@sixb/pg 0.1.11 → 0.1.13

package/dist/index.js

@@ -125,6 +125,7 @@ function canStartPgTransaction(sql) {
 }
 
 // src/agents/rows.ts
+import { snapshotAgentThreadSandboxParams } from "@sixb/core/internal/agent-run-storage-provider";
 import { parseSixbFailure } from "@sixb/core/internal/errors";
 import {
   AGENT_RUN_FAILURE_CODES,
@@ -136,6 +137,12 @@ function rowToThreadRecord(row) {
     projectId: row.project_id,
     ownerPrincipal: { type: row.owner_principal_type, id: row.owner_principal_id },
     title: row.title ?? undefined,
+    ...row.sandbox_state == null ? {} : {
+      sandboxState: typeof row.sandbox_state === "string" ? JSON.parse(row.sandbox_state) : row.sandbox_state
+    },
+    ...row.sandbox_params == null ? {} : {
+      sandboxParams: snapshotAgentThreadSandboxParams(typeof row.sandbox_params === "string" ? JSON.parse(row.sandbox_params) : row.sandbox_params)
+    },
     status: row.status,
     activeRunId: row.active_run_id,
     lastMessageAt: row.last_message_at ? new Date(row.last_message_at) : undefined,
@@ -974,6 +981,10 @@ class PgAgentRunStore {
 }
 
 // src/agents/threads.ts
+import {
+  snapshotAgentThreadSandboxParams as snapshotAgentThreadSandboxParams2,
+  transitionAgentThreadSandbox
+} from "@sixb/core/internal/agent-run-storage-provider";
 import {
   AgentStorageError as AgentStorageError4
 } from "@sixb/core/storage";
@@ -982,7 +993,24 @@ class PgAgentThreadStore {
   constructor(sql) {
     this.sql = sql;
   }
+  async transitionSandbox(input) {
+    return runPgTransaction(this.sql, async (tx) => {
+      const runs = input.action === "recreate" ? [] : await tx`
+        SELECT * FROM agent_runs WHERE project_id = ${input.projectId} AND id = ${input.runId}
+        FOR UPDATE
+      `;
+      const [thread] = await tx`
+        SELECT * FROM agent_threads WHERE project_id = ${input.projectId} AND id = ${input.id}
+        FOR UPDATE
+      `;
+      const state = transitionAgentThreadSandbox(thread ? rowToThreadRecord(thread) : null, runs[0] ? rowToRunRecord(runs[0]) : null, input);
+      await tx`UPDATE agent_threads SET sandbox_state = ${JSON.stringify(state)}::text::jsonb
+        WHERE project_id = ${input.projectId} AND id = ${input.id}`;
+      return state;
+    });
+  }
   async create(input) {
+    const sandboxParams = input.sandboxParams === undefined ? null : JSON.stringify(snapshotAgentThreadSandboxParams2(input.sandboxParams));
     const createdAt = input.createdAt ?? new Date;
     const updatedAt = input.updatedAt ?? createdAt;
     try {
@@ -993,6 +1021,7 @@ class PgAgentThreadStore {
           owner_principal_type,
           owner_principal_id,
           title,
+          sandbox_params,
           status,
           created_at,
           updated_at
@@ -1002,6 +1031,7 @@ class PgAgentThreadStore {
           ${input.ownerPrincipal.type},
           ${input.ownerPrincipal.id},
           ${input.title ?? null},
+          ${sandboxParams}::text::jsonb,
           ${input.status ?? "active"},
           ${createdAt},
           ${updatedAt}
@@ -1132,7 +1162,14 @@ function rowToSessionRecord(row) {
     revokedAt: row.revoked_at ? toDate(row.revoked_at) : undefined,
     lastSeenAt: row.last_seen_at ? toDate(row.last_seen_at) : undefined,
     userAgent: row.user_agent ?? undefined,
-    ipAddress: row.ip_address ?? undefined
+    ipAddress: row.ip_address ?? undefined,
+    bearer: row.refresh_token_hash !== null && row.client_name !== null && row.access_expires_at !== null ? {
+      clientName: row.client_name,
+      accessExpiresAt: toDate(row.access_expires_at),
+      refreshTokenHash: row.refresh_token_hash,
+      previousRefreshTokenHash: row.previous_refresh_token_hash ?? undefined,
+      refreshedAt: row.refreshed_at ? toDate(row.refreshed_at) : undefined
+    } : undefined
   };
 }
 function rowToAccessTokenRecord(row) {
@@ -1141,8 +1178,7 @@ function rowToAccessTokenRecord(row) {
     projectId: row.project_id,
     name: row.name,
     kind: row.kind,
-    subjectType: row.subject_type,
-    subjectId: row.subject_id,
+    subject: { type: row.subject_type, id: row.subject_id },
     tokenHash: row.token_hash,
     groupIds: parseOptionalStringArray(row.group_ids),
     createdByPrincipal: principalFromColumns2(row),
@@ -1217,8 +1253,6 @@ function rowToDeviceAuthorizationRecord(row) {
     deviceCodeHash: row.device_code_hash,
     userCode: row.user_code,
     clientName: row.client_name,
-    tokenName: row.token_name,
-    tokenExpiresAt: toDate(row.token_expires_at),
     status: row.status,
     approvedUserId: row.approved_user_id ?? undefined,
     approvedSessionId: row.approved_session_id ?? undefined,
@@ -1529,7 +1563,10 @@ async function createSession(sql, input) {
         expires_at,
         absolute_expires_at,
         user_agent,
-        ip_address
+        ip_address,
+        client_name,
+        access_expires_at,
+        refresh_token_hash
       ) VALUES (
         ${projectId},
         ${id},
@@ -1541,7 +1578,10 @@ async function createSession(sql, input) {
         ${input.expiresAt},
         ${input.absoluteExpiresAt ?? null},
         ${input.userAgent ?? null},
-        ${input.ipAddress ?? null}
+        ${input.ipAddress ?? null},
+        ${input.bearer ? assertNonEmpty(input.bearer.clientName, "Session client name") : null},
+        ${input.bearer?.accessExpiresAt ?? null},
+        ${input.bearer ? assertNonEmpty(input.bearer.refreshTokenHash, "Refresh token hash") : null}
       )
       RETURNING *
     `;
@@ -1733,10 +1773,10 @@ class PgAuthAccessTokenStore {
     const id = assertNonEmpty(input.id, "Access token id");
     const projectId = assertNonEmpty(input.projectId, "Project id");
     const name = assertNonEmpty(input.name, "Access token name");
-    const subjectId = assertNonEmpty(input.subjectId, "Access token subject id");
+    const subjectId = assertNonEmpty(input.subject.id, "Access token subject id");
     const tokenHash = assertNonEmpty(input.tokenHash, "Access token hash");
     assertKindMatchesSubject(input);
-    await this.assertSubjectExists(projectId, input.subjectType, subjectId);
+    await this.assertSubjectExists(projectId, input.subject.type, subjectId);
     const groupIds = input.groupIds === undefined ? undefined : normalizeGroupIds(input.groupIds);
     try {
       const [row] = await this.sql`
@@ -1760,7 +1800,7 @@ class PgAuthAccessTokenStore {
           ${id},
           ${name},
           ${input.kind},
-          ${input.subjectType},
+          ${input.subject.type},
           ${subjectId},
           ${tokenHash},
           ${serializeOptionalStringArray(groupIds)},
@@ -1795,13 +1835,9 @@ class PgAuthAccessTokenStore {
       whereClauses.push(`kind = $${nextIndex++}`);
       params.push(input.kind);
     }
-    if (input.subjectType) {
-      whereClauses.push(`subject_type = $${nextIndex++}`);
-      params.push(input.subjectType);
-    }
-    if (input.subjectId) {
-      whereClauses.push(`subject_id = $${nextIndex++}`);
-      params.push(input.subjectId);
+    if (input.subject) {
+      whereClauses.push(`subject_type = $${nextIndex++}`, `subject_id = $${nextIndex++}`);
+      params.push(input.subject.type, input.subject.id);
     }
     if (!input.includeRevoked) {
       whereClauses.push("revoked_at IS NULL");
@@ -1889,10 +1925,10 @@ class PgAuthAccessTokenStore {
   }
 }
 function assertKindMatchesSubject(input) {
-  if (input.kind === "personal" && input.subjectType === "user" || input.kind === "serviceAccount" && input.subjectType === "serviceAccount") {
+  if (input.kind === "personal" && input.subject.type === "user" || input.kind === "serviceAccount" && input.subject.type === "serviceAccount") {
     return;
   }
-  throw new AuthStorageError2("invalid_input", `[Sixb] Access token kind '${input.kind}' cannot target subject type '${input.subjectType}'.`);
+  throw new AuthStorageError2("invalid_input", `[Sixb] Access token kind '${input.kind}' cannot target subject type '${input.subject.type}'.`);
 }
 
