@segmentstream-cloud/ontology 0.22.0 → 0.24.0

package/dist/render.js

@@ -1,4 +1,4 @@
-import { shortestRoutesFrom } from "./aggregate-routes.js";
+import { inputEntities, shortestRoutesFrom } from "./aggregate-routes.js";
 import { isAllowed, permissionOf, READ_VERB, rolesGranting } from "./permissions.js";
 import { REFERENCE_ANNOTATION } from "./property.js";
 /** What an action of the manifest requires; version 1 manifests leave it implicit. */
@@ -389,6 +389,51 @@ export function measuresFor(manifest, permissions) {
         measure,
     })));
 }
+/**
+ * The measures of the model whose every input entity the reader may read, in declaration order.
+ * Reading a model measure is reading its inputs. Without permissions, every one.
+ */
+export function modelMeasuresFor(manifest, permissions) {
+    return (manifest.measures ?? []).filter((measure) => inputEntities(measure).every((entity) => readable(entity, permissions)));
+}
+/** `a`, `a and b`, `a, b and c`. */
+function listed(values) {
+    return values.length < 2
+        ? values.join("")
+        : `${values.slice(0, -1).join(", ")} and ${values[values.length - 1]}`;
+}
+/**
+ * How one alignment group reads: `sales.order_date aligns with plans.month`, and for an entity
+ * without a counterpart `listings has no counterpart for sales.order_date`. Members follow the
+ * measure's input entities, whatever order the document keeps them in.
+ */
+function alignmentClauses(measure, group) {
+    const order = inputEntities(measure);
+    const members = Object.entries(group).sort(([left], [right]) => order.indexOf(left) - order.indexOf(right));
+    const present = members.flatMap(([entity, property]) => property === null ? [] : [`${entity}.${property}`]);
+    const absent = members.flatMap(([entity, property]) => (property === null ? [entity] : []));
+    const [first, ...rest] = present;
+    if (first === undefined) {
+        return [];
+    }
+    return [
+        ...(rest.length > 0 ? [`${first} aligns with ${listed(rest)}`] : []),
+        ...absent.map((entity) => `${entity} has no counterpart for ${first}`),
+    ];
+}
+/**
+ * A measure of the model as `describe`, the MCP tool and the instructions show it: its description,
+ * the entity measures it reads and how their properties align. `Ordered over planned units. Reads
+ * sales.ordered and plans.planned_units; sales.order_date aligns with plans.month.`
+ */
+export function modelMeasureDescription(measure) {
+    const clauses = [
+        `Reads ${listed(measure.inputs)}`,
+        ...measure.align.flatMap((group) => alignmentClauses(measure, group)),
+    ];
+    const described = measure.description === "" ? [] : [sentence(measure.description)];
+    return [...described, `${clauses.join("; ")}.`].join(" ");
+}
 /**
  * The entities one entity reaches, with the shortest routes to each: exactly the routes aggregate
  * resolution weighs ({@link shortestRoutesFrom}). Only then is the reader applied: a target they may
@@ -416,8 +461,9 @@ function reachLine(entity, reaches) {
     return `${entity} reaches ${targets.join(", ")}.`;
 }
 /**
- * The aggregate part of the catalog's prose: every measure the reader may read, model-wide, and
- * per measure entity the entities it reaches. Empty when the reader may read no measure.
+ * The aggregate part of the catalog's prose: every measure the reader may read, model-wide, the
+ * measures of the model whose every input they may read, and per measure entity the entities it
+ * reaches. Empty when the reader may read no measure.
  */
 export function renderAggregates(manifest, permissions) {
     const measures = measuresFor(manifest, permissions);
@@ -430,10 +476,17 @@ export function renderAggregates(manifest, permissions) {
         return reaches.length === 0 ? [] : [reachLine(owner, reaches)];
     });
     const measureLines = measures.map(({ name, entity, measure }) => `${name} (${measure.unit}): ${sentence(measureDescription(entity, measure))}`);
+    const modelLines = modelMeasuresFor(manifest, permissions).map((measure) => `${measure.name} (${measure.unit}): ${modelMeasureDescription(measure)}`);
     return [
         `Aggregates: ${RECORDS_OR_AGGREGATES} (POST /api/ontology/aggregate, or the aggregate tool).`,
         `${INDENT}Measures, as <entity>.<measure>:`,
         ...measureLines.map((line) => `${INDENT}${INDENT}${line}`),
+        ...(modelLines.length === 0
+            ? []
+            : [
+                `${INDENT}Measures of the model, by name:`,
+                ...modelLines.map((line) => `${INDENT}${INDENT}${line}`),
+            ]),
         ...(reachLines.length === 0
             ? []
             : [

