@sixb/core 0.1.8 → 0.1.9

package/src/models/generation-types.ts

@@ -0,0 +1,50 @@
+import type { InferSchemaOrRef, SchemaOrRef } from "../ontology"
+import type { ModelFinishReason, ModelUsage } from "./events"
+import type { LanguageModel, ModelReasoning } from "./language-model"
+import type { ModelMessage } from "./messages"
+import type { ModelCallCost } from "./pricing"
+
+export type LanguageModelOutputShape = Readonly<Record<string, SchemaOrRef>>
+
+export type InferLanguageModelOutput<TShape extends LanguageModelOutputShape> =
+  string extends keyof TShape
+    ? Record<string, unknown>
+    : { -readonly [K in keyof TShape]: InferSchemaOrRef<TShape[K]> }
+
+export type LanguageModelGenerateInput<
+  TShape extends LanguageModelOutputShape | undefined = undefined,
+> = {
+  readonly instructions?: string
+  readonly model?: LanguageModel
+  readonly output?: TShape
+  readonly maxOutputTokens?: number
+  readonly reasoning?: ModelReasoning
+  readonly caching?: "auto" | "off"
+  readonly signal?: AbortSignal
+} & (undefined extends TShape ? unknown : { readonly output: TShape }) &
+  (
+    | { readonly prompt: string; readonly messages?: never }
+    | { readonly messages: readonly ModelMessage[]; readonly prompt?: never }
+  )
+
+export interface LanguageModelGenerateResult<TOutput = string> {
+  readonly output: TOutput
+  readonly usage: ModelUsage
+  readonly cost: ModelCallCost
+  readonly finishReason: ModelFinishReason
+  readonly callId: string
+}
+
+export interface LanguageModelsRuntime {
+  generate<const TShape extends LanguageModelOutputShape | undefined = undefined>(
+    input: LanguageModelGenerateInput<TShape>
+  ): Promise<
+    LanguageModelGenerateResult<
+      TShape extends LanguageModelOutputShape ? InferLanguageModelOutput<TShape> : string
+    >
+  >
+}
+
+export interface ModelsRuntime {
+  readonly language: LanguageModelsRuntime
+}

package/src/models/index.ts

@@ -35,6 +35,14 @@ export type {
   ModelUsage,
 } from "./events"
 export { normalizeModelProviderIds } from "./events"
+export type {
+  InferLanguageModelOutput,
+  LanguageModelGenerateInput,
+  LanguageModelGenerateResult,
+  LanguageModelOutputShape,
+  LanguageModelsRuntime,
+  ModelsRuntime,
+} from "./generation-types"
 export type {
   LanguageModel,
   LanguageModelProvider,

package/src/models/language-model.ts

@@ -43,6 +43,7 @@ export interface ModelCapabilities {
   readonly reasoning?: false | ModelReasoningCapabilities
   readonly localTools?: boolean
   readonly parallelToolCalls?: boolean
+  /** `undefined` is unknown, not an assertion that schema-constrained output is unsupported. */
   readonly nativeStructuredOutput?: boolean
   readonly providerExecutedTools?: boolean
 }
@@ -90,6 +91,8 @@ export interface LanguageModel {
    * retry with an offline snapshot. Invalid definitions and other resolver errors remain fatal.
    */
   resolve?(options?: { readonly offline?: boolean }): Promise<LanguageModel>
+  /** Validate known output constraints without inference. Success does not certify endpoint support. */
+  validateResponseFormat?(format: ModelResponseFormat): void | Promise<void>
   stream(request: LanguageModelRequest): Promise<LanguageModelStream>
 }
 

