@sixb/core 0.1.7 → 0.1.9

package/dist/chunk-dz5h08xv.js

@@ -0,0 +1,1887 @@
+// @bun
+import {
+  createSixbError2
+} from "./chunk-f4w3yp4f.js";
+import {
+  compileSelectedObjectReadScope2
+} from "./chunk-v4jbb3rs.js";
+import {
+  resolveSemanticType2
+} from "./chunk-ms2tmn1k.js";
+import {
+  compareStrings
+} from "./chunk-wy0qdqfm.js";
+
+// src/execution/authorization.ts
+import { isDeepStrictEqual } from "util";
+
+// src/agents/identity.ts
+function agentServiceAccountId2(actorId) {
+  return `svc_agent_${actorId}`;
+}
+
+// src/authorization/grant-kinds.ts
+var GRANT_KINDS = {
+  "access:application": {
+    universeKey: "applicationIds",
+    subject: "application",
+    fix: "Use an application exported from '@sixb/core'."
+  },
+  "view:object": {
+    universeKey: "objectTypeIds",
+    subject: "object type",
+    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies }).",
+    expandsSubtypes: true
+  },
+  "view:dataset": {
+    universeKey: "datasetIds",
+    subject: "dataset",
+    fix: "Add it to 'datasets/' or pass it to createSixb({ datasets })."
+  },
+  "edit:object": {
+    universeKey: "objectTypeIds",
+    subject: "object type",
+    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies })."
+  },
+  "append:telemetry": {
+    universeKey: "objectTypeIds",
+    subject: "object type",
+    fix: "Register it in 'ontology/' or pass it to createSixb({ ontologies })."
+  },
+  "apply:action": {
+    universeKey: "actionIds",
+    subject: "action",
+    fix: "Add it to 'actions/' or pass it to createSixb({ actions })."
+  },
+  "share:share": {
+    universeKey: "shareIds",
+    subject: "share",
+    fix: "Add it to 'shares/' or pass it to createSixb({ shares })."
+  },
+  "run:workflow": {
+    universeKey: "workflowIds",
+    subject: "workflow",
+    fix: "Add it to 'workflows/' or pass it to createSixb({ workflows })."
+  },
+  "run:sync": {
+    universeKey: "syncIds",
+    subject: "sync",
+    fix: "Add it to 'syncs/' or pass it to createSixb({ syncs })."
+  },
+  "run:pipeline": {
+    universeKey: "pipelineIds",
+    subject: "pipeline",
+    fix: "Add it to 'pipelines/' or pass it to createSixb({ pipelines })."
+  },
+  "run:agent": {
+    singleton: true,
+    subject: "agent",
+    fix: "Configure models.language and use the exported agent reference in can.run(agent)."
+  },
+  "observe:logs": {
+    universeKey: "observableIds",
+    subject: "observability surface",
+    fix: 'Use can.observe("logs").'
+  },
+  "observe:aiUsage": {
+    universeKey: "observableIds",
+    subject: "observability surface",
+    fix: "Use can.observe(agent.usage)."
+  },
+  "manage:connector": {
+    universeKey: "connectorIds",
+    subject: "connector",
+    fix: "Add it to 'connectors/' or pass it to createSixb({ connectors })."
+  },
+  "manage:aiUsage": {
+    universeKey: "manageableIds",
+    subject: "management surface",
+    fix: "Use can.manage(agent.usage)."
+  }
+};
+var GRANT_KIND_KEYS = Object.keys(GRANT_KINDS);
+var TARGETED_GRANT_KIND_KEYS = GRANT_KIND_KEYS.filter((kind) => kind !== "run:agent");
+function grantKindOf(grant) {
+  switch (grant.capability) {
+    case "access":
+      return "access:application";
+    case "view":
+      return `view:${grant.target}`;
+    case "edit":
+      return "edit:object";
+    case "append":
+      return "append:telemetry";
+    case "apply":
+      return "apply:action";
+    case "share":
+      return "share:share";
+    case "run":
+      return `run:${grant.target}`;
+    case "observe":
+      return `observe:${grant.target}`;
+    case "manage":
+      return `manage:${grant.target}`;
+  }
+}
+function emptyGrantSets() {
+  return {
+    "access:application": new Set,
+    "view:object": new Set,
+    "view:dataset": new Set,
+    "edit:object": new Set,
+    "append:telemetry": new Set,
+    "apply:action": new Set,
+    "share:share": new Set,
+    "run:workflow": new Set,
+    "run:sync": new Set,
+    "run:pipeline": new Set,
+    "run:agent": false,
+    "observe:logs": new Set,
+    "observe:aiUsage": new Set,
+    "manage:connector": new Set,
+    "manage:aiUsage": new Set
+  };
+}
+
+// src/storage/objects/execution-limits.ts
+var MAX_OBJECT_READ_FACETS2 = 16;
+var MAX_OUTPUT_JSON_DEPTH = 64;
+
+class ObjectReadLimitExceededError2 extends Error {
+  metric;
+  limit;
+  name = "ObjectReadLimitExceededError";
+  code = "object_read_limit_exceeded";
+  constructor(metric, limit) {
+    super(`[Sixb] Object read exceeded its ${metric} limit (${limit}).`);
+    this.metric = metric;
+    this.limit = limit;
+  }
+}
+function snapshotObjectReadExecutionLimits2(limits) {
+  if (typeof limits !== "object" || limits === null) {
+    throw new Error("[Sixb] Object read execution limits must be provided.");
+  }
+  return Object.freeze({
+    maxTraversalFacts: positiveSafeInteger(limits.maxTraversalFacts, "maxTraversalFacts"),
+    maxOutputJsonBytes: positiveSafeInteger(limits.maxOutputJsonBytes, "maxOutputJsonBytes")
+  });
+}
+function assertObjectReadFacetCount2(count) {
+  if (!Number.isSafeInteger(count) || count < 0 || count > MAX_OBJECT_READ_FACETS2) {
+    throw new Error(`[Sixb] An object read supports between 0 and ${MAX_OBJECT_READ_FACETS2} facets.`);
+  }
+}
+function assertObjectReadOutputWithinLimit2(value, limits) {
+  const fail = () => {
+    throw new ObjectReadLimitExceededError2("outputJsonBytes", limits.maxOutputJsonBytes);
+  };
+  const stack = [];
+  let bytes = 0;
+  const addBytes = (count) => {
+    bytes += count;
+    if (bytes > limits.maxOutputJsonBytes)
+      fail();
+  };
+  const addPrimitiveBytes = (primitive) => {
+    switch (typeof primitive) {
+      case "string":
+        addBytes(jsonStringUtf8Length(primitive));
+        break;
+      case "number":
+        addBytes(Number.isFinite(primitive) ? Object.is(primitive, -0) ? 1 : String(primitive).length : 4);
+        break;
+      case "boolean":
+        addBytes(primitive ? 4 : 5);
+        break;
+    }
+  };
+  try {
+    JSON.stringify(value, function(key, current) {
+      const parent = isObject(this) ? this : undefined;
+      let parentFrameIndex = -1;
+      if (parent) {
+        for (let index = stack.length - 1;index >= 0; index -= 1) {
+          if (stack[index]?.value === parent) {
+            parentFrameIndex = index;
+            break;
+          }
+        }
+      }
+      const isRoot = parentFrameIndex === -1;
+      if (isRoot) {
+        stack.length = 0;
+      } else {
+        stack.length = parentFrameIndex + 1;
+      }
+      const parentFrame = isRoot ? undefined : stack[parentFrameIndex];
+      const parentIsArray = Array.isArray(parent);
+      const unsupported = current === undefined || typeof current === "function" || typeof current === "symbol";
+      if (!isRoot) {
+        if (!parentIsArray && unsupported)
+          return current;
+        if (!parentFrame)
+          return fail();
+        if (parentFrame.serializedChildren > 0)
+          addBytes(1);
+        parentFrame.serializedChildren += 1;
+        if (!parentIsArray)
+          addBytes(jsonStringUtf8Length(key) + 1);
+      } else if (unsupported) {
+        return current;
+      }
+      if (parentIsArray && unsupported) {
+        addBytes(4);
+        return current;
+      }
+      if (isObject(current)) {
+        const special = inspectJsonSpecialObject(current);
+        switch (special.kind) {
+          case "primitive":
+            addPrimitiveBytes(special.value);
+            return special.value;
+          case "bigint":
+            throw new TypeError("BigInt is not JSON serializable");
+          case "raw":
+            addBytes(rawJsonUtf8Length(special.value));
+            return current;
+          case "ordinary":
+            break;
+        }
+      }
+      switch (typeof current) {
+        case "string":
+          addPrimitiveBytes(current);
+          break;
+        case "number":
+          addPrimitiveBytes(current);
+          break;
+        case "boolean":
+          addPrimitiveBytes(current);
+          break;
+        case "bigint":
+          throw new TypeError("BigInt is not JSON serializable");
+        case "object":
+          if (current === null) {
+            addBytes(4);
+            break;
+          }
+          if (stack.some((frame) => frame.value === current)) {
+            throw new TypeError("Cyclic object value");
+          }
+          if (stack.length + 1 > MAX_OUTPUT_JSON_DEPTH)
+            fail();
+          addBytes(2);
+          stack.push({ value: current, serializedChildren: 0 });
+          break;
+      }
+      return current;
+    });
+  } catch (error) {
+    if (error instanceof ObjectReadLimitExceededError2)
+      throw error;
+    if (error instanceof RangeError || error instanceof TypeError)
+      fail();
+    throw error;
+  }
+}
+var jsonWithRawJson = JSON;
+var isRawJson = jsonWithRawJson.isRawJSON?.bind(jsonWithRawJson);
+var booleanValueOf = bindValueOf(Boolean.prototype.valueOf);
+var numberValueOf = bindValueOf(Number.prototype.valueOf);
+var stringValueOf = bindValueOf(String.prototype.valueOf);
+var bigintValueOf = bindValueOf(BigInt.prototype.valueOf);
+var toStringValue = String;
+function inspectJsonSpecialObject(value) {
+  if (isRawJson?.(value)) {
+    const raw = value.rawJSON;
+    if (typeof raw !== "string")
+      return { kind: "ordinary" };
+    return { kind: "raw", value: raw };
+  }
+  const boolean = unbox(value, booleanValueOf);
+  if (boolean.matched)
+    return { kind: "primitive", value: boolean.value };
+  const number = unbox(value, numberValueOf);
+  if (number.matched)
+    return { kind: "primitive", value: +value };
+  const string = unbox(value, stringValueOf);
+  if (string.matched)
+    return { kind: "primitive", value: toStringValue(value) };
+  if (unbox(value, bigintValueOf).matched)
+    return { kind: "bigint" };
+  return { kind: "ordinary" };
