@sixb/core 0.1.20 → 0.1.22

package/dist/chunk-7z5p905k.js

@@ -0,0 +1,1660 @@
+// @bun
+import {
+  MAX_OBJECT_READ_FACETS2,
+  assertObjectReadOutputWithinLimit2,
+  captureExecutionScope,
+  resolveExecutionScopeAuthorization,
+  AuthorizationError2,
+  isAllowed2,
+  assertAuthorized2,
+  isRuntimeAllowed2,
+  assertRuntimeAuthorizationBound2
+} from "./chunk-yc9ners4.js";
+import {
+  isUserRef,
+  isUserRefPropertySchema
+} from "./chunk-4y26vs3v.js";
+import {
+  compileConditionalObjectReadScope2
+} from "./chunk-rap5w0x0.js";
+import {
+  validateSchemaValue2,
+  normalizeSchemaValue2,
+  uniqueValueKind,
+  uniqueValueKey
+} from "./chunk-65pyhyas.js";
+import {
+  unreadableError,
+  resolvePropertyClearance
+} from "./chunk-6rrtzea3.js";
+import {
+  bindCurrentUserPredicate,
+  composeObjectQueryAdmissions,
+  validateObjectQuery2,
+  validateObjectQueryWithAdmission,
+  toUserProfile
+} from "./chunk-h3pbv7n8.js";
+import {
+  snapshotVectorProfiles
+} from "./chunk-cdk3egjj.js";
+import {
+  userExpansionPlan,
+  executeObjectQuery2,
+  countObjects2,
+  existsObjects2,
+  facetObjects2,
+  validateObjectFacetRequests,
+  preflightObjectQueryLinks,
+  executeObjectQueryLinks2
+} from "./chunk-efmm01gj.js";
+import {
+  createPropertyTokenMap2,
+  createLinkTokenMap2
+} from "./chunk-16a9dmfy.js";
+import {
+  ObjectQueryValidationError2,
+  normalizeObjectQuery2
+} from "./chunk-j936th07.js";
+import {
+  OntologyValidationError2,
+  OntologyNotFoundError2,
+  formatUnknownObjectTypeMessage
+} from "./chunk-cqr3acm1.js";
+
+// src/assert-never.ts
+function assertNever(_value, message) {
+  throw new Error(message);
+}
+
+// src/objects/clearance-redaction.ts
+function redactObjectRow(row, clearance) {
+  return redactRow(row, clearance, true);
+}
+function omitHiddenProperties(row, clearance) {
+  return redactRow(row, clearance, false);
+}
+function attachRedactions(row, clearance) {
+  const hidden = clearance.hiddenProperties(row.objectTypeId);
+  if (hidden !== undefined)
+    row.redactions = hidden.redactions;
+  if (row.links === undefined)
+    return;
+  for (const value of Object.values(row.links)) {
+    if (value === null)
+      continue;
+    if (Array.isArray(value)) {
+      for (const linked of value)
+        attachRedactions(linked, clearance);
+    } else {
+      attachRedactions(value, clearance);
+    }
+  }
+}
+function redactRow(row, clearance, withRedactions) {
+  const hidden = clearance.hiddenProperties(row.objectTypeId);
+  const links = row.links;
+  if (hidden === undefined && links === undefined)
+    return row;
+  const redacted = { ...row };
+  if (hidden !== undefined) {
+    redacted.properties = withoutKeys(row.properties, hidden.ids);
+    if (withRedactions)
+      redacted.redactions = hidden.redactions;
+  }
+  if (links !== undefined) {
+    redacted.links = Object.fromEntries(Object.entries(links).map(([linkId, value]) => [
+      linkId,
+      redactLinkValue(value, clearance, withRedactions)
+    ]));
+  }
+  return redacted;
+}
+function redactLinkValue(value, clearance, withRedactions) {
+  if (value === null)
+    return null;
+  if (Array.isArray(value)) {
+    return value.map((row) => redactRow(row, clearance, withRedactions));
+  }
+  return redactRow(value, clearance, withRedactions);
+}
+function redactDomainEvent(event, clearance) {
+  if (event.topic !== "objects")
+    return event;
+  const hidden = clearance.hiddenProperties(event.payload.objectTypeId);
+  if (hidden === undefined)
+    return event;
+  if (event.type === "object.deleted") {
+    return {
+      ...event,
+      payload: {
+        ...event.payload,
+        propertyChanges: withoutKeys(event.payload.propertyChanges, hidden.ids),
+        redactions: hidden.redactions
+      }
+    };
+  }
+  return {
+    ...event,
+    payload: {
+      ...event.payload,
+      properties: withoutKeys(event.payload.properties, hidden.ids),
+      propertyChanges: withoutKeys(event.payload.propertyChanges, hidden.ids),
+      redactions: hidden.redactions
+    }
+  };
+}
+function withoutKeys(record, hidden) {
+  const kept = { ...record };
+  for (const key of hidden)
+    delete kept[key];
+  return kept;
+}
+
+// src/objects/query/clearance-admission.ts
+function createClearanceQueryAdmission(clearance) {
+  const reachedTypes = new WeakMap;
+  const state = (objectTypeIds) => {
+    const created = Object.freeze({});
+    reachedTypes.set(created, Object.freeze([...objectTypeIds]));
+    return created;
+  };
+  const reached = (input) => {
+    const objectTypeIds = reachedTypes.get(input);
+    if (!objectTypeIds) {
+      throw new Error("[Sixb] Clearance query admission received a state it did not create.");
+    }
+    return objectTypeIds;
+  };
+  const empty = state([]);
+  const admission = {
+    empty: () => empty,
+    source: (input) => ({
+      state: state(input.result.objectTypeIds),
+      ...denied(unreadableTypeAmong(clearance, input.result.objectTypeIds))
+    }),
+    edge: (input) => {
+      const sourceTypeIds = input.direction === "outgoing" ? reached(input.state) : [
+        ...input.result.objectTypeIds,
+        ...input.sourceObjectTypeId ? [input.sourceObjectTypeId] : []
+      ];
+      const link = sourceTypeIds.map((objectTypeId) => clearance.unreadableLink(objectTypeId, input.linkId)).find((unreadable) => unreadable !== undefined);
+      return {
+        state: state(input.result.objectTypeIds),
+        ...denied(link ?? unreadableTypeAmong(clearance, input.result.objectTypeIds))
+      };
+    },
+    set: (input) => input.op === "subtract" ? input.states[0] ?? empty : state([...new Set(input.states.flatMap(reached))]),
+    property: (input) => {
+      if (input.use === "project")
+        return;
+      const objectTypeIds = input.objectTypeId === undefined ? reached(input.state) : [input.objectTypeId];
+      for (const objectTypeId of objectTypeIds) {
+        const marking = clearance.missingMarking(objectTypeId, input.propertyId);
+        if (marking === undefined)
+          continue;
+        return new AuthorizationError2(`clearance:marking:${marking}`, `[Sixb] Cannot ${PROPERTY_USE_VERBS[input.use]} '${objectTypeId}.${input.propertyId}' at '${input.path}': it requires clearance for marking '${marking}'.`);
+      }
+      return;
+    }
+  };
+  return Object.freeze(admission);
+}
+function unreadableTypeAmong(clearance, objectTypeIds) {
+  for (const objectTypeId of objectTypeIds) {
+    const unreadable = clearance.unreadableType(objectTypeId);
+    if (unreadable)
+      return unreadable;
+  }
+  return;
+}
+function denied(unreadable) {
+  return unreadable ? { denial: unreadableError(unreadable) } : {};
+}
+var PROPERTY_USE_VERBS = {
+  filter: "filter by",
+  text: "search",
+  vector: "run a vector search over",
+  sort: "sort by",
+  project: "project",
+  "expand.orderBy": "order expanded objects by",
+  facet: "facet by"
+};
+
+// src/objects/query/link-query-clearance.ts
+function assertLinkQueryReadable(input) {
+  const { ontology, clearance } = input;
+  const { types, links } = clearance.unreadable();
+  if (types.size === 0 && links.length === 0)
+    return;
+  const preflight = preflightObjectQueryLinks({ ...input.request, query: input.query }, { ontology });
+  const selected = preflight.validated.result.objectTypeIds;
+  const outgoing = preflight.direction !== "incoming";
+  const incoming = preflight.direction !== "outgoing";
+  const named = (linkId) => preflight.linkId === undefined || preflight.linkId === linkId;
+  const targets = (expected, objectTypeId) => (typeof expected === "string" ? [expected] : expected).some((target) => ontology.isValidLinkTarget(target, objectTypeId));
+  for (const link of links) {
+    if (!named(link.linkId))
+      continue;
+    if (outgoing && selected.includes(link.objectTypeId) || incoming && selected.some((id) => targets(link.targetObjectTypeId, id))) {
+      throw unreadableError(link);
+    }
+  }
+  const sealed = [...types].filter(([id]) => input.viewableByGrants(id));
+  if (sealed.length === 0)
+    return;
+  for (const objectType of ontology.listObjectTypes()) {
+    for (const link of objectType.links) {
+      if (!named(link.id))
+        continue;
+      if (outgoing && selected.includes(objectType.id)) {
+        const other = sealed.find(([id]) => targets(link.targetObjectTypeId, id));
+        if (other)
+          throw unreadableError(other[1]);
+      }
+      const source = types.get(objectType.id);
+      if (incoming && source && input.viewableByGrants(objectType.id) && selected.some((id) => targets(link.targetObjectTypeId, id))) {
