@sixb/core 0.1.6 → 0.1.8

package/src/storage/ai-usage/types.ts

@@ -1,4 +1,5 @@
 import type { ReadonlyJsonObject } from "../../json"
+import type { ModelReasoning } from "../../models/language-model"
 
 /** How much normalized token usage a provider reported for one model call. */
 export type AiUsageReportingStatus = "complete" | "partial" | "unavailable"
@@ -31,22 +32,25 @@ export interface AiUsageExecutionSummary {
 
 /** Input for an idempotent model-call ledger append. */
 export interface RecordAiModelCallInput {
+  readonly providerIds?: import("../../models/events").ModelProviderIds
   readonly id: string
   readonly projectId: string
   /** Immutable execution-ledger record that owns this provider call. */
   readonly executionId: string
   /** Queue delivery attempt that made the provider call. */
   readonly attempt: number
-  /** AI SDK generation ID. Tool-loop model calls share it and are distinguished by responseId. */
+  /** Stable call ID generated by the owned model loop. */
   readonly callId: string
   /**
    * Durable group memberships snapshotted when the parent run was admitted. The requester itself
    * is read from the immutable execution record.
    */
   readonly requesterGroupIds: readonly string[]
-  /** AI SDK provider that handled the call, such as `openai`, `anthropic`, or `gateway`. */
+  /** Provider contract that handled the call, such as `anthropic` or `vercel-ai-gateway`. */
   readonly providerId: string
   readonly requestedModelId: string
+  /** Provider-neutral reasoning preference used for this call, when explicitly configured. */
+  readonly requestedReasoning?: ModelReasoning
   /** Provider-returned model identity when the capture path exposes it. */
   readonly responseModelId?: string
   /** Provider-returned response ID used for later usage and cost reconciliation. */

package/src/storage/auth/errors.ts

@@ -1,4 +1,7 @@
 export type AuthStorageErrorCode =
+  | "device_authorization_denied"
+  | "device_authorization_limit_exceeded"
+  | "duplicate_device_authorization"
   | "duplicate_access_token"
   | "duplicate_identity"
   | "duplicate_invitation"
@@ -13,10 +16,13 @@ export type AuthStorageErrorCode =
   | "invalid_input"
   | "invalid_magic_link"
   | "invalid_oidc_attempt"
+  | "invalid_device_authorization"
   | "missing_identity"
   | "missing_invitation"
   | "missing_magic_link"
   | "missing_oidc_attempt"
+  | "missing_device_authorization"
+  | "pending_device_authorization"
   | "missing_access_token"
   | "missing_service_account"
   | "missing_session"

package/src/storage/auth/in-memory/auth-storage.ts

@@ -1,6 +1,8 @@
 import { AuthStorageError } from "../errors"
 import type {
   AuthStorage,
+  CompleteDeviceAuthorizationInput,
+  CompleteDeviceAuthorizationResult,
   CompleteMagicLinkSignInInput,
   CompleteOidcSignInInput,
   CompleteSignInResult,
@@ -12,6 +14,7 @@ import type {
   UserRecord,
 } from "../types"
 import { InMemoryAuthAccessTokenStore } from "./access-tokens"
+import { InMemoryAuthDeviceAuthorizationStore } from "./device-authorizations"
 import { InMemoryAuthGroupMembershipStore } from "./group-memberships"
 import { InMemoryAuthUserIdentityStore } from "./identities"
 import { InMemoryAuthInvitationStore } from "./invitations"
@@ -27,8 +30,10 @@ import {
   cloneRecord,
   consumeMagicLinkRecord,
   consumeOidcAttemptRecord,
+  createAccessTokenRecord,
   createAuthStorageState,
   createSessionRecord,
+  deviceAuthorizationKey,
   getActiveInvitationByEmail,
   getUserByEmail,
   identityKey,
@@ -60,6 +65,7 @@ export class InMemoryAuthStorage implements AuthStorage {
   readonly groupMemberships = new InMemoryAuthGroupMembershipStore(this.state)
   readonly magicLinks = new InMemoryAuthMagicLinkStore(this.state)
   readonly oidcAuthorizationAttempts = new InMemoryAuthOidcAuthorizationAttemptStore(this.state)
+  readonly deviceAuthorizations = new InMemoryAuthDeviceAuthorizationStore(this.state)
 