 // src/auth-storage/device-authorizations.ts
@@ -1919,16 +1955,15 @@ class PgAuthDeviceAuthorizationStore {
       try {
         const [row] = await tx`
         INSERT INTO auth_device_authorizations (
-          project_id, id, device_code_hash, user_code, client_name, token_name,
-          token_expires_at, status, created_at, expires_at
+          project_id, id, device_code_hash, user_code, client_name, status, created_at,
+          expires_at
         ) VALUES (
           ${assertNonEmpty(input.projectId, "Project id")},
           ${assertNonEmpty(input.id, "Device authorization id")},
           ${assertNonEmpty(input.deviceCodeHash, "Device code hash")},
           ${assertNonEmpty(input.userCode, "User code")},
           ${assertNonEmpty(input.clientName, "Client name")},
-          ${assertNonEmpty(input.tokenName, "Token name")},
-          ${input.tokenExpiresAt}, 'pending', ${input.createdAt}, ${input.expiresAt}
+          'pending', ${input.createdAt}, ${input.expiresAt}
         ) RETURNING *
       `;
         return rowToDeviceAuthorizationRecord(row);
@@ -2670,11 +2705,53 @@ class PgAuthSessionStore {
   }
   async findValidByTokenHash(params) {
     const row = await getSessionRowById(this.sql, params);
-    if (!row || row.audience !== params.audience || row.token_hash !== params.tokenHash || row.revoked_at || new Date(row.expires_at) <= params.now || row.absolute_expires_at !== null && new Date(row.absolute_expires_at) <= params.now) {
+    if (!row || row.refresh_token_hash !== null || row.audience !== params.audience || row.token_hash !== params.tokenHash || !isLiveSessionRow(row, params.now)) {
+      return null;
+    }
+    return rowToSessionRecord(row);
+  }
+  async findValidByAccessTokenHash(params) {
+    const row = await getSessionRowById(this.sql, params);
+    if (!row || row.access_expires_at === null || row.token_hash !== params.tokenHash || new Date(row.access_expires_at) <= params.now || !isLiveSessionRow(row, params.now)) {
       return null;
     }
     return rowToSessionRecord(row);
   }
+  async rotateRefreshToken(params) {
+    return runPgTransaction(this.sql, async (tx) => {
+      const row = await getSessionRowById(tx, params, { forUpdate: true });
+      if (!row?.refresh_token_hash || !isLiveSessionRow(row, params.now)) {
+        return { status: "invalid" };
+      }
+      const replacedRecently = row.previous_refresh_token_hash === params.refreshTokenHash && row.refreshed_at !== null && params.now.getTime() - new Date(row.refreshed_at).getTime() <= params.reuseGraceMs;
+      if (row.refresh_token_hash !== params.refreshTokenHash && !replacedRecently) {
+        if (row.previous_refresh_token_hash !== params.refreshTokenHash) {
+          return { status: "invalid" };
+        }
+        await tx`
+          UPDATE auth_sessions SET revoked_at = ${params.now}
+          WHERE project_id = ${params.projectId} AND id = ${params.id}
+        `;
+        return { status: "reused" };
+      }
+      const [rotated] = await tx`
+        UPDATE auth_sessions
+        SET token_hash = ${params.next.tokenHash},
+            access_expires_at = ${params.next.accessExpiresAt},
+            previous_refresh_token_hash = refresh_token_hash,
+            refresh_token_hash = ${params.next.refreshTokenHash},
+            refreshed_at = ${params.now},
+            last_seen_at = ${params.now},
+            expires_at = GREATEST(
+              expires_at,
+              LEAST(${params.next.expiresAt}, COALESCE(absolute_expires_at, ${params.next.expiresAt}))
+            )
+        WHERE project_id = ${params.projectId} AND id = ${params.id}
+        RETURNING *
+      `;
+      return rotated ? { status: "rotated", session: rowToSessionRecord(rotated) } : { status: "invalid" };
+    });
+  }
   async renewIfValid(params) {
     const [row] = await this.sql`
       UPDATE auth_sessions
@@ -2690,6 +2767,7 @@ class PgAuthSessionStore {
         AND id = ${params.id}
         AND audience = ${params.audience}
         AND token_hash = ${params.tokenHash}
+        AND refresh_token_hash IS NULL
         AND revoked_at IS NULL
         AND expires_at > ${params.now}
         AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.now})
@@ -2737,6 +2815,9 @@ class PgAuthSessionStore {
     });
   }
 }
+function isLiveSessionRow(row, now) {
+  return row.revoked_at === null && new Date(row.expires_at) > now && (row.absolute_expires_at === null || new Date(row.absolute_expires_at) > now);
+}
 
 // src/auth-storage/users.ts
 import { AuthStorageError as AuthStorageError10 } from "@sixb/core/storage";
@@ -2898,7 +2979,7 @@ class PgAuthStorage {
         throw new AuthStorageError11("missing_device_authorization", `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`);
       }
       assertCompletableDeviceAuthorization(authorization, input);
-      const accessToken = await new PgAuthAccessTokenStore(tx).create(input.accessToken);
+      const session = await createSession(tx, input.session);
       const [consumed] = await tx`
         UPDATE auth_device_authorizations
         SET status = 'consumed', consumed_at = ${input.completedAt}
@@ -2914,7 +2995,7 @@ class PgAuthStorage {
           status: "consumed",
           consumedAt: new Date(input.completedAt)
         },
-        accessToken
+        session
       };
     });
   }
@@ -3376,7 +3457,7 @@ function assertCompletableDeviceAuthorization(authorization, input) {
   if (authorization.status === "denied") {
     throw new AuthStorageError11("device_authorization_denied", "[Sixb] Device authorization was denied.");
   }
-  if (authorization.status !== "approved" || authorization.expiresAt <= input.completedAt || !authorization.approvedUserId || !authorization.approvedSessionId || input.accessToken.projectId !== input.projectId || input.accessToken.subjectType !== "user" || input.accessToken.subjectId !== authorization.approvedUserId || input.accessToken.createdBySessionId !== authorization.approvedSessionId) {
+  if (authorization.status !== "approved" || authorization.expiresAt <= input.completedAt || !authorization.approvedUserId || !authorization.approvedSessionId || input.session.projectId !== input.projectId || input.session.userId !== authorization.approvedUserId) {
     throw new AuthStorageError11("invalid_device_authorization", "[Sixb] Device authorization is invalid.");
   }
 }
@@ -7140,6 +7221,173 @@ ALTER TABLE projection_runs ADD COLUMN source_changes_read BIGINT
   CHECK (source_changes_read IS NULL OR source_changes_read >= 0);
 `;
 
+// src/migrations/041-agent-thread-workspaces.sql
+var _041_agent_thread_workspaces_default = `ALTER TABLE agent_threads ADD COLUMN sandbox_params JSONB
+  CHECK (sandbox_params IS NULL OR jsonb_typeof(sandbox_params) = 'object');
+`;
+
+// src/migrations/042-vector-profiles.sql
+var _042_vector_profiles_default = `-- Transactional derived state. Search extensions are not required for persistence.
+CREATE TABLE object_vectors (
+  project_id TEXT NOT NULL,
+  object_type_id TEXT NOT NULL,
+  primary_id TEXT NOT NULL,
+  profile TEXT NOT NULL CHECK (length(btrim(profile)) > 0),
+  configuration TEXT NOT NULL,
+  source TEXT[] NOT NULL,
+  source_fingerprint TEXT NOT NULL,
+  embedding REAL[] NOT NULL,
+  last_commit_id TEXT NOT NULL,
+  PRIMARY KEY (project_id, object_type_id, primary_id, profile),
+  FOREIGN KEY (project_id, object_type_id, primary_id)
+    REFERENCES objects (project_id, object_type_id, primary_id) ON DELETE CASCADE,
+  FOREIGN KEY (project_id, last_commit_id)
+    REFERENCES ontology_commits (project_id, id) DEFERRABLE INITIALLY DEFERRED,
+  CONSTRAINT object_vectors_sources CHECK (
+    cardinality(source) > 0 AND array_ndims(source) = 1 AND array_lower(source, 1) = 1
+    AND array_position(source, NULL) IS NULL
+  ),
+  CONSTRAINT object_vectors_values CHECK (
+    cardinality(embedding) BETWEEN 1 AND 16000
+    AND array_ndims(embedding) = 1 AND array_lower(embedding, 1) = 1
+    AND array_position(embedding, NULL) IS NULL
+    AND '-Infinity'::real < ALL(embedding) AND 'Infinity'::real > ALL(embedding)
+    AND 0::real <> ANY(embedding)
+  )
+);
+`;
+
+// src/migrations/043-vector-indexing.sql
+var _043_vector_indexing_default = `CREATE TABLE object_vector_indexing (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  object_type_id TEXT NOT NULL,
+  primary_id TEXT NOT NULL,
+  profile TEXT NOT NULL,
+  request JSONB NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('pending', 'running', 'ready', 'failed')),
+  available_at TIMESTAMPTZ NOT NULL,
+  dispatch_at TIMESTAMPTZ NOT NULL,
+  values_json JSONB,
+  error TEXT,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, object_type_id, primary_id, profile)
+);
+CREATE INDEX object_vector_indexing_due ON object_vector_indexing (project_id, dispatch_at, id)
+  WHERE status <> 'failed';
+
+ALTER TABLE executions DROP CONSTRAINT executions_authority_kernel_operation_check;
+ALTER TABLE executions ADD CONSTRAINT executions_authority_kernel_operation_check
+  CHECK (authority_kernel_operation IS NULL OR authority_kernel_operation IN ('ontology.recover', 'ontology.indexVectors'));
+ALTER TABLE executions DROP CONSTRAINT executions_source_kind_check;
+ALTER TABLE executions ADD CONSTRAINT executions_source_kind_check
+  CHECK (source_kind IN ('http', 'webhook', 'schedule', 'event', 'datasetVersion', 'execution', 'ontologyCommit'));
+`;
+
+// src/migrations/044-vector-batching.sql
+var _044_vector_batching_default = `ALTER TABLE object_vector_indexing ADD COLUMN batch_id TEXT;
+CREATE INDEX object_vector_indexing_batch ON object_vector_indexing (project_id, batch_id, id)
+  WHERE batch_id IS NOT NULL;
+`;
+
+// src/migrations/045-agent-thread-sandbox-state.sql
+var _045_agent_thread_sandbox_state_default = `ALTER TABLE agent_threads ADD COLUMN sandbox_state JSONB
+  CHECK (sandbox_state IS NULL OR jsonb_typeof(sandbox_state) = 'object');
+`;
+
+// src/migrations/046-workflow-intervention-principals.sql
+var _046_workflow_intervention_principals_default = `-- Intervention actors were stored as { principalType, principalId }. Rewrite them to the
+-- canonical Principal shape { type, id } used by every other stored principal.
+UPDATE workflow_interventions
+SET submitted_by = jsonb_build_object(
+  'type', submitted_by->>'principalType',
+  'id', submitted_by->>'principalId'
+)
+WHERE submitted_by->>'principalType' IS NOT NULL;
+
+UPDATE workflow_interventions
+SET cancelled_by = jsonb_build_object(
+  'type', cancelled_by->>'principalType',
+  'id', cancelled_by->>'principalId'
+)
+WHERE cancelled_by->>'principalType' IS NOT NULL;
+`;
+
+// src/migrations/047-ontology-commit-attribution.sql
+var _047_ontology_commit_attribution_default = `-- Commits and their events name who requested the write and what ran it, replacing the
+-- authority-only \`actor\`. Both are copied from the commit's execution, which stays canonical and
+-- is immutable, so the backfill is exact.
+ALTER TABLE ontology_commits
+  ADD COLUMN requested_by JSONB,
+  ADD COLUMN executor JSONB;
+
+UPDATE ontology_commits c SET
+  requested_by = CASE
+    WHEN e.requested_by_user_id IS NOT NULL
+      THEN jsonb_build_object('type', 'user', 'id', e.requested_by_user_id)
+    WHEN e.requested_by_service_account_id IS NOT NULL
+      THEN jsonb_build_object('type', 'serviceAccount', 'id', e.requested_by_service_account_id)
+  END,
+  executor = CASE e.executor_kind
+    WHEN 'request' THEN jsonb_build_object('type', 'request', 'requestId', e.executor_id)
+    WHEN 'agent' THEN jsonb_build_object('type', 'agent', 'runId', e.executor_id)
+    WHEN 'kernel' THEN jsonb_build_object(
+      'type', 'kernel',
+      'operation',
+      CASE e.authority_kernel_operation
+        WHEN 'ontology.recover'
+          THEN jsonb_build_object('type', 'ontology.recover', 'recoveryId', e.executor_id)
+        ELSE jsonb_build_object('type', 'ontology.indexVectors', 'indexingId', e.executor_id)
+      END
+    )
+    ELSE jsonb_build_object(
+      'type', 'primitive',
+      'kind', e.executor_kind,
+      'id', e.authority_primitive_id,
+      'runId', e.executor_id
+    )
+  END
+FROM executions e
+WHERE e.project_id = c.project_id AND e.id = c.execution_id;
+
+ALTER TABLE ontology_commits ALTER COLUMN executor SET NOT NULL;
+
+-- Events not yet published would otherwise reach consumers in the retired shape.
+UPDATE ontology_outbox o SET envelope =
+  (o.envelope - 'actor')
+  || jsonb_build_object('executor', c.executor)
+  || CASE
+    WHEN c.requested_by IS NULL THEN '{}'::jsonb
+    ELSE jsonb_build_object('requestedBy', c.requested_by)
+  END
+FROM ontology_commits c
+WHERE c.project_id = o.project_id AND c.id = o.commit_id;
+
+ALTER TABLE ontology_commits DROP COLUMN actor;
+`;
+
+// src/migrations/049-native-sessions.sql
+var _049_native_sessions_default = `-- Native clients, such as the CLI, hold their session as bearer tokens: a
+-- short-lived access token, whose hash is \`token_hash\`, and a rotating refresh token. Browser
+-- sessions leave these columns NULL; \`refresh_token_hash IS NULL\` is what marks a cookie session.
+ALTER TABLE auth_sessions
+  ADD COLUMN client_name TEXT,
+  ADD COLUMN access_expires_at TIMESTAMPTZ,
+  ADD COLUMN refresh_token_hash TEXT,
+  ADD COLUMN previous_refresh_token_hash TEXT,
+  ADD COLUMN refreshed_at TIMESTAMPTZ,
+  ADD CONSTRAINT auth_sessions_bearer_state CHECK (
+    (refresh_token_hash IS NULL) = (client_name IS NULL)
+    AND (refresh_token_hash IS NULL) = (access_expires_at IS NULL)
+    AND (refresh_token_hash IS NOT NULL OR previous_refresh_token_hash IS NULL)
+  );
+
+-- The device flow now starts a session instead of issuing a personal access token.
+ALTER TABLE auth_device_authorizations
+  DROP COLUMN token_name,
+  DROP COLUMN token_expires_at;
+`;
+
 // src/migrations/037-execution-requester-groups.sql
 var _037_execution_requester_groups_default = `ALTER TABLE executions ADD COLUMN requester_group_ids JSONB NOT NULL DEFAULT '[]'::jsonb;
 
