@sixb/core 0.1.21 → 0.1.22

package/dist/{chunk-6rqgmkde.js → chunk-7z5p905k.js}

@@ -2,33 +2,43 @@
 import {
   MAX_OBJECT_READ_FACETS2,
   assertObjectReadOutputWithinLimit2,
-  getAuthorizationRef,
   captureExecutionScope,
   resolveExecutionScopeAuthorization,
   AuthorizationError2,
   isAllowed2,
   assertAuthorized2,
-  canViewActionRun2,
-  canViewWorkflowRun2
-} from "./chunk-6vb4st8k.js";
+  isRuntimeAllowed2,
+  assertRuntimeAuthorizationBound2
+} from "./chunk-yc9ners4.js";
 import {
-  unreadableError,
-  resolvePropertyClearance
-} from "./chunk-9j4jw7as.js";
+  isUserRef,
+  isUserRefPropertySchema
+} from "./chunk-4y26vs3v.js";
 import {
-  objectBatchKey2
-} from "./chunk-918wwnaa.js";
+  compileConditionalObjectReadScope2
+} from "./chunk-rap5w0x0.js";
 import {
-  ACTIVITY_MIN_IDLE_TIMEOUT_MS,
-  ACTIVITY_MAX_VISIT_MS2
-} from "./chunk-tbc1ngpd.js";
+  validateSchemaValue2,
+  normalizeSchemaValue2,
+  uniqueValueKind,
+  uniqueValueKey
+} from "./chunk-65pyhyas.js";
 import {
-  snapshotVectorProfiles
-} from "./chunk-g257jwnc.js";
+  unreadableError,
+  resolvePropertyClearance
+} from "./chunk-6rrtzea3.js";
 import {
+  bindCurrentUserPredicate,
   composeObjectQueryAdmissions,
   validateObjectQuery2,
   validateObjectQueryWithAdmission,
+  toUserProfile
+} from "./chunk-h3pbv7n8.js";
+import {
+  snapshotVectorProfiles
+} from "./chunk-cdk3egjj.js";
+import {
+  userExpansionPlan,
   executeObjectQuery2,
   countObjects2,
   existsObjects2,
@@ -36,241 +46,21 @@ import {
   validateObjectFacetRequests,
   preflightObjectQueryLinks,
   executeObjectQueryLinks2
-} from "./chunk-cn0fwwhy.js";
-import {
-  executionRecordInputFromRuntime,
-  ensureExecutionRecord2
-} from "./chunk-vf57cr4t.js";
-import {
-  requireAccountingCapabilities,
-  createAiModelCallLimitController2,
-  AiModelCallRecorder2,
-  enqueueAiModelCallRecovery2
-} from "./chunk-1cc1xaf3.js";
-import {
-  ObjectQueryValidationError2
-} from "./chunk-91mg3nj9.js";
-import {
-  findPrimitiveParentRequestExecution
-} from "./chunk-ey1nk510.js";
+} from "./chunk-efmm01gj.js";
 import {
   createPropertyTokenMap2,
   createLinkTokenMap2
-} from "./chunk-rdghfsss.js";
+} from "./chunk-16a9dmfy.js";
+import {
+  ObjectQueryValidationError2,
+  normalizeObjectQuery2
+} from "./chunk-j936th07.js";
 import {
   OntologyValidationError2,
   OntologyNotFoundError2,
   formatUnknownObjectTypeMessage
 } from "./chunk-cqr3acm1.js";
 
-// src/runtime/ontology-mutations.ts
-var ontologyMutationRuntimeKey = Symbol("sixb.ontologyMutationRuntime");
-function registerOntologyMutationRuntime2(owner, runtime) {
-  const registered = owner[ontologyMutationRuntimeKey];
-  if (registered && registered !== runtime) {
-    throw new Error("[Sixb] Ontology mutation runtime is already registered for this owner.");
-  }
-  Object.defineProperty(owner, ontologyMutationRuntimeKey, {
-    configurable: false,
-    enumerable: true,
-    value: runtime,
-    writable: false
-  });
-}
-function getOntologyMutationRuntime2(owner) {
-  const runtime = owner[ontologyMutationRuntimeKey];
-  if (runtime)
-    return runtime;
-  throw new Error("[Sixb] Ontology mutation runtime is not registered for this runtime context.");
-}
-function shareOntologyMutationRuntime2(source, target) {
-  registerOntologyMutationRuntime2(target, getOntologyMutationRuntime2(source));
-}
-function createOntologyMutationRuntime2(input) {
-  const applied = (work) => work.finally(() => notifyWithoutAffecting(input.onProjectionApplied));
-  const runtime = {
-    getProjectionSource: (source) => input.materializer.projections.getActive(source),
-    commitEdits: (command) => commitAndNotify(() => input.materializer.edits.commit(command), input.notifyCommittedFacts),
-    replaceProjection: (command) => applied(commitAndNotify(() => input.materializer.projections.replace(command), input.notifyCommittedFacts)),
-    finishProjection: (command) => applied(input.materializer.projections.finishRun(command)),
-    appendTelemetry: (command) => commitAndNotify(() => input.materializer.telemetry.append(command), input.notifyCommittedFacts)
-  };
-  return Object.freeze(runtime);
-}
-async function commitAndNotify(commit, notify) {
-  const result = await commit();
-  if (result.eventCount > 0)
-    notifyWithoutAffectingCommit(notify);
-  return result;
-}
-function notifyWithoutAffectingCommit(notify) {
-  try {
-    notify();
-  } catch (error) {
-    console.error("[Sixb] Failed to wake the ontology outbox dispatcher:", error);
-  }
-}
-function notifyWithoutAffecting(notify) {
-  try {
-    notify?.();
-  } catch (error) {
-    console.error("[Sixb] Failed to report an applied projection:", error);
-  }
-}
-
-// src/activity/device.ts
-var BROWSERS = [
-  [/\bEdg(?:e|A|iOS)?\//, "Edge"],
-  [/\b(?:OPR|Opera)\//, "Opera"],
-  [/\bSamsungBrowser\//, "Samsung Internet"],
-  [/\b(?:Firefox|FxiOS)\//, "Firefox"],
-  [/\b(?:Chrome|Chromium|CriOS|HeadlessChrome)\//, "Chrome"],
-  [/\bVersion\/[\d.]+.*\bSafari\//, "Safari"]
-];
-var SYSTEMS = [
-  [/\bWindows\b/, "Windows"],
-  [/\biPad\b/, "iPadOS"],
-  [/\b(?:iPhone|iPod)\b/, "iOS"],
-  [/\bAndroid\b/, "Android"],
-  [/\bCrOS\b/, "ChromeOS"],
-  [/\bMac OS X\b|\bMacintosh\b/, "macOS"],
-  [/\bLinux\b/, "Linux"]
-];
-function describeUserAgent(userAgent) {
-  if (!userAgent) {
-    return {};
-  }
-  const browser = BROWSERS.find(([pattern]) => pattern.test(userAgent))?.[1];
-  const os = SYSTEMS.find(([pattern]) => pattern.test(userAgent))?.[1];
-  return {
-    ...browser === undefined ? {} : { browser },
-    ...os === undefined ? {} : { os }
-  };
-}
-
-// src/activity/connection.ts
-async function readActivityConnections(runtime, service, query, now) {
-  const { userId, limit, before } = service.connectionsQuery(query);
-  const sessions = runtime.storage.auth?.sessions;
-  if (!sessions) {
-    return { connections: [] };
-  }
-  const page = await sessions.listByUserId({
-    projectId: runtime.projectId,
-    userId,
-    limit,
-    ...before === undefined ? {} : { before }
-  });
-  const visits = await service.sessionVisits({
-    userId,
-    sessionIds: page.sessions.map((session) => session.id)
-  });
-  const bySession = new Map(visits.map((entry) => [entry.sessionId, entry]));
