@sixb/core 0.1.20 → 0.1.21

package/dist/chunk-6rqgmkde.js

@@ -0,0 +1,2028 @@
+// @bun
+import {
+  MAX_OBJECT_READ_FACETS2,
+  assertObjectReadOutputWithinLimit2,
+  getAuthorizationRef,
+  captureExecutionScope,
+  resolveExecutionScopeAuthorization,
+  AuthorizationError2,
+  isAllowed2,
+  assertAuthorized2,
+  canViewActionRun2,
+  canViewWorkflowRun2
+} from "./chunk-6vb4st8k.js";
+import {
+  unreadableError,
+  resolvePropertyClearance
+} from "./chunk-9j4jw7as.js";
+import {
+  objectBatchKey2
+} from "./chunk-918wwnaa.js";
+import {
+  ACTIVITY_MIN_IDLE_TIMEOUT_MS,
+  ACTIVITY_MAX_VISIT_MS2
+} from "./chunk-tbc1ngpd.js";
+import {
+  snapshotVectorProfiles
+} from "./chunk-g257jwnc.js";
+import {
+  composeObjectQueryAdmissions,
+  validateObjectQuery2,
+  validateObjectQueryWithAdmission,
+  executeObjectQuery2,
+  countObjects2,
+  existsObjects2,
+  facetObjects2,
+  validateObjectFacetRequests,
+  preflightObjectQueryLinks,
+  executeObjectQueryLinks2
+} from "./chunk-cn0fwwhy.js";
+import {
+  executionRecordInputFromRuntime,
+  ensureExecutionRecord2
+} from "./chunk-vf57cr4t.js";
+import {
+  requireAccountingCapabilities,
+  createAiModelCallLimitController2,
+  AiModelCallRecorder2,
+  enqueueAiModelCallRecovery2
+} from "./chunk-1cc1xaf3.js";
+import {
+  ObjectQueryValidationError2
+} from "./chunk-91mg3nj9.js";
+import {
+  findPrimitiveParentRequestExecution
+} from "./chunk-ey1nk510.js";
+import {
+  createPropertyTokenMap2,
+  createLinkTokenMap2
+} from "./chunk-rdghfsss.js";
+import {
+  OntologyValidationError2,
+  OntologyNotFoundError2,
+  formatUnknownObjectTypeMessage
+} from "./chunk-cqr3acm1.js";
+
+// src/runtime/ontology-mutations.ts
+var ontologyMutationRuntimeKey = Symbol("sixb.ontologyMutationRuntime");
+function registerOntologyMutationRuntime2(owner, runtime) {
+  const registered = owner[ontologyMutationRuntimeKey];
+  if (registered && registered !== runtime) {
+    throw new Error("[Sixb] Ontology mutation runtime is already registered for this owner.");
+  }
+  Object.defineProperty(owner, ontologyMutationRuntimeKey, {
+    configurable: false,
+    enumerable: true,
+    value: runtime,
+    writable: false
+  });
+}
+function getOntologyMutationRuntime2(owner) {
+  const runtime = owner[ontologyMutationRuntimeKey];
+  if (runtime)
+    return runtime;
+  throw new Error("[Sixb] Ontology mutation runtime is not registered for this runtime context.");
+}
+function shareOntologyMutationRuntime2(source, target) {
+  registerOntologyMutationRuntime2(target, getOntologyMutationRuntime2(source));
+}
+function createOntologyMutationRuntime2(input) {
+  const applied = (work) => work.finally(() => notifyWithoutAffecting(input.onProjectionApplied));
+  const runtime = {
+    getProjectionSource: (source) => input.materializer.projections.getActive(source),
+    commitEdits: (command) => commitAndNotify(() => input.materializer.edits.commit(command), input.notifyCommittedFacts),
+    replaceProjection: (command) => applied(commitAndNotify(() => input.materializer.projections.replace(command), input.notifyCommittedFacts)),
+    finishProjection: (command) => applied(input.materializer.projections.finishRun(command)),
+    appendTelemetry: (command) => commitAndNotify(() => input.materializer.telemetry.append(command), input.notifyCommittedFacts)
+  };
+  return Object.freeze(runtime);
+}
+async function commitAndNotify(commit, notify) {
+  const result = await commit();
+  if (result.eventCount > 0)
+    notifyWithoutAffectingCommit(notify);
+  return result;
+}
+function notifyWithoutAffectingCommit(notify) {
+  try {
+    notify();
+  } catch (error) {
+    console.error("[Sixb] Failed to wake the ontology outbox dispatcher:", error);
+  }
+}
+function notifyWithoutAffecting(notify) {
+  try {
+    notify?.();
+  } catch (error) {
+    console.error("[Sixb] Failed to report an applied projection:", error);
+  }
+}
+
+// src/activity/device.ts
+var BROWSERS = [
+  [/\bEdg(?:e|A|iOS)?\//, "Edge"],
+  [/\b(?:OPR|Opera)\//, "Opera"],
+  [/\bSamsungBrowser\//, "Samsung Internet"],
+  [/\b(?:Firefox|FxiOS)\//, "Firefox"],
+  [/\b(?:Chrome|Chromium|CriOS|HeadlessChrome)\//, "Chrome"],
+  [/\bVersion\/[\d.]+.*\bSafari\//, "Safari"]
+];
+var SYSTEMS = [
+  [/\bWindows\b/, "Windows"],
+  [/\biPad\b/, "iPadOS"],
+  [/\b(?:iPhone|iPod)\b/, "iOS"],
+  [/\bAndroid\b/, "Android"],
+  [/\bCrOS\b/, "ChromeOS"],
+  [/\bMac OS X\b|\bMacintosh\b/, "macOS"],
+  [/\bLinux\b/, "Linux"]
+];
+function describeUserAgent(userAgent) {
+  if (!userAgent) {
+    return {};
+  }
+  const browser = BROWSERS.find(([pattern]) => pattern.test(userAgent))?.[1];
+  const os = SYSTEMS.find(([pattern]) => pattern.test(userAgent))?.[1];
+  return {
+    ...browser === undefined ? {} : { browser },
+    ...os === undefined ? {} : { os }
+  };
+}
+
+// src/activity/connection.ts
+async function readActivityConnections(runtime, service, query, now) {
+  const { userId, limit, before } = service.connectionsQuery(query);
+  const sessions = runtime.storage.auth?.sessions;
+  if (!sessions) {
+    return { connections: [] };
+  }
+  const page = await sessions.listByUserId({
+    projectId: runtime.projectId,
+    userId,
+    limit,
+    ...before === undefined ? {} : { before }
+  });
+  const visits = await service.sessionVisits({
+    userId,
+    sessionIds: page.sessions.map((session) => session.id)
+  });
+  const bySession = new Map(visits.map((entry) => [entry.sessionId, entry]));
+  const connections = page.sessions.map((session) => ({
+    ...sessionConnection(session, now),
+    visits: bySession.get(session.id)?.visits ?? 0,
+    latestVisits: bySession.get(session.id)?.latest ?? []
+  }));
+  const last = page.sessions.at(-1);
+  return {
+    connections,
+    ...page.hasMore && last ? { nextCursor: nextConnectionsCursor(page.sessions, last, before) } : {}
+  };
+}
+function nextConnectionsCursor(sessions, last, before) {
+  const { createdAt } = last;
+  const tied = sessions.filter((session) => session.createdAt.getTime() === createdAt.getTime());
+  const earlier = before && before.createdAt.getTime() === createdAt.getTime() ? before.skip : 0;
+  return encodeActivityConnectionsCursor({ createdAt, skip: earlier + tied.length });
+}
+function encodeActivityConnectionsCursor(cursor) {
+  return Buffer.from(JSON.stringify([cursor.createdAt.toISOString(), cursor.skip])).toString("base64url");
+}
+function decodeActivityConnectionsCursor(value) {
+  try {
+    const parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+    if (Array.isArray(parsed) && parsed.length === 2) {
+      const [at, skip] = parsed;
+      const createdAt = new Date(typeof at === "string" ? at : Number.NaN);
+      if (Number.isFinite(createdAt.getTime()) && Number.isSafeInteger(skip) && skip >= 0) {
+        return { createdAt, skip };
+      }
+    }
+  } catch {}
+  throw new Error("[Sixb] Invalid activity connections cursor.");
+}
+async function readActivityConnection(runtime, page, grant, now) {
+  const { storage, projectId } = runtime;
+  const { actor } = page.visit;
+  if (actor.type === "user") {
+    const session = await storage.auth?.sessions.getById({ projectId, id: page.sessionId });
+    return session ? sessionConnection(session, now) : undefined;
+  }
+  const session = await storage.shareSessions?.getById({ projectId, id: page.sessionId });
+  if (!session) {
+    return;
+  }
+  const revokedAt = [session.revokedAt, grant?.revokedAt].flatMap((at) => at === undefined ? [] : [at.getTime()]).sort((left, right) => left - right)[0];
+  const statuses = [
+    connectionStatus(session, now),
+    ...grant ? [connectionStatus(grant, now)] : []
+  ];
+  const status = statuses.includes("revoked") ? "revoked" : statuses.includes("expired") ? "expired" : "active";
+  return {
+    type: "share",
+    grantId: actor.grantId,
+    ...grant ? { definitionId: grant.definitionId } : {},
+    status,
+    createdAt: new Date(session.createdAt),
+    ...revokedAt === undefined ? {} : { revokedAt: new Date(revokedAt) }
+  };
+}
+function connectionStatus(session, now) {
+  if (session.revokedAt) {
+    return "revoked";
+  }
+  const expired = session.expiresAt <= now || session.absoluteExpiresAt !== undefined && session.absoluteExpiresAt <= now;
+  return expired ? "expired" : "active";
+}
+function sessionConnection(session, now) {
+  return {
+    type: "session",
+    device: describeUserAgent(session.userAgent),
+    ...session.bearer === undefined ? {} : { clientName: session.bearer.clientName },
+    status: connectionStatus(session, now),
+    createdAt: new Date(session.createdAt),
+    ...session.lastSeenAt === undefined ? {} : { lastSeenAt: new Date(session.lastSeenAt) },
+    ...session.revokedAt === undefined ? {} : { revokedAt: new Date(session.revokedAt) }
+  };
+}
+
+// src/activity/shares.ts
+async function nameSharedVisits(runtime, visits) {
+  const grants = await readGrants(runtime, visits);
+  return visits.map((visit) => withShare(visit, grants));
+}
+async function nameSharedVisit(runtime, visit) {
+  const grants = await readGrants(runtime, [visit]);
+  const grant = visit.actor.type === "share" ? grants.get(visit.actor.grantId) : undefined;
+  return { visit: withShare(visit, grants), ...grant === undefined ? {} : { grant } };
+}
+async function readGrants(runtime, visits) {
+  const ids = visits.flatMap((visit) => visit.actor.type === "share" ? [visit.actor.grantId] : []);
+  if (ids.length === 0 || !runtime.storage.shareGrants) {
+    return new Map;
+  }
+  const grants = await runtime.storage.shareGrants.getByIds({ projectId: runtime.projectId, ids });
+  return new Map(grants.map((grant) => [grant.id, grant]));
+}
+function withShare(visit, grants) {
+  const { actor } = visit;
+  const grant = actor.type === "share" ? grants.get(actor.grantId) : undefined;
+  if (actor.type !== "share" || grant === undefined) {
+    return visit;
+  }
+  return { ...visit, actor: { ...actor, definitionId: grant.definitionId } };
+}
+
+// src/assert-never.ts
+function assertNever(_value, message) {
+  throw new Error(message);
+}
+
+// src/objects/clearance-redaction.ts
+function redactObjectRow(row, clearance) {
+  return redactRow(row, clearance, true);
+}
+function omitHiddenProperties(row, clearance) {
+  return redactRow(row, clearance, false);
+}
+function attachRedactions(row, clearance) {
