@sixb/sqlite 0.1.6 → 0.1.7

package/dist/index.js

@@ -3015,6 +3015,623 @@ ADD COLUMN edited_at TEXT NOT NULL DEFAULT '{}'
 CHECK (json_valid(edited_at) AND json_type(edited_at) = 'object');
 `;
 
+// src/migrations/029-model-accounting.sql
+var _029_model_accounting_default = `-- Call-time model configuration and provider identity. Historical identity remains unknown.
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN requested_reasoning TEXT
+  CHECK (
+    requested_reasoning IS NULL OR (
+      json_valid(requested_reasoning) AND
+      json_type(requested_reasoning) IN ('text', 'object')
+    )
+  );
+ALTER TABLE ai_model_call_usage ADD COLUMN provider_ids TEXT
+  CHECK (provider_ids IS NULL OR json_valid(provider_ids));
+
+-- Upgrade the shipped valuation reason while retaining the selected-cost projection.
+CREATE TABLE ai_model_call_valuations_next (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  usage_record_id TEXT NOT NULL CHECK (length(trim(usage_record_id)) > 0),
+  status TEXT NOT NULL CHECK (status IN ('rated', 'unpriceable')),
+  provider_id TEXT CHECK (provider_id IS NULL OR length(trim(provider_id)) > 0),
+  model_id TEXT CHECK (model_id IS NULL OR length(trim(model_id)) > 0),
+  currency TEXT CHECK (
+    currency IS NULL OR (length(currency) = 3 AND currency GLOB '[A-Z][A-Z][A-Z]')
+  ),
+  amount_nanos INTEGER CHECK (
+    amount_nanos IS NULL OR (typeof(amount_nanos) = 'integer' AND amount_nanos >= 0)
+  ),
+  reason TEXT CHECK (
+    reason IS NULL OR reason IN (
+      'missingBillingIdentity',
+      'missingRateCard',
+      'missingUsageMeter',
+      'unsupportedPricingDimension',
+      'invalidUsageForFormula'
+    )
+  ),
+  details TEXT NOT NULL CHECK (json_valid(details) AND json_type(details) = 'object'),
+  rated_at TEXT NOT NULL CHECK (length(trim(rated_at)) > 0),
+  PRIMARY KEY (project_id, usage_record_id),
+  FOREIGN KEY (project_id, usage_record_id)
+    REFERENCES ai_model_call_usage(project_id, id)
+    ON DELETE RESTRICT,
+  CHECK (
+    (
+      status = 'rated'
+      AND provider_id IS NOT NULL
+      AND model_id IS NOT NULL
+      AND currency IS NOT NULL
+      AND amount_nanos IS NOT NULL
+      AND reason IS NULL
+    )
+    OR
+    (
+      status = 'unpriceable'
+      AND currency IS NULL
+      AND amount_nanos IS NULL
+      AND reason IS NOT NULL
+      AND (
+        (reason = 'missingBillingIdentity' AND provider_id IS NULL AND model_id IS NULL)
+        OR
+        (reason <> 'missingBillingIdentity' AND provider_id IS NOT NULL AND model_id IS NOT NULL)
+      )
+    )
+  )
+);
+
+INSERT INTO ai_model_call_valuations_next (
+  project_id, usage_record_id, status, provider_id, model_id,
+  currency, amount_nanos, reason, details, rated_at
+)
+SELECT project_id, usage_record_id, status, provider_id, model_id,
+  currency, amount_nanos,
+  CASE WHEN reason = 'missingCatalogEntry' THEN 'missingRateCard' ELSE reason END,
+  details, rated_at
+FROM ai_model_call_valuations;
+
+DROP TABLE ai_model_call_valuations;
+ALTER TABLE ai_model_call_valuations_next RENAME TO ai_model_call_valuations;
+
+CREATE INDEX idx_ai_model_call_valuations_summary
+  ON ai_model_call_valuations (project_id, status, currency, usage_record_id);
+`;
+
+// src/migrations/030-ai-usage-limits.sql
+var _030_ai_usage_limits_default = `CREATE TABLE ai_usage_limits (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  subject_type TEXT NOT NULL CHECK (
+    subject_type IN ('project', 'group', 'user', 'serviceAccount')
+  ),
+  subject_id TEXT NOT NULL CHECK (
+    (subject_type = 'project' AND subject_id = '')