-  const connections = page.sessions.map((session) => ({
-    ...sessionConnection(session, now),
-    visits: bySession.get(session.id)?.visits ?? 0,
-    latestVisits: bySession.get(session.id)?.latest ?? []
-  }));
-  const last = page.sessions.at(-1);
-  return {
-    connections,
-    ...page.hasMore && last ? { nextCursor: nextConnectionsCursor(page.sessions, last, before) } : {}
-  };
-}
-function nextConnectionsCursor(sessions, last, before) {
-  const { createdAt } = last;
-  const tied = sessions.filter((session) => session.createdAt.getTime() === createdAt.getTime());
-  const earlier = before && before.createdAt.getTime() === createdAt.getTime() ? before.skip : 0;
-  return encodeActivityConnectionsCursor({ createdAt, skip: earlier + tied.length });
-}
-function encodeActivityConnectionsCursor(cursor) {
-  return Buffer.from(JSON.stringify([cursor.createdAt.toISOString(), cursor.skip])).toString("base64url");
-}
-function decodeActivityConnectionsCursor(value) {
-  try {
-    const parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
-    if (Array.isArray(parsed) && parsed.length === 2) {
-      const [at, skip] = parsed;
-      const createdAt = new Date(typeof at === "string" ? at : Number.NaN);
-      if (Number.isFinite(createdAt.getTime()) && Number.isSafeInteger(skip) && skip >= 0) {
-        return { createdAt, skip };
-      }
-    }
-  } catch {}
-  throw new Error("[Sixb] Invalid activity connections cursor.");
-}
-async function readActivityConnection(runtime, page, grant, now) {
-  const { storage, projectId } = runtime;
-  const { actor } = page.visit;
-  if (actor.type === "user") {
-    const session = await storage.auth?.sessions.getById({ projectId, id: page.sessionId });
-    return session ? sessionConnection(session, now) : undefined;
-  }
-  const session = await storage.shareSessions?.getById({ projectId, id: page.sessionId });
-  if (!session) {
-    return;
-  }
-  const revokedAt = [session.revokedAt, grant?.revokedAt].flatMap((at) => at === undefined ? [] : [at.getTime()]).sort((left, right) => left - right)[0];
-  const statuses = [
-    connectionStatus(session, now),
-    ...grant ? [connectionStatus(grant, now)] : []
-  ];
-  const status = statuses.includes("revoked") ? "revoked" : statuses.includes("expired") ? "expired" : "active";
-  return {
-    type: "share",
-    grantId: actor.grantId,
-    ...grant ? { definitionId: grant.definitionId } : {},
-    status,
-    createdAt: new Date(session.createdAt),
-    ...revokedAt === undefined ? {} : { revokedAt: new Date(revokedAt) }
-  };
-}
-function connectionStatus(session, now) {
-  if (session.revokedAt) {
-    return "revoked";
-  }
-  const expired = session.expiresAt <= now || session.absoluteExpiresAt !== undefined && session.absoluteExpiresAt <= now;
-  return expired ? "expired" : "active";
-}
-function sessionConnection(session, now) {
-  return {
-    type: "session",
-    device: describeUserAgent(session.userAgent),
-    ...session.bearer === undefined ? {} : { clientName: session.bearer.clientName },
-    status: connectionStatus(session, now),
-    createdAt: new Date(session.createdAt),
-    ...session.lastSeenAt === undefined ? {} : { lastSeenAt: new Date(session.lastSeenAt) },
-    ...session.revokedAt === undefined ? {} : { revokedAt: new Date(session.revokedAt) }
-  };
-}
-
-// src/activity/shares.ts
-async function nameSharedVisits(runtime, visits) {
-  const grants = await readGrants(runtime, visits);
-  return visits.map((visit) => withShare(visit, grants));
-}
-async function nameSharedVisit(runtime, visit) {
-  const grants = await readGrants(runtime, [visit]);
-  const grant = visit.actor.type === "share" ? grants.get(visit.actor.grantId) : undefined;
-  return { visit: withShare(visit, grants), ...grant === undefined ? {} : { grant } };
-}
-async function readGrants(runtime, visits) {
-  const ids = visits.flatMap((visit) => visit.actor.type === "share" ? [visit.actor.grantId] : []);
-  if (ids.length === 0 || !runtime.storage.shareGrants) {
-    return new Map;
-  }
-  const grants = await runtime.storage.shareGrants.getByIds({ projectId: runtime.projectId, ids });
-  return new Map(grants.map((grant) => [grant.id, grant]));
-}
-function withShare(visit, grants) {
-  const { actor } = visit;
-  const grant = actor.type === "share" ? grants.get(actor.grantId) : undefined;
-  if (actor.type !== "share" || grant === undefined) {
-    return visit;
-  }
-  return { ...visit, actor: { ...actor, definitionId: grant.definitionId } };
-}
-
 // src/assert-never.ts
 function assertNever(_value, message) {
   throw new Error(message);
@@ -732,6 +522,7 @@ function snapshotProperty(property) {
     required: property.required,
     nullable: property.nullable,
     primary: property.primary,
+    unique: property.unique,
     mode: property.mode,
     semanticType: property.semanticType,
     query: snapshotPropertyQuery(property.query)
@@ -843,18 +634,18 @@ function unknownObjectType(objectTypeId) {
 // src/execution/object-reader-ontology.ts
 class ObjectReaderOntology {
   registry;
-  #authority;
+  #security;
   #view;
-  constructor(registry, authority) {
+  constructor(registry, security) {
     this.registry = registry;
-    this.#authority = authority;
+    this.#security = security;
     Object.freeze(this);
   }
   view() {
-    const authority = this.#authority;
+    const authority = this.#security.authority;
     this.#view ??= createAuthorizedOntologyView({
       ontology: this.registry,
-      selection: selectionForAuthority(authority, this.registry),
+      selection: selectionForAuthority(this.#security, this.registry),
       ...authority.type === "delegated" ? {
         assertOutputWithinLimit: (value) => assertObjectReadOutputWithinLimit2(value, authority.objectRead.limits)
       } : {}
@@ -862,17 +653,15 @@ class ObjectReaderOntology {
     return this.#view;
   }
 }
-function selectionForAuthority(authority, ontology) {
+function selectionForAuthority(security, ontology) {
+  const authority = security.authority;
   switch (authority.type) {
     case "unrestricted":
       return { kind: "all" };
     case "principal":
       return {
         kind: "types",
-        objectTypeIds: ontology.listObjectTypes().filter((objectType) => isAllowed2(authority.context, {
