@sixb/core 0.1.12 → 0.1.13

package/src/storage/ontology/commits.ts

@@ -1,4 +1,5 @@
-import type { EventActor } from "../../events/envelope"
+import type { AuthorizablePrincipal } from "../../execution/types"
+import type { EventExecutor } from "../../materialization/events"
 import type {
   EditCommitResult,
   OntologyMaterializationOrigin,
@@ -57,7 +58,10 @@ interface OntologyCommitFields {
   readonly requestHash: string
   readonly executionId: string
   readonly origin: OntologyMaterializationOrigin
-  readonly actor?: EventActor
+  /** Principal on whose behalf the execution ran, copied from `ExecutionRecord.requestedBy`. */
+  readonly requestedBy?: AuthorizablePrincipal
+  /** Workload that wrote the commit, copied from its execution. */
+  readonly executor: EventExecutor
   readonly ontologyRevision: string
   readonly projectionRevision?: string
   readonly ownershipHash?: string

package/src/storage/ontology/in-memory/materializations.ts

@@ -64,6 +64,9 @@ import type {
 import type { OntologyMaterializationEvent } from "../outbox"
 import {
   appendScopeSnapshot,
+  assertExpectedLinkRevision,
+  assertExpectedLinkScopeRevision,
+  assertExpectedObjectRevision,
   assertMaterializationHeader,
   finishScopeAccumulator,
   type ProviderMaterializationTransactionLifecycle,
@@ -217,12 +220,7 @@ export class InMemoryOntologyMaterializationStorage implements OntologyMateriali
         expectedScopeRevisions.get(key) ??
         this.computeEffectiveLinkScope(input.commit.projectId, expected.source, expected.linkId)
       expectedScopeRevisions.set(key, current)
-      if (current.fingerprint !== expected.fingerprint) {
-        throw new MaterializationConflictError(
-          "effective-state",
-          `Expected link scope changed for ${expected.source.objectTypeId}:${expected.source.primaryId}.${expected.linkId}.`
-        )
-      }
+      assertExpectedLinkScopeRevision(current.fingerprint, expected)
     }
     for (const expected of input.expected.points) this.assertPoint(expected, input.commit.projectId)
 
@@ -1039,20 +1037,7 @@ export class InMemoryOntologyMaterializationStorage implements OntologyMateriali
       expected.ref.objectTypeId,
       expected.ref.primaryId
     )
-    if (!expected.exists) {
-      if (row)
-        throw new MaterializationConflictError(
-          "effective-state",
-          `Expected object ${objectRefKey(expected.ref)} to be absent.`
-        )
-      return
-    }
-    if (!row || row.version !== expected.version || row.lastCommitId !== expected.lastCommitId) {
-      throw new MaterializationConflictError(
-        "effective-state",
-        `Expected object ${objectRefKey(expected.ref)} changed.`
-      )
-    }
+    assertExpectedObjectRevision(row ?? null, expected)
   }
 
   private async assertLink(expected: ExpectedLinkRevision, projectId: string): Promise<void> {
@@ -1067,20 +1052,7 @@ export class InMemoryOntologyMaterializationStorage implements OntologyMateriali
       targetTypeId: expected.ref.target.objectTypeId,
       targetId: expected.ref.target.primaryId,
     })
-    if (!expected.exists) {
-      if (row)
-        throw new MaterializationConflictError(
-          "effective-state",
-          `Expected link ${linkRefKey(expected.ref)} to be absent.`
-        )
-      return
-    }
-    if (!row || row.lastCommitId !== expected.lastCommitId) {
-      throw new MaterializationConflictError(
-        "effective-state",
-        `Expected link ${linkRefKey(expected.ref)} changed.`
-      )
-    }
+    assertExpectedLinkRevision(row?.lastCommitId, expected)
   }
 
   private assertPoint(expected: ExpectedTimeseriesPointRevision, projectId: string): void {

