@sixb/core 0.1.12 → 0.1.13

package/src/actions/read-facade.ts

@@ -8,16 +8,19 @@ import type {
   OntologyObjectRef,
 } from "../materializer"
 import { createLinkScopeFingerprint } from "../materializer"
+import { decorateObjectQueryExecutor } from "../objects/sdk/query-builder"
+import type { ObjectQueryExecutor } from "../objects/sdk/query-executor"
 import { OntologyValidationError } from "../ontology/errors"
 import type { ObjectTypeWithPropertyTokens } from "../ontology/tokens"
-import type { ValueType } from "../ontology/types"
 import {
   assertPropertyTokenBelongsToObjectType,
   assertTelemetryProperty,
 } from "../ontology/validation"
 import { RuntimeError } from "../runtime/errors"
-import type { ObjectSetListInput } from "../runtime/types"
+import type { ObjectReader, ObjectReadSet } from "../runtime/types"
 import type {
+  ExpandedLinkValue,
+  ExpandedObjectRow,
   ObjectLinkRow,
   ObjectRow,
   TimeseriesHistoryBatchInput,
@@ -26,21 +29,10 @@ import type {
 import type { ActionReadDependencies } from "./commit-edits"
 import type {
   ActionReadFacade,
-  ActionReadObjectSet,
   ActionTelemetryHistorySeriesInput,
   ActionTelemetryReadFacade,
 } from "./types"
 
-export type ActionReadObjectSetSource = {
-  get(id: string): Promise<unknown>
-  query(): unknown
-  list(input?: ObjectSetListInput): Promise<unknown>
-  byId(id: string): {
-    get(): Promise<unknown>
-    listLinks(link?: { readonly id: string }): Promise<unknown>
-  }
-}
-
 /** Runtime leaves used by the Action telemetry read adapter. */
 export interface ActionTelemetryReadSource {
   readonly resolveObjectType: (objectTypeId: string) => ObjectTypeWithPropertyTokens
@@ -54,9 +46,10 @@ export interface ActionTelemetryReadSource {
  *
  * A handler that reads one dependency twice keeps the first observation: the commit must fail when
  * current state no longer matches what the decision was made against, and the later read may already
- * reflect the handler's own intent. Arbitrary query phantoms stay out of this release — `query()` and
- * `list()` results are not turned into dependencies. Telemetry history is also a call-level snapshot,
- * not an edit dependency.
+ * reflect the handler's own intent. Objects returned by `list()` and `query()` are fenced like
+ * concrete reads, but query membership is not yet: an object that starts matching a query after the
+ * read, and aggregate results (`count()`, `exists()`, `facets()`), stay unfenced. Telemetry history
+ * is also a call-level snapshot, not an edit dependency.
  */
 export class ActionReadRecorder {
   private readonly objects = new Map<string, ExpectedObjectRevision>()
@@ -81,6 +74,21 @@ export class ActionReadRecorder {
     })
   }
 
+  /**
+   * Records every object a listing or query returned, including the objects its expansions attached.
+   *
+   * Rows are keyed by their own type: a traversal or subtype query returns objects of a type other
+   * than the one the query started from, and the commit checks each row under its exact identity.
+   */
+  observeObjectRows(rows: readonly ObjectRow[]): void {
+    for (const row of rows) {
+      this.observeObject({ objectTypeId: row.objectTypeId, primaryId: row.primaryId }, row)
+      for (const value of Object.values(row.links ?? {})) {
+        this.observeObjectRows(expandedRows(value))
+      }
+    }
+  }
+
   /**
    * Records the complete `(source, linkId)` scopes a link listing observed.
    *
@@ -159,29 +167,23 @@ export interface ActionReadFacadeOptions {
   readonly telemetry?: ActionTelemetryReadSource
 }
 
