@sixb/core 0.1.19 → 0.1.21

package/src/security/validation.ts

@@ -1,4 +1,9 @@
-import { GRANT_KINDS, type GrantUniverseKey, grantKindOf } from "../authorization/grant-kinds"
+import {
+  GRANT_KINDS,
+  type GrantUniverseKey,
+  grantKindOf,
+  isSingletonGrantKind,
+} from "../authorization/grant-kinds"
 import { SecurityValidationError } from "./errors"
 import { isMembershipOperation } from "./membership-policies"
 import type {
@@ -22,11 +27,10 @@ type RegisteredUniverses = Partial<Record<GrantUniverseKey, ReadonlySet<string>>
  *
  * Written as a total `Record<GrantCapability, true>` rather than a bare array so a capability added
  * to `GrantDefinition` is a compile error here — the same discipline `GRANT_KINDS` uses. The
- * hand-written `capability !== "access" && …` chain this replaces would have accepted the new
+ * hand-written `capability !== "view" && …` chain this replaces would have accepted the new
  * capability at startup and then died on `GRANT_KINDS[kind].universeKey`.
  */
 const GRANT_CAPABILITIES = Object.keys({
-  access: true,
   view: true,
   edit: true,
   append: true,
@@ -102,7 +106,7 @@ function assertMembershipOperationArray(
   for (const item of value) {
     if (!isMembershipOperation(item)) {
       throw createError(
-        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend.`
+        `[Sixb] ${field} must contain only membership operations: invite, assignGroups, suspend, serviceAccounts.`
       )
     }
   }
@@ -231,10 +235,6 @@ export function assertGrantDefinition(
     )
   }
 
-  if (value.capability === "access" && value.target !== "application") {
-    throw createError(`[Sixb] ${field} access grant target must be 'application'.`)
-  }
-
   if (value.capability === "view" && value.target !== "object" && value.target !== "dataset") {
     throw createError(`[Sixb] ${field} view grant target must be 'object' or 'dataset'.`)
   }
@@ -251,17 +251,28 @@ export function assertGrantDefinition(
     )
   }
 
-  if (value.capability === "observe" && value.target !== "logs" && value.target !== "aiUsage") {
-    throw createError(`[Sixb] ${field} observe grant target must be 'logs' or 'aiUsage'.`)
+  if (
+    value.capability === "observe" &&
+    value.target !== "logs" &&
+    value.target !== "aiUsage" &&
+    value.target !== "activity"
+  ) {
+    throw createError(
+      `[Sixb] ${field} observe grant target must be 'logs', 'aiUsage', or 'activity'.`
+    )
   }
 
   if (value.capability === "manage" && value.target !== "connector" && value.target !== "aiUsage") {
     throw createError(`[Sixb] ${field} manage grant target must be 'connector' or 'aiUsage'.`)
   }
 
-  if (value.capability === "run" && value.target === "agent") {
+  // The agent, logs, AI usage and activity are one surface each, so their grants select nothing.
+  // The checks above settled the capability and target, so the kind is known.
+  if (isSingletonGrantKind(grantKindOf(value as unknown as GrantDefinition))) {
     if (value.selection !== undefined) {
-      throw createError(`[Sixb] ${field} agent run grant must not declare a selection.`)
+      throw createError(
+        `[Sixb] ${field} ${value.capability} grant on '${value.target}' must not declare a selection.`
+      )
     }
     return
   }
@@ -332,8 +343,6 @@ export function validateSecurityDefinitionsAtStartup(input: {
   readonly groups: readonly GroupDefinition[]
   readonly membershipPolicies: readonly MembershipPolicyDefinition[]
   readonly roles?: readonly RoleDefinition[]
-  /** Registered browser application ids — when provided, access grants must reference them. */
-  readonly applicationIds?: ReadonlySet<string>
   /** Registered object type ids — when provided, view grants must reference them. */
   readonly objectTypeIds?: ReadonlySet<string>
   /** Registered dataset ids — when provided, dataset view grants must reference them. */
@@ -348,10 +357,6 @@ export function validateSecurityDefinitionsAtStartup(input: {
   readonly pipelineIds?: ReadonlySet<string>
   /** Whether the project's single conversational Agent is configured. */
   readonly agentAvailable?: boolean
-  /** Registered observability surfaces. */
-  readonly observableIds?: ReadonlySet<string>
-  /** Registered singleton management surfaces. */
-  readonly manageableIds?: ReadonlySet<string>
   /** Registered connector ids — when provided, manage grants must reference them. */
   readonly connectorIds?: ReadonlySet<string>
   /** Registered Share ids — when provided, share grants must reference them. */
@@ -496,7 +501,11 @@ function assertGrantReferences(
     }
     return
   }
-  const spec = GRANT_KINDS[grantKindOf(grant)]
+  // Logs and AI usage are always there; only targeted grants name ids to check.
+  if (!("selection" in grant)) return
+  const kind = grantKindOf(grant)
+  if (isSingletonGrantKind(kind)) return
+  const spec = GRANT_KINDS[kind]
   const universe = registered[spec.universeKey]
 
