@sixb/core 0.1.20 → 0.1.22

package/dist/sandboxes/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/sandboxes/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAExE,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE5D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,sEAAsE;IACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/C,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;IACtC,kGAAkG;IAClG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAA;CAChD,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAA;AAE5B,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAA;CACrD;AAED,oGAAoG;AACpG,MAAM,WAAW,qBAAqB;IACpC,8FAA8F;IAC9F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;IACjE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAA;IACnE,sGAAsG;IACtG,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACjD;AAED,oGAAoG;AACpG,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAA;CAC7B;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC;;;OAGG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,WAAW,EAAE,SAAS,wBAAwB,EAAE,KAC7C,OAAO,CAAC,IAAI,CAAC,CAAA;IAElB,UAAU,CACR,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAAA;IAEzB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9D;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,SAAS,YAAY,GAAG,YAAY;IAChF,yFAAyF;IACzF,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAA;IAC7C,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;IAC/C;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACxD;;;;;;;;OAQG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxE"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/sandboxes/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAExE,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE5D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,sEAAsE;IACtE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/C,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAAA;IACtC,kGAAkG;IAClG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAA;CAChD,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAA;AAE5B,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,0FAA0F;AAC1F,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAA;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,oBAAoB,EAAE,CAAA;IACvE,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAA;CACrD;AAED,oGAAoG;AACpG,MAAM,WAAW,qBAAqB;IACpC,8FAA8F;IAC9F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,wBAAwB,EAAE,CAAA;IACjE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAA;CACxC;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,OAAO,CAAC,CAAA;IACnE,sGAAsG;IACtG,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CACjD;AAED,oGAAoG;AACpG,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAA;CAC7B;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IAEjC;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAC/B,WAAW,EAAE,SAAS,wBAAwB,EAAE,KAC7C,OAAO,CAAC,IAAI,CAAC,CAAA;IAElB,UAAU,CACR,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,aAAa,CAAC,CAAA;IAEzB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE9D;;;OAGG;IACH,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACrB;;OAEG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,SAAS,YAAY,GAAG,YAAY;IAChF,4FAA4F;IAC5F,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAA;IAC7C,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;IAC/C;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACxD;;;;;;;;OAQG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxE"}

package/dist/schedules/builders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/schedules/builders.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAMV,eAAe,EAChB,MAAM,SAAS,CAAA;AAsKhB,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA"}
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/schedules/builders.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAMV,eAAe,EAChB,MAAM,SAAS,CAAA;AAwKhB,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA"}

package/dist/schedules/index.js

@@ -8,7 +8,7 @@ import {
   assertScheduleDefinition2,
   isScheduleDefinition2,
   validateSchedulesAtStartup2
-} from "../chunk-nq6gpjt7.js";
+} from "../chunk-fntqb7qy.js";
 import {
   ScheduleValidationError2,
   CronValidationError2,
@@ -16,8 +16,8 @@ import {
   createCronMatcher2,
   nextCronOccurrence2
 } from "../chunk-fb3feg1e.js";
-import"../chunk-yxd3nnqt.js";
-import"../chunk-bkpke1sg.js";
+import"../chunk-9mab3dvg.js";
+import"../chunk-t5608tkq.js";
 export {
   CronValidationError2 as CronValidationError,
   ScheduleValidationError2 as ScheduleValidationError,

package/dist/schedules/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/schedules/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACzF,OAAO,KAAK,EAAE,WAAW,EAAqC,MAAM,iBAAiB,CAAA;AAErF,OAAO,KAAK,EAA+B,8BAA8B,EAAE,MAAM,SAAS,CAAA;AAE1F,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AAE3E,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAA;CAC7E;AAED,MAAM,WAAW,6BAA6B,CAAC,MAAM,GAAG,OAAO;IAC7D,QAAQ,CAAC,QAAQ,EAAE,8BAA8B,CAAA;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,8BAA8B,GACvC,SAAS,WAAW,CAAC,MAAM,CAAC,EAAE,CAEhC;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,8BAA8B,EACxC,KAAK,EAAE,WAAW,GACjB,6BAA6B,GAAG,IAAI,CAmCtC;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,WAAW,GAAG,2BAA2B,GAAG,IAAI,CA+ChG"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/schedules/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACzF,OAAO,KAAK,EAAE,WAAW,EAAqC,MAAM,iBAAiB,CAAA;AAErF,OAAO,KAAK,EAA+B,8BAA8B,EAAE,MAAM,SAAS,CAAA;AAE1F,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AAE3E,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAA;CAC7E;AAED,MAAM,WAAW,6BAA6B,CAAC,MAAM,GAAG,OAAO;IAC7D,QAAQ,CAAC,QAAQ,EAAE,8BAA8B,CAAA;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,8BAA8B,GACvC,SAAS,WAAW,CAAC,MAAM,CAAC,EAAE,CAEhC;AAED,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,8BAA8B,EACxC,KAAK,EAAE,WAAW,GACjB,6BAA6B,GAAG,IAAI,CAmCtC;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,WAAW,GAAG,2BAA2B,GAAG,IAAI,CAqDhG"}

package/dist/schedules/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/schedules/validation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA0B,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAI3E,OAAO,KAAK,EAAmD,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAWlG,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAChD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAChD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACrD;AAgBD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,KAAyD,GAC1F,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAkCrC;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAOhF;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,SAAS,kBAAkB,EAAE,EACxC,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,iCAAsC,GAC9C,IAAI,CAkBN"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/schedules/validation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA0B,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAI3E,OAAO,KAAK,EAAmD,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAkBlG,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAChD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACnD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAChD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACrD;AAgBD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,KAAyD,GAC1F,OAAO,CAAC,KAAK,IAAI,kBAAkB,CAkCrC;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAOhF;AAED,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,SAAS,kBAAkB,EAAE,EACxC,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,GAAE,iCAAsC,GAC9C,IAAI,CAkBN"}

