@sixb/core 0.1.19 → 0.1.21

package/dist/execution/authorized-object-reader.d.ts

@@ -1,12 +1,14 @@
 import type { EmbeddingModelCatalog, RerankingModelCatalog } from "../models/catalog";
-import { type AuthorizedOntologyView } from "../objects/authorized-ontology-view";
+import type { AuthorizedOntologyView } from "../objects/authorized-ontology-view";
 import { type ExecuteObjectCountInput, type ExecuteObjectCountResult, type ExecuteObjectExistsInput, type ExecuteObjectExistsResult, type ExecuteObjectFacetsInput, type ExecuteObjectFacetsResult, type ExecuteObjectQueryInput, type ExecuteObjectQueryLinksInput, type ExecuteObjectQueryLinksResult, type ExecuteObjectQueryResult } from "../objects/query";
 import { type TelemetryHistoryReadAdmission, type TelemetryHistoryReadWorkloadInput } from "../objects/telemetry/workload";
 import type { OntologyRegistry } from "../ontology";
+import type { AppliedMarkings } from "../security/applied-markings";
 import type { ObjectReadStorage, ObjectRow, ObjectStorage } from "../storage";
-import { resolveExecutionScopeAuthorization } from "./authorization";
+import type { Clearance, EventSources } from "./object-reader-clearance";
+import { ObjectReaderOntology } from "./object-reader-ontology";
+import { ObjectReaderSecurity } from "./object-reader-security";
 import type { ExecutionScope } from "./types";
-type ResolvedExecutionAuthority = ReturnType<typeof resolveExecutionScopeAuthorization>;
 type GetObjectInput = Omit<Parameters<ObjectReadStorage["getByPrimaryId"]>[0], "projectId">;
 type GetObjectsInput = Omit<Parameters<ObjectReadStorage["getByPrimaryIdBatch"]>[0], "projectId">;
 type SelectObjectPropertiesInput = Parameters<ObjectReadStorage["selectsObjectProperties"]>[0];
@@ -15,6 +17,11 @@ type CanReadObjectPropertiesBatchInput = Omit<SelectObjectPropertiesInput, "proj
 type ListObjectsInput = Omit<Parameters<ObjectReadStorage["list"]>[0], "projectId">;
 type ListLinksInput = Omit<Parameters<ObjectReadStorage["listLinks"]>[0], "projectId">;
 type ListLinksBatchInput = Omit<Parameters<ObjectReadStorage["listLinksBatch"]>[0], "projectId">;
+/** The model catalogs semantic and reranked search use. */
+interface ObjectReaderModels {
+    readonly embedding?: EmbeddingModelCatalog;
+    readonly reranking?: RerankingModelCatalog;
+}
 declare const readerConstructionKey: Readonly<{}>;
 /**
  * Core-owned object read boundary for one exact execution authority.
@@ -22,18 +29,24 @@ declare const readerConstructionKey: Readonly<{}>;
  * The implementation class is intentionally private to this module. Its private fields make the
  * exported instance type nominal, while the construction key prevents code that discovers the
  * JavaScript constructor through an instance from manufacturing another reader.
+ *
+ * Its state is grouped as a project is: the ontology it resolves against, the security of the
+ * authority (its delegation and clearance included), the model catalogs search uses, and the
+ * storage it reads. Each group decides what belongs to it; the reader composes them.
  */
 declare class AuthorizedObjectReaderImpl {
     #private;
     constructor(key: typeof readerConstructionKey, input: {
-        readonly scope: ExecutionScope;
-        readonly ontology: OntologyRegistry;
-        readonly embeddingModels?: EmbeddingModelCatalog;
-        readonly rerankingModels?: RerankingModelCatalog;
+        readonly ontology: ObjectReaderOntology;
+        readonly security: ObjectReaderSecurity;
+        readonly models: ObjectReaderModels;
         readonly storage: ObjectReadStorage;
-        readonly authority: ResolvedExecutionAuthority;
     });
     static assertBound(reader: AuthorizedObjectReaderImpl, scope: ExecutionScope): void;
+    /** What the reader cannot read now, for surfaces such as events that redact on their own. */
+    static clearance(reader: AuthorizedObjectReaderImpl): Promise<Clearance>;
+    /** What the reader cannot read in an object event. */
+    static eventClearance(reader: AuthorizedObjectReaderImpl, sources: EventSources): Clearance | Promise<Clearance>;
     static ontologyView(reader: AuthorizedObjectReaderImpl): AuthorizedOntologyView;
     /** Project identity carried by this nominal reader capability. */
     get projectId(): string;
@@ -50,10 +63,17 @@ declare class AuthorizedObjectReaderImpl {
     exists(input: Omit<ExecuteObjectExistsInput, "projectId">): Promise<ExecuteObjectExistsResult>;
     facet(input: Omit<ExecuteObjectFacetsInput, "projectId">): Promise<ExecuteObjectFacetsResult>;
     /**
-     * Redact a row returned by a write. An upsert returns the merged effective row, which may hold
-     * marked values the writer never sent and cannot read.
+     * Redact the rows a write of this object type returns. An upsert returns the merged effective
+     * row, which may hold marked values the writer never sent and cannot read. Resolved before the
+     * write, which it refuses when the writer cannot read the type at all.
      */
-    redactWrittenRow<TRow extends ObjectRow>(row: TRow): TRow;
+    writtenRowRedactor(objectTypeId: string): Promise<(<TRow extends ObjectRow>(row: TRow) => TRow)>;
+    /**
+     * Refuse a write or a request that names an object type or link this authority cannot read,
+     * before any lookup: it would answer whether what it names exists, and land where the reader
+     * cannot see.
+     */
+    assertReadable(targets: ReadTargets): Promise<void>;
     /** Enforce the delegated response budget without exposing or recombining its limits. */
     assertVisibleOutputWithinLimit(value: unknown): void;
     /** Admit adjacent telemetry work without exposing which authority policy was selected. */
@@ -67,6 +87,8 @@ export declare function createAuthorizedObjectReader(input: {
     readonly embeddingModels?: EmbeddingModelCatalog;
     readonly rerankingModels?: RerankingModelCatalog;
     readonly objectStorage: ObjectStorage;
+    /** Markings of the dataset versions projections applied; the code's markings alone without. */
+    readonly appliedMarkings?: AppliedMarkings;
 }): AuthorizedObjectReader;
 /** Reject recombining an authorized reader with any other execution authority. */
 export declare function assertAuthorizedObjectReaderBinding(input: {
@@ -75,5 +97,24 @@ export declare function assertAuthorizedObjectReaderBinding(input: {
 }): void;
 /** Return inert metadata projected from the exact authority already owned by the reader. */
 export declare function getAuthorizedOntologyView(reader: AuthorizedObjectReader): AuthorizedOntologyView;
+/**
+ * What a reader resolved for this authority cannot read now. Events redact with it: an event of an
+ * object type the reader cannot read is not delivered, and the others are redacted like rows.
+ */
+export declare function readerClearance(reader: AuthorizedObjectReader): Promise<Clearance>;
+/**
+ * What a reader cannot read in an object event: the current markings, with those of the versions
+ * its values came from. A plain value for a reader those markings cannot affect, which reads no
+ * version.
+ */
+export declare function readerEventClearance(reader: AuthorizedObjectReader, sources: EventSources): Clearance | Promise<Clearance>;
+/** What a write or a request names: object types, and links by their source type. */
+interface ReadTargets {
+    readonly objectTypeIds: readonly string[];
+    readonly links?: readonly {
+        readonly objectTypeId: string;
+        readonly linkId: string;
+    }[];
+}
 export {};
 //# sourceMappingURL=authorized-object-reader.d.ts.map

