@sixb/core 0.1.7 → 0.1.8

package/dist/execution/agent.js

@@ -6,42 +6,46 @@ import {
   createAgentExecutionRecord,
   createInheritedAgentExecutionRecord,
   restoreAgentExecutionScope
-} from "../chunk-h0knpbz5.js";
-import"../chunk-ha58tjtt.js";
+} from "../chunk-xajtptbw.js";
+import"../chunk-wtf06et8.js";
 import"../chunk-c15dr03f.js";
-import"../chunk-rp1mvzb4.js";
-import"../chunk-e4rvtvpw.js";
-import"../chunk-4rh2m6zg.js";
+import"../chunk-v4en4jc2.js";
+import"../chunk-w9tg6yyb.js";
+import"../chunk-aa2pen2v.js";
 import"../chunk-xhy826cz.js";
-import"../chunk-3fqt22c4.js";
-import"../chunk-rte5sm3z.js";
+import"../chunk-4rh2m6zg.js";
 import"../chunk-8m5ejdpn.js";
 import"../chunk-nf4r78r4.js";
-import"../chunk-d2ndstdf.js";
-import"../chunk-y35ma3mj.js";
-import"../chunk-9aehf39w.js";
+import"../chunk-359jm1jw.js";
+import"../chunk-n4khvw9n.js";
+import"../chunk-pc7ys28c.js";
+import"../chunk-v1xppd0y.js";
+import"../chunk-h5vqbfmd.js";
+import"../chunk-q0k9nc5a.js";
+import"../chunk-rte5sm3z.js";
+import"../chunk-f26bck4t.js";
 import"../chunk-96swp2wd.js";
 import {
   ensureExecutionRecord
-} from "../chunk-hdz94br2.js";
-import"../chunk-6ed5bwnd.js";
-import"../chunk-4nxeacx7.js";
-import"../chunk-agsvg9ar.js";
-import"../chunk-qjzp9xyb.js";
+} from "../chunk-k522z7v6.js";
+import"../chunk-sbzzr4kx.js";
+import"../chunk-4jjp5k14.js";
+import"../chunk-rv2hkwwa.js";
+import"../chunk-nx7k8tpr.js";
+import"../chunk-4yqmp43v.js";
+import"../chunk-wdage1eb.js";
+import"../chunk-5ntny1qx.js";
+import"../chunk-nn0tekr1.js";
+import"../chunk-p03r0h5s.js";
+import"../chunk-jecn6t54.js";
 import"../chunk-5gd7tpv6.js";
-import"../chunk-gbrpsx4m.js";
+import"../chunk-rafagrwr.js";
 import"../chunk-8tsf6dmc.js";
-import"../chunk-xc7hq65b.js";
-import"../chunk-5jcdmjam.js";
-import"../chunk-xdpwpkha.js";
+import"../chunk-yp8ee62z.js";
 import"../chunk-ka3a2ft3.js";
-import"../chunk-1kamz6j0.js";
-import"../chunk-08twe8m6.js";
-import"../chunk-3kv70xwp.js";
-import"../chunk-p03r0h5s.js";
-import"../chunk-jecn6t54.js";
-import"../chunk-x0qhkqje.js";
-import"../chunk-dqn23610.js";
+import"../chunk-w1tvjszy.js";
+import"../chunk-p1rzczbt.js";
+import"../chunk-j1sbhm7p.js";
 import"../chunk-9dzba0f2.js";
 import"../chunk-dbc80ad7.js";
 import"../chunk-ry24jbr1.js";
@@ -54,16 +58,19 @@ import"../chunk-1evzqhks.js";
 import"../chunk-jq43kdvk.js";
 import"../chunk-qw9gvjv5.js";
 import"../chunk-yt8wphsx.js";
-import"../chunk-atmkaf60.js";
+import"../chunk-5e3pq99w.js";
 import"../chunk-7y0f6rf1.js";
 import"../chunk-d8qkxt2v.js";
-import"../chunk-rre42skh.js";
+import"../chunk-4sm0aznx.js";
 import"../chunk-4a849fr1.js";
+import"../chunk-2dw777qw.js";
+import"../chunk-19jp6g9d.js";
 import"../chunk-xwnf87e1.js";
-import"../chunk-37wk412q.js";
-import"../chunk-d63tybny.js";
-import"../chunk-04b07a9q.js";
+import"../chunk-p1x242ad.js";
+import"../chunk-r8jrnexe.js";
+import"../chunk-h0k55pc7.js";
 import"../chunk-dktq02ne.js";
+import"../chunk-04b07a9q.js";
 import"../chunk-08m3b6w8.js";
 import"../chunk-2xns679x.js";
 import"../chunk-n6jxh8sw.js";
@@ -78,4 +85,4 @@ export {
   assertAgentExecutionRecord
 };
 
