@sixb/core 0.1.0 → 0.1.2

package/src/objects/execution.ts

@@ -0,0 +1,346 @@
+import { assertAuthorized, isAllowed } from "../authorization"
+import type { ExecutionContext } from "../execution"
+import type { ValueType } from "../ontology"
+import { assertObjectTypeRegistered } from "../ontology"
+import type { ObjectTypeWithPropertyTokens } from "../ontology/tokens"
+import type {
+  ListResult,
+  ObjectByIdHandle,
+  ObjectSet,
+  OntologySource,
+  RegisteredObjectType,
+  RegisteredValueTypes,
+  SixbRuntimeContext,
+} from "../runtime/types"
+import type {
+  LinkDirection,
+  ObjectLinkRow,
+  ObjectRow,
+  TimeseriesHistoryBatchInput,
+  TimeseriesHistoryBatchResult,
+  TimeseriesPoint,
+} from "../storage"
+import {
+  countObjects,
+  type ExecuteObjectCountInput,
+  type ExecuteObjectCountResult,
+  type ExecuteObjectExistsInput,
+  type ExecuteObjectExistsResult,
+  type ExecuteObjectFacetsInput,
+  type ExecuteObjectFacetsResult,
+  type ExecuteObjectQueryInput,
+  type ExecuteObjectQueryResult,
+  executeObjectQuery,
+  existsObjects,
+  facetObjects,
+} from "./query"
+import { createObjectSet } from "./sdk"
+import type { ListObjectsParams } from "./service"
+import * as objectService from "./service"
+import { getTelemetryHistoryBatch } from "./telemetry"
+
+export interface ExecutionObjectOperations {
+  listTypes(): readonly ObjectTypeWithPropertyTokens[]
+  getTypeById(objectTypeId: string): ObjectTypeWithPropertyTokens | null
+  resolveType(objectTypeId: string): ObjectTypeWithPropertyTokens
+  getValueTypesById(): ReturnType<SixbRuntimeContext["ontology"]["getValueTypesById"]>
+  getPrimaryPropertyId(objectTypeId: string): string
+  listSubTypes(objectTypeId: string): string[]
+  isValidLinkTarget(expected: string | string[], actual: string): boolean
+  get(objectTypeId: string, primaryId: string): Promise<ObjectRow | null>
+  list(params: ListObjectsParams): Promise<ListResult<ObjectRow>>
+  upsert(objectTypeId: string, properties: Record<string, unknown>): Promise<ObjectRow>
+  upsertBatch(
+    objectTypeId: string,
+    items: readonly { properties: Record<string, unknown> }[]
+  ): ReturnType<typeof objectService.upsertObjectBatch>
+  appendTelemetry(
+    objectTypeId: string,
+    items: readonly { id: string; properties: Record<string, unknown>; at?: Date }[]
+  ): Promise<void>
+  upsertLink(
+    objectTypeId: string,
+    sourceId: string,
+    linkId: string,
+    target: { targetTypeId: string; targetId: string; properties?: Record<string, unknown> }
+  ): Promise<void>
+  upsertLinkBatch(
+    items: readonly {
+      objectTypeId: string
+      sourceId: string
+      linkId: string
+      target: { targetTypeId: string; targetId: string; properties?: Record<string, unknown> }
+    }[]
+  ): ReturnType<typeof objectService.upsertLinkBatch>
+  removeLink(
+    objectTypeId: string,
+    sourceId: string,
+    linkId: string,
+    target: { targetTypeId: string; targetId: string }
+  ): Promise<void>
+}
+
+export interface ExecutionObjectByIdHandle<
+  TObjectType extends ObjectTypeWithPropertyTokens,
+  TValueTypes extends readonly ValueType[],
+> {
+  get: ObjectByIdHandle<TObjectType, TValueTypes>["get"]
+  listLinks: ObjectByIdHandle<TObjectType, TValueTypes>["listLinks"]
+  requestAction: ObjectByIdHandle<TObjectType, TValueTypes>["requestAction"]
+  requestActionAndWait: ObjectByIdHandle<TObjectType, TValueTypes>["requestActionAndWait"]
+  link: ObjectByIdHandle<TObjectType, TValueTypes>["link"]
+  unlink: ObjectByIdHandle<TObjectType, TValueTypes>["unlink"]
+  delete: ObjectByIdHandle<TObjectType, TValueTypes>["delete"]
+  restore: ObjectByIdHandle<TObjectType, TValueTypes>["restore"]
+  telemetry: ObjectByIdHandle<TObjectType, TValueTypes>["telemetry"]
+}
+
+export interface ExecutionObjectSet<
+  TObjectType extends ObjectTypeWithPropertyTokens,
+  TValueTypes extends readonly ValueType[],
+  TRegisteredObjectTypes extends ObjectTypeWithPropertyTokens = TObjectType,
+> {
+  get: ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes>["get"]
+  list: ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes>["list"]
+  query: ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes>["query"]
+  requestAction: ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes>["requestAction"]
+  requestActionAndWait: ObjectSet<
+    TObjectType,
+    TValueTypes,
+    TRegisteredObjectTypes
+  >["requestActionAndWait"]
+  upsert: ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes>["upsert"]
+  upsertLink: ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes>["upsertLink"]
