@sixb/core 0.1.20 → 0.1.21

package/dist/security/internal.js

@@ -0,0 +1,135 @@
+// @bun
+import"../chunk-x0v3jd47.js";
+import {
+  registeredSteps,
+  runStepLineages,
+  MarkingPropagation,
+  validateProjectionMarkings,
+  assertProjectionVersionMarkings2,
+  describeOrigins,
+  getAppliedMarkings2,
+  warmAppliedMarkings2,
+  getDatasetVersionMarkings2,
+  shareDatasetVersionMarkings2
+} from "../chunk-twe4dx8p.js";
+import {
+  stepInputColumns2,
+  stepReadColumns
+} from "../chunk-g5bvzyyr.js";
+import {
+  PipelineError2
+} from "../chunk-hke9aeen.js";
+import {
+  SecurityValidationError2
+} from "../chunk-jcfw4h7m.js";
+// src/security/pipeline-markings.ts
+async function checkPipelineMarkings(input) {
+  const { definitions, lakeStorage } = input;
+  const datasetsById = new Map(definitions.datasets.list().map((dataset) => [dataset.id, dataset]));
+  const steps = registeredSteps(definitions.pipelines.list());
+  const runLineageOf = runStepLineages(datasetsById);
+  const analyzed = new Map;
+  const lineageOf = (entry) => runLineageOf(entry) ?? analyzed.get(entry.step) ?? null;
+  const markings = new MarkingPropagation(datasetsById, steps).derive(lineageOf);
+  for (;; ) {
+    const wave = new Map;
+    for (const entry of steps) {
+      if (entry.step.executor.kind !== "sql" || analyzed.has(entry.step))
+        continue;
+      if (stepReadColumns(entry.step).some((ref) => markings.of(ref).size > 0)) {
+        if (!wave.has(entry.step))
+          wave.set(entry.step, entry);
+      }
+    }
+    if (wave.size === 0)
+      break;
+    await forEachConcurrently([...wave], ANALYSIS_CONCURRENCY, async ([step, entry]) => {
+      analyzed.set(step, await analyzeSqlStep(entry, markings, datasetsById, lakeStorage));
+    });
+    markings.derive(lineageOf);
+  }
+  validateProjectionMarkings(definitions.projections, definitions.ontology, markings);
+}
+var ANALYSIS_CONCURRENCY = 8;
+async function forEachConcurrently(items, limit, task) {
+  const pending = items.values();
+  let failed = false;
+  const worker = async () => {
+    for (const item of pending) {
+      if (failed)
+        return;
+      try {
+        await task(item);
+      } catch (error) {
+        failed = true;
+        throw error;
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+}
+async function analyzeSqlStep(entry, markings, datasetsById, lakeStorage) {
+  const { step } = entry;
+  const subject = `[Sixb] Pipeline '${entry.pipelineId}' step '${step.id}'`;
+  if (step.executor.kind !== "sql")
+    throw new PipelineError2(`${subject} is not a SQL step.`);
+  const sql = "sql" in lakeStorage ? lakeStorage.sql : undefined;
+  if (!sql?.analyze) {
+    throw new SecurityValidationError2(`${subject} reads ${describeMarkedRead(step, markings)}, but the lake provider cannot analyze SQL to derive the markings of its output. Use a lake provider that analyzes SQL, or pick only unmarked columns.`);
+  }
+  const inputs = Object.entries(step.inputs);
+  let analysis;
+  try {
+    analysis = await sql.analyze({
+      sql: step.executor.sql,
+      sources: Object.fromEntries(inputs.map(([name, dataset]) => [
+        name,
+        {
+          dataset: registeredDataset(datasetsById, dataset.id, subject),
+          columns: stepInputColumns2(dataset)
+        }
+      ]))
+    });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new PipelineError2(`${subject} could not be analyzed: ${reason}`, { cause: error });
+  }
+  if (!analysis.supported) {
+    throw new SecurityValidationError2(`${subject} reads ${describeMarkedRead(step, markings)}, but its SQL cannot be analyzed: ${analysis.reason}. Rewrite that part of the query, or pick only unmarked columns.`);
+  }
+  const datasetIdBySource = new Map(inputs.map(([name, dataset]) => [name, dataset.id]));
+  const toRef = (ref) => {
+    const datasetId = datasetIdBySource.get(ref.source);
+    if (datasetId === undefined) {
+      throw new PipelineError2(`${subject} analysis references unknown source '${ref.source}'.`);
+    }
+    return { datasetId, column: ref.column };
+  };
+  return {
+    rows: analysis.lineage.rows.map(toRef),
+    columns: Object.fromEntries(Object.entries(analysis.lineage.columns).map(([column, refs]) => [column, refs.map(toRef)]))
+  };
+}
+function describeMarkedRead(step, markings) {
+  const ref = stepReadColumns(step).find((candidate) => markings.of(candidate).size > 0);
+  if (!ref)
+    return "no marked column";
+  const path = `${ref.datasetId}.${ref.column}`;
+  return `column '${path}', which carries ${describeOrigins(markings.of(ref), path)}`;
+}
+function registeredDataset(datasetsById, datasetId, subject) {
+  const dataset = datasetsById.get(datasetId);
+  if (!dataset)
+    throw new PipelineError2(`${subject} reads unregistered dataset '${datasetId}'.`);
+  return dataset;
+}
+export {
+  assertProjectionVersionMarkings2 as assertProjectionVersionMarkings,
+  checkPipelineMarkings,
+  getAppliedMarkings2 as getAppliedMarkings,
+  getDatasetVersionMarkings2 as getDatasetVersionMarkings,
+  shareDatasetVersionMarkings2 as shareDatasetVersionMarkings,
+  warmAppliedMarkings2 as warmAppliedMarkings
+};
+
+//# debugId=02F47B8AEF3C739F64756E2164756E21

