@sixb/core 0.1.19 → 0.1.20

package/dist/chunk-enpsx8k5.js.map

@@ -1,10 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/authorization/grant-kinds.ts"],
-  "sourcesContent": [
-    "/**\n * Grant kinds: the single source of truth for the (capability, target) space.\n *\n * Every grant collapses to one `GrantKind` discriminant — the same\n * `capability:target` string the decision engine uses as a grant key (e.g.\n * `view:object`, `run:sync`). Resolution, validation, enforcement, and the\n * resolved `GrantIndex` all key off it, so adding a grant family is a single\n * entry in `GRANT_KINDS` plus the compile errors that forces at every consumer.\n */\n\nimport type { AgentRunGrant, GrantDefinition } from \"../security/types\"\n\nexport type GrantKind =\n  | \"access:application\"\n  | \"view:object\"\n  | \"view:dataset\"\n  | \"edit:object\"\n  | \"append:telemetry\"\n  | \"apply:action\"\n  | \"share:share\"\n  | \"run:workflow\"\n  | \"run:sync\"\n  | \"run:pipeline\"\n  | \"run:agent\"\n  | \"observe:logs\"\n  | \"observe:aiUsage\"\n  | \"manage:connector\"\n  | \"manage:aiUsage\"\n\nexport type SingletonGrantKind = \"run:agent\"\nexport type TargetedGrantKind = Exclude<GrantKind, SingletonGrantKind>\n\n/** Registered id universes a grant kind ranges over, plus subtype expansion. */\nexport interface GrantUniverse {\n  readonly applicationIds: ReadonlySet<string>\n  readonly objectTypeIds: ReadonlySet<string>\n  readonly datasetIds: ReadonlySet<string>\n  readonly actionIds: ReadonlySet<string>\n  readonly shareIds: ReadonlySet<string>\n  readonly workflowIds: ReadonlySet<string>\n  readonly syncIds: ReadonlySet<string>\n  readonly pipelineIds: ReadonlySet<string>\n  readonly observableIds: ReadonlySet<string>\n  readonly connectorIds: ReadonlySet<string>\n  readonly manageableIds: ReadonlySet<string>\n  readonly getSubTypes: (objectTypeId: string) => readonly string[]\n}\n\n/** The registered-id sets a grant kind validates against (no subtype hook). */\nexport type GrantUniverseKey = Exclude<keyof GrantUniverse, \"getSubTypes\">\n\ninterface TargetedGrantKindSpec {\n  /** Registered universe the grant's ids must belong to. */\n  readonly universeKey: GrantUniverseKey\n  /** Subject noun used in validation errors (\"unknown <subject> '<id>'\"). */\n  readonly subject: string\n  /** Actionable hint appended to the \"unknown <subject>\" error. */\n  readonly fix: string\n  /** Only object-type grants also expand to subtypes. */\n  readonly expandsSubtypes?: true\n}\n\ninterface SingletonGrantKindSpec {\n  /** Project-wide capability with no resource selection; resolves to a boolean. */\n  readonly singleton: true\n  readonly subject: string\n  readonly fix: string\n}\n\n/**\n * The exhaustive grant-kind table. A new grant family is one entry here; the\n * mapped type makes every omission a compile error.\n */\nexport const GRANT_KINDS: {\n  readonly [TKind in GrantKind]: TKind extends SingletonGrantKind\n    ? SingletonGrantKindSpec\n    : TargetedGrantKindSpec\n} = {\n  \"access:application\": {\n    universeKey: \"applicationIds\",\n    subject: \"application\",\n    fix: \"Use an application exported from '@sixb/core'.\",\n  },\n  \"view:object\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n    expandsSubtypes: true,\n  },\n  \"view:dataset\": {\n    universeKey: \"datasetIds\",\n    subject: \"dataset\",\n    fix: \"Add it to 'datasets/' or pass it to createSixb({ datasets }).\",\n  },\n  // Deliberately no `expandsSubtypes`: granting writes on a parent type must not\n  // silently extend to types added under it later. `view:object` expands because\n  // a read of a subtype reveals nothing the parent's grant did not already cover.\n  \"edit:object\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n  },\n  \"append:telemetry\": {\n    universeKey: \"objectTypeIds\",\n    subject: \"object type\",\n    fix: \"Register it in 'ontology/' or pass it to createSixb({ ontologies }).\",\n  },\n  \"apply:action\": {\n    universeKey: \"actionIds\",\n    subject: \"action\",\n    fix: \"Add it to 'actions/' or pass it to createSixb({ actions }).\",\n  },\n  \"share:share\": {\n    universeKey: \"shareIds\",\n    subject: \"share\",\n    fix: \"Add it to 'shares/' or pass it to createSixb({ shares }).\",\n  },\n  \"run:workflow\": {\n    universeKey: \"workflowIds\",\n    subject: \"workflow\",\n    fix: \"Add it to 'workflows/' or pass it to createSixb({ workflows }).\",\n  },\n  \"run:sync\": {\n    universeKey: \"syncIds\",\n    subject: \"sync\",\n    fix: \"Add it to 'syncs/' or pass it to createSixb({ syncs }).\",\n  },\n  \"run:pipeline\": {\n    universeKey: \"pipelineIds\",\n    subject: \"pipeline\",\n    fix: \"Add it to 'pipelines/' or pass it to createSixb({ pipelines }).\",\n  },\n  \"run:agent\": {\n    singleton: true,\n    subject: \"agent\",\n    fix: \"Configure models.language and use the exported agent reference in can.run(agent).\",\n  },\n  \"observe:logs\": {\n    universeKey: \"observableIds\",\n    subject: \"observability surface\",\n    fix: 'Use can.observe(\"logs\").',\n  },\n  \"observe:aiUsage\": {\n    universeKey: \"observableIds\",\n    subject: \"observability surface\",\n    fix: \"Use can.observe(agent.usage).\",\n  },\n  \"manage:connector\": {\n    universeKey: \"connectorIds\",\n    subject: \"connector\",\n    fix: \"Add it to 'connectors/' or pass it to createSixb({ connectors }).\",\n  },\n  \"manage:aiUsage\": {\n    universeKey: \"manageableIds\",\n    subject: \"management surface\",\n    fix: \"Use can.manage(agent.usage).\",\n  },\n}\n\nexport const GRANT_KIND_KEYS = Object.keys(GRANT_KINDS) as readonly GrantKind[]\nexport const TARGETED_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter(\n  (kind): kind is TargetedGrantKind => kind !== \"run:agent\"\n)\n\n/** The grant kind a stored grant resolves to. */\nexport function grantKindOf(grant: AgentRunGrant): SingletonGrantKind\nexport function grantKindOf(grant: Exclude<GrantDefinition, AgentRunGrant>): TargetedGrantKind\nexport function grantKindOf(grant: GrantDefinition): GrantKind\nexport function grantKindOf(grant: GrantDefinition): GrantKind {\n  switch (grant.capability) {\n    case \"access\":\n      return \"access:application\"\n    case \"view\":\n      return `view:${grant.target}`\n    case \"edit\":\n      return \"edit:object\"\n    case \"append\":\n      return \"append:telemetry\"\n    case \"apply\":\n      return \"apply:action\"\n    case \"share\":\n      return \"share:share\"\n    case \"run\":\n      return `run:${grant.target}`\n    case \"observe\":\n      return `observe:${grant.target}`\n    case \"manage\":\n      return `manage:${grant.target}`\n  }\n}\n\n/** Mutable grant index: booleans for singleton capabilities, id sets for selected resources. */\nexport type MutableGrantIndex = {\n  [TKind in GrantKind]: TKind extends SingletonGrantKind ? boolean : Set<string>\n}\n\nexport function emptyGrantSets(): MutableGrantIndex {\n  return {\n    \"access:application\": new Set(),\n    \"view:object\": new Set(),\n    \"view:dataset\": new Set(),\n    \"edit:object\": new Set(),\n    \"append:telemetry\": new Set(),\n    \"apply:action\": new Set(),\n    \"share:share\": new Set(),\n    \"run:workflow\": new Set(),\n    \"run:sync\": new Set(),\n    \"run:pipeline\": new Set(),\n    \"run:agent\": false,\n    \"observe:logs\": new Set(),\n    \"observe:aiUsage\": new Set(),\n    \"manage:connector\": new Set(),\n    \"manage:aiUsage\": new Set(),\n  }\n}\n"
-  ],
-  "mappings": ";;AAyEO,IAAM,cAIT;AAAA,EACF,sBAAsB;AAAA,IACpB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,IACL,iBAAiB;AAAA,EACnB;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EAIA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,eAAe;AAAA,IACb,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,YAAY;AAAA,IACV,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,aAAa;AAAA,IACX,WAAW;AAAA,IACX,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,gBAAgB;AAAA,IACd,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,mBAAmB;AAAA,IACjB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,oBAAoB;AAAA,IAClB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AAAA,EACA,kBAAkB;AAAA,IAChB,aAAa;AAAA,IACb,SAAS;AAAA,IACT,KAAK;AAAA,EACP;AACF;AAEO,IAAM,kBAAkB,OAAO,KAAK,WAAW;AAC/C,IAAM,2BAA2B,gBAAgB,OACtD,CAAC,SAAoC,SAAS,WAChD;AAMO,SAAS,WAAW,CAAC,OAAmC;AAAA,EAC7D,QAAQ,MAAM;AAAA,SACP;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO,QAAQ,MAAM;AAAA,SAClB;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO,OAAO,MAAM;AAAA,SACjB;AAAA,MACH,OAAO,WAAW,MAAM;AAAA,SACrB;AAAA,MACH,OAAO,UAAU,MAAM;AAAA;AAAA;AAStB,SAAS,cAAc,GAAsB;AAAA,EAClD,OAAO;AAAA,IACL,sBAAsB,IAAI;AAAA,IAC1B,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,eAAe,IAAI;AAAA,IACnB,oBAAoB,IAAI;AAAA,IACxB,gBAAgB,IAAI;AAAA,IACpB,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,YAAY,IAAI;AAAA,IAChB,gBAAgB,IAAI;AAAA,IACpB,aAAa;AAAA,IACb,gBAAgB,IAAI;AAAA,IACpB,mBAAmB,IAAI;AAAA,IACvB,oBAAoB,IAAI;AAAA,IACxB,kBAAkB,IAAI;AAAA,EACxB;AAAA;",
-  "debugId": "C6044AB9EC3A569764756E2164756E21",
-  "names": []
-}

package/dist/chunk-kyzq4wy9.js.map

@@ -1,18 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/objects/vectors/indexing-shared.ts", "../src/models/execution/embedding.ts", "../src/objects/vectors/indexing-generate.ts", "../src/objects/vectors/indexing-single.ts", "../src/objects/vectors/indexing-store-batch.ts", "../src/objects/vectors/indexing-batch.ts", "../src/objects/vectors/indexing.ts", "../src/objects/vectors/indexing-runtime.ts", "../src/runtime/public-origin.ts"],
-  "sourcesContent": [
-    "import { randomUUID } from \"node:crypto\"\nimport { reportVectorIndexingFailure } from \"../../error-reporting/capability\"\nimport { captureSixbFailure } from \"../../errors/internal\"\nimport { createKernelRuntimeAuthorization } from \"../../execution/authorization\"\nimport { ensureExecutionRecord, executionRecordInputFromRuntime } from \"../../execution/durable\"\nimport type { ExecutionContext, ExecutionScope } from \"../../execution/types\"\nimport { MaterializationConflictError } from \"../../materialization/errors\"\nimport type { ObjectVectorWrite, PreparedObjectVector } from \"../../materialization/vectors\"\nimport type { OntologyMaterializerContract } from \"../../materializer/materializer\"\nimport type { SixbHostContext } from \"../../runtime/types\"\nimport {\n  type OntologyVectorIndexingStorage,\n  VECTOR_INDEXING_FAILURE_CODES,\n  type VectorIndexingWork,\n} from \"../../storage/ontology/vector-indexing\"\nimport { vectorConfiguration, vectorSources } from \"./profile\"\n\n/** Return null when the requested representation is obsolete or already stored. */\nexport async function prepare(\n  runtime: SixbHostContext,\n  work: VectorIndexingWork\n): Promise<PreparedObjectVector | null> {\n  const profile = runtime.ontology.getObjectTypeById(work.ref.objectTypeId)?.search?.vectors?.[\n    work.profile\n  ]\n  if (!profile || vectorConfiguration(profile) !== work.configuration) return null\n\n  const row = await runtime.storage.objects.getByPrimaryId({\n    projectId: runtime.projectId,\n    ...work.ref,\n  })\n  if (!row) return null\n\n  const sources = vectorSources(profile.source, row.properties)\n  if (sources.sourceFingerprint !