+}
+function bindValueOf(unboxer) {
+  return Function.prototype.call.bind(unboxer);
+}
+function unbox(value, unboxer) {
+  try {
+    return { matched: true, value: unboxer(value) };
+  } catch {
+    return { matched: false };
+  }
+}
+function rawJsonUtf8Length(value) {
+  let bytes = 0;
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 127) {
+      bytes += 1;
+    } else if (code <= 2047) {
+      bytes += 2;
+    } else if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        index += 1;
+      } else {
+        bytes += 3;
+      }
+    } else {
+      bytes += 3;
+    }
+  }
+  return bytes;
+}
+function jsonStringUtf8Length(value) {
+  let bytes = 2;
+  for (let index = 0;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code === 34 || code === 92) {
+      bytes += 2;
+    } else if (code <= 31) {
+      bytes += code === 8 || code === 9 || code === 10 || code === 12 || code === 13 ? 2 : 6;
+    } else if (code <= 127) {
+      bytes += 1;
+    } else if (code <= 2047) {
+      bytes += 2;
+    } else if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        index += 1;
+      } else {
+        bytes += 6;
+      }
+    } else if (code >= 56320 && code <= 57343) {
+      bytes += 6;
+    } else {
+      bytes += 3;
+    }
+  }
+  return bytes;
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+function positiveSafeInteger(value, name) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`[Sixb] ${name} must be a positive safe integer.`);
+  }
+  return value;
+}
+
+// src/execution/types.ts
+class RuntimeAuthorizationCapability {
+  #runtimeAuthorization = true;
+  constructor() {}
+  static create() {
+    const capability = new RuntimeAuthorizationCapability;
+    Object.freeze(capability);
+    return capability;
+  }
+  static is(value) {
+    return typeof value === "object" && value !== null && #runtimeAuthorization in value;
+  }
+}
+function createRuntimeAuthorizationCapability() {
+  return RuntimeAuthorizationCapability.create();
+}
+function isRuntimeAuthorizationCapability(value) {
+  return RuntimeAuthorizationCapability.is(value);
+}
+
+// src/execution/authorization.ts
+var registeredAuthorizations = new WeakMap;
+var MAX_DELEGATED_ACTION_APPLY_TARGETS = 4096;
+var MAX_DELEGATED_ACTION_IDENTIFIER_CHARACTERS = 1e6;
+function createPrincipalRuntimeAuthorization(input) {
+  if (input.execution.executor.type !== "request") {
+    throw new Error("[Sixb] Principal runtime authorization requires a request execution.");
+  }
+  return createRegisteredPrincipalAuthorization(input);
+}
+function createAgentRuntimeAuthorization(input) {
+  if (input.execution.executor.type !== "agent") {
+    throw new Error("[Sixb] Agent runtime authorization requires an Agent execution.");
+  }
+  if (input.authority.type === "principal") {
+    return createRegisteredPrincipalAuthorization({
+      execution: input.execution,
+      context: input.authority.context,
+      ...input.authority.credential === undefined ? {} : { credential: input.authority.credential }
+    });
+  }
+  return register(input.execution, {
+    type: "unrestricted",
+    projectId: input.execution.projectId,
+    ref: Object.freeze({ type: "disabled" })
+  });
+}
+function createRegisteredPrincipalAuthorization(input) {
+  const context = snapshotAuthorizationContext(input.context);
+  const credential = input.credential ? snapshotCredential(input.credential) : undefined;
+  assertCredentialMatchesContext(context, credential);
+  const ref = Object.freeze({
+    type: "principal",
+    principal: context.principal,
+    ...credential === undefined ? {} : { credential }
+  });
+  return register(input.execution, {
+    type: "principal",
+    projectId: input.execution.projectId,
+    context,
+    ref
+  });
+}
+function createDisabledRuntimeAuthorization(execution) {
+  return register(execution, {
+    type: "unrestricted",
+    projectId: execution.projectId,
+    ref: Object.freeze({ type: "disabled" })
+  });
+}
+function createDelegatedRuntimeAuthorization(input) {
+  const execution = input.execution;
+  const objectReadInput = input.objectRead;
+  const actionApplyInput = input.actionApply;
+  const delegationInput = input.delegation;
+  const delegation = delegationInput === undefined ? undefined : snapshotSharedDelegation(delegationInput);
+  if (execution.executor.type !== "request" || execution.requestedBy !== undefined) {
+    throw new Error("[Sixb] Delegated runtime authorization requires a request execution without a principal.");
+  }
+  const objectRead = Object.freeze({
+    scope: compileSelectedObjectReadScope2(objectReadInput.selection),
+    limits: snapshotObjectReadExecutionLimits2(objectReadInput.limits)
+  });
+  return register(execution, {
+    type: "delegated",
+    projectId: execution.projectId,
+    objectRead,
+    actionApply: snapshotDelegatedActionApply(actionApplyInput ?? []),
+    ...delegation === undefined ? {} : { delegation }
+  });
+}
+function createTrustedPrimitiveRuntimeAuthorization(input) {
+  const primitive = snapshotTrustedPrimitive(input.primitive);
+  return register(input.execution, {
+    type: "unrestricted",
+    projectId: input.execution.projectId,
+    ref: Object.freeze({ type: "trustedPrimitive", primitive })
+  });
+}
+function resolveRuntimeAuthorization(authorization) {
+  if (!isRuntimeAuthorizationCapability(authorization)) {
+    return { type: "denied" };
+  }
+  return registeredAuthorizations.get(authorization)?.resolved ?? { type: "denied" };
+}
+function resolveRuntimeAuthorizationForProject(input) {
+  const resolved = resolveRuntimeAuthorization(input.runtimeAuthorization);
+  if (resolved.type === "denied" || typeof input.projectId !== "string" || resolved.projectId !== input.projectId) {
+    return { type: "denied" };
+  }
+  return resolved;
+}
+function getAuthorizationRef(authorization) {
+  const resolved = resolveRuntimeAuthorization(authorization);
+  if (resolved.type === "denied") {
+    throw new Error("[Sixb] Runtime authorization is not a registered Core capability.");
+  }
+  if (resolved.type === "delegated") {
+    if (resolved.delegation) {
+      return { type: "delegated", delegation: { ...resolved.delegation } };
+    }
+    throw new Error("[Sixb] Delegated runtime authorization cannot cross a durable execution boundary.");
+  }
+  return cloneAuthorizationRef(resolved.ref);
+}
+function snapshotSharedDelegation(input) {
+  const kind = input.kind;
+  const grantId = input.grantId;
+  const sessionId = input.sessionId;
+  if (kind !== "share")
+    throw new Error("[Sixb] Unknown delegated authority provenance.");
+  assertNonEmpty(grantId, "Share grant id");
+  assertNonEmpty(sessionId, "Share session id");
+  return Object.freeze({ kind, grantId, sessionId });
+}
+function assertExecutionScopeProject(projectId, scope) {
+  assertNonEmpty(projectId, "Project id");
+  if (scope.execution.projectId !== projectId) {
+    throw createSixbError2("internal.unexpected", `[Sixb] Execution scope belongs to project '${scope.execution.projectId}', not '${projectId}'.`, {
+      details: {
+        executionId: scope.execution.id,
+        expectedProjectId: projectId,
+        scopeProjectId: scope.execution.projectId
+      }
+    });
+  }
+  const resolved = resolveRuntimeAuthorization(scope.authorization);
+  if (resolved.type === "denied") {
+    throw createSixbError2("internal.unexpected", "[Sixb] Execution scope carries unregistered runtime authorization.", { details: { executionId: scope.execution.id, projectId } });
+  }
+  if (resolved.projectId !== projectId) {
+    throw createSixbError2("internal.unexpected", `[Sixb] Execution authorization belongs to project '${resolved.projectId}', not '${projectId}'.`, {
+      details: {
+        authorizationProjectId: resolved.projectId,
+        executionId: scope.execution.id,
+        expectedProjectId: projectId
+      }
+    });
+  }
+}
+function captureExecutionScope(scope) {
+  const execution = scope.execution;
+  const authorization = scope.authorization;
+  return Object.freeze({ execution, authorization });
+}
+function resolveExecutionScopeAuthorization(projectId, scope) {
+  const capturedScope = captureExecutionScope(scope);
+  assertExecutionScopeProject(projectId, capturedScope);
+  const resolved = resolveRuntimeAuthorization(capturedScope.authorization);
+  if (resolved.type === "denied") {
+    throw createSixbError2("internal.unexpected", "[Sixb] Execution scope carries unregistered runtime authorization.", { details: { executionId: capturedScope.execution.id, projectId } });
+  }
+  const registration = registeredAuthorizations.get(capturedScope.authorization);
+  if (!registration || !executionMatchesBinding(registration.execution, capturedScope.execution)) {
+    throw invalidExecutionAuthority(capturedScope.execution.id, "authority is bound to different execution provenance");
+  }
+  assertResolvedAuthorizationMatchesExecution(resolved, capturedScope.execution);
+  return resolved;
+}
+function assertResolvedAuthorizationMatchesExecution(resolved, execution) {
+  switch (execution.executor.type) {
+    case "request":
+      if (execution.source.type !== "http" || execution.source.requestId !== execution.executor.requestId) {
+        throw invalidExecutionAuthority(execution.id, "request source does not match its executor");
+      }
+      if (resolved.type === "principal") {
+        if (!principalsEqual(execution.requestedBy, resolved.ref.principal)) {
+          throw invalidExecutionAuthority(execution.id, "request authority does not match its requested-by principal");
+        }
+        return;
+      }
+      if (resolved.type === "unrestricted" && resolved.ref.type === "disabled" && execution.requestedBy === undefined) {
+        return;
+      }
+      if (resolved.type === "delegated" && execution.requestedBy === undefined)
+        return;
