@sixb/core 0.1.7 → 0.1.9

package/src/storage/executions/run-link.ts

@@ -41,6 +41,35 @@ export async function findPrimitiveRunExecution(input: {
   return execution
 }
 
+/** Resolve the request execution that directly initiated one provider-validated primitive run. */
+export async function findPrimitiveParentRequestExecution(input: {
+  readonly executions: ExecutionStorage
+  readonly projectId: string
+  readonly executionId: string
+  readonly primitive: TrustedPrimitiveRef
+}): Promise<ExecutionRecord | null> {
+  const child = await findPrimitiveRunExecution({
+    ...input,
+    sourceTypes: ["execution"],
+  })
+  if (!child || child.source.type !== "execution") return null
+
+  const parent = await input.executions.getById({
+    projectId: input.projectId,
+    id: child.source.executionId,
+  })
+  if (
+    !parent ||
+    parent.executor.type !== "request" ||
+    parent.source.type !== "http" ||
+    parent.executor.requestId !== parent.source.requestId ||
+    parent.correlationId !== child.correlationId
+  ) {
+    return null
+  }
+  return parent
+}
+
 /** Find the immutable execution and authority owned by one Agent run. */
 export async function findAgentRunExecution(input: {
   readonly executions: ExecutionStorage

package/src/storage/executions/types.ts

@@ -29,6 +29,8 @@ export interface ExecutionRecord {
   readonly id: string
   readonly projectId: string
   readonly requestedBy?: AuthorizablePrincipal
+  /** Requester memberships at admission, independent of current execution authority. */
+  readonly requesterGroupIds: readonly string[]
   readonly executor: DurableExecutionExecutor
   readonly source: DurableExecutionSource
   readonly correlationId: string
@@ -36,8 +38,10 @@ export interface ExecutionRecord {
   readonly createdAt: Date
 }
 
-/** Creation input; the storage boundary assigns the immutable creation timestamp. */
-export type CreateExecutionInput = Omit<ExecutionRecord, "createdAt">
+/** Storage captures root memberships or inherits the parent's snapshot when omitted. */
+export type CreateExecutionInput = Omit<ExecutionRecord, "createdAt" | "requesterGroupIds"> & {
+  readonly requesterGroupIds?: readonly string[]
+}
 
 /** Immutable execution ledger. Records can be created and read, never updated or deleted. */
 export interface ExecutionStorage {

package/src/storage/executions/validation.ts

@@ -1,4 +1,5 @@
 import { isDeepStrictEqual } from "node:util"
+import { normalizeRequesterGroupIds, snapshotRequesterGroupIds } from "../../auth/attribution"
 import type {
   AuthorizablePrincipal,
   AuthorizationRef,
@@ -19,6 +20,34 @@ export interface ExecutionValidationLookup {
     readonly projectId: string
     readonly id: string
   }): Promise<ExecutionRecord | null>
+  getShareSession(params: {
+    readonly projectId: string
+    readonly id: string
+  }): Promise<{ readonly grantId: string } | null>
+}
+
+/** Capture accounting attribution at the same storage boundary that admits the execution. */
+export async function prepareExecutionRecord(
+  input: CreateExecutionInput,
+  lookup: ExecutionValidationLookup
+): Promise<ExecutionRecord> {
+  let groups = input.requesterGroupIds
+  if (groups === undefined && input.source.type === "execution") {
+    const parent = await lookup.getExecution({
+      projectId: input.projectId,
+      id: input.source.executionId,
+    })
+    groups = parent?.requesterGroupIds
+  } else if (groups === undefined && input.requestedBy) {
+    groups = await snapshotRequesterGroupIds({
+      auth: lookup.auth,
+      projectId: input.projectId,
+      principal: input.requestedBy,
+    })
+  }
+  const record = normalizeExecutionRecord({ ...input, requesterGroupIds: groups ?? [] })
+  await validateExecutionRecordReferences(record, lookup)
+  return record
 }
 
 export function normalizeExecutionRecord(
@@ -28,6 +57,7 @@ export function normalizeExecutionRecord(
   const record: ExecutionRecord = {
     id: input.id,
     projectId: input.projectId,
+    requesterGroupIds: normalizeRequesterGroupIds(input.requesterGroupIds ?? []),
     ...(input.requestedBy === undefined ? {} : { requestedBy: structuredClone(input.requestedBy) }),
     executor: structuredClone(input.executor),
     source: structuredClone(input.source),
@@ -56,6 +86,9 @@ export async function validateExecutionRecordReferences(
     )
     await validateCredential(record, lookup)
   }
+  if (record.authorizationRef.type === "delegated") {
+    await validateDelegation(record, lookup)
+  }
 
