@sixb/core 0.1.21 → 0.1.22

package/dist/execution/authorized-object-reader.d.ts

@@ -1,16 +1,23 @@
 import type { EmbeddingModelCatalog, RerankingModelCatalog } from "../models/catalog";
 import type { AuthorizedOntologyView } from "../objects/authorized-ontology-view";
 import { type ExecuteObjectCountInput, type ExecuteObjectCountResult, type ExecuteObjectExistsInput, type ExecuteObjectExistsResult, type ExecuteObjectFacetsInput, type ExecuteObjectFacetsResult, type ExecuteObjectQueryInput, type ExecuteObjectQueryLinksInput, type ExecuteObjectQueryLinksResult, type ExecuteObjectQueryResult } from "../objects/query";
+import type { ObjectQueryPredicate } from "../objects/query/ir";
 import { type TelemetryHistoryReadAdmission, type TelemetryHistoryReadWorkloadInput } from "../objects/telemetry/workload";
 import type { OntologyRegistry } from "../ontology";
 import type { AppliedMarkings } from "../security/applied-markings";
-import type { ObjectReadStorage, ObjectRow, ObjectStorage } from "../storage";
+import type { AuthUserStore, ObjectReadStorage, ObjectRow, ObjectStorage } from "../storage";
 import type { Clearance, EventSources } from "./object-reader-clearance";
 import { ObjectReaderOntology } from "./object-reader-ontology";
 import { ObjectReaderSecurity } from "./object-reader-security";
 import type { ExecutionScope } from "./types";
 type GetObjectInput = Omit<Parameters<ObjectReadStorage["getByPrimaryId"]>[0], "projectId">;
 type GetObjectsInput = Omit<Parameters<ObjectReadStorage["getByPrimaryIdBatch"]>[0], "projectId">;
+/** A caller's value, validated and keyed against the property's schema. */
+interface GetByUniqueValueInput {
+    readonly objectTypeId: string;
+    readonly propertyId: string;
+    readonly value: unknown;
+}
 type SelectObjectPropertiesInput = Parameters<ObjectReadStorage["selectsObjectProperties"]>[0];
 type CanReadObjectPropertyInput = SelectObjectPropertiesInput["items"][number];
 type CanReadObjectPropertiesBatchInput = Omit<SelectObjectPropertiesInput, "projectId">;
@@ -32,7 +39,8 @@ declare const readerConstructionKey: Readonly<{}>;
  *
  * Its state is grouped as a project is: the ontology it resolves against, the security of the
  * authority (its delegation and clearance included), the model catalogs search uses, and the
- * storage it reads. Each group decides what belongs to it; the reader composes them.
+ * storage it reads, with the member directory that expanded user properties resolve against.
+ * Each group decides what belongs to it; the reader composes them.
  */
 declare class AuthorizedObjectReaderImpl {
     #private;
@@ -41,16 +49,24 @@ declare class AuthorizedObjectReaderImpl {
         readonly security: ObjectReaderSecurity;
         readonly models: ObjectReaderModels;
         readonly storage: ObjectReadStorage;
+        readonly users?: AuthUserStore;
     });
     static assertBound(reader: AuthorizedObjectReaderImpl, scope: ExecutionScope): void;
     /** What the reader cannot read now, for surfaces such as events that redact on their own. */
     static clearance(reader: AuthorizedObjectReaderImpl): Promise<Clearance>;
     /** What the reader cannot read in an object event. */
     static eventClearance(reader: AuthorizedObjectReaderImpl, sources: EventSources): Clearance | Promise<Clearance>;
+    /** The conditions the reader views object types through, by concrete type. */
+    static viewConditions(reader: AuthorizedObjectReaderImpl): ReadonlyMap<string, ReaderViewCondition>;
     static ontologyView(reader: AuthorizedObjectReaderImpl): AuthorizedOntologyView;
     /** Project identity carried by this nominal reader capability. */
     get projectId(): string;
     getByPrimaryId(input: GetObjectInput): ReturnType<ObjectReadStorage["getByPrimaryId"]>;
+    /**
+     * The object of exactly `objectTypeId` holding a unique property's value, or null. A lookup by a
+     * marked property would reveal its value, so it needs the clearance a query predicate needs.
+     */
+    getByUniqueValue(input: GetByUniqueValueInput): Promise<ObjectRow | null>;
     getByPrimaryIdBatch(input: GetObjectsInput): ReturnType<ObjectReadStorage["getByPrimaryIdBatch"]>;
     canReadObjectProperty(input: CanReadObjectPropertyInput): Promise<boolean>;
     canReadObjectPropertiesBatch(input: CanReadObjectPropertiesBatchInput): Promise<readonly boolean[]>;
@@ -68,12 +84,26 @@ declare class AuthorizedObjectReaderImpl {
      * write, which it refuses when the writer cannot read the type at all.
      */
     writtenRowRedactor(objectTypeId: string): Promise<(<TRow extends ObjectRow>(row: TRow) => TRow)>;
+    /**
+     * The check a direct write runs on each object's properties before its commit claims them. It
+     * refuses a value for a unique property this authority cannot read: whether the write is refused
+     * as taken would reveal which values objects hold, as a `getBy` would.
+     */
+    uniqueValueWriteCheck(objectTypeId: string): Promise<(properties: Readonly<Record<string, unknown>>) => void>;
     /**
      * Refuse a write or a request that names an object type or link this authority cannot read,
      * before any lookup: it would answer whether what it names exists, and land where the reader
      * cannot see.
      */
     assertReadable(targets: ReadTargets): Promise<void>;
+    /**
+     * Whether this reader sees only the objects of a type that a condition matches. A write or a
+     * request that names such an object finds it through this reader first: one it cannot find is
+     * hidden or missing, and both answer alike.
+     */
+    viewsThroughCondition(objectTypeId: string): boolean;
+    /** Refuse a type this reader views neither whole nor through a condition. */
+    assertViewable(objectTypeIds: readonly string[]): Promise<void>;
     /** Enforce the delegated response budget without exposing or recombining its limits. */
     assertVisibleOutputWithinLimit(value: unknown): void;
     /** Admit adjacent telemetry work without exposing which authority policy was selected. */
@@ -89,6 +119,8 @@ export declare function createAuthorizedObjectReader(input: {
     readonly objectStorage: ObjectStorage;
     /** Markings of the dataset versions projections applied; the code's markings alone without. */
     readonly appliedMarkings?: AppliedMarkings;
+    /** The member directory expanded user properties resolve against. */
+    readonly users?: AuthUserStore;
 }): AuthorizedObjectReader;
 /** Reject recombining an authorized reader with any other execution authority. */
 export declare function assertAuthorizedObjectReaderBinding(input: {
@@ -108,6 +140,23 @@ export declare function readerClearance(reader: AuthorizedObjectReader): Promise
  * version.
  */
 export declare function readerEventClearance(reader: AuthorizedObjectReader, sources: EventSources): Clearance | Promise<Clearance>;
+/** A condition a reader views an object type through, for a surface that decides per object. */
+export interface ReaderViewCondition {
+    /** The condition, `currentUser()` bound, as the reader's storage reads it. */
+    readonly predicate: ObjectQueryPredicate;
+    /**
+     * Whether a clearance hides the type, or a property the condition reads: which objects match
+     * would reveal it, so the reader reads no object of the type.
+     */
+    hiddenBy(clearance: Clearance): boolean;
+}
+/**
+ * The conditions a reader views object types through, by concrete type: empty for a reader that
+ * views each type it reads whole. A type absent here is decided by its grants alone, which deny a
+ * type viewed only under a condition. Events match the state they carry against these, and read
+ * through the reader what they cannot decide from it.
+ */
+export declare function readerViewConditions(reader: AuthorizedObjectReader): ReadonlyMap<string, ReaderViewCondition>;
 /** What a write or a request names: object types, and links by their source type. */
 interface ReadTargets {
     readonly objectTypeIds: readonly string[];

