@sixb/sqlite 0.1.11 → 0.1.13

package/src/migrations/047-ontology-commit-attribution.sql

@@ -0,0 +1,67 @@
+-- Commits and their events name who requested the write and what ran it, replacing the
+-- authority-only `actor`. Both are copied from the commit's execution, which stays canonical and
+-- is immutable, so the backfill is exact. SQLite cannot add a NOT NULL column without a default;
+-- every insert supplies `executor`, and the UPDATE below replaces the placeholder on every row.
+ALTER TABLE ontology_commits ADD COLUMN requested_by TEXT
+  CHECK (requested_by IS NULL OR json_valid(requested_by));
+ALTER TABLE ontology_commits ADD COLUMN executor TEXT NOT NULL DEFAULT '{}'
+  CHECK (json_valid(executor));
+
+UPDATE ontology_commits SET
+  requested_by = (
+    SELECT CASE
+      WHEN e.requested_by_user_id IS NOT NULL
+        THEN json_object('id', e.requested_by_user_id, 'type', 'user')
+      WHEN e.requested_by_service_account_id IS NOT NULL
+        THEN json_object('id', e.requested_by_service_account_id, 'type', 'serviceAccount')
+    END
+    FROM executions e
+    WHERE e.project_id = ontology_commits.project_id AND e.id = ontology_commits.execution_id
+  ),
+  executor = (
+    SELECT CASE e.executor_kind
+      WHEN 'request' THEN json_object('requestId', e.executor_id, 'type', 'request')
+      WHEN 'agent' THEN json_object('runId', e.executor_id, 'type', 'agent')
+      WHEN 'kernel' THEN json_object(
+        'operation',
+        CASE e.authority_kernel_operation
+          WHEN 'ontology.recover'
+            THEN json_object('recoveryId', e.executor_id, 'type', 'ontology.recover')
+          ELSE json_object('indexingId', e.executor_id, 'type', 'ontology.indexVectors')
+        END,
+        'type', 'kernel'
+      )
+      ELSE json_object(
+        'id', e.authority_primitive_id,
+        'kind', e.executor_kind,
+        'runId', e.executor_id,
+        'type', 'primitive'
+      )
+    END
+    FROM executions e
+    WHERE e.project_id = ontology_commits.project_id AND e.id = ontology_commits.execution_id
+  );
+
+-- Events not yet published would otherwise reach consumers in the retired shape.
+UPDATE ontology_outbox SET envelope = (
+  SELECT json_remove(
+    CASE
+      WHEN c.requested_by IS NULL
+        THEN json_set(ontology_outbox.envelope, '$.executor', json(c.executor))
+      ELSE json_set(
+        ontology_outbox.envelope,
+        '$.executor', json(c.executor),
+        '$.requestedBy', json(c.requested_by)
+      )
+    END,
+    '$.actor'
+  )
+  FROM ontology_commits c
+  WHERE c.project_id = ontology_outbox.project_id AND c.id = ontology_outbox.commit_id
+)
+WHERE EXISTS (
+  SELECT 1 FROM ontology_commits c
+  WHERE c.project_id = ontology_outbox.project_id AND c.id = ontology_outbox.commit_id
+);
+
+ALTER TABLE ontology_commits DROP COLUMN actor;