-//# debugId=619B96BF0D5C2A1864756E2164756E21
+//# debugId=003E79197C173FC764756E2164756E21

package/dist/execution/agent.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "619B96BF0D5C2A1864756E2164756E21",
+  "debugId": "003E79197C173FC764756E2164756E21",
   "names": []
 }

package/dist/execution/authorization.d.ts

@@ -1,5 +1,8 @@
 import type { AuthorizationContext } from "../authorization/types";
-import { type AuthorizationRef, type ExecutionScope, type KernelOperation, type RuntimeAuthorization, type TrustedPrimitiveRef } from "./types";
+import type { ObjectRef } from "../ontology";
+import { type ObjectReadExecutionLimits } from "../storage/objects/execution-limits";
+import type { CompiledSelectedObjectReadScope, SelectedObjectReadScope } from "../storage/objects/types";
+import { type AuthorizationRef, type ExecutionContext, type ExecutionScope, type KernelOperation, type RuntimeAuthorization, type TrustedPrimitiveRef } from "./types";
 export type ResolvedRuntimeAuthorization = {
     readonly type: "principal";
     readonly projectId: string;
@@ -7,30 +10,38 @@ export type ResolvedRuntimeAuthorization = {
     readonly ref: Extract<AuthorizationRef, {
         readonly type: "principal";
     }>;
-    /** Process-local binding used by provider façades that explicitly support agent runs. */
-    readonly executionBinding?: AgentExecutionBinding;
 } | {
     readonly type: "unrestricted";
     readonly projectId: string;
     readonly ref: Exclude<AuthorizationRef, {
-        readonly type: "principal";
+        readonly type: "principal" | "delegated";
     }>;
-    /** Process-local binding used by provider façades that explicitly support agent runs. */
-    readonly executionBinding?: AgentExecutionBinding;
+} | {
+    readonly type: "delegated";
+    readonly projectId: string;
+    readonly objectRead: DelegatedObjectReadAuthorization;
+    readonly actionApply: readonly DelegatedActionApplyTarget[];
+    readonly delegation?: Extract<AuthorizationRef, {
+        readonly type: "delegated";
+    }>["delegation"];
 } | {
     readonly type: "denied";
 };
+/** Immutable process-local object-read authority. It has no durable representation. */
+export interface DelegatedObjectReadAuthorization {
+    readonly scope: CompiledSelectedObjectReadScope;
+    readonly limits: ObjectReadExecutionLimits;
+}
+/** One exact object-bound Action target carried by process-local delegated authority. */
+export interface DelegatedActionApplyTarget {
+    readonly actionId: string;
+    readonly subject: ObjectRef;
+}
 type RegisteredRuntimeAuthorization = Exclude<ResolvedRuntimeAuthorization, {
     readonly type: "denied";
 }>;
-interface AgentExecutionBinding {
-    readonly type: "agent";
-    readonly executionId: string;
-    readonly actorId?: string;
-    readonly runId: string;
-}
 export declare function createPrincipalRuntimeAuthorization(input: {
-    readonly projectId: string;
+    readonly execution: ExecutionContext;
     readonly context: AuthorizationContext;
     readonly credential?: Extract<AuthorizationRef, {
         readonly type: "principal";
@@ -38,10 +49,7 @@ export declare function createPrincipalRuntimeAuthorization(input: {
 }): RuntimeAuthorization;
 /** Register restored authority bound to one exact agent run. */
 export declare function createAgentRuntimeAuthorization(input: {
-    readonly projectId: string;
-    readonly executionId: string;
-    readonly actorId?: string;
-    readonly runId: string;
+    readonly execution: ExecutionContext;
     readonly authority: {
         readonly type: "principal";
         readonly context: AuthorizationContext;
@@ -52,18 +60,48 @@ export declare function createAgentRuntimeAuthorization(input: {
         readonly type: "disabled";
     };
 }): RuntimeAuthorization;
-export declare function createDisabledRuntimeAuthorization(projectId: string): RuntimeAuthorization;
+export declare function createDisabledRuntimeAuthorization(execution: ExecutionContext): RuntimeAuthorization;
+/** Register exact object-read authority without fabricating a principal identity. */
+export declare function createDelegatedRuntimeAuthorization(input: {
+    readonly execution: ExecutionContext;
+    readonly objectRead: {
+        readonly selection: SelectedObjectReadScope;
+        readonly limits: ObjectReadExecutionLimits;
+    };
+    readonly actionApply?: readonly DelegatedActionApplyTarget[];
+    readonly delegation?: Extract<AuthorizationRef, {
+        readonly type: "delegated";
+    }>["delegation"];
+}): RuntimeAuthorization;
 export declare function createTrustedPrimitiveRuntimeAuthorization(input: {
-    readonly projectId: string;
+    readonly execution: ExecutionContext;
     readonly primitive: TrustedPrimitiveRef;
 }): RuntimeAuthorization;
 export declare function createKernelRuntimeAuthorization(input: {
-    readonly projectId: string;
+    readonly execution: ExecutionContext;
     readonly operation: KernelOperation;
 }): RuntimeAuthorization;
 export declare function resolveRuntimeAuthorization(authorization: unknown): ResolvedRuntimeAuthorization;
+/**
+ * Resolve authority from a runtime already admitted by `SixbHost.withScope`.
+ *
+ * Bound runtime facades carry no second execution value to recombine. Any lower-level boundary
+ * that receives an `ExecutionContext` separately must use `resolveExecutionScopeAuthorization`.
+ */
+export declare function resolveRuntimeAuthorizationForProject(input: {
+    readonly projectId: unknown;
+    readonly runtimeAuthorization?: unknown;
+}): ResolvedRuntimeAuthorization;
 export declare function getAuthorizationRef(authorization: RuntimeAuthorization): AuthorizationRef;
 export declare function assertExecutionScopeProject(projectId: string, scope: ExecutionScope): void;
+/**
+ * Capture the two opaque capabilities carried by a scope exactly once.
+ *
+ * Security-sensitive boundaries must not resolve a caller-owned wrapper and then read it again:
+ * accessor-backed inputs could otherwise substitute a different execution or authority between
+ * those operations.
+ */
+export declare function captureExecutionScope(scope: ExecutionScope): ExecutionScope;
 /** Validate that one registered authority belongs to the exact execution it accompanies. */
 export declare function resolveExecutionScopeAuthorization(projectId: string, scope: ExecutionScope): RegisteredRuntimeAuthorization;
 export {};