+  removeLink: ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes>["removeLink"]
+  appendTelemetryBatch: ObjectSet<
+    TObjectType,
+    TValueTypes,
+    TRegisteredObjectTypes
+  >["appendTelemetryBatch"]
+
+  byId(id: string): ExecutionObjectByIdHandle<TObjectType, TValueTypes>
+}
+
+export interface ObjectsRuntime<TOntologySources extends readonly OntologySource[]>
+  extends ExecutionObjectOperations {
+  <TObjectType extends RegisteredObjectType<TOntologySources>>(
+    objectType: TObjectType
+  ): ExecutionObjectSet<
+    TObjectType,
+    RegisteredValueTypes<TOntologySources>,
+    RegisteredObjectType<TOntologySources>
+  >
+  executeQuery(input: Omit<ExecuteObjectQueryInput, "projectId">): Promise<ExecuteObjectQueryResult>
+  count(input: Omit<ExecuteObjectCountInput, "projectId">): Promise<ExecuteObjectCountResult>
+  exists(input: Omit<ExecuteObjectExistsInput, "projectId">): Promise<ExecuteObjectExistsResult>
+  facet(input: Omit<ExecuteObjectFacetsInput, "projectId">): Promise<ExecuteObjectFacetsResult>
+  listLinks(input: {
+    readonly objectTypeId: string
+    readonly objectId: string
+    readonly linkId?: string
+    readonly direction?: LinkDirection
+  }): Promise<readonly ObjectLinkRow[]>
+  getTelemetryHistoryBatch(
+    input: Omit<TimeseriesHistoryBatchInput, "projectId">
+  ): Promise<readonly TimeseriesHistoryBatchResult[]>
+  getTelemetryHistory(input: {
+    readonly objectTypeId: string
+    readonly objectId: string
+    readonly propertyId: string
+    readonly from?: Date
+    readonly to?: Date
+    readonly limit?: number
+    readonly order?: "asc" | "desc"
+  }): Promise<readonly TimeseriesPoint[]>
+  getLatestTelemetry(input: {
+    readonly objectTypeId: string
+    readonly objectId: string
+    readonly propertyId: string
+  }): Promise<TimeseriesPoint | null>
+}
+
+export function createObjectsRuntime<TOntologySources extends readonly OntologySource[]>(
+  runtime: SixbRuntimeContext,
+  execution: ExecutionContext
+): ObjectsRuntime<TOntologySources> {
+  const objects = Object.assign(
+    <TObjectType extends RegisteredObjectType<TOntologySources>>(objectType: TObjectType) => {
+      assertObjectTypeRegistered(runtime.ontology.getObjectTypesById(), objectType)
+      return createObjectSet<
+        TObjectType,
+        RegisteredObjectType<TOntologySources>,
+        RegisteredValueTypes<TOntologySources>
+      >({ ...runtime, execution, objectType }) as ExecutionObjectSet<
+        TObjectType,
+        RegisteredValueTypes<TOntologySources>,
+        RegisteredObjectType<TOntologySources>
+      >
+    },
+    {
+      listTypes: () =>
+        runtime.ontology.listObjectTypes().filter((objectType) =>
+          isAllowed(runtime.authorization, {
+            kind: "object.view",
+            objectTypeId: objectType.id,
+          })
+        ),
+      getTypeById: (objectTypeId: string) => {
+        const objectType = runtime.ontology.getObjectTypeById(objectTypeId)
+        return objectType && isAllowed(runtime.authorization, { kind: "object.view", objectTypeId })
+          ? objectType
+          : null
+      },
+      resolveType: (objectTypeId: string) => {
+        assertAuthorized(runtime, { kind: "object.view", objectTypeId })
+        return runtime.ontology.resolveObjectType(objectTypeId)
+      },
+      getValueTypesById: () => runtime.ontology.getValueTypesById(),
+      listSubTypes: (objectTypeId: string) => runtime.ontology.listSubTypes(objectTypeId),
+      isValidLinkTarget: (expected: string | string[], actual: string) =>
+        runtime.ontology.isValidLinkTarget(expected, actual),
+      executeQuery: (input: Omit<ExecuteObjectQueryInput, "projectId">) =>
+        executeObjectQuery(
+          { projectId: runtime.projectId, ...input },
+          {
+            ontology: runtime.ontology,
+            storage: runtime.storage.objects,
+            runtimeAuthorization: runtime.runtimeAuthorization,
+            authorization: runtime.authorization,
+          }
+        ),
+      count: (input: Omit<ExecuteObjectCountInput, "projectId">) =>
+        countObjects(
+          { projectId: runtime.projectId, ...input },
+          {
+            ontology: runtime.ontology,
+            storage: runtime.storage.objects,
+            runtimeAuthorization: runtime.runtimeAuthorization,
+            authorization: runtime.authorization,
+          }
+        ),
+      exists: (input: Omit<ExecuteObjectExistsInput, "projectId">) =>
+        existsObjects(
+          { projectId: runtime.projectId, ...input },
+          {
+            ontology: runtime.ontology,
+            storage: runtime.storage.objects,
