@sixb/core 0.1.20 → 0.1.22

package/src/authorization/decision.ts

@@ -24,6 +24,7 @@ import type { AuthorizationContext, GrantIndex } from "./types"
 export type AuthzRequest =
   | { readonly kind: "object.view"; readonly objectTypeId: string }
   | { readonly kind: "dataset.view"; readonly datasetId: string }
+  | { readonly kind: "users.view" }
   | { readonly kind: "object.edit"; readonly objectTypeId: string }
   | { readonly kind: "telemetry.append"; readonly objectTypeId: string }
   | { readonly kind: "action.apply"; readonly actionId: string }
@@ -32,9 +33,13 @@ export type AuthzRequest =
   | { readonly kind: "sync.run"; readonly syncId: string }
   | { readonly kind: "pipeline.run"; readonly pipelineId: string }
   | { readonly kind: "agent.run" }
+  | { readonly kind: "models.run" }
   | { readonly kind: "logs.observe" }
   | { readonly kind: "aiUsage.observe" }
+  | { readonly kind: "activity.observe" }
+  | { readonly kind: "agentThreads.observe" }
   | { readonly kind: "aiUsage.manage" }
+  | { readonly kind: "agentMemory.manage" }
   | { readonly kind: "connector.manage"; readonly connectorId: string }
   | { readonly kind: "object.query"; readonly touchedObjectTypeIds: readonly string[] }
 
@@ -66,6 +71,8 @@ function atomsFor(request: AuthzRequest): readonly Atom[] {
       return [{ kind: "view:object", id: request.objectTypeId }]
     case "dataset.view":
       return [{ kind: "view:dataset", id: request.datasetId }]
+    case "users.view":
+      return [{ kind: "view:users" }]
     case "object.edit":
       return [{ kind: "edit:object", id: request.objectTypeId }]
     case "telemetry.append":
@@ -82,12 +89,20 @@ function atomsFor(request: AuthzRequest): readonly Atom[] {
       return [{ kind: "run:pipeline", id: request.pipelineId }]
     case "agent.run":
       return [{ kind: "run:agent" }]
+    case "models.run":
+      return [{ kind: "run:models" }]
     case "logs.observe":
       return [{ kind: "observe:logs" }]
     case "aiUsage.observe":
       return [{ kind: "observe:aiUsage" }]
+    case "activity.observe":
+      return [{ kind: "observe:activity" }]
+    case "agentThreads.observe":
+      return [{ kind: "observe:agentThreads" }]
     case "aiUsage.manage":
       return [{ kind: "manage:aiUsage" }]
+    case "agentMemory.manage":
+      return [{ kind: "manage:agentMemory" }]
     case "connector.manage":
       return [{ kind: "manage:connector", id: request.connectorId }]
     case "object.query":
@@ -248,6 +263,33 @@ export function assertProviderAccess(
   )
 }
 