package/dist/security/internal.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/security/pipeline-markings.ts"],
+  "sourcesContent": [
+    "import type { DatasetDefinition } from \"../datasets/types\"\nimport type {\n  LakeStorageWithSql,\n  SqlTransformAnalysis,\n  SqlTransformColumnRef,\n} from \"../lake-storage/sql-transforms\"\nimport type { DatasetColumnLineage, DatasetColumnRef, LakeStorage } from \"../lake-storage/types\"\nimport { PipelineError } from \"../pipelines/errors\"\nimport { stepInputColumns, stepReadColumns } from \"../pipelines/lineage\"\nimport type { PipelineStepDefinition } from \"../pipelines/types\"\nimport type { SixbDefinitions } from \"../runtime/definitions\"\nimport { SecurityValidationError } from \"./errors\"\nimport {\n  type DatasetMarkings,\n  MarkingPropagation,\n  type RegisteredStep,\n  registeredSteps,\n  runStepLineages,\n} from \"./marking-propagation\"\nimport { describeOrigins, validateProjectionMarkings } from \"./projection-markings\"\n\n/**\n * Derive the markings SQL steps give their outputs and check every projection against them.\n *\n * Startup cannot see through SQL, so this preflight completes it before a host serves traffic. It\n * is a diagnostic: each version records the lineage of the SQL that actually ran, and reads and\n * projections enforce markings from that record whether or not this ran.\n *\n * Only steps that read a marked column are analyzed, each step once. Analyzing a step can mark\n * the inputs of others, so steps are analyzed in waves, a few at a time within a wave. A step whose\n * SQL cannot be analyzed, or a lake provider that cannot analyze SQL, is reported with the step\n * and a marked column it reads.\n */\nexport async function checkPipelineMarkings(input: {\n  readonly definitions: Pick<SixbDefinitions, \"ontology\" | \"datasets\" | \"pipelines\" | \"projections\">\n  readonly lakeStorage: LakeStorage | LakeStorageWithSql\n}): Promise<void> {\n  const { definitions, lakeStorage } = input\n  const datasetsById = new Map(definitions.datasets.list().map((dataset) => [dataset.id, dataset]))\n  const steps = registeredSteps(definitions.pipelines.list())\n  const runLineageOf = runStepLineages(datasetsById)\n  const analyzed = new Map<PipelineStepDefinition, DatasetColumnLineage>()\n  const lineageOf = (entry: RegisteredStep) =>\n    runLineageOf(entry) ?? analyzed.get(entry.step) ?? null\n\n  const markings = new MarkingPropagation(datasetsById, steps).derive(lineageOf)\n\n  for (;;) {\n    const wave = new Map<PipelineStepDefinition, RegisteredStep>()\n    for (const entry of steps) {\n      if (entry.step.executor.kind !== \"sql\" || analyzed.has(entry.step)) continue\n      if (stepReadColumns(entry.step).some((ref) => markings.of(ref).size > 0)) {\n        if (!wave.has(entry.step)) wave.set(entry.step, entry)\n      }\n    }\n\n    if (wave.size === 0) break\n\n    await forEachConcurrently([...wave], ANALYSIS_CONCURRENCY, async ([step, entry]) => {\n      analyzed.set(step, await analyzeSqlStep(entry, markings, datasetsById, lakeStorage))\n    })\n    markings.derive(lineageOf)\n  }\n\n  validateProjectionMarkings(definitions.projections, definitions.ontology, markings)\n}\n\n/** Analyses run at once. A provider may open a database per analysis, so a wave is not unbounded. */\nconst ANALYSIS_CONCURRENCY = 8\n\n/** Run `task` on each item, `limit` at a time. Stops starting new tasks once one fails. */\nasync function forEachConcurrently<TItem>(\n  items: readonly TItem[],\n  limit: number,\n  task: (item: TItem) => Promise<void>\n): Promise<void> {\n  const pending = items.values()\n  let failed = false\n\n  const worker = async () => {\n    for (const item of pending) {\n      if (failed) return\n\n      try {\n        await task(item)\n      } catch (error) {\n        failed = true\n        throw error\n      }\n    }\n  }\n\n  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker))\n}\n\nasync function analyzeSqlStep(\n  entry: RegisteredStep,\n  markings: DatasetMarkings,\n  datasetsById: ReadonlyMap<string, DatasetDefinition>,\n  lakeStorage: LakeStorage | LakeStorageWithSql\n): Promise<DatasetColumnLineage> {\n  const { step } = entry\n  const subject = `[Sixb] Pipeline '${entry.pipelineId}' step '${step.id}'`\n\n  if (step.executor.kind !== \"sql\") throw new PipelineError(`${subject} is not a SQL step.`)\n\n  const sql = \"sql\" in lakeStorage ? lakeStorage.sql : undefined\n  if (!sql?.analyze) {\n    throw new SecurityValidationError(\n      `${subject} reads ${describeMarkedRead(step, markings)}, but the lake provider cannot analyze SQL to derive the markings of its output. Use a lake provider that analyzes SQL, or pick only unmarked columns.`\n    )\n  }\n\n  const inputs = Object.entries(step.inputs)\n  let analysis: SqlTransformAnalysis\n  try {\n    analysis = await sql.analyze({\n      sql: step.executor.sql,\n      sources: Object.fromEntries(\n        inputs.map(([name, dataset]) => [\n          name,\n          {\n            dataset: registeredDataset(datasetsById, dataset.id, subject),\n            columns: stepInputColumns(dataset),\n          },\n        ])\n      ),\n    })\n  } catch (error) {\n    const reason = error instanceof Error ? error.message : String(error)\n    throw new PipelineError(`${subject} could not be analyzed: ${reason}`, { cause: error })\n  }\n\n  if (!analysis.supported) {\n    throw new SecurityValidationError(\n      `${subject} reads ${describeMarkedRead(step, markings)}, but its SQL cannot be analyzed: ${analysis.reason}. Rewrite that part of the query, or pick only unmarked columns.`\n    )\n  }\n\n  const datasetIdBySource = new Map(inputs.map(([name, dataset]) => [name, dataset.id]))\n  const toRef = (ref: SqlTransformColumnRef): DatasetColumnRef => {\n    const datasetId = datasetIdBySource.get(ref.source)\n    if (datasetId === undefined) {\n      throw new PipelineError(`${subject} analysis references unknown source '${ref.source}'.`)\n    }\n\n    return { datasetId, column: ref.column }\n  }\n\n  return {\n    rows: analysis.lineage.rows.map(toRef),\n    columns: Object.fromEntries(\n      Object.entries(analysis.lineage.columns).map(([column, refs]) => [column, refs.map(toRef)])\n    ),\n  }\n}\n\n/** A marked column the step reads, for messages. */\nfunction describeMarkedRead(step: PipelineStepDefinition, markings: DatasetMarkings): string {\n  const ref = stepReadColumns(step).find((candidate) => markings.of(candidate).size > 0)\n  if (!ref) return \"no marked column\"\n\n  const path = `${ref.datasetId}.${ref.column}`\n  return `column '${path}', which carries ${describeOrigins(markings.of(ref), path)}`\n}\n\nfunction registeredDataset(\n  datasetsById: ReadonlyMap<string, DatasetDefinition>,\n  datasetId: string,\n  subject: string\n): DatasetDefinition {\n  const dataset = datasetsById.get(datasetId)\n  if (!dataset) throw new PipelineError(`${subject} reads unregistered dataset '${datasetId}'.`)\n  return dataset\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,eAAsB,qBAAqB,CAAC,OAG1B;AAAA,EAChB,QAAQ,aAAa,gBAAgB;AAAA,EACrC,MAAM,eAAe,IAAI,IAAI,YAAY,SAAS,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC;AAAA,EAChG,MAAM,QAAQ,gBAAgB,YAAY,UAAU,KAAK,CAAC;AAAA,EAC1D,MAAM,eAAe,gBAAgB,YAAY;AAAA,EACjD,MAAM,WAAW,IAAI;AAAA,EACrB,MAAM,YAAY,CAAC,UACjB,aAAa,KAAK,KAAK,SAAS,IAAI,MAAM,IAAI,KAAK;AAAA,EAErD,MAAM,WAAW,IAAI,mBAAmB,cAAc,KAAK,EAAE,OAAO,SAAS;AAAA,EAE7E,UAAS;AAAA,IACP,MAAM,OAAO,IAAI;AAAA,IACjB,WAAW,SAAS,OAAO;AAAA,MACzB,IAAI,MAAM,KAAK,SAAS,SAAS,SAAS,SAAS,IAAI,MAAM,IAAI;AAAA,QAAG;AAAA,MACpE,IAAI,gBAAgB,MAAM,IAAI,EAAE,KAAK,CAAC,QAAQ,SAAS,GAAG,GAAG,EAAE,OAAO,CAAC,GAAG;AAAA,QACxE,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI;AAAA,UAAG,KAAK,IAAI,MAAM,MAAM,KAAK;AAAA,MACvD;AAAA,IACF;AAAA,IAEA,IAAI,KAAK,SAAS;AAAA,MAAG;AAAA,IAErB,MAAM,oBAAoB,CAAC,GAAG,IAAI,GAAG,sBAAsB,QAAQ,MAAM,WAAW;AAAA,MAClF,SAAS,IAAI,MAAM,MAAM,eAAe,OAAO,UAAU,cAAc,WAAW,CAAC;AAAA,KACpF;AAAA,IACD,SAAS,OAAO,SAAS;AAAA,EAC3B;AAAA,EAEA,2BAA2B,YAAY,aAAa,YAAY,UAAU,QAAQ;AAAA;AAIpF,IAAM,uBAAuB;AAG7B,eAAe,mBAA0B,CACvC,OACA,OACA,MACe;AAAA,EACf,MAAM,UAAU,MAAM,OAAO;AAAA,EAC7B,IAAI,SAAS;AAAA,EAEb,MAAM,SAAS,YAAY;AAAA,IACzB,WAAW,QAAQ,SAAS;AAAA,MAC1B,IAAI;AAAA,QAAQ;AAAA,MAEZ,IAAI;AAAA,QACF,MAAM,KAAK,IAAI;AAAA,QACf,OAAO,OAAO;AAAA,QACd,SAAS;AAAA,QACT,MAAM;AAAA;AAAA,IAEV;AAAA;AAAA,EAGF,MAAM,QAAQ,IAAI,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,OAAO,MAAM,MAAM,EAAE,GAAG,MAAM,CAAC;AAAA;AAGjF,eAAe,cAAc,CAC3B,OACA,UACA,cACA,aAC+B;AAAA,EAC/B,QAAQ,SAAS;AAAA,EACjB,MAAM,UAAU,oBAAoB,MAAM,qBAAqB,KAAK;AAAA,EAEpE,IAAI,KAAK,SAAS,SAAS;AAAA,IAAO,MAAM,IAAI,eAAc,GAAG,4BAA4B;AAAA,EAEzF,MAAM,MAAM,SAAS,cAAc,YAAY,MAAM;AAAA,EACrD,IAAI,CAAC,KAAK,SAAS;AAAA,IACjB,MAAM,IAAI,yBACR,GAAG,iBAAiB,mBAAmB,MAAM,QAAQ,yJACvD;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,OAAO,QAAQ,KAAK,MAAM;AAAA,EACzC,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,WAAW,MAAM,IAAI,QAAQ;AAAA,MAC3B,KAAK,KAAK,SAAS;AAAA,MACnB,SAAS,OAAO,YACd,OAAO,IAAI,EAAE,MAAM,aAAa;AAAA,QAC9B;AAAA,QACA;AAAA,UACE,SAAS,kBAAkB,cAAc,QAAQ,IAAI,OAAO;AAAA,UAC5D,SAAS,kBAAiB,OAAO;AAAA,QACnC;AAAA,MACF,CAAC,CACH;AAAA,IACF,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACpE,MAAM,IAAI,eAAc,GAAG,kCAAkC,UAAU,EAAE,OAAO,MAAM,CAAC;AAAA;AAAA,EAGzF,IAAI,CAAC,SAAS,WAAW;AAAA,IACvB,MAAM,IAAI,yBACR,GAAG,iBAAiB,mBAAmB,MAAM,QAAQ,sCAAsC,SAAS,wEACtG;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,IAAI,IAAI,OAAO,IAAI,EAAE,MAAM,aAAa,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC;AAAA,EACrF,MAAM,QAAQ,CAAC,QAAiD;AAAA,IAC9D,MAAM,YAAY,kBAAkB,IAAI,IAAI,MAAM;AAAA,IAClD,IAAI,cAAc,WAAW;AAAA,MAC3B,MAAM,IAAI,eAAc,GAAG,+CAA+C,IAAI,UAAU;AAAA,IAC1F;AAAA,IAEA,OAAO,EAAE,WAAW,QAAQ,IAAI,OAAO;AAAA;AAAA,EAGzC,OAAO;AAAA,IACL,MAAM,SAAS,QAAQ,KAAK,IAAI,KAAK;AAAA,IACrC,SAAS,OAAO,YACd,OAAO,QAAQ,SAAS,QAAQ,OAAO,EAAE,IAAI,EAAE,QAAQ,UAAU,CAAC,QAAQ,KAAK,IAAI,KAAK,CAAC,CAAC,CAC5F;AAAA,EACF;AAAA;AAIF,SAAS,kBAAkB,CAAC,MAA8B,UAAmC;AAAA,EAC3F,MAAM,MAAM,gBAAgB,IAAI,EAAE,KAAK,CAAC,cAAc,SAAS,GAAG,SAAS,EAAE,OAAO,CAAC;AAAA,EACrF,IAAI,CAAC;AAAA,IAAK,OAAO;AAAA,EAEjB,MAAM,OAAO,GAAG,IAAI,aAAa,IAAI;AAAA,EACrC,OAAO,WAAW,wBAAwB,gBAAgB,SAAS,GAAG,GAAG,GAAG,IAAI;AAAA;AAGlF,SAAS,iBAAiB,CACxB,cACA,WACA,SACmB;AAAA,EACnB,MAAM,UAAU,aAAa,IAAI,SAAS;AAAA,EAC1C,IAAI,CAAC;AAAA,IAAS,MAAM,IAAI,eAAc,GAAG,uCAAuC,aAAa;AAAA,EAC7F,OAAO;AAAA;",
+  "debugId": "02F47B8AEF3C739F64756E2164756E21",
+  "names": []
+}

