@sixb/sqlite 0.1.11 → 0.1.13

package/dist/index.js

@@ -3990,6 +3990,349 @@ CREATE INDEX idx_ontology_outbox_publication_order
   WHERE published_at IS NULL;
 `;
 
+// src/migrations/041-agent-thread-workspaces.sql
+var _041_agent_thread_workspaces_default = `ALTER TABLE agent_threads ADD COLUMN sandbox_params TEXT
+  CHECK (sandbox_params IS NULL OR (json_valid(sandbox_params) AND json_type(sandbox_params) = 'object'));
+`;
+
+// src/migrations/042-vector-profiles.sql
+var _042_vector_profiles_default = `CREATE TABLE object_vectors (
+  project_id TEXT NOT NULL,
+  object_type_id TEXT NOT NULL,
+  primary_id TEXT NOT NULL,
+  profile TEXT NOT NULL CHECK (length(trim(profile)) > 0),
+  configuration TEXT NOT NULL,
+  source TEXT NOT NULL CHECK (
+    json_valid(source) AND json_type(source) = 'array' AND json_array_length(source) > 0
+  ),
+  source_fingerprint TEXT NOT NULL,
+  embedding BLOB NOT NULL CHECK (
+    typeof(embedding) = 'blob' AND length(embedding) BETWEEN 4 AND 64000
+    AND length(embedding) % 4 = 0
+  ),
+  last_commit_id TEXT NOT NULL,
+  PRIMARY KEY (project_id, object_type_id, primary_id, profile),
+  FOREIGN KEY (project_id, object_type_id, primary_id)
+    REFERENCES objects (project_id, object_type_id, primary_id) ON DELETE CASCADE,
+  FOREIGN KEY (project_id, last_commit_id)
+    REFERENCES ontology_commits (project_id, id) DEFERRABLE INITIALLY DEFERRED
+);
+`;
+
+// src/migrations/043-vector-indexing.sql
+var _043_vector_indexing_default = `CREATE TABLE object_vector_indexing (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  object_type_id TEXT NOT NULL,
+  primary_id TEXT NOT NULL,
+  profile TEXT NOT NULL,
+  request TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('pending', 'running', 'ready', 'failed')),
+  available_at TEXT NOT NULL,
+  dispatch_at TEXT NOT NULL,
+  values_json TEXT,
+  error TEXT,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, object_type_id, primary_id, profile)
+);
+CREATE INDEX object_vector_indexing_due ON object_vector_indexing (project_id, dispatch_at, id)
+  WHERE status <> 'failed';
+
+CREATE TABLE executions_v2 (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  executor_kind TEXT NOT NULL CHECK (
+    executor_kind IN (
+      'request', 'action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow',
+      'agent', 'kernel'
+    )
+  ),
+  executor_id TEXT NOT NULL CHECK (length(trim(executor_id)) > 0),
+  source_kind TEXT NOT NULL CHECK (
+    source_kind IN ('http', 'webhook', 'schedule', 'event', 'datasetVersion', 'execution', 'ontologyCommit')
+  ),
+  source_id TEXT NOT NULL CHECK (length(trim(source_id)) > 0),
+  requested_by_user_id TEXT,
+  requested_by_service_account_id TEXT,
+  correlation_id TEXT NOT NULL CHECK (length(trim(correlation_id)) > 0),
+  parent_execution_id TEXT,
+  authority_kind TEXT NOT NULL CHECK (
+    authority_kind IN ('principal', 'trustedPrimitive', 'delegated', 'kernel', 'disabled')
+  ),
+  authority_user_id TEXT,
+  authority_service_account_id TEXT,
+  authority_session_id TEXT,
+  authority_access_token_id TEXT,
+  authority_primitive_kind TEXT CHECK (
+    authority_primitive_kind IS NULL
+      OR authority_primitive_kind IN (
+        'action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow'
+      )
+  ),
+  authority_primitive_id TEXT,
+  authority_kernel_operation TEXT CHECK (
+    authority_kernel_operation IS NULL OR authority_kernel_operation IN ('ontology.recover', 'ontology.indexVectors')
+  ),
+  authority_delegation_kind TEXT CHECK (
+    authority_delegation_kind IS NULL OR authority_delegation_kind = 'share'
+  ),
+  authority_delegation_id TEXT,
+  authority_delegation_session_id TEXT,
+  requester_group_ids TEXT NOT NULL DEFAULT '[]',
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, id),
+  FOREIGN KEY (project_id, parent_execution_id) REFERENCES executions (project_id, id),
+  FOREIGN KEY (project_id, requested_by_user_id) REFERENCES auth_users (project_id, id),
+  FOREIGN KEY (project_id, requested_by_service_account_id)
+    REFERENCES auth_service_accounts (project_id, id),
+  FOREIGN KEY (project_id, authority_user_id) REFERENCES auth_users (project_id, id),
+  FOREIGN KEY (project_id, authority_service_account_id)
+    REFERENCES auth_service_accounts (project_id, id),
+  FOREIGN KEY (project_id, authority_session_id) REFERENCES auth_sessions (project_id, id),
+  FOREIGN KEY (project_id, authority_access_token_id)
+    REFERENCES auth_access_tokens (project_id, id),
+  FOREIGN KEY (
+    project_id, authority_delegation_session_id, authority_delegation_id
+  ) REFERENCES share_sessions (project_id, id, grant_id),
+  CHECK ((requested_by_user_id IS NOT NULL) + (requested_by_service_account_id IS NOT NULL) <= 1),
+  CHECK (
+    (source_kind = 'execution' AND parent_execution_id = source_id)
+      OR (source_kind <> 'execution' AND parent_execution_id IS NULL)
+  ),
+  CHECK (
+    (
+      authority_kind = 'principal'
+      AND (authority_user_id IS NOT NULL) + (authority_service_account_id IS NOT NULL) = 1
+      AND (authority_session_id IS NOT NULL) + (authority_access_token_id IS NOT NULL) <= 1
+      AND (authority_session_id IS NULL OR authority_user_id IS NOT NULL)
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'trustedPrimitive'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NOT NULL
+      AND authority_primitive_id IS NOT NULL
+      AND length(trim(authority_primitive_id)) > 0
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'delegated'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NOT NULL
+      AND authority_delegation_kind = 'share'
+      AND authority_delegation_id IS NOT NULL
+      AND length(trim(authority_delegation_id)) > 0
+      AND authority_delegation_session_id IS NOT NULL
+      AND length(trim(authority_delegation_session_id)) > 0
+    )
+    OR (
+      authority_kind = 'kernel'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NOT NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'disabled'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+  ),
+  CHECK (
+    (
+      executor_kind = 'request'
+      AND source_kind = 'http'
+      AND executor_id = source_id
+      AND (
+        (
+          authority_kind = 'principal'
+          AND requested_by_user_id IS authority_user_id
+          AND requested_by_service_account_id IS authority_service_account_id
+        )
+        OR (
+          authority_kind IN ('delegated', 'disabled')
+          AND requested_by_user_id IS NULL
+          AND requested_by_service_account_id IS NULL
+        )
+      )
+    )
+    OR (
+      executor_kind IN ('action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow')
+      AND authority_kind = 'trustedPrimitive'
+      AND executor_kind = authority_primitive_kind
+    )
+    OR (
+      executor_kind = 'agent'
+      AND source_kind = 'execution'
+      AND (
+        (
+          authority_kind = 'principal'
+          AND authority_service_account_id IS NOT NULL
+          AND authority_session_id IS NULL
+          AND authority_access_token_id IS NULL
+        )
+        OR (
+          authority_kind = 'principal'
+          AND authority_user_id IS NOT NULL
+          AND (authority_session_id IS NOT NULL) + (authority_access_token_id IS NOT NULL) = 1
+        )
+        OR authority_kind = 'disabled'
+      )
+    )
+    OR (executor_kind = 'kernel' AND authority_kind = 'kernel')
+  )
+);
+
+INSERT INTO executions_v2 (project_id, id, executor_kind, executor_id, source_kind, source_id, requested_by_user_id, requested_by_service_account_id, correlation_id, parent_execution_id, authority_kind, authority_user_id, authority_service_account_id, authority_session_id, authority_access_token_id, authority_primitive_kind, authority_primitive_id, authority_kernel_operation, authority_delegation_kind, authority_delegation_id, authority_delegation_session_id, requester_group_ids, created_at) SELECT project_id, id, executor_kind, executor_id, source_kind, source_id, requested_by_user_id, requested_by_service_account_id, correlation_id, parent_execution_id, authority_kind, authority_user_id, authority_service_account_id, authority_session_id, authority_access_token_id, authority_primitive_kind, authority_primitive_id, authority_kernel_operation, authority_delegation_kind, authority_delegation_id, authority_delegation_session_id, requester_group_ids, created_at FROM executions;
+DROP TABLE executions;
+ALTER TABLE executions_v2 RENAME TO executions;
+`;
+
+// src/migrations/044-vector-batching.sql
+var _044_vector_batching_default = `ALTER TABLE object_vector_indexing ADD COLUMN batch_id TEXT;
+CREATE INDEX object_vector_indexing_batch ON object_vector_indexing (project_id, batch_id, id)
+  WHERE batch_id IS NOT NULL;
+`;
+
+// src/migrations/045-agent-thread-sandbox-state.sql
+var _045_agent_thread_sandbox_state_default = `ALTER TABLE agent_threads ADD COLUMN sandbox_state TEXT
+  CHECK (sandbox_state IS NULL OR (json_valid(sandbox_state) AND json_type(sandbox_state) = 'object'));
+`;
+
+// src/migrations/046-workflow-intervention-principals.sql
+var _046_workflow_intervention_principals_default = `-- Intervention actors were stored as { principalType, principalId }. Rewrite them to the
+-- canonical Principal shape { type, id } used by every other stored principal.
+UPDATE workflow_interventions
+SET submitted_by = json_object(
+  'type', json_extract(submitted_by, '$.principalType'),
+  'id', json_extract(submitted_by, '$.principalId')
+)
+WHERE json_extract(submitted_by, '$.principalType') IS NOT NULL;
+
+UPDATE workflow_interventions
+SET cancelled_by = json_object(
+  'type', json_extract(cancelled_by, '$.principalType'),
+  'id', json_extract(cancelled_by, '$.principalId')
+)
+WHERE json_extract(cancelled_by, '$.principalType') IS NOT NULL;
+`;
+
+// src/migrations/047-ontology-commit-attribution.sql
+var _047_ontology_commit_attribution_default = `-- Commits and their events name who requested the write and what ran it, replacing the
+-- authority-only \`actor\`. Both are copied from the commit's execution, which stays canonical and
+-- is immutable, so the backfill is exact. SQLite cannot add a NOT NULL column without a default;
+-- every insert supplies \`executor\`, and the UPDATE below replaces the placeholder on every row.
+ALTER TABLE ontology_commits ADD COLUMN requested_by TEXT
+  CHECK (requested_by IS NULL OR json_valid(requested_by));
+ALTER TABLE ontology_commits ADD COLUMN executor TEXT NOT NULL DEFAULT '{}'
+  CHECK (json_valid(executor));
+
+UPDATE ontology_commits SET
+  requested_by = (
+    SELECT CASE
+      WHEN e.requested_by_user_id IS NOT NULL
+        THEN json_object('id', e.requested_by_user_id, 'type', 'user')
+      WHEN e.requested_by_service_account_id IS NOT NULL
+        THEN json_object('id', e.requested_by_service_account_id, 'type', 'serviceAccount')
+    END
+    FROM executions e
+    WHERE e.project_id = ontology_commits.project_id AND e.id = ontology_commits.execution_id
+  ),
+  executor = (
+    SELECT CASE e.executor_kind
+      WHEN 'request' THEN json_object('requestId', e.executor_id, 'type', 'request')
+      WHEN 'agent' THEN json_object('runId', e.executor_id, 'type', 'agent')
+      WHEN 'kernel' THEN json_object(
+        'operation',
+        CASE e.authority_kernel_operation
+          WHEN 'ontology.recover'
+            THEN json_object('recoveryId', e.executor_id, 'type', 'ontology.recover')
+          ELSE json_object('indexingId', e.executor_id, 'type', 'ontology.indexVectors')
+        END,
+        'type', 'kernel'
+      )
+      ELSE json_object(
+        'id', e.authority_primitive_id,
+        'kind', e.executor_kind,
+        'runId', e.executor_id,
+        'type', 'primitive'
+      )
+    END
+    FROM executions e
+    WHERE e.project_id = ontology_commits.project_id AND e.id = ontology_commits.execution_id
+  );
+
+-- Events not yet published would otherwise reach consumers in the retired shape.
+UPDATE ontology_outbox SET envelope = (
+  SELECT json_remove(
+    CASE
+      WHEN c.requested_by IS NULL
+        THEN json_set(ontology_outbox.envelope, '$.executor', json(c.executor))
+      ELSE json_set(
+        ontology_outbox.envelope,
+        '$.executor', json(c.executor),
+        '$.requestedBy', json(c.requested_by)
+      )
+    END,
+    '$.actor'
+  )
+  FROM ontology_commits c
+  WHERE c.project_id = ontology_outbox.project_id AND c.id = ontology_outbox.commit_id
+)
+WHERE EXISTS (
+  SELECT 1 FROM ontology_commits c
+  WHERE c.project_id = ontology_outbox.project_id AND c.id = ontology_outbox.commit_id
+);
+
+ALTER TABLE ontology_commits DROP COLUMN actor;
+`;
+
+// src/migrations/049-native-sessions.sql
+var _049_native_sessions_default = `-- Native clients, such as the CLI, hold their session as bearer tokens: a
+-- short-lived access token, whose hash is \`token_hash\`, and a rotating refresh token. Browser
+-- sessions leave these columns NULL; \`refresh_token_hash IS NULL\` is what marks a cookie session.
+ALTER TABLE auth_sessions ADD COLUMN client_name TEXT;
+ALTER TABLE auth_sessions ADD COLUMN access_expires_at TEXT;
+ALTER TABLE auth_sessions ADD COLUMN refresh_token_hash TEXT;
+ALTER TABLE auth_sessions ADD COLUMN previous_refresh_token_hash TEXT;
+ALTER TABLE auth_sessions ADD COLUMN refreshed_at TEXT;
+
+-- The device flow now starts a session instead of issuing a personal access token.
+ALTER TABLE auth_device_authorizations DROP COLUMN token_name;
+ALTER TABLE auth_device_authorizations DROP COLUMN token_expires_at;
+`;
+
 // src/migrations/037-execution-requester-groups.sql
 var _037_execution_requester_groups_default = `ALTER TABLE executions ADD COLUMN requester_group_ids TEXT NOT NULL DEFAULT '[]';
 
