@sixb/pg 0.1.5 → 0.1.7

package/dist/index.js

@@ -104,7 +104,6 @@ function rowToThreadRecord(row) {
   return {
     id: row.id,
     projectId: row.project_id,
-    agentId: row.agent_id,
     ownerPrincipal: { type: row.owner_principal_type, id: row.owner_principal_id },
     title: row.title ?? undefined,
     status: row.status,
@@ -116,13 +115,10 @@ function rowToThreadRecord(row) {
   };
 }
 function rowToRunRecord(row) {
-  return {
+  const base = {
     id: row.id,
     projectId: row.project_id,
     executionId: row.execution_id,
-    threadId: row.thread_id,
-    agentId: row.agent_id,
-    triggerMessageId: row.trigger_message_id,
     requesterGroupIds: typeof row.requester_group_ids === "string" ? JSON.parse(row.requester_group_ids) : row.requester_group_ids,
     status: row.status,
     modelId: row.model_id ?? undefined,
@@ -138,6 +134,29 @@ function rowToRunRecord(row) {
     startedAt: row.started_at ? new Date(row.started_at) : undefined,
     completedAt: row.completed_at ? new Date(row.completed_at) : undefined
   };
+  if (row.kind === "conversation") {
+    if (!row.thread_id || !row.trigger_message_id) {
+      throw new Error(`[SixbPg] Conversational Agent run '${row.id}' has invalid persisted fields.`);
+    }
+    return {
+      ...base,
+      kind: "conversation",
+      threadId: row.thread_id,
+      triggerMessageId: row.trigger_message_id,
+      ...row.spec === null ? {} : { spec: parseJsonColumn(row.spec) }
+    };
+  }
+  if (!row.parent_run_id || !row.spawn_key || row.spec === null) {
+    throw new Error(`[SixbPg] Subagent run '${row.id}' has invalid persisted fields.`);
+  }
+  return {
+    ...base,
+    kind: "subagent",
+    parentRunId: row.parent_run_id,
+    spawnKey: row.spawn_key,
+    spec: parseJsonColumn(row.spec),
+    ...row.result === null ? {} : { result: parseJsonColumn(row.result) }
+  };
 }
 function rowToMessageRecord(row) {
   return {
@@ -193,6 +212,9 @@ function normalizeDiagnostics(value) {
   }
   return typeof value === "string" ? JSON.parse(value) : value;
 }
+function parseJsonColumn(value) {
+  return typeof value === "string" ? JSON.parse(value) : value;
+}
 async function queryAgentList(input) {
   const where = `WHERE ${input.whereClauses.join(" AND ")}`;
   const offset = input.offset ?? 0;
@@ -523,7 +545,13 @@ class PgAgentMessageStore {
 }
 
 // src/agents/runs.ts
-import { assertAgentRunExecution } from "@sixb/core/internal/agent-run-storage-provider";
+import {
+  assertAgentRunExecution,
+  assertConversationAgentRunSpec,
+  assertCreateSubagentRunInput,
+  assertSubagentRunResult,
+  subagentRunMatchesCreateInput
+} from "@sixb/core/internal/agent-run-storage-provider";
 import { normalizeRequesterGroupIds } from "@sixb/core/internal/auth";
 import { serializeSixbFailure } from "@sixb/core/internal/errors";
 import {
@@ -597,13 +625,13 @@ class PgAgentRunStore {
     this.executions = executions;
   }
   async create(input) {
+    assertConversationAgentRunSpec(input.spec, "SixbPg");
     const createdAt = input.createdAt ?? new Date;
     await assertAgentRunExecution({
       executions: this.executions,
       projectId: input.projectId,
       executionId: input.executionId,
-      runId: input.id,
-      agentId: input.agentId
+      runId: input.id
     });
     try {
       return await runPgTransaction(this.sql, async (tx) => {
@@ -623,9 +651,10 @@ class PgAgentRunStore {
             project_id,
             id,
             execution_id,
+            kind,
             thread_id,
-            agent_id,
             trigger_message_id,
+            spec,
             requester_group_ids,
             status,
             attempt,
@@ -634,9 +663,10 @@ class PgAgentRunStore {
             ${input.projectId},
             ${input.id},
             ${input.executionId},
+            ${"conversation"},
             ${input.threadId},
-            ${input.agentId},
             ${input.triggerMessageId},
+            ${JSON.stringify(input.spec)}::text::jsonb,
             ${JSON.stringify(normalizeRequesterGroupIds(input.requesterGroupIds))}::text::jsonb,
             ${"queued"},
             ${0},
@@ -648,7 +678,11 @@ class PgAgentRunStore {
           UPDATE agent_threads SET active_run_id = ${input.id}, updated_at = ${createdAt}
           WHERE project_id = ${input.projectId} AND id = ${input.threadId}
         `;
-        return rowToRunRecord(row);
+        const created = rowToRunRecord(row);
+        if (created.kind !== "conversation") {
+          throw new Error(`[SixbPg] Agent run insert '${input.id}' returned the wrong run kind.`);
+        }
+        return created;
       });
     } catch (error) {
       if (isUniqueViolation(error)) {
@@ -657,6 +691,80 @@ class PgAgentRunStore {
       throw error;
     }
   }
+  async createSubagent(input) {
+    assertCreateSubagentRunInput(input, "SixbPg");
+    const execution = await assertAgentRunExecution({
+      executions: this.executions,
+      projectId: input.projectId,
+      executionId: input.executionId,
+      runId: input.id
+    });
+    try {
+      return await runPgTransaction(this.sql, async (tx) => {
+        const [parent] = await tx`
+          SELECT * FROM agent_runs
+          WHERE project_id = ${input.projectId} AND id = ${input.parentRunId}
+          FOR UPDATE
+        `;
+        if (!parent || parent.kind !== "conversation") {
+          throw new AgentStorageError3("run_not_found", `[SixbPg] Parent Agent run '${input.parentRunId}' was not found.`);
+        }
+        const [existingRow] = await tx`
+          SELECT * FROM agent_runs
+          WHERE project_id = ${input.projectId} AND id = ${input.id}
+        `;
+        if (existingRow) {
+          const existing = rowToRunRecord(existingRow);
+          if (subagentRunMatchesCreateInput(existing, input))
+            return existing;
+          throw new AgentStorageError3("duplicate_id", `[SixbPg] Subagent run '${input.id}' already exists with different immutable inputs.`);
+        }
+        if (parent.status !== "running") {
+          throw new AgentStorageError3("invalid_state", `[SixbPg] Parent Agent run '${parent.id}' is not running (status '${parent.status}').`);
+        }
+        if (execution.source.type !== "execution" || execution.source.executionId !== parent.execution_id) {
+          throw new AgentStorageError3("invalid_input", `[SixbPg] Subagent execution '${execution.id}' is not a child of parent execution '${parent.execution_id}'.`);
+        }
+        if (parent.execution_token !== input.parentExecutionToken) {
+          throw new AgentStorageError3("execution_lost", `[SixbPg] Parent Agent run '${parent.id}' is no longer owned by this execution.`);
+        }
+        const parentRecord = rowToRunRecord(parent);
+        const [countRow] = await tx`
+          SELECT COUNT(*)::bigint AS count FROM agent_runs
+          WHERE project_id = ${input.projectId}
+            AND parent_run_id = ${input.parentRunId}
+            AND status IN (${"queued"}, ${"running"})
+        `;
+        const activeChildren = Number(countRow?.count ?? 0);
+        if (activeChildren >= input.maxActiveChildren) {
+          throw new AgentStorageError3("active_child_limit", `[SixbPg] Agent run '${parent.id}' already has ${activeChildren} active subagents.`);
+        }
+        const [row] = await tx`
+          INSERT INTO agent_runs (
+            project_id, id, execution_id, kind, parent_run_id, spawn_key, spec,
+            requester_group_ids, status, attempt, created_at
+          ) VALUES (
+            ${input.projectId}, ${input.id}, ${input.executionId}, ${"subagent"},
+            ${input.parentRunId}, ${input.spawnKey},
+            ${JSON.stringify(input.spec)}::text::jsonb,
+            ${JSON.stringify(parentRecord.requesterGroupIds)}::text::jsonb,
+            ${"queued"}, ${0}, ${input.createdAt ?? new Date}
+          )
+          RETURNING *
+        `;
+        const created = rowToRunRecord(row);
+        if (created.kind !== "subagent") {
+          throw new Error(`[SixbPg] Subagent insert '${input.id}' returned the wrong run kind.`);
+        }
+        return created;
+      });
+    } catch (error) {
+      if (isUniqueViolation(error)) {
+        throw new AgentStorageError3("duplicate_id", `[SixbPg] Subagent run '${input.id}' conflicts with an existing durable spawn.`);
+      }
+      throw error;
+    }
+  }
   async start(input) {
     const startedAt = input.startedAt ?? new Date;
     return runPgTransaction(this.sql, async (tx) => {
@@ -731,6 +839,12 @@ class PgAgentRunStore {
     const errorValue = input.status === "succeeded" || input.error === undefined ? null : serializeSixbFailure(input.error, AGENT_RUN_FAILURE_CODES2);
     return runPgTransaction(this.sql, async (tx) => {
       const run = await this.lockRunning(tx, input.projectId, input.id);
+      if (input.status === "succeeded" && run.kind === "subagent") {
+        assertSubagentRunResult(input.result, run.id, "SixbPg");
+      }
+      if (input.status === "succeeded" && run.kind === "conversation" && input.result !== undefined) {
+        throw new AgentStorageError3("invalid_input", `[SixbPg] Conversational Agent run '${run.id}' cannot persist a subagent result.`);
+      }
       if (run.execution_token !== input.executionToken) {
         throw new AgentStorageError3("execution_lost", `[SixbPg] Execution token is no longer current on agent run '${input.id}'.`);
       }
@@ -742,6 +856,7 @@ class PgAgentRunStore {
           finish_reason = ${input.finishReason ?? null},
           error = ${errorValue}::text::jsonb,
           diagnostics = ${input.diagnostics === undefined ? null : JSON.stringify(input.diagnostics)}::text::jsonb,
+          result = ${input.status === "succeeded" && input.result !== undefined ? JSON.stringify(input.result) : null}::text::jsonb,
           execution_token = ${null},
           execution_queue_lease_expires_at = ${null},
           completed_at = ${completedAt}
@@ -776,19 +891,23 @@ class PgAgentRunStore {
     });
   }
   async list(input) {
-    if (hasEmptyStatuses(input)) {
+    if (hasEmptyStatuses(input) || input.kinds?.length === 0) {
       return { runs: [], hasMore: false, total: 0 };
     }
     const whereClauses = ["project_id = $1"];
     const params = [input.projectId];
     let index = 2;
+    if (input.kinds) {
+      whereClauses.push(`kind = ANY($${index++}::text[])`);
+      params.push(input.kinds);
+    }
     if (input.threadId) {
       whereClauses.push(`thread_id = $${index++}`);
       params.push(input.threadId);
     }
-    if (input.agentId) {
-      whereClauses.push(`agent_id = $${index++}`);
-      params.push(input.agentId);
+    if (input.parentRunId) {
+      whereClauses.push(`parent_run_id = $${index++}`);
+      params.push(input.parentRunId);
     }
     index = appendRunListFilters(whereClauses, params, index, input, "COALESCE(started_at, created_at)");
     const { rows, total, hasMore } = await queryRunList({
@@ -821,6 +940,8 @@ class PgAgentRunStore {
     return row;
   }
   async releaseThread(sql, run, completedAt) {
+    if (run.kind !== "conversation")
+      return;
     await sql`
       UPDATE agent_threads SET active_run_id = ${null}, updated_at = ${completedAt}
       WHERE project_id = ${run.project_id} AND id = ${run.thread_id} AND active_run_id = ${run.id}
@@ -845,7 +966,6 @@ class PgAgentThreadStore {
         INSERT INTO agent_threads (
           project_id,
           id,
-          agent_id,
           owner_principal_type,
           owner_principal_id,
           title,
@@ -855,7 +975,6 @@ class PgAgentThreadStore {
         ) VALUES (
           ${input.projectId},
           ${input.id},
-          ${input.agentId},
           ${input.ownerPrincipal.type},
           ${input.ownerPrincipal.id},
           ${input.title ?? null},
@@ -880,21 +999,12 @@ class PgAgentThreadStore {
     return row ? rowToThreadRecord(row) : null;
   }
   async list(input) {
-    if (input.statuses !== undefined && input.statuses.length === 0 || input.agentIds !== undefined && input.agentIds.length === 0) {
+    if (input.statuses !== undefined && input.statuses.length === 0) {
       return { threads: [], hasMore: false, total: 0 };
     }
     const whereClauses = ["project_id = $1"];
     const params = [input.projectId];
     let index = 2;
-    if (input.agentId) {
-      whereClauses.push(`agent_id = $${index++}`);
-      params.push(input.agentId);
-    }
-    if (input.agentIds) {
-      const placeholders = input.agentIds.map(() => `$${index++}`);
-      whereClauses.push(`agent_id IN (${placeholders.join(", ")})`);
-      params.push(...input.agentIds);
-    }
     if (input.statuses) {
       const placeholders = input.statuses.map(() => `$${index++}`);
       whereClauses.push(`status IN (${placeholders.join(", ")})`);
@@ -933,7 +1043,7 @@ class PgAgentStorage {
   }
 }
 // src/auth-storage/auth-storage.ts
-import { AuthStorageError as AuthStorageError10 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError11 } from "@sixb/core/storage";
 
 // src/auth-storage/access-tokens.ts
 import { AuthStorageError as AuthStorageError2 } from "@sixb/core/storage";
@@ -1076,6 +1186,25 @@ function rowToOidcAuthorizationAttemptRecord(row) {
     consumedAt: row.consumed_at ? toDate(row.consumed_at) : undefined
   };
 }
+function rowToDeviceAuthorizationRecord(row) {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    deviceCodeHash: row.device_code_hash,
+    userCode: row.user_code,
+    clientName: row.client_name,
+    tokenName: row.token_name,
+    tokenExpiresAt: toDate(row.token_expires_at),
+    status: row.status,
+    approvedUserId: row.approved_user_id ?? undefined,
+    approvedSessionId: row.approved_session_id ?? undefined,
+    createdAt: toDate(row.created_at),
+    expiresAt: toDate(row.expires_at),
+    approvedAt: row.approved_at ? toDate(row.approved_at) : undefined,
+    deniedAt: row.denied_at ? toDate(row.denied_at) : undefined,
+    consumedAt: row.consumed_at ? toDate(row.consumed_at) : undefined
+  };
+}
 function serializeOptionalRecord(value) {
   return value ? JSON.stringify(value) : null;
 }
@@ -1742,6 +1871,102 @@ function assertKindMatchesSubject(input) {
   throw new AuthStorageError2("invalid_input", `[Sixb] Access token kind '${input.kind}' cannot target subject type '${input.subjectType}'.`);
 }
 
