@sixb/core 0.1.7 → 0.1.9

package/dist/chunk-37wk412q.js

@@ -1,1370 +0,0 @@
-// @bun
-import {
-  resolveSemanticType
-} from "./chunk-d63tybny.js";
-import {
-  createSixbError
-} from "./chunk-2xns679x.js";
-import {
-  compareStrings
-} from "./chunk-n6jxh8sw.js";
-
-// src/authorization/grant-kinds.ts
-var GRANT_KINDS = {
-  "access:application": {
-    universeKey: "applicationIds",
-    subject: "application",
-    fix: "Use an application exported from '@sixb/core'."
-  },
-  "view:object": {
-    universeKey: "objectTypeIds",
-    subject: "object type",
-    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies }).",
-    expandsSubtypes: true
-  },
-  "view:dataset": {
-    universeKey: "datasetIds",
-    subject: "dataset",
-    fix: "Add it to 'datasets/' or pass it to createSixb({ datasets })."
-  },
-  "edit:object": {
-    universeKey: "objectTypeIds",
-    subject: "object type",
-    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies })."
-  },
-  "append:telemetry": {
-    universeKey: "objectTypeIds",
-    subject: "object type",
-    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies })."
-  },
-  "apply:action": {
-    universeKey: "actionIds",
-    subject: "action",
-    fix: "Add it to 'actions/' or pass it to createSixb({ actions })."
-  },
-  "run:workflow": {
-    universeKey: "workflowIds",
-    subject: "workflow",
-    fix: "Add it to 'workflows/' or pass it to createSixb({ workflows })."
-  },
-  "run:sync": {
-    universeKey: "syncIds",
-    subject: "sync",
-    fix: "Add it to 'syncs/' or pass it to createSixb({ syncs })."
-  },
-  "run:pipeline": {
-    universeKey: "pipelineIds",
-    subject: "pipeline",
-    fix: "Add it to 'pipelines/' or pass it to createSixb({ pipelines })."
-  },
-  "run:agent": {
-    singleton: true,
-    subject: "agent",
-    fix: "Configure models.language and use the exported agent reference in can.run(agent)."
-  },
-  "observe:logs": {
-    universeKey: "observableIds",
-    subject: "observability surface",
-    fix: 'Use can.observe("logs").'
-  },
-  "observe:aiUsage": {
-    universeKey: "observableIds",
-    subject: "observability surface",
-    fix: "Use can.observe(agent.usage)."
-  },
-  "manage:connector": {
-    universeKey: "connectorIds",
-    subject: "connector",
-    fix: "Add it to 'connectors/' or pass it to createSixb({ connectors })."
-  },
-  "manage:aiUsage": {
-    universeKey: "manageableIds",
-    subject: "management surface",
-    fix: "Use can.manage(agent.usage)."
-  }
-};
-var GRANT_KIND_KEYS = Object.keys(GRANT_KINDS);
-var TARGETED_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter((kind) => kind !== "run:agent");
-function grantKindOf(grant) {
-  switch (grant.capability) {
-    case "access":
-      return "access:application";
-    case "view":
-      return `view:${grant.target}`;
-    case "edit":
-      return "edit:object";
-    case "append":
-      return "append:telemetry";
-    case "apply":
-      return "apply:action";
-    case "run":
-      return `run:${grant.target}`;
-    case "observe":
-      return `observe:${grant.target}`;
-    case "manage":
-      return `manage:${grant.target}`;
-  }
-}
-function emptyGrantSets() {
-  return {
-    "access:application": new Set,
-    "view:object": new Set,
-    "view:dataset": new Set,
-    "edit:object": new Set,
-    "append:telemetry": new Set,
-    "apply:action": new Set,
-    "run:workflow": new Set,
-    "run:sync": new Set,
-    "run:pipeline": new Set,
-    "run:agent": false,
-    "observe:logs": new Set,
-    "observe:aiUsage": new Set,
-    "manage:connector": new Set,
-    "manage:aiUsage": new Set
-  };
-}
-
-// src/execution/types.ts
-class RuntimeAuthorizationCapability {
-  #runtimeAuthorization = true;
-  constructor() {}
-  static create() {
-    const capability = new RuntimeAuthorizationCapability;
-    Object.freeze(capability);
-    return capability;
-  }
-  static is(value) {
-    return typeof value === "object" && value !== null && #runtimeAuthorization in value;
-  }
-}
-function createRuntimeAuthorizationCapability() {
-  return RuntimeAuthorizationCapability.create();
-}
-function isRuntimeAuthorizationCapability(value) {
-  return RuntimeAuthorizationCapability.is(value);
-}
-
-// src/execution/authorization.ts
-var registeredAuthorizations = new WeakMap;
-function createPrincipalRuntimeAuthorization(input) {
-  return createRegisteredPrincipalAuthorization(input);
-}
-function createAgentRuntimeAuthorization(input) {
-  assertNonEmpty(input.executionId, "Execution id");
-  if (input.actorId !== undefined)
-    assertNonEmpty(input.actorId, "Agent actor id");
-  assertNonEmpty(input.runId, "Agent run id");
-  const executionBinding = {
-    type: "agent",
-    executionId: input.executionId,
-    ...input.actorId === undefined ? {} : { actorId: input.actorId },
-    runId: input.runId
-  };
-  if (input.authority.type === "principal") {
-    return createRegisteredPrincipalAuthorization({
-      projectId: input.projectId,
-      context: input.authority.context,
-      ...input.authority.credential === undefined ? {} : { credential: input.authority.credential }
-    }, executionBinding);
-  }
-  return register({
-    type: "unrestricted",
-    projectId: input.projectId,
-    ref: Object.freeze({ type: "disabled" }),
-    executionBinding: Object.freeze(executionBinding)
-  });
-}
-function createRegisteredPrincipalAuthorization(input, executionBinding) {
-  const context = snapshotAuthorizationContext(input.context);
-  const credential = input.credential ? snapshotCredential(input.credential) : undefined;
-  assertCredentialMatchesContext(context, credential);
-  const ref = Object.freeze({
-    type: "principal",
-    principal: context.principal,
-    ...credential === undefined ? {} : { credential }
-  });
-  return register({
-    type: "principal",
-    projectId: input.projectId,
-    context,
-    ref,
-    ...executionBinding === undefined ? {} : { executionBinding: Object.freeze({ ...executionBinding }) }
-  });
-}
-function createDisabledRuntimeAuthorization(projectId) {
-  return register({ type: "unrestricted", projectId, ref: Object.freeze({ type: "disabled" }) });
-}
-function createTrustedPrimitiveRuntimeAuthorization(input) {
-  const primitive = snapshotTrustedPrimitive(input.primitive);
-  return register({
-    type: "unrestricted",
-    projectId: input.projectId,
-    ref: Object.freeze({ type: "trustedPrimitive", primitive })
-  });
-}
-function resolveRuntimeAuthorization(authorization) {
-  if (!isRuntimeAuthorizationCapability(authorization)) {
-    return { type: "denied" };
-  }
-  return registeredAuthorizations.get(authorization) ?? { type: "denied" };
-}
-function getAuthorizationRef(authorization) {
-  const resolved = resolveRuntimeAuthorization(authorization);
-  if (resolved.type === "denied") {
-    throw new Error("[Sixb] Runtime authorization is not a registered Core capability.");
-  }
-  return cloneAuthorizationRef(resolved.ref);
-}
-function assertExecutionScopeProject(projectId, scope) {
-  assertNonEmpty(projectId, "Project id");
-  if (scope.execution.projectId !== projectId) {
-    throw createSixbError("internal.unexpected", `[Sixb] Execution scope belongs to project '${scope.execution.projectId}', not '${projectId}'.`, {
-      details: {
-        executionId: scope.execution.id,
-        expectedProjectId: projectId,
-        scopeProjectId: scope.execution.projectId
-      }
-    });
-  }
-  const resolved = resolveRuntimeAuthorization(scope.authorization);
