@sixb/core 0.1.7 → 0.1.8

package/src/objects/sdk/object-set.ts

@@ -6,9 +6,9 @@
 
 import type { ActionDefinition } from "../../actions"
 import type { AuthorizationContext } from "../../authorization"
-import { assertAuthorized } from "../../authorization"
 import { shareSixbErrorReporter } from "../../error-reporting/capability"
 import type { ExecutionContext } from "../../execution"
+import { assertAuthorizedObjectReaderBinding } from "../../execution/authorized-object-reader"
 import type { ValueType } from "../../ontology"
 import { OntologyValidationError } from "../../ontology/errors"
 import type { ObjectTypeWithPropertyTokens } from "../../ontology/tokens"
@@ -43,6 +43,10 @@ export function createObjectSet<
     readonly authorization?: AuthorizationContext
   }
 ): ObjectSet<TObjectType, TValueTypes, TRegisteredObjectTypes> {
+  assertAuthorizedObjectReaderBinding({
+    reader: params.objectReader,
+    scope: { execution: params.execution, authorization: params.runtimeAuthorization },
+  })
   const { objectType } = params
   const primaryProp = objectType.properties.find((p) => p.primary)
   if (!primaryProp) {
@@ -58,16 +62,14 @@ export function createObjectSet<
     events,
     storage,
     queues,
+    objectReader,
     runtimeAuthorization,
     authorization,
     execution,
   } = params
   const queryExecutor = createRuntimeQueryExecutor({
-    projectId,
     ontology,
-    storage,
-    runtimeAuthorization,
-    authorization,
+    objectReader,
   })
 
   const resolvedCtx: ExecutionObjectContext = {
@@ -78,6 +80,7 @@ export function createObjectSet<
     events,
     storage,
     queues,
+    objectReader,
     runtimeAuthorization,
     authorization,
     execution,
@@ -89,9 +92,7 @@ export function createObjectSet<
 
   const objectSet = {
     get: async (id: string) => {
-      assertAuthorized(resolvedCtx, { kind: "object.view", objectTypeId: objectType.id })
-      const row = await storage.objects.getByPrimaryId({
-        projectId,
+      const row = await objectReader.getByPrimaryId({
         objectTypeId: objectType.id,
         primaryId: id,
       })
@@ -112,9 +113,7 @@ export function createObjectSet<
     byId: (id: string) => createObjectByIdHandle<TObjectType, TValueTypes>(resolvedCtx, id),
 
     list: async (input?: ObjectSetListInput) => {
-      assertAuthorized(resolvedCtx, { kind: "object.view", objectTypeId: objectType.id })
-      const result = await storage.objects.list({
-        projectId,
+      const result = await objectReader.list({
         objectTypeId: objectType.id,
         primaryIdPrefix: input?.idPrefix,
         primaryIdSuffix: input?.idSuffix,

package/src/objects/sdk/runtime-query-executor.ts

@@ -4,44 +4,24 @@
  * HTTP executor in `@sixb/client` is the remote counterpart.
  */
 
-import type { AuthorizationContext } from "../../authorization"
-import type { RuntimeAuthorization } from "../../execution/types"
+import type { AuthorizedObjectReader } from "../../execution/authorized-object-reader"
 import type { OntologyRegistry } from "../../ontology"
-import type { Storage } from "../../storage"
-import {
-  countObjects,
-  executeObjectQuery,
-  existsObjects,
-  facetObjects,
-  ObjectQueryPlanningError,
-} from "../query"
+import { ObjectQueryPlanningError } from "../query"
 import { explainObjectQuery } from "../query/explain"
 import type { ObjectQuery } from "../query/ir"
 import { validateObjectQuery } from "../query/validate"
 import type { ObjectQueryExecutor, ObjectQueryExecutorFacetRequest } from "./query-executor"
 
 export function createRuntimeQueryExecutor(params: {
-  projectId: string
   ontology: OntologyRegistry
-  storage: Storage
-  runtimeAuthorization?: RuntimeAuthorization
-  authorization?: AuthorizationContext
+  objectReader: AuthorizedObjectReader
 }): ObjectQueryExecutor {
-  const { projectId, ontology, storage, runtimeAuthorization, authorization } = params
-  const executorOptions = {
-    ontology,
-    storage: storage.objects,
-    runtimeAuthorization,
-    authorization,
-  }
+  const { ontology, objectReader } = params
 