+    OR (subject_type <> 'project' AND length(trim(subject_id)) > 0)
+  ),
+  meter TEXT NOT NULL CHECK (meter IN ('tokens.total', 'cost.catalogEstimated')),
+  currency TEXT NOT NULL CHECK (
+    (meter = 'tokens.total' AND currency = '')
+    OR (meter = 'cost.catalogEstimated' AND currency = 'USD')
+  ),
+  limit_amount TEXT NOT NULL CHECK (
+    limit_amount = '0'
+    OR (
+      limit_amount NOT GLOB '*[^0-9]*'
+      AND substr(limit_amount, 1, 1) BETWEEN '1' AND '9'
+    )
+  ),
+  period_kind TEXT NOT NULL CHECK (period_kind = 'calendarMonth'),
+  enabled INTEGER NOT NULL CHECK (enabled IN (0, 1)),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, subject_type, subject_id, meter, currency)
+);
+
+CREATE INDEX idx_ai_usage_limits_project_enabled
+  ON ai_usage_limits (project_id, enabled, subject_type, subject_id, meter, currency);
+
+CREATE TABLE ai_usage_limit_periods (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  subject_type TEXT NOT NULL CHECK (
+    subject_type IN ('project', 'group', 'user', 'serviceAccount')
+  ),
+  subject_id TEXT NOT NULL CHECK (
+    (subject_type = 'project' AND subject_id = '')
+    OR (subject_type <> 'project' AND length(trim(subject_id)) > 0)
+  ),
+  meter TEXT NOT NULL CHECK (meter IN ('tokens.total', 'cost.catalogEstimated')),
+  currency TEXT NOT NULL CHECK (
+    (meter = 'tokens.total' AND currency = '')
+    OR (meter = 'cost.catalogEstimated' AND currency = 'USD')
+  ),
+  period_start TEXT NOT NULL,
+  period_end TEXT NOT NULL,
+  actual_amount TEXT NOT NULL DEFAULT '0',
+  reserved_amount TEXT NOT NULL DEFAULT '0',
+  unknown_amount TEXT NOT NULL DEFAULT '0',
+  accounting_status TEXT NOT NULL DEFAULT 'complete' CHECK (
+    accounting_status IN ('complete', 'unavailable')
+  ),
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (
+    project_id, subject_type, subject_id, meter, currency, period_start
+  )
+);
+
+CREATE INDEX idx_ai_usage_limit_periods_subject_period
+  ON ai_usage_limit_periods (
+    project_id, subject_type, subject_id, period_start, period_end, meter, currency
+  );
+
+CREATE TABLE ai_model_call_reservations (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  execution_id TEXT NOT NULL CHECK (length(trim(execution_id)) > 0),
+  attempt INTEGER NOT NULL CHECK (attempt >= 1),
+  call_id TEXT NOT NULL CHECK (length(trim(call_id)) > 0),
+  buckets TEXT NOT NULL CHECK (json_valid(buckets) AND json_type(buckets) = 'array'),
+  request_key TEXT NOT NULL,
+  period_start TEXT NOT NULL,
+  period_end TEXT NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('active', 'reconciled', 'unknown')),
+  usage_record_id TEXT,
+  reserved_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, execution_id, attempt, call_id),
+  FOREIGN KEY (project_id, execution_id)
+    REFERENCES executions(project_id, id)
+    ON DELETE RESTRICT,
+  FOREIGN KEY (project_id, usage_record_id)
+    REFERENCES ai_model_call_usage(project_id, id)
+    ON DELETE RESTRICT,
+  CHECK (
+    (
+      state = 'reconciled'
+      AND usage_record_id IS NOT NULL
+    )
+    OR (
+      state <> 'reconciled'
+      AND usage_record_id IS NULL
+    )
+  )
+);
+
+CREATE INDEX idx_ai_model_call_reservations_active
+  ON ai_model_call_reservations (project_id, state, period_end, execution_id, attempt, call_id);
+`;
+
+// src/migrations/031-subagent-runs.sql
+var _031_subagent_runs_default = `-- SQLite cannot alter a CHECK constraint in place. Rebuild the execution table to align SQL with
+-- the durable Agent authority model: managed service account or exact inherited user/disabled.
