@segmentstream/ontology 0.0.0-stage → 0.92.0

package/dist/runtime/resolve-agent-identity.js

@@ -0,0 +1,181 @@
+import { randomUUID } from "node:crypto";
+import { Effect, Option, Schema } from "effect";
+import { isSqlError } from "effect/unstable/sql/SqlError";
+import { Conflict } from "../errors.js";
+import { channelPolicyOf } from "../manifest.js";
+import { AGENT_IDENTITIES_TABLE, CHANNEL_USERS_TABLE } from "../migrate/storage.js";
+import { countAgentAttempt, effectiveChannelLimits } from "./agent-counters.js";
+import { runNewUserHook } from "./new-user-hook.js";
+import { makePrincipalUserWriter } from "./sql-runtime.js";
+import { makeIdentityWriter, USER_IDENTITY_TABLE } from "./user-identities.js";
+class RegistrationCapped extends Schema.TaggedError()("RegistrationCapped", {
+    limit: Schema.Int,
+}) {
+}
+function uniqueFailure(error) {
+    const sqlError = error instanceof Conflict ? error.cause : error;
+    if (!isSqlError(sqlError)) {
+        return false;
+    }
+    const cause = sqlError.reason.cause;
+    return sqlError.reason._tag === "UniqueViolation" || cause?.code === "23505";
+}
+/** Account admission shares pairing's lock and creates User plus identity in one transaction. */
+export function resolveAgentIdentity(ontology, sql, store, input, context = "agent") {
+    const contact = input.turn || context === "channel_app";
+    const policy = effectiveChannelLimits(sql, input.limits);
+    const account = `${input.provider}:${input.externalId}`;
+    const attempt = sql.withTransaction(Effect.gen(function* () {
+        const limits = yield* effectiveChannelLimits(sql);
+        yield* sql.unsafe(`SELECT pg_advisory_xact_lock(hashtext($1))`, [`account:${account}`]);
+        let identity = yield* store.findIdentity(input);
+        let created = false;
+        if (identity !== undefined && identity.revokedAt !== null) {
+            return { status: "refused", reason: "blocked" };
+        }
+        if (identity === undefined) {
+            if (!contact ||
+                input.chat !== "private" ||
+                channelPolicyOf(ontology.manifest, input.provider) !== "open") {
+                return { status: "pairing_required" };
+            }
+            const limited = yield* countAgentAttempt(sql, {
+                scope: "newUsersPerHour",
+                subject: "workspace",
+                window: "hour",
+                limit: limits.newUsersPerHour,
+            });
+            if (limited !== undefined) {
+                // Roll back admission's increment as well as every possible provisioning write.
+                return yield* new RegistrationCapped({ limit: limits.newUsersPerHour });
+            }
+            const display = input.display?.trim() || null;
+            const username = input.username?.trim().replace(/^@/, "");
+            const providerName = input.provider.charAt(0).toUpperCase() + input.provider.slice(1);
+            const actionId = randomUUID();
+            const writer = makePrincipalUserWriter(ontology, sql, {
+                action: "user.provision",
+                actionId,
+            });
+            const user = yield* writer.create({
+                kind: "member",
+                name: display || (username ? `@${username}` : `${providerName} ${input.externalId}`),
+                email: null,
+                identity_provider: null,
+                identity_subject: null,
+            });
+            // The channel account is a `user_identity` record; `_agent_identities` keeps its id too.
