@sixb/core 0.1.7 → 0.1.9

package/src/agents/validation.ts

@@ -1,12 +1,7 @@
 import { getInvalidJsonValueReason, isPlainRecord, type JsonValue } from "../json"
-import {
-  normalizeSchemaValue,
-  type ObjectSchema,
-  OntologyValidationError,
-  type ValueType,
-  validateSchemaValue,
-} from "../ontology"
-import type { GroupDefinition } from "../security"
+import { type ObjectSchema, OntologyValidationError, type ValueType } from "../ontology"
+import { normalizeSchemaValue } from "../ontology/validation/normalize"
+import { validateSchemaValue } from "../ontology/validation/schema"
 import { AgentDefinitionError } from "./errors"
 import type { AgentToolDefinition, AgentToolInputSchema } from "./types"
 
@@ -31,12 +26,6 @@ export const AGENT_RESERVED_TOOL_NAMES = [
   "wait_agent",
 ] as const
 
-export function assertNonEmpty(value: string, field: string): void {
-  if (!value.trim()) {
-    throw new AgentDefinitionError(`[Sixb] Agent ${field} must not be empty.`)
-  }
-}
-
 export function isAgentToolDefinition(value: unknown): value is AgentToolDefinition {
   return (
     isRecord(value) &&
@@ -126,38 +115,6 @@ export function validateAndNormalizeAgentToolInput(
   )
 }
 
-export function groupIdsFromDefinitions(
-  agentId: string,
-  groups: readonly GroupDefinition[] | undefined
-): readonly string[] {
-  const groupIds = (groups ?? []).map((group) => {
-    if (!isRecord(group) || group.kind !== "group") {
-      throw new AgentDefinitionError(
-        `[Sixb] Agent '${agentId}' groups must contain only group definitions.`
-      )
-    }
-
-    assertNonEmpty(group.id, `Agent '${agentId}' group id`)
-    return group.id
-  })
-
-  assertNoDuplicateGroupIds(agentId, groupIds)
-  return Object.freeze(groupIds)
-}
-
-function assertNoDuplicateGroupIds(agentId: string, groupIds: readonly string[]): void {
-  const seen = new Set<string>()
-  for (const groupId of groupIds) {
-    assertNonEmpty(groupId, `Agent '${agentId}' group id`)
-    if (seen.has(groupId)) {
-      throw new AgentDefinitionError(
-        `[Sixb] Agent '${agentId}' groups contains duplicate group id '${groupId}'.`
-      )
-    }
-    seen.add(groupId)
-  }
-}
-
 function assertValidAgentToolSchema(
   toolName: string,
   schema: unknown,
@@ -238,45 +195,25 @@ function invalidAgentToolSchema(toolName: string, path: string): AgentDefinition
   )
 }
 
-export function assertValidAgentToolDefinitions(
-  agentId: string,
-  tools: readonly AgentToolDefinition[]
-): void {
-  assertValidAgentToolDefinitionList(tools, {
-    invalidDefinitions: `[Sixb] Agent '${agentId}' tools must contain only agent tool definitions.`,
-    duplicateName: (name) =>
-      `[Sixb] Agent '${agentId}' tools contains duplicate tool name '${name}'.`,
-  })
-}
-
 export function assertValidProjectAgentToolDefinitions(
   tools: readonly AgentToolDefinition[]
-): void {
-  assertValidAgentToolDefinitionList(tools, {
-    invalidDefinitions: "[Sixb] Project tools must contain only agent tool definitions.",
-    duplicateName: (name) => `[Sixb] Project tools contain duplicate tool name '${name}'.`,
-  })
-}
-
-function assertValidAgentToolDefinitionList(
-  tools: readonly AgentToolDefinition[],
-  messages: {
-    readonly invalidDefinitions: string
-    readonly duplicateName: (name: string) => string
-  }
 ): void {
   const seen = new Set<string>()
   for (let index = 0; index < tools.length; index += 1) {
     const tool = tools[index]
     if (!Object.hasOwn(tools, index) || !isAgentToolDefinition(tool)) {
-      throw new AgentDefinitionError(messages.invalidDefinitions)
+      throw new AgentDefinitionError(
+        "[Sixb] Project tools must contain only agent tool definitions."
+      )
     }
 
