@sixb/core 0.1.0 → 0.1.2

package/src/objects/service/action-service.ts

@@ -5,6 +5,7 @@
  */
 
 import type { RequestActionResult } from "../../actions/request"
+import type { ExecutionContext } from "../../execution"
 import type { SixbRuntimeContext } from "../../runtime/types"
 import type { ActionRunRecord } from "../../storage"
 import {
@@ -17,24 +18,26 @@ import { resolveObjectContext } from "../context"
 
 export async function requestAction(
   runtime: SixbRuntimeContext,
+  execution: ExecutionContext,
   objectTypeId: string,
   primaryId: string,
   actionId: string,
   params?: Record<string, unknown>,
   options?: RequestActionOptions
 ): Promise<RequestActionResult> {
-  const ctx = resolveObjectContext(runtime, objectTypeId)
+  const ctx = { ...resolveObjectContext(runtime, objectTypeId), execution }
   return requestActionLeaf(ctx, { primaryId, actionId, params, options })
 }
 
 export async function requestActionAndWait(
   runtime: SixbRuntimeContext,
+  execution: ExecutionContext,
   objectTypeId: string,
   primaryId: string,
   actionId: string,
   params?: Record<string, unknown>,
   options?: RequestActionAndWaitOptions
 ): Promise<ActionRunRecord> {
-  const ctx = resolveObjectContext(runtime, objectTypeId)
+  const ctx = { ...resolveObjectContext(runtime, objectTypeId), execution }
   return requestActionAndWaitLeaf(ctx, { primaryId, actionId, params, options })
 }

package/src/objects/service/list-service.ts

@@ -1,7 +1,7 @@
 /**
  * Cross-type object listing for dashboards and search.
  *
- * On scoped runtimes the type filter is authorized before the storage call:
+ * On principal-bound runtimes the type filter is authorized before the storage call:
  * explicitly requested types must all be viewable, and unfiltered listings
  * narrow to the principal's viewable types instead of post-filtering rows.
  */

package/src/objects/telemetry/history.ts

@@ -1,4 +1,5 @@
 import { type AuthorizationContext, assertAuthorized } from "../../authorization"
+import type { RuntimeAuthorization } from "../../execution"
 import type {
   TimeseriesHistoryBatchInput,
   TimeseriesHistoryBatchResult,
@@ -8,6 +9,7 @@ import type {
 
 export interface TelemetryHistoryOptions {
   readonly storage: TimeseriesStorage
+  readonly runtimeAuthorization?: RuntimeAuthorization
   readonly authorization?: AuthorizationContext | null
 }
 
@@ -15,17 +17,20 @@ export async function getTelemetryHistoryBatch(
   input: TimeseriesHistoryBatchInput,
   options: TelemetryHistoryOptions
 ): Promise<readonly TimeseriesHistoryBatchResult[]> {
-  assertTelemetrySeriesViewable(input.series, options.authorization)
+  assertTelemetrySeriesViewable(input.series, options)
   return options.storage.getHistoryBatch(input)
 }
 
 function assertTelemetrySeriesViewable(
   series: readonly TimeseriesHistorySeriesInput[],
-  authorization: AuthorizationContext | null | undefined
+  authorization: Pick<TelemetryHistoryOptions, "authorization" | "runtimeAuthorization">
 ): void {
   for (const objectTypeId of new Set(series.map((entry) => entry.objectTypeId))) {
     assertAuthorized(
-      { authorization: authorization ?? undefined },
+      {
+        runtimeAuthorization: authorization.runtimeAuthorization,
+        authorization: authorization.authorization ?? undefined,
+      },
       { kind: "object.view", objectTypeId }
     )
   }

package/src/objects/telemetry/write-batch.ts

@@ -34,8 +34,6 @@ export async function writeTelemetryBatch(
   try {
     commit = await getOntologyMutationRuntime(ctx).appendTelemetry({
       source: { kind: "runtime", requestId: randomUUID() },
-      // A `Principal` is an `EventActor` — same literals, no translation.
-      ...(ctx.authorization === undefined ? {} : { actor: ctx.authorization.principal }),
       points,
     })
   } catch (error) {

package/src/ontology/index.ts

@@ -55,7 +55,12 @@ export type {
 
 // ── Registry ──────────────────────────────────────────────
 
-export type { OntologyDocumentInput, OntologyRegistryOptions, OntologySource } from "./registry"
+export type {
+  OntologyDefinitionCatalog,
+  OntologyDocumentInput,
+  OntologyRegistryOptions,
+  OntologySource,
+} from "./registry"
 export { OntologyRegistry } from "./registry"
 
