@sixb/core 0.1.18 → 0.1.20

package/src/storage/action-runs/types.ts

@@ -2,32 +2,26 @@ import type { ActionSubject } from "../../actions"
 import type { SixbErrorCode, SixbFailure } from "../../errors/types"
 import type { JsonValue } from "../../json"
 
-export type ActionRunStatus = "queued" | "running" | "succeeded" | "failed" | "cancelled"
-
-export const ACTION_RUN_PHASES = [
-  "request",
-  "enqueue",
-  "validation",
-  "writeback",
-  "edits",
-  "commit",
-  "effects",
-  "cancelled",
-] as const
+/**
+ * How a run ended. A run is recorded once, when it ends: while it executes, the request that runs
+ * it is its only state.
+ */
+export type ActionRunStatus = "succeeded" | "failed"
+
+/** The phases of a run, in the order it reaches them. */
+export const ACTION_RUN_PHASES = ["validation", "writeback", "edits", "commit", "effects"] as const
 
 export type ActionRunPhase = (typeof ACTION_RUN_PHASES)[number]
 
 export type ActionRunParams = Readonly<Record<string, JsonValue>>
 
-export type ActionRunPhaseStatus = "succeeded" | "failed"
-
 /** Error codes an action run or phase record can persist and expose. */
 export const ACTION_RUN_FAILURE_CODES = [
   "internal.unexpected",
   "runtime.cancelled",
-  "queue.enqueue_failed",
   "action.phase_failed",
   "action.read_conflict",
+  "action.timeout",
 ] as const satisfies readonly [SixbErrorCode, ...SixbErrorCode[]]
 
 export type ActionRunFailureCode = (typeof ACTION_RUN_FAILURE_CODES)[number]
@@ -70,67 +64,34 @@ export type ActionRunEffectsRecord =
       readonly error: ActionRunFailure<"effects">
     }
 
-export interface ActionRunRecord {
+interface ActionRunRecordFields {
   readonly id: string
   readonly projectId: string
   readonly executionId: string
   readonly actionId: string
   readonly subject: ActionSubject
-  readonly status: ActionRunStatus
-  readonly phase?: ActionRunPhase
-  readonly queuedAt: Date
-  readonly startedAt?: Date
-  readonly finishedAt?: Date
+  /** The last phase the run reached. */
+  readonly phase: ActionRunPhase
+  readonly startedAt: Date
+  readonly finishedAt: Date
   readonly params: ActionRunParams
   readonly idempotencyKey: string
   readonly writeback?: ActionRunWritebackRecord
-  readonly effects?: ActionRunEffectsRecord
-  readonly error?: ActionRunFailure
-}
-
-export interface QueueActionRunInput {
-  readonly id: string
-  readonly projectId: string
-  readonly executionId: string
-  readonly actionId: string
-  readonly subject: ActionSubject
-  readonly params: ActionRunParams
-  readonly idempotencyKey: string
-  readonly queuedAt?: Date
 }
 
-export interface StartActionRunInput {
-  readonly id: string
-  readonly projectId: string
-  readonly startedAt?: Date
-  readonly phase?: Extract<ActionRunPhase, "validation">
-}
+/** A run's terminal record, as it is written once when the run ends. */
+export type RecordActionRunInput =
+  | (ActionRunRecordFields & { readonly status: "succeeded"; readonly error?: never })
+  | (ActionRunRecordFields & { readonly status: "failed"; readonly error: ActionRunFailure })
 
-export interface EnterActionRunPhaseInput {
-  readonly id: string
-  readonly projectId: string
-  readonly phase: Extract<
-    ActionRunPhase,
-    "validation" | "writeback" | "edits" | "commit" | "effects"
-  >
+/**
+ * A recorded run. Its effects run after its record is written, so their outcome is the one part
+ * recorded later, on a succeeded run that committed edits.
+ */
+export type ActionRunRecord = RecordActionRunInput & {
+  readonly effects?: ActionRunEffectsRecord
 }
 
-export type RecordActionWritebackInput =
-  | {
-      readonly id: string
-      readonly projectId: string
-      readonly status: "succeeded"
-      readonly completedAt?: Date
-      readonly result: JsonValue
-    }
-  | {
-      readonly id: string
-      readonly projectId: string
-      readonly status: "failed"
-      readonly completedAt?: Date
-      readonly error: ActionRunFailure<"writeback">
-    }
-
 export type RecordActionEffectsInput =
   | {
       readonly id: string
@@ -146,22 +107,6 @@ export type RecordActionEffectsInput =
       readonly error: ActionRunFailure<"effects">
     }
 
