@sixb/core 0.1.8 → 0.1.10

package/src/storage/ai-cost/analytics.ts

@@ -168,7 +168,7 @@ export function buildAiAccountingOverview(
         item
       )
     }
-    if (item.attribution?.kind === "workflowAgent") {
+    if (item.attribution?.kind === "workflowAgent" || item.attribution?.kind === "workflow") {
       appendGrouped(workflowItems, item.attribution.workflowId, item)
     }
   }

package/src/storage/ai-cost/attribution.ts

@@ -0,0 +1,15 @@
+import type { AiAccountingAttribution } from "./types"
+
+/** Direct calls are identified by durable provenance, even when their run has been removed. */
+export function directModelCallAttribution(
+  kind: string | null,
+  id: string | null,
+  primitiveId: string | null
+): AiAccountingAttribution | undefined {
+  if (!id) return undefined
+  if (kind === "request") return { kind, requestId: id }
+  if (kind === "action" && primitiveId) return { kind, actionId: primitiveId, actionRunId: id }
+  if (kind === "workflow" && primitiveId)
+    return { kind, workflowId: primitiveId, workflowRunId: id }
+  return undefined
+}

package/src/storage/ai-cost/groups.ts

@@ -1,5 +1,6 @@
 import type { AiAccountingRecordSetItem } from "./analytics"
 import { aiAccountingItemMatchesQuery, normalizeAiModelCallAccountingQuery } from "./analytics"
+import { directModelCallAttribution } from "./attribution"
 import type {
   AiAccountingAttribution,
   AiBillingIdentity,
@@ -56,12 +57,15 @@ export interface AiModelCallGroupRow {
   readonly workflow_node_run_id: string | null
   readonly workflow_id: string | null
   readonly workflow_run_id: string | null
+  readonly executor_kind: string | null
+  readonly executor_id: string | null
+  readonly primitive_id: string | null
 }
 
 export function aiModelCallGroupFragmentFromRow(
   row: AiModelCallGroupRow
 ): AiModelCallGroupFragment {
-  let attribution: AiAccountingAttribution | undefined
+  let attribution = directModelCallAttribution(row.executor_kind, row.executor_id, row.primitive_id)
   if (row.root_agent_run_id && row.root_thread_id) {
     attribution = {
       kind: "agent",

package/src/storage/ai-cost/provider.ts

@@ -12,6 +12,7 @@ export {
   normalizeAiModelCallAccountingQuery,
   toAccountingItem,
 } from "./analytics"
+export { directModelCallAttribution } from "./attribution"
 export type { AiModelCallCostDetails } from "./codec"
 export { aiModelCallCostDetails, parseAiModelCallCostDetails } from "./codec"
 export type {

package/src/storage/ai-cost/types.ts

@@ -181,7 +181,14 @@ export interface AiAccountingOverview {
   readonly workflows: readonly AiAccountingWorkflowBreakdown[]
 }
 
+/**
+ * The execution that made the model call, rather than the request that triggered its work.
+ * `request` identifies a direct call from a request-bound SDK, outside an action or workflow.
+ */
 export type AiAccountingAttribution =
+  | { readonly kind: "request"; readonly requestId: string }
+  | { readonly kind: "action"; readonly actionId: string; readonly actionRunId: string }
+  | { readonly kind: "workflow"; readonly workflowId: string; readonly workflowRunId: string }
   | {
       readonly kind: "agent"
       readonly agentRunId: string

package/src/storage/auth/in-memory.ts

@@ -1 +1 @@
-export { InMemoryAuthStorage } from "./in-memory/index"
+export { InMemoryAuthStorage } from "./in-memory/auth-storage"

package/src/storage/connector-connections/in-memory.ts

@@ -147,7 +147,9 @@ export class InMemoryConnectorConnectionStorage implements ConnectorConnectionSt
       slot: input.slot,
       initiatedByExecutionId: input.initiatedByExecutionId,
       stateHash: input.stateHash,
-      codeVerifier: structuredClone(input.codeVerifier),
+      ...(input.codeVerifier === undefined
+        ? {}
+        : { codeVerifier: structuredClone(input.codeVerifier) }),
       redirectUri: input.redirectUri,
       ...(input.connectionRunId === undefined ? {} : { connectionRunId: input.connectionRunId }),
       ...(input.returnTo === undefined ? {} : { returnTo: input.returnTo }),

