@sixb/core 0.1.20 → 0.1.22

package/src/storage/index.ts

@@ -4,7 +4,7 @@
  * A type in a public interface signature must be exported from the same subpath as the interface, or
  * the interface cannot be implemented from outside the package.
  */
-export type { Principal } from "../auth"
+export type { Principal, UserPrincipal } from "../auth"
 export type { ConnectorAccountCandidate } from "../connectors"
 export type { SealedConnectorCredential } from "../connectors/credentials"
 export type { SixbFailure } from "../errors/types"
@@ -21,6 +21,7 @@ export type {
 } from "../materialization/model"
 export type { ModelProviderIds } from "../models/events"
 export type { ObjectRef } from "../ontology"
+export type { UniqueValueKind } from "../ontology/unique-values"
 export type { RedactionReason, Redactions } from "../security/types"
 export type {
   ShareAccessPlan,
@@ -28,6 +29,7 @@ export type {
   ShareScopedGrant,
   ShareScopedViewGrant,
 } from "../shares/access-plan"
+export type { UserProfile } from "../users"
 export type {
   ActionRunEffectsRecord,
   ActionRunFailure,
@@ -51,10 +53,52 @@ export {
   InMemoryActionRunStorage,
 } from "./action-runs"
 export type {
+  ActivityActor,
+  ActivityAttribution,
+  ActivityCalendarInput,
+  ActivityCursor,
+  ActivityDay,
+  ActivityEventInput,
+  ActivityEventType,
+  ActivityInteraction,
+  ActivityPageView,
+  ActivityPeriodInput,
+  ActivitySessionVisits,
+  ActivityStorage,
+  ActivitySummary,
+  ActivityUser,
+  ActivityUsersPage,
+  ActivityVisit,
+  ActivityVisitsPage,
+  AppendActivityInput,
+  AppendActivityResult,
+  ListActivitySessionVisitsInput,
+  ListActivityUsersInput,
+  ListActivityVisitsInput,
+  ReadActivityVisitInput,
+  StoredActivityVisitPage,
+} from "./activity"
+export type {
+  AddAgentThreadParticipantsInput,
+  AgentApprovalCall,
+  AgentApprovalCursor,
+  AgentApprovalMode,
+  AgentApprovalModeStore,
+  AgentApprovalOutcome,
+  AgentApprovalRecord,
+  AgentApprovalSettledStatus,
+  AgentApprovalStatus,
+  AgentApprovalStore,
   AgentContextCheckpointReason,
   AgentContextCheckpointRecord,
   AgentContextCheckpointStore,
   AgentExecutionStatus,
+  AgentHoldingApprovalMode,
+  AgentMemoryChange,
+  AgentMemoryFile,
+  AgentMemoryRepoRecord,
+  AgentMemoryRevisionRecord,
+  AgentMemoryStore,
   AgentMessageRecord,
   AgentMessageRole,
   AgentMessageStore,
@@ -70,6 +114,9 @@ export type {
   AgentRunStore,
   AgentStorage,
   AgentStorageErrorCode,
+  AgentThreadKind,
+  AgentThreadParent,
+  AgentThreadParticipantRecord,
   AgentThreadRecord,
   AgentThreadSandboxParams,
   AgentThreadSandboxState,
@@ -83,23 +130,46 @@ export type {
   CreateAgentRunInput,
   CreateAgentThreadInput,
   CreateSubagentRunInput,
+  DecideAgentApprovalInput,
+  DecideAgentApprovalResult,
   DeleteAgentMessagesByRunInput,
   FinishAgentRunInput,
   FinishQueuedAgentRunInput,
+  ForkAgentThreadInput,
+  ListAgentApprovalsInput,
+  ListAgentApprovalsResult,
+  ListAgentMemoryRevisionsInput,
+  ListAgentMemoryRevisionsResult,
   ListAgentMessagesInput,
   ListAgentMessagesResult,
   ListAgentRunsInput,
   ListAgentRunsResult,
+  ListAgentThreadChildrenInput,
+  ListAgentThreadParticipantsInput,
