@sixb/core 0.1.20 → 0.1.22

package/dist/chunk-7z5p905k.js.map

@@ -0,0 +1,22 @@
+{
+  "version": 3,
+  "sources": ["../src/assert-never.ts", "../src/objects/clearance-redaction.ts", "../src/objects/query/clearance-admission.ts", "../src/objects/query/link-query-clearance.ts", "../src/objects/telemetry/workload.ts", "../src/objects/authorized-ontology-view.ts", "../src/execution/object-reader-ontology.ts", "../src/objects/query/selected-read-admission.ts", "../src/execution/object-reader-clearance.ts", "../src/execution/object-reader-security.ts", "../src/execution/object-reader-users.ts", "../src/execution/unique-lookup.ts", "../src/execution/authorized-object-reader.ts"],
+  "sourcesContent": [
+    "/**\n * Closes a switch over a union: the call stops compiling when a new member has no case, and throws\n * if an untyped value reaches it at runtime.\n */\nexport function assertNever(_value: never, message: string): never {\n  throw new Error(message)\n}\n",
+    "import type { StoredDomainEvent } from \"../events/types\"\nimport type { ExpandedLinkValue, ExpandedObjectRow, ObjectRow } from \"../storage\"\nimport type { PropertyClearance } from \"./property-clearance\"\n\n/**\n * Omit unreadable properties from a row and the objects expanded under it, and list them in\n * `redactions`. The row is not modified: what changes is copied, the rest is shared.\n */\nexport function redactObjectRow<TRow extends ObjectRow>(\n  row: TRow,\n  clearance: PropertyClearance\n): TRow {\n  return redactRow(row, clearance, true)\n}\n\n/**\n * {@link redactObjectRow} without the `redactions` records, for rows about to be deep-copied.\n *\n * Omitting hidden values before the copy keeps them out of it and copies each row once. The copy\n * then receives its records from {@link attachRedactions}: they are frozen and owned by the\n * clearance, so they are shared rather than copied with each row.\n */\nexport function omitHiddenProperties<TRow extends ObjectRow>(\n  row: TRow,\n  clearance: PropertyClearance\n): TRow {\n  return redactRow(row, clearance, false)\n}\n\n/**\n * Set `redactions` on a row returned by {@link omitHiddenProperties} and since deep-copied, and on\n * the objects expanded under it. It modifies the row, so it only accepts the caller's own copy.\n */\nexport function attachRedactions(row: ObjectRow, clearance: PropertyClearance): void {\n  const hidden = clearance.hiddenProperties(row.objectTypeId)\n  if (hidden !== undefined) row.redactions = hidden.redactions\n\n  if (row.links === undefined) return\n\n  for (const value of Object.values(row.links)) {\n    if (value === null) continue\n    if (Array.isArray(value)) {\n      for (const linked of value) attachRedactions(linked, clearance)\n    } else {\n      attachRedactions(value as ExpandedObjectRow, clearance)\n    }\n  }\n}\n\nfunction redactRow<TRow extends ObjectRow>(\n  row: TRow,\n  clearance: PropertyClearance,\n  withRedactions: boolean\n): TRow {\n  const hidden = clearance.hiddenProperties(row.objectTypeId)\n  const links = row.links\n  if (hidden === undefined && links === undefined) return row\n\n  const redacted: TRow = { ...row }\n  if (hidden !== undefined) {\n    redacted.properties = withoutKeys(row.properties, hidden.ids)\n    if (withRedactions) redacted.redactions = hidden.redactions\n  }\n\n  if (links !== undefined) {\n    redacted.links = Object.fromEntries(\n      Object.entries(links).map(([linkId, value]) => [\n        linkId,\n        redactLinkValue(value, clearance, withRedactions),\n      ])\n    )\n  }\n  return redacted\n}\n\nfunction redactLinkValue(\n  value: ExpandedLinkValue,\n  clearance: PropertyClearance,\n  withRedactions: boolean\n): ExpandedLinkValue {\n  if (value === null) return null\n  if (Array.isArray(value)) {\n    return value.map((row) => redactRow(row, clearance, withRedactions))\n  }\n\n  // Array.isArray does not narrow a readonly[] away, so assert the single-object case.\n  return redactRow(value as ExpandedObjectRow, clearance, withRedactions)\n}\n\n/**\n * Omit unreadable properties from an object event, under the same contract as rows. Other events\n * carry no markable value: link properties and telemetry properties cannot be marked.\n */\nexport function redactDomainEvent(\n  event: StoredDomainEvent,\n  clearance: PropertyClearance\n): StoredDomainEvent {\n  if (event.topic !== \"objects\") return event\n\n  const hidden = clearance.hiddenProperties(event.payload.objectTypeId)\n  if (hidden === undefined) return event\n\n  if (event.type === \"object.deleted\") {\n    return {\n      ...event,\n      payload: {\n        ...event.payload,\n        propertyChanges: withoutKeys(event.payload.propertyChanges, hidden.ids),\n        redactions: hidden.redactions,\n      },\n    }\n  }\n\n  return {\n    ...event,\n    payload: {\n      ...event.payload,\n      properties: withoutKeys(event.payload.properties, hidden.ids),\n      propertyChanges: withoutKeys(event.payload.propertyChanges, hidden.ids),\n      redactions: hidden.redactions,\n    },\n  }\n}\n\n/**\n * A copy of the record's own properties without the hidden keys.\n *\n * Spreading the record and deleting the few hidden keys is several times faster than assigning\n * each kept key, and the spread defines every key as an own property, even `__proto__`.\n */\nfunction withoutKeys<TValue>(\n  record: Readonly<Record<string, TValue>>,\n  hidden: ReadonlySet<string>\n): Record<string, TValue> {\n  const kept: Record<string, TValue> = { ...record }\n  for (const key of hidden) delete kept[key]\n  return kept\n}\n",
+    "import { AuthorizationError } from \"../../authorization/errors\"\nimport { type PropertyClearance, type Unreadable, unreadableError } from \"../property-clearance\"\nimport type {\n  ObjectQueryAdmissionState,\n  ObjectQueryPropertyUse,\n  ObjectQuerySemanticAdmission,\n} from \"./validate\"\n\n/**\n * Reject every query use of a property the reader cannot read, except projection.\n *\n * Filtering, ordering, searching, or faceting by a hidden value would reveal it through which\n * objects match and in what order. Projection only shapes the output, which is redacted anyway.\n */\nexport function createClearanceQueryAdmission(\n  clearance: PropertyClearance\n): ObjectQuerySemanticAdmission {\n  // Each state stands for the object types a query has reached so far. A property without an\n  // explicit type is checked against all of them.\n  const reachedTypes = new WeakMap<ObjectQueryAdmissionState, readonly string[]>()\n  const state = (objectTypeIds: readonly string[]): ObjectQueryAdmissionState => {\n    const created = Object.freeze({})\n    reachedTypes.set(created, Object.freeze([...objectTypeIds]))\n    return created\n  }\n\n  const reached = (input: ObjectQueryAdmissionState): readonly string[] => {\n    const objectTypeIds = reachedTypes.get(input)\n    if (!objectTypeIds) {\n      throw new Error(\"[Sixb] Clearance query admission received a state it did not create.\")\n    }\n    return objectTypeIds\n  }\n\n  const empty = state([])\n\n  const admission: ObjectQuerySemanticAdmission = {\n    empty: () => empty,\n    // An object type or link the reader cannot read is denied like one it has no view grant for.\n    source: (input) => ({\n      state: state(input.result.objectTypeIds),\n      ...denied(unreadableTypeAmong(clearance, input.result.objectTypeIds)),\n    }),\n    edge: (input) => {\n      // A link is keyed by its source type: the reached types going out, the result coming in.\n      const sourceTypeIds =\n        input.direction === \"outgoing\"\n          ? reached(input.state)\n          : [\n              ...input.result.objectTypeIds,\n              ...(input.sourceObjectTypeId ? [input.sourceObjectTypeId] : []),\n            ]\n\n      const link = sourceTypeIds\n        .map((objectTypeId) => clearance.unreadableLink(objectTypeId, input.linkId))\n        .find((unreadable) => unreadable !== undefined)\n\n      return {\n        state: state(input.result.objectTypeIds),\n        ...denied(link ?? unreadableTypeAmong(clearance, input.result.objectTypeIds)),\n      }\n    },\n    // A difference only returns objects of its first input.\n    set: (input) =>\n      input.op === \"subtract\"\n        ? (input.states[0] ?? empty)\n        : state([...new Set(input.states.flatMap(reached))]),\n    property: (input) => {\n      if (input.use === \"project\") return undefined\n\n      const objectTypeIds =\n        input.objectTypeId === undefined ? reached(input.state) : [input.objectTypeId]\n      for (const objectTypeId of objectTypeIds) {\n        const marking = clearance.missingMarking(objectTypeId, input.propertyId)\n        if (marking === undefined) continue\n        return new AuthorizationError(\n          `clearance:marking:${marking}`,\n          `[Sixb] Cannot ${PROPERTY_USE_VERBS[input.use]} '${objectTypeId}.${input.propertyId}' at '${input.path}': it requires clearance for marking '${marking}'.`\n        )\n      }\n\n      return undefined\n    },\n  }\n\n  return Object.freeze(admission)\n}\n\nfunction unreadableTypeAmong(\n  clearance: PropertyClearance,\n  objectTypeIds: readonly string[]\n): Unreadable | undefined {\n  for (const objectTypeId of objectTypeIds) {\n    const unreadable = clearance.unreadableType(objectTypeId)\n    if (unreadable) return unreadable\n  }\n  return undefined\n}\n\nfunction denied(unreadable: Unreadable | undefined): { readonly denial?: Error } {\n  return unreadable ? { denial: unreadableError(unreadable) } : {}\n}\n\nconst PROPERTY_USE_VERBS: Readonly<Record<ObjectQueryPropertyUse, string>> = {\n  filter: \"filter by\",\n  text: \"search\",\n  vector: \"run a vector search over\",\n  sort: \"sort by\",\n  project: \"project\",\n  \"expand.orderBy\": \"order expanded objects by\",\n  facet: \"facet by\",\n}\n",
+    "import type { OntologyRegistry } from \"../../ontology\"\nimport { type PropertyClearance, unreadableError } from \"../property-clearance\"\nimport type { ObjectQuery } from \"./ir\"\nimport { type ExecuteObjectQueryLinksInput, preflightObjectQueryLinks } from \"./links\"\n\n/**\n * Refuse a link query that could return a link, or an endpoint, the reader cannot read.\n *\n * A link query returns every link incident to the objects it selects, a page at a time. The page\n * cannot be filtered afterward without breaking its cursor, so what the reader cannot read is\n * refused before the page is read, from the definitions: a link that is unreadable, or that leads\n * to an unreadable object type, whether or not such a link exists.\n */\nexport function assertLinkQueryReadable(input: {\n  readonly ontology: OntologyRegistry\n  readonly clearance: PropertyClearance\n  readonly query: ObjectQuery\n  readonly request: Omit<ExecuteObjectQueryLinksInput, \"query\">\n  /** Whether grants alone let the reader view the type: storage already leaves out the others. */\n  readonly viewableByGrants: (objectTypeId: string) => boolean\n}): void {\n  const { ontology, clearance } = input\n  const { types, links } = clearance.unreadable()\n  if (types.size === 0 && links.length === 0) return\n\n  const preflight = preflightObjectQueryLinks(\n    { ...input.request, query: input.query },\n    { ontology }\n  )\n\n  const selected = preflight.validated.result.objectTypeIds\n  const outgoing = preflight.direction !== \"incoming\"\n  const incoming = preflight.direction !== \"outgoing\"\n\n  const named = (linkId: string) => preflight.linkId === undefined || preflight.linkId === linkId\n  const targets = (expected: string | readonly string[], objectTypeId: string) =>\n    (typeof expected === \"string\" ? [expected] : expected).some((target) =>\n      ontology.isValidLinkTarget(target, objectTypeId)\n    )\n\n  for (const link of links) {\n    if (!named(link.linkId)) continue\n    if (\n      (outgoing && selected.includes(link.objectTypeId)) ||\n      (incoming && selected.some((id) => targets(link.targetObjectTypeId, id)))\n    ) {\n      throw unreadableError(link)\n    }\n  }\n\n  const sealed = [...types].filter(([id]) => input.viewableByGrants(id))\n  if (sealed.length === 0) return\n\n  for (const objectType of ontology.listObjectTypes()) {\n    for (const link of objectType.links) {\n      if (!named(link.id)) continue\n      if (outgoing && selected.includes(objectType.id)) {\n        const other = sealed.find(([id]) => targets(link.targetObjectTypeId, id))\n        if (other) throw unreadableError(other[1])\n      }\n\n      const source = types.get(objectType.id)\n      if (\n        incoming &&\n        source &&\n        input.viewableByGrants(objectType.id) &&\n        selected.some((id) => targets(link.targetObjectTypeId, id))\n      ) {\n        throw unreadableError(source)\n      }\n    }\n  }\n}\n",
+    "const MAX_DELEGATED_TELEMETRY_HISTORY_SERIES = 100\nconst MAX_DELEGATED_TELEMETRY_HISTORY_POINTS = 10_000\nconst DEFAULT_DELEGATED_TELEMETRY_HISTORY_LIMIT_PER_SERIES = 100\n\nexport interface TelemetryHistoryReadWorkloadInput {\n  readonly seriesCount: number\n  readonly limitPerSeries?: number\n}\n\nexport interface TelemetryHistoryReadAdmission {\n  readonly limitPerSeries?: number\n  readonly maxPointOccurrences?: number\n}\n\ntype TelemetryHistoryWorkloadMetric = \"series\" | \"points\"\n\nclass TelemetryHistoryWorkloadExceededError extends Error {\n  readonly name = \"TelemetryHistoryWorkloadExceededError\"\n  readonly code = \"telemetry_history_workload_exceeded\"\n\n  constructor(\n    readonly metric: TelemetryHistoryWorkloadMetric,\n    readonly limit: number\n  ) {\n    super(`[Sixb] Delegated telemetry history exceeded its ${metric} limit (${limit}).`)\n  }\n}\n\n/** Resolve one history request without exposing the authority that selected its policy. */\nexport function admitTelemetryHistoryReadWorkload(\n  input: TelemetryHistoryReadWorkloadInput,\n  delegated: boolean\n): TelemetryHistoryReadAdmission {\n  const seriesCount = input.seriesCount\n  const limitPerSeries = input.limitPerSeries\n  if (!Number.isSafeInteger(seriesCount) || seriesCount < 0) {\n    throw new Error(\"[Sixb] Telemetry history series must have a non-negative safe integer length.\")\n  }\n  if (\n    limitPerSeries !== undefined &&\n    (!Number.isSafeInteger(limitPerSeries) || limitPerSeries < 0)\n  ) {\n    throw new Error(\"[Sixb] Telemetry history limit must be a non-negative safe integer.\")\n  }\n\n  if (!delegated) {\n    const admission: TelemetryHistoryReadAdmission =\n      limitPerSeries === undefined ? {} : { limitPerSeries }\n    return Object.freeze(admission)\n  }\n  if (seriesCount > MAX_DELEGATED_TELEMETRY_HISTORY_SERIES) {\n    throw new TelemetryHistoryWorkloadExceededError(\n      \"series\",\n      MAX_DELEGATED_TELEMETRY_HISTORY_SERIES\n    )\n  }\n  if (seriesCount === 0) {\n    return Object.freeze({\n      ...(limitPerSeries === undefined ? {} : { limitPerSeries }),\n      maxPointOccurrences: MAX_DELEGATED_TELEMETRY_HISTORY_POINTS,\n    })\n  }\n\n  const maxLimitPerSeries = Math.floor(MAX_DELEGATED_TELEMETRY_HISTORY_POINTS / seriesCount)\n  const effectiveLimitPerSeries =\n    limitPerSeries ??\n    Math.min(DEFAULT_DELEGATED_TELEMETRY_HISTORY_LIMIT_PER_SERIES, maxLimitPerSeries)\n  if (effectiveLimitPerSeries > maxLimitPerSeries) {\n    throw new TelemetryHistoryWorkloadExceededError(\n      \"points\",\n      MAX_DELEGATED_TELEMETRY_HISTORY_POINTS\n    )\n  }\n\n  return Object.freeze({\n    limitPerSeries: effectiveLimitPerSeries,\n    maxPointOccurrences: MAX_DELEGATED_TELEMETRY_HISTORY_POINTS,\n  })\n}\n",
+    "import {\n  formatUnknownObjectTypeMessage,\n  OntologyNotFoundError,\n  OntologyValidationError,\n} from \"../ontology/errors\"\nimport type { OntologyDefinitionCatalog } from \"../ontology/registry\"\nimport type { ObjectTypeWithPropertyTokens } from \"../ontology/tokens\"\nimport { createLinkTokenMap, createPropertyTokenMap } from \"../ontology/tokens\"\nimport type {\n  ObjectLink,\n  ObjectType,\n  ObjectTypeSearchMetadata,\n  Property,\n  PropertyQueryMetadata,\n  Schema,\n  ValueType,\n} from \"../ontology/types\"\nimport { snapshotVectorProfiles } from \"../ontology/vector-profiles\"\nimport type { CompiledSelectedObjectReadScope } from \"../storage/objects/types\"\n\n/** Public ontology operations that may cross an execution-bound authorization boundary. */\nexport type AuthorizedOntologyView = Pick<\n  OntologyDefinitionCatalog,\n  | \"listObjectTypes\"\n  | \"getObjectTypeById\"\n  | \"resolveObjectType\"\n  | \"getValueTypesById\"\n  | \"getPrimaryPropertyId\"\n  | \"listSubTypes\"\n  | \"isValidLinkTarget\"\n>\n\nexport type AuthorizedOntologySelection =\n  | { readonly kind: \"all\" }\n  | { readonly kind: \"types\"; readonly objectTypeIds: readonly string[] }\n  | { readonly kind: \"selected\"; readonly scope: CompiledSelectedObjectReadScope }\n\ninterface LinkSelection {\n  readonly targetObjectTypeIds: Set<string>\n  readonly propertyIds: Set<string>\n}\n\ninterface SelectedSchema {\n  readonly propertyIdsByObjectType: ReadonlyMap<string, ReadonlySet<string>>\n  readonly linksBySourceType: ReadonlyMap<string, ReadonlyMap<string, LinkSelection>>\n}\n\n/**\n * Project inert ontology metadata from one already-captured authority.\n *\n * Query validation intentionally keeps using the complete internal registry. This view is only\n * the discovery surface returned to application code and HTTP serializers.\n */\nexport function createAuthorizedOntologyView(input: {\n  readonly ontology: OntologyDefinitionCatalog\n  readonly selection: AuthorizedOntologySelection\n  readonly assertOutputWithinLimit?: (value: unknown) => void\n}): AuthorizedOntologyView {\n  const allObjectTypes = input.ontology.listObjectTypes()\n  const registeredObjectTypeIds = new Set(allObjectTypes.map((objectType) => objectType.id))\n  const requestedObjectTypeIds = selectedObjectTypeIds(input.selection, allObjectTypes)\n  const visibleObjectTypeIds = new Set(\n    [...requestedObjectTypeIds].filter((objectTypeId) => registeredObjectTypeIds.has(objectTypeId))\n  )\n  const selectedSchema =\n    input.selection.kind === \"selected\" ? collectSelectedSchema(input.selection.scope) : undefined\n  const projectedObjectTypes: ObjectTypeWithPropertyTokens[] = []\n\n  for (const objectType of allObjectTypes) {\n    if (!visibleObjectTypeIds.has(objectType.id)) continue\n    const propertyIds =\n      selectedSchema?.propertyIdsByObjectType.get(objectType.id) ??\n      new Set(objectType.properties.map((property) => property.id))\n    const links = selectedSchema\n      ? (selectedSchema.linksBySourceType.get(objectType.id) ?? new Map())\n      : input.selection.kind === \"all\"\n        ? allDeclaredLinks(objectType)\n        : allVisibleLinks(input.ontology, objectType, visibleObjectTypeIds)\n    projectedObjectTypes.push(\n      projectObjectType({\n        objectType,\n        propertyIds,\n        links,\n        visibleObjectTypeIds,\n        ontology: input.ontology,\n        targetMode:\n          input.selection.kind === \"all\"\n            ? \"original\"\n            : input.selection.kind === \"types\"\n              ? \"principal\"\n              : \"exact\",\n        exposeContracts: input.selection.kind !== \"selected\",\n      })\n    )\n  }\n\n  const objectTypes = projectedObjectTypes\n  const objectTypesById = new Map(objectTypes.map((objectType) => [objectType.id, objectType]))\n  const valueTypesById =\n    input.selection.kind === \"selected\"\n      ? collectVisibleValueTypes(input.ontology.getValueTypesById(), objectTypes)\n      : snapshotAllValueTypes(input.ontology.getValueTypesById())\n  const release = <T>(value: T, budgetValue: unknown = value): T => {\n    input.assertOutputWithinLimit?.(budgetValue)\n    return value\n  }\n  const cloneObjectType = (objectType: ObjectTypeWithPropertyTokens) => structuredClone(objectType)\n  const cloneValueTypes = () =>\n    new Map(\n      [...valueTypesById].map(([valueTypeId, valueType]) => [\n        valueTypeId,\n        structuredClone(valueType),\n      ])\n    )\n\n  return Object.freeze({\n    listObjectTypes: () => release(objectTypes.map(cloneObjectType)),\n    getObjectTypeById: (objectTypeId: string) => {\n      const objectType = objectTypesById.get(objectTypeId)\n      return release(objectType ? cloneObjectType(objectType) : null)\n    },\n    resolveObjectType: (objectTypeId: string) => {\n      const objectType = objectTypesById.get(objectTypeId)\n      return objectType ? release(cloneObjectType(objectType)) : unknownObjectType(objectTypeId)\n    },\n    getValueTypesById: () => {\n      const valueTypes = cloneValueTypes()\n      return release(valueTypes, [...valueTypes.entries()])\n    },\n    getPrimaryPropertyId: (objectTypeId: string) => {\n      const objectType = objectTypesById.get(objectTypeId)\n      if (!objectType) return unknownObjectType(objectTypeId)\n      const primary = objectType.properties.find((property) => property.primary)\n      if (!primary) {\n        throw new OntologyValidationError(\n          `[Sixb] Object type '${objectTypeId}' does not expose its primary property in this execution scope.