@segmentstream-cloud/ontology 0.23.0 → 0.24.1

package/README.md

@@ -500,6 +500,22 @@ usage error.
 `ontology/index.ts`, migrates the workspace database and deploys the service under
 `/api/ontology`. A failure stops the deployment and keeps the running version.
 
+## Development tests
+
+`npm test --workspace @segmentstream-cloud/ontology` runs the ordinary suite with
+embedded PGlite. Authentication contention tests require separate PostgreSQL
+backends and run against a local disposable PostgreSQL server:
+
+```sh
+ONTOLOGY_TEST_ADMIN_URL=postgresql://postgres@127.0.0.1:5432/postgres \
+  npm run test:postgres --workspace @segmentstream-cloud/ontology
+```
+
+The test fixture accepts only a localhost `postgres` admin connection to the
+`postgres` database. It creates a randomly named test database, applies the example
+ontology, and drops that database on completion. Repository CI and the SDK release
+gate run this suite with PostgreSQL 17.
+
 ## License
 
 Apache-2.0

package/dist/index.d.ts

@@ -53,6 +53,7 @@ export { makeOntologyRuntime } from "./runtime/sql-runtime.js";
 export type { SqlOntologyRuntime, WriteScope } from "./runtime/sql-runtime.js";
 export { BASE_PATH, deriveApi } from "./service/api.js";
 export type { DeriveApiOptions, OntologyApi } from "./service/api.js";
+export { WorkloadExecution } from "./runtime/workload.js";
 export { CurrentPrincipal } from "./service/authentication.js";
 export { deployedConnections, LocalConnectionContextError, localConnections, OIDC_TOKEN_HEADER, parseLocalConnectionContext, readLocalConnectionContext, RUNTIME_CONTEXT_FD, } from "./service/connections.js";
 export type { ConnectionAudit, ConnectionTransportFactory, LocalConnection, LocalConnectionContext, } from "./service/connections.js";

package/dist/index.js

@@ -31,6 +31,7 @@ export { backendLayer, postgresLayer, sqlServiceRuntime } from "./runtime/servic
 export { makeOntologyRuntime } from "./runtime/sql-runtime.js";
 // The HTTP service derived from the ontology.
 export { BASE_PATH, deriveApi } from "./service/api.js";
+export { WorkloadExecution } from "./runtime/workload.js";
 export { CurrentPrincipal } from "./service/authentication.js";
 export { deployedConnections, LocalConnectionContextError, localConnections, OIDC_TOKEN_HEADER, parseLocalConnectionContext, readLocalConnectionContext, RUNTIME_CONTEXT_FD, } from "./service/connections.js";
 export { configFromEnv, AGENT_HOST_VARIABLE, ENVIRONMENT_VARIABLES, NEON_AUTH_ENVIRONMENT_VARIABLES, OntologyServiceConfigError, RUNTIME_IDENTITY_ENVIRONMENT_VARIABLES, } from "./service/config.js";

package/dist/manifest.d.ts

@@ -449,6 +449,7 @@ export declare const OntologyManifestWire: Schema.encodeKeys<Schema.Struct<{
     }>, {
         readonly builtIn: "built_in";
     }>>;
+    readonly runtimeCapabilities: Schema.optionalKey<Schema.$Array<Schema.String>>;
     readonly version: Schema.Int;
     /** `sha256:` and the hex digest of the canonical JSON of the manifest without `hash`. */
     readonly hash: Schema.String;
@@ -619,6 +620,7 @@ export declare const OntologyManifest: Schema.Union<readonly [Schema.encodeKeys<
     }>, {
         readonly builtIn: "built_in";
     }>>;
+    readonly runtimeCapabilities: Schema.optionalKey<Schema.$Array<Schema.String>>;
     readonly version: Schema.Int;
     /** `sha256:` and the hex digest of the canonical JSON of the manifest without `hash`. */
     readonly hash: Schema.String;
@@ -653,6 +655,7 @@ export declare const OntologyManifest: Schema.Union<readonly [Schema.encodeKeys<
 }>, {
     readonly signIn: "sign_in";
 }>, Schema.Struct<{
+    readonly runtimeCapabilities: Schema.optionalKey<Schema.$Array<Schema.String>>;
     readonly version: Schema.Int;
     /** `sha256:` and the hex digest of the canonical JSON of the manifest without `hash`. */
     readonly hash: Schema.String;
@@ -929,6 +932,7 @@ export declare const decodeManifestDocument: (value: unknown) => Effect.Effect<{
         readonly key: string;
         readonly description: string;
     }[] | undefined;
+    readonly runtimeCapabilities?: readonly string[] | undefined;
     readonly signIn?: {
         readonly policy: string;
     } | undefined;
@@ -1047,6 +1051,7 @@ export declare const decodeManifestDocument: (value: unknown) => Effect.Effect<{
         readonly key: string;
         readonly description: string;
     }[] | undefined;
+    readonly runtimeCapabilities?: readonly string[] | undefined;
     readonly signIn?: {
         readonly policy: string;
     } | undefined;