+            runtimeAuthorization: runtime.runtimeAuthorization,
+            authorization: runtime.authorization,
+          }
+        ),
+      facet: (input: Omit<ExecuteObjectFacetsInput, "projectId">) =>
+        facetObjects(
+          { projectId: runtime.projectId, ...input },
+          {
+            ontology: runtime.ontology,
+            storage: runtime.storage.objects,
+            runtimeAuthorization: runtime.runtimeAuthorization,
+            authorization: runtime.authorization,
+          }
+        ),
+      listLinks: async (input: {
+        objectTypeId: string
+        objectId: string
+        linkId?: string
+        direction?: LinkDirection
+      }) => {
+        assertAuthorized(runtime, { kind: "object.view", objectTypeId: input.objectTypeId })
+        const links = await runtime.storage.objects.listLinks({
+          projectId: runtime.projectId,
+          ...input,
+        })
+        return links.filter(
+          (link) =>
+            isAllowed(runtime.authorization, {
+              kind: "object.view",
+              objectTypeId: link.sourceTypeId,
+            }) &&
+            isAllowed(runtime.authorization, {
+              kind: "object.view",
+              objectTypeId: link.targetTypeId,
+            })
+        )
+      },
+      getTelemetryHistoryBatch: (input: Omit<TimeseriesHistoryBatchInput, "projectId">) =>
+        getTelemetryHistoryBatch(
+          { projectId: runtime.projectId, ...input },
+          {
+            storage: runtime.storage.timeseries,
+            runtimeAuthorization: runtime.runtimeAuthorization,
+            authorization: runtime.authorization,
+          }
+        ),
+      getTelemetryHistory: (input: {
+        objectTypeId: string
+        objectId: string
+        propertyId: string
+        from?: Date
+        to?: Date
+        limit?: number
+        order?: "asc" | "desc"
+      }) => {
+        assertAuthorized(runtime, { kind: "object.view", objectTypeId: input.objectTypeId })
+        return runtime.storage.timeseries.getHistory({
+          projectId: runtime.projectId,
+          ...input,
+        })
+      },
+      getLatestTelemetry: (input: {
+        objectTypeId: string
+        objectId: string
+        propertyId: string
+      }) => {
+        assertAuthorized(runtime, { kind: "object.view", objectTypeId: input.objectTypeId })
+        return runtime.storage.timeseries.getLatest({
+          projectId: runtime.projectId,
+          ...input,
+        })
+      },
+      list: (params: ListObjectsParams) => objectService.listObjects(runtime, params),
+      get: async (objectTypeId: string, primaryId: string) => {
+        assertAuthorized(runtime, { kind: "object.view", objectTypeId })
+        return runtime.storage.objects.getByPrimaryId({
+          projectId: runtime.projectId,
+          objectTypeId,
+          primaryId,
+        })
+      },
+      getPrimaryPropertyId: (objectTypeId: string) => {
+        assertAuthorized(runtime, { kind: "object.view", objectTypeId })
+        return runtime.ontology.getPrimaryPropertyId(objectTypeId)
+      },
+      upsert: (objectTypeId: string, properties: Record<string, unknown>) =>
+        objectService.upsertObject(runtime, objectTypeId, properties),
+      upsertBatch: (
+        objectTypeId: string,
+        items: readonly { properties: Record<string, unknown> }[]
+      ) => objectService.upsertObjectBatch(runtime, objectTypeId, items),
+      upsertLink: (
+        objectTypeId: string,
+        sourceId: string,
+        linkId: string,
+        target: { targetTypeId: string; targetId: string; properties?: Record<string, unknown> }
+      ) => objectService.upsertLink(runtime, objectTypeId, sourceId, linkId, target),
+      upsertLinkBatch: (
+        items: readonly {
+          objectTypeId: string
+          sourceId: string
+          linkId: string
+          target: { targetTypeId: string; targetId: string; properties?: Record<string, unknown> }
+        }[]
+      ) => objectService.upsertLinkBatch(runtime, items),
+      removeLink: (
+        objectTypeId: string,
+        sourceId: string,
+        linkId: string,
+        target: { targetTypeId: string; targetId: string }
+      ) => objectService.removeLink(runtime, objectTypeId, sourceId, linkId, target),
+      appendTelemetry: (
+        objectTypeId: string,
+        items: readonly { id: string; properties: Record<string, unknown>; at?: Date }[]
+      ) => objectService.appendTelemetry(runtime, objectTypeId, items),
+    }
+  )
+
+  return objects as ObjectsRuntime<TOntologySources>
+}