+// src/auth-storage/device-authorizations.ts
+import { AuthStorageError as AuthStorageError3, MAX_PENDING_DEVICE_AUTHORIZATIONS } from "@sixb/core/storage";
+class PgAuthDeviceAuthorizationStore {
+  sql;
+  constructor(sql) {
+    this.sql = sql;
+  }
+  async create(input) {
+    return runPgTransaction(this.sql, async (tx) => {
+      await lockAdvisoryKeys(tx, [authLockKey("device-authorizations", input.projectId)]);
+      await tx`
+        DELETE FROM auth_device_authorizations
+        WHERE project_id = ${input.projectId} AND expires_at <= ${input.createdAt}
+      `;
+      const [pending] = await tx`
+        SELECT COUNT(*)::bigint AS count FROM auth_device_authorizations
+        WHERE project_id = ${input.projectId} AND status = 'pending'
+      `;
+      if (Number(pending?.count ?? 0) >= MAX_PENDING_DEVICE_AUTHORIZATIONS) {
+        throw new AuthStorageError3("device_authorization_limit_exceeded", `[Sixb] Project '${input.projectId}' has too many pending device authorizations.`);
+      }
+      try {
+        const [row] = await tx`
+        INSERT INTO auth_device_authorizations (
+          project_id, id, device_code_hash, user_code, client_name, token_name,
+          token_expires_at, status, created_at, expires_at
+        ) VALUES (
+          ${assertNonEmpty(input.projectId, "Project id")},
+          ${assertNonEmpty(input.id, "Device authorization id")},
+          ${assertNonEmpty(input.deviceCodeHash, "Device code hash")},
+          ${assertNonEmpty(input.userCode, "User code")},
+          ${assertNonEmpty(input.clientName, "Client name")},
+          ${assertNonEmpty(input.tokenName, "Token name")},
+          ${input.tokenExpiresAt}, 'pending', ${input.createdAt}, ${input.expiresAt}
+        ) RETURNING *
+      `;
+        return rowToDeviceAuthorizationRecord(row);
+      } catch (error) {
+        mapUniqueConstraintError(error, "duplicate_device_authorization", `[Sixb] Device authorization '${input.id}' already exists for project '${input.projectId}'.`);
+      }
+    });
+  }
+  async getById(params) {
+    return getPgDeviceAuthorizationById(this.sql, params.projectId, params.id);
+  }
+  async getByUserCode(params) {
+    const [row] = await this.sql`
+      SELECT * FROM auth_device_authorizations
+      WHERE project_id = ${params.projectId} AND user_code = ${params.userCode}
+    `;
+    return row ? rowToDeviceAuthorizationRecord(row) : null;
+  }
+  async approve(params) {
+    const [row] = await this.sql`
+      UPDATE auth_device_authorizations
+      SET status = 'approved', approved_user_id = ${params.userId},
+          approved_session_id = ${params.sessionId}, approved_at = ${params.approvedAt}
+      WHERE project_id = ${params.projectId} AND id = ${params.id}
+        AND status = 'pending' AND expires_at > ${params.approvedAt}
+        AND EXISTS (
+          SELECT 1 FROM auth_sessions
+          WHERE project_id = ${params.projectId} AND id = ${params.sessionId}
+            AND user_id = ${params.userId} AND revoked_at IS NULL
+            AND expires_at > ${params.approvedAt}
+            AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.approvedAt})
+        )
+      RETURNING *
+    `;
+    if (!row)
+      throw invalidTransition(params.id, params.projectId);
+    return rowToDeviceAuthorizationRecord(row);
+  }
+  async deny(params) {
+    const [row] = await this.sql`
+      UPDATE auth_device_authorizations
+      SET status = 'denied', denied_at = ${params.deniedAt}
+      WHERE project_id = ${params.projectId} AND id = ${params.id}
+        AND status = 'pending' AND expires_at > ${params.deniedAt}
+      RETURNING *
+    `;
+    if (!row)
+      throw invalidTransition(params.id, params.projectId);
+    return rowToDeviceAuthorizationRecord(row);
+  }
+}
+async function getPgDeviceAuthorizationById(sql, projectId, id) {
+  const [row] = await sql`
+    SELECT * FROM auth_device_authorizations
+    WHERE project_id = ${projectId} AND id = ${id}
+  `;
+  return row ? rowToDeviceAuthorizationRecord(row) : null;
+}
+function invalidTransition(id, projectId) {
+  return new AuthStorageError3("invalid_device_authorization", `[Sixb] Device authorization '${id}' is no longer pending for project '${projectId}'.`);
+}
+
 // src/auth-storage/group-memberships.ts
 class PgAuthGroupMembershipStore {
   sql;
@@ -1832,7 +2057,7 @@ class PgAuthUserIdentityStore {
 }
 
 // src/auth-storage/invitations.ts
-import { AuthStorageError as AuthStorageError3 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError4 } from "@sixb/core/storage";
 class PgAuthInvitationStore {
   sql;
   constructor(sql) {
@@ -1873,7 +2098,7 @@ class PgAuthInvitationStore {
         return requireInvitationById(tx, { projectId, id: existingActive.id });
       }
       if (await getInvitationById(tx, { projectId, id })) {
-        throw new AuthStorageError3("duplicate_invitation", `[Sixb] Invitation '${id}' already exists but is not active for project '${projectId}'.`);
+        throw new AuthStorageError4("duplicate_invitation", `[Sixb] Invitation '${id}' already exists but is not active for project '${projectId}'.`);
       }
       const createdAt = dateOrNow(input.createdAt);
       try {
@@ -2011,7 +2236,7 @@ class PgAuthInvitationStore {
 
 // src/auth-storage/magic-links.ts
 import { resolveAuthSessionAudience } from "@sixb/core";
-import { AuthStorageError as AuthStorageError4 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError5 } from "@sixb/core/storage";
 class PgAuthMagicLinkStore {
   sql;
   constructor(sql) {
@@ -2027,7 +2252,7 @@ class PgAuthMagicLinkStore {
       const tokenHash = assertNonEmpty(input.tokenHash, "Magic link token hash");
       await lockAdvisoryKeys(tx, [authLockKey("magic-links", projectId, email)]);
       if (await getMagicLinkRowById(tx, { projectId, id })) {
-        throw new AuthStorageError4("duplicate_magic_link", `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`);
+        throw new AuthStorageError5("duplicate_magic_link", `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`);
       }
       await revokeActiveMagicLinksForEmail(tx, {
         projectId,
@@ -2099,7 +2324,7 @@ class PgAuthMagicLinkStore {
 
 // src/auth-storage/oidc-attempts.ts
 import { resolveAuthSessionAudience as resolveAuthSessionAudience2 } from "@sixb/core";
-import { AuthStorageError as AuthStorageError5 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError6 } from "@sixb/core/storage";
 class PgAuthOidcAuthorizationAttemptStore {
   sql;
   constructor(sql) {
@@ -2114,7 +2339,7 @@ class PgAuthOidcAuthorizationAttemptStore {
     const nonceHash = assertNonEmpty(input.nonceHash, "OIDC nonce hash");
     const codeVerifier = assertNonEmpty(input.codeVerifier, "OIDC code verifier");
     if (await getOidcAttemptRowById(this.sql, { projectId, id })) {
-      throw new AuthStorageError5("duplicate_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`);
+      throw new AuthStorageError6("duplicate_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`);
     }
     try {
       const [row] = await this.sql`
@@ -2157,7 +2382,7 @@ class PgAuthOidcAuthorizationAttemptStore {
 }
 
 // src/auth-storage/service-account-group-memberships.ts
-import { AuthStorageError as AuthStorageError6 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError7 } from "@sixb/core/storage";
 class PgAuthServiceAccountGroupMembershipStore {
   sql;
   constructor(sql) {
@@ -2174,7 +2399,7 @@ class PgAuthServiceAccountGroupMembershipStore {
         AND id = ${serviceAccountId}
     `;
     if (!serviceAccount) {
-      throw new AuthStorageError6("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
+      throw new AuthStorageError7("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
     }
     const [row] = await this.sql`
       INSERT INTO auth_service_account_group_memberships (
@@ -2209,7 +2434,7 @@ class PgAuthServiceAccountGroupMembershipStore {
         AND id = ${serviceAccountId}
     `;
     if (!serviceAccount) {
-      throw new AuthStorageError6("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
+      throw new AuthStorageError7("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
     }
     if (groupIds.length === 0) {
       await this.sql`
@@ -2272,7 +2497,7 @@ class PgAuthServiceAccountGroupMembershipStore {
 }
 
 // src/auth-storage/service-accounts.ts
-import { AuthStorageError as AuthStorageError7 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError8 } from "@sixb/core/storage";
 class PgAuthServiceAccountStore {
   sql;
   constructor(sql) {
@@ -2343,7 +2568,7 @@ class PgAuthServiceAccountStore {
       RETURNING *
     `;
     if (!row) {
-      throw new AuthStorageError7("missing_service_account", `[Sixb] Service account '${id}' not found for project '${projectId}'.`);
+      throw new AuthStorageError8("missing_service_account", `[Sixb] Service account '${id}' not found for project '${projectId}'.`);
     }
     return rowToServiceAccountRecord(row);
   }
@@ -2379,7 +2604,7 @@ class PgAuthServiceAccountStore {
 }
 
 // src/auth-storage/sessions.ts
-import { AuthStorageError as AuthStorageError8 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError9 } from "@sixb/core/storage";
 class PgAuthSessionStore {
   sql;
   constructor(sql) {
@@ -2452,7 +2677,7 @@ class PgAuthSessionStore {
     return runPgTransaction(this.sql, async (tx) => {
       const existing = await getSessionRowById(tx, params, { forUpdate: true });
       if (!existing) {
-        throw new AuthStorageError8("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
+        throw new AuthStorageError9("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
       }
       const [row] = await tx`
         UPDATE auth_sessions
@@ -2490,7 +2715,7 @@ class PgAuthSessionStore {
 }
 
 // src/auth-storage/users.ts
-import { AuthStorageError as AuthStorageError9 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError10 } from "@sixb/core/storage";
 class PgAuthUserStore {
   sql;
   constructor(sql) {
@@ -2501,10 +2726,10 @@ class PgAuthUserStore {
     const projectId = assertNonEmpty(input.projectId, "Project id");
     const email = normalizeEmail(input.email);
     if (await getUserRowById(this.sql, { projectId, id })) {
-      throw new AuthStorageError9("duplicate_user", `[Sixb] User '${id}' already exists for project '${projectId}'.`);
+      throw new AuthStorageError10("duplicate_user", `[Sixb] User '${id}' already exists for project '${projectId}'.`);
     }
     if (await getUserRowByEmail(this.sql, { projectId, email })) {
-      throw new AuthStorageError9("duplicate_user", `[Sixb] User email '${email}' already exists for project '${projectId}'.`);
+      throw new AuthStorageError10("duplicate_user", `[Sixb] User email '${email}' already exists for project '${projectId}'.`);
     }
     const createdAt = dateOrNow(input.createdAt);
     const updatedAt = input.updatedAt ? new Date(input.updatedAt) : createdAt;
@@ -2550,7 +2775,7 @@ class PgAuthUserStore {
       id: input.id
     });
     if (!existing) {
-      throw new AuthStorageError9("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
+      throw new AuthStorageError10("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
     }
     const updatedAt = dateOrNow(input.updatedAt);
     const [row] = await this.sql`
@@ -2570,7 +2795,7 @@ class PgAuthUserStore {
       id: input.id
     });
     if (!existing) {
-      throw new AuthStorageError9("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
+      throw new AuthStorageError10("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
     }
     const updatedAt = dateOrNow(input.updatedAt);
     const [row] = await this.sql`
@@ -2627,6 +2852,7 @@ class PgAuthStorage {
   groupMemberships;
   magicLinks;
   oidcAuthorizationAttempts;
+  deviceAuthorizations;
   constructor(options) {
     this.sql = options.sql;
     this.users = new PgAuthUserStore(this.sql);
@@ -2639,6 +2865,34 @@ class PgAuthStorage {
     this.groupMemberships = new PgAuthGroupMembershipStore(this.sql);
     this.magicLinks = new PgAuthMagicLinkStore(this.sql);
     this.oidcAuthorizationAttempts = new PgAuthOidcAuthorizationAttemptStore(this.sql);
+    this.deviceAuthorizations = new PgAuthDeviceAuthorizationStore(this.sql);
+  }
+  async completeDeviceAuthorization(input) {
+    return runPgTransaction(this.sql, async (tx) => {
+      const authorization = await getPgDeviceAuthorizationById(tx, input.projectId, input.id);
+      if (!authorization) {
+        throw new AuthStorageError11("missing_device_authorization", `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`);
+      }
+      assertCompletableDeviceAuthorization(authorization, input);
+      const accessToken = await new PgAuthAccessTokenStore(tx).create(input.accessToken);
+      const [consumed] = await tx`
+        UPDATE auth_device_authorizations
+        SET status = 'consumed', consumed_at = ${input.completedAt}
+        WHERE project_id = ${input.projectId} AND id = ${input.id} AND status = 'approved'
+        RETURNING *
+      `;
+      if (!consumed) {
+        throw new AuthStorageError11("invalid_device_authorization", "[Sixb] Device authorization was already consumed.");
+      }
+      return {
+        authorization: {
+          ...authorization,
+          status: "consumed",
+          consumedAt: new Date(input.completedAt)
+        },
+        accessToken
+      };
+    });
   }
   async completeMagicLinkSignIn(input) {
     const result = await runPgTransaction(this.sql, async (tx) => {
@@ -2649,7 +2903,7 @@ class PgAuthStorage {
         id: input.magicLinkId
       });
       if (!initialMagicLink) {
-        throw new AuthStorageError10("missing_magic_link", `[Sixb] Magic link '${input.magicLinkId}' not found for project '${projectId}'.`);
+        throw new AuthStorageError11("missing_magic_link", `[Sixb] Magic link '${input.magicLinkId}' not found for project '${projectId}'.`);
       }
       const email = normalizeEmail(initialMagicLink.email);
       await lockAdvisoryKeys(tx, [
@@ -2682,7 +2936,7 @@ class PgAuthStorage {
           consumedAt: completedAt
         });
         return {
-          error: new AuthStorageError10("suspended_user", `[Sixb] User '${existingUserRow.id}' is suspended for project '${projectId}'.`)
+          error: new AuthStorageError11("suspended_user", `[Sixb] User '${existingUserRow.id}' is suspended for project '${projectId}'.`)
         };
       }
       if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
@@ -2693,7 +2947,7 @@ class PgAuthStorage {
           consumedAt: completedAt
         });
         return {
-          error: new AuthStorageError10("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
+          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
         };
       }
       if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && await hasActiveUsers(tx, projectId)) {
@@ -2704,7 +2958,7 @@ class PgAuthStorage {
           consumedAt: completedAt
         });
         return {
-          error: new AuthStorageError10("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
+          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
         };
       }
       await validateCompleteSessionInput(tx, projectId, input.session);
@@ -2713,7 +2967,7 @@ class PgAuthStorage {
       if (shouldCreateUser) {
         newUserId = assertNonEmpty(input.newUserId, "User id");
         if (await getUserRowById(tx, { projectId, id: newUserId })) {
-          throw new AuthStorageError10("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
+          throw new AuthStorageError11("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
         }
       }
       const sessionUserId = existingUserRow?.id ?? newUserId ?? input.newUserId;
@@ -2796,37 +3050,37 @@ class PgAuthStorage {
       if (identity && !userRow) {
         await this.consumeOidcAttempt(input, completedAt, projectId, tx);
         return {
-          error: new AuthStorageError10("missing_user", `[Sixb] User '${identity.user_id}' not found for linked OIDC identity.`)
+          error: new AuthStorageError11("missing_user", `[Sixb] User '${identity.user_id}' not found for linked OIDC identity.`)
         };
       }
       if (!identity && userRow && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
         await this.consumeOidcAttempt(input, completedAt, projectId, tx);
         return {
-          error: new AuthStorageError10("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${userRow.id}' for project '${projectId}'.`)
+          error: new AuthStorageError11("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${userRow.id}' for project '${projectId}'.`)
         };
       }
       if (userRow?.status === "suspended") {
         await this.consumeOidcAttempt(input, completedAt, projectId, tx);
         return {
-          error: new AuthStorageError10("suspended_user", `[Sixb] User '${userRow.id}' is suspended for project '${projectId}'.`)
+          error: new AuthStorageError11("suspended_user", `[Sixb] User '${userRow.id}' is suspended for project '${projectId}'.`)
         };
       }
       if (shouldCreateUser && !input.emailVerified) {
         await this.consumeOidcAttempt(input, completedAt, projectId, tx);
         return {
-          error: new AuthStorageError10("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
+          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
         };
       }
       if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
         await this.consumeOidcAttempt(input, completedAt, projectId, tx);
         return {
-          error: new AuthStorageError10("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
+          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
         };
       }
       if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && await hasActiveUsers(tx, projectId)) {
         await this.consumeOidcAttempt(input, completedAt, projectId, tx);
         return {
-          error: new AuthStorageError10("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
+          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
         };
       }
       await validateCompleteSessionInput(tx, projectId, input.session);
@@ -2835,7 +3089,7 @@ class PgAuthStorage {
       if (shouldCreateUser) {
         newUserId = assertNonEmpty(input.newUserId, "User id");
         if (await getUserRowById(tx, { projectId, id: newUserId })) {
-          throw new AuthStorageError10("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
+          throw new AuthStorageError11("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
         }
       }
       await lockAdvisoryKeys(tx, [
@@ -2914,7 +3168,7 @@ class PgAuthStorage {
         id: input.userId
       }, { forUpdate: true });
       if (!existing) {
-        throw new AuthStorageError10("missing_user", `[Sixb] User '${input.userId}' not found for project '${input.projectId}'.`);
+        throw new AuthStorageError11("missing_user", `[Sixb] User '${input.userId}' not found for project '${input.projectId}'.`);
       }
       const [updated] = await tx`
         UPDATE auth_users
@@ -2934,13 +3188,13 @@ class PgAuthStorage {
   }
   assertMagicLinkUsable(projectId, id, tokenHash, completedAt, row) {
     if (!row) {
-      throw new AuthStorageError10("missing_magic_link", `[Sixb] Magic link '${id}' not found for project '${projectId}'.`);
+      throw new AuthStorageError11("missing_magic_link", `[Sixb] Magic link '${id}' not found for project '${projectId}'.`);
     }
     assertMagicLinkUsable(projectId, id, tokenHash, completedAt, row);
   }
   assertOidcAttemptUsable(projectId, id, stateHash, completedAt, row) {
     if (!row) {
-      throw new AuthStorageError10("missing_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' not found for project '${projectId}'.`);
+      throw new AuthStorageError11("missing_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' not found for project '${projectId}'.`);
     }
     assertOidcAttemptUsable(projectId, id, stateHash, completedAt, row);
   }
@@ -3086,7 +3340,21 @@ function assertSignInSessionAudience(projectId, sessionAudience, storedAudience)
   if (sessionAudience === storedAudience) {
     return;
   }
-  throw new AuthStorageError10("invalid_input", `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`);
+  throw new AuthStorageError11("invalid_input", `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`);
+}
+function assertCompletableDeviceAuthorization(authorization, input) {
+  if (authorization.deviceCodeHash !== input.deviceCodeHash) {
+    throw new AuthStorageError11("invalid_device_authorization", "[Sixb] Invalid device authorization.");
+  }
+  if (authorization.status === "pending") {
+    throw new AuthStorageError11("pending_device_authorization", "[Sixb] Device authorization is pending.");
+  }
+  if (authorization.status === "denied") {
+    throw new AuthStorageError11("device_authorization_denied", "[Sixb] Device authorization was denied.");
+  }
+  if (authorization.status !== "approved" || authorization.expiresAt <= input.completedAt || !authorization.approvedUserId || !authorization.approvedSessionId || input.accessToken.projectId !== input.projectId || input.accessToken.subjectType !== "user" || input.accessToken.subjectId !== authorization.approvedUserId || input.accessToken.createdBySessionId !== authorization.approvedSessionId) {
+    throw new AuthStorageError11("invalid_device_authorization", "[Sixb] Device authorization is invalid.");
+  }
 }
 // src/connector-connection-storage.ts
 import {
@@ -6245,121 +6513,429 @@ ADD COLUMN edited_at JSONB NOT NULL DEFAULT '{}'::jsonb
 CHECK (jsonb_typeof(edited_at) = 'object');
 `;
 