+            const identityId = randomUUID();
+            yield* makeIdentityWriter(ontology, sql, {
+                action: `${USER_IDENTITY_TABLE}.provision`,
+                actionId,
+            }).create({
+                id: identityId,
+                provider: input.provider,
+                issuer: null,
+                subject: input.externalId,
+                userId: String(user.id),
+                origin: "channel",
+                display,
+                username: username || null,
+            });
+            yield* sql.unsafe(`INSERT INTO "${AGENT_IDENTITIES_TABLE}"
+             ("id", "provider", "external_id", "user_id", "display", "origin")
+           VALUES ($1::uuid, $2, $3, $4::uuid, $5, 'provisioned')`, [identityId, input.provider, input.externalId, String(user.id), display]);
+            yield* sql.unsafe(`INSERT INTO "${CHANNEL_USERS_TABLE}" ("user_id", "created_via") VALUES ($1::uuid, $2)`, [String(user.id), input.provider]);
+            created = true;
+            identity = yield* store.findIdentity(input);
+        }
+        if (identity === undefined) {
+            return yield* Effect.die(new Error("Provisioning did not create an identity."));
+        }
+        const [lifecycle] = yield* sql.unsafe(`SELECT "created_via", "blocked_at" IS NOT NULL AS "blocked",
+         "on_new_user_completed_at" IS NOT NULL AS "completed"
+         FROM "${CHANNEL_USERS_TABLE}" WHERE "user_id" = $1::uuid`, [identity.userId]);
+        if (lifecycle?.blocked) {
+            return { status: "refused", reason: "blocked" };
+        }
+        const member = yield* store.member(identity.userId);
+        if (member === undefined) {
+            return { status: "refused", reason: "inactive" };
+        }
+        // The account's current name and username; history records a change, never a repeat.
+        const described = {};
+        const display = input.display === undefined ? undefined : input.display?.trim() || null;
+        const username = input.username === undefined ? undefined : input.username.trim().replace(/^@/, "") || null;
+        if (display !== undefined && display !== identity.display) {
+            described.display = display;
+        }
+        if (username !== undefined && username !== (identity.username ?? null)) {
+            described.username = username;
+        }
+        // `user_identity` first, then `_agent_identities`: the order revoking an account locks them in.
+        if (Object.keys(described).length > 0) {
+            yield* makeIdentityWriter(ontology, sql, {
+                action: `${USER_IDENTITY_TABLE}.describe`,
+                actionId: randomUUID(),
+            }).describe(identity.id, described);
+        }
+        if (described.display !== undefined) {
+            // @legacy identities.legacy-stores-dual-write
+            yield* sql.unsafe(`UPDATE "${AGENT_IDENTITIES_TABLE}" SET "display" = $2 WHERE "id" = $1::uuid`, [identity.id, described.display]);
+        }
+        if (username !== undefined) {
+            yield* sql.unsafe(`UPDATE "${AGENT_IDENTITIES_TABLE}" SET "username" = $2 WHERE "id" = $1::uuid`, [identity.id, username]);
+        }
+        const provisioned = lifecycle !== undefined && !["invite", "email"].includes(lifecycle.created_via);
+        if (contact &&
+            provisioned &&
+            member.principal.roles.length === 1 &&
+            member.principal.roles[0] === "member") {
+            for (const [scope, subject, window] of [
+                ["turnsPerMinute", identity.userId, "minute"],
+                ["turnsPerDay", identity.userId, "day"],
+                ["workspaceTurnsPerDay", "workspace", "day"],
+            ]) {
+                const limited = yield* countAgentAttempt(sql, {
+                    scope,
+                    subject,
+                    window,
+                    limit: scope === "workspaceTurnsPerDay"
+                        ? limits.workspaceTurnsPerDay
+                        : limits.perSender[scope],
+                });
+                if (limited !== undefined) {
+                    return limited;
+                }
+            }
+        }
+        return {
+            status: created ? "created" : "existing",
+            member: { ...member, principal: { ...member.principal, authenticatedVia: input.provider } },
+            provisioned,
+            noticeDue: provisioned &&
+                (identity.noticedAt === null ||
+                    (input.noticeVersion !== undefined && identity.noticeVersion !== input.noticeVersion) ||
+                    (input.noticeSha256 !== undefined && identity.noticeSha256 !== input.noticeSha256)),
+            onNewUserPending: provisioned && !lifecycle?.completed && ontology.signIn.onNewUser !== undefined,
+        };
+    }));
+    const admission = policy.pipe(Effect.andThen(attempt)).pipe(Effect.catchIf(uniqueFailure, () => attempt), Effect.catchTag("RegistrationCapped", ({ limit }) => 
+    // A separate refusal counter survives admission's rollback. Only its first attempt notifies.