     assertValidAgentToolName(tool.name)
     assertValidAgentToolDescription(tool.name, tool.description)
     assertValidAgentToolInput(tool.name, tool.input)
     if (seen.has(tool.name)) {
-      throw new AgentDefinitionError(messages.duplicateName(tool.name))
+      throw new AgentDefinitionError(
+        `[Sixb] Project tools contain duplicate tool name '${tool.name}'.`
+      )
     }
     seen.add(tool.name)
   }

package/src/ai-usage/execution.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto"
-import { assertAuthorized, assertRuntimeAuthorizationBound, isAllowed } from "../authorization"
+import { assertAuthorized, isRuntimeAllowed } from "../authorization"
 import type { SixbRuntimeContext } from "../runtime/types"
 import type { SecurityDefinitionCatalog } from "../security"
 import type {
@@ -87,11 +87,9 @@ export function createAiUsageRuntime(
   const assertObservable = () => assertAuthorized(runtime, { kind: "aiUsage.observe" })
   const assertManageable = () => assertAuthorized(runtime, { kind: "aiUsage.manage" })
   const assertPolicyReadable = () => {
-    const resolved = assertRuntimeAuthorizationBound(runtime)
     if (
-      resolved.type === "principal" &&
-      !isAllowed(resolved.context, { kind: "aiUsage.observe" }) &&
-      !isAllowed(resolved.context, { kind: "aiUsage.manage" })
+      !isRuntimeAllowed(runtime, { kind: "aiUsage.observe" }) &&
+      !isRuntimeAllowed(runtime, { kind: "aiUsage.manage" })
     ) {
       assertObservable()
     }
@@ -114,12 +112,7 @@ export function createAiUsageRuntime(
     limitsConfigured: runtime.storage.aiLimits !== undefined,
     assertObservable,
     assertManageable,
-    canManageLimits: () => {
-      const resolved = assertRuntimeAuthorizationBound(runtime)
-      return (
-        resolved.type !== "principal" || isAllowed(resolved.context, { kind: "aiUsage.manage" })
-      )
-    },
+    canManageLimits: () => isRuntimeAllowed(runtime, { kind: "aiUsage.manage" }),
     queryOverview: (input) => {
       assertObservable()
       return requireCosts().queryProjectOverview({ ...input, projectId: runtime.projectId })

package/src/auth/index.ts

@@ -9,7 +9,6 @@ export {
   parseAccessTokenValue,
   SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX,
 } from "./access-tokens"
-export { normalizeRequesterGroupIds, snapshotRequesterGroupIds } from "./attribution"
 export type { AuthSessionAudience, AuthSessionAudienceOptions } from "./audience"
 export {
   DEFAULT_AUTH_SESSION_AUDIENCE,

package/src/authorization/decision.ts

@@ -13,7 +13,8 @@
 import type { AuthSessionAudience } from "../auth/audience"
 import {
   type ResolvedRuntimeAuthorization,
-  resolveRuntimeAuthorization,
+  resolveExecutionScopeAuthorization,
+  resolveRuntimeAuthorizationForProject,
 } from "../execution/authorization"
 import type { ExecutionContext, RuntimeAuthorization } from "../execution/types"
 import { AuthorizationError } from "./errors"
@@ -28,6 +29,7 @@ export type AuthzRequest =
   | { readonly kind: "object.edit"; readonly objectTypeId: string }
   | { readonly kind: "telemetry.append"; readonly objectTypeId: string }
   | { readonly kind: "action.apply"; readonly actionId: string }
+  | { readonly kind: "share.manage"; readonly shareId: string }
   | { readonly kind: "workflow.run"; readonly workflowId: string }
   | { readonly kind: "sync.run"; readonly syncId: string }
   | { readonly kind: "pipeline.run"; readonly pipelineId: string }
@@ -47,6 +49,7 @@ export interface AuthzDecision {
 }
 