+  const hidden = clearance.hiddenProperties(row.objectTypeId);
+  if (hidden !== undefined)
+    row.redactions = hidden.redactions;
+  if (row.links === undefined)
+    return;
+  for (const value of Object.values(row.links)) {
+    if (value === null)
+      continue;
+    if (Array.isArray(value)) {
+      for (const linked of value)
+        attachRedactions(linked, clearance);
+    } else {
+      attachRedactions(value, clearance);
+    }
+  }
+}
+function redactRow(row, clearance, withRedactions) {
+  const hidden = clearance.hiddenProperties(row.objectTypeId);
+  const links = row.links;
+  if (hidden === undefined && links === undefined)
+    return row;
+  const redacted = { ...row };
+  if (hidden !== undefined) {
+    redacted.properties = withoutKeys(row.properties, hidden.ids);
+    if (withRedactions)
+      redacted.redactions = hidden.redactions;
+  }
+  if (links !== undefined) {
+    redacted.links = Object.fromEntries(Object.entries(links).map(([linkId, value]) => [
+      linkId,
+      redactLinkValue(value, clearance, withRedactions)
+    ]));
+  }
+  return redacted;
+}
+function redactLinkValue(value, clearance, withRedactions) {
+  if (value === null)
+    return null;
+  if (Array.isArray(value)) {
+    return value.map((row) => redactRow(row, clearance, withRedactions));
+  }
+  return redactRow(value, clearance, withRedactions);
+}
+function redactDomainEvent(event, clearance) {
+  if (event.topic !== "objects")
+    return event;
+  const hidden = clearance.hiddenProperties(event.payload.objectTypeId);
+  if (hidden === undefined)
+    return event;
+  if (event.type === "object.deleted") {
+    return {
+      ...event,
+      payload: {
+        ...event.payload,
+        propertyChanges: withoutKeys(event.payload.propertyChanges, hidden.ids),
+        redactions: hidden.redactions
+      }
+    };
+  }
+  return {
+    ...event,
+    payload: {
+      ...event.payload,
+      properties: withoutKeys(event.payload.properties, hidden.ids),
+      propertyChanges: withoutKeys(event.payload.propertyChanges, hidden.ids),
+      redactions: hidden.redactions
+    }
+  };
+}
+function withoutKeys(record, hidden) {
+  const kept = { ...record };
+  for (const key of hidden)
+    delete kept[key];
+  return kept;
+}
+
+// src/objects/query/clearance-admission.ts
+function createClearanceQueryAdmission(clearance) {
+  const reachedTypes = new WeakMap;
+  const state = (objectTypeIds) => {
+    const created = Object.freeze({});
+    reachedTypes.set(created, Object.freeze([...objectTypeIds]));
+    return created;
+  };
+  const reached = (input) => {
+    const objectTypeIds = reachedTypes.get(input);
+    if (!objectTypeIds) {
+      throw new Error("[Sixb] Clearance query admission received a state it did not create.");
+    }
+    return objectTypeIds;
+  };
+  const empty = state([]);
+  const admission = {
+    empty: () => empty,
+    source: (input) => ({
+      state: state(input.result.objectTypeIds),
+      ...denied(unreadableTypeAmong(clearance, input.result.objectTypeIds))
+    }),
+    edge: (input) => {
+      const sourceTypeIds = input.direction === "outgoing" ? reached(input.state) : [
+        ...input.result.objectTypeIds,
+        ...input.sourceObjectTypeId ? [input.sourceObjectTypeId] : []
+      ];
+      const link = sourceTypeIds.map((objectTypeId) => clearance.unreadableLink(objectTypeId, input.linkId)).find((unreadable) => unreadable !== undefined);
+      return {
+        state: state(input.result.objectTypeIds),
+        ...denied(link ?? unreadableTypeAmong(clearance, input.result.objectTypeIds))
+      };
+    },
+    set: (input) => input.op === "subtract" ? input.states[0] ?? empty : state([...new Set(input.states.flatMap(reached))]),
+    property: (input) => {
+      if (input.use === "project")
+        return;
+      const objectTypeIds = input.objectTypeId === undefined ? reached(input.state) : [input.objectTypeId];
+      for (const objectTypeId of objectTypeIds) {
+        const marking = clearance.missingMarking(objectTypeId, input.propertyId);
+        if (marking === undefined)
+          continue;
+        return new AuthorizationError2(`clearance:marking:${marking}`, `[Sixb] Cannot ${PROPERTY_USE_VERBS[input.use]} '${objectTypeId}.${input.propertyId}' at '${input.path}': it requires clearance for marking '${marking}'.`);
+      }
+      return;
+    }
+  };
+  return Object.freeze(admission);
+}
+function unreadableTypeAmong(clearance, objectTypeIds) {
+  for (const objectTypeId of objectTypeIds) {
+    const unreadable = clearance.unreadableType(objectTypeId);
+    if (unreadable)
+      return unreadable;
+  }
+  return;
+}
+function denied(unreadable) {
+  return unreadable ? { denial: unreadableError(unreadable) } : {};
+}
+var PROPERTY_USE_VERBS = {
+  filter: "filter by",
+  text: "search",
+  vector: "run a vector search over",
+  sort: "sort by",
+  project: "project",
+  "expand.orderBy": "order expanded objects by",
+  facet: "facet by"
+};
+
+// src/objects/query/link-query-clearance.ts
+function assertLinkQueryReadable(input) {
+  const { ontology, clearance } = input;
+  const { types, links } = clearance.unreadable();
+  if (types.size === 0 && links.length === 0)
+    return;
+  const preflight = preflightObjectQueryLinks({ ...input.request, query: input.query }, { ontology });
+  const selected = preflight.validated.result.objectTypeIds;
+  const outgoing = preflight.direction !== "incoming";
+  const incoming = preflight.direction !== "outgoing";
+  const named = (linkId) => preflight.linkId === undefined || preflight.linkId === linkId;
+  const targets = (expected, objectTypeId) => (typeof expected === "string" ? [expected] : expected).some((target) => ontology.isValidLinkTarget(target, objectTypeId));
+  for (const link of links) {
+    if (!named(link.linkId))
+      continue;
+    if (outgoing && selected.includes(link.objectTypeId) || incoming && selected.some((id) => targets(link.targetObjectTypeId, id))) {
+      throw unreadableError(link);
+    }
+  }
+  const sealed = [...types].filter(([id]) => input.viewableByGrants(id));
+  if (sealed.length === 0)
+    return;
+  for (const objectType of ontology.listObjectTypes()) {
+    for (const link of objectType.links) {
+      if (!named(link.id))
+        continue;
+      if (outgoing && selected.includes(objectType.id)) {
+        const other = sealed.find(([id]) => targets(link.targetObjectTypeId, id));
+        if (other)
+          throw unreadableError(other[1]);
+      }
+      const source = types.get(objectType.id);
+      if (incoming && source && input.viewableByGrants(objectType.id) && selected.some((id) => targets(link.targetObjectTypeId, id))) {
+        throw unreadableError(source);
+      }
+    }
+  }
+}
+
+// src/objects/telemetry/workload.ts
+var MAX_DELEGATED_TELEMETRY_HISTORY_SERIES = 100;
+var MAX_DELEGATED_TELEMETRY_HISTORY_POINTS = 1e4;
+var DEFAULT_DELEGATED_TELEMETRY_HISTORY_LIMIT_PER_SERIES = 100;
+
+class TelemetryHistoryWorkloadExceededError extends Error {
+  metric;
+  limit;
+  name = "TelemetryHistoryWorkloadExceededError";
+  code = "telemetry_history_workload_exceeded";
+  constructor(metric, limit) {
+    super(`[Sixb] Delegated telemetry history exceeded its ${metric} limit (${limit}).`);
+    this.metric = metric;
+    this.limit = limit;
+  }
+}
+function admitTelemetryHistoryReadWorkload(input, delegated) {
+  const seriesCount = input.seriesCount;
+  const limitPerSeries = input.limitPerSeries;
+  if (!Number.isSafeInteger(seriesCount) || seriesCount < 0) {
+    throw new Error("[Sixb] Telemetry history series must have a non-negative safe integer length.");
+  }
+  if (limitPerSeries !== undefined && (!Number.isSafeInteger(limitPerSeries) || limitPerSeries < 0)) {
+    throw new Error("[Sixb] Telemetry history limit must be a non-negative safe integer.");
+  }
+  if (!delegated) {
+    const admission = limitPerSeries === undefined ? {} : { limitPerSeries };
+    return Object.freeze(admission);
+  }
+  if (seriesCount > MAX_DELEGATED_TELEMETRY_HISTORY_SERIES) {
+    throw new TelemetryHistoryWorkloadExceededError("series", MAX_DELEGATED_TELEMETRY_HISTORY_SERIES);
+  }
+  if (seriesCount === 0) {
+    return Object.freeze({
+      ...limitPerSeries === undefined ? {} : { limitPerSeries },
+      maxPointOccurrences: MAX_DELEGATED_TELEMETRY_HISTORY_POINTS
+    });
+  }
+  const maxLimitPerSeries = Math.floor(MAX_DELEGATED_TELEMETRY_HISTORY_POINTS / seriesCount);
+  const effectiveLimitPerSeries = limitPerSeries ?? Math.min(DEFAULT_DELEGATED_TELEMETRY_HISTORY_LIMIT_PER_SERIES, maxLimitPerSeries);
+  if (effectiveLimitPerSeries > maxLimitPerSeries) {
+    throw new TelemetryHistoryWorkloadExceededError("points", MAX_DELEGATED_TELEMETRY_HISTORY_POINTS);
+  }
+  return Object.freeze({
+    limitPerSeries: effectiveLimitPerSeries,
+    maxPointOccurrences: MAX_DELEGATED_TELEMETRY_HISTORY_POINTS
+  });
+}
+
+// src/objects/authorized-ontology-view.ts
+function createAuthorizedOntologyView(input) {
+  const allObjectTypes = input.ontology.listObjectTypes();
+  const registeredObjectTypeIds = new Set(allObjectTypes.map((objectType) => objectType.id));
+  const requestedObjectTypeIds = selectedObjectTypeIds(input.selection, allObjectTypes);
+  const visibleObjectTypeIds = new Set([...requestedObjectTypeIds].filter((objectTypeId) => registeredObjectTypeIds.has(objectTypeId)));
+  const selectedSchema = input.selection.kind === "selected" ? collectSelectedSchema(input.selection.scope) : undefined;
+  const projectedObjectTypes = [];
+  for (const objectType of allObjectTypes) {
+    if (!visibleObjectTypeIds.has(objectType.id))
+      continue;
+    const propertyIds = selectedSchema?.propertyIdsByObjectType.get(objectType.id) ?? new Set(objectType.properties.map((property) => property.id));
+    const links = selectedSchema ? selectedSchema.linksBySourceType.get(objectType.id) ?? new Map : input.selection.kind === "all" ? allDeclaredLinks(objectType) : allVisibleLinks(input.ontology, objectType, visibleObjectTypeIds);
+    projectedObjectTypes.push(projectObjectType({
+      objectType,
+      propertyIds,
+      links,
+      visibleObjectTypeIds,
+      ontology: input.ontology,
+      targetMode: input.selection.kind === "all" ? "original" : input.selection.kind === "types" ? "principal" : "exact",