package/src/objects/materializer-adapter.ts

@@ -8,7 +8,6 @@
  */
 
 import { randomUUID } from "node:crypto"
-import type { EventActor } from "../events/envelope"
 import type { JsonValue } from "../json"
 import type {
   EditCommitResult,
@@ -37,12 +36,7 @@ import type { ObjectRow } from "../storage"
 import { ObjectError } from "./errors"
 
 /** The runtime pieces one commit needs. */
-// `authorization` is here only so a commit can name its actor; it stays optional, so every existing
-// privileged caller still satisfies the type.
-export type RuntimeMaterializerContext = Pick<
-  SixbRuntimeContext,
-  "projectId" | "storage" | "authorization"
->
+export type RuntimeMaterializerContext = Pick<SixbRuntimeContext, "projectId" | "storage">
 
 /** One caller-supplied batch item, lowered to the operations it contributes. */
 export interface RuntimeBatchGroup {
@@ -57,20 +51,6 @@ export interface RuntimeBatchCommit {
   readonly outcomes: ReadonlyMap<number, readonly OntologyOperationOutcome[]>
 }
 
-/**
- * The principal behind a runtime write, when there is one.
- *
- * `origin: { kind: "runtime" }` already says a write bypassed an Action; this says who made it.
- * Absent on a privileged caller (workers, syncs, tests), which is what makes the field's absence
- * meaningful rather than merely unset: an event with no actor was written by the system itself.
- *
- * A `Principal` is an `EventActor` — same literals, no translation.
- */
-function runtimeActor(ctx: RuntimeMaterializerContext): { readonly actor?: EventActor } {
-  const principal = ctx.authorization?.principal
-  return principal === undefined ? {} : { actor: principal }
-}
-
 /**
  * Commits ordered operations as one atomic runtime commit.
  *
@@ -85,7 +65,6 @@ export async function commitRuntimeOperations(
   const commit = await mutations.commitEdits({
     mode: "atomic",
     source: { kind: "runtime", requestId: randomUUID() },
-    ...runtimeActor(ctx),
     operations,
     expectedObjects: [],
     expectedLinks: [],
@@ -120,7 +99,6 @@ export async function commitRuntimeBatch(
   const commit = await mutations.commitEdits({
     mode: "continue",
     source: { kind: "runtime", requestId: randomUUID() },
-    ...runtimeActor(ctx),
     operations,
     ...(operationGroups.length > 0 ? { operationGroups } : {}),
   })

package/src/objects/query/executor.ts

@@ -1,4 +1,5 @@
 import { type AuthorizationContext, assertAuthorized } from "../../authorization"
+import type { RuntimeAuthorization } from "../../execution/types"
 import type { OntologyRegistry } from "../../ontology"
 import type {
   CountObjectsResult,
@@ -60,6 +61,8 @@ export interface QueryExecutorOptions
   maxExpansionFanout?: number
   /** When present, every object type the query touches must be viewable. */
   authorization?: AuthorizationContext
+  /** Registered execution capability for queries reached through a bound Sixb SDK. */
+  runtimeAuthorization?: RuntimeAuthorization
 }
 
 export interface ExecuteObjectQueryInput {
@@ -120,26 +123,6 @@ const DEFAULT_MAX_EXPANSION_FANOUT = 1_000
 // opaque and should only be interpreted by the provider that returned them.
 const PAGE_TOKEN_PREFIX = "offset:"
 
-export class QueryExecutor {
-  constructor(private readonly options: QueryExecutorOptions) {}
-