package/dist/execution/authorized-object-reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorized-object-reader.d.ts","sourceRoot":"","sources":["../../src/execution/authorized-object-reader.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACrF,OAAO,EAEL,KAAK,sBAAsB,EAE5B,MAAM,qCAAqC,CAAA;AAO5C,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAK9B,MAAM,kBAAkB,CAAA;AAgBzB,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACvC,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAKV,iBAAiB,EACjB,SAAS,EACT,aAAa,EACd,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAyB,kCAAkC,EAAE,MAAM,iBAAiB,CAAA;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAwB,MAAM,SAAS,CAAA;AAQnE,KAAK,0BAA0B,GAAG,UAAU,CAAC,OAAO,kCAAkC,CAAC,CAAA;AACvF,KAAK,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AAC3F,KAAK,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACjG,KAAK,2BAA2B,GAAG,UAAU,CAAC,iBAAiB,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9F,KAAK,0BAA0B,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;AAC9E,KAAK,iCAAiC,GAAG,IAAI,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAA;AACvF,KAAK,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACnF,KAAK,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACtF,KAAK,mBAAmB,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AAEhG,QAAA,MAAM,qBAAqB,cAAoB,CAAA;AAE/C;;;;;;GAMG;AACH,cAAM,0BAA0B;;gBAgB5B,GAAG,EAAE,OAAO,qBAAqB,EACjC,KAAK,EAAE;QACL,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;QAC9B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;QACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAA;QAChD,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAA;QAChD,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;QACnC,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAA;KAC/C;IAgCH,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,0BAA0B,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAUnF,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,0BAA0B,GAAG,sBAAsB;IAe/E,kEAAkE;IAClE,IAAI,SAAS,IAAI,MAAM,CAEtB;IAEK,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAatF,mBAAmB,CACvB,KAAK,EAAE,eAAe,GACrB,UAAU,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAiBjD,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,OAAO,CAAC;IAgB1E,4BAA4B,CAChC,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC;IAqBxB,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAmCpE,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAiB5E,cAAc,CAClB,KAAK,EAAE,mBAAmB,GACzB,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IA0B5C,YAAY,CAChB,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,GAChD,OAAO,CAAC,wBAAwB,CAAC;IAgB9B,UAAU,CACd,KAAK,EAAE,IAAI,CAAC,4BAA4B,EAAE,WAAW,CAAC,GACrD,OAAO,CAAC,6BAA6B,CAAC;IAgDnC,KAAK,CACT,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,GAChD,OAAO,CAAC,wBAAwB,CAAC;IAW9B,MAAM,CACV,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,GACjD,OAAO,CAAC,yBAAyB,CAAC;IAW/B,KAAK,CACT,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,GACjD,OAAO,CAAC,yBAAyB,CAAC;IAyCrC;;;OAGG;IACH,gBAAgB,CAAC,IAAI,SAAS,SAAS,EAAE,GAAG,EAAE,IAAI,GAAG,IAAI;IAIzD,wFAAwF;IACxF,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAKpD,0FAA0F;IAC1F,yBAAyB,CACvB,KAAK,EAAE,iCAAiC,GACvC,6BAA6B;CAkHjC;AAKD,MAAM,MAAM,sBAAsB,GAAG,0BAA0B,CAAA;AAE/D,0FAA0F;AAC1F,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAA;IAChD,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAA;IAChD,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;CACtC,GAAG,sBAAsB,CAezB;AAED,kFAAkF;AAClF,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAC/B,GAAG,IAAI,CAEP;AAED,4FAA4F;AAC5F,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,sBAAsB,GAAG,sBAAsB,CAEhG"}
+{"version":3,"file":"authorized-object-reader.d.ts","sourceRoot":"","sources":["../../src/execution/authorized-object-reader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA;AAOjF,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAK9B,MAAM,kBAAkB,CAAA;AAczB,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACvC,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,KAAK,EAIV,iBAAiB,EACjB,SAAS,EACT,aAAa,EACd,MAAM,YAAY,CAAA;AAGnB,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,oBAAoB,EAAmC,MAAM,0BAA0B,CAAA;AAChG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,KAAK,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AAC3F,KAAK,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACjG,KAAK,2BAA2B,GAAG,UAAU,CAAC,iBAAiB,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9F,KAAK,0BAA0B,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;AAC9E,KAAK,iCAAiC,GAAG,IAAI,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAA;AACvF,KAAK,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACnF,KAAK,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACtF,KAAK,mBAAmB,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AAEhG,2DAA2D;AAC3D,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;CAC3C;AAED,QAAA,MAAM,qBAAqB,cAAoB,CAAA;AAE/C;;;;;;;;;;GAUG;AACH,cAAM,0BAA0B;;gBAO5B,GAAG,EAAE,OAAO,qBAAqB,EACjC,KAAK,EAAE;QACL,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;QACvC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;QACvC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;QACnC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;KACpC;IAWH,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,0BAA0B,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAUnF,6FAA6F;WAChF,SAAS,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC;IAI9E,sDAAsD;IACtD,MAAM,CAAC,cAAc,CACnB,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,YAAY,GACpB,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAIjC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,0BAA0B,GAAG,sBAAsB;IAI/E,kEAAkE;IAClE,IAAI,SAAS,IAAI,MAAM,CAEtB;IAEK,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAkBtF,mBAAmB,CACvB,KAAK,EAAE,eAAe,GACrB,UAAU,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAuBjD,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB1E,4BAA4B,CAChC,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC;IAyBxB,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAwCpE,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAkB5E,cAAc,CAClB,KAAK,EAAE,mBAAmB,GACzB,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IA8B5C,YAAY,CAChB,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,GAChD,OAAO,CAAC,wBAAwB,CAAC;IAqB9B,UAAU,CACd,KAAK,EAAE,IAAI,CAAC,4BAA4B,EAAE,WAAW,CAAC,GACrD,OAAO,CAAC,6BAA6B,CAAC;IAmEnC,KAAK,CACT,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,GAChD,OAAO,CAAC,wBAAwB,CAAC;IAY9B,MAAM,CACV,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,GACjD,OAAO,CAAC,yBAAyB,CAAC;IAY/B,KAAK,CACT,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,GACjD,OAAO,CAAC,yBAAyB,CAAC;IA0CrC;;;;OAIG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,GACnB,OAAO,EAAC,CAAC,IAAI,SAAS,SAAS,EAAE,GAAG,EAAE,IAAI,KAAK,IAAI,EAAC;IAMvD;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzD,wFAAwF;IACxF,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAKpD,0FAA0F;IAC1F,yBAAyB,CACvB,KAAK,EAAE,iCAAiC,GACvC,6BAA6B;CA0FjC;AAKD,MAAM,MAAM,sBAAsB,GAAG,0BAA0B,CAAA;AAE/D,0FAA0F;AAC1F,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAA;IAChD,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAA;IAChD,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,+FAA+F;IAC/F,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAA;CAC3C,GAAG,sBAAsB,CAsBzB;AAED,kFAAkF;AAClF,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAC/B,GAAG,IAAI,CAEP;AAED,4FAA4F;AAC5F,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,sBAAsB,GAAG,sBAAsB,CAEhG;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,CAElF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,YAAY,GACpB,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAEhC;AAED,qFAAqF;AACrF,UAAU,WAAW;IACnB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CACvF"}