+        throw unreadableError(source);
+      }
+    }
+  }
+}
+
+// src/objects/telemetry/workload.ts
+var MAX_DELEGATED_TELEMETRY_HISTORY_SERIES = 100;
+var MAX_DELEGATED_TELEMETRY_HISTORY_POINTS = 1e4;
+var DEFAULT_DELEGATED_TELEMETRY_HISTORY_LIMIT_PER_SERIES = 100;
+
+class TelemetryHistoryWorkloadExceededError extends Error {
+  metric;
+  limit;
+  name = "TelemetryHistoryWorkloadExceededError";
+  code = "telemetry_history_workload_exceeded";
+  constructor(metric, limit) {
+    super(`[Sixb] Delegated telemetry history exceeded its ${metric} limit (${limit}).`);
+    this.metric = metric;
+    this.limit = limit;
+  }
+}
+function admitTelemetryHistoryReadWorkload(input, delegated) {
+  const seriesCount = input.seriesCount;
+  const limitPerSeries = input.limitPerSeries;
+  if (!Number.isSafeInteger(seriesCount) || seriesCount < 0) {
+    throw new Error("[Sixb] Telemetry history series must have a non-negative safe integer length.");
+  }
+  if (limitPerSeries !== undefined && (!Number.isSafeInteger(limitPerSeries) || limitPerSeries < 0)) {
+    throw new Error("[Sixb] Telemetry history limit must be a non-negative safe integer.");
+  }
+  if (!delegated) {
+    const admission = limitPerSeries === undefined ? {} : { limitPerSeries };
+    return Object.freeze(admission);
+  }
+  if (seriesCount > MAX_DELEGATED_TELEMETRY_HISTORY_SERIES) {
+    throw new TelemetryHistoryWorkloadExceededError("series", MAX_DELEGATED_TELEMETRY_HISTORY_SERIES);
+  }
+  if (seriesCount === 0) {
+    return Object.freeze({
+      ...limitPerSeries === undefined ? {} : { limitPerSeries },
+      maxPointOccurrences: MAX_DELEGATED_TELEMETRY_HISTORY_POINTS
+    });
+  }
+  const maxLimitPerSeries = Math.floor(MAX_DELEGATED_TELEMETRY_HISTORY_POINTS / seriesCount);
+  const effectiveLimitPerSeries = limitPerSeries ?? Math.min(DEFAULT_DELEGATED_TELEMETRY_HISTORY_LIMIT_PER_SERIES, maxLimitPerSeries);
+  if (effectiveLimitPerSeries > maxLimitPerSeries) {
+    throw new TelemetryHistoryWorkloadExceededError("points", MAX_DELEGATED_TELEMETRY_HISTORY_POINTS);
+  }
+  return Object.freeze({
+    limitPerSeries: effectiveLimitPerSeries,
+    maxPointOccurrences: MAX_DELEGATED_TELEMETRY_HISTORY_POINTS
+  });
+}
+
+// src/objects/authorized-ontology-view.ts
+function createAuthorizedOntologyView(input) {
+  const allObjectTypes = input.ontology.listObjectTypes();
+  const registeredObjectTypeIds = new Set(allObjectTypes.map((objectType) => objectType.id));
+  const requestedObjectTypeIds = selectedObjectTypeIds(input.selection, allObjectTypes);
+  const visibleObjectTypeIds = new Set([...requestedObjectTypeIds].filter((objectTypeId) => registeredObjectTypeIds.has(objectTypeId)));
+  const selectedSchema = input.selection.kind === "selected" ? collectSelectedSchema(input.selection.scope) : undefined;
+  const projectedObjectTypes = [];
+  for (const objectType of allObjectTypes) {
+    if (!visibleObjectTypeIds.has(objectType.id))
+      continue;
+    const propertyIds = selectedSchema?.propertyIdsByObjectType.get(objectType.id) ?? new Set(objectType.properties.map((property) => property.id));
+    const links = selectedSchema ? selectedSchema.linksBySourceType.get(objectType.id) ?? new Map : input.selection.kind === "all" ? allDeclaredLinks(objectType) : allVisibleLinks(input.ontology, objectType, visibleObjectTypeIds);
+    projectedObjectTypes.push(projectObjectType({
+      objectType,
+      propertyIds,
+      links,
+      visibleObjectTypeIds,
+      ontology: input.ontology,
+      targetMode: input.selection.kind === "all" ? "original" : input.selection.kind === "types" ? "principal" : "exact",
+      exposeContracts: input.selection.kind !== "selected"
+    }));
+  }
+  const objectTypes = projectedObjectTypes;
+  const objectTypesById = new Map(objectTypes.map((objectType) => [objectType.id, objectType]));
+  const valueTypesById = input.selection.kind === "selected" ? collectVisibleValueTypes(input.ontology.getValueTypesById(), objectTypes) : snapshotAllValueTypes(input.ontology.getValueTypesById());
+  const release = (value, budgetValue = value) => {
+    input.assertOutputWithinLimit?.(budgetValue);
+    return value;
+  };
+  const cloneObjectType = (objectType) => structuredClone(objectType);
+  const cloneValueTypes = () => new Map([...valueTypesById].map(([valueTypeId, valueType]) => [
+    valueTypeId,
+    structuredClone(valueType)
+  ]));
+  return Object.freeze({
+    listObjectTypes: () => release(objectTypes.map(cloneObjectType)),
+    getObjectTypeById: (objectTypeId) => {
+      const objectType = objectTypesById.get(objectTypeId);
+      return release(objectType ? cloneObjectType(objectType) : null);
+    },
+    resolveObjectType: (objectTypeId) => {
+      const objectType = objectTypesById.get(objectTypeId);
+      return objectType ? release(cloneObjectType(objectType)) : unknownObjectType(objectTypeId);
+    },
+    getValueTypesById: () => {
+      const valueTypes = cloneValueTypes();
+      return release(valueTypes, [...valueTypes.entries()]);
+    },
+    getPrimaryPropertyId: (objectTypeId) => {
+      const objectType = objectTypesById.get(objectTypeId);
+      if (!objectType)
+        return unknownObjectType(objectTypeId);
+      const primary = objectType.properties.find((property) => property.primary);
+      if (!primary) {
+        throw new OntologyValidationError2(`[Sixb] Object type '${objectTypeId}' does not expose its primary property in this execution scope.`);
+      }
+      return release(primary.id);
+    },
+    listSubTypes: (objectTypeId) => {
+      const subTypes = visibleObjectTypeIds.has(objectTypeId) ? input.ontology.listSubTypes(objectTypeId).filter((subTypeId) => visibleObjectTypeIds.has(subTypeId)) : [];
+      return release(subTypes);
+    },
+    isValidLinkTarget: (expected, actual) => {
+      if (input.selection.kind === "all") {
+        return release(input.ontology.isValidLinkTarget(expected, actual));
+      }
+      if (!visibleObjectTypeIds.has(actual))
+        return release(false);
+      const expectedTypes = Array.isArray(expected) ? expected : [expected];
+      if (input.selection.kind === "selected") {
+        return release(expectedTypes.some((expectedType) => expectedType === "*" || expectedType === actual));
+      }
+      return release(expectedTypes.some((expectedType) => expectedType === "*" || visibleObjectTypeIds.has(expectedType) && input.ontology.isValidLinkTarget(expectedType, actual)));
+    }
+  });
+}
+function selectedObjectTypeIds(selection, allObjectTypes) {
+  switch (selection.kind) {
+    case "all":
+      return new Set(allObjectTypes.map((objectType) => objectType.id));
+    case "types":
+      return new Set(selection.objectTypeIds);
+    case "selected":
+      return new Set(selection.scope.objects.map((object) => object.objectTypeId));
+  }
+}
+function collectSelectedSchema(scope) {
+  const propertyIdsByObjectType = new Map;
+  for (const object of scope.objects) {
+    const properties = propertyIdsByObjectType.get(object.objectTypeId) ?? new Set;
+    for (const propertyId of object.propertyIds)
+      properties.add(propertyId);
+    propertyIdsByObjectType.set(object.objectTypeId, properties);
+  }
+  const linksBySourceType = new Map;
+  for (const step of scope.steps) {
+    const links = linksBySourceType.get(step.sourceObjectTypeId) ?? new Map;
+    const selected = links.get(step.linkId) ?? {
+      targetObjectTypeIds: new Set,
+      propertyIds: new Set
+    };
+    selected.targetObjectTypeIds.add(step.targetObjectTypeId);
+    for (const propertyId of step.propertyIds)
+      selected.propertyIds.add(propertyId);
+    links.set(step.linkId, selected);
+    linksBySourceType.set(step.sourceObjectTypeId, links);
+  }
+  return { propertyIdsByObjectType, linksBySourceType };
+}
+function allDeclaredLinks(objectType) {
+  return new Map(objectType.links.map((link) => [
+    link.id,
+    {
+      targetObjectTypeIds: new Set(typeof link.targetObjectTypeId === "string" ? [link.targetObjectTypeId] : link.targetObjectTypeId),
+      propertyIds: new Set(link.properties?.map((property) => property.id) ?? [])
+    }
+  ]));
+}
+function allVisibleLinks(ontology, objectType, visibleObjectTypeIds) {
+  const links = new Map;
+  for (const link of objectType.links) {
+    const targetObjectTypeIds = new Set([...visibleObjectTypeIds].filter((targetObjectTypeId) => ontology.isValidLinkTarget(link.targetObjectTypeId, targetObjectTypeId)));
+    if (targetObjectTypeIds.size === 0)
+      continue;
