@sixb/core 0.1.20 → 0.1.21

package/dist/{chunk-6c6sn0bh.js → chunk-akzryx9h.js}

@@ -12,7 +12,7 @@ import {
   resolveObjectActionSubject,
   SYSTEM_PRINCIPAL2,
   principalsEqual2
-} from "./chunk-vpq4shxz.js";
+} from "./chunk-nn5xnx3s.js";
 import {
   ActionValidationError2,
   createSixbError2,
@@ -20,16 +20,14 @@ import {
   isSixbError2,
   toSixbFailure2,
   summarizeErrorMessage2
-} from "./chunk-8mx7qw3y.js";
+} from "./chunk-dvd2fp9q.js";
 import {
   agentServiceAccountId2,
-  MAX_OBJECT_READ_FACETS2,
   ObjectReadLimitExceededError2,
   assertObjectReadOutputWithinLimit2,
   createAgentRuntimeAuthorization,
   resolveRuntimeAuthorizationForProject,
   getAuthorizationRef,
-  captureExecutionScope,
   resolveExecutionScopeAuthorization,
   AuthorizationError2,
   isAllowed2,
@@ -48,14 +46,14 @@ import {
   canViewPipelineRun2,
   canViewProjectionRun2,
   canViewProjection2
-} from "./chunk-d0bqz29d.js";
+} from "./chunk-6vb4st8k.js";
 import {
   canonicalMediaType2,
   isFileRef2,
   isValidFileRef,
   supportsDirectUpload2,
   supportsRangeRead2
-} from "./chunk-jhm3zsa7.js";
+} from "./chunk-wkv3h3q7.js";
 import {
   collectUserRefIds,
   userReferenceProblem,
@@ -75,19 +73,15 @@ import {
   normalizeLinkProperties2,
   validateLinkProperties2,
   assertTelemetryProperty2
-} from "./chunk-hvsb78a1.js";
+} from "./chunk-8frc8a4j.js";
 import {
   isObjectRefSchema2,
   validateSchemaOrRefValue2
-} from "./chunk-v9xd5wzd.js";
+} from "./chunk-s7jg7pmn.js";
 import {
   missingClearanceRedactions,
-  resolvePropertyClearance,
-  redactObjectRow,
-  redactDomainEvent,
-  createClearanceQueryAdmission,
   WorkflowRunError2
-} from "./chunk-rrzt8jdy.js";
+} from "./chunk-9j4jw7as.js";
 import {
   objectRefKey2,
   linkRefKey2,
@@ -101,11 +95,11 @@ import {
   normalizeVector2,
   objectBatchKey2,
   WORKFLOW_RUN_FAILURE_CODES2
-} from "./chunk-n33z5bjw.js";
+} from "./chunk-918wwnaa.js";
 import {
   ACTION_RUN_FAILURE_CODES2,
   parseActionRunFailure2
-} from "./chunk-b38szspf.js";
+} from "./chunk-dhcv7yxc.js";
 import {
   isModelReasoning2,
   modelReasoningSupportIssue2
@@ -125,43 +119,48 @@ import {
 import {
   AgentStorageError2,
   AGENT_REASONING_LEVELS2
-} from "./chunk-s54c868q.js";
+} from "./chunk-3qct2mdc.js";
 import {
-  ExecutionStorageError2
-} from "./chunk-tw03bsmb.js";
+  actionRunRequestsEqual,
+  ObjectNotFoundError2
+} from "./chunk-tbc1ngpd.js";
 import {
-  snapshotVectorProfiles
-} from "./chunk-d09tj99x.js";
+  ExecutionStorageError2
+} from "./chunk-eptrvnby.js";
 import {
-  composeObjectQueryAdmissions,
   validateObjectQuery2,
-  validateObjectQueryWithAdmission,
-  executeObjectQuery2,
-  countObjects2,
-  existsObjects2,
-  facetObjects2,
-  validateObjectFacetRequests,
-  explainObjectQuery2,
-  preflightObjectQueryLinks,
-  executeObjectQueryLinks2
-} from "./chunk-bx9q3cwv.js";
-import {
-  shareSixbErrorReporter2,
-  reportActionPhaseFailure2,
-  reportRunFailure2
-} from "./chunk-fa02jy15.js";
+  explainObjectQuery2
+} from "./chunk-cn0fwwhy.js";
 import {
+  redactDomainEvent,
+  assertAuthorizedObjectReaderBinding,
+  getAuthorizedOntologyView,
+  readerClearance,
+  readerEventClearance,
   getOntologyMutationRuntime2,
   shareOntologyMutationRuntime2,
+  canReadActionRunSubject,
+  unreadableActionRunTypes,
+  canDelegationAccessActionRun,
+  actionRunBelongsToShareGrant,
+  resolveExecutionCosts,
+  createActivityRuntime,
+  createActivityCaptureRuntime,
+  registerActivityCaptureRuntime,
   ModelExecutionSession
-} from "./chunk-4vyr1j8f.js";
+} from "./chunk-6rqgmkde.js";
+import {
+  shareSixbErrorReporter2,
+  reportActionPhaseFailure2,
+  reportRunFailure2
+} from "./chunk-cy4mbddw.js";
 import {
   resolveLoggingService2
 } from "./chunk-3qms4nax.js";
 import {
   createLinkScopeFingerprint2,
   normalizeJsonProperties2
-} from "./chunk-hjzdd750.js";
+} from "./chunk-bk9svbcq.js";
 import {
   EditBatchError2,
   lowerEditBatch2
@@ -171,96 +170,98 @@ import {
   applicableAiLimitPolicyStatuses2,
   aiUsageLimitExceededError2,
   aiUsageLimitUnavailableError2
-} from "./chunk-vyf9kfqf.js";
+} from "./chunk-q7gn29y3.js";
 import {
   AgentRequestError2,
   normalizeAgentContextEntries2
 } from "./chunk-pfp1txq2.js";
 import {
   publishAgentRunActivity2
-} from "./chunk-5e43w60z.js";
+} from "./chunk-5948n82c.js";
+import {
+  ArtifactRequestError2
+} from "./chunk-48qjhh6v.js";
 import {
   createFileDownloadUrl,
-  revokeFileDownloadUrl,
-  resolveFileRefAtPath2,
-  openFileRef2,
-  jsonPointerSegment2
-} from "./chunk-3zxk45er.js";
+  revokeFileDownloadUrl
+} from "./chunk-8ncg20rd.js";
 import {
   registerConnectorConnectionsRuntime
 } from "./chunk-5a4a52tq.js";
 import {
   createConnectorRuntime
-} from "./chunk-tg2cw67r.js";
+} from "./chunk-ky3j490c.js";
 import {
   writeDataset2
-} from "./chunk-t7x8dmn0.js";
+} from "./chunk-431pyp2c.js";
 import {
   SyncValidationError2,
   requestSyncRun2
-} from "./chunk-xfs8x8m9.js";
+} from "./chunk-0bphap9y.js";
+import {
+  SandboxError2,
+  sandboxCredentialIssue2,
+  staticSandboxRecipe2
+} from "./chunk-cfj9dfbb.js";
 import {
   compileShareAccessPlan
-} from "./chunk-fkgc1wt8.js";
+} from "./chunk-z58tm0hm.js";
+import {
+  schemaRecordToJsonSchema2
+} from "./chunk-6x0pqh32.js";
+import {
+  requestPipelineRun2
+} from "./chunk-rmakanzx.js";
+import {
+  PipelineError2
+} from "./chunk-hke9aeen.js";
 import {
   createObjectQueryBuilder2,
   decorateObjectQueryExecutor
 } from "./chunk-9k93ah50.js";
+import {
+  executionRecordInputFromRuntime,
+  ensureExecutionRecord2,
+  createPrimitiveExecutionRecord,
+  restoreTrustedPrimitiveExecutionScope
+} from "./chunk-vf57cr4t.js";
 import {
   resolveLanguageModel2
 } from "./chunk-mfs23znk.js";
 import {
   AI_MODEL_CALL_OUTPUT_TOKEN_ALLOWANCE,
   aiModelCallOutputTokenAllowance
-} from "./chunk-1zq2p6g0.js";
+} from "./chunk-1cc1xaf3.js";
 import {
-  ObjectQueryValidationError2,
   ObjectQueryPlanningError2
 } from "./chunk-91mg3nj9.js";
-import {
-  schemaRecordToJsonSchema2
-} from "./chunk-6x0pqh32.js";
-import {
-  PipelineError2,
-  requestPipelineRun2
-} from "./chunk-yevzdx4y.js";
-import {
-  executionRecordInputFromRuntime,
-  ensureExecutionRecord2,
-  createPrimitiveExecutionRecord,
-  restoreTrustedPrimitiveExecutionScope
-} from "./chunk-9dmt152s.js";
 import {
   ShareGrantStorageError2
 } from "./chunk-br3k6qbf.js";
-import {
-  actionRunRequestsEqual,
-  ObjectNotFoundError2
-} from "./chunk-s16apyk9.js";
 import {
   ActionRunError2
 } from "./chunk-y0c4e6ex.js";
-import {
-  findPrimitiveParentRequestExecution
-} from "./chunk-ey1nk510.js";
-import {
-  RuntimeError2
-} from "./chunk-m4ehq95f.js";
-import {
-  createPropertyTokenMap2,
-  createLinkTokenMap2
-} from "./chunk-rdghfsss.js";
 import {
   MaterializationValidationError2,
   MaterializationObjectNotFoundError2,
   isMaterializationConflictError2
 } from "./chunk-96yw3pwd.js";
+import {
+  RuntimeError2
+} from "./chunk-m4ehq95f.js";
 import {
   getDatasetPrimaryKeyColumns2
-} from "./chunk-way52z4h.js";
+} from "./chunk-e17zdm62.js";
+import {
+  publishArtifact2
+} from "./chunk-9kgkfg6v.js";
 import {
   normalizeParams
-} from "./chunk-c85m1hyj.js";
+} from "./chunk-447a5c0p.js";
+import {
+  OntologyValidationError2,
+  OntologyNotFoundError2
+} from "./chunk-cqr3acm1.js";
 import {
   ModelProviderError2,
   ModelStreamError2,
@@ -269,10 +270,10 @@ import {
   sameEmbeddingModel
 } from "./chunk-kyjcwqz6.js";
 import {
-  OntologyValidationError2,
-  OntologyNotFoundError2,
-  formatUnknownObjectTypeMessage
-} from "./chunk-cqr3acm1.js";
+  resolveFileRefAtPath2,
+  openFileRef2,
+  jsonPointerSegment2
+} from "./chunk-a3faa34j.js";
 import {
   isJsonValue2,
   assertJsonValue2,
@@ -313,1003 +314,10 @@ function bindModelExecutionAttempt(models, input) {
   bindings.delete(models);
 }
 
-// src/assert-never.ts
-function assertNever(_value, message) {
-  throw new Error(message);
-}
-
-// src/objects/authorized-ontology-view.ts
-function createAuthorizedOntologyView(input) {
-  const allObjectTypes = input.ontology.listObjectTypes();
-  const registeredObjectTypeIds = new Set(allObjectTypes.map((objectType) => objectType.id));
-  const requestedObjectTypeIds = selectedObjectTypeIds(input.selection, allObjectTypes);
-  const visibleObjectTypeIds = new Set([...requestedObjectTypeIds].filter((objectTypeId) => registeredObjectTypeIds.has(objectTypeId)));
-  const selectedSchema = input.selection.kind === "selected" ? collectSelectedSchema(input.selection.scope) : undefined;
-  const projectedObjectTypes = [];
-  for (const objectType of allObjectTypes) {
-    if (!visibleObjectTypeIds.has(objectType.id))
-      continue;
-    const propertyIds = selectedSchema?.propertyIdsByObjectType.get(objectType.id) ?? new Set(objectType.properties.map((property) => property.id));
-    const links = selectedSchema ? selectedSchema.linksBySourceType.get(objectType.id) ?? new Map : input.selection.kind === "all" ? allDeclaredLinks(objectType) : allVisibleLinks(input.ontology, objectType, visibleObjectTypeIds);
-    projectedObjectTypes.push(projectObjectType({
-      objectType,
-      propertyIds,
-      links,
-      visibleObjectTypeIds,
-      ontology: input.ontology,
-      targetMode: input.selection.kind === "all" ? "original" : input.selection.kind === "types" ? "principal" : "exact",
-      exposeContracts: input.selection.kind !== "selected"
-    }));
-  }
-  const objectTypes = projectedObjectTypes;
-  const objectTypesById = new Map(objectTypes.map((objectType) => [objectType.id, objectType]));
-  const valueTypesById = input.selection.kind === "selected" ? collectVisibleValueTypes(input.ontology.getValueTypesById(), objectTypes) : snapshotAllValueTypes(input.ontology.getValueTypesById());
-  const release = (value, budgetValue = value) => {
-    input.assertOutputWithinLimit?.(budgetValue);
-    return value;
-  };
-  const cloneObjectType = (objectType) => structuredClone(objectType);
-  const cloneValueTypes = () => new Map([...valueTypesById].map(([valueTypeId, valueType]) => [
-    valueTypeId,
-    structuredClone(valueType)
-  ]));
-  return Object.freeze({
-    listObjectTypes: () => release(objectTypes.map(cloneObjectType)),
-    getObjectTypeById: (objectTypeId) => {
-      const objectType = objectTypesById.get(objectTypeId);
-      return release(objectType ? cloneObjectType(objectType) : null);
-    },
-    resolveObjectType: (objectTypeId) => {
-      const objectType = objectTypesById.get(objectTypeId);