@@ -7178,6 +7426,43 @@ ALTER TABLE connector_authorization_attempts
   ALTER COLUMN code_verifier DROP NOT NULL;
 `;
 
+// src/migrations/048-file-upload-sessions.sql
+var _048_file_upload_sessions_default = `-- Durable staged-upload sessions, so an upload survives restarts and spans API replicas.
+CREATE TABLE file_upload_sessions (
+  id TEXT PRIMARY KEY CHECK (length(trim(id)) > 0),
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  owner_principal_type TEXT NOT NULL
+    CHECK (owner_principal_type IN ('user', 'serviceAccount', 'system')),
+  owner_principal_id TEXT NOT NULL CHECK (length(owner_principal_id) > 0),
+  strategy TEXT NOT NULL CHECK (strategy IN ('server', 'direct-put', 'multipart')),
+  status TEXT NOT NULL CHECK (status IN ('pending', 'completed', 'aborted')),
+  file_name TEXT,
+  media_type TEXT,
+  logical_path TEXT,
+  expected_size_bytes BIGINT CHECK (expected_size_bytes IS NULL OR expected_size_bytes >= 0),
+  expected_digest TEXT,
+  provider_upload JSONB CHECK (provider_upload IS NULL OR jsonb_typeof(provider_upload) = 'object'),
+  signed_parts JSONB NOT NULL CHECK (jsonb_typeof(signed_parts) = 'array'),
+  file_ref JSONB CHECK (file_ref IS NULL OR jsonb_typeof(file_ref) = 'object'),
+  created_at TIMESTAMPTZ NOT NULL,
+  expires_at TIMESTAMPTZ NOT NULL,
+  completed_at TIMESTAMPTZ,
+  aborted_at TIMESTAMPTZ,
+  -- Derived by core (fileUploadSessionReapAt); NULL while an abandoned upload awaits its abort.
+  reap_at TIMESTAMPTZ,
+  CHECK ((status = 'completed') = (completed_at IS NOT NULL)),
+  CHECK ((status = 'aborted') = (aborted_at IS NOT NULL))
+);
+
+CREATE INDEX idx_file_upload_sessions_reap
+  ON file_upload_sessions (reap_at)
+  WHERE reap_at IS NOT NULL;
+
+CREATE INDEX idx_file_upload_sessions_abandoned
+  ON file_upload_sessions (project_id, expires_at)
+  WHERE status = 'pending' AND provider_upload IS NOT NULL;
+`;
+
 // src/migrations.ts
 var POSTGRES_STORAGE_ADAPTER_ID = "SixbPostgresStorage";
 function pgSql(id, sqlText) {
@@ -7392,17 +7677,38 @@ var postgresStorageMigrations = defineMigrations({
     pgSql("037-execution-requester-groups", _037_execution_requester_groups_default),
     pgSql("038-outbox-publication-order", _038_outbox_publication_order_default),
     pgSql("039-projection-source-roots", _039_projection_source_roots_default),
-    pgSql("040-connector-optional-pkce", _040_connector_optional_pkce_default)
+    pgSql("040-connector-optional-pkce", _040_connector_optional_pkce_default),
+    pgSql("041-agent-thread-workspaces", _041_agent_thread_workspaces_default),
+    pgSql("042-vector-profiles", _042_vector_profiles_default),
+    pgSql("043-vector-indexing", _043_vector_indexing_default),
+    pgSql("044-vector-batching", _044_vector_batching_default),
+    pgSql("045-agent-thread-sandbox-state", _045_agent_thread_sandbox_state_default),
+    pgSql("046-workflow-intervention-principals", _046_workflow_intervention_principals_default),
+    pgSql("047-ontology-commit-attribution", _047_ontology_commit_attribution_default),
+    pgSql("048-file-upload-sessions", _048_file_upload_sessions_default),
+    pgSql("049-native-sessions", _049_native_sessions_default)
   ]
 });
 
+// src/objects/storage.ts
+import { hasVectorProfile as hasVectorProfile3 } from "@sixb/core/internal/query";
+
 // src/objects/query-compiler.ts
 import {
   ObjectQueryExecutionError
 } from "@sixb/core";
+import {
+  hasVectorProfile,
+  isVectorProfileQuery,
+  normalizeVector,
+  vectorSearchCandidateLimit
+} from "@sixb/core/internal/query";
 var PAGE_TOKEN_PREFIX = "keyset:";
 var DEFAULT_EXPANSION_FANOUT = 1000;
 function compilePgObjectQuery(projectId, query, options = {}) {
+  if (hasVectorProfile(query) && !isVectorProfileQuery(query)) {
+    throw new ObjectQueryExecutionError("unsupported_vector_composition", "Vector search supports one profile with filters before ranking and limit/project after.");
+  }
   const source = options.source ?? DEFAULT_OBJECT_QUERY_SOURCE;
   const compiled = source.wrapQuery(compileObjectQueryInternal(projectId, query, {
     probeLimit: options.includeTotal === false,
@@ -7412,6 +7718,7 @@ function compilePgObjectQuery(projectId, query, options = {}) {
     ...compiled,
     sql: numberPlaceholders(compiled.sql),
     totalSql: numberPlaceholders(compiled.totalSql),
+    vectorProbe: compiled.vectorProbe ? { ...compiled.vectorProbe, sql: numberPlaceholders(compiled.vectorProbe.sql) } : undefined,
     hasMoreProbe: compiled.hasMoreProbe ? {
       ...compiled.hasMoreProbe,
       sql: numberPlaceholders(compiled.hasMoreProbe.sql)
@@ -7489,8 +7796,56 @@ function compileObjectQueryInternal(projectId, query, ctx) {
     case "expand":
       return compileExpand(projectId, query.input, query.expansions, ctx);
     case "vector":
-      throw new Error(`[SixbPg] PostgreSQL object storage does not support query node '${query.kind}'`);
-  }
+      return compileVector(projectId, query, ctx);
+  }
+}
+function compileVector(projectId, query, ctx) {
+  if (typeof query.vector === "string" || !isVectorProfileQuery(query) || !query.configuration || !Number.isSafeInteger(query.k) || query.k < 1 || query.k > 1000 || query.vector.length < 1 || query.vector.length > 16000) {
+    throw new ObjectQueryExecutionError("invalid_vector_query", "A validated named vector profile is required.");
+  }
+  const input = compileObjectQueryInternal(projectId, query.input, exactContext(ctx));
+  const permissions = ctx.source.objectPropertyPermissionsTable;
+  const permissionJoin = permissions ? `JOIN (
+      SELECT project_id, object_type_id, primary_id, array_agg(property_id) AS property_ids
+      FROM ${permissions}
+      GROUP BY project_id, object_type_id, primary_id
+    ) AS vector_permissions ON vector_permissions.project_id = vectors.project_id
+      AND vector_permissions.object_type_id = vectors.object_type_id
+      AND vector_permissions.primary_id = vectors.primary_id` : "";
+  const authorized = permissions ? `AND vectors.source <@ vector_permissions.property_ids` : "";
+  const candidates = `FROM (${input.sql}) AS input
+    JOIN object_vectors AS vectors ON vectors.project_id = input.project_id
+      AND vectors.object_type_id = input.object_type_id AND vectors.primary_id = input.primary_id
+    ${permissionJoin}
+    WHERE vectors.profile = ? AND vectors.configuration = ?
+      AND cardinality(vectors.embedding) = ? ${authorized}`;
+  const candidateArgs = [...input.args, query.profile, query.configuration, query.vector.length];
+  const limit = vectorSearchCandidateLimit(query.vector.length);
+  const values = normalizeVector(query.vector, query.vector.length);
+  const order = compileOrder([
+    { kind: "column", column: "_vector_score", direction: "desc" },
+    ...identityOrderFields().map((field) => ({ ...field, binary: true }))
+  ]);
+  const sql = `SELECT * FROM (SELECT input.*, 1 - (vectors.embedding::public.vector OPERATOR(public.<=>) ?::public.vector) AS _vector_score
+    ${candidates}) AS ranked ORDER BY ${order.sql} LIMIT ?`;
+  const args = [JSON.stringify(values), ...candidateArgs, query.k];
+  return {
+    sql,
+    args,
+    totalSql: `SELECT COUNT(*)::bigint AS total FROM (SELECT 1 ${candidates} LIMIT ?) AS eligible`,
+    totalArgs: [...candidateArgs, query.k],
+    order,
+    vectorProbe: {
+      sql: `SELECT COUNT(*)::bigint AS total FROM (SELECT 1 ${candidates} LIMIT ?) AS candidates`,
+      args: [...candidateArgs, limit + 1],
+      limit
+    },
+    hasMore: () => false,
+    trimRows: identityRows,
+    nextPageToken: () => {
+      return;
+    }
+  };
 }
 function compileStart(projectId, query, ctx) {
   if (query.includeSubtypes === true) {
@@ -7578,6 +7933,7 @@ function compileWhere(projectId, inputQuery, predicate, ctx) {
       WHERE ${predicate.sql}
     `,
     totalArgs: [...input.args, ...predicate.args],
+    vectorProbe: input.vectorProbe,
     order: input.order,
     hasMore: () => false,
     trimRows: identityRows,
@@ -7604,7 +7960,7 @@ function compileSort(projectId, inputQuery, fields, ctx) {
         input.created_at,
         input.updated_at,
         input.version,
-        input.last_commit_id
+        input.last_commit_id${input.vectorProbe ? ", input._vector_score" : ""}
       FROM (${input.sql}) AS input
       ORDER BY ${order.sql}
     `,
@@ -7635,6 +7991,7 @@ function compileLimit(projectId, inputQuery, rawLimit, ctx) {
       FROM (${input.sql}) AS input
     `,
     totalArgs: input.args,
+    vectorProbe: input.vectorProbe,
     order: input.order,
     hasMore: (rowCount, total) => total === undefined ? ctx.probeLimit && rowCount > limit : limit < total,
     trimRows: ctx.probeLimit ? (rows) => rows.slice(0, limit) : identityRows,
@@ -7663,6 +8020,7 @@ function compilePage(projectId, inputQuery, rawPageSize, pageToken, ctx) {
       FROM (${input.sql}) AS input
     `,
     totalArgs: input.args,
+    vectorProbe: input.vectorProbe,
     order: input.order,
     hasMore: (rowCount) => rowCount > pageSize,
     trimRows: (rows) => rows.slice(0, pageSize),
@@ -7739,6 +8097,7 @@ function compileExpand(projectId, inputQuery, expansions, ctx) {
     args: [...expand.args, ...input.args, ...inputOrder.args],
     totalSql: input.totalSql,
     totalArgs: input.totalArgs,
+    vectorProbe: input.vectorProbe,
     order: input.order,
     hasMoreProbe: input.hasMoreProbe,
     hasMore: input.hasMore,
@@ -7904,13 +8263,14 @@ function compileProject(projectId, inputQuery, properties, ctx) {
         input.created_at,
         input.updated_at,
         input.version,
-        input.last_commit_id
+        input.last_commit_id${input.vectorProbe ? ", input._vector_score" : ""}
       FROM (${input.sql}) AS input
       ORDER BY ${inputOrder.sql}
     `,
     args: [...projection.args, ...input.args, ...inputOrder.args],
     totalSql: input.totalSql,
     totalArgs: input.totalArgs,
+    vectorProbe: input.vectorProbe,
     order: outputOrder,
     hasMoreProbe: input.hasMoreProbe,
     hasMore: input.hasMore,
@@ -7941,7 +8301,7 @@ function compileAggregateSource(projectId, query, source) {
     case "page":
       return compileRowQueryAggregateSource(projectId, query, source);
     case "vector":
-      throw new Error(`[SixbPg] PostgreSQL object storage does not support query node '${query.kind}'`);
+      return compileRowQueryAggregateSource(projectId, query, source);
   }
 }
 function compileAggregateStart(projectId, query, source) {
@@ -8310,7 +8670,7 @@ function compileOrder(fields, qualifier, propertyColumn = "properties") {
   const args = [];
   for (const field of fields) {
     if (field.kind === "column") {
-      clauses.push(`${columnExpression(field.column, qualifier)} ${field.direction.toUpperCase()}`);
+      clauses.push(`${columnExpression(field.column, qualifier)}${field.binary ? ' COLLATE "C"' : ""} ${field.direction.toUpperCase()}`);
       continue;
     }
     const direction = field.direction === "desc" ? "DESC" : "ASC";
@@ -8519,6 +8879,8 @@ function isPlainObject(value) {
 }
 