-// src/migrations.ts
-var POSTGRES_STORAGE_ADAPTER_ID = "SixbPostgresStorage";
-function pgSql(id, sqlText) {
-  return pgStep(id, (context) => context.exec(sqlText), { checksum: checksum(sqlText) });
-}
-function pgStep(id, up, options = {}) {
-  return step(id, up, options);
-}
-function createPostgresStorageMigrators(sql, schemaName) {
-  return [
-    createPostgresMigrator({
-      sql,
-      schemaName,
-      migrations: postgresStorageMigrations
-    })
-  ];
-}
-function createPostgresMigrator(params) {
-  return {
-    adapterId: params.migrations.adapterId,
-    latestVersion: params.migrations.latestVersion,
-    async status() {
-      return describeMigrationHistory({
-        migrations: params.migrations,
-        rows: await readPostgresHistory(params.sql, params.schemaName, params.migrations.adapterId)
-      });
-    },
-    migrate() {
-      return withPostgresMigrationLock(params, async (sql) => {
-        const session = postgresMigrationSession(sql, params.schemaName);
-        return runMigrationSet({
-          context: session.context,
-          migrations: params.migrations,
-          state: session.state
-        });
-      });
-    }
-  };
-}
-async function migratePostgresStorage(sql, schemaName) {
-  await createPostgresMigrator({
-    sql,
-    schemaName,
-    migrations: postgresStorageMigrations
-  }).migrate();
-}
-async function dropSchema(sql, schemaName) {
-  await sql.unsafe(`DROP SCHEMA IF EXISTS ${quoteIdent(schemaName)} CASCADE`);
-}
-function quoteIdent(identifier) {
-  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(identifier)) {
-    throw new Error(`[SixbPg] Invalid identifier: ${identifier}`);
-  }
-  return `"${identifier}"`;
-}
-function postgresMigrationSession(sql, schemaName) {
-  const schema = quoteIdent(schemaName);
-  const migrationsTable = `${schema}.sixb_migrations`;
-  let active = null;
-  const connection = () => active ?? sql;
-  return {
-    context: {
-      async exec(sqlText) {
-        await connection().unsafe(sqlText);
-      }
-    },
-    state: {
-      async ensure() {
-        await sql.unsafe(`
-          CREATE SCHEMA IF NOT EXISTS ${schema};
+// src/migrations/029-model-accounting.sql
+var _029_model_accounting_default = `-- Call-time model configuration and provider identity. Historical identity remains unknown.
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN requested_reasoning JSONB
+  CHECK (
+    requested_reasoning IS NULL OR
+    jsonb_typeof(requested_reasoning) IN ('string', 'object')
+  );
+ALTER TABLE ai_model_call_usage ADD COLUMN provider_ids JSONB;
 
-          CREATE TABLE IF NOT EXISTS ${migrationsTable} (
-            adapter_id TEXT NOT NULL,
-            version INTEGER NOT NULL,
-            id TEXT NOT NULL,
-            checksum TEXT,
-            status TEXT NOT NULL CHECK (status IN ('started', 'applied')),
-            started_at TIMESTAMPTZ NOT NULL,
-            finished_at TIMESTAMPTZ,
-            PRIMARY KEY (adapter_id, version)
-          );
-        `);
-      },
-      async readHistory(adapterId) {
-        const rows = await sql.unsafe(`SELECT * FROM ${migrationsTable} WHERE adapter_id = $1 ORDER BY version`, [adapterId]);
-        return rows.map(rowToMigrationRecord);
-      },
-      async markStarted(adapterId, migration, at) {
-        await connection().unsafe(`
-            INSERT INTO ${migrationsTable} (
-              adapter_id, version, id, checksum, status, started_at, finished_at
-            ) VALUES ($1, $2, $3, $4, 'started', $5, NULL)
-            ON CONFLICT(adapter_id, version) DO UPDATE SET
-              id = excluded.id,
-              checksum = excluded.checksum,
-              status = excluded.status,
-              started_at = excluded.started_at,
-              finished_at = NULL
-          `, [adapterId, migration.version, migration.id, migration.checksum ?? null, at]);
-      },
-      async markApplied(adapterId, migration, at) {
-        await connection().unsafe(`
-            UPDATE ${migrationsTable}
-            SET status = 'applied', finished_at = $1
-            WHERE adapter_id = $2 AND version = $3
-          `, [at, adapterId, migration.version]);
-      },
-      async transaction(run) {
-        const previous = active;
-        active = sql;
-        await sql.unsafe("BEGIN");
-        try {
-          await sql.unsafe(`SET LOCAL search_path TO ${schema}`);
-          const result = await run();
-          await sql.unsafe("COMMIT");
+-- Upgrade the shipped valuation reason while retaining the selected-cost projection.
+ALTER TABLE ai_model_call_valuations
+  DROP CONSTRAINT ai_model_call_valuations_reason_check;
+
+UPDATE ai_model_call_valuations SET reason = 'missingRateCard'
+  WHERE reason = 'missingCatalogEntry';
+
+ALTER TABLE ai_model_call_valuations ADD CONSTRAINT ai_model_call_valuations_reason_check
+  CHECK (reason IS NULL OR reason IN (
+    'missingBillingIdentity',
+    'missingRateCard',
+    'missingUsageMeter',
+    'unsupportedPricingDimension',
+    'invalidUsageForFormula'
+  ));
+`;
+
+// src/migrations/030-ai-usage-limits.sql
+var _030_ai_usage_limits_default = `CREATE TABLE ai_usage_limits (
+  project_id TEXT NOT NULL CHECK (length(btrim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(btrim(id)) > 0),
+  subject_type TEXT NOT NULL CHECK (
+    subject_type IN ('project', 'group', 'user', 'serviceAccount')
+  ),
+  subject_id TEXT NOT NULL CHECK (
+    (subject_type = 'project' AND subject_id = '')
+    OR (subject_type <> 'project' AND length(btrim(subject_id)) > 0)
+  ),
+  meter TEXT NOT NULL CHECK (meter IN ('tokens.total', 'cost.catalogEstimated')),
+  currency TEXT NOT NULL CHECK (
+    (meter = 'tokens.total' AND currency = '')
+    OR (meter = 'cost.catalogEstimated' AND currency = 'USD')
+  ),
+  limit_amount NUMERIC(78, 0) NOT NULL CHECK (limit_amount >= 0),
+  period_kind TEXT NOT NULL CHECK (period_kind = 'calendarMonth'),
+  enabled BOOLEAN NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL,
+  updated_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, subject_type, subject_id, meter, currency)
+);
+
+CREATE INDEX idx_ai_usage_limits_project_enabled
+  ON ai_usage_limits (project_id, enabled, subject_type, subject_id, meter, currency);
+
+CREATE TABLE ai_usage_limit_periods (
+  project_id TEXT NOT NULL CHECK (length(btrim(project_id)) > 0),
+  subject_type TEXT NOT NULL CHECK (
+    subject_type IN ('project', 'group', 'user', 'serviceAccount')
+  ),
+  subject_id TEXT NOT NULL CHECK (
+    (subject_type = 'project' AND subject_id = '')
+    OR (subject_type <> 'project' AND length(btrim(subject_id)) > 0)
+  ),
+  meter TEXT NOT NULL CHECK (meter IN ('tokens.total', 'cost.catalogEstimated')),
+  currency TEXT NOT NULL CHECK (
+    (meter = 'tokens.total' AND currency = '')
+    OR (meter = 'cost.catalogEstimated' AND currency = 'USD')
+  ),
+  period_start TIMESTAMPTZ NOT NULL,
+  period_end TIMESTAMPTZ NOT NULL,
+  actual_amount NUMERIC(78, 0) NOT NULL DEFAULT 0 CHECK (actual_amount >= 0),
+  reserved_amount NUMERIC(78, 0) NOT NULL DEFAULT 0 CHECK (reserved_amount >= 0),
+  unknown_amount NUMERIC(78, 0) NOT NULL DEFAULT 0 CHECK (unknown_amount >= 0),
+  accounting_status TEXT NOT NULL DEFAULT 'complete' CHECK (
+    accounting_status IN ('complete', 'unavailable')
+  ),
+  updated_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (
+    project_id, subject_type, subject_id, meter, currency, period_start
+  )
+);
+
+CREATE INDEX idx_ai_usage_limit_periods_subject_period
+  ON ai_usage_limit_periods (
+    project_id, subject_type, subject_id, period_start, period_end, meter, currency
+  );
+
+CREATE TABLE ai_model_call_reservations (
+  project_id TEXT NOT NULL CHECK (length(btrim(project_id)) > 0),
+  execution_id TEXT NOT NULL CHECK (length(btrim(execution_id)) > 0),
+  attempt BIGINT NOT NULL CHECK (attempt >= 1),
+  call_id TEXT NOT NULL CHECK (length(btrim(call_id)) > 0),
+  buckets JSONB NOT NULL CHECK (jsonb_typeof(buckets) = 'array'),
+  request_key TEXT NOT NULL,
+  period_start TIMESTAMPTZ NOT NULL,
+  period_end TIMESTAMPTZ NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('active', 'reconciled', 'unknown')),
+  usage_record_id TEXT,
+  reserved_at TIMESTAMPTZ NOT NULL,
+  updated_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (project_id, execution_id, attempt, call_id),
+  FOREIGN KEY (project_id, execution_id)
+    REFERENCES executions(project_id, id)
+    ON DELETE RESTRICT,
+  FOREIGN KEY (project_id, usage_record_id)
+    REFERENCES ai_model_call_usage(project_id, id)
+    ON DELETE RESTRICT,
+  CHECK (
+    (
+      state = 'reconciled'
+      AND usage_record_id IS NOT NULL
+    )
+    OR (
+      state <> 'reconciled'
+      AND usage_record_id IS NULL
+    )
+  )
+);
+
+CREATE INDEX idx_ai_model_call_reservations_active
+  ON ai_model_call_reservations (project_id, state, period_end, execution_id, attempt, call_id);
+`;
+
+// src/migrations/031-subagent-runs.sql
+var _031_subagent_runs_default = `-- Agent executions may either use a managed service account or inherit their parent's exact
+-- credentialed-user / auth-disabled authority.
+ALTER TABLE executions
+  DROP CONSTRAINT executions_check3,
+  ADD CONSTRAINT executions_agent_authority_check CHECK (
+    (
+      executor_kind = 'request'
+      AND source_kind = 'http'
+      AND executor_id = source_id
+      AND (
+        (
+          authority_kind = 'principal'
+          AND requested_by_user_id IS NOT DISTINCT FROM authority_user_id
+          AND requested_by_service_account_id IS NOT DISTINCT FROM authority_service_account_id
+        )
+        OR (
+          authority_kind = 'disabled'
+          AND requested_by_user_id IS NULL
+          AND requested_by_service_account_id IS NULL
+        )
+      )
+    )
+    OR (
+      executor_kind IN ('action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow')
+      AND authority_kind = 'trustedPrimitive'
+      AND executor_kind = authority_primitive_kind
+    )
+    OR (
+      executor_kind = 'agent'
+      AND source_kind = 'execution'
+      AND (
+        (
+          authority_kind = 'principal'
+          AND authority_service_account_id IS NOT NULL
+          AND authority_session_id IS NULL
+          AND authority_access_token_id IS NULL
+        )
+        OR (
+          authority_kind = 'principal'
+          AND authority_user_id IS NOT NULL
+          AND num_nonnulls(authority_session_id, authority_access_token_id) = 1
+        )
+        OR authority_kind = 'disabled'
+      )
+    )
+    OR (executor_kind = 'kernel' AND authority_kind = 'kernel')
+  );
+
+ALTER TABLE agent_runs
+  ADD COLUMN kind TEXT NOT NULL DEFAULT 'conversation'
+    CHECK (kind IN ('conversation', 'subagent')),
+  ADD COLUMN parent_run_id TEXT,
+  ADD COLUMN spawn_key TEXT,
+  ADD COLUMN spec JSONB,
+  ADD COLUMN result JSONB,
+  ALTER COLUMN thread_id DROP NOT NULL,
+  ALTER COLUMN agent_id DROP NOT NULL,
+  ALTER COLUMN trigger_message_id DROP NOT NULL,
+  ADD CONSTRAINT fk_agent_runs_parent
+    FOREIGN KEY (project_id, parent_run_id)
+    REFERENCES agent_runs (project_id, id)
+    ON DELETE RESTRICT,
+  ADD CONSTRAINT agent_runs_kind_fields CHECK (
+    (
+      kind = 'conversation'
+      AND thread_id IS NOT NULL
+      AND agent_id IS NOT NULL
+      AND trigger_message_id IS NOT NULL
+      AND parent_run_id IS NULL
+      AND spawn_key IS NULL
+      AND spec IS NULL
+      AND result IS NULL
+    )
+    OR
+    (
+      kind = 'subagent'
+      AND thread_id IS NULL
+      AND agent_id IS NULL
+      AND trigger_message_id IS NULL
+      AND parent_run_id IS NOT NULL
+      AND spawn_key IS NOT NULL
+      AND spec IS NOT NULL
+    )
+  ),
+  ADD CONSTRAINT agent_runs_subagent_result CHECK (
+    kind <> 'subagent' OR status <> 'succeeded' OR result IS NOT NULL
+  ),
+  ADD CONSTRAINT uq_agent_runs_parent_spawn_key UNIQUE (project_id, parent_run_id, spawn_key);
+
+CREATE INDEX idx_agent_runs_project_parent_started
+  ON agent_runs (
+    project_id,
+    parent_run_id,
+    status,
+    COALESCE(started_at, created_at) DESC,
+    id DESC
+  );
+`;
+
+// src/migrations/032-conversation-run-spec.sql
+var _032_conversation_run_spec_default = `ALTER TABLE agent_runs
+  DROP CONSTRAINT agent_runs_kind_fields,
+  ADD CONSTRAINT agent_runs_kind_fields CHECK (
+    (
+      kind = 'conversation'
+      AND thread_id IS NOT NULL
+      AND agent_id IS NOT NULL
+      AND trigger_message_id IS NOT NULL
+      AND parent_run_id IS NULL
+      AND spawn_key IS NULL
+      AND result IS NULL
+    )
+    OR
+    (
+      kind = 'subagent'
+      AND thread_id IS NULL
+      AND agent_id IS NULL
+      AND trigger_message_id IS NULL
+      AND parent_run_id IS NOT NULL
+      AND spawn_key IS NOT NULL
+      AND spec IS NOT NULL
+    )
+  );
+`;
+
+// src/migrations/033-retire-agent-definitions.sql
+var _033_retire_agent_definitions_default = `DROP INDEX IF EXISTS idx_agent_threads_project_agent_activity;
+ALTER TABLE workflow_agent_node_runs RENAME COLUMN agent_id TO actor_id;
+DROP INDEX IF EXISTS idx_agent_runs_project_agent_started;
+
+ALTER TABLE agent_threads DROP COLUMN agent_id;
+
+ALTER TABLE agent_runs
+  DROP CONSTRAINT agent_runs_kind_fields,
+  DROP COLUMN agent_id,
+  ADD CONSTRAINT agent_runs_kind_fields CHECK (
+    (
+      kind = 'conversation'
+      AND thread_id IS NOT NULL
+      AND trigger_message_id IS NOT NULL
+      AND parent_run_id IS NULL
+      AND spawn_key IS NULL
+      AND result IS NULL
+    )
+    OR
+    (
+      kind = 'subagent'
+      AND thread_id IS NULL
+      AND trigger_message_id IS NULL
+      AND parent_run_id IS NOT NULL
+      AND spawn_key IS NOT NULL
+      AND spec IS NOT NULL
+    )
+  );
+`;
+
+// src/migrations/034-device-authorizations.sql
+var _034_device_authorizations_default = `CREATE TABLE auth_device_authorizations (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  device_code_hash TEXT NOT NULL,
+  user_code TEXT NOT NULL,
+  client_name TEXT NOT NULL,
+  token_name TEXT NOT NULL,
+  token_expires_at TIMESTAMPTZ NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('pending', 'approved', 'denied', 'consumed')),
+  approved_user_id TEXT,
+  approved_session_id TEXT,
+  created_at TIMESTAMPTZ NOT NULL,
+  expires_at TIMESTAMPTZ NOT NULL,
+  approved_at TIMESTAMPTZ,
+  denied_at TIMESTAMPTZ,
+  consumed_at TIMESTAMPTZ,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, user_code),
+  FOREIGN KEY (project_id, approved_user_id) REFERENCES auth_users (project_id, id),
+  FOREIGN KEY (project_id, approved_session_id) REFERENCES auth_sessions (project_id, id)
+);
+
+CREATE INDEX idx_auth_device_authorizations_pending
+  ON auth_device_authorizations (project_id, status, expires_at DESC);
+`;
+
+// src/migrations.ts
+var POSTGRES_STORAGE_ADAPTER_ID = "SixbPostgresStorage";
+function pgSql(id, sqlText) {
+  return pgStep(id, (context) => context.exec(sqlText), { checksum: checksum(sqlText) });
+}
+function pgStep(id, up, options = {}) {
+  return step(id, up, options);
+}
+function createPostgresStorageMigrators(sql, schemaName) {
+  return [
+    createPostgresMigrator({
+      sql,
+      schemaName,
+      migrations: postgresStorageMigrations
+    })
+  ];
+}
+function createPostgresMigrator(params) {
+  return {
+    adapterId: params.migrations.adapterId,
+    latestVersion: params.migrations.latestVersion,
+    async status() {
+      return describeMigrationHistory({
+        migrations: params.migrations,
+        rows: await readPostgresHistory(params.sql, params.schemaName, params.migrations.adapterId)
+      });
+    },
+    migrate() {
+      return withPostgresMigrationLock(params, async (sql) => {
+        const session = postgresMigrationSession(sql, params.schemaName);
+        return runMigrationSet({
+          context: session.context,
+          migrations: params.migrations,
+          state: session.state
+        });
+      });
+    }
+  };
+}
+async function migratePostgresStorage(sql, schemaName) {
+  await createPostgresMigrator({
+    sql,
+    schemaName,
+    migrations: postgresStorageMigrations
+  }).migrate();
+}
+async function dropSchema(sql, schemaName) {
+  await sql.unsafe(`DROP SCHEMA IF EXISTS ${quoteIdent(schemaName)} CASCADE`);
+}
+function quoteIdent(identifier) {
+  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(identifier)) {
+    throw new Error(`[SixbPg] Invalid identifier: ${identifier}`);
+  }
+  return `"${identifier}"`;
+}
+function postgresMigrationSession(sql, schemaName) {
+  const schema = quoteIdent(schemaName);
+  const migrationsTable = `${schema}.sixb_migrations`;
+  let active = null;
+  const connection = () => active ?? sql;
+  return {
+    context: {
+      async exec(sqlText) {
+        await connection().unsafe(sqlText);
+      }
+    },
+    state: {
+      async ensure() {
+        await sql.unsafe(`
+          CREATE SCHEMA IF NOT EXISTS ${schema};
+
+          CREATE TABLE IF NOT EXISTS ${migrationsTable} (
+            adapter_id TEXT NOT NULL,
+            version INTEGER NOT NULL,
+            id TEXT NOT NULL,
+            checksum TEXT,
+            status TEXT NOT NULL CHECK (status IN ('started', 'applied')),
+            started_at TIMESTAMPTZ NOT NULL,
+            finished_at TIMESTAMPTZ,
+            PRIMARY KEY (adapter_id, version)
+          );
+        `);
+      },
+      async readHistory(adapterId) {
+        const rows = await sql.unsafe(`SELECT * FROM ${migrationsTable} WHERE adapter_id = $1 ORDER BY version`, [adapterId]);
+        return rows.map(rowToMigrationRecord);
+      },
+      async markStarted(adapterId, migration, at) {
+        await connection().unsafe(`
+            INSERT INTO ${migrationsTable} (
+              adapter_id, version, id, checksum, status, started_at, finished_at
+            ) VALUES ($1, $2, $3, $4, 'started', $5, NULL)
+            ON CONFLICT(adapter_id, version) DO UPDATE SET
+              id = excluded.id,
+              checksum = excluded.checksum,
+              status = excluded.status,
+              started_at = excluded.started_at,
+              finished_at = NULL
+          `, [adapterId, migration.version, migration.id, migration.checksum ?? null, at]);
+      },
+      async markApplied(adapterId, migration, at) {
+        await connection().unsafe(`
+            UPDATE ${migrationsTable}
+            SET status = 'applied', finished_at = $1
+            WHERE adapter_id = $2 AND version = $3
+          `, [at, adapterId, migration.version]);
+      },
+      async transaction(run) {
+        const previous = active;
+        active = sql;
+        await sql.unsafe("BEGIN");
+        try {
+          await sql.unsafe(`SET LOCAL search_path TO ${schema}`);
+          const result = await run();
+          await sql.unsafe("COMMIT");
           return result;
         } catch (error) {
           await sql.unsafe("ROLLBACK");
@@ -6447,7 +7023,13 @@ var postgresStorageMigrations = defineMigrations({
     pgSql("025-connector-connections", _025_connector_connections_default),
     pgSql("026-ai-cost-accounting", _026_ai_cost_accounting_default),
     pgSql("027-agent-context-checkpoints", _027_agent_context_checkpoints_default),
-    pgSql("028-object-override-edit-times", _028_object_override_edit_times_default)
+    pgSql("028-object-override-edit-times", _028_object_override_edit_times_default),
+    pgSql("029-model-accounting", _029_model_accounting_default),
+    pgSql("030-ai-usage-limits", _030_ai_usage_limits_default),
+    pgSql("031-subagent-runs", _031_subagent_runs_default),
+    pgSql("032-conversation-run-spec", _032_conversation_run_spec_default),
+    pgSql("033-retire-agent-definitions", _033_retire_agent_definitions_default),
+    pgSql("034-device-authorizations", _034_device_authorizations_default)
   ]
 });
 