package/src/models/output.ts

@@ -0,0 +1,45 @@
+import { assertJsonObject } from "../json"
+import { schemaRecordToJsonSchema } from "../ontology/json-schema"
+import { isObjectRefSchema, validateSchemaOrRefValue } from "../ontology/refs"
+import type { ValueType } from "../ontology/types"
+import { isRecord } from "../ontology/validation"
+import { coerceSchemaValueToTyped, normalizeSchemaValue } from "../ontology/validation/normalize"
+import type { LanguageModelOutputShape } from "./generation-types"
+import type { ModelOutput } from "./tools"
+
+export function languageModelOutput(
+  shape: LanguageModelOutputShape,
+  valueTypesById: ReadonlyMap<string, ValueType>
+): ModelOutput<Record<string, unknown>> {
+  if (!isRecord(shape)) throw new TypeError("[SixbModels] output must be a Sixb schema record.")
+  const schema = schemaRecordToJsonSchema({ shape, valueTypesById })
+  assertJsonObject(schema, "model output schema")
+  return {
+    name: "sixb_output",
+    schema,
+    validate(value) {
+      if (!isRecord(value)) throw new TypeError("[SixbModels] Output must be an object.")
+      for (const key of Object.keys(value)) {
+        if (!Object.hasOwn(shape, key)) {
+          throw new TypeError(`[SixbModels] Unknown output field '${key}'.`)
+        }
+      }
+      return Object.fromEntries(
+        Object.entries(shape).map(([key, field]) => {
+          if (!Object.hasOwn(value, key)) {
+            throw new TypeError(`[SixbModels] Missing output field '${key}'.`)
+          }
+          validateSchemaOrRefValue(field, value[key], `output.${key}`, valueTypesById)
+          const output = isObjectRefSchema(field)
+            ? value[key]
+            : coerceSchemaValueToTyped(
+                field,
+                normalizeSchemaValue(field, value[key], `output.${key}`, valueTypesById),
+                valueTypesById
+              )
+          return [key, output]
+        })
+      )
+    },
+  }
+}

package/src/models/resolve.ts

@@ -0,0 +1,27 @@
+import { defineLanguageModel } from "./definitions"
+import { ModelCatalogUnavailableError } from "./errors"
+import type { LanguageModel } from "./language-model"
+
+/** Pin operational metadata once, falling back offline only when the catalog is unavailable. */
+export async function resolveLanguageModel(binding: LanguageModel): Promise<LanguageModel> {
+  const offline =
+    binding.definition.contextWindow !== undefined ||
+    binding.definition.maxInputTokens !== undefined
+  let model: LanguageModel
+  try {
+    model = (await binding.resolve?.({ offline })) ?? binding
+  } catch (cause) {
+    if (offline || !(cause instanceof ModelCatalogUnavailableError)) throw cause
+    model = (await binding.resolve?.({ offline: true })) ?? binding
+  }
+  const definition = defineLanguageModel(model.definition)
+  if (
+    definition.providerId !== binding.providerId ||
+    definition.modelId !== binding.modelId ||
+    model.providerId !== binding.providerId ||
+    model.modelId !== binding.modelId
+  ) {
+    throw new TypeError("[SixbModels] Resolved model identity does not match the selected model.")
+  }
+  return model
+}

package/src/objects/execution.ts

@@ -5,8 +5,8 @@ import {
   getAuthorizedOntologyView,
 } from "../execution/authorized-object-reader"
 import type { ValueType } from "../ontology"
-import { assertObjectTypeRegistered } from "../ontology"
 import type { ObjectTypeWithPropertyTokens } from "../ontology/tokens"
+import { assertObjectTypeRegistered } from "../ontology/validation/properties"
 import { shareOntologyMutationRuntime } from "../runtime/ontology-mutations"
 import type {
   ListResult,

package/src/ontology/index.ts

@@ -25,7 +25,7 @@ export type {
   LinkPathSelectionMode,
 } from "./link-path-selection"
 export type { InferSchemaOrRef, ObjectRef, ObjectRefSchema, SchemaOrRef } from "./refs"
-export { isObjectRefSchema, objectRef, ref, validateSchemaOrRefValue } from "./refs"
+export { isObjectRefSchema, objectRef, ref } from "./refs"
 export type {
   LinkToken,
   LinkTokenMap,
@@ -88,4 +88,3 @@ export {
   valueTypeRef,
 } from "./builders"
 export * from "./units"
-export * from "./validation"

