@sixb/core 0.1.8 → 0.1.10

package/src/connectors/connections/validation.ts

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto"
+import { isJsonObject } from "../../json"
 import type { ConnectorAuthorizationRecord } from "../../storage"
 import { createConnectorCodedError } from "../errors"
 import type { ConnectorAccountCandidate, ConnectorOAuthCredentials } from "../types"
@@ -26,6 +27,7 @@ export function validateCredentials(
     tokenType?: string
     scopes?: string[]
     expiresAt?: Date
+    authorizationContext?: ConnectorOAuthCredentials["authorizationContext"]
   } = {
     accessToken: nonblank(
       credentials.accessToken,
@@ -76,6 +78,16 @@ export function validateCredentials(
     normalized.expiresAt = new Date(credentials.expiresAt)
   }
 
+  if (credentials.authorizationContext !== undefined) {
+    if (!isJsonObject(credentials.authorizationContext)) {
+      throw createConnectorCodedError(
+        "connector.adapter_invalid",
+        "OAuth connector adapter returned invalid authorization context; expected a JSON object."
+      )
+    }
+    normalized.authorizationContext = structuredClone(credentials.authorizationContext)
+  }
+
   return normalized
 }
 
@@ -135,6 +147,9 @@ export function serializeCredentials(credentials: ConnectorOAuthCredentials): st
     ...(credentials.expiresAt === undefined
       ? {}
       : { expiresAt: credentials.expiresAt.toISOString() }),
+    ...(credentials.authorizationContext === undefined
+      ? {}
+      : { authorizationContext: credentials.authorizationContext }),
   })
 }
 
@@ -160,7 +175,8 @@ export function parseCredentials(serialized: string): ConnectorOAuthCredentials
     (value.tokenType !== undefined && typeof value.tokenType !== "string") ||
     (value.scopes !== undefined &&
       (!Array.isArray(value.scopes) || value.scopes.some((scope) => typeof scope !== "string"))) ||
-    (value.expiresAt !== undefined && typeof value.expiresAt !== "string")
+    (value.expiresAt !== undefined && typeof value.expiresAt !== "string") ||
+    (value.authorizationContext !== undefined && !isJsonObject(value.authorizationContext))
   ) {
     throw createConnectorCodedError(
       "connector.credentials_unavailable",
@@ -175,6 +191,9 @@ export function parseCredentials(serialized: string): ConnectorOAuthCredentials
       ...(value.tokenType === undefined ? {} : { tokenType: value.tokenType }),
       ...(value.scopes === undefined ? {} : { scopes: value.scopes as string[] }),
       ...(expiresAt === undefined ? {} : { expiresAt }),
+      ...(value.authorizationContext === undefined
+        ? {}
+        : { authorizationContext: value.authorizationContext }),
     })
   } catch (error) {
     throw createConnectorCodedError(
@@ -238,21 +257,88 @@ export function normalizedHttpUrl(
 
 export function assertAuthorizationUrlParameters(
   authorizationUrl: string,
-  expected: { readonly state: string; readonly codeChallenge: string }
+  expected: { readonly state: string; readonly codeChallenge?: string }
 ): void {
   const parameters = new URL(authorizationUrl).searchParams
   if (
     !sameSingleParameter(parameters, "state", expected.state) ||
-    !sameSingleParameter(parameters, "code_challenge", expected.codeChallenge) ||
-    !sameSingleParameter(parameters, "code_challenge_method", "S256")
+    (expected.codeChallenge === undefined
+      ? parameters.has("code_challenge") || parameters.has("code_challenge_method")
+      : !sameSingleParameter(parameters, "code_challenge", expected.codeChallenge) ||
+        !sameSingleParameter(parameters, "code_challenge_method", "S256"))
   ) {
     throw createConnectorCodedError(
       "connector.adapter_invalid",
-      "OAuth connector authorization URL must preserve the framework-provided state and PKCE S256 parameters."
+      expected.codeChallenge === undefined
+        ? "OAuth connector authorization URL must preserve the framework-provided state and omit disabled PKCE parameters."
+        : "OAuth connector authorization URL must preserve the framework-provided state and PKCE S256 parameters."
     )
   }
 }
 