package/src/storage/ontology/provider-header-validation.ts

@@ -38,6 +38,55 @@ function assertCommitEnvelope(commit: OntologyCommitWrite): void {
   assertNonblank(commit.executionId, "Materialization execution id")
   assertNonblank(commit.ontologyRevision, "Materialization ontology revision")
   assertTimestamp(commit.committedAt, "Materialization commit time")
+  assertCommitAttribution(commit)
+}
+
+/** Shape only: the Materializer copies both values from the execution it has already verified. */
+function assertCommitAttribution(commit: OntologyCommitWrite): void {
+  const { requestedBy, executor } = commit
+  if (requestedBy !== undefined) {
+    if (requestedBy.type !== "user" && requestedBy.type !== "serviceAccount") {
+      invalidCorrelation("Materialization requester must be a user or service account.")
+    }
+    assertNonblank(requestedBy.id, "Materialization requester id")
+  }
+
+  switch (executor?.type) {
+    case "request":
+      assertNonblank(executor.requestId, "Materialization executor request id")
+      return
+    case "primitive":
+      assertNonblank(executor.kind, "Materialization executor primitive kind")
+      assertNonblank(executor.id, "Materialization executor primitive id")
+      assertNonblank(executor.runId, "Materialization executor run id")
+      return
+    case "agent":
+      assertNonblank(executor.runId, "Materialization executor Agent run id")
+      return
+    case "kernel":
+      assertNonblank(executor.operation?.type, "Materialization executor kernel operation")
+      return
+    default:
+      invalidCorrelation("Materialization executor is invalid.")
+  }
+}
+
+/** A governed or projected write is attributed to exactly the primitive run that owns it. */
+function assertPrimitiveExecutor(
+  commit: OntologyCommitWrite,
+  kind: "action" | "projection",
+  id: string,
+  runId: string
+): void {
+  const { executor } = commit
+  if (
+    executor.type !== "primitive" ||
+    executor.kind !== kind ||
+    executor.id !== id ||
+    executor.runId !== runId
+  ) {
+    invalidCorrelation(`Commit ${kind} origin does not match its executor.`)
+  }
 }
 
 function assertEditCommit(commit: OntologyCommitWrite, intent: EditOntologyCommitIntent): void {
@@ -47,6 +96,7 @@ function assertEditCommit(commit: OntologyCommitWrite, intent: EditOntologyCommi
     case "action":
       assertNonblank(commit.origin.actionId, "Action origin action id")
       assertNonblank(commit.origin.runId, "Action origin run id")
+      assertPrimitiveExecutor(commit, "action", commit.origin.actionId, commit.origin.runId)
       return
     case "runtime":
       assertNonblank(commit.origin.requestId, "Runtime origin request id")
@@ -77,6 +127,12 @@ function assertProjectionCommit(
   ) {
     invalidCorrelation("Projection commit origin does not match its dataset version.")
   }
+  assertPrimitiveExecutor(
+    commit,
+    "projection",
+    commit.origin.projectionId,
+    commit.origin.projectionRunId
+  )
 }
 
 function assertTelemetryCommit(
@@ -142,6 +198,7 @@ function assertProjectionTelemetryCommit(
   if (origin.batchOrdinal !== source.batchOrdinal) {
     invalidCorrelation("Projection telemetry origin does not match its batch ordinal.")
   }
+  assertPrimitiveExecutor(commit, "projection", origin.projectionId, origin.projectionRunId)
 }
 
 function assertProjectionTelemetryBatch(

package/src/storage/ontology/provider-work.ts

@@ -9,6 +9,7 @@ import {
   objectRefKey,
   telemetryPointKey,
 } from "../../materialization/refs"
+import type { OntologyCommitWrite } from "./commits"
 import {
   type ExactTimeseriesPointWrite,
   type MaterializationCardinalityOccupantWorkRecord,
@@ -107,8 +108,7 @@ export function assertWorkRecord(
       record.draft.commitId !== header.commit.id ||
       record.draft.occurredAt !== header.commit.committedAt ||
       stableJsonStringify(record.draft.origin) !== stableJsonStringify(header.commit.origin) ||
-      stableJsonStringify(record.draft.actor ?? null) !==
-        stableJsonStringify(header.commit.actor ?? null)
+      !sameAttribution(record.draft, header.commit)
     ) {
       throw new MaterializationValidationError("Materialization event work is invalid.")
     }
@@ -312,7 +312,7 @@ function assertOutboxCorrelation(
     value.availableAt !== commit.committedAt ||
     value.createdAt !== commit.committedAt ||
     stableJsonStringify(envelope.origin) !== stableJsonStringify(commit.origin) ||
-    stableJsonStringify(envelope.actor ?? null) !== stableJsonStringify(commit.actor ?? null) ||
+    !sameAttribution(envelope, commit) ||
     !Number.isSafeInteger(envelope.commitOrdinal) ||
     envelope.commitOrdinal < 0 ||
     envelope.id !== createEventId(commit.projectId, commit.id, envelope.commitOrdinal)
@@ -347,3 +347,15 @@ function assertLinkRefEqual(left: OntologyLinkRef, right: OntologyLinkRef, label
     invalidCorrelation(`${label} row and expected references differ.`)
   }
 }
+
+/** Events carry exactly the attribution of the commit that produced them. */
+function sameAttribution(
+  event: Pick<OntologyCommitWrite, "requestedBy" | "executor">,
+  commit: Pick<OntologyCommitWrite, "requestedBy" | "executor">
+): boolean {
+  return (
+    stableJsonStringify(event.requestedBy ?? null) ===
+      stableJsonStringify(commit.requestedBy ?? null) &&
+    stableJsonStringify(event.executor) === stableJsonStringify(commit.executor)
+  )
+}