@@ -4072,6 +4415,44 @@ CREATE INDEX idx_connector_attempts_expiry
   ON connector_authorization_attempts (project_id, connector_id, expires_at);
 `;
 
+// src/migrations/048-file-upload-sessions.sql
+var _048_file_upload_sessions_default = `-- Durable staged-upload sessions, so an upload survives restarts and spans API replicas.
+-- Timestamps are ISO-8601 UTC text and compare lexicographically.
+CREATE TABLE file_upload_sessions (
+  id TEXT PRIMARY KEY CHECK (length(trim(id)) > 0),
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  owner_principal_type TEXT NOT NULL
+    CHECK (owner_principal_type IN ('user', 'serviceAccount', 'system')),
+  owner_principal_id TEXT NOT NULL CHECK (length(owner_principal_id) > 0),
+  strategy TEXT NOT NULL CHECK (strategy IN ('server', 'direct-put', 'multipart')),
+  status TEXT NOT NULL CHECK (status IN ('pending', 'completed', 'aborted')),
+  file_name TEXT,
+  media_type TEXT,
+  logical_path TEXT,
+  expected_size_bytes INTEGER CHECK (expected_size_bytes IS NULL OR expected_size_bytes >= 0),
+  expected_digest TEXT,
+  provider_upload TEXT CHECK (provider_upload IS NULL OR json_type(provider_upload) = 'object'),
+  signed_parts TEXT NOT NULL CHECK (json_type(signed_parts) = 'array'),
+  file_ref TEXT CHECK (file_ref IS NULL OR json_type(file_ref) = 'object'),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  completed_at TEXT,
+  aborted_at TEXT,
+  -- Derived by core (fileUploadSessionReapAt); NULL while an abandoned upload awaits its abort.
+  reap_at TEXT,
+  CHECK ((status = 'completed') = (completed_at IS NOT NULL)),
+  CHECK ((status = 'aborted') = (aborted_at IS NOT NULL))
+);
+
+CREATE INDEX idx_file_upload_sessions_reap
+  ON file_upload_sessions (reap_at)
+  WHERE reap_at IS NOT NULL;
+
+CREATE INDEX idx_file_upload_sessions_abandoned
+  ON file_upload_sessions (project_id, expires_at)
+  WHERE status = 'pending' AND provider_upload IS NOT NULL;
+`;
+
 // src/migrations.ts
 var MIGRATIONS_TABLE_SQL = `
   CREATE TABLE IF NOT EXISTS sixb_migrations (
@@ -4146,7 +4527,16 @@ var sqliteStorageMigrations = defineMigrations({
     sqliteSql("037-execution-requester-groups", _037_execution_requester_groups_default),
     sqliteSql("038-projection-source-roots", _038_projection_source_roots_default),
     sqliteSql("039-connector-optional-pkce", _039_connector_optional_pkce_default),
-    sqliteSql("040-outbox-publication-order", _040_outbox_publication_order_default)
+    sqliteSql("040-outbox-publication-order", _040_outbox_publication_order_default),
+    sqliteSql("041-agent-thread-workspaces", _041_agent_thread_workspaces_default),
+    sqliteSql("042-vector-profiles", _042_vector_profiles_default),
+    sqliteSql("043-vector-indexing", _043_vector_indexing_default),
+    sqliteSql("044-vector-batching", _044_vector_batching_default),
+    sqliteSql("045-agent-thread-sandbox-state", _045_agent_thread_sandbox_state_default),
+    sqliteSql("046-workflow-intervention-principals", _046_workflow_intervention_principals_default),
+    sqliteSql("047-ontology-commit-attribution", _047_ontology_commit_attribution_default),
+    sqliteSql("048-file-upload-sessions", _048_file_upload_sessions_default),
+    sqliteSql("049-native-sessions", _049_native_sessions_default)
   ]
 });
 function sqliteStoragePath(basePath) {
@@ -4831,6 +5221,7 @@ import {
 } from "@sixb/core/storage";
 
 // src/agents/rows.ts
+import { snapshotAgentThreadSandboxParams } from "@sixb/core/internal/agent-run-storage-provider";
 import { parseSixbFailure } from "@sixb/core/internal/errors";
 import {
   AGENT_RUN_FAILURE_CODES,
@@ -4842,6 +5233,10 @@ function rowToThreadRecord(row) {
     projectId: row.project_id,
     ownerPrincipal: { type: row.owner_principal_type, id: row.owner_principal_id },
     title: row.title ?? undefined,
+    ...row.sandbox_state == null ? {} : {
+      sandboxState: JSON.parse(row.sandbox_state)
+    },
+    ...row.sandbox_params == null ? {} : { sandboxParams: snapshotAgentThreadSandboxParams(JSON.parse(row.sandbox_params)) },
     status: row.status,
     activeRunId: row.active_run_id,
     lastMessageAt: row.last_message_at ? new Date(row.last_message_at) : undefined,
@@ -5541,6 +5936,10 @@ class SqliteAgentRunStore {
 }
 
