@sixb/core 0.1.12 → 0.1.14

package/src/testing/ontology-storage-contract.ts

@@ -16,6 +16,7 @@ import {
   commitExactObject,
   contractEditHeader,
   contractEditResult,
+  contractExecutor,
   ensureContractExecution,
   type OntologyContractStorage,
 } from "./ontology-contract-fixture"
@@ -148,6 +149,51 @@ export function runOntologyStorageContractSuite<TStorage extends OntologyStorage
       })
     })
 
+    test("round-trips commit and event attribution exactly", async () => {
+      await withStorage(async (storage) => {
+        // The requester is a real principal: SQL executions reference it by foreign key.
+        if (!storage.auth) throw new Error("The attribution contract requires auth storage.")
+        await storage.auth.users.create({
+          projectId: "contract-project",
+          id: "contract-requester",
+          email: "requester@example.com",
+        })
+        const requestedBy = { type: "user", id: "contract-requester" } as const
+        await commitExactObject(storage, "attributed", { requestedBy })
+        await commitExactObject(storage, "unattributed", { primaryId: "unattributed-device" })
+
+        const attributed = await storage.ontology.commits.getById({
+          projectId: "contract-project",
+          id: "attributed",
+        })
+        expect(attributed?.requestedBy).toEqual(requestedBy)
+        expect(attributed?.executor).toEqual(contractExecutor("attributed"))
+        expect(attributed).not.toHaveProperty("actor")
+        const unattributed = await storage.ontology.commits.getById({
+          projectId: "contract-project",
+          id: "unattributed",
+        })
+        expect(unattributed).not.toHaveProperty("requestedBy")
+        expect(unattributed?.executor).toEqual(contractExecutor("unattributed"))
+
+        const claimed = await storage.ontology.outbox.claim({
+          projectId: "contract-project",
+          now: "2027-01-01T00:00:00.000Z",
+          limit: 10,
+          leaseId: "attribution-check",
+          leaseExpiresAt: "2027-01-01T01:00:00.000Z",
+        })
+        const envelopes = new Map(claimed.map((record) => [record.envelope.commitId, record]))
+        expect(envelopes.get("attributed")?.envelope).toMatchObject({
+          requestedBy,
+          executor: contractExecutor("attributed"),
+        })
+        const unattributedEnvelope = envelopes.get("unattributed")?.envelope
+        expect(unattributedEnvelope?.executor).toEqual(contractExecutor("unattributed"))
+        expect(unattributedEnvelope).not.toHaveProperty("requestedBy")
+      })
+    })
+
     test("rejects an ontology commit whose execution does not exist", async () => {
       await withStorage(async (storage) => {
         const header = contractEditHeader("missing-execution")
@@ -883,6 +929,12 @@ async function activateEmptyCandidate(
         datasetId: candidate.identity.datasetVersion.datasetId,
         datasetVersionId: candidate.identity.datasetVersion.versionId,
       },
+      executor: {
+        type: "primitive",
+        kind: "projection",
+        id: candidate.source.projectionId,
+        runId: candidate.execution.projectionRunId,
+      },
       ontologyRevision: candidate.identity.ontologyRevision,
       projectionRevision: candidate.identity.projectionRevision,
       ownershipHash: candidate.identity.ownershipHash,
@@ -971,6 +1023,12 @@ function telemetryHeader(
           batchOrdinal: 0,
         },
       },
+      executor: {
+        type: "primitive",
+        kind: "projection",
+        id: identity.projectionId,
+        runId: projectionRunId,
+      },
       ontologyRevision: identity.ontologyRevision,
       projectionRevision: identity.projectionRevision,
       ownershipHash: identity.ownershipHash,

package/src/testing/sandboxes-contract.ts

@@ -129,6 +129,33 @@ export function runSandboxesContractSuite(
     })
 