== work.sourceFingerprint) return null\n\n  const storedVectors = await runtime.storage.ontology.vectors!.list({\n    projectId: runtime.projectId,\n    ref: work.ref,\n  })\n  const currentVector = storedVectors.find((entry) => entry.profile === work.profile)\n  const alreadyIndexed =\n    currentVector?.configuration === work.configuration &&\n    currentVector.sourceFingerprint === work.sourceFingerprint\n\n  if (alreadyIndexed) return null\n\n  return {\n    projectId: runtime.projectId,\n    ref: work.ref,\n    profile: work.profile,\n    configuration: work.configuration,\n    ...sources,\n    expectedObject: {\n      ref: work.ref,\n      exists: true,\n      version: row.version,\n      lastCommitId: row.lastCommitId,\n    },\n    expectedVectorCommitId: currentVector?.lastCommitId ?? null,\n  }\n}\n\nexport async function storeVector(\n  runtime: SixbHostContext,\n  materializer: OntologyMaterializerContract,\n  work: VectorIndexingWork,\n  scope: ExecutionScope,\n  signal: AbortSignal\n): Promise<void> {\n  const indexing = runtime.storage.ontology.vectorIndexing!\n  const identity = { projectId: runtime.projectId, id: work.id }\n\n  // Unrelated property changes renew the object fence without repeating a paid inference.\n  for (let attempt = 0; attempt < 3; attempt++) {\n    signal.throwIfAborted()\n    const prepared = await prepare(runtime, work)\n\n    if (!prepared) {\n      await indexing.remove(identity)\n      return\n    }\n\n    try {\n      await commitPreparedVectors(materializer, scope, [{ input: prepared, values: work.values! }])\n      await indexing.remove(identity)\n      return\n    } catch (error) {\n      if (!(error instanceof MaterializationConflictError)) throw error\n\n      const currentWork = await indexing.get(identity)\n      if (!currentWork) return\n    }\n  }\n\n  throw new VectorIndexingDeferred(new Date(Date.now() + 1000).toISOString())\n}\n\nexport async function commitPreparedVectors(\n  materializer: OntologyMaterializerContract,\n  scope: ExecutionScope,\n  writes: readonly ObjectVectorWrite[]\n): Promise<void> {\n  await materializer.edits.commit({\n    scope,\n    input: {\n      mode: \"atomic\",\n      source: { kind: \"runtime\", requestId: randomUUID() },\n      operations: [],\n      vectorWrites: writes,\n      expectedObjects: writes.map((write) => write.input.expectedObject),\n      expectedLinks: [],\n      expectedLinkScopes: [],\n    },\n  })\n}\n\nexport async function indexingScope(\n  runtime: SixbHostContext,\n  work: VectorIndexingWork,\n  indexingId = work.id\n): Promise<ExecutionScope> {\n  const operation = { type: \"ontology.indexVectors\", indexingId } as const\n  const execution: ExecutionContext = {\n    id: `exec_vector_${indexingId}`,\n    projectId: runtime.projectId,\n    executor: { type: \"kernel\", operation },\n    source: { type: \"ontologyCommit\", commitId: work.sourceCommitId },\n    correlationId: `vector_${indexingId}`,\n  }\n  const authorization = createKernelRuntimeAuthorization({ execution, operation })\n\n  await ensureExecutionRecord(runtime.storage.executions, {\n    ...executionRecordInputFromRuntime({ execution, runtimeAuthorization: authorization }),\n    requesterGroupIds: [],\n  })\n\n  return { execution, authorization }\n}\n\nexport async function fail(\n  runtime: SixbHostContext,\n  indexing: OntologyVectorIndexingStorage,\n  work: VectorIndexingWork,\n  error: unknown\n): Promise<void> {\n  const failure = captureSixbFailure(error, {\n    allowedCodes: VECTOR_INDEXING_FAILURE_CODES,\n    defaultCode: \"internal.unexpected\",\n  })\n\n  const recorded = await indexing.update({\n    projectId: runtime.projectId,\n    id: work.id,\n    expectedStatus: work.status,\n    status: \"failed\",\n    availableAt: new Date().toISOString(),\n    error: failure,\n  })\n\n  if (!recorded) return\n\n  reportVectorIndexingFailure(runtime, error, {\n    projectId: runtime.projectId,\n    indexingId: work.id,\n    failure,\n    ...work.ref,\n    profile: work.profile,\n  })\n}\n\nexport function retryAt(details: unknown): string {\n  const resetAt =\n    details && typeof details === \"object\" && \"resetAt\" in details ? details.resetAt : undefined\n  const resetTimestamp = typeof resetAt === \"string\" ? Date.parse(resetAt) : Number.NaN\n\n  const minimumRetryTimestamp = Date.now() + 60_000\n  const budgetResetTimestamp = Number.isFinite(resetTimestamp) ? resetTimestamp : 0\n  const retryTimestamp = Math.max(minimumRetryTimestamp, budgetResetTimestamp)\n\n  return new Date(retryTimestamp).toISOString()\n}\n\nexport class VectorIndexingDeferred extends Error {\n  constructor(readonly availableAt: string) {\n    super(\"[Sixb] Vector indexing is deferred.\")\n  }\n}\n",
-    "import { randomUUID } from \"node:crypto\"\nimport type { EmbeddingModelCatalog, EmbeddingModelEntry, ModelRef } from \"../catalog\"\nimport {\n  assertEmbeddingModel,\n  type EmbeddingModel,\n  type EmbeddingModelRequest,\n  EmbeddingModelResponseError,\n  type EmbeddingModelResponseMetadata,\n  type EmbeddingModelResult,\n  sameEmbeddingModel,\n} from \"../embedding-model\"\nimport { estimateModelCall } from \"../pricing\"\nimport type { AiModelCallRecorder } from \"./model-call-recorder\"\nimport type { ModelExecutionSession } from \"./session\"\n\n/** Scope the configured bindings without changing profile identity or object permissions. */\nexport function bindEmbeddingModels(\n  catalog: EmbeddingModelCatalog | undefined,\n  session: ModelExecutionSession\n): EmbeddingModelCatalog | undefined {\n  if (!catalog) return undefined\n  const entries: readonly EmbeddingModelEntry[] = Object.freeze(\n    catalog.list().map((entry) =>\n      Object.freeze({\n        ...entry,\n        model: Object.freeze({\n          providerId: entry.model.providerId,\n          modelId: entry.model.modelId,\n          definition: entry.model.definition,\n          batching: entry.model.batching && Object.freeze({ ...entry.model.batching }),\n          embed: (input: EmbeddingModelRequest) => executeEmbedding(session, entry.model, input),\n        }),\n      })\n    )\n  )\n  const byRef = new Map(\n    entries.map((entry) => [JSON.stringify([entry.provider, entry.modelId]), entry])\n  )\n  return Object.freeze({\n    list: () => entries,\n    getByRef: (ref: ModelRef) => byRef.get(JSON.stringify([ref.provider, ref.modelId])) ?? null,\n  })\n}\n\nasync function executeEmbedding(\n  session: ModelExecutionSession,\n  binding: EmbeddingModel,\n  input: EmbeddingModelRequest\n) {\n  if (\n    !Array.isArray(input.texts) ||\n    input.texts.some((text) => typeof text !== \"string\" || !text.trim())\n  ) {\n    throw new TypeError(\"[SixbModels] Embedding inputs must be nonempty strings.\")\n  }\n  const texts = [...input.texts]\n  const purpose = input.purpose\n  if (purpose !== undefined && purpose !== \"document\" && purpose !== \"query\") {\n    throw new TypeError(\"[SixbModels] Embedding purpose must be 'document' or 'query'.\")\n  }\n  const signal = session.signal(input.signal)\n  const requestSignal = AbortSignal.any([signal, AbortSignal.timeout(30_000)])\n  requestSignal.throwIfAborted()\n  if (!texts.length) return { vectors: [] }\n\n  const accounting = await session.accounting()\n  accounting.assertHealthy()\n  const model = (await binding.resolve?.()) ?? binding\n  assertEmbeddingModel(model)\n  if (!sameEmbeddingModel(model, binding)) {\n    throw new TypeError(\n      \"[SixbModels] Resolved embedding model identity does not match the selected model.\"\n    )\n  }\n  requestSignal.throwIfAborted()\n  const callId = `call_${randomUUID()}`\n  const tokens = texts.reduce(\n    (sum, text) => sum + Math.ceil(new TextEncoder().encode(text).byteLength / 4),\n    0\n  )\n  await session.admitEmbeddingCall(() =>\n    accounting.admitCall({\n      callId,\n      providerId: model.providerId,\n      modelId: model.modelId,\n      costEstimator: model.costEstimator,\n      inputTokens: { status: \"estimated\", tokens, method: \"utf8BytesDividedByFour\" },\n      outputTokenAllowance: 0,\n      estimatedTotalTokens: tokens,\n    })\n  )\n\n  let result: EmbeddingModelResult\n  try {\n    requestSignal.throwIfAborted()\n    result = await model.embed({ texts, purpose, signal: requestSignal })\n  } catch (error) {\n    if (error instanceof EmbeddingModelResponseError) {\n      await recordEmbedding(accounting, model, callId, error.metadata)\n    } else {\n      // The provider may have accepted the request. Never retry inference or release its budget.\n      await recordEmbedding(accounting, model, callId, {})\n    }\n    throw error\n  }\n  // Account before cancellation, vector validation or the materializer's optimistic write.\n  await recordEmbedding(accounting, model, callId, result ?? {})\n  requestSignal.throwIfAborted()\n  return result\n}\n\nasync function recordEmbedding(\n  accounting: AiModelCallRecorder,\n  model: EmbeddingModel,\n  callId: string,\n  metadata: EmbeddingModelResponseMetadata\n): Promise<void> {\n  // Embeddings produce no output tokens; missing INPUT usage must remain unknown.\n  const usage = { ...metadata.usage, outputTokens: 0 }\n  const estimate = estimateModelCall(model, {\n    usage,\n    route: metadata.route,\n    responseModelId: metadata.responseModelId,\n  })\n  await accounting.onModelCallEnd({\n    callId,\n    providerId: model.providerId,\n    modelId: model.modelId,\n    responseId: metadata.providerIds?.responseId ?? callId,\n    responseModelId: metadata.responseModelId,\n    providerIds: metadata.providerIds,\n    usage,\n    cost: metadata.reportedCost ? { status: \"reported\", ...metadata.reportedCost } : estimate,\n    ...(metadata.reportedCost ? { estimate } : {}),\n    route: metadata.route,\n  })\n}\n",
-    "import { createSixbError, isSixbError } from \"../../errors/internal\"\nimport type { ExecutionScope } from \"../../execution/types\"\nimport type { PreparedObjectVector } from \"../../materialization/vectors\"\nimport {\n  EmbeddingModelResponseError,\n  type EmbeddingModelResult,\n  sameEmbeddingModel,\n} from \"../../models/embedding-model\"\nimport { bindEmbeddingModels } from \"../../models/execution/embedding\"\nimport { ModelExecutionSession } from \"../../models/execution/session\"\nimport type { SixbHostContext } from \"../../runtime/types\"\nimport type { VectorIndexingWork } from \"../../storage/ontology/vector-indexing\"\nimport { fail, retryAt, VectorIndexingDeferred } from \"./indexing-shared\"\nimport { normalizeVector } from \"./profile\"\n\nexport interface PreparedIndexingWork {\n  readonly work: VectorIndexingWork\n  readonly input: PreparedObjectVector\n}\n\ninterface GenerationAttempt {\n  readonly runtime: SixbHostContext\n  readonly entries: readonly PreparedIndexingWork[]\n  readonly signal: AbortSignal\n  /** Running means the durable claim succeeded; budget admission may still be pending. */\n  phase: \"pending\" | \"claiming\" | \"running\"\n}\n\n/** One accounted provider call, with durable admission and atomic result persistence. */\nexport async function generateVectors(\n  runtime: SixbHostContext,\n  entries: readonly PreparedIndexingWork[],\n  scope: ExecutionScope,\n  attempt: number,\n  signal: AbortSignal\n): Promise<void> {\n  const first = entries[0]!\n  const profile = runtime.ontology.resolveObjectType(first.work.ref.objectTypeId).search!.vectors![\n    first.work.profile\n  ]!\n  const generation: GenerationAttempt = { runtime, entries, signal, phase: \"pending\" }\n\n  const session = new ModelExecutionSession(\n    { ...runtime, runtimeAuthorization: scope.authorization },\n    scope.execution\n  )\n  session.bind({\n    attempt,\n    signal,\n    embeddingAdmission: (admit) => admitGeneration(generation, admit),\n  })\n\n  try {\n    const model = bindEmbeddingModels(runtime.embeddingModels, session)?.getByRef({\n      provider: profile.model.providerId,\n      modelId: profile.model.modelId,\n    })?.model\n\n    if (!model || !sameEmbeddingModel(model, profile.model)) {\n      throw createSixbError(\n        \"vector.model_unavailable\",\n        \"[Sixb] Vector indexing requires the profile's configured embedding model.