 interface AuthorizedRuntime {
+  readonly projectId: string
   readonly runtimeAuthorization?: RuntimeAuthorization
   readonly authorization?: AuthorizationContext
 }
@@ -73,6 +76,8 @@ function atomsFor(request: AuthzRequest): readonly Atom[] {
       return [{ kind: "append:telemetry", id: request.objectTypeId }]
     case "action.apply":
       return [{ kind: "apply:action", id: request.actionId }]
+    case "share.manage":
+      return [{ kind: "share:share", id: request.shareId }]
     case "workflow.run":
       return [{ kind: "run:workflow", id: request.workflowId }]
     case "sync.run":
@@ -133,6 +138,12 @@ export function isAllowed(
 
 export function assertAuthorized(runtime: AuthorizedRuntime, request: AuthzRequest): void {
   const resolved = assertRuntimeAuthorizationBound(runtime)
+  if (resolved.type === "delegated") {
+    throw new AuthorizationError(
+      `delegated:${request.kind}`,
+      `[Sixb] Operation '${request.kind}' is not covered by delegated authorization.`
+    )
+  }
   const authorization = resolved.type === "principal" ? resolved.context : undefined
   const decision = evaluate(authorization, request)
   if (decision.allowed) {
@@ -145,11 +156,18 @@ export function assertAuthorized(runtime: AuthorizedRuntime, request: AuthzReque
   )
 }
 
+/** Runtime catalogs never infer unrestricted access from an absent principal context. */
+export function isRuntimeAllowed(runtime: AuthorizedRuntime, request: AuthzRequest): boolean {
+  const authority = resolveRuntimeAuthorizationForProject(runtime)
+  if (authority.type === "denied" || authority.type === "delegated") return false
+  return authority.type === "unrestricted" || isAllowed(authority.context, request)
+}
+
 /** Resolve registered process-local authority before a protected leaf makes a decision. */
 export function assertRuntimeAuthorizationBound(
   runtime: AuthorizedRuntime
 ): Exclude<ResolvedRuntimeAuthorization, { readonly type: "denied" }> {
-  const resolved = resolveRuntimeAuthorization(runtime.runtimeAuthorization)
+  const resolved = resolveRuntimeAuthorizationForProject(runtime)
   if (resolved.type === "denied") {
     throw new AuthorizationError(
       "runtime:unbound",
@@ -218,27 +236,22 @@ export function assertPrivileged(runtime: AuthorizedRuntime, operation: string):
  * Assert access to process providers that trusted executions and genuine agent runs may use.
  *
  * Agent provenance alone is not authority: the registered capability must be bound to the exact
- * same execution identity and run before this check succeeds.
+ * same immutable execution before this check succeeds.
  */
 export function assertProviderAccess(
-  runtime: AuthorizedRuntime,
+  runtime: AuthorizedRuntime & { readonly runtimeAuthorization: RuntimeAuthorization },
   execution: ExecutionContext,
   operation: string
 ): void {
-  const resolved = assertRuntimeAuthorizationBound(runtime)
+  const resolved = resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization,
+  })
   if (resolved.type === "unrestricted") {
     return
   }
 
-  const binding = resolved.executionBinding
-  const executor = execution.executor
-  if (
-    binding?.type === "agent" &&
-    executor.type === "agent" &&
-    binding.executionId === execution.id &&
-    binding.actorId === executor.actorId &&
-    binding.runId === executor.runId
-  ) {
+  if (execution.executor.type === "agent") {
     return
   }
 
@@ -266,6 +279,8 @@ function deniedMessage(
       return `[Sixb] Principal '${principalId}' is not allowed to append telemetry for object type '${request.objectTypeId}'.`
     case "action.apply":
       return `[Sixb] Principal '${principalId}' is not allowed to apply action '${request.actionId}'.`
+    case "share.manage":
+      return `[Sixb] Principal '${principalId}' is not allowed to manage Share '${request.shareId}'.`
     case "workflow.run":
       return `[Sixb] Principal '${principalId}' is not allowed to run workflow '${request.workflowId}'.`
     case "sync.run":

