@sixb/core 0.1.21 → 0.1.22

package/src/actions/request.ts

@@ -1,4 +1,4 @@
-import { AuthorizationError, assertAuthorized, canViewActionRun } from "../authorization"
+import { AuthorizationError, assertAuthorized } from "../authorization"
 import {
   getAuthorizationRef,
   type ResolvedRuntimeAuthorization,
@@ -10,18 +10,25 @@ import {
   executionRecordInputFromRuntime,
 } from "../execution/durable"
 import type { ExecutionContext } from "../execution/types"
+import type { ObjectRef } from "../ontology"
 import { OntologyValidationError } from "../ontology/errors"
+import { isObjectRefSchema } from "../ontology/refs"
 import type { ObjectTypeWithPropertyTokens } from "../ontology/tokens"
 import type { SixbRuntimeContext } from "../runtime/types"
 import { assertParamUsersActive } from "../shared/params/user-refs"
-import type { ActionRunRecord } from "../storage"
+import { type ActionRunRecord, ObjectNotFoundError, objectBatchKey } from "../storage"
+import type { ActionRunParams } from "../storage/action-runs/types"
 import {
   assertObjectReadOutputWithinLimit,
   ObjectReadLimitExceededError,
 } from "../storage/objects/execution-limits"
 import { admitDelegatedObjectAction, assertDelegatedActionTarget } from "./delegated-admission"
 import { getActionRunExecutor } from "./run/executor"
-import { actionRunBelongsToShareGrant, canReadActionRunSubject } from "./run-authorization"
+import {
+  actionRunBelongsToShareGrant,
+  canReadActionRunSubject,
+  viewableActionRuns,
+} from "./run-authorization"
 import { createActionRunId } from "./run-id"
 import { type ExistingActionRun, persistActionRun } from "./run-persistence"
 import type { ActionDefinition, ActionSubject } from "./types"
@@ -68,74 +75,10 @@ export async function requestAction(
   execution: ExecutionContext,
   input: RequestActionInput
 ): Promise<ActionRunRecord> {
-  // Capture the three process-local capabilities before caller-owned request getters can run.
-  const projectId = runtime.projectId
-  const runtimeAuthorization = runtime.runtimeAuthorization
-  const objectReader = runtime.objectReader
-  const request = snapshotActionRequest(input)
-  const authorization = resolveExecutionScopeAuthorization(projectId, {
-    execution,
-    authorization: runtimeAuthorization,
-  })
-  const subject = request.subject
-  const delegatedSubject =
-    authorization.type === "delegated"
-      ? assertDelegatedActionTarget({
-          authorization,
-          actionId: request.actionId,
-          subject,
-        })
-      : undefined
-  const action = getActionDefinition(runtime, request.actionId)
+  const admitted = await admitActionRequest(runtime, execution, input)
+  const { projectId, runtimeAuthorization, objectReader, authorization, request } = admitted
+  const { action, subject, pathPrefix, actionParams } = admitted
   const actionId = action.id
-  const rawParams = request.params
-
-  if (authorization.type === "delegated") {
-    await admitDelegatedObjectAction({
-      objectReader,
-      runtimeAuthorization,
-      execution,
-      authorization,
-      action,
-      subject: delegatedSubject!,
-    })
-  } else {
-    assertAuthorized({ projectId, runtimeAuthorization }, { kind: "action.apply", actionId })
-  }
-  if (authorization.type !== "delegated" && action.binding.kind === "object") {
-    // Object actions require visibility of the type they are bound to, as listing them does.
-    assertAuthorized(
-      { projectId, runtimeAuthorization },
-      { kind: "object.view", objectTypeId: action.binding.objectType.id }
-    )
-  }
-
-  validateActionSubject(action, subject)
-
-  // A run names its subject: a principal cannot request one on a type it cannot read. The action
-  // itself runs as trusted code.
-  if (authorization.type !== "delegated" && subject.kind === "object") {
-    await objectReader.assertReadable({ objectTypeIds: [subject.objectTypeId] })
-  }
-
-  let pathPrefix = action.id
-  let objectType: ObjectTypeWithPropertyTokens | null = null
-
-  if (isObjectActionDefinition(action)) {
-    objectType = resolveObjectActionSubject({ runtime, action, subject })
-    pathPrefix = `${objectType.id}.${action.id}`
-    if (authorization.type !== "delegated") {
-      // A run is visible to whoever may view its subject's type (`canViewActionRun`). A subtype
-      // excluded from a broad grant is not visible through its parent, so admitting the request on
-      // the bound type alone would run what its caller can never read back.
-      assertAuthorized(
-        { projectId, runtimeAuthorization },
-        { kind: "object.view", objectTypeId: objectType.id }
-      )
-    }
-  }
-
-  const actionParams = normalizeActionParams(runtime, action.params, rawParams, pathPrefix)
   const runId = createActionRunId(request.runId)
 