package/src/migrations/048-file-upload-sessions.sql

@@ -0,0 +1,35 @@
+-- Durable staged-upload sessions, so an upload survives restarts and spans API replicas.
+-- Timestamps are ISO-8601 UTC text and compare lexicographically.
+CREATE TABLE file_upload_sessions (
+  id TEXT PRIMARY KEY CHECK (length(trim(id)) > 0),
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  owner_principal_type TEXT NOT NULL
+    CHECK (owner_principal_type IN ('user', 'serviceAccount', 'system')),
+  owner_principal_id TEXT NOT NULL CHECK (length(owner_principal_id) > 0),
+  strategy TEXT NOT NULL CHECK (strategy IN ('server', 'direct-put', 'multipart')),
+  status TEXT NOT NULL CHECK (status IN ('pending', 'completed', 'aborted')),
+  file_name TEXT,
+  media_type TEXT,
+  logical_path TEXT,
+  expected_size_bytes INTEGER CHECK (expected_size_bytes IS NULL OR expected_size_bytes >= 0),
+  expected_digest TEXT,
+  provider_upload TEXT CHECK (provider_upload IS NULL OR json_type(provider_upload) = 'object'),
+  signed_parts TEXT NOT NULL CHECK (json_type(signed_parts) = 'array'),
+  file_ref TEXT CHECK (file_ref IS NULL OR json_type(file_ref) = 'object'),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  completed_at TEXT,
+  aborted_at TEXT,
+  -- Derived by core (fileUploadSessionReapAt); NULL while an abandoned upload awaits its abort.
+  reap_at TEXT,
+  CHECK ((status = 'completed') = (completed_at IS NOT NULL)),
+  CHECK ((status = 'aborted') = (aborted_at IS NOT NULL))
+);
+
+CREATE INDEX idx_file_upload_sessions_reap
+  ON file_upload_sessions (reap_at)
+  WHERE reap_at IS NOT NULL;
+
+CREATE INDEX idx_file_upload_sessions_abandoned
+  ON file_upload_sessions (project_id, expires_at)
+  WHERE status = 'pending' AND provider_upload IS NOT NULL;

package/src/migrations/049-native-sessions.sql

@@ -0,0 +1,12 @@
+-- Native clients, such as the CLI, hold their session as bearer tokens: a
+-- short-lived access token, whose hash is `token_hash`, and a rotating refresh token. Browser
+-- sessions leave these columns NULL; `refresh_token_hash IS NULL` is what marks a cookie session.
+ALTER TABLE auth_sessions ADD COLUMN client_name TEXT;
+ALTER TABLE auth_sessions ADD COLUMN access_expires_at TEXT;
+ALTER TABLE auth_sessions ADD COLUMN refresh_token_hash TEXT;
+ALTER TABLE auth_sessions ADD COLUMN previous_refresh_token_hash TEXT;
+ALTER TABLE auth_sessions ADD COLUMN refreshed_at TEXT;
+
+-- The device flow now starts a session instead of issuing a personal access token.
+ALTER TABLE auth_device_authorizations DROP COLUMN token_name;
+ALTER TABLE auth_device_authorizations DROP COLUMN token_expires_at;

package/src/migrations.ts

@@ -96,6 +96,22 @@ import projectionSourceRootsSql from "./migrations/038-projection-source-roots.s
 import outboxPublicationOrderSql from "./migrations/040-outbox-publication-order.sql" with {
   type: "text",
 }
+import agentThreadWorkspacesSql from "./migrations/041-agent-thread-workspaces.sql" with {
+  type: "text",
+}
+import vectorProfilesSql from "./migrations/042-vector-profiles.sql" with { type: "text" }
+import vectorIndexingSql from "./migrations/043-vector-indexing.sql" with { type: "text" }
+import vectorBatchingSql from "./migrations/044-vector-batching.sql" with { type: "text" }
+import agentThreadSandboxStateSql from "./migrations/045-agent-thread-sandbox-state.sql" with {
+  type: "text",
+}
+import workflowInterventionPrincipalsSql from "./migrations/046-workflow-intervention-principals.sql" with {
+  type: "text",
+}
+import ontologyCommitAttributionSql from "./migrations/047-ontology-commit-attribution.sql" with {
+  type: "text",
+}
+import nativeSessionsSql from "./migrations/049-native-sessions.sql" with { type: "text" }
 
 const MIGRATIONS_TABLE_SQL = `
   CREATE TABLE IF NOT EXISTS sixb_migrations (
@@ -191,6 +207,15 @@ export const sqliteStorageMigrations = defineMigrations({
     sqliteSql("038-projection-source-roots", projectionSourceRootsSql),
     sqliteSql("039-connector-optional-pkce", connectorOptionalPkceSql),
     sqliteSql("040-outbox-publication-order", outboxPublicationOrderSql),
+    sqliteSql("041-agent-thread-workspaces", agentThreadWorkspacesSql),
+    sqliteSql("042-vector-profiles", vectorProfilesSql),
+    sqliteSql("043-vector-indexing", vectorIndexingSql),
+    sqliteSql("044-vector-batching", vectorBatchingSql),
+    sqliteSql("045-agent-thread-sandbox-state", agentThreadSandboxStateSql),
+    sqliteSql("046-workflow-intervention-principals", workflowInterventionPrincipalsSql),
+    sqliteSql("047-ontology-commit-attribution", ontologyCommitAttributionSql),
+    sqliteSql("048-file-upload-sessions", fileUploadSessionsSql),
+    sqliteSql("049-native-sessions", nativeSessionsSql),
   ],
 })
 