   if (!universe) {

package/src/storage/action-runs/in-memory.ts

@@ -109,6 +109,24 @@ export class InMemoryActionRunStorage implements ActionRunStorage {
     })
   }
 
+  async getByExecutionIds(params: {
+    readonly projectId: string
+    readonly executionIds: readonly string[]
+  }): Promise<readonly ActionRunRecord[]> {
+    return this.runRootOperation(() => {
+      const byExecution = new Map(
+        [...this.rows.values()]
+          .filter((record) => record.projectId === params.projectId)
+          .map((record) => [record.executionId, record])
+      )
+
+      return [...new Set(params.executionIds)].flatMap((executionId) => {
+        const record = byExecution.get(executionId)
+        return record ? [cloneActionRunRecord(record)] : []
+      })
+    })
+  }
+
   async list(input: ListActionRunsInput): Promise<ListActionRunsResult> {
     return this.runRootOperation(() => {
       if (input.actionIds?.length === 0) {

package/src/storage/action-runs/types.ts

@@ -144,6 +144,14 @@ export interface ActionRunStorage {
    */
   recordEffects(input: RecordActionEffectsInput): Promise<ActionRunRecord>
   getById(params: { projectId: string; id: string }): Promise<ActionRunRecord | null>
+  /**
+   * The runs these executions recorded, in first-occurrence input order. An execution whose run
+   * is in flight, or was interrupted, has none.
+   */
+  getByExecutionIds(params: {
+    readonly projectId: string
+    readonly executionIds: readonly string[]
+  }): Promise<readonly ActionRunRecord[]>
   /** Runs ordered by `startedAt`, then id. */
   list(input: ListActionRunsInput): Promise<ListActionRunsResult>
 }