+      throw invalidExecutionAuthority(execution.id, "request execution requires principal, delegated, or explicitly disabled authority");
+    case "primitive":
+      if (resolved.type !== "unrestricted" || resolved.ref.type !== "trustedPrimitive" || resolved.ref.primitive.kind !== execution.executor.kind || resolved.ref.primitive.id !== execution.executor.id || resolved.ref.primitive.runId !== execution.executor.runId) {
+        throw invalidExecutionAuthority(execution.id, "trusted primitive authority does not match its executor");
+      }
+      return;
+    case "agent":
+      if (execution.source.type !== "execution") {
+        throw invalidExecutionAuthority(execution.id, "agent execution requires an execution source");
+      }
+      if (resolved.type === "principal" && resolved.ref.type === "principal") {
+        if (resolved.ref.principal.type === "serviceAccount") {
+          const actorId = execution.executor.actorId;
+          if (actorId === undefined || resolved.ref.principal.id !== agentServiceAccountId2(actorId) || resolved.ref.credential !== undefined) {
+            throw invalidExecutionAuthority(execution.id, "agent authority must reference its managed service account");
+          }
+        } else if (resolved.ref.credential === undefined) {
+          throw invalidExecutionAuthority(execution.id, "inherited user agent authority requires a credential");
+        }
+        return;
+      }
+      if (resolved.type === "unrestricted" && resolved.ref.type === "disabled")
+        return;
+      throw invalidExecutionAuthority(execution.id, "agent authority must be principal or explicitly disabled");
+    case "kernel":
+      if (resolved.type !== "unrestricted" || resolved.ref.type !== "kernel" || execution.requestedBy !== undefined || resolved.ref.operation.type !== execution.executor.operation.type || resolved.ref.operation.recoveryId !== execution.executor.operation.recoveryId) {
+        throw invalidExecutionAuthority(execution.id, "kernel authority does not match its executor");
+      }
+      return;
+  }
+}
+function principalsEqual(left, right) {
+  return left?.type === right?.type && left?.id === right?.id;
+}
+function invalidExecutionAuthority(executionId, reason) {
+  return createSixbError2("internal.unexpected", `[Sixb] Execution '${executionId}' is incompatible with its authority: ${reason}.`, { details: { executionId, reason } });
+}
+function register(execution, input) {
+  assertNonEmpty(input.projectId, "Authorization project id");
+  const executionBinding = snapshotExecutionContext(execution);
+  if (input.projectId !== executionBinding.projectId) {
+    throw new Error(`[Sixb] Runtime authorization belongs to project '${input.projectId}', not execution project '${executionBinding.projectId}'.`);
+  }
+  assertResolvedAuthorizationMatchesExecution(input, executionBinding);
+  const authorization = createRuntimeAuthorizationCapability();
+  registeredAuthorizations.set(authorization, Object.freeze({ resolved: Object.freeze(input), execution: executionBinding }));
+  return authorization;
+}
+function executionMatchesBinding(binding, execution) {
+  try {
+    return isDeepStrictEqual(binding, snapshotExecutionContext(execution));
+  } catch {
+    return false;
+  }
+}
+function snapshotExecutionContext(execution) {
+  assertNonEmpty(execution.id, "Execution id");
+  assertNonEmpty(execution.projectId, "Execution project id");
+  assertNonEmpty(execution.correlationId, "Execution correlation id");
+  return Object.freeze({
+    id: execution.id,
+    projectId: execution.projectId,
+    ...execution.requestedBy === undefined ? {} : { requestedBy: snapshotAuthorizablePrincipal(execution.requestedBy) },
+    executor: snapshotExecutionExecutor(execution.executor),
+    source: snapshotExecutionSource(execution.source),
+    correlationId: execution.correlationId
+  });
+}
+function snapshotExecutionExecutor(executor) {
+  switch (executor.type) {
+    case "request":
+      assertNonEmpty(executor.requestId, "Execution request id");
+      return Object.freeze({ type: "request", requestId: executor.requestId });
+    case "primitive": {
+      const primitive = snapshotTrustedPrimitive(executor);
+      return Object.freeze({ type: "primitive", ...primitive });
+    }
+    case "agent":
+      if (executor.actorId !== undefined)
+        assertNonEmpty(executor.actorId, "Execution Agent actor id");
+      assertNonEmpty(executor.runId, "Execution Agent run id");
+      return Object.freeze({
+        type: "agent",
+        ...executor.actorId === undefined ? {} : { actorId: executor.actorId },
+        runId: executor.runId
+      });
+    case "kernel":
+      return Object.freeze({
+        type: "kernel",
+        operation: snapshotKernelOperation(executor.operation)
+      });
+  }
+  throw new Error(`[Sixb] Unknown execution executor type '${String(executor.type)}'.`);
+}
+function snapshotExecutionSource(source) {
+  switch (source.type) {
+    case "http":
+      assertNonEmpty(source.requestId, "Execution source request id");
+      return Object.freeze({ type: "http", requestId: source.requestId });
+    case "webhook":
+      assertNonEmpty(source.deliveryId, "Execution source delivery id");
+      return Object.freeze({ type: "webhook", deliveryId: source.deliveryId });
+    case "schedule":
+    case "event":
+      assertNonEmpty(source.eventId, "Execution source event id");
+      return Object.freeze({ type: source.type, eventId: source.eventId });
+    case "datasetVersion":
+      assertNonEmpty(source.datasetId, "Execution source dataset id");
+      assertNonEmpty(source.versionId, "Execution source dataset version id");
+      return Object.freeze({
+        type: "datasetVersion",
+        datasetId: source.datasetId,
+        versionId: source.versionId
+      });
+    case "execution":
+      assertNonEmpty(source.executionId, "Execution source execution id");
+      return Object.freeze({ type: "execution", executionId: source.executionId });
+  }
+  throw new Error(`[Sixb] Unknown execution source type '${String(source.type)}'.`);
+}
+function snapshotAuthorizationContext(context) {
+  const principal = snapshotAuthorizablePrincipal(context.principal);
+  const grants = {};
+  for (const kind of TARGETED_GRANT_KIND_KEYS) {
+    grants[kind] = new ImmutableGrantSet(context.grants[kind]);
+  }
+  const frozenGrants = Object.freeze({
+    ...grants,
+    "run:agent": context.grants["run:agent"]
+  });
+  return Object.freeze({
+    principal,
+    ...context.sessionId === undefined ? {} : { sessionId: context.sessionId },
+    groupIds: Object.freeze([...context.groupIds]),
+    roleIds: Object.freeze([...context.roleIds]),
+    grants: frozenGrants
+  });
+}
+
+class ImmutableGrantSet {
+  #values;
+  [Symbol.toStringTag] = "Set";
+  constructor(values) {
+    this.#values = new Set(values);
+    Object.freeze(this);
+  }
+  get size() {
+    return this.#values.size;
+  }
+  has(value) {
+    return this.#values.has(value);
+  }
+  entries() {
+    return this.#values.entries();
+  }
+  keys() {
+    return this.#values.keys();
+  }
+  values() {
+    return this.#values.values();
+  }
+  [Symbol.iterator]() {
+    return this.#values[Symbol.iterator]();
+  }
+  forEach(callback, thisArg) {
+    for (const value of this.#values) {
+      callback.call(thisArg, value, value, this);
+    }
+  }
+  add(_value) {
+    throw immutableGrantSetMutation();
+  }
+  delete(_value) {
+    throw immutableGrantSetMutation();
+  }
+  clear() {
+    throw immutableGrantSetMutation();
+  }
+}
+Object.freeze(ImmutableGrantSet.prototype);
+function immutableGrantSetMutation() {
+  return new Error("[Sixb] Runtime authorization grants are immutable.");
+}
+function snapshotAuthorizablePrincipal(principal) {
+  if (principal.type !== "user" && principal.type !== "serviceAccount") {
+    throw new Error(`[Sixb] Principal type '${principal.type}' cannot hold runtime authorization.`);
+  }
+  assertNonEmpty(principal.id, "Authorization principal id");
+  return Object.freeze({ type: principal.type, id: principal.id });
+}
+function snapshotCredential(credential) {
+  assertNonEmpty(credential.id, "Authorization credential id");
+  if (credential.type !== "session" && credential.type !== "accessToken") {
+    const credentialType = credential.type;
+    throw new Error(`[Sixb] Unknown authorization credential type '${credentialType}'.`);
+  }
+  return Object.freeze({ type: credential.type, id: credential.id });
+}
+function assertCredentialMatchesContext(context, credential) {
+  if (credential?.type === "session") {
+    if (context.sessionId !== credential.id) {
+      throw new Error("[Sixb] Session credential id must match the authorization context session id.");
+    }
+    return;
+  }
+  if (context.sessionId !== undefined) {
+    throw new Error("[Sixb] Authorization context session requires a matching session credential.");
+  }
+}
+function snapshotTrustedPrimitive(primitive) {
+  if (!isTrustedPrimitiveKind(primitive.kind)) {
+    throw new Error(`[Sixb] Unknown trusted primitive kind '${primitive.kind}'.`);
+  }
+  assertNonEmpty(primitive.id, "Trusted primitive id");
+  assertNonEmpty(primitive.runId, "Trusted primitive run id");
+  return Object.freeze({ kind: primitive.kind, id: primitive.id, runId: primitive.runId });
+}
+function snapshotKernelOperation(operation) {
+  if (operation.type !== "ontology.recover") {
+    throw new Error(`[Sixb] Unknown kernel operation '${operation.type}'.`);
+  }
+  assertNonEmpty(operation.recoveryId, "Kernel recovery id");
+  return Object.freeze({ type: operation.type, recoveryId: operation.recoveryId });
+}
+function snapshotDelegatedActionApply(input) {
+  if (!Array.isArray(input)) {
+    throw new Error("[Sixb] Delegated Action targets must be an array.");
+  }
+  const targetCount = input.length;
+  if (targetCount > MAX_DELEGATED_ACTION_APPLY_TARGETS) {