 // src/objects/reader.ts
+import { ObjectQueryExecutionError as ObjectQueryExecutionError2 } from "@sixb/core";
+import { hasVectorProfile as hasVectorProfile2 } from "@sixb/core/internal/query";
 import { linkBatchKey, objectBatchKey } from "@sixb/core/storage";
 
 // src/objects/rows.ts
@@ -8535,7 +8897,10 @@ function rowToObject(row) {
   };
 }
 function queryRowToObject(row) {
-  const base = rowToObject(row);
+  const base = {
+    ...rowToObject(row),
+    ...row._vector_score === undefined ? {} : { score: row._vector_score }
+  };
   const links = reviveExpandedLinks(row._expand);
   return links ? { ...base, links } : base;
 }
@@ -8610,7 +8975,23 @@ class PgObjectReader {
     this.sql = sql;
     this.source = source;
   }
+  async assertVectorSearch(params) {
+    if (!hasVectorProfile2(params.query))
+      return;
+    const compiled = compilePgObjectQuery(params.projectId, params.query, { source: this.source });
+    if (!compiled.vectorProbe)
+      return;
+    const extensions = await this.sql.unsafe("SELECT EXISTS (SELECT 1 FROM pg_extension e JOIN pg_namespace n ON n.oid = e.extnamespace WHERE e.extname = 'vector' AND n.nspname = 'public') AS ready");
+    if (!extensions[0]?.ready)
+      throw new ObjectQueryExecutionError2("vector_extension_missing", "PostgreSQL vector search requires pgvector installed in schema public (CREATE EXTENSION vector WITH SCHEMA public).");
+    const probe = compiled.vectorProbe;
+    const [row] = await this.sql.unsafe(probe.sql, probe.args);
+    if (Number(row?.total ?? 0) > probe.limit) {
+      throw new ObjectQueryExecutionError2("vector_work_limit_exceeded", `Exact vector search supports at most ${probe.limit} eligible vectors at this dimension. Narrow the query filters.`);
+    }
+  }
   async queryObjects(params) {
+    await this.assertVectorSearch(params);
     const sql = this.sql;
     const source = this.source;
     const compiled = compilePgObjectQuery(params.projectId, params.query, {
@@ -8629,6 +9010,7 @@ class PgObjectReader {
     };
   }
   async countObjects(params) {
+    await this.assertVectorSearch(params);
     const sql = this.sql;
     const source = this.source;
     const compiled = compilePgObjectCountQuery(params.projectId, stripOuterRowShape(params.query), {
@@ -8638,6 +9020,7 @@ class PgObjectReader {
     return { count: Number(row?.count ?? 0) };
   }
   async existsObjects(params) {
+    await this.assertVectorSearch(params);
     const sql = this.sql;
     const source = this.source;
     const compiled = compilePgObjectExistsQuery(params.projectId, stripOuterRowShape(params.query), { source });
@@ -8645,6 +9028,7 @@ class PgObjectReader {
     return { exists: row !== undefined };
   }
   async facetObjects(params) {
+    await this.assertVectorSearch(params);
     const sql = this.sql;
     const source = this.source;
     const facets = [];
@@ -9032,6 +9416,7 @@ ${sql}`,
     wrapQuery: (query) => ({
       ...query,
       ...wrapStatement(query.sql, query.args),
+      vectorProbe: query.vectorProbe ? { ...query.vectorProbe, ...wrapStatement(query.vectorProbe.sql, query.vectorProbe.args) } : undefined,
       totalSql: `${compiled.sql}
 ${query.totalSql}`,
       totalArgs: [...compiled.args, ...query.totalArgs],
@@ -9153,32 +9538,29 @@ function compileSelectedReadScopeCte(scopeJson, projectId) {
         SELECT DISTINCT project_id, object_type_id, primary_id
         FROM _sixb_scope_reachable
       ),
+      _sixb_scope_object_grants AS (
+        SELECT reachable.project_id, reachable.object_type_id, reachable.primary_id,
+          array_agg(DISTINCT selected_property.value) FILTER (WHERE selected_property.value IS NOT NULL) AS property_ids
+        FROM _sixb_scope_reachable AS reachable
+        LEFT JOIN _sixb_scope_object_selections AS selection
+          ON selection.node_id = reachable.node_id
+         AND selection.object_type_id = reachable.object_type_id
+        LEFT JOIN LATERAL jsonb_array_elements_text(selection.property_ids) AS selected_property(value) ON true
+        GROUP BY reachable.project_id, reachable.object_type_id, reachable.primary_id
+      ),
       _sixb_scope_objects AS (
-        SELECT
-          stored.project_id,
-          stored.object_type_id,
-          stored.primary_id,
-          COALESCE(
-            (
-              SELECT jsonb_object_agg(property.key, property.value)
-              FROM jsonb_each(stored.properties) AS property(key, value)
-              JOIN _sixb_scope_object_permissions AS permission
-                ON permission.project_id = stored.project_id
-               AND permission.object_type_id = stored.object_type_id
-               AND permission.primary_id = stored.primary_id
-               AND permission.property_id = property.key
-            ),
-            '{}'::jsonb
-          ) AS properties,
-          stored.created_at,
-          stored.updated_at,
-          stored.version,
-          stored.last_commit_id
-        FROM objects AS stored
-        JOIN _sixb_scope_object_ids AS visible
-          ON visible.project_id = stored.project_id
-         AND visible.object_type_id = stored.object_type_id
-         AND visible.primary_id = stored.primary_id
+        SELECT stored.project_id, stored.object_type_id, stored.primary_id,
+          COALESCE((
+            SELECT jsonb_object_agg(property.key, property.value)
+            FROM jsonb_each(stored.properties) AS property(key, value)
+            WHERE property.key = ANY(grants.property_ids)
+          ), '{}'::jsonb) AS properties,
+          stored.created_at, stored.updated_at, stored.version, stored.last_commit_id
+        FROM _sixb_scope_object_grants AS grants
+        JOIN objects AS stored
+          ON stored.project_id = grants.project_id
+         AND stored.object_type_id = grants.object_type_id
+         AND stored.primary_id = grants.primary_id
       ),
       _sixb_scope_reached_links(
         project_id,
@@ -9385,6 +9767,7 @@ var PG_OBJECT_QUERY_CAPABILITIES = {
     refs: true,
     filter: true,
     text: true,
+    vector: true,
     sort: true,
     limit: true,
     page: true,
@@ -9427,7 +9810,8 @@ var PG_OBJECT_QUERY_CAPABILITIES = {
     double: { equality: true, ordering: true },
     decimal: { equality: true, ordering: true },
     date: { equality: true, ordering: true },
-    timestamp: { equality: true, ordering: true }
+    timestamp: { equality: true, ordering: true },
+    userRef: { equality: true }
   },
   limits: {
     totalCount: true,
@@ -9437,7 +9821,7 @@ var PG_OBJECT_QUERY_CAPABILITIES = {
     "PostgreSQL object query pushdown supports start/refs/filter/text/sort/limit/page/traverse/set/project/expand over JSONB properties and object links.",
     "expand hydrates linked objects in-database (top-N per parent via LATERAL + jsonb_agg); core resolves each expansion's cardinality before pushdown, and a mixed/unresolved one stays on the fallback.",
     "Exact decimal predicates, ordering, and keyset pagination use PostgreSQL numeric casts.",
-    "Relevance sorting, vector search, and unresolved start.includeSubtypes remain planner fallback or rejection cases."
+    "Relevance sorting and unresolved start.includeSubtypes remain planner fallback or rejection cases."
   ]
 };
 
