@sixb/core 0.1.19 → 0.1.21

package/dist/{chunk-tw03bsmb.js → chunk-eptrvnby.js}

@@ -4,7 +4,8 @@ import {
   normalizeRequesterGroupIds
 } from "./chunk-9tc8dxmn.js";
 import {
-  kernelOperationId
+  kernelOperationId,
+  kernelOperationFromId
 } from "./chunk-58geavnf.js";
 
 // src/storage/executions/errors.ts
@@ -341,6 +342,226 @@ var TRUSTED_PRIMITIVE_KINDS = new Set([
   "workflow"
 ]);
 
-export { ExecutionStorageError2, prepareExecutionRecord2, normalizeExecutionRecord2, validateExecutionRecordReferences2, cloneExecutionRecord };
+// src/storage/executions/provider.ts
+function compareExecutionCreation2(left, right) {
+  const byTime = left.createdAt.getTime() - right.createdAt.getTime();
+  if (byTime !== 0) {
+    return byTime;
+  }
+  return left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+}
+function executionRecordToStorageRow2(record) {
+  const executor = flattenExecutor(record);
+  const source = flattenSource(record);
+  const authority = flattenAuthority(record);
+  return {
+    projectId: record.projectId,
+    id: record.id,
+    requesterGroupIds: [...record.requesterGroupIds],
+    ...executor,
+    ...source,
+    requestedByUserId: record.requestedBy?.type === "user" ? record.requestedBy.id : null,
+    requestedByServiceAccountId: record.requestedBy?.type === "serviceAccount" ? record.requestedBy.id : null,
+    correlationId: record.correlationId,
+    parentExecutionId: record.source.type === "execution" ? record.source.executionId : null,
+    ...authority,
+    createdAt: new Date(record.createdAt)
+  };
+}
+function executionRecordFromStorageRow2(row) {
+  const executor = inflateExecutor(row);
+  const source = inflateSource(row);
+  assertStoredParent(row, source);
+  const authorizationRef = inflateAuthority(row);
+  const requestedBy = row.requestedByUserId ? { type: "user", id: row.requestedByUserId } : row.requestedByServiceAccountId ? { type: "serviceAccount", id: row.requestedByServiceAccountId } : undefined;
+  return normalizeExecutionRecord2({
+    id: row.id,
+    projectId: row.projectId,
+    requesterGroupIds: row.requesterGroupIds,
+    ...requestedBy === undefined ? {} : { requestedBy },
+    executor,
+    source,
+    correlationId: row.correlationId,
+    authorizationRef
+  }, row.createdAt);
+}
+function assertStoredParent(row, source) {
+  const expected = source.type === "execution" ? source.executionId : null;
+  if (row.parentExecutionId !== expected) {
+    throw new ExecutionStorageError2("invalid_parent_execution", `[Sixb] Stored execution '${row.id}' has inconsistent parent execution provenance.`);
+  }
+}
+function flattenExecutor(record) {
+  switch (record.executor.type) {
+    case "request":
+      return { executorKind: "request", executorId: record.executor.requestId };
+    case "primitive":
+      return { executorKind: record.executor.kind, executorId: record.executor.runId };
+    case "agent":
+      return { executorKind: "agent", executorId: record.executor.runId };
+    case "kernel":
+      return { executorKind: "kernel", executorId: kernelOperationId(record.executor.operation) };
+  }
+}
+function flattenSource(record) {
+  switch (record.source.type) {
+    case "ontologyCommit":
+      return { sourceKind: "ontologyCommit", sourceId: record.source.commitId };
+    case "http":
+      return { sourceKind: "http", sourceId: record.source.requestId };
+    case "webhook":
+      return { sourceKind: "webhook", sourceId: record.source.deliveryId };
+    case "schedule":
+    case "event":
+      return { sourceKind: record.source.type, sourceId: record.source.eventId };
+    case "datasetVersion":
+      return {
+        sourceKind: "datasetVersion",
+        sourceId: JSON.stringify([record.source.datasetId, record.source.versionId])
+      };
+    case "execution":
+      return { sourceKind: "execution", sourceId: record.source.executionId };
+  }
+}
+function flattenAuthority(record) {
+  const empty = {
+    authorityUserId: null,
+    authorityServiceAccountId: null,
+    authoritySessionId: null,
+    authorityAccessTokenId: null,
+    authorityPrimitiveKind: null,
+    authorityPrimitiveId: null,
+    authorityKernelOperation: null,
+    authorityDelegationKind: null,
+    authorityDelegationId: null,
+    authorityDelegationSessionId: null
+  };
+  switch (record.authorizationRef.type) {
+    case "principal":
+      return {
+        ...empty,
+        authorityKind: "principal",
+        authorityUserId: record.authorizationRef.principal.type === "user" ? record.authorizationRef.principal.id : null,
+        authorityServiceAccountId: record.authorizationRef.principal.type === "serviceAccount" ? record.authorizationRef.principal.id : null,
+        authoritySessionId: record.authorizationRef.credential?.type === "session" ? record.authorizationRef.credential.id : null,
+        authorityAccessTokenId: record.authorizationRef.credential?.type === "accessToken" ? record.authorizationRef.credential.id : null
+      };
+    case "trustedPrimitive":
+      return {
+        ...empty,
+        authorityKind: "trustedPrimitive",
+        authorityPrimitiveKind: record.authorizationRef.primitive.kind,
+        authorityPrimitiveId: record.authorizationRef.primitive.id
+      };
+    case "delegated":
+      return {
+        ...empty,
+        authorityKind: "delegated",
+        authorityDelegationKind: record.authorizationRef.delegation.kind,
+        authorityDelegationId: record.authorizationRef.delegation.grantId,
+        authorityDelegationSessionId: record.authorizationRef.delegation.sessionId
+      };
+    case "kernel":
+      return {
+        ...empty,
+        authorityKind: "kernel",
+        authorityKernelOperation: record.authorizationRef.operation.type
+      };
+    case "disabled":
+      return { ...empty, authorityKind: "disabled" };
+  }
+}
+function inflateExecutor(row) {
+  switch (row.executorKind) {
+    case "request":
+      return { type: "request", requestId: row.executorId };
+    case "agent":
+      return { type: "agent", runId: row.executorId };
+    case "kernel":
+      return {
+        type: "kernel",
+        operation: kernelOperationFromId(requireValue(row.authorityKernelOperation, "authority kernel operation"), row.executorId)
+      };
+    default:
+      return { type: "primitive", kind: row.executorKind, runId: row.executorId };
+  }
+}
+function inflateSource(row) {
+  switch (row.sourceKind) {
+    case "ontologyCommit":
+      return { type: "ontologyCommit", commitId: row.sourceId };
+    case "http":
+      return { type: "http", requestId: row.sourceId };
+    case "webhook":
+      return { type: "webhook", deliveryId: row.sourceId };
+    case "schedule":
+    case "event":
+      return { type: row.sourceKind, eventId: row.sourceId };
+    case "datasetVersion": {
+      const [datasetId, versionId] = parseDatasetVersionSourceId(row.sourceId);
+      return { type: "datasetVersion", datasetId, versionId };
+    }
+    case "execution":
+      return { type: "execution", executionId: row.sourceId };
+  }
+}
+function parseDatasetVersionSourceId(sourceId) {
+  try {
+    const parsed = JSON.parse(sourceId);
+    if (Array.isArray(parsed) && parsed.length === 2 && parsed.every((value) => typeof value === "string" && value.trim().length > 0)) {
+      return parsed;
+    }
+  } catch {}
+  throw new Error("[Sixb] Stored dataset-version execution source is malformed.");
+}
+function inflateAuthority(row) {
+  switch (row.authorityKind) {
+    case "principal": {
+      const principal = row.authorityUserId ? { type: "user", id: row.authorityUserId } : {
+        type: "serviceAccount",
+        id: requireValue(row.authorityServiceAccountId, "authority service account id")
+      };
+      const credential = row.authoritySessionId ? { type: "session", id: row.authoritySessionId } : row.authorityAccessTokenId ? { type: "accessToken", id: row.authorityAccessTokenId } : undefined;
+      return {
+        type: "principal",
+        principal,
+        ...credential === undefined ? {} : { credential }
+      };
+    }
+    case "trustedPrimitive":
+      return {
+        type: "trustedPrimitive",
+        primitive: {
+          kind: requireValue(row.authorityPrimitiveKind, "authority primitive kind"),
+          id: requireValue(row.authorityPrimitiveId, "authority primitive id"),
+          runId: row.executorId
+        }
+      };
+    case "delegated":
+      return {
+        type: "delegated",
+        delegation: {
+          kind: requireValue(row.authorityDelegationKind, "authority delegation kind"),
+          grantId: requireValue(row.authorityDelegationId, "authority delegation id"),
+          sessionId: requireValue(row.authorityDelegationSessionId, "authority delegation session id")
+        }
+      };
+    case "kernel":
+      return {
+        type: "kernel",
+        operation: kernelOperationFromId(requireValue(row.authorityKernelOperation, "authority kernel operation"), row.executorId)
+      };
+    case "disabled":
+      return { type: "disabled" };
+  }
+}
+function requireValue(value, label) {
+  if (value === null) {
+    throw new Error(`[Sixb] Stored execution is missing ${label}.`);
+  }
+  return value;
+}
+
+export { ExecutionStorageError2, prepareExecutionRecord2, normalizeExecutionRecord2, validateExecutionRecordReferences2, cloneExecutionRecord, compareExecutionCreation2, executionRecordToStorageRow2, executionRecordFromStorageRow2 };
 
-//# debugId=12B08F503967185464756E2164756E21
+//# debugId=63EAD204251D4A3764756E2164756E21

package/dist/chunk-eptrvnby.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/storage/executions/errors.ts", "../src/storage/executions/validation.ts", "../src/storage/executions/provider.ts"],
+  "sourcesContent": [
+    "export type ExecutionStorageErrorCode =\n  | \"duplicate_execution\"\n  | \"invalid_credential\"\n  | \"invalid_input\"\n  | \"invalid_parent_execution\"\n  | \"missing_credential\"\n  | \"missing_parent_execution\"\n  | \"missing_principal\"\n\n/** Stable error raised when an execution record would violate ledger invariants. */\nexport class ExecutionStorageError extends Error {\n  readonly name = \"ExecutionStorageError\"\n\n  constructor(\n    readonly code: ExecutionStorageErrorCode,\n    message: string,\n    options: ErrorOptions = {}\n  ) {\n    super(message, options)\n  }\n}\n",
+    "import { isDeepStrictEqual } from \"node:util\"\nimport { normalizeRequesterGroupIds, snapshotRequesterGroupIds } from \"../../auth/attribution\"\nimport { kernelOperationId } from \"../../execution/kernel-operation\"\nimport type {\n  AuthorizablePrincipal,\n  AuthorizationRef,\n  KernelOperation,\n} from \"../../execution/types\"\nimport type { AuthStorage } from \"../auth\"\nimport { ExecutionStorageError } from \"./errors\"\nimport type {\n  CreateExecutionInput,\n  DurableExecutionExecutor,\n  DurableExecutionSource,\n  ExecutionRecord,\n} from \"./types\"\n\nexport interface ExecutionValidationLookup {\n  readonly auth: AuthStorage\n  getExecution(params: {\n    readonly projectId: string\n    readonly id: string\n  }): Promise<ExecutionRecord | null>\n  getShareSession(params: {\n    readonly projectId: string\n    readonly id: string\n  }): Promise<{ readonly grantId: string } | null>\n}\n\n/** Capture accounting attribution at the same storage boundary that admits the execution. */\nexport async function prepareExecutionRecord(\n  input: CreateExecutionInput,\n  lookup: ExecutionValidationLookup\n): Promise<ExecutionRecord> {\n  let groups = input.requesterGroupIds\n  if (groups === undefined && input.source.type === \"execution\") {\n    const parent = await lookup.getExecution({\n      projectId: input.projectId,\n      id: input.source.executionId,\n    })\n    groups = parent?.requesterGroupIds\n  } else if (groups === undefined && input.requestedBy) {\n    groups = await snapshotRequesterGroupIds({\n      auth: lookup.auth,\n      projectId: input.projectId,\n      principal: input.requestedBy,\n    })\n  }\n  const record = normalizeExecutionRecord({ ...input, requesterGroupIds: groups ?? [] })\n  await validateExecutionRecordReferences(record, lookup)\n  return record\n}\n\nexport function normalizeExecutionRecord(\n  input: CreateExecutionInput,\n  createdAt: Date = new Date()\n): ExecutionRecord {\n  const record: ExecutionRecord = {\n    id: input.id,\n    projectId: input.projectId,\n    requesterGroupIds: normalizeRequesterGroupIds(input.requesterGroupIds ?? []),\n    ...