-  if (resolved.type === "denied") {
-    throw createSixbError("internal.unexpected", "[Sixb] Execution scope carries unregistered runtime authorization.", { details: { executionId: scope.execution.id, projectId } });
-  }
-  if (resolved.projectId !== projectId) {
-    throw createSixbError("internal.unexpected", `[Sixb] Execution authorization belongs to project '${resolved.projectId}', not '${projectId}'.`, {
-      details: {
-        authorizationProjectId: resolved.projectId,
-        executionId: scope.execution.id,
-        expectedProjectId: projectId
-      }
-    });
-  }
-}
-function resolveExecutionScopeAuthorization(projectId, scope) {
-  assertExecutionScopeProject(projectId, scope);
-  const resolved = resolveRuntimeAuthorization(scope.authorization);
-  if (resolved.type === "denied") {
-    throw createSixbError("internal.unexpected", "[Sixb] Execution scope carries unregistered runtime authorization.", { details: { executionId: scope.execution.id, projectId } });
-  }
-  const { execution } = scope;
-  switch (execution.executor.type) {
-    case "request":
-      if (execution.source.type !== "http" || execution.source.requestId !== execution.executor.requestId) {
-        throw invalidExecutionAuthority(execution.id, "request source does not match its executor");
-      }
-      if (resolved.ref.type === "principal") {
-        if (resolved.type !== "principal" || resolved.executionBinding !== undefined || !principalsEqual(execution.requestedBy, resolved.ref.principal)) {
-          throw invalidExecutionAuthority(execution.id, "request authority does not match its requested-by principal");
-        }
-        return resolved;
-      }
-      if (resolved.ref.type === "disabled" && execution.requestedBy === undefined)
-        return resolved;
-      throw invalidExecutionAuthority(execution.id, "request execution requires principal or explicitly disabled authority");
-    case "primitive":
-      if (resolved.ref.type !== "trustedPrimitive" || resolved.ref.primitive.kind !== execution.executor.kind || resolved.ref.primitive.id !== execution.executor.id || resolved.ref.primitive.runId !== execution.executor.runId) {
-        throw invalidExecutionAuthority(execution.id, "trusted primitive authority does not match its executor");
-      }
-      return resolved;
-    case "agent":
-      if (resolved.executionBinding?.type !== "agent" || resolved.executionBinding.executionId !== execution.id || resolved.executionBinding.actorId !== execution.executor.actorId || resolved.executionBinding.runId !== execution.executor.runId) {
-        throw invalidExecutionAuthority(execution.id, "agent authority does not match its execution binding");
-      }
-      if (resolved.type === "principal" && resolved.ref.type === "principal")
-        return resolved;
-      if (resolved.type === "unrestricted" && resolved.ref.type === "disabled")
-        return resolved;
-      throw invalidExecutionAuthority(execution.id, "agent authority must be principal or explicitly disabled");
-    case "kernel":
-      if (resolved.ref.type !== "kernel" || execution.requestedBy !== undefined || resolved.ref.operation.type !== execution.executor.operation.type || resolved.ref.operation.recoveryId !== execution.executor.operation.recoveryId) {
-        throw invalidExecutionAuthority(execution.id, "kernel authority does not match its executor");
-      }
-      return resolved;
-  }
-}
-function principalsEqual(left, right) {
-  return left?.type === right?.type && left?.id === right?.id;
-}
-function invalidExecutionAuthority(executionId, reason) {
-  return createSixbError("internal.unexpected", `[Sixb] Execution '${executionId}' is incompatible with its authority: ${reason}.`, { details: { executionId, reason } });
-}
-function register(input) {
-  assertNonEmpty(input.projectId, "Authorization project id");
-  const authorization = createRuntimeAuthorizationCapability();
-  registeredAuthorizations.set(authorization, Object.freeze(input));
-  return authorization;
-}
-function snapshotAuthorizationContext(context) {
-  const principal = snapshotAuthorizablePrincipal(context.principal);
-  const grants = emptyGrantSets();
-  grants["run:agent"] = context.grants["run:agent"];
-  for (const kind of TARGETED_GRANT_KIND_KEYS) {
-    grants[kind] = new Set(context.grants[kind]);
-  }
-  const frozenGrants = Object.freeze(grants);
-  return Object.freeze({
-    principal,
-    ...context.sessionId === undefined ? {} : { sessionId: context.sessionId },
-    groupIds: Object.freeze([...context.groupIds]),
-    roleIds: Object.freeze([...context.roleIds]),
-    grants: frozenGrants
-  });
-}
-function snapshotAuthorizablePrincipal(principal) {
-  if (principal.type !== "user" && principal.type !== "serviceAccount") {
-    throw new Error(`[Sixb] Principal type '${principal.type}' cannot hold runtime authorization.`);
-  }
-  assertNonEmpty(principal.id, "Authorization principal id");
-  return Object.freeze({ type: principal.type, id: principal.id });
-}
-function snapshotCredential(credential) {
-  assertNonEmpty(credential.id, "Authorization credential id");
-  if (credential.type !== "session" && credential.type !== "accessToken") {
-    const credentialType = credential.type;
-    throw new Error(`[Sixb] Unknown authorization credential type '${credentialType}'.`);
-  }
-  return Object.freeze({ type: credential.type, id: credential.id });
-}
-function assertCredentialMatchesContext(context, credential) {
-  if (credential?.type === "session") {
-    if (context.sessionId !== credential.id) {
-      throw new Error("[Sixb] Session credential id must match the authorization context session id.");
-    }
-    return;
-  }
-  if (context.sessionId !== undefined) {
-    throw new Error("[Sixb] Authorization context session requires a matching session credential.");
-  }
-}
-function snapshotTrustedPrimitive(primitive) {
-  if (!isTrustedPrimitiveKind(primitive.kind)) {
-    throw new Error(`[Sixb] Unknown trusted primitive kind '${primitive.kind}'.`);
-  }
-  assertNonEmpty(primitive.id, "Trusted primitive id");
-  assertNonEmpty(primitive.runId, "Trusted primitive run id");
-  return Object.freeze({ kind: primitive.kind, id: primitive.id, runId: primitive.runId });
-}
-function cloneAuthorizationRef(ref) {
-  switch (ref.type) {
-    case "principal":
-      return {
-        type: "principal",
-        principal: { ...ref.principal },
-        ...ref.credential === undefined ? {} : { credential: { ...ref.credential } }
-      };
-    case "trustedPrimitive":
-      return { type: "trustedPrimitive", primitive: { ...ref.primitive } };
-    case "kernel":
-      return { type: "kernel", operation: { ...ref.operation } };
-    case "disabled":
-      return { type: "disabled" };
-  }
-}
-function isTrustedPrimitiveKind(value) {
-  return value === "action" || value === "pipeline" || value === "projection" || value === "rule" || value === "sync" || value === "webhook" || value === "workflow";
-}
-function assertNonEmpty(value, label) {
-  if (!value.trim()) {
-    throw new Error(`[Sixb] ${label} must not be empty.`);
-  }
-}
-
-// src/authorization/errors.ts
-class AuthorizationError extends Error {
-  grantKey;
-  name = "AuthorizationError";
-  constructor(grantKey, message) {
-    super(message);
-    this.grantKey = grantKey;
-  }
-}
-
-// src/authorization/decision.ts
-function atomsFor(request) {
-  switch (request.kind) {
-    case "application.access":
-      return [{ kind: "access:application", id: request.audience }];
-    case "object.view":
