@sixb/core 0.1.18 → 0.1.20

package/src/actions/run-dispatch.ts

@@ -1,282 +0,0 @@
-import { randomUUID } from "node:crypto"
-import { reportRunFailure } from "../error-reporting/capability"
-import { createSixbError, toSixbFailure } from "../errors/internal"
-import type { DomainEventLog } from "../events"
-import type { Queues } from "../queues"
-import type {
-  ActionRunFailure,
-  ActionRunParams,
-  ActionRunRecord,
-  CreateExecutionInput,
-  Storage,
-} from "../storage"
-import { ACTION_RUN_FAILURE_CODES, ActionRunError } from "../storage"
-import { parseActionRunFailure } from "../storage/action-runs/failure"
-import { actionRunParamsEqual, actionSubjectsEqual } from "../storage/action-runs/idempotency"
-import type { RequestActionResult } from "./request"
-import { createActionRunId, createActionRunIdempotencyKey } from "./run-id"
-import type { ActionSubject } from "./types"
-
-interface DispatchActionRunInput {
-  readonly errorReporterHost: object
-  readonly projectId: string
-  readonly storage: Storage
-  readonly queue: Queues["actions"]
-  readonly events: DomainEventLog
-  readonly actionId: string
-  readonly subject: ActionSubject
-  readonly params: ActionRunParams
-  readonly runId?: string
-  readonly createExecution: (executionId: string, runId: string) => Promise<CreateExecutionInput>
-  /** Runs before payload comparison or retry so an existing run cannot cross authority owners. */
-  readonly assertCanReuseExisting?: (storage: Storage, run: ActionRunRecord) => void | Promise<void>
-  /** Checks that hold only for a run this call creates; a replayed run keeps its accepted params. */
-  readonly assertNewRun?: () => Promise<void>
-}
-
-interface PreparedActionRun {
-  readonly runId: string
-  readonly idempotencyKey: string
-}
-
-type PersistedActionRun =
-  | { readonly publish: false; readonly run: ActionRunRecord }
-  | {
-      readonly publish: true
-      readonly run: ActionRunRecord
-      readonly execution: CreateExecutionInput
-      readonly queuedAt: Date
-      readonly created: boolean
-    }
-
-/** Persist an Action execution and run before publishing its queue job. */
-export async function dispatchActionRun(
-  input: DispatchActionRunInput
-): Promise<RequestActionResult> {
-  const request = prepareActionRun(input)
-  const persisted = await persistActionRun(input, request)
-  if (!persisted.publish) return existingActionRunResult(persisted.run)
-  return publishActionRun(input, persisted)
-}
-
-function prepareActionRun(input: DispatchActionRunInput): PreparedActionRun {
-  const runId = createActionRunId(input.runId)
-  return {
-    runId,
-    idempotencyKey: createActionRunIdempotencyKey(input.projectId, runId),
-  }
-}
-
-async function persistActionRun(
-  input: DispatchActionRunInput,
-  request: PreparedActionRun
-): Promise<PersistedActionRun> {
-  const actionRuns = requireActionRunStorage(input.storage)
-  const existing = await actionRuns.getById({ projectId: input.projectId, id: request.runId })
-  if (existing) {
-    await input.assertCanReuseExisting?.(input.storage, existing)
-    return reuseActionRun(input, existing)
-  }
-
-  await input.assertNewRun?.()
-  const execution = await input.createExecution(`exec_${randomUUID()}`, request.runId)
-  const queuedAt = new Date()
-  try {
-    return await input.storage.transaction(
-      async (tx): Promise<PersistedActionRun> => {
-        const transactionalRuns = requireActionRunStorage(tx)
-        const raced = await transactionalRuns.getById({
-          projectId: input.projectId,
-          id: request.runId,
-        })
-        if (raced) {
-          await input.assertCanReuseExisting?.(tx, raced)
-          assertExistingRunMatchesRequest(raced, input)
-          return { publish: false, run: raced }
-        }
-
-        await tx.executions.create(execution)
-        const run = await transactionalRuns.queue({
-          projectId: input.projectId,
-          id: request.runId,
-          executionId: execution.id,
-          actionId: input.actionId,
-          subject: input.subject,
-          params: input.params,
-          idempotencyKey: request.idempotencyKey,
-          queuedAt,
-        })
-        return { publish: true, run, execution, queuedAt, created: true }
-      },
-      { isolation: "serializable" }
-    )
-  } catch (error) {
-    if (!(error instanceof ActionRunError)) throw error
-    const raced = await actionRuns.getById({ projectId: input.projectId, id: request.runId })
-    if (!raced) throw error
-    await input.assertCanReuseExisting?.(input.storage, raced)