@@ -6936,7 +7518,12 @@ class PgMaterializationStateReader {
       return stored ? [stored] : [];
     });
   }
-  async linkScopes(scopes) {
+  async linkScopeRevisions(scopes) {
+    if (scopes.length === 0)
+      return [];
+    return (await this.readEffectiveLinkScopes(scopes)).revisions;
+  }
+  async linkSlotStates(scopes) {
     if (scopes.length === 0)
       return [];
     const requested = scopes.map(({ source, linkId }) => ({
@@ -6945,10 +7532,6 @@ class PgMaterializationStateReader {
       source_id: source.primaryId,
       link_id: linkId
     }));
-    const accumulators = new Map(scopes.map(({ source, linkId }) => {
-      const key = linkScopeSortKey(source, linkId);
-      return [key, startScopeAccumulator(source, linkId)];
-    }));
     const requestedParameter = jsonParameter2(this.sql, requested);
     const [sourceRows, slotOverrideRows] = await Promise.all([
       this.sql`
@@ -6994,17 +7577,40 @@ class PgMaterializationStateReader {
       const stored = storedLinkSlotOverride(row);
       return [linkScopeSortKey(stored.ref.source, stored.ref.linkId), stored];
     }));
-    const effective = new Map;
-    let scopeCursor = null;
-    let linkCursor = null;
-    while (true) {
-      const rows = await this.sql`
-        WITH requested AS (
-          SELECT DISTINCT * FROM jsonb_to_recordset(${requestedParameter})
-            AS requested_values(
-              scope_sort_key TEXT, source_type_id TEXT, source_id TEXT, link_id TEXT
-            )
-        ), selected AS (
+    const { revisions, effective } = await this.readEffectiveLinkScopes(scopes);
+    return scopes.map(({ source, linkId }, index) => {
+      const key = linkScopeSortKey(source, linkId);
+      return {
+        ...revisions[index],
+        sourceAssertion: sources.get(key) ?? null,
+        override: overrides.get(key) ?? null,
+        effective: effective.get(key) ?? null
+      };
+    });
+  }
+  async readEffectiveLinkScopes(scopes) {
+    const requested = scopes.map(({ source, linkId }) => ({
+      scope_sort_key: linkScopeSortKey(source, linkId),
+      source_type_id: source.objectTypeId,
+      source_id: source.primaryId,
+      link_id: linkId
+    }));
+    const requestedParameter = jsonParameter2(this.sql, requested);
+    const accumulators = new Map(scopes.map(({ source, linkId }) => {
+      const key = linkScopeSortKey(source, linkId);
+      return [key, startScopeAccumulator(source, linkId)];
+    }));
+    const effective = new Map;
+    let scopeCursor = null;
+    let linkCursor = null;
+    while (true) {
+      const rows = await this.sql`
+        WITH requested AS (
+          SELECT DISTINCT * FROM jsonb_to_recordset(${requestedParameter})
+            AS requested_values(
+              scope_sort_key TEXT, source_type_id TEXT, source_id TEXT, link_id TEXT
+            )
+        ), selected AS (
           SELECT requested.scope_sort_key, links.*,
             ${this.sql.unsafe(linkSortExpression("links"))} AS link_sort_key
           FROM links
@@ -7032,22 +7638,10 @@ class PgMaterializationStateReader {
       scopeCursor = last.scope_sort_key;
       linkCursor = last.link_sort_key;
     }
-    return scopes.map(({ source, linkId }) => {
-      const key = linkScopeSortKey(source, linkId);
-      return {
-        ...finishScopeAccumulator(accumulators.get(key)),
-        sourceAssertion: sources.get(key) ?? null,
-        override: overrides.get(key) ?? null,
-        effective: effective.get(key) ?? null
-      };
-    });
-  }
-  async linkScope(source, linkId) {
-    const [scope] = await this.linkScopes([{ source, linkId }]);
-    if (!scope) {
-      throw new MaterializationConflictError2("effective-state", "Link scope lookup returned no row.");
-    }
-    return scope;
+    return {
+      revisions: scopes.map(({ source, linkId }) => finishScopeAccumulator(accumulators.get(linkScopeSortKey(source, linkId)))),
+      effective
+    };
   }
   async* incidentLinks(objects, pageRows) {
     if (objects.length === 0)
@@ -8453,9 +9047,9 @@ class PgOntologyMaterializationStorage {
       for (const expected of input.expected.links) {
         this.assertLink(linkRevisions.get(linkRefKey3(expected.ref)), expected);
       }
-      const linkScopes = await reader.linkScopes(input.expected.linkScopes);
+      const linkScopeRevisions = await reader.linkScopeRevisions(input.expected.linkScopes);
       for (const [index, expected] of input.expected.linkScopes.entries()) {
-        if (linkScopes[index]?.fingerprint !== expected.fingerprint) {
+        if (linkScopeRevisions[index]?.fingerprint !== expected.fingerprint) {
           throw new MaterializationConflictError5("effective-state", `Expected link scope changed for ${expected.source.objectTypeId}:${expected.source.primaryId}.${expected.linkId}.`);
         }
       }
@@ -8502,7 +9096,7 @@ class PgOntologyMaterializationStorage {
         yield {
           objects: [],
           links: [],
-          linkScopes: await reader.linkScopes(scopes.slice(offset, offset + input.pageRows)),
+          linkScopes: await reader.linkSlotStates(scopes.slice(offset, offset + input.pageRows)),
           points: []
         };
       }
@@ -10153,90 +10747,429 @@ import {
   aiModelCallCostMatchesUsage,
   buildAiAccountingOverviewFromFragments,
   normalizeAiAccountingQuery,
-  normalizeAiModelCallAccountingQuery,
+  normalizeAiModelCallAccountingQuery as normalizeAiModelCallAccountingQuery2,
   normalizeAiModelCallCostRecord,
   parseAiModelCallCostDetails,
   toAccountingItem
 } from "@sixb/core/internal/ai-cost-storage-provider";
+import { normalizeModelProviderIds as normalizeModelProviderIds2 } from "@sixb/core/models";
 import {
   AiCostStorageError
 } from "@sixb/core/storage";
-class PgAiCostStorage {
+
+// src/ai-cost-groups.ts
+import {
+  aiModelCallGroupFragmentFromRow,
+  buildAiModelCallGroupsFromFragments,
+  normalizeAiModelCallAccountingQuery
+} from "@sixb/core/internal/ai-cost-storage-provider";
+async function listAiModelCallGroups(sql, input) {
+  const query = normalizeAiModelCallAccountingQuery(input);
+  const parameters = [
+    query.projectId,
+    query.from.toISOString(),
+    query.to.toISOString(),
+    query.providerId ?? null,
+    query.modelId ?? null,
+    query.valuationStatus ?? null
+  ];
+  const [count] = await sql.unsafe(COUNT_SQL, parameters);
+  const rows = await sql.unsafe(PAGE_SQL, [
+    ...parameters,
+    query.limit,
+    query.offset
+  ]);
+  const total = Number(count?.total);
+  if (!Number.isSafeInteger(total) || total < 0)
+    throw new RangeError("[Sixb] Invalid model-call group count.");
+  const items = buildAiModelCallGroupsFromFragments(rows.map(aiModelCallGroupFragmentFromRow));
+  return { items, total, hasMore: query.offset + items.length < total };
+}
+var FILTERED_SQL = `
+WITH filtered AS (
+  SELECT COALESCE(root_agent.execution_id, usage.execution_id) AS root_execution_id,
+    usage.execution_id, usage.provider_id, usage.requested_model_id, usage.occurred_at,
+    usage.total_tokens,
+    COALESCE(cost.status, 'unvalued') AS valuation_status,
+    cost.currency AS amount_currency, cost.amount_nanos,
+    root_agent.id AS root_agent_run_id,
+    root_agent.thread_id AS root_thread_id,
+    direct_agent.kind AS direct_kind,
+    direct_agent.id AS direct_run_id,
+    direct_agent.parent_run_id AS parent_run_id,
+    workflow_node.node_id AS workflow_agent_step_id,
+    workflow_agent.node_run_id AS workflow_node_run_id,
+    workflow_node.workflow_id AS workflow_id,
+    workflow_node.workflow_run_id AS workflow_run_id
+  FROM ai_model_call_usage AS usage
+  LEFT JOIN agent_runs AS direct_agent
+    ON direct_agent.project_id = usage.project_id AND direct_agent.execution_id = usage.execution_id
+  LEFT JOIN agent_runs AS root_agent
+    ON root_agent.project_id = usage.project_id
+    AND root_agent.id = COALESCE(direct_agent.parent_run_id, direct_agent.id)
+  LEFT JOIN workflow_agent_node_runs AS workflow_agent
+    ON workflow_agent.project_id = usage.project_id AND workflow_agent.execution_id = usage.execution_id
+  LEFT JOIN workflow_node_runs AS workflow_node
+    ON workflow_node.project_id = workflow_agent.project_id AND workflow_node.id = workflow_agent.node_run_id
+  LEFT JOIN ai_model_call_valuations AS cost
+    ON cost.project_id = usage.project_id AND cost.usage_record_id = usage.id
+  WHERE usage.project_id = $1
+    AND usage.occurred_at >= $2::timestamptz
+    AND usage.occurred_at < $3::timestamptz
+    AND ($4::text IS NULL OR usage.provider_id = $4)
+    AND ($5::text IS NULL OR usage.requested_model_id = $5)
+    AND ($6::text IS NULL OR COALESCE(cost.status, 'unvalued') = $6)
+), roots AS (
+  SELECT root_execution_id, MAX(occurred_at) AS last_call_at
+  FROM filtered GROUP BY root_execution_id
+)
+`;
+var COUNT_SQL = `${FILTERED_SQL} SELECT CAST(COUNT(*) AS TEXT) AS total FROM roots`;
+var PAGE_SQL = `${FILTERED_SQL}, page AS (
+  SELECT root_execution_id FROM roots
+  ORDER BY last_call_at DESC, root_execution_id COLLATE "C" ASC LIMIT $7 OFFSET $8
+)
+SELECT filtered.root_execution_id, execution_id, provider_id, requested_model_id,
+  MIN(occurred_at) AS first_call_at, MAX(occurred_at) AS last_call_at,
+  CAST(COUNT(*) AS TEXT) AS call_count,
+  CAST(COUNT(total_tokens) AS TEXT) AS token_count,
+  CAST(SUM(total_tokens) AS TEXT) AS total_tokens,
+  valuation_status, amount_currency,
+  CAST(SUM(amount_nanos / 1000000000000) AS TEXT) AS amount_high,
+  CAST(SUM((amount_nanos / 1000000) % 1000000) AS TEXT) AS amount_middle,
+  CAST(SUM(amount_nanos % 1000000) AS TEXT) AS amount_low,
+  MAX(root_agent_run_id) AS root_agent_run_id,
+  MAX(root_thread_id) AS root_thread_id,
+  MAX(direct_kind) AS direct_kind,
+  MAX(direct_run_id) AS direct_run_id,
+  MAX(parent_run_id) AS parent_run_id,
+  MAX(workflow_agent_step_id) AS workflow_agent_step_id,
+  MAX(workflow_node_run_id) AS workflow_node_run_id,
+  MAX(workflow_id) AS workflow_id,
+  MAX(workflow_run_id) AS workflow_run_id
+FROM filtered JOIN page ON page.root_execution_id = filtered.root_execution_id
+GROUP BY filtered.root_execution_id, execution_id, provider_id, requested_model_id,
+  valuation_status, amount_currency
+`;
+
+// src/pg-ai-usage-storage.ts
+import { isModelReasoning, normalizeModelProviderIds } from "@sixb/core/models";
+import {
+  AiUsageStorageError,
+  aggregateAiModelCallUsage,
+  assertAiUsageExecutionId,
+  normalizeAiModelCallRecord
+} from "@sixb/core/storage";
+class PgAiUsageStorage {
   sql;
   constructor(sql) {
     this.sql = sql;
   }
-  async recordModelCallCost(input) {
-    const record = normalizeAiModelCallCostRecord(input);
-    await runPgTransaction(this.sql, async (tx) => {
-      const usage = await findUsage(tx, record.projectId, record.usageRecordId);
-      if (!usage)
-        throw missingUsage(record);
-      assertCostMatchesUsage(record, usage);
-      if (await findCost(tx, record.projectId, record.usageRecordId))
-        return;
-      const rated = record.status === "rated" ? record : undefined;
+  async recordModelCall(input) {
+    const record = normalizeAiModelCallRecord(input);
+    return runPgTransaction(this.sql, async (tx) => {
+      const existing = await this.findByIdempotencyKey(tx, record);
+      if (existing)
+        return { record: existing, created: false };
+      await this.assertExecutionExists(tx, record.projectId, record.executionId);
       const inserted = await tx`
-        INSERT INTO ai_model_call_valuations (
-          project_id, usage_record_id, status, provider_id, model_id,
-          currency, amount_nanos, reason, details, rated_at
+        INSERT INTO ai_model_call_usage (
+          project_id,
+          id,
+          execution_id,
+          attempt,
+          call_id,
+          provider_id,
+          provider_ids,
+          requested_model_id,
+          requested_reasoning,
+          response_model_id,
+          response_id,
+          input_tokens,
+          output_tokens,
+          total_tokens,
+          uncached_input_tokens,
+          cache_read_input_tokens,
+          cache_write_input_tokens,
+          text_output_tokens,
+          reasoning_output_tokens,
+          reporting_status,
+          raw_usage,
+          occurred_at,
+          recorded_at
         ) VALUES (
-          ${record.projectId}, ${record.usageRecordId}, ${record.status},
-          ${record.billingIdentity?.providerId ?? null},
-          ${record.billingIdentity?.modelId ?? null}, ${rated?.money.currency ?? null},
-          ${rated?.money.amountNanos ?? null},
-          ${record.status === "unpriceable" ? record.reason : null},
-          ${JSON.stringify(aiModelCallCostDetails(record))}::text::jsonb, ${record.ratedAt}
+          ${record.projectId},
+          ${record.id},
+          ${record.executionId},
+          ${record.attempt},
+          ${record.callId},
+          ${record.providerId},
+          ${record.providerIds === undefined ? null : JSON.stringify(record.providerIds)}::jsonb,
+          ${record.requestedModelId},
+          ${record.requestedReasoning === undefined ? null : JSON.stringify(record.requestedReasoning)}::text::jsonb,
+          ${record.responseModelId ?? null},
+          ${record.responseId},
+          ${record.usage.inputTokens ?? null},
+          ${record.usage.outputTokens ?? null},
+          ${record.usage.totalTokens ?? null},
+          ${record.usage.uncachedInputTokens ?? null},
+          ${record.usage.cacheReadInputTokens ?? null},
+          ${record.usage.cacheWriteInputTokens ?? null},
+          ${record.usage.textOutputTokens ?? null},
+          ${record.usage.reasoningOutputTokens ?? null},
+          ${record.usage.reportingStatus},
+          ${record.rawUsage === undefined ? null : JSON.stringify(record.rawUsage)}::text::jsonb,
+          ${record.occurredAt},
+          ${record.recordedAt}
         )
         ON CONFLICT DO NOTHING
-        RETURNING usage_record_id
+        RETURNING id
       `;
-      if (inserted.length === 0 && !await findCost(tx, record.projectId, record.usageRecordId)) {
-        throw new Error("[SixbPg] AI valuation insert conflicted without a visible row.");
+      if (inserted.length === 0) {
+        const concurrent = await this.findByIdempotencyKey(tx, record);
+        if (concurrent)
+          return { record: concurrent, created: false };
+        throw new AiUsageStorageError("duplicate_id", `[SixbPg] AI usage record '${record.id}' already exists for project '${record.projectId}'.`);
+      }
+      for (const groupId of record.requesterGroupIds) {
+        await tx`
+          INSERT INTO ai_model_call_usage_groups (
+            project_id, usage_record_id, group_id, occurred_at
+          ) VALUES (
+            ${record.projectId}, ${record.id}, ${groupId}, ${record.occurredAt}
+          )
+        `;
       }
+      return { record: await this.requireById(tx, record.projectId, record.id), created: true };
+    });
+  }
+  async summarizeExecution(input) {
+    const [summary] = await this.summarizeExecutions({
+      projectId: input.projectId,
+      executionIds: [input.executionId]
     });
+    return summary;
+  }
+  async getLatestForExecution(input) {
+    assertNonBlankProjectId(input.projectId);
+    assertAiUsageExecutionId(input.executionId);
+    const [row] = await this.sql`
+      SELECT * FROM ai_model_call_usage
+      WHERE project_id = ${input.projectId} AND execution_id = ${input.executionId}
+      ORDER BY occurred_at DESC, id DESC
+      LIMIT 1
+    `;
+    return row ? this.rowToRecord(this.sql, row) : null;
   }
   async summarizeExecutions(input) {
-    assertNonBlank(input.projectId, "cost summary projectId");
-    for (const id of input.executionIds)
-      assertNonBlank(id, "cost summary executionId");
+    assertNonBlankProjectId(input.projectId);
+    for (const executionId of input.executionIds)
+      assertAiUsageExecutionId(executionId);
     if (input.executionIds.length === 0)
       return [];
-    const ids = [...new Set(input.executionIds)];
-    const rows = await this.sql`
+    const rows = await this.executionRows(this.sql, input);
+    return aggregateExecutionRows(input.executionIds, rows);
+  }
+  async findByIdempotencyKey(sql, record) {
+    const rows = await sql`
+      SELECT * FROM ai_model_call_usage
+      WHERE project_id = ${record.projectId}
+        AND execution_id = ${record.executionId}
+        AND attempt = ${record.attempt}
+        AND call_id = ${record.callId}
+        AND response_id = ${record.responseId}
+    `;
+    return rows[0] ? this.rowToRecord(sql, rows[0]) : null;
+  }
+  async requireById(sql, projectId, id) {
+    const [row] = await sql`
+      SELECT * FROM ai_model_call_usage WHERE project_id = ${projectId} AND id = ${id}
+    `;
+    if (!row)
+      throw new Error(`[SixbPg] AI usage record '${id}' disappeared after insert.`);
+    return this.rowToRecord(sql, row);
+  }
+  async rowToRecord(sql, row) {
+    const groupRows = await sql`
+      SELECT group_id FROM ai_model_call_usage_groups
