@sixb/core 0.1.18 → 0.1.20

package/dist/chunk-tffvfy6s.js.map

@@ -1,15 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/actions/builders/define-action.ts", "../src/shared/params/builders.ts", "../src/actions/commit-edits.ts", "../src/actions/read-facade.ts", "../src/actions/registry.ts", "../src/actions/validators.ts"],
-  "sourcesContent": [
-    "import type { ObjectTypeWithPropertyTokens } from \"../../ontology/tokens\"\nimport { ActionDefinitionError, effectsWithoutEditsMessage } from \"../errors\"\nimport type {\n  ActionBuilder,\n  ActionEditsHandler,\n  ActionEffectsHandler,\n  ActionParamsConfig,\n  ActionValidator,\n  ActionWritebackHandler,\n  GlobalActionDefinition,\n  GlobalActionEditsHandler,\n  GlobalActionEffectsHandler,\n  GlobalActionPhaseBuilder,\n  GlobalActionValidator,\n  GlobalActionWritebackHandler,\n  ObjectActionDefinition,\n  ObjectActionPhaseBuilder,\n} from \"../types\"\nimport { assertNonEmpty } from \"../validation\"\n\ntype ActionOptions = {\n  description?: string\n}\n\nexport function defineAction<const TId extends string>(\n  id: TId,\n  options?: ActionOptions\n): ActionBuilder<TId> {\n  assertNonEmpty(id, \"id\")\n\n  return asPublicActionType<ActionBuilder<TId>>(createActionBuilder(id, options))\n}\n\nfunction createActionBuilder(id: string, options?: ActionOptions) {\n  const builder = {\n    params(params: ActionParamsConfig) {\n      return createGlobalActionPhaseBuilder(id, params, options)\n    },\n    on(objectType: ObjectTypeWithPropertyTokens) {\n      assertNonEmpty(objectType.id, \"target id\")\n      return createObjectActionParamsBuilder(id, objectType, options)\n    },\n  }\n\n  return builder\n}\n\nfunction createGlobalActionPhaseBuilder(\n  id: string,\n  params: ActionParamsConfig,\n  options?: ActionOptions\n): GlobalActionPhaseBuilder<string, ActionParamsConfig> {\n  const validators: GlobalActionValidator<Record<string, unknown>>[] = []\n\n  const builder = {\n    validate(validator: GlobalActionValidator<Record<string, unknown>>) {\n      validators.push(validator)\n      return builder\n    },\n    writeback(handler: GlobalActionWritebackHandler<Record<string, unknown>, unknown>) {\n      return createGlobalDefinition({\n        id,\n        params,\n        description: options?.description,\n        validators,\n        writeback: handler,\n      })\n    },\n    edits(handler: GlobalActionEditsHandler<Record<string, unknown>, undefined>) {\n      return createGlobalDefinition({\n        id,\n        params,\n        description: options?.description,\n        validators,\n        edits: handler,\n      })\n    },\n  }\n\n  return asPublicActionType<GlobalActionPhaseBuilder<string, ActionParamsConfig>>(builder)\n}\n\nfunction createObjectActionParamsBuilder(\n  id: string,\n  objectType: ObjectTypeWithPropertyTokens,\n  options?: ActionOptions\n) {\n  return {\n    params(params: ActionParamsConfig) {\n      return createObjectActionPhaseBuilder(id, objectType, params, options)\n    },\n  }\n}\n\nfunction createObjectActionPhaseBuilder(\n  id: string,\n  objectType: ObjectTypeWithPropertyTokens,\n  params: ActionParamsConfig,\n  options?: ActionOptions\n): ObjectActionPhaseBuilder<string, ObjectTypeWithPropertyTokens, ActionParamsConfig> {\n  const validators: ActionValidator<ObjectTypeWithPropertyTokens, Record<string, unknown>>[] = []\n\n  const builder = {\n    validate(validator: ActionValidator<ObjectTypeWithPropertyTokens, Record<string, unknown>>) {\n      validators.push(validator)\n      return builder\n    },\n    writeback(\n      handler: ActionWritebackHandler<\n        ObjectTypeWithPropertyTokens,\n        Record<string, unknown>,\n        unknown\n      >\n    ) {\n      return createObjectDefinition({\n        id,\n        objectType,\n        params,\n        description: options?.description,\n        validators,\n        writeback: handler,\n      })\n    },\n    edits(\n      handler: ActionEditsHandler<ObjectTypeWithPropertyTokens, Record<string, unknown>, undefined>\n    ) {\n      return createObjectDefinition({\n        id,\n        objectType,\n        params,\n        description: options?.description,\n        validators,\n        edits: handler,\n      })\n    },\n  }\n\n  return asPublicActionType<\n    ObjectActionPhaseBuilder<string, ObjectTypeWithPropertyTokens, ActionParamsConfig>\n  >(builder)\n}\n\nfunction createGlobalDefinition(input: {\n  readonly id: string\n  readonly params: ActionParamsConfig\n  readonly description?: string\n  readonly validators: readonly unknown[]\n  readonly writeback?: unknown\n  readonly edits?: unknown\n  readonly effects?: unknown\n}): GlobalActionDefinition {\n  const definition = {\n    kind: \"action\",\n    id: input.id,\n    binding: { kind: \"global\" },\n    params: input.params,\n    phases: {\n      validate: [...input.validators],\n      ...(input.writeback ? { writeback: input.writeback } : {}),\n      ...(input.edits ? { edits: input.edits } : {}),\n      ...(input.effects ? { effects: input.effects } : {}),\n    },\n    ...(input.description !== undefined ? { description: input.description } : {}),\n  }\n\n  return asPublicActionType<GlobalActionDefinition>(\n    Object.assign(definition, {\n      edits(handler: GlobalActionEditsHandler<Record<string, unknown>, unknown>) {\n        return createGlobalDefinition({\n          ...input,\n          edits: handler,\n        })\n      },\n      effects(handler: GlobalActionEffectsHandler<Record<string, unknown>, unknown>) {\n        if (!input.edits) {\n          throw new ActionDefinitionError(effectsWithoutEditsMessage(input.id))\n        }\n        return createGlobalDefinition({\n          ...input,\n          effects: handler,\n        })\n      },\n    })\n  )\n}\n\nfunction createObjectDefinition(input: {\n  readonly id: string\n  readonly objectType: ObjectTypeWithPropertyTokens\n  readonly params: ActionParamsConfig\n  readonly description?: string\n  readonly validators: readonly unknown[]\n  readonly writeback?: unknown\n  readonly edits?: unknown\n  readonly effects?: unknown\n}): ObjectActionDefinition {\n  const definition = {\n    kind: \"action\",\n    id: input.id,\n    binding: { kind: \"object\", objectType: input.objectType },\n    params: input.params,\n    phases: {\n      validate: [...input.validators],\n      ...(input.writeback ? { writeback: input.writeback } : {}),\n      ...(input.edits ? { edits: input.edits } : {}),\n      ...(input.effects ? { effects: input.effects } : {}),\n    },\n    ...(input.description !== undefined ? { description: input.description } : {}),\n  }\n\n  return asPublicActionType<ObjectActionDefinition>(\n    Object.assign(definition, {\n      edits(\n        handler: ActionEditsHandler<ObjectTypeWithPropertyTokens, Record<string, unknown>, unknown>\n      ) {\n        return createObjectDefinition({\n          ...input,\n          edits: handler,\n        })\n      },\n      effects(\n        handler: ActionEffectsHandler<\n          ObjectTypeWithPropertyTokens,\n          Record<string, unknown>,\n          unknown\n        >\n      ) {\n        if (!input.edits) {\n          throw new ActionDefinitionError(effectsWithoutEditsMessage(input.id))\n        }\n        return createObjectDefinition({\n          ...input,\n          effects: handler,\n        })\n      },\n    })\n  )\n}\n\n// Runtime builders are plain objects; public builder types carry phase-order inference.\nfunction asPublicActionType<TPublic>(value: unknown): TPublic {\n  return value as TPublic\n}\n",
-    "import type { SchemaOrRef } from \"../../ontology\"\nimport type { QuantitativeTypeId } from \"../../ontology/units\"\nimport type { ParamConfig } from \"./types\"\n\nexport interface ParamOptions {\n  readonly description?: string\n  readonly semanticType?: QuantitativeTypeId\n  readonly nullable?: boolean\n}\n\ntype FieldFromOptions<TOptions, TKey extends string, TFallback> =\n  TOptions extends Record<TKey, infer TValue>\n    ? { [K in TKey]: TValue }\n    : { [K in TKey]?: TFallback }\n\ntype ParamResult<\n  TSchema extends SchemaOrRef,\n  TRequired extends boolean,\n  TOptions extends ParamOptions | undefined,\n> = {\n  schema: TSchema\n  required: TRequired\n} & FieldFromOptions<TOptions, \"description\", string> &\n  FieldFromOptions<TOptions, \"semanticType\", QuantitativeTypeId> &\n  FieldFromOptions<TOptions, \"nullable\", boolean>\n\n/** Declare one required parameter. */\nexport function param<\n  const TSchema extends SchemaOrRef,\n  const TOptions extends ParamOptions | undefined = undefined,\n>(schema: TSchema, options?: TOptions): ParamResult<TSchema, true, TOptions> {\n  const result: ParamConfig & { required: true } = {\n    schema,\n    required: true,\n    ...(options?.description !== undefined ? { description: options.description } : {}),\n    ...(options?.semanticType !== undefined ? { semanticType: options.semanticType } : {}),\n    ...(options?.nullable !== undefined ? { nullable: options.nullable } : {}),\n  }\n  return result as ParamResult<TSchema, true, TOptions>\n}\n\n/** Derive an optional parameter without changing its schema or metadata. */\nexport function optional<const TParam extends ParamConfig>(\n  paramConfig: TParam\n): Omit<TParam, \"required\"> & { readonly required: false } {\n  return {\n    ...paramConfig,\n    required: false,\n  }\n}\n",
-    "import type { EditBatch } from \"../edits\"\nimport { lowerEditBatch } from \"../edits\"\nimport type {\n  EditCommitResult,\n  EffectiveLinkChange,\n  EffectiveObjectChange,\n  ExpectedLinkRevision,\n  ExpectedLinkScopeRevision,\n  ExpectedObjectRevision,\n  OntologyOperationOutcome,\n} from \"../materializer\"\nimport type { OntologyMutationRuntime } from \"../runtime/ontology-mutations\"\nimport type { Storage } from \"../storage/types\"\nimport { ActionEditCommitError } from \"./errors\"\n\n/** Exact reads an Action handler depended on, protected by row-level CAS at commit time. */\nexport interface ActionReadDependencies {\n  readonly objects: readonly ExpectedObjectRevision[]\n  readonly links: readonly ExpectedLinkRevision[]\n  readonly linkScopes: readonly ExpectedLinkScopeRevision[]\n}\n\nconst NO_READ_DEPENDENCIES: ActionReadDependencies = { objects: [], links: [], linkScopes: [] }\n\nexport interface CommitActionEditsInput {\n  readonly mutations: Pick<OntologyMutationRuntime, \"commitEdits\">\n  readonly projectId: string\n  readonly runId: string\n  readonly actionId: string\n  readonly batch: EditBatch\n  readonly dependencies?: ActionReadDependencies\n}\n\n/** The authoritative ontology commit an Action run produced. */\nexport interface ActionEditCommitResult {\n  readonly commitId: string\n  readonly created: boolean\n  readonly eventCount: number\n  readonly outcomes: readonly OntologyOperationOutcome[]\n  readonly changes: {\n    readonly objects: readonly EffectiveObjectChange[]\n    readonly links: readonly EffectiveLinkChange[]\n  }\n  readonly committedAt: Date\n}\n\nexport interface FindActionEditCommitInput {\n  readonly storage: Pick<Storage, \"ontology\">\n  readonly projectId: string\n  readonly runId: string\n}\n\n/**\n * Commits one Action run's recorded edits as a single atomic ontology commit.\n *\n * The batch lowers to canonical Materializer operations and the Materializer validates the Action run\n * identity, applies managed authority, resolves effective state, writes the authoritative commit, and\n * inserts outbox facts in one transaction. Repeating the call for the same run replays that commit;\n * a divergent request for the same run is a typed idempotency conflict.\n */\nexport async function commitActionEdits(\n  input: CommitActionEditsInput\n): Promise<ActionEditCommitResult> {\n  const dependencies = input.dependencies ?? NO_READ_DEPENDENCIES\n  const commit = await input.mutations.commitEdits({\n    mode: \"atomic\",\n    source: { kind: \"action\", actionId: input.actionId, runId: input.runId },\n    operations: lowerEditBatch(input.batch),\n    expectedObjects: dependencies.objects,\n    expectedLinks: dependencies.links,\n    expectedLinkScopes: dependencies.linkScopes,\n  })\n  return toActionEditCommitResult(commit)\n}\n\n/**\n * Resolves the authoritative commit an Action run already produced, if any.\n *\n * Resume uses the exact `{ actionRunId }` origin instead of rerunning handlers, so a redelivered run\n * returns the persisted result without recomputing an idempotency hash.\n */\nexport async function findActionEditCommit(\n  input: FindActionEditCommitInput\n): Promise<ActionEditCommitResult | null> {\n  const record = await input.storage.ontology.commits.getByOrigin({\n    projectId: input.projectId,\n    origin: { kind: \"action\", actionRunId: input.runId },\n  })\n  if (!record) return null\n  if (record.result.kind !== \"edit\") {\n    throw new ActionEditCommitError(\n      `[Sixb] Action run '${input.runId}' resolved a '${record.result.kind}' commit instead of an edit commit.`\n    )\n  }\n  return toActionEditCommitResult({ ...record.result, created: false })\n}\n\nfunction toActionEditCommitResult(commit: EditCommitResult): ActionEditCommitResult {\n  return {\n    commitId: commit.commitId,\n    created: commit.created,\n    eventCount: commit.eventCount,\n    outcomes: commit.outcomes,\n    changes: commit.changes,\n    committedAt: new Date(commit.committedAt),\n  }\n}\n",
-    "import { linkRefKey, linkScopeKey, objectRefKey } from \"../materialization/refs\"\nimport type {\n  EffectiveLinkSnapshot,\n  ExpectedLinkRevision,\n  ExpectedLinkScopeRevision,\n  ExpectedObjectRevision,\n  OntologyLinkRef,\n  OntologyObjectRef,\n} from \"../materializer\"\nimport { createLinkScopeFingerprint } from \"../materializer\"\nimport { decorateObjectQueryExecutor } from \"../objects/sdk/query-builder\"\nimport type { ObjectQueryExecutor } from \"../objects/sdk/query-executor\"\nimport { OntologyValidationError } from \"../ontology/errors\"\nimport type { ObjectTypeWithPropertyTokens } from \"../ontology/tokens\"\nimport {\n  assertPropertyTokenBelongsToObjectType,\n  assertTelemetryProperty,\n} from \"../ontology/validation\"\nimport { RuntimeError } from \"../runtime/errors\"\nimport type { ObjectReader, ObjectReadSet } from \"../runtime/types\"\nimport type {\n  ExpandedLinkValue,\n  ExpandedObjectRow,\n  ObjectLinkRow,\n  ObjectRow,\n  TimeseriesHistoryBatchInput,\n  TimeseriesHistoryBatchResult,\n} from \"../storage\"\nimport type { ActionReadDependencies } from \"./commit-edits\"\nimport type {\n  ActionReadFacade,\n  ActionTelemetryHistorySeriesInput,\n  ActionTelemetryReadFacade,\n} from \"./types\"\n\n/** Runtime leaves used by the Action telemetry read adapter. */\nexport interface ActionTelemetryReadSource {\n  readonly resolveObjectType: (objectTypeId: string) => ObjectTypeWithPropertyTokens\n  readonly getHistoryBatch: (\n    input: Omit<TimeseriesHistoryBatchInput, \"projectId\">\n  ) => Promise<readonly TimeseriesHistoryBatchResult[]>\n}\n\n/**\n * Records the exact state an Action handler observed while reading.\n *\n * A handler that reads one dependency twice keeps the first observation: the commit must fail when\n * current state no longer matches what the decision was made against, and the later read may already\n * reflect the handler's own intent. Objects returned by `list()` and `query()` are fenced like\n * concrete reads, but query membership is not yet: an object that starts matching a query after the\n * read, and aggregate results (`count()`, `exists()`, `facets()`), stay unfenced. Telemetry history\n * and file content are also call-level snapshots, not edit dependencies.\n */\nexport class ActionReadRecorder {\n  private readonly objects = new Map<string, ExpectedObjectRevision>()\n  private readonly links = new Map<string, ExpectedLinkRevision>()\n  private readonly linkScopes = new Map<string, ExpectedLinkScopeRevision>()\n\n  /** Records a concrete object read, including exact absence. */\n  observeObject(ref: OntologyObjectRef, row: ObjectRow | null): void {\n    const key = objectRefKey(ref)\n    if (this.objects.has(key)) return\n    if (!row) {\n      this.objects.set(key, { ref, exists: false })\n      return\n    }\n    // Rows without materializer provenance predate the commit ledger and cannot be fenced.