-      return [{ kind: "view:object", id: request.objectTypeId }];
-    case "dataset.view":
-      return [{ kind: "view:dataset", id: request.datasetId }];
-    case "object.edit":
-      return [{ kind: "edit:object", id: request.objectTypeId }];
-    case "telemetry.append":
-      return [{ kind: "append:telemetry", id: request.objectTypeId }];
-    case "action.apply":
-      return [{ kind: "apply:action", id: request.actionId }];
-    case "workflow.run":
-      return [{ kind: "run:workflow", id: request.workflowId }];
-    case "sync.run":
-      return [{ kind: "run:sync", id: request.syncId }];
-    case "pipeline.run":
-      return [{ kind: "run:pipeline", id: request.pipelineId }];
-    case "agent.run":
-      return [{ kind: "run:agent" }];
-    case "logs.observe":
-      return [{ kind: "observe:logs", id: "logs" }];
-    case "aiUsage.observe":
-      return [{ kind: "observe:aiUsage", id: "aiUsage" }];
-    case "aiUsage.manage":
-      return [{ kind: "manage:aiUsage", id: "aiUsage" }];
-    case "connector.manage":
-      return [{ kind: "manage:connector", id: request.connectorId }];
-    case "object.query":
-      return request.touchedObjectTypeIds.map((id) => ({ kind: "view:object", id }));
-  }
-}
-function atomKey(atom) {
-  if (atom.kind === "run:agent")
-    return atom.kind;
-  if (atom.kind === "observe:logs" || atom.kind === "observe:aiUsage" || atom.kind === "manage:aiUsage") {
-    return atom.kind;
-  }
-  return `${atom.kind}:${atom.id}`;
-}
-function holds(grants, atom) {
-  if (atom.kind === "run:agent")
-    return grants[atom.kind];
-  return grants[atom.kind].has(atom.id);
-}
-function evaluate(authorization, request) {
-  const atoms = atomsFor(request);
-  const requirements = atoms.map(atomKey);
-  const missing = authorization ? atoms.filter((atom) => !holds(authorization.grants, atom)).map(atomKey) : [];
-  return { allowed: missing.length === 0, requirements, missing };
-}
-function isAllowed(authorization, request) {
-  return evaluate(authorization, request).allowed;
-}
-function assertAuthorized(runtime, request) {
-  const resolved = assertRuntimeAuthorizationBound(runtime);
-  const authorization = resolved.type === "principal" ? resolved.context : undefined;
-  const decision = evaluate(authorization, request);
-  if (decision.allowed) {
-    return;
-  }
-  throw new AuthorizationError(decision.missing[0] ?? request.kind, deniedMessage(authorization, request));
-}
-function assertRuntimeAuthorizationBound(runtime) {
-  const resolved = resolveRuntimeAuthorization(runtime.runtimeAuthorization);
-  if (resolved.type === "denied") {
-    throw new AuthorizationError("runtime:unbound", "[Sixb] Protected operations require a registered execution scope.");
-  }
-  return resolved;
-}
-function assertCanEdit(runtime, objectTypeId) {
-  assertAuthorized(runtime, { kind: "object.view", objectTypeId });
-  assertAuthorized(runtime, { kind: "object.edit", objectTypeId });
-}
-function assertCanAppendTelemetry(runtime, objectTypeId) {
-  assertAuthorized(runtime, { kind: "telemetry.append", objectTypeId });
-}
-function assertCanManageConnector(runtime, connectorId) {
-  assertAuthorized(runtime, { kind: "connector.manage", connectorId });
-}
-function assertPrivileged(runtime, operation) {
-  const resolved = assertRuntimeAuthorizationBound(runtime);
-  if (resolved.type === "unrestricted") {
-    return;
-  }
-  throw new AuthorizationError(`privileged:${operation}`, `[Sixb] Operation '${operation}' is not covered by scoped authorization grants.`);
-}
-function assertProviderAccess(runtime, execution, operation) {
-  const resolved = assertRuntimeAuthorizationBound(runtime);
-  if (resolved.type === "unrestricted") {
-    return;
-  }
-  const binding = resolved.executionBinding;
-  const executor = execution.executor;
-  if (binding?.type === "agent" && executor.type === "agent" && binding.executionId === execution.id && binding.actorId === executor.actorId && binding.runId === executor.runId) {
-    return;
-  }
-  throw new AuthorizationError(`privileged:${operation}`, `[Sixb] Operation '${operation}' is not covered by scoped authorization grants.`);
-}
-function deniedMessage(authorization, request) {
-  const principalId = authorization?.principal.id ?? "unknown";
-  switch (request.kind) {
-    case "application.access":
-      return `[Sixb] Principal '${principalId}' is not allowed to access application '${request.audience}'.`;
-    case "object.view":
-      return `[Sixb] Principal '${principalId}' is not allowed to view object type '${request.objectTypeId}'.`;
-    case "dataset.view":
-      return `[Sixb] Principal '${principalId}' is not allowed to view dataset '${request.datasetId}'.`;
-    case "object.edit":
-      return `[Sixb] Principal '${principalId}' is not allowed to write object type '${request.objectTypeId}'.`;
-    case "telemetry.append":
-      return `[Sixb] Principal '${principalId}' is not allowed to append telemetry for object type '${request.objectTypeId}'.`;
-    case "action.apply":
-      return `[Sixb] Principal '${principalId}' is not allowed to apply action '${request.actionId}'.`;
-    case "workflow.run":
-      return `[Sixb] Principal '${principalId}' is not allowed to run workflow '${request.workflowId}'.`;
-    case "sync.run":
-      return `[Sixb] Principal '${principalId}' is not allowed to run sync '${request.syncId}'.`;
-    case "pipeline.run":
-      return `[Sixb] Principal '${principalId}' is not allowed to run pipeline '${request.pipelineId}'.`;
-    case "agent.run":
-      return `[Sixb] Principal '${principalId}' is not allowed to run the project Agent.`;
-    case "logs.observe":
-      return `[Sixb] Principal '${principalId}' is not allowed to observe project logs.`;
-    case "aiUsage.observe":
-      return `[Sixb] Principal '${principalId}' is not allowed to observe project AI usage.`;
-    case "aiUsage.manage":
-      return `[Sixb] Principal '${principalId}' is not allowed to manage project AI usage limits.`;
-    case "connector.manage":
-      return `[Sixb] Principal '${principalId}' is not allowed to manage connector '${request.connectorId}'.`;
-    case "object.query": {
-      const blocked = request.touchedObjectTypeIds.find((objectTypeId) => !isAllowed(authorization, { kind: "object.view", objectTypeId }));
-      return `[Sixb] Principal '${principalId}' is not allowed to view object type '${blocked}'.`;
-    }
-  }
-}
-
-// src/authorization/application-access.ts
-function isApplicationAccessControlled(roles, audience) {
-  return roles.some((role) => role.grants["access:application"].has(audience));
-}
-function canAccessApplication(authorization, roles, audience) {
-  return !isApplicationAccessControlled(roles, audience) || isAllowed(authorization, { kind: "application.access", audience });
-}
-// src/authorization/event-visibility.ts
-function canViewEvent(authorization, event) {
-  if (!authorization) {
-    return true;
-  }
-  switch (event.topic) {
-    case "objects":
-    case "telemetry":
-      return isAllowed(authorization, {
-        kind: "object.view",
-        objectTypeId: event.payload.objectTypeId
-      });
-    case "links":
-      return isAllowed(authorization, {
-        kind: "object.view",
-        objectTypeId: event.payload.sourceTypeId
-      }) && isAllowed(authorization, { kind: "object.view", objectTypeId: event.payload.targetTypeId });
-    case "actions": {
-      if (!isAllowed(authorization, { kind: "action.apply", actionId: event.payload.actionId })) {
-        return false;
-      }