-          kind: "object.view",
-          objectTypeId: objectType.id
-        })).map((objectType) => objectType.id)
+        objectTypeIds: ontology.listObjectTypes().filter((objectType) => security.isObjectTypeGranted(objectType.id, undefined)).map((objectType) => objectType.id)
       };
     case "delegated":
       return { kind: "selected", scope: authority.objectRead.scope };
@@ -1062,10 +851,16 @@ class ObjectReaderSecurity {
   runtime;
   delegation;
   clearance;
+  requestingUser;
+  conditionalScope;
+  #conditionProperties;
   constructor(input) {
     const authority = input.authority;
     this.authorization = input.authorization;
     this.authority = authority;
+    if (input.requestedBy?.type === "user") {
+      this.requestingUser = Object.freeze({ type: "user", id: input.requestedBy.id });
+    }
     this.runtime = Object.freeze({
       projectId: input.projectId,
       runtimeAuthorization: input.authorization,
@@ -1079,6 +874,22 @@ class ObjectReaderSecurity {
         queryAdmission: createSelectedObjectQueryAdmission(scope)
       });
     }
+    const conditions = authority.type === "principal" ? authority.context.viewConditions : undefined;
+    this.#conditionProperties = new Map([...conditions ?? []].map(([objectTypeId, predicates]) => [
+      objectTypeId,
+      [...new Set(predicates.flatMap(propertiesReadBy))]
+    ]));
+    if (authority.type === "principal" && conditions && conditions.size > 0) {
+      const principal = authority.context.principal;
+      const grantee = principal.type === "user" ? { type: "user", id: principal.id } : undefined;
+      this.conditionalScope = compileConditionalObjectReadScope2({
+        kind: "conditional",
+        conditions: [...conditions].map(([objectTypeId, predicates]) => ({
+          objectTypeId,
+          predicate: bindCurrentUserPredicate(anyOf(predicates), grantee)
+        }))
+      });
+    }
     this.clearance = new ObjectReaderClearance({
       ontology: input.ontology,
       clearances: clearancesForAuthority(authority),
@@ -1094,9 +905,7 @@ class ObjectReaderSecurity {
         throw new AuthorizationError2(`delegated:object.view:${objectTypeId}`, `[Sixb] Delegated authorization does not select object type '${objectTypeId}'.`);
       }
     } else {
-      for (const objectTypeId of new Set(objectTypeIds)) {
-        assertAuthorized2(this.runtime, { kind: "object.view", objectTypeId });
-      }
+      this.assertObjectTypesGranted(objectTypeIds, clearance);
     }
     if (!clearance)
       return;
@@ -1106,19 +915,72 @@ class ObjectReaderSecurity {
         throw unreadableError(unreadable);
     }
   }
-  isObjectTypeViewable(objectTypeId, clearance) {
-    if (clearance?.unreadableType(objectTypeId))
-      return false;
+  assertObjectTypesGranted(objectTypeIds, clearance) {
+    for (const objectTypeId of new Set(objectTypeIds)) {
+      if (!this.#conditionProperties.has(objectTypeId)) {
+        assertAuthorized2(this.runtime, { kind: "object.view", objectTypeId });
+        continue;
+      }
+      assertRuntimeAuthorizationBound2(this.runtime);
+      const unreadable = this.#unreadableCondition(objectTypeId, clearance);
+      if (unreadable)
+        throw unreadableError(unreadable);
+    }
+  }
+  viewsThroughCondition(objectTypeId) {
+    return this.#conditionProperties.has(objectTypeId);
+  }
+  isObjectTypeGranted(objectTypeId, clearance) {
     if (this.delegation)
       return this.delegation.objectTypeIds.has(objectTypeId);
+    if (this.#conditionProperties.has(objectTypeId)) {
+      return this.#unreadableCondition(objectTypeId, clearance) === undefined;
+    }
     return isAllowed2(this.runtime.authorization, { kind: "object.view", objectTypeId });
   }
+  isObjectTypeViewable(objectTypeId, clearance) {
+    if (clearance?.unreadableType(objectTypeId))
+      return false;
+    return this.isObjectTypeGranted(objectTypeId, clearance);
+  }
   isLinkViewable(link, clearance) {
     if (!this.isObjectTypeViewable(link.sourceTypeId, clearance) || !this.isObjectTypeViewable(link.targetTypeId, clearance) || clearance?.unreadableLink(link.sourceTypeId, link.linkId)) {
       return false;
     }
     return this.delegation?.linkDefinitions.has(delegatedLinkDefinitionKey(link)) ?? true;
   }
+  #unreadableCondition(objectTypeId, clearance) {
+    const propertyIds = this.#conditionProperties.get(objectTypeId);
+    return propertyIds && unreadableConditionOf(objectTypeId, propertyIds, clearance);
+  }
+}
+function unreadableConditionOf(objectTypeId, propertyIds, clearance) {
+  for (const propertyId of propertyIds) {
+    const marking = clearance?.missingMarking(objectTypeId, propertyId);
+    if (marking === undefined)
+      continue;
+    return {
+      marking,
+      message: `[Sixb] Cannot read '${objectTypeId}': the condition it is viewed through reads '${objectTypeId}.${propertyId}', which requires clearance for marking '${marking}'.`
+    };
+  }
+  return;
+}
+function propertiesReadBy(predicate) {
+  switch (predicate.op) {
+    case "and":
+    case "or":
+      return predicate.items.flatMap(propertiesReadBy);
+    case "not":
+      return propertiesReadBy(predicate.item);
+    case "constant":
+      return [];
+    default:
+      return [predicate.propertyId];
+  }
+}
+function anyOf(predicates) {
+  return predicates.length === 1 ? predicates[0] : { op: "or", items: predicates };
 }
 function clearancesForAuthority(authority) {
   switch (authority.type) {
@@ -1134,6 +996,97 @@ function delegatedLinkDefinitionKey(input) {
   return "sourceObjectTypeId" in input ? JSON.stringify([input.sourceObjectTypeId, input.linkId, input.targetObjectTypeId]) : JSON.stringify([input.sourceTypeId, input.linkId, input.targetTypeId]);
 }
 
+// src/execution/object-reader-users.ts
+var LOOKUP_BATCH_SIZE = 500;
+async function attachUserProfiles(input) {
+  const slots = [];
+  collectSlots(input.rows, input.plan, input.ontology, slots);
+  if (!input.canViewUsers)
+    return;
+  const records = await readUsers(input, slots);
+  for (const slot of slots) {
+    slot.users[slot.propertyId] = expandedValue(slot, records);
+  }
+}
+function expandedValue(slot, records) {
+  const profiles = slot.ids.flatMap((id) => {
+    const record = records.get(id);