package/dist/execution/object-reader-clearance.d.ts

@@ -0,0 +1,41 @@
+import { type PropertyClearance } from "../objects/property-clearance";
+import type { OntologyRegistry } from "../ontology";
+import type { AppliedMarkings } from "../security/applied-markings";
+import type { EventOriginRef } from "../security/applied-markings-contribution";
+/** What one read may not return; `undefined` when it reads everything. */
+export type Clearance = PropertyClearance | undefined;
+/**
+ * What one authority cannot read: the markings the code declares, and those the dataset versions
+ * projections applied add, for an authority they can affect.
+ *
+ * A reader they cannot affect, trusted code included, gets the code's clearance as a plain value:
+ * awaiting it costs one microtask, not a refresh. Otherwise the clearance is resolved for each
+ * snapshot, which rarely changes, so the last one is kept.
+ */
+export declare class ObjectReaderClearance {
+    #private;
+    constructor(input: {
+        readonly ontology: OntologyRegistry;
+        readonly clearances: ReadonlySet<string> | undefined;
+        readonly appliedMarkings?: AppliedMarkings;
+    });
+    /** What the authority cannot read now. */
+    current(): Clearance | Promise<Clearance>;
+    /**
+     * What the authority cannot read in an object event. Reads the event's origin version only for
+     * an authority its markings affect.
+     */
+    forEvent(sources: EventSources): Clearance | Promise<Clearance>;
+}
+/** Where the values of an object event came from. */
+export interface EventSources {
+    readonly objectTypeId: string;
+    /** The projection that emitted the event, and the version it applied. */
+    readonly origin?: EventOriginRef;
+    /**
+     * Whether the event holds values from before it, which came from versions applied earlier: an
+     * update or a deletion, or a record an action or a direct write took of projected values.
+     */
+    readonly earlier: boolean;
+}
+//# sourceMappingURL=object-reader-clearance.d.ts.map

package/dist/execution/object-reader-clearance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-reader-clearance.d.ts","sourceRoot":"","sources":["../../src/execution/object-reader-clearance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAA4B,MAAM,+BAA+B,CAAA;AAChG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAA;AAG/E,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,iBAAiB,GAAG,SAAS,CAAA;AAErD;;;;;;;GAOG;AACH,qBAAa,qBAAqB;;gBAWpB,KAAK,EAAE;QACjB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;QACnC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;QACpD,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAA;KAC3C;IAYD,0CAA0C;IAC1C,OAAO,IAAI,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAczC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;CAehE;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;IAChC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B"}