package/dist/security/marking-propagation.d.ts

@@ -0,0 +1,62 @@
+import type { DatasetDefinition } from "../datasets/types";
+import type { DatasetColumnLineage, DatasetColumnRef } from "../lake-storage/types";
+import type { PipelineDefinition, PipelineStepDefinition } from "../pipelines/types";
+/** A step of a registered pipeline. A step reused by two pipelines is two registered steps. */
+export interface RegisteredStep {
+    readonly pipelineId: string;
+    readonly step: PipelineStepDefinition;
+}
+/** The column that declares a marking, and the steps it went through to reach a column. */
+export interface MarkingOrigin {
+    readonly column: DatasetColumnRef;
+    /** `pipeline/step`, upstream first. Empty when the column declares the marking itself. */
+    readonly steps: readonly string[];
+}
+/** Each marking a column carries, with one path it arrived by. */
+export type ColumnMarkingOrigins = ReadonlyMap<string, MarkingOrigin>;
+/** Markings of every column of every registered dataset, derived from the definitions. */
+export interface DatasetMarkings {
+    /** Empty for a column without markings or that is not registered. */
+    of(column: DatasetColumnRef): ColumnMarkingOrigins;
+}
+export declare function registeredSteps(pipelines: readonly PipelineDefinition[]): readonly RegisteredStep[];
+/** Lineage of each `run` step, built once per step object; undefined for other steps. */
+export declare function runStepLineages(datasetsById: ReadonlyMap<string, DatasetDefinition>): (entry: RegisteredStep) => DatasetColumnLineage | undefined;
+export declare function stepLabel(entry: RegisteredStep): string;
+/**
+ * Markings each column carries according to the registered definitions: the ones it declares, and
+ * the ones each step derives from the columns it depends on, once that step's lineage is known.
+ *
+ * What decided the rows of a step's inputs decides the rows of its output, whether or not the step
+ * reads a column of that input: `SELECT count(*) FROM rich` reveals which rows `rich` holds. So
+ * each dataset also keeps the markings of its row dependencies, and every output column of a step
+ * carries those of every input it reads, as the lineage each version records does.
+ *
+ * A step may read its own output and a dataset may have several producers, so a step whose output
+ * gains a marking queues the steps that read that output, until nothing changes. Lineage can be
+ * added in rounds: each round only revisits what the new lineage reaches.
+ */
+export declare class MarkingPropagation implements DatasetMarkings {
+    private readonly datasetsById;
+    /** Marked columns only, by dataset, built when a dataset is first looked at. */
+    private readonly markings;
+    /** Markings of what decides each dataset's rows, for datasets a step writes. */
+    private readonly rowMarkings;
+    private readonly ordered;
+    private readonly readers;
+    private readonly known;
+    private readonly queue;
+    constructor(datasetsById: ReadonlyMap<string, DatasetDefinition>, steps: readonly RegisteredStep[]);
+    of(ref: DatasetColumnRef): ColumnMarkingOrigins;
+    /**
+     * Derive markings through every step `lineageOf` knows the lineage of. A step it returns null
+     * for derives nothing until a later call knows it.
+     */
+    derive(lineageOf: (entry: RegisteredStep) => DatasetColumnLineage | null): this;
+    /** Whether the output's rows or any output column gained a marking. */
+    private apply;
+    private markedColumns;
+    /** Every marking of these columns, each with the first origin found. */
+    private union;
+}
+//# sourceMappingURL=marking-propagation.d.ts.map

package/dist/security/marking-propagation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marking-propagation.d.ts","sourceRoot":"","sources":["../../src/security/marking-propagation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAEnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAEpF,+FAA+F;AAC/F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;CACtC;AAED,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED,kEAAkE;AAClE,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAErE,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,EAAE,CAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,CAAA;CACnD;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,kBAAkB,EAAE,GACvC,SAAS,cAAc,EAAE,CAI3B;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAC7B,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,GACnD,CAAC,KAAK,EAAE,cAAc,KAAK,oBAAoB,GAAG,SAAS,CAc7D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAEvD;AAYD;;;;;;;;;;;;GAYG;AACH,qBAAa,kBAAmB,YAAW,eAAe;IACxD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;IACrE,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiD;IAC1E,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;gBAGhD,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACpD,KAAK,EAAE,SAAS,cAAc,EAAE;IAYlC,EAAE,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB;IAI/C;;;OAGG;IACH,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,oBAAoB,GAAG,IAAI,GAAG,IAAI;IAyB/E,uEAAuE;IACvE,OAAO,CAAC,KAAK;IAmDb,OAAO,CAAC,aAAa;IAiBrB,wEAAwE;IACxE,OAAO,CAAC,KAAK;CASd"}

package/dist/security/marking-sets.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Shared, immutable sets of marking ids.
+ *
+ * Every column of every resolved version holds one of a handful of distinct sets, so each distinct
+ * set is created once and compared by identity.
+ */
+export declare class MarkingSets {
+    readonly empty: ReadonlySet<string>;
+    private readonly sets;
+    of(markingIds: Iterable<string> | undefined): ReadonlySet<string>;
+    /** The union of sets this instance created. */
+    union(sets: Iterable<ReadonlySet<string> | undefined>): ReadonlySet<string>;
+}
+//# sourceMappingURL=marking-sets.d.ts.map

package/dist/security/marking-sets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marking-sets.d.ts","sourceRoot":"","sources":["../../src/security/marking-sets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,WAAW;IACtB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAY;IAC/C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2D;IAEhF,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC;IAkBjE,+CAA+C;IAC/C,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC;CAY5E"}

package/dist/security/markings.d.ts

@@ -5,9 +5,12 @@ import type { ProjectionDefinitionCatalog } from "../projections/registry";
 /**
  * Check every marking once at startup.
  *
- * A marking is enforced at read time from the property or column definition alone, so each rule
- * here closes a path that would otherwise return the value unredacted or make enforcement
- * ambiguous.
+ * A marking is enforced at read time from the property or column definition and the lineage of
+ * the version read, so each rule here closes a path that would otherwise return the value
+ * unredacted or make enforcement ambiguous.
+ *
+ * Projections are checked against the markings columns declare or inherit through `run` steps.
+ * What SQL steps derive needs the lake provider's analysis, which `checkPipelineMarkings` adds.
  */
 export declare function validateMarkingsAtStartup(input: {
     readonly markingIds: ReadonlySet<string>;

package/dist/security/markings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markings.d.ts","sourceRoot":"","sources":["../../src/security/markings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAErE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAA;AAI1E;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAA;IAC5C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC7D,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAA;CAClD,GAAG,IAAI,CAKP"}
+{"version":3,"file":"markings.d.ts","sourceRoot":"","sources":["../../src/security/markings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAErE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAA;AAK1E;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAA;IAC5C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC7D,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAA;CAClD,GAAG,IAAI,CAWP"}

package/dist/security/pipeline-markings.d.ts

@@ -0,0 +1,20 @@
+import type { LakeStorageWithSql } from "../lake-storage/sql-transforms";
+import type { LakeStorage } from "../lake-storage/types";
+import type { SixbDefinitions } from "../runtime/definitions";
+/**
+ * Derive the markings SQL steps give their outputs and check every projection against them.
+ *
+ * Startup cannot see through SQL, so this preflight completes it before a host serves traffic. It
+ * is a diagnostic: each version records the lineage of the SQL that actually ran, and reads and
+ * projections enforce markings from that record whether or not this ran.
+ *
+ * Only steps that read a marked column are analyzed, each step once. Analyzing a step can mark
+ * the inputs of others, so steps are analyzed in waves, a few at a time within a wave. A step whose
+ * SQL cannot be analyzed, or a lake provider that cannot analyze SQL, is reported with the step
+ * and a marked column it reads.
+ */
+export declare function checkPipelineMarkings(input: {
+    readonly definitions: Pick<SixbDefinitions, "ontology" | "datasets" | "pipelines" | "projections">;
+    readonly lakeStorage: LakeStorage | LakeStorageWithSql;
+}): Promise<void>;
+//# sourceMappingURL=pipeline-markings.d.ts.map

package/dist/security/pipeline-markings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-markings.d.ts","sourceRoot":"","sources":["../../src/security/pipeline-markings.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,kBAAkB,EAGnB,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAA0C,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAIhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAW7D;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC,CAAA;IAClG,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,kBAAkB,CAAA;CACvD,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BhB"}