 // ── Errors ─────────────────────────────────────────────────

package/src/ontology/json-schema.ts

@@ -53,8 +53,9 @@ function schemaJsonSchema(
       case "integer":
         return { type: "integer" }
       case "double":
-      case "decimal":
         return { type: "number" }
+      case "decimal":
+        return { type: "string", pattern: "^[+-]?\\d+(?:\\.\\d+)?$" }
       case "boolean":
         return { type: "boolean" }
       case "date":

package/src/ontology/registry.ts

@@ -2,7 +2,7 @@
  * Standalone ontology registry — owns all type state and resolution logic.
  *
  * Zero infrastructure dependencies: imports only from the `ontology/` module.
- * Other modules depend on `OntologyRegistry` instead of coupling to the full
+ * Other modules depend on its read-only catalog instead of coupling to the full
  * `Sixb` facade.
  */
 
@@ -40,6 +40,20 @@ export interface OntologyRegistryOptions {
   readonly sources: readonly OntologySource[]
 }
 
+/** Read-only access to the host's validated ontology definitions and type graph. */
+export interface OntologyDefinitionCatalog {
+  listObjectTypes(): readonly ObjectTypeWithPropertyTokens[]
+  getObjectTypeById(objectTypeId: string): ObjectTypeWithPropertyTokens | null
+  resolveObjectType(objectTypeId: string): ObjectTypeWithPropertyTokens
+  getPrimaryPropertyId(objectTypeId: string): string
+  listSubTypes(objectTypeId: string): string[]
+  listAncestorChain(objectType: ObjectType): readonly ObjectTypeWithPropertyTokens[]
+  isValidLinkTarget(expected: string | string[], actual: string): boolean
+  getObjectTypesById(): ReadonlyMap<string, ObjectTypeWithPropertyTokens>
+  getValueTypesById(): ReadonlyMap<string, ValueType>
+  getPrimaryByTypeId(): ReadonlyMap<string, string>
+}
+
 // ── Private helpers ──────────────────────────────────────────
 
 function isOntologyDocumentSource(
@@ -156,7 +170,7 @@ function collectOntology(sources: readonly OntologySource[]): {
  *
  * Exposes read-only accessors so consumers never mutate ontology state.
  */
-export class OntologyRegistry {
+export class OntologyRegistry implements OntologyDefinitionCatalog {
   private readonly objectTypesById = new Map<string, ObjectTypeWithPropertyTokens>()
   private readonly valueTypesById = new Map<string, ValueType>()
   private readonly subTypesById = new Map<string, Set<string>>()

package/src/ontology/validation/normalize.ts

@@ -2,7 +2,7 @@ import { assertJsonValue, cloneJsonValue, type JsonValue } from "../../json"
 import type { ObjectFieldSchema, Property, Schema, ValueType } from ".."
 import { normalizeDecimalValue } from "../decimal"
 import { OntologyValidationError } from "../errors"
-import { resolveValueTypeSchema } from "./schema"
+import { isRecord, resolveValueTypeSchema } from "./schema"
 
 /**
  * Normalize a property bag to JSON-safe values using each property's schema —
@@ -84,20 +84,18 @@ export function normalizeSchemaValue(
 
   const fields = schema.properties
   const record = assertPlainRecord(value, path)
-  const output: Record<string, JsonValue> = {}
+  const entries: Array<[string, JsonValue]> = []
   for (const [fieldId, field] of Object.entries(fields)) {
     const fieldValue = record[fieldId]
     if (fieldValue === undefined) {
       continue
     }
-    output[fieldId] = normalizeObjectFieldValue(
-      field,
-      fieldValue,
-      `${path}.${fieldId}`,
-      valueTypesById
-    )
+    entries.push([
+      fieldId,
+      normalizeObjectFieldValue(field, fieldValue, `${path}.${fieldId}`, valueTypesById),
+    ])
   }
-  return output
+  return Object.fromEntries(entries)
 }
 
 function normalizeObjectFieldValue(
@@ -149,10 +147,6 @@ function normalizeDateLike(value: unknown, path: string): Date {
   return date
 }
 
