@sixb/core 0.1.6 → 0.1.8

package/dist/chunk-h5vqbfmd.js

@@ -0,0 +1,1537 @@
+// @bun
+import {
+  countObjects,
+  executeObjectQuery,
+  executeObjectQueryLinks,
+  existsObjects,
+  facetObjects,
+  preflightObjectQueryLinks,
+  validateObjectFacetRequests,
+  validateObjectQuery,
+  validateObjectQueryWithAdmission
+} from "./chunk-q0k9nc5a.js";
+import {
+  ObjectQueryValidationError
+} from "./chunk-rte5sm3z.js";
+import {
+  createPrimitiveExecutionRecord,
+  ensureExecutionRecord,
+  executionRecordInputFromRuntime
+} from "./chunk-k522z7v6.js";
+import {
+  actionRunParamsEqual,
+  actionSubjectsEqual,
+  isTerminalActionRun
+} from "./chunk-sbzzr4kx.js";
+import {
+  ACTION_RUN_FAILURE_CODES,
+  parseActionRunFailure
+} from "./chunk-ka3a2ft3.js";
+import {
+  ActionRunError
+} from "./chunk-w1tvjszy.js";
+import {
+  findPrimitiveParentRequestExecution
+} from "./chunk-j1sbhm7p.js";
+import {
+  reportRunFailure
+} from "./chunk-jq43kdvk.js";
+import {
+  isObjectActionDefinition,
+  normalizeActionParams,
+  resolveObjectActionSubject,
+  validateActionSubject
+} from "./chunk-4sm0aznx.js";
+import {
+  createLinkTokenMap,
+  createPropertyTokenMap
+} from "./chunk-19jp6g9d.js";
+import {
+  AuthorizationError,
+  MAX_OBJECT_READ_FACETS,
+  assertAuthorized,
+  assertObjectReadOutputWithinLimit,
+  canViewActionRun,
+  captureExecutionScope,
+  getAuthorizationRef,
+  isAllowed,
+  resolveExecutionScopeAuthorization,
+  resolveRuntimeAuthorizationForProject
+} from "./chunk-p1x242ad.js";
+import {
+  OntologyNotFoundError,
+  OntologyValidationError,
+  formatUnknownObjectTypeMessage
+} from "./chunk-dktq02ne.js";
+import {
+  createSixbError,
+  toSixbFailure
+} from "./chunk-2xns679x.js";
+
+// src/objects/action/errors.ts
+class ActionValidationError extends Error {
+  name = "ActionValidationError";
+  actionId;
+  subject;
+  primaryId;
+  constructor(message, params) {
+    super(message);
+    this.actionId = params.actionId;
+    this.subject = params.subject;
+    this.primaryId = params.subject.kind === "object" ? params.subject.primaryId : undefined;
+  }
+}
+
+class ActionRunFailedError extends Error {
+  name = "ActionRunFailedError";
+  runId;
+  actionId;
+  subject;
+  objectTypeId;
+  primaryId;
+  error;
+  finishedAt;
+  constructor(payload) {
+    super(payload.error.message);
+    this.runId = payload.runId;
+    this.actionId = payload.actionId;
+    this.subject = payload.subject;
+    this.objectTypeId = payload.subject.kind === "object" ? payload.subject.objectTypeId : undefined;
+    this.primaryId = payload.subject.kind === "object" ? payload.subject.primaryId : undefined;
+    this.error = payload.error;
+    this.finishedAt = payload.finishedAt;
+  }
+}
+
+class ActionRunTimeoutError extends Error {
+  name = "ActionRunTimeoutError";
+  runId;
+  timeoutMs;
+  constructor(params) {
+    super(`Action run '${params.runId}' did not finish within ${params.timeoutMs}ms.`);
+    this.runId = params.runId;
+    this.timeoutMs = params.timeoutMs;
+  }
+}
+
+// src/objects/authorized-ontology-view.ts
+function createAuthorizedOntologyView(input) {
+  const allObjectTypes = input.ontology.listObjectTypes();
+  const registeredObjectTypeIds = new Set(allObjectTypes.map((objectType) => objectType.id));
+  const requestedObjectTypeIds = selectedObjectTypeIds(input.selection, allObjectTypes);
+  const visibleObjectTypeIds = new Set([...requestedObjectTypeIds].filter((objectTypeId) => registeredObjectTypeIds.has(objectTypeId)));
+  const selectedSchema = input.selection.kind === "selected" ? collectSelectedSchema(input.selection.scope) : undefined;
+  const projectedObjectTypes = [];
+  for (const objectType of allObjectTypes) {
+    if (!visibleObjectTypeIds.has(objectType.id))
+      continue;
+    const propertyIds = selectedSchema?.propertyIdsByObjectType.get(objectType.id) ?? new Set(objectType.properties.map((property) => property.id));
+    const links = selectedSchema ? selectedSchema.linksBySourceType.get(objectType.id) ?? new Map : input.selection.kind === "all" ? allDeclaredLinks(objectType) : allVisibleLinks(input.ontology, objectType, visibleObjectTypeIds);
+    projectedObjectTypes.push(projectObjectType({
+      objectType,
+      propertyIds,
+      links,
+      visibleObjectTypeIds,
+      ontology: input.ontology,
+      targetMode: input.selection.kind === "all" ? "original" : input.selection.kind === "types" ? "principal" : "exact",
+      exposeContracts: input.selection.kind !== "selected"
+    }));
+  }
+  const objectTypes = projectedObjectTypes;
+  const objectTypesById = new Map(objectTypes.map((objectType) => [objectType.id, objectType]));
+  const valueTypesById = input.selection.kind === "selected" ? collectVisibleValueTypes(input.ontology.getValueTypesById(), objectTypes) : snapshotAllValueTypes(input.ontology.getValueTypesById());
+  const release = (value, budgetValue = value) => {
+    input.assertOutputWithinLimit?.(budgetValue);
+    return value;
+  };
+  const cloneObjectType = (objectType) => structuredClone(objectType);
+  const cloneValueTypes = () => new Map([...valueTypesById].map(([valueTypeId, valueType]) => [
+    valueTypeId,
+    structuredClone(valueType)
+  ]));
+  return Object.freeze({
+    listObjectTypes: () => release(objectTypes.map(cloneObjectType)),
+    getObjectTypeById: (objectTypeId) => {
+      const objectType = objectTypesById.get(objectTypeId);
+      return release(objectType ? cloneObjectType(objectType) : null);
+    },
+    resolveObjectType: (objectTypeId) => {
+      const objectType = objectTypesById.get(objectTypeId);
+      return objectType ? release(cloneObjectType(objectType)) : unknownObjectType(objectTypeId);
+    },
+    getValueTypesById: () => {
+      const valueTypes = cloneValueTypes();
+      return release(valueTypes, [...valueTypes.entries()]);
+    },
+    getPrimaryPropertyId: (objectTypeId) => {
+      const objectType = objectTypesById.get(objectTypeId);
+      if (!objectType)
+        return unknownObjectType(objectTypeId);
+      const primary = objectType.properties.find((property) => property.primary);
+      if (!primary) {
+        throw new OntologyValidationError(`[Sixb] Object type '${objectTypeId}' does not expose its primary property in this execution scope.`);
+      }
+      return release(primary.id);
+    },
+    listSubTypes: (objectTypeId) => {
+      const subTypes = visibleObjectTypeIds.has(objectTypeId) ? input.ontology.listSubTypes(objectTypeId).filter((subTypeId) => visibleObjectTypeIds.has(subTypeId)) : [];
+      return release(subTypes);
+    },
+    isValidLinkTarget: (expected, actual) => {
+      if (input.selection.kind === "all") {
+        return release(input.ontology.isValidLinkTarget(expected, actual));
+      }
+      if (!visibleObjectTypeIds.has(actual))
+        return release(false);
+      const expectedTypes = Array.isArray(expected) ? expected : [expected];
+      if (input.selection.kind === "selected") {
+        return release(expectedTypes.some((expectedType) => expectedType === "*" || expectedType === actual));
+      }
+      return release(expectedTypes.some((expectedType) => expectedType === "*" || visibleObjectTypeIds.has(expectedType) && input.ontology.isValidLinkTarget(expectedType, actual)));
+    }
+  });
+}
+function selectedObjectTypeIds(selection, allObjectTypes) {
+  switch (selection.kind) {
+    case "all":
+      return new Set(allObjectTypes.map((objectType) => objectType.id));
+    case "types":
+      return new Set(selection.objectTypeIds);
+    case "selected":
+      return new Set(selection.scope.objects.map((object) => object.objectTypeId));
+  }
+}
+function collectSelectedSchema(scope) {