`\n        )\n      }\n      return release(primary.id)\n    },\n    listSubTypes: (objectTypeId: string) => {\n      const subTypes = visibleObjectTypeIds.has(objectTypeId)\n        ? input.ontology\n            .listSubTypes(objectTypeId)\n            .filter((subTypeId) => visibleObjectTypeIds.has(subTypeId))\n        : []\n      return release(subTypes)\n    },\n    isValidLinkTarget: (expected: string | string[], actual: string) => {\n      if (input.selection.kind === \"all\") {\n        return release(input.ontology.isValidLinkTarget(expected, actual))\n      }\n      if (!visibleObjectTypeIds.has(actual)) return release(false)\n      const expectedTypes = Array.isArray(expected) ? expected : [expected]\n      if (input.selection.kind === \"selected\") {\n        return release(\n          expectedTypes.some((expectedType) => expectedType === \"*\" || expectedType === actual)\n        )\n      }\n      return release(\n        expectedTypes.some(\n          (expectedType) =>\n            expectedType === \"*\" ||\n            (visibleObjectTypeIds.has(expectedType) &&\n              input.ontology.isValidLinkTarget(expectedType, actual))\n        )\n      )\n    },\n  })\n}\n\nfunction selectedObjectTypeIds(\n  selection: AuthorizedOntologySelection,\n  allObjectTypes: readonly ObjectTypeWithPropertyTokens[]\n): ReadonlySet<string> {\n  switch (selection.kind) {\n    case \"all\":\n      return new Set(allObjectTypes.map((objectType) => objectType.id))\n    case \"types\":\n      return new Set(selection.objectTypeIds)\n    case \"selected\":\n      return new Set(selection.scope.objects.map((object) => object.objectTypeId))\n  }\n}\n\nfunction collectSelectedSchema(scope: CompiledSelectedObjectReadScope): SelectedSchema {\n  const propertyIdsByObjectType = new Map<string, Set<string>>()\n  for (const object of scope.objects) {\n    const properties = propertyIdsByObjectType.get(object.objectTypeId) ?? new Set<string>()\n    for (const propertyId of object.propertyIds) properties.add(propertyId)\n    propertyIdsByObjectType.set(object.objectTypeId, properties)\n  }\n\n  const linksBySourceType = new Map<string, Map<string, LinkSelection>>()\n  for (const step of scope.steps) {\n    const links = linksBySourceType.get(step.sourceObjectTypeId) ?? new Map()\n    const selected = links.get(step.linkId) ?? {\n      targetObjectTypeIds: new Set<string>(),\n      propertyIds: new Set<string>(),\n    }\n    selected.targetObjectTypeIds.add(step.targetObjectTypeId)\n    for (const propertyId of step.propertyIds) selected.propertyIds.add(propertyId)\n    links.set(step.linkId, selected)\n    linksBySourceType.set(step.sourceObjectTypeId, links)\n  }\n\n  return { propertyIdsByObjectType, linksBySourceType }\n}\n\nfunction allDeclaredLinks(\n  objectType: ObjectTypeWithPropertyTokens\n): ReadonlyMap<string, LinkSelection> {\n  return new Map(\n    objectType.links.map((link) => [\n      link.id,\n      {\n        targetObjectTypeIds: new Set(\n          typeof link.targetObjectTypeId === \"string\"\n            ? [link.targetObjectTypeId]\n            : link.targetObjectTypeId\n        ),\n        propertyIds: new Set(link.properties?.map((property) => property.id) ?? []),\n      },\n    ])\n  )\n}\n\nfunction allVisibleLinks(\n  ontology: OntologyDefinitionCatalog,\n  objectType: ObjectTypeWithPropertyTokens,\n  visibleObjectTypeIds: ReadonlySet<string>\n): ReadonlyMap<string, LinkSelection> {\n  const links = new Map<string, LinkSelection>()\n  for (const link of objectType.links) {\n    const targetObjectTypeIds = new Set(\n      [...visibleObjectTypeIds].filter((targetObjectTypeId) =>\n        ontology.isValidLinkTarget(link.targetObjectTypeId, targetObjectTypeId)\n      )\n    )\n    if (targetObjectTypeIds.size === 0) continue\n    links.set(link.id, {\n      targetObjectTypeIds,\n      propertyIds: new Set(link.properties?.map((property) => property.id) ?? []),\n    })\n  }\n  return links\n}\n\nfunction projectObjectType(input: {\n  readonly ontology: OntologyDefinitionCatalog\n  readonly objectType: ObjectTypeWithPropertyTokens\n  readonly propertyIds: ReadonlySet<string>\n  readonly links: ReadonlyMap<string, LinkSelection>\n  readonly visibleObjectTypeIds: ReadonlySet<string>\n  readonly targetMode: \"original\" | \"principal\" | \"exact\"\n  readonly exposeContracts: boolean\n}): ObjectTypeWithPropertyTokens {\n  const properties = input.objectType.properties\n    .filter((property) => input.propertyIds.has(property.id))\n    .map(snapshotProperty)\n  const visiblePropertyIds = new Set(properties.map((property) => property.id))\n  const links = input.objectType.links.flatMap((link): ObjectLink[] => {\n    const selected = input.links.get(link.id)\n    if (!selected) return []\n    if (input.targetMode === \"original\") {\n      return [snapshotLink(link, snapshotLinkTarget(link.targetObjectTypeId), selected.propertyIds)]\n    }\n    const targetObjectTypeIds = new Set(\n      [...selected.targetObjectTypeIds].filter(\n        (targetObjectTypeId) =>\n          input.visibleObjectTypeIds.has(targetObjectTypeId) &&\n          input.ontology.isValidLinkTarget(link.targetObjectTypeId, targetObjectTypeId)\n      )\n    )\n    if (targetObjectTypeIds.size === 0) return []\n    const target =\n      input.targetMode === \"principal\"\n        ? principalLinkTargets(link, targetObjectTypeIds, input.visibleObjectTypeIds)\n        : exactLinkTargets(targetObjectTypeIds)\n    return [snapshotLink(link, target, selected.propertyIds, { omitEmptyProperties: true })]\n  })\n\n  // Whitelist top-level metadata so future cross-ontology fields remain closed until reviewed.\n  const projected: ObjectType = {\n    id: input.objectType.id,\n    name: input.objectType.name,\n    description: input.objectType.description,\n    quantityKind: input.objectType.quantityKind,\n    seeAlso: input.objectType.seeAlso ? [...input.objectType.seeAlso] : undefined,\n    extends:\n      input.objectType.extends && input.visibleObjectTypeIds.has(input.objectType.extends)\n        ? input.objectType.extends\n        : undefined,\n    parents: projectOptionalIds(\n      input.objectType.parents,\n      input.visibleObjectTypeIds,\n      input.targetMode === \"original\"\n    ),\n    implements:\n      input.exposeContracts && input.objectType.implements\n        ? [...input.objectType.implements]\n        : undefined,\n    properties,\n    links,\n    search: projectSearch(input.objectType.search, visiblePropertyIds, {\n      preserveEmpty: input.targetMode !== \"exact\",\n    }),\n  }\n  const withTokens = {\n    ...projected,\n    p: createPropertyTokenMap(projected),\n    l: createLinkTokenMap(projected),\n  }\n  return deepFreeze(withTokens) as ObjectTypeWithPropertyTokens\n}\n\nfunction principalLinkTargets(\n  link: ObjectLink,\n  allowedTargetObjectTypeIds: ReadonlySet<string>,\n  visibleObjectTypeIds: ReadonlySet<string>\n): string | string[] {\n  if (link.targetObjectTypeId === \"*\") return exactLinkTargets(allowedTargetObjectTypeIds)\n  const declared = Array.isArray(link.targetObjectTypeId)\n    ? link.targetObjectTypeId\n    : [link.targetObjectTypeId]\n  if (declared.every((objectTypeId) => visibleObjectTypeIds.has(objectTypeId))) {\n    return snapshotLinkTarget(link.targetObjectTypeId)\n  }\n  return exactLinkTargets(allowedTargetObjectTypeIds)\n}\n\nfunction exactLinkTargets(targetObjectTypeIds: ReadonlySet<string>): string | string[] {\n  const targets = [...targetObjectTypeIds].sort()\n  return targets.length === 1 ? targets[0]! : targets\n}\n\nfunction projectOptionalIds(\n  ids: readonly string[] | undefined,\n  visibleObjectTypeIds: ReadonlySet<string>,\n  preserveOriginal: boolean\n): string[] | undefined {\n  if (!ids) return undefined\n  if (preserveOriginal) return [...ids]\n  const visible = ids.filter((id) => visibleObjectTypeIds.has(id))\n  return visible.length > 0 ? visible : undefined\n}\n\nfunction snapshotLink(\n  link: ObjectLink,\n  targetObjectTypeId: string | string[],\n  propertyIds: ReadonlySet<string>,\n  options: { readonly omitEmptyProperties?: boolean } = {}\n): ObjectLink {\n  const properties = link.properties\n    ?.filter((property) => propertyIds.has(property.id))\n    .map(snapshotProperty)\n  return {\n    id: link.id,\n    name: link.name,\n    description: link.description,\n    targetObjectTypeId,\n    cardinality: link.cardinality,\n    properties: options.omitEmptyProperties && properties?.length === 0 ? undefined : properties,\n  }\n}\n\nfunction snapshotLinkTarget(target: string | readonly string[]): string | string[] {\n  return typeof target === \"string\" ? target : [...target]\n}\n\nfunction snapshotProperty(property: Property): Property {\n  return {\n    id: property.id,\n    name: property.name,\n    schema: snapshotSchema(property.schema),\n    description: property.description,\n    required: property.required,\n    nullable: property.nullable,\n    primary: property.primary,\n    unique: property.unique,\n    mode: property.mode,\n    semanticType: property.semanticType,\n    query: snapshotPropertyQuery(property.query),\n  }\n}\n\nfunction snapshotPropertyQuery(\n  query: PropertyQueryMetadata | undefined\n): PropertyQueryMetadata | undefined {\n  if (!query) return undefined\n  return {\n    searchable: query.searchable,\n    filterable: query.filterable,\n    sortable: query.sortable,\n    text: query.text,\n    exact: query.exact,\n    facet: query.facet,\n    weight: query.weight,\n  }\n}\n\nfunction projectSearch(\n  search: ObjectTypeSearchMetadata | undefined,\n  visiblePropertyIds: ReadonlySet<string>,\n  options: { readonly preserveEmpty: boolean }\n): ObjectTypeSearchMetadata | undefined {\n  if (!search) return undefined\n  const title = search.title && visiblePropertyIds.has(search.title) ? search.title : undefined\n  const selectedDefaultText = search.defaultText?.filter((propertyId) =>\n    visiblePropertyIds.has(propertyId)\n  )\n  const selectedExact = search.exact?.filter((propertyId) => visiblePropertyIds.has(propertyId))\n  const defaultText =\n    options.preserveEmpty || selectedDefaultText?.length ? selectedDefaultText : undefined\n  const exact = options.preserveEmpty || selectedExact?.length ? selectedExact : undefined\n  const vectors =\n    search.vectors === undefined\n      ? undefined\n      : snapshotVectorProfiles(\n          Object.fromEntries(\n            Object.entries(search.vectors).filter(([, profile]) =>\n              profile.source.every((id) => visiblePropertyIds.has(id))\n            )\n          )\n        )\n  const projected: ObjectTypeSearchMetadata = {\n    ...(vectors === undefined || Object.keys(vectors).length === 0 ? {} : { vectors }),\n    ...(title === undefined ? {} : { title }),\n    ...(defaultText === undefined ? {} : { defaultText }),\n    ...(exact === undefined ? {} : { exact }),\n  }\n  return Object.keys(projected).length > 0 || options.preserveEmpty ? projected : undefined\n}\n\nfunction snapshotAllValueTypes(\n  registered: ReadonlyMap<string, ValueType>\n): ReadonlyMap<string, ValueType> {\n  return new Map(\n    [...registered.values()].map((valueType) => {\n      const snapshot = snapshotValueType(valueType)\n      return [snapshot.id, snapshot] as const\n    })\n  )\n}\n\nfunction collectVisibleValueTypes(\n  registered: ReadonlyMap<string, ValueType>,\n  objectTypes: readonly ObjectTypeWithPropertyTokens[]\n): ReadonlyMap<string, ValueType> {\n  const referencedIds = new Set<string>()\n  const pendingSchemas: Schema[] = []\n  const visitedSchemas = new Set<object>()\n  for (const objectType of objectTypes) {\n    for (const property of objectType.properties) pendingSchemas.push(property.schema)\n    for (const link of objectType.links) {\n      for (const property of link.properties ?? []) pendingSchemas.push(property.schema)\n    }\n  }\n\n  while (pendingSchemas.length > 0) {\n    const schema = pendingSchemas.pop()!\n    if (typeof schema === \"string\" || visitedSchemas.has(schema)) continue\n    visitedSchemas.add(schema)\n    if (schema.type === \"valueTypeRef\") {\n      if (!referencedIds.has(schema.valueTypeId)) {\n        referencedIds.add(schema.valueTypeId)\n        const valueType = registered.get(schema.valueTypeId)\n        if (valueType) pendingSchemas.push(valueType.schema)\n      }\n      if (schema._resolved) pendingSchemas.push(schema._resolved)\n    } else if (schema.type === \"object\") {\n      for (const field of Object.values(schema.properties)) pendingSchemas.push(field.schema)\n    } else if (schema.type === \"array\") {\n      pendingSchemas.push(schema.items)\n    } else if (schema.type === \"map\") {\n      pendingSchemas.push(schema.valueSchema)\n    }\n  }\n\n  return new Map(\n    [...referencedIds]\n      .map((valueTypeId) => registered.get(valueTypeId))\n      .filter((valueType): valueType is ValueType => valueType !== undefined)\n      .map((valueType) => {\n        const snapshot = snapshotValueType(valueType)\n        return [snapshot.id, snapshot] as const\n      })\n  )\n}\n\nfunction snapshotValueType(valueType: ValueType): ValueType {\n  return deepFreeze({\n    id: valueType.id,\n    name: valueType.name,\n    description: valueType.description,\n    schema: snapshotSchema(valueType.schema),\n    semanticType: valueType.semanticType,\n  })\n}\n\nfunction snapshotSchema(schema: Schema): Schema {\n  return deepFreeze(structuredClone(schema))\n}\n\nfunction deepFreeze<T>(value: T, seen: Set<object> = new Set()): T {\n  if (typeof value !== \"object\" || value === null || seen.has(value)) return value\n  seen.add(value)\n  for (const key of Reflect.ownKeys(value)) {\n    const descriptor = Object.getOwnPropertyDescriptor(value, key)\n    if (descriptor && \"value\" in descriptor) deepFreeze(descriptor.value, seen)\n  }\n  return Object.freeze(value)\n}\n\nfunction unknownObjectType(objectTypeId: string): never {\n  throw new OntologyNotFoundError(formatUnknownObjectTypeMessage(objectTypeId))\n}\n",
+    "import {\n  type AuthorizedOntologySelection,\n  type AuthorizedOntologyView,\n  createAuthorizedOntologyView,\n} from \"../objects/authorized-ontology-view\"\nimport type { OntologyRegistry } from \"../ontology\"\nimport { assertObjectReadOutputWithinLimit } from \"../storage\"\nimport type { ObjectReaderSecurity } from \"./object-reader-security\"\n\n/** The ontology a reader resolves against, and the part of it its authority may describe. */\nexport class ObjectReaderOntology {\n  readonly registry: OntologyRegistry\n  readonly #security: ObjectReaderSecurity\n  #view?: AuthorizedOntologyView\n\n  constructor(registry: OntologyRegistry, security: ObjectReaderSecurity) {\n    this.registry = registry\n    this.#security = security\n    Object.freeze(this)\n  }\n\n  /** Inert metadata for the types the authority may view, built on first use. */\n  view(): AuthorizedOntologyView {\n    const authority = this.#security.authority\n    this.#view ??= createAuthorizedOntologyView({\n      ontology: this.registry,\n      selection: selectionForAuthority(this.#security, this.registry),\n      ...(authority.type === \"delegated\"\n        ? {\n            assertOutputWithinLimit: (value: unknown) =>\n              assertObjectReadOutputWithinLimit(value, authority.objectRead.limits),\n          }\n        : {}),\n    })\n    return this.#view\n  }\n}\n\nfunction selectionForAuthority(\n  security: ObjectReaderSecurity,\n  ontology: OntologyRegistry\n): AuthorizedOntologySelection {\n  const authority = security.authority\n\n  switch (authority.type) {\n    case \"unrestricted\":\n      return { kind: \"all\" }\n    case \"principal\":\n      return {\n        kind: \"types\",\n        objectTypeIds: ontology\n          .listObjectTypes()\n          // A type viewed through a condition is listed: the reader reads the objects it matches.\n          .filter((objectType) => security.isObjectTypeGranted(objectType.id, undefined))\n          .map((objectType) => objectType.id),\n      }\n    case \"delegated\":\n      return { kind: \"selected\", scope: authority.objectRead.scope }\n  }\n}\n",
+    "import { AuthorizationError } from \"../../authorization/errors\"\nimport type {\n  CompiledObjectReadObjectSelection,\n  CompiledObjectReadStep,\n  CompiledSelectedObjectReadScope,\n} from \"../../storage/objects/types\"\nimport type {\n  ObjectQueryAdmissionState,\n  ObjectQueryAdmissionTransition,\n  ObjectQueryEdgeUse,\n  ObjectQueryPropertyUse,\n  ObjectQuerySemanticAdmission,\n} from \"./validate\"\n\nconst selectedStateBrand = Symbol(\"sixb.selected-object-query-admission-state\")\n\ninterface SelectedObjectQueryState extends ObjectQueryAdmissionState {\n  readonly [selectedStateBrand]: true\n  readonly selections: readonly CompiledObjectReadObjectSelection[]\n}\n\nexport interface SelectedObjectQueryAdmission extends ObjectQuerySemanticAdmission {\n  /** Terminal hook for property-bearing operations outside the query IR, such as facets. */\n  assertPropertySelected(input: {\n    readonly state: ObjectQueryAdmissionState\n    readonly propertyId: string\n    readonly objectTypeId?: string\n    readonly use: ObjectQueryPropertyUse\n    readonly path: string\n  }): void\n  /** Terminal hook for the physical-link selector that sits outside `queryLinks.query`. */\n  assertIncidentEdgeSelected(input: {\n    readonly state: ObjectQueryAdmissionState\n    readonly linkId?: string\n    readonly direction: \"outgoing\" | \"incoming\" | \"both\"\n    readonly path: string\n  }): void\n}\n\n/**\n * Build an immutable semantic admission over one already-compiled selected reader scope.\n *\n * Object identities remain provider-owned: query admission follows exact path occurrences while\n * the selected storage relation decides which live roots and linked instances exist.\n */\nexport function createSelectedObjectQueryAdmission(\n  scope: CompiledSelectedObjectReadScope\n): SelectedObjectQueryAdmission {\n  const selectionByKey = new Map<string, CompiledObjectReadObjectSelection>()\n  const selectionsByType = new Map<string, CompiledObjectReadObjectSelection[]>()\n  const propertiesBySelection = new Map<string, ReadonlySet<string>>()\n\n  for (const selection of scope.objects) {\n    const key = selectionKey(selection.nodeId, selection.objectTypeId)\n    selectionByKey.set(key, selection)\n    propertiesBySelection.set(key, new Set(selection.propertyIds))\n    const byType = selectionsByType.get(selection.objectTypeId) ?? []\n    byType.push(selection)\n    selectionsByType.set(selection.objectTypeId, byType)\n  }\n\n  const outgoing = indexSteps(scope.steps, \"outgoing\", selectionByKey)\n  const incoming = indexSteps(scope.steps, \"incoming\", selectionByKey)\n  const emptyState = selectedState([])\n\n  const admission: SelectedObjectQueryAdmission = {\n    empty: () => emptyState,\n    source: (input) => {\n      const selections = input.result.objectTypeIds.flatMap(\n        (objectTypeId) => selectionsByType.get(objectTypeId) ?? []\n      )\n      const state = selectedState(selections)\n\n      if (input.kind === \"refs\") {\n        const missingType = [...new Set(input.refs?.map((ref) => ref.objectTypeId) ?? [])]\n          .sort()\n          .find((objectTypeId) => !selectionsByType.has(objectTypeId))\n        if (missingType) {\n          return denied(\n            state,\n            new AuthorizationError(\n              `view:object:${missingType}`,\n              `[Sixb] Delegated query cannot reference object type '${missingType}' at '${input.path}': the selected object scope does not contain that type.`\n            )\n          )\n        }\n      }\n\n      if (state.selections.length > 0) return { state }\n      const objectTypeId = input.objectTypeId ?? input.result.objectTypeIds[0] ?? \"unknown\"\n      return denied(\n        state,\n        new AuthorizationError(\n          `view:object:${objectTypeId}`,\n          `[Sixb] Delegated query cannot start from object type '${objectTypeId}' at '${input.path}': the selected object scope does not contain that type.`\n        )\n      )\n    },\n    property: (input) =>\n      propertyDenial(\n        asSelectedState(input.state),\n        input.propertyId,\n        input.objectTypeId,\n        input.use,\n        input.path,\n        propertiesBySelection\n      ),\n    edge: (input) => {\n      const state = asSelectedState(input.state)\n      const next = followEdge(\n        state,\n        input.linkId,\n        input.direction,\n        input.sourceObjectTypeId,\n        outgoing,\n        incoming,\n        input.result.objectTypeIds\n      )\n      if (next.selections.length > 0 || state.selections.length === 0) return { state: next }\n      return denied(\n        next,\n        edgeDenial(\n          state,\n          input.linkId,\n          input.direction,\n          input.sourceObjectTypeId,\n          input.use,\n          input.path\n        )\n      )\n    },\n    set: ({ op, states }) => {\n      if (op === \"subtract\") return asSelectedState(states[0] ?? emptyState)\n      return selectedState(states.flatMap((state) => asSelectedState(state).selections))\n    },\n    assertPropertySelected: (input) => {\n      const denial = propertyDenial(\n        asSelectedState(input.state),\n        input.propertyId,\n        input.objectTypeId,\n        input.use,\n        input.path,\n        propertiesBySelection\n      )\n      if (denial) throw denial\n    },\n    assertIncidentEdgeSelected: (input) => {\n      if (input.linkId === undefined) return\n      const state = asSelectedState(input.state)\n      const directions: readonly (\"outgoing\" | \"incoming\")[] =\n        input.direction === \"both\" ? [\"outgoing\", \"incoming\"] : [input.direction]\n      const next = selectedState(\n        directions.flatMap(\n          (direction) =>\n            followEdge(state, input.linkId!, direction, undefined, outgoing, incoming).selections\n        )\n      )\n      if (next.selections.length > 0 || state.selections.length === 0) return\n      throw edgeDenial(state, input.linkId, input.direction, undefined, \"queryLinks\", input.path)\n    },\n  }\n\n  return Object.freeze(admission)\n}\n\nfunction indexSteps(\n  steps: readonly CompiledObjectReadStep[],\n  direction: \"outgoing\" | \"incoming\",\n  selectionByKey: ReadonlyMap<string, CompiledObjectReadObjectSelection>\n): ReadonlyMap<string, readonly CompiledObjectReadObjectSelection[]> {\n  const index = new Map<string, CompiledObjectReadObjectSelection[]>()\n  for (const step of steps) {\n    const fromKey =\n      direction === \"outgoing\"\n        ? selectionKey(step.parentNodeId, step.sourceObjectTypeId)\n        : selectionKey(step.nodeId, step.targetObjectTypeId)\n    const toKey =\n      direction === \"outgoing\"\n        ? selectionKey(step.nodeId, step.targetObjectTypeId)\n        : selectionKey(step.parentNodeId, step.sourceObjectTypeId)\n    const target = selectionByKey.get(toKey)\n    if (!selectionByKey.has(fromKey) || !target) {\n      throw new Error(\"[Sixb] Compiled selected object scope contains an invalid query path step.\")\n    }\n    const key = edgeKey(\n      direction === \"outgoing\" ? step.parentNodeId : step.nodeId,\n      direction === \"outgoing\" ? step.sourceObjectTypeId : step.targetObjectTypeId,\n      step.linkId\n    )\n    const targets = index.get(key) ?? []\n    targets.push(target)\n    index.set(key, targets)\n  }\n  return index\n}\n\nfunction followEdge(\n  state: SelectedObjectQueryState,\n  linkId: string,\n  direction: \"outgoing\" | \"incoming\",\n  sourceObjectTypeId: string | undefined,\n  outgoing: ReadonlyMap<string, readonly CompiledObjectReadObjectSelection[]>,\n  incoming: ReadonlyMap<string, readonly CompiledObjectReadObjectSelection[]>,\n  resultObjectTypeIds?: readonly string[]\n): SelectedObjectQueryState {\n  const index = direction === \"outgoing\" ? outgoing : incoming\n  const resultTypes = resultObjectTypeIds ? new Set(resultObjectTypeIds) : undefined\n  const selections = state.selections.flatMap((selection) => {\n    const candidates = index.get(edgeKey(selection.nodeId, selection.objectTypeId, linkId)) ?? []\n    return candidates.filter(\n      (candidate) =>\n        (resultTypes === undefined || resultTypes.has(candidate.objectTypeId)) &&\n        (direction === \"outgoing\" ||\n          sourceObjectTypeId === undefined ||\n          candidate.objectTypeId === sourceObjectTypeId)\n    )\n  })\n  return selectedState(selections)\n}\n\nfunction propertyDenial(\n  state: SelectedObjectQueryState,\n  propertyId: string,\n  objectTypeId: string | undefined,\n  use: ObjectQueryPropertyUse,\n  path: string,\n  propertiesBySelection: ReadonlyMap<string, ReadonlySet<string>>\n): AuthorizationError | undefined {\n  const candidates = objectTypeId\n    ? state.selections.filter((selection) => selection.objectTypeId === objectTypeId)\n    : state.selections\n  // A selected reader has no rows for result types absent from this provenance. Those empty\n  // branches cannot observe a property and must not make includeSubtypes queries fail closed.