   ListAgentThreadsInput,
   ListAgentThreadsResult,
+  ListThreadSubagentsInput,
+  MarkAgentApprovalsReportedInput,
   ReclaimAgentRunInput,
+  RemoveAgentThreadParticipantInput,
+  RequestAgentApprovalInput,
+  RequestAgentApprovalResult,
+  SaveAgentMemoryInput,
+  SaveAgentMemoryResult,
+  SettleAgentApprovalsInput,
   StartAgentRunInput,
+  StopAgentApprovalsInput,
+  StopAgentApprovalsResult,
+  SubagentRunFile,
   SubagentRunRecord,
   SubagentRunResult,
   SubagentRunSpec,
   TransitionAgentThreadSandboxInput,
 } from "./agents"
 export {
+  AGENT_APPROVAL_MODES,
+  AGENT_APPROVAL_STATUSES,
+  AGENT_HOLDING_APPROVAL_MODES,
   AGENT_RUN_DIAGNOSTIC_CODES,
   AGENT_RUN_FAILURE_CODES,
   AGENT_RUN_FINISH_REASONS,
@@ -112,6 +182,7 @@ export type {
   AiAccountingAggregate,
   AiAccountingAttribution,
   AiAccountingBucket,
+  AiAccountingKindBreakdown,
   AiAccountingModelBreakdown,
   AiAccountingOverview,
   AiAccountingRange,
@@ -177,6 +248,7 @@ export type {
 } from "./ai-limits"
 export { AiLimitStorageError, aiLimitCalendarMonth, InMemoryAiLimitStorage } from "./ai-limits"
 export type {
+  AiModelCallFilesRecord,
   AiModelCallUsage,
   AiModelCallUsageInput,
   AiModelCallUsageRecord,
@@ -184,15 +256,52 @@ export type {
   AiUsageReportingStatus,
   AiUsageStorage,
   AiUsageStorageErrorCode,
+  GetAiModelCallFilesInput,
   GetLatestAiModelCallForExecutionInput,
   InMemoryAiUsageGroupRow,
   InMemoryAiUsageStorageSnapshot,
+  RecordAiModelCallFilesInput,
   RecordAiModelCallInput,
   RecordAiModelCallResult,
   SummarizeAiUsageExecutionInput,
   SummarizeAiUsageExecutionsInput,
 } from "./ai-usage"
 export { AiUsageStorageError, aggregateAiModelCallUsage, InMemoryAiUsageStorage } from "./ai-usage"
+export type {
+  ArtifactFile,
+  ArtifactFrameGrantRecord,
+  ArtifactFrameTarget,
+  ArtifactKind,
+  ArtifactLatestVersion,
+  ArtifactOrigin,
+  ArtifactOutline,
+  ArtifactRecord,
+  ArtifactReference,
+  ArtifactStateEntry,
+  ArtifactStateKeyInput,
+  ArtifactStateScope,
+  ArtifactStorage,
+  ArtifactStorageError,
+  ArtifactStorageErrorCode,
+  ArtifactVersionInput,
+  ArtifactVersionRecord,
+  CopyArtifactInput,
+  CreateArtifactInput,
+  DeleteArtifactInput,
+  DeleteArtifactVersionsByOriginInput,
+  DeleteExpiredArtifactFrameGrantsInput,
+  FindArtifactFrameGrantInput,
+  GetArtifactInput,
+  GetArtifactVersionInput,
+  ListArtifactsInput,
+  ListArtifactsResult,
+  ListArtifactVersionsInput,
+  ListArtifactVersionsResult,
+  ListReferencingVersionsInput,
+  PublishArtifactVersionInput,
+  PublishedArtifactVersion,
+  SetArtifactStateInput,
+} from "./artifacts"
 export type {
   AccessTokenRecord,
   AuthAccessTokenStore,
@@ -235,6 +344,8 @@ export type {
   ListAuthInvitationsResult,
   ListAuthServiceAccountsInput,
   ListAuthServiceAccountsResult,
+  ListAuthSessionsInput,
+  ListAuthSessionsResult,
   ListAuthUsersInput,
   ListAuthUsersResult,
   MagicLinkRecord,
@@ -248,6 +359,7 @@ export type {
   SuspendUserAndRevokeSessionsInput,
   UpdateAuthServiceAccountInput,
   UpdateAuthUserProfileInput,
+  UpdateAuthUserResult,
   UpdateAuthUserStatusInput,
   UpsertAuthGroupMembershipInput,