package/dist/runtime/history.d.ts

@@ -1,4 +1,5 @@
 import { Schema } from "effect";
+import { WorkloadExecution } from "./workload.js";
 import type { StoredRecord } from "../runtime.js";
 import type { EntityModel } from "./model.js";
 import type { Params } from "./statement.js";
@@ -31,6 +32,26 @@ export declare const Edit: Schema.Struct<{
 export type Edit = typeof Edit.Type;
 /** A row of `<entity>_history`. */
 export declare const HistoryEntry: Schema.Struct<{
+    readonly execution: Schema.optionalKey<Schema.Struct<{
+        readonly issuer: Schema.String;
+        readonly audience: Schema.String;
+        readonly organizationId: Schema.String;
+        readonly workspaceId: Schema.String;
+        readonly subject: Schema.String;
+        readonly deploymentId: Schema.String;
+        readonly ontologyDeploymentId: Schema.String;
+        readonly servingOntologyDeploymentId: Schema.String;
+        readonly ontologyOrigin: Schema.String;
+        readonly environment: Schema.Literal<"production">;
+        readonly jobName: Schema.String;
+        readonly runId: Schema.String;
+        readonly executionId: Schema.NullOr<Schema.String>;
+        readonly attemptId: Schema.String;
+        readonly generation: Schema.Number;
+        readonly tokenId: Schema.String;
+        readonly issuedAt: Schema.Number;
+        readonly expiresAt: Schema.Number;
+    }>>;
     readonly id: Schema.String;
     readonly recordId: Schema.String;
     /** The qualified action, for example `lead.changeStatus`. */
@@ -54,6 +75,7 @@ export interface HistoryWrite {
     readonly edit: Edit;
 }
 export interface HistoryScope {
+    readonly execution?: WorkloadExecution;
     readonly action: string;
     readonly actionId: string;
     readonly principalId: string | null;

package/dist/runtime/history.js

@@ -1,5 +1,6 @@
 import { Schema } from "effect";
 import { canonicalJson } from "../manifest.js";
+import { WorkloadExecution } from "./workload.js";
 import { quoteIdentifier } from "../migrate/storage.js";
 import { uuidv7 } from "./ids.js";
 export const EditKind = Schema.Literals(["create", "update", "delete", "link", "unlink"]);
@@ -21,6 +22,7 @@ export const Edit = Schema.Struct({
 });
 /** A row of `<entity>_history`. */
 export const HistoryEntry = Schema.Struct({
+    execution: Schema.optionalKey(WorkloadExecution),
     id: Schema.String,
     recordId: Schema.String,
     /** The qualified action, for example `lead.changeStatus`. */

package/dist/runtime/pipeline.js

@@ -141,7 +141,7 @@ export function runAction(ontology, request) {
         if (consumesUpload) {
             const saved = yield* sql
                 .withTransaction(Effect.gen(function* () {
-                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions);
+                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions, request.principal.execution);
                 const [saved] = yield* sql.unsafe(`SELECT fingerprint, outcome FROM "_blob_action_results"
                WHERE principal_id = $1::uuid AND key = $2`, [request.principal.id, key]);
                 if (saved && saved.fingerprint !== fingerprint) {
@@ -168,6 +168,7 @@ export function runAction(ontology, request) {
             action: qualified,
             actionId,
             principalId: request.principal.id,
+            ...(request.principal.execution ? { execution: request.principal.execution } : {}),
             ...(key ? { blobActionKey: key } : {}),
             ...(request.branchId ? { branchId: request.branchId } : {}),
             ...(request.options?.createIntent ? { createIntent: request.options.createIntent } : {}),
@@ -177,8 +178,11 @@ export function runAction(ontology, request) {
         const handler = Effect.suspend(() => handle({ ...context, prepared }));
         let replay;
         const transactionalHandler = Effect.gen(function* () {
+            if (request.principal.execution !== undefined) {
+                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions, request.principal.execution);
+            }
             if (consumesUpload) {
-                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions);
+                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions, request.principal.execution);
                 yield* sql.unsafe(`INSERT INTO "_blob_action_results" (principal_id, key, fingerprint)
           VALUES ($1::uuid, $2, $3) ON CONFLICT DO NOTHING`, [request.principal.id, key, fingerprint]);
                 const [saved] = yield* sql.unsafe(`SELECT fingerprint, outcome FROM "_blob_action_results" WHERE principal_id = $1::uuid AND key = $2