+      WHERE project_id = ${row.project_id} AND usage_record_id = ${row.id}
+      ORDER BY group_id
+    `;
+    return {
+      id: row.id,
+      projectId: row.project_id,
+      executionId: row.execution_id,
+      attempt: Number(row.attempt),
+      callId: row.call_id,
+      requesterGroupIds: groupRows.map((group) => group.group_id),
+      providerId: row.provider_id,
+      ...row.provider_ids === null ? {} : {
+        providerIds: normalizeModelProviderIds(typeof row.provider_ids === "string" ? JSON.parse(row.provider_ids) : row.provider_ids)
+      },
+      requestedModelId: row.requested_model_id,
+      ...row.requested_reasoning === null ? {} : { requestedReasoning: requestedReasoningFromRow(row.requested_reasoning) },
+      ...row.response_model_id === null ? {} : { responseModelId: row.response_model_id },
+      responseId: row.response_id,
+      usage: {
+        ...usageFromRow(row),
+        ...row.total_tokens === null ? {} : { totalTokens: Number(row.total_tokens) },
+        reportingStatus: row.reporting_status
+      },
+      ...row.raw_usage === null ? {} : { rawUsage: rawUsageFromRow(row.raw_usage) },
+      occurredAt: new Date(row.occurred_at),
+      recordedAt: new Date(row.recorded_at)
+    };
+  }
+  executionRows(sql, input) {
+    const executionIds = [...new Set(input.executionIds)];
+    return sql`
       WITH requested(execution_id) AS (
-        SELECT DISTINCT * FROM unnest(${this.sql.array(ids)}::text[])
+        SELECT * FROM unnest(${sql.array(executionIds)}::text[])
       )
-      SELECT usage.execution_id,
-        cost.status,
-        cost.currency,
-        cost.amount_nanos
-      FROM requested
+      SELECT usage.* FROM requested
       JOIN ai_model_call_usage AS usage
-        ON usage.project_id = ${input.projectId} AND usage.execution_id = requested.execution_id
-      LEFT JOIN ai_model_call_valuations AS cost
-        ON cost.project_id = usage.project_id AND cost.usage_record_id = usage.id
+        ON usage.project_id = ${input.projectId}
+        AND usage.execution_id = requested.execution_id
     `;
-    return aggregateSummaryRows(input.executionIds, rows);
   }
-  async queryProjectOverview(input) {
-    const query = normalizeAiAccountingQuery(input);
-    const providerId = query.providerId ?? null;
-    const modelId = query.modelId ?? null;
-    const rows = await this.sql`
-      WITH filtered AS (
-        SELECT usage.provider_id,
-          usage.requested_model_id,
-          usage.occurred_at,
-          usage.input_tokens,
-          usage.output_tokens,
-          usage.uncached_input_tokens,
-          usage.cache_read_input_tokens,
-          usage.cache_write_input_tokens,
-          usage.text_output_tokens,
-          usage.reasoning_output_tokens,
+  async assertExecutionExists(sql, projectId, executionId) {
+    const [execution] = await sql`
+      SELECT EXISTS (
+        SELECT 1 FROM executions WHERE project_id = ${projectId} AND id = ${executionId}
+      ) AS exists
+    `;
+    if (execution?.exists)
+      return;
+    throw new AiUsageStorageError("missing_execution", `[SixbPg] AI usage execution '${executionId}' does not exist in project '${projectId}'.`);
+  }
+}
+function aggregateExecutionRows(executionIds, rows) {
+  const usageByExecutionId = new Map;
+  for (const executionId of executionIds)
+    usageByExecutionId.set(executionId, []);
+  for (const row of rows) {
+    usageByExecutionId.get(row.execution_id)?.push(usageFromRow(row));
+  }
+  return executionIds.map((executionId) => {
+    const usages = usageByExecutionId.get(executionId) ?? [];
+    return {
+      modelCallCount: usages.length,
+      usage: aggregateAiModelCallUsage(usages)
+    };
+  });
+}
+function usageFromRow(row) {
+  return {
+    ...row.input_tokens === null ? {} : { inputTokens: Number(row.input_tokens) },
+    ...row.output_tokens === null ? {} : { outputTokens: Number(row.output_tokens) },
+    ...row.uncached_input_tokens === null ? {} : { uncachedInputTokens: Number(row.uncached_input_tokens) },
+    ...row.cache_read_input_tokens === null ? {} : { cacheReadInputTokens: Number(row.cache_read_input_tokens) },
+    ...row.cache_write_input_tokens === null ? {} : { cacheWriteInputTokens: Number(row.cache_write_input_tokens) },
+    ...row.text_output_tokens === null ? {} : { textOutputTokens: Number(row.text_output_tokens) },
+    ...row.reasoning_output_tokens === null ? {} : { reasoningOutputTokens: Number(row.reasoning_output_tokens) }
+  };
+}
+function rawUsageFromRow(value) {
+  return typeof value === "string" ? JSON.parse(value) : value;
+}
+function requestedReasoningFromRow(value) {
+  const parsed = typeof value === "string" && (value.startsWith('"') || value.startsWith("{")) ? JSON.parse(value) : value;
+  if (!isModelReasoning(parsed)) {
+    throw new Error("[SixbPg] Stored AI usage requested reasoning is invalid.");
+  }
+  return parsed;
+}
+function assertNonBlankProjectId(projectId) {
+  if (typeof projectId !== "string" || projectId.trim().length === 0) {
+    throw new TypeError("[Sixb] AI usage projectId must be nonblank.");
+  }
+}
+
+// src/pg-ai-cost-storage.ts
+class PgAiCostStorage {
+  sql;
+  constructor(sql) {
+    this.sql = sql;
+  }
+  async listModelCallGroups(input) {
+    return listAiModelCallGroups(this.sql, input);
+  }
+  async recordModelCallCost(input) {
+    const record = normalizeAiModelCallCostRecord(input);
+    await runPgTransaction(this.sql, async (tx) => {
+      const usage = await findUsage(tx, record.projectId, record.usageRecordId);
+      if (!usage)
+        throw missingUsage(record);
+      assertCostMatchesUsage(record, usage);
+      if (await findCost(tx, record.projectId, record.usageRecordId))
+        return;
+      const rated = record.status === "rated" ? record : undefined;
+      const inserted = await tx`
+        INSERT INTO ai_model_call_valuations (
+          project_id, usage_record_id, status, provider_id, model_id,
+          currency, amount_nanos, reason, details, rated_at
+        ) VALUES (
+          ${record.projectId}, ${record.usageRecordId}, ${record.status},
+          ${record.billingIdentity?.providerId ?? null},
+          ${record.billingIdentity?.modelId ?? null}, ${rated?.money.currency ?? null},
+          ${rated?.money.amountNanos ?? null},
+          ${record.status === "unpriceable" ? record.reason : null},
+          ${JSON.stringify(aiModelCallCostDetails(record))}::text::jsonb, ${record.ratedAt}
+        )
+        ON CONFLICT DO NOTHING
+        RETURNING usage_record_id
+      `;
+      if (inserted.length === 0 && !await findCost(tx, record.projectId, record.usageRecordId)) {
+        throw new Error("[SixbPg] AI valuation insert conflicted without a visible row.");
+      }
+    });
+  }
+  async summarizeExecutions(input) {
+    assertNonBlank(input.projectId, "cost summary projectId");
+    for (const id of input.executionIds)
+      assertNonBlank(id, "cost summary executionId");
+    if (input.executionIds.length === 0)
+      return [];
+    const ids = [...new Set(input.executionIds)];
+    const rows = await this.sql`
+      WITH requested(execution_id) AS (
+        SELECT DISTINCT * FROM unnest(${this.sql.array(ids)}::text[])
+      )
+      SELECT usage.execution_id,
+        cost.status,
+        cost.currency,
+        cost.amount_nanos
+      FROM requested
+      JOIN ai_model_call_usage AS usage
+        ON usage.project_id = ${input.projectId} AND usage.execution_id = requested.execution_id
+      LEFT JOIN ai_model_call_valuations AS cost
+        ON cost.project_id = usage.project_id AND cost.usage_record_id = usage.id
+    `;
+    return aggregateSummaryRows(input.executionIds, rows);
+  }
+  async queryProjectOverview(input) {
+    const query = normalizeAiAccountingQuery(input);
+    const providerId = query.providerId ?? null;
+    const modelId = query.modelId ?? null;
+    const rows = await this.sql`
+      WITH filtered AS (
+        SELECT usage.provider_id,
+          usage.requested_model_id,
+          usage.occurred_at,
+          usage.input_tokens,
+          usage.output_tokens,
+          usage.uncached_input_tokens,
+          usage.cache_read_input_tokens,
+          usage.cache_write_input_tokens,
+          usage.text_output_tokens,
+          usage.reasoning_output_tokens,
           usage.reporting_status,
-          COALESCE(direct_agent.agent_id, workflow_agent.agent_id) AS attribution_agent_id,
+          CASE
+            WHEN direct_agent.kind = 'conversation' THEN 'agent'
+            WHEN workflow_agent.node_run_id IS NOT NULL THEN 'workflowAgent'
+            ELSE NULL
+          END AS attribution_agent_kind,
+          workflow_node.node_id AS attribution_agent_step_id,
           workflow_node.workflow_id AS attribution_workflow_id,
           cost.status AS cost_status,
           cost.currency AS cost_currency,
@@ -10271,11 +11204,12 @@ class PgAiCostStorage {
         SELECT 'totals'::text AS dimension,
           NULL::text AS key_1,
           NULL::text AS key_2,
+          NULL::text AS key_3,
           NULL::timestamptz AS bucket_start,
           classified.*
         FROM classified
         UNION ALL
-        SELECT 'series', NULL, NULL,
+        SELECT 'series', NULL, NULL, NULL,
           CASE ${input.bucket}::text
             WHEN 'hour' THEN
               date_trunc('hour', occurred_at AT TIME ZONE 'UTC') AT TIME ZONE 'UTC'
@@ -10286,17 +11220,18 @@ class PgAiCostStorage {
           classified.*
         FROM classified
         UNION ALL
-        SELECT 'model', provider_id, requested_model_id, NULL, classified.* FROM classified
+        SELECT 'model', provider_id, requested_model_id, NULL, NULL, classified.* FROM classified
         UNION ALL
-        SELECT 'agent', attribution_agent_id, NULL, NULL, classified.*
-        FROM classified WHERE attribution_agent_id IS NOT NULL
+        SELECT 'agent', attribution_agent_kind, attribution_workflow_id, attribution_agent_step_id, NULL, classified.*
+        FROM classified WHERE attribution_agent_kind IS NOT NULL
         UNION ALL
-        SELECT 'workflow', attribution_workflow_id, NULL, NULL, classified.*
+        SELECT 'workflow', attribution_workflow_id, NULL, NULL, NULL, classified.*
         FROM classified WHERE attribution_workflow_id IS NOT NULL
       )
       SELECT dimension,
         key_1,
         key_2,
+        key_3,
         bucket_start,
         amount_currency,
         COUNT(*)::text AS model_call_count,
@@ -10323,12 +11258,12 @@ class PgAiCostStorage {
           AS unvalued_call_count,
         SUM(amount_nanos)::text AS amount_nanos
       FROM expanded
-      GROUP BY dimension, key_1, key_2, bucket_start, amount_currency
+      GROUP BY dimension, key_1, key_2, key_3, bucket_start, amount_currency
     `;
     return buildAiAccountingOverviewFromFragments(input, rows.map(aggregateFragmentFromRow));
   }
   async listModelCalls(input) {
-    const query = normalizeAiModelCallAccountingQuery(input);
+    const query = normalizeAiModelCallAccountingQuery2(input);
     const providerId = query.providerId ?? null;
     const modelId = query.modelId ?? null;
     const executionId = query.executionId ?? null;
@@ -10354,13 +11289,15 @@ class PgAiCostStorage {
     const rows = await this.sql`
       SELECT usage.*,
         CASE
-          WHEN direct_agent.id IS NOT NULL THEN 'agent'
+          WHEN direct_agent.kind = 'conversation' THEN 'agent'
+          WHEN direct_agent.kind = 'subagent' THEN 'subagent'
           WHEN workflow_agent.node_run_id IS NOT NULL THEN 'workflowAgent'
           ELSE NULL
         END AS attribution_kind,
-        COALESCE(direct_agent.agent_id, workflow_agent.agent_id) AS attribution_agent_id,
+        workflow_node.node_id AS attribution_agent_step_id,
         direct_agent.id AS attribution_agent_run_id,
         direct_agent.thread_id AS attribution_thread_id,
+        direct_agent.parent_run_id AS attribution_parent_run_id,
         workflow_agent.node_run_id AS attribution_node_run_id,
         workflow_node.workflow_id AS attribution_workflow_id,
         workflow_node.workflow_run_id AS attribution_workflow_run_id,
@@ -10426,10 +11363,13 @@ async function findUsage(sql, projectId, id) {
   const [row] = await sql`
     SELECT * FROM ai_model_call_usage WHERE project_id = ${projectId} AND id = ${id}
   `;
-  return row ? usageFromRow(row, []) : null;
+  return row ? usageFromRow2(row, []) : null;
 }
 function aggregateFragmentFromRow(row) {
-  const dimensionKeys = row.dimension === "model" ? { providerId: required2(row.key_1), modelId: required2(row.key_2) } : row.dimension === "agent" ? { agentId: required2(row.key_1) } : row.dimension === "workflow" ? { workflowId: required2(row.key_1) } : row.dimension === "series" ? { start: new Date(required2(row.bucket_start)) } : {};
+  const dimensionKeys = row.dimension === "model" ? { providerId: required2(row.key_1), modelId: required2(row.key_2) } : row.dimension === "agent" ? {
+    agentKind: required2(row.key_1),
+    ...row.key_1 === "workflowAgent" ? { workflowId: required2(row.key_2), agentStepId: required2(row.key_3) } : {}
+  } : row.dimension === "workflow" ? { workflowId: required2(row.key_1) } : row.dimension === "series" ? { start: new Date(required2(row.bucket_start)) } : {};
   return {
     dimension: row.dimension,
     ...dimensionKeys,
@@ -10461,16 +11401,19 @@ function meterFragment(presentCallCount, total) {
   return { presentCallCount, total };
 }
 function accountingItemFromRow(row) {
-  const usage = usageFromRow(row, parseStringArray(row.requester_group_ids));
+  const usage = usageFromRow2(row, parseStringArray(row.requester_group_ids));
   const cost = row.cost_status === null ? undefined : costFromJoinedRow(row);
   const attribution = row.attribution_kind === null ? undefined : row.attribution_kind === "agent" ? {
     kind: "agent",
-    agentId: required2(row.attribution_agent_id),
     agentRunId: required2(row.attribution_agent_run_id),
     threadId: required2(row.attribution_thread_id)
+  } : row.attribution_kind === "subagent" ? {
+    kind: "subagent",
+    subagentRunId: required2(row.attribution_agent_run_id),
+    parentRunId: required2(row.attribution_parent_run_id)
   } : {
     kind: "workflowAgent",
-    agentId: required2(row.attribution_agent_id),
+    agentStepId: required2(row.attribution_agent_step_id),
     nodeRunId: required2(row.attribution_node_run_id),
     workflowId: required2(row.attribution_workflow_id),
     workflowRunId: required2(row.attribution_workflow_run_id)
@@ -10481,7 +11424,7 @@ function accountingItemFromRow(row) {
     ...cost ? { cost } : {}
   };
 }
-function usageFromRow(row, requesterGroupIds) {
+function usageFromRow2(row, requesterGroupIds) {
   const number = (value) => value === null ? undefined : Number(value);
   return {
     id: row.id,
@@ -10491,7 +11434,11 @@ function usageFromRow(row, requesterGroupIds) {
     callId: row.call_id,
     requesterGroupIds,
     providerId: row.provider_id,
+    ...row.provider_ids === null ? {} : {
+      providerIds: normalizeModelProviderIds2(typeof row.provider_ids === "string" ? JSON.parse(row.provider_ids) : row.provider_ids)
+    },
     requestedModelId: row.requested_model_id,
+    ...row.requested_reasoning === null ? {} : { requestedReasoning: requestedReasoningFromRow(row.requested_reasoning) },
     ...row.response_model_id === null ? {} : { responseModelId: row.response_model_id },
     responseId: row.response_id,
     usage: {
@@ -10540,14 +11487,12 @@ function costFromJoinedRow(row) {
 }
 function costRecord(input) {
   const details = parseAiModelCallCostDetails(input.details);
+  const priceSource = details.priceSource === undefined ? undefined : { ...details.priceSource, observedAt: new Date(details.priceSource.observedAt) };
   const base = {
+    ...details.estimate === undefined ? {} : { estimate: details.estimate },
     projectId: input.projectId,
     usageRecordId: input.usageId,
     pricingContext: details.pricingContext,
-    priceSource: {
-      ...details.priceSource,
-      observedAt: new Date(details.priceSource.observedAt)
-    },
     ratedAt: new Date(input.ratedAt)
   };
   if (input.status === "rated") {
@@ -10555,6 +11500,7 @@ function costRecord(input) {
       ...base,
       status: "rated",
       billingIdentity: { providerId: required2(input.providerId), modelId: required2(input.modelId) },
+      priceSource: required2(priceSource),
       money: { currency: required2(input.currency), amountNanos: required2(input.amountNanos) },
       components: required2(details.components)
     });
@@ -10563,6 +11509,7 @@ function costRecord(input) {
     ...base,
     status: "unpriceable",
     ...input.providerId && input.modelId ? { billingIdentity: { providerId: input.providerId, modelId: input.modelId } } : {},
+    ...priceSource === undefined ? {} : { priceSource },
     reason: required2(input.reason),
     ...details.missingMeters ? { missingMeters: details.missingMeters } : {}
   });
@@ -10643,222 +11590,611 @@ function required2(value) {
   return value;
 }
 