   return {
     async list(query: ObjectQuery, options?: { includeTotal?: boolean }) {
       try {
-        return await executeObjectQuery(
-          { projectId, query, includeTotal: options?.includeTotal },
-          executorOptions
-        )
+        return await objectReader.executeQuery({ query, includeTotal: options?.includeTotal })
       } catch (error) {
         if (error instanceof ObjectQueryPlanningError) {
           throw addSdkPlanningHints(error)
@@ -51,17 +31,17 @@ export function createRuntimeQueryExecutor(params: {
     },
 
     async count(query: ObjectQuery) {
-      const result = await countObjects({ projectId, query }, executorOptions)
+      const result = await objectReader.count({ query })
       return result.count
     },
 
     async exists(query: ObjectQuery) {
-      const result = await existsObjects({ projectId, query }, executorOptions)
+      const result = await objectReader.exists({ query })
       return result.exists
     },
 
     async facets(query: ObjectQuery, facets: readonly ObjectQueryExecutorFacetRequest[]) {
-      const result = await facetObjects({ projectId, query, facets }, executorOptions)
+      const result = await objectReader.facet({ query, facets })
       return result.facets.map((facet) => ({
         propertyId: facet.propertyId,
         buckets: [...facet.buckets],

package/src/objects/sdk/telemetry-channel.ts

@@ -51,23 +51,27 @@ export function createTelemetryChannel<
 
       history: async (input: TelemetryHistoryInput = {}) => {
         const timeseries = ctx.storage.timeseries
+        const objectReader = ctx.objectReader
         if (!timeseries) {
           throw new RuntimeError("[Sixb] Reading telemetry requires storage.timeseries support.")
         }
 
+        const from = input.from
+        const to = input.to
+        const limit = input.limit
+        const order = input.order
+
         const [result] = await getTelemetryHistoryBatch(
           {
-            projectId: ctx.projectId,
             series: [series],
-            ...(input.from !== undefined ? { from: input.from } : {}),
-            ...(input.to !== undefined ? { to: input.to } : {}),
-            ...(input.limit !== undefined ? { limitPerSeries: input.limit } : {}),
-            ...(input.order !== undefined ? { order: input.order } : {}),
+            ...(from !== undefined ? { from } : {}),
+            ...(to !== undefined ? { to } : {}),
+            ...(limit !== undefined ? { limitPerSeries: limit } : {}),
+            ...(order !== undefined ? { order } : {}),
           },
           {
             storage: timeseries,
-            runtimeAuthorization: ctx.runtimeAuthorization,
-            authorization: ctx.authorization,
+            objectReader,
           }
         )
 

package/src/objects/service/list-service.ts

@@ -1,12 +1,12 @@
 /**
  * Cross-type object listing for dashboards and search.
  *
- * On principal-bound runtimes the type filter is authorized before the storage call:
- * explicitly requested types must all be viewable, and unfiltered listings
- * narrow to the principal's viewable types instead of post-filtering rows.
+ * Type hierarchies are expanded before the request reaches the canonical object
+ * reader, which owns authorization and provider-scope enforcement.
  */
 
-import { assertAuthorized } from "../../authorization"
+import { resolveRuntimeAuthorizationForProject } from "../../execution/authorization"
+import { getAuthorizedOntologyView } from "../../execution/authorized-object-reader"
 import type { ListResult, SixbRuntimeContext } from "../../runtime/types"
 import type { ObjectRow } from "../../storage"
 
@@ -28,14 +28,13 @@ export async function listObjects(
   runtime: SixbRuntimeContext,
   params: ListObjectsParams
 ): Promise<ListResult<ObjectRow>> {
-  const objectTypeIds = resolveAuthorizedTypeFilter(runtime, params.objectTypeIds)
+  const objectTypeIds = resolveTypeFilter(runtime, params.objectTypeIds)
 
