@sixb/core 0.1.19 → 0.1.21

package/dist/runtime/resolve-definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-definitions.d.ts","sourceRoot":"","sources":["../../src/runtime/resolve-definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAI3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAEtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,KAAK,cAAc,EAA0B,MAAM,UAAU,CAAA;AACtE,OAAO,EAAE,KAAK,kBAAkB,EAA8B,MAAM,cAAc,CAAA;AAClF,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,cAAc,EACnB,gBAAgB,EACjB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,KAAK,eAAe,EAA2B,MAAM,WAAW,CAAA;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAK9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,UAAU,iBAAiB;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAA;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAA;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;CACpE;AAED,UAAU,mBAAoB,SAAQ,eAAe;IACnD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;CACpC;AAED,mGAAmG;AACnG,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,GAAG,mBAAmB,CA+JlF"}
+{"version":3,"file":"resolve-definitions.d.ts","sourceRoot":"","sources":["../../src/runtime/resolve-definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAI3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAGxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAEtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,EAAE,KAAK,cAAc,EAA0B,MAAM,UAAU,CAAA;AACtE,OAAO,EAAE,KAAK,kBAAkB,EAA8B,MAAM,cAAc,CAAA;AAClF,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,cAAc,EACnB,gBAAgB,EACjB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,KAAK,eAAe,EAA2B,MAAM,WAAW,CAAA;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAK9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AAE7E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,UAAU,iBAAiB;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAA;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAA;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;CACpE;AAED,UAAU,mBAAoB,SAAQ,eAAe;IACnD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;CACpC;AAED,mGAAmG;AACnG,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,GAAG,mBAAmB,CAkKlF"}

package/dist/runtime/sixb.d.ts

@@ -1,6 +1,9 @@
 import { type ActionsRuntime } from "../actions/execution";
+import { type ActivityRuntime } from "../activity/execution";
+import type { ActivityService } from "../activity/service";
 import { type AgentRuntime } from "../agents/execution";
 import { type AiUsageRuntime } from "../ai-usage";
+import { type ArtifactsRuntime } from "../artifacts/execution";
 import { type BlobsRuntime } from "../blob-storage/execution";
 import type { BlobStorage } from "../blob-storage/types";
 import type { ConnectorConnectionProcess } from "../connectors/connections/contracts";
@@ -19,6 +22,7 @@ import { type ProjectionsRuntime } from "../projections/execution";
 import { type RulesRuntime } from "../rules/execution";
 import type { SandboxDefinition } from "../sandboxes/configuration";
 import { type SchedulesRuntime } from "../schedules/execution";
+import type { DatasetVersionMarkings } from "../security/dataset-version-markings";
 import { type SharesRuntime } from "../shares/execution";
 import { type SyncsRuntime } from "../syncs/execution";
 import { type WorkflowsRuntime } from "../workflows/execution";
@@ -36,10 +40,12 @@ export interface Sixb<TParams extends Record<string, unknown> = Record<string, u
     readonly projections: ProjectionsRuntime;
     readonly rules: RulesRuntime;
     readonly agent: AgentRuntime<TParams>;
+    readonly artifacts: ArtifactsRuntime;
     readonly models: ModelsRuntime;
     readonly aiUsage: AiUsageRuntime;
     readonly events: EventsRuntime;
     readonly logs: LogsRuntime;
+    readonly activity: ActivityRuntime;
     readonly schedules: SchedulesRuntime;
     readonly shares: SharesRuntime;
     readonly connector: ConnectorRuntime;
@@ -52,11 +58,13 @@ export interface SixbDependencies {
     };
     readonly definitions: SixbDefinitions;
     readonly logging: LoggingService;
+    readonly activity: ActivityService;
     readonly connectorService: ConnectorService;
     readonly connectorConnections?: ConnectorConnectionProcess;
     readonly blobStorage: BlobStorage;
     readonly apiPublicOrigin: () => string | undefined;
     readonly lakeStorage: LakeStorage;
+    readonly datasetVersionMarkings: DatasetVersionMarkings;
 }
 export declare function createBoundSixb<TParams extends Record<string, unknown> = Record<string, unknown>>(runtime: SixbRuntimeContext, dependencies: SixbDependencies, execution: ExecutionContext): Sixb<TParams>;
 /** Internal nominal guard for execution boundaries that accept a narrow structural host. */