package/dist/execution/authorized-object-reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorized-object-reader.d.ts","sourceRoot":"","sources":["../../src/execution/authorized-object-reader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA;AAOjF,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAK9B,MAAM,kBAAkB,CAAA;AAczB,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACvC,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,KAAK,EAIV,iBAAiB,EACjB,SAAS,EACT,aAAa,EACd,MAAM,YAAY,CAAA;AAGnB,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,oBAAoB,EAAmC,MAAM,0BAA0B,CAAA;AAChG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,KAAK,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AAC3F,KAAK,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACjG,KAAK,2BAA2B,GAAG,UAAU,CAAC,iBAAiB,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9F,KAAK,0BAA0B,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;AAC9E,KAAK,iCAAiC,GAAG,IAAI,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAA;AACvF,KAAK,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACnF,KAAK,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACtF,KAAK,mBAAmB,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AAEhG,2DAA2D;AAC3D,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;CAC3C;AAED,QAAA,MAAM,qBAAqB,cAAoB,CAAA;AAE/C;;;;;;;;;;GAUG;AACH,cAAM,0BAA0B;;gBAO5B,GAAG,EAAE,OAAO,qBAAqB,EACjC,KAAK,EAAE;QACL,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;QACvC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;QACvC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;QACnC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;KACpC;IAWH,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,0BAA0B,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAUnF,6FAA6F;WAChF,SAAS,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC;IAI9E,sDAAsD;IACtD,MAAM,CAAC,cAAc,CACnB,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,YAAY,GACpB,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAIjC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,0BAA0B,GAAG,sBAAsB;IAI/E,kEAAkE;IAClE,IAAI,SAAS,IAAI,MAAM,CAEtB;IAEK,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAkBtF,mBAAmB,CACvB,KAAK,EAAE,eAAe,GACrB,UAAU,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAuBjD,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,OAAO,CAAC;IAkB1E,4BAA4B,CAChC,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC;IAyBxB,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAwCpE,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAkB5E,cAAc,CAClB,KAAK,EAAE,mBAAmB,GACzB,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IA8B5C,YAAY,CAChB,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,GAChD,OAAO,CAAC,wBAAwB,CAAC;IAqB9B,UAAU,CACd,KAAK,EAAE,IAAI,CAAC,4BAA4B,EAAE,WAAW,CAAC,GACrD,OAAO,CAAC,6BAA6B,CAAC;IAmEnC,KAAK,CACT,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,GAChD,OAAO,CAAC,wBAAwB,CAAC;IAY9B,MAAM,CACV,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,GACjD,OAAO,CAAC,yBAAyB,CAAC;IAY/B,KAAK,CACT,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,GACjD,OAAO,CAAC,yBAAyB,CAAC;IA0CrC;;;;OAIG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,GACnB,OAAO,EAAC,CAAC,IAAI,SAAS,SAAS,EAAE,GAAG,EAAE,IAAI,KAAK,IAAI,EAAC;IAMvD;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzD,wFAAwF;IACxF,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAKpD,0FAA0F;IAC1F,yBAAyB,CACvB,KAAK,EAAE,iCAAiC,GACvC,6BAA6B;CA0FjC;AAKD,MAAM,MAAM,sBAAsB,GAAG,0BAA0B,CAAA;AAE/D,0FAA0F;AAC1F,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAA;IAChD,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAA;IAChD,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,+FAA+F;IAC/F,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAA;CAC3C,GAAG,sBAAsB,CAsBzB;AAED,kFAAkF;AAClF,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAC/B,GAAG,IAAI,CAEP;AAED,4FAA4F;AAC5F,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,sBAAsB,GAAG,sBAAsB,CAEhG;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,CAElF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,YAAY,GACpB,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAEhC;AAED,qFAAqF;AACrF,UAAU,WAAW;IACnB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CACvF"}
