@sixb/core 0.1.7 → 0.1.9

package/src/storage/share-sessions/record.ts

@@ -0,0 +1,176 @@
+import { ShareSessionStorageError } from "./errors"
+import type {
+  CreateShareSessionInput,
+  GetShareSessionByIdInput,
+  RenewShareSessionIfValidInput,
+  RevokeShareSessionInput,
+  ShareSessionRecord,
+} from "./types"
+
+const SHA256_HEX = /^[0-9a-f]{64}$/
+
+export function normalizeShareSessionCreate(input: CreateShareSessionInput): ShareSessionRecord {
+  if (!isRecord(input)) throw invalidInput("Share session create input must be an object.")
+  const createdAt = inputDate(input.createdAt, "Share session creation time")
+  const expiresAt = inputDate(input.expiresAt, "Share session inactivity expiry")
+  const absoluteExpiresAt = inputDate(input.absoluteExpiresAt, "Share session absolute expiry")
+  if (expiresAt.getTime() <= createdAt.getTime()) {
+    throw invalidInput("Share session inactivity expiry must be later than creation time.")
+  }
+  if (absoluteExpiresAt.getTime() <= createdAt.getTime()) {
+    throw invalidInput("Share session absolute expiry must be later than creation time.")
+  }
+  if (expiresAt.getTime() > absoluteExpiresAt.getTime()) {
+    throw invalidInput("Share session inactivity expiry must not exceed its absolute expiry.")
+  }
+
+  return {
+    id: identifier(input.id, "Share session id"),
+    projectId: identifier(input.projectId, "Project id"),
+    grantId: identifier(input.grantId, "Share grant id"),
+    tokenHash: sha256(input.tokenHash, "Share session token hash"),
+    createdAt,
+    expiresAt,
+    absoluteExpiresAt,
+  }
+}
+
+export function parseShareSessionRecord(input: unknown): ShareSessionRecord {
+  if (!isRecord(input)) throw invalidRecord("Share session row must be an object.")
+  try {
+    const createdAt = storedDate(input.createdAt, "Share session creation time")
+    const expiresAt = storedDate(input.expiresAt, "Share session inactivity expiry")
+    const absoluteExpiresAt = storedDate(input.absoluteExpiresAt, "Share session absolute expiry")
+    if (expiresAt.getTime() <= createdAt.getTime()) {
+      throw invalidRecord("Share session inactivity expiry must be later than creation time.")
+    }
+    if (absoluteExpiresAt.getTime() <= createdAt.getTime()) {
+      throw invalidRecord("Share session absolute expiry must be later than creation time.")
+    }
+    if (expiresAt.getTime() > absoluteExpiresAt.getTime()) {
+      throw invalidRecord("Share session inactivity expiry exceeds its absolute expiry.")
+    }
+
+    const revokedAtValue = input.revokedAt
+    if (revokedAtValue === null) {
+      throw invalidRecord("Share session revocation time must be omitted rather than null.")
+    }
+    const revokedAt =
+      revokedAtValue === undefined
+        ? undefined
+        : storedDate(revokedAtValue, "Share session revocation time")
+    if (revokedAt && revokedAt.getTime() < createdAt.getTime()) {
+      throw invalidRecord("Share session revocation time must not precede creation time.")
+    }
+
+    return {
+      id: identifier(input.id, "Share session id"),
+      projectId: identifier(input.projectId, "Project id"),
+      grantId: identifier(input.grantId, "Share grant id"),
+      tokenHash: sha256(input.tokenHash, "Share session token hash"),
+      createdAt,
+      expiresAt,
+      absoluteExpiresAt,
+      ...(revokedAt === undefined ? {} : { revokedAt }),
+    }
+  } catch (error) {
+    if (error instanceof ShareSessionStorageError) {