@@ -414,3 +439,4 @@ import executionRequesterGroupsSql from "./migrations/037-execution-requester-gr
 import connectorOptionalPkceSql from "./migrations/039-connector-optional-pkce.sql" with {
   type: "text",
 }
+import fileUploadSessionsSql from "./migrations/048-file-upload-sessions.sql" with { type: "text" }

package/src/objects/query-compiler.ts

@@ -6,8 +6,15 @@ import {
   type ObjectQuerySetOperation,
   type ObjectQuerySortField,
 } from "@sixb/core"
+import {
+  hasVectorProfile,
+  isVectorProfileQuery,
+  normalizeVector,
+  vectorSearchCandidateLimit,
+} from "@sixb/core/internal/query"
+import { encodeSqliteVector } from "../vector-encoding"
 
-export type SqliteValue = string | number | bigint | boolean | null
+export type SqliteValue = string | number | bigint | boolean | null | Uint8Array
 
 export interface SqliteObjectQueryPageRow {
   object_type_id: string
@@ -17,6 +24,7 @@ export interface SqliteObjectQueryPageRow {
 }
 
 export interface CompiledObjectQuery {
+  vectorProbe?: { sql: string; args: SqliteValue[]; limit: number }
   sql: string
   args: SqliteValue[]
   totalSql: string
@@ -59,7 +67,8 @@ type CompiledOrderField =
     }
   | {
       kind: "column"
-      column: "object_type_id" | "primary_id"
+      column: "object_type_id" | "primary_id" | "_vector_score"
+      binary?: boolean
       direction: "asc" | "desc"
     }
 