package/src/authorization/grant-kinds.ts

@@ -17,6 +17,7 @@ export type GrantKind =
   | "edit:object"
   | "append:telemetry"
   | "apply:action"
+  | "share:share"
   | "run:workflow"
   | "run:sync"
   | "run:pipeline"
@@ -35,6 +36,7 @@ export interface GrantUniverse {
   readonly objectTypeIds: ReadonlySet<string>
   readonly datasetIds: ReadonlySet<string>
   readonly actionIds: ReadonlySet<string>
+  readonly shareIds: ReadonlySet<string>
   readonly workflowIds: ReadonlySet<string>
   readonly syncIds: ReadonlySet<string>
   readonly pipelineIds: ReadonlySet<string>
@@ -108,6 +110,11 @@ export const GRANT_KINDS: {
     subject: "action",
     fix: "Add it to 'actions/' or pass it to createSixb({ actions }).",
   },
+  "share:share": {
+    universeKey: "shareIds",
+    subject: "share",
+    fix: "Add it to 'shares/' or pass it to createSixb({ shares }).",
+  },
   "run:workflow": {
     universeKey: "workflowIds",
     subject: "workflow",
@@ -171,6 +178,8 @@ export function grantKindOf(grant: GrantDefinition): GrantKind {
       return "append:telemetry"
     case "apply":
       return "apply:action"
+    case "share":
+      return "share:share"
     case "run":
       return `run:${grant.target}`
     case "observe":
@@ -193,6 +202,7 @@ export function emptyGrantSets(): MutableGrantIndex {
     "edit:object": new Set(),
     "append:telemetry": new Set(),
     "apply:action": new Set(),
+    "share:share": new Set(),
     "run:workflow": new Set(),
     "run:sync": new Set(),
     "run:pipeline": new Set(),

package/src/authorization/index.ts

@@ -10,6 +10,7 @@ export {
   assertRuntimeAuthorizationBound,
   evaluate,
   isAllowed,
+  isRuntimeAllowed,
 } from "./decision"
 export { AuthorizationError } from "./errors"
 export { canViewEvent } from "./event-visibility"

package/src/bootstrap/discovery.ts

@@ -6,8 +6,9 @@
  * for the `Sixb` constructor.
  */
 
+import { AsyncLocalStorage } from "node:async_hooks"
 import { readdir } from "node:fs/promises"
-import { join, relative } from "node:path"
+import { join, relative, resolve } from "node:path"
 import { pathToFileURL } from "node:url"
 import { isActionDefinition } from "../actions"
 import { isConnectorDefinition } from "../connectors"
@@ -21,6 +22,7 @@ import { isRuleDefinition } from "../rules"
 import { RuntimeError } from "../runtime/errors"
 import { isScheduleDefinition } from "../schedules"
 import { isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition } from "../security"
+import { isShareDefinition } from "../shares"
 import { isSyncDefinition } from "../syncs"
 import { isWorkflowDefinition } from "../workflows"
 
@@ -29,13 +31,7 @@ const moduleExtensions = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"])
 export async function discoverOntologySources(
   projectRoot: string
 ): Promise<readonly OntologySource[]> {
-  const ontologyDir = join(projectRoot, "ontology")
-  const modulePaths = await listModuleFiles(ontologyDir)
-  const exportedCandidates = await loadModuleExports({
-    modulePaths,
-    projectRoot,
-    kind: "ontology",
-  })
+  const exportedCandidates = await loadFamilyExports(projectRoot, "ontology", ["ontology"])
 
   const ontologyDocuments: OntologyDocumentInput[] = []
   const objectTypes: ObjectTypeWithPropertyTokens[] = []
@@ -70,7 +66,7 @@ export async function discoverOntologySources(
   return discoveredSources
 }
 
-type DiscoveryModuleKind =
+export type DiscoveryModuleKind =
   | "action"
   | "connector"
   | "dataset"
@@ -82,9 +78,35 @@ type DiscoveryModuleKind =
   | "role"
   | "rule"
   | "schedule"
+  | "share"
   | "sync"
   | "workflow"
 
