@sixb/core 0.1.6 → 0.1.8

package/dist/chunk-r8jrnexe.js

@@ -0,0 +1,403 @@
+// @bun
+// src/storage/objects/read-scope.ts
+var OBJECT_READ_SCOPE_LIMITS = Object.freeze({
+  maxDepth: 32,
+  maxNodes: 512,
+  maxObjectSelections: 4096,
+  maxSteps: 2048,
+  maxPropertyOccurrences: 16384,
+  maxIdentifierCharacters: 1e6
+});
+function compileSelectedObjectReadScope(rawScope) {
+  const scope = captureSelectedObjectReadScope(rawScope);
+  if (!isRecord(scope) || scope.kind !== "selected" || !Array.isArray(scope.roots)) {
+    throw invalidScope("scope must be a selected scope with a roots array");
+  }
+  const roots = [];
+  const objects = [];
+  const steps = [];
+  const visiting = new Set;
+  let nextNodeId = 0;
+  let concreteStepCount = 0;
+  let objectSelectionCount = 0;
+  let propertyOccurrenceCount = 0;
+  let identifierCharacterCount = 0;
+  let compiledPropertyOccurrenceCount = 0;
+  let compiledIdentifierCharacterCount = 0;
+  const addIdentifier = (value, path) => {
+    const identifier = nonEmptyString(value, path);
+    identifierCharacterCount += identifier.length;
+    if (identifierCharacterCount > OBJECT_READ_SCOPE_LIMITS.maxIdentifierCharacters) {
+      throw invalidScope(`scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxIdentifierCharacters} identifier characters`);
+    }
+    return identifier;
+  };
+  const addPropertyOccurrences = (count) => {
+    propertyOccurrenceCount += count;
+    if (propertyOccurrenceCount > OBJECT_READ_SCOPE_LIMITS.maxPropertyOccurrences) {
+      throw invalidScope(`scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxPropertyOccurrences} selected property occurrences`);
+    }
+  };
+  const addCompiledPropertyOccurrences = (count) => {
+    compiledPropertyOccurrenceCount += count;
+    if (compiledPropertyOccurrenceCount > OBJECT_READ_SCOPE_LIMITS.maxPropertyOccurrences) {
+      throw invalidScope(`scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxPropertyOccurrences} selected property occurrences after compilation`);
+    }
+  };
+  const addCompiledIdentifierCharacters = (count) => {
+    compiledIdentifierCharacterCount += count;
+    if (compiledIdentifierCharacterCount > OBJECT_READ_SCOPE_LIMITS.maxIdentifierCharacters) {
+      throw invalidScope(`scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxIdentifierCharacters} identifier characters after compilation`);
+    }
+  };
+  const visitNode = (node, path, depth) => {
+    if (!isRecord(node) || !Array.isArray(node.objects) || !Array.isArray(node.links)) {
+      throw invalidScope(`${path} must contain object and link selections`);
+    }
+    if (depth > OBJECT_READ_SCOPE_LIMITS.maxDepth) {
+      throw invalidScope(`${path} exceeds the maximum link depth of ${OBJECT_READ_SCOPE_LIMITS.maxDepth}`);
+    }
+    if (nextNodeId >= OBJECT_READ_SCOPE_LIMITS.maxNodes) {
+      throw invalidScope(`scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxNodes} selection nodes`);
+    }
+    if (visiting.has(node))
+      throw invalidScope(`${path} contains a cyclic selection node`);
+    visiting.add(node);
+    const nodeId = nextNodeId++;
+    try {
+      objectSelectionCount += node.objects.length;
+      if (objectSelectionCount > OBJECT_READ_SCOPE_LIMITS.maxObjectSelections) {
+        throw invalidScope(`scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxObjectSelections} object selections`);
+      }
+      for (const [objectIndex, object] of node.objects.entries()) {
+        const objectPath = `${path}.objects[${objectIndex}]`;
+        if (!isRecord(object) || !Array.isArray(object.propertyIds)) {
+          throw invalidScope(`${objectPath} must contain an object type and property ids`);
+        }
+        addIdentifier(object.objectTypeId, `${objectPath}.objectTypeId`);
+        addPropertyOccurrences(object.propertyIds.length);
+        for (const [propertyIndex, propertyId] of object.propertyIds.entries()) {
+          addIdentifier(propertyId, `${objectPath}.propertyIds[${propertyIndex}]`);
+        }
+      }
+      const normalizedObjects = normalizeObjects(node.objects, `${path}.objects`);
+      if (normalizedObjects.length === 0) {
+        throw invalidScope(`${path}.objects must contain at least one concrete object type`);
+      }
+      for (const object of normalizedObjects) {
+        addCompiledPropertyOccurrences(object.propertyIds.length);
+        addCompiledIdentifierCharacters(object.objectTypeId.length + identifierCharacters(object.propertyIds));
+        objects.push(Object.freeze({ nodeId, ...object }));
+      }
+      for (const [linkIndex, link] of node.links.entries()) {
+        const linkPath = `${path}.links[${linkIndex}]`;
+        if (!isRecord(link) || !Array.isArray(link.definitions) || !isRecord(link.target)) {
+          throw invalidScope(`${linkPath} must contain definitions and a target node`);
+        }
+        if (link.definitions.length === 0) {
+          throw invalidScope(`${linkPath}.definitions must not be empty`);
+        }
+        const definitions = normalizeConcreteDefinitions(link.definitions, `${linkPath}.definitions`, addIdentifier, addPropertyOccurrences, addCompiledPropertyOccurrences, addCompiledIdentifierCharacters, () => {
+          concreteStepCount += 1;
+          if (concreteStepCount > OBJECT_READ_SCOPE_LIMITS.maxSteps) {
+            throw invalidScope(`scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxSteps} concrete link steps`);
+          }
+        });
+        const parentTypes = new Set(normalizedObjects.map((object) => object.objectTypeId));
+        for (const definition of definitions) {
+          if (!parentTypes.has(definition.sourceObjectTypeId)) {
+            throw invalidScope(`${linkPath} selects source type '${definition.sourceObjectTypeId}' outside its parent node`);
+          }
+        }
+        const childNodeId = visitNode(link.target, `${linkPath}.target`, depth + 1);
+        const childTypes = new Set(objects.filter((object) => object.nodeId === childNodeId).map((object) => object.objectTypeId));
+        const targetTypes = new Set(definitions.map((definition) => definition.targetObjectTypeId));
+        if (!setsEqual(childTypes, targetTypes)) {
+          throw invalidScope(`${linkPath}.target object types must exactly match its definition target types`);
+        }
+        for (const definition of definitions) {
+          steps.push(Object.freeze({
+            nodeId: childNodeId,
+            parentNodeId: nodeId,
+            ...definition
+          }));
+        }
+      }
+    } finally {
+      visiting.delete(node);
+    }
+    return nodeId;
+  };
+  for (const [rootIndex, root] of scope.roots.entries()) {
+    const path = `roots[${rootIndex}]`;
+    if (!isRecord(root) || !isRecord(root.anchor) || !isRecord(root.node)) {
+      throw invalidScope(`${path} must contain an exact anchor and a selection node`);
+    }
+    const objectTypeId = addIdentifier(root.anchor.objectTypeId, `${path}.anchor.objectTypeId`);
+    const primaryId = addIdentifier(root.anchor.primaryId, `${path}.anchor.primaryId`);
+    addCompiledIdentifierCharacters(objectTypeId.length + primaryId.length);
+    const nodeId = visitNode(root.node, `${path}.node`, 0);
+    if (!objects.some((object) => object.nodeId === nodeId && object.objectTypeId === objectTypeId)) {
+      throw invalidScope(`${path}.anchor type '${objectTypeId}' is not selected by its root node`);
+    }
+    roots.push(Object.freeze({ nodeId, objectTypeId, primaryId }));
+  }
+  return Object.freeze({
+    kind: "selected",
+    roots: Object.freeze(roots),
+    objects: Object.freeze(objects),
+    steps: Object.freeze(steps)
+  });
+}
+function captureSelectedObjectReadScope(value) {
+  if (!isRecord(value)) {
+    throw invalidScope("scope must be a selected scope with a roots array");
+  }
+  const kind = value.kind;
+  if (kind !== "selected") {
+    throw invalidScope("scope must be a selected scope with a roots array");
+  }
+  const rootsValue = value.roots;
+  const rootsSource = captureArray(rootsValue, "roots");
+  if (rootsSource.length > OBJECT_READ_SCOPE_LIMITS.maxNodes) {
