@sixb/sqlite 0.1.5 → 0.1.7

package/src/ai-usage-storage.ts

@@ -1,3 +1,4 @@
+import { isModelReasoning, normalizeModelProviderIds } from "@sixb/core/models"
 import type { ReadonlyJsonObject } from "@sixb/core/storage"
 import {
   type AiModelCallUsageInput,
@@ -129,7 +130,9 @@ export class SqliteAiUsageStorage implements AiUsageStorage {
             attempt,
             call_id,
             provider_id,
+            provider_ids,
             requested_model_id,
+            requested_reasoning,
             response_model_id,
             response_id,
             input_tokens,
@@ -145,7 +148,7 @@ export class SqliteAiUsageStorage implements AiUsageStorage {
             occurred_at,
             recorded_at
           ) VALUES (
-            ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+            ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
           )
         `
       )
@@ -156,7 +159,9 @@ export class SqliteAiUsageStorage implements AiUsageStorage {
         record.attempt,
         record.callId,
         record.providerId,
+        record.providerIds === undefined ? null : JSON.stringify(record.providerIds),
         record.requestedModelId,
+        record.requestedReasoning === undefined ? null : JSON.stringify(record.requestedReasoning),
         record.responseModelId ?? null,
         record.responseId,
         record.usage.inputTokens ?? null,
@@ -228,7 +233,13 @@ export class SqliteAiUsageStorage implements AiUsageStorage {
       callId: row.call_id,
       requesterGroupIds: groupRows.map((group) => group.group_id),
       providerId: row.provider_id,
+      ...(row.provider_ids === null
+        ? {}
+        : { providerIds: normalizeModelProviderIds(JSON.parse(row.provider_ids)) }),
       requestedModelId: row.requested_model_id,
+      ...(row.requested_reasoning === null
+        ? {}
+        : { requestedReasoning: requestedReasoningFromRow(row.requested_reasoning) }),
       ...(row.response_model_id === null ? {} : { responseModelId: row.response_model_id }),
       responseId: row.response_id,
       usage: {
@@ -281,7 +292,9 @@ interface AiUsageRow {
   readonly attempt: number
   readonly call_id: string
   readonly provider_id: string
+  readonly provider_ids: string | null
   readonly requested_model_id: string
+  readonly requested_reasoning: string | null
   readonly response_model_id: string | null
   readonly response_id: string
   readonly input_tokens: number | null
@@ -336,6 +349,16 @@ function usageFromRow(row: AiUsageRow): AiModelCallUsageInput {
   }
 }
 
+export function requestedReasoningFromRow(
+  value: string
+): AiModelCallUsageRecord["requestedReasoning"] {
+  const parsed: unknown = JSON.parse(value)
+  if (!isModelReasoning(parsed)) {
+    throw new Error("[SixbSqlite] Stored AI usage requested reasoning is invalid.")
+  }
+  return parsed
+}
+
 function assertNonBlankProjectId(projectId: string): void {
   if (typeof projectId !== "string" || projectId.trim().length === 0) {
     throw new TypeError("[Sixb] AI usage projectId must be nonblank.")

package/src/auth-storage/access-tokens.ts

@@ -22,23 +22,22 @@ import {
   toIso,
 } from "./shared"
 
-export class SqliteAuthAccessTokenStore implements AuthAccessTokenStore {
-  constructor(private readonly db: Database) {}
-
-  async create(input: CreateAuthAccessTokenInput): Promise<AccessTokenRecord> {
-    const id = assertNonEmpty(input.id, "Access token id")
-    const projectId = assertNonEmpty(input.projectId, "Project id")
-    const name = assertNonEmpty(input.name, "Access token name")
-    const subjectId = assertNonEmpty(input.subjectId, "Access token subject id")
-    const tokenHash = assertNonEmpty(input.tokenHash, "Access token hash")
-    assertKindMatchesSubject(input)
-    this.assertSubjectExists(projectId, input.subjectType, subjectId)
-    const groupIds = input.groupIds === undefined ? undefined : normalizeGroupIds(input.groupIds)
+export function createAuthAccessToken(
+  db: Database,
+  input: CreateAuthAccessTokenInput
+): AccessTokenRecord {
+  const id = assertNonEmpty(input.id, "Access token id")
+  const projectId = assertNonEmpty(input.projectId, "Project id")
+  const name = assertNonEmpty(input.name, "Access token name")
+  const subjectId = assertNonEmpty(input.subjectId, "Access token subject id")
+  const tokenHash = assertNonEmpty(input.tokenHash, "Access token hash")
+  assertKindMatchesSubject(input)
+  assertSubjectExists(db, projectId, input.subjectType, subjectId)
+  const groupIds = input.groupIds === undefined ? undefined : normalizeGroupIds(input.groupIds)
 