   snapshot(): InMemoryAuthStorageSnapshot {
     return {
@@ -73,6 +79,7 @@ export class InMemoryAuthStorage implements AuthStorage {
       groupMemberships: structuredClone(this.state.groupMemberships),
       magicLinks: structuredClone(this.state.magicLinks),
       oidcAuthorizationAttempts: structuredClone(this.state.oidcAuthorizationAttempts),
+      deviceAuthorizations: structuredClone(this.state.deviceAuthorizations),
     }
   }
 
@@ -87,6 +94,68 @@ export class InMemoryAuthStorage implements AuthStorage {
     restoreMap(this.state.groupMemberships, snapshot.groupMemberships)
     restoreMap(this.state.magicLinks, snapshot.magicLinks)
     restoreMap(this.state.oidcAuthorizationAttempts, snapshot.oidcAuthorizationAttempts)
+    restoreMap(this.state.deviceAuthorizations, snapshot.deviceAuthorizations)
+  }
+
+  async completeDeviceAuthorization(
+    input: CompleteDeviceAuthorizationInput
+  ): Promise<CompleteDeviceAuthorizationResult> {
+    const key = deviceAuthorizationKey(input.projectId, input.id)
+    const authorization = this.state.deviceAuthorizations.get(key)
+    if (!authorization) {
+      throw new AuthStorageError(
+        "missing_device_authorization",
+        `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`
+      )
+    }
+    if (authorization.deviceCodeHash !== input.deviceCodeHash) {
+      throw new AuthStorageError(
+        "invalid_device_authorization",
+        "[Sixb] Invalid device authorization."
+      )
+    }
+    if (authorization.status === "pending") {
+      throw new AuthStorageError(
+        "pending_device_authorization",
+        "[Sixb] Device authorization is pending."
+      )
+    }
+    if (authorization.status === "denied") {
+      throw new AuthStorageError(
+        "device_authorization_denied",
+        "[Sixb] Device authorization was denied."
+      )
+    }
+    if (
+      authorization.status !== "approved" ||
+      !authorization.approvedUserId ||
+      !authorization.approvedSessionId ||
+      authorization.expiresAt <= input.completedAt
+    ) {
+      throw new AuthStorageError(
+        "invalid_device_authorization",
+        "[Sixb] Device authorization is invalid."
+      )
+    }
+    if (
+      input.accessToken.projectId !== input.projectId ||
+      input.accessToken.subjectType !== "user" ||
+      input.accessToken.subjectId !== authorization.approvedUserId ||
+      input.accessToken.createdBySessionId !== authorization.approvedSessionId
+    ) {
+      throw new AuthStorageError(
+        "invalid_device_authorization",
+        "[Sixb] Device access token is invalid."
+      )
+    }
+    const accessToken = createAccessTokenRecord(this.state, input.accessToken)
+    const consumed = {
+      ...authorization,
+      status: "consumed" as const,
+      consumedAt: new Date(input.completedAt),
+    }
+    this.state.deviceAuthorizations.set(key, cloneRecord(consumed))
+    return { authorization: cloneRecord(consumed), accessToken: cloneRecord(accessToken) }
   }
 