-      return objectType ? release(cloneObjectType(objectType)) : unknownObjectType(objectTypeId);
-    },
-    getValueTypesById: () => {
-      const valueTypes = cloneValueTypes();
-      return release(valueTypes, [...valueTypes.entries()]);
-    },
-    getPrimaryPropertyId: (objectTypeId) => {
-      const objectType = objectTypesById.get(objectTypeId);
-      if (!objectType)
-        return unknownObjectType(objectTypeId);
-      const primary = objectType.properties.find((property) => property.primary);
-      if (!primary) {
-        throw new OntologyValidationError2(`[Sixb] Object type '${objectTypeId}' does not expose its primary property in this execution scope.`);
-      }
-      return release(primary.id);
-    },
-    listSubTypes: (objectTypeId) => {
-      const subTypes = visibleObjectTypeIds.has(objectTypeId) ? input.ontology.listSubTypes(objectTypeId).filter((subTypeId) => visibleObjectTypeIds.has(subTypeId)) : [];
-      return release(subTypes);
-    },
-    isValidLinkTarget: (expected, actual) => {
-      if (input.selection.kind === "all") {
-        return release(input.ontology.isValidLinkTarget(expected, actual));
-      }
-      if (!visibleObjectTypeIds.has(actual))
-        return release(false);
-      const expectedTypes = Array.isArray(expected) ? expected : [expected];
-      if (input.selection.kind === "selected") {
-        return release(expectedTypes.some((expectedType) => expectedType === "*" || expectedType === actual));
-      }
-      return release(expectedTypes.some((expectedType) => expectedType === "*" || visibleObjectTypeIds.has(expectedType) && input.ontology.isValidLinkTarget(expectedType, actual)));
-    }
-  });
-}
-function selectedObjectTypeIds(selection, allObjectTypes) {
-  switch (selection.kind) {
-    case "all":
-      return new Set(allObjectTypes.map((objectType) => objectType.id));
-    case "types":
-      return new Set(selection.objectTypeIds);
-    case "selected":
-      return new Set(selection.scope.objects.map((object) => object.objectTypeId));
-  }
-}
-function collectSelectedSchema(scope) {
-  const propertyIdsByObjectType = new Map;
-  for (const object of scope.objects) {
-    const properties = propertyIdsByObjectType.get(object.objectTypeId) ?? new Set;
-    for (const propertyId of object.propertyIds)
-      properties.add(propertyId);
-    propertyIdsByObjectType.set(object.objectTypeId, properties);
-  }
-  const linksBySourceType = new Map;
-  for (const step of scope.steps) {
-    const links = linksBySourceType.get(step.sourceObjectTypeId) ?? new Map;
-    const selected = links.get(step.linkId) ?? {
-      targetObjectTypeIds: new Set,
-      propertyIds: new Set
-    };
-    selected.targetObjectTypeIds.add(step.targetObjectTypeId);
-    for (const propertyId of step.propertyIds)
-      selected.propertyIds.add(propertyId);
-    links.set(step.linkId, selected);
-    linksBySourceType.set(step.sourceObjectTypeId, links);
-  }
-  return { propertyIdsByObjectType, linksBySourceType };
-}
-function allDeclaredLinks(objectType) {
-  return new Map(objectType.links.map((link) => [
-    link.id,
-    {
-      targetObjectTypeIds: new Set(typeof link.targetObjectTypeId === "string" ? [link.targetObjectTypeId] : link.targetObjectTypeId),
-      propertyIds: new Set(link.properties?.map((property) => property.id) ?? [])
-    }
-  ]));
-}
-function allVisibleLinks(ontology, objectType, visibleObjectTypeIds) {
-  const links = new Map;
-  for (const link of objectType.links) {
-    const targetObjectTypeIds = new Set([...visibleObjectTypeIds].filter((targetObjectTypeId) => ontology.isValidLinkTarget(link.targetObjectTypeId, targetObjectTypeId)));
-    if (targetObjectTypeIds.size === 0)
-      continue;
-    links.set(link.id, {
-      targetObjectTypeIds,
-      propertyIds: new Set(link.properties?.map((property) => property.id) ?? [])
-    });
-  }
-  return links;
-}
-function projectObjectType(input) {
-  const properties = input.objectType.properties.filter((property) => input.propertyIds.has(property.id)).map(snapshotProperty);
-  const visiblePropertyIds = new Set(properties.map((property) => property.id));
-  const links = input.objectType.links.flatMap((link) => {
-    const selected = input.links.get(link.id);
-    if (!selected)
-      return [];
-    if (input.targetMode === "original") {
-      return [snapshotLink(link, snapshotLinkTarget(link.targetObjectTypeId), selected.propertyIds)];
-    }
-    const targetObjectTypeIds = new Set([...selected.targetObjectTypeIds].filter((targetObjectTypeId) => input.visibleObjectTypeIds.has(targetObjectTypeId) && input.ontology.isValidLinkTarget(link.targetObjectTypeId, targetObjectTypeId)));
-    if (targetObjectTypeIds.size === 0)
-      return [];
-    const target = input.targetMode === "principal" ? principalLinkTargets(link, targetObjectTypeIds, input.visibleObjectTypeIds) : exactLinkTargets(targetObjectTypeIds);
-    return [snapshotLink(link, target, selected.propertyIds, { omitEmptyProperties: true })];
-  });
-  const projected = {
-    id: input.objectType.id,
-    name: input.objectType.name,
-    description: input.objectType.description,
-    quantityKind: input.objectType.quantityKind,
-    seeAlso: input.objectType.seeAlso ? [...input.objectType.seeAlso] : undefined,
-    extends: input.objectType.extends && input.visibleObjectTypeIds.has(input.objectType.extends) ? input.objectType.extends : undefined,
-    parents: projectOptionalIds(input.objectType.parents, input.visibleObjectTypeIds, input.targetMode === "original"),
-    implements: input.exposeContracts && input.objectType.implements ? [...input.objectType.implements] : undefined,
-    properties,
-    links,
-    search: projectSearch(input.objectType.search, visiblePropertyIds, {
-      preserveEmpty: input.targetMode !== "exact"
-    })
-  };
-  const withTokens = {
-    ...projected,
-    p: createPropertyTokenMap2(projected),
-    l: createLinkTokenMap2(projected)
-  };
-  return deepFreeze(withTokens);
-}
-function principalLinkTargets(link, allowedTargetObjectTypeIds, visibleObjectTypeIds) {
-  if (link.targetObjectTypeId === "*")
-    return exactLinkTargets(allowedTargetObjectTypeIds);
-  const declared = Array.isArray(link.targetObjectTypeId) ? link.targetObjectTypeId : [link.targetObjectTypeId];
-  if (declared.every((objectTypeId) => visibleObjectTypeIds.has(objectTypeId))) {
-    return snapshotLinkTarget(link.targetObjectTypeId);
-  }
-  return exactLinkTargets(allowedTargetObjectTypeIds);
-}
-function exactLinkTargets(targetObjectTypeIds) {
-  const targets = [...targetObjectTypeIds].sort();
-  return targets.length === 1 ? targets[0] : targets;
-}
-function projectOptionalIds(ids, visibleObjectTypeIds, preserveOriginal) {
-  if (!ids)
-    return;
-  if (preserveOriginal)
-    return [...ids];
-  const visible = ids.filter((id) => visibleObjectTypeIds.has(id));
-  return visible.length > 0 ? visible : undefined;
-}
-function snapshotLink(link, targetObjectTypeId, propertyIds, options = {}) {
-  const properties = link.properties?.filter((property) => propertyIds.has(property.id)).map(snapshotProperty);
-  return {
-    id: link.id,
-    name: link.name,
-    description: link.description,
-    targetObjectTypeId,
-    cardinality: link.cardinality,
-    properties: options.omitEmptyProperties && properties?.length === 0 ? undefined : properties
-  };
-}
-function snapshotLinkTarget(target) {
-  return typeof target === "string" ? target : [...target];
-}
-function snapshotProperty(property) {
-  return {
-    id: property.id,
-    name: property.name,
-    schema: snapshotSchema(property.schema),
-    description: property.description,
-    required: property.required,
-    nullable: property.nullable,
-    primary: property.primary,
-    mode: property.mode,
-    semanticType: property.semanticType,
-    query: snapshotPropertyQuery(property.query)
-  };
-}
-function snapshotPropertyQuery(query) {
-  if (!query)
-    return;
-  return {
-    searchable: query.searchable,
-    filterable: query.filterable,
-    sortable: query.sortable,
-    text: query.text,
-    exact: query.exact,
-    facet: query.facet,
-    weight: query.weight
-  };
-}
-function projectSearch(search, visiblePropertyIds, options) {
-  if (!search)
-    return;
-  const title = search.title && visiblePropertyIds.has(search.title) ? search.title : undefined;
-  const selectedDefaultText = search.defaultText?.filter((propertyId) => visiblePropertyIds.has(propertyId));
-  const selectedExact = search.exact?.filter((propertyId) => visiblePropertyIds.has(propertyId));
-  const defaultText = options.preserveEmpty || selectedDefaultText?.length ? selectedDefaultText : undefined;
-  const exact = options.preserveEmpty || selectedExact?.length ? selectedExact : undefined;
-  const vectors = search.vectors === undefined ? undefined : snapshotVectorProfiles(Object.fromEntries(Object.entries(search.vectors).filter(([, profile]) => profile.source.every((id) => visiblePropertyIds.has(id)))));
-  const projected = {
-    ...vectors === undefined || Object.keys(vectors).length === 0 ? {} : { vectors },
-    ...title === undefined ? {} : { title },
-    ...defaultText === undefined ? {} : { defaultText },
-    ...exact === undefined ? {} : { exact }
-  };
-  return Object.keys(projected).length > 0 || options.preserveEmpty ? projected : undefined;
-}
-function snapshotAllValueTypes(registered) {
-  return new Map([...registered.values()].map((valueType) => {
-    const snapshot = snapshotValueType(valueType);
-    return [snapshot.id, snapshot];
-  }));
-}
-function collectVisibleValueTypes(registered, objectTypes) {
-  const referencedIds = new Set;
-  const pendingSchemas = [];
-  const visitedSchemas = new Set;
-  for (const objectType of objectTypes) {
-    for (const property of objectType.properties)
-      pendingSchemas.push(property.schema);
-    for (const link of objectType.links) {
-      for (const property of link.properties ?? [])
-        pendingSchemas.push(property.schema);
-    }
-  }
-  while (pendingSchemas.length > 0) {
-    const schema = pendingSchemas.pop();
-    if (typeof schema === "string" || visitedSchemas.has(schema))
-      continue;
-    visitedSchemas.add(schema);
-    if (schema.type === "valueTypeRef") {
-      if (!referencedIds.has(schema.valueTypeId)) {
-        referencedIds.add(schema.valueTypeId);
-        const valueType = registered.get(schema.valueTypeId);
-        if (valueType)
-          pendingSchemas.push(valueType.schema);
-      }
-      if (schema._resolved)
-        pendingSchemas.push(schema._resolved);