package/src/ontology/internal.ts

@@ -1,2 +1,37 @@
 export { schemaFieldsToJsonSchema, schemaRecordToJsonSchema } from "./json-schema"
+export { validateSchemaOrRefValue } from "./refs"
 export { createLinkTokenMap, createPropertyTokenMap } from "./tokens"
+export {
+  assertLinkTargetType,
+  assertTargetTypeCompatible,
+  normalizeLinkProperties,
+  validateLinkProperties,
+} from "./validation/links"
+export {
+  coerceSchemaValueToTyped,
+  normalizeObjectProperties,
+  normalizeSchemaValue,
+} from "./validation/normalize"
+export {
+  assertKnownProperties,
+  assertLinkTokenBelongsToObjectType,
+  assertObjectTypeRegistered,
+  assertPropertyTokenBelongsToObjectType,
+  assertRequiredProperties,
+  validateObjectProperties,
+  validatePrimaryProperties,
+  validatePropertyDefinitions,
+  validatePropertyValue,
+} from "./validation/properties"
+export { validateQueryMetadata } from "./validation/query"
+export {
+  isRecord,
+  resolveValueTypeRef,
+  resolveValueTypeSchema,
+  validateSchemaValue,
+} from "./validation/schema"
+export {
+  assertTelemetryProperty,
+  resolveSemanticType,
+  validateTelemetryUnit,
+} from "./validation/telemetry"

package/src/projections/run-dispatch.ts

@@ -144,6 +144,7 @@ async function persistProjectionRun(input: {
         versionId: input.identity.datasetVersion.versionId,
       },
       correlationId: input.producerExecution?.correlationId ?? input.runId,
+      requesterGroupIds: input.producerExecution?.requesterGroupIds,
       ...(input.producerExecution?.requestedBy === undefined
         ? {}
         : { requestedBy: input.producerExecution.requestedBy }),

package/src/query.ts

@@ -40,7 +40,6 @@ export type {
   ObjectQueryTraverse,
   ObjectQueryVector,
 } from "./objects/query/ir"
-export { normalizeObjectQuery } from "./objects/query/normalize"
 export { createObjectQueryBuilder } from "./objects/sdk/query-builder"
 export type {
   ObjectQueryExecutor,

package/src/queues/index.ts

@@ -7,14 +7,16 @@ export type {
   ModelRoute,
 } from "../models"
 export type { ModelProviderIds } from "../models/events"
+export type {
+  AiModelCallAccountingPayload,
+  AiModelCallRecordPayload,
+} from "../models/execution/types"
 export type { ProviderScope } from "../provider-scope"
 export { QueueError } from "./errors"
 export { InMemoryQueues } from "./in-memory"
 export type {
   ActionQueueJobFailureCode,
   ActionRunRequestedQueueJob,
-  AgentAiUsageAccountingPayload,
-  AgentAiUsageRecordPayload,
   AgentAiUsageRecordRequestedQueueJob,
   AgentQueueJob,
   AgentQueueJobFailureCode,

package/src/queues/types.ts

@@ -1,11 +1,13 @@
 import type { SixbErrorCode, SixbFailure } from "../errors/types"
 import type { JsonValue } from "../json"
-import type { ModelCallCost, ModelCostEstimate, ModelRoute } from "../models"
+import type {
+  AiModelCallAccountingPayload,
+  AiModelCallRecordPayload,
+} from "../models/execution/types"
 import type { ProjectionRunFailureCode } from "../projections/types"
 import type { ProviderScope } from "../provider-scope"
 import type { ActionRunFailureCode } from "../storage/action-runs/types"
 import type { AgentRunFailureCode } from "../storage/agents/types"
-import type { RecordAiModelCallInput } from "../storage/ai-usage"
 import type { PipelineRunFailureCode } from "../storage/pipeline-runs/types"
 import type { SyncRunFailureCode } from "../storage/sync-runs/types"
 import type { WorkflowRunFailureCode } from "../storage/workflow-runs/types"
@@ -210,33 +212,12 @@ export interface AgentWorkflowNodeRequestedQueueJob
     }
   > {}
 