package/dist/runtime/principals.d.ts

@@ -49,6 +49,8 @@ export declare const SIGN_IN_RECORD_INTERVAL_MS: number;
  * {@link SIGN_IN_RECORD_INTERVAL_MS}, so history keeps it. Inactive users are rejected.
  */
 export declare function resolvePrincipalByIdentity(ontology: Ontology, claims: IdentityClaims): Effect.Effect<Principal, PrincipalRejected, SqlClient.SqlClient>;
+/** Resolve the workspace's stable keyless pipeline service, without customer roles or sign-in. */
+export declare function resolvePipelineWorker(ontology: Ontology, execution: import("./workload.js").WorkloadExecution): Effect.Effect<Principal, PrincipalRejected, SqlClient.SqlClient>;
 /**
  * The principal of an API key, with the permissions its roles have in the ontology. Unknown and
  * revoked keys and inactive users are rejected.

package/dist/runtime/principals.js

@@ -207,6 +207,61 @@ export function resolvePrincipalByIdentity(ontology, claims) {
         return yield* activePrincipal(ontology, sql, user);
     }).pipe(Effect.catchIf(isSqlError, (error) => Effect.die(error)));
 }
+/** Resolve the workspace's stable keyless pipeline service, without customer roles or sign-in. */
+export function resolvePipelineWorker(ontology, execution) {
+    return Effect.gen(function* () {
+        const sql = yield* SqlClient.SqlClient;
+        const provider = "segmentstream-ontology-workload";
+        const subject = `pipeline-workers:${execution.workspaceId}`;
+        const runtime = platformRuntime(ontology, sql, "user.resolve_pipeline_worker");
+        const principal = (user) => user.kind !== "service" || user.active !== true
+            ? Effect.fail(new PrincipalRejected({
+                reason: "inactive_user",
+                message: "The pipeline worker principal is inactive or has an invalid kind.",
+            }))
+            : Effect.succeed({
+                id: user.id,
+                kind: "service",
+                roles: [],
+                permissions: ["*:*"],
+                execution,
+            });
+        const find = (forUpdate) => runtime.find({
+            entity: "user",
+            options: {
+                where: { identity_provider: provider, identity_subject: subject },
+                limit: 1,
+                forUpdate,
+            },
+        });
+        const [known] = yield* find(false);
+        // Returning requests only read the principal; writes revalidate it in their transaction.
+        if (known !== undefined) {
+            return yield* principal(known);
+        }
+        return yield* sql
+            .withTransaction(Effect.gen(function* () {
+            // The replication lock precedes every business lock, including principal initialization.
+            yield* beginReplicationWrite(sql);
+            yield* sql.unsafe("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [
+                provider + ":" + subject,
+            ]);
+            const [existing] = yield* find(true);
+            const user = existing ??
+                (yield* runtime.create({
+                    entity: "user",
+                    values: {
+                        name: "Pipeline workers",
+                        kind: "service",
+                        identity_provider: provider,
+                        identity_subject: subject,
+                    },
+                }));
+            return yield* principal(user);
+        }))
+            .pipe(Effect.catchTag("Conflict", (error) => Effect.die(error)), Effect.catchTag("NotFound", (error) => Effect.die(error)));
+    }).pipe(Effect.catchIf(isSqlError, (error) => Effect.die(error)));
+}
 /**
  * The principal of an API key, with the permissions its roles have in the ontology. Unknown and
  * revoked keys and inactive users are rejected.