+      if (error.code === "invalid_record") throw error
+      throw invalidRecord(error.message.replace(/^\[Sixb\] /, ""), error)
+    }
+    throw error
+  }
+}
+
+export function normalizeGetShareSessionByIdInput(
+  input: GetShareSessionByIdInput
+): GetShareSessionByIdInput {
+  if (!isRecord(input)) throw invalidInput("Share session lookup input must be an object.")
+  return {
+    projectId: identifier(input.projectId, "Project id"),
+    id: identifier(input.id, "Share session id"),
+  }
+}
+
+export function normalizeRenewShareSessionIfValidInput(
+  input: RenewShareSessionIfValidInput
+): RenewShareSessionIfValidInput {
+  if (!isRecord(input)) throw invalidInput("Share session renewal input must be an object.")
+  const now = inputDate(input.now, "Share session renewal time")
+  const expiresAt = inputDate(input.expiresAt, "Requested Share session expiry")
+  if (expiresAt.getTime() <= now.getTime()) {
+    throw invalidInput("Requested Share session expiry must be later than renewal time.")
+  }
+  return {
+    projectId: identifier(input.projectId, "Project id"),
+    id: identifier(input.id, "Share session id"),
+    grantId: identifier(input.grantId, "Share grant id"),
+    tokenHash: sha256(input.tokenHash, "Share session token hash"),
+    now,
+    expiresAt,
+  }
+}
+
+export function normalizeRevokeShareSessionInput(
+  input: RevokeShareSessionInput,
+  createdAt?: Date
+): RevokeShareSessionInput {
+  if (!isRecord(input)) throw invalidInput("Share session revocation input must be an object.")
+  const normalized = {
+    projectId: identifier(input.projectId, "Project id"),
+    id: identifier(input.id, "Share session id"),
+    revokedAt: inputDate(input.revokedAt, "Share session revocation time"),
+  }
+  if (createdAt && normalized.revokedAt.getTime() < createdAt.getTime()) {
+    throw invalidInput("Share session revocation time must not precede creation time.")
+  }
+  return normalized
+}
+
+export function cloneShareSessionRecord(input: ShareSessionRecord): ShareSessionRecord {
+  return structuredClone(input)
+}
+
+function identifier(value: unknown, label: string): string {
+  if (typeof value !== "string" || value.trim().length === 0 || value.includes("\0")) {
+    throw invalidInput(`${label} must be a non-empty string without NUL bytes.`)
+  }
+  return value
+}
+
+function sha256(value: unknown, label: string): string {
+  if (typeof value !== "string" || !SHA256_HEX.test(value)) {
+    throw invalidInput(`${label} must be a lowercase SHA-256 hex digest.`)
+  }
+  return value
+}
+
+function inputDate(value: unknown, label: string): Date {
+  if (!(value instanceof Date) || !Number.isFinite(value.getTime())) {
+    throw invalidInput(`${label} must be a valid Date.`)
+  }
+  return new Date(value)
+}
+
+function storedDate(value: unknown, label: string): Date {
+  const parsed =
+    value instanceof Date
+      ? new Date(value)
+      : typeof value === "string"
+        ? new Date(value)
+        : new Date(Number.NaN)
+  if (!Number.isFinite(parsed.getTime())) throw invalidRecord(`${label} is invalid.`)
+  return parsed
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+function invalidInput(message: string, cause?: unknown): ShareSessionStorageError {
+  return new ShareSessionStorageError("invalid_input", `[Sixb] ${message}`, { cause })
+}
+
+function invalidRecord(message: string, cause?: unknown): ShareSessionStorageError {
+  return new ShareSessionStorageError("invalid_record", `[Sixb] ${message}`, { cause })
+}