+  const propertyIdsByObjectType = new Map;
+  for (const object of scope.objects) {
+    const properties = propertyIdsByObjectType.get(object.objectTypeId) ?? new Set;
+    for (const propertyId of object.propertyIds)
+      properties.add(propertyId);
+    propertyIdsByObjectType.set(object.objectTypeId, properties);
+  }
+  const linksBySourceType = new Map;
+  for (const step of scope.steps) {
+    const links = linksBySourceType.get(step.sourceObjectTypeId) ?? new Map;
+    const selected = links.get(step.linkId) ?? {
+      targetObjectTypeIds: new Set,
+      propertyIds: new Set
+    };
+    selected.targetObjectTypeIds.add(step.targetObjectTypeId);
+    for (const propertyId of step.propertyIds)
+      selected.propertyIds.add(propertyId);
+    links.set(step.linkId, selected);
+    linksBySourceType.set(step.sourceObjectTypeId, links);
+  }
+  return { propertyIdsByObjectType, linksBySourceType };
+}
+function allDeclaredLinks(objectType) {
+  return new Map(objectType.links.map((link) => [
+    link.id,
+    {
+      targetObjectTypeIds: new Set(typeof link.targetObjectTypeId === "string" ? [link.targetObjectTypeId] : link.targetObjectTypeId),
+      propertyIds: new Set(link.properties?.map((property) => property.id) ?? [])
+    }
+  ]));
+}
+function allVisibleLinks(ontology, objectType, visibleObjectTypeIds) {
+  const links = new Map;
+  for (const link of objectType.links) {
+    const targetObjectTypeIds = new Set([...visibleObjectTypeIds].filter((targetObjectTypeId) => ontology.isValidLinkTarget(link.targetObjectTypeId, targetObjectTypeId)));
+    if (targetObjectTypeIds.size === 0)
+      continue;
+    links.set(link.id, {
+      targetObjectTypeIds,
+      propertyIds: new Set(link.properties?.map((property) => property.id) ?? [])
+    });
+  }
+  return links;
+}
+function projectObjectType(input) {
+  const properties = input.objectType.properties.filter((property) => input.propertyIds.has(property.id)).map(snapshotProperty);
+  const visiblePropertyIds = new Set(properties.map((property) => property.id));
+  const links = input.objectType.links.flatMap((link) => {
+    const selected = input.links.get(link.id);
+    if (!selected)
+      return [];
+    if (input.targetMode === "original") {
+      return [snapshotLink(link, snapshotLinkTarget(link.targetObjectTypeId), selected.propertyIds)];
+    }
+    const targetObjectTypeIds = new Set([...selected.targetObjectTypeIds].filter((targetObjectTypeId) => input.visibleObjectTypeIds.has(targetObjectTypeId) && input.ontology.isValidLinkTarget(link.targetObjectTypeId, targetObjectTypeId)));
+    if (targetObjectTypeIds.size === 0)
+      return [];
+    const target = input.targetMode === "principal" ? principalLinkTargets(link, targetObjectTypeIds, input.visibleObjectTypeIds) : exactLinkTargets(targetObjectTypeIds);
+    return [snapshotLink(link, target, selected.propertyIds, { omitEmptyProperties: true })];
+  });
+  const projected = {
+    id: input.objectType.id,
+    name: input.objectType.name,
+    description: input.objectType.description,
+    quantityKind: input.objectType.quantityKind,
+    seeAlso: input.objectType.seeAlso ? [...input.objectType.seeAlso] : undefined,
+    extends: input.objectType.extends && input.visibleObjectTypeIds.has(input.objectType.extends) ? input.objectType.extends : undefined,
+    parents: projectOptionalIds(input.objectType.parents, input.visibleObjectTypeIds, input.targetMode === "original"),
+    implements: input.exposeContracts && input.objectType.implements ? [...input.objectType.implements] : undefined,
+    properties,
+    links,
+    search: projectSearch(input.objectType.search, visiblePropertyIds, {
+      preserveEmpty: input.targetMode !== "exact"
+    })
+  };
+  const withTokens = {
+    ...projected,
+    p: createPropertyTokenMap(projected),
+    l: createLinkTokenMap(projected)
+  };
+  return deepFreeze(withTokens);
+}
+function principalLinkTargets(link, allowedTargetObjectTypeIds, visibleObjectTypeIds) {
+  if (link.targetObjectTypeId === "*")
+    return exactLinkTargets(allowedTargetObjectTypeIds);
+  const declared = Array.isArray(link.targetObjectTypeId) ? link.targetObjectTypeId : [link.targetObjectTypeId];
+  if (declared.every((objectTypeId) => visibleObjectTypeIds.has(objectTypeId))) {
+    return snapshotLinkTarget(link.targetObjectTypeId);
+  }
+  return exactLinkTargets(allowedTargetObjectTypeIds);
+}
+function exactLinkTargets(targetObjectTypeIds) {
+  const targets = [...targetObjectTypeIds].sort();
+  return targets.length === 1 ? targets[0] : targets;
+}
+function projectOptionalIds(ids, visibleObjectTypeIds, preserveOriginal) {
+  if (!ids)
+    return;
+  if (preserveOriginal)
+    return [...ids];
+  const visible = ids.filter((id) => visibleObjectTypeIds.has(id));
+  return visible.length > 0 ? visible : undefined;
+}
+function snapshotLink(link, targetObjectTypeId, propertyIds, options = {}) {
+  const properties = link.properties?.filter((property) => propertyIds.has(property.id)).map(snapshotProperty);
+  return {
+    id: link.id,
+    name: link.name,
+    description: link.description,
+    targetObjectTypeId,
+    cardinality: link.cardinality,
+    properties: options.omitEmptyProperties && properties?.length === 0 ? undefined : properties
+  };
+}
+function snapshotLinkTarget(target) {
+  return typeof target === "string" ? target : [...target];
+}
+function snapshotProperty(property) {
+  return {
+    id: property.id,
+    name: property.name,
+    schema: snapshotSchema(property.schema),
+    description: property.description,
+    required: property.required,
+    nullable: property.nullable,
+    primary: property.primary,
+    mode: property.mode,
+    semanticType: property.semanticType,
+    query: snapshotPropertyQuery(property.query)
+  };
+}
+function snapshotPropertyQuery(query) {
+  if (!query)
+    return;
+  return {
+    searchable: query.searchable,
+    filterable: query.filterable,
+    sortable: query.sortable,
+    text: query.text,
+    exact: query.exact,
+    facet: query.facet,
+    vector: query.vector,
+    weight: query.weight
+  };
+}
+function projectSearch(search, visiblePropertyIds, options) {
+  if (!search)
+    return;
+  const title = search.title && visiblePropertyIds.has(search.title) ? search.title : undefined;
+  const selectedDefaultText = search.defaultText?.filter((propertyId) => visiblePropertyIds.has(propertyId));
+  const selectedExact = search.exact?.filter((propertyId) => visiblePropertyIds.has(propertyId));
+  const defaultText = options.preserveEmpty || selectedDefaultText?.length ? selectedDefaultText : undefined;
+  const exact = options.preserveEmpty || selectedExact?.length ? selectedExact : undefined;
+  const vector = search.vector && visiblePropertyIds.has(search.vector.property) && search.vector.source.every((propertyId) => visiblePropertyIds.has(propertyId)) ? { property: search.vector.property, source: [...search.vector.source] } : undefined;
+  const projected = {
+    ...title === undefined ? {} : { title },
+    ...defaultText === undefined ? {} : { defaultText },
+    ...exact === undefined ? {} : { exact },
+    ...vector === undefined ? {} : { vector }
+  };
+  return Object.keys(projected).length > 0 || options.preserveEmpty ? projected : undefined;
+}
+function snapshotAllValueTypes(registered) {
+  return new Map([...registered.values()].map((valueType) => {
+    const snapshot = snapshotValueType(valueType);
+    return [snapshot.id, snapshot];
+  }));
+}
+function collectVisibleValueTypes(registered, objectTypes) {
+  const referencedIds = new Set;
+  const pendingSchemas = [];
+  const visitedSchemas = new Set;
+  for (const objectType of objectTypes) {