(input.requestedBy === undefined ? {} : { requestedBy: structuredClone(input.requestedBy) }),\n    executor: structuredClone(input.executor),\n    source: structuredClone(input.source),\n    correlationId: input.correlationId,\n    authorizationRef: structuredClone(input.authorizationRef),\n    createdAt: new Date(createdAt),\n  }\n\n  assertRecordShape(record)\n  assertExecutorAuthority(record)\n  return record\n}\n\nexport async function validateExecutionRecordReferences(\n  record: ExecutionRecord,\n  lookup: ExecutionValidationLookup\n): Promise<void> {\n  await validatePrincipal(record.requestedBy, record.projectId, \"Requested-by principal\", lookup)\n\n  if (record.authorizationRef.type === \"principal\") {\n    await validatePrincipal(\n      record.authorizationRef.principal,\n      record.projectId,\n      \"Authority principal\",\n      lookup\n    )\n    await validateCredential(record, lookup)\n  }\n  if (record.authorizationRef.type === \"delegated\") {\n    await validateDelegation(record, lookup)\n  }\n\n  await validateParent(record, lookup)\n}\n\nexport function cloneExecutionRecord(record: ExecutionRecord): ExecutionRecord {\n  return structuredClone(record)\n}\n\nfunction assertRecordShape(record: ExecutionRecord): void {\n  assertNonBlank(record.id, \"Execution id\")\n  assertNonBlank(record.projectId, \"Execution project id\")\n  assertNonBlank(record.correlationId, \"Execution correlation id\")\n  assertValidDate(record.createdAt, \"Execution createdAt\")\n\n  if (record.requestedBy) {\n    assertPrincipal(record.requestedBy, \"Requested-by principal\")\n  }\n\n  assertExecutor(record.executor)\n  assertSource(record.source)\n  assertAuthorizationRef(record.authorizationRef)\n}\n\nfunction assertExecutor(executor: DurableExecutionExecutor): void {\n  switch (executor.type) {\n    case \"request\":\n      assertNonBlank(executor.requestId, \"Executor request id\")\n      return\n    case \"primitive\":\n      assertTrustedPrimitiveKind(executor.kind, \"Executor primitive kind\")\n      assertNonBlank(executor.runId, \"Executor primitive run id\")\n      return\n    case \"agent\":\n      assertNonBlank(executor.runId, \"Executor agent run id\")\n      return\n    case \"kernel\":\n      assertKernelOperation(executor.operation, \"Executor kernel operation\")\n      return\n    default:\n      invalid(`Unknown execution executor type '${String((executor as { type?: unknown }).type)}'.`)\n  }\n}\n\nfunction assertSource(source: DurableExecutionSource): void {\n  switch (source.type) {\n    case \"ontologyCommit\":\n      assertNonBlank(source.commitId, \"Execution source commit id\")\n      return\n    case \"http\":\n      assertNonBlank(source.requestId, \"Execution source request id\")\n      return\n    case \"webhook\":\n      assertNonBlank(source.deliveryId, \"Execution source delivery id\")\n      return\n    case \"schedule\":\n    case \"event\":\n      assertNonBlank(source.eventId, \"Execution source event id\")\n      return\n    case \"datasetVersion\":\n      assertNonBlank(source.datasetId, \"Execution source dataset id\")\n      assertNonBlank(source.versionId, \"Execution source dataset version id\")\n      return\n    case \"execution\":\n      assertNonBlank(source.executionId, \"Execution source execution id\")\n      return\n    default:\n      invalid(\n        `Execution source type '${String((source as { type?: unknown }).type)}' is not durable.`\n      )\n  }\n}\n\nfunction assertAuthorizationRef(ref: AuthorizationRef): void {\n  switch (ref.type) {\n    case \"principal\":\n      assertPrincipal(ref.principal, \"Authority principal\")\n      if (ref.credential) {\n        if (ref.credential.type !== \"session\" && ref.credential.type !== \"accessToken\") {\n          invalid(\n            `Unknown authority credential type '${String(\n              (ref.credential as { type?: unknown }).type\n            )}'.`\n          )\n        }\n        assertNonBlank(ref.credential.id, \"Authority credential id\")\n      }\n      return\n    case \"trustedPrimitive\":\n      assertTrustedPrimitiveKind(ref.primitive.kind, \"Authority primitive kind\")\n      assertNonBlank(ref.primitive.id, \"Authority primitive id\")\n      assertNonBlank(ref.primitive.runId, \"Authority primitive run id\")\n      return\n    case \"delegated\":\n      if (ref.delegation.kind !== \"share\") {\n        invalid(\n          `Unknown authority delegation kind '${String(\n            (ref.delegation as { kind?: unknown }).kind\n          )}'.`\n        )\n      }\n      assertNonBlank(ref.delegation.grantId, \"Authority delegation grant id\")\n      assertNonBlank(ref.delegation.sessionId, \"Authority delegation session id\")\n      return\n    case \"kernel\":\n      assertKernelOperation(ref.operation, \"Authority kernel operation\")\n      return\n    case \"disabled\":\n      return\n    default:\n      invalid(`Unknown authorization reference type '${String((ref as { type?: unknown }).type)}'.`)\n  }\n}\n\nfunction assertExecutorAuthority(record: ExecutionRecord): void {\n  const { executor, authorizationRef, requestedBy, source } = record\n\n  switch (executor.type) {\n    case \"request\": {\n      if (source.type !== \"http\" || source.requestId !== executor.requestId) {\n        invalid(\"Request executions require a matching HTTP source request id.\")\n      }\n      if (authorizationRef.type === \"principal\") {\n        if (!principalsEqual(requestedBy, authorizationRef.principal)) {\n          invalid(\"Request authority must match its requested-by principal.\")\n        }\n        return\n      }\n      if (authorizationRef.type === \"disabled\") {\n        if (requestedBy !== undefined) {\n          invalid(\"Auth-disabled request executions cannot have a requested-by principal.\")\n        }\n        return\n      }\n      if (authorizationRef.type === \"delegated\") {\n        if (requestedBy !== undefined) {\n          invalid(\"Delegated request executions cannot have a requested-by principal.\")\n        }\n        return\n      }\n      invalid(\"Request executions require principal, delegated, or explicitly disabled authority.\")\n      break\n    }\n    case \"primitive\": {\n      if (authorizationRef.type !== \"trustedPrimitive\") {\n        invalid(\"Primitive executions require trusted primitive authority.\")\n      }\n      if (\n        authorizationRef.primitive.kind !== executor.kind ||\n        authorizationRef.primitive.runId !== executor.runId\n      ) {\n        invalid(\"Trusted primitive authority must match the executor kind and run id.\")\n      }\n      return\n    }\n    case \"agent\": {\n      if (source.type !== \"execution\") {\n        invalid(\"Agent executions require a parent execution source.\")\n      }\n      if (\n        authorizationRef.type === \"principal\" &&\n        authorizationRef.principal.type === \"serviceAccount\" &&\n        authorizationRef.credential === undefined\n      ) {\n        return\n      }\n      if (\n        authorizationRef.type === \"principal\" &&\n        authorizationRef.principal.type === \"user\" &&\n        authorizationRef.credential !== undefined\n      ) {\n        return\n      }\n      if (authorizationRef.type === \"disabled\") return\n      invalid(\n        \"Agent executions require managed service-account, credentialed user, or explicitly disabled authority.\"\n      )\n      break\n    }\n    case \"kernel\": {\n      if (\n        authorizationRef.type !== \"kernel\" ||\n        !kernelOperationsEqual(authorizationRef.operation, executor.operation)\n      ) {\n        invalid(\"Kernel authority must match the executor operation.\")\n      }\n      if (requestedBy !== undefined) {\n        invalid(\"Kernel executions cannot have a requested-by principal.\")\n      }\n      return\n    }\n  }\n}\n\nasync function validatePrincipal(\n  principal: AuthorizablePrincipal | undefined,\n  projectId: string,\n  label: string,\n  lookup: ExecutionValidationLookup\n): Promise<void> {\n  if (!principal) return\n\n  const record =\n    principal.type === \"user\"\n      ? await lookup.auth.users.getById({ projectId, id: principal.id })\n      : await lookup.auth.serviceAccounts.getById({ projectId, id: principal.id })\n  if (!record) {\n    throw new ExecutionStorageError(\n      \"missing_principal\",\n      `[Sixb] ${label} '${principal.id}' does not exist in project '${projectId}'.`\n    )\n  }\n}\n\nasync function validateCredential(\n  record: ExecutionRecord,\n  lookup: ExecutionValidationLookup\n): Promise<void> {\n  if (record.authorizationRef.type !== \"principal\" || !record.authorizationRef.credential) return\n\n  const { principal, credential } = record.authorizationRef\n  if (credential.type === \"session\") {\n    const session = await lookup.auth.sessions.getById({\n      projectId: record.projectId,\n      id: credential.id,\n    })\n    if (!session) {\n      throw new ExecutionStorageError(\n        \"missing_credential\",\n        `[Sixb] Authority session '${credential.id}' does not exist in project '${record.projectId}'.`\n      )\n    }\n    if (principal.type !== \"user\" || session.userId !== principal.id) {\n      throw new ExecutionStorageError(\n        \"invalid_credential\",\n        `[Sixb] Authority session '${credential.id}' does not belong to principal '${principal.id}'.`\n      )\n    }\n    return\n  }\n\n  const token = await lookup.auth.accessTokens.getById({\n    projectId: record.projectId,\n    id: credential.id,\n  })\n  if (!token) {\n    throw new ExecutionStorageError(\n      \"missing_credential\",\n      `[Sixb] Authority access token '${credential.id}' does not exist in project '${record.projectId}'.`\n    )\n  }\n  if (!principalsEqual(token.subject, principal)) {\n    throw new ExecutionStorageError(\n      \"invalid_credential\",\n      `[Sixb] Authority access token '${credential.id}' does not belong to principal '${principal.id}'.`\n    )\n  }\n}\n\nasync function validateDelegation(\n  record: ExecutionRecord,\n  lookup: ExecutionValidationLookup\n): Promise<void> {\n  if (record.authorizationRef.type !== \"delegated\") return\n  const { grantId, sessionId } = record.authorizationRef.delegation\n  const session = await lookup.getShareSession({ projectId: record.projectId, id: sessionId })\n  if (!session) {\n    throw new ExecutionStorageError(\n      \"missing_credential\",\n      `[Sixb] Authority shared session '${sessionId}' does not exist in project '${record.projectId}'.`\n    )\n  }\n  if (session.grantId !== grantId) {\n    throw new ExecutionStorageError(\n      \"invalid_credential\",\n      `[Sixb] Authority shared session '${sessionId}' does not belong to grant '${grantId}'.`\n    )\n  }\n}\n\nasync function validateParent(\n  record: ExecutionRecord,\n  lookup: ExecutionValidationLookup\n): Promise<void> {\n  if (record.source.type !== \"execution\") return\n  const parentExecutionId = record.source.executionId\n\n  const parent = await lookup.getExecution({\n    projectId: record.projectId,\n    id: parentExecutionId,\n  })\n  if (!parent) {\n    throw new ExecutionStorageError(\n      \"missing_parent_execution\",\n      `[Sixb] Parent execution '${parentExecutionId}' does not exist in project '${record.projectId}'.`\n    )\n  }\n  if (parent.correlationId !== record.correlationId) {\n    throw new ExecutionStorageError(\n      \"invalid_parent_execution\",\n      `[Sixb] Child execution '${record.id}' must preserve its parent correlation id.`\n    )\n  }\n  if (!principalsEqual(parent.requestedBy, record.requestedBy)) {\n    throw new ExecutionStorageError(\n      \"invalid_parent_execution\",\n      `[Sixb] Child execution '${record.id}' must preserve its parent requested-by principal.`\n    )\n  }\n  if (!isDeepStrictEqual(parent.requesterGroupIds, record.requesterGroupIds)) {\n    throw new ExecutionStorageError(\n      \"invalid_parent_execution\",\n      `[Sixb] Child execution '${record.id}' must preserve its parent requester-group snapshot.