package/src/storage/activity/in-memory.ts

@@ -0,0 +1,374 @@
+import {
+  ACTIVITY_MAX_VISIT_MS,
+  type ActivitySourceState,
+  activityCalendarDays,
+  activityDay,
+  type PlannedActivityPageView,
+  planActivityAppend,
+  validateActivityAppend,
+} from "./policy"
+import type {
+  ActivityActor,
+  ActivityAttribution,
+  ActivityCalendarInput,
+  ActivityCursor,
+  ActivityDay,
+  ActivityInteraction,
+  ActivityPageView,
+  ActivityPeriodInput,
+  ActivitySessionVisits,
+  ActivityStorage,
+  ActivitySummary,
+  ActivityUsersPage,
+  ActivityVisit,
+  ActivityVisitsPage,
+  AppendActivityInput,
+  AppendActivityResult,
+  ListActivitySessionVisitsInput,
+  ListActivityUsersInput,
+  ListActivityVisitsInput,
+  ReadActivityVisitInput,
+  StoredActivityVisitPage,
+} from "./types"
+
+interface StoredVisit {
+  readonly projectId: string
+  readonly id: string
+  readonly actor: ActivityActor
+  readonly sessionId: string
+  readonly attribution: ActivityAttribution | null
+  readonly startedAt: Date
+  lastSeenAt: Date
+  pageViews: number
+  interactions: number
+}
+
+interface StoredPageView extends PlannedActivityPageView {
+  readonly projectId: string
+}
+
+interface StoredInteraction extends ActivityInteraction {
+  readonly projectId: string
+}
+
+/** A source as stored: the start of its visit is read from the visit, which may be gone. */
+type StoredSource = Omit<ActivitySourceState, "visitStartedAt">
+
+interface InMemoryActivitySnapshot {
+  readonly sources: Map<string, StoredSource>
+  readonly visits: Map<string, StoredVisit>
+  readonly pageViews: StoredPageView[]
+  readonly interactions: StoredInteraction[]
+}
+
+/** Activity for tests and local development. Each append runs without yielding, so it is atomic. */
+export class InMemoryActivityStorage implements ActivityStorage {
+  private sources = new Map<string, StoredSource>()
+  private visits = new Map<string, StoredVisit>()
+  private pageViews: StoredPageView[] = []
+  private interactions: StoredInteraction[] = []
+
+  async append(input: AppendActivityInput): Promise<AppendActivityResult> {
+    validateActivityAppend(input)
+
+    const sourceKey = JSON.stringify([input.projectId, input.actor.type, input.sessionId])
+    const stored = [...this.pageViews, ...this.interactions].filter(
+      (event) =>
+        event.projectId === input.projectId &&
+        this.isFromSession(event, input) &&
+        input.events.some((candidate) => candidate.id === event.id)
+    )
+
+    const plan = planActivityAppend(input, this.source(sourceKey, input.projectId), stored)
+    if (plan.status !== "append") {
+      return { status: plan.status === "duplicate" ? "accepted" : "throttled", accepted: 0 }
+    }
+
+    const visitKey = JSON.stringify([input.projectId, plan.state.visitId])
+    const lastSeenAt = new Date(plan.state.lastSeenAt)
+
+    if (plan.newVisit) {
+      if (this.visits.has(visitKey)) {
+        throw new Error("[Sixb] Activity visit id already exists.")
+      }
+
+      this.visits.set(visitKey, {
+        projectId: input.projectId,
+        id: plan.state.visitId,
+        actor: structuredClone(input.actor),
+        sessionId: input.sessionId,
+        attribution: plan.newVisit.attribution,
+        startedAt: lastSeenAt,
+        lastSeenAt,
+        pageViews: plan.pageViews.length,
+        interactions: plan.interactions.length,
+      })
+    } else {
+      const visit = this.requireVisit(input.projectId, plan.state.visitId)
+      visit.lastSeenAt = lastSeenAt
+      visit.pageViews += plan.pageViews.length
+      visit.interactions += plan.interactions.length
+    }
+
+    const { visitStartedAt: _startedAt, ...source } = plan.state
+    this.sources.set(sourceKey, source)
+    for (const pageView of plan.pageViews) {
+      this.pageViews.push({ ...pageView, projectId: input.projectId })
+    }
+    for (const interaction of plan.interactions) {
+      this.interactions.push({ ...interaction, projectId: input.projectId })
+    }
+
+    return { status: "accepted", accepted: plan.accepted }
+  }
+
+  async list(input: ListActivityVisitsInput): Promise<ActivityVisitsPage> {
+    const visits = this.overlapping(input)
+      .filter((visit) => isBefore(visit.lastSeenAt, visit.id, input.before))
+      .sort(byLastSeenDescending((visit) => visit.id))
+
+    return {
+      visits: visits.slice(0, input.limit).map(toVisit),