+    links.set(link.id, {
+      targetObjectTypeIds,
+      propertyIds: new Set(link.properties?.map((property) => property.id) ?? [])
+    });
+  }
+  return links;
+}
+function projectObjectType(input) {
+  const properties = input.objectType.properties.filter((property) => input.propertyIds.has(property.id)).map(snapshotProperty);
+  const visiblePropertyIds = new Set(properties.map((property) => property.id));
+  const links = input.objectType.links.flatMap((link) => {
+    const selected = input.links.get(link.id);
+    if (!selected)
+      return [];
+    if (input.targetMode === "original") {
+      return [snapshotLink(link, snapshotLinkTarget(link.targetObjectTypeId), selected.propertyIds)];
+    }
+    const targetObjectTypeIds = new Set([...selected.targetObjectTypeIds].filter((targetObjectTypeId) => input.visibleObjectTypeIds.has(targetObjectTypeId) && input.ontology.isValidLinkTarget(link.targetObjectTypeId, targetObjectTypeId)));
+    if (targetObjectTypeIds.size === 0)
+      return [];
+    const target = input.targetMode === "principal" ? principalLinkTargets(link, targetObjectTypeIds, input.visibleObjectTypeIds) : exactLinkTargets(targetObjectTypeIds);
+    return [snapshotLink(link, target, selected.propertyIds, { omitEmptyProperties: true })];
+  });
+  const projected = {
+    id: input.objectType.id,
+    name: input.objectType.name,
+    description: input.objectType.description,
+    quantityKind: input.objectType.quantityKind,
+    seeAlso: input.objectType.seeAlso ? [...input.objectType.seeAlso] : undefined,
+    extends: input.objectType.extends && input.visibleObjectTypeIds.has(input.objectType.extends) ? input.objectType.extends : undefined,
+    parents: projectOptionalIds(input.objectType.parents, input.visibleObjectTypeIds, input.targetMode === "original"),
+    implements: input.exposeContracts && input.objectType.implements ? [...input.objectType.implements] : undefined,
+    properties,
+    links,
+    search: projectSearch(input.objectType.search, visiblePropertyIds, {
+      preserveEmpty: input.targetMode !== "exact"
+    })
+  };
+  const withTokens = {
+    ...projected,
+    p: createPropertyTokenMap2(projected),
+    l: createLinkTokenMap2(projected)
+  };
+  return deepFreeze(withTokens);
+}
+function principalLinkTargets(link, allowedTargetObjectTypeIds, visibleObjectTypeIds) {
+  if (link.targetObjectTypeId === "*")
+    return exactLinkTargets(allowedTargetObjectTypeIds);
+  const declared = Array.isArray(link.targetObjectTypeId) ? link.targetObjectTypeId : [link.targetObjectTypeId];
+  if (declared.every((objectTypeId) => visibleObjectTypeIds.has(objectTypeId))) {
+    return snapshotLinkTarget(link.targetObjectTypeId);
+  }
+  return exactLinkTargets(allowedTargetObjectTypeIds);
+}
+function exactLinkTargets(targetObjectTypeIds) {
+  const targets = [...targetObjectTypeIds].sort();
+  return targets.length === 1 ? targets[0] : targets;
+}
+function projectOptionalIds(ids, visibleObjectTypeIds, preserveOriginal) {
+  if (!ids)
+    return;
+  if (preserveOriginal)
+    return [...ids];
+  const visible = ids.filter((id) => visibleObjectTypeIds.has(id));
+  return visible.length > 0 ? visible : undefined;
+}
+function snapshotLink(link, targetObjectTypeId, propertyIds, options = {}) {
+  const properties = link.properties?.filter((property) => propertyIds.has(property.id)).map(snapshotProperty);
+  return {
+    id: link.id,
+    name: link.name,
+    description: link.description,
+    targetObjectTypeId,
+    cardinality: link.cardinality,
+    properties: options.omitEmptyProperties && properties?.length === 0 ? undefined : properties
+  };
+}
+function snapshotLinkTarget(target) {
+  return typeof target === "string" ? target : [...target];
+}
+function snapshotProperty(property) {
+  return {
+    id: property.id,
+    name: property.name,
+    schema: snapshotSchema(property.schema),
+    description: property.description,
+    required: property.required,
+    nullable: property.nullable,
+    primary: property.primary,
+    unique: property.unique,
+    mode: property.mode,
+    semanticType: property.semanticType,
+    query: snapshotPropertyQuery(property.query)
+  };
+}
+function snapshotPropertyQuery(query) {
+  if (!query)
+    return;
+  return {
+    searchable: query.searchable,
+    filterable: query.filterable,
+    sortable: query.sortable,
+    text: query.text,
+    exact: query.exact,
+    facet: query.facet,
+    weight: query.weight
+  };
+}
+function projectSearch(search, visiblePropertyIds, options) {
+  if (!search)
+    return;
+  const title = search.title && visiblePropertyIds.has(search.title) ? search.title : undefined;
+  const selectedDefaultText = search.defaultText?.filter((propertyId) => visiblePropertyIds.has(propertyId));
+  const selectedExact = search.exact?.filter((propertyId) => visiblePropertyIds.has(propertyId));
+  const defaultText = options.preserveEmpty || selectedDefaultText?.length ? selectedDefaultText : undefined;
+  const exact = options.preserveEmpty || selectedExact?.length ? selectedExact : undefined;
+  const vectors = search.vectors === undefined ? undefined : snapshotVectorProfiles(Object.fromEntries(Object.entries(search.vectors).filter(([, profile]) => profile.source.every((id) => visiblePropertyIds.has(id)))));
+  const projected = {
+    ...vectors === undefined || Object.keys(vectors).length === 0 ? {} : { vectors },
+    ...title === undefined ? {} : { title },
+    ...defaultText === undefined ? {} : { defaultText },
+    ...exact === undefined ? {} : { exact }
+  };
+  return Object.keys(projected).length > 0 || options.preserveEmpty ? projected : undefined;
+}
+function snapshotAllValueTypes(registered) {
+  return new Map([...registered.values()].map((valueType) => {
+    const snapshot = snapshotValueType(valueType);
+    return [snapshot.id, snapshot];
+  }));
+}
+function collectVisibleValueTypes(registered, objectTypes) {
+  const referencedIds = new Set;
+  const pendingSchemas = [];
+  const visitedSchemas = new Set;
+  for (const objectType of objectTypes) {
+    for (const property of objectType.properties)
+      pendingSchemas.push(property.schema);
+    for (const link of objectType.links) {
+      for (const property of link.properties ?? [])
+        pendingSchemas.push(property.schema);
+    }
+  }
+  while (pendingSchemas.length > 0) {
+    const schema = pendingSchemas.pop();
+    if (typeof schema === "string" || visitedSchemas.has(schema))
+      continue;
+    visitedSchemas.add(schema);
+    if (schema.type === "valueTypeRef") {
+      if (!referencedIds.has(schema.valueTypeId)) {
+        referencedIds.add(schema.valueTypeId);
+        const valueType = registered.get(schema.valueTypeId);
+        if (valueType)
+          pendingSchemas.push(valueType.schema);
+      }
+      if (schema._resolved)
+        pendingSchemas.push(schema._resolved);
+    } else if (schema.type === "object") {
+      for (const field of Object.values(schema.properties))
+        pendingSchemas.push(field.schema);
+    } else if (schema.type === "array") {
+      pendingSchemas.push(schema.items);
+    } else if (schema.type === "map") {
+      pendingSchemas.push(schema.valueSchema);
+    }
+  }
+  return new Map([...referencedIds].map((valueTypeId) => registered.get(valueTypeId)).filter((valueType) => valueType !== undefined).map((valueType) => {
+    const snapshot = snapshotValueType(valueType);
+    return [snapshot.id, snapshot];
+  }));
+}
+function snapshotValueType(valueType) {
+  return deepFreeze({
+    id: valueType.id,
+    name: valueType.name,
+    description: valueType.description,
+    schema: snapshotSchema(valueType.schema),
+    semanticType: valueType.semanticType
+  });
+}
+function snapshotSchema(schema) {
+  return deepFreeze(structuredClone(schema));
+}
+function deepFreeze(value, seen = new Set) {
+  if (typeof value !== "object" || value === null || seen.has(value))
+    return value;
+  seen.add(value);
+  for (const key of Reflect.ownKeys(value)) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor && "value" in descriptor)
+      deepFreeze(descriptor.value, seen);
+  }
+  return Object.freeze(value);
+}
+function unknownObjectType(objectTypeId) {
+  throw new OntologyNotFoundError2(formatUnknownObjectTypeMessage(objectTypeId));
+}
+
+// src/execution/object-reader-ontology.ts
+class ObjectReaderOntology {
+  registry;
+  #security;
+  #view;
+  constructor(registry, security) {
+    this.registry = registry;
+    this.#security = security;
+    Object.freeze(this);
+  }
+  view() {