+/** Build-time inventory; paths are relative to the source project root. */
+export interface ProjectModule {
+  readonly path: string
+  readonly kind: DiscoveryModuleKind
+}
+
+/** Literal imports generated by the CLI put discovery and config in the same bundle graph. */
+export interface BundledProjectModule extends ProjectModule {
+  readonly load: () => Promise<Record<string, unknown>>
+}
+
+const bundledProject = new AsyncLocalStorage<{
+  readonly projectRoot: string
+  readonly modules: readonly BundledProjectModule[]
+}>()
+
+/** Scope both config evaluation and deferred config factories without process-global state. */
+export function withProjectModules<T>(
+  projectRoot: string,
+  modules: readonly BundledProjectModule[],
+  run: () => T
+): T {
+  return bundledProject.run({ projectRoot: resolve(projectRoot), modules }, run)
+}
+
 interface DefinitionDiscoveryFamily<TDefinition> {
   readonly directory: readonly string[]
   readonly kind: Exclude<DiscoveryModuleKind, "ontology">
@@ -136,8 +158,22 @@ const definitionDiscoveryRegistry = {
     kind: "membershipPolicy",
     isDefinition: isMembershipPolicyDefinition,
   },
+  shares: { directory: ["shares"], kind: "share", isDefinition: isShareDefinition },
 } as const satisfies Record<string, DefinitionDiscoveryFamily<unknown>>
 
+/** Inventory every discovery family without evaluating project code. */
+export async function listProjectModules(projectRoot: string): Promise<readonly ProjectModule[]> {
+  const families = [
+    { kind: "ontology" as const, directory: ["ontology"] },
+    ...Object.values(definitionDiscoveryRegistry),
+  ]
+  return (
+    await Promise.all(
+      families.map(({ kind, directory }) => listFamilyModules(projectRoot, kind, directory))
+    )
+  ).flat()
+}
+
 type DefinitionFromFamily<TFamily> =
   TFamily extends DefinitionDiscoveryFamily<infer TDefinition> ? TDefinition : never
 
@@ -166,34 +202,58 @@ async function discoverDefinitionFamily(
   projectRoot: string,
   family: DefinitionDiscoveryFamily<unknown>
 ): Promise<readonly unknown[]> {
-  const modulePaths = await listModuleFiles(join(projectRoot, ...family.directory))
-  const exportedCandidates = await loadModuleExports({
-    modulePaths,
-    projectRoot,
-    kind: family.kind,
-  })
+  const exportedCandidates = await loadFamilyExports(projectRoot, family.kind, family.directory)
 
   return exportedCandidates.filter(family.isDefinition)
 }
 
 // ── Internal helpers ────────────────────────────────────────
 
-async function loadModuleExports(options: {
-  modulePaths: readonly string[]
-  projectRoot: string
-  kind: DiscoveryModuleKind
-}): Promise<unknown[]> {
+async function listFamilyModules(
+  projectRoot: string,
+  kind: DiscoveryModuleKind,
+  directory: readonly string[]
+): Promise<ProjectModule[]> {
+  const paths = await listModuleFiles(join(projectRoot, ...directory))
+  return paths.map((path) => ({ kind, path: relative(projectRoot, path) }))
+}
+
+async function loadFamilyExports(
+  projectRoot: string,
+  kind: DiscoveryModuleKind,
+  directory: readonly string[]
+): Promise<unknown[]> {
+  const project = bundledProject.getStore()
+  if (project) {
+    if (resolve(projectRoot) !== project.projectRoot) {
+      throw new RuntimeError(
+        `Built project discovery is scoped to '${project.projectRoot}', not '${projectRoot}'. ` +
+          "Run the built entry from the project root and use that root in createSixb()."
+      )
+    }
+    return loadModuleExports(project.modules.filter((module) => module.kind === kind))
+  }
+
+  const modules = await listFamilyModules(projectRoot, kind, directory)
+  return loadModuleExports(
+    modules.map((module) => ({
+      ...module,
+      load: () => import(pathToFileURL(resolve(projectRoot, module.path)).href),
+    }))
+  )
+}
+
+async function loadModuleExports(modules: readonly BundledProjectModule[]): Promise<unknown[]> {
   const exportedCandidates: unknown[] = []
   const seen = new Set<unknown>()
 