-      const subject = event.payload.subject;
-      return subject.kind === "object" ? isAllowed(authorization, { kind: "object.view", objectTypeId: subject.objectTypeId }) : true;
-    }
-    case "workflows":
-      return isAllowed(authorization, {
-        kind: "workflow.run",
-        workflowId: event.payload.workflowId
-      });
-    case "rules":
-      return isAllowed(authorization, {
-        kind: "object.view",
-        objectTypeId: event.payload.subject.objectTypeId
-      });
-    case "syncs":
-      return isAllowed(authorization, {
-        kind: "sync.run",
-        syncId: event.payload.syncId
-      });
-    case "pipelines":
-      return isAllowed(authorization, {
-        kind: "pipeline.run",
-        pipelineId: event.payload.pipelineId
-      });
-    case "schedules":
-      return true;
-    case "datasets":
-      return isAllowed(authorization, {
-        kind: "dataset.view",
-        datasetId: event.payload.datasetId
-      });
-    default:
-      return false;
-  }
-}
-// src/authorization/resolve.ts
-function resolveRoleGrants(role, universe) {
-  const grants = emptyGrantSets();
-  for (const grant of role.grants) {
-    if (grant.capability === "run" && grant.target === "agent") {
-      grants["run:agent"] = true;
-      continue;
-    }
-    const kind = grantKindOf(grant);
-    const spec = GRANT_KINDS[kind];
-    expandSelection(grant.selection, universe[spec.universeKey], grants[kind], spec.expandsSubtypes ? universe.getSubTypes : undefined);
-  }
-  return grants;
-}
-function expandSelection(selection, universe, into, expand) {
-  if (selection.all) {
-    const except = new Set(selection.except);
-    for (const id of universe) {
-      if (!except.has(id)) {
-        into.add(id);
-      }
-    }
-    return;
-  }
-  for (const id of selection.ids) {
-    into.add(id);
-    if (expand) {
-      for (const subTypeId of expand(id)) {
-        into.add(subTypeId);
-      }
-    }
-  }
-}
-function resolveAuthorizationContext(input) {
-  const memberGroupIds = new Set(input.groupIds);
-  const roleIds = [];
-  const grants = emptyGrantSets();
-  for (const role of input.roles) {
-    if (!role.grantedToGroupIds.some((groupId) => memberGroupIds.has(groupId))) {
-      continue;
-    }
-    roleIds.push(role.id);
-    if (role.grants["run:agent"]) {
-      grants["run:agent"] = true;
-    }
-    for (const kind of TARGETED_GRANT_KIND_KEYS) {
-      for (const id of role.grants[kind]) {
-        grants[kind].add(id);
-      }
-    }
-  }
-  return {
-    principal: input.principal,
-    ...input.sessionId !== undefined ? { sessionId: input.sessionId } : {},
-    groupIds: input.groupIds,
-    roleIds,
-    grants
-  };
-}
-// src/projections/errors.ts
-class ProjectionValidationError extends Error {
-  name = "ProjectionValidationError";
-}
-
-// src/projections/ownership.ts
-function computeProjectionOwnership(projection, ontology) {
-  if (projection._tag === "ObjectProjectionDefinition") {
-    const primaryId = ontology.getPrimaryPropertyId(projection.objectTypeId);
-    return freezeOwnership({
-      objects: [
-        {
-          objectTypeId: projection.objectTypeId,
-          existence: true,
-          propertyIds: Object.keys(projection.properties).filter((propertyId) => propertyId !== primaryId).sort(compareStrings)
-        }
-      ],
-      links: Object.keys(projection.links).sort(compareStrings).map((linkId) => ({ sourceObjectTypeId: projection.objectTypeId, linkId })),
-      telemetry: []
-    });
-  }
-  if (projection._tag === "LinkProjectionDefinition") {
-    return freezeOwnership({
-      objects: [],
-      links: [
-        {
-          sourceObjectTypeId: projection.sourceObjectTypeId,
-          linkId: projection.linkId
-        }
-      ],
-      telemetry: []
-    });
-  }
-  return freezeOwnership({
-    objects: [],
-    links: [],
-    telemetry: Object.keys(projection.properties).sort(compareStrings).map((propertyId) => ({
-      objectTypeId: projection.objectTypeId,
-      propertyId
-    }))
-  });
-}
-function validateProjectionOwnership(projections) {
-  const existenceOwners = new Map;
-  const propertyOwners = new Map;
-  const linkOwners = new Map;
-  const telemetryOwners = new Map;
-  for (const { definition, ownership } of projections) {
-    for (const object of ownership.objects) {
-      if (object.existence) {
-        registerOwner(existenceOwners, object.objectTypeId, definition.id, `object type '${object.objectTypeId}' existence`);
-      }
-      for (const propertyId of object.propertyIds) {
-        registerOwner(propertyOwners, JSON.stringify([object.objectTypeId, propertyId]), definition.id, `property '${object.objectTypeId}.${propertyId}'`);
-      }
-    }
-    for (const link of ownership.links) {
-      registerOwner(linkOwners, JSON.stringify([link.sourceObjectTypeId, link.linkId]), definition.id, `link scope '${link.sourceObjectTypeId}.${link.linkId}'`);
-    }
-    for (const telemetry of ownership.telemetry) {
-      registerOwner(telemetryOwners, JSON.stringify([telemetry.objectTypeId, telemetry.propertyId]), definition.id, `telemetry source '${telemetry.objectTypeId}.${telemetry.propertyId}'`);
-    }
-  }
-}
-function registerOwner(owners, key, projectionId, description) {
-  const existing = owners.get(key);
-  if (existing !== undefined) {
-    throw new ProjectionValidationError(`[Sixb] Projection '${projectionId}' overlaps ${description} owned by projection '${existing}'.`);
-  }
-  owners.set(key, projectionId);
-}
-function freezeOwnership(ownership) {
-  return Object.freeze({
-    objects: Object.freeze(ownership.objects.map((object) => Object.freeze({ ...object, propertyIds: Object.freeze([...object.propertyIds]) }))),
-    links: Object.freeze(ownership.links.map((link) => Object.freeze({ ...link }))),
-    telemetry: Object.freeze(ownership.telemetry.map((telemetry) => Object.freeze({ ...telemetry })))
-  });
-}
-
-// src/projections/validation.ts
-function validatePropertyMapping(objectType, mapping) {
-  const propertyIds = new Set(objectType.properties.map((p) => p.id));
-  const mappingKeys = Object.keys(mapping);
-  for (const key of mappingKeys) {
-    if (!propertyIds.has(key)) {
-      const available = [...propertyIds].sort().join(", ");
-      throw new ProjectionValidationError(`Property '${key}' does not exist on object type '${objectType.id}'. ` + `Available properties: ${available}`);
-    }
-  }
-  const primaryProperties = objectType.properties.filter((p) => p.primary === true);
-  if (primaryProperties.length !== 1) {
-    throw new ProjectionValidationError(`Object type '${objectType.id}' must have exactly one primary property, ` + `found ${primaryProperties.length}.`);
-  }
-  const primaryId = primaryProperties[0].id;
-  if (!(primaryId in mapping)) {
-    throw new ProjectionValidationError(`Primary property '${primaryId}' of object type '${objectType.id}' ` + `must be included in the property mapping.`);
-  }
-}
-function validateAndLowerLinkMapping(objectType, linkMapping, propertyMapping) {
-  const linkIds = new Set(objectType.links.map((l) => l.id));
-  const linksById = new Map(objectType.links.map((l) => [l.id, l]));
-  const propertyIds = new Set(objectType.properties.map((p) => p.id));
-  for (const [key, descriptor] of Object.entries(linkMapping)) {
-    if (!linkIds.has(key)) {
-      const available = [...linkIds].sort().join(", ");
-      throw new ProjectionValidationError(`Link '${key}' does not exist on object type '${objectType.id}'. ` + `Available links: ${available}`);
-    }
