@sixb/core 0.1.18 → 0.1.20

package/src/objects/execution.ts

@@ -1,3 +1,4 @@
+import { shareActionRunExecutor } from "../actions/run/executor"
 import type { BlobStorage } from "../blob-storage"
 import { shareSixbErrorReporter } from "../error-reporting/capability"
 import type { ExecutionContext } from "../execution"
@@ -86,7 +87,6 @@ export interface ExecutionObjectByIdHandle<TObjectType extends ObjectTypeWithPro
   extends ObjectReadByIdHandle<TObjectType> {
   vector: ObjectByIdHandle<TObjectType>["vector"]
   requestAction: ObjectByIdHandle<TObjectType>["requestAction"]
-  requestActionAndWait: ObjectByIdHandle<TObjectType>["requestActionAndWait"]
   link: ObjectByIdHandle<TObjectType>["link"]
   unlink: ObjectByIdHandle<TObjectType>["unlink"]
   delete: ObjectByIdHandle<TObjectType>["delete"]
@@ -97,7 +97,6 @@ export interface ExecutionObjectByIdHandle<TObjectType extends ObjectTypeWithPro
 export interface ExecutionObjectSet<TObjectType extends ObjectTypeWithPropertyTokens>
   extends ObjectReadSet<TObjectType> {
   requestAction: ObjectSet<TObjectType>["requestAction"]
-  requestActionAndWait: ObjectSet<TObjectType>["requestActionAndWait"]
   upsert: ObjectSet<TObjectType>["upsert"]
   upsertLink: ObjectSet<TObjectType>["upsertLink"]
   removeLink: ObjectSet<TObjectType>["removeLink"]
@@ -173,6 +172,7 @@ export function createObjectsRuntime(
   }
   shareOntologyMutationRuntime(runtime, capturedRuntime)
   shareSixbErrorReporter(runtime, capturedRuntime)
+  shareActionRunExecutor(runtime, capturedRuntime)
   Object.freeze(capturedRuntime)
   const ontologyView = () => getAuthorizedOntologyView(objectReader)
   const objects = Object.assign(

package/src/objects/sdk/object-handle.ts

@@ -10,10 +10,7 @@ import { OntologyValidationError } from "../../ontology/errors"
 import type { LinkToken, ObjectTypeWithPropertyTokens, PropertyToken } from "../../ontology/tokens"
 import { assertLinkTokenBelongsToObjectType } from "../../ontology/validation"
 import type { ObjectByIdHandle, TwinObject } from "../../runtime/types"
-import {
-  requestActionAndWait as requestActionAndWaitLeaf,
-  requestAction as requestActionLeaf,
-} from "../action"
+import { requestAction as requestActionLeaf } from "../action"
 import type { ObjectSetContext, ResolvedLinkContext } from "../context"
 import { removeLink as removeLinkLeaf, upsertLink as upsertLinkLeaf } from "../link"
 import { deleteObject, restoreObject } from "../object"
@@ -91,6 +88,7 @@ export function createObjectByIdHandle<TObjectType extends ObjectTypeWithPropert
       actionId?: string
       params?: Record<string, unknown>
       runId?: string
+      signal?: AbortSignal
     }) => {
       const actionId = input.action?.id ?? input.actionId
       if (!actionId) {
@@ -102,31 +100,7 @@ export function createObjectByIdHandle<TObjectType extends ObjectTypeWithPropert
         primaryId,
         actionId,
         params: input.params,
-        options: { runId: input.runId },
-      })
-    },
-
-    requestActionAndWait: async (input: {
-      action?: ActionDefinition
-      actionId?: string
-      params?: Record<string, unknown>
-      timeoutMs?: number
-      signal?: AbortSignal
-    }) => {
-      const actionId = input.action?.id ?? input.actionId
-      if (!actionId) {
-        throw new OntologyValidationError(
-          "[Sixb] requestActionAndWait requires either 'action' or 'actionId'"
-        )
-      }
-      return requestActionAndWaitLeaf(ctx, {
-        primaryId,
-        actionId,
-        params: input.params,
-        options: {
-          timeoutMs: input.timeoutMs,
-          signal: input.signal,
-        },
+        options: { runId: input.runId, signal: input.signal },
       })
     },
 