+/** Exposes `reader`'s object reads to an Action handler; with `options`, each read is recorded. */
 export function createActionReadFacade(
-  createObjectSet: <const TObjectType extends ObjectTypeWithPropertyTokens>(
-    objectType: TObjectType
-  ) => ActionReadObjectSetSource,
+  reader: ObjectReader,
   options?: ActionReadFacadeOptions
 ): ActionReadFacade {
-  const facade = {
+  return {
     telemetry: createActionTelemetryReadFacade(options?.telemetry),
     objects<const TObjectType extends ObjectTypeWithPropertyTokens>(objectType: TObjectType) {
-      return createActionReadObjectSetAdapter<TObjectType>(
-        objectType,
-        createObjectSet(objectType),
-        options
-      )
+      const objectSet = reader.objects(objectType)
+      return options ? recordObjectReads(objectType, objectSet, options) : objectSet
     },
   }
-
-  return facade as ActionReadFacade
 }
 
 function createActionTelemetryReadFacade(
   source: ActionTelemetryReadSource | undefined
-): ActionTelemetryReadFacade<readonly ValueType[]> {
+): ActionTelemetryReadFacade {
   const facade = {
     async historyBatch(input: {
       readonly series: readonly ActionTelemetryHistorySeriesInput[]
@@ -241,7 +243,7 @@ function createActionTelemetryReadFacade(
 
   // Cast needed at the generic token boundary: the implementation deliberately manipulates raw
   // provider values while the public facade maps every tuple position back to its property token.
-  return facade as unknown as ActionTelemetryReadFacade<readonly ValueType[]>
+  return facade as unknown as ActionTelemetryReadFacade
 }
 
 function assertTelemetryBatchResultMatchesRequest(
@@ -273,60 +275,98 @@ function assertTelemetryBatchResultMatchesRequest(
   }
 }
 
-function createActionReadObjectSetAdapter<TObjectType extends ObjectTypeWithPropertyTokens>(
+function recordObjectReads<TObjectType extends ObjectTypeWithPropertyTokens>(
   objectType: TObjectType,
-  objectSet: ActionReadObjectSetSource,
-  options: ActionReadFacadeOptions | undefined
-): ActionReadObjectSet<TObjectType, readonly ValueType[], ObjectTypeWithPropertyTokens> {
-  type TypedReadObjectSet = ActionReadObjectSet<
-    TObjectType,
-    readonly ValueType[],
-    ObjectTypeWithPropertyTokens
-  >
-
-  async function readObject(id: string, read: () => Promise<unknown>): Promise<unknown> {
-    const row = await read()
-    options?.recorder.observeObject(
-      { objectTypeId: objectType.id, primaryId: id },
-      (row ?? null) as ObjectRow | null
-    )
-    return row
-  }
+  objectSet: ObjectReadSet<TObjectType>,
+  options: ActionReadFacadeOptions
+): ObjectReadSet<TObjectType> {
+  const { recorder } = options
+  const ref = (primaryId: string): OntologyObjectRef => ({
+    objectTypeId: objectType.id,
+    primaryId,
+  })
 
   return {
-    get(id) {
-      return readObject(id, () => objectSet.get(id)) as ReturnType<TypedReadObjectSet["get"]>
+    async get(id) {
+      const row = await objectSet.get(id)
+      recorder.observeObject(ref(id), row && storageRow(row))
+      return row
     },
     query() {
-      return objectSet.query() as ReturnType<TypedReadObjectSet["query"]>
+      // Recording at the executor covers every terminal of every refinement, present and future.
+      return decorateObjectQueryExecutor(objectSet.query(), (executor) =>
+        recordingExecutor(executor, recorder)
+      )
     },
-    list(input) {
-      return objectSet.list(input) as ReturnType<TypedReadObjectSet["list"]>
+    async list(input) {
+      const result = await objectSet.list(input)
+      recorder.observeObjectRows(result.objects.map(storageRow))
+      return result
     },
     byId(id) {
       const handle = objectSet.byId(id)
       return {
-        get() {
-          return readObject(id, () => handle.get()) as ReturnType<
-            ReturnType<TypedReadObjectSet["byId"]>["get"]
-          >
+        async get() {
+          const row = await handle.get()
+          recorder.observeObject(ref(id), row && storageRow(row))
+          return row
         },
         async listLinks(link) {
-          const rows = (await handle.listLinks(link)) as readonly ObjectLinkRow[]
-          options?.recorder.observeLinkScopes(
-            { objectTypeId: objectType.id, primaryId: id },
+          const rows = await handle.listLinks(link)
+          recorder.observeLinkScopes(
+            ref(id),
             link ? [link.id] : options.resolveLinkIds(objectType.id),
             rows
           )
-          return rows as unknown as Awaited<
-            ReturnType<ReturnType<TypedReadObjectSet["byId"]>["listLinks"]>
-          >
+          return rows
         },
       }
     },
   }
 }
 