   await validateParent(record, lookup)
 }
@@ -145,6 +178,17 @@ function assertAuthorizationRef(ref: AuthorizationRef): void {
       assertNonBlank(ref.primitive.id, "Authority primitive id")
       assertNonBlank(ref.primitive.runId, "Authority primitive run id")
       return
+    case "delegated":
+      if (ref.delegation.kind !== "share") {
+        invalid(
+          `Unknown authority delegation kind '${String(
+            (ref.delegation as { kind?: unknown }).kind
+          )}'.`
+        )
+      }
+      assertNonBlank(ref.delegation.grantId, "Authority delegation grant id")
+      assertNonBlank(ref.delegation.sessionId, "Authority delegation session id")
+      return
     case "kernel":
       assertKernelOperation(ref.operation, "Authority kernel operation")
       return
@@ -175,7 +219,13 @@ function assertExecutorAuthority(record: ExecutionRecord): void {
         }
         return
       }
-      invalid("Request executions require principal or explicitly disabled authority.")
+      if (authorizationRef.type === "delegated") {
+        if (requestedBy !== undefined) {
+          invalid("Delegated request executions cannot have a requested-by principal.")
+        }
+        return
+      }
+      invalid("Request executions require principal, delegated, or explicitly disabled authority.")
       break
     }
     case "primitive": {
@@ -294,6 +344,27 @@ async function validateCredential(
   }
 }
 
+async function validateDelegation(
+  record: ExecutionRecord,
+  lookup: ExecutionValidationLookup
+): Promise<void> {
+  if (record.authorizationRef.type !== "delegated") return
+  const { grantId, sessionId } = record.authorizationRef.delegation
+  const session = await lookup.getShareSession({ projectId: record.projectId, id: sessionId })
+  if (!session) {
+    throw new ExecutionStorageError(
+      "missing_credential",
+      `[Sixb] Authority shared session '${sessionId}' does not exist in project '${record.projectId}'.`
+    )
+  }
+  if (session.grantId !== grantId) {
+    throw new ExecutionStorageError(
+      "invalid_credential",
+      `[Sixb] Authority shared session '${sessionId}' does not belong to grant '${grantId}'.`
+    )
+  }
+}
+
 async function validateParent(
   record: ExecutionRecord,
   lookup: ExecutionValidationLookup
@@ -323,6 +394,12 @@ async function validateParent(
       `[Sixb] Child execution '${record.id}' must preserve its parent requested-by principal.`
     )
   }
+  if (!isDeepStrictEqual(parent.requesterGroupIds, record.requesterGroupIds)) {
+    throw new ExecutionStorageError(
+      "invalid_parent_execution",
+      `[Sixb] Child execution '${record.id}' must preserve its parent requester-group snapshot.`
+    )
+  }
   if (
     record.executor.type === "agent" &&
     isInheritedAgentAuthority(record.authorizationRef) &&

package/src/storage/in-memory/index.ts

@@ -2,6 +2,7 @@ import { AsyncLocalStorage } from "node:async_hooks"
 import { InMemoryActionRunStorage } from "../action-runs"
 import { type AgentStorage, InMemoryAgentStorage } from "../agents"
 import { type AiAccountingAttribution, type AiCostStorage, InMemoryAiCostStorage } from "../ai-cost"
+import { directModelCallAttribution } from "../ai-cost/attribution"
 import { type AiLimitStorage, InMemoryAiLimitStorage } from "../ai-limits"
 import { type AiUsageStorage, InMemoryAiUsageStorage } from "../ai-usage"
 import { type AuthStorage, InMemoryAuthStorage } from "../auth"
@@ -21,6 +22,7 @@ import { ProviderMaterializationTransactionLifecycle } from "../ontology/provide
 import {
   createAgentOperationScope,
   createAuthOperationScope,
+  createObjectOperationScope,
   createOntologyOperationScope,
   createOperationScopedFacade,
   createStorageOperationScope,
@@ -29,6 +31,8 @@ import {
 import { InMemoryPipelineRunStorage, type PipelineRunStorage } from "../pipeline-runs"
 import { InMemoryProjectionRunStorage } from "../projection-runs"
 import { InMemoryRulesStorage, type RulesStorage } from "../rules"
+import { InMemoryShareGrantStorage, type ShareGrantStorage } from "../share-grants"
+import { InMemoryShareSessionStorage, type ShareSessionStorage } from "../share-sessions"
 import { InMemorySyncRunStorage, type SyncRunStorage } from "../sync-runs"
 import type { TimeseriesStorage } from "../timeseries"
 import { InMemoryTimeseriesStorage } from "../timeseries/store"
@@ -66,7 +70,11 @@ export class InMemoryStorage implements Storage {
   private readonly timeseriesStorage = new InMemoryTimeseriesStorage()
   private readonly ontologyStorage: InMemoryOntologyStorage
   private readonly authStorage = new InMemoryAuthStorage()
-  private readonly executionStorage = new InMemoryExecutionStorage(this.authStorage)
+  private readonly shareGrantStorage = new InMemoryShareGrantStorage()
+  private readonly shareSessionStorage = new InMemoryShareSessionStorage(this.shareGrantStorage)
+  private readonly executionStorage = new InMemoryExecutionStorage(this.authStorage, {
+    shareSessions: this.shareSessionStorage,
+  })
   private readonly agentStorage = new InMemoryAgentStorage(this.executionStorage)
   private readonly aiUsageStorage = new InMemoryAiUsageStorage(this.executionStorage)
   private readonly aiCostStorage = new InMemoryAiCostStorage(this.aiUsageStorage, {
@@ -123,6 +131,8 @@ export class InMemoryStorage implements Storage {
   readonly workflowInterventions: WorkflowInterventionStorage
   readonly webhookRuns: WebhookRunStorage
   readonly rules: RulesStorage
+  readonly shareGrants: ShareGrantStorage
+  readonly shareSessions: ShareSessionStorage
   readonly fileUploadSessions: FileUploadSessionStore
   readonly connectorConnections: ConnectorConnectionStorage
 