package/dist/manifest.js

@@ -213,6 +213,7 @@ export const SignInManifest = Schema.Struct({
  * `onDelete`) are validated because the migration planner must map every value to storage.
  */
 const OntologyManifestModel = Schema.Struct({
+    runtimeCapabilities: Schema.optionalKey(Schema.Array(Schema.String)),
     version: Schema.Int,
     /** `sha256:` and the hex digest of the canonical JSON of the manifest without `hash`. */
     hash: Schema.String,
@@ -462,6 +463,7 @@ export function buildManifest(input) {
         .map((candidate) => candidate.name));
     const body = {
         version: MANIFEST_VERSION,
+        runtimeCapabilities: ["pipeline-workload-tokens-v1"],
         entities: input.entities.map((candidate) => entityManifest({ resolved: candidate, warehouseBacked })),
         roles: input.roles.map((candidate) => ({
             name: candidate.name,

package/dist/migrate/apply.js

@@ -7,7 +7,7 @@ import { REPLICATION_DDL, REPLICATION_SCHEMA_VERSION, replicationEntityDdl, } fr
 import { replicationMigrationRefusals } from "../replication/migrate.js";
 import { ATTACHMENTS_TABLE } from "../storage/tables.js";
 import { resolveReplicationSelection, } from "../replication/model.js";
-import { AGENT_TABLES, API_KEYS_TABLE, CATALOG_TABLE, OAUTH_TABLES, USER_ROLES_TABLE, quoteIdentifier, quoteLiteral, } from "./storage.js";
+import { ACTION_ATTRIBUTION_TABLE, AGENT_TABLES, API_KEYS_TABLE, CATALOG_TABLE, OAUTH_TABLES, USER_ROLES_TABLE, quoteIdentifier, quoteLiteral, } from "./storage.js";
 const CATALOG = quoteIdentifier(CATALOG_TABLE);
 /** Serializes migrations of one database; transaction-scoped, so it ends with the transaction. */
 const MIGRATION_LOCK = "segmentstream.ontology.migration";
@@ -180,6 +180,7 @@ export const applyMigration = (plan, options) => Effect.gen(function* () {
  */
 /** The runtime's tables, beside the catalog and the entity tables. */
 export const RUNTIME_TABLES = [
+    ACTION_ATTRIBUTION_TABLE,
     USER_ROLES_TABLE,
     API_KEYS_TABLE,
     ...OAUTH_TABLES,

package/dist/migrate/model.d.ts

@@ -152,6 +152,7 @@ export declare const MigrationPlan: Schema.Struct<{
         }>, {
             readonly builtIn: "built_in";
         }>>;
+        readonly runtimeCapabilities: Schema.optionalKey<Schema.$Array<Schema.String>>;
         readonly version: Schema.Int;
         readonly hash: Schema.String;
         readonly signIn: Schema.optionalKey<Schema.Struct<{
@@ -174,6 +175,7 @@ export declare const MigrationPlan: Schema.Struct<{
     }>, {
         readonly signIn: "sign_in";
     }>, Schema.Struct<{
+        readonly runtimeCapabilities: Schema.optionalKey<Schema.$Array<Schema.String>>;
         readonly version: Schema.Int;
         readonly hash: Schema.String;
         readonly entities: Schema.$Array<Schema.Struct<{

