@segmentstream-cloud/ontology 0.23.0 → 0.24.0

package/dist/index.d.ts

@@ -53,6 +53,7 @@ export { makeOntologyRuntime } from "./runtime/sql-runtime.js";
 export type { SqlOntologyRuntime, WriteScope } from "./runtime/sql-runtime.js";
 export { BASE_PATH, deriveApi } from "./service/api.js";
 export type { DeriveApiOptions, OntologyApi } from "./service/api.js";
+export { WorkloadExecution } from "./runtime/workload.js";
 export { CurrentPrincipal } from "./service/authentication.js";
 export { deployedConnections, LocalConnectionContextError, localConnections, OIDC_TOKEN_HEADER, parseLocalConnectionContext, readLocalConnectionContext, RUNTIME_CONTEXT_FD, } from "./service/connections.js";
 export type { ConnectionAudit, ConnectionTransportFactory, LocalConnection, LocalConnectionContext, } from "./service/connections.js";

package/dist/index.js

@@ -31,6 +31,7 @@ export { backendLayer, postgresLayer, sqlServiceRuntime } from "./runtime/servic
 export { makeOntologyRuntime } from "./runtime/sql-runtime.js";
 // The HTTP service derived from the ontology.
 export { BASE_PATH, deriveApi } from "./service/api.js";
+export { WorkloadExecution } from "./runtime/workload.js";
 export { CurrentPrincipal } from "./service/authentication.js";
 export { deployedConnections, LocalConnectionContextError, localConnections, OIDC_TOKEN_HEADER, parseLocalConnectionContext, readLocalConnectionContext, RUNTIME_CONTEXT_FD, } from "./service/connections.js";
 export { configFromEnv, AGENT_HOST_VARIABLE, ENVIRONMENT_VARIABLES, NEON_AUTH_ENVIRONMENT_VARIABLES, OntologyServiceConfigError, RUNTIME_IDENTITY_ENVIRONMENT_VARIABLES, } from "./service/config.js";

package/dist/manifest.d.ts

@@ -449,6 +449,7 @@ export declare const OntologyManifestWire: Schema.encodeKeys<Schema.Struct<{
     }>, {
         readonly builtIn: "built_in";
     }>>;
+    readonly runtimeCapabilities: Schema.optionalKey<Schema.$Array<Schema.String>>;
     readonly version: Schema.Int;
     /** `sha256:` and the hex digest of the canonical JSON of the manifest without `hash`. */
     readonly hash: Schema.String;
@@ -619,6 +620,7 @@ export declare const OntologyManifest: Schema.Union<readonly [Schema.encodeKeys<
     }>, {
         readonly builtIn: "built_in";
     }>>;
+    readonly runtimeCapabilities: Schema.optionalKey<Schema.$Array<Schema.String>>;
     readonly version: Schema.Int;
     /** `sha256:` and the hex digest of the canonical JSON of the manifest without `hash`. */
     readonly hash: Schema.String;
@@ -653,6 +655,7 @@ export declare const OntologyManifest: Schema.Union<readonly [Schema.encodeKeys<
 }>, {
     readonly signIn: "sign_in";
 }>, Schema.Struct<{
+    readonly runtimeCapabilities: Schema.optionalKey<Schema.$Array<Schema.String>>;
     readonly version: Schema.Int;
     /** `sha256:` and the hex digest of the canonical JSON of the manifest without `hash`. */
     readonly hash: Schema.String;
@@ -929,6 +932,7 @@ export declare const decodeManifestDocument: (value: unknown) => Effect.Effect<{
         readonly key: string;
         readonly description: string;
     }[] | undefined;
+    readonly runtimeCapabilities?: readonly string[] | undefined;
     readonly signIn?: {
         readonly policy: string;
     } | undefined;
@@ -1047,6 +1051,7 @@ export declare const decodeManifestDocument: (value: unknown) => Effect.Effect<{
         readonly key: string;
         readonly description: string;
     }[] | undefined;
+    readonly runtimeCapabilities?: readonly string[] | undefined;
     readonly signIn?: {
         readonly policy: string;
     } | undefined;

package/dist/manifest.js

@@ -213,6 +213,7 @@ export const SignInManifest = Schema.Struct({
  * `onDelete`) are validated because the migration planner must map every value to storage.
  */
 const OntologyManifestModel = Schema.Struct({
+    runtimeCapabilities: Schema.optionalKey(Schema.Array(Schema.String)),
     version: Schema.Int,
     /** `sha256:` and the hex digest of the canonical JSON of the manifest without `hash`. */
     hash: Schema.String,
@@ -462,6 +463,7 @@ export function buildManifest(input) {
         .map((candidate) => candidate.name));
     const body = {
         version: MANIFEST_VERSION,
+        runtimeCapabilities: ["pipeline-workload-tokens-v1"],
         entities: input.entities.map((candidate) => entityManifest({ resolved: candidate, warehouseBacked })),
         roles: input.roles.map((candidate) => ({
             name: candidate.name,

package/dist/migrate/apply.js

@@ -7,7 +7,7 @@ import { REPLICATION_DDL, REPLICATION_SCHEMA_VERSION, replicationEntityDdl, } fr
 import { replicationMigrationRefusals } from "../replication/migrate.js";
 import { ATTACHMENTS_TABLE } from "../storage/tables.js";
 import { resolveReplicationSelection, } from "../replication/model.js";
-import { AGENT_TABLES, API_KEYS_TABLE, CATALOG_TABLE, OAUTH_TABLES, USER_ROLES_TABLE, quoteIdentifier, quoteLiteral, } from "./storage.js";
+import { ACTION_ATTRIBUTION_TABLE, AGENT_TABLES, API_KEYS_TABLE, CATALOG_TABLE, OAUTH_TABLES, USER_ROLES_TABLE, quoteIdentifier, quoteLiteral, } from "./storage.js";
 const CATALOG = quoteIdentifier(CATALOG_TABLE);
 /** Serializes migrations of one database; transaction-scoped, so it ends with the transaction. */
 const MIGRATION_LOCK = "segmentstream.ontology.migration";
@@ -180,6 +180,7 @@ export const applyMigration = (plan, options) => Effect.gen(function* () {
  */
 /** The runtime's tables, beside the catalog and the entity tables. */
 export const RUNTIME_TABLES = [
+    ACTION_ATTRIBUTION_TABLE,
     USER_ROLES_TABLE,
     API_KEYS_TABLE,
     ...OAUTH_TABLES,

package/dist/migrate/model.d.ts

@@ -152,6 +152,7 @@ export declare const MigrationPlan: Schema.Struct<{
         }>, {
             readonly builtIn: "built_in";
         }>>;
+        readonly runtimeCapabilities: Schema.optionalKey<Schema.$Array<Schema.String>>;
         readonly version: Schema.Int;
         readonly hash: Schema.String;
         readonly signIn: Schema.optionalKey<Schema.Struct<{
@@ -174,6 +175,7 @@ export declare const MigrationPlan: Schema.Struct<{
     }>, {
         readonly signIn: "sign_in";
     }>, Schema.Struct<{
+        readonly runtimeCapabilities: Schema.optionalKey<Schema.$Array<Schema.String>>;
         readonly version: Schema.Int;
         readonly hash: Schema.String;
         readonly entities: Schema.$Array<Schema.Struct<{