package/src/storage/share-sessions/types.ts

@@ -0,0 +1,57 @@
+/** Durable server-side session created after a Share link secret is exchanged. */
+export interface ShareSessionRecord {
+  readonly id: string
+  readonly projectId: string
+  readonly grantId: string
+  /** SHA-256 of the bearer session secret. The plaintext secret is never durable. */
+  readonly tokenHash: string
+  readonly createdAt: Date
+  /** Sliding inactivity deadline. */
+  readonly expiresAt: Date
+  /** Immutable upper bound, normally inherited from the Share grant expiry. */
+  readonly absoluteExpiresAt: Date
+  readonly revokedAt?: Date
+}
+
+export type CreateShareSessionInput = Omit<ShareSessionRecord, "revokedAt">
+
+export interface GetShareSessionByIdInput {
+  readonly projectId: string
+  readonly id: string
+}
+
+export interface RenewShareSessionIfValidInput {
+  readonly projectId: string
+  readonly id: string
+  readonly grantId: string
+  readonly tokenHash: string
+  /** Explicit clock keeps expiry semantics deterministic across providers. */
+  readonly now: Date
+  /** Requested sliding inactivity deadline. Storage clamps it to the absolute deadline. */
+  readonly expiresAt: Date
+}
+
+export interface RevokeShareSessionInput {
+  readonly projectId: string
+  readonly id: string
+  readonly revokedAt: Date
+}
+
+/** Persistence contract for short-lived Share access sessions. */
+export interface ShareSessionStorage {
+  /** `(projectId, id)` and `(projectId, tokenHash)` must both be unique. */
+  create(input: CreateShareSessionInput): Promise<ShareSessionRecord>
+
+  /** Load one project-scoped session, including expired or revoked sessions, or return null. */
+  getById(input: GetShareSessionByIdInput): Promise<ShareSessionRecord | null>
+
+  /**
+   * Atomically authenticate and renew an active session. Mismatched, expired, or revoked sessions
+   * return null. A renewal never shortens the current deadline and never exceeds
+   * `absoluteExpiresAt`.
+   */
+  renewIfValid(input: RenewShareSessionIfValidInput): Promise<ShareSessionRecord | null>
+
+  /** Preserve and return the first revocation; a missing session returns null. */
+  revoke(input: RevokeShareSessionInput): Promise<ShareSessionRecord | null>
+}

package/src/storage/transaction.ts

@@ -1,12 +1,21 @@
 import { StorageTransactionError } from "./errors"
+import { createObjectOperationScope } from "./operation-scope"
+import type { Storage } from "./types"
 
 type ObjectLike = Record<PropertyKey, unknown>
 
-export function createTransactionStorageProxy<T extends object>(
+export function createTransactionStorageProxy<T extends Storage>(
   target: T,
   isActive: () => boolean
 ): T {
   const proxies = new WeakMap<object, object>()
+  const objectStorage = createObjectOperationScope(target.objects, {
+    assertAvailable: () => assertTransactionActive(isActive),
+    run: async <TResult>(operation: () => Promise<TResult> | TResult): Promise<TResult> => {
+      assertTransactionActive(isActive)
+      return operation()
+    },
+  })
 
   const wrap = <TValue extends object>(value: TValue): TValue => {
     const existing = proxies.get(value)
@@ -19,7 +28,10 @@ export function createTransactionStorageProxy<T extends object>(
       // from `tx` are wrapped (a handful), not the row/link data graph, and never per-record.
       get(current, property, receiver) {
         assertTransactionActive(isActive)
-        const result = Reflect.get(current, property, receiver)
+        const result =
+          current === target && property === "objects"
+            ? objectStorage
+            : Reflect.get(current, property, receiver)
         if (typeof result === "function") {
           return (...args: unknown[]) => {
             assertTransactionActive(isActive)