package/dist/runtime/sixb.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sixb.d.ts","sourceRoot":"","sources":["../../src/runtime/sixb.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,sBAAsB,CAAA;AAChF,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,qBAAqB,CAAA;AAC3E,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,2BAA2B,CAAA;AACjF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAA;AAErF,OAAO,EAAE,KAAK,gBAAgB,EAA0B,MAAM,yBAAyB,CAAA;AACvF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACnF,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAGpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAChF,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACtF,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC5F,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACtF,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC7E,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAEpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAEjD,wFAAwF;AACxF,MAAM,WAAW,IAAI,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACrF,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;CAC7B;AAID,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;QACtC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAA;KACtC,CAAA;IACD,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAA;IAC3C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;IAC1D,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;CAClC;AAED,wBAAgB,eAAe,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/F,OAAO,EAAE,kBAAkB,EAC3B,YAAY,EAAE,gBAAgB,EAC9B,SAAS,EAAE,gBAAgB,GAC1B,IAAI,CAAC,OAAO,CAAC,CAsBf;AAED,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3F,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAExB"}
+{"version":3,"file":"sixb.d.ts","sourceRoot":"","sources":["../../src/runtime/sixb.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,sBAAsB,CAAA;AAChF,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,qBAAqB,CAAA;AAC3E,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,KAAK,gBAAgB,EAA0B,MAAM,wBAAwB,CAAA;AACtF,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,2BAA2B,CAAA;AACjF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAA;AAErF,OAAO,EAAE,KAAK,gBAAgB,EAA0B,MAAM,yBAAyB,CAAA;AACvF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACnF,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAGpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAChF,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACtF,OAAO,EAA4B,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC5F,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACtF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAA;AAClF,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC7E,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACtF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAEpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAEjD,wFAAwF;AACxF,MAAM,WAAW,IAAI,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACrF,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAA;IACxC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,CAAA;IACrC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;CAC7B;AAID,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAA;QACtC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAA;KACtC,CAAA;IACD,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAA;IACrC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAA;IAC3C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;IAC1D,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,CAAA;CACxD;AAED,wBAAgB,eAAe,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/F,OAAO,EAAE,kBAAkB,EAC3B,YAAY,EAAE,gBAAgB,EAC9B,SAAS,EAAE,gBAAgB,GAC1B,IAAI,CAAC,OAAO,CAAC,CAuBf;AAED,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3F,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAExB"}

package/dist/sandboxes/auth.d.ts

@@ -2,12 +2,28 @@ import type { SandboxSource } from "./configuration";
 import type { SandboxRequestCredential } from "./sandbox";
 /** Per-run source access. Never persist these grants or expose them to the guest. */
 export interface SandboxSourceCredentials {
+    /**
+     * Sixb opens these origins in the run's network, whether the recipe omits `network` or
+     * restricts it, so each must be one exact `https://` origin: a wildcard host is rejected. The
+     * network is set from the first grant of a session: return requests for the same origins on
+     * renewal.
+     */
     readonly requests: readonly SandboxRequestCredential[];
+    /**
+     * Guest-readable variables the integration needs in the sandbox, such as identities or the
+     * placeholder a tool requires before the host replaces its Authorization header. Never a
+     * credential: commands, files and snapshots can read these values.
+     *
+     * Applied from the first grant of a session; the recipe's own `env` wins on collision. Return
+     * the same values on renewal: renewals only rotate `requests`, so later values are ignored.
+     */
+    readonly env?: Readonly<Record<string, string>>;
     readonly expiresAt: Date;
     revoke(): Promise<void>;
 }
 /** Integration-owned authentication; grant source.access (read by default), or reject. */
 export interface SandboxSourceAuth {
+    /** A thrown error is reported to onError: it and its causes must never contain a credential. */
     authorize(input: {
         readonly source: SandboxSource;
         readonly signal: AbortSignal;

package/dist/sandboxes/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/sandboxes/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAEzD,qFAAqF;AACrF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,wBAAwB,EAAE,CAAA;IACtD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACxB;AAED,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,KAAK,EAAE;QACf,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;QAC9B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;KAC7B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACtC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/sandboxes/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAEzD,qFAAqF;AACrF,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,wBAAwB,EAAE,CAAA;IACtD;;;;;;;OAOG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/C,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACxB;AAED,0FAA0F;AAC1F,MAAM,WAAW,iBAAiB;IAChC,gGAAgG;IAChG,SAAS,CAAC,KAAK,EAAE;QACf,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;QAC9B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;KAC7B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACtC"}

package/dist/sandboxes/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/sandboxes/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAGxE,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,OAAO,SAAS,YAAY,EACxD,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,GAC9B,aAAa,CAAC,OAAO,CAAC,CA6BxB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/sandboxes/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,KAAK,aAAa,EAAuB,MAAM,iBAAiB,CAAA;AAGzE,mGAAmG;AACnG,wBAAgB,aAAa,CAAC,OAAO,SAAS,YAAY,EACxD,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,GAC9B,aAAa,CAAC,OAAO,CAAC,CAwBxB"}

package/dist/sandboxes/configuration.d.ts

@@ -36,6 +36,32 @@ export interface SandboxDefinition {
     readonly resolve: (context: SandboxResolveContext) => Promise<SandboxEnvironment>;
 }
 export declare function createSandboxDefinition<TParams extends ParamsConfig>(config: SandboxConfig<TParams>, ontology: OntologyRegistry): SandboxDefinition;
+/** What the source access rule reads: the provider's capability and one recipe's source. */
+interface SandboxCredentialRuleInput {
+    readonly supportsRequestCredentials?: boolean;
+    /** The factory's source auth; it applies to every recipe the factory resolves. */
+    readonly auth?: unknown;
+    readonly source?: SandboxSource;
+}
+/**
+ * Why a recipe cannot get the source access it declares, as a whole message, or undefined.
+ *
+ * Write access needs source auth. Source auth needs a provider that injects request credentials
+ * outside the sandbox, even for a recipe without a source: auth is the factory's, so startup and
+ * every run give the same answer. Source auth without a source is otherwise fine; that recipe
+ * does not use it.
+ */
+export declare function sandboxCredentialIssue(input: SandboxCredentialRuleInput): string | undefined;
+/** The static part of a recipe, captured: all a run without thread params can apply. */
+export declare function staticSandboxRecipe(configuration: {
+    readonly source?: unknown;
+    readonly setup?: unknown;
+    readonly env?: unknown;
+    readonly network?: unknown;
+}): SandboxEnvironment;
 /** Capture declarative data only; never retain caller-owned objects or include values in errors. */
 export declare function captureEnvironment(value: unknown): SandboxEnvironment;
+/** Snapshot guest-readable variables under the recipe `env` rules; never include values in errors. */
+export declare function captureSandboxEnv(value: unknown): Readonly<Record<string, string>>;
+export {};
 //# sourceMappingURL=configuration.d.ts.map

