@sixb/core 0.1.20 → 0.1.22

package/dist/{chunk-rrzt8jdy.js → chunk-6rrtzea3.js}

@@ -3,151 +3,145 @@ import {
   AuthStorageError2,
   SYSTEM_PRINCIPAL2,
   principalsEqual2
-} from "./chunk-vpq4shxz.js";
+} from "./chunk-h3pbv7n8.js";
 import {
   createSixbError2
-} from "./chunk-8mx7qw3y.js";
+} from "./chunk-zbc929zg.js";
 import {
   agentServiceAccountId2,
   AuthorizationError2,
+  isAllowed2,
   resolveAuthorizationContext2
-} from "./chunk-d0bqz29d.js";
+} from "./chunk-yc9ners4.js";
+import {
+  appliedLinkKey,
+  NO_APPLIED_MARKINGS
+} from "./chunk-x0v3jd47.js";
 import {
   findPrimitiveRunExecution,
   findAgentRunExecution
 } from "./chunk-ey1nk510.js";
 
 // src/security/redactions.ts
+var MISSING_CLEARANCE = Object.freeze({ reason: "missing_clearance" });
 function missingClearanceRedactions(ids) {
-  return Object.fromEntries([...ids].map((id) => [id, { reason: "missing_clearance" }]));
+  return Object.freeze(Object.fromEntries([...ids].map((id) => [id, MISSING_CLEARANCE])));
 }
 
 // src/objects/property-clearance.ts
-var NO_PROPERTIES = new Set;
+function unreadableError(unreadable) {
+  return new AuthorizationError2(`clearance:marking:${unreadable.marking}`, unreadable.message);
+}
 var clearancesByOntology = new WeakMap;
-function resolvePropertyClearance(ontology, clearances) {
-  let resolved = clearancesByOntology.get(ontology);
+var appliedClearancesByOntology = new WeakMap;
+var NO_UNREADABLE_TARGETS = Object.freeze({
+  types: new Map,
+  links: Object.freeze([])
+});
+function resolvePropertyClearance(ontology, clearances, applied = NO_APPLIED_MARKINGS) {
+  const key = JSON.stringify([...clearances].sort());
+  if (applied === NO_APPLIED_MARKINGS || clearsEvery(clearances, applied.markings)) {
+    let resolved = clearancesByOntology.get(ontology);
+    if (!resolved) {
+      resolved = new Map;
+      clearancesByOntology.set(ontology, resolved);
+    }
+    if (!resolved.has(key))
+      resolved.set(key, createPropertyClearance(ontology, clearances));
+    return resolved.get(key);
+  }
+  let bySnapshot = appliedClearancesByOntology.get(ontology);
+  if (!bySnapshot) {
+    bySnapshot = new WeakMap;
+    appliedClearancesByOntology.set(ontology, bySnapshot);
+  }
+  let resolved = bySnapshot.get(applied);
   if (!resolved) {
     resolved = new Map;
-    clearancesByOntology.set(ontology, resolved);
+    bySnapshot.set(applied, resolved);
+  }
+  if (!resolved.has(key)) {
+    resolved.set(key, createPropertyClearance(ontology, clearances, applied));
   }
-  const key = JSON.stringify([...clearances].sort());
-  if (!resolved.has(key))
-    resolved.set(key, createPropertyClearance(ontology, clearances));
   return resolved.get(key);
 }
-function createPropertyClearance(ontology, clearances) {
+function clearsEvery(clearances, markings) {
+  for (const markingId of markings)
+    if (!clearances.has(markingId))
+      return false;
+  return true;
+}
+function createPropertyClearance(ontology, clearances, applied = NO_APPLIED_MARKINGS) {
   const missingByType = new Map;
+  const hiddenByType = new Map;
   for (const objectType of ontology.listObjectTypes()) {
+    const surplus = applied.properties.get(objectType.id);
     const missing = new Map;
     for (const property of objectType.properties) {
-      const marking = property.markings?.find((markingId) => !clearances.has(markingId));
+      const marking = property.markings?.find((markingId) => !clearances.has(markingId)) ?? firstMissing(surplus?.get(property.id), clearances);
       if (marking !== undefined)
         missing.set(property.id, marking);
     }
-    if (missing.size > 0)
-      missingByType.set(objectType.id, missing);
+    if (missing.size === 0)
+      continue;
+    missingByType.set(objectType.id, missing);
+    hiddenByType.set(objectType.id, Object.freeze({
+      ids: new Set(missing.keys()),
+      redactions: missingClearanceRedactions(missing.keys())
+    }));
+  }
+  const types = new Map;
+  for (const [objectTypeId, seals] of applied.types) {
+    const unreadable = unreadableBy(seals, clearances, `'${objectTypeId}'`);
+    if (unreadable)
+      types.set(objectTypeId, unreadable);
   }
-  if (missingByType.size === 0)
+  const links = [];
+  const linksByKey = new Map;
+  for (const [key, link] of applied.links) {
+    const name = `link '${link.objectTypeId}.${link.linkId}'`;
+    const unreadable = unreadableBy(link.seals, clearances, name);
+    if (!unreadable)
+      continue;
+    linksByKey.set(key, unreadable);
+    links.push(Object.freeze({
+      ...unreadable,
+      objectTypeId: link.objectTypeId,
+      linkId: link.linkId,
+      targetObjectTypeId: link.targetObjectTypeId
+    }));
+  }
+  if (hiddenByType.size === 0 && types.size === 0 && links.length === 0)
     return;
-  const hiddenByType = new Map([...missingByType].map(([objectTypeId, missing]) => [objectTypeId, new Set(missing.keys())]));
+  const unreadable = types.size === 0 && links.length === 0 ? NO_UNREADABLE_TARGETS : Object.freeze({ types, links: Object.freeze(links) });
   return Object.freeze({
-    hiddenPropertyIds: (objectTypeId) => hiddenByType.get(objectTypeId) ?? NO_PROPERTIES,
-    missingMarking: (objectTypeId, propertyId) => missingByType.get(objectTypeId)?.get(propertyId)
+    hiddenProperties: (objectTypeId) => hiddenByType.get(objectTypeId),
+    missingMarking: (objectTypeId, propertyId) => missingByType.get(objectTypeId)?.get(propertyId),
+    unreadableType: (objectTypeId) => types.get(objectTypeId),
+    unreadableLink: (objectTypeId, linkId) => linksByKey.get(appliedLinkKey(objectTypeId, linkId)),
+    unreadable: () => unreadable
   });
 }
-function redactObjectRow(row, clearance) {
-  const hidden = clearance.hiddenPropertyIds(row.objectTypeId);
-  const links = row.links;
-  if (hidden.size === 0 && links === undefined)
-    return row;
-  const redacted = { ...row };
-  if (hidden.size > 0) {
-    redacted.properties = withoutKeys(row.properties, hidden);
-    redacted.redactions = missingClearanceRedactions(hidden);
-  }
-  if (links !== undefined) {
-    redacted.links = Object.fromEntries(Object.entries(links).map(([linkId, value]) => [linkId, redactLinkValue(value, clearance)]));
-  }
-  return redacted;
-}
-function redactLinkValue(value, clearance) {
-  if (value === null)
-    return null;
-  if (Array.isArray(value))
-    return value.map((row) => redactObjectRow(row, clearance));
-  return redactObjectRow(value, clearance);
-}
-function redactDomainEvent(event, clearance) {
-  if (event.topic !== "objects")
-    return event;
-  const hidden = clearance.hiddenPropertyIds(event.payload.objectTypeId);
-  if (hidden.size === 0)
-    return event;
-  const payload = {
-    ...event.payload,
-    propertyChanges: withoutKeys(event.payload.propertyChanges, hidden),
-    redactions: missingClearanceRedactions(hidden)
-  };
-  if (event.type === "object.deleted")
-    return { ...event, payload };
-  return {
-    ...event,
-    payload: { ...payload, properties: withoutKeys(event.payload.properties, hidden) }
-  };
+function firstMissing(markings, clearances) {
+  if (!markings)
+    return;
+  for (const markingId of [...markings].sort())
+    if (!clearances.has(markingId))
+      return markingId;
+  return;
 }
-function withoutKeys(record, hidden) {
-  const kept = {};
-  for (const [key, value] of Object.entries(record)) {
-    if (!hidden.has(key))
-      kept[key] = value;
+function unreadableBy(seals, clearances, name) {
+  for (const seal of seals) {
+    const marking = firstMissing(seal.markings, clearances);
+    if (marking === undefined)
+      continue;
+    return Object.freeze({
+      marking,
+      message: `[Sixb] Cannot read ${name} until projection '${seal.projectionId}' applies a compliant version: ${seal.reason} carries marking '${marking}'.`
+    });
   }
-  return kept;
+  return;
 }
-function createClearanceQueryAdmission(clearance) {
-  const reachedTypes = new WeakMap;
-  const state = (objectTypeIds) => {
-    const created = Object.freeze({});
-    reachedTypes.set(created, Object.freeze([...objectTypeIds]));
-    return created;
-  };
-  const reached = (input) => {
-    const objectTypeIds = reachedTypes.get(input);
-    if (!objectTypeIds) {
-      throw new Error("[Sixb] Clearance query admission received a state it did not create.");
-    }
-    return objectTypeIds;
-  };
-  const empty = state([]);
-  const admission = {
-    empty: () => empty,
-    source: (input) => ({ state: state(input.result.objectTypeIds) }),
-    edge: (input) => ({ state: state(input.result.objectTypeIds) }),
-    set: (input) => input.op === "subtract" ? input.states[0] ?? empty : state([...new Set(input.states.flatMap(reached))]),
-    property: (input) => {
-      if (input.use === "project")
-        return;
-      const objectTypeIds = input.objectTypeId === undefined ? reached(input.state) : [input.objectTypeId];
-      for (const objectTypeId of objectTypeIds) {
-        const marking = clearance.missingMarking(objectTypeId, input.propertyId);
-        if (marking === undefined)
-          continue;
-        return new AuthorizationError2(`clearance:marking:${marking}`, `[Sixb] Cannot ${PROPERTY_USE_VERBS[input.use]} '${objectTypeId}.${input.propertyId}' at '${input.path}': it requires clearance for marking '${marking}'.`);
-      }
-      return;
-    }
-  };
-  return Object.freeze(admission);
-}
-var PROPERTY_USE_VERBS = {
-  filter: "filter by",
-  text: "search",
-  vector: "run a vector search over",
-  sort: "sort by",
-  project: "project",
-  "expand.orderBy": "order expanded objects by",
-  facet: "facet by"
-};
 
 // src/agents/authority.ts
 function resolveAgentPropertyClearance2(ontology, authorization) {
@@ -267,6 +261,18 @@ async function resolveAgentExecutionAuthorization2(input) {
     })
   };
 }
+async function userCanRunAgent2(input) {
+  const memberships = await input.auth.groupMemberships.listForUser({
+    projectId: input.projectId,
+    userId: input.userId
+  });
+  const context = resolveAuthorizationContext2({
+    principal: { type: "user", id: input.userId },
+    groupIds: memberships.map((membership) => membership.groupId),
+    roles: input.security.listResolvedRoles()
+  });
+  return isAllowed2(context, { kind: "agent.run" });
+}
 async function resolveInheritedAgentExecutionAuthorization2(input) {
   if (input.authorizationRef.type === "disabled")
     return { type: "disabled" };
@@ -415,6 +421,6 @@ function invalidExecution(executionId, runId) {
   throw new WorkflowRunError2(`[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`);
 }
 
-export { missingClearanceRedactions, resolvePropertyClearance, redactObjectRow, redactDomainEvent, createClearanceQueryAdmission, WorkflowRunError2, resolveAgentPropertyClearance2, ensureManagedAgentExecutionIdentity2, resolveAgentExecutionAuthorization2, resolveInheritedAgentExecutionAuthorization2, assertWorkflowRunExecution2, assertWorkflowAgentNodeRunExecution2 };
+export { WorkflowRunError2, missingClearanceRedactions, unreadableError, resolvePropertyClearance, resolveAgentPropertyClearance2, ensureManagedAgentExecutionIdentity2, resolveAgentExecutionAuthorization2, userCanRunAgent2, resolveInheritedAgentExecutionAuthorization2, assertWorkflowRunExecution2, assertWorkflowAgentNodeRunExecution2 };
 
-//# debugId=86420060B98AACE864756E2164756E21
+//# debugId=C3E7FA1E69C6C30464756E2164756E21