@@ -9455,15 +9839,23 @@ class PgObjectStorage {
     return createPgSelectedReader(this.sql, params, () => this.queryCapabilities());
   }
   async queryObjects(params) {
+    if (hasVectorProfile3(params.query))
+      return runPgRepeatableReadTransaction(this.sql, (tx) => new PgObjectReader(tx, DEFAULT_OBJECT_QUERY_SOURCE).queryObjects(params));
     return this.reader.queryObjects(params);
   }
   async countObjects(params) {
+    if (hasVectorProfile3(params.query))
+      return runPgRepeatableReadTransaction(this.sql, (tx) => new PgObjectReader(tx, DEFAULT_OBJECT_QUERY_SOURCE).countObjects(params));
     return this.reader.countObjects(params);
   }
   async existsObjects(params) {
+    if (hasVectorProfile3(params.query))
+      return runPgRepeatableReadTransaction(this.sql, (tx) => new PgObjectReader(tx, DEFAULT_OBJECT_QUERY_SOURCE).existsObjects(params));
     return this.reader.existsObjects(params);
   }
   async facetObjects(params) {
+    if (hasVectorProfile3(params.query))
+      return runPgRepeatableReadTransaction(this.sql, (tx) => new PgObjectReader(tx, DEFAULT_OBJECT_QUERY_SOURCE).facetObjects(params));
     return this.reader.facetObjects(params);
   }
   async getByPrimaryId(params) {
@@ -9622,9 +10014,10 @@ function commitRecord(row) {
     requestHash: row.request_hash,
     executionId: row.execution_id,
     origin: structuredClone(row.origin),
-    ...row.actor === null ? {} : {
-      actor: structuredClone(row.actor)
+    ...row.requested_by === null ? {} : {
+      requestedBy: structuredClone(row.requested_by)
     },
+    executor: structuredClone(row.executor),
     ontologyRevision: row.ontology_revision,
     ...row.projection_revision === null ? {} : { projectionRevision: row.projection_revision },
     ...row.ownership_hash === null ? {} : { ownershipHash: row.ownership_hash },
@@ -9766,12 +10159,16 @@ import {
   linkRefSortKey,
   linkScopeSortKey as linkScopeSortKey2,
   MaterializationConflictError as MaterializationConflictError6,
+  MaterializationValidationError as MaterializationValidationError2,
   objectRefKey as objectRefKey3,
   objectRefSortKey,
   telemetryPointKey as telemetryPointKey3,
   telemetryPointSortKey as telemetryPointSortKey2
 } from "@sixb/core/internal/materialization";
 import {
+  assertExpectedLinkRevision,
+  assertExpectedLinkScopeRevision,
+  assertExpectedObjectRevision,
   assertMaterializationFinalizationCorrelation,
   assertMaterializationHeader,
   assertMaterializationLaneCompletion,
@@ -11692,6 +12089,12 @@ class PgOntologyMaterializationStorage {
     this.sessions = new PgMaterializationSessions(sql, context);
     this.writer = new PgMaterializationWriter(sql);
   }
+  assertVectorSession(session, projectId, commitId) {
+    const active = this.sessions.require(session);
+    if (active.header.commit.projectId !== projectId || commitId !== undefined && active.header.commit.id !== commitId) {
+      throw new MaterializationValidationError2("Vector mutation does not belong to this materialization session.");
+    }
+  }
   async begin(input) {
     assertMaterializationHeader(input);
     const session = await this.sessions.create(input);
@@ -11702,17 +12105,15 @@ class PgOntologyMaterializationStorage {
       await this.assertSources(input.expected.sources, input.commit.projectId);
       const objectRevisions = await reader.effectiveObjectRevisions(input.expected.objects.map((expected) => expected.ref), true);
       for (const expected of input.expected.objects) {
-        this.assertObject(objectRevisions.get(objectRefKey3(expected.ref)) ?? null, expected);
+        assertExpectedObjectRevision(objectRevisions.get(objectRefKey3(expected.ref)) ?? null, expected);
       }
       const linkRevisions = await reader.effectiveLinkLastCommits(input.expected.links.map((expected) => expected.ref), true);
       for (const expected of input.expected.links) {
-        this.assertLink(linkRevisions.get(linkRefKey3(expected.ref)), expected);
+        assertExpectedLinkRevision(linkRevisions.get(linkRefKey3(expected.ref)), expected);
       }
       const linkScopeRevisions = await reader.linkScopeRevisions(input.expected.linkScopes);
       for (const [index, expected] of input.expected.linkScopes.entries()) {
-        if (linkScopeRevisions[index]?.fingerprint !== expected.fingerprint) {
-          throw new MaterializationConflictError6("effective-state", `Expected link scope changed for ${expected.source.objectTypeId}:${expected.source.primaryId}.${expected.linkId}.`);
-        }
+        assertExpectedLinkScopeRevision(linkScopeRevisions[index]?.fingerprint, expected);
       }
       const points = await reader.exactPoints(input.expected.points, true);
       const pointRevisions = new Map(points.map((point) => [telemetryPointKey3(point.series, point.at), point.lastCommitId]));
@@ -11972,28 +12373,6 @@ class PgOntologyMaterializationStorage {
       throw new MaterializationConflictError6("projection-fence", `Source '${expected.source.projectionId}' changed.`);
     }
   }
-  assertObject(row, expected) {
-    if (!expected.exists) {
-      if (row) {
-        throw new MaterializationConflictError6("effective-state", `Expected object ${objectRefKey3(expected.ref)} to be absent.`);
-      }
-      return;
-    }
-    if (!row || row.version !== expected.version || row.lastCommitId !== expected.lastCommitId) {
-      throw new MaterializationConflictError6("effective-state", `Expected object ${objectRefKey3(expected.ref)} changed.`);
-    }
-  }
-  assertLink(lastCommitId, expected) {
-    if (!expected.exists) {
-      if (lastCommitId !== undefined) {
-        throw new MaterializationConflictError6("effective-state", `Expected link ${linkRefKey3(expected.ref)} to be absent.`);
-      }
-      return;
-    }
-    if (lastCommitId === undefined || lastCommitId !== expected.lastCommitId) {
-      throw new MaterializationConflictError6("effective-state", `Expected link ${linkRefKey3(expected.ref)} changed.`);
-    }
-  }
   async assertFinalization(session, input) {
     const { commit } = session.header;
     const { result } = input.finalization;
@@ -12229,18 +12608,19 @@ class PgOntologyMaterializationStorage {
   async insertCommit(header, input) {
     const { commit } = header;
     const origin = originColumns(commit.origin);
-    const actor = commit.actor === undefined ? null : jsonParameter2(this.sql, commit.actor);
+    const requestedBy = commit.requestedBy === undefined ? null : jsonParameter2(this.sql, commit.requestedBy);
     const rows = await this.sql`
       INSERT INTO ontology_commits (
         project_id, id, idempotency_key, request_hash, execution_id,
-        origin_kind, origin_run_id, origin_batch_ordinal, origin, actor,
+        origin_kind, origin_run_id, origin_batch_ordinal, origin, requested_by, executor,
         ontology_revision, projection_revision, ownership_hash,
         intent, result, committed_at
       ) VALUES (
         ${commit.projectId}, ${commit.id}, ${commit.idempotencyKey}, ${commit.requestHash},
         ${commit.executionId},
         ${origin.kind}, ${origin.runId}, ${origin.batchOrdinal},
-        ${jsonParameter2(this.sql, commit.origin)}, ${actor}, ${commit.ontologyRevision},
+        ${jsonParameter2(this.sql, commit.origin)}, ${requestedBy},
+        ${jsonParameter2(this.sql, commit.executor)}, ${commit.ontologyRevision},
         ${commit.projectionRevision ?? null}, ${commit.ownershipHash ?? null},
         ${jsonParameter2(this.sql, commit.intent)},
         ${jsonParameter2(this.sql, input.finalization.result)}, ${commit.committedAt}
@@ -12299,7 +12679,7 @@ function databaseCount(value) {
 import { serializeSixbFailure as serializeSixbFailure2 } from "@sixb/core/internal/errors";
 import {
   MaterializationConflictError as MaterializationConflictError7,
-  MaterializationValidationError as MaterializationValidationError2
+  MaterializationValidationError as MaterializationValidationError3
 } from "@sixb/core/internal/materialization";
 import { ONTOLOGY_OUTBOX_FAILURE_CODES as ONTOLOGY_OUTBOX_FAILURE_CODES2 } from "@sixb/core/storage";
 class PgOntologyOutboxStorage {
@@ -12315,7 +12695,7 @@ class PgOntologyOutboxStorage {
       const leaseExpiry = assertTimestamp(input.leaseExpiresAt, "Ontology outbox lease expiry");
       assertNonblank(input.leaseId, "Ontology outbox lease id");
       if (leaseExpiry <= now) {
-        throw new MaterializationValidationError2("Ontology outbox lease expiry must be later than the claim time.");
+        throw new MaterializationValidationError3("Ontology outbox lease expiry must be later than the claim time.");
       }
       const rows = await sql`
         WITH candidates AS (
@@ -12466,7 +12846,7 @@ function validateLeaseIds(ids) {
   for (const id of ids) {
     assertNonblank(id, "Ontology outbox event id");
     if (seen.has(id)) {
-      throw new MaterializationValidationError2(`Ontology outbox lease batch repeats event '${id}'.`);
+      throw new MaterializationValidationError3(`Ontology outbox lease batch repeats event '${id}'.`);
     }
     seen.add(id);
   }
@@ -12481,7 +12861,7 @@ function leaseConflict() {
 }
 
