@sixb/core 0.1.6 → 0.1.8

package/src/shares/session-protocol.ts

@@ -0,0 +1,258 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto"
+import { formatSessionCookieValue, parseSessionCookieValue } from "../auth/sessions"
+import type { SixbHostView } from "../runtime"
+import type { ShareGrantRecord, ShareSessionRecord, Storage } from "../storage"
+import { ShareSessionStorageError } from "../storage"
+import { type ShareAccessPlan, snapshotShareAccessPlan } from "./access-plan"
+import { compileShareAccessPlan } from "./compiler"
+import { intersectShareAccessPlans } from "./intersection"
+
+export const DEFAULT_SHARED_SESSION_INACTIVITY_TTL_MS = 15 * 60_000
+
+const MAX_CREATE_ATTEMPTS = 5
+const SECRET_PATTERN = /^[A-Za-z0-9_-]{43}$/
+
+export interface SharedSessionContext {
+  readonly grantId: string
+  readonly sessionId: string
+  readonly destinationPath: string
+  readonly access: ShareAccessPlan
+  readonly expiresAt: Date
+  readonly absoluteExpiresAt: Date
+}
+
+export interface SharedSessionCredential {
+  readonly context: SharedSessionContext
+  /** Opaque value for the HttpOnly shared-session cookie. */
+  readonly cookieValue: string
+}
+
+export interface SharedSessionProtocolOptions {
+  readonly host: SixbHostView
+  readonly inactivityTtlMs?: number
+  readonly now?: () => Date
+}
+
+/**
+ * Framework-owned shared-session lifecycle.
+ *
+ * Link and session secrets are verified here. Callers receive only an effective access plan built
+ * from the issued snapshot intersected with the Share definition registered now.
+ */
+export class SharedSessionProtocol {
+  private readonly host: SixbHostView
+  private readonly inactivityTtlMs: number
+  private readonly now: () => Date
+
+  constructor(options: SharedSessionProtocolOptions) {
+    if (!options.host.storage.shareGrants || !options.host.storage.shareSessions) {
+      throw new Error("[Sixb] Shared sessions require share grant and session storage.")
+    }
+    const inactivityTtlMs = options.inactivityTtlMs ?? DEFAULT_SHARED_SESSION_INACTIVITY_TTL_MS
+    if (!Number.isSafeInteger(inactivityTtlMs) || inactivityTtlMs <= 0) {
+      throw new Error("[Sixb] Shared session inactivity TTL must be a positive integer.")
+    }
+    this.host = options.host
+    this.inactivityTtlMs = inactivityTtlMs
+    this.now = options.now ?? (() => new Date())
+  }
+
+  async exchange(grantId: string, secret: string): Promise<SharedSessionCredential | null> {
+    if (!validIdentifier(grantId) || !validSecret(secret)) return null
+    const now = this.currentTime()
+
+    for (let attempt = 0; attempt < MAX_CREATE_ATTEMPTS; attempt += 1) {
+      const sessionSecret = randomBytes(32).toString("base64url")
+      const sessionId = `shs_${randomUUID()}`
+      try {
+        const result = await this.host.storage.transaction(async (tx) => {
+          const grant = await activeGrant(tx, this.host.projectId, grantId, now)
+          const secretMatches = secretMatchesHash(secret, grant?.tokenHash ?? "")
+          if (!grant || !secretMatches) return null
+          const sessions = requireSessions(tx)
+          const absoluteExpiresAt = new Date(grant.expiresAt)
+          const session = await sessions.create({
+            id: sessionId,
+            projectId: this.host.projectId,
+            grantId: grant.id,
+            tokenHash: sha256(sessionSecret),
+            createdAt: now,
+            expiresAt: inactivityDeadline(now, absoluteExpiresAt, this.inactivityTtlMs),
+            absoluteExpiresAt,
+          })
+          return { grant, session }
+        })
+        if (!result) return null
+        return {
+          context: this.context(result.grant, result.session),
+          cookieValue: formatSessionCookieValue(sessionId, sessionSecret),
+        }
+      } catch (error) {
+        if (
+          error instanceof ShareSessionStorageError &&
+          error.code === "duplicate" &&
+          attempt < MAX_CREATE_ATTEMPTS - 1
+        ) {
+          continue
+        }
+        throw error
+      }
+    }
+
+    return null
+  }
+
+  async resolve(
+    grantId: string,
+    cookieValue: string | undefined,
+    options: { readonly activity?: "background" | "foreground" } = {}
+  ): Promise<SharedSessionContext | null> {
+    if (!validIdentifier(grantId) || !validCookieValue(cookieValue)) return null
+    const credential = parseSessionCookieValue(cookieValue)
+    if (
+      !credential ||
+      !validIdentifier(credential.sessionId) ||
+      !validSecret(credential.sessionSecret)
+    ) {
+      return null
+    }
+    const now = this.currentTime()
+    const tokenHash = sha256(credential.sessionSecret)
+