package/dist/chunk-6rrtzea3.js.map

@@ -0,0 +1,14 @@
+{
+  "version": 3,
+  "sources": ["../src/security/redactions.ts", "../src/objects/property-clearance.ts", "../src/agents/authority.ts", "../src/storage/workflow-runs/errors.ts", "../src/storage/workflow-runs/provider.ts"],
+  "sourcesContent": [
+    "import type { Redactions } from \"./types\"\n\nconst MISSING_CLEARANCE = Object.freeze({ reason: \"missing_clearance\" } as const)\n\n/**\n * List the values hidden from a reader that lacks a clearance for their markings. Deeply frozen,\n * so every row and event redacted the same way can share it.\n */\nexport function missingClearanceRedactions(ids: Iterable<string>): Redactions {\n  return Object.freeze(Object.fromEntries([...ids].map((id) => [id, MISSING_CLEARANCE] as const)))\n}\n",
+    "import { AuthorizationError } from \"../authorization/errors\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport {\n  type AppliedMarkingsSnapshot,\n  type AppliedSeal,\n  appliedLinkKey,\n  NO_APPLIED_MARKINGS,\n} from \"../security/applied-markings-snapshot\"\nimport { missingClearanceRedactions } from \"../security/redactions\"\nimport type { Redactions } from \"../security/types\"\n\n/**\n * The marked properties one reader cannot read, resolved once from its clearances.\n *\n * A property is readable when the reader clears every one of its markings. Unreadable properties\n * are omitted from rows and cannot be used to select, order, or aggregate objects.\n *\n * Markings a projection's applied dataset version still carries extend this: its properties keep\n * them, and an object type or link whose key column carries markings the reader lacks is\n * unreadable, like a type it has no view grant for.\n */\nexport interface PropertyClearance {\n  /** What the reader cannot read on this object type; `undefined` when it reads every property. */\n  hiddenProperties(objectTypeId: string): HiddenProperties | undefined\n  /** First marking on the property that the reader is not cleared for. */\n  missingMarking(objectTypeId: string, propertyId: string): string | undefined\n  /** Why the reader cannot read this object type at all; `undefined` when it can. */\n  unreadableType(objectTypeId: string): Unreadable | undefined\n  /** Why the reader cannot read this link, keyed by its source type; `undefined` when it can. */\n  unreadableLink(objectTypeId: string, linkId: string): Unreadable | undefined\n  /** Every object type and link the reader cannot read, for link queries that name none. */\n  unreadable(): UnreadableTargets\n}\n\n/** A marking the reader lacks on what makes an object type or link unreadable, and why. */\nexport interface Unreadable {\n  readonly marking: string\n  readonly message: string\n}\n\nexport interface UnreadableTargets {\n  readonly types: ReadonlyMap<string, Unreadable>\n  readonly links: readonly (Unreadable & {\n    readonly objectTypeId: string\n    readonly linkId: string\n    readonly targetObjectTypeId: string\n  })[]\n}\n\n/** The error a read of an unreadable object type or link fails with: a 403. */\nexport function unreadableError(unreadable: Unreadable): AuthorizationError {\n  return new AuthorizationError(`clearance:marking:${unreadable.marking}`, unreadable.message)\n}\n\n/**\n * The properties of one object type a clearance set hides. It depends only on the type and the\n * clearances, so it is computed once and shared by every row and event redacted with it.\n */\nexport interface HiddenProperties {\n  readonly ids: ReadonlySet<string>\n  /**\n   * The `redactions` record of a redacted row or event. It lists every hidden property, whether or\n   * not a row holds a value: listing only present values would reveal which ones are empty.\n   *\n   * Deeply frozen, because every redacted row and event shares it.\n   */\n  readonly redactions: Redactions\n}\n\n// Readers are built per execution, but few distinct clearance sets exist per ontology.\nconst clearancesByOntology = new WeakMap<\n  OntologyDefinitionCatalog,\n  Map<string, PropertyClearance | undefined>\n>()\n// Applied markings change rarely, and a snapshot is replaced only when its content changes.\nconst appliedClearancesByOntology = new WeakMap<\n  OntologyDefinitionCatalog,\n  WeakMap<AppliedMarkingsSnapshot, Map<string, PropertyClearance | undefined>>\n>()\n\nconst NO_UNREADABLE_TARGETS: UnreadableTargets = Object.freeze({\n  types: new Map(),\n  links: Object.freeze([]),\n})\n\n/**\n * Resolve what a reader with these clearances cannot read. Returns `undefined` when it can read\n * every property, so callers skip redaction entirely.\n *\n * A reader cleared for every marking the applied versions add receives the clearance of the code\n * alone, the same object whatever the snapshot.\n */\nexport function resolvePropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  clearances: ReadonlySet<string>,\n  applied: AppliedMarkingsSnapshot = NO_APPLIED_MARKINGS\n): PropertyClearance | undefined {\n  const key = JSON.stringify([...clearances].sort())\n\n  if (applied === NO_APPLIED_MARKINGS || clearsEvery(clearances, applied.markings)) {\n    let resolved = clearancesByOntology.get(ontology)\n    if (!resolved) {\n      resolved = new Map()\n      clearancesByOntology.set(ontology, resolved)\n    }\n\n    if (!resolved.has(key)) resolved.set(key, createPropertyClearance(ontology, clearances))\n    return resolved.get(key)\n  }\n\n  let bySnapshot = appliedClearancesByOntology.get(ontology)\n  if (!bySnapshot) {\n    bySnapshot = new WeakMap()\n    appliedClearancesByOntology.set(ontology, bySnapshot)\n  }\n\n  let resolved = bySnapshot.get(applied)\n  if (!resolved) {\n    resolved = new Map()\n    bySnapshot.set(applied, resolved)\n  }\n\n  if (!resolved.has(key)) {\n    resolved.set(key, createPropertyClearance(ontology, clearances, applied))\n  }\n  return resolved.get(key)\n}\n\nfunction clearsEvery(clearances: ReadonlySet<string>, markings: ReadonlySet<string>): boolean {\n  for (const markingId of markings) if (!clearances.has(markingId)) return false\n  return true\n}\n\nfunction createPropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  clearances: ReadonlySet<string>,\n  applied: AppliedMarkingsSnapshot = NO_APPLIED_MARKINGS\n): PropertyClearance | undefined {\n  const missingByType = new Map<string, ReadonlyMap<string, string>>()\n  const hiddenByType = new Map<string, HiddenProperties>()\n  for (const objectType of ontology.listObjectTypes()) {\n    const surplus = applied.properties.get(objectType.id)\n    const missing = new Map<string, string>()\n    for (const property of objectType.properties) {\n      const marking =\n        property.markings?.find((markingId) => !clearances.has(markingId)) ??\n        firstMissing(surplus?.get(property.id), clearances)\n      if (marking !== undefined) missing.set(property.id, marking)\n    }\n\n    if (missing.size === 0) continue\n\n    missingByType.set(objectType.id, missing)\n    hiddenByType.set(\n      objectType.id,\n      Object.freeze({\n        ids: new Set(missing.keys()),\n        redactions: missingClearanceRedactions(missing.keys()),\n      })\n    )\n  }\n\n  const types = new Map<string, Unreadable>()\n  for (const [objectTypeId, seals] of applied.types) {\n    const unreadable = unreadableBy(seals, clearances, `'${objectTypeId}'`)\n    if (unreadable) types.set(objectTypeId, unreadable)\n  }\n\n  const links: UnreadableTargets[\"links\"][number][] = []\n  const linksByKey = new Map<string, Unreadable>()\n  for (const [key, link] of applied.links) {\n    const name = `link '${link.objectTypeId}.${link.linkId}'`\n    const unreadable = unreadableBy(link.seals, clearances, name)\n    if (!unreadable) continue\n\n    linksByKey.set(key, unreadable)\n    links.push(\n      Object.freeze({\n        ...unreadable,\n        objectTypeId: link.objectTypeId,\n        linkId: link.linkId,\n        targetObjectTypeId: link.targetObjectTypeId,\n      })\n    )\n  }\n\n  if (hiddenByType.size === 0 && types.size === 0 && links.length === 0) return undefined\n\n  const unreadable: UnreadableTargets =\n    types.size === 0 && links.length === 0\n      ? NO_UNREADABLE_TARGETS\n      : Object.freeze({ types, links: Object.freeze(links) })\n  return Object.freeze({\n    hiddenProperties: (objectTypeId: string) => hiddenByType.get(objectTypeId),\n    missingMarking: (objectTypeId: string, propertyId: string) =>\n      missingByType.get(objectTypeId)?.get(propertyId),\n    unreadableType: (objectTypeId: string) => types.get(objectTypeId),\n    unreadableLink: (objectTypeId: string, linkId: string) =>\n      linksByKey.get(appliedLinkKey(objectTypeId, linkId)),\n    unreadable: () => unreadable,\n  })\n}\n\nfunction firstMissing(\n  markings: ReadonlySet<string> | undefined,\n  clearances: ReadonlySet<string>\n): string | undefined {\n  if (!markings) return undefined\n  for (const markingId of [...markings].sort()) if (!clearances.has(markingId)) return markingId\n  return undefined\n}\n\n/** The first seal the reader lacks a marking for, as the message a denied read returns. */\nfunction unreadableBy(\n  seals: readonly AppliedSeal[],\n  clearances: ReadonlySet<string>,\n  name: string\n): Unreadable | undefined {\n  for (const seal of seals) {\n    const marking = firstMissing(seal.markings, clearances)\n    if (marking === undefined) continue\n    return Object.freeze({\n      marking,\n      message: `[Sixb] Cannot read ${name} until projection '${seal.projectionId}' applies a compliant version: ${seal.reason} carries marking '${marking}'.`,\n    })\n  }\n  return undefined\n}\n",
+    "import { principalsEqual, SYSTEM_PRINCIPAL } from \"../auth\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport { isAllowed, resolveAuthorizationContext } from \"../authorization\"\nimport { createSixbError } from \"../errors/internal\"\nimport type { AuthorizablePrincipal, AuthorizationRef } from \"../execution\"\nimport { type PropertyClearance, resolvePropertyClearance } from \"../objects/property-clearance\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport type { SecurityDefinitionCatalog } from \"../security\"\nimport type {\n  AccessTokenRecord,\n  AuthStorage,\n  ServiceAccountGroupMembershipRecord,\n  ServiceAccountRecord,\n  SessionRecord,\n  UserRecord,\n} from \"../storage/auth\"\nimport { AuthStorageError } from \"../storage/auth\"\nimport { agentServiceAccountId } from \"./identity\"\n\nexport type AgentExecutionAuthorization =\n  | { readonly type: \"principal\"; readonly context: AuthorizationContext }\n  | { readonly type: \"disabled\" }\n\n/**\n * The marked properties an Agent execution cannot read, resolved exactly as its object reader\n * resolves them. Disabled authorization reads everything.\n */\nexport function resolveAgentPropertyClearance(\n  ontology: OntologyDefinitionCatalog,\n  authorization: AgentExecutionAuthorization\n): PropertyClearance | undefined {\n  return authorization.type === \"principal\"\n    ? resolvePropertyClearance(ontology, authorization.context.clearances ?? new Set())\n    : undefined\n}\n\ntype UserCredentialRef = NonNullable<\n  Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n>\n\ninterface CredentialedUserAuthorizationRef {\n  readonly type: \"principal\"\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"user\" }>\n  readonly credential: UserCredentialRef\n}\n\nexport { agentServiceAccountId } from \"./identity\"\n\nexport interface AgentExecutionIdentity {\n  readonly serviceAccount: ServiceAccountRecord\n  readonly principal: Extract<AuthorizablePrincipal, { readonly type: \"serviceAccount\" }>\n  readonly groupMemberships: readonly ServiceAccountGroupMembershipRecord[]\n}\n\n/** Ensure a framework-managed Agent actor exists with exactly its declared group memberships. */\nexport async function ensureManagedAgentExecutionIdentity(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly name: string\n  readonly description: string\n  readonly groupIds: readonly string[]\n}): Promise<AgentExecutionIdentity> {\n  const auth = requireAuthStorage(input.auth)\n  const id = agentServiceAccountId(input.actorId)\n  const now = new Date()\n  const loaded = await loadOrCreateAgentServiceAccount(auth, {\n    id,\n    projectId: input.projectId,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertFrameworkManagedAgentServiceAccount(input.actorId, loaded)\n  assertActiveAgentServiceAccount(input.actorId, loaded)\n  const serviceAccount = await updateAgentServiceAccountMetadata(auth, {\n    existing: loaded,\n    name: input.name,\n    description: input.description,\n    updatedAt: now,\n  })\n  assertActiveAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.reconcileForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: id,\n      groupIds: input.groupIds,\n      source: \"agent\",\n      updatedAt: now,\n    })\n  )\n\n  return {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id },\n    groupMemberships,\n  }\n}\n\n/** Load the managed identity, recovering only the expected concurrent-create race. */\nasync function loadOrCreateAgentServiceAccount(\n  auth: AuthStorage,\n  input: {\n    readonly id: string\n    readonly projectId: string\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  const existing = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: input.id,\n  })\n  if (existing) return existing\n\n  try {\n    return await auth.serviceAccounts.create({\n      id: input.id,\n      projectId: input.projectId,\n      name: input.name,\n      description: input.description,\n      status: \"active\",\n      createdByPrincipal: SYSTEM_PRINCIPAL,\n      createdAt: input.updatedAt,\n      updatedAt: input.updatedAt,\n    })\n  } catch (error) {\n    if (!