-// src/pg-ai-usage-storage.ts
+// src/pg-ai-limit-storage.ts
 import {
-  AiUsageStorageError,
-  aggregateAiModelCallUsage,
-  assertAiUsageExecutionId,
-  normalizeAiModelCallRecord
-} from "@sixb/core/storage";
-class PgAiUsageStorage {
+  AiLimitOperationLock,
+  aiLimitAmountKey,
+  aiLimitQuantityFromAmount,
+  aiLimitReservationBuckets,
+  aiLimitReservationRequestKey,
+  aiLimitReservationRequestMatches,
+  aiLimitSubjectFromParts,
+  aiLimitSubjectKey,
+  aiLimitSubjectParts,
+  aiLimitSubjectsFromAccountingEntry,
+  assertAiLimitAccountingMatchesReservation,
+  assertNonBlank as assertNonBlank2,
+  cloneValidDate,
+  normalizeAiLimitAmount,
+  normalizeAiLimitQuantities,
+  normalizeAiModelCallReservationIdentity,
+  normalizeCreateAiLimitPolicy,
+  normalizeReserveAiModelCall,
+  normalizeUpdateAiLimitPolicy,
+  resolveAiLimitActual
+} from "@sixb/core/internal/ai-limit-storage-provider";
+import { AiLimitStorageError, aiLimitCalendarMonth } from "@sixb/core/storage";
+class PgAiLimitStorage {
   sql;
+  operations = new AiLimitOperationLock;
   constructor(sql) {
     this.sql = sql;
   }
-  async recordModelCall(input) {
-    const record = normalizeAiModelCallRecord(input);
-    return runPgTransaction(this.sql, async (tx) => {
-      const existing = await this.findByIdempotencyKey(tx, record);
-      if (existing)
-        return { record: existing, created: false };
-      await this.assertExecutionExists(tx, record.projectId, record.executionId);
+  settleOperations() {
+    return this.operations.settle();
+  }
+  async createPolicy(input) {
+    const policy = normalizeCreateAiLimitPolicy(input);
+    return this.withProjectLock(policy.projectId, async (tx) => {
+      const subject = aiLimitSubjectParts(policy.subject);
+      const limit = normalizeAiLimitAmount(policy.limit);
       const inserted = await tx`
-        INSERT INTO ai_model_call_usage (
-          project_id,
-          id,
-          execution_id,
-          attempt,
-          call_id,
-          provider_id,
-          requested_model_id,
-          response_model_id,
-          response_id,
-          input_tokens,
-          output_tokens,
-          total_tokens,
-          uncached_input_tokens,
-          cache_read_input_tokens,
-          cache_write_input_tokens,
-          text_output_tokens,
-          reasoning_output_tokens,
-          reporting_status,
-          raw_usage,
-          occurred_at,
-          recorded_at
+        INSERT INTO ai_usage_limits (
+          project_id, id, subject_type, subject_id, meter, currency, limit_amount,
+          period_kind, enabled, created_at, updated_at
         ) VALUES (
-          ${record.projectId},
-          ${record.id},
-          ${record.executionId},
-          ${record.attempt},
-          ${record.callId},
-          ${record.providerId},
-          ${record.requestedModelId},
-          ${record.responseModelId ?? null},
-          ${record.responseId},
-          ${record.usage.inputTokens ?? null},
-          ${record.usage.outputTokens ?? null},
-          ${record.usage.totalTokens ?? null},
-          ${record.usage.uncachedInputTokens ?? null},
-          ${record.usage.cacheReadInputTokens ?? null},
-          ${record.usage.cacheWriteInputTokens ?? null},
-          ${record.usage.textOutputTokens ?? null},
-          ${record.usage.reasoningOutputTokens ?? null},
-          ${record.usage.reportingStatus},
-          ${record.rawUsage === undefined ? null : JSON.stringify(record.rawUsage)}::text::jsonb,
-          ${record.occurredAt},
-          ${record.recordedAt}
+          ${policy.projectId}, ${policy.id}, ${subject.type}, ${subject.id}, ${limit.meter},
+          ${limit.currency}, ${limit.amount.toString()}, ${policy.period}, ${policy.enabled},
+          ${policy.createdAt}, ${policy.updatedAt}
         )
         ON CONFLICT DO NOTHING
         RETURNING id
       `;
-      if (inserted.length === 0) {
-        const concurrent = await this.findByIdempotencyKey(tx, record);
-        if (concurrent)
-          return { record: concurrent, created: false };
-        throw new AiUsageStorageError("duplicate_id", `[SixbPg] AI usage record '${record.id}' already exists for project '${record.projectId}'.`);
+      if (inserted.length === 0)
+        throw duplicatePolicy(policy);
+      return this.requirePolicy(tx, policy.projectId, policy.id);
+    });
+  }
+  async updatePolicy(input) {
+    const update = normalizeUpdateAiLimitPolicy(input);
+    return this.withProjectLock(update.projectId, async (tx) => {
+      const existing = await this.requirePolicy(tx, update.projectId, update.id);
+      if (update.limit !== undefined)
+        assertSameDimension(existing.limit, update.limit);
+      const limit = normalizeAiLimitAmount(update.limit ?? existing.limit);
+      await tx`
+        UPDATE ai_usage_limits
+        SET limit_amount = ${limit.amount.toString()},
+            enabled = ${update.enabled ?? existing.enabled},
+            updated_at = ${update.updatedAt}
+        WHERE project_id = ${update.projectId} AND id = ${update.id}
+      `;
+      return this.requirePolicy(tx, update.projectId, update.id);
+    });
+  }
+  async deletePolicy(input) {
+    validatePolicyIdentity(input);
+    return this.withProjectLock(input.projectId, async (tx) => {
+      const deleted = await tx`
+        DELETE FROM ai_usage_limits
+        WHERE project_id = ${input.projectId} AND id = ${input.id}
+        RETURNING id
+      `;
+      return deleted.length > 0;
+    });
+  }
+  async getPolicy(input) {
+    validatePolicyIdentity(input);
+    const [row] = await this.sql`
+      SELECT * FROM ai_usage_limits
+      WHERE project_id = ${input.projectId} AND id = ${input.id}
+    `;
+    return row ? policyFromRow(row) : null;
+  }
+  async listPolicies(input) {
+    assertNonBlank2(input.projectId, "projectId");
+    return (await this.policyRows(this.sql, input.projectId, input.includeDisabled ?? false)).map(policyFromRow);
+  }
+  async listPolicyStatuses(input) {
+    assertNonBlank2(input.projectId, "projectId");
+    const period = aiLimitCalendarMonth(input.at ?? new Date);
+    const existingGroups = input.existingGroupIds === undefined ? undefined : new Set(input.existingGroupIds);
+    return this.withProjectLock(input.projectId, async (tx) => {
+      const rows = await this.policyRows(tx, input.projectId, input.includeDisabled ?? false);
+      return Promise.all(rows.map((row) => this.statusForPolicy(tx, policyFromRow(row), period, existingGroups)));
+    });
+  }
+  async reserveModelCall(input) {
+    const request = normalizeReserveAiModelCall(input);
+    return this.withProjectLock(request.identity.projectId, async (tx) => {
+      const existing = await this.findReservation(tx, request.identity);
+      if (existing) {
+        if (!aiLimitReservationRequestMatches(existing, request)) {
+          throw new AiLimitStorageError("reservation_conflict", `[SixbPg] AI model-call reservation '${input.callId}' was replayed with different subjects, estimates, or period.`);
+        }
+        if (existing.state !== "active") {
+          return { status: "terminal", reservation: existing, created: false };
+        }
+        return { status: "reserved", reservation: existing, created: false };
       }
-      for (const groupId of record.requesterGroupIds) {
-        await tx`
-          INSERT INTO ai_model_call_usage_groups (
-            project_id, usage_record_id, group_id, occurred_at
-          ) VALUES (
-            ${record.projectId}, ${record.id}, ${groupId}, ${record.occurredAt}
-          )
+      await this.assertExecutionExists(tx, request.identity.projectId, request.identity.executionId);
+      const subjectKeys = new Set(request.subjects.map(aiLimitSubjectKey));
+      const estimates = new Map(request.estimates.map((quantity) => {
+        const amount = normalizeAiLimitAmount(quantity);
+        return [aiLimitAmountKey(amount), amount];
+      }));
+      const enabledPolicies = (await this.policyRows(tx, request.identity.projectId, false)).map(policyFromRow);
+      const exhaustedPolicies = [];
+      const unavailablePolicies = [];
+      const unavailableReasons = new Set;
+      for (const policy of enabledPolicies) {
+        if (!subjectKeys.has(aiLimitSubjectKey(policy.subject)))
+          continue;
+        const limit = normalizeAiLimitAmount(policy.limit);
+        const estimate = estimates.get(aiLimitAmountKey(limit));
+        const status = await this.statusForPolicy(tx, policy, request.period);
+        if (!estimate || status.accountingStatus === "unavailable") {
+          unavailablePolicies.push(status);
+          if (!estimate)
+            unavailableReasons.add("missingEstimate");
+          if (status.accountingStatus === "unavailable") {
+            unavailableReasons.add("incompleteAccounting");
+          }
+          continue;
+        }
+        const consumed = normalizeAiLimitAmount(status.consumption.actual).amount + normalizeAiLimitAmount(status.consumption.reserved).amount + normalizeAiLimitAmount(status.consumption.unknown).amount;
+        if (consumed + estimate.amount > limit.amount)
+          exhaustedPolicies.push(status);
+      }
+      if (unavailablePolicies.length > 0) {
+        unavailablePolicies.sort((left, right) => left.policy.id.localeCompare(right.policy.id));
+        return {
+          status: "unavailable",
+          unavailablePolicies,
+          reasons: [...unavailableReasons].sort()
+        };
+      }
+      if (exhaustedPolicies.length > 0) {
+        exhaustedPolicies.sort((left, right) => left.policy.id.localeCompare(right.policy.id));
+        return {
+          status: "denied",
+          exhaustedPolicies,
+          resetAt: new Date(Math.min(...exhaustedPolicies.map((status) => status.period.resetAt.getTime())))
+        };
+      }
+      const buckets = aiLimitReservationBuckets(enabledPolicies, request.subjects, request.estimates);
+      if (buckets.length === 0)
+        return { status: "notRequired" };
+      for (const bucket of buckets) {
+        const amount = normalizeAiLimitAmount(bucket.estimate);
+        await this.changeCounters(tx, request.identity.projectId, bucket.subject, amount, request.period, { reserved: amount.amount }, request.reservedAt);
+      }
+      const reservation = {
+        ...request.identity,
+        buckets,
+        requestKey: aiLimitReservationRequestKey(request),
+        period: request.period,
+        state: "active",
+        reservedAt: request.reservedAt,
+        updatedAt: new Date(request.reservedAt)
+      };
+      await this.insertReservation(tx, reservation);
+      return { status: "reserved", reservation: structuredClone(reservation), created: true };
+    });
+  }
+  async recordModelCallActuals(input) {
+    assertNonBlank2(input.projectId, "projectId");
+    assertNonBlank2(input.usageRecordId, "usageRecordId");
+    const recordedAt = cloneValidDate(input.recordedAt ?? new Date, "recordedAt");
+    await this.withProjectLock(input.projectId, async (tx) => {
+      const entry = await this.requireAccountingEntry(tx, input.projectId, input.usageRecordId);
+      const period = aiLimitCalendarMonth(entry.occurredAt);
+      for (const subjectValue of aiLimitSubjectsFromAccountingEntry(entry)) {
+        const subject = aiLimitSubjectParts(subjectValue);
+        const rows = await tx`
+          SELECT meter, currency, actual_amount, accounting_status
+          FROM ai_usage_limit_periods
+          WHERE project_id = ${input.projectId}
+            AND subject_type = ${subject.type}
+            AND subject_id = ${subject.id}
+            AND period_start = ${period.start}
+          FOR UPDATE
         `;
+        for (const row of rows) {
+          const actual = resolveAiLimitActual([entry], row);
+          await tx`
+            UPDATE ai_usage_limit_periods
+            SET actual_amount = ${(BigInt(row.actual_amount) + actual.amount).toString()},
+                accounting_status = ${row.accounting_status === "unavailable" || actual.accountingStatus === "unavailable" ? "unavailable" : "complete"},
+                updated_at = ${recordedAt}
+            WHERE project_id = ${input.projectId}
+              AND subject_type = ${subject.type}
+              AND subject_id = ${subject.id}
+              AND meter = ${row.meter}
+              AND currency = ${row.currency}
+              AND period_start = ${period.start}
+          `;
+        }
       }
-      return { record: await this.requireById(tx, record.projectId, record.id), created: true };
     });
   }
-  async summarizeExecution(input) {
-    const [summary] = await this.summarizeExecutions({
-      projectId: input.projectId,
-      executionIds: [input.executionId]
+  async reconcileModelCall(input) {
+    const identity = normalizeAiModelCallReservationIdentity(input);
+    assertNonBlank2(input.usageRecordId, "usageRecordId");
+    const reconciledAt = cloneValidDate(input.reconciledAt ?? new Date, "reconciledAt");
+    return this.withProjectLock(identity.projectId, async (tx) => {
+      const reservation = await this.findReservation(tx, identity);
+      if (!reservation)
+        throw missingReservation(identity);
+      if (reservation.state === "reconciled") {
+        if (reservation.usageRecordId === input.usageRecordId) {
+          return reservation;
+        }
+        throw reconciliationConflict(identity.callId);
+      }
+      const accounting = await this.requireAccountingEntry(tx, identity.projectId, input.usageRecordId);
+      assertAiLimitAccountingMatchesReservation(reservation, accounting);
+      await this.reconcileEstimateCounters(tx, reservation, accounting, reconciledAt);
+      const reconciled = {
+        ...reservation,
+        state: "reconciled",
+        usageRecordId: input.usageRecordId,
+        updatedAt: reconciledAt
+      };
+      await this.updateReservation(tx, reconciled);
+      return structuredClone(reconciled);
     });
-    return summary;
   }
-  async getLatestForExecution(input) {
-    assertNonBlankProjectId(input.projectId);
-    assertAiUsageExecutionId(input.executionId);
-    const [row] = await this.sql`
-      SELECT * FROM ai_model_call_usage
-      WHERE project_id = ${input.projectId} AND execution_id = ${input.executionId}
-      ORDER BY occurred_at DESC, id DESC
-      LIMIT 1
-    `;
-    return row ? this.rowToRecord(this.sql, row) : null;
+  async markReservationUnknown(input) {
+    const identity = normalizeAiModelCallReservationIdentity(input);
+    const markedAt = cloneValidDate(input.markedAt ?? new Date, "markedAt");
+    return this.withProjectLock(identity.projectId, async (tx) => {
+      const reservation = await this.findReservation(tx, identity);
+      if (!reservation)
+        throw missingReservation(identity);
+      if (reservation.state === "unknown")
+        return reservation;
+      if (reservation.state !== "active")
+        throw invalidState(reservation, "mark unknown");
+      await this.moveEstimateCounters(tx, reservation, { reserved: -1n, unknown: 1n }, markedAt);
+      const unknown = { ...reservation, state: "unknown", updatedAt: markedAt };
+      await this.updateReservation(tx, unknown);
+      return structuredClone(unknown);
+    });
   }
-  async summarizeExecutions(input) {
-    assertNonBlankProjectId(input.projectId);
-    for (const executionId of input.executionIds)
-      assertAiUsageExecutionId(executionId);
-    if (input.executionIds.length === 0)
-      return [];
-    const rows = await this.executionRows(this.sql, input);
-    return aggregateExecutionRows(input.executionIds, rows);
+  async withProjectLock(projectId, run) {
+    return runPgTransaction(this.sql, async (tx) => {
+      const operation = async () => {
+        await lockAdvisoryKeys(tx, [`ai-limit:${projectId}`]);
+        return run(tx);
+      };
+      return tx === this.sql ? this.operations.run(operation) : operation();
+    });
   }
-  async findByIdempotencyKey(sql, record) {
-    const rows = await sql`
-      SELECT * FROM ai_model_call_usage
-      WHERE project_id = ${record.projectId}
-        AND execution_id = ${record.executionId}
-        AND attempt = ${record.attempt}
-        AND call_id = ${record.callId}
-        AND response_id = ${record.responseId}
+  policyRows(sql, projectId, includeDisabled) {
+    return sql`
+      SELECT * FROM ai_usage_limits
+      WHERE project_id = ${projectId} AND (${includeDisabled} OR enabled)
+      ORDER BY id
     `;
-    return rows[0] ? this.rowToRecord(sql, rows[0]) : null;
   }
-  async requireById(sql, projectId, id) {
+  async requirePolicy(sql, projectId, id) {
     const [row] = await sql`
-      SELECT * FROM ai_model_call_usage WHERE project_id = ${projectId} AND id = ${id}
+      SELECT * FROM ai_usage_limits WHERE project_id = ${projectId} AND id = ${id}
+    `;
+    if (row)
+      return policyFromRow(row);
+    throw new AiLimitStorageError("missing_policy", `[SixbPg] AI limit policy '${id}' does not exist in project '${projectId}'.`);
+  }
+  async statusForPolicy(sql, policy, period, existingGroups) {
+    const subject = aiLimitSubjectParts(policy.subject);
+    const limit = normalizeAiLimitAmount(policy.limit);
+    let [row] = await sql`
+      SELECT actual_amount, reserved_amount, unknown_amount, accounting_status
+      FROM ai_usage_limit_periods
+      WHERE project_id = ${policy.projectId}
+        AND subject_type = ${subject.type}
+        AND subject_id = ${subject.id}
+        AND meter = ${limit.meter}
+        AND currency = ${limit.currency}