package/dist/migrate/plan.js

@@ -1,7 +1,7 @@
 import { isValueMatched, } from "../manifest.js";
 import { ATTACHMENTS_TABLE, ATTACHMENT_TABLES_DDL, BLOB_TABLES_DDL } from "../storage/tables.js";
 import { SNAKE_CASE_NAME, isSystemProperty, toSnakeCase } from "../names.js";
-import { AGENT_TABLES, AGENT_TABLES_DDL, CATALOG_TABLE_DDL, MAX_IDENTIFIER_LENGTH, OAUTH_TABLES, OAUTH_TABLES_DDL, USER_TABLE, addConstraintStatement, columnDefinition, constraintDefinition, createEnumStatement, createIndexStatement, createTableStatement, defaultExpression, entityStorage, enumTypeName, fieldColumnName, joinTable, propertyCheck, blobForeignKey, propertyColumn, propertyEnum, quoteIdentifier, quoteLiteral, relationshipColumn, RUNTIME_TABLES_DDL, relationshipForeignKey, SYSTEM_COLUMNS, tableName, } from "./storage.js";
+import { ACTION_ATTRIBUTION_TABLE, ACTION_ATTRIBUTION_DDL, AGENT_TABLES, AGENT_TABLES_DDL, CATALOG_TABLE_DDL, MAX_IDENTIFIER_LENGTH, OAUTH_TABLES, OAUTH_TABLES_DDL, USER_TABLE, addConstraintStatement, columnDefinition, constraintDefinition, createEnumStatement, createIndexStatement, createTableStatement, defaultExpression, entityStorage, enumTypeName, fieldColumnName, joinTable, propertyCheck, blobForeignKey, propertyColumn, propertyEnum, quoteIdentifier, quoteLiteral, relationshipColumn, RUNTIME_TABLES_DDL, relationshipForeignKey, SYSTEM_COLUMNS, tableName, } from "./storage.js";
 const GLOBAL_KINDS = new Set(["table", "type", "index"]);
 function step(input) {
     return {
@@ -77,6 +77,14 @@ export function planMigration(input) {
     else {
         // A database an earlier SDK migrated lacks the tables added since; each set arrives on its own.
         const lacks = (tables) => tables.some((table) => input.existingTables?.has(table) === false);
+        if (lacks([ACTION_ATTRIBUTION_TABLE])) {
+            draft.runtimeTables.push(step({
+                kind: "createCatalog",
+                classification: "additive",
+                description: "Create the runtime's verified pipeline action attribution table.",
+                sql: ACTION_ATTRIBUTION_DDL,
+            }));
+        }
         if (lacks(OAUTH_TABLES)) {
             draft.runtimeTables.push(step({
                 kind: "createCatalog",

package/dist/migrate/storage.d.ts

@@ -180,6 +180,9 @@ export declare const AGENT_TABLES_DDL: ReadonlyArray<string>;
  * The runtime's own tables beside the catalog. They are created with it, after the entity tables
  * because they refer to the built-in user table, and every statement is idempotent.
  */
+export declare const ACTION_ATTRIBUTION_TABLE = "_ontology_action_attribution";
+/** Runtime audit metadata deliberately has no foreign key: deleted records retain their history. */
+export declare const ACTION_ATTRIBUTION_DDL: ReadonlyArray<string>;
 export declare const RUNTIME_TABLES_DDL: ReadonlyArray<string>;
 export declare function columnDefinition(column: ColumnStorage): string;
 export declare function constraintDefinition(constraint: {

package/dist/migrate/storage.js

@@ -575,7 +575,17 @@ export const AGENT_TABLES_DDL = [
  * The runtime's own tables beside the catalog. They are created with it, after the entity tables
  * because they refer to the built-in user table, and every statement is idempotent.
  */
+export const ACTION_ATTRIBUTION_TABLE = "_ontology_action_attribution";
+/** Runtime audit metadata deliberately has no foreign key: deleted records retain their history. */
+export const ACTION_ATTRIBUTION_DDL = [
+    `CREATE TABLE IF NOT EXISTS "${ACTION_ATTRIBUTION_TABLE}" (
+    "action_id" uuid PRIMARY KEY,
+    "execution" jsonb NOT NULL,
+    "at" timestamptz NOT NULL DEFAULT now()
+  )`,
+];
 export const RUNTIME_TABLES_DDL = [
+    ...ACTION_ATTRIBUTION_DDL,
     [
         `CREATE TABLE IF NOT EXISTS ${quoteIdentifier(USER_ROLES_TABLE)} (`,
         `  "user_id" uuid NOT NULL,`,

package/dist/permissions.d.ts

@@ -33,6 +33,7 @@ export declare function permissionOf(entity: string, verb: string): string;
 export declare function grants(granted: string, required: string): boolean;
 /** Anything that holds permissions: a principal, or the reader of a catalog. */
 export interface PermissionHolder {
+    readonly execution?: import("./runtime/workload.js").WorkloadExecution;
     readonly permissions: ReadonlyArray<string>;
 }
 /**
@@ -40,6 +41,8 @@ export interface PermissionHolder {
  * through a wildcard.
  */
 export declare function isAllowed(required: string, principal: PermissionHolder): boolean;
+/** Expand workload authority for permission-only catalog and documentation readers. */
+export declare function effectivePermissions(principal: PermissionHolder): ReadonlyArray<string>;
 /** The first of the required permissions the principal lacks, or `undefined` when it holds all. */
 export declare function missingPermission(required: ReadonlyArray<string>, principal: PermissionHolder): string | undefined;
 /**

package/dist/permissions.js

@@ -52,7 +52,14 @@ export function grants(granted, required) {
  * through a wildcard.
  */
 export function isAllowed(required, principal) {
-    return principal.permissions.some((granted) => grants(granted, required));
+    return ((principal.execution !== undefined && principal.permissions.includes("*:*")) ||
+        principal.permissions.some((granted) => grants(granted, required)));
+}
+/** Expand workload authority for permission-only catalog and documentation readers. */
+export function effectivePermissions(principal) {
+    return principal.execution !== undefined && principal.permissions.includes("*:*")
+        ? [...principal.permissions, ...Array.from(EXPLICIT_GRANT_ENTITIES, (entity) => `${entity}:*`)]
+        : principal.permissions;
 }
 /** The first of the required permissions the principal lacks, or `undefined` when it holds all. */
 export function missingPermission(required, principal) {

package/dist/runtime/history.d.ts

@@ -1,4 +1,5 @@
 import { Schema } from "effect";
+import { WorkloadExecution } from "./workload.js";
 import type { StoredRecord } from "../runtime.js";
 import type { EntityModel } from "./model.js";
 import type { Params } from "./statement.js";
@@ -31,6 +32,26 @@ export declare const Edit: Schema.Struct<{
 export type Edit = typeof Edit.Type;
 /** A row of `<entity>_history`. */
 export declare const HistoryEntry: Schema.Struct<{
+    readonly execution: Schema.optionalKey<Schema.Struct<{
+        readonly issuer: Schema.String;
+        readonly audience: Schema.String;
+        readonly organizationId: Schema.String;
+        readonly workspaceId: Schema.String;
+        readonly subject: Schema.String;
+        readonly deploymentId: Schema.String;
+        readonly ontologyDeploymentId: Schema.String;
+        readonly servingOntologyDeploymentId: Schema.String;
+        readonly ontologyOrigin: Schema.String;
+        readonly environment: Schema.Literal<"production">;
+        readonly jobName: Schema.String;
+        readonly runId: Schema.String;
+        readonly executionId: Schema.NullOr<Schema.String>;
+        readonly attemptId: Schema.String;
+        readonly generation: Schema.Number;
+        readonly tokenId: Schema.String;
+        readonly issuedAt: Schema.Number;
+        readonly expiresAt: Schema.Number;
+    }>>;
     readonly id: Schema.String;
     readonly recordId: Schema.String;
     /** The qualified action, for example `lead.changeStatus`. */
@@ -54,6 +75,7 @@ export interface HistoryWrite {
     readonly edit: Edit;
 }
 export interface HistoryScope {
+    readonly execution?: WorkloadExecution;
     readonly action: string;
     readonly actionId: string;
     readonly principalId: string | null;

