@sixb/core 0.1.7 → 0.1.8

package/dist/{chunk-h0knpbz5.js → chunk-xajtptbw.js}

@@ -3,20 +3,24 @@ import {
   SyncValidationError,
   createConnectorRuntime,
   requestSyncRun
-} from "./chunk-ha58tjtt.js";
+} from "./chunk-wtf06et8.js";
 import {
   aiLimitSubjectsFromAttribution,
   aiUsageLimitExceededError,
   aiUsageLimitUnavailableError,
   applicableAiLimitPolicyStatuses
 } from "./chunk-c15dr03f.js";
+import {
+  compileShareAccessPlan
+} from "./chunk-v4en4jc2.js";
 import {
   PipelineError,
   requestPipelineRun
-} from "./chunk-rp1mvzb4.js";
+} from "./chunk-w9tg6yyb.js";
 import {
   appendTelemetry,
   createObjectSet,
+  getLatestTelemetryPoint,
   getTelemetryHistoryBatch,
   listObjects,
   removeLink1 as removeLink,
@@ -24,48 +28,48 @@ import {
   upsertLinkBatch1 as upsertLinkBatch,
   upsertObject1 as upsertObject,
   upsertObjectBatch1 as upsertObjectBatch
-} from "./chunk-e4rvtvpw.js";
+} from "./chunk-aa2pen2v.js";
 import {
   shareOntologyMutationRuntime
 } from "./chunk-xhy826cz.js";
-import {
-  countObjects,
-  executeObjectQuery,
-  executeObjectQueryLinks,
-  existsObjects,
-  facetObjects
-} from "./chunk-3fqt22c4.js";
 import {
   registerConnectorConnectionsRuntime
 } from "./chunk-nf4r78r4.js";
 import {
-  isActionDefinition,
+  writeDataset
+} from "./chunk-359jm1jw.js";
+import {
+  getDatasetPrimaryKeyColumns
+} from "./chunk-n4khvw9n.js";
+import {
+  assertAuthorizedObjectReaderBinding,
+  canDelegationAccessActionRun,
+  getAuthorizedOntologyView,
   requestAction,
   requestActionAndWait
-} from "./chunk-y35ma3mj.js";
+} from "./chunk-h5vqbfmd.js";
 import {
   createPrimitiveExecutionRecord,
   ensureExecutionRecord,
   executionRecordInputFromRuntime
-} from "./chunk-hdz94br2.js";
+} from "./chunk-k522z7v6.js";
 import {
+  ObjectNotFoundError,
   WORKFLOW_RUN_FAILURE_CODES
-} from "./chunk-6ed5bwnd.js";
+} from "./chunk-sbzzr4kx.js";
+import {
+  ShareGrantStorageError
+} from "./chunk-nx7k8tpr.js";
 import {
-  WorkflowRunError,
-  agentServiceAccountId
-} from "./chunk-qjzp9xyb.js";
+  WorkflowRunError
+} from "./chunk-nn0tekr1.js";
 import {
   ExecutionStorageError
-} from "./chunk-gbrpsx4m.js";
+} from "./chunk-rafagrwr.js";
 import {
   AGENT_REASONING_LEVELS,
   AgentStorageError
-} from "./chunk-08twe8m6.js";
-import {
-  isObjectRefSchema,
-  validateSchemaOrRefValue
-} from "./chunk-dqn23610.js";
+} from "./chunk-p1rzczbt.js";
 import {
   RuntimeError
 } from "./chunk-p2vqaxkc.js";
@@ -73,29 +77,36 @@ import {
   isModelReasoning
 } from "./chunk-trxxmgnf.js";
 import {
-  reportRunFailure
+  reportRunFailure,
+  shareSixbErrorReporter
 } from "./chunk-jq43kdvk.js";
 import {
   AgentRequestError,
   normalizeAgentContextEntries
-} from "./chunk-atmkaf60.js";
+} from "./chunk-5e3pq99w.js";
 import {
   publishAgentRunActivity
 } from "./chunk-7y0f6rf1.js";
 import {
   SYSTEM_PRINCIPAL,
+  isActionDefinition,
   principalsEqual
-} from "./chunk-rre42skh.js";
+} from "./chunk-4sm0aznx.js";
 import {
   snapshotRequesterGroupIds
 } from "./chunk-4a849fr1.js";
+import {
+  isObjectRefSchema,
+  validateSchemaOrRefValue
+} from "./chunk-2dw777qw.js";
 import {
   AuthorizationError,
+  agentServiceAccountId,
   assertAuthorized,
   assertCanManageConnector,
+  assertObjectReadOutputWithinLimit,
   assertPrivileged,
   assertProviderAccess,
-  assertRuntimeAuthorizationBound,
   canViewActionRun,
   canViewEvent,
   canViewPipelineRun,
@@ -106,11 +117,13 @@ import {
   createAgentRuntimeAuthorization,
   getAuthorizationRef,
   isAllowed,
-  resolveExecutionScopeAuthorization
-} from "./chunk-37wk412q.js";
+  isRuntimeAllowed,
+  resolveExecutionScopeAuthorization,
+  resolveRuntimeAuthorizationForProject
+} from "./chunk-p1x242ad.js";
 import {
   assertObjectTypeRegistered
-} from "./chunk-d63tybny.js";
+} from "./chunk-h0k55pc7.js";
 import {
   supportsDirectUpload,
   supportsRangeRead
@@ -122,39 +135,105 @@ import {
   isPlainRecord
 } from "./chunk-n6jxh8sw.js";
 