+        AND period_start = ${period.start}
     `;
+    if (!row || row.accounting_status === "unavailable") {
+      const actual = resolveAiLimitActual(await this.accountingEntries(sql, policy, period), limit);
+      const [inserted] = await sql`
+        INSERT INTO ai_usage_limit_periods (
+          project_id, subject_type, subject_id, meter, currency, period_start, period_end,
+          actual_amount, reserved_amount, unknown_amount, accounting_status, updated_at
+        ) VALUES (
+          ${policy.projectId}, ${subject.type}, ${subject.id}, ${limit.meter}, ${limit.currency},
+          ${period.start}, ${period.end}, ${actual.amount.toString()}, 0, 0,
+          ${actual.accountingStatus}, ${new Date}
+        )
+        ON CONFLICT (project_id, subject_type, subject_id, meter, currency, period_start)
+        DO UPDATE SET
+          actual_amount = excluded.actual_amount,
+          accounting_status = excluded.accounting_status,
+          updated_at = excluded.updated_at
+        RETURNING actual_amount, reserved_amount, unknown_amount, accounting_status
+      `;
+      row = inserted;
+    }
     if (!row)
-      throw new Error(`[SixbPg] AI usage record '${id}' disappeared after insert.`);
-    return this.rowToRecord(sql, row);
+      throw new Error("[SixbPg] Failed to initialize AI limit period state.");
+    return policyStatus(policy, period, row, existingGroups);
   }
-  async rowToRecord(sql, row) {
-    const groupRows = await sql`
-      SELECT group_id FROM ai_model_call_usage_groups
-      WHERE project_id = ${row.project_id} AND usage_record_id = ${row.id}
-      ORDER BY group_id
+  async changeCounters(sql, projectId, subjectValue, amount, period, changes, updatedAt) {
+    const subject = aiLimitSubjectParts(subjectValue);
+    const [row] = await sql`
+      SELECT actual_amount, reserved_amount, unknown_amount, accounting_status
+      FROM ai_usage_limit_periods
+      WHERE project_id = ${projectId}
+        AND subject_type = ${subject.type}
+        AND subject_id = ${subject.id}
+        AND meter = ${amount.meter}
+        AND currency = ${amount.currency}
+        AND period_start = ${period.start}
+      FOR UPDATE
+    `;
+    const reserved = BigInt(row?.reserved_amount ?? "0") + (changes.reserved ?? 0n);
+    const unknown = BigInt(row?.unknown_amount ?? "0") + (changes.unknown ?? 0n);
+    if (reserved < 0n || unknown < 0n) {
+      throw new Error("[SixbPg] AI limit period counter became negative.");
+    }
+    await sql`
+      INSERT INTO ai_usage_limit_periods (
+        project_id, subject_type, subject_id, meter, currency, period_start, period_end,
+        actual_amount, reserved_amount, unknown_amount, accounting_status, updated_at
+      ) VALUES (
+        ${projectId}, ${subject.type}, ${subject.id}, ${amount.meter}, ${amount.currency},
+        ${period.start}, ${period.end}, ${row?.actual_amount ?? "0"}, ${reserved.toString()},
+        ${unknown.toString()}, ${row?.accounting_status ?? "complete"}, ${updatedAt}
+      )
+      ON CONFLICT (project_id, subject_type, subject_id, meter, currency, period_start)
+      DO UPDATE SET
+        period_end = excluded.period_end,
+        actual_amount = excluded.actual_amount,
+        reserved_amount = excluded.reserved_amount,
+        unknown_amount = excluded.unknown_amount,
+        accounting_status = excluded.accounting_status,
+        updated_at = excluded.updated_at
     `;
-    return {
-      id: row.id,
-      projectId: row.project_id,
-      executionId: row.execution_id,
-      attempt: Number(row.attempt),
-      callId: row.call_id,
-      requesterGroupIds: groupRows.map((group) => group.group_id),
-      providerId: row.provider_id,
-      requestedModelId: row.requested_model_id,
-      ...row.response_model_id === null ? {} : { responseModelId: row.response_model_id },
-      responseId: row.response_id,
-      usage: {
-        ...usageFromRow2(row),
-        ...row.total_tokens === null ? {} : { totalTokens: Number(row.total_tokens) },
-        reportingStatus: row.reporting_status
-      },
-      ...row.raw_usage === null ? {} : { rawUsage: rawUsageFromRow(row.raw_usage) },
-      occurredAt: new Date(row.occurred_at),
-      recordedAt: new Date(row.recorded_at)
-    };
   }
-  executionRows(sql, input) {
-    const executionIds = [...new Set(input.executionIds)];
-    return sql`
-      WITH requested(execution_id) AS (
-        SELECT * FROM unnest(${sql.array(executionIds)}::text[])
+  async moveEstimateCounters(sql, reservation, directions, updatedAt) {
+    for (const bucket of reservation.buckets) {
+      const amount = normalizeAiLimitAmount(bucket.estimate);
+      await this.changeCounters(sql, reservation.projectId, bucket.subject, amount, reservation.period, {
+        ...directions.reserved === undefined ? {} : { reserved: directions.reserved * amount.amount },
+        ...directions.unknown === undefined ? {} : { unknown: directions.unknown * amount.amount }
+      }, updatedAt);
+    }
+  }
+  async reconcileEstimateCounters(sql, reservation, entry, updatedAt) {
+    for (const bucket of reservation.buckets) {
+      const amount = normalizeAiLimitAmount(bucket.estimate);
+      const actual = resolveAiLimitActual([entry], amount);
+      if (actual.accountingStatus === "complete") {
+        await this.changeCounters(sql, reservation.projectId, bucket.subject, amount, reservation.period, reservation.state === "active" ? { reserved: -amount.amount } : { unknown: -amount.amount }, updatedAt);
+      } else if (reservation.state === "active") {
+        await this.changeCounters(sql, reservation.projectId, bucket.subject, amount, reservation.period, { reserved: -amount.amount, unknown: amount.amount }, updatedAt);
+      }
+    }
+  }
+  async insertReservation(sql, reservation) {
+    await sql`
+      INSERT INTO ai_model_call_reservations (
+        project_id, execution_id, attempt, call_id, buckets, request_key,
+        period_start, period_end, state, usage_record_id, reserved_at, updated_at
+      ) VALUES (
+        ${reservation.projectId}, ${reservation.executionId}, ${reservation.attempt},
+        ${reservation.callId}, ${JSON.stringify(reservation.buckets)}::text::jsonb,
+        ${reservation.requestKey}, ${reservation.period.start},
+        ${reservation.period.end}, ${reservation.state}, ${reservation.usageRecordId ?? null},
+        ${reservation.reservedAt}, ${reservation.updatedAt}
       )
-      SELECT usage.* FROM requested
-      JOIN ai_model_call_usage AS usage
-        ON usage.project_id = ${input.projectId}
-        AND usage.execution_id = requested.execution_id
     `;
   }
+  async updateReservation(sql, reservation) {
+    await sql`
+      UPDATE ai_model_call_reservations
+      SET state = ${reservation.state},
+          usage_record_id = ${reservation.usageRecordId ?? null},
+          updated_at = ${reservation.updatedAt}
+      WHERE project_id = ${reservation.projectId}
+        AND execution_id = ${reservation.executionId}
+        AND attempt = ${reservation.attempt}
+        AND call_id = ${reservation.callId}
+    `;
+  }
+  async findReservation(sql, input) {
+    const [row] = await sql`
+      SELECT * FROM ai_model_call_reservations
+      WHERE project_id = ${input.projectId}
+        AND execution_id = ${input.executionId}
+        AND attempt = ${input.attempt}
+        AND call_id = ${input.callId}
+    `;
+    return row ? reservationFromRow(row) : null;
+  }
+  async accountingEntries(sql, policy, period) {
+    const subject = aiLimitSubjectParts(policy.subject);
+    const rows = await sql`
+      SELECT usage.project_id, usage.id AS usage_record_id, usage.execution_id,
+             usage.attempt, usage.call_id, usage.occurred_at,
+             usage.total_tokens::text AS total_tokens,
+             executions.requested_by_user_id,
+             executions.requested_by_service_account_id,
+             valuations.status AS valuation_status,
+             valuations.currency AS valuation_currency,
+             valuations.amount_nanos::text AS valuation_amount_nanos
+      FROM ai_model_call_usage AS usage
+      JOIN executions
+        ON executions.project_id = usage.project_id AND executions.id = usage.execution_id
+      LEFT JOIN ai_model_call_valuations AS valuations
+        ON valuations.project_id = usage.project_id
+       AND valuations.usage_record_id = usage.id
+      WHERE usage.project_id = ${policy.projectId}
+        AND usage.occurred_at >= ${period.start}
+        AND usage.occurred_at < ${period.end}
+        AND (
+          ${subject.type} = 'project'
+          OR (
+            ${subject.type} = 'group'
+            AND EXISTS (
+              SELECT 1 FROM ai_model_call_usage_groups AS usage_groups
+              WHERE usage_groups.project_id = usage.project_id
+                AND usage_groups.usage_record_id = usage.id
+                AND usage_groups.group_id = ${subject.id}
+            )
+          )
+          OR (${subject.type} = 'user' AND executions.requested_by_user_id = ${subject.id})
+          OR (
+            ${subject.type} = 'serviceAccount'
+            AND executions.requested_by_service_account_id = ${subject.id}
+          )
+        )
+      ORDER BY usage.occurred_at, usage.id
+    `;
+    return rows.map((row) => accountingEntryFromRow(row, policy.subject));
+  }
+  async requireAccountingEntry(sql, projectId, usageRecordId) {
+    const [row] = await sql`
+      SELECT usage.project_id, usage.id AS usage_record_id, usage.execution_id,
+             usage.attempt, usage.call_id, usage.occurred_at,
+             usage.total_tokens::text AS total_tokens,
+             executions.requested_by_user_id,
+             executions.requested_by_service_account_id,
+             valuations.status AS valuation_status,
+             valuations.currency AS valuation_currency,
+             valuations.amount_nanos::text AS valuation_amount_nanos
+      FROM ai_model_call_usage AS usage
+      JOIN executions
+        ON executions.project_id = usage.project_id AND executions.id = usage.execution_id
+      LEFT JOIN ai_model_call_valuations AS valuations
+        ON valuations.project_id = usage.project_id
+       AND valuations.usage_record_id = usage.id
+      WHERE usage.project_id = ${projectId} AND usage.id = ${usageRecordId}
+    `;
+    if (row) {
+      const groups = await sql`
+        SELECT group_id FROM ai_model_call_usage_groups
+        WHERE project_id = ${projectId} AND usage_record_id = ${usageRecordId}
+        ORDER BY group_id
+      `;
+      return accountingEntryFromRow(row, undefined, groups.map((group) => group.group_id));
+    }
+    throw new AiLimitStorageError("missing_usage_record", `[SixbPg] AI usage record '${usageRecordId}' does not exist in project '${projectId}'.`);
+  }
   async assertExecutionExists(sql, projectId, executionId) {
-    const [execution] = await sql`
+    const [row] = await sql`
       SELECT EXISTS (
         SELECT 1 FROM executions WHERE project_id = ${projectId} AND id = ${executionId}
       ) AS exists
     `;
-    if (execution?.exists)
+    if (row?.exists)
       return;
-    throw new AiUsageStorageError("missing_execution", `[SixbPg] AI usage execution '${executionId}' does not exist in project '${projectId}'.`);
+    throw new AiLimitStorageError("missing_execution", `[SixbPg] AI limit execution '${executionId}' does not exist in project '${projectId}'.`);
   }
 }
-function aggregateExecutionRows(executionIds, rows) {
-  const usageByExecutionId = new Map;
-  for (const executionId of executionIds)
-    usageByExecutionId.set(executionId, []);
-  for (const row of rows) {
-    usageByExecutionId.get(row.execution_id)?.push(usageFromRow2(row));
-  }
-  return executionIds.map((executionId) => {
-    const usages = usageByExecutionId.get(executionId) ?? [];
-    return {
-      modelCallCount: usages.length,
-      usage: aggregateAiModelCallUsage(usages)
-    };
-  });
+function policyFromRow(row) {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    subject: aiLimitSubjectFromParts(row.subject_type, row.subject_id),
+    limit: aiLimitQuantityFromAmount({
+      meter: row.meter,
+      currency: row.currency,
+      amount: BigInt(row.limit_amount)
+    }),
+    period: row.period_kind,
+    enabled: row.enabled,
+    createdAt: new Date(row.created_at),
+    updatedAt: new Date(row.updated_at)
+  };
 }
-function usageFromRow2(row) {
+function policyStatus(policy, period, row, existingGroups) {
+  const limit = normalizeAiLimitAmount(policy.limit);
+  const actual = BigInt(row.actual_amount);
+  const reserved = BigInt(row.reserved_amount);
+  const unknown = BigInt(row.unknown_amount);
+  const consumed = actual + reserved + unknown;
+  const quantity = (amount) => aiLimitQuantityFromAmount({ ...limit, amount });
   return {
-    ...row.input_tokens === null ? {} : { inputTokens: Number(row.input_tokens) },
-    ...row.output_tokens === null ? {} : { outputTokens: Number(row.output_tokens) },
-    ...row.uncached_input_tokens === null ? {} : { uncachedInputTokens: Number(row.uncached_input_tokens) },
-    ...row.cache_read_input_tokens === null ? {} : { cacheReadInputTokens: Number(row.cache_read_input_tokens) },
-    ...row.cache_write_input_tokens === null ? {} : { cacheWriteInputTokens: Number(row.cache_write_input_tokens) },
-    ...row.text_output_tokens === null ? {} : { textOutputTokens: Number(row.text_output_tokens) },
-    ...row.reasoning_output_tokens === null ? {} : { reasoningOutputTokens: Number(row.reasoning_output_tokens) }
+    policy,
+    period: structuredClone(period),
+    consumption: {
+      actual: quantity(actual),
+      reserved: quantity(reserved),
+      unknown: quantity(unknown),
+      remaining: quantity(limit.amount > consumed ? limit.amount - consumed : 0n)
+    },
+    accountingStatus: row.accounting_status,
+    exhausted: consumed >= limit.amount,
+    orphaned: policy.subject.type === "group" && existingGroups !== undefined && !existingGroups.has(policy.subject.id)
   };
 }
-function rawUsageFromRow(value) {
+function accountingEntryFromRow(row, subject, requesterGroupIds = subject?.type === "group" ? [subject.id] : []) {
+  const totalTokens = row.total_tokens === null ? undefined : Number(row.total_tokens);
+  const requester = row.requested_by_user_id ? { type: "user", id: row.requested_by_user_id } : row.requested_by_service_account_id ? { type: "serviceAccount", id: row.requested_by_service_account_id } : undefined;
+  return {
+    projectId: row.project_id,
+    usageRecordId: row.usage_record_id,
+    executionId: row.execution_id,
+    attempt: Number(row.attempt),
+    callId: row.call_id,
+    occurredAt: new Date(row.occurred_at),
+    ...totalTokens !== undefined && Number.isSafeInteger(totalTokens) ? { totalTokens } : {},
+    requesterGroupIds,
+    ...requester ? { requester } : {},
+    ...row.valuation_status === "rated" && row.valuation_currency !== null && row.valuation_amount_nanos !== null ? {
+      valuation: {
+        status: "rated",
+        money: {
+          currency: row.valuation_currency,
+          amountNanos: row.valuation_amount_nanos
+        }
+      }
+    } : row.valuation_status === "unpriceable" ? { valuation: { status: "unavailable" } } : {}
+  };
+}
+function reservationFromRow(row) {
+  const buckets = jsonValue(row.buckets);
+  return {
+    projectId: row.project_id,
+    executionId: row.execution_id,
+    attempt: Number(row.attempt),
+    callId: row.call_id,
+    buckets: buckets.map((bucket) => ({
+      subject: structuredClone(bucket.subject),
+      estimate: normalizeAiLimitQuantities([bucket.estimate], "stored bucket")[0]
+    })),
+    requestKey: row.request_key,
+    period: {
+      kind: "calendarMonth",
+      start: new Date(row.period_start),
+      end: new Date(row.period_end),
+      resetAt: new Date(row.period_end)
+    },
+    state: row.state,
+    ...row.usage_record_id === null ? {} : { usageRecordId: row.usage_record_id },
+    reservedAt: new Date(row.reserved_at),
+    updatedAt: new Date(row.updated_at)
+  };
+}
+function jsonValue(value) {
   return typeof value === "string" ? JSON.parse(value) : value;
 }
-function assertNonBlankProjectId(projectId) {
-  if (typeof projectId !== "string" || projectId.trim().length === 0) {
-    throw new TypeError("[Sixb] AI usage projectId must be nonblank.");
+function assertSameDimension(previous, next) {
+  if (aiLimitAmountKey(normalizeAiLimitAmount(previous)) !== aiLimitAmountKey(normalizeAiLimitAmount(next))) {
+    throw new TypeError("[Sixb] AI limit policy meter and cost currency are immutable.");
   }
 }
+function validatePolicyIdentity(input) {
+  assertNonBlank2(input.projectId, "projectId");
+  assertNonBlank2(input.id, "policy id");
+}
+function duplicatePolicy(policy) {
+  return new AiLimitStorageError("duplicate_policy", `[SixbPg] An AI limit policy already exists for policy ID or subject-meter dimension '${policy.id}'.`);
+}
+function missingReservation(input) {
+  return new AiLimitStorageError("missing_reservation", `[SixbPg] AI model-call reservation '${input.callId}' does not exist for execution '${input.executionId}' attempt ${input.attempt}.`);
+}
+function reconciliationConflict(callId) {
+  return new AiLimitStorageError("reconciliation_conflict", `[SixbPg] AI model-call reservation '${callId}' was reconciled with a different usage record.`);
+}
+function invalidState(reservation, operation) {
+  return new AiLimitStorageError("invalid_reservation_state", `[SixbPg] Cannot ${operation} AI model-call reservation '${reservation.callId}' in state '${reservation.state}'.`);
+}
 