 // src/agents/threads.ts
+import {
+  snapshotAgentThreadSandboxParams as snapshotAgentThreadSandboxParams2,
+  transitionAgentThreadSandbox
+} from "@sixb/core/internal/agent-run-storage-provider";
 import {
   AgentStorageError as AgentStorageError4
 } from "@sixb/core/storage";
@@ -5549,7 +5948,17 @@ class SqliteAgentThreadStore {
   constructor(db) {
     this.db = db;
   }
+  async transitionSandbox(input) {
+    return this.db.transaction(() => {
+      const run = input.action === "recreate" ? null : this.db.query("SELECT * FROM agent_runs WHERE project_id = ? AND id = ?").get(input.projectId, input.runId);
+      const thread = this.requireThread(input.projectId, input.id);
+      const state = transitionAgentThreadSandbox(thread, run ? rowToRunRecord(run) : null, input);
+      this.db.query("UPDATE agent_threads SET sandbox_state = ? WHERE project_id = ? AND id = ?").run(JSON.stringify(state), input.projectId, input.id);
+      return state;
+    }).immediate();
+  }
   async create(input) {
+    const sandboxParams = input.sandboxParams === undefined ? null : JSON.stringify(snapshotAgentThreadSandboxParams2(input.sandboxParams));
     const createdAt = input.createdAt ?? new Date;
     const updatedAt = input.updatedAt ?? createdAt;
     try {
@@ -5560,14 +5969,15 @@ class SqliteAgentThreadStore {
             owner_principal_type,
             owner_principal_id,
             title,
+            sandbox_params,
             status,
             active_run_id,
             last_message_at,
             message_count,
             created_at,
             updated_at
-          ) VALUES (?, ?, ?, ?, ?, ?, NULL, NULL, 0, ?, ?)
-        `).run(input.projectId, input.id, input.ownerPrincipal.type, input.ownerPrincipal.id, input.title ?? null, input.status ?? "active", createdAt.toISOString(), updatedAt.toISOString());
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, NULL, NULL, 0, ?, ?)
+        `).run(input.projectId, input.id, input.ownerPrincipal.type, input.ownerPrincipal.id, input.title ?? null, sandboxParams, input.status ?? "active", createdAt.toISOString(), updatedAt.toISOString());
     } catch (error) {
       if (isUniqueConstraintError2(error)) {
         throw new AgentStorageError4("duplicate_id", `[SixbSqlite] Agent thread '${input.id}' already exists for project '${input.projectId}'.`);
@@ -6188,6 +6598,8 @@ var SQLITE_ACCOUNTING_OVERVIEW_SQL = `
     CAST(COUNT(*) AS TEXT) AS model_call_count,
     CAST(SUM(CASE WHEN reporting_status <> 'unavailable' THEN 1 ELSE 0 END) AS TEXT)
       AS reported_usage_call_count,
+    CAST(SUM(CASE WHEN input_tokens IS NOT NULL AND output_tokens IS NOT NULL THEN 1 ELSE 0 END) AS TEXT)
+      AS complete_usage_call_count,
     CAST(COUNT(input_tokens) AS TEXT) AS input_tokens_count,
     CAST(SUM(input_tokens) AS TEXT) AS input_tokens_sum,
     CAST(COUNT(output_tokens) AS TEXT) AS output_tokens_count,
@@ -6240,6 +6652,7 @@ function aggregateFragmentFromRow(row) {
     modelCallCount: row.model_call_count,
     usage: {
       reportedCallCount: row.reported_usage_call_count,
+      completeCallCount: row.complete_usage_call_count,
       inputTokens: meterFragment(row.input_tokens_count, row.input_tokens_sum),
       outputTokens: meterFragment(row.output_tokens_count, row.output_tokens_sum),
       uncachedInputTokens: meterFragment(row.uncached_input_tokens_count, row.uncached_input_tokens_sum),
@@ -7077,7 +7490,14 @@ function rowToSessionRecord(row) {
     revokedAt: row.revoked_at ? new Date(row.revoked_at) : undefined,
     lastSeenAt: row.last_seen_at ? new Date(row.last_seen_at) : undefined,
     userAgent: row.user_agent ?? undefined,
-    ipAddress: row.ip_address ?? undefined
+    ipAddress: row.ip_address ?? undefined,
+    bearer: row.refresh_token_hash !== null && row.client_name !== null && row.access_expires_at !== null ? {
+      clientName: row.client_name,
+      accessExpiresAt: new Date(row.access_expires_at),
+      refreshTokenHash: row.refresh_token_hash,
+      previousRefreshTokenHash: row.previous_refresh_token_hash ?? undefined,
+      refreshedAt: row.refreshed_at ? new Date(row.refreshed_at) : undefined
+    } : undefined
   };
 }
 function rowToAccessTokenRecord(row) {
@@ -7086,8 +7506,7 @@ function rowToAccessTokenRecord(row) {
     projectId: row.project_id,
     name: row.name,
     kind: row.kind,
-    subjectType: row.subject_type,
-    subjectId: row.subject_id,
+    subject: { type: row.subject_type, id: row.subject_id },
     tokenHash: row.token_hash,
     groupIds: parseOptionalStringArray(row.group_ids),
     createdByPrincipal: row.created_by_principal_type && row.created_by_principal_id ? {
@@ -7168,8 +7587,6 @@ function rowToDeviceAuthorizationRecord(row) {
     deviceCodeHash: row.device_code_hash,
     userCode: row.user_code,
     clientName: row.client_name,
-    tokenName: row.token_name,
-    tokenExpiresAt: new Date(row.token_expires_at),
     status: row.status,
     approvedUserId: row.approved_user_id ?? undefined,
     approvedSessionId: row.approved_session_id ?? undefined,
@@ -7400,9 +7817,12 @@ function createSession(db, input) {
       expires_at,
       absolute_expires_at,
       user_agent,
-      ip_address
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-  `).run(projectId, id, userId, strategyId, audience, tokenHash, toIso(input.createdAt), toIso(input.expiresAt), input.absoluteExpiresAt ? toIso(input.absoluteExpiresAt) : null, input.userAgent ?? null, input.ipAddress ?? null);
+      ip_address,
+      client_name,
+      access_expires_at,
+      refresh_token_hash
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(projectId, id, userId, strategyId, audience, tokenHash, toIso(input.createdAt), toIso(input.expiresAt), input.absoluteExpiresAt ? toIso(input.absoluteExpiresAt) : null, input.userAgent ?? null, input.ipAddress ?? null, input.bearer ? assertNonEmpty(input.bearer.clientName, "Session client name") : null, input.bearer ? toIso(input.bearer.accessExpiresAt) : null, input.bearer ? assertNonEmpty(input.bearer.refreshTokenHash, "Refresh token hash") : null);
   const session = getSessionById(db, { projectId, id });
   if (!session) {
     throw new AuthStorageError("missing_session", `[Sixb] Failed to load session '${id}' for project '${projectId}'.`);
@@ -7550,10 +7970,10 @@ function createAuthAccessToken(db, input) {
   const id = assertNonEmpty(input.id, "Access token id");
   const projectId = assertNonEmpty(input.projectId, "Project id");
   const name = assertNonEmpty(input.name, "Access token name");
-  const subjectId = assertNonEmpty(input.subjectId, "Access token subject id");
+  const subjectId = assertNonEmpty(input.subject.id, "Access token subject id");
   const tokenHash = assertNonEmpty(input.tokenHash, "Access token hash");
   assertKindMatchesSubject(input);
-  assertSubjectExists(db, projectId, input.subjectType, subjectId);
+  assertSubjectExists(db, projectId, input.subject.type, subjectId);
   const groupIds = input.groupIds === undefined ? undefined : normalizeGroupIds(input.groupIds);
   try {
     db.query(`
@@ -7572,7 +7992,7 @@ function createAuthAccessToken(db, input) {
             created_at,
             expires_at
           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-        `).run(projectId, id, name, input.kind, input.subjectType, subjectId, tokenHash, serializeOptionalStringArray(groupIds), input.createdByPrincipal?.type ?? null, input.createdByPrincipal?.id ?? null, input.createdBySessionId ?? null, toIso(input.createdAt), toIso(input.expiresAt));
+        `).run(projectId, id, name, input.kind, input.subject.type, subjectId, tokenHash, serializeOptionalStringArray(groupIds), input.createdByPrincipal?.type ?? null, input.createdByPrincipal?.id ?? null, input.createdBySessionId ?? null, toIso(input.createdAt), toIso(input.expiresAt));
   } catch (error) {
     mapUniqueConstraintError(error, "duplicate_access_token", `[Sixb] Access token '${id}' already exists for project '${projectId}'.`);
   }
@@ -7603,13 +8023,9 @@ class SqliteAuthAccessTokenStore {
       whereClauses.push("kind = ?");
       args.push(input.kind);
     }
-    if (input.subjectType) {
-      whereClauses.push("subject_type = ?");
-      args.push(input.subjectType);
-    }
-    if (input.subjectId) {
-      whereClauses.push("subject_id = ?");
-      args.push(input.subjectId);
+    if (input.subject) {
+      whereClauses.push("subject_type = ?", "subject_id = ?");
+      args.push(input.subject.type, input.subject.id);
     }
     if (!input.includeRevoked) {
       whereClauses.push("revoked_at IS NULL");
@@ -7693,10 +8109,10 @@ function assertSubjectExists(db, projectId, subjectType, subjectId) {
   throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${subjectId}' not found for project '${projectId}'.`);
 }
 function assertKindMatchesSubject(input) {
-  if (input.kind === "personal" && input.subjectType === "user" || input.kind === "serviceAccount" && input.subjectType === "serviceAccount") {
+  if (input.kind === "personal" && input.subject.type === "user" || input.kind === "serviceAccount" && input.subject.type === "serviceAccount") {
     return;
   }
-  throw new AuthStorageError2("invalid_input", `[Sixb] Access token kind '${input.kind}' cannot target subject type '${input.subjectType}'.`);
+  throw new AuthStorageError2("invalid_input", `[Sixb] Access token kind '${input.kind}' cannot target subject type '${input.subject.type}'.`);
 }
 
 // src/auth-storage/device-authorizations.ts
@@ -7716,10 +8132,10 @@ class SqliteAuthDeviceAuthorizationStore {
       try {
         this.db.query(`
           INSERT INTO auth_device_authorizations (
-            project_id, id, device_code_hash, user_code, client_name, token_name,
-            token_expires_at, status, created_at, expires_at
-          ) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)
-        `).run(assertNonEmpty(input.projectId, "Project id"), assertNonEmpty(input.id, "Device authorization id"), assertNonEmpty(input.deviceCodeHash, "Device code hash"), assertNonEmpty(input.userCode, "User code"), assertNonEmpty(input.clientName, "Client name"), assertNonEmpty(input.tokenName, "Token name"), toIso(input.tokenExpiresAt), toIso(input.createdAt), toIso(input.expiresAt));
+            project_id, id, device_code_hash, user_code, client_name, status, created_at,
+            expires_at
+          ) VALUES (?, ?, ?, ?, ?, 'pending', ?, ?)
+        `).run(assertNonEmpty(input.projectId, "Project id"), assertNonEmpty(input.id, "Device authorization id"), assertNonEmpty(input.deviceCodeHash, "Device code hash"), assertNonEmpty(input.userCode, "User code"), assertNonEmpty(input.clientName, "Client name"), toIso(input.createdAt), toIso(input.expiresAt));
       } catch (error) {
         mapUniqueConstraintError(error, "duplicate_device_authorization", `[Sixb] Device authorization '${input.id}' already exists for project '${input.projectId}'.`);
       }
@@ -8385,11 +8801,48 @@ class SqliteAuthSessionStore {
   }
   async findValidByTokenHash(params) {
     const row = getSessionRowById(this.db, params);
-    if (!row || row.audience !== params.audience || row.token_hash !== params.tokenHash || row.revoked_at || new Date(row.expires_at) <= params.now || row.absolute_expires_at !== null && new Date(row.absolute_expires_at) <= params.now) {
+    if (!row || row.refresh_token_hash !== null || row.audience !== params.audience || row.token_hash !== params.tokenHash || !isLiveSessionRow(row, params.now)) {
+      return null;
+    }
+    return rowToSessionRecord(row);
+  }
+  async findValidByAccessTokenHash(params) {
+    const row = getSessionRowById(this.db, params);
+    if (!row || row.access_expires_at === null || row.token_hash !== params.tokenHash || new Date(row.access_expires_at) <= params.now || !isLiveSessionRow(row, params.now)) {
       return null;
     }
     return rowToSessionRecord(row);
   }
+  async rotateRefreshToken(params) {
+    return runImmediateTransaction(this.db, () => {
+      const row = getSessionRowById(this.db, params);
+      if (!row?.refresh_token_hash || !isLiveSessionRow(row, params.now)) {
+        return { status: "invalid" };
+      }
+      const replacedRecently = row.previous_refresh_token_hash === params.refreshTokenHash && row.refreshed_at !== null && params.now.getTime() - new Date(row.refreshed_at).getTime() <= params.reuseGraceMs;
+      if (row.refresh_token_hash !== params.refreshTokenHash && !replacedRecently) {
+        if (row.previous_refresh_token_hash !== params.refreshTokenHash) {
+          return { status: "invalid" };
+        }
+        this.db.query("UPDATE auth_sessions SET revoked_at = ? WHERE project_id = ? AND id = ?").run(toIso(params.now), params.projectId, params.id);
+        return { status: "reused" };
+      }
+      const expiresAt = toIso(params.next.expiresAt);
+      this.db.query(`
+          UPDATE auth_sessions
+          SET token_hash = ?,
+              access_expires_at = ?,
+              previous_refresh_token_hash = refresh_token_hash,
+              refresh_token_hash = ?,
+              refreshed_at = ?,
+              last_seen_at = ?,
+              expires_at = MAX(expires_at, MIN(?, COALESCE(absolute_expires_at, ?)))
+          WHERE project_id = ? AND id = ?
+        `).run(params.next.tokenHash, toIso(params.next.accessExpiresAt), params.next.refreshTokenHash, toIso(params.now), toIso(params.now), expiresAt, expiresAt, params.projectId, params.id);
+      const session = getSessionById(this.db, params);
+      return session ? { status: "rotated", session } : { status: "invalid" };
+    });
+  }
   async renewIfValid(params) {
     return runImmediateTransaction(this.db, () => {
       const now = toIso(params.now);
@@ -8405,6 +8858,7 @@ class SqliteAuthSessionStore {
             AND id = ?
             AND audience = ?
             AND token_hash = ?
+            AND refresh_token_hash IS NULL
             AND revoked_at IS NULL
             AND expires_at > ?
             AND (absolute_expires_at IS NULL OR absolute_expires_at > ?)
@@ -8450,6 +8904,9 @@ class SqliteAuthSessionStore {
     });
   }
 }
+function isLiveSessionRow(row, now) {
+  return row.revoked_at === null && new Date(row.expires_at) > now && (row.absolute_expires_at === null || new Date(row.absolute_expires_at) > now);
+}
 
 // src/auth-storage/users.ts
 import { AuthStorageError as AuthStorageError10 } from "@sixb/core/storage";
@@ -8620,7 +9077,7 @@ class SqliteAuthStorage {
         throw new AuthStorageError11("missing_device_authorization", `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`);
       }
       assertCompletableDeviceAuthorization(authorization, input);
-      const accessToken = createAuthAccessToken(this.db, input.accessToken);
+      const session = createSession(this.db, input.session);
       this.db.query(`
         UPDATE auth_device_authorizations
         SET status = 'consumed', consumed_at = ?
@@ -8632,7 +9089,7 @@ class SqliteAuthStorage {
           status: "consumed",
           consumedAt: new Date(input.completedAt)
         },
-        accessToken
+        session
       };
     });
   }
@@ -9073,7 +9530,7 @@ function assertCompletableDeviceAuthorization(authorization, input) {
   if (authorization.status === "denied") {
     throw new AuthStorageError11("device_authorization_denied", "[Sixb] Device authorization was denied.");
   }
-  if (authorization.status !== "approved" || authorization.expiresAt <= input.completedAt || !authorization.approvedUserId || !authorization.approvedSessionId || input.accessToken.projectId !== input.projectId || input.accessToken.subjectType !== "user" || input.accessToken.subjectId !== authorization.approvedUserId || input.accessToken.createdBySessionId !== authorization.approvedSessionId) {
+  if (authorization.status !== "approved" || authorization.expiresAt <= input.completedAt || !authorization.approvedUserId || !authorization.approvedSessionId || input.session.projectId !== input.projectId || input.session.userId !== authorization.approvedUserId) {
     throw new AuthStorageError11("invalid_device_authorization", "[Sixb] Device authorization is invalid.");
   }
 }
@@ -9652,13 +10109,131 @@ function isDuplicateExecutionError(error) {
   return error instanceof Error && error.message.includes("UNIQUE constraint failed: executions.project_id, executions.id");
 }
 