+// src/actions/descriptor.ts
+function snapshotActionDescriptor(action) {
+  const params = Object.fromEntries(Object.entries(action.params).map(([id, config]) => [id, structuredClone(config)]));
+  return deepFreeze({
+    id: action.id,
+    ...action.description === undefined ? {} : { description: action.description },
+    binding: action.binding.kind === "global" ? { kind: "global" } : { kind: "object", objectTypeId: action.binding.objectType.id },
+    params,
+    phases: {
+      validate: action.phases.validate.length > 0,
+      writeback: action.phases.writeback !== undefined,
+      edits: action.phases.edits !== undefined,
+      effects: action.phases.effects !== undefined
+    }
+  });
+}
+function deepFreeze(value, seen = new Set) {
+  if (typeof value !== "object" || value === null || seen.has(value))
+    return value;
+  seen.add(value);
+  for (const key of Reflect.ownKeys(value)) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor && "value" in descriptor)
+      deepFreeze(descriptor.value, seen);
+  }
+  return Object.freeze(value);
+}
+
 // src/actions/execution.ts
 function createActionsRuntime(runtime, execution) {
-  const canList = (action) => isAllowed(runtime.authorization, { kind: "action.apply", actionId: action.id }) && (action.binding.kind === "global" || isAllowed(runtime.authorization, {
-    kind: "object.view",
-    objectTypeId: action.binding.objectType.id
-  }));
+  const projectId = runtime.projectId;
+  const runtimeAuthorization = runtime.runtimeAuthorization;
+  const objectReader = runtime.objectReader;
+  assertAuthorizedObjectReaderBinding({
+    reader: objectReader,
+    scope: { execution, authorization: runtimeAuthorization }
+  });
+  const authorization = resolveRuntimeAuthorizationForProject({
+    projectId,
+    runtimeAuthorization
+  });
+  const canList = (action) => {
+    if (authorization.type === "denied")
+      return false;
+    if (authorization.type === "delegated") {
+      const binding = action.binding;
+      return binding.kind === "object" && authorization.actionApply.some((target) => target.actionId === action.id && target.subject.objectTypeId === binding.objectType.id) && getAuthorizedOntologyView(objectReader).getObjectTypeById(binding.objectType.id) !== null;
+    }
+    if (authorization.type === "unrestricted")
+      return true;
+    return isAllowed(authorization.context, { kind: "action.apply", actionId: action.id }) && (action.binding.kind === "global" || isAllowed(authorization.context, {
+      kind: "object.view",
+      objectTypeId: action.binding.objectType.id
+    }));
+  };
+  const release = (value) => {
+    if (authorization.type === "delegated") {
+      assertObjectReadOutputWithinLimit(value, authorization.objectRead.limits);
+    }
+    return value;
+  };
+  const describeAll = (actions) => release(actions.filter(canList).map(snapshotActionDescriptor));
   return {
-    list: () => runtime.actionRegistry.list().filter(canList),
+    list: () => describeAll(runtime.actionRegistry.list()),
     getById: (actionId) => {
       const action = runtime.actionRegistry.getById(actionId);
-      return action && canList(action) ? action : null;
+      return release(action && canList(action) ? snapshotActionDescriptor(action) : null);
     },
-    listGlobal: () => runtime.actionRegistry.listGlobal().filter(canList),
-    listForType: (objectType) => runtime.actionRegistry.listForType(objectType).filter(canList),
+    listGlobal: () => describeAll(runtime.actionRegistry.listGlobal()),
+    listForType: (objectType) => describeAll(runtime.actionRegistry.listForType(objectType).filter((action) => authorization.type !== "delegated" || action.binding.kind === "object" && action.binding.objectType.id === objectType.id)),
     request: (input) => requestAction(runtime, execution, input),
     requestAndWait: (input) => requestActionAndWait(runtime, execution, input),
     runs: {
       getById: async (runId) => {
+        if (authorization.type === "denied" || authorization.type === "delegated" && (!authorization.delegation || authorization.actionApply.length === 0))
+          return null;
         const run = await runtime.storage.actionRuns?.getById({
-          projectId: runtime.projectId,
+          projectId,
           id: runId
         }) ?? null;
-        return run && canViewActionRun(runtime.authorization, run) ? run : null;
+        return run && (authorization.type === "unrestricted" || authorization.type === "principal" && canViewActionRun(authorization.context, run) || authorization.type === "delegated" && await canDelegationAccessActionRun({
+          storage: runtime.storage,
+          projectId,
+          authority: authorization,
+          run
+        })) ? release(run) : null;
       },
       list: (input = {}) => {
+        if (authorization.type === "denied" || authorization.type === "delegated") {
+          return Promise.resolve({ runs: [], hasMore: false, total: 0 });
+        }
         const storage = runtime.storage.actionRuns;
         if (!storage)
           return Promise.resolve({ runs: [], hasMore: false, total: 0 });
         return storage.list({
-          projectId: runtime.projectId,
           ...input,
-          actionIds: runtime.authorization ? [...runtime.authorization.grants["apply:action"]] : undefined,
-          objectTypeIds: runtime.authorization ? [...runtime.authorization.grants["view:object"]] : undefined
+          projectId,
+          actionIds: authorization.type === "principal" ? [...authorization.context.grants["apply:action"]] : undefined,
+          objectTypeIds: authorization.type === "principal" ? [...authorization.context.grants["view:object"]] : undefined
         });
       }
     }
@@ -230,9 +309,7 @@ async function resolveAgentContextParts(runtime, input) {
     } catch {
       invalidContext(`context references an unknown object type '${objectTypeId}'`);
     }
-    assertAuthorized(runtime, { kind: "object.view", objectTypeId });
-    const object = await runtime.storage.objects.getByPrimaryId({
-      projectId: runtime.projectId,
+    const object = await runtime.objectReader.getByPrimaryId({
       objectTypeId,
       primaryId
     });
@@ -362,6 +439,10 @@ function assertNoAgentSelector(input) {
 
 // src/agents/request.ts
 async function requestAgentRun(runtime, execution, models, input) {
+  const authority = resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization
+  });
   assertNoAgentSelector(input);
   assertAuthorized(runtime, { kind: "agent.run" });
   assertRequestAuthorityCanRunAgent(runtime);
@@ -369,7 +450,7 @@ async function requestAgentRun(runtime, execution, models, input) {
   const contextParts = await resolveAgentContextParts(runtime, input.context);
   const agents = requireAgentStorage(runtime);
   const projectId = runtime.projectId;
-  const principal = runtime.authorization?.principal ?? input.principal ?? SYSTEM_PRINCIPAL;
+  const principal = authority.type === "principal" ? authority.context.principal : input.principal ?? SYSTEM_PRINCIPAL;
   const runId = createAgentRunId();
   const durableExecution = await prepareDurableAgentExecution(runtime, execution, runId);
   const requesterGroupIds = durableExecution.requestedBy ? await snapshotRequesterGroupIds({
@@ -434,6 +515,10 @@ async function requestAgentRun(runtime, execution, models, input) {
   };
 }
 async function retryAgentRun(runtime, execution, models, failedRun) {
+  resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization
+  });
   assertAuthorized(runtime, { kind: "agent.run" });
   assertRequestAuthorityCanRunAgent(runtime);
   if (failedRun.status !== "failed") {
@@ -591,18 +676,23 @@ function requireAgentStorage(runtime) {
 
 // src/agents/execution.ts
 function createAgentRuntime(runtime, execution, models) {
-  const principal = runtime.authorization?.principal ?? SYSTEM_PRINCIPAL;
-  const allowed = () => isAllowed(runtime.authorization, { kind: "agent.run" });
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const principal = authority.type === "principal" ? authority.context.principal : SYSTEM_PRINCIPAL;
+  const allowed = () => isRuntimeAllowed(runtime, { kind: "agent.run" });
   const getVisibleThreadRecord = async (threadId) => {
+    if (authority.type === "denied" || authority.type === "delegated")
+      return null;
     const thread = await runtime.storage.agents?.threads.getById({
       projectId: runtime.projectId,
       id: threadId
     }) ?? null;
     if (!thread || !allowed())
       return null;
-    return runtime.authorization && !principalsEqual(principal, thread.ownerPrincipal) ? null : thread;
+    return authority.type === "principal" && !principalsEqual(principal, thread.ownerPrincipal) ? null : thread;
   };
   const getAgent = () => {
+    if (authority.type === "denied" || authority.type === "delegated")
+      return null;
     const model = models?.language.default;
     if (!model || !allowed())
       return null;
@@ -612,6 +702,8 @@ function createAgentRuntime(runtime, execution, models) {
     };
   };
   const getVisibleRunRecord = async (runId) => {
+    if (authority.type === "denied" || authority.type === "delegated")
+      return null;
     const run = await runtime.storage.agents?.runs.getById({
       projectId: runtime.projectId,
       id: runId
@@ -648,13 +740,16 @@ function createAgentRuntime(runtime, execution, models) {
       getById: getVisibleThreadRecord,
       list: async (input = {}) => {
         assertNoAgentSelector(input);
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return { threads: [], hasMore: false, total: 0 };
+        }
         const storage = runtime.storage.agents;
         if (!storage || !allowed())
           return { threads: [], hasMore: false, total: 0 };
         return storage.threads.list({
           ...input,
           projectId: runtime.projectId,
-          ownerPrincipal: runtime.authorization ? principal : undefined
+          ownerPrincipal: authority.type === "principal" ? principal : undefined
         });
       }
     },
@@ -752,8 +847,7 @@ function createAiUsageRuntime(runtime, security) {
   const assertObservable = () => assertAuthorized(runtime, { kind: "aiUsage.observe" });
   const assertManageable = () => assertAuthorized(runtime, { kind: "aiUsage.manage" });
   const assertPolicyReadable = () => {
-    const resolved = assertRuntimeAuthorizationBound(runtime);
-    if (resolved.type === "principal" && !isAllowed(resolved.context, { kind: "aiUsage.observe" }) && !isAllowed(resolved.context, { kind: "aiUsage.manage" })) {
+    if (!isRuntimeAllowed(runtime, { kind: "aiUsage.observe" }) && !isRuntimeAllowed(runtime, { kind: "aiUsage.manage" })) {
       assertObservable();
     }
   };
@@ -774,10 +868,7 @@ function createAiUsageRuntime(runtime, security) {
     limitsConfigured: runtime.storage.aiLimits !== undefined,
     assertObservable,
     assertManageable,
-    canManageLimits: () => {
-      const resolved = assertRuntimeAuthorizationBound(runtime);
-      return resolved.type !== "principal" || isAllowed(resolved.context, { kind: "aiUsage.manage" });
-    },
+    canManageLimits: () => isRuntimeAllowed(runtime, { kind: "aiUsage.manage" }),
     queryOverview: (input) => {
       assertObservable();
       return requireCosts().queryProjectOverview({ ...input, projectId: runtime.projectId });
@@ -934,21 +1025,88 @@ function commandContext(runtime, execution, connectorId) {
 }
 