-/** JSON-safe representation of one model-call ledger append awaiting durable recovery. */
-export type AgentAiUsageRecordPayload = Omit<
-  RecordAiModelCallInput,
-  "projectId" | "usage" | "occurredAt" | "recordedAt"
-> & {
-  readonly usage: {
-    readonly [Field in keyof RecordAiModelCallInput["usage"]]: RecordAiModelCallInput["usage"][Field]
-  }
-  readonly occurredAt: string
-}
-
-export interface AgentAiUsageAccountingPayload {
-  readonly estimate?: ModelCostEstimate
-  readonly cost: ModelCallCost
-  readonly route?: ModelRoute
-  readonly ratedAt: string
-  /** Absent on pre-limit jobs; those model calls did not create a reservation. */
-  readonly reconcileLimitReservation?: boolean
-}
-
 export interface AgentAiUsageRecordRequestedQueueJob
   extends QueueJob<
     "agent.ai-usage.record.requested",
     {
-      readonly record: AgentAiUsageRecordPayload
-      /** Absent only on legacy jobs that predate atomic valuation recovery. */
-      readonly accounting?: AgentAiUsageAccountingPayload
+      readonly record: AiModelCallRecordPayload
+      readonly accounting: AiModelCallAccountingPayload
     }
   > {}
 

package/src/runtime/create.ts

@@ -10,7 +10,8 @@ import type { ConnectorConnectionOptions, ConnectorDefinition } from "../connect
 import type { DatasetDefinition } from "../datasets"
 import type { SixbErrorHandler } from "../error-reporting/types"
 import type { LakeStorage } from "../lake-storage"
-import type { LoggerProvider, ObservabilityOptions } from "../logging"
+import type { LoggerProvider } from "../logging"
+import type { ObservabilityOptions } from "../logging/service"
 import type { OntologyMaintenanceOptions } from "../maintenance"
 import type { ModelCatalogInput } from "../models"
 import type { PipelineDefinition } from "../pipelines/types"

package/src/runtime/host.ts

@@ -43,7 +43,8 @@ import {
 import { createAuthorizedObjectReader } from "../execution/authorized-object-reader"
 import type { ExecutionScope } from "../execution/types"
 import type { LakeStorage } from "../lake-storage"
-import { type LoggerProvider, LoggingService, type ObservabilityOptions } from "../logging"
+import type { LoggerProvider } from "../logging"
+import { LoggingService, type ObservabilityOptions } from "../logging/service"
 import {
   OntologyMaintenance,
   type OntologyMaintenanceHandle,

package/src/runtime/sixb.ts

@@ -16,6 +16,8 @@ import { assertAuthorizedObjectReaderBinding } from "../execution/authorized-obj
 import type { LakeStorage } from "../lake-storage/types"
 import { createLogsRuntime, type LogsRuntime } from "../logging/execution"
 import type { LoggingService } from "../logging/service"
+import { createModelsRuntime } from "../models/execution"
+import type { ModelsRuntime } from "../models/generation-types"
 import { createObjectsRuntime, type ObjectsRuntime } from "../objects/execution"
 import { createPipelinesRuntime, type PipelinesRuntime } from "../pipelines/execution"
 import { createProjectionsRuntime, type ProjectionsRuntime } from "../projections/execution"
@@ -42,6 +44,7 @@ export interface Sixb<
   readonly projections: ProjectionsRuntime
   readonly rules: RulesRuntime
   readonly agent: AgentRuntime
+  readonly models: ModelsRuntime
   readonly aiUsage: AiUsageRuntime
   readonly events: EventsRuntime
   readonly logs: LogsRuntime
@@ -118,6 +121,7 @@ function createExecutionFacades<TOntologySources extends readonly OntologySource
     projections: createProjectionsRuntime(runtime, dependencies.definitions.projections),
     rules: createRulesRuntime(runtime, dependencies.definitions.rules),
     agent: createAgentRuntime(runtime, execution, dependencies.definitions.models),
+    models: createModelsRuntime(runtime, execution, dependencies.definitions.models),
     aiUsage: createAiUsageRuntime(runtime, dependencies.definitions.security),
     events: createEventsRuntime(runtime),
     logs: createLogsRuntime(runtime, dependencies.logging),

package/src/sandboxes/errors.ts

@@ -6,6 +6,11 @@ export class SandboxError extends Error {
   readonly name: string = "SandboxError"
 }
 