-  for (const modulePath of options.modulePaths) {
+  for (const module of modules) {
     let moduleNamespace: Record<string, unknown>
     try {
-      moduleNamespace = (await import(pathToFileURL(modulePath).href)) as Record<string, unknown>
+      moduleNamespace = await module.load()
     } catch (error) {
-      const relPath = relative(options.projectRoot, modulePath)
       const reason = error instanceof Error ? error.message : String(error)
-      throw new RuntimeError(`Failed to load ${options.kind} module '${relPath}': ${reason}`)
+      throw new RuntimeError(`Failed to load ${module.kind} module '${module.path}': ${reason}`)
     }
 
     for (const exportedValue of Object.values(moduleNamespace)) {

package/src/bootstrap/index.ts

@@ -1,7 +1,14 @@
-export type { DiscoveredProjectDefinitions } from "./discovery"
+export type {
+  BundledProjectModule,
+  DiscoveredProjectDefinitions,
+  DiscoveryModuleKind,
+  ProjectModule,
+} from "./discovery"
 export {
   discoverOntologySources,
   discoverProjectDefinitions,
+  listProjectModules,
+  withProjectModules,
 } from "./discovery"
 export type {
   GenerateOntologyTypeManifestOptions,

package/src/bootstrap/ontology-type-manifest.ts

@@ -1,4 +1,4 @@
-import { mkdir, readdir, readFile, writeFile } from "node:fs/promises"
+import { access, mkdir, readdir, readFile, writeFile } from "node:fs/promises"
 import { dirname, extname, join, relative, resolve, sep } from "node:path"
 import { pathToFileURL } from "node:url"
 import type { OntologyDocumentInput } from "../ontology/registry"
@@ -75,11 +75,17 @@ export async function generateOntologyTypeManifest(
   const discovery = await discoverOntologyTypeManifest(projectRoot)
 
   if (discovery.moduleCount === 0) {
-    return {
-      ...discovery,
-      path: outFile,
-      written: false,
-      skipped: true,
+    // Leave projects without ontology untouched, but clear a previously generated map.
+    try {
+      await access(outFile)
+    } catch (error) {
+      if (!isNotFoundError(error)) throw error
+      return {
+        ...discovery,
+        path: outFile,
+        written: false,
+        skipped: true,
+      }
     }
   }
 

package/src/datasets/builders.ts

@@ -15,6 +15,7 @@ type DatasetColumnOptions = {
 type DefineDatasetOptions = {
   readonly schema: readonly DatasetColumnDefinition[]
   readonly primaryKey?: DatasetPrimaryKey
+  readonly sequenceBy?: string
   readonly partitionBy?: readonly string[]
   readonly description?: string
 }
@@ -23,6 +24,7 @@ type DeriveDatasetOptions<TParent extends DatasetDefinition> = {
   readonly pick?: readonly DatasetColumnNameOf<TParent>[]
   readonly add?: readonly DatasetColumnDefinition[]
   readonly primaryKey?: DatasetPrimaryKey
+  readonly sequenceBy?: string
   readonly partitionBy?: readonly string[]
   readonly description?: string
 }
@@ -58,8 +60,22 @@ type PrimaryKeyColumnNameOf<TColumns extends readonly DatasetColumnDefinition[]>
 
 type CheckedDefineDatasetOptions<TOptions extends DefineDatasetOptions> = TOptions & {
   readonly primaryKey?: DatasetPrimaryKey<PrimaryKeyColumnNameOf<TOptions["schema"]>>
+  readonly sequenceBy?: SequenceColumnNameOf<TOptions["schema"]>
 }
 
+type SequenceColumnNameOf<TColumns extends readonly DatasetColumnDefinition[]> =
+  string extends ColumnNameOf<TColumns>
+    ? string
+    : {
+        [TName in ColumnNameOf<TColumns>]: ColumnDefinitionOf<TColumns, TName>["type"] extends
+          | "timestamp"
+          | "int64"
+          ? ColumnDefinitionOf<TColumns, TName> extends { readonly nullable: true }
+            ? never
+            : TName
+          : never
+      }[ColumnNameOf<TColumns>]
+
 type PickColumns<
   TColumns extends readonly DatasetColumnDefinition[],
   TNames extends readonly ColumnNameOf<TColumns>[],
@@ -107,8 +123,9 @@ type DatasetColumnResult<
 