+    const result = await this.host.storage.transaction(async (tx) => {
+      const sessions = requireSessions(tx)
+      const current = await sessions.getById({
+        projectId: this.host.projectId,
+        id: credential.sessionId,
+      })
+      const secretMatches = secretMatchesHash(credential.sessionSecret, current?.tokenHash ?? "")
+      if (
+        !current ||
+        current.grantId !== grantId ||
+        current.revokedAt !== undefined ||
+        current.expiresAt.getTime() <= now.getTime() ||
+        current.absoluteExpiresAt.getTime() <= now.getTime() ||
+        !secretMatches
+      ) {
+        return null
+      }
+
+      const grant = await activeGrant(tx, this.host.projectId, grantId, now)
+      if (!grant || current.absoluteExpiresAt.getTime() !== grant.expiresAt.getTime()) {
+        return null
+      }
+
+      if (options.activity !== "foreground") return { grant, session: current }
+
+      const renewed = await sessions.renewIfValid({
+        projectId: this.host.projectId,
+        id: current.id,
+        grantId,
+        tokenHash,
+        now,
+        expiresAt: inactivityDeadline(now, current.absoluteExpiresAt, this.inactivityTtlMs),
+      })
+      return renewed ? { grant, session: renewed } : null
+    })
+
+    return result ? this.context(result.grant, result.session) : null
+  }
+
+  async revoke(context: Pick<SharedSessionContext, "grantId" | "sessionId">): Promise<void> {
+    const revokedAt = this.currentTime()
+    await this.host.storage.transaction(async (tx) => {
+      const session = await requireSessions(tx).getById({
+        projectId: this.host.projectId,
+        id: context.sessionId,
+      })
+      if (!session || session.grantId !== context.grantId) return
+      await requireSessions(tx).revoke({
+        projectId: this.host.projectId,
+        id: context.sessionId,
+        revokedAt,
+      })
+    })
+  }
+
+  private context(grant: ShareGrantRecord, session: ShareSessionRecord): SharedSessionContext {
+    return {
+      grantId: grant.id,
+      sessionId: session.id,
+      destinationPath: grant.destinationPath,
+      access: effectiveAccess(this.host, grant),
+      expiresAt: new Date(session.expiresAt),
+      absoluteExpiresAt: new Date(session.absoluteExpiresAt),
+    }
+  }
+
+  private currentTime(): Date {
+    const now = this.now()
+    if (!(now instanceof Date) || !Number.isFinite(now.getTime())) {
+      throw new Error("[Sixb] Shared session clock returned an invalid date.")
+    }
+    return new Date(now)
+  }
+}
+
+function effectiveAccess(host: SixbHostView, grant: ShareGrantRecord): ShareAccessPlan {
+  const definition = host.definitions.shares.getById(grant.definitionId)
+  if (!definition || definition.target.objectTypeId !== grant.target.objectTypeId) {
+    return snapshotShareAccessPlan({ grants: [] })
+  }
+  const current = compileShareAccessPlan({
+    share: definition,
+    target: grant.target,
+    ontology: host.definitions.ontology,
+    actions: host.definitions.actions,
+  })
+  return intersectShareAccessPlans(grant.authoritySnapshot.access, current)
+}
+
+async function activeGrant(
+  storage: Storage,
+  projectId: string,
+  grantId: string,
+  now: Date
+): Promise<ShareGrantRecord | null> {
+  const grant = await storage.shareGrants?.getById({ projectId, id: grantId })
+  return !grant || grant.revokedAt !== undefined || grant.expiresAt.getTime() <= now.getTime()
+    ? null
+    : grant
+}
+
+function requireSessions(storage: Storage): NonNullable<Storage["shareSessions"]> {
+  if (!storage.shareSessions) {
+    throw new Error("[Sixb] Shared session storage is not configured.")
+  }
+  return storage.shareSessions
+}
+
+function inactivityDeadline(now: Date, absolute: Date, ttlMs: number): Date {
+  return new Date(Math.min(absolute.getTime(), now.getTime() + ttlMs))
+}
+
+function secretMatchesHash(secret: string, expectedHash: string): boolean {
+  const actual = createHash("sha256").update(secret).digest()
+  const expected = /^[0-9a-f]{64}$/.test(expectedHash)
+    ? Buffer.from(expectedHash, "hex")
+    : Buffer.alloc(actual.length)
+  return timingSafeEqual(actual, expected)
+}
+
+function sha256(value: string): string {
+  return createHash("sha256").update(value).digest("hex")
+}
+
+function validIdentifier(value: unknown): value is string {
+  return (
+    typeof value === "string" && value.length > 0 && value.length <= 128 && value.trim() === value
+  )
+}
+
+function validSecret(value: unknown): value is string {
+  return typeof value === "string" && SECRET_PATTERN.test(value)
+}
+
+function validCookieValue(value: unknown): value is string {
+  return typeof value === "string" && value.length <= 256
+}