package/dist/runtime/reads.js

@@ -238,17 +238,25 @@ export function readHistory(context, entity, input) {
             const at = params.add(cursor[0], "timestamptz");
             conditions.push(`("h"."at" < ${at} OR ("h"."at" = ${at} AND "h"."id" < ${params.add(cursor[1], "uuid")}))`);
         }
+        const presenceParams = new Params();
+        const [presence] = yield* context.run("SELECT to_regclass('_ontology_action_attribution') IS NOT NULL AS present", presenceParams);
+        const attribution = presence?.present === true;
         const rows = yield* context.run(`SELECT "h"."id"::text AS "id", "h"."record_id"::text AS "recordId", "h"."action" AS "action", ` +
             `"h"."action_id"::text AS "actionId", "h"."kind" AS "kind", ` +
             `"h"."principal_id"::text AS "principalId", ` +
             `to_char("h"."at" AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') AS "at", ` +
             `"h"."changes"::text AS "changes" ` +
+            (attribution ? `, "a"."execution" AS "execution" ` : "") +
             `FROM ${quoteIdentifier(entity.historyTable)} AS "h" ` +
+            (attribution
+                ? `LEFT JOIN "_ontology_action_attribution" AS "a" ON "a"."action_id" = "h"."action_id" `
+                : "") +
             `WHERE ${conditions.join(" AND ")} ` +
             `ORDER BY "h"."at" DESC, "h"."id" DESC ` +
             `LIMIT ${params.add(limit + 1, "bigint")}`, params);
         const items = rows.slice(0, limit).map((row) => Schema.decodeUnknownSync(HistoryEntry)({
-            ...row,
+            ...Object.fromEntries(Object.entries(row).filter(([key, value]) => key !== "execution" || value != null)),
+            ...(row.execution == null ? {} : { execution: row.execution }),
             at: canonicalInstant(String(row.at)),
             changes: JSON.parse(String(row.changes)),
         }));

package/dist/runtime/service-binding.js

@@ -11,7 +11,7 @@ import { sqlAgentStore } from "./agents.js";
 import { generatedActions } from "./generated-actions.js";
 import { sqlOAuthStore } from "./oauth.js";
 import { runAction } from "./pipeline.js";
-import { checkSignIn, resolvePrincipalByApiKey, resolvePrincipalByIdentity } from "./principals.js";
+import { checkSignIn, resolvePrincipalByApiKey, resolvePrincipalByIdentity, resolvePipelineWorker, } from "./principals.js";
 import { postgresTls } from "./postgres-tls.js";
 import { makeOntologyRuntime } from "./sql-runtime.js";
 /** Connections one service instance holds to the database's pooler. */
@@ -61,6 +61,7 @@ export function backendLayer(ontology, blobStorage) {
             })).pipe(Effect.catchTag("PrincipalRejected", (rejection) => rejection.reason === "not_invited"
                 ? rejectedAs("sign_in")(rejection).pipe(Effect.andThen(Effect.fail(new NotInvited({ message: rejection.message }))))
                 : rejectedAs("sign_in")(rejection))),
+            resolvePipelineWorker: (execution) => withSql(resolvePipelineWorker(ontology, execution)).pipe(Effect.catchTag("PrincipalRejected", rejectedAs("pipeline_worker"))),
             checkSignIn: (email) => withSql(checkSignIn(ontology, email)),
             resolveApiKey: (key) => withSql(resolvePrincipalByApiKey(ontology, Redacted.value(key))).pipe(Effect.catchTag("PrincipalRejected", rejectedAs("api_key"))),
             appliedHash: readCatalog({ sql }).pipe(Effect.map((manifest) => manifest?.hash), Effect.orDie),