package/dist/migrate/plan.js

@@ -1,7 +1,7 @@
 import { isValueMatched, } from "../manifest.js";
 import { ATTACHMENTS_TABLE, ATTACHMENT_TABLES_DDL, BLOB_TABLES_DDL } from "../storage/tables.js";
 import { SNAKE_CASE_NAME, isSystemProperty, toSnakeCase } from "../names.js";
-import { AGENT_TABLES, AGENT_TABLES_DDL, CATALOG_TABLE_DDL, MAX_IDENTIFIER_LENGTH, OAUTH_TABLES, OAUTH_TABLES_DDL, USER_TABLE, addConstraintStatement, columnDefinition, constraintDefinition, createEnumStatement, createIndexStatement, createTableStatement, defaultExpression, entityStorage, enumTypeName, fieldColumnName, joinTable, propertyCheck, blobForeignKey, propertyColumn, propertyEnum, quoteIdentifier, quoteLiteral, relationshipColumn, RUNTIME_TABLES_DDL, relationshipForeignKey, SYSTEM_COLUMNS, tableName, } from "./storage.js";
+import { ACTION_ATTRIBUTION_TABLE, ACTION_ATTRIBUTION_DDL, AGENT_TABLES, AGENT_TABLES_DDL, CATALOG_TABLE_DDL, MAX_IDENTIFIER_LENGTH, OAUTH_TABLES, OAUTH_TABLES_DDL, USER_TABLE, addConstraintStatement, columnDefinition, constraintDefinition, createEnumStatement, createIndexStatement, createTableStatement, defaultExpression, entityStorage, enumTypeName, fieldColumnName, joinTable, propertyCheck, blobForeignKey, propertyColumn, propertyEnum, quoteIdentifier, quoteLiteral, relationshipColumn, RUNTIME_TABLES_DDL, relationshipForeignKey, SYSTEM_COLUMNS, tableName, } from "./storage.js";
 const GLOBAL_KINDS = new Set(["table", "type", "index"]);
 function step(input) {
     return {
@@ -77,6 +77,14 @@ export function planMigration(input) {
     else {
         // A database an earlier SDK migrated lacks the tables added since; each set arrives on its own.
         const lacks = (tables) => tables.some((table) => input.existingTables?.has(table) === false);
+        if (lacks([ACTION_ATTRIBUTION_TABLE])) {
+            draft.runtimeTables.push(step({
+                kind: "createCatalog",
+                classification: "additive",
+                description: "Create the runtime's verified pipeline action attribution table.",
+                sql: ACTION_ATTRIBUTION_DDL,
+            }));
+        }
         if (lacks(OAUTH_TABLES)) {
             draft.runtimeTables.push(step({
                 kind: "createCatalog",

package/dist/migrate/storage.d.ts

@@ -180,6 +180,9 @@ export declare const AGENT_TABLES_DDL: ReadonlyArray<string>;
  * The runtime's own tables beside the catalog. They are created with it, after the entity tables
  * because they refer to the built-in user table, and every statement is idempotent.
  */
+export declare const ACTION_ATTRIBUTION_TABLE = "_ontology_action_attribution";
+/** Runtime audit metadata deliberately has no foreign key: deleted records retain their history. */
+export declare const ACTION_ATTRIBUTION_DDL: ReadonlyArray<string>;
 export declare const RUNTIME_TABLES_DDL: ReadonlyArray<string>;
 export declare function columnDefinition(column: ColumnStorage): string;
 export declare function constraintDefinition(constraint: {

package/dist/migrate/storage.js

@@ -575,7 +575,17 @@ export const AGENT_TABLES_DDL = [
  * The runtime's own tables beside the catalog. They are created with it, after the entity tables
  * because they refer to the built-in user table, and every statement is idempotent.
  */
+export const ACTION_ATTRIBUTION_TABLE = "_ontology_action_attribution";
+/** Runtime audit metadata deliberately has no foreign key: deleted records retain their history. */
+export const ACTION_ATTRIBUTION_DDL = [
+    `CREATE TABLE IF NOT EXISTS "${ACTION_ATTRIBUTION_TABLE}" (
+    "action_id" uuid PRIMARY KEY,
+    "execution" jsonb NOT NULL,
+    "at" timestamptz NOT NULL DEFAULT now()
+  )`,
+];
 export const RUNTIME_TABLES_DDL = [
+    ...ACTION_ATTRIBUTION_DDL,
     [
         `CREATE TABLE IF NOT EXISTS ${quoteIdentifier(USER_ROLES_TABLE)} (`,
         `  "user_id" uuid NOT NULL,`,