+      exposeContracts: input.selection.kind !== "selected"
+    }));
+  }
+  const objectTypes = projectedObjectTypes;
+  const objectTypesById = new Map(objectTypes.map((objectType) => [objectType.id, objectType]));
+  const valueTypesById = input.selection.kind === "selected" ? collectVisibleValueTypes(input.ontology.getValueTypesById(), objectTypes) : snapshotAllValueTypes(input.ontology.getValueTypesById());
+  const release = (value, budgetValue = value) => {
+    input.assertOutputWithinLimit?.(budgetValue);
+    return value;
+  };
+  const cloneObjectType = (objectType) => structuredClone(objectType);
+  const cloneValueTypes = () => new Map([...valueTypesById].map(([valueTypeId, valueType]) => [
+    valueTypeId,
+    structuredClone(valueType)
+  ]));
+  return Object.freeze({
+    listObjectTypes: () => release(objectTypes.map(cloneObjectType)),
+    getObjectTypeById: (objectTypeId) => {
+      const objectType = objectTypesById.get(objectTypeId);
+      return release(objectType ? cloneObjectType(objectType) : null);
+    },
+    resolveObjectType: (objectTypeId) => {
+      const objectType = objectTypesById.get(objectTypeId);
+      return objectType ? release(cloneObjectType(objectType)) : unknownObjectType(objectTypeId);
+    },
+    getValueTypesById: () => {
+      const valueTypes = cloneValueTypes();
+      return release(valueTypes, [...valueTypes.entries()]);
+    },
+    getPrimaryPropertyId: (objectTypeId) => {
+      const objectType = objectTypesById.get(objectTypeId);
+      if (!objectType)
+        return unknownObjectType(objectTypeId);
+      const primary = objectType.properties.find((property) => property.primary);
+      if (!primary) {
+        throw new OntologyValidationError2(`[Sixb] Object type '${objectTypeId}' does not expose its primary property in this execution scope.`);
+      }
+      return release(primary.id);
+    },
+    listSubTypes: (objectTypeId) => {
+      const subTypes = visibleObjectTypeIds.has(objectTypeId) ? input.ontology.listSubTypes(objectTypeId).filter((subTypeId) => visibleObjectTypeIds.has(subTypeId)) : [];
+      return release(subTypes);
+    },
+    isValidLinkTarget: (expected, actual) => {
+      if (input.selection.kind === "all") {
+        return release(input.ontology.isValidLinkTarget(expected, actual));
+      }
+      if (!visibleObjectTypeIds.has(actual))
+        return release(false);
+      const expectedTypes = Array.isArray(expected) ? expected : [expected];
+      if (input.selection.kind === "selected") {
+        return release(expectedTypes.some((expectedType) => expectedType === "*" || expectedType === actual));
+      }
+      return release(expectedTypes.some((expectedType) => expectedType === "*" || visibleObjectTypeIds.has(expectedType) && input.ontology.isValidLinkTarget(expectedType, actual)));
+    }
+  });
+}
+function selectedObjectTypeIds(selection, allObjectTypes) {
+  switch (selection.kind) {
+    case "all":
+      return new Set(allObjectTypes.map((objectType) => objectType.id));
+    case "types":
+      return new Set(selection.objectTypeIds);
+    case "selected":
+      return new Set(selection.scope.objects.map((object) => object.objectTypeId));
+  }
+}
+function collectSelectedSchema(scope) {
+  const propertyIdsByObjectType = new Map;
+  for (const object of scope.objects) {
+    const properties = propertyIdsByObjectType.get(object.objectTypeId) ?? new Set;
+    for (const propertyId of object.propertyIds)
+      properties.add(propertyId);
+    propertyIdsByObjectType.set(object.objectTypeId, properties);
+  }
+  const linksBySourceType = new Map;
+  for (const step of scope.steps) {
+    const links = linksBySourceType.get(step.sourceObjectTypeId) ?? new Map;
+    const selected = links.get(step.linkId) ?? {
+      targetObjectTypeIds: new Set,
+      propertyIds: new Set
+    };
+    selected.targetObjectTypeIds.add(step.targetObjectTypeId);
+    for (const propertyId of step.propertyIds)
+      selected.propertyIds.add(propertyId);
+    links.set(step.linkId, selected);
+    linksBySourceType.set(step.sourceObjectTypeId, links);
+  }
+  return { propertyIdsByObjectType, linksBySourceType };
+}
+function allDeclaredLinks(objectType) {
+  return new Map(objectType.links.map((link) => [
+    link.id,
+    {
+      targetObjectTypeIds: new Set(typeof link.targetObjectTypeId === "string" ? [link.targetObjectTypeId] : link.targetObjectTypeId),
+      propertyIds: new Set(link.properties?.map((property) => property.id) ?? [])
+    }
+  ]));
+}
+function allVisibleLinks(ontology, objectType, visibleObjectTypeIds) {
+  const links = new Map;
+  for (const link of objectType.links) {
+    const targetObjectTypeIds = new Set([...visibleObjectTypeIds].filter((targetObjectTypeId) => ontology.isValidLinkTarget(link.targetObjectTypeId, targetObjectTypeId)));
+    if (targetObjectTypeIds.size === 0)
+      continue;
+    links.set(link.id, {
+      targetObjectTypeIds,
+      propertyIds: new Set(link.properties?.map((property) => property.id) ?? [])
+    });
+  }
+  return links;
+}
+function projectObjectType(input) {
+  const properties = input.objectType.properties.filter((property) => input.propertyIds.has(property.id)).map(snapshotProperty);
+  const visiblePropertyIds = new Set(properties.map((property) => property.id));
+  const links = input.objectType.links.flatMap((link) => {
+    const selected = input.links.get(link.id);
+    if (!selected)
+      return [];
+    if (input.targetMode === "original") {
+      return [snapshotLink(link, snapshotLinkTarget(link.targetObjectTypeId), selected.propertyIds)];
+    }
+    const targetObjectTypeIds = new Set([...selected.targetObjectTypeIds].filter((targetObjectTypeId) => input.visibleObjectTypeIds.has(targetObjectTypeId) && input.ontology.isValidLinkTarget(link.targetObjectTypeId, targetObjectTypeId)));
+    if (targetObjectTypeIds.size === 0)
+      return [];
+    const target = input.targetMode === "principal" ? principalLinkTargets(link, targetObjectTypeIds, input.visibleObjectTypeIds) : exactLinkTargets(targetObjectTypeIds);
+    return [snapshotLink(link, target, selected.propertyIds, { omitEmptyProperties: true })];
+  });
+  const projected = {
+    id: input.objectType.id,
+    name: input.objectType.name,
+    description: input.objectType.description,
+    quantityKind: input.objectType.quantityKind,
+    seeAlso: input.objectType.seeAlso ? [...input.objectType.seeAlso] : undefined,
+    extends: input.objectType.extends && input.visibleObjectTypeIds.has(input.objectType.extends) ? input.objectType.extends : undefined,
+    parents: projectOptionalIds(input.objectType.parents, input.visibleObjectTypeIds, input.targetMode === "original"),
+    implements: input.exposeContracts && input.objectType.implements ? [...input.objectType.implements] : undefined,
+    properties,
+    links,
+    search: projectSearch(input.objectType.search, visiblePropertyIds, {
+      preserveEmpty: input.targetMode !== "exact"
+    })
+  };
+  const withTokens = {
+    ...projected,
+    p: createPropertyTokenMap2(projected),
+    l: createLinkTokenMap2(projected)
+  };
+  return deepFreeze(withTokens);
+}
+function principalLinkTargets(link, allowedTargetObjectTypeIds, visibleObjectTypeIds) {
+  if (link.targetObjectTypeId === "*")
+    return exactLinkTargets(allowedTargetObjectTypeIds);
+  const declared = Array.isArray(link.targetObjectTypeId) ? link.targetObjectTypeId : [link.targetObjectTypeId];
+  if (declared.every((objectTypeId) => visibleObjectTypeIds.has(objectTypeId))) {
+    return snapshotLinkTarget(link.targetObjectTypeId);
+  }
+  return exactLinkTargets(allowedTargetObjectTypeIds);
+}
+function exactLinkTargets(targetObjectTypeIds) {
+  const targets = [...targetObjectTypeIds].sort();
+  return targets.length === 1 ? targets[0] : targets;
+}
+function projectOptionalIds(ids, visibleObjectTypeIds, preserveOriginal) {
+  if (!ids)
+    return;
+  if (preserveOriginal)
+    return [...ids];
+  const visible = ids.filter((id) => visibleObjectTypeIds.has(id));
+  return visible.length > 0 ? visible : undefined;
+}
+function snapshotLink(link, targetObjectTypeId, propertyIds, options = {}) {
+  const properties = link.properties?.filter((property) => propertyIds.has(property.id)).map(snapshotProperty);
+  return {
+    id: link.id,
+    name: link.name,
+    description: link.description,
+    targetObjectTypeId,
+    cardinality: link.cardinality,
+    properties: options.omitEmptyProperties && properties?.length === 0 ? undefined : properties
+  };
+}
+function snapshotLinkTarget(target) {
+  return typeof target === "string" ? target : [...target];
+}
+function snapshotProperty(property) {
+  return {
+    id: property.id,
+    name: property.name,
+    schema: snapshotSchema(property.schema),
+    description: property.description,
+    required: property.required,
+    nullable: property.nullable,
+    primary: property.primary,
+    mode: property.mode,
+    semanticType: property.semanticType,
+    query: snapshotPropertyQuery(property.query)
+  };
+}
+function snapshotPropertyQuery(query) {
+  if (!query)
+    return;
+  return {
+    searchable: query.searchable,
+    filterable: query.filterable,
+    sortable: query.sortable,
+    text: query.text,
+    exact: query.exact,
+    facet: query.facet,
+    weight: query.weight
+  };
+}
+function projectSearch(search, visiblePropertyIds, options) {
+  if (!search)
+    return;
+  const title = search.title && visiblePropertyIds.has(search.title) ? search.title : undefined;
+  const selectedDefaultText = search.defaultText?.filter((propertyId) => visiblePropertyIds.has(propertyId));
+  const selectedExact = search.exact?.filter((propertyId) => visiblePropertyIds.has(propertyId));
+  const defaultText = options.preserveEmpty || selectedDefaultText?.length ? selectedDefaultText : undefined;
+  const exact = options.preserveEmpty || selectedExact?.length ? selectedExact : undefined;
+  const vectors = search.vectors === undefined ? undefined : snapshotVectorProfiles(Object.fromEntries(Object.entries(search.vectors).filter(([, profile]) => profile.source.every((id) => visiblePropertyIds.has(id)))));
+  const projected = {
+    ...vectors === undefined || Object.keys(vectors).length === 0 ? {} : { vectors },
+    ...title === undefined ? {} : { title },