package/src/objects/sdk/object-set.ts

@@ -5,6 +5,7 @@
  */
 
 import type { ActionDefinition } from "../../actions"
+import { shareActionRunExecutor } from "../../actions/run/executor"
 import type { AuthorizationContext } from "../../authorization"
 import type { BlobStorage } from "../../blob-storage"
 import { shareSixbErrorReporter } from "../../error-reporting/capability"
@@ -19,10 +20,7 @@ import type {
   SixbRuntimeContext,
   TwinObject,
 } from "../../runtime/types"
-import {
-  requestActionAndWait as requestActionAndWaitLeaf,
-  requestAction as requestActionLeaf,
-} from "../action"
+import { requestAction as requestActionLeaf } from "../action"
 import type { ObjectSetContext, ResolvedLinkContext } from "../context"
 import { requireLinkDefinition } from "../context"
 import { removeLink as removeLinkLeaf, upsertLink as upsertLinkLeaf } from "../link"
@@ -88,6 +86,7 @@ export function createObjectSet<TObjectType extends ObjectTypeWithPropertyTokens
   }
   shareOntologyMutationRuntime(params, resolvedCtx)
   shareSixbErrorReporter(params, resolvedCtx)
+  shareActionRunExecutor(params, resolvedCtx)
 
   const objectSet = {
     get: async (id: string) => {
@@ -149,6 +148,7 @@ export function createObjectSet<TObjectType extends ObjectTypeWithPropertyTokens
       actionId?: string
       params?: Record<string, unknown>
       runId?: string
+      signal?: AbortSignal
     }) => {
       const actionId = input.action?.id ?? input.actionId
       if (!actionId) {
@@ -160,32 +160,7 @@ export function createObjectSet<TObjectType extends ObjectTypeWithPropertyTokens
         primaryId: input.id,
         actionId,
         params: input.params,
-        options: { runId: input.runId },
-      })
-    },
-
-    requestActionAndWait: async (input: {
-      id: string
-      action?: ActionDefinition
-      actionId?: string
-      params?: Record<string, unknown>
-      timeoutMs?: number
-      signal?: AbortSignal
-    }) => {
-      const actionId = input.action?.id ?? input.actionId
-      if (!actionId) {
-        throw new OntologyValidationError(
-          "[Sixb] requestActionAndWait requires either 'action' or 'actionId'"
-        )
-      }
-      return requestActionAndWaitLeaf(resolvedCtx, {
-        primaryId: input.id,
-        actionId,
-        params: input.params,
-        options: {
-          timeoutMs: input.timeoutMs,
-          signal: input.signal,
-        },
+        options: { runId: input.runId, signal: input.signal },
       })
     },
 

package/src/objects/service/index.ts

@@ -1,4 +1,3 @@
-export { requestAction, requestActionAndWait } from "./action-service"
 export { removeLink, upsertLink, upsertLinkBatch } from "./link-service"
 export type { ListObjectsParams } from "./list-service"
 export { listObjects } from "./list-service"

package/src/objects/vectors/README.md

@@ -5,6 +5,10 @@ A named profile identifies a derived representation, separate from object proper
 Indexing sends embedding purpose `document`; search sends `query`. The execution wrapper preserves
 that role through model resolution, admission and accounting. Symmetric providers may ignore it.
 