package/dist/security/applied-markings-contribution.d.ts

@@ -0,0 +1,58 @@
+import type { ProjectionEventOrigin } from "../events/envelope";
+import type { DatasetVersion } from "../lake-storage/types";
+import type { OntologyDefinitionCatalog } from "../ontology/registry";
+import type { PipelineDefinition } from "../pipelines/types";
+import type { LinkProjectionDefinition, ObjectProjectionDefinition } from "../projections/types";
+import type { ActiveOntologySource } from "../storage/ontology";
+import { type AppliedContribution } from "./applied-markings-snapshot";
+import type { VersionClassification } from "./dataset-version-markings";
+export type SourceProjection = ObjectProjectionDefinition | LinkProjectionDefinition;
+/** What reading a projection's applied version from the lake gave. */
+export type AppliedVersionRead = {
+    readonly kind: "read";
+    readonly version: DatasetVersion;
+    readonly classification: VersionClassification;
+} | {
+    readonly kind: "missing";
+} | {
+    readonly kind: "failed";
+    readonly error: unknown;
+};
+export interface AppliedContributionContext {
+    readonly ontology: Pick<OntologyDefinitionCatalog, "getObjectTypeById">;
+    /** The revision of a projection's current definition. */
+    readonly revisionOf: (projectionId: string) => string;
+    /** What a version that cannot be read may carry. */
+    readonly everyMarking: ReadonlySet<string>;
+    /** The pipeline that writes a dataset in the current code, for messages. */
+    readonly pipelineOf: (datasetId: string) => string | undefined;
+}
+/**
+ * What one projection's applied version adds to the code's markings, with the notice that explains
+ * it. It reads nothing: the caller reads and classifies the version.
+ *
+ * - A version that could not be read seals the projection's target with every marking.
+ * - Objects written by an earlier definition, which may have mapped any column, seal it with every
+ *   marking of the version.
+ * - Otherwise a property keeps the markings its column carries beyond its declaration, and a key
+ *   column that carries markings seals what it keys.
+ */
+export declare function appliedContribution(projection: SourceProjection, source: ActiveOntologySource, read: AppliedVersionRead, context: AppliedContributionContext): AppliedContribution;
+/** Every marking the version carries in any column; every marking when it could not be read. */
+export declare function appliedVersionMarkings(read: AppliedVersionRead, everyMarking: ReadonlySet<string>): readonly string[];
+/** An object event a projection emitted: the version its values came from, and its type. */
+export type EventOriginRef = Pick<ProjectionEventOrigin, "projectionId" | "datasetId" | "datasetVersionId"> & {
+    readonly objectTypeId: string;
+};
+/**
+ * The markings an object event's origin version carries on each property its projection maps.
+ * When the projection now maps another dataset or type, or the version cannot be read, every
+ * property but the primary one carries every marking it could, as objects written under an
+ * earlier definition do.
+ */
+export declare function eventOriginMarkings(projection: ObjectProjectionDefinition, origin: EventOriginRef, read: AppliedVersionRead, context: Pick<AppliedContributionContext, "ontology" | "everyMarking">): AppliedContribution["properties"];
+/** The pipeline that writes each dataset in the current code. */
+export declare function producingPipelines(pipelines: readonly PipelineDefinition[]): (datasetId: string) => string | undefined;
+export declare function sentence(text: string): string;
+export declare function errorMessage(error: unknown): string;
+//# sourceMappingURL=applied-markings-contribution.d.ts.map

package/dist/security/applied-markings-contribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-markings-contribution.d.ts","sourceRoot":"","sources":["../../src/security/applied-markings-contribution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAA;AAChG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EAAE,KAAK,mBAAmB,EAAmB,MAAM,6BAA6B,CAAA;AACvF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAIvE,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,GAAG,wBAAwB,CAAA;AAEpF,sEAAsE;AACtE,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAA;CAC/C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAA;AAExD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,CAAA;IACvE,yDAAyD;IACzD,QAAQ,CAAC,UAAU,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;IACrD,oDAAoD;IACpD,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;CAC/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,0BAA0B,GAClC,mBAAmB,CAyFrB;AAED,gGAAgG;AAChG,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,kBAAkB,EACxB,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAChC,SAAS,MAAM,EAAE,CAKnB;AAED,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,qBAAqB,EACrB,cAAc,GAAG,WAAW,GAAG,kBAAkB,CAClD,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAA;AAErC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,0BAA0B,EACtC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,IAAI,CAAC,0BAA0B,EAAE,UAAU,GAAG,cAAc,CAAC,GACrE,mBAAmB,CAAC,YAAY,CAAC,CAqBnC;AAED,iEAAiE;AACjE,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,kBAAkB,EAAE,GACvC,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAO3C;AAkED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAMD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnD"}

package/dist/security/applied-markings-host.d.ts

@@ -0,0 +1,10 @@
+import type { AppliedMarkings } from "./applied-markings";
+/** One snapshot per host, so every reader shares it and its resolved clearances. */
+export declare function registerAppliedMarkings(owner: object, markings: AppliedMarkings): void;
+export declare function getAppliedMarkings(owner: object): AppliedMarkings;
+/**
+ * Read the applied versions ahead of the first request that needs them. A failure is only
+ * reported here: that request reads them again, and fails closed if it cannot.
+ */
+export declare function warmAppliedMarkings(owner: object): void;
+//# sourceMappingURL=applied-markings-host.d.ts.map

package/dist/security/applied-markings-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-markings-host.d.ts","sourceRoot":"","sources":["../../src/security/applied-markings-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AASzD,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAYtF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAIjE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAMvD"}

package/dist/security/applied-markings-snapshot.d.ts

@@ -0,0 +1,67 @@
+import type { ProjectionKeyTarget } from "./projection-markings";
+/** Why readers lacking some markings cannot read an object type or a link. */
+export interface AppliedSeal {
+    readonly projectionId: string;
+    readonly markings: ReadonlySet<string>;
+    /** What carries the marking, completed by "carries marking 'm'" in messages. */
+    readonly reason: string;
+}
+export interface AppliedLinkSeals {
+    readonly objectTypeId: string;
+    readonly linkId: string;
+    readonly targetObjectTypeId: string;
+    readonly seals: readonly AppliedSeal[];
+}
+export interface AppliedMarkingsNotice {
+    readonly projectionId: string;
+    /** Whether the projection makes an object type or a link unreadable, not only properties. */
+    readonly sealed: boolean;
+    readonly message: string;
+}
+/**
+ * What the applied versions add to the ontology's markings.
+ *
+ * Every reader of a host shares one snapshot and the clearances resolved for it, so a snapshot is
+ * immutable all the way down: its maps and sets refuse writes.
+ */
+export interface AppliedMarkingsSnapshot {
+    /** Surplus markings by object type, then property. */
+    readonly properties: ReadonlyMap<string, ReadonlyMap<string, ReadonlySet<string>>>;
+    /** Object types readers lacking a seal's markings cannot read. */
+    readonly types: ReadonlyMap<string, readonly AppliedSeal[]>;
+    /** Links, by {@link appliedLinkKey}, readers lacking a seal's markings cannot read. */
+    readonly links: ReadonlyMap<string, AppliedLinkSeals>;
+    /** Every marking above: a reader cleared for all of them reads what the code allows. */
+    readonly markings: ReadonlySet<string>;
+    /** One per projection whose applied version adds markings, for diagnostics. */
+    readonly notices: readonly AppliedMarkingsNotice[];
+}
+export declare function appliedLinkKey(objectTypeId: string, linkId: string): string;
+/** What one applied version adds, as plain data so that equal results serialize equally. */
+export interface AppliedContribution {
+    readonly properties: readonly {
+        readonly objectTypeId: string;
+        readonly propertyId: string;
+        readonly markings: readonly string[];
+    }[];
+    readonly seals: readonly {
+        readonly target: ProjectionKeyTarget;
+        readonly seal: {
+            readonly projectionId: string;
+            readonly markings: readonly string[];
+            readonly reason: string;
+        };
+    }[];
+    readonly notice?: AppliedMarkingsNotice;
+}
+/** An applied version that adds nothing. */
+export declare const NO_CONTRIBUTION: AppliedContribution;
+export declare const NO_APPLIED_MARKINGS: AppliedMarkingsSnapshot;
+/** One snapshot from the contributions of every applied version, in projection order. */
+export declare function assembleAppliedMarkings(contributions: readonly AppliedContribution[]): AppliedMarkingsSnapshot;
+/**
+ * The snapshot with these properties' markings added: what an object event reads under, given the
+ * markings its origin version carries on them.
+ */
+export declare function withPropertyMarkings(snapshot: AppliedMarkingsSnapshot, added: AppliedContribution["properties"]): AppliedMarkingsSnapshot;
+//# sourceMappingURL=applied-markings-snapshot.d.ts.map

