@segmentstream/ontology 0.0.0-stage → 0.92.0

package/dist/runtime/workflow-starts.js

@@ -0,0 +1,493 @@
+import { Context, Duration, Effect, Option, Schema } from "effect";
+import { NO_INPUT } from "../analyze.js";
+import { actionInputToWire } from "../authoring-input.js";
+import { nameToWire } from "../authoring-names.js";
+import { editsFromWire, generatedResultFromWire, recordFromWire } from "../authoring-records.js";
+import { principalFromWire } from "../authoring.js";
+import { isActionTrigger } from "../manifest.js";
+import { referenceTarget } from "../property.js";
+import { NIL_RECORD_ID, WORKFLOW_STARTS_TABLE } from "../storage/tables.js";
+import { isWorkflowTrigger, } from "../workflow.js";
+import { TriggerInputInvalid } from "./errors.js";
+import { canonicalInstant } from "./records.js";
+import { validate } from "./validation.js";
+import { decodeWorkflowArguments, encodeWorkflowArguments } from "./workflow-arguments.js";
+/** Starts that fail this many times are left for an operator: the automatic sweep skips them. */
+export const MAX_START_ATTEMPTS = 10;
+/** How long a pending row waits before a sweep takes it: its own request starts it first. */
+export const SWEEP_DELAY_SECONDS = 30;
+/** The most rows one sweep starts. */
+export const SWEEP_BATCH = 100;
+/** How long started rows are kept, for the starts listing, before the sweep deletes them. */
+export const STARTED_RETENTION_DAYS = 30;
+/** How many starts run at once, after an action's commit and in a sweep. */
+const START_CONCURRENCY = 10;
+/** How long one start may take before it counts as failed and its row stays pending. */
+const START_TIMEOUT = Duration.seconds(15);
+/** The Workflow SDK refused or did not answer a start; the row stays pending. */
+export class WorkflowStartFailed extends Schema.TaggedError()("WorkflowStartFailed", {
+    reason: Schema.Literals([
+        "unknown_workflow",
+        "not_compiled",
+        "no_recovery_workflow",
+        "invalid_input",
+        "engine",
+        "timeout",
+    ]),
+    message: Schema.String,
+    cause: Schema.optionalKey(Schema.Unknown),
+}) {
+}
+/**
+ * Starts the run of a pending row through the Workflow SDK, on the ontology's queue, with
+ * `startedBy` naming the trigger, the action and the record, and arms the recovery run that starts
+ * what a request leaves pending. The ontology service provides it; a runtime without one leaves its
+ * rows pending for an operator's sweep.
+ */
+export class WorkflowStarter extends Context.Service()("@segmentstream/ontology/WorkflowStarter") {
+}
+/** The `startedBy` of a run an action trigger started. */
+export function triggerContext(start) {
+    return {
+        startedBy: {
+            kind: "trigger",
+            triggerKind: "action",
+            trigger: start.trigger,
+            actionId: start.actionId,
+            ...(start.recordId === null ? {} : { recordId: start.recordId }),
+        },
+    };
+}
+const resolvedTriggers = new WeakMap();
+/**
+ * The action triggers of the workflows that passed `check`, paired with their declarations. Built
+ * once per ontology.
+ */
+export function actionTriggers(ontology) {
+    const cached = resolvedTriggers.get(ontology);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const declarations = ontology.config.workflows ?? [];
+    const resolved = ontology.workflows.flatMap((manifest) => {
+        const declaration = declarations.find((candidate) => nameToWire(candidate.name) === manifest.name);
+        if (declaration === undefined) {
+            return [];
+        }
+        const codec = declaration.input === undefined ? NO_INPUT : actionInputToWire(declaration.input);
+        return manifest.triggers.filter(isActionTrigger).flatMap((trigger) => {
+            const authored = declaration.triggers.find((candidate) => isWorkflowTrigger(candidate) &&
+                candidate.kind === "action" &&
+                nameToWire(candidate.name) === trigger.name);
+            return authored === undefined || authored.kind !== "action"
+                ? []
+                : [
+                    {
+                        workflow: manifest.name,
+                        trigger: `${manifest.name}.${trigger.name}`,
+                        entity: trigger.entity,
+                        action: trigger.action,
+                        when: authored.when,
+                        input: authored.input,
+                        codec,
+                    },
+                ];
+        });
+    });
+    resolvedTriggers.set(ontology, resolved);
+    return resolved;
+}
+/** Whether the ontology declares any action trigger, so that `_workflow_starts` exists. */
+export function hasActionTriggers(ontology) {
+    return actionTriggers(ontology).length > 0;
+}
+/**
+ * The triggers that fire for an action of `entity` run by `principal`: on that action or on the
+ * entity, except the triggers of the workflow whose user runs it, so that a workflow never starts
+ * itself.
