@segmentstream-cloud/ontology 0.22.0 → 0.24.0

package/dist/service/handlers.js

@@ -1,3 +1,4 @@
+import { effectivePermissions } from "../permissions.js";
 import { HttpServerResponse } from "effect/unstable/http";
 import { Effect, Layer, Schema } from "effect";
 import { HttpApiBuilder, OpenApi } from "effect/unstable/httpapi";
@@ -145,7 +146,7 @@ function serviceHandlers(built, operationsOf, aggregate) {
                 return undefined;
             }
             const principal = yield* CurrentPrincipal;
-            return principal.permissions;
+            return effectivePermissions(principal);
         });
         return handlers
             .handle("catalog", (request) => Effect.map(permissionsFor(request.query.as), (permissions) => catalogFor(manifest, permissions)))

package/dist/service/mcp/server.js

@@ -1,3 +1,4 @@
+import { effectivePermissions } from "../../permissions.js";
 import { Cause, Data, Effect, Layer, Option, Schema, SchemaTransformation } from "effect";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
 import { HttpApiBuilder, HttpApiSecurity } from "effect/unstable/httpapi";
@@ -7,7 +8,7 @@ import { SCOPE_MISMATCH } from "../aggregate-platform.js";
 import { CurrentPrincipal, withPrincipal } from "../authentication.js";
 import { catalogFor } from "../catalog.js";
 import { ConversationSearch } from "../agent/conversations.js";
-import { describeCatalog, measureDescription, measuresFor, RECORDS_OR_AGGREGATES, } from "../../render.js";
+import { describeCatalog, measureDescription, measuresFor, modelMeasureDescription, modelMeasuresFor, RECORDS_OR_AGGREGATES, } from "../../render.js";
 import { RequestId, errorBodyForWire, expectedFailure, internalError, schemaIssues, } from "../errors.js";
 import { publicOrigin } from "../oauth/protocol.js";
 import { mcpChallenge, mcpResource } from "../oauth/server.js";
@@ -175,7 +176,7 @@ function runTool({ built, operations, aggregate, conversations }, tool, args, re
             case "describe": {
                 const principal = yield* CurrentPrincipal;
                 return {
-                    text: describeCatalog(built.plan.ontology.manifest, principal.permissions),
+                    text: describeCatalog(built.plan.ontology.manifest, effectivePermissions(principal)),
                 };
             }
             case "aggregate": {
@@ -285,7 +286,7 @@ function readResource({ built }, uri) {
                     {
                         uri,
                         mimeType: "application/json",
-                        text: JSON.stringify(encodeManifest(catalogFor(manifest, principal.permissions))),
+                        text: JSON.stringify(encodeManifest(catalogFor(manifest, effectivePermissions(principal)))),
                     },
                 ];
             case DESCRIBE_URI:
@@ -293,7 +294,7 @@ function readResource({ built }, uri) {
                     {
                         uri,
                         mimeType: "text/plain",
-                        text: describeCatalog(manifest, principal.permissions),
+                        text: describeCatalog(manifest, effectivePermissions(principal)),
                     },
                 ];
             default:
@@ -313,7 +314,10 @@ function instructions({ built }, permissions) {
         return (definition.source === undefined && isAllowed(permissionOf(name, READ_VERB), { permissions }));
     })
         .map(({ name, resolved }) => `- ${name}: ${resolved.entity.definition.description}`);
-    const measures = measuresFor(manifest, permissions).map(({ name, entity, measure }) => `- ${name}: ${measureDescription(entity, measure)}`);
+    const measures = [
+        ...measuresFor(manifest, permissions).map(({ name, entity, measure }) => `- ${name}: ${measureDescription(entity, measure)}`),
+        ...modelMeasuresFor(manifest, permissions).map((measure) => `- ${measure.name}: ${modelMeasureDescription(measure)}`),
+    ];
     return [
         "This server is the app's ontology: the records the company works with and the actions " +
             "that change them. Every change goes through an action, is checked against your " +
@@ -351,7 +355,7 @@ function dispatch(server, message, request) {
                         title: "Ontology",
                         version: server.built.plan.ontology.manifest.hash,
                     },
-                    instructions: instructions(server, principal.permissions),
+                    instructions: instructions(server, effectivePermissions(principal)),
                 });
             case "ping":
                 return rpcResult(id, {});