+// src/file-upload-session-storage.ts
+import {
+  DurableFileUploadSessions,
+  fileUploadSessionReapAt,
+  parseFileUploadSessionRow
+} from "@sixb/core/internal/file-upload-session-storage-provider";
+class SqliteFileUploadSessionStorage extends DurableFileUploadSessions {
+  constructor(connection) {
+    super(new SqliteFileUploadSessionBackend(connection.db));
+  }
+}
+
+class SqliteFileUploadSessionBackend {
+  db;
+  persistence;
+  constructor(db) {
+    this.db = db;
+    this.persistence = new SqliteFileUploadSessionPersistence(db);
+  }
+  read(run) {
+    return run(this.persistence);
+  }
+  transaction(run) {
+    return runImmediateTransactionAsync(this.db, () => run(this.persistence));
+  }
+}
+
+class SqliteFileUploadSessionPersistence {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async now() {
+    const row = this.db.query("SELECT strftime('%Y-%m-%dT%H:%M:%fZ', 'now') AS now").get();
+    return new Date(row.now);
+  }
+  async insert(session) {
+    try {
+      this.db.query(`INSERT INTO file_upload_sessions (
+            id, project_id, owner_principal_type, owner_principal_id, strategy, status, file_name,
+            media_type, logical_path, expected_size_bytes, expected_digest, provider_upload, signed_parts, file_ref,
+            created_at, expires_at, completed_at, aborted_at, reap_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(session.id, session.projectId, session.principal.type, session.principal.id, session.strategy, session.status, session.fileName ?? null, session.mediaType ?? null, session.logicalPath ?? null, session.expectedSizeBytes ?? null, session.expectedDigest ?? null, ...mutableColumns(session));
+      return true;
+    } catch (error) {
+      if (isUniqueConstraintError2(error))
+        return false;
+      throw error;
+    }
+  }
+  async get(uploadId) {
+    const row = this.db.query(`${SELECT_SESSION} WHERE id = ?`).get(uploadId);
+    return row ? parseFileUploadSessionRow(row) : null;
+  }
+  async update(session) {
+    this.db.query(`UPDATE file_upload_sessions
+         SET status = ?, provider_upload = ?, signed_parts = ?, file_ref = ?, created_at = ?,
+             expires_at = ?, completed_at = ?, aborted_at = ?, reap_at = ?
+         WHERE id = ?`).run(session.status, ...mutableColumns(session), session.id);
+  }
+  async listAbandoned(input) {
+    const rows = this.db.query(`${SELECT_SESSION}
+         WHERE project_id = ? AND status = 'pending' AND provider_upload IS NOT NULL
+           AND expires_at <= ?
+         ORDER BY expires_at, id
+         LIMIT ?`).all(input.projectId, input.now.toISOString(), input.limit);
+    return rows.map((row) => parseFileUploadSessionRow(row));
+  }
+  async deleteReapable(now) {
+    return this.db.query("DELETE FROM file_upload_sessions WHERE reap_at IS NOT NULL AND reap_at <= ?").run(now.toISOString()).changes;
+  }
+}
+var SELECT_SESSION = `
+  SELECT id, project_id AS projectId, owner_principal_type AS ownerPrincipalType,
+    owner_principal_id AS ownerPrincipalId, strategy, status,
+    file_name AS fileName, media_type AS mediaType, logical_path AS logicalPath,
+    expected_size_bytes AS expectedSizeBytes, expected_digest AS expectedDigest,
+    provider_upload AS providerUpload, signed_parts AS signedParts, file_ref AS fileRef,
+    created_at AS createdAt, expires_at AS expiresAt, completed_at AS completedAt,
+    aborted_at AS abortedAt
+  FROM file_upload_sessions`;
+function mutableColumns(session) {
+  return [
+    session.providerUpload === undefined ? null : JSON.stringify(session.providerUpload),
+    JSON.stringify(session.signedParts),
+    session.fileRef === undefined ? null : JSON.stringify(session.fileRef),
+    session.createdAt.toISOString(),
+    session.expiresAt.toISOString(),
+    session.completedAt?.toISOString() ?? null,
+    session.abortedAt?.toISOString() ?? null,
+    fileUploadSessionReapAt(session)?.toISOString() ?? null
+  ];
+}
+
+// src/objects/storage.ts
+import { hasVectorProfile as hasVectorProfile3 } from "@sixb/core/internal/query";
+
 // src/objects/query-compiler.ts
 import {
   ObjectQueryExecutionError
 } from "@sixb/core";
+import {
+  hasVectorProfile,
+  isVectorProfileQuery,
+  normalizeVector,
+  vectorSearchCandidateLimit
+} from "@sixb/core/internal/query";
+
+// src/vector-encoding.ts
+function encodeSqliteVector(values) {
+  const bytes = new Uint8Array(values.length * 4);
+  const view = new DataView(bytes.buffer);
+  for (let index = 0;index < values.length; index++) {
+    view.setFloat32(index * 4, values[index], true);
+  }
+  return bytes;
+}
+
+// src/objects/query-compiler.ts
 var PAGE_TOKEN_PREFIX = "keyset:";
 var DEFAULT_EXPANSION_FANOUT = 1000;
 function compileObjectQuery(projectId, query, options = {}) {
+  if (hasVectorProfile(query) && !isVectorProfileQuery(query)) {
+    throw new ObjectQueryExecutionError("unsupported_vector_composition", "Vector search supports one profile with filters before ranking and limit/project after.");
+  }
   const source = options.source ?? DEFAULT_OBJECT_QUERY_SOURCE;
   const ctx = { probeLimit: options.includeTotal === false, source };
   return source.wrapQuery(compileObjectQueryInternal(projectId, query, ctx));
@@ -9697,8 +10272,59 @@ function compileObjectQueryInternal(projectId, query, ctx) {
     case "expand":
       return compileExpand(projectId, query.input, query.expansions, ctx);
     case "vector":
-      throw new Error(`[Sixb] SQLite object storage does not support query node '${query.kind}'`);
-  }
+      return compileVector(projectId, query, ctx);
+  }
+}
+function compileVector(projectId, query, ctx) {
+  if (typeof query.vector === "string" || !isVectorProfileQuery(query) || !query.configuration || !Number.isSafeInteger(query.k) || query.k < 1 || query.k > 1000 || query.vector.length < 1 || query.vector.length > 16000) {
+    throw new ObjectQueryExecutionError("invalid_vector_query", "A validated named vector profile is required.");
+  }
+  const input = compileObjectQueryInternal(projectId, query.input, exactContext(ctx));
+  const permissions = ctx.source.objectPropertyPermissionsTable;
+  const permissionJoin = permissions ? `CROSS JOIN (
+      SELECT project_id, object_type_id, primary_id, json_group_array(property_id) AS property_ids
+      FROM ${permissions}
+      GROUP BY project_id, object_type_id, primary_id
+    ) AS vector_permissions ON vector_permissions.project_id = vectors.project_id
+      AND vector_permissions.object_type_id = vectors.object_type_id
+      AND vector_permissions.primary_id = vectors.primary_id` : "";
+  const authorized = permissions ? `AND NOT EXISTS (
+    SELECT 1 FROM json_each(vectors.source) AS required
+    WHERE required.value NOT IN (SELECT value FROM json_each(vector_permissions.property_ids))
+  )` : "";
+  const candidates = `FROM (${input.sql}) AS input
+    CROSS JOIN object_vectors AS vectors ON vectors.project_id = input.project_id
+      AND vectors.object_type_id = input.object_type_id AND vectors.primary_id = input.primary_id
+    ${permissionJoin}
+    WHERE vectors.profile = ? AND vectors.configuration = ?
+      AND length(vectors.embedding) / 4 = ? ${authorized}`;
+  const candidateArgs = [...input.args, query.profile, query.configuration, query.vector.length];
+  const limit = vectorSearchCandidateLimit(query.vector.length);
+  const values = normalizeVector(query.vector, query.vector.length);
+  const order = compileOrder([
+    { kind: "column", column: "_vector_score", direction: "desc" },
+    ...identityOrderFields().map((field) => ({ ...field, binary: true }))
+  ]);
+  const sql = `SELECT * FROM (SELECT input.*, max(-1, min(1, 1 - vec_distance_cosine(vectors.embedding, ?))) AS _vector_score
+    ${candidates}) AS ranked ORDER BY ${order.sql} LIMIT ?`;
+  const args = [encodeSqliteVector(values), ...candidateArgs, query.k];
+  return {
+    sql,
+    args,
+    totalSql: `SELECT COUNT(*) AS total FROM (SELECT 1 ${candidates} LIMIT ?) AS eligible`,
+    totalArgs: [...candidateArgs, query.k],
+    order,
+    vectorProbe: {
+      sql: `SELECT COUNT(*) AS total FROM (SELECT 1 ${candidates} LIMIT ?) AS candidates`,
+      args: [...candidateArgs, limit + 1],
+      limit
+    },
+    hasMore: () => false,
+    trimRows: identityRows,
+    nextPageToken: () => {
+      return;
+    }
+  };
 }
 function compileStart(projectId, query, ctx) {
   if (query.includeSubtypes === true) {
@@ -9788,6 +10414,7 @@ function compileWhere(projectId, inputQuery, predicate, ctx) {
       WHERE ${predicate.sql}
     `,
     totalArgs: [...input.args, ...predicate.args],
+    vectorProbe: input.vectorProbe,
     order: input.order,
     hasMore: () => false,
     trimRows: identityRows,
@@ -9818,7 +10445,7 @@ function compileSort(projectId, inputQuery, fields, ctx) {
         input.created_at,
         input.updated_at,
         input.version,
-        input.last_commit_id
+        input.last_commit_id${input.vectorProbe ? ", input._vector_score" : ""}
       FROM (${input.sql}) AS input
       ORDER BY ${order.sql}
     `,
@@ -9849,6 +10476,7 @@ function compileLimit(projectId, inputQuery, rawLimit, ctx) {
       FROM (${input.sql}) AS input
     `,
     totalArgs: input.args,
+    vectorProbe: input.vectorProbe,
     order: input.order,
     hasMore: (rowCount, total) => total === undefined ? ctx.probeLimit && rowCount > limit : limit < total,
     trimRows: ctx.probeLimit ? (rows) => rows.slice(0, limit) : identityRows,
@@ -9877,6 +10505,7 @@ function compilePage(projectId, inputQuery, rawPageSize, pageToken, ctx) {
       FROM (${input.sql}) AS input
     `,
     totalArgs: input.args,
+    vectorProbe: input.vectorProbe,
     order: input.order,
     hasMore: (rowCount) => rowCount > pageSize,
     trimRows: (rows) => rows.slice(0, pageSize),
@@ -9953,6 +10582,7 @@ function compileExpand(projectId, inputQuery, expansions, ctx) {
     args: [...expand.args, ...input.args, ...inputOrder.args],
     totalSql: input.totalSql,
     totalArgs: input.totalArgs,
+    vectorProbe: input.vectorProbe,
     order: input.order,
     hasMoreProbe: input.hasMoreProbe,
     hasMore: input.hasMore,
@@ -10123,13 +10753,14 @@ function compileProject(projectId, inputQuery, properties, ctx) {
         input.created_at,
         input.updated_at,
         input.version,
-        input.last_commit_id
+        input.last_commit_id${input.vectorProbe ? ", input._vector_score" : ""}
       FROM (${input.sql}) AS input
       ORDER BY ${inputOrder.sql}
     `,
     args: [...projection.args, ...input.args, ...inputOrder.args],
     totalSql: input.totalSql,
     totalArgs: input.totalArgs,
+    vectorProbe: input.vectorProbe,
     order: outputOrder,
     hasMoreProbe: input.hasMoreProbe,
     hasMore: input.hasMore,
@@ -10206,9 +10837,9 @@ function compilePredicate(predicate) {
       return negatePredicate(item);
     }
     case "eq":
-      return compileEqualityPredicate(predicate.propertyId, "eq", predicate.value);
+      return predicate.scalarKind === "userRef" ? compileUserRefInPredicate(predicate.propertyId, [predicate.value]) : compileEqualityPredicate(predicate.propertyId, "eq", predicate.value);
     case "neq":
-      return compileEqualityPredicate(predicate.propertyId, "neq", predicate.value);
+      return predicate.scalarKind === "userRef" ? negatePredicate(compileUserRefInPredicate(predicate.propertyId, [predicate.value])) : compileEqualityPredicate(predicate.propertyId, "neq", predicate.value);
     case "lt":
     case "lte":
     case "gt":
@@ -10220,16 +10851,52 @@ function compilePredicate(predicate) {
       };
     }
     case "in":
-      return compileInPredicate(predicate.propertyId, predicate.values);
+      return predicate.scalarKind === "userRef" ? compileUserRefInPredicate(predicate.propertyId, predicate.values) : compileInPredicate(predicate.propertyId, predicate.values);
     case "exists": {
       const sql = `${jsonTypeExpression()} IS NOT NULL`;
       const item = { sql, args: [jsonPath(predicate.propertyId)] };
       return predicate.value ? item : negatePredicate(item);
     }
     case "contains":
-      return compileContainsPredicate(predicate.propertyId, predicate.value);
+      return predicate.scalarKind === "userRef" ? compileUserRefContainsPredicate(predicate.propertyId, predicate.value) : compileContainsPredicate(predicate.propertyId, predicate.value);
   }
 }
+function compileUserRefInPredicate(propertyId, values) {
+  const path = jsonPath(propertyId);
+  const ids = values.flatMap((value) => {
+    const id = userRefId(value);
+    return id === undefined ? [] : [id];
+  });
+  const clauses = [];
+  const args = [];
+  if (values.includes(null)) {
+    clauses.push(`${jsonTypeExpression()} = 'null'`);
+    args.push(path);
+  }
+  if (ids.length > 0) {
+    clauses.push(`(${jsonValueExpression()} = 'user' AND ${jsonValueExpression()} IN (${ids.map(() => "?").join(", ")}))`);
+    args.push(`${path}.type`, `${path}.id`, ...ids);
+  }
+  if (clauses.length === 0)
+    return { sql: "0 = 1", args: [] };
+  return { sql: `(${clauses.join(" OR ")})`, args };
+}
+function compileUserRefContainsPredicate(propertyId, value) {
+  const id = userRefId(value);
+  if (id === undefined)
+    return { sql: "0 = 1", args: [] };
+  const path = jsonPath(propertyId);
+  return {
+    sql: `(${jsonTypeExpression()} = 'array' AND EXISTS (SELECT 1 FROM json_each(properties, ?) AS item WHERE item.type = 'object' AND json_extract(item.value, '$.type') = 'user' AND json_extract(item.value, '$.id') = ?))`,
+    args: [path, path, id]
+  };
+}
+function userRefId(value) {
+  if (typeof value !== "object" || value === null)
+    return;
+  const { type, id } = value;
+  return type === "user" && typeof id === "string" ? id : undefined;
+}
 function negatePredicate(predicate) {
   return {
     sql: `(NOT COALESCE((${predicate.sql}), 0))`,
@@ -10324,7 +10991,7 @@ function compileOrder(fields, qualifier, propertyColumn = "properties") {
   const args = [];
   for (const field of fields) {
     if (field.kind === "column") {
-      clauses.push(`${columnExpression(field.column, qualifier)} ${field.direction.toUpperCase()}`);
+      clauses.push(`${columnExpression(field.column, qualifier)}${field.binary ? " COLLATE BINARY" : ""} ${field.direction.toUpperCase()}`);
       continue;
     }
     const direction = field.direction === "desc" ? "DESC" : "ASC";
@@ -10510,6 +11177,8 @@ function isPlainObject(value) {
 }
 