package/dist/security/project.d.ts

@@ -0,0 +1,4 @@
+import type { ProjectReference } from "./types";
+/** Project-wide surfaces used in security grants such as `can.observe(project.logs)`. */
+export declare const project: ProjectReference;
+//# sourceMappingURL=project.d.ts.map

package/dist/security/project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../src/security/project.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAE/C,yFAAyF;AACzF,eAAO,MAAM,OAAO,EAAE,gBAIpB,CAAA"}

package/dist/security/projection-markings.d.ts

@@ -0,0 +1,71 @@
+import type { DatasetVersion } from "../lake-storage/types";
+import type { OntologyDefinitionCatalog } from "../ontology/registry";
+import type { ProjectionDefinitionCatalog } from "../projections/registry";
+import type { ProjectionDefinition } from "../projections/types";
+import type { VersionClassification } from "./dataset-version-markings";
+import type { ColumnMarkingOrigins, DatasetMarkings } from "./marking-propagation";
+type OntologyLookup = Pick<OntologyDefinitionCatalog, "getObjectTypeById">;
+/** Markings of one column of the projection's dataset. */
+type ColumnMarkingsLookup = (column: string) => readonly string[];
+/** What a marked key column makes unreadable: the objects it identifies, or the link it keys. */
+export type ProjectionKeyTarget = {
+    readonly kind: "type";
+    readonly objectTypeId: string;
+} | {
+    readonly kind: "link";
+    readonly objectTypeId: string;
+    readonly linkId: string;
+    readonly targetObjectTypeId: string;
+};
+/**
+ * Objects are read through the ontology, so each projected property declares the markings of its
+ * column: the ontology stays the reviewed contract of what each reader receives. Values that
+ * identify objects or key links are returned wherever the object or link is, and telemetry does
+ * not enforce markings yet, so those columns cannot carry markings.
+ *
+ * Startup checks it with the markings columns declare or inherit through `run` steps, and the
+ * pipeline preflight with the markings SQL steps derive as well.
+ */
+export declare function validateProjectionMarkings(projections: ProjectionDefinitionCatalog, ontology: OntologyLookup, markings: DatasetMarkings): void;
+/**
+ * Refuse to project a dataset version whose columns carry more markings than the projection
+ * allows. A version keeps the markings of the code that produced it, so a version written before
+ * the current code can carry markings startup did not see. Call it once per version, before
+ * reading its rows; it reads nothing, so what it throws is a refusal that no retry changes.
+ */
+export declare function assertProjectionVersionMarkings(input: {
+    readonly projection: ProjectionDefinition;
+    readonly ontology: OntologyLookup;
+    readonly version: DatasetVersion;
+    readonly classification: VersionClassification;
+}): void;
+/** Markings an applied version gives a projection's targets beyond what the ontology declares. */
+export interface ProjectionSurplus {
+    /** Markings a mapped column carries that its property does not declare. */
+    readonly properties: readonly {
+        readonly objectTypeId: string;
+        readonly propertyId: string;
+        readonly column: string;
+        readonly markings: readonly string[];
+    }[];
+    /** Marked key columns, with what each one makes unreadable and why. */
+    readonly keys: readonly {
+        readonly target: ProjectionKeyTarget;
+        readonly column: string;
+        readonly role: string;
+        readonly markings: readonly string[];
+    }[];
+}
+/**
+ * What a projection's targets carry beyond their declarations when read from columns with these
+ * markings: every rule it breaks, as markings to add to properties and to key targets. A property
+ * that keys a link keeps its markings on the property as well.
+ */
+export declare function projectionSurplus(projection: ProjectionDefinition, ontology: OntologyLookup, markingsOf: ColumnMarkingsLookup): ProjectionSurplus;
+/**
+ * `[financial] from 'raw_invoices.amount' through step 'invoices/normalize'`: each marking with one
+ * path it arrived by. Markings the column declares itself have no path.
+ */
+export declare function describeOrigins(origins: ColumnMarkingOrigins, columnPath: string): string;
+export {};
+//# sourceMappingURL=projection-markings.d.ts.map

package/dist/security/projection-markings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection-markings.d.ts","sourceRoot":"","sources":["../../src/security/projection-markings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAErE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,KAAK,EAGV,oBAAoB,EAErB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAEvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAiB,MAAM,uBAAuB,CAAA;AAEjG,KAAK,cAAc,GAAG,IAAI,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,CAAA;AAE1E,0DAA0D;AAC1D,KAAK,oBAAoB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;AAEjE,iGAAiG;AACjG,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CACpC,CAAA;AAuBL;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,2BAA2B,EACxC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,eAAe,GACxB,IAAI,CA+BN;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;IACzC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAA;CAC/C,GAAG,IAAI,CAoBP;AAED,kGAAkG;AAClG,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS;QAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KACrC,EAAE,CAAA;IACH,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,SAAS;QACtB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;QACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KACrC,EAAE,CAAA;CACJ;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,oBAAoB,EAChC,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,oBAAoB,GAC/B,iBAAiB,CAkCnB;AA+MD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAOzF"}

package/dist/security/public.js

@@ -1,8 +1,8 @@
 // @bun
-import"../chunk-gsjm1wms.js";
+import"../chunk-dhdha526.js";
 import {
   defineGroup2
-} from "../chunk-es1gxsbf.js";
+} from "../chunk-f4pamkt9.js";
 export {
   defineGroup2 as defineGroup
 };

package/dist/security/redactions.d.ts

@@ -1,4 +1,7 @@
 import type { Redactions } from "./types";
-/** List the values hidden from a reader that lacks a clearance for their markings. */
+/**
+ * List the values hidden from a reader that lacks a clearance for their markings. Deeply frozen,
+ * so every row and event redacted the same way can share it.
+ */
 export declare function missingClearanceRedactions(ids: Iterable<string>): Redactions;
 //# sourceMappingURL=redactions.d.ts.map

package/dist/security/redactions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redactions.d.ts","sourceRoot":"","sources":["../../src/security/redactions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEzC,sFAAsF;AACtF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,UAAU,CAE5E"}
+{"version":3,"file":"redactions.d.ts","sourceRoot":"","sources":["../../src/security/redactions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAIzC;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,UAAU,CAE5E"}

package/dist/security/types.d.ts

@@ -107,8 +107,28 @@ export interface AgentRunGrant {
     readonly capability: "run";
     readonly target: "agent";
 }
-export type ObserveGrantTarget = "logs" | "aiUsage";
-/** Read the project's logs or its AI usage. Each is one surface, so there is nothing to select. */
+export type ObserveGrantTarget = "logs" | "aiUsage" | "activity";
+/**
+ * Project-wide surfaces used in security grants such as `can.observe(project.logs)`. Each member's
+ * `kind` is the grant target it selects.
+ */
+export interface ProjectReference {
+    readonly kind: "project";
+    /** The project's captured logs. */
+    readonly logs: {
+        readonly kind: "logs";
+    };
+    /** Visits and page views recorded in the project's app. */
+    readonly activity: {
+        readonly kind: "activity";
+    };
+}
+/** Any member of `project`, such as `project.logs`. */
+export type ProjectSurfaceReference = ProjectReference[Exclude<keyof ProjectReference, "kind">];
+/**
+ * Read the project's logs, its AI usage or its app activity. Each is one surface, so there is
+ * nothing to select.
+ */
 export interface ObserveGrant {
     readonly kind: "grant";
     readonly capability: "observe";

package/dist/security/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC1D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC5D,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,2CAA2C;AAC3C,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAA;AAEjD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC,CAAC,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,MAAM,CAAA;AAErD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAE5D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,CAAA;AAElD,MAAM,WAAW,SAAS,CAAC,OAAO,SAAS,eAAe,GAAG,eAAe;IAC1E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAA;AAE7D,MAAM,WAAW,QAAQ,CAAC,OAAO,SAAS,cAAc,GAAG,cAAc;IACvE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAAA;AAEnD,mGAAmG;AACnG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CACpC;AAED,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,SAAS,CAAA;AAEvD;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,OAAO,SAAS,iBAAiB,GAAG,iBAAiB,IAC3E,OAAO,SAAS,WAAW,GACvB;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB,CAAA;AAEP,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,SAAS,GACT,WAAW,GACX,UAAU,GACV,UAAU,GACV,QAAQ,GACR,aAAa,GACb,YAAY,GACZ,WAAW,CAAA;AAEf,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;AAE3D,MAAM,WAAW,cAAc,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,GAAG,iBAAiB,CAAA;AAE3F,MAAM,WAAW,0BAA0B,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IACrE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAC7C;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC/C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC7D,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACzD,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACvD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;CACjF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC1D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC5D,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,2CAA2C;AAC3C,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAA;AAEjD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC,CAAC,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,MAAM,CAAA;AAErD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAE5D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,CAAA;AAElD,MAAM,WAAW,SAAS,CAAC,OAAO,SAAS,eAAe,GAAG,eAAe;IAC1E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAA;AAE7D,MAAM,WAAW,QAAQ,CAAC,OAAO,SAAS,cAAc,GAAG,cAAc;IACvE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAA;AAEhE;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,mCAAmC;IACnC,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAA;CACjD;AAED,uDAAuD;AACvD,MAAM,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAA;AAE/F;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CACpC;AAED,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,SAAS,CAAA;AAEvD;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,OAAO,SAAS,iBAAiB,GAAG,iBAAiB,IAC3E,OAAO,SAAS,WAAW,GACvB;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB,CAAA;AAEP,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,SAAS,GACT,WAAW,GACX,UAAU,GACV,UAAU,GACV,QAAQ,GACR,aAAa,GACb,YAAY,GACZ,WAAW,CAAA;AAEf,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;AAE3D,MAAM,WAAW,cAAc,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,GAAG,iBAAiB,CAAA;AAE3F,MAAM,WAAW,0BAA0B,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IACrE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAC7C;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC/C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC7D,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACzD,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACvD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;CACjF"}