 // src/datasets/execution.ts
-function createDatasetsRuntime(runtime, source) {
-  const allowed = (datasetId) => isAllowed(runtime.authorization, { kind: "dataset.view", datasetId });
+function createDatasetsRuntime(runtime, execution, source, lakeStorage, blobStorage) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const allowed = (datasetId) => isRuntimeAllowed(runtime, { kind: "dataset.view", datasetId });
   return {
-    list: () => source.list().filter((dataset) => allowed(dataset.id)),
+    list: () => authority.type === "denied" || authority.type === "delegated" ? [] : source.list().filter((dataset) => allowed(dataset.id)),
     getById: (datasetId) => {
+      if (authority.type === "denied" || authority.type === "delegated")
+        return null;
       const dataset = source.getById(datasetId);
       return dataset && allowed(datasetId) ? dataset : null;
+    },
+    async ingest(dataset, input) {
+      assertPrivileged(runtime, "datasets.ingest");
+      const registered = source.getById(dataset.id);
+      if (!registered)
+        throw new Error(`[Sixb] Dataset '${dataset.id}' is not registered.`);
+      if (getDatasetPrimaryKeyColumns(registered) === null) {
+        throw new Error(`[Sixb] Dataset '${dataset.id}' must define a primaryKey before ingestion.`);
+      }
+      if (typeof lakeStorage.beginMerge !== "function") {
+        throw new Error("[Sixb] Dataset ingestion requires a lake provider with merge support.");
+      }
+      const producer = { kind: "ingest", id: execution.id };
+      const result = await writeDataset({
+        lakeStorage,
+        blobStorage,
+        dataset: registered,
+        mode: "merge",
+        signal: input.signal ?? new AbortController().signal,
+        producer,
+        readValues: async () => async function* () {
+          for await (const value of input.changes)
+            yield { value };
+        }()
+      });
+      if (result.outcome === "created") {
+        await runtime.events.emit({
+          events: [
+            {
+              type: "dataset.version.committed",
+              payload: {
+                datasetId: registered.id,
+                versionId: result.version.versionId,
+                createdAt: result.version.createdAt.toISOString(),
+                producer
+              }
+            }
+          ],
+          correlationId: execution.correlationId
+        }, { source: "SixbDatasets" });
+      }
+      return result;
     }
   };
 }
 
 // src/events/execution.ts
 function createEventsRuntime(runtime) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const visibleEvents = (events) => {
+    switch (authority.type) {
+      case "denied":
+      case "delegated":
+        return [];
+      case "principal":
+        return events.filter((event) => canViewEvent(authority.context, event));
+      case "unrestricted":
+        return [...events];
+    }
+  };
   return {
-    canRead: (event) => canViewEvent(runtime.authorization, event),
+    canRead: (event) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return false;
+        case "principal":
+          return canViewEvent(authority.context, event);
+        case "unrestricted":
+          return true;
+      }
+    },
     append: (input) => {
       assertPrivileged(runtime, "events.append");
       return runtime.events.append(input);
@@ -958,15 +1116,42 @@ function createEventsRuntime(runtime) {
       return runtime.events.emit(input, options);
     },
     read: async (input) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return [];
+        case "principal":
+        case "unrestricted":
+          break;
+      }
       const events = await runtime.events.read(input);
-      return events.filter((event) => canViewEvent(runtime.authorization, event));
+      return visibleEvents(events);
     },
-    latestCursor: () => runtime.events.latestCursor(),
-    subscribe: (input, handler) => runtime.events.subscribe(input, (events) => {
-      const visible = events.filter((event) => canViewEvent(runtime.authorization, event));
-      if (visible.length > 0)
-        handler(visible);
-    })
+    latestCursor: () => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return Promise.resolve(undefined);
+        case "principal":
+        case "unrestricted":
+          return runtime.events.latestCursor();
+      }
+    },
+    subscribe: (input, handler) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return Promise.resolve(() => {});
+        case "principal":
+        case "unrestricted":
+          break;
+      }
+      return runtime.events.subscribe(input, (events) => {
+        const visible = visibleEvents(events);
+        if (visible.length > 0)
+          handler(visible);
+      });
+    }
   };
 }
 