+/**
+ * Delegates to `executor` and records the objects its row queries return.
+ *
+ * Aggregates (`count()`, `exists()`, `facets()`) return no rows to fence; protecting their result
+ * needs query-level dependencies.
+ */
+function recordingExecutor(
+  executor: ObjectQueryExecutor,
+  recorder: ActionReadRecorder
+): ObjectQueryExecutor {
+  return {
+    async list(query, listOptions) {
+      const result = await executor.list(query, listOptions)
+      recorder.observeObjectRows(result.objects.map(storageRow))
+      return result
+    },
+    count: (query) => executor.count(query),
+    exists: (query) => executor.exists(query),
+    facets: (query, facets) => executor.facets(query, facets),
+    validate: executor.validate?.bind(executor),
+    explain: executor.explain?.bind(executor),
+  }
+}
+
+/**
+ * Runtime reads return storage rows; the SDK row types only leave out the commit fields a fence
+ * needs.
+ */
+function storageRow(row: object): ObjectRow {
+  return row as ObjectRow
+}
+
+function expandedRows(value: ExpandedLinkValue): readonly ObjectRow[] {
+  if (value === null) return []
+  return isExpandedRowList(value) ? value : [value]
+}
+
+// `Array.isArray` does not narrow a readonly array out of a union.
+function isExpandedRowList(value: ExpandedLinkValue): value is readonly ExpandedObjectRow[] {
+  return Array.isArray(value)
+}
+
 function toLinkSnapshot(row: ObjectLinkRow): EffectiveLinkSnapshot | null {
   // Rows without materializer provenance predate the commit ledger and cannot be fenced.
   if (row.lastCommitId === undefined) return null

package/src/actions/request.ts

@@ -14,6 +14,7 @@ import { ActionRunTimeoutError } from "../objects/action/errors"
 import { OntologyValidationError } from "../ontology/errors"
 import type { ObjectTypeWithPropertyTokens } from "../ontology/tokens"
 import type { SixbRuntimeContext } from "../runtime/types"
+import { assertParamUsersActive } from "../shared/params/user-refs"
 import {
   ActionRunError,
   type ActionRunRecord,
@@ -159,6 +160,18 @@ export async function requestAction(
     subject,
     params: actionParams,
     runId: request.runId,
+    assertNewRun: () =>
+      assertParamUsersActive({
+        auth: runtime.storage.auth,
+        projectId,
+        schemas: Object.fromEntries(
+          Object.entries(action.params).map(([paramId, param]) => [paramId, param.schema])
+        ),
+        values: actionParams,
+        valueTypesById: runtime.ontology.getValueTypesById(),
+        describe: (paramId) => `Action param '${pathPrefix}.${paramId}'`,
+        invalid: (message) => new OntologyValidationError(message),
+      }),
     ...(authorization.type === "delegated"
       ? {
           assertCanReuseExisting: async (

package/src/actions/run-dispatch.ts

@@ -30,6 +30,8 @@ interface DispatchActionRunInput {
   readonly createExecution: (executionId: string, runId: string) => Promise<CreateExecutionInput>
   /** Runs before payload comparison or retry so an existing run cannot cross authority owners. */
   readonly assertCanReuseExisting?: (storage: Storage, run: ActionRunRecord) => void | Promise<void>
+  /** Checks that hold only for a run this call creates; a replayed run keeps its accepted params. */
+  readonly assertNewRun?: () => Promise<void>
 }
 
 interface PreparedActionRun {
@@ -76,6 +78,7 @@ async function persistActionRun(
     return reuseActionRun(input, existing)
   }
 