(error instanceof AuthStorageError) || error.code !== \"duplicate_service_account\") {\n      throw error\n    }\n    const concurrent = await auth.serviceAccounts.getById({\n      projectId: input.projectId,\n      id: input.id,\n    })\n    if (!concurrent) throw error\n    return concurrent\n  }\n}\n\nfunction assertActiveAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (serviceAccount.status === \"suspended\") {\n    throw new Error(\n      `[Sixb] Agent '${actorId}' service account '${serviceAccount.id}' is suspended.`\n    )\n  }\n}\n\nfunction assertFrameworkManagedAgentServiceAccount(\n  actorId: string,\n  serviceAccount: ServiceAccountRecord\n): void {\n  if (\n    serviceAccount.createdByPrincipal === undefined ||\n    !principalsEqual(serviceAccount.createdByPrincipal, SYSTEM_PRINCIPAL)\n  ) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' cannot use service account '${serviceAccount.id}' because it is not managed by Sixb.`,\n      { details: { actorId, serviceAccountId: serviceAccount.id } }\n    )\n  }\n}\n\nfunction requireDefinitionOwnedGroupMemberships(\n  actorId: string,\n  memberships: readonly ServiceAccountGroupMembershipRecord[]\n): readonly ServiceAccountGroupMembershipRecord[] {\n  const externalGroupIds = memberships\n    .filter((membership) => membership.source !== \"agent\")\n    .map((membership) => membership.groupId)\n  if (externalGroupIds.length > 0) {\n    throw createSixbError(\n      \"agent.execution_failed\",\n      `[Sixb] Agent '${actorId}' service account has group memberships not managed by its definition: ${externalGroupIds.join(\", \")}.`,\n      { details: { actorId, externalGroupIds } }\n    )\n  }\n  return memberships\n}\n\n/** Resolve current grants for the service account referenced by a durable Agent execution. */\nexport async function resolveAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly actorId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n}): Promise<{ readonly identity: AgentExecutionIdentity; readonly context: AuthorizationContext }> {\n  const auth = requireAuthStorage(input.auth)\n  const expectedId = agentServiceAccountId(input.actorId)\n  const principal =\n    input.authorizationRef.type === \"principal\" ? input.authorizationRef.principal : null\n  if (principal?.type !== \"serviceAccount\" || principal.id !== expectedId) {\n    throw new Error(\n      `[Sixb] Agent '${input.actorId}' execution authority must reference service account '${expectedId}'.`\n    )\n  }\n\n  const serviceAccount = await auth.serviceAccounts.getById({\n    projectId: input.projectId,\n    id: principal.id,\n  })\n  if (!serviceAccount || serviceAccount.status !== \"active\") {\n    throw new Error(`[Sixb] Agent service account '${principal.id}' is not active.`)\n  }\n  assertFrameworkManagedAgentServiceAccount(input.actorId, serviceAccount)\n\n  const groupMemberships = requireDefinitionOwnedGroupMemberships(\n    input.actorId,\n    await auth.serviceAccountGroupMemberships.listForServiceAccount({\n      projectId: input.projectId,\n      serviceAccountId: principal.id,\n    })\n  )\n  const identity: AgentExecutionIdentity = {\n    serviceAccount,\n    principal: { type: \"serviceAccount\", id: principal.id },\n    groupMemberships,\n  }\n  return {\n    identity,\n    context: resolveAuthorizationContext({\n      principal: identity.principal,\n      groupIds: groupMemberships.map((membership) => membership.groupId),\n      roles: input.security.listResolvedRoles(),\n    }),\n  }\n}\n\n/**\n * Whether a user may talk to the Agent now, through the groups they belong to and the project's\n * roles: who is added to a conversation, or named to the model as taking part in it.\n */\nexport async function userCanRunAgent(input: {\n  readonly auth: AuthStorage\n  readonly projectId: string\n  readonly userId: string\n  readonly security: SecurityDefinitionCatalog\n}): Promise<boolean> {\n  const memberships = await input.auth.groupMemberships.listForUser({\n    projectId: input.projectId,\n    userId: input.userId,\n  })\n\n  const context = resolveAuthorizationContext({\n    principal: { type: \"user\", id: input.userId },\n    groupIds: memberships.map((membership) => membership.groupId),\n    roles: input.security.listResolvedRoles(),\n  })\n  return isAllowed(context, { kind: \"agent.run\" })\n}\n\n/** Revalidate the durable user authority inherited by a conversational or child Agent. */\nexport async function resolveInheritedAgentExecutionAuthorization(input: {\n  readonly auth: AuthStorage | undefined\n  readonly projectId: string\n  readonly authorizationRef: AuthorizationRef\n  readonly security: SecurityDefinitionCatalog\n  readonly now?: Date\n}): Promise<AgentExecutionAuthorization> {\n  if (input.authorizationRef.type === \"disabled\") return { type: \"disabled\" }\n\n  const ref = requireCredentialedUserAuthority(input.authorizationRef)\n  const auth = requireAuthStorage(input.auth)\n  const now = input.now ?? new Date()\n  const user = await requireActiveUser(auth, input.projectId, ref.principal.id)\n  const memberships = await auth.groupMemberships.listForUser({\n    projectId: input.projectId,\n    userId: user.id,\n  })\n  const credential = await revalidateUserCredential({\n    auth,\n    projectId: input.projectId,\n    userId: user.id,\n    credential: ref.credential,\n    currentGroupIds: memberships.map((membership) => membership.groupId),\n    now,\n  })\n\n  return {\n    type: \"principal\",\n    context: resolveAuthorizationContext({\n      principal: ref.principal,\n      groupIds: credential.groupIds,\n      roles: input.security.listResolvedRoles(),\n      ...(credential.sessionId === undefined ? {} : { sessionId: credential.sessionId }),\n    }),\n  }\n}\n\nfunction requireCredentialedUserAuthority(ref: AuthorizationRef): CredentialedUserAuthorizationRef {\n  if (ref.type !== \"principal\" || ref.principal.type !== \"user\" || ref.credential === undefined) {\n    throw invalidInheritedAuthority(\"the durable reference is not a credentialed user\")\n  }\n  return {\n    type: \"principal\",\n    principal: { type: \"user\", id: ref.principal.id },\n    credential: { type: ref.credential.type, id: ref.credential.id },\n  }\n}\n\nasync function requireActiveUser(\n  auth: AuthStorage,\n  projectId: string,\n  userId: string\n): Promise<UserRecord> {\n  const user = await auth.users.getById({ projectId, id: userId })\n  if (!user || user.status !== \"active\") {\n    throw invalidInheritedAuthority(`user '${userId}' is not active`)\n  }\n  return user\n}\n\nasync function revalidateUserCredential(input: {\n  readonly auth: AuthStorage\n  readonly projectId: string\n  readonly userId: string\n  readonly credential: UserCredentialRef\n  readonly currentGroupIds: readonly string[]\n  readonly now: Date\n}): Promise<{ readonly groupIds: readonly string[]; readonly sessionId?: string }> {\n  if (input.credential.type === \"session\") {\n    const session = await input.auth.sessions.getById({\n      projectId: input.projectId,\n      id: input.credential.id,\n    })\n    if (!isUsableUserSession(session, input.userId, input.now)) {\n      throw invalidInheritedAuthority(\"the inherited session is no longer valid\")\n    }\n    return { groupIds: input.currentGroupIds, sessionId: session.id }\n  }\n\n  const accessToken = await input.auth.accessTokens.getById({\n    projectId: input.projectId,\n    id: input.credential.id,\n  })\n  if (!isUsableUserAccessToken(accessToken, input.userId, input.now)) {\n    throw invalidInheritedAuthority(\"the inherited access token is no longer valid\")\n  }\n  if (accessToken.groupIds === undefined) return { groupIds: input.currentGroupIds }\n\n  const allowedGroupIds = new Set(accessToken.groupIds)\n  return {\n    groupIds: input.currentGroupIds.filter((groupId) => allowedGroupIds.has(groupId)),\n  }\n}\n\nfunction isUsableUserSession(\n  session: SessionRecord | null,\n  userId: string,\n  now: Date\n): session is SessionRecord {\n  if (!session || session.userId !== userId || session.revokedAt !== undefined) return false\n  if (session.expiresAt.getTime() <= now.getTime()) return false\n  return (\n    session.absoluteExpiresAt === undefined || session.absoluteExpiresAt.getTime() > now.getTime()\n  )\n}\n\nfunction isUsableUserAccessToken(\n  token: AccessTokenRecord | null,\n  userId: string,\n  now: Date\n): token is AccessTokenRecord {\n  if (!token || !principalsEqual(token.subject, { type: \"user\", id: userId })) return false\n  return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime()\n}\n\nfunction invalidInheritedAuthority(reason: string): Error {\n  return createSixbError(\n    \"agent.execution_failed\",\n    `[Sixb] The Agent execution cannot restore its inherited authority: ${reason}.`\n  )\n}\n\nfunction requireAuthStorage(auth: AuthStorage | undefined): AuthStorage {\n  if (!auth) {\n    throw new Error(\"[Sixb] Agent executions require auth storage.\")\n  }\n  return auth\n}\n\nasync function updateAgentServiceAccountMetadata(\n  auth: AuthStorage,\n  input: {\n    readonly existing: ServiceAccountRecord\n    readonly name: string\n    readonly description: string\n    readonly updatedAt: Date\n  }\n): Promise<ServiceAccountRecord> {\n  if (input.existing.name === input.name && input.existing.description === input.description) {\n    return input.existing\n  }\n  return auth.serviceAccounts.update({\n    projectId: input.existing.projectId,\n    id: input.existing.id,\n    name: input.name,\n    description: input.description,\n    updatedAt: input.updatedAt,\n  })\n}\n",
+    "/**\n * Base error for workflow-run storage operations.\n */\nexport class WorkflowRunError extends Error {\n  readonly name = \"WorkflowRunError\"\n}\n",
