@sixb/core 0.1.20 → 0.1.22

package/dist/security/marking-propagation.d.ts

@@ -0,0 +1,62 @@
+import type { DatasetDefinition } from "../datasets/types";
+import type { DatasetColumnLineage, DatasetColumnRef } from "../lake-storage/types";
+import type { PipelineDefinition, PipelineStepDefinition } from "../pipelines/types";
+/** A step of a registered pipeline. A step reused by two pipelines is two registered steps. */
+export interface RegisteredStep {
+    readonly pipelineId: string;
+    readonly step: PipelineStepDefinition;
+}
+/** The column that declares a marking, and the steps it went through to reach a column. */
+export interface MarkingOrigin {
+    readonly column: DatasetColumnRef;
+    /** `pipeline/step`, upstream first. Empty when the column declares the marking itself. */
+    readonly steps: readonly string[];
+}
+/** Each marking a column carries, with one path it arrived by. */
+export type ColumnMarkingOrigins = ReadonlyMap<string, MarkingOrigin>;
+/** Markings of every column of every registered dataset, derived from the definitions. */
+export interface DatasetMarkings {
+    /** Empty for a column without markings or that is not registered. */
+    of(column: DatasetColumnRef): ColumnMarkingOrigins;
+}
+export declare function registeredSteps(pipelines: readonly PipelineDefinition[]): readonly RegisteredStep[];
+/** Lineage of each `run` step, built once per step object; undefined for other steps. */
+export declare function runStepLineages(datasetsById: ReadonlyMap<string, DatasetDefinition>): (entry: RegisteredStep) => DatasetColumnLineage | undefined;
+export declare function stepLabel(entry: RegisteredStep): string;
+/**
+ * Markings each column carries according to the registered definitions: the ones it declares, and
+ * the ones each step derives from the columns it depends on, once that step's lineage is known.
+ *
+ * What decided the rows of a step's inputs decides the rows of its output, whether or not the step
+ * reads a column of that input: `SELECT count(*) FROM rich` reveals which rows `rich` holds. So
+ * each dataset also keeps the markings of its row dependencies, and every output column of a step
+ * carries those of every input it reads, as the lineage each version records does.
+ *
+ * A step may read its own output and a dataset may have several producers, so a step whose output
+ * gains a marking queues the steps that read that output, until nothing changes. Lineage can be
+ * added in rounds: each round only revisits what the new lineage reaches.
+ */
+export declare class MarkingPropagation implements DatasetMarkings {
+    private readonly datasetsById;
+    /** Marked columns only, by dataset, built when a dataset is first looked at. */
+    private readonly markings;
+    /** Markings of what decides each dataset's rows, for datasets a step writes. */
+    private readonly rowMarkings;
+    private readonly ordered;
+    private readonly readers;
+    private readonly known;
+    private readonly queue;
+    constructor(datasetsById: ReadonlyMap<string, DatasetDefinition>, steps: readonly RegisteredStep[]);
+    of(ref: DatasetColumnRef): ColumnMarkingOrigins;
+    /**
+     * Derive markings through every step `lineageOf` knows the lineage of. A step it returns null
+     * for derives nothing until a later call knows it.
+     */
+    derive(lineageOf: (entry: RegisteredStep) => DatasetColumnLineage | null): this;
+    /** Whether the output's rows or any output column gained a marking. */
+    private apply;
+    private markedColumns;
+    /** Every marking of these columns, each with the first origin found. */
+    private union;
+}
+//# sourceMappingURL=marking-propagation.d.ts.map

package/dist/security/marking-propagation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marking-propagation.d.ts","sourceRoot":"","sources":["../../src/security/marking-propagation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAEnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAEpF,+FAA+F;AAC/F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;CACtC;AAED,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED,kEAAkE;AAClE,MAAM,MAAM,oBAAoB,GAAG,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAErE,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,EAAE,CAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,CAAA;CACnD;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,kBAAkB,EAAE,GACvC,SAAS,cAAc,EAAE,CAI3B;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAC7B,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,GACnD,CAAC,KAAK,EAAE,cAAc,KAAK,oBAAoB,GAAG,SAAS,CAc7D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAEvD;AAYD;;;;;;;;;;;;GAYG;AACH,qBAAa,kBAAmB,YAAW,eAAe;IACxD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;IACrE,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiD;IAC1E,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0C;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;gBAGhD,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACpD,KAAK,EAAE,SAAS,cAAc,EAAE;IAYlC,EAAE,CAAC,GAAG,EAAE,gBAAgB,GAAG,oBAAoB;IAI/C;;;OAGG;IACH,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,oBAAoB,GAAG,IAAI,GAAG,IAAI;IAyB/E,uEAAuE;IACvE,OAAO,CAAC,KAAK;IAmDb,OAAO,CAAC,aAAa;IAiBrB,wEAAwE;IACxE,OAAO,CAAC,KAAK;CASd"}