   UpsertAuthServiceAccountGroupMembershipInput,
@@ -339,10 +451,15 @@ export type {
   CreateExecutionInput,
   DurableExecutionExecutor,
   DurableExecutionSource,
+  ExecutionDescendant,
   ExecutionRecord,
+  ExecutionSessionRef,
   ExecutionStorage,
   ExecutionStorageErrorCode,
   KernelOperation,
+  ListExecutionDescendantsInput,
+  ListSessionExecutionsInput,
+  SessionExecutions,
   TrustedPrimitiveKind,
   TrustedPrimitiveRef,
 } from "./executions"
@@ -398,10 +515,12 @@ export {
   step,
 } from "./migrations"
 export type {
+  CompiledConditionalObjectReadScope,
   CompiledObjectReadObjectSelection,
   CompiledObjectReadRoot,
   CompiledObjectReadStep,
   CompiledSelectedObjectReadScope,
+  ConditionalObjectReadScope,
   CountObjectsInput,
   CountObjectsResult,
   ExistsObjectsInput,
@@ -422,6 +541,7 @@ export type {
   ObjectQueryCapabilityMap,
   ObjectQueryScalarOperation,
   ObjectQueryScalarOperations,
+  ObjectReadCondition,
   ObjectReadExecutionLimits,
   ObjectReadLimitMetric,
   ObjectReadLinkDefinitionSelection,
@@ -433,6 +553,7 @@ export type {
   ObjectReadStorage,
   ObjectRow,
   ObjectRowLinks,
+  ObjectRowUsers,
   ObjectStorage,
   QueryObjectLinksInput,
   QueryObjectLinksResult,
@@ -444,6 +565,7 @@ export {
   assertObjectReaderProject,
   assertObjectReadFacetCount,
   assertObjectReadOutputWithinLimit,
+  compileConditionalObjectReadScope,
   compileSelectedObjectReadScope,
   linkBatchKey,
   MAX_OBJECT_READ_FACETS,
@@ -461,6 +583,7 @@ export type {
   AbandonRunSourceMaterializationInput,
   AbandonSourceMaterializationCandidateInput,
   AbandonSourceMaterializationInput,
+  ActiveOntologySource,
   AdoptedSourceMaterialization,
   AdoptSourceMaterializationInput,
   AppliedMaterialization,
@@ -486,6 +609,8 @@ export type {
   ExactObjectOverrideDelete,
   ExactObjectOverrideWrite,
   ExactTimeseriesPointWrite,
+  ExactUniqueValueClaim,
+  ExactUniqueValueWrite,
   ExpectedSourceRevision,
   ExpectedTimeseriesPointRevision,
   FinalizeMaterializationInput,
@@ -493,6 +618,7 @@ export type {
   GetOntologyCommitByIdempotencyKeyInput,
   GetOntologyCommitByIdInput,
   GetOntologyCommitByOriginInput,
+  ListActiveOntologySourcesInput,
   ListOntologyCommitsInput,
   ListOntologyCommitsResult,
   MarkSourceMaterializationReadyInput,
@@ -538,10 +664,12 @@ export type {
   OntologySourceRecord,
   OntologySourceStorage,
   OntologyStorage,
+  OntologyUniqueValueStorage,
   OntologyVectorStorage,
   OpenedReplacementPlan,
   OpenReplacementPlanInput,
   PlannedReplacementIdentity,
+  PreparedUniqueProperty,
   ProjectionOntologyCommitIntent,
   PurgeAbandonedSourceMaterializationsInput,
   PurgePublishedOntologyOutboxInput,
@@ -572,6 +700,8 @@ export type {
   StreamReplacementPlanStateInput,
   SummarizeOntologyOutboxInput,
   TelemetryOntologyCommitIntent,
+  UniqueValueEntry,
+  UniqueValueRef,
 } from "./ontology"
 export { ONTOLOGY_OUTBOX_FAILURE_CODES } from "./ontology"
 export type {
@@ -658,6 +788,7 @@ export { InMemoryRulesStorage } from "./rules"
 export type {
   CreateShareGrantInput,
   GetShareGrantByIdInput,
+  GetShareGrantsByIdsInput,
   ListShareGrantsInput,
   ListShareGrantsResult,
   RevokeShareGrantInput,