\n    if (row.lastCommitId === undefined) return\n    this.objects.set(key, {\n      ref,\n      exists: true,\n      version: row.version,\n      lastCommitId: row.lastCommitId,\n    })\n  }\n\n  /**\n   * Records every object a listing or query returned, including the objects its expansions attached.\n   *\n   * Rows are keyed by their own type: a traversal or subtype query returns objects of a type other\n   * than the one the query started from, and the commit checks each row under its exact identity.\n   */\n  observeObjectRows(rows: readonly ObjectRow[]): void {\n    for (const row of rows) {\n      this.observeObject({ objectTypeId: row.objectTypeId, primaryId: row.primaryId }, row)\n      for (const value of Object.values(row.links ?? {})) {\n        this.observeObjectRows(expandedRows(value))\n      }\n    }\n  }\n\n  /**\n   * Records the complete `(source, linkId)` scopes a link listing observed.\n   *\n   * `linkIds` names every scope the read covered so an empty scope is recorded as an empty\n   * fingerprint rather than being silently omitted.\n   */\n  observeLinkScopes(\n    source: OntologyObjectRef,\n    linkIds: readonly string[],\n    rows: readonly ObjectLinkRow[]\n  ): void {\n    const snapshotsByLinkId = new Map<string, EffectiveLinkSnapshot[]>()\n    for (const linkId of linkIds) snapshotsByLinkId.set(linkId, [])\n    /** Scopes holding a row that cannot be fenced, so no expectation may be recorded for them. */\n    const unfenceable = new Set<string>()\n\n    for (const row of rows) {\n      if (row.sourceTypeId !== source.objectTypeId || row.sourceId !== source.primaryId) continue\n      const snapshots = snapshotsByLinkId.get(row.linkId)\n      if (!snapshots) continue\n      const snapshot = toLinkSnapshot(row)\n      if (!snapshot) {\n        // Same rule `observeObject` applies to rows without materializer provenance: record no\n        // expectation at all. A fingerprint computed over the remaining rows would describe a scope\n        // the store can never reproduce, turning every such read into a guaranteed conflict.\n        unfenceable.add(row.linkId)\n        continue\n      }\n      snapshots.push(snapshot)\n      this.observeLink(snapshot.ref, snapshot)\n    }\n\n    for (const [linkId, snapshots] of snapshotsByLinkId) {\n      if (unfenceable.has(linkId)) continue\n      const key = linkScopeKey(source, linkId)\n      if (this.linkScopes.has(key)) continue\n      this.linkScopes.set(key, {\n        source,\n        linkId,\n        fingerprint: createLinkScopeFingerprint(snapshots),\n      })\n    }\n  }\n\n  /** Records a concrete link read, including exact absence. */\n  observeLink(ref: OntologyLinkRef, snapshot: EffectiveLinkSnapshot | null): void {\n    const key = linkRefKey(ref)\n    if (this.links.has(key)) return\n    this.links.set(\n      key,\n      snapshot ? { ref, exists: true, lastCommitId: snapshot.lastCommitId } : { ref, exists: false }\n    )\n  }\n\n  dependencies(): ActionReadDependencies {\n    return {\n      objects: [...this.objects.values()],\n      links: [...this.links.values()],\n      linkScopes: [...this.linkScopes.values()],\n    }\n  }\n}\n\nexport interface ActionReadFacadeOptions {\n  /** Records what the handler observed, so the commit can be fenced against it. */\n  readonly recorder: ActionReadRecorder\n  /**\n   * Every link the object type carries, inherited links included.\n   *\n   * Inheritance is resolved by the Ontology registry, not by the imported definition, so an\n   * `extends` type would otherwise report only its own links and drop inherited ones from the\n   * recorded scopes.\n   */\n  readonly resolveLinkIds: (objectTypeId: string) => readonly string[]\n  /** Canonical authorized telemetry history leaf. Omitted only by isolated facade consumers. */\n  readonly telemetry?: ActionTelemetryReadSource\n}\n\n/** Exposes `reader`'s object reads to an Action handler; with `options`, each read is recorded. */\nexport function createActionReadFacade(\n  reader: ObjectReader,\n  options?: ActionReadFacadeOptions\n): ActionReadFacade {\n  return {\n    telemetry: createActionTelemetryReadFacade(options?.telemetry),\n    objects<const TObjectType extends ObjectTypeWithPropertyTokens>(objectType: TObjectType) {\n      const objectSet = reader.objects(objectType)\n      return options ? recordObjectReads(objectType, objectSet, options) : objectSet\n    },\n  }\n}\n\nfunction createActionTelemetryReadFacade(\n  source: ActionTelemetryReadSource | undefined\n): ActionTelemetryReadFacade {\n  const facade = {\n    async historyBatch(input: {\n      readonly series: readonly ActionTelemetryHistorySeriesInput[]\n      readonly from?: Date\n      readonly to?: Date\n      readonly limitPerSeries?: number\n      readonly order?: \"asc\" | \"desc\"\n    }) {\n      if (!source) {\n        throw new RuntimeError(\n          \"[Sixb] Action telemetry history requires a configured telemetry read source.\"\n        )\n      }\n      if (input.series.length === 0) {\n        return []\n      }\n\n      const requestedSeries = input.series.map((entry) => {\n        const objectType = source.resolveObjectType(entry.property.objectTypeId)\n        assertPropertyTokenBelongsToObjectType(objectType, entry.property)\n        const registeredProperty = objectType.properties.find(\n          (property) => property.id === entry.property.id\n        )\n        if (!registeredProperty) {\n          throw new OntologyValidationError(\n            `[Sixb] Unknown property '${entry.property.id}' for object type '${objectType.id}'`\n          )\n        }\n        assertTelemetryProperty(registeredProperty)\n        return {\n          objectTypeId: objectType.id,\n          objectId: entry.objectId,\n          propertyId: registeredProperty.id,\n        }\n      })\n\n      const results = await source.getHistoryBatch({\n        series: requestedSeries,\n        ...(input.from !== undefined ? { from: input.from } : {}),\n        ...(input.to !== undefined ? { to: input.to } : {}),\n        ...(input.limitPerSeries !== undefined ? { limitPerSeries: input.limitPerSeries } : {}),\n        ...(input.order !== undefined ? { order: input.order } : {}),\n      })\n      assertTelemetryBatchResultMatchesRequest(requestedSeries, results)\n\n      return input.series.map((entry, index) => ({\n        objectId: entry.objectId,\n        property: entry.property,\n        points: results[index].points.map((point) => ({\n          value: point.value,\n          at: point.at,\n          ...(point.unit !== undefined ? { unit: point.unit } : {}),\n        })),\n      }))\n    },\n  }\n\n  // Cast needed at the generic token boundary: the implementation deliberately manipulates raw\n  // provider values while the public facade maps every tuple position back to its property token.\n  return facade as unknown as ActionTelemetryReadFacade\n}\n\nfunction assertTelemetryBatchResultMatchesRequest(\n  requested: readonly {\n    readonly objectTypeId: string\n    readonly objectId: string\n    readonly propertyId: string\n  }[],\n  results: readonly TimeseriesHistoryBatchResult[]\n): void {\n  if (results.length !== requested.length) {\n    throw new RuntimeError(\n      `[Sixb] Telemetry history provider returned ${results.length} batch results for ${requested.length} requested series.`\n    )\n  }\n\n  for (let index = 0; index < requested.length; index += 1) {\n    const expected = requested[index]\n    const actual = results[index]\n    if (\n      actual.objectTypeId !== expected.objectTypeId ||\n      actual.objectId !== expected.objectId ||\n      actual.propertyId !== expected.propertyId\n    ) {\n      throw new RuntimeError(\n        `[Sixb] Telemetry history provider returned an unexpected series at batch index ${index}.`\n      )\n    }\n  }\n}\n\nfunction recordObjectReads<TObjectType extends ObjectTypeWithPropertyTokens>(\n  objectType: TObjectType,\n  objectSet: ObjectReadSet<TObjectType>,\n  options: ActionReadFacadeOptions\n): ObjectReadSet<TObjectType> {\n  const { recorder } = options\n  const ref = (primaryId: string): OntologyObjectRef => ({\n    objectTypeId: objectType.id,\n    primaryId,\n  })\n\n  return {\n    async get(id) {\n      const row = await objectSet.get(id)\n      recorder.observeObject(ref(id), row && storageRow(row))\n      return row\n    },\n    query() {\n      // Recording at the executor covers every terminal of every refinement, present and future.\n      return decorateObjectQueryExecutor(objectSet.query(), (executor) =>\n        recordingExecutor(executor, recorder)\n      )\n    },\n    async list(input) {\n      const result = await objectSet.list(input)\n      recorder.observeObjectRows(result.objects.map(storageRow))\n      return result\n    },\n    byId(id) {\n      const handle = objectSet.byId(id)\n      return {\n        async get() {\n          const row = await handle.get()\n          recorder.observeObject(ref(id), row && storageRow(row))\n          return row\n        },\n        async listLinks(link) {\n          const rows = await handle.listLinks(link)\n          recorder.observeLinkScopes(\n            ref(id),\n            link ? [link.id] : options.resolveLinkIds(objectType.id),\n            rows\n          )\n          return rows\n        },\n        file: handle.file,\n      }\n    },\n  }\n}\n\n/**\n * Delegates to `executor` and records the objects its row queries return.\n *\n * Aggregates (`count()`, `exists()`, `facets()`) return no rows to fence; protecting their result\n * needs query-level dependencies.\n */\nfunction recordingExecutor(\n  executor: ObjectQueryExecutor,\n  recorder: ActionReadRecorder\n): ObjectQueryExecutor {\n  return {\n    async list(query, listOptions) {\n      const result = await executor.list(query, listOptions)\n      recorder.observeObjectRows(result.objects.map(storageRow))\n      return result\n    },\n    count: (query) => executor.count(query),\n    exists: (query) => executor.exists(query),\n    facets: (query, facets) => executor.facets(query, facets),\n    validate: executor.validate?.bind(executor),\n    explain: executor.explain?.bind(executor),\n  }\n}\n\n/**\n * Runtime reads return storage rows; the SDK row types only leave out the commit fields a fence\n * needs.\n */\nfunction storageRow(row: object): ObjectRow {\n  return row as ObjectRow\n}\n\nfunction expandedRows(value: ExpandedLinkValue): readonly ObjectRow[] {\n  if (value === null) return []\n  return isExpandedRowList(value) ? value : [value]\n}\n\n// `Array.isArray` does not narrow a readonly array out of a union.\nfunction isExpandedRowList(value: ExpandedLinkValue): value is readonly ExpandedObjectRow[] {\n  return Array.isArray(value)\n}\n\nfunction toLinkSnapshot(row: ObjectLinkRow): EffectiveLinkSnapshot | null {\n  // Rows without materializer provenance predate the commit ledger and cannot be fenced.\n  if (row.lastCommitId === undefined) return null\n  return {\n    ref: {\n      source: { objectTypeId: row.sourceTypeId, primaryId: row.sourceId },\n      linkId: row.linkId,\n      target: { objectTypeId: row.targetTypeId, primaryId: row.targetId },\n    },\n    ...(row.properties !== undefined\n      ? { properties: row.properties as EffectiveLinkSnapshot[\"properties\"] }\n      : {}),\n    createdAt: row.createdAt.toISOString(),\n    updatedAt: row.updatedAt.toISOString(),\n    lastCommitId: row.lastCommitId,\n  }\n}\n",
-    "import type { ObjectType, OntologyDefinitionCatalog } from \"../ontology\"\nimport {\n  ActionDefinitionError,\n  effectsWithoutEditsMessage,\n  missingActionMutationMessage,\n} from \"./errors\"\nimport type { ActionDefinition, ObjectActionDefinition } from \"./types\"\nimport { isObjectActionDefinition } from \"./validation\"\n\nexport interface ActionDefinitionCatalog {\n  list(): readonly ActionDefinition[]\n  getById(id: string): ActionDefinition | null\n  listGlobal(): readonly ActionDefinition[]\n  listForType(type: ObjectType): readonly ObjectActionDefinition[]\n}\n\nexport interface ActionRegistryOptions {\n  readonly actions: readonly ActionDefinition[]\n  readonly ontology: OntologyDefinitionCatalog\n}\n\nexport class ActionRegistry implements ActionDefinitionCatalog {\n  private readonly byId = new Map<string, ActionDefinition>()\n  private readonly globalActions: ActionDefinition[] = []\n  private readonly byTargetId = new Map<string, ObjectActionDefinition[]>()\n\n  private readonly ontology: OntologyDefinitionCatalog\n\n  constructor(options: ActionRegistryOptions) {\n    this.ontology = options.ontology\n\n    for (const action of options.actions) {\n      const previous = this.byId.get(action.id)\n      if (previous) {\n        const chainDuplicate = this.getInheritanceDuplicate(action, previous)\n        if (chainDuplicate) {\n          throw new ActionDefinitionError(\n            `Duplicate action id \"${action.id}\" in inheritance chain of \"${chainDuplicate.objectTypeId}\": defined on both \"${chainDuplicate.firstTargetId}\" and \"${chainDuplicate.secondTargetId}\".`\n          )\n        }\n\n        throw new ActionDefinitionError(\n          `Duplicate action id \"${action.id}\" declared in multiple files.`\n        )\n      }\n\n      this.validatePhases(action)\n      this.byId.set(action.id, action)\n\n      if (!isObjectActionDefinition(action)) {\n        this.globalActions.push(action)\n        continue\n      }\n\n      const objectType = action.binding.objectType\n      const target = this.ontology.getObjectTypeById(objectType.id)\n      if (!target) {\n        throw new ActionDefinitionError(\n          `Action \"${action.id}\" targets unknown object type \"${objectType.id}\". Add the object type to ontology before registering the action.`\n        )\n      }\n\n      const bucket = this.byTargetId.get(objectType.id) ?? []\n      bucket.push(action)\n      this.byTargetId.set(objectType.id, bucket)\n    }\n  }\n\n  private validatePhases(action: ActionDefinition): void {\n    const hasWriteback = action.phases.writeback !== undefined\n    const hasEdits = action.phases.edits !== undefined\n    const hasEffects = action.phases.effects !== undefined\n\n    if (!hasWriteback && !hasEdits) {\n      throw new ActionDefinitionError(missingActionMutationMessage(action.id))\n    }\n\n    if (hasEffects && !hasEdits) {\n      throw new ActionDefinitionError(effectsWithoutEditsMessage(action.id))\n    }\n  }\n\n  list(): readonly ActionDefinition[] {\n    return [...this.byId.values()]\n  }\n\n  getById(id: string): ActionDefinition | null {\n    return this.byId.get(id) ?? null\n  }\n\n  listGlobal(): readonly ActionDefinition[] {\n    return [...this.globalActions]\n  }\n\n  listForType(type: ObjectType): readonly ObjectActionDefinition[] {\n    this.ontology.resolveObjectType(type.id)\n\n    const seen = new Set<string>()\n    const result: ObjectActionDefinition[] = []\n\n    for (const ancestor of this.ontology.listAncestorChain(type)) {\n      for (const action of this.byTargetId.get(ancestor.id) ?? []) {\n        if (seen.has(action.id)) continue\n        seen.add(action.id)\n        result.push(action)\n      }\n    }\n\n    return result\n  }\n\n  private getInheritanceDuplicate(\n    action: ActionDefinition,\n    previous: ActionDefinition\n  ): { objectTypeId: string; firstTargetId: string; secondTargetId: string } | null {\n    if (!isObjectActionDefinition(action) || !isObjectActionDefinition(previous)) {\n      return null\n    }\n\n    const actionObjectType = action.binding.objectType\n    const previousObjectType = previous.binding.objectType\n\n    if (actionObjectType.id === previousObjectType.id) {\n      return null\n    }\n\n    const actionChain = this.ontology.listAncestorChain(actionObjectType)\n    if (actionChain.some((ancestor) => ancestor.id === previousObjectType.id)) {\n      return {\n        objectTypeId: actionObjectType.id,\n        firstTargetId: previousObjectType.id,\n        secondTargetId: actionObjectType.id,\n      }\n    }\n\n    const previousChain = this.ontology.listAncestorChain(previousObjectType)\n    if (previousChain.some((ancestor) => ancestor.id === actionObjectType.id)) {\n      return {\n        objectTypeId: previousObjectType.id,\n        firstTargetId: actionObjectType.id,\n        secondTargetId: previousObjectType.id,\n      }\n    }\n\n    return null\n  }\n}\n",