+    return record ? [toUserProfile(record)] : [];
+  });
+  return slot.many ? profiles : profiles[0] ?? null;
+}
+function collectSlots(rows, plan, ontology, into) {
+  for (const row of rows) {
+    const properties = ontology.getObjectTypeById(row.objectTypeId)?.properties ?? [];
+    for (const propertyId of plan.users) {
+      const property = properties.find((candidate) => candidate.id === propertyId);
+      if (!property || !isUserRefPropertySchema(property.schema))
+        continue;
+      row.users ??= {};
+      if (row.redactions?.[propertyId])
+        continue;
+      into.push({
+        users: row.users,
+        propertyId,
+        many: property.schema !== "userRef",
+        ids: userIdsOf(row.properties[propertyId])
+      });
+    }
+    for (const link of plan.links) {
+      collectSlots(linkedRows(row.links?.[link.linkId]), link.plan, ontology, into);
+    }
+  }
+}
+async function readUsers(input, slots) {
+  const records = new Map;
+  const ids = [...new Set(slots.flatMap((slot) => slot.ids))];
+  if (!input.users || ids.length === 0)
+    return records;
+  for (let start = 0;start < ids.length; start += LOOKUP_BATCH_SIZE) {
+    const batch = ids.slice(start, start + LOOKUP_BATCH_SIZE);
+    for (const record of await input.users.getByIds({ projectId: input.projectId, ids: batch })) {
+      records.set(record.id, record);
+    }
+  }
+  return records;
+}
+function userIdsOf(value) {
+  if (isUserRef(value))
+    return [value.id];
+  if (!Array.isArray(value))
+    return [];
+  return value.filter(isUserRef).map((ref) => ref.id);
+}
+function linkedRows(value) {
+  if (value === undefined || value === null)
+    return [];
+  if (Array.isArray(value))
+    return value;
+  return [value];
+}
+
+// src/execution/unique-lookup.ts
+function uniqueLookupKey(ontology, input) {
+  return uniqueLookupKeyOf(ontology.resolveObjectType(input.objectTypeId), input.propertyId, input.value, ontology.getValueTypesById());
+}
+function uniqueLookupKeyOf(objectType, propertyId, value, valueTypesById) {
+  const path = `${objectType.id}.${propertyId}`;
+  const property = objectType.properties.find((candidate) => candidate.id === propertyId);
+  const kind = property?.unique ? uniqueValueKind(property.schema, valueTypesById) : undefined;
+  if (!property || !kind) {
+    throw new OntologyValidationError2(`[Sixb] Cannot look up '${path}' by value: getBy needs a property declared with unique: true.`);
+  }
+  if (value === null || value === undefined) {
+    throw new OntologyValidationError2(`[Sixb] Cannot look up '${path}' by ${String(value)}: no object holds a null or missing value.`);
+  }
+  validateSchemaValue2(property.schema, value, path, valueTypesById);
+  const key = uniqueValueKey(kind, normalizeSchemaValue2(property.schema, value, path, valueTypesById));
+  if (key === null) {
+    throw new OntologyValidationError2(`[Sixb] Cannot look up '${path}' by this value.`);
+  }
+  return key;
+}
+
 // src/execution/authorized-object-reader.ts
 var readerConstructionKey = Object.freeze({});
 
@@ -1142,6 +1095,7 @@ class AuthorizedObjectReaderImpl {
   #security;
   #models;
   #storage;
+  #users;
   constructor(key, input) {
     if (key !== readerConstructionKey) {
       throw new Error("[Sixb] AuthorizedObjectReader can only be created by Core.");
@@ -1150,6 +1104,7 @@ class AuthorizedObjectReaderImpl {
     this.#security = input.security;
     this.#models = input.models;
     this.#storage = input.storage;
+    this.#users = input.users;
   }
   static assertBound(reader, scope) {
     const capturedScope = captureExecutionScope(scope);
@@ -1164,6 +1119,17 @@ class AuthorizedObjectReaderImpl {
   static eventClearance(reader, sources) {
     return reader.#security.clearance.forEvent(sources);
   }
+  static viewConditions(reader) {
+    const security = reader.#security;
+    const conditions = security.conditionalScope?.conditions ?? [];
+    return new Map(conditions.map(({ objectTypeId, predicate }) => [
+      objectTypeId,
+      {
+        predicate,
+        hiddenBy: (clearance) => !security.isObjectTypeViewable(objectTypeId, clearance)
+      }
+    ]));
+  }
   static ontologyView(reader) {
     return reader.#ontology.view();
   }
@@ -1183,6 +1149,27 @@ class AuthorizedObjectReaderImpl {
     });
     return this.#detachRows(row && this.#omitHidden(row, clearance), (detached) => [detached], clearance);
   }
+  async getByUniqueValue(input) {
+    const request = snapshotReadValue({
+      objectTypeId: input.objectTypeId,
+      propertyId: input.propertyId,
+      value: input.value
+    });
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable([request.objectTypeId], clearance);
+    const valueKey = uniqueLookupKey(this.#ontology.registry, request);
+    const marking = clearance?.missingMarking(request.objectTypeId, request.propertyId);
+    if (marking !== undefined) {
+      throw new AuthorizationError2(`clearance:marking:${marking}`, `[Sixb] Cannot look up '${request.objectTypeId}.${request.propertyId}' by value: it requires clearance for marking '${marking}'.`);
+    }
+    const row = await this.#storage.getByUniqueValue({
+      objectTypeId: request.objectTypeId,
+      propertyId: request.propertyId,
+      valueKey,
+      projectId: this.#security.runtime.projectId
+    });
+    return this.#detachRows(row && this.#omitHidden(row, clearance), (detached) => [detached], clearance);
+  }
   async getByPrimaryIdBatch(input) {
     const request = snapshotReadValue({
       items: input.items.map((item) => ({
@@ -1208,13 +1195,8 @@ class AuthorizedObjectReaderImpl {
     this.#security.assertObjectTypesViewable([request.objectTypeId], clearance);
     if (hidesProperty(request, clearance))
       return false;
-    if (this.#security.authority.type !== "delegated")
-      return true;
-    const [readable] = await this.#storage.selectsObjectProperties({
-      projectId: this.#security.runtime.projectId,
-      items: [request]
-    });
-    return readable ?? false;
+    const [selected] = await this.#selectsObjectProperties([request]);
+    return selected ?? false;
   }
   async canReadObjectPropertiesBatch(input) {
     const request = snapshotReadValue({
@@ -1226,10 +1208,7 @@ class AuthorizedObjectReaderImpl {