-  if (runtime.authorization && objectTypeIds !== undefined && objectTypeIds.length === 0) {
+  if (objectTypeIds !== undefined && objectTypeIds.length === 0) {
     return { objects: [], hasMore: false, total: 0 }
   }
 
-  const result = await runtime.storage.objects.list({
-    projectId: runtime.projectId,
+  const result = await runtime.objectReader.list({
     objectTypeId: objectTypeIds?.length === 1 ? objectTypeIds[0] : objectTypeIds,
     primaryIdPrefix: params.idPrefix,
     primaryIdSuffix: params.idSuffix,
@@ -56,34 +55,21 @@ export async function listObjects(
   }
 }
 
-function resolveAuthorizedTypeFilter(
+function resolveTypeFilter(
   runtime: SixbRuntimeContext,
   requested: readonly string[] | undefined
 ): readonly string[] | undefined {
+  const ontology =
+    resolveRuntimeAuthorizationForProject(runtime).type === "delegated"
+      ? getAuthorizedOntologyView(runtime.objectReader)
+      : runtime.ontology
   if (requested) {
     for (const objectTypeId of requested) {
-      runtime.ontology.resolveObjectType(objectTypeId)
+      ontology.resolveObjectType(objectTypeId)
     }
   }
 
-  const expanded = requested
-    ? [...new Set(requested.flatMap((id) => [id, ...runtime.ontology.listSubTypes(id)]))]
+  return requested
+    ? [...new Set(requested.flatMap((id) => [id, ...ontology.listSubTypes(id)]))]
     : undefined
-
-  if (!runtime.authorization) {
-    return expanded
-  }
-
-  if (!expanded) {
-    // Broad listings narrow to the visible universe rather than failing. The
-    // set already contains every registered type when "all" was granted.
-    return [...runtime.authorization.grants["view:object"]]
-  }
-
-  // Explicitly requested types must all be viewable.
-  for (const objectTypeId of expanded) {
-    assertAuthorized(runtime, { kind: "object.view", objectTypeId })
-  }
-
-  return expanded
 }

package/src/objects/telemetry/history.ts

@@ -1,37 +1,317 @@
-import { type AuthorizationContext, assertAuthorized } from "../../authorization"
-import type { RuntimeAuthorization } from "../../execution"
+import { createSixbError } from "../../errors/internal"
+import type { AuthorizedObjectReader } from "../../execution/authorized-object-reader"
 import type {
   TimeseriesHistoryBatchInput,
   TimeseriesHistoryBatchResult,
   TimeseriesHistorySeriesInput,
+  TimeseriesPoint,
   TimeseriesStorage,
 } from "../../storage"
 
 export interface TelemetryHistoryOptions {
   readonly storage: TimeseriesStorage
-  readonly runtimeAuthorization?: RuntimeAuthorization
-  readonly authorization?: AuthorizationContext | null
+  readonly objectReader: AuthorizedObjectReader
 }
 