\"\n      )\n    }\n\n    const result = await model.embed({\n      texts: entries.map((entry) => entry.input.text),\n      purpose: \"document\",\n      signal,\n    })\n    const values = normalizeEmbeddingResult(\n      result,\n      entries.length,\n      profile.model.definition.dimensions\n    )\n\n    // Persist every surviving result atomically before any vector is published.\n    await runtime.storage.ontology.vectorIndexing!.updateBatch({\n      projectId: runtime.projectId,\n      updates: entries.map(({ work }, index) => ({\n        id: work.id,\n        expectedStatus: \"running\",\n        status: \"ready\",\n        values: values[index]!,\n        availableAt: new Date().toISOString(),\n      })),\n    })\n  } catch (error) {\n    await handleGenerationFailure(generation, error)\n  }\n}\n\nasync function admitGeneration(\n  generation: GenerationAttempt,\n  admit: () => Promise<void>\n): Promise<void> {\n  generation.signal.throwIfAborted()\n  generation.phase = \"claiming\"\n\n  const claimed = await transitionWork(generation, \"pending\", \"running\", { requireAll: true })\n  generation.phase = claimed ? \"running\" : \"pending\"\n\n  if (!claimed) {\n    if (generation.entries.length === 1) {\n      throw new Error(\"[Sixb] Vector indexing request was superseded.\")\n    }\n    throw new VectorIndexingDeferred(new Date().toISOString())\n  }\n\n  try {\n    await admit()\n  } catch (error) {\n    await transitionWork(generation, \"running\", \"pending\")\n    generation.phase = \"pending\"\n    throw error\n  }\n}\n\nfunction normalizeEmbeddingResult(\n  result: EmbeddingModelResult,\n  count: number,\n  dimensions: number\n): readonly (readonly number[])[] {\n  try {\n    if (!Array.isArray(result?.vectors) || result.vectors.length !== count) {\n      throw new Error(\"Unexpected vector count\")\n    }\n\n    return result.vectors.map((vector) => normalizeVector(vector, dimensions))\n  } catch (cause) {\n    throw createSixbError(\"vector.response_invalid\", \"[Sixb] Invalid embedding batch response.\", {\n      cause,\n    })\n  }\n}\n\nasync function handleGenerationFailure(\n  generation: GenerationAttempt,\n  error: unknown\n): Promise<void> {\n  // No provider call can start while the storage claim is unresolved. Retry delivery,\n  // not inference; an ambiguously committed claim will be fenced as running on redelivery.\n  if (generation.phase === \"claiming\" || error instanceof VectorIndexingDeferred) {\n    throw error\n  }\n\n  if (generation.phase === \"pending\") {\n    if (\n      isSixbError(error) &&\n      (error.code === \"ai.usage_limit_exceeded\" || error.code === \"ai.usage_limit_unavailable\")\n    ) {\n      const availableAt = retryAt(error.details)\n      await transitionWork(generation, \"pending\", \"pending\", { availableAt })\n      throw new VectorIndexingDeferred(availableAt)\n    }\n\n    if (generation.signal.aborted) throw error\n  }\n\n  const failure =\n    error instanceof EmbeddingModelResponseError\n      ? createSixbError(\"vector.response_invalid\", \"[Sixb] Invalid embedding batch response.\", {\n          cause: error,\n        })\n      : error\n  const { runtime, entries } = generation\n  const indexing = runtime.storage.ontology.vectorIndexing!\n\n  for (const { work } of entries) {\n    await fail(runtime, indexing, { ...work, status: generation.phase }, failure)\n  }\n}\n\nfunction transitionWork(\n  generation: GenerationAttempt,\n  expectedStatus: VectorIndexingWork[\"status\"],\n  status: VectorIndexingWork[\"status\"],\n  options: { availableAt?: string; requireAll?: boolean } = {}\n): Promise<boolean> {\n  const { runtime, entries } = generation\n  const availableAt = options.availableAt ?? new Date().toISOString()\n\n  return runtime.storage.ontology.vectorIndexing!.updateBatch({\n    projectId: runtime.projectId,\n    requireAll: options.requireAll ?? false,\n    updates: entries.map(({ work }) => ({ id: work.id, expectedStatus, status, availableAt })),\n  })\n}\n",
-    "import { createSixbError } from \"../../errors/internal\"\nimport type { OntologyMaterializerContract } from \"../../materializer/materializer\"\nimport type { SixbHostContext } from \"../../runtime/types\"\nimport { generateVectors } from \"./indexing-generate\"\nimport {\n  fail,\n  indexingScope,\n  prepare,\n  storeVector,\n  VectorIndexingDeferred,\n} from \"./indexing-shared\"\n\nexport async function processVector(\n  runtime: SixbHostContext,\n  materializer: OntologyMaterializerContract,\n  id: string,\n  attempt: number,\n  signal: AbortSignal\n): Promise<void> {\n  const indexing = runtime.storage.ontology.vectorIndexing\n  if (!indexing) throw new Error(\"[Sixb] Storage does not support automatic vector indexing.\")\n  const projectId = runtime.projectId\n  const work = await indexing.get({ projectId, id })\n  if (!work || work.status === \"failed\") return\n  if (work.status === \"running\") {\n    await fail(\n      runtime,\n      indexing,\n      work,\n      createSixbError(\n        \"vector.outcome_unknown\",\n        \"[Sixb] Interrupted embedding call has an unknown outcome; inference was not repeated.\"\n      )\n    )\n    return\n  }\n  if (Date.parse(work.availableAt) > Date.now()) throw new VectorIndexingDeferred(work.availableAt)\n  const prepared = await prepare(runtime, work)\n  if (!prepared) {\n    await indexing.remove({ projectId, id })\n    return\n  }\n  const scope = await indexingScope(runtime, work, work.batchId ?? work.id)\n  if (work.status === \"ready\") {\n    await storeVector(runtime, materializer, work, scope, signal)\n    return\n  }\n  await generateVectors(runtime, [{ work, input: prepared }], scope, attempt, signal)\n  const ready = await indexing.get({ projectId, id })\n  if (ready?.status === \"ready\") await storeVector(runtime, materializer, ready, scope, signal)\n}\n",
-    "import type { ExecutionScope } from \"../../execution/types\"\nimport { MaterializationConflictError } from \"../../materialization/errors\"\nimport type { ObjectVectorWrite } from \"../../materialization/vectors\"\nimport type { OntologyMaterializerContract } from \"../../materializer/materializer\"\nimport type { SixbHostContext } from \"../../runtime/types\"\nimport {\n  commitPreparedVectors,\n  prepare,\n  storeVector,\n  VectorIndexingDeferred,\n} from \"./indexing-shared\"\n\n/** Publish a current subset atomically; reprepare conflicts without repeating inference. */\nexport async function storeVectorBatch(\n  runtime: SixbHostContext,\n  materializer: OntologyMaterializerContract,\n  batchId: string,\n  scope: ExecutionScope,\n  signal: AbortSignal\n): Promise<void> {\n  const indexing = runtime.storage.ontology.vectorIndexing!\n  const identity = { projectId: runtime.projectId, batchId }\n\n  for (let attempt = 0; attempt < 3; attempt++) {\n    const ready = (await indexing.getBatch(identity)).filter((work) => work.status === \"ready\")\n    const writes: ObjectVectorWrite[] = []\n\n    for (const work of ready) {\n      signal.throwIfAborted()\n      const input = await prepare(runtime, work)\n      if (input) {\n        writes.push({ input, values: work.values! })\n      } else {\n        await indexing.remove({ projectId: runtime.projectId, id: work.id })\n      }\n    }\n\n    if (!writes.length) return\n\n    try {\n      signal.throwIfAborted()\n      await commitPreparedVectors(materializer, scope, writes)\n      return\n    } catch (error) {\n      if (!(error instanceof MaterializationConflictError)) throw error\n    }\n  }\n\n  // A continuously changing object must not keep stable peers from becoming searchable.\n  let deferred = false\n  for (const work of await indexing.getBatch(identity)) {\n    if (work.status !== \"ready\") continue\n    try {\n      await storeVector(runtime, materializer, work, scope, signal)\n    } catch (error) {\n      if (!(error instanceof VectorIndexingDeferred)) throw error\n      deferred = true\n    }\n  }\n\n  if (deferred) throw new VectorIndexingDeferred(new Date(Date.now() + 1000).toISOString())\n}\n",
-    "import type { OntologyMaterializerContract } from \"../../materializer/materializer\"\nimport type { EmbeddingBatchLimits } from \"../../models/embedding-model\"\nimport type { SixbHostContext } from \"../../runtime/types\"\nimport type { VectorIndexingWork } from \"../../storage/ontology/vector-indexing\"\nimport { generateVectors, type PreparedIndexingWork } from \"./indexing-generate\"\nimport { indexingScope, prepare, VectorIndexingDeferred } from \"./indexing-shared\"\nimport { processVector } from \"./indexing-single\"\nimport { storeVectorBatch } from \"./indexing-store-batch\"\n\n/** Membership was persisted by one projection commit; there is no fill timer or memory queue. */\nexport async function processVectorBatch(\n  runtime: SixbHostContext,\n  materializer: OntologyMaterializerContract,\n  batchId: string,\n  batch: readonly VectorIndexingWork[],\n  attempt: number,\n  signal: AbortSignal\n): Promise<void> {\n  if (batch.some((work) => work.status !== \"pending\")) {\n    await resumeBatch(runtime, materializer, batchId, batch, attempt, signal)\n    return\n  }\n\n  const entries = await prepareBatch(runtime, batch, signal)\n  const first = entries[0]\n  if (!first) return\n\n  const limits = getBatchLimits(runtime, first.work)\n  if (!limits) {\n    // Unknown provider batch limits: embed each object/profile individually.\n    for (const { work } of entries) {\n      await processVector(runtime, materializer, work.id, attempt, signal)\n    }\n    return\n  }\n\n  assertCompatibleEntries(entries, first.work)\n  const scope = await indexingScope(runtime, first.work, batchId)\n\n  for (const group of partition(entries, limits)) {\n    if (group.length === 1) {\n      await processVector(runtime, materializer, group[0]!.work.id, attempt, signal)\n    } else {\n      await generateVectors(runtime, group, scope, attempt, signal)\n    }\n  }\n\n  await storeVectorBatch(runtime, materializer, batchId, scope, signal)\n}\n\n/** Resume storage or terminalize interrupted calls; never repeat paid inference. */\nasync function resumeBatch(\n  runtime: SixbHostContext,\n  materializer: OntologyMaterializerContract,\n  batchId: string,\n  batch: readonly VectorIndexingWork[],\n  attempt: number,\n  signal: AbortSignal\n): Promise<void> {\n  const ready = batch.find((work) => work.status === \"ready\")\n  if (ready) {\n    const scope = await indexingScope(runtime, ready, batchId)\n    await storeVectorBatch(runtime, materializer, batchId, scope, signal)\n  }\n\n  for (const work of batch) {\n    if (work.status !== \"ready\") {\n      await processVector(runtime, materializer, work.id, attempt, signal)\n    }\n  }\n}\n\nasync function prepareBatch(\n  runtime: SixbHostContext,\n  batch: readonly VectorIndexingWork[],\n  signal: AbortSignal\n): Promise<PreparedIndexingWork[]> {\n  const availableAt = batch.reduce(\n    (latest, work) => (work.availableAt > latest ? work.availableAt : latest),\n    \"\"\n  )\n  if (Date.parse(availableAt) > Date.now()) {\n    throw new VectorIndexingDeferred(availableAt)\n  }\n\n  const entries: PreparedIndexingWork[] = []\n  const indexing = runtime.storage.ontology.vectorIndexing!\n\n  for (const work of batch) {\n    signal.throwIfAborted()\n    const input = await prepare(runtime, work)\n\n    if (input) {\n      entries.push({ work, input })\n    } else {\n      await indexing.remove({ projectId: runtime.projectId, id: work.id })\n    }\n  }\n\n  return entries\n}\n\nfunction getBatchLimits(\n  runtime: SixbHostContext,\n  work: VectorIndexingWork\n): EmbeddingBatchLimits | undefined {\n  const profile = runtime.ontology.resolveObjectType(work.ref.objectTypeId).search!.vectors![\n    work.profile\n  ]!