-    "import { ActionValidationError } from \"../objects/action/errors\"\nimport type { ActionDefinition, ActionSubject, ActionTargetObject } from \"./types\"\nimport { isObjectActionDefinition } from \"./validation\"\n\ntype RuntimePhaseHandler = (ctx: unknown) => unknown | Promise<unknown>\n\nexport async function runActionValidators<TBaseContext extends object>(input: {\n  readonly action: ActionDefinition\n  readonly subject: ActionSubject\n  readonly baseContext: TBaseContext\n  readonly target?: ActionTargetObject | null\n}): Promise<void> {\n  const validators = input.action.phases.validate as readonly RuntimePhaseHandler[]\n  if (validators.length === 0) {\n    return\n  }\n\n  if (!isObjectActionDefinition(input.action)) {\n    for (const validator of validators) {\n      const result = await validator(input.baseContext)\n      if (isValidatorErrorResult(result)) {\n        throw new ActionValidationError(result.error, {\n          actionId: input.action.id,\n          subject: input.subject,\n        })\n      }\n    }\n    return\n  }\n\n  if (!input.target) {\n    throw new Error(`[Sixb] Action '${input.action.id}' requires an object target.`)\n  }\n\n  for (const validator of validators) {\n    const result = await validator({\n      ...input.baseContext,\n      target: input.target,\n    })\n    if (isValidatorErrorResult(result)) {\n      throw new ActionValidationError(result.error, {\n        actionId: input.action.id,\n        subject: input.subject,\n      })\n    }\n  }\n}\n\nfunction isValidatorErrorResult(value: unknown): value is { readonly error: string } {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    \"error\" in value &&\n    typeof value.error === \"string\"\n  )\n}\n"
-  ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBO,SAAS,aAAsC,CACpD,IACA,SACoB;AAAA,EACpB,gBAAe,IAAI,IAAI;AAAA,EAEvB,OAAO,mBAAuC,oBAAoB,IAAI,OAAO,CAAC;AAAA;AAGhF,SAAS,mBAAmB,CAAC,IAAY,SAAyB;AAAA,EAChE,MAAM,UAAU;AAAA,IACd,MAAM,CAAC,QAA4B;AAAA,MACjC,OAAO,+BAA+B,IAAI,QAAQ,OAAO;AAAA;AAAA,IAE3D,EAAE,CAAC,YAA0C;AAAA,MAC3C,gBAAe,WAAW,IAAI,WAAW;AAAA,MACzC,OAAO,gCAAgC,IAAI,YAAY,OAAO;AAAA;AAAA,EAElE;AAAA,EAEA,OAAO;AAAA;AAGT,SAAS,8BAA8B,CACrC,IACA,QACA,SACsD;AAAA,EACtD,MAAM,aAA+D,CAAC;AAAA,EAEtE,MAAM,UAAU;AAAA,IACd,QAAQ,CAAC,WAA2D;AAAA,MAClE,WAAW,KAAK,SAAS;AAAA,MACzB,OAAO;AAAA;AAAA,IAET,SAAS,CAAC,SAAyE;AAAA,MACjF,OAAO,uBAAuB;AAAA,QAC5B;AAAA,QACA;AAAA,QACA,aAAa,SAAS;AAAA,QACtB;AAAA,QACA,WAAW;AAAA,MACb,CAAC;AAAA;AAAA,IAEH,KAAK,CAAC,SAAuE;AAAA,MAC3E,OAAO,uBAAuB;AAAA,QAC5B;AAAA,QACA;AAAA,QACA,aAAa,SAAS;AAAA,QACtB;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAAA;AAAA,EAEL;AAAA,EAEA,OAAO,mBAAyE,OAAO;AAAA;AAGzF,SAAS,+BAA+B,CACtC,IACA,YACA,SACA;AAAA,EACA,OAAO;AAAA,IACL,MAAM,CAAC,QAA4B;AAAA,MACjC,OAAO,+BAA+B,IAAI,YAAY,QAAQ,OAAO;AAAA;AAAA,EAEzE;AAAA;AAGF,SAAS,8BAA8B,CACrC,IACA,YACA,QACA,SACoF;AAAA,EACpF,MAAM,aAAuF,CAAC;AAAA,EAE9F,MAAM,UAAU;AAAA,IACd,QAAQ,CAAC,WAAmF;AAAA,MAC1F,WAAW,KAAK,SAAS;AAAA,MACzB,OAAO;AAAA;AAAA,IAET,SAAS,CACP,SAKA;AAAA,MACA,OAAO,uBAAuB;AAAA,QAC5B;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,SAAS;AAAA,QACtB;AAAA,QACA,WAAW;AAAA,MACb,CAAC;AAAA;AAAA,IAEH,KAAK,CACH,SACA;AAAA,MACA,OAAO,uBAAuB;AAAA,QAC5B;AAAA,QACA;AAAA,QACA;AAAA,QACA,aAAa,SAAS;AAAA,QACtB;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAAA;AAAA,EAEL;AAAA,EAEA,OAAO,mBAEL,OAAO;AAAA;AAGX,SAAS,sBAAsB,CAAC,OAQL;AAAA,EACzB,MAAM,aAAa;AAAA,IACjB,MAAM;AAAA,IACN,IAAI,MAAM;AAAA,IACV,SAAS,EAAE,MAAM,SAAS;AAAA,IAC1B,QAAQ,MAAM;AAAA,IACd,QAAQ;AAAA,MACN,UAAU,CAAC,GAAG,MAAM,UAAU;AAAA,SAC1B,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,SACpD,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,SACxC,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IACpD;AAAA,OACI,MAAM,gBAAgB,YAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,EAC9E;AAAA,EAEA,OAAO,mBACL,OAAO,OAAO,YAAY;AAAA,IACxB,KAAK,CAAC,SAAqE;AAAA,MACzE,OAAO,uBAAuB;AAAA,WACzB;AAAA,QACH,OAAO;AAAA,MACT,CAAC;AAAA;AAAA,IAEH,OAAO,CAAC,SAAuE;AAAA,MAC7E,IAAI,CAAC,MAAM,OAAO;AAAA,QAChB,MAAM,IAAI,uBAAsB,2BAA2B,MAAM,EAAE,CAAC;AAAA,MACtE;AAAA,MACA,OAAO,uBAAuB;AAAA,WACzB;AAAA,QACH,SAAS;AAAA,MACX,CAAC;AAAA;AAAA,EAEL,CAAC,CACH;AAAA;AAGF,SAAS,sBAAsB,CAAC,OASL;AAAA,EACzB,MAAM,aAAa;AAAA,IACjB,MAAM;AAAA,IACN,IAAI,MAAM;AAAA,IACV,SAAS,EAAE,MAAM,UAAU,YAAY,MAAM,WAAW;AAAA,IACxD,QAAQ,MAAM;AAAA,IACd,QAAQ;AAAA,MACN,UAAU,CAAC,GAAG,MAAM,UAAU;AAAA,SAC1B,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,SACpD,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,SACxC,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IACpD;AAAA,OACI,MAAM,gBAAgB,YAAY,EAAE,aAAa,MAAM,YAAY,IAAI,CAAC;AAAA,EAC9E;AAAA,EAEA,OAAO,mBACL,OAAO,OAAO,YAAY;AAAA,IACxB,KAAK,CACH,SACA;AAAA,MACA,OAAO,uBAAuB;AAAA,WACzB;AAAA,QACH,OAAO;AAAA,MACT,CAAC;AAAA;AAAA,IAEH,OAAO,CACL,SAKA;AAAA,MACA,IAAI,CAAC,MAAM,OAAO;AAAA,QAChB,MAAM,IAAI,uBAAsB,2BAA2B,MAAM,EAAE,CAAC;AAAA,MACtE;AAAA,MACA,OAAO,uBAAuB;AAAA,WACzB;AAAA,QACH,SAAS;AAAA,MACX,CAAC;AAAA;AAAA,EAEL,CAAC,CACH;AAAA;AAIF,SAAS,kBAA2B,CAAC,OAAyB;AAAA,EAC5D,OAAO;AAAA;;ACtNF,SAAS,MAGf,CAAC,QAAiB,SAA0D;AAAA,EAC3E,MAAM,SAA2C;AAAA,IAC/C;AAAA,IACA,UAAU;AAAA,OACN,SAAS,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,OAC7E,SAAS,iBAAiB,YAAY,EAAE,cAAc,QAAQ,aAAa,IAAI,CAAC;AAAA,OAChF,SAAS,aAAa,YAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,EAC1E;AAAA,EACA,OAAO;AAAA;AAIF,SAAS,SAA0C,CACxD,aACyD;AAAA,EACzD,OAAO;AAAA,OACF;AAAA,IACH,UAAU;AAAA,EACZ;AAAA;;AC1BF,IAAM,uBAA+C,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,YAAY,CAAC,EAAE;AAsC9F,eAAsB,kBAAiB,CACrC,OACiC;AAAA,EACjC,MAAM,eAAe,MAAM,gBAAgB;AAAA,EAC3C,MAAM,SAAS,MAAM,MAAM,UAAU,YAAY;AAAA,IAC/C,MAAM;AAAA,IACN,QAAQ,EAAE,MAAM,UAAU,UAAU,MAAM,UAAU,OAAO,MAAM,MAAM;AAAA,IACvE,YAAY,gBAAe,MAAM,KAAK;AAAA,IACtC,iBAAiB,aAAa;AAAA,IAC9B,eAAe,aAAa;AAAA,IAC5B,oBAAoB,aAAa;AAAA,EACnC,CAAC;AAAA,EACD,OAAO,yBAAyB,MAAM;AAAA;AASxC,eAAsB,qBAAoB,CACxC,OACwC;AAAA,EACxC,MAAM,SAAS,MAAM,MAAM,QAAQ,SAAS,QAAQ,YAAY;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,QAAQ,EAAE,MAAM,UAAU,aAAa,MAAM,MAAM;AAAA,EACrD,CAAC;AAAA,EACD,IAAI,CAAC;AAAA,IAAQ,OAAO;AAAA,EACpB,IAAI,OAAO,OAAO,SAAS,QAAQ;AAAA,IACjC,MAAM,IAAI,uBACR,sBAAsB,MAAM,sBAAsB,OAAO,OAAO,yCAClE;AAAA,EACF;AAAA,EACA,OAAO,yBAAyB,KAAK,OAAO,QAAQ,SAAS,MAAM,CAAC;AAAA;AAGtE,SAAS,wBAAwB,CAAC,QAAkD;AAAA,EAClF,OAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,SAAS,OAAO;AAAA,IAChB,YAAY,OAAO;AAAA,IACnB,UAAU,OAAO;AAAA,IACjB,SAAS,OAAO;AAAA,IAChB,aAAa,IAAI,KAAK,OAAO,WAAW;AAAA,EAC1C;AAAA;;ACpDK,MAAM,oBAAmB;AAAA,EACb,UAAU,IAAI;AAAA,EACd,QAAQ,IAAI;AAAA,EACZ,aAAa,IAAI;AAAA,EAGlC,aAAa,CAAC,KAAwB,KAA6B;AAAA,IACjE,MAAM,MAAM,cAAa,GAAG;AAAA,IAC5B,IAAI,KAAK,QAAQ,IAAI,GAAG;AAAA,MAAG;AAAA,IAC3B,IAAI,CAAC,KAAK;AAAA,MACR,KAAK,QAAQ,IAAI,KAAK,EAAE,KAAK,QAAQ,MAAM,CAAC;AAAA,MAC5C;AAAA,IACF;AAAA,IAEA,IAAI,IAAI,iBAAiB;AAAA,MAAW;AAAA,IACpC,KAAK,QAAQ,IAAI,KAAK;AAAA,MACpB;AAAA,MACA,QAAQ;AAAA,MACR,SAAS,IAAI;AAAA,MACb,cAAc,IAAI;AAAA,IACpB,CAAC;AAAA;AAAA,EASH,iBAAiB,CAAC,MAAkC;AAAA,IAClD,WAAW,OAAO,MAAM;AAAA,MACtB,KAAK,cAAc,EAAE,cAAc,IAAI,cAAc,WAAW,IAAI,UAAU,GAAG,GAAG;AAAA,MACpF,WAAW,SAAS,OAAO,OAAO,IAAI,SAAS,CAAC,CAAC,GAAG;AAAA,QAClD,KAAK,kBAAkB,aAAa,KAAK,CAAC;AAAA,MAC5C;AAAA,IACF;AAAA;AAAA,EASF,iBAAiB,CACf,QACA,SACA,MACM;AAAA,IACN,MAAM,oBAAoB,IAAI;AAAA,IAC9B,WAAW,UAAU;AAAA,MAAS,kBAAkB,IAAI,QAAQ,CAAC,CAAC;AAAA,IAE9D,MAAM,cAAc,IAAI;AAAA,IAExB,WAAW,OAAO,MAAM;AAAA,MACtB,IAAI,IAAI,iBAAiB,OAAO,gBAAgB,IAAI,aAAa,OAAO;AAAA,QAAW;AAAA,MACnF,MAAM,YAAY,kBAAkB,IAAI,IAAI,MAAM;AAAA,MAClD,IAAI,CAAC;AAAA,QAAW;AAAA,MAChB,MAAM,WAAW,eAAe,GAAG;AAAA,MACnC,IAAI,CAAC,UAAU;AAAA,QAIb,YAAY,IAAI,IAAI,MAAM;AAAA,QAC1B;AAAA,MACF;AAAA,MACA,UAAU,KAAK,QAAQ;AAAA,MACvB,KAAK,YAAY,SAAS,KAAK,QAAQ;AAAA,IACzC;AAAA,IAEA,YAAY,QAAQ,cAAc,mBAAmB;AAAA,MACnD,IAAI,YAAY,IAAI,MAAM;AAAA,QAAG;AAAA,MAC7B,MAAM,MAAM,aAAa,QAAQ,MAAM;AAAA,MACvC,IAAI,KAAK,WAAW,IAAI,GAAG;AAAA,QAAG;AAAA,MAC9B,KAAK,WAAW,IAAI,KAAK;AAAA,QACvB;AAAA,QACA;AAAA,QACA,aAAa,4BAA2B,SAAS;AAAA,MACnD,CAAC;AAAA,IACH;AAAA;AAAA,EAIF,WAAW,CAAC,KAAsB,UAA8C;AAAA,IAC9E,MAAM,MAAM,YAAW,GAAG;AAAA,IAC1B,IAAI,KAAK,MAAM,IAAI,GAAG;AAAA,MAAG;AAAA,IACzB,KAAK,MAAM,IACT,KACA,WAAW,EAAE,KAAK,QAAQ,MAAM,cAAc,SAAS,aAAa,IAAI,EAAE,KAAK,QAAQ,MAAM,CAC/F;AAAA;AAAA,EAGF,YAAY,GAA2B;AAAA,IACrC,OAAO;AAAA,MACL,SAAS,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC;AAAA,MAClC,OAAO,CAAC,GAAG,KAAK,MAAM,OAAO,CAAC;AAAA,MAC9B,YAAY,CAAC,GAAG,KAAK,WAAW,OAAO,CAAC;AAAA,IAC1C;AAAA;AAEJ;AAkBO,SAAS,uBAAsB,CACpC,QACA,SACkB;AAAA,EAClB,OAAO;AAAA,IACL,WAAW,gCAAgC,SAAS,SAAS;AAAA,IAC7D,OAA+D,CAAC,YAAyB;AAAA,MACvF,MAAM,YAAY,OAAO,QAAQ,UAAU;AAAA,MAC3C,OAAO,UAAU,kBAAkB,YAAY,WAAW,OAAO,IAAI;AAAA;AAAA,EAEzE;AAAA;AAGF,SAAS,+BAA+B,CACtC,QAC2B;AAAA,EAC3B,MAAM,SAAS;AAAA,SACP,aAAY,CAAC,OAMhB;AAAA,MACD,IAAI,CAAC,QAAQ;AAAA,QACX,MAAM,IAAI,cACR,8EACF;AAAA,MACF;AAAA,MACA,IAAI,MAAM,OAAO,WAAW,GAAG;AAAA,QAC7B,OAAO,CAAC;AAAA,MACV;AAAA,MAEA,MAAM,kBAAkB,MAAM,OAAO,IAAI,CAAC,UAAU;AAAA,QAClD,MAAM,aAAa,OAAO,kBAAkB,MAAM,SAAS,YAAY;AAAA,QACvE,wCAAuC,YAAY,MAAM,QAAQ;AAAA,QACjE,MAAM,qBAAqB,WAAW,WAAW,KAC/C,CAAC,aAAa,SAAS,OAAO,MAAM,SAAS,EAC/C;AAAA,QACA,IAAI,CAAC,oBAAoB;AAAA,UACvB,MAAM,IAAI,yBACR,4BAA4B,MAAM,SAAS,wBAAwB,WAAW,KAChF;AAAA,QACF;AAAA,QACA,yBAAwB,kBAAkB;AAAA,QAC1C,OAAO;AAAA,UACL,cAAc,WAAW;AAAA,UACzB,UAAU,MAAM;AAAA,UAChB,YAAY,mBAAmB;AAAA,QACjC;AAAA,OACD;AAAA,MAED,MAAM,UAAU,MAAM,OAAO,gBAAgB;AAAA,QAC3C,QAAQ;AAAA,WACJ,MAAM,SAAS,YAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,WACnD,MAAM,OAAO,YAAY,EAAE,IAAI,MAAM,GAAG,IAAI,CAAC;AAAA,WAC7C,MAAM,mBAAmB,YAAY,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;AAAA,WACjF,MAAM,UAAU,YAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC5D,CAAC;AAAA,MACD,yCAAyC,iBAAiB,OAAO;AAAA,MAEjE,OAAO,MAAM,OAAO,IAAI,CAAC,OAAO,WAAW;AAAA,QACzC,UAAU,MAAM;AAAA,QAChB,UAAU,MAAM;AAAA,QAChB,QAAQ,QAAQ,OAAO,OAAO,IAAI,CAAC,WAAW;AAAA,UAC5C,OAAO,MAAM;AAAA,UACb,IAAI,MAAM;AAAA,aACN,MAAM,SAAS,YAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,QACzD,EAAE;AAAA,MACJ,EAAE;AAAA;AAAA,EAEN;AAAA,EAIA,OAAO;AAAA;AAGT,SAAS,wCAAwC,CAC/C,WAKA,SACM;AAAA,EACN,IAAI,QAAQ,WAAW,UAAU,QAAQ;AAAA,IACvC,MAAM,IAAI,cACR,8CAA8C,QAAQ,4BAA4B,UAAU,0BAC9F;AAAA,EACF;AAAA,EAEA,SAAS,QAAQ,EAAG,QAAQ,UAAU,QAAQ,SAAS,GAAG;AAAA,IACxD,MAAM,WAAW,UAAU;AAAA,IAC3B,MAAM,SAAS,QAAQ;AAAA,IACvB,IACE,OAAO,iBAAiB,SAAS,gBACjC,OAAO,aAAa,SAAS,YAC7B,OAAO,eAAe,SAAS,YAC/B;AAAA,MACA,MAAM,IAAI,cACR,kFAAkF,QACpF;AAAA,IACF;AAAA,EACF;AAAA;AAGF,SAAS,iBAAmE,CAC1E,YACA,WACA,SAC4B;AAAA,EAC5B,QAAQ,aAAa;AAAA,EACrB,MAAM,MAAM,CAAC,eAA0C;AAAA,IACrD,cAAc,WAAW;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,SACC,IAAG,CAAC,IAAI;AAAA,MACZ,MAAM,MAAM,MAAM,UAAU,IAAI,EAAE;AAAA,MAClC,SAAS,cAAc,IAAI,EAAE,GAAG,OAAO,WAAW,GAAG,CAAC;AAAA,MACtD,OAAO;AAAA;AAAA,IAET,KAAK,GAAG;AAAA,MAEN,OAAO,4BAA4B,UAAU,MAAM,GAAG,CAAC,aACrD,kBAAkB,UAAU,QAAQ,CACtC;AAAA;AAAA,SAEI,KAAI,CAAC,OAAO;AAAA,MAChB,MAAM,SAAS,MAAM,UAAU,KAAK,KAAK;AAAA,MACzC,SAAS,kBAAkB,OAAO,QAAQ,IAAI,UAAU,CAAC;AAAA,MACzD,OAAO;AAAA;AAAA,IAET,IAAI,CAAC,IAAI;AAAA,MACP,MAAM,SAAS,UAAU,KAAK,EAAE;AAAA,MAChC,OAAO;AAAA,aACC,IAAG,GAAG;AAAA,UACV,MAAM,MAAM,MAAM,OAAO,IAAI;AAAA,UAC7B,SAAS,cAAc,IAAI,EAAE,GAAG,OAAO,WAAW,GAAG,CAAC;AAAA,UACtD,OAAO;AAAA;AAAA,aAEH,UAAS,CAAC,MAAM;AAAA,UACpB,MAAM,OAAO,MAAM,OAAO,UAAU,IAAI;AAAA,UACxC,SAAS,kBACP,IAAI,EAAE,GACN,OAAO,CAAC,KAAK,EAAE,IAAI,QAAQ,eAAe,WAAW,EAAE,GACvD,IACF;AAAA,UACA,OAAO;AAAA;AAAA,QAET,MAAM,OAAO;AAAA,MACf;AAAA;AAAA,EAEJ;AAAA;AASF,SAAS,iBAAiB,CACxB,UACA,UACqB;AAAA,EACrB,OAAO;AAAA,SACC,KAAI,CAAC,OAAO,aAAa;AAAA,MAC7B,MAAM,SAAS,MAAM,SAAS,KAAK,OAAO,WAAW;AAAA,MACrD,SAAS,kBAAkB,OAAO,QAAQ,IAAI,UAAU,CAAC;AAAA,MACzD,OAAO;AAAA;AAAA,IAET,OAAO,CAAC,UAAU,SAAS,MAAM,KAAK;AAAA,IACtC,QAAQ,CAAC,UAAU,SAAS,OAAO,KAAK;AAAA,IACxC,QAAQ,CAAC,OAAO,WAAW,SAAS,OAAO,OAAO,MAAM;AAAA,IACxD,UAAU,SAAS,UAAU,KAAK,QAAQ;AAAA,IAC1C,SAAS,SAAS,SAAS,KAAK,QAAQ;AAAA,EAC1C;AAAA;AAOF,SAAS,UAAU,CAAC,KAAwB;AAAA,EAC1C,OAAO;AAAA;AAGT,SAAS,YAAY,CAAC,OAAgD;AAAA,EACpE,IAAI,UAAU;AAAA,IAAM,OAAO,CAAC;AAAA,EAC5B,OAAO,kBAAkB,KAAK,IAAI,QAAQ,CAAC,KAAK;AAAA;AAIlD,SAAS,iBAAiB,CAAC,OAAiE;AAAA,EAC1F,OAAO,MAAM,QAAQ,KAAK;AAAA;AAG5B,SAAS,cAAc,CAAC,KAAkD;AAAA,EAExE,IAAI,IAAI,iBAAiB;AAAA,IAAW,OAAO;AAAA,EAC3C,OAAO;AAAA,IACL,KAAK;AAAA,MACH,QAAQ,EAAE,cAAc,IAAI,cAAc,WAAW,IAAI,SAAS;AAAA,MAClE,QAAQ,IAAI;AAAA,MACZ,QAAQ,EAAE,cAAc,IAAI,cAAc,WAAW,IAAI,SAAS;AAAA,IACpE;AAAA,OACI,IAAI,eAAe,YACnB,EAAE,YAAY,IAAI,WAAkD,IACpE,CAAC;AAAA,IACL,WAAW,IAAI,UAAU,YAAY;AAAA,IACrC,WAAW,IAAI,UAAU,YAAY;AAAA,IACrC,cAAc,IAAI;AAAA,EACpB;AAAA;;AC5WK,MAAM,gBAAkD;AAAA,EAC5C,OAAO,IAAI;AAAA,EACX,gBAAoC,CAAC;AAAA,EACrC,aAAa,IAAI;AAAA,EAEjB;AAAA,EAEjB,WAAW,CAAC,SAAgC;AAAA,IAC1C,KAAK,WAAW,QAAQ;AAAA,IAExB,WAAW,UAAU,QAAQ,SAAS;AAAA,MACpC,MAAM,WAAW,KAAK,KAAK,IAAI,OAAO,EAAE;AAAA,MACxC,IAAI,UAAU;AAAA,QACZ,MAAM,iBAAiB,KAAK,wBAAwB,QAAQ,QAAQ;AAAA,QACpE,IAAI,gBAAgB;AAAA,UAClB,MAAM,IAAI,uBACR,wBAAwB,OAAO,gCAAgC,eAAe,mCAAmC,eAAe,uBAAuB,eAAe,kBACxK;AAAA,QACF;AAAA,QAEA,MAAM,IAAI,uBACR,wBAAwB,OAAO,iCACjC;AAAA,MACF;AAAA,MAEA,KAAK,eAAe,MAAM;AAAA,MAC1B,KAAK,KAAK,IAAI,OAAO,IAAI,MAAM;AAAA,MAE/B,IAAI,CAAC,0BAAyB,MAAM,GAAG;AAAA,QACrC,KAAK,cAAc,KAAK,MAAM;AAAA,QAC9B;AAAA,MACF;AAAA,MAEA,MAAM,aAAa,OAAO,QAAQ;AAAA,MAClC,MAAM,SAAS,KAAK,SAAS,kBAAkB,WAAW,EAAE;AAAA,MAC5D,IAAI,CAAC,QAAQ;AAAA,QACX,MAAM,IAAI,uBACR,WAAW,OAAO,oCAAoC,WAAW,qEACnE;AAAA,MACF;AAAA,MAEA,MAAM,SAAS,KAAK,WAAW,IAAI,WAAW,EAAE,KAAK,CAAC;AAAA,MACtD,OAAO,KAAK,MAAM;AAAA,MAClB,KAAK,WAAW,IAAI,WAAW,IAAI,MAAM;AAAA,IAC3C;AAAA;AAAA,EAGM,cAAc,CAAC,QAAgC;AAAA,IACrD,MAAM,eAAe,OAAO,OAAO,cAAc;AAAA,IACjD,MAAM,WAAW,OAAO,OAAO,UAAU;AAAA,IACzC,MAAM,aAAa,OAAO,OAAO,YAAY;AAAA,IAE7C,IAAI,CAAC,gBAAgB,CAAC,UAAU;AAAA,MAC9B,MAAM,IAAI,uBAAsB,6BAA6B,OAAO,EAAE,CAAC;AAAA,IACzE;AAAA,IAEA,IAAI,cAAc,CAAC,UAAU;AAAA,MAC3B,MAAM,IAAI,uBAAsB,2BAA2B,OAAO,EAAE,CAAC;AAAA,IACvE;AAAA;AAAA,EAGF,IAAI,GAAgC;AAAA,IAClC,OAAO,CAAC,GAAG,KAAK,KAAK,OAAO,CAAC;AAAA;AAAA,EAG/B,OAAO,CAAC,IAAqC;AAAA,IAC3C,OAAO,KAAK,KAAK,IAAI,EAAE,KAAK;AAAA;AAAA,EAG9B,UAAU,GAAgC;AAAA,IACxC,OAAO,CAAC,GAAG,KAAK,aAAa;AAAA;AAAA,EAG/B,WAAW,CAAC,MAAqD;AAAA,IAC/D,KAAK,SAAS,kBAAkB,KAAK,EAAE;AAAA,IAEvC,MAAM,OAAO,IAAI;AAAA,IACjB,MAAM,SAAmC,CAAC;AAAA,IAE1C,WAAW,YAAY,KAAK,SAAS,kBAAkB,IAAI,GAAG;AAAA,MAC5D,WAAW,UAAU,KAAK,WAAW,IAAI,SAAS,EAAE,KAAK,CAAC,GAAG;AAAA,QAC3D,IAAI,KAAK,IAAI,OAAO,EAAE;AAAA,UAAG;AAAA,QACzB,KAAK,IAAI,OAAO,EAAE;AAAA,QAClB,OAAO,KAAK,MAAM;AAAA,MACpB;AAAA,IACF;AAAA,IAEA,OAAO;AAAA;AAAA,EAGD,uBAAuB,CAC7B,QACA,UACgF;AAAA,IAChF,IAAI,CAAC,0BAAyB,MAAM,KAAK,CAAC,0BAAyB,QAAQ,GAAG;AAAA,MAC5E,OAAO;AAAA,IACT;AAAA,IAEA,MAAM,mBAAmB,OAAO,QAAQ;AAAA,IACxC,MAAM,qBAAqB,SAAS,QAAQ;AAAA,IAE5C,IAAI,iBAAiB,OAAO,mBAAmB,IAAI;AAAA,MACjD,OAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,KAAK,SAAS,kBAAkB,gBAAgB;AAAA,IACpE,IAAI,YAAY,KAAK,CAAC,aAAa,SAAS,OAAO,mBAAmB,EAAE,GAAG;AAAA,MACzE,OAAO;AAAA,QACL,cAAc,iBAAiB;AAAA,QAC/B,eAAe,mBAAmB;AAAA,QAClC,gBAAgB,iBAAiB;AAAA,MACnC;AAAA,IACF;AAAA,IAEA,MAAM,gBAAgB,KAAK,SAAS,kBAAkB,kBAAkB;AAAA,IACxE,IAAI,cAAc,KAAK,CAAC,aAAa,SAAS,OAAO,iBAAiB,EAAE,GAAG;AAAA,MACzE,OAAO;AAAA,QACL,cAAc,mBAAmB;AAAA,QACjC,eAAe,iBAAiB;AAAA,QAChC,gBAAgB,mBAAmB;AAAA,MACrC;AAAA,IACF;AAAA,IAEA,OAAO;AAAA;AAEX;;AC5IA,eAAsB,oBAAgD,CAAC,OAKrD;AAAA,EAChB,MAAM,aAAa,MAAM,OAAO,OAAO;AAAA,EACvC,IAAI,WAAW,WAAW,GAAG;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,IAAI,CAAC,0BAAyB,MAAM,MAAM,GAAG;AAAA,IAC3C,WAAW,aAAa,YAAY;AAAA,MAClC,MAAM,SAAS,MAAM,UAAU,MAAM,WAAW;AAAA,MAChD,IAAI,uBAAuB,MAAM,GAAG;AAAA,QAClC,MAAM,IAAI,uBAAsB,OAAO,OAAO;AAAA,UAC5C,UAAU,MAAM,OAAO;AAAA,UACvB,SAAS,MAAM;AAAA,QACjB,CAAC;AAAA,MACH;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,IAAI,CAAC,MAAM,QAAQ;AAAA,IACjB,MAAM,IAAI,MAAM,kBAAkB,MAAM,OAAO,gCAAgC;AAAA,EACjF;AAAA,EAEA,WAAW,aAAa,YAAY;AAAA,IAClC,MAAM,SAAS,MAAM,UAAU;AAAA,SAC1B,MAAM;AAAA,MACT,QAAQ,MAAM;AAAA,IAChB,CAAC;AAAA,IACD,IAAI,uBAAuB,MAAM,GAAG;AAAA,MAClC,MAAM,IAAI,uBAAsB,OAAO,OAAO;AAAA,QAC5C,UAAU,MAAM,OAAO;AAAA,QACvB,SAAS,MAAM;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAGF,SAAS,sBAAsB,CAAC,OAAqD;AAAA,EACnF,OACE,OAAO,UAAU,YACjB,UAAU,QACV,WAAW,SACX,OAAO,MAAM,UAAU;AAAA;",
-  "debugId": "566997B478269C6164756E2164756E21",
-  "names": []
-}