package/dist/runtime/workload.d.ts

@@ -0,0 +1,23 @@
+import { Schema } from "effect";
+/** Verified platform claims retained with each write; never supplied by request headers. */
+export declare const WorkloadExecution: Schema.Struct<{
+    readonly issuer: Schema.String;
+    readonly audience: Schema.String;
+    readonly organizationId: Schema.String;
+    readonly workspaceId: Schema.String;
+    readonly subject: Schema.String;
+    readonly deploymentId: Schema.String;
+    readonly ontologyDeploymentId: Schema.String;
+    readonly servingOntologyDeploymentId: Schema.String;
+    readonly ontologyOrigin: Schema.String;
+    readonly environment: Schema.Literal<"production">;
+    readonly jobName: Schema.String;
+    readonly runId: Schema.String;
+    readonly executionId: Schema.NullOr<Schema.String>;
+    readonly attemptId: Schema.String;
+    readonly generation: Schema.Number;
+    readonly tokenId: Schema.String;
+    readonly issuedAt: Schema.Number;
+    readonly expiresAt: Schema.Number;
+}>;
+export type WorkloadExecution = typeof WorkloadExecution.Type;

package/dist/runtime/workload.js

@@ -0,0 +1,22 @@
+import { Schema } from "effect";
+/** Verified platform claims retained with each write; never supplied by request headers. */
+export const WorkloadExecution = Schema.Struct({
+    issuer: Schema.String,
+    audience: Schema.String,
+    organizationId: Schema.String,
+    workspaceId: Schema.String,
+    subject: Schema.String,
+    deploymentId: Schema.String,
+    ontologyDeploymentId: Schema.String,
+    servingOntologyDeploymentId: Schema.String,
+    ontologyOrigin: Schema.String,
+    environment: Schema.Literal("production"),
+    jobName: Schema.String,
+    runId: Schema.String,
+    executionId: Schema.NullOr(Schema.String),
+    attemptId: Schema.String,
+    generation: Schema.Number,
+    tokenId: Schema.String,
+    issuedAt: Schema.Number,
+    expiresAt: Schema.Number,
+});

package/dist/runtime/writes.js

@@ -1,7 +1,7 @@
 import { Effect } from "effect";
 import { resolveBlobWrites } from "../storage/writes.js";
 import { Conflict } from "../errors.js";
-import { quoteIdentifier } from "../migrate/storage.js";
+import { ACTION_ATTRIBUTION_TABLE, quoteIdentifier } from "../migrate/storage.js";
 import { InvalidValues } from "./errors.js";
 import { uuidv7 } from "./ids.js";
 import { diffRecords, insertHistory } from "./history.js";
@@ -13,6 +13,12 @@ import { columnOf, Params } from "./statement.js";
 function recordEdit(context, entity, edit) {
     return Effect.gen(function* () {
         const params = new Params();
+        if (context.scope.execution !== undefined) {
+            const attribution = new Params();
+            yield* context.run(`INSERT INTO "${ACTION_ATTRIBUTION_TABLE}" (action_id, execution) VALUES (` +
+                `${attribution.add(context.scope.actionId, "uuid")}, ` +
+                `${attribution.add(JSON.stringify(context.scope.execution), "jsonb")}) ON CONFLICT DO NOTHING`, attribution);
+        }
         yield* context.run(insertHistory(context.scope, { entity, edit }, params), params);
         context.edits.push(edit);
     });

package/dist/runtime.d.ts

@@ -1,8 +1,11 @@
 import { Context, Effect } from "effect";
 import type { Conflict, NotFound } from "./errors.js";
 import type { Where } from "./query.js";
+import type { WorkloadExecution } from "./runtime/workload.js";
 /** Who runs an action: an app member or a service principal, both `user` records. */
 export interface Principal {
+    /** Present only for a verified managed pipeline worker. */
+    readonly execution?: WorkloadExecution;
     /** The id of the principal's `user` record. */
     readonly id: string;
     readonly kind: "member" | "service";