+Each caller sets its own deadline; the execution wrapper adds none. A search has someone waiting
+and gives up after 30 seconds. Indexing, automatic or explicit, waits five minutes: the provider
+bills a call whose response is abandoned, and an abandoned automatic call is a terminal failure.
+
 Vector candidates may come from filters, traversals, explicit refs or set operations. Canonical
 validation requires one concrete result type and admits every intermediate type, edge and source
 property. Model lookup uses that resolved result type, not the query's initial type. SQL ranks the

package/src/objects/vectors/handle.ts

@@ -6,7 +6,12 @@ import type { PreparedObjectVector } from "../../materialization/vectors"
 import { sameEmbeddingModel } from "../../models/embedding-model"
 import { getOntologyMutationRuntime } from "../../runtime/ontology-mutations"
 import type { ExecutionObjectContext } from "../context"
-import { normalizeVector, vectorConfiguration, vectorSources } from "./profile"
+import {
+  INDEXING_EMBEDDING_TIMEOUT_MS,
+  normalizeVector,
+  vectorConfiguration,
+  vectorSources,
+} from "./profile"
 import type { ObjectVectorHandle } from "./types"
 
 export function createObjectVectorHandle(
@@ -65,7 +70,11 @@ export function createObjectVectorHandle(
       }
 
       // Network work never holds a storage transaction or retries an obsolete computation.
-      const result = await model.embed({ texts: [input.text], purpose: "document" })
+      const result = await model.embed({
+        texts: [input.text],
+        purpose: "document",
+        signal: AbortSignal.timeout(INDEXING_EMBEDDING_TIMEOUT_MS),
+      })
       if (!Array.isArray(result?.vectors) || result.vectors.length !== 1) {
         throw new MaterializationValidationError(
           "Embedding model must return exactly one vector for one input text."

package/src/objects/vectors/indexing-generate.ts

@@ -11,7 +11,7 @@ import { ModelExecutionSession } from "../../models/execution/session"
 import type { SixbHostContext } from "../../runtime/types"
 import type { VectorIndexingWork } from "../../storage/ontology/vector-indexing"
 import { fail, retryAt, VectorIndexingDeferred } from "./indexing-shared"
-import { normalizeVector } from "./profile"
+import { INDEXING_EMBEDDING_TIMEOUT_MS, normalizeVector } from "./profile"
 
 export interface PreparedIndexingWork {
   readonly work: VectorIndexingWork
@@ -66,7 +66,7 @@ export async function generateVectors(
     const result = await model.embed({
       texts: entries.map((entry) => entry.input.text),
       purpose: "document",
-      signal,
+      signal: AbortSignal.any([signal, AbortSignal.timeout(INDEXING_EMBEDDING_TIMEOUT_MS)]),
     })
     const values = normalizeEmbeddingResult(
       result,

package/src/objects/vectors/profile.ts

@@ -4,6 +4,11 @@ import type { ObjectVectorSearchProfile } from "../../ontology/types"
 
 export const MAX_VECTOR_K = 1000
 export const VECTOR_INPUT_VERSION = 1
+/**
+ * Nobody waits on indexing, and the provider bills a call whose response is abandoned. The
+ * deadline only frees the worker from a dead connection, so it is far longer than a search's.
+ */
+export const INDEXING_EMBEDDING_TIMEOUT_MS = 5 * 60_000
 
 export function vectorConfiguration(profile: ObjectVectorSearchProfile): string {
   return sha256Canonical({

package/src/queues/in-memory.ts

@@ -3,8 +3,6 @@ import type { SixbErrorCode } from "../errors/types"
 import { QueueError } from "./errors"
 import { IndexedHeap } from "./indexed-heap"
 import type {
-  ActionQueueJobFailureCode,
-  ActionRunRequestedQueueJob,
   AgentQueueJob,
   AgentQueueJobFailureCode,
   ClaimedQueueJob,
@@ -458,10 +456,6 @@ export class InMemoryQueues implements Queues {
     this.store,
     "workflow.runs"
   )
-  readonly actions = new InMemoryQueue<ActionRunRequestedQueueJob, ActionQueueJobFailureCode>(
-    this.store,
-    "action.runs"
-  )
   readonly agents = new InMemoryQueue<AgentQueueJob, AgentQueueJobFailureCode>(
     this.store,
     "agent.runs"

package/src/queues/index.ts

@@ -15,8 +15,6 @@ export type { ProviderScope } from "../provider-scope"
 export { QueueError } from "./errors"
 export { InMemoryQueues } from "./in-memory"
 export type {
-  ActionQueueJobFailureCode,
-  ActionRunRequestedQueueJob,
   AgentAiUsageRecordRequestedQueueJob,
   AgentQueueJob,
   AgentQueueJobFailureCode,