+    throw invalidScope(`scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxNodes} selection nodes`);
+  }
+  const state = {
+    visiting: new Set,
+    nodeCount: 0,
+    objectSelectionCount: 0,
+    concreteStepCount: 0,
+    propertyOccurrenceCount: 0,
+    identifierCharacterCount: 0
+  };
+  const roots = [];
+  for (let rootIndex = 0;rootIndex < rootsSource.length; rootIndex += 1) {
+    const path = `roots[${rootIndex}]`;
+    const rootValue = rootsSource.value[rootIndex];
+    if (!isRecord(rootValue)) {
+      throw invalidScope(`${path} must contain an exact anchor and a selection node`);
+    }
+    const anchorValue = rootValue.anchor;
+    if (!isRecord(anchorValue)) {
+      throw invalidScope(`${path} must contain an exact anchor and a selection node`);
+    }
+    const objectTypeId = captureIdentifier(state, anchorValue.objectTypeId, `${path}.anchor.objectTypeId`);
+    const primaryId = captureIdentifier(state, anchorValue.primaryId, `${path}.anchor.primaryId`);
+    const anchor = Object.freeze({ objectTypeId, primaryId });
+    const nodeValue = rootValue.node;
+    if (!isRecord(nodeValue)) {
+      throw invalidScope(`${path} must contain an exact anchor and a selection node`);
+    }
+    const node = captureNode(state, nodeValue, `${path}.node`, 0);
+    roots.push(Object.freeze({ anchor, node }));
+  }
+  return Object.freeze({ kind, roots: Object.freeze(roots) });
+}
+function captureNode(state, value, path, depth) {
+  if (depth > OBJECT_READ_SCOPE_LIMITS.maxDepth) {
+    throw invalidScope(`${path} exceeds the maximum link depth of ${OBJECT_READ_SCOPE_LIMITS.maxDepth}`);
+  }
+  if (state.nodeCount >= OBJECT_READ_SCOPE_LIMITS.maxNodes) {
+    throw invalidScope(`scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxNodes} selection nodes`);
+  }
+  if (state.visiting.has(value)) {
+    throw invalidScope(`${path} contains a cyclic selection node`);
+  }
+  state.visiting.add(value);
+  state.nodeCount += 1;
+  try {
+    const objectsValue = value.objects;
+    const objectsSource = captureArray(objectsValue, `${path}.objects`);
+    state.objectSelectionCount = reserveCount(state.objectSelectionCount, objectsSource.length, OBJECT_READ_SCOPE_LIMITS.maxObjectSelections, `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxObjectSelections} object selections`);
+    const objects = [];
+    for (let objectIndex = 0;objectIndex < objectsSource.length; objectIndex += 1) {
+      const objectPath = `${path}.objects[${objectIndex}]`;
+      const objectValue = objectsSource.value[objectIndex];
+      if (!isRecord(objectValue)) {
+        throw invalidScope(`${objectPath} must contain an object type and property ids`);
+      }
+      const objectTypeId = captureIdentifier(state, objectValue.objectTypeId, `${objectPath}.objectTypeId`);
+      const propertyIdsValue = objectValue.propertyIds;
+      const propertyIds = capturePropertyIds(state, propertyIdsValue, `${objectPath}.propertyIds`);
+      objects.push(Object.freeze({ objectTypeId, propertyIds }));
+    }
+    const linksValue = value.links;
+    const linksSource = captureArray(linksValue, `${path}.links`);
+    if (linksSource.length > OBJECT_READ_SCOPE_LIMITS.maxNodes - state.nodeCount) {
+      throw invalidScope(`scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxNodes} selection nodes`);
+    }
+    const links = [];
+    for (let linkIndex = 0;linkIndex < linksSource.length; linkIndex += 1) {
+      const linkPath = `${path}.links[${linkIndex}]`;
+      const linkValue = linksSource.value[linkIndex];
+      if (!isRecord(linkValue)) {
+        throw invalidScope(`${linkPath} must contain definitions and a target node`);
+      }
+      const definitionsValue = linkValue.definitions;
+      const definitionsSource = captureArray(definitionsValue, `${linkPath}.definitions`);
+      if (definitionsSource.length === 0) {
+        throw invalidScope(`${linkPath}.definitions must not be empty`);
+      }
+      if (definitionsSource.length > OBJECT_READ_SCOPE_LIMITS.maxSteps - state.concreteStepCount) {
+        throw invalidScope(`scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxSteps} concrete link steps`);
+      }
+      const definitions = [];
+      for (let definitionIndex = 0;definitionIndex < definitionsSource.length; definitionIndex += 1) {
+        const definitionPath = `${linkPath}.definitions[${definitionIndex}]`;
+        const definitionValue = definitionsSource.value[definitionIndex];
+        definitions.push(captureDefinition(state, definitionValue, definitionPath));
+      }
+      const targetValue = linkValue.target;
+      if (!isRecord(targetValue)) {
+        throw invalidScope(`${linkPath} must contain definitions and a target node`);
+      }
+      const target = captureNode(state, targetValue, `${linkPath}.target`, depth + 1);
+      links.push(Object.freeze({ definitions: Object.freeze(definitions), target }));
+    }
+    return Object.freeze({ objects: Object.freeze(objects), links: Object.freeze(links) });
+  } finally {
+    state.visiting.delete(value);
+  }
+}
+function captureDefinition(state, value, path) {
+  if (!isRecord(value)) {
+    throw invalidScope(`${path} must contain a concrete link definition`);
+  }
+  const sourceObjectTypeId = captureIdentifier(state, value.sourceObjectTypeId, `${path}.sourceObjectTypeId`);
+  const linkId = captureIdentifier(state, value.linkId, `${path}.linkId`);
+  const targetObjectTypeIdsValue = value.targetObjectTypeIds;
+  const targetObjectTypeIdsSource = captureArray(targetObjectTypeIdsValue, `${path}.targetObjectTypeIds`);
+  if (targetObjectTypeIdsSource.length === 0) {
+    throw invalidScope(`${path}.targetObjectTypeIds must not be empty`);
+  }
+  state.concreteStepCount = reserveCount(state.concreteStepCount, targetObjectTypeIdsSource.length, OBJECT_READ_SCOPE_LIMITS.maxSteps, `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxSteps} concrete link steps`);
+  const targetObjectTypeIds = captureIdentifiers(state, targetObjectTypeIdsSource, `${path}.targetObjectTypeIds`);
+  const propertyIdsValue = value.propertyIds;
+  const propertyIds = capturePropertyIds(state, propertyIdsValue, `${path}.propertyIds`);
+  return Object.freeze({ sourceObjectTypeId, linkId, targetObjectTypeIds, propertyIds });
+}
+function capturePropertyIds(state, value, path) {
+  const source = captureArray(value, path);
+  state.propertyOccurrenceCount = reserveCount(state.propertyOccurrenceCount, source.length, OBJECT_READ_SCOPE_LIMITS.maxPropertyOccurrences, `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxPropertyOccurrences} selected property occurrences`);
+  return captureIdentifiers(state, source, path);
+}
+function captureIdentifiers(state, source, path) {
+  const identifiers = [];
+  for (let index = 0;index < source.length; index += 1) {
+    identifiers.push(captureIdentifier(state, source.value[index], `${path}[${index}]`));
+  }
+  return Object.freeze(identifiers);
+}
+function captureIdentifier(state, value, path) {
+  const identifier = nonEmptyString(value, path);
+  state.identifierCharacterCount = reserveCount(state.identifierCharacterCount, identifier.length, OBJECT_READ_SCOPE_LIMITS.maxIdentifierCharacters, `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxIdentifierCharacters} identifier characters`);
+  return identifier;
+}
+function captureArray(value, path) {
+  if (!Array.isArray(value)) {
+    throw invalidScope(`${path} must be an array`);
+  }
+  const array = value;
+  const length = array.length;
+  if (!Number.isSafeInteger(length) || length < 0) {
+    throw invalidScope(`${path}.length must be a non-negative safe integer`);
+  }
+  return { value: array, length };
+}
+function reserveCount(current, count, limit, message) {
+  if (count > limit - current)
+    throw invalidScope(message);
+  return current + count;
+}
+function assertObjectReaderProject(expectedProjectId, actualProjectId) {
+  if (actualProjectId !== expectedProjectId) {
+    throw new Error(`[Sixb] Object reader belongs to project '${expectedProjectId}', not '${actualProjectId}'.`);
+  }
+}