+ */
+export function matchingTriggers(ontology, entity, action, principal) {
+    return actionTriggers(ontology).filter((trigger) => trigger.entity === entity &&
+        (trigger.action === undefined || trigger.action === action) &&
+        trigger.workflow !== principal.workflow?.name);
+}
+/**
+ * The input field of an action that holds an id of `entity`, when exactly one top-level field is a
+ * reference to it; its name as the decoded input carries it.
+ */
+function namingField(action, entity) {
+    const fields = action.input.fields;
+    const naming = Object.entries(fields ?? {}).filter(([, schema]) => referenceTarget(schema) === entity);
+    return naming.length === 1 ? naming[0][0] : undefined;
+}
+/**
+ * The records each trigger is evaluated for. The record the input names, once for the action, when
+ * one input field holds an id of the entity and the action edited that record; otherwise every
+ * edited record of the entity, each on its own. An action that edits none fires nothing.
+ */
+function selectRecords(evaluation) {
+    const edited = [
+        ...new Set(evaluation.edits.filter((edit) => edit.entity === evaluation.entity).map((edit) => edit.id)),
+    ];
+    const field = namingField(evaluation.definition, evaluation.entity);
+    const value = field === undefined || typeof evaluation.input !== "object" || evaluation.input === null
+        ? undefined
+        : evaluation.input[field];
+    const named = typeof value === "string"
+        ? edited.find((id) => id.toLowerCase() === value.toLowerCase())
+        : undefined;
+    return named === undefined ? { named: false, ids: edited } : { named: true, ids: [named] };
+}
+function authoredDefinition(ontology, entity) {
+    return ontology.config.entities.find((candidate) => nameToWire(candidate.name) === entity)
+        ?.definition;
+}
+/** A trigger function threw, or `when` answered something other than a boolean: a defect. */
+export class TriggerFunctionFailed extends Error {
+    constructor(trigger, part, cause) {
+        super(`The ${part} of action trigger ${trigger} failed.`, { cause });
+        this.name = "TriggerFunctionFailed";
+    }
+}
+function issuesOf(error) {
+    return [{ path: [], message: error instanceof Error ? error.message : String(error) }];
+}
+/**
+ * Evaluates the matching triggers inside the action's transaction: selects the records, runs
+ * `when`, maps and validates the input with the workflow's input schema. A function that throws is
+ * a defect, which rolls the action back; an input the workflow does not accept fails the action
+ * with {@link TriggerInputInvalid}. The starts it answers are in the wire form the rows store.
+ */
+export function evaluateTriggers(triggers, evaluation) {
+    return Effect.gen(function* () {
+        if (triggers.length === 0) {
+            return [];
+        }
+        const { named, ids } = selectRecords(evaluation);
+        if (ids.length === 0) {
+            return [];
+        }
+        const { ontology } = evaluation;
+        const definition = authoredDefinition(ontology, evaluation.entity);
+        const event = {
+            action: `${evaluation.entity}.${evaluation.action}`,
+            actionId: evaluation.actionId,
+            at: evaluation.at,
+            principal: principalFromWire(evaluation.principal),
+            input: evaluation.generated ? recordFromWire(evaluation.input, definition) : evaluation.input,
+            result: evaluation.generated
+                ? generatedResultFromWire(evaluation.result, evaluation.action, definition)
+                : evaluation.result,
+            edits: editsFromWire(evaluation.edits, ontology.config.entities),
+        };
+        const authored = (record) => record === undefined ? undefined : recordFromWire(record, definition);
+        const starts = [];
+        for (const id of ids) {
+            const held = evaluation.held.get(id);
+            const pair = held ??