+    countAgentAttempt(sql, {
+        scope: "newUsersPerHour",
+        subject: `refused:${limit}`,
+        window: "hour",
+        limit: 0,
+    }).pipe(Effect.map((limited) => limited))), Effect.flatMap((resolution) => {
+        if ((resolution.status !== "created" && resolution.status !== "existing") ||
+            !resolution.onNewUserPending ||
+            !contact) {
+            return Effect.succeed(resolution);
+        }
+        return runNewUserHook(ontology, sql, resolution.member.principal).pipe(Effect.map((pending) => ({ ...resolution, onNewUserPending: pending })));
+    }), Effect.orDie);
+    return Effect.gen(function* () {
+        if (Option.isSome(yield* Effect.serviceOption(sql.transactionService))) {
+            return yield* Effect.die(new Error("Channel admission must run outside any transaction."));
+        }
+        return yield* admission;
+    });
+}

package/dist/runtime/service-binding.d.ts

@@ -0,0 +1,18 @@
+import { Layer, Redacted } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+import { type SqlError } from "effect/unstable/sql/SqlError";
+import type { BlobStorageBinding } from "../storage/provider.js";
+import type { DeploymentObservation } from "../deployment.js";
+import type { Ontology } from "../ontology.js";
+import { OntologyBackend, type OntologyServiceRuntime } from "../service/runtime-contract.js";
+import { SignInLinks } from "./sign-in-links.js";
+import { WorkflowStarter } from "./workflow-starts.js";
+/** The service's backend on the runtime, over the SQL client in context. */
+export declare function backendLayer(ontology: Ontology, blobStorage?: Redacted.Redacted<BlobStorageBinding>, workflowStarter?: WorkflowStarter["Service"], deployment?: DeploymentObservation, signInLinks?: SignInLinks["Service"]): Layer.Layer<OntologyBackend, never, SqlClient.SqlClient>;
+/**
+ * `@effect/sql-pg` on the pooled `ontology_app` connection string, with the TLS server name a
+ * Neon endpoint needs.
+ */
+export declare function postgresLayer(databaseUrl: Redacted.Redacted<string>): Layer.Layer<SqlClient.SqlClient, SqlError>;
+/** The default runtime of `createOntologyService`: the SQL runtime on the workspace database. */
+export declare const sqlServiceRuntime: OntologyServiceRuntime;

package/dist/runtime/service-binding.js

@@ -0,0 +1,266 @@
+import * as PgClient from "@effect/sql-pg/PgClient";
+import { randomUUID } from "node:crypto";
+import { Effect, Layer, Redacted } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+import { isSqlError } from "effect/unstable/sql/SqlError";
+import { neonBlobProvider } from "../storage/neon.js";
+import { maintainBlobStorage } from "../storage/maintenance.js";
+import { attachmentRuntime } from "../storage/attachments.js";
+import { blobRuntime } from "../storage/sessions.js";
+import { FileAccess, unavailableFiles } from "../storage/file-access.js";
+import { validateDeploymentStorage } from "../storage/provider.js";
+import { readCatalog } from "../migrate/apply.js";
+import { RuntimeDeployment } from "./deployment.js";
+import { NotInvited, OntologyBackend, } from "../service/runtime-contract.js";
+import { WorkflowRecoveryUnavailable } from "./errors.js";
+import { sqlAgentStore } from "./agents.js";
+import { sqlAgentTaskStore } from "./agent-tasks.js";
+import { generatedActions } from "./generated-actions.js";
+import { sqlChannelSessionStore } from "./channel-sessions.js";
+import { sqlOAuthStore } from "./oauth.js";
+import { sqlFederationStore } from "./federation.js";
+import { runAction } from "./pipeline.js";
+import { checkSignIn, resolvePrincipalByApiKey, resolvePrincipalByIdentity, resolvePipelineWorker, resolveHookService, resolveWorkflowUser, } from "./principals.js";
+import { postgresTls } from "./postgres-tls.js";
+import { makeOntologyRuntime } from "./sql-runtime.js";
+import { NEON_AUTH_PROVIDER, SIGN_IN_ORIGIN_SQL, USER_IDENTITY_TABLE, } from "./user-identity-sql.js";
+import { ActionTransactions, makeActionTransactions } from "./action-transactions.js";
+import { SignInLinks } from "./sign-in-links.js";
+import { listStarts, sweepStarts, WorkflowStarter, WorkflowStartFailed, } from "./workflow-starts.js";
+import { reserveWorkflowStart, recordWorkflowSubmission } from "./workflow-admission.js";
+/** Connections one service instance holds to the database's pooler. */
+const MAX_CONNECTIONS = 5;
+/**
+ * A rejected credential answers 401; the reason stays in the operator's logs. Only `not_invited`
+ * reaches the caller, as a 403 telling them to ask for an invitation.