package/dist/security/applied-markings-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-markings-snapshot.d.ts","sourceRoot":"","sources":["../../src/security/applied-markings-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAEhE,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAA;CACvC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAClF,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC,CAAA;IAC3D,uFAAuF;IACvF,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;IACrD,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAA;CACnD;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,4FAA4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,SAAS;QAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KACrC,EAAE,CAAA;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS;QACvB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;QACpC,QAAQ,CAAC,IAAI,EAAE;YACb,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;YAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;YACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;SACxB,CAAA;KACF,EAAE,CAAA;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAA;CACxC;AAED,4CAA4C;AAC5C,eAAO,MAAM,eAAe,EAAE,mBAG5B,CAAA;AAEF,eAAO,MAAM,mBAAmB,EAAE,uBAMhC,CAAA;AAEF,yFAAyF;AACzF,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,SAAS,mBAAmB,EAAE,GAC5C,uBAAuB,CA6EzB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,uBAAuB,EACjC,KAAK,EAAE,mBAAmB,CAAC,YAAY,CAAC,GACvC,uBAAuB,CAsCzB"}

package/dist/security/applied-markings.d.ts

@@ -0,0 +1,73 @@
+import type { LakeStorage } from "../lake-storage/types";
+import type { OntologyDefinitionCatalog } from "../ontology/registry";
+import type { PipelineDefinition } from "../pipelines/types";
+import type { ProjectionDefinitionCatalog } from "../projections/registry";
+import type { OntologySourceStorage } from "../storage/ontology";
+import { type EventOriginRef } from "./applied-markings-contribution";
+import { type AppliedMarkingsSnapshot } from "./applied-markings-snapshot";
+import type { DatasetVersionMarkings } from "./dataset-version-markings";
+/**
+ * Objects keep the markings of the dataset version they were projected from.
+ *
+ * Startup checks the code: each projected property declares the markings its column carries. The
+ * objects a projection applied may predate that code. When a property stops declaring a marking
+ * its applied version still carries on the column, the objects still hold those values. Until the
+ * projection applies a version the code allows, each such property keeps the marking (its
+ * surplus), and an object type or link whose key column carries markings is unreadable to readers
+ * lacking them, like a type they have no view grant for.
+ *
+ * Lifecycle: the snapshot is read when a read needs it, with no background work.
+ * - A read reads it with one storage query for the projections' active sources; only projections
+ *   whose applied version or definition changed are classified again. A project whose columns
+ *   carry no marking reads nothing.
+ * - A read uses a snapshot younger than {@link APPLIED_MARKINGS_FRESH_MS}. An older one, up to
+ *   {@link APPLIED_MARKINGS_MAX_AGE_MS}, is used while one refresh runs behind the read. Past that
+ *   age, or before any snapshot, the read waits for a refresh and fails if it fails or hangs past
+ *   the same bound. Other servers so see a newly applied version within seconds.
+ * - A host that applies a projection invalidates the snapshot, so its next read refreshes first:
+ *   `sixb dev` sees a version at once.
+ */
+export interface AppliedMarkings {
+    /** Whether readers with these clearances can be denied anything the code alone allows. */
+    affects(clearances: ReadonlySet<string>): boolean;
+    /** The current snapshot, refreshed on demand. */
+    current(): Promise<AppliedMarkingsSnapshot>;
+    /** A projection applied a version in this process: the next read refreshes first. */
+    invalidate(): void;
+    /**
+     * The snapshot with the markings an object event's origin version carries on the properties
+     * its projection maps: the event holds that version's values, whatever version the projection
+     * applied since. Reads each version once, keeping the last few.
+     */
+    forEventOrigin(snapshot: AppliedMarkingsSnapshot, origin: EventOriginRef): Promise<AppliedMarkingsSnapshot>;
+    /**
+     * The snapshot with every marking a column declares on each property a projection maps to this
+     * type: what an object event's earlier values read under. They are the values an update or a
+     * deletion replaced, and the projected values an action or a direct write recorded. They came
+     * from versions projections applied before, which no event records, so they read like a version
+     * that cannot be read. Like the objects they wrote, a projection the code no longer declares
+     * marks nothing.
+     */
+    forEarlierValues(snapshot: AppliedMarkingsSnapshot, objectTypeId: string): AppliedMarkingsSnapshot;
+}
+export interface AppliedMarkingsOptions {
+    readonly projectId: string;
+    readonly ontology: Pick<OntologyDefinitionCatalog, "getObjectTypeById">;
+    readonly projections: Pick<ProjectionDefinitionCatalog, "listObjects" | "listLinks">;
+    /** The revision of a projection's current definition. */
+    readonly revisionOf: (projectionId: string) => string;
+    readonly pipelines: readonly PipelineDefinition[];
+    readonly versionMarkings: DatasetVersionMarkings;
+    readonly lakeStorage: Pick<LakeStorage, "getVersion">;
+    readonly sources: Pick<OntologySourceStorage, "listActive">;
+    /** A monotonic clock in milliseconds. */
+    readonly now?: () => number;
+    /** For this repo's tests: the bound past which a read waits, and a refresh fails. */
+    readonly maxAgeMs?: number;
+}
+/** A read uses a snapshot younger than this as it is. */
+export declare const APPLIED_MARKINGS_FRESH_MS = 5000;
+/** A read waits for a snapshot older than this, and a refresh that takes longer fails. */
+export declare const APPLIED_MARKINGS_MAX_AGE_MS = 10000;
+export declare function createAppliedMarkings(options: AppliedMarkingsOptions): AppliedMarkings;
+//# sourceMappingURL=applied-markings.d.ts.map

package/dist/security/applied-markings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-markings.d.ts","sourceRoot":"","sources":["../../src/security/applied-markings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAChE,OAAO,EAGL,KAAK,cAAc,EAMpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EAEL,KAAK,uBAAuB,EAK7B,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAExE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,eAAe;IAC9B,0FAA0F;IAC1F,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAA;IACjD,iDAAiD;IACjD,OAAO,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAC3C,qFAAqF;IACrF,UAAU,IAAI,IAAI,CAAA;IAClB;;;;OAIG;IACH,cAAc,CACZ,QAAQ,EAAE,uBAAuB,EACjC,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACnC;;;;;;;OAOG;IACH,gBAAgB,CAAC,QAAQ,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,GAAG,uBAAuB,CAAA;CACnG;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,CAAA;IACvE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,2BAA2B,EAAE,aAAa,GAAG,WAAW,CAAC,CAAA;IACpF,yDAAyD;IACzD,QAAQ,CAAC,UAAU,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAA;IACrD,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACjD,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAA;IAChD,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IACrD,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAA;IAC3D,yCAAyC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAC3B,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAKD,yDAAyD;AACzD,eAAO,MAAM,yBAAyB,OAAQ,CAAA;AAC9C,0FAA0F;AAC1F,eAAO,MAAM,2BAA2B,QAAS,CAAA;AAUjD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAkStF"}