     });
     const clearance = await this.#security.clearance.current();
     this.#security.assertObjectTypesViewable(request.items.map((item) => item.objectTypeId), clearance);
-    const selected = this.#security.authority.type === "delegated" ? await this.#storage.selectsObjectProperties({
-      ...request,
-      projectId: this.#security.runtime.projectId
-    }) : request.items.map(() => true);
+    const selected = await this.#selectsObjectProperties(request.items);
     return request.items.map((item, index) => !hidesProperty(item, clearance) && selected[index] === true);
   }
   async list(input) {
@@ -1305,7 +1284,9 @@ class AuthorizedObjectReaderImpl {
       projectId: this.#security.runtime.projectId,
       signal: input.signal
     }, this.#queryExecutorOptions(clearance));
-    return this.#detachRows({ ...result, objects: result.objects.map((row) => this.#omitHidden(row, clearance)) }, (detached) => detached.objects, clearance);
+    const detached = this.#detachRows({ ...result, objects: result.objects.map((row) => this.#omitHidden(row, clearance)) }, (detached) => detached.objects, clearance);
+    await this.#attachUsers(detached.objects, query);
+    return detached;
   }
   async queryLinks(input) {
     const query = snapshotAuthoredQuery(input.query);
@@ -1395,9 +1376,30 @@ class AuthorizedObjectReaderImpl {
     assertTargetsReadable(clearance, { objectTypeIds: [objectTypeId] });
     return (row) => clearance ? redactObjectRow(row, clearance) : row;
   }
+  async uniqueValueWriteCheck(objectTypeId) {
+    const clearance = await this.#security.clearance.current();
+    const marked = this.#ontology.registry.listUniqueProperties(objectTypeId).flatMap((property) => {
+      const marking = clearance?.missingMarking(objectTypeId, property.propertyId);
+      return marking === undefined ? [] : [{ propertyId: property.propertyId, marking }];
+    });
+    return (properties) => {
+      for (const { propertyId, marking } of marked) {
+        if (properties[propertyId] === undefined || properties[propertyId] === null)
+          continue;
+        throw new AuthorizationError2(`clearance:marking:${marking}`, `[Sixb] Cannot write a value to '${objectTypeId}.${propertyId}': it is unique and requires clearance for marking '${marking}'.`);
+      }
+    };
+  }
   async assertReadable(targets) {
     assertTargetsReadable(await this.#security.clearance.current(), targets);
   }
+  viewsThroughCondition(objectTypeId) {
+    return this.#security.viewsThroughCondition(objectTypeId);
+  }
+  async assertViewable(objectTypeIds) {
+    const clearance = await this.#security.clearance.current();
+    this.#security.assertObjectTypesViewable(objectTypeIds, clearance);
+  }
   assertVisibleOutputWithinLimit(value) {
     if (this.#security.authority.type !== "delegated")
       return;
@@ -1414,7 +1416,8 @@ class AuthorizedObjectReaderImpl {
         storage: this.#storage,
         embeddingModels: this.#models.embedding,
         rerankingModels: this.#models.reranking,
-        ...admission === undefined ? {} : { admission }
+        ...admission === undefined ? {} : { admission },
+        requestingUser: this.#security.requestingUser
       };
     }
     return {
@@ -1422,9 +1425,22 @@ class AuthorizedObjectReaderImpl {
       embeddingModels: this.#models.embedding,
       rerankingModels: this.#models.reranking,
       storage: this.#storage,
-      runtimeAuthorization: this.#security.runtime.runtimeAuthorization,
-      ...this.#security.runtime.authorization === undefined ? {} : { authorization: this.#security.runtime.authorization },
-      ...admission === undefined ? {} : { admission }
+      ...this.#queryAuthorization(clearance),
+      ...admission === undefined ? {} : { admission },
+      requestingUser: this.#security.requestingUser
+    };
+  }
+  #queryAuthorization(clearance) {
+    const runtimeAuthorization = this.#security.runtime.runtimeAuthorization;
+    if (this.#security.authority.type !== "principal")
+      return { runtimeAuthorization };
+    const security = this.#security;
+    return {
+      runtimeAuthorization,
+      readableObjectTypes: Object.freeze({
+        assert: (objectTypeIds) => security.assertObjectTypesGranted(objectTypeIds, clearance),
+        has: (objectTypeId) => security.isObjectTypeGranted(objectTypeId, clearance)
+      })
     };
   }
   #executorAdmission(clearance) {
@@ -1434,6 +1450,29 @@ class AuthorizedObjectReaderImpl {
       return composeObjectQueryAdmissions(selected, admission);
     return selected ?? admission;
   }
+  async#attachUsers(rows, query) {
+    const plan = userExpansionPlan(normalizeObjectQuery2(query));
+    if (!plan)
+      return;
+    await attachUserProfiles({
+      rows,
+      plan,
+      ontology: this.#ontology.registry,
+      projectId: this.#security.runtime.projectId,
+      canViewUsers: isRuntimeAllowed2(this.#security.runtime, { kind: "users.view" }),
+      users: this.#users
+    });
+  }
+  async#selectsObjectProperties(items) {
+    const readsByObject = (item) => this.#security.authority.type === "delegated" || this.#security.viewsThroughCondition(item.objectTypeId);
+    const checked = items.filter(readsByObject);
+    const selected = checked.length === 0 ? [] : await this.#storage.selectsObjectProperties({
+      projectId: this.#security.runtime.projectId,
+      items: checked
+    });
+    let next = 0;
+    return items.map((item) => !readsByObject(item) || selected[next++] === true);
+  }
   #omitHidden(row, clearance) {
     return clearance ? omitHiddenProperties(row, clearance) : row;
   }
@@ -1472,21 +1511,24 @@ function createAuthorizedObjectReader(input) {
   const scope = captureExecutionScope(input.scope);
   const projectId = scope.execution.projectId;
   const authority = resolveExecutionScopeAuthorization(projectId, scope);
-  const storage = objectStorageForAuthority(authority, input.objectStorage);
+  const security = new ObjectReaderSecurity({
+    authorization: scope.authorization,
+    authority,
+    projectId,
+    ontology: input.ontology,
+    ...input.appliedMarkings === undefined ? {} : { appliedMarkings: input.appliedMarkings },
+    requestedBy: scope.execution.requestedBy
+  });
+  const storage = objectStorageForAuthority(security, input.objectStorage);