-function isPlainRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value)
-}
-
 /**
  * Inverse of `normalizeSchemaValue` for the handler-facing surface: re-hydrate
  * `date`/`timestamp` values from their stored ISO string back into a `Date`, so
@@ -196,7 +190,7 @@ export function coerceSchemaValueToTyped(
   }
 
   if (schema.type === "map") {
-    if (!isPlainRecord(value)) return value
+    if (!isRecord(value)) return value
     return Object.fromEntries(
       Object.entries(value).map(([key, entry]) => [
         key,
@@ -205,7 +199,7 @@ export function coerceSchemaValueToTyped(
     )
   }
 
-  if (!isPlainRecord(value)) return value
+  if (!isRecord(value)) return value
   const output: Record<string, unknown> = { ...value }
   for (const [fieldId, field] of Object.entries(schema.properties)) {
     if (value[fieldId] === undefined) continue

package/src/pipelines/execution.ts

@@ -0,0 +1,105 @@
+import { canViewPipelineRun, isAllowed } from "../authorization"
+import type { ExecutionContext } from "../execution"
+import type { SixbRuntimeContext } from "../runtime/types"
+import type {
+  ListLatestPipelineRunsResult,
+  ListPipelineRunsInput,
+  ListPipelineRunsResult,
+  ListPipelineStepRunsInput,
+  ListPipelineStepRunsResult,
+  PipelineRunRecord,
+} from "../storage/pipeline-runs"
+import { PipelineError } from "./errors"
+import {
+  type PipelineRunRequestResult,
+  type RequestPipelineRunInput,
+  requestPipelineRun,
+} from "./request"
+import type { PipelineDefinition } from "./types"
+
+export interface PipelineRunsRuntime {
+  getById(runId: string): Promise<PipelineRunRecord | null>
+  list(
+    input?: Omit<ListPipelineRunsInput, "projectId" | "pipelineIds">
+  ): Promise<ListPipelineRunsResult>
+  listLatest(pipelineIds: readonly string[]): Promise<ListLatestPipelineRunsResult>
+  listSteps(
+    runId: string,
+    input?: Omit<ListPipelineStepRunsInput, "projectId" | "pipelineRunId">
+  ): Promise<ListPipelineStepRunsResult | null>
+}
+
+export interface PipelinesRuntime {
+  list(): readonly PipelineDefinition[]
+  getById(pipelineId: string): PipelineDefinition | null
+  request(input: RequestPipelineRunInput): Promise<PipelineRunRequestResult>
+  readonly runs: PipelineRunsRuntime
+}
+
+export function createPipelinesRuntime(
+  runtime: SixbRuntimeContext,
+  execution: ExecutionContext,
+  source: Pick<PipelinesRuntime, "list" | "getById">
+): PipelinesRuntime {
+  const allowed = (pipelineId: string) =>
+    isAllowed(runtime.authorization, { kind: "pipeline.run", pipelineId })
+  const visibleIds = () =>
+    source
+      .list()
+      .filter((pipeline) => allowed(pipeline.id))
+      .map((pipeline) => pipeline.id)
+
+  const getRun = async (runId: string) => {
+    const run =
+      (await runtime.storage.pipelineRuns?.getById({
+        projectId: runtime.projectId,
+        id: runId,
+      })) ?? null
+    return run && canViewPipelineRun(runtime.authorization, run) ? run : null
+  }
+
+  return {
+    list: () => source.list().filter((pipeline) => allowed(pipeline.id)),
+    getById: (pipelineId) => {
+      const pipeline = source.getById(pipelineId)
+      return pipeline && allowed(pipelineId) ? pipeline : null
+    },
+    request: async (input) => {
+      const pipeline = source.getById(input.pipelineId)
+      if (!pipeline) throw new PipelineError(`[Sixb] Unknown pipeline '${input.pipelineId}'`)
+      return requestPipelineRun(runtime, execution, pipeline, input)
+    },
+    runs: {
+      getById: getRun,
+      list: (input = {}) => {
+        const storage = runtime.storage.pipelineRuns
+        if (!storage) return Promise.resolve({ runs: [], hasMore: false, total: 0 })
+        return storage.list({
+          projectId: runtime.projectId,
+          ...input,
+          pipelineIds: runtime.authorization ? visibleIds() : undefined,
+        })
+      },
+      listLatest: (pipelineIds) => {
+        const storage = runtime.storage.pipelineRuns
+        if (!storage || pipelineIds.length === 0) return Promise.resolve({ runs: [] })
+        const allowedIds = pipelineIds.filter(allowed)
+        return allowedIds.length === 0
+          ? Promise.resolve({ runs: [] })
+          : storage.listLatestByPipelineIds({
+              projectId: runtime.projectId,
+              pipelineIds: allowedIds,
+            })
+      },
+      listSteps: async (runId, input = {}) => {
+        const storage = runtime.storage.pipelineRuns
+        if (!storage || !(await getRun(runId))) return null
+        return storage.listSteps({
+          projectId: runtime.projectId,
+          ...input,
+          pipelineRunId: runId,
+        })
+      },
+    },
+  }
+}