+    "import { agentServiceAccountId } from \"../../agents/authority\"\nimport type { ExecutionStorage } from \"../executions\"\nimport { findAgentRunExecution, findPrimitiveRunExecution } from \"../executions/run-link\"\nimport { WorkflowRunError } from \"./errors\"\n\n/** Validate the semantic link between a durable workflow run and its immutable execution. */\nexport async function assertWorkflowRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly runId: string\n  readonly workflowId: string\n}): Promise<void> {\n  const execution = await findPrimitiveRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    primitive: { kind: \"workflow\", id: input.workflowId, runId: input.runId },\n    sourceTypes: [\"execution\", \"schedule\", \"event\"],\n  })\n  if (!execution) {\n    invalidExecution(input.executionId, input.runId)\n  }\n\n  if (execution.source.type === \"schedule\" || execution.source.type === \"event\") {\n    if (execution.requestedBy !== undefined) {\n      invalidExecution(input.executionId, input.runId)\n    }\n    return\n  }\n\n  // ExecutionStorage already validates the immutable parent reference, correlation id, and\n  // requested-by propagation. This boundary only owns the workflow-specific source restriction.\n  if (execution.source.type !== \"execution\") {\n    invalidExecution(input.executionId, input.runId)\n  }\n}\n\n/** Validate the semantic link between a Workflow Agent-node run and its child execution. */\nexport async function assertWorkflowAgentNodeRunExecution(input: {\n  readonly executions: ExecutionStorage\n  readonly projectId: string\n  readonly executionId: string\n  readonly nodeRunId: string\n  readonly actorId: string\n  readonly workflowExecutionId: string\n}): Promise<void> {\n  const execution = await findAgentRunExecution({\n    executions: input.executions,\n    projectId: input.projectId,\n    executionId: input.executionId,\n    runId: input.nodeRunId,\n    authority: { type: \"managed\", serviceAccountId: agentServiceAccountId(input.actorId) },\n  })\n  if (\n    !execution ||\n    execution.source.type !== \"execution\" ||\n    execution.source.executionId !== input.workflowExecutionId\n  ) {\n    throw new WorkflowRunError(\n      `[Sixb] Execution '${input.executionId}' does not authorize Workflow Agent-node run '${input.nodeRunId}'.`\n    )\n  }\n}\n\nfunction invalidExecution(executionId: string, runId: string): never {\n  throw new WorkflowRunError(\n    `[Sixb] Execution '${executionId}' does not authorize workflow run '${runId}'.`\n  )\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAEA,IAAM,oBAAoB,OAAO,OAAO,EAAE,QAAQ,oBAAoB,CAAU;AAMzE,SAAS,0BAA0B,CAAC,KAAmC;AAAA,EAC5E,OAAO,OAAO,OAAO,OAAO,YAAY,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,iBAAiB,CAAU,CAAC,CAAC;AAAA;;;ACyC1F,SAAS,eAAe,CAAC,YAA4C;AAAA,EAC1E,OAAO,IAAI,oBAAmB,qBAAqB,WAAW,WAAW,WAAW,OAAO;AAAA;AAmB7F,IAAM,uBAAuB,IAAI;AAKjC,IAAM,8BAA8B,IAAI;AAKxC,IAAM,wBAA2C,OAAO,OAAO;AAAA,EAC7D,OAAO,IAAI;AAAA,EACX,OAAO,OAAO,OAAO,CAAC,CAAC;AACzB,CAAC;AASM,SAAS,wBAAwB,CACtC,UACA,YACA,UAAmC,qBACJ;AAAA,EAC/B,MAAM,MAAM,KAAK,UAAU,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC;AAAA,EAEjD,IAAI,YAAY,uBAAuB,YAAY,YAAY,QAAQ,QAAQ,GAAG;AAAA,IAChF,IAAI,WAAW,qBAAqB,IAAI,QAAQ;AAAA,IAChD,IAAI,CAAC,UAAU;AAAA,MACb,WAAW,IAAI;AAAA,MACf,qBAAqB,IAAI,UAAU,QAAQ;AAAA,IAC7C;AAAA,IAEA,IAAI,CAAC,SAAS,IAAI,GAAG;AAAA,MAAG,SAAS,IAAI,KAAK,wBAAwB,UAAU,UAAU,CAAC;AAAA,IACvF,OAAO,SAAS,IAAI,GAAG;AAAA,EACzB;AAAA,EAEA,IAAI,aAAa,4BAA4B,IAAI,QAAQ;AAAA,EACzD,IAAI,CAAC,YAAY;AAAA,IACf,aAAa,IAAI;AAAA,IACjB,4BAA4B,IAAI,UAAU,UAAU;AAAA,EACtD;AAAA,EAEA,IAAI,WAAW,WAAW,IAAI,OAAO;AAAA,EACrC,IAAI,CAAC,UAAU;AAAA,IACb,WAAW,IAAI;AAAA,IACf,WAAW,IAAI,SAAS,QAAQ;AAAA,EAClC;AAAA,EAEA,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG;AAAA,IACtB,SAAS,IAAI,KAAK,wBAAwB,UAAU,YAAY,OAAO,CAAC;AAAA,EAC1E;AAAA,EACA,OAAO,SAAS,IAAI,GAAG;AAAA;AAGzB,SAAS,WAAW,CAAC,YAAiC,UAAwC;AAAA,EAC5F,WAAW,aAAa;AAAA,IAAU,IAAI,CAAC,WAAW,IAAI,SAAS;AAAA,MAAG,OAAO;AAAA,EACzE,OAAO;AAAA;AAGT,SAAS,uBAAuB,CAC9B,UACA,YACA,UAAmC,qBACJ;AAAA,EAC/B,MAAM,gBAAgB,IAAI;AAAA,EAC1B,MAAM,eAAe,IAAI;AAAA,EACzB,WAAW,cAAc,SAAS,gBAAgB,GAAG;AAAA,IACnD,MAAM,UAAU,QAAQ,WAAW,IAAI,WAAW,EAAE;AAAA,IACpD,MAAM,UAAU,IAAI;AAAA,IACpB,WAAW,YAAY,WAAW,YAAY;AAAA,MAC5C,MAAM,UACJ,SAAS,UAAU,KAAK,CAAC,cAAc,CAAC,WAAW,IAAI,SAAS,CAAC,KACjE,aAAa,SAAS,IAAI,SAAS,EAAE,GAAG,UAAU;AAAA,MACpD,IAAI,YAAY;AAAA,QAAW,QAAQ,IAAI,SAAS,IAAI,OAAO;AAAA,IAC7D;AAAA,IAEA,IAAI,QAAQ,SAAS;AAAA,MAAG;AAAA,IAExB,cAAc,IAAI,WAAW,IAAI,OAAO;AAAA,IACxC,aAAa,IACX,WAAW,IACX,OAAO,OAAO;AAAA,MACZ,KAAK,IAAI,IAAI,QAAQ,KAAK,CAAC;AAAA,MAC3B,YAAY,2BAA2B,QAAQ,KAAK,CAAC;AAAA,IACvD,CAAC,CACH;AAAA,EACF;AAAA,EAEA,MAAM,QAAQ,IAAI;AAAA,EAClB,YAAY,cAAc,UAAU,QAAQ,OAAO;AAAA,IACjD,MAAM,aAAa,aAAa,OAAO,YAAY,IAAI,eAAe;AAAA,IACtE,IAAI;AAAA,MAAY,MAAM,IAAI,cAAc,UAAU;AAAA,EACpD;AAAA,EAEA,MAAM,QAA8C,CAAC;AAAA,EACrD,MAAM,aAAa,IAAI;AAAA,EACvB,YAAY,KAAK,SAAS,QAAQ,OAAO;AAAA,IACvC,MAAM,OAAO,SAAS,KAAK,gBAAgB,KAAK;AAAA,IAChD,MAAM,aAAa,aAAa,KAAK,OAAO,YAAY,IAAI;AAAA,IAC5D,IAAI,CAAC;AAAA,MAAY;AAAA,IAEjB,WAAW,IAAI,KAAK,UAAU;AAAA,IAC9B,MAAM,KACJ,OAAO,OAAO;AAAA,SACT;AAAA,MACH,cAAc,KAAK;AAAA,MACnB,QAAQ,KAAK;AAAA,MACb,oBAAoB,KAAK;AAAA,IAC3B,CAAC,CACH;AAAA,EACF;AAAA,EAEA,IAAI,aAAa,SAAS,KAAK,MAAM,SAAS,KAAK,MAAM,WAAW;AAAA,IAAG;AAAA,EAEvE,MAAM,aACJ,MAAM,SAAS,KAAK,MAAM,WAAW,IACjC,wBACA,OAAO,OAAO,EAAE,OAAO,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,EAC1D,OAAO,OAAO,OAAO;AAAA,IACnB,kBAAkB,CAAC,iBAAyB,aAAa,IAAI,YAAY;AAAA,IACzE,gBAAgB,CAAC,cAAsB,eACrC,cAAc,IAAI,YAAY,GAAG,IAAI,UAAU;AAAA,IACjD,gBAAgB,CAAC,iBAAyB,MAAM,IAAI,YAAY;AAAA,IAChE,gBAAgB,CAAC,cAAsB,WACrC,WAAW,IAAI,eAAe,cAAc,MAAM,CAAC;AAAA,IACrD,YAAY,MAAM;AAAA,EACpB,CAAC;AAAA;AAGH,SAAS,YAAY,CACnB,UACA,YACoB;AAAA,EACpB,IAAI,CAAC;AAAA,IAAU;AAAA,EACf,WAAW,aAAa,CAAC,GAAG,QAAQ,EAAE,KAAK;AAAA,IAAG,IAAI,CAAC,WAAW,IAAI,SAAS;AAAA,MAAG,OAAO;AAAA,EACrF;AAAA;AAIF,SAAS,YAAY,CACnB,OACA,YACA,MACwB;AAAA,EACxB,WAAW,QAAQ,OAAO;AAAA,IACxB,MAAM,UAAU,aAAa,KAAK,UAAU,UAAU;AAAA,IACtD,IAAI,YAAY;AAAA,MAAW;AAAA,IAC3B,OAAO,OAAO,OAAO;AAAA,MACnB;AAAA,MACA,SAAS,sBAAsB,0BAA0B,KAAK,8CAA8C,KAAK,2BAA2B;AAAA,IAC9I,CAAC;AAAA,EACH;AAAA,EACA;AAAA;;;ACvMK,SAAS,8BAA6B,CAC3C,UACA,eAC+B;AAAA,EAC/B,OAAO,cAAc,SAAS,cAC1B,yBAAyB,UAAU,cAAc,QAAQ,cAAc,IAAI,GAAK,IAChF;AAAA;AAsBN,eAAsB,oCAAmC,CAAC,OAOtB;AAAA,EAClC,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,KAAK,uBAAsB,MAAM,OAAO;AAAA,EAC9C,MAAM,MAAM,IAAI;AAAA,EAChB,MAAM,SAAS,MAAM,gCAAgC,MAAM;AAAA,IACzD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,0CAA0C,MAAM,SAAS,MAAM;AAAA,EAC/D,gCAAgC,MAAM,SAAS,MAAM;AAAA,EACrD,MAAM,iBAAiB,MAAM,kCAAkC,MAAM;AAAA,IACnE,UAAU;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW;AAAA,EACb,CAAC;AAAA,EACD,gCAAgC,MAAM,SAAS,cAAc;AAAA,EAE7D,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,2BAA2B;AAAA,IACnE,WAAW,MAAM;AAAA,IACjB,kBAAkB;AAAA,IAClB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW;AAAA,EACb,CAAC,CACH;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,GAAG;AAAA,IACxC;AAAA,EACF;AAAA;AAIF,eAAe,+BAA+B,CAC5C,MACA,OAO+B;AAAA,EAC/B,MAAM,WAAW,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IAClD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM;AAAA,EACZ,CAAC;AAAA,EACD,IAAI;AAAA,IAAU,OAAO;AAAA,EAErB,IAAI;AAAA,IACF,OAAO,MAAM,KAAK,gBAAgB,OAAO;AAAA,MACvC,IAAI,MAAM;AAAA,MACV,WAAW,MAAM;AAAA,MACjB,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,QAAQ;AAAA,MACR,oBAAoB;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,IAAI,EAAE,iBAAiB,sBAAqB,MAAM,SAAS,6BAA6B;AAAA,MACtF,MAAM;AAAA,IACR;AAAA,IACA,MAAM,aAAa,MAAM,KAAK,gBAAgB,QAAQ;AAAA,MACpD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM;AAAA,IACZ,CAAC;AAAA,IACD,IAAI,CAAC;AAAA,MAAY,MAAM;AAAA,IACvB,OAAO;AAAA;AAAA;AAIX,SAAS,+BAA+B,CACtC,SACA,gBACM;AAAA,EACN,IAAI,eAAe,WAAW,aAAa;AAAA,IACzC,MAAM,IAAI,MACR,iBAAiB,6BAA6B,eAAe,mBAC/D;AAAA,EACF;AAAA;AAGF,SAAS,yCAAyC,CAChD,SACA,gBACM;AAAA,EACN,IACE,eAAe,uBAAuB,aACtC,CAAC,iBAAgB,eAAe,oBAAoB,iBAAgB,GACpE;AAAA,IACA,MAAM,iBACJ,0BACA,iBAAiB,wCAAwC,eAAe,0CACxE,EAAE,SAAS,EAAE,SAAS,kBAAkB,eAAe,GAAG,EAAE,CAC9D;AAAA,EACF;AAAA;AAGF,SAAS,sCAAsC,CAC7C,SACA,aACgD;AAAA,EAChD,MAAM,mBAAmB,YACtB,OAAO,CAAC,eAAe,WAAW,WAAW,OAAO,EACpD,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,EACzC,IAAI,iBAAiB,SAAS,GAAG;AAAA,IAC/B,MAAM,iBACJ,0BACA,iBAAiB,iFAAiF,iBAAiB,KAAK,IAAI,MAC5H,EAAE,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAC3C;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAIT,eAAsB,mCAAkC,CAAC,OAM0C;AAAA,EACjG,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,aAAa,uBAAsB,MAAM,OAAO;AAAA,EACtD,MAAM,YACJ,MAAM,iBAAiB,SAAS,cAAc,MAAM,iBAAiB,YAAY;AAAA,EACnF,IAAI,WAAW,SAAS,oBAAoB,UAAU,OAAO,YAAY;AAAA,IACvE,MAAM,IAAI,MACR,iBAAiB,MAAM,gEAAgE,cACzF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAAM,KAAK,gBAAgB,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,UAAU;AAAA,EAChB,CAAC;AAAA,EACD,IAAI,CAAC,kBAAkB,eAAe,WAAW,UAAU;AAAA,IACzD,MAAM,IAAI,MAAM,iCAAiC,UAAU,oBAAoB;AAAA,EACjF;AAAA,EACA,0CAA0C,MAAM,SAAS,cAAc;AAAA,EAEvE,MAAM,mBAAmB,uCACvB,MAAM,SACN,MAAM,KAAK,+BAA+B,sBAAsB;AAAA,IAC9D,WAAW,MAAM;AAAA,IACjB,kBAAkB,UAAU;AAAA,EAC9B,CAAC,CACH;AAAA,EACA,MAAM,WAAmC;AAAA,IACvC;AAAA,IACA,WAAW,EAAE,MAAM,kBAAkB,IAAI,UAAU,GAAG;AAAA,IACtD;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA,SAAS,6BAA4B;AAAA,MACnC,WAAW,SAAS;AAAA,MACpB,UAAU,iBAAiB,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,MACjE,OAAO,MAAM,SAAS,kBAAkB;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA;AAOF,eAAsB,gBAAe,CAAC,OAKjB;AAAA,EACnB,MAAM,cAAc,MAAM,MAAM,KAAK,iBAAiB,YAAY;AAAA,IAChE,WAAW,MAAM;AAAA,IACjB,QAAQ,MAAM;AAAA,EAChB,CAAC;AAAA,EAED,MAAM,UAAU,6BAA4B;AAAA,IAC1C,WAAW,EAAE,MAAM,QAAQ,IAAI,MAAM,OAAO;AAAA,IAC5C,UAAU,YAAY,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,IAC5D,OAAO,MAAM,SAAS,kBAAkB;AAAA,EAC1C,CAAC;AAAA,EACD,OAAO,WAAU,SAAS,EAAE,MAAM,YAAY,CAAC;AAAA;AAIjD,eAAsB,4CAA2C,CAAC,OAMzB;AAAA,EACvC,IAAI,MAAM,iBAAiB,SAAS;AAAA,IAAY,OAAO,EAAE,MAAM,WAAW;AAAA,EAE1E,MAAM,MAAM,iCAAiC,MAAM,gBAAgB;AAAA,EACnE,MAAM,OAAO,mBAAmB,MAAM,IAAI;AAAA,EAC1C,MAAM,MAAM,MAAM,OAAO,IAAI;AAAA,EAC7B,MAAM,OAAO,MAAM,kBAAkB,MAAM,MAAM,WAAW,IAAI,UAAU,EAAE;AAAA,EAC5E,MAAM,cAAc,MAAM,KAAK,iBAAiB,YAAY;AAAA,IAC1D,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,EACf,CAAC;AAAA,EACD,MAAM,aAAa,MAAM,yBAAyB;AAAA,IAChD;AAAA,IACA,WAAW,MAAM;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,YAAY,IAAI;AAAA,IAChB,iBAAiB,YAAY,IAAI,CAAC,eAAe,WAAW,OAAO;AAAA,IACnE;AAAA,EACF,CAAC;AAAA,EAED,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,6BAA4B;AAAA,MACnC,WAAW,IAAI;AAAA,MACf,UAAU,WAAW;AAAA,MACrB,OAAO,MAAM,SAAS,kBAAkB;AAAA,SACpC,WAAW,cAAc,YAAY,CAAC,IAAI,EAAE,WAAW,WAAW,UAAU;AAAA,IAClF,CAAC;AAAA,EACH;AAAA;AAGF,SAAS,gCAAgC,CAAC,KAAyD;AAAA,EACjG,IAAI,IAAI,SAAS,eAAe,IAAI,UAAU,SAAS,UAAU,IAAI,eAAe,WAAW;AAAA,IAC7F,MAAM,0BAA0B,kDAAkD;AAAA,EACpF;AAAA,EACA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,WAAW,EAAE,MAAM,QAAQ,IAAI,IAAI,UAAU,GAAG;AAAA,IAChD,YAAY,EAAE,MAAM,IAAI,WAAW,MAAM,IAAI,IAAI,WAAW,GAAG;AAAA,EACjE;AAAA;AAGF,eAAe,iBAAiB,CAC9B,MACA,WACA,QACqB;AAAA,EACrB,MAAM,OAAO,MAAM,KAAK,MAAM,QAAQ,EAAE,WAAW,IAAI,OAAO,CAAC;AAAA,EAC/D,IAAI,CAAC,QAAQ,KAAK,WAAW,UAAU;AAAA,IACrC,MAAM,0BAA0B,SAAS,uBAAuB;AAAA,EAClE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,wBAAwB,CAAC,OAO2C;AAAA,EACjF,IAAI,MAAM,WAAW,SAAS,WAAW;AAAA,IACvC,MAAM,UAAU,MAAM,MAAM,KAAK,SAAS,QAAQ;AAAA,MAChD,WAAW,MAAM;AAAA,MACjB,IAAI,MAAM,WAAW;AAAA,IACvB,CAAC;AAAA,IACD,IAAI,CAAC,oBAAoB,SAAS,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,MAC1D,MAAM,0BAA0B,0CAA0C;AAAA,IAC5E;AAAA,IACA,OAAO,EAAE,UAAU,MAAM,iBAAiB,WAAW,QAAQ,GAAG;AAAA,EAClE;AAAA,EAEA,MAAM,cAAc,MAAM,MAAM,KAAK,aAAa,QAAQ;AAAA,IACxD,WAAW,MAAM;AAAA,IACjB,IAAI,MAAM,WAAW;AAAA,EACvB,CAAC;AAAA,EACD,IAAI,CAAC,wBAAwB,aAAa,MAAM,QAAQ,MAAM,GAAG,GAAG;AAAA,IAClE,MAAM,0BAA0B,+CAA+C;AAAA,EACjF;AAAA,EACA,IAAI,YAAY,aAAa;AAAA,IAAW,OAAO,EAAE,UAAU,MAAM,gBAAgB;AAAA,EAEjF,MAAM,kBAAkB,IAAI,IAAI,YAAY,QAAQ;AAAA,EACpD,OAAO;AAAA,IACL,UAAU,MAAM,gBAAgB,OAAO,CAAC,YAAY,gBAAgB,IAAI,OAAO,CAAC;AAAA,EAClF;AAAA;AAGF,SAAS,mBAAmB,CAC1B,SACA,QACA,KAC0B;AAAA,EAC1B,IAAI,CAAC,WAAW,QAAQ,WAAW,UAAU,QAAQ,cAAc;AAAA,IAAW,OAAO;AAAA,EACrF,IAAI,QAAQ,UAAU,QAAQ,KAAK,IAAI,QAAQ;AAAA,IAAG,OAAO;AAAA,EACzD,OACE,QAAQ,sBAAsB,aAAa,QAAQ,kBAAkB,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAIjG,SAAS,uBAAuB,CAC9B,OACA,QACA,KAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,CAAC,iBAAgB,MAAM,SAAS,EAAE,MAAM,QAAQ,IAAI,OAAO,CAAC;AAAA,IAAG,OAAO;AAAA,EACpF,OAAO,MAAM,cAAc,aAAa,MAAM,UAAU,QAAQ,IAAI,IAAI,QAAQ;AAAA;AAGlF,SAAS,yBAAyB,CAAC,QAAuB;AAAA,EACxD,OAAO,iBACL,0BACA,sEAAsE,SACxE;AAAA;AAGF,SAAS,kBAAkB,CAAC,MAA4C;AAAA,EACtE,IAAI,CAAC,MAAM;AAAA,IACT,MAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAAA,EACA,OAAO;AAAA;AAGT,eAAe,iCAAiC,CAC9C,MACA,OAM+B;AAAA,EAC/B,IAAI,MAAM,SAAS,SAAS,MAAM,QAAQ,MAAM,SAAS,gBAAgB,MAAM,aAAa;AAAA,IAC1F,OAAO,MAAM;AAAA,EACf;AAAA,EACA,OAAO,KAAK,gBAAgB,OAAO;AAAA,IACjC,WAAW,MAAM,SAAS;AAAA,IAC1B,IAAI,MAAM,SAAS;AAAA,IACnB,MAAM,MAAM;AAAA,IACZ,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,EACnB,CAAC;AAAA;;;ACnZI,MAAM,0BAAyB,MAAM;AAAA,EACjC,OAAO;AAClB;;;ACCA,eAAsB,2BAA0B,CAAC,OAM/B;AAAA,EAChB,MAAM,YAAY,MAAM,0BAA0B;AAAA,IAChD,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,WAAW,EAAE,MAAM,YAAY,IAAI,MAAM,YAAY,OAAO,MAAM,MAAM;AAAA,IACxE,aAAa,CAAC,aAAa,YAAY,OAAO;AAAA,EAChD,CAAC;AAAA,EACD,IAAI,CAAC,WAAW;AAAA,IACd,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA,EAEA,IAAI,UAAU,OAAO,SAAS,cAAc,UAAU,OAAO,SAAS,SAAS;AAAA,IAC7E,IAAI,UAAU,gBAAgB,WAAW;AAAA,MACvC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AAAA,EAIA,IAAI,UAAU,OAAO,SAAS,aAAa;AAAA,IACzC,iBAAiB,MAAM,aAAa,MAAM,KAAK;AAAA,EACjD;AAAA;AAIF,eAAsB,oCAAmC,CAAC,OAOxC;AAAA,EAChB,MAAM,YAAY,MAAM,sBAAsB;AAAA,IAC5C,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM;AAAA,IACjB,aAAa,MAAM;AAAA,IACnB,OAAO,MAAM;AAAA,IACb,WAAW,EAAE,MAAM,WAAW,kBAAkB,uBAAsB,MAAM,OAAO,EAAE;AAAA,EACvF,CAAC;AAAA,EACD,IACE,CAAC,aACD,UAAU,OAAO,SAAS,eAC1B,UAAU,OAAO,gBAAgB,MAAM,qBACvC;AAAA,IACA,MAAM,IAAI,kBACR,qBAAqB,MAAM,4DAA4D,MAAM,aAC/F;AAAA,EACF;AAAA;AAGF,SAAS,gBAAgB,CAAC,aAAqB,OAAsB;AAAA,EACnE,MAAM,IAAI,kBACR,qBAAqB,iDAAiD,SACxE;AAAA;",
+  "debugId": "C3E7FA1E69C6C30464756E2164756E21",
+  "names": []
+}