   // `persistActionRun` checks an existing run id before creating its durable execution. Keep
@@ -189,6 +132,12 @@ export async function requestAction(
       },
     })
 
+  // The request saw its subject; the run reads it again, and must find a state its requester sees.
+  const conditioned =
+    authorization.type === "principal" &&
+    subject.kind === "object" &&
+    objectReader.viewsThroughCondition(subject.objectTypeId)
+
   const run = await executor.request({
     runId,
     payload,
@@ -196,10 +145,214 @@ export async function requestAction(
     assertCanReuse,
     signal: request.signal,
     onRequested: request.onRequested,
+    ...(conditioned
+      ? {
+          readSubjectAsRequester: ({ objectTypeId, primaryId }) =>
+            objectReader.getByPrimaryId({ objectTypeId, primaryId }),
+        }
+      : {}),
   })
   return enforceDelegatedOutputBudget(authorization, run)
 }
 
+/** An Action request as it would run: admitted, and its params normalized. */
+export interface PreparedActionRequest {
+  readonly actionId: string
+  readonly subject: ActionSubject
+  readonly params: ActionRunParams
+  /** `external` when the Action has a writeback or effects: it reaches beyond Sixb. */
+  readonly effect: "ontology" | "external"
+}
+
+/**
+ * Admit an Action request without running it: the checks and the params `requestAction` applies
+ * before anything is persisted. The agent API gateway prepares the calls it holds for approval.
+ */
+export async function prepareActionRequest(
+  runtime: SixbRuntimeContext,
+  execution: ExecutionContext,
+  input: Pick<RequestActionInput, "actionId" | "subject" | "params">
+): Promise<PreparedActionRequest> {
+  const { action, subject, actionParams } = await admitActionRequest(runtime, execution, input)
+
+  return {
+    actionId: action.id,
+    subject,
+    params: actionParams,
+    effect:
+      action.phases.writeback !== undefined || action.phases.effects !== undefined
+        ? "external"
+        : "ontology",
+  }
+}
+
+/**
+ * Who may request the Action on this subject, and its normalized params, with the capabilities the
+ * request runs with. Persists nothing.
+ */
+async function admitActionRequest(
+  runtime: SixbRuntimeContext,
+  execution: ExecutionContext,
+  input: RequestActionInput
+) {
+  // Capture the three process-local capabilities before caller-owned request getters can run.
+  const projectId = runtime.projectId
+  const runtimeAuthorization = runtime.runtimeAuthorization
+  const objectReader = runtime.objectReader
+  const request = snapshotActionRequest(input)
+  const authorization = resolveExecutionScopeAuthorization(projectId, {
+    execution,
+    authorization: runtimeAuthorization,
+  })
+  const subject = request.subject
+  const delegatedSubject =
+    authorization.type === "delegated"
+      ? assertDelegatedActionTarget({
+          authorization,
+          actionId: request.actionId,
+          subject,
+        })
+      : undefined
+  const action = getActionDefinition(runtime, request.actionId)
+  const rawParams = request.params
+
+  if (authorization.type === "delegated") {
+    await admitDelegatedObjectAction({
+      objectReader,
+      runtimeAuthorization,
+      execution,
+      authorization,
+      action,
+      subject: delegatedSubject!,
+    })
+  } else {
+    assertAuthorized(
+      { projectId, runtimeAuthorization },
+      { kind: "action.apply", actionId: action.id }
+    )
+  }
+  if (authorization.type !== "delegated" && action.binding.kind === "object") {
+    // Object actions require visibility of the type they are bound to, as listing them does.
+    await assertTypeViewable({
+      projectId,
+      runtimeAuthorization,
+      objectReader,
+      objectTypeId: action.binding.objectType.id,
+    })
+  }
+
+  validateActionSubject(action, subject)
+
+  let pathPrefix = action.id
+  if (isObjectActionDefinition(action)) {
+    const objectType: ObjectTypeWithPropertyTokens = resolveObjectActionSubject({
+      runtime,
+      action,
+      subject,
+    })
+    pathPrefix = `${objectType.id}.${action.id}`
+  }
+