+export function connectorPkceEnabled(pkce: "S256" | "disabled" | undefined): boolean {
+  if (pkce === undefined || pkce === "S256") return true
+  if (pkce === "disabled") return false
+  throw createConnectorCodedError(
+    "connector.adapter_invalid",
+    "OAuth connector PKCE must be S256 or disabled."
+  )
+}
+
+const reservedCallbackParameters = new Set([
+  "state",
+  "code",
+  "auth_code",
+  "error",
+  "error_description",
+  "error_uri",
+])
+
+export function validateCallbackParameterNames(names: readonly string[] = []): void {
+  if (
+    !Array.isArray(names) ||
+    names.some(
+      (name) =>
+        typeof name !== "string" ||
+        !/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(name) ||
+        reservedCallbackParameters.has(name)
+    ) ||
+    new Set(names).size !== names.length
+  ) {
+    throw createConnectorCodedError(
+      "connector.adapter_invalid",
+      "OAuth callback parameter names must be unique, non-reserved parameter names."
+    )
+  }
+}
+
+/** Select only declared provider values after the callback's state and browser binding are proved. */
+export function selectCallbackParameters(
+  names: readonly string[] = [],
+  parameters: Readonly<Record<string, string | readonly string[]>> = {}
+): Readonly<Record<string, string>> {
+  validateCallbackParameterNames(names)
+  if (!isRecord(parameters)) {
+    throw createConnectorCodedError(
+      "connector.authorization_invalid",
+      "OAuth provider callback parameters must be an object."
+    )
+  }
+  return Object.fromEntries(
+    names.flatMap((name) => {
+      if (!Object.hasOwn(parameters, name)) return []
+      const value = parameters[name]
+      if (typeof value !== "string") {
+        throw createConnectorCodedError(
+          "connector.authorization_invalid",
+          "OAuth provider callback parameters must have a single string value."
+        )
+      }
+      return [[name, value]]
+    })
+  )
+}
+
 export function nonblank(
   value: unknown,
   field: string,

package/src/connectors/types.ts

@@ -1,3 +1,4 @@
+import type { ReadonlyJsonObject } from "../json"
 import type { WebhookDefinition } from "../webhooks/types"
 
 /**
@@ -33,6 +34,12 @@ export interface ConnectorOAuthCredentials {
   readonly tokenType?: string
   readonly scopes?: readonly string[]
   readonly expiresAt?: Date
+  /**
+   * Provider-owned grant context, encrypted with the tokens and never exposed in connection views.
+   * Available to account discovery, refresh, and revoke. Refresh preserves it when omitted;
+   * returning an object replaces it (use {} to clear it). Code exchange starts fresh on reauthorization.
+   */
+  readonly authorizationContext?: ReadonlyJsonObject
 }
 
 /** Public, non-secret account information returned for framework-owned selection UI. */
@@ -75,13 +82,17 @@ export interface OAuthConnectorAuthorizationContext extends ConnectorContext {
 
 export interface OAuthConnectorAuthorizationUrlInput {
   readonly state: string
-  readonly codeChallenge: string
-  readonly codeChallengeMethod: "S256"
+  /** Present only when the adapter enables PKCE (S256 by default). */
+  readonly codeChallenge?: string
+  readonly codeChallengeMethod?: "S256"
 }
 
 export interface OAuthConnectorCodeExchangeInput {
   readonly code: string
-  readonly codeVerifier: string
+  /** Present only when this authorization attempt used PKCE. */
+  readonly codeVerifier?: string
+  /** Allowlisted callback values. Untrusted until the adapter validates them with the provider. */
+  readonly callbackParameters?: Readonly<Record<string, string>>
 }
 