package/dist/security/marking-sets.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Shared, immutable sets of marking ids.
+ *
+ * Every column of every resolved version holds one of a handful of distinct sets, so each distinct
+ * set is created once and compared by identity.
+ */
+export declare class MarkingSets {
+    readonly empty: ReadonlySet<string>;
+    private readonly sets;
+    of(markingIds: Iterable<string> | undefined): ReadonlySet<string>;
+    /** The union of sets this instance created. */
+    union(sets: Iterable<ReadonlySet<string> | undefined>): ReadonlySet<string>;
+}
+//# sourceMappingURL=marking-sets.d.ts.map

package/dist/security/marking-sets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marking-sets.d.ts","sourceRoot":"","sources":["../../src/security/marking-sets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,qBAAa,WAAW;IACtB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAY;IAC/C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2D;IAEhF,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC;IAkBjE,+CAA+C;IAC/C,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC;CAY5E"}

package/dist/security/markings.d.ts

@@ -5,9 +5,12 @@ import type { ProjectionDefinitionCatalog } from "../projections/registry";
 /**
  * Check every marking once at startup.
  *
- * A marking is enforced at read time from the property or column definition alone, so each rule
- * here closes a path that would otherwise return the value unredacted or make enforcement
- * ambiguous.
+ * A marking is enforced at read time from the property or column definition and the lineage of
+ * the version read, so each rule here closes a path that would otherwise return the value
+ * unredacted or make enforcement ambiguous.
+ *
+ * Projections are checked against the markings columns declare or inherit through `run` steps.
+ * What SQL steps derive needs the lake provider's analysis, which `checkPipelineMarkings` adds.
  */
 export declare function validateMarkingsAtStartup(input: {
     readonly markingIds: ReadonlySet<string>;

package/dist/security/markings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markings.d.ts","sourceRoot":"","sources":["../../src/security/markings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAErE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAA;AAI1E;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAA;IAC5C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC7D,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAA;CAClD,GAAG,IAAI,CAKP"}
+{"version":3,"file":"markings.d.ts","sourceRoot":"","sources":["../../src/security/markings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAErE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAA;AAK1E;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAA;IAC5C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC7D,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAA;CAClD,GAAG,IAAI,CAWP"}

package/dist/security/pipeline-markings.d.ts

@@ -0,0 +1,20 @@
+import type { LakeStorageWithSql } from "../lake-storage/sql-transforms";
+import type { LakeStorage } from "../lake-storage/types";
+import type { SixbDefinitions } from "../runtime/definitions";
+/**
+ * Derive the markings SQL steps give their outputs and check every projection against them.
+ *
+ * Startup cannot see through SQL, so this preflight completes it before a host serves traffic. It
+ * is a diagnostic: each version records the lineage of the SQL that actually ran, and reads and
+ * projections enforce markings from that record whether or not this ran.
+ *
+ * Only steps that read a marked column are analyzed, each step once. Analyzing a step can mark
+ * the inputs of others, so steps are analyzed in waves, a few at a time within a wave. A step whose
+ * SQL cannot be analyzed, or a lake provider that cannot analyze SQL, is reported with the step
+ * and a marked column it reads.
+ */
+export declare function checkPipelineMarkings(input: {
+    readonly definitions: Pick<SixbDefinitions, "ontology" | "datasets" | "pipelines" | "projections">;
+    readonly lakeStorage: LakeStorage | LakeStorageWithSql;
+}): Promise<void>;
+//# sourceMappingURL=pipeline-markings.d.ts.map

package/dist/security/pipeline-markings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-markings.d.ts","sourceRoot":"","sources":["../../src/security/pipeline-markings.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,kBAAkB,EAGnB,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAA0C,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAIhG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAW7D;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC,CAAA;IAClG,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,kBAAkB,CAAA;CACvD,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BhB"}

package/dist/security/project.d.ts

@@ -0,0 +1,7 @@
+import type { ProjectReference } from "./types";
+/**
+ * Project-wide surfaces used in security grants such as `can.observe(project.logs)`,
+ * `can.view(project.users)` and `can.run(project.models)`.
+ */
+export declare const project: ProjectReference;
+//# sourceMappingURL=project.d.ts.map

package/dist/security/project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../src/security/project.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAE/C;;;GAGG;AACH,eAAO,MAAM,OAAO,EAAE,gBAMpB,CAAA"}