package/dist/service/authentication.d.ts

@@ -2,6 +2,7 @@ import { Context, Effect, Layer, Redacted } from "effect";
 import { HttpServerRequest, type HttpServerResponse } from "effect/unstable/http";
 import { HttpApiMiddleware, HttpApiSecurity } from "effect/unstable/httpapi";
 import { type JWTVerifyGetKey } from "jose";
+import type { WorkloadExecution } from "../runtime/workload.js";
 import type { Principal } from "../runtime.js";
 import type { NeonAuthEnvironment } from "./config.js";
 import { RequestId } from "./errors.js";
@@ -32,6 +33,10 @@ declare const Authentication_base: HttpApiMiddleware.ServiceClass<Authentication
 export declare class Authentication extends Authentication_base {
 }
 export interface TokenVerifierConfig {
+    /** Production workload activation and the deployment actually serving the request. */
+    readonly workloadTarget?: {
+        readonly deploymentId: string;
+    };
     /** The control plane: the issuer of app tokens and the host of their JWKS. */
     readonly segmentstreamUrl: string;
     readonly applicationId: string;
@@ -39,6 +44,9 @@ export interface TokenVerifierConfig {
     readonly organizationId: string;
 }
 export type TokenVerification = {
+    readonly status: "workload";
+    readonly execution: WorkloadExecution;
+} | {
     readonly status: "valid";
     readonly identity: SignInIdentity;
 } | {
@@ -56,6 +64,9 @@ export declare function neonAuthKeySet(jwksUrl: string): JWTVerifyGetKey;
  * `SEGMENTSTREAM_URL` for this application (`aud: app:<application id>`), organization and workspace.
  */
 export declare function makeTokenVerifier(config: TokenVerifierConfig, keySet: JWTVerifyGetKey): TokenVerifier;
+export declare const WORKLOAD_TOKEN_TYPE = "segmentstream-ontology-workload+jwt";
+/** A separate verifier: a workload token can never resolve as a human or act as an agent. */
+export declare function makeWorkloadTokenVerifier(config: TokenVerifierConfig, keySet: JWTVerifyGetKey): TokenVerifier;
 /**
  * Neon Auth's issuer is the origin of its Auth URL: `https://ep-….neon.tech/ontology/auth` issues
  * tokens with `iss: https://ep-….neon.tech`.