-    } else if (schema.type === "object") {
-      for (const field of Object.values(schema.properties))
-        pendingSchemas.push(field.schema);
-    } else if (schema.type === "array") {
-      pendingSchemas.push(schema.items);
-    } else if (schema.type === "map") {
-      pendingSchemas.push(schema.valueSchema);
-    }
-  }
-  return new Map([...referencedIds].map((valueTypeId) => registered.get(valueTypeId)).filter((valueType) => valueType !== undefined).map((valueType) => {
-    const snapshot = snapshotValueType(valueType);
-    return [snapshot.id, snapshot];
-  }));
-}
-function snapshotValueType(valueType) {
-  return deepFreeze({
-    id: valueType.id,
-    name: valueType.name,
-    description: valueType.description,
-    schema: snapshotSchema(valueType.schema),
-    semanticType: valueType.semanticType
-  });
-}
-function snapshotSchema(schema) {
-  return deepFreeze(structuredClone(schema));
-}
-function deepFreeze(value, seen = new Set) {
-  if (typeof value !== "object" || value === null || seen.has(value))
-    return value;
-  seen.add(value);
-  for (const key of Reflect.ownKeys(value)) {
-    const descriptor = Object.getOwnPropertyDescriptor(value, key);
-    if (descriptor && "value" in descriptor)
-      deepFreeze(descriptor.value, seen);
-  }
-  return Object.freeze(value);
-}
-function unknownObjectType(objectTypeId) {
-  throw new OntologyNotFoundError2(formatUnknownObjectTypeMessage(objectTypeId));
-}
-
-// src/objects/query/selected-read-admission.ts
-var selectedStateBrand = Symbol("sixb.selected-object-query-admission-state");
-function createSelectedObjectQueryAdmission(scope) {
-  const selectionByKey = new Map;
-  const selectionsByType = new Map;
-  const propertiesBySelection = new Map;
-  for (const selection of scope.objects) {
-    const key = selectionKey(selection.nodeId, selection.objectTypeId);
-    selectionByKey.set(key, selection);
-    propertiesBySelection.set(key, new Set(selection.propertyIds));
-    const byType = selectionsByType.get(selection.objectTypeId) ?? [];
-    byType.push(selection);
-    selectionsByType.set(selection.objectTypeId, byType);
-  }
-  const outgoing = indexSteps(scope.steps, "outgoing", selectionByKey);
-  const incoming = indexSteps(scope.steps, "incoming", selectionByKey);
-  const emptyState = selectedState([]);
-  const admission = {
-    empty: () => emptyState,
-    source: (input) => {
-      const selections = input.result.objectTypeIds.flatMap((objectTypeId) => selectionsByType.get(objectTypeId) ?? []);
-      const state = selectedState(selections);
-      if (input.kind === "refs") {
-        const missingType = [...new Set(input.refs?.map((ref) => ref.objectTypeId) ?? [])].sort().find((objectTypeId) => !selectionsByType.has(objectTypeId));
-        if (missingType) {
-          return denied(state, new AuthorizationError2(`view:object:${missingType}`, `[Sixb] Delegated query cannot reference object type '${missingType}' at '${input.path}': the selected object scope does not contain that type.`));
-        }
-      }
-      if (state.selections.length > 0)
-        return { state };
-      const objectTypeId = input.objectTypeId ?? input.result.objectTypeIds[0] ?? "unknown";
-      return denied(state, new AuthorizationError2(`view:object:${objectTypeId}`, `[Sixb] Delegated query cannot start from object type '${objectTypeId}' at '${input.path}': the selected object scope does not contain that type.`));
-    },
-    property: (input) => propertyDenial(asSelectedState(input.state), input.propertyId, input.objectTypeId, input.use, input.path, propertiesBySelection),
-    edge: (input) => {
-      const state = asSelectedState(input.state);
-      const next = followEdge(state, input.linkId, input.direction, input.sourceObjectTypeId, outgoing, incoming, input.result.objectTypeIds);
-      if (next.selections.length > 0 || state.selections.length === 0)
-        return { state: next };
-      return denied(next, edgeDenial(state, input.linkId, input.direction, input.sourceObjectTypeId, input.use, input.path));
-    },
-    set: ({ op, states }) => {
-      if (op === "subtract")
-        return asSelectedState(states[0] ?? emptyState);
-      return selectedState(states.flatMap((state) => asSelectedState(state).selections));
-    },
-    assertPropertySelected: (input) => {
-      const denial = propertyDenial(asSelectedState(input.state), input.propertyId, input.objectTypeId, input.use, input.path, propertiesBySelection);
-      if (denial)
-        throw denial;
-    },
-    assertIncidentEdgeSelected: (input) => {
-      if (input.linkId === undefined)
-        return;
-      const state = asSelectedState(input.state);
-      const directions = input.direction === "both" ? ["outgoing", "incoming"] : [input.direction];
-      const next = selectedState(directions.flatMap((direction) => followEdge(state, input.linkId, direction, undefined, outgoing, incoming).selections));
-      if (next.selections.length > 0 || state.selections.length === 0)
-        return;
-      throw edgeDenial(state, input.linkId, input.direction, undefined, "queryLinks", input.path);
-    }
-  };
-  return Object.freeze(admission);
-}
-function indexSteps(steps, direction, selectionByKey) {
-  const index = new Map;
-  for (const step of steps) {
-    const fromKey = direction === "outgoing" ? selectionKey(step.parentNodeId, step.sourceObjectTypeId) : selectionKey(step.nodeId, step.targetObjectTypeId);
-    const toKey = direction === "outgoing" ? selectionKey(step.nodeId, step.targetObjectTypeId) : selectionKey(step.parentNodeId, step.sourceObjectTypeId);
-    const target = selectionByKey.get(toKey);
-    if (!selectionByKey.has(fromKey) || !target) {
-      throw new Error("[Sixb] Compiled selected object scope contains an invalid query path step.");
-    }
-    const key = edgeKey(direction === "outgoing" ? step.parentNodeId : step.nodeId, direction === "outgoing" ? step.sourceObjectTypeId : step.targetObjectTypeId, step.linkId);
-    const targets = index.get(key) ?? [];
-    targets.push(target);
-    index.set(key, targets);
-  }
-  return index;
-}
-function followEdge(state, linkId, direction, sourceObjectTypeId, outgoing, incoming, resultObjectTypeIds) {
-  const index = direction === "outgoing" ? outgoing : incoming;
-  const resultTypes = resultObjectTypeIds ? new Set(resultObjectTypeIds) : undefined;
-  const selections = state.selections.flatMap((selection) => {
-    const candidates = index.get(edgeKey(selection.nodeId, selection.objectTypeId, linkId)) ?? [];
-    return candidates.filter((candidate) => (resultTypes === undefined || resultTypes.has(candidate.objectTypeId)) && (direction === "outgoing" || sourceObjectTypeId === undefined || candidate.objectTypeId === sourceObjectTypeId));
-  });
-  return selectedState(selections);
-}
-function propertyDenial(state, propertyId, objectTypeId, use, path, propertiesBySelection) {
-  const candidates = objectTypeId ? state.selections.filter((selection) => selection.objectTypeId === objectTypeId) : state.selections;
-  if (candidates.length === 0)
-    return;
-  const missing = candidates.find((selection) => !propertiesBySelection.get(selectionKey(selection.nodeId, selection.objectTypeId))?.has(propertyId));
-  if (!missing)
-    return;
-  const objectTypeIds = [...new Set(candidates.map((selection) => selection.objectTypeId))].sort();
-  return new AuthorizationError2(`view:object:${objectTypeIds.join(",")}:property:${propertyId}`, `[Sixb] Delegated query cannot use property '${propertyId}' for ${use} at '${path}': it is not selected on every matching read-scope path (missing on ${formatSelection(missing)}).`);
-}
-function edgeDenial(state, linkId, direction, sourceObjectTypeId, use, path) {
-  const source = sourceObjectTypeId ? `:${sourceObjectTypeId}` : "";
-  return new AuthorizationError2(`view:link:${direction}${source}:${linkId}`, `[Sixb] Delegated query cannot use ${direction} link '${linkId}' for ${use} from ${formatState(state)} at '${path}': that exact read-scope path is not selected.`);
-}
-function formatState(state) {
-  if (state.selections.length === 0)
-    return "an empty read-scope provenance";
-  return `read-scope provenance ${state.selections.map(formatSelection).join(", ")}`;
-}
-function formatSelection(selection) {
-  return `'${selection.objectTypeId}'@node ${selection.nodeId}`;
-}
-function selectedState(selections) {
-  const unique = new Map;
-  for (const selection of selections) {
-    unique.set(selectionKey(selection.nodeId, selection.objectTypeId), selection);
-  }
-  return Object.freeze({
-    [selectedStateBrand]: true,
-    selections: Object.freeze([...unique.values()].sort((left, right) => left.nodeId - right.nodeId || left.objectTypeId.localeCompare(right.objectTypeId)))
-  });
-}
-function asSelectedState(state) {
-  if (state[selectedStateBrand] !== true) {
-    throw new Error("[Sixb] Object query admission state belongs to another semantic admission.");
-  }
-  return state;
-}
-function denied(state, denial) {
-  return { state, denial };
-}
-function selectionKey(nodeId, objectTypeId) {
-  return JSON.stringify([nodeId, objectTypeId]);
-}
-function edgeKey(nodeId, objectTypeId, linkId) {
-  return JSON.stringify([nodeId, objectTypeId, linkId]);
-}
-
-// src/objects/telemetry/workload.ts
-var MAX_DELEGATED_TELEMETRY_HISTORY_SERIES = 100;
-var MAX_DELEGATED_TELEMETRY_HISTORY_POINTS = 1e4;
-var DEFAULT_DELEGATED_TELEMETRY_HISTORY_LIMIT_PER_SERIES = 100;
-
-class TelemetryHistoryWorkloadExceededError extends Error {
-  metric;
-  limit;
-  name = "TelemetryHistoryWorkloadExceededError";
-  code = "telemetry_history_workload_exceeded";
-  constructor(metric, limit) {
-    super(`[Sixb] Delegated telemetry history exceeded its ${metric} limit (${limit}).`);
-    this.metric = metric;
-    this.limit = limit;
-  }
-}
-function admitTelemetryHistoryReadWorkload(input, delegated) {
-  const seriesCount = input.seriesCount;
-  const limitPerSeries = input.limitPerSeries;
-  if (!Number.isSafeInteger(seriesCount) || seriesCount < 0) {
-    throw new Error("[Sixb] Telemetry history series must have a non-negative safe integer length.");
-  }
-  if (limitPerSeries !== undefined && (!Number.isSafeInteger(limitPerSeries) || limitPerSeries < 0)) {
-    throw new Error("[Sixb] Telemetry history limit must be a non-negative safe integer.");
-  }
-  if (!delegated) {
-    const admission = limitPerSeries === undefined ? {} : { limitPerSeries };
-    return Object.freeze(admission);
-  }
-  if (seriesCount > MAX_DELEGATED_TELEMETRY_HISTORY_SERIES) {