package/dist/execution/object-reader-ontology.d.ts

@@ -0,0 +1,12 @@
+import { type AuthorizedOntologyView } from "../objects/authorized-ontology-view";
+import type { OntologyRegistry } from "../ontology";
+import type { ResolvedExecutionAuthority } from "./object-reader-security";
+/** The ontology a reader resolves against, and the part of it its authority may describe. */
+export declare class ObjectReaderOntology {
+    #private;
+    readonly registry: OntologyRegistry;
+    constructor(registry: OntologyRegistry, authority: ResolvedExecutionAuthority);
+    /** Inert metadata for the types the authority may view, built on first use. */
+    view(): AuthorizedOntologyView;
+}
+//# sourceMappingURL=object-reader-ontology.d.ts.map

package/dist/execution/object-reader-ontology.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-reader-ontology.d.ts","sourceRoot":"","sources":["../../src/execution/object-reader-ontology.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,sBAAsB,EAE5B,MAAM,qCAAqC,CAAA;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAA;AAE1E,6FAA6F;AAC7F,qBAAa,oBAAoB;;IAC/B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;gBAIvB,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,0BAA0B;IAM7E,+EAA+E;IAC/E,IAAI,IAAI,sBAAsB;CAc/B"}

package/dist/execution/object-reader-security.d.ts

@@ -0,0 +1,45 @@
+import type { AuthorizationContext } from "../authorization/types";
+import { type SelectedObjectQueryAdmission } from "../objects/query/selected-read-admission";
+import type { OntologyRegistry } from "../ontology";
+import type { AppliedMarkings } from "../security/applied-markings";
+import type { ObjectLinkRow } from "../storage";
+import type { resolveExecutionScopeAuthorization } from "./authorization";
+import { type Clearance, ObjectReaderClearance } from "./object-reader-clearance";
+import type { RuntimeAuthorization } from "./types";
+export type ResolvedExecutionAuthority = ReturnType<typeof resolveExecutionScopeAuthorization>;
+export type RuntimeReadAuthorization = {
+    readonly projectId: string;
+    readonly runtimeAuthorization: RuntimeAuthorization;
+    readonly authorization?: AuthorizationContext;
+};
+/** What a delegated authority selected: the object types, links, and queries it may read. */
+export interface ObjectReaderDelegation {
+    readonly objectTypeIds: ReadonlySet<string>;
+    readonly linkDefinitions: ReadonlySet<string>;
+    readonly queryAdmission: SelectedObjectQueryAdmission;
+}
+/**
+ * Who reads, and what it may read: the exact execution authority, the selection a delegated one
+ * carries, and its clearance. It decides whether an object type or a link is viewable.
+ */
+export declare class ObjectReaderSecurity {
+    /** The registered authority the reader is bound to. */
+    readonly authorization: RuntimeAuthorization;
+    readonly authority: ResolvedExecutionAuthority;
+    /** The authority as generic authorization checks take it. */
+    readonly runtime: RuntimeReadAuthorization;
+    /** Present for delegated authority only. */
+    readonly delegation?: ObjectReaderDelegation;
+    readonly clearance: ObjectReaderClearance;
+    constructor(input: {
+        readonly authorization: RuntimeAuthorization;
+        readonly authority: ResolvedExecutionAuthority;
+        readonly projectId: string;
+        readonly ontology: OntologyRegistry;
+        readonly appliedMarkings?: AppliedMarkings;
+    });
+    assertObjectTypesViewable(objectTypeIds: readonly string[], clearance: Clearance): void;
+    isObjectTypeViewable(objectTypeId: string, clearance: Clearance): boolean;
+    isLinkViewable(link: ObjectLinkRow, clearance: Clearance): boolean;
+}
+//# sourceMappingURL=object-reader-security.d.ts.map

package/dist/execution/object-reader-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-reader-security.d.ts","sourceRoot":"","sources":["../../src/execution/object-reader-security.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAElE,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,0CAA0C,CAAA;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,KAAK,EAA0B,aAAa,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,KAAK,SAAS,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAEnD,MAAM,MAAM,0BAA0B,GAAG,UAAU,CAAC,OAAO,kCAAkC,CAAC,CAAA;AAE9F,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAA;IACnD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;CAC9C,CAAA;AAED,6FAA6F;AAC7F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7C,QAAQ,CAAC,cAAc,EAAE,4BAA4B,CAAA;CACtD;AAED;;;GAGG;AACH,qBAAa,oBAAoB;IAC/B,uDAAuD;IACvD,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAA;IAC9C,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAA;IAC1C,4CAA4C;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAA;IAC5C,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAA;gBAE7B,KAAK,EAAE;QACjB,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;QAC5C,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAA;QAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;QACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAA;KAC3C;IA4BD,yBAAyB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI;IAuBvF,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO;IAMzE,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO;CAWnE"}