+CREATE TABLE executions_v3 (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  executor_kind TEXT NOT NULL CHECK (
+    executor_kind IN (
+      'request', 'action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow',
+      'agent', 'kernel'
+    )
+  ),
+  executor_id TEXT NOT NULL CHECK (length(trim(executor_id)) > 0),
+  source_kind TEXT NOT NULL CHECK (
+    source_kind IN ('http', 'webhook', 'schedule', 'event', 'datasetVersion', 'execution')
+  ),
+  source_id TEXT NOT NULL CHECK (length(trim(source_id)) > 0),
+  requested_by_user_id TEXT,
+  requested_by_service_account_id TEXT,
+  correlation_id TEXT NOT NULL CHECK (length(trim(correlation_id)) > 0),
+  parent_execution_id TEXT,
+  authority_kind TEXT NOT NULL CHECK (
+    authority_kind IN ('principal', 'trustedPrimitive', 'kernel', 'disabled')
+  ),
+  authority_user_id TEXT,
+  authority_service_account_id TEXT,
+  authority_session_id TEXT,
+  authority_access_token_id TEXT,
+  authority_primitive_kind TEXT CHECK (
+    authority_primitive_kind IS NULL
+      OR authority_primitive_kind IN (
+        'action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow'
+      )
+  ),
+  authority_primitive_id TEXT,
+  authority_kernel_operation TEXT CHECK (
+    authority_kernel_operation IS NULL OR authority_kernel_operation = 'ontology.recover'
+  ),
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, id),
+  FOREIGN KEY (project_id, parent_execution_id) REFERENCES executions (project_id, id),
+  FOREIGN KEY (project_id, requested_by_user_id) REFERENCES auth_users (project_id, id),
+  FOREIGN KEY (project_id, requested_by_service_account_id)
+    REFERENCES auth_service_accounts (project_id, id),
+  FOREIGN KEY (project_id, authority_user_id) REFERENCES auth_users (project_id, id),
+  FOREIGN KEY (project_id, authority_service_account_id)
+    REFERENCES auth_service_accounts (project_id, id),
+  FOREIGN KEY (project_id, authority_session_id) REFERENCES auth_sessions (project_id, id),
+  FOREIGN KEY (project_id, authority_access_token_id)
+    REFERENCES auth_access_tokens (project_id, id),
+  CHECK ((requested_by_user_id IS NOT NULL) + (requested_by_service_account_id IS NOT NULL) <= 1),
+  CHECK (
+    (source_kind = 'execution' AND parent_execution_id = source_id)
+      OR (source_kind <> 'execution' AND parent_execution_id IS NULL)
+  ),
+  CHECK (
+    (
+      authority_kind = 'principal'
+      AND (authority_user_id IS NOT NULL) + (authority_service_account_id IS NOT NULL) = 1
+      AND (authority_session_id IS NOT NULL) + (authority_access_token_id IS NOT NULL) <= 1
+      AND (authority_session_id IS NULL OR authority_user_id IS NOT NULL)
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+    )
+    OR (
+      authority_kind = 'trustedPrimitive'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NOT NULL
+      AND authority_primitive_id IS NOT NULL
+      AND length(trim(authority_primitive_id)) > 0
+      AND authority_kernel_operation IS NULL
+    )
+    OR (
+      authority_kind = 'kernel'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NOT NULL
+    )
+    OR (
+      authority_kind = 'disabled'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+    )
+  ),
+  CHECK (
+    (
+      executor_kind = 'request'
+      AND source_kind = 'http'
+      AND executor_id = source_id
+      AND (
+        (
+          authority_kind = 'principal'
+          AND requested_by_user_id IS authority_user_id
+          AND requested_by_service_account_id IS authority_service_account_id
+        )
+        OR (
+          authority_kind = 'disabled'
+          AND requested_by_user_id IS NULL
+          AND requested_by_service_account_id IS NULL
+        )
+      )
+    )
+    OR (
+      executor_kind IN ('action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow')
+      AND authority_kind = 'trustedPrimitive'
+      AND executor_kind = authority_primitive_kind
