@segmentstream-cloud/ontology 0.12.0 → 0.14.0

package/dist/service/runtime-identity.js

@@ -0,0 +1,102 @@
+import { Effect } from "effect";
+import { createRemoteJWKSet, decodeJwt, errors, jwtVerify } from "jose";
+/**
+ * The header in which a runtime caller names the member it acts for: the member's user id. The
+ * service honours it only with a verified runtime token, so nobody else can claim a member with it.
+ */
+export const ACT_AS_HEADER = "x-segmentstream-act-as";
+const CLOCK_TOLERANCE_SECONDS = 5;
+const JWKS_TIMEOUT_MS = 5_000;
+/** The environment that a Vercel function token must name: channels run only in production. */
+const PRODUCTION = "production";
+/** The issuer without a trailing slash, as Vercel writes it in `iss` and as its JWKS URL starts. */
+function normalizedIssuer(issuer) {
+    let end = issuer.length;
+    while (end > 0 && issuer[end - 1] === "/") {
+        end -= 1;
+    }
+    return issuer.slice(0, end);
+}
+/** The issuer's key set, at `<issuer>/.well-known/jwks` as Vercel publishes it. */
+export function runtimeKeySet(issuer) {
+    return createRemoteJWKSet(new URL(`${normalizedIssuer(issuer)}/.well-known/jwks`), {
+        timeoutDuration: JWKS_TIMEOUT_MS,
+    });
+}
+/** The key set could not be read: not the token's fault. Every other jose error is about the token. */
+function keySetUnavailable(error) {
+    if (!(error instanceof errors.JOSEError)) {
+        return true;
+    }
+    return (error instanceof errors.JWKSTimeout ||
+        error instanceof errors.JWKSInvalid ||
+        error.code === errors.JOSEError.code);
+}
+/** What about a token failed, for the operator's log: a jose code or a claim name, never a value. */
+function failureReason(error) {
+    if (error instanceof errors.JWTClaimValidationFailed || error instanceof errors.JWTExpired) {
+        return `claim:${error.claim}`;
+    }
+    return error instanceof errors.JOSEError ? error.code : "invalid";
+}
+function claimedIssuer(token) {
+    try {
+        const { iss } = decodeJwt(token);
+        return typeof iss === "string" ? iss : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Verifies the Vercel OIDC token of a function of this deployment's project, as backend-next
+ * verifies the ontology service's own: RS256 from the team's issuer, for the team's audience,
+ * unexpired, with `project_id` equal to the configured project and `environment` `production`.
+ * The issuer and the audience name the team, so no further owner check is needed. A token that
+ * claims another issuer is `other`, without a key-set fetch.
+ */
+export function makeRuntimeTokenVerifier(config, keySet) {
+    const issuer = normalizedIssuer(config.issuer);
+    return async function verifyRuntimeToken(token) {
+        if (claimedIssuer(token) !== issuer) {
+            return { status: "other" };
+        }
+        try {
+            const { payload } = await jwtVerify(token, keySet, {
+                algorithms: ["RS256"],
+                issuer,
+                audience: config.audience,
+                clockTolerance: CLOCK_TOLERANCE_SECONDS,
+                requiredClaims: ["exp", "iat", "iss", "aud", "project_id", "environment"],
+            });
+            if (payload.project_id !== config.projectId) {
+                return { status: "invalid", reason: "claim:project_id" };
+            }
+            if (payload.environment !== PRODUCTION) {
+                return { status: "invalid", reason: "claim:environment" };
+            }
+            return { status: "valid" };
+        }
+        catch (error) {
+            return keySetUnavailable(error)
+                ? { status: "unavailable" }
+                : { status: "invalid", reason: failureReason(error) };
+        }
+    };
+}
+/** The runtime verifier on the issuer's remote key set, which jose caches between requests. */
+export function runtimeTokenVerifier(config) {
+    return makeRuntimeTokenVerifier(config, runtimeKeySet(config.issuer));
+}
+/** A runtime token that failed verification: the reason is logged, the token never. */