+    throw new Error(`[Sixb] Delegated authority exceeds the maximum of ${MAX_DELEGATED_ACTION_APPLY_TARGETS} Action targets.`);
+  }
+  let identifierCharacters = 0;
+  const targets = [];
+  for (let index = 0;index < targetCount; index += 1) {
+    const authoredTarget = input[index];
+    if (!isRecord(authoredTarget)) {
+      throw new Error(`[Sixb] Delegated Action target ${index} must be an object.`);
+    }
+    const authoredActionId = authoredTarget.actionId;
+    const authoredSubject = authoredTarget.subject;
+    if (!isRecord(authoredSubject)) {
+      throw new Error(`[Sixb] Delegated Action target ${index} subject must be an ObjectRef.`);
+    }
+    const actionId = delegatedActionIdentifier(authoredActionId, `Delegated Action target ${index} action id`);
+    const objectTypeId = delegatedActionIdentifier(authoredSubject.objectTypeId, `Delegated Action target ${index} subject object type id`);
+    const primaryId = delegatedActionIdentifier(authoredSubject.primaryId, `Delegated Action target ${index} subject primary id`);
+    identifierCharacters += actionId.length + objectTypeId.length + primaryId.length;
+    if (identifierCharacters > MAX_DELEGATED_ACTION_IDENTIFIER_CHARACTERS) {
+      throw new Error(`[Sixb] Delegated authority exceeds the maximum of ${MAX_DELEGATED_ACTION_IDENTIFIER_CHARACTERS} Action identifier characters.`);
+    }
+    targets.push(Object.freeze({
+      actionId,
+      subject: Object.freeze({ objectTypeId, primaryId })
+    }));
+  }
+  return Object.freeze(targets);
+}
+function delegatedActionIdentifier(value, label) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`[Sixb] ${label} must not be empty.`);
+  }
+  return value;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function cloneAuthorizationRef(ref) {
+  switch (ref.type) {
+    case "principal":
+      return {
+        type: "principal",
+        principal: { ...ref.principal },
+        ...ref.credential === undefined ? {} : { credential: { ...ref.credential } }
+      };
+    case "trustedPrimitive":
+      return { type: "trustedPrimitive", primitive: { ...ref.primitive } };
+    case "delegated":
+      return { type: "delegated", delegation: { ...ref.delegation } };
+    case "kernel":
+      return { type: "kernel", operation: { ...ref.operation } };
+    case "disabled":
+      return { type: "disabled" };
+  }
+}
+function isTrustedPrimitiveKind(value) {
+  return value === "action" || value === "pipeline" || value === "projection" || value === "rule" || value === "sync" || value === "webhook" || value === "workflow";
+}
+function assertNonEmpty(value, label) {
+  if (!value.trim()) {
+    throw new Error(`[Sixb] ${label} must not be empty.`);
+  }
+}
+
+// src/authorization/errors.ts
+class AuthorizationError2 extends Error {
+  grantKey;
+  name = "AuthorizationError";
+  constructor(grantKey, message) {
+    super(message);
+    this.grantKey = grantKey;
+  }
+}
+
+// src/authorization/decision.ts
+function atomsFor(request) {
+  switch (request.kind) {
+    case "application.access":
+      return [{ kind: "access:application", id: request.audience }];
+    case "object.view":
+      return [{ kind: "view:object", id: request.objectTypeId }];
+    case "dataset.view":
+      return [{ kind: "view:dataset", id: request.datasetId }];
+    case "object.edit":
+      return [{ kind: "edit:object", id: request.objectTypeId }];
+    case "telemetry.append":
+      return [{ kind: "append:telemetry", id: request.objectTypeId }];
+    case "action.apply":
+      return [{ kind: "apply:action", id: request.actionId }];
+    case "share.manage":
+      return [{ kind: "share:share", id: request.shareId }];
+    case "workflow.run":
+      return [{ kind: "run:workflow", id: request.workflowId }];
+    case "sync.run":
+      return [{ kind: "run:sync", id: request.syncId }];
+    case "pipeline.run":
+      return [{ kind: "run:pipeline", id: request.pipelineId }];
+    case "agent.run":
+      return [{ kind: "run:agent" }];
+    case "logs.observe":
+      return [{ kind: "observe:logs", id: "logs" }];
+    case "aiUsage.observe":
+      return [{ kind: "observe:aiUsage", id: "aiUsage" }];
+    case "aiUsage.manage":
+      return [{ kind: "manage:aiUsage", id: "aiUsage" }];
+    case "connector.manage":
+      return [{ kind: "manage:connector", id: request.connectorId }];
+    case "object.query":
+      return request.touchedObjectTypeIds.map((id) => ({ kind: "view:object", id }));
+  }
+}
+function atomKey(atom) {
+  if (atom.kind === "run:agent")
+    return atom.kind;
+  if (atom.kind === "observe:logs" || atom.kind === "observe:aiUsage" || atom.kind === "manage:aiUsage") {
+    return atom.kind;
+  }
+  return `${atom.kind}:${atom.id}`;
+}
+function holds(grants, atom) {
+  if (atom.kind === "run:agent")
+    return grants[atom.kind];
+  return grants[atom.kind].has(atom.id);
+}
+function evaluate2(authorization, request) {
+  const atoms = atomsFor(request);
+  const requirements = atoms.map(atomKey);
+  const missing = authorization ? atoms.filter((atom) => !holds(authorization.grants, atom)).map(atomKey) : [];
+  return { allowed: missing.length === 0, requirements, missing };
+}
+function isAllowed2(authorization, request) {
+  return evaluate2(authorization, request).allowed;
+}
+function assertAuthorized2(runtime, request) {
+  const resolved = assertRuntimeAuthorizationBound2(runtime);
+  if (resolved.type === "delegated") {
+    throw new AuthorizationError2(`delegated:${request.kind}`, `[Sixb] Operation '${request.kind}' is not covered by delegated authorization.`);
+  }
+  const authorization = resolved.type === "principal" ? resolved.context : undefined;
+  const decision = evaluate2(authorization, request);
+  if (decision.allowed) {
+    return;
+  }
+  throw new AuthorizationError2(decision.missing[0] ?? request.kind, deniedMessage(authorization, request));
+}
+function isRuntimeAllowed2(runtime, request) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  if (authority.type === "denied" || authority.type === "delegated")
+    return false;
+  return authority.type === "unrestricted" || isAllowed2(authority.context, request);
+}
+function assertRuntimeAuthorizationBound2(runtime) {
+  const resolved = resolveRuntimeAuthorizationForProject(runtime);
+  if (resolved.type === "denied") {
+    throw new AuthorizationError2("runtime:unbound", "[Sixb] Protected operations require a registered execution scope.");
+  }
+  return resolved;
+}
+function assertCanEdit2(runtime, objectTypeId) {
+  assertAuthorized2(runtime, { kind: "object.view", objectTypeId });
+  assertAuthorized2(runtime, { kind: "object.edit", objectTypeId });
+}
+function assertCanAppendTelemetry2(runtime, objectTypeId) {
+  assertAuthorized2(runtime, { kind: "telemetry.append", objectTypeId });
+}
+function assertCanManageConnector2(runtime, connectorId) {
+  assertAuthorized2(runtime, { kind: "connector.manage", connectorId });
+}
+function assertPrivileged2(runtime, operation) {
+  const resolved = assertRuntimeAuthorizationBound2(runtime);
+  if (resolved.type === "unrestricted") {
+    return;
+  }
+  throw new AuthorizationError2(`privileged:${operation}`, `[Sixb] Operation '${operation}' is not covered by scoped authorization grants.`);
+}
+function assertProviderAccess2(runtime, execution, operation) {
+  const resolved = resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization
+  });
+  if (resolved.type === "unrestricted") {
+    return;
+  }
+  if (execution.executor.type === "agent") {
+    return;
+  }
+  throw new AuthorizationError2(`privileged:${operation}`, `[Sixb] Operation '${operation}' is not covered by scoped authorization grants.`);
+}
+function deniedMessage(authorization, request) {
+  const principalId = authorization?.principal.id ?? "unknown";
+  switch (request.kind) {
+    case "application.access":
+      return `[Sixb] Principal '${principalId}' is not allowed to access application '${request.audience}'.`;
+    case "object.view":
+      return `[Sixb] Principal '${principalId}' is not allowed to view object type '${request.objectTypeId}'.`;
+    case "dataset.view":
+      return `[Sixb] Principal '${principalId}' is not allowed to view dataset '${request.datasetId}'.`;
+    case "object.edit":
+      return `[Sixb] Principal '${principalId}' is not allowed to write object type '${request.objectTypeId}'.`;
+    case "telemetry.append":
+      return `[Sixb] Principal '${principalId}' is not allowed to append telemetry for object type '${request.objectTypeId}'.`;
+    case "action.apply":
+      return `[Sixb] Principal '${principalId}' is not allowed to apply action '${request.actionId}'.`;
+    case "share.manage":
+      return `[Sixb] Principal '${principalId}' is not allowed to manage Share '${request.shareId}'.`;
+    case "workflow.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to run workflow '${request.workflowId}'.`;
+    case "sync.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to run sync '${request.syncId}'.`;
+    case "pipeline.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to run pipeline '${request.pipelineId}'.`;
+    case "agent.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to run the project Agent.`;
+    case "logs.observe":
+      return `[Sixb] Principal '${principalId}' is not allowed to observe project logs.`;
+    case "aiUsage.observe":
+      return `[Sixb] Principal '${principalId}' is not allowed to observe project AI usage.`;
+    case "aiUsage.manage":
+      return `[Sixb] Principal '${principalId}' is not allowed to manage project AI usage limits.`;
+    case "connector.manage":
+      return `[Sixb] Principal '${principalId}' is not allowed to manage connector '${request.connectorId}'.`;
+    case "object.query": {
+      const blocked = request.touchedObjectTypeIds.find((objectTypeId) => !isAllowed2(authorization, { kind: "object.view", objectTypeId }));