+    const authority = this.#security.authority;
+    this.#view ??= createAuthorizedOntologyView({
+      ontology: this.registry,
+      selection: selectionForAuthority(this.#security, this.registry),
+      ...authority.type === "delegated" ? {
+        assertOutputWithinLimit: (value) => assertObjectReadOutputWithinLimit2(value, authority.objectRead.limits)
+      } : {}
+    });
+    return this.#view;
+  }
+}
+function selectionForAuthority(security, ontology) {
+  const authority = security.authority;
+  switch (authority.type) {
+    case "unrestricted":
+      return { kind: "all" };
+    case "principal":
+      return {
+        kind: "types",
+        objectTypeIds: ontology.listObjectTypes().filter((objectType) => security.isObjectTypeGranted(objectType.id, undefined)).map((objectType) => objectType.id)
+      };
+    case "delegated":
+      return { kind: "selected", scope: authority.objectRead.scope };
+  }
+}
+
+// src/objects/query/selected-read-admission.ts
+var selectedStateBrand = Symbol("sixb.selected-object-query-admission-state");
+function createSelectedObjectQueryAdmission(scope) {
+  const selectionByKey = new Map;
+  const selectionsByType = new Map;
+  const propertiesBySelection = new Map;
+  for (const selection of scope.objects) {
+    const key = selectionKey(selection.nodeId, selection.objectTypeId);
+    selectionByKey.set(key, selection);
+    propertiesBySelection.set(key, new Set(selection.propertyIds));
+    const byType = selectionsByType.get(selection.objectTypeId) ?? [];
+    byType.push(selection);
+    selectionsByType.set(selection.objectTypeId, byType);
+  }
+  const outgoing = indexSteps(scope.steps, "outgoing", selectionByKey);
+  const incoming = indexSteps(scope.steps, "incoming", selectionByKey);
+  const emptyState = selectedState([]);
+  const admission = {
+    empty: () => emptyState,
+    source: (input) => {
+      const selections = input.result.objectTypeIds.flatMap((objectTypeId) => selectionsByType.get(objectTypeId) ?? []);
+      const state = selectedState(selections);
+      if (input.kind === "refs") {
+        const missingType = [...new Set(input.refs?.map((ref) => ref.objectTypeId) ?? [])].sort().find((objectTypeId) => !selectionsByType.has(objectTypeId));
+        if (missingType) {
+          return denied2(state, new AuthorizationError2(`view:object:${missingType}`, `[Sixb] Delegated query cannot reference object type '${missingType}' at '${input.path}': the selected object scope does not contain that type.`));
+        }
+      }
+      if (state.selections.length > 0)
+        return { state };
+      const objectTypeId = input.objectTypeId ?? input.result.objectTypeIds[0] ?? "unknown";
+      return denied2(state, new AuthorizationError2(`view:object:${objectTypeId}`, `[Sixb] Delegated query cannot start from object type '${objectTypeId}' at '${input.path}': the selected object scope does not contain that type.`));
+    },
+    property: (input) => propertyDenial(asSelectedState(input.state), input.propertyId, input.objectTypeId, input.use, input.path, propertiesBySelection),
+    edge: (input) => {
+      const state = asSelectedState(input.state);
+      const next = followEdge(state, input.linkId, input.direction, input.sourceObjectTypeId, outgoing, incoming, input.result.objectTypeIds);
+      if (next.selections.length > 0 || state.selections.length === 0)
+        return { state: next };
+      return denied2(next, edgeDenial(state, input.linkId, input.direction, input.sourceObjectTypeId, input.use, input.path));
+    },
+    set: ({ op, states }) => {
+      if (op === "subtract")
+        return asSelectedState(states[0] ?? emptyState);
+      return selectedState(states.flatMap((state) => asSelectedState(state).selections));
+    },
+    assertPropertySelected: (input) => {
+      const denial = propertyDenial(asSelectedState(input.state), input.propertyId, input.objectTypeId, input.use, input.path, propertiesBySelection);
+      if (denial)
+        throw denial;
+    },
+    assertIncidentEdgeSelected: (input) => {
+      if (input.linkId === undefined)
+        return;
+      const state = asSelectedState(input.state);
+      const directions = input.direction === "both" ? ["outgoing", "incoming"] : [input.direction];
+      const next = selectedState(directions.flatMap((direction) => followEdge(state, input.linkId, direction, undefined, outgoing, incoming).selections));
+      if (next.selections.length > 0 || state.selections.length === 0)
+        return;
+      throw edgeDenial(state, input.linkId, input.direction, undefined, "queryLinks", input.path);
+    }
+  };
+  return Object.freeze(admission);
+}
+function indexSteps(steps, direction, selectionByKey) {
+  const index = new Map;
+  for (const step of steps) {
+    const fromKey = direction === "outgoing" ? selectionKey(step.parentNodeId, step.sourceObjectTypeId) : selectionKey(step.nodeId, step.targetObjectTypeId);
+    const toKey = direction === "outgoing" ? selectionKey(step.nodeId, step.targetObjectTypeId) : selectionKey(step.parentNodeId, step.sourceObjectTypeId);
+    const target = selectionByKey.get(toKey);
+    if (!selectionByKey.has(fromKey) || !target) {
+      throw new Error("[Sixb] Compiled selected object scope contains an invalid query path step.");
+    }
+    const key = edgeKey(direction === "outgoing" ? step.parentNodeId : step.nodeId, direction === "outgoing" ? step.sourceObjectTypeId : step.targetObjectTypeId, step.linkId);
+    const targets = index.get(key) ?? [];
+    targets.push(target);
+    index.set(key, targets);
+  }
+  return index;
+}
+function followEdge(state, linkId, direction, sourceObjectTypeId, outgoing, incoming, resultObjectTypeIds) {
+  const index = direction === "outgoing" ? outgoing : incoming;
+  const resultTypes = resultObjectTypeIds ? new Set(resultObjectTypeIds) : undefined;
+  const selections = state.selections.flatMap((selection) => {
+    const candidates = index.get(edgeKey(selection.nodeId, selection.objectTypeId, linkId)) ?? [];
+    return candidates.filter((candidate) => (resultTypes === undefined || resultTypes.has(candidate.objectTypeId)) && (direction === "outgoing" || sourceObjectTypeId === undefined || candidate.objectTypeId === sourceObjectTypeId));
+  });
+  return selectedState(selections);
+}
+function propertyDenial(state, propertyId, objectTypeId, use, path, propertiesBySelection) {
+  const candidates = objectTypeId ? state.selections.filter((selection) => selection.objectTypeId === objectTypeId) : state.selections;
+  if (candidates.length === 0)
+    return;
+  const missing = candidates.find((selection) => !propertiesBySelection.get(selectionKey(selection.nodeId, selection.objectTypeId))?.has(propertyId));
+  if (!missing)
+    return;
+  const objectTypeIds = [...new Set(candidates.map((selection) => selection.objectTypeId))].sort();
+  return new AuthorizationError2(`view:object:${objectTypeIds.join(",")}:property:${propertyId}`, `[Sixb] Delegated query cannot use property '${propertyId}' for ${use} at '${path}': it is not selected on every matching read-scope path (missing on ${formatSelection(missing)}).`);
+}
+function edgeDenial(state, linkId, direction, sourceObjectTypeId, use, path) {
+  const source = sourceObjectTypeId ? `:${sourceObjectTypeId}` : "";
+  return new AuthorizationError2(`view:link:${direction}${source}:${linkId}`, `[Sixb] Delegated query cannot use ${direction} link '${linkId}' for ${use} from ${formatState(state)} at '${path}': that exact read-scope path is not selected.`);
+}
+function formatState(state) {
+  if (state.selections.length === 0)
+    return "an empty read-scope provenance";
+  return `read-scope provenance ${state.selections.map(formatSelection).join(", ")}`;
+}
+function formatSelection(selection) {
+  return `'${selection.objectTypeId}'@node ${selection.nodeId}`;
+}
+function selectedState(selections) {
+  const unique = new Map;
+  for (const selection of selections) {
+    unique.set(selectionKey(selection.nodeId, selection.objectTypeId), selection);
+  }
+  return Object.freeze({
+    [selectedStateBrand]: true,
+    selections: Object.freeze([...unique.values()].sort((left, right) => left.nodeId - right.nodeId || left.objectTypeId.localeCompare(right.objectTypeId)))
+  });
+}
+function asSelectedState(state) {
+  if (state[selectedStateBrand] !== true) {
+    throw new Error("[Sixb] Object query admission state belongs to another semantic admission.");
+  }
+  return state;
+}
+function denied2(state, denial) {
+  return { state, denial };
+}
+function selectionKey(nodeId, objectTypeId) {
