAAC;AAAA,SACjD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,gBAAgB,IAAI,QAAQ,WAAW,CAAC;AAAA,SACrD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,YAAY,IAAI,QAAQ,OAAO,CAAC;AAAA,SAC7C;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,gBAAgB,IAAI,QAAQ,WAAW,CAAC;AAAA,SACrD;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,YAAY,CAAC;AAAA,SAC1B;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,gBAAgB,IAAI,OAAO,CAAC;AAAA,SACzC;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,mBAAmB,IAAI,UAAU,CAAC;AAAA,SAC/C;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,kBAAkB,IAAI,UAAU,CAAC;AAAA,SAC9C;AAAA,MACH,OAAO,CAAC,EAAE,MAAM,oBAAoB,IAAI,QAAQ,YAAY,CAAC;AAAA,SAC1D;AAAA,MACH,OAAO,QAAQ,qBAAqB,IAAI,CAAC,QAAQ,EAAE,MAAM,eAAe,GAAG,EAAE;AAAA;AAAA;AAInF,SAAS,OAAO,CAAC,MAAoB;AAAA,EACnC,IAAI,KAAK,SAAS;AAAA,IAAa,OAAO,KAAK;AAAA,EAC3C,IACE,KAAK,SAAS,kBACd,KAAK,SAAS,qBACd,KAAK,SAAS,kBACd;AAAA,IACA,OAAO,KAAK;AAAA,EACd;AAAA,EACA,OAAO,GAAG,KAAK,QAAQ,KAAK;AAAA;AAG9B,SAAS,KAAK,CAAC,QAAoB,MAAqB;AAAA,EACtD,IAAI,KAAK,SAAS;AAAA,IAAa,OAAO,OAAO,KAAK;AAAA,EAClD,OAAO,OAAO,KAAK,MAAM,IAAI,KAAK,EAAE;AAAA;AAI/B,SAAS,SAAQ,CACtB,eACA,SACe;AAAA,EACf,MAAM,QAAQ,SAAS,OAAO;AAAA,EAC9B,MAAM,eAAe,MAAM,IAAI,OAAO;AAAA,EACtC,MAAM,UAAU,gBACZ,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,cAAc,QAAQ,IAAI,CAAC,EAAE,IAAI,OAAO,IACtE,CAAC;AAAA,EACL,OAAO,EAAE,SAAS,QAAQ,WAAW,GAAG,cAAc,QAAQ;AAAA;AAGzD,SAAS,UAAS,CACvB,eACA,SACS;AAAA,EACT,OAAO,UAAS,eAAe,OAAO,EAAE;AAAA;AAGnC,SAAS,iBAAgB,CAAC,SAA4B,SAA6B;AAAA,EACxF,MAAM,WAAW,iCAAgC,OAAO;AAAA,EACxD,IAAI,SAAS,SAAS,aAAa;AAAA,IACjC,MAAM,IAAI,oBACR,aAAa,QAAQ,QACrB,qBAAqB,QAAQ,kDAC/B;AAAA,EACF;AAAA,EACA,MAAM,gBAAgB,SAAS,SAAS,cAAc,SAAS,UAAU;AAAA,EACzE,MAAM,WAAW,UAAS,eAAe,OAAO;AAAA,EAChD,IAAI,SAAS,SAAS;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,oBACR,SAAS,QAAQ,MAAM,QAAQ,MAC/B,cAAc,eAAe,OAAO,CACtC;AAAA;AAIK,SAAS,iBAAgB,CAAC,SAA4B,SAAgC;AAAA,EAC3F,MAAM,YAAY,sCAAsC,OAAO;AAAA,EAC/D,IAAI,UAAU,SAAS,YAAY,UAAU,SAAS;AAAA,IAAa,OAAO;AAAA,EAC1E,OAAO,UAAU,SAAS,kBAAkB,WAAU,UAAU,SAAS,OAAO;AAAA;AAI3E,SAAS,gCAA+B,CAC7C,SACoE;AAAA,EACpE,MAAM,WAAW,sCAAsC,OAAO;AAAA,EAC9D,IAAI,SAAS,SAAS,UAAU;AAAA,IAC9B,MAAM,IAAI,oBACR,mBACA,mEACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAiBF,SAAS,cAAa,CAAC,SAA4B,cAA4B;AAAA,EACpF,kBAAiB,SAAS,EAAE,MAAM,eAAe,aAAa,CAAC;AAAA,EAC/D,kBAAiB,SAAS,EAAE,MAAM,eAAe,aAAa,CAAC;AAAA;AAU1D,SAAS,yBAAwB,CAAC,SAA4B,cAA4B;AAAA,EAC/F,kBAAiB,SAAS,EAAE,MAAM,oBAAoB,aAAa,CAAC;AAAA;AAI/D,SAAS,yBAAwB,CAAC,SAA4B,aAA2B;AAAA,EAC9F,kBAAiB,SAAS,EAAE,MAAM,oBAAoB,YAAY,CAAC;AAAA;AAW9D,SAAS,iBAAgB,CAAC,SAA4B,WAAyB;AAAA,EACpF,MAAM,WAAW,iCAAgC,OAAO;AAAA,EACxD,IAAI,SAAS,SAAS,gBAAgB;AAAA,IACpC;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,oBACR,cAAc,aACd,qBAAqB,2DACvB;AAAA;AASK,SAAS,qBAAoB,CAClC,SACA,WACA,WACM;AAAA,EACN,MAAM,WAAW,mCAAmC,QAAQ,WAAW;AAAA,IACrE;AAAA,IACA,eAAe,QAAQ;AAAA,EACzB,CAAC;AAAA,EACD,IAAI,SAAS,SAAS,gBAAgB;AAAA,IACpC;AAAA,EACF;AAAA,EAEA,IAAI,UAAU,SAAS,SAAS,SAAS;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,oBACR,cAAc,aACd,qBAAqB,2DACvB;AAAA;AAGF,SAAS,aAAa,CACpB,eACA,SACQ;AAAA,EACR,MAAM,cAAc,eAAe,UAAU,MAAM;AAAA,EACnD,QAAQ,QAAQ;AAAA,SACT;AAAA,MACH,OAAO,qBAAqB,sDAAsD,QAAQ;AAAA,SACvF;AAAA,MACH,OAAO,qBAAqB,oDAAoD,QAAQ;AAAA,SACrF;AAAA,MACH,OAAO,qBAAqB,gDAAgD,QAAQ;AAAA,SACjF;AAAA,MACH,OAAO,qBAAqB,qDAAqD,QAAQ;AAAA,SACtF;AAAA,MACH,OAAO,qBAAqB,oEAAoE,QAAQ;AAAA,SACrG;AAAA,MACH,OAAO,qBAAqB,gDAAgD,QAAQ;AAAA,SACjF;AAAA,MACH,OAAO,qBAAqB,gDAAgD,QAAQ;AAAA,SACjF;AAAA,MACH,OAAO,qBAAqB,gDAAgD,QAAQ;AAAA,SACjF;AAAA,MACH,OAAO,qBAAqB,4CAA4C,QAAQ;AAAA,SAC7E;AAAA,MACH,OAAO,qBAAqB,gDAAgD,QAAQ;AAAA,SACjF;AAAA,MACH,OAAO,