@@ -134,7 +144,7 @@ export class InMemoryStorage implements Storage {
       (run) => this.withStorageOperation(run),
       () => this.assertRootOperationAvailable()
     )
-    this.objects = createOperationScopedFacade(this.objectStorage, scope)
+    this.objects = createObjectOperationScope(this.objectStorage, scope)
     this.timeseries = createOperationScopedFacade(this.timeseriesStorage, scope)
     this.auth = createAuthOperationScope(this.authStorage, scope)
     this.executions = createOperationScopedFacade(this.executionStorage, scope)
@@ -153,6 +163,8 @@ export class InMemoryStorage implements Storage {
     )
     this.webhookRuns = createOperationScopedFacade(this.webhookRunStorage, scope)
     this.rules = createOperationScopedFacade(this.rulesStorage, scope)
+    this.shareGrants = createOperationScopedFacade(this.shareGrantStorage, scope)
+    this.shareSessions = createOperationScopedFacade(this.shareSessionStorage, scope)
     this.fileUploadSessions = createOperationScopedFacade(this.fileUploadSessionStorage, scope)
     this.connectorConnections = createOperationScopedFacade(this.connectorConnectionStorage, scope)
     this.ontologyStorage = new InMemoryOntologyStorage(this.objectStorage, this.timeseriesStorage, {
@@ -177,7 +189,21 @@ export class InMemoryStorage implements Storage {
       projectId: input.projectId,
       id: input.executionId,
     })
-    if (!execution || execution.executor.type !== "agent") return undefined
+    if (!execution) return undefined
+    if (execution.executor.type !== "agent") {
+      const executor = execution.executor
+      return directModelCallAttribution(
+        executor.type === "primitive" ? executor.kind : executor.type,
+        executor.type === "request"
+          ? executor.requestId
+          : executor.type === "primitive"
+            ? executor.runId
+            : null,
+        execution.authorizationRef.type === "trustedPrimitive"
+          ? execution.authorizationRef.primitive.id
+          : null
+      )
+    }
     const directRun = await this.agentStorage.runs.getById({
       projectId: input.projectId,
       id: execution.executor.runId,
@@ -346,6 +372,8 @@ export class InMemoryStorage implements Storage {
       workflowInterventions: this.workflowInterventionStorage,
       webhookRuns: this.webhookRunStorage,
       rules: this.rulesStorage,
+      shareGrants: this.shareGrantStorage,
+      shareSessions: this.shareSessionStorage,
       fileUploadSessions: this.fileUploadSessionStorage,
       connectorConnections: this.connectorConnectionStorage,
       ping: async () => undefined,
@@ -374,6 +402,8 @@ export class InMemoryStorage implements Storage {
       workflowInterventions: this.workflowInterventionStorage.snapshot(),
       webhookRuns: this.webhookRunStorage.snapshot(),
       rules: this.rulesStorage.snapshot(),
+      shareGrants: this.shareGrantStorage.snapshot(),
+      shareSessions: this.shareSessionStorage.snapshot(),
       fileUploadSessions: this.fileUploadSessionStorage.snapshot(),
       connectorConnections: this.connectorConnectionStorage.snapshot(),
     }
@@ -397,6 +427,8 @@ export class InMemoryStorage implements Storage {
     this.workflowInterventionStorage.restore(snapshot.workflowInterventions)
     this.webhookRunStorage.restore(snapshot.webhookRuns)
     this.rulesStorage.restore(snapshot.rules)
+    this.shareGrantStorage.restore(snapshot.shareGrants)
+    this.shareSessionStorage.restore(snapshot.shareSessions)
     this.fileUploadSessionStorage.restore(snapshot.fileUploadSessions)
     this.connectorConnectionStorage.restore(snapshot.connectorConnections)
   }
@@ -420,6 +452,8 @@ export interface InMemoryStorageSnapshot {
   readonly workflowInterventions: ReturnType<InMemoryWorkflowInterventionStorage["snapshot"]>
   readonly webhookRuns: ReturnType<InMemoryWebhookRunStorage["snapshot"]>
   readonly rules: ReturnType<InMemoryRulesStorage["snapshot"]>
+  readonly shareGrants: ReturnType<InMemoryShareGrantStorage["snapshot"]>
+  readonly shareSessions: ReturnType<InMemoryShareSessionStorage["snapshot"]>
   readonly fileUploadSessions: ReturnType<InMemoryFileUploadSessions["snapshot"]>
   readonly connectorConnections: ReturnType<InMemoryConnectorConnectionStorage["snapshot"]>
 }