+      hasMore: visits.length > input.limit,
+    }
+  }
+
+  async users(input: ListActivityUsersInput): Promise<ActivityUsersPage> {
+    const byUser = new Map<string, { lastSeenAt: Date; visits: number; pageViews: number }>()
+
+    for (const visit of this.overlapping(input)) {
+      if (visit.actor.type !== "user") {
+        continue
+      }
+
+      const user = byUser.get(visit.actor.userId) ?? {
+        lastSeenAt: visit.lastSeenAt,
+        visits: 0,
+        pageViews: 0,
+      }
+      if (visit.lastSeenAt > user.lastSeenAt) {
+        user.lastSeenAt = visit.lastSeenAt
+      }
+      user.visits += 1
+      user.pageViews += this.pageViewsInPeriod(visit, input).length
+      byUser.set(visit.actor.userId, user)
+    }
+
+    const users = [...byUser]
+      .map(([userId, user]) => ({ userId, ...user }))
+      .filter((user) => isBefore(user.lastSeenAt, user.userId, input.before))
+      .sort(byLastSeenDescending((user) => user.userId))
+
+    return {
+      users: users.slice(0, input.limit).map((user) => ({ ...user })),
+      hasMore: users.length > input.limit,
+    }
+  }
+
+  async summarize(input: ActivityPeriodInput): Promise<ActivitySummary> {
+    const visits = this.overlapping(input)
+    const userIds = visits.flatMap((visit) =>
+      visit.actor.type === "user" ? [visit.actor.userId] : []
+    )
+
+    return {
+      users: new Set(userIds).size,
+      visits: visits.length,
+      sharedVisits: visits.filter((visit) => visit.actor.type === "share").length,
+      pageViews: visits.reduce(
+        (total, visit) => total + this.pageViewsInPeriod(visit, input).length,
+        0
+      ),
+    }
+  }
+
+  async calendar(input: ActivityCalendarInput): Promise<readonly ActivityDay[]> {
+    const visits = this.overlapping(input)
+
+    const pageViewsByDay = new Map<string, number>()
+    for (const visit of visits) {
+      for (const pageView of this.pageViewsInPeriod(visit, input)) {
+        const day = activityDay(pageView.receivedAt)
+        pageViewsByDay.set(day, (pageViewsByDay.get(day) ?? 0) + 1)
+      }
+    }
+
+    return activityCalendarDays(input, visits, pageViewsByDay)
+  }
+
+  async read(input: ReadActivityVisitInput): Promise<StoredActivityVisitPage | null> {
+    const visit = this.visits.get(JSON.stringify([input.projectId, input.id]))
+    if (!visit) {
+      return null
+    }
+
+    const ofVisit = (event: StoredPageView | StoredInteraction) =>
+      event.projectId === visit.projectId && event.visitId === visit.id
+
+    const events = [...this.pageViews.filter(ofVisit), ...this.interactions.filter(ofVisit)].sort(
+      (left, right) => left.sequence - right.sequence
+    )
+
+    const pageViews: ActivityPageView[] = []
+    const interactions: ActivityInteraction[] = []
+    for (const event of events.slice(0, input.limit)) {
+      const { id, visitId, sequence, route } = event
+      const pageView = { id, visitId, sequence, route, receivedAt: new Date(event.receivedAt) }
+
+      if ("name" in event) {
+        interactions.push({ ...pageView, name: event.name })
+      } else {
+        pageViews.push(pageView)
+      }
+    }
+
+    return {
+      visit: toVisit(visit),
+      sessionId: visit.sessionId,
+      pageViews,
+      interactions,
+      hasMore: events.length > input.limit,
+    }
+  }
+
+  async sessionVisits(
+    input: ListActivitySessionVisitsInput
+  ): Promise<readonly ActivitySessionVisits[]> {
+    const sessionIds = new Set(input.sessionIds)
+    const bySession = new Map<string, StoredVisit[]>()
+
+    for (const visit of this.visits.values()) {
+      if (
+        visit.projectId !== input.projectId ||
+        visit.actor.type !== "user" ||
+        visit.actor.userId !== input.userId ||
+        !sessionIds.has(visit.sessionId)
+      ) {
+        continue
+      }
+
+      const visits = bySession.get(visit.sessionId) ?? []
+      visits.push(visit)
+      bySession.set(visit.sessionId, visits)
+    }
+
+    return [...bySession].map(([sessionId, visits]) => ({
+      sessionId,
+      visits: visits.length,
+      latest: visits.sort(byStartDescending).slice(0, input.limit).map(toVisit),
+    }))
+  }
+
+  snapshot(): InMemoryActivitySnapshot {
+    return structuredClone({
+      sources: this.sources,
+      visits: this.visits,
+      pageViews: this.pageViews,