`\n    )\n  }\n  if (\n    record.executor.type === \"agent\" &&\n    isInheritedAgentAuthority(record.authorizationRef) &&\n    !isDeepStrictEqual(parent.authorizationRef, record.authorizationRef)\n  ) {\n    throw new ExecutionStorageError(\n      \"invalid_parent_execution\",\n      `[Sixb] Child Agent execution '${record.id}' must inherit its parent's authorization reference.`\n    )\n  }\n}\n\nfunction isInheritedAgentAuthority(ref: AuthorizationRef): boolean {\n  return (\n    ref.type === \"disabled\" ||\n    (ref.type === \"principal\" && ref.principal.type === \"user\" && ref.credential !== undefined)\n  )\n}\n\nfunction assertPrincipal(principal: AuthorizablePrincipal, label: string): void {\n  if (principal.type !== \"user\" && principal.type !== \"serviceAccount\") {\n    invalid(`${label} has unsupported type '${String((principal as { type?: unknown }).type)}'.`)\n  }\n  assertNonBlank(principal.id, `${label} id`)\n}\n\nfunction assertKernelOperation(operation: KernelOperation, label: string): void {\n  if (operation.type !== \"ontology.recover\" && operation.type !== \"ontology.indexVectors\") {\n    invalid(`${label} has unsupported type '${String((operation as { type?: unknown }).type)}'.`)\n  }\n  assertNonBlank(kernelOperationId(operation), `${label} operation id`)\n}\n\nfunction assertTrustedPrimitiveKind(value: string, label: string): void {\n  if (!TRUSTED_PRIMITIVE_KINDS.has(value)) {\n    invalid(`${label} '${value}' is not supported.`)\n  }\n}\n\nfunction assertNonBlank(value: string, label: string): void {\n  if (typeof value !== \"string\" || !value.trim()) {\n    invalid(`${label} must be a non-empty string.`)\n  }\n}\n\nfunction assertValidDate(value: Date, label: string): void {\n  if (!(value instanceof Date) || !Number.isFinite(value.getTime())) {\n    invalid(`${label} must be a valid date.`)\n  }\n}\n\nfunction principalsEqual(\n  left: AuthorizablePrincipal | undefined,\n  right: AuthorizablePrincipal | undefined\n): boolean {\n  return left?.type === right?.type && left?.id === right?.id\n}\n\nfunction kernelOperationsEqual(left: KernelOperation, right: KernelOperation): boolean {\n  return left.type === right.type && kernelOperationId(left) === kernelOperationId(right)\n}\n\nfunction invalid(message: string): never {\n  throw new ExecutionStorageError(\"invalid_input\", `[Sixb] ${message}`)\n}\n\nconst TRUSTED_PRIMITIVE_KINDS = new Set([\n  \"action\",\n  \"pipeline\",\n  \"projection\",\n  \"rule\",\n  \"sync\",\n  \"webhook\",\n  \"workflow\",\n])\n",
+    "import { kernelOperationFromId, kernelOperationId } from \"../../execution/kernel-operation\"\nimport type { KernelOperation, TrustedPrimitiveKind } from \"../../execution/types\"\nimport { ExecutionStorageError } from \"./errors\"\nimport type { CreateExecutionInput, ExecutionRecord } from \"./types\"\nimport { normalizeExecutionRecord } from \"./validation\"\n\nexport {\n  type ExecutionValidationLookup,\n  normalizeExecutionRecord,\n  prepareExecutionRecord,\n  validateExecutionRecordReferences,\n} from \"./validation\"\n\n/** Oldest first, then by id compared byte by byte: the order `listBySession` returns. */\nexport function compareExecutionCreation(\n  left: Pick<ExecutionRecord, \"createdAt\" | \"id\">,\n  right: Pick<ExecutionRecord, \"createdAt\" | \"id\">\n): number {\n  const byTime = left.createdAt.getTime() - right.createdAt.getTime()\n  if (byTime !== 0) {\n    return byTime\n  }\n  return left.id < right.id ? -1 : left.id > right.id ? 1 : 0\n}\n\n/** Provider-neutral flattened representation used by the SQL adapters. */\nexport interface ExecutionStorageRow {\n  readonly projectId: string\n  readonly id: string\n  readonly executorKind: \"agent\" | \"kernel\" | \"request\" | TrustedPrimitiveKind\n  readonly executorId: string\n  readonly sourceKind:\n    | \"ontologyCommit\"\n    | \"datasetVersion\"\n    | \"event\"\n    | \"execution\"\n    | \"http\"\n    | \"schedule\"\n    | \"webhook\"\n  readonly sourceId: string\n  readonly requestedByUserId: string | null\n  readonly requestedByServiceAccountId: string | null\n  readonly requesterGroupIds: readonly string[]\n  readonly correlationId: string\n  /** SQL-only projection of an execution source, used to enforce the parent foreign key. */\n  readonly parentExecutionId: string | null\n  readonly authorityKind: \"delegated\" | \"disabled\" | \"kernel\" | \"principal\" | \"trustedPrimitive\"\n  readonly authorityUserId: string | null\n  readonly authorityServiceAccountId: string | null\n  readonly authoritySessionId: string | null\n  readonly authorityAccessTokenId: string | null\n  readonly authorityPrimitiveKind: TrustedPrimitiveKind | null\n  readonly authorityPrimitiveId: string | null\n  readonly authorityKernelOperation: KernelOperation[\"type\"] | null\n  readonly authorityDelegationKind: \"share\" | null\n  readonly authorityDelegationId: string | null\n  readonly authorityDelegationSessionId: string | null\n  readonly createdAt: Date\n}\n\nexport function executionRecordToStorageRow(record: ExecutionRecord): ExecutionStorageRow {\n  const executor = flattenExecutor(record)\n  const source = flattenSource(record)\n  const authority = flattenAuthority(record)\n  return {\n    projectId: record.projectId,\n    id: record.id,\n    requesterGroupIds: [...record.requesterGroupIds],\n    ...executor,\n    ...source,\n    requestedByUserId: record.requestedBy?.type === \"user\" ? record.requestedBy.id : null,\n    requestedByServiceAccountId:\n      record.requestedBy?.type === \"serviceAccount\" ? record.requestedBy.id : null,\n    correlationId: record.correlationId,\n    parentExecutionId: record.source.type === \"execution\" ? record.source.executionId : null,\n    ...authority,\n    createdAt: new Date(record.createdAt),\n  }\n}\n\nexport function executionRecordFromStorageRow(row: ExecutionStorageRow): ExecutionRecord {\n  const executor = inflateExecutor(row)\n  const source = inflateSource(row)\n  assertStoredParent(row, source)\n  const authorizationRef = inflateAuthority(row)\n  const requestedBy = row.requestedByUserId\n    ? ({ type: \"user\", id: row.requestedByUserId } as const)\n    : row.requestedByServiceAccountId\n      ? ({ type: \"serviceAccount\", id: row.requestedByServiceAccountId } as const)\n      : undefined\n\n  return normalizeExecutionRecord(\n    {\n      id: row.id,\n      projectId: row.projectId,\n      requesterGroupIds: row.requesterGroupIds,\n      ...(requestedBy === undefined ? {} : { requestedBy }),\n      executor,\n      source,\n      correlationId: row.correlationId,\n      authorizationRef,\n    },\n    row.createdAt\n  )\n}\n\nfunction assertStoredParent(\n  row: ExecutionStorageRow,\n  source: CreateExecutionInput[\"source\"]\n): void {\n  const expected = source.type === \"execution\" ? source.executionId : null\n  if (row.parentExecutionId !== expected) {\n    throw new ExecutionStorageError(\n      \"invalid_parent_execution\",\n      `[Sixb] Stored execution '${row.id}' has inconsistent parent execution provenance.`\n    )\n  }\n}\n\nfunction flattenExecutor(\n  record: ExecutionRecord\n): Pick<ExecutionStorageRow, \"executorId\" | \"executorKind\"> {\n  switch (record.executor.type) {\n    case \"request\":\n      return { executorKind: \"request\", executorId: record.executor.requestId }\n    case \"primitive\":\n      return { executorKind: record.executor.kind, executorId: record.executor.runId }\n    case \"agent\":\n      return { executorKind: \"agent\", executorId: record.executor.runId }\n    case \"kernel\":\n      return { executorKind: \"kernel\", executorId: kernelOperationId(record.executor.operation) }\n  }\n}\n\nfunction flattenSource(\n  record: ExecutionRecord\n): Pick<ExecutionStorageRow, \"sourceId\" | \"sourceKind\"> {\n  switch (record.source.type) {\n    case \"ontologyCommit\":\n      return { sourceKind: \"ontologyCommit\", sourceId: record.source.commitId }\n    case \"http\":\n      return { sourceKind: \"http\", sourceId: record.source.requestId }\n    case \"webhook\":\n      return { sourceKind: \"webhook\", sourceId: record.source.deliveryId }\n    case \"schedule\":\n    case \"event\":\n      return { sourceKind: record.source.type, sourceId: record.source.eventId }\n    case \"datasetVersion\":\n      return {\n        sourceKind: \"datasetVersion\",\n        sourceId: JSON.stringify([record.source.datasetId, record.source.versionId]),\n      }\n    case \"execution\":\n      return { sourceKind: \"execution\", sourceId: record.source.executionId }\n  }\n}\n\nfunction flattenAuthority(\n  record: ExecutionRecord\n): Pick<\n  ExecutionStorageRow,\n  | \"authorityAccessTokenId\"\n  | \"authorityKernelOperation\"\n  | \"authorityDelegationKind\"\n  | \"authorityDelegationId\"\n  | \"authorityDelegationSessionId\"\n  | \"authorityKind\"\n  | \"authorityPrimitiveId\"\n  | \"authorityPrimitiveKind\"\n  | \"authorityServiceAccountId\"\n  | \"authoritySessionId\"\n  | \"authorityUserId\"\n> {\n  const empty = {\n    authorityUserId: null,\n    authorityServiceAccountId: null,\n    authoritySessionId: null,\n    authorityAccessTokenId: null,\n    authorityPrimitiveKind: null,\n    authorityPrimitiveId: null,\n    authorityKernelOperation: null,\n    authorityDelegationKind: null,\n    authorityDelegationId: null,\n    authorityDelegationSessionId: null,\n  }\n\n  switch (record.authorizationRef.type) {\n    case \"principal\":\n      return {\n        ...empty,\n        authorityKind: \"principal\",\n        authorityUserId:\n          record.authorizationRef.principal.type === \"user\"\n            ? record.authorizationRef.principal.id\n            : null,\n        authorityServiceAccountId:\n          record.authorizationRef.principal.type === \"serviceAccount\"\n            ? record.authorizationRef.principal.id\n            : null,\n        authoritySessionId:\n          record.authorizationRef.credential?.type === \"session\"\n            ? record.authorizationRef.credential.id\n            : null,\n        authorityAccessTokenId:\n          record.authorizationRef.credential?.type === \"accessToken\"\n            ? record.authorizationRef.credential.id\n            : null,\n      }\n    case \"trustedPrimitive\":\n      return {\n        ...empty,\n        authorityKind: \"trustedPrimitive\",\n        authorityPrimitiveKind: record.authorizationRef.primitive.kind,\n        authorityPrimitiveId: record.authorizationRef.primitive.id,\n      }\n    case \"delegated\":\n      return {\n        ...empty,\n        authorityKind: \"delegated\",\n        authorityDelegationKind: record.authorizationRef.delegation.kind,\n        authorityDelegationId: record.authorizationRef.delegation.grantId,\n        authorityDelegationSessionId: record.authorizationRef.delegation.sessionId,\n      }\n    case \"kernel\":\n      return {\n        ...empty,\n        authorityKind: \"kernel\",\n        authorityKernelOperation: record.authorizationRef.operation.type,\n      }\n    case \"disabled\":\n      return { ...empty, authorityKind: \"disabled\" }\n  }\n}\n\nfunction inflateExecutor(row: ExecutionStorageRow): CreateExecutionInput[\"executor\"] {\n  switch (row.executorKind) {\n    case \"request\":\n      return { type: \"request\", requestId: row.executorId }\n    case \"agent\":\n      return { type: \"agent\", runId: row.executorId }\n    case \"kernel\":\n      return {\n        type: \"kernel\",\n        operation: kernelOperationFromId(\n          requireValue(row.authorityKernelOperation, \"authority kernel operation\"),\n          row.executorId\n        ),\n      }\n    default:\n      return { type: \"primitive\", kind: row.executorKind, runId: row.executorId }\n  }\n}\n\nfunction inflateSource(row: ExecutionStorageRow): CreateExecutionInput[\"source\"] {\n  switch (row.sourceKind) {\n    case \"ontologyCommit\":\n      return { type: \"ontologyCommit\", commitId: row.sourceId }\n    case \"http\":\n      return { type: \"http\", requestId: row.sourceId }\n    case \"webhook\":\n      return { type: \"webhook\", deliveryId: row.sourceId }\n    case \"schedule\":\n    case \"event\":\n      return { type: row.sourceKind, eventId: row.sourceId }\n    case \"datasetVersion\": {\n      const [datasetId, versionId] = parseDatasetVersionSourceId(row.sourceId)\n      return { type: \"datasetVersion\", datasetId, versionId }\n    }\n    case \"execution\":\n      return { type: \"execution\", executionId: row.sourceId }\n  }\n}\n\nfunction parseDatasetVersionSourceId(sourceId: string): readonly [string, string] {\n  try {\n    const parsed: unknown = JSON.parse(sourceId)\n    if (\n      Array.isArray(parsed) &&\n      parsed.length === 2 &&\n      parsed.every((value) => typeof value === \"string\" && value.trim().length > 0)\n    ) {\n      return parsed as unknown as readonly [string, string]\n    }\n  } catch {\n    // Fall through to the provider-corruption error below.