package/src/storage/types.ts

@@ -12,6 +12,8 @@ import type { OntologyStorage } from "./ontology"
 import type { PipelineRunStorage } from "./pipeline-runs"
 import type { ProjectionRunStorage } from "./projection-runs"
 import type { RulesStorage } from "./rules"
+import type { ShareGrantStorage } from "./share-grants"
+import type { ShareSessionStorage } from "./share-sessions"
 import type { SyncRunStorage } from "./sync-runs"
 import type { TimeseriesStorage } from "./timeseries/types"
 import type { WebhookRunStorage } from "./webhook-runs"
@@ -231,6 +233,29 @@ export type {
   RuleStateRecord,
   RulesStorage,
 } from "./rules"
+export type {
+  CreateShareGrantInput,
+  GetShareGrantByIdInput,
+  ListShareGrantsInput,
+  ListShareGrantsResult,
+  RevokeShareGrantInput,
+  ShareAuthoritySnapshot,
+  ShareAuthoritySnapshotV1,
+  ShareGrantRecord,
+  ShareGrantStorage,
+  ShareGrantStorageErrorCode,
+} from "./share-grants"
+export { ShareGrantStorageError } from "./share-grants"
+export type {
+  CreateShareSessionInput,
+  GetShareSessionByIdInput,
+  RenewShareSessionIfValidInput,
+  RevokeShareSessionInput,
+  ShareSessionRecord,
+  ShareSessionStorage,
+  ShareSessionStorageErrorCode,
+} from "./share-sessions"
+export { ShareSessionStorageError } from "./share-sessions"
 export type {
   FinishSyncRunInput,
   ListSyncRunsInput,
@@ -340,6 +365,8 @@ export interface Storage {
   workflowInterventions?: WorkflowInterventionStorage
   webhookRuns?: WebhookRunStorage
   rules?: RulesStorage
+  shareGrants?: ShareGrantStorage
+  shareSessions?: ShareSessionStorage
   fileUploadSessions?: FileUploadSessionStore
   connectorConnections?: ConnectorConnectionStorage
 

package/src/storage/workflow-runs/in-memory.ts

@@ -1,4 +1,3 @@
-import { normalizeRequesterGroupIds } from "../../auth/attribution"
 import { parseSixbFailure } from "../../errors/internal"
 import type { SixbFailure } from "../../errors/types"
 import type { AgentRunFailureCode } from "../agents"
@@ -143,7 +142,6 @@ export class InMemoryWorkflowRunStorage implements WorkflowRunStorage {
       queuedAt,
       startedAt: queuedAt,
       attempt: 0,
-      requesterGroupIds: normalizeRequesterGroupIds(input.requesterGroupIds),
     }
 
     this.runs.set(key, cloneRecord(record))

package/src/storage/workflow-runs/types.ts

@@ -144,8 +144,6 @@ export interface WorkflowRunRecord {
   readonly startedAt: Date
   readonly finishedAt?: Date
   readonly error?: SixbFailure<WorkflowRunFailureCode>
-  /** Durable group memberships snapshotted when the workflow run was admitted. */
-  readonly requesterGroupIds: readonly string[]
   readonly attempt: number
   readonly execution?: WorkflowRunExecution
 }
@@ -181,7 +179,6 @@ export interface QueueWorkflowRunInput {
   readonly workflowId: string
   readonly input: WorkflowIOSnapshot
   readonly queuedAt?: Date
-  readonly requesterGroupIds: readonly string[]
 }
 
 export interface ReclaimWorkflowRunInput {

package/src/syncs/execution.ts

@@ -1,5 +1,6 @@
-import { isAllowed } from "../authorization"
+import { assertAuthorized, isRuntimeAllowed } from "../authorization"
 import type { ExecutionContext } from "../execution"
+import { resolveRuntimeAuthorizationForProject } from "../execution/authorization"
 import type { SixbRuntimeContext } from "../runtime/types"
 import type {
   ListLatestSyncRunsResult,
@@ -29,26 +30,39 @@ export function createSyncsRuntime(
   execution: ExecutionContext,
   source: Pick<SyncsRuntime, "list" | "getById">
 ): SyncsRuntime {
-  const allowed = (syncId: string) => isAllowed(runtime.authorization, { kind: "sync.run", syncId })
+  const authority = resolveRuntimeAuthorizationForProject(runtime)
+  const allowed = (syncId: string) => isRuntimeAllowed(runtime, { kind: "sync.run", syncId })
   const visibleIds = () =>
     source
       .list()
       .filter((sync) => allowed(sync.id))
       .map((sync) => sync.id)
+  const historyFilterIds = () =>
+    authority.type === "unrestricted"
+      ? undefined
+      : authority.type === "principal"
+        ? visibleIds()
+        : []
 