package/dist/runtime/history.js

@@ -1,5 +1,6 @@
 import { Schema } from "effect";
 import { canonicalJson } from "../manifest.js";
+import { WorkloadExecution } from "./workload.js";
 import { quoteIdentifier } from "../migrate/storage.js";
 import { uuidv7 } from "./ids.js";
 export const EditKind = Schema.Literals(["create", "update", "delete", "link", "unlink"]);
@@ -21,6 +22,7 @@ export const Edit = Schema.Struct({
 });
 /** A row of `<entity>_history`. */
 export const HistoryEntry = Schema.Struct({
+    execution: Schema.optionalKey(WorkloadExecution),
     id: Schema.String,
     recordId: Schema.String,
     /** The qualified action, for example `lead.changeStatus`. */

package/dist/runtime/pipeline.js

@@ -141,7 +141,7 @@ export function runAction(ontology, request) {
         if (consumesUpload) {
             const saved = yield* sql
                 .withTransaction(Effect.gen(function* () {
-                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions);
+                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions, request.principal.execution);
                 const [saved] = yield* sql.unsafe(`SELECT fingerprint, outcome FROM "_blob_action_results"
                WHERE principal_id = $1::uuid AND key = $2`, [request.principal.id, key]);
                 if (saved && saved.fingerprint !== fingerprint) {
@@ -168,6 +168,7 @@ export function runAction(ontology, request) {
             action: qualified,
             actionId,
             principalId: request.principal.id,
+            ...(request.principal.execution ? { execution: request.principal.execution } : {}),
             ...(key ? { blobActionKey: key } : {}),
             ...(request.branchId ? { branchId: request.branchId } : {}),
             ...(request.options?.createIntent ? { createIntent: request.options.createIntent } : {}),
@@ -177,8 +178,11 @@ export function runAction(ontology, request) {
         const handler = Effect.suspend(() => handle({ ...context, prepared }));
         let replay;
         const transactionalHandler = Effect.gen(function* () {
+            if (request.principal.execution !== undefined) {
+                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions, request.principal.execution);
+            }
             if (consumesUpload) {
-                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions);
+                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions, request.principal.execution);
                 yield* sql.unsafe(`INSERT INTO "_blob_action_results" (principal_id, key, fingerprint)
           VALUES ($1::uuid, $2, $3) ON CONFLICT DO NOTHING`, [request.principal.id, key, fingerprint]);
                 const [saved] = yield* sql.unsafe(`SELECT fingerprint, outcome FROM "_blob_action_results" WHERE principal_id = $1::uuid AND key = $2

package/dist/runtime/principals.d.ts

@@ -49,6 +49,8 @@ export declare const SIGN_IN_RECORD_INTERVAL_MS: number;
  * {@link SIGN_IN_RECORD_INTERVAL_MS}, so history keeps it. Inactive users are rejected.
  */
 export declare function resolvePrincipalByIdentity(ontology: Ontology, claims: IdentityClaims): Effect.Effect<Principal, PrincipalRejected, SqlClient.SqlClient>;
+/** Resolve the workspace's stable keyless pipeline service, without customer roles or sign-in. */
+export declare function resolvePipelineWorker(ontology: Ontology, execution: import("./workload.js").WorkloadExecution): Effect.Effect<Principal, PrincipalRejected, SqlClient.SqlClient>;
 /**
  * The principal of an API key, with the permissions its roles have in the ontology. Unknown and
  * revoked keys and inactive users are rejected.

package/dist/runtime/principals.js

@@ -207,6 +207,61 @@ export function resolvePrincipalByIdentity(ontology, claims) {
         return yield* activePrincipal(ontology, sql, user);
     }).pipe(Effect.catchIf(isSqlError, (error) => Effect.die(error)));
 }
+/** Resolve the workspace's stable keyless pipeline service, without customer roles or sign-in. */
+export function resolvePipelineWorker(ontology, execution) {
+    return Effect.gen(function* () {
+        const sql = yield* SqlClient.SqlClient;
+        const provider = "segmentstream-ontology-workload";
+        const subject = `pipeline-workers:${execution.workspaceId}`;
+        const runtime = platformRuntime(ontology, sql, "user.resolve_pipeline_worker");
+        const principal = (user) => user.kind !== "service" || user.active !== true
+            ? Effect.fail(new PrincipalRejected({
+                reason: "inactive_user",
+                message: "The pipeline worker principal is inactive or has an invalid kind.",
+            }))
+            : Effect.succeed({
+                id: user.id,
+                kind: "service",
+                roles: [],
+                permissions: ["*:*"],
+                execution,
+            });
+        const find = (forUpdate) => runtime.find({
+            entity: "user",
+            options: {
+                where: { identity_provider: provider, identity_subject: subject },
+                limit: 1,
+                forUpdate,
+            },
+        });
+        const [known] = yield* find(false);
+        // Returning requests only read the principal; writes revalidate it in their transaction.
+        if (known !== undefined) {
+            return yield* principal(known);
+        }
+        return yield* sql
+            .withTransaction(Effect.gen(function* () {
+            // The replication lock precedes every business lock, including principal initialization.
+            yield* beginReplicationWrite(sql);
+            yield* sql.unsafe("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [
+                provider + ":" + subject,
+            ]);
+            const [existing] = yield* find(true);
+            const user = existing ??
+                (yield* runtime.create({
+                    entity: "user",
+                    values: {
+                        name: "Pipeline workers",
+                        kind: "service",
+                        identity_provider: provider,
+                        identity_subject: subject,
+                    },
+                }));
+            return yield* principal(user);
+        }))
+            .pipe(Effect.catchTag("Conflict", (error) => Effect.die(error)), Effect.catchTag("NotFound", (error) => Effect.die(error)));
+    }).pipe(Effect.catchIf(isSqlError, (error) => Effect.die(error)));
+}
 /**
  * The principal of an API key, with the permissions its roles have in the ontology. Unknown and
  * revoked keys and inactive users are rejected.

package/dist/runtime/reads.js

@@ -238,17 +238,25 @@ export function readHistory(context, entity, input) {
             const at = params.add(cursor[0], "timestamptz");
             conditions.push(`("h"."at" < ${at} OR ("h"."at" = ${at} AND "h"."id" < ${params.add(cursor[1], "uuid")}))`);
         }
+        const presenceParams = new Params();
+        const [presence] = yield* context.run("SELECT to_regclass('_ontology_action_attribution') IS NOT NULL AS present", presenceParams);
+        const attribution = presence?.present === true;
         const rows = yield* context.run(`SELECT "h"."id"::text AS "id", "h"."record_id"::text AS "recordId", "h"."action" AS "action", ` +
             `"h"."action_id"::text AS "actionId", "h"."kind" AS "kind", ` +
             `"h"."principal_id"::text AS "principalId", ` +
             `to_char("h"."at" AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') AS "at", ` +
             `"h"."changes"::text AS "changes" ` +
+            (attribution ? `, "a"."execution" AS "execution" ` : "") +
             `FROM ${quoteIdentifier(entity.historyTable)} AS "h" ` +
+            (attribution
+                ? `LEFT JOIN "_ontology_action_attribution" AS "a" ON "a"."action_id" = "h"."action_id" `
+                : "") +
             `WHERE ${conditions.join(" AND ")} ` +
             `ORDER BY "h"."at" DESC, "h"."id" DESC ` +
             `LIMIT ${params.add(limit + 1, "bigint")}`, params);
         const items = rows.slice(0, limit).map((row) => Schema.decodeUnknownSync(HistoryEntry)({
-            ...row,
+            ...Object.fromEntries(Object.entries(row).filter(([key, value]) => key !== "execution" || value != null)),
+            ...(row.execution == null ? {} : { execution: row.execution }),
             at: canonicalInstant(String(row.at)),
             changes: JSON.parse(String(row.changes)),
         }));

