@sixb/core 0.1.20 → 0.1.21

package/dist/chunk-twe4dx8p.js

@@ -0,0 +1,676 @@
+// @bun
+import {
+  NO_CONTRIBUTION
+} from "./chunk-x0v3jd47.js";
+import {
+  lineageColumn,
+  isUnknownLineage,
+  versionLineage
+} from "./chunk-ff5xkv0p.js";
+import {
+  runStepLineage2,
+  stepReadColumns
+} from "./chunk-g5bvzyyr.js";
+import {
+  SecurityValidationError2
+} from "./chunk-jcfw4h7m.js";
+
+// src/security/projection-markings.ts
+function validateProjectionMarkings(projections, ontology, markings) {
+  const all = [
+    ...projections.listObjects(),
+    ...projections.listLinks(),
+    ...projections.listTelemetry()
+  ];
+  for (const projection of all) {
+    const originsOf = (column) => markings.of({ datasetId: projection.datasetId, column });
+    const violation = firstViolation(projection, ontology, (column) => [
+      ...originsOf(column).keys()
+    ]);
+    if (!violation)
+      continue;
+    const carries = (column) => {
+      const origins = originsOf(column);
+      return {
+        text: describeOrigins(origins, `${projection.datasetId}.${column}`),
+        inherited: [...origins.values()].some((origin) => origin.steps.length > 0)
+      };
+    };
+    throw new SecurityValidationError2(violationMessage(`[Sixb] Projection '${projection.id}'`, projection.datasetId, violation, carries));
+  }
+}
+function assertProjectionVersionMarkings2(input) {
+  const { projection, version, classification } = input;
+  const markingsOf = (column) => [...classification.columns.get(column) ?? []].sort();
+  const violation = firstViolation(projection, input.ontology, markingsOf);
+  if (!violation)
+    return;
+  const subject = `[Sixb] Projection '${projection.id}' cannot read version '${version.versionId}' of dataset '${version.datasetId}'`;
+  const carries = (column) => ({
+    text: `${markingList(markingsOf(column))} in this version`,
+    inherited: true
+  });
+  const conservative = classification.conservative === undefined ? "" : ` The version was classified with every marking its sources could hold, because ${classification.conservative}.`;
+  const rerun = `If the code that writes '${version.datasetId}' no longer derives these markings, rerun its pipeline.`;
+  throw new Error(`${violationMessage(subject, version.datasetId, violation, carries)}${conservative} ${rerun}`);
+}
+function projectionSurplus(projection, ontology, markingsOf) {
+  const properties = [];
+  const keys = [];
+  for (const violation of projectionMarkingViolations(projection, ontology, markingsOf)) {
+    switch (violation.kind) {
+      case "undeclared":
+        properties.push({
+          objectTypeId: violation.objectTypeId,
+          propertyId: violation.propertyId,
+          column: violation.column,
+          markings: violation.missing
+        });
+        break;
+      case "markedKeyColumn": {
+        const markings = markingsOf(violation.column);
+        for (const target of violation.targets) {
+          keys.push({ target, column: violation.column, role: violation.role, markings });
+        }
+        const property = violation.property;
+        if (property && violation.targets.some((target) => target.kind === "link")) {
+          properties.push({ ...property, column: violation.column, markings });
+        }
+        break;
+      }
+      case "markedKeyProperty":
+      case "telemetry":
+        break;
+    }
+  }
+  return { properties, keys };
+}
+function firstViolation(projection, ontology, markingsOf) {
+  const first = projectionMarkingViolations(projection, ontology, markingsOf).next();
+  return first.done ? null : first.value;
+}
+function* projectionMarkingViolations(projection, ontology, markingsOf) {
+  switch (projection._tag) {
+    case "ObjectProjectionDefinition": {
+      const objectType = ontology.getObjectTypeById(projection.objectTypeId);
+      if (objectType)