@@ -988,129 +1173,118 @@ function createLogsRuntime(runtime, source) {
 
 // src/objects/execution.ts
 function createObjectsRuntime(runtime, execution) {
+  const runtimeAuthorization = runtime.runtimeAuthorization;
+  const objectReader = runtime.objectReader;
+  assertAuthorizedObjectReaderBinding({
+    reader: objectReader,
+    scope: { execution, authorization: runtimeAuthorization }
+  });
+  const authorization = runtime.authorization;
+  const capturedRuntime = {
+    projectId: runtime.projectId,
+    broker: runtime.broker,
+    ontology: runtime.ontology,
+    actionRegistry: runtime.actionRegistry,
+    events: runtime.events,
+    storage: runtime.storage,
+    queues: runtime.queues,
+    runtimeAuthorization,
+    objectReader,
+    ...authorization === undefined ? {} : { authorization }
+  };
+  shareOntologyMutationRuntime(runtime, capturedRuntime);
+  shareSixbErrorReporter(runtime, capturedRuntime);
+  Object.freeze(capturedRuntime);
+  const ontologyView = () => getAuthorizedOntologyView(objectReader);
   const objects = Object.assign((objectType) => {
-    assertObjectTypeRegistered(runtime.ontology.getObjectTypesById(), objectType);
-    return createObjectSet({ ...runtime, execution, objectType });
+    assertObjectTypeRegistered(capturedRuntime.ontology.getObjectTypesById(), objectType);
+    return createObjectSet({ ...capturedRuntime, execution, objectType });
   }, {
-    listTypes: () => runtime.ontology.listObjectTypes().filter((objectType) => isAllowed(runtime.authorization, {
-      kind: "object.view",
-      objectTypeId: objectType.id
-    })),
-    getTypeById: (objectTypeId) => {
-      const objectType = runtime.ontology.getObjectTypeById(objectTypeId);
-      return objectType && isAllowed(runtime.authorization, { kind: "object.view", objectTypeId }) ? objectType : null;
-    },
-    resolveType: (objectTypeId) => {
-      assertAuthorized(runtime, { kind: "object.view", objectTypeId });
-      return runtime.ontology.resolveObjectType(objectTypeId);
-    },
-    getValueTypesById: () => runtime.ontology.getValueTypesById(),
-    listSubTypes: (objectTypeId) => runtime.ontology.listSubTypes(objectTypeId),
-    isValidLinkTarget: (expected, actual) => runtime.ontology.isValidLinkTarget(expected, actual),
-    executeQuery: (input) => executeObjectQuery({ projectId: runtime.projectId, ...input }, {
-      ontology: runtime.ontology,
-      storage: runtime.storage.objects,
-      runtimeAuthorization: runtime.runtimeAuthorization,
-      authorization: runtime.authorization
-    }),
-    queryLinks: (input) => executeObjectQueryLinks({ projectId: runtime.projectId, ...input }, {
-      ontology: runtime.ontology,
-      storage: runtime.storage.objects,
-      runtimeAuthorization: runtime.runtimeAuthorization,
-      authorization: runtime.authorization
-    }),
-    count: (input) => countObjects({ projectId: runtime.projectId, ...input }, {
-      ontology: runtime.ontology,
-      storage: runtime.storage.objects,
-      runtimeAuthorization: runtime.runtimeAuthorization,
-      authorization: runtime.authorization
-    }),
-    exists: (input) => existsObjects({ projectId: runtime.projectId, ...input }, {
-      ontology: runtime.ontology,
-      storage: runtime.storage.objects,
-      runtimeAuthorization: runtime.runtimeAuthorization,
-      authorization: runtime.authorization
-    }),
-    facet: (input) => facetObjects({ projectId: runtime.projectId, ...input }, {
-      ontology: runtime.ontology,
-      storage: runtime.storage.objects,
-      runtimeAuthorization: runtime.runtimeAuthorization,
-      authorization: runtime.authorization
-    }),
+    listTypes: () => ontologyView().listObjectTypes(),
+    getTypeById: (objectTypeId) => ontologyView().getObjectTypeById(objectTypeId),
+    resolveType: (objectTypeId) => ontologyView().resolveObjectType(objectTypeId),
+    getValueTypesById: () => ontologyView().getValueTypesById(),
+    listSubTypes: (objectTypeId) => ontologyView().listSubTypes(objectTypeId),
+    isValidLinkTarget: (expected, actual) => ontologyView().isValidLinkTarget(expected, actual),
+    executeQuery: (input) => objectReader.executeQuery(input),
+    queryLinks: (input) => objectReader.queryLinks(input),
+    count: (input) => objectReader.count(input),
+    exists: (input) => objectReader.exists(input),
+    facet: (input) => objectReader.facet(input),
     listLinks: async (input) => {
-      assertAuthorized(runtime, { kind: "object.view", objectTypeId: input.objectTypeId });
-      const links = await runtime.storage.objects.listLinks({
-        projectId: runtime.projectId,
-        ...input
-      });
-      return links.filter((link) => isAllowed(runtime.authorization, {
-        kind: "object.view",
-        objectTypeId: link.sourceTypeId
-      }) && isAllowed(runtime.authorization, {
-        kind: "object.view",
-        objectTypeId: link.targetTypeId
-      }));
+      return objectReader.listLinks(input);
     },
-    getTelemetryHistoryBatch: (input) => getTelemetryHistoryBatch({ projectId: runtime.projectId, ...input }, {
-      storage: runtime.storage.timeseries,
-      runtimeAuthorization: runtime.runtimeAuthorization,
-      authorization: runtime.authorization
-    }),
-    getTelemetryHistory: (input) => {
-      assertAuthorized(runtime, { kind: "object.view", objectTypeId: input.objectTypeId });
-      return runtime.storage.timeseries.getHistory({
-        projectId: runtime.projectId,
-        ...input
-      });
+    getTelemetryHistoryBatch: (input) => {
+      const timeseries = capturedRuntime.storage.timeseries;
+      return getTelemetryHistoryBatch(input, { storage: timeseries, objectReader });
     },
-    getLatestTelemetry: (input) => {
-      assertAuthorized(runtime, { kind: "object.view", objectTypeId: input.objectTypeId });
-      return runtime.storage.timeseries.getLatest({
-        projectId: runtime.projectId,
-        ...input
-      });
+    getTelemetryHistory: async (input) => {
+      const timeseries = capturedRuntime.storage.timeseries;
+      const objectTypeId = input.objectTypeId;
+      const objectId = input.objectId;
+      const propertyId = input.propertyId;
+      const from = input.from;
+      const to = input.to;
+      const limit = input.limit;
+      const order = input.order;
+      const [result] = await getTelemetryHistoryBatch({
+        series: [{ objectTypeId, objectId, propertyId }],
+        ...from === undefined ? {} : { from },
+        ...to === undefined ? {} : { to },
+        ...limit === undefined ? {} : { limitPerSeries: limit },
+        ...order === undefined ? {} : { order }
+      }, { storage: timeseries, objectReader });
+      return result?.points ?? [];
     },
-    list: (params) => listObjects(runtime, params),
-    get: async (objectTypeId, primaryId) => {
-      assertAuthorized(runtime, { kind: "object.view", objectTypeId });
-      return runtime.storage.objects.getByPrimaryId({
-        projectId: runtime.projectId,
-        objectTypeId,
-        primaryId
-      });
+    getLatestTelemetry: async (input) => {
+      const timeseries = capturedRuntime.storage.timeseries;
+      const objectTypeId = input.objectTypeId;
+      const objectId = input.objectId;
+      const propertyId = input.propertyId;
+      return getLatestTelemetryPoint({ objectTypeId, objectId, propertyId }, { storage: timeseries, objectReader });
     },
+    list: (params) => listObjects(capturedRuntime, params),
+    get: (objectTypeId, primaryId) => objectReader.getByPrimaryId({ objectTypeId, primaryId }),
     getPrimaryPropertyId: (objectTypeId) => {
-      assertAuthorized(runtime, { kind: "object.view", objectTypeId });
-      return runtime.ontology.getPrimaryPropertyId(objectTypeId);
+      return ontologyView().getPrimaryPropertyId(objectTypeId);
     },
-    upsert: (objectTypeId, properties) => upsertObject(runtime, objectTypeId, properties),
-    upsertBatch: (objectTypeId, items) => upsertObjectBatch(runtime, objectTypeId, items),
-    upsertLink: (objectTypeId, sourceId, linkId, target) => upsertLink(runtime, objectTypeId, sourceId, linkId, target),
-    upsertLinkBatch: (items) => upsertLinkBatch(runtime, items),
-    removeLink: (objectTypeId, sourceId, linkId, target) => removeLink(runtime, objectTypeId, sourceId, linkId, target),
-    appendTelemetry: (objectTypeId, items) => appendTelemetry(runtime, objectTypeId, items)
+    upsert: (objectTypeId, properties) => upsertObject(capturedRuntime, objectTypeId, properties),
+    upsertBatch: (objectTypeId, items) => upsertObjectBatch(capturedRuntime, objectTypeId, items),
+    upsertLink: (objectTypeId, sourceId, linkId, target) => upsertLink(capturedRuntime, objectTypeId, sourceId, linkId, target),
+    upsertLinkBatch: (items) => upsertLinkBatch(capturedRuntime, items),
+    removeLink: (objectTypeId, sourceId, linkId, target) => removeLink(capturedRuntime, objectTypeId, sourceId, linkId, target),
+    appendTelemetry: (objectTypeId, items) => appendTelemetry(capturedRuntime, objectTypeId, items)
   });
   return objects;
 }
 
