@sixb/core 0.1.20 → 0.1.22

package/dist/chunk-5tfev0fv.js.map

@@ -0,0 +1,15 @@
+{
+  "version": 3,
+  "sources": ["../src/security/projection-markings.ts", "../src/security/marking-propagation.ts", "../src/security/applied-markings-contribution.ts", "../src/security/applied-markings-host.ts", "../src/security/marking-sets.ts", "../src/security/dataset-version-markings.ts"],
+  "sourcesContent": [
+    "import type { DatasetVersion } from \"../lake-storage/types\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport type { ObjectType } from \"../ontology/types\"\nimport type { ProjectionDefinitionCatalog } from \"../projections/registry\"\nimport type {\n  LinkProjectionDefinition,\n  ObjectProjectionDefinition,\n  ProjectionDefinition,\n  TelemetryProjectionDefinition,\n} from \"../projections/types\"\nimport type { VersionClassification } from \"./dataset-version-markings\"\nimport { SecurityValidationError } from \"./errors\"\nimport type { ColumnMarkingOrigins, DatasetMarkings, MarkingOrigin } from \"./marking-propagation\"\n\ntype OntologyLookup = Pick<OntologyDefinitionCatalog, \"getObjectTypeById\">\n\n/** Markings of one column of the projection's dataset. */\ntype ColumnMarkingsLookup = (column: string) => readonly string[]\n\n/** What a marked key column makes unreadable: the objects it identifies, or the link it keys. */\nexport type ProjectionKeyTarget =\n  | { readonly kind: \"type\"; readonly objectTypeId: string }\n  | {\n      readonly kind: \"link\"\n      readonly objectTypeId: string\n      readonly linkId: string\n      readonly targetObjectTypeId: string\n    }\n\n/** A marking rule a projection breaks. */\ntype ProjectionMarkingViolation =\n  | {\n      readonly kind: \"undeclared\"\n      readonly property: string\n      readonly objectTypeId: string\n      readonly propertyId: string\n      readonly column: string\n      readonly missing: readonly string[]\n    }\n  | {\n      readonly kind: \"markedKeyColumn\"\n      readonly column: string\n      readonly role: string\n      readonly targets: readonly ProjectionKeyTarget[]\n      /** The property the column fills, when the key is a property. */\n      readonly property?: { readonly objectTypeId: string; readonly propertyId: string }\n    }\n  | { readonly kind: \"markedKeyProperty\"; readonly property: string; readonly role: string }\n  | { readonly kind: \"telemetry\"; readonly column: string }\n\n/**\n * Objects are read through the ontology, so each projected property declares the markings of its\n * column: the ontology stays the reviewed contract of what each reader receives. Values that\n * identify objects or key links are returned wherever the object or link is, and telemetry does\n * not enforce markings yet, so those columns cannot carry markings.\n *\n * Startup checks it with the markings columns declare or inherit through `run` steps, and the\n * pipeline preflight with the markings SQL steps derive as well.\n */\nexport function validateProjectionMarkings(\n  projections: ProjectionDefinitionCatalog,\n  ontology: OntologyLookup,\n  markings: DatasetMarkings\n): void {\n  const all = [\n    ...projections.listObjects(),\n    ...projections.listLinks(),\n    ...projections.listTelemetry(),\n  ]\n\n  for (const projection of all) {\n    const originsOf = (column: string) => markings.of({ datasetId: projection.datasetId, column })\n    const violation = firstViolation(projection, ontology, (column) => [\n      ...originsOf(column).keys(),\n    ])\n    if (!violation) continue\n\n    const carries = (column: string): CarriedMarkings => {\n      const origins = originsOf(column)\n      return {\n        text: describeOrigins(origins, `${projection.datasetId}.${column}`),\n        inherited: [...origins.values()].some((origin) => origin.steps.length > 0),\n      }\n    }\n\n    throw new SecurityValidationError(\n      violationMessage(\n        `[Sixb] Projection '${projection.id}'`,\n        projection.datasetId,\n        violation,\n        carries\n      )\n    )\n  }\n}\n\n/**\n * Refuse to project a dataset version whose columns carry more markings than the projection\n * allows. A version keeps the markings of the code that produced it, so a version written before\n * the current code can carry markings startup did not see. Call it once per version, before\n * reading its rows; it reads nothing, so what it throws is a refusal that no retry changes.\n */\nexport function assertProjectionVersionMarkings(input: {\n  readonly projection: ProjectionDefinition\n  readonly ontology: OntologyLookup\n  readonly version: DatasetVersion\n  readonly classification: VersionClassification\n}): void {\n  const { projection, version, classification } = input\n  const markingsOf = (column: string) => [...(classification.columns.get(column) ?? [])].sort()\n  const violation = firstViolation(projection, input.ontology, markingsOf)\n  if (!violation) return\n\n  const subject = `[Sixb] Projection '${projection.id}' cannot read version '${version.versionId}' of dataset '${version.datasetId}'`\n  const carries = (column: string): CarriedMarkings => ({\n    text: `${markingList(markingsOf(column))} in this version`,\n    inherited: true,\n  })\n  const conservative =\n    classification.conservative === undefined\n      ? \"\"\n      : ` The version was classified with every marking its sources could hold, because ${classification.conservative}.`\n  const rerun = `If the code that writes '${version.datasetId}' no longer derives these markings, rerun its pipeline.`\n\n  throw new Error(\n    `${violationMessage(subject, version.datasetId, violation, carries)}${conservative} ${rerun}`\n  )\n}\n\n/** Markings an applied version gives a projection's targets beyond what the ontology declares. */\nexport interface ProjectionSurplus {\n  /** Markings a mapped column carries that its property does not declare. */\n  readonly properties: readonly {\n    readonly objectTypeId: string\n    readonly propertyId: string\n    readonly column: string\n    readonly markings: readonly string[]\n  }[]\n  /** Marked key columns, with what each one makes unreadable and why. */\n  readonly keys: readonly {\n    readonly target: ProjectionKeyTarget\n    readonly column: string\n    readonly role: string\n    readonly markings: readonly string[]\n  }[]\n}\n\n/**\n * What a projection's targets carry beyond their declarations when read from columns with these\n * markings: every rule it breaks, as markings to add to properties and to key targets. A property\n * that keys a link keeps its markings on the property as well.\n */\nexport function projectionSurplus(\n  projection: ProjectionDefinition,\n  ontology: OntologyLookup,\n  markingsOf: ColumnMarkingsLookup\n): ProjectionSurplus {\n  const properties: ProjectionSurplus[\"properties\"][number][] = []\n  const keys: ProjectionSurplus[\"keys\"][number][] = []\n\n  for (const violation of projectionMarkingViolations(projection, ontology, markingsOf)) {\n    switch (violation.kind) {\n      case \"undeclared\":\n        properties.push({\n          objectTypeId: violation.objectTypeId,\n          propertyId: violation.propertyId,\n          column: violation.column,\n          markings: violation.missing,\n        })\n        break\n      case \"markedKeyColumn\": {\n        const markings = markingsOf(violation.column)\n        for (const target of violation.targets) {\n          keys.push({ target, column: violation.column, role: violation.role, markings })\n        }\n\n        const property = violation.property\n        if (property && violation.targets.some((target) => target.kind === \"link\")) {\n          properties.push({ ...property, column: violation.column, markings })\n        }\n        break\n      }\n      // Startup refuses a marked key property and a marked telemetry column from the code alone.\n      case \"markedKeyProperty\":\n      case \"telemetry\":\n        break\n    }\n  }\n\n  return { properties, keys }\n}\n\n// ── Rules ───────────────────────────────────────────────────\n\nfunction firstViolation(\n  projection: ProjectionDefinition,\n  ontology: OntologyLookup,\n  markingsOf: ColumnMarkingsLookup\n): ProjectionMarkingViolation | null {\n  const first = projectionMarkingViolations(projection, ontology, markingsOf).next()\n  return first.done ? null : first.value\n}\n\n/** Every marking rule the projection breaks, the first one being the one messages report. */\nfunction* projectionMarkingViolations(\n  projection: ProjectionDefinition,\n  ontology: OntologyLookup,\n  markingsOf: ColumnMarkingsLookup\n): Generator<ProjectionMarkingViolation> {\n  switch (projection._tag) {\n    case \"ObjectProjectionDefinition\": {\n      const objectType = ontology.getObjectTypeById(projection.objectTypeId)\n      if (objectType) yield* objectProjectionViolations(projection, objectType, markingsOf)\n      return\n    }\n    case \"LinkProjectionDefinition\":\n      yield* linkProjectionViolations(projection, markingsOf)\n      return\n    case \"TelemetryProjectionDefinition\":\n      yield* telemetryProjectionViolations(projection, markingsOf)\n      return\n  }\n}\n\nfunction* objectProjectionViolations(\n  projection: ObjectProjectionDefinition,\n  objectType: ObjectType,\n  markingsOf: ColumnMarkingsLookup\n): Generator<ProjectionMarkingViolation> {\n  const keyRoles = objectProjectionKeyRoles(projection, objectType)\n\n  for (const [propertyId, column] of Object.entries(projection.properties)) {\n    const property = objectType.properties.find((candidate) => candidate.id === propertyId)\n    const path = `${objectType.id}.${propertyId}`\n    const keyRole = keyRoles.get(propertyId)\n\n    if (keyRole) {\n      if (markingsOf(column).length > 0) {\n        yield {\n          kind: \"markedKeyColumn\",\n          column,\n          role: keyRole.role,\n          targets: keyRole.targets,\n          property: { objectTypeId: objectType.id, propertyId },\n        }\n      } else if (property?.markings) {\n        yield { kind: \"markedKeyProperty\", property: path, role: keyRole.role }\n      }\n      continue\n    }\n\n    const declared = new Set(property?.markings ?? [])\n    const missing = markingsOf(column).filter((markingId) => !declared.has(markingId))\n    if (missing.length > 0) {\n      yield {\n        kind: \"undeclared\",\n        property: path,\n        objectTypeId: objectType.id,\n        propertyId,\n        column,\n        missing,\n      }\n    }\n  }\n\n  for (const [linkId, link] of Object.entries(projection.links)) {\n    if (link.sourceField === undefined) continue\n\n    const role = `keys link '${objectType.id}.${linkId}'`\n    const target = linkTarget(objectType.id, linkId, link.targetObjectTypeId)\n    yield* markedKeyColumn(link.sourceField, role, [target], markingsOf)\n  }\n\n  // The timestamp decides whether the source value or an app edit wins, which reveals how they\n  // compare.