@sixb/core 0.1.12 → 0.1.13

package/dist/{chunk-m7cx05vp.js → chunk-rqtdtm43.js}

@@ -21,6 +21,8 @@ import {
   withFailureMessage
 } from "./chunk-z3y5kg1x.js";
 import {
+  collectUserRefIds,
+  userReferenceProblem,
   normalizeObjectProperties2,
   normalizeSchemaValue2,
   assertKnownProperties2,
@@ -29,7 +31,7 @@ import {
   normalizeLinkProperties2,
   validateLinkProperties2,
   validateTelemetryUnit2
-} from "./chunk-vsg0g7h9.js";
+} from "./chunk-d8yes9yx.js";
 import {
   materializationEventKindOrdinal2,
   sha256Canonical2,
@@ -37,29 +39,29 @@ import {
   createCommitId2,
   createEventId2,
   materializationApplyPhase
-} from "./chunk-hkw8rykk.js";
+} from "./chunk-ht4a7mjg.js";
 import {
   ProjectionValidationError2,
   validateProjectionsAtStartup,
   isProjectionDefinition2,
   resolveExecutionScopeAuthorization
-} from "./chunk-bbaa1fet.js";
-import {
-  isStorageSerializationFailure2
-} from "./chunk-wjffn5m4.js";
+} from "./chunk-rzcjp5m2.js";
 import {
   objectBatchKey2,
   vectorConfiguration,
   vectorSources,
   normalizeVector2
-} from "./chunk-ybhz3j9g.js";
+} from "./chunk-gc226ten.js";
 import {
   parseDatasetTimestamp2
 } from "./chunk-z667z3sg.js";
 import {
   executionRecordInputFromRuntime,
   ensureExecutionRecord2
-} from "./chunk-0mza4xb2.js";
+} from "./chunk-m8zkvep1.js";
+import {
+  isStorageSerializationFailure2
+} from "./chunk-zdkcdshk.js";
 import {
   assertPinnedDatasetWatermark2
 } from "./chunk-3qpcrcj8.js";
@@ -657,19 +659,36 @@ async function withSerializationRetry(context, run) {
 
 // src/materializer/execution/scope.ts
 function prepareMaterializerExecution(projectId, scope) {
-  const authorization = resolveExecutionScopeAuthorization(projectId, scope);
-  const base = {
+  resolveExecutionScopeAuthorization(projectId, scope);
+  return {
     scope,
     record: executionRecordInputFromRuntime({
       execution: scope.execution,
       runtimeAuthorization: scope.authorization
     }),
     executionId: scope.execution.id,
-    correlationId: scope.execution.correlationId
+    correlationId: scope.execution.correlationId,
+    attribution: executionAttribution(scope)
   };
-  if (authorization.type !== "principal")
-    return base;
-  return { ...base, actor: authorization.context.principal };
+}
+function executionAttribution(scope) {
+  const { requestedBy, executor } = scope.execution;
+  const attributed = { executor: eventExecutor(executor) };
+  if (requestedBy === undefined)
+    return attributed;
+  return { ...attributed, requestedBy: { type: requestedBy.type, id: requestedBy.id } };
+}
+function eventExecutor(executor) {
+  switch (executor.type) {
+    case "request":
+      return { type: "request", requestId: executor.requestId };
+    case "primitive":
+      return { type: "primitive", kind: executor.kind, id: executor.id, runId: executor.runId };
+    case "agent":
+      return { type: "agent", runId: executor.runId };
+    case "kernel":
+      return { type: "kernel", operation: structuredClone(executor.operation) };
+  }
 }
 function ensureMaterializerExecution(executions, execution) {
   return ensureExecutionRecord2(executions, execution.record);
@@ -799,17 +818,15 @@ function buildTelemetryEventDraft(context, point) {
   };
 }
 function eventDraftBase(context) {
-  const base = {
+  return {
     schemaVersion: 1,
     projectId: context.projectId,
     occurredAt: context.committedAt,
     correlationId: context.correlationId,
     origin: context.origin,
+    ...context.attribution,
     commitId: context.commitId
   };
-  if (context.actor === undefined)
-    return base;
-  return { ...base, actor: context.actor };
 }
 function orderedDraft(sortKey, draft) {
   return {
@@ -2522,16 +2539,71 @@ function sameAuthority(left, right) {
   return stableJsonStringify2(left) === stableJsonStringify2(right);
 }
 
+// src/materializer/edits/user-refs.ts
+var NO_REFERENCED_USERS = { kind: "loaded", statuses: new Map };
+async function loadReferencedUsers(context, operations) {
+  const ids = new Set;
+  for (const operation of operations) {
+    switch (operation.kind) {
+      case "object.create":
+      case "object.upsert":
+        collectObjectUserRefIds(context.ontology, operation.ref.objectTypeId, operation.properties, ids);
+        break;
+      case "object.patch":
+        collectObjectUserRefIds(context.ontology, operation.ref.objectTypeId, operation.set, ids);
+        break;
+      default:
+        break;
+    }
+  }
+  if (ids.size === 0)
+    return NO_REFERENCED_USERS;
+  const users = context.storage.auth?.users;
+  if (!users)
+    return { kind: "unavailable" };
+  const entries = await Promise.all([...ids].map(async (id) => {
+    const user = await users.getById({ projectId: context.projectId, id });
+    return [id, user?.status ?? null];
+  }));
+  return { kind: "loaded", statuses: new Map(entries) };
+}
+function assertIntroducedUsersActive(ontology, objectTypeId, before, after, users) {
+  const objectType = ontology.resolveObjectType(objectTypeId);
+  const valueTypesById = ontology.getValueTypesById();
+  for (const property of objectType.properties) {
+    const introduced = collectUserRefIds(property.schema, after[property.id], valueTypesById, new Set);
+    if (introduced.size === 0)
+      continue;
+    const held = collectUserRefIds(property.schema, before?.[property.id], valueTypesById, new Set);
+    for (const id of introduced) {
+      if (held.has(id))
+        continue;
+      const problem = userReferenceProblem(`Property '${objectTypeId}.${property.id}'`, id, users.kind === "unavailable" ? "unverifiable" : users.statuses.get(id) ?? null);
+      if (problem)
+        throw new MaterializationValidationError2(problem);
+    }
+  }
+}
+function collectObjectUserRefIds(ontology, objectTypeId, properties, into) {
+  const objectType = ontology.getObjectTypeById(objectTypeId);
+  if (!objectType)
+    return;
+  const valueTypesById = ontology.getValueTypesById();
+  for (const property of objectType.properties) {
+    collectUserRefIds(property.schema, properties[property.id], valueTypesById, into);
+  }
+}
+
 // src/materializer/edits/operations.ts
 function undoEditJournal(journal) {
   for (let index = journal.length - 1;index >= 0; index -= 1) {
     journal[index]?.restore();
   }
 }
-function applyEditOperation(context, state, operation, identity, journal) {
+function applyEditOperation(context, state, operation, identity, users, journal) {
   validateOperationRef(context, operation);
   if (isObjectOperation2(operation)) {
-    return applyObjectOperation(context, state, operation, identity, journal);
+    return applyObjectOperation(context, state, operation, identity, users, journal);
   }
   return applyLinkOperation(context, state, operation, linkCardinality(context.ontology, operation.ref), journal);
 }
@@ -2542,7 +2614,7 @@ function validateOperationRef(context, operation) {
   }
   validateLinkRef(context.ontology, operation.ref);
 }
-function applyObjectOperation(context, state, operation, identity, journal) {
+function applyObjectOperation(context, state, operation, identity, users, journal) {
   const working = requireWorkingObject(state, operation);
   const normalized = validateObjectOperation(context, operation);
   const currentEffective = resolveObject(context.ontology, working);
@@ -2555,7 +2627,8 @@ function applyObjectOperation(context, state, operation, identity, journal) {
     effectiveExists: currentEffective !== null,
     ...normalized
   });
-  applyObjectTransition(context, state, working, transition.next, transition.editedAt, journal);
+  const assertUsers = operation.kind === "object.restore" ? undefined : (resolved) => assertIntroducedUsersActive(context.ontology, operation.ref.objectTypeId, currentEffective?.properties, resolved.properties, users);
+  applyObjectTransition(context, state, working, transition.next, transition.editedAt, journal, assertUsers);
   return objectOperationOutcome(operation, working, transition.changed, context, identity);
 }
 function requireWorkingObject(state, operation) {
@@ -2582,15 +2655,17 @@ function validateObjectOperation(context, operation) {
       return {};
   }
 }
-function applyObjectTransition(context, state, working, next, nextEditedAt, journal) {
+function applyObjectTransition(context, state, working, next, nextEditedAt, journal, validateResolved) {
   const previous = working.override;
   const previousEditedAt = working.editedAt;
   working.override = next;
   working.editedAt = { ...nextEditedAt };
   try {
     const resolved = resolveObject(context.ontology, working);
-    if (resolved)
+    if (resolved) {
       validateEffectiveObject(context.ontology, resolved.ref, resolved.properties);
+      validateResolved?.(resolved);
+    }
     validateWorkingCardinality(state.links.slots);
   } catch (error) {
     working.override = previous;