package/dist/security/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/security/validation.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAEV,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,cAAc,EAEf,MAAM,SAAS,CAAA;AAiChB,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,KAAK,CAAA;AAI5D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,MAAM,CAIzB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,MAAM,GAAG,SAAS,CAQrC;AA2DD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAYpC;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAO9E;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,eAAe,CAYlC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAO1E;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,0BAA0B,CAiB7C;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,0BAA0B,CAOhG;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,eAAe,CA+ClC;AAqBD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,cAAc,CAyBjC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAOxE;AAED,wBAAgB,oCAAoC,CAAC,KAAK,EAAE;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,mFAAmF;IACnF,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,uEAAuE;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACxC,GAAG,6BAA6B,CA4HhC"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/security/validation.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAEV,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,cAAc,EAEf,MAAM,SAAS,CAAA;AAiChB,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,KAAK,CAAA;AAI5D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,MAAM,CAIzB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,MAAM,GAAG,SAAS,CAQrC;AA2DD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAYpC;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAO9E;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,eAAe,CAYlC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAO1E;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,0BAA0B,CAiB7C;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,0BAA0B,CAOhG;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,eAAe,CAsDlC;AAqBD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,cAAc,CAyBjC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAOxE;AAED,wBAAgB,oCAAoC,CAAC,KAAK,EAAE;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,mFAAmF;IACnF,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,uEAAuE;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACxC,GAAG,6BAA6B,CA4HhC"}

package/dist/shares/internal.js

@@ -1,56 +1,57 @@
 // @bun
 import"../chunk-a40ad1ft.js";
-import"../chunk-8mx7qw3y.js";
-import"../chunk-z3y5kg1x.js";
-import"../chunk-b38szspf.js";
+import"../chunk-dvd2fp9q.js";
+import"../chunk-6eqsgvxk.js";
+import"../chunk-dhcv7yxc.js";
 import {
   formatSessionCookieValue2,
   parseSessionCookieValue2
-} from "../chunk-vpq4shxz.js";
-import"../chunk-gsjm1wms.js";
-import"../chunk-d0bqz29d.js";
+} from "../chunk-nn5xnx3s.js";
+import"../chunk-dhdha526.js";
+import"../chunk-6vb4st8k.js";
 import"../chunk-v4jbb3rs.js";
-import"../chunk-jhm3zsa7.js";
-import"../chunk-hvsb78a1.js";
-import"../chunk-es1gxsbf.js";
-import"../chunk-v9xd5wzd.js";
+import"../chunk-wkv3h3q7.js";
+import"../chunk-8frc8a4j.js";
+import"../chunk-f4pamkt9.js";
+import"../chunk-s7jg7pmn.js";
 import"../chunk-hcbyfxbe.js";
 import"../chunk-pqajwytd.js";
 import"../chunk-29yx306f.js";
-import"../chunk-gfdh9kqa.js";
-import"../chunk-gc4ntf7d.js";
-import"../chunk-s54c868q.js";
+import"../chunk-3qct2mdc.js";
 import"../chunk-ere85b8y.js";
 import"../chunk-4as3wt1c.js";
 import"../chunk-h89wz928.js";
-import"../chunk-9w055r5b.js";
-import"../chunk-tw03bsmb.js";
-import"../chunk-d09tj99x.js";
+import"../chunk-d09e3rax.js";
+import"../chunk-tbc1ngpd.js";
+import"../chunk-gfdh9kqa.js";
+import"../chunk-cwdzcv37.js";
+import"../chunk-eptrvnby.js";
+import"../chunk-g257jwnc.js";
 import"../chunk-7n440zgt.js";
-import"../chunk-n33z5bjw.js";
+import"../chunk-918wwnaa.js";
 import"../chunk-pbcbn83d.js";
 import"../chunk-qczk96d9.js";
 import"../chunk-mmagke4x.js";
 import"../chunk-hn2r7z41.js";
-import"../chunk-9ybhtmg4.js";
+import"../chunk-vvxtn22d.js";
 import"../chunk-jmfet9r4.js";
 import"../chunk-qf954wje.js";
-import"../chunk-rrzt8jdy.js";
+import"../chunk-x0v3jd47.js";
+import"../chunk-9j4jw7as.js";
 import {
   intersectShareAccessPlans
 } from "../chunk-x9v4cx1d.js";
 import {
   compileShareAccessPlan
-} from "../chunk-fkgc1wt8.js";
+} from "../chunk-z58tm0hm.js";
 import {
   snapshotShareAccessPlan
 } from "../chunk-br3k6qbf.js";
 import {
   ShareSessionStorageError2
 } from "../chunk-z8fx5cgb.js";
-import"../chunk-s16apyk9.js";
 import"../chunk-rj69qcrd.js";
-import"../chunk-c85m1hyj.js";
+import"../chunk-447a5c0p.js";
 
 // src/shares/session-protocol.ts
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "crypto";
@@ -234,4 +235,4 @@ export {
   SharedSessionProtocol
 };
 
-//# debugId=34911D02E010DC8E64756E2164756E21
+//# debugId=C3C5BDA4DF19C4DF64756E2164756E21