package/dist/service/mcp/tools.js

@@ -1,11 +1,11 @@
 import { Schema } from "effect";
 import { AGGREGATE_NAME_PATTERN } from "../../aggregate-routes.js";
 import { InvalidOntology } from "../../diagnostics.js";
-import { isValueMatched } from "../../manifest.js";
+import { isValueMatched, } from "../../manifest.js";
 import { GENERATED_UPSERT_PREFIX, humanize, mcpToolName } from "../../names.js";
 import { isAllowed, permissionOf, READ_VERB } from "../../permissions.js";
 import { queryJsonSchema } from "../../query.js";
-import { measureDescription, measuresFor, RECORDS_OR_AGGREGATES, } from "../../render.js";
+import { measureDescription, measuresFor, modelMeasureDescription, modelMeasuresFor, RECORDS_OR_AGGREGATES, } from "../../render.js";
 import { actionInputJsonSchema } from "../../runtime/generated-actions.js";
 import { uploadFields } from "../../storage/attachments.js";
 import { actionDescription, requires } from "../descriptions.js";
@@ -281,8 +281,15 @@ function measureChoice({ name, entity, measure }) {
             measureDescription(entity, measure),
     };
 }
+/** A measure of the model, by its bare name, read only by a caller who may read every input. */
+function modelMeasureChoice(measure) {
+    return {
+        const: measure.name,
+        description: `Model · ${measure.label} (${measure.unit}): ` + modelMeasureDescription(measure),
+    };
+}
 /** The aggregate tool's input for a caller: the request of `POST /api/ontology/aggregate`. */
-function aggregateInput(measures) {
+function aggregateInput({ measures, model }) {
     return {
         type: "object",
         properties: {
@@ -291,9 +298,11 @@ function aggregateInput(measures) {
                 minItems: 1,
                 maxItems: AGGREGATE_LIMITS.measures,
                 uniqueItems: true,
-                items: { anyOf: measures.map(measureChoice) },
-                description: "What to compute, as <entity>.<measure>. Measures of several entities are each " +
-                    "computed over their own entity's rows, then combined on the dimensions.",
+                items: { anyOf: [...measures.map(measureChoice), ...model.map(modelMeasureChoice)] },
+                description: "What to compute, as <entity>.<measure>, or a measure of the model by its name. " +
+                    "Measures of several entities are each computed over their own entity's rows, then " +
+                    "combined on the dimensions; a measure of the model is computed on the combined rows " +
+                    "from the entity measures it reads.",
             },
             dimensions: {
                 type: "array",
@@ -385,17 +394,23 @@ const AGGREGATE_DESCRIPTION = "Numbers about the model: measures from one or sev
     "which dates were used. " +
     "Answers come from the warehouse, and stored records from its replica: execution.sources says " +
     "how fresh each is, and execution.warnings says when a filter did not apply to a measure. " +
-    "Requires reading every entity the request reads, path intermediates included. Call describe " +
-    "for the model's measures and relationships.";
+    "Requires reading every entity the request reads, path intermediates included, and every " +
+    "entity a measure of the model reads. A measure of the model is named without an entity; a " +
+    "filter must reach every entity it reads or none of them, unless its alignment gives an entity " +
+    "no counterpart. Call describe for the model's measures and relationships.";
 function aggregateTool(manifest) {
     return {
         name: "aggregate",
         title: "Aggregate measures",
         description: AGGREGATE_DESCRIPTION,
-        inputSchema: aggregateInput(measuresFor(manifest)),
+        inputSchema: aggregateInput({
+            measures: measuresFor(manifest),
+            model: modelMeasuresFor(manifest),
+        }),
         inputSchemaFor: (caller) => {
             const measures = measuresFor(manifest, caller.permissions);
-            return measures.length === 0 ? undefined : aggregateInput(measures);
+            const model = modelMeasuresFor(manifest, caller.permissions);
+            return measures.length === 0 ? undefined : aggregateInput({ measures, model });
         },
         annotations: READ,
         permissions: [],