 // src/pipelines/execution.ts
 function createPipelinesRuntime(runtime, execution, source) {
-  const allowed = (pipelineId) => isAllowed(runtime.authorization, { kind: "pipeline.run", pipelineId });
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const allowed = (pipelineId) => isRuntimeAllowed(runtime, { kind: "pipeline.run", pipelineId });
   const visibleIds = () => source.list().filter((pipeline) => allowed(pipeline.id)).map((pipeline) => pipeline.id);
+  const historyFilterIds = () => authority.type === "unrestricted" ? undefined : authority.type === "principal" ? visibleIds() : [];
   const getRun = async (runId) => {
+    if (authority.type === "denied" || authority.type === "delegated")
+      return null;
     const run = await runtime.storage.pipelineRuns?.getById({
       projectId: runtime.projectId,
       id: runId
     }) ?? null;
-    return run && canViewPipelineRun(runtime.authorization, run) ? run : null;
+    if (!run)
+      return null;
+    return authority.type === "unrestricted" || canViewPipelineRun(authority.context, run) ? run : null;
   };
   return {
-    list: () => source.list().filter((pipeline) => allowed(pipeline.id)),
+    list: () => authority.type === "denied" || authority.type === "delegated" ? [] : source.list().filter((pipeline) => allowed(pipeline.id)),
     getById: (pipelineId) => {
+      if (authority.type === "denied" || authority.type === "delegated")
+        return null;
       const pipeline = source.getById(pipelineId);
       return pipeline && allowed(pipelineId) ? pipeline : null;
     },
     request: async (input) => {
+      assertAuthorized(runtime, { kind: "pipeline.run", pipelineId: input.pipelineId });
       const pipeline = source.getById(input.pipelineId);
       if (!pipeline)
         throw new PipelineError(`[Sixb] Unknown pipeline '${input.pipelineId}'`);
@@ -1119,16 +1293,22 @@ function createPipelinesRuntime(runtime, execution, source) {
     runs: {
       getById: getRun,
       list: (input = {}) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ runs: [], hasMore: false, total: 0 });
+        }
         const storage = runtime.storage.pipelineRuns;
         if (!storage)
           return Promise.resolve({ runs: [], hasMore: false, total: 0 });
         return storage.list({
-          projectId: runtime.projectId,
           ...input,
-          pipelineIds: runtime.authorization ? visibleIds() : undefined
+          pipelineIds: historyFilterIds(),
+          projectId: runtime.projectId
         });
       },
       listLatest: (pipelineIds) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ runs: [] });
+        }
         const storage = runtime.storage.pipelineRuns;
         if (!storage || pipelineIds.length === 0)
           return Promise.resolve({ runs: [] });
@@ -1143,9 +1323,9 @@ function createPipelinesRuntime(runtime, execution, source) {
         if (!storage || !await getRun(runId))
           return null;
         return storage.listSteps({
-          projectId: runtime.projectId,
           ...input,
-          pipelineRunId: runId
+          pipelineRunId: runId,
+          projectId: runtime.projectId
         });
       }
     }
@@ -1154,39 +1334,95 @@ function createPipelinesRuntime(runtime, execution, source) {
 
 // src/projections/execution.ts
 function createProjectionsRuntime(runtime, source) {
-  const visible = (projection) => canViewProjection(runtime.authorization, projection);
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const listVisible = (list) => {
+    switch (authority.type) {
+      case "denied":
+      case "delegated":
+        return [];
+      case "principal":
+        return list().filter((projection) => canViewProjection(authority.context, projection));
+      case "unrestricted":
+        return [...list()];
+    }
+  };
+  const visible = (projection) => {
+    switch (authority.type) {
+      case "denied":
+      case "delegated":
+        return false;
+      case "principal":
+        return canViewProjection(authority.context, projection);
+      case "unrestricted":
+        return true;
+    }
+  };
   const visibleIds = (projectionIds) => projectionIds.filter((projectionId) => {
     const projection = source.getById(projectionId);
     return projection !== null && visible(projection);
   });
   return {
-    list: () => source.list().filter(visible),
-    listObjects: () => source.listObjects().filter(visible),
-    listLinks: () => source.listLinks().filter(visible),
-    listTelemetry: () => source.listTelemetry().filter(visible),
+    list: () => listVisible(() => source.list()),
+    listObjects: () => listVisible(() => source.listObjects()),
+    listLinks: () => listVisible(() => source.listLinks()),
+    listTelemetry: () => listVisible(() => source.listTelemetry()),
     getById: (projectionId) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return null;
+        case "principal":
+        case "unrestricted":
+          break;
+      }
       const projection = source.getById(projectionId);
       return projection && visible(projection) ? projection : null;
     },
     runs: {
       getById: async (runId) => {
+        switch (authority.type) {
+          case "denied":
+          case "delegated":
+            return null;
+          case "principal":
+          case "unrestricted":
+            break;
+        }
         const run = await runtime.storage.projectionRuns?.getById({
           projectId: runtime.projectId,
           id: runId
         }) ?? null;
-        return run && canViewProjectionRun(runtime.authorization, run.target) ? run : null;
+        if (!run)
+          return null;
+        return authority.type === "unrestricted" || canViewProjectionRun(authority.context, run.target) ? run : null;
       },
       list: (input = {}) => {
+        switch (authority.type) {
+          case "denied":
+          case "delegated":
+            return Promise.resolve({ runs: [], hasMore: false, total: 0 });
+          case "principal":
+          case "unrestricted":
+            break;
+        }
         const storage = runtime.storage.projectionRuns;
         if (!storage)
           return Promise.resolve({ runs: [], hasMore: false, total: 0 });
         return storage.list({
-          projectId: runtime.projectId,
           ...input,
-          objectTypeIds: runtime.authorization ? [...runtime.authorization.grants["view:object"]] : undefined
+          objectTypeIds: authority.type === "principal" ? [...authority.context.grants["view:object"]] : undefined,
+          projectId: runtime.projectId
         });
       },
       listLatest: (projectionIds) => {
+        switch (authority.type) {
+          case "denied":
+          case "delegated":
+            return Promise.resolve({ runs: [] });
+          case "principal":
+          case "unrestricted":
+            break;
+        }
         const storage = runtime.storage.projectionRuns;
         if (!storage || projectionIds.length === 0)
           return Promise.resolve({ runs: [] });
@@ -1199,25 +1435,35 @@ function createProjectionsRuntime(runtime, source) {
 
 // src/rules/execution.ts
 function createRulesRuntime(runtime, source) {
-  const visible = (rule) => isAllowed(runtime.authorization, {
-    kind: "object.view",
-    objectTypeId: rule.subject.objectTypeId
-  });
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const visible = (rule) => {
+    if (authority.type === "denied" || authority.type === "delegated")
+      return false;
+    return isRuntimeAllowed(runtime, {
+      kind: "object.view",
+      objectTypeId: rule.subject.objectTypeId
+    });
+  };
   return {
-    list: () => source.list().filter(visible),
+    list: () => authority.type === "denied" || authority.type === "delegated" ? [] : source.list().filter(visible),
     getById: (ruleId) => {
+      if (authority.type === "denied" || authority.type === "delegated")
+        return null;
       const rule = source.getById(ruleId);
       return rule && visible(rule) ? rule : null;
     },
     states: {
       list: (input = {}) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ states: [], hasMore: false, total: 0 });
+        }
         const storage = runtime.storage.rules;
         if (!storage)
           return Promise.resolve({ states: [], hasMore: false, total: 0 });
         return storage.listActive({
-          projectId: runtime.projectId,
           ...input,
-          objectTypeIds: runtime.authorization ? [...runtime.authorization.grants["view:object"]] : undefined
+          objectTypeIds: authority.type === "principal" ? [...authority.context.grants["view:object"]] : undefined,
+          projectId: runtime.projectId
         });
       }
     }
@@ -1225,24 +1471,299 @@ function createRulesRuntime(runtime, source) {
 }
 
 // src/schedules/execution.ts
-function createSchedulesRuntime(schedules) {
+function createSchedulesRuntime(runtime, schedules) {
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
   return {
-    list: () => schedules.list(),
-    getById: (scheduleId) => schedules.getById(scheduleId)
+    list: () => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return [];
+        case "principal":
+        case "unrestricted":
+          return schedules.list();
+      }
+    },
+    getById: (scheduleId) => {
+      switch (authority.type) {
+        case "denied":
+        case "delegated":
+          return null;
+        case "principal":
+        case "unrestricted":
+          return schedules.getById(scheduleId);
+      }
+    }
   };
 }
 