package/dist/execution/authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/execution/authorization.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,wBAAwB,CAAA;AAE9E,OAAO,EAEL,KAAK,gBAAgB,EAErB,KAAK,cAAc,EAEnB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAEzB,KAAK,mBAAmB,EACzB,MAAM,SAAS,CAAA;AAEhB,MAAM,MAAM,4BAA4B,GACpC;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAA;IACvE,yFAAyF;IACzF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;CAClD,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAA;IACvE,yFAAyF;IACzF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;CAClD,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAA;AAE/B,KAAK,8BAA8B,GAAG,OAAO,CAC3C,4BAA4B,EAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAC5B,CAAA;AAMD,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAID,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC,YAAY,CAAC,CAAA;CAC9F,GAAG,oBAAoB,CAEvB;AAED,gEAAgE;AAChE,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EACd;QACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;QAC1B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;QACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,gBAAgB,EAChB;YAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;SAAE,CAC/B,CAAC,YAAY,CAAC,CAAA;KAChB,GACD;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAA;CAClC,GAAG,oBAAoB,CA8BvB;AA6BD,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,MAAM,GAAG,oBAAoB,CAE1F;AAED,wBAAgB,0CAA0C,CAAC,KAAK,EAAE;IAChE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC,GAAG,oBAAoB,CAOvB;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CACpC,GAAG,oBAAoB,CAOvB;AAED,wBAAgB,2BAA2B,CAAC,aAAa,EAAE,OAAO,GAAG,4BAA4B,CAKhG;AAED,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,oBAAoB,GAAG,gBAAgB,CAMzF;AAED,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAqC1F;AAED,4FAA4F;AAC5F,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,cAAc,GACpB,8BAA8B,CAsFhC"}
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../src/execution/authorization.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAc,MAAM,wBAAwB,CAAA;AAE9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EACL,KAAK,yBAAyB,EAE/B,MAAM,qCAAqC,CAAA;AAE5C,OAAO,KAAK,EACV,+BAA+B,EAC/B,uBAAuB,EACxB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAEL,KAAK,gBAAgB,EAErB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EAEnB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAEzB,KAAK,mBAAmB,EACzB,MAAM,SAAS,CAAA;AAEhB,MAAM,MAAM,4BAA4B,GACpC;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAA;CACxE,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,WAAW,CAAA;KAAE,CAAC,CAAA;CACtF,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,gCAAgC,CAAA;IACrD,QAAQ,CAAC,WAAW,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC,YAAY,CAAC,CAAA;CAC9F,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAA;AAE/B,uFAAuF;AACvF,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAA;IAC/C,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAA;CAC3C;AAED,yFAAyF;AACzF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;CAC5B;AAED,KAAK,8BAA8B,GAAG,OAAO,CAC3C,4BAA4B,EAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAC5B,CAAA;AAmBD,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC,YAAY,CAAC,CAAA;CAC9F,GAAG,oBAAoB,CAKvB;AAED,gEAAgE;AAChE,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,SAAS,EACd;QACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;QAC1B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;QACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAC3B,gBAAgB,EAChB;YAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;SAAE,CAC/B,CAAC,YAAY,CAAC,CAAA;KAChB,GACD;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAA;CAClC,GAAG,oBAAoB,CAoBvB;AAuBD,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,gBAAgB,GAC1B,oBAAoB,CAMtB;AAED,qFAAqF;AACrF,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAA;QAC3C,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAA;KAC3C,CAAA;IACD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC,YAAY,CAAC,CAAA;CAC9F,GAAG,oBAAoB,CAwBvB;AAED,wBAAgB,0CAA0C,CAAC,KAAK,EAAE;IAChE,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC,GAAG,oBAAoB,CAOvB;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACtD,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CACpC,GAAG,oBAAoB,CAOvB;AAED,wBAAgB,2BAA2B,CAAC,aAAa,EAAE,OAAO,GAAG,4BAA4B,CAKhG;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;CACxC,GAAG,4BAA4B,CAU/B;AAED,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,oBAAoB,GAAG,gBAAgB,CAczF;AAcD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAqC1F;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,cAAc,GAAG,cAAc,CAI3E;AAED,4FAA4F;AAC5F,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,cAAc,GACpB,8BAA8B,CAsBhC"}