+                (yield* evaluation.load(id).pipe(Effect.map((current) => ({ before: current, after: current })), Effect.orDie));
+            const record = { record: id, before: authored(pair.before), after: authored(pair.after) };
+            for (const trigger of triggers) {
+                if (trigger.when !== undefined) {
+                    const fires = yield* Effect.try({
+                        try: () => trigger.when(event, record),
+                        catch: (cause) => new TriggerFunctionFailed(trigger.trigger, "when", cause),
+                    }).pipe(Effect.orDie);
+                    if (typeof fires !== "boolean") {
+                        return yield* Effect.die(new TriggerFunctionFailed(trigger.trigger, "when", new TypeError("when must return a boolean synchronously.")));
+                    }
+                    if (!fires) {
+                        continue;
+                    }
+                }
+                const mapped = trigger.input === undefined
+                    ? {}
+                    : yield* Effect.try({
+                        try: () => trigger.input(event, record),
+                        catch: (cause) => new TriggerFunctionFailed(trigger.trigger, "input", cause),
+                    }).pipe(Effect.orDie);
+                const input = yield* encodeInput(trigger, mapped);
+                starts.push({
+                    trigger: trigger.trigger,
+                    workflow: trigger.workflow,
+                    actionId: evaluation.actionId,
+                    recordId: named ? null : id,
+                    input,
+                });
+            }
+        }
+        return starts;
+    });
+}
+/** The mapping's value in the workflow input's wire form, validated as a start would decode it. */
+function encodeInput(trigger, mapped) {
+    return Effect.gen(function* () {
+        const invalid = (issues) => new TriggerInputInvalid({
+            trigger: trigger.trigger,
+            message: `The input action trigger ${trigger.trigger} maps is not one its workflow accepts.`,
+            issues,
+        });
+        const encoded = yield* Schema.encodeUnknownEffect(trigger.codec)(mapped, { errors: "all", onExcessProperty: "error" }).pipe(Effect.mapError((error) => invalid(issuesOf(error))));
+        const decoded = validate(trigger.codec, encoded);
+        if (!decoded.ok) {
+            return yield* invalid(decoded.issues);
+        }
+        return JSON.parse(JSON.stringify(encoded));
+    });
+}
+/** Rows per INSERT: five parameters each, well below PostgreSQL's limit. */
+const INSERT_CHUNK = 1_000;
+/** Inserts the starts in the action's transaction, so they commit with its records and history. */
+export function insertStarts(sql, starts) {
+    return Effect.gen(function* () {
+        const capture = Option.getOrUndefined(yield* Effect.serviceOption(WorkflowStarter))?.capture;
+        for (let offset = 0; offset < starts.length; offset += INSERT_CHUNK) {
+            const chunk = starts.slice(offset, offset + INSERT_CHUNK);
+            const params = [];
+            const values = chunk.map((start) => {
+                const bound = capture?.(start);
+                params.push(start.trigger, start.actionId, start.recordId, start.workflow, JSON.stringify(start.input), process.env.VERCEL_DEPLOYMENT_ID ?? null, bound?.workflowId ?? null, bound ? JSON.stringify(encodeWorkflowArguments(bound.arguments)) : null, bound ? JSON.stringify(bound.attributes) : null);
+                const at = params.length - 9;
+                return (`($${at + 1}, $${at + 2}::uuid, $${at + 3}::uuid, $${at + 4}, $${at + 5}::jsonb, ` +
+                    `$${at + 6},$${at + 7},` +
+                    `$${at + 8}::jsonb,$${at + 9}::jsonb)`);
+            });
+            yield* sql.unsafe(`INSERT INTO "${WORKFLOW_STARTS_TABLE}" ("trigger", "action_id", "record_id", "workflow", "input", ` +
+                `admission_deployment_id,provider_workflow_id,arguments,admission_attributes) ` +
+                `VALUES ${values.join(", ")}`, params);
+        }
+    });
+}
+/** Runs the starts, a few at a time; each failure is kept, never raised. */
+function attempt(starter, starts) {
+    return Effect.forEach(starts, (start) => starter.start(start).pipe(Effect.timeoutOrElse({
+        duration: START_TIMEOUT,
+        orElse: () => Effect.fail(new WorkflowStartFailed({
+            reason: "timeout",
+            message: `The Workflow SDK did not accept the run within ${Duration.format(START_TIMEOUT)}.`,
+        })),
+    }), Effect.result, Effect.map((result) => ({ start, result }))), { concurrency: START_CONCURRENCY }).pipe(Effect.map((results) => ({
+        started: results.flatMap(({ start, result }) => result._tag === "Success" ? [{ start, runId: result.success }] : []),
+        failed: results.flatMap(({ start, result }) => result._tag === "Failure" ? [{ start, error: result.failure }] : []),
+    })));
+}
+/** `(trigger, action_id, record_id)` of each start as a VALUES list, from `$offset + 1`. */
+function keys(starts, params, extra) {
+    return starts
+        .map((start) => {
+        params.push(start.trigger, start.actionId, start.recordId);
+        const columns = [
+            `$${params.length - 2}::text`,
+            `$${params.length - 1}::uuid`,
+            `$${params.length}::uuid`,
+        ];
+        if (extra !== undefined) {
+            params.push(extra(start));
+            columns.push(`$${params.length}::text`);
+        }
+        return `(${columns.join(", ")})`;
+    })
+        .join(", ");
+}
+const SAME_ROW = `s."trigger" = v."trigger" AND s."action_id" = v."action_id" ` +
+    `AND COALESCE(s."record_id", '${NIL_RECORD_ID}'::uuid) = COALESCE(v."record_id", '${NIL_RECORD_ID}'::uuid)`;
+/**
+ * Records what the starts did: the run id of each start the SDK accepted, and one more attempt on
+ * each that failed, logged with the request id. A start that reaches {@link MAX_START_ATTEMPTS} is
+ * logged as abandoned.