+/**
+ * Assert a model call is allowed. Trusted code and genuine agent runs always may; a principal
+ * needs `can.run(project.models)`, which covers every model in the catalog.
+ */
+export function assertModelAccess(
+  runtime: AuthorizedRuntime & { readonly runtimeAuthorization: RuntimeAuthorization },
+  execution: ExecutionContext,
+  operation: string
+): void {
+  const resolved = resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization,
+  })
+  if (resolved.type === "unrestricted" || execution.executor.type === "agent") return
+  if (resolved.type === "principal") {
+    if (isAllowed(resolved.context, { kind: "models.run" })) return
+    throw new AuthorizationError(
+      "run:models",
+      deniedMessage(resolved.context, { kind: "models.run" })
+    )
+  }
+  throw new AuthorizationError(
+    `delegated:${operation}`,
+    `[Sixb] Operation '${operation}' is not covered by delegated authorization.`
+  )
+}
+
 function deniedMessage(
   authorization: AuthorizationContext | null | undefined,
   request: AuthzRequest
@@ -258,6 +300,8 @@ function deniedMessage(
       return `[Sixb] Principal '${principalId}' is not allowed to view object type '${request.objectTypeId}'.`
     case "dataset.view":
       return `[Sixb] Principal '${principalId}' is not allowed to view dataset '${request.datasetId}'.`
+    case "users.view":
+      return `[Sixb] Principal '${principalId}' is not allowed to view the member directory.`
     case "object.edit":
       return `[Sixb] Principal '${principalId}' is not allowed to write object type '${request.objectTypeId}'.`
     case "telemetry.append":
@@ -274,12 +318,20 @@ function deniedMessage(
       return `[Sixb] Principal '${principalId}' is not allowed to run pipeline '${request.pipelineId}'.`
     case "agent.run":
       return `[Sixb] Principal '${principalId}' is not allowed to run the project Agent.`
+    case "models.run":
+      return `[Sixb] Principal '${principalId}' is not allowed to call the project's models.`
     case "logs.observe":
       return `[Sixb] Principal '${principalId}' is not allowed to observe project logs.`
     case "aiUsage.observe":
       return `[Sixb] Principal '${principalId}' is not allowed to observe project AI usage.`
+    case "activity.observe":
+      return `[Sixb] Principal '${principalId}' is not allowed to observe project activity.`
+    case "agentThreads.observe":
+      return `[Sixb] Principal '${principalId}' is not allowed to observe other users' Agent conversations.`
     case "aiUsage.manage":
       return `[Sixb] Principal '${principalId}' is not allowed to manage project AI usage limits.`
+    case "agentMemory.manage":
+      return `[Sixb] Principal '${principalId}' is not allowed to manage the project's Agent memory.`
     case "connector.manage":
       return `[Sixb] Principal '${principalId}' is not allowed to manage connector '${request.connectorId}'.`
     case "object.query": {

package/src/authorization/event-visibility.ts

@@ -9,35 +9,36 @@
  * topic we don't yet model may carry a subject the principal is not allowed to
  * see. Adding an event topic therefore requires an explicit visibility decision
  * here, never a silent default.
+ *
+ * A type the principal views only under a condition holds no view grant, so it is hidden here
+ * unless the caller names it in `conditioned`: it then passes, and the caller decides on the
+ * objects the event names.
  */
 
 import type { StoredDomainEvent } from "../events"
 import { isAllowed } from "./decision"
 import type { AuthorizationContext } from "./types"
 
+const NO_CONDITIONS: ReadonlySet<string> = new Set()
+
 export function canViewEvent(
   authorization: AuthorizationContext | null | undefined,
-  event: StoredDomainEvent
+  event: StoredDomainEvent,
+  conditioned: Pick<ReadonlySet<string>, "has"> = NO_CONDITIONS
 ): boolean {
   if (!authorization) {
     return true
   }
 
+  const viewsObjects = (objectTypeId: string) =>
+    conditioned.has(objectTypeId) || isAllowed(authorization, { kind: "object.view", objectTypeId })
+
   switch (event.topic) {
     case "objects":
     case "telemetry":
-      return isAllowed(authorization, {
-        kind: "object.view",
-        objectTypeId: event.payload.objectTypeId,
-      })
+      return viewsObjects(event.payload.objectTypeId)
     case "links":
-      return (
-        isAllowed(authorization, {
-          kind: "object.view",
-          objectTypeId: event.payload.sourceTypeId,
-        }) &&
-        isAllowed(authorization, { kind: "object.view", objectTypeId: event.payload.targetTypeId })
-      )
+      return viewsObjects(event.payload.sourceTypeId) && viewsObjects(event.payload.targetTypeId)
     case "workflows":
       return isAllowed(authorization, {
         kind: "workflow.run",
@@ -46,10 +47,7 @@ export function canViewEvent(
     case "rules":
       // Rule events carry the object they fired on, so gate on viewing it —
       // otherwise they leak the existence and id of hidden-type objects.
-      return isAllowed(authorization, {
-        kind: "object.view",
-        objectTypeId: event.payload.subject.objectTypeId,
-      })
+      return viewsObjects(event.payload.subject.objectTypeId)
     // Run grant gates the operational stream. These payloads may also carry the
     // produced datasetId/versionId; that target is already visible to a runner
     // through the sync/pipeline catalog (`sync.target.dataset`), so surfacing it
@@ -80,6 +78,9 @@ export function canViewEvent(
         kind: "dataset.view",
         datasetId: event.payload.datasetId,
       })
+    case "users":
+      // Member events carry profiles and invitee emails: the member directory's grant.
+      return isAllowed(authorization, { kind: "users.view" })
     default:
       // Fail closed: an unmodeled topic may carry a subject we don't yet gate.
       return false