package/dist/service/operations.d.ts

@@ -74,19 +74,39 @@ export declare function makeOperations(backend: Backend, plan: ApiPlan, hooks: R
         readonly after?: string;
         readonly limit?: number;
     }) => Effect.Effect<QueryResult<{
+        readonly at: string;
         readonly id: string;
-        readonly recordId: string;
-        readonly action: string;
-        readonly actionId: string;
         readonly kind: "create" | "update" | "delete" | "link" | "unlink";
-        readonly principalId: string | null;
-        readonly at: string;
+        readonly action: string;
         readonly changes: {
             readonly [x: string]: {
                 readonly before: import("effect/Schema").Json;
                 readonly after: import("effect/Schema").Json;
             };
         };
+        readonly principalId: string | null;
+        readonly recordId: string;
+        readonly actionId: string;
+        readonly execution?: {
+            readonly issuer: string;
+            readonly audience: string;
+            readonly organizationId: string;
+            readonly workspaceId: string;
+            readonly subject: string;
+            readonly deploymentId: string;
+            readonly ontologyDeploymentId: string;
+            readonly servingOntologyDeploymentId: string;
+            readonly ontologyOrigin: string;
+            readonly environment: "production";
+            readonly jobName: string;
+            readonly runId: string;
+            readonly executionId: string | null;
+            readonly attemptId: string;
+            readonly generation: number;
+            readonly tokenId: string;
+            readonly issuedAt: number;
+            readonly expiresAt: number;
+        } | undefined;
     }>, PermissionDenied | import("../errors.js").NotFound | import("../index.js").InvalidQuery, CurrentPrincipal>;
     /** The records a relationship reaches from one record, as a page of the target entity. */
     traverse: (planned: PlannedEntity, traversal: Traversal, id: string, query: Query) => Effect.Effect<QueryResult<Readonly<Record<string, unknown>>>, PermissionDenied | import("../errors.js").NotFound | import("../index.js").InvalidQuery, CurrentPrincipal>;

package/dist/service/runtime-contract.d.ts

@@ -274,6 +274,7 @@ declare const OntologyBackend_base: Context.ServiceClass<OntologyBackend, "@segm
      * Finds, links or creates the member's user. `undefined` when the user may not sign in, and
      * {@link NotInvited} when the sign-in policy turns away a person nobody invited.
      */
+    readonly resolvePipelineWorker?: (execution: import("../runtime/workload.js").WorkloadExecution) => Effect.Effect<Principal | undefined>;
     readonly resolvePrincipal: (identity: SignInIdentity) => Effect.Effect<Principal | undefined, NotInvited>;
     /**
      * Whether a person may sign in with this address, and how, read before the app emails them.