-    try {
-      this.db
-        .query(
-          `
+  try {
+    db.query(
+      `
           INSERT INTO auth_access_tokens (
             project_id,
             id,
@@ -55,38 +54,47 @@ export class SqliteAuthAccessTokenStore implements AuthAccessTokenStore {
             expires_at
           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
         `
-        )
-        .run(
-          projectId,
-          id,
-          name,
-          input.kind,
-          input.subjectType,
-          subjectId,
-          tokenHash,
-          serializeOptionalStringArray(groupIds),
-          input.createdByPrincipal?.type ?? null,
-          input.createdByPrincipal?.id ?? null,
-          input.createdBySessionId ?? null,
-          toIso(input.createdAt),
-          toIso(input.expiresAt)
-        )
-    } catch (error) {
-      mapUniqueConstraintError(
-        error,
-        "duplicate_access_token",
-        `[Sixb] Access token '${id}' already exists for project '${projectId}'.`
-      )
-    }
+    ).run(
+      projectId,
+      id,
+      name,
+      input.kind,
+      input.subjectType,
+      subjectId,
+      tokenHash,
+      serializeOptionalStringArray(groupIds),
+      input.createdByPrincipal?.type ?? null,
+      input.createdByPrincipal?.id ?? null,
+      input.createdBySessionId ?? null,
+      toIso(input.createdAt),
+      toIso(input.expiresAt)
+    )
+  } catch (error) {
+    mapUniqueConstraintError(
+      error,
+      "duplicate_access_token",
+      `[Sixb] Access token '${id}' already exists for project '${projectId}'.`
+    )
+  }
 
-    const token = await this.getById({ projectId, id })
-    if (!token) {
-      throw new AuthStorageError(
-        "missing_access_token",
-        `[Sixb] Access token '${id}' not found for project '${projectId}'.`
-      )
-    }
-    return token
+  const row = db
+    .query("SELECT * FROM auth_access_tokens WHERE project_id = ? AND id = ?")
+    .get(projectId, id) as SqliteAuthAccessTokenRow | null
+  const token = row ? rowToAccessTokenRecord(row) : null
+  if (!token) {
+    throw new AuthStorageError(
+      "missing_access_token",
+      `[Sixb] Access token '${id}' not found for project '${projectId}'.`
+    )
+  }
+  return token
+}
+
+export class SqliteAuthAccessTokenStore implements AuthAccessTokenStore {
+  constructor(private readonly db: Database) {}
+
+  async create(input: CreateAuthAccessTokenInput): Promise<AccessTokenRecord> {
+    return createAuthAccessToken(this.db, input)
   }
 
   async getById(params: {
@@ -246,32 +254,33 @@ export class SqliteAuthAccessTokenStore implements AuthAccessTokenStore {
       lastUsedIpAddress,
     }
   }
+}
 
-  private assertSubjectExists(
-    projectId: string,
-    subjectType: CreateAuthAccessTokenInput["subjectType"],
-    subjectId: string
-  ): void {
-    if (subjectType === "user") {
-      const row = this.db
-        .query("SELECT * FROM auth_users WHERE project_id = ? AND id = ?")
-        .get(projectId, subjectId) as SqliteAuthUserRow | null
-      if (row) return
-      throw new AuthStorageError(
-        "missing_user",
-        `[Sixb] User '${subjectId}' not found for project '${projectId}'.`
-      )
-    }
-
-    const row = this.db
-      .query("SELECT * FROM auth_service_accounts WHERE project_id = ? AND id = ?")
-      .get(projectId, subjectId) as SqliteAuthServiceAccountRow | null
+function assertSubjectExists(
+  db: Database,
+  projectId: string,
+  subjectType: CreateAuthAccessTokenInput["subjectType"],
+  subjectId: string
+): void {
+  if (subjectType === "user") {
+    const row = db
+      .query("SELECT * FROM auth_users WHERE project_id = ? AND id = ?")
+      .get(projectId, subjectId) as SqliteAuthUserRow | null
     if (row) return
     throw new AuthStorageError(
-      "missing_service_account",
-      `[Sixb] Service account '${subjectId}' not found for project '${projectId}'.`
+      "missing_user",
+      `[Sixb] User '${subjectId}' not found for project '${projectId}'.`
     )
   }
+
+  const row = db
+    .query("SELECT * FROM auth_service_accounts WHERE project_id = ? AND id = ?")
+    .get(projectId, subjectId) as SqliteAuthServiceAccountRow | null
+  if (row) return
+  throw new AuthStorageError(
+    "missing_service_account",
+    `[Sixb] Service account '${subjectId}' not found for project '${projectId}'.`
+  )
 }
 