   return {
-    list: () => source.list().filter((sync) => allowed(sync.id)),
+    list: () =>
+      authority.type === "denied" || authority.type === "delegated"
+        ? []
+        : source.list().filter((sync) => allowed(sync.id)),
     getById: (syncId) => {
+      if (authority.type === "denied" || authority.type === "delegated") return null
       const sync = source.getById(syncId)
       return sync && allowed(syncId) ? sync : null
     },
     request: async (input) => {
+      assertAuthorized(runtime, { kind: "sync.run", syncId: input.syncId })
       const sync = source.getById(input.syncId)
       if (!sync) throw new SyncValidationError(`[Sixb] Unknown sync '${input.syncId}'`)
       return requestSyncRun(runtime, execution, sync, input)
     },
     runs: {
       getById: async (runId) => {
+        if (authority.type === "denied" || authority.type === "delegated") return null
         const run =
           (await runtime.storage.syncRuns?.getById({
             projectId: runtime.projectId,
@@ -57,15 +71,21 @@ export function createSyncsRuntime(
         return run && allowed(run.syncId) ? run : null
       },
       list: (input = {}) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ runs: [], hasMore: false, total: 0 })
+        }
         const storage = runtime.storage.syncRuns
         if (!storage) return Promise.resolve({ runs: [], hasMore: false, total: 0 })
         return storage.list({
-          projectId: runtime.projectId,
           ...input,
-          syncIds: runtime.authorization ? visibleIds() : undefined,
+          syncIds: historyFilterIds(),
+          projectId: runtime.projectId,
         })
       },
       listLatest: (syncIds) => {
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return Promise.resolve({ runs: [] })
+        }
         const storage = runtime.storage.syncRuns
         if (!storage || syncIds.length === 0) return Promise.resolve({ runs: [] })
         const allowedIds = syncIds.filter(allowed)

package/src/syncs/request.ts

@@ -1,4 +1,5 @@
 import { assertAuthorized } from "../authorization"
+import { resolveExecutionScopeAuthorization } from "../execution/authorization"
 import {
   createPrimitiveExecutionRecord,
   ensureExecutionRecord,
@@ -45,6 +46,10 @@ export async function requestSyncRun(
   sync: SyncDefinition,
   options: SyncRunRequestOptions = {}
 ): Promise<SyncRunRequestResult> {
+  resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization,
+  })
   assertAuthorized(runtime, { kind: "sync.run", syncId: sync.id })
   if (!runtime.storage.syncRuns) {
     throw new SyncValidationError("[Sixb] Sync run storage is not configured.")

package/src/testing/action-execution.ts

@@ -10,6 +10,7 @@ export async function createTestActionExecution(
     readonly actionId: string
     readonly runId: string
     readonly executionId?: string
+    readonly requesterGroupIds?: readonly string[]
   }
 ): Promise<string> {
   const parentExecutionId = `test_request_execution:${input.runId}`
@@ -27,6 +28,7 @@ export async function createTestActionExecution(
   if (!parent) {
     await executions.create({
       id: parentExecutionId,
+      requesterGroupIds: input.requesterGroupIds ?? [],
       projectId: input.projectId,
       executor: { type: "request", requestId: `test_request:${input.runId}` },
       source: { type: "http", requestId: `test_request:${input.runId}` },
@@ -36,6 +38,7 @@ export async function createTestActionExecution(
   }
   await executions.create({
     id: executionId,
+    requesterGroupIds: input.requesterGroupIds ?? [],
     projectId: input.projectId,
     executor: { type: "primitive", kind: primitive.kind, runId: primitive.runId },
     source: { type: "execution", executionId: parentExecutionId },
@@ -49,13 +52,17 @@ export async function createTestActionExecution(
 /** Queue an Action run with the valid durable execution fixture required by every provider. */
 export async function queueTestActionRun(
   storage: Pick<Storage, "actionRuns" | "executions">,
-  input: Omit<QueueActionRunInput, "executionId">
+  input: Omit<QueueActionRunInput, "executionId"> & {
+    readonly requesterGroupIds?: readonly string[]
+  }
 ): Promise<ActionRunRecord> {
   if (!storage.actionRuns) throw new Error("Action run storage is not configured for this test.")
   const executionId = await createTestActionExecution(storage.executions, {
     projectId: input.projectId,
     actionId: input.actionId,
     runId: input.id,
+    requesterGroupIds: input.requesterGroupIds,
   })
-  return storage.actionRuns.queue({ ...input, executionId })
+  const { requesterGroupIds: _groups, ...run } = input
+  return storage.actionRuns.queue({ ...run, executionId })
 }