package/dist/execution/authorized-object-reader.d.ts

@@ -0,0 +1,69 @@
+import { type AuthorizedOntologyView } from "../objects/authorized-ontology-view";
+import { type ExecuteObjectCountInput, type ExecuteObjectCountResult, type ExecuteObjectExistsInput, type ExecuteObjectExistsResult, type ExecuteObjectFacetsInput, type ExecuteObjectFacetsResult, type ExecuteObjectQueryInput, type ExecuteObjectQueryLinksInput, type ExecuteObjectQueryLinksResult, type ExecuteObjectQueryResult } from "../objects/query";
+import { type TelemetryHistoryReadAdmission, type TelemetryHistoryReadWorkloadInput } from "../objects/telemetry/workload";
+import type { OntologyRegistry } from "../ontology";
+import type { ObjectReadStorage, ObjectStorage } from "../storage";
+import { resolveExecutionScopeAuthorization } from "./authorization";
+import type { ExecutionScope } from "./types";
+type ResolvedExecutionAuthority = ReturnType<typeof resolveExecutionScopeAuthorization>;
+type GetObjectInput = Omit<Parameters<ObjectReadStorage["getByPrimaryId"]>[0], "projectId">;
+type GetObjectsInput = Omit<Parameters<ObjectReadStorage["getByPrimaryIdBatch"]>[0], "projectId">;
+type SelectObjectPropertiesInput = Parameters<ObjectReadStorage["selectsObjectProperties"]>[0];
+type CanReadObjectPropertyInput = SelectObjectPropertiesInput["items"][number];
+type CanReadObjectPropertiesBatchInput = Omit<SelectObjectPropertiesInput, "projectId">;
+type ListObjectsInput = Omit<Parameters<ObjectReadStorage["list"]>[0], "projectId">;
+type ListLinksInput = Omit<Parameters<ObjectReadStorage["listLinks"]>[0], "projectId">;
+type ListLinksBatchInput = Omit<Parameters<ObjectReadStorage["listLinksBatch"]>[0], "projectId">;
+declare const readerConstructionKey: Readonly<{}>;
+/**
+ * Core-owned object read boundary for one exact execution authority.
+ *
+ * The implementation class is intentionally private to this module. Its private fields make the
+ * exported instance type nominal, while the construction key prevents code that discovers the
+ * JavaScript constructor through an instance from manufacturing another reader.
+ */
+declare class AuthorizedObjectReaderImpl {
+    #private;
+    constructor(key: typeof readerConstructionKey, input: {
+        readonly scope: ExecutionScope;
+        readonly ontology: OntologyRegistry;
+        readonly storage: ObjectReadStorage;
+        readonly authority: ResolvedExecutionAuthority;
+    });
+    static assertBound(reader: AuthorizedObjectReaderImpl, scope: ExecutionScope): void;
+    static ontologyView(reader: AuthorizedObjectReaderImpl): AuthorizedOntologyView;
+    /** Project identity carried by this nominal reader capability. */
+    get projectId(): string;
+    getByPrimaryId(input: GetObjectInput): ReturnType<ObjectReadStorage["getByPrimaryId"]>;
+    getByPrimaryIdBatch(input: GetObjectsInput): ReturnType<ObjectReadStorage["getByPrimaryIdBatch"]>;
+    canReadObjectProperty(input: CanReadObjectPropertyInput): Promise<boolean>;
+    canReadObjectPropertiesBatch(input: CanReadObjectPropertiesBatchInput): Promise<readonly boolean[]>;
+    list(input: ListObjectsInput): ReturnType<ObjectReadStorage["list"]>;
+    listLinks(input: ListLinksInput): ReturnType<ObjectReadStorage["listLinks"]>;
+    listLinksBatch(input: ListLinksBatchInput): ReturnType<ObjectReadStorage["listLinksBatch"]>;
+    executeQuery(input: Omit<ExecuteObjectQueryInput, "projectId">): Promise<ExecuteObjectQueryResult>;
+    queryLinks(input: Omit<ExecuteObjectQueryLinksInput, "projectId">): Promise<ExecuteObjectQueryLinksResult>;
+    count(input: Omit<ExecuteObjectCountInput, "projectId">): Promise<ExecuteObjectCountResult>;
+    exists(input: Omit<ExecuteObjectExistsInput, "projectId">): Promise<ExecuteObjectExistsResult>;
+    facet(input: Omit<ExecuteObjectFacetsInput, "projectId">): Promise<ExecuteObjectFacetsResult>;
+    /** Enforce the delegated response budget without exposing or recombining its limits. */
+    assertVisibleOutputWithinLimit(value: unknown): void;
+    /** Admit adjacent telemetry work without exposing which authority policy was selected. */
+    admitTelemetryHistoryRead(input: TelemetryHistoryReadWorkloadInput): TelemetryHistoryReadAdmission;
+}
+export type AuthorizedObjectReader = AuthorizedObjectReaderImpl;
+/** Build the sole application-facing object reader for one registered execution scope. */
+export declare function createAuthorizedObjectReader(input: {
+    readonly scope: ExecutionScope;
+    readonly ontology: OntologyRegistry;
+    readonly objectStorage: ObjectStorage;
+}): AuthorizedObjectReader;
+/** Reject recombining an authorized reader with any other execution authority. */
+export declare function assertAuthorizedObjectReaderBinding(input: {
+    readonly reader: AuthorizedObjectReader;
+    readonly scope: ExecutionScope;
+}): void;
+/** Return inert metadata projected from the exact authority already owned by the reader. */
+export declare function getAuthorizedOntologyView(reader: AuthorizedObjectReader): AuthorizedOntologyView;
+export {};
+//# sourceMappingURL=authorized-object-reader.d.ts.map