 // src/objects/reader.ts
+import { ObjectQueryExecutionError as ObjectQueryExecutionError3 } from "@sixb/core";
+import { hasVectorProfile as hasVectorProfile2 } from "@sixb/core/internal/query";
 import { linkBatchKey, objectBatchKey } from "@sixb/core/storage";
 
 // src/objects/rows.ts
@@ -10526,7 +11195,10 @@ function rowToObject(row) {
   };
 }
 function queryRowToObject(row) {
-  const base = rowToObject(row);
+  const base = {
+    ...rowToObject(row),
+    ...row._vector_score === undefined ? {} : { score: row._vector_score }
+  };
   const links = reviveExpandedLinks(parseExpandColumn(row._expand));
   return links ? { ...base, links } : base;
 }
@@ -10589,6 +11261,25 @@ function isPlainObject2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+// src/objects/vector-extension.ts
+import { ObjectQueryExecutionError as ObjectQueryExecutionError2 } from "@sixb/core";
+import { load } from "sqlite-vec";
+var loaded = new WeakSet;
+function ensureSqliteVectorSearch(db) {
+  if (loaded.has(db))
+    return;
+  const options = db.query("PRAGMA compile_options").all();
+  if (options.some((option) => option.compile_options === "OMIT_LOAD_EXTENSION")) {
+    throw new ObjectQueryExecutionError2("vector_extension_missing", "SQLite vector search requires extension support. On macOS install SQLite (brew install sqlite), then call Database.setCustomSQLite with its library path before opening any database.");
+  }
+  try {
+    load(db);
+    loaded.add(db);
+  } catch (cause) {
+    throw new Error("[SixbSqlite] Could not load sqlite-vec for vector search. Check that its native package supports your platform.", { cause });
+  }
+}
+
 // src/objects/reader.ts
 class SqliteObjectReader {
   db;
@@ -10597,7 +11288,21 @@ class SqliteObjectReader {
     this.db = db;
     this.source = source;
   }
+  assertVectorSearch(params) {
+    if (!hasVectorProfile2(params.query))
+      return;
+    const compiled = compileObjectQuery(params.projectId, params.query, { source: this.source });
+    if (!compiled.vectorProbe)
+      return;
+    ensureSqliteVectorSearch(this.db);
+    const probe = compiled.vectorProbe;
+    const row = this.db.query(probe.sql).get(...probe.args);
+    if (Number(row?.total ?? 0) > probe.limit) {
+      throw new ObjectQueryExecutionError3("vector_work_limit_exceeded", `Exact vector search supports at most ${probe.limit} eligible vectors at this dimension. Narrow the query filters.`);
+    }
+  }
   queryObjects(params) {
+    this.assertVectorSearch(params);
     const source = this.source;
     const compiled = compileObjectQuery(params.projectId, params.query, {
       includeTotal: params.includeTotal,
@@ -10615,6 +11320,7 @@ class SqliteObjectReader {
     };
   }
   countObjects(params) {
+    this.assertVectorSearch(params);
     const source = this.source;
     return {
       count: readTotal(this.db, compileObjectQuery(params.projectId, stripOuterRowShape(params.query), {
@@ -10623,6 +11329,7 @@ class SqliteObjectReader {
     };
   }
   existsObjects(params) {
+    this.assertVectorSearch(params);
     const source = this.source;
     const compiled = compileObjectQuery(params.projectId, existsProbeQuery(params.query), {
       source
@@ -10630,6 +11337,7 @@ class SqliteObjectReader {
     return { exists: this.db.query(compiled.sql).get(...compiled.args) !== null };
   }
   facetObjects(params) {
+    this.assertVectorSearch(params);
     const source = this.source;
     const compiled = compileObjectQuery(params.projectId, stripOuterRowShape(params.query), {
       source
@@ -10919,6 +11627,9 @@ function sqliteFacetValue(valueType, value) {
     return false;
   if (valueType === "null")
     return null;
+  if ((valueType === "object" || valueType === "array") && typeof value === "string") {
+    return JSON.parse(value);
+  }
   return value;
 }
 function existsProbeQuery(query) {
@@ -10966,6 +11677,7 @@ ${sql}`,
     wrapQuery: (query) => ({
       ...query,
       ...wrapStatement(query.sql, query.args),
+      vectorProbe: query.vectorProbe ? { ...query.vectorProbe, ...wrapStatement(query.vectorProbe.sql, query.vectorProbe.args) } : undefined,
       totalSql: `${compiled.sql}
 ${query.totalSql}`,
       totalArgs: [...compiled.args, ...query.totalArgs],
@@ -11052,16 +11764,16 @@ function compileSelectedReadScopeCte(scopeJson, projectId) {
 
         SELECT edge.project_id, selection.node_id, edge.target_type_id, edge.target_id
         FROM _sixb_scope_reachable AS parent
-        JOIN _sixb_scope_link_selections AS selection
+        CROSS JOIN _sixb_scope_link_selections AS selection
           ON selection.parent_node_id = parent.node_id
          AND selection.source_object_type_id = parent.object_type_id
-        JOIN links AS edge
+        CROSS JOIN links AS edge
           ON edge.project_id = parent.project_id
          AND edge.source_type_id = parent.object_type_id
          AND edge.source_id = parent.primary_id
          AND edge.link_id = selection.link_id
          AND edge.target_type_id = selection.target_object_type_id
-        JOIN objects AS target
+        CROSS JOIN objects AS target
           ON target.project_id = edge.project_id
          AND target.object_type_id = edge.target_type_id
          AND target.primary_id = edge.target_id
@@ -11082,32 +11794,29 @@ function compileSelectedReadScopeCte(scopeJson, projectId) {
         SELECT DISTINCT project_id, object_type_id, primary_id
         FROM _sixb_scope_reachable
       ),
+      _sixb_scope_object_grants AS (
+        SELECT reachable.project_id, reachable.object_type_id, reachable.primary_id,
+          json_group_array(DISTINCT selected_property.value) FILTER (WHERE selected_property.value IS NOT NULL) AS property_ids
+        FROM _sixb_scope_reachable AS reachable
+        LEFT JOIN _sixb_scope_object_selections AS selection
+          ON selection.node_id = reachable.node_id
+         AND selection.object_type_id = reachable.object_type_id
+        LEFT JOIN json_each(selection.property_ids) AS selected_property ON true
+        GROUP BY reachable.project_id, reachable.object_type_id, reachable.primary_id
+      ),
       _sixb_scope_objects AS (
-        SELECT
-          stored.project_id,
-          stored.object_type_id,
-          stored.primary_id,
-          COALESCE(
-            (
-              SELECT json_group_object(property.key, ${sqliteJsonEachValue("property")})
-              FROM json_each(stored.properties) AS property
-              JOIN _sixb_scope_object_permissions AS permission
-                ON permission.project_id = stored.project_id
-               AND permission.object_type_id = stored.object_type_id
-               AND permission.primary_id = stored.primary_id
-               AND permission.property_id = property.key
-            ),
-            json('{}')
-          ) AS properties,
-          stored.created_at,
-          stored.updated_at,
-          stored.version,
-          stored.last_commit_id
-        FROM objects AS stored
-        JOIN _sixb_scope_object_ids AS visible
-          ON visible.project_id = stored.project_id
-         AND visible.object_type_id = stored.object_type_id
-         AND visible.primary_id = stored.primary_id
+        SELECT stored.project_id, stored.object_type_id, stored.primary_id,
+          COALESCE((
+            SELECT json_group_object(property.key, ${sqliteJsonEachValue("property")})
+            FROM json_each(stored.properties) AS property
+            WHERE property.key IN (SELECT value FROM json_each(grants.property_ids))
+          ), json('{}')) AS properties,
+          stored.created_at, stored.updated_at, stored.version, stored.last_commit_id
+        FROM _sixb_scope_object_grants AS grants
+        CROSS JOIN objects AS stored
+          ON stored.project_id = grants.project_id
+         AND stored.object_type_id = grants.object_type_id
+         AND stored.primary_id = grants.primary_id
       ),
       _sixb_scope_reached_links(
         project_id,
@@ -11133,16 +11842,16 @@ function compileSelectedReadScopeCte(scopeJson, projectId) {
           edge.target_id,
           selection.property_ids
         FROM _sixb_scope_reachable AS parent
-        JOIN _sixb_scope_link_selections AS selection
+        CROSS JOIN _sixb_scope_link_selections AS selection
           ON selection.parent_node_id = parent.node_id
          AND selection.source_object_type_id = parent.object_type_id
-        JOIN links AS edge
+        CROSS JOIN links AS edge
           ON edge.project_id = parent.project_id
          AND edge.source_type_id = parent.object_type_id
          AND edge.source_id = parent.primary_id
          AND edge.link_id = selection.link_id
          AND edge.target_type_id = selection.target_object_type_id
-        JOIN objects AS target
+        CROSS JOIN objects AS target
           ON target.project_id = edge.project_id
          AND target.object_type_id = edge.target_type_id
          AND target.primary_id = edge.target_id
@@ -11314,6 +12023,7 @@ var SQLITE_OBJECT_QUERY_CAPABILITIES = {
     refs: true,
     filter: true,
     text: true,
+    vector: true,
     sort: true,
     limit: true,
     page: true,
@@ -11356,7 +12066,8 @@ var SQLITE_OBJECT_QUERY_CAPABILITIES = {
     double: { equality: true, ordering: true },
     decimal: { equality: true },
     date: { equality: true, ordering: true },
-    timestamp: { equality: true, ordering: true }
+    timestamp: { equality: true, ordering: true },
+    userRef: { equality: true }
   },
   limits: {
     totalCount: true,
@@ -11366,7 +12077,7 @@ var SQLITE_OBJECT_QUERY_CAPABILITIES = {
     "SQLite object query pushdown supports start/refs/filter/text/sort/limit/page/traverse/set/project/expand over JSON properties and object links.",
     "expand hydrates linked objects in-database (top-N per parent via row_number() + json_group_array); core resolves each expansion's cardinality before pushdown, and a mixed/unresolved one stays on the fallback.",
     "Ordered decimal predicates and sorting use the bounded core fallback because SQLite has no native exact decimal type; canonical decimal equality remains pushdown-safe.",
-    "Relevance sorting, vector search, and unresolved start.includeSubtypes remain planner fallback or rejection cases."
+    "Relevance sorting and unresolved start.includeSubtypes remain planner fallback or rejection cases."
   ]
 };
 