+ */
+function record(sql, attempted, requestId) {
+    return Effect.gen(function* () {
+        if (attempted.started.length > 0) {
+            const params = [];
+            const runIds = new Map(attempted.started.map(({ start, runId }) => [start, runId]));
+            const values = keys(attempted.started.map(({ start }) => start), params, (start) => runIds.get(start));
+            yield* sql.unsafe(`UPDATE "${WORKFLOW_STARTS_TABLE}" AS s SET "run_id" = v."run_id", ` +
+                `"started_at" = now(), submission_lease_until=NULL ` +
+                `FROM (VALUES ${values}) AS v ("trigger", "action_id", "record_id", "run_id") ` +
+                `WHERE ${SAME_ROW} AND s."run_id" IS NULL`, params);
+        }
+        if (attempted.failed.length === 0) {
+            return;
+        }
+        const params = [];
+        const values = keys(attempted.failed.map(({ start }) => start), params);
+        const counted = yield* sql.unsafe(`UPDATE "${WORKFLOW_STARTS_TABLE}" AS s SET "attempts" = s."attempts" + 1, submission_lease_until=NULL ` +
+            `FROM (VALUES ${values}) AS v ("trigger", "action_id", "record_id") ` +
+            `WHERE ${SAME_ROW} AND s."run_id" IS NULL ` +
+            `RETURNING s."trigger", s."action_id"::text AS "action_id", s."record_id"::text AS "record_id", s."attempts"`, params);
+        const attemptsOf = new Map(counted.map((row) => [
+            `${row.trigger}|${row.action_id}|${row.record_id ?? ""}`,
+            Number(row.attempts),
+        ]));
+        for (const { start, error } of attempted.failed) {
+            const attempts = attemptsOf.get(`${start.trigger}|${start.actionId}|${start.recordId ?? ""}`);
+            const annotations = {
+                requestId,
+                trigger: start.trigger,
+                workflow: start.workflow,
+                actionId: start.actionId,
+                recordId: start.recordId,
+                attempts: attempts ?? null,
+                reason: error.reason,
+            };
+            yield* Effect.logWarning("ontology.workflow.trigger_start_failed", error).pipe(Effect.annotateLogs(annotations));
+            if (attempts === MAX_START_ATTEMPTS) {
+                yield* Effect.logError("ontology.workflow.trigger_start_abandoned").pipe(Effect.annotateLogs(annotations));
+            }
+        }
+    });
+}
+/**
+ * Starts the rows an action's transaction inserted, after its commit, in the same request. A
+ * failure is logged and leaves the row pending for the sweep; nothing here fails the action.