package/src/storage/connector-connections/provider/runs.ts

@@ -63,7 +63,9 @@ export class DurableConnectorConnectionRuns extends ConnectorConnectionOperation
         slot: input.slot,
         initiatedByExecutionId: input.initiatedByExecutionId,
         stateHash: input.stateHash,
-        codeVerifier: structuredClone(input.codeVerifier),
+        ...(input.codeVerifier === undefined
+          ? {}
+          : { codeVerifier: structuredClone(input.codeVerifier) }),
         redirectUri: input.redirectUri,
         ...(input.connectionRunId === undefined ? {} : { connectionRunId: input.connectionRunId }),
         ...(input.returnTo === undefined ? {} : { returnTo: input.returnTo }),

package/src/storage/connector-connections/types.ts

@@ -198,7 +198,8 @@ export interface ConnectorAuthorizationAttemptRecord extends ConnectorConnection
   /** Durable execution that initiated and authorizes completion of this OAuth attempt. */
   readonly initiatedByExecutionId: string
   readonly stateHash: string
-  readonly codeVerifier: SealedConnectorCredential
+  /** Absent when the authorization attempt explicitly disabled PKCE. */
+  readonly codeVerifier?: SealedConnectorCredential
   readonly redirectUri: string
   /** Present only for attempts created by the headless connection-run API. */
   readonly connectionRunId?: string
@@ -219,7 +220,7 @@ export interface CreateConnectorAuthorizationAttemptInput extends ConnectorConne
   readonly connectorId: string
   readonly initiatedByExecutionId: string
   readonly stateHash: string
-  readonly codeVerifier: SealedConnectorCredential
+  readonly codeVerifier?: SealedConnectorCredential
   readonly redirectUri: string
   readonly connectionRunId?: string
   readonly returnTo?: string

package/src/storage/executions/in-memory.ts

@@ -2,11 +2,7 @@ import type { AuthStorage } from "../auth"
 import type { ShareSessionStorage } from "../share-sessions"
 import { ExecutionStorageError } from "./errors"
 import type { CreateExecutionInput, ExecutionRecord, ExecutionStorage } from "./types"
-import {
-  cloneExecutionRecord,
-  normalizeExecutionRecord,
-  validateExecutionRecordReferences,
-} from "./validation"
+import { cloneExecutionRecord, prepareExecutionRecord } from "./validation"
 
 type RunRootOperation = <T>(run: () => Promise<T> | T) => Promise<T>
 
@@ -45,16 +41,15 @@ export class InMemoryExecutionStorage implements ExecutionStorage {
 
   async create(input: CreateExecutionInput): Promise<ExecutionRecord> {
     return this.runRootOperation(async () => {
-      const record = normalizeExecutionRecord(input)
-      const key = executionKey(record.projectId, record.id)
+      const key = executionKey(input.projectId, input.id)
       if (this.rows.has(key)) {
         throw new ExecutionStorageError(
           "duplicate_execution",
-          `[Sixb] Execution '${record.id}' already exists in project '${record.projectId}'.`
+          `[Sixb] Execution '${input.id}' already exists in project '${input.projectId}'.`
         )
       }
 
-      await validateExecutionRecordReferences(record, {
+      const record = await prepareExecutionRecord(input, {
         auth: this.auth,
         getExecution: async ({ projectId, id }) => {
           const existing = this.rows.get(executionKey(projectId, id))

package/src/storage/executions/provider.ts

@@ -6,6 +6,7 @@ import { normalizeExecutionRecord } from "./validation"
 export {
   type ExecutionValidationLookup,
   normalizeExecutionRecord,
+  prepareExecutionRecord,
   validateExecutionRecordReferences,
 } from "./validation"
 