+function normalizeConcreteDefinitions(definitions, path, addIdentifier, addPropertyOccurrences, addCompiledPropertyOccurrences, addCompiledIdentifierCharacters, addConcreteStep) {
+  const propertiesByDefinition = new Map;
+  for (const [index, definition] of definitions.entries()) {
+    const definitionPath = `${path}[${index}]`;
+    if (!isRecord(definition) || !Array.isArray(definition.targetObjectTypeIds) || !Array.isArray(definition.propertyIds)) {
+      throw invalidScope(`${definitionPath} must contain a concrete link definition`);
+    }
+    const sourceObjectTypeId = addIdentifier(definition.sourceObjectTypeId, `${definitionPath}.sourceObjectTypeId`);
+    const linkId = addIdentifier(definition.linkId, `${definitionPath}.linkId`);
+    if (definition.targetObjectTypeIds.length === 0) {
+      throw invalidScope(`${definitionPath}.targetObjectTypeIds must not be empty`);
+    }
+    addPropertyOccurrences(definition.propertyIds.length);
+    let propertyIdentifierCharacters = 0;
+    for (const [propertyIndex, propertyId] of definition.propertyIds.entries()) {
+      propertyIdentifierCharacters += addIdentifier(propertyId, `${definitionPath}.propertyIds[${propertyIndex}]`).length;
+    }
+    let targetIdentifierCharacters = 0;
+    for (const [targetIndex, value] of definition.targetObjectTypeIds.entries()) {
+      addConcreteStep();
+      targetIdentifierCharacters += addIdentifier(value, `${definitionPath}.targetObjectTypeIds[${targetIndex}]`).length;
+    }
+    addCompiledPropertyOccurrences(definition.propertyIds.length * definition.targetObjectTypeIds.length);
+    const repeatedIdentifierCharacters = sourceObjectTypeId.length + linkId.length + propertyIdentifierCharacters;
+    addCompiledIdentifierCharacters(repeatedIdentifierCharacters * definition.targetObjectTypeIds.length + targetIdentifierCharacters);
+    for (const [targetIndex, value] of definition.targetObjectTypeIds.entries()) {
+      const targetObjectTypeId = nonEmptyString(value, `${definitionPath}.targetObjectTypeIds[${targetIndex}]`);
+      const key = JSON.stringify([sourceObjectTypeId, linkId, targetObjectTypeId]);
+      const normalized = propertiesByDefinition.get(key) ?? {
+        sourceObjectTypeId,
+        linkId,
+        targetObjectTypeId,
+        properties: new Set
+      };
+      for (const [propertyIndex, propertyId] of definition.propertyIds.entries()) {
+        normalized.properties.add(nonEmptyString(propertyId, `${definitionPath}.propertyIds[${propertyIndex}]`));
+      }
+      propertiesByDefinition.set(key, normalized);
+    }
+  }
+  return [...propertiesByDefinition.values()].sort((left, right) => left.sourceObjectTypeId.localeCompare(right.sourceObjectTypeId) || left.linkId.localeCompare(right.linkId) || left.targetObjectTypeId.localeCompare(right.targetObjectTypeId)).map(({ properties, ...definition }) => Object.freeze({
+    ...definition,
+    propertyIds: Object.freeze([...properties].sort())
+  }));
+}
+function identifierCharacters(values) {
+  return values.reduce((total, value) => total + value.length, 0);
+}
+function normalizeObjects(selections, path) {
+  const propertiesByType = new Map;
+  for (const [index, selection] of selections.entries()) {
+    if (!isRecord(selection) || !Array.isArray(selection.propertyIds)) {
+      throw invalidScope(`${path}[${index}] must contain an object type and property ids`);
+    }
+    const objectTypeId = nonEmptyString(selection.objectTypeId, `${path}[${index}].objectTypeId`);
+    const properties = propertiesByType.get(objectTypeId) ?? new Set;
+    for (const propertyId of normalizeIds(selection.propertyIds, `${path}[${index}].propertyIds`)) {
+      properties.add(propertyId);
+    }
+    propertiesByType.set(objectTypeId, properties);
+  }
+  return [...propertiesByType].sort(([left], [right]) => left.localeCompare(right)).map(([objectTypeId, properties]) => Object.freeze({ objectTypeId, propertyIds: Object.freeze([...properties].sort()) }));
+}
+function normalizeIds(values, path) {
+  return [
+    ...new Set(values.map((value, index) => nonEmptyString(value, `${path}[${index}]`)))
+  ].sort();
+}
+function nonEmptyString(value, path) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw invalidScope(`${path} must be a non-empty string`);
+  }
+  return value;
+}
+function setsEqual(left, right) {
+  return left.size === right.size && [...left].every((value) => right.has(value));
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function invalidScope(message) {
+  return new Error(`[Sixb] Invalid object read scope: ${message}.`);
+}
+
+export { compileSelectedObjectReadScope, captureSelectedObjectReadScope, assertObjectReaderProject };
+
+//# debugId=F3C89DAB3F2B853064756E2164756E21

package/dist/chunk-r8jrnexe.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/storage/objects/read-scope.ts"],
+  "sourcesContent": [
+    "import type {\n  CompiledObjectReadObjectSelection,\n  CompiledObjectReadRoot,\n  CompiledObjectReadStep,\n  CompiledSelectedObjectReadScope,\n  ObjectReadLinkDefinitionSelection,\n  ObjectReadLinkSelection,\n  ObjectReadNode,\n  ObjectReadObjectSelection,\n  ObjectReadRoot,\n  SelectedObjectReadScope,\n} from \"./types\"\n\n/** Admission bounds applied before a raw selection is normalized or allocated by a provider. */\nexport const OBJECT_READ_SCOPE_LIMITS = Object.freeze({\n  maxDepth: 32,\n  maxNodes: 512,\n  maxObjectSelections: 4_096,\n  maxSteps: 2_048,\n  maxPropertyOccurrences: 16_384,\n  maxIdentifierCharacters: 1_000_000,\n})\n\n/**\n * Validate, detach, normalize, and flatten a finite selection exactly once.\n *\n * Every path occurrence receives its own node id. Reusing only `(sourceType, linkId)` would lose\n * provenance and let an object reached through one branch borrow nested authority from another.\n */\nexport function compileSelectedObjectReadScope(\n  rawScope: SelectedObjectReadScope\n): CompiledSelectedObjectReadScope {\n  const scope = captureSelectedObjectReadScope(rawScope)\n  if (!isRecord(scope) || scope.kind !== \"selected\" || !Array.isArray(scope.roots)) {\n    throw invalidScope(\"scope must be a selected scope with a roots array\")\n  }\n\n  const roots: CompiledObjectReadRoot[] = []\n  const objects: CompiledObjectReadObjectSelection[] = []\n  const steps: CompiledObjectReadStep[] = []\n  const visiting = new Set<object>()\n  let nextNodeId = 0\n  let concreteStepCount = 0\n  let objectSelectionCount = 0\n  let propertyOccurrenceCount = 0\n  let identifierCharacterCount = 0\n  let compiledPropertyOccurrenceCount = 0\n  let compiledIdentifierCharacterCount = 0\n\n  const addIdentifier = (value: unknown, path: string): string => {\n    const identifier = nonEmptyString(value, path)\n    identifierCharacterCount += identifier.length\n    if (identifierCharacterCount > OBJECT_READ_SCOPE_LIMITS.maxIdentifierCharacters) {\n      throw invalidScope(\n        `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxIdentifierCharacters} identifier characters`\n      )\n    }\n    return identifier\n  }\n\n  const addPropertyOccurrences = (count: number): void => {\n    propertyOccurrenceCount += count\n    if (propertyOccurrenceCount > OBJECT_READ_SCOPE_LIMITS.maxPropertyOccurrences) {\n      throw invalidScope(\n        `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxPropertyOccurrences} selected property occurrences`\n      )\n    }\n  }\n\n  const addCompiledPropertyOccurrences = (count: number): void => {\n    compiledPropertyOccurrenceCount += count\n    if (compiledPropertyOccurrenceCount > OBJECT_READ_SCOPE_LIMITS.maxPropertyOccurrences) {\n      throw invalidScope(\n        `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxPropertyOccurrences} selected property occurrences after compilation`\n      )\n    }\n  }\n\n  const addCompiledIdentifierCharacters = (count: number): void => {\n    compiledIdentifierCharacterCount += count\n    if (compiledIdentifierCharacterCount > OBJECT_READ_SCOPE_LIMITS.maxIdentifierCharacters) {\n      throw invalidScope(\n        `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxIdentifierCharacters} identifier