 // src/ontology-storage/sources.ts
-import { MaterializationValidationError as MaterializationValidationError3 } from "@sixb/core/internal/materialization";
+import { MaterializationValidationError as MaterializationValidationError4 } from "@sixb/core/internal/materialization";
 import {
   assertSourceBeginInput as assertBeginInput,
   assertSourceExecutionIdentity as assertExecutionIdentity,
@@ -12641,7 +13021,7 @@ class PgOntologySourceStorage {
         throw sourceConflict(`Source materialization '${input.materializationId}' cannot transition from '${manifest.status}' to 'ready'.`);
       }
       if (input.readyAt < toIsoString2(manifest.created_at)) {
-        throw new MaterializationValidationError3("Source readyAt cannot precede source createdAt.");
+        throw new MaterializationValidationError4("Source readyAt cannot precede source createdAt.");
       }
       if (input.assertionCount >= 1000 || input.rootCount >= 1000) {
         await sql`ANALYZE ontology_source_rows, ontology_source_roots`;
@@ -12739,7 +13119,7 @@ class PgOntologySourceStorage {
   }
   async transitionToAbandoned(sql, manifest, abandonedAt) {
     if (abandonedAt < toIsoString2(manifest.created_at) || manifest.ready_at !== null && abandonedAt < toIsoString2(manifest.ready_at)) {
-      throw new MaterializationValidationError3("Source abandonedAt cannot precede source creation or readiness.");
+      throw new MaterializationValidationError4("Source abandonedAt cannot precede source creation or readiness.");
     }
     const rows = await sql`
       UPDATE ontology_sources
@@ -12777,7 +13157,7 @@ class PgOntologySourceStorage {
     const minimum = counts?.min_ordinal === null ? null : Number(counts?.min_ordinal);
     const maximum = counts?.max_ordinal === null ? null : Number(counts?.max_ordinal);
     if (assertions !== assertionCount || roots !== rootCount || ordinals !== rootCount || rootCount > 0 && (minimum !== 0 || maximum !== rootCount - 1)) {
-      throw new MaterializationValidationError3("Source ready counts do not match the staged roots and assertions.");
+      throw new MaterializationValidationError4("Source ready counts do not match the staged roots and assertions.");
     }
     await assertSourceRootCoverage(sql, manifest);
     const [invalid] = manifest.projection_kind === "link" ? await sql`
@@ -12813,7 +13193,7 @@ class PgOntologySourceStorage {
             LIMIT 1
           `;
     if (invalid) {
-      throw new MaterializationValidationError3(manifest.projection_kind === "link" ? "Link projection roots must contain exactly their matching link assertion." : "Object projection roots must contain exactly their matching object assertion plus links sourced from that root.");
+      throw new MaterializationValidationError4(manifest.projection_kind === "link" ? "Link projection roots must contain exactly their matching link assertion." : "Object projection roots must contain exactly their matching object assertion plus links sourced from that root.");
     }
   }
   async findStageRows(sql, input, rows) {
@@ -12945,17 +13325,300 @@ function numberOrNull(value) {
   return value === null ? null : Number(value);
 }
 
+// src/ontology-storage/vector-indexing.ts
+import { parseSixbFailure as parseSixbFailure3 } from "@sixb/core/internal/errors";
+import {
+  VECTOR_INDEXING_FAILURE_CODES
+} from "@sixb/core/storage";
+class PgVectorIndexingStorage {
+  sql;
+  run;
+  assertSession;
+  constructor(sql, run, assertSession) {
+    this.sql = sql;
+    this.run = run;
+    this.assertSession = assertSession;
+  }
+  async schedule(input) {
+    this.assertSession(input.session, input.projectId);
+    if (input.deleted.length)
+      await this.sql`
+      DELETE FROM object_vector_indexing AS work
+      USING jsonb_array_elements(${jsonParameter2(this.sql, input.deleted)}::jsonb) AS deleted(ref)
+      WHERE work.project_id = ${input.projectId}
+        AND work.object_type_id = deleted.ref->>'objectTypeId'
+        AND work.primary_id = deleted.ref->>'primaryId'
+    `;
+    if (input.requests.length)
+      await this.sql`
+      INSERT INTO object_vector_indexing (
+        project_id, id, object_type_id, primary_id, profile, batch_id, request, status, available_at, dispatch_at
+      )
+      SELECT ${input.projectId}, entry->>'id', entry#>>'{ref,objectTypeId}',
+        entry#>>'{ref,primaryId}', entry->>'profile', entry->>'batchId', entry - 'batchId', 'pending',
+        ${input.availableAt}::timestamptz, ${input.availableAt}::timestamptz
+      FROM jsonb_array_elements(${jsonParameter2(this.sql, input.requests)}::jsonb) AS pending(entry)
+      ON CONFLICT (project_id, object_type_id, primary_id, profile) DO UPDATE SET
+        id = EXCLUDED.id, batch_id = EXCLUDED.batch_id, request = EXCLUDED.request, status = 'pending',
+        available_at = EXCLUDED.available_at, dispatch_at = EXCLUDED.dispatch_at,
+        values_json = NULL, error = NULL
+    `;
+  }
+  async complete(input) {
+    this.assertSession(input.session, input.projectId);
+    if (!input.entries.length)
+      return;
+    await this.sql`
+      DELETE FROM object_vector_indexing AS work
+      USING jsonb_array_elements(${jsonParameter2(this.sql, input.entries)}::jsonb) AS completed(entry)
+      WHERE work.project_id = ${input.projectId}
+        AND work.object_type_id = entry#>>'{ref,objectTypeId}'
+        AND work.primary_id = entry#>>'{ref,primaryId}'
+        AND work.profile = entry->>'profile'
+        AND work.request->>'configuration' = entry->>'configuration'
+        AND work.request->>'sourceFingerprint' = entry->>'sourceFingerprint'
+    `;
+  }
+  async dispatched(input) {
+    if (!input.ids.length)
+      return;
+    await this.run(async (sql) => {
+      await sql`UPDATE object_vector_indexing SET dispatch_at = ${input.nextDispatchAt} WHERE project_id = ${input.projectId} AND id = ANY(${sql.array([...input.ids])}::text[])`;
+    });
+  }
+  async get(input) {
+    return this.run(async (sql) => {
+      const rows = await sql`SELECT batch_id, request, status, available_at, values_json, error FROM object_vector_indexing WHERE project_id = ${input.projectId} AND id = ${input.id}`;
+      return rows[0] ? decode(rows[0]) : null;
+    });
+  }
+  async getBatch(input) {
+    return this.run(async (sql) => (await sql`
+      SELECT batch_id, request, status, available_at, values_json, error
+      FROM object_vector_indexing WHERE project_id = ${input.projectId}
+      AND batch_id = ${input.batchId} ORDER BY id`).map(decode));
+  }
+  async getBatchMember(input) {
+    return this.run(async (sql) => {
+      const rows = await sql`
+        SELECT batch_id, request, status, available_at, values_json, error
+        FROM object_vector_indexing WHERE project_id = ${input.projectId}
+        AND object_type_id = ${input.ref.objectTypeId} AND primary_id = ${input.ref.primaryId}
+        AND profile = ${input.profile} AND batch_id = ${input.batchId}`;
+      return rows[0] ? decode(rows[0]) : null;
+    });
+  }
+  async updateBatch(input) {
+    if (!input.updates.length)
+      return true;
+    return this.run(async (sql) => {
+      const rows = await sql`
+        WITH changes AS MATERIALIZED (
+          SELECT item FROM jsonb_array_elements(${jsonParameter2(sql, input.updates)}::jsonb) AS entries(item)
+        ), locked AS MATERIALIZED (
+          SELECT work.id FROM object_vector_indexing AS work
+          JOIN changes ON work.id = item->>'id' AND work.status = item->>'expectedStatus'
+          WHERE work.project_id = ${input.projectId} ORDER BY work.id FOR UPDATE OF work
+        )
+        UPDATE object_vector_indexing AS work SET
+          status = changes.item->>'status', available_at = (changes.item->>'availableAt')::timestamptz,
+          values_json = COALESCE(changes.item->'values', work.values_json),
+          error = (changes.item->'error')::text
+        FROM changes, locked
+        WHERE work.project_id = ${input.projectId} AND work.id = locked.id
+          AND work.id = changes.item->>'id'
+          AND (${!input.requireAll} OR (SELECT count(*) FROM locked) = ${input.updates.length})
+        RETURNING work.id`;
+      return !input.requireAll || rows.length === input.updates.length;
+    });
+  }
+  async listDue(input) {
+    return this.run(async (sql) => (await sql`SELECT batch_id, request, status, available_at, NULL AS values_json, error FROM object_vector_indexing WHERE project_id = ${input.projectId} AND status <> 'failed' AND dispatch_at <= ${input.now} ORDER BY dispatch_at, id LIMIT ${input.limit}`).map(decode));
+  }
+  async update(input) {
+    return this.run(async (sql) => (await sql`
+      UPDATE object_vector_indexing SET status = ${input.status}, available_at = ${input.availableAt},
+      values_json = COALESCE(${input.values ? jsonParameter2(sql, input.values) : null}, values_json), error = ${input.error ? JSON.stringify(input.error) : null}
+      WHERE project_id = ${input.projectId} AND id = ${input.id} AND status = ${input.expectedStatus} RETURNING id
+    `).length === 1);
+  }
+  async remove(input) {
+    await this.run(async (sql) => {
+      await sql`DELETE FROM object_vector_indexing WHERE project_id = ${input.projectId} AND id = ${input.id}`;
+    });
+  }
+}
+function decode(row) {
+  return {
+    ...row.request,
+    ...row.batch_id ? { batchId: row.batch_id } : {},
+    status: row.status,
+    availableAt: new Date(row.available_at).toISOString(),
+    ...row.values_json ? { values: row.values_json } : {},
+    ...row.error ? {
+      error: parseSixbFailure3(row.error, VECTOR_INDEXING_FAILURE_CODES)
+    } : {}
+  };
+}
+
+// src/ontology-storage/vectors.ts
+import { MaterializationConflictError as MaterializationConflictError8 } from "@sixb/core/internal/materialization";
+class PgOntologyVectorStorage {
+  sql;
+  runRootOperation;
+  assertSession;
+  constructor(sql, runRootOperation, assertSession) {
+    this.sql = sql;
+    this.runRootOperation = runRootOperation;
+    this.assertSession = assertSession;
+  }
+  async list(input) {
+    return this.runRootOperation(async (sql) => {
+      const rows = await sql`
+        SELECT profile, configuration, source, source_fingerprint, last_commit_id
+        FROM object_vectors
+        WHERE project_id = ${input.projectId}
+          AND object_type_id = ${input.ref.objectTypeId} AND primary_id = ${input.ref.primaryId}
+        ORDER BY profile
+      `;
+      return rows.map((row) => ({
+        ref: { ...input.ref },
+        profile: row.profile,
+        configuration: row.configuration,
+        source: row.source,
+        sourceFingerprint: row.source_fingerprint,
+        lastCommitId: row.last_commit_id
+      }));
+    });
+  }
+  async listBatch(input) {
+    if (!input.refs.length)
+      return [];
+    return this.runRootOperation(async (sql) => {
+      const rows = await sql`
+        SELECT stored.object_type_id, stored.primary_id, stored.profile, stored.configuration,
+          stored.source, stored.source_fingerprint, stored.last_commit_id
+        FROM (SELECT DISTINCT ref->>'objectTypeId' AS object_type_id, ref->>'primaryId' AS primary_id
+          FROM jsonb_array_elements(${jsonParameter2(sql, input.refs)}::jsonb) AS requested(ref)) AS requested
+        JOIN object_vectors AS stored ON stored.project_id = ${input.projectId}
+          AND stored.object_type_id = requested.object_type_id AND stored.primary_id = requested.primary_id
+        ORDER BY stored.object_type_id, stored.primary_id, stored.profile
+      `;
+      return rows.map((row) => ({
+        ref: { objectTypeId: row.object_type_id, primaryId: row.primary_id },
+        profile: row.profile,
+        configuration: row.configuration,
+        source: row.source,
+        sourceFingerprint: row.source_fingerprint,
+        lastCommitId: row.last_commit_id
+      }));
+    });
+  }
+  async removeBatch(input) {
+    this.assertSession(input.session, input.projectId);
+    if (!input.entries.length)
+      return;
+    const removed = await this.sql`
+      DELETE FROM object_vectors AS stored
+      USING jsonb_array_elements(${jsonParameter2(this.sql, input.entries)}::jsonb) AS requested(entry)
+      WHERE stored.project_id = ${input.projectId}
+        AND stored.object_type_id = entry#>>'{ref,objectTypeId}'
+        AND stored.primary_id = entry#>>'{ref,primaryId}' AND stored.profile = entry->>'profile'
+        AND stored.last_commit_id = entry->>'expectedCommitId'
+      RETURNING stored.profile
+    `;
+    if (removed.length !== input.entries.length)
+      throw vectorConflict();
+  }
+  async write(input) {
+    await this.writeBatch({ session: input.session, projectId: input.projectId, entries: [input] });
+  }
+  async writeBatch(input) {
+    const entries = input.entries.map(({ value, expectedCommitId }) => {
+      this.assertSession(input.session, input.projectId, value.lastCommitId);
+      return {
+        object_type_id: value.ref.objectTypeId,
+        primary_id: value.ref.primaryId,
+        profile: value.profile,
+        configuration: value.configuration,
+        source: [...value.source],
+        source_fingerprint: value.sourceFingerprint,
+        embedding: [...value.values],
+        last_commit_id: value.lastCommitId,
+        expected_commit_id: expectedCommitId
+      };
+    });
+    const inserts = entries.filter((entry) => entry.expected_commit_id === null);
+    const updates = entries.filter((entry) => entry.expected_commit_id !== null);
+    if (inserts.length) {
+      const rows = await this.sql`
+        INSERT INTO object_vectors (
+          project_id, object_type_id, primary_id, profile, configuration,
+          source, source_fingerprint, embedding, last_commit_id
+        )
+        SELECT ${input.projectId}, object_type_id, primary_id, profile, configuration,
+          source, source_fingerprint, embedding, last_commit_id
+        FROM jsonb_to_recordset(${jsonParameter2(this.sql, inserts)}::jsonb) AS incoming(
+          object_type_id text, primary_id text, profile text, configuration text,
+          source text[], source_fingerprint text, embedding real[], last_commit_id text
+        )
+        ORDER BY object_type_id, primary_id, profile
+        ON CONFLICT (project_id, object_type_id, primary_id, profile) DO NOTHING
+        RETURNING profile`;
+      if (rows.length !== inserts.length)
+        throw vectorConflict();
+    }
+    if (updates.length) {
+      const rows = await this.sql`
+        UPDATE object_vectors AS stored SET
+          configuration = incoming.configuration, source = incoming.source,
+          source_fingerprint = incoming.source_fingerprint, embedding = incoming.embedding,
+          last_commit_id = incoming.last_commit_id
+        FROM jsonb_to_recordset(${jsonParameter2(this.sql, updates)}::jsonb) AS incoming(
+          object_type_id text, primary_id text, profile text, configuration text,
+          source text[], source_fingerprint text, embedding real[], last_commit_id text,
+          expected_commit_id text
+        )
+        WHERE stored.project_id = ${input.projectId}
+          AND stored.object_type_id = incoming.object_type_id AND stored.primary_id = incoming.primary_id
+          AND stored.profile = incoming.profile AND stored.last_commit_id = incoming.expected_commit_id
+        RETURNING stored.profile`;
+      if (rows.length !== updates.length)
+        throw vectorConflict();
+    }
+  }
+  async remove(input) {
+    this.assertSession(input.session, input.projectId);
+    const rows = await this.sql`
+      DELETE FROM object_vectors
+      WHERE project_id = ${input.projectId}
+        AND object_type_id = ${input.ref.objectTypeId} AND primary_id = ${input.ref.primaryId}
+        AND profile = ${input.profile} AND last_commit_id = ${input.expectedCommitId}
+      RETURNING profile
+    `;
+    if (rows.length !== 1)
+      throw vectorConflict();
+  }
+}
+function vectorConflict() {
+  return new MaterializationConflictError8("effective-state", "Vector changed since it was prepared.");
+}
+
 // src/ontology-storage/index.ts
 class PgOntologyStorage {
   commits;
   sources;
   materializations;
   outbox;
+  vectorIndexing;
+  vectors;
   constructor(input) {
     this.commits = new PgOntologyCommitStorage(input.runRootOperation);
     this.sources = new PgOntologySourceStorage(input.runRootOperation);
     this.materializations = new PgOntologyMaterializationStorage(input.sql, input.transactionContext);
     this.outbox = new PgOntologyOutboxStorage(input.runRootOperation);
+    this.vectorIndexing = new PgVectorIndexingStorage(input.sql, input.runRootOperation, (session, projectId) => this.materializations.assertVectorSession(session, projectId));
+    this.vectors = new PgOntologyVectorStorage(input.sql, input.runRootOperation, (session, projectId, commitId) => this.materializations.assertVectorSession(session, projectId, commitId));
   }
   deactivateSessions() {
     this.materializations.deactivateSessions();
@@ -13925,6 +14588,8 @@ class PgAiCostStorage {
         COUNT(*)::text AS model_call_count,
         COUNT(*) FILTER (WHERE reporting_status <> 'unavailable')::text
           AS reported_usage_call_count,
+        COUNT(*) FILTER (WHERE input_tokens IS NOT NULL AND output_tokens IS NOT NULL)::text
+          AS complete_usage_call_count,
         COUNT(input_tokens)::text AS input_tokens_count,
         SUM(input_tokens)::text AS input_tokens_sum,
         COUNT(output_tokens)::text AS output_tokens_count,
@@ -14066,6 +14731,7 @@ function aggregateFragmentFromRow(row) {
     modelCallCount: row.model_call_count,
     usage: {
       reportedCallCount: row.reported_usage_call_count,
+      completeCallCount: row.complete_usage_call_count,
       inputTokens: meterFragment(row.input_tokens_count, row.input_tokens_sum),
       outputTokens: meterFragment(row.output_tokens_count, row.output_tokens_sum),
       uncachedInputTokens: meterFragment(row.uncached_input_tokens_count, row.uncached_input_tokens_sum),
@@ -15048,8 +15714,134 @@ function toStorageRow(row) {
   };
 }
 