package/src/authorization/grant-kinds.ts

@@ -13,6 +13,7 @@ import type { GrantDefinition } from "../security/types"
 export type GrantKind =
   | "view:object"
   | "view:dataset"
+  | "view:users"
   | "edit:object"
   | "append:telemetry"
   | "apply:action"
@@ -21,13 +22,26 @@ export type GrantKind =
   | "run:sync"
   | "run:pipeline"
   | "run:agent"
+  | "run:models"
   | "observe:logs"
   | "observe:aiUsage"
+  | "observe:activity"
+  | "observe:agentThreads"
   | "manage:connector"
   | "manage:aiUsage"
+  | "manage:agentMemory"
 
 /** Capabilities over one project-wide surface: held or not, with no ids to select. */
-export type SingletonGrantKind = "run:agent" | "observe:logs" | "observe:aiUsage" | "manage:aiUsage"
+export type SingletonGrantKind =
+  | "view:users"
+  | "run:agent"
+  | "run:models"
+  | "observe:logs"
+  | "observe:aiUsage"
+  | "observe:activity"
+  | "observe:agentThreads"
+  | "manage:aiUsage"
+  | "manage:agentMemory"
 export type TargetedGrantKind = Exclude<GrantKind, SingletonGrantKind>
 
 /** Registered id universes a grant kind ranges over, plus subtype expansion. */
@@ -84,6 +98,11 @@ export const GRANT_KINDS: {
     subject: "dataset",
     fix: "Add it to 'datasets/' or pass it to createSixb({ datasets }).",
   },
+  "view:users": {
+    singleton: true,
+    subject: "member directory",
+    fix: "Use can.view(project.users).",
+  },
   // Deliberately no `expandsSubtypes`: granting writes on a parent type must not
   // silently extend to types added under it later. `view:object` expands because
   // a read of a subtype reveals nothing the parent's grant did not already cover.
@@ -127,16 +146,31 @@ export const GRANT_KINDS: {
     subject: "agent",
     fix: "Configure models.language and use the exported agent reference in can.run(agent).",
   },
+  "run:models": {
+    singleton: true,
+    subject: "models",
+    fix: "Use can.run(project.models).",
+  },
   "observe:logs": {
     singleton: true,
     subject: "logs",
-    fix: 'Use can.observe("logs").',
+    fix: "Use can.observe(project.logs).",
   },
   "observe:aiUsage": {
     singleton: true,
     subject: "AI usage",
     fix: "Use can.observe(agent.usage).",
   },
+  "observe:activity": {
+    singleton: true,
+    subject: "activity",
+    fix: "Use can.observe(project.activity).",
+  },
+  "observe:agentThreads": {
+    singleton: true,
+    subject: "Agent conversations",
+    fix: "Use can.observe(agent.threads).",
+  },
   "manage:connector": {
     universeKey: "connectorIds",
     subject: "connector",
@@ -147,6 +181,11 @@ export const GRANT_KINDS: {
     subject: "AI usage",
     fix: "Use can.manage(agent.usage).",
   },
+  "manage:agentMemory": {
+    singleton: true,
+    subject: "Agent memory",
+    fix: "Use can.manage(agent.memory).",
+  },
 }
 
 export const GRANT_KIND_KEYS = Object.keys(GRANT_KINDS) as readonly GrantKind[]
@@ -192,6 +231,7 @@ export function emptyGrantSets(): MutableGrantIndex {
   return {
     "view:object": new Set(),
     "view:dataset": new Set(),
+    "view:users": false,
     "edit:object": new Set(),
     "append:telemetry": new Set(),
     "apply:action": new Set(),
@@ -200,9 +240,13 @@ export function emptyGrantSets(): MutableGrantIndex {
     "run:sync": new Set(),
     "run:pipeline": new Set(),
     "run:agent": false,
+    "run:models": false,
     "observe:logs": false,
     "observe:aiUsage": false,
+    "observe:activity": false,
+    "observe:agentThreads": false,
     "manage:connector": new Set(),
     "manage:aiUsage": false,
+    "manage:agentMemory": false,
   }
 }