package/dist/execution/primitive.js

@@ -1,70 +1,77 @@
 // @bun
 import {
   bindDurablePrimitiveExecution2
-} from "../chunk-ey3pyej1.js";
-import"../chunk-t6vq7bff.js";
-import"../chunk-wz0xs816.js";
-import"../chunk-52bk93x8.js";
-import"../chunk-wwdfe68s.js";
-import"../chunk-zrmy8zvw.js";
+} from "../chunk-akzryx9h.js";
+import"../chunk-0bphap9y.js";
+import"../chunk-ky3j490c.js";
+import"../chunk-cfj9dfbb.js";
+import"../chunk-z58tm0hm.js";
+import"../chunk-rmakanzx.js";
+import"../chunk-6rqgmkde.js";
+import"../chunk-3qms4nax.js";
+import"../chunk-bk9svbcq.js";
+import"../chunk-vf57cr4t.js";
 import"../chunk-mfs23znk.js";
-import"../chunk-7mbzgd9m.js";
+import"../chunk-1cc1xaf3.js";
 import"../chunk-99nd4rc1.js";
-import"../chunk-vyf9kfqf.js";
-import"../chunk-4tcx876c.js";
-import"../chunk-d2ync1v3.js";
-import"../chunk-nre82s12.js";
-import"../chunk-j2bp5ryw.js";
-import"../chunk-br3k6qbf.js";
-import"../chunk-jmfet9r4.js";
+import"../chunk-q7gn29y3.js";
+import"../chunk-cn0fwwhy.js";
+import"../chunk-918wwnaa.js";
 import"../chunk-qf954wje.js";
-import"../chunk-1f7wpmyp.js";
-import"../chunk-tw03bsmb.js";
-import"../chunk-7kg3k1m9.js";
-import"../chunk-s16apyk9.js";
-import"../chunk-h89wz928.js";
+import"../chunk-9j4jw7as.js";
+import"../chunk-tbc1ngpd.js";
 import"../chunk-pbcbn83d.js";
 import"../chunk-qczk96d9.js";
 import"../chunk-mmagke4x.js";
-import"../chunk-9ybhtmg4.js";
+import"../chunk-vvxtn22d.js";
 import"../chunk-hn2r7z41.js";
-import"../chunk-b38szspf.js";
-import"../chunk-a40ad1ft.js";
-import"../chunk-s54c868q.js";
+import"../chunk-br3k6qbf.js";
+import"../chunk-jmfet9r4.js";
+import"../chunk-3qct2mdc.js";
 import"../chunk-ere85b8y.js";
 import"../chunk-rj69qcrd.js";
 import"../chunk-4as3wt1c.js";
+import"../chunk-eptrvnby.js";
+import"../chunk-d09e3rax.js";
+import"../chunk-h89wz928.js";
+import"../chunk-x0v3jd47.js";
+import"../chunk-dhcv7yxc.js";
+import"../chunk-a40ad1ft.js";
+import"../chunk-g257jwnc.js";
+import"../chunk-7n440zgt.js";
 import"../chunk-29yx306f.js";
 import"../chunk-pqajwytd.js";
-import"../chunk-bpgy64fw.js";
-import"../chunk-3qms4nax.js";
-import"../chunk-7n440zgt.js";
-import"../chunk-m427qgq0.js";
-import"../chunk-fa02jy15.js";
-import"../chunk-7t429e3f.js";
-import"../chunk-3zxk45er.js";
 import"../chunk-5a4a52tq.js";
-import"../chunk-6gmfggss.js";
-import"../chunk-bwjcehza.js";
-import"../chunk-rz53yb4v.js";
-import"../chunk-gc4ntf7d.js";
+import"../chunk-431pyp2c.js";
+import"../chunk-e17zdm62.js";
+import"../chunk-q5e5tv4b.js";
+import"../chunk-m427qgq0.js";
+import"../chunk-cy4mbddw.js";
+import"../chunk-xvsc5m8n.js";
+import"../chunk-cwdzcv37.js";
 import"../chunk-gfdh9kqa.js";
+import"../chunk-8ncg20rd.js";
 import"../chunk-pfp1txq2.js";
-import"../chunk-5e43w60z.js";
-import"../chunk-3gnrh4ve.js";
-import"../chunk-c85m1hyj.js";
-import"../chunk-v9xd5wzd.js";
-import"../chunk-xt1zt7gv.js";
-import"../chunk-2jntasmh.js";
-import"../chunk-y7rqfrgg.js";
+import"../chunk-5948n82c.js";
+import"../chunk-9kgkfg6v.js";
+import"../chunk-nn5xnx3s.js";
+import"../chunk-447a5c0p.js";
+import"../chunk-s7jg7pmn.js";
+import"../chunk-f4pamkt9.js";
+import"../chunk-hcbyfxbe.js";
+import"../chunk-6vb4st8k.js";
 import"../chunk-v4jbb3rs.js";
-import"../chunk-hvsb78a1.js";
-import"../chunk-enpsx8k5.js";
-import"../chunk-jhm3zsa7.js";
-import"../chunk-8mx7qw3y.js";
-import"../chunk-z3y5kg1x.js";
+import"../chunk-8frc8a4j.js";
+import"../chunk-dhdha526.js";
+import"../chunk-dvd2fp9q.js";
+import"../chunk-6eqsgvxk.js";
+import"../chunk-48qjhh6v.js";
+import"../chunk-a3faa34j.js";
+import"../chunk-wkv3h3q7.js";
+import"../chunk-7q8t23v4.js";
+import"../chunk-mjddfa7k.js";
 export {
   bindDurablePrimitiveExecution2 as bindDurablePrimitiveExecution
 };
 
-//# debugId=A1A47CCF44A6D67364756E2164756E21
+//# debugId=42478EB7DC83C4BB64756E2164756E21

package/dist/execution/primitive.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "A1A47CCF44A6D67364756E2164756E21",
+  "debugId": "42478EB7DC83C4BB64756E2164756E21",
   "names": []
 }