-    if (key !== descriptor.linkId) {
-      throw new ProjectionValidationError(`Link mapping key '${key}' does not match descriptor linkId '${descriptor.linkId}'.`);
-    }
-    const link = linksById.get(key);
-    if (Array.isArray(link.targetObjectTypeId)) {
-      throw new ProjectionValidationError(`Link '${key}' on object type '${objectType.id}' has a polymorphic target. ` + `FK projection of polymorphic links is not yet supported.`);
-    }
-    if (link.targetObjectTypeId === "*") {
-      throw new ProjectionValidationError(`Link '${key}' on object type '${objectType.id}' has a wildcard target. ` + `FK projection of wildcard links is not supported.`);
-    }
-    const sourcePropertyId = descriptor.sourcePropertyId;
-    const sourceField = descriptor.sourceField;
-    if (sourcePropertyId && sourceField) {
-      throw new ProjectionValidationError(`FK link '${key}' must use either sourceProperty or sourceField, not both.`);
-    }
-    if (!sourcePropertyId && !sourceField) {
-      throw new ProjectionValidationError(`FK link '${key}' must declare sourceProperty or sourceField.`);
-    }
-    if (!sourcePropertyId) {
-      continue;
-    }
-    if (!propertyIds.has(sourcePropertyId)) {
-      const available = [...propertyIds].sort().join(", ");
-      throw new ProjectionValidationError(`Source property '${sourcePropertyId}' does not exist on ` + `object type '${objectType.id}'. Available properties: ${available}`);
-    }
-    if (!(sourcePropertyId in propertyMapping)) {
-      throw new ProjectionValidationError(`Source property '${sourcePropertyId}' for link '${key}' ` + `must be included in the property mapping.`);
-    }
-  }
-  return Object.fromEntries(Object.entries(linkMapping).map(([linkId, descriptor]) => [
-    linkId,
-    {
-      linkId: descriptor.linkId,
-      ...descriptor.sourcePropertyId !== undefined ? { sourcePropertyId: descriptor.sourcePropertyId } : {},
-      ...descriptor.sourceField !== undefined ? { sourceField: descriptor.sourceField } : {},
-      targetObjectTypeId: descriptor.targetObjectTypeId
-    }
-  ]));
-}
-function validateLinkProjectionTarget(linkToken) {
-  if (Array.isArray(linkToken.targetObjectTypeId)) {
-    throw new ProjectionValidationError(`Link '${linkToken.id}' has a polymorphic target. ` + `Link projection of polymorphic links is not yet supported.`);
-  }
-  if (linkToken.targetObjectTypeId === "*") {
-    throw new ProjectionValidationError(`Link '${linkToken.id}' has a wildcard target. ` + `Link projection of wildcard links is not supported.`);
-  }
-}
-function validateTelemetryProjectionFieldMapping(projection, objectType, datasetColumnNames, valueTypesById, prefix) {
-  const mappedProperties = Object.entries(projection.properties);
-  if (mappedProperties.length === 0) {
-    throw new ProjectionValidationError(`${prefix}: must map at least one telemetry property`);
-  }
-  const mappedFields = [
-    ["objectId", projection.objectIdField],
-    ["at", projection.atField]
-  ];
-  for (const [fieldRole, columnName] of mappedFields) {
-    if (!datasetColumnNames.has(columnName)) {
-      throw new ProjectionValidationError(`${prefix}: ${fieldRole} field "${columnName}" references unknown dataset column ` + `on dataset "${projection.datasetId}"`);
-    }
-  }
-  const propertiesById = new Map(objectType.properties.map((property) => [property.id, property]));
-  const resolvedProperties = new Map;
-  for (const [propertyId, mapping] of mappedProperties) {
-    const property = propertiesById.get(propertyId);
-    if (!property) {
-      throw new ProjectionValidationError(`${prefix}: unknown property "${propertyId}" on type "${projection.objectTypeId}"`);
-    }
-    if (property.mode !== "telemetry") {
-      throw new ProjectionValidationError(`${prefix}: property "${propertyId}" on type "${projection.objectTypeId}" must be telemetry-enabled`);
-    }
-    for (const [fieldRole, columnName] of [
-      ["value", mapping.valueField],
-      ...mapping.unitField !== undefined ? [["unit", mapping.unitField]] : []
-    ]) {
-      if (!datasetColumnNames.has(columnName)) {
-        throw new ProjectionValidationError(`${prefix}: property "${propertyId}" ${fieldRole} field "${columnName}" references ` + `unknown dataset column on dataset "${projection.datasetId}"`);
-      }
-    }
-    const semanticType = resolveSemanticType(property, valueTypesById);
-    if (semanticType !== undefined && mapping.unitField === undefined) {
-      throw new ProjectionValidationError(`${prefix}: property "${propertyId}" requires a unit field because it uses semantic type "${semanticType}"`);
-    }
-    if (semanticType === undefined && mapping.unitField !== undefined) {
-      throw new ProjectionValidationError(`${prefix}: property "${propertyId}" cannot map a unit field because it has no semantic type`);
-    }
-    resolvedProperties.set(propertyId, property);
-  }
-  return resolvedProperties;
-}
-function validateProjectionsAtStartup(projections, ontology, datasetsById) {
-  const { objectProjections, linkProjections, telemetryProjections } = projections;
-  const objectTypesById = ontology.getObjectTypesById();
-  const primaryByTypeId = ontology.getPrimaryByTypeId();
-  const validatedObjectProjections = [];
-  const validatedLinkProjections = [];
-  const validatedTelemetryProjections = [];
-  validateMaterializationOntologyConstraints(ontology);
-  for (const projection of objectProjections) {
-    const prefix = `Projection "${projection.id}"`;
-    const dataset = datasetsById.get(projection.datasetId);
-    if (!dataset) {
-      throw new ProjectionValidationError(`${prefix}: unknown dataset "${projection.datasetId}". ` + `Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
-    }
-    const objectType = objectTypesById.get(projection.objectTypeId);
-    if (!objectType) {
-      throw new ProjectionValidationError(`${prefix}: unknown object type "${projection.objectTypeId}"`);
-    }
-    const datasetColumnNames = new Set(dataset.schema.columns.map((column) => column.name));
-    const conflictResolution = projection.conflictResolution ?? { strategy: "editsWin" };
-    if (conflictResolution.strategy === "mostRecent") {
-      const sourceTimestamp = dataset.schema.columns.find((column) => column.name === conflictResolution.sourceTimestamp);
-      if (!sourceTimestamp) {
-        throw new ProjectionValidationError(`${prefix}: source timestamp "${conflictResolution.sourceTimestamp}" references unknown ` + `dataset column on dataset "${projection.datasetId}"`);
-      }
-      if (sourceTimestamp.type !== "timestamp") {
-        throw new ProjectionValidationError(`${prefix}: source timestamp "${conflictResolution.sourceTimestamp}" must reference a ` + `timestamp dataset column`);
-      }
-      if (sourceTimestamp.nullable === true) {
-        throw new ProjectionValidationError(`${prefix}: source timestamp "${conflictResolution.sourceTimestamp}" must reference a ` + `non-null timestamp dataset column`);
-      }
-    }
-    const propertyIds = new Set(objectType.properties.map((p) => p.id));
-    for (const [propId, columnName] of Object.entries(projection.properties)) {
-      if (!propertyIds.has(propId)) {
-        throw new ProjectionValidationError(`${prefix}: unknown property "${propId}" on type "${projection.objectTypeId}"`);
-      }
-      if (!datasetColumnNames.has(columnName)) {
-        throw new ProjectionValidationError(`${prefix}: property "${propId}" references unknown dataset column "${columnName}" ` + `on dataset "${projection.datasetId}"`);