-export type FinishActionRunInput =
-  | {
-      readonly id: string
-      readonly projectId: string
-      readonly status: "succeeded"
-      readonly finishedAt?: Date
-      readonly phase?: ActionRunPhase
-    }
-  | {
-      readonly id: string
-      readonly projectId: string
-      readonly status: "failed" | "cancelled"
-      readonly finishedAt?: Date
-      readonly error: ActionRunFailure
-    }
-
 export interface ListActionRunsInput {
   readonly projectId: string
   readonly actionId?: string
@@ -184,21 +129,21 @@ export interface ListActionRunsResult {
   readonly total: number
 }
 
-export interface LockActionMaterializationRunInput {
-  readonly projectId: string
-  readonly actionId: string
-  readonly runId: string
-}
-
 export interface ActionRunStorage {
-  /** Transactional fence for Action identity and running state before a new ontology commit. */
-  lockForMaterialization(input: LockActionMaterializationRunInput): Promise<ActionRunRecord>
-  queue(input: QueueActionRunInput): Promise<ActionRunRecord>
-  start(input: StartActionRunInput): Promise<ActionRunRecord>
-  enterPhase(input: EnterActionRunPhaseInput): Promise<ActionRunRecord>
-  recordWriteback(input: RecordActionWritebackInput): Promise<ActionRunRecord>
+  /**
+   * Insert a run's terminal record.
+   *
+   * A run is recorded once: a run id that already has a record is refused with an
+   * `ActionRunError`, and so is an execution that already recorded another run. The execution must
+   * be the trusted primitive execution created for this run.
+   */
+  record(input: RecordActionRunInput): Promise<ActionRunRecord>
+  /**
+   * Record the outcome of the effects of a succeeded run that committed edits, once. Recording an
+   * equal outcome again returns the run unchanged.
+   */
   recordEffects(input: RecordActionEffectsInput): Promise<ActionRunRecord>
-  finish(input: FinishActionRunInput): Promise<ActionRunRecord>
   getById(params: { projectId: string; id: string }): Promise<ActionRunRecord | null>
+  /** Runs ordered by `startedAt`, then id. */
   list(input: ListActionRunsInput): Promise<ListActionRunsResult>
 }

package/src/storage/agents/types.ts

@@ -172,7 +172,7 @@ export const AGENT_RUN_DIAGNOSTIC_CODES = [
  *
  * Sixb writes these codes and the generated client is what reads them, so an open union would only
  * be honest if the HTTP schema were open too — and that costs the OpenAPI enum, the client's
- * autocompletion, and Atlas's exhaustive `switch`. Sixb owns both ends, so a new code is a minor
+ * autocompletion, and the app's exhaustive `switch`. Sixb owns both ends, so a new code is a minor
  * version bump: cheap here, and a broken `switch` is better than a 500 from `z.enum`.
  */
 export type AgentRunDiagnosticCode = (typeof AGENT_RUN_DIAGNOSTIC_CODES)[number]

package/src/storage/auth/in-memory/auth-storage.ts

@@ -222,7 +222,6 @@ export class InMemoryAuthStorage implements AuthStorage {
     }
 
     validateCompleteSessionInput(this.state, projectId, input.session)
-    assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience)
 
     let newUserId: string | undefined
     if (shouldCreateUser) {
@@ -353,7 +352,6 @@ export class InMemoryAuthStorage implements AuthStorage {
     }
 
     validateCompleteSessionInput(this.state, projectId, input.session)
-    assertSignInSessionAudience(projectId, input.session.audience, attempt.audience)
 
     let newUserId: string | undefined
     if (shouldCreateUser) {
@@ -555,7 +553,6 @@ export class InMemoryAuthStorage implements AuthStorage {
       projectId: input.projectId,
       userId: input.userId,
       strategyId: input.strategyId,
-      audience: input.session.audience,
       tokenHash: input.session.tokenHash,
       createdAt: input.session.createdAt,
       expiresAt: input.session.expiresAt,
@@ -587,18 +584,3 @@ function restoreMap<TKey, TValue>(target: Map<TKey, TValue>, snapshot: Map<TKey,
     target.set(key, value)
   }
 }
-
-function assertSignInSessionAudience(
-  projectId: string,
-  sessionAudience: string,
-  storedAudience: string
-): void {
-  if (sessionAudience === storedAudience) {
-    return
-  }
-
-  throw new AuthStorageError(
-    "invalid_input",
-    `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`
-  )
-}