-  async execute(input: ExecuteObjectQueryInput): Promise<ExecuteObjectQueryResult> {
-    return executeObjectQuery(input, this.options)
-  }
-
-  async count(input: ExecuteObjectCountInput): Promise<ExecuteObjectCountResult> {
-    return countObjects(input, this.options)
-  }
-
-  async exists(input: ExecuteObjectExistsInput): Promise<ExecuteObjectExistsResult> {
-    return existsObjects(input, this.options)
-  }
-
-  async facets(input: ExecuteObjectFacetsInput): Promise<ExecuteObjectFacetsResult> {
-    return facetObjects(input, this.options)
-  }
-}
-
 export async function executeObjectQuery(
   input: ExecuteObjectQueryInput,
   options: QueryExecutorOptions
@@ -151,7 +134,7 @@ export async function executeObjectQuery(
     maxPageSize: options.maxPageSize,
     normalize: false,
   })
-  assertQueryViewable(validated, options.authorization)
+  assertQueryViewable(validated, options)
   const capabilities = options.storage.queryCapabilities()
   const hasQueryObjects = typeof options.storage.queryObjects === "function"
   const hasCountObjects = typeof options.storage.countObjects === "function"
@@ -218,7 +201,7 @@ export async function countObjects(
     maxPageSize: options.maxPageSize,
     normalize: false,
   })
-  assertQueryViewable(validated, options.authorization)
+  assertQueryViewable(validated, options)
   const capabilities = options.storage.queryCapabilities()
   const hasQueryObjects = typeof options.storage.queryObjects === "function"
   const hasCountObjects = typeof options.storage.countObjects === "function"
@@ -278,7 +261,7 @@ export async function existsObjects(
     maxPageSize: options.maxPageSize,
     normalize: false,
   })
-  assertQueryViewable(validated, options.authorization)
+  assertQueryViewable(validated, options)
   const capabilities = options.storage.queryCapabilities()
   const hasQueryObjects = typeof options.storage.queryObjects === "function"
   const hasCountObjects = typeof options.storage.countObjects === "function"
@@ -338,7 +321,7 @@ export async function facetObjects(
     maxPageSize: options.maxPageSize,
     normalize: false,
   })
-  assertQueryViewable(validated, options.authorization)
+  assertQueryViewable(validated, options)
   const facets = validateFacetRequests(input.facets, validated.result.objectTypeIds, options)
   const aggregateQuery = stripOuterRowShape(validated.query)
   const capabilities = options.storage.queryCapabilities()
@@ -399,12 +382,15 @@ export async function facetObjects(
 // grant for every object type it touches, before any storage call runs.
 function assertQueryViewable(
   validated: ValidatedObjectQuery,
-  authorization: AuthorizationContext | undefined
+  authorization: Pick<QueryExecutorOptions, "authorization" | "runtimeAuthorization">
 ): void {
-  assertAuthorized(
-    { authorization },
-    { kind: "object.query", touchedObjectTypeIds: validated.touchedObjectTypeIds }
-  )
+  // The query engine is also a storage-level utility. Authorization is activated by a runtime
+  // context; execution SDKs always provide a registered capability, including auth-disabled ones.
+  if (!authorization.runtimeAuthorization && !authorization.authorization) return
+  assertAuthorized(authorization, {
+    kind: "object.query",
+    touchedObjectTypeIds: validated.touchedObjectTypeIds,
+  })
 }
 