+// src/shares/execution.ts
+import { createHash as createHash2, randomBytes, randomUUID as randomUUID4 } from "crypto";
+var MAX_CREATE_ATTEMPTS = 5;
+
+class ShareError extends Error {
+  reason;
+  name = "ShareError";
+  constructor(reason, message, options) {
+    super(message, options);
+    this.reason = reason;
+  }
+}
+function createSharesRuntime(runtime, execution, definitions) {
+  const managementPrincipal = () => {
+    const authority = resolveExecutionScopeAuthorization(runtime.projectId, {
+      execution,
+      authorization: runtime.runtimeAuthorization
+    });
+    if (authority.type !== "principal" || authority.context.principal.type === "system") {
+      throw new ShareError("unauthenticated", "[Sixb] Shared access grants require user or service-account authority.");
+    }
+    return {
+      type: authority.context.principal.type,
+      id: authority.context.principal.id
+    };
+  };
+  const canManage = (shareId) => {
+    try {
+      managementPrincipal();
+      return isRuntimeAllowed(runtime, { kind: "share.manage", shareId });
+    } catch {
+      return false;
+    }
+  };
+  const resolveManageableDefinition = (definitionId) => {
+    const id = validDefinitionId(definitionId);
+    managementPrincipal();
+    assertCanManage(runtime, id);
+    return resolveDefinition(definitions, id);
+  };
+  const issueByDefinition = async (definition, input) => {
+    assertInputObject(input, "Shared access issue input");
+    const issuer = managementPrincipal();
+    assertCanManage(runtime, definition.id);
+    const storage = requireShareStorage(runtime);
+    const createdAt = new Date;
+    const expiresAt = validFutureDate(input.expiresAt, createdAt);
+    const target = exactTarget(definition, input.target);
+    const object = await runtime.objectReader.getByPrimaryId({
+      objectTypeId: target.objectTypeId,
+      primaryId: target.primaryId
+    });
+    if (!object) {
+      throw new ObjectNotFoundError(target.objectTypeId, target.primaryId, "Share target not found");
+    }
+    const authoritySnapshot = {
+      version: 1,
+      access: compileShareAccessPlan({
+        share: definition,
+        target,
+        ontology: runtime.ontology,
+        actions: runtime.actionRegistry
+      })
+    };
+    for (let attempt = 0;attempt < MAX_CREATE_ATTEMPTS; attempt += 1) {
+      const secret = randomBytes(32).toString("base64url");
+      try {
+        const grant = await storage.create({
+          id: `shr_${randomUUID4()}`,
+          projectId: runtime.projectId,
+          definitionId: definition.id,
+          target,
+          issuedBy: issuer,
+          authoritySnapshot,
+          tokenHash: sha256(secret),
+          destinationPath: input.destinationPath,
+          createdAt,
+          expiresAt
+        });
+        return { grant: publicGrant(grant), secret };
+      } catch (error) {
+        if (error instanceof ShareGrantStorageError && error.code === "invalid_input") {
+          throw new ShareError("invalid_input", error.message, { cause: error });
+        }
+        if (!(error instanceof ShareGrantStorageError) || error.code !== "duplicate" || attempt === MAX_CREATE_ATTEMPTS - 1) {
+          throw storageFailure("issue", error);
+        }
+      }
+    }
+    throw storageFailure("issue");
+  };
+  const listByDefinition = async (definition, input = {}) => {
+    assertInputObject(input, "Shared access list input");
+    managementPrincipal();
+    assertCanManage(runtime, definition.id);
+    const storage = requireShareStorage(runtime);
+    const target = input.target === undefined ? undefined : exactTarget(definition, input.target);
+    try {
+      const result = await storage.list({
+        projectId: runtime.projectId,
+        definitionId: definition.id,
+        ...target === undefined ? {} : { target },
+        includeRevoked: input.includeRevoked,
+        includeExpired: input.includeExpired,
+        now: new Date,
+        limit: input.limit,
+        offset: input.offset
+      });
+      return { ...result, grants: result.grants.map(publicGrant) };
+    } catch (error) {
+      if (error instanceof ShareGrantStorageError && error.code === "invalid_input") {
+        throw new ShareError("invalid_input", error.message, { cause: error });
+      }
+      throw storageFailure("list", error);
+    }
+  };
+  return {
+    listDefinitions: () => definitions.list().filter((definition) => canManage(definition.id)),
+    getDefinitionById: (definitionId) => {
+      const definition = definitions.getById(definitionId);
+      return definition && canManage(definition.id) ? definition : null;
+    },
+    async issue(definition, input) {
+      return issueByDefinition(resolveManageableDefinition(definitionIdFromReference(definition)), input);
+    },
+    async issueById(input) {
+      assertInputObject(input, "Shared access issue input");
+      return issueByDefinition(resolveManageableDefinition(input.definitionId), input);
+    },
+    async list(definition, input) {
+      return listByDefinition(resolveManageableDefinition(definitionIdFromReference(definition)), input);
+    },
+    async listById(input) {
+      assertInputObject(input, "Shared access list input");
+      const definition = resolveManageableDefinition(input.definitionId);
+      const { primaryId, includeRevoked, includeExpired, limit, offset } = input;
+      return listByDefinition(definition, {
+        ...primaryId === undefined ? {} : {
+          target: {
+            objectTypeId: definition.target.objectTypeId,
+            primaryId
+          }
+        },
+        includeRevoked,
+        includeExpired,
+        limit,
+        offset
+      });
+    },
+    revoke: async (grantId) => {
+      const actor = managementPrincipal();
+      const storage = requireShareStorage(runtime);
+      if (typeof grantId !== "string" || !grantId.trim()) {
+        throw new ShareError("invalid_input", "[Sixb] Shared access grant id must not be empty.");
+      }
+      let current;
+      try {
+        current = await storage.getById({ projectId: runtime.projectId, id: grantId });
+      } catch (error) {
+        throw storageFailure("load for revocation", error);
+      }
+      if (!current)
+        return null;
+      if (!definitions.getById(current.definitionId) || !canManage(current.definitionId)) {
+        return null;
+      }
+      try {
+        const revoked = await storage.revoke({
+          projectId: runtime.projectId,
+          id: grantId,
+          revokedAt: new Date,
+          revokedBy: actor
+        });
+        return revoked ? publicGrant(revoked) : null;
+      } catch (error) {
+        throw storageFailure("revoke", error);
+      }
+    }
+  };
+}
+function definitionIdFromReference(value) {
+  return typeof value === "object" && value !== null ? value.id : undefined;
+}
+function assertInputObject(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new ShareError("invalid_input", `[Sixb] ${label} must be an object.`);
+  }
+}
+function resolveDefinition(definitions, definitionId) {
+  const id = validDefinitionId(definitionId);
+  const definition = definitions.getById(id);
+  if (!definition) {
+    throw new ShareError("not_found", `[Sixb] Unknown Share definition '${id}'.`);
+  }
+  return definition;
+}
+function validDefinitionId(value) {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new ShareError("invalid_input", "[Sixb] Share definition id must not be empty.");
+  }
+  return value;
+}
+function assertCanManage(runtime, shareId) {
+  assertAuthorized(runtime, { kind: "share.manage", shareId });
+}
+function requireShareStorage(runtime) {
+  const storage = runtime.storage.shareGrants;
+  if (!storage) {
+    throw new ShareError("storage_unavailable", "[Sixb] Share grant storage is not configured on this runtime.");
+  }
+  return storage;
+}
+function exactTarget(definition, value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new ShareError("invalid_input", "[Sixb] Share target must be an exact object reference.");
+  }
+  const objectTypeId = value.objectTypeId;
+  const primaryId = value.primaryId;
+  if (typeof objectTypeId !== "string" || typeof primaryId !== "string" || !primaryId.trim()) {
+    throw new ShareError("invalid_input", "[Sixb] Share target must be an exact object reference.");
+  }
+  if (objectTypeId !== definition.target.objectTypeId) {
+    throw new ShareError("invalid_input", `[Sixb] Share '${definition.id}' targets '${definition.target.objectTypeId}', not '${objectTypeId}'.`);
+  }
+  return Object.freeze({ objectTypeId, primaryId });
+}
+function validFutureDate(value, now) {
+  if (!(value instanceof Date) || !Number.isFinite(value.getTime()) || value <= now) {
+    throw new ShareError("invalid_input", "[Sixb] Shared access expiry must be a valid future date.");
+  }
+  return new Date(value);
+}
+function sha256(value) {
+  return createHash2("sha256").update(value).digest("hex");
+}
+function publicGrant(record) {
+  const {
+    projectId: _projectId,
+    authoritySnapshot: _authoritySnapshot,
+    authorityDigest: _authorityDigest,
+    tokenHash: _tokenHash,
+    ...grant
+  } = record;
+  return structuredClone(grant);
+}
+function storageFailure(operation, cause) {
+  return new ShareError("storage_failure", `[Sixb] Share grant storage failed to ${operation}.`, {
+    cause
+  });
+}
+
 // src/syncs/execution.ts
 function createSyncsRuntime(runtime, execution, source) {
-  const allowed = (syncId) => isAllowed(runtime.authorization, { kind: "sync.run", syncId });
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const allowed = (syncId) => isRuntimeAllowed(runtime, { kind: "sync.run", syncId });
   const visibleIds = () => source.list().filter((sync) => allowed(sync.id)).map((sync) => sync.id);
+  const historyFilterIds = () => authority.type === "unrestricted" ? undefined : authority.type === "principal" ? visibleIds() : [];
   return {
-    list: () => source.list().filter((sync) => allowed(sync.id)),
+    list: () => authority.type === "denied" || authority.type === "delegated" ? [] : source.list().filter((sync) => allowed(sync.id)),
     getById: (syncId) => {
+      if (authority.type === "denied" || authority.type === "delegated")
+        return null;
       const sync = source.getById(syncId);
       return sync && allowed(syncId) ? sync : null;
     },
     request: async (input) => {
+      assertAuthorized(runtime, { kind: "sync.run", syncId: input.syncId });
       const sync = source.getById(input.syncId);
       if (!sync)
         throw new SyncValidationError(`[Sixb] Unknown sync '${input.syncId}'`);
@@ -1250,6 +1771,8 @@ function createSyncsRuntime(runtime, execution, source) {
     },
     runs: {
       getById: async (runId) => {
+        if (authority.type === "denied" || authority.type === "delegated")
+          return null;
         const run = await runtime.storage.syncRuns?.getById({
           projectId: runtime.projectId,
           id: runId
@@ -1257,16 +1780,22 @@ function createSyncsRuntime(runtime, execution, source) {
         return run && allowed(run.syncId) ? run : null;
       },
       list: (input = {}) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ runs: [], hasMore: false, total: 0 });
+        }
         const storage = runtime.storage.syncRuns;
         if (!storage)
           return Promise.resolve({ runs: [], hasMore: false, total: 0 });
         return storage.list({
-          projectId: runtime.projectId,
           ...input,
-          syncIds: runtime.authorization ? visibleIds() : undefined
+          syncIds: historyFilterIds(),
+          projectId: runtime.projectId
         });
       },
       listLatest: (syncIds) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ runs: [] });
+        }
         const storage = runtime.storage.syncRuns;
         if (!storage || syncIds.length === 0)
           return Promise.resolve({ runs: [] });
@@ -1292,7 +1821,7 @@ class WorkflowValidationError extends Error {
 }
 