-      }
-      const property = objectType.properties.find((candidate) => candidate.id === propId);
-      if (property?.mode === "telemetry") {
-        throw new ProjectionValidationError(`[Sixb] ${prefix}: source mappings cannot own telemetry property "${projection.objectTypeId}.${propId}"`);
-      }
-    }
-    const primaryId = primaryByTypeId.get(projection.objectTypeId);
-    if (!(primaryId in projection.properties)) {
-      throw new ProjectionValidationError(`${prefix}: primary property "${primaryId}" must be in property mapping`);
-    }
-    const linkIds = new Set(objectType.links.map((l) => l.id));
-    for (const [linkId, fk] of Object.entries(projection.links)) {
-      if (!linkIds.has(linkId)) {
-        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" references unknown link on type "${projection.objectTypeId}"`);
-      }
-      if (fk.linkId !== linkId) {
-        throw new ProjectionValidationError(`${prefix}: FK link mapping key "${linkId}" does not match descriptor linkId "${fk.linkId}"`);
-      }
-      const sourcePropertyId = fk.sourcePropertyId;
-      const sourceField = fk.sourceField;
-      if (sourcePropertyId && sourceField) {
-        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" must use either sourcePropertyId or sourceField, not both`);
-      }
-      if (!sourcePropertyId && !sourceField) {
-        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" must declare sourcePropertyId or sourceField`);
-      }
-      if (sourcePropertyId && !propertyIds.has(sourcePropertyId)) {
-        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" source property "${sourcePropertyId}" does not exist on type "${projection.objectTypeId}"`);
-      }
-      if (sourcePropertyId && !(sourcePropertyId in projection.properties)) {
-        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" source property "${sourcePropertyId}" must be in property mapping`);
-      }
-      if (sourceField && !datasetColumnNames.has(sourceField)) {
-        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" source field "${sourceField}" references unknown dataset column on dataset "${projection.datasetId}"`);
-      }
-      if (!objectTypesById.has(fk.targetObjectTypeId)) {
-        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" target type "${fk.targetObjectTypeId}" is unknown`);
-      }
-      if (!primaryByTypeId.has(fk.targetObjectTypeId)) {
-        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" target type "${fk.targetObjectTypeId}" has no primary property`);
-      }
-      const link = objectType.links.find((candidate) => candidate.id === linkId);
-      if (!ontology.isValidLinkTarget(link.targetObjectTypeId, fk.targetObjectTypeId)) {
-        throw new ProjectionValidationError(`${prefix}: FK link "${linkId}" target type "${fk.targetObjectTypeId}" is not compatible with its declared target`);
-      }
-    }
-    validatedObjectProjections.push({
-      definition: projection,
-      dataset,
-      ownership: computeProjectionOwnership(projection, ontology)
-    });
-  }
-  for (const projection of linkProjections) {
-    const prefix = `Projection "${projection.id}"`;
-    const dataset = datasetsById.get(projection.datasetId);
-    if (!dataset) {
-      throw new ProjectionValidationError(`${prefix}: unknown dataset "${projection.datasetId}". ` + `Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
-    }
-    if (!objectTypesById.has(projection.sourceObjectTypeId)) {
-      throw new ProjectionValidationError(`${prefix}: unknown source type "${projection.sourceObjectTypeId}"`);
-    }
-    if (!objectTypesById.has(projection.targetObjectTypeId)) {
-      throw new ProjectionValidationError(`${prefix}: unknown target type "${projection.targetObjectTypeId}"`);
-    }
-    const sourceType = objectTypesById.get(projection.sourceObjectTypeId);
-    const link = sourceType.links.find((candidate) => candidate.id === projection.linkId);
-    if (!link) {
-      throw new ProjectionValidationError(`${prefix}: link "${projection.linkId}" does not exist on source type "${projection.sourceObjectTypeId}"`);
-    }
-    if (!ontology.isValidLinkTarget(link.targetObjectTypeId, projection.targetObjectTypeId)) {
-      throw new ProjectionValidationError(`${prefix}: target type "${projection.targetObjectTypeId}" is not compatible with link "${projection.linkId}"`);
-    }
-    const datasetColumnNames = new Set(dataset.schema.columns.map((column) => column.name));
-    if (!datasetColumnNames.has(projection.sourceField)) {
-      throw new ProjectionValidationError(`${prefix}: source field "${projection.sourceField}" references unknown dataset column ` + `on dataset "${projection.datasetId}"`);
-    }
-    if (!datasetColumnNames.has(projection.targetField)) {
-      throw new ProjectionValidationError(`${prefix}: target field "${projection.targetField}" references unknown dataset column ` + `on dataset "${projection.datasetId}"`);
-    }
-    if (!primaryByTypeId.has(projection.sourceObjectTypeId)) {
-      throw new ProjectionValidationError(`${prefix}: source type "${projection.sourceObjectTypeId}" has no primary property`);
-    }
-    if (!primaryByTypeId.has(projection.targetObjectTypeId)) {
-      throw new ProjectionValidationError(`${prefix}: target type "${projection.targetObjectTypeId}" has no primary property`);
-    }
-    validatedLinkProjections.push({
-      definition: projection,
-      dataset,
-      ownership: computeProjectionOwnership(projection, ontology)
-    });
-  }
-  for (const projection of telemetryProjections) {
-    const prefix = `Projection "${projection.id}"`;
-    const dataset = datasetsById.get(projection.datasetId);
-    if (!dataset) {
-      throw new ProjectionValidationError(`${prefix}: unknown dataset "${projection.datasetId}". ` + `Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
-    }
-    const objectType = objectTypesById.get(projection.objectTypeId);
-    if (!objectType) {
-      throw new ProjectionValidationError(`${prefix}: unknown object type "${projection.objectTypeId}"`);
-    }
-    const datasetColumnNames = new Set(dataset.schema.columns.map((column) => column.name));
-    validateTelemetryProjectionFieldMapping(projection, objectType, datasetColumnNames, ontology.getValueTypesById(), prefix);
-    validatedTelemetryProjections.push({
-      definition: projection,
-      dataset,
-      ownership: computeProjectionOwnership(projection, ontology)
-    });
-  }
-  const validatedProjections = [
-    ...validatedObjectProjections,
-    ...validatedLinkProjections,
-    ...validatedTelemetryProjections
-  ];
-  validateProjectionOwnership(validatedProjections);
-  return {
-    objectProjections: validatedObjectProjections,
-    linkProjections: validatedLinkProjections,
-    telemetryProjections: validatedTelemetryProjections
-  };
-}
-function validateMaterializationOntologyConstraints(ontology) {
-  for (const objectType of ontology.getObjectTypesById().values()) {
-    for (const property of objectType.properties) {
-      if (property.mode === "telemetry" && property.required === true) {
-        throw new ProjectionValidationError(`[Sixb] Telemetry property '${objectType.id}.${property.id}' cannot be required.`);
-      }
-    }
-    for (const link of objectType.links) {
-      for (const property of link.properties ?? []) {
-        if (property.mode === "telemetry") {
-          throw new ProjectionValidationError(`[Sixb] Link property '${objectType.id}.${link.id}.${property.id}' cannot use telemetry mode.`);