@@ -19,6 +20,7 @@ export interface ExecutionStorageRow {
   readonly sourceId: string
   readonly requestedByUserId: string | null
   readonly requestedByServiceAccountId: string | null
+  readonly requesterGroupIds: readonly string[]
   readonly correlationId: string
   /** SQL-only projection of an execution source, used to enforce the parent foreign key. */
   readonly parentExecutionId: string | null
@@ -43,6 +45,7 @@ export function executionRecordToStorageRow(record: ExecutionRecord): ExecutionS
   return {
     projectId: record.projectId,
     id: record.id,
+    requesterGroupIds: [...record.requesterGroupIds],
     ...executor,
     ...source,
     requestedByUserId: record.requestedBy?.type === "user" ? record.requestedBy.id : null,
@@ -70,6 +73,7 @@ export function executionRecordFromStorageRow(row: ExecutionStorageRow): Executi
     {
       id: row.id,
       projectId: row.projectId,
+      requesterGroupIds: row.requesterGroupIds,
       ...(requestedBy === undefined ? {} : { requestedBy }),
       executor,
       source,

package/src/storage/executions/types.ts

@@ -29,6 +29,8 @@ export interface ExecutionRecord {
   readonly id: string
   readonly projectId: string
   readonly requestedBy?: AuthorizablePrincipal
+  /** Requester memberships at admission, independent of current execution authority. */
+  readonly requesterGroupIds: readonly string[]
   readonly executor: DurableExecutionExecutor
   readonly source: DurableExecutionSource
   readonly correlationId: string
@@ -36,8 +38,10 @@ export interface ExecutionRecord {
   readonly createdAt: Date
 }
 
-/** Creation input; the storage boundary assigns the immutable creation timestamp. */
-export type CreateExecutionInput = Omit<ExecutionRecord, "createdAt">
+/** Storage captures root memberships or inherits the parent's snapshot when omitted. */
+export type CreateExecutionInput = Omit<ExecutionRecord, "createdAt" | "requesterGroupIds"> & {
+  readonly requesterGroupIds?: readonly string[]
+}
 
 /** Immutable execution ledger. Records can be created and read, never updated or deleted. */
 export interface ExecutionStorage {

package/src/storage/executions/validation.ts

@@ -1,4 +1,5 @@
 import { isDeepStrictEqual } from "node:util"
+import { normalizeRequesterGroupIds, snapshotRequesterGroupIds } from "../../auth/attribution"
 import type {
   AuthorizablePrincipal,
   AuthorizationRef,
@@ -25,6 +26,30 @@ export interface ExecutionValidationLookup {
   }): Promise<{ readonly grantId: string } | null>
 }
 
+/** Capture accounting attribution at the same storage boundary that admits the execution. */
+export async function prepareExecutionRecord(
+  input: CreateExecutionInput,
+  lookup: ExecutionValidationLookup
+): Promise<ExecutionRecord> {
+  let groups = input.requesterGroupIds
+  if (groups === undefined && input.source.type === "execution") {
+    const parent = await lookup.getExecution({
+      projectId: input.projectId,
+      id: input.source.executionId,
+    })
+    groups = parent?.requesterGroupIds
+  } else if (groups === undefined && input.requestedBy) {
+    groups = await snapshotRequesterGroupIds({
+      auth: lookup.auth,
+      projectId: input.projectId,
+      principal: input.requestedBy,
+    })
+  }
+  const record = normalizeExecutionRecord({ ...input, requesterGroupIds: groups ?? [] })
+  await validateExecutionRecordReferences(record, lookup)
+  return record
+}
+
 export function normalizeExecutionRecord(
   input: CreateExecutionInput,
   createdAt: Date = new Date()
@@ -32,6 +57,7 @@ export function normalizeExecutionRecord(
   const record: ExecutionRecord = {
     id: input.id,
     projectId: input.projectId,
+    requesterGroupIds: normalizeRequesterGroupIds(input.requesterGroupIds ?? []),
     ...(input.requestedBy === undefined ? {} : { requestedBy: structuredClone(input.requestedBy) }),
     executor: structuredClone(input.executor),
     source: structuredClone(input.source),
@@ -368,6 +394,12 @@ async function validateParent(
       `[Sixb] Child execution '${record.id}' must preserve its parent requested-by principal.`
     )
   }
+  if (!isDeepStrictEqual(parent.requesterGroupIds, record.requesterGroupIds)) {
+    throw new ExecutionStorageError(
+      "invalid_parent_execution",
+      `[Sixb] Child execution '${record.id}' must preserve its parent requester-group snapshot.`
+    )
+  }
   if (
     record.executor.type === "agent" &&
     isInheritedAgentAuthority(record.authorizationRef) &&