package/src/storage/internal.ts

@@ -1,8 +1,46 @@
 /** Implementation exports for Sixb packages only. */
 
 export { normalizeRecordActionRunInput, resolveActionRunEffects } from "./action-runs/record"
-export { assertAiUsageExecutionId, normalizeAiModelCallRecord } from "./ai-usage/record"
+export type { ActivitySourceState, StoredActivityEvent } from "./activity/policy"
+export {
+  ACTIVITY_BATCH_LIMIT,
+  ACTIVITY_EVENT_ID_PATTERN,
+  ACTIVITY_HOSTNAME_PATTERN,
+  ACTIVITY_ID_MAX_LENGTH,
+  ACTIVITY_INTERACTION_NAME_MAX_LENGTH,
+  ACTIVITY_INTERACTION_NAME_PATTERN,
+  ACTIVITY_LABEL_MAX_LENGTH,
+  ACTIVITY_LABEL_PATTERN,
+  ACTIVITY_MAX_PAGE_SIZE,
+  ACTIVITY_MAX_PERIOD_MS,
+  ACTIVITY_MAX_VISIT_MS,
+  ACTIVITY_REFERRER_MAX_LENGTH,
+  ACTIVITY_ROUTE_MAX_LENGTH,
+  ACTIVITY_VISIT_ID_PATTERN,
+  activityActor,
+  activityCalendarDays,
+  isActivityRoutePattern,
+  parseActivityAttribution,
+  planActivityAppend,
+  serializeActivityAttribution,
+  validateActivityAppend,
+} from "./activity/policy"
+export {
+  assertAiUsageExecutionId,
+  assertSameCallExecution,
+  normalizeAiModelCallFilesRecord,
+  normalizeAiModelCallRecord,
+} from "./ai-usage/record"
 export { normalizeAiModelCallUsage } from "./ai-usage/usage"
+export {
+  artifactStateBytes,
+  artifactStorageErrors,
+  checkArtifactStateWrite,
+  parseArtifactFrameGrantRow,
+  parseArtifactRow,
+  parseArtifactStateRow,
+  parseArtifactVersionRow,
+} from "./artifacts/record"
 export { parseFileDownloadGrantRow } from "./file-download-grants/record"
 export { createFileUploadId, createUploadExpiresAt } from "./file-upload-sessions/utils"
 export { canRequeuePipelineRunAfterEnqueueFailure } from "./pipeline-runs/idempotency"

package/src/storage/migrations/migrate-storage.ts

@@ -4,6 +4,7 @@ import {
   prepareObjectQueries,
 } from "../objects/query-preparation"
 import type { Storage } from "../types"
+import { prepareUniqueProperties } from "./prepare-unique-properties"
 import type {
   MigrationCapableStorage,
   MigrationReport,
@@ -15,7 +16,10 @@ export function isMigrationCapableStorage(storage: Storage): storage is Migratio
   return Array.isArray((storage as { migrators?: unknown }).migrators)
 }
 
-/** Run schema migrations, then prepare query indexes when the provider supports it. */
+/**
+ * Run schema migrations, then, given the project's ontology, prepare query indexes when the
+ * provider supports it and the stored values of unique properties.
+ */
 export async function migrateStorage(
   storage: Storage,
   options?: StorageMigrationOptions
@@ -35,6 +39,9 @@ export async function migrateStorage(
     }
   }
 