@@ -86,6 +95,12 @@ export function compileObjectQuery(
   query: ObjectQuery,
   options: { includeTotal?: boolean; source?: SqliteObjectQuerySource } = {}
 ): CompiledObjectQuery {
+  if (hasVectorProfile(query) && !isVectorProfileQuery(query)) {
+    throw new ObjectQueryExecutionError(
+      "unsupported_vector_composition",
+      "Vector search supports one profile with filters before ranking and limit/project after."
+    )
+  }
   const source = options.source ?? DEFAULT_OBJECT_QUERY_SOURCE
   const ctx: CompileContext = { probeLimit: options.includeTotal === false, source }
   return source.wrapQuery(compileObjectQueryInternal(projectId, query, ctx))
@@ -95,6 +110,7 @@ export function compileObjectQuery(
 export interface SqliteObjectQuerySource {
   readonly objectsTable: string
   readonly linksTable: string
+  readonly objectPropertyPermissionsTable?: string
   /** Wrap a terminal SELECT without its own WITH clause; the selected source owns the only WITH. */
   wrapStatement(
     sql: string,
@@ -160,7 +176,79 @@ function compileObjectQueryInternal(
     case "expand":
       return compileExpand(projectId, query.input, query.expansions, ctx)
     case "vector":
-      throw new Error(`[Sixb] SQLite object storage does not support query node '${query.kind}'`)
+      return compileVector(projectId, query, ctx)
+  }
+}
+
+function compileVector(
+  projectId: string,
+  query: Extract<ObjectQuery, { kind: "vector" }>,
+  ctx: CompileContext
+): CompiledObjectQuery {
+  if (
+    typeof query.vector === "string" ||
+    !isVectorProfileQuery(query) ||
+    !query.configuration ||
+    !Number.isSafeInteger(query.k) ||
+    query.k < 1 ||
+    query.k > 1000 ||
+    query.vector.length < 1 ||
+    query.vector.length > 16000
+  ) {
+    throw new ObjectQueryExecutionError(
+      "invalid_vector_query",
+      "A validated named vector profile is required."
+    )
+  }
+  const input = compileObjectQueryInternal(projectId, query.input, exactContext(ctx))
+  const permissions = ctx.source.objectPropertyPermissionsTable
+  const permissionJoin = permissions
+    ? `CROSS JOIN (
+      SELECT project_id, object_type_id, primary_id, json_group_array(property_id) AS property_ids
+      FROM ${permissions}
+      GROUP BY project_id, object_type_id, primary_id
+    ) AS vector_permissions ON vector_permissions.project_id = vectors.project_id
+      AND vector_permissions.object_type_id = vectors.object_type_id
+      AND vector_permissions.primary_id = vectors.primary_id`
+    : ""
+  const authorized = permissions
+    ? `AND NOT EXISTS (
+    SELECT 1 FROM json_each(vectors.source) AS required
+    WHERE required.value NOT IN (SELECT value FROM json_each(vector_permissions.property_ids))
+  )`
+    : ""
+  const candidates = `FROM (${input.sql}) AS input
+    CROSS JOIN object_vectors AS vectors ON vectors.project_id = input.project_id
+      AND vectors.object_type_id = input.object_type_id AND vectors.primary_id = input.primary_id
+    ${permissionJoin}
+    WHERE vectors.profile = ? AND vectors.configuration = ?
+      AND length(vectors.embedding) / 4 = ? ${authorized}`
+  const candidateArgs = [...input.args, query.profile!, query.configuration, query.vector.length]
+  // Bound distance work, not just returned rows. Exceeding the envelope fails before ranking.
+  const limit = vectorSearchCandidateLimit(query.vector.length)
+  const values = normalizeVector(query.vector, query.vector.length)
+  const order = compileOrder([
+    { kind: "column", column: "_vector_score", direction: "desc" },
+    ...identityOrderFields().map((field) => ({ ...field, binary: true })),
+  ])
+  const sql = `SELECT * FROM (SELECT input.*, max(-1, min(1, 1 - vec_distance_cosine(vectors.embedding, ?))) AS _vector_score
+    ${candidates}) AS ranked ORDER BY ${order.sql} LIMIT ?`
+  const args = [encodeSqliteVector(values), ...candidateArgs, query.k]
+  return {
+    sql,
+    args,
+    // Top-k cardinality depends on eligibility, not distances or ranking.
+    totalSql: `SELECT COUNT(*) AS total FROM (SELECT 1 ${candidates} LIMIT ?) AS eligible`,
+    totalArgs: [...candidateArgs, query.k],
+    order,
+    vectorProbe: {
+      sql: `SELECT COUNT(*) AS total FROM (SELECT 1 ${candidates} LIMIT ?) AS candidates`,
+      args: [...candidateArgs, limit + 1],
+      limit,
+    },
+    hasMore: () => false,
+    trimRows: identityRows,
+    nextPageToken: () => undefined,
   }
 }
 