\n  if (candidates.length === 0) return undefined\n\n  const missing = candidates.find(\n    (selection) =>\n      !propertiesBySelection\n        .get(selectionKey(selection.nodeId, selection.objectTypeId))\n        ?.has(propertyId)\n  )\n  if (!missing) return undefined\n\n  const objectTypeIds = [...new Set(candidates.map((selection) => selection.objectTypeId))].sort()\n  return new AuthorizationError(\n    `view:object:${objectTypeIds.join(\",\")}:property:${propertyId}`,\n    `[Sixb] Delegated query cannot use property '${propertyId}' for ${use} at '${path}': it is not selected on every matching read-scope path (missing on ${formatSelection(missing)}).`\n  )\n}\n\nfunction edgeDenial(\n  state: SelectedObjectQueryState,\n  linkId: string,\n  direction: \"outgoing\" | \"incoming\" | \"both\",\n  sourceObjectTypeId: string | undefined,\n  use: ObjectQueryEdgeUse,\n  path: string\n): AuthorizationError {\n  const source = sourceObjectTypeId ? `:${sourceObjectTypeId}` : \"\"\n  return new AuthorizationError(\n    `view:link:${direction}${source}:${linkId}`,\n    `[Sixb] Delegated query cannot use ${direction} link '${linkId}' for ${use} from ${formatState(state)} at '${path}': that exact read-scope path is not selected.`\n  )\n}\n\nfunction formatState(state: SelectedObjectQueryState): string {\n  if (state.selections.length === 0) return \"an empty read-scope provenance\"\n  return `read-scope provenance ${state.selections.map(formatSelection).join(\", \")}`\n}\n\nfunction formatSelection(selection: CompiledObjectReadObjectSelection): string {\n  return `'${selection.objectTypeId}'@node ${selection.nodeId}`\n}\n\nfunction selectedState(\n  selections: readonly CompiledObjectReadObjectSelection[]\n): SelectedObjectQueryState {\n  const unique = new Map<string, CompiledObjectReadObjectSelection>()\n  for (const selection of selections) {\n    unique.set(selectionKey(selection.nodeId, selection.objectTypeId), selection)\n  }\n  return Object.freeze({\n    [selectedStateBrand]: true as const,\n    selections: Object.freeze(\n      [...unique.values()].sort(\n        (left, right) =>\n          left.nodeId - right.nodeId || left.objectTypeId.localeCompare(right.objectTypeId)\n      )\n    ),\n  })\n}\n\nfunction asSelectedState(state: ObjectQueryAdmissionState): SelectedObjectQueryState {\n  if ((state as Partial<SelectedObjectQueryState>)[selectedStateBrand] !== true) {\n    throw new Error(\"[Sixb] Object query admission state belongs to another semantic admission.\")\n  }\n  return state as SelectedObjectQueryState\n}\n\nfunction denied(state: SelectedObjectQueryState, denial: Error): ObjectQueryAdmissionTransition {\n  return { state, denial }\n}\n\nfunction selectionKey(nodeId: number, objectTypeId: string): string {\n  return JSON.stringify([nodeId, objectTypeId])\n}\n\nfunction edgeKey(nodeId: number, objectTypeId: string, linkId: string): string {\n  return JSON.stringify([nodeId, objectTypeId, linkId])\n}\n",
+    "import { type PropertyClearance, resolvePropertyClearance } from \"../objects/property-clearance\"\nimport type { OntologyRegistry } from \"../ontology\"\nimport type { AppliedMarkings } from \"../security/applied-markings\"\nimport type { EventOriginRef } from \"../security/applied-markings-contribution\"\nimport type { AppliedMarkingsSnapshot } from \"../security/applied-markings-snapshot\"\n\n/** What one read may not return; `undefined` when it reads everything. */\nexport type Clearance = PropertyClearance | undefined\n\n/**\n * What one authority cannot read: the markings the code declares, and those the dataset versions\n * projections applied add, for an authority they can affect.\n *\n * A reader they cannot affect, trusted code included, gets the code's clearance as a plain value:\n * awaiting it costs one microtask, not a refresh. Otherwise the clearance is resolved for each\n * snapshot, which rarely changes, so the last one is kept.\n */\nexport class ObjectReaderClearance {\n  readonly #ontology: OntologyRegistry\n  /** What the authority cannot read under the code's markings; absent when it reads everything. */\n  readonly #static: Clearance\n  /** The authority's clearances; absent when it is unrestricted. */\n  readonly #clearances?: ReadonlySet<string>\n  /** Present only when applied dataset versions can deny this authority more than the code. */\n  readonly #applied?: AppliedMarkings\n  #lastSnapshot?: AppliedMarkingsSnapshot\n  #lastClearance: Clearance\n\n  constructor(input: {\n    readonly ontology: OntologyRegistry\n    readonly clearances: ReadonlySet<string> | undefined\n    readonly appliedMarkings?: AppliedMarkings\n  }) {\n    this.#ontology = input.ontology\n    this.#clearances = input.clearances\n    this.#static = input.clearances && resolvePropertyClearance(input.ontology, input.clearances)\n\n    if (input.clearances && input.appliedMarkings?.affects(input.clearances)) {\n      this.#applied = input.appliedMarkings\n    }\n\n    Object.freeze(this)\n  }\n\n  /** What the authority cannot read now. */\n  current(): Clearance | Promise<Clearance> {\n    const applied = this.#applied\n    const clearances = this.#clearances\n    if (!applied || !clearances) return this.#static\n\n    return applied.current().then((snapshot) => {\n      if (snapshot !== this.#lastSnapshot) {\n        this.#lastClearance = resolvePropertyClearance(this.#ontology, clearances, snapshot)\n        this.#lastSnapshot = snapshot\n      }\n      return this.#lastClearance\n    })\n  }\n\n  /**\n   * What the authority cannot read in an object event. Reads the event's origin version only for\n   * an authority its markings affect.\n   */\n  forEvent(sources: EventSources): Clearance | Promise<Clearance> {\n    const applied = this.#applied\n    const clearances = this.#clearances\n    if (!applied || !clearances) return this.#static\n\n    return applied\n      .current()\n      .then((snapshot) =>\n        sources.origin ? applied.forEventOrigin(snapshot, sources.origin) : snapshot\n      )\n      .then((snapshot) =>\n        sources.earlier ? applied.forEarlierValues(snapshot, sources.objectTypeId) : snapshot\n      )\n      .then((snapshot) => resolvePropertyClearance(this.#ontology, clearances, snapshot))\n  }\n}\n\n/** Where the values of an object event came from. */\nexport interface EventSources {\n  readonly objectTypeId: string\n  /** The projection that emitted the event, and the version it applied. */\n  readonly origin?: EventOriginRef\n  /**\n   * Whether the event holds values from before it, which came from versions applied earlier: an\n   * update or a deletion, or a record an action or a direct write took of projected values.\n   */\n  readonly earlier: boolean\n}\n",
+    "import { assertAuthorized, assertRuntimeAuthorizationBound, isAllowed } from \"../authorization\"\nimport { AuthorizationError } from \"../authorization/errors\"\nimport type { AuthorizationContext } from \"../authorization/types\"\nimport { type Unreadable, unreadableError } from \"../objects/property-clearance\"\nimport { bindCurrentUserPredicate } from \"../objects/query/current-user\"\nimport type { ObjectQueryPredicate } from \"../objects/query/ir\"\nimport {\n  createSelectedObjectQueryAdmission,\n  type SelectedObjectQueryAdmission,\n} from \"../objects/query/selected-read-admission\"\nimport type { OntologyRegistry } from \"../ontology\"\nimport type { UserRef } from \"../ontology/user-ref\"\nimport type { AppliedMarkings } from \"../security/applied-markings\"\nimport type {\n  CompiledConditionalObjectReadScope,\n  CompiledObjectReadStep,\n  ObjectLinkRow,\n} from \"../storage\"\nimport { compileConditionalObjectReadScope } from \"../storage/objects/read-scope\"\nimport type { resolveExecutionScopeAuthorization } from \"./authorization\"\nimport { type Clearance, ObjectReaderClearance } from \"./object-reader-clearance\"\nimport type { AuthorizablePrincipal, RuntimeAuthorization } from \"./types\"\n\nexport type ResolvedExecutionAuthority = ReturnType<typeof resolveExecutionScopeAuthorization>\n\nexport type RuntimeReadAuthorization = {\n  readonly projectId: string\n  readonly runtimeAuthorization: RuntimeAuthorization\n  readonly authorization?: AuthorizationContext\n}\n\n/** What a delegated authority selected: the object types, links, and queries it may read. */\nexport interface ObjectReaderDelegation {\n  readonly objectTypeIds: ReadonlySet<string>\n  readonly linkDefinitions: ReadonlySet<string>\n  readonly queryAdmission: SelectedObjectQueryAdmission\n}\n\n/**\n * Who reads, and what it may read: the exact execution authority, the selection a delegated one\n * carries, the conditions a principal reads some types through, and its clearance. It decides\n * whether an object type or a link is viewable.\n *\n * A type a principal views only through a condition is viewable here, and nowhere else: the\n * reader's storage shows only the objects the condition matches. A check that answers for one\n * object of such a type reads that object through the same storage.\n */\nexport class ObjectReaderSecurity {\n  /** The registered authority the reader is bound to. */\n  readonly authorization: RuntimeAuthorization\n  readonly authority: ResolvedExecutionAuthority\n  /** The authority as generic authorization checks take it. */\n  readonly runtime: RuntimeReadAuthorization\n  /** Present for delegated authority only. */\n  readonly delegation?: ObjectReaderDelegation\n  readonly clearance: ObjectReaderClearance\n  /** The user `currentUser()` stands for in this reader's queries; absent when no user reads. */\n  readonly requestingUser?: UserRef\n  /** What the reader's storage reads through: present when a principal views a type under one. */\n  readonly conditionalScope?: CompiledConditionalObjectReadScope\n  /** The properties each conditioned type's condition reads, which its clearance must show. */\n  readonly #conditionProperties: ReadonlyMap<string, readonly string[]>\n\n  constructor(input: {\n    readonly authorization: RuntimeAuthorization\n    readonly authority: ResolvedExecutionAuthority\n    readonly projectId: string\n    readonly ontology: OntologyRegistry\n    readonly appliedMarkings?: AppliedMarkings\n    readonly requestedBy: AuthorizablePrincipal | undefined\n  }) {\n    const authority = input.authority\n    this.authorization = input.authorization\n    this.authority = authority\n    if (input.requestedBy?.type === \"user\") {\n      this.requestingUser = Object.freeze({ type: \"user\", id: input.requestedBy.id })\n    }\n    this.runtime = Object.freeze({\n      projectId: input.projectId,\n      runtimeAuthorization: input.authorization,\n      ...(authority.type === \"principal\" ? { authorization: authority.context } : {}),\n    })\n\n    if (authority.type === \"delegated\") {\n      const scope = authority.objectRead.scope\n      this.delegation = Object.freeze({\n        objectTypeIds: new Set(scope.objects.map((object) => object.objectTypeId)),\n        linkDefinitions: new Set(scope.steps.map(delegatedLinkDefinitionKey)),\n        queryAdmission: createSelectedObjectQueryAdmission(scope),\n      })\n    }\n\n    const conditions = authority.type === \"principal\" ? authority.context.viewConditions : undefined\n    this.#conditionProperties = new Map(\n      [...(conditions ?? [])].map(([objectTypeId, predicates]) => [\n        objectTypeId,\n        [...new Set(predicates.flatMap(propertiesReadBy))],\n      ])\n    )\n\n    if (authority.type === \"principal\" && conditions && conditions.size > 0) {\n      // A reader sees an object any of its conditions matches. In a condition, `currentUser()` is\n      // the principal the grant was resolved for, when it is a user: never the user who requested\n      // the execution, which an agent's service account runs for. Otherwise it is no one.\n      const principal = authority.context.principal\n      const grantee: UserRef | undefined =\n        principal.type === \"user\" ? { type: \"user\", id: principal.id } : undefined\n\n      this.conditionalScope = compileConditionalObjectReadScope({\n        kind: \"conditional\",\n        conditions: [...conditions].map(([objectTypeId, predicates]) => ({\n          objectTypeId,\n          predicate: bindCurrentUserPredicate(anyOf(predicates), grantee),\n        })),\n      })\n    }\n\n    this.clearance = new ObjectReaderClearance({\n      ontology: input.ontology,\n      clearances: clearancesForAuthority(authority),\n      ...(input.appliedMarkings === undefined ? {} : { appliedMarkings: input.appliedMarkings }),\n    })\n\n    Object.freeze(this)\n  }\n\n  assertObjectTypesViewable(objectTypeIds: readonly string[], clearance: Clearance): void {\n    if (this.delegation) {\n      for (const objectTypeId of new Set(objectTypeIds)) {\n        if (this.delegation.objectTypeIds.has(objectTypeId)) continue\n        throw new AuthorizationError(\n          `delegated:object.view:${objectTypeId}`,\n          `[Sixb] Delegated authorization does not select object type '${objectTypeId}'.`\n        )\n      }\n    } else {\n      this.assertObjectTypesGranted(objectTypeIds, clearance)\n    }\n\n    if (!clearance) return\n\n    for (const objectTypeId of new Set(objectTypeIds)) {\n      const unreadable = clearance.unreadableType(objectTypeId)\n      if (unreadable) throw unreadableError(unreadable)\n    }\n  }\n\n  /**\n   * Refuse a type a principal holds no view grant for, before its clearance is applied to what it\n   * reads. A type viewed through a condition passes while the clearance shows every property the\n   * condition reads.\n   */\n  assertObjectTypesGranted(objectTypeIds: readonly string[], clearance: Clearance): void {\n    for (const objectTypeId of new Set(objectTypeIds)) {\n      if (!this.#conditionProperties.has(objectTypeId)) {\n        assertAuthorized(this.runtime, { kind: \"object.view\", objectTypeId })\n        continue\n      }\n\n      assertRuntimeAuthorizationBound(this.runtime)\n\n      const unreadable = this.#unreadableCondition(objectTypeId, clearance)\n      if (unreadable) throw unreadableError(unreadable)\n    }\n  }\n\n  /** Whether the principal views this type only through a condition, which decides per object. */\n  viewsThroughCondition(objectTypeId: string): boolean {\n    return this.#conditionProperties.has(objectTypeId)\n  }\n\n  isObjectTypeGranted(objectTypeId: string, clearance: Clearance): boolean {\n    if (this.delegation) return this.delegation.objectTypeIds.has(objectTypeId)\n\n    if (this.#conditionProperties.has(objectTypeId)) {\n      return this.#unreadableCondition(objectTypeId, clearance) === undefined\n    }\n\n    return isAllowed(this.runtime.authorization, { kind: \"object.view\", objectTypeId })\n  }\n\n  isObjectTypeViewable(objectTypeId: string, clearance: Clearance): boolean {\n    if (clearance?.unreadableType(objectTypeId)) return false\n    return this.isObjectTypeGranted(objectTypeId, clearance)\n  }\n\n  isLinkViewable(link: ObjectLinkRow, clearance: Clearance): boolean {\n    if (\n      !this.isObjectTypeViewable(link.sourceTypeId, clearance) ||\n      !this.isObjectTypeViewable(link.targetTypeId, clearance) ||\n      clearance?.unreadableLink(link.sourceTypeId, link.linkId)\n    ) {\n      return false\n    }\n\n    return this.delegation?.linkDefinitions.has(delegatedLinkDefinitionKey(link)) ?? true\n  }\n\n  #unreadableCondition(objectTypeId: string, clearance: Clearance): Unreadable | undefined {\n    const propertyIds = this.#conditionProperties.get(objectTypeId)\n    return propertyIds && unreadableConditionOf(objectTypeId, propertyIds, clearance)\n  }\n}\n\n/**\n * Which objects match a condition would reveal a property the reader cannot read, so a clearance\n * that hides one, a marking applied by a dataset version included, hides the whole type.\n */\nfunction unreadableConditionOf(\n  objectTypeId: string,\n  propertyIds: readonly string[],\n  clearance: Clearance\n): Unreadable | undefined {\n  for (const propertyId of propertyIds) {\n    const marking = clearance?.missingMarking(objectTypeId, propertyId)\n    if (marking === undefined) continue\n\n    return {\n      marking,\n      message: `[Sixb] Cannot read '${objectTypeId}': the condition it is viewed through reads '${objectTypeId}.${propertyId}', which requires clearance for marking '${marking}'.`,\n    }\n  }\n\n  return undefined\n}\n\nfunction propertiesReadBy(predicate: ObjectQueryPredicate): readonly string[] {\n  switch (predicate.op) {\n    case \"and\":\n    case \"or\":\n      return predicate.items.flatMap(propertiesReadBy)\n    case \"not\":\n      return propertiesReadBy(predicate.item)\n    case \"constant\":\n      return []\n    default:\n      return [predicate.propertyId]\n  }\n}\n\nfunction anyOf(predicates: readonly ObjectQueryPredicate[]): ObjectQueryPredicate {\n  return predicates.length === 1 ? predicates[0]! : { op: \"or\", items: predicates }\n}\n\n/**\n * Unrestricted authority reads every property. A principal reads what its roles clear; delegated\n * shared access carries no clearance, so no share can expose a marked property.\n */\nfunction clearancesForAuthority(\n  authority: ResolvedExecutionAuthority\n): ReadonlySet<string> | undefined {\n  switch (authority.type) {\n    case \"unrestricted\":\n      return undefined\n    case \"principal\":\n      return authority.context.clearances ?? new Set()\n    case \"delegated\":\n      return new Set()\n  }\n}\n\nfunction delegatedLinkDefinitionKey(\n  input:\n    | Pick<CompiledObjectReadStep, \"sourceObjectTypeId\" | \"linkId\" | \"targetObjectTypeId\">\n    | Pick<ObjectLinkRow, \"sourceTypeId\" | \"linkId\" | \"targetTypeId\">\n): string {\n  return \"sourceObjectTypeId\" in input\n    ? JSON.stringify([input.sourceObjectTypeId, input.linkId, input.targetObjectTypeId])\n    : JSON.stringify([input.sourceTypeId, input.linkId, input.targetTypeId])\n}\n",
+    "import type { UserExpansionPlan } from \"../objects/query/user-expansions\"\nimport type { OntologyRegistry } from \"../ontology\"\nimport { isUserRef, isUserRefPropertySchema } from \"../ontology/user-ref\"\nimport type {\n  AuthUserStore,\n  ExpandedLinkValue,\n  ObjectRow,\n  ObjectRowUsers,\n  UserRecord,\n} from \"../storage\"\nimport { toUserProfile } from \"../users/execution\"\n\n/** Ids read per storage call: one call for a typical page, bounded for the largest. */\nconst LOOKUP_BATCH_SIZE = 500\n\n/** One expanded property of one row, and the member ids its value holds, in stored order. */\ninterface UserSlot {\n  readonly users: ObjectRowUsers\n  readonly propertyId: string\n  readonly many: boolean\n  readonly ids: readonly string[]\n}\n\n/**\n * Attach the member profiles a query expands to the rows the reader returns.\n *\n * Every row whose type declares an expanded property gets `users`, so reading an entry never\n * throws. An entry is left out when the reader may not view the directory, and when the reader\n * cannot read the value: the rows have already lost their hidden values and carry `redactions`,\n * so a marked value is never looked up. The rows must be the reader's own copies.\n */\nexport async function attachUserProfiles(input: {\n  readonly rows: readonly ObjectRow[]\n  readonly plan: UserExpansionPlan\n  readonly ontology: OntologyRegistry\n  readonly projectId: string\n  readonly canViewUsers: boolean\n  readonly users: AuthUserStore | undefined\n}): Promise<void> {\n  const slots: UserSlot[] = []\n  collectSlots(input.rows, input.plan, input.ontology, slots)\n\n  if (!input.canViewUsers) return\n\n  const records = await readUsers(input, slots)\n\n  for (const slot of slots) {\n    slot.users[slot.propertyId] = expandedValue(slot, records)\n  }\n}\n\n// An array keeps its members in order and skips ids no member has; a single reference to no\n// member, or an empty one, is `null`.\nfunction expandedValue(slot: UserSlot, records: ReadonlyMap<string, UserRecord>) {\n  const profiles = slot.ids.flatMap((id) => {\n    const record = records.get(id)\n    return record ? [toUserProfile(record)] : []\n  })\n\n  return slot.many ? profiles : (profiles[0] ?? null)\n}\n\nfunction collectSlots(\n  rows: readonly ObjectRow[],\n  plan: UserExpansionPlan,\n  ontology: OntologyRegistry,\n  into: UserSlot[]\n): void {\n  for (const row of rows) {\n    const properties = ontology.getObjectTypeById(row.objectTypeId)?.properties ?? []\n\n    for (const propertyId of plan.users) {\n      const property = properties.find((candidate) => candidate.id === propertyId)\n      if (!property || !isUserRefPropertySchema(property.schema)) continue\n\n      row.users ??= {}\n      if (row.redactions?.[propertyId]) continue\n\n      into.push({\n        users: row.users,\n        propertyId,\n        many: property.schema !== \"userRef\",\n        ids: userIdsOf(row.properties[propertyId]),\n      })\n    }\n\n    for (const link of plan.links) {\n      collectSlots(linkedRows(row.links?.[link.linkId]), link.plan, ontology, into)\n    }\n  }\n}\n\nasync function readUsers(\n  input: { readonly projectId: string; readonly users: AuthUserStore | undefined },\n  slots: readonly UserSlot[]\n): Promise<ReadonlyMap<string, UserRecord>> {\n  const records = new Map<string, UserRecord>()\n  const ids = [...new Set(slots.flatMap((slot) => slot.ids))]\n  if (!input.users || ids.length === 0) return records\n\n  for (let start = 0; start < ids.length; start += LOOKUP_BATCH_SIZE) {\n    const batch = ids.slice(start, start + LOOKUP_BATCH_SIZE)\n    for (const record of await input.users.getByIds({ projectId: input.projectId, ids: batch })) {\n      records.set(record.id, record)\n    }\n  }\n\n  return records\n}\n\n// A single reference, or the references of an array in order. Anything else holds no member.\nfunction userIdsOf(value: unknown): string[] {\n  if (isUserRef(value)) return [value.id]\n  if (!Array.isArray(value)) return []\n  return value.filter(isUserRef).map((ref) => ref.id)\n}\n\nfunction linkedRows(value: ExpandedLinkValue | undefined): readonly ObjectRow[] {\n  if (value === undefined || value === null) return []\n  if (Array.isArray(value)) return value\n  return [value as ObjectRow]\n}\n",