package/src/shares/types.ts

@@ -0,0 +1,76 @@
+import type { ObjectActionDefinition } from "../actions"
+import type {
+  LinkPathSelectionInput,
+  LinkPathSelectionMode,
+  ObjectTypeWithPropertyTokens,
+} from "../ontology"
+
+declare const shareTargetBrand: unique symbol
+
+/** Contextual placeholder for the one exact object supplied when a Share is issued. */
+export interface ShareTarget<TObjectTypeId extends string = string> {
+  readonly [shareTargetBrand]: true
+  readonly objectTypeId: TObjectTypeId
+}
+
+export interface ShareViewGrant<TObjectTypeId extends string = string> {
+  readonly kind: "object.view"
+  readonly targetObjectTypeId: TObjectTypeId
+  readonly links: LinkPathSelectionMode
+}
+
+export interface ShareViewGrantBuilder<TObjectTypeId extends string = string>
+  extends ShareViewGrant<TObjectTypeId> {
+  /** Include every direct link present when a grant is issued. Nested links remain excluded. */
+  withLinks(): ShareViewGrant<TObjectTypeId>
+  /** Include only these link paths. Use a bare link token when it has no nested links. */
+  withLinks<const TLinks extends readonly LinkPathSelectionInput<TObjectTypeId>[]>(
+    links: TLinks
+  ): ShareViewGrant<TObjectTypeId>
+}
+
+export interface ShareActionGrant<
+  TActionId extends string = string,
+  TObjectTypeId extends string = string,
+> {
+  readonly kind: "action.apply"
+  readonly actionId: TActionId
+  readonly subjectObjectTypeId: TObjectTypeId
+}
+
+export interface ShareActionGrantBuilder<
+  TAction extends ObjectActionDefinition = ObjectActionDefinition,
+> {
+  on(
+    target: ShareTarget<TAction["binding"]["objectType"]["id"]>
+  ): ShareActionGrant<TAction["id"], TAction["binding"]["objectType"]["id"]>
+}
+
+export type ShareScopeGrant = ShareViewGrant | ShareActionGrant
+
+export interface ShareDefinition<
+  TId extends string = string,
+  TTargetObjectTypeId extends string = string,
+> {
+  readonly kind: "share"
+  /**
+   * Durable authority identity. Removing a definition suspends its grants; reusing the id can make
+   * unexpired grants effective again after intersection. Revoke them before permanent removal.
+   */
+  readonly id: TId
+  readonly target: {
+    readonly kind: "object"
+    readonly objectTypeId: TTargetObjectTypeId
+  }
+  readonly grants: readonly ShareScopeGrant[]
+  readonly description?: string
+}
+
+export interface DefineShareOptions<
+  TTarget extends ObjectTypeWithPropertyTokens,
+  TGrants extends readonly ShareScopeGrant[],
+> {
+  readonly target: TTarget
+  readonly grants: (context: { readonly target: ShareTarget<TTarget["id"]> }) => TGrants
+  readonly description?: string
+}