package/dist/security/dataset-version-markings.d.ts

@@ -0,0 +1,47 @@
+import type { DatasetDefinition } from "../datasets/types";
+import type { DatasetVersion, LakeStorage } from "../lake-storage/types";
+/** Markings of each column of one dataset version. A column without markings has an empty set. */
+export type VersionColumnMarkings = ReadonlyMap<string, ReadonlySet<string>>;
+export interface VersionClassification {
+    readonly columns: VersionColumnMarkings;
+    /**
+     * Why part of the version was classified conservatively, with every marking it could hold.
+     * Absent when every column was classified from its lineage.
+     */
+    readonly conservative?: string;
+}
+/**
+ * Markings each version of a dataset carries.
+ *
+ * Markings are never stored. A column carries the markings its registered dataset declares, and
+ * those every column its lineage lists declares. The version records that lineage resolved across
+ * every upstream step and every row it keeps (`DatasetVersion.lineage`), so a version keeps the
+ * classification of the code that produced it, and classifying it reads no other version.
+ *
+ * Wherever the record does not say what a column holds (no lineage on a pipeline version, or on
+ * any version of a provider that does not declare `recordsLineage`, an unknown history, a column
+ * it does not list, a dataset no longer registered) the column is classified with every marking
+ * the project declares.
+ */
+export interface DatasetVersionMarkings {
+    classify(version: DatasetVersion): VersionClassification;
+    /**
+     * Every marking declared on a registered column. Every classification, conservative ones
+     * included, is drawn from it, so a reader cleared for all of it needs no classification. Empty
+     * when the project declares no column markings.
+     */
+    everyMarking(): ReadonlySet<string>;
+}
+export interface DatasetVersionMarkingsOptions {
+    readonly datasets: {
+        list(): readonly DatasetDefinition[];
+    };
+    /** The lake the versions are read from: whether it records lineage on every version. */
+    readonly lakeStorage: Pick<LakeStorage, "recordsLineage">;
+}
+export declare function createDatasetVersionMarkings(options: DatasetVersionMarkingsOptions): DatasetVersionMarkings;
+/** One classifier per host, so every reader shares the markings it reads from the definitions. */
+export declare function registerDatasetVersionMarkings(owner: object, markings: DatasetVersionMarkings): void;
+export declare function getDatasetVersionMarkings(owner: object): DatasetVersionMarkings;
+export declare function shareDatasetVersionMarkings(source: object, target: object): void;
+//# sourceMappingURL=dataset-version-markings.d.ts.map

package/dist/security/dataset-version-markings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-version-markings.d.ts","sourceRoot":"","sources":["../../src/security/dataset-version-markings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAoB,cAAc,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAG1F,kGAAkG;AAClG,MAAM,MAAM,qBAAqB,GAAG,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;AAE5E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAA;IACvC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,qBAAqB,CAAA;IACxD;;;;OAIG;IACH,YAAY,IAAI,WAAW,CAAC,MAAM,CAAC,CAAA;CACpC;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE;QAAE,IAAI,IAAI,SAAS,iBAAiB,EAAE,CAAA;KAAE,CAAA;IAC3D,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAA;CAC1D;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,6BAA6B,GACrC,sBAAsB,CA8ExB;AAUD,kGAAkG;AAClG,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,sBAAsB,GAC/B,IAAI,CAYN;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAI/E;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAEhF"}

package/dist/security/grants.d.ts

@@ -7,18 +7,20 @@
  * checks stay simple `set.has(id)` lookups.
  */
 import type { ActionDefinition, ObjectActionDefinition } from "../actions/types";
-import type { AgentReference, AgentUsageReference } from "../agents/types";
+import type { AgentMemoryReference, AgentReference, AgentThreadsReference, AgentUsageReference } from "../agents/types";
 import type { ConnectorDefinition } from "../connectors";
 import type { DatasetDefinition } from "../datasets";
-import type { ObjectType } from "../ontology";
+import type { ObjectType, ObjectTypeWithPropertyTokens } from "../ontology";
 import type { PipelineDefinition } from "../pipelines";
 import type { ShareActionGrantBuilder, ShareDefinition, ShareTarget, ShareViewGrantBuilder } from "../shares/types";
 import type { SyncDefinition } from "../syncs";
 import type { WorkflowDefinition } from "../workflows/types";
 import { type BreadthSelector, type BreadthTarget } from "./every";
-import type { AgentRunGrant, AppendGrant, ApplyGrant, EditGrant, ManageGrant, ObserveGrant, RunGrant, ShareGrant, ViewGrant } from "./types";
+import type { AgentRunGrant, AppendGrant, ApplyGrant, EditGrant, ManageGrant, ModelsRunGrant, ObjectViewGrantBuilder, ObserveGrant, ProjectReference, RunGrant, ShareGrant, UsersViewGrant, ViewGrant } from "./types";
 type GrantInput<TDefinition, TTarget extends BreadthTarget> = TDefinition | readonly TDefinition[] | BreadthSelector<TTarget>;
 declare function view<const TObjectTypeId extends string>(input: ShareTarget<TObjectTypeId>): ShareViewGrantBuilder<TObjectTypeId>;
+declare function view(input: ProjectReference["users"]): UsersViewGrant;
+declare function view<const TObjectType extends ObjectTypeWithPropertyTokens>(input: TObjectType): ObjectViewGrantBuilder<TObjectType>;
 declare function view(input: GrantInput<ObjectType, "object">): ViewGrant<"object">;
 declare function view(input: GrantInput<DatasetDefinition, "dataset">): ViewGrant<"dataset">;
 declare function edit(input: GrantInput<ObjectType, "object">): EditGrant;
@@ -30,9 +32,16 @@ declare function run(input: GrantInput<WorkflowDefinition, "workflow">): RunGran
 declare function run(input: GrantInput<SyncDefinition, "sync">): RunGrant<"sync">;
 declare function run(input: GrantInput<PipelineDefinition, "pipeline">): RunGrant<"pipeline">;
 declare function run(input: AgentReference): AgentRunGrant;
-declare function observe(input: "logs" | AgentUsageReference): ObserveGrant;
+declare function run(input: ProjectReference["models"]): ModelsRunGrant;
+/**
+ * Listed member by member: a `project` surface is not observable just by existing.
+ * `project.users` is read with `can.view`.
+ */
+type ObservableReference = ProjectReference["logs"] | ProjectReference["activity"] | AgentUsageReference | AgentThreadsReference;
+declare function observe(input: ObservableReference): ObserveGrant;
 declare function manage(input: GrantInput<ConnectorDefinition, "connector">): ManageGrant<"connector">;
 declare function manage(input: AgentUsageReference): ManageGrant<"aiUsage">;
+declare function manage(input: AgentMemoryReference): ManageGrant<"agentMemory">;
 export declare const can: {
     view: typeof view;
     edit: typeof edit;

