@sixb/core 0.1.5 → 0.1.7

package/src/execution/authorization.ts

@@ -1,5 +1,5 @@
 import type { Principal } from "../auth"
-import { emptyGrantSets, GRANT_KIND_KEYS } from "../authorization/grant-kinds"
+import { emptyGrantSets, TARGETED_GRANT_KIND_KEYS } from "../authorization/grant-kinds"
 import type { AuthorizationContext, GrantIndex } from "../authorization/types"
 import { createSixbError } from "../errors/internal"
 import {
@@ -27,6 +27,8 @@ export type ResolvedRuntimeAuthorization =
       readonly type: "unrestricted"
       readonly projectId: string
       readonly ref: Exclude<AuthorizationRef, { readonly type: "principal" }>
+      /** Process-local binding used by provider façades that explicitly support agent runs. */
+      readonly executionBinding?: AgentExecutionBinding
     }
   | { readonly type: "denied" }
 
@@ -42,7 +44,7 @@ type PrincipalAuthorizationContext = Omit<AuthorizationContext, "principal"> & {
 interface AgentExecutionBinding {
   readonly type: "agent"
   readonly executionId: string
-  readonly agentId: string
+  readonly actorId?: string
   readonly runId: string
 }
 
@@ -56,25 +58,51 @@ export function createPrincipalRuntimeAuthorization(input: {
   return createRegisteredPrincipalAuthorization(input)
 }
 
-/** Register service-account authority bound to one exact agent run. */
+/** Register restored authority bound to one exact agent run. */
 export function createAgentRuntimeAuthorization(input: {
   readonly projectId: string
-  readonly context: AuthorizationContext
   readonly executionId: string
-  readonly agentId: string
+  readonly actorId?: string
   readonly runId: string
+  readonly authority:
+    | {
+        readonly type: "principal"
+        readonly context: AuthorizationContext
+        readonly credential?: Extract<
+          AuthorizationRef,
+          { readonly type: "principal" }
+        >["credential"]
+      }
+    | { readonly type: "disabled" }
 }): RuntimeAuthorization {
-  if (input.context.principal.type !== "serviceAccount") {
-    throw new Error("[Sixb] Agent execution authority must belong to a service account.")
-  }
   assertNonEmpty(input.executionId, "Execution id")
-  assertNonEmpty(input.agentId, "Agent id")
+  if (input.actorId !== undefined) assertNonEmpty(input.actorId, "Agent actor id")
   assertNonEmpty(input.runId, "Agent run id")
-  return createRegisteredPrincipalAuthorization(input, {
+  const executionBinding: AgentExecutionBinding = {
     type: "agent",
     executionId: input.executionId,
-    agentId: input.agentId,
+    ...(input.actorId === undefined ? {} : { actorId: input.actorId }),
     runId: input.runId,
+  }
+
+  if (input.authority.type === "principal") {
+    return createRegisteredPrincipalAuthorization(
+      {
+        projectId: input.projectId,
+        context: input.authority.context,
+        ...(input.authority.credential === undefined
+          ? {}
+          : { credential: input.authority.credential }),
+      },
+      executionBinding
+    )
+  }
+
+  return register({
+    type: "unrestricted",
+    projectId: input.projectId,
+    ref: Object.freeze({ type: "disabled" }),
+    executionBinding: Object.freeze(executionBinding),
   })
 }
 