@@ -274,6 +362,7 @@ function compileWhere(
       WHERE ${predicate.sql}
     `,
     totalArgs: [...input.args, ...predicate.args],
+    vectorProbe: input.vectorProbe,
     order: input.order,
     hasMore: () => false,
     trimRows: identityRows,
@@ -324,7 +413,7 @@ function compileSort(
         input.created_at,
         input.updated_at,
         input.version,
-        input.last_commit_id
+        input.last_commit_id${input.vectorProbe ? ", input._vector_score" : ""}
       FROM (${input.sql}) AS input
       ORDER BY ${order.sql}
     `,
@@ -362,6 +451,7 @@ function compileLimit(
       FROM (${input.sql}) AS input
     `,
     totalArgs: input.args,
+    vectorProbe: input.vectorProbe,
     order: input.order,
     hasMore: (rowCount, total) =>
       total === undefined ? ctx.probeLimit && rowCount > limit : limit < total,
@@ -399,6 +489,7 @@ function compilePage(
       FROM (${input.sql}) AS input
     `,
     totalArgs: input.args,
+    vectorProbe: input.vectorProbe,
     order: input.order,
     hasMore: (rowCount) => rowCount > pageSize,
     trimRows: (rows) => rows.slice(0, pageSize),
@@ -507,6 +598,7 @@ function compileExpand(
     args: [...expand.args, ...input.args, ...inputOrder.args],
     totalSql: input.totalSql,
     totalArgs: input.totalArgs,
+    vectorProbe: input.vectorProbe,
     order: input.order,
     hasMoreProbe: input.hasMoreProbe,
     hasMore: input.hasMore,
@@ -760,13 +852,14 @@ function compileProject(
         input.created_at,
         input.updated_at,
         input.version,
-        input.last_commit_id
+        input.last_commit_id${input.vectorProbe ? ", input._vector_score" : ""}
       FROM (${input.sql}) AS input
       ORDER BY ${inputOrder.sql}
     `,
     args: [...projection.args, ...input.args, ...inputOrder.args],
     totalSql: input.totalSql,
     totalArgs: input.totalArgs,
+    vectorProbe: input.vectorProbe,
     order: outputOrder,
     hasMoreProbe: input.hasMoreProbe,
     hasMore: input.hasMore,
@@ -870,9 +963,13 @@ function compilePredicate(predicate: ObjectQueryPredicate): CompiledPredicate {
       return negatePredicate(item)
     }
     case "eq":
-      return compileEqualityPredicate(predicate.propertyId, "eq", predicate.value)
+      return predicate.scalarKind === "userRef"
+        ? compileUserRefInPredicate(predicate.propertyId, [predicate.value])
+        : compileEqualityPredicate(predicate.propertyId, "eq", predicate.value)
     case "neq":
-      return compileEqualityPredicate(predicate.propertyId, "neq", predicate.value)
+      return predicate.scalarKind === "userRef"
+        ? negatePredicate(compileUserRefInPredicate(predicate.propertyId, [predicate.value]))
+        : compileEqualityPredicate(predicate.propertyId, "neq", predicate.value)
     case "lt":
     case "lte":
     case "gt":
@@ -884,17 +981,68 @@ function compilePredicate(predicate: ObjectQueryPredicate): CompiledPredicate {
       }
     }
     case "in":
-      return compileInPredicate(predicate.propertyId, predicate.values)
+      return predicate.scalarKind === "userRef"
+        ? compileUserRefInPredicate(predicate.propertyId, predicate.values)
+        : compileInPredicate(predicate.propertyId, predicate.values)
     case "exists": {
       const sql = `${jsonTypeExpression()} IS NOT NULL`
       const item: CompiledPredicate = { sql, args: [jsonPath(predicate.propertyId)] }
       return predicate.value ? item : negatePredicate(item)
     }
     case "contains":
-      return compileContainsPredicate(predicate.propertyId, predicate.value)
+      return predicate.scalarKind === "userRef"
+        ? compileUserRefContainsPredicate(predicate.propertyId, predicate.value)
+        : compileContainsPredicate(predicate.propertyId, predicate.value)
   }
 }
 