package/src/pipelines/index.ts

@@ -6,6 +6,13 @@ export type {
   RequestPipelineRunInput,
 } from "./request"
 export { requestPipelineRun } from "./request"
+export {
+  type AutomaticPipelineExecutionSource,
+  type AutomaticPipelineRunDispatchInput,
+  PipelineRunDispatcher,
+  type PipelineRunDispatcherDependencies,
+  type PipelineRunDispatchPort,
+} from "./run-dispatch"
 export type {
   PipelineBuilder,
   PipelineDefinition,

package/src/pipelines/request.ts

@@ -1,15 +1,17 @@
-import { randomUUID } from "node:crypto"
 import { assertAuthorized } from "../authorization"
+import {
+  createPrimitiveExecutionRecord,
+  ensureExecutionRecord,
+  executionRecordInputFromRuntime,
+} from "../execution/durable"
+import type { ExecutionContext } from "../execution/types"
 import type { SixbRuntimeContext } from "../runtime/types"
 import { PipelineError } from "./errors"
+import { dispatchPipelineRun } from "./run-dispatch"
 import type { PipelineDefinition } from "./types"
 
 export interface PipelineRunRequestOptions {
-  /**
-   * Identity of the run to create. Deduplicated when a worker claims the job, not here: two requests
-   * carrying the same id enqueue two jobs, and the second loses to the unique run id. So one run
-   * happens, but this call cannot tell you whether it was yours.
-   */
+  /** Stable identity used to make dispatch idempotent. */
   readonly runId?: string
 }
 
@@ -20,9 +22,10 @@ export interface RequestPipelineRunInput extends PipelineRunRequestOptions {
 export interface PipelineRunRequestResult {
   readonly pipelineId: string
   readonly runId: string
-  /** When the job was enqueued. Not persisted — the run row records `startedAt` instead. */
+  /** Durable time at which the run entered the queue. */
   readonly queuedAt: string
   readonly jobId?: string
+  readonly created: boolean
 }
 
 /**
@@ -31,11 +34,11 @@ export interface PipelineRunRequestResult {
  * Operates on an already-resolved definition and the shared runtime context, so the HTTP route and
  * the runtime verb cannot drift apart.
  *
- * Like `requestSyncRun` and unlike `requestWorkflowRun`, the run row is created by the worker that
- * claims the job — see the note there for why the two cannot be aligned by adding a field.
+ * The immutable child execution and queued run are persisted before queue publication.
  */
 export async function requestPipelineRun(
   runtime: SixbRuntimeContext,
+  execution: ExecutionContext,
   pipeline: PipelineDefinition,
   options: PipelineRunRequestOptions = {}
 ): Promise<PipelineRunRequestResult> {
@@ -49,23 +52,26 @@ export async function requestPipelineRun(
     throw new PipelineError("[Sixb] Pipeline run queue is not configured.")
   }
 
-  const runId = createPipelineRunId(options.runId)
-  const queuedAt = new Date().toISOString()
-  const [job] = await queue.enqueue({
+  return dispatchPipelineRun({
+    errorReporterHost: runtime,
     projectId: runtime.projectId,
-    jobs: [{ type: "pipeline.run.requested", payload: { pipelineId: pipeline.id, runId } }],
+    pipeline,
+    storage: runtime.storage,
+    queue,
+    ...options,
+    createExecution: async (executionId, runId) => {
+      const caller = await ensureExecutionRecord(
+        runtime.storage.executions,
+        executionRecordInputFromRuntime({
+          execution,
+          runtimeAuthorization: runtime.runtimeAuthorization,
+        })
+      )
+      return createPrimitiveExecutionRecord({
+        id: executionId,
+        primitive: { kind: "pipeline", id: pipeline.id, runId },
+        origin: { type: "execution", parent: caller },
+      })
+    },
   })
-
-  return { pipelineId: pipeline.id, runId, queuedAt, jobId: job?.id }
-}
-
-function createPipelineRunId(runId: string | undefined): string {
-  if (runId !== undefined) {
-    if (!runId.trim()) {
-      throw new PipelineError("[Sixb] Pipeline run id must not be empty")
-    }
-    return runId
-  }
-
-  return `run_${randomUUID()}`
 }