@segmentstream/ontology 0.0.0-stage → 0.92.1

package/dist/runtime/channel-session-revocation.d.ts

@@ -0,0 +1,3 @@
+import type { SqlClient } from "effect/unstable/sql";
+/** Revocation joins the caller's identity/member transaction, including pairing displacement. */
+export declare function revokeChannelSessions(sql: SqlClient.SqlClient, identityId: string): import("effect/unstable/sql/Statement").Statement<object>;

package/dist/runtime/channel-session-revocation.js

@@ -0,0 +1,5 @@
+/** Revocation joins the caller's identity/member transaction, including pairing displacement. */
+export function revokeChannelSessions(sql, identityId) {
+    return sql.unsafe(`UPDATE "_oauth_grants" SET "revoked_at" = now()
+     WHERE "identity_id" = $1::uuid AND "revoked_at" IS NULL`, [identityId]);
+}

package/dist/runtime/channel-sessions.d.ts

@@ -0,0 +1,4 @@
+import type { SqlClient } from "effect/unstable/sql";
+import type { Ontology } from "../ontology.js";
+import type { ChannelSessionStore } from "../service/runtime-contract.js";
+export declare function sqlChannelSessionStore(ontology: Ontology, sql: SqlClient.SqlClient): ChannelSessionStore;

package/dist/runtime/channel-sessions.js

@@ -0,0 +1,61 @@
+import { randomUUID } from "node:crypto";
+import { Effect } from "effect";
+import { channelClientId, CHANNEL_SESSION_TTL_SECONDS } from "../channel-session.js";
+import { ACCESS_TOKEN_PREFIX, FULL_SCOPE, newSecret, secretHash, } from "../service/oauth/protocol.js";
+import { revokeChannelSessions } from "./channel-session-revocation.js";
+import { resolveChannelSignIn } from "./agents.js";
+import { isMemberBlocked } from "./principals.js";
+import { sqlOAuthStore } from "./oauth.js";
+import { CHANNEL_IDENTITIES_FROM, LIVE_CHANNEL_IDENTITY } from "./user-identity-sql.js";
+export function sqlChannelSessionStore(ontology, sql) {
+    const oauth = sqlOAuthStore(ontology, sql);
+    return {
+        create: (input) => Effect.gen(function* () {
+            // A1 commits admission before running onboarding. Never place this inside the issuer transaction.
+            const resolution = yield* resolveChannelSignIn(ontology, sql, input);
+            if (resolution.status !== "existing" && resolution.status !== "created") {
+                return resolution;
+            }
+            const userId = resolution.member.principal.id;
+            return yield* sql
+                .withTransaction(Effect.gen(function* () {
+                // Same lock order as A1 lifecycle operations: User, then identity. Prevent resurrection.
+                const [member] = yield* sql.unsafe(`SELECT "kind"::text AS "kind", "active" FROM "user" WHERE "id" = $1::uuid FOR SHARE`, [userId]);
+                if (member?.kind !== "member" || !member.active) {
+                    return { status: "refused", reason: "inactive" };
+                }
+                if (yield* isMemberBlocked(sql, userId)) {
+                    return { status: "refused", reason: "blocked" };
+                }
+                // Revocation locks the identity too, so a revoked account never gains a session.
+                const [identity] = yield* sql.unsafe(`SELECT "i"."id"::text AS "id", "i"."user_id"::text AS "user_id"
+           FROM ${CHANNEL_IDENTITIES_FROM}
+           WHERE "i"."provider" = $1 AND "i"."subject" = $2 AND ${LIVE_CHANNEL_IDENTITY}
+           FOR UPDATE OF "i"`, [input.provider, input.externalId]);
+                if (!identity || identity.user_id !== userId) {
+                    return { status: "pairing_required" };
+                }
+                const clientId = channelClientId(input.provider);
+                yield* sql.unsafe(`INSERT INTO "_oauth_clients" ("id", "name", "redirect_uris", "auth_method")
+           VALUES ($1, $1, '[]'::jsonb, 'none') ON CONFLICT ("id") DO NOTHING`, [clientId]);
+                yield* revokeChannelSessions(sql, identity.id);
+                const grantId = randomUUID();
+                const token = newSecret(ACCESS_TOKEN_PREFIX);
+                const expiresAt = new Date(Date.now() + CHANNEL_SESSION_TTL_SECONDS * 1000);
+                yield* oauth.saveGrant({
+                    id: grantId,
+                    clientId,
+                    userId,
+                    scope: FULL_SCOPE,
+                    resource: input.resource,
+                });
+                yield* sql.unsafe(`UPDATE "_oauth_grants" SET "identity_id" = $2::uuid WHERE "id" = $1::uuid`, [grantId, identity.id]);
+                yield* oauth.saveTokens([
+                    { hash: secretHash(token), grantId, kind: "access", expiresAt },
+                ]);
+                return { status: "signed_in", token, expiresAt };
+            }))
+                .pipe(Effect.orDie);
+        }),
+    };
+}