+  const actionParams = normalizeActionParams(runtime, action.params, rawParams, pathPrefix)
+
+  if (authorization.type !== "delegated") {
+    await assertNamedObjectsVisible({
+      objectReader,
+      subject,
+      paramsConfig: action.params,
+      params: actionParams,
+      pathPrefix,
+    })
+  }
+
+  return {
+    projectId,
+    runtimeAuthorization,
+    objectReader,
+    authorization,
+    request,
+    action,
+    subject,
+    pathPrefix,
+    actionParams,
+  }
+}
+
+/**
+ * A principal views a type whole, through a view grant, or through a condition its reader applies.
+ * Only the reader knows the latter, and each object the request names is then read through it.
+ */
+async function assertTypeViewable(input: {
+  readonly projectId: string
+  readonly runtimeAuthorization: SixbRuntimeContext["runtimeAuthorization"]
+  readonly objectReader: SixbRuntimeContext["objectReader"]
+  readonly objectTypeId: string
+}): Promise<void> {
+  const { objectReader, objectTypeId } = input
+
+  if (objectReader.viewsThroughCondition(objectTypeId)) {
+    await objectReader.assertViewable([objectTypeId])
+    return
+  }
+
+  assertAuthorized(input, { kind: "object.view", objectTypeId })
+}
+
+/**
+ * A principal acts only on the objects it can see: the action runs as trusted code, so it cannot
+ * name, as its subject or a `ref()` param, an object it could not read itself. Each one's type must
+ * be viewable as a read requires it, its markings included. A subtype excluded from a broad grant
+ * is not viewable through its parent, and a run on it is one its caller could never read back.
+ *
+ * Where it views a type through a condition, each object of that type must also be visible through
+ * its reader now: one that is not is hidden or missing, and both are not found, before anything is
+ * recorded. An object of a type it views whole is not read here. Its missing subject fails the run,
+ * and its `ref()` params are not looked up, as before conditions existed.
+ */
+async function assertNamedObjectsVisible(input: {
+  readonly objectReader: SixbRuntimeContext["objectReader"]
+  readonly subject: ActionSubject
+  readonly paramsConfig: ActionDefinition["params"]
+  readonly params: Record<string, unknown>
+  readonly pathPrefix: string
+}): Promise<void> {
+  const { objectReader, subject, params } = input
+
+  const named: { readonly ref: ObjectRef; readonly context: string }[] = []
+  if (subject.kind === "object") {
+    named.push({ ref: subject, context: "Object not found for action run" })
+  }
+  for (const [paramId, param] of Object.entries(input.paramsConfig)) {
+    const value = params[paramId]
+    if (!isObjectRefSchema(param.schema) || value === undefined || value === null) continue
+
+    named.push({
+      ref: value as ObjectRef,
+      context: `Object not found for action param '${input.pathPrefix}.${paramId}'`,
+    })
+  }
+
+  if (named.length === 0) return
+  await objectReader.assertViewable(named.map(({ ref }) => ref.objectTypeId))
+
+  const conditioned = named.filter(({ ref }) =>
+    objectReader.viewsThroughCondition(ref.objectTypeId)
+  )
+  if (conditioned.length === 0) return
+
+  const visible = await objectReader.getByPrimaryIdBatch({
+    items: conditioned.map(({ ref }) => ({
+      objectTypeId: ref.objectTypeId,
+      primaryId: ref.primaryId,
+    })),
+  })
+
+  for (const { ref, context } of conditioned) {
+    if (visible.has(objectBatchKey(ref.objectTypeId, ref.primaryId))) continue
+    throw new ObjectNotFoundError(ref.objectTypeId, ref.primaryId, context)
+  }
+}
+
 /**
  * A run that already exists under the requested run id, recorded or executing, answers this request
  * only under the rules that would let its caller read it.
@@ -227,7 +380,7 @@ async function assertCallerMayHaveRun(input: {
           grantId: authorization.delegation.grantId,
         }))
       : authorization.type !== "principal" ||
-        (canViewActionRun(authorization.context, run) &&
+        ((await viewableActionRuns(input.objectReader, authorization.context, [run])).length > 0 &&
           (await canReadActionRunSubject(input.objectReader, run)))
   if (!visible) {
     throw new AuthorizationError(