+    ...defaultText === undefined ? {} : { defaultText },
+    ...exact === undefined ? {} : { exact }
+  };
+  return Object.keys(projected).length > 0 || options.preserveEmpty ? projected : undefined;
+}
+function snapshotAllValueTypes(registered) {
+  return new Map([...registered.values()].map((valueType) => {
+    const snapshot = snapshotValueType(valueType);
+    return [snapshot.id, snapshot];
+  }));
+}
+function collectVisibleValueTypes(registered, objectTypes) {
+  const referencedIds = new Set;
+  const pendingSchemas = [];
+  const visitedSchemas = new Set;
+  for (const objectType of objectTypes) {
+    for (const property of objectType.properties)
+      pendingSchemas.push(property.schema);
+    for (const link of objectType.links) {
+      for (const property of link.properties ?? [])
+        pendingSchemas.push(property.schema);
+    }
+  }
+  while (pendingSchemas.length > 0) {
+    const schema = pendingSchemas.pop();
+    if (typeof schema === "string" || visitedSchemas.has(schema))
+      continue;
+    visitedSchemas.add(schema);
+    if (schema.type === "valueTypeRef") {
+      if (!referencedIds.has(schema.valueTypeId)) {
+        referencedIds.add(schema.valueTypeId);
+        const valueType = registered.get(schema.valueTypeId);
+        if (valueType)
+          pendingSchemas.push(valueType.schema);
+      }
+      if (schema._resolved)
+        pendingSchemas.push(schema._resolved);
+    } else if (schema.type === "object") {
+      for (const field of Object.values(schema.properties))
+        pendingSchemas.push(field.schema);
+    } else if (schema.type === "array") {
+      pendingSchemas.push(schema.items);
+    } else if (schema.type === "map") {
+      pendingSchemas.push(schema.valueSchema);
+    }
+  }
+  return new Map([...referencedIds].map((valueTypeId) => registered.get(valueTypeId)).filter((valueType) => valueType !== undefined).map((valueType) => {
+    const snapshot = snapshotValueType(valueType);
+    return [snapshot.id, snapshot];
+  }));
+}
+function snapshotValueType(valueType) {
+  return deepFreeze({
+    id: valueType.id,
+    name: valueType.name,
+    description: valueType.description,
+    schema: snapshotSchema(valueType.schema),
+    semanticType: valueType.semanticType
+  });
+}
+function snapshotSchema(schema) {
+  return deepFreeze(structuredClone(schema));
+}
+function deepFreeze(value, seen = new Set) {
+  if (typeof value !== "object" || value === null || seen.has(value))
+    return value;
+  seen.add(value);
+  for (const key of Reflect.ownKeys(value)) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor && "value" in descriptor)
+      deepFreeze(descriptor.value, seen);
+  }
+  return Object.freeze(value);
+}
+function unknownObjectType(objectTypeId) {
+  throw new OntologyNotFoundError2(formatUnknownObjectTypeMessage(objectTypeId));
+}
+
+// src/execution/object-reader-ontology.ts
+class ObjectReaderOntology {
+  registry;
+  #authority;
+  #view;
+  constructor(registry, authority) {
+    this.registry = registry;
+    this.#authority = authority;
+    Object.freeze(this);
+  }
+  view() {
+    const authority = this.#authority;
+    this.#view ??= createAuthorizedOntologyView({
+      ontology: this.registry,
+      selection: selectionForAuthority(authority, this.registry),
+      ...authority.type === "delegated" ? {
+        assertOutputWithinLimit: (value) => assertObjectReadOutputWithinLimit2(value, authority.objectRead.limits)
+      } : {}
+    });
+    return this.#view;
+  }
+}
+function selectionForAuthority(authority, ontology) {
+  switch (authority.type) {
+    case "unrestricted":
+      return { kind: "all" };
+    case "principal":
+      return {
+        kind: "types",
+        objectTypeIds: ontology.listObjectTypes().filter((objectType) => isAllowed2(authority.context, {
+          kind: "object.view",
+          objectTypeId: objectType.id
+        })).map((objectType) => objectType.id)
+      };
+    case "delegated":
+      return { kind: "selected", scope: authority.objectRead.scope };
+  }
+}
+
+// src/objects/query/selected-read-admission.ts
+var selectedStateBrand = Symbol("sixb.selected-object-query-admission-state");
+function createSelectedObjectQueryAdmission(scope) {
+  const selectionByKey = new Map;
+  const selectionsByType = new Map;
+  const propertiesBySelection = new Map;
+  for (const selection of scope.objects) {
+    const key = selectionKey(selection.nodeId, selection.objectTypeId);
+    selectionByKey.set(key, selection);
+    propertiesBySelection.set(key, new Set(selection.propertyIds));
+    const byType = selectionsByType.get(selection.objectTypeId) ?? [];
+    byType.push(selection);
+    selectionsByType.set(selection.objectTypeId, byType);
+  }
+  const outgoing = indexSteps(scope.steps, "outgoing", selectionByKey);
+  const incoming = indexSteps(scope.steps, "incoming", selectionByKey);
+  const emptyState = selectedState([]);
+  const admission = {
+    empty: () => emptyState,
+    source: (input) => {
+      const selections = input.result.objectTypeIds.flatMap((objectTypeId) => selectionsByType.get(objectTypeId) ?? []);
+      const state = selectedState(selections);
+      if (input.kind === "refs") {
+        const missingType = [...new Set(input.refs?.map((ref) => ref.objectTypeId) ?? [])].sort().find((objectTypeId) => !selectionsByType.has(objectTypeId));
+        if (missingType) {
+          return denied2(state, new AuthorizationError2(`view:object:${missingType}`, `[Sixb] Delegated query cannot reference object type '${missingType}' at '${input.path}': the selected object scope does not contain that type.`));
+        }
+      }
+      if (state.selections.length > 0)
+        return { state };
+      const objectTypeId = input.objectTypeId ?? input.result.objectTypeIds[0] ?? "unknown";
+      return denied2(state, new AuthorizationError2(`view:object:${objectTypeId}`, `[Sixb] Delegated query cannot start from object type '${objectTypeId}' at '${input.path}': the selected object scope does not contain that type.`));
+    },
+    property: (input) => propertyDenial(asSelectedState(input.state), input.propertyId, input.objectTypeId, input.use, input.path, propertiesBySelection),
+    edge: (input) => {
+      const state = asSelectedState(input.state);
+      const next = followEdge(state, input.linkId, input.direction, input.sourceObjectTypeId, outgoing, incoming, input.result.objectTypeIds);
+      if (next.selections.length > 0 || state.selections.length === 0)
+        return { state: next };
+      return denied2(next, edgeDenial(state, input.linkId, input.direction, input.sourceObjectTypeId, input.use, input.path));
+    },
+    set: ({ op, states }) => {
+      if (op === "subtract")
+        return asSelectedState(states[0] ?? emptyState);
+      return selectedState(states.flatMap((state) => asSelectedState(state).selections));
+    },
+    assertPropertySelected: (input) => {
+      const denial = propertyDenial(asSelectedState(input.state), input.propertyId, input.objectTypeId, input.use, input.path, propertiesBySelection);
+      if (denial)
+        throw denial;
+    },
+    assertIncidentEdgeSelected: (input) => {
+      if (input.linkId === undefined)
+        return;
+      const state = asSelectedState(input.state);
+      const directions = input.direction === "both" ? ["outgoing", "incoming"] : [input.direction];
+      const next = selectedState(directions.flatMap((direction) => followEdge(state, input.linkId, direction, undefined, outgoing, incoming).selections));
+      if (next.selections.length > 0 || state.selections.length === 0)
+        return;
+      throw edgeDenial(state, input.linkId, input.direction, undefined, "queryLinks", input.path);
+    }
+  };
+  return Object.freeze(admission);
+}
+function indexSteps(steps, direction, selectionByKey) {
+  const index = new Map;
+  for (const step of steps) {
+    const fromKey = direction === "outgoing" ? selectionKey(step.parentNodeId, step.sourceObjectTypeId) : selectionKey(step.nodeId, step.targetObjectTypeId);
+    const toKey = direction === "outgoing" ? selectionKey(step.nodeId, step.targetObjectTypeId) : selectionKey(step.parentNodeId, step.sourceObjectTypeId);
+    const target = selectionByKey.get(toKey);
+    if (!selectionByKey.has(fromKey) || !target) {
+      throw new Error("[Sixb] Compiled selected object scope contains an invalid query path step.");
+    }
+    const key = edgeKey(direction === "outgoing" ? step.parentNodeId : step.nodeId, direction === "outgoing" ? step.sourceObjectTypeId : step.targetObjectTypeId, step.linkId);
+    const targets = index.get(key) ?? [];
+    targets.push(target);
+    index.set(key, targets);
+  }
+  return index;
+}
+function followEdge(state, linkId, direction, sourceObjectTypeId, outgoing, incoming, resultObjectTypeIds) {
+  const index = direction === "outgoing" ? outgoing : incoming;
+  const resultTypes = resultObjectTypeIds ? new Set(resultObjectTypeIds) : undefined;
+  const selections = state.selections.flatMap((selection) => {
+    const candidates = index.get(edgeKey(selection.nodeId, selection.objectTypeId, linkId)) ?? [];
+    return candidates.filter((candidate) => (resultTypes === undefined || resultTypes.has(candidate.objectTypeId)) && (direction === "outgoing" || sourceObjectTypeId === undefined || candidate.objectTypeId === sourceObjectTypeId));
+  });
+  return selectedState(selections);
+}
+function propertyDenial(state, propertyId, objectTypeId, use, path, propertiesBySelection) {
+  const candidates = objectTypeId ? state.selections.filter((selection) => selection.objectTypeId === objectTypeId) : state.selections;
+  if (candidates.length === 0)
+    return;
+  const missing = candidates.find((selection) => !propertiesBySelection.get(selectionKey(selection.nodeId, selection.objectTypeId))?.has(propertyId));
+  if (!missing)
+    return;
+  const objectTypeIds = [...new Set(candidates.map((selection) => selection.objectTypeId))].sort();
+  return new AuthorizationError2(`view:object:${objectTypeIds.join(",")}:property:${propertyId}`, `[Sixb] Delegated query cannot use property '${propertyId}' for ${use} at '${path}': it is not selected on every matching read-scope path (missing on ${formatSelection(missing)}).`);
+}
+function edgeDenial(state, linkId, direction, sourceObjectTypeId, use, path) {