\n  const conflictResolution = projection.conflictResolution\n  if (conflictResolution?.strategy === \"mostRecent\") {\n    const role = \"decides which value wins under 'mostRecent'\"\n    const target: ProjectionKeyTarget = { kind: \"type\", objectTypeId: objectType.id }\n    yield* markedKeyColumn(conflictResolution.sourceTimestamp, role, [target], markingsOf)\n  }\n}\n\nfunction* linkProjectionViolations(\n  projection: LinkProjectionDefinition,\n  markingsOf: ColumnMarkingsLookup\n): Generator<ProjectionMarkingViolation> {\n  const role = `keys link '${projection.sourceObjectTypeId}.${projection.linkId}'`\n  const targets = [\n    linkTarget(projection.sourceObjectTypeId, projection.linkId, projection.targetObjectTypeId),\n  ]\n  yield* markedKeyColumn(projection.sourceField, role, targets, markingsOf)\n  yield* markedKeyColumn(projection.targetField, role, targets, markingsOf)\n}\n\nfunction* telemetryProjectionViolations(\n  projection: TelemetryProjectionDefinition,\n  markingsOf: ColumnMarkingsLookup\n): Generator<ProjectionMarkingViolation> {\n  const columns = [\n    projection.objectIdField,\n    projection.atField,\n    ...Object.values(projection.properties).flatMap((mapping) =>\n      mapping.unitField === undefined\n        ? [mapping.valueField]\n        : [mapping.valueField, mapping.unitField]\n    ),\n  ]\n\n  for (const column of columns) {\n    if (markingsOf(column).length > 0) yield { kind: \"telemetry\", column }\n  }\n}\n\ninterface KeyRole {\n  readonly role: string\n  readonly targets: readonly ProjectionKeyTarget[]\n}\n\n/** Properties whose value becomes an object id or a link key, with the role they play. */\nfunction objectProjectionKeyRoles(\n  projection: ObjectProjectionDefinition,\n  objectType: ObjectType\n): ReadonlyMap<string, KeyRole> {\n  const roles = new Map<string, KeyRole>()\n\n  for (const property of objectType.properties) {\n    if (!property.primary) continue\n    roles.set(property.id, {\n      role: `becomes the id of '${objectType.id}'`,\n      targets: [{ kind: \"type\", objectTypeId: objectType.id }],\n    })\n  }\n\n  for (const [linkId, link] of Object.entries(projection.links)) {\n    if (link.sourcePropertyId === undefined) continue\n    // An id that also keys a link plays both roles; messages name the link.\n    roles.set(link.sourcePropertyId, {\n      role: `keys link '${objectType.id}.${linkId}'`,\n      targets: [\n        ...(roles.get(link.sourcePropertyId)?.targets ?? []),\n        linkTarget(objectType.id, linkId, link.targetObjectTypeId),\n      ],\n    })\n  }\n\n  return roles\n}\n\nfunction linkTarget(\n  objectTypeId: string,\n  linkId: string,\n  targetObjectTypeId: string\n): ProjectionKeyTarget {\n  return { kind: \"link\", objectTypeId, linkId, targetObjectTypeId }\n}\n\nfunction* markedKeyColumn(\n  column: string,\n  role: string,\n  targets: readonly ProjectionKeyTarget[],\n  markingsOf: ColumnMarkingsLookup\n): Generator<ProjectionMarkingViolation> {\n  if (markingsOf(column).length > 0) yield { kind: \"markedKeyColumn\", column, role, targets }\n}\n\n// ── Messages ────────────────────────────────────────────────\n\n/** What a column carries, for messages, and whether any of it comes from elsewhere. */\ninterface CarriedMarkings {\n  readonly text: string\n  readonly inherited: boolean\n}\n\nfunction violationMessage(\n  subject: string,\n  datasetId: string,\n  violation: ProjectionMarkingViolation,\n  carries: (column: string) => CarriedMarkings\n): string {\n  const path = (column: string) => `${datasetId}.${column}`\n\n  switch (violation.kind) {\n    case \"undeclared\":\n      return `${subject}: property '${violation.property}' is projected from column '${path(violation.column)}', which carries ${carries(violation.column).text}. Add markings: ${markingList(violation.missing)} to the property.`\n    case \"markedKeyColumn\": {\n      const carried = carries(violation.column)\n      const inherited = carried.inherited ? `, but carries ${carried.text}` : \"\"\n      return `${subject}: column '${path(violation.column)}' ${violation.role} and cannot carry markings${inherited}.`\n    }\n    case \"markedKeyProperty\":\n      return `${subject}: property '${violation.property}' ${violation.role} and cannot carry markings.`\n    case \"telemetry\":\n      return `${subject}: column '${path(violation.column)}' carries ${carries(violation.column).text}, and telemetry projections cannot read marked columns yet.`\n  }\n}\n\n/**\n * `[financial] from 'raw_invoices.amount' through step 'invoices/normalize'`: each marking with one\n * path it arrived by. Markings the column declares itself have no path.\n */\nexport function describeOrigins(origins: ColumnMarkingOrigins, columnPath: string): string {\n  const groups = new Map<string, string[]>()\n  for (const [markingId, origin] of origins) {\n    const path = originPath(origin, columnPath)\n    groups.set(path, [...(groups.get(path) ?? []), markingId])\n  }\n  return [...groups].map(([path, markingIds]) => `${markingList(markingIds)}${path}`).join(\" and \")\n}\n\nfunction originPath(origin: MarkingOrigin, columnPath: string): string {\n  const source = `${origin.column.datasetId}.${origin.column.column}`\n  if (origin.steps.length === 0 && source === columnPath) return \"\"\n\n  const steps = origin.steps.map((step) => `'${step}'`).join(\", \")\n  return ` from '${source}' through ${origin.steps.length === 1 ? \"step\" : \"steps\"} ${steps}`\n}\n\nfunction markingList(markings: readonly string[]): string {\n  return `[${markings.join(\", \")}]`\n}\n",
+    "import type { DatasetDefinition } from \"../datasets/types\"\nimport { lineageColumn } from \"../lake-storage/lineage\"\nimport type { DatasetColumnLineage, DatasetColumnRef } from \"../lake-storage/types\"\nimport { runStepLineage, stepReadColumns } from \"../pipelines/lineage\"\nimport type { PipelineDefinition, PipelineStepDefinition } from \"../pipelines/types\"\n\n/** A step of a registered pipeline. A step reused by two pipelines is two registered steps. */\nexport interface RegisteredStep {\n  readonly pipelineId: string\n  readonly step: PipelineStepDefinition\n}\n\n/** The column that declares a marking, and the steps it went through to reach a column. */\nexport interface MarkingOrigin {\n  readonly column: DatasetColumnRef\n  /** `pipeline/step`, upstream first. Empty when the column declares the marking itself. */\n  readonly steps: readonly string[]\n}\n\n/** Each marking a column carries, with one path it arrived by. */\nexport type ColumnMarkingOrigins = ReadonlyMap<string, MarkingOrigin>\n\n/** Markings of every column of every registered dataset, derived from the definitions. */\nexport interface DatasetMarkings {\n  /** Empty for a column without markings or that is not registered. */\n  of(column: DatasetColumnRef): ColumnMarkingOrigins\n}\n\nexport function registeredSteps(\n  pipelines: readonly PipelineDefinition[]\n): readonly RegisteredStep[] {\n  return pipelines.flatMap((pipeline) =>\n    pipeline.graph.nodes.map(({ step }) => ({ pipelineId: pipeline.id, step }))\n  )\n}\n\n/** Lineage of each `run` step, built once per step object; undefined for other steps. */\nexport function runStepLineages(\n  datasetsById: ReadonlyMap<string, DatasetDefinition>\n): (entry: RegisteredStep) => DatasetColumnLineage | undefined {\n  const lineages = new Map<PipelineStepDefinition, DatasetColumnLineage>()\n\n  return ({ step }) => {\n    if (step.executor.kind !== \"run\") return undefined\n\n    let lineage = lineages.get(step)\n    if (!lineage) {\n      lineage = runStepLineage(step, datasetsById)\n      lineages.set(step, lineage)\n    }\n\n    return lineage\n  }\n}\n\nexport function stepLabel(entry: RegisteredStep): string {\n  return `${entry.pipelineId}/${entry.step.id}`\n}\n\ntype MutableOrigins = Map<string, MarkingOrigin>\n\nconst NO_MARKINGS: ColumnMarkingOrigins = new Map()\n\ninterface KnownLineage {\n  readonly lineage: DatasetColumnLineage\n  /** What a column the lineage does not list depends on. */\n  readonly reads: readonly DatasetColumnRef[]\n}\n\n/**\n * Markings each column carries according to the registered definitions: the ones it declares, and\n * the ones each step derives from the columns it depends on, once that step's lineage is known.\n *\n * What decided the rows of a step's inputs decides the rows of its output, whether or not the step\n * reads a column of that input: `SELECT count(*) FROM rich` reveals which rows `rich` holds. So\n * each dataset also keeps the markings of its row dependencies, and every output column of a step\n * carries those of every input it reads, as the lineage each version records does.\n *\n * A step may read its own output and a dataset may have several producers, so a step whose output\n * gains a marking queues the steps that read that output, until nothing changes. Lineage can be\n * added in rounds: each round only revisits what the new lineage reaches.\n */\nexport class MarkingPropagation implements DatasetMarkings {\n  private readonly datasetsById: ReadonlyMap<string, DatasetDefinition>\n  /** Marked columns only, by dataset, built when a dataset is first looked at. */\n  private readonly markings = new Map<string, Map<string, MutableOrigins>>()\n  /** Markings of what decides each dataset's rows, for datasets a step writes. */\n  private readonly rowMarkings = new Map<string, MutableOrigins>()\n  private readonly ordered: readonly RegisteredStep[]\n  private readonly readers = new Map<string, RegisteredStep[]>()\n  private readonly known = new Map<RegisteredStep, KnownLineage>()\n  private readonly queue = new Set<RegisteredStep>()\n\n  constructor(\n    datasetsById: ReadonlyMap<string, DatasetDefinition>,\n    steps: readonly RegisteredStep[]\n  ) {\n    this.datasetsById = datasetsById\n    this.ordered = inDependencyOrder(steps)\n\n    for (const entry of steps) {\n      for (const input of new Set(Object.values(entry.step.inputs).map((dataset) => dataset.id))) {\n        appendTo(this.readers, input, entry)\n      }\n    }\n  }\n\n  of(ref: DatasetColumnRef): ColumnMarkingOrigins {\n    return this.markedColumns(ref.datasetId).get(ref.column) ?? NO_MARKINGS\n  }\n\n  /**\n   * Derive markings through every step `lineageOf` knows the lineage of. A step it returns null\n   * for derives nothing until a later call knows it.\n   */\n  derive(lineageOf: (entry: RegisteredStep) => DatasetColumnLineage | null): this {\n    for (const entry of this.ordered) {\n      if (this.known.has(entry)) continue\n\n      const lineage = lineageOf(entry)\n      if (!lineage) continue\n\n      this.known.set(entry, { lineage, reads: stepReadColumns(entry.step) })\n      this.queue.add(entry)\n    }\n\n    for (const entry of this.queue) {\n      this.queue.delete(entry)\n      const known = this.known.get(entry)\n      if (!known || !this.apply(entry, known)) continue\n\n      // Entries added while iterating a Set are visited, so the queue drains in this loop.