+ */
+export function startCommitted(sql, starter, starts, requestId) {
+    if (starts.length === 0) {
+        return Effect.void;
+    }
+    if (starter === undefined) {
+        return Effect.logDebug("ontology.workflow.trigger_start_deferred").pipe(Effect.annotateLogs({ requestId, pending: starts.length }));
+    }
+    return attempt(starter, starts).pipe(Effect.flatMap((attempted) => record(sql, attempted, requestId)), Effect.catchCause((cause) => Effect.logError("ontology.workflow.trigger_start_failed", cause).pipe(Effect.annotateLogs({ requestId, pending: starts.length }))));
+}
+/** The database's clock as the sweep reads it, ISO 8601 with milliseconds. */
+const SWEEP_CLOCK = `to_char(now() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')`;
+/** A sweep's result when the database has no `_workflow_starts` table: nothing to do. */
+function nothingToSweep() {
+    return { started: 0, failed: 0, abandoned: 0, waiting: 0, at: new Date().toISOString() };
+}
+/** Whether the database has `_workflow_starts`: a manifest with an action trigger was migrated. */
+function hasStartsTable(sql) {
+    return sql
+        .unsafe(`SELECT to_regclass('"${WORKFLOW_STARTS_TABLE}"') IS NOT NULL AS "present"`)
+        .pipe(Effect.map(([row]) => row?.present === true));
+}
+function pendingOf(row) {
+    return {
+        trigger: row.trigger,
+        workflow: row.workflow,
+        actionId: row.action_id,
+        recordId: row.record_id,
+        input: typeof row.input === "string" ? JSON.parse(row.input) : row.input,
+        ...(row.reservation ? { reservation: row.reservation } : {}),
+        ...(row.arguments ? { arguments: decodeWorkflowArguments(row.arguments) } : {}),
+        ...(row.provider_workflow_id ? { workflowId: row.provider_workflow_id } : {}),
+        ...(row.admission_attributes ? { attributes: row.admission_attributes } : {}),
+        ...(row.admission_deployment_id ? { deploymentId: row.admission_deployment_id } : {}),
+    };
+}
+/**
+ * The sweep: starts up to {@link SWEEP_BATCH} rows pending for more than
+ * {@link SWEEP_DELAY_SECONDS}, oldest first, locked with `SKIP LOCKED` so that concurrent sweeps
+ * take different rows, and records each outcome before the locks are released. Rows that failed
+ * {@link MAX_START_ATTEMPTS} times are taken only with `retryAbandoned`. Started rows older than
+ * {@link STARTED_RETENTION_DAYS} days are deleted. `waiting` counts the pending rows an automatic
+ * sweep still takes, young ones included, created before `before` when it is given: the recovery
+ * run's horizon.
+ */
+export function sweepStarts(sql, starter, options) {
+    return Effect.gen(function* () {
+        if (!(yield* hasStartsTable(sql))) {
+            return nothingToSweep();
+        }
+        const selected = yield* sql.withTransaction(Effect.gen(function* () {
+            const rows = yield* sql.unsafe(`SELECT "trigger", "action_id"::text AS "action_id", "record_id"::text AS "record_id", ` +
+                `"workflow", "input",reservation,arguments,provider_workflow_id,admission_attributes,` +
+                `admission_deployment_id FROM "${WORKFLOW_STARTS_TABLE}" ` +
+                `WHERE "run_id" IS NULL AND "created_at" < now() - make_interval(secs => $1) ` +
+                `AND (submission_lease_until IS NULL OR submission_lease_until < clock_timestamp()) ` +
+                `AND ($2 OR "attempts" < $3) ORDER BY "created_at" LIMIT $4 FOR UPDATE SKIP LOCKED`, [SWEEP_DELAY_SECONDS, options.retryAbandoned, MAX_START_ATTEMPTS, SWEEP_BATCH]);
+            for (const row of rows) {
+                yield* sql.unsafe(`UPDATE _workflow_starts SET submission_lease_until=clock_timestamp()+interval '30 seconds'
+             WHERE trigger=$1 AND action_id=$2::uuid AND record_id IS NOT DISTINCT FROM $3::uuid`, [row.trigger, row.action_id, row.record_id]);
+            }
+            return rows;
+        }));
+        if (selected.length > 0 && starter === undefined) {
+            return yield* Effect.die(new Error("The sweep needs the ontology service's starter."));
+        }
+        const attempted = selected.length === 0
+            ? { started: [], failed: [] }
+            : yield* attempt(starter, selected.map(pendingOf));
+        // Provider submission is outside the lease transaction. Concurrent/reclaimed attempts use the
+        // same persisted reservation rather than generating another provider run.