@@ -246,13 +274,9 @@ export function resolveExecutionScopeAuthorization(
 
     case "agent":
       if (
-        resolved.type !== "principal" ||
-        resolved.ref.type !== "principal" ||
-        resolved.ref.principal.type !== "serviceAccount" ||
-        resolved.ref.credential !== undefined ||
         resolved.executionBinding?.type !== "agent" ||
         resolved.executionBinding.executionId !== execution.id ||
-        resolved.executionBinding.agentId !== execution.executor.agentId ||
+        resolved.executionBinding.actorId !== execution.executor.actorId ||
         resolved.executionBinding.runId !== execution.executor.runId
       ) {
         throw invalidExecutionAuthority(
@@ -260,7 +284,12 @@ export function resolveExecutionScopeAuthorization(
           "agent authority does not match its execution binding"
         )
       }
-      return resolved
+      if (resolved.type === "principal" && resolved.ref.type === "principal") return resolved
+      if (resolved.type === "unrestricted" && resolved.ref.type === "disabled") return resolved
+      throw invalidExecutionAuthority(
+        execution.id,
+        "agent authority must be principal or explicitly disabled"
+      )
 
     case "kernel":
       if (
@@ -305,7 +334,8 @@ function snapshotAuthorizationContext(
 ): PrincipalAuthorizationContext {
   const principal = snapshotAuthorizablePrincipal(context.principal)
   const grants = emptyGrantSets()
-  for (const kind of GRANT_KIND_KEYS) {
+  grants["run:agent"] = context.grants["run:agent"]
+  for (const kind of TARGETED_GRANT_KIND_KEYS) {
     grants[kind] = new Set(context.grants[kind])
   }
   const frozenGrants: GrantIndex = Object.freeze(grants)

package/src/execution/request.ts

@@ -9,13 +9,15 @@ export type { ActionRunsRuntime, ActionsRuntime } from "../actions/execution"
 export type {
   AgentRunListResult,
   AgentRunsRuntime,
+  AgentRuntime,
   AgentRunView,
-  AgentsRuntime,
   AgentThreadsRuntime,
   CreateExecutionAgentThreadInput,
   ExecutionAgentRequestInput,
+  ExecutionAgentRunResult,
   ListExecutionAgentThreadsInput,
 } from "../agents/execution"
+export type { AgentDescriptor } from "../agents/types"
 export type { AuthorizationContext } from "../authorization"
 export type { DatasetsRuntime } from "../datasets/execution"
 export type { EventsRuntime } from "../events/execution"
@@ -35,6 +37,7 @@ export type {
 } from "../projections/execution"
 export type { RuleStatesRuntime, RulesRuntime } from "../rules/execution"
 export type { Sixb } from "../runtime/sixb"
+export type { AgentThreadRecord, ListAgentThreadsResult } from "../storage/agents"
 export type { SyncRunsRuntime, SyncsRuntime } from "../syncs/execution"
 export type {
   LatestWorkflowRunListResult,

package/src/execution/types.ts

@@ -33,7 +33,7 @@ export type ExecutionExecutor =
       readonly id: string
       readonly runId: string
     }
-  | { readonly type: "agent"; readonly agentId: string; readonly runId: string }
+  | { readonly type: "agent"; readonly actorId?: string; readonly runId: string }
   | { readonly type: "kernel"; readonly operation: KernelOperation }
 
 /**

package/src/http/api-routes.ts

@@ -406,6 +406,69 @@ export const SIXB_API_ROUTES: readonly SixbApiRoute[] = [
     accessToken: true,
     agentApi: false,
   },
+  {
+    operationId: "getAiAccountingOverview",
+    method: "GET",
+    path: "/api/ai/accounting/overview",
+    accessToken: true,
+    agentApi: false,
+  },
+  {
+    operationId: "listAiModelCalls",
+    method: "GET",
+    path: "/api/ai/model-calls",
+    accessToken: true,
+    agentApi: false,
+  },
+  {
+    operationId: "listAiModelCallGroups",
+    method: "GET",
+    path: "/api/ai/model-call-groups",
+    accessToken: true,
+    agentApi: false,
+  },
+  {
+    operationId: "listAiLimitPolicies",
+    method: "GET",
+    path: "/api/ai/limits",
+    accessToken: true,
+    agentApi: false,
+  },
+  {
+    operationId: "getAiLimitStatus",
+    method: "GET",
+    path: "/api/ai/limits/status",
+    accessToken: true,
+    agentApi: false,
+  },
+  {
+    operationId: "getAiLimitSubjectOptions",
+    method: "GET",
+    path: "/api/ai/limits/subjects",
+    accessToken: true,
+    agentApi: false,
+  },
+  {
+    operationId: "createAiLimitPolicy",
+    method: "POST",
+    path: "/api/ai/limits",
+    accessToken: true,
+    agentApi: false,
+  },
+  {
+    operationId: "updateAiLimitPolicy",
+    method: "PUT",
+    path: "/api/ai/limits/:limitId",
+    accessToken: true,
+    agentApi: false,
+  },
+  {
+    operationId: "deleteAiLimitPolicy",
+    method: "DELETE",
+    path: "/api/ai/limits/:limitId",
+    accessToken: true,
+    agentApi: false,
+  },
 ]
 