+export type TelemetryHistoryBatchInput = Omit<TimeseriesHistoryBatchInput, "projectId">
+
+interface SnapshotTelemetryHistoryRequest extends TelemetryHistoryBatchInput {
+  readonly maxPointOccurrences?: number
+}
+
+/** Read only series selected for the exact object occurrence carried by the nominal reader. */
 export async function getTelemetryHistoryBatch(
-  input: TimeseriesHistoryBatchInput,
+  input: TelemetryHistoryBatchInput,
   options: TelemetryHistoryOptions
 ): Promise<readonly TimeseriesHistoryBatchResult[]> {
-  assertTelemetrySeriesViewable(input.series, options)
-  return options.storage.getHistoryBatch(input)
+  // Capture both provider capabilities before reading caller-owned request fields.
+  const objectReader = options.objectReader
+  const storage = options.storage
+  const projectId = objectReader.projectId
+  const request = snapshotTelemetryHistoryInput(input, objectReader)
+
+  const uniqueSeries = deduplicateSeries(request.series)
+  const readableSeries = await selectReadableSeries(uniqueSeries, objectReader)
+  const resultsBySeries = await readAndValidateHistory({
+    storage,
+    projectId,
+    request,
+    series: readableSeries,
+  })
+
+  // Objects and telemetry do not share a portable read snapshot. Recheck live selection after
+  // all provider-owned values have been detached, before deciding which points to return.
+  const releasableSeries =
+    readableSeries.length === 0 ? [] : await selectReadableSeries(readableSeries, objectReader)
+  const result = assembleHistoryResults({ request, resultsBySeries, releasableSeries })
+  objectReader.assertVisibleOutputWithinLimit(result)
+  return result
+}
+
+/** Read the latest point only while its exact object property remains selected. */
+export async function getLatestTelemetryPoint(
+  input: TimeseriesHistorySeriesInput,
+  options: TelemetryHistoryOptions
+): Promise<TimeseriesPoint | null> {
+  const objectReader = options.objectReader
+  const storage = options.storage
+  const projectId = objectReader.projectId
+  const series = snapshotTelemetrySeries(input)
+  const readable = await objectReader.canReadObjectProperty(objectPropertySelection(series))
+  if (!readable) return visibleLatestResult(null, objectReader)
+
+  const rawResult = await storage.getLatest({ projectId, ...series })
+  const result = rawResult === null ? null : snapshotProviderPoint(rawResult)
+  if (result) assertTimeseriesPointMatchesSeries(projectId, series, result)
+
+  // See the batch release check above. Revocation during the timeseries read hides the result.
+  const releaseReadable = await objectReader.canReadObjectProperty(objectPropertySelection(series))
+  if (!releaseReadable) return visibleLatestResult(null, objectReader)
+
+  return visibleLatestResult(result, objectReader)
+}
+
+function deduplicateSeries(
+  series: readonly TimeseriesHistorySeriesInput[]
+): TimeseriesHistorySeriesInput[] {
+  const uniqueSeries = new Map<string, TimeseriesHistorySeriesInput>()
+  for (const item of series) {
+    const key = seriesKey(item)
+    if (!uniqueSeries.has(key)) uniqueSeries.set(key, item)
+  }
+  return [...uniqueSeries.values()]
 }
 