+    )
+    OR (
+      executor_kind = 'agent'
+      AND source_kind = 'execution'
+      AND (
+        (
+          authority_kind = 'principal'
+          AND authority_service_account_id IS NOT NULL
+          AND authority_session_id IS NULL
+          AND authority_access_token_id IS NULL
+        )
+        OR (
+          authority_kind = 'principal'
+          AND authority_user_id IS NOT NULL
+          AND (authority_session_id IS NOT NULL) + (authority_access_token_id IS NOT NULL) = 1
+        )
+        OR authority_kind = 'disabled'
+      )
+    )
+    OR (executor_kind = 'kernel' AND authority_kind = 'kernel')
+  )
+);
+
+INSERT INTO executions_v3 SELECT * FROM executions;
+DROP TABLE executions;
+ALTER TABLE executions_v3 RENAME TO executions;
+
+CREATE TABLE agent_runs_v3 (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  execution_id TEXT NOT NULL,
+  kind TEXT NOT NULL DEFAULT 'conversation' CHECK (kind IN ('conversation', 'subagent')),
+  thread_id TEXT,
+  agent_id TEXT,
+  trigger_message_id TEXT,
+  parent_run_id TEXT,
+  spawn_key TEXT,
+  spec TEXT CHECK (spec IS NULL OR json_valid(spec)),
+  result TEXT CHECK (result IS NULL OR json_valid(result)),
+  requester_group_ids TEXT NOT NULL DEFAULT '[]'
+    CHECK (json_valid(requester_group_ids) AND json_type(requester_group_ids) = 'array'),
+  status TEXT NOT NULL CHECK (
+    status IN ('queued', 'running', 'succeeded', 'failed', 'cancelled')
+  ),
+  model_id TEXT,
+  finish_reason TEXT,
+  error TEXT CHECK (error IS NULL OR json_valid(error)),
+  diagnostics TEXT,
+  attempt INTEGER NOT NULL DEFAULT 0 CHECK (attempt >= 0),
+  execution_token TEXT,
+  execution_queue_lease_expires_at TEXT,
+  created_at TEXT NOT NULL,
+  started_at TEXT,
+  completed_at TEXT,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, execution_id),
+  UNIQUE (project_id, parent_run_id, spawn_key),
+  FOREIGN KEY (project_id, execution_id)
+    REFERENCES executions (project_id, id)
+    ON DELETE RESTRICT,
+  FOREIGN KEY (project_id, parent_run_id)
+    REFERENCES agent_runs_v3 (project_id, id)
+    ON DELETE RESTRICT,
+  CHECK ((execution_token IS NULL) = (execution_queue_lease_expires_at IS NULL)),
+  CHECK (
+    (
+      kind = 'conversation'
+      AND thread_id IS NOT NULL
+      AND agent_id IS NOT NULL
+      AND trigger_message_id IS NOT NULL
+      AND parent_run_id IS NULL
+      AND spawn_key IS NULL
+      AND spec IS NULL
+      AND result IS NULL
+    )
+    OR
+    (
+      kind = 'subagent'
+      AND thread_id IS NULL
+      AND agent_id IS NULL
+      AND trigger_message_id IS NULL
+      AND parent_run_id IS NOT NULL
+      AND spawn_key IS NOT NULL
+      AND spec IS NOT NULL
+    )
+  ),
+  CHECK (kind <> 'subagent' OR status <> 'succeeded' OR result IS NOT NULL)
+);
+
+INSERT INTO agent_runs_v3 (
+  project_id, id, execution_id, kind, thread_id, agent_id, trigger_message_id,
+  requester_group_ids, status, model_id, finish_reason, error, diagnostics, attempt,
+  execution_token, execution_queue_lease_expires_at, created_at, started_at, completed_at
+)
+SELECT
+  project_id, id, execution_id, 'conversation', thread_id, agent_id, trigger_message_id,
+  requester_group_ids, status, model_id, finish_reason, error, diagnostics, attempt,
+  execution_token, execution_queue_lease_expires_at, created_at, started_at, completed_at
+FROM agent_runs;
+
+DROP TABLE agent_runs;
+ALTER TABLE agent_runs_v3 RENAME TO agent_runs;
+
+CREATE INDEX idx_agent_runs_project_started
+  ON agent_runs(project_id, COALESCE(started_at, created_at) DESC);
+CREATE INDEX idx_agent_runs_project_thread_started
+  ON agent_runs(project_id, thread_id, COALESCE(started_at, created_at) DESC);
+CREATE INDEX idx_agent_runs_project_agent_started
+  ON agent_runs(project_id, agent_id, COALESCE(started_at, created_at) DESC);
+CREATE INDEX idx_agent_runs_project_status_started