\n\n  return runtime.embeddingModels?.getByRef({\n    provider: profile.model.providerId,\n    modelId: profile.model.modelId,\n  })?.model.batching\n}\n\n/** Do not mix commits or configurations, even with malformed storage membership. */\nfunction assertCompatibleEntries(\n  entries: readonly PreparedIndexingWork[],\n  reference: VectorIndexingWork\n): void {\n  const incompatible = entries.some(\n    ({ work }) =>\n      work.sourceCommitId !== reference.sourceCommitId ||\n      work.ref.objectTypeId !== reference.ref.objectTypeId ||\n      work.profile !== reference.profile ||\n      work.configuration !== reference.configuration\n  )\n\n  if (incompatible) {\n    throw new Error(\"[Sixb] Incompatible vector batch membership.\")\n  }\n}\n\n/** Split an already durable, bounded page; never wait for more work or truncate input. */\nfunction* partition(entries: readonly PreparedIndexingWork[], limits: EmbeddingBatchLimits) {\n  let group: PreparedIndexingWork[] = []\n  let bytes = 0\n\n  for (const entry of entries) {\n    const size = Buffer.byteLength(entry.input.text)\n    const exceedsGroupLimit =\n      group.length >= limits.maxInputs ||\n      bytes + size > limits.maxTotalInputBytes ||\n      size > limits.maxInputBytes\n\n    if (group.length > 0 && exceedsGroupLimit) {\n      yield group\n      group = []\n      bytes = 0\n    }\n\n    if (size > limits.maxInputBytes || size > limits.maxTotalInputBytes) {\n      yield [entry]\n      continue\n    }\n\n    group.push(entry)\n    bytes += size\n  }\n\n  if (group.length > 0) yield group\n}\n",
-    "import type { OntologyMaterializerContract } from \"../../materializer/materializer\"\nimport type { SixbHostContext } from \"../../runtime/types\"\nimport { processVectorBatch } from \"./indexing-batch\"\nimport type { VectorIndexingRuntime } from \"./indexing-runtime\"\nimport { processVector } from \"./indexing-single\"\n\nexport { VectorIndexingDeferred } from \"./indexing-shared\"\n\n/** Internal processing port; durable projection groups and individual requests share delivery. */\nexport function createVectorIndexingRuntime(\n  runtime: SixbHostContext,\n  materializer: OntologyMaterializerContract\n): VectorIndexingRuntime {\n  return {\n    async process(id, attempt, signal) {\n      const indexing = runtime.storage.ontology.vectorIndexing\n      if (!indexing) throw new Error(\"[Sixb] Storage does not support automatic vector indexing.\")\n      const batch = await indexing.getBatch({ projectId: runtime.projectId, batchId: id })\n      if (batch.length) await processVectorBatch(runtime, materializer, id, batch, attempt, signal)\n      else await processVector(runtime, materializer, id, attempt, signal)\n    },\n  }\n}\n",
-    "/** Internal worker entry point; it does not expose the host context or domain SDK. */\nexport interface VectorIndexingRuntime {\n  process(id: string, attempt: number, signal: AbortSignal): Promise<void>\n}\n\n// Associates each host with its service. Durable work lives in ontology storage, not this map.\nconst runtimes = new WeakMap<object, VectorIndexingRuntime>()\n\nexport function registerVectorIndexingRuntime(host: object, runtime: VectorIndexingRuntime): void {\n  runtimes.set(host, runtime)\n}\n\nexport function getVectorIndexingRuntime(host: object): VectorIndexingRuntime {\n  const runtime = runtimes.get(host)\n  if (!runtime) throw new Error(\"[Sixb] Vector indexing requires a configured Sixb host.\")\n  return runtime\n}\n",
-    "/**\n * The origin the API is reachable at from outside, for features that hand out absolute URLs a\n * third party will fetch. It is deployment topology, not app configuration: the API server\n * records the `publicOrigin` it was started with, and the CLI records `SIXB_API_PUBLIC_ORIGIN`\n * for worker processes. A process that never learns it cannot issue such URLs.\n */\n\nconst apiPublicOrigins = new WeakMap<object, string>()\n\n/** Record where the API is reachable. A host served by several servers keeps the latest one. */\nexport function setApiPublicOrigin(host: object, origin: string): void {\n  apiPublicOrigins.set(host, normalizeOrigin(origin))\n}\n\nexport function getApiPublicOrigin(host: object): string | undefined {\n  return apiPublicOrigins.get(host)\n}\n\nfunction normalizeOrigin(value: string): string {\n  let url: URL\n  try {\n    url = new URL(value)\n  } catch {\n    throw new Error(`[Sixb] Invalid API public origin: '${value}'.`)\n  }\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") {\n    throw new Error(\"[Sixb] The API public origin must use http or https.\")\n  }\n  if (url.pathname !== \"/\" || url.search || url.hash) {\n    throw new Error(\"[Sixb] The API public origin must be an origin, not a full URL.\")\n  }\n  return url.origin\n}\n"
-  ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAkBA,eAAsB,OAAO,CAC3B,SACA,MACsC;AAAA,EACtC,MAAM,UAAU,QAAQ,SAAS,kBAAkB,KAAK,IAAI,YAAY,GAAG,QAAQ,UACjF,KAAK;AAAA,EAEP,IAAI,CAAC,WAAW,oBAAoB,OAAO,MAAM,KAAK;AAAA,IAAe,OAAO;AAAA,EAE5E,MAAM,MAAM,MAAM,QAAQ,QAAQ,QAAQ,eAAe;AAAA,IACvD,WAAW,QAAQ;AAAA,OAChB,KAAK;AAAA,EACV,CAAC;AAAA,EACD,IAAI,CAAC;AAAA,IAAK,OAAO;AAAA,EAEjB,MAAM,UAAU,cAAc,QAAQ,QAAQ,IAAI,UAAU;AAAA,EAC5D,IAAI,QAAQ,sBAAsB,KAAK;AAAA,IAAmB,OAAO;AAAA,EAEjE,MAAM,gBAAgB,MAAM,QAAQ,QAAQ,SAAS,QAAS,KAAK;AAAA,IACjE,WAAW,QAAQ;AAAA,IACnB,KAAK,KAAK;AAAA,EACZ,CAAC;AAAA,EACD,MAAM,gBAAgB,cAAc,KAAK,CAAC,UAAU,MAAM,YAAY,KAAK,OAAO;AAAA,EAClF,MAAM,iBACJ,eAAe,kBAAkB,KAAK,iBACtC,cAAc,sBAAsB,KAAK;AAAA,EAE3C,IAAI;AAAA,IAAgB,OAAO;AAAA,EAE3B,OAAO;AAAA,IACL,WAAW,QAAQ;AAAA,IACnB,KAAK,KAAK;AAAA,IACV,SAAS,KAAK;AAAA,IACd,eAAe,KAAK;AAAA,OACjB;AAAA,IACH,gBAAgB;AAAA,MACd,KAAK,KAAK;AAAA,MACV,QAAQ;AAAA,MACR,SAAS,IAAI;AAAA,MACb,cAAc,IAAI;AAAA,IACpB;AAAA,IACA,wBAAwB,eAAe,gBAAgB;AAAA,EACzD;AAAA;AAGF,eAAsB,WAAW,CAC/B,SACA,cACA,MACA,OACA,QACe;AAAA,EACf,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAC1C,MAAM,WAAW,EAAE,WAAW,QAAQ,WAAW,IAAI,KAAK,GAAG;AAAA,EAG7D,SAAS,UAAU,EAAG,UAAU,GAAG,WAAW;AAAA,IAC5C,OAAO,eAAe;AAAA,IACtB,MAAM,WAAW,MAAM,QAAQ,SAAS,IAAI;AAAA,IAE5C,IAAI,CAAC,UAAU;AAAA,MACb,MAAM,SAAS,OAAO,QAAQ;AAAA,MAC9B;AAAA,IACF;AAAA,IAEA,IAAI;AAAA,MACF,MAAM,sBAAsB,cAAc,OAAO,CAAC,EAAE,OAAO,UAAU,QAAQ,KAAK,OAAQ,CAAC,CAAC;AAAA,MAC5F,MAAM,SAAS,OAAO,QAAQ;AAAA,MAC9B;AAAA,MACA,OAAO,OAAO;AAAA,MACd,IAAI,EAAE,iBAAiB;AAAA,QAA+B,MAAM;AAAA,MAE5D,MAAM,cAAc,MAAM,SAAS,IAAI,QAAQ;AAAA,MAC/C,IAAI,CAAC;AAAA,QAAa;AAAA;AAAA,EAEtB;AAAA,EAEA,MAAM,IAAI,wBAAuB,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,EAAE,YAAY,CAAC;AAAA;AAG5E,eAAsB,qBAAqB,CACzC,cACA,OACA,QACe;AAAA,EACf,MAAM,aAAa,MAAM,OAAO;AAAA,IAC9B;AAAA,IACA,OAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ,EAAE,MAAM,WAAW,WAAW,WAAW,EAAE;AAAA,MACnD,YAAY,CAAC;AAAA,MACb,cAAc;AAAA,MACd,iBAAiB,OAAO,IAAI,CAAC,UAAU,MAAM,MAAM,cAAc;AAAA,MACjE,eAAe,CAAC;AAAA,MAChB,oBAAoB,CAAC;AAAA,IACvB;AAAA,EACF,CAAC;AAAA;AAGH,eAAsB,aAAa,CACjC,SACA,MACA,aAAa,KAAK,IACO;AAAA,EACzB,MAAM,YAAY,EAAE,MAAM,yBAAyB,WAAW;AAAA,EAC9D,MAAM,YAA8B;AAAA,IAClC,IAAI,eAAe;AAAA,IACnB,WAAW,QAAQ;AAAA,IACnB,UAAU,EAAE,MAAM,UAAU,UAAU;AAAA,IACtC,QAAQ,EAAE,MAAM,kBAAkB,UAAU,KAAK,eAAe;AAAA,IAChE,eAAe,UAAU;AAAA,EAC3B;AAAA,EACA,MAAM,gBAAgB,iCAAiC,EAAE,WAAW,UAAU,CAAC;AAAA,EAE/E,MAAM,uBAAsB,QAAQ,QAAQ,YAAY;AAAA,OACnD,gCAAgC,EAAE,WAAW,sBAAsB,cAAc,CAAC;AAAA,IACrF,mBAAmB,CAAC;AAAA,EACtB,CAAC;AAAA,EAED,OAAO,EAAE,WAAW,cAAc;AAAA;AAGpC,eAAsB,IAAI,CACxB,SACA,UACA,MACA,OACe;AAAA,EACf,MAAM,UAAU,oBAAmB,OAAO;AAAA,IACxC,cAAc;AAAA,IACd,aAAa;AAAA,EACf,CAAC;AAAA,EAED,MAAM,WAAW,MAAM,SAAS,OAAO;AAAA,IACrC,WAAW,QAAQ;AAAA,IACnB,IAAI,KAAK;AAAA,IACT,gBAAgB,KAAK;AAAA,IACrB,QAAQ;AAAA,IACR,aAAa,IAAI,KAAK,EAAE,YAAY;AAAA,IACpC,OAAO;AAAA,EACT,CAAC;AAAA,EAED,IAAI,CAAC;AAAA,IAAU;AAAA,EAEf,4BAA4B,SAAS,OAAO;AAAA,IAC1C,WAAW,QAAQ;AAAA,IACnB,YAAY,KAAK;AAAA,IACjB;AAAA,OACG,KAAK;AAAA,IACR,SAAS,KAAK;AAAA,EAChB,CAAC;AAAA;AAGI,SAAS,OAAO,CAAC,SAA0B;AAAA,EAChD,MAAM,UACJ,WAAW,OAAO,YAAY,YAAY,aAAa,UAAU,QAAQ,UAAU;AAAA,EACrF,MAAM,iBAAiB,OAAO,YAAY,WAAW,KAAK,MAAM,OAAO,IAAI,OAAO;AAAA,EAElF,MAAM,wBAAwB,KAAK,IAAI,IAAI;AAAA,EAC3C,MAAM,uBAAuB,OAAO,SAAS,cAAc,IAAI,iBAAiB;AAAA,EAChF,MAAM,iBAAiB,KAAK,IAAI,uBAAuB,oBAAoB;AAAA,EAE3E,OAAO,IAAI,KAAK,cAAc,EAAE,YAAY;AAAA;AAAA;AAGvC,MAAM,gCAA+B,MAAM;AAAA,EAC3B;AAAA,EAArB,WAAW,CAAU,aAAqB;AAAA,IACxC,MAAM,qCAAqC;AAAA,IADxB;AAAA;AAGvB;;;AC3LA,uBAAS;AAgBF,SAAS,mBAAmB,CACjC,SACA,SACmC;AAAA,EACnC,IAAI,CAAC;AAAA,IAAS;AAAA,EACd,MAAM,UAA0C,OAAO,OACrD,QAAQ,KAAK,EAAE,IAAI,CAAC,UAClB,OAAO,OAAO;AAAA,OACT;AAAA,IACH,OAAO,OAAO,OAAO;AAAA,MACnB,YAAY,MAAM,MAAM;AAAA,MACxB,SAAS,MAAM,MAAM;AAAA,MACrB,YAAY,MAAM,MAAM;AAAA,MACxB,UAAU,MAAM,MAAM,YAAY,OAAO,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAAA,MAC3E,OAAO,CAAC,UAAiC,iBAAiB,SAAS,MAAM,OAAO,KAAK;AAAA,IACvF,CAAC;AAAA,EACH,CAAC,CACH,CACF;AAAA,EACA,MAAM,QAAQ,IAAI,IAChB,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,UAAU,CAAC,MAAM,UAAU,MAAM,OAAO,CAAC,GAAG,KAAK,CAAC,CACjF;AAAA,EACA,OAAO,OAAO,OAAO;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,UAAU,CAAC,QAAkB,MAAM,IAAI,KAAK,UAAU,CAAC,IAAI,UAAU,IAAI,OAAO,CAAC,CAAC,KAAK;AAAA,EACzF,CAAC;AAAA;AAGH,eAAe,gBAAgB,CAC7B,SACA,SACA,OACA;AAAA,EACA,IACE,CAAC,MAAM,QAAQ,MAAM,KAAK,KAC1B,MAAM,MAAM,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,CAAC,KAAK,KAAK,CAAC,GACnE;AAAA,IACA,MAAM,IAAI,UAAU,yDAAyD;AAAA,EAC/E;AAAA,EACA,MAAM,QAAQ,CAAC,GAAG,MAAM,KAAK;AAAA,EAC7B,MAAM,UAAU,MAAM;AAAA,EACtB,IAAI,YAAY,aAAa,YAAY,cAAc,YAAY,SAAS;AAAA,IAC1E,MAAM,IAAI,UAAU,+DAA+D;AAAA,EACrF;AAAA,EACA,MAAM,SAAS,QAAQ,OAAO,MAAM,MAAM;AAAA,EAC1C,MAAM,gBAAgB,YAAY,IAAI,CAAC,QAAQ,YAAY,QAAQ,KAAM,CAAC,CAAC;AAAA,EAC3E,cAAc,eAAe;AAAA,EAC7B,IAAI,CAAC,MAAM;AAAA,IAAQ,OAAO,EAAE,SAAS,CAAC,EAAE;AAAA,EAExC,MAAM,aAAa,MAAM,QAAQ,WAAW;AAAA,EAC5C,WAAW,cAAc;AAAA,EACzB,MAAM,QAAS,MAAM,QAAQ,UAAU,KAAM;AAAA,EAC7C,qBAAqB,KAAK;AAAA,EAC1B,IAAI,CAAC,mBAAmB,OAAO,OAAO,GAAG;AAAA,IACvC,MAAM,IAAI,UACR,mFACF;AAAA,EACF;AAAA,EACA,cAAc,eAAe;AAAA,EAC7B,MAAM,SAAS,QAAQ,YAAW;AAAA,EAClC,MAAM,SAAS,MAAM,OACnB,CAAC,KAAK,SAAS,MAAM,KAAK,KAAK,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa,CAAC,GAC5E,CACF;AAAA,EACA,MAAM,QAAQ,mBAAmB,MAC/B,WAAW,UAAU;AAAA,IACnB;AAAA,IACA,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,eAAe,MAAM;AAAA,IACrB,aAAa,EAAE,QAAQ,aAAa,QAAQ,QAAQ,yBAAyB;AAAA,IAC7E,sBAAsB;AAAA,IACtB,sBAAsB;AAAA,EACxB,CAAC,CACH;AAAA,EAEA,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,cAAc,eAAe;AAAA,IAC7B,SAAS,MAAM,MAAM,MAAM,EAAE,OAAO,SAAS,QAAQ,cAAc,CAAC;AAAA,IACpE,OAAO,OAAO;AAAA,IACd,IAAI,iBAAiB,8BAA6B;AAAA,MAChD,MAAM,gBAAgB,YAAY,OAAO,QAAQ,MAAM,QAAQ;AAAA,IACjE,EAAO;AAAA,MAEL,MAAM,gBAAgB,YAAY,OAAO,QAAQ,CAAC,CAAC;AAAA;AAAA,IAErD,MAAM;AAAA;AAAA,EAGR,MAAM,gBAAgB,YAAY,OAAO,QAAQ,UAAU,CAAC,CAAC;AAAA,EAC7D,cAAc,eAAe;AAAA,EAC7B,OAAO;AAAA;AAGT,eAAe,eAAe,CAC5B,YACA,OACA,QACA,UACe;AAAA,EAEf,MAAM,QAAQ,KAAK,SAAS,OAAO,cAAc,EAAE;AAAA,EACnD,MAAM,WAAW,kBAAkB,OAAO;AAAA,IACxC;AAAA,IACA,OAAO,SAAS;AAAA,IAChB,iBAAiB,SAAS;AAAA,EAC5B,CAAC;AAAA,EACD,MAAM,WAAW,eAAe;AAAA,IAC9B;AAAA,IACA,YAAY,MAAM;AAAA,IAClB,SAAS,MAAM;AAAA,IACf,YAAY,SAAS,aAAa,cAAc;AAAA,IAChD,iBAAiB,SAAS;AAAA,IAC1B,aAAa,SAAS;AAAA,IACtB;AAAA,IACA,MAAM,SAAS,eAAe,EAAE,QAAQ,eAAe,SAAS,aAAa,IAAI;AAAA,OAC7E,SAAS,eAAe,EAAE,SAAS,IAAI,CAAC;AAAA,IAC5C,OAAO,SAAS;AAAA,EAClB,CAAC;AAAA;;;AC1GH,eAAsB,eAAe,CACnC,SACA,SACA,OACA,SACA,QACe;AAAA,EACf,MAAM,QAAQ,QAAQ;AAAA,EACtB,MAAM,UAAU,QAAQ,SAAS,kBAAkB,MAAM,KAAK,IAAI,YAAY,EAAE,OAAQ,QACtF,MAAM,KAAK;AAAA,EAEb,MAAM,aAAgC,EAAE,SAAS,SAAS,QAAQ,OAAO,UAAU;AAAA,EAEnF,MAAM,UAAU,IAAI,sBAClB,KAAK,SAAS,sBAAsB,MAAM,cAAc,GACxD,MAAM,SACR;AAAA,EACA,QAAQ,KAAK;AAAA,IACX;AAAA,IACA;AAAA,IACA,oBAAoB,CAAC,UAAU,gBAAgB,YAAY,KAAK;AAAA,EAClE,CAAC;AAAA,EAED,IAAI;AAAA,IACF,MAAM,QAAQ,oBAAoB,QAAQ,iBAAiB,OAAO,GAAG,SAAS;AAAA,MAC5E,UAAU,QAAQ,MAAM;AAAA,MACxB,SAAS,QAAQ,MAAM;AAAA,IACzB,CAAC,GAAG;AAAA,IAEJ,IAAI,CAAC,SAAS,CAAC,mBAAmB,OAAO,QAAQ,KAAK,GAAG;AAAA,MACvD,MAAM,iBACJ,4BACA,2EACF;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,MAAM,MAAM,MAAM;AAAA,MAC/B,OAAO,QAAQ,IAAI,CAAC,UAAU,MAAM,MAAM,IAAI;AAAA,MAC9C,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IACD,MAAM,SAAS,yBACb,QACA,QAAQ,QACR,QAAQ,MAAM,WAAW,UAC3B;AAAA,IAGA,MAAM,QAAQ,QAAQ,SAAS,eAAgB,YAAY;AAAA,MACzD,WAAW,QAAQ;AAAA,MACnB,SAAS,QAAQ,IAAI,GAAG,QAAQ,WAAW;AAAA,QACzC,IAAI,KAAK;AAAA,QACT,gBAAgB;AAAA,QAChB,QAAQ;AAAA,QACR,QAAQ,OAAO;AAAA,QACf,aAAa,IAAI,KAAK,EAAE,YAAY;AAAA,MACtC,EAAE;AAAA,IACJ,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,MAAM,wBAAwB,YAAY,KAAK;AAAA;AAAA;AAInD,eAAe,eAAe,CAC5B,YACA,OACe;AAAA,EACf,WAAW,OAAO,eAAe;AAAA,EACjC,WAAW,QAAQ;AAAA,EAEnB,MAAM,UAAU,MAAM,eAAe,YAAY,WAAW,WAAW,EAAE,YAAY,KAAK,CAAC;AAAA,EAC3F,WAAW,QAAQ,UAAU,YAAY;AAAA,EAEzC,IAAI,CAAC,SAAS;AAAA,IACZ,IAAI,WAAW,QAAQ,WAAW,GAAG;AAAA,MACnC,MAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AAAA,IACA,MAAM,IAAI,wBAAuB,IAAI,KAAK,EAAE,YAAY,CAAC;AAAA,EAC3D;AAAA,EAEA,IAAI;AAAA,IACF,MAAM,MAAM;AAAA,IACZ,OAAO,OAAO;AAAA,IACd,MAAM,eAAe,YAAY,WAAW,SAAS;AAAA,IACrD,WAAW,QAAQ;AAAA,IACnB,MAAM;AAAA;AAAA;AAIV,SAAS,wBAAwB,CAC/B,QACA,OACA,YACgC;AAAA,EAChC,IAAI;AAAA,IACF,IAAI,CAAC,MAAM,QAAQ,QAAQ,OAAO,KAAK,OAAO,QAAQ,WAAW,OAAO;AAAA,MACtE,MAAM,IAAI,MAAM,yBAAyB;AAAA,IAC3C;AAAA,IAEA,OAAO,OAAO,QAAQ,IAAI,CAAC,WAAW,iBAAgB,QAAQ,UAAU,CAAC;AAAA,IACzE,OAAO,OAAO;AAAA,IACd,MAAM,iBAAgB,2BAA2B,4CAA4C;AAAA,MAC3F;AAAA,IACF,CAAC;AAAA;AAAA;AAIL,eAAe,uBAAuB,CACpC,YACA,OACe;AAAA,EAGf,IAAI,WAAW,UAAU,cAAc,iBAAiB,yBAAwB;AAAA,IAC9E,MAAM;AAAA,EACR;AAAA,EAEA,IAAI,WAAW,UAAU,WAAW;AAAA,IAClC,IACE,aAAY,KAAK,MAChB,MAAM,SAAS,6BAA6B,MAAM,SAAS,+BAC5D;AAAA,MACA,MAAM,cAAc,QAAQ,MAAM,OAAO;AAAA,MACzC,MAAM,eAAe,YAAY,WAAW,WAAW,EAAE,YAAY,CAAC;AAAA,MACtE,MAAM,IAAI,wBAAuB,WAAW;AAAA,IAC9C;AAAA,IAEA,IAAI,WAAW,OAAO;AAAA,MAAS,MAAM;AAAA,EACvC;AAAA,EAEA,MAAM,UACJ,iBAAiB,+BACb,iBAAgB,2BAA2B,4CAA4C;AAAA,IACrF,OAAO;AAAA,EACT,CAAC,IACD;AAAA,EACN,QAAQ,SAAS,YAAY;AAAA,EAC7B,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAE1C,aAAa,UAAU,SAAS;AAAA,IAC9B,MAAM,KAAK,SAAS,UAAU,KAAK,MAAM,QAAQ,WAAW,MAAM,GAAG,OAAO;AAAA,EAC9E;AAAA;AAGF,SAAS,cAAc,CACrB,YACA,gBACA,QACA,UAA0D,CAAC,GACzC;AAAA,EAClB,QAAQ,SAAS,YAAY;AAAA,EAC7B,MAAM,cAAc,QAAQ,eAAe,IAAI,KAAK,EAAE,YAAY;AAAA,EAElE,OAAO,QAAQ,QAAQ,SAAS,eAAgB,YAAY;AAAA,IAC1D,WAAW,QAAQ;AAAA,IACnB,YAAY,QAAQ,cAAc;AAAA,IAClC,SAAS,QAAQ,IAAI,GAAG,YAAY,EAAE,IAAI,KAAK,IAAI,gBAAgB,QAAQ,YAAY,EAAE;AAAA,EAC3F,CAAC;AAAA;;;AC9KH,eAAsB,aAAa,CACjC,SACA,cACA,IACA,SACA,QACe;AAAA,EACf,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAC1C,IAAI,CAAC;AAAA,IAAU,MAAM,IAAI,MAAM,4DAA4D;AAAA,EAC3F,MAAM,YAAY,QAAQ;AAAA,EAC1B,MAAM,OAAO,MAAM,SAAS,IAAI,EAAE,WAAW,GAAG,CAAC;AAAA,EACjD,IAAI,CAAC,QAAQ,KAAK,WAAW;AAAA,IAAU;AAAA,EACvC,IAAI,KAAK,WAAW,WAAW;AAAA,IAC7B,MAAM,KACJ,SACA,UACA,MACA,iBACE,0BACA,uFACF,CACF;AAAA,IACA;AAAA,EACF;AAAA,EACA,IAAI,KAAK,MAAM,KAAK,WAAW,IAAI,KAAK,IAAI;AAAA,IAAG,MAAM,IAAI,wBAAuB,KAAK,WAAW;AAAA,EAChG,MAAM,WAAW,MAAM,QAAQ,SAAS,IAAI;AAAA,EAC5C,IAAI,CAAC,UAAU;AAAA,IACb,MAAM,SAAS,OAAO,EAAE,WAAW,GAAG,CAAC;AAAA,IACvC;AAAA,EACF;AAAA,EACA,MAAM,QAAQ,MAAM,cAAc,SAAS,MAAM,KAAK,WAAW,KAAK,EAAE;AAAA,EACxE,IAAI,KAAK,WAAW,SAAS;AAAA,IAC3B,MAAM,YAAY,SAAS,cAAc,MAAM,OAAO,MAAM;AAAA,IAC5D;AAAA,EACF;AAAA,EACA,MAAM,gBAAgB,SAAS,CAAC,EAAE,MAAM,OAAO,SAAS,CAAC,GAAG,OAAO,SAAS,MAAM;AAAA,EAClF,MAAM,QAAQ,MAAM,SAAS,IAAI,EAAE,WAAW,GAAG,CAAC;AAAA,EAClD,IAAI,OAAO,WAAW;AAAA,IAAS,MAAM,YAAY,SAAS,cAAc,OAAO,OAAO,MAAM;AAAA;;;ACpC9F,eAAsB,gBAAgB,CACpC,SACA,cACA,SACA,OACA,QACe;AAAA,EACf,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAC1C,MAAM,WAAW,EAAE,WAAW,QAAQ,WAAW,QAAQ;AAAA,EAEzD,SAAS,UAAU,EAAG,UAAU,GAAG,WAAW;AAAA,IAC5C,MAAM,SAAS,MAAM,SAAS,SAAS,QAAQ,GAAG,OAAO,CAAC,SAAS,KAAK,WAAW,OAAO;AAAA,IAC1F,MAAM,SAA8B,CAAC;AAAA,IAErC,WAAW,QAAQ,OAAO;AAAA,MACxB,OAAO,eAAe;AAAA,MACtB,MAAM,QAAQ,MAAM,QAAQ,SAAS,IAAI;AAAA,MACzC,IAAI,OAAO;AAAA,QACT,OAAO,KAAK,EAAE,OAAO,QAAQ,KAAK,OAAQ,CAAC;AAAA,MAC7C,EAAO;AAAA,QACL,MAAM,SAAS,OAAO,EAAE,WAAW,QAAQ,WAAW,IAAI,KAAK,GAAG,CAAC;AAAA;AAAA,IAEvE;AAAA,IAEA,IAAI,CAAC,OAAO;AAAA,MAAQ;AAAA,IAEpB,IAAI;AAAA,MACF,OAAO,eAAe;AAAA,MACtB,MAAM,sBAAsB,cAAc,OAAO,MAAM;AAAA,MACvD;AAAA,MACA,OAAO,OAAO;AAAA,MACd,IAAI,EAAE,iBAAiB;AAAA,QAA+B,MAAM;AAAA;AAAA,EAEhE;AAAA,EAGA,IAAI,WAAW;AAAA,EACf,WAAW,QAAQ,MAAM,SAAS,SAAS,QAAQ,GAAG;AAAA,IACpD,IAAI,KAAK,WAAW;AAAA,MAAS;AAAA,IAC7B,IAAI;AAAA,MACF,MAAM,YAAY,SAAS,cAAc,MAAM,OAAO,MAAM;AAAA,MAC5D,OAAO,OAAO;AAAA,MACd,IAAI,EAAE,iBAAiB;AAAA,QAAyB,MAAM;AAAA,MACtD,WAAW;AAAA;AAAA,EAEf;AAAA,EAEA,IAAI;AAAA,IAAU,MAAM,IAAI,wBAAuB,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,EAAE,YAAY,CAAC;AAAA;;;AClD1F,eAAsB,kBAAkB,CACtC,SACA,cACA,SACA,OACA,SACA,QACe;AAAA,EACf,IAAI,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,SAAS,GAAG;AAAA,IACnD,MAAM,YAAY,SAAS,cAAc,SAAS,OAAO,SAAS,MAAM;AAAA,IACxE;AAAA,EACF;AAAA,EAEA,MAAM,UAAU,MAAM,aAAa,SAAS,OAAO,MAAM;AAAA,EACzD,MAAM,QAAQ,QAAQ;AAAA,EACtB,IAAI,CAAC;AAAA,IAAO;AAAA,EAEZ,MAAM,SAAS,eAAe,SAAS,MAAM,IAAI;AAAA,EACjD,IAAI,CAAC,QAAQ;AAAA,IAEX,aAAa,UAAU,SAAS;AAAA,MAC9B,MAAM,cAAc,SAAS,cAAc,KAAK,IAAI,SAAS,MAAM;AAAA,IACrE;AAAA,IACA;AAAA,EACF;AAAA,EAEA,wBAAwB,SAAS,MAAM,IAAI;AAAA,EAC3C,MAAM,QAAQ,MAAM,cAAc,SAAS,MAAM,MAAM,OAAO;AAAA,EAE9D,WAAW,SAAS,UAAU,SAAS,MAAM,GAAG;AAAA,IAC9C,IAAI,MAAM,WAAW,GAAG;AAAA,MACtB,MAAM,cAAc,SAAS,cAAc,MAAM,GAAI,KAAK,IAAI,SAAS,MAAM;AAAA,IAC/E,EAAO;AAAA,MACL,MAAM,gBAAgB,SAAS,OAAO,OAAO,SAAS,MAAM;AAAA;AAAA,EAEhE;AAAA,EAEA,MAAM,iBAAiB,SAAS,cAAc,SAAS,OAAO,MAAM;AAAA;AAItE,eAAe,WAAW,CACxB,SACA,cACA,SACA,OACA,SACA,QACe;AAAA,EACf,MAAM,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,WAAW,OAAO;AAAA,EAC1D,IAAI,OAAO;AAAA,IACT,MAAM,QAAQ,MAAM,cAAc,SAAS,OAAO,OAAO;AAAA,IACzD,MAAM,iBAAiB,SAAS,cAAc,SAAS,OAAO,MAAM;AAAA,EACtE;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,KAAK,WAAW,SAAS;AAAA,MAC3B,MAAM,cAAc,SAAS,cAAc,KAAK,IAAI,SAAS,MAAM;AAAA,IACrE;AAAA,EACF;AAAA;AAGF,eAAe,YAAY,CACzB,SACA,OACA,QACiC;AAAA,EACjC,MAAM,cAAc,MAAM,OACxB,CAAC,QAAQ,SAAU,KAAK,cAAc,SAAS,KAAK,cAAc,QAClE,EACF;AAAA,EACA,IAAI,KAAK,MAAM,WAAW,IAAI,KAAK,IAAI,GAAG;AAAA,IACxC,MAAM,IAAI,wBAAuB,WAAW;AAAA,EAC9C;AAAA,EAEA,MAAM,UAAkC,CAAC;AAAA,EACzC,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,EAE1C,WAAW,QAAQ,OAAO;AAAA,IACxB,OAAO,eAAe;AAAA,IACtB,MAAM,QAAQ,MAAM,QAAQ,SAAS,IAAI;AAAA,IAEzC,IAAI,OAAO;AAAA,MACT,QAAQ,KAAK,EAAE,MAAM,MAAM,CAAC;AAAA,IAC9B,EAAO;AAAA,MACL,MAAM,SAAS,OAAO,EAAE,WAAW,QAAQ,WAAW,IAAI,KAAK,GAAG,CAAC;AAAA;AAAA,EAEvE;AAAA,EAEA,OAAO;AAAA;AAGT,SAAS,cAAc,CACrB,SACA,MACkC;AAAA,EAClC,MAAM,UAAU,QAAQ,SAAS,kBAAkB,KAAK,IAAI,YAAY,EAAE,OAAQ,QAChF,KAAK;AAAA,EAGP,OAAO,QAAQ,iBAAiB,SAAS;AAAA,IACvC,UAAU,QAAQ,MAAM;AAAA,IACxB,SAAS,QAAQ,MAAM;AAAA,EACzB,CAAC,GAAG,MAAM;AAAA;AAIZ,SAAS,uBAAuB,CAC9B,SACA,WACM;AAAA,EACN,MAAM,eAAe,QAAQ,KAC3B,GAAG,WACD,KAAK,mBAAmB,UAAU,kBAClC,KAAK,IAAI,iBAAiB,UAAU,IAAI,gBACxC,KAAK,YAAY,UAAU,WAC3B,KAAK,kBAAkB,UAAU,aACrC;AAAA,EAEA,IAAI,cAAc;AAAA,IAChB,MAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AAAA;AAIF,UAAU,SAAS,CAAC,SAA0C,QAA8B;AAAA,EAC1F,IAAI,QAAgC,CAAC;AAAA,EACrC,IAAI,QAAQ;AAAA,EAEZ,WAAW,SAAS,SAAS;AAAA,IAC3B,MAAM,OAAO,OAAO,WAAW,MAAM,MAAM,IAAI;AAAA,IAC/C,MAAM,oBACJ,MAAM,UAAU,OAAO,aACvB,QAAQ,OAAO,OAAO,sBACtB,OAAO,OAAO;AAAA,IAEhB,IAAI,MAAM,SAAS,KAAK,mBAAmB;AAAA,MACzC,MAAM;AAAA,MACN,QAAQ,CAAC;AAAA,MACT,QAAQ;AAAA,IACV;AAAA,IAEA,IAAI,OAAO,OAAO,iBAAiB,OAAO,OAAO,oBAAoB;AAAA,MACnE,MAAM,CAAC,KAAK;AAAA,MACZ;AAAA,IACF;AAAA,IAEA,MAAM,KAAK,KAAK;AAAA,IAChB,SAAS;AAAA,EACX;AAAA,EAEA,IAAI,MAAM,SAAS;AAAA,IAAG,MAAM;AAAA;;;ACxJvB,SAAS,2BAA2B,CACzC,SACA,cACuB;AAAA,EACvB,OAAO;AAAA,SACC,QAAO,CAAC,IAAI,SAAS,QAAQ;AAAA,MACjC,MAAM,WAAW,QAAQ,QAAQ,SAAS;AAAA,MAC1C,IAAI,CAAC;AAAA,QAAU,MAAM,IAAI,MAAM,4DAA4D;AAAA,MAC3F,MAAM,QAAQ,MAAM,SAAS,SAAS,EAAE,WAAW,QAAQ,WAAW,SAAS,GAAG,CAAC;AAAA,MACnF,IAAI,MAAM;AAAA,QAAQ,MAAM,mBAAmB,SAAS,cAAc,IAAI,OAAO,SAAS,MAAM;AAAA,MACvF;AAAA,cAAM,cAAc,SAAS,cAAc,IAAI,SAAS,MAAM;AAAA;AAAA,EAEvE;AAAA;;;ACfF,IAAM,WAAW,IAAI;AAEd,SAAS,6BAA6B,CAAC,MAAc,SAAsC;AAAA,EAChG,SAAS,IAAI,MAAM,OAAO;AAAA;AAGrB,SAAS,yBAAwB,CAAC,MAAqC;AAAA,EAC5E,MAAM,UAAU,SAAS,IAAI,IAAI;AAAA,EACjC,IAAI,CAAC;AAAA,IAAS,MAAM,IAAI,MAAM,yDAAyD;AAAA,EACvF,OAAO;AAAA;;;ACRT,IAAM,mBAAmB,IAAI;AAGtB,SAAS,mBAAkB,CAAC,MAAc,QAAsB;AAAA,EACrE,iBAAiB,IAAI,MAAM,gBAAgB,MAAM,CAAC;AAAA;AAG7C,SAAS,kBAAkB,CAAC,MAAkC;AAAA,EACnE,OAAO,iBAAiB,IAAI,IAAI;AAAA;AAGlC,SAAS,eAAe,CAAC,OAAuB;AAAA,EAC9C,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,MAAM,IAAI,IAAI,KAAK;AAAA,IACnB,MAAM;AAAA,IACN,MAAM,IAAI,MAAM,sCAAsC,SAAS;AAAA;AAAA,EAEjE,IAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU;AAAA,IACzD,MAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAAA,EACA,IAAI,IAAI,aAAa,OAAO,IAAI,UAAU,IAAI,MAAM;AAAA,IAClD,MAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AAAA,EACA,OAAO,IAAI;AAAA;",
-  "debugId": "2C71EF9B86846F7764756E2164756E21",
-  "names": []
-}

package/dist/chunk-xt1zt7gv.js.map

@@ -1,13 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/security/errors.ts", "../src/security/membership-policies.ts", "../src/security/validation.ts", "../src/security/builders.ts"],
-  "sourcesContent": [
-    "export class SecurityValidationError extends Error {\n  readonly name = \"SecurityValidationError\"\n}\n",
-    "import type { MembershipOperation, MembershipPolicyDefinition } from \"./types\"\n\nexport interface MembershipOperationScope {\n  readonly policyIds: readonly string[]\n  readonly groupIds: ReadonlySet<string>\n}\n\nexport interface MembershipPolicyScope {\n  readonly policyIds: readonly string[]\n  readonly operations: Readonly<Record<MembershipOperation, MembershipOperationScope>>\n}\n\nconst MEMBERSHIP_OPERATIONS = [\"invite\", \"assignGroups\", \"suspend\"] as const\n\nexport function resolveMembershipPolicyScope(input: {\n  readonly membershipPolicies: readonly MembershipPolicyDefinition[]\n  readonly callerGroupIds: readonly string[]\n}): MembershipPolicyScope {\n  const callerGroups = new Set(input.callerGroupIds)\n  const policyIds: string[] = []\n  const operations = createEmptyOperationScopes()\n\n  for (const policy of input.membershipPolicies) {\n    if (!policy.grantedToGroupIds.some((groupId) => callerGroups.has(groupId))) {\n      continue\n    }\n\n    policyIds.push(policy.id)\n    for (const operation of policy.can) {\n      operations[operation].policyIds.push(policy.id)\n      for (const groupId of policy.scopeGroupIds) {\n        operations[operation].groupIds.add(groupId)\n      }\n    }\n  }\n\n  return {\n    policyIds,\n    operations: {\n      invite: freezeOperationScope(operations.invite),\n      assignGroups: freezeOperationScope(operations.assignGroups),\n      suspend: freezeOperationScope(operations.suspend),\n    },\n  }\n}\n\nexport function canPerformMembershipOperation(\n  scope: MembershipPolicyScope,\n  operation: MembershipOperation,\n  groupIds: readonly string[]\n): boolean {\n  const operationScope = scope.operations[operation]\n\n  if (operationScope.policyIds.length === 0) {\n    return false\n  }\n\n  if (groupIds.length === 0) {\n    return true\n  }\n\n  return groupIds.every((groupId) => operationScope.groupIds.has(groupId))\n}\n\nexport function missingMembershipGroupIds(\n  scope: MembershipPolicyScope,\n  operation: MembershipOperation,\n  groupIds: readonly string[]\n): readonly string[] {\n  if (groupIds.length === 0) {\n    return []\n  }\n\n  const operationScope = scope.operations[operation]\n  return groupIds.filter((groupId) => !operationScope.groupIds.has(groupId))\n}\n\nfunction createEmptyOperationScopes(): Record<\n  MembershipOperation,\n  { policyIds: string[]; groupIds: Set<string> }\n> {\n  return {\n    invite: { policyIds: [], groupIds: new Set<string>() },\n    assignGroups: { policyIds: [], groupIds: new Set<string>() },\n    suspend: { policyIds: [], groupIds: new Set<string>() },\n  }\n}\n\nfunction freezeOperationScope(input: {\n  readonly policyIds: readonly string[]\n  readonly groupIds: ReadonlySet<string>\n}): MembershipOperationScope {\n  return {\n    policyIds: [...input.policyIds],\n    groupIds: new Set(input.groupIds),\n  }\n}\n\nexport function isMembershipOperation(value: unknown): value is MembershipOperation {\n  return MEMBERSHIP_OPERATIONS.includes(value as MembershipOperation)\n}\n",