package/dist/permissions.d.ts

@@ -33,6 +33,7 @@ export declare function permissionOf(entity: string, verb: string): string;
 export declare function grants(granted: string, required: string): boolean;
 /** Anything that holds permissions: a principal, or the reader of a catalog. */
 export interface PermissionHolder {
+    readonly execution?: import("./runtime/workload.js").WorkloadExecution;
     readonly permissions: ReadonlyArray<string>;
 }
 /**
@@ -40,6 +41,8 @@ export interface PermissionHolder {
  * through a wildcard.
  */
 export declare function isAllowed(required: string, principal: PermissionHolder): boolean;
+/** Expand workload authority for permission-only catalog and documentation readers. */
+export declare function effectivePermissions(principal: PermissionHolder): ReadonlyArray<string>;
 /** The first of the required permissions the principal lacks, or `undefined` when it holds all. */
 export declare function missingPermission(required: ReadonlyArray<string>, principal: PermissionHolder): string | undefined;
 /**

package/dist/permissions.js

@@ -52,7 +52,14 @@ export function grants(granted, required) {
  * through a wildcard.
  */
 export function isAllowed(required, principal) {
-    return principal.permissions.some((granted) => grants(granted, required));
+    return ((principal.execution !== undefined && principal.permissions.includes("*:*")) ||
+        principal.permissions.some((granted) => grants(granted, required)));
+}
+/** Expand workload authority for permission-only catalog and documentation readers. */
+export function effectivePermissions(principal) {
+    return principal.execution !== undefined && principal.permissions.includes("*:*")
+        ? [...principal.permissions, ...Array.from(EXPLICIT_GRANT_ENTITIES, (entity) => `${entity}:*`)]
+        : principal.permissions;
 }
 /** The first of the required permissions the principal lacks, or `undefined` when it holds all. */
 export function missingPermission(required, principal) {

package/dist/runtime/history.d.ts

@@ -1,4 +1,5 @@
 import { Schema } from "effect";
+import { WorkloadExecution } from "./workload.js";
 import type { StoredRecord } from "../runtime.js";
 import type { EntityModel } from "./model.js";
 import type { Params } from "./statement.js";
@@ -31,6 +32,26 @@ export declare const Edit: Schema.Struct<{
 export type Edit = typeof Edit.Type;
 /** A row of `<entity>_history`. */
 export declare const HistoryEntry: Schema.Struct<{
+    readonly execution: Schema.optionalKey<Schema.Struct<{
+        readonly issuer: Schema.String;
+        readonly audience: Schema.String;
+        readonly organizationId: Schema.String;
+        readonly workspaceId: Schema.String;
+        readonly subject: Schema.String;
+        readonly deploymentId: Schema.String;
+        readonly ontologyDeploymentId: Schema.String;
+        readonly servingOntologyDeploymentId: Schema.String;
+        readonly ontologyOrigin: Schema.String;
+        readonly environment: Schema.Literal<"production">;
+        readonly jobName: Schema.String;
+        readonly runId: Schema.String;
+        readonly executionId: Schema.NullOr<Schema.String>;
+        readonly attemptId: Schema.String;
+        readonly generation: Schema.Number;
+        readonly tokenId: Schema.String;
+        readonly issuedAt: Schema.Number;
+        readonly expiresAt: Schema.Number;
+    }>>;
     readonly id: Schema.String;
     readonly recordId: Schema.String;
     /** The qualified action, for example `lead.changeStatus`. */
@@ -54,6 +75,7 @@ export interface HistoryWrite {
     readonly edit: Edit;
 }
 export interface HistoryScope {
+    readonly execution?: WorkloadExecution;
     readonly action: string;
     readonly actionId: string;
     readonly principalId: string | null;

package/dist/runtime/history.js

@@ -1,5 +1,6 @@
 import { Schema } from "effect";
 import { canonicalJson } from "../manifest.js";
+import { WorkloadExecution } from "./workload.js";
 import { quoteIdentifier } from "../migrate/storage.js";
 import { uuidv7 } from "./ids.js";
 export const EditKind = Schema.Literals(["create", "update", "delete", "link", "unlink"]);
@@ -21,6 +22,7 @@ export const Edit = Schema.Struct({
 });
 /** A row of `<entity>_history`. */
 export const HistoryEntry = Schema.Struct({
+    execution: Schema.optionalKey(WorkloadExecution),
     id: Schema.String,
     recordId: Schema.String,
     /** The qualified action, for example `lead.changeStatus`. */

