@sixb/core 0.1.7 → 0.1.9

package/src/agents/errors.ts

@@ -6,16 +6,6 @@ export class AgentDefinitionError extends Error {
   readonly name: string = "AgentDefinitionError"
 }
 
-/**
- * Raised by the message adapters. `fromUiMessage` is **total**: rather than silently dropping a part it
- * cannot model, it throws this — which both prevents data loss and pinpoints exactly when the
- * {@link AgentMessage} part union must be extended. It also fires on transient/streaming parts that
- * must never be persisted, and on out-of-contract (non-JSON) payloads.
- */
-export class AgentMessageAdapterError extends Error {
-  readonly name = "AgentMessageAdapterError"
-}
-
 /**
  * An agent-tool failure whose message is intentionally safe to expose to the model and persist in
  * the durable trace. Tool authors must keep the message free of credentials and internal details;

package/src/agents/execution.ts

@@ -1,6 +1,7 @@
 import { principalsEqual, SYSTEM_PRINCIPAL } from "../auth"
-import { assertAuthorized, isAllowed } from "../authorization"
+import { assertAuthorized, isRuntimeAllowed } from "../authorization"
 import type { AuthorizablePrincipal, ExecutionContext } from "../execution"
+import { resolveRuntimeAuthorizationForProject } from "../execution/authorization"
 import type { ModelCatalog } from "../models"
 import { resolveExecutionCosts } from "../runtime/ai-cost"
 import { resolveExecutionUsage } from "../runtime/ai-usage"
@@ -82,22 +83,25 @@ export function createAgentRuntime(
   execution: ExecutionContext,
   models?: ModelCatalog
 ): AgentRuntime {
-  const principal = runtime.authorization?.principal ?? SYSTEM_PRINCIPAL
-  const allowed = () => isAllowed(runtime.authorization, { kind: "agent.run" })
+  const authority = resolveRuntimeAuthorizationForProject(runtime)
+  const principal = authority.type === "principal" ? authority.context.principal : SYSTEM_PRINCIPAL
+  const allowed = () => isRuntimeAllowed(runtime, { kind: "agent.run" })
 
   const getVisibleThreadRecord = async (threadId: string): Promise<AgentThreadRecord | null> => {
+    if (authority.type === "denied" || authority.type === "delegated") return null
     const thread =
       (await runtime.storage.agents?.threads.getById({
         projectId: runtime.projectId,
         id: threadId,
       })) ?? null
     if (!thread || !allowed()) return null
-    return runtime.authorization && !principalsEqual(principal, thread.ownerPrincipal)
+    return authority.type === "principal" && !principalsEqual(principal, thread.ownerPrincipal)
       ? null
       : thread
   }
 
   const getAgent = (): AgentDescriptor | null => {
+    if (authority.type === "denied" || authority.type === "delegated") return null
     const model = models?.language.default
     if (!model || !allowed()) return null
     return {
@@ -107,6 +111,7 @@ export function createAgentRuntime(
   }
 
   const getVisibleRunRecord = async (runId: string): Promise<ConversationAgentRunRecord | null> => {
+    if (authority.type === "denied" || authority.type === "delegated") return null
     const run =
       (await runtime.storage.agents?.runs.getById({
         projectId: runtime.projectId,
@@ -148,12 +153,15 @@ export function createAgentRuntime(
       getById: getVisibleThreadRecord,
       list: async (input = {}) => {
         assertNoAgentSelector(input)
+        if (authority.type === "denied" || authority.type === "delegated") {
+          return { threads: [], hasMore: false, total: 0 }
+        }
         const storage = runtime.storage.agents
         if (!storage || !allowed()) return { threads: [], hasMore: false, total: 0 }
         return storage.threads.list({
           ...input,
           projectId: runtime.projectId,
-          ownerPrincipal: runtime.authorization ? principal : undefined,
+          ownerPrincipal: authority.type === "principal" ? principal : undefined,
         })
       },
     },

package/src/agents/identity.ts

@@ -0,0 +1,4 @@
+/** Deterministic managed service-account id owned by one framework Agent actor. */
+export function agentServiceAccountId(actorId: string): string {
+  return `svc_agent_${actorId}`
+}