+      return `[Sixb] Principal '${principalId}' is not allowed to view object type '${blocked}'.`;
+    }
+  }
+}
+
+// src/authorization/application-access.ts
+function isApplicationAccessControlled2(roles, audience) {
+  return roles.some((role) => role.grants["access:application"].has(audience));
+}
+function canAccessApplication2(authorization, roles, audience) {
+  return !isApplicationAccessControlled2(roles, audience) || isAllowed2(authorization, { kind: "application.access", audience });
+}
+// src/authorization/event-visibility.ts
+function canViewEvent2(authorization, event) {
+  if (!authorization) {
+    return true;
+  }
+  switch (event.topic) {
+    case "objects":
+    case "telemetry":
+      return isAllowed2(authorization, {
+        kind: "object.view",
+        objectTypeId: event.payload.objectTypeId
+      });
+    case "links":
+      return isAllowed2(authorization, {
+        kind: "object.view",
+        objectTypeId: event.payload.sourceTypeId
+      }) && isAllowed2(authorization, { kind: "object.view", objectTypeId: event.payload.targetTypeId });
+    case "actions": {
+      if (!isAllowed2(authorization, { kind: "action.apply", actionId: event.payload.actionId })) {
+        return false;
+      }
+      const subject = event.payload.subject;
+      return subject.kind === "object" ? isAllowed2(authorization, { kind: "object.view", objectTypeId: subject.objectTypeId }) : true;
+    }
+    case "workflows":
+      return isAllowed2(authorization, {
+        kind: "workflow.run",
+        workflowId: event.payload.workflowId
+      });
+    case "rules":
+      return isAllowed2(authorization, {
+        kind: "object.view",
+        objectTypeId: event.payload.subject.objectTypeId
+      });
+    case "syncs":
+      return isAllowed2(authorization, {
+        kind: "sync.run",
+        syncId: event.payload.syncId
+      });
+    case "pipelines":
+      return isAllowed2(authorization, {
+        kind: "pipeline.run",
+        pipelineId: event.payload.pipelineId
+      });
+    case "schedules":
+      return true;
+    case "datasets":
+      return isAllowed2(authorization, {
+        kind: "dataset.view",
+        datasetId: event.payload.datasetId
+      });
+    default:
+      return false;
+  }
+}
+// src/authorization/resolve.ts
+function resolveRoleGrants2(role, universe) {
+  const grants = emptyGrantSets();
+  for (const grant of role.grants) {
+    if (grant.capability === "run" && grant.target === "agent") {
+      grants["run:agent"] = true;
+      continue;
+    }
+    const kind = grantKindOf(grant);
+    const spec = GRANT_KINDS[kind];
+    expandSelection(grant.selection, universe[spec.universeKey], grants[kind], spec.expandsSubtypes ? universe.getSubTypes : undefined);
+  }
+  return grants;
+}
+function expandSelection(selection, universe, into, expand) {
+  if (selection.all) {
+    const except = new Set(selection.except);
+    for (const id of universe) {
+      if (!except.has(id)) {
+        into.add(id);
+      }
+    }
+    return;
+  }
+  for (const id of selection.ids) {
+    into.add(id);
+    if (expand) {
+      for (const subTypeId of expand(id)) {
+        into.add(subTypeId);
+      }
+    }
+  }
+}
+function resolveAuthorizationContext2(input) {
+  const memberGroupIds = new Set(input.groupIds);
+  const roleIds = [];
+  const grants = emptyGrantSets();
+  for (const role of input.roles) {
+    if (!role.grantedToGroupIds.some((groupId) => memberGroupIds.has(groupId))) {
+      continue;
+    }
+    roleIds.push(role.id);
+    if (role.grants["run:agent"]) {
+      grants["run:agent"] = true;
+    }
+    for (const kind of TARGETED_GRANT_KIND_KEYS) {
+      for (const id of role.grants[kind]) {
+        grants[kind].add(id);
+      }
+    }
+  }
+  return {
+    principal: input.principal,
+    ...input.sessionId !== undefined ? { sessionId: input.sessionId } : {},
+    groupIds: input.groupIds,
+    roleIds,
+    grants
+  };
+}
+// src/projections/errors.ts
+class ProjectionValidationError2 extends Error {
+  name = "ProjectionValidationError";
+}
+
+// src/projections/ownership.ts
+function computeProjectionOwnership2(projection, ontology) {
+  if (projection._tag === "ObjectProjectionDefinition") {
+    const primaryId = ontology.getPrimaryPropertyId(projection.objectTypeId);
+    return freezeOwnership({
+      objects: [
+        {
+          objectTypeId: projection.objectTypeId,
+          existence: true,
+          propertyIds: Object.keys(projection.properties).filter((propertyId) => propertyId !== primaryId).sort(compareStrings)
+        }
+      ],
+      links: Object.keys(projection.links).sort(compareStrings).map((linkId) => ({ sourceObjectTypeId: projection.objectTypeId, linkId })),
+      telemetry: []
+    });
+  }
+  if (projection._tag === "LinkProjectionDefinition") {
+    return freezeOwnership({
+      objects: [],
+      links: [
+        {
+          sourceObjectTypeId: projection.sourceObjectTypeId,
+          linkId: projection.linkId
+        }
+      ],
+      telemetry: []
+    });
+  }
+  return freezeOwnership({
+    objects: [],
+    links: [],
+    telemetry: Object.keys(projection.properties).sort(compareStrings).map((propertyId) => ({
+      objectTypeId: projection.objectTypeId,
+      propertyId
+    }))
+  });
+}
+function validateProjectionOwnership2(projections) {
+  const existenceOwners = new Map;
+  const propertyOwners = new Map;
+  const linkOwners = new Map;
+  const telemetryOwners = new Map;
+  for (const { definition, ownership } of projections) {
+    for (const object of ownership.objects) {
+      if (object.existence) {
+        registerOwner(existenceOwners, object.objectTypeId, definition.id, `object type '${object.objectTypeId}' existence`);
+      }
+      for (const propertyId of object.propertyIds) {
+        registerOwner(propertyOwners, JSON.stringify([object.objectTypeId, propertyId]), definition.id, `property '${object.objectTypeId}.${propertyId}'`);
+      }
+    }
+    for (const link of ownership.links) {
+      registerOwner(linkOwners, JSON.stringify([link.sourceObjectTypeId, link.linkId]), definition.id, `link scope '${link.sourceObjectTypeId}.${link.linkId}'`);
+    }
+    for (const telemetry of ownership.telemetry) {
+      registerOwner(telemetryOwners, JSON.stringify([telemetry.objectTypeId, telemetry.propertyId]), definition.id, `telemetry source '${telemetry.objectTypeId}.${telemetry.propertyId}'`);
+    }
+  }
+}
+function registerOwner(owners, key, projectionId, description) {
+  const existing = owners.get(key);
+  if (existing !== undefined) {
+    throw new ProjectionValidationError2(`[Sixb] Projection '${projectionId}' overlaps ${description} owned by projection '${existing}'.`);
+  }
+  owners.set(key, projectionId);
+}
+function freezeOwnership(ownership) {
+  return Object.freeze({
+    objects: Object.freeze(ownership.objects.map((object) => Object.freeze({ ...object, propertyIds: Object.freeze([...object.propertyIds]) }))),
+    links: Object.freeze(ownership.links.map((link) => Object.freeze({ ...link }))),
+    telemetry: Object.freeze(ownership.telemetry.map((telemetry) => Object.freeze({ ...telemetry })))
+  });
+}
+
+// src/projections/validation.ts
+function validatePropertyMapping(objectType, mapping) {
+  const propertyIds = new Set(objectType.properties.map((p) => p.id));
+  const mappingKeys = Object.keys(mapping);
+  for (const key of mappingKeys) {
+    if (!propertyIds.has(key)) {
+      const available = [...propertyIds].sort().join(", ");
+      throw new ProjectionValidationError2(`Property '${key}' does not exist on object type '${objectType.id}'. ` + `Available properties: ${available}`);
+    }
+  }
+  const primaryProperties = objectType.properties.filter((p) => p.primary === true);
+  if (primaryProperties.length !== 1) {
+    throw new ProjectionValidationError2(`Object type '${objectType.id}' must have exactly one primary property, ` + `found ${primaryProperties.length}.`);
+  }
+  const primaryId = primaryProperties[0].id;
+  if (!(primaryId in mapping)) {
+    throw new ProjectionValidationError2(`Primary property '${primaryId}' of object type '${objectType.id}' ` + `must be included in the property mapping.`);
+  }
+}
+function validateAndLowerLinkMapping(objectType, linkMapping, propertyMapping) {
+  const linkIds = new Set(objectType.links.map((l) => l.id));
+  const linksById = new Map(objectType.links.map((l) => [l.id, l]));
+  const propertyIds = new Set(objectType.properties.map((p) => p.id));
+  for (const [key, descriptor] of Object.entries(linkMapping)) {
+    if (!linkIds.has(key)) {
+      const available = [...linkIds].sort().join(", ");
+      throw new ProjectionValidationError2(`Link '${key}' does not exist on object type '${objectType.id}'. ` + `Available links: ${available}`);
+    }
+    if (key !== descriptor.linkId) {
+      throw new ProjectionValidationError2(`Link mapping key '${key}' does not match descriptor linkId '${descriptor.linkId}'.`);
+    }
+    const link = linksById.get(key);
+    if (Array.isArray(link.targetObjectTypeId)) {
+      throw new ProjectionValidationError2(`Link '${key}' on object type '${objectType.id}' has a polymorphic target. ` + `FK projection of polymorphic links is not yet supported.`);
+    }
+    if (link.targetObjectTypeId === "*") {
+      throw new ProjectionValidationError2(`Link '${key}' on object type '${objectType.id}' has a wildcard target. ` + `FK projection of wildcard links is not supported.`);
+    }
+    const sourcePropertyId = descriptor.sourcePropertyId;
+    const sourceField = descriptor.sourceField;
+    if (sourcePropertyId && sourceField) {
+      throw new ProjectionValidationError2(`FK link '${key}' must use either sourceProperty or sourceField, not both.`);
+    }
+    if (!sourcePropertyId && !sourceField) {
+      throw new ProjectionValidationError2(`FK link '${key}' must declare sourceProperty or sourceField.`);
+    }