+export function logRuntimeRejection(reason) {
+    return Effect.logWarning("ontology.runtime_identity.rejected").pipe(Effect.annotateLogs({ reason }));
+}
+/** The request's runtime credential, or `undefined` while runtime authentication is disabled. */
+export function runtimeCredential(verify, request) {
+    if (verify === undefined) {
+        return undefined;
+    }
+    const actAs = request.headers[ACT_AS_HEADER]?.trim();
+    return { verify, actAs: actAs === undefined || actAs === "" ? undefined : actAs };
+}

package/dist/service/schemas.d.ts

@@ -4,7 +4,7 @@ import type { ApiPlan } from "./plan.js";
 export declare const IdParam: Schema.String;
 /** The schemas of one entity's records and queries. */
 export interface EntitySchemas {
-    /** System fields, properties and `<relationship>_id` per `rel.one`. */
+    /** System fields, properties and `<relationship>_id` per stored `rel.one`. */
     readonly record: Schema.Top;
     /** A record with the relationships a query may include. */
     readonly result: Schema.Top;
@@ -392,6 +392,13 @@ export declare const Graph: Schema.Struct<{
         readonly to: Schema.String;
         readonly inverse: Schema.String;
         readonly cardinality: Schema.Literals<readonly ["one", "many"]>;
+        /** The property pair of a relationship matched by value: one with a warehouse-backed end. */
+        readonly on: Schema.optionalKey<Schema.encodeKeys<Schema.Struct<{
+            readonly property: Schema.String;
+            readonly targetProperty: Schema.String;
+        }>, {
+            readonly targetProperty: "target_property";
+        }>>;
         readonly optional: Schema.Boolean;
         readonly phrase: Schema.Tuple<readonly [Schema.String, Schema.String]>;
         readonly forward: Schema.String;
@@ -414,6 +421,92 @@ export declare const SIGN_IN_CHECK_MAX_EMAIL_LENGTH = 320;
 export declare const SignInCheckRequest: Schema.Struct<{
     readonly email: Schema.String;
 }>;
+/** The bounds of a model-level aggregate (docs/ontology-aggregates-spec.md, "Request"). */
+export declare const AGGREGATE_LIMITS: {
+    readonly measures: 30;
+    readonly dimensions: 20;
+    readonly filters: 50;
+    readonly values: 100;
+    readonly orderBy: 50;
+    readonly rows: 1000;
+};
+export declare const AGGREGATE_FILTER_OPERATORS: readonly ["equals", "in", "isNull", "isNotNull", "between"];
+/** The operators of the per-entity shorthand, which bounds dates with `dateRange` instead. */
+export declare const ENTITY_AGGREGATE_FILTER_OPERATORS: readonly ["equals", "in", "isNull", "isNotNull"];
+export declare const AGGREGATE_GRANULARITIES: readonly ["day", "week", "month"];
+type AggregateValue = string | number | boolean;
+interface AggregateFilter<Operator extends string> {
+    readonly dimension: string;
+    readonly operator: Operator;
+    readonly value?: AggregateValue;
+    readonly values?: ReadonlyArray<AggregateValue>;
+}
+declare const AggregateValue: Schema.Union<readonly [Schema.String, Schema.Number, Schema.Boolean]>;
+interface AggregateOrdering {
+    readonly measure?: string;
+    readonly dimension?: string;
+    readonly direction: "asc" | "desc";
+}
+/**
+ * `POST /api/ontology/aggregate`. The service checks the shape and the bounds, resolves the names
+ * against its manifest and forwards the body unchanged; SegmentStream checks everything else.
+ */
+export declare const AggregateRequest: Schema.Codec<AggregateRequest>;
+export interface AggregateRequest {
+    readonly measures: ReadonlyArray<string>;
+    readonly dimensions?: ReadonlyArray<string>;
+    readonly filters?: ReadonlyArray<AggregateFilter<(typeof AGGREGATE_FILTER_OPERATORS)[number]>>;
+    readonly granularity?: (typeof AGGREGATE_GRANULARITIES)[number];
+    readonly granularityOf?: string;
+    readonly orderBy?: ReadonlyArray<AggregateOrdering>;
+    readonly limit?: number;
+}
+/**
+ * `POST /api/ontology/<entity>/aggregate`: SegmentStream's per-entity request, unchanged. Names are
+ * relative to the entity (`revenue`, `product.brand`), and `dateRange` bounds a partitioned entity.