qBAAqB;AAAA,SACzB;AAAA,MACH,OAAO,qBAAqB;AAAA,SACzB;AAAA,MACH,OAAO,qBAAqB;AAAA,SACzB;AAAA,MACH,OAAO,qBAAqB;AAAA,SACzB;AAAA,MACH,OAAO,qBAAqB,oDAAoD,QAAQ;AAAA,SACrF,gBAAgB;AAAA,MAEnB,MAAM,UAAU,QAAQ,qBAAqB,KAC3C,CAAC,iBAAiB,CAAC,WAAU,eAAe,EAAE,MAAM,eAAe,aAAa,CAAC,CACnF;AAAA,MACA,OAAO,qBAAqB,oDAAoD;AAAA,IAClF;AAAA;AAAA;;;AC5SG,SAAS,8BAA6B,CAC3C,OACA,UACS;AAAA,EACT,OAAO,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,sBAAsB,IAAI,QAAQ,CAAC;AAAA;AAetE,SAAS,qBAAoB,CAClC,eACA,OACA,UACS;AAAA,EACT,OACE,CAAC,+BAA8B,OAAO,QAAQ,KAC9C,WAAU,eAAe,EAAE,MAAM,sBAAsB,SAAS,CAAC;AAAA;;ACd9D,SAAS,aAAY,CAC1B,eACA,OACS;AAAA,EACT,IAAI,CAAC,eAAe;AAAA,IAClB,OAAO;AAAA,EACT;AAAA,EAEA,QAAQ,MAAM;AAAA,SACP;AAAA,SACA;AAAA,MACH,OAAO,WAAU,eAAe;AAAA,QAC9B,MAAM;AAAA,QACN,cAAc,MAAM,QAAQ;AAAA,MAC9B,CAAC;AAAA,SACE;AAAA,MACH,OACE,WAAU,eAAe;AAAA,QACvB,MAAM;AAAA,QACN,cAAc,MAAM,QAAQ;AAAA,MAC9B,CAAC,KACD,WAAU,eAAe,EAAE,MAAM,eAAe,cAAc,MAAM,QAAQ,aAAa,CAAC;AAAA,SAEzF,WAAW;AAAA,MAId,IAAI,CAAC,WAAU,eAAe,EAAE,MAAM,gBAAgB,UAAU,MAAM,QAAQ,SAAS,CAAC,GAAG;AAAA,QACzF,OAAO;AAAA,MACT;AAAA,MACA,MAAM,UAAU,MAAM,QAAQ;AAAA,MAC9B,OAAO,QAAQ,SAAS,WACpB,WAAU,eAAe,EAAE,MAAM,eAAe,cAAc,QAAQ,aAAa,CAAC,IACpF;AAAA,IACN;AAAA,SACK;AAAA,MACH,OAAO,WAAU,eAAe;AAAA,QAC9B,MAAM;AAAA,QACN,YAAY,MAAM,QAAQ;AAAA,MAC5B,CAAC;AAAA,SACE;AAAA,MAGH,OAAO,WAAU,eAAe;AAAA,QAC9B,MAAM;AAAA,QACN,cAAc,MAAM,QAAQ,QAAQ;AAAA,MACtC,CAAC;AAAA,SAKE;AAAA,MACH,OAAO,WAAU,eAAe;AAAA,QAC9B,MAAM;AAAA,QACN,QAAQ,MAAM,QAAQ;AAAA,MACxB,CAAC;AAAA,SACE;AAAA,MACH,OAAO,WAAU,eAAe;AAAA,QAC9B,MAAM;AAAA,QACN,YAAY,MAAM,QAAQ;AAAA,MAC5B,CAAC;AAAA,SACE;AAAA,MAIH,OAAO;AAAA,SACJ;AAAA,MAOH,OAAO,WAAU,eAAe;AAAA,QAC9B,MAAM;AAAA,QACN,WAAW,MAAM,QAAQ;AAAA,MAC3B,CAAC;AAAA;AAAA,MAGD,OAAO;AAAA;AAAA;;AC5EN,SAAS,kBAAiB,CAAC,MAAsB,UAAqC;AAAA,EAC3F,MAAM,SAAS,eAAe;AAAA,EAE9B,WAAW,SAAS,KAAK,QAAQ;AAAA,IAC/B,IAAI,MAAM,eAAe,SAAS,MAAM,WAAW,SAAS;AAAA,MAC1D,OAAO,eAAe;AAAA,MACtB;AAAA,IACF;AAAA,IACA,MAAM,OAAO,YAAY,KAAK;AAAA,IAC9B,MAAM,OAAO,YAAY;AAAA,IACzB,gBACE,MAAM,WACN,SAAS,KAAK,cACd,OAAO,OACP,KAAK,kBAAkB,SAAS,cAAc,SAChD;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;AAGT,SAAS,eAAe,CACtB,WACA,UACA,MACA,QACM;AAAA,EACN,IAAI,UAAU,KAAK;AAAA,IACjB,MAAM,SAAS,IAAI,IAAI,UAAU,MAAM;AAAA,IACvC,WAAW,MAAM,UAAU;AAAA,MACzB,IAAI,CAAC,OAAO,IAAI,EAAE,GAAG;AAAA,QACnB,KAAK,IAAI,EAAE;AAAA,MACb;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,WAAW,MAAM,UAAU,KAAK;AAAA,IAC9B,KAAK,IAAI,EAAE;AAAA,IACX,IAAI,QAAQ;AAAA,MACV,WAAW,aAAa,OAAO,EAAE,GAAG;AAAA,QAClC,KAAK,IAAI,SAAS;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AAAA;AAUK,SAAS,4BAA2B,CAAC,OAKnB;AAAA,EACvB,MAAM,iBAAiB,IAAI,IAAI,MAAM,QAAQ;AAAA,EAC7C,MAAM,UAAoB,CAAC;AAAA,EAC3B,MAAM,SAAS,eAAe;AAAA,EAE9B,WAAW,QAAQ,MAAM,OAAO;AAAA,IAC9B,IAAI,CAAC,KAAK,kBAAkB,KAAK,CAAC,YAAY,eAAe,IAAI,OAAO,CAAC,GAAG;AAAA,MAC1E;AAAA,IACF;AAAA,IAEA,QAAQ,KAAK,KAAK,EAAE;AAAA,IACpB,IAAI,KAAK,OAAO,cAAc;AAAA,MAC5B,OAAO,eAAe;AAAA,IACxB;AAAA,IACA,WAAW,QAAQ,0BAA0B;AAAA,MAC3C,WAAW,MAAM,KAAK,OAAO,OAAO;AAAA,QAClC,OAAO,MAAM,IAAI,EAAE;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,WAAW,MAAM;AAAA,OACb,MAAM,cAAc,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,IACtE,UAAU,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,EACF;AAAA;;AC1GK,MAAM,mCAAkC,MAAM;AAAA,EAC1C,OAAO;AAClB;;;ACGO,SAAS,2BAA0B,CACxC,YACA,UACqB;AAAA,EACrB,IAAI,WAAW,SAAS,8BAA8B;AAAA,IACpD,MAAM,YAAY,SAAS,qBAAqB,WAAW,YAAY;AAAA,IACvE,OAAO,gBAAgB;AAAA,MACrB,SAAS;AAAA,QACP;AAAA,UACE,cAAc,WAAW;AAAA,UACzB,WAAW;AAAA,UACX,aAAa,OAAO,KAAK,WAAW,UAAU,EAC3C,OAAO,CAAC,eAAe,eAAe,SAAS,EAC/C,KAAK,cAAc;AAAA,QACxB;AAAA,MACF;AAAA,MACA,OAAO,OAAO,KAAK,WAAW,KAAK,EAChC,KAAK,cAAc,EACnB,IAAI,CAAC,YAAY,EAAE,oBAAoB,WAAW,cAAc,OAAO,EAAE;AAAA,MAC5E,WAAW,CAAC;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EAEA,IAAI,WAAW,SAAS,4BAA4B;AAAA,IAClD,OAAO,gBAAgB;AAAA,MACrB,SAAS,CAAC;AAAA,MACV,OAAO;AAAA,QACL;AAAA,UACE,oBAAoB,WAAW;AAAA,UAC/B,QAAQ,WAAW;AAAA,QACrB;AAAA,MACF;AAAA,MACA,WAAW,CAAC;AAAA,IACd,CAAC;AAAA,EACH;AAAA,EAEA,OAAO,gBAAgB;AAAA,IACrB,SAAS,CAAC;AAAA,IACV,OAAO,CAAC;AAAA,IACR,WAAW,OAAO,KAAK,WAAW,UAAU,EACzC,KAAK,cAAc,EACnB,IAAI,CAAC,gBAAgB;AAAA,MACpB,cAAc,WAAW;AAAA,MACzB;AAAA,IACF,EAAE;AAAA,EACN,CAAC;AAAA;AAUI,SAAS,4BAA2B,CACzC,aACM;AAAA,EACN,MAAM,kBAAkB,IAAI;AAAA,EAC5B,MAAM,iBAAiB,IAAI;AAAA,EAC3B,MAAM,aAAa,IAAI;AAAA,EACvB,MAAM,kBAAkB,IAAI;AAAA,EAE5B,aAAa,YAAY,eAAe,aAAa;AAAA,IACnD,WAAW,UAAU,UAAU,SAAS;AAAA,MACtC,IAAI,OAAO,WAAW;AAAA,QACpB,cACE,iBACA,OAAO,cACP,WAAW,IACX,gBAAgB,OAAO,yBACzB;AAAA,MACF;AAAA,MACA,WAAW,cAAc,OAAO,aAAa;AAAA,QAC3C,cACE,gBACA,KAAK,UAAU,CAAC,OAAO,cAAc,UAAU,CAAC,GAChD,WAAW,IACX,aAAa,OAAO,gBAAgB,aACtC;AAAA,MACF;AAAA,IACF;AAAA,IACA,WAAW,QAAQ,UAAU,OAAO;AAAA,MAClC,cACE,YACA,KAAK,UAAU,CAAC,KAAK,oBAAoB,KAAK,MAAM,CAAC,GACrD,WAAW,IACX,eAAe,KAAK,sBAAsB,KAAK,SACjD;AAAA,IACF;AAAA,IACA,WAAW,aAAa,UAAU,WAAW;AAAA,MAC3C,cACE,iBACA,KAAK,UAAU,CAAC,UAAU,cAAc,UAAU,UAAU,CAAC,GAC7D,WAAW,IACX,qBAAqB,UAAU,gBAAgB,UAAU,aAC3D;AAAA,IACF;AAAA,EACF;AAAA;AAGF,SAAS,aAAa,CACpB,QACA,KACA,cACA,aACM;AAAA,EACN,MAAM,WAAW,OAAO,IAAI,GAAG;AAAA,EAC/B,IAAI,aAAa,WAAW;AAAA,IAC1B,MAAM,IAAI,2BACR,sBAAsB,0BAA0B,oCAAoC,YACtF;AAAA,EACF;AAAA,EACA,OAAO,IAAI,KAAK,YAAY;AAAA;AAG9B,SAAS,eAAe,CAAC,WAAqD;AAAA,EAC5E,OAAO,OAAO,OAAO;AAAA,IACnB,SAAS,OAAO,OACd,UAAU,QAAQ,IAAI,CAAC,WACrB,OAAO,OAAO,KAAK,QAAQ,aAAa,OAAO,OAAO,CAAC,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAClF,CACF;AAAA,IACA,OAAO,OAAO,OAAO,UAAU,MAAM,IAAI,CAAC,SAAS,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC;AAAA,IAC9E,WAAW,OAAO,OAChB,UAAU,UAAU,IAAI,CAAC,cAAc,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC,CACxE;AAAA,EACF,CAAC;AAAA;;;ACnGI,SAAS,uBAAuB,CACrC,YACA,SACM;AAAA,EACN,MAAM,cAAc,IAAI,IAAI,WAAW,WAAW,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AAAA,EAClE,MAAM,cAAc,OAAO,KAAK,OAAO;AAAA,EAGvC,WAAW,OAAO,aAAa;AAAA,IAC7B,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG;AAAA,MACzB,MAAM,YAAY,CAAC,GAAG,WAAW,EAAE,KAAK,EAAE,KAAK,IAAI;AAAA,MACnD,MAAM,IAAI,2BACR,aAAa,uCAAuC,WAAW,UAC7D,yBAAyB,WAC7B;AAAA,IACF;AAAA,EACF;AAAA,EAGA,MAAM,oBAAoB,WAAW,WAAW,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI;AAAA,EAChF,IAAI,kBAAkB,WAAW,GAAG;AAAA,IAClC,MAAM,IAAI,2BACR,gBAAgB,WAAW,iDACzB,SAAS,kBAAkB,SAC/B;AAAA,EACF;AAAA,EAGA,MAAM,YAAY,kBAAkB,GAAG;AAAA,EACvC,IAAI,EAAE,aAAa,UAAU;AAAA,IAC3B,MAAM,IAAI,2BACR,qBAAqB,8BAA8B,WAAW,SAC5D,2CACJ;AAAA,EACF;AAAA;AAcK,SAAS,2BAA2B,CACzC,YACA,aACA,iBACsC;AAAA,EACtC,MAAM,UAAU,IAAI,IAAI,WAAW,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AAAA,EACzD,MAAM,YAAY,IAAI,IAAI,WAAW,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAAA,EAChE,MAAM,cAAc,IAAI,IAAI,WAAW,WAAW,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AAAA,EAElE,YAAY,KAAK,eAAe,OAAO,QAAQ,WAAW,GAAG;AAAA,IAE3D,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AAAA,MACrB,MAAM,YAAY,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI;AAAA,MAC/C,MAAM,IAAI,2BACR,SAAS,uCAAuC,WAAW,UACzD,oBAAoB,WACxB;AAAA,IACF;AAAA,IAGA,IAAI,QAAQ,WAAW,QAAQ;AAAA,MAC7B,MAAM,IAAI,2BACR,qBAAqB,0CAA0C,WAAW,UAC5E;AAAA,IACF;AAAA,IAGA,MAAM,OAAO,UAAU,IAAI,GAAG;AAAA,IAC9B,IAAI,MAAM,QAAQ,KAAK,kBAAkB,GAAG;AAAA,MAC1C,MAAM,IAAI,2BACR,SAAS,wBAAwB,WAAW,mCAC1C,0DACJ;AAAA,IACF;AAAA,IACA,IAAI,KAAK,uBAAuB,KAAK;AAAA,MACnC,MAAM,IAAI,2BACR,SAAS,wBAAwB,WAAW,gCAC1C,mDACJ;AAAA,IACF;AAAA,IAEA,MAAM,mBAAmB,WAAW;AAAA,IACpC,MAAM,cAAc,WAAW;AAAA,IAC/B