package/dist/service/schemas.d.ts

@@ -40,6 +40,26 @@ export declare const Validation: Schema.Struct<{
     }>>;
 }>;
 export declare const HistoryEntry: Schema.decodeTo<Schema.Struct<{
+    readonly execution: Schema.optionalKey<Schema.Struct<{
+        readonly issuer: Schema.String;
+        readonly audience: Schema.String;
+        readonly organizationId: Schema.String;
+        readonly workspaceId: Schema.String;
+        readonly subject: Schema.String;
+        readonly deploymentId: Schema.String;
+        readonly ontologyDeploymentId: Schema.String;
+        readonly servingOntologyDeploymentId: Schema.String;
+        readonly ontologyOrigin: Schema.String;
+        readonly environment: Schema.Literal<"production">;
+        readonly jobName: Schema.String;
+        readonly runId: Schema.String;
+        readonly executionId: Schema.NullOr<Schema.String>;
+        readonly attemptId: Schema.String;
+        readonly generation: Schema.Number;
+        readonly tokenId: Schema.String;
+        readonly issuedAt: Schema.Number;
+        readonly expiresAt: Schema.Number;
+    }>>;
     readonly id: Schema.String;
     readonly recordId: Schema.String;
     readonly action: Schema.String;
@@ -52,6 +72,26 @@ export declare const HistoryEntry: Schema.decodeTo<Schema.Struct<{
         readonly after: Schema.Codec<Schema.Json, Schema.Json, never, never>;
     }>>;
 }>, Schema.Struct<{
+    readonly execution: Schema.toEncoded<Schema.optionalKey<Schema.Struct<{
+        readonly issuer: Schema.String;
+        readonly audience: Schema.String;
+        readonly organizationId: Schema.String;
+        readonly workspaceId: Schema.String;
+        readonly subject: Schema.String;
+        readonly deploymentId: Schema.String;
+        readonly ontologyDeploymentId: Schema.String;
+        readonly servingOntologyDeploymentId: Schema.String;
+        readonly ontologyOrigin: Schema.String;
+        readonly environment: Schema.Literal<"production">;
+        readonly jobName: Schema.String;
+        readonly runId: Schema.String;
+        readonly executionId: Schema.NullOr<Schema.String>;
+        readonly attemptId: Schema.String;
+        readonly generation: Schema.Number;
+        readonly tokenId: Schema.String;
+        readonly issuedAt: Schema.Number;
+        readonly expiresAt: Schema.Number;
+    }>>>;
     readonly id: Schema.toEncoded<Schema.String>;
     readonly record_id: Schema.toEncoded<Schema.String>;
     readonly action: Schema.toEncoded<Schema.String>;
@@ -66,6 +106,26 @@ export declare const HistoryEntry: Schema.decodeTo<Schema.Struct<{
 }>, never, never>;
 export declare const HistoryPage: Schema.decodeTo<Schema.Struct<{
     readonly items: Schema.$Array<Schema.decodeTo<Schema.Struct<{
+        readonly execution: Schema.optionalKey<Schema.Struct<{
+            readonly issuer: Schema.String;
+            readonly audience: Schema.String;
+            readonly organizationId: Schema.String;
+            readonly workspaceId: Schema.String;
+            readonly subject: Schema.String;
+            readonly deploymentId: Schema.String;
+            readonly ontologyDeploymentId: Schema.String;
+            readonly servingOntologyDeploymentId: Schema.String;
+            readonly ontologyOrigin: Schema.String;
+            readonly environment: Schema.Literal<"production">;
+            readonly jobName: Schema.String;
+            readonly runId: Schema.String;
+            readonly executionId: Schema.NullOr<Schema.String>;
+            readonly attemptId: Schema.String;
+            readonly generation: Schema.Number;
+            readonly tokenId: Schema.String;
+            readonly issuedAt: Schema.Number;
+            readonly expiresAt: Schema.Number;
+        }>>;
         readonly id: Schema.String;
         readonly recordId: Schema.String;
         readonly action: Schema.String;
@@ -78,6 +138,26 @@ export declare const HistoryPage: Schema.decodeTo<Schema.Struct<{
             readonly after: Schema.Codec<Schema.Json, Schema.Json, never, never>;
         }>>;
     }>, Schema.Struct<{
+        readonly execution: Schema.toEncoded<Schema.optionalKey<Schema.Struct<{
+            readonly issuer: Schema.String;
+            readonly audience: Schema.String;
+            readonly organizationId: Schema.String;
+            readonly workspaceId: Schema.String;
+            readonly subject: Schema.String;
+            readonly deploymentId: Schema.String;
+            readonly ontologyDeploymentId: Schema.String;
+            readonly servingOntologyDeploymentId: Schema.String;
+            readonly ontologyOrigin: Schema.String;
+            readonly environment: Schema.Literal<"production">;
+            readonly jobName: Schema.String;
+            readonly runId: Schema.String;
+            readonly executionId: Schema.NullOr<Schema.String>;
+            readonly attemptId: Schema.String;
+            readonly generation: Schema.Number;
+            readonly tokenId: Schema.String;
+            readonly issuedAt: Schema.Number;
+            readonly expiresAt: Schema.Number;
+        }>>>;
         readonly id: Schema.toEncoded<Schema.String>;
         readonly record_id: Schema.toEncoded<Schema.String>;
         readonly action: Schema.toEncoded<Schema.String>;
@@ -93,6 +173,26 @@ export declare const HistoryPage: Schema.decodeTo<Schema.Struct<{
     readonly nextCursor: Schema.NullOr<Schema.String>;
 }>, Schema.Struct<{
     readonly items: Schema.toEncoded<Schema.$Array<Schema.decodeTo<Schema.Struct<{
+        readonly execution: Schema.optionalKey<Schema.Struct<{