+ */
+export declare const EntityAggregateRequest: Schema.Codec<EntityAggregateRequest>;
+export interface EntityAggregateRequest {
+    readonly dimensions: ReadonlyArray<string>;
+    readonly measures: ReadonlyArray<string>;
+    readonly dateRange?: {
+        readonly from: string;
+        readonly to: string;
+    };
+    readonly filters?: ReadonlyArray<AggregateFilter<(typeof ENTITY_AGGREGATE_FILTER_OPERATORS)[number]>>;
+    readonly granularity?: (typeof AGGREGATE_GRANULARITIES)[number];
+    readonly granularityOf?: string;
+    readonly orderBy?: ReadonlyArray<AggregateOrdering>;
+    readonly limit?: number;
+}
+/** SegmentStream's answer to an aggregate, which the service forwards unchanged. */
+export declare const AggregateResult: Schema.Struct<{
+    readonly fields: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly label: Schema.String;
+        readonly type: Schema.String;
+        readonly unit: Schema.optionalKey<Schema.String>;
+        readonly format: Schema.optionalKey<Schema.String>;
+        readonly scope: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        readonly implicit: Schema.optionalKey<Schema.Boolean>;
+        readonly additive: Schema.optionalKey<Schema.Boolean>;
+        readonly filters: Schema.optionalKey<Schema.$Array<Schema.String>>;
+    }>>;
+    readonly rows: Schema.$Array<Schema.$Record<Schema.String, Schema.NullOr<Schema.Union<readonly [Schema.String, Schema.Boolean]>>>>;
+    readonly truncated: Schema.Boolean;
+    readonly execution: Schema.Struct<{
+        readonly elapsedMs: Schema.Number;
+        readonly bytesProcessed: Schema.optionalKey<Schema.String>;
+        readonly bytesBilled: Schema.optionalKey<Schema.String>;
+        readonly warnings: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        readonly sources: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly entity: Schema.String;
+            readonly asOf: Schema.String;
+        }>>>;
+    }>;
+    readonly deploymentId: Schema.NullOr<Schema.String>;
+    readonly definitionDigest: Schema.String;
+}>;
 /** Whether the address may sign in, and with a code or a link. */
 export declare const SignInCheckResult: Schema.Union<readonly [Schema.Struct<{
     readonly allowed: Schema.Literal<false>;
@@ -448,7 +541,12 @@ export declare const ErrorSchemas: {
     rateLimited: Schema.Top;
     internal: Schema.Top;
     unavailable: Schema.Top;
+    invalidAggregateQuery: Schema.Top;
+    readForbidden: Schema.Top;
+    aggregateUnavailable: Schema.Top;
+    aggregateUpstreamUnavailable: Schema.Top;
     connectionRequired: Schema.Top;
     connectionResponseInvalid: Schema.Top;
     connectionUnavailable: Schema.Top;
 };
+export {};

package/dist/service/schemas.js

@@ -1,7 +1,7 @@
 import { BlobValue } from "../blob.js";
 import { Schema, SchemaTransformation } from "effect";
 import { wireStruct } from "../wire.js";
-import { OntologyManifestWire } from "../manifest.js";
+import { isValueMatched, OntologyManifestWire } from "../manifest.js";
 import { entityQuerySchemas, queryLinks } from "../query.js";
 import { ValidationIssue as RuntimeValidationIssue } from "../runtime/errors.js";
 import { Edit, HistoryEntry as RuntimeHistoryEntry } from "../runtime/history.js";
@@ -96,7 +96,8 @@ function recordFields(entity) {
         fields[name] = definition.optional ? Schema.NullOr(value) : value;
     }
     for (const { name, relationship } of entity.relationships) {
-        if (relationship.cardinality === "one") {
+        // A value-matched relationship's reference is the property its `on` names.