+    for (const property of objectType.properties)
+      pendingSchemas.push(property.schema);
+    for (const link of objectType.links) {
+      for (const property of link.properties ?? [])
+        pendingSchemas.push(property.schema);
+    }
+  }
+  while (pendingSchemas.length > 0) {
+    const schema = pendingSchemas.pop();
+    if (typeof schema === "string" || visitedSchemas.has(schema))
+      continue;
+    visitedSchemas.add(schema);
+    if (schema.type === "valueTypeRef") {
+      if (!referencedIds.has(schema.valueTypeId)) {
+        referencedIds.add(schema.valueTypeId);
+        const valueType = registered.get(schema.valueTypeId);
+        if (valueType)
+          pendingSchemas.push(valueType.schema);
+      }
+      if (schema._resolved)
+        pendingSchemas.push(schema._resolved);
+    } else if (schema.type === "object") {
+      for (const field of Object.values(schema.properties))
+        pendingSchemas.push(field.schema);
+    } else if (schema.type === "array") {
+      pendingSchemas.push(schema.items);
+    } else if (schema.type === "map") {
+      pendingSchemas.push(schema.valueSchema);
+    }
+  }
+  return new Map([...referencedIds].map((valueTypeId) => registered.get(valueTypeId)).filter((valueType) => valueType !== undefined).map((valueType) => {
+    const snapshot = snapshotValueType(valueType);
+    return [snapshot.id, snapshot];
+  }));
+}
+function snapshotValueType(valueType) {
+  return deepFreeze({
+    id: valueType.id,
+    name: valueType.name,
+    description: valueType.description,
+    schema: snapshotSchema(valueType.schema),
+    semanticType: valueType.semanticType
+  });
+}
+function snapshotSchema(schema) {
+  return deepFreeze(structuredClone(schema));
+}
+function deepFreeze(value, seen = new Set) {
+  if (typeof value !== "object" || value === null || seen.has(value))
+    return value;
+  seen.add(value);
+  for (const key of Reflect.ownKeys(value)) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor && "value" in descriptor)
+      deepFreeze(descriptor.value, seen);
+  }
+  return Object.freeze(value);
+}
+function unknownObjectType(objectTypeId) {
+  throw new OntologyNotFoundError(formatUnknownObjectTypeMessage(objectTypeId));
+}
+
+// src/objects/query/selected-read-admission.ts
+var selectedStateBrand = Symbol("sixb.selected-object-query-admission-state");
+function createSelectedObjectQueryAdmission(scope) {
+  const selectionByKey = new Map;
+  const selectionsByType = new Map;
+  const propertiesBySelection = new Map;
+  for (const selection of scope.objects) {
+    const key = selectionKey(selection.nodeId, selection.objectTypeId);
+    selectionByKey.set(key, selection);
+    propertiesBySelection.set(key, new Set(selection.propertyIds));
+    const byType = selectionsByType.get(selection.objectTypeId) ?? [];
+    byType.push(selection);
+    selectionsByType.set(selection.objectTypeId, byType);
+  }
+  const outgoing = indexSteps(scope.steps, "outgoing", selectionByKey);
+  const incoming = indexSteps(scope.steps, "incoming", selectionByKey);
+  const emptyState = selectedState([]);
+  const admission = {
+    empty: () => emptyState,
+    source: (input) => {
+      const selections = input.result.objectTypeIds.flatMap((objectTypeId2) => selectionsByType.get(objectTypeId2) ?? []);
+      const state = selectedState(selections);
+      if (input.kind === "refs") {
+        const missingType = [...new Set(input.refs?.map((ref) => ref.objectTypeId) ?? [])].sort().find((objectTypeId2) => !selectionsByType.has(objectTypeId2));
+        if (missingType) {
+          return denied(state, new AuthorizationError(`view:object:${missingType}`, `[Sixb] Delegated query cannot reference object type '${missingType}' at '${input.path}': the selected object scope does not contain that type.`));
+        }
+      }
+      if (state.selections.length > 0)
+        return { state };
+      const objectTypeId = input.objectTypeId ?? input.result.objectTypeIds[0] ?? "unknown";
+      return denied(state, new AuthorizationError(`view:object:${objectTypeId}`, `[Sixb] Delegated query cannot start from object type '${objectTypeId}' at '${input.path}': the selected object scope does not contain that type.`));
+    },
+    property: (input) => propertyDenial(asSelectedState(input.state), input.propertyId, input.objectTypeId, input.use, input.path, propertiesBySelection),
+    edge: (input) => {
+      const state = asSelectedState(input.state);
+      const next = followEdge(state, input.linkId, input.direction, input.sourceObjectTypeId, outgoing, incoming, input.result.objectTypeIds);
+      if (next.selections.length > 0 || state.selections.length === 0)
+        return { state: next };
+      return denied(next, edgeDenial(state, input.linkId, input.direction, input.sourceObjectTypeId, input.use, input.path));
+    },
+    set: ({ op, states }) => {
+      if (op === "subtract")
+        return asSelectedState(states[0] ?? emptyState);
+      return selectedState(states.flatMap((state) => asSelectedState(state).selections));
+    },
+    assertPropertySelected: (input) => {
+      const denial = propertyDenial(asSelectedState(input.state), input.propertyId, input.objectTypeId, input.use, input.path, propertiesBySelection);
+      if (denial)
+        throw denial;
+    },
+    assertIncidentEdgeSelected: (input) => {
+      if (input.linkId === undefined)
+        return;
+      const state = asSelectedState(input.state);
+      const directions = input.direction === "both" ? ["outgoing", "incoming"] : [input.direction];
+      const next = selectedState(directions.flatMap((direction) => followEdge(state, input.linkId, direction, undefined, outgoing, incoming).selections));
+      if (next.selections.length > 0 || state.selections.length === 0)
+        return;
+      throw edgeDenial(state, input.linkId, input.direction, undefined, "queryLinks", input.path);
+    }
+  };
+  return Object.freeze(admission);
+}
+function indexSteps(steps, direction, selectionByKey) {
+  const index = new Map;
+  for (const step of steps) {
+    const fromKey = direction === "outgoing" ? selectionKey(step.parentNodeId, step.sourceObjectTypeId) : selectionKey(step.nodeId, step.targetObjectTypeId);
+    const toKey = direction === "outgoing" ? selectionKey(step.nodeId, step.targetObjectTypeId) : selectionKey(step.parentNodeId, step.sourceObjectTypeId);
+    const target = selectionByKey.get(toKey);
+    if (!selectionByKey.has(fromKey) || !target) {
+      throw new Error("[Sixb] Compiled selected object scope contains an invalid query path step.");
+    }
+    const key = edgeKey(direction === "outgoing" ? step.parentNodeId : step.nodeId, direction === "outgoing" ? step.sourceObjectTypeId : step.targetObjectTypeId, step.linkId);
+    const targets = index.get(key) ?? [];
+    targets.push(target);
+    index.set(key, targets);
+  }
+  return index;
+}
+function followEdge(state, linkId, direction, sourceObjectTypeId, outgoing, incoming, resultObjectTypeIds) {
+  const index = direction === "outgoing" ? outgoing : incoming;
+  const resultTypes = resultObjectTypeIds ? new Set(resultObjectTypeIds) : undefined;
+  const selections = state.selections.flatMap((selection) => {
+    const candidates = index.get(edgeKey(selection.nodeId, selection.objectTypeId, linkId)) ?? [];
+    return candidates.filter((candidate) => (resultTypes === undefined || resultTypes.has(candidate.objectTypeId)) && (direction === "outgoing" || sourceObjectTypeId === undefined || candidate.objectTypeId === sourceObjectTypeId));
+  });
+  return selectedState(selections);
+}
+function propertyDenial(state, propertyId, objectTypeId, use, path, propertiesBySelection) {