+        yield* objectProjectionViolations(projection, objectType, markingsOf);
+      return;
+    }
+    case "LinkProjectionDefinition":
+      yield* linkProjectionViolations(projection, markingsOf);
+      return;
+    case "TelemetryProjectionDefinition":
+      yield* telemetryProjectionViolations(projection, markingsOf);
+      return;
+  }
+}
+function* objectProjectionViolations(projection, objectType, markingsOf) {
+  const keyRoles = objectProjectionKeyRoles(projection, objectType);
+  for (const [propertyId, column] of Object.entries(projection.properties)) {
+    const property = objectType.properties.find((candidate) => candidate.id === propertyId);
+    const path = `${objectType.id}.${propertyId}`;
+    const keyRole = keyRoles.get(propertyId);
+    if (keyRole) {
+      if (markingsOf(column).length > 0) {
+        yield {
+          kind: "markedKeyColumn",
+          column,
+          role: keyRole.role,
+          targets: keyRole.targets,
+          property: { objectTypeId: objectType.id, propertyId }
+        };
+      } else if (property?.markings) {
+        yield { kind: "markedKeyProperty", property: path, role: keyRole.role };
+      }
+      continue;
+    }
+    const declared = new Set(property?.markings ?? []);
+    const missing = markingsOf(column).filter((markingId) => !declared.has(markingId));
+    if (missing.length > 0) {
+      yield {
+        kind: "undeclared",
+        property: path,
+        objectTypeId: objectType.id,
+        propertyId,
+        column,
+        missing
+      };
+    }
+  }
+  for (const [linkId, link] of Object.entries(projection.links)) {
+    if (link.sourceField === undefined)
+      continue;
+    const role = `keys link '${objectType.id}.${linkId}'`;
+    const target = linkTarget(objectType.id, linkId, link.targetObjectTypeId);
+    yield* markedKeyColumn(link.sourceField, role, [target], markingsOf);
+  }
+  const conflictResolution = projection.conflictResolution;
+  if (conflictResolution?.strategy === "mostRecent") {
+    const role = "decides which value wins under 'mostRecent'";
+    const target = { kind: "type", objectTypeId: objectType.id };
+    yield* markedKeyColumn(conflictResolution.sourceTimestamp, role, [target], markingsOf);
+  }
+}
+function* linkProjectionViolations(projection, markingsOf) {
+  const role = `keys link '${projection.sourceObjectTypeId}.${projection.linkId}'`;
+  const targets = [
+    linkTarget(projection.sourceObjectTypeId, projection.linkId, projection.targetObjectTypeId)
+  ];
+  yield* markedKeyColumn(projection.sourceField, role, targets, markingsOf);
+  yield* markedKeyColumn(projection.targetField, role, targets, markingsOf);
+}
+function* telemetryProjectionViolations(projection, markingsOf) {
+  const columns = [
+    projection.objectIdField,
+    projection.atField,
+    ...Object.values(projection.properties).flatMap((mapping) => mapping.unitField === undefined ? [mapping.valueField] : [mapping.valueField, mapping.unitField])
+  ];
+  for (const column of columns) {
+    if (markingsOf(column).length > 0)
+      yield { kind: "telemetry", column };
+  }
+}
+function objectProjectionKeyRoles(projection, objectType) {
+  const roles = new Map;
+  for (const property of objectType.properties) {
+    if (!property.primary)
+      continue;
+    roles.set(property.id, {
+      role: `becomes the id of '${objectType.id}'`,
+      targets: [{ kind: "type", objectTypeId: objectType.id }]
+    });
+  }
+  for (const [linkId, link] of Object.entries(projection.links)) {
+    if (link.sourcePropertyId === undefined)
+      continue;
+    roles.set(link.sourcePropertyId, {
+      role: `keys link '${objectType.id}.${linkId}'`,
+      targets: [
+        ...roles.get(link.sourcePropertyId)?.targets ?? [],
+        linkTarget(objectType.id, linkId, link.targetObjectTypeId)
+      ]
+    });
+  }
+  return roles;