+  ON agent_runs(project_id, status, COALESCE(started_at, created_at) DESC);
+CREATE INDEX idx_agent_runs_project_parent_started
+  ON agent_runs(project_id, parent_run_id, status, COALESCE(started_at, created_at) DESC);
+`;
+
+// src/migrations/032-conversation-run-spec.sql
+var _032_conversation_run_spec_default = `CREATE TABLE agent_runs_v4 (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  execution_id TEXT NOT NULL,
+  kind TEXT NOT NULL DEFAULT 'conversation' CHECK (kind IN ('conversation', 'subagent')),
+  thread_id TEXT,
+  agent_id TEXT,
+  trigger_message_id TEXT,
+  parent_run_id TEXT,
+  spawn_key TEXT,
+  spec TEXT CHECK (spec IS NULL OR json_valid(spec)),
+  result TEXT CHECK (result IS NULL OR json_valid(result)),
+  requester_group_ids TEXT NOT NULL DEFAULT '[]'
+    CHECK (json_valid(requester_group_ids) AND json_type(requester_group_ids) = 'array'),
+  status TEXT NOT NULL CHECK (
+    status IN ('queued', 'running', 'succeeded', 'failed', 'cancelled')
+  ),
+  model_id TEXT,
+  finish_reason TEXT,
+  error TEXT CHECK (error IS NULL OR json_valid(error)),
+  diagnostics TEXT,
+  attempt INTEGER NOT NULL DEFAULT 0 CHECK (attempt >= 0),
+  execution_token TEXT,
+  execution_queue_lease_expires_at TEXT,
+  created_at TEXT NOT NULL,
+  started_at TEXT,
+  completed_at TEXT,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, execution_id),
+  UNIQUE (project_id, parent_run_id, spawn_key),
+  FOREIGN KEY (project_id, execution_id)
+    REFERENCES executions (project_id, id)
+    ON DELETE RESTRICT,
+  FOREIGN KEY (project_id, parent_run_id)
+    -- Use the final name: Bun's legacy ALTER mode preserves references when foreign keys are off.
+    REFERENCES agent_runs (project_id, id)
+    ON DELETE RESTRICT,
+  CHECK ((execution_token IS NULL) = (execution_queue_lease_expires_at IS NULL)),
+  CHECK (
+    (
+      kind = 'conversation'
+      AND thread_id IS NOT NULL
+      AND agent_id IS NOT NULL
+      AND trigger_message_id IS NOT NULL
+      AND parent_run_id IS NULL
+      AND spawn_key IS NULL
+      AND result IS NULL
+    )
+    OR
+    (
+      kind = 'subagent'
+      AND thread_id IS NULL
+      AND agent_id IS NULL
+      AND trigger_message_id IS NULL
+      AND parent_run_id IS NOT NULL
+      AND spawn_key IS NOT NULL
+      AND spec IS NOT NULL
+    )
+  ),
+  CHECK (kind <> 'subagent' OR status <> 'succeeded' OR result IS NOT NULL)
+);
+
+INSERT INTO agent_runs_v4 SELECT * FROM agent_runs;
+DROP TABLE agent_runs;
+ALTER TABLE agent_runs_v4 RENAME TO agent_runs;
+
+CREATE INDEX idx_agent_runs_project_thread_started
+  ON agent_runs (project_id, thread_id, COALESCE(started_at, created_at) DESC, id DESC);
+CREATE INDEX idx_agent_runs_project_status_created
+  ON agent_runs (project_id, status, created_at, id);
+CREATE INDEX idx_agent_runs_project_parent_started
+  ON agent_runs (
+    project_id,
+    parent_run_id,
+    status,
+    COALESCE(started_at, created_at) DESC,
+    id DESC
+  );
+`;
+
+// src/migrations/033-retire-agent-definitions.sql
+var _033_retire_agent_definitions_default = `DROP INDEX idx_agent_threads_project_agent_activity;
+ALTER TABLE workflow_agent_node_runs RENAME COLUMN agent_id TO actor_id;
+ALTER TABLE agent_threads DROP COLUMN agent_id;
+
+CREATE TABLE agent_runs_v5 (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  execution_id TEXT NOT NULL,
+  kind TEXT NOT NULL DEFAULT 'conversation' CHECK (kind IN ('conversation', 'subagent')),
+  thread_id TEXT,
+  trigger_message_id TEXT,
+  parent_run_id TEXT,
+  spawn_key TEXT,
+  spec TEXT CHECK (spec IS NULL OR json_valid(spec)),
+  result TEXT CHECK (result IS NULL OR json_valid(result)),
+  requester_group_ids TEXT NOT NULL DEFAULT '[]'
+    CHECK (json_valid(requester_group_ids) AND json_type(requester_group_ids) = 'array'),
+  status TEXT NOT NULL CHECK (
+    status IN ('queued', 'running', 'succeeded', 'failed', 'cancelled')
+  ),
+  model_id TEXT,