+            readonly issuer: Schema.String;
+            readonly audience: Schema.String;
+            readonly organizationId: Schema.String;
+            readonly workspaceId: Schema.String;
+            readonly subject: Schema.String;
+            readonly deploymentId: Schema.String;
+            readonly ontologyDeploymentId: Schema.String;
+            readonly servingOntologyDeploymentId: Schema.String;
+            readonly ontologyOrigin: Schema.String;
+            readonly environment: Schema.Literal<"production">;
+            readonly jobName: Schema.String;
+            readonly runId: Schema.String;
+            readonly executionId: Schema.NullOr<Schema.String>;
+            readonly attemptId: Schema.String;
+            readonly generation: Schema.Number;
+            readonly tokenId: Schema.String;
+            readonly issuedAt: Schema.Number;
+            readonly expiresAt: Schema.Number;
+        }>>;
         readonly id: Schema.String;
         readonly recordId: Schema.String;
         readonly action: Schema.String;
@@ -105,6 +205,26 @@ export declare const HistoryPage: Schema.decodeTo<Schema.Struct<{
             readonly after: Schema.Codec<Schema.Json, Schema.Json, never, never>;
         }>>;
     }>, Schema.Struct<{
+        readonly execution: Schema.toEncoded<Schema.optionalKey<Schema.Struct<{
+            readonly issuer: Schema.String;
+            readonly audience: Schema.String;
+            readonly organizationId: Schema.String;
+            readonly workspaceId: Schema.String;
+            readonly subject: Schema.String;
+            readonly deploymentId: Schema.String;
+            readonly ontologyDeploymentId: Schema.String;
+            readonly servingOntologyDeploymentId: Schema.String;
+            readonly ontologyOrigin: Schema.String;
+            readonly environment: Schema.Literal<"production">;
+            readonly jobName: Schema.String;
+            readonly runId: Schema.String;
+            readonly executionId: Schema.NullOr<Schema.String>;
+            readonly attemptId: Schema.String;
+            readonly generation: Schema.Number;
+            readonly tokenId: Schema.String;
+            readonly issuedAt: Schema.Number;
+            readonly expiresAt: Schema.Number;
+        }>>>;
         readonly id: Schema.toEncoded<Schema.String>;
         readonly record_id: Schema.toEncoded<Schema.String>;
         readonly action: Schema.toEncoded<Schema.String>;
@@ -259,6 +379,7 @@ export declare const Catalog: Schema.decodeTo<Schema.Struct<{
     }>, {
         readonly builtIn: "built_in";
     }>>;
+    readonly runtimeCapabilities: Schema.optionalKey<Schema.$Array<Schema.String>>;
     readonly version: Schema.Int;
     readonly hash: Schema.String;
     readonly signIn: Schema.optionalKey<Schema.Struct<{
@@ -268,6 +389,16 @@ export declare const Catalog: Schema.decodeTo<Schema.Struct<{
         readonly key: Schema.String;
         readonly description: Schema.String;
     }>>>;
+    readonly measures: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly label: Schema.String;
+        readonly description: Schema.String;
+        readonly unit: Schema.Literals<readonly ["number", "currency", "ratio", "percent"]>;
+        readonly format: Schema.Literals<readonly ["decimal", "currency", "percent"]>;
+        readonly expression: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+        readonly inputs: Schema.$Array<Schema.String>;
+        readonly align: Schema.$Array<Schema.$Record<Schema.String, Schema.NullOr<Schema.String>>>;
+    }>>>;
 }>, Schema.Struct<{
     readonly entities: Schema.toEncoded<Schema.$Array<Schema.encodeKeys<Schema.Struct<{
         readonly measures: Schema.optionalKey<Schema.$Array<Schema.encodeKeys<Schema.Struct<{
@@ -378,6 +509,7 @@ export declare const Catalog: Schema.decodeTo<Schema.Struct<{
     }>, {
         readonly builtIn: "built_in";
     }>>>;
+    readonly runtimeCapabilities: Schema.toEncoded<Schema.optionalKey<Schema.$Array<Schema.String>>>;
     readonly version: Schema.toEncoded<Schema.Int>;
     readonly hash: Schema.toEncoded<Schema.String>;
     readonly sign_in: Schema.toEncoded<Schema.optionalKey<Schema.Struct<{
@@ -387,6 +519,16 @@ export declare const Catalog: Schema.decodeTo<Schema.Struct<{
         readonly key: Schema.String;
         readonly description: Schema.String;
     }>>>>;
+    readonly measures: Schema.toEncoded<Schema.optionalKey<Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly label: Schema.String;
+        readonly description: Schema.String;
+        readonly unit: Schema.Literals<readonly ["number", "currency", "ratio", "percent"]>;
+        readonly format: Schema.Literals<readonly ["decimal", "currency", "percent"]>;
+        readonly expression: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+        readonly inputs: Schema.$Array<Schema.String>;
+        readonly align: Schema.$Array<Schema.$Record<Schema.String, Schema.NullOr<Schema.String>>>;
+    }>>>>;
 }>, never, never>;
 export declare const Graph: Schema.Struct<{
     readonly hash: Schema.String;
@@ -505,6 +647,7 @@ export declare const AggregateResult: Schema.Struct<{
         readonly additive: Schema.optionalKey<Schema.Boolean>;
         readonly filters: Schema.optionalKey<Schema.$Array<Schema.String>>;
         readonly balanceOver: Schema.optionalKey<Schema.String>;
+        readonly inputs: Schema.optionalKey<Schema.$Array<Schema.String>>;
     }>>;
     readonly rows: Schema.$Array<Schema.$Record<Schema.String, Schema.NullOr<Schema.Union<readonly [Schema.String, Schema.Boolean]>>>>;
     readonly truncated: Schema.Boolean;