package/src/storage/ontology/provider.ts

@@ -6,10 +6,13 @@ import {
 } from "../../materialization/errors"
 import type {
   EffectiveLinkSnapshot,
+  ExpectedLinkRevision,
+  ExpectedLinkScopeRevision,
+  ExpectedObjectRevision,
   OntologyLinkRef,
   OntologyObjectRef,
 } from "../../materialization/model"
-import { projectionEntityKey } from "../../materialization/refs"
+import { linkRefKey, objectRefKey, projectionEntityKey } from "../../materialization/refs"
 import type { OntologyCommitOriginSelector, OntologyCommitWrite } from "./commits"
 import type {
   FinalizeMaterializationInput,
@@ -485,6 +488,61 @@ export function effectiveConflict(message: string): MaterializationConflictError
   return new MaterializationConflictError("effective-state", message)
 }
 
+/**
+ * Rejects a commit whose expected object no longer matches its current effective row.
+ *
+ * Every provider checks commit expectations through these helpers, so a failed expectation is always
+ * the `expectation` conflict kind: an Action run reports exactly that kind as a read conflict.
+ */
+export function assertExpectedObjectRevision(
+  current: { readonly version: number; readonly lastCommitId: string | null } | null,
+  expected: ExpectedObjectRevision
+): void {
+  if (!expected.exists) {
+    if (current) {
+      throw expectationConflict(`Expected object ${objectRefKey(expected.ref)} to be absent.`)
+    }
+    return
+  }
+  if (
+    !current ||
+    current.version !== expected.version ||
+    current.lastCommitId !== expected.lastCommitId
+  ) {
+    throw expectationConflict(`Expected object ${objectRefKey(expected.ref)} changed.`)
+  }
+}
+
+/** `currentLastCommitId` is `undefined` when the link has no effective row. */
+export function assertExpectedLinkRevision(
+  currentLastCommitId: string | null | undefined,
+  expected: ExpectedLinkRevision
+): void {
+  if (!expected.exists) {
+    if (currentLastCommitId !== undefined) {
+      throw expectationConflict(`Expected link ${linkRefKey(expected.ref)} to be absent.`)
+    }
+    return
+  }
+  if (currentLastCommitId === undefined || currentLastCommitId !== expected.lastCommitId) {
+    throw expectationConflict(`Expected link ${linkRefKey(expected.ref)} changed.`)
+  }
+}
+
+export function assertExpectedLinkScopeRevision(
+  currentFingerprint: string | undefined,
+  expected: ExpectedLinkScopeRevision
+): void {
+  if (currentFingerprint === expected.fingerprint) return
+  throw expectationConflict(
+    `Expected link scope changed for ${expected.source.objectTypeId}:${expected.source.primaryId}.${expected.linkId}.`
+  )
+}
+
+function expectationConflict(message: string): MaterializationConflictError {
+  return new MaterializationConflictError("expectation", message)
+}
+
 export function materializationWorkColumns(record: MaterializationWorkRecord): {
   readonly lane: "none" | "apply" | "cardinality" | "event"
   readonly majorOrder: number

package/src/storage/operation-scope.ts

@@ -206,6 +206,7 @@ export function createAuthOperationScope<T extends AuthStorage>(
     groupMemberships: createOperationScopedFacade(target.groupMemberships, scope),
     magicLinks: createOperationScopedFacade(target.magicLinks, scope),
     oidcAuthorizationAttempts: createOperationScopedFacade(target.oidcAuthorizationAttempts, scope),
+    deviceAuthorizations: createOperationScopedFacade(target.deviceAuthorizations, scope),
   }) as T
 }
 

package/src/storage/types.ts

@@ -300,7 +300,6 @@ export type {
   ListWorkflowInterventionsInput,
   ListWorkflowInterventionsResult,
   SubmitWorkflowInterventionInput,
-  WorkflowInterventionActor,
   WorkflowInterventionRecord,
   WorkflowInterventionStatus,
   WorkflowInterventionStorage,

package/src/storage/workflow-interventions/index.ts

@@ -7,7 +7,6 @@ export type {
   ListWorkflowInterventionsInput,
   ListWorkflowInterventionsResult,
   SubmitWorkflowInterventionInput,
-  WorkflowInterventionActor,
   WorkflowInterventionRecord,
   WorkflowInterventionStatus,
   WorkflowInterventionStorage,

package/src/storage/workflow-interventions/types.ts

@@ -1,12 +1,8 @@
+import type { Principal } from "../../auth"
 import type { WorkflowIOSnapshot } from "../workflow-runs"
 
 export type WorkflowInterventionStatus = "pending" | "submitted" | "cancelled" | "expired"
 