package/src/authorization/index.ts

@@ -4,6 +4,7 @@ export {
   assertCanAppendTelemetry,
   assertCanEdit,
   assertCanManageConnector,
+  assertModelAccess,
   assertPrivileged,
   assertProviderAccess,
   assertRuntimeAuthorizationBound,
@@ -14,7 +15,11 @@ export {
 export { AuthorizationError } from "./errors"
 export { canViewEvent } from "./event-visibility"
 export type { GrantKind, GrantUniverse } from "./grant-kinds"
-export { resolveAuthorizationContext, resolveRoleGrants } from "./resolve"
+export {
+  resolveAuthorizationContext,
+  resolveRoleGrants,
+  resolveRoleViewConditions,
+} from "./resolve"
 export {
   canViewActionRun,
   canViewPipelineRun,

package/src/authorization/resolve.ts

@@ -1,4 +1,5 @@
 import type { Principal } from "../auth/types"
+import type { ObjectQueryPredicate } from "../objects/query/ir"
 import type { RoleDefinition, Selection } from "../security"
 import {
   emptyGrantSets,
@@ -16,14 +17,19 @@ import type { AuthorizationContext, GrantIndex, ResolvedRole } from "./types"
  *
  * Broad grants (`every.object().except([...])`) expand against the registered
  * universe; object-type grants also expand to subtypes. Resource grants become
- * id sets; grants on one project-wide surface (the Agent, logs, AI usage) become booleans.
+ * id sets; grants on one project-wide surface (the member directory, the Agent, logs, AI usage)
+ * become booleans.
  * The per-kind universe and subtype rules come from the `GRANT_KINDS` table, so
  * this loop never enumerates targets by hand.
+ *
+ * A view grant with a condition grants no type here: see {@link resolveRoleViewConditions}.
  */
 export function resolveRoleGrants(role: RoleDefinition, universe: GrantUniverse): GrantIndex {
   const grants = emptyGrantSets()
 
   for (const grant of role.grants) {
+    if ("condition" in grant && grant.condition !== undefined) continue
+
     const kind = grantKindOf(grant)
     if (isSingletonGrantKind(kind)) {
       grants[kind] = true
@@ -43,6 +49,45 @@ export function resolveRoleGrants(role: RoleDefinition, universe: GrantUniverse)
   return grants
 }
 
+/**
+ * Resolve a role's conditional view grants once at startup, from their validated conditions.
+ *
+ * A condition applies to the type its grant names and to each subtype, as a view grant does.
+ * Several conditions on one type combine with `or`, and a type the role also views without a
+ * condition drops them: the role shows every object of it.
+ */
+export function resolveRoleViewConditions(
+  conditions: readonly {
+    readonly objectTypeId: string
+    readonly predicate: ObjectQueryPredicate
+  }[],
+  grants: GrantIndex,
+  universe: GrantUniverse
+): ReadonlyMap<string, ObjectQueryPredicate> {
+  const byType = new Map<string, ObjectQueryPredicate[]>()
+
+  for (const condition of conditions) {
+    const objectTypeIds = [condition.objectTypeId, ...universe.getSubTypes(condition.objectTypeId)]
+
+    for (const objectTypeId of objectTypeIds) {
+      if (grants["view:object"].has(objectTypeId)) continue
+
+      const predicates = byType.get(objectTypeId) ?? []
+      predicates.push(condition.predicate)
+      byType.set(objectTypeId, predicates)
+    }
+  }
+
+  return new Map(
+    [...byType].map(([objectTypeId, predicates]) => [objectTypeId, anyOf(predicates)] as const)
+  )
+}
+
+function anyOf(predicates: readonly ObjectQueryPredicate[]): ObjectQueryPredicate {
+  if (predicates.length === 1) return predicates[0]!
+  return Object.freeze({ op: "or", items: Object.freeze([...predicates]) })
+}
+
 function expandSelection(
   selection: Selection,
   universe: ReadonlySet<string>,
@@ -75,6 +120,9 @@ function expandSelection(
  * Pure set-union over pre-resolved roles: roles match when their grantedTo
  * groups intersect the principal's memberships, and their concrete id sets
  * and clearances union into the principal's context.
+ *
+ * View conditions union too: the principal sees an object any of them matches. A type one role
+ * views without a condition is viewed whole, whatever conditions the others put on it.
  */
 export function resolveAuthorizationContext(input: {
   readonly principal: Principal
@@ -86,6 +134,7 @@ export function resolveAuthorizationContext(input: {
   const roleIds: string[] = []
   const grants = emptyGrantSets()
   const clearances = new Set<string>()
+  const viewConditions = new Map<string, ObjectQueryPredicate[]>()
 