package/dist/security/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/security/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEhF,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,WAAW,EACX,qBAAqB,EACtB,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAGnB,MAAM,SAAS,CAAA;AAChB,OAAO,KAAK,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EAER,UAAU,EACV,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,KAAK,UAAU,CAAC,WAAW,EAAE,OAAO,SAAS,aAAa,IACtD,WAAW,GACX,SAAS,WAAW,EAAE,GACtB,eAAe,CAAC,OAAO,CAAC,CAAA;AA6G5B,iBAAS,IAAI,CAAC,KAAK,CAAC,aAAa,SAAS,MAAM,EAC9C,KAAK,EAAE,WAAW,CAAC,aAAa,CAAC,GAChC,qBAAqB,CAAC,aAAa,CAAC,CAAA;AACvC,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAC3E,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;AASpF,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,SAAS,CAMhE;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,WAAW,CAMpE;AAED,iBAAS,KAAK,CAAC,KAAK,CAAC,OAAO,SAAS,sBAAsB,EACzD,KAAK,EAAE,OAAO,GACb,UAAU,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;AAChD,iBAAS,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAA;AAsBzE,iBAAS,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,eAAe,EAAE,OAAO,CAAC,GAAG,UAAU,CAMtE;AAED,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;AACrF,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;AACzE,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;AACrF,iBAAS,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAAA;AAsClD,iBAAS,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,YAAY,CAKlE;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;AAC9F,iBAAS,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;AAenE,eAAO,MAAM,GAAG;;;;;;;;;CASf,CAAA"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/security/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEhF,OAAO,KAAK,EACV,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,KAAK,EACV,uBAAuB,EACvB,eAAe,EACf,WAAW,EACX,qBAAqB,EACtB,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,aAAa,EAGnB,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,SAAS,EACT,WAAW,EACX,cAAc,EACd,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,QAAQ,EAER,UAAU,EACV,cAAc,EACd,SAAS,EACV,MAAM,SAAS,CAAA;AAEhB,KAAK,UAAU,CAAC,WAAW,EAAE,OAAO,SAAS,aAAa,IACtD,WAAW,GACX,SAAS,WAAW,EAAE,GACtB,eAAe,CAAC,OAAO,CAAC,CAAA;AAoH5B,iBAAS,IAAI,CAAC,KAAK,CAAC,aAAa,SAAS,MAAM,EAC9C,KAAK,EAAE,WAAW,CAAC,aAAa,CAAC,GAChC,qBAAqB,CAAC,aAAa,CAAC,CAAA;AACvC,iBAAS,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,cAAc,CAAA;AAC/D,iBAAS,IAAI,CAAC,KAAK,CAAC,WAAW,SAAS,4BAA4B,EAClE,KAAK,EAAE,WAAW,GACjB,sBAAsB,CAAC,WAAW,CAAC,CAAA;AACtC,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAC3E,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,iBAAiB,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;AA6FpF,iBAAS,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,SAAS,CAMhE;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,WAAW,CAMpE;AAED,iBAAS,KAAK,CAAC,KAAK,CAAC,OAAO,SAAS,sBAAsB,EACzD,KAAK,EAAE,OAAO,GACb,UAAU,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;AAChD,iBAAS,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAA;AAsBzE,iBAAS,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,eAAe,EAAE,OAAO,CAAC,GAAG,UAAU,CAMtE;AAED,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;AACrF,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;AACzE,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAA;AACrF,iBAAS,GAAG,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAAA;AAClD,iBAAS,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAA;AAqD/D;;;GAGG;AACH,KAAK,mBAAmB,GACpB,gBAAgB,CAAC,MAAM,CAAC,GACxB,gBAAgB,CAAC,UAAU,CAAC,GAC5B,mBAAmB,GACnB,qBAAqB,CAAA;AAuBzB,iBAAS,OAAO,CAAC,KAAK,EAAE,mBAAmB,GAAG,YAAY,CAiBzD;AAaD,iBAAS,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,CAAA;AAC9F,iBAAS,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;AACnE,iBAAS,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,WAAW,CAAC,aAAa,CAAC,CAAA;AAkBxE,eAAO,MAAM,GAAG;;;;;;;;;CASf,CAAA"}

package/dist/security/index.d.ts

@@ -6,8 +6,9 @@ export { every } from "./every";
 export { can } from "./grants";
 export type { MembershipOperationScope, MembershipPolicyScope } from "./membership-policies";
 export { canPerformMembershipOperation, isMembershipOperation, missingMembershipGroupIds, resolveMembershipPolicyScope, } from "./membership-policies";
+export { project } from "./project";
 export type { SecurityDefinitionCatalog, SecurityRegistryOptions } from "./registry";
 export { SecurityRegistry } from "./registry";
-export type { AgentRunGrant, AppendGrant, ApplyGrant, EditGrant, GrantCapability, GrantDefinition, GroupDefinition, GroupReference, ManageGrant, ManageGrantTarget, MarkingDefinition, MembershipOperation, MembershipPolicyDefinition, ObserveGrant, ObserveGrantTarget, RedactionReason, Redactions, RegisteredSecurityDefinitions, RoleDefinition, RunGrant, RunGrantTarget, Selection, ShareGrant, ViewGrant, ViewGrantTarget, } from "./types";
+export type { AgentRunGrant, AppendGrant, ApplyGrant, EditGrant, GrantCapability, GrantDefinition, GroupDefinition, GroupReference, ManageGrant, ManageGrantTarget, MarkingDefinition, MembershipOperation, MembershipPolicyDefinition, ModelsRunGrant, ObjectViewGrantBuilder, ObserveGrant, ObserveGrantTarget, ProjectReference, RedactionReason, Redactions, RegisteredSecurityDefinitions, RoleDefinition, RunGrant, RunGrantTarget, Selection, ShareGrant, UsersViewGrant, ViewGrant, ViewGrantTarget, } from "./types";
 export { assertGrantDefinition, assertGroupDefinition, assertMembershipPolicyDefinition, assertRoleDefinition, isGroupDefinition, isMarkingDefinition, isMembershipPolicyDefinition, isRoleDefinition, validateSecurityDefinitionsAtStartup, } from "./validation";
 //# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,YAAY,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC5F,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAA;AAC9B,YAAY,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,YAAY,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,SAAS,EACT,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,6BAA6B,EAC7B,cAAc,EACd,QAAQ,EACR,cAAc,EACd,SAAS,EACT,UAAU,EACV,SAAS,EACT,eAAe,GAChB,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,gCAAgC,EAChC,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,EAChB,oCAAoC,GACrC,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAA;AAC9B,YAAY,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC5F,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,YAAY,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,YAAY,EACV,aAAa,EACb,WAAW,EACX,UAAU,EACV,SAAS,EACT,eAAe,EACf,eAAe,EACf,eAAe,EACf,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,EAC1B,cAAc,EACd,sBAAsB,EACtB,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,6BAA6B,EAC7B,cAAc,EACd,QAAQ,EACR,cAAc,EACd,SAAS,EACT,UAAU,EACV,cAAc,EACd,SAAS,EACT,eAAe,GAChB,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,gCAAgC,EAChC,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,EAChB,oCAAoC,GACrC,MAAM,cAAc,CAAA"}

package/dist/security/internal.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Marking plumbing for this repo's hosts and workers, not for app authors.
+ *
+ * `checkPipelineMarkings` is the SQL preflight the API server and CLI run before serving. The
+ * projection worker shares the host's version classifier with `shareDatasetVersionMarkings`, then
+ * classifies each pinned version and refuses one with `assertProjectionVersionMarkings`. The API
+ * server reads the versions projections applied ahead of its first request with
+ * `warmAppliedMarkings`, and the CLI reports what they add with `getAppliedMarkings`.
+ */
+export { getAppliedMarkings, warmAppliedMarkings } from "./applied-markings-host";
+export type { DatasetVersionMarkings, VersionClassification, VersionColumnMarkings, } from "./dataset-version-markings";
+export { getDatasetVersionMarkings, shareDatasetVersionMarkings } from "./dataset-version-markings";
+export { checkPipelineMarkings } from "./pipeline-markings";
+export { assertProjectionVersionMarkings } from "./projection-markings";
+//# sourceMappingURL=internal.d.ts.map

package/dist/security/internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../src/security/internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AACjF,YAAY,EACV,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AACnG,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/security/internal.js