package/dist/security/projection-markings.d.ts

@@ -0,0 +1,71 @@
+import type { DatasetVersion } from "../lake-storage/types";
+import type { OntologyDefinitionCatalog } from "../ontology/registry";
+import type { ProjectionDefinitionCatalog } from "../projections/registry";
+import type { ProjectionDefinition } from "../projections/types";
+import type { VersionClassification } from "./dataset-version-markings";
+import type { ColumnMarkingOrigins, DatasetMarkings } from "./marking-propagation";
+type OntologyLookup = Pick<OntologyDefinitionCatalog, "getObjectTypeById">;
+/** Markings of one column of the projection's dataset. */
+type ColumnMarkingsLookup = (column: string) => readonly string[];
+/** What a marked key column makes unreadable: the objects it identifies, or the link it keys. */
+export type ProjectionKeyTarget = {
+    readonly kind: "type";
+    readonly objectTypeId: string;
+} | {
+    readonly kind: "link";
+    readonly objectTypeId: string;
+    readonly linkId: string;
+    readonly targetObjectTypeId: string;
+};
+/**
+ * Objects are read through the ontology, so each projected property declares the markings of its
+ * column: the ontology stays the reviewed contract of what each reader receives. Values that
+ * identify objects or key links are returned wherever the object or link is, and telemetry does
+ * not enforce markings yet, so those columns cannot carry markings.
+ *
+ * Startup checks it with the markings columns declare or inherit through `run` steps, and the
+ * pipeline preflight with the markings SQL steps derive as well.
+ */
+export declare function validateProjectionMarkings(projections: ProjectionDefinitionCatalog, ontology: OntologyLookup, markings: DatasetMarkings): void;
+/**
+ * Refuse to project a dataset version whose columns carry more markings than the projection
+ * allows. A version keeps the markings of the code that produced it, so a version written before
+ * the current code can carry markings startup did not see. Call it once per version, before
+ * reading its rows; it reads nothing, so what it throws is a refusal that no retry changes.
+ */
+export declare function assertProjectionVersionMarkings(input: {
+    readonly projection: ProjectionDefinition;
+    readonly ontology: OntologyLookup;
+    readonly version: DatasetVersion;
+    readonly classification: VersionClassification;
+}): void;
+/** Markings an applied version gives a projection's targets beyond what the ontology declares. */
+export interface ProjectionSurplus {
+    /** Markings a mapped column carries that its property does not declare. */
+    readonly properties: readonly {
+        readonly objectTypeId: string;
+        readonly propertyId: string;
+        readonly column: string;
+        readonly markings: readonly string[];
+    }[];
+    /** Marked key columns, with what each one makes unreadable and why. */
+    readonly keys: readonly {
+        readonly target: ProjectionKeyTarget;
+        readonly column: string;
+        readonly role: string;
+        readonly markings: readonly string[];
+    }[];
+}
+/**
+ * What a projection's targets carry beyond their declarations when read from columns with these
+ * markings: every rule it breaks, as markings to add to properties and to key targets. A property
+ * that keys a link keeps its markings on the property as well.
+ */
+export declare function projectionSurplus(projection: ProjectionDefinition, ontology: OntologyLookup, markingsOf: ColumnMarkingsLookup): ProjectionSurplus;
+/**
+ * `[financial] from 'raw_invoices.amount' through step 'invoices/normalize'`: each marking with one
+ * path it arrived by. Markings the column declares itself have no path.
+ */
+export declare function describeOrigins(origins: ColumnMarkingOrigins, columnPath: string): string;
+export {};
+//# sourceMappingURL=projection-markings.d.ts.map

package/dist/security/projection-markings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection-markings.d.ts","sourceRoot":"","sources":["../../src/security/projection-markings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AAErE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAA;AAC1E,OAAO,KAAK,EAGV,oBAAoB,EAErB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAEvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAiB,MAAM,uBAAuB,CAAA;AAEjG,KAAK,cAAc,GAAG,IAAI,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,CAAA;AAE1E,0DAA0D;AAC1D,KAAK,oBAAoB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;AAEjE,iGAAiG;AACjG,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;CACpC,CAAA;AAuBL;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,2BAA2B,EACxC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,eAAe,GACxB,IAAI,CA+BN;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;IACzC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAA;CAC/C,GAAG,IAAI,CAoBP;AAED,kGAAkG;AAClG,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,SAAS;QAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KACrC,EAAE,CAAA;IACH,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,SAAS;QACtB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;QACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;KACrC,EAAE,CAAA;CACJ;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,oBAAoB,EAChC,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,oBAAoB,GAC/B,iBAAiB,CAkCnB;AA+MD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAOzF"}

package/dist/security/public.js

@@ -1,8 +1,8 @@
 // @bun
-import"../chunk-gsjm1wms.js";
+import"../chunk-vhbw5sqm.js";
 import {
   defineGroup2
-} from "../chunk-es1gxsbf.js";
+} from "../chunk-73v685wb.js";
 export {
   defineGroup2 as defineGroup
 };

package/dist/security/redactions.d.ts

@@ -1,4 +1,7 @@
 import type { Redactions } from "./types";
-/** List the values hidden from a reader that lacks a clearance for their markings. */
+/**
+ * List the values hidden from a reader that lacks a clearance for their markings. Deeply frozen,
+ * so every row and event redacted the same way can share it.
+ */
 export declare function missingClearanceRedactions(ids: Iterable<string>): Redactions;
 //# sourceMappingURL=redactions.d.ts.map

package/dist/security/redactions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redactions.d.ts","sourceRoot":"","sources":["../../src/security/redactions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEzC,sFAAsF;AACtF,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,UAAU,CAE5E"}
+{"version":3,"file":"redactions.d.ts","sourceRoot":"","sources":["../../src/security/redactions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAIzC;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,UAAU,CAE5E"}