package/dist/runtime/service-binding.js

@@ -11,7 +11,7 @@ import { sqlAgentStore } from "./agents.js";
 import { generatedActions } from "./generated-actions.js";
 import { sqlOAuthStore } from "./oauth.js";
 import { runAction } from "./pipeline.js";
-import { checkSignIn, resolvePrincipalByApiKey, resolvePrincipalByIdentity } from "./principals.js";
+import { checkSignIn, resolvePrincipalByApiKey, resolvePrincipalByIdentity, resolvePipelineWorker, } from "./principals.js";
 import { postgresTls } from "./postgres-tls.js";
 import { makeOntologyRuntime } from "./sql-runtime.js";
 /** Connections one service instance holds to the database's pooler. */
@@ -61,6 +61,7 @@ export function backendLayer(ontology, blobStorage) {
             })).pipe(Effect.catchTag("PrincipalRejected", (rejection) => rejection.reason === "not_invited"
                 ? rejectedAs("sign_in")(rejection).pipe(Effect.andThen(Effect.fail(new NotInvited({ message: rejection.message }))))
                 : rejectedAs("sign_in")(rejection))),
+            resolvePipelineWorker: (execution) => withSql(resolvePipelineWorker(ontology, execution)).pipe(Effect.catchTag("PrincipalRejected", rejectedAs("pipeline_worker"))),
             checkSignIn: (email) => withSql(checkSignIn(ontology, email)),
             resolveApiKey: (key) => withSql(resolvePrincipalByApiKey(ontology, Redacted.value(key))).pipe(Effect.catchTag("PrincipalRejected", rejectedAs("api_key"))),
             appliedHash: readCatalog({ sql }).pipe(Effect.map((manifest) => manifest?.hash), Effect.orDie),

package/dist/runtime/workload.d.ts

@@ -0,0 +1,23 @@
+import { Schema } from "effect";
+/** Verified platform claims retained with each write; never supplied by request headers. */
+export declare const WorkloadExecution: Schema.Struct<{
+    readonly issuer: Schema.String;
+    readonly audience: Schema.String;
+    readonly organizationId: Schema.String;
+    readonly workspaceId: Schema.String;
+    readonly subject: Schema.String;
+    readonly deploymentId: Schema.String;
+    readonly ontologyDeploymentId: Schema.String;
+    readonly servingOntologyDeploymentId: Schema.String;
+    readonly ontologyOrigin: Schema.String;
+    readonly environment: Schema.Literal<"production">;
+    readonly jobName: Schema.String;
+    readonly runId: Schema.String;
+    readonly executionId: Schema.NullOr<Schema.String>;
+    readonly attemptId: Schema.String;
+    readonly generation: Schema.Number;
+    readonly tokenId: Schema.String;
+    readonly issuedAt: Schema.Number;
+    readonly expiresAt: Schema.Number;
+}>;
+export type WorkloadExecution = typeof WorkloadExecution.Type;

package/dist/runtime/workload.js

@@ -0,0 +1,22 @@
+import { Schema } from "effect";
+/** Verified platform claims retained with each write; never supplied by request headers. */
+export const WorkloadExecution = Schema.Struct({
+    issuer: Schema.String,
+    audience: Schema.String,
+    organizationId: Schema.String,
+    workspaceId: Schema.String,
+    subject: Schema.String,
+    deploymentId: Schema.String,
+    ontologyDeploymentId: Schema.String,
+    servingOntologyDeploymentId: Schema.String,
+    ontologyOrigin: Schema.String,
+    environment: Schema.Literal("production"),
+    jobName: Schema.String,
+    runId: Schema.String,
+    executionId: Schema.NullOr(Schema.String),
+    attemptId: Schema.String,
+    generation: Schema.Number,
+    tokenId: Schema.String,
+    issuedAt: Schema.Number,
+    expiresAt: Schema.Number,
+});

package/dist/runtime/writes.js

@@ -1,7 +1,7 @@
 import { Effect } from "effect";
 import { resolveBlobWrites } from "../storage/writes.js";
 import { Conflict } from "../errors.js";
-import { quoteIdentifier } from "../migrate/storage.js";
+import { ACTION_ATTRIBUTION_TABLE, quoteIdentifier } from "../migrate/storage.js";
 import { InvalidValues } from "./errors.js";
 import { uuidv7 } from "./ids.js";
 import { diffRecords, insertHistory } from "./history.js";
@@ -13,6 +13,12 @@ import { columnOf, Params } from "./statement.js";
 function recordEdit(context, entity, edit) {
     return Effect.gen(function* () {
         const params = new Params();
+        if (context.scope.execution !== undefined) {
+            const attribution = new Params();
+            yield* context.run(`INSERT INTO "${ACTION_ATTRIBUTION_TABLE}" (action_id, execution) VALUES (` +
+                `${attribution.add(context.scope.actionId, "uuid")}, ` +
+                `${attribution.add(JSON.stringify(context.scope.execution), "jsonb")}) ON CONFLICT DO NOTHING`, attribution);
+        }
         yield* context.run(insertHistory(context.scope, { entity, edit }, params), params);
         context.edits.push(edit);
     });

package/dist/runtime.d.ts

@@ -1,8 +1,11 @@
 import { Context, Effect } from "effect";
 import type { Conflict, NotFound } from "./errors.js";
 import type { Where } from "./query.js";
+import type { WorkloadExecution } from "./runtime/workload.js";
 /** Who runs an action: an app member or a service principal, both `user` records. */
 export interface Principal {
+    /** Present only for a verified managed pipeline worker. */
+    readonly execution?: WorkloadExecution;
     /** The id of the principal's `user` record. */
     readonly id: string;
     readonly kind: "member" | "service";

package/dist/service/authentication.d.ts

@@ -2,6 +2,7 @@ import { Context, Effect, Layer, Redacted } from "effect";
 import { HttpServerRequest, type HttpServerResponse } from "effect/unstable/http";
 import { HttpApiMiddleware, HttpApiSecurity } from "effect/unstable/httpapi";
 import { type JWTVerifyGetKey } from "jose";
+import type { WorkloadExecution } from "../runtime/workload.js";
 import type { Principal } from "../runtime.js";
 import type { NeonAuthEnvironment } from "./config.js";
 import { RequestId } from "./errors.js";
@@ -32,6 +33,10 @@ declare const Authentication_base: HttpApiMiddleware.ServiceClass<Authentication
 export declare class Authentication extends Authentication_base {
 }
 export interface TokenVerifierConfig {
+    /** Production workload activation and the deployment actually serving the request. */
+    readonly workloadTarget?: {
+        readonly deploymentId: string;
+    };
     /** The control plane: the issuer of app tokens and the host of their JWKS. */
     readonly segmentstreamUrl: string;
     readonly applicationId: string;
@@ -39,6 +44,9 @@ export interface TokenVerifierConfig {
     readonly organizationId: string;
 }
 export type TokenVerification = {
+    readonly status: "workload";
+    readonly execution: WorkloadExecution;
+} | {
     readonly status: "valid";
     readonly identity: SignInIdentity;
 } | {
@@ -56,6 +64,9 @@ export declare function neonAuthKeySet(jwksUrl: string): JWTVerifyGetKey;
  * `SEGMENTSTREAM_URL` for this application (`aud: app:<application id>`), organization and workspace.
  */
 export declare function makeTokenVerifier(config: TokenVerifierConfig, keySet: JWTVerifyGetKey): TokenVerifier;
+export declare const WORKLOAD_TOKEN_TYPE = "segmentstream-ontology-workload+jwt";
+/** A separate verifier: a workload token can never resolve as a human or act as an agent. */
+export declare function makeWorkloadTokenVerifier(config: TokenVerifierConfig, keySet: JWTVerifyGetKey): TokenVerifier;
 /**
  * Neon Auth's issuer is the origin of its Auth URL: `https://ep-….neon.tech/ontology/auth` issues
  * tokens with `iss: https://ep-….neon.tech`.