package/src/queues/types.ts

@@ -6,7 +6,6 @@ import type {
 } from "../models/execution/types"
 import type { ProjectionRunFailureCode } from "../projections/types"
 import type { ProviderScope } from "../provider-scope"
-import type { ActionRunFailureCode } from "../storage/action-runs/types"
 import type { AgentRunFailureCode } from "../storage/agents/types"
 import type { PipelineRunFailureCode } from "../storage/pipeline-runs/types"
 import type { SyncRunFailureCode } from "../storage/sync-runs/types"
@@ -48,7 +47,6 @@ export type SyncQueueJobFailureCode = SyncRunFailureCode
 export type PipelineQueueJobFailureCode = PipelineRunFailureCode
 export type ProjectionQueueJobFailureCode = ProjectionRunFailureCode
 export type WorkflowQueueJobFailureCode = WorkflowRunFailureCode
-export type ActionQueueJobFailureCode = ActionRunFailureCode
 export type AgentQueueJobFailureCode = AgentRunFailureCode
 
 export interface ClaimedQueueJob<TQueueJob extends QueueJob = QueueJob> {
@@ -176,14 +174,6 @@ export interface WorkflowRunResumeRequestedQueueJob
 
 export type WorkflowQueueJob = WorkflowRunRequestedQueueJob | WorkflowRunResumeRequestedQueueJob
 
-export interface ActionRunRequestedQueueJob
-  extends QueueJob<
-    "action.run.requested",
-    {
-      readonly runId: string
-    }
-  > {}
-
 /**
  * An agent turn is requested for a thread. The payload points to the durable queued run created
  * with the user message; the worker transitions it to running and installs the delivery's execution
@@ -245,7 +235,6 @@ export interface Queues {
   readonly pipelines: Queue<PipelineRunRequestedQueueJob, PipelineQueueJobFailureCode>
   readonly projections: Queue<ProjectionRunRequestedQueueJob, ProjectionQueueJobFailureCode>
   readonly workflows: Queue<WorkflowQueueJob, WorkflowQueueJobFailureCode>
-  readonly actions: Queue<ActionRunRequestedQueueJob, ActionQueueJobFailureCode>
   readonly agents: Queue<AgentQueueJob, AgentQueueJobFailureCode>
   /** Internal capacity reserved for headless child runs. */
   readonly agentChildren: Queue<SubagentQueueJob, AgentQueueJobFailureCode>

package/src/runtime/host.ts

@@ -6,6 +6,7 @@
  */
 
 import { resolve } from "node:path"
+import { ActionRunExecutor, registerActionRunExecutor } from "../actions/run/executor"
 import type { ActionDefinition } from "../actions/types"
 import type { AgentDefinitionsInput, AgentToolDefinition } from "../agents"
 import {
@@ -294,6 +295,10 @@ export class SixbHost<in out TParams extends ParamsConfig = ParamsConfig> {
     }
     registerProjectionRegistry(this.hostContext, definitions.projections)
     shareSixbErrorReporter(this, this.hostContext)
+    // Bound SDKs run requested Actions through the context; the host drains them on shutdown.
+    const executor = new ActionRunExecutor(this)
+    registerActionRunExecutor(this, executor)
+    registerActionRunExecutor(this.hostContext, executor)
     registerVectorIndexingRuntime(
       this,
       createVectorIndexingRuntime(this.hostContext, this.materializer)

package/src/runtime/resolve-definitions.ts

@@ -145,7 +145,6 @@ export function resolveDefinitions(options: DefinitionOptions): ResolvedDefiniti
 
   validateSchedulesAtStartup(schedules, ontology, {
     registeredRuleIds: new Set(rulesById.keys()),
-    registeredActionIds,
     registeredDatasetIds: new Set(datasetsById.keys()),
     registeredSyncIds: new Set(syncsById.keys()),
     registeredPipelineIds: new Set(pipelinesById.keys()),

package/src/runtime/types.ts

@@ -5,12 +5,7 @@
  * Each level narrows generic parameters so downstream code stays type-safe.
  */
 