package/dist/security/registry.d.ts

@@ -1,5 +1,7 @@
 import { type ResolvedRole } from "../authorization";
+import type { OntologyRegistry } from "../ontology";
 import type { GroupDefinition, MarkingDefinition, MembershipPolicyDefinition, RoleDefinition } from "./types";
+import { type ViewCondition } from "./view-conditions";
 /** Read-only access to validated security definitions and resolved role grants. */
 export interface SecurityDefinitionCatalog {
     listMarkings(): readonly MarkingDefinition[];
@@ -27,6 +29,7 @@ export interface SecurityRegistryOptions {
     readonly connectorIds?: ReadonlySet<string>;
     readonly shareIds?: ReadonlySet<string>;
     readonly getSubTypes?: (objectTypeId: string) => readonly string[];
+    readonly ontology?: OntologyRegistry;
 }
 export declare class SecurityRegistry implements SecurityDefinitionCatalog {
     private readonly markingsById;
@@ -34,6 +37,7 @@ export declare class SecurityRegistry implements SecurityDefinitionCatalog {
     private readonly rolesById;
     private readonly membershipPoliciesById;
     private readonly resolvedRoles;
+    private readonly viewConditions;
     constructor(input: SecurityRegistryOptions);
     listMarkings(): readonly MarkingDefinition[];
     getMarkingById(markingId: string): MarkingDefinition | null;
@@ -42,6 +46,8 @@ export declare class SecurityRegistry implements SecurityDefinitionCatalog {
     listRoles(): readonly RoleDefinition[];
     getRoleById(roleId: string): RoleDefinition | null;
     listResolvedRoles(): readonly ResolvedRole[];
+    /** Every role's `can.view(Type).where(...)`, validated, in declaration order. */
+    listViewConditions(): readonly ViewCondition[];
     listMembershipPolicies(): readonly MembershipPolicyDefinition[];
     getMembershipPolicyById(policyId: string): MembershipPolicyDefinition | null;
 }

package/dist/security/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/security/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAqB,MAAM,kBAAkB,CAAA;AACvE,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACf,MAAM,SAAS,CAAA;AAGhB,mFAAmF;AACnF,MAAM,WAAW,yBAAyB;IACxC,YAAY,IAAI,SAAS,iBAAiB,EAAE,CAAA;IAC5C,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAAA;IAC3D,UAAU,IAAI,SAAS,eAAe,EAAE,CAAA;IACxC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAAA;IACrD,SAAS,IAAI,SAAS,cAAc,EAAE,CAAA;IACtC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAA;IAClD,iBAAiB,IAAI,SAAS,YAAY,EAAE,CAAA;IAC5C,sBAAsB,IAAI,SAAS,0BAA0B,EAAE,CAAA;IAC/D,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI,CAAA;CAC7E;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;IACnE,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CACnE;AAED,qBAAa,gBAAiB,YAAW,yBAAyB;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;IACrE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsC;IACjE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAC/D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAiD;IACxF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;gBAE3C,KAAK,EAAE,uBAAuB;IAyC1C,YAAY,IAAI,SAAS,iBAAiB,EAAE;IAI5C,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAI3D,UAAU,IAAI,SAAS,eAAe,EAAE;IAIxC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAIrD,SAAS,IAAI,SAAS,cAAc,EAAE;IAItC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAIlD,iBAAiB,IAAI,SAAS,YAAY,EAAE;IAI5C,sBAAsB,IAAI,SAAS,0BAA0B,EAAE;IAI/D,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI;CAG7E"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/security/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAgD,MAAM,kBAAkB,CAAA;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,cAAc,EACf,MAAM,SAAS,CAAA;AAEhB,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAE5E,mFAAmF;AACnF,MAAM,WAAW,yBAAyB;IACxC,YAAY,IAAI,SAAS,iBAAiB,EAAE,CAAA;IAC5C,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAAA;IAC3D,UAAU,IAAI,SAAS,eAAe,EAAE,CAAA;IACxC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAAA;IACrD,SAAS,IAAI,SAAS,cAAc,EAAE,CAAA;IACtC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAA;IAClD,iBAAiB,IAAI,SAAS,YAAY,EAAE,CAAA;IAC5C,sBAAsB,IAAI,SAAS,0BAA0B,EAAE,CAAA;IAC/D,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI,CAAA;CAC7E;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;IACnE,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACvC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;CACrC;AAED,qBAAa,gBAAiB,YAAW,yBAAyB;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAwC;IACrE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsC;IACjE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAC/D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAiD;IACxF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyB;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0B;gBAE7C,KAAK,EAAE,uBAAuB;IAyD1C,YAAY,IAAI,SAAS,iBAAiB,EAAE;IAI5C,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAI3D,UAAU,IAAI,SAAS,eAAe,EAAE;IAIxC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAIrD,SAAS,IAAI,SAAS,cAAc,EAAE;IAItC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAIlD,iBAAiB,IAAI,SAAS,YAAY,EAAE;IAI5C,iFAAiF;IACjF,kBAAkB,IAAI,SAAS,aAAa,EAAE;IAI9C,sBAAsB,IAAI,SAAS,0BAA0B,EAAE;IAI/D,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,IAAI;CAG7E"}