package/dist/runtime/pipeline.js

@@ -141,7 +141,7 @@ export function runAction(ontology, request) {
         if (consumesUpload) {
             const saved = yield* sql
                 .withTransaction(Effect.gen(function* () {
-                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions);
+                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions, request.principal.execution);
                 const [saved] = yield* sql.unsafe(`SELECT fingerprint, outcome FROM "_blob_action_results"
                WHERE principal_id = $1::uuid AND key = $2`, [request.principal.id, key]);
                 if (saved && saved.fingerprint !== fingerprint) {
@@ -168,6 +168,7 @@ export function runAction(ontology, request) {
             action: qualified,
             actionId,
             principalId: request.principal.id,
+            ...(request.principal.execution ? { execution: request.principal.execution } : {}),
             ...(key ? { blobActionKey: key } : {}),
             ...(request.branchId ? { branchId: request.branchId } : {}),
             ...(request.options?.createIntent ? { createIntent: request.options.createIntent } : {}),
@@ -177,8 +178,11 @@ export function runAction(ontology, request) {
         const handler = Effect.suspend(() => handle({ ...context, prepared }));
         let replay;
         const transactionalHandler = Effect.gen(function* () {
+            if (request.principal.execution !== undefined) {
+                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions, request.principal.execution);
+            }
             if (consumesUpload) {
-                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions);
+                yield* authorizeBlobOperation(ontology, sql, request.principal.id, found.permissions, request.principal.execution);
                 yield* sql.unsafe(`INSERT INTO "_blob_action_results" (principal_id, key, fingerprint)
           VALUES ($1::uuid, $2, $3) ON CONFLICT DO NOTHING`, [request.principal.id, key, fingerprint]);
                 const [saved] = yield* sql.unsafe(`SELECT fingerprint, outcome FROM "_blob_action_results" WHERE principal_id = $1::uuid AND key = $2

package/dist/runtime/principals.d.ts

@@ -46,9 +46,12 @@ export declare const SIGN_IN_RECORD_INTERVAL_MS: number;
  * is linked by email when someone invited them; a person nobody invited is rejected as
  * `not_invited` under the `invited` policy and becomes a member holding only `member` under
  * `open`. Every sign-in that lets the member in sets `lastSignInAt`, at most once per
- * {@link SIGN_IN_RECORD_INTERVAL_MS}, so history keeps it. Inactive users are rejected.
+ * {@link SIGN_IN_RECORD_INTERVAL_MS}, so history keeps it. If the User row is busy, recording is
+ * deferred to a later request instead of delaying authentication. Inactive users are rejected.
  */
 export declare function resolvePrincipalByIdentity(ontology: Ontology, claims: IdentityClaims): Effect.Effect<Principal, PrincipalRejected, SqlClient.SqlClient>;
+/** Resolve the workspace's stable keyless pipeline service, without customer roles or sign-in. */
+export declare function resolvePipelineWorker(ontology: Ontology, execution: import("./workload.js").WorkloadExecution): Effect.Effect<Principal, PrincipalRejected, SqlClient.SqlClient>;
 /**
  * The principal of an API key, with the permissions its roles have in the ontology. Unknown and
  * revoked keys and inactive users are rejected.