+  const candidates = objectTypeId ? state.selections.filter((selection) => selection.objectTypeId === objectTypeId) : state.selections;
+  if (candidates.length === 0)
+    return;
+  const missing = candidates.find((selection) => !propertiesBySelection.get(selectionKey(selection.nodeId, selection.objectTypeId))?.has(propertyId));
+  if (!missing)
+    return;
+  const objectTypeIds = [...new Set(candidates.map((selection) => selection.objectTypeId))].sort();
+  return new AuthorizationError(`view:object:${objectTypeIds.join(",")}:property:${propertyId}`, `[Sixb] Delegated query cannot use property '${propertyId}' for ${use} at '${path}': it is not selected on every matching read-scope path (missing on ${formatSelection(missing)}).`);
+}
+function edgeDenial(state, linkId, direction, sourceObjectTypeId, use, path) {
+  const source = sourceObjectTypeId ? `:${sourceObjectTypeId}` : "";
+  return new AuthorizationError(`view:link:${direction}${source}:${linkId}`, `[Sixb] Delegated query cannot use ${direction} link '${linkId}' for ${use} from ${formatState(state)} at '${path}': that exact read-scope path is not selected.`);
+}
+function formatState(state) {
+  if (state.selections.length === 0)
+    return "an empty read-scope provenance";
+  return `read-scope provenance ${state.selections.map(formatSelection).join(", ")}`;
+}
+function formatSelection(selection) {
+  return `'${selection.objectTypeId}'@node ${selection.nodeId}`;
+}
+function selectedState(selections) {
+  const unique = new Map;
+  for (const selection of selections) {
+    unique.set(selectionKey(selection.nodeId, selection.objectTypeId), selection);
+  }
+  return Object.freeze({
+    [selectedStateBrand]: true,
+    selections: Object.freeze([...unique.values()].sort((left, right) => left.nodeId - right.nodeId || left.objectTypeId.localeCompare(right.objectTypeId)))
+  });
+}
+function asSelectedState(state) {
+  if (state[selectedStateBrand] !== true) {
+    throw new Error("[Sixb] Object query admission state belongs to another semantic admission.");
+  }
+  return state;
+}
+function denied(state, denial) {
+  return { state, denial };
+}
+function selectionKey(nodeId, objectTypeId) {
+  return JSON.stringify([nodeId, objectTypeId]);
+}
+function edgeKey(nodeId, objectTypeId, linkId) {
+  return JSON.stringify([nodeId, objectTypeId, linkId]);
+}
+
+// src/objects/telemetry/workload.ts
+var MAX_DELEGATED_TELEMETRY_HISTORY_SERIES = 100;
+var MAX_DELEGATED_TELEMETRY_HISTORY_POINTS = 1e4;
+var DEFAULT_DELEGATED_TELEMETRY_HISTORY_LIMIT_PER_SERIES = 100;
+
+class TelemetryHistoryWorkloadExceededError extends Error {
+  metric;
+  limit;
+  name = "TelemetryHistoryWorkloadExceededError";
+  code = "telemetry_history_workload_exceeded";
+  constructor(metric, limit) {
+    super(`[Sixb] Delegated telemetry history exceeded its ${metric} limit (${limit}).`);
+    this.metric = metric;
+    this.limit = limit;
+  }
+}
+function admitTelemetryHistoryReadWorkload(input, delegated) {
+  const seriesCount = input.seriesCount;
+  const limitPerSeries = input.limitPerSeries;
+  if (!Number.isSafeInteger(seriesCount) || seriesCount < 0) {
+    throw new Error("[Sixb] Telemetry history series must have a non-negative safe integer length.");
+  }
+  if (limitPerSeries !== undefined && (!Number.isSafeInteger(limitPerSeries) || limitPerSeries < 0)) {
+    throw new Error("[Sixb] Telemetry history limit must be a non-negative safe integer.");
+  }
+  if (!delegated) {
+    const admission = limitPerSeries === undefined ? {} : { limitPerSeries };
+    return Object.freeze(admission);
+  }
+  if (seriesCount > MAX_DELEGATED_TELEMETRY_HISTORY_SERIES) {
+    throw new TelemetryHistoryWorkloadExceededError("series", MAX_DELEGATED_TELEMETRY_HISTORY_SERIES);
+  }
+  if (seriesCount === 0) {
+    return Object.freeze({
+      ...limitPerSeries === undefined ? {} : { limitPerSeries },
+      maxPointOccurrences: MAX_DELEGATED_TELEMETRY_HISTORY_POINTS
+    });
+  }
+  const maxLimitPerSeries = Math.floor(MAX_DELEGATED_TELEMETRY_HISTORY_POINTS / seriesCount);
+  const effectiveLimitPerSeries = limitPerSeries ?? Math.min(DEFAULT_DELEGATED_TELEMETRY_HISTORY_LIMIT_PER_SERIES, maxLimitPerSeries);
+  if (effectiveLimitPerSeries > maxLimitPerSeries) {
+    throw new TelemetryHistoryWorkloadExceededError("points", MAX_DELEGATED_TELEMETRY_HISTORY_POINTS);
+  }
+  return Object.freeze({
+    limitPerSeries: effectiveLimitPerSeries,
+    maxPointOccurrences: MAX_DELEGATED_TELEMETRY_HISTORY_POINTS
+  });
+}
+
+// src/execution/authorized-object-reader.ts
+var readerConstructionKey = Object.freeze({});
+
+class AuthorizedObjectReaderImpl {
+  #authorization;
+  #authority;
+  #runtime;
+  #ontology;
+  #ontologyView;
+  #storage;
+  #delegatedObjectTypeIds;
+  #delegatedLinkDefinitions;
+  #delegatedQueryAdmission;
+  constructor(key, input) {
+    if (key !== readerConstructionKey) {
+      throw new Error("[Sixb] AuthorizedObjectReader can only be created by Core.");
+    }
+    this.#authorization = input.scope.authorization;
+    this.#authority = input.authority;
+    this.#ontology = input.ontology;
+    this.#storage = input.storage;
+    this.#delegatedObjectTypeIds = input.authority.type === "delegated" ? new Set(input.authority.objectRead.scope.objects.map((object) => object.objectTypeId)) : undefined;
+    this.#delegatedLinkDefinitions = input.authority.type === "delegated" ? new Set(input.authority.objectRead.scope.steps.map(delegatedLinkDefinitionKey)) : undefined;
+    this.#delegatedQueryAdmission = input.authority.type === "delegated" ? createSelectedObjectQueryAdmission(input.authority.objectRead.scope) : undefined;
+    this.#runtime = Object.freeze({
+      projectId: input.scope.execution.projectId,
+      runtimeAuthorization: input.scope.authorization,
+      ...input.authority.type === "principal" ? { authorization: input.authority.context } : {}
+    });
+  }
+  static assertBound(reader, scope) {
+    const capturedScope = captureExecutionScope(scope);
+    resolveExecutionScopeAuthorization(reader.#runtime.projectId, capturedScope);
+    if (capturedScope.authorization !== reader.#authorization) {
+      throw new Error("[Sixb] AuthorizedObjectReader is not bound to this exact execution authority.");
+    }
+  }
+  static ontologyView(reader) {
+    const authority = reader.#authority;
+    reader.#ontologyView ??= createAuthorizedOntologyView({
+      ontology: reader.#ontology,
+      selection: ontologySelectionForAuthority(authority, reader.#ontology),
+      ...authority.type === "delegated" ? {
+        assertOutputWithinLimit: (value) => assertObjectReadOutputWithinLimit(value, authority.objectRead.limits)
+      } : {}
+    });
+    return reader.#ontologyView;
+  }
+  get projectId() {
+    return this.#runtime.projectId;
+  }
+  async getByPrimaryId(input) {
+    const request = snapshotReadValue({
+      objectTypeId: input.objectTypeId,
+      primaryId: input.primaryId
+    });
+    this.#assertObjectTypesViewable([request.objectTypeId]);
+    return detachReadResult(await this.#storage.getByPrimaryId({
+      ...request,
+      projectId: this.#runtime.projectId
+    }));
+  }
+  async getByPrimaryIdBatch(input) {
+    const request = snapshotReadValue({
+      items: input.items.map((item) => ({
+        objectTypeId: item.objectTypeId,
+        primaryId: item.primaryId
+      }))
+    });
+    this.#assertObjectTypesViewable(request.items.map((item) => item.objectTypeId));
+    return detachReadResult(await this.#storage.getByPrimaryIdBatch({
+      ...request,
+      projectId: this.#runtime.projectId
+    }));
+  }
+  async canReadObjectProperty(input) {
+    const request = snapshotReadValue({