+  // Not part of the status: it only reads and writes rows, and says when it builds values.
+  if (options) await prepareUniqueProperties({ ...options, storage })
+
   let status: StorageMigrationResult["status"] = "skipped"
   if (reports.length > 0 || queries) {
     status = "current"

package/src/storage/migrations/prepare-unique-properties.ts

@@ -0,0 +1,161 @@
+import { UniqueValueViolationError } from "../../materialization/errors"
+import type { OntologyDefinitionCatalog } from "../../ontology/registry"
+import {
+  UNIQUE_VALUE_KEY_VERSION,
+  type UniquePropertyDefinition,
+  uniquePropertiesOf,
+  uniqueValueKey,
+} from "../../ontology/unique-values"
+import { isStorageSerializationFailure } from "../errors"
+import type { PreparedUniqueProperty, UniqueValueEntry } from "../ontology/unique-values"
+import type { Storage } from "../types"
+
+/** Objects read, and values inserted, per round of a property's backfill. */
+const BACKFILL_PAGE_ROWS = 1_000
+
+/** A write committing during a backfill makes it fail serialization: start it over. */
+const MAX_PREPARATION_ATTEMPTS = 5
+const FIRST_RETRY_DELAY_MS = 50
+
+interface DeclaredUniqueProperty extends UniquePropertyDefinition {
+  readonly objectTypeId: string
+}
+
+/**
+ * Brings the stored unique values in line with the ontology: builds those of a property that is
+ * newly unique (or whose keys changed kind or version) from the objects already stored, and drops
+ * those of a property that is no longer unique. Object writes keep them current from then on, and
+ * refuse to claim a value of a property this has not prepared.
+ *
+ * Each property is prepared in its own serializable transaction, which first takes the provider's
+ * preparation lock. Two objects already sharing a value fail the preparation, naming both, and
+ * leave the property unprepared.
+ */
+export async function prepareUniqueProperties(input: {
+  readonly storage: Storage
+  readonly projectId: string
+  readonly ontology: OntologyDefinitionCatalog
+}): Promise<void> {
+  const { storage, projectId } = input
+  const declared = declaredUniqueProperties(input.ontology)
+  const declaredKeys = new Set(declared.map(propertyKey))
+
+  for (const property of declared) {
+    await withRetries(property, () =>
+      storage.transaction((tx) => backfillProperty(tx, projectId, property), {
+        isolation: "serializable",
+      })
+    )
+  }
+
+  const undeclared = (await storage.ontology.uniqueValues.listPrepared({ projectId })).filter(
+    (property) => !declaredKeys.has(propertyKey(property))
+  )
+  for (const { objectTypeId, propertyId } of undeclared) {
+    await withRetries({ objectTypeId, propertyId }, () =>
+      storage.transaction(
+        async (tx) => {
+          await tx.ontology.uniqueValues.lockPreparation({ projectId })
+          await tx.ontology.uniqueValues.clear({ projectId, objectTypeId, propertyId })
+        },
+        { isolation: "serializable" }
+      )
+    )
+  }
+}
+
+function declaredUniqueProperties(ontology: OntologyDefinitionCatalog): DeclaredUniqueProperty[] {
+  const valueTypesById = ontology.getValueTypesById()
+  return ontology.listObjectTypes().flatMap((objectType) =>