+  return JSON.stringify([nodeId, objectTypeId]);
+}
+function edgeKey(nodeId, objectTypeId, linkId) {
+  return JSON.stringify([nodeId, objectTypeId, linkId]);
+}
+
+// src/execution/object-reader-clearance.ts
+class ObjectReaderClearance {
+  #ontology;
+  #static;
+  #clearances;
+  #applied;
+  #lastSnapshot;
+  #lastClearance;
+  constructor(input) {
+    this.#ontology = input.ontology;
+    this.#clearances = input.clearances;
+    this.#static = input.clearances && resolvePropertyClearance(input.ontology, input.clearances);
+    if (input.clearances && input.appliedMarkings?.affects(input.clearances)) {
+      this.#applied = input.appliedMarkings;
+    }
+    Object.freeze(this);
+  }
+  current() {
+    const applied = this.#applied;
+    const clearances = this.#clearances;
+    if (!applied || !clearances)
+      return this.#static;
+    return applied.current().then((snapshot) => {
+      if (snapshot !== this.#lastSnapshot) {
+        this.#lastClearance = resolvePropertyClearance(this.#ontology, clearances, snapshot);
+        this.#lastSnapshot = snapshot;
+      }
+      return this.#lastClearance;
+    });
+  }
+  forEvent(sources) {
+    const applied = this.#applied;
+    const clearances = this.#clearances;
+    if (!applied || !clearances)
+      return this.#static;
+    return applied.current().then((snapshot) => sources.origin ? applied.forEventOrigin(snapshot, sources.origin) : snapshot).then((snapshot) => sources.earlier ? applied.forEarlierValues(snapshot, sources.objectTypeId) : snapshot).then((snapshot) => resolvePropertyClearance(this.#ontology, clearances, snapshot));
+  }
+}
+
+// src/execution/object-reader-security.ts
+class ObjectReaderSecurity {
+  authorization;
+  authority;
+  runtime;
+  delegation;
+  clearance;
+  requestingUser;
+  conditionalScope;
+  #conditionProperties;
+  constructor(input) {
+    const authority = input.authority;
+    this.authorization = input.authorization;
+    this.authority = authority;
+    if (input.requestedBy?.type === "user") {
+      this.requestingUser = Object.freeze({ type: "user", id: input.requestedBy.id });
+    }
+    this.runtime = Object.freeze({
+      projectId: input.projectId,
+      runtimeAuthorization: input.authorization,
+      ...authority.type === "principal" ? { authorization: authority.context } : {}
+    });
+    if (authority.type === "delegated") {
+      const scope = authority.objectRead.scope;
+      this.delegation = Object.freeze({
+        objectTypeIds: new Set(scope.objects.map((object) => object.objectTypeId)),
+        linkDefinitions: new Set(scope.steps.map(delegatedLinkDefinitionKey)),
+        queryAdmission: createSelectedObjectQueryAdmission(scope)
+      });
+    }
+    const conditions = authority.type === "principal" ? authority.context.viewConditions : undefined;
+    this.#conditionProperties = new Map([...conditions ?? []].map(([objectTypeId, predicates]) => [
+      objectTypeId,
+      [...new Set(predicates.flatMap(propertiesReadBy))]
+    ]));
+    if (authority.type === "principal" && conditions && conditions.size > 0) {
+      const principal = authority.context.principal;
+      const grantee = principal.type === "user" ? { type: "user", id: principal.id } : undefined;
+      this.conditionalScope = compileConditionalObjectReadScope2({
+        kind: "conditional",
+        conditions: [...conditions].map(([objectTypeId, predicates]) => ({
+          objectTypeId,
+          predicate: bindCurrentUserPredicate(anyOf(predicates), grantee)
+        }))
+      });
+    }
+    this.clearance = new ObjectReaderClearance({
+      ontology: input.ontology,
+      clearances: clearancesForAuthority(authority),
+      ...input.appliedMarkings === undefined ? {} : { appliedMarkings: input.appliedMarkings }
+    });
+    Object.freeze(this);
+  }
+  assertObjectTypesViewable(objectTypeIds, clearance) {
+    if (this.delegation) {
+      for (const objectTypeId of new Set(objectTypeIds)) {
+        if (this.delegation.objectTypeIds.has(objectTypeId))
+          continue;
+        throw new AuthorizationError2(`delegated:object.view:${objectTypeId}`, `[Sixb] Delegated authorization does not select object type '${objectTypeId}'.`);
+      }
+    } else {
+      this.assertObjectTypesGranted(objectTypeIds, clearance);
+    }
+    if (!clearance)
+      return;
+    for (const objectTypeId of new Set(objectTypeIds)) {
+      const unreadable = clearance.unreadableType(objectTypeId);
+      if (unreadable)
+        throw unreadableError(unreadable);
+    }
+  }
+  assertObjectTypesGranted(objectTypeIds, clearance) {
+    for (const objectTypeId of new Set(objectTypeIds)) {
+      if (!this.#conditionProperties.has(objectTypeId)) {
+        assertAuthorized2(this.runtime, { kind: "object.view", objectTypeId });
+        continue;
+      }
+      assertRuntimeAuthorizationBound2(this.runtime);
+      const unreadable = this.#unreadableCondition(objectTypeId, clearance);
+      if (unreadable)
+        throw unreadableError(unreadable);
+    }
+  }
+  viewsThroughCondition(objectTypeId) {
+    return this.#conditionProperties.has(objectTypeId);
+  }
+  isObjectTypeGranted(objectTypeId, clearance) {
+    if (this.delegation)
+      return this.delegation.objectTypeIds.has(objectTypeId);
+    if (this.#conditionProperties.has(objectTypeId)) {
+      return this.#unreadableCondition(objectTypeId, clearance) === undefined;
+    }
+    return isAllowed2(this.runtime.authorization, { kind: "object.view", objectTypeId });
+  }
+  isObjectTypeViewable(objectTypeId, clearance) {
+    if (clearance?.unreadableType(objectTypeId))
+      return false;
+    return this.isObjectTypeGranted(objectTypeId, clearance);
+  }
+  isLinkViewable(link, clearance) {
+    if (!this.isObjectTypeViewable(link.sourceTypeId, clearance) || !this.isObjectTypeViewable(link.targetTypeId, clearance) || clearance?.unreadableLink(link.sourceTypeId, link.linkId)) {
+      return false;
+    }
+    return this.delegation?.linkDefinitions.has(delegatedLinkDefinitionKey(link)) ?? true;
+  }
+  #unreadableCondition(objectTypeId, clearance) {
+    const propertyIds = this.#conditionProperties.get(objectTypeId);
+    return propertyIds && unreadableConditionOf(objectTypeId, propertyIds, clearance);
+  }
+}
+function unreadableConditionOf(objectTypeId, propertyIds, clearance) {
+  for (const propertyId of propertyIds) {
+    const marking = clearance?.missingMarking(objectTypeId, propertyId);
+    if (marking === undefined)
+      continue;
+    return {
+      marking,
+      message: `[Sixb] Cannot read '${objectTypeId}': the condition it is viewed through reads '${objectTypeId}.${propertyId}', which requires clearance for marking '${marking}'.`
+    };
+  }
+  return;
+}
+function propertiesReadBy(predicate) {
+  switch (predicate.op) {
+    case "and":
+    case "or":
+      return predicate.items.flatMap(propertiesReadBy);
+    case "not":
+      return propertiesReadBy(predicate.item);
+    case "constant":
+      return [];
+    default:
+      return [predicate.propertyId];
+  }
+}
+function anyOf(predicates) {
+  return predicates.length === 1 ? predicates[0] : { op: "or", items: predicates };
+}
+function clearancesForAuthority(authority) {
+  switch (authority.type) {
+    case "unrestricted":
+      return;
+    case "principal":
+      return authority.context.clearances ?? new Set;
+    case "delegated":
+      return new Set;
+  }
+}
+function delegatedLinkDefinitionKey(input) {
+  return "sourceObjectTypeId" in input ? JSON.stringify([input.sourceObjectTypeId, input.linkId, input.targetObjectTypeId]) : JSON.stringify([input.sourceTypeId, input.linkId, input.targetTypeId]);
+}
+
+// src/execution/object-reader-users.ts
+var LOOKUP_BATCH_SIZE = 500;
+async function attachUserProfiles(input) {
+  const slots = [];
+  collectSlots(input.rows, input.plan, input.ontology, slots);
+  if (!input.canViewUsers)
+    return;
+  const records = await readUsers(input, slots);
+  for (const slot of slots) {
+    slot.users[slot.propertyId] = expandedValue(slot, records);
+  }
+}
+function expandedValue(slot, records) {
+  const profiles = slot.ids.flatMap((id) => {
+    const record = records.get(id);
+    return record ? [toUserProfile(record)] : [];
+  });
+  return slot.many ? profiles : profiles[0] ?? null;
+}
+function collectSlots(rows, plan, ontology, into) {
+  for (const row of rows) {
+    const properties = ontology.getObjectTypeById(row.objectTypeId)?.properties ?? [];
+    for (const propertyId of plan.users) {