\n      for (const reader of this.readers.get(entry.step.output.id) ?? []) {\n        if (this.known.has(reader)) this.queue.add(reader)\n      }\n    }\n\n    return this\n  }\n\n  /** Whether the output's rows or any output column gained a marking. */\n  private apply(entry: RegisteredStep, { lineage, reads }: KnownLineage): boolean {\n    const label = stepLabel(entry)\n    const rows = this.union(lineage.rows)\n\n    for (const input of new Set(Object.values(entry.step.inputs).map((dataset) => dataset.id))) {\n      for (const [markingId, origin] of this.rowMarkings.get(input) ?? []) {\n        if (!rows.has(markingId)) rows.set(markingId, origin)\n      }\n    }\n\n    let everyRead: ReadonlyMap<string, MarkingOrigin> | undefined\n    let changed = false\n\n    const outputId = entry.step.output.id\n    let outputRows = this.rowMarkings.get(outputId)\n\n    for (const [markingId, origin] of rows) {\n      if (outputRows?.has(markingId)) continue\n      if (!outputRows) {\n        outputRows = new Map()\n        this.rowMarkings.set(outputId, outputRows)\n      }\n\n      outputRows.set(markingId, { column: origin.column, steps: [...origin.steps, label] })\n      changed = true\n    }\n\n    const marked = this.markedColumns(outputId)\n    for (const { name: column } of this.datasetsById.get(outputId)?.schema.columns ?? []) {\n      const values = lineageColumn(lineage, column)\n      const valueSource = values ? this.union(values) : (everyRead ?? this.union(reads))\n      if (!values) everyRead = valueSource\n\n      for (const source of [rows, valueSource]) {\n        for (const [markingId, origin] of source) {\n          let origins = marked.get(column)\n          if (origins?.has(markingId)) continue\n          if (!origins) {\n            origins = new Map()\n            marked.set(column, origins)\n          }\n\n          origins.set(markingId, { column: origin.column, steps: [...origin.steps, label] })\n          changed = true\n        }\n      }\n    }\n\n    return changed\n  }\n\n  private markedColumns(datasetId: string): Map<string, MutableOrigins> {\n    let columns = this.markings.get(datasetId)\n    if (!columns) {\n      columns = new Map()\n      for (const column of this.datasetsById.get(datasetId)?.schema.columns ?? []) {\n        if (!column.markings?.length) continue\n\n        const origin = { column: { datasetId, column: column.name }, steps: [] }\n        columns.set(column.name, new Map(column.markings.map((id) => [id, origin])))\n      }\n\n      this.markings.set(datasetId, columns)\n    }\n\n    return columns\n  }\n\n  /** Every marking of these columns, each with the first origin found. */\n  private union(columns: readonly DatasetColumnRef[]): MutableOrigins {\n    const union: MutableOrigins = new Map()\n    for (const column of columns) {\n      for (const [markingId, origin] of this.of(column)) {\n        if (!union.has(markingId)) union.set(markingId, origin)\n      }\n    }\n    return union\n  }\n}\n\n/** Producers before consumers, so most markings arrive by their shortest path. */\nfunction inDependencyOrder(steps: readonly RegisteredStep[]): readonly RegisteredStep[] {\n  const producers = producersByDataset(steps)\n  const ordered: RegisteredStep[] = []\n  const visited = new Set<RegisteredStep>()\n\n  const visit = (entry: RegisteredStep): void => {\n    if (visited.has(entry)) return\n\n    visited.add(entry)\n    for (const input of Object.values(entry.step.inputs)) {\n      for (const producer of producers.get(input.id) ?? []) visit(producer)\n    }\n\n    ordered.push(entry)\n  }\n\n  for (const entry of steps) visit(entry)\n  return ordered\n}\n\nfunction producersByDataset(\n  steps: readonly RegisteredStep[]\n): ReadonlyMap<string, readonly RegisteredStep[]> {\n  const producers = new Map<string, RegisteredStep[]>()\n  for (const entry of steps) appendTo(producers, entry.step.output.id, entry)\n  return producers\n}\n\nfunction appendTo<TValue>(map: Map<string, TValue[]>, key: string, value: TValue): void {\n  const values = map.get(key)\n  if (values) values.push(value)\n  else map.set(key, [value])\n}\n",
+    "import type { ProjectionEventOrigin } from \"../events/envelope\"\nimport type { DatasetVersion } from \"../lake-storage/types\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport type { PipelineDefinition } from \"../pipelines/types\"\nimport type { LinkProjectionDefinition, ObjectProjectionDefinition } from \"../projections/types\"\nimport type { ActiveOntologySource } from \"../storage/ontology\"\nimport { type AppliedContribution, NO_CONTRIBUTION } from \"./applied-markings-snapshot\"\nimport type { VersionClassification } from \"./dataset-version-markings\"\nimport { registeredSteps } from \"./marking-propagation\"\nimport { type ProjectionKeyTarget, projectionSurplus } from \"./projection-markings\"\n\nexport type SourceProjection = ObjectProjectionDefinition | LinkProjectionDefinition\n\n/** What reading a projection's applied version from the lake gave. */\nexport type AppliedVersionRead =\n  | {\n      readonly kind: \"read\"\n      readonly version: DatasetVersion\n      readonly classification: VersionClassification\n    }\n  | { readonly kind: \"missing\" }\n  | { readonly kind: \"failed\"; readonly error: unknown }\n\nexport interface AppliedContributionContext {\n  readonly ontology: Pick<OntologyDefinitionCatalog, \"getObjectTypeById\">\n  /** The revision of a projection's current definition. */\n  readonly revisionOf: (projectionId: string) => string\n  /** What a version that cannot be read may carry. */\n  readonly everyMarking: ReadonlySet<string>\n  /** The pipeline that writes a dataset in the current code, for messages. */\n  readonly pipelineOf: (datasetId: string) => string | undefined\n}\n\n/**\n * What one projection's applied version adds to the code's markings, with the notice that explains\n * it. It reads nothing: the caller reads and classifies the version.\n *\n * - A version that could not be read seals the projection's target with every marking.\n * - Objects written by an earlier definition, which may have mapped any column, seal it with every\n *   marking of the version.\n * - Otherwise a property keeps the markings its column carries beyond its declaration, and a key\n *   column that carries markings seals what it keys.\n */\nexport function appliedContribution(\n  projection: SourceProjection,\n  source: ActiveOntologySource,\n  read: AppliedVersionRead,\n  context: AppliedContributionContext\n): AppliedContribution {\n  const { datasetId, versionId } = source.datasetVersion\n  const subject = `version '${versionId}' of '${datasetId}'`\n  const target = projectionTarget(projection)\n  const hint = rerunHint(datasetId, read.kind === \"read\" ? read.version : undefined, context)\n  const every = [...context.everyMarking].sort()\n\n  if (read.kind === \"failed\") {\n    return sealed(projection.id, target, every, hint, {\n      reason: `the ${subject} it applied, which could not be read from the lake,`,\n      detail: `applied ${subject}, which could not be read from the lake: ${sentence(errorMessage(read.error))}`,\n    })\n  }\n\n  if (read.kind === \"missing\") {\n    return sealed(projection.id, target, every, hint, {\n      reason: `the ${subject} it applied, which the lake no longer has,`,\n      detail: `applied ${subject}, which the lake no longer has.`,\n    })\n  }\n\n  const { columns, conservative } = read.classification\n  const because =\n    conservative === undefined\n      ? \"\"\n      : ` The version was classified with every marking its sources could hold, because ${conservative}.`\n\n  if (\n    datasetId !== projection.datasetId ||\n    source.projectionRevision !== context.revisionOf(projection.id)\n  ) {\n    const markings = appliedVersionMarkings(read, context.everyMarking)\n    return sealed(projection.id, target, markings, hint, {\n      reason: `the ${subject} it applied under an earlier definition of the projection`,\n      detail: `applied ${subject} under an earlier definition of the projection, and that version carries ${markingList(markings)}.${because}`,\n    })\n  }\n\n  const markingsOf = (column: string) => [...(columns.get(column) ?? [])].sort()\n  const surplus = projectionSurplus(projection, context.ontology, markingsOf)\n  if (surplus.properties.length === 0 && surplus.keys.length === 0) return NO_CONTRIBUTION\n\n  const column = (name: string) => `'${datasetId}.${name}'`\n  const seals = surplus.keys.map((key) => ({\n    target: key.target,\n    seal: {\n      projectionId: projection.id,\n      markings: key.markings,\n      reason: `in the version '${versionId}' it applied, column ${column(key.column)}, which ${key.role},`,\n    },\n  }))\n\n  const details = [\n    ...surplus.keys.map(\n      (key) => `column ${column(key.column)} ${key.role} and carries ${markingList(key.markings)}`\n    ),\n    ...surplus.properties.map(\n      (property) =>\n        `property '${property.objectTypeId}.${property.propertyId}' is projected from column ${column(property.column)}, which carries ${markingList(property.markings)}`\n    ),\n  ]\n\n  const consequences: string[] = []\n  if (seals.length > 0) {\n    const markings = [...new Set(seals.flatMap(({ seal }) => seal.markings))].sort()\n    consequences.push(\n      `${describeTargets(seals.map(({ target }) => target))} cannot be read without clearance for ${markingList(markings)}`\n    )\n  }\n\n  if (surplus.properties.length > 0) {\n    const names = surplus.properties.map((p) => `'${p.objectTypeId}.${p.propertyId}'`)\n    const verb = surplus.properties.length === 1 ? \"keeps\" : \"keep\"\n    consequences.push(`${describeNames(names)} ${verb} these markings`)\n  }\n\n  return {\n    properties: surplus.properties.map(({ objectTypeId, propertyId, markings }) => ({\n      objectTypeId,\n      propertyId,\n      markings,\n    })),\n    seals,\n    notice: {\n      projectionId: projection.id,\n      sealed: seals.length > 0,\n      message: `[Sixb] Projection '${projection.id}' applied ${subject}, in which ${details.join(\"; \")}.${because} ${capitalize(consequences.join(\", and \"))} until the projection applies a version the code allows. ${hint}`,\n    },\n  }\n}\n\n/** Every marking the version carries in any column; every marking when it could not be read. */\nexport function appliedVersionMarkings(\n  read: AppliedVersionRead,\n  everyMarking: ReadonlySet<string>\n): readonly string[] {\n  if (read.kind !== \"read\") return [...everyMarking].sort()\n\n  const { columns } = read.classification\n  return [...new Set([...columns.values()].flatMap((set) => [...set]))].sort()\n}\n\n/** An object event a projection emitted: the version its values came from, and its type. */\nexport type EventOriginRef = Pick<\n  ProjectionEventOrigin,\n  \"projectionId\" | \"datasetId\" | \"datasetVersionId\"\n> & { readonly objectTypeId: string }\n\n/**\n * The markings an object event's origin version carries on each property its projection maps.\n * When the projection now maps another dataset or type, or the version cannot be read, every\n * property but the primary one carries every marking it could, as objects written under an\n * earlier definition do.