 // src/workflows/run-dispatch.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import { isDeepStrictEqual } from "util";
 
 // src/workflows/validation.ts
@@ -1981,7 +2510,7 @@ async function persistWorkflowRun(input, request) {
     assertExistingWorkflowRun(existing, input.workflow.id, request.snapshot);
     return { run: existing, created: false };
   }
-  const execution = await input.createExecution(`exec_${randomUUID4()}`, request.runId);
+  const execution = await input.createExecution(`exec_${randomUUID5()}`, request.runId);
   const queuedAt = new Date;
   try {
     return await input.storage.transaction(async (tx) => {
@@ -2088,7 +2617,7 @@ async function failWorkflowRunPublication(input, run, error) {
 }
 function resolveWorkflowRunId(runId) {
   if (runId === undefined)
-    return `run_${randomUUID4()}`;
+    return `run_${randomUUID5()}`;
   if (!runId.trim()) {
     throw new WorkflowValidationError("[Sixb] Workflow run id must not be empty");
   }
@@ -2134,6 +2663,10 @@ function assertNonBlank(value, label) {
 
 // src/workflows/request.ts
 async function requestWorkflowRun(runtime, execution, workflow, options = {}) {
+  resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization
+  });
   assertAuthorized(runtime, { kind: "workflow.run", workflowId: workflow.id });
   const requesterGroupIds = execution.requestedBy ? await snapshotRequesterGroupIds({
     auth: runtime.storage.auth,
@@ -2168,15 +2701,31 @@ async function requestWorkflowRun(runtime, execution, workflow, options = {}) {
 