 // Enforce the subset invariant at module load: a gateway-proxied route must also be a bearer route,

package/src/index.ts

@@ -427,10 +427,28 @@ export {
   resolveAuthorizationContext,
 } from "./authorization"
 
+// ── AI usage ───────────────────────────────────────────────
+
+export type {
+  AiUsageLimitGroupOption,
+  AiUsageLimitServiceAccountOption,
+  AiUsageLimitSubjectOptions,
+  AiUsageLimitUserOption,
+  AiUsageRuntime,
+  CreateAiUsageLimitPolicyInput,
+  ListAiUsageLimitPoliciesInput,
+  ListAiUsageLimitStatusesInput,
+  ListAiUsageModelCallGroupsInput,
+  ListAiUsageModelCallsInput,
+  QueryAiUsageOverviewInput,
+  UpdateAiUsageLimitPolicyInput,
+} from "./ai-usage"
+
 // ── Security Definitions ───────────────────────────────────
 
 export type {
   AccessGrant,
+  AgentRunGrant,
   AppendGrant,
   ApplicationDefinition,
   ApplyGrant,
@@ -445,6 +463,7 @@ export type {
   GroupDefinition,
   GroupReference,
   ManageGrant,
+  ManageGrantTarget,
   MembershipOperation,
   MembershipPolicyDefinition,
   ObserveGrant,
@@ -748,6 +767,7 @@ export type {
   AgentStepPrompt,
   AgentStepPromptBuilder,
   AgentStepPromptContext,
+  DefineAgentStepConfig,
   InferAgentStepInput,
   InferAgentStepOutput,
   InferInterventionInput,
@@ -827,8 +847,8 @@ export type { ActionRunsRuntime, ActionsRuntime } from "./actions/execution"
 export type {
   AgentRunListResult,
   AgentRunsRuntime,
+  AgentRuntime,
   AgentRunView,
-  AgentsRuntime,
   AgentThreadsRuntime,
   ExecutionAgentRunResult,
 } from "./agents/execution"
@@ -857,6 +877,12 @@ export type {
   OntologyOperationalStatus,
   SixbReadiness,
 } from "./maintenance"
+export type {
+  LanguageModel,
+  LanguageModelDefinition,
+  LanguageModelRateCard,
+  ProviderData,
+} from "./models"
 export type {
   ExecutionObjectByIdHandle,
   ExecutionObjectSet,
@@ -949,18 +975,16 @@ export type {
 // ── Agents ──────────────────────────────────────────────────
 