   async completeMagicLinkSignIn(

package/src/storage/auth/in-memory/device-authorizations.ts

@@ -0,0 +1,145 @@
+import { AuthStorageError } from "../errors"
+import type {
+  AuthDeviceAuthorizationStore,
+  CreateDeviceAuthorizationInput,
+  DeviceAuthorizationRecord,
+} from "../types"
+import { MAX_PENDING_DEVICE_AUTHORIZATIONS } from "../types"
+import type { AuthStorageState } from "./shared"
+import {
+  assertNonEmpty,
+  cloneRecord,
+  deviceAuthorizationKey,
+  isActiveSession,
+  sessionKey,
+  userKey,
+} from "./shared"
+
+export class InMemoryAuthDeviceAuthorizationStore implements AuthDeviceAuthorizationStore {
+  constructor(private readonly state: AuthStorageState) {}
+
+  async create(input: CreateDeviceAuthorizationInput): Promise<DeviceAuthorizationRecord> {
+    const id = assertNonEmpty(input.id, "Device authorization id")
+    const projectId = assertNonEmpty(input.projectId, "Project id")
+    for (const [key, authorization] of this.state.deviceAuthorizations) {
+      if (authorization.projectId === projectId && authorization.expiresAt <= input.createdAt) {
+        this.state.deviceAuthorizations.delete(key)
+      }
+    }
+    const pending = [...this.state.deviceAuthorizations.values()].filter(
+      (authorization) => authorization.projectId === projectId && authorization.status === "pending"
+    ).length
+    if (pending >= MAX_PENDING_DEVICE_AUTHORIZATIONS) {
+      throw new AuthStorageError(
+        "device_authorization_limit_exceeded",
+        `[Sixb] Project '${projectId}' has too many pending device authorizations.`
+      )
+    }
+    const key = deviceAuthorizationKey(projectId, id)
+    if (this.state.deviceAuthorizations.has(key)) {
+      throw duplicateAuthorization(id, projectId)
+    }
+    const record: DeviceAuthorizationRecord = {
+      id,
+      projectId,
+      deviceCodeHash: assertNonEmpty(input.deviceCodeHash, "Device code hash"),
+      userCode: assertNonEmpty(input.userCode, "User code"),
+      clientName: assertNonEmpty(input.clientName, "Client name"),
+      tokenName: assertNonEmpty(input.tokenName, "Token name"),
+      tokenExpiresAt: new Date(input.tokenExpiresAt),
+      status: "pending",
+      createdAt: new Date(input.createdAt),
+      expiresAt: new Date(input.expiresAt),
+    }
+    this.state.deviceAuthorizations.set(key, cloneRecord(record))
+    return cloneRecord(record)
+  }
+
+  async getById(params: { readonly projectId: string; readonly id: string }) {
+    const record = this.state.deviceAuthorizations.get(
+      deviceAuthorizationKey(params.projectId, params.id)
+    )
+    return record ? cloneRecord(record) : null
+  }
+
+  async getByUserCode(params: { readonly projectId: string; readonly userCode: string }) {
+    for (const record of this.state.deviceAuthorizations.values()) {
+      if (record.projectId === params.projectId && record.userCode === params.userCode) {
+        return cloneRecord(record)
+      }
+    }
+    return null
+  }
+
+  async approve(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly userId: string
+    readonly sessionId: string
+    readonly approvedAt: Date
+  }): Promise<DeviceAuthorizationRecord> {
+    const record = this.requirePending(params.projectId, params.id, params.approvedAt)
+    const user = this.state.users.get(userKey(params.projectId, params.userId))
+    const session = this.state.sessions.get(sessionKey(params.projectId, params.sessionId))
+    if (
+      !user ||
+      user.status !== "active" ||
+      !session ||
+      session.userId !== user.id ||
+      !isActiveSession(session, params.approvedAt)
+    ) {
+      throw new AuthStorageError(
+        "invalid_device_authorization",
+        "[Sixb] Device authorization requires an active user session."
+      )
+    }
+    const next: DeviceAuthorizationRecord = {
+      ...record,
+      status: "approved",
+      approvedUserId: assertNonEmpty(params.userId, "Approved user id"),
+      approvedSessionId: assertNonEmpty(params.sessionId, "Approved session id"),
+      approvedAt: new Date(params.approvedAt),
+    }
+    this.state.deviceAuthorizations.set(deviceAuthorizationKey(params.projectId, params.id), next)
+    return cloneRecord(next)
+  }
+
+  async deny(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly deniedAt: Date
+  }): Promise<DeviceAuthorizationRecord> {
+    const record = this.requirePending(params.projectId, params.id, params.deniedAt)
+    const next: DeviceAuthorizationRecord = {
+      ...record,
+      status: "denied",
+      deniedAt: new Date(params.deniedAt),
+    }
+    this.state.deviceAuthorizations.set(deviceAuthorizationKey(params.projectId, params.id), next)
+    return cloneRecord(next)
+  }
+
+  private requirePending(projectId: string, id: string, now: Date): DeviceAuthorizationRecord {
+    const record = this.state.deviceAuthorizations.get(deviceAuthorizationKey(projectId, id))
+    if (!record) {
+      throw new AuthStorageError(
+        "missing_device_authorization",
+        `[Sixb] Device authorization '${id}' not found for project '${projectId}'.`
+      )
+    }
+    if (record.status !== "pending" || record.expiresAt <= now) {
+      throw new AuthStorageError(
+        "invalid_device_authorization",
+        `[Sixb] Device authorization '${id}' is no longer pending for project '${projectId}'.`
+      )
+    }
+    return record
+  }
+}
+
+function duplicateAuthorization(id: string, projectId: string): AuthStorageError {
+  return new AuthStorageError(
+    "duplicate_device_authorization",
+    `[Sixb] Device authorization '${id}' already exists for project '${projectId}'.`
+  )
+}