package/src/actions/run/context.ts

@@ -1,7 +1,8 @@
 import { createSixbError } from "../../errors/internal"
+import { uniqueLookupKeyOf } from "../../execution/unique-lookup"
 import type { Logger } from "../../logging"
 import type { ObjectTypeWithPropertyTokens } from "../../ontology/tokens"
-import { ObjectNotFoundError } from "../../storage"
+import { ObjectNotFoundError, type ObjectRow } from "../../storage"
 import type { ActionReadRecorder } from "../read-facade"
 import { createActionReadFacade } from "../read-facade"
 import type {
@@ -38,6 +39,7 @@ export function toActionRuntimeFacade(runtime: ActionRunContext): ActionRuntimeF
     },
     connector: runtime.sixb.connector,
     models: runtime.sixb.models,
+    users: runtime.sixb.users,
     objects(objectType) {
       return {
         appendTelemetryBatch(items) {
@@ -56,6 +58,13 @@ export function toActionReadFacade(
     recorder,
     resolveLinkIds: (objectTypeId) =>
       runtime.sixb.objects.resolveType(objectTypeId).links.map((definition) => definition.id),
+    uniqueValueKey: (objectTypeId, propertyId, value) =>
+      uniqueLookupKeyOf(
+        runtime.sixb.objects.resolveType(objectTypeId),
+        propertyId,
+        value,
+        runtime.sixb.objects.getValueTypesById()
+      ),
     telemetry: {
       resolveObjectType: (objectTypeId) => runtime.sixb.objects.resolveType(objectTypeId),
       getHistoryBatch: (input) => runtime.sixb.objects.getTelemetryHistoryBatch(input),
@@ -105,6 +114,7 @@ export function createBasePhaseContext(input: {
       input.runtime.sixb.objects.getValueTypesById()
     ),
     subject: run.subject,
+    requestedBy: input.runtime.requestedBy,
   }
 }
 
@@ -155,6 +165,11 @@ export async function loadObjectTarget(input: {
     )
   }
 
+  await assertRequesterSees(input.runtime, targetRow, {
+    actionId: input.action.id,
+    runId: input.run.id,
+  })
+
   return {
     subjectObjectType,
     snapshot: toActionTargetObject(targetRow, input.action.binding.objectType.id),
@@ -162,6 +177,37 @@ export async function loadObjectTarget(input: {
   }
 }
 
+/**
+ * Handlers run on, and the commit fences on, the state just read. A requester that views the type
+ * through a condition must see that very state: hidden, it is not found, as a missing subject is,
+ * and on a replay too. A state that changed between the two reads conflicts, and the run replays
+ * on what it finds then.
+ */
+async function assertRequesterSees(
+  runtime: ActionRunContext,
+  row: ObjectRow,
+  ids: { readonly actionId: string; readonly runId: string }
+): Promise<void> {
+  if (!runtime.readSubjectAsRequester) return
+
+  const seen = await runtime.readSubjectAsRequester(row)
+  if (!seen) {
+    throw new ObjectNotFoundError(
+      row.objectTypeId,
+      row.primaryId,
+      "Object not found for action run"
+    )
+  }
+
+  if (seen.version !== row.version) {
+    throw createSixbError(
+      "action.read_conflict",
+      `[Sixb] Action run '${ids.runId}' read its subject while it changed.`,
+      { details: ids }
+    )
+  }
+}
+
 export function requireObjectSubject<
   TObjectType extends ObjectTypeWithPropertyTokens = ObjectTypeWithPropertyTokens,
 >(

package/src/actions/run/execute.ts

@@ -10,7 +10,12 @@ import type { ActionRunStorage, Storage } from "../../storage"
 import type { ExecutionRecord } from "../../storage/executions"
 import { runAction } from "./run-action"
 import { ActionRunSignals } from "./signals"
-import type { ActionRunContext, ActionRunOutcome, PendingActionRun } from "./types"
+import type {
+  ActionRunContext,
+  ActionRunOutcome,
+  PendingActionRun,
+  ReadSubjectAsRequester,
+} from "./types"
 
 /** What executing a stored Action run needs from its host. */
 export interface ActionRunHost extends PrimitiveExecutionHost {
@@ -25,8 +30,7 @@ export interface ExecuteActionRunInput {
   readonly execution: ExecutionRecord
   /** Cancels the run before its irreversible boundary. */
   readonly signal?: AbortSignal
-  /** Test-only override of the 30-second deadlines of the run and of its effects. */
-  readonly timeoutMs?: number
+  readonly readSubjectAsRequester?: ReadSubjectAsRequester
 }
 