package/dist/shares/internal.js.map

@@ -4,7 +4,7 @@
   "sourcesContent": [
     "import { createHash, randomBytes, randomUUID, timingSafeEqual } from \"node:crypto\"\nimport { formatSessionCookieValue, parseSessionCookieValue } from \"../auth/sessions\"\nimport type { SixbHostView } from \"../runtime\"\nimport type { ShareGrantRecord, ShareSessionRecord, Storage } from \"../storage\"\nimport { ShareSessionStorageError } from \"../storage\"\nimport { type ShareAccessPlan, snapshotShareAccessPlan } from \"./access-plan\"\nimport { compileShareAccessPlan } from \"./compiler\"\nimport { intersectShareAccessPlans } from \"./intersection\"\n\nexport const DEFAULT_SHARED_SESSION_INACTIVITY_TTL_MS = 15 * 60_000\n\nconst MAX_CREATE_ATTEMPTS = 5\nconst SECRET_PATTERN = /^[A-Za-z0-9_-]{43}$/\n\nexport interface SharedSessionContext {\n  readonly grantId: string\n  readonly sessionId: string\n  readonly destinationPath: string\n  readonly access: ShareAccessPlan\n  readonly expiresAt: Date\n  readonly absoluteExpiresAt: Date\n}\n\nexport interface SharedSessionCredential {\n  readonly context: SharedSessionContext\n  /** Opaque value for the HttpOnly shared-session cookie. */\n  readonly cookieValue: string\n}\n\nexport interface SharedSessionProtocolOptions {\n  readonly host: SixbHostView\n  readonly inactivityTtlMs?: number\n  readonly now?: () => Date\n}\n\n/**\n * Framework-owned shared-session lifecycle.\n *\n * Link and session secrets are verified here. Callers receive only an effective access plan built\n * from the issued snapshot intersected with the Share definition registered now.\n */\nexport class SharedSessionProtocol {\n  private readonly host: SixbHostView\n  private readonly inactivityTtlMs: number\n  private readonly now: () => Date\n\n  constructor(options: SharedSessionProtocolOptions) {\n    if (!options.host.storage.shareGrants || !options.host.storage.shareSessions) {\n      throw new Error(\"[Sixb] Shared sessions require share grant and session storage.\")\n    }\n    const inactivityTtlMs = options.inactivityTtlMs ?? DEFAULT_SHARED_SESSION_INACTIVITY_TTL_MS\n    if (!Number.isSafeInteger(inactivityTtlMs) || inactivityTtlMs <= 0) {\n      throw new Error(\"[Sixb] Shared session inactivity TTL must be a positive integer.\")\n    }\n    this.host = options.host\n    this.inactivityTtlMs = inactivityTtlMs\n    this.now = options.now ?? (() => new Date())\n  }\n\n  async exchange(grantId: string, secret: string): Promise<SharedSessionCredential | null> {\n    if (!validIdentifier(grantId) || !validSecret(secret)) return null\n    const now = this.currentTime()\n\n    for (let attempt = 0; attempt < MAX_CREATE_ATTEMPTS; attempt += 1) {\n      const sessionSecret = randomBytes(32).toString(\"base64url\")\n      const sessionId = `shs_${randomUUID()}`\n      try {\n        const result = await this.host.storage.transaction(async (tx) => {\n          const grant = await activeGrant(tx, this.host.projectId, grantId, now)\n          const secretMatches = secretMatchesHash(secret, grant?.tokenHash ?? \"\")\n          if (!grant || !secretMatches) return null\n          const sessions = requireSessions(tx)\n          const absoluteExpiresAt = new Date(grant.expiresAt)\n          const session = await sessions.create({\n            id: sessionId,\n            projectId: this.host.projectId,\n            grantId: grant.id,\n            tokenHash: sha256(sessionSecret),\n            createdAt: now,\n            expiresAt: inactivityDeadline(now, absoluteExpiresAt, this.inactivityTtlMs),\n            absoluteExpiresAt,\n          })\n          return { grant, session }\n        })\n        if (!result) return null\n        return {\n          context: this.context(result.grant, result.session),\n          cookieValue: formatSessionCookieValue(sessionId, sessionSecret),\n        }\n      } catch (error) {\n        if (\n          error instanceof ShareSessionStorageError &&\n          error.code === \"duplicate\" &&\n          attempt < MAX_CREATE_ATTEMPTS - 1\n        ) {\n          continue\n        }\n        throw error\n      }\n    }\n\n    return null\n  }\n\n  async resolve(\n    grantId: string,\n    cookieValue: string | undefined,\n    options: { readonly activity?: \"background\" | \"foreground\" } = {}\n  ): Promise<SharedSessionContext | null> {\n    if (!validIdentifier(grantId) || !validCookieValue(cookieValue)) return null\n    const credential = parseSessionCookieValue(cookieValue)\n    if (\n      !credential ||\n      !validIdentifier(credential.sessionId) ||\n      !validSecret(credential.sessionSecret)\n    ) {\n      return null\n    }\n    const now = this.currentTime()\n    const tokenHash = sha256(credential.sessionSecret)\n\n    const result = await this.host.storage.transaction(async (tx) => {\n      const sessions = requireSessions(tx)\n      const current = await sessions.getById({\n        projectId: this.host.projectId,\n        id: credential.sessionId,\n      })\n      const secretMatches = secretMatchesHash(credential.sessionSecret, current?.tokenHash ?? \"\")\n      if (\n        !current ||\n        current.grantId !== grantId ||\n        current.revokedAt !== undefined ||\n        current.expiresAt.getTime() <= now.getTime() ||\n        current.absoluteExpiresAt.getTime() <= now.getTime() ||\n        !secretMatches\n      ) {\n        return null\n      }\n\n      const grant = await activeGrant(tx, this.host.projectId, grantId, now)\n      if (!grant || current.absoluteExpiresAt.getTime() !== grant.expiresAt.getTime()) {\n        return null\n      }\n\n      if (options.activity !== \"foreground\") return { grant, session: current }\n\n      const renewed = await sessions.renewIfValid({\n        projectId: this.host.projectId,\n        id: current.id,\n        grantId,\n        tokenHash,\n        now,\n        expiresAt: inactivityDeadline(now, current.absoluteExpiresAt, this.inactivityTtlMs),\n      })\n      return renewed ? { grant, session: renewed } : null\n    })\n\n    return result ? this.context(result.grant, result.session) : null\n  }\n\n  async revoke(context: Pick<SharedSessionContext, \"grantId\" | \"sessionId\">): Promise<void> {\n    const revokedAt = this.currentTime()\n    await this.host.storage.transaction(async (tx) => {\n      const session = await requireSessions(tx).getById({\n        projectId: this.host.projectId,\n        id: context.sessionId,\n      })\n      if (!session || session.grantId !