+    if (!sourcePropertyId) {
+      continue;
+    }
+    if (!propertyIds.has(sourcePropertyId)) {
+      const available = [...propertyIds].sort().join(", ");
+      throw new ProjectionValidationError2(`Source property '${sourcePropertyId}' does not exist on ` + `object type '${objectType.id}'. Available properties: ${available}`);
+    }
+    if (!(sourcePropertyId in propertyMapping)) {
+      throw new ProjectionValidationError2(`Source property '${sourcePropertyId}' for link '${key}' ` + `must be included in the property mapping.`);
+    }
+  }
+  return Object.fromEntries(Object.entries(linkMapping).map(([linkId, descriptor]) => [
+    linkId,
+    {
+      linkId: descriptor.linkId,
+      ...descriptor.sourcePropertyId !== undefined ? { sourcePropertyId: descriptor.sourcePropertyId } : {},
+      ...descriptor.sourceField !== undefined ? { sourceField: descriptor.sourceField } : {},
+      targetObjectTypeId: descriptor.targetObjectTypeId
+    }
+  ]));
+}
+function validateLinkProjectionTarget(linkToken) {
+  if (Array.isArray(linkToken.targetObjectTypeId)) {
+    throw new ProjectionValidationError2(`Link '${linkToken.id}' has a polymorphic target. ` + `Link projection of polymorphic links is not yet supported.`);
+  }
+  if (linkToken.targetObjectTypeId === "*") {
+    throw new ProjectionValidationError2(`Link '${linkToken.id}' has a wildcard target. ` + `Link projection of wildcard links is not supported.`);
+  }
+}
+function validateTelemetryProjectionFieldMapping2(projection, objectType, datasetColumnNames, valueTypesById, prefix) {
+  const mappedProperties = Object.entries(projection.properties);
+  if (mappedProperties.length === 0) {
+    throw new ProjectionValidationError2(`${prefix}: must map at least one telemetry property`);
+  }
+  const mappedFields = [
+    ["objectId", projection.objectIdField],
+    ["at", projection.atField]
+  ];
+  for (const [fieldRole, columnName] of mappedFields) {
+    if (!datasetColumnNames.has(columnName)) {
+      throw new ProjectionValidationError2(`${prefix}: ${fieldRole} field "${columnName}" references unknown dataset column ` + `on dataset "${projection.datasetId}"`);
+    }
+  }
+  const propertiesById = new Map(objectType.properties.map((property) => [property.id, property]));
+  const resolvedProperties = new Map;
+  for (const [propertyId, mapping] of mappedProperties) {
+    const property = propertiesById.get(propertyId);
+    if (!property) {
+      throw new ProjectionValidationError2(`${prefix}: unknown property "${propertyId}" on type "${projection.objectTypeId}"`);
+    }
+    if (property.mode !== "telemetry") {
+      throw new ProjectionValidationError2(`${prefix}: property "${propertyId}" on type "${projection.objectTypeId}" must be telemetry-enabled`);
+    }
+    for (const [fieldRole, columnName] of [
+      ["value", mapping.valueField],
+      ...mapping.unitField !== undefined ? [["unit", mapping.unitField]] : []
+    ]) {
+      if (!datasetColumnNames.has(columnName)) {
+        throw new ProjectionValidationError2(`${prefix}: property "${propertyId}" ${fieldRole} field "${columnName}" references ` + `unknown dataset column on dataset "${projection.datasetId}"`);
+      }
+    }
+    const semanticType = resolveSemanticType2(property, valueTypesById);
+    if (semanticType !== undefined && mapping.unitField === undefined) {
+      throw new ProjectionValidationError2(`${prefix}: property "${propertyId}" requires a unit field because it uses semantic type "${semanticType}"`);
+    }
+    if (semanticType === undefined && mapping.unitField !== undefined) {
+      throw new ProjectionValidationError2(`${prefix}: property "${propertyId}" cannot map a unit field because it has no semantic type`);
+    }
+    resolvedProperties.set(propertyId, property);
+  }
+  return resolvedProperties;
+}
+function validateProjectionsAtStartup(projections, ontology, datasetsById) {
+  const { objectProjections, linkProjections, telemetryProjections } = projections;
+  const objectTypesById = ontology.getObjectTypesById();
+  const primaryByTypeId = ontology.getPrimaryByTypeId();
+  const validatedObjectProjections = [];
+  const validatedLinkProjections = [];
+  const validatedTelemetryProjections = [];
+  validateMaterializationOntologyConstraints(ontology);
+  for (const projection of objectProjections) {
+    const prefix = `Projection "${projection.id}"`;
+    const dataset = datasetsById.get(projection.datasetId);
+    if (!dataset) {
+      throw new ProjectionValidationError2(`${prefix}: unknown dataset "${projection.datasetId}". ` + `Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+    }
+    const objectType = objectTypesById.get(projection.objectTypeId);
+    if (!objectType) {
+      throw new ProjectionValidationError2(`${prefix}: unknown object type "${projection.objectTypeId}"`);
+    }
+    const datasetColumnNames = new Set(dataset.schema.columns.map((column) => column.name));
+    const conflictResolution = projection.conflictResolution ?? { strategy: "editsWin" };
+    if (conflictResolution.strategy === "mostRecent") {
+      const sourceTimestamp = dataset.schema.columns.find((column) => column.name === conflictResolution.sourceTimestamp);
+      if (!sourceTimestamp) {
+        throw new ProjectionValidationError2(`${prefix}: source timestamp "${conflictResolution.sourceTimestamp}" references unknown ` + `dataset column on dataset "${projection.datasetId}"`);
+      }
+      if (sourceTimestamp.type !== "timestamp") {
+        throw new ProjectionValidationError2(`${prefix}: source timestamp "${conflictResolution.sourceTimestamp}" must reference a ` + `timestamp dataset column`);
+      }
+      if (sourceTimestamp.nullable === true) {
+        throw new ProjectionValidationError2(`${prefix}: source timestamp "${conflictResolution.sourceTimestamp}" must reference a ` + `non-null timestamp dataset column`);
+      }
+    }
+    const propertyIds = new Set(objectType.properties.map((p) => p.id));
+    for (const [propId, columnName] of Object.entries(projection.properties)) {
+      if (!propertyIds.has(propId)) {
+        throw new ProjectionValidationError2(`${prefix}: unknown property "${propId}" on type "${projection.objectTypeId}"`);
+      }
+      if (!datasetColumnNames.has(columnName)) {
+        throw new ProjectionValidationError2(`${prefix}: property "${propId}" references unknown dataset column "${columnName}" ` + `on dataset "${projection.datasetId}"`);
+      }
+      const property = objectType.properties.find((candidate) => candidate.id === propId);
+      if (property?.mode === "telemetry") {
+        throw new ProjectionValidationError2(`[Sixb] ${prefix}: source mappings cannot own telemetry property "${projection.objectTypeId}.${propId}"`);
+      }
+    }
+    const primaryId = primaryByTypeId.get(projection.objectTypeId);
+    if (!(primaryId in projection.properties)) {
+      throw new ProjectionValidationError2(`${prefix}: primary property "${primaryId}" must be in property mapping`);
+    }
+    const linkIds = new Set(objectType.links.map((l) => l.id));
+    for (const [linkId, fk] of Object.entries(projection.links)) {
+      if (!linkIds.has(linkId)) {
+        throw new ProjectionValidationError2(`${prefix}: FK link "${linkId}" references unknown link on type "${projection.objectTypeId}"`);
+      }
+      if (fk.linkId !== linkId) {
+        throw new ProjectionValidationError2(`${prefix}: FK link mapping key "${linkId}" does not match descriptor linkId "${fk.linkId}"`);
+      }
+      const sourcePropertyId = fk.sourcePropertyId;
+      const sourceField = fk.sourceField;
+      if (sourcePropertyId && sourceField) {
+        throw new ProjectionValidationError2(`${prefix}: FK link "${linkId}" must use either sourcePropertyId or sourceField, not both`);
+      }
+      if (!sourcePropertyId && !sourceField) {
+        throw new ProjectionValidationError2(`${prefix}: FK link "${linkId}" must declare sourcePropertyId or sourceField`);
+      }
+      if (sourcePropertyId && !propertyIds.has(sourcePropertyId)) {
+        throw new ProjectionValidationError2(`${prefix}: FK link "${linkId}" source property "${sourcePropertyId}" does not exist on type "${projection.objectTypeId}"`);
+      }
+      if (sourcePropertyId && !(sourcePropertyId in projection.properties)) {
+        throw new ProjectionValidationError2(`${prefix}: FK link "${linkId}" source property "${sourcePropertyId}" must be in property mapping`);
+      }
+      if (sourceField && !datasetColumnNames.has(sourceField)) {
+        throw new ProjectionValidationError2(`${prefix}: FK link "${linkId}" source field "${sourceField}" references unknown dataset column on dataset "${projection.datasetId}"`);
+      }
+      if (!objectTypesById.has(fk.targetObjectTypeId)) {
+        throw new ProjectionValidationError2(`${prefix}: FK link "${linkId}" target type "${fk.targetObjectTypeId}" is unknown`);
+      }
+      if (!primaryByTypeId.has(fk.targetObjectTypeId)) {
+        throw new ProjectionValidationError2(`${prefix}: FK link "${linkId}" target type "${fk.targetObjectTypeId}" has no primary property`);
+      }
+      const link = objectType.links.find((candidate) => candidate.id === linkId);
+      if (!ontology.isValidLinkTarget(link.targetObjectTypeId, fk.targetObjectTypeId)) {
+        throw new ProjectionValidationError2(`${prefix}: FK link "${linkId}" target type "${fk.targetObjectTypeId}" is not compatible with its declared target`);
+      }
+    }
+    validatedObjectProjections.push({
+      definition: projection,
+      dataset,
+      ownership: computeProjectionOwnership2(projection, ontology)
+    });
+  }
+  for (const projection of linkProjections) {
+    const prefix = `Projection "${projection.id}"`;
+    const dataset = datasetsById.get(projection.datasetId);
+    if (!dataset) {
+      throw new ProjectionValidationError2(`${prefix}: unknown dataset "${projection.datasetId}". ` + `Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+    }