+    "import type { OntologyRegistry } from \"../ontology\"\nimport { OntologyValidationError } from \"../ontology/errors\"\nimport type { ObjectType, ValueType } from \"../ontology/types\"\nimport { uniqueValueKey, uniqueValueKind } from \"../ontology/unique-values\"\nimport { normalizeSchemaValue, validateSchemaValue } from \"../ontology/validation\"\n\n/**\n * The key a lookup by a unique property compares: the caller's value, validated and normalized as\n * a write would store it, so a `Date` finds the object a write gave the same date.\n */\nexport function uniqueLookupKey(\n  ontology: OntologyRegistry,\n  input: { readonly objectTypeId: string; readonly propertyId: string; readonly value: unknown }\n): string {\n  return uniqueLookupKeyOf(\n    ontology.resolveObjectType(input.objectTypeId),\n    input.propertyId,\n    input.value,\n    ontology.getValueTypesById()\n  )\n}\n\n/** {@link uniqueLookupKey} against an already resolved object type. */\nexport function uniqueLookupKeyOf(\n  objectType: ObjectType,\n  propertyId: string,\n  value: unknown,\n  valueTypesById: ReadonlyMap<string, ValueType>\n): string {\n  const path = `${objectType.id}.${propertyId}`\n\n  const property = objectType.properties.find((candidate) => candidate.id === propertyId)\n  const kind = property?.unique ? uniqueValueKind(property.schema, valueTypesById) : undefined\n  if (!property || !kind) {\n    throw new OntologyValidationError(\n      `[Sixb] Cannot look up '${path}' by value: getBy needs a property declared with unique: true.`\n    )\n  }\n\n  if (value === null || value === undefined) {\n    throw new OntologyValidationError(\n      `[Sixb] Cannot look up '${path}' by ${String(value)}: no object holds a null or missing value.`\n    )\n  }\n\n  validateSchemaValue(property.schema, value, path, valueTypesById)\n  const key = uniqueValueKey(\n    kind,\n    normalizeSchemaValue(property.schema, value, path, valueTypesById)\n  )\n  if (key === null) {\n    throw new OntologyValidationError(`[Sixb] Cannot look up '${path}' by this value.`)\n  }\n  return key\n}\n",
+    "import { assertNever } from \"../assert-never\"\nimport { isRuntimeAllowed } from \"../authorization\"\nimport { AuthorizationError } from \"../authorization/errors\"\nimport type { EmbeddingModelCatalog, RerankingModelCatalog } from \"../models/catalog\"\nimport type { AuthorizedOntologyView } from \"../objects/authorized-ontology-view\"\nimport {\n  attachRedactions,\n  omitHiddenProperties,\n  redactObjectRow,\n} from \"../objects/clearance-redaction\"\nimport { unreadableError } from \"../objects/property-clearance\"\nimport {\n  countObjects,\n  type ExecuteObjectCountInput,\n  type ExecuteObjectCountResult,\n  type ExecuteObjectExistsInput,\n  type ExecuteObjectExistsResult,\n  type ExecuteObjectFacetsInput,\n  type ExecuteObjectFacetsResult,\n  type ExecuteObjectQueryInput,\n  type ExecuteObjectQueryLinksInput,\n  type ExecuteObjectQueryLinksResult,\n  type ExecuteObjectQueryResult,\n  executeObjectQuery,\n  executeObjectQueryLinks,\n  existsObjects,\n  facetObjects,\n} from \"../objects/query\"\nimport { createClearanceQueryAdmission } from \"../objects/query/clearance-admission\"\nimport { ObjectQueryValidationError } from \"../objects/query/errors\"\nimport { type QueryExecutorOptions, validateObjectFacetRequests } from \"../objects/query/executor\"\nimport type { ObjectQuery, ObjectQueryPredicate } from \"../objects/query/ir\"\nimport { assertLinkQueryReadable } from \"../objects/query/link-query-clearance\"\nimport { preflightObjectQueryLinks } from \"../objects/query/links\"\nimport { normalizeObjectQuery } from \"../objects/query/normalize\"\nimport { userExpansionPlan } from \"../objects/query/user-expansions\"\nimport {\n  type AdmittedObjectQuery,\n  composeObjectQueryAdmissions,\n  type ObjectQuerySemanticAdmission,\n  validateObjectQuery,\n  validateObjectQueryWithAdmission,\n} from \"../objects/query/validate\"\nimport {\n  admitTelemetryHistoryReadWorkload,\n  type TelemetryHistoryReadAdmission,\n  type TelemetryHistoryReadWorkloadInput,\n} from \"../objects/telemetry/workload\"\nimport type { OntologyRegistry } from \"../ontology\"\nimport type { AppliedMarkings } from \"../security/applied-markings\"\nimport type {\n  AuthUserStore,\n  LinkBatchKey,\n  ObjectFacetRequest,\n  ObjectLinkRow,\n  ObjectReadStorage,\n  ObjectRow,\n  ObjectStorage,\n} from \"../storage\"\nimport { assertObjectReadOutputWithinLimit, MAX_OBJECT_READ_FACETS } from \"../storage\"\nimport { captureExecutionScope, resolveExecutionScopeAuthorization } from \"./authorization\"\nimport type { Clearance, EventSources } from \"./object-reader-clearance\"\nimport { ObjectReaderOntology } from \"./object-reader-ontology\"\nimport { ObjectReaderSecurity } from \"./object-reader-security\"\nimport { attachUserProfiles } from \"./object-reader-users\"\nimport type { ExecutionScope } from \"./types\"\nimport { uniqueLookupKey } from \"./unique-lookup\"\n\ntype GetObjectInput = Omit<Parameters<ObjectReadStorage[\"getByPrimaryId\"]>[0], \"projectId\">\ntype GetObjectsInput = Omit<Parameters<ObjectReadStorage[\"getByPrimaryIdBatch\"]>[0], \"projectId\">\n/** A caller's value, validated and keyed against the property's schema. */\ninterface GetByUniqueValueInput {\n  readonly objectTypeId: string\n  readonly propertyId: string\n  readonly value: unknown\n}\ntype SelectObjectPropertiesInput = Parameters<ObjectReadStorage[\"selectsObjectProperties\"]>[0]\ntype CanReadObjectPropertyInput = SelectObjectPropertiesInput[\"items\"][number]\ntype CanReadObjectPropertiesBatchInput = Omit<SelectObjectPropertiesInput, \"projectId\">\ntype ListObjectsInput = Omit<Parameters<ObjectReadStorage[\"list\"]>[0], \"projectId\">\ntype ListLinksInput = Omit<Parameters<ObjectReadStorage[\"listLinks\"]>[0], \"projectId\">\ntype ListLinksBatchInput = Omit<Parameters<ObjectReadStorage[\"listLinksBatch\"]>[0], \"projectId\">\n\n/** The model catalogs semantic and reranked search use. */\ninterface ObjectReaderModels {\n  readonly embedding?: EmbeddingModelCatalog\n  readonly reranking?: RerankingModelCatalog\n}\n\nconst readerConstructionKey = Object.freeze({})\n\n/**\n * Core-owned object read boundary for one exact execution authority.\n *\n * The implementation class is intentionally private to this module. Its private fields make the\n * exported instance type nominal, while the construction key prevents code that discovers the\n * JavaScript constructor through an instance from manufacturing another reader.\n *\n * Its state is grouped as a project is: the ontology it resolves against, the security of the\n * authority (its delegation and clearance included), the model catalogs search uses, and the\n * storage it reads, with the member directory that expanded user properties resolve against.\n * Each group decides what belongs to it; the reader composes them.\n */\nclass AuthorizedObjectReaderImpl {\n  readonly #ontology: ObjectReaderOntology\n  readonly #security: ObjectReaderSecurity\n  readonly #models: ObjectReaderModels\n  readonly #storage: ObjectReadStorage\n  readonly #users: AuthUserStore | undefined\n\n  constructor(\n    key: typeof readerConstructionKey,\n    input: {\n      readonly ontology: ObjectReaderOntology\n      readonly security: ObjectReaderSecurity\n      readonly models: ObjectReaderModels\n      readonly storage: ObjectReadStorage\n      readonly users?: AuthUserStore\n    }\n  ) {\n    if (key !== readerConstructionKey) {\n      throw new Error(\"[Sixb] AuthorizedObjectReader can only be created by Core.\")\n    }\n    this.#ontology = input.ontology\n    this.#security = input.security\n    this.#models = input.models\n    this.#storage = input.storage\n    this.#users = input.users\n  }\n\n  static assertBound(reader: AuthorizedObjectReaderImpl, scope: ExecutionScope): void {\n    const capturedScope = captureExecutionScope(scope)\n    resolveExecutionScopeAuthorization(reader.#security.runtime.projectId, capturedScope)\n    if (capturedScope.authorization !== reader.#security.authorization) {\n      throw new Error(\n        \"[Sixb] AuthorizedObjectReader is not bound to this exact execution authority.\"\n      )\n    }\n  }\n\n  /** What the reader cannot read now, for surfaces such as events that redact on their own. */\n  static async clearance(reader: AuthorizedObjectReaderImpl): Promise<Clearance> {\n    return reader.#security.clearance.current()\n  }\n\n  /** What the reader cannot read in an object event. */\n  static eventClearance(\n    reader: AuthorizedObjectReaderImpl,\n    sources: EventSources\n  ): Clearance | Promise<Clearance> {\n    return reader.#security.clearance.forEvent(sources)\n  }\n\n  /** The conditions the reader views object types through, by concrete type. */\n  static viewConditions(\n    reader: AuthorizedObjectReaderImpl\n  ): ReadonlyMap<string, ReaderViewCondition> {\n    const security = reader.#security\n    const conditions = security.conditionalScope?.conditions ?? []\n\n    return new Map(\n      conditions.map(({ objectTypeId, predicate }) => [\n        objectTypeId,\n        {\n          predicate,\n          hiddenBy: (clearance: Clearance) =>\n            !security.isObjectTypeViewable(objectTypeId, clearance),\n        },\n      ])\n    )\n  }\n\n  static ontologyView(reader: AuthorizedObjectReaderImpl): AuthorizedOntologyView {\n    return reader.#ontology.view()\n  }\n\n  /** Project identity carried by this nominal reader capability. */\n  get projectId(): string {\n    return this.#security.runtime.projectId\n  }\n\n  async getByPrimaryId(input: GetObjectInput): ReturnType<ObjectReadStorage[\"getByPrimaryId\"]> {\n    const request = snapshotReadValue({\n      objectTypeId: input.objectTypeId,\n      primaryId: input.primaryId,\n    })\n    const clearance = await this.#security.clearance.current()\n    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance)\n    const row = await this.#storage.getByPrimaryId({\n      ...request,\n      projectId: this.#security.runtime.projectId,\n    })\n    return this.#detachRows(\n      row && this.#omitHidden(row, clearance),\n      (detached) => [detached],\n      clearance\n    )\n  }\n\n  /**\n   * The object of exactly `objectTypeId` holding a unique property's value, or null. A lookup by a\n   * marked property would reveal its value, so it needs the clearance a query predicate needs.\n   */\n  async getByUniqueValue(input: GetByUniqueValueInput): Promise<ObjectRow | null> {\n    const request = snapshotReadValue({\n      objectTypeId: input.objectTypeId,\n      propertyId: input.propertyId,\n      value: input.value,\n    })\n    const clearance = await this.#security.clearance.current()\n    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance)\n\n    const valueKey = uniqueLookupKey(this.#ontology.registry, request)\n    const marking = clearance?.missingMarking(request.objectTypeId, request.propertyId)\n    if (marking !== undefined) {\n      throw new AuthorizationError(\n        `clearance:marking:${marking}`,\n        `[Sixb] Cannot look up '${request.objectTypeId}.${request.propertyId}' by value: it requires clearance for marking '${marking}'.`\n      )\n    }\n\n    const row = await this.#storage.getByUniqueValue({\n      objectTypeId: request.objectTypeId,\n      propertyId: request.propertyId,\n      valueKey,\n      projectId: this.#security.runtime.projectId,\n    })\n    return this.#detachRows(\n      row && this.#omitHidden(row, clearance),\n      (detached) => [detached],\n      clearance\n    )\n  }\n\n  async getByPrimaryIdBatch(\n    input: GetObjectsInput\n  ): ReturnType<ObjectReadStorage[\"getByPrimaryIdBatch\"]> {\n    const request = snapshotReadValue({\n      items: input.items.map((item) => ({\n        objectTypeId: item.objectTypeId,\n        primaryId: item.primaryId,\n      })),\n    })\n    const clearance = await this.#security.clearance.current()\n    this.#security.assertObjectTypesViewable(\n      request.items.map((item) => item.objectTypeId),\n      clearance\n    )\n    const rows = await this.#storage.getByPrimaryIdBatch({\n      ...request,\n      projectId: this.#security.runtime.projectId,\n    })\n    return this.#detachRows(\n      new Map([...rows].map(([key, row]) => [key, this.#omitHidden(row, clearance)] as const)),\n      (detached) => detached.values(),\n      clearance\n    )\n  }\n\n  async canReadObjectProperty(input: CanReadObjectPropertyInput): Promise<boolean> {\n    const request = snapshotReadValue({\n      objectTypeId: input.objectTypeId,\n      primaryId: input.primaryId,\n      propertyId: input.propertyId,\n    })\n    const clearance = await this.#security.clearance.current()\n    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance)\n\n    if (hidesProperty(request, clearance)) return false\n    const [selected] = await this.#selectsObjectProperties([request])\n    return selected ?? false\n  }\n\n  async canReadObjectPropertiesBatch(\n    input: CanReadObjectPropertiesBatchInput\n  ): Promise<readonly boolean[]> {\n    const request = snapshotReadValue({\n      items: input.items.map((item) => ({\n        objectTypeId: item.objectTypeId,\n        primaryId: item.primaryId,\n        propertyId: item.propertyId,\n      })),\n    })\n    const clearance = await this.#security.clearance.current()\n    this.#security.assertObjectTypesViewable(\n      request.items.map((item) => item.objectTypeId),\n      clearance\n    )\n    const selected = await this.#selectsObjectProperties(request.items)\n    return request.items.map(\n      (item, index) => !hidesProperty(item, clearance) && selected[index] === true\n    )\n  }\n\n  async list(input: ListObjectsInput): ReturnType<ObjectReadStorage[\"list\"]> {\n    const request = snapshotReadValue({\n      objectTypeId:\n        typeof input.objectTypeId === \"string\"\n          ? input.objectTypeId\n          : input.objectTypeId === undefined\n            ? undefined\n            : [...input.objectTypeId],\n      primaryIdPrefix: input.primaryIdPrefix,\n      primaryIdSuffix: input.primaryIdSuffix,\n      updatedAfter: input.updatedAfter,\n      updatedBefore: input.updatedBefore,\n      createdAfter: input.createdAfter,\n      createdBefore: input.createdBefore,\n      limit: input.limit,\n      offset: input.offset,\n      orderBy: input.orderBy,\n      order: input.order,\n    })\n    const clearance = await this.#security.clearance.current()\n    const objectTypeId = this.#resolveListObjectTypes(request.objectTypeId, clearance)\n\n    // An empty type selection means \"none\", never \"all\". Short-circuiting here prevents a\n    // provider with different empty-array semantics from turning a principal read into a broad one.\n    if (Array.isArray(objectTypeId) && objectTypeId.length === 0) {\n      return { objects: [], hasMore: false, total: 0 }\n    }\n\n    const page = await this.#storage.list({\n      ...request,\n      ...(objectTypeId === undefined ? {} : { objectTypeId }),\n      projectId: this.#security.runtime.projectId,\n    })\n    return this.#detachRows(\n      { ...page, objects: page.objects.map((row) => this.#omitHidden(row, clearance)) },\n      (detached) => detached.objects,\n      clearance\n    )\n  }\n\n  async listLinks(input: ListLinksInput): ReturnType<ObjectReadStorage[\"listLinks\"]> {\n    const request = snapshotReadValue({\n      objectTypeId: input.objectTypeId,\n      objectId: input.objectId,\n      linkId: input.linkId,\n      direction: input.direction,\n    })\n    const clearance = await this.#security.clearance.current()\n    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance)\n    const links = detachReadResult(\n      await this.#storage.listLinks({\n        ...request,\n        projectId: this.#security.runtime.projectId,\n      })\n    )\n    return links.filter((link) => this.#security.isLinkViewable(link, clearance))\n  }\n\n  async listLinksBatch(\n    input: ListLinksBatchInput\n  ): ReturnType<ObjectReadStorage[\"listLinksBatch\"]> {\n    const request = snapshotReadValue({\n      direction: input.direction,\n      items: input.items.map((item) => ({\n        objectTypeId: item.objectTypeId,\n        objectId: item.objectId,\n        linkId: item.linkId,\n      })),\n    })\n    const clearance = await this.#security.clearance.current()\n    this.#security.assertObjectTypesViewable(\n      request.items.map((item) => item.objectTypeId),\n      clearance\n    )\n    const pages = detachReadResult(\n      await this.#storage.listLinksBatch({\n        ...request,\n        projectId: this.#security.runtime.projectId,\n      })\n    )\n    const filtered = new Map<LinkBatchKey, ObjectLinkRow[]>()\n    for (const [key, links] of pages) {\n      filtered.set(\n        key,\n        links.filter((link) => this.#security.isLinkViewable(link, clearance))\n      )\n    }\n    return filtered\n  }\n\n  async executeQuery(\n    input: Omit<ExecuteObjectQueryInput, \"projectId\">\n  ): Promise<ExecuteObjectQueryResult> {\n    const query = snapshotAuthoredQuery(input.query)\n    const includeTotal = snapshotReadValue(input.includeTotal)\n    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query\n    const clearance = await this.#security.clearance.current()\n    const result = await executeObjectQuery(\n      {\n        query: executionQuery,\n        ...(includeTotal === undefined ? {} : { includeTotal }),\n        projectId: this.#security.runtime.projectId,\n        signal: input.signal,\n      },\n      this.#queryExecutorOptions(clearance)\n    )\n    const detached = this.#detachRows(\n      { ...result, objects: result.objects.map((row) => this.#omitHidden(row, clearance)) },\n      (detached) => detached.objects,\n      clearance\n    )\n\n    await this.#attachUsers(detached.objects, query)\n    return detached\n  }\n\n  async queryLinks(\n    input: Omit<ExecuteObjectQueryLinksInput, \"projectId\">\n  ): Promise<ExecuteObjectQueryLinksResult> {\n    const query = snapshotAuthoredQuery(input.query)\n    const request = snapshotReadValue({\n      direction: input.direction,\n      linkId: input.linkId,\n      includeObjects: input.includeObjects,\n      pageSize: input.pageSize,\n      pageToken: input.pageToken,\n    })\n    let executionQuery = query\n    const admission = this.#security.delegation?.queryAdmission\n    if (admission) {\n      const preflight = preflightObjectQueryLinks(\n        { query, ...request, projectId: this.#security.runtime.projectId },\n        { ontology: this.#ontology.registry }\n      )\n      const admitted = validateObjectQueryWithAdmission(\n        preflight.validated.query,\n        { ontology: this.#ontology.registry, normalize: false },\n        admission\n      )\n      admission.assertIncidentEdgeSelected({\n        state: admitted.admissionState,\n        ...(preflight.linkId === undefined ? {} : { linkId: preflight.linkId }),\n        direction: preflight.direction,\n        path: \"$.linkId\",\n      })\n      executionQuery = admitted.query\n    }\n\n    const clearance = await this.#security.clearance.current()\n    if (clearance) {\n      assertLinkQueryReadable({\n        ontology: this.#ontology.registry,\n        clearance,\n        query,\n        request: { ...request, projectId: this.#security.runtime.projectId },\n        viewableByGrants: (objectTypeId) =>\n          this.#security.isObjectTypeViewable(objectTypeId, undefined),\n      })\n    }\n\n    const result = detachReadResult(\n      await executeObjectQueryLinks(\n        { query: executionQuery, ...request, projectId: this.#security.runtime.projectId },\n        this.#queryExecutorOptions(clearance)\n      )\n    )\n\n    // Link pagination is computed by the provider-facing executor. Filtering afterward would make\n    // its cursor and hasMore metadata describe hidden rows, so a provider contract violation must\n    // fail closed instead of returning a partially filtered page.\n    if (\n      result.objects.some(\n        (row) => !this.#security.isObjectTypeViewable(row.objectTypeId, clearance)\n      ) ||\n      result.links.some((link) => !this.#security.isLinkViewable(link, clearance))\n    ) {\n      throw new Error(\"[Sixb] Object storage returned a link page outside its authorized scope.\")\n    }\n\n    return {\n      ...result,\n      objects: result.objects.map((row) => (clearance ? redactObjectRow(row, clearance) : row)),\n    }\n  }\n\n  async count(\n    input: Omit<ExecuteObjectCountInput, \"projectId\">\n  ): Promise<ExecuteObjectCountResult> {\n    const query = snapshotAuthoredQuery(input.query)\n    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query\n    const clearance = await this.#security.clearance.current()\n    return detachReadResult(\n      await countObjects(\n        { query: executionQuery, projectId: this.#security.runtime.projectId },\n        this.#queryExecutorOptions(clearance)\n      )\n    )\n  }\n\n  async exists(\n    input: Omit<ExecuteObjectExistsInput, \"projectId\">\n  ): Promise<ExecuteObjectExistsResult> {\n    const query = snapshotAuthoredQuery(input.query)\n    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query\n    const clearance = await this.#security.clearance.current()\n    return detachReadResult(\n      await existsObjects(\n        { query: executionQuery, projectId: this.#security.runtime.projectId },\n        this.#queryExecutorOptions(clearance)\n      )\n    )\n  }\n\n  async facet(\n    input: Omit<ExecuteObjectFacetsInput, \"projectId\">\n  ): Promise<ExecuteObjectFacetsResult> {\n    const query = snapshotAuthoredQuery(input.query)\n    const facets = snapshotFacetRequests(input.facets)\n    let executionQuery = query\n    let executionFacets = facets\n    const admission = this.#security.delegation?.queryAdmission\n    if (admission) {\n      // Terminal arguments are ordinary validation errors, not an authorization oracle. Validate\n      // them against the canonical result shape before raising any delegated-scope denial.\n      const validated = validateObjectQuery(query, { ontology: this.#ontology.registry })\n      const normalizedFacets = validateObjectFacetRequests(facets, validated.result.objectTypeIds, {\n        ontology: this.#ontology.registry,\n      })\n      const admitted = validateObjectQueryWithAdmission(\n        validated.query,\n        { ontology: this.#ontology.registry, normalize: false },\n        admission\n      )\n      normalizedFacets.forEach((facet, index) => {\n        admission.assertPropertySelected({\n          state: admitted.admissionState,\n          propertyId: facet.propertyId,\n          use: \"facet\",\n          path: `$.facets[${index}].propertyId`,\n        })\n      })\n      executionQuery = admitted.query\n      executionFacets = normalizedFacets\n    }\n    const clearance = await this.