+}
+function linkTarget(objectTypeId, linkId, targetObjectTypeId) {
+  return { kind: "link", objectTypeId, linkId, targetObjectTypeId };
+}
+function* markedKeyColumn(column, role, targets, markingsOf) {
+  if (markingsOf(column).length > 0)
+    yield { kind: "markedKeyColumn", column, role, targets };
+}
+function violationMessage(subject, datasetId, violation, carries) {
+  const path = (column) => `${datasetId}.${column}`;
+  switch (violation.kind) {
+    case "undeclared":
+      return `${subject}: property '${violation.property}' is projected from column '${path(violation.column)}', which carries ${carries(violation.column).text}. Add markings: ${markingList(violation.missing)} to the property.`;
+    case "markedKeyColumn": {
+      const carried = carries(violation.column);
+      const inherited = carried.inherited ? `, but carries ${carried.text}` : "";
+      return `${subject}: column '${path(violation.column)}' ${violation.role} and cannot carry markings${inherited}.`;
+    }
+    case "markedKeyProperty":
+      return `${subject}: property '${violation.property}' ${violation.role} and cannot carry markings.`;
+    case "telemetry":
+      return `${subject}: column '${path(violation.column)}' carries ${carries(violation.column).text}, and telemetry projections cannot read marked columns yet.`;
+  }
+}
+function describeOrigins(origins, columnPath) {
+  const groups = new Map;
+  for (const [markingId, origin] of origins) {
+    const path = originPath(origin, columnPath);
+    groups.set(path, [...groups.get(path) ?? [], markingId]);
+  }
+  return [...groups].map(([path, markingIds]) => `${markingList(markingIds)}${path}`).join(" and ");
+}
+function originPath(origin, columnPath) {
+  const source = `${origin.column.datasetId}.${origin.column.column}`;
+  if (origin.steps.length === 0 && source === columnPath)
+    return "";
+  const steps = origin.steps.map((step) => `'${step}'`).join(", ");
+  return ` from '${source}' through ${origin.steps.length === 1 ? "step" : "steps"} ${steps}`;
+}
+function markingList(markings) {
+  return `[${markings.join(", ")}]`;
+}
+
+// src/security/marking-propagation.ts
+function registeredSteps(pipelines) {
+  return pipelines.flatMap((pipeline) => pipeline.graph.nodes.map(({ step }) => ({ pipelineId: pipeline.id, step })));
+}
+function runStepLineages(datasetsById) {
+  const lineages = new Map;
+  return ({ step }) => {
+    if (step.executor.kind !== "run")
+      return;
+    let lineage = lineages.get(step);
+    if (!lineage) {
+      lineage = runStepLineage2(step, datasetsById);
+      lineages.set(step, lineage);
+    }
+    return lineage;
+  };
+}
+function stepLabel(entry) {
+  return `${entry.pipelineId}/${entry.step.id}`;
+}
+var NO_MARKINGS = new Map;
+
+class MarkingPropagation {
+  datasetsById;
+  markings = new Map;
+  rowMarkings = new Map;
+  ordered;
+  readers = new Map;
+  known = new Map;
+  queue = new Set;
+  constructor(datasetsById, steps) {
+    this.datasetsById = datasetsById;
+    this.ordered = inDependencyOrder(steps);
+    for (const entry of steps) {
+      for (const input of new Set(Object.values(entry.step.inputs).map((dataset) => dataset.id))) {
+        appendTo(this.readers, input, entry);
+      }
+    }
+  }
+  of(ref) {
+    return this.markedColumns(ref.datasetId).get(ref.column) ?? NO_MARKINGS;
+  }
+  derive(lineageOf) {
+    for (const entry of this.ordered) {
+      if (this.known.has(entry))
+        continue;
+      const lineage = lineageOf(entry);
+      if (!lineage)
+        continue;
+      this.known.set(entry, { lineage, reads: stepReadColumns(entry.step) });
+      this.queue.add(entry);
+    }
+    for (const entry of this.queue) {
+      this.queue.delete(entry);
+      const known = this.known.get(entry);
+      if (!known || !this.apply(entry, known))
+        continue;