package/src/shares/validation.ts

@@ -0,0 +1,40 @@
+import type { ActionDefinitionCatalog } from "../actions"
+import type { OntologyDefinitionCatalog } from "../ontology"
+import { snapshotShareDefinition } from "./builders"
+import { compileShareAccessPlan } from "./compiler"
+import { ShareDefinitionError } from "./errors"
+import type { ShareDefinition } from "./types"
+
+/** Cross-validate discovered Share definitions after ontology and Actions are registered. */
+export function validateSharesAtStartup(input: {
+  readonly shares: readonly ShareDefinition[]
+  readonly ontology: OntologyDefinitionCatalog
+  readonly actions: ActionDefinitionCatalog
+}): ReadonlyMap<string, ShareDefinition> {
+  const byId = new Map<string, ShareDefinition>()
+  for (const authoredShare of input.shares) {
+    const share = snapshotShareDefinition(authoredShare)
+    if (byId.has(share.id)) {
+      throw invalid(`Duplicate Share id: ${share.id}`)
+    }
+    compileShareAccessPlan({
+      share,
+      target: {
+        objectTypeId: share.target.objectTypeId,
+        primaryId: "__sixb_share_definition_validation__",
+      },
+      ontology: input.ontology,
+      actions: input.actions,
+    })
+    byId.set(share.id, share)
+  }
+  return byId
+}
+
+export function assertShareDefinitionEnvelope(value: unknown): asserts value is ShareDefinition {
+  snapshotShareDefinition(value)
+}
+
+function invalid(message: string): ShareDefinitionError {
+  return new ShareDefinitionError(`[Sixb] ${message}`)
+}

package/src/storage/agents/errors.ts

@@ -1,6 +1,7 @@
 export type AgentStorageErrorCode =
   | "thread_not_found"
   | "active_run_exists"
+  | "active_child_limit"
   | "run_not_found"
   | "invalid_input"
   | "invalid_state"

package/src/storage/agents/in-memory.ts

@@ -11,7 +11,11 @@ import {
   assertAgentContextCheckpointAuthority,
   assertAgentContextCheckpointReplayState,
   assertAgentRunExecution,
+  assertConversationAgentRunSpec,
   assertCreateAgentContextCheckpointInput,
+  assertCreateSubagentRunInput,
+  assertSubagentRunResult,
+  subagentRunMatchesCreateInput,
 } from "./provider"
 import type {
   AgentContextCheckpointRecord,
@@ -26,9 +30,11 @@ import type {
   AgentThreadStore,
   AppendAgentMessageInput,
   ConfirmAgentRunExecutionOwnershipInput,
+  ConversationAgentRunRecord,
   CreateAgentContextCheckpointInput,
   CreateAgentRunInput,
   CreateAgentThreadInput,
+  CreateSubagentRunInput,
   DeleteAgentMessagesByRunInput,
   FinishAgentRunInput,
   FinishQueuedAgentRunInput,
@@ -40,6 +46,7 @@ import type {
   ListAgentThreadsResult,
   ReclaimAgentRunInput,
   StartAgentRunInput,
+  SubagentRunRecord,
 } from "./types"
 import { AGENT_RUN_FAILURE_CODES } from "./types"
 
@@ -125,7 +132,6 @@ class InMemoryAgentThreadStore implements AgentThreadStore {
     const record: AgentThreadRecord = {
       id: input.id,
       projectId: input.projectId,
-      agentId: input.agentId,
       ownerPrincipal: clone(input.ownerPrincipal),
       ...(input.title === undefined ? {} : { title: input.title }),
       status: input.status ?? "active",
@@ -147,12 +153,8 @@ class InMemoryAgentThreadStore implements AgentThreadStore {
   async list(input: ListAgentThreadsInput): Promise<ListAgentThreadsResult> {
     const order = input.order ?? "desc"
     const statuses = input.statuses ? new Set(input.statuses) : null
-    const agentIds = input.agentIds ? new Set(input.agentIds) : null
-
     const filtered = [...this.state.threads.values()]
       .filter((thread) => thread.projectId === input.projectId)
-      .filter((thread) => (input.agentId ? thread.agentId === input.agentId : true))
-      .filter((thread) => (agentIds ? agentIds.has(thread.agentId) : true))
       .filter((thread) => (statuses ? statuses.has(thread.status) : true))
       .filter((thread) =>
         input.ownerPrincipal ? principalsEqual(thread.ownerPrincipal, input.ownerPrincipal) : true
@@ -180,13 +182,13 @@ class InMemoryAgentRunStore implements AgentRunStore {
     private readonly executions: ExecutionStorage
   ) {}
 