+      objectTypeId: input.objectTypeId,
+      primaryId: input.primaryId,
+      propertyId: input.propertyId
+    });
+    this.#assertObjectTypesViewable([request.objectTypeId]);
+    if (this.#authority.type !== "delegated")
+      return true;
+    const [readable] = await this.#storage.selectsObjectProperties({
+      projectId: this.#runtime.projectId,
+      items: [request]
+    });
+    return readable ?? false;
+  }
+  async canReadObjectPropertiesBatch(input) {
+    const request = snapshotReadValue({
+      items: input.items.map((item) => ({
+        objectTypeId: item.objectTypeId,
+        primaryId: item.primaryId,
+        propertyId: item.propertyId
+      }))
+    });
+    this.#assertObjectTypesViewable(request.items.map((item) => item.objectTypeId));
+    if (this.#authority.type !== "delegated")
+      return request.items.map(() => true);
+    return detachReadResult(await this.#storage.selectsObjectProperties({
+      ...request,
+      projectId: this.#runtime.projectId
+    }));
+  }
+  async list(input) {
+    const request = snapshotReadValue({
+      objectTypeId: typeof input.objectTypeId === "string" ? input.objectTypeId : input.objectTypeId === undefined ? undefined : [...input.objectTypeId],
+      primaryIdPrefix: input.primaryIdPrefix,
+      primaryIdSuffix: input.primaryIdSuffix,
+      updatedAfter: input.updatedAfter,
+      updatedBefore: input.updatedBefore,
+      createdAfter: input.createdAfter,
+      createdBefore: input.createdBefore,
+      limit: input.limit,
+      offset: input.offset,
+      orderBy: input.orderBy,
+      order: input.order
+    });
+    const objectTypeId = this.#resolveListObjectTypes(request.objectTypeId);
+    if (Array.isArray(objectTypeId) && objectTypeId.length === 0) {
+      return { objects: [], hasMore: false, total: 0 };
+    }
+    return detachReadResult(await this.#storage.list({
+      ...request,
+      ...objectTypeId === undefined ? {} : { objectTypeId },
+      projectId: this.#runtime.projectId
+    }));
+  }
+  async listLinks(input) {
+    const request = snapshotReadValue({
+      objectTypeId: input.objectTypeId,
+      objectId: input.objectId,
+      linkId: input.linkId,
+      direction: input.direction
+    });
+    this.#assertObjectTypesViewable([request.objectTypeId]);
+    const links = detachReadResult(await this.#storage.listLinks({
+      ...request,
+      projectId: this.#runtime.projectId
+    }));
+    return links.filter((link) => this.#isLinkViewable(link));
+  }
+  async listLinksBatch(input) {
+    const request = snapshotReadValue({
+      direction: input.direction,
+      items: input.items.map((item) => ({
+        objectTypeId: item.objectTypeId,
+        objectId: item.objectId,
+        linkId: item.linkId
+      }))
+    });
+    this.#assertObjectTypesViewable(request.items.map((item) => item.objectTypeId));
+    const pages = detachReadResult(await this.#storage.listLinksBatch({
+      ...request,
+      projectId: this.#runtime.projectId
+    }));
+    const filtered = new Map;
+    for (const [key, links] of pages) {
+      filtered.set(key, links.filter((link) => this.#isLinkViewable(link)));
+    }
+    return filtered;
+  }
+  async executeQuery(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const includeTotal = snapshotReadValue(input.includeTotal);
+    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query;
+    return detachReadResult(await executeObjectQuery({
+      query: executionQuery,
+      ...includeTotal === undefined ? {} : { includeTotal },
+      projectId: this.#runtime.projectId
+    }, this.#queryExecutorOptions()));
+  }
+  async queryLinks(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const request = snapshotReadValue({
+      direction: input.direction,
+      linkId: input.linkId,
+      includeObjects: input.includeObjects,
+      pageSize: input.pageSize,
+      pageToken: input.pageToken
+    });
+    let executionQuery = query;
+    const admission = this.#delegatedQueryAdmission;
+    if (admission) {
+      const preflight = preflightObjectQueryLinks({ query, ...request, projectId: this.#runtime.projectId }, { ontology: this.#ontology });
+      const admitted = validateObjectQueryWithAdmission(preflight.validated.query, { ontology: this.#ontology, normalize: false }, admission);
+      admission.assertIncidentEdgeSelected({
+        state: admitted.admissionState,
+        ...preflight.linkId === undefined ? {} : { linkId: preflight.linkId },
+        direction: preflight.direction,
+        path: "$.linkId"
+      });
+      executionQuery = admitted.query;
+    }
+    const result = detachReadResult(await executeObjectQueryLinks({ query: executionQuery, ...request, projectId: this.#runtime.projectId }, this.#queryExecutorOptions()));
+    if (result.objects.some((row) => !this.#isObjectTypeViewable(row.objectTypeId)) || result.links.some((link) => !this.#isLinkViewable(link))) {
+      throw new Error("[Sixb] Object storage returned a link page outside its authorized scope.");
+    }
+    return result;
+  }
+  async count(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query;
+    return detachReadResult(await countObjects({ query: executionQuery, projectId: this.#runtime.projectId }, this.#queryExecutorOptions()));
+  }
+  async exists(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const executionQuery = this.#admitDelegatedQuery(query)?.query ?? query;
+    return detachReadResult(await existsObjects({ query: executionQuery, projectId: this.#runtime.projectId }, this.#queryExecutorOptions()));
+  }
+  async facet(input) {
+    const query = snapshotAuthoredQuery(input.query);
+    const facets = snapshotFacetRequests(input.facets);
+    let executionQuery = query;
+    let executionFacets = facets;
+    const admission = this.#delegatedQueryAdmission;
+    if (admission) {
+      const validated = validateObjectQuery(query, { ontology: this.#ontology });
+      const normalizedFacets = validateObjectFacetRequests(facets, validated.result.objectTypeIds, {
+        ontology: this.#ontology
+      });
+      const admitted = validateObjectQueryWithAdmission(validated.query, { ontology: this.#ontology, normalize: false }, admission);
+      normalizedFacets.forEach((facet, index) => {
+        admission.assertPropertySelected({
+          state: admitted.admissionState,
+          propertyId: facet.propertyId,
+          use: "facet",
+          path: `$.facets[${index}].propertyId`
+        });
+      });
+      executionQuery = admitted.query;
+      executionFacets = normalizedFacets;
+    }
+    return detachReadResult(await facetObjects({
+      query: executionQuery,
+      facets: executionFacets,
+      projectId: this.#runtime.projectId
+    }, this.#queryExecutorOptions()));
+  }
+  assertVisibleOutputWithinLimit(value) {
+    if (this.#authority.type !== "delegated")
+      return;
+    assertObjectReadOutputWithinLimit(value, this.#authority.objectRead.limits);
+  }
+  admitTelemetryHistoryRead(input) {
+    return admitTelemetryHistoryReadWorkload(input, this.#authority.type === "delegated");
+  }
+  #queryExecutorOptions() {
+    if (this.#authority.type === "delegated") {
+      return { ontology: this.#ontology, storage: this.#storage };
+    }
+    return {
+      ontology: this.#ontology,
+      storage: this.#storage,
+      runtimeAuthorization: this.#runtime.runtimeAuthorization,
+      ...this.#runtime.authorization === undefined ? {} : { authorization: this.#runtime.authorization }
+    };
+  }
+  #admitDelegatedQuery(query) {
+    if (!this.#delegatedQueryAdmission)
+      return;
+    return validateObjectQueryWithAdmission(query, { ontology: this.#ontology }, this.#delegatedQueryAdmission);