package/src/storage/index.ts

@@ -17,6 +17,13 @@ export type {
   ProjectionMaterializationIdentity,
 } from "../materialization/model"
 export type { ModelProviderIds } from "../models/events"
+export type { ObjectRef } from "../ontology"
+export type {
+  ShareAccessPlan,
+  ShareScopedActionGrant,
+  ShareScopedGrant,
+  ShareScopedViewGrant,
+} from "../shares/access-plan"
 export type {
   ActionRunEffectsRecord,
   ActionRunFailure,
@@ -44,11 +51,6 @@ export {
   ACTION_RUN_FAILURE_CODES,
   ACTION_RUN_PHASES,
   ActionRunError,
-  actionRunParamsEqual,
-  actionRunPhaseRecordsEqual,
-  actionSubjectsEqual,
-  canRequeueActionRunAfterEnqueueFailure,
-  finishActionRunPhase,
   InMemoryActionRunStorage,
   isTerminalActionRun,
 } from "./action-runs"
@@ -190,14 +192,7 @@ export type {
   SummarizeAiUsageExecutionInput,
   SummarizeAiUsageExecutionsInput,
 } from "./ai-usage"
-export {
-  AiUsageStorageError,
-  aggregateAiModelCallUsage,
-  assertAiUsageExecutionId,
-  InMemoryAiUsageStorage,
-  normalizeAiModelCallRecord,
-  normalizeAiModelCallUsage,
-} from "./ai-usage"
+export { AiUsageStorageError, aggregateAiModelCallUsage, InMemoryAiUsageStorage } from "./ai-usage"
 export type {
   AccessTokenRecord,
   AccessTokenSubjectType,
@@ -360,8 +355,6 @@ export type {
   FileUploadStrategy,
 } from "./file-upload-sessions"
 export {
-  createFileUploadId,
-  createUploadExpiresAt,
   DEFAULT_FILE_UPLOAD_SESSION_TTL_MS,
   DEFAULT_FILE_UPLOAD_TERMINAL_SESSION_TTL_MS,
   FileUploadSessionError,
@@ -395,6 +388,10 @@ export {
   step,
 } from "./migrations"
 export type {
+  CompiledObjectReadObjectSelection,
+  CompiledObjectReadRoot,
+  CompiledObjectReadStep,
+  CompiledSelectedObjectReadScope,
   CountObjectsInput,
   CountObjectsResult,
   ExistsObjectsInput,
@@ -415,6 +412,15 @@ export type {
   ObjectQueryCapabilityMap,
   ObjectQueryScalarOperation,
   ObjectQueryScalarOperations,
+  ObjectReadExecutionLimits,
+  ObjectReadLimitMetric,
+  ObjectReadLinkDefinitionSelection,
+  ObjectReadLinkSelection,
+  ObjectReadNode,
+  ObjectReadObjectSelection,
+  ObjectReadRoot,
+  ObjectReadScopeFactory,
+  ObjectReadStorage,
   ObjectRow,
   ObjectRowLinks,
   ObjectStorage,
@@ -422,11 +428,19 @@ export type {
   QueryObjectLinksResult,
   QueryObjectsInput,
   QueryObjectsResult,
+  SelectedObjectReadScope,
 } from "./objects"
 export {
+  assertObjectReaderProject,
+  assertObjectReadFacetCount,
+  assertObjectReadOutputWithinLimit,
+  compileSelectedObjectReadScope,
   linkBatchKey,
+  MAX_OBJECT_READ_FACETS,
+  ObjectReadLimitExceededError,
   objectBatchKey,
   objectLinkCursor,
+  snapshotObjectReadExecutionLimits,
 } from "./objects"
 export type {
   AbandonSourceMaterializationCandidateInput,
@@ -556,7 +570,6 @@ export type {
   StartPipelineStepRunInput,
 } from "./pipeline-runs"
 export {
-  canRequeuePipelineRunAfterEnqueueFailure,
   InMemoryPipelineRunStorage,