+{"version":3,"file":"authorized-object-reader.d.ts","sourceRoot":"","sources":["../../src/execution/authorized-object-reader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA;AAOjF,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAK9B,MAAM,kBAAkB,CAAA;AAIzB,OAAO,KAAK,EAAe,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAY5E,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACvC,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,KAAK,EACV,aAAa,EAIb,iBAAiB,EACjB,SAAS,EACT,aAAa,EACd,MAAM,YAAY,CAAA;AAGnB,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAE/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAG7C,KAAK,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AAC3F,KAAK,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACjG,2EAA2E;AAC3E,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CACxB;AACD,KAAK,2BAA2B,GAAG,UAAU,CAAC,iBAAiB,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9F,KAAK,0BAA0B,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;AAC9E,KAAK,iCAAiC,GAAG,IAAI,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAA;AACvF,KAAK,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACnF,KAAK,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACtF,KAAK,mBAAmB,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AAEhG,2DAA2D;AAC3D,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;CAC3C;AAED,QAAA,MAAM,qBAAqB,cAAoB,CAAA;AAE/C;;;;;;;;;;;GAWG;AACH,cAAM,0BAA0B;;gBAQ5B,GAAG,EAAE,OAAO,qBAAqB,EACjC,KAAK,EAAE;QACL,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;QACvC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAA;QACvC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;QACnC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;QACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAA;KAC/B;IAYH,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,0BAA0B,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAUnF,6FAA6F;WAChF,SAAS,CAAC,MAAM,EAAE,0BAA0B,GAAG,OAAO,CAAC,SAAS,CAAC;IAI9E,sDAAsD;IACtD,MAAM,CAAC,cAAc,CACnB,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,YAAY,GACpB,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAIjC,8EAA8E;IAC9E,MAAM,CAAC,cAAc,CACnB,MAAM,EAAE,0BAA0B,GACjC,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC;IAgB3C,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,0BAA0B,GAAG,sBAAsB;IAI/E,kEAAkE;IAClE,IAAI,SAAS,IAAI,MAAM,CAEtB;IAEK,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAkB5F;;;OAGG;IACG,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IA+BzE,mBAAmB,CACvB,KAAK,EAAE,eAAe,GACrB,UAAU,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAuBjD,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,OAAO,CAAC;IAc1E,4BAA4B,CAChC,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC;IAmBxB,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAwCpE,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAkB5E,cAAc,CAClB,KAAK,EAAE,mBAAmB,GACzB,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IA8B5C,YAAY,CAChB,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,GAChD,OAAO,CAAC,wBAAwB,CAAC;IAwB9B,UAAU,CACd,KAAK,EAAE,IAAI,CAAC,4BAA4B,EAAE,WAAW,CAAC,GACrD,OAAO,CAAC,6BAA6B,CAAC;IAmEnC,KAAK,CACT,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,GAChD,OAAO,CAAC,wBAAwB,CAAC;IAY9B,MAAM,CACV,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,GACjD,OAAO,CAAC,yBAAyB,CAAC;IAY/B,KAAK,CACT,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,GACjD,OAAO,CAAC,yBAAyB,CAAC;IA0CrC;;;;OAIG;IACG,kBAAkB,CACtB,YAAY,EAAE,MAAM,GACnB,OAAO,EAAC,CAAC,IAAI,SAAS,SAAS,EAAE,GAAG,EAAE,IAAI,KAAK,IAAI,EAAC;IAMvD;;;;OAIG;IACG,qBAAqB,CACzB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;IAqBnE;;;;OAIG;IACG,cAAc,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzD;;;;OAIG;IACH,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAIpD,6EAA6E;IACvE,cAAc,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrE,wFAAwF;IACxF,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAKpD,0FAA0F;IAC1F,yBAAyB,CACvB,KAAK,EAAE,iCAAiC,GACvC,6BAA6B;CAyJjC;AAKD,MAAM,MAAM,sBAAsB,GAAG,0BAA0B,CAAA;AAE/D,0FAA0F;AAC1F,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAA;IAChD,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,CAAA;IAChD,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,+FAA+F;IAC/F,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAA;IAC1C,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAA;CAC/B,GAAG,sBAAsB,CAyBzB;AAED,kFAAkF;AAClF,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAC/B,GAAG,IAAI,CAEP;AAED,4FAA4F;AAC5F,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,sBAAsB,GAAG,sBAAsB,CAEhG;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,SAAS,CAAC,CAElF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,YAAY,GACpB,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAEhC;AAED,gGAAgG;AAChG,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAA;IACxC;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAA;CACxC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,sBAAsB,GAC7B,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAE1C;AAED,qFAAqF;AACrF,UAAU,WAAW;IACnB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CACvF"}