package/dist/runtime/confirmations.d.ts

@@ -0,0 +1,29 @@
+import { Effect } from "effect";
+import type { SqlClient } from "effect/unstable/sql";
+/** Private runtime data. Never exposed as an ontology entity or a model tool. */
+export interface DeferredConfirmation {
+    readonly id: string;
+    readonly key: string;
+    readonly memberId: string;
+    readonly inputHash: string;
+    readonly expiresAt: number;
+    readonly status: "pending" | "approved" | "cancelled" | "expired" | "done" | "failed";
+    readonly data: Readonly<Record<string, unknown>>;
+}
+export interface ConfirmationStore {
+    readonly create: (record: DeferredConfirmation) => Effect.Effect<DeferredConfirmation | undefined>;
+    readonly read: (key: string) => Effect.Effect<DeferredConfirmation | undefined>;
+    /** Commits before external execution. A lost worker never causes automatic execution again. */
+    readonly decide: (input: {
+        readonly key: string;
+        readonly memberId: string;
+        readonly inputHash: string;
+        readonly decision: "approve" | "cancel" | "expire";
+    }) => Effect.Effect<DeferredConfirmation | undefined>;
+    readonly attach: (key: string, messageId: string, address: string) => Effect.Effect<void>;
+    readonly finish: (key: string, status: "done" | "failed") => Effect.Effect<void>;
+    readonly expired: (chatId?: string) => Effect.Effect<ReadonlyArray<DeferredConfirmation>>;
+}
+export declare const CONFIRMATION_TABLE = "_agent_confirmations";
+export declare const CONFIRMATION_DDL: string[];
+export declare function sqlConfirmationStore(sql: SqlClient.SqlClient): ConfirmationStore;