#security.clearance.current()\n    return detachReadResult(\n      await facetObjects(\n        {\n          query: executionQuery,\n          facets: executionFacets,\n          projectId: this.#security.runtime.projectId,\n        },\n        this.#queryExecutorOptions(clearance)\n      )\n    )\n  }\n\n  /**\n   * Redact the rows a write of this object type returns. An upsert returns the merged effective\n   * row, which may hold marked values the writer never sent and cannot read. Resolved before the\n   * write, which it refuses when the writer cannot read the type at all.\n   */\n  async writtenRowRedactor(\n    objectTypeId: string\n  ): Promise<<TRow extends ObjectRow>(row: TRow) => TRow> {\n    const clearance = await this.#security.clearance.current()\n    assertTargetsReadable(clearance, { objectTypeIds: [objectTypeId] })\n    return (row) => (clearance ? redactObjectRow(row, clearance) : row)\n  }\n\n  /**\n   * The check a direct write runs on each object's properties before its commit claims them. It\n   * refuses a value for a unique property this authority cannot read: whether the write is refused\n   * as taken would reveal which values objects hold, as a `getBy` would.\n   */\n  async uniqueValueWriteCheck(\n    objectTypeId: string\n  ): Promise<(properties: Readonly<Record<string, unknown>>) => void> {\n    const clearance = await this.#security.clearance.current()\n    const marked = this.#ontology.registry\n      .listUniqueProperties(objectTypeId)\n      .flatMap((property) => {\n        const marking = clearance?.missingMarking(objectTypeId, property.propertyId)\n        return marking === undefined ? [] : [{ propertyId: property.propertyId, marking }]\n      })\n\n    return (properties) => {\n      for (const { propertyId, marking } of marked) {\n        if (properties[propertyId] === undefined || properties[propertyId] === null) continue\n\n        throw new AuthorizationError(\n          `clearance:marking:${marking}`,\n          `[Sixb] Cannot write a value to '${objectTypeId}.${propertyId}': it is unique and requires clearance for marking '${marking}'.`\n        )\n      }\n    }\n  }\n\n  /**\n   * Refuse a write or a request that names an object type or link this authority cannot read,\n   * before any lookup: it would answer whether what it names exists, and land where the reader\n   * cannot see.\n   */\n  async assertReadable(targets: ReadTargets): Promise<void> {\n    assertTargetsReadable(await this.#security.clearance.current(), targets)\n  }\n\n  /**\n   * Whether this reader sees only the objects of a type that a condition matches. A write or a\n   * request that names such an object finds it through this reader first: one it cannot find is\n   * hidden or missing, and both answer alike.\n   */\n  viewsThroughCondition(objectTypeId: string): boolean {\n    return this.#security.viewsThroughCondition(objectTypeId)\n  }\n\n  /** Refuse a type this reader views neither whole nor through a condition. */\n  async assertViewable(objectTypeIds: readonly string[]): Promise<void> {\n    const clearance = await this.#security.clearance.current()\n    this.#security.assertObjectTypesViewable(objectTypeIds, clearance)\n  }\n\n  /** Enforce the delegated response budget without exposing or recombining its limits. */\n  assertVisibleOutputWithinLimit(value: unknown): void {\n    if (this.#security.authority.type !== \"delegated\") return\n    assertObjectReadOutputWithinLimit(value, this.#security.authority.objectRead.limits)\n  }\n\n  /** Admit adjacent telemetry work without exposing which authority policy was selected. */\n  admitTelemetryHistoryRead(\n    input: TelemetryHistoryReadWorkloadInput\n  ): TelemetryHistoryReadAdmission {\n    return admitTelemetryHistoryReadWorkload(input, this.#security.authority.type === \"delegated\")\n  }\n\n  #queryExecutorOptions(clearance: Clearance) {\n    const admission = this.#executorAdmission(clearance)\n\n    if (this.#security.authority.type === \"delegated\") {\n      // The selected storage instance is the private execution capability. Passing the delegated\n      // runtime token into the generic executor would either reject this admitted query or tempt a\n      // forgeable bypass flag; neither is needed at this nominal boundary.\n      return {\n        ontology: this.#ontology.registry,\n        storage: this.#storage,\n        embeddingModels: this.#models.embedding,\n        rerankingModels: this.#models.reranking,\n        ...(admission === undefined ? {} : { admission }),\n        requestingUser: this.#security.requestingUser,\n      }\n    }\n    return {\n      ontology: this.#ontology.registry,\n      embeddingModels: this.#models.embedding,\n      rerankingModels: this.#models.reranking,\n      storage: this.#storage,\n      ...this.#queryAuthorization(clearance),\n      ...(admission === undefined ? {} : { admission }),\n      requestingUser: this.#security.requestingUser,\n    }\n  }\n\n  /**\n   * A principal's queries read the types this reader's security grants, including those its\n   * storage reads through a condition, which no view grant holds.\n   */\n  #queryAuthorization(\n    clearance: Clearance\n  ): Pick<QueryExecutorOptions, \"readableObjectTypes\" | \"runtimeAuthorization\"> {\n    const runtimeAuthorization = this.#security.runtime.runtimeAuthorization\n    if (this.#security.authority.type !== \"principal\") return { runtimeAuthorization }\n\n    const security = this.#security\n    return {\n      runtimeAuthorization,\n      readableObjectTypes: Object.freeze({\n        assert: (objectTypeIds: readonly string[]) =>\n          security.assertObjectTypesGranted(objectTypeIds, clearance),\n        has: (objectTypeId: string) => security.isObjectTypeGranted(objectTypeId, clearance),\n      }),\n    }\n  }\n\n  /**\n   * The executor validates the query it runs, and that validation resolves default text fields.\n   * Every admission that narrows those fields must therefore apply there, not only beforehand.\n   */\n  #executorAdmission(clearance: Clearance): ObjectQuerySemanticAdmission | undefined {\n    const admission = clearance && createClearanceQueryAdmission(clearance)\n    const selected = this.#security.delegation?.queryAdmission\n\n    if (selected && admission) return composeObjectQueryAdmissions(selected, admission)\n    return selected ?? admission\n  }\n\n  /**\n   * Resolve the user properties the query expands on rows already detached and redacted. Only an\n   * authority that may view the directory reads profiles; a delegated one never does.\n   */\n  async #attachUsers(rows: readonly ObjectRow[], query: ObjectQuery): Promise<void> {\n    const plan = userExpansionPlan(normalizeObjectQuery(query))\n    if (!plan) return\n\n    await attachUserProfiles({\n      rows,\n      plan,\n      ontology: this.#ontology.registry,\n      projectId: this.#security.runtime.projectId,\n      canViewUsers: isRuntimeAllowed(this.#security.runtime, { kind: \"users.view\" }),\n      users: this.#users,\n    })\n  }\n\n  /**\n   * Whether the reader's storage selects each property of its object. A delegated reader selects\n   * what its share does. A principal reads a type it views through a condition object by object,\n   * so a hidden object and a missing one both select nothing; it selects every other property.\n   */\n  async #selectsObjectProperties(\n    items: readonly CanReadObjectPropertyInput[]\n  ): Promise<readonly boolean[]> {\n    const readsByObject = (item: CanReadObjectPropertyInput) =>\n      this.#security.authority.type === \"delegated\" ||\n      this.#security.viewsThroughCondition(item.objectTypeId)\n\n    const checked = items.filter(readsByObject)\n    const selected =\n      checked.length === 0\n        ? []\n        : await this.#storage.selectsObjectProperties({\n            projectId: this.#security.runtime.projectId,\n            items: checked,\n          })\n\n    let next = 0\n    return items.map((item) => !readsByObject(item) || selected[next++] === true)\n  }\n\n  #omitHidden<TRow extends ObjectRow>(row: TRow, clearance: Clearance): TRow {\n    return clearance ? omitHiddenProperties(row, clearance) : row\n  }\n\n  /**\n   * Detach a result whose rows went through {@link #omitHidden}, then list their redactions on\n   * the copy. Each row is deep-copied once, and never with a hidden value.\n   */\n  #detachRows<TResult>(\n    result: TResult,\n    rows: (detached: TResult) => Iterable<ObjectRow | null>,\n    clearance: Clearance\n  ): TResult {\n    const detached = detachReadResult(result)\n    if (clearance) {\n      for (const row of rows(detached)) if (row) attachRedactions(row, clearance)\n    }\n\n    return detached\n  }\n\n  #admitDelegatedQuery(query: ObjectQuery): AdmittedObjectQuery | undefined {\n    const admission = this.#security.delegation?.queryAdmission\n    if (!admission) return undefined\n    return validateObjectQueryWithAdmission(query, { ontology: this.#ontology.registry }, admission)\n  }\n\n  #resolveListObjectTypes(\n    requested: ListObjectsInput[\"objectTypeId\"],\n    clearance: Clearance\n  ): ListObjectsInput[\"objectTypeId\"] {\n    if (requested !== undefined) {\n      const objectTypeIds = typeof requested === \"string\" ? [requested] : [...new Set(requested)]\n      for (const objectTypeId of objectTypeIds) {\n        this.#ontology.registry.resolveObjectType(objectTypeId)\n      }\n      this.#security.assertObjectTypesViewable(objectTypeIds, clearance)\n      return typeof requested === \"string\" ? requested : objectTypeIds\n    }\n\n    if (this.#security.authority.type === \"unrestricted\") return undefined\n    return this.#ontology.registry\n      .listObjectTypes()\n      .map((objectType) => objectType.id)\n      .filter((objectTypeId) => this.#security.isObjectTypeViewable(objectTypeId, clearance))\n  }\n}\n\nObject.freeze(AuthorizedObjectReaderImpl.prototype)\nObject.freeze(AuthorizedObjectReaderImpl)\n\nexport type AuthorizedObjectReader = AuthorizedObjectReaderImpl\n\n/** Build the sole application-facing object reader for one registered execution scope. */\nexport function createAuthorizedObjectReader(input: {\n  readonly scope: ExecutionScope\n  readonly ontology: OntologyRegistry\n  readonly embeddingModels?: EmbeddingModelCatalog\n  readonly rerankingModels?: RerankingModelCatalog\n  readonly objectStorage: ObjectStorage\n  /** Markings of the dataset versions projections applied; the code's markings alone without. */\n  readonly appliedMarkings?: AppliedMarkings\n  /** The member directory expanded user properties resolve against. */\n  readonly users?: AuthUserStore\n}): AuthorizedObjectReader {\n  const scope = captureExecutionScope(input.scope)\n  const projectId = scope.execution.projectId\n  const authority = resolveExecutionScopeAuthorization(projectId, scope)\n  const security = new ObjectReaderSecurity({\n    authorization: scope.authorization,\n    authority,\n    projectId,\n    ontology: input.ontology,\n    ...(input.appliedMarkings === undefined ? {} : { appliedMarkings: input.appliedMarkings }),\n    requestedBy: scope.execution.requestedBy,\n  })\n  const storage = objectStorageForAuthority(security, input.objectStorage)\n  const reader = new AuthorizedObjectReaderImpl(readerConstructionKey, {\n    ontology: new ObjectReaderOntology(input.ontology, security),\n    security,\n    models: Object.freeze({\n      ...(input.embeddingModels === undefined ? {} : { embedding: input.embeddingModels }),\n      ...(input.rerankingModels === undefined ? {} : { reranking: input.rerankingModels }),\n    }),\n    storage,\n    ...(input.users === undefined ? {} : { users: input.users }),\n  })\n  Object.freeze(reader)\n  return reader\n}\n\n/** Reject recombining an authorized reader with any other execution authority. */\nexport function assertAuthorizedObjectReaderBinding(input: {\n  readonly reader: AuthorizedObjectReader\n  readonly scope: ExecutionScope\n}): void {\n  AuthorizedObjectReaderImpl.assertBound(input.reader, input.scope)\n}\n\n/** Return inert metadata projected from the exact authority already owned by the reader. */\nexport function getAuthorizedOntologyView(reader: AuthorizedObjectReader): AuthorizedOntologyView {\n  return AuthorizedObjectReaderImpl.ontologyView(reader)\n}\n\n/**\n * What a reader resolved for this authority cannot read now. Events redact with it: an event of an\n * object type the reader cannot read is not delivered, and the others are redacted like rows.\n */\nexport function readerClearance(reader: AuthorizedObjectReader): Promise<Clearance> {\n  return AuthorizedObjectReaderImpl.clearance(reader)\n}\n\n/**\n * What a reader cannot read in an object event: the current markings, with those of the versions\n * its values came from. A plain value for a reader those markings cannot affect, which reads no\n * version.\n */\nexport function readerEventClearance(\n  reader: AuthorizedObjectReader,\n  sources: EventSources\n): Clearance | Promise<Clearance> {\n  return AuthorizedObjectReaderImpl.eventClearance(reader, sources)\n}\n\n/** A condition a reader views an object type through, for a surface that decides per object. */\nexport interface ReaderViewCondition {\n  /** The condition, `currentUser()` bound, as the reader's storage reads it. */\n  readonly predicate: ObjectQueryPredicate\n  /**\n   * Whether a clearance hides the type, or a property the condition reads: which objects match\n   * would reveal it, so the reader reads no object of the type.\n   */\n  hiddenBy(clearance: Clearance): boolean\n}\n\n/**\n * The conditions a reader views object types through, by concrete type: empty for a reader that\n * views each type it reads whole. A type absent here is decided by its grants alone, which deny a\n * type viewed only under a condition. Events match the state they carry against these, and read\n * through the reader what they cannot decide from it.\n */\nexport function readerViewConditions(\n  reader: AuthorizedObjectReader\n): ReadonlyMap<string, ReaderViewCondition> {\n  return AuthorizedObjectReaderImpl.viewConditions(reader)\n}\n\n/** What a write or a request names: object types, and links by their source type. */\ninterface ReadTargets {\n  readonly objectTypeIds: readonly string[]\n  readonly links?: readonly { readonly objectTypeId: string; readonly linkId: string }[]\n}\n\nfunction assertTargetsReadable(clearance: Clearance, targets: ReadTargets): void {\n  if (!clearance) return\n\n  for (const objectTypeId of targets.objectTypeIds) {\n    const unreadable = clearance.unreadableType(objectTypeId)\n    if (unreadable) throw unreadableError(unreadable)\n  }\n\n  for (const link of targets.links ?? []) {\n    const unreadable = clearance.unreadableLink(link.objectTypeId, link.linkId)\n    if (unreadable) throw unreadableError(unreadable)\n  }\n}\n\nfunction hidesProperty(\n  item: { readonly objectTypeId: string; readonly propertyId: string },\n  clearance: Clearance\n): boolean {\n  return clearance?.missingMarking(item.objectTypeId, item.propertyId) !== undefined\n}\n\nfunction objectStorageForAuthority(\n  security: ObjectReaderSecurity,\n  objectStorage: ObjectStorage\n): ObjectReadStorage {\n  const authority = security.authority\n\n  switch (authority.type) {\n    case \"principal\":\n      return security.conditionalScope\n        ? objectStorage.createConditionalReadScope({\n            projectId: authority.projectId,\n            scope: security.conditionalScope,\n          })\n        : objectStorage\n    case \"unrestricted\":\n      return objectStorage\n    case \"delegated\":\n      return objectStorage.createSelectedReadScope({\n        projectId: authority.projectId,\n        scope: authority.objectRead.scope,\n        limits: authority.objectRead.limits,\n      })\n    default:\n      return assertNever(\n        authority,\n        `[Sixb] Unsupported object reader authority '${String((authority as { type?: unknown }).type)}'.`\n      )\n  }\n}\n\n/**\n * Storage providers may optimize trusted reads with live references. Values crossing the\n * application-facing authorization boundary must not retain them.\n */\nfunction detachReadResult<T>(value: T): T {\n  return structuredClone(value)\n}\n\n/** Capture caller-owned values before authorization and execution. */\nfunction snapshotReadValue<T>(value: T): T {\n  return structuredClone(value)\n}\n\n/** Bound and capture facet arguments before reading any caller-owned element. */\nfunction snapshotFacetRequests(facets: readonly ObjectFacetRequest[]): ObjectFacetRequest[] {\n  if (!Array.isArray(facets)) {\n    throw new ObjectQueryValidationError([\n      {\n        path: \"$.facets\",\n        code: \"invalid_facets\",\n        message: \"facets must be an array\",\n      },\n    ])\n  }\n  const length = facets.length\n  if (!Number.isSafeInteger(length) || length > MAX_OBJECT_READ_FACETS) {\n    throw new ObjectQueryValidationError([\n      {\n        path: \"$.facets\",\n        code: \"too_many_facets\",\n        message: `facets must include at most ${MAX_OBJECT_READ_FACETS} facet requests`,\n      },\n    ])\n  }\n\n  const snapshot: ObjectFacetRequest[] = []\n  for (let index = 0; index < length; index += 1) {\n    const facet = facets[index]\n    snapshot.push({ propertyId: facet.propertyId, limit: facet.limit })\n  }\n  return snapshot\n}\n\n/** Capture one serializable query before either authorization or execution sees it. */\nfunction snapshotAuthoredQuery(query: ObjectQuery): ObjectQuery {\n  try {\n    const snapshot = structuredClone(query)\n    const pending = [snapshot]\n    const seen = new Set<ObjectQuery>()\n    for (const node of pending) {\n      if (seen.has(node)) continue\n      seen.add(node)\n      if (\n        node.kind === \"vector\" &&\n        (typeof node.vector !== \"string\" ||\n          typeof node.profile !== \"string\" ||\n          \"propertyId\" in node)\n      ) {\n        throw new ObjectQueryValidationError([\n          {\n            path: \"$\",\n            code: \"invalid_vector_search_input\",\n            message: \"Vector search requires a named profile and search text\",\n          },\n        ])\n      }\n      if (\"input\" in node) pending.push(node.input)\n      if (node.kind === \"set\") pending.push(...node.inputs)\n    }\n    return snapshot\n  } catch (error) {\n    if (error instanceof ObjectQueryValidationError) throw error\n    throw new ObjectQueryValidationError([\n      {\n        path: \"$\",\n        code: \"query_not_cloneable\",\n        message: \"Object query must contain only structured-cloneable data\",\n      },\n    ])\n  }\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIO,SAAS,WAAW,CAAC,QAAe,SAAwB;AAAA,EACjE,MAAM,IAAI,MAAM,OAAO;AAAA;;;ACGlB,SAAS,eAAuC,CACrD,KACA,WACM;AAAA,EACN,OAAO,UAAU,KAAK,WAAW,IAAI;AAAA;AAUhC,SAAS,oBAA4C,CAC1D,KACA,WACM;AAAA,EACN,OAAO,UAAU,KAAK,WAAW,KAAK;AAAA;AAOjC,SAAS,gBAAgB,CAAC,KAAgB,WAAoC;AAAA,EACnF,MAAM,SAAS,UAAU,iBAAiB,IAAI,YAAY;AAAA,EAC1D,IAAI,WAAW;AAAA,IAAW,IAAI,aAAa,OAAO;AAAA,EAElD,IAAI,IAAI,UAAU;AAAA,IAAW;AAAA,EAE7B,WAAW,SAAS,OAAO,OAAO,IAAI,KAAK,GAAG;AAAA,IAC5C,IAAI,UAAU;AAAA,MAAM;AAAA,IACpB,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,MACxB,WAAW,UAAU;AAAA,QAAO,iBAAiB,QAAQ,SAAS;AAAA,IAChE,EAAO;AAAA,MACL,iBAAiB,OAA4B,SAAS;AAAA;AAAA,EAE1D;AAAA;AAGF,SAAS,SAAiC,CACxC,KACA,WACA,gBACM;AAAA,EACN,MAAM,SAAS,UAAU,iBAAiB,IAAI,YAAY;AAAA,EAC1D,MAAM,QAAQ,IAAI;AAAA,EAClB,IAAI,WAAW,aAAa,UAAU;AAAA,IAAW,OAAO;AAAA,EAExD,MAAM,WAAiB,KAAK,IAAI;AAAA,EAChC,IAAI,WAAW,WAAW;AAAA,IACxB,SAAS,aAAa,YAAY,IAAI,YAAY,OAAO,GAAG;AAAA,IAC5D,IAAI;AAAA,MAAgB,SAAS,aAAa,OAAO;AAAA,EACnD;AAAA,EAEA,IAAI,UAAU,WAAW;AAAA,IACvB,SAAS,QAAQ,OAAO,YACtB,OAAO,QAAQ,KAAK,EAAE,IAAI,EAAE,QAAQ,WAAW;AAAA,MAC7C;AAAA,MACA,gBAAgB,OAAO,WAAW,cAAc;AAAA,IAClD,CAAC,CACH;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,eAAe,CACtB,OACA,WACA,gBACmB;AAAA,EACnB,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,IAAI,MAAM,QAAQ,KAAK,GAAG;AAAA,IACxB,OAAO,MAAM,IAAI,CAAC,QAAQ,UAAU,KAAK,WAAW,cAAc,CAAC;AAAA,EACrE;AAAA,EAGA,OAAO,UAAU,OAA4B,WAAW,cAAc;AAAA;AAOjE,SAAS,iBAAiB,CAC/B,OACA,WACmB;AAAA,EACnB,IAAI,MAAM,UAAU;AAAA,IAAW,OAAO;AAAA,EAEtC,MAAM,SAAS,UAAU,iBAAiB,MAAM,QAAQ,YAAY;AAAA,EACpE,IAAI,WAAW;AAAA,IAAW,OAAO;AAAA,EAEjC,IAAI,MAAM,SAAS,kBAAkB;AAAA,IACnC,OAAO;AAAA,SACF;AAAA,MACH,SAAS;AAAA,WACJ,MAAM;AAAA,QACT,iBAAiB,YAAY,MAAM,QAAQ,iBAAiB,OAAO,GAAG;AAAA,QACtE,YAAY,OAAO;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO;AAAA,OACF;AAAA,IACH,SAAS;AAAA,SACJ,MAAM;AAAA,MACT,YAAY,YAAY,MAAM,QAAQ,YAAY,OAAO,GAAG;AAAA,MAC5D,iBAAiB,YAAY,MAAM,QAAQ,iBAAiB,OAAO,GAAG;AAAA,MACtE,YAAY,OAAO;AAAA,IACrB;AAAA,EACF;AAAA;AASF,SAAS,WAAmB,CAC1B,QACA,QACwB;AAAA,EACxB,MAAM,OAA+B,KAAK,OAAO;AAAA,EACjD,WAAW,OAAO;AAAA,IAAQ,OAAO,KAAK;AAAA,EACtC,OAAO;AAAA;;;AC1HF,SAAS,6BAA6B,CAC3C,WAC8B;AAAA,EAG9B,MAAM,eAAe,IAAI;AAAA,EACzB,MAAM,QAAQ,CAAC,kBAAgE;AAAA,IAC7E,MAAM,UAAU,OAAO,OAAO,CAAC,CAAC;AAAA,IAChC,aAAa,IAAI,SAAS,OAAO,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;AAAA,IAC3D,OAAO;AAAA;AAAA,EAGT,MAAM,UAAU,CAAC,UAAwD;AAAA,IACvE,MAAM,gBAAgB,aAAa,IAAI,KAAK;AAAA,IAC5C,IAAI,CAAC,eAAe;AAAA,MAClB,MAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AAAA,IACA,OAAO;AAAA;AAAA,EAGT,MAAM,QAAQ,MAAM,CAAC,CAAC;AAAA,EAEtB,MAAM,YAA0C;AAAA,IAC9C,OAAO,MAAM;AAAA,IAEb,QAAQ,CAAC,WAAW;AAAA,MAClB,OAAO,MAAM,MAAM,OAAO,aAAa;AAAA,SACpC,OAAO,oBAAoB,WAAW,MAAM,OAAO,aAAa,CAAC;AAAA,IACtE;AAAA,IACA,MAAM,CAAC,UAAU;AAAA,MAEf,MAAM,gBACJ,MAAM,cAAc,aAChB,QAAQ,MAAM,KAAK,IACnB;AAAA,QACE,GAAG,MAAM,OAAO;AAAA,QAChB,GAAI,MAAM,qBAAqB,CAAC,MAAM,kBAAkB,IAAI,CAAC;AAAA,MAC/D;AAAA,MAEN,MAAM,OAAO,cACV,IAAI,CAAC,iBAAiB,UAAU,eAAe,cAAc,MAAM,MAAM,CAAC,EAC1E,KAAK,CAAC,eAAe,eAAe,SAAS;AAAA,MAEhD,OAAO;AAAA,QACL,OAAO,MAAM,MAAM,OAAO,aAAa;AAAA,WACpC,OAAO,QAAQ,oBAAoB,WAAW,MAAM,OAAO,aAAa,CAAC;AAAA,MAC9E;AAAA;AAAA,IAGF,KAAK,CAAC,UACJ,MAAM,OAAO,aACR,MAAM,OAAO,MAAM,QACpB,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,OAAO,QAAQ,OAAO,CAAC,CAAC,CAAC;AAAA,IACvD,UAAU,CAAC,UAAU;AAAA,MACnB,IAAI,MAAM,QAAQ;AAAA,QAAW;AAAA,MAE7B,MAAM,gBACJ,MAAM,iBAAiB,YAAY,QAAQ,MAAM,KAAK,IAAI,CAAC,MAAM,YAAY;AAAA,MAC/E,WAAW,gBAAgB,eAAe;AAAA,QACxC,MAAM,UAAU,UAAU,eAAe,cAAc,MAAM,UAAU;AAAA,QACvE,IAAI,YAAY;AAAA,UAAW;AAAA,QAC3B,OAAO,IAAI,oBACT,qBAAqB,WACrB,iBAAiB,mBAAmB,MAAM,SAAS,gBAAgB,MAAM,mBAAmB,MAAM,6CAA6C,WACjJ;AAAA,MACF;AAAA,MAEA;AAAA;AAAA,EAEJ;AAAA,EAEA,OAAO,OAAO,OAAO,SAAS;AAAA;AAGhC,SAAS,mBAAmB,CAC1B,WACA,eACwB;AAAA,EACxB,WAAW,gBAAgB,eAAe;AAAA,IACxC,MAAM,aAAa,UAAU,eAAe,YAAY;AAAA,IACxD,IAAI;AAAA,MAAY,OAAO;AAAA,EACzB;AAAA,EACA;AAAA;AAGF,SAAS,MAAM,CAAC,YAAiE;AAAA,EAC/E,OAAO,aAAa,EAAE,QAAQ,gBAAgB,UAAU,EAAE,IAAI,CAAC;AAAA;AAGjE,IAAM,qBAAuE;AAAA,EAC3E,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,OAAO;AACT;;;AClGO,SAAS,uBAAuB,CAAC,OAO/B;AAAA,EACP,QAAQ,UAAU,cAAc;AAAA,EAChC,QAAQ,