@sixb/core 0.1.7 → 0.1.8

package/src/execution/durable.ts

@@ -5,7 +5,11 @@ import {
   type ExecutionStorage,
   ExecutionStorageError,
 } from "../storage/executions"
-import { createTrustedPrimitiveRuntimeAuthorization, getAuthorizationRef } from "./authorization"
+import {
+  createTrustedPrimitiveRuntimeAuthorization,
+  getAuthorizationRef,
+  resolveExecutionScopeAuthorization,
+} from "./authorization"
 import type {
   ExecutionContext,
   ExecutionScope,
@@ -19,6 +23,10 @@ export function executionRecordInputFromRuntime(input: {
   readonly runtimeAuthorization: RuntimeAuthorization
 }): CreateExecutionInput {
   const execution = input.execution
+  resolveExecutionScopeAuthorization(execution.projectId, {
+    execution,
+    authorization: input.runtimeAuthorization,
+  })
   return {
     id: execution.id,
     projectId: execution.projectId,
@@ -135,7 +143,7 @@ export function restoreTrustedPrimitiveExecutionScope(input: {
   return Object.freeze({
     execution: context,
     authorization: createTrustedPrimitiveRuntimeAuthorization({
-      projectId: input.execution.projectId,
+      execution: context,
       primitive: input.primitive,
     }),
   })

package/src/execution/index.ts

@@ -7,6 +7,7 @@ export type {
   ExecutionSource,
   KernelOperation,
   RuntimeAuthorization,
+  SharedAccessDelegationRef,
   TrustedPrimitiveKind,
   TrustedPrimitiveRef,
 } from "./types"

package/src/execution/request.ts

@@ -2,7 +2,17 @@ import { randomUUID } from "node:crypto"
 import type { AuthorizationContext } from "../authorization"
 import type { OntologySource } from "../ontology"
 import { isBoundSixb, type Sixb } from "../runtime/sixb"
-import { createDisabledRequestScope, createPrincipalRequestScope } from "./scopes"
+import {
+  objectReadScopeForAccessPlan,
+  type ShareAccessPlan,
+  snapshotShareAccessPlan,
+} from "../shares/access-plan"
+import type { ObjectReadExecutionLimits } from "../storage/objects/execution-limits"
+import {
+  createDelegatedRequestScope,
+  createDisabledRequestScope,
+  createPrincipalRequestScope,
+} from "./scopes"
 import type { AuthorizationRef, ExecutionScope } from "./types"
 
 export type { ActionRunsRuntime, ActionsRuntime } from "../actions/execution"
@@ -59,6 +69,16 @@ export type RequestExecutionAuthorization =
       readonly context: AuthorizationContext
       readonly credential?: Extract<AuthorizationRef, { readonly type: "principal" }>["credential"]
     }
+  | {
+      readonly type: "delegated"
+      readonly access: ShareAccessPlan
+      readonly limits?: ObjectReadExecutionLimits
+      readonly delegation: {
+        readonly kind: "share"
+        readonly grantId: string
+        readonly sessionId: string
+      }
+    }
   | { readonly type: "disabled" }
 
 export interface BindRequestExecutionInput {
@@ -78,18 +98,7 @@ export function bindRequestExecution(
 ): Sixb<readonly OntologySource[]> {
   const requestId = requestIdentifier(input.request)
   const correlationId = correlationIdentifier(input.request, requestId)
-  const scope =
-    input.authorization.type === "principal"
-      ? createPrincipalRequestScope({
-          projectId: host.id,
-          requestId,
-          correlationId,
-          context: input.authorization.context,
-          ...(input.authorization.credential === undefined
-            ? {}
-            : { credential: input.authorization.credential }),
-        })
-      : createDisabledRequestScope({ projectId: host.id, requestId, correlationId })
+  const scope = createRequestScope(host.id, requestId, correlationId, input.authorization)
 
   const sixb = host.withScope(scope)
   if (!isBoundSixb(sixb)) {
@@ -98,6 +107,47 @@ export function bindRequestExecution(
   return sixb
 }
 
+function createRequestScope(
+  projectId: string,
+  requestId: string,
+  correlationId: string,
+  authorization: RequestExecutionAuthorization
+): ExecutionScope {
+  switch (authorization.type) {
+    case "principal":
+      return createPrincipalRequestScope({
+        projectId,
+        requestId,
+        correlationId,
+        context: authorization.context,
+        ...(authorization.credential === undefined ? {} : { credential: authorization.credential }),
+      })
+    case "delegated": {
+      const access = snapshotShareAccessPlan(authorization.access)
+      return createDelegatedRequestScope({
+        projectId,
+        requestId,
+        correlationId,
+        objectRead: {
+          selection: objectReadScopeForAccessPlan(access),
+          limits: authorization.limits ?? {
+            maxTraversalFacts: 10_000,
+            maxOutputJsonBytes: 8 * 1024 * 1024,
+          },
+        },
+        actionApply: access.grants.flatMap((grant) =>
+          grant.kind === "action.apply"
+            ? grant.subjects.map((subject) => ({ actionId: grant.actionId, subject }))
+            : []
+        ),
+        delegation: authorization.delegation,
+      })
+    }
+    case "disabled":
+      return createDisabledRequestScope({ projectId, requestId, correlationId })
+  }
+}
+
 function requestIdentifier(request: Request): string {
   return headerIdentifier(request, "x-request-id") ?? `req_${randomUUID()}`
 }