   for (const role of input.roles) {
     if (!role.grantedToGroupIds.some((groupId) => memberGroupIds.has(groupId))) {
@@ -104,6 +153,13 @@ export function resolveAuthorizationContext(input: {
     for (const markingId of role.clearances ?? []) {
       clearances.add(markingId)
     }
+    for (const [objectTypeId, predicate] of role.viewConditions ?? []) {
+      viewConditions.set(objectTypeId, [...(viewConditions.get(objectTypeId) ?? []), predicate])
+    }
+  }
+
+  for (const objectTypeId of grants["view:object"]) {
+    viewConditions.delete(objectTypeId)
   }
 
   return {
@@ -112,6 +168,7 @@ export function resolveAuthorizationContext(input: {
     groupIds: input.groupIds,
     roleIds,
     grants,
+    ...(viewConditions.size > 0 ? { viewConditions } : {}),
     clearances,
   }
 }

package/src/authorization/run-visibility.ts

@@ -7,6 +7,10 @@ import type { WorkflowRunRecord } from "../storage/workflow-runs"
 import { isAllowed } from "./decision"
 import type { AuthorizationContext } from "./types"
 
+/**
+ * Whether a principal may view a run, by its action and its subject's type. A type the principal
+ * views only through a condition fails here: the subject decides, which `viewableActionRuns` reads.
+ */
 export function canViewActionRun(
   authorization: AuthorizationContext | null | undefined,
   run: Pick<ActionRunRecord, "actionId" | "subject">
@@ -55,7 +59,10 @@ export function canViewPipelineRun(
   )
 }
 
-/** A projection run is viewable when its target object type(s) are viewable. */
+/**
+ * A projection run is viewable when its target object type(s) are viewable. A run, like its
+ * definition, describes every object of the type, so a type viewed through a condition stays closed.
+ */
 export function canViewProjectionRun(
   authorization: AuthorizationContext | null | undefined,
   target: ProjectionTarget

package/src/authorization/types.ts

@@ -8,6 +8,7 @@
  */
 
 import type { Principal } from "../auth/types"
+import type { ObjectQueryPredicate } from "../objects/query/ir"
 import { emptyGrantSets, type GrantKind, type SingletonGrantKind } from "./grant-kinds"
 
 /**
@@ -42,6 +43,12 @@ export interface ResolvedRole {
   readonly id: string
   readonly grantedToGroupIds: readonly string[]
   readonly grants: GrantIndex
+  /**
+   * What the role's `can.view(Type).where(...)` grants show, per concrete type: the type's
+   * conditions, combined with `or`. A type the role also views without a condition is in
+   * `grants["view:object"]` and not here. Absent means none.
+   */
+  readonly viewConditions?: ReadonlyMap<string, ObjectQueryPredicate>
   /** Marking ids this role clears. Absent means none. */
   readonly clearances?: ReadonlySet<string>
 }
@@ -53,6 +60,13 @@ export interface AuthorizationContext {
   /** Roles whose grantedTo groups intersect the principal's memberships. */
   readonly roleIds: readonly string[]
   readonly grants: GrantIndex
+  /**
+   * The object types the principal views only where a condition matches, with one condition per
+   * role that grants it. A type in `grants["view:object"]` is never here, so a check on that grant
+   * denies these types; only the authorized object reader reads them, through these conditions.
+   * Absent means none.
+   */
+  readonly viewConditions?: ReadonlyMap<string, readonly ObjectQueryPredicate[]>
   /**
    * Marking ids the principal may read, unioned from its roles. Absent means none: a context built
    * without clearances reads no marked property.