-  async create(input: CreateAgentRunInput): Promise<AgentRunRecord> {
+  async create(input: CreateAgentRunInput): Promise<ConversationAgentRunRecord> {
+    assertConversationAgentRunSpec(input.spec)
     await assertAgentRunExecution({
       executions: this.executions,
       projectId: input.projectId,
       executionId: input.executionId,
       runId: input.id,
-      agentId: input.agentId,
     })
     // No `await` between read and write: the in-memory critical section is atomic, so two concurrent
     // queued runs on the same thread cannot both win — the second observes `activeRunId` set.
@@ -224,13 +226,14 @@ class InMemoryAgentRunStore implements AgentRunStore {
     }
 
     const createdAt = new Date(input.createdAt ?? new Date())
-    const run: AgentRunRecord = {
+    const run: ConversationAgentRunRecord = {
+      kind: "conversation",
       id: input.id,
       projectId: input.projectId,
       executionId: input.executionId,
       threadId: input.threadId,
-      agentId: input.agentId,
       triggerMessageId: input.triggerMessageId,
+      spec: clone(input.spec),
       requesterGroupIds: normalizeRequesterGroupIds(input.requesterGroupIds),
       status: "queued",
       attempt: 0,
@@ -248,6 +251,94 @@ class InMemoryAgentRunStore implements AgentRunStore {
     return clone(run)
   }
 
+  async createSubagent(input: CreateSubagentRunInput): Promise<SubagentRunRecord> {
+    assertCreateSubagentRunInput(input)
+    const execution = await assertAgentRunExecution({
+      executions: this.executions,
+      projectId: input.projectId,
+      executionId: input.executionId,
+      runId: input.id,
+    })
+
+    const runKey = key(input.projectId, input.id)
+    const existing = this.state.runs.get(runKey)
+    if (existing) {
+      if (subagentRunMatchesCreateInput(existing, input)) return clone(existing)
+      throw new AgentStorageError(
+        "duplicate_id",
+        `[Sixb] Subagent run '${input.id}' already exists with different immutable inputs.`
+      )
+    }
+
+    const parent = this.state.runs.get(key(input.projectId, input.parentRunId))
+    if (!parent || parent.kind !== "conversation") {
+      throw new AgentStorageError(
+        "run_not_found",
+        `[Sixb] Parent Agent run '${input.parentRunId}' was not found.`
+      )
+    }
+    if (parent.status !== "running") {
+      throw new AgentStorageError(
+        "invalid_state",
+        `[Sixb] Parent Agent run '${parent.id}' is not running (status '${parent.status}').`
+      )
+    }
+    if (
+      execution.source.type !== "execution" ||
+      execution.source.executionId !== parent.executionId
+    ) {
+      throw new AgentStorageError(
+        "invalid_input",
+        `[Sixb] Subagent execution '${execution.id}' is not a child of parent execution '${parent.executionId}'.`
+      )
+    }
+    if (parent.execution?.token !== input.parentExecutionToken) {
+      throw new AgentStorageError(
+        "execution_lost",
+        `[Sixb] Parent Agent run '${parent.id}' is no longer owned by this execution.`
+      )
+    }
+    const activeChildren = [...this.state.runs.values()].filter(
+      (run) =>
+        run.kind === "subagent" &&
+        run.projectId === input.projectId &&
+        run.parentRunId === parent.id &&
+        (run.status === "queued" || run.status === "running")
+    ).length
+    if (activeChildren >= input.maxActiveChildren) {
+      throw new AgentStorageError(
+        "active_child_limit",
+        `[Sixb] Agent run '${parent.id}' already has ${activeChildren} active subagents.`
+      )
+    }
+    if (
+      [...this.state.runs.values()].some(
+        (run) => run.projectId === input.projectId && run.executionId === input.executionId
+      )
+    ) {
+      throw new AgentStorageError(
+        "duplicate_id",
+        `[Sixb] Execution '${input.executionId}' already belongs to another Agent run.`
+      )
+    }
+
+    const run: SubagentRunRecord = {
+      kind: "subagent",
+      id: input.id,
+      projectId: input.projectId,
+      executionId: input.executionId,
+      parentRunId: input.parentRunId,
+      spawnKey: input.spawnKey,
+      spec: clone(input.spec),
+      requesterGroupIds: clone(parent.requesterGroupIds),
+      status: "queued",
+      attempt: 0,
+      createdAt: new Date(input.createdAt ?? new Date()),
+    }
+    this.state.runs.set(runKey, clone(run))
+    return clone(run)
+  }
+
   async start(input: StartAgentRunInput): Promise<AgentRunRecord> {
     const run = this.requireStatus(input.projectId, input.id, "queued")
     const startedAt = new Date(input.startedAt ?? new Date())
@@ -320,6 +411,15 @@ class InMemoryAgentRunStore implements AgentRunStore {
         `[Sixb] Execution token is no longer current on agent run '${input.id}'.`
       )
     }
+    if (input.status === "succeeded" && run.kind === "subagent") {
+      assertSubagentRunResult(input.result, run.id)
+    }
+    if (input.status === "succeeded" && run.kind === "conversation" && input.result !== undefined) {
+      throw new AgentStorageError(
+        "invalid_input",
+        `[Sixb] Conversational Agent run '${run.id}' cannot persist a subagent result.`
+      )
+    }
 