package/dist/service/authentication.js

@@ -1,7 +1,7 @@
 import { Cause, Context, Effect, Layer, Redacted } from "effect";
 import { HttpServerRequest } from "effect/unstable/http";
 import { HttpApiMiddleware, HttpApiSecurity, OpenApi } from "effect/unstable/httpapi";
-import { createRemoteJWKSet, decodeJwt, errors, jwtVerify, } from "jose";
+import { createRemoteJWKSet, decodeJwt, decodeProtectedHeader, errors, jwtVerify, } from "jose";
 import { API_KEY_PREFIX } from "../runtime/principals.js";
 import { RequestId, crossOriginSession, forbidden, internalError, notInvited, toServerResponse, unauthorized, unavailable, } from "./errors.js";
 import { ACCESS_TOKEN_PREFIX, principalOfAccessToken } from "./oauth/protocol.js";
@@ -76,6 +76,7 @@ export function makeTokenVerifier(config, keySet) {
         try {
             const verified = await jwtVerify(token, keySet, {
                 algorithms: ["ES256"],
+                typ: "JWT",
                 issuer,
                 audience,
                 clockTolerance: CLOCK_TOLERANCE_SECONDS,
@@ -90,6 +91,96 @@ export function makeTokenVerifier(config, keySet) {
         return identity === undefined ? { status: "invalid" } : { status: "valid", identity };
     };
 }
+export const WORKLOAD_TOKEN_TYPE = "segmentstream-ontology-workload+jwt";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** A separate verifier: a workload token can never resolve as a human or act as an agent. */
+export function makeWorkloadTokenVerifier(config, keySet) {
+    return async (token) => {
+        if (config.workloadTarget === undefined) {
+            return { status: "invalid" };
+        }
+        let payload;
+        try {
+            const verified = await jwtVerify(token, keySet, {
+                algorithms: ["ES256"],
+                typ: WORKLOAD_TOKEN_TYPE,
+                issuer: new URL(config.segmentstreamUrl).origin,
+                audience: `ontology:${config.applicationId}`,
+                clockTolerance: CLOCK_TOLERANCE_SECONDS,
+                requiredClaims: [
+                    "sub",
+                    "exp",
+                    "iat",
+                    "jti",
+                    "org",
+                    "wsp",
+                    "deploymentId",
+                    "ontologyDeploymentId",
+                    "ontologyOrigin",
+                    "environment",
+                    "jobName",
+                    "runId",
+                    "executionId",
+                    "attemptId",
+                    "generation",
+                ],
+            });
+            payload = verified.payload;
+        }
+        catch (error) {
+            return keySetUnavailable(error) ? { status: "unavailable" } : { status: "invalid" };
+        }
+        const strings = ["jti", "jobName"];
+        const ids = ["deploymentId", "ontologyDeploymentId", "runId", "attemptId"];
+        if (payload.org !== config.organizationId ||
+            payload.wsp !== config.workspaceId ||
+            payload.sub !== `pipeline-workers:${config.workspaceId}` ||
+            payload.environment !== "production" ||
+            payload.aud !== `ontology:${config.applicationId}` ||
+            strings.some((name) => typeof payload[name] !== "string" || payload[name].trim() === "") ||
+            ids.some((name) => typeof payload[name] !== "string" || !UUID.test(payload[name])) ||
+            (payload.executionId !== null &&
+                (typeof payload.executionId !== "string" || !UUID.test(payload.executionId))) ||
+            !Number.isSafeInteger(payload.generation) ||
+            payload.generation < 1 ||
+            !Number.isSafeInteger(payload.iat) ||
+            !Number.isSafeInteger(payload.exp) ||
+            payload.iat > Math.floor(Date.now() / 1000) + CLOCK_TOLERANCE_SECONDS ||
+            payload.exp <= payload.iat ||
+            payload.exp - payload.iat > 300 ||
+            typeof payload.ontologyOrigin !== "string" ||
+            !URL.canParse(payload.ontologyOrigin)) {
+            return { status: "invalid" };
+        }
+        const origin = new URL(payload.ontologyOrigin);
+        if (origin.protocol !== "https:" || origin.origin !== payload.ontologyOrigin) {
+            return { status: "invalid" };
+        }
+        return {
+            status: "workload",
+            execution: {
+                issuer: payload.iss,
+                audience: payload.aud,
+                organizationId: config.organizationId,
+                workspaceId: config.workspaceId,
+                subject: payload.sub,
+                deploymentId: payload.deploymentId,
+                ontologyDeploymentId: payload.ontologyDeploymentId,
+                servingOntologyDeploymentId: config.workloadTarget.deploymentId,
+                ontologyOrigin: payload.ontologyOrigin,
+                environment: "production",
+                jobName: payload.jobName,
+                runId: payload.runId,
+                executionId: payload.executionId,
+                attemptId: payload.attemptId,
+                generation: payload.generation,
+                tokenId: payload.jti,
+                issuedAt: payload.iat,
+                expiresAt: payload.exp,
+            },
+        };
+    };
+}
 /**
  * Neon Auth's issuer is the origin of its Auth URL: `https://ep-….neon.tech/ontology/auth` issues
  * tokens with `iss: https://ep-….neon.tech`.
@@ -166,11 +257,21 @@ export function verifyByIssuer(verifiers) {
  * once it has Neon Auth. Both are accepted while workspaces move to Neon Auth.
  */
 export function tokenVerifier(config) {
+    const platformKeys = remoteKeySet(config.segmentstreamUrl);
+    const human = makeTokenVerifier(config, platformKeys);
+    const workload = makeWorkloadTokenVerifier(config, platformKeys);
+    const platform = (token) => {
+        try {
+            return decodeProtectedHeader(token).typ === WORKLOAD_TOKEN_TYPE
+                ? workload(token)
+                : human(token);
+        }
+        catch {
+            return Promise.resolve({ status: "invalid" });
+        }
+    };
     const verifiers = new Map([
-        [
-            new URL(config.segmentstreamUrl).origin,
-            makeTokenVerifier(config, remoteKeySet(config.segmentstreamUrl)),
-        ],
+        [new URL(config.segmentstreamUrl).origin, platform],
     ]);
     if (config.neonAuth !== undefined) {
         verifiers.set(neonAuthIssuer(config.neonAuth.baseUrl), makeNeonAuthTokenVerifier(config.neonAuth, neonAuthKeySet(config.neonAuth.jwksUrl)));
@@ -337,6 +438,14 @@ export function authenticate(credential, verifyToken, options = {}) {
             }
         }
         const verification = yield* Effect.promise(() => verifyToken(token));
+        if (verification.status === "workload") {
+            const principal = backend.resolvePipelineWorker === undefined
+                ? undefined
+                : yield* backend.resolvePipelineWorker(verification.execution);
+            return principal === undefined
+                ? { status: "rejected" }
+                : { status: "authenticated", principal };
+        }
         if (verification.status !== "valid") {
             return verification.status === "invalid"
                 ? { status: "rejected" }

package/dist/service/config.d.ts

@@ -66,6 +66,10 @@ export interface OntologyEnvironment {
      * `segmentstreamUrl` for `workspaceId`; previews and local development have none.
      */
     readonly appCredential?: Redacted.Redacted<string>;
+    /** Production deployment identity; absent in local, preview and earlier deployments. */
+    readonly workloadTarget?: {
+        readonly deploymentId: string;
+    };
     /** Present once the workspace has Neon Auth: members then sign in with its tokens. */
     readonly neonAuth?: NeonAuthEnvironment;
     /**