+/**
+ * User references are JSON objects, so they match on both fields rather than on serialized text,
+ * which would depend on key order.
+ */
+function compileUserRefInPredicate(
+  propertyId: string,
+  values: readonly unknown[]
+): CompiledPredicate {
+  const path = jsonPath(propertyId)
+  const ids = values.flatMap((value) => {
+    const id = userRefId(value)
+    return id === undefined ? [] : [id]
+  })
+  const clauses: string[] = []
+  const args: SqliteValue[] = []
+
+  if (values.includes(null)) {
+    clauses.push(`${jsonTypeExpression()} = 'null'`)
+    args.push(path)
+  }
+  if (ids.length > 0) {
+    clauses.push(
+      `(${jsonValueExpression()} = 'user' AND ${jsonValueExpression()} IN (${ids.map(() => "?").join(", ")}))`
+    )
+    args.push(`${path}.type`, `${path}.id`, ...ids)
+  }
+  if (clauses.length === 0) return { sql: "0 = 1", args: [] }
+
+  return { sql: `(${clauses.join(" OR ")})`, args }
+}
+
+function compileUserRefContainsPredicate(propertyId: string, value: unknown): CompiledPredicate {
+  const id = userRefId(value)
+  if (id === undefined) return { sql: "0 = 1", args: [] }
+  const path = jsonPath(propertyId)
+  return {
+    sql: `(${jsonTypeExpression()} = 'array' AND EXISTS (SELECT 1 FROM json_each(properties, ?) AS item WHERE item.type = 'object' AND json_extract(item.value, '$.type') = 'user' AND json_extract(item.value, '$.id') = ?))`,
+    args: [path, path, id],
+  }
+}
+
+function userRefId(value: unknown): string | undefined {
+  if (typeof value !== "object" || value === null) return undefined
+  const { type, id } = value as { type?: unknown; id?: unknown }
+  return type === "user" && typeof id === "string" ? id : undefined
+}
+
 function negatePredicate(predicate: CompiledPredicate): CompiledPredicate {
   return {
     sql: `(NOT COALESCE((${predicate.sql}), 0))`,
@@ -1026,7 +1174,9 @@ function compileOrder(
 
   for (const field of fields) {
     if (field.kind === "column") {
-      clauses.push(`${columnExpression(field.column, qualifier)} ${field.direction.toUpperCase()}`)
+      clauses.push(
+        `${columnExpression(field.column, qualifier)}${field.binary ? " COLLATE BINARY" : ""} ${field.direction.toUpperCase()}`
+      )
       continue
     }
 
@@ -1238,7 +1388,10 @@ function orderFieldKey(field: CompiledOrderField): string {
     : `property:${field.propertyId}:${field.direction}`
 }
 
-function columnExpression(column: "object_type_id" | "primary_id", qualifier?: string): string {
+function columnExpression(
+  column: "object_type_id" | "primary_id" | "_vector_score",
+  qualifier?: string
+): string {
   return qualifier ? `${qualifier}.${column}` : column
 }
 

package/src/objects/read-scope.ts

@@ -19,6 +19,9 @@ export interface SqliteSelectedObjectReadSource extends SqliteObjectQuerySource
  *
  * The complete compiled scope is serialized once. Every statement receives that one JSON document
  * and the bound project id, keeping the host-parameter count constant as selections grow.
+ * CROSS JOIN keeps authorized parents/grants before indexed edge/object lookups, even when
+ * statistics would otherwise make SQLite rescan all grants for every stored object.
+ * Property grants are grouped only after path-sensitive reachability has been resolved.
  */
 export function compileSqliteSelectedObjectReadSource(
   projectId: string,
@@ -44,6 +47,9 @@ export function compileSqliteSelectedObjectReadSource(
     wrapQuery: (query: CompiledObjectQuery): CompiledObjectQuery => ({
       ...query,
       ...wrapStatement(query.sql, query.args),
+      vectorProbe: query.vectorProbe
+        ? { ...query.vectorProbe, ...wrapStatement(query.vectorProbe.sql, query.vectorProbe.args) }
+        : undefined,
       totalSql: `${compiled.sql}\n${query.totalSql}`,
       totalArgs: [...compiled.args, ...query.totalArgs],
       ...(query.hasMoreProbe
@@ -140,16 +146,16 @@ function compileSelectedReadScopeCte(scopeJson: string, projectId: string): Comp
 