-import type {
-  ActionDefinitionCatalog,
-  ActionParamsConfig,
-  InferActionParams,
-  RequestActionResult,
-} from "../actions"
+import type { ActionDefinitionCatalog, ActionParamsConfig, InferActionParams } from "../actions"
 import type { AuthorizationContext } from "../authorization"
 import type { OpenedFileRef } from "../blob-storage"
 import type { Broker } from "../broker"
@@ -860,36 +855,25 @@ export interface ObjectByIdHandle<TObjectType extends ObjectTypeWithPropertyToke
     target: ObjectRef<ResolveTargetTypeId<TLinkToken["targetObjectTypeId"]>>
   ): Promise<void>
 
-  /** Request an action on this object by id (dynamic / server contexts). */
+  /**
+   * Run an action on this object by id (dynamic / server contexts) and return its terminal run.
+   * A failed run resolves with status `failed`.
+   */
   requestAction(input: {
     actionId: string
     params?: Record<string, unknown>
     runId?: string
-  }): Promise<RequestActionResult>
+    signal?: AbortSignal
+  }): Promise<ActionRunRecord>
 
   /**
-   * Request an action on this object using a typed action reference.
+   * Run an action on this object using a typed action reference, and return its terminal run.
    * Params are inferred from the action's declared shape.
    */
   requestAction<const TAction extends TypedActionReference>(input: {
     action: TAction
     params: NoInfer<TypedActionParams<TAction>>
     runId?: string
-  }): Promise<RequestActionResult>
-
-  /** Request an action and wait for the terminal lifecycle event. */
-  requestActionAndWait(input: {
-    actionId: string
-    params?: Record<string, unknown>
-    timeoutMs?: number
-    signal?: AbortSignal
-  }): Promise<ActionRunRecord>
-
-  /** Request a typed action and wait for the terminal lifecycle event. */
-  requestActionAndWait<const TAction extends TypedActionReference>(input: {
-    action: TAction
-    params: NoInfer<TypedActionParams<TAction>>
-    timeoutMs?: number
     signal?: AbortSignal
   }): Promise<ActionRunRecord>
 
@@ -931,40 +915,27 @@ export interface ObjectSet<TObjectType extends ObjectTypeWithPropertyTokens>
     }[]
   ): Promise<void>
 
-  /** Request an action on an object of this type by id (dynamic / server contexts). */
+  /**
+   * Run an action on an object of this type by id (dynamic / server contexts) and return its
+   * terminal run. A failed run resolves with status `failed`.
+   */
   requestAction(input: {
     id: string
     actionId: string
     params?: Record<string, unknown>
     runId?: string
-  }): Promise<RequestActionResult>
+    signal?: AbortSignal
+  }): Promise<ActionRunRecord>
 
   /**
-   * Request an action on an object of this type using a typed action reference.
-   * Params are inferred from the action's declared shape.
+   * Run an action on an object of this type using a typed action reference, and return its
+   * terminal run. Params are inferred from the action's declared shape.
    */
   requestAction<const TAction extends TypedActionReference>(input: {
     id: string
     action: TAction
     params: NoInfer<TypedActionParams<TAction>>
     runId?: string
-  }): Promise<RequestActionResult>
-
-  /** Request an action on an object and wait for the terminal lifecycle event. */
-  requestActionAndWait(input: {
-    id: string
-    actionId: string
-    params?: Record<string, unknown>
-    timeoutMs?: number
-    signal?: AbortSignal
-  }): Promise<ActionRunRecord>
-
-  /** Request a typed action and wait for the terminal lifecycle event. */
-  requestActionAndWait<const TAction extends TypedActionReference>(input: {
-    id: string
-    action: TAction
-    params: NoInfer<TypedActionParams<TAction>>
-    timeoutMs?: number
     signal?: AbortSignal
   }): Promise<ActionRunRecord>
 