package/dist/service/config.js

@@ -134,6 +134,13 @@ export function configFromEnv(environment = process.env) {
             message: `The ontology service cannot start: ${list} ${verb} not set.`,
         });
     }
+    const deploymentId = read("SEGMENTSTREAM_ONTOLOGY_DEPLOYMENT_ID");
+    if (deploymentId !== "" &&
+        !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(deploymentId)) {
+        throw new OntologyServiceConfigError({
+            message: "SEGMENTSTREAM_ONTOLOGY_DEPLOYMENT_ID must be a UUID.",
+        });
+    }
     const neonAuth = neonAuthFromEnv(read);
     const runtimeIdentity = runtimeIdentityFromEnv(read);
     const localConnections = localConnectionsFromEnv(environment);
@@ -163,6 +170,10 @@ export function configFromEnv(environment = process.env) {
         ...(read(APP_CREDENTIAL_VARIABLE)
             ? { appCredential: Redacted.make(read(APP_CREDENTIAL_VARIABLE)) }
             : {}),
+        ...(environment.VERCEL_ENV === "production" &&
+            read("SEGMENTSTREAM_ONTOLOGY_DEPLOYMENT_ID") !== ""
+            ? { workloadTarget: { deploymentId: read("SEGMENTSTREAM_ONTOLOGY_DEPLOYMENT_ID") } }
+            : {}),
         ...(neonAuth === undefined ? {} : { neonAuth }),
         ...(runtimeIdentity === undefined ? {} : { runtimeIdentity }),
         ...(runtimeIdentity === undefined || read(AGENT_HOST_VARIABLE) === ""

package/dist/service/handlers.js

@@ -1,3 +1,4 @@
+import { effectivePermissions } from "../permissions.js";
 import { HttpServerResponse } from "effect/unstable/http";
 import { Effect, Layer, Schema } from "effect";
 import { HttpApiBuilder, OpenApi } from "effect/unstable/httpapi";
@@ -145,7 +146,7 @@ function serviceHandlers(built, operationsOf, aggregate) {
                 return undefined;
             }
             const principal = yield* CurrentPrincipal;
-            return principal.permissions;
+            return effectivePermissions(principal);
         });
         return handlers
             .handle("catalog", (request) => Effect.map(permissionsFor(request.query.as), (permissions) => catalogFor(manifest, permissions)))

package/dist/service/mcp/server.js

@@ -1,3 +1,4 @@
+import { effectivePermissions } from "../../permissions.js";
 import { Cause, Data, Effect, Layer, Option, Schema, SchemaTransformation } from "effect";
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
 import { HttpApiBuilder, HttpApiSecurity } from "effect/unstable/httpapi";
@@ -175,7 +176,7 @@ function runTool({ built, operations, aggregate, conversations }, tool, args, re
             case "describe": {
                 const principal = yield* CurrentPrincipal;
                 return {
-                    text: describeCatalog(built.plan.ontology.manifest, principal.permissions),
+                    text: describeCatalog(built.plan.ontology.manifest, effectivePermissions(principal)),
                 };
             }
             case "aggregate": {
@@ -285,7 +286,7 @@ function readResource({ built }, uri) {
                     {
                         uri,
                         mimeType: "application/json",
-                        text: JSON.stringify(encodeManifest(catalogFor(manifest, principal.permissions))),
+                        text: JSON.stringify(encodeManifest(catalogFor(manifest, effectivePermissions(principal)))),
                     },
                 ];
             case DESCRIBE_URI:
@@ -293,7 +294,7 @@ function readResource({ built }, uri) {
                     {
                         uri,
                         mimeType: "text/plain",
-                        text: describeCatalog(manifest, principal.permissions),
+                        text: describeCatalog(manifest, effectivePermissions(principal)),
                     },
                 ];
             default:
@@ -354,7 +355,7 @@ function dispatch(server, message, request) {
                         title: "Ontology",
                         version: server.built.plan.ontology.manifest.hash,
                     },
-                    instructions: instructions(server, principal.permissions),
+                    instructions: instructions(server, effectivePermissions(principal)),
                 });
             case "ping":
                 return rpcResult(id, {});

package/dist/service/operations.d.ts

@@ -74,19 +74,39 @@ export declare function makeOperations(backend: Backend, plan: ApiPlan, hooks: R
         readonly after?: string;
         readonly limit?: number;
     }) => Effect.Effect<QueryResult<{
+        readonly at: string;
         readonly id: string;
-        readonly recordId: string;
-        readonly action: string;
-        readonly actionId: string;
         readonly kind: "create" | "update" | "delete" | "link" | "unlink";
-        readonly principalId: string | null;
-        readonly at: string;
+        readonly action: string;
         readonly changes: {
             readonly [x: string]: {
                 readonly before: import("effect/Schema").Json;
                 readonly after: import("effect/Schema").Json;
             };
         };
+        readonly principalId: string | null;
+        readonly recordId: string;
+        readonly actionId: string;
+        readonly execution?: {
+            readonly issuer: string;
+            readonly audience: string;
+            readonly organizationId: string;
+            readonly workspaceId: string;
+            readonly subject: string;
+            readonly deploymentId: string;
+            readonly ontologyDeploymentId: string;
+            readonly servingOntologyDeploymentId: string;
+            readonly ontologyOrigin: string;
+            readonly environment: "production";
+            readonly jobName: string;
+            readonly runId: string;
+            readonly executionId: string | null;
+            readonly attemptId: string;
+            readonly generation: number;
+            readonly tokenId: string;
+            readonly issuedAt: number;
+            readonly expiresAt: number;
+        } | undefined;
     }>, PermissionDenied | import("../errors.js").NotFound | import("../index.js").InvalidQuery, CurrentPrincipal>;
     /** The records a relationship reaches from one record, as a page of the target entity. */
     traverse: (planned: PlannedEntity, traversal: Traversal, id: string, query: Query) => Effect.Effect<QueryResult<Readonly<Record<string, unknown>>>, PermissionDenied | import("../errors.js").NotFound | import("../index.js").InvalidQuery, CurrentPrincipal>;

package/dist/service/runtime-contract.d.ts

@@ -274,6 +274,7 @@ declare const OntologyBackend_base: Context.ServiceClass<OntologyBackend, "@segm
      * Finds, links or creates the member's user. `undefined` when the user may not sign in, and
      * {@link NotInvited} when the sign-in policy turns away a person nobody invited.
      */
+    readonly resolvePipelineWorker?: (execution: import("../runtime/workload.js").WorkloadExecution) => Effect.Effect<Principal | undefined>;
     readonly resolvePrincipal: (identity: SignInIdentity) => Effect.Effect<Principal | undefined, NotInvited>;
     /**
      * Whether a person may sign in with this address, and how, read before the app emails them.