package/src/storage/in-memory/index.ts

@@ -2,6 +2,7 @@ import { AsyncLocalStorage } from "node:async_hooks"
 import { InMemoryActionRunStorage } from "../action-runs"
 import { type AgentStorage, InMemoryAgentStorage } from "../agents"
 import { type AiAccountingAttribution, type AiCostStorage, InMemoryAiCostStorage } from "../ai-cost"
+import { directModelCallAttribution } from "../ai-cost/attribution"
 import { type AiLimitStorage, InMemoryAiLimitStorage } from "../ai-limits"
 import { type AiUsageStorage, InMemoryAiUsageStorage } from "../ai-usage"
 import { type AuthStorage, InMemoryAuthStorage } from "../auth"
@@ -188,7 +189,21 @@ export class InMemoryStorage implements Storage {
       projectId: input.projectId,
       id: input.executionId,
     })
-    if (!execution || execution.executor.type !== "agent") return undefined
+    if (!execution) return undefined
+    if (execution.executor.type !== "agent") {
+      const executor = execution.executor
+      return directModelCallAttribution(
+        executor.type === "primitive" ? executor.kind : executor.type,
+        executor.type === "request"
+          ? executor.requestId
+          : executor.type === "primitive"
+            ? executor.runId
+            : null,
+        execution.authorizationRef.type === "trustedPrimitive"
+          ? execution.authorizationRef.primitive.id
+          : null
+      )
+    }
     const directRun = await this.agentStorage.runs.getById({
       projectId: input.projectId,
       id: execution.executor.runId,

package/src/storage/index.ts

@@ -51,11 +51,6 @@ export {
   ACTION_RUN_FAILURE_CODES,
   ACTION_RUN_PHASES,
   ActionRunError,
-  actionRunParamsEqual,
-  actionRunPhaseRecordsEqual,
-  actionSubjectsEqual,
-  canRequeueActionRunAfterEnqueueFailure,
-  finishActionRunPhase,
   InMemoryActionRunStorage,
   isTerminalActionRun,
 } from "./action-runs"
@@ -197,14 +192,7 @@ export type {
   SummarizeAiUsageExecutionInput,
   SummarizeAiUsageExecutionsInput,
 } from "./ai-usage"
-export {
-  AiUsageStorageError,
-  aggregateAiModelCallUsage,
-  assertAiUsageExecutionId,
-  InMemoryAiUsageStorage,
-  normalizeAiModelCallRecord,
-  normalizeAiModelCallUsage,
-} from "./ai-usage"
+export { AiUsageStorageError, aggregateAiModelCallUsage, InMemoryAiUsageStorage } from "./ai-usage"
 export type {
   AccessTokenRecord,
   AccessTokenSubjectType,
@@ -367,8 +355,6 @@ export type {
   FileUploadStrategy,
 } from "./file-upload-sessions"
 export {
-  createFileUploadId,
-  createUploadExpiresAt,
   DEFAULT_FILE_UPLOAD_SESSION_TTL_MS,
   DEFAULT_FILE_UPLOAD_TERMINAL_SESSION_TTL_MS,
   FileUploadSessionError,
@@ -546,6 +532,7 @@ export type {
   SourceReplacementStatePage,
   StageMaterializationWorkInput,
   StageSourceAssertion,
+  StageSourceRoot,
   StageSourceRowsInput,
   StageSourceRowsResult,
   StoredLinkOverride,
@@ -584,7 +571,6 @@ export type {
   StartPipelineStepRunInput,
 } from "./pipeline-runs"
 export {
-  canRequeuePipelineRunAfterEnqueueFailure,
   InMemoryPipelineRunStorage,
   PIPELINE_RUN_FAILURE_CODES,
   PipelineRunError,
@@ -623,8 +609,6 @@ export {
   PROJECTION_RUN_FAILURE_CODES,
   PROJECTION_RUN_PROGRESS_KEYS,
   ProjectionRunError,
-  projectionRunObjectTypesVisible,
-  zeroProjectionRunProgress,
 } from "./projection-runs"
 export type {
   ListActiveRuleStatesInput,
@@ -675,12 +659,7 @@ export type {
   SyncRunStatus,
   SyncRunStorage,
 } from "./sync-runs"
-export {
-  canRequeueSyncRunAfterEnqueueFailure,
-  InMemorySyncRunStorage,
-  SYNC_RUN_FAILURE_CODES,
-  SyncRunError,
-} from "./sync-runs"
+export { InMemorySyncRunStorage, SYNC_RUN_FAILURE_CODES, SyncRunError } from "./sync-runs"
 export type {
   TimeseriesHistoryBatchInput,
   TimeseriesHistoryBatchResult,
@@ -688,11 +667,7 @@ export type {
   TimeseriesPoint,
   TimeseriesStorage,
 } from "./timeseries"
-export {
-  assertTransactionActive,
-  createTransactionStorageProxy,
-  throwNestedStorageTransaction,
-} from "./transaction"
+
 export type { Storage, StorageTransactionOptions } from "./types"
 export type {
   FinishWebhookRunInput,