package/dist/{chunk-t7x8dmn0.js → chunk-6y0mkhex.js}

@@ -2,13 +2,13 @@
 import {
   isFileRef2,
   isValidFileRef
-} from "./chunk-jhm3zsa7.js";
+} from "./chunk-wkv3h3q7.js";
 import {
   getDatasetRowValidationFailure
-} from "./chunk-0yh890a4.js";
+} from "./chunk-c844dkwd.js";
 import {
   getDatasetMergeChangeValidationError2
-} from "./chunk-way52z4h.js";
+} from "./chunk-1t6k1avb.js";
 
 // src/datasets/write.ts
 function lakeDatasetDefinition2(dataset) {

package/dist/{chunk-es1gxsbf.js → chunk-73v685wb.js}

@@ -3,12 +3,10 @@ import {
   GRANT_KINDS,
   isSingletonGrantKind,
   grantKindOf
-} from "./chunk-gsjm1wms.js";
-
-// src/security/errors.ts
-class SecurityValidationError2 extends Error {
-  name = "SecurityValidationError";
-}
+} from "./chunk-vhbw5sqm.js";
+import {
+  SecurityValidationError2
+} from "./chunk-jcfw4h7m.js";
 
 // src/security/membership-policies.ts
 var MEMBERSHIP_OPERATIONS = ["invite", "assignGroups", "suspend", "serviceAccounts"];
@@ -206,17 +204,17 @@ function assertGrantDefinition(value, field, createError = (message) => new Secu
   if (!GRANT_CAPABILITIES.includes(value.capability)) {
     throw createError(`[Sixb] ${field} grant capability must be ${formatAlternatives(GRANT_CAPABILITIES)}.`);
   }
-  if (value.capability === "view" && value.target !== "object" && value.target !== "dataset") {
-    throw createError(`[Sixb] ${field} view grant target must be 'object' or 'dataset'.`);
+  if (value.capability === "view" && value.target !== "object" && value.target !== "dataset" && value.target !== "users") {
+    throw createError(`[Sixb] ${field} view grant target must be 'object', 'dataset', or 'users'.`);
   }
-  if (value.capability === "run" && value.target !== "workflow" && value.target !== "sync" && value.target !== "pipeline" && value.target !== "agent") {
-    throw createError(`[Sixb] ${field} run grant target must be 'workflow', 'sync', 'pipeline', or 'agent'.`);
+  if (value.capability === "run" && value.target !== "workflow" && value.target !== "sync" && value.target !== "pipeline" && value.target !== "agent" && value.target !== "models") {
+    throw createError(`[Sixb] ${field} run grant target must be 'workflow', 'sync', 'pipeline', 'agent', or 'models'.`);
   }
-  if (value.capability === "observe" && value.target !== "logs" && value.target !== "aiUsage") {
-    throw createError(`[Sixb] ${field} observe grant target must be 'logs' or 'aiUsage'.`);
+  if (value.capability === "observe" && value.target !== "logs" && value.target !== "aiUsage" && value.target !== "activity" && value.target !== "agentThreads") {
+    throw createError(`[Sixb] ${field} observe grant target must be 'logs', 'aiUsage', 'activity', or 'agentThreads'.`);
   }
-  if (value.capability === "manage" && value.target !== "connector" && value.target !== "aiUsage") {
-    throw createError(`[Sixb] ${field} manage grant target must be 'connector' or 'aiUsage'.`);
+  if (value.capability === "manage" && value.target !== "connector" && value.target !== "aiUsage" && value.target !== "agentMemory") {
+    throw createError(`[Sixb] ${field} manage grant target must be 'connector', 'aiUsage', or 'agentMemory'.`);
   }
   if (isSingletonGrantKind(grantKindOf(value))) {
     if (value.selection !== undefined) {
@@ -475,6 +473,6 @@ function defineMembershipPolicy2(id, options) {
   };
 }
 
-export { SecurityValidationError2, resolveMembershipPolicyScope, canPerformMembershipOperation, missingMembershipGroupIds, isMarkingDefinition, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, validateSecurityDefinitionsAtStartup, defineGroup2, markingIdsFrom, defineMarking2, defineRole2, defineMembershipPolicy2 };
+export { resolveMembershipPolicyScope, canPerformMembershipOperation, missingMembershipGroupIds, isMarkingDefinition, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, validateSecurityDefinitionsAtStartup, defineGroup2, markingIdsFrom, defineMarking2, defineRole2, defineMembershipPolicy2 };
 
-//# debugId=5079B2E8C73E746064756E2164756E21
+//# debugId=880112CC989BBA4664756E2164756E21