-function assertTelemetrySeriesViewable(
+async function selectReadableSeries(
   series: readonly TimeseriesHistorySeriesInput[],
-  authorization: Pick<TelemetryHistoryOptions, "authorization" | "runtimeAuthorization">
+  objectReader: AuthorizedObjectReader
+): Promise<readonly TimeseriesHistorySeriesInput[]> {
+  const readable = await objectReader.canReadObjectPropertiesBatch({
+    items: series.map(objectPropertySelection),
+  })
+  return series.filter((_, index) => readable[index] === true)
+}
+
+async function readAndValidateHistory(input: {
+  readonly storage: TimeseriesStorage
+  readonly projectId: string
+  readonly request: SnapshotTelemetryHistoryRequest
+  readonly series: readonly TimeseriesHistorySeriesInput[]
+}): Promise<ReadonlyMap<string, TimeseriesHistoryBatchResult>> {
+  const { storage, projectId, request, series } = input
+
+  // The provider receives its own detached request. It must never retain or mutate the canonical
+  // series snapshot that admission and the final release check rely on.
+  const providerRequest = structuredClone({
+    projectId,
+    series,
+    ...(request.from === undefined ? {} : { from: request.from }),
+    ...(request.to === undefined ? {} : { to: request.to }),
+    ...(request.limitPerSeries === undefined ? {} : { limitPerSeries: request.limitPerSeries }),
+    ...(request.order === undefined ? {} : { order: request.order }),
+  })
+  const stored = series.length === 0 ? [] : await storage.getHistoryBatch(providerRequest)
+
+  // Fully detach and validate provider-owned data before the final live check. A provider result
+  // may contain accessors or a custom iterator; none of that code may run after release admission.
+  if (!Array.isArray(stored)) throw invalidTimeseriesProviderResult()
+  const storedCount = stored.length
+  if (!Number.isSafeInteger(storedCount) || storedCount > series.length) {
+    throw invalidTimeseriesProviderResult()
+  }
+  const seriesKeys = new Set(series.map(seriesKey))
+  const providerResultBySeries = new Map<string, TimeseriesHistoryBatchResult>()
+  for (let index = 0; index < storedCount; index += 1) {
+    const providerResult = snapshotProviderResult(stored[index]!, request.limitPerSeries)
+    const key = seriesKey(providerResult)
+    if (providerResultBySeries.has(key) || !seriesKeys.has(key)) {
+      throw invalidTimeseriesProviderResult()
+    }
+    for (const point of providerResult.points) {
+      assertTimeseriesPointMatchesSeries(projectId, providerResult, point)
+    }
+    providerResultBySeries.set(key, providerResult)
+  }
+
+  return providerResultBySeries
+}
+
+/** Restore request order and duplicates, with independent point copies for every occurrence. */
+function assembleHistoryResults(input: {
+  readonly request: SnapshotTelemetryHistoryRequest
+  readonly resultsBySeries: ReadonlyMap<string, TimeseriesHistoryBatchResult>
+  readonly releasableSeries: readonly TimeseriesHistorySeriesInput[]
+}): readonly TimeseriesHistoryBatchResult[] {
+  const { request, resultsBySeries, releasableSeries } = input
+  const releasableSeriesKeys = new Set(releasableSeries.map(seriesKey))
+  const releasedPoints = request.series.map((series) =>
+    releasableSeriesKeys.has(seriesKey(series))
+      ? (resultsBySeries.get(seriesKey(series))?.points ?? [])
+      : []
+  )
+  const pointOccurrences = releasedPoints.reduce((total, points) => total + points.length, 0)
+  if (request.maxPointOccurrences !== undefined && pointOccurrences > request.maxPointOccurrences) {
+    throw invalidTimeseriesProviderResult()
+  }
+  return request.series.map((series, index) => ({
+    ...series,
+    points: releasedPoints[index]!.map((point) => structuredClone(point)),
+  }))
+}
+
+function snapshotTelemetrySeries(
+  series: TimeseriesHistorySeriesInput
+): TimeseriesHistorySeriesInput {
+  if (typeof series !== "object" || series === null || Array.isArray(series)) {
+    throw new Error("[Sixb] Telemetry history series must be an object.")
+  }
+  const objectTypeId = telemetryIdentifier(series.objectTypeId, "objectTypeId")
+  const objectId = telemetryIdentifier(series.objectId, "objectId")
+  const propertyId = telemetryIdentifier(series.propertyId, "propertyId")
+  return structuredClone({ objectTypeId, objectId, propertyId })
+}
+
+function assertTimeseriesPointMatchesSeries(
+  projectId: string,
+  series: TimeseriesHistorySeriesInput,
+  point: TimeseriesPoint
 ): void {
-  for (const objectTypeId of new Set(series.map((entry) => entry.objectTypeId))) {
-    assertAuthorized(
-      {
-        runtimeAuthorization: authorization.runtimeAuthorization,
-        authorization: authorization.authorization ?? undefined,
-      },
-      { kind: "object.view", objectTypeId }