+    if (!objectTypesById.has(projection.sourceObjectTypeId)) {
+      throw new ProjectionValidationError2(`${prefix}: unknown source type "${projection.sourceObjectTypeId}"`);
+    }
+    if (!objectTypesById.has(projection.targetObjectTypeId)) {
+      throw new ProjectionValidationError2(`${prefix}: unknown target type "${projection.targetObjectTypeId}"`);
+    }
+    const sourceType = objectTypesById.get(projection.sourceObjectTypeId);
+    const link = sourceType.links.find((candidate) => candidate.id === projection.linkId);
+    if (!link) {
+      throw new ProjectionValidationError2(`${prefix}: link "${projection.linkId}" does not exist on source type "${projection.sourceObjectTypeId}"`);
+    }
+    if (!ontology.isValidLinkTarget(link.targetObjectTypeId, projection.targetObjectTypeId)) {
+      throw new ProjectionValidationError2(`${prefix}: target type "${projection.targetObjectTypeId}" is not compatible with link "${projection.linkId}"`);
+    }
+    const datasetColumnNames = new Set(dataset.schema.columns.map((column) => column.name));
+    if (!datasetColumnNames.has(projection.sourceField)) {
+      throw new ProjectionValidationError2(`${prefix}: source field "${projection.sourceField}" references unknown dataset column ` + `on dataset "${projection.datasetId}"`);
+    }
+    if (!datasetColumnNames.has(projection.targetField)) {
+      throw new ProjectionValidationError2(`${prefix}: target field "${projection.targetField}" references unknown dataset column ` + `on dataset "${projection.datasetId}"`);
+    }
+    if (!primaryByTypeId.has(projection.sourceObjectTypeId)) {
+      throw new ProjectionValidationError2(`${prefix}: source type "${projection.sourceObjectTypeId}" has no primary property`);
+    }
+    if (!primaryByTypeId.has(projection.targetObjectTypeId)) {
+      throw new ProjectionValidationError2(`${prefix}: target type "${projection.targetObjectTypeId}" has no primary property`);
+    }
+    validatedLinkProjections.push({
+      definition: projection,
+      dataset,
+      ownership: computeProjectionOwnership2(projection, ontology)
+    });
+  }
+  for (const projection of telemetryProjections) {
+    const prefix = `Projection "${projection.id}"`;
+    const dataset = datasetsById.get(projection.datasetId);
+    if (!dataset) {
+      throw new ProjectionValidationError2(`${prefix}: unknown dataset "${projection.datasetId}". ` + `Add it to 'datasets' in createSixb() or export it from 'datasets/'.`);
+    }
+    const objectType = objectTypesById.get(projection.objectTypeId);
+    if (!objectType) {
+      throw new ProjectionValidationError2(`${prefix}: unknown object type "${projection.objectTypeId}"`);
+    }
+    const datasetColumnNames = new Set(dataset.schema.columns.map((column) => column.name));
+    validateTelemetryProjectionFieldMapping2(projection, objectType, datasetColumnNames, ontology.getValueTypesById(), prefix);
+    validatedTelemetryProjections.push({
+      definition: projection,
+      dataset,
+      ownership: computeProjectionOwnership2(projection, ontology)
+    });
+  }
+  const validatedProjections = [
+    ...validatedObjectProjections,
+    ...validatedLinkProjections,
+    ...validatedTelemetryProjections
+  ];
+  validateProjectionOwnership2(validatedProjections);
+  return {
+    objectProjections: validatedObjectProjections,
+    linkProjections: validatedLinkProjections,
+    telemetryProjections: validatedTelemetryProjections
+  };
+}
+function validateMaterializationOntologyConstraints(ontology) {
+  for (const objectType of ontology.getObjectTypesById().values()) {
+    for (const property of objectType.properties) {
+      if (property.mode === "telemetry" && property.required === true) {
+        throw new ProjectionValidationError2(`[Sixb] Telemetry property '${objectType.id}.${property.id}' cannot be required.`);
+      }
+    }
+    for (const link of objectType.links) {
+      for (const property of link.properties ?? []) {
+        if (property.mode === "telemetry") {
+          throw new ProjectionValidationError2(`[Sixb] Link property '${objectType.id}.${link.id}.${property.id}' cannot use telemetry mode.`);
+        }
+      }
+    }
+  }
+}
+
+// src/projections/builders.ts
+function assertNonEmpty2(value, field) {
+  if (!value.trim()) {
+    throw new ProjectionValidationError2(`Projection ${field} must not be empty.`);
+  }
+}
+function assertProjectionDataset(dataset) {
+  if (!dataset || dataset.kind !== "dataset" || typeof dataset.id !== "string") {
+    throw new ProjectionValidationError2("Projection dataset must be a dataset definition.");
+  }
+  assertNonEmpty2(dataset.id, "dataset id");
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function lowerForeignKeyMapping(mapping) {
+  const lowered = {};
+  for (const [linkId, descriptor] of Object.entries(mapping)) {
+    if (!descriptor)
+      continue;
+    lowered[linkId] = isForeignKeyDescriptor(descriptor) ? descriptor : fromForeignKey2(descriptor);
+  }
+  return lowered;
+}
+function isForeignKeyDescriptor(value) {
+  return isRecord2(value) && typeof value.linkId === "string";
+}
+function defineProjection2(id, target) {
+  if ("link" in target)
+    return buildLinkProjection(id, target);
+  if ("property" in target)
+    return buildTelemetryProjection(id, target);
+  return buildObjectTypeProjection(id, target);
+}
+function buildObjectTypeProjection(id, objectType) {
+  assertNonEmpty2(id, "id");
+  return {
+    fromDataset(dataset) {
+      assertProjectionDataset(dataset);
+      const datasetId = dataset.id;
+      return {
+        properties(mapping) {
+          const propertyMapping = mapping;
+          validatePropertyMapping(objectType, propertyMapping);
+          return objectProjectionBuilder({
+            id,
+            objectType,
+            datasetId,
+            propertyMapping,
+            links: {},
+            conflictResolution: { strategy: "editsWin" }
+          });
+        },
+        points(mapping) {
+          const pointMapping = lowerTelemetryPropertiesPointMapping(objectType, mapping);
+          return {
+            _tag: "TelemetryProjectionDefinition",
+            id,
+            objectTypeId: objectType.id,
+            datasetId,
+            objectIdField: pointMapping.objectId,
+            atField: pointMapping.at,
+            properties: pointMapping.properties
+          };
+        }
+      };
+    }
+  };
+}
+function objectProjectionBuilder(input) {
+  const definition = {
+    _tag: "ObjectProjectionDefinition",
+    id: input.id,
+    objectTypeId: input.objectType.id,
+    datasetId: input.datasetId,
+    properties: { ...input.propertyMapping },
+    links: { ...input.links },
+    conflictResolution: { ...input.conflictResolution }
+  };
+  return Object.assign(definition, {
+    withLinks(linkMapping) {
+      const loweredLinkMapping = lowerForeignKeyMapping(linkMapping);
+      const validatedLinks = validateAndLowerLinkMapping(input.objectType, loweredLinkMapping, input.propertyMapping);
+      return objectProjectionBuilder({ ...input, links: validatedLinks });
+    },
+    resolveConflicts(resolution) {
+      validateConflictResolution(resolution);
+      return objectProjectionBuilder({
+        ...input,
+        conflictResolution: resolution
+      });
+    }
+  });
+}
+function validateConflictResolution(resolution) {
+  if (resolution.strategy === "editsWin")
+    return;
+  assertNonEmpty2(resolution.sourceTimestamp, "source timestamp field");
+}
+function buildTelemetryProjection(id, propertyToken) {
+  assertNonEmpty2(id, "id");
+  validateTelemetryProjectionProperty(propertyToken);
+  return {
+    fromDataset(dataset) {
+      assertProjectionDataset(dataset);
+      const datasetId = dataset.id;
+      return {
+        points(mapping) {
+          const pointMapping = lowerTelemetryPointMapping(mapping);
+          return {
+            _tag: "TelemetryProjectionDefinition",
+            id,
+            objectTypeId: propertyToken.objectTypeId,
+            datasetId,
+            objectIdField: pointMapping.objectId,
+            atField: pointMapping.at,
+            properties: {
+              [propertyToken.id]: {
+                valueField: pointMapping.value,
+                ...pointMapping.unit !== undefined ? { unitField: pointMapping.unit } : {}
+              }
+            }
+          };
+        }
+      };
+    }
+  };
+}
+function validateTelemetryProjectionProperty(propertyToken) {
+  if (propertyToken.property.mode !== "telemetry") {
+    throw new ProjectionValidationError2(`Projection property '${propertyToken.objectTypeId}.${propertyToken.id}' must be telemetry-enabled.`);
+  }
+}
+function lowerTelemetryPointMapping(mapping) {
+  const allowedKeys = new Set(["objectId", "at", "value", "unit"]);
+  for (const key of Object.keys(mapping)) {
+    if (!allowedKeys.has(key)) {
+      throw new ProjectionValidationError2(`Telemetry projection point mapping contains unknown key '${key}'.`);
+    }
+  }
+  if (mapping.objectId === undefined) {
+    throw new ProjectionValidationError2("Telemetry projection point mapping requires objectId.");
+  }
+  if (mapping.at === undefined) {
+    throw new ProjectionValidationError2("Telemetry projection point mapping requires at.");
+  }
+  if (mapping.value === undefined) {
+    throw new ProjectionValidationError2("Telemetry projection point mapping requires value.");
+  }
+  assertNonEmpty2(mapping.objectId, "objectId field");
+  assertNonEmpty2(mapping.at, "at field");
+  assertNonEmpty2(mapping.value, "value field");
+  if (mapping.unit !== undefined) {
+    assertNonEmpty2(mapping.unit, "unit field");
+  }
+  return {
+    objectId: mapping.objectId,
+    at: mapping.at,
+    value: mapping.value,
+    ...mapping.unit !== undefined ? { unit: mapping.unit } : {}
+  };
+}