package/dist/security/types.d.ts

@@ -1,3 +1,6 @@
+import type { ObjectQueryPredicate } from "../objects/query";
+import type { ObjectTypeWithPropertyTokens } from "../ontology";
+import type { ObjectWhereBuilder, ObjectWhereClause } from "../runtime/types";
 export interface GroupDefinition<TId extends string = string> {
     readonly kind: "group";
     readonly id: TId;
@@ -52,6 +55,29 @@ export interface ViewGrant<TTarget extends ViewGrantTarget = ViewGrantTarget> {
     readonly capability: "view";
     readonly target: TTarget;
     readonly selection: Selection;
+    /**
+     * The objects this grant covers, when it covers only some. Built once by
+     * `can.view(Type).where(...)`, and only on a grant for one object type.
+     */
+    readonly condition?: ObjectQueryPredicate;
+}
+/** `can.view(Type)`: a view grant on one object type, which `.where()` can narrow. */
+export interface ObjectViewGrantBuilder<TObjectType extends ObjectTypeWithPropertyTokens = ObjectTypeWithPropertyTokens> extends ViewGrant<"object"> {
+    /**
+     * Grant only the objects that match, with the builder of an object query's `.where()`. An
+     * array means AND. A reader sees the union of their grants, so an unconditional
+     * `can.view(Type)` from another role still grants every object.
+     */
+    where(condition: (object: ObjectWhereBuilder<TObjectType>) => ObjectWhereClause<TObjectType> | readonly ObjectWhereClause<TObjectType>[]): ViewGrant<"object">;
+}
+/**
+ * Read the project's member directory: names, emails, avatars and status. The directory is one
+ * surface, so there is nothing to select. Kept apart from {@link ViewGrant}, which always selects.
+ */
+export interface UsersViewGrant {
+    readonly kind: "grant";
+    readonly capability: "view";
+    readonly target: "users";
 }
 /**
  * Write objects of the selected types: properties, links, delete, and restore.
@@ -107,17 +133,49 @@ export interface AgentRunGrant {
     readonly capability: "run";
     readonly target: "agent";
 }
-export type ObserveGrantTarget = "logs" | "aiUsage";
-/** Read the project's logs or its AI usage. Each is one surface, so there is nothing to select. */
+/** Call every model in the project's catalog directly, such as through `sixb models`. */
+export interface ModelsRunGrant {
+    readonly kind: "grant";
+    readonly capability: "run";
+    readonly target: "models";
+}
+export type ObserveGrantTarget = "logs" | "aiUsage" | "activity" | "agentThreads";
+/**
+ * Project-wide surfaces used in security grants such as `can.observe(project.logs)`. Each member's
+ * `kind` is the grant target it selects.
+ */
+export interface ProjectReference {
+    readonly kind: "project";
+    /** The project's captured logs. */
+    readonly logs: {
+        readonly kind: "logs";
+    };
+    /** Visits and page views recorded in the project's app. */
+    readonly activity: {
+        readonly kind: "activity";
+    };
+    /** The project's member directory: names, emails, avatars and status. */
+    readonly users: {
+        readonly kind: "users";
+    };
+    /** Every model in the project's catalog, for `can.run(project.models)`. */
+    readonly models: {
+        readonly kind: "models";
+    };
+}
+/**
+ * Read the project's logs, its AI usage, its app activity or every user's Agent conversations. Each
+ * is one surface, so there is nothing to select.
+ */
 export interface ObserveGrant {
     readonly kind: "grant";
     readonly capability: "observe";
     readonly target: ObserveGrantTarget;
 }
-export type ManageGrantTarget = "connector" | "aiUsage";
+export type ManageGrantTarget = "connector" | "aiUsage" | "agentMemory";
 /**
- * Manage the selected connectors, or the project's AI usage-limit policies. AI usage is one
- * surface, so its grant selects nothing.
+ * Manage the selected connectors, the project's AI usage-limit policies, or the project's shared
+ * Agent memory. AI usage and memory are one surface each, so their grants select nothing.
  */
 export type ManageGrant<TTarget extends ManageGrantTarget = ManageGrantTarget> = TTarget extends "connector" ? {
     readonly kind: "grant";
@@ -129,7 +187,7 @@ export type ManageGrant<TTarget extends ManageGrantTarget = ManageGrantTarget> =
     readonly capability: "manage";
     readonly target: TTarget;
 };
-export type GrantDefinition = ViewGrant | EditGrant | AppendGrant | ApplyGrant | ShareGrant | RunGrant | AgentRunGrant | ObserveGrant | ManageGrant;
+export type GrantDefinition = ViewGrant | UsersViewGrant | EditGrant | AppendGrant | ApplyGrant | ShareGrant | RunGrant | AgentRunGrant | ModelsRunGrant | ObserveGrant | ManageGrant;
 export type GrantCapability = GrantDefinition["capability"];
 export interface RoleDefinition<TId extends string = string> {
     readonly kind: "role";