,IAAI,oBAAoB,aAAa;AAAA,MACnC,MAAM,IAAI,2BACR,YAAY,+DACd;AAAA,IACF;AAAA,IACA,IAAI,CAAC,oBAAoB,CAAC,aAAa;AAAA,MACrC,MAAM,IAAI,2BACR,YAAY,kDACd;AAAA,IACF;AAAA,IAEA,IAAI,CAAC,kBAAkB;AAAA,MACrB;AAAA,IACF;AAAA,IAGA,IAAI,CAAC,YAAY,IAAI,gBAAgB,GAAG;AAAA,MACtC,MAAM,YAAY,CAAC,GAAG,WAAW,EAAE,KAAK,EAAE,KAAK,IAAI;AAAA,MACnD,MAAM,IAAI,2BACR,oBAAoB,yCAClB,gBAAgB,WAAW,8BAA8B,WAC7D;AAAA,IACF;AAAA,IAGA,IAAI,EAAE,oBAAoB,kBAAkB;AAAA,MAC1C,MAAM,IAAI,2BACR,oBAAoB,+BAA+B,UACjD,2CACJ;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO,OAAO,YACZ,OAAO,QAAQ,WAAW,EAAE,IAAI,EAAE,QAAQ,gBAAgB;AAAA,IACxD;AAAA,IACA;AAAA,MACE,QAAQ,WAAW;AAAA,SACf,WAAW,qBAAqB,YAChC,EAAE,kBAAkB,WAAW,iBAAiB,IAChD,CAAC;AAAA,SACD,WAAW,gBAAgB,YAAY,EAAE,aAAa,WAAW,YAAY,IAAI,CAAC;AAAA,MACtF,oBAAoB,WAAW;AAAA,IACjC;AAAA,EACF,CAAC,CACH;AAAA;AAUK,SAAS,4BAA4B,CAAC,WAGpC;AAAA,EACP,IAAI,MAAM,QAAQ,UAAU,kBAAkB,GAAG;AAAA,IAC/C,MAAM,IAAI,2BACR,SAAS,UAAU,mCACjB,4DACJ;AAAA,EACF;AAAA,EACA,IAAI,UAAU,uBAAuB,KAAK;AAAA,IACxC,MAAM,IAAI,2BACR,SAAS,UAAU,gCACjB,qDACJ;AAAA,EACF;AAAA;AAaK,SAAS,wCAAuC,CACrD,YACA,YACA,oBACA,gBACA,QAC+B;AAAA,EAC/B,MAAM,mBAAmB,OAAO,QAAQ,WAAW,UAAU;AAAA,EAC7D,IAAI,iBAAiB,WAAW,GAAG;AAAA,IACjC,MAAM,IAAI,2BAA0B,GAAG,kDAAkD;AAAA,EAC3F;AAAA,EAEA,MAAM,eAAe;AAAA,IACnB,CAAC,YAAY,WAAW,aAAa;AAAA,IACrC,CAAC,MAAM,WAAW,OAAO;AAAA,EAC3B;AAAA,EACA,YAAY,WAAW,eAAe,cAAc;AAAA,IAClD,IAAI,CAAC,mBAAmB,IAAI,UAAU,GAAG;AAAA,MACvC,MAAM,IAAI,2BACR,GAAG,WAAW,oBAAoB,mDAChC,eAAe,WAAW,YAC9B;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,IAAI,IAAI,WAAW,WAAW,IAAI,CAAC,aAAa,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;AAAA,EAC/F,MAAM,qBAAqB,IAAI;AAAA,EAC/B,YAAY,YAAY,YAAY,kBAAkB;AAAA,IACpD,MAAM,WAAW,eAAe,IAAI,UAAU;AAAA,IAC9C,IAAI,CAAC,UAAU;AAAA,MACb,MAAM,IAAI,2BACR,GAAG,6BAA6B,wBAAwB,WAAW,eACrE;AAAA,IACF;AAAA,IACA,IAAI,SAAS,SAAS,aAAa;AAAA,MACjC,MAAM,IAAI,2BACR,GAAG,qBAAqB,wBAAwB,WAAW,yCAC7D;AAAA,IACF;AAAA,IAEA,YAAY,WAAW,eAAe;AAAA,MACpC,CAAC,SAAS,QAAQ,UAAU;AAAA,MAC5B,GAAI,QAAQ,cAAc,YAAa,CAAC,CAAC,QAAQ,QAAQ,SAAS,CAAC,IAAc,CAAC;AAAA,IACpF,GAAY;AAAA,MACV,IAAI,CAAC,mBAAmB,IAAI,UAAU,GAAG;AAAA,QACvC,MAAM,IAAI,2BACR,GAAG,qBAAqB,eAAe,oBAAoB,4BACzD,sCAAsC,WAAW,YACrD;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,eAAe,qBAAoB,UAAU,cAAc;AAAA,IACjE,IAAI,iBAAiB,aAAa,QAAQ,cAAc,WAAW;AAAA,MACjE,MAAM,IAAI,2BACR,GAAG,qBAAqB,oEAAoE,eAC9F;AAAA,IACF;AAAA,IACA,IAAI,iBAAiB,aAAa,QAAQ,cAAc,WAAW;AAAA,MACjE,MAAM,IAAI,2BACR,GAAG,qBAAqB,qEAC1B;AAAA,IACF;AAAA,IAEA,mBAAmB,IAAI,YAAY,QAAQ;AAAA,EAC7C;AAAA,EAEA,OAAO;AAAA;AA8CF,SAAS,4BAA4B,CAC1C,aACA,UACA,cAC4B;AAAA,EAC5B,QAAQ,mBAAmB,iBAAiB,yBAAyB;AAAA,EACrE,MAAM,kBAAkB,SAAS,mBAAmB;AAAA,EACpD,MAAM,kBAAkB,SAAS,mBAAmB;AAAA,EACpD,MAAM,6BAAsF,CAAC;AAAA,EAC7F,MAAM,2BAAkF,CAAC;AAAA,EACzF,MAAM,gCACJ,CAAC;AAAA,EAEH,2CAA2C,QAAQ;AAAA,EAEnD,WAAW,cAAc,mBAAmB;AAAA,IAC1C,MAAM,SAAS,eAAe,WAAW;AAAA,IACzC,MAAM,UAAU,aAAa,IAAI,WAAW,SAAS;AAAA,IACrD,IAAI,CAAC,SAAS;AAAA,MACZ,MAAM,IAAI,2BACR,GAAG,4BAA4B,WAAW,iBACxC,qEACJ;AAAA,IACF;AAAA,IAEA,MAAM,aAAa,gBAAgB,IAAI,WAAW,YAAY;AAAA,IAC9D,IAAI,CAAC,YAAY;AAAA,MACf,MAAM,IAAI,2BACR,GAAG,gCAAgC,WAAW,eAChD;AAAA,IACF;AAAA,IAEA,MAAM,qBAAqB,IAAI,IAAI,QAAQ,OAAO,QAAQ,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC;AAAA,IACtF,MAAM,qBAAqB,WAAW,sBAAsB,EAAE,UAAU,WAAW;AAAA,IACnF,IAAI,mBAAmB,aAAa,cAAc;AAAA,MAChD,MAAM,kBAAkB,QAAQ,OAAO,QAAQ,KAC7C,CAAC,WAAW,OAAO,SAAS,mBAAmB,eACjD;AAAA,MACA,IAAI,CAAC,iBAAiB;AAAA,QACpB,MAAM,IAAI,2BACR,GAAG,6BAA6B,mBAAmB,yCACjD,8BAA8B,WAAW,YAC7C;AAAA,MACF;AAAA,MACA,IAAI,gBAAgB,SAAS,aAAa;AAAA,QACxC,MAAM,IAAI,2BACR,GAAG,6BAA6B,mBAAmB,uCACjD,0BACJ;AAAA,MACF;AAAA,MACA,IAAI,gBAAgB,aAAa,MAAM;AAAA,QACrC,MAAM,IAAI,2BACR,GAAG,6BAA6B,mBAAmB,uCACjD,mCACJ;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,cAAc,IAAI,IAAI,WAAW,WAAW,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AAAA,IAClE,YAAY,QAAQ,eAAe,OAAO,QAAQ,WAAW,UAAU,GAAG;AAAA,MACxE,IAAI,CAAC,YAAY,IAAI,MAAM,GAAG;AAAA,QAC5B,MAAM,IAAI,2BACR,GAAG,6BAA6B,oBAAoB,WAAW,eACjE;AAAA,MACF;AAAA,MACA,IAAI,CAAC,mBAAmB,IAAI,UAAU,GAAG;AAAA,QACvC,MAAM,IAAI,2BACR,GAAG,qBAAqB,8CAA8C,iBACpE,eAAe,WAAW,YAC9B;AAAA,MACF;AAAA,MACA,MAAM,WAAW,WAAW,WAAW,KAAK,CAAC,cAAc,UAAU,OAAO,MAAM;AAAA,MAClF,IAAI,UAAU,SAAS,aAAa;AAAA,QAClC,MAAM,IAAI,2BACR,UAAU,0DAA0D,WAAW,gBAAgB,SACjG;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,YAAY,gBAAgB,IAAI,WAAW,YAAY;AAAA,IAC7D,IAAI,EAAE,aAAa,WAAW,aAAa;AAAA,MACzC,MAAM,IAAI,2BACR,GAAG,6BAA6B,wCAClC;AAAA,IACF;AAAA,IAEA,MAAM,UAAU,IAAI,IAAI,WAAW,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AAAA,IACzD,YAAY,QAAQ,OAAO,OAAO,QAAQ,WAAW,KAAK,GAAG;AAAA,MAC3D,IAAI,CAAC,QAAQ,IAAI,MAAM,GAAG;AAAA,QACxB,MAAM,IAAI,2BACR,GAAG,oBAAoB,4CAA4C,WAAW,eAChF;AAAA,MACF;AAAA,MACA,IAAI,GAAG,WAAW,QAAQ;AAAA,QACxB,MAAM,IAAI,2BACR,GAAG,gCAAgC,6CAA6C,GAAG,SACrF;AAAA,MACF;AAAA,MACA,MAAM,mBAAmB,GAAG;AAAA,MAC5B,MAAM,cAAc,GAAG;AAAA,MACvB,IAAI,oBAAoB,aAAa;AAAA,QACnC,MAAM,IAAI,2BACR,GAAG,oBAAoB,mEACzB;AAAA,MACF;AAAA,MACA,IAAI,CAAC,oBAAoB,CAAC,aAAa;AAAA,QACrC,MAAM,IAAI,2BACR,GAAG,oBAAoB,sDACzB;AAAA,MACF;AAAA,MACA,IAAI,oBAAoB,CAAC,YAAY,IAAI,gBAAgB,GAAG;AAAA,QAC1D,MAAM,IAAI,2BACR,GAAG,oBAAoB,4BAA4B,6CAA6C,WAAW,eAC7G;AAAA,MACF;AAAA,MACA,IAAI,oBAAoB,EAAE,oBAAoB,WAAW,aAAa;AAAA,QACpE,MAAM,IAAI,2BACR,GAAG,oBAAoB,4BAA4B,+CACrD;AAAA,MACF;AAAA,MACA,IAAI,eAAe,CAAC,mBAAmB,IAAI,WAAW,GAAG;AAAA,QACvD,MAAM,IAAI,2BACR,GAAG,oBAAoB,yBAAyB,8DAA8D,WAAW,YAC3H;AAAA,MACF;AAAA,MACA,IAAI,CAAC,gBAAgB,IAAI,GAAG,kBAAkB,GAAG;AAAA,QAC/C,MAAM,IAAI,2BACR,GAAG,oBAAoB,wBAAwB,GAAG,gCACpD;AAAA,MACF;AAAA,MACA,IAAI,CAAC,gBAAgB,IAAI,GAAG,kBAAkB,GAAG;AAAA,QAC/C,MAAM,IAAI,2BACR,GAAG,oBAAoB,wBAAwB,GAAG,6CACpD;AAAA,MACF;AAAA,MACA,MAAM,OAAO,WAAW,MAAM,KAAK,CAAC,cAAc,UAAU,OAAO,MAAM;AAAA,MACzE,IAAI,CAAC,SAAS,kBAAkB,KAAK,oBAAoB,GAAG,kBAAkB,GAAG;AAAA,QAC/E,MAAM,IAAI,2BACR,GAAG,oBAAoB,wBAAwB,GAAG,gEACpD;AAAA,MACF;AAAA,IACF;AAAA,IAEA,2BAA2B,KAAK;AAAA,MAC9B,YAAY;AAAA,MACZ;AAAA,MACA,WAAW,4BAA2B,YAAY,QAAQ;AAAA,IAC5D,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,cAAc,iBAAiB;AAAA,IACxC,MAAM,SAAS,eAAe,WAAW;AAAA,IACzC,MAAM,UAAU,aAAa,IAAI,WAAW,SAAS;AAAA,IACrD,IAAI,CAAC,SAAS;AAAA,MACZ,MAAM,IAAI,2BACR,GAAG,4BAA4B,WAAW,iBACxC,qEACJ;AAAA,IACF;AAAA,IAEA,IAAI,CAAC,gBAAgB,IAAI,WAAW,kBAAkB,GAAG;AAAA,MACvD,MAAM,IAAI,2BACR,GAAG,gCAAgC,WAAW,qBAChD;AAAA,IACF;AAAA,IACA,IAAI,CAAC,gBAAgB,IAAI,WAAW,kBAAkB,GAAG;AAAA,MACvD,MAAM,IAAI,2BACR,GAAG,gCAAgC,WAAW,qBAChD;AAAA,IACF;AAAA,IACA,MAAM,aAAa,gBAAgB,IAAI,WAAW,kBAAkB;AAAA,IACpE,MAAM,OAAO,WAAW,MAAM,KAAK,CAAC,cAAc,UAAU,OAAO,WAAW,MAAM;AAAA,IACpF,IAAI,CAAC,MAAM;AAAA,MACT,MAAM,IAAI,2BACR,GAAG,iBAAiB,WAAW,0CAA0C,WAAW,qBACtF;AAAA,IACF;AAAA,IACA,IAAI,CAAC,SAAS,kBAAkB,KAAK,oBAAoB,WAAW,kBAAkB,GAAG;AAAA,MACvF,MAAM,IAAI,2BACR,GAAG,wBAAwB,WAAW,oDAAoD,WAAW,SACvG;AAAA,IACF;AAAA,IACA,MAAM,qBAAqB,IAAI,IAAI,QAAQ,OAAO,QAAQ,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC;AAAA,IACtF,IAAI,CAAC,mBAAmB,IAAI,WAAW,WAAW,GAAG;AAAA,MACnD,MAAM,IAAI,2BACR,GAAG,yBAAyB,WAAW,oDACrC,eAAe,WAAW,YAC9B;AAAA,IACF;AAAA,IACA,IAAI,CAAC,mBAAmB,IAAI,WAAW,WAAW,GAAG;AAAA,MACnD,MAAM,IAAI,2BACR,GAAG,yBAAyB,WAAW,oDACrC,eAAe,WAAW,YAC9B;AAAA,IACF;AAAA,IACA,IAAI,CAAC,gBAAgB,IAAI,WAAW,kBAAkB,GAAG;AAAA,MACvD,MAAM,IAAI,2BACR,GAAG,wBAAwB,WAAW,6CACxC;AAAA,IACF;AAAA,IACA,IAAI,CAAC,gBAAgB,IAAI,WAAW,kBAAkB,GAAG;AAAA,MACvD,MAAM,IAAI,2BACR,GAAG,wBAAwB,WAAW,6CACxC;AAAA,IACF;AAAA,IAEA,yBAAyB,KAAK;AAAA,MAC5B,YAAY;AAAA,MACZ;