-    assertExistingRunMatchesRequest(raced, input)
-    return { publish: false, run: raced }
-  }
-}
-
-async function reuseActionRun(
-  input: DispatchActionRunInput,
-  existing: ActionRunRecord
-): Promise<PersistedActionRun> {
-  assertExistingRunMatchesRequest(existing, input)
-  if (!isRetryableEnqueueFailure(existing)) return { publish: false, run: existing }
-
-  const execution = await input.storage.executions.getById({
-    projectId: input.projectId,
-    id: existing.executionId,
-  })
-  if (!execution) {
-    throw new ActionRunError(
-      `[Sixb] Execution '${existing.executionId}' for Action run '${existing.id}' was not found.`
-    )
-  }
-
-  const queuedAt = new Date()
-  const run = await requireActionRunStorage(input.storage).queue({
-    projectId: input.projectId,
-    id: existing.id,
-    executionId: existing.executionId,
-    actionId: existing.actionId,
-    subject: existing.subject,
-    params: existing.params,
-    idempotencyKey: existing.idempotencyKey,
-    queuedAt,
-  })
-  return { publish: true, run, execution, queuedAt, created: false }
-}
-
-async function publishActionRun(
-  input: DispatchActionRunInput,
-  persisted: Extract<PersistedActionRun, { readonly publish: true }>
-): Promise<RequestActionResult> {
-  let job: Awaited<ReturnType<Queues["actions"]["enqueue"]>>[number] | undefined
-  try {
-    const jobs = await input.queue.enqueue({
-      projectId: input.projectId,
-      jobs: [
-        {
-          id: persisted.run.id,
-          type: "action.run.requested",
-          payload: {
-            runId: persisted.run.id,
-          },
-        },
-      ],
-    })
-    job = jobs[0]
-  } catch (error) {
-    await failActionRunPublication(input, persisted.run, error)
-    throw error
-  }
-
-  await input.events.emit(
-    {
-      events: [
-        {
-          type: "action.requested",
-          payload: {
-            actionId: persisted.run.actionId,
-            subject: persisted.run.subject,
-            params: persisted.run.params,
-            runId: persisted.run.id,
-          },
-        },
-      ],
-      correlationId: persisted.execution.correlationId,
-    },
-    { source: "Sixb" }
-  )
-
-  return {
-    runId: persisted.run.id,
-    queuedAt: persisted.queuedAt.toISOString(),
-    ...(job?.id ? { jobId: job.id } : {}),
-    created: persisted.created,
-  }
-}
-
-async function failActionRunPublication(
-  input: DispatchActionRunInput,
-  run: ActionRunRecord,
-  error: unknown
-): Promise<void> {
-  const failedAt = new Date()
-  const failure = toActionRunFailure(error, run, failedAt)
-  await requireActionRunStorage(input.storage).finish({
-    projectId: input.projectId,
-    id: run.id,
-    status: "failed",
-    finishedAt: failedAt,
-    error: failure,
-  })
-  reportRunFailure(input.errorReporterHost, error, {
-    projectId: input.projectId,
-    runKind: "action",
-    run: { runId: run.id, actionId: run.actionId },
-    failure,
-  })
-}
-
-function requireActionRunStorage(storage: Storage): NonNullable<Storage["actionRuns"]> {
-  if (!storage.actionRuns) {
-    throw new ActionRunError("[Sixb] Action run storage is not configured.")
-  }
-  return storage.actionRuns
-}
-
-function assertExistingRunMatchesRequest(
-  existing: ActionRunRecord,
-  request: Pick<DispatchActionRunInput, "actionId" | "subject" | "params">
-): void {
-  if (
-    existing.actionId !== request.actionId ||
-    !actionSubjectsEqual(existing.subject, request.subject) ||
-    !actionRunParamsEqual(existing.params, request.params)
-  ) {
-    throw new ActionRunError(
-      `[Sixb] Action run '${existing.id}' already exists with a different request payload.`
-    )
-  }
-}
-
-function isRetryableEnqueueFailure(record: ActionRunRecord): boolean {
-  return (
-    record.status === "failed" && record.phase === "enqueue" && record.error?.retryable === true
-  )
-}
-
-function existingActionRunResult(existing: ActionRunRecord): RequestActionResult {
-  return {
-    runId: existing.id,
-    queuedAt: existing.queuedAt.toISOString(),
-    created: false,
-  }
-}
-
-function toActionRunFailure(
-  error: unknown,
-  run: ActionRunRecord,
-  at: Date
-): ActionRunFailure<"enqueue"> {
-  const enqueueError = createSixbError(
-    "queue.enqueue_failed",
-    `[Sixb] Could not enqueue Action run '${run.id}'.`,
-    {
-      cause: error,
-      details: { actionId: run.actionId, runId: run.id, phase: "enqueue" },
-    }
-  )
-  return parseActionRunFailure(
-    toSixbFailure(enqueueError, {
-      allowedCodes: ACTION_RUN_FAILURE_CODES,
-      at,
-    }),
-    "enqueue"
-  )
-}