@@ -11389,15 +12100,23 @@ class SqliteObjectStorage {
     return createSqliteSelectedReader(this.db, params, () => this.queryCapabilities());
   }
   async queryObjects(params) {
+    if (hasVectorProfile3(params.query))
+      return runDeferredReadTransaction(this.db, () => this.reader.queryObjects(params));
     return this.reader.queryObjects(params);
   }
   async countObjects(params) {
+    if (hasVectorProfile3(params.query))
+      return runDeferredReadTransaction(this.db, () => this.reader.countObjects(params));
     return this.reader.countObjects(params);
   }
   async existsObjects(params) {
+    if (hasVectorProfile3(params.query))
+      return runDeferredReadTransaction(this.db, () => this.reader.existsObjects(params));
     return this.reader.existsObjects(params);
   }
   async facetObjects(params) {
+    if (hasVectorProfile3(params.query))
+      return runDeferredReadTransaction(this.db, () => this.reader.facetObjects(params));
     return this.reader.facetObjects(params);
   }
   async getByPrimaryId(params) {
@@ -11542,7 +12261,10 @@ function commitRecord(row) {
     requestHash: row.request_hash,
     executionId: row.execution_id,
     origin: parseJson2(row.origin),
-    ...row.actor === null ? {} : { actor: parseJson2(row.actor) },
+    ...row.requested_by === null ? {} : {
+      requestedBy: parseJson2(row.requested_by)
+    },
+    executor: parseJson2(row.executor),
     ontologyRevision: row.ontology_revision,
     ...row.projection_revision === null ? {} : { projectionRevision: row.projection_revision },
     ...row.ownership_hash === null ? {} : { ownershipHash: row.ownership_hash },
@@ -11689,12 +12411,16 @@ import {
   linkRefSortKey,
   linkScopeSortKey as linkScopeSortKey2,
   MaterializationConflictError as MaterializationConflictError6,
+  MaterializationValidationError as MaterializationValidationError2,
   objectRefKey as objectRefKey3,
   objectRefSortKey,
   telemetryPointKey as telemetryPointKey2,
   telemetryPointSortKey as telemetryPointSortKey2
 } from "@sixb/core/internal/materialization";
 import {
+  assertExpectedLinkRevision,
+  assertExpectedLinkScopeRevision,
+  assertExpectedObjectRevision,
   assertMaterializationFinalizationCorrelation,
   assertMaterializationHeader,
   assertMaterializationLaneCompletion,
@@ -13176,6 +13902,12 @@ class SqliteOntologyMaterializationStorage {
     this.sessions = new SqliteMaterializationSessions(db, context);
     this.writer = new SqliteMaterializationWriter(db);
   }
+  assertVectorSession(session, projectId, commitId) {
+    const active = this.sessions.require(session);
+    if (active.header.commit.projectId !== projectId || commitId !== undefined && active.header.commit.id !== commitId) {
+      throw new MaterializationValidationError2("Vector mutation does not belong to this materialization session.");
+    }
+  }
   async begin(input) {
     assertMaterializationHeader(input);
     const session = this.sessions.create(input);
@@ -13184,15 +13916,15 @@ class SqliteOntologyMaterializationStorage {
       const reader = new SqliteMaterializationStateReader(this.db, input.commit.projectId);
       for (const expected of input.expected.sources)
         this.assertSource(expected, input.commit.projectId);
-      for (const expected of input.expected.objects)
-        this.assertObject(reader, expected);
-      for (const expected of input.expected.links)
-        this.assertLink(reader, expected);
+      for (const expected of input.expected.objects) {
+        assertExpectedObjectRevision(reader.effectiveObjectRevision(expected.ref), expected);
+      }
+      for (const expected of input.expected.links) {
+        assertExpectedLinkRevision(reader.effectiveLinkLastCommit(expected.ref), expected);
+      }
       const linkScopeRevisions = reader.linkScopeRevisions(input.expected.linkScopes);
       for (const [index, expected] of input.expected.linkScopes.entries()) {
-        if (linkScopeRevisions[index]?.fingerprint !== expected.fingerprint) {
-          throw new MaterializationConflictError6("effective-state", `Expected link scope changed for ${expected.source.objectTypeId}:${expected.source.primaryId}.${expected.linkId}.`);
-        }
+        assertExpectedLinkScopeRevision(linkScopeRevisions[index]?.fingerprint, expected);
       }
       for (const expected of input.expected.points) {
         const point = reader.exactPoint(expected.series, expected.at);
@@ -13425,30 +14157,6 @@ class SqliteOntologyMaterializationStorage {
       throw new MaterializationConflictError6("projection-fence", `Source '${expected.source.projectionId}' changed.`);
     }
   }
-  assertObject(reader, expected) {
-    const row = reader.effectiveObjectRevision(expected.ref);
-    if (!expected.exists) {
-      if (row) {
-        throw new MaterializationConflictError6("effective-state", `Expected object ${objectRefKey3(expected.ref)} to be absent.`);
-      }
-      return;
-    }
-    if (!row || row.version !== expected.version || row.lastCommitId !== expected.lastCommitId) {
-      throw new MaterializationConflictError6("effective-state", `Expected object ${objectRefKey3(expected.ref)} changed.`);
-    }
-  }
-  assertLink(reader, expected) {
-    const lastCommitId = reader.effectiveLinkLastCommit(expected.ref);
-    if (!expected.exists) {
-      if (lastCommitId !== undefined) {
-        throw new MaterializationConflictError6("effective-state", `Expected link ${linkRefKey3(expected.ref)} to be absent.`);
-      }
-      return;
-    }
-    if (lastCommitId === undefined || lastCommitId !== expected.lastCommitId) {
-      throw new MaterializationConflictError6("effective-state", `Expected link ${linkRefKey3(expected.ref)} changed.`);
-    }
-  }
   async assertFinalization(session, input) {
     const { commit } = session.header;
     const { result } = input.finalization;
@@ -13585,11 +14293,13 @@ class SqliteOntologyMaterializationStorage {
       this.db.query(`
             INSERT INTO ontology_commits (
               project_id, id, idempotency_key, request_hash, execution_id,
-              origin_kind, origin_run_id, origin_batch_ordinal, origin, actor,
+              origin_kind, origin_run_id, origin_batch_ordinal, origin, requested_by, executor,
               ontology_revision, projection_revision, ownership_hash,
               intent, result, committed_at
-            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, json(?), json(?), ?, ?, ?, json(?), json(?), ?)
-          `).run(commit.projectId, commit.id, commit.idempotencyKey, commit.requestHash, commit.executionId, origin.kind, origin.runId, origin.batchOrdinal, canonicalJson(commit.origin), commit.actor === undefined ? null : canonicalJson(commit.actor), commit.ontologyRevision, commit.projectionRevision ?? null, commit.ownershipHash ?? null, canonicalJson(commit.intent), canonicalJson(input.finalization.result), commit.committedAt);
+            ) VALUES (
+              ?, ?, ?, ?, ?, ?, ?, ?, json(?), json(?), json(?), ?, ?, ?, json(?), json(?), ?
+            )
+          `).run(commit.projectId, commit.id, commit.idempotencyKey, commit.requestHash, commit.executionId, origin.kind, origin.runId, origin.batchOrdinal, canonicalJson(commit.origin), commit.requestedBy === undefined ? null : canonicalJson(commit.requestedBy), canonicalJson(commit.executor), commit.ontologyRevision, commit.projectionRevision ?? null, commit.ownershipHash ?? null, canonicalJson(commit.intent), canonicalJson(input.finalization.result), commit.committedAt);
     } catch (error) {
       if (isSqliteConstraintError(error)) {
         throw new MaterializationConflictError6("idempotency", "Ontology commit identity already exists.");
@@ -13613,7 +14323,7 @@ class SqliteOntologyMaterializationStorage {
 import { serializeSixbFailure as serializeSixbFailure2 } from "@sixb/core/internal/errors";
 import {
   MaterializationConflictError as MaterializationConflictError7,
-  MaterializationValidationError as MaterializationValidationError2
+  MaterializationValidationError as MaterializationValidationError3
 } from "@sixb/core/internal/materialization";
 import { ONTOLOGY_OUTBOX_FAILURE_CODES as ONTOLOGY_OUTBOX_FAILURE_CODES2 } from "@sixb/core/storage";
 class SqliteOntologyOutboxStorage {
@@ -13631,7 +14341,7 @@ class SqliteOntologyOutboxStorage {
       const leaseExpiry = assertTimestamp(input.leaseExpiresAt, "Ontology outbox lease expiry");
       assertNonblank(input.leaseId, "Ontology outbox lease id");
       if (leaseExpiry <= now) {
-        throw new MaterializationValidationError2("Ontology outbox lease expiry must be later than the claim time.");
+        throw new MaterializationValidationError3("Ontology outbox lease expiry must be later than the claim time.");
       }
       const eligible = this.db.query(`SELECT CAST(rowid AS TEXT) AS rowId
            FROM ontology_outbox INDEXED BY idx_ontology_outbox_claim
@@ -13756,7 +14466,7 @@ function validateLeaseIds(ids) {
   for (const id of ids) {
     assertNonblank(id, "Ontology outbox event id");
     if (seen.has(id)) {
-      throw new MaterializationValidationError2(`Ontology outbox lease batch repeats event '${id}'.`);
+      throw new MaterializationValidationError3(`Ontology outbox lease batch repeats event '${id}'.`);
     }
     seen.add(id);
   }
@@ -13771,7 +14481,7 @@ function leaseConflict() {
 }
 