AAAA,MACA,WAAW,4BAA2B,YAAY,QAAQ;AAAA,IAC5D,CAAC;AAAA,EACH;AAAA,EAEA,WAAW,cAAc,sBAAsB;AAAA,IAC7C,MAAM,SAAS,eAAe,WAAW;AAAA,IACzC,MAAM,UAAU,aAAa,IAAI,WAAW,SAAS;AAAA,IACrD,IAAI,CAAC,SAAS;AAAA,MACZ,MAAM,IAAI,2BACR,GAAG,4BAA4B,WAAW,iBACxC,qEACJ;AAAA,IACF;AAAA,IAEA,MAAM,aAAa,gBAAgB,IAAI,WAAW,YAAY;AAAA,IAC9D,IAAI,CAAC,YAAY;AAAA,MACf,MAAM,IAAI,2BACR,GAAG,gCAAgC,WAAW,eAChD;AAAA,IACF;AAAA,IAEA,MAAM,qBAAqB,IAAI,IAAI,QAAQ,OAAO,QAAQ,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC;AAAA,IACtF,yCACE,YACA,YACA,oBACA,SAAS,kBAAkB,GAC3B,MACF;AAAA,IACA,8BAA8B,KAAK;AAAA,MACjC,YAAY;AAAA,MACZ;AAAA,MACA,WAAW,4BAA2B,YAAY,QAAQ;AAAA,IAC5D,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,uBAAuB;AAAA,IAC3B,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,EACL;AAAA,EACA,6BAA4B,oBAAoB;AAAA,EAChD,OAAO;AAAA,IACL,mBAAmB;AAAA,IACnB,iBAAiB;AAAA,IACjB,sBAAsB;AAAA,EACxB;AAAA;AAGF,SAAS,0CAA0C,CAAC,UAA2C;AAAA,EAC7F,WAAW,cAAc,SAAS,mBAAmB,EAAE,OAAO,GAAG;AAAA,IAC/D,WAAW,YAAY,WAAW,YAAY;AAAA,MAC5C,IAAI,SAAS,SAAS,eAAe,SAAS,aAAa,MAAM;AAAA,QAC/D,MAAM,IAAI,2BACR,8BAA8B,WAAW,MAAM,SAAS,yBAC1D;AAAA,MACF;AAAA,IACF;AAAA,IACA,WAAW,QAAQ,WAAW,OAAO;AAAA,MACnC,WAAW,YAAY,KAAK,cAAc,CAAC,GAAG;AAAA,QAC5C,IAAI,SAAS,SAAS,aAAa;AAAA,UACjC,MAAM,IAAI,2BACR,yBAAyB,WAAW,MAAM,KAAK,MAAM,SAAS,gCAChE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;;;AC/iBF,SAAS,eAAc,CAAC,OAAe,OAAqB;AAAA,EAC1D,IAAI,CAAC,MAAM,KAAK,GAAG;AAAA,IACjB,MAAM,IAAI,2BAA0B,cAAc,0BAA0B;AAAA,EAC9E;AAAA;AAGF,SAAS,uBAAuB,CAAC,SAAkC;AAAA,EACjE,IAAI,CAAC,WAAW,QAAQ,SAAS,aAAa,OAAO,QAAQ,OAAO,UAAU;AAAA,IAC5E,MAAM,IAAI,2BAA0B,kDAAkD;AAAA,EACxF;AAAA,EACA,gBAAe,QAAQ,IAAI,YAAY;AAAA;AAGzC,SAAS,SAAQ,CAAC,OAAkD;AAAA,EAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA;AAwR5E,SAAS,sBAA0F,CACjG,SAGsC;AAAA,EACtC,MAAM,UAAgD,CAAC;AAAA,EACvD,YAAY,QAAQ,eAAe,OAAO,QAAQ,OAAO,GAAG;AAAA,IAC1D,IAAI,CAAC;AAAA,MAAY;AAAA,IACjB,QAAQ,UAAU,uBAAuB,UAAU,IAC/C,aACA,gBAAe,UAAkD;AAAA,EACvE;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,sBAAsB,CAAC,OAA+C;AAAA,EAC7E,OAAO,UAAS,KAAK,KAAK,OAAO,MAAM,WAAW;AAAA;AA2E7C,SAAS,iBAAgB,CAC9B,IACA,QAI2D;AAAA,EAC3D,IAAI,UAAU;AAAA,IAAQ,OAAO,oBAAoB,IAAI,MAAM;AAAA,EAC3D,IAAI,cAAc;AAAA,IAAQ,OAAO,yBAAyB,IAAI,MAAM;AAAA,EACpE,OAAO,0BAA0B,IAAI,MAAM;AAAA;AAG7C,SAAS,yBAA+D,CACtE,IACA,YACgD;AAAA,EAChD,gBAAe,IAAI,IAAI;AAAA,EAEvB,OAAO;AAAA,IACL,WAAqD,CACnD,SAC2D;AAAA,MAC3D,wBAAwB,OAAO;AAAA,MAC/B,MAAM,YAAY,QAAQ;AAAA,MAE1B,OAAO;AAAA,QACL,UAA8E,CAC5E,SACgD;AAAA,UAChD,MAAM,kBAAkB;AAAA,UACxB,wBAAwB,YAAY,eAAe;AAAA,UAEnD,OAAO,wBAAwB;AAAA,YAC7B;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA,OAAO,CAAC;AAAA,YACR,oBAAoB,EAAE,UAAU,WAAW;AAAA,UAC7C,CAAC;AAAA;AAAA,QAEH,MAEC,CACC,SAC+B;AAAA,UAC/B,MAAM,eAAe,qCACnB,YACA,OAKF;AAAA,UACA,OAAO;AAAA,YACL,MAAM;AAAA,YACN;AAAA,YACA,cAAc,WAAW;AAAA,YACzB;AAAA,YACA,eAAe,aAAa;AAAA,YAC5B,SAAS,aAAa;AAAA,YACtB,YAAY,aAAa;AAAA,UAC3B;AAAA;AAAA,MAEJ;AAAA;AAAA,EAEJ;AAAA;AAGF,SAAS,uBAGR,CAAC,OAOiD;AAAA,EACjD,MAAM,aAEF;AAAA,IACF,MAAM;AAAA,IACN,IAAI,MAAM;AAAA,IACV,cAAc,MAAM,WAAW;AAAA,IAC/B,WAAW,MAAM;AAAA,IACjB,YAAY,KAAK,MAAM,gBAAgB;AAAA,IACvC,OAAO,KAAK,MAAM,MAAM;AAAA,IACxB,oBAAoB,KAAK,MAAM,mBAAmB;AAAA,EACpD;AAAA,EAEA,OAAO,OAAO,OAAO,YAAY;AAAA,IAC/B,SAAS,CACP,aAGgD;AAAA,MAChD,MAAM,qBAAqB,uBAAuB,WAAW;AAAA,MAC7D,MAAM,iBAAiB,4BACrB,MAAM,YACN,oBACA,MAAM,eACR;AAAA,MACA,OAAO,wBAAwB,KAAK,OAAO,OAAO,eAAe,CAAC;AAAA;AAAA,IAEpE,gBAAgB,CACd,YACgD;AAAA,MAChD,2BAA2B,UAAU;AAAA,MACrC,OAAO,wBAAwB;AAAA,WAC1B;AAAA,QACH,oBAAoB;AAAA,MACtB,CAAC;AAAA;AAAA,EAEL,CAAC;AAAA;AAGH,SAAS,0BAA0B,CAAC,YAAgD;AAAA,EAClF,IAAI,WAAW,aAAa;AAAA,IAAY;AAAA,EACxC,gBAAe,WAAW,iBAAiB,wBAAwB;AAAA;AAkCrE,SAAS,wBAA6E,CACpF,IACA,eACkD;AAAA,EAClD,gBAAe,IAAI,IAAI;AAAA,EACvB,oCAAoC,aAAa;AAAA,EAEjD,OAAO;AAAA,IACL,WAAqD,CACnD,SAC6D;AAAA,MAC7D,wBAAwB,OAAO;AAAA,MAC/B,MAAM,YAAY,QAAQ;AAAA,MAE1B,OAAO;AAAA,QACL,MAAwF,CACtF,SAC+B;AAAA,UAC/B,MAAM,eAAe,2BAA2B,OAAO;AAAA,UACvD,OAAO;AAAA,YACL,MAAM;AAAA,YACN;AAAA,YACA,cAAc,cAAc;AAAA,YAC5B;AAAA,YACA,eAAe,aAAa;AAAA,YAC5B,SAAS,aAAa;AAAA,YACtB,YAAY;AAAA,eACT,cAAc,KAAK;AAAA,gBAClB,YAAY,aAAa;AAAA,mBACrB,aAAa,SAAS,YAAY,EAAE,WAAW,aAAa,KAAK,IAAI,CAAC;AAAA,cAC5E;AAAA,YACF;AAAA,UACF;AAAA;AAAA,MAEJ;AAAA;AAAA,EAEJ;AAAA;AAGF,SAAS,mCAAmC,CAAC,eAAoC;AAAA,EAC/E,IAAI,cAAc,SAAS,SAAS,aAAa;AAAA,IAC/C,MAAM,IAAI,2BACR,wBAAwB,cAAc,gBAAgB,cAAc,gCACtE;AAAA,EACF;AAAA;AAGF,SAAS,0BAA0B,CAAC,SAUlC;AAAA,EACA,MAAM,cAAc,IAAI,IAAI,CAAC,YAAY,MAAM,SAAS,MAAM,CAAC;AAAA,EAC/D,WAAW,OAAO,OAAO,KAAK,OAAO,GAAG;AAAA,IACtC,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG;AAAA,MACzB,MAAM,IAAI,2BACR,4DAA4D,OAC9D;AAAA,IACF;AAAA,EACF;AAAA,EAEA,IAAI,QAAQ,aAAa,WAAW;AAAA,IAClC,MAAM,IAAI,2BAA0B,uDAAuD;AAAA,EAC7F;AAAA,EACA,IAAI,QAAQ,OAAO,WAAW;AAAA,IAC5B,MAAM,IAAI,2BAA0B,iDAAiD;AAAA,EACvF;AAAA,EACA,IAAI,QAAQ,UAAU,WAAW;AAAA,IAC/B,MAAM,IAAI,2BAA0B,oDAAoD;AAAA,EAC1F;AAAA,EAEA,gBAAe,QAAQ,UAAU,gBAAgB;AAAA,EACjD,gBAAe,QAAQ,IAAI,UAAU;AAAA,EACrC,gBAAe,QAAQ,OAAO,aAAa;AAAA,EAC3C,IAAI,QAAQ,SAAS,WAAW;AAAA,IAC9B,gBAAe,QAAQ,MAAM,YAAY;AAAA,EAC3C;AAAA,EAEA,OAAO;AAAA,IACL,UAAU,QAAQ;AAAA,IAClB,IAAI,QAAQ;AAAA,IACZ,OAAO,QAAQ;AAAA,OACX,QAAQ,SAAS,YAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC7D;AAAA;AAGF,SAAS,oCAAoC,CAC3C,YACA,SASA;AAAA,EACA,MAAM,cAAc,IAAI,IAAI,CAAC,YAAY,MAAM,YAAY,CAAC;AAAA,EAC5D,WAAW,OAAO,OAAO,KAAK,OAAO,GAAG;AAAA,IACtC,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG;AAAA,MACzB,MAAM,IAAI,2BACR,4DAA4D,OAC9D;AAAA,IACF;AAAA,EACF;AAAA,EAEA,IAAI,QAAQ,aAAa,WAAW;AAAA,IAClC,MAAM,IAAI,2BAA0B,uDAAuD;AAAA,EAC7F;AAAA,EACA,IAAI,QAAQ,OAAO,WAAW;AAAA,IAC5B,MAAM,IAAI,2BAA0B,iDAAiD;AAAA,EACvF;AAAA,EACA,IAAI,QAAQ,eAAe,WAAW;AAAA,IACpC,MAAM,IAAI,2BAA0B,yDAAyD;AAAA,EAC/F;AAAA,EACA,IAAI,CAAC,UAAS,QAAQ,UAAU,GAAG;AAAA,IACjC,MAAM,IAAI,2BACR,kEACF;AAAA,EACF;AAAA,EAEA,gBAAe,QAAQ,UAAU,gBAAgB;AAAA,EACjD,gBAAe,QAAQ,IAAI,UAAU;AAAA,EAErC,MAAM,kBAAkB,OAAO,QAAQ,QAAQ,UAAU;AAAA,EACzD,IAAI,gBAAgB,WAAW,GAAG;AAAA,IAChC,MAAM,IAAI,2BACR,oEACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,IAAI,IAAI,WAAW,WAAW,IAAI,CAAC,aAAa,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;AAAA,EAC/F,MAAM,aAAiE,CAAC;AAAA,EACxE,YAAY,YAAY,UAAU,iBAAiB;AAAA,IACjD,MAAM,WAAW,eAAe,IAAI,UAAU;AAAA,IAC9C,IAAI,CAAC,UAAU;AAAA,MACb,MAAM,IAAI,2BACR,aAAa,8CAA8C,WAAW,MACxE;AAAA,IACF;AAAA,IACA,IAAI,SAAS,SAAS,aAAa;AAAA,MACjC,MAAM,IAAI,2BACR,wBAAwB,WAAW,MAAM,wCAC3C;AAAA,IACF;AAAA,IACA,WAAW,cAAc,8BAA8B,YAAY,KAAK;AAAA,EAC1E;AAAA,EAEA,OAAO,EAAE,UAAU,QAAQ,UAAU,IAAI,QAAQ,IAAI,WAAW;AAAA;AAGlE,SAAS,6BAA6B,CACpC,YACA,OACoC;AAAA,EACpC,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,gBAAe,OAAO,aAAa,yBAAyB;AAAA,IAC5D,OAAO,EAAE,YAAY,MAAM;AAAA,EAC7B;AAAA,EACA,IAAI,CAAC,UAAS,KAAK,GAAG;AAAA,IACpB,MAAM,IAAI,2BACR,kCAAkC,4DACpC;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,IAAI,IAAI,CAAC,SAAS,MAAM,CAAC;AAAA,EAC7C,WAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AAAA,IACpC,IAAI,CAAC,YAAY,IAAI,GAAG,GAAG;AAAA,MACzB,MAAM,IAAI,2BACR,kCAAkC,qCAAqC,OACzE;AAAA,IACF;AAAA,EACF;AAAA,EACA,IAAI,OAAO,MAAM,UAAU,UAAU;AAAA,IACnC,MAAM,IAAI,2BACR,kCAAkC,qCACpC;AAAA,EACF;AAAA,EACA,IAAI,OAAO,MAAM,SAAS,UAAU;AAAA,IAClC,MAAM,IAAI,2BACR,kCAAkC,oCACpC;AAAA,EACF;AAAA,EACA,gBAAe,MAAM,OAAO,aAAa,yBAAyB;AAAA,EAClE,gBAAe,MAAM,MAAM,aAAa,wBAAwB;AAAA,EAChE,OAAO,EAAE,YAAY,MAAM,OAAO,WAAW,MAAM,KAAK;AAAA;AA2CnD,SAAS,eAGf,CAAC,OAMuB;AAAA,EACvB,6BAA6B,MAAM,IAAI;AAAA,EAEvC,IAAI,MAAM,gBAAgB;AAAA,IACxB,OAAO;AAAA,MACL,QAAQ,MAAM,KAAK;AAAA,MACnB,kBAAkB,MAAM,eAAe;AAAA,MACvC,oBAAoB,MAAM,OAAO;AAAA,IACnC;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,gBAAgB,WAAW;AAAA,IACnC,MAAM,IAAI,2BAA0B,sCAAsC;AAAA,EAC5E;AAAA,EACA,gBAAe,MAAM,aAAa,cAAc;AAAA,EAChD,OAAO;AAAA,IACL,QAAQ,MAAM,KAAK;AAAA,IACnB,aAAa,MAAM;AAAA,IACnB,oBAAoB,MAAM,OAAO;AAAA,EACnC;AAAA;AA+BF,SAAS,mBAIR,CACC,IACA,WAC6B;AAAA,EAC7B,gBAAe,IAAI,IAAI;AAAA,EACvB,6BAA6B,SAAS;AAAA,EAEtC,OAAO;AAAA,IACL,WAAqD,CACnD,SACsC;AAAA,MACtC,wBAAwB,OAAO;AAAA,MAC/B,MAAM,YAAY,QAAQ;AAAA,MAE1B,OAAO;AAAA,QACL,WAAW,CACT,YACuC;AAAA,UACvC,gBAAe,YAAY,cAAc;AAAA,UAEzC,OAAO;AAAA,YACL,WAAW,CACT,kBAC0B;AAAA,cAC1B,gBAAe,kBAAkB,cAAc;AAAA,cAE/C,OAAO;AAAA,gBACL,MAAM;AAAA,gBACN;AAAA,gBACA,QAAQ,UAAU;AAAA,gBAClB,oBAAoB,UAAU;AAAA,gBAC9B,oBAAoB,UAAU;AAAA,gBAC9B;AAAA,gBACA,aAAa;AAAA,gBACb,aAAa;AAAA,cACf;AAAA;AAAA,UAEJ;AAAA;AAAA,MAEJ;AAAA;AAAA,EAEJ;AAAA;AAMK,SAAS,6BAA4B,CAAC,OAAqD;AAAA,EAChG,IAAI,CAAC,UAAS,KAAK;AAAA,IAAG,OAAO;AAAA,EAC7B,OACE,MAAM,SAAS,gCACf,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,iBAAiB,YAC9B,OAAO,MAAM,cAAc,YAC3B,UAAS,MAAM,UAAU,KACzB,UAAS,MAAM,KAAK,KACpB,+BAA+B,MAAM,kBAAkB;AAAA;AAI3D,SAAS,8BAA8B,CAAC,OAAyB;AAAA,EAC/D,IAAI,UAAU;AAAA,IAAW,OAAO;AAAA,EAChC,IAAI,CAAC,UAAS,KAAK,KAAK,OAAO,MAAM,aAAa;AAAA,IAAU,OAAO;AAAA,EACnE,IAAI,MAAM,aAAa;AAAA,IAAY,OAAO,MAAM,oBAAoB;AAAA,EACpE,OAAO,MAAM,aAAa,gBAAgB,OAAO,MAAM,oBAAoB;AAAA;AAItE,SAAS,2BAA0B,CAAC,OAAmD;AAAA,EAC5F,IAAI,CAAC,UAAS,KAAK;AAAA,IAAG,OAAO;AAAA,EAC7B,OACE,MAAM,SAAS,8BACf,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,WAAW,YACxB,OAAO,MAAM,uBAAuB,YACpC,OAAO,MAAM,uBAAuB,YACpC,OAAO,MAAM,cAAc,YAC3B,OAAO,MAAM,gBAAgB,YAC7B,OAAO,MAAM,gBAAgB;AAAA;AAK1B,SAAS,gCAA+B,CAC7C,OACwC;AAAA,EACxC,IAAI,CAAC,UAAS,KAAK;AAAA,IAAG,OAAO;AAAA,EAC7B,OACE,MAAM,SAAS,mCACf,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,iBAAiB,YAC9B,OAAO,MAAM,cAAc,YAC3B,OAAO,MAAM,kBAAkB,YAC/B,OAAO,MAAM,YAAY,YACzB,gCAAgC,MAAM,UAAU;AAAA;AAIpD,SAAS,+BAA+B,CAAC,OAAyB;AAAA,EAChE,IAAI,CAAC,UAAS,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,WAAW;AAAA,IAAG,OAAO;AAAA,EAChE,OAAO,OAAO,OAAO,KAAK,EAAE,MAC1B,CAAC,YACC,UAAS,OAAO,KAChB,OAAO,QAAQ,eAAe,aAC7B,QAAQ,cAAc,aAAa,OAAO,QAAQ,cAAc,SACrE;AAAA;AAIK,SAAS,uBAAsB,CAAC,OAA+C;AAAA,EACpF,OACE,8BAA6B,KAAK,KAClC,4BAA2B,KAAK,KAChC,iCAAgC,KAAK;AAAA;AAclC,SAAS,mBAAkB,CAAC,YAAoD;AAAA,EACrF,OAAO,WAAW,SAAS,6BACvB;AAAA,IACE,oBAAoB,WAAW;AAAA,IAC/B,oBAAoB,WAAW;AAAA,EACjC,IACA,EAAE,cAAc,WAAW,aAAa;AAAA;;;ACr+BvC,SAAS,iBAAgB,CAC9B,eACA,KACS;AAAA,EACT,IAAI,CAAC,eAAe;AAAA,IAClB,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,CAAC,WAAU,eAAe,EAAE,MAAM,gBAAgB,UAAU,IAAI,SAAS,CAAC,GAAG;AAAA,IAC/E,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,IAAI,QAAQ,SAAS,WACxB,OACA,WAAU,eAAe;AAAA,IACvB,MAAM;AAAA,IACN,cAAc,IAAI,QAAQ;AAAA,EAC5B,CAAC;AAAA;AAGA,SAAS,mBAAkB,CAChC,eACA,KACS;AAAA,EACT,OACE,CAAC,iBAAiB,WAAU,eAAe,EAAE,MAAM,gBAAgB,YAAY,IAAI,WAAW,CAAC;AAAA;AAI5F,SAAS,4BAA2B,CACzC,eACA,cACS;AAAA,EACT,OACE,CAAC,iBACD,WAAU,eAAe,EAAE,MAAM,gBAAgB,YAAY,aAAa,WAAW,CAAC;AAAA;AAInF,SAAS,mBAAkB,CAChC,eACA,KACS;AAAA,EACT,OACE,CAAC,iBAAiB,WAAU,eAAe,EAAE,MAAM,gBAAgB,YAAY,IAAI,WAAW,CAAC;AAAA;AAK5F,SAAS,qBAAoB,CAClC,eACA,QACS;AAAA,EACT,IAAI,CAAC;AAAA,IAAe,OAAO;AAAA,EAC3B,MAAM,UAAU,CAAC,iBACf,WAAU,eAAe,EAAE,MAAM,eAAe,aAAa,CAAC;AAAA,EAChE,IAAI,wBAAwB,QAAQ;AAAA,IAClC,OAAO,QAAQ,OAAO,kBAAkB,KAAK,QAAQ,OAAO,kBAAkB;AAAA,EAChF;AAAA,EACA,OAAO,QAAQ,OAAO,YAAY;AAAA;AAI7B,SAAS,kBAAiB,CAC/B,eACA,YACS;AAAA,EACT,OAAO,sBAAqB,eAAe,oBAAmB,UAAU,CAAC;AAAA;;ACzCpE,SAAS,gBAAe,GAAe;AAAA,EAC5C,OAAO,eAAe;AAAA;",
-  "debugId": "081671DAEDB8F65F64756E2164756E21",
-  "names": []
-}