     const completedAt = new Date(input.completedAt ?? new Date())
     const next: AgentRunRecord = {
@@ -328,6 +428,9 @@ class InMemoryAgentRunStore implements AgentRunStore {
       ...(input.modelId === undefined ? {} : { modelId: input.modelId }),
       ...(input.finishReason === undefined ? {} : { finishReason: input.finishReason }),
       ...(input.diagnostics === undefined ? {} : { diagnostics: clone(input.diagnostics) }),
+      ...(input.status === "succeeded" && input.result !== undefined
+        ? { result: clone(input.result) }
+        : {}),
       ...(input.status === "succeeded" || input.error === undefined
         ? {}
         : { error: normalizeFailure(input.error) }),
@@ -359,11 +462,17 @@ class InMemoryAgentRunStore implements AgentRunStore {
   async list(input: ListAgentRunsInput): Promise<ListAgentRunsResult> {
     const order = input.order ?? "desc"
     const statuses = input.statuses ? new Set(input.statuses) : null
+    const kinds = input.kinds ? new Set(input.kinds) : null
 
     const filtered = [...this.state.runs.values()]
       .filter((run) => run.projectId === input.projectId)
-      .filter((run) => (input.threadId ? run.threadId === input.threadId : true))
-      .filter((run) => (input.agentId ? run.agentId === input.agentId : true))
+      .filter((run) => (kinds ? kinds.has(run.kind) : true))
+      .filter((run) =>
+        input.threadId ? run.kind === "conversation" && run.threadId === input.threadId : true
+      )
+      .filter((run) =>
+        input.parentRunId ? run.kind === "subagent" && run.parentRunId === input.parentRunId : true
+      )
       .filter((run) => (statuses ? statuses.has(run.status) : true))
       .filter((run) =>
         input.startedAfter ? (run.startedAt ?? run.createdAt) >= input.startedAfter : true
@@ -405,6 +514,7 @@ class InMemoryAgentRunStore implements AgentRunStore {
   }
 
   private releaseThread(run: AgentRunRecord, completedAt: Date): void {
+    if (run.kind !== "conversation") return
     const threadKey = key(run.projectId, run.threadId)
     const thread = this.state.threads.get(threadKey)
     if (thread && thread.activeRunId === run.id) {

package/src/storage/agents/index.ts

@@ -16,6 +16,7 @@ export type {
   AgentRunExecution,
   AgentRunFailureCode,
   AgentRunFinishReason,
+  AgentRunKind,
   AgentRunRecord,
   AgentRunStatus,
   AgentRunStore,
@@ -25,9 +26,12 @@ export type {
   AgentThreadStore,
   AppendAgentMessageInput,
   ConfirmAgentRunExecutionOwnershipInput,
+  ConversationAgentRunRecord,
+  ConversationAgentRunSpec,
   CreateAgentContextCheckpointInput,
   CreateAgentRunInput,
   CreateAgentThreadInput,
+  CreateSubagentRunInput,
   DeleteAgentMessagesByRunInput,
   FinishAgentRunInput,
   FinishQueuedAgentRunInput,
@@ -39,6 +43,9 @@ export type {
   ListAgentThreadsResult,
   ReclaimAgentRunInput,
   StartAgentRunInput,
+  SubagentRunRecord,
+  SubagentRunResult,
+  SubagentRunSpec,
 } from "./types"
 export {
   AGENT_RUN_DIAGNOSTIC_CODES,