OAAO,UAAU,UAAU,WAAW;AAAA,EAC9C,IAAI,MAAM,SAAS,KAAK,MAAM,WAAW;AAAA,IAAG;AAAA,EAE5C,MAAM,YAAY,0BAChB,KAAK,MAAM,SAAS,OAAO,MAAM,MAAM,GACvC,EAAE,SAAS,CACb;AAAA,EAEA,MAAM,WAAW,UAAU,UAAU,OAAO;AAAA,EAC5C,MAAM,WAAW,UAAU,cAAc;AAAA,EACzC,MAAM,WAAW,UAAU,cAAc;AAAA,EAEzC,MAAM,QAAQ,CAAC,WAAmB,UAAU,WAAW,aAAa,UAAU,WAAW;AAAA,EACzF,MAAM,UAAU,CAAC,UAAsC,kBACpD,OAAO,aAAa,WAAW,CAAC,QAAQ,IAAI,UAAU,KAAK,CAAC,WAC3D,SAAS,kBAAkB,QAAQ,YAAY,CACjD;AAAA,EAEF,WAAW,QAAQ,OAAO;AAAA,IACxB,IAAI,CAAC,MAAM,KAAK,MAAM;AAAA,MAAG;AAAA,IACzB,IACG,YAAY,SAAS,SAAS,KAAK,YAAY,KAC/C,YAAY,SAAS,KAAK,CAAC,OAAO,QAAQ,KAAK,oBAAoB,EAAE,CAAC,GACvE;AAAA,MACA,MAAM,gBAAgB,IAAI;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ,MAAM,iBAAiB,EAAE,CAAC;AAAA,EACrE,IAAI,OAAO,WAAW;AAAA,IAAG;AAAA,EAEzB,WAAW,cAAc,SAAS,gBAAgB,GAAG;AAAA,IACnD,WAAW,QAAQ,WAAW,OAAO;AAAA,MACnC,IAAI,CAAC,MAAM,KAAK,EAAE;AAAA,QAAG;AAAA,MACrB,IAAI,YAAY,SAAS,SAAS,WAAW,EAAE,GAAG;AAAA,QAChD,MAAM,QAAQ,OAAO,KAAK,EAAE,QAAQ,QAAQ,KAAK,oBAAoB,EAAE,CAAC;AAAA,QACxE,IAAI;AAAA,UAAO,MAAM,gBAAgB,MAAM,EAAE;AAAA,MAC3C;AAAA,MAEA,MAAM,SAAS,MAAM,IAAI,WAAW,EAAE;AAAA,MACtC,IACE,YACA,UACA,MAAM,iBAAiB,WAAW,EAAE,KACpC,SAAS,KAAK,CAAC,OAAO,QAAQ,KAAK,oBAAoB,EAAE,CAAC,GAC1D;AAAA,QACA,MAAM,gBAAgB,MAAM;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA;;;ACvEF,IAAM,yCAAyC;AAC/C,IAAM,yCAAyC;AAC/C,IAAM,uDAAuD;AAAA;AAc7D,MAAM,8CAA8C,MAAM;AAAA,EAK7C;AAAA,EACA;AAAA,EALF,OAAO;AAAA,EACP,OAAO;AAAA,EAEhB,WAAW,CACA,QACA,OACT;AAAA,IACA,MAAM,mDAAmD,iBAAiB,SAAS;AAAA,IAH1E;AAAA,IACA;AAAA;AAIb;AAGO,SAAS,iCAAiC,CAC/C,OACA,WAC+B;AAAA,EAC/B,MAAM,cAAc,MAAM;AAAA,EAC1B,MAAM,iBAAiB,MAAM;AAAA,EAC7B,IAAI,CAAC,OAAO,cAAc,WAAW,KAAK,cAAc,GAAG;AAAA,IACzD,MAAM,IAAI,MAAM,+EAA+E;AAAA,EACjG;AAAA,EACA,IACE,mBAAmB,cAClB,CAAC,OAAO,cAAc,cAAc,KAAK,iBAAiB,IAC3D;AAAA,IACA,MAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AAAA,EAEA,IAAI,CAAC,WAAW;AAAA,IACd,MAAM,YACJ,mBAAmB,YAAY,CAAC,IAAI,EAAE,eAAe;AAAA,IACvD,OAAO,OAAO,OAAO,SAAS;AAAA,EAChC;AAAA,EACA,IAAI,cAAc,wCAAwC;AAAA,IACxD,MAAM,IAAI,sCACR,UACA,sCACF;AAAA,EACF;AAAA,EACA,IAAI,gBAAgB,GAAG;AAAA,IACrB,OAAO,OAAO,OAAO;AAAA,SACf,mBAAmB,YAAY,CAAC,IAAI,EAAE,eAAe;AAAA,MACzD,qBAAqB;AAAA,IACvB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,oBAAoB,KAAK,MAAM,yCAAyC,WAAW;AAAA,EACzF,MAAM,0BACJ,kBACA,KAAK,IAAI,sDAAsD,iBAAiB;AAAA,EAClF,IAAI,0BAA0B,mBAAmB;AAAA,IAC/C,MAAM,IAAI,sCACR,UACA,sCACF;AAAA,EACF;AAAA,EAEA,OAAO,OAAO,OAAO;AAAA,IACnB,gBAAgB;AAAA,IAChB,qBAAqB;AAAA,EACvB,CAAC;AAAA;;;ACxBI,SAAS,4BAA4B,CAAC,OAIlB;AAAA,EACzB,MAAM,iBAAiB,MAAM,SAAS,gBAAgB;AAAA,EACtD,MAAM,0BAA0B,IAAI,IAAI,eAAe,IAAI,CAAC,eAAe,WAAW,EAAE,CAAC;AAAA,EACzF,MAAM,yBAAyB,sBAAsB,MAAM,WAAW,cAAc;AAAA,EACpF,MAAM,uBAAuB,IAAI,IAC/B,CAAC,GAAG,sBAAsB,EAAE,OAAO,CAAC,iBAAiB,wBAAwB,IAAI,YAAY,CAAC,CAChG;AAAA,EACA,MAAM,iBACJ,MAAM,UAAU,SAAS,aAAa,sBAAsB,MAAM,UAAU,KAAK,IAAI;AAAA,EACvF,MAAM,uBAAuD,CAAC;AAAA,EAE9D,WAAW,cAAc,gBAAgB;AAAA,IACvC,IAAI,CAAC,qBAAqB,IAAI,WAAW,EAAE;AAAA,MAAG;AAAA,IAC9C,MAAM,cACJ,gBAAgB,wBAAwB,IAAI,WAAW,EAAE,KACzD,IAAI,IAAI,WAAW,WAAW,IAAI,CAAC,aAAa,SAAS,EAAE,CAAC;AAAA,IAC9D,MAAM,QAAQ,iBACT,eAAe,kBAAkB,IAAI,WAAW,EAAE,KAAK,IAAI,MAC5D,MAAM,UAAU,SAAS,QACvB,iBAAiB,UAAU,IAC3B,gBAAgB,MAAM,UAAU,YAAY,oBAAoB;AAAA,IACtE,qBAAqB,KACnB,kBAAkB;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,YACE,MAAM,UAAU,SAAS,QACrB,aACA,MAAM,UAAU,SAAS,UACvB,cACA;AAAA,MACR,iBAAiB,MAAM,UAAU,SAAS;AAAA,IAC5C,CAAC,CACH;AAAA,EACF;AAAA,EAEA,MAAM,cAAc;AAAA,EACpB,MAAM,kBAAkB,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,CAAC,WAAW,IAAI,UAAU,CAAC,CAAC;AAAA,EAC5F,MAAM,iBACJ,MAAM,UAAU,SAAS,aACrB,yBAAyB,MAAM,SAAS,kBAAkB,GAAG,WAAW,IACxE,sBAAsB,MAAM,SAAS,kBAAkB,CAAC;AAAA,EAC9D,MAAM,UAAU,CAAI,OAAU,cAAuB,UAAa;AAAA,IAChE,MAAM,0BAA0B,WAAW;AAAA,IAC3C,OAAO;AAAA;AAAA,EAET,MAAM,kBAAkB,CAAC,eAA6C,gBAAgB,UAAU;AAAA,EAChG,MAAM,kBAAkB,MACtB,IAAI,IACF,CAAC,GAAG,cAAc,EAAE,IAAI,EAAE,aAAa,eAAe;AAAA,IACpD;AAAA,IACA,gBAAgB,SAAS;AAAA,EAC3B,CAAC,CACH;AAAA,EAEF,OAAO,OAAO,OAAO;AAAA,IACnB,iBAAiB,MAAM,QAAQ,YAAY,IAAI,eAAe,CAAC;AAAA,IAC/D,mBAAmB,CAAC,iBAAyB;AAAA,MAC3C,MAAM,aAAa,gBAAgB,IAAI,YAAY;AAAA,MACnD,OAAO,QAAQ,aAAa,gBAAgB,UAAU,IAAI,IAAI;AAAA;AAAA,IAEhE,mBAAmB,CAAC,iBAAyB;AAAA,MAC3C,MAAM,aAAa,gBAAgB,IAAI,YAAY;AAAA,MACnD,OAAO,aAAa,QAAQ,gBAAgB,UAAU,CAAC,IAAI,kBAAkB,YAAY;AAAA;AAAA,IAE3F,mBAAmB,MAAM;AAAA,MACvB,MAAM,aAAa,gBAAgB;AAAA,MACnC,OAAO,QAAQ,YAAY,CAAC,GAAG,WAAW,QAAQ,CAAC,CAAC;AAAA;AAAA,IAEtD,sBAAsB,CAAC,iBAAyB;AAAA,MAC9C,MAAM,aAAa,gBAAgB,IAAI,YAAY;AAAA,MACnD,IAAI,CAAC;AAAA,QAAY,OAAO,kBAAkB,YAAY;AAAA,MACtD,MAAM,UAAU,WAAW,WAAW,KAAK,CAAC,aAAa,SAAS,OAAO;AAAA,MACzE,IAAI,CAAC,SAAS;AAAA,QACZ,MAAM,IAAI,yBACR,uBAAuB,6EACzB;AAAA,MACF;AAAA,MACA,OAAO,QAAQ,QAAQ,EAAE;AAAA;AAAA,IAE3B,cAAc,CAAC,iBAAyB;AAAA,MACtC,MAAM,WAAW,qBAAqB,IAAI,YAAY,IAClD,MAAM,SACH,aAAa,YAAY,EACzB,OAAO,CAAC,cAAc,qBAAqB,IAAI,SAAS,CAAC,IAC5D,CAAC;AAAA,MACL,OAAO,QAAQ,QAAQ;AAAA;AAAA,IAEzB,mBAAmB,CAAC,UAA6B,WAAmB;AAAA,MAClE,IAAI,MAAM,UAAU,SAAS,OAAO;AAAA,QAClC,OAAO,QAAQ,MAAM,SAAS,kBAAkB,UAAU,MAAM,CAAC;AAAA,MACnE;AAAA,MACA,IAAI,CAAC,qBAAqB,IAAI,MAAM;AAAA,QAAG,OAAO,QAAQ,KAAK;AAAA,MAC3D,MAAM,gBAAgB,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ;AAAA,MACpE,IAAI,MAAM,UAAU,SAAS,YAAY;AAAA,QACvC,OAAO,QACL,cAAc,KAAK,CAAC,iBAAiB,iBAAiB,OAAO,iBAAiB,MAAM,CACtF;AAAA,MACF;AAAA,MACA,OAAO,QACL,cAAc,KACZ,CAAC,iBACC,iBAAiB,OAChB,qBAAqB,IAAI,YAAY,KACpC,MAAM,SAAS,kBAAkB,cAAc,MAAM,CAC3D,CACF;AAAA;AAAA,EAEJ,CAAC;AAAA;AAGH,SAAS,qBAAqB,CAC5B,WACA,gBACqB;AAAA,EACrB,QAAQ,UAAU;AAAA,SACX;AAAA,MACH,OAAO,IAAI,IAAI,eAAe,IAAI,CAAC,eAAe,WAAW,EAAE,CAAC;AAAA,SAC7D;AAAA,MACH,OAAO,IAAI,IAAI,UAAU,aAAa;AAAA,SACnC;AAAA,MACH,OAAO,IAAI,IAAI,UAAU,MAAM,QAAQ,IAAI,CAAC,WAAW,OAAO,YAAY,CAAC;AAAA;AAAA;AAIjF,SAAS,qBAAqB,CAAC,OAAwD;AAAA,EACrF,MAAM,0BAA0B,IAAI;AAAA,EACpC,WAAW,UAAU,MAAM,SAAS;AAAA,IAClC,MAAM,aAAa,wBAAwB,IAAI,OAAO,YAAY,KAAK,IAAI;AAAA,IAC3E,WAAW,cAAc,OAAO;AAAA,MAAa,WAAW,IAAI,UAAU;AAAA,IACtE,wBAAwB,IAAI,OAAO,cAAc,UAAU;AAAA,EAC7D;AAAA,EAEA,MAAM,oBAAoB,IAAI;AAAA,EAC9B,WAAW,QAAQ,MAAM,OAAO;AAAA,IAC9B,MAAM,QAAQ,kBAAkB,IAAI,KAAK,kBAAkB,KAAK,IAAI;AAAA,IACpE,MAAM,WAAW,MAAM,IAAI,KAAK,MAAM,KAAK;AAAA,MACzC,qBAAqB,IAAI;AAAA,MACzB,aAAa,IAAI;AAAA,IACnB;AAAA,IACA,SAAS,oBAAoB,IAAI,KAAK,kBAAkB;AAAA,IACxD,WAAW,cAAc,KAAK;AAAA,MAAa,SAAS,YAAY,IAAI,UAAU;AAAA,IAC9E,MAAM,IAAI,KAAK,QAAQ,QAAQ;AAAA,IAC/B,kBAAkB,IAAI,KAAK,oBAAoB,KAAK;AAAA,EACtD;AAAA,EAEA,OAAO,EAAE,yBAAyB,kBAAkB;AAAA;AAGtD,SAAS,gBAAgB,CACvB,YACoC;AAAA,EACpC,OAAO,IAAI,IACT,WAAW,MAAM,IAAI,CAAC,SAAS;AAAA,IAC7B,KAAK;AAAA,IACL;AAAA,MACE,qBAAqB,IAAI,IACvB,OAAO,KAAK,uBAAuB,WAC/B,CAAC,KAAK,kBAAkB,IACxB,KAAK,kBACX;AAAA,MACA,aAAa,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,aAAa,SAAS,EAAE,KAAK,CAAC,CAAC;AAAA,IAC5E;AAAA,EACF,CAAC,CACH;AAAA;AAGF,SAAS,eAAe,CACtB,UACA,YACA,sBACoC;AAAA,EACpC,MAAM,QAAQ,IAAI;AAAA,EAClB,WAAW,QAAQ,WAAW,OAAO;AAAA,IACnC,MAAM,sBAAsB,IAAI,IAC9B,CAAC,GAAG,oBAAoB,EAAE,OAAO,CAAC,uBAChC,SAAS,kBAAkB,KAAK,oBAAoB,kBAAkB,CACxE,CACF;AAAA,IACA,IAAI,oBAAoB,SAAS;AAAA,MAAG;AAAA,IACpC,MAAM,IAAI,KAAK,IAAI;AAAA,MACjB;AAAA,MACA,aAAa,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,aAAa,SAAS,EAAE,KAAK,CAAC,CAAC;AAAA,IAC5E,CAAC;AAAA,EACH;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,iBAAiB,CAAC,OAQM;AAAA,EAC/B,MAAM,aAAa,MAAM,WAAW,WACjC,OAAO,CAAC,aAAa,MAAM,YAAY,IAAI,SAAS,EAAE,CAAC,EACvD,IAAI,gBAAgB;AAAA,EACvB,MAAM,qBAAqB,IAAI,IAAI,WAAW,IAAI,CAAC,aAAa,SAAS,EAAE,CAAC;AAAA,EAC5E,MAAM,QAAQ,MAAM,WAAW,MAAM,QAAQ,CAAC,SAAuB;AAAA,IACnE,MAAM,WAAW,MAAM,MAAM,IAAI,KAAK,EAAE;AAAA,IACxC,IAAI,CAAC;AAAA,MAAU,OAAO,CAAC;AAAA,IACvB,IAAI,MAAM,eAAe,YAAY;AAAA,MACnC,OAAO,CAAC,aAAa,MAAM,mBAAmB,KAAK,kBAAkB,GAAG,SAAS,WAAW,CAAC;AAAA,IAC/F;AAAA,IACA,MAAM,sBAAsB,IAAI,IAC9B,CAAC,GAAG,SAAS,mBAAmB,EAAE,OAChC,CAAC,uBACC,MAAM,qBAAqB,IAAI,kBAAkB,KACjD,MAAM,SAAS,kBAAkB,KAAK,oBAAoB,kBAAkB,CAChF,CACF;AAAA,IACA,IAAI,oBAAoB,SAAS;AAAA,MAAG,OAAO,CAAC;AAAA,IAC5C,MAAM,SACJ,MAAM,eAAe,cACjB,qBAAqB,MAAM,qBAAqB,MAAM,oBAAoB,IAC1E,iBAAiB,mBAAmB;AAAA,IAC1C,OAAO,CAAC,aAAa,MAAM,QAAQ,SAAS,aAAa,EAAE,qBAAqB,KAAK,CAAC,CAAC;AAAA,GACxF;AAAA,EAGD,MAAM,YAAwB;AAAA,IAC5B,IAAI,MAAM,WAAW;AAAA,IACrB,MAAM,MAAM,WAAW;AAAA,IACvB,aAAa,MAAM,WAAW;AAAA,IAC9B,cAAc,MAAM,WAAW;AAAA,IAC/B,SAAS,MAAM,WAAW,UAAU,CAAC,GAAG,MAAM,WAAW,OAAO,IAAI;AAAA,IACpE,SACE,MAAM,WAAW,WAAW,MAAM,qBAAqB,IAAI,MAAM,WAAW,OAAO,IAC/E,MAAM,WAAW,UACjB;AAAA,IACN,SAAS,mBACP,MAAM,WAAW,SACjB,MAAM,sBACN,MAAM,eAAe,UACvB;AAAA,IACA,YACE,MAAM,mBAAmB,MAAM,WAAW,aACtC,CAAC,GAAG,MAAM,WAAW,UAAU,IAC/B;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ,cAAc,MAAM,WAAW,QAAQ,oBAAoB;AAAA,MACjE,eAAe,MAAM,eAAe;AAAA,IACtC,CAAC;AAAA,EACH;AAAA,EACA,MAAM,aAAa;AAAA,OACd;AAAA,IACH,GAAG,wBAAuB,SAAS;AAAA,IACnC,GAAG,oBAAmB,SAAS;AAAA,EACjC;AAAA,EACA,OAAO,WAAW,UAAU;AAAA;AAG9B,SAAS,oBAAoB,CAC3B,MACA,4BACA,sBACmB;AAAA,EACnB,IAAI,KAAK,uBAAuB;AAAA,IAAK,OAAO,iBAAiB,0BAA0B;AAAA,EACvF,MAAM,WAAW,MAAM,QAAQ,KAAK,kBAAkB,IAClD,KAAK,qBACL,CAAC,KAAK,kBAAkB;AAAA,EAC5B,IAAI,SAAS,MAAM,CAAC,iBAAiB,qBAAqB,IAAI,YAAY,CAAC,GAAG;AAAA,IAC5E,OAAO,mBAAmB,KAAK,kBAAkB;AAAA,EACnD;AAAA,EACA,OAAO,iBAAiB,0BAA0B;AAAA;AAGpD,SAAS,gBAAgB,CAAC,qBAA6D;AAAA,EACrF,MAAM,UAAU,CAAC,GAAG,mBAAmB,EAAE,KAAK;AAAA,EAC9C,OAAO,QAAQ,WAAW,IAAI,QAAQ,KAAM;AAAA;AAG9C,SAAS,kBAAkB,CACzB,KACA,sBACA,kBACsB;AAAA,EACtB,IAAI,CAAC;AAAA,IAAK;AAAA,EACV,IAAI;AAAA,IAAkB,OAAO,CAAC,GAAG,GAAG;AAAA,EACpC,MAAM,UAAU,IAAI,OAAO,CAAC,OAAO,qBAAqB,IAAI,EAAE,CAAC;AAAA,EAC/D,OAAO,QAAQ,SAAS,IAAI,UAAU;AAAA;AAGxC,SAAS,YAAY,CACnB,MACA,oBACA,aACA,UAAsD,CAAC,GAC3C;AAAA,EACZ,MAAM,aAAa,KAAK,YACpB,OAAO,CAAC,aAAa,YAAY,IAAI,SAAS,EAAE,CAAC,EAClD,IAAI,gBAAgB;AAAA,EACvB,OAAO;AAAA,IACL,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,aAAa,KAAK;AAAA,IAClB;AAAA,IACA,aAAa,KAAK;AAAA,IAClB,YAAY,QAAQ,uBAAuB,YAAY,WAAW,IAAI,YAAY;AAAA,EACpF;AAAA;AAGF,SAAS,kBAAkB,CAAC,QAAuD;AAAA,EACjF,OAAO,OAAO,WAAW,WAAW,SAAS,CAAC,GAAG,MAAM;AAAA;AAGzD,SAAS,gBAAgB,CAAC,UAA8B;AAAA,EACtD,OAAO;AAAA,IACL,IAAI,SAAS;AAAA,IACb,MAAM,SAAS;AAAA,IACf,QAAQ,eAAe,SAAS,MAAM;AAAA,IACtC,aAAa,SAAS;AAAA,IACtB,UAAU,SAAS;AAAA,IACnB,UAAU,SAAS;AAAA,IACnB,SAAS,SAAS;AAAA,IAClB,QAAQ,SAAS;AAAA,IACjB,MAAM,SAAS;AAAA,IACf,cAAc,SAAS;AAAA,IACvB,OAAO,sBAAsB,SAAS,KAAK;AAAA,EAC7C;AAAA;AAGF,SAAS,qBAAqB,CAC5B,OACmC;AAAA,EACnC,IAAI,CAAC;AAAA,IAAO;AAAA,EACZ,OAAO;AAAA,IACL,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM;AAAA,IAClB,UAAU,MAAM;AAAA,IAChB,MAAM,MAAM;AAAA,IACZ,OAAO,MAAM;AAAA,IACb,OAAO,MAAM;AAAA,IACb,QAAQ,MAAM;AAAA,EAChB;AAAA;AAGF,SAAS,aAAa,CACpB,QACA,oBACA,SACsC;AAAA,EACtC,IAAI,CAAC;AAAA,IAAQ;AAAA,EACb,MAAM,QAAQ,OAAO,SAAS,mBAAmB,IAAI,OAAO,KAAK,IAAI,OAAO,QAAQ;AAAA,EACpF,MAAM,sBAAsB,OAAO,aAAa,OAAO,CAAC,eACtD,mBAAmB,IAAI,UAAU,CACnC;AAAA,EACA,MAAM,gBAAgB,OAAO,OAAO,OAAO,CAAC,eAAe,mBAAmB,IAAI,UAAU,CAAC;AAAA,EAC7F,MAAM,cACJ,QAAQ,iBAAiB,qBAAqB,SAAS,sBAAsB;AAAA,EAC/E,MAAM,QAAQ,QAAQ,iBAAiB,eAAe,SAAS,gBAAgB;AAAA,EAC/E,MAAM,UACJ,OAAO,YAAY,YACf,YACA,uBACE,OAAO,YACL,OAAO,QAAQ,OAAO,OAAO,EAAE,OAAO,IAAI,aACxC,QAAQ,OAAO,MAAM,CAAC,OAAO,mBAAmB,IAAI,EAAE,CAAC,CACzD,CACF,CACF;AAAA,EACN,MAAM,YAAsC;AAAA,OACtC,YAAY,aAAa,OAAO,KAAK,OAAO,EAAE,WAAW,IAAI,CAAC,IAAI,EAAE,QAAQ;AAAA,OAC5E,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM;AAAA,OACnC,gBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY;AAAA,OAC/C,UAAU,YAAY,CAAC,IAAI,EAAE,MAAM;AAAA,EACzC;AAAA,EACA,OAAO,OAAO,KAAK,SAAS,EAAE,SAAS,KAAK,QAAQ,gBAAgB,YAAY;AAAA;AAGlF,SAAS,qBAAqB,CAC5B,YACgC;AAAA,EAChC,OAAO,IAAI,IACT,CAAC,GAAG,WAAW,OAAO,CAAC,EAAE,IAAI,CAAC,cAAc;AAAA,IAC1C,MAAM,WAAW,kBAAkB,SAAS;AAAA,IAC5C,OAAO,CAAC,SAAS,IAAI,QAAQ;AAAA,GAC9B,CACH;AAAA;AAGF,SAAS,wBAAwB,CAC/B,YACA,aACgC;AAAA,EAChC,MAAM,gBAAgB,IAAI;AAAA,EAC1B,MAAM,iBAA2B,CAAC;AAAA,EAClC,MAAM,iBAAiB,IAAI;AAAA,EAC3B,WAAW,cAAc,aAAa;AAAA,IACpC,WAAW,YAAY,WAAW;AAAA,MAAY,eAAe,KAAK,SAAS,MAAM;AAAA,IACjF,WAAW,QAAQ,WAAW,OAAO;AAAA,MACnC,WAAW,YAAY,KAAK,cAAc,CAAC;AAAA,QAAG,eAAe,KAAK,SAAS,MAAM;AAAA,IACnF;AAAA,EACF;AAAA,EAEA,OAAO,eAAe,SAAS,GAAG;AAAA,IAChC,MAAM,SAAS,eAAe,IAAI;AAAA,IAClC,IAAI,OAAO,WAAW,YAAY,eAAe,IAAI,MAAM;AAAA,MAAG;AAAA,IAC9D,eAAe,IAAI,MAAM;AAAA,IACzB,IAAI,OAAO,SAAS,gBAAgB;AAAA,MAClC,IAAI,CAAC,cAAc,IAAI,OAAO,WAAW,GAAG;AAAA,QAC1C,cAAc,IAAI,OAAO,WAAW;AAAA,QACpC,MAAM,YAAY,WAAW,IAAI,OAAO,WAAW;AAAA,QACnD,IAAI;AAAA,UAAW,eAAe,KAAK,UAAU,MAAM;AAAA,MACrD;AAAA,MACA,IAAI,OAAO;AAAA,QAAW,eAAe,KAAK,OAAO,SAAS;AAAA,IAC5D,EAAO,SAAI,OAAO,SAAS,UAAU;AAAA,MACnC,WAAW,SAAS,OAAO,OAAO,OAAO,UAAU;AAAA,QAAG,eAAe,KAAK,MAAM,MAAM;AAAA,IACxF,EAAO,SAAI,OAAO,SAAS,SAAS;AAAA,MAClC,eAAe,KAAK,OAAO,KAAK;AAAA,IAClC,EAAO,SAAI,OAAO,SAAS,OAAO;AAAA,MAChC,eAAe,KAAK,OAAO,WAAW;AAAA,IACxC;AAAA,EACF;AAAA,EAEA,OAAO,IAAI,IACT,CAAC,GAAG,aAAa,EACd,IAAI,CAAC,gBAAgB,WAAW,IAAI,WAAW,CAAC,EAChD,OAAO,CAAC,cAAsC,cAAc,SAAS,EACrE,IAAI,CAAC,cAAc;AAAA,IAClB,MAAM,WAAW,kBAAkB,SAAS;AAAA,IAC5C,OAAO,CAAC,SAAS,IAAI,QAAQ;AAAA,GAC9B,CACL;AAAA;AAGF,SAAS,iBAAiB,CAAC,WAAiC;AAAA,EAC1D,OAAO,WAAW;AAAA,IAChB,IAAI,UAAU;AAAA,IACd,MAAM,UAAU;AAAA,IAChB,aAAa,UAAU;AAAA,IACvB,QAAQ,eAAe,UAAU,MAAM;AAAA,IACvC,cAAc,UAAU;AAAA,EAC1B,CAAC;AAAA;AAGH,SAAS,cAAc,CAAC,QAAwB;AAAA,EAC9C,OAAO,WAAW,gBAAgB,MAAM,CAAC;AAAA;AAG3C,SAAS,UAAa,CAAC,OAAU,OAAoB,IAAI,KAAU;AAAA,EACjE,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,KAAK,IAAI,KAAK;AAAA,IAAG,OAAO;AAAA,EAC3E,KAAK,IAAI,KAAK;AAAA,EACd,WAAW,OAAO,QAAQ,QAAQ,KAAK,GAAG;AAAA,IACxC,MAAM,aAAa,OAAO,yBAAyB,OAAO,GAAG;AAAA,IAC7D,IAAI,cAAc,WAAW;AAAA,MAAY,WAAW,WAAW,OAAO,IAAI;AAAA,EAC5E;AAAA,EACA,OAAO,OAAO,OAAO,KAAK;AAAA;AAG5B,SAAS,iBAAiB,CAAC,cAA6B;AAAA,EACtD,MAAM,IAAI,uBAAsB,+BAA+B,YAAY,CAAC;AAAA;;;ACzfvE,MAAM,qBAAqB;AAAA,EACvB;AAAA,EACA;AAAA,EACT;AAAA,EAEA,WAAW,CAAC,UAA4B,UAAgC;AAAA,IACtE,KAAK,WAAW;AAAA,IAChB,KAAK,YAAY;AAAA,IACjB,OAAO,OAAO,IAAI;AAAA;AAAA,EAIpB,IAAI,GAA2B;AAAA,IAC7B,MAAM,YAAY,KAAK,UAAU;AAAA,IACjC,KAAK,UAAU,6BAA6B;AAAA,MAC1C,UAAU,KAAK;AAAA,MACf,WAAW,sBAAsB,KAAK,WAAW,KAAK,QAAQ;AAAA,SAC1D,UAAU,SAAS,cACnB;AAAA,QACE,yBAAyB,CAAC,UACxB,mCAAkC,OAAO,UAAU,WAAW,MAAM;AAAA,MACxE,IACA,CAAC;AAAA,IACP,CAAC;AAAA,IACD,OAAO,KAAK;AAAA;AAEhB;AAEA,SAAS,qBAAqB,CAC5B,UACA,UAC6B;AAAA,EAC7B,MAAM,YAAY,SAAS;AAAA,EAE3B,QAAQ,UAAU;AAAA,SACX;AAAA,MACH,OAAO,EAAE,MAAM,MAAM;AAAA,SAClB;AAAA,MACH,OAAO;AAAA,QACL,MAAM;AAAA,QACN,eAAe,SACZ,gBAAgB,EAEhB,OAAO,CAAC,eAAe,SAAS,oBAAoB,WAAW,IAAI,SAAS,CAAC,EAC7E,IAAI,CAAC,eAAe,WAAW,EAAE;AAAA,MACtC;AAAA,SACG;AAAA,MACH,OAAO,EAAE,MAAM,YAAY,OAAO,UAAU,WAAW,MAAM;AAAA;AAAA;;;AC3CnE,IAAM,qBAAqB,OAAO,4CAA4C;AA+BvE,SAAS,kCAAkC,CAChD,OAC8B;AAAA,EAC9B,MAAM,iBAAiB,IAAI;AAAA,EAC3B,MAAM,mBAAmB,IAAI;AAAA,EAC7B,MAAM,wBAAwB,IAAI;AAAA,EAElC,WAAW,aAAa,MAAM,SAAS;AAAA,IACrC,MAAM,MAAM,aAAa,UAAU,QAAQ,UAAU,YAAY;AAAA,IACjE,eAAe,IAAI,KAAK,SAAS;AAAA,IACjC,sBAAsB,IAAI,KAAK,IAAI,IAAI,UAAU,WAAW,CAAC;AAAA,IAC7D,MAAM,SAAS,iBAAiB,IAAI,UAAU,YAAY,KAAK,CAAC;AAAA,IAChE,OAAO,KAAK,SAAS;AAAA,IACrB,iBAAiB,IAAI,UAAU,cAAc,MAAM;AAAA,EACrD;AAAA,EAEA,MAAM,WAAW,WAAW,MAAM,OAAO,YAAY,cAAc;AAAA,EACnE,MAAM,WAAW,WAAW,MAAM,OAAO,YAAY,cAAc;AAAA,EACnE,MAAM,aAAa,cAAc,CAAC,CAAC;AAAA,EAEnC,MAAM,YAA0C;AAAA,IAC9C,OAAO,MAAM;AAAA,IACb,QAAQ,CAAC,UAAU;AAAA,MACjB,MAAM,aAAa,MAAM,OAAO,cAAc,QAC5C,CAAC,iBAAiB,iBAAiB,IAAI,YAAY,KAAK,CAAC,CAC3D;AAAA,MACA,MAAM,QAAQ,cAAc,UAAU;AAAA,MAEtC,IAAI,MAAM,SAAS,QAAQ;AAAA,QACzB,MAAM,cAAc,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,IAAI,CAAC,QAAQ,IAAI,YAAY,KAAK,CAAC,CAAC,CAAC,EAC9E,KAAK,EACL,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,IAAI,YAAY,CAAC;AAAA,QAC7D,IAAI,aAAa;AAAA,UACf,OAAO,QACL,OACA,IAAI,oBACF,eAAe,eACf,wDAAwD,oBAAoB,MAAM,8DACpF,CACF;AAAA,QACF;AAAA,MACF;AAAA,MAEA,IAAI,MAAM,WAAW,SAAS;AAAA,QAAG,OAAO,EAAE,MAAM;AAAA,MAChD,MAAM,eAAe,MAAM,gBAAgB,MAAM,OAAO,cAAc,MAAM;AAAA,MAC5E,OAAO,QACL,OACA,IAAI,oBACF,eAAe,gBACf,yDAAyD,qBAAqB,MAAM,8DACtF,CACF;AAAA;AAAA,IAEF,UAAU,CAAC,UACT,eACE,gBAAgB,MAAM,KAAK,GAC3B,MAAM,YACN,MAAM,cACN,MAAM,KACN,MAAM,MACN,qBACF;AAAA,IACF,MAAM,CAAC,UAAU;AAAA,MACf,MAAM,QAAQ,gBAAgB,MAAM,KAAK;AAAA,MACzC,MAAM,OAAO,WACX,OACA,MAAM,QACN,MAAM,WACN,MAAM,oBACN,UACA,UACA,MAAM,OAAO,aACf;AAAA,MACA,IAAI,KAAK,WAAW,SAAS,KAAK,MAAM,WAAW,WAAW;AAAA,QAAG,OAAO,EAAE,OAAO,KAAK;AAAA,MACtF,OAAO,QACL,MACA,WACE,OACA,MAAM,QACN,MAAM,WACN,MAAM,oBACN,MAAM,KACN,MAAM,IACR,CACF;AAAA;AAAA,IAEF,KAAK,GAAG,IAAI,aAAa;AAAA,MACvB,IAAI,OAAO;AAAA,QAAY,OAAO,gBAAgB,OAAO,MAAM,UAAU;AAAA,MACrE,OAAO,cAAc,OAAO,QAAQ,CAAC,UAAU,gBAAgB,KAAK,EAAE,UAAU,CAAC;AAAA;AAAA,IAEnF,wBAAwB,CAAC,UAAU;AAAA,MACjC,MAAM,SAAS,eACb,gBAAgB,MAAM,KAAK,GAC3B,MAAM,YACN,MAAM,cACN,MAAM,KACN,MAAM,MACN,qBACF;AAAA,MACA,IAAI;AAAA,QAAQ,MAAM;AAAA;AAAA,IAEpB,4BAA4B,CAAC,UAAU;AAAA,MACrC,IAAI,MAAM,WAAW;AAAA,QAAW;AAAA,MAChC,MAAM,QAAQ,gBAAgB,MAAM,KAAK;AAAA,MACzC,MAAM,aACJ,MAAM,cAAc,SAAS,CAAC,YAAY,UAAU,IAAI,CAAC,MAAM,SAAS;AAAA,MAC1E,MAAM,OAAO,cACX,WAAW,QACT,CAAC,cACC,WAAW,OAAO,MAAM,QAAS,WAAW,WAAW,UAAU,QAAQ,EAAE,UAC/E,CACF;AAAA,MACA,IAAI,KAAK,WAAW,SAAS,KAAK,MAAM,WAAW,WAAW;AAAA,QAAG;AAAA,MACjE,MAAM,WAAW,OAAO,MAAM,QAAQ,MAAM,WAAW,WAAW,cAAc,MAAM,IAAI;AAAA;AAAA,EAE9F;AAAA,EAEA,OAAO,OAAO,OAAO,SAAS;AAAA;AAGhC,SAAS,UAAU,CACjB,OACA,WACA,gBACmE;AAAA,EACnE,MAAM,QAAQ,IAAI;AAAA,EAClB,WAAW,QAAQ,OAAO;AAAA,IACxB,MAAM,UACJ,cAAc,aACV,aAAa,KAAK,cAAc,KAAK,kBAAkB,IACvD,aAAa,KAAK,QAAQ,KAAK,kBAAkB;AAAA,IACvD,MAAM,QACJ,cAAc,aACV,aAAa,KAAK,QAAQ,KAAK,kBAAkB,IACjD,aAAa,KAAK,cAAc,KAAK,kBAAkB;AAAA,IAC7D,MAAM,SAAS,eAAe,IAAI,KAAK;AAAA,IACvC,IAAI,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,QAAQ;AAAA,MAC3C,MAAM,IAAI,MAAM,4EAA4E;AAAA,IAC9F;AAAA,IACA,MAAM,MAAM,QACV,cAAc,aAAa,KAAK,eAAe,KAAK,QACpD,cAAc,aAAa,KAAK,qBAAqB,KAAK,oBAC1D,KAAK,MACP;AAAA,IACA,MAAM,UAAU,MAAM,IAAI,GAAG,KAAK,CAAC;AAAA,IACnC,QAAQ,KAAK,MAAM;AAAA,IACnB,MAAM,IAAI,KAAK,OAAO;AAAA,EACxB;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,UAAU,CACjB,OACA,QACA,WACA,oBACA,UACA,UACA,qBAC0B;AAAA,EAC1B,MAAM,QAAQ,cAAc,aAAa,WAAW;AAAA,EACpD,MAAM,cAAc,sBAAsB,IAAI,IAAI,mBAAmB,IAAI;AAAA,EACzE,MAAM,aAAa,MAAM,WAAW,QAAQ,CAAC,cAAc;AAAA,IACzD,MAAM,aAAa,MAAM,IAAI,QAAQ,UAAU,QAAQ,UAAU,cAAc,MAAM,CAAC,KAAK,CAAC;AAAA,IAC5F,OAAO,WAAW,OAChB,CAAC,eACE,gBAAgB,aAAa,YAAY,IAAI,UAAU,YAAY,OACnE,cAAc,cACb,uBAAuB,aACvB,UAAU,iBAAiB,mBACjC;AAAA,GACD;AAAA,EACD,OAAO,cAAc,UAAU;AAAA;AAGjC,SAAS,cAAc,CACrB,OACA,YACA,cACA,KACA,MACA,uBACgC;AAAA,EAChC,MAAM,aAAa,eACf,MAAM,WAAW,OAAO,CAAC,cAAc,UAAU,iBAAiB,YAAY,IAC9E,MAAM;AAAA,EAGV,IAAI,WAAW,WAAW;AAAA,IAAG;AAAA,EAE7B,MAAM,UAAU,WAAW,KACzB,CAAC,cACC,CAAC,sBACE,IAAI,aAAa,UAAU,QAAQ,UAAU,YAAY,CAAC,GACzD,IAAI,UAAU,CACtB;AAAA,EACA,IAAI,CAAC;AAAA,IAAS;AAAA,EAEd,MAAM,gBAAgB,CAAC,GAAG,IAAI,IAAI,WAAW,IAAI,CAAC,cAAc,UAAU,YAAY,CAAC,CAAC,EAAE,KAAK;AAAA,EAC/F,OAAO,IAAI,oBACT,eAAe,cAAc,KAAK,GAAG,cAAc,cACnD,+CAA+C,mBAAmB,WAAW,2EAA2E,gBAAgB,OAAO,KACjL;AAAA;AAGF,SAAS,UAAU,CACjB,OACA,QACA,WACA,oBACA,KACA,MACoB;AAAA,EACpB,MAAM,SAAS,qBAAqB,IAAI,uBAAuB;AAAA,EAC/D,OAAO,IAAI,oBACT,aAAa,YAAY,UAAU,UACnC,qCAAqC,mBAAmB,eAAe,YAAY,YAAY,KAAK,SAAS,oDAC/G;AAAA;AAGF,SAAS,WAAW,CAAC,OAAyC;AAAA,EAC5D,IAAI,MAAM,WAAW,WAAW;AAAA,IAAG,OAAO;AAAA,EAC1C,OAAO,yBAAyB,MAAM,WAAW,IAAI,eAAe,EAAE,KAAK,IAAI;AAAA;AAGjF,SAAS,eAAe,CAAC,WAAsD;AAAA,EAC7E,OAAO,IAAI,UAAU,sBAAsB,UAAU;AAAA;AAGvD,SAAS,aAAa,CACpB,YAC0B;AAAA,EAC1B,MAAM,SAAS,IAAI;AAAA,EACnB,WAAW,aAAa,YAAY;AAAA,IAClC,OAAO,IAAI,aAAa,UAAU,QAAQ,UAAU,YAAY,GAAG,SAAS;AAAA,EAC9E;AAAA,EACA,OAAO,OAAO,OAAO;AAAA,KAClB,qBAAqB;AAAA,IACtB,YAAY,OAAO,OACjB,CAAC,GAAG,OAAO,OAAO,CAAC,EAAE,KACnB,CAAC,MAAM,UACL,KAAK,SAAS,MAAM,UAAU,KAAK,aAAa,cAAc,MAAM,YAAY,CACpF,CACF;AAAA,EACF,CAAC;AAAA;AAGH,SAAS,eAAe,CAAC,OAA4D;AAAA,EACnF,IAAK,MAA4C,wBAAwB,MAAM;AAAA,IAC7E,MAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,OAAM,CAAC,OAAiC,QAA+C;AAAA,EAC9F,OAAO,EAAE,OAAO,OAAO;AAAA;AAGzB,SAAS,YAAY,CAAC,QAAgB,cAA8B;AAAA,EAClE,OAAO,KAAK,UAAU,CAAC,QAAQ,YAAY,CAAC;AAAA;AAG9C,SAAS,OAAO,CAAC,QAAgB,cAAsB,QAAwB;AAAA,EAC7E,OAAO,KAAK,UAAU,CAAC,QAAQ,cAAc,MAAM,CAAC;AAAA;;;ACnS/C,MAAM,sBAAsB;AAAA,EACxB;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EACT;AAAA,EACA;AAAA,EAEA,WAAW,CAAC,OAIT;AAAA,IACD,KAAK,YAAY,MAAM;AAAA,IACvB,KAAK,cAAc,MAAM;AAAA,IACzB,KAAK,UAAU,MAAM,cAAc,yBAAyB,MAAM,UAAU,MAAM,UAAU;AAAA,IAE5F,IAAI,MAAM,cAAc,MAAM,iBAAiB,QAAQ,MAAM,UAAU,GAAG;AAAA,MACxE,KAAK,WAAW,MAAM;AAAA,IACxB;AAAA,IAEA,OAAO,OAAO,IAAI;AAAA;AAAA,EAIpB,OAAO,GAAmC;AAAA,IACxC,MAAM,UAAU,KAAK;AAAA,IACrB,MAAM,aAAa,KAAK;AAAA,IACxB,IAAI,CAAC,WAAW,CAAC;AAAA,MAAY,OAAO,KAAK;AAAA,IAEzC,OAAO,QAAQ,QAAQ,EAAE,KAAK,CAAC,aAAa;AAAA,MAC1C,IAAI,aAAa,KAAK,eAAe;AAAA,QACnC,KAAK,iBAAiB,yBAAyB,KAAK,WAAW,YAAY,QAAQ;AAAA,QACnF,KAAK,gBAAgB;AAAA,MACvB;AAAA,MACA,OAAO,KAAK;AAAA,KACb;AAAA;AAAA,EAOH,QAAQ,CAAC,SAAuD;AAAA,IAC9D,MAAM,UAAU,KAAK;AAAA,IACrB,MAAM,aAAa,KAAK;AAAA,IACxB,IAAI,CAAC,WAAW,CAAC;AAAA,MAAY,OAAO,KAAK;AAAA,IAEzC,OAAO,QACJ,QAAQ,EACR,KAAK,CAAC,aACL,QAAQ,SAAS,QAAQ,eAAe,UAAU,QAAQ,MAAM,IAAI,QACtE,EACC,KAAK,CAAC,aACL,QAAQ,UAAU,QAAQ,iBAAiB,UAAU,QAAQ,YAAY,IAAI,QAC/E,EACC,KAAK,CAAC,aAAa,yBAAyB,KAAK,WAAW,YAAY,QAAQ,CAAC;AAAA;AAExF;;;AC/BO,MAAM,qBAAqB;AAAA,EAEvB;AAAA,EACA;AAAA,EAEA;AAAA,EAEA;AAAA,EACA;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EAET,WAAW,CAAC,OAOT;AAAA,IACD,MAAM,YAAY,MAAM;AAAA,IACxB,KAAK,gBAAgB,MAAM;AAAA,IAC3B,KAAK,YAAY;AAAA,IACjB,IAAI,MAAM,aAAa,SAAS,QAAQ;AAAA,MACtC,KAAK,iBAAiB,OAAO,OAAO,EAAE,MAAM,QAAQ,IAAI,MAAM,YAAY,GAAG,CAAC;AAAA,IAChF;AAAA,IACA,KAAK,UAAU,OAAO,OAAO;AAAA,MAC3B,WAAW,MAAM;AAAA,MACjB,sBAAsB,MAAM;AAAA,SACxB,UAAU,SAAS,cAAc,EAAE,eAAe,UAAU,QAAQ,IAAI,CAAC;AAAA,IAC/E,CAAC;AAAA,IAED,IAAI,UAAU,SAAS,aAAa;AAAA,MAClC,MAAM,QAAQ,UAAU,WAAW;AAAA,MACnC,KAAK,aAAa,OAAO,OAAO;AAAA,QAC9B,eAAe,IAAI,IAAI,MAAM,QAAQ,IAAI,CAAC,WAAW,OAAO,YAAY,CAAC;AAAA,QACzE,iBAAiB,IAAI,IAAI,MAAM,MAAM,IAAI,0BAA0B,CAAC;AAAA,QACpE,gBAAgB,mCAAmC,KAAK;AAAA,MAC1D,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,aAAa,UAAU,SAAS,cAAc,UAAU,QAAQ,iBAAiB;AAAA,IACvF,KAAK,uBAAuB,IAAI,IAC9B,CAAC,GAAI,cAAc,CAAC,CAAE,EAAE,IAAI,EAAE,cAAc,gBAAgB;AAAA,MAC1D;AAAA,MACA,CAAC,GAAG,IAAI,IAAI,WAAW,QAAQ,gBAAgB,CAAC,CAAC;AAAA,IACnD,CAAC,CACH;AAAA,IAEA,IAAI,UAAU,SAAS,eAAe,cAAc,WAAW,OAAO,GAAG;AAAA,MAIvE,MAAM,YAAY,UAAU,QAAQ;AAAA,MACpC,MAAM,UACJ,UAAU,SAAS,SAAS,EAAE,MAAM,QAAQ,IAAI,UAAU,GAAG,IAAI;AAAA,MAEnE,KAAK,mBAAmB,mCAAkC;AAAA,QACxD,MAAM;AAAA,QACN,YAAY,CAAC,GAAG,UAAU,EAAE,IAAI,EAAE,cAAc,iBAAiB;AAAA,UAC/D;AAAA,UACA,WAAW,yBAAyB,MAAM,UAAU,GAAG,OAAO;AAAA,QAChE,EAAE;AAAA,MACJ,CAAC;AAAA,IACH;AAAA,IAEA,KAAK,YAAY,IAAI,sBAAsB;AAAA,MACzC,UAAU,MAAM;AAAA,MAChB,YAAY,uBAAuB,SAAS;AAAA,SACxC,MAAM,oBAAoB,YAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;AAAA,IAC1F,CAAC;AAAA,IAED,OAAO,OAAO,IAAI;AAAA;AAAA,EAGpB,yBAAyB,CAAC,eAAkC,WAA4B;AAAA,IACtF,IAAI,KAAK,YAAY;AAAA,MACnB,WAAW,gBAAgB,IAAI,IAAI,aAAa,GAAG;AAAA,QACjD,IAAI,KAAK,WAAW,cAAc,IAAI,YAAY;AAAA,UAAG;AAAA,QACrD,MAAM,IAAI,oBACR,yBAAyB,gBACzB,+DAA+D,gBACjE;AAAA,MACF;AAAA,IACF,EAAO;AAAA,MACL,KAAK,yBAAyB,eAAe,SAAS;AAAA;AAAA,IAGxD,IAAI,CAAC;AAAA,MAAW;AAAA,IAEhB,WAAW,gBAAgB,IAAI,IAAI,aAAa,GAAG;AAAA,MACjD,MAAM,aAAa,UAAU,eAAe,YAAY;AAAA,MACxD,IAAI;AAAA,QAAY,MAAM,gBAAgB,UAAU;AAAA,IAClD;AAAA;AAAA,EAQF,wBAAwB,CAAC,eAAkC,WAA4B;AAAA,IACrF,WAAW,gBAAgB,IAAI,IAAI,aAAa,GAAG;AAAA,MACjD,IAAI,CAAC,KAAK,qBAAqB,IAAI,YAAY,GAAG;AAAA,QAChD,kBAAiB,KAAK,SAAS,EAAE,MAAM,eAAe,aAAa,CAAC;AAAA,QACpE;AAAA,MACF;AAAA,MAEA,iCAAgC,KAAK,OAAO;AAAA,MAE5C,MAAM,aAAa,KAAK,qBAAqB,cAAc,SAAS;AAAA,MACpE,IAAI;AAAA,QAAY,MAAM,gBAAgB,UAAU;AAAA,IAClD;AAAA;AAAA,EAIF,qBAAqB,CAAC,cAA+B;AAAA,IACnD,OAAO,KAAK,qBAAqB,IAAI,YAAY;AAAA;AAAA,EAGnD,mBAAmB,CAAC,cAAsB,WAA+B;AAAA,IACvE,IAAI,KAAK;AAAA,MAAY,OAAO,KAAK,WAAW,cAAc,IAAI,YAAY;AAAA,IAE1E,IAAI,KAAK,qBAAqB,IAAI,YAAY,GAAG;AAAA,MAC/C,OAAO,KAAK,qBAAqB,cAAc,SAAS,MAAM;AAAA,IAChE;AAAA,IAEA,OAAO,WAAU,KAAK,QAAQ,eAAe,EAAE,MAAM,eAAe,aAAa,CAAC;AAAA;AAAA,EAGpF,oBAAoB,CAAC,cAAsB,WAA+B;AAAA,IACxE,IAAI,