-    "import { GRANT_KINDS, type GrantUniverseKey, grantKindOf } from \"../authorization/grant-kinds\"\nimport { SecurityValidationError } from \"./errors\"\nimport { isMembershipOperation } from \"./membership-policies\"\nimport type {\n  GrantCapability,\n  GrantDefinition,\n  GroupDefinition,\n  MarkingDefinition,\n  MembershipPolicyDefinition,\n  RegisteredSecurityDefinitions,\n  RoleDefinition,\n  Selection,\n} from \"./types\"\n\n/** Registered id universes and singleton capabilities available to role grants. */\ntype RegisteredUniverses = Partial<Record<GrantUniverseKey, ReadonlySet<string>>> & {\n  readonly agentAvailable?: boolean\n}\n\n/**\n * Every grant capability, for validating grants that arrive from untyped code.\n *\n * Written as a total `Record<GrantCapability, true>` rather than a bare array so a capability added\n * to `GrantDefinition` is a compile error here — the same discipline `GRANT_KINDS` uses. The\n * hand-written `capability !== \"access\" && …` chain this replaces would have accepted the new\n * capability at startup and then died on `GRANT_KINDS[kind].universeKey`.\n */\nconst GRANT_CAPABILITIES = Object.keys({\n  access: true,\n  view: true,\n  edit: true,\n  append: true,\n  apply: true,\n  share: true,\n  run: true,\n  observe: true,\n  manage: true,\n} satisfies Record<GrantCapability, true>) as readonly GrantCapability[]\n\n/** \"'a', 'b', or 'c'\" — the shape the security errors already use. */\nfunction formatAlternatives(values: readonly string[]): string {\n  const quoted = values.map((value) => `'${value}'`)\n  const last = quoted.at(-1)\n  return quoted.length < 2 ? (last ?? \"\") : `${quoted.slice(0, -1).join(\", \")}, or ${last}`\n}\n\nexport type CreateSecurityError = (message: string) => Error\n\n// Shared, single-source validation primitives. The builders reuse these too, so\n// authoring-time and startup-time checks can never drift apart.\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nexport function assertNonEmptyString(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is string {\n  if (typeof value !== \"string\" || value.trim().length === 0) {\n    throw createError(`[Sixb] ${field} must not be empty.`)\n  }\n}\n\nexport function assertOptionalString(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is string | undefined {\n  if (value === undefined) {\n    return\n  }\n\n  if (typeof value !== \"string\") {\n    throw createError(`[Sixb] ${field} must be a string.`)\n  }\n}\n\nfunction assertStringArray(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is readonly string[] {\n  if (!Array.isArray(value)) {\n    throw createError(`[Sixb] ${field} must be an array of group ids.`)\n  }\n\n  for (const item of value) {\n    assertNonEmptyString(item, `${field} item`, createError)\n  }\n}\n\nfunction assertMembershipOperationArray(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is MembershipPolicyDefinition[\"can\"] {\n  if (!Array.isArray(value)) {\n    throw createError(`[Sixb] ${field} must be an array of membership operations.`)\n  }\n\n  for (const item of value) {\n    if (!isMembershipOperation(item)) {\n      throw createError(\n        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`\n      )\n    }\n  }\n}\n\nfunction assertNoDuplicateIds(ids: readonly string[], field: string): void {\n  const seen = new Set<string>()\n  for (const id of ids) {\n    if (seen.has(id)) {\n      throw new SecurityValidationError(`[Sixb] ${field} contains duplicate group id '${id}'.`)\n    }\n    seen.add(id)\n  }\n}\n\nfunction assertNoDuplicateOperations(\n  operations: readonly MembershipPolicyDefinition[\"can\"][number][],\n  field: string\n): void {\n  const seen = new Set<string>()\n  for (const operation of operations) {\n    if (seen.has(operation)) {\n      throw new SecurityValidationError(\n        `[Sixb] ${field} contains duplicate operation '${operation}'.`\n      )\n    }\n    seen.add(operation)\n  }\n}\n\nexport function assertMarkingDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is MarkingDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Marking definition must be an object.\")\n  }\n\n  if (value.kind !== \"marking\") {\n    throw createError(\"[Sixb] Marking definition kind must be 'marking'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Marking id\", createError)\n  assertOptionalString(value.label, `Marking '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Marking '${value.id}' description`, createError)\n}\n\nexport function isMarkingDefinition(value: unknown): value is MarkingDefinition {\n  try {\n    assertMarkingDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertGroupDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is GroupDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Group definition must be an object.\")\n  }\n\n  if (value.kind !== \"group\") {\n    throw createError(\"[Sixb] Group definition kind must be 'group'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Group id\", createError)\n  assertOptionalString(value.label, `Group '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Group '${value.id}' description`, createError)\n}\n\nexport function isGroupDefinition(value: unknown): value is GroupDefinition {\n  try {\n    assertGroupDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertMembershipPolicyDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is MembershipPolicyDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Membership policy definition must be an object.\")\n  }\n\n  if (value.kind !== \"membershipPolicy\") {\n    throw createError(\"[Sixb] Membership policy definition kind must be 'membershipPolicy'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Membership policy id\", createError)\n  assertStringArray(\n    value.grantedToGroupIds,\n    `Membership policy '${value.id}' grantedTo`,\n    createError\n  )\n  assertStringArray(value.scopeGroupIds, `Membership policy '${value.id}' scope`, createError)\n  assertMembershipOperationArray(value.can, `Membership policy '${value.id}' can`, createError)\n}\n\nexport function isMembershipPolicyDefinition(value: unknown): value is MembershipPolicyDefinition {\n  try {\n    assertMembershipPolicyDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertGrantDefinition(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is GrantDefinition {\n  if (!isRecord(value) || value.kind !== \"grant\") {\n    throw createError(`[Sixb] ${field} must contain only grant definitions from 'can'.`)\n  }\n\n  if (!GRANT_CAPABILITIES.includes(value.capability as GrantCapability)) {\n    throw createError(\n      `[Sixb] ${field} grant capability must be ${formatAlternatives(GRANT_CAPABILITIES)}.`\n    )\n  }\n\n  if (value.capability === \"access\" && value.target !== \"application\") {\n    throw createError(`[Sixb] ${field} access grant target must be 'application'.`)\n  }\n\n  if (value.capability === \"view\" && value.target !== \"object\" && value.target !== \"dataset\") {\n    throw createError(`[Sixb] ${field} view grant target must be 'object' or 'dataset'.`)\n  }\n\n  if (\n    value.capability === \"run\" &&\n    value.target !== \"workflow\" &&\n    value.target !== \"sync\" &&\n    value.target !== \"pipeline\" &&\n    value.target !== \"agent\"\n  ) {\n    throw createError(\n      `[Sixb] ${field} run grant target must be 'workflow', 'sync', 'pipeline', or 'agent'.`\n    )\n  }\n\n  if (value.capability === \"observe\" && value.target !== \"logs\" && value.target !== \"aiUsage\") {\n    throw createError(`[Sixb] ${field} observe grant target must be 'logs' or 'aiUsage'.`)\n  }\n\n  if (value.capability === \"manage\" && value.target !== \"connector\" && value.target !== \"aiUsage\") {\n    throw createError(`[Sixb] ${field} manage grant target must be 'connector' or 'aiUsage'.`)\n  }\n\n  if (value.capability === \"run\" && value.target === \"agent\") {\n    if (value.selection !== undefined) {\n      throw createError(`[Sixb] ${field} agent run grant must not declare a selection.`)\n    }\n    return\n  }\n\n  assertSelection(value.selection, field, createError)\n}\n\nfunction assertSelection(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is Selection {\n  if (!isRecord(value) || typeof value.all !== \"boolean\") {\n    throw createError(`[Sixb] ${field} grant must carry a selection from 'can' or a scope.`)\n  }\n\n  const ids = value.all ? value.except : value.ids\n  if (!Array.isArray(ids)) {\n    throw createError(`[Sixb] ${field} grant selection must list ids.`)\n  }\n\n  for (const id of ids) {\n    assertNonEmptyString(id, `${field} grant selection id`, createError)\n  }\n}\n\nexport function assertRoleDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is RoleDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Role definition must be an object.\")\n  }\n\n  if (value.kind !== \"role\") {\n    throw createError(\"[Sixb] Role definition kind must be 'role'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Role id\", createError)\n  assertOptionalString(value.label, `Role '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Role '${value.id}' description`, createError)\n  assertStringArray(value.grantedToGroupIds, `Role '${value.id}' grantedTo`, createError)\n\n  if (!Array.isArray(value.grants)) {\n    throw createError(`[Sixb] Role '${value.id}' grants must be an array.`)\n  }\n\n  for (const grant of value.grants) {\n    assertGrantDefinition(grant, `Role '${value.id}' grants`, createError)\n  }\n\n  if (value.clearances !== undefined) {\n    assertStringArray(value.clearances, `Role '${value.id}' clearances`, createError)\n  }\n}\n\nexport function isRoleDefinition(value: unknown): value is RoleDefinition {\n  try {\n    assertRoleDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function validateSecurityDefinitionsAtStartup(input: {\n  readonly markings?: readonly MarkingDefinition[]\n  readonly groups: readonly GroupDefinition[]\n  readonly membershipPolicies: readonly MembershipPolicyDefinition[]\n  readonly roles?: readonly RoleDefinition[]\n  /** Registered browser application ids — when provided, access grants must reference them. */\n  readonly applicationIds?: ReadonlySet<string>\n  /** Registered object type ids — when provided, view grants must reference them. */\n  readonly objectTypeIds?: ReadonlySet<string>\n  /** Registered dataset ids — when provided, dataset view grants must reference them. */\n  readonly datasetIds?: ReadonlySet<string>\n  /** Registered action ids — when provided, apply grants must reference them. */\n  readonly actionIds?: ReadonlySet<string>\n  /** Registered workflow ids — when provided, run grants must reference them. */\n  readonly workflowIds?: ReadonlySet<string>\n  /** Registered sync ids — when provided, sync run grants must reference them. */\n  readonly syncIds?: ReadonlySet<string>\n  /** Registered pipeline ids — when provided, pipeline run grants must reference them. */\n  readonly pipelineIds?: ReadonlySet<string>\n  /** Whether the project's single conversational Agent is configured. */\n  readonly agentAvailable?: boolean\n  /** Registered observability surfaces. */\n  readonly observableIds?: ReadonlySet<string>\n  /** Registered singleton management surfaces. */\n  readonly manageableIds?: ReadonlySet<string>\n  /** Registered connector ids — when provided, manage grants must reference them. */\n  readonly connectorIds?: ReadonlySet<string>\n  /** Registered Share ids — when provided, share grants must reference them. */\n  readonly shareIds?: ReadonlySet<string>\n}): RegisteredSecurityDefinitions {\n  const markingsById = new Map<string, MarkingDefinition>()\n  const groupsById = new Map<string, GroupDefinition>()\n  const rolesById = new Map<string, RoleDefinition>()\n  const membershipPoliciesById = new Map<string, MembershipPolicyDefinition>()\n\n  for (const marking of input.markings ?? []) {\n    assertMarkingDefinition(marking)\n\n    if (markingsById.has(marking.