\n  }\n  throw new Error(\"[Sixb] Stored dataset-version execution source is malformed.\")\n}\n\nfunction inflateAuthority(row: ExecutionStorageRow): CreateExecutionInput[\"authorizationRef\"] {\n  switch (row.authorityKind) {\n    case \"principal\": {\n      const principal = row.authorityUserId\n        ? ({ type: \"user\", id: row.authorityUserId } as const)\n        : ({\n            type: \"serviceAccount\",\n            id: requireValue(row.authorityServiceAccountId, \"authority service account id\"),\n          } as const)\n      const credential = row.authoritySessionId\n        ? ({ type: \"session\", id: row.authoritySessionId } as const)\n        : row.authorityAccessTokenId\n          ? ({ type: \"accessToken\", id: row.authorityAccessTokenId } as const)\n          : undefined\n      return {\n        type: \"principal\",\n        principal,\n        ...(credential === undefined ? {} : { credential }),\n      }\n    }\n    case \"trustedPrimitive\":\n      return {\n        type: \"trustedPrimitive\",\n        primitive: {\n          kind: requireValue(row.authorityPrimitiveKind, \"authority primitive kind\"),\n          id: requireValue(row.authorityPrimitiveId, \"authority primitive id\"),\n          runId: row.executorId,\n        },\n      }\n    case \"delegated\":\n      return {\n        type: \"delegated\",\n        delegation: {\n          kind: requireValue(row.authorityDelegationKind, \"authority delegation kind\"),\n          grantId: requireValue(row.authorityDelegationId, \"authority delegation id\"),\n          sessionId: requireValue(\n            row.authorityDelegationSessionId,\n            \"authority delegation session id\"\n          ),\n        },\n      }\n    case \"kernel\":\n      return {\n        type: \"kernel\",\n        operation: kernelOperationFromId(\n          requireValue(row.authorityKernelOperation, \"authority kernel operation\"),\n          row.executorId\n        ),\n      }\n    case \"disabled\":\n      return { type: \"disabled\" }\n  }\n}\n\nfunction requireValue<T>(value: T | null, label: string): T {\n  if (value === null) {\n    throw new Error(`[Sixb] Stored execution is missing ${label}.`)\n  }\n  return value\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;AAUO,MAAM,+BAA8B,MAAM;AAAA,EAIpC;AAAA,EAHF,OAAO;AAAA,EAEhB,WAAW,CACA,MACT,SACA,UAAwB,CAAC,GACzB;AAAA,IACA,MAAM,SAAS,OAAO;AAAA,IAJb;AAAA;AAMb;;;ACpBA;AA8BA,eAAsB,uBAAsB,CAC1C,OACA,QAC0B;AAAA,EAC1B,IAAI,SAAS,MAAM;AAAA,EACnB,IAAI,WAAW,aAAa,MAAM,OAAO,SAAS,aAAa;AAAA,IAC7D,MAAM,SAAS,MAAM,OAAO,aAAa;AAAA,MACvC,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM,OAAO;AAAA,IACnB,CAAC;AAAA,IACD,SAAS,QAAQ;AAAA,EACnB,EAAO,SAAI,WAAW,aAAa,MAAM,aAAa;AAAA,IACpD,SAAS,MAAM,0BAA0B;AAAA,MACvC,MAAM,OAAO;AAAA,MACb,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,EACH;AAAA,EACA,MAAM,SAAS,0BAAyB,KAAK,OAAO,mBAAmB,UAAU,CAAC,EAAE,CAAC;AAAA,EACrF,MAAM,mCAAkC,QAAQ,MAAM;AAAA,EACtD,OAAO;AAAA;AAGF,SAAS,yBAAwB,CACtC,OACA,YAAkB,IAAI,MACL;AAAA,EACjB,MAAM,SAA0B;AAAA,IAC9B,IAAI,MAAM;AAAA,IACV,WAAW,MAAM;AAAA,IACjB,mBAAmB,2BAA2B,MAAM,qBAAqB,CAAC,CAAC;AAAA,OACvE,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,gBAAgB,MAAM,WAAW,EAAE;AAAA,IAC7F,UAAU,gBAAgB,MAAM,QAAQ;AAAA,IACxC,QAAQ,gBAAgB,MAAM,MAAM;AAAA,IACpC,eAAe,MAAM;AAAA,IACrB,kBAAkB,gBAAgB,MAAM,gBAAgB;AAAA,IACxD,WAAW,IAAI,KAAK,SAAS;AAAA,EAC/B;AAAA,EAEA,kBAAkB,MAAM;AAAA,EACxB,wBAAwB,MAAM;AAAA,EAC9B,OAAO;AAAA;AAGT,eAAsB,kCAAiC,CACrD,QACA,QACe;AAAA,EACf,MAAM,kBAAkB,OAAO,aAAa,OAAO,WAAW,0BAA0B,MAAM;AAAA,EAE9F,IAAI,OAAO,iBAAiB,SAAS,aAAa;AAAA,IAChD,MAAM,kBACJ,OAAO,iBAAiB,WACxB,OAAO,WACP,uBACA,MACF;AAAA,IACA,MAAM,mBAAmB,QAAQ,MAAM;AAAA,EACzC;AAAA,EACA,IAAI,OAAO,iBAAiB,SAAS,aAAa;AAAA,IAChD,MAAM,mBAAmB,QAAQ,MAAM;AAAA,EACzC;AAAA,EAEA,MAAM,eAAe,QAAQ,MAAM;AAAA;AAG9B,SAAS,oBAAoB,CAAC,QAA0C;AAAA,EAC7E,OAAO,gBAAgB,MAAM;AAAA;AAG/B,SAAS,iBAAiB,CAAC,QAA+B;AAAA,EACxD,eAAe,OAAO,IAAI,cAAc;AAAA,EACxC,eAAe,OAAO,WAAW,sBAAsB;AAAA,EACvD,eAAe,OAAO,eAAe,0BAA0B;AAAA,EAC/D,gBAAgB,OAAO,WAAW,qBAAqB;AAAA,EAEvD,IAAI,OAAO,aAAa;AAAA,IACtB,gBAAgB,OAAO,aAAa,wBAAwB;AAAA,EAC9D;AAAA,EAEA,eAAe,OAAO,QAAQ;AAAA,EAC9B,aAAa,OAAO,MAAM;AAAA,EAC1B,uBAAuB,OAAO,gBAAgB;AAAA;AAGhD,SAAS,cAAc,CAAC,UAA0C;AAAA,EAChE,QAAQ,SAAS;AAAA,SACV;AAAA,MACH,eAAe,SAAS,WAAW,qBAAqB;AAAA,MACxD;AAAA,SACG;AAAA,MACH,2BAA2B,SAAS,MAAM,yBAAyB;AAAA,MACnE,eAAe,SAAS,OAAO,2BAA2B;AAAA,MAC1D;AAAA,SACG;AAAA,MACH,eAAe,SAAS,OAAO,uBAAuB;AAAA,MACtD;AAAA,SACG;AAAA,MACH,sBAAsB,SAAS,WAAW,2BAA2B;AAAA,MACrE;AAAA;AAAA,MAEA,QAAQ,oCAAoC,OAAQ,SAAgC,IAAI,KAAK;AAAA;AAAA;AAInG,SAAS,YAAY,CAAC,QAAsC;AAAA,EAC1D,QAAQ,OAAO;AAAA,SACR;AAAA,MACH,eAAe,OAAO,UAAU,4BAA4B;AAAA,MAC5D;AAAA,SACG;AAAA,MACH,eAAe,OAAO,WAAW,6BAA6B;AAAA,MAC9D;AAAA,SACG;AAAA,MACH,eAAe,OAAO,YAAY,8BAA8B;AAAA,MAChE;AAAA,SACG;AAAA,SACA;AAAA,MACH,eAAe,OAAO,SAAS,2BAA2B;AAAA,MAC1D;AAAA,SACG;AAAA,MACH,eAAe,OAAO,WAAW,6BAA6B;AAAA,MAC9D,eAAe,OAAO,WAAW,qCAAqC;AAAA,MACtE;AAAA,SACG;AAAA,MACH,eAAe,OAAO,aAAa,+BAA+B;AAAA,MAClE;AAAA;AAAA,MAEA,QACE,0BAA0B,OAAQ,OAA8B,IAAI,oBACtE;AAAA;AAAA;AAIN,SAAS,sBAAsB,CAAC,KAA6B;AAAA,EAC3D,QAAQ,IAAI;AAAA,SACL;AAAA,MACH,gBAAgB,IAAI,WAAW,qBAAqB;AAAA,MACpD,IAAI,IAAI,YAAY;AAAA,QAClB,IAAI,IAAI,WAAW,SAAS,aAAa,IAAI,WAAW,SAAS,eAAe;AAAA,UAC9E,QACE,sCAAsC,OACnC,IAAI,WAAkC,IACzC,KACF;AAAA,QACF;AAAA,QACA,eAAe,IAAI,WAAW,IAAI,yBAAyB;AAAA,MAC7D;AAAA,MACA;AAAA,SACG;AAAA,MACH,2BAA2B,IAAI,UAAU,MAAM,0BAA0B;AAAA,MACzE,eAAe,IAAI,UAAU,IAAI,wBAAwB;AAAA,MACzD,eAAe,IAAI,UAAU,OAAO,4BAA4B;AAAA,MAChE;AAAA,SACG;AAAA,MACH,IAAI,IAAI,WAAW,SAAS,SAAS;AAAA,QACnC,QACE,sCAAsC,OACnC,IAAI,WAAkC,IACzC,KACF;AAAA,MACF;AAAA,MACA,eAAe,IAAI,WAAW,SAAS,+BAA+B;AAAA,MACtE,eAAe,IAAI,WAAW,WAAW,iCAAiC;AAAA,MAC1E;AAAA,SACG;AAAA,MACH,sBAAsB,IAAI,WAAW,4BAA4B;AAAA,MACjE;AAAA,SACG;AAAA,MACH;AAAA;AAAA,MAEA,QAAQ,yCAAyC,OAAQ,IAA2B,IAAI,KAAK;AAAA;AAAA;AAInG,SAAS,uBAAuB,CAAC,QAA+B;AAAA,EAC9D,QAAQ,UAAU,kBAAkB,aAAa,WAAW;AAAA,EAE5D,QAAQ,SAAS;AAAA,SACV,WAAW;AAAA,MACd,IAAI,OAAO,SAAS,UAAU,OAAO,cAAc,SAAS,WAAW;AAAA,QACrE,QAAQ,+DAA+D;AAAA,MACzE;AAAA,MACA,IAAI,iBAAiB,SAAS,aAAa;AAAA,QACzC,IAAI,CAAC,gBAAgB,aAAa,iBAAiB,SAAS,GAAG;AAAA,UAC7D,QAAQ,0DAA0D;AAAA,QACpE;AAAA,QACA;AAAA,MACF;AAAA,MACA,IAAI,iBAAiB,SAAS,YAAY;AAAA,QACxC,IAAI,gBAAgB,WAAW;AAAA,UAC7B,QAAQ,wEAAwE;AAAA,QAClF;AAAA,QACA;AAAA,MACF;AAAA,MACA,IAAI,iBAAiB,SAAS,aAAa;AAAA,QACzC,IAAI,gBAAgB,WAAW;AAAA,UAC7B,QAAQ,oEAAoE;AAAA,QAC9E;AAAA,QACA;AAAA,MACF;AAAA,MACA,QAAQ,oFAAoF;AAAA,MAC5F;AAAA,IACF;AAAA,SACK,aAAa;AAAA,MAChB,IAAI,iBAAiB,SAAS,oBAAoB;AAAA,QAChD,QAAQ,2DAA2D;AAAA,MACrE;AAAA,MACA,IACE,iBAAiB,UAAU,SAAS,SAAS,QAC7C,iBAAiB,UAAU,UAAU,SAAS,OAC9C;AAAA,QACA,QAAQ,sEAAsE;AAAA,MAChF;AAAA,MACA;AAAA,IACF;AAAA,SACK,SAAS;AAAA,MACZ,IAAI,OAAO,SAAS,aAAa;AAAA,QAC/B,QAAQ,qDAAqD;AAAA,MAC/D;AAAA,MACA,IACE,iBAAiB,SAAS,eAC1B,iBAAiB,UAAU,SAAS,oBACpC,iBAAiB,eAAe,WAChC;AAAA,QACA;AAAA,MACF;AAAA,MACA,IACE,iBAAiB,SAAS,eAC1B,iBAAiB,UAAU,SAAS,UACpC,iBAAiB,eAAe,WAChC;AAAA,QACA;AAAA,MACF;AAAA,MACA,IAAI,iBAAiB,SAAS;AAAA,QAAY;AAAA,MAC1C,QACE,wGACF;AAAA,MACA;AAAA,IACF;AAAA,SACK,UAAU;AAAA,MACb,IACE,iBAAiB,SAAS,YAC1B,CAAC,sBAAsB,iBAAiB,WAAW,SAAS,SAAS,GACrE;AAAA,QACA,QAAQ,qDAAqD;AAAA,MAC/D;AAAA,MACA,IAAI,gBAAgB,WAAW;AAAA,QAC7B,QAAQ,yDAAyD;AAAA,MACnE;AAAA,MACA;AAAA,IACF;AAAA;AAAA;AAIJ,eAAe,iBAAiB,CAC9B,WACA,WACA,OACA,QACe;AAAA,EACf,IAAI,CAAC;AAAA,IAAW;AAAA,EAEhB,MAAM,SACJ,UAAU,SAAS,SACf,MAAM,OAAO,KAAK,MAAM,QAAQ,EAAE,WAAW,IAAI,UAAU,GAAG,CAAC,IAC/D,MAAM,OAAO,KAAK,gBAAgB,QAAQ,EAAE,WAAW,IAAI,UAAU,GAAG,CAAC;AAAA,EAC/E,IAAI,CAAC,QAAQ;AAAA,IACX,MAAM,IAAI,uBACR,qBACA,UAAU,UAAU,UAAU,kCAAkC,aAClE;AAAA,EACF;AAAA;AAGF,eAAe,kBAAkB,CAC/B,QACA,QACe;AAAA,EACf,IAAI,OAAO,iBAAiB,SAAS,eAAe,CAAC,OAAO,iBAAiB;AAAA,IAAY;AAAA,EAEzF,QAAQ,WAAW,eAAe,OAAO;AAAA,EACzC,IAAI,WAAW,SAAS,WAAW;AAAA,IACjC,MAAM,UAAU,MAAM,OAAO,KAAK,SAAS,QAAQ;AAAA,MACjD,WAAW,OAAO;AAAA,MAClB,IAAI,WAAW;AAAA,IACjB,CAAC;AAAA,IACD,IAAI,CAAC,SAAS;AAAA,MACZ,MAAM,IAAI,uBACR,sBACA,6BAA6B,WAAW,kCAAkC,OAAO,aACnF;AAAA,IACF;AAAA,IACA,IAAI,UAAU,SAAS,UAAU,QAAQ,WAAW,UAAU,IAAI;AAAA,MAChE,MAAM,IAAI,uBACR,sBACA,6BAA6B,WAAW,qCAAqC,UAAU,MACzF;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,MAAM,OAAO,KAAK,aAAa,QAAQ;AAAA,IACnD,WAAW,OAAO;AAAA,IAClB,IAAI,WAAW;AAAA,EACjB,CAAC;AAAA,EACD,IAAI,CAAC,OAAO;AAAA,IACV,MAAM,IAAI,uBACR,sBACA,kCAAkC,WAAW,kCAAkC,OAAO,aACxF;AAAA,EACF;AAAA,EACA,IAAI,CAAC,gBAAgB,MAAM,SAAS,SAAS,GAAG;AAAA,IAC9C,MAAM,IAAI,uBACR,sBACA,kCAAkC,WAAW,qCAAqC,UAAU,MAC9F;AAAA,EACF;AAAA;AAGF,eAAe,kBAAkB,CAC/B,QACA,QACe;AAAA,EACf,IAAI,OAAO,iBAAiB,SAAS;AAAA,IAAa;AAAA,EAClD,QAAQ,SAAS,cAAc,OAAO,iBAAiB;AAAA,EACvD,MAAM,UAAU,MAAM,OAAO,gBAAgB,EAAE,WAAW,OAAO,WAAW,IAAI,UAAU,CAAC;AAAA,EAC3F,IAAI,CAAC,SAAS;AAAA,IACZ,MAAM,IAAI,uBACR,sBACA,oCAAoC,yCAAyC,OAAO,aACtF;AAAA,EACF;AAAA,EACA,IAAI,QAAQ,YAAY,SAAS;AAAA,IAC/B,MAAM,IAAI,uBACR,sBACA,oCAAoC,wCAAwC,WAC9E;AAAA,EACF;AAAA;AAGF,eAAe,cAAc,CAC3B,QACA,QACe;AAAA,EACf,IAAI,OAAO,OAAO,SAAS;AAAA,IAAa;AAAA,EACxC,MAAM,oBAAoB,OAAO,OAAO;AAAA,EAExC,MAAM,SAAS,MAAM,OAAO,aAAa;AAAA,IACvC,WAAW,OAAO;AAAA,IAClB,IAAI;AAAA,EACN,CAAC;AAAA,EACD,IAAI,CAAC,QAAQ;AAAA,IACX,MAAM,IAAI,uBACR,4BACA,4BAA4B,iDAAiD,OAAO,aACtF;AAAA,EACF;AAAA,EACA,IAAI,OAAO,kBAAkB,OAAO,eAAe;AAAA,IACjD,MAAM,IAAI,uBACR,4BACA,2BAA2B,OAAO,8CACpC;AAAA,EACF;AAAA,EACA,IAAI,CAAC,gBAAgB,OAAO,aAAa,OAAO,WAAW,GAAG;AAAA,IAC5D,MAAM,IAAI,uBACR,4BACA,2BAA2B,OAAO,sDACpC;AAAA,EACF;AAAA,EACA,IAAI,CAAC,kBAAkB,OAAO,mBAAmB,OAAO,iBAAiB,GAAG;AAAA,IAC1E,MAAM,IAAI,uBACR,4BACA,2BAA2B,OAAO,wDACpC;AAAA,EACF;AAAA,EACA,IACE,OAAO,SAAS,SAAS,WACzB,0BAA0B,OAAO,gBAAgB,KACjD,CAAC,kBAAkB,OAAO,kBAAkB,OAAO,gBAAgB,GACnE;AAAA,IACA,MAAM,IAAI,uBACR,4BACA,iCAAiC,OAAO,wDAC1C;AAAA,EACF;AAAA;AAGF,SAAS,yBAAyB,CAAC,KAAgC;AAAA,EACjE,OACE,IAAI,SAAS,cACZ,IAAI,SAAS,eAAe,IAAI,UAAU,SAAS,UAAU,IAAI,eAAe;AAAA;AAIrF,SAAS,eAAe,CAAC,WAAkC,OAAqB;AAAA,EAC9E,IAAI,UAAU,SAAS,UAAU,UAAU,SAAS,kBAAkB;AAAA,IACpE,QAAQ,GAAG,+BAA+B,OAAQ,UAAiC,IAAI,KAAK;AAAA,EAC9F;AAAA,EACA,eAAe,UAAU,IAAI,GAAG,UAAU;AAAA;AAG5C,SAAS,qBAAqB,CAAC,WAA4B,OAAqB;AAAA,EAC9E,IAAI,UAAU,SAAS,sBAAsB,UAAU,SAAS,yBAAyB;AAAA,IACvF,QAAQ,GAAG,+BAA+B,OAAQ,UAAiC,IAAI,KAAK;AAAA,EAC9F;AAAA,EACA,eAAe,kBAAkB,SAAS,GAAG,GAAG,oBAAoB;AAAA;AAGtE,SAAS,0BAA0B,CAAC,OAAe,OAAqB;AAAA,EACtE,IAAI,CAAC,wBAAwB,IAAI,KAAK,GAAG;AAAA,IACvC,QAAQ,GAAG,UAAU,0BAA0B;AAAA,EACjD;AAAA;AAGF,SAAS,cAAc,CAAC,OAAe,OAAqB;AAAA,EAC1D,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,GAAG;AAAA,IAC9C,QAAQ,GAAG,mCAAmC;AAAA,EAChD;AAAA;AAGF,SAAS,eAAe,CAAC,OAAa,OAAqB;AAAA,EACzD,IAAI,EAAE,iBAAiB,SAAS,CAAC,OAAO,SAAS,MAAM,QAAQ,CAAC,GAAG;AAAA,IACjE,QAAQ,GAAG,6BAA6B;AAAA,EAC1C;AAAA;AAGF,SAAS,eAAe,CACtB,MACA,OACS;AAAA,EACT,OAAO,MAAM,SAAS,OAAO,QAAQ,MAAM,OAAO,OAAO;AAAA;AAG3D,SAAS,qBAAqB,CAAC,MAAuB,OAAiC;AAAA,EACrF,OAAO,KAAK,SAAS,MAAM,QAAQ,kBAAkB,IAAI,MAAM,kBAAkB,KAAK;AAAA;AAGxF,SAAS,OAAO,CAAC,SAAwB;AAAA,EACvC,MAAM,IAAI,uBAAsB,iBAAiB,UAAU,SAAS;AAAA;AAGtE,IAAM,0BAA0B,IAAI,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;;;ACldM,SAAS,yBAAwB,CACtC,MACA,OACQ;AAAA,EACR,MAAM,SAAS,KAAK,UAAU,QAAQ,IAAI,MAAM,UAAU,QAAQ;AAAA,EAClE,IAAI,WAAW,GAAG;AAAA,IAChB,OAAO;AAAA,EACT;AAAA,EACA,OAAO,KAAK,KAAK,MAAM,KAAK,KAAK,KAAK,KAAK,MAAM,KAAK,IAAI;AAAA;AAsCrD,SAAS,4BAA2B,CAAC,QAA8C;AAAA,EACxF,MAAM,WAAW,gBAAgB,MAAM;AAAA,EACvC,MAAM,SAAS,cAAc,MAAM;AAAA,EACnC,MAAM,YAAY,iBAAiB,MAAM;AAAA,EACzC,OAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,IAAI,OAAO;AAAA,IACX,mBAAmB,CAAC,GAAG,OAAO,iBAAiB;AAAA,OAC5C;AAAA,OACA;AAAA,IACH,mBAAmB,OAAO,aAAa,SAAS,SAAS,OAAO,YAAY,KAAK;AAAA,IACjF,6BACE,OAAO,aAAa,SAAS,mBAAmB,OAAO,YAAY,KAAK;AAAA,IAC1E,eAAe,OAAO;AAAA,IACtB,mBAAmB,OAAO,OAAO,SAAS,cAAc,OAAO,OAAO,cAAc;AAAA,OACjF;AAAA,IACH,WAAW,IAAI,KAAK,OAAO,SAAS;AAAA,EACtC;AAAA;AAGK,SAAS,8BAA6B,CAAC,KAA2C;AAAA,EACvF,MAAM,WAAW,gBAAgB,GAAG;AAAA,EACpC,MAAM,SAAS,cAAc,GAAG;AAAA,EAChC,mBAAmB,KAAK,MAAM;AAAA,EAC9B