 // src/pg-client.ts
 import postgres from "postgres";
@@ -14712,15 +16048,15 @@ class PgWorkflowAgentNodeRunStorage {
       projectId: input.projectId,
       executionId: input.executionId,
       nodeRunId: input.nodeRunId,
-      agentId: input.agentId,
+      actorId: input.actorId,
       workflowExecutionId: parent.execution_id
     });
     try {
       const [row] = await this.sql`
         INSERT INTO workflow_agent_node_runs (
-          project_id, node_run_id, execution_id, agent_id, status, prompt, attempt, created_at
+          project_id, node_run_id, execution_id, actor_id, status, prompt, attempt, created_at
         ) VALUES (
-          ${input.projectId}, ${input.nodeRunId}, ${input.executionId}, ${input.agentId},
+          ${input.projectId}, ${input.nodeRunId}, ${input.executionId}, ${input.actorId},
           ${"queued"}, ${input.prompt}, ${0}, ${input.createdAt ?? new Date}
         ) RETURNING *
       `;
@@ -14837,9 +16173,9 @@ class PgWorkflowAgentNodeRunStorage {
     const whereClauses = ["project_id = $1"];
     const params = [input.projectId];
     let index = 2;
-    if (input.agentId) {
-      whereClauses.push(`agent_id = $${index++}`);
-      params.push(input.agentId);
+    if (input.actorId) {
+      whereClauses.push(`actor_id = $${index++}`);
+      params.push(input.actorId);
     }
     index = appendRunListFilters(whereClauses, params, index, input);
     const result = await queryRunList({
@@ -15116,7 +16452,7 @@ function rowToWorkflowAgentNodeRunRecord(row) {
     projectId: row.project_id,
     nodeRunId: row.node_run_id,
     executionId: row.execution_id,
-    agentId: row.agent_id,
+    actorId: row.actor_id,
     status: row.status,
     prompt: row.prompt,
     ...row.model_id ? { modelId: row.model_id } : {},
@@ -15181,6 +16517,7 @@ class PostgresStorage {
   agents;
   aiUsage;
   aiCosts;
+  aiLimits;
   actionRuns;
   pipelineRuns;
   workflowRuns;
@@ -15231,6 +16568,7 @@ class PostgresStorage {
     this.agents = createAgentOperationScope(stores.agents, scope);
     this.aiUsage = createOperationScopedFacade(stores.aiUsage, scope);
     this.aiCosts = createOperationScopedFacade(stores.aiCosts, scope);
+    this.aiLimits = createOperationScopedFacade(stores.aiLimits, scope);
     this.actionRuns = createOperationScopedFacade(stores.actionRuns, scope);
     this.pipelineRuns = createOperationScopedFacade(stores.pipelineRuns, scope);
     this.workflowRuns = createWorkflowRunOperationScope(stores.workflowRuns, scope);
@@ -15266,6 +16604,7 @@ class PostgresStorage {
           transactionContext.materializations.assertCommittable();
           return result;
         } finally {
+          await txStorage.aiLimits.settleOperations();
           transactionContext.active = false;
           txStorage.ontology.deactivateSessions();
           transactionContext.materializations.deactivate();
@@ -15320,6 +16659,7 @@ function createPostgresStores(sql, options) {
     agents: new PgAgentStorage({ sql, executions }),
     aiUsage: new PgAiUsageStorage(sql),
     aiCosts: new PgAiCostStorage(sql),
+    aiLimits: new PgAiLimitStorage(sql),
     actionRuns: new PgActionRunStorage(sql, executions),
     pipelineRuns: new PgPipelineRunStorage(sql, executions),
     workflowRuns: new PgWorkflowRunStorage(sql, executions),
@@ -15346,4 +16686,4 @@ export {
   PostgresStorage
 };
 
-//# debugId=0531F72AD7BC178764756E2164756E21
+//# debugId=A5AA822A44042C7A64756E2164756E21