package/dist/execution/authorized-object-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorized-object-reader.d.ts","sourceRoot":"","sources":["../../src/execution/authorized-object-reader.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,sBAAsB,EAE5B,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAK9B,MAAM,kBAAkB,CAAA;AAczB,OAAO,EAEL,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACvC,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,EAKV,iBAAiB,EACjB,aAAa,EACd,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAyB,kCAAkC,EAAE,MAAM,iBAAiB,CAAA;AAC3F,OAAO,KAAK,EAAE,cAAc,EAAwB,MAAM,SAAS,CAAA;AAQnE,KAAK,0BAA0B,GAAG,UAAU,CAAC,OAAO,kCAAkC,CAAC,CAAA;AACvF,KAAK,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AAC3F,KAAK,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACjG,KAAK,2BAA2B,GAAG,UAAU,CAAC,iBAAiB,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9F,KAAK,0BAA0B,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;AAC9E,KAAK,iCAAiC,GAAG,IAAI,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAA;AACvF,KAAK,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACnF,KAAK,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AACtF,KAAK,mBAAmB,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;AAEhG,QAAA,MAAM,qBAAqB,cAAoB,CAAA;AAE/C;;;;;;GAMG;AACH,cAAM,0BAA0B;;gBAY5B,GAAG,EAAE,OAAO,qBAAqB,EACjC,KAAK,EAAE;QACL,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;QAC9B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;QACnC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;QACnC,QAAQ,CAAC,SAAS,EAAE,0BAA0B,CAAA;KAC/C;IA6BH,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,0BAA0B,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAUnF,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,0BAA0B,GAAG,sBAAsB;IAe/E,kEAAkE;IAClE,IAAI,SAAS,IAAI,MAAM,CAEtB;IAEK,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IActF,mBAAmB,CACvB,KAAK,EAAE,eAAe,GACrB,UAAU,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;IAgBjD,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,OAAO,CAAC;IAe1E,4BAA4B,CAChC,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC;IAkBxB,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAoCpE,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAiB5E,cAAc,CAClB,KAAK,EAAE,mBAAmB,GACzB,UAAU,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IA0B5C,YAAY,CAChB,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,GAChD,OAAO,CAAC,wBAAwB,CAAC;IAgB9B,UAAU,CACd,KAAK,EAAE,IAAI,CAAC,4BAA4B,EAAE,WAAW,CAAC,GACrD,OAAO,CAAC,6BAA6B,CAAC;IAgDnC,KAAK,CACT,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,GAChD,OAAO,CAAC,wBAAwB,CAAC;IAW9B,MAAM,CACV,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,GACjD,OAAO,CAAC,yBAAyB,CAAC;IAW/B,KAAK,CACT,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,WAAW,CAAC,GACjD,OAAO,CAAC,yBAAyB,CAAC;IAyCrC,wFAAwF;IACxF,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAKpD,0FAA0F;IAC1F,yBAAyB,CACvB,KAAK,EAAE,iCAAiC,GACvC,6BAA6B;CAqFjC;AAKD,MAAM,MAAM,sBAAsB,GAAG,0BAA0B,CAAA;AAE/D,0FAA0F;AAC1F,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;CACtC,GAAG,sBAAsB,CAazB;AAED,kFAAkF;AAClF,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;IACvC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAC/B,GAAG,IAAI,CAEP;AAED,4FAA4F;AAC5F,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,sBAAsB,GAAG,sBAAsB,CAEhG"}