package/src/actions/worker.ts

@@ -1,2 +0,0 @@
-export type { RecordEditsHandler, RecordEditsOptions } from "../edits/recorder"
-export { recordEdits } from "../edits/recorder"

package/src/auth/audience.ts

@@ -1,28 +0,0 @@
-import { AuthRuntimeError } from "./errors"
-
-export const DEFAULT_AUTH_SESSION_AUDIENCE = "atlas"
-
-export type AuthSessionAudience = typeof DEFAULT_AUTH_SESSION_AUDIENCE | "app"
-
-export interface AuthSessionAudienceOptions {
-  readonly audience?: AuthSessionAudience
-}
-
-export function isValidAuthSessionAudience(value: string): value is AuthSessionAudience {
-  return value === "atlas" || value === "app"
-}
-
-export function resolveAuthSessionAudience(
-  value: AuthSessionAudience | undefined
-): AuthSessionAudience {
-  const audience = value ?? DEFAULT_AUTH_SESSION_AUDIENCE
-
-  if (!isValidAuthSessionAudience(audience)) {
-    throw new AuthRuntimeError(
-      "invalid_auth_config",
-      `[Sixb] Auth session audience '${audience}' is invalid. Expected 'atlas' or 'app'.`
-    )
-  }
-
-  return audience
-}

package/src/authorization/application-access.ts

@@ -1,34 +0,0 @@
-import type { AuthSessionAudience } from "../auth/audience"
-import { isAllowed } from "./decision"
-import type { AuthorizationContext, ResolvedRole } from "./types"
-
-/** Whether declaring roles has enabled an allowlist for an application. */
-export function isApplicationAccessControlled(
-  roles: readonly ResolvedRole[],
-  audience: AuthSessionAudience
-): boolean {
-  return roles.some((role) => role.grants["access:application"].has(audience))
-}
-
-/**
- * Whether this principal may open this application.
- *
- * KNOWN LIMITATION (0.1.x): application access is the one capability that is **not** deny-by-default.
- * While no role mentions an application, every authenticated principal may open it; the allowlist only
- * switches on once some role grants it. Every other capability — `view`, `apply`, `run`, `observe` —
- * denies unless granted, so this is the single asymmetry in the model.
- *
- * It is deliberate for now: flipping it would lock every project out of Atlas until it declares a role,
- * including projects with no security definitions at all. Closing it means shipping a default grant with
- * the scaffold first, and it is a breaking change for any project relying on the open default.
- */
-export function canAccessApplication(
-  authorization: AuthorizationContext,
-  roles: readonly ResolvedRole[],
-  audience: AuthSessionAudience
-): boolean {
-  return (
-    !isApplicationAccessControlled(roles, audience) ||
-    isAllowed(authorization, { kind: "application.access", audience })
-  )
-}