+  finish_reason TEXT,
+  error TEXT CHECK (error IS NULL OR json_valid(error)),
+  diagnostics TEXT,
+  attempt INTEGER NOT NULL DEFAULT 0 CHECK (attempt >= 0),
+  execution_token TEXT,
+  execution_queue_lease_expires_at TEXT,
+  created_at TEXT NOT NULL,
+  started_at TEXT,
+  completed_at TEXT,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, execution_id),
+  UNIQUE (project_id, parent_run_id, spawn_key),
+  FOREIGN KEY (project_id, execution_id)
+    REFERENCES executions (project_id, id)
+    ON DELETE RESTRICT,
+  FOREIGN KEY (project_id, parent_run_id)
+    -- Use the final name: Bun's legacy ALTER mode preserves references when foreign keys are off.
+    REFERENCES agent_runs (project_id, id)
+    ON DELETE RESTRICT,
+  CHECK ((execution_token IS NULL) = (execution_queue_lease_expires_at IS NULL)),
+  CHECK (
+    (
+      kind = 'conversation'
+      AND thread_id IS NOT NULL
+      AND trigger_message_id IS NOT NULL
+      AND parent_run_id IS NULL
+      AND spawn_key IS NULL
+      AND result IS NULL
+    )
+    OR
+    (
+      kind = 'subagent'
+      AND thread_id IS NULL
+      AND trigger_message_id IS NULL
+      AND parent_run_id IS NOT NULL
+      AND spawn_key IS NOT NULL
+      AND spec IS NOT NULL
+    )
+  ),
+  CHECK (kind <> 'subagent' OR status <> 'succeeded' OR result IS NOT NULL)
+);
+
+INSERT INTO agent_runs_v5 (
+  project_id, id, execution_id, kind, thread_id, trigger_message_id, parent_run_id, spawn_key,
+  spec, result, requester_group_ids, status, model_id, finish_reason, error, diagnostics, attempt,
+  execution_token, execution_queue_lease_expires_at, created_at, started_at, completed_at
+)
+SELECT
+  project_id, id, execution_id, kind, thread_id, trigger_message_id, parent_run_id, spawn_key,
+  spec, result, requester_group_ids, status, model_id, finish_reason, error, diagnostics, attempt,
+  execution_token, execution_queue_lease_expires_at, created_at, started_at, completed_at
+FROM agent_runs;
+
+DROP TABLE agent_runs;
+ALTER TABLE agent_runs_v5 RENAME TO agent_runs;
+
+CREATE INDEX idx_agent_runs_project_thread_started
+  ON agent_runs (project_id, thread_id, COALESCE(started_at, created_at) DESC, id DESC);
+CREATE INDEX idx_agent_runs_project_status_created
+  ON agent_runs (project_id, status, created_at, id);
+CREATE INDEX idx_agent_runs_project_parent_started
+  ON agent_runs (
+    project_id,
+    parent_run_id,
+    status,
+    COALESCE(started_at, created_at) DESC,
+    id DESC
+  );
+`;
+
+// src/migrations/034-device-authorizations.sql
+var _034_device_authorizations_default = `CREATE TABLE auth_device_authorizations (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  device_code_hash TEXT NOT NULL,
+  user_code TEXT NOT NULL,
+  client_name TEXT NOT NULL,
+  token_name TEXT NOT NULL,
+  token_expires_at TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('pending', 'approved', 'denied', 'consumed')),
+  approved_user_id TEXT,
+  approved_session_id TEXT,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  approved_at TEXT,
+  denied_at TEXT,
+  consumed_at TEXT,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, user_code)
+);
+
+CREATE INDEX idx_auth_device_authorizations_pending
+  ON auth_device_authorizations(project_id, status, expires_at);
+`;
+
 // src/migrations.ts
 var MIGRATIONS_TABLE_SQL = `
   CREATE TABLE IF NOT EXISTS sixb_migrations (
@@ -3077,7 +3694,13 @@ var sqliteStorageMigrations = defineMigrations({
     sqliteSql("025-connector-connections", _025_connector_connections_default),
     sqliteSql("026-ai-cost-accounting", _026_ai_cost_accounting_default),
     sqliteSql("027-agent-context-checkpoints", _027_agent_context_checkpoints_default),
-    sqliteSql("028-object-override-edit-times", _028_object_override_edit_times_default)
+    sqliteSql("028-object-override-edit-times", _028_object_override_edit_times_default),