package/dist/execution/durable.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"durable.d.ts","sourceRoot":"","sources":["../../src/execution/durable.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAEtB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,SAAS,CAAA;AAEhB,sFAAsF;AACtF,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAA;CACpD,GAAG,oBAAoB,CAavB;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,eAAe,CAAC,CAmB1B;AAED,KAAK,wBAAwB,GACzB;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CACjC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CACtB,oBAAoB,CAAC,QAAQ,CAAC,EAC9B;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAAA;KAAE,CACvE,CAAA;IACD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC,aAAa,CAAC,CAAA;CAC3D,CAAA;AAEL,6FAA6F;AAC7F,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;CAC1C,GAAG,oBAAoB,CAiCvB;AAED,oFAAoF;AACpF,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC,GAAG,cAAc,CAmBjB"}
+{"version":3,"file":"durable.d.ts","sourceRoot":"","sources":["../../src/execution/durable.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAEtB,MAAM,uBAAuB,CAAA;AAM9B,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,SAAS,CAAA;AAEhB,sFAAsF;AACtF,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB,CAAA;CACpD,GAAG,oBAAoB,CAiBvB;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,gBAAgB,EACzB,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,eAAe,CAAC,CAmB1B;AAED,KAAK,wBAAwB,GACzB;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CACjC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CACtB,oBAAoB,CAAC,QAAQ,CAAC,EAC9B;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAAA;KAAE,CACvE,CAAA;IACD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC,aAAa,CAAC,CAAA;CAC3D,CAAA;AAEL,6FAA6F;AAC7F,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;CAC1C,GAAG,oBAAoB,CAiCvB;AAED,oFAAoF;AACpF,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC,GAAG,cAAc,CAmBjB"}

package/dist/execution/index.d.ts

@@ -1,2 +1,2 @@
-export type { AuthorizablePrincipal, AuthorizationRef, ExecutionContext, ExecutionExecutor, ExecutionScope, ExecutionSource, KernelOperation, RuntimeAuthorization, TrustedPrimitiveKind, TrustedPrimitiveRef, } from "./types";
+export type { AuthorizablePrincipal, AuthorizationRef, ExecutionContext, ExecutionExecutor, ExecutionScope, ExecutionSource, KernelOperation, RuntimeAuthorization, SharedAccessDelegationRef, TrustedPrimitiveKind, TrustedPrimitiveRef, } from "./types";
 //# sourceMappingURL=index.d.ts.map

package/dist/execution/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/execution/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/execution/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,SAAS,CAAA"}