package/dist/runtime/confirmations.js

@@ -0,0 +1,57 @@
+import { Effect } from "effect";
+// @legacy agent.retired-confirmation-ledger
+export const CONFIRMATION_TABLE = "_agent_confirmations";
+export const CONFIRMATION_DDL = [
+    `CREATE TABLE IF NOT EXISTS "${CONFIRMATION_TABLE}" (
+    id text PRIMARY KEY, key text NOT NULL UNIQUE,
+    member_id uuid NOT NULL REFERENCES "user" (id) ON DELETE CASCADE,
+    input_hash text NOT NULL, expires_at timestamptz NOT NULL,
+    status text NOT NULL CHECK (status IN ('pending','approved','cancelled','expired','done','failed')),
+    data jsonb NOT NULL
+  )`,
+    `CREATE INDEX IF NOT EXISTS "_agent_confirmations_expiry" ON "${CONFIRMATION_TABLE}" (expires_at)
+    WHERE status = 'pending'`,
+];
+export function sqlConfirmationStore(sql) {
+    const query = (statement, values = []) => sql.unsafe(statement, values).pipe(Effect.orDie);
+    const columns = `id, key, member_id::text AS "memberId", input_hash AS "inputHash",
+    (extract(epoch from expires_at) * 1000)::double precision AS "expiresAt", status, data`;
+    const read = (key) => query(`SELECT ${columns} FROM "${CONFIRMATION_TABLE}" WHERE key = $1`, [key]).pipe(Effect.map((rows) => rows[0]));
+    return {
+        read,
+        create: (record) => Effect.gen(function* () {
+            yield* query(`INSERT INTO "${CONFIRMATION_TABLE}"
+        (id, key, member_id, input_hash, expires_at, status, data)
+        VALUES ($1, $2, $3::uuid, $4, to_timestamp($5::double precision / 1000), 'pending', $6::jsonb)
+        ON CONFLICT DO NOTHING`, [
+                record.id,
+                record.key,
+                record.memberId,
+                record.inputHash,
+                record.expiresAt,
+                JSON.stringify(record.data),
+            ]);
+            const saved = yield* read(record.key);
+            return saved?.id === record.id &&
+                saved.memberId === record.memberId &&
+                saved.inputHash === record.inputHash &&
+                ["action", "requester", "chatId", "threadId", "sessionId", "callId"].every((field) => saved.data[field] === record.data[field])
+                ? saved
+                : undefined;
+        }),
+        decide: (input) => query(`UPDATE "${CONFIRMATION_TABLE}" SET status =
+      CASE WHEN expires_at <= now() THEN 'expired'
+           WHEN $4 = 'approve' THEN 'approved' ELSE 'cancelled' END
+      WHERE key = $1 AND member_id = $2::uuid AND input_hash = $3 AND status = 'pending'
+        AND ($4 <> 'expire' OR expires_at <= now())
+      RETURNING ${columns}`, [input.key, input.memberId, input.inputHash, input.decision]).pipe(Effect.map((rows) => rows[0])),
+        attach: (key, messageId, address) => query(`UPDATE "${CONFIRMATION_TABLE}"
+      SET data = data || jsonb_build_object('messageId', $2::text, 'address', $3::text)
+      WHERE key = $1 AND status = 'pending' AND NOT (data ? 'messageId')`, [key, messageId, address]).pipe(Effect.asVoid),
+        finish: (key, status) => query(`UPDATE "${CONFIRMATION_TABLE}" SET status = $2
+      WHERE key = $1 AND status = 'approved'`, [key, status]).pipe(Effect.asVoid),
+        expired: (chatId) => query(`SELECT ${columns} FROM "${CONFIRMATION_TABLE}"
+      WHERE status = 'pending' AND expires_at <= now() AND ($1::text IS NULL OR data->>'chatId' = $1)
+      ORDER BY expires_at LIMIT 100`, [chatId ?? null]),
+    };
+}

package/dist/runtime/cursor.d.ts

@@ -0,0 +1,23 @@
+import { type OrderBy, type SortDirection } from "../query.js";
+import type { StoredRecord } from "../runtime.js";
+import type { EntityModel, FieldModel } from "./model.js";
+import { type Params } from "./statement.js";
+/**
+ * Keyset pagination. A cursor carries the sort values of the last record of a page and the order
+ * they belong to; the next page starts strictly after them. Ascending keys put empty values last,
+ * descending keys first, as PostgreSQL does by default; the id always breaks ties.
+ */
+export interface SortKey {
+    readonly field: FieldModel;
+    readonly direction: SortDirection;
+}
+export declare function sortKeys(entity: EntityModel, orderBy: ReadonlyArray<OrderBy> | undefined): SortKey[];
+export declare function orderByClause(keys: ReadonlyArray<SortKey>, alias: string): string;
+export declare function encodeCursor(keys: ReadonlyArray<SortKey>, record: StoredRecord): string;
+/** The sort values in a cursor, or `undefined` when it was not issued for this order. */
+export declare function decodeCursor(keys: ReadonlyArray<SortKey>, cursor: string): ReadonlyArray<unknown> | undefined;
+/**
+ * Rows after the cursor: for some key, every earlier key equals the cursor's value and this one
+ * comes after it.
+ */
+export declare function afterCondition(keys: ReadonlyArray<SortKey>, values: ReadonlyArray<unknown>, alias: string, params: Params): string;

