@sixb/core 0.1.7 → 0.1.9

package/src/shares/session-protocol.ts

@@ -0,0 +1,258 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto"
+import { formatSessionCookieValue, parseSessionCookieValue } from "../auth/sessions"
+import type { SixbHostView } from "../runtime"
+import type { ShareGrantRecord, ShareSessionRecord, Storage } from "../storage"
+import { ShareSessionStorageError } from "../storage"
+import { type ShareAccessPlan, snapshotShareAccessPlan } from "./access-plan"
+import { compileShareAccessPlan } from "./compiler"
+import { intersectShareAccessPlans } from "./intersection"
+
+export const DEFAULT_SHARED_SESSION_INACTIVITY_TTL_MS = 15 * 60_000
+
+const MAX_CREATE_ATTEMPTS = 5
+const SECRET_PATTERN = /^[A-Za-z0-9_-]{43}$/
+
+export interface SharedSessionContext {
+  readonly grantId: string
+  readonly sessionId: string
+  readonly destinationPath: string
+  readonly access: ShareAccessPlan
+  readonly expiresAt: Date
+  readonly absoluteExpiresAt: Date
+}
+
+export interface SharedSessionCredential {
+  readonly context: SharedSessionContext
+  /** Opaque value for the HttpOnly shared-session cookie. */
+  readonly cookieValue: string
+}
+
+export interface SharedSessionProtocolOptions {
+  readonly host: SixbHostView
+  readonly inactivityTtlMs?: number
+  readonly now?: () => Date
+}
+
+/**
+ * Framework-owned shared-session lifecycle.
+ *
+ * Link and session secrets are verified here. Callers receive only an effective access plan built
+ * from the issued snapshot intersected with the Share definition registered now.
+ */
+export class SharedSessionProtocol {
+  private readonly host: SixbHostView
+  private readonly inactivityTtlMs: number
+  private readonly now: () => Date
+
+  constructor(options: SharedSessionProtocolOptions) {
+    if (!options.host.storage.shareGrants || !options.host.storage.shareSessions) {
+      throw new Error("[Sixb] Shared sessions require share grant and session storage.")
+    }
+    const inactivityTtlMs = options.inactivityTtlMs ?? DEFAULT_SHARED_SESSION_INACTIVITY_TTL_MS
+    if (!Number.isSafeInteger(inactivityTtlMs) || inactivityTtlMs <= 0) {
+      throw new Error("[Sixb] Shared session inactivity TTL must be a positive integer.")
+    }
+    this.host = options.host
+    this.inactivityTtlMs = inactivityTtlMs
+    this.now = options.now ?? (() => new Date())
+  }
+
+  async exchange(grantId: string, secret: string): Promise<SharedSessionCredential | null> {
+    if (!validIdentifier(grantId) || !validSecret(secret)) return null
+    const now = this.currentTime()
+
+    for (let attempt = 0; attempt < MAX_CREATE_ATTEMPTS; attempt += 1) {
+      const sessionSecret = randomBytes(32).toString("base64url")
+      const sessionId = `shs_${randomUUID()}`
+      try {
+        const result = await this.host.storage.transaction(async (tx) => {
+          const grant = await activeGrant(tx, this.host.projectId, grantId, now)
+          const secretMatches = secretMatchesHash(secret, grant?.tokenHash ?? "")
+          if (!grant || !secretMatches) return null
+          const sessions = requireSessions(tx)
+          const absoluteExpiresAt = new Date(grant.expiresAt)
+          const session = await sessions.create({
+            id: sessionId,
+            projectId: this.host.projectId,
+            grantId: grant.id,
+            tokenHash: sha256(sessionSecret),
+            createdAt: now,
+            expiresAt: inactivityDeadline(now, absoluteExpiresAt, this.inactivityTtlMs),
+            absoluteExpiresAt,
+          })
+          return { grant, session }
+        })
+        if (!result) return null
+        return {
+          context: this.context(result.grant, result.session),
+          cookieValue: formatSessionCookieValue(sessionId, sessionSecret),
+        }
+      } catch (error) {
+        if (
+          error instanceof ShareSessionStorageError &&
+          error.code === "duplicate" &&
+          attempt < MAX_CREATE_ATTEMPTS - 1
+        ) {
+          continue
+        }
+        throw error
+      }
+    }
+
+    return null
+  }
+
+  async resolve(
+    grantId: string,
+    cookieValue: string | undefined,
+    options: { readonly activity?: "background" | "foreground" } = {}
+  ): Promise<SharedSessionContext | null> {
+    if (!validIdentifier(grantId) || !validCookieValue(cookieValue)) return null
+    const credential = parseSessionCookieValue(cookieValue)
+    if (
+      !credential ||
+      !validIdentifier(credential.sessionId) ||
+      !validSecret(credential.sessionSecret)
+    ) {
+      return null
+    }
+    const now = this.currentTime()
+    const tokenHash = sha256(credential.sessionSecret)
+