-        }
-      }
-    }
-  }
-}
-
-// src/projections/builders.ts
-function assertNonEmpty2(value, field) {
-  if (!value.trim()) {
-    throw new ProjectionValidationError(`Projection ${field} must not be empty.`);
-  }
-}
-function assertProjectionDataset(dataset) {
-  if (!dataset || dataset.kind !== "dataset" || typeof dataset.id !== "string") {
-    throw new ProjectionValidationError("Projection dataset must be a dataset definition.");
-  }
-  assertNonEmpty2(dataset.id, "dataset id");
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function lowerForeignKeyMapping(mapping) {
-  const lowered = {};
-  for (const [linkId, descriptor] of Object.entries(mapping)) {
-    if (!descriptor)
-      continue;
-    lowered[linkId] = isForeignKeyDescriptor(descriptor) ? descriptor : fromForeignKey(descriptor);
-  }
-  return lowered;
-}
-function isForeignKeyDescriptor(value) {
-  return isRecord(value) && typeof value.linkId === "string";
-}
-function defineProjection(id, target) {
-  if ("link" in target)
-    return buildLinkProjection(id, target);
-  if ("property" in target)
-    return buildTelemetryProjection(id, target);
-  return buildObjectTypeProjection(id, target);
-}
-function buildObjectTypeProjection(id, objectType) {
-  assertNonEmpty2(id, "id");
-  return {
-    fromDataset(dataset) {
-      assertProjectionDataset(dataset);
-      const datasetId = dataset.id;
-      return {
-        properties(mapping) {
-          const propertyMapping = mapping;
-          validatePropertyMapping(objectType, propertyMapping);
-          return objectProjectionBuilder({
-            id,
-            objectType,
-            datasetId,
-            propertyMapping,
-            links: {},
-            conflictResolution: { strategy: "editsWin" }
-          });
-        },
-        points(mapping) {
-          const pointMapping = lowerTelemetryPropertiesPointMapping(objectType, mapping);
-          return {
-            _tag: "TelemetryProjectionDefinition",
-            id,
-            objectTypeId: objectType.id,
-            datasetId,
-            objectIdField: pointMapping.objectId,
-            atField: pointMapping.at,
-            properties: pointMapping.properties
-          };
-        }
-      };
-    }
-  };
-}
-function objectProjectionBuilder(input) {
-  const definition = {
-    _tag: "ObjectProjectionDefinition",
-    id: input.id,
-    objectTypeId: input.objectType.id,
-    datasetId: input.datasetId,
-    properties: { ...input.propertyMapping },
-    links: { ...input.links },
-    conflictResolution: { ...input.conflictResolution }
-  };
-  return Object.assign(definition, {
-    withLinks(linkMapping) {
-      const loweredLinkMapping = lowerForeignKeyMapping(linkMapping);
-      const validatedLinks = validateAndLowerLinkMapping(input.objectType, loweredLinkMapping, input.propertyMapping);
-      return objectProjectionBuilder({ ...input, links: validatedLinks });
-    },
-    resolveConflicts(resolution) {
-      validateConflictResolution(resolution);
-      return objectProjectionBuilder({
-        ...input,
-        conflictResolution: resolution
-      });
-    }
-  });
-}
-function validateConflictResolution(resolution) {
-  if (resolution.strategy === "editsWin")
-    return;
-  assertNonEmpty2(resolution.sourceTimestamp, "source timestamp field");
-}
-function buildTelemetryProjection(id, propertyToken) {
-  assertNonEmpty2(id, "id");
-  validateTelemetryProjectionProperty(propertyToken);
-  return {
-    fromDataset(dataset) {
-      assertProjectionDataset(dataset);
-      const datasetId = dataset.id;
-      return {
-        points(mapping) {
-          const pointMapping = lowerTelemetryPointMapping(mapping);
-          return {
-            _tag: "TelemetryProjectionDefinition",
-            id,
-            objectTypeId: propertyToken.objectTypeId,
-            datasetId,
-            objectIdField: pointMapping.objectId,
-            atField: pointMapping.at,
-            properties: {
-              [propertyToken.id]: {
-                valueField: pointMapping.value,
-                ...pointMapping.unit !== undefined ? { unitField: pointMapping.unit } : {}
-              }
-            }
-          };
-        }
-      };
-    }
-  };
-}
-function validateTelemetryProjectionProperty(propertyToken) {
-  if (propertyToken.property.mode !== "telemetry") {
-    throw new ProjectionValidationError(`Projection property '${propertyToken.objectTypeId}.${propertyToken.id}' must be telemetry-enabled.`);
-  }
-}
-function lowerTelemetryPointMapping(mapping) {
-  const allowedKeys = new Set(["objectId", "at", "value", "unit"]);
-  for (const key of Object.keys(mapping)) {
-    if (!allowedKeys.has(key)) {
-      throw new ProjectionValidationError(`Telemetry projection point mapping contains unknown key '${key}'.`);
-    }
-  }
-  if (mapping.objectId === undefined) {
-    throw new ProjectionValidationError("Telemetry projection point mapping requires objectId.");
-  }
-  if (mapping.at === undefined) {
-    throw new ProjectionValidationError("Telemetry projection point mapping requires at.");
-  }
-  if (mapping.value === undefined) {
-    throw new ProjectionValidationError("Telemetry projection point mapping requires value.");
-  }
-  assertNonEmpty2(mapping.objectId, "objectId field");
-  assertNonEmpty2(mapping.at, "at field");
-  assertNonEmpty2(mapping.value, "value field");
-  if (mapping.unit !== undefined) {
-    assertNonEmpty2(mapping.unit, "unit field");
-  }
-  return {
-    objectId: mapping.objectId,
-    at: mapping.at,
-    value: mapping.value,
-    ...mapping.unit !== undefined ? { unit: mapping.unit } : {}
-  };
-}
-function lowerTelemetryPropertiesPointMapping(objectType, mapping) {
-  const allowedKeys = new Set(["objectId", "at", "properties"]);
-  for (const key of Object.keys(mapping)) {
-    if (!allowedKeys.has(key)) {
-      throw new ProjectionValidationError(`Telemetry projection point mapping contains unknown key '${key}'.`);
-    }
-  }
-  if (mapping.objectId === undefined) {
-    throw new ProjectionValidationError("Telemetry projection point mapping requires objectId.");
-  }
-  if (mapping.at === undefined) {
-    throw new ProjectionValidationError("Telemetry projection point mapping requires at.");
-  }
-  if (mapping.properties === undefined) {
-    throw new ProjectionValidationError("Telemetry projection point mapping requires properties.");
-  }
-  if (!isRecord(mapping.properties)) {
-    throw new ProjectionValidationError("Telemetry projection point mapping properties must be an object.");
-  }
-  assertNonEmpty2(mapping.objectId, "objectId field");
-  assertNonEmpty2(mapping.at, "at field");
-  const propertyEntries = Object.entries(mapping.properties);
-  if (propertyEntries.length === 0) {
-    throw new ProjectionValidationError("Telemetry projection point mapping requires at least one property.");
-  }
-  const propertiesById = new Map(objectType.properties.map((property) => [property.id, property]));
-  const properties = {};
-  for (const [propertyId, input] of propertyEntries) {
-    const property = propertiesById.get(propertyId);
-    if (!property) {
-      throw new ProjectionValidationError(`Property '${propertyId}' does not exist on object type '${objectType.id}'.`);
-    }
-    if (property.mode !== "telemetry") {
-      throw new ProjectionValidationError(`Projection property '${objectType.id}.${propertyId}' must be telemetry-enabled.`);
-    }
-    properties[propertyId] = lowerTelemetryPropertyMapping(propertyId, input);
-  }