-    )
+  if (
+    typeof point !== "object" ||
+    point === null ||
+    point.projectId !== projectId ||
+    point.objectTypeId !== series.objectTypeId ||
+    point.objectId !== series.objectId ||
+    point.propertyId !== series.propertyId
+  ) {
+    throw invalidTimeseriesProviderResult()
+  }
+}
+
+function snapshotTelemetryHistoryInput(
+  input: TelemetryHistoryBatchInput,
+  objectReader: AuthorizedObjectReader
+): SnapshotTelemetryHistoryRequest {
+  const authoredSeries = input.series
+  const from = input.from
+  const to = input.to
+  const limitPerSeries = input.limitPerSeries
+  const order = input.order
+  if (!Array.isArray(authoredSeries)) {
+    throw new Error("[Sixb] Telemetry history series must be an array.")
+  }
+  if (order !== undefined && order !== "asc" && order !== "desc") {
+    throw new Error("[Sixb] Telemetry history order must be 'asc' or 'desc'.")
+  }
+
+  // Capture length once and walk by index so proxies cannot change the iteration shape halfway.
+  const seriesCount = authoredSeries.length
+  const admission = objectReader.admitTelemetryHistoryRead({
+    seriesCount,
+    ...(limitPerSeries === undefined ? {} : { limitPerSeries }),
+  })
+  const series: TimeseriesHistorySeriesInput[] = []
+  for (let index = 0; index < seriesCount; index += 1) {
+    series.push(snapshotTelemetrySeries(authoredSeries[index]!))
+  }
+  return structuredClone({
+    series,
+    ...(from === undefined ? {} : { from }),
+    ...(to === undefined ? {} : { to }),
+    ...(admission.limitPerSeries === undefined ? {} : { limitPerSeries: admission.limitPerSeries }),
+    ...(order === undefined ? {} : { order }),
+    ...(admission.maxPointOccurrences === undefined
+      ? {}
+      : { maxPointOccurrences: admission.maxPointOccurrences }),
+  })
+}
+
+function objectPropertySelection(series: TimeseriesHistorySeriesInput): {
+  readonly objectTypeId: string
+  readonly primaryId: string
+  readonly propertyId: string
+} {
+  return {
+    objectTypeId: series.objectTypeId,
+    primaryId: series.objectId,
+    propertyId: series.propertyId,
+  }
+}
+
+function visibleLatestResult<T extends TimeseriesPoint | null>(
+  result: T,
+  objectReader: AuthorizedObjectReader
+): T {
+  objectReader.assertVisibleOutputWithinLimit(result)
+  return result
+}
+
+function snapshotProviderResult(
+  result: TimeseriesHistoryBatchResult,
+  maxPointsPerSeries: number | undefined
+): TimeseriesHistoryBatchResult {
+  try {
+    if (typeof result !== "object" || result === null || Array.isArray(result)) {
+      throw invalidTimeseriesProviderResult()
+    }
+    const series = snapshotTelemetrySeries(result)
+    const authoredPoints = result.points
+    if (!Array.isArray(authoredPoints)) throw invalidTimeseriesProviderResult()
+    const pointCount = authoredPoints.length
+    if (
+      !Number.isSafeInteger(pointCount) ||
+      (maxPointsPerSeries !== undefined && pointCount > maxPointsPerSeries)
+    ) {
+      throw invalidTimeseriesProviderResult()
+    }
+    const points: TimeseriesPoint[] = []
+    for (let index = 0; index < pointCount; index += 1) {
+      points.push(snapshotProviderPoint(authoredPoints[index]!))
+    }
+    return { ...series, points }
+  } catch (error) {
+    if (isInvalidTimeseriesProviderResult(error)) throw error
+    throw invalidTimeseriesProviderResult(error)
+  }
+}
+
+function snapshotProviderPoint(point: TimeseriesPoint): TimeseriesPoint {
+  try {
+    const snapshot = structuredClone(point)
+    if (!snapshot || typeof snapshot !== "object") throw invalidTimeseriesProviderResult()
+    return snapshot
+  } catch (error) {
+    if (isInvalidTimeseriesProviderResult(error)) throw error
+    throw invalidTimeseriesProviderResult(error)
+  }
+}
+
+function invalidTimeseriesProviderResult(cause?: unknown): Error {
+  return createSixbError(
+    "internal.unexpected",
+    "[Sixb] Timeseries storage returned data outside the requested series.",
+    cause === undefined ? {} : { cause }
+  )
+}
+
+function isInvalidTimeseriesProviderResult(
+  error: unknown
+): error is Error & { readonly code: "internal.unexpected" } {
+  return (
+    error instanceof Error &&
+    "code" in error &&
+    error.code === "internal.unexpected" &&
+    error.message === "[Sixb] Timeseries storage returned data outside the requested series."
+  )
+}
+
+function telemetryIdentifier(value: unknown, field: string): string {
+  if (typeof value !== "string" || !value.trim()) {
+    throw new Error(`[Sixb] Telemetry history ${field} must be a non-empty string.`)
   }
+  return value
+}
+
+function seriesKey(series: TimeseriesHistorySeriesInput): string {
+  return JSON.stringify([series.objectTypeId, series.objectId, series.propertyId])
 }