package/dist/runtime/principals.js

@@ -15,7 +15,7 @@ import { beginReplicationWrite } from "../replication/transaction.js";
 import { User } from "../user.js";
 import { MemberNotFound, PrincipalRejected, UnknownRole } from "./errors.js";
 import { isRecordId } from "./records.js";
-import { makeOntologyRuntime } from "./sql-runtime.js";
+import { makeOntologyRuntime, makePrincipalUserWriter, } from "./sql-runtime.js";
 /** API keys are `ssk_<key id>.<secret>`. */
 export const API_KEY_PREFIX = "ssk_";
 /**
@@ -107,93 +107,116 @@ function userRow(record) {
     return decodeUser({ id: record.id, kind: record.kind, active: record.active });
 }
 /**
- * Finds, links or creates the member's user, in one transaction, and records the sign-in on it. A
+ * Finds the member's user without locking. Links or creates it transactionally when needed. A
  * user linked to this identity is found; else a member invited with the same email is linked; else
  * the ontology's sign-in policy decides: `invited` turns the person away, `open` creates a member.
  */
 function signIn(ontology, sql, claims) {
-    const runtime = platformRuntime(ontology, sql, "user.sign_in");
+    const runtime = makeOntologyRuntime(ontology, sql);
+    const writer = makePrincipalUserWriter(ontology, sql, {
+        action: "user.sign_in",
+        actionId: randomUUID(),
+    });
     const claimedEmail = claims.email?.trim().toLowerCase();
     const email = claimedEmail !== undefined && EMAIL_PATTERN.test(claimedEmail) ? claimedEmail : undefined;
-    return sql
-        .withTransaction(Effect.gen(function* () {
-        yield* beginReplicationWrite(sql);
-        const now = new Date();
-        const signedIn = { last_sign_in_at: now.toISOString() };
-        const [linked] = yield* runtime.find({
-            entity: "user",
-            options: {
-                where: {
-                    identity_provider: claims.identityProvider,
-                    identity_subject: claims.identitySubject,
-                },
-                limit: 1,
-                forUpdate: true,
+    const findLinked = (forUpdate = false) => runtime.find({
+        entity: "user",
+        options: {
+            where: {
+                identity_provider: claims.identityProvider,
+                identity_subject: claims.identitySubject,
             },
-        });
-        if (linked !== undefined) {
-            // An inactive user is turned away, which is not a sign-in to record.
-            if (linked.active !== true || !signInDue(linked.last_sign_in_at, now)) {
-                return userRow(linked);
+            limit: 1,
+            forUpdate,
+        },
+    });
+    const member = (record) => record.kind === "member"
+        ? Effect.succeed(userRow(record))
+        : Effect.fail(new PrincipalRejected({
+            reason: "identity_conflict",
+            message: "This identity belongs to a service, not a member.",
+        }));
+    return Effect.gen(function* () {
+        const [known] = yield* findLinked();
+        if (known !== undefined) {
+            const user = yield* member(known);
+            // Ordinary authentication is read-only. Optional bookkeeping must never queue behind a
+            // business transaction holding a User key or row lock; a later request can record it.
+            if (!user.active || !writer.recordsSignIn || !signInDue(known.last_sign_in_at, new Date())) {
+                return user;
             }
-            const returning = yield* runtime.update({
-                entity: "user",
-                id: linked.id,
-                values: signedIn,
-            });
-            return userRow(returning);
+            return yield* sql.withTransaction(Effect.gen(function* () {
+                const [locked] = yield* sql.unsafe(`SELECT "id" FROM "${USER_TABLE}" WHERE "id" = $1::uuid FOR UPDATE SKIP LOCKED`, [user.id]);
+                if (locked === undefined) {
+                    return user;
+                }
+                const current = yield* runtime.get({ entity: "user", id: user.id });
+                const principal = yield* member(current);
+                const now = new Date();
+                if (principal.active && signInDue(current.last_sign_in_at, now)) {
+                    yield* writer.update(user.id, { last_sign_in_at: now.toISOString() });
+                }
+                return principal;
+            }));
         }
-        const [invited] = email === undefined
-            ? []
-            : yield* runtime.find({
-                entity: "user",
-                options: { where: { email }, limit: 1, forUpdate: true },
-            });
-        if (invited !== undefined) {
-            if (invited.kind !== "member" || invited.identity_subject !== null) {
-                return yield* new PrincipalRejected({
-                    reason: "identity_conflict",
-                    message: "Another user already has this email.",
-                });
+        return yield* sql.withTransaction(Effect.gen(function* () {
+            const now = new Date();
+            const signedIn = writer.recordsSignIn ? { last_sign_in_at: now.toISOString() } : {};
+            const [linked] = yield* findLinked(true);
+            if (linked !== undefined) {
+                return yield* member(linked);
             }
-            const linkedUser = yield* runtime.update({
-                entity: "user",
-                id: invited.id,
-                values: {
+            const [invited] = email === undefined
+                ? []
+                : yield* runtime.find({
+                    entity: "user",
+                    options: { where: { email }, limit: 1, forUpdate: true },
+                });
+            if (invited !== undefined) {
+                // A concurrent first sign-in may have linked this invitation while this transaction
+                // waited for its row. Accept the exact identity; another identity still conflicts.