package/dist/service/schemas.js

@@ -366,7 +366,10 @@ const aggregateFields = {
 export const AggregateRequest = closedStruct({
     measures: Schema.Array(Schema.String)
         .check(Schema.isMaxLength(AGGREGATE_LIMITS.measures))
-        .annotate({ description: "<entity>.<measure>, at least one." }),
+        .annotate({
+        description: "<entity>.<measure>, or a measure of the model by its name, such as plan_attainment; " +
+            "at least one, at most 30 of both together.",
+    }),
     dimensions: Schema.optionalKey(Schema.Array(Schema.String).check(Schema.isMaxLength(AGGREGATE_LIMITS.dimensions))).annotate({
         description: "<entity>.<property>, or a route from a measure's entity: " +
             "<entity>.<relationship>[.<relationship>].<property>.",
@@ -408,7 +411,9 @@ export const EntityAggregateRequest = closedStruct({
 /** SegmentStream's answer to an aggregate, which the service forwards unchanged. */
 export const AggregateResult = Schema.Struct({
     fields: Schema.Array(Schema.Struct({
-        name: Schema.String.annotate({ description: "A dimension identity or <entity>.<measure>." }),
+        name: Schema.String.annotate({
+            description: "A dimension identity, <entity>.<measure>, or the name of a measure of the model.",
+        }),
         label: Schema.String,
         type: Schema.String,
         unit: Schema.optionalKey(Schema.String),
@@ -425,6 +430,10 @@ export const AggregateResult = Schema.Struct({
             description: "The date or timestamp dimension a balance measure was grouped by or filtered to one " +
                 "day of.",
         }),
+        inputs: Schema.optionalKey(Schema.Array(Schema.String)).annotate({
+            description: "The entity measures a measure of the model reads, <entity>.<measure>, in declaration " +
+                "order; present only on such a measure.",
+        }),
     })),
     rows: Schema.Array(Schema.Record(Schema.String, Schema.NullOr(Schema.Union([Schema.String, Schema.Boolean])))),
     truncated: Schema.Boolean,