   const reader = new AuthorizedObjectReaderImpl(readerConstructionKey, {
-    ontology: new ObjectReaderOntology(input.ontology, authority),
-    security: new ObjectReaderSecurity({
-      authorization: scope.authorization,
-      authority,
-      projectId,
-      ontology: input.ontology,
-      ...input.appliedMarkings === undefined ? {} : { appliedMarkings: input.appliedMarkings }
-    }),
+    ontology: new ObjectReaderOntology(input.ontology, security),
+    security,
     models: Object.freeze({
       ...input.embeddingModels === undefined ? {} : { embedding: input.embeddingModels },
       ...input.rerankingModels === undefined ? {} : { reranking: input.rerankingModels }
     }),
-    storage
+    storage,
+    ...input.users === undefined ? {} : { users: input.users }
   });
   Object.freeze(reader);
   return reader;
@@ -1503,6 +1545,9 @@ function readerClearance(reader) {
 function readerEventClearance(reader, sources) {
   return AuthorizedObjectReaderImpl.eventClearance(reader, sources);
 }
+function readerViewConditions(reader) {
+  return AuthorizedObjectReaderImpl.viewConditions(reader);
+}
 function assertTargetsReadable(clearance, targets) {
   if (!clearance)
     return;
@@ -1520,9 +1565,14 @@ function assertTargetsReadable(clearance, targets) {
 function hidesProperty(item, clearance) {
   return clearance?.missingMarking(item.objectTypeId, item.propertyId) !== undefined;
 }
-function objectStorageForAuthority(authority, objectStorage) {
+function objectStorageForAuthority(security, objectStorage) {
+  const authority = security.authority;
   switch (authority.type) {
     case "principal":
+      return security.conditionalScope ? objectStorage.createConditionalReadScope({
+        projectId: authority.projectId,
+        scope: security.conditionalScope
+      }) : objectStorage;
     case "unrestricted":
       return objectStorage;
     case "delegated":
@@ -1605,424 +1655,6 @@ function snapshotAuthoredQuery(query) {
   }
 }
 
-// src/actions/run-authorization.ts
-async function canReadActionRunSubject(objectReader, run) {
-  if (run.subject.kind !== "object")
-    return true;
-  const clearance = await readerClearance(objectReader);
-  return clearance?.unreadableType(run.subject.objectTypeId) === undefined;
-}
-async function unreadableActionRunTypes(objectReader) {
-  const clearance = await readerClearance(objectReader);
-  return new Set(clearance?.unreadable().types.keys());
-}
-async function canDelegationAccessActionRun(input) {
-  const subject = input.run.subject;
-  if (!input.authority.delegation || subject.kind !== "object" || !input.authority.actionApply.some((target) => target.actionId === input.run.actionId && target.subject.objectTypeId === subject.objectTypeId && target.subject.primaryId === subject.primaryId)) {
-    return false;
-  }
-  return actionRunBelongsToShareGrant({
-    storage: input.storage,
-    projectId: input.projectId,
-    run: input.run,
-    grantId: input.authority.delegation.grantId
-  });
-}
-async function actionRunBelongsToShareGrant(input) {
-  const parent = await findPrimitiveParentRequestExecution({
-    executions: input.storage.executions,
-    projectId: input.projectId,
-    executionId: input.run.executionId,
-    primitive: { kind: "action", id: input.run.actionId, runId: input.run.id }
-  });
-  const authorization = parent?.authorizationRef;
-  return authorization?.type === "delegated" && authorization.delegation.kind === "share" && authorization.delegation.grantId === input.grantId;
-}
-
-// src/runtime/ai-cost.ts
-async function resolveExecutionCosts(input) {
-  if (input.executionIds.length === 0)
-    return [];
-  if (!input.storage)
-    return input.executionIds.map(() => {
-      return;
-    });
-  return input.storage.summarizeExecutions({
-    projectId: input.projectId,
-    executionIds: input.executionIds
-  });
-}
-
-// src/activity/timeline.ts
-var ACTIVITY_TIMELINE_LIMIT = 200;
-var SESSION_GRACE_MS = ACTIVITY_MIN_IDLE_TIMEOUT_MS / 2;
-async function composeActivityTimeline(runtime, input, now) {
-  const { page, visit } = input;
-  const { storage, projectId } = runtime;
-  const [ledger, connection] = await Promise.all([
-    storage.executions.listBySession({
-      projectId,
-      session: { type: visit.actor.type, id: page.sessionId },
-      ...sessionWindow(visit),
-      limit: ACTIVITY_TIMELINE_LIMIT
-    }),
-    readActivityConnection(runtime, page, input.grant, now)
-  ]);
-  const executions = ledger.executions;
-  const ofKind = (kind) => executions.flatMap((execution) => execution.executor.type === "primitive" && execution.executor.kind === kind ? [execution.id] : []);
-  const agentRunIds = executions.flatMap((execution) => execution.executor.type === "agent" ? [execution.executor.runId] : []);
-  const byId = new Map(executions.map((execution) => [execution.id, execution]));
-  const withAgent = executions.filter((execution) => lineage(execution, byId).some((ancestor) => ancestor.executor.type === "agent"));
-  const [actionRuns, workflowRuns, agentRuns, costs] = await Promise.all([
-    storage.actionRuns?.getByExecutionIds({ projectId, executionIds: ofKind("action") }) ?? [],
-    storage.workflowRuns?.getByExecutionIds({ projectId, executionIds: ofKind("workflow") }) ?? [],
-    storage.agents?.runs.getByIds({ projectId, ids: agentRunIds }) ?? [],
-    resolveExecutionCosts({
-      storage: storage.aiCosts,
-      projectId,
-      executionIds: withAgent.map((execution) => execution.id)
-    })
-  ]);
-  const conversations = new Map(agentRuns.flatMap((run) => run.kind === "conversation" ? [[run.executionId, run]] : []));
-  const subjects = actionRuns.flatMap((run) => run.subject.kind === "object" ? [run.subject] : []);
-  const [threads, readable, unreadableRunTypes] = await Promise.all([
-    storage.agents?.threads.getByIds({
-      projectId,
-      ids: [...conversations.values()].map((run) => run.threadId)
-    }) ?? [],
-    readableObjects(runtime, subjects),
-    subjects.length > 0 ? unreadableActionRunTypes(runtime.objectReader) : new Set
-  ]);
-  const actionRunByExecution = new Map(actionRuns.map((run) => [run.executionId, run]));
-  const workflowRunByExecution = new Map(workflowRuns.map((run) => [run.executionId, run]));