package/src/storage/auth/in-memory/shared.ts

@@ -6,6 +6,7 @@ import type {
   CreateAuthAccessTokenInput,
   CreateAuthServiceAccountInput,
   CreateAuthSessionInput,
+  DeviceAuthorizationRecord,
   GroupMembershipRecord,
   InvitationRecord,
   MagicLinkRecord,
@@ -30,6 +31,7 @@ export interface AuthStorageState {
   readonly groupMemberships: Map<string, GroupMembershipRecord>
   readonly magicLinks: Map<string, MagicLinkRecord>
   readonly oidcAuthorizationAttempts: Map<string, OidcAuthorizationAttemptRecord>
+  readonly deviceAuthorizations: Map<string, DeviceAuthorizationRecord>
 }
 
 export function createAuthStorageState(): AuthStorageState {
@@ -44,6 +46,7 @@ export function createAuthStorageState(): AuthStorageState {
     groupMemberships: new Map(),
     magicLinks: new Map(),
     oidcAuthorizationAttempts: new Map(),
+    deviceAuthorizations: new Map(),
   }
 }
 
@@ -75,6 +78,10 @@ export function sessionKey(projectId: string, id: string): string {
   return scopedKey(projectId, id)
 }
 
+export function deviceAuthorizationKey(projectId: string, id: string): string {
+  return scopedKey(projectId, id)
+}
+
 export function accessTokenKey(projectId: string, id: string): string {
   return scopedKey(projectId, id)
 }

package/src/storage/auth/index.ts

@@ -5,6 +5,7 @@ export type {
   AccessTokenRecord,
   AccessTokenSubjectType,
   AuthAccessTokenStore,
+  AuthDeviceAuthorizationStore,
   AuthGroupMembershipStore,
   AuthInvitationStore,
   AuthMagicLinkStore,
@@ -16,6 +17,8 @@ export type {
   AuthUserIdentityStore,
   AuthUserStore,
   CompleteAuthSessionInput,
+  CompleteDeviceAuthorizationInput,
+  CompleteDeviceAuthorizationResult,
   CompleteMagicLinkSignInInput,
   CompleteOidcSignInInput,
   CompleteSignInResult,
@@ -24,8 +27,11 @@ export type {
   CreateAuthServiceAccountInput,
   CreateAuthSessionInput,
   CreateAuthUserInput,
+  CreateDeviceAuthorizationInput,
   CreateOidcAuthorizationAttemptInput,
   CreateOrUpdateAuthInvitationInput,
+  DeviceAuthorizationRecord,
+  DeviceAuthorizationStatus,
   GroupMembershipRecord,
   GroupMembershipSource,
   InvitationRecord,
@@ -56,3 +62,4 @@ export type {
   UserRecord,
   UserStatus,
 } from "./types"
+export { MAX_PENDING_DEVICE_AUTHORIZATIONS } from "./types"