-    throw new TelemetryHistoryWorkloadExceededError("series", MAX_DELEGATED_TELEMETRY_HISTORY_SERIES);
-  }
-  if (seriesCount === 0) {
-    return Object.freeze({
-      ...limitPerSeries === undefined ? {} : { limitPerSeries },
-      maxPointOccurrences: MAX_DELEGATED_TELEMETRY_HISTORY_POINTS
-    });
-  }
-  const maxLimitPerSeries = Math.floor(MAX_DELEGATED_TELEMETRY_HISTORY_POINTS / seriesCount);
-  const effectiveLimitPerSeries = limitPerSeries ?? Math.min(DEFAULT_DELEGATED_TELEMETRY_HISTORY_LIMIT_PER_SERIES, maxLimitPerSeries);
-  if (effectiveLimitPerSeries > maxLimitPerSeries) {
-    throw new TelemetryHistoryWorkloadExceededError("points", MAX_DELEGATED_TELEMETRY_HISTORY_POINTS);
-  }
-  return Object.freeze({
-    limitPerSeries: effectiveLimitPerSeries,
-    maxPointOccurrences: MAX_DELEGATED_TELEMETRY_HISTORY_POINTS
-  });
-}
-
-// src/execution/authorized-object-reader.ts
-var readerConstructionKey = Object.freeze({});
-
-class AuthorizedObjectReaderImpl {
-  #authorization;
-  #authority;
-  #runtime;
-  #ontology;
-  #embeddingModels;
-  #rerankingModels;
-  #ontologyView;
-  #storage;
-  #delegatedObjectTypeIds;
-  #delegatedLinkDefinitions;
-  #delegatedQueryAdmission;
-  #clearance;
-  constructor(key, input) {
-    if (key !== readerConstructionKey) {
-      throw new Error("[Sixb] AuthorizedObjectReader can only be created by Core.");
-    }
-    this.#authorization = input.scope.authorization;
-    this.#authority = input.authority;
-    this.#ontology = input.ontology;
-    this.#embeddingModels = input.embeddingModels;
-    this.#rerankingModels = input.rerankingModels;
-    this.#storage = input.storage;
-    this.#delegatedObjectTypeIds = input.authority.type === "delegated" ? new Set(input.authority.objectRead.scope.objects.map((object) => object.objectTypeId)) : undefined;
-    this.#delegatedLinkDefinitions = input.authority.type === "delegated" ? new Set(input.authority.objectRead.scope.steps.map(delegatedLinkDefinitionKey)) : undefined;
-    this.#delegatedQueryAdmission = input.authority.type === "delegated" ? createSelectedObjectQueryAdmission(input.authority.objectRead.scope) : undefined;
-    this.#clearance = clearanceForAuthority(input.authority, input.ontology);
-    this.#runtime = Object.freeze({
-      projectId: input.scope.execution.projectId,
-      runtimeAuthorization: input.scope.authorization,
-      ...input.authority.type === "principal" ? { authorization: input.authority.context } : {}
-    });
-  }
-  static assertBound(reader, scope) {
-    const capturedScope = captureExecutionScope(scope);
-    resolveExecutionScopeAuthorization(reader.#runtime.projectId, capturedScope);
-    if (capturedScope.authorization !== reader.#authorization) {
-      throw new Error("[Sixb] AuthorizedObjectReader is not bound to this exact execution authority.");
-    }
-  }
-  static ontologyView(reader) {
-    const authority = reader.#authority;
-    reader.#ontologyView ??= createAuthorizedOntologyView({
-      ontology: reader.#ontology,
-      selection: ontologySelectionForAuthority(authority, reader.#ontology),
-      ...authority.type === "delegated" ? {
-        assertOutputWithinLimit: (value) => assertObjectReadOutputWithinLimit2(value, authority.objectRead.limits)
-      } : {}
-    });
-    return reader.#ontologyView;
-  }
-  get projectId() {
-    return this.#runtime.projectId;
-  }
-  async getByPrimaryId(input) {
-    const request = snapshotReadValue({
-      objectTypeId: input.objectTypeId,
-      primaryId: input.primaryId
-    });
-    this.#assertObjectTypesViewable([request.objectTypeId]);
-    const row = await this.#storage.getByPrimaryId({
-      ...request,
-      projectId: this.#runtime.projectId
-    });
-    return detachReadResult(row && this.#redact(row));
-  }
-  async getByPrimaryIdBatch(input) {
-    const request = snapshotReadValue({
-      items: input.items.map((item) => ({
-        objectTypeId: item.objectTypeId,
-        primaryId: item.primaryId
-      }))
-    });
-    this.#assertObjectTypesViewable(request.items.map((item) => item.objectTypeId));
-    const rows = await this.#storage.getByPrimaryIdBatch({
-      ...request,
-      projectId: this.#runtime.projectId
-    });
-    return detachReadResult(new Map([...rows].map(([key, row]) => [key, this.#redact(row)])));
-  }
-  async canReadObjectProperty(input) {
-    const request = snapshotReadValue({
-      objectTypeId: input.objectTypeId,
-      primaryId: input.primaryId,
-      propertyId: input.propertyId
-    });
-    this.#assertObjectTypesViewable([request.objectTypeId]);
-    if (this.#hidesProperty(request))
-      return false;
-    if (this.#authority.type !== "delegated")
-      return true;
-    const [readable] = await this.#storage.selectsObjectProperties({
-      projectId: this.#runtime.projectId,
-      items: [request]
-    });
-    return readable ?? false;
-  }
-  async canReadObjectPropertiesBatch(input) {
-    const request = snapshotReadValue({
-      items: input.items.map((item) => ({
-        objectTypeId: item.objectTypeId,
-        primaryId: item.primaryId,
-        propertyId: item.propertyId
-      }))
-    });
-    this.#assertObjectTypesViewable(request.items.map((item) => item.objectTypeId));
-    const selected = this.#authority.type === "delegated" ? await this.#storage.selectsObjectProperties({
-      ...request,
-      projectId: this.#runtime.projectId
-    }) : request.items.map(() => true);
-    return request.items.map((item, index) => !this.#hidesProperty(item) && selected[index] === true);
-  }
-  async list(input) {
-    const request = snapshotReadValue({
-      objectTypeId: typeof input.objectTypeId === "string" ? input.objectTypeId : input.objectTypeId === undefined ? undefined : [...input.objectTypeId],
-      primaryIdPrefix: input.primaryIdPrefix,
-      primaryIdSuffix: input.primaryIdSuffix,
-      updatedAfter: input.updatedAfter,
-      updatedBefore: input.updatedBefore,
-      createdAfter: input.createdAfter,
-      createdBefore: input.createdBefore,
-      limit: input.limit,
-      offset: input.offset,
-      orderBy: input.orderBy,
-      order: input.order
-    });
-    const objectTypeId = this.#resolveListObjectTypes(request.objectTypeId);
-    if (Array.isArray(objectTypeId) && objectTypeId.length === 0) {
-      return { objects: [], hasMore: false, total: 0 };
-    }
-    const page = await this.#storage.list({
-      ...request,
-      ...objectTypeId === undefined ? {} : { objectTypeId },
-      projectId: this.#runtime.projectId
-    });
-    return detachReadResult({ ...page, objects: page.objects.map((row) => this.#redact(row)) });
-  }
-  async listLinks(input) {
-    const request = snapshotReadValue({
-      objectTypeId: input.objectTypeId,
-      objectId: input.objectId,
-      linkId: input.linkId,
-      direction: input.direction
-    });
-    this.#assertObjectTypesViewable([request.objectTypeId]);
-    const links = detachReadResult(await this.#storage.listLinks({
-      ...request,
-      projectId: this.#runtime.projectId
-    }));
-    return links.filter((link) => this.#isLinkViewable(link));
-  }
-  async listLinksBatch(input) {
-    const request = snapshotReadValue({
-      direction: input.direction,
-      items: input.items.map((item) => ({
-        objectTypeId: item.objectTypeId,
-        objectId: item.objectId,
-        linkId: item.linkId
-      }))
-    });
-    this.#assertObjectTypesViewable(request.items.map((item) => item.objectTypeId));
-    const pages = detachReadResult(await this.#storage.listLinksBatch({
-      ...request,
-      projectId: this.#runtime.projectId
-    }));
-    const filtered = new Map;
-    for (const [key, links] of pages) {
-      filtered.set(key, links.filter((link) => this.#isLinkViewable(link)));
-    }
-    return filtered;
-  }
-  async executeQuery(input) {
-    const query = snapshotAuthoredQuery(input.query);
-    const includeTotal = snapshotReadValue(input.includeTotal);
-    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query;
-    const result = await executeObjectQuery2({
-      query: executionQuery,
-      ...includeTotal === undefined ? {} : { includeTotal },
-      projectId: this.#runtime.projectId,
-      signal: input.signal
-    }, this.#queryExecutorOptions());
-    return detachReadResult({ ...result, objects: result.objects.map((row) => this.#redact(row)) });
-  }
-  async queryLinks(input) {
-    const query = snapshotAuthoredQuery(input.query);
-    const request = snapshotReadValue({
-      direction: input.direction,
-      linkId: input.linkId,
-      includeObjects: input.includeObjects,
-      pageSize: input.pageSize,
-      pageToken: input.pageToken
-    });
-    let executionQuery = query;
-    const admission = this.#delegatedQueryAdmission;
-    if (admission) {
-      const preflight = preflightObjectQueryLinks({ query, ...request, projectId: this.#runtime.projectId }, { ontology: this.#ontology });
-      const admitted = validateObjectQueryWithAdmission(preflight.validated.query, { ontology: this.#ontology, normalize: false }, admission);
-      admission.assertIncidentEdgeSelected({
-        state: admitted.admissionState,
-        ...preflight.linkId === undefined ? {} : { linkId: preflight.linkId },
-        direction: preflight.direction,
-        path: "$.linkId"
-      });
-      executionQuery = admitted.query;
-    }
-    const result = detachReadResult(await executeObjectQueryLinks2({ query: executionQuery, ...request, projectId: this.#runtime.projectId }, this.#queryExecutorOptions()));
-    if (result.objects.some((row) => !this.#isObjectTypeViewable(row.objectTypeId)) || result.links.some((link) => !this.#isLinkViewable(link))) {
-      throw new Error("[Sixb] Object storage returned a link page outside its authorized scope.");
-    }
-    return { ...result, objects: result.objects.map((row) => this.#redact(row)) };
-  }
-  async count(input) {
-    const query = snapshotAuthoredQuery(input.query);
-    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query;
-    return detachReadResult(await countObjects2({ query: executionQuery, projectId: this.#runtime.projectId }, this.#queryExecutorOptions()));
-  }
-  async exists(input) {
-    const query = snapshotAuthoredQuery(input.query);
-    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query;
-    return detachReadResult(await existsObjects2({ query: executionQuery, projectId: this.#runtime.projectId }, this.#queryExecutorOptions()));
-  }
-  async facet(input) {
-    const query = snapshotAuthoredQuery(input.query);