package/src/agents/index.ts

@@ -1,28 +1,10 @@
 export type {
   AgentFileDataProjection,
   AgentFileDataResolverInput,
-  AgentInboundUiMessage,
-  AgentInboundUiMessagePart,
-  AgentModelAssistantPart,
-  AgentModelFilePart,
-  AgentModelMessage,
-  AgentModelReasoningPart,
-  AgentModelTextPart,
-  AgentModelToolCallPart,
-  AgentModelToolOutput,
-  AgentModelToolResultPart,
   AgentToolResultFileResolverInput,
-  AgentUiMessage,
-  AgentUiMessagePart,
-  AgentUiToolPart,
   ToModelMessagesOptions,
 } from "./adapters"
-export {
-  fromUiMessage,
-  omitUndefinedObjectProperties,
-  toModelMessages,
-  toUiMessage,
-} from "./adapters"
+export { toModelMessages } from "./adapters"
 export type { AgentApiGatewayCapabilityInput, AgentApiRoute } from "./api-gateway"
 export {
   AGENT_API_GATEWAY_PREFIX,
@@ -44,7 +26,7 @@ export type {
   AgentContextInput,
   AgentContextOrigin,
   AgentContextPart,
-} from "./context"
+} from "./context/entries"
 export {
   agentContext,
   agentContextFingerprint,
@@ -53,7 +35,7 @@ export {
   MAX_AGENT_APP_STATE_TOTAL_BYTES,
   MAX_AGENT_CONTEXT_ENTRIES,
   normalizeAgentContextEntries,
-} from "./context"
+} from "./context/entries"
 export type {
   AgentContextCompactionBoundary,
   AgentContextEstimateTool,
@@ -85,7 +67,6 @@ export {
 } from "./dispatch"
 export {
   AgentDefinitionError,
-  AgentMessageAdapterError,
   AgentRequestError,
   type AgentRequestErrorCode,
   AgentToolPublicError,
@@ -135,7 +116,7 @@ export type {
   AgentRunFinishedEvent,
   AgentRunStreamEvent,
   AgentRunStreamId,
-} from "./streams"
+} from "./streams/protocol"
 export {
   AGENT_COMPACTION_FAILURE_CODES,
   AGENT_RUN_CANCEL_RECORD,
@@ -151,7 +132,7 @@ export {
   publishAgentRunCancel,
   publishAgentRunFinished,
   subscribeAgentRunCancel,
-} from "./streams"
+} from "./streams/protocol"
 export type {
   AgentThreadModelContextMessage,
   ProjectAgentThreadModelContextInput,

package/src/agents/message.ts

@@ -1,7 +1,7 @@
 import type { FileRef } from "../blob-storage"
 import type { JsonValue } from "../json"
 import type { ProviderData } from "../models"
-import type { AgentContextPart } from "./context"
+import type { AgentContextPart } from "./context/entries"
 
 /**
  * The agent's own, SDK-independent message. We store messages and threads — not an SDK transport —
@@ -10,9 +10,8 @@ import type { AgentContextPart } from "./context"
  * column) versions the parts shape so it can be migrated.
  *
  * The part union is intentionally focused on what agent runs actually produce (text, reasoning, step
- * boundaries, tool calls). It is extensible: adding a part kind later is non-breaking. The adapter
- * `fromUiMessage` is total — it throws on any part it cannot model rather than dropping it silently,
- * which both prevents data loss and signals exactly when the union must grow.
+ * boundaries, tool calls). The model loop validates and normalizes output before its steps are
+ * projected into this union; storage validates the durable write contract independently.
  */
 export const AGENT_MESSAGE_CONTENT_VERSION = 2 as const
 
@@ -53,7 +52,7 @@ interface AgentToolCallBase {
   readonly type: "tool-call"
   readonly toolCallId: string
   readonly toolName: string
-  /** `true` when reconstructed from a dynamic tool part (vs a static `tool-${name}` part). */
+  /** `true` when the model identifies the call as a dynamic tool. */
   readonly dynamic?: boolean
   /** `true` when the provider executed the tool inline (steers model projection). */
   readonly providerExecuted?: boolean
@@ -95,6 +94,6 @@ export type AgentToolCallState = AgentToolCallPart["state"]
 export interface AgentMessage {
   readonly role: AgentMessageRole
   readonly parts: readonly AgentMessagePart[]
-  /** Message-level metadata (mirrors `UIMessage.metadata`). */
+  /** Optional JSON metadata associated with the message. */
   readonly metadata?: JsonValue
 }