+  }
+  #assertObjectTypesViewable(objectTypeIds) {
+    if (this.#authority.type === "delegated") {
+      for (const objectTypeId of new Set(objectTypeIds)) {
+        if (this.#delegatedObjectTypeIds?.has(objectTypeId))
+          continue;
+        throw new AuthorizationError(`delegated:object.view:${objectTypeId}`, `[Sixb] Delegated authorization does not select object type '${objectTypeId}'.`);
+      }
+      return;
+    }
+    for (const objectTypeId of new Set(objectTypeIds)) {
+      assertAuthorized(this.#runtime, { kind: "object.view", objectTypeId });
+    }
+  }
+  #resolveListObjectTypes(requested) {
+    if (requested !== undefined) {
+      const objectTypeIds = typeof requested === "string" ? [requested] : [...new Set(requested)];
+      for (const objectTypeId of objectTypeIds) {
+        this.#ontology.resolveObjectType(objectTypeId);
+      }
+      this.#assertObjectTypesViewable(objectTypeIds);
+      return typeof requested === "string" ? requested : objectTypeIds;
+    }
+    if (this.#authority.type === "unrestricted")
+      return;
+    return this.#ontology.listObjectTypes().map((objectType) => objectType.id).filter((objectTypeId) => this.#isObjectTypeViewable(objectTypeId));
+  }
+  #isObjectTypeViewable(objectTypeId) {
+    if (this.#authority.type === "delegated") {
+      return this.#delegatedObjectTypeIds?.has(objectTypeId) ?? false;
+    }
+    return isAllowed(this.#runtime.authorization, { kind: "object.view", objectTypeId });
+  }
+  #isLinkViewable(link) {
+    if (!this.#isObjectTypeViewable(link.sourceTypeId) || !this.#isObjectTypeViewable(link.targetTypeId)) {
+      return false;
+    }
+    return this.#delegatedLinkDefinitions?.has(delegatedLinkDefinitionKey(link)) ?? this.#authority.type !== "delegated";
+  }
+}
+Object.freeze(AuthorizedObjectReaderImpl.prototype);
+Object.freeze(AuthorizedObjectReaderImpl);
+function createAuthorizedObjectReader(input) {
+  const scope = captureExecutionScope(input.scope);
+  const projectId = scope.execution.projectId;
+  const authority = resolveExecutionScopeAuthorization(projectId, scope);
+  const storage = objectStorageForAuthority(authority, input.objectStorage);
+  const reader = new AuthorizedObjectReaderImpl(readerConstructionKey, {
+    scope,
+    ontology: input.ontology,
+    storage,
+    authority
+  });
+  Object.freeze(reader);
+  return reader;
+}
+function assertAuthorizedObjectReaderBinding(input) {
+  AuthorizedObjectReaderImpl.assertBound(input.reader, input.scope);
+}
+function getAuthorizedOntologyView(reader) {
+  return AuthorizedObjectReaderImpl.ontologyView(reader);
+}
+function objectStorageForAuthority(authority, objectStorage) {
+  switch (authority.type) {
+    case "principal":
+    case "unrestricted":
+      return objectStorage;
+    case "delegated":
+      return objectStorage.createSelectedReadScope({
+        projectId: authority.projectId,
+        scope: authority.objectRead.scope,
+        limits: authority.objectRead.limits
+      });
+    default:
+      return assertNever(authority);
+  }
+}
+function assertNever(value) {
+  throw new Error(`[Sixb] Unsupported object reader authority '${String(value.type)}'.`);
+}
+function ontologySelectionForAuthority(authority, ontology) {
+  switch (authority.type) {
+    case "unrestricted":
+      return { kind: "all" };
+    case "principal":
+      return {
+        kind: "types",
+        objectTypeIds: ontology.listObjectTypes().filter((objectType) => isAllowed(authority.context, {
+          kind: "object.view",
+          objectTypeId: objectType.id
+        })).map((objectType) => objectType.id)
+      };
+    case "delegated":
+      return { kind: "selected", scope: authority.objectRead.scope };
+  }
+}
+function delegatedLinkDefinitionKey(input) {
+  return "sourceObjectTypeId" in input ? JSON.stringify([input.sourceObjectTypeId, input.linkId, input.targetObjectTypeId]) : JSON.stringify([input.sourceTypeId, input.linkId, input.targetTypeId]);
+}
+function detachReadResult(value) {
+  return structuredClone(value);
+}
+function snapshotReadValue(value) {
+  return structuredClone(value);
+}
+function snapshotFacetRequests(facets) {
+  if (!Array.isArray(facets)) {
+    throw new ObjectQueryValidationError([
+      {
+        path: "$.facets",
+        code: "invalid_facets",
+        message: "facets must be an array"
+      }
+    ]);
+  }
+  const length = facets.length;
+  if (!Number.isSafeInteger(length) || length > MAX_OBJECT_READ_FACETS) {
+    throw new ObjectQueryValidationError([
+      {
+        path: "$.facets",
+        code: "too_many_facets",
+        message: `facets must include at most ${MAX_OBJECT_READ_FACETS} facet requests`
+      }
+    ]);
+  }
+  const snapshot = [];
+  for (let index = 0;index < length; index += 1) {
+    const facet = facets[index];
+    snapshot.push({ propertyId: facet.propertyId, limit: facet.limit });
+  }
+  return snapshot;
+}
+function snapshotAuthoredQuery(query) {
+  try {
+    return structuredClone(query);
+  } catch (error) {
+    if (error instanceof ObjectQueryValidationError)
+      throw error;
+    throw new ObjectQueryValidationError([
+      {
+        path: "$",
+        code: "query_not_cloneable",
+        message: "Object query must contain only structured-cloneable data"
+      }
+    ]);
+  }
+}
+
+// src/actions/delegated-admission.ts
+function assertDelegatedActionTarget(input) {
+  const { actionId, authorization, subject } = input;
+  if (subject.kind !== "object" || !authorization.actionApply.some((target) => target.actionId === actionId && target.subject.objectTypeId === subject.objectTypeId && target.subject.primaryId === subject.primaryId)) {
+    throw denied2(actionId, subject);
+  }
+  return subject;
+}
+async function admitDelegatedObjectAction(input) {
+  const { action, authorization, execution, objectReader, runtimeAuthorization, subject } = input;
+  assertDelegatedActionTarget({ authorization, actionId: action.id, subject });
+  if (action.binding.kind !== "object" || action.binding.objectType.id !== subject.objectTypeId) {
+    throw denied2(action.id, subject);
+  }
+  assertAuthorizedObjectReaderBinding({
+    reader: objectReader,
+    scope: { execution, authorization: runtimeAuthorization }
+  });
+  try {
+    const visible = await objectReader.getByPrimaryId({
+      objectTypeId: subject.objectTypeId,
+      primaryId: subject.primaryId
+    });
+    if (!visible)
+      throw denied2(action.id, subject);
+  } catch (error) {
+    if (error instanceof AuthorizationError)
+      throw denied2(action.id, subject);
+    throw error;
+  }
+}
+function denied2(actionId, subject) {
+  const target = subject.kind === "object" ? `${subject.objectTypeId}:${subject.primaryId}` : "global";
+  return new AuthorizationError(`apply:action:${actionId}:${target}`, `[Sixb] Delegated authority cannot apply Action '${actionId}' to '${target}'.`);
+}
+
+// src/actions/run-authorization.ts
+async function canDelegationAccessActionRun(input) {
+  const subject = input.run.subject;
+  if (!input.authority.delegation || subject.kind !== "object" || !input.authority.actionApply.some((target) => target.actionId === input.run.actionId && target.subject.objectTypeId === subject.objectTypeId && target.subject.primaryId === subject.primaryId)) {
+    return false;
+  }
+  return actionRunBelongsToShareGrant({
+    storage: input.storage,
+    projectId: input.projectId,
+    run: input.run,
+    grantId: input.authority.delegation.grantId
+  });
+}
+async function actionRunBelongsToShareGrant(input) {
+  const parent = await findPrimitiveParentRequestExecution({
+    executions: input.storage.executions,