== context.grantId) return\n      await requireSessions(tx).revoke({\n        projectId: this.host.projectId,\n        id: context.sessionId,\n        revokedAt,\n      })\n    })\n  }\n\n  private context(grant: ShareGrantRecord, session: ShareSessionRecord): SharedSessionContext {\n    return {\n      grantId: grant.id,\n      sessionId: session.id,\n      destinationPath: grant.destinationPath,\n      access: effectiveAccess(this.host, grant),\n      expiresAt: new Date(session.expiresAt),\n      absoluteExpiresAt: new Date(session.absoluteExpiresAt),\n    }\n  }\n\n  private currentTime(): Date {\n    const now = this.now()\n    if (!(now instanceof Date) || !Number.isFinite(now.getTime())) {\n      throw new Error(\"[Sixb] Shared session clock returned an invalid date.\")\n    }\n    return new Date(now)\n  }\n}\n\nfunction effectiveAccess(host: SixbHostView, grant: ShareGrantRecord): ShareAccessPlan {\n  const definition = host.definitions.shares.getById(grant.definitionId)\n  if (!definition || definition.target.objectTypeId !== grant.target.objectTypeId) {\n    return snapshotShareAccessPlan({ grants: [] })\n  }\n  const current = compileShareAccessPlan({\n    share: definition,\n    target: grant.target,\n    ontology: host.definitions.ontology,\n    actions: host.definitions.actions,\n  })\n  return intersectShareAccessPlans(grant.authoritySnapshot.access, current)\n}\n\nasync function activeGrant(\n  storage: Storage,\n  projectId: string,\n  grantId: string,\n  now: Date\n): Promise<ShareGrantRecord | null> {\n  const grant = await storage.shareGrants?.getById({ projectId, id: grantId })\n  return !grant || grant.revokedAt !== undefined || grant.expiresAt.getTime() <= now.getTime()\n    ? null\n    : grant\n}\n\nfunction requireSessions(storage: Storage): NonNullable<Storage[\"shareSessions\"]> {\n  if (!storage.shareSessions) {\n    throw new Error(\"[Sixb] Shared session storage is not configured.\")\n  }\n  return storage.shareSessions\n}\n\nfunction inactivityDeadline(now: Date, absolute: Date, ttlMs: number): Date {\n  return new Date(Math.min(absolute.getTime(), now.getTime() + ttlMs))\n}\n\nfunction secretMatchesHash(secret: string, expectedHash: string): boolean {\n  const actual = createHash(\"sha256\").update(secret).digest()\n  const expected = /^[0-9a-f]{64}$/.test(expectedHash)\n    ? Buffer.from(expectedHash, \"hex\")\n    : Buffer.alloc(actual.length)\n  return timingSafeEqual(actual, expected)\n}\n\nfunction sha256(value: string): string {\n  return createHash(\"sha256\").update(value).digest(\"hex\")\n}\n\nfunction validIdentifier(value: unknown): value is string {\n  return (\n    typeof value === \"string\" && value.length > 0 && value.length <= 128 && value.trim() === value\n  )\n}\n\nfunction validSecret(value: unknown): value is string {\n  return typeof value === \"string\" && SECRET_PATTERN.test(value)\n}\n\nfunction validCookieValue(value: unknown): value is string {\n  return typeof value === \"string\" && value.length <= 256\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AASO,IAAM,2CAA2C,KAAK;AAE7D,IAAM,sBAAsB;AAC5B,IAAM,iBAAiB;AAAA;AA6BhB,MAAM,sBAAsB;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,WAAW,CAAC,SAAuC;AAAA,IACjD,IAAI,CAAC,QAAQ,KAAK,QAAQ,eAAe,CAAC,QAAQ,KAAK,QAAQ,eAAe;AAAA,MAC5E,MAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AAAA,IACA,MAAM,kBAAkB,QAAQ,mBAAmB;AAAA,IACnD,IAAI,CAAC,OAAO,cAAc,eAAe,KAAK,mBAAmB,GAAG;AAAA,MAClE,MAAM,IAAI,MAAM,kEAAkE;AAAA,IACpF;AAAA,IACA,KAAK,OAAO,QAAQ;AAAA,IACpB,KAAK,kBAAkB;AAAA,IACvB,KAAK,MAAM,QAAQ,QAAQ,MAAM,IAAI;AAAA;AAAA,OAGjC,SAAQ,CAAC,SAAiB,QAAyD;AAAA,IACvF,IAAI,CAAC,gBAAgB,OAAO,KAAK,CAAC,YAAY,MAAM;AAAA,MAAG,OAAO;AAAA,IAC9D,MAAM,MAAM,KAAK,YAAY;AAAA,IAE7B,SAAS,UAAU,EAAG,UAAU,qBAAqB,WAAW,GAAG;AAAA,MACjE,MAAM,gBAAgB,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,MAC1D,MAAM,YAAY,OAAO,WAAW;AAAA,MACpC,IAAI;AAAA,QACF,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,YAAY,OAAO,OAAO;AAAA,UAC/D,MAAM,QAAQ,MAAM,YAAY,IAAI,KAAK,KAAK,WAAW,SAAS,GAAG;AAAA,UACrE,MAAM,gBAAgB,kBAAkB,QAAQ,OAAO,aAAa,EAAE;AAAA,UACtE,IAAI,CAAC,SAAS,CAAC;AAAA,YAAe,OAAO;AAAA,UACrC,MAAM,WAAW,gBAAgB,EAAE;AAAA,UACnC,MAAM,oBAAoB,IAAI,KAAK,MAAM,SAAS;AAAA,UAClD,MAAM,UAAU,MAAM,SAAS,OAAO;AAAA,YACpC,IAAI;AAAA,YACJ,WAAW,KAAK,KAAK;AAAA,YACrB,SAAS,MAAM;AAAA,YACf,WAAW,OAAO,aAAa;AAAA,YAC/B,WAAW;AAAA,YACX,WAAW,mBAAmB,KAAK,mBAAmB,KAAK,eAAe;AAAA,YAC1E;AAAA,UACF,CAAC;AAAA,UACD,OAAO,EAAE,OAAO,QAAQ;AAAA,SACzB;AAAA,QACD,IAAI,CAAC;AAAA,UAAQ,OAAO;AAAA,QACpB,OAAO;AAAA,UACL,SAAS,KAAK,QAAQ,OAAO,OAAO,OAAO,OAAO;AAAA,UAClD,aAAa,0BAAyB,WAAW,aAAa;AAAA,QAChE;AAAA,QACA,OAAO,OAAO;AAAA,QACd,IACE,iBAAiB,6BACjB,MAAM,SAAS,eACf,UAAU,sBAAsB,GAChC;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM;AAAA;AAAA,IAEV;AAAA,IAEA,OAAO;AAAA;AAAA,OAGH,QAAO,CACX,SACA,aACA,UAA+D,CAAC,GAC1B;AAAA,IACtC,IAAI,CAAC,gBAAgB,OAAO,KAAK,CAAC,iBAAiB,WAAW;AAAA,MAAG,OAAO;AAAA,IACxE,MAAM,aAAa,yBAAwB,WAAW;AAAA,IACtD,IACE,CAAC,cACD,CAAC,gBAAgB,WAAW,SAAS,KACrC,CAAC,YAAY,WAAW,aAAa,GACrC;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,MAAM,MAAM,KAAK,YAAY;AAAA,IAC7B,MAAM,YAAY,OAAO,WAAW,aAAa;AAAA,IAEjD,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,YAAY,OAAO,OAAO;AAAA,MAC/D,MAAM,WAAW,gBAAgB,EAAE;AAAA,MACnC,MAAM,UAAU,MAAM,SAAS,QAAQ;AAAA,QACrC,WAAW,KAAK,KAAK;AAAA,QACrB,IAAI,WAAW;AAAA,MACjB,CAAC;AAAA,MACD,MAAM,gBAAgB,kBAAkB,WAAW,eAAe,SAAS,aAAa,EAAE;AAAA,MAC1F,IACE,CAAC,WACD,QAAQ,YAAY,WACpB,QAAQ,cAAc,aACtB,QAAQ,UAAU,QAAQ,KAAK,IAAI,QAAQ,KAC3C,QAAQ,kBAAkB,QAAQ,KAAK,IAAI,QAAQ,KACnD,CAAC,eACD;AAAA,QACA,OAAO;AAAA,MACT;AAAA,MAEA,MAAM,QAAQ,MAAM,YAAY,IAAI,KAAK,KAAK,WAAW,SAAS,GAAG;AAAA,MACrE,IAAI,CAAC,SAAS,QAAQ,kBAAkB,QAAQ,MAAM,MAAM,UAAU,QAAQ,GAAG;AAAA,QAC/E,OAAO;AAAA,MACT;AAAA,MAEA,IAAI,QAAQ,aAAa;AAAA,QAAc,OAAO,EAAE,OAAO,SAAS,QAAQ;AAAA,MAExE,MAAM,UAAU,MAAM,SAAS,aAAa;AAAA,QAC1C,WAAW,KAAK,KAAK;AAAA,QACrB,IAAI,QAAQ;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,mBAAmB,KAAK,QAAQ,mBAAmB,KAAK,eAAe;AAAA,MACpF,CAAC;AAAA,MACD,OAAO,UAAU,EAAE,OAAO,SAAS,QAAQ,IAAI;AAAA,KAChD;AAAA,IAED,OAAO,SAAS,KAAK,QAAQ,OAAO,OAAO,OAAO,OAAO,IAAI;AAAA;AAAA,OAGzD,OAAM,CAAC,SAA6E;AAAA,IACxF,MAAM,YAAY,KAAK,YAAY;AAAA,IACnC,MAAM,KAAK,KAAK,QAAQ,YAAY,OAAO,OAAO;AAAA,MAChD,MAAM,UAAU,MAAM,gBAAgB,EAAE,EAAE,QAAQ;AAAA,QAChD,WAAW,KAAK,KAAK;AAAA,QACrB,IAAI,QAAQ;AAAA,MACd,CAAC;AAAA,MACD,IAAI,CAAC,WAAW,QAAQ,YAAY,QAAQ;AAAA,QAAS;AAAA,MACrD,MAAM,gBAAgB,EAAE,EAAE,OAAO;AAAA,QAC/B,WAAW,KAAK,KAAK;AAAA,QACrB,IAAI,QAAQ;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,KACF;AAAA;AAAA,EAGK,OAAO,CAAC,OAAyB,SAAmD;AAAA,IAC1F,OAAO;AAAA,MACL,SAAS,MAAM;AAAA,MACf,WAAW,QAAQ;AAAA,MACnB,iBAAiB,MAAM;AAAA,MACvB,QAAQ,gBAAgB,KAAK,MAAM,KAAK;AAAA,MACxC,WAAW,IAAI,KAAK,QAAQ,SAAS;AAAA,MACrC,mBAAmB,IAAI,KAAK,QAAQ,iBAAiB;AAAA,IACvD;AAAA;AAAA,EAGM,WAAW,GAAS;AAAA,IAC1B,MAAM,MAAM,KAAK,IAAI;AAAA,IACrB,IAAI,EAAE,eAAe,SAAS,CAAC,OAAO,SAAS,IAAI,QAAQ,CAAC,GAAG;AAAA,MAC7D,MAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AAAA,IACA,OAAO,IAAI,KAAK,GAAG;AAAA;AAEvB;AAEA,SAAS,eAAe,CAAC,MAAoB,OAA0C;AAAA,EACrF,MAAM,aAAa,KAAK,YAAY,OAAO,QAAQ,MAAM,YAAY;AAAA,EACrE,IAAI,CAAC,cAAc,WAAW,OAAO,iBAAiB,MAAM,OAAO,cAAc;AAAA,IAC/E,OAAO,wBAAwB,EAAE,QAAQ,CAAC,EAAE,CAAC;AAAA,EAC/C;AAAA,EACA,MAAM,UAAU,uBAAuB;AAAA,IACrC,OAAO;AAAA,IACP,QAAQ,MAAM;AAAA,IACd,UAAU,KAAK,YAAY;AAAA,IAC3B,SAAS,KAAK,YAAY;AAAA,EAC5B,CAAC;AAAA,EACD,OAAO,0BAA0B,MAAM,kBAAkB,QAAQ,OAAO;AAAA;AAG1E,eAAe,WAAW,CACxB,SACA,WACA,SACA,KACkC;AAAA,EAClC,MAAM,QAAQ,MAAM,QAAQ,aAAa,QAAQ,EAAE,WAAW,IAAI,QAAQ,CAAC;AAAA,EAC3E,OAAO,CAAC,SAAS,MAAM,cAAc,aAAa,MAAM,UAAU,QAAQ,KAAK,IAAI,QAAQ,IACvF,OACA;AAAA;AAGN,SAAS,eAAe,CAAC,SAAyD;AAAA,EAChF,IAAI,CAAC,QAAQ,eAAe;AAAA,IAC1B,MAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AAAA,EACA,OAAO,QAAQ;AAAA;AAGjB,SAAS,kBAAkB,CAAC,KAAW,UAAgB,OAAqB;AAAA,EAC1E,OAAO,IAAI,KAAK,KAAK,IAAI,SAAS,QAAQ,GAAG,IAAI,QAAQ,IAAI,KAAK,CAAC;AAAA;AAGrE,SAAS,iBAAiB,CAAC,QAAgB,cAA+B;AAAA,EACxE,MAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO;AAAA,EAC1D,MAAM,WAAW,iBAAiB,KAAK,YAAY,IAC/C,OAAO,KAAK,cAAc,KAAK,IAC/B,OAAO,MAAM,OAAO,MAAM;AAAA,EAC9B,OAAO,gBAAgB,QAAQ,QAAQ;AAAA;AAGzC,SAAS,MAAM,CAAC,OAAuB;AAAA,EACrC,OAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAAA;AAGxD,SAAS,eAAe,CAAC,OAAiC;AAAA,EACxD,OACE,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,UAAU,OAAO,MAAM,KAAK,MAAM;AAAA;AAI7F,SAAS,WAAW,CAAC,OAAiC;AAAA,EACpD,OAAO,OAAO,UAAU,YAAY,eAAe,KAAK,KAAK;AAAA;AAG/D,SAAS,gBAAgB,CAAC,OAAiC;AAAA,EACzD,OAAO,OAAO,UAAU,YAAY,MAAM,UAAU;AAAA;",
-  "debugId": "34911D02E010DC8E64756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AASO,IAAM,2CAA2C,KAAK;AAE7D,IAAM,sBAAsB;AAC5B,IAAM,iBAAiB;AAAA;AA6BhB,MAAM,sBAAsB;AAAA,EAChB;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,WAAW,CAAC,SAAuC;AAAA,IACjD,IAAI,CAAC,QAAQ,KAAK,QAAQ,eAAe,CAAC,QAAQ,KAAK,QAAQ,eAAe;AAAA,MAC5E,MAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AAAA,IACA,MAAM,kBAAkB,QAAQ,mBAAmB;AAAA,IACnD,IAAI,CAAC,OAAO,cAAc,eAAe,KAAK,mBAAmB,GAAG;AAAA,MAClE,MAAM,IAAI,MAAM,kEAAkE;AAAA,IACpF;AAAA,IACA,KAAK,OAAO,QAAQ;AAAA,IACpB,KAAK,kBAAkB;AAAA,IACvB,KAAK,MAAM,QAAQ,QAAQ,MAAM,IAAI;AAAA;AAAA,OAGjC,SAAQ,CAAC,SAAiB,QAAyD;AAAA,IACvF,IAAI,CAAC,gBAAgB,OAAO,KAAK,CAAC,YAAY,MAAM;AAAA,MAAG,OAAO;AAAA,IAC9D,MAAM,MAAM,KAAK,YAAY;AAAA,IAE7B,SAAS,UAAU,EAAG,UAAU,qBAAqB,WAAW,GAAG;AAAA,MACjE,MAAM,gBAAgB,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,MAC1D,MAAM,YAAY,OAAO,WAAW;AAAA,MACpC,IAAI;AAAA,QACF,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,YAAY,OAAO,OAAO;AAAA,UAC/D,MAAM,QAAQ,MAAM,YAAY,IAAI,KAAK,KAAK,WAAW,SAAS,GAAG;AAAA,UACrE,MAAM,gBAAgB,kBAAkB,QAAQ,OAAO,aAAa,EAAE;AAAA,UACtE,IAAI,CAAC,SAAS,CAAC;AAAA,YAAe,OAAO;AAAA,UACrC,MAAM,WAAW,gBAAgB,EAAE;AAAA,UACnC,MAAM,oBAAoB,IAAI,KAAK,MAAM,SAAS;AAAA,UAClD,MAAM,UAAU,MAAM,SAAS,OAAO;AAAA,YACpC,IAAI;AAAA,YACJ,WAAW,KAAK,KAAK;AAAA,YACrB,SAAS,MAAM;AAAA,YACf,WAAW,OAAO,aAAa;AAAA,YAC/B,WAAW;AAAA,YACX,WAAW,mBAAmB,KAAK,mBAAmB,KAAK,eAAe;AAAA,YAC1E;AAAA,UACF,CAAC;AAAA,UACD,OAAO,EAAE,OAAO,QAAQ;AAAA,SACzB;AAAA,QACD,IAAI,CAAC;AAAA,UAAQ,OAAO;AAAA,QACpB,OAAO;AAAA,UACL,SAAS,KAAK,QAAQ,OAAO,OAAO,OAAO,OAAO;AAAA,UAClD,aAAa,0BAAyB,WAAW,aAAa;AAAA,QAChE;AAAA,QACA,OAAO,OAAO;AAAA,QACd,IACE,iBAAiB,6BACjB,MAAM,SAAS,eACf,UAAU,sBAAsB,GAChC;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM;AAAA;AAAA,IAEV;AAAA,IAEA,OAAO;AAAA;AAAA,OAGH,QAAO,CACX,SACA,aACA,UAA+D,CAAC,GAC1B;AAAA,IACtC,IAAI,CAAC,gBAAgB,OAAO,KAAK,CAAC,iBAAiB,WAAW;AAAA,MAAG,OAAO;AAAA,IACxE,MAAM,aAAa,yBAAwB,WAAW;AAAA,IACtD,IACE,CAAC,cACD,CAAC,gBAAgB,WAAW,SAAS,KACrC,CAAC,YAAY,WAAW,aAAa,GACrC;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,MAAM,MAAM,KAAK,YAAY;AAAA,IAC7B,MAAM,YAAY,OAAO,WAAW,aAAa;AAAA,IAEjD,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,YAAY,OAAO,OAAO;AAAA,MAC/D,MAAM,WAAW,gBAAgB,EAAE;AAAA,MACnC,MAAM,UAAU,MAAM,SAAS,QAAQ;AAAA,QACrC,WAAW,KAAK,KAAK;AAAA,QACrB,IAAI,WAAW;AAAA,MACjB,CAAC;AAAA,MACD,MAAM,gBAAgB,kBAAkB,WAAW,eAAe,SAAS,aAAa,EAAE;AAAA,MAC1F,IACE,CAAC,WACD,QAAQ,YAAY,WACpB,QAAQ,cAAc,aACtB,QAAQ,UAAU,QAAQ,KAAK,IAAI,QAAQ,KAC3C,QAAQ,kBAAkB,QAAQ,KAAK,IAAI,QAAQ,KACnD,CAAC,eACD;AAAA,QACA,OAAO;AAAA,MACT;AAAA,MAEA,MAAM,QAAQ,MAAM,YAAY,IAAI,KAAK,KAAK,WAAW,SAAS,GAAG;AAAA,MACrE,IAAI,CAAC,SAAS,QAAQ,kBAAkB,QAAQ,MAAM,MAAM,UAAU,QAAQ,GAAG;AAAA,QAC/E,OAAO;AAAA,MACT;AAAA,MAEA,IAAI,QAAQ,aAAa;AAAA,QAAc,OAAO,EAAE,OAAO,SAAS,QAAQ;AAAA,MAExE,MAAM,UAAU,MAAM,SAAS,aAAa;AAAA,QAC1C,WAAW,KAAK,KAAK;AAAA,QACrB,IAAI,QAAQ;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA,WAAW,mBAAmB,KAAK,QAAQ,mBAAmB,KAAK,eAAe;AAAA,MACpF,CAAC;AAAA,MACD,OAAO,UAAU,EAAE,OAAO,SAAS,QAAQ,IAAI;AAAA,KAChD;AAAA,IAED,OAAO,SAAS,KAAK,QAAQ,OAAO,OAAO,OAAO,OAAO,IAAI;AAAA;AAAA,OAGzD,OAAM,CAAC,SAA6E;AAAA,IACxF,MAAM,YAAY,KAAK,YAAY;AAAA,IACnC,MAAM,KAAK,KAAK,QAAQ,YAAY,OAAO,OAAO;AAAA,MAChD,MAAM,UAAU,MAAM,gBAAgB,EAAE,EAAE,QAAQ;AAAA,QAChD,WAAW,KAAK,KAAK;AAAA,QACrB,IAAI,QAAQ;AAAA,MACd,CAAC;AAAA,MACD,IAAI,CAAC,WAAW,QAAQ,YAAY,QAAQ;AAAA,QAAS;AAAA,MACrD,MAAM,gBAAgB,EAAE,EAAE,OAAO;AAAA,QAC/B,WAAW,KAAK,KAAK;AAAA,QACrB,IAAI,QAAQ;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,KACF;AAAA;AAAA,EAGK,OAAO,CAAC,OAAyB,SAAmD;AAAA,IAC1F,OAAO;AAAA,MACL,SAAS,MAAM;AAAA,MACf,WAAW,QAAQ;AAAA,MACnB,iBAAiB,MAAM;AAAA,MACvB,QAAQ,gBAAgB,KAAK,MAAM,KAAK;AAAA,MACxC,WAAW,IAAI,KAAK,QAAQ,SAAS;AAAA,MACrC,mBAAmB,IAAI,KAAK,QAAQ,iBAAiB;AAAA,IACvD;AAAA;AAAA,EAGM,WAAW,GAAS;AAAA,IAC1B,MAAM,MAAM,KAAK,IAAI;AAAA,IACrB,IAAI,EAAE,eAAe,SAAS,CAAC,OAAO,SAAS,IAAI,QAAQ,CAAC,GAAG;AAAA,MAC7D,MAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AAAA,IACA,OAAO,IAAI,KAAK,GAAG;AAAA;AAEvB;AAEA,SAAS,eAAe,CAAC,MAAoB,OAA0C;AAAA,EACrF,MAAM,aAAa,KAAK,YAAY,OAAO,QAAQ,MAAM,YAAY;AAAA,EACrE,IAAI,CAAC,cAAc,WAAW,OAAO,iBAAiB,MAAM,OAAO,cAAc;AAAA,IAC/E,OAAO,wBAAwB,EAAE,QAAQ,CAAC,EAAE,CAAC;AAAA,EAC/C;AAAA,EACA,MAAM,UAAU,uBAAuB;AAAA,IACrC,OAAO;AAAA,IACP,QAAQ,MAAM;AAAA,IACd,UAAU,KAAK,YAAY;AAAA,IAC3B,SAAS,KAAK,YAAY;AAAA,EAC5B,CAAC;AAAA,EACD,OAAO,0BAA0B,MAAM,kBAAkB,QAAQ,OAAO;AAAA;AAG1E,eAAe,WAAW,CACxB,SACA,WACA,SACA,KACkC;AAAA,EAClC,MAAM,QAAQ,MAAM,QAAQ,aAAa,QAAQ,EAAE,WAAW,IAAI,QAAQ,CAAC;AAAA,EAC3E,OAAO,CAAC,SAAS,MAAM,cAAc,aAAa,MAAM,UAAU,QAAQ,KAAK,IAAI,QAAQ,IACvF,OACA;AAAA;AAGN,SAAS,eAAe,CAAC,SAAyD;AAAA,EAChF,IAAI,CAAC,QAAQ,eAAe;AAAA,IAC1B,MAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AAAA,EACA,OAAO,QAAQ;AAAA;AAGjB,SAAS,kBAAkB,CAAC,KAAW,UAAgB,OAAqB;AAAA,EAC1E,OAAO,IAAI,KAAK,KAAK,IAAI,SAAS,QAAQ,GAAG,IAAI,QAAQ,IAAI,KAAK,CAAC;AAAA;AAGrE,SAAS,iBAAiB,CAAC,QAAgB,cAA+B;AAAA,EACxE,MAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO;AAAA,EAC1D,MAAM,WAAW,iBAAiB,KAAK,YAAY,IAC/C,OAAO,KAAK,cAAc,KAAK,IAC/B,OAAO,MAAM,OAAO,MAAM;AAAA,EAC9B,OAAO,gBAAgB,QAAQ,QAAQ;AAAA;AAGzC,SAAS,MAAM,CAAC,OAAuB;AAAA,EACrC,OAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAAA;AAGxD,SAAS,eAAe,CAAC,OAAiC;AAAA,EACxD,OACE,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,UAAU,OAAO,MAAM,KAAK,MAAM;AAAA;AAI7F,SAAS,WAAW,CAAC,OAAiC;AAAA,EACpD,OAAO,OAAO,UAAU,YAAY,eAAe,KAAK,KAAK;AAAA;AAG/D,SAAS,gBAAgB,CAAC,OAAiC;AAAA,EACzD,OAAO,OAAO,UAAU,YAAY,MAAM,UAAU;AAAA;",
+  "debugId": "C3C5BDA4DF19C4DF64756E2164756E21",
   "names": []
 }