 // src/workflows/execution.ts
 function createWorkflowsRuntime(runtime, execution, source) {
-  const allowed = (workflowId) => isAllowed(runtime.authorization, { kind: "workflow.run", workflowId });
-  const canAccessHistory = (workflowId) => allowed(workflowId) && (!runtime.authorization || source.getById(workflowId) !== null);
+  const authority = resolveRuntimeAuthorizationForProject(runtime);
+  const allowed = (workflowId) => isRuntimeAllowed(runtime, { kind: "workflow.run", workflowId });
+  const canAccessHistory = (workflowId) => {
+    switch (authority.type) {
+      case "denied":
+      case "delegated":
+        return false;
+      case "unrestricted":
+        return true;
+      case "principal":
+        return allowed(workflowId) && source.getById(workflowId) !== null;
+    }
+  };
   const visibleIds = () => source.list().filter((workflow) => allowed(workflow.id)).map((workflow) => workflow.id);
+  const historyFilterIds = () => authority.type === "unrestricted" ? undefined : authority.type === "principal" ? visibleIds() : [];
   const getVisibleRunRecord = async (runId) => {
+    if (authority.type === "denied" || authority.type === "delegated")
+      return null;
     const run = await runtime.storage.workflowRuns?.getById({
       projectId: runtime.projectId,
       id: runId
     }) ?? null;
-    return run && canViewWorkflowRun(runtime.authorization, run) && canAccessHistory(run.workflowId) ? run : null;
+    if (!run || !canAccessHistory(run.workflowId))
+      return null;
+    return authority.type === "unrestricted" || canViewWorkflowRun(authority.context, run) ? run : null;
   };
   const getRun = async (runId) => {
     const run = await getVisibleRunRecord(runId);
@@ -2187,9 +2736,9 @@ function createWorkflowsRuntime(runtime, execution, source) {
     if (!storage || !await getVisibleRunRecord(runId))
       return null;
     const result = await storage.nodes.list({
-      projectId: runtime.projectId,
       ...input,
-      workflowRunId: runId
+      workflowRunId: runId,
+      projectId: runtime.projectId
     });
     return {
       ...result,
@@ -2197,13 +2746,16 @@ function createWorkflowsRuntime(runtime, execution, source) {
     };
   };
   return {
-    list: () => source.list().filter((workflow) => allowed(workflow.id)),
+    list: () => authority.type === "denied" || authority.type === "delegated" ? [] : source.list().filter((workflow) => allowed(workflow.id)),
     getById: (workflowId) => {
+      if (authority.type === "denied" || authority.type === "delegated")
+        return null;
       const workflow = source.getById(workflowId);
       return workflow && allowed(workflowId) ? workflow : null;
     },
     request: (workflow, options) => requestWorkflowRun(runtime, execution, workflow, options),
     requestById: async (input) => {
+      assertAuthorized(runtime, { kind: "workflow.run", workflowId: input.workflowId });
       const workflow = source.getById(input.workflowId);
       if (!workflow) {
         throw new WorkflowValidationError(`[Sixb] Unknown workflow '${input.workflowId}'`);
@@ -2213,13 +2765,16 @@ function createWorkflowsRuntime(runtime, execution, source) {
     runs: {
       getById: getRun,
       list: async (input = {}) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return { runs: [], hasMore: false, total: 0 };
+        }
         const storage = runtime.storage.workflowRuns;
         if (!storage)
           return { runs: [], hasMore: false, total: 0 };
         const result = await storage.list({
-          projectId: runtime.projectId,
           ...input,
-          workflowIds: runtime.authorization ? visibleIds() : undefined
+          workflowIds: historyFilterIds(),
+          projectId: runtime.projectId
         });
         return {
           ...result,
@@ -2227,6 +2782,9 @@ function createWorkflowsRuntime(runtime, execution, source) {
         };
       },
       listLatest: async (workflowIds) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return { runs: [] };
+        }
         const storage = runtime.storage.workflowRuns;
         if (!storage || workflowIds.length === 0)
           return { runs: [] };
@@ -2245,20 +2803,27 @@ function createWorkflowsRuntime(runtime, execution, source) {
     },
     interventions: {
       getById: async (interventionId) => {
+        if (authority.type === "denied" || authority.type === "delegated")
+          return null;
         const intervention = await runtime.storage.workflowInterventions?.getById({
           projectId: runtime.projectId,
           id: interventionId
         }) ?? null;
-        return intervention && canViewWorkflowIntervention(runtime.authorization, intervention) && canAccessHistory(intervention.workflowId) ? intervention : null;
+        if (!intervention || !canAccessHistory(intervention.workflowId))
+          return null;
+        return authority.type === "unrestricted" || canViewWorkflowIntervention(authority.context, intervention) ? intervention : null;
       },
       list: (input = {}) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ interventions: [], hasMore: false, total: 0 });
+        }
         const storage = runtime.storage.workflowInterventions;
         if (!storage)
           return Promise.resolve({ interventions: [], hasMore: false, total: 0 });
         return storage.list({
-          projectId: runtime.projectId,
           ...input,
-          workflowIds: runtime.authorization ? visibleIds() : undefined
+          workflowIds: historyFilterIds(),
+          projectId: runtime.projectId
         });
       }
     }
@@ -2337,6 +2902,14 @@ async function attachRequestedBy(runtime, run) {
 // src/runtime/sixb.ts
 var boundSixbInstances = new WeakSet;
 function createBoundSixb(runtime, dependencies, execution) {
+  resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization
+  });
+  assertAuthorizedObjectReaderBinding({
+    reader: runtime.objectReader,
+    scope: { execution, authorization: runtime.runtimeAuthorization }
+  });
   const sixb = {
     execution,
     ...createExecutionFacades(runtime, execution, dependencies)
@@ -2355,7 +2928,7 @@ function createExecutionFacades(runtime, execution, dependencies) {
   return {
     objects: createObjectsRuntime(runtime, execution),
     actions: createActionsRuntime(runtime, execution),
-    datasets: createDatasetsRuntime(runtime, dependencies.definitions.datasets),
+    datasets: createDatasetsRuntime(runtime, execution, dependencies.definitions.datasets, dependencies.lakeStorage, dependencies.blobStorage),
     workflows: createWorkflowsRuntime(runtime, execution, dependencies.definitions.workflows),
     syncs: createSyncsRuntime(runtime, execution, dependencies.definitions.syncs),
     pipelines: createPipelinesRuntime(runtime, execution, dependencies.definitions.pipelines),
@@ -2365,7 +2938,8 @@ function createExecutionFacades(runtime, execution, dependencies) {
     aiUsage: createAiUsageRuntime(runtime, dependencies.definitions.security),
     events: createEventsRuntime(runtime),
     logs: createLogsRuntime(runtime, dependencies.logging),
-    schedules: createSchedulesRuntime(dependencies.definitions.schedules),
+    schedules: createSchedulesRuntime(runtime, dependencies.definitions.schedules),
+    shares: createSharesRuntime(runtime, execution, dependencies.definitions.shares),
     connector: createConnectorRuntime(runtime, execution, dependencies.connectorService),
     blobs: createBlobsRuntime(runtime, execution, dependencies.blobStorage)
   };
@@ -2430,10 +3004,7 @@ function restoreAgentExecutionScope(input) {
   return Object.freeze({
     execution: context,
     authorization: createAgentRuntimeAuthorization({
-      projectId: input.execution.projectId,
-      executionId: input.execution.id,
-      ...input.actorId === undefined ? {} : { actorId: input.actorId },
-      runId: input.runId,
+      execution: context,
       authority: input.authorization.type === "principal" ? {
         type: "principal",
         context: input.authorization.context,
@@ -2481,6 +3052,6 @@ function invalidAgentExecution(executionId, runId) {
   throw new ExecutionStorageError("invalid_input", `[Sixb] Execution '${executionId}' does not authorize Agent run '${runId}'.`);
 }
 
-export { resolveAgentContextParts, agentRunQueueJobId, subagentRunQueueJobId, workflowAgentNodeQueueJobId, dispatchQueuedAgentRuns, dispatchQueuedSubagentRuns, createAgentThreadId, createAgentRunId, createSubagentRunId, createSubagentExecutionId, createAgentMessageId, agentContextCheckpointId, createAgentRunExecutionToken, assertNoAgentDefinitions, WorkflowDefinitionError, WorkflowValidationError, assertNonEmpty, isStepDefinition, isAgentStepDefinition, isInterventionDefinition, isWorkflowDefinition, validateWorkflowDefinition, validateWorkflowsAtStartup, validateWorkflowAgentStepGroupReferences, validateWorkflowInput, validateWorkflowStepInput, validateWorkflowStepOutput, validateWorkflowInterventionInput, validateWorkflowInterventionResponse, validateWorkflowInterventionDefaultResponse, validateWorkflowAgentStepInput, validateWorkflowAgentStepOutput, snapshotWorkflowAgentStepInput, snapshotWorkflowAgentStepOutput, snapshotWorkflowInput, snapshotWorkflowStepInput, snapshotWorkflowStepOutput, snapshotWorkflowInterventionInput, snapshotWorkflowInterventionResponse, snapshotWorkflowInterventionDefaultResponse, snapshotWorkflowActionInput, WorkflowRunDispatcher, requestWorkflowRun, createBoundSixb, isBoundSixb, canInheritAgentRequestAuthorization, createAgentExecutionRecord, createInheritedAgentExecutionRecord, bindDurableAgentExecution, restoreAgentExecutionScope, assertAgentExecutionRecord, requestAgentRun, retryAgentRun };
+export { resolveAgentContextParts, agentRunQueueJobId, subagentRunQueueJobId, workflowAgentNodeQueueJobId, dispatchQueuedAgentRuns, dispatchQueuedSubagentRuns, createAgentThreadId, createAgentRunId, createSubagentRunId, createSubagentExecutionId, createAgentMessageId, agentContextCheckpointId, createAgentRunExecutionToken, assertNoAgentDefinitions, ShareError, WorkflowDefinitionError, WorkflowValidationError, assertNonEmpty, isStepDefinition, isAgentStepDefinition, isInterventionDefinition, isWorkflowDefinition, validateWorkflowDefinition, validateWorkflowsAtStartup, validateWorkflowAgentStepGroupReferences, validateWorkflowInput, validateWorkflowStepInput, validateWorkflowStepOutput, validateWorkflowInterventionInput, validateWorkflowInterventionResponse, validateWorkflowInterventionDefaultResponse, validateWorkflowAgentStepInput, validateWorkflowAgentStepOutput, snapshotWorkflowAgentStepInput, snapshotWorkflowAgentStepOutput, snapshotWorkflowInput, snapshotWorkflowStepInput, snapshotWorkflowStepOutput, snapshotWorkflowInterventionInput, snapshotWorkflowInterventionResponse, snapshotWorkflowInterventionDefaultResponse, snapshotWorkflowActionInput, WorkflowRunDispatcher, requestWorkflowRun, createBoundSixb, isBoundSixb, canInheritAgentRequestAuthorization, createAgentExecutionRecord, createInheritedAgentExecutionRecord, bindDurableAgentExecution, restoreAgentExecutionScope, assertAgentExecutionRecord, requestAgentRun, retryAgentRun };
 
-//# debugId=00C5E0281CC5D43264756E2164756E21
+//# debugId=3C841C41C07F660564756E2164756E21