package/dist/service/schemas.d.ts

@@ -40,6 +40,26 @@ export declare const Validation: Schema.Struct<{
     }>>;
 }>;
 export declare const HistoryEntry: Schema.decodeTo<Schema.Struct<{
+    readonly execution: Schema.optionalKey<Schema.Struct<{
+        readonly issuer: Schema.String;
+        readonly audience: Schema.String;
+        readonly organizationId: Schema.String;
+        readonly workspaceId: Schema.String;
+        readonly subject: Schema.String;
+        readonly deploymentId: Schema.String;
+        readonly ontologyDeploymentId: Schema.String;
+        readonly servingOntologyDeploymentId: Schema.String;
+        readonly ontologyOrigin: Schema.String;
+        readonly environment: Schema.Literal<"production">;
+        readonly jobName: Schema.String;
+        readonly runId: Schema.String;
+        readonly executionId: Schema.NullOr<Schema.String>;
+        readonly attemptId: Schema.String;
+        readonly generation: Schema.Number;
+        readonly tokenId: Schema.String;
+        readonly issuedAt: Schema.Number;
+        readonly expiresAt: Schema.Number;
+    }>>;
     readonly id: Schema.String;
     readonly recordId: Schema.String;
     readonly action: Schema.String;
@@ -52,6 +72,26 @@ export declare const HistoryEntry: Schema.decodeTo<Schema.Struct<{
         readonly after: Schema.Codec<Schema.Json, Schema.Json, never, never>;
     }>>;
 }>, Schema.Struct<{
+    readonly execution: Schema.toEncoded<Schema.optionalKey<Schema.Struct<{
+        readonly issuer: Schema.String;
+        readonly audience: Schema.String;
+        readonly organizationId: Schema.String;
+        readonly workspaceId: Schema.String;
+        readonly subject: Schema.String;
+        readonly deploymentId: Schema.String;
+        readonly ontologyDeploymentId: Schema.String;
+        readonly servingOntologyDeploymentId: Schema.String;
+        readonly ontologyOrigin: Schema.String;
+        readonly environment: Schema.Literal<"production">;
+        readonly jobName: Schema.String;
+        readonly runId: Schema.String;
+        readonly executionId: Schema.NullOr<Schema.String>;
+        readonly attemptId: Schema.String;
+        readonly generation: Schema.Number;
+        readonly tokenId: Schema.String;
+        readonly issuedAt: Schema.Number;
+        readonly expiresAt: Schema.Number;
+    }>>>;
     readonly id: Schema.toEncoded<Schema.String>;
     readonly record_id: Schema.toEncoded<Schema.String>;
     readonly action: Schema.toEncoded<Schema.String>;
@@ -66,6 +106,26 @@ export declare const HistoryEntry: Schema.decodeTo<Schema.Struct<{
 }>, never, never>;
 export declare const HistoryPage: Schema.decodeTo<Schema.Struct<{
     readonly items: Schema.$Array<Schema.decodeTo<Schema.Struct<{
+        readonly execution: Schema.optionalKey<Schema.Struct<{
+            readonly issuer: Schema.String;
+            readonly audience: Schema.String;
+            readonly organizationId: Schema.String;
+            readonly workspaceId: Schema.String;
+            readonly subject: Schema.String;
+            readonly deploymentId: Schema.String;
+            readonly ontologyDeploymentId: Schema.String;
+            readonly servingOntologyDeploymentId: Schema.String;
+            readonly ontologyOrigin: Schema.String;
+            readonly environment: Schema.Literal<"production">;
+            readonly jobName: Schema.String;
+            readonly runId: Schema.String;
+            readonly executionId: Schema.NullOr<Schema.String>;
+            readonly attemptId: Schema.String;
+            readonly generation: Schema.Number;
+            readonly tokenId: Schema.String;
+            readonly issuedAt: Schema.Number;
+            readonly expiresAt: Schema.Number;
+        }>>;
         readonly id: Schema.String;
         readonly recordId: Schema.String;
         readonly action: Schema.String;
@@ -78,6 +138,26 @@ export declare const HistoryPage: Schema.decodeTo<Schema.Struct<{
             readonly after: Schema.Codec<Schema.Json, Schema.Json, never, never>;
         }>>;
     }>, Schema.Struct<{
+        readonly execution: Schema.toEncoded<Schema.optionalKey<Schema.Struct<{
+            readonly issuer: Schema.String;
+            readonly audience: Schema.String;
+            readonly organizationId: Schema.String;
+            readonly workspaceId: Schema.String;
+            readonly subject: Schema.String;
+            readonly deploymentId: Schema.String;
+            readonly ontologyDeploymentId: Schema.String;
+            readonly servingOntologyDeploymentId: Schema.String;
+            readonly ontologyOrigin: Schema.String;
+            readonly environment: Schema.Literal<"production">;
+            readonly jobName: Schema.String;
+            readonly runId: Schema.String;
+            readonly executionId: Schema.NullOr<Schema.String>;
+            readonly attemptId: Schema.String;
+            readonly generation: Schema.Number;
+            readonly tokenId: Schema.String;
+            readonly issuedAt: Schema.Number;
+            readonly expiresAt: Schema.Number;
+        }>>>;
         readonly id: Schema.toEncoded<Schema.String>;
         readonly record_id: Schema.toEncoded<Schema.String>;
         readonly action: Schema.toEncoded<Schema.String>;
@@ -93,6 +173,26 @@ export declare const HistoryPage: Schema.decodeTo<Schema.Struct<{
     readonly nextCursor: Schema.NullOr<Schema.String>;
 }>, Schema.Struct<{
     readonly items: Schema.toEncoded<Schema.$Array<Schema.decodeTo<Schema.Struct<{
+        readonly execution: Schema.optionalKey<Schema.Struct<{
+            readonly issuer: Schema.String;
+            readonly audience: Schema.String;
+            readonly organizationId: Schema.String;
+            readonly workspaceId: Schema.String;
+            readonly subject: Schema.String;
+            readonly deploymentId: Schema.String;
+            readonly ontologyDeploymentId: Schema.String;
+            readonly servingOntologyDeploymentId: Schema.String;
+            readonly ontologyOrigin: Schema.String;
+            readonly environment: Schema.Literal<"production">;
+            readonly jobName: Schema.String;
+            readonly runId: Schema.String;
+            readonly executionId: Schema.NullOr<Schema.String>;
+            readonly attemptId: Schema.String;
+            readonly generation: Schema.Number;
+            readonly tokenId: Schema.String;
+            readonly issuedAt: Schema.Number;
+            readonly expiresAt: Schema.Number;
+        }>>;
         readonly id: Schema.String;
         readonly recordId: Schema.String;
         readonly action: Schema.String;
@@ -105,6 +205,26 @@ export declare const HistoryPage: Schema.decodeTo<Schema.Struct<{
             readonly after: Schema.Codec<Schema.Json, Schema.Json, never, never>;
         }>>;
     }>, Schema.Struct<{
+        readonly execution: Schema.toEncoded<Schema.optionalKey<Schema.Struct<{
+            readonly issuer: Schema.String;
+            readonly audience: Schema.String;
+            readonly organizationId: Schema.String;
+            readonly workspaceId: Schema.String;
+            readonly subject: Schema.String;
+            readonly deploymentId: Schema.String;
+            readonly ontologyDeploymentId: Schema.String;
+            readonly servingOntologyDeploymentId: Schema.String;
+            readonly ontologyOrigin: Schema.String;
+            readonly environment: Schema.Literal<"production">;
+            readonly jobName: Schema.String;
+            readonly runId: Schema.String;
+            readonly executionId: Schema.NullOr<Schema.String>;
+            readonly attemptId: Schema.String;
+            readonly generation: Schema.Number;
+            readonly tokenId: Schema.String;
+            readonly issuedAt: Schema.Number;
+            readonly expiresAt: Schema.Number;
+        }>>>;
         readonly id: Schema.toEncoded<Schema.String>;
         readonly record_id: Schema.toEncoded<Schema.String>;
         readonly action: Schema.toEncoded<Schema.String>;
@@ -259,6 +379,7 @@ export declare const Catalog: Schema.decodeTo<Schema.Struct<{
     }>, {
         readonly builtIn: "built_in";
     }>>;
+    readonly runtimeCapabilities: Schema.optionalKey<Schema.$Array<Schema.String>>;
     readonly version: Schema.Int;
     readonly hash: Schema.String;
     readonly signIn: Schema.optionalKey<Schema.Struct<{
@@ -388,6 +509,7 @@ export declare const Catalog: Schema.decodeTo<Schema.Struct<{
     }>, {
         readonly builtIn: "built_in";
     }>>>;
+    readonly runtimeCapabilities: Schema.toEncoded<Schema.optionalKey<Schema.$Array<Schema.String>>>;
     readonly version: Schema.toEncoded<Schema.Int>;
     readonly hash: Schema.toEncoded<Schema.String>;
     readonly sign_in: Schema.toEncoded<Schema.optionalKey<Schema.Struct<{