package/src/storage/auth/types.ts

@@ -5,6 +5,8 @@ export type ServiceAccountStatus = "active" | "suspended"
 export type InvitationStatus = "pending" | "accepted" | "revoked"
 export type GroupMembershipSource = "invitation" | "manual" | "agent"
 export type AccessTokenSubjectType = "user" | "serviceAccount"
+export type DeviceAuthorizationStatus = "pending" | "approved" | "denied" | "consumed"
+export const MAX_PENDING_DEVICE_AUTHORIZATIONS = 100
 
 export interface UserRecord {
   readonly id: string
@@ -140,6 +142,24 @@ export interface OidcAuthorizationAttemptRecord {
   readonly consumedAt?: Date
 }
 
+export interface DeviceAuthorizationRecord {
+  readonly id: string
+  readonly projectId: string
+  readonly deviceCodeHash: string
+  readonly userCode: string
+  readonly clientName: string
+  readonly tokenName: string
+  readonly tokenExpiresAt: Date
+  readonly status: DeviceAuthorizationStatus
+  readonly approvedUserId?: string
+  readonly approvedSessionId?: string
+  readonly createdAt: Date
+  readonly expiresAt: Date
+  readonly approvedAt?: Date
+  readonly deniedAt?: Date
+  readonly consumedAt?: Date
+}
+
 export interface CreateAuthUserInput {
   readonly id: string
   readonly projectId: string
@@ -359,6 +379,31 @@ export interface CreateOidcAuthorizationAttemptInput {
   readonly expiresAt: Date
 }
 
+export interface CreateDeviceAuthorizationInput {
+  readonly id: string
+  readonly projectId: string
+  readonly deviceCodeHash: string
+  readonly userCode: string
+  readonly clientName: string
+  readonly tokenName: string
+  readonly tokenExpiresAt: Date
+  readonly createdAt: Date
+  readonly expiresAt: Date
+}
+
+export interface CompleteDeviceAuthorizationInput {
+  readonly projectId: string
+  readonly id: string
+  readonly deviceCodeHash: string
+  readonly accessToken: CreateAuthAccessTokenInput
+  readonly completedAt: Date
+}
+
+export interface CompleteDeviceAuthorizationResult {
+  readonly authorization: DeviceAuthorizationRecord
+  readonly accessToken: AccessTokenRecord
+}
+
 export interface CompleteMagicLinkSignInInput {
   readonly projectId: string
   readonly magicLinkId: string
@@ -622,6 +667,30 @@ export interface AuthOidcAuthorizationAttemptStore {
   }): Promise<OidcAuthorizationAttemptRecord>
 }
 
+export interface AuthDeviceAuthorizationStore {
+  create(input: CreateDeviceAuthorizationInput): Promise<DeviceAuthorizationRecord>
+  getById(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<DeviceAuthorizationRecord | null>
+  getByUserCode(params: {
+    readonly projectId: string
+    readonly userCode: string
+  }): Promise<DeviceAuthorizationRecord | null>
+  approve(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly userId: string
+    readonly sessionId: string
+    readonly approvedAt: Date
+  }): Promise<DeviceAuthorizationRecord>
+  deny(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly deniedAt: Date
+  }): Promise<DeviceAuthorizationRecord>
+}
+
 export interface AuthStorage {
   readonly users: AuthUserStore
   readonly identities: AuthUserIdentityStore
@@ -633,8 +702,12 @@ export interface AuthStorage {
   readonly groupMemberships: AuthGroupMembershipStore
   readonly magicLinks: AuthMagicLinkStore
   readonly oidcAuthorizationAttempts: AuthOidcAuthorizationAttemptStore
+  readonly deviceAuthorizations: AuthDeviceAuthorizationStore
 