+    sqliteSql("029-model-accounting", _029_model_accounting_default),
+    sqliteSql("030-ai-usage-limits", _030_ai_usage_limits_default),
+    sqliteSql("031-subagent-runs", _031_subagent_runs_default),
+    sqliteSql("032-conversation-run-spec", _032_conversation_run_spec_default),
+    sqliteSql("033-retire-agent-definitions", _033_retire_agent_definitions_default),
+    sqliteSql("034-device-authorizations", _034_device_authorizations_default)
   ]
 });
 function sqliteStoragePath(basePath) {
@@ -3750,7 +4373,6 @@ function rowToThreadRecord(row) {
   return {
     id: row.id,
     projectId: row.project_id,
-    agentId: row.agent_id,
     ownerPrincipal: { type: row.owner_principal_type, id: row.owner_principal_id },
     title: row.title ?? undefined,
     status: row.status,
@@ -3762,13 +4384,10 @@ function rowToThreadRecord(row) {
   };
 }
 function rowToRunRecord(row) {
-  return {
+  const base = {
     id: row.id,
     projectId: row.project_id,
     executionId: row.execution_id,
-    threadId: row.thread_id,
-    agentId: row.agent_id,
-    triggerMessageId: row.trigger_message_id,
     requesterGroupIds: JSON.parse(row.requester_group_ids),
     status: row.status,
     modelId: row.model_id ?? undefined,
@@ -3784,6 +4403,29 @@ function rowToRunRecord(row) {
     startedAt: row.started_at ? new Date(row.started_at) : undefined,
     completedAt: row.completed_at ? new Date(row.completed_at) : undefined
   };
+  if (row.kind === "conversation") {
+    if (!row.thread_id || !row.trigger_message_id) {
+      throw new Error(`[SixbSqlite] Conversational Agent run '${row.id}' has invalid persisted fields.`);
+    }
+    return {
+      ...base,
+      kind: "conversation",
+      threadId: row.thread_id,
+      triggerMessageId: row.trigger_message_id,
+      ...row.spec === null ? {} : { spec: JSON.parse(row.spec) }
+    };
+  }
+  if (!row.parent_run_id || !row.spawn_key || row.spec === null) {
+    throw new Error(`[SixbSqlite] Subagent run '${row.id}' has invalid persisted fields.`);
+  }
+  return {
+    ...base,
+    kind: "subagent",
+    parentRunId: row.parent_run_id,
+    spawnKey: row.spawn_key,
+    spec: JSON.parse(row.spec),
+    ...row.result === null ? {} : { result: JSON.parse(row.result) }
+  };
 }
 function rowToMessageRecord(row) {
   return {
@@ -4082,7 +4724,13 @@ class SqliteAgentMessageStore {
 }
 
 // src/agents/runs.ts
-import { assertAgentRunExecution } from "@sixb/core/internal/agent-run-storage-provider";
+import {
+  assertAgentRunExecution,
+  assertConversationAgentRunSpec,
+  assertCreateSubagentRunInput,
+  assertSubagentRunResult,
+  subagentRunMatchesCreateInput
+} from "@sixb/core/internal/agent-run-storage-provider";
 import { normalizeRequesterGroupIds } from "@sixb/core/internal/auth";
 import { serializeSixbFailure } from "@sixb/core/internal/errors";
 import {
@@ -4152,13 +4800,13 @@ class SqliteAgentRunStore {
     this.executions = executions;
   }
   async create(input) {
+    assertConversationAgentRunSpec(input.spec, "SixbSqlite");
     const createdAt = input.createdAt ?? new Date;
     await assertAgentRunExecution({
       executions: this.executions,
       projectId: input.projectId,
       executionId: input.executionId,
-      runId: input.id,
-      agentId: input.agentId
+      runId: input.id
     });
     return this.db.transaction(() => {
       const thread = this.db.query("SELECT active_run_id FROM agent_threads WHERE project_id = ? AND id = ?").get(input.projectId, input.threadId);
@@ -4174,15 +4822,16 @@ class SqliteAgentRunStore {
               project_id,
               id,
               execution_id,
+              kind,
               thread_id,
-              agent_id,
               trigger_message_id,
+              spec,
               requester_group_ids,
               status,
               attempt,
               created_at
-            ) VALUES (?, ?, ?, ?, ?, ?, ?, 'queued', 0, ?)