+    const result = await this.host.storage.transaction(async (tx) => {
+      const sessions = requireSessions(tx)
+      const current = await sessions.getById({
+        projectId: this.host.projectId,
+        id: credential.sessionId,
+      })
+      const secretMatches = secretMatchesHash(credential.sessionSecret, current?.tokenHash ?? "")
+      if (
+        !current ||
+        current.grantId !== grantId ||
+        current.revokedAt !== undefined ||
+        current.expiresAt.getTime() <= now.getTime() ||
+        current.absoluteExpiresAt.getTime() <= now.getTime() ||
+        !secretMatches
+      ) {
+        return null
+      }
+
+      const grant = await activeGrant(tx, this.host.projectId, grantId, now)
+      if (!grant || current.absoluteExpiresAt.getTime() !== grant.expiresAt.getTime()) {
+        return null
+      }
+
+      if (options.activity !== "foreground") return { grant, session: current }
+
+      const renewed = await sessions.renewIfValid({
+        projectId: this.host.projectId,
+        id: current.id,
+        grantId,
+        tokenHash,
+        now,
+        expiresAt: inactivityDeadline(now, current.absoluteExpiresAt, this.inactivityTtlMs),
+      })
+      return renewed ? { grant, session: renewed } : null
+    })
+
+    return result ? this.context(result.grant, result.session) : null
+  }
+
+  async revoke(context: Pick<SharedSessionContext, "grantId" | "sessionId">): Promise<void> {
+    const revokedAt = this.currentTime()
+    await this.host.storage.transaction(async (tx) => {
+      const session = await requireSessions(tx).getById({
+        projectId: this.host.projectId,
+        id: context.sessionId,
+      })
+      if (!session || session.grantId !== context.grantId) return
+      await requireSessions(tx).revoke({
+        projectId: this.host.projectId,
+        id: context.sessionId,
+        revokedAt,
+      })
+    })
+  }
+
+  private context(grant: ShareGrantRecord, session: ShareSessionRecord): SharedSessionContext {
+    return {
+      grantId: grant.id,
+      sessionId: session.id,
+      destinationPath: grant.destinationPath,
+      access: effectiveAccess(this.host, grant),
+      expiresAt: new Date(session.expiresAt),
+      absoluteExpiresAt: new Date(session.absoluteExpiresAt),
+    }
+  }
+
+  private currentTime(): Date {
+    const now = this.now()
+    if (!(now instanceof Date) || !Number.isFinite(now.getTime())) {
+      throw new Error("[Sixb] Shared session clock returned an invalid date.")
+    }
+    return new Date(now)
+  }
+}
+
+function effectiveAccess(host: SixbHostView, grant: ShareGrantRecord): ShareAccessPlan {
+  const definition = host.definitions.shares.getById(grant.definitionId)
+  if (!definition || definition.target.objectTypeId !== grant.target.objectTypeId) {
+    return snapshotShareAccessPlan({ grants: [] })
+  }
+  const current = compileShareAccessPlan({
+    share: definition,
+    target: grant.target,
+    ontology: host.definitions.ontology,
+    actions: host.definitions.actions,
+  })
+  return intersectShareAccessPlans(grant.authoritySnapshot.access, current)
+}
+
+async function activeGrant(
+  storage: Storage,
+  projectId: string,
+  grantId: string,
+  now: Date
+): Promise<ShareGrantRecord | null> {
+  const grant = await storage.shareGrants?.getById({ projectId, id: grantId })
+  return !grant || grant.revokedAt !== undefined || grant.expiresAt.getTime() <= now.getTime()
+    ? null
+    : grant
+}
+
+function requireSessions(storage: Storage): NonNullable<Storage["shareSessions"]> {
+  if (!storage.shareSessions) {
+    throw new Error("[Sixb] Shared session storage is not configured.")
+  }
+  return storage.shareSessions
+}
+
+function inactivityDeadline(now: Date, absolute: Date, ttlMs: number): Date {
+  return new Date(Math.min(absolute.getTime(), now.getTime() + ttlMs))
+}
+
+function secretMatchesHash(secret: string, expectedHash: string): boolean {
+  const actual = createHash("sha256").update(secret).digest()
+  const expected = /^[0-9a-f]{64}$/.test(expectedHash)
+    ? Buffer.from(expectedHash, "hex")
+    : Buffer.alloc(actual.length)
+  return timingSafeEqual(actual, expected)
+}
+
+function sha256(value: string): string {
+  return createHash("sha256").update(value).digest("hex")
+}
+
+function validIdentifier(value: unknown): value is string {
+  return (
+    typeof value === "string" && value.length > 0 && value.length <= 128 && value.trim() === value
+  )
+}
+
+function validSecret(value: unknown): value is string {
+  return typeof value === "string" && SECRET_PATTERN.test(value)
+}
+
+function validCookieValue(value: unknown): value is string {
+  return typeof value === "string" && value.length <= 256
+}