   PIPELINE_RUN_FAILURE_CODES,
   PipelineRunError,
@@ -595,8 +608,6 @@ export {
   PROJECTION_RUN_FAILURE_CODES,
   PROJECTION_RUN_PROGRESS_KEYS,
   ProjectionRunError,
-  projectionRunObjectTypesVisible,
-  zeroProjectionRunProgress,
 } from "./projection-runs"
 export type {
   ListActiveRuleStatesInput,
@@ -610,6 +621,29 @@ export type {
   RulesStorage,
 } from "./rules"
 export { InMemoryRulesStorage } from "./rules"
+export type {
+  CreateShareGrantInput,
+  GetShareGrantByIdInput,
+  ListShareGrantsInput,
+  ListShareGrantsResult,
+  RevokeShareGrantInput,
+  ShareAuthoritySnapshot,
+  ShareAuthoritySnapshotV1,
+  ShareGrantRecord,
+  ShareGrantStorage,
+  ShareGrantStorageErrorCode,
+} from "./share-grants"
+export { InMemoryShareGrantStorage, ShareGrantStorageError } from "./share-grants"
+export type {
+  CreateShareSessionInput,
+  GetShareSessionByIdInput,
+  RenewShareSessionIfValidInput,
+  RevokeShareSessionInput,
+  ShareSessionRecord,
+  ShareSessionStorage,
+  ShareSessionStorageErrorCode,
+} from "./share-sessions"
+export { InMemoryShareSessionStorage, ShareSessionStorageError } from "./share-sessions"
 export type {
   FinishSyncRunInput,
   ListLatestSyncRunsInput,
@@ -624,12 +658,7 @@ export type {
   SyncRunStatus,
   SyncRunStorage,
 } from "./sync-runs"
-export {
-  canRequeueSyncRunAfterEnqueueFailure,
-  InMemorySyncRunStorage,
-  SYNC_RUN_FAILURE_CODES,
-  SyncRunError,
-} from "./sync-runs"
+export { InMemorySyncRunStorage, SYNC_RUN_FAILURE_CODES, SyncRunError } from "./sync-runs"
 export type {
   TimeseriesHistoryBatchInput,
   TimeseriesHistoryBatchResult,
@@ -637,11 +666,7 @@ export type {
   TimeseriesPoint,
   TimeseriesStorage,
 } from "./timeseries"
-export {
-  assertTransactionActive,
-  createTransactionStorageProxy,
-  throwNestedStorageTransaction,
-} from "./transaction"
+
 export type { Storage, StorageTransactionOptions } from "./types"
 export type {
   FinishWebhookRunInput,

package/src/storage/internal.ts

@@ -0,0 +1,20 @@
+/** Implementation exports for Sixb packages only. */
+
+export {
+  actionRunParamsEqual,
+  actionRunPhaseRecordsEqual,
+  actionSubjectsEqual,
+  canRequeueActionRunAfterEnqueueFailure,
+  finishActionRunPhase,
+} from "./action-runs/idempotency"
+export { assertAiUsageExecutionId, normalizeAiModelCallRecord } from "./ai-usage/record"
+export { normalizeAiModelCallUsage } from "./ai-usage/usage"
+export { createFileUploadId, createUploadExpiresAt } from "./file-upload-sessions/utils"
+export { canRequeuePipelineRunAfterEnqueueFailure } from "./pipeline-runs/idempotency"
+export { projectionRunObjectTypesVisible, zeroProjectionRunProgress } from "./projection-runs/types"
+export { canRequeueSyncRunAfterEnqueueFailure } from "./sync-runs/idempotency"
+export {
+  assertTransactionActive,
+  createTransactionStorageProxy,
+  throwNestedStorageTransaction,
+} from "./transaction"