package/dist/chunk-xt1zt7gv.js.map

@@ -1,13 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/security/errors.ts", "../src/security/membership-policies.ts", "../src/security/validation.ts", "../src/security/builders.ts"],
-  "sourcesContent": [
-    "export class SecurityValidationError extends Error {\n  readonly name = \"SecurityValidationError\"\n}\n",
-    "import type { MembershipOperation, MembershipPolicyDefinition } from \"./types\"\n\nexport interface MembershipOperationScope {\n  readonly policyIds: readonly string[]\n  readonly groupIds: ReadonlySet<string>\n}\n\nexport interface MembershipPolicyScope {\n  readonly policyIds: readonly string[]\n  readonly operations: Readonly<Record<MembershipOperation, MembershipOperationScope>>\n}\n\nconst MEMBERSHIP_OPERATIONS = [\"invite\", \"assignGroups\", \"suspend\"] as const\n\nexport function resolveMembershipPolicyScope(input: {\n  readonly membershipPolicies: readonly MembershipPolicyDefinition[]\n  readonly callerGroupIds: readonly string[]\n}): MembershipPolicyScope {\n  const callerGroups = new Set(input.callerGroupIds)\n  const policyIds: string[] = []\n  const operations = createEmptyOperationScopes()\n\n  for (const policy of input.membershipPolicies) {\n    if (!policy.grantedToGroupIds.some((groupId) => callerGroups.has(groupId))) {\n      continue\n    }\n\n    policyIds.push(policy.id)\n    for (const operation of policy.can) {\n      operations[operation].policyIds.push(policy.id)\n      for (const groupId of policy.scopeGroupIds) {\n        operations[operation].groupIds.add(groupId)\n      }\n    }\n  }\n\n  return {\n    policyIds,\n    operations: {\n      invite: freezeOperationScope(operations.invite),\n      assignGroups: freezeOperationScope(operations.assignGroups),\n      suspend: freezeOperationScope(operations.suspend),\n    },\n  }\n}\n\nexport function canPerformMembershipOperation(\n  scope: MembershipPolicyScope,\n  operation: MembershipOperation,\n  groupIds: readonly string[]\n): boolean {\n  const operationScope = scope.operations[operation]\n\n  if (operationScope.policyIds.length === 0) {\n    return false\n  }\n\n  if (groupIds.length === 0) {\n    return true\n  }\n\n  return groupIds.every((groupId) => operationScope.groupIds.has(groupId))\n}\n\nexport function missingMembershipGroupIds(\n  scope: MembershipPolicyScope,\n  operation: MembershipOperation,\n  groupIds: readonly string[]\n): readonly string[] {\n  if (groupIds.length === 0) {\n    return []\n  }\n\n  const operationScope = scope.operations[operation]\n  return groupIds.filter((groupId) => !operationScope.groupIds.has(groupId))\n}\n\nfunction createEmptyOperationScopes(): Record<\n  MembershipOperation,\n  { policyIds: string[]; groupIds: Set<string> }\n> {\n  return {\n    invite: { policyIds: [], groupIds: new Set<string>() },\n    assignGroups: { policyIds: [], groupIds: new Set<string>() },\n    suspend: { policyIds: [], groupIds: new Set<string>() },\n  }\n}\n\nfunction freezeOperationScope(input: {\n  readonly policyIds: readonly string[]\n  readonly groupIds: ReadonlySet<string>\n}): MembershipOperationScope {\n  return {\n    policyIds: [...input.policyIds],\n    groupIds: new Set(input.groupIds),\n  }\n}\n\nexport function isMembershipOperation(value: unknown): value is MembershipOperation {\n  return MEMBERSHIP_OPERATIONS.includes(value as MembershipOperation)\n}\n",
-    "import { GRANT_KINDS, type GrantUniverseKey, grantKindOf } from \"../authorization/grant-kinds\"\nimport { SecurityValidationError } from \"./errors\"\nimport { isMembershipOperation } from \"./membership-policies\"\nimport type {\n  GrantCapability,\n  GrantDefinition,\n  GroupDefinition,\n  MarkingDefinition,\n  MembershipPolicyDefinition,\n  RegisteredSecurityDefinitions,\n  RoleDefinition,\n  Selection,\n} from \"./types\"\n\n/** Registered id universes and singleton capabilities available to role grants. */\ntype RegisteredUniverses = Partial<Record<GrantUniverseKey, ReadonlySet<string>>> & {\n  readonly agentAvailable?: boolean\n}\n\n/**\n * Every grant capability, for validating grants that arrive from untyped code.\n *\n * Written as a total `Record<GrantCapability, true>` rather than a bare array so a capability added\n * to `GrantDefinition` is a compile error here — the same discipline `GRANT_KINDS` uses. The\n * hand-written `capability !== \"access\" && …` chain this replaces would have accepted the new\n * capability at startup and then died on `GRANT_KINDS[kind].universeKey`.\n */\nconst GRANT_CAPABILITIES = Object.keys({\n  access: true,\n  view: true,\n  edit: true,\n  append: true,\n  apply: true,\n  share: true,\n  run: true,\n  observe: true,\n  manage: true,\n} satisfies Record<GrantCapability, true>) as readonly GrantCapability[]\n\n/** \"'a', 'b', or 'c'\" — the shape the security errors already use. */\nfunction formatAlternatives(values: readonly string[]): string {\n  const quoted = values.map((value) => `'${value}'`)\n  const last = quoted.at(-1)\n  return quoted.length < 2 ? (last ?? \"\") : `${quoted.slice(0, -1).join(\", \")}, or ${last}`\n}\n\nexport type CreateSecurityError = (message: string) => Error\n\n// Shared, single-source validation primitives. The builders reuse these too, so\n// authoring-time and startup-time checks can never drift apart.\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nexport function assertNonEmptyString(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is string {\n  if (typeof value !== \"string\" || value.trim().length === 0) {\n    throw createError(`[Sixb] ${field} must not be empty.`)\n  }\n}\n\nexport function assertOptionalString(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is string | undefined {\n  if (value === undefined) {\n    return\n  }\n\n  if (typeof value !== \"string\") {\n    throw createError(`[Sixb] ${field} must be a string.`)\n  }\n}\n\nfunction assertStringArray(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is readonly string[] {\n  if (!Array.isArray(value)) {\n    throw createError(`[Sixb] ${field} must be an array of group ids.`)\n  }\n\n  for (const item of value) {\n    assertNonEmptyString(item, `${field} item`, createError)\n  }\n}\n\nfunction assertMembershipOperationArray(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is MembershipPolicyDefinition[\"can\"] {\n  if (!Array.isArray(value)) {\n    throw createError(`[Sixb] ${field} must be an array of membership operations.`)\n  }\n\n  for (const item of value) {\n    if (!isMembershipOperation(item)) {\n      throw createError(\n        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`\n      )\n    }\n  }\n}\n\nfunction assertNoDuplicateIds(ids: readonly string[], field: string): void {\n  const seen = new Set<string>()\n  for (const id of ids) {\n    if (seen.has(id)) {\n      throw new SecurityValidationError(`[Sixb] ${field} contains duplicate group id '${id}'.`)\n    }\n    seen.add(id)\n  }\n}\n\nfunction assertNoDuplicateOperations(\n  operations: readonly MembershipPolicyDefinition[\"can\"][number][],\n  field: string\n): void {\n  const seen = new Set<string>()\n  for (const operation of operations) {\n    if (seen.has(operation)) {\n      throw new SecurityValidationError(\n        `[Sixb] ${field} contains duplicate operation '${operation}'.`\n      )\n    }\n    seen.add(operation)\n  }\n}\n\nexport function assertMarkingDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is MarkingDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Marking definition must be an object.\")\n  }\n\n  if (value.kind !== \"marking\") {\n    throw createError(\"[Sixb] Marking definition kind must be 'marking'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Marking id\", createError)\n  assertOptionalString(value.label, `Marking '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Marking '${value.id}' description`, createError)\n}\n\nexport function isMarkingDefinition(value: unknown): value is MarkingDefinition {\n  try {\n    assertMarkingDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertGroupDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is GroupDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Group definition must be an object.\")\n  }\n\n  if (value.kind !== \"group\") {\n    throw createError(\"[Sixb] Group definition kind must be 'group'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Group id\", createError)\n  assertOptionalString(value.label, `Group '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Group '${value.id}' description`, createError)\n}\n\nexport function isGroupDefinition(value: unknown): value is GroupDefinition {\n  try {\n    assertGroupDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertMembershipPolicyDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is MembershipPolicyDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Membership policy definition must be an object.\")\n  }\n\n  if (value.kind !== \"membershipPolicy\") {\n    throw createError(\"[Sixb] Membership policy definition kind must be 'membershipPolicy'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Membership policy id\", createError)\n  assertStringArray(\n    value.grantedToGroupIds,\n    `Membership policy '${value.id}' grantedTo`,\n    createError\n  )\n  assertStringArray(value.scopeGroupIds, `Membership policy '${value.id}' scope`, createError)\n  assertMembershipOperationArray(value.can, `Membership policy '${value.id}' can`, createError)\n}\n\nexport function isMembershipPolicyDefinition(value: unknown): value is MembershipPolicyDefinition {\n  try {\n    assertMembershipPolicyDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertGrantDefinition(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is GrantDefinition {\n  if (!isRecord(value) || value.kind !== \"grant\") {\n    throw createError(`[Sixb] ${field} must contain only grant definitions from 'can'.`)\n  }\n\n  if (!GRANT_CAPABILITIES.includes(value.capability as GrantCapability)) {\n    throw createError(\n      `[Sixb] ${field} grant capability must be ${formatAlternatives(GRANT_CAPABILITIES)}.`\n    )\n  }\n\n  if (value.capability === \"access\" && value.target !== \"application\") {\n    throw createError(`[Sixb] ${field} access grant target must be 'application'.`)\n  }\n\n  if (value.capability === \"view\" && value.target !== \"object\" && value.target !== \"dataset\") {\n    throw createError(`[Sixb] ${field} view grant target must be 'object' or 'dataset'.`)\n  }\n\n  if (\n    value.capability === \"run\" &&\n    value.target !== \"workflow\" &&\n    value.target !== \"sync\" &&\n    value.target !== \"pipeline\" &&\n    value.target !== \"agent\"\n  ) {\n    throw createError(\n      `[Sixb] ${field} run grant target must be 'workflow', 'sync', 'pipeline', or 'agent'.`\n    )\n  }\n\n  if (value.capability === \"observe\" && value.target !== \"logs\" && value.target !== \"aiUsage\") {\n    throw createError(`[Sixb] ${field} observe grant target must be 'logs' or 'aiUsage'.`)\n  }\n\n  if (value.capability === \"manage\" && value.target !== \"connector\" && value.target !== \"aiUsage\") {\n    throw createError(`[Sixb] ${field} manage grant target must be 'connector' or 'aiUsage'.`)\n  }\n\n  if (value.capability === \"run\" && value.target === \"agent\") {\n    if (value.selection !== undefined) {\n      throw createError(`[Sixb] ${field} agent run grant must not declare a selection.`)\n    }\n    return\n  }\n\n  assertSelection(value.selection, field, createError)\n}\n\nfunction assertSelection(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is Selection {\n  if (!isRecord(value) || typeof value.all !== \"boolean\") {\n    throw createError(`[Sixb] ${field} grant must carry a selection from 'can' or a scope.`)\n  }\n\n  const ids = value.all ? value.except : value.ids\n  if (!Array.isArray(ids)) {\n    throw createError(`[Sixb] ${field} grant selection must list ids.`)\n  }\n\n  for (const id of ids) {\n    assertNonEmptyString(id, `${field} grant selection id`, createError)\n  }\n}\n\nexport function assertRoleDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is RoleDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Role definition must be an object.\")\n  }\n\n  if (value.kind !== \"role\") {\n    throw createError(\"[Sixb] Role definition kind must be 'role'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Role id\", createError)\n  assertOptionalString(value.label, `Role '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Role '${value.id}' description`, createError)\n  assertStringArray(value.grantedToGroupIds, `Role '${value.id}' grantedTo`, createError)\n\n  if (!Array.isArray(value.grants)) {\n    throw createError(`[Sixb] Role '${value.id}' grants must be an array.