   completeMagicLinkSignIn(input: CompleteMagicLinkSignInInput): Promise<CompleteSignInResult>
   completeOidcSignIn(input: CompleteOidcSignInInput): Promise<CompleteSignInResult>
+  completeDeviceAuthorization(
+    input: CompleteDeviceAuthorizationInput
+  ): Promise<CompleteDeviceAuthorizationResult>
   suspendUserAndRevokeSessions(input: SuspendUserAndRevokeSessionsInput): Promise<UserRecord>
 }

package/src/storage/executions/in-memory.ts

@@ -1,4 +1,5 @@
 import type { AuthStorage } from "../auth"
+import type { ShareSessionStorage } from "../share-sessions"
 import { ExecutionStorageError } from "./errors"
 import type { CreateExecutionInput, ExecutionRecord, ExecutionStorage } from "./types"
 import {
@@ -18,12 +19,17 @@ function executionKey(projectId: string, id: string): string {
 export class InMemoryExecutionStorage implements ExecutionStorage {
   private readonly rows = new Map<string, ExecutionRecord>()
   private readonly runRootOperation: RunRootOperation
+  private readonly shareSessions?: Pick<ShareSessionStorage, "getById">
 
   constructor(
     private readonly auth: AuthStorage,
-    input: { readonly runRootOperation?: RunRootOperation } = {}
+    input: {
+      readonly runRootOperation?: RunRootOperation
+      readonly shareSessions?: Pick<ShareSessionStorage, "getById">
+    } = {}
   ) {
     this.runRootOperation = input.runRootOperation ?? runDirectly
+    this.shareSessions = input.shareSessions
   }
 
   snapshot(): InMemoryExecutionStorageSnapshot {
@@ -54,6 +60,8 @@ export class InMemoryExecutionStorage implements ExecutionStorage {
           const existing = this.rows.get(executionKey(projectId, id))
           return existing ? cloneExecutionRecord(existing) : null
         },
+        getShareSession: async ({ projectId, id }) =>
+          (await this.shareSessions?.getById({ projectId, id })) ?? null,
       })
 
       this.rows.set(key, cloneExecutionRecord(record))

package/src/storage/executions/provider.ts

@@ -22,7 +22,7 @@ export interface ExecutionStorageRow {
   readonly correlationId: string
   /** SQL-only projection of an execution source, used to enforce the parent foreign key. */
   readonly parentExecutionId: string | null
-  readonly authorityKind: "disabled" | "kernel" | "principal" | "trustedPrimitive"
+  readonly authorityKind: "delegated" | "disabled" | "kernel" | "principal" | "trustedPrimitive"
   readonly authorityUserId: string | null
   readonly authorityServiceAccountId: string | null
   readonly authoritySessionId: string | null
@@ -30,6 +30,9 @@ export interface ExecutionStorageRow {
   readonly authorityPrimitiveKind: TrustedPrimitiveKind | null
   readonly authorityPrimitiveId: string | null
   readonly authorityKernelOperation: "ontology.recover" | null
+  readonly authorityDelegationKind: "share" | null
+  readonly authorityDelegationId: string | null
+  readonly authorityDelegationSessionId: string | null
   readonly createdAt: Date
 }
 