+      for (const reader of this.readers.get(entry.step.output.id) ?? []) {
+        if (this.known.has(reader))
+          this.queue.add(reader);
+      }
+    }
+    return this;
+  }
+  apply(entry, { lineage, reads }) {
+    const label = stepLabel(entry);
+    const rows = this.union(lineage.rows);
+    for (const input of new Set(Object.values(entry.step.inputs).map((dataset) => dataset.id))) {
+      for (const [markingId, origin] of this.rowMarkings.get(input) ?? []) {
+        if (!rows.has(markingId))
+          rows.set(markingId, origin);
+      }
+    }
+    let everyRead;
+    let changed = false;
+    const outputId = entry.step.output.id;
+    let outputRows = this.rowMarkings.get(outputId);
+    for (const [markingId, origin] of rows) {
+      if (outputRows?.has(markingId))
+        continue;
+      if (!outputRows) {
+        outputRows = new Map;
+        this.rowMarkings.set(outputId, outputRows);
+      }
+      outputRows.set(markingId, { column: origin.column, steps: [...origin.steps, label] });
+      changed = true;
+    }
+    const marked = this.markedColumns(outputId);
+    for (const { name: column } of this.datasetsById.get(outputId)?.schema.columns ?? []) {
+      const values = lineageColumn(lineage, column);
+      const valueSource = values ? this.union(values) : everyRead ?? this.union(reads);
+      if (!values)
+        everyRead = valueSource;
+      for (const source of [rows, valueSource]) {
+        for (const [markingId, origin] of source) {
+          let origins = marked.get(column);
+          if (origins?.has(markingId))
+            continue;
+          if (!origins) {
+            origins = new Map;
+            marked.set(column, origins);
+          }
+          origins.set(markingId, { column: origin.column, steps: [...origin.steps, label] });
+          changed = true;
+        }
+      }
+    }
+    return changed;
+  }
+  markedColumns(datasetId) {
+    let columns = this.markings.get(datasetId);
+    if (!columns) {
+      columns = new Map;
+      for (const column of this.datasetsById.get(datasetId)?.schema.columns ?? []) {
+        if (!column.markings?.length)
+          continue;
+        const origin = { column: { datasetId, column: column.name }, steps: [] };
+        columns.set(column.name, new Map(column.markings.map((id) => [id, origin])));
+      }
+      this.markings.set(datasetId, columns);
+    }
+    return columns;
+  }
+  union(columns) {
+    const union = new Map;
+    for (const column of columns) {
+      for (const [markingId, origin] of this.of(column)) {
+        if (!union.has(markingId))
+          union.set(markingId, origin);
+      }
+    }
+    return union;
+  }
+}
+function inDependencyOrder(steps) {
+  const producers = producersByDataset(steps);
+  const ordered = [];
+  const visited = new Set;
+  const visit = (entry) => {
+    if (visited.has(entry))
+      return;
+    visited.add(entry);
+    for (const input of Object.values(entry.step.inputs)) {
+      for (const producer of producers.get(input.id) ?? [])
+        visit(producer);
+    }
+    ordered.push(entry);
+  };
+  for (const entry of steps)
+    visit(entry);
+  return ordered;
+}
+function producersByDataset(steps) {
+  const producers = new Map;
+  for (const entry of steps)
+    appendTo(producers, entry.step.output.id, entry);
+  return producers;
+}
+function appendTo(map, key, value) {
+  const values = map.get(key);
+  if (values)
+    values.push(value);
+  else
+    map.set(key, [value]);
+}
+
+// src/security/applied-markings-contribution.ts
+function appliedContribution(projection, source, read, context) {
+  const { datasetId, versionId } = source.datasetVersion;
+  const subject = `version '${versionId}' of '${datasetId}'`;
+  const target = projectionTarget(projection);
+  const hint = rerunHint(datasetId, read.kind === "read" ? read.version : undefined, context);