 function assertKindMatchesSubject(input: CreateAuthAccessTokenInput): void {

package/src/auth-storage/auth-storage.ts

@@ -1,9 +1,12 @@
 import type { Database } from "bun:sqlite"
 import type {
   AuthStorage,
+  CompleteDeviceAuthorizationInput,
+  CompleteDeviceAuthorizationResult,
   CompleteMagicLinkSignInInput,
   CompleteOidcSignInInput,
   CompleteSignInResult,
+  DeviceAuthorizationRecord,
   GroupMembershipRecord,
   InvitationRecord,
   SessionRecord,
@@ -19,7 +22,11 @@ import {
   runImmediateTransaction,
   type SqliteStoreConnection,
 } from "../transactions"
-import { SqliteAuthAccessTokenStore } from "./access-tokens"
+import { createAuthAccessToken, SqliteAuthAccessTokenStore } from "./access-tokens"
+import {
+  getDeviceAuthorizationById,
+  SqliteAuthDeviceAuthorizationStore,
+} from "./device-authorizations"
 import { SqliteAuthGroupMembershipStore } from "./group-memberships"
 import { SqliteAuthUserIdentityStore } from "./identities"
 import { SqliteAuthInvitationStore } from "./invitations"
@@ -76,6 +83,7 @@ export class SqliteAuthStorage implements AuthStorage {
   readonly groupMemberships: SqliteAuthGroupMembershipStore
   readonly magicLinks: SqliteAuthMagicLinkStore
   readonly oidcAuthorizationAttempts: SqliteAuthOidcAuthorizationAttemptStore
+  readonly deviceAuthorizations: SqliteAuthDeviceAuthorizationStore
 
   constructor(options: SqliteAuthStorageOptions = {}) {
     this.connection = openSqliteStoreConnection(options)
@@ -95,6 +103,38 @@ export class SqliteAuthStorage implements AuthStorage {
     this.groupMemberships = new SqliteAuthGroupMembershipStore(this.db)
     this.magicLinks = new SqliteAuthMagicLinkStore(this.db)
     this.oidcAuthorizationAttempts = new SqliteAuthOidcAuthorizationAttemptStore(this.db)
+    this.deviceAuthorizations = new SqliteAuthDeviceAuthorizationStore(this.db)
+  }
+
+  async completeDeviceAuthorization(
+    input: CompleteDeviceAuthorizationInput
+  ): Promise<CompleteDeviceAuthorizationResult> {
+    return runImmediateTransaction(this.db, () => {
+      const authorization = getDeviceAuthorizationById(this.db, input.projectId, input.id)
+      if (!authorization) {
+        throw new AuthStorageError(
+          "missing_device_authorization",
+          `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`
+        )
+      }
+      assertCompletableDeviceAuthorization(authorization, input)
+      const accessToken = createAuthAccessToken(this.db, input.accessToken)
+      this.db
+        .query(`
+        UPDATE auth_device_authorizations
+        SET status = 'consumed', consumed_at = ?
+        WHERE project_id = ? AND id = ? AND status = 'approved'
+      `)
+        .run(toIso(input.completedAt), input.projectId, input.id)
+      return {
+        authorization: {
+          ...authorization,
+          status: "consumed",
+          consumedAt: new Date(input.completedAt),
+        },
+        accessToken,
+      }
+    })
   }
 