package/dist/execution/lineage.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The nearest of an execution and its ancestors that `isOwner` accepts, walking up through
+ * `parentOf`: where a roll-up counts what the execution spent. Undefined when the walk runs out of
+ * known parents first.
+ */
+export declare function nearestOwner(executionId: string, parentOf: (executionId: string) => string | undefined, isOwner: (executionId: string) => boolean): string | undefined;
+//# sourceMappingURL=lineage.d.ts.map

package/dist/execution/lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lineage.d.ts","sourceRoot":"","sources":["../../src/execution/lineage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EACrD,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,GACxC,MAAM,GAAG,SAAS,CAIpB"}

package/dist/execution/object-reader-ontology.d.ts

@@ -1,11 +1,11 @@
 import { type AuthorizedOntologyView } from "../objects/authorized-ontology-view";
 import type { OntologyRegistry } from "../ontology";
-import type { ResolvedExecutionAuthority } from "./object-reader-security";
+import type { ObjectReaderSecurity } from "./object-reader-security";
 /** The ontology a reader resolves against, and the part of it its authority may describe. */
 export declare class ObjectReaderOntology {
     #private;
     readonly registry: OntologyRegistry;
-    constructor(registry: OntologyRegistry, authority: ResolvedExecutionAuthority);
+    constructor(registry: OntologyRegistry, security: ObjectReaderSecurity);
     /** Inert metadata for the types the authority may view, built on first use. */
     view(): AuthorizedOntologyView;
 }

package/dist/execution/object-reader-ontology.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"object-reader-ontology.d.ts","sourceRoot":"","sources":["../../src/execution/object-reader-ontology.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,sBAAsB,EAE5B,MAAM,qCAAqC,CAAA;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAA;AAE1E,6FAA6F;AAC7F,qBAAa,oBAAoB;;IAC/B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;gBAIvB,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,0BAA0B;IAM7E,+EAA+E;IAC/E,IAAI,IAAI,sBAAsB;CAc/B"}
+{"version":3,"file":"object-reader-ontology.d.ts","sourceRoot":"","sources":["../../src/execution/object-reader-ontology.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,sBAAsB,EAE5B,MAAM,qCAAqC,CAAA;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAEpE,6FAA6F;AAC7F,qBAAa,oBAAoB;;IAC/B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;gBAIvB,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,oBAAoB;IAMtE,+EAA+E;IAC/E,IAAI,IAAI,sBAAsB;CAc/B"}