+  const source = sourceObjectTypeId ? `:${sourceObjectTypeId}` : "";
+  return new AuthorizationError2(`view:link:${direction}${source}:${linkId}`, `[Sixb] Delegated query cannot use ${direction} link '${linkId}' for ${use} from ${formatState(state)} at '${path}': that exact read-scope path is not selected.`);
+}
+function formatState(state) {
+  if (state.selections.length === 0)
+    return "an empty read-scope provenance";
+  return `read-scope provenance ${state.selections.map(formatSelection).join(", ")}`;
+}
+function formatSelection(selection) {
+  return `'${selection.objectTypeId}'@node ${selection.nodeId}`;
+}
+function selectedState(selections) {
+  const unique = new Map;
+  for (const selection of selections) {
+    unique.set(selectionKey(selection.nodeId, selection.objectTypeId), selection);
+  }
+  return Object.freeze({
+    [selectedStateBrand]: true,
+    selections: Object.freeze([...unique.values()].sort((left, right) => left.nodeId - right.nodeId || left.objectTypeId.localeCompare(right.objectTypeId)))
+  });
+}
+function asSelectedState(state) {
+  if (state[selectedStateBrand] !== true) {
+    throw new Error("[Sixb] Object query admission state belongs to another semantic admission.");
+  }
+  return state;
+}
+function denied2(state, denial) {
+  return { state, denial };
+}
+function selectionKey(nodeId, objectTypeId) {
+  return JSON.stringify([nodeId, objectTypeId]);
+}
+function edgeKey(nodeId, objectTypeId, linkId) {
+  return JSON.stringify([nodeId, objectTypeId, linkId]);
+}
+
+// src/execution/object-reader-clearance.ts
+class ObjectReaderClearance {
+  #ontology;
+  #static;
+  #clearances;
+  #applied;
+  #lastSnapshot;
+  #lastClearance;
+  constructor(input) {
+    this.#ontology = input.ontology;
+    this.#clearances = input.clearances;
+    this.#static = input.clearances && resolvePropertyClearance(input.ontology, input.clearances);
+    if (input.clearances && input.appliedMarkings?.affects(input.clearances)) {
+      this.#applied = input.appliedMarkings;
+    }
+    Object.freeze(this);
+  }
+  current() {
+    const applied = this.#applied;
+    const clearances = this.#clearances;
+    if (!applied || !clearances)
+      return this.#static;
+    return applied.current().then((snapshot) => {
+      if (snapshot !== this.#lastSnapshot) {
+        this.#lastClearance = resolvePropertyClearance(this.#ontology, clearances, snapshot);
+        this.#lastSnapshot = snapshot;
+      }
+      return this.#lastClearance;
+    });
+  }
+  forEvent(sources) {
+    const applied = this.#applied;
+    const clearances = this.#clearances;
+    if (!applied || !clearances)
+      return this.#static;
+    return applied.current().then((snapshot) => sources.origin ? applied.forEventOrigin(snapshot, sources.origin) : snapshot).then((snapshot) => sources.earlier ? applied.forEarlierValues(snapshot, sources.objectTypeId) : snapshot).then((snapshot) => resolvePropertyClearance(this.#ontology, clearances, snapshot));
+  }
+}
+
+// src/execution/object-reader-security.ts
+class ObjectReaderSecurity {
+  authorization;
+  authority;
+  runtime;
+  delegation;
+  clearance;
+  constructor(input) {
+    const authority = input.authority;
+    this.authorization = input.authorization;
+    this.authority = authority;
+    this.runtime = Object.freeze({
+      projectId: input.projectId,
+      runtimeAuthorization: input.authorization,
+      ...authority.type === "principal" ? { authorization: authority.context } : {}
+    });
+    if (authority.type === "delegated") {
+      const scope = authority.objectRead.scope;
+      this.delegation = Object.freeze({
+        objectTypeIds: new Set(scope.objects.map((object) => object.objectTypeId)),
+        linkDefinitions: new Set(scope.steps.map(delegatedLinkDefinitionKey)),
+        queryAdmission: createSelectedObjectQueryAdmission(scope)
+      });
+    }
+    this.clearance = new ObjectReaderClearance({
+      ontology: input.ontology,
+      clearances: clearancesForAuthority(authority),
+      ...input.appliedMarkings === undefined ? {} : { appliedMarkings: input.appliedMarkings }
+    });
+    Object.freeze(this);
+  }
+  assertObjectTypesViewable(objectTypeIds, clearance) {
+    if (this.delegation) {
+      for (const objectTypeId of new Set(objectTypeIds)) {
+        if (this.delegation.objectTypeIds.has(objectTypeId))
+          continue;
+        throw new AuthorizationError2(`delegated:object.view:${objectTypeId}`, `[Sixb] Delegated authorization does not select object type '${objectTypeId}'.`);
+      }
+    } else {
+      for (const objectTypeId of new Set(objectTypeIds)) {
+        assertAuthorized2(this.runtime, { kind: "object.view", objectTypeId });
+      }
+    }
+    if (!clearance)
+      return;
+    for (const objectTypeId of new Set(objectTypeIds)) {
+      const unreadable = clearance.unreadableType(objectTypeId);
+      if (unreadable)
+        throw unreadableError(unreadable);
+    }
+  }
+  isObjectTypeViewable(objectTypeId, clearance) {
+    if (clearance?.unreadableType(objectTypeId))
+      return false;
+    if (this.delegation)
+      return this.delegation.objectTypeIds.has(objectTypeId);
+    return isAllowed2(this.runtime.authorization, { kind: "object.view", objectTypeId });
+  }
+  isLinkViewable(link, clearance) {
+    if (!this.isObjectTypeViewable(link.sourceTypeId, clearance) || !this.isObjectTypeViewable(link.targetTypeId, clearance) || clearance?.unreadableLink(link.sourceTypeId, link.linkId)) {
+      return false;
+    }
+    return this.delegation?.linkDefinitions.has(delegatedLinkDefinitionKey(link)) ?? true;
+  }
+}
+function clearancesForAuthority(authority) {
+  switch (authority.type) {
+    case "unrestricted":
+      return;
+    case "principal":
+      return authority.context.clearances ?? new Set;
+    case "delegated":
+      return new Set;
+  }
+}
+function delegatedLinkDefinitionKey(input) {
+  return "sourceObjectTypeId" in input ? JSON.stringify([input.sourceObjectTypeId, input.linkId, input.targetObjectTypeId]) : JSON.stringify([input.sourceTypeId, input.linkId, input.targetTypeId]);
+}
+
+// src/execution/authorized-object-reader.ts
+var readerConstructionKey = Object.freeze({});
+
+class AuthorizedObjectReaderImpl {
+  #ontology;
+  #security;
+  #models;
+  #storage;
+  constructor(key, input) {
+    if (key !== readerConstructionKey) {
+      throw new Error("[Sixb] AuthorizedObjectReader can only be created by Core.");
+    }
+    this.#ontology = input.ontology;
+    this.#security = input.security;
+    this.#models = input.models;
+    this.#storage = input.storage;
+  }
+  static assertBound(reader, scope) {
+    const capturedScope = captureExecutionScope(scope);
+    resolveExecutionScopeAuthorization(reader.#security.runtime.projectId, capturedScope);
+    if (capturedScope.authorization !== reader.#security.authorization) {
+      throw new Error("[Sixb] AuthorizedObjectReader is not bound to this exact execution authority.");
+    }
+  }
+  static async clearance(reader) {
+    return reader.#security.clearance.current();
+  }
+  static eventClearance(reader, sources) {
+    return reader.#security.clearance.forEvent(sources);
+  }
+  static ontologyView(reader) {
+    return reader.#ontology.view();
+  }
+  get projectId() {
+    return this.#security.runtime.projectId;
+  }
+  async getByPrimaryId(input) {
+    const request = snapshotReadValue({
+      objectTypeId: input.objectTypeId,
+      primaryId: input.primaryId
+    });
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance);
+    const row = await this.#storage.getByPrimaryId({
+      ...request,
+      projectId: this.#security.runtime.projectId
+    });
+    return this.#detachRows(row && this.#omitHidden(row, clearance), (detached) => [detached], clearance);
+  }
+  async getByPrimaryIdBatch(input) {
+    const request = snapshotReadValue({
+      items: input.items.map((item) => ({
+        objectTypeId: item.objectTypeId,
+        primaryId: item.primaryId
+      }))
+    });
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable(request.items.map((item) => item.objectTypeId), clearance);
+    const rows = await this.#storage.getByPrimaryIdBatch({
+      ...request,
+      projectId: this.#security.runtime.projectId
+    });
+    return this.#detachRows(new Map([...rows].map(([key, row]) => [key, this.#omitHidden(row, clearance)])), (detached) => detached.values(), clearance);
+  }
+  async canReadObjectProperty(input) {
+    const request = snapshotReadValue({
+      objectTypeId: input.objectTypeId,
+      primaryId: input.primaryId,
+      propertyId: input.propertyId
+    });
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance);
+    if (hidesProperty(request, clearance))
+      return false;
+    if (this.#security.authority.type !== "delegated")
+      return true;
+    const [readable] = await this.#storage.selectsObjectProperties({
+      projectId: this.#security.runtime.projectId,
+      items: [request]
+    });
+    return readable ?? false;
+  }
+  async canReadObjectPropertiesBatch(input) {
+    const request = snapshotReadValue({
+      items: input.items.map((item) => ({
+        objectTypeId: item.objectTypeId,
+        primaryId: item.primaryId,
+        propertyId: item.propertyId
+      }))
+    });
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable(request.items.map((item) => item.objectTypeId), clearance);
+    const selected = this.#security.authority.type === "delegated" ? await this.#storage.selectsObjectProperties({
+      ...request,
+      projectId: this.#security.runtime.projectId
+    }) : request.items.map(() => true);
+    return request.items.map((item, index) => !hidesProperty(item, clearance) && selected[index] === true);
+  }
+  async list(input) {
+    const request = snapshotReadValue({
+      objectTypeId: typeof input.objectTypeId === "string" ? input.objectTypeId : input.objectTypeId === undefined ? undefined : [...input.objectTypeId],
+      primaryIdPrefix: input.primaryIdPrefix,
+      primaryIdSuffix: input.primaryIdSuffix,
+      updatedAfter: input.updatedAfter,
+      updatedBefore: input.updatedBefore,
+      createdAfter: input.createdAfter,
+      createdBefore: input.createdBefore,
+      limit: input.limit,
+      offset: input.offset,
+      orderBy: input.orderBy,
+      order: input.order
+    });