package/dist/chunk-73v685wb.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/security/membership-policies.ts", "../src/security/validation.ts", "../src/security/builders.ts"],
+  "sourcesContent": [
+    "import type { MembershipOperation, MembershipPolicyDefinition } from \"./types\"\n\nexport interface MembershipOperationScope {\n  readonly policyIds: readonly string[]\n  readonly groupIds: ReadonlySet<string>\n}\n\nexport interface MembershipPolicyScope {\n  readonly policyIds: readonly string[]\n  readonly operations: Readonly<Record<MembershipOperation, MembershipOperationScope>>\n}\n\nconst MEMBERSHIP_OPERATIONS = [\"invite\", \"assignGroups\", \"suspend\", \"serviceAccounts\"] as const\n\nexport function resolveMembershipPolicyScope(input: {\n  readonly membershipPolicies: readonly MembershipPolicyDefinition[]\n  readonly callerGroupIds: readonly string[]\n}): MembershipPolicyScope {\n  const callerGroups = new Set(input.callerGroupIds)\n  const policyIds: string[] = []\n  const operations = createEmptyOperationScopes()\n\n  for (const policy of input.membershipPolicies) {\n    if (!policy.grantedToGroupIds.some((groupId) => callerGroups.has(groupId))) {\n      continue\n    }\n\n    policyIds.push(policy.id)\n    for (const operation of policy.can) {\n      operations[operation].policyIds.push(policy.id)\n      for (const groupId of policy.scopeGroupIds) {\n        operations[operation].groupIds.add(groupId)\n      }\n    }\n  }\n\n  return {\n    policyIds,\n    operations: {\n      invite: freezeOperationScope(operations.invite),\n      assignGroups: freezeOperationScope(operations.assignGroups),\n      suspend: freezeOperationScope(operations.suspend),\n      serviceAccounts: freezeOperationScope(operations.serviceAccounts),\n    },\n  }\n}\n\nexport function canPerformMembershipOperation(\n  scope: MembershipPolicyScope,\n  operation: MembershipOperation,\n  groupIds: readonly string[]\n): boolean {\n  const operationScope = scope.operations[operation]\n\n  if (operationScope.policyIds.length === 0) {\n    return false\n  }\n\n  if (groupIds.length === 0) {\n    return true\n  }\n\n  return groupIds.every((groupId) => operationScope.groupIds.has(groupId))\n}\n\nexport function missingMembershipGroupIds(\n  scope: MembershipPolicyScope,\n  operation: MembershipOperation,\n  groupIds: readonly string[]\n): readonly string[] {\n  if (groupIds.length === 0) {\n    return []\n  }\n\n  const operationScope = scope.operations[operation]\n  return groupIds.filter((groupId) => !operationScope.groupIds.has(groupId))\n}\n\nfunction createEmptyOperationScopes(): Record<\n  MembershipOperation,\n  { policyIds: string[]; groupIds: Set<string> }\n> {\n  return {\n    invite: { policyIds: [], groupIds: new Set<string>() },\n    assignGroups: { policyIds: [], groupIds: new Set<string>() },\n    suspend: { policyIds: [], groupIds: new Set<string>() },\n    serviceAccounts: { policyIds: [], groupIds: new Set<string>() },\n  }\n}\n\nfunction freezeOperationScope(input: {\n  readonly policyIds: readonly string[]\n  readonly groupIds: ReadonlySet<string>\n}): MembershipOperationScope {\n  return {\n    policyIds: [...input.policyIds],\n    groupIds: new Set(input.groupIds),\n  }\n}\n\nexport function isMembershipOperation(value: unknown): value is MembershipOperation {\n  return MEMBERSHIP_OPERATIONS.includes(value as MembershipOperation)\n}\n",
+    "import {\n  GRANT_KINDS,\n  type GrantUniverseKey,\n  grantKindOf,\n  isSingletonGrantKind,\n} from \"../authorization/grant-kinds\"\nimport { SecurityValidationError } from \"./errors\"\nimport { isMembershipOperation } from \"./membership-policies\"\nimport type {\n  GrantCapability,\n  GrantDefinition,\n  GroupDefinition,\n  MarkingDefinition,\n  MembershipPolicyDefinition,\n  RegisteredSecurityDefinitions,\n  RoleDefinition,\n  Selection,\n} from \"./types\"\n\n/** Registered id universes and singleton capabilities available to role grants. */\ntype RegisteredUniverses = Partial<Record<GrantUniverseKey, ReadonlySet<string>>> & {\n  readonly agentAvailable?: boolean\n}\n\n/**\n * Every grant capability, for validating grants that arrive from untyped code.\n *\n * Written as a total `Record<GrantCapability, true>` rather than a bare array so a capability added\n * to `GrantDefinition` is a compile error here — the same discipline `GRANT_KINDS` uses. The\n * hand-written `capability !== \"view\" && …` chain this replaces would have accepted the new\n * capability at startup and then died on `GRANT_KINDS[kind].universeKey`.\n */\nconst GRANT_CAPABILITIES = Object.keys({\n  view: true,\n  edit: true,\n  append: true,\n  apply: true,\n  share: true,\n  run: true,\n  observe: true,\n  manage: true,\n} satisfies Record<GrantCapability, true>) as readonly GrantCapability[]\n\n/** \"'a', 'b', or 'c'\" — the shape the security errors already use. */\nfunction formatAlternatives(values: readonly string[]): string {\n  const quoted = values.map((value) => `'${value}'`)\n  const last = quoted.at(-1)\n  return quoted.length < 2 ? (last ?? \"\") : `${quoted.slice(0, -1).join(\", \")}, or ${last}`\n}\n\nexport type CreateSecurityError = (message: string) => Error\n\n// Shared, single-source validation primitives. The builders reuse these too, so\n// authoring-time and startup-time checks can never drift apart.\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nexport function assertNonEmptyString(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is string {\n  if (typeof value !== \"string\" || value.trim().length === 0) {\n    throw createError(`[Sixb] ${field} must not be empty.`)\n  }\n}\n\nexport function assertOptionalString(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is string | undefined {\n  if (value === undefined) {\n    return\n  }\n\n  if (typeof value !== \"string\") {\n    throw createError(`[Sixb] ${field} must be a string.`)\n  }\n}\n\nfunction assertStringArray(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is readonly string[] {\n  if (!Array.isArray(value)) {\n    throw createError(`[Sixb] ${field} must be an array of group ids.`)\n  }\n\n  for (const item of value) {\n    assertNonEmptyString(item, `${field} item`, createError)\n  }\n}\n\nfunction assertMembershipOperationArray(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is MembershipPolicyDefinition[\"can\"] {\n  if (!Array.isArray(value)) {\n    throw createError(`[Sixb] ${field} must be an array of membership operations.`)\n  }\n\n  for (const item of value) {\n    if (!isMembershipOperation(item)) {\n      throw createError(\n        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`\n      )\n    }\n  }\n}\n\nfunction assertNoDuplicateIds(ids: readonly string[], field: string): void {\n  const seen = new Set<string>()\n  for (const id of ids) {\n    if (seen.has(id)) {\n      throw new SecurityValidationError(`[Sixb] ${field} contains duplicate group id '${id}'.`)\n    }\n    seen.add(id)\n  }\n}\n\nfunction assertNoDuplicateOperations(\n  operations: readonly MembershipPolicyDefinition[\"can\"][number][],\n  field: string\n): void {\n  const seen = new Set<string>()\n  for (const operation of operations) {\n    if (seen.has(operation)) {\n      throw new SecurityValidationError(\n        `[Sixb] ${field} contains duplicate operation '${operation}'.`\n      )\n    }\n    seen.add(operation)\n  }\n}\n\nexport function assertMarkingDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is MarkingDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Marking definition must be an object.\")\n  }\n\n  if (value.kind !== \"marking\") {\n    throw createError(\"[Sixb] Marking definition kind must be 'marking'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Marking id\", createError)\n  assertOptionalString(value.label, `Marking '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Marking '${value.id}' description`, createError)\n}\n\nexport function isMarkingDefinition(value: unknown): value is MarkingDefinition {\n  try {\n    assertMarkingDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertGroupDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is GroupDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Group definition must be an object.\")\n  }\n\n  if (value.kind !== \"group\") {\n    throw createError(\"[Sixb] Group definition kind must be 'group'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Group id\", createError)\n  assertOptionalString(value.label, `Group '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Group '${value.id}' description`, createError)\n}\n\nexport function isGroupDefinition(value: unknown): value is GroupDefinition {\n  try {\n    assertGroupDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertMembershipPolicyDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is MembershipPolicyDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Membership policy definition must be an object.\")\n  }\n\n  if (value.kind !== \"membershipPolicy\") {\n    throw createError(\"[Sixb] Membership policy definition kind must be 'membershipPolicy'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Membership policy id\", createError)\n  assertStringArray(\n    value.grantedToGroupIds,\n    `Membership policy '${value.id}' grantedTo`,\n    createError\n  )\n  assertStringArray(value.scopeGroupIds, `Membership policy '${value.id}' scope`, createError)\n  assertMembershipOperationArray(value.can, `Membership policy '${value.id}' can`, createError)\n}\n\nexport function isMembershipPolicyDefinition(value: unknown): value is MembershipPolicyDefinition {\n  try {\n    assertMembershipPolicyDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function assertGrantDefinition(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is GrantDefinition {\n  if (!isRecord(value) || value.kind !== \"grant\") {\n    throw createError(`[Sixb] ${field} must contain only grant definitions from 'can'.`)\n  }\n\n  if (!GRANT_CAPABILITIES.includes(value.capability as GrantCapability)) {\n    throw createError(\n      `[Sixb] ${field} grant capability must be ${formatAlternatives(GRANT_CAPABILITIES)}.`\n    )\n  }\n\n  if (\n    value.capability === \"view\" &&\n    value.target !== \"object\" &&\n    value.target !== \"dataset\" &&\n    value.target !== \"users\"\n  ) {\n    throw createError(`[Sixb] ${field} view grant target must be 'object', 'dataset', or 'users'.`)\n  }\n\n  if (\n    value.capability === \"run\" &&\n    value.target !== \"workflow\" &&\n    value.target !== \"sync\" &&\n    value.target !== \"pipeline\" &&\n    value.target !== \"agent\" &&\n    value.target !== \"models\"\n  ) {\n    throw createError(\n      `[Sixb] ${field} run grant target must be 'workflow', 'sync', 'pipeline', 'agent', or 'models'.`\n    )\n  }\n\n  if (\n    value.capability === \"observe\" &&\n    value.target !== \"logs\" &&\n    value.target !== \"aiUsage\" &&\n    value.target !== \"activity\" &&\n    value.target !== \"agentThreads\"\n  ) {\n    throw createError(\n      `[Sixb] ${field} observe grant target must be 'logs', 'aiUsage', 'activity', or 'agentThreads'.`\n    )\n  }\n\n  if (\n    value.capability === \"manage\" &&\n    value.target !== \"connector\" &&\n    value.target !== \"aiUsage\" &&\n    value.target !== \"agentMemory\"\n  ) {\n    throw createError(\n      `[Sixb] ${field} manage grant target must be 'connector', 'aiUsage', or 'agentMemory'.`\n    )\n  }\n\n  // The member directory, the agent, logs, AI usage, activity, Agent conversations and Agent\n  // memory are one surface each, so their grants select nothing. The checks above settled the\n  // capability and target, so the kind is known.\n  if (isSingletonGrantKind(grantKindOf(value as unknown as GrantDefinition))) {\n    if (value.selection !== undefined) {\n      throw createError(\n        `[Sixb] ${field} ${value.capability} grant on '${value.target}' must not declare a selection.`\n      )\n    }\n    return\n  }\n\n  assertSelection(value.selection, field, createError)\n}\n\nfunction assertSelection(\n  value: unknown,\n  field: string,\n  createError: CreateSecurityError\n): asserts value is Selection {\n  if (!isRecord(value) || typeof value.all !== \"boolean\") {\n    throw createError(`[Sixb] ${field} grant must carry a selection from 'can' or a scope.`)\n  }\n\n  const ids = value.all ? value.except : value.ids\n  if (!Array.isArray(ids)) {\n    throw createError(`[Sixb] ${field} grant selection must list ids.`)\n  }\n\n  for (const id of ids) {\n    assertNonEmptyString(id, `${field} grant selection id`, createError)\n  }\n}\n\nexport function assertRoleDefinition(\n  value: unknown,\n  createError: CreateSecurityError = (message) => new SecurityValidationError(message)\n): asserts value is RoleDefinition {\n  if (!isRecord(value)) {\n    throw createError(\"[Sixb] Role definition must be an object.\")\n  }\n\n  if (value.kind !== \"role\") {\n    throw createError(\"[Sixb] Role definition kind must be 'role'.