+ */
+function rejectedAs(operation) {
+    return (rejection) => Effect.logWarning("ontology.principal.rejected").pipe(Effect.annotateLogs({
+        operation,
+        reason: rejection.reason,
+        ...(rejection.diagnostic === undefined ? {} : { diagnostic: rejection.diagnostic }),
+    }), Effect.as(undefined));
+}
+/** The service's backend on the runtime, over the SQL client in context. */
+export function backendLayer(ontology, blobStorage, workflowStarter, deployment, signInLinks) {
+    return Layer.effect(OntologyBackend, Effect.gen(function* () {
+        const sql = yield* SqlClient.SqlClient;
+        const runtime = makeOntologyRuntime(ontology, sql);
+        const original = workflowStarter;
+        const boundStarter = original?.prepare
+            ? {
+                ...original,
+                start: (start) => original.prepare(start).pipe(Effect.flatMap((prepared) => reserveWorkflowStart(sql, ontology, prepared)), Effect.flatMap((admitted) => original
+                    .start(admitted)
+                    .pipe(Effect.tap(() => recordWorkflowSubmission(sql, admitted)))), Effect.mapError((cause) => cause instanceof WorkflowStartFailed
+                    ? cause
+                    : new WorkflowStartFailed({
+                        reason: "engine",
+                        message: "Durable workflow admission failed.",
+                        cause,
+                    }))),
+                ensureRecovery: (input) => original.ensureRecovery({
+                    ...input,
+                    ...(original.allocateRun
+                        ? {
+                            submit: (recovery) => Effect.runPromise(Effect.gen(function* () {
+                                const reservation = yield* Effect.tryPromise(() => original.allocateRun());
+                                const admitted = yield* reserveWorkflowStart(sql, ontology, {
+                                    trigger: "_recovery",
+                                    workflow: "_recovery",
+                                    actionId: randomUUID(),
+                                    recordId: null,
+                                    input: {},
+                                    workflowId: recovery.workflowId,
+                                    arguments: recovery.arguments,
+                                    attributes: recovery.attributes,
+                                    reservation,
+                                });
+                                const runId = yield* original.start(admitted);
+                                yield* recordWorkflowSubmission(sql, admitted);
+                                return { runId };
+                            })),
+                        }
+                        : {}),
+                }),
+            }
+            : original;
+        const actionTransactions = makeActionTransactions();
+        const agents = sqlAgentStore(ontology, sql);
+        const channelSessions = sqlChannelSessionStore(ontology, sql);
+        const withSql = (effect) => {
+            const connected = Effect.provideService(effect, SqlClient.SqlClient, sql);
+            return deployment
+                ? Effect.provideService(connected, RuntimeDeployment, deployment)
+                : connected;
+        };
+        // Actions start the runs their triggers decide; without a starter the sweep starts them.
+        const withStarter = (effect) => boundStarter === undefined
+            ? effect
+            : Effect.provideService(effect, WorkflowStarter, boundStarter);
+        // Actions send the sign-in links they queue; without a sender the rows are marked failed.
+        const withSignInLinks = (effect) => signInLinks === undefined
+            ? effect
+            : Effect.provideService(effect, SignInLinks, signInLinks);
+        const binding = blobStorage ? Redacted.value(blobStorage) : undefined;
+        if (binding) {
+            validateDeploymentStorage(binding, deployment);
+        }
+        if (deployment?.target === "preview") {
+            // The provisioner supplies a fresh child binding tagged for this exact deployment.
+            // Rebind copied immutable revisions to the child's provider; never follow their old branch.
+            if (binding) {
+                const [blobs] = yield* sql
+                    .unsafe("SELECT to_regclass('_blobs') IS NOT NULL AS present")
+                    .pipe(Effect.orDie);
+                // Storage can be provisioned before an ontology declares its first blob property.
+                // Present or declared file storage must still work; never suppress its SQL failures.