+    const clearance = await this.#security.clearance.current();
+    const objectTypeId = this.#resolveListObjectTypes(request.objectTypeId, clearance);
+    if (Array.isArray(objectTypeId) && objectTypeId.length === 0) {
+      return { objects: [], hasMore: false, total: 0 };
+    }
+    const page = await this.#storage.list({
+      ...request,
+      ...objectTypeId === undefined ? {} : { objectTypeId },
+      projectId: this.#security.runtime.projectId
+    });
+    return this.#detachRows({ ...page, objects: page.objects.map((row) => this.#omitHidden(row, clearance)) }, (detached) => detached.objects, clearance);
+  }
+  async listLinks(input) {
+    const request = snapshotReadValue({
+      objectTypeId: input.objectTypeId,
+      objectId: input.objectId,
+      linkId: input.linkId,
+      direction: input.direction
+    });
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance);
+    const links = detachReadResult(await this.#storage.listLinks({
+      ...request,
+      projectId: this.#security.runtime.projectId
+    }));
+    return links.filter((link) => this.#security.isLinkViewable(link, clearance));
+  }
+  async listLinksBatch(input) {
+    const request = snapshotReadValue({
+      direction: input.direction,
+      items: input.items.map((item) => ({
+        objectTypeId: item.objectTypeId,
+        objectId: item.objectId,
+        linkId: item.linkId
+      }))
+    });
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable(request.items.map((item) => item.objectTypeId), clearance);
+    const pages = detachReadResult(await this.#storage.listLinksBatch({
+      ...request,
+      projectId: this.#security.runtime.projectId
+    }));
+    const filtered = new Map;
+    for (const [key, links] of pages) {
+      filtered.set(key, links.filter((link) => this.#security.isLinkViewable(link, clearance)));
+    }
+    return filtered;
+  }
+  async executeQuery(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const includeTotal = snapshotReadValue(input.includeTotal);
+    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query;
+    const clearance = await this.#security.clearance.current();
+    const result = await executeObjectQuery2({
+      query: executionQuery,
+      ...includeTotal === undefined ? {} : { includeTotal },
+      projectId: this.#security.runtime.projectId,
+      signal: input.signal
+    }, this.#queryExecutorOptions(clearance));
+    return this.#detachRows({ ...result, objects: result.objects.map((row) => this.#omitHidden(row, clearance)) }, (detached) => detached.objects, clearance);
+  }
+  async queryLinks(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const request = snapshotReadValue({
+      direction: input.direction,
+      linkId: input.linkId,
+      includeObjects: input.includeObjects,
+      pageSize: input.pageSize,
+      pageToken: input.pageToken
+    });
+    let executionQuery = query;
+    const admission = this.#security.delegation?.queryAdmission;
+    if (admission) {
+      const preflight = preflightObjectQueryLinks({ query, ...request, projectId: this.#security.runtime.projectId }, { ontology: this.#ontology.registry });
+      const admitted = validateObjectQueryWithAdmission(preflight.validated.query, { ontology: this.#ontology.registry, normalize: false }, admission);
+      admission.assertIncidentEdgeSelected({
+        state: admitted.admissionState,
+        ...preflight.linkId === undefined ? {} : { linkId: preflight.linkId },
+        direction: preflight.direction,
+        path: "$.linkId"
+      });
+      executionQuery = admitted.query;
+    }
+    const clearance = await this.#security.clearance.current();
+    if (clearance) {
+      assertLinkQueryReadable({
+        ontology: this.#ontology.registry,
+        clearance,
+        query,
+        request: { ...request, projectId: this.#security.runtime.projectId },
+        viewableByGrants: (objectTypeId) => this.#security.isObjectTypeViewable(objectTypeId, undefined)
+      });
+    }
+    const result = detachReadResult(await executeObjectQueryLinks2({ query: executionQuery, ...request, projectId: this.#security.runtime.projectId }, this.#queryExecutorOptions(clearance)));
+    if (result.objects.some((row) => !this.#security.isObjectTypeViewable(row.objectTypeId, clearance)) || result.links.some((link) => !this.#security.isLinkViewable(link, clearance))) {
+      throw new Error("[Sixb] Object storage returned a link page outside its authorized scope.");
+    }
+    return {
+      ...result,
+      objects: result.objects.map((row) => clearance ? redactObjectRow(row, clearance) : row)
+    };
+  }
+  async count(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query;
+    const clearance = await this.#security.clearance.current();
+    return detachReadResult(await countObjects2({ query: executionQuery, projectId: this.#security.runtime.projectId }, this.#queryExecutorOptions(clearance)));
+  }
+  async exists(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query;
+    const clearance = await this.#security.clearance.current();
+    return detachReadResult(await existsObjects2({ query: executionQuery, projectId: this.#security.runtime.projectId }, this.#queryExecutorOptions(clearance)));
+  }
+  async facet(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const facets = snapshotFacetRequests(input.facets);
+    let executionQuery = query;
+    let executionFacets = facets;
+    const admission = this.#security.delegation?.queryAdmission;
+    if (admission) {
+      const validated = validateObjectQuery2(query, { ontology: this.#ontology.registry });
+      const normalizedFacets = validateObjectFacetRequests(facets, validated.result.objectTypeIds, {
+        ontology: this.#ontology.registry
+      });
+      const admitted = validateObjectQueryWithAdmission(validated.query, { ontology: this.#ontology.registry, normalize: false }, admission);
+      normalizedFacets.forEach((facet, index) => {
+        admission.assertPropertySelected({
+          state: admitted.admissionState,
+          propertyId: facet.propertyId,
+          use: "facet",
+          path: `$.facets[${index}].propertyId`
+        });
+      });
+      executionQuery = admitted.query;
+      executionFacets = normalizedFacets;
+    }
+    const clearance = await this.#security.clearance.current();
+    return detachReadResult(await facetObjects2({
+      query: executionQuery,
+      facets: executionFacets,
+      projectId: this.#security.runtime.projectId
+    }, this.#queryExecutorOptions(clearance)));
+  }
+  async writtenRowRedactor(objectTypeId) {
+    const clearance = await this.#security.clearance.current();
+    assertTargetsReadable(clearance, { objectTypeIds: [objectTypeId] });
+    return (row) => clearance ? redactObjectRow(row, clearance) : row;
+  }
+  async assertReadable(targets) {
+    assertTargetsReadable(await this.#security.clearance.current(), targets);
+  }
+  assertVisibleOutputWithinLimit(value) {
+    if (this.#security.authority.type !== "delegated")
+      return;
+    assertObjectReadOutputWithinLimit2(value, this.#security.authority.objectRead.limits);
+  }
+  admitTelemetryHistoryRead(input) {
+    return admitTelemetryHistoryReadWorkload(input, this.#security.authority.type === "delegated");
+  }
+  #queryExecutorOptions(clearance) {
+    const admission = this.#executorAdmission(clearance);
+    if (this.#security.authority.type === "delegated") {
+      return {
+        ontology: this.#ontology.registry,
+        storage: this.#storage,
+        embeddingModels: this.#models.embedding,
+        rerankingModels: this.#models.reranking,
+        ...admission === undefined ? {} : { admission }
+      };
+    }
+    return {
+      ontology: this.#ontology.registry,
+      embeddingModels: this.#models.embedding,
+      rerankingModels: this.#models.reranking,
+      storage: this.#storage,
+      runtimeAuthorization: this.#security.runtime.runtimeAuthorization,
+      ...this.#security.runtime.authorization === undefined ? {} : { authorization: this.#security.runtime.authorization },
+      ...admission === undefined ? {} : { admission }
+    };
+  }
+  #executorAdmission(clearance) {
+    const admission = clearance && createClearanceQueryAdmission(clearance);
+    const selected = this.#security.delegation?.queryAdmission;
+    if (selected && admission)
+      return composeObjectQueryAdmissions(selected, admission);
+    return selected ?? admission;
+  }
+  #omitHidden(row, clearance) {
+    return clearance ? omitHiddenProperties(row, clearance) : row;
+  }
+  #detachRows(result, rows, clearance) {
+    const detached = detachReadResult(result);
+    if (clearance) {
+      for (const row of rows(detached))
+        if (row)
+          attachRedactions(row, clearance);
+    }
+    return detached;
+  }
+  #admitDelegatedQuery(query) {
+    const admission = this.#security.delegation?.queryAdmission;
+    if (!admission)
+      return;
+    return validateObjectQueryWithAdmission(query, { ontology: this.#ontology.registry }, admission);
+  }
+  #resolveListObjectTypes(requested, clearance) {
+    if (requested !== undefined) {
+      const objectTypeIds = typeof requested === "string" ? [requested] : [...new Set(requested)];
+      for (const objectTypeId of objectTypeIds) {
+        this.#ontology.registry.resolveObjectType(objectTypeId);
+      }
+      this.#security.assertObjectTypesViewable(objectTypeIds, clearance);
+      return typeof requested === "string" ? requested : objectTypeIds;
+    }
+    if (this.#security.authority.type === "unrestricted")
+      return;
+    return this.#ontology.registry.listObjectTypes().map((objectType) => objectType.id).filter((objectTypeId) => this.#security.isObjectTypeViewable(objectTypeId, clearance));
+  }
+}
+Object.freeze(AuthorizedObjectReaderImpl.prototype);
+Object.freeze(AuthorizedObjectReaderImpl);
+function createAuthorizedObjectReader(input) {
+  const scope = captureExecutionScope(input.scope);
+  const projectId = scope.execution.projectId;
+  const authority = resolveExecutionScopeAuthorization(projectId, scope);
+  const storage = objectStorageForAuthority(authority, input.objectStorage);
+  const reader = new AuthorizedObjectReaderImpl(readerConstructionKey, {
+    ontology: new ObjectReaderOntology(input.ontology, authority),
+    security: new ObjectReaderSecurity({