package/dist/sandboxes/configuration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../../src/sandboxes/configuration.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAE5D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAEvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAA;AAE/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAErD,sFAAsF;AACtF,MAAM,MAAM,kBAAkB,CAAC,OAAO,SAAS,YAAY,IAAI,MAAM,OAAO,SAAS,KAAK,GACtF,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GACrB,WAAW,CAAC,OAAO,CAAC,CAAA;AAExB,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACnC;AAED,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED,MAAM,WAAW,qBAAqB,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CACpB;AAKD,MAAM,WAAW,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,SAAS,YAAY,GAAG,YAAY,CAC/E,SAAQ,kBAAkB;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,CACjB,OAAO,EAAE,qBAAqB,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAC1D,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CACtD;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;CAClF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,SAAS,YAAY,EAClE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,QAAQ,EAAE,gBAAgB,GACzB,iBAAiB,CAqFnB;AAED,oGAAoG;AACpG,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAarE"}
+{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../../src/sandboxes/configuration.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAE5D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAEvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAA;AAE/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAA;AAErD,sFAAsF;AACtF,MAAM,MAAM,kBAAkB,CAAC,OAAO,SAAS,YAAY,IAAI,MAAM,OAAO,SAAS,KAAK,GACtF,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GACrB,WAAW,CAAC,OAAO,CAAC,CAAA;AAExB,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACnC;AAED,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED,MAAM,WAAW,qBAAqB,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACtE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;CACpB;AAKD,MAAM,WAAW,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,SAAS,YAAY,GAAG,YAAY,CAC/E,SAAQ,kBAAkB;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,CACjB,OAAO,EAAE,qBAAqB,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAC1D,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CACtD;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAA;IACjC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;CAClF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,SAAS,YAAY,EAClE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,QAAQ,EAAE,gBAAgB,GACzB,iBAAiB,CAgFnB;AAED,4FAA4F;AAC5F,UAAU,0BAA0B;IAClC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAA;IAC7C,kFAAkF;IAClF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,0BAA0B,GAAG,MAAM,GAAG,SAAS,CAW5F;AAED,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,aAAa,EAAE;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAC3B,GAAG,kBAAkB,CAQrB;AAED,oGAAoG;AACpG,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAarE;AAgDD,sGAAsG;AACtG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAGlF"}

package/dist/sandboxes/index.d.ts

@@ -6,5 +6,5 @@ export { initializeSandboxEnvironment, sandboxCreationEnvironment, sandboxProjec
 export { SandboxError, SandboxIsolationUnavailableError, SandboxNotRunningError, SandboxStateUnavailableError, SandboxTimeoutError, } from "./errors";
 export type { ExecOptions } from "./exec";
 export { exec } from "./exec";
-export type { CommandResult, CreateSandboxOptions, ResumeSandboxOptions, RunCommandOptions, Sandbox, SandboxFactory, SandboxFileRecord, SandboxNetworkPolicy, SandboxNetworkTarget, SandboxRequestCredential, SandboxSessionOptions, SandboxStatus, } from "./sandbox";
+export type { CommandResult, CreateSandboxOptions, ResumeSandboxOptions, RunCommandOptions, Sandbox, SandboxFactory, SandboxFileRecord, SandboxNetworkPolicy, SandboxNetworkTarget, SandboxRequestCredential, SandboxRequestMethod, SandboxSessionOptions, SandboxStatus, } from "./sandbox";
 //# sourceMappingURL=index.d.ts.map

package/dist/sandboxes/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandboxes/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACvE,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,QAAQ,CAAA;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,GACd,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,YAAY,EACZ,gCAAgC,EAChC,sBAAsB,EACtB,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAA;AAC7B,YAAY,EACV,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,OAAO,EACP,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,GACd,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandboxes/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACvE,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,QAAQ,CAAA;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,qBAAqB,EACrB,aAAa,GACd,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,YAAY,EACZ,gCAAgC,EAChC,sBAAsB,EACtB,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAA;AAC7B,YAAY,EACV,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,OAAO,EACP,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,GACd,MAAM,WAAW,CAAA"}

package/dist/sandboxes/index.js

@@ -1,22 +1,23 @@
 // @bun
 import {
-  SandboxError2,
-  SandboxStateUnavailableError2,
-  SandboxNotRunningError2,
-  SandboxTimeoutError2,
-  SandboxIsolationUnavailableError2,
   sandboxConfig2,
   sandboxCreationEnvironment2,
   sandboxProjectDirectory2,
   initializeSandboxEnvironment2,
   exec2
-} from "../chunk-9gyp8hg1.js";
-import"../chunk-1k89ecfr.js";
-import"../chunk-c85m1hyj.js";
-import"../chunk-v9xd5wzd.js";
-import"../chunk-hvsb78a1.js";
-import"../chunk-jhm3zsa7.js";
-import"../chunk-z3y5kg1x.js";
+} from "../chunk-d5rjr8c0.js";
+import {
+  SandboxError2,
+  SandboxStateUnavailableError2,
+  SandboxNotRunningError2,
+  SandboxTimeoutError2,
+  SandboxIsolationUnavailableError2
+} from "../chunk-cfj9dfbb.js";
+import"../chunk-447a5c0p.js";
+import"../chunk-s7jg7pmn.js";
+import"../chunk-8frc8a4j.js";
+import"../chunk-6eqsgvxk.js";
+import"../chunk-wkv3h3q7.js";
 export {
   SandboxError2 as SandboxError,
   SandboxIsolationUnavailableError2 as SandboxIsolationUnavailableError,
@@ -30,4 +31,4 @@ export {
   sandboxProjectDirectory2 as sandboxProjectDirectory
 };
 