package/src/schedules/builders.ts

@@ -169,9 +169,6 @@ function assertEventSource(source: EventSelectorSpec): void {
     case "rules":
       assertNonEmpty(source.ruleId ?? "", "event source ruleId")
       return
-    case "actions":
-      assertNonEmpty(source.actionId ?? "", "event source actionId")
-      return
     case "datasets":
       assertNonEmpty(source.datasetId ?? "", "event source datasetId")
       return
@@ -183,7 +180,7 @@ function assertEventSource(source: EventSelectorSpec): void {
       return
     default:
       throw new ScheduleValidationError(
-        "Schedule event source must select object, link, rule, action, dataset, sync, or pipeline events."
+        "Schedule event source must select object, link, rule, dataset, sync, or pipeline events."
       )
   }
 }

package/src/schedules/runtime.ts

@@ -100,26 +100,6 @@ export function buildEventScheduleContext(event: DomainEvent): RuntimeEventSched
           primaryId: event.payload.subject.primaryId,
         },
       }
-    case "action.requested":
-      return {
-        actionId: event.payload.actionId,
-        runId: event.payload.runId,
-        ...actionSubjectContext(event.payload.subject),
-        params: { ...event.payload.params },
-      }
-    case "action.completed":
-      return {
-        actionId: event.payload.actionId,
-        runId: event.payload.runId,
-        ...actionSubjectContext(event.payload.subject),
-      }
-    case "action.failed":
-      return {
-        actionId: event.payload.actionId,
-        runId: event.payload.runId,
-        ...actionSubjectContext(event.payload.subject),
-        error: event.payload.error,
-      }
     case "dataset.version.committed":
       return { ...event.payload }
     case "sync.run.finished":
@@ -131,27 +111,6 @@ export function buildEventScheduleContext(event: DomainEvent): RuntimeEventSched
   }
 }
 
-function actionSubjectContext(subject: {
-  readonly kind: "none" | "object"
-  readonly objectTypeId?: string
-  readonly primaryId?: string
-}): { readonly subject?: { readonly objectTypeId: string; readonly primaryId: string } } {
-  if (
-    subject.kind !== "object" ||
-    subject.objectTypeId === undefined ||
-    subject.primaryId === undefined
-  ) {
-    return {}
-  }
-
-  return {
-    subject: {
-      objectTypeId: subject.objectTypeId,
-      primaryId: subject.primaryId,
-    },
-  }
-}
-
 function fieldsForEvent(event: DomainEvent): Readonly<Record<string, unknown>> {
   if (event.topic !== "links") {
     return {}

package/src/schedules/validation.ts

@@ -8,7 +8,6 @@ import type { EventScheduleCondition, EventScheduleDefinition, ScheduleDefinitio
 const objectEventTypes = new Set(["object.created", "object.updated", "object.deleted"])
 const linkEventTypes = new Set(["link.created", "link.updated", "link.deleted"])
 const ruleEventTypes = new Set(["rule.triggered", "rule.resolved"])
-const actionEventTypes = new Set(["action.requested", "action.completed", "action.failed"])
 const datasetEventTypes = new Set(["dataset.version.committed"])
 const syncEventTypes = new Set(["sync.run.finished"])
 const pipelineEventTypes = new Set(["pipeline.run.finished"])
@@ -17,7 +16,6 @@ const linkIdentityFields = new Set(["target.objectTypeId", "target.primaryId"])
 