,MAAM,mBAAmB,iBAAiB,GAAG;AAAA,EAC7C,MAAM,cAAc,IAAI,oBACnB,EAAE,MAAM,QAAQ,IAAI,IAAI,kBAAkB,IAC3C,IAAI,8BACD,EAAE,MAAM,kBAAkB,IAAI,IAAI,4BAA4B,IAC/D;AAAA,EAEN,OAAO,0BACL;AAAA,IACE,IAAI,IAAI;AAAA,IACR,WAAW,IAAI;AAAA,IACf,mBAAmB,IAAI;AAAA,OACnB,gBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY;AAAA,IACnD;AAAA,IACA;AAAA,IACA,eAAe,IAAI;AAAA,IACnB;AAAA,EACF,GACA,IAAI,SACN;AAAA;AAGF,SAAS,kBAAkB,CACzB,KACA,QACM;AAAA,EACN,MAAM,WAAW,OAAO,SAAS,cAAc,OAAO,cAAc;AAAA,EACpE,IAAI,IAAI,sBAAsB,UAAU;AAAA,IACtC,MAAM,IAAI,uBACR,4BACA,4BAA4B,IAAI,mDAClC;AAAA,EACF;AAAA;AAGF,SAAS,eAAe,CACtB,QAC0D;AAAA,EAC1D,QAAQ,OAAO,SAAS;AAAA,SACjB;AAAA,MACH,OAAO,EAAE,cAAc,WAAW,YAAY,OAAO,SAAS,UAAU;AAAA,SACrE;AAAA,MACH,OAAO,EAAE,cAAc,OAAO,SAAS,MAAM,YAAY,OAAO,SAAS,MAAM;AAAA,SAC5E;AAAA,MACH,OAAO,EAAE,cAAc,SAAS,YAAY,OAAO,SAAS,MAAM;AAAA,SAC/D;AAAA,MACH,OAAO,EAAE,cAAc,UAAU,YAAY,kBAAkB,OAAO,SAAS,SAAS,EAAE;AAAA;AAAA;AAIhG,SAAS,aAAa,CACpB,QACsD;AAAA,EACtD,QAAQ,OAAO,OAAO;AAAA,SACf;AAAA,MACH,OAAO,EAAE,YAAY,kBAAkB,UAAU,OAAO,OAAO,SAAS;AAAA,SACrE;AAAA,MACH,OAAO,EAAE,YAAY,QAAQ,UAAU,OAAO,OAAO,UAAU;AAAA,SAC5D;AAAA,MACH,OAAO,EAAE,YAAY,WAAW,UAAU,OAAO,OAAO,WAAW;AAAA,SAChE;AAAA,SACA;AAAA,MACH,OAAO,EAAE,YAAY,OAAO,OAAO,MAAM,UAAU,OAAO,OAAO,QAAQ;AAAA,SACtE;AAAA,MACH,OAAO;AAAA,QACL,YAAY;AAAA,QACZ,UAAU,KAAK,UAAU,CAAC,OAAO,OAAO,WAAW,OAAO,OAAO,SAAS,CAAC;AAAA,MAC7E;AAAA,SACG;AAAA,MACH,OAAO,EAAE,YAAY,aAAa,UAAU,OAAO,OAAO,YAAY;AAAA;AAAA;AAI5E,SAAS,gBAAgB,CACvB,QAcA;AAAA,EACA,MAAM,QAAQ;AAAA,IACZ,iBAAiB;AAAA,IACjB,2BAA2B;AAAA,IAC3B,oBAAoB;AAAA,IACpB,wBAAwB;AAAA,IACxB,wBAAwB;AAAA,IACxB,sBAAsB;AAAA,IACtB,0BAA0B;AAAA,IAC1B,yBAAyB;AAAA,IACzB,uBAAuB;AAAA,IACvB,8BAA8B;AAAA,EAChC;AAAA,EAEA,QAAQ,OAAO,iBAAiB;AAAA,SACzB;AAAA,MACH,OAAO;AAAA,WACF;AAAA,QACH,eAAe;AAAA,QACf,iBACE,OAAO,iBAAiB,UAAU,SAAS,SACvC,OAAO,iBAAiB,UAAU,KAClC;AAAA,QACN,2BACE,OAAO,iBAAiB,UAAU,SAAS,mBACvC,OAAO,iBAAiB,UAAU,KAClC;AAAA,QACN,oBACE,OAAO,iBAAiB,YAAY,SAAS,YACzC,OAAO,iBAAiB,WAAW,KACnC;AAAA,QACN,wBACE,OAAO,iBAAiB,YAAY,SAAS,gBACzC,OAAO,iBAAiB,WAAW,KACnC;AAAA,MACR;AAAA,SACG;AAAA,MACH,OAAO;AAAA,WACF;AAAA,QACH,eAAe;AAAA,QACf,wBAAwB,OAAO,iBAAiB,UAAU;AAAA,QAC1D,sBAAsB,OAAO,iBAAiB,UAAU;AAAA,MAC1D;AAAA,SACG;AAAA,MACH,OAAO;AAAA,WACF;AAAA,QACH,eAAe;AAAA,QACf,yBAAyB,OAAO,iBAAiB,WAAW;AAAA,QAC5D,uBAAuB,OAAO,iBAAiB,WAAW;AAAA,QAC1D,8BAA8B,OAAO,iBAAiB,WAAW;AAAA,MACnE;AAAA,SACG;AAAA,MACH,OAAO;AAAA,WACF;AAAA,QACH,eAAe;AAAA,QACf,0BAA0B,OAAO,iBAAiB,UAAU;AAAA,MAC9D;AAAA,SACG;AAAA,MACH,OAAO,KAAK,OAAO,eAAe,WAAW;AAAA;AAAA;AAInD,SAAS,eAAe,CAAC,KAA4D;AAAA,EACnF,QAAQ,IAAI;AAAA,SACL;AAAA,MACH,OAAO,EAAE,MAAM,WAAW,WAAW,IAAI,WAAW;AAAA,SACjD;AAAA,MACH,OAAO,EAAE,MAAM,SAAS,OAAO,IAAI,WAAW;AAAA,SAC3C;AAAA,MACH,OAAO;AAAA,QACL,MAAM;AAAA,QACN,WAAW,sBACT,aAAa,IAAI,0BAA0B,4BAA4B,GACvE,IAAI,UACN;AAAA,MACF;AAAA;AAAA,MAEA,OAAO,EAAE,MAAM,aAAa,MAAM,IAAI,cAAc,OAAO,IAAI,WAAW;AAAA;AAAA;AAIhF,SAAS,aAAa,CAAC,KAA0D;AAAA,EAC/E,QAAQ,IAAI;AAAA,SACL;AAAA,MACH,OAAO,EAAE,MAAM,kBAAkB,UAAU,IAAI,SAAS;AAAA,SACrD;AAAA,MACH,OAAO,EAAE,MAAM,QAAQ,WAAW,IAAI,SAAS;AAAA,SAC5C;AAAA,MACH,OAAO,EAAE,MAAM,WAAW,YAAY,IAAI,SAAS;AAAA,SAChD;AAAA,SACA;AAAA,MACH,OAAO,EAAE,MAAM,IAAI,YAAY,SAAS,IAAI,SAAS;AAAA,SAClD,kBAAkB;AAAA,MACrB,OAAO,WAAW,aAAa,4BAA4B,IAAI,QAAQ;AAAA,MACvE,OAAO,EAAE,MAAM,kBAAkB,WAAW,UAAU;AAAA,IACxD;AAAA,SACK;AAAA,MACH,OAAO,EAAE,MAAM,aAAa,aAAa,IAAI,SAAS;AAAA;AAAA;AAI5D,SAAS,2BAA2B,CAAC,UAA6C;AAAA,EAChF,IAAI;AAAA,IACF,MAAM,SAAkB,KAAK,MAAM,QAAQ;AAAA,IAC3C,IACE,MAAM,QAAQ,MAAM,KACpB,OAAO,WAAW,KAClB,OAAO,MAAM,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC,GAC5E;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,MAAM;AAAA,EAGR,MAAM,IAAI,MAAM,8DAA8D;AAAA;AAGhF,SAAS,gBAAgB,CAAC,KAAoE;AAAA,EAC5F,QAAQ,IAAI;AAAA,SACL,aAAa;AAAA,MAChB,MAAM,YAAY,IAAI,kBACjB,EAAE,MAAM,QAAQ,IAAI,IAAI,gBAAgB,IACxC;AAAA,QACC,MAAM;AAAA,QACN,IAAI,aAAa,IAAI,2BAA2B,8BAA8B;AAAA,MAChF;AAAA,MACJ,MAAM,aAAa,IAAI,qBAClB,EAAE,MAAM,WAAW,IAAI,IAAI,mBAAmB,IAC/C,IAAI,yBACD,EAAE,MAAM,eAAe,IAAI,IAAI,uBAAuB,IACvD;AAAA,MACN,OAAO;AAAA,QACL,MAAM;AAAA,QACN;AAAA,WACI,eAAe,YAAY,CAAC,IAAI,EAAE,WAAW;AAAA,MACnD;AAAA,IACF;AAAA,SACK;AAAA,MACH,OAAO;AAAA,QACL,MAAM;AAAA,QACN,WAAW;AAAA,UACT,MAAM,aAAa,IAAI,wBAAwB,0BAA0B;AAAA,UACzE,IAAI,aAAa,IAAI,sBAAsB,wBAAwB;AAAA,UACnE,OAAO,IAAI;AAAA,QACb;AAAA,MACF;AAAA,SACG;AAAA,MACH,OAAO;AAAA,QACL,MAAM;AAAA,QACN,YAAY;AAAA,UACV,MAAM,aAAa,IAAI,yBAAyB,2BAA2B;AAAA,UAC3E,SAAS,aAAa,IAAI,uBAAuB,yBAAyB;AAAA,UAC1E,WAAW,aACT,IAAI,8BACJ,iCACF;AAAA,QACF;AAAA,MACF;AAAA,SACG;AAAA,MACH,OAAO;AAAA,QACL,MAAM;AAAA,QACN,WAAW,sBACT,aAAa,IAAI,0BAA0B,4BAA4B,GACvE,IAAI,UACN;AAAA,MACF;AAAA,SACG;AAAA,MACH,OAAO,EAAE,MAAM,WAAW;AAAA;AAAA;AAIhC,SAAS,YAAe,CAAC,OAAiB,OAAkB;AAAA,EAC1D,IAAI,UAAU,MAAM;AAAA,IAClB,MAAM,IAAI,MAAM,sCAAsC,QAAQ;AAAA,EAChE;AAAA,EACA,OAAO;AAAA;",
+  "debugId": "63EAD204251D4A3764756E2164756E21",
+  "names": []
+}

package/dist/{chunk-xt1zt7gv.js → chunk-f4pamkt9.js}

@@ -1,16 +1,15 @@
 // @bun
 import {
   GRANT_KINDS,
+  isSingletonGrantKind,
   grantKindOf
-} from "./chunk-enpsx8k5.js";
-
-// src/security/errors.ts
-class SecurityValidationError2 extends Error {
-  name = "SecurityValidationError";
-}
+} from "./chunk-dhdha526.js";
+import {
+  SecurityValidationError2
+} from "./chunk-jcfw4h7m.js";
 
 // src/security/membership-policies.ts
-var MEMBERSHIP_OPERATIONS = ["invite", "assignGroups", "suspend"];
+var MEMBERSHIP_OPERATIONS = ["invite", "assignGroups", "suspend", "serviceAccounts"];
 function resolveMembershipPolicyScope(input) {
   const callerGroups = new Set(input.callerGroupIds);
   const policyIds = [];
@@ -32,7 +31,8 @@ function resolveMembershipPolicyScope(input) {
     operations: {
       invite: freezeOperationScope(operations.invite),
       assignGroups: freezeOperationScope(operations.assignGroups),
-      suspend: freezeOperationScope(operations.suspend)
+      suspend: freezeOperationScope(operations.suspend),
+      serviceAccounts: freezeOperationScope(operations.serviceAccounts)
     }
   };
 }
@@ -57,7 +57,8 @@ function createEmptyOperationScopes() {
   return {
     invite: { policyIds: [], groupIds: new Set },
     assignGroups: { policyIds: [], groupIds: new Set },
-    suspend: { policyIds: [], groupIds: new Set }
+    suspend: { policyIds: [], groupIds: new Set },
+    serviceAccounts: { policyIds: [], groupIds: new Set }
   };
 }
 function freezeOperationScope(input) {
@@ -72,7 +73,6 @@ function isMembershipOperation(value) {
 
 // src/security/validation.ts
 var GRANT_CAPABILITIES = Object.keys({
-  access: true,
   view: true,
   edit: true,
   append: true,
@@ -117,7 +117,7 @@ function assertMembershipOperationArray(value, field, createError) {
   }
   for (const item of value) {
     if (!isMembershipOperation(item)) {
-      throw createError(`[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`);
+      throw createError(`[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`);
     }
   }
 }
@@ -204,24 +204,21 @@ function assertGrantDefinition(value, field, createError = (message) => new Secu
   if (!GRANT_CAPABILITIES.includes(value.capability)) {
     throw createError(`[Sixb] ${field} grant capability must be ${formatAlternatives(GRANT_CAPABILITIES)}.`);
   }
-  if (value.capability === "access" && value.target !== "application") {
-    throw createError(`[Sixb] ${field} access grant target must be 'application'.`);
-  }
   if (value.capability === "view" && value.target !== "object" && value.target !== "dataset") {
     throw createError(`[Sixb] ${field} view grant target must be 'object' or 'dataset'.`);
   }
   if (value.capability === "run" && value.target !== "workflow" && value.target !== "sync" && value.target !== "pipeline" && value.target !== "agent") {
     throw createError(`[Sixb] ${field} run grant target must be 'workflow', 'sync', 'pipeline', or 'agent'.`);
   }
-  if (value.capability === "observe" && value.target !== "logs" && value.target !== "aiUsage") {
-    throw createError(`[Sixb] ${field} observe grant target must be 'logs' or 'aiUsage'.`);
+  if (value.capability === "observe" && value.target !== "logs" && value.target !== "aiUsage" && value.target !== "activity") {
+    throw createError(`[Sixb] ${field} observe grant target must be 'logs', 'aiUsage', or 'activity'.`);
   }
   if (value.capability === "manage" && value.target !== "connector" && value.target !== "aiUsage") {
     throw createError(`[Sixb] ${field} manage grant target must be 'connector' or 'aiUsage'.`);
   }
-  if (value.capability === "run" && value.target === "agent") {
+  if (isSingletonGrantKind(grantKindOf(value))) {
     if (value.selection !== undefined) {
-      throw createError(`[Sixb] ${field} agent run grant must not declare a selection.`);
+      throw createError(`[Sixb] ${field} ${value.capability} grant on '${value.target}' must not declare a selection.`);
     }
     return;
   }
@@ -361,7 +358,12 @@ function assertGrantReferences(roleId, grant, registered) {
     }
     return;
   }
-  const spec = GRANT_KINDS[grantKindOf(grant)];
+  if (!("selection" in grant))
+    return;
+  const kind = grantKindOf(grant);
+  if (isSingletonGrantKind(kind))
+    return;
+  const spec = GRANT_KINDS[kind];
   const universe = registered[spec.universeKey];
   if (!universe) {
     return;
@@ -375,7 +377,12 @@ function assertGrantReferences(roleId, grant, registered) {
 }
 
 // src/security/builders.ts
-var MEMBERSHIP_OPERATIONS2 = new Set(["invite", "assignGroups", "suspend"]);
+var MEMBERSHIP_OPERATIONS2 = new Set([
+  "invite",
+  "assignGroups",
+  "suspend",
+  "serviceAccounts"
+]);
 function assertNonEmptyArray(value, field) {
   if (value.length === 0) {
     throw new SecurityValidationError2(`[Sixb] ${field} must not be empty.`);
@@ -393,7 +400,7 @@ function groupIdsFrom(groups, field) {
 function membershipOperationsFrom(operations, field) {
   return operations.map((operation) => {
     if (!MEMBERSHIP_OPERATIONS2.has(operation)) {
-      throw new SecurityValidationError2(`[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`);
+      throw new SecurityValidationError2(`[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`);
     }
     return operation;
   });
@@ -466,6 +473,6 @@ function defineMembershipPolicy2(id, options) {
   };
 }
 
-export { SecurityValidationError2, resolveMembershipPolicyScope, canPerformMembershipOperation, missingMembershipGroupIds, isMarkingDefinition, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, validateSecurityDefinitionsAtStartup, defineGroup2, markingIdsFrom, defineMarking2, defineRole2, defineMembershipPolicy2 };
+export { resolveMembershipPolicyScope, canPerformMembershipOperation, missingMembershipGroupIds, isMarkingDefinition, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, validateSecurityDefinitionsAtStartup, defineGroup2, markingIdsFrom, defineMarking2, defineRole2, defineMembershipPolicy2 };
 
-//# debugId=5DED6666AEF6ACF164756E2164756E21
+//# debugId=88BF5C5FE7F574CA64756E2164756E21

package/dist/chunk-f4pamkt9.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/security/membership-policies.ts", "../src/security/validation.ts", "../src/security/builders.ts"],
+  "sourcesContent": [