package/src/agents/model-loop.ts

@@ -1,5 +1,11 @@
 import { randomUUID } from "node:crypto"
-import { assertJsonObject, assertJsonValue, isJsonValue, type JsonValue } from "../json"
+import {
+  assertJsonObject,
+  assertJsonValue,
+  isJsonValue,
+  isPlainRecord,
+  type JsonValue,
+} from "../json"
 import { ModelProviderError, ModelStreamError, StructuredOutputError } from "../models/errors"
 import type {
   LanguageModelStreamEvent,
@@ -42,6 +48,8 @@ interface ModelLoopOptions {
   readonly maxOutputTokens?: number
   readonly caching?: "auto" | "off"
   readonly maxSteps: number
+  /** Direct generation cannot execute or synthesize local tool results. */
+  readonly rejectLocalToolCalls?: boolean
   readonly signal: AbortSignal
   /** Reserve the final provider call for a tool-free synthesis response. */
   readonly finalStepInstruction?: string
@@ -110,6 +118,8 @@ interface ParsedToolCall {
  *
  * One step is exactly one provider call. Lifecycle and stream callbacks are awaited so the caller
  * controls backpressure and can fail closed before another billable call starts.
+ * Completed steps and partial content contain validated JSON payloads and normalized provider
+ * metadata. Trace adapters may project these results directly; storage owns write validation.
  */
 export function runModelLoop<TOutput = string>(
   input: RunModelLoopInput<TOutput>
@@ -245,6 +255,12 @@ export async function runModelLoop(
     }
 
     const localCalls = response.toolCalls.filter((call) => call.part.providerExecuted !== true)
+    if (
+      input.rejectLocalToolCalls &&
+      (localCalls.length > 0 || response.finishReason === "tool-calls")
+    ) {
+      throw new ModelStreamError("[SixbModels] Direct generation cannot continue local tool calls.")
+    }
     if (response.finishReason === "pause" && localCalls.length === 0) {
       const step = modelStep(response, responseId, response.content, cost)
       steps.push(step)
@@ -523,6 +539,11 @@ function validateModelToolOutput(output: ModelToolOutput, toolName: string): voi
     }
     return
   }
+  if (output.type !== "json" && output.type !== "error-json") {
+    throw new TypeError(
+      `[SixbModels] Tool '${toolName}' returned an unsupported model output type.`
+    )
+  }
   assertJsonValue(output.value, `tool '${toolName}' model output`)
 }
 
@@ -537,6 +558,9 @@ function modelToolOutput(value: JsonValue): ModelToolOutput {
 }
 
 function toolErrorResult(part: ModelToolCallPart, errorText: string): ModelToolResultPart {
+  if (typeof errorText !== "string") {
+    throw new TypeError(`[SixbModels] Tool '${part.toolName}' error text must be a string.`)
+  }
   return {
     type: "tool-result",
     toolCallId: part.toolCallId,
@@ -645,6 +669,12 @@ class StreamAccumulator {
         this.addProviderToolResult(event)
         return
       case "provider-state":
+        if (typeof event.providerId !== "string" || event.providerId.length === 0) {
+          this.captureProjectionError(
+            new ModelStreamError("[SixbModels] Provider state requires a nonempty provider ID.")
+          )
+          return
+        }
         if (this.captureProviderState(event.data)) {
           this.parts.push({
             type: "provider-state",
@@ -836,7 +866,12 @@ class StreamAccumulator {
     event: Extract<LanguageModelStreamEvent, { type: "tool-input-start" }>
   ): Promise<void> {
     this.requireStarted(event.type)
-    if (!event.id || !event.toolName) {
+    if (
+      typeof event.id !== "string" ||
+      !event.id ||
+      typeof event.toolName !== "string" ||
+      !event.toolName
+    ) {
       throw new ModelStreamError("[SixbModels] Tool calls require nonempty IDs and names.")
     }
     if (this.toolCalls.has(event.id)) {
@@ -932,8 +967,7 @@ class StreamAccumulator {
   private captureProviderData(data: ProviderData | undefined): ProviderData | undefined {
     if (data === undefined) return undefined
     try {
-      validateProviderData(data)
-      return data
+      return normalizeProviderData(data)
     } catch (error) {
       this.captureProjectionError(error)
       return undefined
@@ -993,8 +1027,8 @@ function validateUsage(usage: ModelUsage): void {
   }
 }
 