+                const storesFiles = ontology.manifest.entities.some((entity) => entity.properties.some((property) => property.type === "blob"));
+                if (blobs?.present || storesFiles) {
+                    yield* sql
+                        .unsafe(`UPDATE "_blobs" SET branch_id = $1 WHERE branch_id <> $1`, [
+                        binding.branchId,
+                    ])
+                        .pipe(Effect.orDie);
+                }
+            }
+            const [replication] = yield* sql
+                .unsafe("SELECT to_regclass('_ontology_replication') IS NOT NULL AS present")
+                .pipe(Effect.orDie);
+            if (replication?.present) {
+                yield* sql
+                    .unsafe("UPDATE _ontology_replication SET enabled = false WHERE id AND enabled")
+                    .pipe(Effect.orDie);
+            }
+        }
+        const provider = binding
+            ? yield* Effect.acquireRelease(Effect.sync(() => neonBlobProvider(binding, deployment)), (provider) => Effect.sync(() => provider.close?.()))
+            : undefined;
+        const blobs = provider ? blobRuntime(ontology, sql, provider) : undefined;
+        const attachments = provider ? attachmentRuntime(ontology, sql, provider) : undefined;
+        return OntologyBackend.of({
+            workflowAdmissions: {
+                ensureRecovery: (commitBy) => boundStarter
+                    ? boundStarter.ensureRecovery({ commitBy }).pipe(Effect.andThen(() => {
+                        const horizon = boundStarter.recoveryHorizon?.();
+                        return typeof horizon === "number" &&
+                            Number.isFinite(horizon) &&
+                            horizon > commitBy
+                            ? Effect.succeed(horizon)
+                            : Effect.fail(new WorkflowRecoveryUnavailable({
+                                message: "The workflow runtime did not confirm durable recovery coverage.",
+                            }));
+                    }), Effect.mapError((cause) => new WorkflowRecoveryUnavailable({
+                        message: "The durable workflow recovery run could not be secured.",
+                        cause,
+                    })))
+                    : Effect.fail(new WorkflowRecoveryUnavailable({
+                        message: "The durable workflow recovery runtime is unavailable.",
+                    })),
+                reserve: (start) => reserveWorkflowStart(sql, ontology, start).pipe(Effect.catchIf(isSqlError, Effect.die)),
+                submitted: (start) => recordWorkflowSubmission(sql, start).pipe(Effect.asVoid, Effect.orDie),
+            },
+            ...(blobs ? { blobs } : {}),
+            ...(attachments ? { attachments } : {}),
+            ...(provider ? { maintainBlobs: maintainBlobStorage(sql, provider) } : {}),
+            runAction: (input) => withSql(runAction(ontology, {
+                entity: input.entity,
+                action: input.action,
+                input: input.input,
+                ...(input.runtime === undefined ? {} : { runtime: input.runtime }),
+                principal: input.principal,
+                options: input.options,
+                ...(binding ? { branchId: binding.branchId } : {}),
+                afterCommit: input.afterCommit === undefined ? [] : [input.afterCommit],
+                ...(input.requestId === undefined ? {} : { requestId: input.requestId }),
+                ...(input.connections === undefined ? {} : { connections: input.connections }),
+            })).pipe(withStarter, withSignInLinks, Effect.provideService(ActionTransactions, actionTransactions), Effect.provideService(FileAccess, {
+                forInvocation: (invocation) => blobs?.files(invocation) ?? unavailableFiles,
+            }), Effect.catchTag("UnknownAction", (error) => Effect.die(error))),
+            workflowStarts: {
+                sweep: (input) => sweepStarts(sql, boundStarter, input).pipe(Effect.orDie),
+                list: (input) => listStarts(sql, input).pipe(Effect.catchIf(isSqlError, (error) => Effect.die(error))),
+            },
+            agentTasks: sqlAgentTaskStore(sql),
+            get: (input) => runtime.get(input),
+            find: (input) => runtime.query(input),
+            history: (input) => runtime.history(input),
+            resolvePrincipal: (identity) => identity.provider === "segmentstream" && identity.oidcIdentity
+                ? Effect.gen(function* () {
+                    const store = sqlFederationStore(ontology, sql);
+                    const mapped = identity.oidcIdentity;
+                    const principal = yield* store.identity(mapped.issuer, mapped.subject);
+                    if (principal) {
+                        return principal;
+                    }
+                    // A known blocked binding is terminal; an unknown mapping never enrolls by email.