package/src/objects/telemetry/index.ts

@@ -1,4 +1,4 @@
 export { appendTelemetryBatch } from "./append-batch"
-export type { TelemetryHistoryOptions } from "./history"
-export { getTelemetryHistoryBatch } from "./history"
+export type { TelemetryHistoryBatchInput, TelemetryHistoryOptions } from "./history"
+export { getLatestTelemetryPoint, getTelemetryHistoryBatch } from "./history"
 export { writeTelemetryBatch } from "./write-batch"

package/src/objects/telemetry/workload.ts

@@ -0,0 +1,79 @@
+const MAX_DELEGATED_TELEMETRY_HISTORY_SERIES = 100
+const MAX_DELEGATED_TELEMETRY_HISTORY_POINTS = 10_000
+const DEFAULT_DELEGATED_TELEMETRY_HISTORY_LIMIT_PER_SERIES = 100
+
+export interface TelemetryHistoryReadWorkloadInput {
+  readonly seriesCount: number
+  readonly limitPerSeries?: number
+}
+
+export interface TelemetryHistoryReadAdmission {
+  readonly limitPerSeries?: number
+  readonly maxPointOccurrences?: number
+}
+
+type TelemetryHistoryWorkloadMetric = "series" | "points"
+
+class TelemetryHistoryWorkloadExceededError extends Error {
+  readonly name = "TelemetryHistoryWorkloadExceededError"
+  readonly code = "telemetry_history_workload_exceeded"
+
+  constructor(
+    readonly metric: TelemetryHistoryWorkloadMetric,
+    readonly limit: number
+  ) {
+    super(`[Sixb] Delegated telemetry history exceeded its ${metric} limit (${limit}).`)
+  }
+}
+
+/** Resolve one history request without exposing the authority that selected its policy. */
+export function admitTelemetryHistoryReadWorkload(
+  input: TelemetryHistoryReadWorkloadInput,
+  delegated: boolean
+): TelemetryHistoryReadAdmission {
+  const seriesCount = input.seriesCount
+  const limitPerSeries = input.limitPerSeries
+  if (!Number.isSafeInteger(seriesCount) || seriesCount < 0) {
+    throw new Error("[Sixb] Telemetry history series must have a non-negative safe integer length.")
+  }
+  if (
+    limitPerSeries !== undefined &&
+    (!Number.isSafeInteger(limitPerSeries) || limitPerSeries < 0)
+  ) {
+    throw new Error("[Sixb] Telemetry history limit must be a non-negative safe integer.")
+  }
+
+  if (!delegated) {
+    const admission: TelemetryHistoryReadAdmission =
+      limitPerSeries === undefined ? {} : { limitPerSeries }
+    return Object.freeze(admission)
+  }
+  if (seriesCount > MAX_DELEGATED_TELEMETRY_HISTORY_SERIES) {
+    throw new TelemetryHistoryWorkloadExceededError(
+      "series",
+      MAX_DELEGATED_TELEMETRY_HISTORY_SERIES
+    )
+  }
+  if (seriesCount === 0) {
+    return Object.freeze({
+      ...(limitPerSeries === undefined ? {} : { limitPerSeries }),
+      maxPointOccurrences: MAX_DELEGATED_TELEMETRY_HISTORY_POINTS,
+    })
+  }
+
+  const maxLimitPerSeries = Math.floor(MAX_DELEGATED_TELEMETRY_HISTORY_POINTS / seriesCount)
+  const effectiveLimitPerSeries =
+    limitPerSeries ??
+    Math.min(DEFAULT_DELEGATED_TELEMETRY_HISTORY_LIMIT_PER_SERIES, maxLimitPerSeries)
+  if (effectiveLimitPerSeries > maxLimitPerSeries) {
+    throw new TelemetryHistoryWorkloadExceededError(
+      "points",
+      MAX_DELEGATED_TELEMETRY_HISTORY_POINTS
+    )
+  }
+
+  return Object.freeze({
+    limitPerSeries: effectiveLimitPerSeries,
+    maxPointOccurrences: MAX_DELEGATED_TELEMETRY_HISTORY_POINTS,
+  })
+}