+      authorization: scope.authorization,
+      authority,
+      projectId,
+      ontology: input.ontology,
+      ...input.appliedMarkings === undefined ? {} : { appliedMarkings: input.appliedMarkings }
+    }),
+    models: Object.freeze({
+      ...input.embeddingModels === undefined ? {} : { embedding: input.embeddingModels },
+      ...input.rerankingModels === undefined ? {} : { reranking: input.rerankingModels }
+    }),
+    storage
+  });
+  Object.freeze(reader);
+  return reader;
+}
+function assertAuthorizedObjectReaderBinding(input) {
+  AuthorizedObjectReaderImpl.assertBound(input.reader, input.scope);
+}
+function getAuthorizedOntologyView(reader) {
+  return AuthorizedObjectReaderImpl.ontologyView(reader);
+}
+function readerClearance(reader) {
+  return AuthorizedObjectReaderImpl.clearance(reader);
+}
+function readerEventClearance(reader, sources) {
+  return AuthorizedObjectReaderImpl.eventClearance(reader, sources);
+}
+function assertTargetsReadable(clearance, targets) {
+  if (!clearance)
+    return;
+  for (const objectTypeId of targets.objectTypeIds) {
+    const unreadable = clearance.unreadableType(objectTypeId);
+    if (unreadable)
+      throw unreadableError(unreadable);
+  }
+  for (const link of targets.links ?? []) {
+    const unreadable = clearance.unreadableLink(link.objectTypeId, link.linkId);
+    if (unreadable)
+      throw unreadableError(unreadable);
+  }
+}
+function hidesProperty(item, clearance) {
+  return clearance?.missingMarking(item.objectTypeId, item.propertyId) !== undefined;
+}
+function objectStorageForAuthority(authority, objectStorage) {
+  switch (authority.type) {
+    case "principal":
+    case "unrestricted":
+      return objectStorage;
+    case "delegated":
+      return objectStorage.createSelectedReadScope({
+        projectId: authority.projectId,
+        scope: authority.objectRead.scope,
+        limits: authority.objectRead.limits
+      });
+    default:
+      return assertNever(authority, `[Sixb] Unsupported object reader authority '${String(authority.type)}'.`);
+  }
+}
+function detachReadResult(value) {
+  return structuredClone(value);
+}
+function snapshotReadValue(value) {
+  return structuredClone(value);
+}
+function snapshotFacetRequests(facets) {
+  if (!Array.isArray(facets)) {
+    throw new ObjectQueryValidationError2([
+      {
+        path: "$.facets",
+        code: "invalid_facets",
+        message: "facets must be an array"
+      }
+    ]);
+  }
+  const length = facets.length;
+  if (!Number.isSafeInteger(length) || length > MAX_OBJECT_READ_FACETS2) {
+    throw new ObjectQueryValidationError2([
+      {
+        path: "$.facets",
+        code: "too_many_facets",
+        message: `facets must include at most ${MAX_OBJECT_READ_FACETS2} facet requests`
+      }
+    ]);
+  }
+  const snapshot = [];
+  for (let index = 0;index < length; index += 1) {
+    const facet = facets[index];
+    snapshot.push({ propertyId: facet.propertyId, limit: facet.limit });
+  }
+  return snapshot;
+}
+function snapshotAuthoredQuery(query) {
+  try {
+    const snapshot = structuredClone(query);
+    const pending = [snapshot];
+    const seen = new Set;
+    for (const node of pending) {
+      if (seen.has(node))
+        continue;
+      seen.add(node);
+      if (node.kind === "vector" && (typeof node.vector !== "string" || typeof node.profile !== "string" || ("propertyId" in node))) {
+        throw new ObjectQueryValidationError2([
+          {
+            path: "$",
+            code: "invalid_vector_search_input",
+            message: "Vector search requires a named profile and search text"
+          }
+        ]);
+      }
+      if ("input" in node)
+        pending.push(node.input);
+      if (node.kind === "set")
+        pending.push(...node.inputs);
+    }
+    return snapshot;
+  } catch (error) {
+    if (error instanceof ObjectQueryValidationError2)
+      throw error;
+    throw new ObjectQueryValidationError2([
+      {
+        path: "$",
+        code: "query_not_cloneable",
+        message: "Object query must contain only structured-cloneable data"
+      }
+    ]);
+  }
+}
+
+// src/actions/run-authorization.ts
+async function canReadActionRunSubject(objectReader, run) {
+  if (run.subject.kind !== "object")
+    return true;
+  const clearance = await readerClearance(objectReader);
+  return clearance?.unreadableType(run.subject.objectTypeId) === undefined;
+}
+async function unreadableActionRunTypes(objectReader) {
+  const clearance = await readerClearance(objectReader);
+  return new Set(clearance?.unreadable().types.keys());
+}
+async function canDelegationAccessActionRun(input) {
+  const subject = input.run.subject;
+  if (!input.authority.delegation || subject.kind !== "object" || !input.authority.actionApply.some((target) => target.actionId === input.run.actionId && target.subject.objectTypeId === subject.objectTypeId && target.subject.primaryId === subject.primaryId)) {
+    return false;
+  }
+  return actionRunBelongsToShareGrant({
+    storage: input.storage,
+    projectId: input.projectId,
+    run: input.run,
+    grantId: input.authority.delegation.grantId
+  });
+}
+async function actionRunBelongsToShareGrant(input) {
+  const parent = await findPrimitiveParentRequestExecution({
+    executions: input.storage.executions,
+    projectId: input.projectId,
+    executionId: input.run.executionId,
+    primitive: { kind: "action", id: input.run.actionId, runId: input.run.id }
+  });
+  const authorization = parent?.authorizationRef;
+  return authorization?.type === "delegated" && authorization.delegation.kind === "share" && authorization.delegation.grantId === input.grantId;
+}
+
+// src/runtime/ai-cost.ts
+async function resolveExecutionCosts(input) {
+  if (input.executionIds.length === 0)
+    return [];
+  if (!input.storage)
+    return input.executionIds.map(() => {
+      return;
+    });
+  return input.storage.summarizeExecutions({
+    projectId: input.projectId,
+    executionIds: input.executionIds
+  });
+}
+
+// src/activity/timeline.ts
+var ACTIVITY_TIMELINE_LIMIT = 200;
+var SESSION_GRACE_MS = ACTIVITY_MIN_IDLE_TIMEOUT_MS / 2;
+async function composeActivityTimeline(runtime, input, now) {
+  const { page, visit } = input;
+  const { storage, projectId } = runtime;
+  const [ledger, connection] = await Promise.all([
+    storage.executions.listBySession({
+      projectId,
+      session: { type: visit.actor.type, id: page.sessionId },
+      ...sessionWindow(visit),
+      limit: ACTIVITY_TIMELINE_LIMIT
+    }),
+    readActivityConnection(runtime, page, input.grant, now)
+  ]);
+  const executions = ledger.executions;
+  const ofKind = (kind) => executions.flatMap((execution) => execution.executor.type === "primitive" && execution.executor.kind === kind ? [execution.id] : []);
+  const agentRunIds = executions.flatMap((execution) => execution.executor.type === "agent" ? [execution.executor.runId] : []);
+  const byId = new Map(executions.map((execution) => [execution.id, execution]));
+  const withAgent = executions.filter((execution) => lineage(execution, byId).some((ancestor) => ancestor.executor.type === "agent"));
+  const [actionRuns, workflowRuns, agentRuns, costs] = await Promise.all([
+    storage.actionRuns?.getByExecutionIds({ projectId, executionIds: ofKind("action") }) ?? [],
+    storage.workflowRuns?.getByExecutionIds({ projectId, executionIds: ofKind("workflow") }) ?? [],
+    storage.agents?.runs.getByIds({ projectId, ids: agentRunIds }) ?? [],
+    resolveExecutionCosts({
+      storage: storage.aiCosts,
+      projectId,
+      executionIds: withAgent.map((execution) => execution.id)
+    })
+  ]);
+  const conversations = new Map(agentRuns.flatMap((run) => run.kind === "conversation" ? [[run.executionId, run]] : []));
+  const subjects = actionRuns.flatMap((run) => run.subject.kind === "object" ? [run.subject] : []);
+  const [threads, readable, unreadableRunTypes] = await Promise.all([
+    storage.agents?.threads.getByIds({
+      projectId,
+      ids: [...conversations.values()].map((run) => run.threadId)
+    }) ?? [],
+    readableObjects(runtime, subjects),
+    subjects.length > 0 ? unreadableActionRunTypes(runtime.objectReader) : new Set
+  ]);
+  const actionRunByExecution = new Map(actionRuns.map((run) => [run.executionId, run]));
+  const workflowRunByExecution = new Map(workflowRuns.map((run) => [run.executionId, run]));
+  const messagesByThread = new Map(threads.map((thread) => [thread.id, thread.messageCount]));
+  const costByAgent = rollUpCosts(byId, conversations, withAgent, costs);
+  const executionEntries = executions.flatMap((execution) => {
+    const at = new Date(execution.createdAt);
+    const executor = execution.executor;
+    const authority = execution.authorizationRef;
+    if (executor.type === "primitive" && authority.type === "trustedPrimitive") {
+      if (executor.kind === "action") {
+        const run = actionRunByExecution.get(execution.id);
+        const subject = run?.subject.kind === "object" ? run.subject : undefined;
+        const object = subject && readable.has(objectBatchKey2(subject.objectTypeId, subject.primaryId)) ? { objectTypeId: subject.objectTypeId, primaryId: subject.primaryId } : undefined;
+        const runVisible = run !== undefined && canViewActionRun2(runtime.authorization, run) && (subject === undefined || !unreadableRunTypes.has(subject.objectTypeId));
+        return [
+          {
+            kind: "action",
+            at,
+            executionId: execution.id,
+            actionId: authority.primitive.id,
+            runId: executor.runId,
+            status: run?.status ?? "incomplete",
+            runVisible,
+            ...object === undefined ? {} : { object }
+          }
+        ];
+      }
+      if (executor.kind === "workflow") {
+        const run = workflowRunByExecution.get(execution.id);
+        return [
+          {
+            kind: "workflow",
+            at,
+            executionId: execution.id,
+            workflowId: authority.primitive.id,
+            runId: executor.runId,
+            status: run?.status ?? "incomplete",
+            runVisible: run !== undefined && canViewWorkflowRun2(runtime.authorization, run)
+          }
+        ];
+      }
+    }
+    const conversation = conversations.get(execution.id);