 export interface ConnectorConnectionClientContext extends ConnectorContext {
@@ -109,6 +120,10 @@ export interface ConnectorTokenSource {
  */
 export interface ConnectorOAuth2Authentication {
   readonly type: "oauth2"
+  /** Defaults to S256. Disable only for providers whose flow does not support PKCE. */
+  readonly pkce?: "S256" | "disabled"
+  /** Additional callback parameter names accepted by exchangeCode; framework OAuth fields are reserved. */
+  readonly callbackParameters?: readonly string[]
   authorizationUrl(
     context: OAuthConnectorAuthorizationContext,
     input: OAuthConnectorAuthorizationUrlInput
@@ -131,7 +146,7 @@ export interface ConnectorOAuth2Authentication {
 export interface OAuthConnectorAdapter<TType extends string = string, TClient = unknown> {
   readonly type: TType
   readonly authentication: ConnectorOAuth2Authentication
-  readonly webhooks?: undefined
+  readonly webhooks?: readonly WebhookDefinition<unknown, TClient>[]
   discoverAccounts(
     context: ConnectorContext,
     credentials: ConnectorOAuthCredentials

package/src/errors/internal.ts

@@ -1,5 +1,6 @@
 import { cloneJsonValue, isJsonValue, isPlainRecord, type ReadonlyJsonValue } from "../json"
 import { SIXB_ERROR_CODES, SIXB_ERROR_DEFINITIONS } from "./catalog"
+import { createFailureRedactor } from "./redaction"
 import type { SixbErrorCode, SixbFailure } from "./types"
 
 export const SIXB_FAILURE_MAX_MESSAGE_BYTES = 4 * 1024
@@ -103,7 +104,11 @@ export function captureSixbFailure<const TCodes extends SixbErrorCodeTuple>(
 
 /** Identifies errors created by Sixb without making their class part of the contract. */
 export function isSixbError(error: unknown): error is SixbCodedError {
-  return error instanceof SixbError
+  try {
+    return error instanceof SixbError
+  } catch {
+    return false
+  }
 }
 
 /**
@@ -128,9 +133,12 @@ export function toSixbFailure(
     throw new Error(`[Sixb] Error code '${error.code}' is not allowed by this failure contract.`)
   }
   const code = error.code
-  const details = error.details
+  const redactor = createFailureRedactor()
+  const details = error.details === undefined ? undefined : redactor.context(error.details)
+  const { detail, truncated } = findFailureDetail(error, code)
+  const summary = SIXB_ERROR_DEFINITIONS[code].publicMessage
   const message = truncateUtf8(
-    SIXB_ERROR_DEFINITIONS[code].publicMessage,
+    redactor.text(detail && detail.message !== summary ? `${summary} ${detail.message}` : summary),
     SIXB_FAILURE_MAX_MESSAGE_BYTES
   )
   const failure: SixbFailure = {
@@ -139,7 +147,9 @@ export function toSixbFailure(
     retryable: SIXB_ERROR_DEFINITIONS[code].retryable,
     at: failureTimestamp(options.at),
     ...(details === undefined ? {} : { details: cloneJsonValue(details, "Sixb failure details") }),
-    ...(message.truncated ? { truncated: true } : {}),
+    ...(detail?.httpStatus === undefined ? {} : { httpStatus: detail.httpStatus }),
+    ...(redactor.redacted ? { redacted: true } : {}),
+    ...(message.truncated || truncated || redactor.truncated ? { truncated: true } : {}),
   }
 
   if (serializedByteLength(failure) <= SIXB_FAILURE_MAX_SERIALIZED_BYTES) return failure
@@ -149,10 +159,67 @@ export function toSixbFailure(
     message: failure.message,
     retryable: failure.retryable,
     at: failure.at,
+    ...(failure.httpStatus === undefined ? {} : { httpStatus: failure.httpStatus }),
+    ...(failure.redacted ? { redacted: true } : {}),
     truncated: true,
   }
 }
 