+      const property = properties.find((candidate) => candidate.id === propertyId);
+      if (!property || !isUserRefPropertySchema(property.schema))
+        continue;
+      row.users ??= {};
+      if (row.redactions?.[propertyId])
+        continue;
+      into.push({
+        users: row.users,
+        propertyId,
+        many: property.schema !== "userRef",
+        ids: userIdsOf(row.properties[propertyId])
+      });
+    }
+    for (const link of plan.links) {
+      collectSlots(linkedRows(row.links?.[link.linkId]), link.plan, ontology, into);
+    }
+  }
+}
+async function readUsers(input, slots) {
+  const records = new Map;
+  const ids = [...new Set(slots.flatMap((slot) => slot.ids))];
+  if (!input.users || ids.length === 0)
+    return records;
+  for (let start = 0;start < ids.length; start += LOOKUP_BATCH_SIZE) {
+    const batch = ids.slice(start, start + LOOKUP_BATCH_SIZE);
+    for (const record of await input.users.getByIds({ projectId: input.projectId, ids: batch })) {
+      records.set(record.id, record);
+    }
+  }
+  return records;
+}
+function userIdsOf(value) {
+  if (isUserRef(value))
+    return [value.id];
+  if (!Array.isArray(value))
+    return [];
+  return value.filter(isUserRef).map((ref) => ref.id);
+}
+function linkedRows(value) {
+  if (value === undefined || value === null)
+    return [];
+  if (Array.isArray(value))
+    return value;
+  return [value];
+}
+
+// src/execution/unique-lookup.ts
+function uniqueLookupKey(ontology, input) {
+  return uniqueLookupKeyOf(ontology.resolveObjectType(input.objectTypeId), input.propertyId, input.value, ontology.getValueTypesById());
+}
+function uniqueLookupKeyOf(objectType, propertyId, value, valueTypesById) {
+  const path = `${objectType.id}.${propertyId}`;
+  const property = objectType.properties.find((candidate) => candidate.id === propertyId);
+  const kind = property?.unique ? uniqueValueKind(property.schema, valueTypesById) : undefined;
+  if (!property || !kind) {
+    throw new OntologyValidationError2(`[Sixb] Cannot look up '${path}' by value: getBy needs a property declared with unique: true.`);
+  }
+  if (value === null || value === undefined) {
+    throw new OntologyValidationError2(`[Sixb] Cannot look up '${path}' by ${String(value)}: no object holds a null or missing value.`);
+  }
+  validateSchemaValue2(property.schema, value, path, valueTypesById);
+  const key = uniqueValueKey(kind, normalizeSchemaValue2(property.schema, value, path, valueTypesById));
+  if (key === null) {
+    throw new OntologyValidationError2(`[Sixb] Cannot look up '${path}' by this value.`);
+  }
+  return key;
+}
+
+// src/execution/authorized-object-reader.ts
+var readerConstructionKey = Object.freeze({});
+
+class AuthorizedObjectReaderImpl {
+  #ontology;
+  #security;
+  #models;
+  #storage;
+  #users;
+  constructor(key, input) {
+    if (key !== readerConstructionKey) {
+      throw new Error("[Sixb] AuthorizedObjectReader can only be created by Core.");
+    }
+    this.#ontology = input.ontology;
+    this.#security = input.security;
+    this.#models = input.models;
+    this.#storage = input.storage;
+    this.#users = input.users;
+  }
+  static assertBound(reader, scope) {
+    const capturedScope = captureExecutionScope(scope);
+    resolveExecutionScopeAuthorization(reader.#security.runtime.projectId, capturedScope);
+    if (capturedScope.authorization !== reader.#security.authorization) {
+      throw new Error("[Sixb] AuthorizedObjectReader is not bound to this exact execution authority.");
+    }
+  }
+  static async clearance(reader) {
+    return reader.#security.clearance.current();
+  }
+  static eventClearance(reader, sources) {
+    return reader.#security.clearance.forEvent(sources);
+  }
+  static viewConditions(reader) {
+    const security = reader.#security;
+    const conditions = security.conditionalScope?.conditions ?? [];
+    return new Map(conditions.map(({ objectTypeId, predicate }) => [
+      objectTypeId,
+      {
+        predicate,
+        hiddenBy: (clearance) => !security.isObjectTypeViewable(objectTypeId, clearance)
+      }
+    ]));
+  }
+  static ontologyView(reader) {
+    return reader.#ontology.view();
+  }
+  get projectId() {
+    return this.#security.runtime.projectId;
+  }
+  async getByPrimaryId(input) {
+    const request = snapshotReadValue({
+      objectTypeId: input.objectTypeId,
+      primaryId: input.primaryId
+    });
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance);
+    const row = await this.#storage.getByPrimaryId({
+      ...request,
+      projectId: this.#security.runtime.projectId
+    });
+    return this.#detachRows(row && this.#omitHidden(row, clearance), (detached) => [detached], clearance);
+  }
+  async getByUniqueValue(input) {
+    const request = snapshotReadValue({
+      objectTypeId: input.objectTypeId,
+      propertyId: input.propertyId,
+      value: input.value
+    });
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance);
+    const valueKey = uniqueLookupKey(this.#ontology.registry, request);
+    const marking = clearance?.missingMarking(request.objectTypeId, request.propertyId);
+    if (marking !== undefined) {
+      throw new AuthorizationError2(`clearance:marking:${marking}`, `[Sixb] Cannot look up '${request.objectTypeId}.${request.propertyId}' by value: it requires clearance for marking '${marking}'.`);
+    }
+    const row = await this.#storage.getByUniqueValue({
+      objectTypeId: request.objectTypeId,
+      propertyId: request.propertyId,
+      valueKey,
+      projectId: this.#security.runtime.projectId
+    });
+    return this.#detachRows(row && this.#omitHidden(row, clearance), (detached) => [detached], clearance);
+  }
+  async getByPrimaryIdBatch(input) {
+    const request = snapshotReadValue({
+      items: input.items.map((item) => ({
+        objectTypeId: item.objectTypeId,
+        primaryId: item.primaryId
+      }))
+    });
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable(request.items.map((item) => item.objectTypeId), clearance);
+    const rows = await this.#storage.getByPrimaryIdBatch({
+      ...request,
+      projectId: this.#security.runtime.projectId
+    });
+    return this.#detachRows(new Map([...rows].map(([key, row]) => [key, this.#omitHidden(row, clearance)])), (detached) => detached.values(), clearance);
+  }
+  async canReadObjectProperty(input) {
+    const request = snapshotReadValue({
+      objectTypeId: input.objectTypeId,
+      primaryId: input.primaryId,
+      propertyId: input.propertyId
+    });
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance);
+    if (hidesProperty(request, clearance))
+      return false;
+    const [selected] = await this.#selectsObjectProperties([request]);
+    return selected ?? false;
+  }
+  async canReadObjectPropertiesBatch(input) {
+    const request = snapshotReadValue({
+      items: input.items.map((item) => ({
+        objectTypeId: item.objectTypeId,
+        primaryId: item.primaryId,
+        propertyId: item.propertyId
+      }))
+    });
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable(request.items.map((item) => item.objectTypeId), clearance);
+    const selected = await this.#selectsObjectProperties(request.items);
+    return request.items.map((item, index) => !hidesProperty(item, clearance) && selected[index] === true);
+  }
+  async list(input) {
+    const request = snapshotReadValue({
+      objectTypeId: typeof input.objectTypeId === "string" ? input.objectTypeId : input.objectTypeId === undefined ? undefined : [...input.objectTypeId],
+      primaryIdPrefix: input.primaryIdPrefix,
+      primaryIdSuffix: input.primaryIdSuffix,
+      updatedAfter: input.updatedAfter,
+      updatedBefore: input.updatedBefore,
+      createdAfter: input.createdAfter,
+      createdBefore: input.createdBefore,
+      limit: input.limit,
+      offset: input.offset,
+      orderBy: input.orderBy,
+      order: input.order
+    });
+    const clearance = await this.#security.clearance.current();
+    const objectTypeId = this.#resolveListObjectTypes(request.objectTypeId, clearance);
+    if (Array.isArray(objectTypeId) && objectTypeId.length === 0) {
+      return { objects: [], hasMore: false, total: 0 };
+    }
+    const page = await this.#storage.list({
+      ...request,
+      ...objectTypeId === undefined ? {} : { objectTypeId },
+      projectId: this.#security.runtime.projectId
+    });
+    return this.#detachRows({ ...page, objects: page.objects.map((row) => this.#omitHidden(row, clearance)) }, (detached) => detached.objects, clearance);
+  }
+  async listLinks(input) {