+  const every = [...context.everyMarking].sort();
+  if (read.kind === "failed") {
+    return sealed(projection.id, target, every, hint, {
+      reason: `the ${subject} it applied, which could not be read from the lake,`,
+      detail: `applied ${subject}, which could not be read from the lake: ${sentence(errorMessage(read.error))}`
+    });
+  }
+  if (read.kind === "missing") {
+    return sealed(projection.id, target, every, hint, {
+      reason: `the ${subject} it applied, which the lake no longer has,`,
+      detail: `applied ${subject}, which the lake no longer has.`
+    });
+  }
+  const { columns, conservative } = read.classification;
+  const because = conservative === undefined ? "" : ` The version was classified with every marking its sources could hold, because ${conservative}.`;
+  if (datasetId !== projection.datasetId || source.projectionRevision !== context.revisionOf(projection.id)) {
+    const markings = appliedVersionMarkings(read, context.everyMarking);
+    return sealed(projection.id, target, markings, hint, {
+      reason: `the ${subject} it applied under an earlier definition of the projection`,
+      detail: `applied ${subject} under an earlier definition of the projection, and that version carries ${markingList2(markings)}.${because}`
+    });
+  }
+  const markingsOf = (column) => [...columns.get(column) ?? []].sort();
+  const surplus = projectionSurplus(projection, context.ontology, markingsOf);
+  if (surplus.properties.length === 0 && surplus.keys.length === 0)
+    return NO_CONTRIBUTION;
+  const column = (name) => `'${datasetId}.${name}'`;
+  const seals = surplus.keys.map((key) => ({
+    target: key.target,
+    seal: {
+      projectionId: projection.id,
+      markings: key.markings,
+      reason: `in the version '${versionId}' it applied, column ${column(key.column)}, which ${key.role},`
+    }
+  }));
+  const details = [
+    ...surplus.keys.map((key) => `column ${column(key.column)} ${key.role} and carries ${markingList2(key.markings)}`),
+    ...surplus.properties.map((property) => `property '${property.objectTypeId}.${property.propertyId}' is projected from column ${column(property.column)}, which carries ${markingList2(property.markings)}`)
+  ];
+  const consequences = [];
+  if (seals.length > 0) {
+    const markings = [...new Set(seals.flatMap(({ seal }) => seal.markings))].sort();
+    consequences.push(`${describeTargets(seals.map(({ target }) => target))} cannot be read without clearance for ${markingList2(markings)}`);
+  }
+  if (surplus.properties.length > 0) {
+    const names = surplus.properties.map((p) => `'${p.objectTypeId}.${p.propertyId}'`);
+    const verb = surplus.properties.length === 1 ? "keeps" : "keep";
+    consequences.push(`${describeNames(names)} ${verb} these markings`);
+  }
+  return {
+    properties: surplus.properties.map(({ objectTypeId, propertyId, markings }) => ({
+      objectTypeId,
+      propertyId,
+      markings
+    })),
+    seals,
+    notice: {
+      projectionId: projection.id,
+      sealed: seals.length > 0,
+      message: `[Sixb] Projection '${projection.id}' applied ${subject}, in which ${details.join("; ")}.${because} ${capitalize(consequences.join(", and "))} until the projection applies a version the code allows. ${hint}`
+    }
+  };
+}
+function appliedVersionMarkings(read, everyMarking) {
+  if (read.kind !== "read")
+    return [...everyMarking].sort();
+  const { columns } = read.classification;
+  return [...new Set([...columns.values()].flatMap((set) => [...set]))].sort();
+}
+function eventOriginMarkings(projection, origin, read, context) {
+  const { objectTypeId } = origin;
+  if (read.kind === "read" && projection.datasetId === origin.datasetId && projection.objectTypeId === objectTypeId) {
+    const { columns } = read.classification;
+    return Object.entries(projection.properties).flatMap(([propertyId, column]) => {