package/dist/runtime/cursor.js

@@ -0,0 +1,100 @@
+import { Schema } from "effect";
+import { fieldValueSchema } from "../query.js";
+import { bindValue } from "./records.js";
+import { columnOf } from "./statement.js";
+/** The default order: newest first. */
+const DEFAULT_ORDER = [{ field: "created_at", direction: "desc" }];
+export function sortKeys(entity, orderBy) {
+    const requested = orderBy === undefined || orderBy.length === 0 ? DEFAULT_ORDER : orderBy;
+    const keys = [];
+    for (const entry of requested) {
+        const field = entity.fieldsByName.get(entry.field);
+        if (field === undefined) {
+            throw new Error(`${entity.name}.${entry.field} is not a field.`);
+        }
+        if (!keys.some((key) => key.field === field)) {
+            keys.push({ field, direction: entry.direction ?? "asc" });
+        }
+    }
+    if (!keys.some((key) => key.field.name === "id")) {
+        keys.push({ field: entity.fieldsByName.get("id"), direction: "asc" });
+    }
+    return keys;
+}
+export function orderByClause(keys, alias) {
+    return keys
+        .map(({ field, direction }) => direction === "asc"
+        ? `${columnOf(alias, field.column)} ASC NULLS LAST`
+        : `${columnOf(alias, field.column)} DESC NULLS FIRST`)
+        .join(", ");
+}
+function signature(keys) {
+    return keys.map(({ field, direction }) => `${field.name}:${direction}`).join(",");
+}
+const CursorBody = Schema.Struct({
+    order: Schema.String,
+    values: Schema.Array(Schema.Json),
+});
+export function encodeCursor(keys, record) {
+    const body = {
+        order: signature(keys),
+        values: keys.map(({ field }) => record[field.name] ?? null),
+    };
+    return Buffer.from(JSON.stringify(body), "utf8").toString("base64url");
+}
+/** The sort values in a cursor, or `undefined` when it was not issued for this order. */
+export function decodeCursor(keys, cursor) {
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
+    }
+    catch {
+        return undefined;
+    }
+    if (!Schema.is(CursorBody)(parsed) || parsed.order !== signature(keys)) {
+        return undefined;
+    }
+    if (parsed.values.length !== keys.length) {
+        return undefined;
+    }
+    const valid = keys.every(({ field }, index) => {
+        const value = parsed.values[index];
+        return value === null ? field.nullable : Schema.is(fieldValueSchema(field))(value);
+    });
+    return valid ? parsed.values : undefined;
+}
+/**
+ * Rows after the cursor: for some key, every earlier key equals the cursor's value and this one
+ * comes after it.
+ */
+export function afterCondition(keys, values, alias, params) {
+    const branches = keys.map((key, index) => {
+        const equal = keys
+            .slice(0, index)
+            .map((earlier, position) => equalTo(earlier, values[position], alias, params));
+        return [...equal, after(key, values[index], alias, params)].join(" AND ");
+    });
+    return branches.map((branch) => `(${branch})`).join(" OR ");
+}
+function equalTo(key, value, alias, params) {
+    const column = columnOf(alias, key.field.column);
+    return value === null
+        ? `${column} IS NULL`
+        : `${column} = ${params.add(bindValue(key.field, value), key.field.sqlType)}`;
+}
+function after(key, value, alias, params) {
+    const column = columnOf(alias, key.field.column);
+    if (key.direction === "asc") {
+        if (value === null) {
+            return "FALSE";
+        }
+        const bound = params.add(bindValue(key.field, value), key.field.sqlType);
+        return key.field.nullable
+            ? `(${column} > ${bound} OR ${column} IS NULL)`
+            : `${column} > ${bound}`;
+    }
+    if (value === null) {
+        return `${column} IS NOT NULL`;
+    }
+    return `${column} < ${params.add(bindValue(key.field, value), key.field.sqlType)}`;
+}