\n */\nexport function eventOriginMarkings(\n  projection: ObjectProjectionDefinition,\n  origin: EventOriginRef,\n  read: AppliedVersionRead,\n  context: Pick<AppliedContributionContext, \"ontology\" | \"everyMarking\">\n): AppliedContribution[\"properties\"] {\n  const { objectTypeId } = origin\n\n  if (\n    read.kind === \"read\" &&\n    projection.datasetId === origin.datasetId &&\n    projection.objectTypeId === objectTypeId\n  ) {\n    const { columns } = read.classification\n    return Object.entries(projection.properties).flatMap(([propertyId, column]) => {\n      const markings = [...(columns.get(column) ?? [])].sort()\n      return markings.length === 0 ? [] : [{ objectTypeId, propertyId, markings }]\n    })\n  }\n\n  const markings = appliedVersionMarkings(read, context.everyMarking)\n  if (markings.length === 0) return []\n\n  return (context.ontology.getObjectTypeById(objectTypeId)?.properties ?? [])\n    .filter((property) => !property.primary)\n    .map((property) => ({ objectTypeId, propertyId: property.id, markings }))\n}\n\n/** The pipeline that writes each dataset in the current code. */\nexport function producingPipelines(\n  pipelines: readonly PipelineDefinition[]\n): (datasetId: string) => string | undefined {\n  const byDataset = new Map<string, string>()\n  for (const { pipelineId, step } of registeredSteps(pipelines)) {\n    if (!byDataset.has(step.output.id)) byDataset.set(step.output.id, pipelineId)\n  }\n\n  return (datasetId) => byDataset.get(datasetId)\n}\n\n/** Seal the projection's whole target: its object type, or its link. */\nfunction sealed(\n  projectionId: string,\n  target: ProjectionKeyTarget,\n  markings: readonly string[],\n  hint: string,\n  text: { readonly reason: string; readonly detail: string }\n): AppliedContribution {\n  if (markings.length === 0) return NO_CONTRIBUTION\n  return {\n    properties: [],\n    seals: [{ target, seal: { projectionId, markings, reason: text.reason } }],\n    notice: {\n      projectionId,\n      sealed: true,\n      message: `[Sixb] Projection '${projectionId}' ${text.detail} ${describeTargets([target])} cannot be read without clearance for ${markingList(markings)} until the projection applies a version the code allows. ${hint}`,\n    },\n  }\n}\n\nfunction projectionTarget(projection: SourceProjection): ProjectionKeyTarget {\n  return projection._tag === \"ObjectProjectionDefinition\"\n    ? { kind: \"type\", objectTypeId: projection.objectTypeId }\n    : {\n        kind: \"link\",\n        objectTypeId: projection.sourceObjectTypeId,\n        linkId: projection.linkId,\n        targetObjectTypeId: projection.targetObjectTypeId,\n      }\n}\n\nfunction rerunHint(\n  datasetId: string,\n  version: DatasetVersion | undefined,\n  context: AppliedContributionContext\n): string {\n  const pipelineId =\n    context.pipelineOf(datasetId) ??\n    (version?.producer?.kind === \"pipeline\" ? version.producer.id : undefined)\n  return pipelineId === undefined\n    ? `Write a new version of '${datasetId}' to replace it.`\n    : `Rerun pipeline '${pipelineId}' to replace it.`\n}\n\nfunction describeTargets(targets: readonly ProjectionKeyTarget[]): string {\n  return describeNames(\n    targets.map((target) =>\n      target.kind === \"type\"\n        ? `'${target.objectTypeId}'`\n        : `link '${target.objectTypeId}.${target.linkId}'`\n    )\n  )\n}\n\nfunction describeNames(names: readonly string[]): string {\n  const unique = [...new Set(names)]\n  const last = unique.pop() ?? \"\"\n  return unique.length === 0 ? last : `${unique.join(\", \")} and ${last}`\n}\n\nfunction capitalize(text: string): string {\n  return text.charAt(0).toUpperCase() + text.slice(1)\n}\n\nexport function sentence(text: string): string {\n  return text.endsWith(\".\") ? text : `${text}.`\n}\n\nfunction markingList(markings: readonly string[]): string {\n  return `[${markings.join(\", \")}]`\n}\n\nexport function errorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error)\n}\n",
+    "import type { AppliedMarkings } from \"./applied-markings\"\nimport { errorMessage } from \"./applied-markings-contribution\"\n\nconst appliedMarkingsKey: unique symbol = Symbol(\"sixb.appliedMarkings\")\n\ninterface AppliedMarkingsOwner {\n  readonly [appliedMarkingsKey]?: AppliedMarkings\n}\n\n/** One snapshot per host, so every reader shares it and its resolved clearances. */\nexport function registerAppliedMarkings(owner: object, markings: AppliedMarkings): void {\n  const registered = (owner as AppliedMarkingsOwner)[appliedMarkingsKey]\n  if (registered && registered !== markings) {\n    throw new Error(\"[Sixb] Applied markings are already registered for this owner.\")\n  }\n\n  Object.defineProperty(owner, appliedMarkingsKey, {\n    configurable: false,\n    enumerable: false,\n    value: markings,\n    writable: false,\n  })\n}\n\nexport function getAppliedMarkings(owner: object): AppliedMarkings {\n  const markings = (owner as AppliedMarkingsOwner)[appliedMarkingsKey]\n  if (markings) return markings\n  throw new Error(\"[Sixb] Applied markings are not registered for this runtime.\")\n}\n\n/**\n * Read the applied versions ahead of the first request that needs them. A failure is only\n * reported here: that request reads them again, and fails closed if it cannot.\n */\nexport function warmAppliedMarkings(owner: object): void {\n  getAppliedMarkings(owner)\n    .current()\n    .catch((error: unknown) => {\n      console.warn(errorMessage(error))\n    })\n}\n",
+    "/**\n * Shared, immutable sets of marking ids.\n *\n * Every column of every resolved version holds one of a handful of distinct sets, so each distinct\n * set is created once and compared by identity.\n */\nexport class MarkingSets {\n  readonly empty: ReadonlySet<string> = new Set()\n  private readonly sets = new Map<string, ReadonlySet<string>>([[\"\", this.empty]])\n\n  of(markingIds: Iterable<string> | undefined): ReadonlySet<string> {\n    // Most columns carry no marking.\n    if (markingIds === undefined || (Array.isArray(markingIds) && markingIds.length === 0)) {\n      return this.empty\n    }\n\n    const sorted = [...new Set(markingIds)].sort()\n    const key = sorted.join(\"\\u0000\")\n\n    let set = this.sets.get(key)\n    if (!set) {\n      set = new Set(sorted)\n      this.sets.set(key, set)\n    }\n\n    return set\n  }\n\n  /** The union of sets this instance created. */\n  union(sets: Iterable<ReadonlySet<string> | undefined>): ReadonlySet<string> {\n    let single: ReadonlySet<string> | undefined\n    const ids: string[] = []\n\n    for (const set of sets) {\n      if (!set || set.size === 0) continue\n      single = single === undefined && ids.length === 0 ? set : undefined\n      ids.push(...set)\n    }\n\n    return single ?? this.of(ids)\n  }\n}\n",
+    "import type { DatasetDefinition } from \"../datasets/types\"\nimport { isUnknownLineage, lineageColumn, versionLineage } from \"../lake-storage/lineage\"\nimport type { DatasetColumnRef, DatasetVersion, LakeStorage } from \"../lake-storage/types\"\nimport { MarkingSets } from \"./marking-sets\"\n\n/** Markings of each column of one dataset version. A column without markings has an empty set. */\nexport type VersionColumnMarkings = ReadonlyMap<string, ReadonlySet<string>>\n\nexport interface VersionClassification {\n  readonly columns: VersionColumnMarkings\n  /**\n   * Why part of the version was classified conservatively, with every marking it could hold.\n   * Absent when every column was classified from its lineage.\n   */\n  readonly conservative?: string\n}\n\n/**\n * Markings each version of a dataset carries.\n *\n * Markings are never stored. A column carries the markings its registered dataset declares, and\n * those every column its lineage lists declares. The version records that lineage resolved across\n * every upstream step and every row it keeps (`DatasetVersion.lineage`), so a version keeps the\n * classification of the code that produced it, and classifying it reads no other version.\n *\n * Wherever the record does not say what a column holds (no lineage on a pipeline version, or on\n * any version of a provider that does not declare `recordsLineage`, an unknown history, a column\n * it does not list, a dataset no longer registered) the column is classified with every marking\n * the project declares.\n */\nexport interface DatasetVersionMarkings {\n  classify(version: DatasetVersion): VersionClassification\n  /**\n   * Every marking declared on a registered column. Every classification, conservative ones\n   * included, is drawn from it, so a reader cleared for all of it needs no classification. Empty\n   * when the project declares no column markings.\n   */\n  everyMarking(): ReadonlySet<string>\n}\n\nexport interface DatasetVersionMarkingsOptions {\n  readonly datasets: { list(): readonly DatasetDefinition[] }\n  /** The lake the versions are read from: whether it records lineage on every version. */\n  readonly lakeStorage: Pick<LakeStorage, \"recordsLineage\">\n}\n\nexport function createDatasetVersionMarkings(\n  options: DatasetVersionMarkingsOptions\n): DatasetVersionMarkings {\n  const sets = new MarkingSets()\n\n  // Built on first use: a host that never classifies a version pays nothing for it.\n  let declared: ReadonlyMap<string, ReadonlyMap<string, ReadonlySet<string>>> | undefined\n  const declaredByDataset = () =>\n    (declared ??= new Map(\n      options.datasets\n        .list()\n        .map((dataset) => [\n          dataset.id,\n          new Map(dataset.schema.columns.map((column) => [column.name, sets.of(column.markings)])),\n        ])\n    ))\n\n  /**\n   * Every marking a registered column declares: what a column may hold where its record does not\n   * say. The pipelines that wrote it may have read datasets the current code no longer reads, so\n   * nothing narrower is safe.\n   */\n  let every: ReadonlySet<string> | undefined\n  const everyMarking = () =>\n    (every ??= sets.union(\n      [...declaredByDataset().values()].flatMap((columns) => [...columns.values()])\n    ))\n\n  const classify = (version: DatasetVersion): VersionClassification => {\n    const subject = `version '${version.versionId}' of '${version.datasetId}'`\n    const own = declaredByDataset().get(version.datasetId)\n\n    // No definition says what its columns declare: they may hold anything a column declares.\n    if (!own) return conservatively(version, `dataset '${version.datasetId}' is not registered`)\n\n    const lineage = versionLineage(version, options.lakeStorage)\n    if (isUnknownLineage(lineage)) {\n      // A reason core derived names this version. A recorded one names where the lineage was\n      // lost: upstream, or, for a provider that could not decode it, this version's own record.\n      return conservatively(\n        version,\n        lineage === version.lineage\n          ? `the lineage of ${subject} is unknown: ${lineage.unknown}`\n          : lineage.unknown\n      )\n    }\n\n    let conservative: string | undefined\n    const markingsOf = (ref: DatasetColumnRef): ReadonlySet<string> | undefined => {\n      const columns = declaredByDataset().get(ref.datasetId)\n      if (columns) return columns.get(ref.column)\n      conservative ??