package/src/events/types/actions.ts

@@ -1,42 +0,0 @@
-import type { ActionSubject } from "../../actions"
-import type { ActionRunFailure } from "../../storage"
-import type { EventEnvelope } from "../envelope"
-
-export interface ActionRequestedEvent extends EventEnvelope {
-  type: "action.requested"
-  topic: "actions"
-  partitionKey: string
-  payload: {
-    actionId: string
-    subject: ActionSubject
-    params: Record<string, unknown>
-    runId: string
-  }
-}
-
-export interface ActionCompletedEvent extends EventEnvelope {
-  type: "action.completed"
-  topic: "actions"
-  partitionKey: string
-  payload: {
-    actionId: string
-    runId: string
-    subject: ActionSubject
-    finishedAt: string
-  }
-}
-
-export interface ActionFailedEvent extends EventEnvelope {
-  type: "action.failed"
-  topic: "actions"
-  partitionKey: string
-  payload: {
-    actionId: string
-    runId: string
-    subject: ActionSubject
-    error: ActionRunFailure
-    finishedAt: string
-  }
-}
-
-export type ActionEvent = ActionRequestedEvent | ActionCompletedEvent | ActionFailedEvent

package/src/objects/service/action-service.ts

@@ -1,43 +0,0 @@
-/**
- * Service layer for action operations.
- *
- * Resolves objectTypeId to a typed context and delegates to the leaf function.
- */
-
-import type { RequestActionResult } from "../../actions/request"
-import type { ExecutionContext } from "../../execution"
-import type { SixbRuntimeContext } from "../../runtime/types"
-import type { ActionRunRecord } from "../../storage"
-import {
-  type RequestActionAndWaitOptions,
-  type RequestActionOptions,
-  requestActionAndWait as requestActionAndWaitLeaf,
-  requestAction as requestActionLeaf,
-} from "../action"
-import { resolveObjectContext } from "../context"
-
-export async function requestAction(
-  runtime: SixbRuntimeContext,
-  execution: ExecutionContext,
-  objectTypeId: string,
-  primaryId: string,
-  actionId: string,
-  params?: Record<string, unknown>,
-  options?: RequestActionOptions
-): Promise<RequestActionResult> {
-  const ctx = { ...resolveObjectContext(runtime, objectTypeId), execution }
-  return requestActionLeaf(ctx, { primaryId, actionId, params, options })
-}
-
-export async function requestActionAndWait(
-  runtime: SixbRuntimeContext,
-  execution: ExecutionContext,
-  objectTypeId: string,
-  primaryId: string,
-  actionId: string,
-  params?: Record<string, unknown>,
-  options?: RequestActionAndWaitOptions
-): Promise<ActionRunRecord> {
-  const ctx = { ...resolveObjectContext(runtime, objectTypeId), execution }
-  return requestActionAndWaitLeaf(ctx, { primaryId, actionId, params, options })
-}

package/src/security/applications.ts

@@ -1,11 +0,0 @@
-import type { ApplicationDefinition } from "./types"
-
-/** Browser applications that can be protected by role grants. */
-export const applications = {
-  atlas: { kind: "application", id: "atlas", label: "Atlas" },
-  app: { kind: "application", id: "app", label: "Custom app" },
-} as const satisfies Readonly<Record<string, ApplicationDefinition>>
-
-export const APPLICATION_IDS: ReadonlySet<string> = new Set(
-  Object.values(applications).map((application) => application.id)
-)