+      const markings = [...columns.get(column) ?? []].sort();
+      return markings.length === 0 ? [] : [{ objectTypeId, propertyId, markings }];
+    });
+  }
+  const markings = appliedVersionMarkings(read, context.everyMarking);
+  if (markings.length === 0)
+    return [];
+  return (context.ontology.getObjectTypeById(objectTypeId)?.properties ?? []).filter((property) => !property.primary).map((property) => ({ objectTypeId, propertyId: property.id, markings }));
+}
+function producingPipelines(pipelines) {
+  const byDataset = new Map;
+  for (const { pipelineId, step } of registeredSteps(pipelines)) {
+    if (!byDataset.has(step.output.id))
+      byDataset.set(step.output.id, pipelineId);
+  }
+  return (datasetId) => byDataset.get(datasetId);
+}
+function sealed(projectionId, target, markings, hint, text) {
+  if (markings.length === 0)
+    return NO_CONTRIBUTION;
+  return {
+    properties: [],
+    seals: [{ target, seal: { projectionId, markings, reason: text.reason } }],
+    notice: {
+      projectionId,
+      sealed: true,
+      message: `[Sixb] Projection '${projectionId}' ${text.detail} ${describeTargets([target])} cannot be read without clearance for ${markingList2(markings)} until the projection applies a version the code allows. ${hint}`
+    }
+  };
+}
+function projectionTarget(projection) {
+  return projection._tag === "ObjectProjectionDefinition" ? { kind: "type", objectTypeId: projection.objectTypeId } : {
+    kind: "link",
+    objectTypeId: projection.sourceObjectTypeId,
+    linkId: projection.linkId,
+    targetObjectTypeId: projection.targetObjectTypeId
+  };
+}
+function rerunHint(datasetId, version, context) {
+  const pipelineId = context.pipelineOf(datasetId) ?? (version?.producer?.kind === "pipeline" ? version.producer.id : undefined);
+  return pipelineId === undefined ? `Write a new version of '${datasetId}' to replace it.` : `Rerun pipeline '${pipelineId}' to replace it.`;
+}
+function describeTargets(targets) {
+  return describeNames(targets.map((target) => target.kind === "type" ? `'${target.objectTypeId}'` : `link '${target.objectTypeId}.${target.linkId}'`));
+}
+function describeNames(names) {
+  const unique = [...new Set(names)];
+  const last = unique.pop() ?? "";
+  return unique.length === 0 ? last : `${unique.join(", ")} and ${last}`;
+}
+function capitalize(text) {
+  return text.charAt(0).toUpperCase() + text.slice(1);
+}
+function sentence(text) {
+  return text.endsWith(".") ? text : `${text}.`;
+}
+function markingList2(markings) {
+  return `[${markings.join(", ")}]`;
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/security/applied-markings-host.ts
+var appliedMarkingsKey = Symbol("sixb.appliedMarkings");
+function registerAppliedMarkings(owner, markings) {
+  const registered = owner[appliedMarkingsKey];
+  if (registered && registered !== markings) {
+    throw new Error("[Sixb] Applied markings are already registered for this owner.");
+  }
+  Object.defineProperty(owner, appliedMarkingsKey, {
+    configurable: false,
+    enumerable: false,
+    value: markings,
+    writable: false
+  });
+}
+function getAppliedMarkings2(owner) {
+  const markings = owner[appliedMarkingsKey];
+  if (markings)
+    return markings;
+  throw new Error("[Sixb] Applied markings are not registered for this runtime.");
+}
+function warmAppliedMarkings2(owner) {
+  getAppliedMarkings2(owner).current().catch((error) => {
+    console.warn(errorMessage(error));
+  });
+}
+
+// src/security/marking-sets.ts
+class MarkingSets {
+  empty = new Set;
+  sets = new Map([["", this.empty]]);
+  of(markingIds) {
+    if (markingIds === undefined || Array.isArray(markingIds) && markingIds.length === 0) {
+      return this.empty;
+    }
+    const sorted = [...new Set(markingIds)].sort();
+    const key = sorted.join("\x00");
+    let set = this.sets.get(key);