package/src/blob-storage/internal.ts

@@ -5,4 +5,4 @@ export {
   resolveFileRefAtPath,
   statFileRef,
 } from "./file-content"
-export { canonicalMediaType } from "./media-type"
+export { canonicalMediaType, inferFileMediaType, sniffFileMediaType } from "./media-type"

package/src/blob-storage/media-type.ts

@@ -27,3 +27,72 @@ export function canonicalMediaType(value: unknown): string | null {
   }
   return canonical
 }
+
+/**
+ * The media type a file's bytes declare by their leading signature, or `undefined` when they carry
+ * none this function knows. Only formats with an unambiguous signature are recognized; text formats
+ * have none and are left to the file name.
+ */
+export function sniffFileMediaType(bytes: Uint8Array): string | undefined {
+  if (startsWith(bytes, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])) return "image/png"
+  if (startsWith(bytes, [0xff, 0xd8, 0xff])) return "image/jpeg"
+  if (asciiAt(bytes, 0, "GIF87a") || asciiAt(bytes, 0, "GIF89a")) return "image/gif"
+  if (asciiAt(bytes, 0, "RIFF") && asciiAt(bytes, 8, "WEBP")) return "image/webp"
+  if (asciiAt(bytes, 0, "%PDF-")) return "application/pdf"
+  return undefined
+}
+
+/**
+ * The media type of a file handed over without one: its bytes' signature when they have one, else
+ * its extension, else `application/octet-stream`. Every place that classifies a sandbox or tool file
+ * goes through this one table, so the same file gets the same type wherever it comes from.
+ */
+export function inferFileMediaType(fileName: string, bytes?: Uint8Array): string {
+  const sniffed = bytes === undefined ? undefined : sniffFileMediaType(bytes)
+  if (sniffed) return sniffed
+  const dot = fileName.lastIndexOf(".")
+  const extension = dot < 0 ? "" : fileName.slice(dot).toLowerCase()
+  return EXTENSION_MEDIA_TYPES[extension] ?? "application/octet-stream"
+}
+
+const EXTENSION_MEDIA_TYPES: Readonly<Record<string, string>> = {
+  ".bmp": "image/bmp",
+  ".css": "text/css",
+  ".csv": "text/csv",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".gif": "image/gif",
+  ".htm": "text/html",
+  ".html": "text/html",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".js": "application/javascript",
+  ".json": "application/json",
+  ".jsonl": "application/x-ndjson",
+  ".markdown": "text/markdown",
+  ".md": "text/markdown",
+  ".mjs": "application/javascript",
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".svg": "image/svg+xml",
+  ".tsv": "text/tab-separated-values",
+  ".txt": "text/plain",
+  ".webp": "image/webp",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".xml": "application/xml",
+  ".yaml": "application/yaml",
+  ".yml": "application/yaml",
+  ".zip": "application/zip",
+}
+
+function startsWith(bytes: Uint8Array, signature: readonly number[]): boolean {
+  return signature.every((byte, index) => bytes[index] === byte)
+}
+
+function asciiAt(bytes: Uint8Array, offset: number, value: string): boolean {
+  if (bytes.byteLength < offset + value.length) return false
+  for (let index = 0; index < value.length; index += 1) {
+    if (bytes[offset + index] !== value.charCodeAt(index)) return false
+  }
+  return true
+}

package/src/datasets/builders.ts

@@ -93,6 +93,17 @@ type PickColumns<
     ? readonly []
     : readonly ColumnDefinitionOf<TColumns, TNames[number]>[]
 