 // src/ontology-storage/sources.ts
-import { MaterializationValidationError as MaterializationValidationError3 } from "@sixb/core/internal/materialization";
+import { MaterializationValidationError as MaterializationValidationError4 } from "@sixb/core/internal/materialization";
 import {
   assertSourceBeginInput as assertBeginInput,
   assertSourceExecutionIdentity as assertExecutionIdentity,
@@ -13911,7 +14621,7 @@ class SqliteOntologySourceStorage {
         throw sourceConflict(`Source materialization '${input.materializationId}' cannot transition from '${manifest.status}' to 'ready'.`);
       }
       if (input.readyAt < manifest.created_at) {
-        throw new MaterializationValidationError3("Source readyAt cannot precede source createdAt.");
+        throw new MaterializationValidationError4("Source readyAt cannot precede source createdAt.");
       }
       this.assertReadyState(manifest, input.rootCount, input.assertionCount);
       const result = this.db.query(`
@@ -13994,7 +14704,7 @@ class SqliteOntologySourceStorage {
   }
   transitionToAbandoned(manifest, abandonedAt) {
     if (abandonedAt < manifest.created_at || manifest.ready_at !== null && abandonedAt < manifest.ready_at) {
-      throw new MaterializationValidationError3("Source abandonedAt cannot precede source creation or readiness.");
+      throw new MaterializationValidationError4("Source abandonedAt cannot precede source creation or readiness.");
     }
     const changed = this.db.query(`
           UPDATE ontology_sources
@@ -14019,7 +14729,7 @@ class SqliteOntologySourceStorage {
           WHERE project_id = ? AND source_id = ? AND materialization_id = ?
         `).get(manifest.project_id, manifest.source_id, manifest.materialization_id, manifest.project_id, manifest.source_id, manifest.materialization_id);
     if (counts.assertions !== assertionCount || counts.roots !== rootCount || counts.ordinals !== rootCount || rootCount > 0 && (counts.min_ordinal !== 0 || counts.max_ordinal !== rootCount - 1)) {
-      throw new MaterializationValidationError3("Source ready counts do not match the staged roots and assertions.");
+      throw new MaterializationValidationError4("Source ready counts do not match the staged roots and assertions.");
     }
     assertSourceRootCoverage(this.db, manifest);
     const invalid = this.db.query(manifest.projection_kind === "link" ? `
@@ -14047,7 +14757,7 @@ class SqliteOntologySourceStorage {
               LIMIT 1
             `).get(manifest.project_id, manifest.source_id, manifest.materialization_id);
     if (invalid) {
-      throw new MaterializationValidationError3(manifest.projection_kind === "link" ? "Link projection roots must contain exactly their matching link assertion." : "Object projection roots must contain exactly their matching object assertion plus links sourced from that root.");
+      throw new MaterializationValidationError4(manifest.projection_kind === "link" ? "Link projection roots must contain exactly their matching link assertion." : "Object projection roots must contain exactly their matching object assertion plus links sourced from that root.");
     }
   }
   findStageRows(input, rows) {
@@ -14153,16 +14863,228 @@ class SqliteOntologySourceStorage {
   }
 }
 
+// src/ontology-storage/vector-indexing.ts
+import { parseSixbFailure as parseSixbFailure3 } from "@sixb/core/internal/errors";
+import {
+  VECTOR_INDEXING_FAILURE_CODES
+} from "@sixb/core/storage";
+
+class SqliteVectorIndexingStorage {
+  db;
+  run;
+  assertSession;
+  constructor(db, run, assertSession) {
+    this.db = db;
+    this.run = run;
+    this.assertSession = assertSession;
+  }
+  async schedule(input) {
+    this.assertSession(input.session, input.projectId);
+    for (const ref of input.deleted)
+      this.db.query(`DELETE FROM object_vector_indexing WHERE project_id = ? AND object_type_id = ? AND primary_id = ?`).run(input.projectId, ref.objectTypeId, ref.primaryId);
+    const insert = this.db.query(`INSERT INTO object_vector_indexing (project_id, id, object_type_id, primary_id, profile, batch_id, request, status, available_at, dispatch_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)
+      ON CONFLICT (project_id, object_type_id, primary_id, profile) DO UPDATE SET id = excluded.id, batch_id = excluded.batch_id, request = excluded.request, status = 'pending', available_at = excluded.available_at, dispatch_at = excluded.dispatch_at, values_json = NULL, error = NULL`);
+    for (const { batchId, ...request } of input.requests)
+      insert.run(input.projectId, request.id, request.ref.objectTypeId, request.ref.primaryId, request.profile, batchId ?? null, JSON.stringify(request), input.availableAt, input.availableAt);
+  }
+  async complete(input) {
+    this.assertSession(input.session, input.projectId);
+    const remove = this.db.query(`DELETE FROM object_vector_indexing WHERE project_id = ? AND object_type_id = ? AND primary_id = ? AND profile = ? AND json_extract(request, '$.configuration') = ? AND json_extract(request, '$.sourceFingerprint') = ?`);
+    for (const entry of input.entries) {
+      remove.run(input.projectId, entry.ref.objectTypeId, entry.ref.primaryId, entry.profile, entry.configuration, entry.sourceFingerprint);
+    }
+  }
+  async dispatched(input) {
+    await this.run(() => {
+      const update = this.db.query(`UPDATE object_vector_indexing SET dispatch_at = ? WHERE project_id = ? AND id = ?`);
+      for (const id of input.ids)
+        update.run(input.nextDispatchAt, input.projectId, id);
+    });
+  }
+  async get(input) {
+    return this.run(() => {
+      const row = this.db.query(`SELECT batch_id, request, status, available_at, values_json, error FROM object_vector_indexing WHERE project_id = ? AND id = ?`).get(input.projectId, input.id);
+      return row ? decode(row) : null;
+    });
+  }
+  async getBatch(input) {
+    return this.run(() => this.db.query(`
+      SELECT batch_id, request, status, available_at, values_json, error FROM object_vector_indexing
+      WHERE project_id = ? AND batch_id = ? ORDER BY id`).all(input.projectId, input.batchId).map(decode));
+  }
+  async getBatchMember(input) {
+    return this.run(() => {
+      const row = this.db.query(`
+        SELECT batch_id, request, status, available_at, values_json, error
+        FROM object_vector_indexing WHERE project_id = ? AND object_type_id = ?
+        AND primary_id = ? AND profile = ? AND batch_id = ?`).get(input.projectId, input.ref.objectTypeId, input.ref.primaryId, input.profile, input.batchId);
+      return row ? decode(row) : null;
+    });
+  }
+  async updateBatch(input) {
+    return this.run(() => this.db.transaction(() => {
+      const status = this.db.query("SELECT status FROM object_vector_indexing WHERE project_id = ? AND id = ?");
+      if (input.requireAll && input.updates.some((update) => status.get(input.projectId, update.id)?.status !== update.expectedStatus))
+        return false;
+      const updateRow = this.db.query(`UPDATE object_vector_indexing
+        SET status = ?, available_at = ?, values_json = COALESCE(?, values_json), error = ?
+        WHERE project_id = ? AND id = ? AND status = ?`);
+      for (const update of input.updates)
+        updateRow.run(update.status, update.availableAt, update.values ? JSON.stringify(update.values) : null, update.error ? JSON.stringify(update.error) : null, input.projectId, update.id, update.expectedStatus);
+      return true;
+    })());
+  }
+  async listDue(input) {
+    return this.run(() => this.db.query(`SELECT batch_id, request, status, available_at, NULL AS values_json, error FROM object_vector_indexing WHERE project_id = ? AND status <> 'failed' AND dispatch_at <= ? ORDER BY dispatch_at, id LIMIT ?`).all(input.projectId, input.now, input.limit).map(decode));
+  }
+  async update(input) {
+    return this.run(() => this.db.query(`UPDATE object_vector_indexing SET status = ?, available_at = ?, values_json = COALESCE(?, values_json), error = ? WHERE project_id = ? AND id = ? AND status = ?`).run(input.status, input.availableAt, input.values ? JSON.stringify(input.values) : null, input.error ? JSON.stringify(input.error) : null, input.projectId, input.id, input.expectedStatus).changes === 1);
+  }
+  async remove(input) {
+    await this.run(() => {
+      this.db.query(`DELETE FROM object_vector_indexing WHERE project_id = ? AND id = ?`).run(input.projectId, input.id);
+    });
+  }
+}
+function decode(row) {
+  const request = JSON.parse(row.request);
+  return {
+    ...request,
+    ...row.batch_id ? { batchId: row.batch_id } : {},
+    status: row.status,
+    availableAt: row.available_at,
+    ...row.values_json ? { values: JSON.parse(row.values_json) } : {},
+    ...row.error ? {
+      error: parseSixbFailure3(row.error, VECTOR_INDEXING_FAILURE_CODES)
+    } : {}
+  };
+}
+
+// src/ontology-storage/vectors.ts
+import { MaterializationConflictError as MaterializationConflictError8 } from "@sixb/core/internal/materialization";
+class SqliteOntologyVectorStorage {
+  db;
+  runRootOperation;
+  assertSession;
+  constructor(db, runRootOperation, assertSession) {
+    this.db = db;
+    this.runRootOperation = runRootOperation;
+    this.assertSession = assertSession;
+  }
+  async list(input) {
+    return this.runRootOperation(() => {
+      const rows = this.db.query(`
+        SELECT profile, configuration, source, source_fingerprint, last_commit_id
+        FROM object_vectors
+        WHERE project_id = ? AND object_type_id = ? AND primary_id = ?
+        ORDER BY profile
+      `).all(input.projectId, input.ref.objectTypeId, input.ref.primaryId);
+      return rows.map((row) => ({
+        ref: { ...input.ref },
+        profile: row.profile,
+        configuration: row.configuration,
+        source: JSON.parse(row.source),
+        sourceFingerprint: row.source_fingerprint,
+        lastCommitId: row.last_commit_id
+      }));
+    });
+  }
+  async listBatch(input) {
+    if (!input.refs.length)
+      return [];
+    return this.runRootOperation(() => {
+      const rows = this.db.query(`
+        WITH requested AS (
+          SELECT DISTINCT json_extract(value, '$.objectTypeId') AS object_type_id,
+            json_extract(value, '$.primaryId') AS primary_id FROM json_each(?)
+        )
+        SELECT stored.object_type_id, stored.primary_id, stored.profile, stored.configuration,
+          stored.source, stored.source_fingerprint, stored.last_commit_id
+        FROM requested CROSS JOIN object_vectors AS stored
+        WHERE stored.project_id = ? AND stored.object_type_id = requested.object_type_id
+          AND stored.primary_id = requested.primary_id
+        ORDER BY stored.object_type_id, stored.primary_id, stored.profile
+      `).all(JSON.stringify(input.refs), input.projectId);
+      return rows.map((row) => ({
+        ref: { objectTypeId: row.object_type_id, primaryId: row.primary_id },
+        profile: row.profile,
+        configuration: row.configuration,
+        source: JSON.parse(row.source),
+        sourceFingerprint: row.source_fingerprint,
+        lastCommitId: row.last_commit_id
+      }));
+    });
+  }
+  async removeBatch(input) {
+    this.assertSession(input.session, input.projectId);
+    if (!input.entries.length)
+      return;
+    const { changes } = this.db.query(`
+      DELETE FROM object_vectors WHERE rowid IN (
+        SELECT stored.rowid FROM json_each(?) AS requested CROSS JOIN object_vectors AS stored
+        WHERE stored.project_id = ? AND stored.object_type_id = json_extract(requested.value, '$.ref.objectTypeId')
+          AND stored.primary_id = json_extract(requested.value, '$.ref.primaryId')
+          AND stored.profile = json_extract(requested.value, '$.profile')
+          AND stored.last_commit_id = json_extract(requested.value, '$.expectedCommitId')
+      )
+    `).run(JSON.stringify(input.entries), input.projectId);
+    if (changes !== input.entries.length)
+      throw vectorConflict();
+  }
+  async write(input) {
+    const { value } = input;
+    this.assertSession(input.session, input.projectId, value.lastCommitId);
+    const embedding = encodeSqliteVector(value.values);
+    const changes = input.expectedCommitId === null ? this.db.query(`
+          INSERT INTO object_vectors (
+            project_id, object_type_id, primary_id, profile,
+            configuration, source, source_fingerprint, embedding, last_commit_id
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+          ON CONFLICT (project_id, object_type_id, primary_id, profile) DO NOTHING
+        `).run(input.projectId, value.ref.objectTypeId, value.ref.primaryId, value.profile, value.configuration, JSON.stringify(value.source), value.sourceFingerprint, embedding, value.lastCommitId).changes : this.db.query(`
+          UPDATE object_vectors
+          SET configuration = ?, source = ?, source_fingerprint = ?, embedding = ?, last_commit_id = ?
+          WHERE project_id = ? AND object_type_id = ? AND primary_id = ?
+            AND profile = ? AND last_commit_id = ?
+        `).run(value.configuration, JSON.stringify(value.source), value.sourceFingerprint, embedding, value.lastCommitId, input.projectId, value.ref.objectTypeId, value.ref.primaryId, value.profile, input.expectedCommitId).changes;
+    if (changes !== 1)
+      throw vectorConflict();
+  }
+  async writeBatch(input) {
+    for (const entry of input.entries) {
+      await this.write({ session: input.session, projectId: input.projectId, ...entry });
+    }
+  }
+  async remove(input) {
+    this.assertSession(input.session, input.projectId);
+    const { changes } = this.db.query(`
+      DELETE FROM object_vectors
+      WHERE project_id = ? AND object_type_id = ? AND primary_id = ?
+        AND profile = ? AND last_commit_id = ?
+    `).run(input.projectId, input.ref.objectTypeId, input.ref.primaryId, input.profile, input.expectedCommitId);
+    if (changes !== 1)
+      throw vectorConflict();
+  }
+}
+function vectorConflict() {
+  return new MaterializationConflictError8("effective-state", "Vector changed since it was prepared.");
+}
+
 // src/ontology-storage/index.ts
 class SqliteOntologyStorage {
   commits;
   sources;
   materializations;
+  vectorIndexing;
+  vectors;
   outbox;
   constructor(input) {
     this.commits = new SqliteOntologyCommitStorage(input.db, input.runRootOperation);
     this.sources = new SqliteOntologySourceStorage(input.db, input.runRootOperation);
     this.materializations = new SqliteOntologyMaterializationStorage(input.db, input.transactionContext);
+    this.vectorIndexing = new SqliteVectorIndexingStorage(input.db, input.runRootOperation, (session, projectId) => this.materializations.assertVectorSession(session, projectId));
+    this.vectors = new SqliteOntologyVectorStorage(input.db, input.runRootOperation, (session, projectId, commitId) => this.materializations.assertVectorSession(session, projectId, commitId));
     this.outbox = new SqliteOntologyOutboxStorage(input.db, input.runRootOperation);
   }
   deactivateSessions() {
@@ -14171,7 +15093,7 @@ class SqliteOntologyStorage {
 }
 