`)\n  }\n\n  for (const grant of value.grants) {\n    assertGrantDefinition(grant, `Role '${value.id}' grants`, createError)\n  }\n\n  if (value.clearances !== undefined) {\n    assertStringArray(value.clearances, `Role '${value.id}' clearances`, createError)\n  }\n}\n\nexport function isRoleDefinition(value: unknown): value is RoleDefinition {\n  try {\n    assertRoleDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function validateSecurityDefinitionsAtStartup(input: {\n  readonly markings?: readonly MarkingDefinition[]\n  readonly groups: readonly GroupDefinition[]\n  readonly membershipPolicies: readonly MembershipPolicyDefinition[]\n  readonly roles?: readonly RoleDefinition[]\n  /** Registered browser application ids — when provided, access grants must reference them. */\n  readonly applicationIds?: ReadonlySet<string>\n  /** Registered object type ids — when provided, view grants must reference them. */\n  readonly objectTypeIds?: ReadonlySet<string>\n  /** Registered dataset ids — when provided, dataset view grants must reference them. */\n  readonly datasetIds?: ReadonlySet<string>\n  /** Registered action ids — when provided, apply grants must reference them. */\n  readonly actionIds?: ReadonlySet<string>\n  /** Registered workflow ids — when provided, run grants must reference them. */\n  readonly workflowIds?: ReadonlySet<string>\n  /** Registered sync ids — when provided, sync run grants must reference them. */\n  readonly syncIds?: ReadonlySet<string>\n  /** Registered pipeline ids — when provided, pipeline run grants must reference them. */\n  readonly pipelineIds?: ReadonlySet<string>\n  /** Whether the project's single conversational Agent is configured. */\n  readonly agentAvailable?: boolean\n  /** Registered observability surfaces. */\n  readonly observableIds?: ReadonlySet<string>\n  /** Registered singleton management surfaces. */\n  readonly manageableIds?: ReadonlySet<string>\n  /** Registered connector ids — when provided, manage grants must reference them. */\n  readonly connectorIds?: ReadonlySet<string>\n  /** Registered Share ids — when provided, share grants must reference them. */\n  readonly shareIds?: ReadonlySet<string>\n}): RegisteredSecurityDefinitions {\n  const markingsById = new Map<string, MarkingDefinition>()\n  const groupsById = new Map<string, GroupDefinition>()\n  const rolesById = new Map<string, RoleDefinition>()\n  const membershipPoliciesById = new Map<string, MembershipPolicyDefinition>()\n\n  for (const marking of input.markings ?? []) {\n    assertMarkingDefinition(marking)\n\n    if (markingsById.has(marking.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate marking id: ${marking.id}`)\n    }\n\n    markingsById.set(marking.id, marking)\n  }\n\n  for (const group of input.groups) {\n    assertGroupDefinition(group)\n\n    if (groupsById.has(group.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate group id: ${group.id}`)\n    }\n\n    groupsById.set(group.id, group)\n  }\n\n  for (const role of input.roles ?? []) {\n    assertRoleDefinition(role)\n\n    if (rolesById.has(role.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate role id: ${role.id}`)\n    }\n\n    if (role.grantedToGroupIds.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${role.id}' must be granted to at least one group.`\n      )\n    }\n\n    const clearances = role.clearances ?? []\n    if (role.grants.length === 0 && clearances.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${role.id}' must declare at least one grant or clearance.`\n      )\n    }\n\n    assertNoDuplicateIds(role.grantedToGroupIds, `Role '${role.id}' grantedTo`)\n    assertNoDuplicateIds(clearances, `Role '${role.id}' clearances`)\n\n    for (const markingId of clearances) {\n      if (!markingsById.has(markingId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Role '${role.id}' clearances reference unknown marking '${markingId}'. Add it to 'security/markings/' or pass it to createSixb({ markings }).`\n        )\n      }\n    }\n\n    for (const groupId of role.grantedToGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Role '${role.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    for (const grant of role.grants) {\n      assertGrantReferences(role.id, grant, input)\n    }\n\n    rolesById.set(role.id, role)\n  }\n\n  for (const policy of input.membershipPolicies) {\n    assertMembershipPolicyDefinition(policy)\n\n    if (membershipPoliciesById.has(policy.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate membership policy id: ${policy.id}`)\n    }\n\n    if (policy.grantedToGroupIds.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Membership policy '${policy.id}' must grant membership authority to at least one group.`\n      )\n    }\n\n    if (policy.can.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Membership policy '${policy.id}' must declare at least one operation.`\n      )\n    }\n\n    assertNoDuplicateIds(policy.grantedToGroupIds, `Membership policy '${policy.id}' grantedTo`)\n    assertNoDuplicateIds(policy.scopeGroupIds, `Membership policy '${policy.id}' scope`)\n    assertNoDuplicateOperations(policy.can, `Membership policy '${policy.id}' can`)\n\n    for (const groupId of policy.grantedToGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Membership policy '${policy.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    for (const groupId of policy.scopeGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Membership policy '${policy.id}' scope references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    membershipPoliciesById.set(policy.id, policy)\n  }\n\n  return {\n    markings: [...markingsById.values()],\n    markingsById,\n    groups: [...groupsById.values()],\n    groupsById,\n    roles: [...rolesById.values()],\n    rolesById,\n    membershipPolicies: [...membershipPoliciesById.values()],\n    membershipPoliciesById,\n  }\n}\n\nfunction assertGrantReferences(\n  roleId: string,\n  grant: GrantDefinition,\n  registered: RegisteredUniverses\n): void {\n  if (grant.capability === \"run\" && grant.target === \"agent\") {\n    const spec = GRANT_KINDS[grantKindOf(grant)]\n    if (!registered.agentAvailable) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${roleId}' grants ${grant.capability} on the project Agent, but it is unavailable. ${spec.fix}`\n      )\n    }\n    return\n  }\n  const spec = GRANT_KINDS[grantKindOf(grant)]\n  const universe = registered[spec.universeKey]\n\n  if (!universe) {\n    return\n  }\n\n  // Explicit selections list ids to include; \"all except\" selections list ids\n  // to exclude. Either way every named id must be registered — an unknown id is\n  // a typo that would silently widen or no-op the grant.\n  const ids = grant.selection.all ? grant.selection.except : grant.selection.ids\n\n  for (const id of ids) {\n    if (!universe.has(id)) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${roleId}' grants ${grant.capability} on unknown ${spec.subject} '${id}'. ${spec.fix}`\n      )\n    }\n  }\n}\n",
-    "import { SecurityValidationError } from \"./errors\"\nimport type {\n  GrantDefinition,\n  GroupDefinition,\n  MarkingDefinition,\n  MembershipOperation,\n  MembershipPolicyDefinition,\n  RoleDefinition,\n} from \"./types\"\nimport {\n  assertGrantDefinition,\n  assertNonEmptyString,\n  assertOptionalString,\n  isRecord,\n} from \"./validation\"\n\nexport interface DefineGroupOptions {\n  readonly label?: string\n  readonly description?: string\n}\n\nexport interface DefineMarkingOptions {\n  readonly label?: string\n  readonly description?: string\n}\n\nexport interface DefineRoleOptions {\n  readonly label?: string\n  readonly description?: string\n  readonly grantedTo: readonly GroupDefinition[]\n  readonly grants?: readonly GrantDefinition[]\n  /** Markings this role's members may read. */\n  readonly clearances?: readonly MarkingDefinition[]\n}\n\nexport interface DefineMembershipPolicyOptions {\n  readonly grantedTo: readonly GroupDefinition[]\n  readonly scope: readonly GroupDefinition[]\n  readonly can: readonly MembershipOperation[]\n}\n\nconst MEMBERSHIP_OPERATIONS = new Set<MembershipOperation>([\"invite\", \"assignGroups\", \"suspend\"])\n\nfunction assertNonEmptyArray<T>(value: readonly T[], field: string): void {\n  if (value.length === 0) {\n    throw new SecurityValidationError(`[Sixb] ${field} must not be empty.`)\n  }\n}\n\nfunction groupIdsFrom(groups: readonly GroupDefinition[], field: string): readonly string[] {\n  return groups.map((group) => {\n    if (!isRecord(group) || group.kind !== \"group\") {\n      throw new SecurityValidationError(`[Sixb] ${field} must contain only group definitions.`)\n    }\n\n    assertNonEmptyString(group.id, `${field} group id`)\n    return group.id\n  })\n}\n\nfunction membershipOperationsFrom(\n  operations: readonly MembershipOperation[],\n  field: string\n): readonly MembershipOperation[] {\n  return operations.map((operation) => {\n    if (!MEMBERSHIP_OPERATIONS.has(operation)) {\n      throw new SecurityValidationError(\n        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`\n      )\n    }\n\n    return operation\n  })\n}\n\nexport function defineGroup<const TId extends string>(\n  id: TId,\n  options: DefineGroupOptions = {}\n): GroupDefinition<TId> {\n  assertNonEmptyString(id, \"Group id\")\n  assertOptionalString(options.label, `Group '${id}' label`)\n  assertOptionalString(options.description, `Group '${id}' description`)\n\n  return {\n    kind: \"group\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n  }\n}\n\n/** Read the ids of marking definitions, rejecting anything else such as a bare id. */\nexport function markingIdsFrom(\n  markings: readonly MarkingDefinition[],\n  field: string\n): readonly string[] {\n  return markings.map((marking) => {\n    if (!isRecord(marking) || marking.kind !== \"marking\") {\n      throw new SecurityValidationError(`[Sixb] ${field} must contain only marking definitions.`)\n    }\n\n    assertNonEmptyString(marking.id, `${field} marking id`)\n    return marking.id\n  })\n}\n\nexport function defineMarking<const TId extends string>(\n  id: TId,\n  options: DefineMarkingOptions = {}\n): MarkingDefinition<TId> {\n  assertNonEmptyString(id, \"Marking id\")\n  assertOptionalString(options.label, `Marking '${id}' label`)\n  assertOptionalString(options.description, `Marking '${id}' description`)\n\n  return {\n    kind: \"marking\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n  }\n}\n\nexport function defineRole<const TId extends string>(\n  id: TId,\n  options: DefineRoleOptions\n): RoleDefinition<TId> {\n  assertNonEmptyString(id, \"Role id\")\n  assertOptionalString(options.label, `Role '${id}' label`)\n  assertOptionalString(options.description, `Role '${id}' description`)\n  assertNonEmptyArray(options.grantedTo, `Role '${id}' grantedTo`)\n\n  const grantedToGroupIds = groupIdsFrom(options.grantedTo, `Role '${id}' grantedTo`)\n  const grants = options.grants ?? []\n  const clearances = markingIdsFrom(options.clearances ?? [], `Role '${id}' clearances`)\n\n  for (const grant of grants) {\n    assertGrantDefinition(grant, `Role '${id}' grants`)\n  }\n\n  if (grants.length === 0 && clearances.length === 0) {\n    throw new SecurityValidationError(\n      `[Sixb] Role '${id}' must declare at least one grant or clearance.`\n    )\n  }\n\n  return {\n    kind: \"role\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n    grantedToGroupIds,\n    grants,\n    ...(clearances.length > 0 ? { clearances } : {}),\n  }\n}\n\nexport function defineMembershipPolicy<const TId extends string>(\n  id: TId,\n  options: DefineMembershipPolicyOptions\n): MembershipPolicyDefinition<TId> {\n  assertNonEmptyString(id, \"Membership policy id\")\n  assertNonEmptyArray(options.grantedTo, `Membership policy '${id}' grantedTo`)\n  assertNonEmptyArray(options.can, `Membership policy '${id}' can`)\n\n  return {\n    kind: \"membershipPolicy\",\n    id,\n    grantedToGroupIds: groupIdsFrom(options.grantedTo, `Membership policy '${id}' grantedTo`),\n    scopeGroupIds: groupIdsFrom(options.scope, `Membership policy '${id}' scope`),\n    can: membershipOperationsFrom(options.can, `Membership policy '${id}' can`),\n  }\n}\n"
-  ],