+    const request = snapshotReadValue({
+      objectTypeId: input.objectTypeId,
+      objectId: input.objectId,
+      linkId: input.linkId,
+      direction: input.direction
+    });
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance);
+    const links = detachReadResult(await this.#storage.listLinks({
+      ...request,
+      projectId: this.#security.runtime.projectId
+    }));
+    return links.filter((link) => this.#security.isLinkViewable(link, clearance));
+  }
+  async listLinksBatch(input) {
+    const request = snapshotReadValue({
+      direction: input.direction,
+      items: input.items.map((item) => ({
+        objectTypeId: item.objectTypeId,
+        objectId: item.objectId,
+        linkId: item.linkId
+      }))
+    });
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable(request.items.map((item) => item.objectTypeId), clearance);
+    const pages = detachReadResult(await this.#storage.listLinksBatch({
+      ...request,
+      projectId: this.#security.runtime.projectId
+    }));
+    const filtered = new Map;
+    for (const [key, links] of pages) {
+      filtered.set(key, links.filter((link) => this.#security.isLinkViewable(link, clearance)));
+    }
+    return filtered;
+  }
+  async executeQuery(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const includeTotal = snapshotReadValue(input.includeTotal);
+    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query;
+    const clearance = await this.#security.clearance.current();
+    const result = await executeObjectQuery2({
+      query: executionQuery,
+      ...includeTotal === undefined ? {} : { includeTotal },
+      projectId: this.#security.runtime.projectId,
+      signal: input.signal
+    }, this.#queryExecutorOptions(clearance));
+    const detached = this.#detachRows({ ...result, objects: result.objects.map((row) => this.#omitHidden(row, clearance)) }, (detached) => detached.objects, clearance);
+    await this.#attachUsers(detached.objects, query);
+    return detached;
+  }
+  async queryLinks(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const request = snapshotReadValue({
+      direction: input.direction,
+      linkId: input.linkId,
+      includeObjects: input.includeObjects,
+      pageSize: input.pageSize,
+      pageToken: input.pageToken
+    });
+    let executionQuery = query;
+    const admission = this.#security.delegation?.queryAdmission;
+    if (admission) {
+      const preflight = preflightObjectQueryLinks({ query, ...request, projectId: this.#security.runtime.projectId }, { ontology: this.#ontology.registry });
+      const admitted = validateObjectQueryWithAdmission(preflight.validated.query, { ontology: this.#ontology.registry, normalize: false }, admission);
+      admission.assertIncidentEdgeSelected({
+        state: admitted.admissionState,
+        ...preflight.linkId === undefined ? {} : { linkId: preflight.linkId },
+        direction: preflight.direction,
+        path: "$.linkId"
+      });
+      executionQuery = admitted.query;
+    }
+    const clearance = await this.#security.clearance.current();
+    if (clearance) {
+      assertLinkQueryReadable({
+        ontology: this.#ontology.registry,
+        clearance,
+        query,
+        request: { ...request, projectId: this.#security.runtime.projectId },
+        viewableByGrants: (objectTypeId) => this.#security.isObjectTypeViewable(objectTypeId, undefined)
+      });
+    }
+    const result = detachReadResult(await executeObjectQueryLinks2({ query: executionQuery, ...request, projectId: this.#security.runtime.projectId }, this.#queryExecutorOptions(clearance)));
+    if (result.objects.some((row) => !this.#security.isObjectTypeViewable(row.objectTypeId, clearance)) || result.links.some((link) => !this.#security.isLinkViewable(link, clearance))) {
+      throw new Error("[Sixb] Object storage returned a link page outside its authorized scope.");
+    }
+    return {
+      ...result,
+      objects: result.objects.map((row) => clearance ? redactObjectRow(row, clearance) : row)
+    };
+  }
+  async count(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query;
+    const clearance = await this.#security.clearance.current();
+    return detachReadResult(await countObjects2({ query: executionQuery, projectId: this.#security.runtime.projectId }, this.#queryExecutorOptions(clearance)));
+  }
+  async exists(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query;
+    const clearance = await this.#security.clearance.current();
+    return detachReadResult(await existsObjects2({ query: executionQuery, projectId: this.#security.runtime.projectId }, this.#queryExecutorOptions(clearance)));
+  }
+  async facet(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const facets = snapshotFacetRequests(input.facets);
+    let executionQuery = query;
+    let executionFacets = facets;
+    const admission = this.#security.delegation?.queryAdmission;
+    if (admission) {
+      const validated = validateObjectQuery2(query, { ontology: this.#ontology.registry });
+      const normalizedFacets = validateObjectFacetRequests(facets, validated.result.objectTypeIds, {
+        ontology: this.#ontology.registry
+      });
+      const admitted = validateObjectQueryWithAdmission(validated.query, { ontology: this.#ontology.registry, normalize: false }, admission);
+      normalizedFacets.forEach((facet, index) => {
+        admission.assertPropertySelected({
+          state: admitted.admissionState,
+          propertyId: facet.propertyId,
+          use: "facet",
+          path: `$.facets[${index}].propertyId`
+        });
+      });
+      executionQuery = admitted.query;
+      executionFacets = normalizedFacets;
+    }
+    const clearance = await this.#security.clearance.current();
+    return detachReadResult(await facetObjects2({
+      query: executionQuery,
+      facets: executionFacets,
+      projectId: this.#security.runtime.projectId
+    }, this.#queryExecutorOptions(clearance)));
+  }
+  async writtenRowRedactor(objectTypeId) {
+    const clearance = await this.#security.clearance.current();
+    assertTargetsReadable(clearance, { objectTypeIds: [objectTypeId] });
+    return (row) => clearance ? redactObjectRow(row, clearance) : row;
+  }
+  async uniqueValueWriteCheck(objectTypeId) {
+    const clearance = await this.#security.clearance.current();
+    const marked = this.#ontology.registry.listUniqueProperties(objectTypeId).flatMap((property) => {
+      const marking = clearance?.missingMarking(objectTypeId, property.propertyId);
+      return marking === undefined ? [] : [{ propertyId: property.propertyId, marking }];
+    });
+    return (properties) => {
+      for (const { propertyId, marking } of marked) {
+        if (properties[propertyId] === undefined || properties[propertyId] === null)
+          continue;
+        throw new AuthorizationError2(`clearance:marking:${marking}`, `[Sixb] Cannot write a value to '${objectTypeId}.${propertyId}': it is unique and requires clearance for marking '${marking}'.`);
+      }
+    };
+  }
+  async assertReadable(targets) {
+    assertTargetsReadable(await this.#security.clearance.current(), targets);
+  }
+  viewsThroughCondition(objectTypeId) {
+    return this.#security.viewsThroughCondition(objectTypeId);
+  }
+  async assertViewable(objectTypeIds) {
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable(objectTypeIds, clearance);
+  }
+  assertVisibleOutputWithinLimit(value) {
+    if (this.#security.authority.type !== "delegated")
+      return;
+    assertObjectReadOutputWithinLimit2(value, this.#security.authority.objectRead.limits);
+  }
+  admitTelemetryHistoryRead(input) {
+    return admitTelemetryHistoryReadWorkload(input, this.#security.authority.type === "delegated");
+  }
+  #queryExecutorOptions(clearance) {
+    const admission = this.#executorAdmission(clearance);
+    if (this.#security.authority.type === "delegated") {
+      return {
+        ontology: this.#ontology.registry,
+        storage: this.#storage,
+        embeddingModels: this.#models.embedding,
+        rerankingModels: this.#models.reranking,
+        ...admission === undefined ? {} : { admission },
+        requestingUser: this.#security.requestingUser
+      };
+    }
+    return {
+      ontology: this.#ontology.registry,
+      embeddingModels: this.#models.embedding,
+      rerankingModels: this.#models.reranking,
+      storage: this.#storage,
+      ...this.#queryAuthorization(clearance),
+      ...admission === undefined ? {} : { admission },
+      requestingUser: this.#security.requestingUser