package/src/storage/auth/in-memory/magic-links.ts

@@ -1,4 +1,3 @@
-import { resolveAuthSessionAudience } from "../../../auth/audience"
 import { AuthStorageError } from "../errors"
 import type { AuthMagicLinkStore, CreateAuthMagicLinkInput, MagicLinkRecord } from "../types"
 import type { AuthStorageState } from "./shared"
@@ -22,7 +21,6 @@ export class InMemoryAuthMagicLinkStore implements AuthMagicLinkStore {
     const id = assertNonEmpty(input.id, "Magic link id")
     const projectId = assertNonEmpty(input.projectId, "Project id")
     const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-    const audience = resolveAuthSessionAudience(input.audience)
     const email = normalizeEmail(input.email)
     const tokenHash = assertNonEmpty(input.tokenHash, "Magic link token hash")
     const key = magicLinkKey(projectId, id)
@@ -40,7 +38,6 @@ export class InMemoryAuthMagicLinkStore implements AuthMagicLinkStore {
       id,
       projectId,
       strategyId,
-      audience,
       email,
       tokenHash,
       returnTo: input.returnTo,

package/src/storage/auth/in-memory/oidc-attempts.ts

@@ -1,4 +1,3 @@
-import { resolveAuthSessionAudience } from "../../../auth/audience"
 import { AuthStorageError } from "../errors"
 import type {
   AuthOidcAuthorizationAttemptStore,
@@ -26,7 +25,6 @@ export class InMemoryAuthOidcAuthorizationAttemptStore
     const id = assertNonEmpty(input.id, "OIDC authorization attempt id")
     const projectId = assertNonEmpty(input.projectId, "Project id")
     const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-    const audience = resolveAuthSessionAudience(input.audience)
     const stateHash = assertNonEmpty(input.stateHash, "OIDC state hash")
     const nonceHash = assertNonEmpty(input.nonceHash, "OIDC nonce hash")
     const codeVerifier = assertNonEmpty(input.codeVerifier, "OIDC code verifier")
@@ -43,7 +41,6 @@ export class InMemoryAuthOidcAuthorizationAttemptStore
       id,
       projectId,
       strategyId,
-      audience,
       stateHash,
       nonceHash,
       codeVerifier,

package/src/storage/auth/in-memory/sessions.ts

@@ -1,4 +1,3 @@
-import type { AuthSessionAudience } from "../../../auth/audience"
 import { AuthStorageError } from "../errors"
 import type {
   AuthSessionStore,
@@ -11,7 +10,6 @@ import {
   cloneDate,
   cloneOptionalRecord,
   cloneRecord,
-  compareByCreatedAt,
   createSessionRecord,
   isActiveSession,
   revokeActiveSessionsForUser,
@@ -33,22 +31,6 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     return cloneOptionalRecord(record)
   }
 
-  async getActiveByUserId(params: {
-    readonly projectId: string
-    readonly userId: string
-    readonly audience: AuthSessionAudience
-    readonly now: Date
-  }): Promise<SessionRecord | null> {
-    const sessions = [...this.state.sessions.values()]
-      .filter((session) => session.projectId === params.projectId)
-      .filter((session) => session.userId === params.userId)
-      .filter((session) => session.audience === params.audience)
-      .filter((session) => isActiveSession(session, params.now))
-      .sort((a, b) => compareByCreatedAt(a, b, "desc"))
-
-    return cloneOptionalRecord(sessions[0] ?? null)
-  }
-
   async listActiveByUserId(params: {
     readonly projectId: string
     readonly userId: string
@@ -71,7 +53,6 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
   async findValidByTokenHash(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
   }): Promise<SessionRecord | null> {
@@ -79,7 +60,6 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     if (
       !session ||
       session.bearer ||
-      session.audience !== params.audience ||
       session.tokenHash !== params.tokenHash ||
       !isActiveSession(session, params.now)
     ) {
@@ -153,7 +133,6 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
   async renewIfValid(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
     readonly expiresAt: Date
@@ -163,7 +142,6 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     if (
       !session ||
       session.bearer ||
-      session.audience !== params.audience ||
       session.tokenHash !== params.tokenHash ||
       !isActiveSession(session, params.now)
     ) {
@@ -208,15 +186,13 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
   async revokeActiveForUser(params: {
     readonly projectId: string
     readonly userId: string
-    readonly audience?: AuthSessionAudience
     readonly revokedAt: Date
   }): Promise<readonly SessionRecord[]> {
     return revokeActiveSessionsForUser(
       this.state,
       params.projectId,
       params.userId,
-      params.revokedAt,
-      params.audience
+      params.revokedAt
     ).map(cloneRecord)
   }
 