+                    if (yield* store.bindingExists(mapped.issuer, mapped.subject)) {
+                        return undefined;
+                    }
+                    if (!identity.email) {
+                        return undefined;
+                    }
+                    const [neon] = yield* sql.unsafe(`SELECT u.id::text FROM "user" u WHERE lower(u.email) = lower($1)
+                   AND u.kind = 'member' AND EXISTS (SELECT 1 FROM "${USER_IDENTITY_TABLE}" i
+                     WHERE i.user_id = u.id AND i.provider = $2
+                     AND i.origin::text IN ${SIGN_IN_ORIGIN_SQL} AND i.revoked_at IS NULL)`, [identity.email, NEON_AUTH_PROVIDER]);
+                    return neon ? yield* store.principal(neon.id) : undefined;
+                }).pipe(Effect.orDie)
+                : withSql(resolvePrincipalByIdentity(ontology, {
+                    identityProvider: identity.provider,
+                    identitySubject: identity.subject,
+                    ...(identity.email === undefined ? {} : { email: identity.email }),
+                    ...(identity.name === undefined ? {} : { name: identity.name }),
+                })).pipe(Effect.catchTag("PrincipalRejected", (rejection) => rejection.reason === "not_invited"
+                    ? rejectedAs("sign_in")(rejection).pipe(Effect.andThen(Effect.fail(new NotInvited({ message: rejection.message }))))
+                    : rejectedAs("sign_in")(rejection))),
+            resolveHookService: (heldRole) => withSql(resolveHookService(ontology, heldRole)).pipe(Effect.catchTag("PrincipalRejected", rejectedAs("hook_service"))),
+            resolvePipelineWorker: (execution) => withSql(resolvePipelineWorker(ontology, execution)).pipe(Effect.catchTag("PrincipalRejected", rejectedAs("pipeline_worker"))),
+            resolveWorkflowUser: (input) => withSql(resolveWorkflowUser(ontology, input)).pipe(Effect.catchTag("PrincipalRejected", rejectedAs("workflow_user"))),
+            checkSignIn: (email) => ontology.signIn.browser && !ontology.signIn.browser.methods.includes("email")
+                ? Effect.succeed({ allowed: false })
+                : withSql(checkSignIn(ontology, email)),
+            resolveApiKey: (key) => withSql(resolvePrincipalByApiKey(ontology, Redacted.value(key))).pipe(Effect.catchTag("PrincipalRejected", rejectedAs("api_key"))),
+            appliedHash: readCatalog({ sql }).pipe(Effect.map((manifest) => manifest?.hash), Effect.orDie),
+            replicationEnabled: Effect.gen(function* () {
+                const [presence] = yield* sql.unsafe("SELECT to_regclass('_ontology_replication') IS NOT NULL AS present");
+                if (!presence?.present) {
+                    return false;
+                }
+                const [state] = yield* sql.unsafe("SELECT enabled FROM _ontology_replication WHERE id");
+                return state?.enabled === true;
+            }).pipe(Effect.orDie),
+            oauth: sqlOAuthStore(ontology, sql),
+            channelSessions: {
+                create: (input) => channelSessions
+                    .create(input)
+                    .pipe(withStarter, Effect.provideService(ActionTransactions, actionTransactions)),
+            },
+            federation: sqlFederationStore(ontology, sql),
+            agents: {
+                ...agents,
+                resolveIdentity: (input) => agents
+                    .resolveIdentity(input)
+                    .pipe(withStarter, Effect.provideService(ActionTransactions, actionTransactions)),
+            },
+        });
+    }));
+}
+/**
+ * `@effect/sql-pg` on the pooled `ontology_app` connection string, with the TLS server name a
+ * Neon endpoint needs.