+  await input.assertNewRun?.()
   const execution = await input.createExecution(`exec_${randomUUID()}`, request.runId)
   const queuedAt = new Date()
   try {

package/src/actions/types/context.ts

@@ -8,21 +8,13 @@ import type {
   OntologyOperationOutcome,
 } from "../../materializer"
 import type { ModelsRuntime } from "../../models/generation-types"
-import type { ObjectType, Property, ValueType } from "../../ontology"
+import type { ObjectType, Property } from "../../ontology"
 import type { InferPropertyUnit, InferPropertyValue } from "../../ontology/inference"
-import type { LinkToken, ObjectTypeWithPropertyTokens, PropertyToken } from "../../ontology/tokens"
-import type {
-  ListResult,
-  ObjectQueryBuilder,
-  ObjectSetListInput,
-  TwinObject,
-} from "../../runtime/types"
+import type { ObjectTypeWithPropertyTokens, PropertyToken } from "../../ontology/tokens"
+import type { ObjectReader } from "../../runtime/types"
 import type { ActionPrimitiveSchemaValues } from "./params"
 
-export type ActionTargetObject<
-  TObjectType extends ObjectType = ObjectType,
-  _TValueTypes extends readonly ValueType[] = readonly ValueType[],
-> = {
+export type ActionTargetObject<TObjectType extends ObjectType = ObjectType> = {
   readonly primaryId: string
   readonly objectTypeId: TObjectType["id"]
   readonly properties: ActionTargetPropertyBag<TObjectType>
@@ -66,45 +58,12 @@ export type ActionBinding<TObjectType extends ObjectType = ObjectType> =
   | { readonly kind: "global" }
   | { readonly kind: "object"; readonly objectType: TObjectType }
 
-type ActionLinkTokenForObjectType<TObjectType extends ObjectTypeWithPropertyTokens> = LinkToken<
-  TObjectType["id"],
-  TObjectType["links"][number]["id"],
-  TObjectType["links"][number]["targetObjectTypeId"],
-  TObjectType["links"][number]
->
-
 export interface ActionRunPhaseInfo {
   readonly id: string
   readonly startedAt: Date
   readonly idempotencyKey: string
 }
 
-export interface ActionReadObjectByIdHandle<
-  TObjectType extends ObjectTypeWithPropertyTokens,
-  TValueTypes extends readonly ValueType[],
-> {
-  get(): Promise<TwinObject<TObjectType, TValueTypes> | null>
-  listLinks(link?: ActionLinkTokenForObjectType<TObjectType>): Promise<
-    readonly {
-      readonly linkId: string
-      readonly targetTypeId: string
-      readonly targetId: string
-      readonly properties?: Readonly<Record<string, unknown>>
-    }[]
-  >
-}
-
-export interface ActionReadObjectSet<
-  TObjectType extends ObjectTypeWithPropertyTokens,
-  TValueTypes extends readonly ValueType[],
-  TRegisteredObjectTypes extends ObjectTypeWithPropertyTokens = TObjectType,
-> {
-  get(id: string): Promise<TwinObject<TObjectType, TValueTypes> | null>
-  query(): ObjectQueryBuilder<TObjectType, TRegisteredObjectTypes, TValueTypes>
-  list(input?: ObjectSetListInput): Promise<ListResult<TwinObject<TObjectType, TValueTypes>>>
-  byId(id: string): ActionReadObjectByIdHandle<TObjectType, TValueTypes>
-}
-
 /** A telemetry-mode ontology property accepted by Action history reads. */
 export type ActionTelemetryPropertyToken = PropertyToken<
   string,
@@ -139,7 +98,6 @@ export interface ActionTelemetryHistoryBatchInput<
 export type ActionTelemetryHistoryBatchResult<
   TSeries extends
     readonly ActionTelemetryHistorySeriesInput[] = readonly ActionTelemetryHistorySeriesInput[],
-  TValueTypes extends readonly ValueType[] = readonly ValueType[],
 > = {
   readonly [TIndex in keyof TSeries]: TSeries[TIndex] extends ActionTelemetryHistorySeriesInput<
     infer TProperty
@@ -148,17 +106,15 @@ export type ActionTelemetryHistoryBatchResult<
         readonly objectId: TSeries[TIndex]["objectId"]
         readonly property: TProperty
         readonly points: readonly {
-          readonly value: InferPropertyValue<TProperty["property"], TValueTypes>
+          readonly value: InferPropertyValue<TProperty["property"]>
           readonly at: Date
-          readonly unit?: InferPropertyUnit<TProperty["property"], TValueTypes>
+          readonly unit?: InferPropertyUnit<TProperty["property"]>
         }[]
       }
     : never
 }
 