\")\n  }\n\n  assertNonEmptyString(value.id, \"Role id\", createError)\n  assertOptionalString(value.label, `Role '${value.id}' label`, createError)\n  assertOptionalString(value.description, `Role '${value.id}' description`, createError)\n  assertStringArray(value.grantedToGroupIds, `Role '${value.id}' grantedTo`, createError)\n\n  if (!Array.isArray(value.grants)) {\n    throw createError(`[Sixb] Role '${value.id}' grants must be an array.`)\n  }\n\n  for (const grant of value.grants) {\n    assertGrantDefinition(grant, `Role '${value.id}' grants`, createError)\n  }\n\n  if (value.clearances !== undefined) {\n    assertStringArray(value.clearances, `Role '${value.id}' clearances`, createError)\n  }\n}\n\nexport function isRoleDefinition(value: unknown): value is RoleDefinition {\n  try {\n    assertRoleDefinition(value, (message) => new Error(message))\n    return true\n  } catch {\n    return false\n  }\n}\n\nexport function validateSecurityDefinitionsAtStartup(input: {\n  readonly markings?: readonly MarkingDefinition[]\n  readonly groups: readonly GroupDefinition[]\n  readonly membershipPolicies: readonly MembershipPolicyDefinition[]\n  readonly roles?: readonly RoleDefinition[]\n  /** Registered object type ids — when provided, view grants must reference them. */\n  readonly objectTypeIds?: ReadonlySet<string>\n  /** Registered dataset ids — when provided, dataset view grants must reference them. */\n  readonly datasetIds?: ReadonlySet<string>\n  /** Registered action ids — when provided, apply grants must reference them. */\n  readonly actionIds?: ReadonlySet<string>\n  /** Registered workflow ids — when provided, run grants must reference them. */\n  readonly workflowIds?: ReadonlySet<string>\n  /** Registered sync ids — when provided, sync run grants must reference them. */\n  readonly syncIds?: ReadonlySet<string>\n  /** Registered pipeline ids — when provided, pipeline run grants must reference them. */\n  readonly pipelineIds?: ReadonlySet<string>\n  /** Whether the project's single conversational Agent is configured. */\n  readonly agentAvailable?: boolean\n  /** Registered connector ids — when provided, manage grants must reference them. */\n  readonly connectorIds?: ReadonlySet<string>\n  /** Registered Share ids — when provided, share grants must reference them. */\n  readonly shareIds?: ReadonlySet<string>\n}): RegisteredSecurityDefinitions {\n  const markingsById = new Map<string, MarkingDefinition>()\n  const groupsById = new Map<string, GroupDefinition>()\n  const rolesById = new Map<string, RoleDefinition>()\n  const membershipPoliciesById = new Map<string, MembershipPolicyDefinition>()\n\n  for (const marking of input.markings ?? []) {\n    assertMarkingDefinition(marking)\n\n    if (markingsById.has(marking.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate marking id: ${marking.id}`)\n    }\n\n    markingsById.set(marking.id, marking)\n  }\n\n  for (const group of input.groups) {\n    assertGroupDefinition(group)\n\n    if (groupsById.has(group.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate group id: ${group.id}`)\n    }\n\n    groupsById.set(group.id, group)\n  }\n\n  for (const role of input.roles ?? []) {\n    assertRoleDefinition(role)\n\n    if (rolesById.has(role.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate role id: ${role.id}`)\n    }\n\n    if (role.grantedToGroupIds.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${role.id}' must be granted to at least one group.`\n      )\n    }\n\n    const clearances = role.clearances ?? []\n    if (role.grants.length === 0 && clearances.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${role.id}' must declare at least one grant or clearance.`\n      )\n    }\n\n    assertNoDuplicateIds(role.grantedToGroupIds, `Role '${role.id}' grantedTo`)\n    assertNoDuplicateIds(clearances, `Role '${role.id}' clearances`)\n\n    for (const markingId of clearances) {\n      if (!markingsById.has(markingId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Role '${role.id}' clearances reference unknown marking '${markingId}'. Add it to 'security/markings/' or pass it to createSixb({ markings }).`\n        )\n      }\n    }\n\n    for (const groupId of role.grantedToGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Role '${role.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    for (const grant of role.grants) {\n      assertGrantReferences(role.id, grant, input)\n    }\n\n    rolesById.set(role.id, role)\n  }\n\n  for (const policy of input.membershipPolicies) {\n    assertMembershipPolicyDefinition(policy)\n\n    if (membershipPoliciesById.has(policy.id)) {\n      throw new SecurityValidationError(`[Sixb] Duplicate membership policy id: ${policy.id}`)\n    }\n\n    if (policy.grantedToGroupIds.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Membership policy '${policy.id}' must grant membership authority to at least one group.`\n      )\n    }\n\n    if (policy.can.length === 0) {\n      throw new SecurityValidationError(\n        `[Sixb] Membership policy '${policy.id}' must declare at least one operation.`\n      )\n    }\n\n    assertNoDuplicateIds(policy.grantedToGroupIds, `Membership policy '${policy.id}' grantedTo`)\n    assertNoDuplicateIds(policy.scopeGroupIds, `Membership policy '${policy.id}' scope`)\n    assertNoDuplicateOperations(policy.can, `Membership policy '${policy.id}' can`)\n\n    for (const groupId of policy.grantedToGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Membership policy '${policy.id}' grantedTo references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    for (const groupId of policy.scopeGroupIds) {\n      if (!groupsById.has(groupId)) {\n        throw new SecurityValidationError(\n          `[Sixb] Membership policy '${policy.id}' scope references unknown group '${groupId}'. Add it to 'security/groups/' or pass it to createSixb({ groups }).`\n        )\n      }\n    }\n\n    membershipPoliciesById.set(policy.id, policy)\n  }\n\n  return {\n    markings: [...markingsById.values()],\n    markingsById,\n    groups: [...groupsById.values()],\n    groupsById,\n    roles: [...rolesById.values()],\n    rolesById,\n    membershipPolicies: [...membershipPoliciesById.values()],\n    membershipPoliciesById,\n  }\n}\n\nfunction assertGrantReferences(\n  roleId: string,\n  grant: GrantDefinition,\n  registered: RegisteredUniverses\n): void {\n  if (grant.capability === \"run\" && grant.target === \"agent\") {\n    const spec = GRANT_KINDS[grantKindOf(grant)]\n    if (!registered.agentAvailable) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${roleId}' grants ${grant.capability} on the project Agent, but it is unavailable. ${spec.fix}`\n      )\n    }\n    return\n  }\n  // The member directory, logs and AI usage are always there; only targeted grants name ids to\n  // check.\n  if (!(\"selection\" in grant)) return\n  const kind = grantKindOf(grant)\n  if (isSingletonGrantKind(kind)) return\n  const spec = GRANT_KINDS[kind]\n  const universe = registered[spec.universeKey]\n\n  if (!universe) {\n    return\n  }\n\n  // Explicit selections list ids to include; \"all except\" selections list ids\n  // to exclude. Either way every named id must be registered — an unknown id is\n  // a typo that would silently widen or no-op the grant.\n  const ids = grant.selection.all ? grant.selection.except : grant.selection.ids\n\n  for (const id of ids) {\n    if (!universe.has(id)) {\n      throw new SecurityValidationError(\n        `[Sixb] Role '${roleId}' grants ${grant.capability} on unknown ${spec.subject} '${id}'. ${spec.fix}`\n      )\n    }\n  }\n}\n",
+    "import { SecurityValidationError } from \"./errors\"\nimport type {\n  GrantDefinition,\n  GroupDefinition,\n  MarkingDefinition,\n  MembershipOperation,\n  MembershipPolicyDefinition,\n  RoleDefinition,\n} from \"./types\"\nimport {\n  assertGrantDefinition,\n  assertNonEmptyString,\n  assertOptionalString,\n  isRecord,\n} from \"./validation\"\n\nexport interface DefineGroupOptions {\n  readonly label?: string\n  readonly description?: string\n}\n\nexport interface DefineMarkingOptions {\n  readonly label?: string\n  readonly description?: string\n}\n\nexport interface DefineRoleOptions {\n  readonly label?: string\n  readonly description?: string\n  readonly grantedTo: readonly GroupDefinition[]\n  readonly grants?: readonly GrantDefinition[]\n  /** Markings this role's members may read. */\n  readonly clearances?: readonly MarkingDefinition[]\n}\n\nexport interface DefineMembershipPolicyOptions {\n  readonly grantedTo: readonly GroupDefinition[]\n  readonly scope: readonly GroupDefinition[]\n  readonly can: readonly MembershipOperation[]\n}\n\nconst MEMBERSHIP_OPERATIONS = new Set<MembershipOperation>([\n  \"invite\",\n  \"assignGroups\",\n  \"suspend\",\n  \"serviceAccounts\",\n])\n\nfunction assertNonEmptyArray<T>(value: readonly T[], field: string): void {\n  if (value.length === 0) {\n    throw new SecurityValidationError(`[Sixb] ${field} must not be empty.`)\n  }\n}\n\nfunction groupIdsFrom(groups: readonly GroupDefinition[], field: string): readonly string[] {\n  return groups.map((group) => {\n    if (!isRecord(group) || group.kind !== \"group\") {\n      throw new SecurityValidationError(`[Sixb] ${field} must contain only group definitions.`)\n    }\n\n    assertNonEmptyString(group.id, `${field} group id`)\n    return group.id\n  })\n}\n\nfunction membershipOperationsFrom(\n  operations: readonly MembershipOperation[],\n  field: string\n): readonly MembershipOperation[] {\n  return operations.map((operation) => {\n    if (!MEMBERSHIP_OPERATIONS.has(operation)) {\n      throw new SecurityValidationError(\n        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`\n      )\n    }\n\n    return operation\n  })\n}\n\nexport function defineGroup<const TId extends string>(\n  id: TId,\n  options: DefineGroupOptions = {}\n): GroupDefinition<TId> {\n  assertNonEmptyString(id, \"Group id\")\n  assertOptionalString(options.label, `Group '${id}' label`)\n  assertOptionalString(options.description, `Group '${id}' description`)\n\n  return {\n    kind: \"group\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n  }\n}\n\n/** Read the ids of marking definitions, rejecting anything else such as a bare id. */\nexport function markingIdsFrom(\n  markings: readonly MarkingDefinition[],\n  field: string\n): readonly string[] {\n  return markings.map((marking) => {\n    if (!isRecord(marking) || marking.kind !== \"marking\") {\n      throw new SecurityValidationError(`[Sixb] ${field} must contain only marking definitions.`)\n    }\n\n    assertNonEmptyString(marking.id, `${field} marking id`)\n    return marking.id\n  })\n}\n\nexport function defineMarking<const TId extends string>(\n  id: TId,\n  options: DefineMarkingOptions = {}\n): MarkingDefinition<TId> {\n  assertNonEmptyString(id, \"Marking id\")\n  assertOptionalString(options.label, `Marking '${id}' label`)\n  assertOptionalString(options.description, `Marking '${id}' description`)\n\n  return {\n    kind: \"marking\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n  }\n}\n\nexport function defineRole<const TId extends string>(\n  id: TId,\n  options: DefineRoleOptions\n): RoleDefinition<TId> {\n  assertNonEmptyString(id, \"Role id\")\n  assertOptionalString(options.label, `Role '${id}' label`)\n  assertOptionalString(options.description, `Role '${id}' description`)\n  assertNonEmptyArray(options.grantedTo, `Role '${id}' grantedTo`)\n\n  const grantedToGroupIds = groupIdsFrom(options.grantedTo, `Role '${id}' grantedTo`)\n  const grants = options.grants ?? []\n  const clearances = markingIdsFrom(options.clearances ?? [], `Role '${id}' clearances`)\n\n  for (const grant of grants) {\n    assertGrantDefinition(grant, `Role '${id}' grants`)\n  }\n\n  if (grants.length === 0 && clearances.length === 0) {\n    throw new SecurityValidationError(\n      `[Sixb] Role '${id}' must declare at least one grant or clearance.`\n    )\n  }\n\n  return {\n    kind: \"role\",\n    id,\n    ...(options.label !== undefined ? { label: options.label } : {}),\n    ...(options.description !== undefined ? { description: options.description } : {}),\n    grantedToGroupIds,\n    grants,\n    ...