@@ -2841,16 +2916,14 @@ function buildLinkEvent(context, planContext, change) {
   return buildLinkMaterializationEventDraft({ ...eventContext, change });
 }
 function materializationEventContext(context, planContext) {
-  const base = {
+  return {
     projectId: context.projectId,
     commitId: planContext.identity.commitId,
     committedAt: planContext.identity.committedAt,
     origin: planContext.origin,
-    correlationId: planContext.correlationId
+    correlationId: planContext.correlationId,
+    attribution: planContext.attribution
   };
-  if (planContext.actor === undefined)
-    return base;
-  return { ...base, actor: planContext.actor };
 }
 function sortedObjects(objects) {
   return [...objects.values()].sort((left, right) => compareObjectRefs2(left.ref, right.ref));
@@ -2973,10 +3046,10 @@ async function commitVectorWrites(context, storage, input, commitId, session) {
 
 // src/materializer/edits/commit.ts
 async function commitEdits(context, raw) {
-  const command = prepareEditCommit(context, raw);
+  const command = await prepareEditCommit(context, raw);
   return executeEditCommit(context, command);
 }
-function prepareEditCommit(context, raw) {
+async function prepareEditCommit(context, raw) {
   const input = normalizeOntologyEditCommit2(raw.input);
   const idempotencyKey = editIdempotencyKey(input);
   const identity = createTimedCommitIdentity2({
@@ -2989,7 +3062,8 @@ function prepareEditCommit(context, raw) {
     input,
     identity,
     origin: input.source,
-    execution: prepareMaterializerExecution(context.projectId, raw.scope)
+    execution: prepareMaterializerExecution(context.projectId, raw.scope),
+    users: await loadReferencedUsers(context, input.operations)
   };
 }
 function editIdempotencyKey(input) {
@@ -3077,13 +3151,14 @@ async function beginEditMaterialization(context, storage, command) {
   });
 }
 function buildEditCommit(context, command) {
-  const commit = {
+  return {
     projectId: context.projectId,
     id: command.identity.commitId,
     idempotencyKey: command.identity.idempotencyKey,
     requestHash: command.identity.requestHash,
     executionId: command.execution.executionId,
     origin: command.origin,
+    ...command.execution.attribution,
     ontologyRevision: context.projectionRegistry.ontologyRevision,
     intent: {
       kind: "edit",
@@ -3093,9 +3168,6 @@ function buildEditCommit(context, command) {
     },
     committedAt: command.identity.committedAt
   };
-  if (command.execution.actor === undefined)
-    return commit;
-  return { ...commit, actor: command.execution.actor };
 }
 function editExpectations(input) {
   if (input.mode === "atomic") {
@@ -3123,7 +3195,7 @@ function applyEditExecutionUnit(context, state, command, unit) {
 }
 function applyOneEditOperation(context, state, operation, command) {
   try {
-    return applyEditOperation(context, state, operation, command.identity);
+    return applyEditOperation(context, state, operation, command.identity, command.users);
   } catch (error) {
     if (!isRecoverableEditValidation(command.input, error))
       throw error;
@@ -3136,7 +3208,7 @@ function applyEditOperationGroup(context, state, command, group) {
   for (const operation of group) {
     let outcome;
     try {
-      outcome = applyEditOperation(context, state, operation, command.identity, journal);
+      outcome = applyEditOperation(context, state, operation, command.identity, command.users, journal);
     } catch (error) {
       if (!isRecoverableEditValidation(command.input, error))
         throw error;
@@ -3164,14 +3236,12 @@ function isRecoverableEditValidation(input, error) {
   return error instanceof MaterializationValidationError2;
 }
 function editPlanContext(command) {
-  const context = {
+  return {
     identity: command.identity,
     origin: command.origin,
-    correlationId: command.execution.correlationId
+    correlationId: command.execution.correlationId,
+    attribution: command.execution.attribution
   };
-  if (command.execution.actor === undefined)
-    return context;
-  return { ...context, actor: command.execution.actor };
 }
 async function finalizeEditMaterialization(storage, session, result) {
   const applied = await storage.ontology.materializations.finalize({
@@ -3520,6 +3590,7 @@ function appendObjectChangeWork(work, sortKey, context, input, change) {
     committedAt: input.identity.committedAt,
     origin: input.origin,
     correlationId: input.correlationId,