+        if (relationship.cardinality === "one" && !isValueMatched(relationship)) {
             const key = Id.annotate({ description: relationship.description });
             fields[`${name}_id`] = relationship.optional ? Schema.NullOr(key) : key;
         }
@@ -276,6 +277,8 @@ const GraphRelationship = Schema.Struct({
     to: Schema.String,
     inverse: Schema.String,
     cardinality: Schema.Literals(["one", "many"]),
+    /** The property pair of a relationship matched by value: one with a warehouse-backed end. */
+    on: Schema.optionalKey(Schema.Struct({ property: Schema.String, targetProperty: Schema.String }).pipe(Schema.encodeKeys({ targetProperty: "target_property" }))),
     optional: Schema.Boolean,
     phrase: Schema.Tuple([Schema.String, Schema.String]),
     forward: Schema.String.annotate({ examples: ["Lead is owned by one User"] }),
@@ -304,6 +307,143 @@ export const SignInCheckRequest = Schema.Struct({
         description: "The address the person typed, in any case.",
     }),
 }).annotate({ identifier: "SignInCheckRequest" });
+/** The bounds of a model-level aggregate (docs/ontology-aggregates-spec.md, "Request"). */
+export const AGGREGATE_LIMITS = {
+    measures: 30,
+    dimensions: 20,
+    filters: 50,
+    values: 100,
+    orderBy: 50,
+    rows: 1000,
+};
+export const AGGREGATE_FILTER_OPERATORS = [
+    "equals",
+    "in",
+    "isNull",
+    "isNotNull",
+    "between",
+];
+/** The operators of the per-entity shorthand, which bounds dates with `dateRange` instead. */
+export const ENTITY_AGGREGATE_FILTER_OPERATORS = ["equals", "in", "isNull", "isNotNull"];
+export const AGGREGATE_GRANULARITIES = ["day", "week", "month"];
+const AggregateValue = Schema.Union([Schema.String, Schema.Number, Schema.Boolean]);
+/** Which values each operator takes, with SegmentStream's own messages (`planner.ts`). */
+function filterValuesIssue(filter) {
+    const { operator, value, values } = filter;
+    switch (operator) {
+        case "equals":
+            return value === undefined || values !== undefined
+                ? "Equality filters require one value."
+                : undefined;
+        case "in":
+            return values === undefined ||
+                values.length === 0 ||
+                values.length > AGGREGATE_LIMITS.values ||
+                value !== undefined
+                ? "Membership filters require between 1 and 100 values."
+                : undefined;
+        case "between":
+            return value !== undefined || values?.length !== 2
+                ? "between needs two values in order."
+                : undefined;
+        default:
+            return value !== undefined || values !== undefined
+                ? "Null filters do not accept values."
+                : undefined;
+    }
+}
+function aggregateFilter(operators) {
+    const filter = closedStruct({
+        dimension: Schema.String.annotate({
+            description: "A property, or a path of to-one relationships ending in one.",
+        }),
+        operator: Schema.Literals(operators),
+        value: Schema.optionalKey(AggregateValue).annotate({ description: "The value of equals." }),
+        values: Schema.optionalKey(Schema.Array(AggregateValue).check(Schema.isMaxLength(AGGREGATE_LIMITS.values))).annotate({ description: "The values of in, or the two inclusive bounds of between." }),
+    }, "Unknown key; use dimension, operator, value and values");
+    return filter.check(Schema.makeFilter((candidate) => filterValuesIssue(candidate) ?? true));
+}
+const AggregateOrder = closedStruct({
+    measure: Schema.optionalKey(Schema.String),
+    dimension: Schema.optionalKey(Schema.String),
+    direction: Schema.Literals(["asc", "desc"]),
+}, "Unknown key; use measure or dimension, and direction");
+/** The fields both aggregate requests share, with their bounds. */
+const aggregateFields = {
+    granularity: Schema.optionalKey(Schema.Literals(AGGREGATE_GRANULARITIES)),
+    granularityOf: Schema.optionalKey(Schema.String).annotate({
+        description: "The requested date or timestamp dimension that granularity buckets.",
+    }),
+    orderBy: Schema.optionalKey(Schema.Array(AggregateOrder).check(Schema.isMaxLength(AGGREGATE_LIMITS.orderBy))),
+    limit: Schema.optionalKey(Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: AGGREGATE_LIMITS.rows }))).annotate({ description: "At most 1000 rows; 100 by default." }),
+};
+/**
+ * `POST /api/ontology/aggregate`. The service checks the shape and the bounds, resolves the names
+ * against its manifest and forwards the body unchanged; SegmentStream checks everything else.