   async completeMagicLinkSignIn(
@@ -782,3 +822,42 @@ function assertSignInSessionAudience(
     `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`
   )
 }
+
+function assertCompletableDeviceAuthorization(
+  authorization: DeviceAuthorizationRecord,
+  input: CompleteDeviceAuthorizationInput
+): void {
+  if (authorization.deviceCodeHash !== input.deviceCodeHash) {
+    throw new AuthStorageError(
+      "invalid_device_authorization",
+      "[Sixb] Invalid device authorization."
+    )
+  }
+  if (authorization.status === "pending") {
+    throw new AuthStorageError(
+      "pending_device_authorization",
+      "[Sixb] Device authorization is pending."
+    )
+  }
+  if (authorization.status === "denied") {
+    throw new AuthStorageError(
+      "device_authorization_denied",
+      "[Sixb] Device authorization was denied."
+    )
+  }
+  if (
+    authorization.status !== "approved" ||
+    authorization.expiresAt <= input.completedAt ||
+    !authorization.approvedUserId ||
+    !authorization.approvedSessionId ||
+    input.accessToken.projectId !== input.projectId ||
+    input.accessToken.subjectType !== "user" ||
+    input.accessToken.subjectId !== authorization.approvedUserId ||
+    input.accessToken.createdBySessionId !== authorization.approvedSessionId
+  ) {
+    throw new AuthStorageError(
+      "invalid_device_authorization",
+      "[Sixb] Device authorization is invalid."
+    )
+  }
+}