 interface ExpansionResolutionContext {

package/src/objects/query/index.ts

@@ -20,7 +20,6 @@ export {
   executeObjectQuery,
   existsObjects,
   facetObjects,
-  QueryExecutor,
 } from "./executor"
 export type {
   ObjectQueryExplainNode,
@@ -64,7 +63,7 @@ export type {
   ObjectQueryPlanningOptions,
   ObjectQueryProviderOperation,
 } from "./planner"
-export { planObjectQuery, QueryPlanner } from "./planner"
+export { planObjectQuery } from "./planner"
 export type {
   ObjectQueryValidationIssue,
   ObjectQueryValidationOptions,

package/src/objects/query/planner.ts

@@ -48,12 +48,6 @@ const fallbackNodeKinds = new Set<ObjectQuery["kind"]>([
   "expand",
 ])
 
-export class QueryPlanner {
-  plan(query: ObjectQuery, options: ObjectQueryPlanningOptions): ObjectQueryPlan {
-    return planObjectQuery(query, options)
-  }
-}
-
 export function planObjectQuery(
   query: ObjectQuery,
   options: ObjectQueryPlanningOptions

package/src/objects/sdk/object-handle.ts

@@ -14,7 +14,7 @@ import {
   requestActionAndWait as requestActionAndWaitLeaf,
   requestAction as requestActionLeaf,
 } from "../action"
-import type { ResolvedLinkContext, ResolvedObjectContext } from "../context"
+import type { ExecutionObjectContext, ResolvedLinkContext } from "../context"
 import { removeLink as removeLinkLeaf, upsertLink as upsertLinkLeaf } from "../link"
 import { deleteObject, restoreObject } from "../object"
 import { createTelemetryChannel } from "./telemetry-channel"
@@ -25,7 +25,7 @@ type AnyLinkToken = LinkToken<string, string, string | readonly string[], Object
 export function createObjectByIdHandle<
   TObjectType extends ObjectTypeWithPropertyTokens,
   TValueTypes extends readonly ValueType[],
->(ctx: ResolvedObjectContext, primaryId: string): ObjectByIdHandle<TObjectType, TValueTypes> {
+>(ctx: ExecutionObjectContext, primaryId: string): ObjectByIdHandle<TObjectType, TValueTypes> {
   const objectHandle = {
     get: async () => {
       assertAuthorized(ctx, { kind: "object.view", objectTypeId: ctx.objectType.id })