+    if (conversation) {
+      const cost = costByAgent.get(execution.id);
+      return [
+        {
+          kind: "agent",
+          at,
+          executionId: execution.id,
+          runId: conversation.id,
+          threadId: conversation.threadId,
+          status: conversation.status,
+          messages: messagesByThread.get(conversation.threadId) ?? 0,
+          ...cost === undefined ? {} : { cost }
+        }
+      ];
+    }
+    return [];
+  });
+  const recorded = [
+    ...page.pageViews.map((pageView) => ({
+      kind: "page",
+      at: new Date(pageView.receivedAt),
+      sequence: pageView.sequence,
+      route: pageView.route
+    })),
+    ...page.interactions.map((interaction) => ({
+      kind: "interaction",
+      at: new Date(interaction.receivedAt),
+      sequence: interaction.sequence,
+      name: interaction.name,
+      route: interaction.route
+    }))
+  ].sort((left, right) => left.sequence - right.sequence);
+  const cutoffs = [
+    page.hasMore ? recorded.at(-1)?.at : undefined,
+    ledger.truncated ? executions.filter((execution) => execution.source.type !== "execution").at(-1)?.createdAt : undefined
+  ].flatMap((at) => at === undefined ? [] : [at.getTime()]);
+  const cutoff = cutoffs.length > 0 ? Math.min(...cutoffs) : Number.POSITIVE_INFINITY;
+  const entries = [...recorded, ...executionEntries].filter((entry) => entry.at.getTime() <= cutoff).sort((left, right) => left.at.getTime() - right.at.getTime());
+  return {
+    visit,
+    ...connection === undefined ? {} : { connection },
+    entries,
+    truncated: page.hasMore || ledger.truncated
+  };
+}
+function sessionWindow(visit) {
+  const startedAt = visit.startedAt.getTime();
+  return {
+    from: new Date(startedAt - SESSION_GRACE_MS),
+    to: new Date(Math.min(visit.lastSeenAt.getTime() + SESSION_GRACE_MS, startedAt + ACTIVITY_MAX_VISIT_MS2 - SESSION_GRACE_MS))
+  };
+}
+function lineage(execution, byId) {
+  const chain = [];
+  let current = execution;
+  while (current) {
+    chain.push(current);
+    current = current.source.type === "execution" ? byId.get(current.source.executionId) : undefined;
+  }
+  return chain;
+}
+function rollUpCosts(byId, conversations, withAgent, costs) {
+  const grouped = new Map;
+  withAgent.forEach((execution, index) => {
+    const cost = costs[index];
+    const owner = lineage(execution, byId).find((ancestor) => conversations.has(ancestor.id));
+    if (!cost || !owner) {
+      return;
+    }
+    const summaries = grouped.get(owner.id) ?? [];
+    summaries.push(cost);
+    grouped.set(owner.id, summaries);
+  });
+  return new Map([...grouped].flatMap(([owner, summaries]) => {
+    const total = addCosts(summaries);
+    return total ? [[owner, total]] : [];
+  }));
+}
+function addCosts(summaries) {
+  const amounts = new Map;
+  let ratedCallCount = 0;
+  let unpriceableCallCount = 0;
+  let unvaluedCallCount = 0;
+  for (const summary of summaries) {
+    for (const money of summary.amounts) {
+      amounts.set(money.currency, (amounts.get(money.currency) ?? 0n) + BigInt(money.amountNanos));
+    }
+    ratedCallCount += summary.ratedCallCount;
+    unpriceableCallCount += summary.unpriceableCallCount;
+    unvaluedCallCount += summary.unvaluedCallCount;
+  }
+  if (ratedCallCount + unpriceableCallCount + unvaluedCallCount === 0) {
+    return;
+  }
+  return {
+    amounts: [...amounts].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([currency, amount]) => ({ currency, amountNanos: amount.toString() })),
+    ratedCallCount,
+    unpriceableCallCount,
+    unvaluedCallCount
+  };
+}
+async function readableObjects(runtime, subjects) {
+  const byType = new Map;
+  for (const subject of subjects) {
+    const items = byType.get(subject.objectTypeId) ?? new Map;
+    items.set(subject.primaryId, subject);
+    byType.set(subject.objectTypeId, items);
+  }
+  const readable = new Set;
+  await Promise.all([...byType.values()].map(async (items) => {
+    try {
+      const rows = await runtime.objectReader.getByPrimaryIdBatch({ items: [...items.values()] });
+      for (const key of rows.keys()) {
+        readable.add(key);
+      }
+    } catch (error) {
+      if (!(error instanceof AuthorizationError2)) {
+        throw error;
+      }
+    }
+  }));
+  return readable;
+}
+
+// src/activity/execution.ts
+var PROFILE_READ_CONCURRENCY = 8;
+function createActivityRuntime(runtime, service) {
+  const assertObservable = () => assertAuthorized2(runtime, { kind: "activity.observe" });
+  return {
+    async list(query) {
+      assertObservable();
+      const page = await service.list(query);
+      return { ...page, visits: await nameSharedVisits(runtime, page.visits) };
+    },
+    async users(query) {
+      assertObservable();
+      const page = await service.users(query);
+      const users = await mapInChunks(page.users, PROFILE_READ_CONCURRENCY, async (user) => {
+        const profile = await runtime.storage.auth?.users.getById({
+          projectId: runtime.projectId,
+          id: user.userId
+        });
+        return profile?.displayName ? { ...user, displayName: profile.displayName } : user;
+      });
+      return { users, hasMore: page.hasMore };
+    },
+    async summarize(query) {
+      assertObservable();
+      return service.summarize(query);
+    },
+    async calendar(query) {
+      assertObservable();
+      return service.calendar(query);
+    },
+    async timeline(visitId) {
+      assertObservable();
+      const page = await service.readWithSession({ id: visitId, limit: ACTIVITY_TIMELINE_LIMIT });
+      if (!page) {
+        return null;
+      }
+      const shared = await nameSharedVisit(runtime, page.visit);
+      return composeActivityTimeline(runtime, { ...shared, page }, new Date);
+    },
+    async connections(query) {
+      assertObservable();
+      return readActivityConnections(runtime, service, query, new Date);
+    }
+  };
+}
+function createActivityCaptureRuntime(runtime, service) {
+  return {
+    captureOptions() {
+      captureSource(runtime);
+      return service.captureOptions;
+    },
+    async capture(events) {
+      return service.capture(captureSource(runtime), events);
+    }
+  };
+}
+var activityCaptureKey = Symbol("sixb.activityCapture");
+function registerActivityCaptureRuntime(owner, capture) {
+  Object.defineProperty(owner, activityCaptureKey, {
+    configurable: false,
+    enumerable: false,
+    value: capture,
+    writable: false
+  });
+}
+function getActivityCaptureRuntime2(owner) {
+  const capture = owner[activityCaptureKey];
+  if (!capture) {
+    throw new Error("[Sixb] Activity capture is not registered for this execution.");
+  }
+  return capture;
+}
+function captureSource(runtime) {
+  const ref = getAuthorizationRef(runtime.runtimeAuthorization);
+  if (ref.type === "principal" && ref.principal.type === "user" && ref.credential?.type === "session") {
+    return {
+      actor: { type: "user", userId: ref.principal.id },
+      sessionId: ref.credential.id
+    };
+  }
+  if (ref.type === "delegated") {
+    return {
+      actor: { type: "share", grantId: ref.delegation.grantId },
+      sessionId: ref.delegation.sessionId
+    };
+  }
+  throw new AuthorizationError2("activity.capture", "[Sixb] Activity is recorded only for a signed-in user's session or a shared link's session.");
+}
+async function mapInChunks(items, size, map) {
+  const results = [];
+  for (let start = 0;start < items.length; start += size) {
+    const chunk = await Promise.all(items.slice(start, start + size).map(map));
+    results.push(...chunk);
+  }
+  return results;
+}
+
+// src/models/execution/session.ts
+class ModelExecutionSession {
+  runtime;
+  execution;
+  binding;
+  recorder;
+  constructor(runtime, execution) {
+    this.runtime = runtime;
+    this.execution = execution;
+  }
+  bind(input) {
+    if (this.binding)
+      throw new Error("[SixbModels] Execution attempt is already bound.");
+    this.binding = { ...input };
+  }
+  signal(signal) {
+    const binding = this.requireBinding();
+    return signal ? AbortSignal.any([binding.signal, signal]) : binding.signal;
+  }
+  async admitEmbeddingCall(admit) {
+    const admission = this.requireBinding().embeddingAdmission;
+    if (admission)
+      await admission(admit);
+    else
+      await admit();
+  }
+  accounting() {
+    const { accounting } = this.requireBinding();
+    this.recorder ??= accounting ? Promise.resolve(accounting) : this.createRecorder();
+    return this.recorder;
+  }
+  requireBinding() {
+    if (!this.binding) {
+      throw new Error("[SixbModels] Model calls require a bound request or worker execution attempt.");
+    }
+    return this.binding;
+  }
+  async createRecorder() {
+    const runtime = this.runtime;
+    const execution = this.execution;
+    const { attempt } = this.requireBinding();
+    const storage = {
+      ...requireAccountingCapabilities(runtime.storage),
+      transaction: runtime.storage.transaction.bind(runtime.storage)
+    };
+    const { requesterGroupIds } = await ensureExecutionRecord2(runtime.storage.executions, executionRecordInputFromRuntime({
+      execution,
+      runtimeAuthorization: runtime.runtimeAuthorization
+    }));
+    return new AiModelCallRecorder2({
+      storage,
+      projectId: runtime.projectId,
+      executionId: execution.id,
+      attempt,
+      requesterGroupIds,
+      limits: createAiModelCallLimitController2({
+        storage,
+        projectId: runtime.projectId,
+        requestedBy: execution.requestedBy,
+        requesterGroupIds
+      }),
+      recoverAiModelCall: (input) => enqueueAiModelCallRecovery2(runtime.queues.agents, input)
+    });
+  }
+}
+
+export { redactDomainEvent, createAuthorizedObjectReader, assertAuthorizedObjectReaderBinding, getAuthorizedOntologyView, readerClearance, readerEventClearance, registerOntologyMutationRuntime2, getOntologyMutationRuntime2, shareOntologyMutationRuntime2, createOntologyMutationRuntime2, canReadActionRunSubject, unreadableActionRunTypes, canDelegationAccessActionRun, actionRunBelongsToShareGrant, decodeActivityConnectionsCursor, resolveExecutionCosts, createActivityRuntime, createActivityCaptureRuntime, registerActivityCaptureRuntime, getActivityCaptureRuntime2, ModelExecutionSession };
+
+//# debugId=84DA6826BB3C05B764756E2164756E21