+ */
+export function postgresLayer(databaseUrl) {
+    return PgClient.layer({
+        url: databaseUrl,
+        ssl: postgresTls(databaseUrl),
+        maxConnections: MAX_CONNECTIONS,
+        connectTimeout: "5 seconds",
+        applicationName: "segmentstream-ontology",
+    });
+}
+/** The default runtime of `createOntologyService`: the SQL runtime on the workspace database. */
+export const sqlServiceRuntime = {
+    generatedActions: (entity, ontology) => generatedActions(ontology, entity.name),
+    connect: ({ ontology, databaseUrl, blobStorage, workflowStarter, deployment, signInLinks }) => backendLayer(ontology, blobStorage, workflowStarter, deployment, signInLinks).pipe(Layer.provide(postgresLayer(databaseUrl))),
+};

package/dist/runtime/sign-in-links.d.ts

@@ -0,0 +1,68 @@
+import { Context, Effect } from "effect";
+import type { SqlClient } from "effect/unstable/sql";
+import type { QueuedSignInEmail } from "./member-writes.js";
+/** How long sign-in email rows are kept, for an operator, before a later send deletes them. */
+export declare const SIGN_IN_EMAIL_RETENTION_DAYS = 30;
+/** Why Neon Auth did not issue a link, as the row's `failure` records it. */
+export type SignInLinkFailure = "disabled" | "refused" | "unreachable";
+declare const SignInLinks_base: Context.ServiceClass<SignInLinks, "@segmentstream/ontology/SignInLinks", {
+    /** Undefined once Neon Auth issued the link, else why it did not. */
+    readonly request: (email: QueuedSignInEmail) => Effect.Effect<SignInLinkFailure | undefined>;
+}>;
+/**
+ * Asks the app's Neon Auth for a sign-in link to `returnTo` for a queued email. Neon Auth posts the
+ * link to the platform's email webhook, which sends the email, before it answers. The ontology
+ * service provides it in production; a runtime without one marks its rows `failed`.
+ */
+export declare class SignInLinks extends SignInLinks_base {
+}
+/**
+ * The callback a queued email's link is requested with: the path on the app's origin, with
+ * {@link SIGN_IN_EMAIL_PARAMETER} naming the row, which the platform's webhook reads and removes.
+ */
+export declare function signInEmailCallback(origin: string, email: QueuedSignInEmail): string;
+/**
+ * {@link SignInLinks} through Better Auth's `POST /sign-in/magic-link` on the app's Neon Auth, with
+ * the app's production origin, which Neon Auth trusts for callbacks. A 404 means the workspace has
+ * no magic links yet; it is reconciled for them.
+ */
+export declare function neonSignInLinks(config: {
+    readonly baseUrl: string;
+    readonly origin: string;
+    readonly fetch?: typeof fetch;
+}): SignInLinks["Service"];
+/**
+ * Requests the links of the emails an action queued, after its commit, in the same request, and
+ * records each outcome on its row; rows older than {@link SIGN_IN_EMAIL_RETENTION_DAYS} days go.
+ * Without {@link SignInLinks}, as in a preview, the rows are `failed` with `unavailable`. Nothing
+ * here fails the action, and logs never carry an address or a link.
+ */
+export declare function sendQueuedSignInEmails(sql: SqlClient.SqlClient, links: SignInLinks["Service"] | undefined, emails: ReadonlyArray<QueuedSignInEmail>, requestId: string): Effect.Effect<void>;
+/**
+ * A queued sign-in email as the platform's webhook sends it: the workspace's `template`, by wire
+ * name, with `values`, or the platform's own email when it is null; the member's name for the
+ * built-in values, and the address of the member whose action sent it, to whom replies go.
+ */
+export interface SignInEmail {
+    readonly id: string;
+    readonly email: string;
+    readonly template: string | null;
+    readonly values: Readonly<Record<string, string>>;
+    readonly returnTo: string;
+    readonly memberName: string;
+    readonly senderEmail: string | undefined;
+}
+/**
+ * The queued email with this id, while its link may still arrive; undefined for an unknown or
+ * older one, and in a database migrated before the table existed.
+ */
+export declare function findSignInEmail(sql: SqlClient.SqlClient, id: string): Effect.Effect<SignInEmail | undefined, unknown>;
+/** Sends committed queued context through the platform's deployment-authenticated mail boundary. */
+export declare function segmentstreamSignInLinks(config: {
+    readonly segmentstreamUrl: string;
+    readonly workspaceId: string;
+    readonly organizationId: string;
+    readonly identityToken: () => string | undefined;
+    readonly fetch?: typeof fetch;
+}): SignInLinks["Service"];
+export {};