 /**
@@ -54,7 +58,6 @@ export async function executeActionRun(
     actionId: run.actionId,
     runId: run.id,
     caller: input.signal,
-    timeoutMs: input.timeoutMs,
   })
 
   try {
@@ -67,7 +70,7 @@ export async function executeActionRun(
       primitive: { kind: "action", id: run.actionId, runId: run.id },
     })
     return await runAction({
-      runtime: buildActionContext(host, actionRuns, bound),
+      runtime: buildActionContext(host, actionRuns, bound, input.readSubjectAsRequester),
       run,
       signals,
     })
@@ -91,7 +94,8 @@ function requireActionRunStorage(host: ActionRunHost, runId: string): ActionRunS
 function buildActionContext(
   host: ActionRunHost,
   actionRunsStorage: ActionRunStorage,
-  execution: BoundPrimitiveExecution
+  execution: BoundPrimitiveExecution,
+  readSubjectAsRequester: ReadSubjectAsRequester | undefined
 ): ActionRunContext {
   const sixb = {
     models: execution.sixb.models,
@@ -99,6 +103,7 @@ function buildActionContext(
     actions: execution.sixb.actions,
     connector: execution.sixb.connector,
     blobs: execution.sixb.blobs,
+    users: execution.sixb.users,
   }
   return {
     id: host.id,
@@ -109,5 +114,7 @@ function buildActionContext(
     ontologyMutations: execution.ontologyMutations,
     sixb,
     actions: host.definitions.actions,
+    requestedBy: execution.sixb.execution.requestedBy,
+    ...(readSubjectAsRequester === undefined ? {} : { readSubjectAsRequester }),
   }
 }

package/src/actions/run/executor.ts

@@ -10,7 +10,7 @@ import {
 import { type ActionRunHost, executeActionRun } from "./execute"
 import { toActionRunFailure } from "./normalize"
 import { UnrecordedActionRunError } from "./run-action"
-import type { PendingActionRun } from "./types"
+import type { PendingActionRun, ReadSubjectAsRequester } from "./types"
 
 /** A request for an Action run, handed over to execute in the requesting process. */
 export interface ActionRunRequest {
@@ -24,6 +24,8 @@ export interface ActionRunRequest {
   readonly signal?: AbortSignal
   /** Called once the run's execution exists, before the run executes. A throw starts nothing. */
   readonly onRequested?: (runId: string) => void | Promise<void>
+  /** Set when the requester views the subject's type through a condition. */
+  readonly readSubjectAsRequester?: ReadSubjectAsRequester
 }
 
 type NewActionRun = Extract<PersistedActionRun, { readonly kind: "new" }>
@@ -180,7 +182,14 @@ export class ActionRunExecutor {
 
     let outcome: Awaited<ReturnType<typeof executeActionRun>>
     try {
-      outcome = await executeActionRun(this.host, { run, execution, signal: request.signal })
+      outcome = await executeActionRun(this.host, {
+        run,
+        execution,
+        signal: request.signal,
+        ...(request.readSubjectAsRequester === undefined
+          ? {}
+          : { readSubjectAsRequester: request.readSubjectAsRequester }),
+      })
     } catch (error) {
       throw this.failRequest(run, error)
     }

package/src/actions/run/normalize.ts

@@ -6,6 +6,8 @@ import {
   toSixbFailure,
 } from "../../errors/internal"
 import { isMaterializationConflictError } from "../../materialization/errors"
+import { ActionValidationError } from "../../objects/action/errors"
+import { uniqueViolationError } from "../../objects/unique-violation"
 import { ACTION_RUN_FAILURE_CODES, type ActionRunFailure, type ActionRunPhase } from "../../storage"
 import { parseActionRunFailure } from "../../storage/action-runs/failure"
 import { isActionTimeout } from "./signals"
@@ -48,7 +50,8 @@ export async function untilAborted<T>(work: () => Promise<T>, signal: AbortSigna
  * with `action.timeout` when its deadline elapsed, and with `runtime.cancelled` when its caller
  * aborted. The handler's own error stays the cause reported to `onError`. Every expectation an
  * Action commit carries comes from the Action's own reads, so an expectation conflict at commit is
- * a read conflict: the run can be requested again against current state.
+ * a read conflict: the run can be requested again against current state. A validator's returned
+ * error is a rejection, not a crash.
  */
 export function translateActionPhaseError(
   error: unknown,
@@ -82,9 +85,14 @@ export function translateActionPhaseError(
   if (isSixbError(error) && error.code === "internal.unexpected") {
     return error
   }
+  if (error instanceof ActionValidationError) {
+    return createSixbError("action.rejected", error.message, { cause: error, details })
+  }
   if (phase === "commit" && isMaterializationConflictError(error) && error.kind === "expectation") {
     return createSixbError("action.read_conflict", error.message, { cause: error, details })
   }
+  const uniqueViolation = phase === "commit" ? uniqueViolationError(error, details) : undefined
+  if (uniqueViolation) return uniqueViolation
 