+    attribution: input.attribution,
     change
   })));
 }
@@ -3660,6 +3731,7 @@ function appendLinkChangeWork(work, sortKey, context, input, change) {
     committedAt: input.identity.committedAt,
     origin: input.origin,
     correlationId: input.correlationId,
+    attribution: input.attribution,
     change
   })));
 }
@@ -3978,6 +4050,7 @@ function projectionCommit(projectId, command, identity, origin) {
     requestHash: identity.requestHash,
     executionId: command.scopeExecution.executionId,
     origin,
+    ...command.scopeExecution.attribution,
     ontologyRevision: command.runIdentity.ontologyRevision,
     projectionRevision: command.runIdentity.projectionRevision,
     ownershipHash: command.runIdentity.ownershipHash,
@@ -3992,7 +4065,8 @@ async function planReadyProjection(context, storage, session, command, ready, or
     projectionKind: command.projectionKind,
     identity: ready.identity,
     origin,
-    correlationId: command.scopeExecution.correlationId
+    correlationId: command.scopeExecution.correlationId,
+    attribution: command.scopeExecution.attribution
   };
   if (command.signal === undefined) {
     return planProjectionReplacement(context, storage, session, input);
@@ -4227,16 +4301,14 @@ async function stageTelemetryObjectPlan(context, storage, session, planContext,
   await stageWorkBounded(context, storage, session, work);
 }
 function telemetryEventContext(context, planContext) {
-  const eventContext = {
+  return {
     projectId: context.projectId,
     commitId: planContext.identity.commitId,
     committedAt: planContext.identity.committedAt,
     origin: planContext.origin,
-    correlationId: planContext.event.correlationId
+    correlationId: planContext.event.correlationId,
+    attribution: planContext.event.attribution
   };
-  if (planContext.event.actor === undefined)
-    return eventContext;
-  return { ...eventContext, actor: planContext.event.actor };
 }
 function emptyTelemetryCounts() {
   return {
@@ -4435,7 +4507,7 @@ async function executeTelemetryTransaction(context, storage, command) {
   const session = await beginTelemetryMaterialization(context, storage, command, origin);
   const counts = await planTelemetryAppend(context, storage.ontology.materializations, session, command.input, command.identity, origin, {
     correlationId: command.execution.correlationId,
-    ...command.execution.actor === undefined ? {} : { actor: command.execution.actor }
+    attribution: command.execution.attribution
   });
   await drainStagedWork(context, storage, session);
   const eventCount = await drainStagedEvents(context, storage.ontology.materializations, session, command.identity);
@@ -4485,24 +4557,19 @@ function telemetryCommit(projectId, command, origin) {
     requestHash: command.identity.requestHash,
     executionId: command.execution.executionId,
     origin,
+    ...command.execution.attribution,
     ontologyRevision: command.ontologyRevision,
     intent: telemetryCommitIntent(command),
     committedAt: command.identity.committedAt
   };
-  const withActor = telemetryCommitActor(base, command);
   if (command.kind === "runtime")
-    return withActor;
+    return base;
   return {
-    ...withActor,
+    ...base,
     projectionRevision: command.resolvedProjection.projectionRevision,
     ownershipHash: command.resolvedProjection.ownershipHash
   };
 }
-function telemetryCommitActor(commit, command) {
-  if (command.execution.actor === undefined)
-    return commit;
-  return { ...commit, actor: command.execution.actor };
-}
 function telemetryCommitIntent(command) {
   if (command.kind === "runtime") {
     return {
@@ -4597,4 +4664,4 @@ function createOntologyMaterializer2(input) {
 }
 export { computeOntologyRevision2, computeProjectionRevision2, computeProjectionOwnershipHash2, ProjectionRegistry2, createActionIdempotencyKey2, createRuntimeIdempotencyKey2, createProjectionIdempotencyKey2, createRuntimeTelemetryIdempotencyKey2, createProjectionTelemetryIdempotencyKey2, createCommitIdentity2, timestampCommitIdentity2, createTimedCommitIdentity2, createProjectionMaterializationId2, createLinkScopeFingerprint2, normalizeJsonProperties2, normalizeOntologyEditCommit2, normalizeProjectionExecution2, normalizeProjectionSourceEntry2, normalizeTelemetryAppend2, OntologyMaterializer2, createOntologyMaterializer2 };
 
-//# debugId=07774B0E8444369164756E2164756E21
+//# debugId=61B9FC5452B219F064756E2164756E21