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate marking id: ${marking.id}`)\n    }\n\n    markingsById.set(marking.id, marking)\n  }\n\n  for (const group of input.groups) {\n    assertGroupDefinition(group)\n\n    if (groupsById.has(group.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate group id: ${group.id}`)\n    }\n\n    groupsById.set(group.id, group)\n  }\n\n  for (const role of input.roles ?? []) {\n    assertRoleDefinition(role)\n\n    if (rolesById.has(role.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate role id: ${role.id}`)\n    }\n\n    if (role.grantedToGroupIds.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${role.id}' must be granted to at least one group.`\n      )\n    }\n\n    const clearances = role.clearances ?? []\n    if (role.grants.length === 0 && clearances.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${role.id}' must declare at least one grant or clearance.`\n      )\n    }\n\n    assertNoDuplicateIds(role.grantedToGroupIds, `Role '${role.id}' grantedTo`)\n    assertNoDuplicateIds(clearances, `Role '${role.id}' clearances`)\n\n    for (const markingId of clearances) {\n      if (!markingsById.has(markingId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Role '${role.id}' clearances reference unknown marking '${markingId}'. Add it to 'security/markings/' or pass it to createSixb({ markings }).`\n        )\n      }\n    }\n\n    for (const groupId of role.grantedToGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Role '${role.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    for (const grant of role.grants) {\n      assertGrantReferences(role.id, grant, input)\n    }\n\n    rolesById.set(role.id, role)\n  }\n\n  for (const policy of input.membershipPolicies) {\n    assertMembershipPolicyDefinition(policy)\n\n    if (membershipPoliciesById.has(policy.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate membership policy id: ${policy.id}`)\n    }\n\n    if (policy.grantedToGroupIds.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Membership policy '${policy.id}' must grant membership authority to at least one group.`\n      )\n    }\n\n    if (policy.can.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Membership policy '${policy.id}' must declare at least one operation.`\n      )\n    }\n\n    assertNoDuplicateIds(policy.grantedToGroupIds, `Membership policy '${policy.id}' grantedTo`)\n    assertNoDuplicateIds(policy.scopeGroupIds, `Membership policy '${policy.id}' scope`)\n    assertNoDuplicateOperations(policy.can, `Membership policy '${policy.id}' can`)\n\n    for (const groupId of policy.grantedToGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Membership policy '${policy.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    for (const groupId of policy.scopeGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Membership policy '${policy.id}' scope references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    membershipPoliciesById.set(policy.id, policy)\n  }\n\n  return {\n    markings: [...markingsById.values()],\n    markingsById,\n    groups: [...groupsById.values()],\n    groupsById,\n    roles: [...rolesById.values()],\n    rolesById,\n    membershipPolicies: [...membershipPoliciesById.values()],\n    membershipPoliciesById,\n  }\n}\n\nfunction assertGrantReferences(\n  roleId: string,\n  grant: GrantDefinition,\n  registered: RegisteredUniverses\n): void {\n  if (grant.capability === \"run\" && grant.target === \"agent\") {\n    const spec = GRANT_KINDS[grantKindOf(grant)]\n    if (!registered.agentAvailable) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${roleId}' grants ${grant.capability} on the project Agent, but it is unavailable. ${spec.fix}`\n      )\n    }\n    return\n  }\n  const spec = GRANT_KINDS[grantKindOf(grant)]\n  const universe = registered[spec.universeKey]\n\n  if (!universe) {\n    return\n  }\n\n  // Explicit selections list ids to include; \"all except\" selections list ids\n  // to exclude. Either way every named id must be registered — an unknown id is\n  // a typo that would silently widen or no-op the grant.\n  const ids = grant.selection.all ? grant.selection.except : grant.selection.ids\n\n  for (const id of ids) {\n    if (!universe.has(id)) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${roleId}' grants ${grant.capability} on unknown ${spec.subject} '${id}'. ${spec.fix}`\n      )\n    }\n  }\n}\n",
-    "import { SecurityValidationError } from \"./errors\"\nimport type {\n  GrantDefinition,\n  GroupDefinition,\n  MarkingDefinition,\n  MembershipOperation,\n  MembershipPolicyDefinition,\n  RoleDefinition,\n} from \"./types\"\nimport {\n  assertGrantDefinition,\n  assertNonEmptyString,\n  assertOptionalString,\n  isRecord,\n} from \"./validation\"\n\nexport interface DefineGroupOptions {\n  readonly label?: string\n  readonly description?: string\n}\n\nexport interface DefineMarkingOptions {\n  readonly label?: string\n  readonly description?: string\n}\n\nexport interface DefineRoleOptions {\n  readonly label?: string\n  readonly description?: string\n  readonly grantedTo: readonly GroupDefinition[]\n  readonly grants?: readonly GrantDefinition[]\n  /** Markings this role's members may read. */\n  readonly clearances?: readonly MarkingDefinition[]\n}\n\nexport interface DefineMembershipPolicyOptions {\n  readonly grantedTo: readonly GroupDefinition[]\n  readonly scope: readonly GroupDefinition[]\n  readonly can: readonly MembershipOperation[]\n}\n\nconst MEMBERSHIP_OPERATIONS = new Set<MembershipOperation>([\"invite\", \"assignGroups\", \"suspend\"])\n\nfunction assertNonEmptyArray<T>(value: readonly T[], field: string): void {\n  if (value.length === 0) {\n    throw new SecurityValidationError(`[Sixb] ${field} must not be empty.`)\n  }\n}\n\nfunction groupIdsFrom(groups: readonly GroupDefinition[], field: string): readonly string[] {\n  return groups.map((group) => {\n    if (!isRecord(group) || group.kind !== \"group\") {\n      throw new SecurityValidationError(`[Sixb] ${field} must contain only group definitions.`)\n    }\n\n    assertNonEmptyString(group.id, `${field} group id`)\n    return group.id\n  })\n}\n\nfunction membershipOperationsFrom(\n  operations: readonly MembershipOperation[],\n  field: string\n): readonly MembershipOperation[] {\n  return operations.map((operation) => {\n    if (!MEMBERSHIP_OPERATIONS.has(operation)) {\n      throw new SecurityValidationError(\n        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`\n      )\n    }\n\n    return operation\n  })\n}\n\nexport function defineGroup<const TId extends string>(\n  id: TId,\n  options: DefineGroupOptions = {}\n): GroupDefinition<TId> {\n  assertNonEmptyString(id, \"Group id\")\n  assertOptionalString(options.label, `Group '${id}' label`)\n  assertOptionalString(options.description, `Group '${id}' description`)\n\n  return {\n    kind: \"group\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n  }\n}\n\n/** Read the ids of marking definitions, rejecting anything else such as a bare id. */\nexport function markingIdsFrom(\n  markings: readonly MarkingDefinition[],\n  field: string\n): readonly string[] {\n  return markings.map((marking) => {\n    if (!isRecord(marking) || marking.kind !== \"marking\") {\n      throw new SecurityValidationError(`[Sixb] ${field} must contain only marking definitions.`)\n    }\n\n    assertNonEmptyString(marking.id, `${field} marking id`)\n    return marking.id\n  })\n}\n\nexport function defineMarking<const TId extends string>(\n  id: TId,\n  options: DefineMarkingOptions = {}\n): MarkingDefinition<TId> {\n  assertNonEmptyString(id, \"Marking id\")\n  assertOptionalString(options.label, `Marking '${id}' label`)\n  assertOptionalString(options.description, `Marking '${id}' description`)\n\n  return {\n    kind: \"marking\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n  }\n}\n\nexport function defineRole<const TId extends string>(\n  id: TId,\n  options: DefineRoleOptions\n): RoleDefinition<TId> {\n  assertNonEmptyString(id, \"Role id\")\n  assertOptionalString(options.label, `Role '${id}' label`)\n  assertOptionalString(options.description, `Role '${id}' description`)\n  assertNonEmptyArray(options.grantedTo, `Role '${id}' grantedTo`)\n\n  const grantedToGroupIds = groupIdsFrom(options.grantedTo, `Role '${id}' grantedTo`)\n  const grants = options.grants ?? []\n  const clearances = markingIdsFrom(options.clearances ?? [], `Role '${id}' clearances`)\n\n  for (const grant of grants) {\n    assertGrantDefinition(grant, `Role '${id}' grants`)\n  }\n\n  if (grants.length === 0 && clearances.length === 0) {\n    throw new SecurityValidationError(\n      `[Sixb] Role '${id}' must declare at least one grant or clearance.`\n    )\n  }\n\n  return {\n    kind: \"role\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n    grantedToGroupIds,\n    grants,\n    ...(clearances.length > 0 ? { clearances } : {}),\n  }\n}\n\nexport function defineMembershipPolicy<const TId extends string>(\n  id: TId,\n  options: DefineMembershipPolicyOptions\n): MembershipPolicyDefinition<TId> {\n  assertNonEmptyString(id, \"Membership policy id\")\n  assertNonEmptyArray(options.grantedTo, `Membership policy '${id}' grantedTo`)\n  assertNonEmptyArray(options.can, `Membership policy '${id}' can`)\n\n  return {\n    kind: \"membershipPolicy\",\n    id,\n    grantedToGroupIds: groupIdsFrom(options.grantedTo, `Membership policy '${id}' grantedTo`),\n    scopeGroupIds: groupIdsFrom(options.scope, `Membership policy '${id}' scope`),\n    can: membershipOperationsFrom(options.can, `Membership policy '${id}' can`),\n  }\n}\n"
-  ],