+    };
+  }
+  #queryAuthorization(clearance) {
+    const runtimeAuthorization = this.#security.runtime.runtimeAuthorization;
+    if (this.#security.authority.type !== "principal")
+      return { runtimeAuthorization };
+    const security = this.#security;
+    return {
+      runtimeAuthorization,
+      readableObjectTypes: Object.freeze({
+        assert: (objectTypeIds) => security.assertObjectTypesGranted(objectTypeIds, clearance),
+        has: (objectTypeId) => security.isObjectTypeGranted(objectTypeId, clearance)
+      })
+    };
+  }
+  #executorAdmission(clearance) {
+    const admission = clearance && createClearanceQueryAdmission(clearance);
+    const selected = this.#security.delegation?.queryAdmission;
+    if (selected && admission)
+      return composeObjectQueryAdmissions(selected, admission);
+    return selected ?? admission;
+  }
+  async#attachUsers(rows, query) {
+    const plan = userExpansionPlan(normalizeObjectQuery2(query));
+    if (!plan)
+      return;
+    await attachUserProfiles({
+      rows,
+      plan,
+      ontology: this.#ontology.registry,
+      projectId: this.#security.runtime.projectId,
+      canViewUsers: isRuntimeAllowed2(this.#security.runtime, { kind: "users.view" }),
+      users: this.#users
+    });
+  }
+  async#selectsObjectProperties(items) {
+    const readsByObject = (item) => this.#security.authority.type === "delegated" || this.#security.viewsThroughCondition(item.objectTypeId);
+    const checked = items.filter(readsByObject);
+    const selected = checked.length === 0 ? [] : await this.#storage.selectsObjectProperties({
+      projectId: this.#security.runtime.projectId,
+      items: checked
+    });
+    let next = 0;
+    return items.map((item) => !readsByObject(item) || selected[next++] === true);
+  }
+  #omitHidden(row, clearance) {
+    return clearance ? omitHiddenProperties(row, clearance) : row;
+  }
+  #detachRows(result, rows, clearance) {
+    const detached = detachReadResult(result);
+    if (clearance) {
+      for (const row of rows(detached))
+        if (row)
+          attachRedactions(row, clearance);
+    }
+    return detached;
+  }
+  #admitDelegatedQuery(query) {
+    const admission = this.#security.delegation?.queryAdmission;
+    if (!admission)
+      return;
+    return validateObjectQueryWithAdmission(query, { ontology: this.#ontology.registry }, admission);
+  }
+  #resolveListObjectTypes(requested, clearance) {
+    if (requested !== undefined) {
+      const objectTypeIds = typeof requested === "string" ? [requested] : [...new Set(requested)];
+      for (const objectTypeId of objectTypeIds) {
+        this.#ontology.registry.resolveObjectType(objectTypeId);
+      }
+      this.#security.assertObjectTypesViewable(objectTypeIds, clearance);
+      return typeof requested === "string" ? requested : objectTypeIds;
+    }
+    if (this.#security.authority.type === "unrestricted")
+      return;
+    return this.#ontology.registry.listObjectTypes().map((objectType) => objectType.id).filter((objectTypeId) => this.#security.isObjectTypeViewable(objectTypeId, clearance));
+  }
+}
+Object.freeze(AuthorizedObjectReaderImpl.prototype);
+Object.freeze(AuthorizedObjectReaderImpl);
+function createAuthorizedObjectReader(input) {
+  const scope = captureExecutionScope(input.scope);
+  const projectId = scope.execution.projectId;
+  const authority = resolveExecutionScopeAuthorization(projectId, scope);
+  const security = new ObjectReaderSecurity({
+    authorization: scope.authorization,
+    authority,
+    projectId,
+    ontology: input.ontology,
+    ...input.appliedMarkings === undefined ? {} : { appliedMarkings: input.appliedMarkings },
+    requestedBy: scope.execution.requestedBy
+  });
+  const storage = objectStorageForAuthority(security, input.objectStorage);
+  const reader = new AuthorizedObjectReaderImpl(readerConstructionKey, {
+    ontology: new ObjectReaderOntology(input.ontology, security),
+    security,
+    models: Object.freeze({
+      ...input.embeddingModels === undefined ? {} : { embedding: input.embeddingModels },
+      ...input.rerankingModels === undefined ? {} : { reranking: input.rerankingModels }
+    }),
+    storage,
+    ...input.users === undefined ? {} : { users: input.users }
+  });
+  Object.freeze(reader);
+  return reader;
+}
+function assertAuthorizedObjectReaderBinding(input) {
+  AuthorizedObjectReaderImpl.assertBound(input.reader, input.scope);
+}
+function getAuthorizedOntologyView(reader) {
+  return AuthorizedObjectReaderImpl.ontologyView(reader);
+}
+function readerClearance(reader) {
+  return AuthorizedObjectReaderImpl.clearance(reader);
+}
+function readerEventClearance(reader, sources) {
+  return AuthorizedObjectReaderImpl.eventClearance(reader, sources);
+}
+function readerViewConditions(reader) {
+  return AuthorizedObjectReaderImpl.viewConditions(reader);
+}
+function assertTargetsReadable(clearance, targets) {
+  if (!clearance)
+    return;
+  for (const objectTypeId of targets.objectTypeIds) {
+    const unreadable = clearance.unreadableType(objectTypeId);
+    if (unreadable)
+      throw unreadableError(unreadable);
+  }
+  for (const link of targets.links ?? []) {
+    const unreadable = clearance.unreadableLink(link.objectTypeId, link.linkId);
+    if (unreadable)
+      throw unreadableError(unreadable);
+  }
+}
+function hidesProperty(item, clearance) {
+  return clearance?.missingMarking(item.objectTypeId, item.propertyId) !== undefined;
+}
+function objectStorageForAuthority(security, objectStorage) {
+  const authority = security.authority;
+  switch (authority.type) {
+    case "principal":
+      return security.conditionalScope ? objectStorage.createConditionalReadScope({
+        projectId: authority.projectId,
+        scope: security.conditionalScope
+      }) : objectStorage;
+    case "unrestricted":
+      return objectStorage;
+    case "delegated":
+      return objectStorage.createSelectedReadScope({
+        projectId: authority.projectId,
+        scope: authority.objectRead.scope,
+        limits: authority.objectRead.limits
+      });
+    default:
+      return assertNever(authority, `[Sixb] Unsupported object reader authority '${String(authority.type)}'.`);
+  }
+}
+function detachReadResult(value) {
+  return structuredClone(value);
+}
+function snapshotReadValue(value) {
+  return structuredClone(value);
+}
+function snapshotFacetRequests(facets) {
+  if (!Array.isArray(facets)) {
+    throw new ObjectQueryValidationError2([
+      {
+        path: "$.facets",
+        code: "invalid_facets",
+        message: "facets must be an array"
+      }
+    ]);
+  }
+  const length = facets.length;
+  if (!Number.isSafeInteger(length) || length > MAX_OBJECT_READ_FACETS2) {
+    throw new ObjectQueryValidationError2([
+      {
+        path: "$.facets",
+        code: "too_many_facets",
+        message: `facets must include at most ${MAX_OBJECT_READ_FACETS2} facet requests`
+      }
+    ]);
+  }
+  const snapshot = [];
+  for (let index = 0;index < length; index += 1) {
+    const facet = facets[index];
+    snapshot.push({ propertyId: facet.propertyId, limit: facet.limit });
+  }
+  return snapshot;
+}
+function snapshotAuthoredQuery(query) {
+  try {
+    const snapshot = structuredClone(query);
+    const pending = [snapshot];
+    const seen = new Set;
+    for (const node of pending) {
+      if (seen.has(node))
+        continue;
+      seen.add(node);
+      if (node.kind === "vector" && (typeof node.vector !== "string" || typeof node.profile !== "string" || ("propertyId" in node))) {
+        throw new ObjectQueryValidationError2([
+          {
+            path: "$",
+            code: "invalid_vector_search_input",
+            message: "Vector search requires a named profile and search text"
+          }
+        ]);
+      }
+      if ("input" in node)
+        pending.push(node.input);
+      if (node.kind === "set")
+        pending.push(...node.inputs);
+    }
+    return snapshot;
+  } catch (error) {
+    if (error instanceof ObjectQueryValidationError2)
+      throw error;
+    throw new ObjectQueryValidationError2([
+      {
+        path: "$",
+        code: "query_not_cloneable",
+        message: "Object query must contain only structured-cloneable data"
+      }
+    ]);
+  }
+}
+
+export { redactDomainEvent, uniqueLookupKeyOf, createAuthorizedObjectReader, assertAuthorizedObjectReaderBinding, getAuthorizedOntologyView, readerClearance, readerEventClearance, readerViewConditions };
+
+//# debugId=2DBF13BEAC1BA51864756E2164756E21