 export interface ValidateSchedulesAtStartupOptions {
   readonly registeredRuleIds?: ReadonlySet<string>
-  readonly registeredActionIds?: ReadonlySet<string>
   readonly registeredDatasetIds?: ReadonlySet<string>
   readonly registeredSyncIds?: ReadonlySet<string>
   readonly registeredPipelineIds?: ReadonlySet<string>
@@ -138,9 +136,6 @@ function assertEventSourceShape(
     case "rules":
       assertNonEmptyString(value.ruleId, `${path} ruleId`, createError)
       return
-    case "actions":
-      assertNonEmptyString(value.actionId, `${path} actionId`, createError)
-      return
     case "datasets":
       assertNonEmptyString(value.datasetId, `${path} datasetId`, createError)
       return
@@ -154,7 +149,7 @@ function assertEventSourceShape(
       return
     default:
       throw createError(
-        `${path} must select object, link, rule, action, dataset, sync, or pipeline events.`
+        `${path} must select object, link, rule, dataset, sync, or pipeline events.`
       )
   }
 }
@@ -212,15 +207,6 @@ function validateEventSchedule(
         "rule"
       )
       return
-    case "actions":
-      validateRegisteredSource(
-        schedule,
-        source.actionId,
-        options.registeredActionIds,
-        actionEventTypes,
-        "action"
-      )
-      return
     case "datasets":
       validateRegisteredSource(
         schedule,
@@ -294,7 +280,7 @@ function validateRegisteredSource(
   sourceId: string | undefined,
   registeredIds: ReadonlySet<string> | undefined,
   supportedTypes: ReadonlySet<string>,
-  sourceKind: "rule" | "action" | "dataset" | "sync" | "pipeline"
+  sourceKind: "rule" | "dataset" | "sync" | "pipeline"
 ): void {
   validateEventTypes(schedule, supportedTypes, sourceKind)
   if (!registeredIds?.has(sourceId ?? "")) {

package/src/security/builders.ts

@@ -39,7 +39,12 @@ export interface DefineMembershipPolicyOptions {
   readonly can: readonly MembershipOperation[]
 }
 
-const MEMBERSHIP_OPERATIONS = new Set<MembershipOperation>(["invite", "assignGroups", "suspend"])
+const MEMBERSHIP_OPERATIONS = new Set<MembershipOperation>([
+  "invite",
+  "assignGroups",
+  "suspend",
+  "serviceAccounts",
+])
 
 function assertNonEmptyArray<T>(value: readonly T[], field: string): void {
   if (value.length === 0) {
@@ -65,7 +70,7 @@ function membershipOperationsFrom(
   return operations.map((operation) => {
     if (!MEMBERSHIP_OPERATIONS.has(operation)) {
       throw new SecurityValidationError(
-        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`
+        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`
       )
     }
 

package/src/security/every.ts

@@ -8,7 +8,7 @@
  *
  * They live under one `every` namespace on purpose. Spending seven of the best identifiers in
  * `@sixb/core` — `actions`, `workflows`, `syncs`, … — on an auxiliary subsystem collided with the
- * primitives themselves and with `events.actions()` / `logs.actions()` on the client.
+ * primitives themselves and with client builders such as `logs.actions()`.
  */
 
 import type { ActionDefinition } from "../actions/types"
@@ -20,7 +20,6 @@ import type { ShareDefinition } from "../shares"
 import type { SyncDefinition } from "../syncs"
 import type { WorkflowDefinition } from "../workflows/types"
 import { SecurityValidationError } from "./errors"
-import type { ApplicationDefinition } from "./types"
 
 /** Capability targets a breadth selector can range over. */
 export const BREADTH_TARGETS = [
@@ -30,7 +29,6 @@ export const BREADTH_TARGETS = [
   "workflow",
   "sync",
   "pipeline",
-  "application",
   "connector",
   "share",
 ] as const
@@ -44,7 +42,6 @@ interface BreadthTargetInput {
   workflow: WorkflowDefinition
   sync: SyncDefinition
   pipeline: PipelineDefinition
-  application: ApplicationDefinition
   connector: ConnectorDefinition
   share: ShareDefinition
 }
@@ -106,7 +103,6 @@ export const every = {
   workflow: (): BreadthSelector<"workflow"> => all("workflow"),
   sync: (): BreadthSelector<"sync"> => all("sync"),
   pipeline: (): BreadthSelector<"pipeline"> => all("pipeline"),
-  application: (): BreadthSelector<"application"> => all("application"),
   connector: (): BreadthSelector<"connector"> => all("connector"),
   share: (): BreadthSelector<"share"> => all("share"),
 }