-//# debugId=3B9A897DD75650EF64756E2164756E21
+//# debugId=CE1061B72A7DD69064756E2164756E21

package/dist/sandboxes/index.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "3B9A897DD75650EF64756E2164756E21",
+  "debugId": "CE1061B72A7DD69064756E2164756E21",
   "names": []
 }

package/dist/sandboxes/sandbox.d.ts

@@ -71,13 +71,34 @@ export interface SandboxNetworkTarget {
     readonly name: string;
     readonly origin: string;
 }
-/** Host-only credentials injected outside the guest into one exact HTTPS request target.
- * This selects authenticated requests, not the sandbox's general egress allowlist.
+/** HTTP methods a request credential can be injected into. HEAD and OPTIONS never are. */
+export type SandboxRequestMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+/**
+ * Host-only credentials injected outside the guest into matching HTTPS requests.
+ *
+ * A credential selects which requests receive its Authorization header. It does not decide what
+ * the guest can reach, which is the network policy, nor which resources the token can act on:
+ * the token's own permissions are the boundary, so issue it with the narrowest scope that works.
+ *
+ * Providers apply the same rules so that a credential means the same thing everywhere:
+ * - `origin` is one `https://` domain: no port, path, user info, IP address, loopback host or
+ *   `*` wildcard.
+ * - A path is matched case-sensitively against the raw request path. It starts with a single
+ *   "/" and is printable ASCII without spaces, control characters, "?", "#", "%", "\\", or "."
+ *   and ".." segments. A prefix also ends with "/", so it stops at a segment boundary.
+ * - Two credentials must not match the same request: one credential per request, so providers
+ *   reject the overlap instead of picking one.
+ * - Only Authorization can be set, and the provider forces the request's Host header to
+ *   `origin`'s domain.
  */
 export interface SandboxRequestCredential {
     readonly origin: string;
-    readonly path: string;
-    readonly method: "GET" | "POST";
+    /** One exact path, or every path under `prefix`. */
+    readonly path: string | {
+        readonly prefix: string;
+    };
+    /** One method, or a non-empty list of distinct methods. */
+    readonly method: SandboxRequestMethod | readonly SandboxRequestMethod[];
     readonly headers: {
         readonly Authorization: string;
     };
@@ -115,6 +136,8 @@ export interface Sandbox {
     /** Optional secure injection capability. Replaces all credentials on this session only.
      * An empty list removes injection. Secrets must never enter guest files, env or snapshots.
      * Must not resume a stopped session or change defaults inherited by future sessions.
+     * Renewal, ephemeral or persistent, targets the handle's session; after stop() it rejects.
+     * A thrown error is reported to onError: it and its causes must never contain a credential.
      */
     readonly setRequestCredentials?: (credentials: readonly SandboxRequestCredential[]) => Promise<void>;
     runCommand(command: string, args?: readonly string[], options?: RunCommandOptions): Promise<CommandResult>;
@@ -148,7 +171,7 @@ export interface Sandbox {
  * Credentials and current authority must be supplied again, never inferred from saved files.
  */
 export interface SandboxFactory<in out TParams extends ParamsConfig = ParamsConfig> {
-    /** Supports initial and renewable host-only credentials on named persistent sessions. */
+    /** Supports initial and renewable host-only credentials on ephemeral and named sessions. */
     readonly supportsRequestCredentials?: boolean;
     /** Common host-side environment recipe. Never a discovered Agent definition. */
     readonly configuration?: SandboxConfig<TParams>;

package/dist/sandboxes/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/sandboxes/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAExE,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE5D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,sEAAsE;IACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/C,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;IACtC,kGAAkG;IAClG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAA;CAChD,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAA;AAE5B,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAA;CACrD;AAED,oGAAoG;AACpG,MAAM,WAAW,qBAAqB;IACpC,8FAA8F;IAC9F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;IACjE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAA;IACnE,sGAAsG;IACtG,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACjD;AAED,oGAAoG;AACpG,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAA;CAC7B;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,WAAW,EAAE,SAAS,wBAAwB,EAAE,KAC7C,OAAO,CAAC,IAAI,CAAC,CAAA;IAElB,UAAU,CACR,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAAA;IAEzB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9D;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,SAAS,YAAY,GAAG,YAAY;IAChF,yFAAyF;IACzF,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAA;IAC7C,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;IAC/C;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACxD;;;;;;;;OAQG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxE"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/sandboxes/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAExE,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE5D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,sEAAsE;IACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/C,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;IACtC,kGAAkG;IAClG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAA;CAChD,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAA;AAE5B,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,0FAA0F;AAC1F,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAA;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,oBAAoB,EAAE,CAAA;IACvE,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAA;CACrD;AAED,oGAAoG;AACpG,MAAM,WAAW,qBAAqB;IACpC,8FAA8F;IAC9F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;IACjE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAA;IACnE,sGAAsG;IACtG,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACjD;AAED,oGAAoG;AACpG,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAA;CAC7B;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,WAAW,EAAE,SAAS,wBAAwB,EAAE,KAC7C,OAAO,CAAC,IAAI,CAAC,CAAA;IAElB,UAAU,CACR,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAAA;IAEzB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9D;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,SAAS,YAAY,GAAG,YAAY;IAChF,4FAA4F;IAC5F,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAA;IAC7C,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;IAC/C;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACxD;;;;;;;;OAQG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxE"}