package/dist/storage/attachments.js

@@ -128,7 +128,7 @@ export function attachmentRuntime(ontology, sql, provider) {
             ]);
         }
         // The member must still be active; a deactivated member's agent reads nothing.
-        yield* authorizeBlobOperation(ontology, sql, caller.principal.id, []);
+        yield* authorizeBlobOperation(ontology, sql, caller.principal.id, [], caller.principal.execution);
         return row;
     });
     /**
@@ -154,7 +154,7 @@ export function attachmentRuntime(ontology, sql, provider) {
             });
         }
         const reserved = yield* sql.withTransaction(Effect.gen(function* () {
-            yield* authorizeBlobOperation(ontology, sql, caller.principal.id, []);
+            yield* authorizeBlobOperation(ontology, sql, caller.principal.id, [], caller.principal.execution);
             yield* sql.unsafe(`SELECT pg_advisory_xact_lock(818724)`);
             const [existing] = yield* sql.unsafe(`SELECT id::text FROM "${ATTACHMENTS_TABLE}"
              WHERE owner_id = $1::uuid AND conversation = $2 AND source_ref = $3`, [caller.principal.id, caller.conversation, input.sourceRef]);
@@ -272,7 +272,7 @@ export function attachmentRuntime(ontology, sql, provider) {
     });
     /** The caller's attachments in this chat and session that are still readable, newest first. */
     const list = (caller) => sql.withTransaction(Effect.gen(function* () {
-        yield* authorizeBlobOperation(ontology, sql, caller.principal.id, []);
+        yield* authorizeBlobOperation(ontology, sql, caller.principal.id, [], caller.principal.execution);
         const rows = yield* sql.unsafe(`${SELECT} WHERE a.owner_id = $1::uuid AND a.conversation = $2 AND a.branch_id = $3
              AND a.state IN ('ready', 'promoted') AND a.expires_at > now()
              AND (a.session_id IS NULL OR a.session_id = $4)
@@ -365,7 +365,7 @@ export function attachmentRuntime(ontology, sql, provider) {
                         `${row.content_type}, ${row.size} bytes.`,
                 });
             }
-            yield* authorizeBlobOperation(ontology, sql, caller.principal.id, found.permissions);
+            yield* authorizeBlobOperation(ontology, sql, caller.principal.id, found.permissions, caller.principal.execution);
             const [earlier] = yield* sql.unsafe(`SELECT id::text, promotion FROM "${ATTACHMENTS_TABLE}"
              WHERE sha256 = $1 AND branch_id = $2 AND state = 'promoted' AND id <> $3::uuid
                AND promotion->>'action' = $4 AND promotion->>'deduplicated_from' IS NULL

package/dist/storage/authorization.d.ts

@@ -5,4 +5,4 @@ import { PermissionDenied } from "../errors.js";
 /** Re-read user and roles in the same transaction that authorizes a storage operation. */
 export declare function authorizeBlobOperation(ontology: Ontology, sql: {
     readonly unsafe: (text: string, args: ReadonlyArray<unknown>) => Effect.Effect<ReadonlyArray<Readonly<Record<string, unknown>>>, SqlError>;
-}, principalId: string, required: ReadonlyArray<string>): Effect.Effect<undefined, PermissionDenied | SqlError, never>;
+}, principalId: string, required: ReadonlyArray<string>, execution?: import("../runtime/workload.js").WorkloadExecution): Effect.Effect<undefined, PermissionDenied | SqlError, never>;

package/dist/storage/authorization.js

@@ -2,7 +2,7 @@ import { Effect } from "effect";
 import { missingPermission, permissionsOf } from "../permissions.js";
 import { PermissionDenied } from "../errors.js";
 /** Re-read user and roles in the same transaction that authorizes a storage operation. */
-export function authorizeBlobOperation(ontology, sql, principalId, required) {
+export function authorizeBlobOperation(ontology, sql, principalId, required, execution) {
     return Effect.gen(function* () {
         const [catalog] = yield* sql.unsafe(`SELECT hash FROM "_ontology" WHERE id = true FOR SHARE`, []);
         if (catalog?.hash !== ontology.manifest.hash) {
@@ -10,17 +10,22 @@ export function authorizeBlobOperation(ontology, sql, principalId, required) {
                 message: "The deployed ontology no longer matches the database catalog.",
             });
         }
-        const users = yield* sql.unsafe(`SELECT kind::text, active FROM "user" WHERE id = $1::uuid FOR SHARE`, [principalId]);
+        const users = yield* sql.unsafe(`SELECT kind::text, active, identity_provider, identity_subject FROM "user" WHERE id = $1::uuid FOR SHARE`, [principalId]);
         const user = users[0];
         const roles = yield* sql.unsafe(`SELECT role FROM "_user_roles" WHERE user_id = $1::uuid FOR SHARE`, [principalId]);
         const held = roles.map((row) => String(row.role));
         if (user?.kind === "member") {
             held.push("member");
         }
+        const worker = execution !== undefined &&
+            user?.kind === "service" &&
+            user.identity_provider === "segmentstream-ontology-workload" &&
+            user.identity_subject === `pipeline-workers:${execution.workspaceId}`;
         const missing = missingPermission(required, {
-            permissions: permissionsOf(ontology.roles, held),
+            ...(worker ? { execution } : {}),
+            permissions: worker ? ["*:*"] : permissionsOf(ontology.roles, held),
         });
-        if (!user?.active || missing) {
+        if (!user?.active || missing || (execution !== undefined && !worker)) {
             return yield* new PermissionDenied({
                 message: "The member cannot use this file operation.",
                 ...(missing ? { permission: missing } : {}),

package/dist/storage/sessions.js

@@ -98,7 +98,7 @@ export function blobRuntime(ontology, sql, provider) {
         if (!found || row.manifest_hash !== ontology.manifest.hash) {
             return yield* conflict();
         }
-        yield* authorizeBlobOperation(ontology, sql, principal.id, found.permissions);
+        yield* authorizeBlobOperation(ontology, sql, principal.id, found.permissions, principal.execution);
         return row;
     });
     const begin = (input, principal) => Effect.gen(function* () {
@@ -129,7 +129,7 @@ export function blobRuntime(ontology, sql, provider) {
         const claim = randomUUID();
         const key = `revisions/${blobId}`;
         const reservation = yield* sql.withTransaction(Effect.gen(function* () {
-            yield* authorizeBlobOperation(ontology, sql, principal.id, found.permissions);
+            yield* authorizeBlobOperation(ontology, sql, principal.id, found.permissions, principal.execution);
             if (input.recordId) {
                 yield* makeOntologyRuntime(ontology, sql).get({
                     entity: input.entity,
@@ -310,7 +310,7 @@ export function blobRuntime(ontology, sql, provider) {
             });
         }
         const blob = yield* sql.withTransaction(Effect.gen(function* () {
-            yield* authorizeBlobOperation(ontology, sql, principal.id, [`${entityName}:read`]);
+            yield* authorizeBlobOperation(ontology, sql, principal.id, [`${entityName}:read`], principal.execution);
             let revisionId = input.revisionId;
             if (!revisionId) {
                 const record = yield* makeOntologyRuntime(ontology, sql).get({

package/dist/storage/writes.js

@@ -39,7 +39,7 @@ export function resolveBlobWrites(context, entity, recordId, values, creating) {
                     }
                     return context.run(statement, params);
                 },
-            }, context.scope.principalId, authored ? [authored.permission] : generatedActionPermissions(actionEntity, actionName)).pipe(Effect.catchTag("PermissionDenied", () => Effect.fail(reject())));
+            }, context.scope.principalId, authored ? [authored.permission] : generatedActionPermissions(actionEntity, actionName), context.scope.execution).pipe(Effect.catchTag("PermissionDenied", () => Effect.fail(reject())));
             const params = new Params();
             const rows = yield* context.run(`SELECT u.*, b.id::text AS blob_id, b.filename, b.content_type, b.size::text AS size,
           to_char(b.created_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS created_at

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@segmentstream-cloud/ontology",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Define a SegmentStream workspace app's ontology: entities, relationships, roles and actions, written with Effect.",
   "license": "Apache-2.0",
   "author": "SegmentStream",