@@ -132,6 +135,9 @@ function flattenAuthority(
   ExecutionStorageRow,
   | "authorityAccessTokenId"
   | "authorityKernelOperation"
+  | "authorityDelegationKind"
+  | "authorityDelegationId"
+  | "authorityDelegationSessionId"
   | "authorityKind"
   | "authorityPrimitiveId"
   | "authorityPrimitiveKind"
@@ -147,6 +153,9 @@ function flattenAuthority(
     authorityPrimitiveKind: null,
     authorityPrimitiveId: null,
     authorityKernelOperation: null,
+    authorityDelegationKind: null,
+    authorityDelegationId: null,
+    authorityDelegationSessionId: null,
   }
 
   switch (record.authorizationRef.type) {
@@ -178,6 +187,14 @@ function flattenAuthority(
         authorityPrimitiveKind: record.authorizationRef.primitive.kind,
         authorityPrimitiveId: record.authorizationRef.primitive.id,
       }
+    case "delegated":
+      return {
+        ...empty,
+        authorityKind: "delegated",
+        authorityDelegationKind: record.authorizationRef.delegation.kind,
+        authorityDelegationId: record.authorizationRef.delegation.grantId,
+        authorityDelegationSessionId: record.authorizationRef.delegation.sessionId,
+      }
     case "kernel":
       return {
         ...empty,
@@ -271,6 +288,18 @@ function inflateAuthority(row: ExecutionStorageRow): CreateExecutionInput["autho
           runId: row.executorId,
         },
       }
+    case "delegated":
+      return {
+        type: "delegated",
+        delegation: {
+          kind: requireValue(row.authorityDelegationKind, "authority delegation kind"),
+          grantId: requireValue(row.authorityDelegationId, "authority delegation id"),
+          sessionId: requireValue(
+            row.authorityDelegationSessionId,
+            "authority delegation session id"
+          ),
+        },
+      }
     case "kernel":
       return {
         type: "kernel",

package/src/storage/executions/run-link.ts

@@ -41,28 +41,67 @@ export async function findPrimitiveRunExecution(input: {
   return execution
 }
 
-/** Find the immutable execution and service-account authority owned by one Agent run. */
+/** Resolve the request execution that directly initiated one provider-validated primitive run. */
+export async function findPrimitiveParentRequestExecution(input: {
+  readonly executions: ExecutionStorage
+  readonly projectId: string
+  readonly executionId: string
+  readonly primitive: TrustedPrimitiveRef
+}): Promise<ExecutionRecord | null> {
+  const child = await findPrimitiveRunExecution({
+    ...input,
+    sourceTypes: ["execution"],
+  })
+  if (!child || child.source.type !== "execution") return null
+
+  const parent = await input.executions.getById({
+    projectId: input.projectId,
+    id: child.source.executionId,
+  })
+  if (
+    !parent ||
+    parent.executor.type !== "request" ||
+    parent.source.type !== "http" ||
+    parent.executor.requestId !== parent.source.requestId ||
+    parent.correlationId !== child.correlationId
+  ) {
+    return null
+  }
+  return parent
+}
+
+/** Find the immutable execution and authority owned by one Agent run. */
 export async function findAgentRunExecution(input: {
   readonly executions: ExecutionStorage
   readonly projectId: string
   readonly executionId: string
   readonly runId: string
-  readonly serviceAccountId: string
+  readonly authority:
+    | { readonly type: "managed"; readonly serviceAccountId: string }
+    | { readonly type: "inherited" }
 }): Promise<ExecutionRecord | null> {
   const execution = await input.executions.getById({
     projectId: input.projectId,
     id: input.executionId,
   })
   const authority = execution?.authorizationRef
+  const validAuthority =
+    input.authority.type === "managed"
+      ? authority?.type === "principal" &&
+        authority.principal.type === "serviceAccount" &&
+        authority.principal.id === input.authority.serviceAccountId &&
+        authority.credential === undefined
+      : authority?.type === "disabled" ||
+        (authority?.type === "principal" &&
+          authority.principal.type === "user" &&
+          authority.credential !== undefined)
+
   if (
     !execution ||
     execution.source.type !== "execution" ||
     execution.executor.type !== "agent" ||
     execution.executor.runId !== input.runId ||
-    authority?.type !== "principal" ||
-    authority.principal.type !== "serviceAccount" ||
-    authority.principal.id !== input.serviceAccountId ||
-    authority.credential !== undefined
+    !validAuthority
   ) {
     return null
   }