package/src/storage/auth/in-memory/shared.ts

@@ -1,4 +1,3 @@
-import { type AuthSessionAudience, resolveAuthSessionAudience } from "../../../auth/audience"
 import { AuthStorageError } from "../errors"
 import type {
   AccessTokenRecord,
@@ -213,8 +212,7 @@ export function revokeActiveSessionsForUser(
   state: AuthStorageState,
   projectId: string,
   userId: string,
-  revokedAt: Date,
-  audience?: AuthSessionAudience
+  revokedAt: Date
 ): readonly SessionRecord[] {
   const revoked: SessionRecord[] = []
 
@@ -223,10 +221,6 @@ export function revokeActiveSessionsForUser(
       continue
     }
 
-    if (audience !== undefined && session.audience !== audience) {
-      continue
-    }
-
     if (!isActiveSession(session, revokedAt)) {
       continue
     }
@@ -290,7 +284,6 @@ export function validateCompleteSessionInput(
   session: CompleteAuthSessionInput
 ): void {
   const sessionId = assertNonEmpty(session.id, "Session id")
-  assertNonEmpty(session.audience, "Session audience")
   assertNonEmpty(session.tokenHash, "Session token hash")
   assertSessionIdAvailable(state, projectId, sessionId)
 }
@@ -303,7 +296,6 @@ export function createSessionRecord(
   const projectId = assertNonEmpty(input.projectId, "Project id")
   const userId = assertNonEmpty(input.userId, "User id")
   const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-  const audience = resolveAuthSessionAudience(input.audience)
   const tokenHash = assertNonEmpty(input.tokenHash, "Session token hash")
 
   assertSessionIdAvailable(state, projectId, id)
@@ -313,7 +305,6 @@ export function createSessionRecord(
     projectId,
     userId,
     strategyId,
-    audience,
     tokenHash,
     createdAt: cloneDate(input.createdAt),
     expiresAt: cloneDate(input.expiresAt),

package/src/storage/auth/types.ts

@@ -1,4 +1,4 @@
-import type { AccessTokenKind, AuthSessionAudience, Principal } from "../../auth"
+import type { AccessTokenKind, Principal } from "../../auth"
 import type { AuthorizablePrincipal } from "../../execution/types"
 
 export type UserStatus = "active" | "suspended"
@@ -57,7 +57,6 @@ export interface SessionRecord {
   readonly userId: string
   readonly strategyId: string
   /** The web app a browser session belongs to. A bearer session belongs to none and ignores it. */
-  readonly audience: AuthSessionAudience
   readonly tokenHash: string
   readonly createdAt: Date
   readonly expiresAt: Date
@@ -142,7 +141,6 @@ export interface MagicLinkRecord {
   readonly id: string
   readonly projectId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly email: string
   readonly tokenHash: string
   readonly returnTo?: string
@@ -156,7 +154,6 @@ export interface OidcAuthorizationAttemptRecord {
   readonly id: string
   readonly projectId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly stateHash: string
   readonly nonceHash: string
   readonly codeVerifier: string
@@ -288,7 +285,6 @@ export interface CreateAuthSessionInput {
   readonly projectId: string
   readonly userId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly tokenHash: string
   readonly createdAt: Date
   readonly expiresAt: Date
@@ -330,7 +326,6 @@ export interface ListAuthAccessTokensResult {
 