-  "mappings": ";;;;;;;AAAO,MAAM,iCAAgC,MAAM;AAAA,EACxC,OAAO;AAClB;;;ACUA,IAAM,wBAAwB,CAAC,UAAU,gBAAgB,SAAS;AAE3D,SAAS,4BAA4B,CAAC,OAGnB;AAAA,EACxB,MAAM,eAAe,IAAI,IAAI,MAAM,cAAc;AAAA,EACjD,MAAM,YAAsB,CAAC;AAAA,EAC7B,MAAM,aAAa,2BAA2B;AAAA,EAE9C,WAAW,UAAU,MAAM,oBAAoB;AAAA,IAC7C,IAAI,CAAC,OAAO,kBAAkB,KAAK,CAAC,YAAY,aAAa,IAAI,OAAO,CAAC,GAAG;AAAA,MAC1E;AAAA,IACF;AAAA,IAEA,UAAU,KAAK,OAAO,EAAE;AAAA,IACxB,WAAW,aAAa,OAAO,KAAK;AAAA,MAClC,WAAW,WAAW,UAAU,KAAK,OAAO,EAAE;AAAA,MAC9C,WAAW,WAAW,OAAO,eAAe;AAAA,QAC1C,WAAW,WAAW,SAAS,IAAI,OAAO;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,YAAY;AAAA,MACV,QAAQ,qBAAqB,WAAW,MAAM;AAAA,MAC9C,cAAc,qBAAqB,WAAW,YAAY;AAAA,MAC1D,SAAS,qBAAqB,WAAW,OAAO;AAAA,IAClD;AAAA,EACF;AAAA;AAGK,SAAS,6BAA6B,CAC3C,OACA,WACA,UACS;AAAA,EACT,MAAM,iBAAiB,MAAM,WAAW;AAAA,EAExC,IAAI,eAAe,UAAU,WAAW,GAAG;AAAA,IACzC,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,SAAS,MAAM,CAAC,YAAY,eAAe,SAAS,IAAI,OAAO,CAAC;AAAA;AAGlE,SAAS,yBAAyB,CACvC,OACA,WACA,UACmB;AAAA,EACnB,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,OAAO,CAAC;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,MAAM,WAAW;AAAA,EACxC,OAAO,SAAS,OAAO,CAAC,YAAY,CAAC,eAAe,SAAS,IAAI,OAAO,CAAC;AAAA;AAG3E,SAAS,0BAA0B,GAGjC;AAAA,EACA,OAAO;AAAA,IACL,QAAQ,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IACrD,cAAc,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IAC3D,SAAS,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,EACxD;AAAA;AAGF,SAAS,oBAAoB,CAAC,OAGD;AAAA,EAC3B,OAAO;AAAA,IACL,WAAW,CAAC,GAAG,MAAM,SAAS;AAAA,IAC9B,UAAU,IAAI,IAAI,MAAM,QAAQ;AAAA,EAClC;AAAA;AAGK,SAAS,qBAAqB,CAAC,OAA8C;AAAA,EAClF,OAAO,sBAAsB,SAAS,KAA4B;AAAA;;;ACxEpE,IAAM,qBAAqB,OAAO,KAAK;AAAA,EACrC,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AAAA,EACP,KAAK;AAAA,EACL,SAAS;AAAA,EACT,QAAQ;AACV,CAAyC;AAGzC,SAAS,kBAAkB,CAAC,QAAmC;AAAA,EAC7D,MAAM,SAAS,OAAO,IAAI,CAAC,UAAU,IAAI,QAAQ;AAAA,EACjD,MAAM,OAAO,OAAO,GAAG,EAAE;AAAA,EACzB,OAAO,OAAO,SAAS,IAAK,QAAQ,KAAM,GAAG,OAAO,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,SAAS;AAAA;AAO9E,SAAS,QAAQ,CAAC,OAAkD;AAAA,EACzE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA;AAGrE,SAAS,oBAAoB,CAClC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC1D;AAAA,EACzB,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAAA,IAC1D,MAAM,YAAY,UAAU,0BAA0B;AAAA,EACxD;AAAA;AAGK,SAAS,oBAAoB,CAClC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC9C;AAAA,EACrC,IAAI,UAAU,WAAW;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,MAAM,YAAY,UAAU,yBAAyB;AAAA,EACvD;AAAA;AAGF,SAAS,iBAAiB,CACxB,OACA,OACA,aACoC;AAAA,EACpC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzB,MAAM,YAAY,UAAU,sCAAsC;AAAA,EACpE;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,qBAAqB,MAAM,GAAG,cAAc,WAAW;AAAA,EACzD;AAAA;AAGF,SAAS,8BAA8B,CACrC,OACA,OACA,aACoD;AAAA,EACpD,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzB,MAAM,YAAY,UAAU,kDAAkD;AAAA,EAChF;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,CAAC,sBAAsB,IAAI,GAAG;AAAA,MAChC,MAAM,YACJ,UAAU,+EACZ;AAAA,IACF;AAAA,EACF;AAAA;AAGF,SAAS,oBAAoB,CAAC,KAAwB,OAAqB;AAAA,EACzE,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,KAAK,IAAI,EAAE,GAAG;AAAA,MAChB,MAAM,IAAI,yBAAwB,UAAU,sCAAsC,MAAM;AAAA,IAC1F;AAAA,IACA,KAAK,IAAI,EAAE;AAAA,EACb;AAAA;AAGF,SAAS,2BAA2B,CAClC,YACA,OACM;AAAA,EACN,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,aAAa,YAAY;AAAA,IAClC,IAAI,KAAK,IAAI,SAAS,GAAG;AAAA,MACvB,MAAM,IAAI,yBACR,UAAU,uCAAuC,aACnD;AAAA,IACF;AAAA,IACA,KAAK,IAAI,SAAS;AAAA,EACpB;AAAA;AAGK,SAAS,uBAAuB,CACrC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC/C;AAAA,EACpC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,8CAA8C;AAAA,EAClE;AAAA,EAEA,IAAI,MAAM,SAAS,WAAW;AAAA,IAC5B,MAAM,YAAY,mDAAmD;AAAA,EACvE;AAAA,EAEA,qBAAqB,MAAM,IAAI,cAAc,WAAW;AAAA,EACxD,qBAAqB,MAAM,OAAO,YAAY,MAAM,aAAa,WAAW;AAAA,EAC5E,qBAAqB,MAAM,aAAa,YAAY,MAAM,mBAAmB,WAAW;AAAA;AAGnF,SAAS,mBAAmB,CAAC,OAA4C;AAAA,EAC9E,IAAI;AAAA,IACF,wBAAwB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC9D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,qBAAqB,CACnC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACjD;AAAA,EAClC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,4CAA4C;AAAA,EAChE;AAAA,EAEA,IAAI,MAAM,SAAS,SAAS;AAAA,IAC1B,MAAM,YAAY,+CAA+C;AAAA,EACnE;AAAA,EAEA,qBAAqB,MAAM,IAAI,YAAY,WAAW;AAAA,EACtD,qBAAqB,MAAM,OAAO,UAAU,MAAM,aAAa,WAAW;AAAA,EAC1E,qBAAqB,MAAM,aAAa,UAAU,MAAM,mBAAmB,WAAW;AAAA;AAGjF,SAAS,iBAAiB,CAAC,OAA0C;AAAA,EAC1E,IAAI;AAAA,IACF,sBAAsB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC5D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,gCAAgC,CAC9C,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACtC;AAAA,EAC7C,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,wDAAwD;AAAA,EAC5E;AAAA,EAEA,IAAI,MAAM,SAAS,oBAAoB;AAAA,IACrC,MAAM,YAAY,sEAAsE;AAAA,EAC1F;AAAA,EAEA,qBAAqB,MAAM,IAAI,wBAAwB,WAAW;AAAA,EAClE,kBACE,MAAM,mBACN,sBAAsB,MAAM,iBAC5B,WACF;AAAA,EACA,kBAAkB,MAAM,eAAe,sBAAsB,MAAM,aAAa,WAAW;AAAA,EAC3F,+BAA+B,MAAM,KAAK,sBAAsB,MAAM,WAAW,WAAW;AAAA;AAGvF,SAAS,4BAA4B,CAAC,OAAqD;AAAA,EAChG,IAAI;AAAA,IACF,iCAAiC,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IACvE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,qBAAqB,CACnC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACjD;AAAA,EAClC,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS;AAAA,IAC9C,MAAM,YAAY,UAAU,uDAAuD;AAAA,EACrF;AAAA,EAEA,IAAI,CAAC,mBAAmB,SAAS,MAAM,UAA6B,GAAG;AAAA,IACrE,MAAM,YACJ,UAAU,kCAAkC,mBAAmB,kBAAkB,IACnF;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,eAAe,YAAY,MAAM,WAAW,eAAe;AAAA,IACnE,MAAM,YAAY,UAAU,kDAAkD;AAAA,EAChF;AAAA,EAEA,IAAI,MAAM,eAAe,UAAU,MAAM,WAAW,YAAY,MAAM,WAAW,WAAW;AAAA,IAC1F,MAAM,YAAY,UAAU,wDAAwD;AAAA,EACtF;AAAA,EAEA,IACE,MAAM,eAAe,SACrB,MAAM,WAAW,cACjB,MAAM,WAAW,UACjB,MAAM,WAAW,cACjB,MAAM,WAAW,SACjB;AAAA,IACA,MAAM,YACJ,UAAU,4EACZ;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,eAAe,aAAa,MAAM,WAAW,UAAU,MAAM,WAAW,WAAW;AAAA,IAC3F,MAAM,YAAY,UAAU,yDAAyD;AAAA,EACvF;AAAA,EAEA,IAAI,MAAM,eAAe,YAAY,MAAM,WAAW,eAAe,MAAM,WAAW,WAAW;AAAA,IAC/F,MAAM,YAAY,UAAU,6DAA6D;AAAA,EAC3F;AAAA,EAEA,IAAI,MAAM,eAAe,SAAS,MAAM,WAAW,SAAS;AAAA,IAC1D,IAAI,MAAM,cAAc,WAAW;AAAA,MACjC,MAAM,YAAY,UAAU,qDAAqD;AAAA,IACnF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,gBAAgB,MAAM,WAAW,OAAO,WAAW;AAAA;AAGrD,SAAS,eAAe,CACtB,OACA,OACA,aAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,KAAK,KAAK,OAAO,MAAM,QAAQ,WAAW;AAAA,IACtD,MAAM,YAAY,UAAU,2DAA2D;AAAA,EACzF;AAAA,EAEA,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,MAAM;AAAA,EAC7C,IAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AAAA,IACvB,MAAM,YAAY,UAAU,sCAAsC;AAAA,EACpE;AAAA,EAEA,WAAW,MAAM,KAAK;AAAA,IACpB,qBAAqB,IAAI,GAAG,4BAA4B,WAAW;AAAA,EACrE;AAAA;AAGK,SAAS,oBAAoB,CAClC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAClD;AAAA,EACjC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,2CAA2C;AAAA,EAC/D;AAAA,EAEA,IAAI,MAAM,SAAS,QAAQ;AAAA,IACzB,MAAM,YAAY,6CAA6C;AAAA,EACjE;AAAA,EAEA,qBAAqB,MAAM,IAAI,WAAW,WAAW;AAAA,EACrD,qBAAqB,MAAM,OAAO,SAAS,MAAM,aAAa,WAAW;AAAA,EACzE,qBAAqB,MAAM,aAAa,SAAS,MAAM,mBAAmB,WAAW;AAAA,EACrF,kBAAkB,MAAM,mBAAmB,SAAS,MAAM,iBAAiB,WAAW;AAAA,EAEtF,IAAI,CAAC,MAAM,QAAQ,MAAM,MAAM,GAAG;AAAA,IAChC,MAAM,YAAY,gBAAgB,MAAM,8BAA8B;AAAA,EACxE;AAAA,EAEA,WAAW,SAAS,MAAM,QAAQ;AAAA,IAChC,sBAAsB,OAAO,SAAS,MAAM,cAAc,WAAW;AAAA,EACvE;AAAA,EAEA,IAAI,MAAM,eAAe,WAAW;AAAA,IAClC,kBAAkB,MAAM,YAAY,SAAS,MAAM,kBAAkB,WAAW;AAAA,EAClF;AAAA;AAGK,SAAS,gBAAgB,CAAC,OAAyC;AAAA,EACxE,IAAI;AAAA,IACF,qBAAqB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC3D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,oCAAoC,CAAC,OA6BnB;AAAA,EAChC,MAAM,eAAe,IAAI;AAAA,EACzB,MAAM,aAAa,IAAI;AAAA,EACvB,MAAM,YAAY,IAAI;AAAA,EACtB,MAAM,yBAAyB,IAAI;AAAA,EAEnC,WAAW,WAAW,MAAM,YAAY,CAAC,GAAG;AAAA,IAC1C,wBAAwB,OAAO;AAAA,IAE/B,IAAI,aAAa,IAAI,QAAQ,EAAE,GAAG;AAAA,MAChC,MAAM,IAAI,yBAAwB,gCAAgC,QAAQ,IAAI;AAAA,IAChF;AAAA,IAEA,aAAa,IAAI,QAAQ,IAAI,OAAO;AAAA,EACtC;AAAA,EAEA,WAAW,SAAS,MAAM,QAAQ;AAAA,IAChC,sBAAsB,KAAK;AAAA,IAE3B,IAAI,WAAW,IAAI,MAAM,EAAE,GAAG;AAAA,MAC5B,MAAM,IAAI,yBAAwB,8BAA8B,MAAM,IAAI;AAAA,IAC5E;AAAA,IAEA,WAAW,IAAI,MAAM,IAAI,KAAK;AAAA,EAChC;AAAA,EAEA,WAAW,QAAQ,MAAM,SAAS,CAAC,GAAG;AAAA,IACpC,qBAAqB,IAAI;AAAA,IAEzB,IAAI,UAAU,IAAI,KAAK,EAAE,GAAG;AAAA,MAC1B,MAAM,IAAI,yBAAwB,6BAA6B,KAAK,IAAI;AAAA,IAC1E;AAAA,IAEA,IAAI,KAAK,kBAAkB,WAAW,GAAG;AAAA,MACvC,MAAM,IAAI,yBACR,gBAAgB,KAAK,4CACvB;AAAA,IACF;AAAA,IAEA,MAAM,aAAa,KAAK,cAAc,CAAC;AAAA,IACvC,IAAI,KAAK,OAAO,WAAW,KAAK,WAAW,WAAW,GAAG;AAAA,MACvD,MAAM,IAAI,yBACR,gBAAgB,KAAK,mDACvB;AAAA,IACF;AAAA,IAEA,qBAAqB,KAAK,mBAAmB,SAAS,KAAK,eAAe;AAAA,IAC1E,qBAAqB,YAAY,SAAS,KAAK,gBAAgB;AAAA,IAE/D,WAAW,aAAa,YAAY;AAAA,MAClC,IAAI,CAAC,aAAa,IAAI,SAAS,GAAG;AAAA,QAChC,MAAM,IAAI,yBACR,gBAAgB,KAAK,6CAA6C,oFACpE;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,WAAW,KAAK,mBAAmB;AAAA,MAC5C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,gBAAgB,KAAK,2CAA2C,8EAClE;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,SAAS,KAAK,QAAQ;AAAA,MAC/B,sBAAsB,KAAK,IAAI,OAAO,KAAK;AAAA,IAC7C;AAAA,IAEA,UAAU,IAAI,KAAK,IAAI,IAAI;AAAA,EAC7B;AAAA,EAEA,WAAW,UAAU,MAAM,oBAAoB;AAAA,IAC7C,iCAAiC,MAAM;AAAA,IAEvC,IAAI,uBAAuB,IAAI,OAAO,EAAE,GAAG;AAAA,MACzC,MAAM,IAAI,yBAAwB,0CAA0C,OAAO,IAAI;AAAA,IACzF;AAAA,IAEA,IAAI,OAAO,kBAAkB,WAAW,GAAG;AAAA,MACzC,MAAM,IAAI,yBACR,6BAA6B,OAAO,4DACtC;AAAA,IACF;AAAA,IAEA,IAAI,OAAO,IAAI,WAAW,GAAG;AAAA,MAC3B,MAAM,IAAI,yBACR,6BAA6B,OAAO,0CACtC;AAAA,IACF;AAAA,IAEA,qBAAqB,OAAO,mBAAmB,sBAAsB,OAAO,eAAe;AAAA,IAC3F,qBAAqB,OAAO,eAAe,sBAAsB,OAAO,WAAW;AAAA,IACnF,4BAA4B,OAAO,KAAK,sBAAsB,OAAO,SAAS;AAAA,IAE9E,WAAW,WAAW,OAAO,mBAAmB;AAAA,MAC9C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,6BAA6B,OAAO,2CAA2C,8EACjF;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,WAAW,OAAO,eAAe;AAAA,MAC1C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,6BAA6B,OAAO,uCAAuC,8EAC7E;AAAA,MACF;AAAA,IACF;AAAA,IAEA,uBAAuB,IAAI,OAAO,IAAI,MAAM;AAAA,EAC9C;AAAA,EAEA,OAAO;AAAA,IACL,UAAU,CAAC,GAAG,aAAa,OAAO,CAAC;AAAA,IACnC;AAAA,IACA,QAAQ,CAAC,GAAG,WAAW,OAAO,CAAC;AAAA,IAC/B;AAAA,IACA,OAAO,CAAC,GAAG,UAAU,OAAO,CAAC;AAAA,IAC7B;AAAA,IACA,oBAAoB,CAAC,GAAG,uBAAuB,OAAO,CAAC;AAAA,IACvD;AAAA,EACF;AAAA;AAGF,SAAS,qBAAqB,CAC5B,QACA,OACA,YACM;AAAA,EACN,IAAI,MAAM,eAAe,SAAS,MAAM,WAAW,SAAS;AAAA,IAC1D,MAAM,OAAO,YAAY,YAAY,KAAK;AAAA,IAC1C,IAAI,CAAC,WAAW,gBAAgB;AAAA,MAC9B,MAAM,IAAI,yBACR,gBAAgB,kBAAkB,MAAM,2DAA2D,KAAK,KAC1G;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EACA,MAAM,OAAO,YAAY,YAAY,KAAK;AAAA,EAC1C,MAAM,WAAW,WAAW,KAAK;AAAA,EAEjC,IAAI,CAAC,UAAU;AAAA,IACb;AAAA,EACF;AAAA,EAKA,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM,UAAU,SAAS,MAAM,UAAU;AAAA,EAE3E,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,CAAC,SAAS,IAAI,EAAE,GAAG;AAAA,MACrB,MAAM,IAAI,yBACR,gBAAgB,kBAAkB,MAAM,yBAAyB,KAAK,YAAY,QAAQ,KAAK,KACjG;AAAA,IACF;AAAA,EACF;AAAA;;;AC3dF,IAAM,yBAAwB,IAAI,IAAyB,CAAC,UAAU,gBAAgB,SAAS,CAAC;AAEhG,SAAS,mBAAsB,CAAC,OAAqB,OAAqB;AAAA,EACxE,IAAI,MAAM,WAAW,GAAG;AAAA,IACtB,MAAM,IAAI,yBAAwB,UAAU,0BAA0B;AAAA,EACxE;AAAA;AAGF,SAAS,YAAY,CAAC,QAAoC,OAAkC;AAAA,EAC1F,OAAO,OAAO,IAAI,CAAC,UAAU;AAAA,IAC3B,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS;AAAA,MAC9C,MAAM,IAAI,yBAAwB,UAAU,4CAA4C;AAAA,IAC1F;AAAA,IAEA,qBAAqB,MAAM,IAAI,GAAG,gBAAgB;AAAA,IAClD,OAAO,MAAM;AAAA,GACd;AAAA;AAGH,SAAS,wBAAwB,CAC/B,YACA,OACgC;AAAA,EAChC,OAAO,WAAW,IAAI,CAAC,cAAc;AAAA,IACnC,IAAI,CAAC,uBAAsB,IAAI,SAAS,GAAG;AAAA,MACzC,MAAM,IAAI,yBACR,UAAU,+EACZ;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,GACR;AAAA;AAGI,SAAS,YAAqC,CACnD,IACA,UAA8B,CAAC,GACT;AAAA,EACtB,qBAAqB,IAAI,UAAU;AAAA,EACnC,qBAAqB,QAAQ,OAAO,UAAU,WAAW;AAAA,EACzD,qBAAqB,QAAQ,aAAa,UAAU,iBAAiB;AAAA,EAErE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EAClF;AAAA;AAIK,SAAS,cAAc,CAC5B,UACA,OACmB;AAAA,EACnB,OAAO,SAAS,IAAI,CAAC,YAAY;AAAA,IAC/B,IAAI,CAAC,SAAS,OAAO,KAAK,QAAQ,SAAS,WAAW;AAAA,MACpD,MAAM,IAAI,yBAAwB,UAAU,8CAA8C;AAAA,IAC5F;AAAA,IAEA,qBAAqB,QAAQ,IAAI,GAAG,kBAAkB;AAAA,IACtD,OAAO,QAAQ;AAAA,GAChB;AAAA;AAGI,SAAS,cAAuC,CACrD,IACA,UAAgC,CAAC,GACT;AAAA,EACxB,qBAAqB,IAAI,YAAY;AAAA,EACrC,qBAAqB,QAAQ,OAAO,YAAY,WAAW;AAAA,EAC3D,qBAAqB,QAAQ,aAAa,YAAY,iBAAiB;AAAA,EAEvE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EAClF;AAAA;AAGK,SAAS,WAAoC,CAClD,IACA,SACqB;AAAA,EACrB,qBAAqB,IAAI,SAAS;AAAA,EAClC,qBAAqB,QAAQ,OAAO,SAAS,WAAW;AAAA,EACxD,qBAAqB,QAAQ,aAAa,SAAS,iBAAiB;AAAA,EACpE,oBAAoB,QAAQ,WAAW,SAAS,eAAe;AAAA,EAE/D,MAAM,oBAAoB,aAAa,QAAQ,WAAW,SAAS,eAAe;AAAA,EAClF,MAAM,SAAS,QAAQ,UAAU,CAAC;AAAA,EAClC,MAAM,aAAa,eAAe,QAAQ,cAAc,CAAC,GAAG,SAAS,gBAAgB;AAAA,EAErF,WAAW,SAAS,QAAQ;AAAA,IAC1B,sBAAsB,OAAO,SAAS,YAAY;AAAA,EACpD;AAAA,EAEA,IAAI,OAAO,WAAW,KAAK,WAAW,WAAW,GAAG;AAAA,IAClD,MAAM,IAAI,yBACR,gBAAgB,mDAClB;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,IAChF;AAAA,IACA;AAAA,OACI,WAAW,SAAS,IAAI,EAAE,WAAW,IAAI,CAAC;AAAA,EAChD;AAAA;AAGK,SAAS,uBAAgD,CAC9D,IACA,SACiC;AAAA,EACjC,qBAAqB,IAAI,sBAAsB;AAAA,EAC/C,oBAAoB,QAAQ,WAAW,sBAAsB,eAAe;AAAA,EAC5E,oBAAoB,QAAQ,KAAK,sBAAsB,SAAS;AAAA,EAEhE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,mBAAmB,aAAa,QAAQ,WAAW,sBAAsB,eAAe;AAAA,IACxF,eAAe,aAAa,QAAQ,OAAO,sBAAsB,WAAW;AAAA,IAC5E,KAAK,yBAAyB,QAAQ,KAAK,sBAAsB,SAAS;AAAA,EAC5E;AAAA;",
-  "debugId": "5DED6666AEF6ACF164756E2164756E21",
-  "names": []
-}