         SELECT edge.project_id, selection.node_id, edge.target_type_id, edge.target_id
         FROM _sixb_scope_reachable AS parent
-        JOIN _sixb_scope_link_selections AS selection
+        CROSS JOIN _sixb_scope_link_selections AS selection
           ON selection.parent_node_id = parent.node_id
          AND selection.source_object_type_id = parent.object_type_id
-        JOIN links AS edge
+        CROSS JOIN links AS edge
           ON edge.project_id = parent.project_id
          AND edge.source_type_id = parent.object_type_id
          AND edge.source_id = parent.primary_id
          AND edge.link_id = selection.link_id
          AND edge.target_type_id = selection.target_object_type_id
-        JOIN objects AS target
+        CROSS JOIN objects AS target
           ON target.project_id = edge.project_id
          AND target.object_type_id = edge.target_type_id
          AND target.primary_id = edge.target_id
@@ -170,32 +176,29 @@ function compileSelectedReadScopeCte(scopeJson: string, projectId: string): Comp
         SELECT DISTINCT project_id, object_type_id, primary_id
         FROM _sixb_scope_reachable
       ),
+      _sixb_scope_object_grants AS (
+        SELECT reachable.project_id, reachable.object_type_id, reachable.primary_id,
+          json_group_array(DISTINCT selected_property.value) FILTER (WHERE selected_property.value IS NOT NULL) AS property_ids
+        FROM _sixb_scope_reachable AS reachable
+        LEFT JOIN _sixb_scope_object_selections AS selection
+          ON selection.node_id = reachable.node_id
+         AND selection.object_type_id = reachable.object_type_id
+        LEFT JOIN json_each(selection.property_ids) AS selected_property ON true
+        GROUP BY reachable.project_id, reachable.object_type_id, reachable.primary_id
+      ),
       _sixb_scope_objects AS (
-        SELECT
-          stored.project_id,
-          stored.object_type_id,
-          stored.primary_id,
-          COALESCE(
-            (
-              SELECT json_group_object(property.key, ${sqliteJsonEachValue("property")})
-              FROM json_each(stored.properties) AS property
-              JOIN _sixb_scope_object_permissions AS permission
-                ON permission.project_id = stored.project_id
-               AND permission.object_type_id = stored.object_type_id
-               AND permission.primary_id = stored.primary_id
-               AND permission.property_id = property.key
-            ),
-            json('{}')
-          ) AS properties,
-          stored.created_at,
-          stored.updated_at,
-          stored.version,
-          stored.last_commit_id
-        FROM objects AS stored
-        JOIN _sixb_scope_object_ids AS visible
-          ON visible.project_id = stored.project_id
-         AND visible.object_type_id = stored.object_type_id
-         AND visible.primary_id = stored.primary_id
+        SELECT stored.project_id, stored.object_type_id, stored.primary_id,
+          COALESCE((
+            SELECT json_group_object(property.key, ${sqliteJsonEachValue("property")})
+            FROM json_each(stored.properties) AS property
+            WHERE property.key IN (SELECT value FROM json_each(grants.property_ids))
+          ), json('{}')) AS properties,
+          stored.created_at, stored.updated_at, stored.version, stored.last_commit_id
+        FROM _sixb_scope_object_grants AS grants
+        CROSS JOIN objects AS stored
+          ON stored.project_id = grants.project_id
+         AND stored.object_type_id = grants.object_type_id
+         AND stored.primary_id = grants.primary_id
       ),
       _sixb_scope_reached_links(
         project_id,
@@ -221,16 +224,16 @@ function compileSelectedReadScopeCte(scopeJson: string, projectId: string): Comp
           edge.target_id,
           selection.property_ids
         FROM _sixb_scope_reachable AS parent
-        JOIN _sixb_scope_link_selections AS selection
+        CROSS JOIN _sixb_scope_link_selections AS selection
           ON selection.parent_node_id = parent.node_id
          AND selection.source_object_type_id = parent.object_type_id
-        JOIN links AS edge
+        CROSS JOIN links AS edge
           ON edge.project_id = parent.project_id
          AND edge.source_type_id = parent.object_type_id
          AND edge.source_id = parent.primary_id
          AND edge.link_id = selection.link_id
          AND edge.target_type_id = selection.target_object_type_id
-        JOIN objects AS target
+        CROSS JOIN objects AS target
           ON target.project_id = edge.project_id
          AND target.object_type_id = edge.target_type_id
          AND target.primary_id = edge.target_id

package/src/objects/reader.ts

@@ -1,5 +1,6 @@
 import type { Database } from "bun:sqlite"
-import type { ObjectQuery } from "@sixb/core"
+import { type ObjectQuery, ObjectQueryExecutionError } from "@sixb/core"
+import { hasVectorProfile } from "@sixb/core/internal/query"
 import type {
   CountObjectsInput,
   CountObjectsResult,
@@ -24,6 +25,7 @@ import {
   type CompiledObjectQuery,
   compileObjectQuery,
   type SqliteObjectQuerySource,
+  type SqliteValue,
 } from "./query-compiler"
 import type { SqliteSelectedObjectReadSource } from "./read-scope"
 import {
@@ -34,6 +36,7 @@ import {
   rowToLink,
   rowToObject,
 } from "./rows"
+import { ensureSqliteVectorSearch } from "./vector-extension"
 