-  return { objectId: mapping.objectId, at: mapping.at, properties };
-}
-function lowerTelemetryPropertyMapping(propertyId, input) {
-  if (typeof input === "string") {
-    assertNonEmpty2(input, `property '${propertyId}' value field`);
-    return { valueField: input };
-  }
-  if (!isRecord(input)) {
-    throw new ProjectionValidationError(`Telemetry projection property '${propertyId}' must map a value column or value/unit columns.`);
-  }
-  const allowedKeys = new Set(["value", "unit"]);
-  for (const key of Object.keys(input)) {
-    if (!allowedKeys.has(key)) {
-      throw new ProjectionValidationError(`Telemetry projection property '${propertyId}' contains unknown key '${key}'.`);
-    }
-  }
-  if (typeof input.value !== "string") {
-    throw new ProjectionValidationError(`Telemetry projection property '${propertyId}' requires a value field.`);
-  }
-  if (typeof input.unit !== "string") {
-    throw new ProjectionValidationError(`Telemetry projection property '${propertyId}' requires a unit field.`);
-  }
-  assertNonEmpty2(input.value, `property '${propertyId}' value field`);
-  assertNonEmpty2(input.unit, `property '${propertyId}' unit field`);
-  return { valueField: input.value, unitField: input.unit };
-}
-function fromForeignKey(input) {
-  validateLinkProjectionTarget(input.link);
-  if (input.sourceProperty) {
-    return {
-      linkId: input.link.id,
-      sourcePropertyId: input.sourceProperty.id,
-      targetObjectTypeId: input.target.id
-    };
-  }
-  if (input.sourceField === undefined) {
-    throw new ProjectionValidationError("Foreign key sourceField is required.");
-  }
-  assertNonEmpty2(input.sourceField, "source field");
-  return {
-    linkId: input.link.id,
-    sourceField: input.sourceField,
-    targetObjectTypeId: input.target.id
-  };
-}
-function buildLinkProjection(id, linkToken) {
-  assertNonEmpty2(id, "id");
-  validateLinkProjectionTarget(linkToken);
-  return {
-    fromDataset(dataset) {
-      assertProjectionDataset(dataset);
-      const datasetId = dataset.id;
-      return {
-        sourceField(columnName) {
-          assertNonEmpty2(columnName, "source field");
-          return {
-            targetField(targetColumnName) {
-              assertNonEmpty2(targetColumnName, "target field");
-              return {
-                _tag: "LinkProjectionDefinition",
-                id,
-                linkId: linkToken.id,
-                sourceObjectTypeId: linkToken.objectTypeId,
-                targetObjectTypeId: linkToken.targetObjectTypeId,
-                datasetId,
-                sourceField: columnName,
-                targetField: targetColumnName
-              };
-            }
-          };
-        }
-      };
-    }
-  };
-}
-function isObjectProjectionDefinition(value) {
-  if (!isRecord(value))
-    return false;
-  return value._tag === "ObjectProjectionDefinition" && typeof value.id === "string" && typeof value.objectTypeId === "string" && typeof value.datasetId === "string" && isRecord(value.properties) && isRecord(value.links) && isSourceEditConflictResolution(value.conflictResolution);
-}
-function isSourceEditConflictResolution(value) {
-  if (value === undefined)
-    return true;
-  if (!isRecord(value) || typeof value.strategy !== "string")
-    return false;
-  if (value.strategy === "editsWin")
-    return value.sourceTimestamp === undefined;
-  return value.strategy === "mostRecent" && typeof value.sourceTimestamp === "string";
-}
-function isLinkProjectionDefinition(value) {
-  if (!isRecord(value))
-    return false;
-  return value._tag === "LinkProjectionDefinition" && typeof value.id === "string" && typeof value.linkId === "string" && typeof value.sourceObjectTypeId === "string" && typeof value.targetObjectTypeId === "string" && typeof value.datasetId === "string" && typeof value.sourceField === "string" && typeof value.targetField === "string";
-}
-function isTelemetryProjectionDefinition(value) {
-  if (!isRecord(value))
-    return false;
-  return value._tag === "TelemetryProjectionDefinition" && typeof value.id === "string" && typeof value.objectTypeId === "string" && typeof value.datasetId === "string" && typeof value.objectIdField === "string" && typeof value.atField === "string" && isTelemetryProjectionProperties(value.properties);
-}
-function isTelemetryProjectionProperties(value) {
-  if (!isRecord(value) || Object.keys(value).length === 0)
-    return false;
-  return Object.values(value).every((mapping) => isRecord(mapping) && typeof mapping.valueField === "string" && (mapping.unitField === undefined || typeof mapping.unitField === "string"));
-}
-function isProjectionDefinition(value) {
-  return isObjectProjectionDefinition(value) || isLinkProjectionDefinition(value) || isTelemetryProjectionDefinition(value);
-}
-function projectionTargetOf(projection) {
-  return projection._tag === "LinkProjectionDefinition" ? {
-    sourceObjectTypeId: projection.sourceObjectTypeId,
-    targetObjectTypeId: projection.targetObjectTypeId
-  } : { objectTypeId: projection.objectTypeId };
-}
-
-// src/authorization/run-visibility.ts
-function canViewActionRun(authorization, run) {
-  if (!authorization) {
-    return true;
-  }
-  if (!isAllowed(authorization, { kind: "action.apply", actionId: run.actionId })) {
-    return false;
-  }
-  return run.subject.kind !== "object" ? true : isAllowed(authorization, {
-    kind: "object.view",
-    objectTypeId: run.subject.objectTypeId
-  });
-}
-function canViewWorkflowRun(authorization, run) {
-  return !authorization || isAllowed(authorization, { kind: "workflow.run", workflowId: run.workflowId });
-}
-function canViewWorkflowIntervention(authorization, intervention) {
-  return !authorization || isAllowed(authorization, { kind: "workflow.run", workflowId: intervention.workflowId });
-}
-function canViewPipelineRun(authorization, run) {
-  return !authorization || isAllowed(authorization, { kind: "pipeline.run", pipelineId: run.pipelineId });
-}
-function canViewProjectionRun(authorization, target) {
-  if (!authorization)
-    return true;
-  const canView = (objectTypeId) => isAllowed(authorization, { kind: "object.view", objectTypeId });
-  if ("sourceObjectTypeId" in target) {
-    return canView(target.sourceObjectTypeId) && canView(target.targetObjectTypeId);
-  }
-  return canView(target.objectTypeId);
-}
-function canViewProjection(authorization, projection) {
-  return canViewProjectionRun(authorization, projectionTargetOf(projection));
-}
-// src/authorization/types.ts
-function emptyGrantIndex() {
-  return emptyGrantSets();
-}
-export { ProjectionValidationError, computeProjectionOwnership, validateProjectionOwnership, validateTelemetryProjectionFieldMapping, validateProjectionsAtStartup, defineProjection, fromForeignKey, isObjectProjectionDefinition, isLinkProjectionDefinition, isTelemetryProjectionDefinition, isProjectionDefinition, projectionTargetOf, GRANT_KINDS, grantKindOf, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, getAuthorizationRef, resolveExecutionScopeAuthorization, AuthorizationError, evaluate, isAllowed, assertAuthorized, assertRuntimeAuthorizationBound, assertCanEdit, assertCanAppendTelemetry, assertCanManageConnector, assertPrivileged, assertProviderAccess, isApplicationAccessControlled, canAccessApplication, canViewEvent, resolveRoleGrants, resolveAuthorizationContext, canViewActionRun, canViewWorkflowRun, canViewWorkflowIntervention, canViewPipelineRun, canViewProjectionRun, canViewProjection, emptyGrantIndex };
-
-//# debugId=61CE77C324BED20164756E2164756E21