package/dist/service/authentication.js

@@ -1,7 +1,7 @@
 import { Cause, Context, Effect, Layer, Redacted } from "effect";
 import { HttpServerRequest } from "effect/unstable/http";
 import { HttpApiMiddleware, HttpApiSecurity, OpenApi } from "effect/unstable/httpapi";
-import { createRemoteJWKSet, decodeJwt, errors, jwtVerify, } from "jose";
+import { createRemoteJWKSet, decodeJwt, decodeProtectedHeader, errors, jwtVerify, } from "jose";
 import { API_KEY_PREFIX } from "../runtime/principals.js";
 import { RequestId, crossOriginSession, forbidden, internalError, notInvited, toServerResponse, unauthorized, unavailable, } from "./errors.js";
 import { ACCESS_TOKEN_PREFIX, principalOfAccessToken } from "./oauth/protocol.js";
@@ -76,6 +76,7 @@ export function makeTokenVerifier(config, keySet) {
         try {
             const verified = await jwtVerify(token, keySet, {
                 algorithms: ["ES256"],
+                typ: "JWT",
                 issuer,
                 audience,
                 clockTolerance: CLOCK_TOLERANCE_SECONDS,
@@ -90,6 +91,96 @@ export function makeTokenVerifier(config, keySet) {
         return identity === undefined ? { status: "invalid" } : { status: "valid", identity };
     };
 }
+export const WORKLOAD_TOKEN_TYPE = "segmentstream-ontology-workload+jwt";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** A separate verifier: a workload token can never resolve as a human or act as an agent. */
+export function makeWorkloadTokenVerifier(config, keySet) {
+    return async (token) => {
+        if (config.workloadTarget === undefined) {
+            return { status: "invalid" };
+        }
+        let payload;
+        try {
+            const verified = await jwtVerify(token, keySet, {
+                algorithms: ["ES256"],
+                typ: WORKLOAD_TOKEN_TYPE,
+                issuer: new URL(config.segmentstreamUrl).origin,
+                audience: `ontology:${config.applicationId}`,
+                clockTolerance: CLOCK_TOLERANCE_SECONDS,
+                requiredClaims: [
+                    "sub",
+                    "exp",
+                    "iat",
+                    "jti",
+                    "org",
+                    "wsp",
+                    "deploymentId",
+                    "ontologyDeploymentId",
+                    "ontologyOrigin",
+                    "environment",
+                    "jobName",
+                    "runId",
+                    "executionId",
+                    "attemptId",
+                    "generation",
+                ],
+            });
+            payload = verified.payload;
+        }
+        catch (error) {
+            return keySetUnavailable(error) ? { status: "unavailable" } : { status: "invalid" };
+        }
+        const strings = ["jti", "jobName"];
+        const ids = ["deploymentId", "ontologyDeploymentId", "runId", "attemptId"];
+        if (payload.org !== config.organizationId ||
+            payload.wsp !== config.workspaceId ||
+            payload.sub !== `pipeline-workers:${config.workspaceId}` ||
+            payload.environment !== "production" ||
+            payload.aud !== `ontology:${config.applicationId}` ||
+            strings.some((name) => typeof payload[name] !== "string" || payload[name].trim() === "") ||
+            ids.some((name) => typeof payload[name] !== "string" || !UUID.test(payload[name])) ||
+            (payload.executionId !== null &&
+                (typeof payload.executionId !== "string" || !UUID.test(payload.executionId))) ||
+            !Number.isSafeInteger(payload.generation) ||
+            payload.generation < 1 ||
+            !Number.isSafeInteger(payload.iat) ||
+            !Number.isSafeInteger(payload.exp) ||
+            payload.iat > Math.floor(Date.now() / 1000) + CLOCK_TOLERANCE_SECONDS ||
+            payload.exp <= payload.iat ||
+            payload.exp - payload.iat > 300 ||
+            typeof payload.ontologyOrigin !== "string" ||
+            !URL.canParse(payload.ontologyOrigin)) {
+            return { status: "invalid" };
+        }
+        const origin = new URL(payload.ontologyOrigin);
+        if (origin.protocol !== "https:" || origin.origin !== payload.ontologyOrigin) {
+            return { status: "invalid" };
+        }
+        return {
+            status: "workload",
+            execution: {
+                issuer: payload.iss,
+                audience: payload.aud,
+                organizationId: config.organizationId,
+                workspaceId: config.workspaceId,
+                subject: payload.sub,
+                deploymentId: payload.deploymentId,
+                ontologyDeploymentId: payload.ontologyDeploymentId,
+                servingOntologyDeploymentId: config.workloadTarget.deploymentId,
+                ontologyOrigin: payload.ontologyOrigin,
+                environment: "production",
+                jobName: payload.jobName,
+                runId: payload.runId,
+                executionId: payload.executionId,
+                attemptId: payload.attemptId,
+                generation: payload.generation,
+                tokenId: payload.jti,
+                issuedAt: payload.iat,
+                expiresAt: payload.exp,
+            },
+        };
+    };
+}
 /**
  * Neon Auth's issuer is the origin of its Auth URL: `https://ep-….neon.tech/ontology/auth` issues
  * tokens with `iss: https://ep-….neon.tech`.
@@ -166,11 +257,21 @@ export function verifyByIssuer(verifiers) {
  * once it has Neon Auth. Both are accepted while workspaces move to Neon Auth.
  */
 export function tokenVerifier(config) {
+    const platformKeys = remoteKeySet(config.segmentstreamUrl);
+    const human = makeTokenVerifier(config, platformKeys);
+    const workload = makeWorkloadTokenVerifier(config, platformKeys);
+    const platform = (token) => {
+        try {
+            return decodeProtectedHeader(token).typ === WORKLOAD_TOKEN_TYPE
+                ? workload(token)
+                : human(token);
+        }
+        catch {
+            return Promise.resolve({ status: "invalid" });
+        }
+    };
     const verifiers = new Map([
-        [
-            new URL(config.segmentstreamUrl).origin,
-            makeTokenVerifier(config, remoteKeySet(config.segmentstreamUrl)),
-        ],
+        [new URL(config.segmentstreamUrl).origin, platform],
     ]);
     if (config.neonAuth !== undefined) {
         verifiers.set(neonAuthIssuer(config.neonAuth.baseUrl), makeNeonAuthTokenVerifier(config.neonAuth, neonAuthKeySet(config.neonAuth.jwksUrl)));
@@ -337,6 +438,14 @@ export function authenticate(credential, verifyToken, options = {}) {
             }
         }
         const verification = yield* Effect.promise(() => verifyToken(token));
+        if (verification.status === "workload") {
+            const principal = backend.resolvePipelineWorker === undefined
+                ? undefined
+                : yield* backend.resolvePipelineWorker(verification.execution);
+            return principal === undefined
+                ? { status: "rejected" }
+                : { status: "authenticated", principal };
+        }
         if (verification.status !== "valid") {
             return verification.status === "invalid"
                 ? { status: "rejected" }