+ */
+export const AggregateRequest = closedStruct({
+    measures: Schema.Array(Schema.String)
+        .check(Schema.isMaxLength(AGGREGATE_LIMITS.measures))
+        .annotate({ description: "<entity>.<measure>, at least one." }),
+    dimensions: Schema.optionalKey(Schema.Array(Schema.String).check(Schema.isMaxLength(AGGREGATE_LIMITS.dimensions))).annotate({
+        description: "<entity>.<property>, or a route from a measure's entity: " +
+            "<entity>.<relationship>[.<relationship>].<property>.",
+    }),
+    filters: Schema.optionalKey(Schema.Array(aggregateFilter(AGGREGATE_FILTER_OPERATORS)).check(Schema.isMaxLength(AGGREGATE_LIMITS.filters))).annotate({ description: "All must hold." }),
+    ...aggregateFields,
+}, "Unknown key; use measures, dimensions, filters, granularity, granularityOf, orderBy and limit").annotate({ identifier: "AggregateRequest" });
+/**
+ * `POST /api/ontology/<entity>/aggregate`: SegmentStream's per-entity request, unchanged. Names are
+ * relative to the entity (`revenue`, `product.brand`), and `dateRange` bounds a partitioned entity.
+ */
+export const EntityAggregateRequest = closedStruct({
+    dimensions: Schema.Array(Schema.String)
+        .check(Schema.isMaxLength(AGGREGATE_LIMITS.dimensions))
+        .annotate({
+        description: "A property, or a path of to-one relationships: product.brand.",
+    }),
+    measures: Schema.Array(Schema.String)
+        .check(Schema.isMaxLength(AGGREGATE_LIMITS.measures))
+        .annotate({ description: "The entity's measures, at least one." }),
+    dateRange: Schema.optionalKey(closedStruct({
+        from: Schema.String.annotate({ format: "date" }),
+        to: Schema.String.annotate({ format: "date" }),
+    }, "Unknown key; use from and to")).annotate({ description: "Inclusive days of the entity's partition property." }),
+    filters: Schema.optionalKey(Schema.Array(aggregateFilter(ENTITY_AGGREGATE_FILTER_OPERATORS)).check(Schema.isMaxLength(AGGREGATE_LIMITS.filters))).annotate({ description: "All must hold." }),
+    ...aggregateFields,
+}, "Unknown key; use dimensions, measures, dateRange, filters, granularity, granularityOf, " +
+    "orderBy and limit").annotate({ identifier: "EntityAggregateRequest" });
+/** SegmentStream's answer to an aggregate, which the service forwards unchanged. */
+export const AggregateResult = Schema.Struct({
+    fields: Schema.Array(Schema.Struct({
+        name: Schema.String.annotate({ description: "A dimension identity or <entity>.<measure>." }),
+        label: Schema.String,
+        type: Schema.String,
+        unit: Schema.optionalKey(Schema.String),
+        format: Schema.optionalKey(Schema.String),
+        scope: Schema.optionalKey(Schema.Array(Schema.String)),
+        implicit: Schema.optionalKey(Schema.Boolean),
+        additive: Schema.optionalKey(Schema.Boolean).annotate({
+            description: "false when the measure's rows do not add up to a total.",
+        }),
+        filters: Schema.optionalKey(Schema.Array(Schema.String)).annotate({
+            description: "The filters the measure applied.",
+        }),
+    })),
+    rows: Schema.Array(Schema.Record(Schema.String, Schema.NullOr(Schema.Union([Schema.String, Schema.Boolean])))),
+    truncated: Schema.Boolean,
+    execution: Schema.Struct({
+        elapsedMs: Schema.Number,
+        bytesProcessed: Schema.optionalKey(Schema.String),
+        bytesBilled: Schema.optionalKey(Schema.String),
+        warnings: Schema.optionalKey(Schema.Array(Schema.String)).annotate({
+            description: "For example, a filter that did not apply to some measure's entity.",
+        }),
+        sources: Schema.optionalKey(Schema.Array(Schema.Struct({ entity: Schema.String, asOf: Schema.String }))).annotate({ description: "How fresh the replica of each stored entity read is." }),
+    }),
+    deploymentId: Schema.NullOr(Schema.String),