package/dist/storage/attachments.js

@@ -128,7 +128,7 @@ export function attachmentRuntime(ontology, sql, provider) {
             ]);
         }
         // The member must still be active; a deactivated member's agent reads nothing.
-        yield* authorizeBlobOperation(ontology, sql, caller.principal.id, []);
+        yield* authorizeBlobOperation(ontology, sql, caller.principal.id, [], caller.principal.execution);
         return row;
     });
     /**
@@ -154,7 +154,7 @@ export function attachmentRuntime(ontology, sql, provider) {
             });
         }
         const reserved = yield* sql.withTransaction(Effect.gen(function* () {
-            yield* authorizeBlobOperation(ontology, sql, caller.principal.id, []);
+            yield* authorizeBlobOperation(ontology, sql, caller.principal.id, [], caller.principal.execution);
             yield* sql.unsafe(`SELECT pg_advisory_xact_lock(818724)`);
             const [existing] = yield* sql.unsafe(`SELECT id::text FROM "${ATTACHMENTS_TABLE}"
              WHERE owner_id = $1::uuid AND conversation = $2 AND source_ref = $3`, [caller.principal.id, caller.conversation, input.sourceRef]);
@@ -272,7 +272,7 @@ export function attachmentRuntime(ontology, sql, provider) {
     });
     /** The caller's attachments in this chat and session that are still readable, newest first. */
     const list = (caller) => sql.withTransaction(Effect.gen(function* () {
-        yield* authorizeBlobOperation(ontology, sql, caller.principal.id, []);
+        yield* authorizeBlobOperation(ontology, sql, caller.principal.id, [], caller.principal.execution);
         const rows = yield* sql.unsafe(`${SELECT} WHERE a.owner_id = $1::uuid AND a.conversation = $2 AND a.branch_id = $3
              AND a.state IN ('ready', 'promoted') AND a.expires_at > now()
              AND (a.session_id IS NULL OR a.session_id = $4)
@@ -365,7 +365,7 @@ export function attachmentRuntime(ontology, sql, provider) {
                         `${row.content_type}, ${row.size} bytes.`,
                 });
             }
-            yield* authorizeBlobOperation(ontology, sql, caller.principal.id, found.permissions);
+            yield* authorizeBlobOperation(ontology, sql, caller.principal.id, found.permissions, caller.principal.execution);
             const [earlier] = yield* sql.unsafe(`SELECT id::text, promotion FROM "${ATTACHMENTS_TABLE}"
              WHERE sha256 = $1 AND branch_id = $2 AND state = 'promoted' AND id <> $3::uuid
                AND promotion->>'action' = $4 AND promotion->>'deduplicated_from' IS NULL

package/dist/storage/authorization.d.ts

@@ -5,4 +5,4 @@ import { PermissionDenied } from "../errors.js";
 /** Re-read user and roles in the same transaction that authorizes a storage operation. */
 export declare function authorizeBlobOperation(ontology: Ontology, sql: {
     readonly unsafe: (text: string, args: ReadonlyArray<unknown>) => Effect.Effect<ReadonlyArray<Readonly<Record<string, unknown>>>, SqlError>;
-}, principalId: string, required: ReadonlyArray<string>): Effect.Effect<undefined, PermissionDenied | SqlError, never>;
+}, principalId: string, required: ReadonlyArray<string>, execution?: import("../runtime/workload.js").WorkloadExecution): Effect.Effect<undefined, PermissionDenied | SqlError, never>;

package/dist/storage/authorization.js

@@ -2,7 +2,7 @@ import { Effect } from "effect";
 import { missingPermission, permissionsOf } from "../permissions.js";
 import { PermissionDenied } from "../errors.js";
 /** Re-read user and roles in the same transaction that authorizes a storage operation. */
-export function authorizeBlobOperation(ontology, sql, principalId, required) {
+export function authorizeBlobOperation(ontology, sql, principalId, required, execution) {
     return Effect.gen(function* () {
         const [catalog] = yield* sql.unsafe(`SELECT hash FROM "_ontology" WHERE id = true FOR SHARE`, []);
         if (catalog?.hash !== ontology.manifest.hash) {
@@ -10,17 +10,22 @@ export function authorizeBlobOperation(ontology, sql, principalId, required) {
                 message: "The deployed ontology no longer matches the database catalog.",
             });
         }
-        const users = yield* sql.unsafe(`SELECT kind::text, active FROM "user" WHERE id = $1::uuid FOR SHARE`, [principalId]);
+        const users = yield* sql.unsafe(`SELECT kind::text, active, identity_provider, identity_subject FROM "user" WHERE id = $1::uuid FOR SHARE`, [principalId]);
         const user = users[0];
         const roles = yield* sql.unsafe(`SELECT role FROM "_user_roles" WHERE user_id = $1::uuid FOR SHARE`, [principalId]);
         const held = roles.map((row) => String(row.role));
         if (user?.kind === "member") {
             held.push("member");
         }
+        const worker = execution !== undefined &&
+            user?.kind === "service" &&
+            user.identity_provider === "segmentstream-ontology-workload" &&
+            user.identity_subject === `pipeline-workers:${execution.workspaceId}`;
         const missing = missingPermission(required, {
-            permissions: permissionsOf(ontology.roles, held),
+            ...(worker ? { execution } : {}),
+            permissions: worker ? ["*:*"] : permissionsOf(ontology.roles, held),
         });
-        if (!user?.active || missing) {
+        if (!user?.active || missing || (execution !== undefined && !worker)) {
             return yield* new PermissionDenied({
                 message: "The member cannot use this file operation.",
                 ...(missing ? { permission: missing } : {}),