WAAW,eAAe,YAAY;AAAA,MAAG,OAAO;AAAA,IACpD,OAAO,KAAK,oBAAoB,cAAc,SAAS;AAAA;AAAA,EAGzD,cAAc,CAAC,MAAqB,WAA+B;AAAA,IACjE,IACE,CAAC,KAAK,qBAAqB,KAAK,cAAc,SAAS,KACvD,CAAC,KAAK,qBAAqB,KAAK,cAAc,SAAS,KACvD,WAAW,eAAe,KAAK,cAAc,KAAK,MAAM,GACxD;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IAEA,OAAO,KAAK,YAAY,gBAAgB,IAAI,2BAA2B,IAAI,CAAC,KAAK;AAAA;AAAA,EAGnF,oBAAoB,CAAC,cAAsB,WAA8C;AAAA,IACvF,MAAM,cAAc,KAAK,qBAAqB,IAAI,YAAY;AAAA,IAC9D,OAAO,eAAe,sBAAsB,cAAc,aAAa,SAAS;AAAA;AAEpF;AAMA,SAAS,qBAAqB,CAC5B,cACA,aACA,WACwB;AAAA,EACxB,WAAW,cAAc,aAAa;AAAA,IACpC,MAAM,UAAU,WAAW,eAAe,cAAc,UAAU;AAAA,IAClE,IAAI,YAAY;AAAA,MAAW;AAAA,IAE3B,OAAO;AAAA,MACL;AAAA,MACA,SAAS,uBAAuB,4DAA4D,gBAAgB,sDAAsD;AAAA,IACpK;AAAA,EACF;AAAA,EAEA;AAAA;AAGF,SAAS,gBAAgB,CAAC,WAAoD;AAAA,EAC5E,QAAQ,UAAU;AAAA,SACX;AAAA,SACA;AAAA,MACH,OAAO,UAAU,MAAM,QAAQ,gBAAgB;AAAA,SAC5C;AAAA,MACH,OAAO,iBAAiB,UAAU,IAAI;AAAA,SACnC;AAAA,MACH,OAAO,CAAC;AAAA;AAAA,MAER,OAAO,CAAC,UAAU,UAAU;AAAA;AAAA;AAIlC,SAAS,KAAK,CAAC,YAAmE;AAAA,EAChF,OAAO,WAAW,WAAW,IAAI,WAAW,KAAM,EAAE,IAAI,MAAM,OAAO,WAAW;AAAA;AAOlF,SAAS,sBAAsB,CAC7B,WACiC;AAAA,EACjC,QAAQ,UAAU;AAAA,SACX;AAAA,MACH;AAAA,SACG;AAAA,MACH,OAAO,UAAU,QAAQ,cAAc,IAAI;AAAA,SACxC;AAAA,MACH,OAAO,IAAI;AAAA;AAAA;AAIjB,SAAS,0BAA0B,CACjC,OAGQ;AAAA,EACR,OAAO,wBAAwB,QAC3B,KAAK,UAAU,CAAC,MAAM,oBAAoB,MAAM,QAAQ,MAAM,kBAAkB,CAAC,IACjF,KAAK,UAAU,CAAC,MAAM,cAAc,MAAM,QAAQ,MAAM,YAAY,CAAC;AAAA;;;AC/P3E,IAAM,oBAAoB;AAkB1B,eAAsB,kBAAkB,CAAC,OAOvB;AAAA,EAChB,MAAM,QAAoB,CAAC;AAAA,EAC3B,aAAa,MAAM,MAAM,MAAM,MAAM,MAAM,UAAU,KAAK;AAAA,EAE1D,IAAI,CAAC,MAAM;AAAA,IAAc;AAAA,EAEzB,MAAM,UAAU,MAAM,UAAU,OAAO,KAAK;AAAA,EAE5C,WAAW,QAAQ,OAAO;AAAA,IACxB,KAAK,MAAM,KAAK,cAAc,cAAc,MAAM,OAAO;AAAA,EAC3D;AAAA;AAKF,SAAS,aAAa,CAAC,MAAgB,SAA0C;AAAA,EAC/E,MAAM,WAAW,KAAK,IAAI,QAAQ,CAAC,OAAO;AAAA,IACxC,MAAM,SAAS,QAAQ,IAAI,EAAE;AAAA,IAC7B,OAAO,SAAS,CAAC,cAAc,MAAM,CAAC,IAAI,CAAC;AAAA,GAC5C;AAAA,EAED,OAAO,KAAK,OAAO,WAAY,SAAS,MAAM;AAAA;AAGhD,SAAS,YAAY,CACnB,MACA,MACA,UACA,MACM;AAAA,EACN,WAAW,OAAO,MAAM;AAAA,IACtB,MAAM,aAAa,SAAS,kBAAkB,IAAI,YAAY,GAAG,cAAc,CAAC;AAAA,IAEhF,WAAW,cAAc,KAAK,OAAO;AAAA,MACnC,MAAM,WAAW,WAAW,KAAK,CAAC,cAAc,UAAU,OAAO,UAAU;AAAA,MAC3E,IAAI,CAAC,YAAY,CAAC,wBAAwB,SAAS,MAAM;AAAA,QAAG;AAAA,MAE5D,IAAI,UAAU,CAAC;AAAA,MACf,IAAI,IAAI,aAAa;AAAA,QAAa;AAAA,MAElC,KAAK,KAAK;AAAA,QACR,OAAO,IAAI;AAAA,QACX;AAAA,QACA,MAAM,SAAS,WAAW;AAAA,QAC1B,KAAK,UAAU,IAAI,WAAW,WAAW;AAAA,MAC3C,CAAC;AAAA,IACH;AAAA,IAEA,WAAW,QAAQ,KAAK,OAAO;AAAA,MAC7B,aAAa,WAAW,IAAI,QAAQ,KAAK,OAAO,GAAG,KAAK,MAAM,UAAU,IAAI;AAAA,IAC9E;AAAA,EACF;AAAA;AAGF,eAAe,SAAS,CACtB,OACA,OAC0C;AAAA,EAC1C,MAAM,UAAU,IAAI;AAAA,EACpB,MAAM,MAAM,CAAC,GAAG,IAAI,IAAI,MAAM,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC;AAAA,EAC1D,IAAI,CAAC,MAAM,SAAS,IAAI,WAAW;AAAA,IAAG,OAAO;AAAA,EAE7C,SAAS,QAAQ,EAAG,QAAQ,IAAI,QAAQ,SAAS,mBAAmB;AAAA,IAClE,MAAM,QAAQ,IAAI,MAAM,OAAO,QAAQ,iBAAiB;AAAA,IACxD,WAAW,UAAU,MAAM,MAAM,MAAM,SAAS,EAAE,WAAW,MAAM,WAAW,KAAK,MAAM,CAAC,GAAG;AAAA,MAC3F,QAAQ,IAAI,OAAO,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AAAA,EAEA,OAAO;AAAA;AAIT,SAAS,SAAS,CAAC,OAA0B;AAAA,EAC3C,IAAI,UAAU,KAAK;AAAA,IAAG,OAAO,CAAC,MAAM,EAAE;AAAA,EACtC,IAAI,CAAC,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO,CAAC;AAAA,EACnC,OAAO,MAAM,OAAO,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;AAAA;AAGpD,SAAS,UAAU,CAAC,OAA4D;AAAA,EAC9E,IAAI,UAAU,aAAa,UAAU;AAAA,IAAM,OAAO,CAAC;AAAA,EACnD,IAAI,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO;AAAA,EACjC,OAAO,CAAC,KAAkB;AAAA;;;AC9GrB,SAAS,eAAe,CAC7B,UACA,OACQ;AAAA,EACR,OAAO,kBACL,SAAS,kBAAkB,MAAM,YAAY,GAC7C,MAAM,YACN,MAAM,OACN,SAAS,kBAAkB,CAC7B;AAAA;AAIK,SAAS,iBAAiB,CAC/B,YACA,YACA,OACA,gBACQ;AAAA,EACR,MAAM,OAAO,GAAG,WAAW,MAAM;AAAA,EAEjC,MAAM,WAAW,WAAW,WAAW,KAAK,CAAC,cAAc,UAAU,OAAO,UAAU;AAAA,EACtF,MAAM,OAAO,UAAU,SAAS,gBAAgB,SAAS,QAAQ,cAAc,IAAI;AAAA,EACnF,IAAI,CAAC,YAAY,CAAC,MAAM;AAAA,IACtB,MAAM,IAAI,yBACR,0BAA0B,oEAC5B;AAAA,EACF;AAAA,EAEA,IAAI,UAAU,QAAQ,UAAU,WAAW;AAAA,IACzC,MAAM,IAAI,yBACR,0BAA0B,YAAY,OAAO,KAAK,6CACpD;AAAA,EACF;AAAA,EAEA,qBAAoB,SAAS,QAAQ,OAAO,MAAM,cAAc;AAAA,EAChE,MAAM,MAAM,eACV,MACA,sBAAqB,SAAS,QAAQ,OAAO,MAAM,cAAc,CACnE;AAAA,EACA,IAAI,QAAQ,MAAM;AAAA,IAChB,MAAM,IAAI,yBAAwB,0BAA0B,sBAAsB;AAAA,EACpF;AAAA,EACA,OAAO;AAAA;;;ACoCT,IAAM,wBAAwB,OAAO,OAAO,CAAC,CAAC;AAAA;AAc9C,MAAM,2BAA2B;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,WAAW,CACT,KACA,OAOA;AAAA,IACA,IAAI,QAAQ,uBAAuB;AAAA,MACjC,MAAM,IAAI,MAAM,4DAA4D;AAAA,IAC9E;AAAA,IACA,KAAK,YAAY,MAAM;AAAA,IACvB,KAAK,YAAY,MAAM;AAAA,IACvB,KAAK,UAAU,MAAM;AAAA,IACrB,KAAK,WAAW,MAAM;AAAA,IACtB,KAAK,SAAS,MAAM;AAAA;AAAA,SAGf,WAAW,CAAC,QAAoC,OAA6B;AAAA,IAClF,MAAM,gBAAgB,sBAAsB,KAAK;AAAA,IACjD,mCAAmC,OAAO,UAAU,QAAQ,WAAW,aAAa;AAAA,IACpF,IAAI,cAAc,kBAAkB,OAAO,UAAU,eAAe;AAAA,MAClE,MAAM,IAAI,MACR,+EACF;AAAA,IACF;AAAA;AAAA,cAIW,UAAS,CAAC,QAAwD;AAAA,IAC7E,OAAO,OAAO,UAAU,UAAU,QAAQ;AAAA;AAAA,SAIrC,cAAc,CACnB,QACA,SACgC;AAAA,IAChC,OAAO,OAAO,UAAU,UAAU,SAAS,OAAO;AAAA;AAAA,SAI7C,cAAc,CACnB,QAC0C;AAAA,IAC1C,MAAM,WAAW,OAAO;AAAA,IACxB,MAAM,aAAa,SAAS,kBAAkB,cAAc,CAAC;AAAA,IAE7D,OAAO,IAAI,IACT,WAAW,IAAI,GAAG,cAAc,gBAAgB;AAAA,MAC9C;AAAA,MACA;AAAA,QACE;AAAA,QACA,UAAU,CAAC,cACT,CAAC,SAAS,qBAAqB,cAAc,SAAS;AAAA,MAC1D;AAAA,IACF,CAAC,CACH;AAAA;AAAA,SAGK,YAAY,CAAC,QAA4D;AAAA,IAC9E,OAAO,OAAO,UAAU,KAAK;AAAA;AAAA,MAI3B,SAAS,GAAW;AAAA,IACtB,OAAO,KAAK,UAAU,QAAQ;AAAA;AAAA,OAG1B,eAAc,CAAC,OAAwE;AAAA,IAC3F,MAAM,UAAU,kBAAkB;AAAA,MAChC,cAAc,MAAM;AAAA,MACpB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,KAAK,UAAU,0BAA0B,CAAC,QAAQ,YAAY,GAAG,SAAS;AAAA,IAC1E,MAAM,MAAM,MAAM,KAAK,SAAS,eAAe;AAAA,SAC1C;AAAA,MACH,WAAW,KAAK,UAAU,QAAQ;AAAA,IACpC,CAAC;AAAA,IACD,OAAO,KAAK,YACV,OAAO,KAAK,YAAY,KAAK,SAAS,GACtC,CAAC,aAAa,CAAC,QAAQ,GACvB,SACF;AAAA;AAAA,OAOI,iBAAgB,CAAC,OAAyD;AAAA,IAC9E,MAAM,UAAU,kBAAkB;AAAA,MAChC,cAAc,MAAM;AAAA,MACpB,YAAY,MAAM;AAAA,MAClB,OAAO,MAAM;AAAA,IACf,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,KAAK,UAAU,0BAA0B,CAAC,QAAQ,YAAY,GAAG,SAAS;AAAA,IAE1E,MAAM,WAAW,gBAAgB,KAAK,UAAU,UAAU,OAAO;AAAA,IACjE,MAAM,UAAU,WAAW,eAAe,QAAQ,cAAc,QAAQ,UAAU;AAAA,IAClF,IAAI,YAAY,WAAW;AAAA,MACzB,MAAM,IAAI,oBACR,qBAAqB,WACrB,0BAA0B,QAAQ,gBAAgB,QAAQ,4DAA4D,WACxH;AAAA,IACF;AAAA,IAEA,MAAM,MAAM,MAAM,KAAK,SAAS,iBAAiB;AAAA,MAC/C,cAAc,QAAQ;AAAA,MACtB,YAAY,QAAQ;AAAA,MACpB;AAAA,MACA,WAAW,KAAK,UAAU,QAAQ;AAAA,IACpC,CAAC;AAAA,IACD,OAAO,KAAK,YACV,OAAO,KAAK,YAAY,KAAK,SAAS,GACtC,CAAC,aAAa,CAAC,QAAQ,GACvB,SACF;AAAA;AAAA,OAGI,oBAAmB,CACvB,OACsD;AAAA,IACtD,MAAM,UAAU,kBAAkB;AAAA,MAChC,OAAO,MAAM,MAAM,IAAI,CAAC,UAAU;AAAA,QAChC,cAAc,KAAK;AAAA,QACnB,WAAW,KAAK;AAAA,MAClB,EAAE;AAAA,IACJ,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,KAAK,UAAU,0BACb,QAAQ,MAAM,IAAI,CAAC,SAAS,KAAK,YAAY,GAC7C,SACF;AAAA,IACA,MAAM,OAAO,MAAM,KAAK,SAAS,oBAAoB;AAAA,SAChD;AAAA,MACH,WAAW,KAAK,UAAU,QAAQ;AAAA,IACpC,CAAC;AAAA,IACD,OAAO,KAAK,YACV,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,SAAS,CAAC,KAAK,KAAK,YAAY,KAAK,SAAS,CAAC,CAAU,CAAC,GACvF,CAAC,aAAa,SAAS,OAAO,GAC9B,SACF;AAAA;AAAA,OAGI,sBAAqB,CAAC,OAAqD;AAAA,IAC/E,MAAM,UAAU,kBAAkB;AAAA,MAChC,cAAc,MAAM;AAAA,MACpB,WAAW,MAAM;AAAA,MACjB,YAAY,MAAM;AAAA,IACpB,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,KAAK,UAAU,0BAA0B,CAAC,QAAQ,YAAY,GAAG,SAAS;AAAA,IAE1E,IAAI,cAAc,SAAS,SAAS;AAAA,MAAG,OAAO;AAAA,IAC9C,OAAO,YAAY,MAAM,KAAK,yBAAyB,CAAC,OAAO,CAAC;AAAA,IAChE,OAAO,YAAY;AAAA;AAAA,OAGf,6BAA4B,CAChC,OAC6B;AAAA,IAC7B,MAAM,UAAU,kBAAkB;AAAA,MAChC,OAAO,MAAM,MAAM,IAAI,CAAC,UAAU;AAAA,QAChC,cAAc,KAAK;AAAA,QACnB,WAAW,KAAK;AAAA,QAChB,YAAY,KAAK;AAAA,MACnB,EAAE;AAAA,IACJ,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,KAAK,UAAU,0BACb,QAAQ,MAAM,IAAI,CAAC,SAAS,KAAK,YAAY,GAC7C,SACF;AAAA,IACA,MAAM,WAAW,MAAM,KAAK,yBAAyB,QAAQ,KAAK;AAAA,IAClE,OAAO,QAAQ,MAAM,IACnB,CAAC,MAAM,UAAU,CAAC,cAAc,MAAM,SAAS,KAAK,SAAS,WAAW,IAC1E;AAAA;AAAA,OAGI,KAAI,CAAC,OAAgE;AAAA,IACzE,MAAM,UAAU,kBAAkB;AAAA,MAChC,cACE,OAAO,MAAM,iBAAiB,WAC1B,MAAM,eACN,MAAM,iBAAiB,YACrB,YACA,CAAC,GAAG,MAAM,YAAY;AAAA,MAC9B,iBAAiB,MAAM;AAAA,MACvB,iBAAiB,MAAM;AAAA,MACvB,cAAc,MAAM;AAAA,MACpB,eAAe,MAAM;AAAA,MACrB,cAAc,MAAM;AAAA,MACpB,eAAe,MAAM;AAAA,MACrB,OAAO,MAAM;AAAA,MACb,QAAQ,MAAM;AAAA,MACd,SAAS,MAAM;AAAA,MACf,OAAO,MAAM;AAAA,IACf,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,MAAM,eAAe,KAAK,wBAAwB,QAAQ,cAAc,SAAS;AAAA,IAIjF,IAAI,MAAM,QAAQ,YAAY,KAAK,aAAa,WAAW,GAAG;AAAA,MAC5D,OAAO,EAAE,SAAS,CAAC,GAAG,SAAS,OAAO,OAAO,EAAE;AAAA,IACjD;AAAA,IAEA,MAAM,OAAO,MAAM,KAAK,SAAS,KAAK;AAAA,SACjC;AAAA,SACC,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa;AAAA,MACrD,WAAW,KAAK,UAAU,QAAQ;AAAA,IACpC,CAAC;AAAA,IACD,OAAO,KAAK,YACV,KAAK,MAAM,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,YAAY,KAAK,SAAS,CAAC,EAAE,GAChF,CAAC,aAAa,SAAS,SACvB,SACF;AAAA;AAAA,OAGI,UAAS,CAAC,OAAmE;AAAA,IACjF,MAAM,UAAU,kBAAkB;AAAA,MAChC,cAAc,MAAM;AAAA,MACpB,UAAU,MAAM;AAAA,MAChB,QAAQ,MAAM;AAAA,MACd,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,KAAK,UAAU,0BAA0B,CAAC,QAAQ,YAAY,GAAG,SAAS;AAAA,IAC1E,MAAM,QAAQ,iBACZ,MAAM,KAAK,SAAS,UAAU;AAAA,SACzB;AAAA,MACH,WAAW,KAAK,UAAU,QAAQ;AAAA,IACpC,CAAC,CACH;AAAA,IACA,OAAO,MAAM,OAAO,CAAC,SAAS,KAAK,UAAU,eAAe,MAAM,SAAS,CAAC;AAAA;AAAA,OAGxE,eAAc,CAClB,OACiD;AAAA,IACjD,MAAM,UAAU,kBAAkB;AAAA,MAChC,WAAW,MAAM;AAAA,MACjB,OAAO,MAAM,MAAM,IAAI,CAAC,UAAU;AAAA,QAChC,cAAc,KAAK;AAAA,QACnB,UAAU,KAAK;AAAA,QACf,QAAQ,KAAK;AAAA,MACf,EAAE;AAAA,IACJ,CAAC;AAAA,IACD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,KAAK,UAAU,0BACb,QAAQ,MAAM,IAAI,CAAC,SAAS,KAAK,YAAY,GAC7C,SACF;AAAA,IACA,MAAM,QAAQ,iBACZ,MAAM,KAAK,SAAS,eAAe;AAAA,SAC9B;AAAA,MACH,WAAW,KAAK,UAAU,QAAQ;AAAA,IACpC,CAAC,CACH;AAAA,IACA,MAAM,WAAW,IAAI;AAAA,IACrB,YAAY,KAAK,UAAU,OAAO;AAAA,MAChC,SAAS,IACP,KACA,MAAM,OAAO,CAAC,SAAS,KAAK,UAAU,eAAe,MAAM,SAAS,CAAC,CACvE;AAAA,IACF;AAAA,IACA,OAAO;AAAA;AAAA,OAGH,aAAY,CAChB,OACmC;AAAA,IACnC,MAAM,QAAQ,sBAAsB,MAAM,KAAK;AAAA,IAC/C,MAAM,eAAe,kBAAkB,MAAM,YAAY;AAAA,IACzD,MAAM,iBAAiB,KAAK,qBAAqB,KAAK,GAAG,SAAS;AAAA,IAClE,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,MAAM,SAAS,MAAM,oBACnB;AAAA,MACE,OAAO;AAAA,SACH,iBAAiB,YAAY,CAAC,IAAI,EAAE,aAAa;AAAA,MACrD,WAAW,KAAK,UAAU,QAAQ;AAAA,MAClC,QAAQ,MAAM;AAAA,IAChB,GACA,KAAK,sBAAsB,SAAS,CACtC;AAAA,IACA,MAAM,WAAW,KAAK,YACpB,KAAK,QAAQ,SAAS,OAAO,QAAQ,IAAI,CAAC,QAAQ,KAAK,YAAY,KAAK,SAAS,CAAC,EAAE,GACpF,CAAC,aAAa,SAAS,SACvB,SACF;AAAA,IAEA,MAAM,KAAK,aAAa,SAAS,SAAS,KAAK;AAAA,IAC/C,OAAO;AAAA;AAAA,OAGH,WAAU,CACd,OACwC;AAAA,IACxC,MAAM,QAAQ,sBAAsB,MAAM,KAAK;AAAA,IAC/C,MAAM,UAAU,kBAAkB;AAAA,MAChC,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM;AAAA,MACd,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,IACD,IAAI,iBAAiB;AAAA,IACrB,MAAM,YAAY,KAAK,UAAU,YAAY;AAAA,IAC7C,IAAI,WAAW;AAAA,MACb,MAAM,YAAY,0BAChB,EAAE,UAAU,SAAS,WAAW,KAAK,UAAU,QAAQ,UAAU,GACjE,EAAE,UAAU,KAAK,UAAU,SAAS,CACtC;AAAA,MACA,MAAM,WAAW,iCACf,UAAU,UAAU,OACpB,EAAE,UAAU,KAAK,UAAU,UAAU,WAAW,MAAM,GACtD,SACF;AAAA,MACA,UAAU,2BAA2B;AAAA,QACnC,OAAO,SAAS;AAAA,WACZ,UAAU,WAAW,YAAY,CAAC,IAAI,EAAE,QAAQ,UAAU,OAAO;AAAA,QACrE,WAAW,UAAU;AAAA,QACrB,MAAM;AAAA,MACR,CAAC;AAAA,MACD,iBAAiB,SAAS;AAAA,IAC5B;AAAA,IAEA,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,IAAI,WAAW;AAAA,MACb,wBAAwB;AAAA,QACtB,UAAU,KAAK,UAAU;AAAA,QACzB;AAAA,QACA;AAAA,QACA,SAAS,KAAK,SAAS,WAAW,KAAK,UAAU,QAAQ,UAAU;AAAA,QACnE,kBAAkB,CAAC,iBACjB,KAAK,UAAU,qBAAqB,cAAc,SAAS;AAAA,MAC/D,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,SAAS,iBACb,MAAM,yBACJ,EAAE,OAAO,mBAAmB,SAAS,WAAW,KAAK,UAAU,QAAQ,UAAU,GACjF,KAAK,sBAAsB,SAAS,CACtC,CACF;AAAA,IAKA,IACE,OAAO,QAAQ,KACb,CAAC,QAAQ,CAAC,KAAK,UAAU,qBAAqB,IAAI,cAAc,SAAS,CAC3E,KACA,OAAO,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,UAAU,eAAe,MAAM,SAAS,CAAC,GAC3E;AAAA,MACA,MAAM,IAAI,MAAM,0EAA0E;AAAA,IAC5F;AAAA,IAEA,OAAO;AAAA,SACF;AAAA,MACH,SAAS,OAAO,QAAQ,IAAI,CAAC,QAAS,YAAY,gBAAgB,KAAK,SAAS,IAAI,GAAI;AAAA,IAC1F;AAAA;AAAA,OAGI,MAAK,CACT,OACmC;AAAA,IACnC,MAAM,QAAQ,sBAAsB,MAAM,KAAK;AAAA,IAC/C,MAAM,iBAAiB,KAAK,qBAAqB,KAAK,GAAG,SAAS;AAAA,IAClE,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,OAAO,iBACL,MAAM,cACJ,EAAE,OAAO,gBAAgB,WAAW,KAAK,UAAU,QAAQ,UAAU,GACrE,KAAK,sBAAsB,SAAS,CACtC,CACF;AAAA;AAAA,OAGI,OAAM,CACV,OACoC;AAAA,IACpC,MAAM,QAAQ,sBAAsB,MAAM,KAAK;AAAA,IAC/C,MAAM,iBAAiB,KAAK,qBAAqB,KAAK,GAAG,SAAS;AAAA,IAClE,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,OAAO,iBACL,MAAM,eACJ,EAAE,OAAO,gBAAgB,WAAW,KAAK,UAAU,QAAQ,UAAU,GACrE,KAAK,sBAAsB,SAAS,CACtC,CACF;AAAA;AAAA,OAGI,MAAK,CACT,OACoC;AAAA,IACpC,MAAM,QAAQ,sBAAsB,MAAM,KAAK;AAAA,IAC/C,MAAM,SAAS,sBAAsB,MAAM,MAAM;AAAA,IACjD,IAAI,iBAAiB;AAAA,IACrB,IAAI,kBAAkB;AAAA,IACtB,MAAM,YAAY,KAAK,UAAU,YAAY;AAAA,IAC7C,IAAI,WAAW;AAAA,MAGb,MAAM,YAAY,qBAAoB,OAAO,EAAE,UAAU,KAAK,UAAU,SAAS,CAAC;AAAA,MAClF,MAAM,mBAAmB,4BAA4B,QAAQ,UAAU,OAAO,eAAe;AAAA,QAC3F,UAAU,KAAK,UAAU;AAAA,MAC3B,CAAC;AAAA,MACD,MAAM,WAAW,iCACf,UAAU,OACV,EAAE,UAAU,KAAK,UAAU,UAAU,WAAW,MAAM,GACtD,SACF;AAAA,MACA,iBAAiB,QAAQ,CAAC,OAAO,UAAU;AAAA,QACzC,UAAU,uBAAuB;AAAA,UAC/B,OAAO,SAAS;AAAA,UAChB,YAAY,MAAM;AAAA,UAClB,KAAK;AAAA,UACL,MAAM,YAAY;AAAA,QACpB,CAAC;AAAA,OACF;AAAA,MACD,iBAAiB,SAAS;AAAA,MAC1B,kBAAkB;AAAA,IACpB;AAAA,IACA,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,OAAO,iBACL,MAAM,cACJ;AAAA,MACE,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,WAAW,KAAK,UAAU,QAAQ;AAAA,IACpC,GACA,KAAK,sBAAsB,SAAS,CACtC,CACF;AAAA;AAAA,OAQI,mBAAkB,CACtB,cACsD;AAAA,IACtD,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,sBAAsB,WAAW,EAAE,eAAe,CAAC,YAAY,EAAE,CAAC;AAAA,IAClE,OAAO,CAAC,QAAS,YAAY,gBAAgB,KAAK,SAAS,IAAI;AAAA;AAAA,OAQ3D,sBAAqB,CACzB,cACkE;AAAA,IAClE,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,MAAM,SAAS,KAAK,UAAU,SAC3B,qBAAqB,YAAY,EACjC,QAAQ,CAAC,aAAa;AAAA,MACrB,MAAM,UAAU,WAAW,eAAe,cAAc,SAAS,UAAU;AAAA,MAC3E,OAAO,YAAY,YAAY,CAAC,IAAI,CAAC,EAAE,YAAY,SAAS,YAAY,QAAQ,CAAC;AAAA,KAClF;AAAA,IAEH,OAAO,CAAC,eAAe;AAAA,MACrB,aAAa,YAAY,aAAa,QAAQ;AAAA,QAC5C,IAAI,WAAW,gBAAgB,aAAa,WAAW,gBAAgB;AAAA,UAAM;AAAA,QAE7E,MAAM,IAAI,oBACR,qBAAqB,WACrB,mCAAmC,gBAAgB,iEAAiE,WACtH;AAAA,MACF;AAAA;AAAA;AAAA,OASE,eAAc,CAAC,SAAqC;AAAA,IACxD,sBAAsB,MAAM,KAAK,UAAU,UAAU,QAAQ,GAAG,OAAO;AAAA;AAAA,EAQzE,qBAAqB,CAAC,cAA+B;AAAA,IACnD,OAAO,KAAK,UAAU,sBAAsB,YAAY;AAAA;AAAA,OAIpD,eAAc,CAAC,eAAiD;AAAA,IACpE,MAAM,YAAY,MAAM,KAAK,UAAU,UAAU,QAAQ;AAAA,IACzD,KAAK,UAAU,0BAA0B,eAAe,SAAS;AAAA;AAAA,EAInE,8BAA8B,CAAC,OAAsB;AAAA,IACnD,IAAI,KAAK,UAAU,UAAU,SAAS;AAAA,MAAa;AAAA,IACnD,mCAAkC,OAAO,KAAK,UAAU,UAAU,WAAW,MAAM;AAAA;AAAA,EAIrF,yBAAyB,CACvB,OAC+B;AAAA,IAC/B,OAAO,kCAAkC,OAAO,KAAK,UAAU,UAAU,SAAS,WAAW;AAAA;AAAA,EAG/F,qBAAqB,CAAC,WAAsB;AAAA,IAC1C,MAAM,YAAY,KAAK,mBAAmB,SAAS;AAAA,IAEnD,IAAI,KAAK,UAAU,UAAU,SAAS,aAAa;AAAA,MAIjD,OAAO;AAAA,QACL,UAAU,KAAK,UAAU;AAAA,QACzB,SAAS,KAAK;AAAA,QACd,iBAAiB,KAAK,QAAQ;AAAA,QAC9B,iBAAiB,KAAK,QAAQ;AAAA,WAC1B,cAAc,YAAY,CAAC,IAAI,EAAE,UAAU;AAAA,QAC/C,gBAAgB,KAAK,UAAU;AAAA,MACjC;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,UAAU,KAAK,UAAU;AAAA,MACzB,iBAAiB,KAAK,QAAQ;AAAA,MAC9B,iBAAiB,KAAK,QAAQ;AAAA,MAC9B,SAAS,KAAK;AAAA,SACX,KAAK,oBAAoB,SAAS;AAAA,SACjC,cAAc,YAAY,CAAC,IAAI,EAAE,UAAU;AAAA,MAC/C,gBAAgB,KAAK,UAAU;AAAA,IACjC;AAAA;AAAA,EAOF,mBAAmB,CACjB,WAC4E;AAAA,IAC5E,MAAM,uBAAuB,KAAK,UAAU,QAAQ;AAAA,IACpD,IAAI,KAAK,UAAU,UAAU,SAAS;AAAA,MAAa,OAAO,EAAE,qBAAqB;AAAA,IAEjF,MAAM,WAAW,KAAK;AAAA,IACtB,OAAO;AAAA,MACL;AAAA,MACA,qBAAqB,OAAO,OAAO;AAAA,QACjC,QAAQ,CAAC,kBACP,SAAS,yBAAyB,eAAe,SAAS;AAAA,QAC5D,KAAK,CAAC,iBAAyB,SAAS,oBAAoB,cAAc,SAAS;AAAA,MACrF,CAAC;AAAA,IACH;AAAA;AAAA,EAOF,kBAAkB,CAAC,WAAgE;AAAA,IACjF,MAAM,YAAY,aAAa,8BAA8B,SAAS;AAAA,IACtE,MAAM,WAAW,KAAK,UAAU,YAAY;AAAA,IAE5C,IAAI,YAAY;AAAA,MAAW,OAAO,6BAA6B,UAAU,SAAS;AAAA,IAClF,OAAO,YAAY;AAAA;AAAA,OAOf,YAAY,CAAC,MAA4B,OAAmC;AAAA,IAChF,MAAM,OAAO,kBAAkB,sBAAqB,KAAK,CAAC;AAAA,IAC1D,IAAI,CAAC;AAAA,MAAM;AAAA,IAEX,MAAM,mBAAmB;AAAA,MACvB;AAAA,MACA;AAAA,MACA,UAAU,KAAK,UAAU;AAAA,MACzB,WAAW,KAAK,UAAU,QAAQ;AAAA,MAClC,cAAc,kBAAiB,KAAK,UAAU,SAAS,EAAE,MAAM,aAAa,CAAC;AAAA,MAC7E,OAAO,KAAK;AAAA,IACd,CAAC;AAAA;AAAA,OAQG,wBAAwB,CAC5B,OAC6B;AAAA,IAC7B,MAAM,gBAAgB,CAAC,SACrB,KAAK,UAAU,UAAU,SAAS,eAClC,KAAK,UAAU,sBAAsB,KAAK,YAAY;AAAA,IAExD,MAAM,UAAU,MAAM,OAAO,aAAa;AAAA,IAC1C,MAAM,WACJ,QAAQ,WAAW,IACf,CAAC,IACD,MAAM,KAAK,SAAS,wBAAwB;AAAA,MAC1C,WAAW,KAAK,UAAU,QAAQ;AAAA,MAClC,OAAO;AAAA,IACT,CAAC;AAAA,IAEP,IAAI,OAAO;AAAA,IACX,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,IAAI,KAAK,SAAS,YAAY,IAAI;AAAA;AAAA,EAG9E,WAAmC,CAAC,KAAW,WAA4B;AAAA,IACzE,OAAO,YAAY,qBAAqB,KAAK,SAAS,IAAI;AAAA;AAAA,EAO5D,WAAoB,CAClB,QACA,MACA,WACS;AAAA,IACT,MAAM,WAAW,iBAAiB,MAAM;AAAA,IACxC,IAAI,WAAW;AAAA,MACb,WAAW,OAAO,KAAK,QAAQ;AAAA,QAAG,IAAI;AAAA,UAAK,iBAAiB,KAAK,SAAS;AAAA,IAC5E;AAAA,IAEA,OAAO;AAAA;AAAA,EAGT,oBAAoB,CAAC,OAAqD;AAAA,IACxE,MAAM,YAAY,KAAK,UAAU,YAAY;AAAA,IAC7C,IAAI,CAAC;AAAA,MAAW;AAAA,IAChB,OAAO,iCAAiC,OAAO,EAAE,UAAU,KAAK,UAAU,SAAS,GAAG,SAAS;AAAA;AAAA,EAGjG,uBAAuB,CACrB,WACA,WACkC;AAAA,IAClC,IAAI,cAAc,WAAW;AAAA,MAC3B,MAAM,gBAAgB,OAAO,cAAc,WAAW,CAAC,SAAS,IAAI,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;AAAA,MAC1F,WAAW,gBAAgB,eAAe;AAAA,QACxC,KAAK,UAAU,SAAS,kBAAkB,YAAY;AAAA,MACxD;AAAA,MACA,KAAK,UAAU,0BAA0B,eAAe,SAAS;AAAA,MACjE,OAAO,OAAO,cAAc,WAAW,YAAY;AAAA,IACrD;AAAA,IAEA,IAAI,KAAK,UAAU,UAAU,SAAS;AAAA,MAAgB;AAAA,IACtD,OAAO,KAAK,UAAU,SACnB,gBAAgB,EAChB,IAAI,CAAC,eAAe,WAAW,EAAE,EACjC,OAAO,CAAC,iBAAiB,KAAK,UAAU,qBAAqB,cAAc,SAAS,CAAC;AAAA;AAE5F;AAEA,OAAO,OAAO,2BAA2B,SAAS;AAClD,OAAO,OAAO,0BAA0B;AAKjC,SAAS,4BAA4B,CAAC,OAUlB;AAAA,EACzB,MAAM,QAAQ,sBAAsB,MAAM,KAAK;AAAA,EAC/C,MAAM,YAAY,MAAM,UAAU;AAAA,EAClC,MAAM,YAAY,mCAAmC,WAAW,KAAK;AAAA,EACrE,MAAM,WAAW,IAAI,qBAAqB;AAAA,IACxC,eAAe,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA,UAAU,MAAM;AAAA,OACZ,MAAM,oBAAoB,YAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,gBAAgB;AAAA,IACxF,aAAa,MAAM,UAAU;AAAA,EAC/B,CAAC;AAAA,EACD,MAAM,UAAU,0BAA0B,UAAU,MAAM,aAAa;AAAA,EACvE,MAAM,SAAS,IAAI,2BAA2B,uBAAuB;AAAA,IACnE,UAAU,IAAI,qBAAqB,MAAM,UAAU,QAAQ;AAAA,IAC3D;AAAA,IACA,QAAQ,OAAO,OAAO;AAAA,SAChB,MAAM,oBAAoB,YAAY,CAAC,IAAI,EAAE,WAAW,MAAM,gBAAgB;AAAA,SAC9E,MAAM,oBAAoB,YAAY,CAAC,IAAI,EAAE,WAAW,MAAM,gBAAgB;AAAA,IACpF,CAAC;AAAA,IACD;AAAA,OACI,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,EAC5D,CAAC;AAAA,EACD,OAAO,OAAO,MAAM;AAAA,EACpB,OAAO;AAAA;AAIF,SAAS,mCAAmC,CAAC,OAG3C;AAAA,EACP,2BAA2B,YAAY,MAAM,QAAQ,MAAM,KAAK;AAAA;AAI3D,SAAS,yBAAyB,CAAC,QAAwD;AAAA,EAChG,OAAO,2BAA2B,aAAa,MAAM;AAAA;AAOhD,SAAS,eAAe,CAAC,QAAoD;AAAA,EAClF,OAAO,2BAA2B,UAAU,MAAM;AAAA;AAQ7C,SAAS,oBAAoB,CAClC,QACA,SACgC;AAAA,EAChC,OAAO,2BAA2B,eAAe,QAAQ,OAAO;AAAA;AAoB3D,SAAS,oBAAoB,CAClC,QAC0C;AAAA,EAC1C,OAAO,2BAA2B,eAAe,MAAM;AAAA;AASzD,SAAS,qBAAqB,CAAC,WAAsB,SAA4B;AAAA,EAC/E,IAAI,CAAC;AAAA,IAAW;AAAA,EAEhB,WAAW,gBAAgB,QAAQ,eAAe;AAAA,IAChD,MAAM,aAAa,UAAU,eAAe,YAAY;AAAA,IACxD,IAAI;AAAA,MAAY,MAAM,gBAAgB,UAAU;AAAA,EAClD;AAAA,EAEA,WAAW,QAAQ,QAAQ,SAAS,CAAC,GAAG;AAAA,IACtC,MAAM,aAAa,UAAU,eAAe,KAAK,cAAc,KAAK,MAAM;AAAA,IAC1E,IAAI;AAAA,MAAY,MAAM,gBAAgB,UAAU;AAAA,EAClD;AAAA;AAGF,SAAS,aAAa,CACpB,MACA,WACS;AAAA,EACT,OAAO,WAAW,eAAe,KAAK,cAAc,KAAK,UAAU,MAAM;AAAA;AAG3E,SAAS,yBAAyB,CAChC,UACA,eACmB;AAAA,EACnB,MAAM,YAAY,SAAS;AAAA,EAE3B,QAAQ,UAAU;AAAA,SACX;AAAA,MACH,OAAO,SAAS,mBACZ,cAAc,2BAA2B;AAAA,QACvC,WAAW,UAAU;AAAA,QACrB,OAAO,SAAS;AAAA,MAClB,CAAC,IACD;AAAA,SACD;AAAA,MACH,OAAO;AAAA,SACJ;AAAA,MACH,OAAO,cAAc,wBAAwB;AAAA,QAC3C,WAAW,UAAU;AAAA,QACrB,OAAO,UAAU,WAAW;AAAA,QAC5B,QAAQ,UAAU,WAAW;AAAA,MAC/B,CAAC;AAAA;AAAA,MAED,OAAO,YACL,WACA,+CAA+C,OAAQ,UAAiC,IAAI,KAC9F;AAAA;AAAA;AAQN,SAAS,gBAAmB,CAAC,OAAa;AAAA,EACxC,OAAO,gBAAgB,KAAK;AAAA;AAI9B,SAAS,iBAAoB,CAAC,OAAa;AAAA,EACzC,OAAO,gBAAgB,KAAK;AAAA;AAI9B,SAAS,qBAAqB,CAAC,QAA6D;AAAA,EAC1F,IAAI,CAAC,MAAM,QAAQ,MAAM,GAAG;AAAA,IAC1B,MAAM,IAAI,4BAA2B;AAAA,MACnC;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EACA,MAAM,SAAS,OAAO;AAAA,EACtB,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,yBAAwB;AAAA,IACpE,MAAM,IAAI,4BAA2B;AAAA,MACnC;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,+BAA+B;AAAA,MAC1C;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,WAAiC,CAAC;AAAA,EACxC,SAAS,QAAQ,EAAG,QAAQ,QAAQ,SAAS,GAAG;AAAA,IAC9C,MAAM,QAAQ,OAAO;AAAA,IACrB,SAAS,KAAK,EAAE,YAAY,MAAM,YAAY,OAAO,MAAM,MAAM,CAAC;AAAA,EACpE;AAAA,EACA,OAAO;AAAA;AAIT,SAAS,qBAAqB,CAAC,OAAiC;AAAA,EAC9D,IAAI;AAAA,IACF,MAAM,WAAW,gBAAgB,KAAK;AAAA,IACtC,MAAM,UAAU,CAAC,QAAQ;AAAA,IACzB,MAAM,OAAO,IAAI;AAAA,IACjB,WAAW,QAAQ,SAAS;AAAA,MAC1B,IAAI,KAAK,IAAI,IAAI;AAAA,QAAG;AAAA,MACpB,KAAK,IAAI,IAAI;AAAA,MACb,IACE,KAAK,SAAS,aACb,OAAO,KAAK,WAAW,YACtB,OAAO,KAAK,YAAY,aACxB,gBAAgB,QAClB;AAAA,QACA,MAAM,IAAI,4BAA2B;AAAA,UACnC;AAAA,YACE,MAAM;AAAA,YACN,MAAM;AAAA,YACN,SAAS;AAAA,UACX;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA,IAAI,WAAW;AAAA,QAAM,QAAQ,KAAK,KAAK,KAAK;AAAA,MAC5C,IAAI,KAAK,SAAS;AAAA,QAAO,QAAQ,KAAK,GAAG,KAAK,MAAM;AAAA,IACtD;AAAA,IACA,OAAO;AAAA,IACP,OAAO,OAAO;AAAA,IACd,IAAI,iBAAiB;AAAA,MAA4B,MAAM;AAAA,IACvD,MAAM,IAAI,4BAA2B;AAAA,MACnC;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAAA;AAAA;",
+  "debugId": "2DBF13BEAC1BA51864756E2164756E21",
+  "names": []
+}

package/dist/{chunk-3zxk45er.js → chunk-8ncg20rd.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   isFileRef2
-} from "./chunk-jhm3zsa7.js";
+} from "./chunk-wkv3h3q7.js";
 import {
   BlobStorageError2
 } from "./chunk-h8teetr0.js";
@@ -82,71 +82,6 @@ function expiryFrom(createdAt, expiresInMs) {
   }
   return new Date(expiresAt);
 }
-// src/blob-storage/file-content.ts
-function resolveFileRefAtPath2(root, path) {
-  const value = resolveJsonPointer(root, path);
-  return isFileRef2(value) ? value : null;
-}
-async function statFileRef2(blobStorage, fileRef) {
-  const stat = await blobStorage.stat(fileRef.blobId);
-  return stat && stat.blobId === fileRef.blobId && stat.digest === fileRef.digest && stat.sizeBytes === fileRef.sizeBytes ? stat : null;
-}
-async function openFileRef2(blobStorage, fileRef) {
-  const stat = await statFileRef2(blobStorage, fileRef);
-  if (!stat)
-    return null;
-  return { fileRef, body: openOnFirstRead(blobStorage, fileRef.blobId) };
-}
-function openOnFirstRead(blobStorage, blobId) {
-  let reader;
-  return new ReadableStream({
-    async pull(controller) {
-      reader ??= (await blobStorage.open(blobId)).getReader();
-      const { done, value } = await reader.read();
-      if (done)
-        controller.close();
-      else
-        controller.enqueue(value);
-    },
-    async cancel(reason) {
-      await reader?.cancel(reason);
-    }
-  }, { highWaterMark: 0 });
-}
-function jsonPointerSegment2(segment) {
-  return String(segment).replaceAll("~", "~0").replaceAll("/", "~1");
-}
-function resolveJsonPointer(root, pointer) {
-  if (pointer === "") {
-    return root;
-  }
-  if (!pointer.startsWith("/")) {
-    return;
-  }
-  let current = root;
-  for (const rawSegment of pointer.slice(1).split("/")) {
-    const segment = decodeJsonPointerSegment(rawSegment);
-    if (Array.isArray(current)) {
-      const index = Number.parseInt(segment, 10);
-      if (!Number.isInteger(index) || index < 0 || index.toString() !== segment) {
-        return;
-      }
-      if (!Object.hasOwn(current, segment)) {
-        return;
-      }
-      current = current[index];
-      continue;
-    }
-    if (typeof current !== "object" || current === null || !Object.hasOwn(current, segment)) {
-      return;
-    }
-    current = current[segment];
-  }
-  return current;
-}
-function decodeJsonPointerSegment(segment) {
-  return segment.replaceAll("~1", "/").replaceAll("~0", "~");