     describe("working directory", () => {
+      // Regression check: remove the provider's cwd resolution, leaving only
+      // `options.cwd ?? this.workingDirectory`; these relative file reads must fail.
+      test.each([
+        [".", "root"],
+        ["nested", "child"],
+        ["./nested/..", "root"],
+      ])("resolves relative cwd %s against the workspace", async (cwd, expected) => {
+        const sandbox = await factory.create()
+        try {
+          await sandbox.writeFiles([
+            { path: "cwd-probe.txt", contents: "root" },
+            { path: "nested/cwd-probe.txt", contents: "child" },
+          ])
+
+          const result = await sandbox.runCommand("cat", ["cwd-probe.txt"], { cwd })
+          expect(result.exitCode).toBe(0)
+          expect(result.stdout).toBe(expected)
+
+          // A per-call override must not change the next command's default directory.
+          const next = await sandbox.runCommand("cat", ["cwd-probe.txt"])
+          expect(next.exitCode).toBe(0)
+          expect(next.stdout).toBe("root")
+        } finally {
+          await sandbox.destroy()
+        }
+      })
+
       test("pwd reflects the configured workingDirectory", async () => {
         const sandbox = await factory.create()
         try {

package/src/testing/workflow-intervention-storage-contract.ts

@@ -0,0 +1,203 @@
+import { describe, expect, test } from "bun:test"
+import type { Principal } from "../auth"
+import {
+  type CreateWorkflowInterventionInput,
+  WorkflowInterventionError,
+  type WorkflowInterventionStorage,
+} from "../storage/workflow-interventions"
+
+export interface WorkflowInterventionStorageContractSuiteOptions<
+  TStorage extends WorkflowInterventionStorage = WorkflowInterventionStorage,
+> {
+  readonly createStorage: () => TStorage | Promise<TStorage>
+  readonly cleanup?: (storage: TStorage) => void | Promise<void>
+}
+
+const projectId = "workflow-intervention-contract"
+
+/** Provider-neutral lifecycle, paging, and principal-attribution contract for interventions. */
+export function runWorkflowInterventionStorageContractSuite<
+  TStorage extends WorkflowInterventionStorage,
+>(label: string, options: WorkflowInterventionStorageContractSuiteOptions<TStorage>): void {
+  const withStorage = async (run: (storage: TStorage) => Promise<void>): Promise<void> => {
+    const storage = await options.createStorage()
+    try {
+      await run(storage)
+    } finally {
+      await options.cleanup?.(storage)
+    }
+  }
+
+  describe(label, () => {
+    test("creates pending interventions and supports filtered paging", async () => {
+      await withStorage(async (storage) => {
+        await storage.create(interventionInput({ id: "intervention-1", requestedAt: at("10:00") }))
+        await storage.create(
+          interventionInput({
+            id: "intervention-2",
+            workflowRunId: "run-2",
+            requestedAt: at("11:00"),
+          })
+        )
+        await storage.submit({ projectId, id: "intervention-2", response: { decision: "approve" } })
+        await storage.create(
+          interventionInput({
+            projectId: "other-project",
+            id: "other-project",
+            requestedAt: at("12:00"),
+          })
+        )
+
+        const stored = await storage.getById({ projectId, id: "intervention-1" })
+        const page = await storage.list({
+          projectId,
+          statuses: ["pending"],
+          workflowId: "review-workflow",
+          interventionId: "review-draft-document",
+          requestedAfter: at("09:00"),
+          order: "asc",
+          limit: 1,
+        })
+
+        expect(stored).toMatchObject({
+          id: "intervention-1",
+          status: "pending",
+          input: { draftId: "draft-1" },
+          defaultResponse: { decision: "approve" },
+        })
+        expect(stored?.requestedAt.toISOString()).toBe(at("10:00").toISOString())
+        expect(page.total).toBe(1)
+        expect(page.hasMore).toBe(false)
+        expect(page.interventions.map((intervention) => intervention.id)).toEqual([
+          "intervention-1",
+        ])
+        await expect(storage.list({ projectId, statuses: [] })).resolves.toEqual({
+          interventions: [],
+          hasMore: false,
+          total: 0,
+        })
+      })
+    })
+
+    test("submits, cancels, expires, and rejects invalid transitions", async () => {
+      await withStorage(async (storage) => {
+        await storage.create(interventionInput({ id: "submit-me" }))
+        const submitted = await storage.submit({
+          projectId,
+          id: "submit-me",
+          submittedAt: at("12:00"),
+          submittedBy: { type: "user", id: "usr_1" },
+          response: { decision: "approve", reviewerNote: "Looks good." },