package/src/execution/scopes.ts

@@ -1,9 +1,12 @@
 import { randomUUID } from "node:crypto"
 import type { AuthorizationContext } from "../authorization"
+import type { ObjectReadExecutionLimits, SelectedObjectReadScope } from "../storage"
 import {
+  createDelegatedRuntimeAuthorization,
   createDisabledRuntimeAuthorization,
   createKernelRuntimeAuthorization,
   createPrincipalRuntimeAuthorization,
+  type DelegatedActionApplyTarget,
 } from "./authorization"
 import type {
   AuthorizablePrincipal,
@@ -31,7 +34,7 @@ export function createPrincipalRequestScope(input: {
   return Object.freeze({
     execution,
     authorization: createPrincipalRuntimeAuthorization({
-      projectId: input.projectId,
+      execution,
       context: input.context,
       ...(input.credential === undefined ? {} : { credential: input.credential }),
     }),
@@ -43,9 +46,36 @@ export function createDisabledRequestScope(input: {
   readonly requestId: string
   readonly correlationId: string
 }): ExecutionScope {
+  const execution = createRequestExecution(input)
   return Object.freeze({
-    execution: createRequestExecution(input),
-    authorization: createDisabledRuntimeAuthorization(input.projectId),
+    execution,
+    authorization: createDisabledRuntimeAuthorization(execution),
+  })
+}
+
+/** Internal request scope carrying only a finite object-read selection. */
+export function createDelegatedRequestScope(input: {
+  readonly projectId: string
+  readonly requestId: string
+  readonly correlationId: string
+  readonly objectRead: {
+    readonly selection: SelectedObjectReadScope
+    readonly limits: ObjectReadExecutionLimits
+  }
+  readonly actionApply?: readonly DelegatedActionApplyTarget[]
+  readonly delegation?: Extract<AuthorizationRef, { readonly type: "delegated" }>["delegation"]
+}): ExecutionScope {
+  const execution = createRequestExecution(input)
+  const actionApply = input.actionApply
+  const delegation = input.delegation
+  return Object.freeze({
+    execution,
+    authorization: createDelegatedRuntimeAuthorization({
+      execution,
+      objectRead: input.objectRead,
+      ...(actionApply === undefined ? {} : { actionApply }),
+      ...(delegation === undefined ? {} : { delegation }),
+    }),
   })
 }
 
@@ -64,7 +94,7 @@ export function createKernelScope(input: {
   })
   return Object.freeze({
     execution,
-    authorization: createKernelRuntimeAuthorization({ projectId: input.projectId, operation }),
+    authorization: createKernelRuntimeAuthorization({ execution, operation }),
   })
 }
 
@@ -110,8 +140,8 @@ export function createTestingScope(input: {
   return Object.freeze({
     execution,
     authorization: context
-      ? createPrincipalRuntimeAuthorization({ projectId: input.projectId, context })
-      : createDisabledRuntimeAuthorization(input.projectId),
+      ? createPrincipalRuntimeAuthorization({ execution, context })
+      : createDisabledRuntimeAuthorization(execution),
   })
 }
 

package/src/execution/types.ts

@@ -19,6 +19,13 @@ export interface TrustedPrimitiveRef {
   readonly runId: string
 }
 
+/** Durable provenance for authority delegated by one shared-access browser session. */
+export interface SharedAccessDelegationRef {
+  readonly kind: "share"
+  readonly grantId: string
+  readonly sessionId: string
+}
+
 export type KernelOperation = {
   readonly type: "ontology.recover"
   readonly recoveryId: string
@@ -69,6 +76,7 @@ export type AuthorizationRef =
         | { readonly type: "accessToken"; readonly id: string }
     }
   | { readonly type: "trustedPrimitive"; readonly primitive: TrustedPrimitiveRef }
+  | { readonly type: "delegated"; readonly delegation: SharedAccessDelegationRef }
   | { readonly type: "kernel"; readonly operation: KernelOperation }
   | { readonly type: "disabled" }
 