+        yield* record(sql, attempted, options.requestId);
+        yield* sql.unsafe(`DELETE FROM "${WORKFLOW_STARTS_TABLE}" WHERE "run_id" IS NOT NULL ` +
+            `AND "started_at" < now() - make_interval(days => $1)`, [STARTED_RETENTION_DAYS]);
+        const [left] = yield* sql.unsafe(`SELECT count(*) FILTER (WHERE "attempts" >= $1)::text AS "abandoned", ` +
+            `count(*) FILTER (WHERE "attempts" < $1 ` +
+            `AND ($2::timestamptz IS NULL OR "created_at" < $2::timestamptz))::text AS "waiting", ` +
+            `${SWEEP_CLOCK} AS "at" FROM "${WORKFLOW_STARTS_TABLE}" WHERE "run_id" IS NULL`, [MAX_START_ATTEMPTS, options.before ?? null]);
+        return {
+            started: attempted.started.length,
+            failed: attempted.failed.length,
+            abandoned: Number(left?.abandoned ?? 0),
+            waiting: Number(left?.waiting ?? 0),
+            at: left?.at ?? new Date().toISOString(),
+        };
+    });
+}
+/** The starts listing's cursor does not decode: it was not one this listing gave. */
+export class InvalidStartsCursor extends Schema.TaggedError()("InvalidStartsCursor", { message: Schema.String }) {
+}
+const Cursor = Schema.Tuple([
+    Schema.String,
+    Schema.String,
+    Schema.String,
+    Schema.NullOr(Schema.String),
+]);
+function encodeCursor(row) {
+    return Buffer.from(JSON.stringify([row.created_cursor, row.trigger, row.action_id, row.record_id])).toString("base64url");
+}
+function decodeCursor(cursor) {
+    return Effect.try({
+        try: () => JSON.parse(Buffer.from(cursor, "base64url").toString("utf8")),
+        catch: () => new InvalidStartsCursor({ message: "The cursor is not one this listing gave." }),
+    }).pipe(Effect.flatMap((value) => Schema.decodeUnknownEffect(Cursor)(value).pipe(Effect.mapError(() => new InvalidStartsCursor({ message: "The cursor is not one this listing gave." })))));
+}
+const TIMESTAMP = `'YYYY-MM-DD"T"HH24:MI:SS.US"Z"'`;
+/**
+ * A page of a workflow's starts, newest first: all of them, or only the pending or the started
+ * ones. A database without `_workflow_starts` has none.
+ */
+export function listStarts(sql, input) {
+    return Effect.gen(function* () {
+        const cursor = input.after === undefined ? undefined : yield* decodeCursor(input.after);
+        if (!(yield* hasStartsTable(sql))) {
+            return { items: [], nextCursor: null };
+        }
+        const params = [input.workflow];
+        const conditions = [`"workflow" = $1`];
+        if (input.pending !== undefined) {
+            conditions.push(input.pending ? `"run_id" IS NULL` : `"run_id" IS NOT NULL`);
+        }
+        if (cursor !== undefined) {
+            params.push(cursor[0], cursor[1], cursor[2], cursor[3] ?? NIL_RECORD_ID);
+            conditions.push(`("created_at", "trigger", "action_id", COALESCE("record_id", '${NIL_RECORD_ID}'::uuid)) < ` +
+                `($2::timestamptz, $3, $4::uuid, $5::uuid)`);
+        }
+        params.push(input.limit + 1);
+        const rows = yield* sql.unsafe(`SELECT "trigger", "action_id"::text AS "action_id", "record_id"::text AS "record_id", ` +
+            `to_char("created_at" AT TIME ZONE 'UTC', ${TIMESTAMP}) AS "created_at", ` +
+            `"created_at"::text AS "created_cursor", "run_id", ` +
+            `to_char("started_at" AT TIME ZONE 'UTC', ${TIMESTAMP}) AS "started_at", "attempts" ` +
+            `FROM "${WORKFLOW_STARTS_TABLE}" WHERE ${conditions.join(" AND ")} ` +
+            `ORDER BY "created_at" DESC, "trigger" DESC, "action_id" DESC, ` +
+            `COALESCE("record_id", '${NIL_RECORD_ID}'::uuid) DESC LIMIT $${params.length}`, params);
+        const page = rows.slice(0, input.limit);
+        const last = page.at(-1);
+        return {
+            items: page.map((row) => ({
+                trigger: row.trigger,
+                actionId: row.action_id,
+                recordId: row.record_id,
+                createdAt: canonicalInstant(row.created_at),
+                runId: row.run_id,
+                startedAt: row.started_at === null ? null : canonicalInstant(row.started_at),
+                attempts: Number(row.attempts),
+            })),
+            nextCursor: rows.length > input.limit && last !== undefined ? encodeCursor(last) : null,
+        };
+    });
+}

package/dist/runtime/workflow-users.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Who signs workflow users in: no one. A workflow's runs execute in the ontology service's own
+ * process, which binds the runtime to the workflow's user; no token names them.