package/dist/security/applied-markings-contribution.d.ts

@@ -0,0 +1,58 @@
+import type { ProjectionEventOrigin } from "../events/envelope";
+import type { DatasetVersion } from "../lake-storage/types";
+import type { OntologyDefinitionCatalog } from "../ontology/registry";
+import type { PipelineDefinition } from "../pipelines/types";
+import type { LinkProjectionDefinition, ObjectProjectionDefinition } from "../projections/types";
+import type { ActiveOntologySource } from "../storage/ontology";
+import { type AppliedContribution } from "./applied-markings-snapshot";
+import type { VersionClassification } from "./dataset-version-markings";
+export type SourceProjection = ObjectProjectionDefinition | LinkProjectionDefinition;
+/** What reading a projection's applied version from the lake gave. */
+export type AppliedVersionRead = {
+    readonly kind: "read";
+    readonly version: DatasetVersion;
+    readonly classification: VersionClassification;
+} | {
+    readonly kind: "missing";
+} | {
+    readonly kind: "failed";
+    readonly error: unknown;
+};
+export interface AppliedContributionContext {
+    readonly ontology: Pick<OntologyDefinitionCatalog, "getObjectTypeById">;
+    /** The revision of a projection's current definition. */
+    readonly revisionOf: (projectionId: string) => string;
+    /** What a version that cannot be read may carry. */
+    readonly everyMarking: ReadonlySet<string>;
+    /** The pipeline that writes a dataset in the current code, for messages. */
+    readonly pipelineOf: (datasetId: string) => string | undefined;
+}
+/**
+ * What one projection's applied version adds to the code's markings, with the notice that explains
+ * it. It reads nothing: the caller reads and classifies the version.
+ *
+ * - A version that could not be read seals the projection's target with every marking.
+ * - Objects written by an earlier definition, which may have mapped any column, seal it with every
+ *   marking of the version.
+ * - Otherwise a property keeps the markings its column carries beyond its declaration, and a key
+ *   column that carries markings seals what it keys.
+ */
+export declare function appliedContribution(projection: SourceProjection, source: ActiveOntologySource, read: AppliedVersionRead, context: AppliedContributionContext): AppliedContribution;
+/** Every marking the version carries in any column; every marking when it could not be read. */
+export declare function appliedVersionMarkings(read: AppliedVersionRead, everyMarking: ReadonlySet<string>): readonly string[];
+/** An object event a projection emitted: the version its values came from, and its type. */
+export type EventOriginRef = Pick<ProjectionEventOrigin, "projectionId" | "datasetId" | "datasetVersionId"> & {
+    readonly objectTypeId: string;
+};
+/**
+ * The markings an object event's origin version carries on each property its projection maps.
+ * When the projection now maps another dataset or type, or the version cannot be read, every
+ * property but the primary one carries every marking it could, as objects written under an
+ * earlier definition do.
+ */
+export declare function eventOriginMarkings(projection: ObjectProjectionDefinition, origin: EventOriginRef, read: AppliedVersionRead, context: Pick<AppliedContributionContext, "ontology" | "everyMarking">): AppliedContribution["properties"];
+/** The pipeline that writes each dataset in the current code. */
+export declare function producingPipelines(pipelines: readonly PipelineDefinition[]): (datasetId: string) => string | undefined;
+export declare function sentence(text: string): string;
+export declare function errorMessage(error: unknown): string;
+//# sourceMappingURL=applied-markings-contribution.d.ts.map

package/dist/security/applied-markings-contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-markings-contribution.d.ts","sourceRoot":"","sources":["../../src/security/applied-markings-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAA;AAChG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAAE,KAAK,mBAAmB,EAAmB,MAAM,6BAA6B,CAAA;AACvF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAIvE,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,GAAG,wBAAwB,CAAA;AAEpF,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAA;CAC/C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAA;AAExD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,CAAA;IACvE,yDAAyD;IACzD,QAAQ,CAAC,UAAU,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;IACrD,oDAAoD;IACpD,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;CAC/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAyFrB;AAED,gGAAgG;AAChG,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,kBAAkB,EACxB,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAChC,SAAS,MAAM,EAAE,CAKnB;AAED,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,qBAAqB,EACrB,cAAc,GAAG,WAAW,GAAG,kBAAkB,CAClD,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAA;AAErC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,0BAA0B,EACtC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,IAAI,CAAC,0BAA0B,EAAE,UAAU,GAAG,cAAc,CAAC,GACrE,mBAAmB,CAAC,YAAY,CAAC,CAqBnC;AAED,iEAAiE;AACjE,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,kBAAkB,EAAE,GACvC,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAO3C;AAkED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAMD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnD"}