package/src/shares/types.ts

@@ -0,0 +1,76 @@
+import type { ObjectActionDefinition } from "../actions"
+import type {
+  LinkPathSelectionInput,
+  LinkPathSelectionMode,
+  ObjectTypeWithPropertyTokens,
+} from "../ontology"
+
+declare const shareTargetBrand: unique symbol
+
+/** Contextual placeholder for the one exact object supplied when a Share is issued. */
+export interface ShareTarget<TObjectTypeId extends string = string> {
+  readonly [shareTargetBrand]: true
+  readonly objectTypeId: TObjectTypeId
+}
+
+export interface ShareViewGrant<TObjectTypeId extends string = string> {
+  readonly kind: "object.view"
+  readonly targetObjectTypeId: TObjectTypeId
+  readonly links: LinkPathSelectionMode
+}
+
+export interface ShareViewGrantBuilder<TObjectTypeId extends string = string>
+  extends ShareViewGrant<TObjectTypeId> {
+  /** Include every direct link present when a grant is issued. Nested links remain excluded. */
+  withLinks(): ShareViewGrant<TObjectTypeId>
+  /** Include only these link paths. Use a bare link token when it has no nested links. */
+  withLinks<const TLinks extends readonly LinkPathSelectionInput<TObjectTypeId>[]>(
+    links: TLinks
+  ): ShareViewGrant<TObjectTypeId>
+}
+
+export interface ShareActionGrant<
+  TActionId extends string = string,
+  TObjectTypeId extends string = string,
+> {
+  readonly kind: "action.apply"
+  readonly actionId: TActionId
+  readonly subjectObjectTypeId: TObjectTypeId
+}
+
+export interface ShareActionGrantBuilder<
+  TAction extends ObjectActionDefinition = ObjectActionDefinition,
+> {
+  on(
+    target: ShareTarget<TAction["binding"]["objectType"]["id"]>
+  ): ShareActionGrant<TAction["id"], TAction["binding"]["objectType"]["id"]>
+}
+
+export type ShareScopeGrant = ShareViewGrant | ShareActionGrant
+
+export interface ShareDefinition<
+  TId extends string = string,
+  TTargetObjectTypeId extends string = string,
+> {
+  readonly kind: "share"
+  /**
+   * Durable authority identity. Removing a definition suspends its grants; reusing the id can make
+   * unexpired grants effective again after intersection. Revoke them before permanent removal.
+   */
+  readonly id: TId
+  readonly target: {
+    readonly kind: "object"
+    readonly objectTypeId: TTargetObjectTypeId
+  }
+  readonly grants: readonly ShareScopeGrant[]
+  readonly description?: string
+}
+
+export interface DefineShareOptions<
+  TTarget extends ObjectTypeWithPropertyTokens,
+  TGrants extends readonly ShareScopeGrant[],
+> {
+  readonly target: TTarget
+  readonly grants: (context: { readonly target: ShareTarget<TTarget["id"]> }) => TGrants
+  readonly description?: string
+}