-    const facets = snapshotFacetRequests(input.facets);
-    let executionQuery = query;
-    let executionFacets = facets;
-    const admission = this.#delegatedQueryAdmission;
-    if (admission) {
-      const validated = validateObjectQuery2(query, { ontology: this.#ontology });
-      const normalizedFacets = validateObjectFacetRequests(facets, validated.result.objectTypeIds, {
-        ontology: this.#ontology
-      });
-      const admitted = validateObjectQueryWithAdmission(validated.query, { ontology: this.#ontology, normalize: false }, admission);
-      normalizedFacets.forEach((facet, index) => {
-        admission.assertPropertySelected({
-          state: admitted.admissionState,
-          propertyId: facet.propertyId,
-          use: "facet",
-          path: `$.facets[${index}].propertyId`
-        });
-      });
-      executionQuery = admitted.query;
-      executionFacets = normalizedFacets;
-    }
-    return detachReadResult(await facetObjects2({
-      query: executionQuery,
-      facets: executionFacets,
-      projectId: this.#runtime.projectId
-    }, this.#queryExecutorOptions()));
-  }
-  redactWrittenRow(row) {
-    return this.#redact(row);
-  }
-  assertVisibleOutputWithinLimit(value) {
-    if (this.#authority.type !== "delegated")
-      return;
-    assertObjectReadOutputWithinLimit2(value, this.#authority.objectRead.limits);
-  }
-  admitTelemetryHistoryRead(input) {
-    return admitTelemetryHistoryReadWorkload(input, this.#authority.type === "delegated");
-  }
-  #queryExecutorOptions() {
-    const admission = this.#executorAdmission();
-    if (this.#authority.type === "delegated") {
-      return {
-        ontology: this.#ontology,
-        storage: this.#storage,
-        embeddingModels: this.#embeddingModels,
-        rerankingModels: this.#rerankingModels,
-        ...admission === undefined ? {} : { admission }
-      };
-    }
-    return {
-      ontology: this.#ontology,
-      embeddingModels: this.#embeddingModels,
-      rerankingModels: this.#rerankingModels,
-      storage: this.#storage,
-      runtimeAuthorization: this.#runtime.runtimeAuthorization,
-      ...this.#runtime.authorization === undefined ? {} : { authorization: this.#runtime.authorization },
-      ...admission === undefined ? {} : { admission }
-    };
-  }
-  #executorAdmission() {
-    const clearance = this.#clearance && createClearanceQueryAdmission(this.#clearance);
-    const selected = this.#delegatedQueryAdmission;
-    if (selected && clearance)
-      return composeObjectQueryAdmissions(selected, clearance);
-    return selected ?? clearance;
-  }
-  #redact(row) {
-    return this.#clearance ? redactObjectRow(row, this.#clearance) : row;
-  }
-  #hidesProperty(item) {
-    return this.#clearance?.hiddenPropertyIds(item.objectTypeId).has(item.propertyId) ?? false;
-  }
-  #admitDelegatedQuery(query) {
-    if (!this.#delegatedQueryAdmission)
-      return;
-    return validateObjectQueryWithAdmission(query, { ontology: this.#ontology }, this.#delegatedQueryAdmission);
-  }
-  #assertObjectTypesViewable(objectTypeIds) {
-    if (this.#authority.type === "delegated") {
-      for (const objectTypeId of new Set(objectTypeIds)) {
-        if (this.#delegatedObjectTypeIds?.has(objectTypeId))
-          continue;
-        throw new AuthorizationError2(`delegated:object.view:${objectTypeId}`, `[Sixb] Delegated authorization does not select object type '${objectTypeId}'.`);
-      }
-      return;
-    }
-    for (const objectTypeId of new Set(objectTypeIds)) {
-      assertAuthorized2(this.#runtime, { kind: "object.view", objectTypeId });
-    }
-  }
-  #resolveListObjectTypes(requested) {
-    if (requested !== undefined) {
-      const objectTypeIds = typeof requested === "string" ? [requested] : [...new Set(requested)];
-      for (const objectTypeId of objectTypeIds) {
-        this.#ontology.resolveObjectType(objectTypeId);
-      }
-      this.#assertObjectTypesViewable(objectTypeIds);
-      return typeof requested === "string" ? requested : objectTypeIds;
-    }
-    if (this.#authority.type === "unrestricted")
-      return;
-    return this.#ontology.listObjectTypes().map((objectType) => objectType.id).filter((objectTypeId) => this.#isObjectTypeViewable(objectTypeId));
-  }
-  #isObjectTypeViewable(objectTypeId) {
-    if (this.#authority.type === "delegated") {
-      return this.#delegatedObjectTypeIds?.has(objectTypeId) ?? false;
-    }
-    return isAllowed2(this.#runtime.authorization, { kind: "object.view", objectTypeId });
-  }
-  #isLinkViewable(link) {
-    if (!this.#isObjectTypeViewable(link.sourceTypeId) || !this.#isObjectTypeViewable(link.targetTypeId)) {
-      return false;
-    }
-    return this.#delegatedLinkDefinitions?.has(delegatedLinkDefinitionKey(link)) ?? this.#authority.type !== "delegated";
-  }
-}
-Object.freeze(AuthorizedObjectReaderImpl.prototype);
-Object.freeze(AuthorizedObjectReaderImpl);
-function createAuthorizedObjectReader(input) {
-  const scope = captureExecutionScope(input.scope);
-  const projectId = scope.execution.projectId;
-  const authority = resolveExecutionScopeAuthorization(projectId, scope);
-  const storage = objectStorageForAuthority(authority, input.objectStorage);
-  const reader = new AuthorizedObjectReaderImpl(readerConstructionKey, {
-    scope,
-    ontology: input.ontology,
-    embeddingModels: input.embeddingModels,
-    rerankingModels: input.rerankingModels,
-    storage,
-    authority
-  });
-  Object.freeze(reader);
-  return reader;
-}
-function assertAuthorizedObjectReaderBinding(input) {
-  AuthorizedObjectReaderImpl.assertBound(input.reader, input.scope);
-}
-function getAuthorizedOntologyView(reader) {
-  return AuthorizedObjectReaderImpl.ontologyView(reader);
-}
-function clearanceForAuthority(authority, ontology) {
-  switch (authority.type) {
-    case "unrestricted":
-      return;
-    case "principal":
-      return resolvePropertyClearance(ontology, authority.context.clearances ?? new Set);
-    case "delegated":
-      return resolvePropertyClearance(ontology, new Set);
-  }
-}
-function objectStorageForAuthority(authority, objectStorage) {
-  switch (authority.type) {
-    case "principal":
-    case "unrestricted":
-      return objectStorage;
-    case "delegated":
-      return objectStorage.createSelectedReadScope({
-        projectId: authority.projectId,
-        scope: authority.objectRead.scope,
-        limits: authority.objectRead.limits
-      });
-    default:
-      return assertNever(authority, `[Sixb] Unsupported object reader authority '${String(authority.type)}'.`);
-  }
-}
-function ontologySelectionForAuthority(authority, ontology) {
-  switch (authority.type) {
-    case "unrestricted":
-      return { kind: "all" };
-    case "principal":
-      return {
-        kind: "types",
-        objectTypeIds: ontology.listObjectTypes().filter((objectType) => isAllowed2(authority.context, {
-          kind: "object.view",
-          objectTypeId: objectType.id
-        })).map((objectType) => objectType.id)
-      };
-    case "delegated":
-      return { kind: "selected", scope: authority.objectRead.scope };
-  }
-}
-function delegatedLinkDefinitionKey(input) {
-  return "sourceObjectTypeId" in input ? JSON.stringify([input.sourceObjectTypeId, input.linkId, input.targetObjectTypeId]) : JSON.stringify([input.sourceTypeId, input.linkId, input.targetTypeId]);
-}
-function detachReadResult(value) {
-  return structuredClone(value);
-}
-function snapshotReadValue(value) {
-  return structuredClone(value);
-}
-function snapshotFacetRequests(facets) {
-  if (!Array.isArray(facets)) {
-    throw new ObjectQueryValidationError2([
-      {
-        path: "$.facets",
-        code: "invalid_facets",
-        message: "facets must be an array"
-      }
-    ]);
-  }
-  const length = facets.length;
-  if (!Number.isSafeInteger(length) || length > MAX_OBJECT_READ_FACETS2) {
-    throw new ObjectQueryValidationError2([
-      {
-        path: "$.facets",
-        code: "too_many_facets",
-        message: `facets must include at most ${MAX_OBJECT_READ_FACETS2} facet requests`
-      }
-    ]);
-  }
-  const snapshot = [];
-  for (let index = 0;index < length; index += 1) {
-    const facet = facets[index];
-    snapshot.push({ propertyId: facet.propertyId, limit: facet.limit });
-  }
-  return snapshot;
-}
-function snapshotAuthoredQuery(query) {
-  try {
-    const snapshot = structuredClone(query);
-    const pending = [snapshot];
-    const seen = new Set;
-    for (const node of pending) {
-      if (seen.has(node))
-        continue;
-      seen.add(node);
-      if (node.kind === "vector" && (typeof node.vector !== "string" || typeof node.profile !== "string" || ("propertyId" in node))) {
-        throw new ObjectQueryValidationError2([
-          {
-            path: "$",
-            code: "invalid_vector_search_input",
-            message: "Vector search requires a named profile and search text"
-          }
-        ]);
-      }
-      if ("input" in node)
-        pending.push(node.input);
-      if (node.kind === "set")
-        pending.push(...node.inputs);
-    }
-    return snapshot;
-  } catch (error) {
-    if (error instanceof ObjectQueryValidationError2)
-      throw error;
-    throw new ObjectQueryValidationError2([
-      {
-        path: "$",
-        code: "query_not_cloneable",
-        message: "Object query must contain only structured-cloneable data"
-      }
-    ]);
-  }
-}
-
 // src/actions/descriptor.ts
 function snapshotActionDescriptor(action) {
   const params = Object.fromEntries(Object.entries(action.params).map(([id, config]) => [id, structuredClone(config)]));
-  return deepFreeze2({
+  return deepFreeze({
     id: action.id,
     ...action.description === undefined ? {} : { description: action.description },
     binding: action.binding.kind === "global" ? { kind: "global" } : { kind: "object", objectTypeId: action.binding.objectType.id },
@@ -1322,14 +330,14 @@ function snapshotActionDescriptor(action) {
     }
   });
 }
-function deepFreeze2(value, seen = new Set) {
+function deepFreeze(value, seen = new Set) {
   if (typeof value !== "object" || value === null || seen.has(value))
     return value;
   seen.add(value);
   for (const key of Reflect.ownKeys(value)) {
     const descriptor = Object.getOwnPropertyDescriptor(value, key);
     if (descriptor && "value" in descriptor)
-      deepFreeze2(descriptor.value, seen);
+      deepFreeze(descriptor.value, seen);
   }
   return Object.freeze(value);
 }
@@ -1362,7 +370,7 @@ async function assertParamUsersActive(input) {