 /** Synchronous SQL reads over one explicit source; transaction and budget ownership stay outside. */
 export class SqliteObjectReader {
@@ -42,7 +45,25 @@ export class SqliteObjectReader {
     private readonly source: SqliteObjectQuerySource | SqliteSelectedObjectReadSource
   ) {}
 
+  private assertVectorSearch(
+    params: QueryObjectsInput | CountObjectsInput | ExistsObjectsInput | FacetObjectsInput
+  ): void {
+    if (!hasVectorProfile(params.query)) return
+    const compiled = compileObjectQuery(params.projectId, params.query, { source: this.source })
+    if (!compiled.vectorProbe) return
+    ensureSqliteVectorSearch(this.db)
+    const probe = compiled.vectorProbe
+    const row = this.db.query<{ total: number }, SqliteValue[]>(probe.sql).get(...probe.args)
+    if (Number(row?.total ?? 0) > probe.limit) {
+      throw new ObjectQueryExecutionError(
+        "vector_work_limit_exceeded",
+        `Exact vector search supports at most ${probe.limit} eligible vectors at this dimension. Narrow the query filters.`
+      )
+    }
+  }
+
   queryObjects(params: QueryObjectsInput): QueryObjectsResult {
+    this.assertVectorSearch(params)
     const source = this.source
     const compiled = compileObjectQuery(params.projectId, params.query, {
       includeTotal: params.includeTotal,
@@ -67,6 +88,7 @@ export class SqliteObjectReader {
   }
 
   countObjects(params: CountObjectsInput): CountObjectsResult {
+    this.assertVectorSearch(params)
     const source = this.source
     return {
       count: readTotal(
@@ -79,6 +101,7 @@ export class SqliteObjectReader {
   }
 
   existsObjects(params: ExistsObjectsInput): ExistsObjectsResult {
+    this.assertVectorSearch(params)
     const source = this.source
     const compiled = compileObjectQuery(params.projectId, existsProbeQuery(params.query), {
       source,
@@ -87,6 +110,7 @@ export class SqliteObjectReader {
   }
 
   facetObjects(params: FacetObjectsInput): FacetObjectsResult {
+    this.assertVectorSearch(params)
     const source = this.source
     const compiled = compileObjectQuery(params.projectId, stripOuterRowShape(params.query), {
       source,
@@ -488,6 +512,10 @@ function sqliteFacetValue(valueType: string | null, value: unknown): unknown {
   if (valueType === "true") return true
   if (valueType === "false") return false
   if (valueType === "null") return null
+  // json_extract returns structured values, such as user references, as JSON text.
+  if ((valueType === "object" || valueType === "array") && typeof value === "string") {
+    return JSON.parse(value)
+  }
   return value
 }
 

package/src/objects/rows.ts

@@ -21,7 +21,10 @@ export function rowToObject(row: DatabaseRow): ObjectRow {
 
 /** Decode an expanded query row with the same shape as Core link hydration. */
 export function queryRowToObject(row: ObjectQueryDatabaseRow): ObjectRow {
-  const base = rowToObject(row)
+  const base = {
+    ...rowToObject(row),
+    ...(row._vector_score === undefined ? {} : { score: row._vector_score }),
+  }
   const links = reviveExpandedLinks(parseExpandColumn(row._expand))
   return links ? { ...base, links } : base
 }
@@ -104,6 +107,7 @@ export interface DatabaseRow {
 }
 
 export interface ObjectQueryDatabaseRow extends DatabaseRow {
+  _vector_score?: number
   _cursor_properties?: string
   /** `json_object(linkId, value, ...)` serialized text from an `expand` pushdown; absent otherwise. */
   _expand?: string | null