+const NETWORK_MESSAGES: Readonly<Record<string, string>> = {
+  ECONNREFUSED: "The remote service refused the connection.",
+  ECONNRESET: "The remote service reset the connection.",
+  ENOTFOUND: "The remote host could not be resolved.",
+  EAI_AGAIN: "DNS resolution temporarily failed.",
+  ETIMEDOUT: "The connection timed out.",
+}
+
+function isHttpStatus(value: unknown): value is number {
+  return typeof value === "number" && Number.isInteger(value) && value >= 100 && value <= 599
+}
+
+/** Select one explanation along the causal chain; unrelated aggregate errors stay separate. */
+function findFailureDetail(
+  error: SixbCodedError,
+  boundaryCode: SixbErrorCode
+): { detail?: { message: string; httpStatus?: number }; truncated: boolean } {
+  const seen = new Set<object>()
+  let current: unknown = error
+  while (typeof current === "object" && current !== null && !seen.has(current)) {
+    if (seen.size === 8) return { truncated: true }
+    seen.add(current)
+    if (
+      isSixbError(current) &&
+      current.code !== boundaryCode &&
+      current.code !== "internal.unexpected"
+    ) {
+      return {
+        detail: { message: SIXB_ERROR_DEFINITIONS[current.code].publicMessage },
+        truncated: false,
+      }
+    }
+    try {
+      // Read only data properties: arbitrary messages and getters remain private.
+      const status =
+        Object.getOwnPropertyDescriptor(current, "status")?.value ??
+        Object.getOwnPropertyDescriptor(current, "statusCode")?.value
+      if (isHttpStatus(status)) {
+        return {
+          detail: { message: `Upstream request returned HTTP ${status}.`, httpStatus: status },
+          truncated: false,
+        }
+      }
+      const code = Object.getOwnPropertyDescriptor(current, "code")?.value
+      if (typeof code === "string" && Object.hasOwn(NETWORK_MESSAGES, code)) {
+        return { detail: { message: NETWORK_MESSAGES[code] }, truncated: false }
+      }
+      current = Object.getOwnPropertyDescriptor(current, "cause")?.value
+    } catch {
+      break
+    }
+  }
+  return { truncated: false }
+}
+
 /** Serializes a validated failure for durable storage. */
 export function serializeSixbFailure<const TCodes extends SixbErrorCodeTuple>(
   failure: SixbFailure<TCodes[number]>,
@@ -186,7 +253,7 @@ export function parseSixbFailure(
     throw invalidStoredFailure("expected a JSON object")
   }
 
-  const { code, message, retryable, at, details, truncated } = candidate
+  const { code, message, retryable, at, details, httpStatus, redacted, truncated } = candidate
   if (typeof code !== "string" || !SIXB_ERROR_CODE_SET.has(code)) {
     throw invalidStoredFailure("code is not a known Sixb error code")
   }
@@ -215,15 +282,28 @@ export function parseSixbFailure(
     throw invalidStoredFailure("truncated must be true when present")
   }
 
+  if (redacted !== undefined && redacted !== true) {
+    throw invalidStoredFailure("redacted must be true when present")
+  }
+  if (httpStatus !== undefined && !isHttpStatus(httpStatus)) {
+    throw invalidStoredFailure("httpStatus must be an integer HTTP status")
+  }
+  const redactor = createFailureRedactor()
+  const safeMessage = truncateUtf8(redactor.text(message), SIXB_FAILURE_MAX_MESSAGE_BYTES)
+  const safeDetails =
+    details === undefined ? undefined : redactor.context(details as ReadonlyJsonValue)
+
   const failure: SixbFailure = {
     code: code as SixbErrorCode,
-    message,
+    message: safeMessage.value,
     retryable,
     at,
-    ...(details === undefined
+    ...(safeDetails === undefined
       ? {}
-      : { details: cloneJsonValue(details, "Stored Sixb failure details") }),
-    ...(truncated === true ? { truncated: true } : {}),
+      : { details: cloneJsonValue(safeDetails, "Stored Sixb failure details") }),
+    ...(httpStatus === undefined ? {} : { httpStatus: httpStatus as number }),
+    ...(redacted || redactor.redacted ? { redacted: true } : {}),
+    ...(truncated || redactor.truncated || safeMessage.truncated ? { truncated: true } : {}),
   }
   if (serializedByteLength(failure) > SIXB_FAILURE_MAX_SERIALIZED_BYTES) {
     throw invalidStoredFailure(
@@ -255,7 +335,7 @@ function invalidStoredFailure(reason: string): Error {
  * Extracts a diagnostic message for an internal error or log entry.
  *
  * The result can contain provider data and must not be persisted or returned by an API.
- * `toSixbFailure()` selects the catalog-owned public message instead.
+ * `toSixbFailure()` constructs a message from recognized HTTP, network, or Sixb information instead.
  */
 export function summarizeErrorMessage(value: unknown, fallback?: string): string {
   const message = readStringProperty(value, "message")