 function assertDelegatedActionTarget(input) {
   const { actionId, authorization, subject } = input;
   if (subject.kind !== "object" || !authorization.actionApply.some((target) => target.actionId === actionId && target.subject.objectTypeId === subject.objectTypeId && target.subject.primaryId === subject.primaryId)) {
-    throw denied2(actionId, subject);
+    throw denied(actionId, subject);
   }
   return subject;
 }
@@ -1370,7 +378,7 @@ async function admitDelegatedObjectAction(input) {
   const { action, authorization, execution, objectReader, runtimeAuthorization, subject } = input;
   assertDelegatedActionTarget({ authorization, actionId: action.id, subject });
   if (action.binding.kind !== "object" || action.binding.objectType.id !== subject.objectTypeId) {
-    throw denied2(action.id, subject);
+    throw denied(action.id, subject);
   }
   assertAuthorizedObjectReaderBinding({
     reader: objectReader,
@@ -1382,14 +390,14 @@ async function admitDelegatedObjectAction(input) {
       primaryId: subject.primaryId
     });
     if (!visible)
-      throw denied2(action.id, subject);
+      throw denied(action.id, subject);
   } catch (error) {
     if (error instanceof AuthorizationError2)
-      throw denied2(action.id, subject);
+      throw denied(action.id, subject);
     throw error;
   }
 }
-function denied2(actionId, subject) {
+function denied(actionId, subject) {
   const target = subject.kind === "object" ? `${subject.objectTypeId}:${subject.primaryId}` : "global";
   return new AuthorizationError2(`apply:action:${actionId}:${target}`, `[Sixb] Delegated authority cannot apply Action '${actionId}' to '${target}'.`);
 }
@@ -2870,30 +1878,6 @@ async function settleWithin(promises, timeoutMs) {
   }
 }
 
-// src/actions/run-authorization.ts
-async function canDelegationAccessActionRun(input) {
-  const subject = input.run.subject;
-  if (!input.authority.delegation || subject.kind !== "object" || !input.authority.actionApply.some((target) => target.actionId === input.run.actionId && target.subject.objectTypeId === subject.objectTypeId && target.subject.primaryId === subject.primaryId)) {
-    return false;
-  }
-  return actionRunBelongsToShareGrant({
-    storage: input.storage,
-    projectId: input.projectId,
-    run: input.run,
-    grantId: input.authority.delegation.grantId
-  });
-}
-async function actionRunBelongsToShareGrant(input) {
-  const parent = await findPrimitiveParentRequestExecution({
-    executions: input.storage.executions,
-    projectId: input.projectId,
-    executionId: input.run.executionId,
-    primitive: { kind: "action", id: input.run.actionId, runId: input.run.id }
-  });
-  const authorization = parent?.authorizationRef;
-  return authorization?.type === "delegated" && authorization.delegation.kind === "share" && authorization.delegation.grantId === input.grantId;
-}
-
 // src/actions/request.ts
 function getActionDefinition(runtime, actionId) {
   const action = runtime.actionRegistry.getById(actionId);
@@ -2936,6 +1920,9 @@ async function requestAction3(runtime, execution, input) {
     assertAuthorized2({ projectId, runtimeAuthorization }, { kind: "object.view", objectTypeId: action.binding.objectType.id });
   }
   validateActionSubject(action, subject);
+  if (authorization.type !== "delegated" && subject.kind === "object") {
+    await objectReader.assertReadable({ objectTypeIds: [subject.objectTypeId] });
+  }
   let pathPrefix = action.id;
   let objectType = null;
   if (isObjectActionDefinition2(action)) {
@@ -2951,7 +1938,13 @@ async function requestAction3(runtime, execution, input) {
   const executor = getActionRunExecutor(runtime);
   request.signal?.throwIfAborted();
   const payload = { actionId, subject, params: actionParams };
-  const assertCanReuse = (run) => assertCallerMayHaveRun({ storage: runtime.storage, projectId, authorization, run });
+  const assertCanReuse = (run) => assertCallerMayHaveRun({
+    storage: runtime.storage,
+    projectId,
+    authorization,
+    objectReader,
+    run
+  });
   const persist = () => persistActionRun({
     projectId,
     storage: runtime.storage,
@@ -2996,7 +1989,7 @@ async function assertCallerMayHaveRun(input) {
     projectId: input.projectId,
     run,
     grantId: authorization.delegation.grantId
-  }) : authorization.type !== "principal" || canViewActionRun2(authorization.context, run);
+  }) : authorization.type !== "principal" || canViewActionRun2(authorization.context, run) && await canReadActionRunSubject(input.objectReader, run);
   if (!visible) {
     throw new AuthorizationError2(`apply:action:${run.actionId}`, authorization.type === "delegated" ? "[Sixb] Delegated authority cannot reuse this Action run." : `[Sixb] Action run '${run.id}' is not visible to this principal.`);
   }
@@ -3088,40 +2081,29 @@ function createActionsRuntime(runtime, execution) {
           projectId,
           authority: authorization,
           run
-        })) ? release(run) : null;
+        })) && await canReadActionRunSubject(objectReader, run) ? release(run) : null;
       },
-      list: (input = {}) => {
+      list: async (input = {}) => {
         if (authorization.type === "denied" || authorization.type === "delegated") {
-          return Promise.resolve({ runs: [], hasMore: false, total: 0 });
+          return { runs: [], hasMore: false, total: 0 };
         }
         const storage = runtime.storage.actionRuns;
         if (!storage)
-          return Promise.resolve({ runs: [], hasMore: false, total: 0 });
+          return { runs: [], hasMore: false, total: 0 };
+        if (authorization.type === "unrestricted")
+          return storage.list({ ...input, projectId });
+        const unreadable = await unreadableActionRunTypes(objectReader);
         return storage.list({
           ...input,
           projectId,
-          actionIds: authorization.type === "principal" ? [...authorization.context.grants["apply:action"]] : undefined,
-          objectTypeIds: authorization.type === "principal" ? [...authorization.context.grants["view:object"]] : undefined
+          actionIds: [...authorization.context.grants["apply:action"]],
+          objectTypeIds: [...authorization.context.grants["view:object"]].filter((objectTypeId) => !unreadable.has(objectTypeId))
         });
       }
     }
   };
 }
 
-// src/runtime/ai-cost.ts
-async function resolveExecutionCosts(input) {
-  if (input.executionIds.length === 0)
-    return [];
-  if (!input.storage)
-    return input.executionIds.map(() => {
-      return;
-    });
-  return input.storage.summarizeExecutions({
-    projectId: input.projectId,
-    executionIds: input.executionIds
-  });
-}
-
 // src/runtime/ai-usage.ts
 async function resolveExecutionUsage(input) {
   if (input.executionIds.length === 0)
@@ -3449,6 +2431,10 @@ async function retryAgentRun2(runtime, execution, models, failedRun) {
       threadId: failedRun.threadId,
       runId: failedRun.id
     });
+    await tx.artifacts?.deleteVersionsByOrigin({
+      projectId: runtime.projectId,
+      runId: failedRun.id
+    });
     await tx.executions.create(durableExecution);
     return agents.runs.create({
       id: runId,
@@ -3963,6 +2949,75 @@ function createAiUsageRuntime(runtime, security) {
     }
   };
 }
+// src/artifacts/execution.ts
+function createArtifactsRuntime(runtime, blobStorage) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const caller = authority.type === "principal" ? authority.context.principal : authority.type === "unrestricted" ? SYSTEM_PRINCIPAL2 : null;
+  const ownerFilter = authority.type === "principal" ? caller : null;
+  const requireStorage = () => {
+    const storage = runtime.storage.artifacts;
+    if (!storage) {
+      throw new ArtifactRequestError2("storage_unavailable", "[Sixb] Artifacts need storage that supports them.");
+    }
+    return storage;
+  };
+  const requireCaller = () => {
+    if (!caller) {
+      throw new ArtifactRequestError2("not_allowed", "[Sixb] This caller cannot publish artifacts.");
+    }
+    return caller;
+  };
+  const visible = (artifact) => artifact && caller && (!ownerFilter || principalsEqual2(ownerFilter, artifact.owner)) ? artifact : null;
+  const getVisible = async (artifactId) => caller ? visible(await requireStorage().get({ projectId: runtime.projectId, id: artifactId })) : null;
+  return {
+    async create(input) {
+      return publishArtifact2({ projectId: runtime.projectId, storage: requireStorage(), blobStorage }, { ...input, author: requireCaller() });
+    },
+    async publish(artifactId, input) {
+      const author = requireCaller();
+      if (!await getVisible(artifactId))
+        throw notFound(artifactId);
+      return publishArtifact2({ projectId: runtime.projectId, storage: requireStorage(), blobStorage }, { ...input, artifactId, author });
+    },
+    get: getVisible,
+    async list(input = {}) {
+      if (!caller)
+        return { artifacts: [], hasMore: false, total: 0 };
+      return requireStorage().list({
+        projectId: runtime.projectId,
+        ...ownerFilter ? { owner: ownerFilter } : {},
+        ...input.threadId === undefined ? {} : { originThreadId: input.threadId },
+        ...input.kind === undefined ? {} : { kind: input.kind },
+        ...input.limit === undefined ? {} : { limit: input.limit },
+        ...input.offset === undefined ? {} : { offset: input.offset }
+      });
+    },
+    async getVersion(artifactId, version) {
+      const artifact = await getVisible(artifactId);
+      if (!artifact)
+        return null;
+      return requireStorage().getVersion({
+        projectId: runtime.projectId,
+        artifactId,
+        version: version === "latest" ? artifact.latestVersion : version
+      });
+    },
+    async listVersions(artifactId, input = {}) {
+      if (!await getVisible(artifactId))
+        return null;
+      return requireStorage().listVersions({ projectId: runtime.projectId, artifactId, ...input });
+    },
+    async delete(artifactId) {
+      if (!await getVisible(artifactId))
+        return false;
+      return requireStorage().delete({ projectId: runtime.projectId, id: artifactId });
+    }
+  };
+}
+function notFound(artifactId) {
+  return new ArtifactRequestError2("artifact_not_found", `[Sixb] Artifact '${artifactId}' was not found.`);
+}
+
 // src/blob-storage/execution.ts
 function createBlobsRuntime(runtime, execution, blobStorage, apiPublicOrigin) {
   const assertAccess = () => assertProviderAccess2(runtime, execution, "blobs.access");
@@ -4071,7 +3126,7 @@ function commandContext(runtime, execution, connectorId) {