-  const messagesByThread = new Map(threads.map((thread) => [thread.id, thread.messageCount]));
-  const costByAgent = rollUpCosts(byId, conversations, withAgent, costs);
-  const executionEntries = executions.flatMap((execution) => {
-    const at = new Date(execution.createdAt);
-    const executor = execution.executor;
-    const authority = execution.authorizationRef;
-    if (executor.type === "primitive" && authority.type === "trustedPrimitive") {
-      if (executor.kind === "action") {
-        const run = actionRunByExecution.get(execution.id);
-        const subject = run?.subject.kind === "object" ? run.subject : undefined;
-        const object = subject && readable.has(objectBatchKey2(subject.objectTypeId, subject.primaryId)) ? { objectTypeId: subject.objectTypeId, primaryId: subject.primaryId } : undefined;
-        const runVisible = run !== undefined && canViewActionRun2(runtime.authorization, run) && (subject === undefined || !unreadableRunTypes.has(subject.objectTypeId));
-        return [
-          {
-            kind: "action",
-            at,
-            executionId: execution.id,
-            actionId: authority.primitive.id,
-            runId: executor.runId,
-            status: run?.status ?? "incomplete",
-            runVisible,
-            ...object === undefined ? {} : { object }
-          }
-        ];
-      }
-      if (executor.kind === "workflow") {
-        const run = workflowRunByExecution.get(execution.id);
-        return [
-          {
-            kind: "workflow",
-            at,
-            executionId: execution.id,
-            workflowId: authority.primitive.id,
-            runId: executor.runId,
-            status: run?.status ?? "incomplete",
-            runVisible: run !== undefined && canViewWorkflowRun2(runtime.authorization, run)
-          }
-        ];
-      }
-    }
-    const conversation = conversations.get(execution.id);
-    if (conversation) {
-      const cost = costByAgent.get(execution.id);
-      return [
-        {
-          kind: "agent",
-          at,
-          executionId: execution.id,
-          runId: conversation.id,
-          threadId: conversation.threadId,
-          status: conversation.status,
-          messages: messagesByThread.get(conversation.threadId) ?? 0,
-          ...cost === undefined ? {} : { cost }
-        }
-      ];
-    }
-    return [];
-  });
-  const recorded = [
-    ...page.pageViews.map((pageView) => ({
-      kind: "page",
-      at: new Date(pageView.receivedAt),
-      sequence: pageView.sequence,
-      route: pageView.route
-    })),
-    ...page.interactions.map((interaction) => ({
-      kind: "interaction",
-      at: new Date(interaction.receivedAt),
-      sequence: interaction.sequence,
-      name: interaction.name,
-      route: interaction.route
-    }))
-  ].sort((left, right) => left.sequence - right.sequence);
-  const cutoffs = [
-    page.hasMore ? recorded.at(-1)?.at : undefined,
-    ledger.truncated ? executions.filter((execution) => execution.source.type !== "execution").at(-1)?.createdAt : undefined
-  ].flatMap((at) => at === undefined ? [] : [at.getTime()]);
-  const cutoff = cutoffs.length > 0 ? Math.min(...cutoffs) : Number.POSITIVE_INFINITY;
-  const entries = [...recorded, ...executionEntries].filter((entry) => entry.at.getTime() <= cutoff).sort((left, right) => left.at.getTime() - right.at.getTime());
-  return {
-    visit,
-    ...connection === undefined ? {} : { connection },
-    entries,
-    truncated: page.hasMore || ledger.truncated
-  };
-}
-function sessionWindow(visit) {
-  const startedAt = visit.startedAt.getTime();
-  return {
-    from: new Date(startedAt - SESSION_GRACE_MS),
-    to: new Date(Math.min(visit.lastSeenAt.getTime() + SESSION_GRACE_MS, startedAt + ACTIVITY_MAX_VISIT_MS2 - SESSION_GRACE_MS))
-  };
-}
-function lineage(execution, byId) {
-  const chain = [];
-  let current = execution;
-  while (current) {
-    chain.push(current);
-    current = current.source.type === "execution" ? byId.get(current.source.executionId) : undefined;
-  }
-  return chain;
-}
-function rollUpCosts(byId, conversations, withAgent, costs) {
-  const grouped = new Map;
-  withAgent.forEach((execution, index) => {
-    const cost = costs[index];
-    const owner = lineage(execution, byId).find((ancestor) => conversations.has(ancestor.id));
-    if (!cost || !owner) {
-      return;
-    }
-    const summaries = grouped.get(owner.id) ?? [];
-    summaries.push(cost);
-    grouped.set(owner.id, summaries);
-  });
-  return new Map([...grouped].flatMap(([owner, summaries]) => {
-    const total = addCosts(summaries);
-    return total ? [[owner, total]] : [];
-  }));
-}
-function addCosts(summaries) {
-  const amounts = new Map;
-  let ratedCallCount = 0;
-  let unpriceableCallCount = 0;
-  let unvaluedCallCount = 0;
-  for (const summary of summaries) {
-    for (const money of summary.amounts) {
-      amounts.set(money.currency, (amounts.get(money.currency) ?? 0n) + BigInt(money.amountNanos));
-    }
-    ratedCallCount += summary.ratedCallCount;
-    unpriceableCallCount += summary.unpriceableCallCount;
-    unvaluedCallCount += summary.unvaluedCallCount;
-  }
-  if (ratedCallCount + unpriceableCallCount + unvaluedCallCount === 0) {
-    return;
-  }
-  return {
-    amounts: [...amounts].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([currency, amount]) => ({ currency, amountNanos: amount.toString() })),
-    ratedCallCount,
-    unpriceableCallCount,
-    unvaluedCallCount
-  };
-}
-async function readableObjects(runtime, subjects) {
-  const byType = new Map;
-  for (const subject of subjects) {
-    const items = byType.get(subject.objectTypeId) ?? new Map;
-    items.set(subject.primaryId, subject);
-    byType.set(subject.objectTypeId, items);
-  }
-  const readable = new Set;
-  await Promise.all([...byType.values()].map(async (items) => {
-    try {
-      const rows = await runtime.objectReader.getByPrimaryIdBatch({ items: [...items.values()] });
-      for (const key of rows.keys()) {
-        readable.add(key);
-      }
-    } catch (error) {
-      if (!(error instanceof AuthorizationError2)) {
-        throw error;
-      }
-    }
-  }));
-  return readable;
-}
-
-// src/activity/execution.ts