+    uniquePropertiesOf(objectType, valueTypesById).map((property) => ({
+      objectTypeId: objectType.id,
+      ...property,
+    }))
+  )
+}
+
+async function withRetries(
+  property: { readonly objectTypeId: string; readonly propertyId: string },
+  run: () => Promise<void>
+): Promise<void> {
+  for (let attempt = 1; ; attempt += 1) {
+    try {
+      return await run()
+    } catch (error) {
+      if (!isStorageSerializationFailure(error) || attempt >= MAX_PREPARATION_ATTEMPTS) {
+        throw preparationError(property, error)
+      }
+      await new Promise((resolve) => setTimeout(resolve, FIRST_RETRY_DELAY_MS * 2 ** (attempt - 1)))
+    }
+  }
+}
+
+async function backfillProperty(
+  tx: Storage,
+  projectId: string,
+  property: DeclaredUniqueProperty
+): Promise<void> {
+  const { objectTypeId, propertyId } = property
+  const values = tx.ontology.uniqueValues
+  await values.lockPreparation({ projectId })
+
+  const current = (await values.listPrepared({ projectId })).find(
+    (prepared) => propertyKey(prepared) === propertyKey(property)
+  )
+  if (current && isCurrent(current, property)) return
+
+  await values.clear({ projectId, objectTypeId, propertyId })
+
+  let afterPrimaryId: string | undefined
+  do {
+    const page = await tx.objects.listByPrimaryIdPage({
+      projectId,
+      objectTypeId,
+      limit: BACKFILL_PAGE_ROWS,
+      ...(afterPrimaryId === undefined ? {} : { afterPrimaryId }),
+    })
+    if (afterPrimaryId === undefined && page.objects.length > 0) {
+      console.info(`[Sixb] Preparing unique property '${objectTypeId}.${propertyId}'.`)
+    }
+
+    const entries: UniqueValueEntry[] = []
+    for (const object of page.objects) {
+      const valueKey = uniqueValueKey(property.kind, object.properties[propertyId])
+      if (valueKey !== null) entries.push({ valueKey, primaryId: object.primaryId })
+    }
+    if (entries.length > 0) await values.insert({ projectId, objectTypeId, propertyId, entries })
+
+    afterPrimaryId = page.nextPrimaryId
+  } while (afterPrimaryId !== undefined)
+
+  await values.markPrepared({
+    projectId,
+    objectTypeId,
+    propertyId,
+    keyKind: property.kind,
+    keyVersion: UNIQUE_VALUE_KEY_VERSION,
+    preparedAt: new Date().toISOString(),
+  })
+}
+
+/** Keys are rebuilt when they were computed for another kind, as after a schema change. */
+function isCurrent(prepared: PreparedUniqueProperty, property: DeclaredUniqueProperty): boolean {
+  return prepared.keyKind === property.kind && prepared.keyVersion === UNIQUE_VALUE_KEY_VERSION
+}
+
+function preparationError(
+  property: { readonly objectTypeId: string; readonly propertyId: string },
+  error: unknown
+): unknown {
+  if (!(error instanceof UniqueValueViolationError)) return error
+  return new Error(
+    `[Sixb] Cannot make '${property.objectTypeId}.${property.propertyId}' unique: objects ` +
+      `'${error.holderPrimaryId}' and '${error.claimantPrimaryId}' share a value. ` +
+      "Fix the data, then start again.",
+    { cause: error }
+  )
+}
+
+function propertyKey(property: { readonly objectTypeId: string; readonly propertyId: string }) {
+  return JSON.stringify([property.objectTypeId, property.propertyId])
+}