package/src/auth-storage/device-authorizations.ts

@@ -0,0 +1,153 @@
+import type { Database } from "bun:sqlite"
+import type {
+  AuthDeviceAuthorizationStore,
+  CreateDeviceAuthorizationInput,
+  DeviceAuthorizationRecord,
+} from "@sixb/core/storage"
+import { AuthStorageError, MAX_PENDING_DEVICE_AUTHORIZATIONS } from "@sixb/core/storage"
+import { runImmediateTransaction } from "../transactions"
+import type { SqliteAuthDeviceAuthorizationRow } from "./rows"
+import { rowToDeviceAuthorizationRecord } from "./rows"
+import { assertNonEmpty, mapUniqueConstraintError, toIso } from "./shared"
+
+export class SqliteAuthDeviceAuthorizationStore implements AuthDeviceAuthorizationStore {
+  constructor(private readonly db: Database) {}
+
+  async create(input: CreateDeviceAuthorizationInput): Promise<DeviceAuthorizationRecord> {
+    return runImmediateTransaction(this.db, () => {
+      this.db
+        .query("DELETE FROM auth_device_authorizations WHERE project_id = ? AND expires_at <= ?")
+        .run(input.projectId, toIso(input.createdAt))
+      const pending = this.db
+        .query(
+          "SELECT COUNT(*) AS count FROM auth_device_authorizations WHERE project_id = ? AND status = 'pending'"
+        )
+        .get(input.projectId) as { readonly count: number }
+      if (pending.count >= MAX_PENDING_DEVICE_AUTHORIZATIONS) {
+        throw new AuthStorageError(
+          "device_authorization_limit_exceeded",
+          `[Sixb] Project '${input.projectId}' has too many pending device authorizations.`
+        )
+      }
+      try {
+        this.db
+          .query(`
+          INSERT INTO auth_device_authorizations (
+            project_id, id, device_code_hash, user_code, client_name, token_name,
+            token_expires_at, status, created_at, expires_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)
+        `)
+          .run(
+            assertNonEmpty(input.projectId, "Project id"),
+            assertNonEmpty(input.id, "Device authorization id"),
+            assertNonEmpty(input.deviceCodeHash, "Device code hash"),
+            assertNonEmpty(input.userCode, "User code"),
+            assertNonEmpty(input.clientName, "Client name"),
+            assertNonEmpty(input.tokenName, "Token name"),
+            toIso(input.tokenExpiresAt),
+            toIso(input.createdAt),
+            toIso(input.expiresAt)
+          )
+      } catch (error) {
+        mapUniqueConstraintError(
+          error,
+          "duplicate_device_authorization",
+          `[Sixb] Device authorization '${input.id}' already exists for project '${input.projectId}'.`
+        )
+      }
+      return requireById(this.db, input.projectId, input.id)
+    })
+  }
+
+  async getById(params: { readonly projectId: string; readonly id: string }) {
+    return getById(this.db, params.projectId, params.id)
+  }
+
+  async getByUserCode(params: { readonly projectId: string; readonly userCode: string }) {
+    const row = this.db
+      .query("SELECT * FROM auth_device_authorizations WHERE project_id = ? AND user_code = ?")
+      .get(params.projectId, params.userCode) as SqliteAuthDeviceAuthorizationRow | null
+    return row ? rowToDeviceAuthorizationRecord(row) : null
+  }
+
+  async approve(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly userId: string
+    readonly sessionId: string
+    readonly approvedAt: Date
+  }) {
+    return runImmediateTransaction(this.db, () => {
+      const result = this.db
+        .query(`
+        UPDATE auth_device_authorizations
+        SET status = 'approved', approved_user_id = ?, approved_session_id = ?, approved_at = ?
+        WHERE project_id = ? AND id = ? AND status = 'pending' AND expires_at > ?
+          AND EXISTS (
+            SELECT 1 FROM auth_sessions
+            WHERE project_id = ? AND id = ? AND user_id = ?
+              AND revoked_at IS NULL AND expires_at > ?
+              AND (absolute_expires_at IS NULL OR absolute_expires_at > ?)
+          )
+      `)
+        .run(
+          params.userId,
+          params.sessionId,
+          toIso(params.approvedAt),
+          params.projectId,
+          params.id,
+          toIso(params.approvedAt),
+          params.projectId,
+          params.sessionId,
+          params.userId,
+          toIso(params.approvedAt),
+          toIso(params.approvedAt)
+        )
+      if (result.changes !== 1) throw invalidTransition(params.id, params.projectId)
+      return requireById(this.db, params.projectId, params.id)
+    })
+  }
+
+  async deny(params: { readonly projectId: string; readonly id: string; readonly deniedAt: Date }) {
+    return runImmediateTransaction(this.db, () => {
+      const result = this.db
+        .query(`
+        UPDATE auth_device_authorizations
+        SET status = 'denied', denied_at = ?
+        WHERE project_id = ? AND id = ? AND status = 'pending' AND expires_at > ?
+      `)
+        .run(toIso(params.deniedAt), params.projectId, params.id, toIso(params.deniedAt))
+      if (result.changes !== 1) throw invalidTransition(params.id, params.projectId)
+      return requireById(this.db, params.projectId, params.id)
+    })
+  }
+}
+
+export function getDeviceAuthorizationById(db: Database, projectId: string, id: string) {
+  return getById(db, projectId, id)
+}
+
+function getById(db: Database, projectId: string, id: string) {
+  const row = db
+    .query("SELECT * FROM auth_device_authorizations WHERE project_id = ? AND id = ?")
+    .get(projectId, id) as SqliteAuthDeviceAuthorizationRow | null
+  return row ? rowToDeviceAuthorizationRecord(row) : null
+}
+
+function requireById(db: Database, projectId: string, id: string): DeviceAuthorizationRecord {
+  const record = getById(db, projectId, id)
+  if (!record) {
+    throw new AuthStorageError(
+      "missing_device_authorization",
+      `[Sixb] Device authorization '${id}' not found for project '${projectId}'.`
+    )
+  }
+  return record
+}
+
+function invalidTransition(id: string, projectId: string): AuthStorageError {
+  return new AuthStorageError(
+    "invalid_device_authorization",
+    `[Sixb] Device authorization '${id}' is no longer pending for project '${projectId}'.`
+  )
+}

package/src/auth-storage/rows.ts

@@ -1,6 +1,7 @@
 import type { Principal } from "@sixb/core"
 import type {
   AccessTokenRecord,
+  DeviceAuthorizationRecord,
   GroupMembershipRecord,
   GroupMembershipSource,
   InvitationRecord,
@@ -145,6 +146,24 @@ export interface SqliteAuthOidcAttemptRow {
   readonly consumed_at: string | null
 }
 
+export interface SqliteAuthDeviceAuthorizationRow {
+  readonly project_id: string
+  readonly id: string
+  readonly device_code_hash: string
+  readonly user_code: string
+  readonly client_name: string
+  readonly token_name: string
+  readonly token_expires_at: string
+  readonly status: DeviceAuthorizationRecord["status"]
+  readonly approved_user_id: string | null
+  readonly approved_session_id: string | null
+  readonly created_at: string
+  readonly expires_at: string
+  readonly approved_at: string | null
+  readonly denied_at: string | null
+  readonly consumed_at: string | null
+}
+
 export function rowToUserRecord(row: SqliteAuthUserRow): UserRecord {
   return {
     id: row.id,
@@ -319,6 +338,28 @@ export function rowToOidcAuthorizationAttemptRecord(
   }
 }
 