 // src/pipeline-run-storage.ts
-import { parseSixbFailure as parseSixbFailure3, serializeSixbFailure as serializeSixbFailure3 } from "@sixb/core/internal/errors";
+import { parseSixbFailure as parseSixbFailure4, serializeSixbFailure as serializeSixbFailure3 } from "@sixb/core/internal/errors";
 import { assertPipelineRunExecution } from "@sixb/core/internal/pipeline-run-storage-provider";
 import { canRequeuePipelineRunAfterEnqueueFailure } from "@sixb/core/internal/storage";
 import { PIPELINE_RUN_FAILURE_CODES, PipelineRunError } from "@sixb/core/storage";
@@ -14493,7 +15415,7 @@ function rowToPipelineRunRecord(row) {
       datasetId: row.output_dataset_id,
       versionId: row.output_version_id
     } : undefined,
-    error: row.error === null ? undefined : parseSixbFailure3(row.error, PIPELINE_RUN_FAILURE_CODES)
+    error: row.error === null ? undefined : parseSixbFailure4(row.error, PIPELINE_RUN_FAILURE_CODES)
   };
 }
 function rowToPipelineStepRunRecord(row) {
@@ -14514,7 +15436,7 @@ function rowToPipelineStepRunRecord(row) {
       versionId: row.output_version_id
     } : undefined,
     rowsWritten: row.rows_written ?? undefined,
-    error: row.error === null ? undefined : parseSixbFailure3(row.error, PIPELINE_RUN_FAILURE_CODES)
+    error: row.error === null ? undefined : parseSixbFailure4(row.error, PIPELINE_RUN_FAILURE_CODES)
   };
 }
 function assertOptionalNonNegativeInteger(value, fieldName) {
@@ -15459,7 +16381,7 @@ function invalidRecord2(message) {
 }
 
 // src/sync-run-storage.ts
-import { parseSixbFailure as parseSixbFailure4, serializeSixbFailure as serializeSixbFailure5 } from "@sixb/core/internal/errors";
+import { parseSixbFailure as parseSixbFailure5, serializeSixbFailure as serializeSixbFailure5 } from "@sixb/core/internal/errors";
 import { canRequeueSyncRunAfterEnqueueFailure } from "@sixb/core/internal/storage";
 import { assertSyncRunExecution } from "@sixb/core/internal/sync-run-storage-provider";
 import { SYNC_RUN_FAILURE_CODES, SyncRunError } from "@sixb/core/storage";
@@ -15662,7 +16584,7 @@ function rowToSyncRunRecord(row) {
     } : undefined,
     expectedLatestVersionId: row.expected_latest_version_id ?? undefined,
     commitMessage: row.commit_message ?? undefined,
-    error: row.error === null ? undefined : parseSixbFailure4(row.error, SYNC_RUN_FAILURE_CODES),
+    error: row.error === null ? undefined : parseSixbFailure5(row.error, SYNC_RUN_FAILURE_CODES),
     checkpoint: parseCheckpoint(row.checkpoint)
   };
 }
@@ -15803,7 +16725,7 @@ class SqliteTimeseriesStorage {
 }
 
 // src/webhook-run-storage.ts
-import { parseSixbFailure as parseSixbFailure5, serializeSixbFailure as serializeSixbFailure6 } from "@sixb/core/internal/errors";
+import { parseSixbFailure as parseSixbFailure6, serializeSixbFailure as serializeSixbFailure6 } from "@sixb/core/internal/errors";
 import { assertWebhookRunExecution } from "@sixb/core/internal/webhook-run-storage-provider";
 import { canRetryWebhookRun, WEBHOOK_RUN_FAILURE_CODES, WebhookRunError } from "@sixb/core/storage";
 class SqliteWebhookRunStorage {
@@ -15949,7 +16871,7 @@ function rowToWebhookRunRecord(row) {
     requestBodySha256: row.request_body_sha256,
     responseStatus: row.response_status ?? undefined,
     idempotencyKey: row.idempotency_key ?? undefined,
-    error: row.error === null ? undefined : parseSixbFailure5(row.error, WEBHOOK_RUN_FAILURE_CODES)
+    error: row.error === null ? undefined : parseSixbFailure6(row.error, WEBHOOK_RUN_FAILURE_CODES)
   };
 }
 
@@ -16005,7 +16927,7 @@ class SqliteWorkflowInterventionStorage {
             submitted_by = ?,
             response = ?
           WHERE project_id = ? AND id = ?
-        `).run("submitted", (input.submittedAt ?? new Date).toISOString(), serializeActor(input.submittedBy), serializeRecord(input.response), existing.project_id, existing.id);
+        `).run("submitted", (input.submittedAt ?? new Date).toISOString(), serializePrincipal(input.submittedBy), serializeRecord(input.response), existing.project_id, existing.id);
       return this.requireIntervention(input.projectId, input.id);
     })();
   }
@@ -16019,7 +16941,7 @@ class SqliteWorkflowInterventionStorage {
             cancelled_at = ?,
             cancelled_by = ?
           WHERE project_id = ? AND id = ?
-        `).run("cancelled", (input.cancelledAt ?? new Date).toISOString(), serializeActor(input.cancelledBy), existing.project_id, existing.id);
+        `).run("cancelled", (input.cancelledAt ?? new Date).toISOString(), serializePrincipal(input.cancelledBy), existing.project_id, existing.id);
       return this.requireIntervention(input.projectId, input.id);
     })();
   }
@@ -16141,10 +17063,10 @@ function serializeRecord(value) {
 function parseRecord(value) {
   return JSON.parse(value);
 }
-function serializeActor(actor) {
-  return actor ? JSON.stringify(actor) : null;
+function serializePrincipal(principal) {
+  return principal ? JSON.stringify(principal) : null;
 }
-function parseActor(value) {
+function parsePrincipal(value) {
   return value ? JSON.parse(value) : undefined;
 }
 function rowToWorkflowInterventionRecord(row) {
@@ -16164,10 +17086,10 @@ function rowToWorkflowInterventionRecord(row) {
     requestedAt: new Date(row.requested_at),
     expiresAt: row.expires_at ? new Date(row.expires_at) : undefined,
     submittedAt: row.submitted_at ? new Date(row.submitted_at) : undefined,
-    submittedBy: parseActor(row.submitted_by),
+    submittedBy: parsePrincipal(row.submitted_by),
     response: row.response ? parseRecord(row.response) : undefined,
     cancelledAt: row.cancelled_at ? new Date(row.cancelled_at) : undefined,
-    cancelledBy: parseActor(row.cancelled_by),
+    cancelledBy: parsePrincipal(row.cancelled_by),
     expiredAt: row.expired_at ? new Date(row.expired_at) : undefined
   };
 }
@@ -16178,7 +17100,7 @@ function assertNonNegativeInteger(value, fieldName) {
 }
 
 // src/workflow-run-storage.ts
-import { parseSixbFailure as parseSixbFailure6, serializeSixbFailure as serializeSixbFailure7 } from "@sixb/core/internal/errors";
+import { parseSixbFailure as parseSixbFailure7, serializeSixbFailure as serializeSixbFailure7 } from "@sixb/core/internal/errors";
 import {
   assertWorkflowAgentNodeRunExecution,
   assertWorkflowRunExecution
@@ -16736,7 +17658,7 @@ function rowToWorkflowRunRecord(row) {
     queuedAt: row.queued_at ? new Date(row.queued_at) : undefined,
     startedAt: new Date(row.started_at),
     finishedAt: row.finished_at ? new Date(row.finished_at) : undefined,
-    error: row.error === null ? undefined : parseSixbFailure6(row.error, WORKFLOW_RUN_FAILURE_CODES),
+    error: row.error === null ? undefined : parseSixbFailure7(row.error, WORKFLOW_RUN_FAILURE_CODES),
     attempt: row.attempt,
     ...row.execution_token && row.execution_queue_lease_expires_at ? {
       execution: {
@@ -16761,7 +17683,7 @@ function rowToWorkflowNodeRunRecord(row) {
     startedAt: new Date(row.started_at),
     finishedAt: row.finished_at ? new Date(row.finished_at) : undefined,
     output: row.output ? parseRecord2(row.output) : undefined,
-    error: row.error === null ? undefined : parseSixbFailure6(row.error, WORKFLOW_RUN_FAILURE_CODES)
+    error: row.error === null ? undefined : parseSixbFailure7(row.error, WORKFLOW_RUN_FAILURE_CODES)
   };
 }
 function assertNonNegativeInteger2(value, fieldName) {
@@ -16789,7 +17711,7 @@ function rowToWorkflowAgentNodeRunRecord(row) {
     ...row.finish_reason ? { finishReason: row.finish_reason } : {},
     ...row.trace ? { trace: JSON.parse(row.trace) } : {},
     ...row.diagnostics ? { diagnostics: JSON.parse(row.diagnostics) } : {},
-    ...row.error ? { error: parseSixbFailure6(row.error, AGENT_RUN_FAILURE_CODES3) } : {},
+    ...row.error ? { error: parseSixbFailure7(row.error, AGENT_RUN_FAILURE_CODES3) } : {},
     attempt: row.attempt,
     ...row.execution_token && row.execution_queue_lease_expires_at ? {
       execution: {
@@ -16830,6 +17752,7 @@ class SqliteStorage {
   shareGrants;
   shareSessions;
   connectorConnections;
+  fileUploadSessions;
   migrators;
   connection;
   readConnection;
@@ -16880,6 +17803,7 @@ class SqliteStorage {
     this.shareGrants = createOperationScopedFacade(stores.shareGrants, scope);
     this.shareSessions = createOperationScopedFacade(stores.shareSessions, scope);
     this.connectorConnections = createOperationScopedFacade(stores.connectorConnections, scope);
+    this.fileUploadSessions = createOperationScopedFacade(stores.fileUploadSessions, scope);
     this.migrators = options.path ? createSqliteStorageMigrators(options.path) : [];
     registerSqliteStorageTestingAdapter(this, (durationMs) => stores.connectorConnections.advanceTimeForTesting(durationMs));
   }
@@ -17004,7 +17928,8 @@ function createSqliteStores(connection, options) {
     rules: new SqliteRulesStorage({ connection }),
     shareGrants,
     shareSessions,
-    connectorConnections: new SqliteConnectorConnectionStorage(connection)
+    connectorConnections: new SqliteConnectorConnectionStorage(connection),
+    fileUploadSessions: new SqliteFileUploadSessionStorage(connection)
   };
 }
 export {
@@ -17012,4 +17937,4 @@ export {
   migrateSqliteStorage
 };
 
-//# debugId=6BCAC863183D761764756E2164756E21
+//# debugId=A346535172FAF7A764756E2164756E21