package/src/testing/agent-execution.ts

@@ -13,6 +13,7 @@ export async function createTestAgentExecution(
     readonly runId: string
     readonly executionId?: string
     readonly sourceExecutionId?: string
+    readonly requesterGroupIds?: readonly string[]
     /** Conversational runs inherit authority; workflow fixtures use managed authority. */
     readonly authority?: "managed" | "inherited"
   }
@@ -65,6 +66,7 @@ export async function createTestAgentExecution(
   if (!parent) {
     parent = await storage.executions.create({
       id: sourceExecutionId,
+      requesterGroupIds: input.requesterGroupIds ?? [],
       projectId: input.projectId,
       executor: { type: "request", requestId: `test_request:${input.runId}` },
       source: { type: "http", requestId: `test_request:${input.runId}` },
@@ -74,6 +76,7 @@ export async function createTestAgentExecution(
   }
   await storage.executions.create({
     id: executionId,
+    requesterGroupIds: parent.requesterGroupIds,
     projectId: input.projectId,
     executor: { type: "agent", runId: input.runId },
     source: { type: "execution", executionId: sourceExecutionId },

package/src/testing/agent-storage-contract.ts

@@ -93,7 +93,6 @@ function runInput(overrides: Partial<TestRunInput> = {}): TestRunInput {
     triggerMessageId: "msg_user_1",
     spec: { model: { provider: "test", modelId: "large" } },
     executionId: "test_agent_execution:run_1",
-    requesterGroupIds: ["support", "engineering", "support"],
     execution: execution("exec_1"),
     createdAt: at("2026-06-23T10:00:10.000Z"),
     ...overrides,
@@ -491,7 +490,6 @@ export function runAgentStorageContractSuite<TStorage extends AgentStorageContra
           spawnKey: "research-orders",
           status: "queued",
           attempt: 0,
-          requesterGroupIds: ["engineering", "support"],
           spec: input.spec,
         })
         expect(child).not.toHaveProperty("threadId")
@@ -655,7 +653,6 @@ export function runAgentStorageContractSuite<TStorage extends AgentStorageContra
         const run = await createAndStartRun(storage, fixture, runInput({ id: "run_1" }))
         expect(run).toMatchObject({ status: "running", attempt: 1, threadId: "thr_1" })
         expect(run.executionId).toBe("test_agent_execution:run_1")
-        expect(run.requesterGroupIds).toEqual(["engineering", "support"])
         expect(run.execution?.token).toBe("exec_1")
         await expect(storage.threads.getById({ projectId, id: "thr_1" })).resolves.toMatchObject({
           activeRunId: "run_1",
@@ -791,10 +788,8 @@ export function runAgentStorageContractSuite<TStorage extends AgentStorageContra
           mutableExecution.token = "mutated"
           mutableExecution.queueLeaseExpiresAt.setTime(0)
         }
-        ;(run.requesterGroupIds as string[]).push("mutated")
         const reread = await storage.runs.getById({ projectId, id: "run_1" })
         expect(reread?.execution?.token).toBe("exec_1")
-        expect(reread?.requesterGroupIds).toEqual(["engineering", "support"])
       })
     })
 