 export type {
-  AgentContextConfig,
   AgentContextEntryInput,
   AgentContextInput,
   AgentContextOrigin,
   AgentContextPart,
-  AgentDefinition,
+  AgentDescriptor,
   AgentFileDataProjection,
   AgentFileDataResolverInput,
   AgentFilePart,
   AgentInboundUiMessage,
   AgentInboundUiMessagePart,
-  AgentLoopConfig,
   AgentMessage,
   AgentMessagePart,
   AgentMessagePartType,
@@ -973,8 +997,11 @@ export type {
   AgentModelToolCallPart,
   AgentModelToolOutput,
   AgentModelToolResultPart,
+  AgentProviderStatePart,
+  AgentReasoning,
   AgentReasoningLevel,
   AgentReasoningPart,
+  AgentReference,
   AgentRequestErrorCode,
   AgentStepStartPart,
   AgentTextPart,
@@ -983,6 +1010,7 @@ export type {
   AgentToolArtifacts,
   AgentToolCallPart,
   AgentToolCallState,
+  AgentToolCatalog,
   AgentToolContent,
   AgentToolDefinition,
   AgentToolDescriptionBuilder,
@@ -1000,7 +1028,7 @@ export type {
   AgentUiMessage,
   AgentUiMessagePart,
   AgentUiToolPart,
-  DefineAgentConfig,
+  AgentUsageReference,
   InferAgentToolInput,
   InferAgentToolInputSchema,
   RequestAgentRunInput,
@@ -1011,22 +1039,23 @@ export {
   AgentDefinitionError,
   AgentRequestError,
   AgentToolPublicError,
+  agent,
   agentContext,
   agentContextIdentity,
-  defineAgent,
   defineAgentTool,
-  isAgentDefinition,
   MAX_AGENT_APP_STATE_ENTRY_BYTES,
   MAX_AGENT_APP_STATE_TOTAL_BYTES,
   MAX_AGENT_CONTEXT_ENTRIES,
   requestAgentRun,
 } from "./agents"
+export type { AgentThreadRecord, ListAgentThreadsResult } from "./storage/agents"
 
 // ── Models ──────────────────────────────────────────────────
 
 export type {
   LanguageModelCatalog,
   LanguageModelEntry,
+  LanguageModelRef,
   ModelCatalog,
   ModelCatalogInput,
 } from "./models"

package/src/json.ts

@@ -21,6 +21,15 @@ export function assertJsonValue(value: unknown, label = "value"): asserts value
   }
 }
 
+export function isJsonObject(value: unknown): value is JsonObject {
+  return isPlainRecord(value) && isJsonValue(value)
+}
+
+export function assertJsonObject(value: unknown, label = "value"): asserts value is JsonObject {
+  assertJsonValue(value, label)
+  if (!isPlainRecord(value)) throw new Error(`[Sixb] ${label} must be a JSON object.`)
+}
+
 export function cloneJsonValue(value: ReadonlyJsonValue, label = "value"): JsonValue {
   assertJsonValue(value, label)
   return JSON.parse(JSON.stringify(value)) as JsonValue