characters after compilation`\n      )\n    }\n  }\n\n  const visitNode = (node: ObjectReadNode, path: string, depth: number): number => {\n    if (!isRecord(node) || !Array.isArray(node.objects) || !Array.isArray(node.links)) {\n      throw invalidScope(`${path} must contain object and link selections`)\n    }\n    if (depth > OBJECT_READ_SCOPE_LIMITS.maxDepth) {\n      throw invalidScope(\n        `${path} exceeds the maximum link depth of ${OBJECT_READ_SCOPE_LIMITS.maxDepth}`\n      )\n    }\n    if (nextNodeId >= OBJECT_READ_SCOPE_LIMITS.maxNodes) {\n      throw invalidScope(\n        `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxNodes} selection nodes`\n      )\n    }\n    if (visiting.has(node)) throw invalidScope(`${path} contains a cyclic selection node`)\n    visiting.add(node)\n\n    const nodeId = nextNodeId++\n    try {\n      objectSelectionCount += node.objects.length\n      if (objectSelectionCount > OBJECT_READ_SCOPE_LIMITS.maxObjectSelections) {\n        throw invalidScope(\n          `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxObjectSelections} object selections`\n        )\n      }\n\n      for (const [objectIndex, object] of node.objects.entries()) {\n        const objectPath = `${path}.objects[${objectIndex}]`\n        if (!isRecord(object) || !Array.isArray(object.propertyIds)) {\n          throw invalidScope(`${objectPath} must contain an object type and property ids`)\n        }\n        addIdentifier(object.objectTypeId, `${objectPath}.objectTypeId`)\n        addPropertyOccurrences(object.propertyIds.length)\n        for (const [propertyIndex, propertyId] of object.propertyIds.entries()) {\n          addIdentifier(propertyId, `${objectPath}.propertyIds[${propertyIndex}]`)\n        }\n      }\n\n      const normalizedObjects = normalizeObjects(node.objects, `${path}.objects`)\n      if (normalizedObjects.length === 0) {\n        throw invalidScope(`${path}.objects must contain at least one concrete object type`)\n      }\n      for (const object of normalizedObjects) {\n        addCompiledPropertyOccurrences(object.propertyIds.length)\n        addCompiledIdentifierCharacters(\n          object.objectTypeId.length + identifierCharacters(object.propertyIds)\n        )\n        objects.push(Object.freeze({ nodeId, ...object }))\n      }\n\n      for (const [linkIndex, link] of node.links.entries()) {\n        const linkPath = `${path}.links[${linkIndex}]`\n        if (!isRecord(link) || !Array.isArray(link.definitions) || !isRecord(link.target)) {\n          throw invalidScope(`${linkPath} must contain definitions and a target node`)\n        }\n        if (link.definitions.length === 0) {\n          throw invalidScope(`${linkPath}.definitions must not be empty`)\n        }\n\n        const definitions = normalizeConcreteDefinitions(\n          link.definitions,\n          `${linkPath}.definitions`,\n          addIdentifier,\n          addPropertyOccurrences,\n          addCompiledPropertyOccurrences,\n          addCompiledIdentifierCharacters,\n          () => {\n            concreteStepCount += 1\n            if (concreteStepCount > OBJECT_READ_SCOPE_LIMITS.maxSteps) {\n              throw invalidScope(\n                `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxSteps} concrete link steps`\n              )\n            }\n          }\n        )\n        const parentTypes = new Set(normalizedObjects.map((object) => object.objectTypeId))\n        for (const definition of definitions) {\n          if (!parentTypes.has(definition.sourceObjectTypeId)) {\n            throw invalidScope(\n              `${linkPath} selects source type '${definition.sourceObjectTypeId}' outside its parent node`\n            )\n          }\n        }\n\n        const childNodeId = visitNode(\n          link.target as unknown as ObjectReadNode,\n          `${linkPath}.target`,\n          depth + 1\n        )\n        const childTypes = new Set(\n          objects\n            .filter((object) => object.nodeId === childNodeId)\n            .map((object) => object.objectTypeId)\n        )\n        const targetTypes = new Set(definitions.map((definition) => definition.targetObjectTypeId))\n        if (!setsEqual(childTypes, targetTypes)) {\n          throw invalidScope(\n            `${linkPath}.target object types must exactly match its definition target types`\n          )\n        }\n\n        for (const definition of definitions) {\n          steps.push(\n            Object.freeze({\n              nodeId: childNodeId,\n              parentNodeId: nodeId,\n              ...definition,\n            })\n          )\n        }\n      }\n    } finally {\n      visiting.delete(node)\n    }\n\n    return nodeId\n  }\n\n  for (const [rootIndex, root] of scope.roots.entries()) {\n    const path = `roots[${rootIndex}]`\n    if (!isRecord(root) || !isRecord(root.anchor) || !isRecord(root.node)) {\n      throw invalidScope(`${path} must contain an exact anchor and a selection node`)\n    }\n    const objectTypeId = addIdentifier(root.anchor.objectTypeId, `${path}.anchor.objectTypeId`)\n    const primaryId = addIdentifier(root.anchor.primaryId, `${path}.anchor.primaryId`)\n    addCompiledIdentifierCharacters(objectTypeId.length + primaryId.length)\n    const nodeId = visitNode(root.node as unknown as ObjectReadNode, `${path}.node`, 0)\n    if (\n      !objects.some((object) => object.nodeId === nodeId && object.objectTypeId === objectTypeId)\n    ) {\n      throw invalidScope(`${path}.anchor type '${objectTypeId}' is not selected by its root node`)\n    }\n    roots.push(Object.freeze({ nodeId, objectTypeId, primaryId }))\n  }\n\n  return Object.freeze({\n    kind: \"selected\",\n    roots: Object.freeze(roots),\n    objects: Object.freeze(objects),\n    steps: Object.freeze(steps),\n  })\n}\n\ninterface ScopeCaptureState {\n  readonly visiting: Set<object>\n  nodeCount: number\n  objectSelectionCount: number\n  concreteStepCount: number\n  propertyOccurrenceCount: number\n  identifierCharacterCount: number\n}\n\ninterface CapturedArray {\n  readonly value: readonly unknown[]\n  readonly length: number\n}\n\n/**\n * Read every caller-controlled property once and detach it before another getter can mutate it.\n * The compiler only ever observes the resulting plain, deeply frozen snapshot.\n */\nexport function captureSelectedObjectReadScope(value: unknown): SelectedObjectReadScope {\n  if (!isRecord(value)) {\n    throw invalidScope(\"scope must be a selected scope with a roots array\")\n  }\n\n  const kind = value.kind\n  if (kind !== \"selected\") {\n    throw invalidScope(\"scope must be a selected scope with a roots array\")\n  }\n\n  const rootsValue = value.roots\n  const rootsSource = captureArray(rootsValue, \"roots\")\n  if (rootsSource.length > OBJECT_READ_SCOPE_LIMITS.maxNodes) {\n    throw invalidScope(\n      `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxNodes} selection nodes`\n    )\n  }\n\n  const state: ScopeCaptureState = {\n    visiting: new Set<object>(),\n    nodeCount: 0,\n    objectSelectionCount: 0,\n    concreteStepCount: 0,\n    propertyOccurrenceCount: 0,\n    identifierCharacterCount: 0,\n  }\n  const roots: ObjectReadRoot[] = []\n  for (let rootIndex = 0; rootIndex < rootsSource.length; rootIndex += 1) {\n    const path = `roots[${rootIndex}]`\n    const rootValue = rootsSource.value[rootIndex]\n    if (!isRecord(rootValue)) {\n      throw invalidScope(`${path} must contain an exact anchor and a selection node`)\n    }\n\n    const anchorValue = rootValue.anchor\n    if (!isRecord(anchorValue)) {\n      throw invalidScope(`${path} must contain an exact anchor and a selection node`)\n    }\n    const objectTypeId = captureIdentifier(\n      state,\n      anchorValue.objectTypeId,\n      `${path}.anchor.objectTypeId`\n    )\n    const primaryId = captureIdentifier(state, anchorValue.primaryId, `${path}.anchor.primaryId`)\n    const anchor = Object.freeze({ objectTypeId, primaryId })\n\n    const nodeValue = rootValue.node\n    if (!isRecord(nodeValue)) {\n      throw invalidScope(`${path} must contain an exact anchor and a selection