+/** A dataset read through some of its columns: `rawInvoices.pick("id", "title")`. */
+type PickableDataset<TId extends string, TColumns extends readonly DatasetColumnDefinition[]> = {
+  /**
+   * The same dataset with only these columns, in this order. A pipeline step given it as an input
+   * reads nothing else, so its output inherits no other column's markings.
+   */
+  pick<const TNames extends readonly [ColumnNameOf<TColumns>, ...ColumnNameOf<TColumns>[]]>(
+    ...columns: TNames
+  ): DatasetDefinition<TId, PickColumns<TColumns, TNames>>
+}
+
 type AddColumns<
   TColumns extends readonly DatasetColumnDefinition[],
   TAdd extends readonly DatasetColumnDefinition[],
@@ -140,7 +151,8 @@ type DatasetDefinitionResult<TId extends string, TOptions extends DefineDatasetO
   FieldFromOptions<TOptions, "sequenceBy", string> &
   FieldFromOptions<TOptions, "primaryKey", DatasetPrimaryKey> &
   FieldFromOptions<TOptions, "partitionBy", readonly string[]> &
-  FieldFromOptions<TOptions, "description", string>
+  FieldFromOptions<TOptions, "description", string> &
+  PickableDataset<TId, TOptions["schema"]>
 
 type DerivedDatasetDefinitionResult<
   TId extends string,
@@ -153,7 +165,8 @@ type DerivedDatasetDefinitionResult<
   FieldFromOptions<TOptions, "sequenceBy", string> &
   FieldFromOptions<TOptions, "primaryKey", DatasetPrimaryKey> &
   FieldFromOptions<TOptions, "partitionBy", readonly string[]> &
-  FieldFromOptions<TOptions, "description", string>
+  FieldFromOptions<TOptions, "description", string> &
+  PickableDataset<TId, DerivedColumns<TParent, TOptions>>
 
 type CheckedDeriveDatasetOptions<
   TParent extends DatasetDefinition,
@@ -217,9 +230,60 @@ function createDatasetDefinition(id: string, options: DefineDatasetOptions): Dat
   }
 
   assertDatasetDefinition(definition, (message) => new DatasetValidationError(message))
+
+  // Not enumerable: the definition stays plain data for cloning, spreading, and storage.
+  Object.defineProperty(definition, "pick", {
+    value: (...columns: string[]) => pickDatasetColumns(definition, columns),
+  })
+
   return definition
 }
 
+const datasetPick: unique symbol = Symbol("sixb.datasetPick")
+
+/**
+ * Whether a definition was made by `pick()`. Only a pick may hold some of a dataset's columns: any
+ * other definition with a registered id stands for the whole dataset.
+ */
+export function isDatasetPick(dataset: DatasetDefinition): boolean {
+  return (dataset as { readonly [datasetPick]?: true })[datasetPick] === true
+}
+
+function pickDatasetColumns(
+  dataset: DatasetDefinition,
+  columnNames: readonly string[]
+): DatasetDefinition {
+  if (columnNames.length === 0) {
+    throw new DatasetValidationError(
+      `[Sixb] Dataset '${dataset.id}' pick needs at least one column.`
+    )
+  }
+
+  const columnsByName = new Map(dataset.schema.columns.map((column) => [column.name, column]))
+  const picked = new Set<string>()
+  const columns = columnNames.map((columnName) => {
+    if (picked.has(columnName)) {
+      throw new DatasetValidationError(
+        `[Sixb] Dataset '${dataset.id}' pick lists column '${columnName}' twice.`
+      )
+    }
+    picked.add(columnName)
+
+    const column = columnsByName.get(columnName)
+    if (column === undefined) {
+      throw new DatasetValidationError(
+        `[Sixb] Dataset '${dataset.id}' has no column '${columnName}' to pick.`
+      )
+    }
+
+    return column
+  })
+
+  const pick: DatasetDefinition = { kind: "dataset", id: dataset.id, schema: { columns } }
+  Object.defineProperty(pick, datasetPick, { value: true })
+  return pick
+}
+
 function assertStringArray(value: unknown, field: string): asserts value is readonly string[] {
   if (!Array.isArray(value)) {
     throw new DatasetValidationError(`${field} must be an array of column names.`)