package/src/models/catalog.ts

@@ -0,0 +1,137 @@
+import { RuntimeError } from "../runtime/errors"
+import {
+  defineLanguageModel,
+  type LanguageModelDefinition,
+  type ModelDefinition,
+} from "./definitions"
+import type { LanguageModel } from "./language-model"
+
+/** Stable identity of one configured language-model binding. */
+export interface LanguageModelRef {
+  readonly provider: string
+  readonly modelId: string
+}
+
+/** The configured language models, with the project default. */
+export interface LanguageModelCatalog {
+  readonly default: LanguageModelEntry
+  list(): readonly LanguageModelEntry[]
+  getByRef(ref: LanguageModelRef): LanguageModelEntry | null
+}
+
+/**
+ * One configured language model.
+ *
+ * The identity describes the configured binding, not only a vendor model. For example,
+ * A gateway binding and a direct provider binding for the same vendor model are distinct because their
+ * `provider` values differ.
+ */
+export interface LanguageModelEntry extends LanguageModelRef {
+  readonly model: LanguageModel
+}
+
+/** Models a project allows Sixb to use, organized by technical model kind. */
+export interface ModelCatalog {
+  readonly language: LanguageModelCatalog
+}
+
+export interface ModelCatalogInput {
+  /** Ordered; the first entry is the project default. */
+  readonly language: readonly LanguageModel[]
+}
+
+/** Build the immutable project model catalog. Rejects invalid, duplicate, and empty catalogs. */
+export function createModelCatalog(input: ModelCatalogInput): ModelCatalog {
+  if (!Array.isArray(input?.language)) {
+    throw new RuntimeError("[Sixb] 'models.language' must be an array of Sixb language models.")
+  }
+
+  const entries: LanguageModelEntry[] = []
+  const byProvider = new Map<string, Map<string, LanguageModelEntry>>()
+
+  for (const [index, model] of input.language.entries()) {
+    assertLanguageModel(model, index)
+
+    let byModelId = byProvider.get(model.providerId)
+    if (byModelId === undefined) {
+      byModelId = new Map()
+      byProvider.set(model.providerId, byModelId)
+    }
+    if (byModelId.has(model.modelId)) {
+      throw new RuntimeError(
+        `[Sixb] Duplicate language model '${model.providerId}/${model.modelId}' in 'models'. Each provider and model id pair may be configured once.`
+      )
+    }
+
+    const entry = Object.freeze({
+      provider: model.providerId,
+      modelId: model.modelId,
+      model,
+    })
+    byModelId.set(model.modelId, entry)
+    entries.push(entry)
+  }
+
+  const [defaultEntry] = entries
+  if (defaultEntry === undefined) {
+    throw new RuntimeError(
+      "[Sixb] 'models.language' needs at least one model. Configure one or omit 'models' from createSixb()."
+    )
+  }
+
+  const listed = Object.freeze(entries.slice())
+  const language: LanguageModelCatalog = Object.freeze({
+    default: defaultEntry,
+    list: () => listed,
+    getByRef: (ref: LanguageModelRef) => byProvider.get(ref.provider)?.get(ref.modelId) ?? null,
+  })
+
+  return Object.freeze({ language })
+}
+
+function assertLanguageModel(model: unknown, index: number): asserts model is LanguageModel {
+  if ((typeof model !== "object" && typeof model !== "function") || model === null) {
+    throw invalidLanguageModel(index, "expected a Sixb LanguageModel instance")
+  }
+
+  const candidate = model as Record<string, unknown>
+  assertModelIdentifier(candidate.providerId, "provider", index)
+  assertModelIdentifier(candidate.modelId, "modelId", index)
+  if (typeof candidate.stream !== "function") {
+    throw invalidLanguageModel(index, "expected 'stream' to be a function")
+  }
+  try {
+    const definition = defineLanguageModel(candidate.definition as LanguageModelDefinition)
+    if (
+      definition.providerId !== candidate.providerId ||
+      definition.modelId !== candidate.modelId
+    ) {
+      throw new Error("definition identity does not match the binding")
+    }
+  } catch (error) {
+    throw invalidLanguageModel(index, error instanceof Error ? error.message : "invalid definition")
+  }
+}
+
+function assertModelIdentifier(value: unknown, field: "provider" | "modelId", index: number): void {
+  if (typeof value !== "string" || value.length === 0) {
+    throw invalidLanguageModel(index, `expected '${field}' to be a non-empty string`)
+  }
+  if (value.trim() !== value) {
+    throw invalidLanguageModel(index, `expected '${field}' not to have surrounding whitespace`)
+  }
+}
+
+function invalidLanguageModel(index: number, detail: string): RuntimeError {
+  return new RuntimeError(
+    `[Sixb] Invalid language model at 'models.language[${index}]': ${detail}.`
+  )
+}
+
+/** Provider-owned metadata lookup, independent from the project's configured bindings. */
+export interface ModelDefinitionCatalog<TDefinition extends ModelDefinition = ModelDefinition> {
+  get(modelId: string): Promise<TDefinition | undefined>
+  list(): Promise<readonly TDefinition[]>
+}
+
+export type LanguageModelDefinitionCatalog = ModelDefinitionCatalog<LanguageModelDefinition>