+    "import type { MembershipOperation, MembershipPolicyDefinition } from \"./types\"\n\nexport interface MembershipOperationScope {\n  readonly policyIds: readonly string[]\n  readonly groupIds: ReadonlySet<string>\n}\n\nexport interface MembershipPolicyScope {\n  readonly policyIds: readonly string[]\n  readonly operations: Readonly<Record<MembershipOperation, MembershipOperationScope>>\n}\n\nconst MEMBERSHIP_OPERATIONS = [\"invite\", \"assignGroups\", \"suspend\", \"serviceAccounts\"] as const\n\nexport function resolveMembershipPolicyScope(input: {\n  readonly membershipPolicies: readonly MembershipPolicyDefinition[]\n  readonly callerGroupIds: readonly string[]\n}): MembershipPolicyScope {\n  const callerGroups = new Set(input.callerGroupIds)\n  const policyIds: string[] = []\n  const operations = createEmptyOperationScopes()\n\n  for (const policy of input.membershipPolicies) {\n    if (!policy.grantedToGroupIds.some((groupId) => callerGroups.has(groupId))) {\n      continue\n    }\n\n    policyIds.push(policy.id)\n    for (const operation of policy.can) {\n      operations[operation].policyIds.push(policy.id)\n      for (const groupId of policy.scopeGroupIds) {\n        operations[operation].groupIds.add(groupId)\n      }\n    }\n  }\n\n  return {\n    policyIds,\n    operations: {\n      invite: freezeOperationScope(operations.invite),\n      assignGroups: freezeOperationScope(operations.assignGroups),\n      suspend: freezeOperationScope(operations.suspend),\n      serviceAccounts: freezeOperationScope(operations.serviceAccounts),\n    },\n  }\n}\n\nexport function canPerformMembershipOperation(\n  scope: MembershipPolicyScope,\n  operation: MembershipOperation,\n  groupIds: readonly string[]\n): boolean {\n  const operationScope = scope.operations[operation]\n\n  if (operationScope.policyIds.length === 0) {\n    return false\n  }\n\n  if (groupIds.length === 0) {\n    return true\n  }\n\n  return groupIds.every((groupId) => operationScope.groupIds.has(groupId))\n}\n\nexport function missingMembershipGroupIds(\n  scope: MembershipPolicyScope,\n  operation: MembershipOperation,\n  groupIds: readonly string[]\n): readonly string[] {\n  if (groupIds.length === 0) {\n    return []\n  }\n\n  const operationScope = scope.operations[operation]\n  return groupIds.filter((groupId) => !operationScope.groupIds.has(groupId))\n}\n\nfunction createEmptyOperationScopes(): Record<\n  MembershipOperation,\n  { policyIds: string[]; groupIds: Set<string> }\n> {\n  return {\n    invite: { policyIds: [], groupIds: new Set<string>() },\n    assignGroups: { policyIds: [], groupIds: new Set<string>() },\n    suspend: { policyIds: [], groupIds: new Set<string>() },\n    serviceAccounts: { policyIds: [], groupIds: new Set<string>() },\n  }\n}\n\nfunction freezeOperationScope(input: {\n  readonly policyIds: readonly string[]\n  readonly groupIds: ReadonlySet<string>\n}): MembershipOperationScope {\n  return {\n    policyIds: [...input.policyIds],\n    groupIds: new Set(input.groupIds),\n  }\n}\n\nexport function isMembershipOperation(value: unknown): value is MembershipOperation {\n  return MEMBERSHIP_OPERATIONS.includes(value as MembershipOperation)\n}\n",
+    "import {\n  GRANT_KINDS,\n  type GrantUniverseKey,\n  grantKindOf,\n  isSingletonGrantKind,\n} from \"../authorization/grant-kinds\"\nimport { SecurityValidationError } from \"./errors\"\nimport { isMembershipOperation } from \"./membership-policies\"\nimport type {\n  GrantCapability,\n  GrantDefinition,\n  GroupDefinition,\n  MarkingDefinition,\n  MembershipPolicyDefinition,\n  RegisteredSecurityDefinitions,\n  RoleDefinition,\n  Selection,\n} from \"./types\"\n\n/** Registered id universes and singleton capabilities available to role grants. */\ntype RegisteredUniverses = Partial<Record<GrantUniverseKey, ReadonlySet<string>>> & {\n  readonly agentAvailable?: boolean\n}\n\n/**\n * Every grant capability, for validating grants that arrive from untyped code.\n *\n * Written as a total `Record<GrantCapability, true>` rather than a bare array so a capability added\n * to `GrantDefinition` is a compile error here — the same discipline `GRANT_KINDS` uses. The\n * hand-written `capability !== \"view\" && …` chain this replaces would have accepted the new\n * capability at startup and then died on `GRANT_KINDS[kind].universeKey`.\n */\nconst GRANT_CAPABILITIES = Object.keys({\n  view: true,\n  edit: true,\n  append: true,\n  apply: true,\n  share: true,\n  run: true,\n  observe: true,\n  manage: true,\n} satisfies Record<GrantCapability, true>) as readonly GrantCapability[]\n\n/** \"'a', 'b', or 'c'\" — the shape the security errors already use. */\nfunction formatAlternatives(values: readonly string[]): string {\n  const quoted = values.map((value) => `'${value}'`)\n  const last = quoted.at(-1)\n  return quoted.length < 2 ? (last ?? \"\") : `${quoted.slice(0, -1).join(\", \")}, or ${last}`\n}\n\nexport type CreateSecurityError = (message: string) => Error\n\n// Shared, single-source validation primitives. The builders reuse these too, so\n// authoring-time and startup-time checks can never drift apart.\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nexport function assertNonEmptyString(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is string {\n  if (typeof value !== \"string\" || value.trim().length === 0) {\n    throw createError(`[Sixb] ${field} must not be empty.`)\n  }\n}\n\nexport function assertOptionalString(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is string | undefined {\n  if (value === undefined) {\n    return\n  }\n\n  if (typeof value !== \"string\") {\n    throw createError(`[Sixb] ${field} must be a string.`)\n  }\n}\n\nfunction assertStringArray(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is readonly string[] {\n  if (!Array.isArray(value)) {\n    throw createError(`[Sixb] ${field} must be an array of group ids.`)\n  }\n\n  for (const item of value) {\n    assertNonEmptyString(item, `${field} item`, createError)\n  }\n}\n\nfunction assertMembershipOperationArray(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is MembershipPolicyDefinition[\"can\"] {\n  if (!Array.isArray(value)) {\n    throw createError(`[Sixb] ${field} must be an array of membership operations.`)\n  }\n\n  for (const item of value) {\n    if (!isMembershipOperation(item)) {\n      throw createError(\n        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`\n      )\n    }\n  }\n}\n\nfunction assertNoDuplicateIds(ids: readonly string[], field: string): void {\n  const seen = new Set<string>()\n  for (const id of ids) {\n    if (seen.has(id)) {\n      throw new SecurityValidationError(`[Sixb] ${field} contains duplicate group id '${id}'.`)\n    }\n    seen.add(id)\n  }\n}\n\nfunction assertNoDuplicateOperations(\n  operations: readonly MembershipPolicyDefinition[\"can\"][number][],\n  field: string\n): void {\n  const seen = new Set<string>()\n  for (const operation of operations) {\n    if (seen.has(operation)) {\n      throw new SecurityValidationError(\n        `[Sixb] ${field} contains duplicate operation '${operation}'.`\n      )\n    }\n    seen.add(operation)\n  }\n}\n\nexport function assertMarkingDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is MarkingDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Marking definition must be an object.\")\n  }\n\n  if (value.kind !== \"marking\") {\n    throw createError(\"[Sixb] Marking definition kind must be 'marking'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Marking id\", createError)\n  assertOptionalString(value.label, `Marking '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Marking '${value.id}' description`, createError)\n}\n\nexport function isMarkingDefinition(value: unknown): value is MarkingDefinition {\n  try {\n    assertMarkingDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertGroupDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is GroupDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Group definition must be an object.\")\n  }\n\n  if (value.kind !== \"group\") {\n    throw createError(\"[Sixb] Group definition kind must be 'group'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Group id\", createError)\n  assertOptionalString(value.label, `Group '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Group '${value.id}' description`, createError)\n}\n\nexport function isGroupDefinition(value: unknown): value is GroupDefinition {\n  try {\n    assertGroupDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertMembershipPolicyDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is MembershipPolicyDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Membership policy definition must be an object.\")\n  }\n\n  if (value.kind !== \"membershipPolicy\") {\n    throw createError(\"[Sixb] Membership policy definition kind must be 'membershipPolicy'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Membership policy id\", createError)\n  assertStringArray(\n    value.grantedToGroupIds,\n    `Membership policy '${value.id}' grantedTo`,\n    createError\n  )\n  assertStringArray(value.scopeGroupIds, `Membership policy '${value.id}' scope`, createError)\n  assertMembershipOperationArray(value.can, `Membership policy '${value.id}' can`, createError)\n}\n\nexport function isMembershipPolicyDefinition(value: unknown): value is MembershipPolicyDefinition {\n  try {\n    assertMembershipPolicyDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertGrantDefinition(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is GrantDefinition {\n  if (!isRecord(value) || value.kind !== \"grant\") {\n    throw createError(`[Sixb] ${field} must contain only grant definitions from 'can'.`)\n  }\n\n  if (!GRANT_CAPABILITIES.includes(value.capability as GrantCapability)) {\n    throw createError(\n      `[Sixb] ${field} grant capability must be ${formatAlternatives(GRANT_CAPABILITIES)}.`\n    )\n  }\n\n  if (value.capability === \"view\" && value.target !== \"object\" && value.target !== \"dataset\") {\n    throw createError(`[Sixb] ${field} view grant target must be 'object' or 'dataset'.`)\n  }\n\n  if (\n    value.capability === \"run\" &&\n    value.target !== \"workflow\" &&\n    value.target !== \"sync\" &&\n    value.target !== \"pipeline\" &&\n    value.target !== \"agent\"\n  ) {\n    throw createError(\n      `[Sixb] ${field} run grant target must be 'workflow', 'sync', 'pipeline', or 'agent'.`\n    )\n  }\n\n  if (\n    value.capability === \"observe\" &&\n    value.target !== \"logs\" &&\n    value.target !== \"aiUsage\" &&\n    value.target !== \"activity\"\n  ) {\n    throw createError(\n      `[Sixb] ${field} observe grant target must be 'logs', 'aiUsage', or 'activity'.`\n    )\n  }\n\n  if (value.capability === \"manage\" && value.target !== \"connector\" && value.target !== \"aiUsage\") {\n    throw createError(`[Sixb] ${field} manage grant target must be 'connector' or 'aiUsage'.`)\n  }\n\n  // The agent, logs, AI usage and activity are one surface each, so their grants select nothing.\n  // The checks above settled the capability and target, so the kind is known.\n  if (isSingletonGrantKind(grantKindOf(value as unknown as GrantDefinition))) {\n    if (value.selection !== undefined) {\n      throw createError(\n        `[Sixb] ${field} ${value.capability} grant on '${value.target}' must not declare a selection.`\n      )\n    }\n    return\n  }\n\n  assertSelection(value.selection, field, createError)\n}\n\nfunction assertSelection(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is Selection {\n  if (!isRecord(value) || typeof value.all !== \"boolean\") {\n    throw createError(`[Sixb] ${field} grant must carry a selection from 'can' or a scope.`)\n  }\n\n  const ids = value.all ? value.except : value.ids\n  if (!Array.isArray(ids)) {\n    throw createError(`[Sixb] ${field} grant selection must list ids.`)\n  }\n\n  for (const id of ids) {\n    assertNonEmptyString(id, `${field} grant selection id`, createError)\n  }\n}\n\nexport function assertRoleDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is RoleDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Role definition must be an object.\")\n  }\n\n  if (value.kind !== \"role\") {\n    throw createError(\"[Sixb] Role definition kind must be 'role'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Role id\", createError)\n  assertOptionalString(value.label, `Role '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Role '${value.id}' description`, createError)\n  assertStringArray(value.grantedToGroupIds, `Role '${value.id}' grantedTo`, createError)\n\n  if (!Array.isArray(value.grants)) {\n    throw createError(`[Sixb] Role '${value.id}' grants must be an array.`)\n  }\n\n  for (const grant of value.grants) {\n    assertGrantDefinition(grant, `Role '${value.id}' grants`, createError)\n  }\n\n  if (value.clearances !