package/src/errors/redaction.ts

@@ -0,0 +1,98 @@
+import type { ReadonlyJsonValue } from "../json"
+
+const REDACTED = "[REDACTED]"
+const MAX_CONTEXT_DEPTH = 12
+const MAX_CONTEXT_ENTRIES = 1024
+const SENSITIVE_KEY =
+  /password|passwd|passphrase|secret|token|credential|authorization|cookie|privatekey|apikey|accesskey|connectionstring|databaseurl|clientassertion|signature/i
+const PRIVATE_CONTAINER =
+  /^(?:request|response)(?:body|headers)?$|^(?:headers|body|payload|env|environment)$/i
+
+function isSensitiveKey(key: string): boolean {
+  const normalized = key.replace(/[^a-z0-9]/gi, "")
+  return SENSITIVE_KEY.test(normalized) || PRIVATE_CONTAINER.test(normalized)
+}
+
+/** Runtime credentials are additional protection for context; never a license to copy errors. */
+function environmentSecrets(): string[] {
+  return Object.entries(process.env)
+    .filter(([key, value]) => isSensitiveKey(key) && value !== undefined && value.length >= 4)
+    .map(([, value]) => value as string)
+    .sort((a, b) => b.length - a.length)
+}
+
+export function createFailureRedactor() {
+  const secrets = environmentSecrets()
+  let redacted = false
+  let truncated = false
+  let entries = 0
+
+  const text = (input: string): string => {
+    let value = input
+    for (const secret of secrets) {
+      value = value
+        .split(REDACTED)
+        .map((part) => part.split(secret).join(REDACTED))
+        .join(REDACTED)
+    }
+    value = value
+      .replace(
+        /-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/g,
+        REDACTED
+      )
+      .replace(/\b(?:Bearer|Basic)\s+[A-Za-z0-9+/_.~=-]+/gi, REDACTED)
+      .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, REDACTED)
+      .replace(
+        /\b(?:sk[-_](?:live[-_]|test[-_]|proj[-_])?[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]+|AKIA[A-Z0-9]{16})\b/g,
+        REDACTED
+      )
+      // URLs may carry userinfo, signed query parameters, or credentials in the path.
+      .replace(/\b[a-z][a-z0-9+.-]*:\/\/[^\s<>"']+/gi, REDACTED)
+      .replace(
+        /["']?\b(?:password|passwd|passphrase|[a-z_-]*secret|[a-z_-]*token|api[-_]?key|authorization|cookie|credential|signature)["']?\s*[=:]\s*(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,;]+)/gi,
+        REDACTED
+      )
+    if (value !== input) redacted = true
+    return value
+  }
+
+  const context = (value: ReadonlyJsonValue, depth = 0): ReadonlyJsonValue => {
+    if (depth > MAX_CONTEXT_DEPTH || entries++ >= MAX_CONTEXT_ENTRIES) {
+      truncated = true
+      return "[TRUNCATED]"
+    }
+    if (typeof value === "string") return text(value)
+    if (value === null || typeof value !== "object") return value
+    if (Array.isArray(value)) {
+      const available = Math.max(0, MAX_CONTEXT_ENTRIES - entries)
+      if (value.length > available) truncated = true
+      return value.slice(0, available).map((entry) => context(entry, depth + 1))
+    }
+    const result: Record<string, ReadonlyJsonValue> = Object.create(null)
+    for (const [key, entry] of Object.entries(value)) {
+      if (entries >= MAX_CONTEXT_ENTRIES) {
+        truncated = true
+        break
+      }
+      if (isSensitiveKey(key)) {
+        redacted = true
+        entries++
+        result[text(key)] = REDACTED
+      } else {
+        result[text(key)] = context(entry, depth + 1)
+      }
+    }
+    return result
+  }
+
+  return {
+    text,
+    context,
+    get redacted() {
+      return redacted
+    },
+    get truncated() {
+      return truncated
+    },
+  }
+}