-export interface WorkflowInterventionActor {
-  readonly principalType: "user" | "serviceAccount" | "system"
-  readonly principalId: string
-}
-
 export interface WorkflowInterventionRecord {
   readonly id: string
   readonly projectId: string
@@ -23,10 +19,10 @@ export interface WorkflowInterventionRecord {
   readonly requestedAt: Date
   readonly expiresAt?: Date
   readonly submittedAt?: Date
-  readonly submittedBy?: WorkflowInterventionActor
+  readonly submittedBy?: Principal
   readonly response?: WorkflowIOSnapshot
   readonly cancelledAt?: Date
-  readonly cancelledBy?: WorkflowInterventionActor
+  readonly cancelledBy?: Principal
   readonly expiredAt?: Date
 }
 
@@ -51,14 +47,14 @@ export interface SubmitWorkflowInterventionInput {
   readonly id: string
   readonly response: WorkflowIOSnapshot
   readonly submittedAt?: Date
-  readonly submittedBy?: WorkflowInterventionActor
+  readonly submittedBy?: Principal
 }
 
 export interface CancelWorkflowInterventionInput {
   readonly projectId: string
   readonly id: string
   readonly cancelledAt?: Date
-  readonly cancelledBy?: WorkflowInterventionActor
+  readonly cancelledBy?: Principal
 }
 
 export interface ExpireWorkflowInterventionInput {

package/src/testing/action-execution.ts

@@ -1,4 +1,4 @@
-import type { TrustedPrimitiveRef } from "../execution"
+import type { AuthorizablePrincipal, TrustedPrimitiveRef } from "../execution"
 import type { ActionRunRecord, QueueActionRunInput, Storage } from "../storage"
 import type { ExecutionStorage } from "../storage/executions"
 
@@ -11,6 +11,8 @@ export async function createTestActionExecution(
     readonly runId: string
     readonly executionId?: string
     readonly requesterGroupIds?: readonly string[]
+    /** Must name an existing auth principal. The parent request then carries its authority. */
+    readonly requestedBy?: AuthorizablePrincipal
   }
 ): Promise<string> {
   const parentExecutionId = `test_request_execution:${input.runId}`
@@ -24,22 +26,28 @@ export async function createTestActionExecution(
   const existing = await executions.getById({ projectId: input.projectId, id: executionId })
   if (existing) return executionId
 
+  const requestedBy = input.requestedBy
   const parent = await executions.getById({ projectId: input.projectId, id: parentExecutionId })
   if (!parent) {
     await executions.create({
       id: parentExecutionId,
       requesterGroupIds: input.requesterGroupIds ?? [],
       projectId: input.projectId,
+      ...(requestedBy === undefined ? {} : { requestedBy }),
       executor: { type: "request", requestId: `test_request:${input.runId}` },
       source: { type: "http", requestId: `test_request:${input.runId}` },
       correlationId: `test_correlation:${input.runId}`,
-      authorizationRef: { type: "disabled" },
+      authorizationRef:
+        requestedBy === undefined
+          ? { type: "disabled" }
+          : { type: "principal", principal: requestedBy },
     })
   }
   await executions.create({
     id: executionId,
     requesterGroupIds: input.requesterGroupIds ?? [],
     projectId: input.projectId,
+    ...(requestedBy === undefined ? {} : { requestedBy }),
     executor: { type: "primitive", kind: primitive.kind, runId: primitive.runId },
     source: { type: "execution", executionId: parentExecutionId },
     correlationId: `test_correlation:${input.runId}`,
@@ -54,6 +62,7 @@ export async function queueTestActionRun(
   storage: Pick<Storage, "actionRuns" | "executions">,
   input: Omit<QueueActionRunInput, "executionId"> & {
     readonly requesterGroupIds?: readonly string[]
+    readonly requestedBy?: AuthorizablePrincipal
   }
 ): Promise<ActionRunRecord> {
   if (!storage.actionRuns) throw new Error("Action run storage is not configured for this test.")
@@ -62,7 +71,8 @@ export async function queueTestActionRun(
     actionId: input.actionId,
     runId: input.id,
     requesterGroupIds: input.requesterGroupIds,
+    ...(input.requestedBy === undefined ? {} : { requestedBy: input.requestedBy }),
   })
-  const { requesterGroupIds: _groups, ...run } = input
+  const { requesterGroupIds: _groups, requestedBy: _requestedBy, ...run } = input
   return storage.actionRuns.queue({ ...run, executionId })
 }