== undefined) {\n    assertStringArray(value.clearances, `Role '${value.id}' clearances`, createError)\n  }\n}\n\nexport function isRoleDefinition(value: unknown): value is RoleDefinition {\n  try {\n    assertRoleDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function validateSecurityDefinitionsAtStartup(input: {\n  readonly markings?: readonly MarkingDefinition[]\n  readonly groups: readonly GroupDefinition[]\n  readonly membershipPolicies: readonly MembershipPolicyDefinition[]\n  readonly roles?: readonly RoleDefinition[]\n  /** Registered object type ids — when provided, view grants must reference them. */\n  readonly objectTypeIds?: ReadonlySet<string>\n  /** Registered dataset ids — when provided, dataset view grants must reference them. */\n  readonly datasetIds?: ReadonlySet<string>\n  /** Registered action ids — when provided, apply grants must reference them. */\n  readonly actionIds?: ReadonlySet<string>\n  /** Registered workflow ids — when provided, run grants must reference them. */\n  readonly workflowIds?: ReadonlySet<string>\n  /** Registered sync ids — when provided, sync run grants must reference them. */\n  readonly syncIds?: ReadonlySet<string>\n  /** Registered pipeline ids — when provided, pipeline run grants must reference them. */\n  readonly pipelineIds?: ReadonlySet<string>\n  /** Whether the project's single conversational Agent is configured. */\n  readonly agentAvailable?: boolean\n  /** Registered connector ids — when provided, manage grants must reference them. */\n  readonly connectorIds?: ReadonlySet<string>\n  /** Registered Share ids — when provided, share grants must reference them. */\n  readonly shareIds?: ReadonlySet<string>\n}): RegisteredSecurityDefinitions {\n  const markingsById = new Map<string, MarkingDefinition>()\n  const groupsById = new Map<string, GroupDefinition>()\n  const rolesById = new Map<string, RoleDefinition>()\n  const membershipPoliciesById = new Map<string, MembershipPolicyDefinition>()\n\n  for (const marking of input.markings ?? []) {\n    assertMarkingDefinition(marking)\n\n    if (markingsById.has(marking.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate marking id: ${marking.id}`)\n    }\n\n    markingsById.set(marking.id, marking)\n  }\n\n  for (const group of input.groups) {\n    assertGroupDefinition(group)\n\n    if (groupsById.has(group.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate group id: ${group.id}`)\n    }\n\n    groupsById.set(group.id, group)\n  }\n\n  for (const role of input.roles ?? []) {\n    assertRoleDefinition(role)\n\n    if (rolesById.has(role.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate role id: ${role.id}`)\n    }\n\n    if (role.grantedToGroupIds.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${role.id}' must be granted to at least one group.`\n      )\n    }\n\n    const clearances = role.clearances ?? []\n    if (role.grants.length === 0 && clearances.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${role.id}' must declare at least one grant or clearance.`\n      )\n    }\n\n    assertNoDuplicateIds(role.grantedToGroupIds, `Role '${role.id}' grantedTo`)\n    assertNoDuplicateIds(clearances, `Role '${role.id}' clearances`)\n\n    for (const markingId of clearances) {\n      if (!markingsById.has(markingId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Role '${role.id}' clearances reference unknown marking '${markingId}'. Add it to 'security/markings/' or pass it to createSixb({ markings }).`\n        )\n      }\n    }\n\n    for (const groupId of role.grantedToGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Role '${role.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    for (const grant of role.grants) {\n      assertGrantReferences(role.id, grant, input)\n    }\n\n    rolesById.set(role.id, role)\n  }\n\n  for (const policy of input.membershipPolicies) {\n    assertMembershipPolicyDefinition(policy)\n\n    if (membershipPoliciesById.has(policy.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate membership policy id: ${policy.id}`)\n    }\n\n    if (policy.grantedToGroupIds.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Membership policy '${policy.id}' must grant membership authority to at least one group.`\n      )\n    }\n\n    if (policy.can.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Membership policy '${policy.id}' must declare at least one operation.`\n      )\n    }\n\n    assertNoDuplicateIds(policy.grantedToGroupIds, `Membership policy '${policy.id}' grantedTo`)\n    assertNoDuplicateIds(policy.scopeGroupIds, `Membership policy '${policy.id}' scope`)\n    assertNoDuplicateOperations(policy.can, `Membership policy '${policy.id}' can`)\n\n    for (const groupId of policy.grantedToGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Membership policy '${policy.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    for (const groupId of policy.scopeGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Membership policy '${policy.id}' scope references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    membershipPoliciesById.set(policy.id, policy)\n  }\n\n  return {\n    markings: [...markingsById.values()],\n    markingsById,\n    groups: [...groupsById.values()],\n    groupsById,\n    roles: [...rolesById.values()],\n    rolesById,\n    membershipPolicies: [...membershipPoliciesById.values()],\n    membershipPoliciesById,\n  }\n}\n\nfunction assertGrantReferences(\n  roleId: string,\n  grant: GrantDefinition,\n  registered: RegisteredUniverses\n): void {\n  if (grant.capability === \"run\" && grant.target === \"agent\") {\n    const spec = GRANT_KINDS[grantKindOf(grant)]\n    if (!registered.agentAvailable) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${roleId}' grants ${grant.capability} on the project Agent, but it is unavailable. ${spec.fix}`\n      )\n    }\n    return\n  }\n  // Logs and AI usage are always there; only targeted grants name ids to check.\n  if (!(\"selection\" in grant)) return\n  const kind = grantKindOf(grant)\n  if (isSingletonGrantKind(kind)) return\n  const spec = GRANT_KINDS[kind]\n  const universe = registered[spec.universeKey]\n\n  if (!universe) {\n    return\n  }\n\n  // Explicit selections list ids to include; \"all except\" selections list ids\n  // to exclude. Either way every named id must be registered — an unknown id is\n  // a typo that would silently widen or no-op the grant.\n  const ids = grant.selection.all ? grant.selection.except : grant.selection.ids\n\n  for (const id of ids) {\n    if (!universe.has(id)) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${roleId}' grants ${grant.capability} on unknown ${spec.subject} '${id}'. ${spec.fix}`\n      )\n    }\n  }\n}\n",
+    "import { SecurityValidationError } from \"./errors\"\nimport type {\n  GrantDefinition,\n  GroupDefinition,\n  MarkingDefinition,\n  MembershipOperation,\n  MembershipPolicyDefinition,\n  RoleDefinition,\n} from \"./types\"\nimport {\n  assertGrantDefinition,\n  assertNonEmptyString,\n  assertOptionalString,\n  isRecord,\n} from \"./validation\"\n\nexport interface DefineGroupOptions {\n  readonly label?: string\n  readonly description?: string\n}\n\nexport interface DefineMarkingOptions {\n  readonly label?: string\n  readonly description?: string\n}\n\nexport interface DefineRoleOptions {\n  readonly label?: string\n  readonly description?: string\n  readonly grantedTo: readonly GroupDefinition[]\n  readonly grants?: readonly GrantDefinition[]\n  /** Markings this role's members may read. */\n  readonly clearances?: readonly MarkingDefinition[]\n}\n\nexport interface DefineMembershipPolicyOptions {\n  readonly grantedTo: readonly GroupDefinition[]\n  readonly scope: readonly GroupDefinition[]\n  readonly can: readonly MembershipOperation[]\n}\n\nconst MEMBERSHIP_OPERATIONS = new Set<MembershipOperation>([\n  \"invite\",\n  \"assignGroups\",\n  \"suspend\",\n  \"serviceAccounts\",\n])\n\nfunction assertNonEmptyArray<T>(value: readonly T[], field: string): void {\n  if (value.length === 0) {\n    throw new SecurityValidationError(`[Sixb] ${field} must not be empty.`)\n  }\n}\n\nfunction groupIdsFrom(groups: readonly GroupDefinition[], field: string): readonly string[] {\n  return groups.map((group) => {\n    if (!isRecord(group) || group.kind !== \"group\") {\n      throw new SecurityValidationError(`[Sixb] ${field} must contain only group definitions.`)\n    }\n\n    assertNonEmptyString(group.id, `${field} group id`)\n    return group.id\n  })\n}\n\nfunction membershipOperationsFrom(\n  operations: readonly MembershipOperation[],\n  field: string\n): readonly MembershipOperation[] {\n  return operations.map((operation) => {\n    if (!MEMBERSHIP_OPERATIONS.has(operation)) {\n      throw new SecurityValidationError(\n        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`\n      )\n    }\n\n    return operation\n  })\n}\n\nexport function defineGroup<const TId extends string>(\n  id: TId,\n  options: DefineGroupOptions = {}\n): GroupDefinition<TId> {\n  assertNonEmptyString(id, \"Group id\")\n  assertOptionalString(options.label, `Group '${id}' label`)\n  assertOptionalString(options.description, `Group '${id}' description`)\n\n  return {\n    kind: \"group\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n  }\n}\n\n/** Read the ids of marking definitions, rejecting anything else such as a bare id. */\nexport function markingIdsFrom(\n  markings: readonly MarkingDefinition[],\n  field: string\n): readonly string[] {\n  return markings.map((marking) => {\n    if (!isRecord(marking) || marking.kind !== \"marking\") {\n      throw new SecurityValidationError(`[Sixb] ${field} must contain only marking definitions.`)\n    }\n\n    assertNonEmptyString(marking.id, `${field} marking id`)\n    return marking.id\n  })\n}\n\nexport function defineMarking<const TId extends string>(\n  id: TId,\n  options: DefineMarkingOptions = {}\n): MarkingDefinition<TId> {\n  assertNonEmptyString(id, \"Marking id\")\n  assertOptionalString(options.label, `Marking '${id}' label`)\n  assertOptionalString(options.description, `Marking '${id}' description`)\n\n  return {\n    kind: \"marking\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n  }\n}\n\nexport function defineRole<const TId extends string>(\n  id: TId,\n  options: DefineRoleOptions\n): RoleDefinition<TId> {\n  assertNonEmptyString(id, \"Role id\")\n  assertOptionalString(options.label, `Role '${id}' label`)\n  assertOptionalString(options.description, `Role '${id}' description`)\n  assertNonEmptyArray(options.grantedTo, `Role '${id}' grantedTo`)\n\n  const grantedToGroupIds = groupIdsFrom(options.grantedTo, `Role '${id}' grantedTo`)\n  const grants = options.grants ?? []\n  const clearances = markingIdsFrom(options.clearances ?? [], `Role '${id}' clearances`)\n\n  for (const grant of grants) {\n    assertGrantDefinition(grant, `Role '${id}' grants`)\n  }\n\n  if (grants.length === 0 && clearances.length === 0) {\n    throw new SecurityValidationError(\n      `[Sixb] Role '${id}' must declare at least one grant or clearance.`\n    )\n  }\n\n  return {\n    kind: \"role\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n    grantedToGroupIds,\n    grants,\n    ...