package/dist/security/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC1D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC5D,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,2CAA2C;AAC3C,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAA;AAEjD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC,CAAC,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,MAAM,CAAA;AAErD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAE5D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,CAAA;AAElD,MAAM,WAAW,SAAS,CAAC,OAAO,SAAS,eAAe,GAAG,eAAe;IAC1E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAA;AAE7D,MAAM,WAAW,QAAQ,CAAC,OAAO,SAAS,cAAc,GAAG,cAAc;IACvE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAAA;AAEnD,mGAAmG;AACnG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CACpC;AAED,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,SAAS,CAAA;AAEvD;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,OAAO,SAAS,iBAAiB,GAAG,iBAAiB,IAC3E,OAAO,SAAS,WAAW,GACvB;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB,CAAA;AAEP,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,SAAS,GACT,WAAW,GACX,UAAU,GACV,UAAU,GACV,QAAQ,GACR,aAAa,GACb,YAAY,GACZ,WAAW,CAAA;AAEf,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;AAE3D,MAAM,WAAW,cAAc,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,GAAG,iBAAiB,CAAA;AAE3F,MAAM,WAAW,0BAA0B,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IACrE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAC7C;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC/C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC7D,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACzD,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACvD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;CACjF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAE7E,MAAM,WAAW,eAAe,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC1D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC5D,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,2CAA2C;AAC3C,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAA;AAEjD;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC,CAAC,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,MAAM,CAAA;AAErD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAA;AAE5D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,CAAA;AAElD,MAAM,WAAW,SAAS,CAAC,OAAO,SAAS,eAAe,GAAG,eAAe;IAC1E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAA;CAC1C;AAED,sFAAsF;AACtF,MAAM,WAAW,sBAAsB,CACrC,WAAW,SAAS,4BAA4B,GAAG,4BAA4B,CAC/E,SAAQ,SAAS,CAAC,QAAQ,CAAC;IAC3B;;;;OAIG;IACH,KAAK,CACH,SAAS,EAAE,CACT,MAAM,EAAE,kBAAkB,CAAC,WAAW,CAAC,KACpC,iBAAiB,CAAC,WAAW,CAAC,GAAG,SAAS,iBAAiB,CAAC,WAAW,CAAC,EAAE,GAC9E,SAAS,CAAC,QAAQ,CAAC,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAA;AAE7D,MAAM,WAAW,QAAQ,CAAC,OAAO,SAAS,cAAc,GAAG,cAAc;IACvE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED,yFAAyF;AACzF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAA;CAC1B;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,cAAc,CAAA;AAEjF;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,mCAAmC;IACnC,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAA;IAChD,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAA;IAC1C,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAA;CAC7C;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CACpC;AAED,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,SAAS,GAAG,aAAa,CAAA;AAEvE;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,OAAO,SAAS,iBAAiB,GAAG,iBAAiB,IAC3E,OAAO,SAAS,WAAW,GACvB;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC9B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB,CAAA;AAEP,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,cAAc,GACd,SAAS,GACT,WAAW,GACX,UAAU,GACV,UAAU,GACV,QAAQ,GACR,aAAa,GACb,cAAc,GACd,YAAY,GACZ,WAAW,CAAA;AAEf,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC,YAAY,CAAC,CAAA;AAE3D,MAAM,WAAW,cAAc,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,cAAc,GAAG,SAAS,GAAG,iBAAiB,CAAA;AAE3F,MAAM,WAAW,0BAA0B,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IACrE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,QAAQ,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAC7C;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC/C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IAC7D,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACzD,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACvD,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,sBAAsB,EAAE,WAAW,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;CACjF"}

package/dist/security/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/security/validation.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAEV,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,cAAc,EAEf,MAAM,SAAS,CAAA;AAiChB,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,KAAK,CAAA;AAI5D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,MAAM,CAIzB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,MAAM,GAAG,SAAS,CAQrC;AA2DD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAYpC;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAO9E;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,eAAe,CAYlC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAO1E;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,0BAA0B,CAiB7C;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,0BAA0B,CAOhG;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,eAAe,CA+ClC;AAqBD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,cAAc,CAyBjC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAOxE;AAED,wBAAgB,oCAAoC,CAAC,KAAK,EAAE;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,mFAAmF;IACnF,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,uEAAuE;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACxC,GAAG,6BAA6B,CA4HhC"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/security/validation.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAEV,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,cAAc,EAEf,MAAM,SAAS,CAAA;AAiChB,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,KAAK,CAAA;AAI5D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,MAAM,CAIzB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,MAAM,GAAG,SAAS,CAQrC;AA2DD,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAYpC;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAO9E;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,eAAe,CAYlC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAO1E;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,0BAA0B,CAiB7C;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,0BAA0B,CAOhG;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,eAAe,CAqElC;AAqBD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,WAAW,GAAE,mBAAuE,GACnF,OAAO,CAAC,KAAK,IAAI,cAAc,CAyBjC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAOxE;AAED,wBAAgB,oCAAoC,CAAC,KAAK,EAAE;IAC1D,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,mFAAmF;IACnF,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC5C,uFAAuF;IACvF,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACtC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC1C,uEAAuE;IACvE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,mFAAmF;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CACxC,GAAG,6BAA6B,CA4HhC"}