+// src/pg-file-upload-session-storage.ts
+import {
+  DurableFileUploadSessions,
+  fileUploadSessionReapAt,
+  parseFileUploadSessionRow
+} from "@sixb/core/internal/file-upload-session-storage-provider";
+class PgFileUploadSessionStorage extends DurableFileUploadSessions {
+  constructor(sql) {
+    super(new PgFileUploadSessionBackend(sql));
+  }
+}
+
+class PgFileUploadSessionBackend {
+  sql;
+  constructor(sql) {
+    this.sql = sql;
+  }
+  read(run) {
+    return run(new PgFileUploadSessionPersistence(this.sql, false));
+  }
+  transaction(run) {
+    return runPgTransaction(this.sql, (tx) => run(new PgFileUploadSessionPersistence(tx, true)));
+  }
+}
+
+class PgFileUploadSessionPersistence {
+  sql;
+  locking;
+  constructor(sql, locking) {
+    this.sql = sql;
+    this.locking = locking;
+  }
+  async now() {
+    const [row] = await this.sql`SELECT clock_timestamp() AS now`;
+    if (!row)
+      throw new Error("[SixbPg] Database clock returned no row.");
+    return new Date(row.now);
+  }
+  async insert(session) {
+    const rows = await this.sql`
+      INSERT INTO file_upload_sessions (
+        id, project_id, owner_principal_type, owner_principal_id, strategy, status, file_name,
+        media_type, logical_path, expected_size_bytes, expected_digest, provider_upload,
+        signed_parts, file_ref, created_at, expires_at, completed_at, aborted_at, reap_at
+      ) VALUES (
+        ${session.id}, ${session.projectId}, ${session.principal.type}, ${session.principal.id},
+        ${session.strategy}, ${session.status}, ${session.fileName ?? null}, ${session.mediaType ?? null},
+        ${session.logicalPath ?? null}, ${session.expectedSizeBytes ?? null},
+        ${session.expectedDigest ?? null}, ${jsonText(session.providerUpload)}::text::jsonb,
+        ${JSON.stringify(session.signedParts)}::text::jsonb, ${jsonText(session.fileRef)}::text::jsonb,
+        ${session.createdAt}, ${session.expiresAt}, ${session.completedAt ?? null},
+        ${session.abortedAt ?? null}, ${fileUploadSessionReapAt(session)}
+      )
+      ON CONFLICT (id) DO NOTHING
+      RETURNING id
+    `;
+    return rows.length === 1;
+  }
+  async get(uploadId) {
+    const [row] = this.locking ? await this.sql`
+          SELECT * FROM file_upload_sessions WHERE id = ${uploadId} FOR UPDATE
+        ` : await this.sql`
+          SELECT * FROM file_upload_sessions WHERE id = ${uploadId}
+        `;
+    return row ? sessionFromRow(row) : null;
+  }
+  async update(session) {
+    await this.sql`
+      UPDATE file_upload_sessions
+      SET status = ${session.status},
+        provider_upload = ${jsonText(session.providerUpload)}::text::jsonb,
+        signed_parts = ${JSON.stringify(session.signedParts)}::text::jsonb,
+        file_ref = ${jsonText(session.fileRef)}::text::jsonb,
+        created_at = ${session.createdAt},
+        expires_at = ${session.expiresAt},
+        completed_at = ${session.completedAt ?? null},
+        aborted_at = ${session.abortedAt ?? null},
+        reap_at = ${fileUploadSessionReapAt(session)}
+      WHERE id = ${session.id}
+    `;
+  }
+  async listAbandoned(input) {
+    const rows = await this.sql`
+      SELECT * FROM file_upload_sessions
+      WHERE project_id = ${input.projectId} AND status = 'pending'
+        AND provider_upload IS NOT NULL AND expires_at <= ${input.now}
+      ORDER BY expires_at, id COLLATE "C"
+      LIMIT ${input.limit}
+    `;
+    return rows.map(sessionFromRow);
+  }
+  async deleteReapable(now) {
+    const rows = await this.sql`
+      DELETE FROM file_upload_sessions
+      WHERE reap_at IS NOT NULL AND reap_at <= ${now}
+      RETURNING id
+    `;
+    return rows.length;
+  }
+}
+function sessionFromRow(row) {
+  return parseFileUploadSessionRow({
+    id: row.id,
+    projectId: row.project_id,
+    ownerPrincipalType: row.owner_principal_type,
+    ownerPrincipalId: row.owner_principal_id,
+    strategy: row.strategy,
+    status: row.status,
+    fileName: row.file_name,
+    mediaType: row.media_type,
+    logicalPath: row.logical_path,
+    expectedSizeBytes: row.expected_size_bytes,
+    expectedDigest: row.expected_digest,
+    providerUpload: row.provider_upload,
+    signedParts: row.signed_parts,
+    fileRef: row.file_ref,
+    createdAt: row.created_at,
+    expiresAt: row.expires_at,
+    completedAt: row.completed_at,
+    abortedAt: row.aborted_at
+  });
+}
+function jsonText(value) {
+  return value === undefined ? null : JSON.stringify(value);
+}
+
 // src/pg-pipeline-run-storage.ts
-import { parseSixbFailure as parseSixbFailure3, serializeSixbFailure as serializeSixbFailure3 } from "@sixb/core/internal/errors";
+import { parseSixbFailure as parseSixbFailure4, serializeSixbFailure as serializeSixbFailure3 } from "@sixb/core/internal/errors";
 import { assertPipelineRunExecution } from "@sixb/core/internal/pipeline-run-storage-provider";
 import { canRequeuePipelineRunAfterEnqueueFailure } from "@sixb/core/internal/storage";
 import { PIPELINE_RUN_FAILURE_CODES, PipelineRunError } from "@sixb/core/storage";
@@ -15403,7 +16195,7 @@ function rowToPipelineRunRecord(row) {
       datasetId: row.output_dataset_id,
       versionId: row.output_version_id
     } : undefined,
-    error: row.error === null ? undefined : parseSixbFailure3(row.error, PIPELINE_RUN_FAILURE_CODES)
+    error: row.error === null ? undefined : parseSixbFailure4(row.error, PIPELINE_RUN_FAILURE_CODES)
   };
 }
 function rowToPipelineStepRunRecord(row) {
@@ -15424,7 +16216,7 @@ function rowToPipelineStepRunRecord(row) {
       versionId: row.output_version_id
     } : undefined,
     rowsWritten: row.rows_written != null ? Number(row.rows_written) : undefined,
-    error: row.error === null ? undefined : parseSixbFailure3(row.error, PIPELINE_RUN_FAILURE_CODES)
+    error: row.error === null ? undefined : parseSixbFailure4(row.error, PIPELINE_RUN_FAILURE_CODES)
   };
 }
 function parseDatasetVersionRefs(value) {
@@ -16150,7 +16942,7 @@ function toIsoString3(value) {
 }
 