package/dist/execution/request.js

@@ -2,76 +2,83 @@
 import {
   bindModelExecutionAttempt,
   isBoundSixb
-} from "../chunk-ey3pyej1.js";
-import"../chunk-enpsx8k5.js";
-import"../chunk-8mx7qw3y.js";
-import"../chunk-z3y5kg1x.js";
-import"../chunk-y7rqfrgg.js";
+} from "../chunk-akzryx9h.js";
+import"../chunk-dhdha526.js";
+import"../chunk-dvd2fp9q.js";
+import"../chunk-6eqsgvxk.js";
+import"../chunk-6vb4st8k.js";
 import"../chunk-v4jbb3rs.js";
-import"../chunk-jhm3zsa7.js";
-import"../chunk-hvsb78a1.js";
-import"../chunk-1f7wpmyp.js";
+import"../chunk-wkv3h3q7.js";
+import"../chunk-8frc8a4j.js";
+import"../chunk-x0v3jd47.js";
+import"../chunk-9j4jw7as.js";
 import"../chunk-7n440zgt.js";
+import"../chunk-918wwnaa.js";
 import"../chunk-a40ad1ft.js";
-import"../chunk-b38szspf.js";
-import"../chunk-3gnrh4ve.js";
-import"../chunk-xt1zt7gv.js";
-import"../chunk-v9xd5wzd.js";
-import"../chunk-2jntasmh.js";
+import"../chunk-dhcv7yxc.js";
+import"../chunk-nn5xnx3s.js";
+import"../chunk-f4pamkt9.js";
+import"../chunk-s7jg7pmn.js";
+import"../chunk-hcbyfxbe.js";
 import"../chunk-pqajwytd.js";
 import"../chunk-29yx306f.js";
-import"../chunk-gfdh9kqa.js";
-import"../chunk-gc4ntf7d.js";
-import"../chunk-s54c868q.js";
+import"../chunk-3qct2mdc.js";
 import"../chunk-ere85b8y.js";
 import"../chunk-4as3wt1c.js";
 import"../chunk-h89wz928.js";
-import"../chunk-7kg3k1m9.js";
-import"../chunk-tw03bsmb.js";
-import"../chunk-bpgy64fw.js";
-import"../chunk-j2bp5ryw.js";
+import"../chunk-d09e3rax.js";
+import"../chunk-tbc1ngpd.js";
+import"../chunk-gfdh9kqa.js";
+import"../chunk-cwdzcv37.js";
+import"../chunk-eptrvnby.js";
+import"../chunk-g257jwnc.js";
 import"../chunk-pbcbn83d.js";
 import"../chunk-qczk96d9.js";
 import"../chunk-mmagke4x.js";
 import"../chunk-hn2r7z41.js";
-import"../chunk-9ybhtmg4.js";
+import"../chunk-vvxtn22d.js";
 import"../chunk-jmfet9r4.js";
 import"../chunk-qf954wje.js";
-import"../chunk-4tcx876c.js";
-import"../chunk-fa02jy15.js";
-import"../chunk-wwdfe68s.js";
+import"../chunk-cn0fwwhy.js";
+import"../chunk-6rqgmkde.js";
+import"../chunk-cy4mbddw.js";
 import"../chunk-3qms4nax.js";
-import"../chunk-zrmy8zvw.js";
+import"../chunk-bk9svbcq.js";
 import"../chunk-m427qgq0.js";
-import"../chunk-vyf9kfqf.js";
+import"../chunk-q7gn29y3.js";
 import"../chunk-pfp1txq2.js";
-import"../chunk-5e43w60z.js";
-import"../chunk-3zxk45er.js";
+import"../chunk-5948n82c.js";
+import"../chunk-mjddfa7k.js";
+import"../chunk-7q8t23v4.js";
+import"../chunk-48qjhh6v.js";
+import"../chunk-8ncg20rd.js";
 import"../chunk-5a4a52tq.js";
-import"../chunk-wz0xs816.js";
-import"../chunk-rz53yb4v.js";
-import"../chunk-6gmfggss.js";
+import"../chunk-ky3j490c.js";
+import"../chunk-q5e5tv4b.js";
+import"../chunk-431pyp2c.js";
 import"../chunk-99nd4rc1.js";
 import {
   createPrincipalRequestScope,
   createDisabledRequestScope,
   createDelegatedRequestScope
-} from "../chunk-kg5j6fct.js";
-import"../chunk-t6vq7bff.js";
-import"../chunk-52bk93x8.js";
+} from "../chunk-y5tah2kf.js";
+import"../chunk-0bphap9y.js";
+import"../chunk-cfj9dfbb.js";
+import"../chunk-z58tm0hm.js";
+import"../chunk-rmakanzx.js";
+import"../chunk-vf57cr4t.js";
 import"../chunk-mfs23znk.js";
-import"../chunk-7mbzgd9m.js";
-import"../chunk-d2ync1v3.js";
-import"../chunk-nre82s12.js";
+import"../chunk-1cc1xaf3.js";
 import {
   snapshotShareAccessPlan,
   objectReadScopeForAccessPlan
 } from "../chunk-br3k6qbf.js";
-import"../chunk-s16apyk9.js";
 import"../chunk-rj69qcrd.js";
-import"../chunk-7t429e3f.js";
-import"../chunk-bwjcehza.js";
-import"../chunk-c85m1hyj.js";
+import"../chunk-e17zdm62.js";
+import"../chunk-xvsc5m8n.js";
+import"../chunk-9kgkfg6v.js";
+import"../chunk-447a5c0p.js";
+import"../chunk-a3faa34j.js";
 
 // src/execution/request.ts
 import { randomUUID } from "crypto";
@@ -131,4 +138,4 @@ export {
   bindRequestExecution
 };
 
-//# debugId=247D55315669FAAA64756E2164756E21
+//# debugId=B567580DC2E1D03364756E2164756E21