package/dist/execution/object-reader-security.d.ts

@@ -1,11 +1,12 @@
 import type { AuthorizationContext } from "../authorization/types";
 import { type SelectedObjectQueryAdmission } from "../objects/query/selected-read-admission";
 import type { OntologyRegistry } from "../ontology";
+import type { UserRef } from "../ontology/user-ref";
 import type { AppliedMarkings } from "../security/applied-markings";
-import type { ObjectLinkRow } from "../storage";
+import type { CompiledConditionalObjectReadScope, ObjectLinkRow } from "../storage";
 import type { resolveExecutionScopeAuthorization } from "./authorization";
 import { type Clearance, ObjectReaderClearance } from "./object-reader-clearance";
-import type { RuntimeAuthorization } from "./types";
+import type { AuthorizablePrincipal, RuntimeAuthorization } from "./types";
 export type ResolvedExecutionAuthority = ReturnType<typeof resolveExecutionScopeAuthorization>;
 export type RuntimeReadAuthorization = {
     readonly projectId: string;
@@ -20,9 +21,15 @@ export interface ObjectReaderDelegation {
 }
 /**
  * Who reads, and what it may read: the exact execution authority, the selection a delegated one
- * carries, and its clearance. It decides whether an object type or a link is viewable.
+ * carries, the conditions a principal reads some types through, and its clearance. It decides
+ * whether an object type or a link is viewable.
+ *
+ * A type a principal views only through a condition is viewable here, and nowhere else: the
+ * reader's storage shows only the objects the condition matches. A check that answers for one
+ * object of such a type reads that object through the same storage.
  */
 export declare class ObjectReaderSecurity {
+    #private;
     /** The registered authority the reader is bound to. */
     readonly authorization: RuntimeAuthorization;
     readonly authority: ResolvedExecutionAuthority;
@@ -31,14 +38,28 @@ export declare class ObjectReaderSecurity {
     /** Present for delegated authority only. */
     readonly delegation?: ObjectReaderDelegation;
     readonly clearance: ObjectReaderClearance;
+    /** The user `currentUser()` stands for in this reader's queries; absent when no user reads. */
+    readonly requestingUser?: UserRef;
+    /** What the reader's storage reads through: present when a principal views a type under one. */
+    readonly conditionalScope?: CompiledConditionalObjectReadScope;
     constructor(input: {
         readonly authorization: RuntimeAuthorization;
         readonly authority: ResolvedExecutionAuthority;
         readonly projectId: string;
         readonly ontology: OntologyRegistry;
         readonly appliedMarkings?: AppliedMarkings;
+        readonly requestedBy: AuthorizablePrincipal | undefined;
     });
     assertObjectTypesViewable(objectTypeIds: readonly string[], clearance: Clearance): void;
+    /**
+     * Refuse a type a principal holds no view grant for, before its clearance is applied to what it
+     * reads. A type viewed through a condition passes while the clearance shows every property the
+     * condition reads.
+     */
+    assertObjectTypesGranted(objectTypeIds: readonly string[], clearance: Clearance): void;
+    /** Whether the principal views this type only through a condition, which decides per object. */
+    viewsThroughCondition(objectTypeId: string): boolean;
+    isObjectTypeGranted(objectTypeId: string, clearance: Clearance): boolean;
     isObjectTypeViewable(objectTypeId: string, clearance: Clearance): boolean;
     isLinkViewable(link: ObjectLinkRow, clearance: Clearance): boolean;
 }

package/dist/execution/object-reader-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"object-reader-security.d.ts","sourceRoot":"","sources":["../../src/execution/object-reader-security.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAElE,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,0CAA0C,CAAA;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,KAAK,EAA0B,aAAa,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,KAAK,SAAS,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAEnD,MAAM,MAAM,0BAA0B,GAAG,UAAU,CAAC,OAAO,kCAAkC,CAAC,CAAA;AAE9F,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAA;IACnD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;CAC9C,CAAA;AAED,6FAA6F;AAC7F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7C,QAAQ,CAAC,cAAc,EAAE,4BAA4B,CAAA;CACtD;AAED;;;GAGG;AACH,qBAAa,oBAAoB;IAC/B,uDAAuD;IACvD,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAA;IAC9C,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAA;IAC1C,4CAA4C;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAA;IAC5C,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAA;gBAE7B,KAAK,EAAE;QACjB,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;QAC5C,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAA;QAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;QACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAA;KAC3C;IA4BD,yBAAyB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI;IAuBvF,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO;IAMzE,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO;CAWnE"}
+{"version":3,"file":"object-reader-security.d.ts","sourceRoot":"","sources":["../../src/execution/object-reader-security.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAIlE,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,0CAA0C,CAAA;AACjD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,KAAK,EACV,kCAAkC,EAElC,aAAa,EACd,MAAM,YAAY,CAAA;AAEnB,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,KAAK,SAAS,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAE1E,MAAM,MAAM,0BAA0B,GAAG,UAAU,CAAC,OAAO,kCAAkC,CAAC,CAAA;AAE9F,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAA;IACnD,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;CAC9C,CAAA;AAED,6FAA6F;AAC7F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7C,QAAQ,CAAC,cAAc,EAAE,4BAA4B,CAAA;CACtD;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAoB;;IAC/B,uDAAuD;IACvD,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAA;IAC9C,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAA;IAC1C,4CAA4C;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAA;IAC5C,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAA;IACzC,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,gGAAgG;IAChG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,kCAAkC,CAAA;gBAIlD,KAAK,EAAE;QACjB,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;QAC5C,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAA;QAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;QAC1B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;QACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAA;QAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,GAAG,SAAS,CAAA;KACxD;IAwDD,yBAAyB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI;IAqBvF;;;;OAIG;IACH,wBAAwB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI;IActF,gGAAgG;IAChG,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAIpD,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO;IAUxE,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO;IAKzE,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO;CAgBnE"}