package/src/shares/validation.ts

@@ -0,0 +1,40 @@
+import type { ActionDefinitionCatalog } from "../actions"
+import type { OntologyDefinitionCatalog } from "../ontology"
+import { snapshotShareDefinition } from "./builders"
+import { compileShareAccessPlan } from "./compiler"
+import { ShareDefinitionError } from "./errors"
+import type { ShareDefinition } from "./types"
+
+/** Cross-validate discovered Share definitions after ontology and Actions are registered. */
+export function validateSharesAtStartup(input: {
+  readonly shares: readonly ShareDefinition[]
+  readonly ontology: OntologyDefinitionCatalog
+  readonly actions: ActionDefinitionCatalog
+}): ReadonlyMap<string, ShareDefinition> {
+  const byId = new Map<string, ShareDefinition>()
+  for (const authoredShare of input.shares) {
+    const share = snapshotShareDefinition(authoredShare)
+    if (byId.has(share.id)) {
+      throw invalid(`Duplicate Share id: ${share.id}`)
+    }
+    compileShareAccessPlan({
+      share,
+      target: {
+        objectTypeId: share.target.objectTypeId,
+        primaryId: "__sixb_share_definition_validation__",
+      },
+      ontology: input.ontology,
+      actions: input.actions,
+    })
+    byId.set(share.id, share)
+  }
+  return byId
+}
+
+export function assertShareDefinitionEnvelope(value: unknown): asserts value is ShareDefinition {
+  snapshotShareDefinition(value)
+}
+
+function invalid(message: string): ShareDefinitionError {
+  return new ShareDefinitionError(`[Sixb] ${message}`)
+}

package/src/storage/agents/in-memory.ts

@@ -1,6 +1,5 @@
 import { AGENT_MESSAGE_CONTENT_VERSION } from "../../agents/message"
 import { principalsEqual } from "../../auth"
-import { normalizeRequesterGroupIds } from "../../auth/attribution"
 import { parseSixbFailure } from "../../errors/internal"
 import type { SixbFailure } from "../../errors/types"
 import type { ExecutionStorage } from "../executions"
@@ -234,7 +233,6 @@ class InMemoryAgentRunStore implements AgentRunStore {
       threadId: input.threadId,
       triggerMessageId: input.triggerMessageId,
       spec: clone(input.spec),
-      requesterGroupIds: normalizeRequesterGroupIds(input.requesterGroupIds),
       status: "queued",
       attempt: 0,
       createdAt,
@@ -330,7 +328,6 @@ class InMemoryAgentRunStore implements AgentRunStore {
       parentRunId: input.parentRunId,
       spawnKey: input.spawnKey,
       spec: clone(input.spec),
-      requesterGroupIds: clone(parent.requesterGroupIds),
       status: "queued",
       attempt: 0,
       createdAt: new Date(input.createdAt ?? new Date()),

package/src/storage/agents/types.ts

@@ -148,8 +148,6 @@ interface AgentRunRecordBase {
   readonly id: string
   readonly projectId: string
   readonly executionId: string
-  /** Durable group memberships snapshotted when the run was admitted. */
-  readonly requesterGroupIds: readonly string[]
   readonly status: AgentRunStatus
   readonly modelId?: string
   /** Why the run ended (our own SDK-independent enum). */
@@ -215,7 +213,6 @@ export interface CreateAgentRunInput {
   readonly threadId: string
   readonly triggerMessageId: string
   readonly spec: ConversationAgentRunSpec
-  readonly requesterGroupIds: readonly string[]
   readonly createdAt?: Date
 }
 

package/src/storage/ai-cost/analytics.ts

@@ -168,7 +168,7 @@ export function buildAiAccountingOverview(
         item
       )
     }
-    if (item.attribution?.kind === "workflowAgent") {
+    if (item.attribution?.kind === "workflowAgent" || item.attribution?.kind === "workflow") {
       appendGrouped(workflowItems, item.attribution.workflowId, item)
     }
   }

package/src/storage/ai-cost/attribution.ts

@@ -0,0 +1,15 @@
+import type { AiAccountingAttribution } from "./types"
+
+/** Direct calls are identified by durable provenance, even when their run has been removed. */
+export function directModelCallAttribution(
+  kind: string | null,
+  id: string | null,
+  primitiveId: string | null
+): AiAccountingAttribution | undefined {
+  if (!id) return undefined
+  if (kind === "request") return { kind, requestId: id }
+  if (kind === "action" && primitiveId) return { kind, actionId: primitiveId, actionRunId: id }
+  if (kind === "workflow" && primitiveId)
+    return { kind, workflowId: primitiveId, workflowRunId: id }
+  return undefined
+}

package/src/storage/ai-cost/groups.ts

@@ -1,5 +1,6 @@
 import type { AiAccountingRecordSetItem } from "./analytics"
 import { aiAccountingItemMatchesQuery, normalizeAiModelCallAccountingQuery } from "./analytics"
+import { directModelCallAttribution } from "./attribution"
 import type {
   AiAccountingAttribution,
   AiBillingIdentity,
@@ -56,12 +57,15 @@ export interface AiModelCallGroupRow {
   readonly workflow_node_run_id: string | null
   readonly workflow_id: string | null
   readonly workflow_run_id: string | null
+  readonly executor_kind: string | null
+  readonly executor_id: string | null
+  readonly primitive_id: string | null
 }
 