-}
-export { FILE_DOWNLOAD_ROUTE_PREFIX2, createFileDownloadUrl, revokeFileDownloadUrl, resolveFileDownload2, resolveFileRefAtPath2, statFileRef2, openFileRef2, jsonPointerSegment2 };
+export { FILE_DOWNLOAD_ROUTE_PREFIX2, createFileDownloadUrl, revokeFileDownloadUrl, resolveFileDownload2 };
 
-//# debugId=14717FDAE9DF0DDF64756E2164756E21
+//# debugId=C8FBB8115796391A64756E2164756E21

package/dist/{chunk-3zxk45er.js.map → chunk-8ncg20rd.js.map}

@@ -1,11 +1,10 @@
 {
   "version": 3,
-  "sources": ["../src/blob-storage/download-urls.ts", "../src/blob-storage/file-content.ts"],
+  "sources": ["../src/blob-storage/download-urls.ts"],
   "sourcesContent": [
-    "import { createHash, randomBytes, randomUUID } from \"node:crypto\"\nimport type { FileDownloadGrantRecord, FileDownloadGrantStorage, Storage } from \"../storage\"\nimport { BlobStorageError } from \"./errors\"\nimport type { BlobStorage, FileRef } from \"./types\"\nimport { isFileRef } from \"./validation\"\n\n/**\n * Download URLs let a third party that cannot hold a Sixb session — a social network fetching\n * media to publish, for instance — read one file for a bounded time.\n *\n * Each URL carries a random token. Storage keeps only its SHA-256, with the file, the expiry, and\n * the execution that issued it. The API looks the token up on every request, so any process\n * sharing the storage can issue a URL, and a URL can be revoked before it expires.\n *\n * The API serves the bytes itself rather than redirecting to the blob provider: fetchers such as\n * TikTok refuse redirects and accept only hosts whose ownership the developer verified.\n */\n\n/** Path prefix of the public route that serves download URLs. */\nexport const FILE_DOWNLOAD_ROUTE_PREFIX = \"/api/files/downloads/\"\n\nconst DEFAULT_EXPIRY_MS = 60 * 60 * 1000\n// SQLite compares ISO timestamps as text, which orders them correctly only for four-digit years.\nconst LATEST_EXPIRY_MS = Date.UTC(9999, 11, 31, 23, 59, 59, 999)\n/** 32 random bytes in base64url. */\nconst TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/\n\nexport interface CreateFileDownloadUrlOptions {\n  /** How long the URL stays valid. Defaults to one hour. */\n  readonly expiresInMs?: number\n}\n\nexport interface FileDownloadUrl {\n  /** Pass to `blobs.revokeDownloadUrl()` to stop the URL before it expires. */\n  readonly id: string\n  readonly url: string\n  readonly expiresAt: Date\n}\n\n/** What issuing and revoking need from the execution that asks. */\nexport interface FileDownloadUrlContext {\n  readonly projectId: string\n  readonly storage: Storage\n  readonly blobStorage: BlobStorage\n  readonly executionId: string\n  readonly apiPublicOrigin: string | undefined\n}\n\nexport async function createFileDownloadUrl(\n  context: FileDownloadUrlContext,\n  file: FileRef,\n  options: CreateFileDownloadUrlOptions = {}\n): Promise<FileDownloadUrl> {\n  if (!isFileRef(file)) {\n    throw new Error(\"[Sixb] blobs.createDownloadUrl() requires a valid file reference.\")\n  }\n  const createdAt = new Date()\n  const expiresAt = expiryFrom(createdAt, options.expiresInMs ?? DEFAULT_EXPIRY_MS)\n  const grants = requireGrantStorage(context.storage)\n  if (context.apiPublicOrigin === undefined) {\n    throw new Error(\n      \"[Sixb] blobs.createDownloadUrl() needs the API's public origin. Set SIXB_API_PUBLIC_ORIGIN for the API and every worker.\"\n    )\n  }\n  // Fail here, not when a third party fetches the URL minutes later and gets a bare 404.\n  const stat = await context.blobStorage.stat(file.blobId)\n  if (!stat || stat.digest !== file.digest || stat.sizeBytes !== file.sizeBytes) {\n    throw new BlobStorageError(`[Sixb] No stored blob matches file '${file.blobId}'.`)\n  }\n\n  const token = randomBytes(32).toString(\"base64url\")\n  const { logicalPath: _logicalPath, ...served } = file\n  const grant: FileDownloadGrantRecord = {\n    id: `filedownload_${randomUUID()}`,\n    projectId: context.projectId,\n    tokenHash: hashToken(token),\n    file: served,\n    executionId: context.executionId,\n    createdAt,\n    expiresAt,\n  }\n  await grants.create(grant)\n\n  return {\n    id: grant.id,\n    url: new URL(`${FILE_DOWNLOAD_ROUTE_PREFIX}${token}`, context.apiPublicOrigin).toString(),\n    expiresAt: grant.expiresAt,\n  }\n}\n\nexport async function revokeFileDownloadUrl(\n  context: FileDownloadUrlContext,\n  id: string\n): Promise<void> {\n  const revoked = await requireGrantStorage(context.storage).revoke({\n    projectId: context.projectId,\n    id,\n    revokedAt: new Date(),\n  })\n  if (!revoked) {\n    throw new Error(`[Sixb] Download URL '${id}' does not exist.`)\n  }\n}\n\n/** The file a token serves, or `null` when the token is unknown, expired, or revoked. */\nexport async function resolveFileDownload(\n  host: { readonly id: string; readonly storage: Storage },\n  token: string\n): Promise<FileRef | null> {\n  const grants = host.storage.fileDownloadGrants\n  if (!grants || !TOKEN_PATTERN.test(token)) return null\n\n  const grant = await grants.findByTokenHash({ projectId: host.id, tokenHash: hashToken(token) })\n  if (!grant || grant.revokedAt || grant.expiresAt.getTime() <= Date.now()) return null\n  return grant.file\n}\n\nfunction hashToken(token: string): string {\n  return createHash(\"sha256\").update(token).digest(\"hex\")\n}\n\nfunction requireGrantStorage(storage: Storage): FileDownloadGrantStorage {\n  if (!storage.fileDownloadGrants) {\n    throw new Error(\"[Sixb] Download URLs require storage.fileDownloadGrants.\")\n  }\n  return storage.fileDownloadGrants\n}\n\nfunction expiryFrom(createdAt: Date, expiresInMs: number): Date {\n  if (!Number.isSafeInteger(expiresInMs) || expiresInMs <= 0) {\n    throw new Error(\"[Sixb] expiresInMs must be a positive integer.\")\n  }\n  const expiresAt = createdAt.getTime() + expiresInMs\n  if (expiresAt > LATEST_EXPIRY_MS) {\n    throw new Error(\"[Sixb] expiresInMs must end before the year 10000.\")\n  }\n  return new Date(expiresAt)\n}\n",
-    "import type { BlobInfo, BlobStorage, FileRef, OpenedFileRef } from \"./types\"\nimport { isFileRef } from \"./validation\"\n\n/**\n * A file is served only through the record that references it: the caller reads that record with\n * its own authority, resolves the FileRef inside it, then checks the FileRef against the stored\n * blob. File content routes and the SDK's `file().open()` share these steps.\n */\n\n/** The FileRef at a JSON Pointer in an authorized record, or null when none is there. */\nexport function resolveFileRefAtPath(root: unknown, path: string): FileRef | null {\n  const value = resolveJsonPointer(root, path)\n  return isFileRef(value) ? value : null\n}\n\n/** The stored blob a FileRef names, or null when it is absent or no longer matches it. */\nexport async function statFileRef(\n  blobStorage: Pick<BlobStorage, \"stat\">,\n  fileRef: FileRef\n): Promise<BlobInfo | null> {\n  const stat = await blobStorage.stat(fileRef.blobId)\n  return stat &&\n    stat.blobId === fileRef.blobId &&\n    stat.digest === fileRef.digest &&\n    stat.sizeBytes === fileRef.sizeBytes\n    ? stat\n    : null\n}\n\n/**\n * Open a FileRef resolved from an authorized record, or return null when its blob is gone. The\n * blob itself is opened on the body's first read, so a body nobody reads holds nothing.\n */\nexport async function openFileRef(\n  blobStorage: Pick<BlobStorage, \"stat\" | \"open\">,\n  fileRef: FileRef\n): Promise<OpenedFileRef | null> {\n  const stat = await statFileRef(blobStorage, fileRef)\n  if (!stat) return null\n  return { fileRef, body: openOnFirstRead(blobStorage, fileRef.blobId) }\n}\n\nfunction openOnFirstRead(\n  blobStorage: Pick<BlobStorage, \"open\">,\n  blobId: string\n): ReadableStream<Uint8Array> {\n  let reader: ReadableStreamDefaultReader<Uint8Array> | undefined\n  return new ReadableStream<Uint8Array>(\n    {\n      async pull(controller) {\n        reader ??= (await blobStorage.open(blobId)).getReader()\n        const { done, value } = await reader.read()\n        if (done) controller.close()\n        else controller.enqueue(value)\n      },\n      async cancel(reason) {\n        await reader?.cancel(reason)\n      },\n    },\n    // No read-ahead: the first pull waits for the first read.\n    { highWaterMark: 0 }\n  )\n}\n\n/** Escape one segment of a JSON Pointer. */\nexport function jsonPointerSegment(segment: string | number): string {\n  return String(segment).replaceAll(\"~\", \"~0\").replaceAll(\"/\", \"~1\")\n}\n\nfunction resolveJsonPointer(root: unknown, pointer: string): unknown {\n  if (pointer === \"\") {\n    return root\n  }\n\n  if (!pointer.startsWith(\"/\")) {\n    return undefined\n  }\n\n  let current = root\n  for (const rawSegment of pointer.slice(1).split(\"/\")) {\n    const segment = decodeJsonPointerSegment(rawSegment)\n    if (Array.isArray(current)) {\n      const index = Number.parseInt(segment, 10)\n      if (!Number.isInteger(index) || index < 0 || index.toString() !== segment) {\n        return undefined\n      }\n      if (!Object.hasOwn(current, segment)) {\n        return undefined\n      }\n      current = current[index]\n      continue\n    }\n\n    if (typeof current !== \"object\" || current === null || !Object.hasOwn(current, segment)) {\n      return undefined\n    }\n\n    current = (current as Record<string, unknown>)[segment]\n  }\n\n  return current\n}\n\nfunction decodeJsonPointerSegment(segment: string): string {\n  return segment.replaceAll(\"~1\", \"/\").replaceAll(\"~0\", \"~\")\n}\n"
+    "import { createHash, randomBytes, randomUUID } from \"node:crypto\"\nimport type { FileDownloadGrantRecord, FileDownloadGrantStorage, Storage } from \"../storage\"\nimport { BlobStorageError } from \"./errors\"\nimport type { BlobStorage, FileRef } from \"./types\"\nimport { isFileRef } from \"./validation\"\n\n/**\n * Download URLs let a third party that cannot hold a Sixb session — a social network fetching\n * media to publish, for instance — read one file for a bounded time.\n *\n * Each URL carries a random token. Storage keeps only its SHA-256, with the file, the expiry, and\n * the execution that issued it. The API looks the token up on every request, so any process\n * sharing the storage can issue a URL, and a URL can be revoked before it expires.\n *\n * The API serves the bytes itself rather than redirecting to the blob provider: fetchers such as\n * TikTok refuse redirects and accept only hosts whose ownership the developer verified.\n */\n\n/** Path prefix of the public route that serves download URLs. */\nexport const FILE_DOWNLOAD_ROUTE_PREFIX = \"/api/files/downloads/\"\n\nconst DEFAULT_EXPIRY_MS = 60 * 60 * 1000\n// SQLite compares ISO timestamps as text, which orders them correctly only for four-digit years.\nconst LATEST_EXPIRY_MS = Date.UTC(9999, 11, 31, 23, 59, 59, 999)\n/** 32 random bytes in base64url. */\nconst TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/\n\nexport interface CreateFileDownloadUrlOptions {\n  /** How long the URL stays valid. Defaults to one hour. */\n  readonly expiresInMs?: number\n}\n\nexport interface FileDownloadUrl {\n  /** Pass to `blobs.revokeDownloadUrl()` to stop the URL before it expires. */\n  readonly id: string\n  readonly url: string\n  readonly expiresAt: Date\n}\n\n/** What issuing and revoking need from the execution that asks. */\nexport interface FileDownloadUrlContext {\n  readonly projectId: string\n  readonly storage: Storage\n  readonly blobStorage: BlobStorage\n  readonly executionId: string\n  readonly apiPublicOrigin: string | undefined\n}\n\nexport async function createFileDownloadUrl(\n  context: FileDownloadUrlContext,\n  file: FileRef,\n  options: CreateFileDownloadUrlOptions = {}\n): Promise<FileDownloadUrl> {\n  if (!isFileRef(file)) {\n    throw new Error(\"[Sixb] blobs.createDownloadUrl() requires a valid file reference.\")\n  }\n  const createdAt = new Date()\n  const expiresAt = expiryFrom(createdAt, options.expiresInMs ?? DEFAULT_EXPIRY_MS)\n  const grants = requireGrantStorage(context.storage)\n  if (context.apiPublicOrigin === undefined) {\n    throw new Error(\n      \"[Sixb] blobs.createDownloadUrl() needs the API's public origin. Set SIXB_API_PUBLIC_ORIGIN for the API and every worker.\"\n    )\n  }\n  // Fail here, not when a third party fetches the URL minutes later and gets a bare 404.\n  const stat = await context.blobStorage.stat(file.blobId)\n  if (!stat || stat.digest !== file.digest || stat.sizeBytes !== file.sizeBytes) {\n    throw new BlobStorageError(`[Sixb] No stored blob matches file '${file.blobId}'.`)\n  }\n\n  const token = randomBytes(32).toString(\"base64url\")\n  const { logicalPath: _logicalPath, ...served } = file\n  const grant: FileDownloadGrantRecord = {\n    id: `filedownload_${randomUUID()}`,\n    projectId: context.projectId,\n    tokenHash: hashToken(token),\n    file: served,\n    executionId: context.executionId,\n    createdAt,\n    expiresAt,\n  }\n  await grants.create(grant)\n\n  return {\n    id: grant.id,\n    url: new URL(`${FILE_DOWNLOAD_ROUTE_PREFIX}${token}`, context.apiPublicOrigin).toString(),\n    expiresAt: grant.expiresAt,\n  }\n}\n\nexport async function revokeFileDownloadUrl(\n  context: FileDownloadUrlContext,\n  id: string\n): Promise<void> {\n  const revoked = await requireGrantStorage(context.storage).revoke({\n    projectId: context.projectId,\n    id,\n    revokedAt: new Date(),\n  })\n  if (!revoked) {\n    throw new Error(`[Sixb] Download URL '${id}' does not exist.`)\n  }\n}\n\n/** The file a token serves, or `null` when the token is unknown, expired, or revoked. */\nexport async function resolveFileDownload(\n  host: { readonly id: string; readonly storage: Storage },\n  token: string\n): Promise<FileRef | null> {\n  const grants = host.storage.fileDownloadGrants\n  if (!grants || !TOKEN_PATTERN.test(token)) return null\n\n  const grant = await grants.findByTokenHash({ projectId: host.id, tokenHash: hashToken(token) })\n  if (!grant || grant.revokedAt || grant.expiresAt.getTime() <= Date.now()) return null\n  return grant.file\n}\n\nfunction hashToken(token: string): string {\n  return createHash(\"sha256\").update(token).digest(\"hex\")\n}\n\nfunction requireGrantStorage(storage: Storage): FileDownloadGrantStorage {\n  if (!storage.fileDownloadGrants) {\n    throw new Error(\"[Sixb] Download URLs require storage.fileDownloadGrants.\")\n  }\n  return storage.fileDownloadGrants\n}\n\nfunction expiryFrom(createdAt: Date, expiresInMs: number): Date {\n  if (!Number.isSafeInteger(expiresInMs) || expiresInMs <= 0) {\n    throw new Error(\"[Sixb] expiresInMs must be a positive integer.\")\n  }\n  const expiresAt = createdAt.getTime() + expiresInMs\n  if (expiresAt > LATEST_EXPIRY_MS) {\n    throw new Error(\"[Sixb] expiresInMs must end before the year 10000.\")\n  }\n  return new Date(expiresAt)\n}\n"
   ],
-  "mappings": ";;;;;;;;;AAAA;AAmBO,IAAM,8BAA6B;AAE1C,IAAM,oBAAoB,KAAK,KAAK;AAEpC,IAAM,mBAAmB,KAAK,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG;AAE/D,IAAM,gBAAgB;AAuBtB,eAAsB,qBAAqB,CACzC,SACA,MACA,UAAwC,CAAC,GACf;AAAA,EAC1B,IAAI,CAAC,WAAU,IAAI,GAAG;AAAA,IACpB,MAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AAAA,EACA,MAAM,YAAY,IAAI;AAAA,EACtB,MAAM,YAAY,WAAW,WAAW,QAAQ,eAAe,iBAAiB;AAAA,EAChF,MAAM,SAAS,oBAAoB,QAAQ,OAAO;AAAA,EAClD,IAAI,QAAQ,oBAAoB,WAAW;AAAA,IACzC,MAAM,IAAI,MACR,0HACF;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,MAAM,QAAQ,YAAY,KAAK,KAAK,MAAM;AAAA,EACvD,IAAI,CAAC,QAAQ,KAAK,WAAW,KAAK,UAAU,KAAK,cAAc,KAAK,WAAW;AAAA,IAC7E,MAAM,IAAI,kBAAiB,uCAAuC,KAAK,UAAU;AAAA,EACnF;AAAA,EAEA,MAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,EAClD,QAAQ,aAAa,iBAAiB,WAAW;AAAA,EACjD,MAAM,QAAiC;AAAA,IACrC,IAAI,gBAAgB,WAAW;AAAA,IAC/B,WAAW,QAAQ;AAAA,IACnB,WAAW,UAAU,KAAK;AAAA,IAC1B,MAAM;AAAA,IACN,aAAa,QAAQ;AAAA,IACrB;AAAA,IACA;AAAA,EACF;AAAA,EACA,MAAM,OAAO,OAAO,KAAK;AAAA,EAEzB,OAAO;AAAA,IACL,IAAI,MAAM;AAAA,IACV,KAAK,IAAI,IAAI,GAAG,8BAA6B,SAAS,QAAQ,eAAe,EAAE,SAAS;AAAA,IACxF,WAAW,MAAM;AAAA,EACnB;AAAA;AAGF,eAAsB,qBAAqB,CACzC,SACA,IACe;AAAA,EACf,MAAM,UAAU,MAAM,oBAAoB,QAAQ,OAAO,EAAE,OAAO;AAAA,IAChE,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA,WAAW,IAAI;AAAA,EACjB,CAAC;AAAA,EACD,IAAI,CAAC,SAAS;AAAA,IACZ,MAAM,IAAI,MAAM,wBAAwB,qBAAqB;AAAA,EAC/D;AAAA;AAIF,eAAsB,oBAAmB,CACvC,MACA,OACyB;AAAA,EACzB,MAAM,SAAS,KAAK,QAAQ;AAAA,EAC5B,IAAI,CAAC,UAAU,CAAC,cAAc,KAAK,KAAK;AAAA,IAAG,OAAO;AAAA,EAElD,MAAM,QAAQ,MAAM,OAAO,gBAAgB,EAAE,WAAW,KAAK,IAAI,WAAW,UAAU,KAAK,EAAE,CAAC;AAAA,EAC9F,IAAI,CAAC,SAAS,MAAM,aAAa,MAAM,UAAU,QAAQ,KAAK,KAAK,IAAI;AAAA,IAAG,OAAO;AAAA,EACjF,OAAO,MAAM;AAAA;AAGf,SAAS,SAAS,CAAC,OAAuB;AAAA,EACxC,OAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAAA;AAGxD,SAAS,mBAAmB,CAAC,SAA4C;AAAA,EACvE,IAAI,CAAC,QAAQ,oBAAoB;AAAA,IAC/B,MAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAAA,EACA,OAAO,QAAQ;AAAA;AAGjB,SAAS,UAAU,CAAC,WAAiB,aAA2B;AAAA,EAC9D,IAAI,CAAC,OAAO,cAAc,WAAW,KAAK,eAAe,GAAG;AAAA,IAC1D,MAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AAAA,EACA,MAAM,YAAY,UAAU,QAAQ,IAAI;AAAA,EACxC,IAAI,YAAY,kBAAkB;AAAA,IAChC,MAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AAAA,EACA,OAAO,IAAI,KAAK,SAAS;AAAA;;AC9HpB,SAAS,qBAAoB,CAAC,MAAe,MAA8B;AAAA,EAChF,MAAM,QAAQ,mBAAmB,MAAM,IAAI;AAAA,EAC3C,OAAO,WAAU,KAAK,IAAI,QAAQ;AAAA;AAIpC,eAAsB,YAAW,CAC/B,aACA,SAC0B;AAAA,EAC1B,MAAM,OAAO,MAAM,YAAY,KAAK,QAAQ,MAAM;AAAA,EAClD,OAAO,QACL,KAAK,WAAW,QAAQ,UACxB,KAAK,WAAW,QAAQ,UACxB,KAAK,cAAc,QAAQ,YACzB,OACA;AAAA;AAON,eAAsB,YAAW,CAC/B,aACA,SAC+B;AAAA,EAC/B,MAAM,OAAO,MAAM,aAAY,aAAa,OAAO;AAAA,EACnD,IAAI,CAAC;AAAA,IAAM,OAAO;AAAA,EAClB,OAAO,EAAE,SAAS,MAAM,gBAAgB,aAAa,QAAQ,MAAM,EAAE;AAAA;AAGvE,SAAS,eAAe,CACtB,aACA,QAC4B;AAAA,EAC5B,IAAI;AAAA,EACJ,OAAO,IAAI,eACT;AAAA,SACQ,KAAI,CAAC,YAAY;AAAA,MACrB,YAAY,MAAM,YAAY,KAAK,MAAM,GAAG,UAAU;AAAA,MACtD,QAAQ,MAAM,UAAU,MAAM,OAAO,KAAK;AAAA,MAC1C,IAAI;AAAA,QAAM,WAAW,MAAM;AAAA,MACtB;AAAA,mBAAW,QAAQ,KAAK;AAAA;AAAA,SAEzB,OAAM,CAAC,QAAQ;AAAA,MACnB,MAAM,QAAQ,OAAO,MAAM;AAAA;AAAA,EAE/B,GAEA,EAAE,eAAe,EAAE,CACrB;AAAA;AAIK,SAAS,mBAAkB,CAAC,SAAkC;AAAA,EACnE,OAAO,OAAO,OAAO,EAAE,WAAW,KAAK,IAAI,EAAE,WAAW,KAAK,IAAI;AAAA;AAGnE,SAAS,kBAAkB,CAAC,MAAe,SAA0B;AAAA,EACnE,IAAI,YAAY,IAAI;AAAA,IAClB,OAAO;AAAA,EACT;AAAA,EAEA,IAAI,CAAC,QAAQ,WAAW,GAAG,GAAG;AAAA,IAC5B;AAAA,EACF;AAAA,EAEA,IAAI,UAAU;AAAA,EACd,WAAW,cAAc,QAAQ,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG;AAAA,IACpD,MAAM,UAAU,yBAAyB,UAAU;AAAA,IACnD,IAAI,MAAM,QAAQ,OAAO,GAAG;AAAA,MAC1B,MAAM,QAAQ,OAAO,SAAS,SAAS,EAAE;AAAA,MACzC,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,MAAM,SAAS,MAAM,SAAS;AAAA,QACzE;AAAA,MACF;AAAA,MACA,IAAI,CAAC,OAAO,OAAO,SAAS,OAAO,GAAG;AAAA,QACpC;AAAA,MACF;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB;AAAA,IACF;AAAA,IAEA,IAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,CAAC,OAAO,OAAO,SAAS,OAAO,GAAG;AAAA,MACvF;AAAA,IACF;AAAA,IAEA,UAAW,QAAoC;AAAA,EACjD;AAAA,EAEA,OAAO;AAAA;AAGT,SAAS,wBAAwB,CAAC,SAAyB;AAAA,EACzD,OAAO,QAAQ,WAAW,MAAM,GAAG,EAAE,WAAW,MAAM,GAAG;AAAA;",
-  "debugId": "14717FDAE9DF0DDF64756E2164756E21",
+  "mappings": ";;;;;;;;;AAAA;AAmBO,IAAM,8BAA6B;AAE1C,IAAM,oBAAoB,KAAK,KAAK;AAEpC,IAAM,mBAAmB,KAAK,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG;AAE/D,IAAM,gBAAgB;AAuBtB,eAAsB,qBAAqB,CACzC,SACA,MACA,UAAwC,CAAC,GACf;AAAA,EAC1B,IAAI,CAAC,WAAU,IAAI,GAAG;AAAA,IACpB,MAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AAAA,EACA,MAAM,YAAY,IAAI;AAAA,EACtB,MAAM,YAAY,WAAW,WAAW,QAAQ,eAAe,iBAAiB;AAAA,EAChF,MAAM,SAAS,oBAAoB,QAAQ,OAAO;AAAA,EAClD,IAAI,QAAQ,oBAAoB,WAAW;AAAA,IACzC,MAAM,IAAI,MACR,0HACF;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,MAAM,QAAQ,YAAY,KAAK,KAAK,MAAM;AAAA,EACvD,IAAI,CAAC,QAAQ,KAAK,WAAW,KAAK,UAAU,KAAK,cAAc,KAAK,WAAW;AAAA,IAC7E,MAAM,IAAI,kBAAiB,uCAAuC,KAAK,UAAU;AAAA,EACnF;AAAA,EAEA,MAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,WAAW;AAAA,EAClD,QAAQ,aAAa,iBAAiB,WAAW;AAAA,EACjD,MAAM,QAAiC;AAAA,IACrC,IAAI,gBAAgB,WAAW;AAAA,IAC/B,WAAW,QAAQ;AAAA,IACnB,WAAW,UAAU,KAAK;AAAA,IAC1B,MAAM;AAAA,IACN,aAAa,QAAQ;AAAA,IACrB;AAAA,IACA;AAAA,EACF;AAAA,EACA,MAAM,OAAO,OAAO,KAAK;AAAA,EAEzB,OAAO;AAAA,IACL,IAAI,MAAM;AAAA,IACV,KAAK,IAAI,IAAI,GAAG,8BAA6B,SAAS,QAAQ,eAAe,EAAE,SAAS;AAAA,IACxF,WAAW,MAAM;AAAA,EACnB;AAAA;AAGF,eAAsB,qBAAqB,CACzC,SACA,IACe;AAAA,EACf,MAAM,UAAU,MAAM,oBAAoB,QAAQ,OAAO,EAAE,OAAO;AAAA,IAChE,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA,WAAW,IAAI;AAAA,EACjB,CAAC;AAAA,EACD,IAAI,CAAC,SAAS;AAAA,IACZ,MAAM,IAAI,MAAM,wBAAwB,qBAAqB;AAAA,EAC/D;AAAA;AAIF,eAAsB,oBAAmB,CACvC,MACA,OACyB;AAAA,EACzB,MAAM,SAAS,KAAK,QAAQ;AAAA,EAC5B,IAAI,CAAC,UAAU,CAAC,cAAc,KAAK,KAAK;AAAA,IAAG,OAAO;AAAA,EAElD,MAAM,QAAQ,MAAM,OAAO,gBAAgB,EAAE,WAAW,KAAK,IAAI,WAAW,UAAU,KAAK,EAAE,CAAC;AAAA,EAC9F,IAAI,CAAC,SAAS,MAAM,aAAa,MAAM,UAAU,QAAQ,KAAK,KAAK,IAAI;AAAA,IAAG,OAAO;AAAA,EACjF,OAAO,MAAM;AAAA;AAGf,SAAS,SAAS,CAAC,OAAuB;AAAA,EACxC,OAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAAA;AAGxD,SAAS,mBAAmB,CAAC,SAA4C;AAAA,EACvE,IAAI,CAAC,QAAQ,oBAAoB;AAAA,IAC/B,MAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAAA,EACA,OAAO,QAAQ;AAAA;AAGjB,SAAS,UAAU,CAAC,WAAiB,aAA2B;AAAA,EAC9D,IAAI,CAAC,OAAO,cAAc,WAAW,KAAK,eAAe,GAAG;AAAA,IAC1D,MAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AAAA,EACA,MAAM,YAAY,UAAU,QAAQ,IAAI;AAAA,EACxC,IAAI,YAAY,kBAAkB;AAAA,IAChC,MAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AAAA,EACA,OAAO,IAAI,KAAK,SAAS;AAAA;",
+  "debugId": "C8FBB8115796391A64756E2164756E21",
   "names": []
 }

package/dist/{chunk-yxd3nnqt.js → chunk-9mab3dvg.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   scopeKeysForEvent2
-} from "./chunk-bkpke1sg.js";
+} from "./chunk-t5608tkq.js";
 
 // src/events/selectors/builder.ts
 class EventSelectorSpecView {
@@ -210,6 +210,27 @@ class PipelineEventSelectorBuilderImpl extends EventSelectorSpecView {
     };
   }
 }
+
+class UserEventSelectorBuilderImpl extends EventSelectorSpecView {
+  joined() {
+    return this.withType("user.joined");
+  }
+  suspended() {
+    return this.withType("user.suspended");
+  }
+  reactivated() {
+    return this.withType("user.reactivated");
+  }
+  invited() {
+    return this.withType("user.invited");
+  }
+  profileUpdated() {
+    return this.withType("user.profile.updated");
+  }
+  withType(type) {
+    return { ...this.spec, types: [type] };
+  }
+}
 var events2 = {
   object(objectType) {
     return new ObjectEventSelectorBuilderImpl(objectType, { objectTypeId: objectType.id });
@@ -237,6 +258,9 @@ var events2 = {
       topic: "pipelines",
       pipelineId: pipeline.id
     });
+  },
+  users() {
+    return new UserEventSelectorBuilderImpl({ topic: "users" });
   }
 };
 function createPropertySelectorMap(tokens, createSelector) {
@@ -332,4 +356,4 @@ function hasPropertyChanges(event) {
 }
 export { events2, eventSelectorSpec2, buildEventSelectorPredicate2 };
 
-//# debugId=5EF4CE704A7F325564756E2164756E21
+//# debugId=AAA718E7A59C5EFF64756E2164756E21