package/dist/execution/object-reader-users.d.ts

@@ -0,0 +1,20 @@
+import type { UserExpansionPlan } from "../objects/query/user-expansions";
+import type { OntologyRegistry } from "../ontology";
+import type { AuthUserStore, ObjectRow } from "../storage";
+/**
+ * Attach the member profiles a query expands to the rows the reader returns.
+ *
+ * Every row whose type declares an expanded property gets `users`, so reading an entry never
+ * throws. An entry is left out when the reader may not view the directory, and when the reader
+ * cannot read the value: the rows have already lost their hidden values and carry `redactions`,
+ * so a marked value is never looked up. The rows must be the reader's own copies.
+ */
+export declare function attachUserProfiles(input: {
+    readonly rows: readonly ObjectRow[];
+    readonly plan: UserExpansionPlan;
+    readonly ontology: OntologyRegistry;
+    readonly projectId: string;
+    readonly canViewUsers: boolean;
+    readonly users: AuthUserStore | undefined;
+}): Promise<void>;
+//# sourceMappingURL=object-reader-users.d.ts.map

package/dist/execution/object-reader-users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object-reader-users.d.ts","sourceRoot":"","sources":["../../src/execution/object-reader-users.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,KAAK,EACV,aAAa,EAEb,SAAS,EAGV,MAAM,YAAY,CAAA;AAcnB;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,CAAA;CAC1C,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhB"}

package/dist/execution/preparation.d.ts

@@ -0,0 +1,23 @@
+import { type PreparedActionRequest } from "../actions/request";
+import type { SixbRuntimeContext } from "../runtime/types";
+import { type PreparedWorkflowRequest } from "../workflows/request";
+import type { WorkflowDefinition } from "../workflows/types";
+import type { ExecutionContext } from "./types";
+export interface ActionRequestToPrepare {
+    readonly actionId: string;
+    readonly subject?: PreparedActionRequest["subject"];
+    readonly params?: Record<string, unknown>;
+}
+export interface WorkflowRequestToPrepare {
+    readonly workflowId: string;
+    readonly input?: Readonly<Record<string, unknown>>;
+}
+/** Let infrastructure prepare requests with a bound SDK's authority. */
+export declare function registerRequestPreparation(owner: object, runtime: SixbRuntimeContext, execution: ExecutionContext, workflows: {
+    getById(workflowId: string): WorkflowDefinition | null;
+}): void;
+/** Admit an Action request as `sixb.actions.request` would, and return it normalized. */
+export declare function prepareBoundActionRequest(sixb: object, input: ActionRequestToPrepare): Promise<PreparedActionRequest>;
+/** Admit a workflow start as `sixb.workflows.requestById` would, and return its input snapshot. */
+export declare function prepareBoundWorkflowRequest(sixb: object, input: WorkflowRequestToPrepare): PreparedWorkflowRequest;
+//# sourceMappingURL=preparation.d.ts.map

package/dist/execution/preparation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preparation.d.ts","sourceRoot":"","sources":["../../src/execution/preparation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAAwB,MAAM,oBAAoB,CAAA;AACrF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,KAAK,uBAAuB,EAA0B,MAAM,sBAAsB,CAAA;AAC3F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAE/C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAA;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CACnD;AAcD,wEAAwE;AACxE,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE;IAAE,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAAA;CAAE,GACpE,IAAI,CAiBN;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAEhC;AAED,mGAAmG;AACnG,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,wBAAwB,GAC9B,uBAAuB,CAEzB"}