= `dataset '${ref.datasetId}' is not registered`\n      return everyMarking()\n    }\n\n    const rows = sets.union(lineage.rows.map(markingsOf))\n    const columns = new Map(\n      version.schema.columns.map(({ name }) => {\n        const values = lineageColumn(lineage, name)\n        if (!values) {\n          conservative ??= `${subject} recorded no lineage for column '${name}'`\n          return [name, everyMarking()]\n        }\n\n        return [name, sets.union([own.get(name), rows, ...values.map(markingsOf)])]\n      })\n    )\n\n    return { columns, ...(conservative === undefined ? {} : { conservative }) }\n  }\n\n  const conservatively = (version: DatasetVersion, reason: string): VersionClassification => {\n    const markings = everyMarking()\n    return {\n      columns: new Map(version.schema.columns.map(({ name }) => [name, markings])),\n      conservative: reason,\n    }\n  }\n\n  return { classify, everyMarking }\n}\n\n// ── Host capability ─────────────────────────────────────────\n\nconst datasetVersionMarkingsKey: unique symbol = Symbol(\"sixb.datasetVersionMarkings\")\n\ninterface DatasetVersionMarkingsOwner {\n  readonly [datasetVersionMarkingsKey]?: DatasetVersionMarkings\n}\n\n/** One classifier per host, so every reader shares the markings it reads from the definitions. */\nexport function registerDatasetVersionMarkings(\n  owner: object,\n  markings: DatasetVersionMarkings\n): void {\n  const registered = (owner as DatasetVersionMarkingsOwner)[datasetVersionMarkingsKey]\n  if (registered && registered !== markings) {\n    throw new Error(\"[Sixb] Dataset version markings are already registered for this owner.\")\n  }\n\n  Object.defineProperty(owner, datasetVersionMarkingsKey, {\n    configurable: false,\n    enumerable: false,\n    value: markings,\n    writable: false,\n  })\n}\n\nexport function getDatasetVersionMarkings(owner: object): DatasetVersionMarkings {\n  const markings = (owner as DatasetVersionMarkingsOwner)[datasetVersionMarkingsKey]\n  if (markings) return markings\n  throw new Error(\"[Sixb] Dataset version markings are not registered for this runtime.\")\n}\n\nexport function shareDatasetVersionMarkings(source: object, target: object): void {\n  registerDatasetVersionMarkings(target, getDatasetVersionMarkings(source))\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;AA2DO,SAAS,0BAA0B,CACxC,aACA,UACA,UACM;AAAA,EACN,MAAM,MAAM;AAAA,IACV,GAAG,YAAY,YAAY;AAAA,IAC3B,GAAG,YAAY,UAAU;AAAA,IACzB,GAAG,YAAY,cAAc;AAAA,EAC/B;AAAA,EAEA,WAAW,cAAc,KAAK;AAAA,IAC5B,MAAM,YAAY,CAAC,WAAmB,SAAS,GAAG,EAAE,WAAW,WAAW,WAAW,OAAO,CAAC;AAAA,IAC7F,MAAM,YAAY,eAAe,YAAY,UAAU,CAAC,WAAW;AAAA,MACjE,GAAG,UAAU,MAAM,EAAE,KAAK;AAAA,IAC5B,CAAC;AAAA,IACD,IAAI,CAAC;AAAA,MAAW;AAAA,IAEhB,MAAM,UAAU,CAAC,WAAoC;AAAA,MACnD,MAAM,UAAU,UAAU,MAAM;AAAA,MAChC,OAAO;AAAA,QACL,MAAM,gBAAgB,SAAS,GAAG,WAAW,aAAa,QAAQ;AAAA,QAClE,WAAW,CAAC,GAAG,QAAQ,OAAO,CAAC,EAAE,KAAK,CAAC,WAAW,OAAO,MAAM,SAAS,CAAC;AAAA,MAC3E;AAAA;AAAA,IAGF,MAAM,IAAI,yBACR,iBACE,sBAAsB,WAAW,OACjC,WAAW,WACX,WACA,OACF,CACF;AAAA,EACF;AAAA;AASK,SAAS,gCAA+B,CAAC,OAKvC;AAAA,EACP,QAAQ,YAAY,SAAS,mBAAmB;AAAA,EAChD,MAAM,aAAa,CAAC,WAAmB,CAAC,GAAI,eAAe,QAAQ,IAAI,MAAM,KAAK,CAAC,CAAE,EAAE,KAAK;AAAA,EAC5F,MAAM,YAAY,eAAe,YAAY,MAAM,UAAU,UAAU;AAAA,EACvE,IAAI,CAAC;AAAA,IAAW;AAAA,EAEhB,MAAM,UAAU,sBAAsB,WAAW,4BAA4B,QAAQ,0BAA0B,QAAQ;AAAA,EACvH,MAAM,UAAU,CAAC,YAAqC;AAAA,IACpD,MAAM,GAAG,YAAY,WAAW,MAAM,CAAC;AAAA,IACvC,WAAW;AAAA,EACb;AAAA,EACA,MAAM,eACJ,eAAe,iBAAiB,YAC5B,KACA,kFAAkF,eAAe;AAAA,EACvG,MAAM,QAAQ,4BAA4B,QAAQ;AAAA,EAElD,MAAM,IAAI,MACR,GAAG,iBAAiB,SAAS,QAAQ,WAAW,WAAW,OAAO,IAAI,gBAAgB,OACxF;AAAA;AA0BK,SAAS,iBAAiB,CAC/B,YACA,UACA,YACmB;AAAA,EACnB,MAAM,aAAwD,CAAC;AAAA,EAC/D,MAAM,OAA4C,CAAC;AAAA,EAEnD,WAAW,aAAa,4BAA4B,YAAY,UAAU,UAAU,GAAG;AAAA,IACrF,QAAQ,UAAU;AAAA,WACX;AAAA,QACH,WAAW,KAAK;AAAA,UACd,cAAc,UAAU;AAAA,UACxB,YAAY,UAAU;AAAA,UACtB,QAAQ,UAAU;AAAA,UAClB,UAAU,UAAU;AAAA,QACtB,CAAC;AAAA,QACD;AAAA,WACG,mBAAmB;AAAA,QACtB,MAAM,WAAW,WAAW,UAAU,MAAM;AAAA,QAC5C,WAAW,UAAU,UAAU,SAAS;AAAA,UACtC,KAAK,KAAK,EAAE,QAAQ,QAAQ,UAAU,QAAQ,MAAM,UAAU,MAAM,SAAS,CAAC;AAAA,QAChF;AAAA,QAEA,MAAM,WAAW,UAAU;AAAA,QAC3B,IAAI,YAAY,UAAU,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,MAAM,GAAG;AAAA,UAC1E,WAAW,KAAK,KAAK,UAAU,QAAQ,UAAU,QAAQ,SAAS,CAAC;AAAA,QACrE;AAAA,QACA;AAAA,MACF;AAAA,WAEK;AAAA,WACA;AAAA,QACH;AAAA;AAAA,EAEN;AAAA,EAEA,OAAO,EAAE,YAAY,KAAK;AAAA;AAK5B,SAAS,cAAc,CACrB,YACA,UACA,YACmC;AAAA,EACnC,MAAM,QAAQ,4BAA4B,YAAY,UAAU,UAAU,EAAE,KAAK;AAAA,EACjF,OAAO,MAAM,OAAO,OAAO,MAAM;AAAA;AAInC,UAAU,2BAA2B,CACnC,YACA,UACA,YACuC;AAAA,EACvC,QAAQ,WAAW;AAAA,SACZ,8BAA8B;AAAA,MACjC,MAAM,aAAa,SAAS,kBAAkB,WAAW,YAAY;AAAA,MACrE,IAAI;AAAA,QAAY,OAAO,2BAA2B,YAAY,YAAY,UAAU;AAAA,MACpF;AAAA,IACF;AAAA,SACK;AAAA,MACH,OAAO,yBAAyB,YAAY,UAAU;AAAA,MACtD;AAAA,SACG;AAAA,MACH,OAAO,8BAA8B,YAAY,UAAU;AAAA,MAC3D;AAAA;AAAA;AAIN,UAAU,0BAA0B,CAClC,YACA,YACA,YACuC;AAAA,EACvC,MAAM,WAAW,yBAAyB,YAAY,UAAU;AAAA,EAEhE,YAAY,YAAY,WAAW,OAAO,QAAQ,WAAW,UAAU,GAAG;AAAA,IACxE,MAAM,WAAW,WAAW,WAAW,KAAK,CAAC,cAAc,UAAU,OAAO,UAAU;AAAA,IACtF,MAAM,OAAO,GAAG,WAAW,MAAM;AAAA,IACjC,MAAM,UAAU,SAAS,IAAI,UAAU;AAAA,IAEvC,IAAI,SAAS;AAAA,MACX,IAAI,WAAW,MAAM,EAAE,SAAS,GAAG;AAAA,QACjC,MAAM;AAAA,UACJ,MAAM;AAAA,UACN;AAAA,UACA,MAAM,QAAQ;AAAA,UACd,SAAS,QAAQ;AAAA,UACjB,UAAU,EAAE,cAAc,WAAW,IAAI,WAAW;AAAA,QACtD;AAAA,MACF,EAAO,SAAI,UAAU,UAAU;AAAA,QAC7B,MAAM,EAAE,MAAM,qBAAqB,UAAU,MAAM,MAAM,QAAQ,KAAK;AAAA,MACxE;AAAA,MACA;AAAA,IACF;AAAA,IAEA,MAAM,WAAW,IAAI,IAAI,UAAU,YAAY,CAAC,CAAC;AAAA,IACjD,MAAM,UAAU,WAAW,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,SAAS,IAAI,SAAS,CAAC;AAAA,IACjF,IAAI,QAAQ,SAAS,GAAG;AAAA,MACtB,MAAM;AAAA,QACJ,MAAM;AAAA,QACN,UAAU;AAAA,QACV,cAAc,WAAW;AAAA,QACzB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,YAAY,QAAQ,SAAS,OAAO,QAAQ,WAAW,KAAK,GAAG;AAAA,IAC7D,IAAI,KAAK,gBAAgB;AAAA,MAAW;AAAA,IAEpC,MAAM,OAAO,cAAc,WAAW,MAAM;AAAA,IAC5C,MAAM,SAAS,WAAW,WAAW,IAAI,QAAQ,KAAK,kBAAkB;AAAA,IACxE,OAAO,gBAAgB,KAAK,aAAa,MAAM,CAAC,MAAM,GAAG,UAAU;AAAA,EACrE;AAAA,EAIA,MAAM,qBAAqB,WAAW;AAAA,EACtC,IAAI,oBAAoB,aAAa,cAAc;AAAA,IACjD,MAAM,OAAO;AAAA,IACb,MAAM,SAA8B,EAAE,MAAM,QAAQ,cAAc,WAAW,GAAG;AAAA,IAChF,OAAO,gBAAgB,mBAAmB,iBAAiB,MAAM,CAAC,MAAM,GAAG,UAAU;AAAA,EACvF;AAAA;AAGF,UAAU,wBAAwB,CAChC,YACA,YACuC;AAAA,EACvC,MAAM,OAAO,cAAc,WAAW,sBAAsB,WAAW;AAAA,EACvE,MAAM,UAAU;AAAA,IACd,WAAW,WAAW,oBAAoB,WAAW,QAAQ,WAAW,kBAAkB;AAAA,EAC5F;AAAA,EACA,OAAO,gBAAgB,WAAW,aAAa,MAAM,SAAS,UAAU;AAAA,EACxE,OAAO,gBAAgB,WAAW,aAAa,MAAM,SAAS,UAAU;AAAA;AAG1E,UAAU,6BAA6B,CACrC,YACA,YACuC;AAAA,EACvC,MAAM,UAAU;AAAA,IACd,WAAW;AAAA,IACX,WAAW;AAAA,IACX,GAAG,OAAO,OAAO,WAAW,UAAU,EAAE,QAAQ,CAAC,YAC/C,QAAQ,cAAc,YAClB,CAAC,QAAQ,UAAU,IACnB,CAAC,QAAQ,YAAY,QAAQ,SAAS,CAC5C;AAAA,EACF;AAAA,EAEA,WAAW,UAAU,SAAS;AAAA,IAC5B,IAAI,WAAW,MAAM,EAAE,SAAS;AAAA,MAAG,MAAM,EAAE,MAAM,aAAa,OAAO;AAAA,EACvE;AAAA;AASF,SAAS,wBAAwB,CAC/B,YACA,YAC8B;AAAA,EAC9B,MAAM,QAAQ,IAAI;AAAA,EAElB,WAAW,YAAY,WAAW,YAAY;AAAA,IAC5C,IAAI,CAAC,SAAS;AAAA,MAAS;AAAA,IACvB,MAAM,IAAI,SAAS,IAAI;AAAA,MACrB,MAAM,sBAAsB,WAAW;AAAA,MACvC,SAAS,CAAC,EAAE,MAAM,QAAQ,cAAc,WAAW,GAAG,CAAC;AAAA,IACzD,CAAC;AAAA,EACH;AAAA,EAEA,YAAY,QAAQ,SAAS,OAAO,QAAQ,WAAW,KAAK,GAAG;AAAA,IAC7D,IAAI,KAAK,qBAAqB;AAAA,MAAW;AAAA,IAEzC,MAAM,IAAI,KAAK,kBAAkB;AAAA,MAC/B,MAAM,cAAc,WAAW,MAAM;AAAA,MACrC,SAAS;AAAA,QACP,GAAI,MAAM,IAAI,KAAK,gBAAgB,GAAG,WAAW,CAAC;AAAA,QAClD,WAAW,WAAW,IAAI,QAAQ,KAAK,kBAAkB;AAAA,MAC3D;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,OAAO;AAAA;AAGT,SAAS,UAAU,CACjB,cACA,QACA,oBACqB;AAAA,EACrB,OAAO,EAAE,MAAM,QAAQ,cAAc,QAAQ,mBAAmB;AAAA;AAGlE,UAAU,eAAe,CACvB,QACA,MACA,SACA,YACuC;AAAA,EACvC,IAAI,WAAW,MAAM,EAAE,SAAS;AAAA,IAAG,MAAM,EAAE,MAAM,mBAAmB,QAAQ,MAAM,QAAQ;AAAA;AAW5F,SAAS,gBAAgB,CACvB,SACA,WACA,WACA,SACQ;AAAA,EACR,MAAM,OAAO,CAAC,WAAmB,GAAG,aAAa;AAAA,EAEjD,QAAQ,UAAU;AAAA,SACX;AAAA,MACH,OAAO,GAAG,sBAAsB,UAAU,uCAAuC,KAAK,UAAU,MAAM,qBAAqB,QAAQ,UAAU,MAAM,EAAE,uBAAuB,YAAY,UAAU,OAAO;AAAA,SACtM,mBAAmB;AAAA,MACtB,MAAM,UAAU,QAAQ,UAAU,MAAM;AAAA,MACxC,MAAM,YAAY,QAAQ,YAAY,iBAAiB,QAAQ,SAAS;AAAA,MACxE,OAAO,GAAG,oBAAoB,KAAK,UAAU,MAAM,MAAM,UAAU,iCAAiC;AAAA,IACtG;AAAA,SACK;AAAA,MACH,OAAO,GAAG,sBAAsB,UAAU,aAAa,UAAU;AAAA,SAC9D;AAAA,MACH,OAAO,GAAG,oBAAoB,KAAK,UAAU,MAAM,cAAc,QAAQ,UAAU,MAAM,EAAE;AAAA;AAAA;AAQ1F,SAAS,eAAe,CAAC,SAA+B,YAA4B;AAAA,EACzF,MAAM,SAAS,IAAI;AAAA,EACnB,YAAY,WAAW,WAAW,SAAS;AAAA,IACzC,MAAM,OAAO,WAAW,QAAQ,UAAU;AAAA,IAC1C,OAAO,IAAI,MAAM,CAAC,GAAI,OAAO,IAAI,IAAI,KAAK,CAAC,GAAI,SAAS,CAAC;AAAA,EAC3D;AAAA,EACA,OAAO,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,gBAAgB,GAAG,YAAY,UAAU,IAAI,MAAM,EAAE,KAAK,OAAO;AAAA;AAGlG,SAAS,UAAU,CAAC,QAAuB,YAA4B;AAAA,EACrE,MAAM,SAAS,GAAG,OAAO,OAAO,aAAa,OAAO,OAAO;AAAA,EAC3D,IAAI,OAAO,MAAM,WAAW,KAAK,WAAW;AAAA,IAAY,OAAO;AAAA,EAE/D,MAAM,QAAQ,OAAO,MAAM,IAAI,CAAC,SAAS,IAAI,OAAO,EAAE,KAAK,IAAI;AAAA,EAC/D,OAAO,UAAU,mBAAmB,OAAO,MAAM,WAAW,IAAI,SAAS,WAAW;AAAA;AAGtF,SAAS,WAAW,CAAC,UAAqC;AAAA,EACxD,OAAO,IAAI,SAAS,KAAK,IAAI;AAAA;;;ACvYxB,SAAS,eAAe,CAC7B,WAC2B;AAAA,EAC3B,OAAO,UAAU,QAAQ,CAAC,aACxB,SAAS,MAAM,MAAM,IAAI,GAAG,YAAY,EAAE,YAAY,SAAS,IAAI,KAAK,EAAE,CAC5E;AAAA;AAIK,SAAS,eAAe,CAC7B,cAC6D;AAAA,EAC7D,MAAM,WAAW,IAAI;AAAA,EAErB,OAAO,GAAG,WAAW;AAAA,IACnB,IAAI,KAAK,SAAS,SAAS;AAAA,MAAO;AAAA,IAElC,IAAI,UAAU,SAAS,IAAI,IAAI;AAAA,IAC/B,IAAI,CAAC,SAAS;AAAA,MACZ,UAAU,gBAAe,MAAM,YAAY;AAAA,MAC3C,SAAS,IAAI,MAAM,OAAO;AAAA,IAC5B;AAAA,IAEA,OAAO;AAAA;AAAA;AAIJ,SAAS,SAAS,CAAC,OAA+B;AAAA,EACvD,OAAO,GAAG,MAAM,cAAc,MAAM,KAAK;AAAA;AAK3C,IAAM,cAAoC,IAAI;AAAA;AAqBvC,MAAM,mBAA8C;AAAA,EACxC;AAAA,EAEA,WAAW,IAAI;AAAA,EAEf,cAAc,IAAI;AAAA,EAClB;AAAA,EACA,UAAU,IAAI;AAAA,EACd,QAAQ,IAAI;AAAA,EACZ,QAAQ,IAAI;AAAA,EAE7B,WAAW,CACT,cACA,OACA;AAAA,IACA,KAAK,eAAe;AAAA,IACpB,KAAK,UAAU,kBAAkB,KAAK;AAAA,IAEtC,WAAW,SAAS,OAAO;AAAA,MACzB,WAAW,SAAS,IAAI,IAAI,OAAO,OAAO,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,YAAY,QAAQ,EAAE,CAAC,GAAG;AAAA,QAC1F,SAAS,KAAK,SAAS,OAAO,KAAK;AAAA,MACrC;AAAA,IACF;AAAA;AAAA,EAGF,EAAE,CAAC,KAA6C;AAAA,IAC9C,OAAO,KAAK,cAAc,IAAI,SAAS,EAAE,IAAI,IAAI,MAAM,KAAK;AAAA;AAAA,EAO9D,MAAM,CAAC,WAAyE;AAAA,IAC9E,WAAW,SAAS,KAAK,SAAS;AAAA,MAChC,IAAI,KAAK,MAAM,IAAI,KAAK;AAAA,QAAG;AAAA,MAE3B,MAAM,UAAU,UAAU,KAAK;AAAA,MAC/B,IAAI,CAAC;AAAA,QAAS;AAAA,MAEd,KAAK,MAAM,IAAI,OAAO,EAAE,SAAS,OAAO,gBAAgB,MAAM,IAAI,EAAE,CAAC;AAAA,MACrE,KAAK,MAAM,IAAI,KAAK;AAAA,IACtB;AAAA,IAEA,WAAW,SAAS,KAAK,OAAO;AAAA,MAC9B,KAAK,MAAM,OAAO,KAAK;AAAA,MACvB,MAAM,QAAQ,KAAK,MAAM,IAAI,KAAK;AAAA,MAClC,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,OAAO,KAAK;AAAA,QAAG;AAAA,MAGzC,WAAW,UAAU,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,EAAE,KAAK,CAAC,GAAG;AAAA,QACjE,IAAI,KAAK,MAAM,IAAI,MAAM;AAAA,UAAG,KAAK,MAAM,IAAI,MAAM;AAAA,MACnD;AAAA,IACF;AAAA,IAEA,OAAO;AAAA;AAAA,EAID,KAAK,CAAC,SAAyB,SAAS,SAAgC;AAAA,IAC9E,MAAM,QAAQ,UAAU,KAAK;AAAA,IAC7B,MAAM,OAAO,KAAK,MAAM,QAAQ,IAAI;AAAA,IAEpC,WAAW,SAAS,IAAI,IAAI,OAAO,OAAO,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC,YAAY,QAAQ,EAAE,CAAC,GAAG;AAAA,MAC1F,YAAY,WAAW,WAAW,KAAK,YAAY,IAAI,KAAK,KAAK,CAAC,GAAG;AAAA,QACnE,IAAI,CAAC,KAAK,IAAI,SAAS;AAAA,UAAG,KAAK,IAAI,WAAW,MAAM;AAAA,MACtD;AAAA,IACF;AAAA,IAEA,IAAI;AAAA,IACJ,IAAI,UAAU;AAAA,IAEd,MAAM,WAAW,MAAM,KAAK,OAAO;AAAA,IACnC,IAAI,aAAa,KAAK,YAAY,IAAI,QAAQ;AAAA,IAE9C,YAAY,WAAW,WAAW,MAAM;AAAA,MACtC,IAAI,YAAY,IAAI,SAAS;AAAA,QAAG;AAAA,MAChC,IAAI,CAAC,YAAY;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,KAAK,YAAY,IAAI,UAAU,UAAU;AAAA,MAC3C;AAAA,MAEA,WAAW,IAAI,WAAW,EAAE,QAAQ,OAAO,QAAQ,OAAO,CAAC,GAAG,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,MACpF,UAAU;AAAA,IACZ;AAAA,IAEA,MAAM,SAAS,KAAK,cAAc,QAAQ;AAAA,IAC1C,aAAa,MAAM,YAAY,KAAK,aAAa,IAAI,QAAQ,GAAG,OAAO,WAAW,CAAC,GAAG;AAAA,MACpF,MAAM,SAAS,cAAc,SAAS,MAAM;AAAA,MAC5C,MAAM,cAAc,SAAS,KAAK,MAAM,MAAM,IAAK,aAAa,KAAK,MAAM,KAAK;AAAA,MAChF,IAAI,CAAC;AAAA,QAAQ,YAAY;AAAA,MAEzB,WAAW,UAAU,CAAC,MAAM,WAAW,GAAG;AAAA,QACxC,YAAY,WAAW,WAAW,QAAQ;AAAA,UACxC,IAAI,UAAU,OAAO,IAAI,MAAM;AAAA,UAC/B,IAAI,SAAS,IAAI,SAAS;AAAA,YAAG;AAAA,UAC7B,IAAI,CAAC,SAAS;AAAA,YACZ,UAAU,IAAI;AAAA,YACd,OAAO,IAAI,QAAQ,OAAO;AAAA,UAC5B;AAAA,UAEA,QAAQ,IAAI,WAAW,EAAE,QAAQ,OAAO,QAAQ,OAAO,CAAC,GAAG,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,UACjF,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AAAA,IAEA,OAAO;AAAA;AAAA,EAGD,aAAa,CAAC,WAAgD;AAAA,IACpE,IAAI,UAAU,KAAK,SAAS,IAAI,SAAS;AAAA,IACzC,IAAI,CAAC,SAAS;AAAA,MACZ,UAAU,IAAI;AAAA,MACd,WAAW,UAAU,KAAK,aAAa,IAAI,SAAS,GAAG,OAAO,WAAW,CAAC,GAAG;AAAA,QAC3E,IAAI,CAAC,OAAO,UAAU;AAAA,UAAQ;AAAA,QAE9B,MAAM,SAAS,EAAE,QAAQ,EAAE,WAAW,QAAQ,OAAO,KAAK,GAAG,OAAO,CAAC,EAAE;AAAA,QACvE,QAAQ,IAAI,OAAO,MAAM,IAAI,IAAI,OAAO,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;AAAA,MAC7E;AAAA,MAEA,KAAK,SAAS,IAAI,WAAW,OAAO;AAAA,IACtC;AAAA,IAEA,OAAO;AAAA;AAAA,EAID,KAAK,CAAC,SAAsD;AAAA,IAClE,MAAM,QAAwB,IAAI;AAAA,IAClC,WAAW,UAAU,SAAS;AAAA,MAC5B,YAAY,WAAW,WAAW,KAAK,GAAG,MAAM,GAAG;AAAA,QACjD,IAAI,CAAC,MAAM,IAAI,SAAS;AAAA,UAAG,MAAM,IAAI,WAAW,MAAM;AAAA,MACxD;AAAA,IACF;AAAA,IACA,OAAO;AAAA;AAEX;AAGA,SAAS,iBAAiB,CAAC,OAA6D;AAAA,EACtF,MAAM,YAAY,mBAAmB,KAAK;AAAA,EAC1C,MAAM,UAA4B,CAAC;AAAA,EACnC,MAAM,UAAU,IAAI;AAAA,EAEpB,MAAM,QAAQ,CAAC,UAAgC;AAAA,IAC7C,IAAI,QAAQ,IAAI,KAAK;AAAA,MAAG;AAAA,IAExB,QAAQ,IAAI,KAAK;AAAA,IACjB,WAAW,SAAS,OAAO,OAAO,MAAM,KAAK,MAAM,GAAG;AAAA,MACpD,WAAW,YAAY,UAAU,IAAI,MAAM,EAAE,KAAK,CAAC;AAAA,QAAG,MAAM,QAAQ;AAAA,IACtE;AAAA,IAEA,QAAQ,KAAK,KAAK;AAAA;AAAA,EAGpB,WAAW,SAAS;AAAA,IAAO,MAAM,KAAK;AAAA,EACtC,OAAO;AAAA;AAGT,SAAS,kBAAkB,CACzB,OACgD;AAAA,EAChD,MAAM,YAAY,IAAI;AAAA,EACtB,WAAW,SAAS;AAAA,IAAO,SAAS,WAAW,MAAM,KAAK,OAAO,IAAI,KAAK;AAAA,EAC1E,OAAO;AAAA;AAGT,SAAS,QAAgB,CAAC,KAA4B,KAAa,OAAqB;AAAA,EACtF,MAAM,SAAS,IAAI,IAAI,GAAG;AAAA,EAC1B,IAAI;AAAA,IAAQ,OAAO,KAAK,KAAK;AAAA,EACxB;AAAA,QAAI,IAAI,KAAK,CAAC,KAAK,CAAC;AAAA;;;AClNpB,SAAS,mBAAmB,CACjC,YACA,QACA,MACA,SACqB;AAAA,EACrB,QAAQ,WAAW,cAAc,OAAO;AAAA,EACxC,MAAM,UAAU,YAAY,kBAAkB;AAAA,EAC9C,MAAM,SAAS,iBAAiB,UAAU;AAAA,EAC1C,MAAM,OAAO,UAAU,WAAW,KAAK,SAAS,SAAS,KAAK,UAAU,WAAW,OAAO;AAAA,EAC1F,MAAM,QAAQ,CAAC,GAAG,QAAQ,YAAY,EAAE,KAAK;AAAA,EAE7C,IAAI,KAAK,SAAS,UAAU;AAAA,IAC1B,OAAO,OAAO,WAAW,IAAI,QAAQ,OAAO,MAAM;AAAA,MAChD,QAAQ,OAAO;AAAA,MACf,QAAQ,WAAW,mDAAmD,SAAS,aAAa,KAAK,KAAK,CAAC;AAAA,IACzG,CAAC;AAAA,EACH;AAAA,EAEA,IAAI,KAAK,SAAS,WAAW;AAAA,IAC3B,OAAO,OAAO,WAAW,IAAI,QAAQ,OAAO,MAAM;AAAA,MAChD,QAAQ,OAAO;AAAA,MACf,QAAQ,WAAW;AAAA,IACrB,CAAC;AAAA,EACH;AAAA,EAEA,QAAQ,SAAS,iBAAiB,KAAK;AAAA,EACvC,MAAM,UACJ,iBAAiB,YACb,KACA,kFAAkF;AAAA,EAExF,IACE,cAAc,WAAW,aACzB,OAAO,uBAAuB,QAAQ,WAAW,WAAW,EAAE,GAC9D;AAAA,IACA,MAAM,WAAW,uBAAuB,MAAM,QAAQ,YAAY;AAAA,IAClE,OAAO,OAAO,WAAW,IAAI,QAAQ,UAAU,MAAM;AAAA,MACnD,QAAQ,OAAO;AAAA,MACf,QAAQ,WAAW,mFAAmF,aAAY,QAAQ,KAAK;AAAA,IACjI,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,aAAa,CAAC,WAAmB,CAAC,GAAI,QAAQ,IAAI,MAAM,KAAK,CAAC,CAAE,EAAE,KAAK;AAAA,EAC7E,MAAM,UAAU,kBAAkB,YAAY,QAAQ,UAAU,UAAU;AAAA,EAC1E,IAAI,QAAQ,WAAW,WAAW,KAAK,QAAQ,KAAK,WAAW;AAAA,IAAG,OAAO;AAAA,EAEzE,MAAM,SAAS,CAAC,SAAiB,IAAI,aAAa;AAAA,EAClD,MAAM,QAAQ,QAAQ,KAAK,IAAI,CAAC,SAAS;AAAA,IACvC,QAAQ,IAAI;AAAA,IACZ,MAAM;AAAA,MACJ,cAAc,WAAW;AAAA,MACzB,UAAU,IAAI;AAAA,MACd,QAAQ,mBAAmB,iCAAiC,OAAO,IAAI,MAAM,YAAY,IAAI;AAAA,IAC/F;AAAA,EACF,EAAE;AAAA,EAEF,MAAM,UAAU;AAAA,IACd,GAAG,QAAQ,KAAK,IACd,CAAC,QAAQ,UAAU,OAAO,IAAI,MAAM,KAAK,IAAI,oBAAoB,aAAY,IAAI,QAAQ,GAC3F;AAAA,IACA,GAAG,QAAQ,WAAW,IACpB,CAAC,aACC,aAAa,SAAS,gBAAgB,SAAS,wCAAwC,OAAO,SAAS,MAAM,oBAAoB,aAAY,SAAS,QAAQ,GAClK;AAAA,EACF;AAAA,EAEA,MAAM,eAAyB,CAAC;AAAA,EAChC,IAAI,MAAM,SAAS,GAAG;AAAA,IACpB,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,QAAQ,GAAG,WAAW,KAAK,QAAQ,CAAC,CAAC,EAAE,KAAK;AAAA,IAC/E,aAAa,KACX,GAAG,gBAAgB,MAAM,IAAI,GAAG,aAAa,MAAM,CAAC,0CAA0C,aAAY,QAAQ,GACpH;AAAA,EACF;AAAA,EAEA,IAAI,QAAQ,WAAW,SAAS,GAAG;AAAA,IACjC,MAAM,QAAQ,QAAQ,WAAW,IAAI,CAAC,MAAM,IAAI,EAAE,gBAAgB,EAAE,aAAa;AAAA,IACjF,MAAM,OAAO,QAAQ,WAAW,WAAW,IAAI,UAAU;AAAA,IACzD,aAAa,KAAK,GAAG,cAAc,KAAK,KAAK,qBAAqB;AAAA,EACpE;AAAA,EAEA,OAAO;AAAA,IACL,YAAY,QAAQ,WAAW,IAAI,GAAG,cAAc,YAAY,gBAAgB;AAAA,MAC9E;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,cAAc,WAAW;AAAA,MACzB,QAAQ,MAAM,SAAS;AAAA,MACvB,SAAS,sBAAsB,WAAW,eAAe,qBAAqB,QAAQ,KAAK,IAAI,KAAK,WAAW,WAAW,aAAa,KAAK,QAAQ,CAAC,6DAA6D;AAAA,IACpN;AAAA,EACF;AAAA;AAIK,SAAS,sBAAsB,CACpC,MACA,cACmB;AAAA,EACnB,IAAI,KAAK,SAAS;AAAA,IAAQ,OAAO,CAAC,GAAG,YAAY,EAAE,KAAK;AAAA,EAExD,QAAQ,YAAY,KAAK;AAAA,EACzB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,QAAQ,OAAO,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK;AAAA;AAetE,SAAS,mBAAmB,CACjC,YACA,QACA,MACA,SACmC;AAAA,EACnC,QAAQ,iBAAiB;AAAA,EAEzB,IACE,KAAK,SAAS,UACd,WAAW,cAAc,OAAO,aAChC,WAAW,iBAAiB,cAC5B;AAAA,IACA,QAAQ,YAAY,KAAK;AAAA,IACzB,OAAO,OAAO,QAAQ,WAAW,UAAU,EAAE,QAAQ,EAAE,YAAY,YAAY;AAAA,MAC7E,MAAM,WAAW,CAAC,GAAI,QAAQ,IAAI,MAAM,KAAK,CAAC,CAAE,EAAE,KAAK;AAAA,MACvD,OAAO,SAAS,WAAW,IAAI,CAAC,IAAI,CAAC,EAAE,cAAc,YAAY,SAAS,CAAC;AAAA,KAC5E;AAAA,EACH;AAAA,EAEA,MAAM,WAAW,uBAAuB,MAAM,QAAQ,YAAY;AAAA,EAClE,IAAI,SAAS,WAAW;AAAA,IAAG,OAAO,CAAC;AAAA,EAEnC,QAAQ,QAAQ,SAAS,kBAAkB,YAAY,GAAG,cAAc,CAAC,GACtE,OAAO,CAAC,aAAa,CAAC,SAAS,OAAO,EACtC,IAAI,CAAC,cAAc,EAAE,cAAc,YAAY,SAAS,IAAI,SAAS,EAAE;AAAA;AAIrE,SAAS,kBAAkB,CAChC,WAC2C;AAAA,EAC3C,MAAM,YAAY,IAAI;AAAA,EACtB,aAAa,YAAY,UAAU,gBAAgB,SAAS,GAAG;AAAA,IAC7D,IAAI,CAAC,UAAU,IAAI,KAAK,OAAO,EAAE;AAAA,MAAG,UAAU,IAAI,KAAK,OAAO,IAAI,UAAU;AAAA,EAC9E;AAAA,EAEA,OAAO,CAAC,cAAc,UAAU,IAAI,SAAS;AAAA;AAI/C,SAAS,MAAM,CACb,cACA,QACA,UACA,MACA,MACqB;AAAA,EACrB,IAAI,SAAS,WAAW;AAAA,IAAG,OAAO;AAAA,EAClC,OAAO;AAAA,IACL,YAAY,CAAC;AAAA,IACb,OAAO,CAAC,EAAE,QAAQ,MAAM,EAAE,cAAc,UAAU,QAAQ,KAAK,OAAO,EAAE,CAAC;AAAA,IACzE,QAAQ;AAAA,MACN;AAAA,MACA,QAAQ;AAAA,MACR,SAAS,sBAAsB,iBAAiB,KAAK,UAAU,gBAAgB,CAAC,MAAM,CAAC,0CAA0C,aAAY,QAAQ,6DAA6D;AAAA,IACpN;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CAAC,YAAmD;AAAA,EAC3E,OAAO,WAAW,SAAS,+BACvB,EAAE,MAAM,QAAQ,cAAc,WAAW,aAAa,IACtD;AAAA,IACE,MAAM;AAAA,IACN,cAAc,WAAW;AAAA,IACzB,QAAQ,WAAW;AAAA,IACnB,oBAAoB,WAAW;AAAA,EACjC;AAAA;AAGN,SAAS,SAAS,CAChB,WACA,SACA,SACQ;AAAA,EACR,MAAM,aACJ,QAAQ,WAAW,SAAS,MAC3B,SAAS,UAAU,SAAS,aAAa,QAAQ,SAAS,KAAK;AAAA,EAClE,OAAO,eAAe,YAClB,2BAA2B,8BAC3B,mBAAmB;AAAA;AAGzB,SAAS,eAAe,CAAC,SAAiD;AAAA,EACxE,OAAO,cACL,QAAQ,IAAI,CAAC,WACX,OAAO,SAAS,SACZ,IAAI,OAAO,kBACX,SAAS,OAAO,gBAAgB,OAAO,SAC7C,CACF;AAAA;AAGF,SAAS,aAAa,CAAC,OAAkC;AAAA,EACvD,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC;AAAA,EACjC,MAAM,OAAO,OAAO,IAAI,KAAK;AAAA,EAC7B,OAAO,OAAO,WAAW,IAAI,OAAO,GAAG,OAAO,KAAK,IAAI,SAAS;AAAA;AAGlE,SAAS,UAAU,CAAC,MAAsB;AAAA,EACxC,OAAO,KAAK,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,MAAM,CAAC;AAAA;AAG7C,SAAS,QAAQ,CAAC,MAAsB;AAAA,EAC7C,OAAO,KAAK,SAAS,GAAG,IAAI,OAAO,GAAG;AAAA;AAGxC,SAAS,YAAW,CAAC,UAAqC;AAAA,EACxD,OAAO,IAAI,SAAS,KAAK,IAAI;AAAA;AAGxB,SAAS,YAAY,CAAC,OAAwB;AAAA,EACnD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA;;;AChR9D,IAAM,qBAAoC,OAAO,sBAAsB;AAOhE,SAAS,uBAAuB,CAAC,OAAe,UAAiC;AAAA,EACtF,MAAM,aAAc,MAA+B;AAAA,EACnD,IAAI,cAAc,eAAe,UAAU;AAAA,IACzC,MAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AAAA,EAEA,OAAO,eAAe,OAAO,oBAAoB;AAAA,IAC/C,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,UAAU;AAAA,EACZ,CAAC;AAAA;AAGI,SAAS,mBAAkB,CAAC,OAAgC;AAAA,EACjE,MAAM,WAAY,MAA+B;AAAA,EACjD,IAAI;AAAA,IAAU,OAAO;AAAA,EACrB,MAAM,IAAI,MAAM,8DAA8D;AAAA;AAOzE,SAAS,oBAAmB,CAAC,OAAqB;AAAA,EACvD,oBAAmB,KAAK,EACrB,QAAQ,EACR,MAAM,CAAC,UAAmB;AAAA,IACzB,QAAQ,KAAK,aAAa,KAAK,CAAC;AAAA,GACjC;AAAA;;;ACjCE,MAAM,YAAY;AAAA,EACd,QAA6B,IAAI;AAAA,EACzB,OAAO,IAAI,IAAiC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;AAAA,EAE/E,EAAE,CAAC,YAA+D;AAAA,IAEhE,IAAI,eAAe,aAAc,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,GAAI;AAAA,MACtF,OAAO,KAAK;AAAA,IACd;AAAA,IAEA,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,UAAU,CAAC,EAAE,KAAK;AAAA,IAC7C,MAAM,MAAM,OAAO,KAAK,MAAQ;AAAA,IAEhC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG;AAAA,IAC3B,IAAI,CAAC,KAAK;AAAA,MACR,MAAM,IAAI,IAAI,MAAM;AAAA,MACpB,KAAK,KAAK,IAAI,KAAK,GAAG;AAAA,IACxB;AAAA,IAEA,OAAO;AAAA;AAAA,EAIT,KAAK,CAAC,MAAsE;AAAA,IAC1E,IAAI;AAAA,IACJ,MAAM,MAAgB,CAAC;AAAA,IAEvB,WAAW,OAAO,MAAM;AAAA,MACtB,IAAI,CAAC,OAAO,IAAI,SAAS;AAAA,QAAG;AAAA,MAC5B,SAAS,WAAW,aAAa,IAAI,WAAW,IAAI,MAAM;AAAA,MAC1D,IAAI,KAAK,GAAG,GAAG;AAAA,IACjB;AAAA,IAEA,OAAO,UAAU,KAAK,GAAG,GAAG;AAAA;AAEhC;;;ACKO,SAAS,4BAA4B,CAC1C,SACwB;AAAA,EACxB,MAAM,OAAO,IAAI;AAAA,EAGjB,IAAI;AAAA,EACJ,MAAM,oBAAoB,MACvB,aAAa,IAAI,IAChB,QAAQ,SACL,KAAK,EACL,IAAI,CAAC,YAAY;AAAA,IAChB,QAAQ;AAAA,IACR,IAAI,IAAI,QAAQ,OAAO,QAAQ,IAAI,CAAC,WAAW,CAAC,OAAO,MAAM,KAAK,GAAG,OAAO,QAAQ,CAAC,CAAC,CAAC;AAAA,EACzF,CAAC,CACL;AAAA,EAOF,IAAI;AAAA,EACJ,MAAM,eAAe,MAClB,UAAU,KAAK,MACd,CAAC,GAAG,kBAAkB,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAC9E;AAAA,EAEF,MAAM,WAAW,CAAC,YAAmD;AAAA,IACnE,MAAM,UAAU,YAAY,QAAQ,kBAAkB,QAAQ;AAAA,IAC9D,MAAM,MAAM,kBAAkB,EAAE,IAAI,QAAQ,SAAS;AAAA,IAGrD,IAAI,CAAC;AAAA,MAAK,OAAO,eAAe,SAAS,YAAY,QAAQ,8BAA8B;AAAA,IAE3F,MAAM,UAAU,eAAe,SAAS,QAAQ,WAAW;AAAA,IAC3D,IAAI,iBAAiB,OAAO,GAAG;AAAA,MAG7B,OAAO,eACL,SACA,YAAY,QAAQ,UAChB,kBAAkB,uBAAuB,QAAQ,YACjD,QAAQ,OACd;AAAA,IACF;AAAA,IAEA,IAAI;AAAA,IACJ,MAAM,aAAa,CAAC,QAA2D;AAAA,MAC7E,MAAM,UAAU,kBAAkB,EAAE,IAAI,IAAI,SAAS;AAAA,MACrD,IAAI;AAAA,QAAS,OAAO,QAAQ,IAAI,IAAI,MAAM;AAAA,MAC1C,iBAAiB,YAAY,IAAI;AAAA,MACjC,OAAO,aAAa;AAAA;AAAA,IAGtB,MAAM,OAAO,KAAK,MAAM,QAAQ,KAAK,IAAI,UAAU,CAAC;AAAA,IACpD,MAAM,UAAU,IAAI,IAClB,QAAQ,OAAO,QAAQ,IAAI,GAAG,WAAW;AAAA,MACvC,MAAM,SAAS,cAAc,SAAS,IAAI;AAAA,MAC1C,IAAI,CAAC,QAAQ;AAAA,QACX,iBAAiB,GAAG,2CAA2C;AAAA,QAC/D,OAAO,CAAC,MAAM,aAAa,CAAC;AAAA,MAC9B;AAAA,MAEA,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,IAAI,IAAI,GAAG,MAAM,GAAG,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC;AAAA,KAC3E,CACH;AAAA,IAEA,OAAO,EAAE,YAAa,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa,EAAG;AAAA;AAAA,EAG5E,MAAM,iBAAiB,CAAC,SAAyB,WAA0C;AAAA,IACzF,MAAM,WAAW,aAAa;AAAA,IAC9B,OAAO;AAAA,MACL,SAAS,IAAI,IAAI,QAAQ,OAAO,QAAQ,IAAI,GAAG,WAAW,CAAC,MAAM,QAAQ,CAAC,CAAC;AAAA,MAC3E,cAAc;AAAA,IAChB;AAAA;AAAA,EAGF,OAAO,EAAE,UAAU,aAAa;AAAA;AAKlC,IAAM,4BAA2C,OAAO,6BAA6B;AAO9E,SAAS,8BAA8B,CAC5C,OACA,UACM;AAAA,EACN,MAAM,aAAc,MAAsC;AAAA,EAC1D,IAAI,cAAc,eAAe,UAAU;AAAA,IACzC,MAAM,IAAI,MAAM,wEAAwE;AAAA,EAC1F;AAAA,EAEA,OAAO,eAAe,OAAO,2BAA2B;AAAA,IACtD,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,UAAU;AAAA,EACZ,CAAC;AAAA;AAGI,SAAS,0BAAyB,CAAC,OAAuC;AAAA,EAC/E,MAAM,WAAY,MAAsC;AAAA,EACxD,IAAI;AAAA,IAAU,OAAO;AAAA,EACrB,MAAM,IAAI,MAAM,sEAAsE;AAAA;AAGjF,SAAS,4BAA2B,CAAC,QAAgB,QAAsB;AAAA,EAChF,+BAA+B,QAAQ,2BAA0B,MAAM,CAAC;AAAA;",
+  "debugId": "BCFE94079FF12A1E64756E2164756E21",
+  "names": []
+}

package/dist/chunk-65abf64x.js

@@ -0,0 +1,13 @@
+// @bun
+// src/lake-storage/errors.ts
+class LakeStorageError2 extends Error {
+  name = "LakeStorageError";
+}
+
+class LakeConcurrencyError2 extends LakeStorageError2 {
+  name = "LakeConcurrencyError";
+}
+
+export { LakeStorageError2, LakeConcurrencyError2 };