package/src/storage/internal.ts

@@ -0,0 +1,20 @@
+/** Implementation exports for Sixb packages only. */
+
+export {
+  actionRunParamsEqual,
+  actionRunPhaseRecordsEqual,
+  actionSubjectsEqual,
+  canRequeueActionRunAfterEnqueueFailure,
+  finishActionRunPhase,
+} from "./action-runs/idempotency"
+export { assertAiUsageExecutionId, normalizeAiModelCallRecord } from "./ai-usage/record"
+export { normalizeAiModelCallUsage } from "./ai-usage/usage"
+export { createFileUploadId, createUploadExpiresAt } from "./file-upload-sessions/utils"
+export { canRequeuePipelineRunAfterEnqueueFailure } from "./pipeline-runs/idempotency"
+export { projectionRunObjectTypesVisible, zeroProjectionRunProgress } from "./projection-runs/types"
+export { canRequeueSyncRunAfterEnqueueFailure } from "./sync-runs/idempotency"
+export {
+  assertTransactionActive,
+  createTransactionStorageProxy,
+  throwNestedStorageTransaction,
+} from "./transaction"

package/src/storage/ontology/in-memory/materializations-state.ts

@@ -27,6 +27,7 @@ import type {
   InMemoryStoredLinkSlotOverride,
   InMemoryStoredObjectOverride,
 } from "./shared-state"
+import { projectEntityKey, sourceMaterializationKey } from "./shared-state"
 
 export function publicObjectOverride(
   value: InMemoryStoredObjectOverride | undefined
@@ -120,24 +121,10 @@ export function findActiveSourceMaterialization(
   projectId: string,
   sourceId: string
 ): InMemorySourceMaterialization | undefined {
-  let active: InMemorySourceMaterialization | undefined
-  for (const materialization of state.sourceMaterializations.values()) {
-    if (
-      materialization.projectId !== projectId ||
-      materialization.source.projectionId !== sourceId ||
-      materialization.status !== "active"
-    ) {
-      continue
-    }
-    if (active) {
-      throw new MaterializationConflictError(
-        "source-materialization",
-        `Source '${sourceId}' has more than one active materialization.`
-      )
-    }
-    active = materialization
-  }
-  return active
+  const id = state.activeSourceHeads.get(projectEntityKey(projectId, sourceId))
+  return id
+    ? state.sourceMaterializations.get(sourceMaterializationKey(projectId, sourceId, id))
+    : undefined
 }
 
 export function storedSource(