package/dist/security/applied-markings-host.d.ts

@@ -0,0 +1,10 @@
+import type { AppliedMarkings } from "./applied-markings";
+/** One snapshot per host, so every reader shares it and its resolved clearances. */
+export declare function registerAppliedMarkings(owner: object, markings: AppliedMarkings): void;
+export declare function getAppliedMarkings(owner: object): AppliedMarkings;
+/**
+ * Read the applied versions ahead of the first request that needs them. A failure is only
+ * reported here: that request reads them again, and fails closed if it cannot.
+ */
+export declare function warmAppliedMarkings(owner: object): void;
+//# sourceMappingURL=applied-markings-host.d.ts.map

package/dist/security/applied-markings-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-markings-host.d.ts","sourceRoot":"","sources":["../../src/security/applied-markings-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AASzD,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAYtF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAIjE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAMvD"}

package/dist/security/applied-markings-snapshot.d.ts

@@ -0,0 +1,67 @@
+import type { ProjectionKeyTarget } from "./projection-markings";
+/** Why readers lacking some markings cannot read an object type or a link. */
+export interface AppliedSeal {
+    readonly projectionId: string;
+    readonly markings: ReadonlySet<string>;
+    /** What carries the marking, completed by "carries marking 'm'" in messages. */
+    readonly reason: string;
+}
+export interface AppliedLinkSeals {
+    readonly objectTypeId: string;
+    readonly linkId: string;
+    readonly targetObjectTypeId: string;
+    readonly seals: readonly AppliedSeal[];
+}
+export interface AppliedMarkingsNotice {
+    readonly projectionId: string;
+    /** Whether the projection makes an object type or a link unreadable, not only properties. */
+    readonly sealed: boolean;
+    readonly message: string;
+}
+/**
+ * What the applied versions add to the ontology's markings.
+ *
+ * Every reader of a host shares one snapshot and the clearances resolved for it, so a snapshot is
+ * immutable all the way down: its maps and sets refuse writes.
+ */
+export interface AppliedMarkingsSnapshot {
+    /** Surplus markings by object type, then property. */
+    readonly properties: ReadonlyMap<string, ReadonlyMap<string, ReadonlySet<string>>>;
+    /** Object types readers lacking a seal's markings cannot read. */
+    readonly types: ReadonlyMap<string, readonly AppliedSeal[]>;
+    /** Links, by {@link appliedLinkKey}, readers lacking a seal's markings cannot read. */
+    readonly links: ReadonlyMap<string, AppliedLinkSeals>;
+    /** Every marking above: a reader cleared for all of them reads what the code allows. */
+    readonly markings: ReadonlySet<string>;
+    /** One per projection whose applied version adds markings, for diagnostics. */
+    readonly notices: readonly AppliedMarkingsNotice[];
+}
+export declare function appliedLinkKey(objectTypeId: string, linkId: string): string;
+/** What one applied version adds, as plain data so that equal results serialize equally. */
+export interface AppliedContribution {
+    readonly properties: readonly {
+        readonly objectTypeId: string;
+        readonly propertyId: string;
+        readonly markings: readonly string[];
+    }[];
+    readonly seals: readonly {
+        readonly target: ProjectionKeyTarget;
+        readonly seal: {
+            readonly projectionId: string;
+            readonly markings: readonly string[];
+            readonly reason: string;
+        };
+    }[];
+    readonly notice?: AppliedMarkingsNotice;
+}
+/** An applied version that adds nothing. */
+export declare const NO_CONTRIBUTION: AppliedContribution;
+export declare const NO_APPLIED_MARKINGS: AppliedMarkingsSnapshot;
+/** One snapshot from the contributions of every applied version, in projection order. */
+export declare function assembleAppliedMarkings(contributions: readonly AppliedContribution[]): AppliedMarkingsSnapshot;
+/**
+ * The snapshot with these properties' markings added: what an object event reads under, given the
+ * markings its origin version carries on them.
+ */
+export declare function withPropertyMarkings(snapshot: AppliedMarkingsSnapshot, added: AppliedContribution["properties"]): AppliedMarkingsSnapshot;
+//# sourceMappingURL=applied-markings-snapshot.d.ts.map

package/dist/security/applied-markings-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-markings-snapshot.d.ts","sourceRoot":"","sources":["../../src/security/applied-markings-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAEhE,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAA;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAClF,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC,CAAA;IAC3D,uFAAuF;IACvF,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;IACrD,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAA;CACnD;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,4FAA4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,SAAS;QAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KACrC,EAAE,CAAA;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS;QACvB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;QACpC,QAAQ,CAAC,IAAI,EAAE;YACb,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;YAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;YACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;SACxB,CAAA;KACF,EAAE,CAAA;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAA;CACxC;AAED,4CAA4C;AAC5C,eAAO,MAAM,eAAe,EAAE,mBAG5B,CAAA;AAEF,eAAO,MAAM,mBAAmB,EAAE,uBAMhC,CAAA;AAEF,yFAAyF;AACzF,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,SAAS,mBAAmB,EAAE,GAC5C,uBAAuB,CA6EzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,uBAAuB,EACjC,KAAK,EAAE,mBAAmB,CAAC,YAAY,CAAC,GACvC,uBAAuB,CAsCzB"}