package/src/errors/types.ts

@@ -16,6 +16,10 @@ export interface SixbFailure<TCode extends SixbErrorCode = SixbErrorCode> {
   /** ISO-8601 UTC timestamp of the failure occurrence. */
   readonly at: string
   readonly details?: ReadonlyJsonValue
+  /** Status returned by the failed upstream request, when one exists. */
+  readonly httpStatus?: number
+  /** Sensitive context was replaced before this record crossed a storage or API boundary. */
+  readonly redacted?: true
   /** Present when optional context exceeded the durable failure size budget and was omitted. */
   readonly truncated?: true
 }

package/src/events/execution.ts

@@ -17,7 +17,7 @@ export interface EventsRuntime {
   latestCursor(): Promise<string | undefined>
   subscribe(
     input: EventsSubscribeInput,
-    handler: (events: readonly StoredDomainEvent[]) => void
+    handler: (events: readonly StoredDomainEvent[]) => unknown
   ): Promise<() => void>
 }
 
@@ -88,7 +88,7 @@ export function createEventsRuntime(runtime: SixbRuntimeContext): EventsRuntime
       }
       return runtime.events.subscribe(input, (events) => {
         const visible = visibleEvents(events)
-        if (visible.length > 0) handler(visible)
+        if (visible.length > 0) return handler(visible)
       })
     },
   }

package/src/events/service.ts

@@ -79,7 +79,7 @@ export interface DomainEventLog {
   latestCursor(): Promise<string | undefined>
   subscribe(
     input: EventsSubscribeInput,
-    handler: (events: readonly StoredDomainEvent[]) => void
+    handler: (events: readonly StoredDomainEvent[]) => unknown
   ): Promise<() => void>
 }
 
@@ -251,7 +251,7 @@ export class DomainEventService implements DomainEventLog, StableEventPublisher
 
   async subscribe(
     input: EventsSubscribeInput,
-    handler: (events: readonly StoredDomainEvent[]) => void
+    handler: (events: readonly StoredDomainEvent[]) => unknown
   ): Promise<() => void> {
     await this.ensureStream()
     return this.broker.subscribe(
@@ -269,7 +269,7 @@ export class DomainEventService implements DomainEventLog, StableEventPublisher
         }
 
         try {
-          handler(events)
+          return handler(events)
         } catch {
           // Preserve fire-and-forget subscriber semantics.
         }

package/src/execution/agent.ts

@@ -1,7 +1,7 @@
 import { type AgentExecutionAuthorization, agentServiceAccountId } from "../agents/authority"
 import type { OntologySource } from "../ontology"
 import { isBoundSixb, type Sixb } from "../runtime/sixb"
-import type { CreateExecutionInput, ExecutionRecord } from "../storage/executions"
+import type { ExecutionRecord } from "../storage/executions"
 import { ExecutionStorageError } from "../storage/executions"
 
 export { ensureExecutionRecord } from "./durable"
@@ -36,11 +36,12 @@ export function createAgentExecutionRecord(input: {
   readonly actorId: string
   readonly runId: string
   readonly principal: Extract<AuthorizablePrincipal, { readonly type: "serviceAccount" }>
-}): CreateExecutionInput {
+}): Omit<ExecutionRecord, "createdAt"> {
   assertAgentPrincipal(input.actorId, input.principal)
   return {
     id: input.id,
     projectId: input.parent.projectId,
+    requesterGroupIds: [...input.parent.requesterGroupIds],
     ...(input.parent.requestedBy === undefined
       ? {}
       : { requestedBy: structuredClone(input.parent.requestedBy) }),
@@ -59,7 +60,7 @@ export function createInheritedAgentExecutionRecord(input: {
   readonly id: string
   readonly parent: ExecutionRecord
   readonly runId: string
-}): CreateExecutionInput {
+}): Omit<ExecutionRecord, "createdAt"> {
   const authority = input.parent.authorizationRef
   if (
     authority.type !== "disabled" &&
@@ -78,6 +79,7 @@ export function createInheritedAgentExecutionRecord(input: {
   return {
     id: input.id,
     projectId: input.parent.projectId,
+    requesterGroupIds: [...input.parent.requesterGroupIds],
     ...(input.parent.requestedBy === undefined
       ? {}
       : { requestedBy: structuredClone(input.parent.requestedBy) }),

package/src/execution/durable.ts

@@ -82,6 +82,7 @@ type PrimitiveExecutionOrigin =
       >
       readonly correlationId: string
       readonly requestedBy?: CreateExecutionInput["requestedBy"]
+      readonly requesterGroupIds?: readonly string[]
     }
 