+    projectId: input.projectId,
+    executionId: input.run.executionId,
+    primitive: { kind: "action", id: input.run.actionId, runId: input.run.id }
+  });
+  const authorization = parent?.authorizationRef;
+  return authorization?.type === "delegated" && authorization.delegation.kind === "share" && authorization.delegation.grantId === input.grantId;
+}
+
+// src/actions/run-dispatch.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
+// src/actions/run-id.ts
+import { randomUUID } from "crypto";
+function createActionRunId(runId) {
+  if (runId !== undefined) {
+    if (!runId.trim()) {
+      throw new OntologyValidationError("[Sixb] Action run id must not be empty");
+    }
+    return runId;
+  }
+  return `act_${randomUUID()}`;
+}
+function createActionRunIdempotencyKey(projectId, runId) {
+  return `action:${projectId}:${runId}`;
+}
+
+// src/actions/run-dispatch.ts
+async function dispatchActionRun(input) {
+  const request = prepareActionRun(input);
+  const persisted = await persistActionRun(input, request);
+  if (!persisted.publish)
+    return existingActionRunResult(persisted.run);
+  return publishActionRun(input, persisted);
+}
+function prepareActionRun(input) {
+  const runId = createActionRunId(input.runId);
+  return {
+    runId,
+    idempotencyKey: createActionRunIdempotencyKey(input.projectId, runId)
+  };
+}
+async function persistActionRun(input, request) {
+  const actionRuns = requireActionRunStorage(input.storage);
+  const existing = await actionRuns.getById({ projectId: input.projectId, id: request.runId });
+  if (existing) {
+    await input.assertCanReuseExisting?.(input.storage, existing);
+    return reuseActionRun(input, existing);
+  }
+  const execution = await input.createExecution(`exec_${randomUUID2()}`, request.runId);
+  const queuedAt = new Date;
+  try {
+    return await input.storage.transaction(async (tx) => {
+      const transactionalRuns = requireActionRunStorage(tx);
+      const raced = await transactionalRuns.getById({
+        projectId: input.projectId,
+        id: request.runId
+      });
+      if (raced) {
+        await input.assertCanReuseExisting?.(tx, raced);
+        assertExistingRunMatchesRequest(raced, input);
+        return { publish: false, run: raced };
+      }
+      await tx.executions.create(execution);
+      const run = await transactionalRuns.queue({
+        projectId: input.projectId,
+        id: request.runId,
+        executionId: execution.id,
+        actionId: input.actionId,
+        subject: input.subject,
+        params: input.params,
+        idempotencyKey: request.idempotencyKey,
+        queuedAt
+      });
+      return { publish: true, run, execution, queuedAt, created: true };
+    }, { isolation: "serializable" });
+  } catch (error) {
+    if (!(error instanceof ActionRunError))
+      throw error;
+    const raced = await actionRuns.getById({ projectId: input.projectId, id: request.runId });
+    if (!raced)
+      throw error;
+    await input.assertCanReuseExisting?.(input.storage, raced);
+    assertExistingRunMatchesRequest(raced, input);
+    return { publish: false, run: raced };
+  }
+}
+async function reuseActionRun(input, existing) {
+  assertExistingRunMatchesRequest(existing, input);
+  if (!isRetryableEnqueueFailure(existing))
+    return { publish: false, run: existing };
+  const execution = await input.storage.executions.getById({
+    projectId: input.projectId,
+    id: existing.executionId
+  });
+  if (!execution) {
+    throw new ActionRunError(`[Sixb] Execution '${existing.executionId}' for Action run '${existing.id}' was not found.`);
+  }
+  const queuedAt = new Date;
+  const run = await requireActionRunStorage(input.storage).queue({
+    projectId: input.projectId,
+    id: existing.id,
+    executionId: existing.executionId,
+    actionId: existing.actionId,
+    subject: existing.subject,
+    params: existing.params,
+    idempotencyKey: existing.idempotencyKey,
+    queuedAt
+  });
+  return { publish: true, run, execution, queuedAt, created: false };
+}
+async function publishActionRun(input, persisted) {
+  let job;
+  try {
+    const jobs = await input.queue.enqueue({
+      projectId: input.projectId,
+      jobs: [
+        {
+          id: persisted.run.id,
+          type: "action.run.requested",
+          payload: {
+            runId: persisted.run.id
+          }
+        }
+      ]
+    });
+    job = jobs[0];
+  } catch (error) {
+    await failActionRunPublication(input, persisted.run, error);
+    throw error;
+  }
+  await input.events.emit({
+    events: [
+      {
+        type: "action.requested",
+        payload: {
+          actionId: persisted.run.actionId,
+          subject: persisted.run.subject,
+          params: persisted.run.params,
+          runId: persisted.run.id
+        }
+      }
+    ],
+    correlationId: persisted.execution.correlationId
+  }, { source: "Sixb" });
+  return {
+    runId: persisted.run.id,
+    queuedAt: persisted.queuedAt.toISOString(),
+    ...job?.id ? { jobId: job.id } : {},
+    created: persisted.created
+  };
+}
+async function failActionRunPublication(input, run, error) {
+  const failedAt = new Date;
+  const failure = toActionRunFailure(error, run, failedAt);
+  await requireActionRunStorage(input.storage).finish({
+    projectId: input.projectId,
+    id: run.id,
+    status: "failed",
+    finishedAt: failedAt,
+    error: failure
+  });
+  reportRunFailure(input.errorReporterHost, error, {
+    projectId: input.projectId,
+    runKind: "action",
+    run: { runId: run.id, actionId: run.actionId },
+    failure
+  });
+}
+function requireActionRunStorage(storage) {
+  if (!storage.actionRuns) {
+    throw new ActionRunError("[Sixb] Action run storage is not configured.");
+  }
+  return storage.actionRuns;
+}
+function assertExistingRunMatchesRequest(existing, request) {
+  if (existing.actionId !== request.actionId || !actionSubjectsEqual(existing.subject, request.subject) || !actionRunParamsEqual(existing.params, request.params)) {
+    throw new ActionRunError(`[Sixb] Action run '${existing.id}' already exists with a different request payload.`);
+  }
+}
+function isRetryableEnqueueFailure(record) {
+  return record.status === "failed" && record.phase === "enqueue" && record.error?.retryable === true;
+}
+function existingActionRunResult(existing) {
+  return {
+    runId: existing.id,
+    queuedAt: existing.queuedAt.toISOString(),
+    created: false
+  };
+}
+function toActionRunFailure(error, run, at) {
+  const enqueueError = createSixbError("queue.enqueue_failed", `[Sixb] Could not enqueue Action run '${run.id}'.`, {
+    cause: error,
+    details: { actionId: run.actionId, runId: run.id, phase: "enqueue" }
+  });
+  return parseActionRunFailure(toSixbFailure(enqueueError, {
+    allowedCodes: ACTION_RUN_FAILURE_CODES,
+    at
+  }), "enqueue");
+}
+
+// src/actions/request.ts
+var DEFAULT_ACTION_WAIT_TIMEOUT_MS = 60000;
+var DEFAULT_ACTION_WAIT_POLL_MS = 1000;
+function clearTimer(timer) {
+  if (timer) {
+    clearTimeout(timer);
+  }
+}
+function getActionDefinition(runtime, actionId) {
+  const action = runtime.actionRegistry.getById(actionId);
+  if (!action) {
+    throw new OntologyValidationError(`Unknown action '${actionId}'`);
+  }
+  return action;
+}
+async function requestAction(runtime, execution, input) {
+  const projectId = runtime.projectId;
+  const runtimeAuthorization = runtime.runtimeAuthorization;
+  const objectReader = runtime.objectReader;
+  const request = snapshotActionRequest(input);
+  const authorization = resolveExecutionScopeAuthorization(projectId, {
+    execution,
+    authorization: runtimeAuthorization
+  });
+  const subject = request.subject;
+  const delegatedSubject = authorization.type === "delegated" ? assertDelegatedActionTarget({
+    authorization,
+    actionId: request.actionId,
+    subject
+  }) : undefined;
+  const action = getActionDefinition(runtime, request.actionId);
+  const actionId = action.id;
+  const rawParams = request.params;
+  if (authorization.type === "delegated") {
+    await admitDelegatedObjectAction({
+      objectReader,
+      runtimeAuthorization,
+      execution,
+      authorization,
+      action,
+      subject: delegatedSubject
+    });
+  } else {
+    assertAuthorized({ projectId, runtimeAuthorization }, { kind: "action.apply", actionId });
+  }
+  if (authorization.type !== "delegated" && action.binding.kind === "object") {
+    assertAuthorized({ projectId, runtimeAuthorization }, { kind: "object.view", objectTypeId: action.binding.objectType.id });
+  }
+  validateActionSubject(action, subject);
+  let pathPrefix = action.id;
+  let objectType = null;
+  if (isObjectActionDefinition(action)) {
+    objectType = resolveObjectActionSubject({ runtime, action, subject });
+    pathPrefix = `${objectType.id}.${action.id}`;
+  }
+  const actionParams = normalizeActionParams(runtime, action.params, rawParams, pathPrefix);
+  getAuthorizationRef(runtimeAuthorization);
+  return dispatchActionRun({
+    errorReporterHost: runtime,
+    projectId,
+    storage: runtime.storage,
+    queue: runtime.queues.actions,
+    events: runtime.events,
+    actionId,
+    subject,
+    params: actionParams,
+    runId: request.runId,
+    ...authorization.type === "delegated" ? {
+      assertCanReuseExisting: async (storage, existing) => {
+        if (!authorization.delegation || !await actionRunBelongsToShareGrant({
+          storage,
+          projectId,
+          run: existing,
+          grantId: authorization.delegation.grantId
+        })) {
+          throw new AuthorizationError(`apply:action:${actionId}`, "[Sixb] Delegated authority cannot reuse this Action run.");
+        }
+      }
+    } : {},
+    createExecution: async (executionId, runId) => {
+      const caller = await ensureExecutionRecord(runtime.storage.executions, executionRecordInputFromRuntime({
+        execution,
+        runtimeAuthorization
+      }));
+      return createPrimitiveExecutionRecord({
+        id: executionId,
+        primitive: { kind: "action", id: actionId, runId },
+        origin: { type: "execution", parent: caller }
+      });
+    }
+  });
+}
+function snapshotActionRequest(input) {
+  const actionId = input.actionId;
+  const subject = input.subject;
+  const params = input.params;
+  const runId = input.runId;
+  return structuredClone({
+    actionId,
+    subject: subject ?? { kind: "none" },
+    params: params ?? {},
+    ...runId === undefined ? {} : { runId }
+  });
+}
+async function requestActionAndWait(runtime, execution, input) {
+  const runId = createActionRunId(input.runId);
+  await requestAction(runtime, execution, {
+    ...input,
+    runId
+  });
+  await input.onRequested?.(runId);
+  return waitForActionRun(runtime, {
+    runId,
+    timeoutMs: input.timeoutMs,
+    signal: input.signal
+  });
+}
+async function waitForActionRun(runtime, input) {
+  const projectId = runtime.projectId;
+  const runtimeAuthorization = runtime.runtimeAuthorization;
+  const request = {
+    runId: input.runId,
+    timeoutMs: input.timeoutMs,
+    signal: input.signal
+  };
+  const authorization = resolveRuntimeAuthorizationForProject({
+    projectId,
+    runtimeAuthorization
+  });
+  if (authorization.type === "denied") {
+    throw new AuthorizationError("runtime:unbound", "[Sixb] Protected operations require registered runtime authorization for this project.");
+  }
+  if (authorization.type === "delegated")
+    getAuthorizationRef(runtimeAuthorization);
+  const actionRuns = requireActionRunStorage2(runtime);
+  const timeoutMs = request.timeoutMs ?? DEFAULT_ACTION_WAIT_TIMEOUT_MS;
+  const signal = request.signal;
+  const startedAt = Date.now();
+  if (signal?.aborted) {
+    throw signal.reason ?? new Error("aborted");
+  }
+  return new Promise((resolve, reject) => {
+    let timer;
+    let pollTimer;
+    let unsubscribe;
+    let settled = false;
+    let checking = false;
+    const releaseSubscription = (release) => {
+      if (!release)
+        return;
+      try {
+        release();
+      } catch (error) {
+        console.error("[Sixb] Failed to release action run wait subscription:", error);
+      }
+    };
+    const cleanup = () => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimer(timer);
+      clearTimer(pollTimer);
+      signal?.removeEventListener("abort", onAbort);
+      releaseSubscription(unsubscribe);
+    };
+    const rejectWith = (error) => {
+      cleanup();
+      reject(error);
+    };
+    const schedulePoll = () => {
+      if (!settled && !pollTimer) {
+        pollTimer = setTimeout(() => {
+          pollTimer = undefined;
+          check();
+        }, DEFAULT_ACTION_WAIT_POLL_MS);
+      }
+    };
+    const check = async () => {
+      if (settled || checking) {
+        return;
+      }
+      checking = true;
+      try {
+        const record = await actionRuns.getById({
+          projectId,
+          id: request.runId
+        });
+        const visible = record && (authorization.type === "unrestricted" || authorization.type === "principal" && canViewActionRun(authorization.context, record) || authorization.type === "delegated" && await canDelegationAccessActionRun({
+          storage: runtime.storage,
+          projectId,
+          authority: authorization,
+          run: record
+        }));
+        if (visible && isTerminalActionRun(record)) {
+          if (authorization.type === "delegated") {
+            assertObjectReadOutputWithinLimit(record, authorization.objectRead.limits);
+          }
+          cleanup();
+          resolve(record);
+          return;
+        }
+        schedulePoll();
+      } catch (error) {
+        rejectWith(error);
+      } finally {
+        checking = false;
+      }
+    };
+    const onAbort = () => {
+      rejectWith(signal?.reason ?? new Error("aborted"));
+    };
+    timer = setTimeout(() => {
+      rejectWith(new ActionRunTimeoutError({ runId: request.runId, timeoutMs }));
+    }, Math.max(0, timeoutMs - (Date.now() - startedAt)));
+    if (signal) {
+      signal.addEventListener("abort", onAbort, { once: true });
+    }
+    runtime.events.subscribe({ types: ["action.completed", "action.failed"] }, (events) => {
+      if (events.some((event) => (event.type === "action.completed" || event.type === "action.failed") && event.payload.runId === request.runId)) {
+        check();
+      }
+    }).then((unsubscribeEvents) => {
+      if (settled) {
+        releaseSubscription(unsubscribeEvents);
+        return;
+      }
+      unsubscribe = unsubscribeEvents;
+      check();
+    }).catch((error) => {
+      if (settled) {
+        console.error("[Sixb] Action run wait subscription failed after the wait settled:", error);
+        return;
+      }
+      rejectWith(error);
+    });
+  });
+}
+function requireActionRunStorage2(runtime) {
+  const actionRuns = runtime.storage.actionRuns;
+  if (!actionRuns) {
+    throw new ActionRunError("[Sixb] Action run storage is not configured.");
+  }
+  return actionRuns;
+}
+
+export { ActionValidationError, ActionRunFailedError, ActionRunTimeoutError, createAuthorizedObjectReader, assertAuthorizedObjectReaderBinding, getAuthorizedOntologyView, canDelegationAccessActionRun, requestAction, requestActionAndWait, waitForActionRun };
+
+//# debugId=FFB8DCF8ECEF803364756E2164756E21