-  "mappings": ";;;;;;;AAAO,MAAM,iCAAgC,MAAM;AAAA,EACxC,OAAO;AAClB;;;ACUA,IAAM,wBAAwB,CAAC,UAAU,gBAAgB,SAAS;AAE3D,SAAS,4BAA4B,CAAC,OAGnB;AAAA,EACxB,MAAM,eAAe,IAAI,IAAI,MAAM,cAAc;AAAA,EACjD,MAAM,YAAsB,CAAC;AAAA,EAC7B,MAAM,aAAa,2BAA2B;AAAA,EAE9C,WAAW,UAAU,MAAM,oBAAoB;AAAA,IAC7C,IAAI,CAAC,OAAO,kBAAkB,KAAK,CAAC,YAAY,aAAa,IAAI,OAAO,CAAC,GAAG;AAAA,MAC1E;AAAA,IACF;AAAA,IAEA,UAAU,KAAK,OAAO,EAAE;AAAA,IACxB,WAAW,aAAa,OAAO,KAAK;AAAA,MAClC,WAAW,WAAW,UAAU,KAAK,OAAO,EAAE;AAAA,MAC9C,WAAW,WAAW,OAAO,eAAe;AAAA,QAC1C,WAAW,WAAW,SAAS,IAAI,OAAO;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,YAAY;AAAA,MACV,QAAQ,qBAAqB,WAAW,MAAM;AAAA,MAC9C,cAAc,qBAAqB,WAAW,YAAY;AAAA,MAC1D,SAAS,qBAAqB,WAAW,OAAO;AAAA,IAClD;AAAA,EACF;AAAA;AAGK,SAAS,6BAA6B,CAC3C,OACA,WACA,UACS;AAAA,EACT,MAAM,iBAAiB,MAAM,WAAW;AAAA,EAExC,IAAI,eAAe,UAAU,WAAW,GAAG;AAAA,IACzC,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,SAAS,MAAM,CAAC,YAAY,eAAe,SAAS,IAAI,OAAO,CAAC;AAAA;AAGlE,SAAS,yBAAyB,CACvC,OACA,WACA,UACmB;AAAA,EACnB,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,OAAO,CAAC;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,MAAM,WAAW;AAAA,EACxC,OAAO,SAAS,OAAO,CAAC,YAAY,CAAC,eAAe,SAAS,IAAI,OAAO,CAAC;AAAA;AAG3E,SAAS,0BAA0B,GAGjC;AAAA,EACA,OAAO;AAAA,IACL,QAAQ,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IACrD,cAAc,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IAC3D,SAAS,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,EACxD;AAAA;AAGF,SAAS,oBAAoB,CAAC,OAGD;AAAA,EAC3B,OAAO;AAAA,IACL,WAAW,CAAC,GAAG,MAAM,SAAS;AAAA,IAC9B,UAAU,IAAI,IAAI,MAAM,QAAQ;AAAA,EAClC;AAAA;AAGK,SAAS,qBAAqB,CAAC,OAA8C;AAAA,EAClF,OAAO,sBAAsB,SAAS,KAA4B;AAAA;;;ACxEpE,IAAM,qBAAqB,OAAO,KAAK;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AAAA,EACP,KAAK;AAAA,EACL,SAAS;AAAA,EACT,QAAQ;AACV,CAAyC;AAGzC,SAAS,kBAAkB,CAAC,QAAmC;AAAA,EAC7D,MAAM,SAAS,OAAO,IAAI,CAAC,UAAU,IAAI,QAAQ;AAAA,EACjD,MAAM,OAAO,OAAO,GAAG,EAAE;AAAA,EACzB,OAAO,OAAO,SAAS,IAAK,QAAQ,KAAM,GAAG,OAAO,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,SAAS;AAAA;AAO9E,SAAS,QAAQ,CAAC,OAAkD;AAAA,EACzE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA;AAGrE,SAAS,oBAAoB,CAClC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC1D;AAAA,EACzB,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAAA,IAC1D,MAAM,YAAY,UAAU,0BAA0B;AAAA,EACxD;AAAA;AAGK,SAAS,oBAAoB,CAClC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC9C;AAAA,EACrC,IAAI,UAAU,WAAW;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,MAAM,YAAY,UAAU,yBAAyB;AAAA,EACvD;AAAA;AAGF,SAAS,iBAAiB,CACxB,OACA,OACA,aACoC;AAAA,EACpC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzB,MAAM,YAAY,UAAU,sCAAsC;AAAA,EACpE;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,qBAAqB,MAAM,GAAG,cAAc,WAAW;AAAA,EACzD;AAAA;AAGF,SAAS,8BAA8B,CACrC,OACA,OACA,aACoD;AAAA,EACpD,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzB,MAAM,YAAY,UAAU,kDAAkD;AAAA,EAChF;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,CAAC,sBAAsB,IAAI,GAAG;AAAA,MAChC,MAAM,YACJ,UAAU,+EACZ;AAAA,IACF;AAAA,EACF;AAAA;AAGF,SAAS,oBAAoB,CAAC,KAAwB,OAAqB;AAAA,EACzE,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,KAAK,IAAI,EAAE,GAAG;AAAA,MAChB,MAAM,IAAI,yBAAwB,UAAU,sCAAsC,MAAM;AAAA,IAC1F;AAAA,IACA,KAAK,IAAI,EAAE;AAAA,EACb;AAAA;AAGF,SAAS,2BAA2B,CAClC,YACA,OACM;AAAA,EACN,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,aAAa,YAAY;AAAA,IAClC,IAAI,KAAK,IAAI,SAAS,GAAG;AAAA,MACvB,MAAM,IAAI,yBACR,UAAU,uCAAuC,aACnD;AAAA,IACF;AAAA,IACA,KAAK,IAAI,SAAS;AAAA,EACpB;AAAA;AAGK,SAAS,uBAAuB,CACrC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC/C;AAAA,EACpC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,8CAA8C;AAAA,EAClE;AAAA,EAEA,IAAI,MAAM,SAAS,WAAW;AAAA,IAC5B,MAAM,YAAY,mDAAmD;AAAA,EACvE;AAAA,EAEA,qBAAqB,MAAM,IAAI,cAAc,WAAW;AAAA,EACxD,qBAAqB,MAAM,OAAO,YAAY,MAAM,aAAa,WAAW;AAAA,EAC5E,qBAAqB,MAAM,aAAa,YAAY,MAAM,mBAAmB,WAAW;AAAA;AAGnF,SAAS,mBAAmB,CAAC,OAA4C;AAAA,EAC9E,IAAI;AAAA,IACF,wBAAwB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC9D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,qBAAqB,CACnC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACjD;AAAA,EAClC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,4CAA4C;AAAA,EAChE;AAAA,EAEA,IAAI,MAAM,SAAS,SAAS;AAAA,IAC1B,MAAM,YAAY,+CAA+C;AAAA,EACnE;AAAA,EAEA,qBAAqB,MAAM,IAAI,YAAY,WAAW;AAAA,EACtD,qBAAqB,MAAM,OAAO,UAAU,MAAM,aAAa,WAAW;AAAA,EAC1E,qBAAqB,MAAM,aAAa,UAAU,MAAM,mBAAmB,WAAW;AAAA;AAGjF,SAAS,iBAAiB,CAAC,OAA0C;AAAA,EAC1E,IAAI;AAAA,IACF,sBAAsB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC5D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,gCAAgC,CAC9C,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACtC;AAAA,EAC7C,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,wDAAwD;AAAA,EAC5E;AAAA,EAEA,IAAI,MAAM,SAAS,oBAAoB;AAAA,IACrC,MAAM,YAAY,sEAAsE;AAAA,EAC1F;AAAA,EAEA,qBAAqB,MAAM,IAAI,wBAAwB,WAAW;AAAA,EAClE,kBACE,MAAM,mBACN,sBAAsB,MAAM,iBAC5B,WACF;AAAA,EACA,kBAAkB,MAAM,eAAe,sBAAsB,MAAM,aAAa,WAAW;AAAA,EAC3F,+BAA+B,MAAM,KAAK,sBAAsB,MAAM,WAAW,WAAW;AAAA;AAGvF,SAAS,4BAA4B,CAAC,OAAqD;AAAA,EAChG,IAAI;AAAA,IACF,iCAAiC,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IACvE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,qBAAqB,CACnC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACjD;AAAA,EAClC,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS;AAAA,IAC9C,MAAM,YAAY,UAAU,uDAAuD;AAAA,EACrF;AAAA,EAEA,IAAI,CAAC,mBAAmB,SAAS,MAAM,UAA6B,GAAG;AAAA,IACrE,MAAM,YACJ,UAAU,kCAAkC,mBAAmB,kBAAkB,IACnF;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,eAAe,YAAY,MAAM,WAAW,eAAe;AAAA,IACnE,MAAM,YAAY,UAAU,kDAAkD;AAAA,EAChF;AAAA,EAEA,IAAI,MAAM,eAAe,UAAU,MAAM,WAAW,YAAY,MAAM,WAAW,WAAW;AAAA,IAC1F,MAAM,YAAY,UAAU,wDAAwD;AAAA,EACtF;AAAA,EAEA,IACE,MAAM,eAAe,SACrB,MAAM,WAAW,cACjB,MAAM,WAAW,UACjB,MAAM,WAAW,cACjB,MAAM,WAAW,SACjB;AAAA,IACA,MAAM,YACJ,UAAU,4EACZ;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,eAAe,aAAa,MAAM,WAAW,UAAU,MAAM,WAAW,WAAW;AAAA,IAC3F,MAAM,YAAY,UAAU,yDAAyD;AAAA,EACvF;AAAA,EAEA,IAAI,MAAM,eAAe,YAAY,MAAM,WAAW,eAAe,MAAM,WAAW,WAAW;AAAA,IAC/F,MAAM,YAAY,UAAU,6DAA6D;AAAA,EAC3F;AAAA,EAEA,IAAI,MAAM,eAAe,SAAS,MAAM,WAAW,SAAS;AAAA,IAC1D,IAAI,MAAM,cAAc,WAAW;AAAA,MACjC,MAAM,YAAY,UAAU,qDAAqD;AAAA,IACnF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,gBAAgB,MAAM,WAAW,OAAO,WAAW;AAAA;AAGrD,SAAS,eAAe,CACtB,OACA,OACA,aAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,KAAK,KAAK,OAAO,MAAM,QAAQ,WAAW;AAAA,IACtD,MAAM,YAAY,UAAU,2DAA2D;AAAA,EACzF;AAAA,EAEA,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,MAAM;AAAA,EAC7C,IAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AAAA,IACvB,MAAM,YAAY,UAAU,sCAAsC;AAAA,EACpE;AAAA,EAEA,WAAW,MAAM,KAAK;AAAA,IACpB,qBAAqB,IAAI,GAAG,4BAA4B,WAAW;AAAA,EACrE;AAAA;AAGK,SAAS,oBAAoB,CAClC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAClD;AAAA,EACjC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,2CAA2C;AAAA,EAC/D;AAAA,EAEA,IAAI,MAAM,SAAS,QAAQ;AAAA,IACzB,MAAM,YAAY,6CAA6C;AAAA,EACjE;AAAA,EAEA,qBAAqB,MAAM,IAAI,WAAW,WAAW;AAAA,EACrD,qBAAqB,MAAM,OAAO,SAAS,MAAM,aAAa,WAAW;AAAA,EACzE,qBAAqB,MAAM,aAAa,SAAS,MAAM,mBAAmB,WAAW;AAAA,EACrF,kBAAkB,MAAM,mBAAmB,SAAS,MAAM,iBAAiB,WAAW;AAAA,EAEtF,IAAI,CAAC,MAAM,QAAQ,MAAM,MAAM,GAAG;AAAA,IAChC,MAAM,YAAY,gBAAgB,MAAM,8BAA8B;AAAA,EACxE;AAAA,EAEA,WAAW,SAAS,MAAM,QAAQ;AAAA,IAChC,sBAAsB,OAAO,SAAS,MAAM,cAAc,WAAW;AAAA,EACvE;AAAA,EAEA,IAAI,MAAM,eAAe,WAAW;AAAA,IAClC,kBAAkB,MAAM,YAAY,SAAS,MAAM,kBAAkB,WAAW;AAAA,EAClF;AAAA;AAGK,SAAS,gBAAgB,CAAC,OAAyC;AAAA,EACxE,IAAI;AAAA,IACF,qBAAqB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC3D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,oCAAoC,CAAC,OA6BnB;AAAA,EAChC,MAAM,eAAe,IAAI;AAAA,EACzB,MAAM,aAAa,IAAI;AAAA,EACvB,MAAM,YAAY,IAAI;AAAA,EACtB,MAAM,yBAAyB,IAAI;AAAA,EAEnC,WAAW,WAAW,MAAM,YAAY,CAAC,GAAG;AAAA,IAC1C,wBAAwB,OAAO;AAAA,IAE/B,IAAI,aAAa,IAAI,QAAQ,EAAE,GAAG;AAAA,MAChC,MAAM,IAAI,yBAAwB,gCAAgC,QAAQ,IAAI;AAAA,IAChF;AAAA,IAEA,aAAa,IAAI,QAAQ,IAAI,OAAO;AAAA,EACtC;AAAA,EAEA,WAAW,SAAS,MAAM,QAAQ;AAAA,IAChC,sBAAsB,KAAK;AAAA,IAE3B,IAAI,WAAW,IAAI,MAAM,EAAE,GAAG;AAAA,MAC5B,MAAM,IAAI,yBAAwB,8BAA8B,MAAM,IAAI;AAAA,IAC5E;AAAA,IAEA,WAAW,IAAI,MAAM,IAAI,KAAK;AAAA,EAChC;AAAA,EAEA,WAAW,QAAQ,MAAM,SAAS,CAAC,GAAG;AAAA,IACpC,qBAAqB,IAAI;AAAA,IAEzB,IAAI,UAAU,IAAI,KAAK,EAAE,GAAG;AAAA,MAC1B,MAAM,IAAI,yBAAwB,6BAA6B,KAAK,IAAI;AAAA,IAC1E;AAAA,IAEA,IAAI,KAAK,kBAAkB,WAAW,GAAG;AAAA,MACvC,MAAM,IAAI,yBACR,gBAAgB,KAAK,4CACvB;AAAA,IACF;AAAA,IAEA,MAAM,aAAa,KAAK,cAAc,CAAC;AAAA,IACvC,IAAI,KAAK,OAAO,WAAW,KAAK,WAAW,WAAW,GAAG;AAAA,MACvD,MAAM,IAAI,yBACR,gBAAgB,KAAK,mDACvB;AAAA,IACF;AAAA,IAEA,qBAAqB,KAAK,mBAAmB,SAAS,KAAK,eAAe;AAAA,IAC1E,qBAAqB,YAAY,SAAS,KAAK,gBAAgB;AAAA,IAE/D,WAAW,aAAa,YAAY;AAAA,MAClC,IAAI,CAAC,aAAa,IAAI,SAAS,GAAG;AAAA,QAChC,MAAM,IAAI,yBACR,gBAAgB,KAAK,6CAA6C,oFACpE;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,WAAW,KAAK,mBAAmB;AAAA,MAC5C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,gBAAgB,KAAK,2CAA2C,8EAClE;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,SAAS,KAAK,QAAQ;AAAA,MAC/B,sBAAsB,KAAK,IAAI,OAAO,KAAK;AAAA,IAC7C;AAAA,IAEA,UAAU,IAAI,KAAK,IAAI,IAAI;AAAA,EAC7B;AAAA,EAEA,WAAW,UAAU,MAAM,oBAAoB;AAAA,IAC7C,iCAAiC,MAAM;AAAA,IAEvC,IAAI,uBAAuB,IAAI,OAAO,EAAE,GAAG;AAAA,MACzC,MAAM,IAAI,yBAAwB,0CAA0C,OAAO,IAAI;AAAA,IACzF;AAAA,IAEA,IAAI,OAAO,kBAAkB,WAAW,GAAG;AAAA,MACzC,MAAM,IAAI,yBACR,6BAA6B,OAAO,4DACtC;AAAA,IACF;AAAA,IAEA,IAAI,OAAO,IAAI,WAAW,GAAG;AAAA,MAC3B,MAAM,IAAI,yBACR,6BAA6B,OAAO,0CACtC;AAAA,IACF;AAAA,IAEA,qBAAqB,OAAO,mBAAmB,sBAAsB,OAAO,eAAe;AAAA,IAC3F,qBAAqB,OAAO,eAAe,sBAAsB,OAAO,WAAW;AAAA,IACnF,4BAA4B,OAAO,KAAK,sBAAsB,OAAO,SAAS;AAAA,IAE9E,WAAW,WAAW,OAAO,mBAAmB;AAAA,MAC9C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,6BAA6B,OAAO,2CAA2C,8EACjF;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,WAAW,OAAO,eAAe;AAAA,MAC1C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,6BAA6B,OAAO,uCAAuC,8EAC7E;AAAA,MACF;AAAA,IACF;AAAA,IAEA,uBAAuB,IAAI,OAAO,IAAI,MAAM;AAAA,EAC9C;AAAA,EAEA,OAAO;AAAA,IACL,UAAU,CAAC,GAAG,aAAa,OAAO,CAAC;AAAA,IACnC;AAAA,IACA,QAAQ,CAAC,GAAG,WAAW,OAAO,CAAC;AAAA,IAC/B;AAAA,IACA,OAAO,CAAC,GAAG,UAAU,OAAO,CAAC;AAAA,IAC7B;AAAA,IACA,oBAAoB,CAAC,GAAG,uBAAuB,OAAO,CAAC;AAAA,IACvD;AAAA,EACF;AAAA;AAGF,SAAS,qBAAqB,CAC5B,QACA,OACA,YACM;AAAA,EACN,IAAI,MAAM,eAAe,SAAS,MAAM,WAAW,SAAS;AAAA,IAC1D,MAAM,OAAO,YAAY,YAAY,KAAK;AAAA,IAC1C,IAAI,CAAC,WAAW,gBAAgB;AAAA,MAC9B,MAAM,IAAI,yBACR,gBAAgB,kBAAkB,MAAM,2DAA2D,KAAK,KAC1G;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EACA,MAAM,OAAO,YAAY,YAAY,KAAK;AAAA,EAC1C,MAAM,WAAW,WAAW,KAAK;AAAA,EAEjC,IAAI,CAAC,UAAU;AAAA,IACb;AAAA,EACF;AAAA,EAKA,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM,UAAU,SAAS,MAAM,UAAU;AAAA,EAE3E,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,CAAC,SAAS,IAAI,EAAE,GAAG;AAAA,MACrB,MAAM,IAAI,yBACR,gBAAgB,kBAAkB,MAAM,yBAAyB,KAAK,YAAY,QAAQ,KAAK,KACjG;AAAA,IACF;AAAA,EACF;AAAA;;;AC3dF,IAAM,yBAAwB,IAAI,IAAyB,CAAC,UAAU,gBAAgB,SAAS,CAAC;AAEhG,SAAS,mBAAsB,CAAC,OAAqB,OAAqB;AAAA,EACxE,IAAI,MAAM,WAAW,GAAG;AAAA,IACtB,MAAM,IAAI,yBAAwB,UAAU,0BAA0B;AAAA,EACxE;AAAA;AAGF,SAAS,YAAY,CAAC,QAAoC,OAAkC;AAAA,EAC1F,OAAO,OAAO,IAAI,CAAC,UAAU;AAAA,IAC3B,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS;AAAA,MAC9C,MAAM,IAAI,yBAAwB,UAAU,4CAA4C;AAAA,IAC1F;AAAA,IAEA,qBAAqB,MAAM,IAAI,GAAG,gBAAgB;AAAA,IAClD,OAAO,MAAM;AAAA,GACd;AAAA;AAGH,SAAS,wBAAwB,CAC/B,YACA,OACgC;AAAA,EAChC,OAAO,WAAW,IAAI,CAAC,cAAc;AAAA,IACnC,IAAI,CAAC,uBAAsB,IAAI,SAAS,GAAG;AAAA,MACzC,MAAM,IAAI,yBACR,UAAU,+EACZ;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,GACR;AAAA;AAGI,SAAS,YAAqC,CACnD,IACA,UAA8B,CAAC,GACT;AAAA,EACtB,qBAAqB,IAAI,UAAU;AAAA,EACnC,qBAAqB,QAAQ,OAAO,UAAU,WAAW;AAAA,EACzD,qBAAqB,QAAQ,aAAa,UAAU,iBAAiB;AAAA,EAErE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EAClF;AAAA;AAIK,SAAS,cAAc,CAC5B,UACA,OACmB;AAAA,EACnB,OAAO,SAAS,IAAI,CAAC,YAAY;AAAA,IAC/B,IAAI,CAAC,SAAS,OAAO,KAAK,QAAQ,SAAS,WAAW;AAAA,MACpD,MAAM,IAAI,yBAAwB,UAAU,8CAA8C;AAAA,IAC5F;AAAA,IAEA,qBAAqB,QAAQ,IAAI,GAAG,kBAAkB;AAAA,IACtD,OAAO,QAAQ;AAAA,GAChB;AAAA;AAGI,SAAS,cAAuC,CACrD,IACA,UAAgC,CAAC,GACT;AAAA,EACxB,qBAAqB,IAAI,YAAY;AAAA,EACrC,qBAAqB,QAAQ,OAAO,YAAY,WAAW;AAAA,EAC3D,qBAAqB,QAAQ,aAAa,YAAY,iBAAiB;AAAA,EAEvE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EAClF;AAAA;AAGK,SAAS,WAAoC,CAClD,IACA,SACqB;AAAA,EACrB,qBAAqB,IAAI,SAAS;AAAA,EAClC,qBAAqB,QAAQ,OAAO,SAAS,WAAW;AAAA,EACxD,qBAAqB,QAAQ,aAAa,SAAS,iBAAiB;AAAA,EACpE,oBAAoB,QAAQ,WAAW,SAAS,eAAe;AAAA,EAE/D,MAAM,oBAAoB,aAAa,QAAQ,WAAW,SAAS,eAAe;AAAA,EAClF,MAAM,SAAS,QAAQ,UAAU,CAAC;AAAA,EAClC,MAAM,aAAa,eAAe,QAAQ,cAAc,CAAC,GAAG,SAAS,gBAAgB;AAAA,EAErF,WAAW,SAAS,QAAQ;AAAA,IAC1B,sBAAsB,OAAO,SAAS,YAAY;AAAA,EACpD;AAAA,EAEA,IAAI,OAAO,WAAW,KAAK,WAAW,WAAW,GAAG;AAAA,IAClD,MAAM,IAAI,yBACR,gBAAgB,mDAClB;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,IAChF;AAAA,IACA;AAAA,OACI,WAAW,SAAS,IAAI,EAAE,WAAW,IAAI,CAAC;AAAA,EAChD;AAAA;AAGK,SAAS,uBAAgD,CAC9D,IACA,SACiC;AAAA,EACjC,qBAAqB,IAAI,sBAAsB;AAAA,EAC/C,oBAAoB,QAAQ,WAAW,sBAAsB,eAAe;AAAA,EAC5E,oBAAoB,QAAQ,KAAK,sBAAsB,SAAS;AAAA,EAEhE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,mBAAmB,aAAa,QAAQ,WAAW,sBAAsB,eAAe;AAAA,IACxF,eAAe,aAAa,QAAQ,OAAO,sBAAsB,WAAW;AAAA,IAC5E,KAAK,yBAAyB,QAAQ,KAAK,sBAAsB,SAAS;AAAA,EAC5E;AAAA;",
-  "debugId": "5DED6666AEF6ACF164756E2164756E21",
-  "names": []
-}