+      interactions: this.interactions,
+    })
+  }
+
+  restore(snapshot: InMemoryActivitySnapshot): void {
+    const restored = structuredClone(snapshot)
+    this.sources = restored.sources
+    this.visits = restored.visits
+    this.pageViews = restored.pageViews
+    this.interactions = restored.interactions
+  }
+
+  private source(key: string, projectId: string): ActivitySourceState | undefined {
+    const source = this.sources.get(key)
+    if (!source) {
+      return undefined
+    }
+
+    const visit = this.visits.get(JSON.stringify([projectId, source.visitId]))
+    return { ...source, visitStartedAt: visit ? visit.startedAt.getTime() : null }
+  }
+
+  /**
+   * Visits active at some point of `[from, to)`, optionally one account's. A visit lasts less than
+   * a day, so one active in the period started at most a day before it.
+   */
+  private overlapping(input: ActivityPeriodInput): StoredVisit[] {
+    const earliestStart = input.from.getTime() - ACTIVITY_MAX_VISIT_MS
+    return [...this.visits.values()].filter(
+      (visit) =>
+        visit.projectId === input.projectId &&
+        visit.startedAt.getTime() >= earliestStart &&
+        visit.startedAt < input.to &&
+        visit.lastSeenAt >= input.from &&
+        (input.userId === undefined ||
+          (visit.actor.type === "user" && visit.actor.userId === input.userId))
+    )
+  }
+
+  private pageViewsOf(visit: StoredVisit): StoredPageView[] {
+    return this.pageViews.filter(
+      (pageView) => pageView.projectId === visit.projectId && pageView.visitId === visit.id
+    )
+  }
+
+  private pageViewsInPeriod(
+    visit: StoredVisit,
+    period: ActivityPeriodInput | ActivityCalendarInput
+  ) {
+    return this.pageViewsOf(visit).filter(
+      (pageView) => pageView.receivedAt >= period.from && pageView.receivedAt < period.to
+    )
+  }
+
+  private isFromSession(
+    event: StoredPageView | StoredInteraction,
+    input: AppendActivityInput
+  ): boolean {
+    const visit = this.visits.get(JSON.stringify([event.projectId, event.visitId]))
+    return visit?.actor.type === input.actor.type && visit.sessionId === input.sessionId
+  }
+
+  private requireVisit(projectId: string, id: string): StoredVisit {
+    const visit = this.visits.get(JSON.stringify([projectId, id]))
+    if (!visit) {
+      throw new Error("[Sixb] Activity visit is missing.")
+    }
+    return visit
+  }
+}
+
+function toVisit(visit: StoredVisit): ActivityVisit {
+  return {
+    id: visit.id,
+    actor: structuredClone(visit.actor),
+    attribution: structuredClone(visit.attribution),
+    startedAt: new Date(visit.startedAt),
+    lastSeenAt: new Date(visit.lastSeenAt),
+    pageViews: visit.pageViews,
+    interactions: visit.interactions,
+  }
+}
+
+function isBefore(at: Date, id: string, cursor: ActivityCursor | undefined): boolean {
+  if (!cursor) {
+    return true
+  }
+  return at < cursor.at || (at.getTime() === cursor.at.getTime() && id < cursor.id)
+}
+
+function byStartDescending(left: StoredVisit, right: StoredVisit): number {
+  const byTime = right.startedAt.getTime() - left.startedAt.getTime()
+  if (byTime !== 0) {
+    return byTime
+  }
+  return left.id < right.id ? 1 : left.id > right.id ? -1 : 0
+}
+
+/** Newest first, then by descending id compared byte by byte, as the SQL providers sort. */
+function byLastSeenDescending<T extends { readonly lastSeenAt: Date }>(id: (row: T) => string) {
+  return (left: T, right: T) => {
+    const byTime = right.lastSeenAt.getTime() - left.lastSeenAt.getTime()
+    if (byTime !== 0) {
+      return byTime
+    }
+    return id(left) < id(right) ? 1 : id(left) > id(right) ? -1 : 0
+  }
+}

package/src/storage/activity/index.ts

@@ -0,0 +1,27 @@
+export { InMemoryActivityStorage } from "./in-memory"
+export type {
+  ActivityActor,
+  ActivityAttribution,
+  ActivityCalendarInput,
+  ActivityCursor,
+  ActivityDay,
+  ActivityEventInput,
+  ActivityEventType,
+  ActivityInteraction,
+  ActivityPageView,
+  ActivityPeriodInput,
+  ActivitySessionVisits,
+  ActivityStorage,
+  ActivitySummary,
+  ActivityUser,
+  ActivityUsersPage,
+  ActivityVisit,
+  ActivityVisitsPage,
+  AppendActivityInput,
+  AppendActivityResult,
+  ListActivitySessionVisitsInput,
+  ListActivityUsersInput,
+  ListActivityVisitsInput,
+  ReadActivityVisitInput,
+  StoredActivityVisitPage,
+} from "./types"