+                if (invited.identity_provider === claims.identityProvider &&
+                    invited.identity_subject === claims.identitySubject) {
+                    return yield* member(invited);
+                }
+                if (invited.kind !== "member" || invited.identity_subject !== null) {
+                    return yield* new PrincipalRejected({
+                        reason: "identity_conflict",
+                        message: "Another user already has this email.",
+                    });
+                }
+                const linkedUser = yield* writer.update(invited.id, {
                     identity_provider: claims.identityProvider,
                     identity_subject: claims.identitySubject,
                     ...(invited.active === true ? signedIn : {}),
-                },
-            });
-            return userRow(linkedUser);
-        }
-        if (ontology.signIn.policy !== "open") {
-            return yield* new PrincipalRejected({
-                reason: "not_invited",
-                message: "No member was invited with this identity or email.",
-            });
-        }
-        const created = yield* runtime.create({
-            entity: "user",
-            values: {
+                });
+                return userRow(linkedUser);
+            }
+            if (ontology.signIn.policy !== "open") {
+                return yield* new PrincipalRejected({
+                    reason: "not_invited",
+                    message: "No member was invited with this identity or email.",
+                });
+            }
+            const created = yield* writer.create({
                 name: claims.name?.trim() || email || claims.identitySubject,
                 email: email ?? null,
                 kind: "member",
                 identity_provider: claims.identityProvider,
                 identity_subject: claims.identitySubject,
                 ...signedIn,
-            },
-        });
-        return userRow(created);
-    }))
-        .pipe(Effect.catchTag("NotFound", (error) => Effect.die(error)));
+            });
+            return userRow(created);
+        }));
+    }).pipe(Effect.catchTag("NotFound", (error) => Effect.die(error)));
 }
 /**
  * The principal of a member signed in with a verified token. On first sign-in the member's `user`
  * is linked by email when someone invited them; a person nobody invited is rejected as
  * `not_invited` under the `invited` policy and becomes a member holding only `member` under
  * `open`. Every sign-in that lets the member in sets `lastSignInAt`, at most once per
- * {@link SIGN_IN_RECORD_INTERVAL_MS}, so history keeps it. Inactive users are rejected.
+ * {@link SIGN_IN_RECORD_INTERVAL_MS}, so history keeps it. If the User row is busy, recording is
+ * deferred to a later request instead of delaying authentication. Inactive users are rejected.
  */
 export function resolvePrincipalByIdentity(ontology, claims) {
     return Effect.gen(function* () {
@@ -207,6 +230,61 @@ export function resolvePrincipalByIdentity(ontology, claims) {
         return yield* activePrincipal(ontology, sql, user);
     }).pipe(Effect.catchIf(isSqlError, (error) => Effect.die(error)));
 }
+/** Resolve the workspace's stable keyless pipeline service, without customer roles or sign-in. */
+export function resolvePipelineWorker(ontology, execution) {
+    return Effect.gen(function* () {
+        const sql = yield* SqlClient.SqlClient;
+        const provider = "segmentstream-ontology-workload";
+        const subject = `pipeline-workers:${execution.workspaceId}`;
+        const runtime = platformRuntime(ontology, sql, "user.resolve_pipeline_worker");
+        const principal = (user) => user.kind !== "service" || user.active !== true
+            ? Effect.fail(new PrincipalRejected({
+                reason: "inactive_user",
+                message: "The pipeline worker principal is inactive or has an invalid kind.",
+            }))
+            : Effect.succeed({
+                id: user.id,
+                kind: "service",
+                roles: [],
+                permissions: ["*:*"],
+                execution,
+            });
+        const find = (forUpdate) => runtime.find({
+            entity: "user",
+            options: {
+                where: { identity_provider: provider, identity_subject: subject },
+                limit: 1,
+                forUpdate,
+            },
+        });
+        const [known] = yield* find(false);
+        // Returning requests only read the principal; writes revalidate it in their transaction.
+        if (known !== undefined) {
+            return yield* principal(known);
+        }
+        return yield* sql
+            .withTransaction(Effect.gen(function* () {
+            // The replication lock precedes every business lock, including principal initialization.
+            yield* beginReplicationWrite(sql);
+            yield* sql.unsafe("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [
+                provider + ":" + subject,
+            ]);
+            const [existing] = yield* find(true);
+            const user = existing ??
+                (yield* runtime.create({
+                    entity: "user",
+                    values: {
+                        name: "Pipeline workers",
+                        kind: "service",
+                        identity_provider: provider,
+                        identity_subject: subject,
+                    },
+                }));
+            return yield* principal(user);
+        }))
+            .pipe(Effect.catchTag("Conflict", (error) => Effect.die(error)), Effect.catchTag("NotFound", (error) => Effect.die(error)));
+    }).pipe(Effect.catchIf(isSqlError, (error) => Effect.die(error)));
+}
 /**
  * The principal of an API key, with the permissions its roles have in the ontology. Unknown and
  * revoked keys and inactive users are rejected.