package/dist/security/view-conditions.d.ts

@@ -0,0 +1,37 @@
+import type { ObjectQueryPredicate } from "../objects/query/ir";
+import type { OntologyRegistry } from "../ontology";
+import type { ObjectReadScopeFactory } from "../storage/objects/types";
+import type { GrantDefinition } from "./types";
+/** A role's `can.view(Type).where(...)`, validated against the ontology at startup. */
+export interface ViewCondition {
+    readonly roleId: string;
+    /** The type the grant names. The condition also applies to its subtypes. */
+    readonly objectTypeId: string;
+    /**
+     * The condition as the validator returns it, `scalarKind` resolved, and deeply frozen. It may
+     * still hold `currentUser()`, which each reader binds to its own user.
+     */
+    readonly predicate: ObjectQueryPredicate;
+}
+/**
+ * Validate a role grant's condition at startup: `can.view(Type).where(...)`.
+ *
+ * The condition is validated as a filter over the type and every subtype the grant covers, which
+ * is the query its reads run. Without an ontology there is nothing to validate it against, so it
+ * is refused.
+ */
+export declare function resolveViewCondition(roleId: string, grant: GrantDefinition, ontology: OntologyRegistry | undefined): ViewCondition | undefined;
+/**
+ * Compile each condition once against the object storage, at startup. A condition the storage
+ * cannot read would otherwise fail every read of its type, for every reader it applies to.
+ *
+ * Each reader binds `currentUser()` to its own user; the check binds it to a placeholder, so the
+ * storage compiles the comparison a user's reads run.
+ */
+export declare function assertViewConditionsReadable(input: {
+    readonly projectId: string;
+    readonly conditions: readonly ViewCondition[];
+    readonly objectStorage: Pick<ObjectReadScopeFactory, "createConditionalReadScope">;
+    readonly getSubTypes: (objectTypeId: string) => readonly string[];
+}): void;
+//# sourceMappingURL=view-conditions.d.ts.map

package/dist/security/view-conditions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-conditions.d.ts","sourceRoot":"","sources":["../../src/security/view-conditions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAK/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAEtE,OAAO,KAAK,EAAE,eAAe,EAAa,MAAM,SAAS,CAAA;AAEzD,uFAAuF;AACvF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAA;CACzC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC,aAAa,GAAG,SAAS,CAqD3B;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAA;IAC7C,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAAA;IAClF,QAAQ,CAAC,WAAW,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAA;CAClE,GAAG,IAAI,CAqBP"}

package/dist/shares/execution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../src/shares/execution.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAE3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EAAuB,KAAK,gBAAgB,EAA0B,MAAM,YAAY,CAAA;AAE/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAI9C,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,WAAW,GACX,iBAAiB,GACjB,qBAAqB,GACrB,iBAAiB,CAAA;AAErB,qBAAa,UAAW,SAAQ,KAAK;IAIjC,QAAQ,CAAC,MAAM,EAAE,gBAAgB;IAHnC,QAAQ,CAAC,IAAI,gBAAe;gBAGjB,MAAM,EAAE,gBAAgB,EACjC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY;CAIzB;AAED,KAAK,uBAAuB,CAAC,WAAW,SAAS,eAAe,IAC9D,WAAW,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,CAAA;AAEvC,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,gBAAgB,EAChB,WAAW,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,WAAW,CACpE,CAAA;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,sBAAsB,CAAC,WAAW,SAAS,eAAe,GAAG,eAAe;IAC3F,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IACzE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,0BAA2B,SAAQ,sBAAsB;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,qBAAqB,CAAC,WAAW,SAAS,eAAe,GAAG,eAAe;IAC1F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IAC1E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,yBAA0B,SAAQ,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC;IACtF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,eAAe,IAAI,SAAS,eAAe,EAAE,CAAA;IAC7C,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAAA;IAC/D,KAAK,CAAC,KAAK,CAAC,WAAW,SAAS,eAAe,EAC7C,UAAU,EAAE,WAAW,EACvB,KAAK,EAAE,sBAAsB,CAAC,WAAW,CAAC,GACzC,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAClC,SAAS,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC7E,IAAI,CAAC,KAAK,CAAC,WAAW,SAAS,eAAe,EAC5C,UAAU,EAAE,WAAW,EACvB,KAAK,CAAC,EAAE,qBAAqB,CAAC,WAAW,CAAC,GACzC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAA;IAChF,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;CAC3D;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,WAAW,EAAE,iBAAiB,CAAC,eAAe,CAAC,GAC9C,aAAa,CAyMf"}
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../src/shares/execution.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyB,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAE3E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EAAuB,KAAK,gBAAgB,EAA0B,MAAM,YAAY,CAAA;AAI/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAI9C,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,WAAW,GACX,iBAAiB,GACjB,qBAAqB,GACrB,iBAAiB,CAAA;AAErB,qBAAa,UAAW,SAAQ,KAAK;IAIjC,QAAQ,CAAC,MAAM,EAAE,gBAAgB;IAHnC,QAAQ,CAAC,IAAI,gBAAe;gBAGjB,MAAM,EAAE,gBAAgB,EACjC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,YAAY;CAIzB;AAED,KAAK,uBAAuB,CAAC,WAAW,SAAS,eAAe,IAC9D,WAAW,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,CAAA;AAEvC,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,gBAAgB,EAChB,WAAW,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,WAAW,CACpE,CAAA;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAA;IACjC,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,sBAAsB,CAAC,WAAW,SAAS,eAAe,GAAG,eAAe;IAC3F,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IACzE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,0BAA2B,SAAQ,sBAAsB;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,qBAAqB,CAAC,WAAW,SAAS,eAAe,GAAG,eAAe;IAC1F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;IAC1E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,yBAA0B,SAAQ,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC;IACtF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,eAAe,IAAI,SAAS,eAAe,EAAE,CAAA;IAC7C,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAAA;IAC/D,KAAK,CAAC,KAAK,CAAC,WAAW,SAAS,eAAe,EAC7C,UAAU,EAAE,WAAW,EACvB,KAAK,EAAE,sBAAsB,CAAC,WAAW,CAAC,GACzC,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAClC,SAAS,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC7E,IAAI,CAAC,KAAK,CAAC,WAAW,SAAS,eAAe,EAC5C,UAAU,EAAE,WAAW,EACvB,KAAK,CAAC,EAAE,qBAAqB,CAAC,WAAW,CAAC,GACzC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAA;IAChF,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;CAC3D;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,WAAW,EAAE,iBAAiB,CAAC,eAAe,CAAC,GAC9C,aAAa,CA+Mf"}