+function lowerTelemetryPropertiesPointMapping(objectType, mapping) {
+  const allowedKeys = new Set(["objectId", "at", "properties"]);
+  for (const key of Object.keys(mapping)) {
+    if (!allowedKeys.has(key)) {
+      throw new ProjectionValidationError2(`Telemetry projection point mapping contains unknown key '${key}'.`);
+    }
+  }
+  if (mapping.objectId === undefined) {
+    throw new ProjectionValidationError2("Telemetry projection point mapping requires objectId.");
+  }
+  if (mapping.at === undefined) {
+    throw new ProjectionValidationError2("Telemetry projection point mapping requires at.");
+  }
+  if (mapping.properties === undefined) {
+    throw new ProjectionValidationError2("Telemetry projection point mapping requires properties.");
+  }
+  if (!isRecord2(mapping.properties)) {
+    throw new ProjectionValidationError2("Telemetry projection point mapping properties must be an object.");
+  }
+  assertNonEmpty2(mapping.objectId, "objectId field");
+  assertNonEmpty2(mapping.at, "at field");
+  const propertyEntries = Object.entries(mapping.properties);
+  if (propertyEntries.length === 0) {
+    throw new ProjectionValidationError2("Telemetry projection point mapping requires at least one property.");
+  }
+  const propertiesById = new Map(objectType.properties.map((property) => [property.id, property]));
+  const properties = {};
+  for (const [propertyId, input] of propertyEntries) {
+    const property = propertiesById.get(propertyId);
+    if (!property) {
+      throw new ProjectionValidationError2(`Property '${propertyId}' does not exist on object type '${objectType.id}'.`);
+    }
+    if (property.mode !== "telemetry") {
+      throw new ProjectionValidationError2(`Projection property '${objectType.id}.${propertyId}' must be telemetry-enabled.`);
+    }
+    properties[propertyId] = lowerTelemetryPropertyMapping(propertyId, input);
+  }
+  return { objectId: mapping.objectId, at: mapping.at, properties };
+}
+function lowerTelemetryPropertyMapping(propertyId, input) {
+  if (typeof input === "string") {
+    assertNonEmpty2(input, `property '${propertyId}' value field`);
+    return { valueField: input };
+  }
+  if (!isRecord2(input)) {
+    throw new ProjectionValidationError2(`Telemetry projection property '${propertyId}' must map a value column or value/unit columns.`);
+  }
+  const allowedKeys = new Set(["value", "unit"]);
+  for (const key of Object.keys(input)) {
+    if (!allowedKeys.has(key)) {
+      throw new ProjectionValidationError2(`Telemetry projection property '${propertyId}' contains unknown key '${key}'.`);
+    }
+  }
+  if (typeof input.value !== "string") {
+    throw new ProjectionValidationError2(`Telemetry projection property '${propertyId}' requires a value field.`);
+  }
+  if (typeof input.unit !== "string") {
+    throw new ProjectionValidationError2(`Telemetry projection property '${propertyId}' requires a unit field.`);
+  }
+  assertNonEmpty2(input.value, `property '${propertyId}' value field`);
+  assertNonEmpty2(input.unit, `property '${propertyId}' unit field`);
+  return { valueField: input.value, unitField: input.unit };
+}
+function fromForeignKey2(input) {
+  validateLinkProjectionTarget(input.link);
+  if (input.sourceProperty) {
+    return {
+      linkId: input.link.id,
+      sourcePropertyId: input.sourceProperty.id,
+      targetObjectTypeId: input.target.id
+    };
+  }
+  if (input.sourceField === undefined) {
+    throw new ProjectionValidationError2("Foreign key sourceField is required.");
+  }
+  assertNonEmpty2(input.sourceField, "source field");
+  return {
+    linkId: input.link.id,
+    sourceField: input.sourceField,
+    targetObjectTypeId: input.target.id
+  };
+}
+function buildLinkProjection(id, linkToken) {
+  assertNonEmpty2(id, "id");
+  validateLinkProjectionTarget(linkToken);
+  return {
+    fromDataset(dataset) {
+      assertProjectionDataset(dataset);
+      const datasetId = dataset.id;
+      return {
+        sourceField(columnName) {
+          assertNonEmpty2(columnName, "source field");
+          return {
+            targetField(targetColumnName) {
+              assertNonEmpty2(targetColumnName, "target field");
+              return {
+                _tag: "LinkProjectionDefinition",
+                id,
+                linkId: linkToken.id,
+                sourceObjectTypeId: linkToken.objectTypeId,
+                targetObjectTypeId: linkToken.targetObjectTypeId,
+                datasetId,
+                sourceField: columnName,
+                targetField: targetColumnName
+              };
+            }
+          };
+        }
+      };
+    }
+  };
+}
+function isObjectProjectionDefinition2(value) {
+  if (!isRecord2(value))
+    return false;
+  return value._tag === "ObjectProjectionDefinition" && typeof value.id === "string" && typeof value.objectTypeId === "string" && typeof value.datasetId === "string" && isRecord2(value.properties) && isRecord2(value.links) && isSourceEditConflictResolution(value.conflictResolution);
+}
+function isSourceEditConflictResolution(value) {
+  if (value === undefined)
+    return true;
+  if (!isRecord2(value) || typeof value.strategy !== "string")
+    return false;
+  if (value.strategy === "editsWin")
+    return value.sourceTimestamp === undefined;
+  return value.strategy === "mostRecent" && typeof value.sourceTimestamp === "string";
+}
+function isLinkProjectionDefinition2(value) {
+  if (!isRecord2(value))
+    return false;
+  return value._tag === "LinkProjectionDefinition" && typeof value.id === "string" && typeof value.linkId === "string" && typeof value.sourceObjectTypeId === "string" && typeof value.targetObjectTypeId === "string" && typeof value.datasetId === "string" && typeof value.sourceField === "string" && typeof value.targetField === "string";
+}
+function isTelemetryProjectionDefinition2(value) {
+  if (!isRecord2(value))
+    return false;
+  return value._tag === "TelemetryProjectionDefinition" && typeof value.id === "string" && typeof value.objectTypeId === "string" && typeof value.datasetId === "string" && typeof value.objectIdField === "string" && typeof value.atField === "string" && isTelemetryProjectionProperties(value.properties);
+}
+function isTelemetryProjectionProperties(value) {
+  if (!isRecord2(value) || Object.keys(value).length === 0)
+    return false;
+  return Object.values(value).every((mapping) => isRecord2(mapping) && typeof mapping.valueField === "string" && (mapping.unitField === undefined || typeof mapping.unitField === "string"));
+}
+function isProjectionDefinition2(value) {
+  return isObjectProjectionDefinition2(value) || isLinkProjectionDefinition2(value) || isTelemetryProjectionDefinition2(value);
+}
+function projectionTargetOf2(projection) {
+  return projection._tag === "LinkProjectionDefinition" ? {
+    sourceObjectTypeId: projection.sourceObjectTypeId,
+    targetObjectTypeId: projection.targetObjectTypeId
+  } : { objectTypeId: projection.objectTypeId };
+}
+
+// src/authorization/run-visibility.ts
+function canViewActionRun2(authorization, run) {
+  if (!authorization) {
+    return true;
+  }
+  if (!isAllowed2(authorization, { kind: "action.apply", actionId: run.actionId })) {
+    return false;
+  }
+  return run.subject.kind !== "object" ? true : isAllowed2(authorization, {
+    kind: "object.view",
+    objectTypeId: run.subject.objectTypeId
+  });
+}
+function canViewWorkflowRun2(authorization, run) {
+  return !authorization || isAllowed2(authorization, { kind: "workflow.run", workflowId: run.workflowId });
+}
+function canViewWorkflowIntervention2(authorization, intervention) {
+  return !authorization || isAllowed2(authorization, { kind: "workflow.run", workflowId: intervention.workflowId });
+}
+function canViewPipelineRun2(authorization, run) {
+  return !authorization || isAllowed2(authorization, { kind: "pipeline.run", pipelineId: run.pipelineId });
+}
+function canViewProjectionRun2(authorization, target) {
+  if (!authorization)
+    return true;
+  const canView = (objectTypeId) => isAllowed2(authorization, { kind: "object.view", objectTypeId });
+  if ("sourceObjectTypeId" in target) {
+    return canView(target.sourceObjectTypeId) && canView(target.targetObjectTypeId);
+  }
+  return canView(target.objectTypeId);
+}
+function canViewProjection2(authorization, projection) {
+  return canViewProjectionRun2(authorization, projectionTargetOf2(projection));
+}
+// src/authorization/types.ts
+function emptyGrantIndex2() {
+  return emptyGrantSets();
+}
+export { ProjectionValidationError2, computeProjectionOwnership2, validateProjectionOwnership2, validateTelemetryProjectionFieldMapping2, validateProjectionsAtStartup, defineProjection2, fromForeignKey2, isObjectProjectionDefinition2, isLinkProjectionDefinition2, isTelemetryProjectionDefinition2, isProjectionDefinition2, projectionTargetOf2, agentServiceAccountId2, GRANT_KINDS, grantKindOf, MAX_OBJECT_READ_FACETS2, ObjectReadLimitExceededError2, snapshotObjectReadExecutionLimits2, assertObjectReadFacetCount2, assertObjectReadOutputWithinLimit2, createPrincipalRuntimeAuthorization, createAgentRuntimeAuthorization, createDisabledRuntimeAuthorization, createDelegatedRuntimeAuthorization, createTrustedPrimitiveRuntimeAuthorization, resolveRuntimeAuthorizationForProject, getAuthorizationRef, captureExecutionScope, resolveExecutionScopeAuthorization, AuthorizationError2, evaluate2, isAllowed2, assertAuthorized2, isRuntimeAllowed2, assertRuntimeAuthorizationBound2, assertCanEdit2, assertCanAppendTelemetry2, assertCanManageConnector2, assertPrivileged2, assertProviderAccess2, isApplicationAccessControlled2, canAccessApplication2, canViewEvent2, resolveRoleGrants2, resolveAuthorizationContext2, canViewActionRun2, canViewWorkflowRun2, canViewWorkflowIntervention2, canViewPipelineRun2, canViewProjectionRun2, canViewProjection2, emptyGrantIndex2 };
+
+//# debugId=C7649C713C108F6A64756E2164756E21