 }
 
 // src/datasets/execution.ts
-function createDatasetsRuntime(runtime, execution, source, lakeStorage, blobStorage) {
+function createDatasetsRuntime(runtime, execution, source, lakeStorage, blobStorage, versionMarkings) {
   const authority = resolveRuntimeAuthorizationForProject(runtime);
   const allowed = (datasetId) => isRuntimeAllowed2(runtime, { kind: "dataset.view", datasetId });
   return {
@@ -4090,7 +3145,7 @@ function createDatasetsRuntime(runtime, execution, source, lakeStorage, blobStor
       const version = input.versionId === undefined ? await lakeStorage.getLatestVersion(registered.id) : await lakeStorage.getVersion(registered.id, input.versionId);
       if (!version)
         return null;
-      const redacted = redactedColumns(registered, assertRuntimeAuthorizationBound2(runtime));
+      const redacted = redactedColumns(version, versionMarkings, assertRuntimeAuthorizationBound2(runtime));
       const selected = selectColumns(version, input.columns);
       const columns = selected.filter((column) => !redacted.has(column));
       const read = (readColumns) => lakeStorage.readRows({
@@ -4164,11 +3219,14 @@ function selectColumns(version, requested) {
   }
   return [...requested];
 }
-function redactedColumns(dataset, authority) {
+function redactedColumns(version, versionMarkings, authority) {
   if (authority.type === "unrestricted")
     return new Set;
   const clearances = authority.type === "principal" ? authority.context.clearances ?? new Set : new Set;
-  return new Set(dataset.schema.columns.filter((column) => column.markings?.some((markingId) => !clearances.has(markingId))).map((column) => column.name));
+  if ([...versionMarkings.everyMarking()].every((id) => clearances.has(id)))
+    return new Set;
+  const { columns } = versionMarkings.classify(version);
+  return new Set([...columns].filter(([, columnMarkings]) => [...columnMarkings].some((id) => !clearances.has(id))).map(([column]) => column));
 }
 async function* emptyRows(rows) {
   for await (const _row of rows)
@@ -4178,23 +3236,30 @@ async function* emptyRows(rows) {
 // src/events/execution.ts
 function createEventsRuntime(runtime) {
   const authority = resolveRuntimeAuthorizationForProject(runtime);
-  const clearance = authority.type === "principal" ? resolvePropertyClearance(runtime.ontology, authority.context.clearances ?? new Set) : undefined;
-  const readable = (event) => {
+  const visible = async (events) => {
     switch (authority.type) {
       case "denied":
       case "delegated":
-        return;
-      case "principal":
-        if (!canViewEvent2(authority.context, event))
-          return;
-        return clearance ? redactDomainEvent(event, clearance) : event;
+        return [];
       case "unrestricted":
-        return event;
+        return events;
+      case "principal": {
+        const viewable = events.filter((event) => canViewEvent2(authority.context, event));
+        if (viewable.length === 0)
+          return viewable;
+        const clearance = await readerClearance(runtime.objectReader);
+        const clearanceFor = await eventClearances(runtime.objectReader, viewable, clearance);
+        return viewable.flatMap((event) => {
+          if (clearance && readsUnreadable(event, clearance))
+            return [];
+          const redacting = clearanceFor(event);
+          return [redacting ? redactDomainEvent(event, redacting) : event];
+        });
+      }
     }
   };
-  const visibleEvents = (events) => events.flatMap((event) => readable(event) ?? []);
   return {
-    readable,
+    visible,
     append: (input) => {
       assertPrivileged2(runtime, "events.append");
       return runtime.events.append(input);
@@ -4212,8 +3277,7 @@ function createEventsRuntime(runtime) {
         case "unrestricted":
           break;
       }
-      const events = await runtime.events.read(input);
-      return visibleEvents(events);
+      return visible(await runtime.events.read(input));
     },
     latestCursor: () => {
       switch (authority.type) {
@@ -4234,14 +3298,63 @@ function createEventsRuntime(runtime) {
         case "unrestricted":
           break;
       }
-      return runtime.events.subscribe(input, (events) => {
-        const visible = visibleEvents(events);
-        if (visible.length > 0)
-          return handler(visible);
+      return runtime.events.subscribe(input, async (events) => {
+        let shown;
+        try {
+          shown = await visible(events);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          console.warn(`[Sixb] Dropped ${events.length} event(s) from cursor '${events[0]?.cursor}' of a subscription, whose markings could not be enforced: ${message}`);
+          return;
+        }
+        if (shown.length > 0)
+          return handler(shown);
       });
     }
   };
 }
+async function eventClearances(reader, events, clearance) {
+  const kinds = new Map;
+  for (const event of events) {
+    const kind = eventSources(event);
+    if (kind)
+      kinds.set(kind.key, kind.sources);
+  }
+  const resolved = await Promise.all([...kinds].map(async ([key, sources]) => [key, await readerEventClearance(reader, sources)]));
+  const byKind = new Map(resolved);
+  return (event) => {
+    const kind = eventSources(event);
+    return kind ? byKind.get(kind.key) : clearance;
+  };
+}
+function eventSources(event) {
+  if (event.topic !== "objects")
+    return;
+  const objectTypeId = event.payload.objectTypeId;
+  const earlier = event.type !== "object.created";
+  if (event.origin?.kind !== "projection") {
+    if (!earlier)
+      return;
+    return { key: JSON.stringify([objectTypeId]), sources: { objectTypeId, earlier } };
+  }
+  const { projectionId, datasetId, datasetVersionId } = event.origin;
+  const origin = { projectionId, datasetId, datasetVersionId, objectTypeId };
+  return {
+    key: JSON.stringify([objectTypeId, projectionId, datasetId, datasetVersionId, earlier]),
+    sources: { objectTypeId, origin, earlier }
+  };
+}
+function readsUnreadable(event, clearance) {
+  switch (event.topic) {
+    case "objects":
+    case "telemetry":
+      return clearance.unreadableType(event.payload.objectTypeId) !== undefined;
+    case "links":
+      return clearance.unreadableType(event.payload.sourceTypeId) !== undefined || clearance.unreadableType(event.payload.targetTypeId) !== undefined || clearance.unreadableLink(event.payload.sourceTypeId, event.payload.linkId) !== undefined;
+    default:
+      return false;
+  }
+}
 
 // src/logging/execution.ts
 function createLogsRuntime(runtime, source) {
@@ -5587,16 +4700,24 @@ function requireOutcome(outcomes, id) {
 }
 
 // src/objects/link/authorization.ts
-function assertCanWriteLink(ctx, endpoints) {
-  assertCanEdit2(ctx, endpoints.sourceTypeId);
-  assertAuthorized2(ctx, { kind: "object.view", objectTypeId: endpoints.targetTypeId });
+async function assertCanWriteLinks(ctx, writes) {
+  for (const write of writes) {
+    assertCanEdit2(ctx, write.sourceTypeId);
+    assertAuthorized2(ctx, { kind: "object.view", objectTypeId: write.targetTypeId });
+  }
+  await ctx.objectReader.assertReadable({
+    objectTypeIds: [
+      ...new Set(writes.flatMap((write) => [write.sourceTypeId, write.targetTypeId]))
+    ],
+    links: writes.map((write) => ({ objectTypeId: write.sourceTypeId, linkId: write.linkId }))
+  });
 }
 
 // src/objects/link/remove.ts
 async function removeLink2(ctx, params) {
   const { objectType, linkDefinition, ontology } = ctx;
   const { sourceId, linkId, targetTypeId, targetId } = params;
-  assertCanWriteLink(ctx, { sourceTypeId: objectType.id, targetTypeId });
+  await assertCanWriteLinks(ctx, [{ sourceTypeId: objectType.id, linkId, targetTypeId }]);
   assertLinkTargetType2(objectType.id, linkId, linkDefinition, targetTypeId, (expected, actual) => ontology.isValidLinkTarget(expected, actual));
   await commitRuntimeOperations(ctx, [
     linkDeleteOperation({
@@ -5652,7 +4773,7 @@ function endpointKey(objectTypeId, primaryId) {
 async function upsertLink2(ctx, params) {
   const { objectType, linkDefinition, ontology } = ctx;
   const { sourceId, linkId, targetTypeId, targetId, properties } = params;
-  assertCanWriteLink(ctx, { sourceTypeId: objectType.id, targetTypeId });
+  await assertCanWriteLinks(ctx, [{ sourceTypeId: objectType.id, linkId, targetTypeId }]);
   const endpoints = { objectType, sourceId, targetTypeId, targetId };
   requireEndpoints(endpoints, await loadEndpointExistence(ctx, collectEndpointLookups([endpoints])));
   const normalizedProperties = normalizeRuntimeLink({
@@ -5728,12 +4849,11 @@ async function upsertLinkBatch2(ctx, items) {
   const { ontology } = ctx;
   if (items.length === 0)
     return [];
-  for (const item of items) {
-    assertCanWriteLink(ctx, {
-      sourceTypeId: item.objectType.id,
-      targetTypeId: item.targetTypeId
-    });
-  }
+  await assertCanWriteLinks(ctx, items.map((item) => ({
+    sourceTypeId: item.objectType.id,
+    linkId: item.linkId,
+    targetTypeId: item.targetTypeId
+  })));
   const existing = await loadEndpointExistence(ctx, collectEndpointLookups(items));
   const valueTypesById = ontology.getValueTypesById();
   return runRuntimeItemBatch({
@@ -5777,6 +4897,7 @@ async function upsertLinkBatch2(ctx, items) {
 // src/objects/object/delete.ts
 async function deleteObject2(ctx, primaryId) {
   assertCanEdit2(ctx, ctx.objectType.id);
+  await ctx.objectReader.assertReadable({ objectTypeIds: [ctx.objectType.id] });
   await commitRuntimeOperations(ctx, [
     objectDeleteOperation({
       id: runtimeOperationId(0),
@@ -5786,6 +4907,7 @@ async function deleteObject2(ctx, primaryId) {
 }
 async function restoreObject2(ctx, primaryId) {
   assertCanEdit2(ctx, ctx.objectType.id);
+  await ctx.objectReader.assertReadable({ objectTypeIds: [ctx.objectType.id] });
   await commitRuntimeOperations(ctx, [
     objectRestoreOperation({
       id: runtimeOperationId(0),
@@ -5797,6 +4919,7 @@ async function restoreObject2(ctx, primaryId) {
 async function upsertObject2(ctx, properties) {
   assertCanEdit2(ctx, ctx.objectType.id);
   const { objectType, primaryPropertyId, ontology } = ctx;
+  const redact = await ctx.objectReader.writtenRowRedactor(objectType.id);
   const normalized = normalizeRuntimeObject({
     objectType,
     primaryPropertyId,
@@ -5807,13 +4930,14 @@ async function upsertObject2(ctx, properties) {
   const commit = await commitRuntimeOperations(ctx, [
     objectUpsertOperation({ id: runtimeOperationId(0), ref, properties: normalized.properties })