package/dist/runtime/deployment.d.ts

@@ -0,0 +1,7 @@
+import { Context } from "effect";
+import type { DeploymentObservation } from "../deployment.js";
+declare const RuntimeDeployment_base: Context.ServiceClass<RuntimeDeployment, "@segmentstream/ontology/RuntimeDeployment", DeploymentObservation>;
+/** In-process admission; never selected from an HTTP header or action input. */
+export declare class RuntimeDeployment extends RuntimeDeployment_base {
+}
+export {};

package/dist/runtime/deployment.js

@@ -0,0 +1,4 @@
+import { Context } from "effect";
+/** In-process admission; never selected from an HTTP header or action input. */
+export class RuntimeDeployment extends Context.Service()("@segmentstream/ontology/RuntimeDeployment") {
+}

package/dist/runtime/errors.d.ts

@@ -0,0 +1,118 @@
+import { Schema } from "effect";
+/** Where a value failed validation, and why. Paths are keys and indexes from the input's root. */
+export declare const ValidationIssue: Schema.Struct<{
+    readonly path: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Number]>>;
+    readonly message: Schema.String;
+}>;
+export type ValidationIssue = typeof ValidationIssue.Type;
+declare const InvalidQuery_base: Schema.Class<InvalidQuery, Schema.TaggedStruct<"InvalidQuery", {
+    readonly entity: Schema.String;
+    readonly message: Schema.String;
+    readonly issues: Schema.$Array<Schema.Struct<{
+        readonly path: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Number]>>;
+        readonly message: Schema.String;
+    }>>;
+}>, import("effect/Cause").YieldableError>;
+/** A query does not fit the entity: an unknown field, an operator its type lacks, a stale cursor. */
+export declare class InvalidQuery extends InvalidQuery_base {
+}
+declare const UnknownAction_base: Schema.Class<UnknownAction, Schema.TaggedStruct<"UnknownAction", {
+    readonly entity: Schema.String;
+    readonly action: Schema.String;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The entity has no action with this name, authored or generated. */
+export declare class UnknownAction extends UnknownAction_base {
+}
+export declare const PRINCIPAL_REJECTIONS: readonly ["unknown_api_key", "revoked_api_key", "inactive_user", "identity_conflict", "not_invited", "unknown_workflow", "role_mismatch"];
+declare const UndeclaredWrite_base: Schema.Class<UndeclaredWrite, Schema.TaggedStruct<"UndeclaredWrite", {
+    readonly entity: Schema.String;
+    readonly action: Schema.String;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A handler wrote an entity its action's `writes` does not list: a defect in the workspace's code,
+ * found by its tests or its first run, never a caller's mistake.
+ */
+export declare class UndeclaredWrite extends UndeclaredWrite_base {
+}
+declare const PrincipalRejected_base: Schema.Class<PrincipalRejected, Schema.TaggedStruct<"PrincipalRejected", {
+    readonly reason: Schema.Literals<readonly ["unknown_api_key", "revoked_api_key", "inactive_user", "identity_conflict", "not_invited", "unknown_workflow", "role_mismatch"]>;
+    readonly message: Schema.String;
+    /** Operator-only API-key failure stage. Never included in the public 401. */
+    readonly diagnostic: Schema.optionalKey<Schema.Literals<readonly ["malformed_api_key", "missing_api_key", "invalid_api_key_record", "api_key_secret_mismatch"]>>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A credential does not resolve to an active principal. `reason` is for operator logs; callers see
+ * an authentication failure without it, except `not_invited`: a person the `invited` sign-in policy