package/dist/runtime/reads.js

@@ -238,17 +238,25 @@ export function readHistory(context, entity, input) {
             const at = params.add(cursor[0], "timestamptz");
             conditions.push(`("h"."at" < ${at} OR ("h"."at" = ${at} AND "h"."id" < ${params.add(cursor[1], "uuid")}))`);
         }
+        const presenceParams = new Params();
+        const [presence] = yield* context.run("SELECT to_regclass('_ontology_action_attribution') IS NOT NULL AS present", presenceParams);
+        const attribution = presence?.present === true;
         const rows = yield* context.run(`SELECT "h"."id"::text AS "id", "h"."record_id"::text AS "recordId", "h"."action" AS "action", ` +
             `"h"."action_id"::text AS "actionId", "h"."kind" AS "kind", ` +
             `"h"."principal_id"::text AS "principalId", ` +
             `to_char("h"."at" AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') AS "at", ` +
             `"h"."changes"::text AS "changes" ` +
+            (attribution ? `, "a"."execution" AS "execution" ` : "") +
             `FROM ${quoteIdentifier(entity.historyTable)} AS "h" ` +
+            (attribution
+                ? `LEFT JOIN "_ontology_action_attribution" AS "a" ON "a"."action_id" = "h"."action_id" `
+                : "") +
             `WHERE ${conditions.join(" AND ")} ` +
             `ORDER BY "h"."at" DESC, "h"."id" DESC ` +
             `LIMIT ${params.add(limit + 1, "bigint")}`, params);
         const items = rows.slice(0, limit).map((row) => Schema.decodeUnknownSync(HistoryEntry)({
-            ...row,
+            ...Object.fromEntries(Object.entries(row).filter(([key, value]) => key !== "execution" || value != null)),
+            ...(row.execution == null ? {} : { execution: row.execution }),
             at: canonicalInstant(String(row.at)),
             changes: JSON.parse(String(row.changes)),
         }));

package/dist/runtime/service-binding.js

@@ -11,7 +11,7 @@ import { sqlAgentStore } from "./agents.js";
 import { generatedActions } from "./generated-actions.js";
 import { sqlOAuthStore } from "./oauth.js";
 import { runAction } from "./pipeline.js";
-import { checkSignIn, resolvePrincipalByApiKey, resolvePrincipalByIdentity } from "./principals.js";
+import { checkSignIn, resolvePrincipalByApiKey, resolvePrincipalByIdentity, resolvePipelineWorker, } from "./principals.js";
 import { postgresTls } from "./postgres-tls.js";
 import { makeOntologyRuntime } from "./sql-runtime.js";
 /** Connections one service instance holds to the database's pooler. */
@@ -61,6 +61,7 @@ export function backendLayer(ontology, blobStorage) {
             })).pipe(Effect.catchTag("PrincipalRejected", (rejection) => rejection.reason === "not_invited"
                 ? rejectedAs("sign_in")(rejection).pipe(Effect.andThen(Effect.fail(new NotInvited({ message: rejection.message }))))
                 : rejectedAs("sign_in")(rejection))),
+            resolvePipelineWorker: (execution) => withSql(resolvePipelineWorker(ontology, execution)).pipe(Effect.catchTag("PrincipalRejected", rejectedAs("pipeline_worker"))),
             checkSignIn: (email) => withSql(checkSignIn(ontology, email)),
             resolveApiKey: (key) => withSql(resolvePrincipalByApiKey(ontology, Redacted.value(key))).pipe(Effect.catchTag("PrincipalRejected", rejectedAs("api_key"))),
             appliedHash: readCatalog({ sql }).pipe(Effect.map((manifest) => manifest?.hash), Effect.orDie),