@@ -0,0 +1,135 @@
+// @bun
+import"../chunk-x0v3jd47.js";
+import {
+  registeredSteps,
+  runStepLineages,
+  MarkingPropagation,
+  validateProjectionMarkings,
+  assertProjectionVersionMarkings2,
+  describeOrigins,
+  getAppliedMarkings2,
+  warmAppliedMarkings2,
+  getDatasetVersionMarkings2,
+  shareDatasetVersionMarkings2
+} from "../chunk-5tfev0fv.js";
+import {
+  stepInputColumns2,
+  stepReadColumns
+} from "../chunk-g5bvzyyr.js";
+import {
+  PipelineError2
+} from "../chunk-hke9aeen.js";
+import {
+  SecurityValidationError2
+} from "../chunk-jcfw4h7m.js";
+// src/security/pipeline-markings.ts
+async function checkPipelineMarkings(input) {
+  const { definitions, lakeStorage } = input;
+  const datasetsById = new Map(definitions.datasets.list().map((dataset) => [dataset.id, dataset]));
+  const steps = registeredSteps(definitions.pipelines.list());
+  const runLineageOf = runStepLineages(datasetsById);
+  const analyzed = new Map;
+  const lineageOf = (entry) => runLineageOf(entry) ?? analyzed.get(entry.step) ?? null;
+  const markings = new MarkingPropagation(datasetsById, steps).derive(lineageOf);
+  for (;; ) {
+    const wave = new Map;
+    for (const entry of steps) {
+      if (entry.step.executor.kind !== "sql" || analyzed.has(entry.step))
+        continue;
+      if (stepReadColumns(entry.step).some((ref) => markings.of(ref).size > 0)) {
+        if (!wave.has(entry.step))
+          wave.set(entry.step, entry);
+      }
+    }
+    if (wave.size === 0)
+      break;
+    await forEachConcurrently([...wave], ANALYSIS_CONCURRENCY, async ([step, entry]) => {
+      analyzed.set(step, await analyzeSqlStep(entry, markings, datasetsById, lakeStorage));
+    });
+    markings.derive(lineageOf);
+  }
+  validateProjectionMarkings(definitions.projections, definitions.ontology, markings);
+}
+var ANALYSIS_CONCURRENCY = 8;
+async function forEachConcurrently(items, limit, task) {
+  const pending = items.values();
+  let failed = false;
+  const worker = async () => {
+    for (const item of pending) {
+      if (failed)
+        return;
+      try {
+        await task(item);
+      } catch (error) {
+        failed = true;
+        throw error;
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+}
+async function analyzeSqlStep(entry, markings, datasetsById, lakeStorage) {
+  const { step } = entry;
+  const subject = `[Sixb] Pipeline '${entry.pipelineId}' step '${step.id}'`;
+  if (step.executor.kind !== "sql")
+    throw new PipelineError2(`${subject} is not a SQL step.`);
+  const sql = "sql" in lakeStorage ? lakeStorage.sql : undefined;
+  if (!sql?.analyze) {
+    throw new SecurityValidationError2(`${subject} reads ${describeMarkedRead(step, markings)}, but the lake provider cannot analyze SQL to derive the markings of its output. Use a lake provider that analyzes SQL, or pick only unmarked columns.`);
+  }
+  const inputs = Object.entries(step.inputs);
+  let analysis;
+  try {
+    analysis = await sql.analyze({
+      sql: step.executor.sql,
+      sources: Object.fromEntries(inputs.map(([name, dataset]) => [
+        name,
+        {
+          dataset: registeredDataset(datasetsById, dataset.id, subject),
+          columns: stepInputColumns2(dataset)
+        }
+      ]))
+    });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new PipelineError2(`${subject} could not be analyzed: ${reason}`, { cause: error });
+  }
+  if (!analysis.supported) {
+    throw new SecurityValidationError2(`${subject} reads ${describeMarkedRead(step, markings)}, but its SQL cannot be analyzed: ${analysis.reason}. Rewrite that part of the query, or pick only unmarked columns.`);
+  }
+  const datasetIdBySource = new Map(inputs.map(([name, dataset]) => [name, dataset.id]));
+  const toRef = (ref) => {
+    const datasetId = datasetIdBySource.get(ref.source);
+    if (datasetId === undefined) {
+      throw new PipelineError2(`${subject} analysis references unknown source '${ref.source}'.`);
+    }
+    return { datasetId, column: ref.column };
+  };
+  return {
+    rows: analysis.lineage.rows.map(toRef),
+    columns: Object.fromEntries(Object.entries(analysis.lineage.columns).map(([column, refs]) => [column, refs.map(toRef)]))
+  };
+}
+function describeMarkedRead(step, markings) {
+  const ref = stepReadColumns(step).find((candidate) => markings.of(candidate).size > 0);
+  if (!ref)
+    return "no marked column";
+  const path = `${ref.datasetId}.${ref.column}`;
+  return `column '${path}', which carries ${describeOrigins(markings.of(ref), path)}`;
+}
+function registeredDataset(datasetsById, datasetId, subject) {
+  const dataset = datasetsById.get(datasetId);
+  if (!dataset)
+    throw new PipelineError2(`${subject} reads unregistered dataset '${datasetId}'.`);
+  return dataset;
+}
+export {
+  assertProjectionVersionMarkings2 as assertProjectionVersionMarkings,
+  checkPipelineMarkings,
+  getAppliedMarkings2 as getAppliedMarkings,
+  getDatasetVersionMarkings2 as getDatasetVersionMarkings,
+  shareDatasetVersionMarkings2 as shareDatasetVersionMarkings,
+  warmAppliedMarkings2 as warmAppliedMarkings
+};
+
+//# debugId=02F47B8AEF3C739F64756E2164756E21