package/dist/execution/primitive.js

@@ -1,44 +1,48 @@
 // @bun
 import {
   isBoundSixb
-} from "../chunk-h0knpbz5.js";
-import"../chunk-ha58tjtt.js";
+} from "../chunk-xajtptbw.js";
+import"../chunk-wtf06et8.js";
 import"../chunk-c15dr03f.js";
-import"../chunk-rp1mvzb4.js";
-import"../chunk-e4rvtvpw.js";
-import"../chunk-4rh2m6zg.js";
+import"../chunk-v4en4jc2.js";
+import"../chunk-w9tg6yyb.js";
+import"../chunk-aa2pen2v.js";
 import {
   getOntologyMutationRuntime
 } from "../chunk-xhy826cz.js";
-import"../chunk-3fqt22c4.js";
-import"../chunk-rte5sm3z.js";
+import"../chunk-4rh2m6zg.js";
 import"../chunk-8m5ejdpn.js";
 import"../chunk-nf4r78r4.js";
-import"../chunk-d2ndstdf.js";
-import"../chunk-y35ma3mj.js";
-import"../chunk-9aehf39w.js";
+import"../chunk-359jm1jw.js";
+import"../chunk-n4khvw9n.js";
+import"../chunk-pc7ys28c.js";
+import"../chunk-v1xppd0y.js";
+import"../chunk-h5vqbfmd.js";
+import"../chunk-q0k9nc5a.js";
+import"../chunk-rte5sm3z.js";
+import"../chunk-f26bck4t.js";
 import"../chunk-96swp2wd.js";
 import {
   restoreTrustedPrimitiveExecutionScope
-} from "../chunk-hdz94br2.js";
-import"../chunk-6ed5bwnd.js";
-import"../chunk-4nxeacx7.js";
-import"../chunk-agsvg9ar.js";
-import"../chunk-qjzp9xyb.js";
+} from "../chunk-k522z7v6.js";
+import"../chunk-sbzzr4kx.js";
+import"../chunk-4jjp5k14.js";
+import"../chunk-rv2hkwwa.js";
+import"../chunk-nx7k8tpr.js";
+import"../chunk-4yqmp43v.js";
+import"../chunk-wdage1eb.js";
+import"../chunk-5ntny1qx.js";
+import"../chunk-nn0tekr1.js";
+import"../chunk-p03r0h5s.js";
+import"../chunk-jecn6t54.js";
 import"../chunk-5gd7tpv6.js";
-import"../chunk-gbrpsx4m.js";
+import"../chunk-rafagrwr.js";
 import"../chunk-8tsf6dmc.js";
-import"../chunk-xc7hq65b.js";
-import"../chunk-5jcdmjam.js";
-import"../chunk-xdpwpkha.js";
+import"../chunk-yp8ee62z.js";
 import"../chunk-ka3a2ft3.js";
-import"../chunk-1kamz6j0.js";
-import"../chunk-08twe8m6.js";
-import"../chunk-3kv70xwp.js";
-import"../chunk-p03r0h5s.js";
-import"../chunk-jecn6t54.js";
-import"../chunk-x0qhkqje.js";
-import"../chunk-dqn23610.js";
+import"../chunk-w1tvjszy.js";
+import"../chunk-p1rzczbt.js";
+import"../chunk-j1sbhm7p.js";
 import"../chunk-9dzba0f2.js";
 import"../chunk-dbc80ad7.js";
 import"../chunk-ry24jbr1.js";
@@ -51,16 +55,19 @@ import"../chunk-1evzqhks.js";
 import"../chunk-jq43kdvk.js";
 import"../chunk-qw9gvjv5.js";
 import"../chunk-yt8wphsx.js";
-import"../chunk-atmkaf60.js";
+import"../chunk-5e3pq99w.js";
 import"../chunk-7y0f6rf1.js";
 import"../chunk-d8qkxt2v.js";
-import"../chunk-rre42skh.js";
+import"../chunk-4sm0aznx.js";
 import"../chunk-4a849fr1.js";
+import"../chunk-2dw777qw.js";
+import"../chunk-19jp6g9d.js";
 import"../chunk-xwnf87e1.js";
-import"../chunk-37wk412q.js";
-import"../chunk-d63tybny.js";
-import"../chunk-04b07a9q.js";
+import"../chunk-p1x242ad.js";
+import"../chunk-r8jrnexe.js";
+import"../chunk-h0k55pc7.js";
 import"../chunk-dktq02ne.js";
+import"../chunk-04b07a9q.js";
 import"../chunk-08m3b6w8.js";
 import"../chunk-2xns679x.js";
 import"../chunk-n6jxh8sw.js";
@@ -89,4 +96,4 @@ export {
   bindDurablePrimitiveExecution
 };
 
-//# debugId=A7853886F7E88F0964756E2164756E21
+//# debugId=70A35A5EF49A574764756E2164756E21