 export function aiModelCallGroupFragmentFromRow(
   row: AiModelCallGroupRow
 ): AiModelCallGroupFragment {
-  let attribution: AiAccountingAttribution | undefined
+  let attribution = directModelCallAttribution(row.executor_kind, row.executor_id, row.primitive_id)
   if (row.root_agent_run_id && row.root_thread_id) {
     attribution = {
       kind: "agent",

package/src/storage/ai-cost/provider.ts

@@ -12,6 +12,7 @@ export {
   normalizeAiModelCallAccountingQuery,
   toAccountingItem,
 } from "./analytics"
+export { directModelCallAttribution } from "./attribution"
 export type { AiModelCallCostDetails } from "./codec"
 export { aiModelCallCostDetails, parseAiModelCallCostDetails } from "./codec"
 export type {

package/src/storage/ai-cost/types.ts

@@ -181,7 +181,14 @@ export interface AiAccountingOverview {
   readonly workflows: readonly AiAccountingWorkflowBreakdown[]
 }
 
+/**
+ * The execution that made the model call, rather than the request that triggered its work.
+ * `request` identifies a direct call from a request-bound SDK, outside an action or workflow.
+ */
 export type AiAccountingAttribution =
+  | { readonly kind: "request"; readonly requestId: string }
+  | { readonly kind: "action"; readonly actionId: string; readonly actionRunId: string }
+  | { readonly kind: "workflow"; readonly workflowId: string; readonly workflowRunId: string }
   | {
       readonly kind: "agent"
       readonly agentRunId: string

package/src/storage/auth/in-memory.ts

@@ -1 +1 @@
-export { InMemoryAuthStorage } from "./in-memory/index"
+export { InMemoryAuthStorage } from "./in-memory/auth-storage"

package/src/storage/executions/in-memory.ts

@@ -1,11 +1,8 @@
 import type { AuthStorage } from "../auth"
+import type { ShareSessionStorage } from "../share-sessions"
 import { ExecutionStorageError } from "./errors"
 import type { CreateExecutionInput, ExecutionRecord, ExecutionStorage } from "./types"
-import {
-  cloneExecutionRecord,
-  normalizeExecutionRecord,
-  validateExecutionRecordReferences,
-} from "./validation"
+import { cloneExecutionRecord, prepareExecutionRecord } from "./validation"
 
 type RunRootOperation = <T>(run: () => Promise<T> | T) => Promise<T>
 
@@ -18,12 +15,17 @@ function executionKey(projectId: string, id: string): string {
 export class InMemoryExecutionStorage implements ExecutionStorage {
   private readonly rows = new Map<string, ExecutionRecord>()
   private readonly runRootOperation: RunRootOperation
+  private readonly shareSessions?: Pick<ShareSessionStorage, "getById">
 
   constructor(
     private readonly auth: AuthStorage,
-    input: { readonly runRootOperation?: RunRootOperation } = {}
+    input: {
+      readonly runRootOperation?: RunRootOperation
+      readonly shareSessions?: Pick<ShareSessionStorage, "getById">
+    } = {}
   ) {
     this.runRootOperation = input.runRootOperation ?? runDirectly
+    this.shareSessions = input.shareSessions
   }
 
   snapshot(): InMemoryExecutionStorageSnapshot {
@@ -39,21 +41,22 @@ export class InMemoryExecutionStorage implements ExecutionStorage {
 
   async create(input: CreateExecutionInput): Promise<ExecutionRecord> {
     return this.runRootOperation(async () => {
-      const record = normalizeExecutionRecord(input)
-      const key = executionKey(record.projectId, record.id)
+      const key = executionKey(input.projectId, input.id)
       if (this.rows.has(key)) {
         throw new ExecutionStorageError(
           "duplicate_execution",
-          `[Sixb] Execution '${record.id}' already exists in project '${record.projectId}'.`
+          `[Sixb] Execution '${input.id}' already exists in project '${input.projectId}'.`
         )
       }
 