package/dist/security/applied-markings.d.ts

@@ -0,0 +1,73 @@
+import type { LakeStorage } from "../lake-storage/types";
+import type { OntologyDefinitionCatalog } from "../ontology/registry";
+import type { PipelineDefinition } from "../pipelines/types";
+import type { ProjectionDefinitionCatalog } from "../projections/registry";
+import type { OntologySourceStorage } from "../storage/ontology";
+import { type EventOriginRef } from "./applied-markings-contribution";
+import { type AppliedMarkingsSnapshot } from "./applied-markings-snapshot";
+import type { DatasetVersionMarkings } from "./dataset-version-markings";
+/**
+ * Objects keep the markings of the dataset version they were projected from.
+ *
+ * Startup checks the code: each projected property declares the markings its column carries. The
+ * objects a projection applied may predate that code. When a property stops declaring a marking
+ * its applied version still carries on the column, the objects still hold those values. Until the
+ * projection applies a version the code allows, each such property keeps the marking (its
+ * surplus), and an object type or link whose key column carries markings is unreadable to readers
+ * lacking them, like a type they have no view grant for.
+ *
+ * Lifecycle: the snapshot is read when a read needs it, with no background work.
+ * - A read reads it with one storage query for the projections' active sources; only projections
+ *   whose applied version or definition changed are classified again. A project whose columns
+ *   carry no marking reads nothing.
+ * - A read uses a snapshot younger than {@link APPLIED_MARKINGS_FRESH_MS}. An older one, up to
+ *   {@link APPLIED_MARKINGS_MAX_AGE_MS}, is used while one refresh runs behind the read. Past that
+ *   age, or before any snapshot, the read waits for a refresh and fails if it fails or hangs past
+ *   the same bound. Other servers so see a newly applied version within seconds.
+ * - A host that applies a projection invalidates the snapshot, so its next read refreshes first:
+ *   `sixb dev` sees a version at once.
+ */
+export interface AppliedMarkings {
+    /** Whether readers with these clearances can be denied anything the code alone allows. */
+    affects(clearances: ReadonlySet<string>): boolean;
+    /** The current snapshot, refreshed on demand. */
+    current(): Promise<AppliedMarkingsSnapshot>;
+    /** A projection applied a version in this process: the next read refreshes first. */
+    invalidate(): void;
+    /**
+     * The snapshot with the markings an object event's origin version carries on the properties
+     * its projection maps: the event holds that version's values, whatever version the projection
+     * applied since. Reads each version once, keeping the last few.
+     */
+    forEventOrigin(snapshot: AppliedMarkingsSnapshot, origin: EventOriginRef): Promise<AppliedMarkingsSnapshot>;
+    /**
+     * The snapshot with every marking a column declares on each property a projection maps to this
+     * type: what an object event's earlier values read under. They are the values an update or a
+     * deletion replaced, and the projected values an action or a direct write recorded. They came
+     * from versions projections applied before, which no event records, so they read like a version
+     * that cannot be read. Like the objects they wrote, a projection the code no longer declares
+     * marks nothing.
+     */
+    forEarlierValues(snapshot: AppliedMarkingsSnapshot, objectTypeId: string): AppliedMarkingsSnapshot;
+}
+export interface AppliedMarkingsOptions {
+    readonly projectId: string;
+    readonly ontology: Pick<OntologyDefinitionCatalog, "getObjectTypeById">;
+    readonly projections: Pick<ProjectionDefinitionCatalog, "listObjects" | "listLinks">;
+    /** The revision of a projection's current definition. */
+    readonly revisionOf: (projectionId: string) => string;
+    readonly pipelines: readonly PipelineDefinition[];
+    readonly versionMarkings: DatasetVersionMarkings;
+    readonly lakeStorage: Pick<LakeStorage, "getVersion">;
+    readonly sources: Pick<OntologySourceStorage, "listActive">;
+    /** A monotonic clock in milliseconds. */
+    readonly now?: () => number;
+    /** For this repo's tests: the bound past which a read waits, and a refresh fails. */
+    readonly maxAgeMs?: number;
+}
+/** A read uses a snapshot younger than this as it is. */
+export declare const APPLIED_MARKINGS_FRESH_MS = 5000;
+/** A read waits for a snapshot older than this, and a refresh that takes longer fails. */
+export declare const APPLIED_MARKINGS_MAX_AGE_MS = 10000;
+export declare function createAppliedMarkings(options: AppliedMarkingsOptions): AppliedMarkings;
+//# sourceMappingURL=applied-markings.d.ts.map

package/dist/security/applied-markings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-markings.d.ts","sourceRoot":"","sources":["../../src/security/applied-markings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAGL,KAAK,cAAc,EAMpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EAEL,KAAK,uBAAuB,EAK7B,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAExE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,eAAe;IAC9B,0FAA0F;IAC1F,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAA;IACjD,iDAAiD;IACjD,OAAO,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAC3C,qFAAqF;IACrF,UAAU,IAAI,IAAI,CAAA;IAClB;;;;OAIG;IACH,cAAc,CACZ,QAAQ,EAAE,uBAAuB,EACjC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACnC;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,GAAG,uBAAuB,CAAA;CACnG;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,CAAA;IACvE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,2BAA2B,EAAE,aAAa,GAAG,WAAW,CAAC,CAAA;IACpF,yDAAyD;IACzD,QAAQ,CAAC,UAAU,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;IACrD,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACjD,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAA;IAChD,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IACrD,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAA;IAC3D,yCAAyC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAC3B,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAKD,yDAAyD;AACzD,eAAO,MAAM,yBAAyB,OAAQ,CAAA;AAC9C,0FAA0F;AAC1F,eAAO,MAAM,2BAA2B,QAAS,CAAA;AAUjD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAkStF"}