package/dist/storage/sessions.js

@@ -98,7 +98,7 @@ export function blobRuntime(ontology, sql, provider) {
         if (!found || row.manifest_hash !== ontology.manifest.hash) {
             return yield* conflict();
         }
-        yield* authorizeBlobOperation(ontology, sql, principal.id, found.permissions);
+        yield* authorizeBlobOperation(ontology, sql, principal.id, found.permissions, principal.execution);
         return row;
     });
     const begin = (input, principal) => Effect.gen(function* () {
@@ -129,7 +129,7 @@ export function blobRuntime(ontology, sql, provider) {
         const claim = randomUUID();
         const key = `revisions/${blobId}`;
         const reservation = yield* sql.withTransaction(Effect.gen(function* () {
-            yield* authorizeBlobOperation(ontology, sql, principal.id, found.permissions);
+            yield* authorizeBlobOperation(ontology, sql, principal.id, found.permissions, principal.execution);
             if (input.recordId) {
                 yield* makeOntologyRuntime(ontology, sql).get({
                     entity: input.entity,
@@ -310,7 +310,7 @@ export function blobRuntime(ontology, sql, provider) {
             });
         }
         const blob = yield* sql.withTransaction(Effect.gen(function* () {
-            yield* authorizeBlobOperation(ontology, sql, principal.id, [`${entityName}:read`]);
+            yield* authorizeBlobOperation(ontology, sql, principal.id, [`${entityName}:read`], principal.execution);
             let revisionId = input.revisionId;
             if (!revisionId) {
                 const record = yield* makeOntologyRuntime(ontology, sql).get({

package/dist/storage/writes.js

@@ -39,7 +39,7 @@ export function resolveBlobWrites(context, entity, recordId, values, creating) {
                     }
                     return context.run(statement, params);
                 },
-            }, context.scope.principalId, authored ? [authored.permission] : generatedActionPermissions(actionEntity, actionName)).pipe(Effect.catchTag("PermissionDenied", () => Effect.fail(reject())));
+            }, context.scope.principalId, authored ? [authored.permission] : generatedActionPermissions(actionEntity, actionName), context.scope.execution).pipe(Effect.catchTag("PermissionDenied", () => Effect.fail(reject())));
             const params = new Params();
             const rows = yield* context.run(`SELECT u.*, b.id::text AS blob_id, b.filename, b.content_type, b.size::text AS size,
           to_char(b.created_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS created_at

package/dist/warehouse-backed.js

@@ -253,6 +253,10 @@ function checkMeasures(input) {
             !["decimal", "currency", "percent"].includes(measure.format)) {
             report("invalid-measure", field, "Invalid measure format.");
         }
+        if (measure.align !== undefined) {
+            report("invalid-measure", field, "Entity measures take no align; a measure that aligns the properties of several " +
+                "entities belongs in defineOntology({ measures }).");
+        }
         let remaining = 10_000;
         /** The balance properties of the measure's aggregates and of the measures it references. */
         const balances = new Set();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@segmentstream-cloud/ontology",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "Define a SegmentStream workspace app's ontology: entities, relationships, roles and actions, written with Effect.",
   "license": "Apache-2.0",
   "author": "SegmentStream",