package/dist/chunk-y2aq6ag9.js.map

@@ -1,11 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/storage/action-runs/types.ts", "../src/storage/action-runs/failure.ts"],
-  "sourcesContent": [
-    "import type { ActionSubject } from \"../../actions\"\nimport type { SixbErrorCode, SixbFailure } from \"../../errors/types\"\nimport type { JsonValue } from \"../../json\"\n\nexport type ActionRunStatus = \"queued\" | \"running\" | \"succeeded\" | \"failed\" | \"cancelled\"\n\nexport const ACTION_RUN_PHASES = [\n  \"request\",\n  \"enqueue\",\n  \"validation\",\n  \"writeback\",\n  \"edits\",\n  \"commit\",\n  \"effects\",\n  \"cancelled\",\n] as const\n\nexport type ActionRunPhase = (typeof ACTION_RUN_PHASES)[number]\n\nexport type ActionRunParams = Readonly<Record<string, JsonValue>>\n\nexport type ActionRunPhaseStatus = \"succeeded\" | \"failed\"\n\n/** Error codes an action run or phase record can persist and expose. */\nexport const ACTION_RUN_FAILURE_CODES = [\n  \"internal.unexpected\",\n  \"runtime.cancelled\",\n  \"queue.enqueue_failed\",\n  \"action.phase_failed\",\n  \"action.read_conflict\",\n] as const satisfies readonly [SixbErrorCode, ...SixbErrorCode[]]\n\nexport type ActionRunFailureCode = (typeof ACTION_RUN_FAILURE_CODES)[number]\n\nexport interface ActionRunFailureDetails<TPhase extends ActionRunPhase = ActionRunPhase> {\n  readonly actionId: string\n  readonly runId: string\n  readonly phase: TPhase\n}\n\n/** Portable failure record with Action's required correlation details. */\nexport interface ActionRunFailure<TPhase extends ActionRunPhase = ActionRunPhase>\n  extends Omit<SixbFailure<ActionRunFailureCode>, \"details\"> {\n  readonly details: ActionRunFailureDetails<TPhase>\n}\n\nexport type ActionRunWritebackRecord =\n  | {\n      readonly status: \"succeeded\"\n      readonly completedAt: Date\n      readonly result: JsonValue\n      readonly error?: never\n    }\n  | {\n      readonly status: \"failed\"\n      readonly completedAt: Date\n      readonly result?: never\n      readonly error: ActionRunFailure<\"writeback\">\n    }\n\nexport type ActionRunEffectsRecord =\n  | {\n      readonly status: \"succeeded\"\n      readonly completedAt: Date\n      readonly error?: never\n    }\n  | {\n      readonly status: \"failed\"\n      readonly completedAt: Date\n      readonly error: ActionRunFailure<\"effects\">\n    }\n\nexport interface ActionRunRecord {\n  readonly id: string\n  readonly projectId: string\n  readonly executionId: string\n  readonly actionId: string\n  readonly subject: ActionSubject\n  readonly status: ActionRunStatus\n  readonly phase?: ActionRunPhase\n  readonly queuedAt: Date\n  readonly startedAt?: Date\n  readonly finishedAt?: Date\n  readonly params: ActionRunParams\n  readonly idempotencyKey: string\n  readonly writeback?: ActionRunWritebackRecord\n  readonly effects?: ActionRunEffectsRecord\n  readonly error?: ActionRunFailure\n}\n\nexport interface QueueActionRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly executionId: string\n  readonly actionId: string\n  readonly subject: ActionSubject\n  readonly params: ActionRunParams\n  readonly idempotencyKey: string\n  readonly queuedAt?: Date\n}\n\nexport interface StartActionRunInput {\n  readonly id: string\n  readonly projectId: string\n  readonly startedAt?: Date\n  readonly phase?: Extract<ActionRunPhase, \"validation\">\n}\n\nexport interface EnterActionRunPhaseInput {\n  readonly id: string\n  readonly projectId: string\n  readonly phase: Extract<\n    ActionRunPhase,\n    \"validation\" | \"writeback\" | \"edits\" | \"commit\" | \"effects\"\n  >\n}\n\nexport type RecordActionWritebackInput =\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"succeeded\"\n      readonly completedAt?: Date\n      readonly result: JsonValue\n    }\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"failed\"\n      readonly completedAt?: Date\n      readonly error: ActionRunFailure<\"writeback\">\n    }\n\nexport type RecordActionEffectsInput =\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"succeeded\"\n      readonly completedAt?: Date\n    }\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"failed\"\n      readonly completedAt?: Date\n      readonly error: ActionRunFailure<\"effects\">\n    }\n\nexport type FinishActionRunInput =\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"succeeded\"\n      readonly finishedAt?: Date\n      readonly phase?: ActionRunPhase\n    }\n  | {\n      readonly id: string\n      readonly projectId: string\n      readonly status: \"failed\" | \"cancelled\"\n      readonly finishedAt?: Date\n      readonly error: ActionRunFailure\n    }\n\nexport interface ListActionRunsInput {\n  readonly projectId: string\n  readonly actionId?: string\n  readonly actionIds?: readonly string[]\n  readonly subject?: ActionSubject\n  readonly objectTypeId?: string\n  readonly objectTypeIds?: readonly string[]\n  readonly primaryId?: string\n  readonly statuses?: readonly ActionRunStatus[]\n  readonly startedAfter?: Date\n  readonly startedBefore?: Date\n  readonly limit?: number\n  readonly offset?: number\n  readonly order?: \"asc\" | \"desc\"\n}\n\nexport interface ListActionRunsResult {\n  readonly runs: readonly ActionRunRecord[]\n  readonly hasMore: boolean\n  readonly total: number\n}\n\nexport interface LockActionMaterializationRunInput {\n  readonly projectId: string\n  readonly actionId: string\n  readonly runId: string\n}\n\nexport interface ActionRunStorage {\n  /** Transactional fence for Action identity and running state before a new ontology commit. */\n  lockForMaterialization(input: LockActionMaterializationRunInput): Promise<ActionRunRecord>\n  queue(input: QueueActionRunInput): Promise<ActionRunRecord>\n  start(input: StartActionRunInput): Promise<ActionRunRecord>\n  enterPhase(input: EnterActionRunPhaseInput): Promise<ActionRunRecord>\n  recordWriteback(input: RecordActionWritebackInput): Promise<ActionRunRecord>\n  recordEffects(input: RecordActionEffectsInput): Promise<ActionRunRecord>\n  finish(input: FinishActionRunInput): Promise<ActionRunRecord>\n  getById(params: { projectId: string; id: string }): Promise<ActionRunRecord | null>\n  list(input: ListActionRunsInput): Promise<ListActionRunsResult>\n}\n",
-    "import { parseSixbFailure } from \"../../errors/internal\"\nimport { isPlainRecord } from \"../../json\"\nimport {\n  ACTION_RUN_FAILURE_CODES,\n  ACTION_RUN_PHASES,\n  type ActionRunFailure,\n  type ActionRunFailureDetails,\n  type ActionRunPhase,\n} from \"./types\"\n\n/** Serializes the canonical failure plus Action's typed lifecycle extension. */\nexport function serializeActionRunFailure<TPhase extends ActionRunPhase>(\n  failure: ActionRunFailure<TPhase>,\n  expectedPhase?: TPhase\n): string {\n  const parsed =\n    expectedPhase === undefined\n      ? parseActionRunFailure(failure)\n      : parseActionRunFailure(failure, expectedPhase)\n  return JSON.stringify(parsed)\n}\n\n/** Validates and detaches an Action failure read from a storage boundary. */\nexport function parseActionRunFailure<TPhase extends ActionRunPhase>(\n  value: unknown,\n  expectedPhase: TPhase\n): ActionRunFailure<TPhase>\nexport function parseActionRunFailure(value: unknown): ActionRunFailure\nexport function parseActionRunFailure(\n  value: unknown,\n  expectedPhase?: ActionRunPhase\n): ActionRunFailure {\n  const candidate = parseStoredActionRunFailureValue(value)\n  const failure = parseSixbFailure(candidate, ACTION_RUN_FAILURE_CODES)\n  const details = failure.details\n  if (\n    !isPlainRecord(details) ||\n    typeof details.actionId !== \"string\" ||\n    typeof details.runId !== \"string\" ||\n    typeof details.phase !== \"string\" ||\n    !(ACTION_RUN_PHASES as readonly string[]).includes(details.phase)\n  ) {\n    throw new Error(\n      \"[Sixb] Stored failure is invalid: Action details must contain actionId, runId, and a known phase.\"\n    )\n  }\n  if (expectedPhase !== undefined && details.phase !== expectedPhase) {\n    throw new Error(`[Sixb] Stored Action ${expectedPhase} failure has phase '${details.phase}'.`)\n  }\n\n  return {\n    ...failure,\n    details: details as unknown as ActionRunFailureDetails,\n  }\n}\n\nfunction parseStoredActionRunFailureValue(value: unknown): unknown {\n  if (typeof value !== \"string\") return value\n  try {\n    return JSON.parse(value) as unknown\n  } catch {\n    throw new Error(\"[Sixb] Stored failure is invalid: value is not valid JSON.\")\n  }\n}\n"
-  ],
-  "mappings": ";;;;;;;;;AAMO,IAAM,qBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASO,IAAM,4BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;ACnBO,SAAS,0BAAwD,CACtE,SACA,eACQ;AAAA,EACR,MAAM,SACJ,kBAAkB,YACd,uBAAsB,OAAO,IAC7B,uBAAsB,SAAS,aAAa;AAAA,EAClD,OAAO,KAAK,UAAU,MAAM;AAAA;AASvB,SAAS,sBAAqB,CACnC,OACA,eACkB;AAAA,EAClB,MAAM,YAAY,iCAAiC,KAAK;AAAA,EACxD,MAAM,UAAU,kBAAiB,WAAW,yBAAwB;AAAA,EACpE,MAAM,UAAU,QAAQ;AAAA,EACxB,IACE,CAAC,cAAc,OAAO,KACtB,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,UAAU,YACzB,OAAO,QAAQ,UAAU,YACzB,CAAE,mBAAwC,SAAS,QAAQ,KAAK,GAChE;AAAA,IACA,MAAM,IAAI,MACR,mGACF;AAAA,EACF;AAAA,EACA,IAAI,kBAAkB,aAAa,QAAQ,UAAU,eAAe;AAAA,IAClE,MAAM,IAAI,MAAM,wBAAwB,oCAAoC,QAAQ,SAAS;AAAA,EAC/F;AAAA,EAEA,OAAO;AAAA,OACF;AAAA,IACH;AAAA,EACF;AAAA;AAGF,SAAS,gCAAgC,CAAC,OAAyB;AAAA,EACjE,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,IAAI;AAAA,IACF,OAAO,KAAK,MAAM,KAAK;AAAA,IACvB,MAAM;AAAA,IACN,MAAM,IAAI,MAAM,4DAA4D;AAAA;AAAA;",
-  "debugId": "4C1D77261542AF7164756E2164756E21",
-  "names": []
-}