package/dist/security/internal.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/security/pipeline-markings.ts"],
+  "sourcesContent": [
+    "import type { DatasetDefinition } from \"../datasets/types\"\nimport type {\n  LakeStorageWithSql,\n  SqlTransformAnalysis,\n  SqlTransformColumnRef,\n} from \"../lake-storage/sql-transforms\"\nimport type { DatasetColumnLineage, DatasetColumnRef, LakeStorage } from \"../lake-storage/types\"\nimport { PipelineError } from \"../pipelines/errors\"\nimport { stepInputColumns, stepReadColumns } from \"../pipelines/lineage\"\nimport type { PipelineStepDefinition } from \"../pipelines/types\"\nimport type { SixbDefinitions } from \"../runtime/definitions\"\nimport { SecurityValidationError } from \"./errors\"\nimport {\n  type DatasetMarkings,\n  MarkingPropagation,\n  type RegisteredStep,\n  registeredSteps,\n  runStepLineages,\n} from \"./marking-propagation\"\nimport { describeOrigins, validateProjectionMarkings } from \"./projection-markings\"\n\n/**\n * Derive the markings SQL steps give their outputs and check every projection against them.\n *\n * Startup cannot see through SQL, so this preflight completes it before a host serves traffic. It\n * is a diagnostic: each version records the lineage of the SQL that actually ran, and reads and\n * projections enforce markings from that record whether or not this ran.\n *\n * Only steps that read a marked column are analyzed, each step once. Analyzing a step can mark\n * the inputs of others, so steps are analyzed in waves, a few at a time within a wave. A step whose\n * SQL cannot be analyzed, or a lake provider that cannot analyze SQL, is reported with the step\n * and a marked column it reads.\n */\nexport async function checkPipelineMarkings(input: {\n  readonly definitions: Pick<SixbDefinitions, \"ontology\" | \"datasets\" | \"pipelines\" | \"projections\">\n  readonly lakeStorage: LakeStorage | LakeStorageWithSql\n}): Promise<void> {\n  const { definitions, lakeStorage } = input\n  const datasetsById = new Map(definitions.datasets.list().map((dataset) => [dataset.id, dataset]))\n  const steps = registeredSteps(definitions.pipelines.list())\n  const runLineageOf = runStepLineages(datasetsById)\n  const analyzed = new Map<PipelineStepDefinition, DatasetColumnLineage>()\n  const lineageOf = (entry: RegisteredStep) =>\n    runLineageOf(entry) ?? analyzed.get(entry.step) ?? null\n\n  const markings = new MarkingPropagation(datasetsById, steps).derive(lineageOf)\n\n  for (;;) {\n    const wave = new Map<PipelineStepDefinition, RegisteredStep>()\n    for (const entry of steps) {\n      if (entry.step.executor.kind !== \"sql\" || analyzed.has(entry.step)) continue\n      if (stepReadColumns(entry.step).some((ref) => markings.of(ref).size > 0)) {\n        if (!wave.has(entry.step)) wave.set(entry.step, entry)\n      }\n    }\n\n    if (wave.size === 0) break\n\n    await forEachConcurrently([...wave], ANALYSIS_CONCURRENCY, async ([step, entry]) => {\n      analyzed.set(step, await analyzeSqlStep(entry, markings, datasetsById, lakeStorage))\n    })\n    markings.derive(lineageOf)\n  }\n\n  validateProjectionMarkings(definitions.projections, definitions.ontology, markings)\n}\n\n/** Analyses run at once. A provider may open a database per analysis, so a wave is not unbounded. */\nconst ANALYSIS_CONCURRENCY = 8\n\n/** Run `task` on each item, `limit` at a time. Stops starting new tasks once one fails. */\nasync function forEachConcurrently<TItem>(\n  items: readonly TItem[],\n  limit: number,\n  task: (item: TItem) => Promise<void>\n): Promise<void> {\n  const pending = items.values()\n  let failed = false\n\n  const worker = async () => {\n    for (const item of pending) {\n      if (failed) return\n\n      try {\n        await task(item)\n      } catch (error) {\n        failed = true\n        throw error\n      }\n    }\n  }\n\n  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker))\n}\n\nasync function analyzeSqlStep(\n  entry: RegisteredStep,\n  markings: DatasetMarkings,\n  datasetsById: ReadonlyMap<string, DatasetDefinition>,\n  lakeStorage: LakeStorage | LakeStorageWithSql\n): Promise<DatasetColumnLineage> {\n  const { step } = entry\n  const subject = `[Sixb] Pipeline '${entry.pipelineId}' step '${step.id}'`\n\n  if (step.executor.kind !== \"sql\") throw new PipelineError(`${subject} is not a SQL step.`)\n\n  const sql = \"sql\" in lakeStorage ? lakeStorage.sql : undefined\n  if (!sql?.analyze) {\n    throw new SecurityValidationError(\n      `${subject} reads ${describeMarkedRead(step, markings)}, but the lake provider cannot analyze SQL to derive the markings of its output. Use a lake provider that analyzes SQL, or pick only unmarked columns.`\n    )\n  }\n\n  const inputs = Object.entries(step.inputs)\n  let analysis: SqlTransformAnalysis\n  try {\n    analysis = await sql.analyze({\n      sql: step.executor.sql,\n      sources: Object.fromEntries(\n        inputs.map(([name, dataset]) => [\n          name,\n          {\n            dataset: registeredDataset(datasetsById, dataset.id, subject),\n            columns: stepInputColumns(dataset),\n          },\n        ])\n      ),\n    })\n  } catch (error) {\n    const reason = error instanceof Error ? error.message : String(error)\n    throw new PipelineError(`${subject} could not be analyzed: ${reason}`, { cause: error })\n  }\n\n  if (!analysis.supported) {\n    throw new SecurityValidationError(\n      `${subject} reads ${describeMarkedRead(step, markings)}, but its SQL cannot be analyzed: ${analysis.reason}. Rewrite that part of the query, or pick only unmarked columns.