-function validateProviderData(data: ProviderData | undefined): void {
-  if (data === undefined) return
+function normalizeProviderData(value: ProviderData): ProviderData {
+  const data = omitUndefinedObjectProperties(value)
   assertJsonValue(data, "provider data")
   if (typeof data !== "object" || data === null || Array.isArray(data)) {
     throw new TypeError("[SixbModels] provider data must be a JSON object.")
@@ -1004,6 +1038,28 @@ function validateProviderData(data: ProviderData | undefined): void {
       `[SixbModels] Provider data exceeds the ${MAX_PROVIDER_DATA_BYTES}-byte response limit.`
     )
   }
+  return data
+}
+
+/** Normalize absent metadata fields at ingestion, leaving non-JSON values for validation. */
+function omitUndefinedObjectProperties(value: unknown, seen = new Set<object>()): unknown {
+  if (typeof value !== "object" || value === null || seen.has(value)) return value
+  seen.add(value)
+  try {
+    if (Array.isArray(value)) {
+      return value.map((entry) => omitUndefinedObjectProperties(entry, seen))
+    }
+    if (!isPlainRecord(value)) return value
+    return Object.fromEntries(
+      Reflect.ownKeys(value)
+        .filter((key) => Object.prototype.propertyIsEnumerable.call(value, key))
+        .map((key) => [key, Reflect.get(value, key)] as const)
+        .filter(([, entry]) => entry !== undefined)
+        .map(([key, entry]) => [key, omitUndefinedObjectProperties(entry, seen)])
+    )
+  } finally {
+    seen.delete(value)
+  }
 }
 
 function mergeProviderData(

package/src/agents/request.ts

@@ -1,13 +1,13 @@
 import { randomUUID } from "node:crypto"
 import type { Principal } from "../auth"
 import { SYSTEM_PRINCIPAL } from "../auth"
-import { snapshotRequesterGroupIds } from "../auth/attribution"
 import { assertAuthorized } from "../authorization"
 import type { FileRef } from "../blob-storage"
 import {
   canInheritAgentRequestAuthorization,
   createInheritedAgentExecutionRecord,
 } from "../execution/agent"
+import { resolveExecutionScopeAuthorization } from "../execution/authorization"
 import { ensureExecutionRecord, executionRecordInputFromRuntime } from "../execution/durable"
 import type { ExecutionContext } from "../execution/types"
 import type { LanguageModelCatalog, LanguageModelRef } from "../models"
@@ -27,14 +27,14 @@ import {
   applicableAiLimitPolicyStatuses,
 } from "../storage/ai-limits/enforcement"
 import type { AiLimitPolicyStatus } from "../storage/ai-limits/types"
-import type { CreateExecutionInput } from "../storage/executions"
-import type { AgentContextEntryInput } from "./context"
+import type { ExecutionRecord } from "../storage/executions"
+import type { AgentContextEntryInput } from "./context/entries"
 import { resolveAgentContextParts } from "./context-resolution"
 import { dispatchQueuedAgentRuns } from "./dispatch"
 import { AgentRequestError } from "./errors"
 import { createAgentMessageId, createAgentRunId, createAgentThreadId } from "./ids"
 import { assertNoAgentSelector } from "./retired-config"
-import { publishAgentRunActivity } from "./streams"
+import { publishAgentRunActivity } from "./streams/protocol"
 import { AGENT_REASONING_LEVELS, type AgentReasoningLevel } from "./types"
 
 export interface RequestAgentRunInput {
@@ -81,6 +81,10 @@ export async function requestAgentRun(
   models: LanguageModelCatalog | undefined,
   input: RequestAgentRunInput
 ): Promise<RequestAgentRunResult> {
+  const authority = resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization,
+  })
   assertNoAgentSelector(input)
   assertAuthorized(runtime, { kind: "agent.run" })
   assertRequestAuthorityCanRunAgent(runtime)
@@ -92,19 +96,16 @@ export async function requestAgentRun(
 