 // src/pg-sync-run-storage.ts
-import { parseSixbFailure as parseSixbFailure4, serializeSixbFailure as serializeSixbFailure5 } from "@sixb/core/internal/errors";
+import { parseSixbFailure as parseSixbFailure5, serializeSixbFailure as serializeSixbFailure5 } from "@sixb/core/internal/errors";
 import { canRequeueSyncRunAfterEnqueueFailure } from "@sixb/core/internal/storage";
 import { assertSyncRunExecution } from "@sixb/core/internal/sync-run-storage-provider";
 import { SYNC_RUN_FAILURE_CODES, SyncRunError } from "@sixb/core/storage";
@@ -16376,7 +17168,7 @@ function rowToSyncRunRecord(row) {
     } : undefined,
     expectedLatestVersionId: row.expected_latest_version_id ?? undefined,
     commitMessage: row.commit_message ?? undefined,
-    error: row.error === null ? undefined : parseSixbFailure4(row.error, SYNC_RUN_FAILURE_CODES),
+    error: row.error === null ? undefined : parseSixbFailure5(row.error, SYNC_RUN_FAILURE_CODES),
     checkpoint: hasCheckpoint(row) ? row.checkpoint : undefined
   };
 }
@@ -16501,7 +17293,7 @@ function rowToPoint(row) {
 }
 
 // src/pg-webhook-run-storage.ts
-import { parseSixbFailure as parseSixbFailure5, serializeSixbFailure as serializeSixbFailure6 } from "@sixb/core/internal/errors";
+import { parseSixbFailure as parseSixbFailure6, serializeSixbFailure as serializeSixbFailure6 } from "@sixb/core/internal/errors";
 import { assertWebhookRunExecution } from "@sixb/core/internal/webhook-run-storage-provider";
 import { canRetryWebhookRun, WEBHOOK_RUN_FAILURE_CODES, WebhookRunError } from "@sixb/core/storage";
 class PgWebhookRunStorage {
@@ -16655,7 +17447,7 @@ function rowToWebhookRunRecord(row) {
     requestBodySha256: row.request_body_sha256,
     responseStatus: row.response_status != null ? Number(row.response_status) : undefined,
     idempotencyKey: row.idempotency_key ?? undefined,
-    error: row.error === null ? undefined : parseSixbFailure5(row.error, WEBHOOK_RUN_FAILURE_CODES)
+    error: row.error === null ? undefined : parseSixbFailure6(row.error, WEBHOOK_RUN_FAILURE_CODES)
   };
 }
 
@@ -16719,7 +17511,7 @@ class PgWorkflowInterventionStorage {
         SET
           status = ${"submitted"},
           submitted_at = ${input.submittedAt ?? new Date},
-          submitted_by = ${serializeActor(input.submittedBy)}::text::jsonb,
+          submitted_by = ${serializePrincipal(input.submittedBy)}::text::jsonb,
           response = ${serializeRecord(input.response)}::text::jsonb
         WHERE project_id = ${input.projectId} AND id = ${input.id}
         RETURNING *
@@ -16735,7 +17527,7 @@ class PgWorkflowInterventionStorage {
         SET
           status = ${"cancelled"},
           cancelled_at = ${input.cancelledAt ?? new Date},
-          cancelled_by = ${serializeActor(input.cancelledBy)}::text::jsonb
+          cancelled_by = ${serializePrincipal(input.cancelledBy)}::text::jsonb
         WHERE project_id = ${input.projectId} AND id = ${input.id}
         RETURNING *
       `;
@@ -16862,10 +17654,10 @@ function serializeRecord(value) {
 function parseRecord(value) {
   return typeof value === "string" ? JSON.parse(value) : value;
 }
-function serializeActor(actor) {
-  return actor ? JSON.stringify(actor) : null;
+function serializePrincipal(principal) {
+  return principal ? JSON.stringify(principal) : null;
 }
-function parseActor(value) {
+function parsePrincipal(value) {
   return typeof value === "string" ? JSON.parse(value) : value ?? undefined;
 }
 function rowToWorkflowInterventionRecord(row) {
@@ -16885,10 +17677,10 @@ function rowToWorkflowInterventionRecord(row) {
     requestedAt: new Date(row.requested_at),
     expiresAt: row.expires_at ? new Date(row.expires_at) : undefined,
     submittedAt: row.submitted_at ? new Date(row.submitted_at) : undefined,
-    submittedBy: parseActor(row.submitted_by),
+    submittedBy: parsePrincipal(row.submitted_by),
     response: row.response ? parseRecord(row.response) : undefined,
     cancelledAt: row.cancelled_at ? new Date(row.cancelled_at) : undefined,
-    cancelledBy: parseActor(row.cancelled_by),
+    cancelledBy: parsePrincipal(row.cancelled_by),
     expiredAt: row.expired_at ? new Date(row.expired_at) : undefined
   };
 }
@@ -16899,7 +17691,7 @@ function assertNonNegativeInteger(value, fieldName) {
 }
 
 // src/pg-workflow-run-storage.ts
-import { parseSixbFailure as parseSixbFailure6, serializeSixbFailure as serializeSixbFailure7 } from "@sixb/core/internal/errors";
+import { parseSixbFailure as parseSixbFailure7, serializeSixbFailure as serializeSixbFailure7 } from "@sixb/core/internal/errors";
 import {
   assertWorkflowAgentNodeRunExecution,
   assertWorkflowRunExecution
@@ -17541,7 +18333,7 @@ function rowToWorkflowRunRecord(row) {
     queuedAt: row.queued_at ? new Date(row.queued_at) : undefined,
     startedAt: new Date(row.started_at),
     finishedAt: row.finished_at ? new Date(row.finished_at) : undefined,
-    error: row.error === null ? undefined : parseSixbFailure6(row.error, WORKFLOW_RUN_FAILURE_CODES),
+    error: row.error === null ? undefined : parseSixbFailure7(row.error, WORKFLOW_RUN_FAILURE_CODES),
     attempt: Number(row.attempt),
     ...row.execution_token && row.execution_queue_lease_expires_at ? {
       execution: {
@@ -17566,7 +18358,7 @@ function rowToWorkflowNodeRunRecord(row) {
     startedAt: new Date(row.started_at),
     finishedAt: row.finished_at ? new Date(row.finished_at) : undefined,
     output: row.output ? parseRecord2(row.output) : undefined,
-    error: row.error === null ? undefined : parseSixbFailure6(row.error, WORKFLOW_RUN_FAILURE_CODES)
+    error: row.error === null ? undefined : parseSixbFailure7(row.error, WORKFLOW_RUN_FAILURE_CODES)
   };
 }
 function assertNonNegativeInteger2(value, fieldName) {
@@ -17608,7 +18400,7 @@ function rowToWorkflowAgentNodeRunRecord(row) {
     ...row.finish_reason ? { finishReason: row.finish_reason } : {},
     ...row.trace ? { trace: parseJson(row.trace) } : {},
     ...row.diagnostics ? { diagnostics: parseJson(row.diagnostics) } : {},
-    ...row.error ? { error: parseSixbFailure6(row.error, AGENT_RUN_FAILURE_CODES3) } : {},
+    ...row.error ? { error: parseSixbFailure7(row.error, AGENT_RUN_FAILURE_CODES3) } : {},
     attempt: Number(row.attempt),
     ...row.execution_token && row.execution_queue_lease_expires_at ? {
       execution: {
@@ -17956,6 +18748,7 @@ class PostgresStorage {
   connectorConnections;
   shareGrants;
   shareSessions;
+  fileUploadSessions;
   migrators;
   sql;
   schemaName;
@@ -18009,6 +18802,7 @@ class PostgresStorage {
     this.connectorConnections = createOperationScopedFacade(stores.connectorConnections, scope);
     this.shareGrants = createOperationScopedFacade(stores.shareGrants, scope);
     this.shareSessions = createOperationScopedFacade(stores.shareSessions, scope);
+    this.fileUploadSessions = createOperationScopedFacade(stores.fileUploadSessions, scope);
     registerPostgresStorageTestingAdapter(this, (durationMs) => stores.connectorConnections.advanceTimeForTesting(durationMs));
   }
   async ping() {
@@ -18103,7 +18897,8 @@ function createPostgresStores(sql, options) {
     rules: new PgRulesStorage(sql),
     connectorConnections: new PgConnectorConnectionStorage(sql),
     shareGrants,
-    shareSessions
+    shareSessions,
+    fileUploadSessions: new PgFileUploadSessionStorage(sql)
   };
 }
 function resolveTimeoutMillis(value, label) {
@@ -18120,4 +18915,4 @@ export {
   migratePostgresStorage
 };
 
-//# debugId=0CAAAAC02FB5CFD864756E2164756E21
+//# debugId=F4D8409142F8F3AF64756E2164756E21