`\n    )\n  }\n\n  const datasetIdBySource = new Map(inputs.map(([name, dataset]) => [name, dataset.id]))\n  const toRef = (ref: SqlTransformColumnRef): DatasetColumnRef => {\n    const datasetId = datasetIdBySource.get(ref.source)\n    if (datasetId === undefined) {\n      throw new PipelineError(`${subject} analysis references unknown source '${ref.source}'.`)\n    }\n\n    return { datasetId, column: ref.column }\n  }\n\n  return {\n    rows: analysis.lineage.rows.map(toRef),\n    columns: Object.fromEntries(\n      Object.entries(analysis.lineage.columns).map(([column, refs]) => [column, refs.map(toRef)])\n    ),\n  }\n}\n\n/** A marked column the step reads, for messages. */\nfunction describeMarkedRead(step: PipelineStepDefinition, markings: DatasetMarkings): string {\n  const ref = stepReadColumns(step).find((candidate) => markings.of(candidate).size > 0)\n  if (!ref) return \"no marked column\"\n\n  const path = `${ref.datasetId}.${ref.column}`\n  return `column '${path}', which carries ${describeOrigins(markings.of(ref), path)}`\n}\n\nfunction registeredDataset(\n  datasetsById: ReadonlyMap<string, DatasetDefinition>,\n  datasetId: string,\n  subject: string\n): DatasetDefinition {\n  const dataset = datasetsById.get(datasetId)\n  if (!dataset) throw new PipelineError(`${subject} reads unregistered dataset '${datasetId}'.`)\n  return dataset\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,eAAsB,qBAAqB,CAAC,OAG1B;AAAA,EAChB,QAAQ,aAAa,gBAAgB;AAAA,EACrC,MAAM,eAAe,IAAI,IAAI,YAAY,SAAS,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC;AAAA,EAChG,MAAM,QAAQ,gBAAgB,YAAY,UAAU,KAAK,CAAC;AAAA,EAC1D,MAAM,eAAe,gBAAgB,YAAY;AAAA,EACjD,MAAM,WAAW,IAAI;AAAA,EACrB,MAAM,YAAY,CAAC,UACjB,aAAa,KAAK,KAAK,SAAS,IAAI,MAAM,IAAI,KAAK;AAAA,EAErD,MAAM,WAAW,IAAI,mBAAmB,cAAc,KAAK,EAAE,OAAO,SAAS;AAAA,EAE7E,UAAS;AAAA,IACP,MAAM,OAAO,IAAI;AAAA,IACjB,WAAW,SAAS,OAAO;AAAA,MACzB,IAAI,MAAM,KAAK,SAAS,SAAS,SAAS,SAAS,IAAI,MAAM,IAAI;AAAA,QAAG;AAAA,MACpE,IAAI,gBAAgB,MAAM,IAAI,EAAE,KAAK,CAAC,QAAQ,SAAS,GAAG,GAAG,EAAE,OAAO,CAAC,GAAG;AAAA,QACxE,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI;AAAA,UAAG,KAAK,IAAI,MAAM,MAAM,KAAK;AAAA,MACvD;AAAA,IACF;AAAA,IAEA,IAAI,KAAK,SAAS;AAAA,MAAG;AAAA,IAErB,MAAM,oBAAoB,CAAC,GAAG,IAAI,GAAG,sBAAsB,QAAQ,MAAM,WAAW;AAAA,MAClF,SAAS,IAAI,MAAM,MAAM,eAAe,OAAO,UAAU,cAAc,WAAW,CAAC;AAAA,KACpF;AAAA,IACD,SAAS,OAAO,SAAS;AAAA,EAC3B;AAAA,EAEA,2BAA2B,YAAY,aAAa,YAAY,UAAU,QAAQ;AAAA;AAIpF,IAAM,uBAAuB;AAG7B,eAAe,mBAA0B,CACvC,OACA,OACA,MACe;AAAA,EACf,MAAM,UAAU,MAAM,OAAO;AAAA,EAC7B,IAAI,SAAS;AAAA,EAEb,MAAM,SAAS,YAAY;AAAA,IACzB,WAAW,QAAQ,SAAS;AAAA,MAC1B,IAAI;AAAA,QAAQ;AAAA,MAEZ,IAAI;AAAA,QACF,MAAM,KAAK,IAAI;AAAA,QACf,OAAO,OAAO;AAAA,QACd,SAAS;AAAA,QACT,MAAM;AAAA;AAAA,IAEV;AAAA;AAAA,EAGF,MAAM,QAAQ,IAAI,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,OAAO,MAAM,MAAM,EAAE,GAAG,MAAM,CAAC;AAAA;AAGjF,eAAe,cAAc,CAC3B,OACA,UACA,cACA,aAC+B;AAAA,EAC/B,QAAQ,SAAS;AAAA,EACjB,MAAM,UAAU,oBAAoB,MAAM,qBAAqB,KAAK;AAAA,EAEpE,IAAI,KAAK,SAAS,SAAS;AAAA,IAAO,MAAM,IAAI,eAAc,GAAG,4BAA4B;AAAA,EAEzF,MAAM,MAAM,SAAS,cAAc,YAAY,MAAM;AAAA,EACrD,IAAI,CAAC,KAAK,SAAS;AAAA,IACjB,MAAM,IAAI,yBACR,GAAG,iBAAiB,mBAAmB,MAAM,QAAQ,yJACvD;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,OAAO,QAAQ,KAAK,MAAM;AAAA,EACzC,IAAI;AAAA,EACJ,IAAI;AAAA,IACF,WAAW,MAAM,IAAI,QAAQ;AAAA,MAC3B,KAAK,KAAK,SAAS;AAAA,MACnB,SAAS,OAAO,YACd,OAAO,IAAI,EAAE,MAAM,aAAa;AAAA,QAC9B;AAAA,QACA;AAAA,UACE,SAAS,kBAAkB,cAAc,QAAQ,IAAI,OAAO;AAAA,UAC5D,SAAS,kBAAiB,OAAO;AAAA,QACnC;AAAA,MACF,CAAC,CACH;AAAA,IACF,CAAC;AAAA,IACD,OAAO,OAAO;AAAA,IACd,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACpE,MAAM,IAAI,eAAc,GAAG,kCAAkC,UAAU,EAAE,OAAO,MAAM,CAAC;AAAA;AAAA,EAGzF,IAAI,CAAC,SAAS,WAAW;AAAA,IACvB,MAAM,IAAI,yBACR,GAAG,iBAAiB,mBAAmB,MAAM,QAAQ,sCAAsC,SAAS,wEACtG;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,IAAI,IAAI,OAAO,IAAI,EAAE,MAAM,aAAa,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC;AAAA,EACrF,MAAM,QAAQ,CAAC,QAAiD;AAAA,IAC9D,MAAM,YAAY,kBAAkB,IAAI,IAAI,MAAM;AAAA,IAClD,IAAI,cAAc,WAAW;AAAA,MAC3B,MAAM,IAAI,eAAc,GAAG,+CAA+C,IAAI,UAAU;AAAA,IAC1F;AAAA,IAEA,OAAO,EAAE,WAAW,QAAQ,IAAI,OAAO;AAAA;AAAA,EAGzC,OAAO;AAAA,IACL,MAAM,SAAS,QAAQ,KAAK,IAAI,KAAK;AAAA,IACrC,SAAS,OAAO,YACd,OAAO,QAAQ,SAAS,QAAQ,OAAO,EAAE,IAAI,EAAE,QAAQ,UAAU,CAAC,QAAQ,KAAK,IAAI,KAAK,CAAC,CAAC,CAC5F;AAAA,EACF;AAAA;AAIF,SAAS,kBAAkB,CAAC,MAA8B,UAAmC;AAAA,EAC3F,MAAM,MAAM,gBAAgB,IAAI,EAAE,KAAK,CAAC,cAAc,SAAS,GAAG,SAAS,EAAE,OAAO,CAAC;AAAA,EACrF,IAAI,CAAC;AAAA,IAAK,OAAO;AAAA,EAEjB,MAAM,OAAO,GAAG,IAAI,aAAa,IAAI;AAAA,EACrC,OAAO,WAAW,wBAAwB,gBAAgB,SAAS,GAAG,GAAG,GAAG,IAAI;AAAA;AAGlF,SAAS,iBAAiB,CACxB,cACA,WACA,SACmB;AAAA,EACnB,MAAM,UAAU,aAAa,IAAI,SAAS;AAAA,EAC1C,IAAI,CAAC;AAAA,IAAS,MAAM,IAAI,eAAc,GAAG,uCAAuC,aAAa;AAAA,EAC7F,OAAO;AAAA;",
+  "debugId": "02F47B8AEF3C739F64756E2164756E21",
+  "names": []
+}