package/src/testing/ai-model-call-groups-contract.ts

@@ -22,6 +22,80 @@ export function runAiModelCallGroupsContractSuite<T extends AiModelCallGroupsCon
   options: AiStorageContractSuiteOptions<T>
 ): void {
   describe(name, () => {
+    test("attributes direct calls and retries to requests, actions, and workflows", async () => {
+      // Removal proof: return undefined from directModelCallAttribution and run this suite.
+      const storage = await options.createStorage()
+      try {
+        await options.setup?.(storage)
+        const expected = [
+          { kind: "request", requestId: "request" },
+          { kind: "action", actionId: "summarize", actionRunId: "action" },
+          { kind: "workflow", workflowId: "summarize", workflowRunId: "workflow" },
+        ] as const
+        for (const attribution of expected) {
+          const kind = attribution.kind
+          const primitive = {
+            kind: kind === "action" ? ("action" as const) : ("workflow" as const),
+            id: "summarize",
+            runId: kind,
+          }
+          const execution = await storage.executions.create({
+            projectId,
+            id: kind,
+            executor:
+              kind === "request"
+                ? { type: "request", requestId: kind }
+                : { type: "primitive", kind, runId: kind },
+            source:
+              kind === "request"
+                ? { type: "http", requestId: kind }
+                : { type: "event", eventId: kind },
+            correlationId: kind,
+            authorizationRef:
+              kind === "request" ? { type: "disabled" } : { type: "trustedPrimitive", primitive },
+          })
+          for (const attempt of [1, 2]) {
+            await storage.aiUsage.recordModelCall({
+              projectId,
+              id: `${kind}:${attempt}`,
+              executionId: execution.id,
+              attempt,
+              callId: `${kind}:${attempt}`,
+              requesterGroupIds: execution.requesterGroupIds,
+              providerId: "test",
+              requestedModelId: "small",
+              responseId: `${kind}:${attempt}`,
+              usage: { inputTokens: 2, outputTokens: 3 },
+              occurredAt: new Date("2026-09-01T12:00:00Z"),
+            })
+          }
+          const calls = await storage.aiCosts.listModelCalls({
+            ...range,
+            executionId: execution.id,
+          })
+          expect(calls.total).toBe(2)
+          expect(calls.items.map((call) => call.attribution)).toEqual([attribution, attribution])
+        }
+        const groups = await storage.aiCosts.listModelCallGroups(range)
+        expect(groups.total).toBe(3)
+        for (const attribution of expected) {
+          const group = groups.items.find((item) => item.executionId === attribution.kind)
+          expect(group).toMatchObject({
+            attribution,
+            modelCallCount: 2,
+            totalTokens: 10,
+            executions: [{ attribution, modelCallCount: 2 }],
+          })
+        }
+        const overview = await storage.aiCosts.queryProjectOverview({ ...range, bucket: "day" })
+        expect(overview.totals.modelCallCount).toBe(6)
+        expect(overview.agents).toEqual([])
+        expect(overview.workflows).toMatchObject([{ workflowId: "summarize", modelCallCount: 2 }])
+      } finally {
+        await options.cleanup?.(storage)
+      }
+    })
+
     test("attributes workflow usage to step references and keeps same-named steps separate", async () => {
       const storage = await options.createStorage()
       try {
@@ -195,7 +269,6 @@ async function seedWorkflowCall(
     workflowId,
     executionId: sourceExecutionId,
     input: {},
-    requesterGroupIds: [],
   })
   await storage.workflowRuns.start({ projectId, id: runId })
   const nodeRunId = `${runId}:node:0`
@@ -275,7 +348,6 @@ async function seed(storage: AiModelCallGroupsContractStorage) {
       threadId: "thread",
       triggerMessageId: `message_${runId}`,
       spec: { model: { provider: "parent-provider", modelId: "large" } },
-      requesterGroupIds: [],
     })
     await storage.agents.runs.start({
       id: runId,