node`)\n    }\n    const node = captureNode(state, nodeValue, `${path}.node`, 0)\n    roots.push(Object.freeze({ anchor, node }))\n  }\n\n  return Object.freeze({ kind, roots: Object.freeze(roots) })\n}\n\nfunction captureNode(\n  state: ScopeCaptureState,\n  value: Record<string, unknown>,\n  path: string,\n  depth: number\n): ObjectReadNode {\n  if (depth > OBJECT_READ_SCOPE_LIMITS.maxDepth) {\n    throw invalidScope(\n      `${path} exceeds the maximum link depth of ${OBJECT_READ_SCOPE_LIMITS.maxDepth}`\n    )\n  }\n  if (state.nodeCount >= OBJECT_READ_SCOPE_LIMITS.maxNodes) {\n    throw invalidScope(\n      `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxNodes} selection nodes`\n    )\n  }\n  if (state.visiting.has(value)) {\n    throw invalidScope(`${path} contains a cyclic selection node`)\n  }\n  state.visiting.add(value)\n  state.nodeCount += 1\n\n  try {\n    const objectsValue = value.objects\n    const objectsSource = captureArray(objectsValue, `${path}.objects`)\n    state.objectSelectionCount = reserveCount(\n      state.objectSelectionCount,\n      objectsSource.length,\n      OBJECT_READ_SCOPE_LIMITS.maxObjectSelections,\n      `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxObjectSelections} object selections`\n    )\n    const objects: ObjectReadObjectSelection[] = []\n    for (let objectIndex = 0; objectIndex < objectsSource.length; objectIndex += 1) {\n      const objectPath = `${path}.objects[${objectIndex}]`\n      const objectValue = objectsSource.value[objectIndex]\n      if (!isRecord(objectValue)) {\n        throw invalidScope(`${objectPath} must contain an object type and property ids`)\n      }\n\n      const objectTypeId = captureIdentifier(\n        state,\n        objectValue.objectTypeId,\n        `${objectPath}.objectTypeId`\n      )\n      const propertyIdsValue = objectValue.propertyIds\n      const propertyIds = capturePropertyIds(state, propertyIdsValue, `${objectPath}.propertyIds`)\n      objects.push(Object.freeze({ objectTypeId, propertyIds }))\n    }\n\n    const linksValue = value.links\n    const linksSource = captureArray(linksValue, `${path}.links`)\n    if (linksSource.length > OBJECT_READ_SCOPE_LIMITS.maxNodes - state.nodeCount) {\n      throw invalidScope(\n        `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxNodes} selection nodes`\n      )\n    }\n    const links: ObjectReadLinkSelection[] = []\n    for (let linkIndex = 0; linkIndex < linksSource.length; linkIndex += 1) {\n      const linkPath = `${path}.links[${linkIndex}]`\n      const linkValue = linksSource.value[linkIndex]\n      if (!isRecord(linkValue)) {\n        throw invalidScope(`${linkPath} must contain definitions and a target node`)\n      }\n\n      const definitionsValue = linkValue.definitions\n      const definitionsSource = captureArray(definitionsValue, `${linkPath}.definitions`)\n      if (definitionsSource.length === 0) {\n        throw invalidScope(`${linkPath}.definitions must not be empty`)\n      }\n      if (definitionsSource.length > OBJECT_READ_SCOPE_LIMITS.maxSteps - state.concreteStepCount) {\n        throw invalidScope(\n          `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxSteps} concrete link steps`\n        )\n      }\n      const definitions: ObjectReadLinkDefinitionSelection[] = []\n      for (\n        let definitionIndex = 0;\n        definitionIndex < definitionsSource.length;\n        definitionIndex += 1\n      ) {\n        const definitionPath = `${linkPath}.definitions[${definitionIndex}]`\n        const definitionValue = definitionsSource.value[definitionIndex]\n        definitions.push(captureDefinition(state, definitionValue, definitionPath))\n      }\n\n      const targetValue = linkValue.target\n      if (!isRecord(targetValue)) {\n        throw invalidScope(`${linkPath} must contain definitions and a target node`)\n      }\n      const target = captureNode(state, targetValue, `${linkPath}.target`, depth + 1)\n      links.push(Object.freeze({ definitions: Object.freeze(definitions), target }))\n    }\n\n    return Object.freeze({ objects: Object.freeze(objects), links: Object.freeze(links) })\n  } finally {\n    state.visiting.delete(value)\n  }\n}\n\nfunction captureDefinition(\n  state: ScopeCaptureState,\n  value: unknown,\n  path: string\n): ObjectReadLinkDefinitionSelection {\n  if (!isRecord(value)) {\n    throw invalidScope(`${path} must contain a concrete link definition`)\n  }\n\n  const sourceObjectTypeId = captureIdentifier(\n    state,\n    value.sourceObjectTypeId,\n    `${path}.sourceObjectTypeId`\n  )\n  const linkId = captureIdentifier(state, value.linkId, `${path}.linkId`)\n\n  const targetObjectTypeIdsValue = value.targetObjectTypeIds\n  const targetObjectTypeIdsSource = captureArray(\n    targetObjectTypeIdsValue,\n    `${path}.targetObjectTypeIds`\n  )\n  if (targetObjectTypeIdsSource.length === 0) {\n    throw invalidScope(`${path}.targetObjectTypeIds must not be empty`)\n  }\n  state.concreteStepCount = reserveCount(\n    state.concreteStepCount,\n    targetObjectTypeIdsSource.length,\n    OBJECT_READ_SCOPE_LIMITS.maxSteps,\n    `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxSteps} concrete link steps`\n  )\n  const targetObjectTypeIds = captureIdentifiers(\n    state,\n    targetObjectTypeIdsSource,\n    `${path}.targetObjectTypeIds`\n  )\n\n  const propertyIdsValue = value.propertyIds\n  const propertyIds = capturePropertyIds(state, propertyIdsValue, `${path}.propertyIds`)\n  return Object.freeze({ sourceObjectTypeId, linkId, targetObjectTypeIds, propertyIds })\n}\n\nfunction capturePropertyIds(\n  state: ScopeCaptureState,\n  value: unknown,\n  path: string\n): readonly string[] {\n  const source = captureArray(value, path)\n  state.propertyOccurrenceCount = reserveCount(\n    state.propertyOccurrenceCount,\n    source.length,\n    OBJECT_READ_SCOPE_LIMITS.maxPropertyOccurrences,\n    `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxPropertyOccurrences} selected property occurrences`\n  )\n  return captureIdentifiers(state, source, path)\n}\n\nfunction captureIdentifiers(\n  state: ScopeCaptureState,\n  source: CapturedArray,\n  path: string\n): readonly string[] {\n  const identifiers: string[] = []\n  for (let index = 0; index < source.length; index += 1) {\n    identifiers.push(captureIdentifier(state, source.value[index], `${path}[${index}]`))\n  }\n  return Object.freeze(identifiers)\n}\n\nfunction captureIdentifier(state: ScopeCaptureState, value: unknown, path: string): string {\n  const identifier = nonEmptyString(value, path)\n  state.identifierCharacterCount = reserveCount(\n    state.identifierCharacterCount,\n    identifier.length,\n    OBJECT_READ_SCOPE_LIMITS.maxIdentifierCharacters,\n    `scope exceeds the maximum of ${OBJECT_READ_SCOPE_LIMITS.maxIdentifierCharacters} identifier characters`\n  )\n  return identifier\n}\n\nfunction captureArray(value: unknown, path: string): CapturedArray {\n  if (!Array.isArray(value)) {\n    throw invalidScope(`${path} must be an array`)\n  }\n  const array = value as readonly unknown[]\n  const length = array.length\n  if (!Number.isSafeInteger(length) || length < 0) {\n    throw invalidScope(`${path}.length must be a non-negative safe integer`)\n  }\n  return { value: array, length }\n}\n\nfunction reserveCount(current: number, count: number, limit: number, message: string): number {\n  if (count > limit - current) throw invalidScope(message)\n  return current + count\n}\n\n/** Fail closed when a project-bound selected reader is accidentally reused across projects. */\nexport function assertObjectReaderProject(\n  expectedProjectId: string,\n  actualProjectId: string\n): void {\n  if (actualProjectId !== expectedProjectId) {\n    throw new Error(\n      `[Sixb] Object reader belongs to project '${expectedProjectId}', not '${actualProjectId}'.