+        })
+
+        await storage.create(interventionInput({ id: "cancel-me" }))
+        const cancelled = await storage.cancel({
+          projectId,
+          id: "cancel-me",
+          cancelledAt: at("12:30"),
+          cancelledBy: { type: "system", id: "workflow-timeout" },
+        })
+
+        await storage.create(interventionInput({ id: "expire-me" }))
+        const expired = await storage.expire({ projectId, id: "expire-me", expiredAt: at("13:00") })
+
+        expect(submitted).toMatchObject({
+          status: "submitted",
+          response: { decision: "approve", reviewerNote: "Looks good." },
+          submittedBy: { type: "user", id: "usr_1" },
+        })
+        expect(submitted.submittedAt?.toISOString()).toBe(at("12:00").toISOString())
+        expect(cancelled).toMatchObject({
+          status: "cancelled",
+          cancelledBy: { type: "system", id: "workflow-timeout" },
+        })
+        expect(cancelled.cancelledAt?.toISOString()).toBe(at("12:30").toISOString())
+        expect(expired.status).toBe("expired")
+        expect(expired.expiredAt?.toISOString()).toBe(at("13:00").toISOString())
+
+        await expect(storage.cancel({ projectId, id: "submit-me" })).rejects.toBeInstanceOf(
+          WorkflowInterventionError
+        )
+        await expect(
+          storage.submit({ projectId, id: "missing", response: {} })
+        ).rejects.toBeInstanceOf(WorkflowInterventionError)
+        await expect(storage.create(interventionInput({ id: "submit-me" }))).rejects.toBeInstanceOf(
+          WorkflowInterventionError
+        )
+        await expect(
+          storage.create(interventionInput({ id: "bad-index", nodeIndex: -1 }))
+        ).rejects.toBeInstanceOf(WorkflowInterventionError)
+      })
+    })
+
+    test("persists submitting and cancelling principals as { type, id }", async () => {
+      await withStorage(async (storage) => {
+        const principals: readonly Principal[] = [
+          { type: "user", id: "usr_1" },
+          { type: "serviceAccount", id: "sa_1" },
+          { type: "system", id: "system" },
+        ]
+        for (const [index, principal] of principals.entries()) {
+          await storage.create(
+            interventionInput({ id: `submit-${principal.type}`, requestedAt: at(`10:0${index}`) })
+          )
+          await storage.submit({
+            projectId,
+            id: `submit-${principal.type}`,
+            response: {},
+            submittedBy: principal,
+          })
+          await storage.create(interventionInput({ id: `cancel-${principal.type}` }))
+          await storage.cancel({
+            projectId,
+            id: `cancel-${principal.type}`,
+            cancelledBy: principal,
+          })
+        }
+        await storage.create(interventionInput({ id: "anonymous" }))
+        await storage.submit({ projectId, id: "anonymous", response: {} })
+
+        for (const principal of principals) {
+          const submitted = await storage.getById({ projectId, id: `submit-${principal.type}` })
+          const cancelled = await storage.getById({ projectId, id: `cancel-${principal.type}` })
+          expect(submitted?.submittedBy).toStrictEqual(principal)
+          expect(cancelled?.cancelledBy).toStrictEqual(principal)
+        }
+        const anonymous = await storage.getById({ projectId, id: "anonymous" })
+        expect(anonymous?.submittedBy).toBeUndefined()
+        expect(anonymous?.cancelledBy).toBeUndefined()
+
+        const listed = await storage.list({ projectId, statuses: ["submitted"], order: "asc" })
+        expect(
+          listed.interventions.flatMap((intervention) =>
+            intervention.submittedBy ? [intervention.submittedBy] : []
+          )
+        ).toStrictEqual([...principals])
+      })
+    })
+  })
+}
+
+function interventionInput(
+  overrides: Partial<CreateWorkflowInterventionInput> = {}
+): CreateWorkflowInterventionInput {
+  return {
+    id: "intervention-1",
+    projectId,
+    workflowId: "review-workflow",
+    workflowRunId: "run-1",
+    nodeRunId: "node-1",
+    nodeIndex: 0,
+    nodeId: "review-draft-document",
+    nodeKey: "reviewDraftDocument",
+    interventionId: "review-draft-document",
+    input: { draftId: "draft-1" },
+    defaultResponse: { decision: "approve" },
+    requestedAt: at("10:00"),
+    ...overrides,
+  }
+}
+
+function at(time: string): Date {
+  return new Date(`2026-05-08T${time}:00.000Z`)
+}

package/src/webhooks/types.ts

@@ -1,6 +1,6 @@
 import type { ConnectorConnectionMetadata, ConnectorDefinition } from "../connectors/types"
 import type { Logger } from "../logging"
-import type { OntologySource, Sixb } from "../runtime"
+import type { Sixb } from "../runtime"
 
 export type WebhookBodyFormat = "json" | "text" | "raw"
 