-export type ActionTelemetryReadFacade<
-  TValueTypes extends readonly ValueType[] = readonly ValueType[],
-> = {
+export type ActionTelemetryReadFacade = {
   /**
    * Read several telemetry series in one provider call.
    *
@@ -167,20 +123,18 @@ export type ActionTelemetryReadFacade<
    */
   historyBatch<const TSeries extends readonly ActionTelemetryHistorySeriesInput[]>(
     input: ActionTelemetryHistoryBatchInput<TSeries>
-  ): Promise<ActionTelemetryHistoryBatchResult<TSeries, TValueTypes>>
+  ): Promise<ActionTelemetryHistoryBatchResult<TSeries>>
 }
 
-export interface ActionReadFacade<TValueTypes extends readonly ValueType[] = readonly ValueType[]> {
-  readonly telemetry: ActionTelemetryReadFacade<TValueTypes>
-  objects<const TObjectType extends ObjectTypeWithPropertyTokens>(
-    objectType: TObjectType
-  ): ActionReadObjectSet<TObjectType, TValueTypes, ObjectTypeWithPropertyTokens>
+/**
+ * The `read` an Action handler receives. What it reads through `objects(Type)` is recorded, and
+ * the commit fails if any of it changed first.
+ */
+export interface ActionReadFacade extends ObjectReader {
+  readonly telemetry: ActionTelemetryReadFacade
 }
 
-export interface ActionTelemetryObjectSet<
-  _TObjectType extends ObjectTypeWithPropertyTokens,
-  _TValueTypes extends readonly ValueType[],
-> {
+export interface ActionTelemetryObjectSet<_TObjectType extends ObjectTypeWithPropertyTokens> {
   appendTelemetryBatch(
     items: readonly {
       id: string
@@ -193,15 +147,13 @@ export interface ActionTelemetryObjectSet<
 /** Immutable blob operations available to action writeback and effects handlers. */
 export type ActionBlobContext = Pick<BlobStorage, "put" | "open" | "stat">
 
-export interface ActionRuntimeFacade<
-  TValueTypes extends readonly ValueType[] = readonly ValueType[],
-> {
+export interface ActionRuntimeFacade {
   readonly blobs: ActionBlobContext
   readonly models: ModelsRuntime
   readonly connector: ConnectorRuntime
   objects<const TObjectType extends ObjectTypeWithPropertyTokens>(
     objectType: TObjectType
-  ): ActionTelemetryObjectSet<TObjectType, TValueTypes>
+  ): ActionTelemetryObjectSet<TObjectType>
 }
 
 /**

package/src/actions/types/params.ts

@@ -1,4 +1,5 @@
 import type { ValueType } from "../../ontology"
+import type { RegisteredValueTypes } from "../../ontology/registered"
 import type {
   InferParams,
   ParamConfig,
@@ -18,5 +19,5 @@ export type ActionPrimitiveSchemaValues = ParamPrimitiveSchemaValues
 /** Action-facing compatibility name for the shared parameter inference contract. */
 export type InferActionParams<
   TParams extends ActionParamsConfig,
-  TValueTypes extends readonly ValueType[] = [],
+  TValueTypes extends readonly ValueType[] = RegisteredValueTypes,
 > = InferParams<TParams, TValueTypes>