(clearances.length > 0 ? { clearances } : {}),\n  }\n}\n\nexport function defineMembershipPolicy<const TId extends string>(\n  id: TId,\n  options: DefineMembershipPolicyOptions\n): MembershipPolicyDefinition<TId> {\n  assertNonEmptyString(id, \"Membership policy id\")\n  assertNonEmptyArray(options.grantedTo, `Membership policy '${id}' grantedTo`)\n  assertNonEmptyArray(options.can, `Membership policy '${id}' can`)\n\n  return {\n    kind: \"membershipPolicy\",\n    id,\n    grantedToGroupIds: groupIdsFrom(options.grantedTo, `Membership policy '${id}' grantedTo`),\n    scopeGroupIds: groupIdsFrom(options.scope, `Membership policy '${id}' scope`),\n    can: membershipOperationsFrom(options.can, `Membership policy '${id}' can`),\n  }\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;AAYA,IAAM,wBAAwB,CAAC,UAAU,gBAAgB,WAAW,iBAAiB;AAE9E,SAAS,4BAA4B,CAAC,OAGnB;AAAA,EACxB,MAAM,eAAe,IAAI,IAAI,MAAM,cAAc;AAAA,EACjD,MAAM,YAAsB,CAAC;AAAA,EAC7B,MAAM,aAAa,2BAA2B;AAAA,EAE9C,WAAW,UAAU,MAAM,oBAAoB;AAAA,IAC7C,IAAI,CAAC,OAAO,kBAAkB,KAAK,CAAC,YAAY,aAAa,IAAI,OAAO,CAAC,GAAG;AAAA,MAC1E;AAAA,IACF;AAAA,IAEA,UAAU,KAAK,OAAO,EAAE;AAAA,IACxB,WAAW,aAAa,OAAO,KAAK;AAAA,MAClC,WAAW,WAAW,UAAU,KAAK,OAAO,EAAE;AAAA,MAC9C,WAAW,WAAW,OAAO,eAAe;AAAA,QAC1C,WAAW,WAAW,SAAS,IAAI,OAAO;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,YAAY;AAAA,MACV,QAAQ,qBAAqB,WAAW,MAAM;AAAA,MAC9C,cAAc,qBAAqB,WAAW,YAAY;AAAA,MAC1D,SAAS,qBAAqB,WAAW,OAAO;AAAA,MAChD,iBAAiB,qBAAqB,WAAW,eAAe;AAAA,IAClE;AAAA,EACF;AAAA;AAGK,SAAS,6BAA6B,CAC3C,OACA,WACA,UACS;AAAA,EACT,MAAM,iBAAiB,MAAM,WAAW;AAAA,EAExC,IAAI,eAAe,UAAU,WAAW,GAAG;AAAA,IACzC,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,SAAS,MAAM,CAAC,YAAY,eAAe,SAAS,IAAI,OAAO,CAAC;AAAA;AAGlE,SAAS,yBAAyB,CACvC,OACA,WACA,UACmB;AAAA,EACnB,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,OAAO,CAAC;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,MAAM,WAAW;AAAA,EACxC,OAAO,SAAS,OAAO,CAAC,YAAY,CAAC,eAAe,SAAS,IAAI,OAAO,CAAC;AAAA;AAG3E,SAAS,0BAA0B,GAGjC;AAAA,EACA,OAAO;AAAA,IACL,QAAQ,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IACrD,cAAc,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IAC3D,SAAS,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IACtD,iBAAiB,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,EAChE;AAAA;AAGF,SAAS,oBAAoB,CAAC,OAGD;AAAA,EAC3B,OAAO;AAAA,IACL,WAAW,CAAC,GAAG,MAAM,SAAS;AAAA,IAC9B,UAAU,IAAI,IAAI,MAAM,QAAQ;AAAA,EAClC;AAAA;AAGK,SAAS,qBAAqB,CAAC,OAA8C;AAAA,EAClF,OAAO,sBAAsB,SAAS,KAA4B;AAAA;;;ACrEpE,IAAM,qBAAqB,OAAO,KAAK;AAAA,EACrC,MAAM;AAAA,EACN,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AAAA,EACP,KAAK;AAAA,EACL,SAAS;AAAA,EACT,QAAQ;AACV,CAAyC;AAGzC,SAAS,kBAAkB,CAAC,QAAmC;AAAA,EAC7D,MAAM,SAAS,OAAO,IAAI,CAAC,UAAU,IAAI,QAAQ;AAAA,EACjD,MAAM,OAAO,OAAO,GAAG,EAAE;AAAA,EACzB,OAAO,OAAO,SAAS,IAAK,QAAQ,KAAM,GAAG,OAAO,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,SAAS;AAAA;AAO9E,SAAS,QAAQ,CAAC,OAAkD;AAAA,EACzE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA;AAGrE,SAAS,oBAAoB,CAClC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC1D;AAAA,EACzB,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAAA,IAC1D,MAAM,YAAY,UAAU,0BAA0B;AAAA,EACxD;AAAA;AAGK,SAAS,oBAAoB,CAClC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC9C;AAAA,EACrC,IAAI,UAAU,WAAW;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,MAAM,YAAY,UAAU,yBAAyB;AAAA,EACvD;AAAA;AAGF,SAAS,iBAAiB,CACxB,OACA,OACA,aACoC;AAAA,EACpC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzB,MAAM,YAAY,UAAU,sCAAsC;AAAA,EACpE;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,qBAAqB,MAAM,GAAG,cAAc,WAAW;AAAA,EACzD;AAAA;AAGF,SAAS,8BAA8B,CACrC,OACA,OACA,aACoD;AAAA,EACpD,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzB,MAAM,YAAY,UAAU,kDAAkD;AAAA,EAChF;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,CAAC,sBAAsB,IAAI,GAAG;AAAA,MAChC,MAAM,YACJ,UAAU,gGACZ;AAAA,IACF;AAAA,EACF;AAAA;AAGF,SAAS,oBAAoB,CAAC,KAAwB,OAAqB;AAAA,EACzE,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,KAAK,IAAI,EAAE,GAAG;AAAA,MAChB,MAAM,IAAI,yBAAwB,UAAU,sCAAsC,MAAM;AAAA,IAC1F;AAAA,IACA,KAAK,IAAI,EAAE;AAAA,EACb;AAAA;AAGF,SAAS,2BAA2B,CAClC,YACA,OACM;AAAA,EACN,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,aAAa,YAAY;AAAA,IAClC,IAAI,KAAK,IAAI,SAAS,GAAG;AAAA,MACvB,MAAM,IAAI,yBACR,UAAU,uCAAuC,aACnD;AAAA,IACF;AAAA,IACA,KAAK,IAAI,SAAS;AAAA,EACpB;AAAA;AAGK,SAAS,uBAAuB,CACrC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC/C;AAAA,EACpC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,8CAA8C;AAAA,EAClE;AAAA,EAEA,IAAI,MAAM,SAAS,WAAW;AAAA,IAC5B,MAAM,YAAY,mDAAmD;AAAA,EACvE;AAAA,EAEA,qBAAqB,MAAM,IAAI,cAAc,WAAW;AAAA,EACxD,qBAAqB,MAAM,OAAO,YAAY,MAAM,aAAa,WAAW;AAAA,EAC5E,qBAAqB,MAAM,aAAa,YAAY,MAAM,mBAAmB,WAAW;AAAA;AAGnF,SAAS,mBAAmB,CAAC,OAA4C;AAAA,EAC9E,IAAI;AAAA,IACF,wBAAwB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC9D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,qBAAqB,CACnC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACjD;AAAA,EAClC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,4CAA4C;AAAA,EAChE;AAAA,EAEA,IAAI,MAAM,SAAS,SAAS;AAAA,IAC1B,MAAM,YAAY,+CAA+C;AAAA,EACnE;AAAA,EAEA,qBAAqB,MAAM,IAAI,YAAY,WAAW;AAAA,EACtD,qBAAqB,MAAM,OAAO,UAAU,MAAM,aAAa,WAAW;AAAA,EAC1E,qBAAqB,MAAM,aAAa,UAAU,MAAM,mBAAmB,WAAW;AAAA;AAGjF,SAAS,iBAAiB,CAAC,OAA0C;AAAA,EAC1E,IAAI;AAAA,IACF,sBAAsB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC5D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,gCAAgC,CAC9C,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACtC;AAAA,EAC7C,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,wDAAwD;AAAA,EAC5E;AAAA,EAEA,IAAI,MAAM,SAAS,oBAAoB;AAAA,IACrC,MAAM,YAAY,sEAAsE;AAAA,EAC1F;AAAA,EAEA,qBAAqB,MAAM,IAAI,wBAAwB,WAAW;AAAA,EAClE,kBACE,MAAM,mBACN,sBAAsB,MAAM,iBAC5B,WACF;AAAA,EACA,kBAAkB,MAAM,eAAe,sBAAsB,MAAM,aAAa,WAAW;AAAA,EAC3F,+BAA+B,MAAM,KAAK,sBAAsB,MAAM,WAAW,WAAW;AAAA;AAGvF,SAAS,4BAA4B,CAAC,OAAqD;AAAA,EAChG,IAAI;AAAA,IACF,iCAAiC,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IACvE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,qBAAqB,CACnC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACjD;AAAA,EAClC,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS;AAAA,IAC9C,MAAM,YAAY,UAAU,uDAAuD;AAAA,EACrF;AAAA,EAEA,IAAI,CAAC,mBAAmB,SAAS,MAAM,UAA6B,GAAG;AAAA,IACrE,MAAM,YACJ,UAAU,kCAAkC,mBAAmB,kBAAkB,IACnF;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,eAAe,UAAU,MAAM,WAAW,YAAY,MAAM,WAAW,WAAW;AAAA,IAC1F,MAAM,YAAY,UAAU,wDAAwD;AAAA,EACtF;AAAA,EAEA,IACE,MAAM,eAAe,SACrB,MAAM,WAAW,cACjB,MAAM,WAAW,UACjB,MAAM,WAAW,cACjB,MAAM,WAAW,SACjB;AAAA,IACA,MAAM,YACJ,UAAU,4EACZ;AAAA,EACF;AAAA,EAEA,IACE,MAAM,eAAe,aACrB,MAAM,WAAW,UACjB,MAAM,WAAW,aACjB,MAAM,WAAW,YACjB;AAAA,IACA,MAAM,YACJ,UAAU,sEACZ;AAAA,EACF;AAAA,EAEA,IAAI,MAAM,eAAe,YAAY,MAAM,WAAW,eAAe,MAAM,WAAW,WAAW;AAAA,IAC/F,MAAM,YAAY,UAAU,6DAA6D;AAAA,EAC3F;AAAA,EAIA,IAAI,qBAAqB,YAAY,KAAmC,CAAC,GAAG;AAAA,IAC1E,IAAI,MAAM,cAAc,WAAW;AAAA,MACjC,MAAM,YACJ,UAAU,SAAS,MAAM,wBAAwB,MAAM,uCACzD;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,gBAAgB,MAAM,WAAW,OAAO,WAAW;AAAA;AAGrD,SAAS,eAAe,CACtB,OACA,OACA,aAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,KAAK,KAAK,OAAO,MAAM,QAAQ,WAAW;AAAA,IACtD,MAAM,YAAY,UAAU,2DAA2D;AAAA,EACzF;AAAA,EAEA,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,MAAM;AAAA,EAC7C,IAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AAAA,IACvB,MAAM,YAAY,UAAU,sCAAsC;AAAA,EACpE;AAAA,EAEA,WAAW,MAAM,KAAK;AAAA,IACpB,qBAAqB,IAAI,GAAG,4BAA4B,WAAW;AAAA,EACrE;AAAA;AAGK,SAAS,oBAAoB,CAClC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAClD;AAAA,EACjC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,2CAA2C;AAAA,EAC/D;AAAA,EAEA,IAAI,MAAM,SAAS,QAAQ;AAAA,IACzB,MAAM,YAAY,6CAA6C;AAAA,EACjE;AAAA,EAEA,qBAAqB,MAAM,IAAI,WAAW,WAAW;AAAA,EACrD,qBAAqB,MAAM,OAAO,SAAS,MAAM,aAAa,WAAW;AAAA,EACzE,qBAAqB,MAAM,aAAa,SAAS,MAAM,mBAAmB,WAAW;AAAA,EACrF,kBAAkB,MAAM,mBAAmB,SAAS,MAAM,iBAAiB,WAAW;AAAA,EAEtF,IAAI,CAAC,MAAM,QAAQ,MAAM,MAAM,GAAG;AAAA,IAChC,MAAM,YAAY,gBAAgB,MAAM,8BAA8B;AAAA,EACxE;AAAA,EAEA,WAAW,SAAS,MAAM,QAAQ;AAAA,IAChC,sBAAsB,OAAO,SAAS,MAAM,cAAc,WAAW;AAAA,EACvE;AAAA,EAEA,IAAI,MAAM,eAAe,WAAW;AAAA,IAClC,kBAAkB,MAAM,YAAY,SAAS,MAAM,kBAAkB,WAAW;AAAA,EAClF;AAAA;AAGK,SAAS,gBAAgB,CAAC,OAAyC;AAAA,EACxE,IAAI;AAAA,IACF,qBAAqB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC3D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,oCAAoC,CAAC,OAuBnB;AAAA,EAChC,MAAM,eAAe,IAAI;AAAA,EACzB,MAAM,aAAa,IAAI;AAAA,EACvB,MAAM,YAAY,IAAI;AAAA,EACtB,MAAM,yBAAyB,IAAI;AAAA,EAEnC,WAAW,WAAW,MAAM,YAAY,CAAC,GAAG;AAAA,IAC1C,wBAAwB,OAAO;AAAA,IAE/B,IAAI,aAAa,IAAI,QAAQ,EAAE,GAAG;AAAA,MAChC,MAAM,IAAI,yBAAwB,gCAAgC,QAAQ,IAAI;AAAA,IAChF;AAAA,IAEA,aAAa,IAAI,QAAQ,IAAI,OAAO;AAAA,EACtC;AAAA,EAEA,WAAW,SAAS,MAAM,QAAQ;AAAA,IAChC,sBAAsB,KAAK;AAAA,IAE3B,IAAI,WAAW,IAAI,MAAM,EAAE,GAAG;AAAA,MAC5B,MAAM,IAAI,yBAAwB,8BAA8B,MAAM,IAAI;AAAA,IAC5E;AAAA,IAEA,WAAW,IAAI,MAAM,IAAI,KAAK;AAAA,EAChC;AAAA,EAEA,WAAW,QAAQ,MAAM,SAAS,CAAC,GAAG;AAAA,IACpC,qBAAqB,IAAI;AAAA,IAEzB,IAAI,UAAU,IAAI,KAAK,EAAE,GAAG;AAAA,MAC1B,MAAM,IAAI,yBAAwB,6BAA6B,KAAK,IAAI;AAAA,IAC1E;AAAA,IAEA,IAAI,KAAK,kBAAkB,WAAW,GAAG;AAAA,MACvC,MAAM,IAAI,yBACR,gBAAgB,KAAK,4CACvB;AAAA,IACF;AAAA,IAEA,MAAM,aAAa,KAAK,cAAc,CAAC;AAAA,IACvC,IAAI,KAAK,OAAO,WAAW,KAAK,WAAW,WAAW,GAAG;AAAA,MACvD,MAAM,IAAI,yBACR,gBAAgB,KAAK,mDACvB;AAAA,IACF;AAAA,IAEA,qBAAqB,KAAK,mBAAmB,SAAS,KAAK,eAAe;AAAA,IAC1E,qBAAqB,YAAY,SAAS,KAAK,gBAAgB;AAAA,IAE/D,WAAW,aAAa,YAAY;AAAA,MAClC,IAAI,CAAC,aAAa,IAAI,SAAS,GAAG;AAAA,QAChC,MAAM,IAAI,yBACR,gBAAgB,KAAK,6CAA6C,oFACpE;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,WAAW,KAAK,mBAAmB;AAAA,MAC5C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,gBAAgB,KAAK,2CAA2C,8EAClE;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,SAAS,KAAK,QAAQ;AAAA,MAC/B,sBAAsB,KAAK,IAAI,OAAO,KAAK;AAAA,IAC7C;AAAA,IAEA,UAAU,IAAI,KAAK,IAAI,IAAI;AAAA,EAC7B;AAAA,EAEA,WAAW,UAAU,MAAM,oBAAoB;AAAA,IAC7C,iCAAiC,MAAM;AAAA,IAEvC,IAAI,uBAAuB,IAAI,OAAO,EAAE,GAAG;AAAA,MACzC,MAAM,IAAI,yBAAwB,0CAA0C,OAAO,IAAI;AAAA,IACzF;AAAA,IAEA,IAAI,OAAO,kBAAkB,WAAW,GAAG;AAAA,MACzC,MAAM,IAAI,yBACR,6BAA6B,OAAO,4DACtC;AAAA,IACF;AAAA,IAEA,IAAI,OAAO,IAAI,WAAW,GAAG;AAAA,MAC3B,MAAM,IAAI,yBACR,6BAA6B,OAAO,0CACtC;AAAA,IACF;AAAA,IAEA,qBAAqB,OAAO,mBAAmB,sBAAsB,OAAO,eAAe;AAAA,IAC3F,qBAAqB,OAAO,eAAe,sBAAsB,OAAO,WAAW;AAAA,IACnF,4BAA4B,OAAO,KAAK,sBAAsB,OAAO,SAAS;AAAA,IAE9E,WAAW,WAAW,OAAO,mBAAmB;AAAA,MAC9C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,6BAA6B,OAAO,2CAA2C,8EACjF;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,WAAW,OAAO,eAAe;AAAA,MAC1C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,6BAA6B,OAAO,uCAAuC,8EAC7E;AAAA,MACF;AAAA,IACF;AAAA,IAEA,uBAAuB,IAAI,OAAO,IAAI,MAAM;AAAA,EAC9C;AAAA,EAEA,OAAO;AAAA,IACL,UAAU,CAAC,GAAG,aAAa,OAAO,CAAC;AAAA,IACnC;AAAA,IACA,QAAQ,CAAC,GAAG,WAAW,OAAO,CAAC;AAAA,IAC/B;AAAA,IACA,OAAO,CAAC,GAAG,UAAU,OAAO,CAAC;AAAA,IAC7B;AAAA,IACA,oBAAoB,CAAC,GAAG,uBAAuB,OAAO,CAAC;AAAA,IACvD;AAAA,EACF;AAAA;AAGF,SAAS,qBAAqB,CAC5B,QACA,OACA,YACM;AAAA,EACN,IAAI,MAAM,eAAe,SAAS,MAAM,WAAW,SAAS;AAAA,IAC1D,MAAM,OAAO,YAAY,YAAY,KAAK;AAAA,IAC1C,IAAI,CAAC,WAAW,gBAAgB;AAAA,MAC9B,MAAM,IAAI,yBACR,gBAAgB,kBAAkB,MAAM,2DAA2D,KAAK,KAC1G;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,IAAI,EAAE,eAAe;AAAA,IAAQ;AAAA,EAC7B,MAAM,OAAO,YAAY,KAAK;AAAA,EAC9B,IAAI,qBAAqB,IAAI;AAAA,IAAG;AAAA,EAChC,MAAM,OAAO,YAAY;AAAA,EACzB,MAAM,WAAW,WAAW,KAAK;AAAA,EAEjC,IAAI,CAAC,UAAU;AAAA,IACb;AAAA,EACF;AAAA,EAKA,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM,UAAU,SAAS,MAAM,UAAU;AAAA,EAE3E,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,CAAC,SAAS,IAAI,EAAE,GAAG;AAAA,MACrB,MAAM,IAAI,yBACR,gBAAgB,kBAAkB,MAAM,yBAAyB,KAAK,YAAY,QAAQ,KAAK,KACjG;AAAA,IACF;AAAA,EACF;AAAA;;;ACpeF,IAAM,yBAAwB,IAAI,IAAyB;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,mBAAsB,CAAC,OAAqB,OAAqB;AAAA,EACxE,IAAI,MAAM,WAAW,GAAG;AAAA,IACtB,MAAM,IAAI,yBAAwB,UAAU,0BAA0B;AAAA,EACxE;AAAA;AAGF,SAAS,YAAY,CAAC,QAAoC,OAAkC;AAAA,EAC1F,OAAO,OAAO,IAAI,CAAC,UAAU;AAAA,IAC3B,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS;AAAA,MAC9C,MAAM,IAAI,yBAAwB,UAAU,4CAA4C;AAAA,IAC1F;AAAA,IAEA,qBAAqB,MAAM,IAAI,GAAG,gBAAgB;AAAA,IAClD,OAAO,MAAM;AAAA,GACd;AAAA;AAGH,SAAS,wBAAwB,CAC/B,YACA,OACgC;AAAA,EAChC,OAAO,WAAW,IAAI,CAAC,cAAc;AAAA,IACnC,IAAI,CAAC,uBAAsB,IAAI,SAAS,GAAG;AAAA,MACzC,MAAM,IAAI,yBACR,UAAU,gGACZ;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,GACR;AAAA;AAGI,SAAS,YAAqC,CACnD,IACA,UAA8B,CAAC,GACT;AAAA,EACtB,qBAAqB,IAAI,UAAU;AAAA,EACnC,qBAAqB,QAAQ,OAAO,UAAU,WAAW;AAAA,EACzD,qBAAqB,QAAQ,aAAa,UAAU,iBAAiB;AAAA,EAErE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EAClF;AAAA;AAIK,SAAS,cAAc,CAC5B,UACA,OACmB;AAAA,EACnB,OAAO,SAAS,IAAI,CAAC,YAAY;AAAA,IAC/B,IAAI,CAAC,SAAS,OAAO,KAAK,QAAQ,SAAS,WAAW;AAAA,MACpD,MAAM,IAAI,yBAAwB,UAAU,8CAA8C;AAAA,IAC5F;AAAA,IAEA,qBAAqB,QAAQ,IAAI,GAAG,kBAAkB;AAAA,IACtD,OAAO,QAAQ;AAAA,GAChB;AAAA;AAGI,SAAS,cAAuC,CACrD,IACA,UAAgC,CAAC,GACT;AAAA,EACxB,qBAAqB,IAAI,YAAY;AAAA,EACrC,qBAAqB,QAAQ,OAAO,YAAY,WAAW;AAAA,EAC3D,qBAAqB,QAAQ,aAAa,YAAY,iBAAiB;AAAA,EAEvE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EAClF;AAAA;AAGK,SAAS,WAAoC,CAClD,IACA,SACqB;AAAA,EACrB,qBAAqB,IAAI,SAAS;AAAA,EAClC,qBAAqB,QAAQ,OAAO,SAAS,WAAW;AAAA,EACxD,qBAAqB,QAAQ,aAAa,SAAS,iBAAiB;AAAA,EACpE,oBAAoB,QAAQ,WAAW,SAAS,eAAe;AAAA,EAE/D,MAAM,oBAAoB,aAAa,QAAQ,WAAW,SAAS,eAAe;AAAA,EAClF,MAAM,SAAS,QAAQ,UAAU,CAAC;AAAA,EAClC,MAAM,aAAa,eAAe,QAAQ,cAAc,CAAC,GAAG,SAAS,gBAAgB;AAAA,EAErF,WAAW,SAAS,QAAQ;AAAA,IAC1B,sBAAsB,OAAO,SAAS,YAAY;AAAA,EACpD;AAAA,EAEA,IAAI,OAAO,WAAW,KAAK,WAAW,WAAW,GAAG;AAAA,IAClD,MAAM,IAAI,yBACR,gBAAgB,mDAClB;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,IAChF;AAAA,IACA;AAAA,OACI,WAAW,SAAS,IAAI,EAAE,WAAW,IAAI,CAAC;AAAA,EAChD;AAAA;AAGK,SAAS,uBAAgD,CAC9D,IACA,SACiC;AAAA,EACjC,qBAAqB,IAAI,sBAAsB;AAAA,EAC/C,oBAAoB,QAAQ,WAAW,sBAAsB,eAAe;AAAA,EAC5E,oBAAoB,QAAQ,KAAK,sBAAsB,SAAS;AAAA,EAEhE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,mBAAmB,aAAa,QAAQ,WAAW,sBAAsB,eAAe;AAAA,IACxF,eAAe,aAAa,QAAQ,OAAO,sBAAsB,WAAW;AAAA,IAC5E,KAAK,yBAAyB,QAAQ,KAAK,sBAAsB,SAAS;AAAA,EAC5E;AAAA;",
+  "debugId": "88BF5C5FE7F574CA64756E2164756E21",
+  "names": []
+}