+    definitionDigest: Schema.String,
+}).annotate({ identifier: "AggregateResult" });
 /** Whether the address may sign in, and with a code or a link. */
 export const SignInCheckResult = Schema.Union([
     Schema.Struct({ allowed: Schema.Literal(false) }),
@@ -370,6 +510,14 @@ export const ErrorSchemas = {
     rateLimited: errorBody("RateLimited", 429, ["rate_limited"]),
     internal: errorBody("InternalError", 500, ["internal_error"]),
     unavailable: errorBody("ServiceUnavailable", 503, ["service_unavailable"]),
+    invalidAggregateQuery: errorBody("InvalidAggregateQuery", 400, ["invalid_aggregate_query"]),
+    readForbidden: errorBody("ReadForbidden", 403, ["forbidden"], {
+        permissions: Schema.optionalKey(Schema.Array(Schema.String)),
+    }),
+    aggregateUnavailable: errorBody("AggregateUnavailable", 503, ["aggregate_unavailable"], {
+        retryable: Schema.Boolean,
+    }),
+    aggregateUpstreamUnavailable: errorBody("AggregateUpstreamUnavailable", 502, ["aggregate_upstream_unavailable"], { retryable: Schema.Boolean }),
     connectionRequired: errorBody("ConnectionRequired", 409, ["connection_authorization_required", "connections_not_deployed"], { connection: Schema.String }),
     connectionResponseInvalid: errorBody("ConnectionResponseInvalid", 502, [
         "connection_response_invalid",

package/dist/service/service.d.ts

@@ -13,8 +13,8 @@ export interface OntologyService {
     readonly dispose: () => Promise<void>;
 }
 /**
- * The ontology service: the derived HttpApi and the MCP server at `/mcp`, wired to the runtime,
- * behind Neon Auth, app-token and API-key authentication. Every response carries `x-ontology-hash`
+ * The ontology service: the derived HttpApi, the MCP server at `/mcp` and the agent's pairing routes,
+ * wired to the runtime, behind Neon Auth, app-token, API-key and runtime-token authentication. Every response carries `x-ontology-hash`
  * and `x-request-id`; failures answer with a JSON error and never a stack or SQL.
  */
 export declare function createOntologyService(ontology: Ontology, config: OntologyServiceConfig): OntologyService;

package/dist/service/service.js

@@ -4,6 +4,9 @@ import { HttpApiBuilder } from "effect/unstable/httpapi";
 import { storageMaintenanceAuthenticationLayer } from "../storage/maintenance-auth.js";
 import { nameToWire } from "../authoring-names.js";
 import { sqlServiceRuntime } from "../runtime/service-binding.js";
+import { agentLayer } from "./agent/server.js";
+import { makeAggregates } from "./aggregate.js";
+import { platformAggregates } from "./aggregate-platform.js";
 import { ErrorResponsesLive, buildApi } from "./api.js";
 import { authenticationLayer, neonAuthSessionExchange, tokenVerifier } from "./authentication.js";
 import { OntologyServiceConfigError, } from "./config.js";
@@ -15,6 +18,7 @@ import { deployedReplication } from "./replication.js";
 import { mcpLayer } from "./mcp/server.js";
 import { oauthLayer } from "./oauth/server.js";
 import { planApi } from "./plan.js";
+import { runtimeTokenVerifier } from "./runtime-identity.js";
 /** The header every response carries: the hash of the manifest the service serves. */
 export const ONTOLOGY_HASH_HEADER = "x-ontology-hash";
 /** The header every response carries: the correlation id quoted in error bodies and logs. */
@@ -57,8 +61,8 @@ function decorate(response, requestId, hash) {
     });
 }
 /**
- * The ontology service: the derived HttpApi and the MCP server at `/mcp`, wired to the runtime,
- * behind Neon Auth, app-token and API-key authentication. Every response carries `x-ontology-hash`
+ * The ontology service: the derived HttpApi, the MCP server at `/mcp` and the agent's pairing routes,
+ * wired to the runtime, behind Neon Auth, app-token, API-key and runtime-token authentication. Every response carries `x-ontology-hash`
  * and `x-request-id`; failures answer with a JSON error and never a stack or SQL.