package/dist/execution/primitive.js

@@ -1,77 +1,81 @@
 // @bun
 import {
   bindDurablePrimitiveExecution2
-} from "../chunk-akzryx9h.js";
-import"../chunk-0bphap9y.js";
-import"../chunk-ky3j490c.js";
-import"../chunk-cfj9dfbb.js";
-import"../chunk-z58tm0hm.js";
-import"../chunk-rmakanzx.js";
-import"../chunk-6rqgmkde.js";
+} from "../chunk-7gr4j2eq.js";
+import"../chunk-6p0pastb.js";
+import"../chunk-02bzjgnt.js";
+import"../chunk-d2m879s4.js";
+import"../chunk-0phpbbvm.js";
+import"../chunk-h33shhq6.js";
+import"../chunk-2626mh4m.js";
 import"../chunk-3qms4nax.js";
-import"../chunk-bk9svbcq.js";
-import"../chunk-vf57cr4t.js";
-import"../chunk-mfs23znk.js";
-import"../chunk-1cc1xaf3.js";
-import"../chunk-99nd4rc1.js";
-import"../chunk-q7gn29y3.js";
-import"../chunk-cn0fwwhy.js";
-import"../chunk-918wwnaa.js";
+import"../chunk-7mc2wkre.js";
+import"../chunk-hyesv9dv.js";
+import"../chunk-07kkp2e1.js";
+import"../chunk-fp2kq35z.js";
+import"../chunk-2gjj5dx3.js";
+import"../chunk-dp0cdtj2.js";
+import"../chunk-5a4a52tq.js";
+import"../chunk-6y0mkhex.js";
+import"../chunk-1t6k1avb.js";
+import"../chunk-c844dkwd.js";
+import"../chunk-m427qgq0.js";
+import"../chunk-48jezz3j.js";
+import"../chunk-npcr0228.js";
+import"../chunk-8ncg20rd.js";
+import"../chunk-sgx82nnt.js";
+import"../chunk-r6szek0x.js";
+import"../chunk-qhqgp4jf.js";
+import"../chunk-7z5p905k.js";
+import"../chunk-efmm01gj.js";
+import"../chunk-ezne9wc9.js";
 import"../chunk-qf954wje.js";
-import"../chunk-9j4jw7as.js";
-import"../chunk-tbc1ngpd.js";
-import"../chunk-pbcbn83d.js";
-import"../chunk-qczk96d9.js";
+import"../chunk-6rrtzea3.js";
+import"../chunk-fe8zwt8b.js";
+import"../chunk-hqsp2sx4.js";
+import"../chunk-2adz0h75.js";
 import"../chunk-mmagke4x.js";
-import"../chunk-vvxtn22d.js";
+import"../chunk-g663fahq.js";
 import"../chunk-hn2r7z41.js";
-import"../chunk-br3k6qbf.js";
+import"../chunk-fm62y49k.js";
 import"../chunk-jmfet9r4.js";
-import"../chunk-3qct2mdc.js";
-import"../chunk-ere85b8y.js";
-import"../chunk-rj69qcrd.js";
-import"../chunk-4as3wt1c.js";
+import"../chunk-nydf3dbe.js";
+import"../chunk-0xmt5p5y.js";
+import"../chunk-pgrf64hp.js";
+import"../chunk-4ymrcdbm.js";
 import"../chunk-eptrvnby.js";
-import"../chunk-d09e3rax.js";
+import"../chunk-hwarjrgf.js";
 import"../chunk-h89wz928.js";
 import"../chunk-x0v3jd47.js";
-import"../chunk-dhcv7yxc.js";
-import"../chunk-a40ad1ft.js";
-import"../chunk-g257jwnc.js";
-import"../chunk-7n440zgt.js";
-import"../chunk-29yx306f.js";
-import"../chunk-pqajwytd.js";
-import"../chunk-5a4a52tq.js";
-import"../chunk-431pyp2c.js";
-import"../chunk-e17zdm62.js";
-import"../chunk-q5e5tv4b.js";
-import"../chunk-m427qgq0.js";
-import"../chunk-cy4mbddw.js";
-import"../chunk-xvsc5m8n.js";
+import"../chunk-c0vk1djt.js";
+import"../chunk-mbsbxarb.js";
+import"../chunk-cswhawa2.js";
+import"../chunk-tdxfsg1c.js";
+import"../chunk-pdt5cw8z.js";
+import"../chunk-h3pbv7n8.js";
+import"../chunk-6n69k945.js";
+import"../chunk-cdk3egjj.js";
+import"../chunk-bab05bhg.js";
+import"../chunk-zrvhsq7f.js";
+import"../chunk-73v685wb.js";
+import"../chunk-5grk14e5.js";
+import"../chunk-yc9ners4.js";
+import"../chunk-rap5w0x0.js";
+import"../chunk-65pyhyas.js";
+import"../chunk-4y26vs3v.js";
+import"../chunk-vhbw5sqm.js";
 import"../chunk-cwdzcv37.js";
 import"../chunk-gfdh9kqa.js";
-import"../chunk-8ncg20rd.js";
-import"../chunk-pfp1txq2.js";
-import"../chunk-5948n82c.js";
-import"../chunk-9kgkfg6v.js";
-import"../chunk-nn5xnx3s.js";
-import"../chunk-447a5c0p.js";
-import"../chunk-s7jg7pmn.js";
-import"../chunk-f4pamkt9.js";
-import"../chunk-hcbyfxbe.js";
-import"../chunk-6vb4st8k.js";
-import"../chunk-v4jbb3rs.js";
-import"../chunk-8frc8a4j.js";
-import"../chunk-dhdha526.js";
-import"../chunk-dvd2fp9q.js";
+import"../chunk-zbc929zg.js";
 import"../chunk-6eqsgvxk.js";
-import"../chunk-48qjhh6v.js";
+import"../chunk-qx00vjrj.js";
 import"../chunk-a3faa34j.js";
 import"../chunk-wkv3h3q7.js";
-import"../chunk-7q8t23v4.js";
-import"../chunk-mjddfa7k.js";
+import"../chunk-waqk73p1.js";
+import"../chunk-3fqxbn31.js";
+import"../chunk-hz5d43gn.js";
 export {
   bindDurablePrimitiveExecution2 as bindDurablePrimitiveExecution
 };
 