+    if (!set) {
+      set = new Set(sorted);
+      this.sets.set(key, set);
+    }
+    return set;
+  }
+  union(sets) {
+    let single;
+    const ids = [];
+    for (const set of sets) {
+      if (!set || set.size === 0)
+        continue;
+      single = single === undefined && ids.length === 0 ? set : undefined;
+      ids.push(...set);
+    }
+    return single ?? this.of(ids);
+  }
+}
+
+// src/security/dataset-version-markings.ts
+function createDatasetVersionMarkings(options) {
+  const sets = new MarkingSets;
+  let declared;
+  const declaredByDataset = () => declared ??= new Map(options.datasets.list().map((dataset) => [
+    dataset.id,
+    new Map(dataset.schema.columns.map((column) => [column.name, sets.of(column.markings)]))
+  ]));
+  let every;
+  const everyMarking = () => every ??= sets.union([...declaredByDataset().values()].flatMap((columns) => [...columns.values()]));
+  const classify = (version) => {
+    const subject = `version '${version.versionId}' of '${version.datasetId}'`;
+    const own = declaredByDataset().get(version.datasetId);
+    if (!own)
+      return conservatively(version, `dataset '${version.datasetId}' is not registered`);
+    const lineage = versionLineage(version, options.lakeStorage);
+    if (isUnknownLineage(lineage)) {
+      return conservatively(version, lineage === version.lineage ? `the lineage of ${subject} is unknown: ${lineage.unknown}` : lineage.unknown);
+    }
+    let conservative;
+    const markingsOf = (ref) => {
+      const columns = declaredByDataset().get(ref.datasetId);
+      if (columns)
+        return columns.get(ref.column);
+      conservative ??= `dataset '${ref.datasetId}' is not registered`;
+      return everyMarking();
+    };
+    const rows = sets.union(lineage.rows.map(markingsOf));
+    const columns = new Map(version.schema.columns.map(({ name }) => {
+      const values = lineageColumn(lineage, name);
+      if (!values) {
+        conservative ??= `${subject} recorded no lineage for column '${name}'`;
+        return [name, everyMarking()];
+      }
+      return [name, sets.union([own.get(name), rows, ...values.map(markingsOf)])];
+    }));
+    return { columns, ...conservative === undefined ? {} : { conservative } };
+  };
+  const conservatively = (version, reason) => {
+    const markings = everyMarking();
+    return {
+      columns: new Map(version.schema.columns.map(({ name }) => [name, markings])),
+      conservative: reason
+    };
+  };
+  return { classify, everyMarking };
+}
+var datasetVersionMarkingsKey = Symbol("sixb.datasetVersionMarkings");
+function registerDatasetVersionMarkings(owner, markings) {
+  const registered = owner[datasetVersionMarkingsKey];
+  if (registered && registered !== markings) {
+    throw new Error("[Sixb] Dataset version markings are already registered for this owner.");
+  }
+  Object.defineProperty(owner, datasetVersionMarkingsKey, {
+    configurable: false,
+    enumerable: false,
+    value: markings,
+    writable: false
+  });
+}
+function getDatasetVersionMarkings2(owner) {
+  const markings = owner[datasetVersionMarkingsKey];
+  if (markings)
+    return markings;
+  throw new Error("[Sixb] Dataset version markings are not registered for this runtime.");
+}
+function shareDatasetVersionMarkings2(source, target) {
+  registerDatasetVersionMarkings(target, getDatasetVersionMarkings2(source));
+}
+
+export { registeredSteps, runStepLineages, MarkingPropagation, validateProjectionMarkings, assertProjectionVersionMarkings2, describeOrigins, appliedContribution, eventOriginMarkings, producingPipelines, sentence, errorMessage, registerAppliedMarkings, getAppliedMarkings2, warmAppliedMarkings2, createDatasetVersionMarkings, registerDatasetVersionMarkings, getDatasetVersionMarkings2, shareDatasetVersionMarkings2 };
+
+//# debugId=BCFE94079FF12A1E64756E2164756E21