+
+//# debugId=1ABED9E92576F82564756E2164756E21

package/dist/chunk-65abf64x.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/lake-storage/errors.ts"],
+  "sourcesContent": [
+    "/**\n * Error for lake-storage invariants and invalid lake operations.\n */\nexport class LakeStorageError extends Error {\n  readonly name: string = \"LakeStorageError\"\n}\n\n/** A known, uncommitted version/transaction conflict; safe to retry staged changes. */\nexport class LakeConcurrencyError extends LakeStorageError {\n  override readonly name = \"LakeConcurrencyError\"\n}\n"
+  ],
+  "mappings": ";;AAGO,MAAM,0BAAyB,MAAM;AAAA,EACjC,OAAe;AAC1B;AAAA;AAGO,MAAM,8BAA6B,kBAAiB;AAAA,EACvC,OAAO;AAC3B;",
+  "debugId": "1ABED9E92576F82564756E2164756E21",
+  "names": []
+}

package/dist/{chunk-hvsb78a1.js → chunk-65pyhyas.js}

@@ -2,16 +2,21 @@
 import {
   isFileRef2,
   isValidFileRef
-} from "./chunk-jhm3zsa7.js";
+} from "./chunk-wkv3h3q7.js";
 import {
-  withFailureMessage
-} from "./chunk-z3y5kg1x.js";
+  withFailureMessage2
+} from "./chunk-6eqsgvxk.js";
 import {
-  assertEmbeddingModelRef
-} from "./chunk-kyjcwqz6.js";
+  isUserRef,
+  isCurrentUser,
+  currentUserNotStorableMessage
+} from "./chunk-4y26vs3v.js";
 import {
   OntologyValidationError2
 } from "./chunk-cqr3acm1.js";
+import {
+  assertEmbeddingModelRef
+} from "./chunk-kyjcwqz6.js";
 import {
   normalizeDecimalValue2,
   isDecimalString2
@@ -21,77 +26,6 @@ import {
   cloneJsonValue2
 } from "./chunk-wy0qdqfm.js";
 
-// src/ontology/user-ref.ts
-function userRef2(id) {
-  if (typeof id !== "string" || !id.trim()) {
-    throw new OntologyValidationError2("[Sixb] User reference id must not be empty.");
-  }
-  return Object.freeze({ type: "user", id });
-}
-function isUserRef(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value))
-    return false;
-  const record = value;
-  return Object.keys(record).every((key) => key === "type" || key === "id") && record.type === "user" && typeof record.id === "string" && record.id.trim().length > 0;
-}
-function collectUserRefIds(schema, value, valueTypesById, into, seenValueTypeIds = new Set) {
-  if (value === null || value === undefined)
-    return into;
-  if (typeof schema === "string") {
-    if (schema === "userRef" && isUserRef(value))
-      into.add(value.id);
-    return into;
-  }
-  switch (schema.type) {
-    case "array":
-      if (Array.isArray(value)) {
-        for (const item of value) {
-          collectUserRefIds(schema.items, item, valueTypesById, into, seenValueTypeIds);
-        }
-      }
-      return into;
-    case "map":
-      if (isRecord(value)) {
-        for (const item of Object.values(value)) {
-          collectUserRefIds(schema.valueSchema, item, valueTypesById, into, seenValueTypeIds);
-        }
-      }
-      return into;
-    case "object":
-      if (isRecord(value)) {
-        for (const [fieldId, field] of Object.entries(schema.properties)) {
-          collectUserRefIds(field.schema, value[fieldId], valueTypesById, into, seenValueTypeIds);
-        }
-      }
-      return into;
-    case "valueTypeRef": {
-      if (seenValueTypeIds.has(schema.valueTypeId))
-        return into;
-      const resolved = schema._resolved ?? valueTypesById.get(schema.valueTypeId)?.schema;
-      if (!resolved)
-        return into;
-      return collectUserRefIds(resolved, value, valueTypesById, into, new Set([...seenValueTypeIds, schema.valueTypeId]));
-    }
-    case "enum":
-      return into;
-  }
-}
-function userReferenceProblem(path, id, status) {
-  switch (status) {
-    case "active":
-      return;
-    case null:
-      return `[Sixb] ${path} references user '${id}', which does not exist.`;
-    case "unverifiable":
-      return `[Sixb] ${path} references user '${id}', but this runtime has no auth storage to verify users. Configure storage with auth to write user references.`;
-    default:
-      return `[Sixb] ${path} references user '${id}', who is ${status}. Only active users can be newly referenced; existing references are kept.`;
-  }
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
 // src/ontology/validation/schema.ts
 function validateSchemaValue2(schema, value, path, valueTypesById, diagnosticPath = path) {
   if (typeof schema === "string") {
@@ -99,50 +33,53 @@ function validateSchemaValue2(schema, value, path, valueTypesById, diagnosticPat
       case "string":
       case "uuid": {
         if (typeof value !== "string") {
-          throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path} must be a string`), `Property ${diagnosticPath} must be a string.`);
+          throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path} must be a string`), `Property ${diagnosticPath} must be a string.`);
         }
         return;
       }
       case "boolean": {
         if (typeof value !== "boolean") {
-          throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path} must be a boolean`), `Property ${diagnosticPath} must be a boolean.`);
+          throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path} must be a boolean`), `Property ${diagnosticPath} must be a boolean.`);
         }
         return;
       }
       case "integer": {
         if (typeof value !== "number" || !Number.isInteger(value)) {
-          throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path} must be an integer`), `Property ${diagnosticPath} must be an integer.`);
+          throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path} must be an integer`), `Property ${diagnosticPath} must be an integer.`);
         }
         return;
       }
       case "double": {
         if (typeof value !== "number" || !Number.isFinite(value)) {
-          throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path} must be numeric`), `Property ${diagnosticPath} must be numeric.`);
+          throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path} must be numeric`), `Property ${diagnosticPath} must be numeric.`);
         }
         return;
       }
       case "decimal": {
         if (!isDecimalString2(value)) {
-          throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path} must be an exact decimal string`), `Property ${diagnosticPath} must be an exact decimal string.`);
+          throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path} must be an exact decimal string`), `Property ${diagnosticPath} must be an exact decimal string.`);
         }
         return;
       }
       case "date":
       case "timestamp": {
         if (!(value instanceof Date) && typeof value !== "string") {
-          throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path} must be a Date or ISO string`), `Property ${diagnosticPath} must be a Date or ISO string.`);
+          throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path} must be a Date or ISO string`), `Property ${diagnosticPath} must be a Date or ISO string.`);
         }
         return;
       }
       case "fileRef": {
         if (!isFileRef2(value)) {
-          throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path} must be a fileRef`), `Property ${diagnosticPath} must be a fileRef.`);
+          throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path} must be a fileRef`), `Property ${diagnosticPath} must be a fileRef.`);
         }
         return;
       }
       case "userRef": {
+        if (isCurrentUser(value)) {
+          throw withFailureMessage2(new OntologyValidationError2(`[Sixb] ${currentUserNotStorableMessage(`Property ${path}`)}`), currentUserNotStorableMessage(`Property ${diagnosticPath}`));
+        }
         if (!isUserRef(value)) {
-          throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path} must be a user reference { type: "user", id }`), `Property ${diagnosticPath} must be a user reference.`);
+          throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path} must be a user reference { type: "user", id }`), `Property ${diagnosticPath} must be a user reference.`);
         }
         return;
       }
@@ -151,13 +88,13 @@ function validateSchemaValue2(schema, value, path, valueTypesById, diagnosticPat
   }
   if (schema.type === "enum") {
     if (!schema.values.includes(value)) {
-      throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path} must be one of: ${schema.values.join(", ")}`), `Property ${diagnosticPath} must match a declared enum value.`);
+      throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path} must be one of: ${schema.values.join(", ")}`), `Property ${diagnosticPath} must match a declared enum value.`);
     }
     return;
   }
   if (schema.type === "array") {
     if (!Array.isArray(value)) {
-      throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path} must be an array`), `Property ${diagnosticPath} must be an array.`);
+      throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path} must be an array`), `Property ${diagnosticPath} must be an array.`);
     }
     for (let index = 0;index < value.length; index += 1) {
       validateSchemaValue2(schema.items, value[index], `${path}[${index}]`, valueTypesById, `${diagnosticPath}[${index}]`);
@@ -166,7 +103,7 @@ function validateSchemaValue2(schema, value, path, valueTypesById, diagnosticPat
   }
   if (schema.type === "map") {
     if (!isRecord2(value)) {
-      throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path} must be an object map`), `Property ${diagnosticPath} must be an object map.`);
+      throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path} must be an object map`), `Property ${diagnosticPath} must be an object map.`);
     }
     for (const [key, entry] of Object.entries(value)) {
       validateSchemaValue2(schema.valueSchema, entry, `${path}.${key}`, valueTypesById, `${diagnosticPath}.*`);
@@ -175,20 +112,20 @@ function validateSchemaValue2(schema, value, path, valueTypesById, diagnosticPat
   }
   if (schema.type === "object") {
     if (!isRecord2(value)) {
-      throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path} must be an object`), `Property ${diagnosticPath} must be an object.`);
+      throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path} must be an object`), `Property ${diagnosticPath} must be an object.`);
     }
     const fields = schema.properties;
     const fieldIds = new Set(Object.keys(fields));
     for (const fieldId of Object.keys(value)) {
       if (!fieldIds.has(fieldId)) {
-        throw withFailureMessage(new OntologyValidationError2(`[Sixb] Unknown field '${path}.${fieldId}'`), `Object ${diagnosticPath} contains an undeclared field.`);
+        throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Unknown field '${path}.${fieldId}'`), `Object ${diagnosticPath} contains an undeclared field.`);
       }
     }
     for (const [fieldId, field] of Object.entries(fields)) {
       const fieldValue = value[fieldId];
       if (fieldValue === undefined) {
         if (field.required) {
-          throw withFailureMessage(new OntologyValidationError2(`[Sixb] Missing required field '${path}.${fieldId}'`), `Missing required field '${diagnosticPath}.${fieldId}'.`);