  */
 export function createOntologyService(ontology, config) {
@@ -74,6 +78,7 @@ export function createOntologyService(ontology, config) {
     const hooks = afterCommitHooks(plan, config.afterCommit);
     const verifyToken = tokenVerifier(config);
     const exchangeSession = config.neonAuth === undefined ? undefined : neonAuthSessionExchange(config.neonAuth);
+    const verifyRuntime = config.runtimeIdentity === undefined ? undefined : runtimeTokenVerifier(config.runtimeIdentity);
     const backend = runtime.connect({
         ontology,
         databaseUrl: config.databaseUrl,
@@ -84,15 +89,28 @@ export function createOntologyService(ontology, config) {
             ? deployedConnections(config)
             : localConnections(config.localConnections));
     const replicate = deployedReplication(config);
-    const routes = HttpApiBuilder.layer(built.api).pipe(Layer.provide(handlersLayer(built, hooks, connections, replicate)), Layer.provide([
-        authenticationLayer(verifyToken, exchangeSession),
+    const aggregates = makeAggregates({
+        manifest: ontology.manifest,
+        transport: platformAggregates({ ...config, manifestHash: ontology.manifest.hash }),
+    });
+    const routes = HttpApiBuilder.layer(built.api).pipe(Layer.provide(handlersLayer(built, hooks, connections, replicate, aggregates)), Layer.provide([
+        authenticationLayer(verifyToken, exchangeSession, verifyRuntime),
         ErrorResponsesLive,
         storageMaintenanceAuthenticationLayer(config.storageMaintenanceKey),
     ]));
     const mcp = config.mcp === false
         ? Layer.empty
-        : Layer.mergeAll(mcpLayer({ built, hooks, connections, verifyToken, replicate }), oauthLayer({ verifyToken }));
-    const application = Layer.mergeAll(routes, mcp, DocsRoute, UnmatchedRoutes).pipe(Layer.provide(backend), Layer.provide(HttpServer.layerServices));
+        : Layer.mergeAll(mcpLayer({
+            built,
+            hooks,
+            connections,
+            verifyToken,
+            verifyRuntime,
+            replicate,
+            aggregates,
+        }), oauthLayer({ verifyToken }));
+    const agent = agentLayer({ verifyToken, verifyRuntime, exchangeSession });
+    const application = Layer.mergeAll(routes, mcp, agent, DocsRoute, UnmatchedRoutes).pipe(Layer.provide(backend), Layer.provide(HttpServer.layerServices));
     const web = HttpRouter.toWebHandler(application, { disableLogger: true });
     const hash = ontology.manifest.hash;
     return {

package/dist/user.d.ts

@@ -16,5 +16,5 @@ export declare const User: import("./entity.js").DraftEntity<"user", {
     readonly identityProvider: import("effect/Schema").optionalKey<import("./property.js").Property<string, false, false>>;
     readonly identitySubject: import("effect/Schema").optionalKey<import("./property.js").Property<string, false, false>>;
     readonly lastSignInAt: import("effect/Schema").optionalKey<import("./property.js").Property<string, false, false>>;
-}, import("./entity.js").Relationships>;
+}, import("./entity.js").Relationships, Readonly<Record<never, never>>>;
 export type User = typeof User.Type;