+ * turns away is told to ask for an invitation.
+ */
+export declare class PrincipalRejected extends PrincipalRejected_base {
+}
+declare const UnknownRole_base: Schema.Class<UnknownRole, Schema.TaggedStruct<"UnknownRole", {
+    readonly role: Schema.String;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** Roles given to users are roles of the ontology, `member` included. */
+export declare class UnknownRole extends UnknownRole_base {
+}
+declare const MemberNotFound_base: Schema.Class<MemberNotFound, Schema.TaggedStruct<"MemberNotFound", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** No member has this email or id. Services are not members: their API keys are managed instead. */
+export declare class MemberNotFound extends MemberNotFound_base {
+}
+declare const InvalidValues_base: Schema.Class<InvalidValues, Schema.TaggedStruct<"InvalidValues", {
+    readonly entity: Schema.String;
+    readonly message: Schema.String;
+    readonly issues: Schema.$Array<Schema.Struct<{
+        readonly path: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Number]>>;
+        readonly message: Schema.String;
+    }>>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A handler wrote values that do not fit the entity: an unknown field, a missing required property,
+ * a value its property rejects. It is a defect in the handler, raised as one, never a typed failure.
+ */
+export declare class InvalidValues extends InvalidValues_base {
+}
+declare const StoredRecordMismatch_base: Schema.Class<StoredRecordMismatch, Schema.TaggedStruct<"StoredRecordMismatch", {
+    readonly entity: Schema.String;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** A stored record does not match its entity's definition. A defect: the schema and data diverged. */
+export declare class StoredRecordMismatch extends StoredRecordMismatch_base {
+}
+declare const WriteOutsideAction_base: Schema.Class<WriteOutsideAction, Schema.TaggedStruct<"WriteOutsideAction", {
+    readonly entity: Schema.String;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** Writes run inside an action, which names the change for history. */
+export declare class WriteOutsideAction extends WriteOutsideAction_base {
+}
+declare const WorkflowRecoveryUnavailable_base: Schema.Class<WorkflowRecoveryUnavailable, Schema.TaggedStruct<"WorkflowRecoveryUnavailable", {
+    readonly message: Schema.String;
+    readonly cause: Schema.optionalKey<Schema.Unknown>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The recovery run that guarantees an action's trigger starts could not be armed, so the action
+ * was refused before its transaction opened. Retrying the action is safe.
+ */
+export declare class WorkflowRecoveryUnavailable extends WorkflowRecoveryUnavailable_base {
+}
+declare const TriggerInputInvalid_base: Schema.Class<TriggerInputInvalid, Schema.TaggedStruct<"TriggerInputInvalid", {
+    /** `<workflow>.<trigger>`, in wire names. */
+    readonly trigger: Schema.String;
+    readonly message: Schema.String;
+    readonly issues: Schema.$Array<Schema.Struct<{
+        readonly path: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Number]>>;
+        readonly message: Schema.String;
+    }>>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * An action trigger's `input` mapping returned a value its workflow's input does not accept. The
+ * action fails before commit, so a broken trigger shows on the first action that would fire it.
+ */
+export declare class TriggerInputInvalid extends TriggerInputInvalid_base {
+}
+export {};