+          throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Missing required field '${path}.${fieldId}'`), `Missing required field '${diagnosticPath}.${fieldId}'.`);
         }
         continue;
       }
@@ -203,7 +140,7 @@ function validateSchemaValue2(schema, value, path, valueTypesById, diagnosticPat
 function assertValidFileRefs2(value, path) {
   if (isFileRef2(value)) {
     if (!isValidFileRef(value)) {
-      throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path}.mediaType must be one media type, such as "application/pdf"`), `Property ${path}.mediaType must be one media type, such as "application/pdf".`);
+      throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path}.mediaType must be one media type, such as "application/pdf"`), `Property ${path}.mediaType must be one media type, such as "application/pdf".`);
     }
     return;
   }
@@ -220,7 +157,7 @@ function validateFieldValue(field, value, path, valueTypesById, diagnosticPath =
     if (field.nullable) {
       return;
     }
-    throw withFailureMessage(new OntologyValidationError2(`[Sixb] Field ${path} cannot be null`), `Field ${diagnosticPath} cannot be null.`);
+    throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Field ${path} cannot be null`), `Field ${diagnosticPath} cannot be null.`);
   }
   validateSchemaValue2(field.schema, value, path, valueTypesById, diagnosticPath);
 }
@@ -421,14 +358,20 @@ var comparable = {
   shareableParam: true
 };
 var PRIMITIVE_TRAITS = {
-  string: { ...comparable, queryScalarKind: "string", text: true, contains: true },
-  uuid: { ...comparable, queryScalarKind: "uuid", contains: true },
-  integer: { ...comparable, queryScalarKind: "integer" },
-  double: { ...comparable, queryScalarKind: "double" },
-  decimal: { ...comparable, queryScalarKind: "decimal" },
-  date: { ...comparable, queryScalarKind: "date" },
-  timestamp: { ...comparable, queryScalarKind: "timestamp" },
-  boolean: { ...comparable, queryScalarKind: "boolean", sortable: false },
+  string: {
+    ...comparable,
+    queryScalarKind: "string",
+    text: true,
+    contains: true,
+    unique: "string"
+  },
+  uuid: { ...comparable, queryScalarKind: "uuid", contains: true, unique: "string" },
+  integer: { ...comparable, queryScalarKind: "integer", unique: "integer" },
+  double: { ...comparable, queryScalarKind: "double", unique: undefined },
+  decimal: { ...comparable, queryScalarKind: "decimal", unique: undefined },
+  date: { ...comparable, queryScalarKind: "date", unique: "string" },
+  timestamp: { ...comparable, queryScalarKind: "timestamp", unique: undefined },
+  boolean: { ...comparable, queryScalarKind: "boolean", sortable: false, unique: undefined },
   fileRef: {
     queryScalarKind: undefined,
     exact: false,
@@ -438,7 +381,8 @@ var PRIMITIVE_TRAITS = {
     contains: false,
     facet: false,
     telemetry: false,
-    shareableParam: false
+    shareableParam: false,
+    unique: undefined
   },
   userRef: {
     queryScalarKind: "userRef",
@@ -449,7 +393,8 @@ var PRIMITIVE_TRAITS = {
     contains: false,
     facet: true,
     telemetry: false,
-    shareableParam: false
+    shareableParam: false,
+    unique: "userRef"
   }
 };
 function isPrimitiveSchema(schema) {
@@ -459,6 +404,43 @@ function primitiveTraits(schema) {
   return isPrimitiveSchema(schema) ? PRIMITIVE_TRAITS[schema] : undefined;
 }
 
+// src/ontology/unique-values.ts
+var UNIQUE_VALUE_KEY_VERSION = 1;
+function uniqueValueKind(schema, valueTypesById, seenValueTypeIds = new Set) {
+  if (typeof schema === "string")
+    return primitiveTraits(schema)?.unique;
+  if (schema.type === "enum")
+    return schema.valueType === "integer" ? "integer" : "string";
+  if (schema.type !== "valueTypeRef" || seenValueTypeIds.has(schema.valueTypeId)) {
+    return;
+  }
+  const resolved = schema._resolved ?? valueTypesById.get(schema.valueTypeId)?.schema;
+  if (!resolved)
+    return;
+  return uniqueValueKind(resolved, valueTypesById, new Set([...seenValueTypeIds, schema.valueTypeId]));
+}
+function uniquePropertiesOf(objectType, valueTypesById) {
+  const unique = [];
+  for (const property of objectType.properties) {
+    if (!property.unique)
+      continue;
+    const kind = uniqueValueKind(property.schema, valueTypesById);
+    if (kind)
+      unique.push({ propertyId: property.id, kind });
+  }
+  return unique;
+}
+function uniqueValueKey(kind, value) {
+  switch (kind) {
+    case "string":
+      return typeof value === "string" ? value : null;
+    case "integer":
+      return Number.isInteger(value) ? String(value) : null;
+    case "userRef":
+      return isUserRef(value) ? value.id : null;
+  }
+}
+
 // src/ontology/validation/properties.ts
 function assertObjectTypeRegistered2(objectTypesById, objectType) {
   if (!objectTypesById.has(objectType.id)) {
@@ -503,7 +485,7 @@ function assertKnownProperties2(objectType, properties) {
 function assertRequiredProperties2(objectType, properties) {
   for (const property of objectType.properties) {
     if (property.required && properties[property.id] === undefined) {
-      throw withFailureMessage(new OntologyValidationError2(`[Sixb] Missing required property '${property.id}' for object type '${objectType.id}'`), `Missing required property '${objectType.id}.${property.id}'.`);
+      throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Missing required property '${property.id}' for object type '${objectType.id}'`), `Missing required property '${objectType.id}.${property.id}'.`);
     }
   }
 }
@@ -541,6 +523,7 @@ function validatePropertyDefinitions2(objectTypesById, valueTypesById) {
   for (const [typeId, objectType] of objectTypesById) {
     for (const property of objectType.properties) {
       assertNoObjectRefSchema(property, `Property '${typeId}.${property.id}'`, valueTypesById);
+      assertUniquePropertyDefinition(typeId, property, valueTypesById);
       if (property.mode !== "telemetry")
         continue;
       const primitive = findPrimitiveSchema(property.schema, valueTypesById, (schema) => primitiveTraits(schema)?.telemetry === false);
@@ -552,6 +535,9 @@ function validatePropertyDefinitions2(objectTypesById, valueTypesById) {
       for (const property of link.properties ?? []) {
         const path = `Link property '${typeId}.${link.id}.${property.id}'`;
         assertNoObjectRefSchema(property, path, valueTypesById);
+        if (property.unique) {
+          throw new OntologyValidationError2(`[Sixb] ${path} cannot be unique. Unique values are supported on object properties only.`);
+        }
         if (findPrimitiveSchema(property.schema, valueTypesById, (schema) => schema === "userRef")) {
           throw new OntologyValidationError2(`[Sixb] ${path} cannot use ref.user(). User references are supported on object properties only.`);
         }
@@ -559,15 +545,36 @@ function validatePropertyDefinitions2(objectTypesById, valueTypesById) {
     }
   }
 }
+function assertUniquePropertyDefinition(typeId, property, valueTypesById) {
+  if (!property.unique)
+    return;
+  const path = `Unique property '${typeId}.${property.id}'`;
+  if (property.primary) {
+    throw new OntologyValidationError2(`[Sixb] ${path} is primary, and primary properties are already unique. Remove unique: true.`);
+  }
+  if (property.mode === "telemetry") {
+    throw new OntologyValidationError2(`[Sixb] ${path} cannot be a telemetry property.`);
+  }
+  if (uniqueValueKind(property.schema, valueTypesById) === undefined) {
+    throw new OntologyValidationError2(`[Sixb] ${path} cannot use ${schemaLabel(property.schema)}. ` + "Unique values must be strings, uuids, integers, dates, enums or user references.");
+  }
+}
+function schemaLabel(schema) {
+  if (typeof schema === "string")
+    return schema;
+  if (schema.type === "valueTypeRef")
+    return `value type '${schema.valueTypeId}'`;
+  return schema.type;
+}
 function validatePropertyValue2(property, value, path, valueTypesById) {
   if (value === undefined) {
-    throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path} cannot be undefined`), `Property ${path} cannot be undefined.`);
+    throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path} cannot be undefined`), `Property ${path} cannot be undefined.`);
   }
   if (value === null) {
     if (property.nullable) {
       return;
     }
-    throw withFailureMessage(new OntologyValidationError2(`[Sixb] Property ${path} cannot be null`), `Property ${path} cannot be null.`);
+    throw withFailureMessage2(new OntologyValidationError2(`[Sixb] Property ${path} cannot be null`), `Property ${path} cannot be null.`);
   }
   validateSchemaValue2(property.schema, value, path, valueTypesById);
 }
@@ -1547,6 +1554,6 @@ function validateTelemetryUnit2(property, propertyPath, unit, valueTypesById) {
     throw new OntologyValidationError2(`[Sixb] Property ${propertyPath} does not define semanticType and cannot accept a unit`);
   }
 }
-export { userRef2, collectUserRefIds, userReferenceProblem, validateSchemaValue2, assertValidFileRefs2, resolveValueTypeRef2, resolveValueTypeSchema2, isRecord2, normalizeObjectProperties2, normalizeSchemaValue2, coerceSchemaValueToTyped2, isPrimitiveSchema, primitiveTraits, assertObjectTypeRegistered2, assertPropertyTokenBelongsToObjectType2, assertLinkTokenBelongsToObjectType2, assertKnownProperties2, assertRequiredProperties2, validateObjectProperties2, validatePrimaryProperties2, validatePropertyDefinitions2, validatePropertyValue2, findPrimitiveSchema, assertLinkTargetType2, assertTargetTypeCompatible2, normalizeLinkProperties2, validateLinkProperties2, isExactSchema, isSortableSchema, isTextSchema, isContainsSchema, queryScalarKindForSchema, resolvePropertyQueryCapabilities2, resolveQuerySchema, validateQueryMetadata2, quantitativeTypes2, getUnit2, getUnitsFor2, isValidUnit2, getUnitSymbol2, isQuantitativeTypeId2, isUnitId2, assertTelemetryProperty2, resolveSemanticType2, validateTelemetryUnit2 };
+export { validateSchemaValue2, assertValidFileRefs2, resolveValueTypeRef2, resolveValueTypeSchema2, isRecord2, normalizeObjectProperties2, normalizeSchemaValue2, coerceSchemaValueToTyped2, isPrimitiveSchema, primitiveTraits, UNIQUE_VALUE_KEY_VERSION, uniqueValueKind, uniquePropertiesOf, uniqueValueKey, assertObjectTypeRegistered2, assertPropertyTokenBelongsToObjectType2, assertLinkTokenBelongsToObjectType2, assertKnownProperties2, assertRequiredProperties2, validateObjectProperties2, validatePrimaryProperties2, validatePropertyDefinitions2, validatePropertyValue2, findPrimitiveSchema, assertLinkTargetType2, assertTargetTypeCompatible2, normalizeLinkProperties2, validateLinkProperties2, isExactSchema, isSortableSchema, isTextSchema, isContainsSchema, queryScalarKindForSchema, resolvePropertyQueryCapabilities2, resolveQuerySchema, validateQueryMetadata2, quantitativeTypes2, getUnit2, getUnitsFor2, isValidUnit2, getUnitSymbol2, isQuantitativeTypeId2, isUnitId2, assertTelemetryProperty2, resolveSemanticType2, validateTelemetryUnit2 };
 
-//# debugId=0F13B6300CF2B17164756E2164756E21
+//# debugId=819D50151832A85A64756E2164756E21