 export interface CompleteAuthSessionInput {
   readonly id: string
-  readonly audience: AuthSessionAudience
   readonly tokenHash: string
   readonly createdAt: Date
   readonly expiresAt: Date
@@ -379,7 +374,6 @@ export interface CreateAuthMagicLinkInput {
   readonly id: string
   readonly projectId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly email: string
   readonly tokenHash: string
   readonly returnTo?: string
@@ -391,7 +385,6 @@ export interface CreateOidcAuthorizationAttemptInput {
   readonly id: string
   readonly projectId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly stateHash: string
   readonly nonceHash: string
   readonly codeVerifier: string
@@ -536,13 +529,7 @@ export interface AuthSessionStore {
     readonly projectId: string
     readonly id: string
   }): Promise<SessionRecord | null>
-  getActiveByUserId(params: {
-    readonly projectId: string
-    readonly userId: string
-    readonly audience: AuthSessionAudience
-    readonly now: Date
-  }): Promise<SessionRecord | null>
-  // All active sessions for a user across every audience, most-recently-active
+  // All active sessions for a user, most-recently-active
   // first. Backs the active-sessions view.
   listActiveByUserId(params: {
     readonly projectId: string
@@ -553,7 +540,6 @@ export interface AuthSessionStore {
   findValidByTokenHash(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
   }): Promise<SessionRecord | null>
@@ -585,7 +571,6 @@ export interface AuthSessionStore {
   renewIfValid(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
     readonly expiresAt: Date
@@ -598,7 +583,6 @@ export interface AuthSessionStore {
   revokeActiveForUser(params: {
     readonly projectId: string
     readonly userId: string
-    readonly audience?: AuthSessionAudience
     readonly revokedAt: Date
   }): Promise<readonly SessionRecord[]>
   touch(params: {

package/src/storage/index.ts

@@ -35,28 +35,20 @@ export type {
   ActionRunFailureDetails,
   ActionRunParams,
   ActionRunPhase,
-  ActionRunPhaseRecord,
-  ActionRunPhaseStatus,
   ActionRunRecord,
   ActionRunStatus,
   ActionRunStorage,
   ActionRunWritebackRecord,
-  EnterActionRunPhaseInput,
-  FinishActionRunInput,
   ListActionRunsInput,
   ListActionRunsResult,
-  LockActionMaterializationRunInput,
-  QueueActionRunInput,
   RecordActionEffectsInput,
-  RecordActionWritebackInput,
-  StartActionRunInput,
+  RecordActionRunInput,
 } from "./action-runs"
 export {
   ACTION_RUN_FAILURE_CODES,
   ACTION_RUN_PHASES,
   ActionRunError,
   InMemoryActionRunStorage,
-  isTerminalActionRun,
 } from "./action-runs"
 export type {
   AgentContextCheckpointReason,

package/src/storage/internal.ts

@@ -1,12 +1,6 @@
 /** Implementation exports for Sixb packages only. */
 
-export {
-  actionRunParamsEqual,
-  actionRunPhaseRecordsEqual,
-  actionSubjectsEqual,
-  canRequeueActionRunAfterEnqueueFailure,
-  finishActionRunPhase,
-} from "./action-runs/idempotency"
+export { normalizeRecordActionRunInput, resolveActionRunEffects } from "./action-runs/record"
 export { assertAiUsageExecutionId, normalizeAiModelCallRecord } from "./ai-usage/record"
 export { normalizeAiModelCallUsage } from "./ai-usage/usage"
 export { parseFileDownloadGrantRow } from "./file-download-grants/record"

package/src/storage/objects/execution-limits.ts

@@ -20,9 +20,10 @@ export class ObjectReadLimitExceededError extends Error {
 
   constructor(
     readonly metric: ObjectReadLimitMetric,
-    readonly limit: number
+    readonly limit: number,
+    message = `[Sixb] Object read exceeded its ${metric} limit (${limit}).`
   ) {
-    super(`[Sixb] Object read exceeded its ${metric} limit (${limit}).`)
+    super(message)
   }
 }
 

package/src/storage/types.ts

@@ -35,12 +35,10 @@ export type {
   ActionRunRecord,
   ActionRunStatus,
   ActionRunStorage,
-  FinishActionRunInput,
   ListActionRunsInput,
   ListActionRunsResult,
-  LockActionMaterializationRunInput,
-  QueueActionRunInput,
-  StartActionRunInput,
+  RecordActionEffectsInput,
+  RecordActionRunInput,
 } from "./action-runs"
 export { ACTION_RUN_FAILURE_CODES, ACTION_RUN_PHASES, ActionRunError } from "./action-runs"
 export type {