 type DatasetDefinitionResult<TId extends string, TOptions extends DefineDatasetOptions> = Omit<
   DatasetDefinition<TId, TOptions["schema"]>,
-  "primaryKey" | "partitionBy" | "description"
+  "primaryKey" | "sequenceBy" | "partitionBy" | "description"
 > &
+  FieldFromOptions<TOptions, "sequenceBy", string> &
   FieldFromOptions<TOptions, "primaryKey", DatasetPrimaryKey> &
   FieldFromOptions<TOptions, "partitionBy", readonly string[]> &
   FieldFromOptions<TOptions, "description", string>
@@ -119,8 +136,9 @@ type DerivedDatasetDefinitionResult<
   TOptions extends DeriveDatasetOptions<TParent> | undefined,
 > = Omit<
   DatasetDefinition<TId, DerivedColumns<TParent, TOptions>>,
-  "primaryKey" | "partitionBy" | "description"
+  "primaryKey" | "sequenceBy" | "partitionBy" | "description"
 > &
+  FieldFromOptions<TOptions, "sequenceBy", string> &
   FieldFromOptions<TOptions, "primaryKey", DatasetPrimaryKey> &
   FieldFromOptions<TOptions, "partitionBy", readonly string[]> &
   FieldFromOptions<TOptions, "description", string>
@@ -130,6 +148,7 @@ type CheckedDeriveDatasetOptions<
   TOptions extends DeriveDatasetOptions<TParent>,
 > = TOptions & {
   readonly primaryKey?: DatasetPrimaryKey<PrimaryKeyColumnNameOf<DerivedColumns<TParent, TOptions>>>
+  readonly sequenceBy?: SequenceColumnNameOf<DerivedColumns<TParent, TOptions>>
 }
 
 export function col<const TName extends string, const TType extends DatasetColumnType>(
@@ -177,6 +196,7 @@ function createDatasetDefinition(id: string, options: DefineDatasetOptions): Dat
         }
       : {}),
     ...(options.partitionBy !== undefined ? { partitionBy: [...options.partitionBy] } : {}),
+    ...(options.sequenceBy !== undefined ? { sequenceBy: options.sequenceBy } : {}),
     ...(options.description !== undefined ? { description: options.description } : {}),
   }
 
@@ -230,6 +250,7 @@ function deriveDatasetDefinition(
   return createDatasetDefinition(id, {
     schema: [...pickedColumns, ...(options.add ?? [])],
     ...(options.primaryKey !== undefined ? { primaryKey: options.primaryKey } : {}),
+    ...(options.sequenceBy !== undefined ? { sequenceBy: options.sequenceBy } : {}),
     ...(options.partitionBy !== undefined ? { partitionBy: options.partitionBy } : {}),
     ...(options.description !== undefined ? { description: options.description } : {}),
   })

package/src/datasets/changes.ts

@@ -1,13 +1,25 @@
 export type MergeChange<Row, Key> =
   | { readonly kind: "upsert"; readonly row: Row }
-  | { readonly kind: "delete"; readonly key: Key }
+  | { readonly kind: "delete"; readonly key: Key; readonly sequence?: string | number | Date }
 
 export const change = {
   upsert<const Row extends object>(row: Row): { readonly kind: "upsert"; readonly row: Row } {
     return { kind: "upsert", row }
   },
 
-  delete<const Key extends object>(key: Key): { readonly kind: "delete"; readonly key: Key } {
-    return { kind: "delete", key }
-  },
+  delete: deleteChange,
+}
+
+function deleteChange<const Key extends object>(
+  key: Key
+): { readonly kind: "delete"; readonly key: Key }
+function deleteChange<const Key extends object, const Sequence extends string | number | Date>(
+  key: Key,
+  options: { readonly sequence: Sequence }
+): { readonly kind: "delete"; readonly key: Key; readonly sequence: Sequence }
+function deleteChange<Key extends object>(
+  key: Key,
+  options?: { readonly sequence: string | number | Date }
+): { readonly kind: "delete"; readonly key: Key; readonly sequence?: string | number | Date } {
+  return { kind: "delete", key, ...(options ? { sequence: options.sequence } : {}) }
 }