package/dist/shares/internal.js

@@ -1,56 +1,60 @@
 // @bun
-import"../chunk-a40ad1ft.js";
-import"../chunk-8mx7qw3y.js";
-import"../chunk-z3y5kg1x.js";
-import"../chunk-b38szspf.js";
+import"../chunk-mbsbxarb.js";
+import"../chunk-zbc929zg.js";
+import"../chunk-6eqsgvxk.js";
+import"../chunk-c0vk1djt.js";
 import {
   formatSessionCookieValue2,
   parseSessionCookieValue2
-} from "../chunk-vpq4shxz.js";
-import"../chunk-gsjm1wms.js";
-import"../chunk-d0bqz29d.js";
-import"../chunk-v4jbb3rs.js";
-import"../chunk-jhm3zsa7.js";
-import"../chunk-hvsb78a1.js";
-import"../chunk-es1gxsbf.js";
-import"../chunk-v9xd5wzd.js";
-import"../chunk-hcbyfxbe.js";
-import"../chunk-pqajwytd.js";
-import"../chunk-29yx306f.js";
-import"../chunk-gfdh9kqa.js";
-import"../chunk-gc4ntf7d.js";
-import"../chunk-s54c868q.js";
-import"../chunk-ere85b8y.js";
-import"../chunk-4as3wt1c.js";
+} from "../chunk-h3pbv7n8.js";
+import"../chunk-vhbw5sqm.js";
+import"../chunk-yc9ners4.js";
+import"../chunk-4y26vs3v.js";
+import"../chunk-rap5w0x0.js";
+import"../chunk-wkv3h3q7.js";
+import"../chunk-65pyhyas.js";
+import"../chunk-73v685wb.js";
+import"../chunk-bab05bhg.js";
+import"../chunk-cdk3egjj.js";
+import"../chunk-zrvhsq7f.js";
+import"../chunk-5grk14e5.js";
+import"../chunk-pdt5cw8z.js";
+import"../chunk-tdxfsg1c.js";
+import"../chunk-nydf3dbe.js";
+import"../chunk-0xmt5p5y.js";
+import"../chunk-4ymrcdbm.js";
 import"../chunk-h89wz928.js";
-import"../chunk-9w055r5b.js";
-import"../chunk-tw03bsmb.js";
-import"../chunk-d09tj99x.js";
-import"../chunk-7n440zgt.js";
-import"../chunk-n33z5bjw.js";
-import"../chunk-pbcbn83d.js";
-import"../chunk-qczk96d9.js";
+import"../chunk-hwarjrgf.js";
+import"../chunk-fe8zwt8b.js";
+import"../chunk-hz5d43gn.js";
+import"../chunk-gfdh9kqa.js";
+import"../chunk-cwdzcv37.js";
+import"../chunk-eptrvnby.js";
+import"../chunk-cswhawa2.js";
+import"../chunk-ezne9wc9.js";
+import"../chunk-hqsp2sx4.js";
+import"../chunk-2adz0h75.js";
 import"../chunk-mmagke4x.js";
 import"../chunk-hn2r7z41.js";
-import"../chunk-9ybhtmg4.js";
+import"../chunk-g663fahq.js";
 import"../chunk-jmfet9r4.js";
 import"../chunk-qf954wje.js";
-import"../chunk-rrzt8jdy.js";
+import"../chunk-x0v3jd47.js";
+import"../chunk-6rrtzea3.js";
 import {
   intersectShareAccessPlans
-} from "../chunk-x9v4cx1d.js";
+} from "../chunk-m36fw8ft.js";
 import {
   compileShareAccessPlan
-} from "../chunk-fkgc1wt8.js";
+} from "../chunk-0phpbbvm.js";
 import {
   snapshotShareAccessPlan
-} from "../chunk-br3k6qbf.js";
+} from "../chunk-fm62y49k.js";
 import {
   ShareSessionStorageError2
 } from "../chunk-z8fx5cgb.js";
-import"../chunk-s16apyk9.js";
-import"../chunk-rj69qcrd.js";
-import"../chunk-c85m1hyj.js";
+import"../chunk-pgrf64hp.js";
+import"../chunk-6n69k945.js";
 
 // src/shares/session-protocol.ts
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "crypto";
@@ -234,4 +238,4 @@ export {
   SharedSessionProtocol
 };
 
-//# debugId=34911D02E010DC8E64756E2164756E21
+//# debugId=83372A30799F0CDF64756E2164756E21