package/src/http/api-routes.ts

@@ -19,6 +19,8 @@ export interface SixbApiRoute {
   readonly accessToken: boolean
   /** The route is proxied by the agent API gateway (a strict subset of the accessToken routes). */
   readonly agentApi: boolean
+  /** The canonical handler may run under an explicitly selected shared session. */
+  readonly sharedSession?: boolean
 }
 
 export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
@@ -103,12 +105,37 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     accessToken: true,
     agentApi: false,
   },
+  // Share lifecycle management is bearer-capable for programmatic administration but never
+  // agent-proxied. Shared sessions themselves use the canonical object/action routes and land in
+  // the request boundary separately.
+  {
+    operationId: "issueSharedAccessGrant",
+    method: "POST",
+    path: "/api/share-grants",
+    accessToken: true,
+    agentApi: false,
+  },
+  {
+    operationId: "listSharedAccessGrants",
+    method: "GET",
+    path: "/api/share-grants",
+    accessToken: true,
+    agentApi: false,
+  },
+  {
+    operationId: "revokeSharedAccessGrant",
+    method: "DELETE",
+    path: "/api/share-grants/:grantId",
+    accessToken: true,
+    agentApi: false,
+  },
   {
     operationId: "listObjectTypes",
     method: "GET",
     path: "/api/object-types",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "getObjectType",
@@ -116,6 +143,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/object-types/:objectTypeId",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "listObjects",
@@ -123,6 +151,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/objects",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "queryObjects",
@@ -130,6 +159,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/objects/query",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "queryObjectLinks",
@@ -137,6 +167,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/objects/query/links",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "countObjects",
@@ -144,6 +175,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/objects/query/count",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "existsObjects",
@@ -151,6 +183,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/objects/query/exists",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "facetObjects",
@@ -158,6 +191,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/objects/query/facets",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "getObject",
@@ -165,6 +199,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/objects/:objectTypeId/:objectId",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   // The four write routes. Bearer-capable because their execution facade enforces authorization
   // (`edit:object` / `append:telemetry`), which is exactly the precondition this table requires.
@@ -205,6 +240,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/telemetry/history",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "getTelemetryHistory",
@@ -212,6 +248,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/objects/:objectTypeId/:objectId/telemetry/:propertyId/history",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "getLatestTelemetry",
@@ -219,6 +256,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/objects/:objectTypeId/:objectId/telemetry/:propertyId/latest",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "getObjectFileContent",
@@ -226,6 +264,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/objects/:objectTypeId/:objectId/files/content",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     // Bearer-capable (CLI/programmatic existence + range probes) but NOT agent-proxied: the agent
@@ -237,6 +276,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/objects/:objectTypeId/:objectId/files/content",
     accessToken: true,
     agentApi: false,
+    sharedSession: true,
   },
   {
     operationId: "listActions",
@@ -244,6 +284,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/actions",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "getAction",
@@ -251,6 +292,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/actions/:actionId",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "requestAction",
@@ -258,6 +300,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/actions/:actionId",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "uploadFileRaw",
@@ -279,6 +322,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/action-runs/:runId",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "getActionRunFileContent",
@@ -391,6 +435,7 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     path: "/api/objects/search",
     accessToken: true,
     agentApi: true,
+    sharedSession: true,
   },
   {
     operationId: "listEvents",

package/src/index.ts

@@ -9,6 +9,10 @@ export type {
   InferSchemaOrRef,
   Interface,
   LinkCardinality,
+  LinkPathSelection,
+  LinkPathSelectionBuilder,
+  LinkPathSelectionInput,
+  LinkPathSelectionMode,
   LinkToken,
   LinkTokenMap,
   MapSchema,
@@ -47,6 +51,7 @@ export {
   isObjectRefSchema,
   link,
   OntologyRegistry,
+  objectRef,
   prop,
   ref,
   stringEnum,
@@ -474,6 +479,7 @@ export type {
   RunGrantTarget,
   SecurityDefinitionCatalog,
   Selection,
+  ShareGrant,
   ViewGrant,
   ViewGrantTarget,
 } from "./security"
@@ -487,6 +493,29 @@ export {
   SecurityValidationError,
 } from "./security"
 