@@ -57,7 +57,7 @@ export interface WebhookVerifyContext {
 
 /** Handler input bound to the durable Webhook run admitted for this delivery. */
 export interface WebhookHandlerContext<TBody, TClient> extends WebhookVerifyContext {
-  readonly sixb: Sixb<readonly OntologySource[]>
+  readonly sixb: Sixb
   readonly logger: Logger
   readonly body: TBody
   /** Resolve selected managed connections for an external account in this connector. */

package/src/workflows/run-dispatch.ts

@@ -6,9 +6,10 @@ import { captureSixbFailure } from "../errors/internal"
 import type { DomainEventLog } from "../events"
 import type { RunDispatcher } from "../execution/dispatch"
 import { createPrimitiveExecutionRecord } from "../execution/durable"
-import type { ValueType } from "../ontology"
+import type { SchemaOrRef, ValueType } from "../ontology"
 import type { Queues } from "../queues"
 import type { SixbDefinitions } from "../runtime/definitions"
+import { assertParamUsersActive } from "../shared/params/user-refs"
 import type { CreateExecutionInput, Storage, WorkflowRunRecord } from "../storage"
 import { WORKFLOW_RUN_FAILURE_CODES, WorkflowRunError } from "../storage"
 import { WorkflowValidationError } from "./errors"
@@ -172,6 +173,16 @@ async function persistWorkflowRun(
     return { run: existing, created: false }
   }
 
+  // A replayed run keeps the input it was accepted with; only a new run checks its users.
+  await assertParamUsersActive({
+    auth: input.storage.auth,
+    projectId: input.projectId,
+    schemas: input.workflow.input as Readonly<Record<string, SchemaOrRef>>,
+    values: request.snapshot,
+    valueTypesById: input.valueTypesById,
+    describe: (fieldId) => `Workflow "${input.workflow.id}" input '${fieldId}'`,
+    invalid: (message) => new WorkflowValidationError(message),
+  })
   const execution = await input.createExecution(`exec_${randomUUID()}`, request.runId)
   const queuedAt = new Date()
   try {

package/src/workflows/snapshot.ts

@@ -234,14 +234,23 @@ function snapshotSchemaValue(params: {
   const { schema, value, path, valueTypesById } = params
 
   if (typeof schema === "string") {
-    if (schema === "date" || schema === "timestamp") {
-      if (value instanceof Date) {
-        return snapshotDate(value, path)
-      }
-      return snapshotJsonValue(value, path)
+    switch (schema) {
+      case "date":
+      case "timestamp":
+        return value instanceof Date ? snapshotDate(value, path) : snapshotJsonValue(value, path)
+      case "string":
+      case "uuid":
+      case "integer":
+      case "double":
+      case "decimal":
+      case "boolean":
+      case "fileRef":
+      case "userRef":
+        return snapshotJsonValue(value, path)
+      default:
+        schema satisfies never
+        return snapshotJsonValue(value, path)
     }
-
-    return snapshotJsonValue(value, path)
   }
 
   if (schema.type === "enum") {

package/src/workflows/types.ts

@@ -18,7 +18,7 @@ import type { LogsRuntime } from "../logging/execution"
 import type { ModelsRuntime } from "../models/generation-types"
 import type { LanguageModel } from "../models/language-model"
 import type { ObjectsRuntime } from "../objects/execution"
-import type { InferSchemaOrRef, ObjectRef, OntologySource, SchemaOrRef } from "../ontology"
+import type { InferSchemaOrRef, ObjectRef, SchemaOrRef } from "../ontology"
 import type { PipelinesRuntime } from "../pipelines/execution"
 import type { ProjectionsRuntime } from "../projections/execution"
 import type { RulesRuntime } from "../rules/execution"
@@ -62,7 +62,7 @@ export interface StepRunContext<TInput extends Record<string, unknown>> {
  */
 export interface WorkflowRuntimeFacade {
   readonly models: ModelsRuntime
-  readonly objects: ObjectsRuntime<readonly OntologySource[]>
+  readonly objects: ObjectsRuntime
   readonly actions: ActionsRuntime
   readonly agent: AgentRuntime
   readonly datasets: DatasetsRuntime