`\n    )\n  }\n}\n\ninterface ConcreteDefinition {\n  readonly sourceObjectTypeId: string\n  readonly linkId: string\n  readonly targetObjectTypeId: string\n  readonly propertyIds: readonly string[]\n}\n\nfunction normalizeConcreteDefinitions(\n  definitions: readonly ObjectReadLinkDefinitionSelection[],\n  path: string,\n  addIdentifier: (value: unknown, path: string) => string,\n  addPropertyOccurrences: (count: number) => void,\n  addCompiledPropertyOccurrences: (count: number) => void,\n  addCompiledIdentifierCharacters: (count: number) => void,\n  addConcreteStep: () => void\n): readonly ConcreteDefinition[] {\n  const propertiesByDefinition = new Map<\n    string,\n    {\n      sourceObjectTypeId: string\n      linkId: string\n      targetObjectTypeId: string\n      properties: Set<string>\n    }\n  >()\n\n  for (const [index, definition] of definitions.entries()) {\n    const definitionPath = `${path}[${index}]`\n    if (\n      !isRecord(definition) ||\n      !Array.isArray(definition.targetObjectTypeIds) ||\n      !Array.isArray(definition.propertyIds)\n    ) {\n      throw invalidScope(`${definitionPath} must contain a concrete link definition`)\n    }\n    const sourceObjectTypeId = addIdentifier(\n      definition.sourceObjectTypeId,\n      `${definitionPath}.sourceObjectTypeId`\n    )\n    const linkId = addIdentifier(definition.linkId, `${definitionPath}.linkId`)\n    if (definition.targetObjectTypeIds.length === 0) {\n      throw invalidScope(`${definitionPath}.targetObjectTypeIds must not be empty`)\n    }\n    addPropertyOccurrences(definition.propertyIds.length)\n    let propertyIdentifierCharacters = 0\n    for (const [propertyIndex, propertyId] of definition.propertyIds.entries()) {\n      propertyIdentifierCharacters += addIdentifier(\n        propertyId,\n        `${definitionPath}.propertyIds[${propertyIndex}]`\n      ).length\n    }\n    let targetIdentifierCharacters = 0\n    for (const [targetIndex, value] of definition.targetObjectTypeIds.entries()) {\n      addConcreteStep()\n      targetIdentifierCharacters += addIdentifier(\n        value,\n        `${definitionPath}.targetObjectTypeIds[${targetIndex}]`\n      ).length\n    }\n\n    // Reserve the complete concrete expansion before allocating collision-safe keys or copying\n    // properties into per-target sets. One compact raw definition may otherwise amplify its\n    // source/link/property identifiers once per target beyond the provider-neutral scope caps.\n    addCompiledPropertyOccurrences(\n      definition.propertyIds.length * definition.targetObjectTypeIds.length\n    )\n    const repeatedIdentifierCharacters =\n      sourceObjectTypeId.length + linkId.length + propertyIdentifierCharacters\n    addCompiledIdentifierCharacters(\n      repeatedIdentifierCharacters * definition.targetObjectTypeIds.length +\n        targetIdentifierCharacters\n    )\n\n    for (const [targetIndex, value] of definition.targetObjectTypeIds.entries()) {\n      const targetObjectTypeId = nonEmptyString(\n        value,\n        `${definitionPath}.targetObjectTypeIds[${targetIndex}]`\n      )\n      const key = JSON.stringify([sourceObjectTypeId, linkId, targetObjectTypeId])\n      const normalized = propertiesByDefinition.get(key) ?? {\n        sourceObjectTypeId,\n        linkId,\n        targetObjectTypeId,\n        properties: new Set<string>(),\n      }\n      for (const [propertyIndex, propertyId] of definition.propertyIds.entries()) {\n        normalized.properties.add(\n          nonEmptyString(propertyId, `${definitionPath}.propertyIds[${propertyIndex}]`)\n        )\n      }\n      propertiesByDefinition.set(key, normalized)\n    }\n  }\n\n  return [...propertiesByDefinition.values()]\n    .sort(\n      (left, right) =>\n        left.sourceObjectTypeId.localeCompare(right.sourceObjectTypeId) ||\n        left.linkId.localeCompare(right.linkId) ||\n        left.targetObjectTypeId.localeCompare(right.targetObjectTypeId)\n    )\n    .map(({ properties, ...definition }) =>\n      Object.freeze({\n        ...definition,\n        propertyIds: Object.freeze([...properties].sort()),\n      })\n    )\n}\n\nfunction identifierCharacters(values: readonly string[]): number {\n  return values.reduce((total, value) => total + value.length, 0)\n}\n\nfunction normalizeObjects(\n  selections: readonly ObjectReadObjectSelection[],\n  path: string\n): readonly ObjectReadObjectSelection[] {\n  const propertiesByType = new Map<string, Set<string>>()\n  for (const [index, selection] of selections.entries()) {\n    if (!isRecord(selection) || !Array.isArray(selection.propertyIds)) {\n      throw invalidScope(`${path}[${index}] must contain an object type and property ids`)\n    }\n    const objectTypeId = nonEmptyString(selection.objectTypeId, `${path}[${index}].objectTypeId`)\n    const properties = propertiesByType.get(objectTypeId) ?? new Set<string>()\n    for (const propertyId of normalizeIds(selection.propertyIds, `${path}[${index}].propertyIds`)) {\n      properties.add(propertyId)\n    }\n    propertiesByType.set(objectTypeId, properties)\n  }\n  return [...propertiesByType]\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([objectTypeId, properties]) =>\n      Object.freeze({ objectTypeId, propertyIds: Object.freeze([...properties].sort()) })\n    )\n}\n\nfunction normalizeIds(values: readonly string[], path: string): string[] {\n  return [\n    ...new Set(values.map((value, index) => nonEmptyString(value, `${path}[${index}]`))),\n  ].sort()\n}\n\nfunction nonEmptyString(value: unknown, path: string): string {\n  if (typeof value !== \"string\" || value.trim().length === 0) {\n    throw invalidScope(`${path} must be a non-empty string`)\n  }\n  return value\n}\n\nfunction setsEqual(left: ReadonlySet<string>, right: ReadonlySet<string>): boolean {\n  return left.size === right.size && [...left].every((value) => right.has(value))\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null\n}\n\nfunction invalidScope(message: string): Error {\n  return new Error(`[Sixb] Invalid object read scope: ${message}.`)\n}\n"
+  ],
+  "mappings": ";;AAcO,IAAM,2BAA2B,OAAO,OAAO;AAAA,EACpD,UAAU;AAAA,EACV,UAAU;AAAA,EACV,qBAAqB;AAAA,EACrB,UAAU;AAAA,EACV,wBAAwB;AAAA,EACxB,yBAAyB;AAC3B,CAAC;AAQM,SAAS,8BAA8B,CAC5C,UACiC;AAAA,EACjC,MAAM,QAAQ,+BAA+B,QAAQ;AAAA,EACrD,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,SAAS,cAAc,CAAC,MAAM,QAAQ,MAAM,KAAK,GAAG;AAAA,IAChF,MAAM,aAAa,mDAAmD;AAAA,EACxE;AAAA,EAEA,MAAM,QAAkC,CAAC;AAAA,EACzC,MAAM,UAA+C,CAAC;AAAA,EACtD,MAAM,QAAkC,CAAC;AAAA,EACzC,MAAM,WAAW,IAAI;AAAA,EACrB,IAAI,aAAa;AAAA,EACjB,IAAI,oBAAoB;AAAA,EACxB,IAAI,uBAAuB;AAAA,EAC3B,IAAI,0BAA0B;AAAA,EAC9B,IAAI,2BAA2B;AAAA,EAC/B,IAAI,kCAAkC;AAAA,EACtC,IAAI,mCAAmC;AAAA,EAEvC,MAAM,gBAAgB,CAAC,OAAgB,SAAyB;AAAA,IAC9D,MAAM,aAAa,eAAe,OAAO,IAAI;AAAA,IAC7C,4BAA4B,WAAW;AAAA,IACvC,IAAI,2BAA2B,yBAAyB,yBAAyB;AAAA,MAC/E,MAAM,aACJ,gCAAgC,yBAAyB,+CAC3D;AAAA,IACF;AAAA,IACA,OAAO;AAAA;AAAA,EAGT,MAAM,yBAAyB,CAAC,UAAwB;AAAA,IACtD,2BAA2B;AAAA,IAC3B,IAAI,0BAA0B,yBAAyB,wBAAwB;AAAA,MAC7E,MAAM,aACJ,gCAAgC,yBAAyB,sDAC3D;AAAA,IACF;AAAA;AAAA,EAGF,MAAM,iCAAiC,CAAC,UAAwB;AAAA,IAC9D,mCAAmC;AAAA,IACnC,IAAI,kCAAkC,yBAAyB,wBAAwB;AAAA,MACrF,MAAM,aACJ,gCAAgC,yBAAyB,wEAC3D;AAAA,IACF;AAAA;AAAA,EAGF,MAAM,kCAAkC,CAAC,UAAwB;AAAA,IAC/D,oCAAoC;AAAA,IACpC,IAAI,mCAAmC,yBAAyB,yBAAyB;AAAA,MACvF,MAAM,aACJ,gCAAgC,yBAAyB,iEAC3D;AAAA,IACF;AAAA;AAAA,EAGF,MAAM,YAAY,CAAC,MAAsB,MAAc,UAA0B;AAAA,IAC/E,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,QAAQ,KAAK,OAAO,KAAK,CAAC,MAAM,QAAQ,KAAK,KAAK,GAAG;AAAA,MACjF,MAAM,aAAa,GAAG,8CAA8C;AAAA,IACtE;AAAA,IACA,IAAI,QAAQ,yBAAyB,UAAU;AAAA,MAC7C,MAAM,aACJ,GAAG,0CAA0C,yBAAyB,UACxE;AAAA,IACF;AAAA,IACA,IAAI,cAAc,yBAAyB,UAAU;AAAA,MACnD,MAAM,aACJ,gCAAgC,yBAAyB,0BAC3D;AAAA,IACF;AAAA,IACA,IAAI,SAAS,IAAI,IAAI;AAAA,MAAG,MAAM,aAAa,GAAG,uCAAuC;AAAA,IACrF,SAAS,IAAI,IAAI;AAAA,IAEjB,MAAM,SAAS;AAAA,IACf,IAAI;AAAA,MACF,wBAAwB,KAAK,QAAQ;AAAA,MACrC,IAAI,uBAAuB,yBAAyB,qBAAqB;AAAA,QACvE,MAAM,aACJ,gCAAgC,yBAAyB,uCAC3D;AAAA,MACF;AAAA,MAEA,YAAY,aAAa,WAAW,KAAK,QAAQ,QAAQ,GAAG;AAAA,QAC1D,MAAM,aAAa,GAAG,gBAAgB;AAAA,QACtC,IAAI,CAAC,SAAS,MAAM,KAAK,CAAC,MAAM,QAAQ,OAAO,WAAW,GAAG;AAAA,UAC3D,MAAM,aAAa,GAAG,yDAAyD;AAAA,QACjF;AAAA,QACA,cAAc,OAAO,cAAc,GAAG,yBAAyB;AAAA,QAC/D,uBAAuB,OAAO,YAAY,MAAM;AAAA,QAChD,YAAY,eAAe,eAAe,OAAO,YAAY,QAAQ,GAAG;AAAA,UACtE,cAAc,YAAY,GAAG,0BAA0B,gBAAgB;AAAA,QACzE;AAAA,MACF;AAAA,MAEA,MAAM,oBAAoB,iBAAiB,KAAK,SAAS,GAAG,cAAc;AAAA,MAC1E,IAAI,kBAAkB,WAAW,GAAG;AAAA,QAClC,MAAM,aAAa,GAAG,6DAA6D;AAAA,MACrF;AAAA,MACA,WAAW,UAAU,mBAAmB;AAAA,QACtC,+BAA+B,OAAO,YAAY,MAAM;AAAA,QACxD,gCACE,OAAO,aAAa,SAAS,qBAAqB,OAAO,WAAW,CACtE;AAAA,QACA,QAAQ,KAAK,OAAO,OAAO,EAAE,WAAW,OAAO,CAAC,CAAC;AAAA,MACnD;AAAA,MAEA,YAAY,WAAW,SAAS,KAAK,MAAM,QAAQ,GAAG;AAAA,QACpD,MAAM,WAAW,GAAG,cAAc;AAAA,QAClC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,QAAQ,KAAK,WAAW,KAAK,CAAC,SAAS,KAAK,MAAM,GAAG;AAAA,UACjF,MAAM,aAAa,GAAG,qDAAqD;AAAA,QAC7E;AAAA,QACA,IAAI,KAAK,YAAY,WAAW,GAAG;AAAA,UACjC,MAAM,aAAa,GAAG,wCAAwC;AAAA,QAChE;AAAA,QAEA,MAAM,cAAc,6BAClB,KAAK,aACL,GAAG,wBACH,eACA,wBACA,gCACA,iCACA,MAAM;AAAA,UACJ,qBAAqB;AAAA,UACrB,IAAI,oBAAoB,yBAAyB,UAAU;AAAA,YACzD,MAAM,aACJ,gCAAgC,yBAAyB,8BAC3D;AAAA,UACF;AAAA,SAEJ;AAAA,QACA,MAAM,cAAc,IAAI,IAAI,kBAAkB,IAAI,CAAC,WAAW,OAAO,YAAY,CAAC;AAAA,QAClF,WAAW,cAAc,aAAa;AAAA,UACpC,IAAI,CAAC,YAAY,IAAI,WAAW,kBAAkB,GAAG;AAAA,YACnD,MAAM,aACJ,GAAG,iCAAiC,WAAW,6CACjD;AAAA,UACF;AAAA,QACF;AAAA,QAEA,MAAM,cAAc,UAClB,KAAK,QACL,GAAG,mBACH,QAAQ,CACV;AAAA,QACA,MAAM,aAAa,IAAI,IACrB,QACG,OAAO,CAAC,WAAW,OAAO,WAAW,WAAW,EAChD,IAAI,CAAC,WAAW,OAAO,YAAY,CACxC;AAAA,QACA,MAAM,cAAc,IAAI,IAAI,YAAY,IAAI,CAAC,eAAe,WAAW,kBAAkB,CAAC;AAAA,QAC1F,IAAI,CAAC,UAAU,YAAY,WAAW,GAAG;AAAA,UACvC,MAAM,aACJ,GAAG,6EACL;AAAA,QACF;AAAA,QAEA,WAAW,cAAc,aAAa;AAAA,UACpC,MAAM,KACJ,OAAO,OAAO;AAAA,YACZ,QAAQ;AAAA,YACR,cAAc;AAAA,eACX;AAAA,UACL,CAAC,CACH;AAAA,QACF;AAAA,MACF;AAAA,cACA;AAAA,MACA,SAAS,OAAO,IAAI;AAAA;AAAA,IAGtB,OAAO;AAAA;AAAA,EAGT,YAAY,WAAW,SAAS,MAAM,MAAM,QAAQ,GAAG;AAAA,IACrD,MAAM,OAAO,SAAS;AAAA,IACtB,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,KAAK,CAAC,SAAS,KAAK,IAAI,GAAG;AAAA,MACrE,MAAM,aAAa,GAAG,wDAAwD;AAAA,IAChF;AAAA,IACA,MAAM,eAAe,cAAc,KAAK,OAAO,cAAc,GAAG,0BAA0B;AAAA,IAC1F,MAAM,YAAY,cAAc,KAAK,OAAO,WAAW,GAAG,uBAAuB;AAAA,IACjF,gCAAgC,aAAa,SAAS,UAAU,MAAM;AAAA,IACtE,MAAM,SAAS,UAAU,KAAK,MAAmC,GAAG,aAAa,CAAC;AAAA,IAClF,IACE,CAAC,QAAQ,KAAK,CAAC,WAAW,OAAO,WAAW,UAAU,OAAO,iBAAiB,YAAY,GAC1F;AAAA,MACA,MAAM,aAAa,GAAG,qBAAqB,gDAAgD;AAAA,IAC7F;AAAA,IACA,MAAM,KAAK,OAAO,OAAO,EAAE,QAAQ,cAAc,UAAU,CAAC,CAAC;AAAA,EAC/D;AAAA,EAEA,OAAO,OAAO,OAAO;AAAA,IACnB,MAAM;AAAA,IACN,OAAO,OAAO,OAAO,KAAK;AAAA,IAC1B,SAAS,OAAO,OAAO,OAAO;AAAA,IAC9B,OAAO,OAAO,OAAO,KAAK;AAAA,EAC5B,CAAC;AAAA;AAqBI,SAAS,8BAA8B,CAAC,OAAyC;AAAA,EACtF,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,aAAa,mDAAmD;AAAA,EACxE;AAAA,EAEA,MAAM,OAAO,MAAM;AAAA,EACnB,IAAI,SAAS,YAAY;AAAA,IACvB,MAAM,aAAa,mDAAmD;AAAA,EACxE;AAAA,EAEA,MAAM,aAAa,MAAM;AAAA,EACzB,MAAM,cAAc,aAAa,YAAY,OAAO;AAAA,EACpD,IAAI,YAAY,SAAS,yBAAyB,UAAU;AAAA,IAC1D,MAAM,aACJ,gCAAgC,yBAAyB,0BAC3D;AAAA,EACF;AAAA,EAEA,MAAM,QAA2B;AAAA,IAC/B,UAAU,IAAI;AAAA,IACd,WAAW;AAAA,IACX,sBAAsB;AAAA,IACtB,mBAAmB;AAAA,IACnB,yBAAyB;AAAA,IACzB,0BAA0B;AAAA,EAC5B;AAAA,EACA,MAAM,QAA0B,CAAC;AAAA,EACjC,SAAS,YAAY,EAAG,YAAY,YAAY,QAAQ,aAAa,GAAG;AAAA,IACtE,MAAM,OAAO,SAAS;AAAA,IACtB,MAAM,YAAY,YAAY,MAAM;AAAA,IACpC,IAAI,CAAC,SAAS,SAAS,GAAG;AAAA,MACxB,MAAM,aAAa,GAAG,wDAAwD;AAAA,IAChF;AAAA,IAEA,MAAM,cAAc,UAAU;AAAA,IAC9B,IAAI,CAAC,SAAS,WAAW,GAAG;AAAA,MAC1B,MAAM,aAAa,GAAG,wDAAwD;AAAA,IAChF;AAAA,IACA,MAAM,eAAe,kBACnB,OACA,YAAY,cACZ,GAAG,0BACL;AAAA,IACA,MAAM,YAAY,kBAAkB,OAAO,YAAY,WAAW,GAAG,uBAAuB;AAAA,IAC5F,MAAM,SAAS,OAAO,OAAO,EAAE,cAAc,UAAU,CAAC;AAAA,IAExD,MAAM,YAAY,UAAU;AAAA,IAC5B,IAAI,CAAC,SAAS,SAAS,GAAG;AAAA,MACxB,MAAM,aAAa,GAAG,wDAAwD;AAAA,IAChF;AAAA,IACA,MAAM,OAAO,YAAY,OAAO,WAAW,GAAG,aAAa,CAAC;AAAA,IAC5D,MAAM,KAAK,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,CAAC;AAAA,EAC5C;AAAA,EAEA,OAAO,OAAO,OAAO,EAAE,MAAM,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA;AAG5D,SAAS,WAAW,CAClB,OACA,OACA,MACA,OACgB;AAAA,EAChB,IAAI,QAAQ,yBAAyB,UAAU;AAAA,IAC7C,MAAM,aACJ,GAAG,0CAA0C,yBAAyB,UACxE;AAAA,EACF;AAAA,EACA,IAAI,MAAM,aAAa,yBAAyB,UAAU;AAAA,IACxD,MAAM,aACJ,gCAAgC,yBAAyB,0BAC3D;AAAA,EACF;AAAA,EACA,IAAI,MAAM,SAAS,IAAI,KAAK,GAAG;AAAA,IAC7B,MAAM,aAAa,GAAG,uCAAuC;AAAA,EAC/D;AAAA,EACA,MAAM,SAAS,IAAI,KAAK;AAAA,EACxB,MAAM,aAAa;AAAA,EAEnB,IAAI;AAAA,IACF,MAAM,eAAe,MAAM;AAAA,IAC3B,MAAM,gBAAgB,aAAa,cAAc,GAAG,cAAc;AAAA,IAClE,MAAM,uBAAuB,aAC3B,MAAM,sBACN,cAAc,QACd,yBAAyB,qBACzB,gCAAgC,yBAAyB,uCAC3D;AAAA,IACA,MAAM,UAAuC,CAAC;AAAA,IAC9C,SAAS,cAAc,EAAG,cAAc,cAAc,QAAQ,eAAe,GAAG;AAAA,MAC9E,MAAM,aAAa,GAAG,gBAAgB;AAAA,MACtC,MAAM,cAAc,cAAc,MAAM;AAAA,MACxC,IAAI,CAAC,SAAS,WAAW,GAAG;AAAA,QAC1B,MAAM,aAAa,GAAG,yDAAyD;AAAA,MACjF;AAAA,MAEA,MAAM,eAAe,kBACnB,OACA,YAAY,cACZ,GAAG,yBACL;AAAA,MACA,MAAM,mBAAmB,YAAY;AAAA,MACrC,MAAM,cAAc,mBAAmB,OAAO,kBAAkB,GAAG,wBAAwB;AAAA,MAC3F,QAAQ,KAAK,OAAO,OAAO,EAAE,cAAc,YAAY,CAAC,CAAC;AAAA,IAC3D;AAAA,IAEA,MAAM,aAAa,MAAM;AAAA,IACzB,MAAM,cAAc,aAAa,YAAY,GAAG,YAAY;AAAA,IAC5D,IAAI,YAAY,SAAS,yBAAyB,WAAW,MAAM,WAAW;AAAA,MAC5E,MAAM,aACJ,gCAAgC,yBAAyB,0BAC3D;AAAA,IACF;AAAA,IACA,MAAM,QAAmC,CAAC;AAAA,IAC1C,SAAS,YAAY,EAAG,YAAY,YAAY,QAAQ,aAAa,GAAG;AAAA,MACtE,MAAM,WAAW,GAAG,cAAc;AAAA,MAClC,MAAM,YAAY,YAAY,MAAM;AAAA,MACpC,IAAI,CAAC,SAAS,SAAS,GAAG;AAAA,QACxB,MAAM,aAAa,GAAG,qDAAqD;AAAA,MAC7E;AAAA,MAEA,MAAM,mBAAmB,UAAU;AAAA,MACnC,MAAM,oBAAoB,aAAa,kBAAkB,GAAG,sBAAsB;AAAA,MAClF,IAAI,kBAAkB,WAAW,GAAG;AAAA,QAClC,MAAM,aAAa,GAAG,wCAAwC;AAAA,MAChE;AAAA,MACA,IAAI,kBAAkB,SAAS,yBAAyB,WAAW,MAAM,mBAAmB;AAAA,QAC1F,MAAM,aACJ,gCAAgC,yBAAyB,8BAC3D;AAAA,MACF;AAAA,MACA,MAAM,cAAmD,CAAC;AAAA,MAC1D,SACM,kBAAkB,EACtB,kBAAkB,kBAAkB,QACpC,mBAAmB,GACnB;AAAA,QACA,MAAM,iBAAiB,GAAG,wBAAwB;AAAA,QAClD,MAAM,kBAAkB,kBAAkB,MAAM;AAAA,QAChD,YAAY,KAAK,kBAAkB,OAAO,iBAAiB,cAAc,CAAC;AAAA,MAC5E;AAAA,MAEA,MAAM,cAAc,UAAU;AAAA,MAC9B,IAAI,CAAC,SAAS,WAAW,GAAG;AAAA,QAC1B,MAAM,aAAa,GAAG,qDAAqD;AAAA,MAC7E;AAAA,MACA,MAAM,SAAS,YAAY,OAAO,aAAa,GAAG,mBAAmB,QAAQ,CAAC;AAAA,MAC9E,MAAM,KAAK,OAAO,OAAO,EAAE,aAAa,OAAO,OAAO,WAAW,GAAG,OAAO,CAAC,CAAC;AAAA,IAC/E;AAAA,IAEA,OAAO,OAAO,OAAO,EAAE,SAAS,OAAO,OAAO,OAAO,GAAG,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,YACrF;AAAA,IACA,MAAM,SAAS,OAAO,KAAK;AAAA;AAAA;AAI/B,SAAS,iBAAiB,CACxB,OACA,OACA,MACmC;AAAA,EACnC,IAAI,CAAC,SAAS,KAAK,GAAG;AAAA,IACpB,MAAM,aAAa,GAAG,8CAA8C;AAAA,EACtE;AAAA,EAEA,MAAM,qBAAqB,kBACzB,OACA,MAAM,oBACN,GAAG,yBACL;AAAA,EACA,MAAM,SAAS,kBAAkB,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,EAEtE,MAAM,2BAA2B,MAAM;AAAA,EACvC,MAAM,4BAA4B,aAChC,0BACA,GAAG,0BACL;AAAA,EACA,IAAI,0BAA0B,WAAW,GAAG;AAAA,IAC1C,MAAM,aAAa,GAAG,4CAA4C;AAAA,EACpE;AAAA,EACA,MAAM,oBAAoB,aACxB,MAAM,mBACN,0BAA0B,QAC1B,yBAAyB,UACzB,gCAAgC,yBAAyB,8BAC3D;AAAA,EACA,MAAM,sBAAsB,mBAC1B,OACA,2BACA,GAAG,0BACL;AAAA,EAEA,MAAM,mBAAmB,MAAM;AAAA,EAC/B,MAAM,cAAc,mBAAmB,OAAO,kBAAkB,GAAG,kBAAkB;AAAA,EACrF,OAAO,OAAO,OAAO,EAAE,oBAAoB,QAAQ,qBAAqB,YAAY,CAAC;AAAA;AAGvF,SAAS,kBAAkB,CACzB,OACA,OACA,MACmB;AAAA,EACnB,MAAM,SAAS,aAAa,OAAO,IAAI;AAAA,EACvC,MAAM,0BAA0B,aAC9B,MAAM,yBACN,OAAO,QACP,yBAAyB,wBACzB,gCAAgC,yBAAyB,sDAC3D;AAAA,EACA,OAAO,mBAAmB,OAAO,QAAQ,IAAI;AAAA;AAG/C,SAAS,kBAAkB,CACzB,OACA,QACA,MACmB;AAAA,EACnB,MAAM,cAAwB,CAAC;AAAA,EAC/B,SAAS,QAAQ,EAAG,QAAQ,OAAO,QAAQ,SAAS,GAAG;AAAA,IACrD,YAAY,KAAK,kBAAkB,OAAO,OAAO,MAAM,QAAQ,GAAG,QAAQ,QAAQ,CAAC;AAAA,EACrF;AAAA,EACA,OAAO,OAAO,OAAO,WAAW;AAAA;AAGlC,SAAS,iBAAiB,CAAC,OAA0B,OAAgB,MAAsB;AAAA,EACzF,MAAM,aAAa,eAAe,OAAO,IAAI;AAAA,EAC7C,MAAM,2BAA2B,aAC/B,MAAM,0BACN,WAAW,QACX,yBAAyB,yBACzB,gCAAgC,yBAAyB,+CAC3D;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,YAAY,CAAC,OAAgB,MAA6B;AAAA,EACjE,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzB,MAAM,aAAa,GAAG,uBAAuB;AAAA,EAC/C;AAAA,EACA,MAAM,QAAQ;AAAA,EACd,MAAM,SAAS,MAAM;AAAA,EACrB,IAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,GAAG;AAAA,IAC/C,MAAM,aAAa,GAAG,iDAAiD;AAAA,EACzE;AAAA,EACA,OAAO,EAAE,OAAO,OAAO,OAAO;AAAA;AAGhC,SAAS,YAAY,CAAC,SAAiB,OAAe,OAAe,SAAyB;AAAA,EAC5F,IAAI,QAAQ,QAAQ;AAAA,IAAS,MAAM,aAAa,OAAO;AAAA,EACvD,OAAO,UAAU;AAAA;AAIZ,SAAS,yBAAyB,CACvC,mBACA,iBACM;AAAA,EACN,IAAI,oBAAoB,mBAAmB;AAAA,IACzC,MAAM,IAAI,MACR,4CAA4C,4BAA4B,mBAC1E;AAAA,EACF;AAAA;AAUF,SAAS,4BAA4B,CACnC,aACA,MACA,eACA,wBACA,gCACA,iCACA,iBAC+B;AAAA,EAC/B,MAAM,yBAAyB,IAAI;AAAA,EAUnC,YAAY,OAAO,eAAe,YAAY,QAAQ,GAAG;AAAA,IACvD,MAAM,iBAAiB,GAAG,QAAQ;AAAA,IAClC,IACE,CAAC,SAAS,UAAU,KACpB,CAAC,MAAM,QAAQ,WAAW,mBAAmB,KAC7C,CAAC,MAAM,QAAQ,WAAW,WAAW,GACrC;AAAA,MACA,MAAM,aAAa,GAAG,wDAAwD;AAAA,IAChF;AAAA,IACA,MAAM,qBAAqB,cACzB,WAAW,oBACX,GAAG,mCACL;AAAA,IACA,MAAM,SAAS,cAAc,WAAW,QAAQ,GAAG,uBAAuB;AAAA,IAC1E,IAAI,WAAW,oBAAoB,WAAW,GAAG;AAAA,MAC/C,MAAM,aAAa,GAAG,sDAAsD;AAAA,IAC9E;AAAA,IACA,uBAAuB,WAAW,YAAY,MAAM;AAAA,IACpD,IAAI,+BAA+B;AAAA,IACnC,YAAY,eAAe,eAAe,WAAW,YAAY,QAAQ,GAAG;AAAA,MAC1E,gCAAgC,cAC9B,YACA,GAAG,8BAA8B,gBACnC,EAAE;AAAA,IACJ;AAAA,IACA,IAAI,6BAA6B;AAAA,IACjC,YAAY,aAAa,UAAU,WAAW,oBAAoB,QAAQ,GAAG;AAAA,MAC3E,gBAAgB;AAAA,MAChB,8BAA8B,cAC5B,OACA,GAAG,sCAAsC,cAC3C,EAAE;AAAA,IACJ;AAAA,IAKA,+BACE,WAAW,YAAY,SAAS,WAAW,oBAAoB,MACjE;AAAA,IACA,MAAM,+BACJ,mBAAmB,SAAS,OAAO,SAAS;AAAA,IAC9C,gCACE,+BAA+B,WAAW,oBAAoB,SAC5D,0BACJ;AAAA,IAEA,YAAY,aAAa,UAAU,WAAW,oBAAoB,QAAQ,GAAG;AAAA,MAC3E,MAAM,qBAAqB,eACzB,OACA,GAAG,sCAAsC,cAC3C;AAAA,MACA,MAAM,MAAM,KAAK,UAAU,CAAC,oBAAoB,QAAQ,kBAAkB,CAAC;AAAA,MAC3E,MAAM,aAAa,uBAAuB,IAAI,GAAG,KAAK;AAAA,QACpD;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY,IAAI;AAAA,MAClB;AAAA,MACA,YAAY,eAAe,eAAe,WAAW,YAAY,QAAQ,GAAG;AAAA,QAC1E,WAAW,WAAW,IACpB,eAAe,YAAY,GAAG,8BAA8B,gBAAgB,CAC9E;AAAA,MACF;AAAA,MACA,uBAAuB,IAAI,KAAK,UAAU;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,OAAO,CAAC,GAAG,uBAAuB,OAAO,CAAC,EACvC,KACC,CAAC,MAAM,UACL,KAAK,mBAAmB,cAAc,MAAM,kBAAkB,KAC9D,KAAK,OAAO,cAAc,MAAM,MAAM,KACtC,KAAK,mBAAmB,cAAc,MAAM,kBAAkB,CAClE,EACC,IAAI,GAAG,eAAe,iBACrB,OAAO,OAAO;AAAA,OACT;AAAA,IACH,aAAa,OAAO,OAAO,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC;AAAA,EACnD,CAAC,CACH;AAAA;AAGJ,SAAS,oBAAoB,CAAC,QAAmC;AAAA,EAC/D,OAAO,OAAO,OAAO,CAAC,OAAO,UAAU,QAAQ,MAAM,QAAQ,CAAC;AAAA;AAGhE,SAAS,gBAAgB,CACvB,YACA,MACsC;AAAA,EACtC,MAAM,mBAAmB,IAAI;AAAA,EAC7B,YAAY,OAAO,cAAc,WAAW,QAAQ,GAAG;AAAA,IACrD,IAAI,CAAC,SAAS,SAAS,KAAK,CAAC,MAAM,QAAQ,UAAU,WAAW,GAAG;AAAA,MACjE,MAAM,aAAa,GAAG,QAAQ,qDAAqD;AAAA,IACrF;AAAA,IACA,MAAM,eAAe,eAAe,UAAU,cAAc,GAAG,QAAQ,qBAAqB;AAAA,IAC5F,MAAM,aAAa,iBAAiB,IAAI,YAAY,KAAK,IAAI;AAAA,IAC7D,WAAW,cAAc,aAAa,UAAU,aAAa,GAAG,QAAQ,oBAAoB,GAAG;AAAA,MAC7F,WAAW,IAAI,UAAU;AAAA,IAC3B;AAAA,IACA,iBAAiB,IAAI,cAAc,UAAU;AAAA,EAC/C;AAAA,EACA,OAAO,CAAC,GAAG,gBAAgB,EACxB,KAAK,EAAE,QAAQ,WAAW,KAAK,cAAc,KAAK,CAAC,EACnD,IAAI,EAAE,cAAc,gBACnB,OAAO,OAAO,EAAE,cAAc,aAAa,OAAO,OAAO,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,CACpF;AAAA;AAGJ,SAAS,YAAY,CAAC,QAA2B,MAAwB;AAAA,EACvE,OAAO;AAAA,IACL,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,UAAU,eAAe,OAAO,GAAG,QAAQ,QAAQ,CAAC,CAAC;AAAA,EACrF,EAAE,KAAK;AAAA;AAGT,SAAS,cAAc,CAAC,OAAgB,MAAsB;AAAA,EAC5D,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAAA,IAC1D,MAAM,aAAa,GAAG,iCAAiC;AAAA,EACzD;AAAA,EACA,OAAO;AAAA;AAGT,SAAS,SAAS,CAAC,MAA2B,OAAqC;AAAA,EACjF,OAAO,KAAK,SAAS,MAAM,QAAQ,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,UAAU,MAAM,IAAI,KAAK,CAAC;AAAA;AAGhF,SAAS,QAAQ,CAAC,OAAkD;AAAA,EAClE,OAAO,OAAO,UAAU,YAAY,UAAU;AAAA;AAGhD,SAAS,YAAY,CAAC,SAAwB;AAAA,EAC5C,OAAO,IAAI,MAAM,qCAAqC,UAAU;AAAA;",
+  "debugId": "F3C89DAB3F2B853064756E2164756E21",
+  "names": []
+}

package/dist/{chunk-h9kxd41f.js → chunk-rafagrwr.js}

@@ -10,6 +10,7 @@ class ExecutionStorageError extends Error {
 }
 
 // src/storage/executions/validation.ts
+import { isDeepStrictEqual } from "util";
 function normalizeExecutionRecord(input, createdAt = new Date) {
   const record = {
     id: input.id,
@@ -31,6 +32,9 @@ async function validateExecutionRecordReferences(record, lookup) {
     await validatePrincipal(record.authorizationRef.principal, record.projectId, "Authority principal", lookup);
     await validateCredential(record, lookup);
   }
+  if (record.authorizationRef.type === "delegated") {
+    await validateDelegation(record, lookup);
+  }
   await validateParent(record, lookup);
 }
 function cloneExecutionRecord(record) {
@@ -106,6 +110,13 @@ function assertAuthorizationRef(ref) {
       assertNonBlank(ref.primitive.id, "Authority primitive id");
       assertNonBlank(ref.primitive.runId, "Authority primitive run id");
       return;
+    case "delegated":
+      if (ref.delegation.kind !== "share") {
+        invalid(`Unknown authority delegation kind '${String(ref.delegation.kind)}'.`);
+      }
+      assertNonBlank(ref.delegation.grantId, "Authority delegation grant id");
+      assertNonBlank(ref.delegation.sessionId, "Authority delegation session id");
+      return;
     case "kernel":
       assertKernelOperation(ref.operation, "Authority kernel operation");
       return;
@@ -134,7 +145,13 @@ function assertExecutorAuthority(record) {
         }
         return;
       }
-      invalid("Request executions require principal or explicitly disabled authority.");
+      if (authorizationRef.type === "delegated") {
+        if (requestedBy !== undefined) {
+          invalid("Delegated request executions cannot have a requested-by principal.");
+        }
+        return;
+      }
+      invalid("Request executions require principal, delegated, or explicitly disabled authority.");
       break;
     }
     case "primitive": {
@@ -147,13 +164,19 @@ function assertExecutorAuthority(record) {
       return;
     }
     case "agent": {
-      if (authorizationRef.type !== "principal" || authorizationRef.principal.type !== "serviceAccount") {
-        invalid("Agent executions require service-account authority.");
+      if (source.type !== "execution") {
+        invalid("Agent executions require a parent execution source.");
       }
-      if (authorizationRef.credential !== undefined) {
-        invalid("Agent execution authority cannot carry an external credential.");
+      if (authorizationRef.type === "principal" && authorizationRef.principal.type === "serviceAccount" && authorizationRef.credential === undefined) {
+        return;
       }
-      return;
+      if (authorizationRef.type === "principal" && authorizationRef.principal.type === "user" && authorizationRef.credential !== undefined) {
+        return;
+      }
+      if (authorizationRef.type === "disabled")
+        return;
+      invalid("Agent executions require managed service-account, credentialed user, or explicitly disabled authority.");
+      break;
     }
     case "kernel": {
       if (authorizationRef.type !== "kernel" || !kernelOperationsEqual(authorizationRef.operation, executor.operation)) {
@@ -202,6 +225,18 @@ async function validateCredential(record, lookup) {
     throw new ExecutionStorageError("invalid_credential", `[Sixb] Authority access token '${credential.id}' does not belong to principal '${principal.id}'.`);
   }
 }
+async function validateDelegation(record, lookup) {
+  if (record.authorizationRef.type !== "delegated")
+    return;
+  const { grantId, sessionId } = record.authorizationRef.delegation;
+  const session = await lookup.getShareSession({ projectId: record.projectId, id: sessionId });
+  if (!session) {
+    throw new ExecutionStorageError("missing_credential", `[Sixb] Authority shared session '${sessionId}' does not exist in project '${record.projectId}'.`);
+  }
+  if (session.grantId !== grantId) {
+    throw new ExecutionStorageError("invalid_credential", `[Sixb] Authority shared session '${sessionId}' does not belong to grant '${grantId}'.`);
+  }
+}
 async function validateParent(record, lookup) {
   if (record.source.type !== "execution")
     return;
@@ -219,6 +254,12 @@ async function validateParent(record, lookup) {
   if (!principalsEqual(parent.requestedBy, record.requestedBy)) {
     throw new ExecutionStorageError("invalid_parent_execution", `[Sixb] Child execution '${record.id}' must preserve its parent requested-by principal.`);
   }
+  if (record.executor.type === "agent" && isInheritedAgentAuthority(record.authorizationRef) && !isDeepStrictEqual(parent.authorizationRef, record.authorizationRef)) {
+    throw new ExecutionStorageError("invalid_parent_execution", `[Sixb] Child Agent execution '${record.id}' must inherit its parent's authorization reference.`);
+  }
+}
+function isInheritedAgentAuthority(ref) {
+  return ref.type === "disabled" || ref.type === "principal" && ref.principal.type === "user" && ref.credential !== undefined;
 }
 function assertPrincipal(principal, label) {
   if (principal.type !== "user" && principal.type !== "serviceAccount") {
@@ -268,4 +309,4 @@ var TRUSTED_PRIMITIVE_KINDS = new Set([
 
 export { ExecutionStorageError, normalizeExecutionRecord, validateExecutionRecordReferences, cloneExecutionRecord };
 
-//# debugId=903A9A3201175C6C64756E2164756E21
+//# debugId=CD48D807CD286EF564756E2164756E21