+ */
+export declare const WORKFLOW_USER_PROVIDER = "segmentstream-ontology-workflow";
+/** The identity subject of a workflow's user: `workflows:<workspace id>:<workflow name>`. */
+export declare function workflowSubject(workspaceId: string, workflow: string): string;
+/** The workflow a workflow user's identity subject names, whatever the workspace. */
+export declare function workflowOfSubject(subject: unknown): string | undefined;

package/dist/runtime/workflow-users.js

@@ -0,0 +1,17 @@
+/**
+ * Who signs workflow users in: no one. A workflow's runs execute in the ontology service's own
+ * process, which binds the runtime to the workflow's user; no token names them.
+ */
+export const WORKFLOW_USER_PROVIDER = "segmentstream-ontology-workflow";
+/** The identity subject of a workflow's user: `workflows:<workspace id>:<workflow name>`. */
+export function workflowSubject(workspaceId, workflow) {
+    return `workflows:${workspaceId}:${workflow}`;
+}
+/** The workflow a workflow user's identity subject names, whatever the workspace. */
+export function workflowOfSubject(subject) {
+    if (typeof subject !== "string" || !subject.startsWith("workflows:")) {
+        return undefined;
+    }
+    const parts = subject.split(":");
+    return parts.length === 3 && parts[1] !== "" && parts[2] !== "" ? parts[2] : undefined;
+}

package/dist/runtime/workload.d.ts

@@ -0,0 +1,25 @@
+import { Schema } from "effect";
+/** Verified platform claims retained with each write; never supplied by request headers. */
+export declare const WorkloadExecution: Schema.Struct<{
+    readonly issuer: Schema.String;
+    readonly audience: Schema.String;
+    readonly organizationId: Schema.String;
+    readonly workspaceId: Schema.String;
+    readonly subject: Schema.String;
+    readonly deploymentId: Schema.String;
+    readonly ontologyDeploymentId: Schema.String;
+    readonly servingOntologyDeploymentId: Schema.String;
+    readonly ontologyOrigin: Schema.String;
+    readonly environment: Schema.Literals<readonly ["production", "preview"]>;
+    readonly jobName: Schema.NullOr<Schema.String>;
+    readonly runId: Schema.String;
+    readonly executionId: Schema.NullOr<Schema.String>;
+    readonly attemptId: Schema.String;
+    readonly generation: Schema.Number;
+    readonly tokenId: Schema.String;
+    readonly issuedAt: Schema.Number;
+    readonly expiresAt: Schema.Number;
+}>;
+export type WorkloadExecution = typeof WorkloadExecution.Type;
+/** Who signs the pipeline worker in: no one. Its requests authenticate with workload tokens. */
+export declare const PIPELINE_WORKER_PROVIDER = "segmentstream-ontology-workload";

package/dist/runtime/workload.js

@@ -0,0 +1,24 @@
+import { Schema } from "effect";
+/** Verified platform claims retained with each write; never supplied by request headers. */
+export const WorkloadExecution = Schema.Struct({
+    issuer: Schema.String,
+    audience: Schema.String,
+    organizationId: Schema.String,
+    workspaceId: Schema.String,
+    subject: Schema.String,
+    deploymentId: Schema.String,
+    ontologyDeploymentId: Schema.String,
+    servingOntologyDeploymentId: Schema.String,
+    ontologyOrigin: Schema.String,
+    environment: Schema.Literals(["production", "preview"]),
+    jobName: Schema.NullOr(Schema.String),
+    runId: Schema.String,
+    executionId: Schema.NullOr(Schema.String),
+    attemptId: Schema.String,
+    generation: Schema.Number,
+    tokenId: Schema.String,
+    issuedAt: Schema.Number,
+    expiresAt: Schema.Number,
+});
+/** Who signs the pipeline worker in: no one. Its requests authenticate with workload tokens. */
+export const PIPELINE_WORKER_PROVIDER = "segmentstream-ontology-workload";