+export function rowToDeviceAuthorizationRecord(
+  row: SqliteAuthDeviceAuthorizationRow
+): DeviceAuthorizationRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    deviceCodeHash: row.device_code_hash,
+    userCode: row.user_code,
+    clientName: row.client_name,
+    tokenName: row.token_name,
+    tokenExpiresAt: new Date(row.token_expires_at),
+    status: row.status,
+    approvedUserId: row.approved_user_id ?? undefined,
+    approvedSessionId: row.approved_session_id ?? undefined,
+    createdAt: new Date(row.created_at),
+    expiresAt: new Date(row.expires_at),
+    approvedAt: row.approved_at ? new Date(row.approved_at) : undefined,
+    deniedAt: row.denied_at ? new Date(row.denied_at) : undefined,
+    consumedAt: row.consumed_at ? new Date(row.consumed_at) : undefined,
+  }
+}
+
 export function serializeOptionalRecord(
   value: Readonly<Record<string, unknown>> | undefined
 ): string | null {

package/src/auth-storage/shared.ts

@@ -658,6 +658,7 @@ export function mapUniqueConstraintError(
   error: unknown,
   code:
     | "duplicate_access_token"
+    | "duplicate_device_authorization"
     | "duplicate_identity"
     | "duplicate_invitation"
     | "duplicate_magic_link"

package/src/index.ts

@@ -20,6 +20,7 @@ import {
 } from "@sixb/core/internal/storage-operation-scope"
 import {
   type AiCostStorage,
+  type AiLimitStorage,
   type AiUsageStorage,
   createTransactionStorageProxy,
   StorageTransactionError,
@@ -28,6 +29,7 @@ import {
 import { SqliteActionRunStorage } from "./action-run-storage"
 import { SqliteAgentStorage } from "./agents"
 import { SqliteAiCostStorage } from "./ai-cost-storage"
+import { SqliteAiLimitStorage } from "./ai-limit-storage"
 import { SqliteAiUsageStorage } from "./ai-usage-storage"
 import { SqliteAuthStorage } from "./auth-storage"
 import { SqliteConnectorConnectionStorage } from "./connector-connection-storage"
@@ -84,6 +86,7 @@ export class SqliteStorage implements MigrationCapableStorage {
   readonly agents: SqliteAgentStorage
   readonly aiUsage: AiUsageStorage
   readonly aiCosts: AiCostStorage
+  readonly aiLimits: AiLimitStorage
   readonly actionRuns: SqliteActionRunStorage
   readonly pipelineRuns: SqlitePipelineRunStorage
   readonly syncRuns: SqliteSyncRunStorage
@@ -147,6 +150,7 @@ export class SqliteStorage implements MigrationCapableStorage {
     this.agents = createAgentOperationScope(stores.agents, scope)
     this.aiUsage = createOperationScopedFacade(stores.aiUsage, scope)
     this.aiCosts = createOperationScopedFacade(stores.aiCosts, scope)
+    this.aiLimits = createOperationScopedFacade(stores.aiLimits, scope)
     this.actionRuns = createOperationScopedFacade(stores.actionRuns, scope)
     this.pipelineRuns = createOperationScopedFacade(stores.pipelineRuns, scope)
     this.timeseries = createOperationScopedFacade(readTimeseries, readScope)
@@ -303,6 +307,7 @@ function createSqliteStores(
     agents: new SqliteAgentStorage({ connection, executions }),
     aiUsage: new SqliteAiUsageStorage({ connection }),
     aiCosts: new SqliteAiCostStorage(connection),
+    aiLimits: new SqliteAiLimitStorage({ connection }),
     actionRuns: new SqliteActionRunStorage({ connection, executions }),
     pipelineRuns: new SqlitePipelineRunStorage({ connection, executions }),
     timeseries: new SqliteTimeseriesStorage({ connection }),
@@ -324,6 +329,7 @@ interface SqliteStoreSet {
   readonly agents: SqliteAgentStorage
   readonly aiUsage: SqliteAiUsageStorage
   readonly aiCosts: SqliteAiCostStorage
+  readonly aiLimits: SqliteAiLimitStorage
   readonly actionRuns: SqliteActionRunStorage
   readonly pipelineRuns: SqlitePipelineRunStorage
   readonly syncRuns: SqliteSyncRunStorage