   const agents = requireAgentStorage(runtime)
   const projectId = runtime.projectId
-  // A scoped runtime is authoritative for caller identity. `input.principal` remains available to
-  // privileged server integrations that have already authenticated their request.
-  const principal = runtime.authorization?.principal ?? input.principal ?? SYSTEM_PRINCIPAL
+  // Attribution comes from the exact capability/execution pair, never the optional context cache
+  // on the runtime. `input.principal` remains available to unrestricted server integrations that
+  // have already authenticated their request.
+  const principal =
+    authority.type === "principal"
+      ? authority.context.principal
+      : (input.principal ?? SYSTEM_PRINCIPAL)
   const runId = createAgentRunId()
   const durableExecution = await prepareDurableAgentExecution(runtime, execution, runId)
-  const requesterGroupIds = durableExecution.requestedBy
-    ? await snapshotRequesterGroupIds({
-        auth: runtime.storage.auth,
-        projectId,
-        principal: durableExecution.requestedBy,
-      })
-    : []
-  await assertAiLimitPreflight(runtime, durableExecution, requesterGroupIds)
+  await assertAiLimitPreflight(runtime, durableExecution)
 
   const { thread, createdThread } = await resolveThread(agents, {
     projectId,
@@ -152,7 +153,6 @@ export async function requestAgentRun(
         threadId: thread.id,
         triggerMessageId,
         spec,
-        requesterGroupIds,
       })
     })
   } catch (error) {
@@ -179,6 +179,10 @@ export async function retryAgentRun(
   models: LanguageModelCatalog | undefined,
   failedRun: ConversationAgentRunRecord
 ): Promise<RequestAgentRunResult> {
+  resolveExecutionScopeAuthorization(runtime.projectId, {
+    execution,
+    authorization: runtime.runtimeAuthorization,
+  })
   assertAuthorized(runtime, { kind: "agent.run" })
   assertRequestAuthorityCanRunAgent(runtime)
   if (failedRun.status !== "failed") {
@@ -201,14 +205,7 @@ export async function retryAgentRun(
   }
   const runId = createAgentRunId()
   const durableExecution = await prepareDurableAgentExecution(runtime, execution, runId)
-  const requesterGroupIds = durableExecution.requestedBy
-    ? await snapshotRequesterGroupIds({
-        auth: runtime.storage.auth,
-        projectId: runtime.projectId,
-        principal: durableExecution.requestedBy,
-      })
-    : []
-  await assertAiLimitPreflight(runtime, durableExecution, requesterGroupIds)
+  await assertAiLimitPreflight(runtime, durableExecution)
   const run = await runtime.storage.transaction(async (tx) => {
     const agents = tx.agents
     if (!agents) {
@@ -232,7 +229,6 @@ export async function retryAgentRun(
           models,
           input: {},
         }),
-      requesterGroupIds,
     })
   })
   await publishRunActivity(runtime, run)
@@ -242,13 +238,15 @@ export async function retryAgentRun(
 
 async function assertAiLimitPreflight(
   runtime: SixbRuntimeContext,
-  execution: CreateExecutionInput,
-  requesterGroupIds: readonly string[]
+  execution: Pick<ExecutionRecord, "requestedBy" | "requesterGroupIds">
 ): Promise<void> {
   const limits = runtime.storage.aiLimits
   if (!limits) throw aiUsageLimitUnavailableError(["limitStorageUnavailable"])
 
-  const subjects = aiLimitSubjectsFromAttribution(execution.requestedBy, requesterGroupIds)
+  const subjects = aiLimitSubjectsFromAttribution(
+    execution.requestedBy,
+    execution.requesterGroupIds
+  )
   let applicable: readonly AiLimitPolicyStatus[]
   try {
     applicable = applicableAiLimitPolicyStatuses(
@@ -309,7 +307,7 @@ async function prepareDurableAgentExecution(
   runtime: SixbRuntimeContext,
   execution: ExecutionContext,
   runId: string
-): Promise<CreateExecutionInput> {
+): Promise<Omit<ExecutionRecord, "createdAt">> {
   const parent = await ensureExecutionRecord(
     runtime.storage.executions,
     executionRecordInputFromRuntime({