+/** The named sandbox or its saved filesystem no longer exists. Explicit recreation is required. */
+export class SandboxStateUnavailableError extends SandboxError {
+  override readonly name = "SandboxStateUnavailableError"
+}
+
 /** runCommand / stop / destroy called after the sandbox is stopped or destroyed. */
 export class SandboxNotRunningError extends SandboxError {
   override readonly name = "SandboxNotRunningError"

package/src/sandboxes/index.ts

@@ -2,6 +2,7 @@ export {
   SandboxError,
   SandboxIsolationUnavailableError,
   SandboxNotRunningError,
+  SandboxStateUnavailableError,
   SandboxTimeoutError,
 } from "./errors"
 export type { ExecOptions } from "./exec"
@@ -9,11 +10,13 @@ export { exec } from "./exec"
 export type {
   CommandResult,
   CreateSandboxOptions,
+  ResumeSandboxOptions,
   RunCommandOptions,
   Sandbox,
   SandboxFactory,
   SandboxFileRecord,
   SandboxNetworkPolicy,
   SandboxNetworkTarget,
+  SandboxSessionOptions,
   SandboxStatus,
 } from "./sandbox"

package/src/sandboxes/sandbox.ts

@@ -72,17 +72,25 @@ export interface SandboxNetworkTarget {
   readonly origin: string
 }
 
-/**
- * Options accepted by every SandboxFactory.create. Provider-specific factories
- * may extend this type with their own options.
- */
-export interface CreateSandboxOptions {
+/** Current execution defaults, supplied on both creation and resume, never recovered from files. */
+export interface SandboxSessionOptions {
   readonly workingDirectory?: string
   readonly env?: Readonly<Record<string, string>>
   readonly timeout?: number
   readonly network?: SandboxNetworkPolicy
 }
 
+/** Options accepted by every SandboxFactory.create. */
+export interface CreateSandboxOptions extends SandboxSessionOptions {
+  /** Create new named state; reject an existing name or unsupported persistence before provisioning. */
+  readonly persistence?: { readonly name: string }
+}
+
+/** Resume changes execution defaults, not the identity or creation configuration of saved state. */
+export interface ResumeSandboxOptions extends SandboxSessionOptions {
+  readonly persistence?: never
+}
+
 export interface Sandbox {
   readonly id: string
   /** Provider id matching the package suffix, for example "local". */
@@ -109,16 +117,36 @@ export interface Sandbox {
    */
   writeFiles(files: readonly SandboxFileRecord[]): Promise<void>
 
-  /** Mark the sandbox stopped; subsequent runCommand calls reject. Idempotent. */
+  /** Stop this session; subsequent operations reject. Idempotent.
+   * Persistent handles confirm preservation and share the outcome, including failure,
+   * across repeated/concurrent calls.
+   */
   stop(): Promise<void>
-  /** Stop and reclaim any provider-side resources. Idempotent. */
+  /** Stop and reclaim resources, permanently deleting named state when persistent. Idempotent.
+   * Requires exclusive lifecycle ownership, including after stop(); never routine persistent teardown.
+   */
   destroy(): Promise<void>
 }
 
 /**
  * What createSixb({ sandboxes }) accepts. Provider-specific factories hold
  * their defaults set once and expose create(options) for each run.
+ * Persistent files are retention-bound, not a durable file store or a distributed lock.
+ * Callers own namespacing and must serialize the entire create/resume/use/stop/destroy lifecycle.
+ * Credentials and current authority must be supplied again, never inferred from saved files.
  */
 export interface SandboxFactory {
+  /** Create an ephemeral sandbox unless persistence is requested. Existing names must fail,
+   * never attach or overwrite. Unsupported providers must reject persistence before provisioning.
+   * A persistent handle targets one session; operations must not automatically resume another VM.
+   */
   create(options?: CreateSandboxOptions): Promise<Sandbox>
+  /**
+   * Present only when named persistent creation and resume are supported.
+   * Resume an existing, stopped sandbox. Missing/expired state throws SandboxStateUnavailableError;
+   * it must never create an empty replacement. An already running sandbox must be rejected.
+   * Returns a handle bound to the resumed session, with no automatic resume on use.
+   * Runtime options must be provided again; no creation settings or persistence option are accepted.
+   */
+  resume?(name: string, options?: ResumeSandboxOptions): Promise<Sandbox>
 }