 /** Build an immutable primitive execution from its parent execution or automatic trigger. */
@@ -94,6 +95,7 @@ export function createPrimitiveExecutionRecord(input: {
     input.origin.type === "execution"
       ? {
           projectId: input.origin.parent.projectId,
+          requesterGroupIds: [...input.origin.parent.requesterGroupIds],
           ...(input.origin.parent.requestedBy === undefined
             ? {}
             : { requestedBy: structuredClone(input.origin.parent.requestedBy) }),
@@ -102,6 +104,9 @@ export function createPrimitiveExecutionRecord(input: {
         }
       : {
           projectId: input.origin.projectId,
+          ...(input.origin.requesterGroupIds === undefined
+            ? {}
+            : { requesterGroupIds: [...input.origin.requesterGroupIds] }),
           ...(input.origin.requestedBy === undefined
             ? {}
             : { requestedBy: structuredClone(input.origin.requestedBy) }),
@@ -171,7 +176,12 @@ function assertExecutionRecordMatches(
   input: CreateExecutionInput
 ): void {
   const { createdAt: _createdAt, ...stored } = existing
-  if (!isDeepStrictEqual(stored, input)) {
+  if (
+    !isDeepStrictEqual(stored, {
+      ...input,
+      requesterGroupIds: input.requesterGroupIds ?? stored.requesterGroupIds,
+    })
+  ) {
     throw new ExecutionStorageError(
       "duplicate_execution",
       `[Sixb] Execution '${input.id}' already exists with different immutable provenance.`

package/src/execution/primitive.ts

@@ -1,3 +1,4 @@
+import { bindModelExecutionAttempt, type ModelExecutionAttempt } from "../models/execution/binding"
 import type { OntologySource } from "../ontology"
 import type { OntologyMutationRuntime } from "../runtime/ontology-mutations"
 import { getOntologyMutationRuntime } from "../runtime/ontology-mutations"
@@ -24,9 +25,12 @@ export function bindDurablePrimitiveExecution(
   input: {
     readonly execution: ExecutionRecord
     readonly primitive: TrustedPrimitiveRef
+    readonly modelExecution?: ModelExecutionAttempt
   }
 ): BoundPrimitiveExecution {
-  return bindPrimitiveScope(host, restoreTrustedPrimitiveExecutionScope(input))
+  const bound = bindPrimitiveScope(host, restoreTrustedPrimitiveExecutionScope(input))
+  if (input.modelExecution) bindModelExecutionAttempt(bound.sixb.models, input.modelExecution)
+  return bound
 }
 
 function bindPrimitiveScope(

package/src/execution/request.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto"
 import type { AuthorizationContext } from "../authorization"
+import { bindModelExecutionAttempt } from "../models/execution/binding"
 import type { OntologySource } from "../ontology"
 import { isBoundSixb, type Sixb } from "../runtime/sixb"
 import {
@@ -32,6 +33,7 @@ export type { AuthorizationContext } from "../authorization"
 export type { DatasetsRuntime } from "../datasets/execution"
 export type { EventsRuntime } from "../events/execution"
 export type { LogsRuntime } from "../logging/execution"
+export type { LanguageModelsRuntime, ModelsRuntime } from "../models/generation-types"
 export type {
   ExecutionObjectByIdHandle,
   ExecutionObjectSet,
@@ -104,6 +106,7 @@ export function bindRequestExecution(
   if (!isBoundSixb(sixb)) {
     throw new Error("[Sixb] Request host did not return an execution-bound Sixb SDK.")
   }
+  bindModelExecutionAttempt(sixb.models, { attempt: 1, signal: input.request.signal })
   return sixb
 }