package/dist/runtime/errors.js

@@ -0,0 +1,109 @@
+import { Schema } from "effect";
+/** Where a value failed validation, and why. Paths are keys and indexes from the input's root. */
+export const ValidationIssue = Schema.Struct({
+    path: Schema.Array(Schema.Union([Schema.String, Schema.Number])),
+    message: Schema.String,
+});
+/** A query does not fit the entity: an unknown field, an operator its type lacks, a stale cursor. */
+export class InvalidQuery extends Schema.TaggedError()("InvalidQuery", {
+    entity: Schema.String,
+    message: Schema.String,
+    issues: Schema.Array(ValidationIssue),
+}) {
+}
+/** The entity has no action with this name, authored or generated. */
+export class UnknownAction extends Schema.TaggedError()("UnknownAction", {
+    entity: Schema.String,
+    action: Schema.String,
+    message: Schema.String,
+}) {
+}
+export const PRINCIPAL_REJECTIONS = [
+    "unknown_api_key",
+    "revoked_api_key",
+    "inactive_user",
+    "identity_conflict",
+    "not_invited",
+    "unknown_workflow",
+    "role_mismatch",
+];
+/**
+ * A handler wrote an entity its action's `writes` does not list: a defect in the workspace's code,
+ * found by its tests or its first run, never a caller's mistake.
+ */
+export class UndeclaredWrite extends Schema.TaggedError()("UndeclaredWrite", {
+    entity: Schema.String,
+    action: Schema.String,
+    message: Schema.String,
+}) {
+}
+/**
+ * A credential does not resolve to an active principal. `reason` is for operator logs; callers see
+ * an authentication failure without it, except `not_invited`: a person the `invited` sign-in policy
+ * turns away is told to ask for an invitation.
+ */
+export class PrincipalRejected extends Schema.TaggedError()("PrincipalRejected", {
+    reason: Schema.Literals(PRINCIPAL_REJECTIONS),
+    message: Schema.String,
+    /** Operator-only API-key failure stage. Never included in the public 401. */
+    diagnostic: Schema.optionalKey(Schema.Literals([
+        "malformed_api_key",
+        "missing_api_key",
+        "invalid_api_key_record",
+        "api_key_secret_mismatch",
+    ])),
+}) {
+}
+/** Roles given to users are roles of the ontology, `member` included. */
+export class UnknownRole extends Schema.TaggedError()("UnknownRole", {
+    role: Schema.String,
+    message: Schema.String,
+}) {
+}
+/** No member has this email or id. Services are not members: their API keys are managed instead. */
+export class MemberNotFound extends Schema.TaggedError()("MemberNotFound", {
+    message: Schema.String,
+}) {
+}
+/**
+ * A handler wrote values that do not fit the entity: an unknown field, a missing required property,
+ * a value its property rejects. It is a defect in the handler, raised as one, never a typed failure.
+ */
+export class InvalidValues extends Schema.TaggedError()("InvalidValues", {
+    entity: Schema.String,
+    message: Schema.String,
+    issues: Schema.Array(ValidationIssue),
+}) {
+}
+/** A stored record does not match its entity's definition. A defect: the schema and data diverged. */
+export class StoredRecordMismatch extends Schema.TaggedError()("StoredRecordMismatch", {
+    entity: Schema.String,
+    message: Schema.String,
+}) {
+}
+/** Writes run inside an action, which names the change for history. */
+export class WriteOutsideAction extends Schema.TaggedError()("WriteOutsideAction", {
+    entity: Schema.String,
+    message: Schema.String,
+}) {
+}
+/**
+ * The recovery run that guarantees an action's trigger starts could not be armed, so the action
+ * was refused before its transaction opened. Retrying the action is safe.
+ */
+export class WorkflowRecoveryUnavailable extends Schema.TaggedError()("WorkflowRecoveryUnavailable", {
+    message: Schema.String,
+    cause: Schema.optionalKey(Schema.Unknown),
+}) {
+}
+/**
+ * An action trigger's `input` mapping returned a value its workflow's input does not accept. The
+ * action fails before commit, so a broken trigger shows on the first action that would fire it.
+ */
+export class TriggerInputInvalid extends Schema.TaggedError()("TriggerInputInvalid", {
+    /** `<workflow>.<trigger>`, in wire names. */
+    trigger: Schema.String,
+    message: Schema.String,
+    issues: Schema.Array(ValidationIssue),
+}) {
+}

package/dist/runtime/federation-tables.d.ts

@@ -0,0 +1,2 @@
+export declare const FEDERATION_TABLES: string[];
+export declare const FEDERATION_TABLES_DDL: string[];