package/src/storage/agents/in-memory.ts

@@ -1,6 +1,5 @@
 import { AGENT_MESSAGE_CONTENT_VERSION } from "../../agents/message"
 import { principalsEqual } from "../../auth"
-import { normalizeRequesterGroupIds } from "../../auth/attribution"
 import { parseSixbFailure } from "../../errors/internal"
 import type { SixbFailure } from "../../errors/types"
 import type { ExecutionStorage } from "../executions"
@@ -234,7 +233,6 @@ class InMemoryAgentRunStore implements AgentRunStore {
       threadId: input.threadId,
       triggerMessageId: input.triggerMessageId,
       spec: clone(input.spec),
-      requesterGroupIds: normalizeRequesterGroupIds(input.requesterGroupIds),
       status: "queued",
       attempt: 0,
       createdAt,
@@ -330,7 +328,6 @@ class InMemoryAgentRunStore implements AgentRunStore {
       parentRunId: input.parentRunId,
       spawnKey: input.spawnKey,
       spec: clone(input.spec),
-      requesterGroupIds: clone(parent.requesterGroupIds),
       status: "queued",
       attempt: 0,
       createdAt: new Date(input.createdAt ?? new Date()),

package/src/storage/agents/types.ts

@@ -148,8 +148,6 @@ interface AgentRunRecordBase {
   readonly id: string
   readonly projectId: string
   readonly executionId: string
-  /** Durable group memberships snapshotted when the run was admitted. */
-  readonly requesterGroupIds: readonly string[]
   readonly status: AgentRunStatus
   readonly modelId?: string
   /** Why the run ended (our own SDK-independent enum). */
@@ -215,7 +213,6 @@ export interface CreateAgentRunInput {
   readonly threadId: string
   readonly triggerMessageId: string
   readonly spec: ConversationAgentRunSpec
-  readonly requesterGroupIds: readonly string[]
   readonly createdAt?: Date
 }
 

package/src/storage/ai-cost/analytics.ts

@@ -168,7 +168,7 @@ export function buildAiAccountingOverview(
         item
       )
     }
-    if (item.attribution?.kind === "workflowAgent") {
+    if (item.attribution?.kind === "workflowAgent" || item.attribution?.kind === "workflow") {
       appendGrouped(workflowItems, item.attribution.workflowId, item)
     }
   }

package/src/storage/ai-cost/attribution.ts

@@ -0,0 +1,15 @@
+import type { AiAccountingAttribution } from "./types"
+
+/** Direct calls are identified by durable provenance, even when their run has been removed. */
+export function directModelCallAttribution(
+  kind: string | null,
+  id: string | null,
+  primitiveId: string | null
+): AiAccountingAttribution | undefined {
+  if (!id) return undefined
+  if (kind === "request") return { kind, requestId: id }
+  if (kind === "action" && primitiveId) return { kind, actionId: primitiveId, actionRunId: id }
+  if (kind === "workflow" && primitiveId)
+    return { kind, workflowId: primitiveId, workflowRunId: id }
+  return undefined
+}

package/src/storage/ai-cost/groups.ts

@@ -1,5 +1,6 @@
 import type { AiAccountingRecordSetItem } from "./analytics"
 import { aiAccountingItemMatchesQuery, normalizeAiModelCallAccountingQuery } from "./analytics"
+import { directModelCallAttribution } from "./attribution"
 import type {
   AiAccountingAttribution,
   AiBillingIdentity,
@@ -56,12 +57,15 @@ export interface AiModelCallGroupRow {
   readonly workflow_node_run_id: string | null
   readonly workflow_id: string | null
   readonly workflow_run_id: string | null
+  readonly executor_kind: string | null
+  readonly executor_id: string | null
+  readonly primitive_id: string | null
 }
 
 export function aiModelCallGroupFragmentFromRow(
   row: AiModelCallGroupRow
 ): AiModelCallGroupFragment {
-  let attribution: AiAccountingAttribution | undefined
+  let attribution = directModelCallAttribution(row.executor_kind, row.executor_id, row.primitive_id)
   if (row.root_agent_run_id && row.root_thread_id) {
     attribution = {
       kind: "agent",

package/src/storage/ai-cost/provider.ts

@@ -12,6 +12,7 @@ export {
   normalizeAiModelCallAccountingQuery,
   toAccountingItem,
 } from "./analytics"
+export { directModelCallAttribution } from "./attribution"
 export type { AiModelCallCostDetails } from "./codec"
 export { aiModelCallCostDetails, parseAiModelCallCostDetails } from "./codec"
 export type {

package/src/storage/ai-cost/types.ts

@@ -181,7 +181,14 @@ export interface AiAccountingOverview {
   readonly workflows: readonly AiAccountingWorkflowBreakdown[]
 }
 