   ]);
-  return ctx.objectReader.redactWrittenRow(toObjectRow(ctx.projectId, requireEffectiveObject(commit.outcomes[0])));
+  return redact(toObjectRow(ctx.projectId, requireEffectiveObject(commit.outcomes[0])));
 }
 // src/objects/object/upsert-batch.ts
 async function upsertObjectBatch2(ctx, items) {
   assertCanEdit2(ctx, ctx.objectType.id);
   const { objectType, primaryPropertyId, ontology } = ctx;
   const valueTypesById = ontology.getValueTypesById();
+  const redact = await ctx.objectReader.writtenRowRedactor(objectType.id);
   return runRuntimeItemBatch({
     ctx,
     items,
@@ -5838,7 +4962,7 @@ async function upsertObjectBatch2(ctx, items) {
         ]
       };
     },
-    value: ([outcome]) => ctx.objectReader.redactWrittenRow(toObjectRow(ctx.projectId, requireEffectiveObject(outcome)))
+    value: ([outcome]) => redact(toObjectRow(ctx.projectId, requireEffectiveObject(outcome)))
   });
 }
 // src/objects/vectors/handle.ts
@@ -7749,10 +6873,51 @@ function validateAgentNodeDefinition(workflowId, node) {
   assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "group", node.agentStep.groupIds);
   assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "tool", node.agentStep.toolNames);
   assertUniqueNonEmptyAgentStepValues(workflowId, node.id, "skill", node.agentStep.skillNames);
+  if (node.agentStep.sandbox !== undefined) {
+    assertAgentStepSandbox(node.agentStep.sandbox, `Workflow "${workflowId}" agent step "${node.id}"`);
+  }
   if (node.mapper !== undefined && typeof node.mapper !== "function") {
     throw new WorkflowDefinitionError2(`Workflow "${workflowId}" agent node "${node.id}" mapper must be a function.`);
   }
 }
+function assertAgentStepSandbox(value, step) {
+  const fail = (issue, cause) => {
+    throw new WorkflowDefinitionError2(`${step} sandbox ${issue}`, cause === undefined ? undefined : { cause });
+  };
+  if (!isRecord(value) || typeof value.create !== "function") {
+    return fail("must be a sandbox factory with a create function.");
+  }
+  const { configuration } = value;
+  if (configuration === undefined)
+    return;
+  if (!isRecord(configuration))
+    return fail("configuration must be a sandbox recipe object.");
+  if (configuration.params !== undefined || configuration.resolve !== undefined) {
+    return fail("must use a static recipe: params and resolve are not supported in workflow steps.");
+  }
+  let recipe;
+  try {
+    recipe = staticSandboxRecipe2(configuration);
+  } catch (error) {
+    if (!(error instanceof SandboxError2))
+      throw error;
+    return fail(`recipe is invalid: ${error.message.replace(/^\[Sixb\] /, "")}`, error);
+  }
+  if (recipe.network?.mode === "none") {
+    return fail('network mode "none" cannot run an agent: the agent needs the Sixb API. Use { mode: "restricted", allow: [...] } with the origins the project needs; Sixb adds its own.');
+  }
+  const { auth } = configuration;
+  if (auth !== undefined && !(isRecord(auth) && typeof auth.authorize === "function")) {
+    return fail("auth requires an authorize function.");
+  }
+  const credentialIssue = sandboxCredentialIssue2({
+    supportsRequestCredentials: value.supportsRequestCredentials === true,
+    auth,
+    source: recipe.source
+  });
+  if (credentialIssue)
+    fail(`is invalid: ${credentialIssue}`);
+}
 function assertUniqueNonEmptyAgentStepValues(workflowId, stepId, kind, values) {
   const seen = new Set;
   for (const value of values) {
@@ -8656,6 +7821,7 @@ function createBoundSixb(runtime, dependencies, execution) {
     ...createExecutionFacades(runtime, execution, dependencies)
   };
   shareOntologyMutationRuntime2(runtime, sixb);
+  registerActivityCaptureRuntime(sixb, createActivityCaptureRuntime(runtime, dependencies.activity));
   if (dependencies.connectorConnections) {
     registerConnectorConnectionsRuntime(sixb, createConnectorConnectionsRuntime(runtime, execution, dependencies.connectorConnections));
   }
@@ -8669,17 +7835,19 @@ function createExecutionFacades(runtime, execution, dependencies) {
   return {
     objects: createObjectsRuntime(runtime, execution, dependencies.blobStorage),
     actions: createActionsRuntime(runtime, execution),
-    datasets: createDatasetsRuntime(runtime, execution, dependencies.definitions.datasets, dependencies.lakeStorage, dependencies.blobStorage),
+    datasets: createDatasetsRuntime(runtime, execution, dependencies.definitions.datasets, dependencies.lakeStorage, dependencies.blobStorage, dependencies.datasetVersionMarkings),
     workflows: createWorkflowsRuntime(runtime, execution, dependencies.definitions.workflows),
     syncs: createSyncsRuntime(runtime, execution, dependencies.definitions.syncs),
     pipelines: createPipelinesRuntime(runtime, execution, dependencies.definitions.pipelines),
     projections: createProjectionsRuntime(runtime, dependencies.definitions.projections),
     rules: createRulesRuntime(runtime, dependencies.definitions.rules),
     agent: createAgentRuntime(runtime, execution, dependencies.definitions.models, dependencies.sandbox),
+    artifacts: createArtifactsRuntime(runtime, dependencies.blobStorage),
     models: createModelsRuntime(runtime, execution, dependencies.definitions.models, dependencies.blobStorage),
     aiUsage: createAiUsageRuntime(runtime, dependencies.definitions.security),
     events: createEventsRuntime(runtime),
     logs: createLogsRuntime(runtime, dependencies.logging),
+    activity: createActivityRuntime(runtime, dependencies.activity),
     schedules: createSchedulesRuntime(runtime, dependencies.definitions.schedules),
     shares: createSharesRuntime(runtime, execution, dependencies.definitions.shares),
     connector: createConnectorRuntime(runtime, execution, dependencies.connectorService),
@@ -8807,6 +7975,6 @@ function invalidAgentExecution(executionId, runId) {
   throw new ExecutionStorageError2("invalid_input", `[Sixb] Execution '${executionId}' does not authorize Agent run '${runId}'.`);
 }
 
-export { defineAction2, param2, optional2, ActionRegistry2, createAuthorizedObjectReader, bindModelExecutionAttempt, createAgentThreadId2, createAgentThreadSandboxName2, createAgentRunId2, createSubagentRunId2, createSubagentExecutionId2, createAgentMessageId2, agentContextCheckpointId2, createAgentRunExecutionToken2, canInheritAgentRequestAuthorization2, createAgentExecutionRecord2, createInheritedAgentExecutionRecord2, bindDurableAgentExecution2, bindAgentModelExecution2, restoreAgentExecutionScope2, assertAgentExecutionRecord2, DEFAULT_PROJECT_LOCALE, DEFAULT_PROJECT_TIME_ZONE, canonicalLocale, canonicalTimeZone, resolveAgentContextParts2, agentRunQueueJobId2, subagentRunQueueJobId2, workflowAgentNodeQueueJobId2, dispatchQueuedAgentRuns2, dispatchQueuedSubagentRuns2, assertNoAgentDefinitions, requestAgentRun2, isRetryableAgentRun2, retryAgentRun2, runModelLoop2, requestAction2, ObjectError2, removeLink2, upsertLink2, upsertLinkBatch2, deleteObject2, restoreObject2, upsertObject2, upsertObjectBatch2, writeTelemetryBatch2, appendTelemetryBatch2, getTelemetryHistoryBatch2, requireLinkDefinition2, resolveObjectContext2, resolveLinkContext2, createObjectSet2, exports_service, ShareError2, WorkflowDefinitionError2, WorkflowValidationError2, assertNonEmpty, isStepDefinition2, isAgentStepDefinition2, isInterventionDefinition2, isWorkflowDefinition2, validateWorkflowDefinition2, validateWorkflowsAtStartup2, validateWorkflowAgentStepGroupReferences2, validateWorkflowInput2, validateWorkflowStepInput2, validateWorkflowStepOutput2, validateWorkflowInterventionInput2, validateWorkflowInterventionResponse2, validateWorkflowInterventionDefaultResponse2, validateWorkflowAgentStepInput2, validateWorkflowAgentStepOutput2, snapshotWorkflowAgentStepInput2, snapshotWorkflowAgentStepOutput2, snapshotWorkflowInput2, snapshotWorkflowStepInput2, snapshotWorkflowStepOutput2, snapshotWorkflowInterventionInput2, snapshotWorkflowInterventionResponse2, snapshotWorkflowInterventionDefaultResponse2, snapshotWorkflowActionInput2, WorkflowRunDispatcher2, requestWorkflowRun2, createBoundSixb, isBoundSixb, bindDurablePrimitiveExecution2, ACTION_RUN_DRAIN_TIMEOUT_MS2, ActionRunExecutor, registerActionRunExecutor, drainActionRuns2, requestAction3 };
+export { defineAction2, param2, optional2, ActionRegistry2, bindModelExecutionAttempt, createAgentThreadId2, createAgentThreadSandboxName2, createAgentRunId2, createSubagentRunId2, createSubagentExecutionId2, createAgentMessageId2, agentContextCheckpointId2, createAgentRunExecutionToken2, canInheritAgentRequestAuthorization2, createAgentExecutionRecord2, createInheritedAgentExecutionRecord2, bindDurableAgentExecution2, bindAgentModelExecution2, restoreAgentExecutionScope2, assertAgentExecutionRecord2, DEFAULT_PROJECT_LOCALE, DEFAULT_PROJECT_TIME_ZONE, canonicalLocale, canonicalTimeZone, resolveAgentContextParts2, agentRunQueueJobId2, subagentRunQueueJobId2, workflowAgentNodeQueueJobId2, dispatchQueuedAgentRuns2, dispatchQueuedSubagentRuns2, assertNoAgentDefinitions, requestAgentRun2, isRetryableAgentRun2, retryAgentRun2, runModelLoop2, requestAction2, ObjectError2, removeLink2, upsertLink2, upsertLinkBatch2, deleteObject2, restoreObject2, upsertObject2, upsertObjectBatch2, writeTelemetryBatch2, appendTelemetryBatch2, getTelemetryHistoryBatch2, requireLinkDefinition2, resolveObjectContext2, resolveLinkContext2, createObjectSet2, exports_service, ShareError2, WorkflowDefinitionError2, WorkflowValidationError2, assertNonEmpty, isStepDefinition2, isAgentStepDefinition2, isInterventionDefinition2, isWorkflowDefinition2, validateWorkflowDefinition2, validateWorkflowsAtStartup2, validateWorkflowAgentStepGroupReferences2, validateWorkflowInput2, validateWorkflowStepInput2, validateWorkflowStepOutput2, validateWorkflowInterventionInput2, validateWorkflowInterventionResponse2, validateWorkflowInterventionDefaultResponse2, assertAgentStepSandbox, validateWorkflowAgentStepInput2, validateWorkflowAgentStepOutput2, snapshotWorkflowAgentStepInput2, snapshotWorkflowAgentStepOutput2, snapshotWorkflowInput2, snapshotWorkflowStepInput2, snapshotWorkflowStepOutput2, snapshotWorkflowInterventionInput2, snapshotWorkflowInterventionResponse2, snapshotWorkflowInterventionDefaultResponse2, snapshotWorkflowActionInput2, WorkflowRunDispatcher2, requestWorkflowRun2, createBoundSixb, isBoundSixb, bindDurablePrimitiveExecution2, ACTION_RUN_DRAIN_TIMEOUT_MS2, ActionRunExecutor, registerActionRunExecutor, drainActionRuns2, requestAction3 };
 
-//# debugId=C2284586B0133A3C64756E2164756E21
+//# debugId=BC1E3E649140D38B64756E2164756E21