package/dist/execution/request.js.map

@@ -4,7 +4,7 @@
   "sourcesContent": [
     "import { randomUUID } from \"node:crypto\"\nimport type { AuthorizationContext } from \"../authorization\"\nimport { bindModelExecutionAttempt } from \"../models/execution/binding\"\nimport { isBoundSixb, type Sixb } from \"../runtime/sixb\"\nimport {\n  objectReadScopeForAccessPlan,\n  type ShareAccessPlan,\n  snapshotShareAccessPlan,\n} from \"../shares/access-plan\"\nimport type { ObjectReadExecutionLimits } from \"../storage/objects/execution-limits\"\nimport {\n  createDelegatedRequestScope,\n  createDisabledRequestScope,\n  createPrincipalRequestScope,\n} from \"./scopes\"\nimport type { AuthorizationRef, ExecutionScope } from \"./types\"\n\nexport type { ActionRunsRuntime, ActionsRuntime } from \"../actions/execution\"\nexport type {\n  AgentRunListResult,\n  AgentRunsRuntime,\n  AgentRuntime,\n  AgentRunView,\n  AgentThreadsRuntime,\n  CreateExecutionAgentThreadInput,\n  ExecutionAgentRequestInput,\n  ExecutionAgentRunResult,\n  ListExecutionAgentThreadsInput,\n} from \"../agents/execution\"\nexport type { AgentDescriptor } from \"../agents/types\"\nexport type { AuthorizationContext } from \"../authorization\"\nexport type { DatasetsRuntime } from \"../datasets/execution\"\nexport type { EventsRuntime } from \"../events/execution\"\nexport type { LogsRuntime } from \"../logging/execution\"\nexport type { LanguageModelsRuntime, ModelsRuntime } from \"../models/generation-types\"\nexport type {\n  ExecutionObjectByIdHandle,\n  ExecutionObjectSet,\n  ObjectsRuntime,\n} from \"../objects/execution\"\nexport type {\n  PipelineRunsRuntime,\n  PipelinesRuntime,\n} from \"../pipelines/execution\"\nexport type {\n  ProjectionRunsRuntime,\n  ProjectionsRuntime,\n} from \"../projections/execution\"\nexport type { RuleStatesRuntime, RulesRuntime } from \"../rules/execution\"\nexport type { Sixb } from \"../runtime/sixb\"\nexport type { AgentThreadRecord, ListAgentThreadsResult } from \"../storage/agents\"\nexport type { SyncRunsRuntime, SyncsRuntime } from \"../syncs/execution\"\nexport type {\n  LatestWorkflowRunListResult,\n  ListWorkflowRunNodesInput,\n  WorkflowAgentNodeRunView,\n  WorkflowInterventionsRuntime,\n  WorkflowNodeRunListResult,\n  WorkflowNodeRunView,\n  WorkflowRunListResult,\n  WorkflowRunsRuntime,\n  WorkflowRunView,\n  WorkflowsRuntime,\n} from \"../workflows/execution\"\nexport type { AuthorizationRef, ExecutionContext } from \"./types\"\n\nexport type RequestExecutionAuthorization =\n  | {\n      readonly type: \"principal\"\n      readonly context: AuthorizationContext\n      readonly credential?: Extract<AuthorizationRef, { readonly type: \"principal\" }>[\"credential\"]\n    }\n  | {\n      readonly type: \"delegated\"\n      readonly access: ShareAccessPlan\n      readonly limits?: ObjectReadExecutionLimits\n      readonly delegation: {\n        readonly kind: \"share\"\n        readonly grantId: string\n        readonly sessionId: string\n      }\n    }\n  | { readonly type: \"disabled\" }\n\nexport interface BindRequestExecutionInput {\n  readonly request: Request\n  readonly authorization: RequestExecutionAuthorization\n}\n\nexport interface RequestExecutionHost {\n  readonly id: string\n  withScope(scope: ExecutionScope): object\n}\n\n/** Bind one HTTP or WebSocket request without exposing trusted or kernel capability factories. */\nexport function bindRequestExecution(\n  host: RequestExecutionHost,\n  input: BindRequestExecutionInput\n): Sixb {\n  const requestId = requestIdentifier(input.request)\n  const correlationId = correlationIdentifier(input.request, requestId)\n  const scope = createRequestScope(host.id, requestId, correlationId, input.authorization)\n\n  const sixb = host.withScope(scope)\n  if (!isBoundSixb(sixb)) {\n    throw new Error(\"[Sixb] Request host did not return an execution-bound Sixb SDK.\")\n  }\n  bindModelExecutionAttempt(sixb.models, { attempt: 1, signal: input.request.signal })\n  return sixb\n}\n\nfunction createRequestScope(\n  projectId: string,\n  requestId: string,\n  correlationId: string,\n  authorization: RequestExecutionAuthorization\n): ExecutionScope {\n  switch (authorization.type) {\n    case \"principal\":\n      return createPrincipalRequestScope({\n        projectId,\n        requestId,\n        correlationId,\n        context: authorization.context,\n        ...