(clearances.length > 0 ? { clearances } : {}),\n  }\n}\n\nexport function defineMembershipPolicy<const TId extends string>(\n  id: TId,\n  options: DefineMembershipPolicyOptions\n): MembershipPolicyDefinition<TId> {\n  assertNonEmptyString(id, \"Membership policy id\")\n  assertNonEmptyArray(options.grantedTo, `Membership policy '${id}' grantedTo`)\n  assertNonEmptyArray(options.can, `Membership policy '${id}' can`)\n\n  return {\n    kind: \"membershipPolicy\",\n    id,\n    grantedToGroupIds: groupIdsFrom(options.grantedTo, `Membership policy '${id}' grantedTo`),\n    scopeGroupIds: groupIdsFrom(options.scope, `Membership policy '${id}' scope`),\n    can: membershipOperationsFrom(options.can, `Membership policy '${id}' can`),\n  }\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;AAYA,IAAM,wBAAwB,CAAC,UAAU,gBAAgB,WAAW,iBAAiB;AAE9E,SAAS,4BAA4B,CAAC,OAGnB;AAAA,EACxB,MAAM,eAAe,IAAI,IAAI,MAAM,cAAc;AAAA,EACjD,MAAM,YAAsB,CAAC;AAAA,EAC7B,MAAM,aAAa,2BAA2B;AAAA,EAE9C,WAAW,UAAU,MAAM,oBAAoB;AAAA,IAC7C,IAAI,CAAC,OAAO,kBAAkB,KAAK,CAAC,YAAY,aAAa,IAAI,OAAO,CAAC,GAAG;AAAA,MAC1E;AAAA,IACF;AAAA,IAEA,UAAU,KAAK,OAAO,EAAE;AAAA,IACxB,WAAW,aAAa,OAAO,KAAK;AAAA,MAClC,WAAW,WAAW,UAAU,KAAK,OAAO,EAAE;AAAA,MAC9C,WAAW,WAAW,OAAO,eAAe;AAAA,QAC1C,WAAW,WAAW,SAAS,IAAI,OAAO;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL;AAAA,IACA,YAAY;AAAA,MACV,QAAQ,qBAAqB,WAAW,MAAM;AAAA,MAC9C,cAAc,qBAAqB,WAAW,YAAY;AAAA,MAC1D,SAAS,qBAAqB,WAAW,OAAO;AAAA,MAChD,iBAAiB,qBAAqB,WAAW,eAAe;AAAA,IAClE;AAAA,EACF;AAAA;AAGK,SAAS,6BAA6B,CAC3C,OACA,WACA,UACS;AAAA,EACT,MAAM,iBAAiB,MAAM,WAAW;AAAA,EAExC,IAAI,eAAe,UAAU,WAAW,GAAG;AAAA,IACzC,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,OAAO;AAAA,EACT;AAAA,EAEA,OAAO,SAAS,MAAM,CAAC,YAAY,eAAe,SAAS,IAAI,OAAO,CAAC;AAAA;AAGlE,SAAS,yBAAyB,CACvC,OACA,WACA,UACmB;AAAA,EACnB,IAAI,SAAS,WAAW,GAAG;AAAA,IACzB,OAAO,CAAC;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,MAAM,WAAW;AAAA,EACxC,OAAO,SAAS,OAAO,CAAC,YAAY,CAAC,eAAe,SAAS,IAAI,OAAO,CAAC;AAAA;AAG3E,SAAS,0BAA0B,GAGjC;AAAA,EACA,OAAO;AAAA,IACL,QAAQ,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IACrD,cAAc,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IAC3D,SAAS,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,IACtD,iBAAiB,EAAE,WAAW,CAAC,GAAG,UAAU,IAAI,IAAc;AAAA,EAChE;AAAA;AAGF,SAAS,oBAAoB,CAAC,OAGD;AAAA,EAC3B,OAAO;AAAA,IACL,WAAW,CAAC,GAAG,MAAM,SAAS;AAAA,IAC9B,UAAU,IAAI,IAAI,MAAM,QAAQ;AAAA,EAClC;AAAA;AAGK,SAAS,qBAAqB,CAAC,OAA8C;AAAA,EAClF,OAAO,sBAAsB,SAAS,KAA4B;AAAA;;;ACrEpE,IAAM,qBAAqB,OAAO,KAAK;AAAA,EACrC,MAAM;AAAA,EACN,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AAAA,EACP,KAAK;AAAA,EACL,SAAS;AAAA,EACT,QAAQ;AACV,CAAyC;AAGzC,SAAS,kBAAkB,CAAC,QAAmC;AAAA,EAC7D,MAAM,SAAS,OAAO,IAAI,CAAC,UAAU,IAAI,QAAQ;AAAA,EACjD,MAAM,OAAO,OAAO,GAAG,EAAE;AAAA,EACzB,OAAO,OAAO,SAAS,IAAK,QAAQ,KAAM,GAAG,OAAO,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,SAAS;AAAA;AAO9E,SAAS,QAAQ,CAAC,OAAkD;AAAA,EACzE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAAA;AAGrE,SAAS,oBAAoB,CAClC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC1D;AAAA,EACzB,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAAA,IAC1D,MAAM,YAAY,UAAU,0BAA0B;AAAA,EACxD;AAAA;AAGK,SAAS,oBAAoB,CAClC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC9C;AAAA,EACrC,IAAI,UAAU,WAAW;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,IAAI,OAAO,UAAU,UAAU;AAAA,IAC7B,MAAM,YAAY,UAAU,yBAAyB;AAAA,EACvD;AAAA;AAGF,SAAS,iBAAiB,CACxB,OACA,OACA,aACoC;AAAA,EACpC,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzB,MAAM,YAAY,UAAU,sCAAsC;AAAA,EACpE;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,qBAAqB,MAAM,GAAG,cAAc,WAAW;AAAA,EACzD;AAAA;AAGF,SAAS,8BAA8B,CACrC,OACA,OACA,aACoD;AAAA,EACpD,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzB,MAAM,YAAY,UAAU,kDAAkD;AAAA,EAChF;AAAA,EAEA,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,CAAC,sBAAsB,IAAI,GAAG;AAAA,MAChC,MAAM,YACJ,UAAU,gGACZ;AAAA,IACF;AAAA,EACF;AAAA;AAGF,SAAS,oBAAoB,CAAC,KAAwB,OAAqB;AAAA,EACzE,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,KAAK,IAAI,EAAE,GAAG;AAAA,MAChB,MAAM,IAAI,yBAAwB,UAAU,sCAAsC,MAAM;AAAA,IAC1F;AAAA,IACA,KAAK,IAAI,EAAE;AAAA,EACb;AAAA;AAGF,SAAS,2BAA2B,CAClC,YACA,OACM;AAAA,EACN,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,aAAa,YAAY;AAAA,IAClC,IAAI,KAAK,IAAI,SAAS,GAAG;AAAA,MACvB,MAAM,IAAI,yBACR,UAAU,uCAAuC,aACnD;AAAA,IACF;AAAA,IACA,KAAK,IAAI,SAAS;AAAA,EACpB;AAAA;AAGK,SAAS,uBAAuB,CACrC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAC/C;AAAA,EACpC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,8CAA8C;AAAA,EAClE;AAAA,EAEA,IAAI,MAAM,SAAS,WAAW;AAAA,IAC5B,MAAM,YAAY,mDAAmD;AAAA,EACvE;AAAA,EAEA,qBAAqB,MAAM,IAAI,cAAc,WAAW;AAAA,EACxD,qBAAqB,MAAM,OAAO,YAAY,MAAM,aAAa,WAAW;AAAA,EAC5E,qBAAqB,MAAM,aAAa,YAAY,MAAM,mBAAmB,WAAW;AAAA;AAGnF,SAAS,mBAAmB,CAAC,OAA4C;AAAA,EAC9E,IAAI;AAAA,IACF,wBAAwB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC9D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,qBAAqB,CACnC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACjD;AAAA,EAClC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,4CAA4C;AAAA,EAChE;AAAA,EAEA,IAAI,MAAM,SAAS,SAAS;AAAA,IAC1B,MAAM,YAAY,+CAA+C;AAAA,EACnE;AAAA,EAEA,qBAAqB,MAAM,IAAI,YAAY,WAAW;AAAA,EACtD,qBAAqB,MAAM,OAAO,UAAU,MAAM,aAAa,WAAW;AAAA,EAC1E,qBAAqB,MAAM,aAAa,UAAU,MAAM,mBAAmB,WAAW;AAAA;AAGjF,SAAS,iBAAiB,CAAC,OAA0C;AAAA,EAC1E,IAAI;AAAA,IACF,sBAAsB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC5D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,gCAAgC,CAC9C,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACtC;AAAA,EAC7C,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,wDAAwD;AAAA,EAC5E;AAAA,EAEA,IAAI,MAAM,SAAS,oBAAoB;AAAA,IACrC,MAAM,YAAY,sEAAsE;AAAA,EAC1F;AAAA,EAEA,qBAAqB,MAAM,IAAI,wBAAwB,WAAW;AAAA,EAClE,kBACE,MAAM,mBACN,sBAAsB,MAAM,iBAC5B,WACF;AAAA,EACA,kBAAkB,MAAM,eAAe,sBAAsB,MAAM,aAAa,WAAW;AAAA,EAC3F,+BAA+B,MAAM,KAAK,sBAAsB,MAAM,WAAW,WAAW;AAAA;AAGvF,SAAS,4BAA4B,CAAC,OAAqD;AAAA,EAChG,IAAI;AAAA,IACF,iCAAiC,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IACvE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,qBAAqB,CACnC,OACA,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GACjD;AAAA,EAClC,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS;AAAA,IAC9C,MAAM,YAAY,UAAU,uDAAuD;AAAA,EACrF;AAAA,EAEA,IAAI,CAAC,mBAAmB,SAAS,MAAM,UAA6B,GAAG;AAAA,IACrE,MAAM,YACJ,UAAU,kCAAkC,mBAAmB,kBAAkB,IACnF;AAAA,EACF;AAAA,EAEA,IACE,MAAM,eAAe,UACrB,MAAM,WAAW,YACjB,MAAM,WAAW,aACjB,MAAM,WAAW,SACjB;AAAA,IACA,MAAM,YAAY,UAAU,kEAAkE;AAAA,EAChG;AAAA,EAEA,IACE,MAAM,eAAe,SACrB,MAAM,WAAW,cACjB,MAAM,WAAW,UACjB,MAAM,WAAW,cACjB,MAAM,WAAW,WACjB,MAAM,WAAW,UACjB;AAAA,IACA,MAAM,YACJ,UAAU,sFACZ;AAAA,EACF;AAAA,EAEA,IACE,MAAM,eAAe,aACrB,MAAM,WAAW,UACjB,MAAM,WAAW,aACjB,MAAM,WAAW,cACjB,MAAM,WAAW,gBACjB;AAAA,IACA,MAAM,YACJ,UAAU,sFACZ;AAAA,EACF;AAAA,EAEA,IACE,MAAM,eAAe,YACrB,MAAM,WAAW,eACjB,MAAM,WAAW,aACjB,MAAM,WAAW,eACjB;AAAA,IACA,MAAM,YACJ,UAAU,6EACZ;AAAA,EACF;AAAA,EAKA,IAAI,qBAAqB,YAAY,KAAmC,CAAC,GAAG;AAAA,IAC1E,IAAI,MAAM,cAAc,WAAW;AAAA,MACjC,MAAM,YACJ,UAAU,SAAS,MAAM,wBAAwB,MAAM,uCACzD;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EAEA,gBAAgB,MAAM,WAAW,OAAO,WAAW;AAAA;AAGrD,SAAS,eAAe,CACtB,OACA,OACA,aAC4B;AAAA,EAC5B,IAAI,CAAC,SAAS,KAAK,KAAK,OAAO,MAAM,QAAQ,WAAW;AAAA,IACtD,MAAM,YAAY,UAAU,2DAA2D;AAAA,EACzF;AAAA,EAEA,MAAM,MAAM,MAAM,MAAM,MAAM,SAAS,MAAM;AAAA,EAC7C,IAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AAAA,IACvB,MAAM,YAAY,UAAU,sCAAsC;AAAA,EACpE;AAAA,EAEA,WAAW,MAAM,KAAK;AAAA,IACpB,qBAAqB,IAAI,GAAG,4BAA4B,WAAW;AAAA,EACrE;AAAA;AAGK,SAAS,oBAAoB,CAClC,OACA,cAAmC,CAAC,YAAY,IAAI,yBAAwB,OAAO,GAClD;AAAA,EACjC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,YAAY,2CAA2C;AAAA,EAC/D;AAAA,EAEA,IAAI,MAAM,SAAS,QAAQ;AAAA,IACzB,MAAM,YAAY,6CAA6C;AAAA,EACjE;AAAA,EAEA,qBAAqB,MAAM,IAAI,WAAW,WAAW;AAAA,EACrD,qBAAqB,MAAM,OAAO,SAAS,MAAM,aAAa,WAAW;AAAA,EACzE,qBAAqB,MAAM,aAAa,SAAS,MAAM,mBAAmB,WAAW;AAAA,EACrF,kBAAkB,MAAM,mBAAmB,SAAS,MAAM,iBAAiB,WAAW;AAAA,EAEtF,IAAI,CAAC,MAAM,QAAQ,MAAM,MAAM,GAAG;AAAA,IAChC,MAAM,YAAY,gBAAgB,MAAM,8BAA8B;AAAA,EACxE;AAAA,EAEA,WAAW,SAAS,MAAM,QAAQ;AAAA,IAChC,sBAAsB,OAAO,SAAS,MAAM,cAAc,WAAW;AAAA,EACvE;AAAA,EAEA,IAAI,MAAM,eAAe,WAAW;AAAA,IAClC,kBAAkB,MAAM,YAAY,SAAS,MAAM,kBAAkB,WAAW;AAAA,EAClF;AAAA;AAGK,SAAS,gBAAgB,CAAC,OAAyC;AAAA,EACxE,IAAI;AAAA,IACF,qBAAqB,OAAO,CAAC,YAAY,IAAI,MAAM,OAAO,CAAC;AAAA,IAC3D,OAAO;AAAA,IACP,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIJ,SAAS,oCAAoC,CAAC,OAuBnB;AAAA,EAChC,MAAM,eAAe,IAAI;AAAA,EACzB,MAAM,aAAa,IAAI;AAAA,EACvB,MAAM,YAAY,IAAI;AAAA,EACtB,MAAM,yBAAyB,IAAI;AAAA,EAEnC,WAAW,WAAW,MAAM,YAAY,CAAC,GAAG;AAAA,IAC1C,wBAAwB,OAAO;AAAA,IAE/B,IAAI,aAAa,IAAI,QAAQ,EAAE,GAAG;AAAA,MAChC,MAAM,IAAI,yBAAwB,gCAAgC,QAAQ,IAAI;AAAA,IAChF;AAAA,IAEA,aAAa,IAAI,QAAQ,IAAI,OAAO;AAAA,EACtC;AAAA,EAEA,WAAW,SAAS,MAAM,QAAQ;AAAA,IAChC,sBAAsB,KAAK;AAAA,IAE3B,IAAI,WAAW,IAAI,MAAM,EAAE,GAAG;AAAA,MAC5B,MAAM,IAAI,yBAAwB,8BAA8B,MAAM,IAAI;AAAA,IAC5E;AAAA,IAEA,WAAW,IAAI,MAAM,IAAI,KAAK;AAAA,EAChC;AAAA,EAEA,WAAW,QAAQ,MAAM,SAAS,CAAC,GAAG;AAAA,IACpC,qBAAqB,IAAI;AAAA,IAEzB,IAAI,UAAU,IAAI,KAAK,EAAE,GAAG;AAAA,MAC1B,MAAM,IAAI,yBAAwB,6BAA6B,KAAK,IAAI;AAAA,IAC1E;AAAA,IAEA,IAAI,KAAK,kBAAkB,WAAW,GAAG;AAAA,MACvC,MAAM,IAAI,yBACR,gBAAgB,KAAK,4CACvB;AAAA,IACF;AAAA,IAEA,MAAM,aAAa,KAAK,cAAc,CAAC;AAAA,IACvC,IAAI,KAAK,OAAO,WAAW,KAAK,WAAW,WAAW,GAAG;AAAA,MACvD,MAAM,IAAI,yBACR,gBAAgB,KAAK,mDACvB;AAAA,IACF;AAAA,IAEA,qBAAqB,KAAK,mBAAmB,SAAS,KAAK,eAAe;AAAA,IAC1E,qBAAqB,YAAY,SAAS,KAAK,gBAAgB;AAAA,IAE/D,WAAW,aAAa,YAAY;AAAA,MAClC,IAAI,CAAC,aAAa,IAAI,SAAS,GAAG;AAAA,QAChC,MAAM,IAAI,yBACR,gBAAgB,KAAK,6CAA6C,oFACpE;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,WAAW,KAAK,mBAAmB;AAAA,MAC5C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,gBAAgB,KAAK,2CAA2C,8EAClE;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,SAAS,KAAK,QAAQ;AAAA,MAC/B,sBAAsB,KAAK,IAAI,OAAO,KAAK;AAAA,IAC7C;AAAA,IAEA,UAAU,IAAI,KAAK,IAAI,IAAI;AAAA,EAC7B;AAAA,EAEA,WAAW,UAAU,MAAM,oBAAoB;AAAA,IAC7C,iCAAiC,MAAM;AAAA,IAEvC,IAAI,uBAAuB,IAAI,OAAO,EAAE,GAAG;AAAA,MACzC,MAAM,IAAI,yBAAwB,0CAA0C,OAAO,IAAI;AAAA,IACzF;AAAA,IAEA,IAAI,OAAO,kBAAkB,WAAW,GAAG;AAAA,MACzC,MAAM,IAAI,yBACR,6BAA6B,OAAO,4DACtC;AAAA,IACF;AAAA,IAEA,IAAI,OAAO,IAAI,WAAW,GAAG;AAAA,MAC3B,MAAM,IAAI,yBACR,6BAA6B,OAAO,0CACtC;AAAA,IACF;AAAA,IAEA,qBAAqB,OAAO,mBAAmB,sBAAsB,OAAO,eAAe;AAAA,IAC3F,qBAAqB,OAAO,eAAe,sBAAsB,OAAO,WAAW;AAAA,IACnF,4BAA4B,OAAO,KAAK,sBAAsB,OAAO,SAAS;AAAA,IAE9E,WAAW,WAAW,OAAO,mBAAmB;AAAA,MAC9C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,6BAA6B,OAAO,2CAA2C,8EACjF;AAAA,MACF;AAAA,IACF;AAAA,IAEA,WAAW,WAAW,OAAO,eAAe;AAAA,MAC1C,IAAI,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,QAC5B,MAAM,IAAI,yBACR,6BAA6B,OAAO,uCAAuC,8EAC7E;AAAA,MACF;AAAA,IACF;AAAA,IAEA,uBAAuB,IAAI,OAAO,IAAI,MAAM;AAAA,EAC9C;AAAA,EAEA,OAAO;AAAA,IACL,UAAU,CAAC,GAAG,aAAa,OAAO,CAAC;AAAA,IACnC;AAAA,IACA,QAAQ,CAAC,GAAG,WAAW,OAAO,CAAC;AAAA,IAC/B;AAAA,IACA,OAAO,CAAC,GAAG,UAAU,OAAO,CAAC;AAAA,IAC7B;AAAA,IACA,oBAAoB,CAAC,GAAG,uBAAuB,OAAO,CAAC;AAAA,IACvD;AAAA,EACF;AAAA;AAGF,SAAS,qBAAqB,CAC5B,QACA,OACA,YACM;AAAA,EACN,IAAI,MAAM,eAAe,SAAS,MAAM,WAAW,SAAS;AAAA,IAC1D,MAAM,OAAO,YAAY,YAAY,KAAK;AAAA,IAC1C,IAAI,CAAC,WAAW,gBAAgB;AAAA,MAC9B,MAAM,IAAI,yBACR,gBAAgB,kBAAkB,MAAM,2DAA2D,KAAK,KAC1G;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAAA,EAGA,IAAI,EAAE,eAAe;AAAA,IAAQ;AAAA,EAC7B,MAAM,OAAO,YAAY,KAAK;AAAA,EAC9B,IAAI,qBAAqB,IAAI;AAAA,IAAG;AAAA,EAChC,MAAM,OAAO,YAAY;AAAA,EACzB,MAAM,WAAW,WAAW,KAAK;AAAA,EAEjC,IAAI,CAAC,UAAU;AAAA,IACb;AAAA,EACF;AAAA,EAKA,MAAM,MAAM,MAAM,UAAU,MAAM,MAAM,UAAU,SAAS,MAAM,UAAU;AAAA,EAE3E,WAAW,MAAM,KAAK;AAAA,IACpB,IAAI,CAAC,SAAS,IAAI,EAAE,GAAG;AAAA,MACrB,MAAM,IAAI,yBACR,gBAAgB,kBAAkB,MAAM,yBAAyB,KAAK,YAAY,QAAQ,KAAK,KACjG;AAAA,IACF;AAAA,EACF;AAAA;;;ACpfF,IAAM,yBAAwB,IAAI,IAAyB;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,mBAAsB,CAAC,OAAqB,OAAqB;AAAA,EACxE,IAAI,MAAM,WAAW,GAAG;AAAA,IACtB,MAAM,IAAI,yBAAwB,UAAU,0BAA0B;AAAA,EACxE;AAAA;AAGF,SAAS,YAAY,CAAC,QAAoC,OAAkC;AAAA,EAC1F,OAAO,OAAO,IAAI,CAAC,UAAU;AAAA,IAC3B,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,SAAS;AAAA,MAC9C,MAAM,IAAI,yBAAwB,UAAU,4CAA4C;AAAA,IAC1F;AAAA,IAEA,qBAAqB,MAAM,IAAI,GAAG,gBAAgB;AAAA,IAClD,OAAO,MAAM;AAAA,GACd;AAAA;AAGH,SAAS,wBAAwB,CAC/B,YACA,OACgC;AAAA,EAChC,OAAO,WAAW,IAAI,CAAC,cAAc;AAAA,IACnC,IAAI,CAAC,uBAAsB,IAAI,SAAS,GAAG;AAAA,MACzC,MAAM,IAAI,yBACR,UAAU,gGACZ;AAAA,IACF;AAAA,IAEA,OAAO;AAAA,GACR;AAAA;AAGI,SAAS,YAAqC,CACnD,IACA,UAA8B,CAAC,GACT;AAAA,EACtB,qBAAqB,IAAI,UAAU;AAAA,EACnC,qBAAqB,QAAQ,OAAO,UAAU,WAAW;AAAA,EACzD,qBAAqB,QAAQ,aAAa,UAAU,iBAAiB;AAAA,EAErE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EAClF;AAAA;AAIK,SAAS,cAAc,CAC5B,UACA,OACmB;AAAA,EACnB,OAAO,SAAS,IAAI,CAAC,YAAY;AAAA,IAC/B,IAAI,CAAC,SAAS,OAAO,KAAK,QAAQ,SAAS,WAAW;AAAA,MACpD,MAAM,IAAI,yBAAwB,UAAU,8CAA8C;AAAA,IAC5F;AAAA,IAEA,qBAAqB,QAAQ,IAAI,GAAG,kBAAkB;AAAA,IACtD,OAAO,QAAQ;AAAA,GAChB;AAAA;AAGI,SAAS,cAAuC,CACrD,IACA,UAAgC,CAAC,GACT;AAAA,EACxB,qBAAqB,IAAI,YAAY;AAAA,EACrC,qBAAqB,QAAQ,OAAO,YAAY,WAAW;AAAA,EAC3D,qBAAqB,QAAQ,aAAa,YAAY,iBAAiB;AAAA,EAEvE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,EAClF;AAAA;AAGK,SAAS,WAAoC,CAClD,IACA,SACqB;AAAA,EACrB,qBAAqB,IAAI,SAAS;AAAA,EAClC,qBAAqB,QAAQ,OAAO,SAAS,WAAW;AAAA,EACxD,qBAAqB,QAAQ,aAAa,SAAS,iBAAiB;AAAA,EACpE,oBAAoB,QAAQ,WAAW,SAAS,eAAe;AAAA,EAE/D,MAAM,oBAAoB,aAAa,QAAQ,WAAW,SAAS,eAAe;AAAA,EAClF,MAAM,SAAS,QAAQ,UAAU,CAAC;AAAA,EAClC,MAAM,aAAa,eAAe,QAAQ,cAAc,CAAC,GAAG,SAAS,gBAAgB;AAAA,EAErF,WAAW,SAAS,QAAQ;AAAA,IAC1B,sBAAsB,OAAO,SAAS,YAAY;AAAA,EACpD;AAAA,EAEA,IAAI,OAAO,WAAW,KAAK,WAAW,WAAW,GAAG;AAAA,IAClD,MAAM,IAAI,yBACR,gBAAgB,mDAClB;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,OACI,QAAQ,UAAU,YAAY,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,OAC1D,QAAQ,gBAAgB,YAAY,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,IAChF;AAAA,IACA;AAAA,OACI,WAAW,SAAS,IAAI,EAAE,WAAW,IAAI,CAAC;AAAA,EAChD;AAAA;AAGK,SAAS,uBAAgD,CAC9D,IACA,SACiC;AAAA,EACjC,qBAAqB,IAAI,sBAAsB;AAAA,EAC/C,oBAAoB,QAAQ,WAAW,sBAAsB,eAAe;AAAA,EAC5E,oBAAoB,QAAQ,KAAK,sBAAsB,SAAS;AAAA,EAEhE,OAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,mBAAmB,aAAa,QAAQ,WAAW,sBAAsB,eAAe;AAAA,IACxF,eAAe,aAAa,QAAQ,OAAO,sBAAsB,WAAW;AAAA,IAC5E,KAAK,yBAAyB,QAAQ,KAAK,sBAAsB,SAAS;AAAA,EAC5E;AAAA;",
+  "debugId": "880112CC989BBA4664756E2164756E21",
+  "names": []
+}