package/dist/service/catalog.d.ts

@@ -1,7 +1,8 @@
 import { type OntologyManifest } from "../manifest.js";
 /**
  * The catalog for a reader: the manifest, with each entity's actions narrowed to the ones the given
- * permissions may run. Without permissions it is the manifest itself.
+ * permissions may run, and only the measures of the model whose every input entity they may read.
+ * Without permissions it is the manifest itself.
  */
 export declare function catalogFor(manifest: OntologyManifest, permissions?: ReadonlyArray<string>): OntologyManifest;
 export interface GraphRelationship {

package/dist/service/catalog.js

@@ -1,16 +1,20 @@
 import { isValueMatched } from "../manifest.js";
 import { isAllowed } from "../permissions.js";
-import { actionPermission } from "../render.js";
+import { actionPermission, modelMeasuresFor } from "../render.js";
 /**
  * The catalog for a reader: the manifest, with each entity's actions narrowed to the ones the given
- * permissions may run. Without permissions it is the manifest itself.
+ * permissions may run, and only the measures of the model whose every input entity they may read.
+ * Without permissions it is the manifest itself.
  */
 export function catalogFor(manifest, permissions) {
     if (permissions === undefined) {
         return manifest;
     }
+    const { measures: declared, ...rest } = manifest;
+    const measures = declared === undefined ? [] : modelMeasuresFor(manifest, permissions);
     return {
-        ...manifest,
+        ...rest,
+        ...(measures.length === 0 ? {} : { measures }),
         entities: manifest.entities
             .filter((entity) => entity.source === undefined ||
             isAllowed(entity.permissions?.read ?? `${entity.name}:read`, { permissions }))

package/dist/service/config.d.ts

@@ -66,6 +66,10 @@ export interface OntologyEnvironment {
      * `segmentstreamUrl` for `workspaceId`; previews and local development have none.
      */
     readonly appCredential?: Redacted.Redacted<string>;
+    /** Production deployment identity; absent in local, preview and earlier deployments. */
+    readonly workloadTarget?: {
+        readonly deploymentId: string;
+    };
     /** Present once the workspace has Neon Auth: members then sign in with its tokens. */
     readonly neonAuth?: NeonAuthEnvironment;
     /**

package/dist/service/config.js

@@ -134,6 +134,13 @@ export function configFromEnv(environment = process.env) {
             message: `The ontology service cannot start: ${list} ${verb} not set.`,
         });
     }
+    const deploymentId = read("SEGMENTSTREAM_ONTOLOGY_DEPLOYMENT_ID");
+    if (deploymentId !== "" &&
+        !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(deploymentId)) {
+        throw new OntologyServiceConfigError({
+            message: "SEGMENTSTREAM_ONTOLOGY_DEPLOYMENT_ID must be a UUID.",
+        });
+    }
     const neonAuth = neonAuthFromEnv(read);
     const runtimeIdentity = runtimeIdentityFromEnv(read);
     const localConnections = localConnectionsFromEnv(environment);
@@ -163,6 +170,10 @@ export function configFromEnv(environment = process.env) {
         ...(read(APP_CREDENTIAL_VARIABLE)
             ? { appCredential: Redacted.make(read(APP_CREDENTIAL_VARIABLE)) }
             : {}),
+        ...(environment.VERCEL_ENV === "production" &&
+            read("SEGMENTSTREAM_ONTOLOGY_DEPLOYMENT_ID") !== ""
+            ? { workloadTarget: { deploymentId: read("SEGMENTSTREAM_ONTOLOGY_DEPLOYMENT_ID") } }
+            : {}),
         ...(neonAuth === undefined ? {} : { neonAuth }),
         ...(runtimeIdentity === undefined ? {} : { runtimeIdentity }),
         ...(runtimeIdentity === undefined || read(AGENT_HOST_VARIABLE) === ""