+// ── Shares ────────────────────────────────────────────────
+
+export type {
+  DefineShareOptions,
+  IssueSharedAccessByIdInput,
+  IssueSharedAccessInput,
+  ListSharedAccessByIdInput,
+  ListSharedAccessInput,
+  ShareActionGrant,
+  ShareActionGrantBuilder,
+  ShareDefinition,
+  SharedAccessGrant,
+  SharedAccessGrantListResult,
+  SharedAccessInvitation,
+  ShareErrorReason,
+  ShareScopeGrant,
+  SharesRuntime,
+  ShareTarget,
+  ShareViewGrant,
+  ShareViewGrantBuilder,
+} from "./shares"
+export { defineShare, ShareDefinitionError, ShareError } from "./shares"
+
 // ── Storage ────────────────────────────────────────────────
 // Config contract + operator migration API + in-memory dev providers.
 // The full storage-provider contract lives at `@sixb/core/storage`.
@@ -854,7 +883,7 @@ export type {
 } from "./agents/execution"
 export type { BlobsRuntime } from "./blob-storage/execution"
 export type { ConnectorRuntime } from "./connectors/execution"
-export type { DatasetsRuntime } from "./datasets/execution"
+export type { DatasetIngestInput, DatasetIngestResult, DatasetsRuntime } from "./datasets/execution"
 export type {
   SixbActionPhaseFailedContext,
   SixbErrorContext,
@@ -983,20 +1012,10 @@ export type {
   AgentFileDataProjection,
   AgentFileDataResolverInput,
   AgentFilePart,
-  AgentInboundUiMessage,
-  AgentInboundUiMessagePart,
   AgentMessage,
   AgentMessagePart,
   AgentMessagePartType,
   AgentMessageRole,
-  AgentModelAssistantPart,
-  AgentModelFilePart,
-  AgentModelMessage,
-  AgentModelReasoningPart,
-  AgentModelTextPart,
-  AgentModelToolCallPart,
-  AgentModelToolOutput,
-  AgentModelToolResultPart,
   AgentProviderStatePart,
   AgentReasoning,
   AgentReasoningLevel,
@@ -1025,9 +1044,6 @@ export type {
   AgentToolRunContext,
   AgentToolRunInfo,
   AgentToolTextContent,
-  AgentUiMessage,
-  AgentUiMessagePart,
-  AgentUiToolPart,
   AgentUsageReference,
   InferAgentToolInput,
   InferAgentToolInputSchema,
@@ -1066,6 +1082,12 @@ export { CronValidationError } from "./schedules"
 
 // ── Projections ─────────────────────────────────────────────
 
+export type {
+  ActionDescriptor,
+  ActionDescriptorBinding,
+  ActionParamDescriptor,
+  ActionPhaseDescriptor,
+} from "./actions/descriptor"
 export type {
   ForeignKeyDescriptor,
   LinkProjectionDefinition,
@@ -1083,7 +1105,6 @@ export type {
   TelemetryProjectionDefinition,
   TelemetryProjectionPropertyMapping,
 } from "./projections"
-
 export {
   defineProjection,
   fromForeignKey,

package/src/lake-storage/definition-updates.ts

@@ -1,4 +1,5 @@
 import type { DatasetColumnDefinition, DatasetDefinition } from "../datasets"
+import { assertDatasetDefinition } from "../datasets/validation"
 import { LakeStorageError } from "./errors"
 import type { LakeStorage } from "./types"
 
@@ -36,6 +37,12 @@ export function planDatasetDefinitionUpdate(
   requested: DatasetDefinition
 ): DatasetDefinitionUpdatePlan {
   assertSameDataset(existing, requested)
+  assertDatasetDefinition(requested, (message) => new LakeStorageError(`[SixbLake] ${message}`))
+  if (existing.sequenceBy !== requested.sequenceBy) {
+    throw new LakeStorageError(
+      `[SixbLake] Dataset '${requested.id}' sequenceBy is immutable. Create a new dataset and backfill to adopt or change source ordering.`
+    )
+  }
   assertPrimaryKeyUnchanged(existing, requested)
 
   const addedColumns = getAddedColumnsAfterValidatingExistingColumns(existing, requested)
@@ -66,6 +73,7 @@ export function mergeStrictDatasetDefinition(options: {
   readonly existing?: DatasetDefinition | null
   readonly next: DatasetDefinition
 }): DatasetDefinition {
+  assertDatasetDefinition(options.next, (message) => new LakeStorageError(`[SixbLake] ${message}`))
   if (!options.existing) {
     return structuredClone(options.next)
   }
@@ -221,6 +229,7 @@ function mergeDatasetDefinition(
     id: requested.id,
     schema: { columns },
     ...(primaryKey !== undefined ? { primaryKey: structuredClone(primaryKey) } : {}),
+    ...(existing.sequenceBy !== undefined ? { sequenceBy: existing.sequenceBy } : {}),
     ...(partitionBy !== undefined ? { partitionBy: [...partitionBy] } : {}),
     ...(description !== undefined ? { description } : {}),
   }

package/src/lake-storage/errors.ts

@@ -2,5 +2,10 @@
  * Error for lake-storage invariants and invalid lake operations.
  */
 export class LakeStorageError extends Error {
-  readonly name = "LakeStorageError"
+  readonly name: string = "LakeStorageError"
+}
+
+/** A known, uncommitted version/transaction conflict; safe to retry staged changes. */
+export class LakeConcurrencyError extends LakeStorageError {
+  override readonly name = "LakeConcurrencyError"
 }