   return createSixbError(
     "action.phase_failed",
@@ -97,7 +105,9 @@ export function translateActionPhaseError(
 export function isActionPhaseFailure(error: unknown): error is SixbCodedError {
   return (
     isSixbError(error) &&
-    (error.code === "action.phase_failed" || error.code === "action.read_conflict")
+    (error.code === "action.phase_failed" ||
+      error.code === "action.read_conflict" ||
+      error.code === "action.rejected")
   )
 }
 

package/src/actions/run/phases.ts

@@ -87,6 +87,8 @@ async function commitOnce(
   try {
     objectTarget = await loadObjectTarget({ runtime, action, run: state.run })
   } catch (error) {
+    // The subject changed while its requester's view of it was read: replay as a commit would.
+    if (isReadConflict(error)) throw error
     throw translateActionPhaseError(error, replayingEdits ? "edits" : "validation", {
       ...ids,
       signal,

package/src/actions/run/run-action.ts

@@ -108,8 +108,17 @@ function runFailure(
 }
 
 /**
- * Record a failed run, and report its failure to `onError` once this request recorded it. A run its
- * caller cancelled is not reported: it did not fail on its own.
+ * Failures that are not the run's own: its caller cancelled it, or a validator rejected the request,
+ * which is a business outcome the caller reads on the run.
+ */
+const UNREPORTED_FAILURE_CODES: ReadonlySet<string> = new Set([
+  "runtime.cancelled",
+  "action.rejected",
+])
+
+/**
+ * Record a failed run, and report its failure to `onError` once this request recorded it, unless
+ * it is one of the {@link UNREPORTED_FAILURE_CODES}.
  */
 async function recordFailure(
   runtime: ActionRunContext,
@@ -117,7 +126,7 @@ async function recordFailure(
   error: unknown
 ): Promise<ActionRunOutcome> {
   const outcome = await recordRun(runtime, record)
-  if (outcome.recorded && record.error.code !== "runtime.cancelled") {
+  if (outcome.recorded && !UNREPORTED_FAILURE_CODES.has(record.error.code)) {
     reportRunFailure(runtime.errorReporterHost, unwrapActionPhaseError(error), {
       projectId: runtime.id,
       runKind: "action",

package/src/actions/run/signals.ts

@@ -18,8 +18,6 @@ export interface ActionRunSignalsInput {
   readonly runId: string
   /** The caller's cancellation. It applies before the boundary only. */
   readonly caller?: AbortSignal
-  /** Test-only override of {@link ACTION_TIMEOUT_MS}. */
-  readonly timeoutMs?: number
 }
 
 /**
@@ -89,22 +87,18 @@ export class ActionDeadline {
   readonly signal: AbortSignal
   private readonly timer: ReturnType<typeof setTimeout>
 
-  constructor(
-    input: Pick<ActionRunSignalsInput, "actionId" | "runId" | "timeoutMs">,
-    scope: "run" | "effects"
-  ) {
+  constructor(input: Pick<ActionRunSignalsInput, "actionId" | "runId">, scope: "run" | "effects") {
     const controller = new AbortController()
-    const timeoutMs = input.timeoutMs ?? ACTION_TIMEOUT_MS
     this.signal = controller.signal
     this.timer = setTimeout(() => {
       controller.abort(
         createSixbError(
           "action.timeout",
-          `[Sixb] Action run '${input.runId}' exceeded its ${timeoutMs} ms ${scope} deadline.`,
+          `[Sixb] Action run '${input.runId}' exceeded its ${ACTION_TIMEOUT_MS} ms ${scope} deadline.`,
           { details: { actionId: input.actionId, runId: input.runId } }
         )
       )
-    }, timeoutMs)
+    }, ACTION_TIMEOUT_MS)
   }
 
   /** Release the deadline timer. */