-      await validateExecutionRecordReferences(record, {
+      const record = await prepareExecutionRecord(input, {
         auth: this.auth,
         getExecution: async ({ projectId, id }) => {
           const existing = this.rows.get(executionKey(projectId, id))
           return existing ? cloneExecutionRecord(existing) : null
         },
+        getShareSession: async ({ projectId, id }) =>
+          (await this.shareSessions?.getById({ projectId, id })) ?? null,
       })
 
       this.rows.set(key, cloneExecutionRecord(record))

package/src/storage/executions/provider.ts

@@ -6,6 +6,7 @@ import { normalizeExecutionRecord } from "./validation"
 export {
   type ExecutionValidationLookup,
   normalizeExecutionRecord,
+  prepareExecutionRecord,
   validateExecutionRecordReferences,
 } from "./validation"
 
@@ -19,10 +20,11 @@ export interface ExecutionStorageRow {
   readonly sourceId: string
   readonly requestedByUserId: string | null
   readonly requestedByServiceAccountId: string | null
+  readonly requesterGroupIds: readonly string[]
   readonly correlationId: string
   /** SQL-only projection of an execution source, used to enforce the parent foreign key. */
   readonly parentExecutionId: string | null
-  readonly authorityKind: "disabled" | "kernel" | "principal" | "trustedPrimitive"
+  readonly authorityKind: "delegated" | "disabled" | "kernel" | "principal" | "trustedPrimitive"
   readonly authorityUserId: string | null
   readonly authorityServiceAccountId: string | null
   readonly authoritySessionId: string | null
@@ -30,6 +32,9 @@ export interface ExecutionStorageRow {
   readonly authorityPrimitiveKind: TrustedPrimitiveKind | null
   readonly authorityPrimitiveId: string | null
   readonly authorityKernelOperation: "ontology.recover" | null
+  readonly authorityDelegationKind: "share" | null
+  readonly authorityDelegationId: string | null
+  readonly authorityDelegationSessionId: string | null
   readonly createdAt: Date
 }
 
@@ -40,6 +45,7 @@ export function executionRecordToStorageRow(record: ExecutionRecord): ExecutionS
   return {
     projectId: record.projectId,
     id: record.id,
+    requesterGroupIds: [...record.requesterGroupIds],
     ...executor,
     ...source,
     requestedByUserId: record.requestedBy?.type === "user" ? record.requestedBy.id : null,
@@ -67,6 +73,7 @@ export function executionRecordFromStorageRow(row: ExecutionStorageRow): Executi
     {
       id: row.id,
       projectId: row.projectId,
+      requesterGroupIds: row.requesterGroupIds,
       ...(requestedBy === undefined ? {} : { requestedBy }),
       executor,
       source,
@@ -132,6 +139,9 @@ function flattenAuthority(
   ExecutionStorageRow,
   | "authorityAccessTokenId"
   | "authorityKernelOperation"
+  | "authorityDelegationKind"
+  | "authorityDelegationId"
+  | "authorityDelegationSessionId"
   | "authorityKind"
   | "authorityPrimitiveId"
   | "authorityPrimitiveKind"
@@ -147,6 +157,9 @@ function flattenAuthority(
     authorityPrimitiveKind: null,
     authorityPrimitiveId: null,
     authorityKernelOperation: null,
+    authorityDelegationKind: null,
+    authorityDelegationId: null,
+    authorityDelegationSessionId: null,
   }
 
   switch (record.authorizationRef.type) {
@@ -178,6 +191,14 @@ function flattenAuthority(
         authorityPrimitiveKind: record.authorizationRef.primitive.kind,
         authorityPrimitiveId: record.authorizationRef.primitive.id,
       }
+    case "delegated":
+      return {
+        ...empty,
+        authorityKind: "delegated",
+        authorityDelegationKind: record.authorizationRef.delegation.kind,
+        authorityDelegationId: record.authorizationRef.delegation.grantId,
+        authorityDelegationSessionId: record.authorizationRef.delegation.sessionId,
+      }
     case "kernel":
       return {
         ...empty,
@@ -271,6 +292,18 @@ function inflateAuthority(row: ExecutionStorageRow): CreateExecutionInput["autho
           runId: row.executorId,
         },
       }
+    case "delegated":
+      return {
+        type: "delegated",
+        delegation: {
+          kind: requireValue(row.authorityDelegationKind, "authority delegation kind"),
+          grantId: requireValue(row.authorityDelegationId, "authority delegation id"),
+          sessionId: requireValue(
+            row.authorityDelegationSessionId,
+            "authority delegation session id"
+          ),
+        },
+      }
     case "kernel":
       return {
         type: "kernel",