package/src/objects/sdk/object-set.ts

@@ -8,6 +8,7 @@ import type { ActionDefinition } from "../../actions"
 import type { AuthorizationContext } from "../../authorization"
 import { assertAuthorized } from "../../authorization"
 import { shareSixbErrorReporter } from "../../error-reporting/capability"
+import type { ExecutionContext } from "../../execution"
 import type { ValueType } from "../../ontology"
 import { OntologyValidationError } from "../../ontology/errors"
 import type { ObjectTypeWithPropertyTokens } from "../../ontology/tokens"
@@ -22,7 +23,7 @@ import {
   requestActionAndWait as requestActionAndWaitLeaf,
   requestAction as requestActionLeaf,
 } from "../action"
-import type { ResolvedLinkContext, ResolvedObjectContext } from "../context"
+import type { ExecutionObjectContext, ResolvedLinkContext } from "../context"
 import { requireLinkDefinition } from "../context"
 import { removeLink as removeLinkLeaf, upsertLink as upsertLinkLeaf } from "../link"
 import { upsertObject as upsertObjectLeaf } from "../object"
@@ -37,6 +38,7 @@ export function createObjectSet<
   TValueTypes extends readonly ValueType[],
 >(
   params: SixbRuntimeContext & {
+    readonly execution: ExecutionContext
     readonly objectType: TObjectType
     readonly authorization?: AuthorizationContext
   }
@@ -50,27 +52,35 @@ export function createObjectSet<
 
   const {
     projectId,
+    broker,
     ontology,
     actionRegistry,
     events,
-    lakeStorage,
-    blobStorage,
     storage,
     queues,
+    runtimeAuthorization,
     authorization,
+    execution,
   } = params
-  const queryExecutor = createRuntimeQueryExecutor({ projectId, ontology, storage, authorization })
+  const queryExecutor = createRuntimeQueryExecutor({
+    projectId,
+    ontology,
+    storage,
+    runtimeAuthorization,
+    authorization,
+  })
 
-  const resolvedCtx: ResolvedObjectContext = {
+  const resolvedCtx: ExecutionObjectContext = {
     projectId,
+    broker,
     ontology,
     actionRegistry,
     events,
-    lakeStorage,
-    blobStorage,
     storage,
     queues,
+    runtimeAuthorization,
     authorization,
+    execution,
     objectType,
     primaryPropertyId,
   }

package/src/objects/sdk/runtime-query-executor.ts

@@ -5,6 +5,7 @@
  */
 
 import type { AuthorizationContext } from "../../authorization"
+import type { RuntimeAuthorization } from "../../execution/types"
 import type { OntologyRegistry } from "../../ontology"
 import type { Storage } from "../../storage"
 import {
@@ -23,10 +24,16 @@ export function createRuntimeQueryExecutor(params: {
   projectId: string
   ontology: OntologyRegistry
   storage: Storage
+  runtimeAuthorization?: RuntimeAuthorization
   authorization?: AuthorizationContext
 }): ObjectQueryExecutor {
-  const { projectId, ontology, storage, authorization } = params
-  const executorOptions = { ontology, storage: storage.objects, authorization }
+  const { projectId, ontology, storage, runtimeAuthorization, authorization } = params
+  const executorOptions = {
+    ontology,
+    storage: storage.objects,
+    runtimeAuthorization,
+    authorization,
+  }
 
   return {
     async list(query: ObjectQuery, options?: { includeTotal?: boolean }) {

package/src/objects/sdk/telemetry-channel.ts

@@ -64,7 +64,11 @@ export function createTelemetryChannel<
             ...(input.limit !== undefined ? { limitPerSeries: input.limit } : {}),
             ...(input.order !== undefined ? { order: input.order } : {}),
           },
-          { storage: timeseries, authorization: ctx.authorization }
+          {
+            storage: timeseries,
+            runtimeAuthorization: ctx.runtimeAuthorization,
+            authorization: ctx.authorization,
+          }
         )
 
         return (result?.points ?? []).map((point) => ({