package/dist/execution/primitive.js.map

@@ -4,7 +4,7 @@
   "sourcesContent": [
     "import type { OntologySource } from \"../ontology\"\nimport type { OntologyMutationRuntime } from \"../runtime/ontology-mutations\"\nimport { getOntologyMutationRuntime } from \"../runtime/ontology-mutations\"\nimport { isBoundSixb, type Sixb } from \"../runtime/sixb\"\nimport type { ExecutionRecord } from \"../storage/executions\"\nimport { restoreTrustedPrimitiveExecutionScope } from \"./durable\"\nimport type { ExecutionScope, TrustedPrimitiveRef } from \"./types\"\n\n/** Minimal host boundary required by trusted primitive workers. */\nexport interface PrimitiveExecutionHost {\n  readonly id: string\n  withScope(scope: ExecutionScope): object\n}\n\nexport interface BoundPrimitiveExecution {\n  readonly sixb: Sixb<readonly OntologySource[]>\n  /** Internal mutation port guarded by the same runtime authority as `sixb`. */\n  readonly ontologyMutations: OntologyMutationRuntime\n}\n\n/** Bind a worker to the immutable execution already owned by its durable primitive run. */\nexport function bindDurablePrimitiveExecution(\n  host: PrimitiveExecutionHost,\n  input: {\n    readonly execution: ExecutionRecord\n    readonly primitive: TrustedPrimitiveRef\n  }\n): BoundPrimitiveExecution {\n  return bindPrimitiveScope(host, restoreTrustedPrimitiveExecutionScope(input))\n}\n\nfunction bindPrimitiveScope(\n  host: PrimitiveExecutionHost,\n  scope: ExecutionScope\n): BoundPrimitiveExecution {\n  let ontologyMutations: OntologyMutationRuntime | undefined\n\n  const sixb = host.withScope(scope)\n  if (!isBoundSixb(sixb)) {\n    throw new Error(\"[Sixb] Primitive execution host returned an invalid bound SDK.\")\n  }\n  const bound: BoundPrimitiveExecution = {\n    sixb,\n    get ontologyMutations() {\n      ontologyMutations ??= getOntologyMutationRuntime(sixb)\n      return ontologyMutations\n    },\n  }\n  return Object.freeze(bound)\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,SAAS,6BAA6B,CAC3C,MACA,OAIyB;AAAA,EACzB,OAAO,mBAAmB,MAAM,sCAAsC,KAAK,CAAC;AAAA;AAG9E,SAAS,kBAAkB,CACzB,MACA,OACyB;AAAA,EACzB,IAAI;AAAA,EAEJ,MAAM,OAAO,KAAK,UAAU,KAAK;AAAA,EACjC,IAAI,CAAC,YAAY,IAAI,GAAG;AAAA,IACtB,MAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AAAA,EACA,MAAM,QAAiC;AAAA,IACrC;AAAA,QACI,iBAAiB,GAAG;AAAA,MACtB,sBAAsB,2BAA2B,IAAI;AAAA,MACrD,OAAO;AAAA;AAAA,EAEX;AAAA,EACA,OAAO,OAAO,OAAO,KAAK;AAAA;",
-  "debugId": "A7853886F7E88F0964756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,SAAS,6BAA6B,CAC3C,MACA,OAIyB;AAAA,EACzB,OAAO,mBAAmB,MAAM,sCAAsC,KAAK,CAAC;AAAA;AAG9E,SAAS,kBAAkB,CACzB,MACA,OACyB;AAAA,EACzB,IAAI;AAAA,EAEJ,MAAM,OAAO,KAAK,UAAU,KAAK;AAAA,EACjC,IAAI,CAAC,YAAY,IAAI,GAAG;AAAA,IACtB,MAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AAAA,EACA,MAAM,QAAiC;AAAA,IACrC;AAAA,QACI,iBAAiB,GAAG;AAAA,MACtB,sBAAsB,2BAA2B,IAAI;AAAA,MACrD,OAAO;AAAA;AAAA,EAEX;AAAA,EACA,OAAO,OAAO,OAAO,KAAK;AAAA;",
+  "debugId": "70A35A5EF49A574764756E2164756E21",
   "names": []
 }

package/dist/execution/request.d.ts

@@ -1,6 +1,8 @@
 import type { AuthorizationContext } from "../authorization";
 import type { OntologySource } from "../ontology";
 import { type Sixb } from "../runtime/sixb";
+import { type ShareAccessPlan } from "../shares/access-plan";
+import type { ObjectReadExecutionLimits } from "../storage/objects/execution-limits";
 import type { AuthorizationRef, ExecutionScope } from "./types";
 export type { ActionRunsRuntime, ActionsRuntime } from "../actions/execution";
 export type { AgentRunListResult, AgentRunsRuntime, AgentRuntime, AgentRunView, AgentThreadsRuntime, CreateExecutionAgentThreadInput, ExecutionAgentRequestInput, ExecutionAgentRunResult, ListExecutionAgentThreadsInput, } from "../agents/execution";
@@ -24,6 +26,15 @@ export type RequestExecutionAuthorization = {
     readonly credential?: Extract<AuthorizationRef, {
         readonly type: "principal";
     }>["credential"];
+} | {
+    readonly type: "delegated";
+    readonly access: ShareAccessPlan;
+    readonly limits?: ObjectReadExecutionLimits;
+    readonly delegation: {
+        readonly kind: "share";
+        readonly grantId: string;
+        readonly sessionId: string;
+    };
 } | {
     readonly type: "disabled";
 };

package/dist/execution/request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/execution/request.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE/D,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC7E,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxD,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,yBAAyB,EACzB,kBAAkB,EAClB,cAAc,GACf,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACzE,YAAY,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAClF,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACvE,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC5B,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAEjE,MAAM,MAAM,6BAA6B,GACrC;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC,YAAY,CAAC,CAAA;CAC9F,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEjC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,6BAA6B,CAAA;CACtD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAAA;CACzC;AAED,kGAAkG;AAClG,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,yBAAyB,GAC/B,IAAI,CAAC,SAAS,cAAc,EAAE,CAAC,CAqBjC"}
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/execution/request.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAA;AAMpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE/D,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC7E,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxD,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EACV,yBAAyB,EACzB,kBAAkB,EAClB,cAAc,GACf,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EACV,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACzE,YAAY,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAClF,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACvE,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC5B,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,GACjB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAEjE,MAAM,MAAM,6BAA6B,GACrC;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,gBAAgB,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC,YAAY,CAAC,CAAA;CAC9F,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,yBAAyB,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAC3B,CAAA;CACF,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAA;AAEjC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,6BAA6B,CAAA;CACtD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAAA;CACzC;AAED,kGAAkG;AAClG,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,yBAAyB,GAC/B,IAAI,CAAC,SAAS,cAAc,EAAE,CAAC,CAUjC"}