package/src/agents/streams/index.ts

@@ -0,0 +1,18 @@
+/** Browser-safe agent stream reader contract. Producers belong to internal/agents/streams. */
+export type {
+  AgentCompactionFailureCode,
+  AgentRunActivityEvent,
+  AgentRunControlStreamId,
+  AgentRunFailure,
+  AgentRunFinishedEvent,
+  AgentRunStreamEvent,
+  AgentRunStreamId,
+} from "./protocol"
+export {
+  AGENT_ACTIVITY_STREAM_ID,
+  AGENT_ACTIVITY_STREAM_SCHEMA_VERSION,
+  AGENT_COMPACTION_FAILURE_CODES,
+  AGENT_RUN_STREAM_SCHEMA_VERSION,
+  isAgentRunActivityEvent,
+  isAgentRunStreamEvent,
+} from "./protocol"

package/src/agents/streams/internal.ts

@@ -0,0 +1,19 @@
+/** Implementation exports for Sixb packages only. */
+export {
+  AGENT_RUN_CANCEL_RECORD,
+  agentActivityStreamDefinition,
+  agentRunActivityEvent,
+  agentRunControlStreamDefinition,
+  agentRunControlStreamId,
+  agentRunFinishedEvent,
+  agentRunStreamDefinition,
+  agentRunStreamEventBase,
+  agentRunStreamId,
+  agentRunStreamIdempotencyKey,
+  DEFAULT_AGENT_ACTIVITY_STREAM_RETENTION,
+  DEFAULT_AGENT_RUN_STREAM_RETENTION,
+  publishAgentRunActivity,
+  publishAgentRunCancel,
+  publishAgentRunFinished,
+  subscribeAgentRunCancel,
+} from "./protocol"

package/src/agents/{streams.ts → streams/protocol.ts}

@@ -1,14 +1,14 @@
-import type { Broker, BrokerStreamDefinition } from "../broker"
-import { parseSixbFailure } from "../errors/internal"
-import type { SixbFailure } from "../errors/types"
-import { isJsonValue, isPlainRecord, type JsonValue } from "../json"
+import type { Broker, BrokerStreamDefinition } from "../../broker"
+import { parseSixbFailure } from "../../errors/internal"
+import type { SixbFailure } from "../../errors/types"
+import { isJsonValue, isPlainRecord, type JsonValue } from "../../json"
 import {
   AGENT_RUN_FAILURE_CODES,
   type AgentContextCheckpointReason,
   type AgentRunFailureCode,
   type AgentRunRecord,
   type ConversationAgentRunRecord,
-} from "../storage/agents/types"
+} from "../../storage/agents/types"
 
 export const AGENT_RUN_STREAM_SCHEMA_VERSION = 1 as const
 export const DEFAULT_AGENT_RUN_STREAM_RETENTION = {

package/src/agents/tool-definition.ts

@@ -13,7 +13,6 @@ import type {
   InferAgentToolInputSchema,
 } from "./types"
 import {
-  assertValidAgentToolDefinitions,
   assertValidAgentToolDescription,
   assertValidAgentToolName,
   assertValidProjectAgentToolDefinitions,
@@ -73,24 +72,6 @@ export function createAgentToolDefinition<
   return Object.freeze(tool)
 }
 
-export function toolsFromDefinitions(
-  agentId: string,
-  tools: readonly AgentToolDefinition[] | undefined
-): readonly AgentToolDefinition[] {
-  if (tools === undefined) {
-    return EMPTY_AGENT_TOOLS
-  }
-  if (!Array.isArray(tools)) {
-    throw new AgentDefinitionError(
-      `[Sixb] Agent '${agentId}' tools must be an array of agent tool definitions.`
-    )
-  }
-
-  assertValidAgentToolDefinitions(agentId, tools)
-
-  return normalizeAgentToolDefinitions(tools)
-}
-
 export function toolsFromProjectConfig(
   tools: readonly AgentToolDefinition[] | undefined
 ): readonly AgentToolDefinition[] {

package/src/agents/types.ts

@@ -11,7 +11,7 @@ export type {
   AgentContextInput,
   AgentContextOrigin,
   AgentContextPart,
-} from "./context"
+} from "./context/entries"
 
 /** Public capability reference used by security grants such as `can.run(agent)`. */
 export interface AgentReference {