-//# debugId=42478EB7DC83C4BB64756E2164756E21
+//# debugId=7C5D1F4B2F995C0864756E2164756E21

package/dist/execution/primitive.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "42478EB7DC83C4BB64756E2164756E21",
+  "debugId": "7C5D1F4B2F995C0864756E2164756E21",
   "names": []
 }

package/dist/execution/request.d.ts

@@ -4,7 +4,7 @@ import { type ShareAccessPlan } from "../shares/access-plan";
 import type { ObjectReadExecutionLimits } from "../storage/objects/execution-limits";
 import type { AuthorizationRef, ExecutionScope } from "./types";
 export type { ActionRunsRuntime, ActionsRuntime } from "../actions/execution";
-export type { AgentRunListResult, AgentRunsRuntime, AgentRuntime, AgentRunView, AgentThreadsRuntime, CreateExecutionAgentThreadInput, ExecutionAgentRequestInput, ExecutionAgentRunResult, ListExecutionAgentThreadsInput, } from "../agents/execution";
+export type { AgentRunListResult, AgentRunsRuntime, AgentRuntime, AgentRunView, AgentThreadsRuntime, CreateExecutionAgentThreadInput, ExecutionAgentRequestInput, ExecutionAgentRunResult, ListExecutionAgentThreadsInput, ObservedAgentThreadsRuntime, } from "../agents/execution";
 export type { AgentDescriptor } from "../agents/types";
 export type { AuthorizationContext } from "../authorization";
 export type { DatasetsRuntime } from "../datasets/execution";
@@ -19,6 +19,7 @@ export type { Sixb } from "../runtime/sixb";
 export type { AgentThreadRecord, ListAgentThreadsResult } from "../storage/agents";
 export type { SyncRunsRuntime, SyncsRuntime } from "../syncs/execution";
 export type { LatestWorkflowRunListResult, ListWorkflowRunNodesInput, WorkflowAgentNodeRunView, WorkflowInterventionsRuntime, WorkflowNodeRunListResult, WorkflowNodeRunView, WorkflowRunListResult, WorkflowRunsRuntime, WorkflowRunView, WorkflowsRuntime, } from "../workflows/execution";
+export { prepareBoundActionRequest, prepareBoundWorkflowRequest } from "./preparation";
 export type { AuthorizationRef, ExecutionContext } from "./types";
 export type RequestExecutionAuthorization = {
     readonly type: "principal";

package/dist/execution/request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/execution/request.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAE5D,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAA;AAMpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE/D,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC7E,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxD,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AACtF,YAAY,EACV,yBAAyB,EACzB,kBAAkB,EAClB,cAAc,GACf,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACzE,YAAY,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAClF,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACvE,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC5B,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAEjE,MAAM,MAAM,6BAA6B,GACrC;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC,YAAY,CAAC,CAAA;CAC9F,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,yBAAyB,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAC3B,CAAA;CACF,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEjC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,6BAA6B,CAAA;CACtD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAAA;CACzC;AAED,kGAAkG;AAClG,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,yBAAyB,GAC/B,IAAI,CAWN"}
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/execution/request.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAE5D,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAA;AAMpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE/D,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC7E,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxD,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AACtF,YAAY,EACV,yBAAyB,EACzB,kBAAkB,EAClB,cAAc,GACf,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACzE,YAAY,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAClF,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACvE,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC5B,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAA;AACtF,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAEjE,MAAM,MAAM,6BAA6B,GACrC;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC,YAAY,CAAC,CAAA;CAC9F,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,yBAAyB,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAC3B,CAAA;CACF,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEjC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,6BAA6B,CAAA;CACtD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAAA;CACzC;AAED,kGAAkG;AAClG,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,yBAAyB,GAC/B,IAAI,CAWN"}