package/dist/chunk-y9jmd7e5.js.map

@@ -1,15 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/storage/action-runs/idempotency.ts", "../src/storage/errors.ts", "../src/storage/file-download-grants/record.ts", "../src/storage/pipeline-runs/idempotency.ts", "../src/storage/sync-runs/idempotency.ts", "../src/storage/transaction.ts"],
-  "sourcesContent": [
-    "import type { ActionSubject } from \"../../actions\"\nimport { stableJsonStringify } from \"../../json\"\nimport type {\n  ActionRunEffectsRecord,\n  ActionRunPhase,\n  ActionRunRecord,\n  ActionRunWritebackRecord,\n  FinishActionRunInput,\n  QueueActionRunInput,\n} from \"./types\"\n\nexport function actionSubjectsEqual(left: ActionSubject, right: ActionSubject): boolean {\n  if (left.kind !== right.kind) return false\n  if (left.kind === \"none\") return true\n  if (right.kind === \"none\") return false\n  return left.objectTypeId === right.objectTypeId && left.primaryId === right.primaryId\n}\n\nexport function actionRunParamsEqual(left: unknown, right: unknown): boolean {\n  return stableJsonStringify(left) === stableJsonStringify(right)\n}\n\nexport type ActionRunPhaseRecord = ActionRunWritebackRecord | ActionRunEffectsRecord\n\nexport function actionRunPhaseRecordsEqual(\n  left: ActionRunPhaseRecord,\n  right: ActionRunPhaseRecord\n): boolean {\n  return actionRunParamsEqual(stripPhaseRecordCompletedAt(left), stripPhaseRecordCompletedAt(right))\n}\n\nexport function finishActionRunPhase(\n  input: FinishActionRunInput,\n  current: ActionRunPhase | null | undefined\n): ActionRunPhase {\n  if (input.status === \"succeeded\") {\n    return input.phase ?? current ?? \"validation\"\n  }\n\n  return input.error.details.phase\n}\n\nexport function canRequeueActionRunAfterEnqueueFailure(\n  existing: ActionRunRecord,\n  input: QueueActionRunInput\n): boolean {\n  return (\n    existing.status === \"failed\" &&\n    existing.phase === \"enqueue\" &&\n    existing.executionId === input.executionId &&\n    existing.error?.retryable === true &&\n    existing.actionId === input.actionId &&\n    existing.idempotencyKey === input.idempotencyKey &&\n    actionSubjectsEqual(existing.subject, input.subject) &&\n    actionRunParamsEqual(existing.params, input.params)\n  )\n}\n\nexport function isTerminalActionRun(record: Pick<ActionRunRecord, \"status\">): boolean {\n  return (\n    record.status === \"succeeded\" || record.status === \"failed\" || record.status === \"cancelled\"\n  )\n}\n\nfunction stripPhaseRecordCompletedAt(\n  record: ActionRunPhaseRecord\n): Omit<ActionRunPhaseRecord, \"completedAt\"> {\n  const { completedAt: _completedAt, ...stableRecord } = record\n  return stableRecord\n}\n",
-    "/**\n * Thrown when a storage lookup by primary ID finds no matching object.\n * Carries structured context so callers can discriminate without string parsing.\n */\nexport class ObjectNotFoundError extends Error {\n  readonly name = \"ObjectNotFoundError\"\n\n  constructor(\n    readonly objectTypeId: string,\n    readonly primaryId: string,\n    readonly context: string\n  ) {\n    super(`[Sixb] ${context}: ${objectTypeId}:${primaryId}`)\n  }\n}\n\nexport class ObjectStorageError extends Error {\n  readonly name = \"ObjectStorageError\"\n}\n\nexport type StorageTransactionErrorCode =\n  | \"nested_transaction\"\n  | \"serialization_failure\"\n  | \"transaction_inactive\"\n\nexport interface StorageTransactionErrorOptions {\n  readonly cause?: unknown\n  readonly code?: StorageTransactionErrorCode\n}\n\nexport class StorageTransactionError extends Error {\n  readonly name = \"StorageTransactionError\"\n  readonly code?: StorageTransactionErrorCode\n  override readonly cause?: unknown\n\n  constructor(message: string, options: StorageTransactionErrorOptions = {}) {\n    super(message)\n    this.code = options.code\n    this.cause = options.cause\n  }\n}\n\nexport function isStorageSerializationFailure(error: unknown): boolean {\n  return error instanceof StorageTransactionError && error.code === \"serialization_failure\"\n}\n",
-    "import { isFileRef } from \"../../blob-storage\"\nimport type { FileDownloadGrantRecord } from \"./types\"\n\n/**\n * Rebuilds a grant from a provider row with camelCase keys. `file` may arrive parsed (jsonb) or\n * as text (SQLite), and timestamps as `Date` or ISO text. Fails closed on corruption: a grant that\n * cannot be read must not serve a file.\n */\nexport function parseFileDownloadGrantRow(row: {\n  readonly [column: string]: unknown\n}): FileDownloadGrantRecord {\n  const id = text(row.id, \"id\", String(row.id))\n  const file = typeof row.file === \"string\" ? JSON.parse(row.file) : row.file\n  if (!isFileRef(file)) throw corrupt(id, \"file is not a file reference\")\n\n  return {\n    id,\n    projectId: text(row.projectId, \"projectId\", id),\n    tokenHash: text(row.tokenHash, \"tokenHash\", id),\n    file,\n    executionId: text(row.executionId, \"executionId\", id),\n    createdAt: date(row.createdAt, \"createdAt\", id),\n    expiresAt: date(row.expiresAt, \"expiresAt\", id),\n    ...(row.revokedAt == null ? {} : { revokedAt: date(row.revokedAt, \"revokedAt\", id) }),\n  }\n}\n\nexport function cloneFileDownloadGrantRecord(\n  record: FileDownloadGrantRecord\n): FileDownloadGrantRecord {\n  return structuredClone(record)\n}\n\nfunction text(value: unknown, column: string, id: string): string {\n  if (typeof value !== \"string\" || value.length === 0) throw corrupt(id, `${column} is not text`)\n  return value\n}\n\nfunction date(value: unknown, column: string, id: string): Date {\n  const parsed = value instanceof Date || typeof value === \"string\" ? new Date(value) : null\n  if (!parsed || !Number.isFinite(parsed.getTime())) throw corrupt(id, `${column} is not a date`)\n  return parsed\n}\n\nfunction corrupt(id: string, reason: string): Error {\n  return new Error(`[Sixb] Stored file download grant '${id}' is invalid: ${reason}.`)\n}\n",
-    "import type { PipelineRunRecord, QueuePipelineRunInput } from \"./types\"\n\nexport function canRequeuePipelineRunAfterEnqueueFailure(\n  existing: PipelineRunRecord,\n  input: QueuePipelineRunInput\n): boolean {\n  return (\n    existing.status === \"failed\" &&\n    existing.error?.code === \"queue.enqueue_failed\" &&\n    existing.error.retryable &&\n    existing.executionId === input.executionId &&\n    existing.pipelineId === input.pipelineId\n  )\n}\n",
-    "import type { QueueSyncRunInput, SyncRunRecord } from \"./types\"\n\nexport function canRequeueSyncRunAfterEnqueueFailure(\n  existing: SyncRunRecord,\n  input: QueueSyncRunInput\n): boolean {\n  return (\n    existing.status === \"failed\" &&\n    existing.error?.code === \"queue.enqueue_failed\" &&\n    existing.error.retryable &&\n    existing.executionId === input.executionId &&\n    existing.syncId === input.syncId &&\n    existing.datasetId === input.datasetId &&\n    existing.mode === input.mode &&\n    existing.expectedLatestVersionId === input.expectedLatestVersionId &&\n    existing.commitMessage === input.commitMessage\n  )\n}\n",
-    "import { StorageTransactionError } from \"./errors\"\nimport { createObjectOperationScope } from \"./operation-scope\"\nimport type { Storage } from \"./types\"\n\ntype ObjectLike = Record<PropertyKey, unknown>\n\nexport function createTransactionStorageProxy<T extends Storage>(\n  target: T,\n  isActive: () => boolean\n): T {\n  const proxies = new WeakMap<object, object>()\n  const objectStorage = createObjectOperationScope(target.objects, {\n    assertAvailable: () => assertTransactionActive(isActive),\n    run: async <TResult>(operation: () => Promise<TResult> | TResult): Promise<TResult> => {\n      assertTransactionActive(isActive)\n      return operation()\n    },\n  })\n\n  const wrap = <TValue extends object>(value: TValue): TValue => {\n    const existing = proxies.get(value)\n    if (existing) return existing as TValue\n\n    const proxy = new Proxy(value as ObjectLike, {\n      // The guard runs on property access and on call. Its purpose is to fail fast when a\n      // transaction handle (`tx`) leaks past the transaction's lifetime — using it afterward is a\n      // bug, not a recoverable state. Overhead is bounded: only the storage namespaces reachable\n      // from `tx` are wrapped (a handful), not the row/link data graph, and never per-record.\n      get(current, property, receiver) {\n        assertTransactionActive(isActive)\n        const result =\n          current === target && property === \"objects\"\n            ? objectStorage\n            : Reflect.get(current, property, receiver)\n        if (typeof result === \"function\") {\n          return (...args: unknown[]) => {\n            assertTransactionActive(isActive)\n            return result.apply(current, args)\n          }\n        }\n        if (result && typeof result === \"object\") {\n          return wrap(result)\n        }\n        return result\n      },\n    })\n\n    proxies.set(value, proxy)\n    return proxy as TValue\n  }\n\n  return wrap(target)\n}\n\nexport function assertTransactionActive(isActive: () => boolean): void {\n  if (!isActive()) {\n    throw new StorageTransactionError(\n      \"[Sixb] Transaction storage cannot be used after transaction completion.\",\n      { code: \"transaction_inactive\" }\n    )\n  }\n}\n\nexport function throwNestedStorageTransaction(): never {\n  throw new StorageTransactionError(\"[Sixb] Nested storage transactions are not supported yet.\", {\n    code: \"nested_transaction\",\n  })\n}\n"
-  ],
-  "mappings": ";;;;;;;;;;;;AAWO,SAAS,oBAAmB,CAAC,MAAqB,OAA+B;AAAA,EACtF,IAAI,KAAK,SAAS,MAAM;AAAA,IAAM,OAAO;AAAA,EACrC,IAAI,KAAK,SAAS;AAAA,IAAQ,OAAO;AAAA,EACjC,IAAI,MAAM,SAAS;AAAA,IAAQ,OAAO;AAAA,EAClC,OAAO,KAAK,iBAAiB,MAAM,gBAAgB,KAAK,cAAc,MAAM;AAAA;AAGvE,SAAS,qBAAoB,CAAC,MAAe,OAAyB;AAAA,EAC3E,OAAO,qBAAoB,IAAI,MAAM,qBAAoB,KAAK;AAAA;AAKzD,SAAS,2BAA0B,CACxC,MACA,OACS;AAAA,EACT,OAAO,sBAAqB,4BAA4B,IAAI,GAAG,4BAA4B,KAAK,CAAC;AAAA;AAG5F,SAAS,qBAAoB,CAClC,OACA,SACgB;AAAA,EAChB,IAAI,MAAM,WAAW,aAAa;AAAA,IAChC,OAAO,MAAM,SAAS,WAAW;AAAA,EACnC;AAAA,EAEA,OAAO,MAAM,MAAM,QAAQ;AAAA;AAGtB,SAAS,uCAAsC,CACpD,UACA,OACS;AAAA,EACT,OACE,SAAS,WAAW,YACpB,SAAS,UAAU,aACnB,SAAS,gBAAgB,MAAM,eAC/B,SAAS,OAAO,cAAc,QAC9B,SAAS,aAAa,MAAM,YAC5B,SAAS,mBAAmB,MAAM,kBAClC,qBAAoB,SAAS,SAAS,MAAM,OAAO,KACnD,sBAAqB,SAAS,QAAQ,MAAM,MAAM;AAAA;AAI/C,SAAS,oBAAmB,CAAC,QAAkD;AAAA,EACpF,OACE,OAAO,WAAW,eAAe,OAAO,WAAW,YAAY,OAAO,WAAW;AAAA;AAIrF,SAAS,2BAA2B,CAClC,QAC2C;AAAA,EAC3C,QAAQ,aAAa,iBAAiB,iBAAiB;AAAA,EACvD,OAAO;AAAA;;;AChEF,MAAM,6BAA4B,MAAM;AAAA,EAIlC;AAAA,EACA;AAAA,EACA;AAAA,EALF,OAAO;AAAA,EAEhB,WAAW,CACA,cACA,WACA,SACT;AAAA,IACA,MAAM,UAAU,YAAY,gBAAgB,WAAW;AAAA,IAJ9C;AAAA,IACA;AAAA,IACA;AAAA;AAIb;AAAA;AAEO,MAAM,4BAA2B,MAAM;AAAA,EACnC,OAAO;AAClB;AAAA;AAYO,MAAM,iCAAgC,MAAM;AAAA,EACxC,OAAO;AAAA,EACP;AAAA,EACS;AAAA,EAElB,WAAW,CAAC,SAAiB,UAA0C,CAAC,GAAG;AAAA,IACzE,MAAM,OAAO;AAAA,IACb,KAAK,OAAO,QAAQ;AAAA,IACpB,KAAK,QAAQ,QAAQ;AAAA;AAEzB;AAEO,SAAS,8BAA6B,CAAC,OAAyB;AAAA,EACrE,OAAO,iBAAiB,4BAA2B,MAAM,SAAS;AAAA;;;ACnC7D,SAAS,0BAAyB,CAAC,KAEd;AAAA,EAC1B,MAAM,KAAK,KAAK,IAAI,IAAI,MAAM,OAAO,IAAI,EAAE,CAAC;AAAA,EAC5C,MAAM,OAAO,OAAO,IAAI,SAAS,WAAW,KAAK,MAAM,IAAI,IAAI,IAAI,IAAI;AAAA,EACvE,IAAI,CAAC,WAAU,IAAI;AAAA,IAAG,MAAM,QAAQ,IAAI,8BAA8B;AAAA,EAEtE,OAAO;AAAA,IACL;AAAA,IACA,WAAW,KAAK,IAAI,WAAW,aAAa,EAAE;AAAA,IAC9C,WAAW,KAAK,IAAI,WAAW,aAAa,EAAE;AAAA,IAC9C;AAAA,IACA,aAAa,KAAK,IAAI,aAAa,eAAe,EAAE;AAAA,IACpD,WAAW,KAAK,IAAI,WAAW,aAAa,EAAE;AAAA,IAC9C,WAAW,KAAK,IAAI,WAAW,aAAa,EAAE;AAAA,OAC1C,IAAI,aAAa,OAAO,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,WAAW,aAAa,EAAE,EAAE;AAAA,EACrF;AAAA;AAGK,SAAS,4BAA4B,CAC1C,QACyB;AAAA,EACzB,OAAO,gBAAgB,MAAM;AAAA;AAG/B,SAAS,IAAI,CAAC,OAAgB,QAAgB,IAAoB;AAAA,EAChE,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW;AAAA,IAAG,MAAM,QAAQ,IAAI,GAAG,oBAAoB;AAAA,EAC9F,OAAO;AAAA;AAGT,SAAS,IAAI,CAAC,OAAgB,QAAgB,IAAkB;AAAA,EAC9D,MAAM,SAAS,iBAAiB,QAAQ,OAAO,UAAU,WAAW,IAAI,KAAK,KAAK,IAAI;AAAA,EACtF,IAAI,CAAC,UAAU,CAAC,OAAO,SAAS,OAAO,QAAQ,CAAC;AAAA,IAAG,MAAM,QAAQ,IAAI,GAAG,sBAAsB;AAAA,EAC9F,OAAO;AAAA;AAGT,SAAS,OAAO,CAAC,IAAY,QAAuB;AAAA,EAClD,OAAO,IAAI,MAAM,sCAAsC,mBAAmB,SAAS;AAAA;;;AC3C9E,SAAS,yCAAwC,CACtD,UACA,OACS;AAAA,EACT,OACE,SAAS,WAAW,YACpB,SAAS,OAAO,SAAS,0BACzB,SAAS,MAAM,aACf,SAAS,gBAAgB,MAAM,eAC/B,SAAS,eAAe,MAAM;AAAA;;;ACT3B,SAAS,qCAAoC,CAClD,UACA,OACS;AAAA,EACT,OACE,SAAS,WAAW,YACpB,SAAS,OAAO,SAAS,0BACzB,SAAS,MAAM,aACf,SAAS,gBAAgB,MAAM,eAC/B,SAAS,WAAW,MAAM,UAC1B,SAAS,cAAc,MAAM,aAC7B,SAAS,SAAS,MAAM,QACxB,SAAS,4BAA4B,MAAM,2BAC3C,SAAS,kBAAkB,MAAM;AAAA;;;ACT9B,SAAS,8BAAgD,CAC9D,QACA,UACG;AAAA,EACH,MAAM,UAAU,IAAI;AAAA,EACpB,MAAM,gBAAgB,4BAA2B,OAAO,SAAS;AAAA,IAC/D,iBAAiB,MAAM,yBAAwB,QAAQ;AAAA,IACvD,KAAK,OAAgB,cAAkE;AAAA,MACrF,yBAAwB,QAAQ;AAAA,MAChC,OAAO,UAAU;AAAA;AAAA,EAErB,CAAC;AAAA,EAED,MAAM,OAAO,CAAwB,UAA0B;AAAA,IAC7D,MAAM,WAAW,QAAQ,IAAI,KAAK;AAAA,IAClC,IAAI;AAAA,MAAU,OAAO;AAAA,IAErB,MAAM,QAAQ,IAAI,MAAM,OAAqB;AAAA,MAK3C,GAAG,CAAC,SAAS,UAAU,UAAU;AAAA,QAC/B,yBAAwB,QAAQ;AAAA,QAChC,MAAM,SACJ,YAAY,UAAU,aAAa,YAC/B,gBACA,QAAQ,IAAI,SAAS,UAAU,QAAQ;AAAA,QAC7C,IAAI,OAAO,WAAW,YAAY;AAAA,UAChC,OAAO,IAAI,SAAoB;AAAA,YAC7B,yBAAwB,QAAQ;AAAA,YAChC,OAAO,OAAO,MAAM,SAAS,IAAI;AAAA;AAAA,QAErC;AAAA,QACA,IAAI,UAAU,OAAO,WAAW,UAAU;AAAA,UACxC,OAAO,KAAK,MAAM;AAAA,QACpB;AAAA,QACA,OAAO;AAAA;AAAA,IAEX,CAAC;AAAA,IAED,QAAQ,IAAI,OAAO,KAAK;AAAA,IACxB,OAAO;AAAA;AAAA,EAGT,OAAO,KAAK,MAAM;AAAA;AAGb,SAAS,wBAAuB,CAAC,UAA+B;AAAA,EACrE,IAAI,CAAC,SAAS,GAAG;AAAA,IACf,MAAM,IAAI,yBACR,2EACA,EAAE,MAAM,uBAAuB,CACjC;AAAA,EACF;AAAA;AAGK,SAAS,8BAA6B,GAAU;AAAA,EACrD,MAAM,IAAI,yBAAwB,6DAA6D;AAAA,IAC7F,MAAM;AAAA,EACR,CAAC;AAAA;",
-  "debugId": "8C3E5A53727ECCEF64756E2164756E21",
-  "names": []
-}

package/dist/chunk-zvx7h87b.js

@@ -1,12 +0,0 @@
-// @bun
-// src/edits/errors.ts
-class EditBatchError2 extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "EditBatchError";
-  }
-}
-
-export { EditBatchError2 };
-
-//# debugId=EB0A82B55DCF58C664756E2164756E21

package/dist/chunk-zvx7h87b.js.map

@@ -1,10 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/edits/errors.ts"],
-  "sourcesContent": [
-    "export class EditBatchError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = \"EditBatchError\"\n  }\n}\n"
-  ],
-  "mappings": ";;AAAO,MAAM,wBAAuB,MAAM;AAAA,EACxC,WAAW,CAAC,SAAiB;AAAA,IAC3B,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA;AAEhB;",
-  "debugId": "EB0A82B55DCF58C664756E2164756E21",
-  "names": []
-}

package/dist/events/types/actions.d.ts

@@ -1,39 +0,0 @@
-import type { ActionSubject } from "../../actions";
-import type { ActionRunFailure } from "../../storage";
-import type { EventEnvelope } from "../envelope";
-export interface ActionRequestedEvent extends EventEnvelope {
-    type: "action.requested";
-    topic: "actions";
-    partitionKey: string;
-    payload: {
-        actionId: string;
-        subject: ActionSubject;
-        params: Record<string, unknown>;
-        runId: string;
-    };
-}
-export interface ActionCompletedEvent extends EventEnvelope {
-    type: "action.completed";
-    topic: "actions";
-    partitionKey: string;
-    payload: {
-        actionId: string;
-        runId: string;
-        subject: ActionSubject;
-        finishedAt: string;
-    };
-}
-export interface ActionFailedEvent extends EventEnvelope {
-    type: "action.failed";
-    topic: "actions";
-    partitionKey: string;
-    payload: {
-        actionId: string;
-        runId: string;
-        subject: ActionSubject;
-        error: ActionRunFailure;
-        finishedAt: string;
-    };
-}
-export type ActionEvent = ActionRequestedEvent | ActionCompletedEvent | ActionFailedEvent;
-//# sourceMappingURL=actions.d.ts.map

package/dist/events/types/actions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../../src/events/types/actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAEhD,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,IAAI,EAAE,kBAAkB,CAAA;IACxB,KAAK,EAAE,SAAS,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,aAAa,CAAA;QACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC/B,KAAK,EAAE,MAAM,CAAA;KACd,CAAA;CACF;AAED,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,IAAI,EAAE,kBAAkB,CAAA;IACxB,KAAK,EAAE,SAAS,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;QACb,OAAO,EAAE,aAAa,CAAA;QACtB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF;AAED,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,IAAI,EAAE,eAAe,CAAA;IACrB,KAAK,EAAE,SAAS,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE;QACP,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;QACb,OAAO,EAAE,aAAa,CAAA;QACtB,KAAK,EAAE,gBAAgB,CAAA;QACvB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF;AAED,MAAM,MAAM,WAAW,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,iBAAiB,CAAA"}

package/dist/objects/service/action-service.d.ts

@@ -1,13 +0,0 @@
-/**
- * Service layer for action operations.
- *
- * Resolves objectTypeId to a typed context and delegates to the leaf function.
- */
-import type { RequestActionResult } from "../../actions/request";
-import type { ExecutionContext } from "../../execution";
-import type { SixbRuntimeContext } from "../../runtime/types";
-import type { ActionRunRecord } from "../../storage";
-import { type RequestActionAndWaitOptions, type RequestActionOptions } from "../action";
-export declare function requestAction(runtime: SixbRuntimeContext, execution: ExecutionContext, objectTypeId: string, primaryId: string, actionId: string, params?: Record<string, unknown>, options?: RequestActionOptions): Promise<RequestActionResult>;
-export declare function requestActionAndWait(runtime: SixbRuntimeContext, execution: ExecutionContext, objectTypeId: string, primaryId: string, actionId: string, params?: Record<string, unknown>, options?: RequestActionAndWaitOptions): Promise<ActionRunRecord>;
-//# sourceMappingURL=action-service.d.ts.map

package/dist/objects/service/action-service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"action-service.d.ts","sourceRoot":"","sources":["../../../src/objects/service/action-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EAG1B,MAAM,WAAW,CAAA;AAGlB,wBAAsB,aAAa,CACjC,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAG9B;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,eAAe,CAAC,CAG1B"}

package/dist/security/applications.d.ts

@@ -1,15 +0,0 @@
-/** Browser applications that can be protected by role grants. */
-export declare const applications: {
-    readonly atlas: {
-        readonly kind: "application";
-        readonly id: "atlas";
-        readonly label: "Atlas";
-    };
-    readonly app: {
-        readonly kind: "application";
-        readonly id: "app";
-        readonly label: "Custom app";
-    };
-};
-export declare const APPLICATION_IDS: ReadonlySet<string>;
-//# sourceMappingURL=applications.d.ts.map

package/dist/security/applications.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"applications.d.ts","sourceRoot":"","sources":["../../src/security/applications.ts"],"names":[],"mappings":"AAEA,iEAAiE;AACjE,eAAO,MAAM,YAAY;;;;;;;;;;;CAG2C,CAAA;AAEpE,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAE/C,CAAA"}