+/**
+ * The execution that made the model call, rather than the request that triggered its work.
+ * `request` identifies a direct call from a request-bound SDK, outside an action or workflow.
+ */
 export type AiAccountingAttribution =
+  | { readonly kind: "request"; readonly requestId: string }
+  | { readonly kind: "action"; readonly actionId: string; readonly actionRunId: string }
+  | { readonly kind: "workflow"; readonly workflowId: string; readonly workflowRunId: string }
   | {
       readonly kind: "agent"
       readonly agentRunId: string

package/src/storage/auth/in-memory.ts

@@ -1 +1 @@
-export { InMemoryAuthStorage } from "./in-memory/index"
+export { InMemoryAuthStorage } from "./in-memory/auth-storage"

package/src/storage/executions/in-memory.ts

@@ -2,11 +2,7 @@ import type { AuthStorage } from "../auth"
 import type { ShareSessionStorage } from "../share-sessions"
 import { ExecutionStorageError } from "./errors"
 import type { CreateExecutionInput, ExecutionRecord, ExecutionStorage } from "./types"
-import {
-  cloneExecutionRecord,
-  normalizeExecutionRecord,
-  validateExecutionRecordReferences,
-} from "./validation"
+import { cloneExecutionRecord, prepareExecutionRecord } from "./validation"
 
 type RunRootOperation = <T>(run: () => Promise<T> | T) => Promise<T>
 
@@ -45,16 +41,15 @@ export class InMemoryExecutionStorage implements ExecutionStorage {
 
   async create(input: CreateExecutionInput): Promise<ExecutionRecord> {
     return this.runRootOperation(async () => {
-      const record = normalizeExecutionRecord(input)
-      const key = executionKey(record.projectId, record.id)
+      const key = executionKey(input.projectId, input.id)
       if (this.rows.has(key)) {
         throw new ExecutionStorageError(
           "duplicate_execution",
-          `[Sixb] Execution '${record.id}' already exists in project '${record.projectId}'.`
+          `[Sixb] Execution '${input.id}' already exists in project '${input.projectId}'.`
         )
       }
 
-      await validateExecutionRecordReferences(record, {
+      const record = await prepareExecutionRecord(input, {
         auth: this.auth,
         getExecution: async ({ projectId, id }) => {
           const existing = this.rows.get(executionKey(projectId, id))

package/src/storage/executions/provider.ts

@@ -6,6 +6,7 @@ import { normalizeExecutionRecord } from "./validation"
 export {
   type ExecutionValidationLookup,
   normalizeExecutionRecord,
+  prepareExecutionRecord,
   validateExecutionRecordReferences,
 } from "./validation"
 
@@ -19,6 +20,7 @@ export interface ExecutionStorageRow {
   readonly sourceId: string
   readonly requestedByUserId: string | null
   readonly requestedByServiceAccountId: string | null
+  readonly requesterGroupIds: readonly string[]
   readonly correlationId: string
   /** SQL-only projection of an execution source, used to enforce the parent foreign key. */
   readonly parentExecutionId: string | null
@@ -43,6 +45,7 @@ export function executionRecordToStorageRow(record: ExecutionRecord): ExecutionS
   return {
     projectId: record.projectId,
     id: record.id,
+    requesterGroupIds: [...record.requesterGroupIds],
     ...executor,
     ...source,
     requestedByUserId: record.requestedBy?.type === "user" ? record.requestedBy.id : null,
@@ -70,6 +73,7 @@ export function executionRecordFromStorageRow(row: ExecutionStorageRow): Executi
     {
       id: row.id,
       projectId: row.projectId,
+      requesterGroupIds: row.requesterGroupIds,
       ...(requestedBy === undefined ? {} : { requestedBy }),
       executor,
       source,