(authorization.credential === undefined ? {} : { credential: authorization.credential }),\n      })\n    case \"delegated\": {\n      const access = snapshotShareAccessPlan(authorization.access)\n      return createDelegatedRequestScope({\n        projectId,\n        requestId,\n        correlationId,\n        objectRead: {\n          selection: objectReadScopeForAccessPlan(access),\n          limits: authorization.limits ?? {\n            maxTraversalFacts: 10_000,\n            maxOutputJsonBytes: 8 * 1024 * 1024,\n          },\n        },\n        actionApply: access.grants.flatMap((grant) =>\n          grant.kind === \"action.apply\"\n            ? grant.subjects.map((subject) => ({ actionId: grant.actionId, subject }))\n            : []\n        ),\n        delegation: authorization.delegation,\n      })\n    }\n    case \"disabled\":\n      return createDisabledRequestScope({ projectId, requestId, correlationId })\n  }\n}\n\nfunction requestIdentifier(request: Request): string {\n  return headerIdentifier(request, \"x-request-id\") ?? `req_${randomUUID()}`\n}\n\nfunction correlationIdentifier(request: Request, requestId: string): string {\n  return headerIdentifier(request, \"x-correlation-id\") ?? requestId\n}\n\nfunction headerIdentifier(request: Request, name: string): string | undefined {\n  const value = request.headers.get(name)?.trim()\n  return value ? value : undefined\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AA+FO,SAAS,oBAAoB,CAClC,MACA,OACM;AAAA,EACN,MAAM,YAAY,kBAAkB,MAAM,OAAO;AAAA,EACjD,MAAM,gBAAgB,sBAAsB,MAAM,SAAS,SAAS;AAAA,EACpE,MAAM,QAAQ,mBAAmB,KAAK,IAAI,WAAW,eAAe,MAAM,aAAa;AAAA,EAEvF,MAAM,OAAO,KAAK,UAAU,KAAK;AAAA,EACjC,IAAI,CAAC,YAAY,IAAI,GAAG;AAAA,IACtB,MAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AAAA,EACA,0BAA0B,KAAK,QAAQ,EAAE,SAAS,GAAG,QAAQ,MAAM,QAAQ,OAAO,CAAC;AAAA,EACnF,OAAO;AAAA;AAGT,SAAS,kBAAkB,CACzB,WACA,WACA,eACA,eACgB;AAAA,EAChB,QAAQ,cAAc;AAAA,SACf;AAAA,MACH,OAAO,4BAA4B;AAAA,QACjC;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,cAAc;AAAA,WACnB,cAAc,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,cAAc,WAAW;AAAA,MAC3F,CAAC;AAAA,SACE,aAAa;AAAA,MAChB,MAAM,SAAS,wBAAwB,cAAc,MAAM;AAAA,MAC3D,OAAO,4BAA4B;AAAA,QACjC;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY;AAAA,UACV,WAAW,6BAA6B,MAAM;AAAA,UAC9C,QAAQ,cAAc,UAAU;AAAA,YAC9B,mBAAmB;AAAA,YACnB,oBAAoB,IAAI,OAAO;AAAA,UACjC;AAAA,QACF;AAAA,QACA,aAAa,OAAO,OAAO,QAAQ,CAAC,UAClC,MAAM,SAAS,iBACX,MAAM,SAAS,IAAI,CAAC,aAAa,EAAE,UAAU,MAAM,UAAU,QAAQ,EAAE,IACvE,CAAC,CACP;AAAA,QACA,YAAY,cAAc;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,SACK;AAAA,MACH,OAAO,2BAA2B,EAAE,WAAW,WAAW,cAAc,CAAC;AAAA;AAAA;AAI/E,SAAS,iBAAiB,CAAC,SAA0B;AAAA,EACnD,OAAO,iBAAiB,SAAS,cAAc,KAAK,OAAO,WAAW;AAAA;AAGxE,SAAS,qBAAqB,CAAC,SAAkB,WAA2B;AAAA,EAC1E,OAAO,iBAAiB,SAAS,kBAAkB,KAAK;AAAA;AAG1D,SAAS,gBAAgB,CAAC,SAAkB,MAAkC;AAAA,EAC5E,MAAM,QAAQ,QAAQ,QAAQ,IAAI,IAAI,GAAG,KAAK;AAAA,EAC9C,OAAO,QAAQ,QAAQ;AAAA;",
-  "debugId": "247D55315669FAAA64756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AA+FO,SAAS,oBAAoB,CAClC,MACA,OACM;AAAA,EACN,MAAM,YAAY,kBAAkB,MAAM,OAAO;AAAA,EACjD,MAAM,gBAAgB,sBAAsB,MAAM,SAAS,SAAS;AAAA,EACpE,MAAM,QAAQ,mBAAmB,KAAK,IAAI,WAAW,eAAe,MAAM,aAAa;AAAA,EAEvF,MAAM,OAAO,KAAK,UAAU,KAAK;AAAA,EACjC,IAAI,CAAC,YAAY,IAAI,GAAG;AAAA,IACtB,MAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AAAA,EACA,0BAA0B,KAAK,QAAQ,EAAE,SAAS,GAAG,QAAQ,MAAM,QAAQ,OAAO,CAAC;AAAA,EACnF,OAAO;AAAA;AAGT,SAAS,kBAAkB,CACzB,WACA,WACA,eACA,eACgB;AAAA,EAChB,QAAQ,cAAc;AAAA,SACf;AAAA,MACH,OAAO,4BAA4B;AAAA,QACjC;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS,cAAc;AAAA,WACnB,cAAc,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,cAAc,WAAW;AAAA,MAC3F,CAAC;AAAA,SACE,aAAa;AAAA,MAChB,MAAM,SAAS,wBAAwB,cAAc,MAAM;AAAA,MAC3D,OAAO,4BAA4B;AAAA,QACjC;AAAA,QACA;AAAA,QACA;AAAA,QACA,YAAY;AAAA,UACV,WAAW,6BAA6B,MAAM;AAAA,UAC9C,QAAQ,cAAc,UAAU;AAAA,YAC9B,mBAAmB;AAAA,YACnB,oBAAoB,IAAI,OAAO;AAAA,UACjC;AAAA,QACF;AAAA,QACA,aAAa,OAAO,OAAO,QAAQ,CAAC,UAClC,MAAM,SAAS,iBACX,MAAM,SAAS,IAAI,CAAC,aAAa,EAAE,UAAU,MAAM,UAAU,QAAQ,EAAE,IACvE,CAAC,CACP;AAAA,QACA,YAAY,cAAc;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,SACK;AAAA,MACH,OAAO,2BAA2B,EAAE,WAAW,WAAW,cAAc,CAAC;AAAA;AAAA;AAI/E,SAAS,iBAAiB,CAAC,SAA0B;AAAA,EACnD,OAAO,iBAAiB,SAAS,cAAc,KAAK,OAAO,WAAW;AAAA;AAGxE,SAAS,qBAAqB,CAAC,SAAkB,WAA2B;AAAA,EAC1E,OAAO,iBAAiB,SAAS,kBAAkB,KAAK;AAAA;AAG1D,SAAS,gBAAgB,CAAC,SAAkB,MAAkC;AAAA,EAC5E,MAAM,QAAQ,QAAQ,QAAQ,IAAI,IAAI,GAAG,KAAK;AAAA,EAC9C,OAAO,QAAQ,QAAQ;AAAA;",
+  "debugId": "B567580DC2E1D03364756E2164756E21",
   "names": []
 }

package/dist/http/api-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-routes.d.ts","sourceRoot":"","sources":["../../src/http/api-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8FAA8F;IAC9F,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CACjC;AAED,eAAO,MAAM,eAAe,EAAE,SAAS,YAAY,EA4elD,CAAA"}
+{"version":3,"file":"api-routes.d.ts","sourceRoot":"","sources":["../../src/http/api-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8FAA8F;IAC9F,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CACjC;AAED,eAAO,MAAM,eAAe,EAAE,SAAS,YAAY,EAymBlD,CAAA"}

package/dist/http/index.js

@@ -4,7 +4,7 @@ import {
   pathSegmentsFor2,
   matchesPathPattern2,
   normalizeRoutePath2
-} from "../chunk-1sr8ryzk.js";
+} from "../chunk-hwksyjks.js";
 export {
   SIXB_API_ROUTES2 as SIXB_API_ROUTES,
   matchesPathPattern2 as matchesPathPattern,