package/dist/security/builders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/security/builders.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACf,MAAM,SAAS,CAAA;AAQhB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAA;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,6CAA6C;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACnD;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAA;IAC9C,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAA;IAC1C,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAC7C;AAoCD,wBAAgB,WAAW,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EAClD,EAAE,EAAE,GAAG,EACP,OAAO,GAAE,kBAAuB,GAC/B,eAAe,CAAC,GAAG,CAAC,CAWtB;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,KAAK,EAAE,MAAM,GACZ,SAAS,MAAM,EAAE,CASnB;AAED,wBAAgB,aAAa,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACpD,EAAE,EAAE,GAAG,EACP,OAAO,GAAE,oBAAyB,GACjC,iBAAiB,CAAC,GAAG,CAAC,CAWxB;AAED,wBAAgB,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACjD,EAAE,EAAE,GAAG,EACP,OAAO,EAAE,iBAAiB,GACzB,cAAc,CAAC,GAAG,CAAC,CA6BrB;AAED,wBAAgB,sBAAsB,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EAC7D,EAAE,EAAE,GAAG,EACP,OAAO,EAAE,6BAA6B,GACrC,0BAA0B,CAAC,GAAG,CAAC,CAYjC"}
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/security/builders.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACf,MAAM,SAAS,CAAA;AAQhB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAA;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,6CAA6C;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACnD;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,CAAA;IAC9C,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAA;IAC1C,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAC7C;AAyCD,wBAAgB,WAAW,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EAClD,EAAE,EAAE,GAAG,EACP,OAAO,GAAE,kBAAuB,GAC/B,eAAe,CAAC,GAAG,CAAC,CAWtB;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,KAAK,EAAE,MAAM,GACZ,SAAS,MAAM,EAAE,CASnB;AAED,wBAAgB,aAAa,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACpD,EAAE,EAAE,GAAG,EACP,OAAO,GAAE,oBAAyB,GACjC,iBAAiB,CAAC,GAAG,CAAC,CAWxB;AAED,wBAAgB,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACjD,EAAE,EAAE,GAAG,EACP,OAAO,EAAE,iBAAiB,GACzB,cAAc,CAAC,GAAG,CAAC,CA6BrB;AAED,wBAAgB,sBAAsB,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EAC7D,EAAE,EAAE,GAAG,EACP,OAAO,EAAE,6BAA6B,GACrC,0BAA0B,CAAC,GAAG,CAAC,CAYjC"}

package/dist/security/dataset-version-markings.d.ts

@@ -0,0 +1,47 @@
+import type { DatasetDefinition } from "../datasets/types";
+import type { DatasetVersion, LakeStorage } from "../lake-storage/types";
+/** Markings of each column of one dataset version. A column without markings has an empty set. */
+export type VersionColumnMarkings = ReadonlyMap<string, ReadonlySet<string>>;
+export interface VersionClassification {
+    readonly columns: VersionColumnMarkings;
+    /**
+     * Why part of the version was classified conservatively, with every marking it could hold.
+     * Absent when every column was classified from its lineage.
+     */
+    readonly conservative?: string;
+}
+/**
+ * Markings each version of a dataset carries.
+ *
+ * Markings are never stored. A column carries the markings its registered dataset declares, and
+ * those every column its lineage lists declares. The version records that lineage resolved across
+ * every upstream step and every row it keeps (`DatasetVersion.lineage`), so a version keeps the
+ * classification of the code that produced it, and classifying it reads no other version.
+ *
+ * Wherever the record does not say what a column holds (no lineage on a pipeline version, or on
+ * any version of a provider that does not declare `recordsLineage`, an unknown history, a column
+ * it does not list, a dataset no longer registered) the column is classified with every marking
+ * the project declares.
+ */
+export interface DatasetVersionMarkings {
+    classify(version: DatasetVersion): VersionClassification;
+    /**
+     * Every marking declared on a registered column. Every classification, conservative ones
+     * included, is drawn from it, so a reader cleared for all of it needs no classification. Empty
+     * when the project declares no column markings.
+     */
+    everyMarking(): ReadonlySet<string>;
+}
+export interface DatasetVersionMarkingsOptions {
+    readonly datasets: {
+        list(): readonly DatasetDefinition[];
+    };
+    /** The lake the versions are read from: whether it records lineage on every version. */
+    readonly lakeStorage: Pick<LakeStorage, "recordsLineage">;
+}
+export declare function createDatasetVersionMarkings(options: DatasetVersionMarkingsOptions): DatasetVersionMarkings;
+/** One classifier per host, so every reader shares the markings it reads from the definitions. */
+export declare function registerDatasetVersionMarkings(owner: object, markings: DatasetVersionMarkings): void;
+export declare function getDatasetVersionMarkings(owner: object): DatasetVersionMarkings;
+export declare function shareDatasetVersionMarkings(source: object, target: object): void;
+//# sourceMappingURL=dataset-version-markings.d.ts.map

package/dist/security/dataset-version-markings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-version-markings.d.ts","sourceRoot":"","sources":["../../src/security/dataset-version-markings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAoB,cAAc,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAG1F,kGAAkG;AAClG,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;AAE5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAA;IACvC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,qBAAqB,CAAA;IACxD;;;;OAIG;IACH,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAAA;CACpC;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE;QAAE,IAAI,IAAI,SAAS,iBAAiB,EAAE,CAAA;KAAE,CAAA;IAC3D,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAA;CAC1D;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,6BAA6B,GACrC,sBAAsB,CA8ExB;AAUD,kGAAkG;AAClG,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,sBAAsB,GAC/B,IAAI,CAYN;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAI/E;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAEhF"}