package/src/storage/objects/guard.ts

@@ -7,16 +7,19 @@ export interface ObjectReadStorageCallGuard {
 
 /** Validate the required runtime capability before any facade can expose broad object reads. */
 export function requireObjectReadScopeFactory(storage: ObjectStorage): ObjectReadScopeFactory {
-  if (typeof storage.createSelectedReadScope !== "function") {
+  if (
+    typeof storage.createSelectedReadScope !== "function" ||
+    typeof storage.createConditionalReadScope !== "function"
+  ) {
     throw new Error(
-      "[Sixb] Object storage provider must implement ObjectReadScopeFactory to create selected object readers."
+      "[Sixb] Object storage provider must implement ObjectReadScopeFactory to create selected and conditional object readers."
     )
   }
   return storage
 }
 
 /**
- * Guard every selected-reader terminal without proxying the provider reader.
+ * Guard every scoped-reader terminal without proxying the provider reader.
  *
  * First-party providers freeze their readers. A Proxy cannot substitute a frozen own method
  * without violating JavaScript's invariants, so operation and lifetime guards use this explicit
@@ -32,6 +35,7 @@ export function createGuardedObjectReadStorage(
       return reader.queryCapabilities()
     },
     getByPrimaryId: (input) => guard.run(() => reader.getByPrimaryId(input)),
+    getByUniqueValue: (input) => guard.run(() => reader.getByUniqueValue(input)),
     selectsObjectProperties: (input) => guard.run(() => reader.selectsObjectProperties(input)),
     listLinks: (input) => guard.run(() => reader.listLinks(input)),
     getByPrimaryIdBatch: (input) => guard.run(() => reader.getByPrimaryIdBatch(input)),

package/src/storage/objects/in-memory/conditional-reader.ts

@@ -0,0 +1,72 @@
+import type { ObjectQueryPredicate } from "../../../objects/query"
+import { matchesPredicate } from "../../../objects/query/matches-predicate"
+import type {
+  CompiledConditionalObjectReadScope,
+  ObjectLinkRow,
+  ObjectQueryCapabilities,
+  ObjectReadStorage,
+  ObjectRow,
+} from "../types"
+import type { InMemoryReadSource, InMemoryScopedReadSource } from "./read-source"
+import { createInMemoryScopedReader } from "./scoped-reader"
+
+/** Read the live store through a conditional scope. */
+export function createInMemoryConditionalReader(
+  source: InMemoryReadSource,
+  scope: CompiledConditionalObjectReadScope,
+  queryCapabilities: () => ObjectQueryCapabilities
+): ObjectReadStorage {
+  const conditional = createConditionalReadSource(source, scope)
+
+  return createInMemoryScopedReader({
+    projectId: source.projectId,
+    resolve: () => conditional,
+    queryCapabilities,
+  })
+}
+
+/**
+ * Filter the live source as it is read: an object of a conditioned type exists only while its
+ * condition matches, and a link only while both its endpoints do.
+ */
+function createConditionalReadSource(
+  source: InMemoryReadSource,
+  scope: CompiledConditionalObjectReadScope
+): InMemoryScopedReadSource {
+  const predicates = new Map<string, ObjectQueryPredicate>(
+    scope.conditions.map((condition) => [condition.objectTypeId, condition.predicate])
+  )
+
+  const isVisible = (row: ObjectRow): boolean => {
+    const predicate = predicates.get(row.objectTypeId)
+    return predicate === undefined || matchesPredicate(row, predicate)
+  }
+
+  const getObject = (objectTypeId: string, primaryId: string): ObjectRow | undefined => {
+    const row = source.getObject(objectTypeId, primaryId)
+    return row && isVisible(row) ? row : undefined
+  }
+
+  // An endpoint of an unconditioned type is read as unscoped storage reads it, stored or not.
+  const isVisibleEndpoint = (objectTypeId: string, primaryId: string): boolean =>
+    !predicates.has(objectTypeId) || getObject(objectTypeId, primaryId) !== undefined
+
+  const isVisibleLink = (link: ObjectLinkRow): boolean =>
+    isVisibleEndpoint(link.sourceTypeId, link.sourceId) &&
+    isVisibleEndpoint(link.targetTypeId, link.targetId)
+
+  return {
+    projectId: source.projectId,
+    selectsProperty: (objectTypeId, primaryId) => getObject(objectTypeId, primaryId) !== undefined,
+    // Read only for rows a query already found here.
+    getVector: (ref, profile) => source.getVector?.(ref, profile),
+    allObjects: () => [...source.allObjects()].filter(isVisible),
+    objectsOfType: (objectTypeId) => source.objectsOfType(objectTypeId).filter(isVisible),
+    getObject,
+    outgoingLinks: (objectTypeId, primaryId) =>
+      [...source.outgoingLinks(objectTypeId, primaryId)].filter(isVisibleLink),
+    allLinks: () => [...source.allLinks()].filter(isVisibleLink),
+    // A hidden holder is read through getObject, which finds nothing.
+    uniqueHolder: (value) => source.uniqueHolder(value),
+  }
+}