package/dist/runtime/federation-tables.js

@@ -0,0 +1,20 @@
+export const FEDERATION_TABLES = ["_user_identities", "_federation_sessions"];
+export const FEDERATION_TABLES_DDL = [
+    `CREATE TABLE IF NOT EXISTS "_user_identities" (
+    issuer text NOT NULL, subject text NOT NULL, user_id uuid NOT NULL REFERENCES "user"(id) ON DELETE CASCADE,
+    PRIMARY KEY (issuer, subject)
+  )`,
+    `CREATE INDEX IF NOT EXISTS "_user_identities_user" ON "_user_identities" (user_id)`,
+    `CREATE TABLE IF NOT EXISTS "_federation_sessions" (
+    hash text PRIMARY KEY, user_id uuid REFERENCES "user"(id) ON DELETE CASCADE,
+    issuer text NOT NULL, subject text NOT NULL, client_id text NOT NULL,
+    generation integer NOT NULL, consent_id text NOT NULL, expires_at bigint NOT NULL
+  )`,
+    `ALTER TABLE "_federation_sessions" ADD COLUMN IF NOT EXISTS session_id text`,
+    `ALTER TABLE "_federation_sessions" ADD COLUMN IF NOT EXISTS environment text`,
+    `ALTER TABLE "_federation_sessions" ADD COLUMN IF NOT EXISTS deployment_id text`,
+    `ALTER TABLE "_federation_sessions" ADD COLUMN IF NOT EXISTS manifest_digest text`,
+    `ALTER TABLE "_federation_sessions" ADD COLUMN IF NOT EXISTS link_user_id uuid
+     REFERENCES "user"(id) ON DELETE CASCADE`,
+    `CREATE INDEX IF NOT EXISTS "_federation_sessions_expiry" ON "_federation_sessions" (expires_at)`,
+];

package/dist/runtime/federation.d.ts

@@ -0,0 +1,42 @@
+import { Effect, Schema } from "effect";
+import { SqlClient } from "effect/unstable/sql";
+import type { Ontology } from "../ontology.js";
+import type { Principal } from "../runtime.js";
+export declare const FEDERATION_TOKEN_PREFIX = "ssfs_";
+export declare const federationDigest: (value: string) => string;
+export declare const FederationSession: Schema.Struct<{
+    readonly hash: Schema.String;
+    readonly userId: Schema.NullOr<Schema.String>;
+    readonly linkUserId: Schema.optionalKey<Schema.String>;
+    readonly issuer: Schema.String;
+    readonly subject: Schema.String;
+    readonly clientId: Schema.String;
+    readonly generation: Schema.Int;
+    readonly consentId: Schema.String;
+    readonly sessionId: Schema.optionalKey<Schema.String>;
+    readonly environment: Schema.optionalKey<Schema.String>;
+    readonly deploymentId: Schema.optionalKey<Schema.String>;
+    readonly manifestDigest: Schema.optionalKey<Schema.String>;
+    readonly expiresAt: Schema.Number;
+}>;
+export type FederationSession = typeof FederationSession.Type;
+export interface FederationStore {
+    readonly identity: (issuer: string, subject: string) => Effect.Effect<Principal | undefined>;
+    /** Only the service's authenticated workspace member supplies proofUserId. Never an email. */
+    readonly link: (issuer: string, subject: string, proofUserId: string) => Effect.Effect<Principal | undefined>;
+    readonly emailIdentity?: (subject: string) => Effect.Effect<Principal | undefined>;
+    readonly bindingExists?: (issuer: string, subject: string) => Effect.Effect<boolean>;
+    readonly enroll?: (identity: {
+        issuer: string;
+        subject: string;
+        email?: string;
+        name?: string;
+    }) => Effect.Effect<Principal | undefined>;
+    readonly linkEmail?: (userId: string, subject: string, email?: string) => Effect.Effect<Principal | "email_identity_mismatch" | undefined>;
+    readonly save: (session: FederationSession) => Effect.Effect<void>;
+    readonly read: (hash: string) => Effect.Effect<FederationSession | undefined>;
+    readonly consumePending: (hash: string) => Effect.Effect<FederationSession | undefined>;
+    readonly remove: (hash: string) => Effect.Effect<void>;
+    readonly principal: (id: string) => Effect.Effect<Principal | undefined>;
+}
+export declare function sqlFederationStore(ontology: Ontology, sql: SqlClient.SqlClient): FederationStore;