-var PROFILE_READ_CONCURRENCY = 8;
-function createActivityRuntime(runtime, service) {
-  const assertObservable = () => assertAuthorized2(runtime, { kind: "activity.observe" });
-  return {
-    async list(query) {
-      assertObservable();
-      const page = await service.list(query);
-      return { ...page, visits: await nameSharedVisits(runtime, page.visits) };
-    },
-    async users(query) {
-      assertObservable();
-      const page = await service.users(query);
-      const users = await mapInChunks(page.users, PROFILE_READ_CONCURRENCY, async (user) => {
-        const profile = await runtime.storage.auth?.users.getById({
-          projectId: runtime.projectId,
-          id: user.userId
-        });
-        return profile?.displayName ? { ...user, displayName: profile.displayName } : user;
-      });
-      return { users, hasMore: page.hasMore };
-    },
-    async summarize(query) {
-      assertObservable();
-      return service.summarize(query);
-    },
-    async calendar(query) {
-      assertObservable();
-      return service.calendar(query);
-    },
-    async timeline(visitId) {
-      assertObservable();
-      const page = await service.readWithSession({ id: visitId, limit: ACTIVITY_TIMELINE_LIMIT });
-      if (!page) {
-        return null;
-      }
-      const shared = await nameSharedVisit(runtime, page.visit);
-      return composeActivityTimeline(runtime, { ...shared, page }, new Date);
-    },
-    async connections(query) {
-      assertObservable();
-      return readActivityConnections(runtime, service, query, new Date);
-    }
-  };
-}
-function createActivityCaptureRuntime(runtime, service) {
-  return {
-    captureOptions() {
-      captureSource(runtime);
-      return service.captureOptions;
-    },
-    async capture(events) {
-      return service.capture(captureSource(runtime), events);
-    }
-  };
-}
-var activityCaptureKey = Symbol("sixb.activityCapture");
-function registerActivityCaptureRuntime(owner, capture) {
-  Object.defineProperty(owner, activityCaptureKey, {
-    configurable: false,
-    enumerable: false,
-    value: capture,
-    writable: false
-  });
-}
-function getActivityCaptureRuntime2(owner) {
-  const capture = owner[activityCaptureKey];
-  if (!capture) {
-    throw new Error("[Sixb] Activity capture is not registered for this execution.");
-  }
-  return capture;
-}
-function captureSource(runtime) {
-  const ref = getAuthorizationRef(runtime.runtimeAuthorization);
-  if (ref.type === "principal" && ref.principal.type === "user" && ref.credential?.type === "session") {
-    return {
-      actor: { type: "user", userId: ref.principal.id },
-      sessionId: ref.credential.id
-    };
-  }
-  if (ref.type === "delegated") {
-    return {
-      actor: { type: "share", grantId: ref.delegation.grantId },
-      sessionId: ref.delegation.sessionId
-    };
-  }
-  throw new AuthorizationError2("activity.capture", "[Sixb] Activity is recorded only for a signed-in user's session or a shared link's session.");
-}
-async function mapInChunks(items, size, map) {
-  const results = [];
-  for (let start = 0;start < items.length; start += size) {
-    const chunk = await Promise.all(items.slice(start, start + size).map(map));
-    results.push(...chunk);
-  }
-  return results;
-}
-
-// src/models/execution/session.ts
-class ModelExecutionSession {
-  runtime;
-  execution;
-  binding;
-  recorder;
-  constructor(runtime, execution) {
-    this.runtime = runtime;
-    this.execution = execution;
-  }
-  bind(input) {
-    if (this.binding)
-      throw new Error("[SixbModels] Execution attempt is already bound.");
-    this.binding = { ...input };
-  }
-  signal(signal) {
-    const binding = this.requireBinding();
-    return signal ? AbortSignal.any([binding.signal, signal]) : binding.signal;
-  }
-  async admitEmbeddingCall(admit) {
-    const admission = this.requireBinding().embeddingAdmission;
-    if (admission)
-      await admission(admit);
-    else
-      await admit();
-  }
-  accounting() {
-    const { accounting } = this.requireBinding();
-    this.recorder ??= accounting ? Promise.resolve(accounting) : this.createRecorder();
-    return this.recorder;
-  }
-  requireBinding() {
-    if (!this.binding) {
-      throw new Error("[SixbModels] Model calls require a bound request or worker execution attempt.");
-    }
-    return this.binding;
-  }
-  async createRecorder() {
-    const runtime = this.runtime;
-    const execution = this.execution;
-    const { attempt } = this.requireBinding();
-    const storage = {
-      ...requireAccountingCapabilities(runtime.storage),
-      transaction: runtime.storage.transaction.bind(runtime.storage)
-    };
-    const { requesterGroupIds } = await ensureExecutionRecord2(runtime.storage.executions, executionRecordInputFromRuntime({
-      execution,
-      runtimeAuthorization: runtime.runtimeAuthorization
-    }));
-    return new AiModelCallRecorder2({
-      storage,
-      projectId: runtime.projectId,
-      executionId: execution.id,
-      attempt,
-      requesterGroupIds,
-      limits: createAiModelCallLimitController2({
-        storage,
-        projectId: runtime.projectId,
-        requestedBy: execution.requestedBy,
-        requesterGroupIds
-      }),
-      recoverAiModelCall: (input) => enqueueAiModelCallRecovery2(runtime.queues.agents, input)
-    });
-  }
-}
-
-export { redactDomainEvent, createAuthorizedObjectReader, assertAuthorizedObjectReaderBinding, getAuthorizedOntologyView, readerClearance, readerEventClearance, registerOntologyMutationRuntime2, getOntologyMutationRuntime2, shareOntologyMutationRuntime2, createOntologyMutationRuntime2, canReadActionRunSubject, unreadableActionRunTypes, canDelegationAccessActionRun, actionRunBelongsToShareGrant, decodeActivityConnectionsCursor, resolveExecutionCosts, createActivityRuntime, createActivityCaptureRuntime, registerActivityCaptureRuntime, getActivityCaptureRuntime2, ModelExecutionSession };
+export { redactDomainEvent, uniqueLookupKeyOf, createAuthorizedObjectReader, assertAuthorizedObjectReaderBinding, getAuthorizedOntologyView, readerClearance, readerEventClearance, readerViewConditions };
 
-//# debugId=84DA6826BB3C05B764756E2164756E21
+//# debugId=2DBF13BEAC1BA51864756E2164756E21