package/src/agents/authority.ts

@@ -330,7 +330,7 @@ function isUsableUserAccessToken(
   userId: string,
   now: Date
 ): token is AccessTokenRecord {
-  if (!token || token.subjectType !== "user" || token.subjectId !== userId) return false
+  if (!token || !principalsEqual(token.subject, { type: "user", id: userId })) return false
   return token.revokedAt === undefined && token.expiresAt.getTime() > now.getTime()
 }
 

package/src/assert-never.ts

@@ -0,0 +1,7 @@
+/**
+ * Closes a switch over a union: the call stops compiling when a new member has no case, and throws
+ * if an untyped value reaches it at runtime.
+ */
+export function assertNever(_value: never, message: string): never {
+  throw new Error(message)
+}

package/src/auth/client-address.ts

@@ -0,0 +1,12 @@
+// The server resolves each request's client address once, at the socket, from the peer address
+// and the forwarding headers its trusted proxies wrote. Everything else reads it from here and
+// never parses forwarding headers itself: a client can write any value into them.
+const clientAddresses = new WeakMap<Request, string>()
+
+export function setRequestClientAddress(request: Request, address: string): void {
+  clientAddresses.set(request, address)
+}
+
+export function getRequestClientAddress(request: Request): string | undefined {
+  return clientAddresses.get(request)
+}

package/src/auth/csrf.ts

@@ -14,20 +14,29 @@ export function isCsrfExemptMethod(method: string): boolean {
 
 export function verifyDoubleSubmitCsrf(
   request: Request,
-  options: { readonly cookieName: string; readonly headerName?: string }
+  options: { readonly cookieName: string }
 ): boolean {
   if (isCsrfExemptMethod(request.method)) {
     return true
   }
 
-  const cookieValue = getCookie(request, options.cookieName)
-  const headerValue = request.headers.get(options.headerName ?? CSRF_HEADER_NAME)
+  return verifyCsrfToken(request, {
+    cookieName: options.cookieName,
+    token: request.headers.get(CSRF_HEADER_NAME),
+  })
+}
 
-  if (!cookieValue || !headerValue) {
+/** Match a submitted CSRF token (header or form field) against the request's CSRF cookie. */
+export function verifyCsrfToken(
+  request: Request,
+  options: { readonly cookieName: string; readonly token: string | null }
+): boolean {
+  const cookieValue = getCookie(request, options.cookieName)
+  if (!cookieValue || !options.token) {
     return false
   }
 
-  return safeEqual(cookieValue, headerValue)
+  return safeEqual(cookieValue, options.token)
 }
 
 function safeEqual(left: string, right: string): boolean {

package/src/auth/index.ts

@@ -15,6 +15,7 @@ export {
   isValidAuthSessionAudience,
   resolveAuthSessionAudience,
 } from "./audience"
+export { getRequestClientAddress, setRequestClientAddress } from "./client-address"
 export {
   clearCsrfCookieHeader,
   clearSessionCookieHeader,
@@ -32,6 +33,7 @@ export {
   CSRF_HEADER_NAME,
   generateCsrfToken,
   isCsrfExemptMethod,
+  verifyCsrfToken,
   verifyDoubleSubmitCsrf,
 } from "./csrf"
 export type { AuthRuntimeErrorCode } from "./errors"
@@ -85,6 +87,7 @@ export type {
   GetMembershipOptionsResult,
   InvitationDeliveryAuthStrategy,
   InvitationDeliveryInput,
+  InvitationDestination,
   InvitationGroupOption,
   InvitationRecipientInput,
   InvitationRecipientResult,
@@ -92,7 +95,6 @@ export type {
   InviteDeliveryResult,
   InviteDeliveryStatus,
   InviteUserInput,
-  InviteUserOptions,
   InviteUserResult,
   ListInvitationsInput,
   ListInvitationsResult,
@@ -133,7 +135,6 @@ export type {
   RevokePersonalAccessTokenInput,
   RevokeServiceAccountAccessTokenInput,
   RevokeServiceAccountAccessTokenResult,
-  SecurityContext,
   ServiceAccountWithGroups,
   SixbAuthConfig,
   SuspendMemberInput,