-          `).run(input.projectId, input.id, input.executionId, input.threadId, input.agentId, input.triggerMessageId, JSON.stringify(normalizeRequesterGroupIds(input.requesterGroupIds)), createdAt.toISOString());
+            ) VALUES (?, ?, ?, 'conversation', ?, ?, ?, ?, 'queued', 0, ?)
+          `).run(input.projectId, input.id, input.executionId, input.threadId, input.triggerMessageId, JSON.stringify(input.spec), JSON.stringify(normalizeRequesterGroupIds(input.requesterGroupIds)), createdAt.toISOString());
       } catch (error) {
         if (isUniqueConstraintError2(error)) {
           throw new AgentStorageError3("duplicate_id", `[SixbSqlite] Agent run '${input.id}' already exists for project '${input.projectId}'.`);
@@ -4190,7 +4839,65 @@ class SqliteAgentRunStore {
         throw error;
       }
       this.db.query("UPDATE agent_threads SET active_run_id = ?, updated_at = ? WHERE project_id = ? AND id = ?").run(input.id, createdAt.toISOString(), input.projectId, input.threadId);
-      return this.requireRun(input.projectId, input.id);
+      const created = this.requireRun(input.projectId, input.id);
+      if (created.kind !== "conversation") {
+        throw new Error(`[SixbSqlite] Agent run insert '${input.id}' returned the wrong run kind.`);
+      }
+      return created;
+    })();
+  }
+  async createSubagent(input) {
+    assertCreateSubagentRunInput(input, "SixbSqlite");
+    const execution = await assertAgentRunExecution({
+      executions: this.executions,
+      projectId: input.projectId,
+      executionId: input.executionId,
+      runId: input.id
+    });
+    return this.db.transaction(() => {
+      const parentRow = this.db.query("SELECT * FROM agent_runs WHERE project_id = ? AND id = ?").get(input.projectId, input.parentRunId);
+      if (!parentRow || parentRow.kind !== "conversation") {
+        throw new AgentStorageError3("run_not_found", `[SixbSqlite] Parent Agent run '${input.parentRunId}' was not found.`);
+      }
+      const existingRow = this.db.query("SELECT * FROM agent_runs WHERE project_id = ? AND id = ?").get(input.projectId, input.id);
+      if (existingRow) {
+        const existing = rowToRunRecord(existingRow);
+        if (subagentRunMatchesCreateInput(existing, input))
+          return existing;
+        throw new AgentStorageError3("duplicate_id", `[SixbSqlite] Subagent run '${input.id}' already exists with different immutable inputs.`);
+      }
+      if (parentRow.status !== "running") {
+        throw new AgentStorageError3("invalid_state", `[SixbSqlite] Parent Agent run '${parentRow.id}' is not running (status '${parentRow.status}').`);
+      }
+      if (execution.source.type !== "execution" || execution.source.executionId !== parentRow.execution_id) {
+        throw new AgentStorageError3("invalid_input", `[SixbSqlite] Subagent execution '${execution.id}' is not a child of parent execution '${parentRow.execution_id}'.`);
+      }
+      if (parentRow.execution_token !== input.parentExecutionToken) {
+        throw new AgentStorageError3("execution_lost", `[SixbSqlite] Parent Agent run '${parentRow.id}' is no longer owned by this execution.`);
+      }
+      const count = this.db.query(`SELECT COUNT(*) AS count FROM agent_runs
+           WHERE project_id = ? AND parent_run_id = ? AND status IN ('queued', 'running')`).get(input.projectId, input.parentRunId);
+      if (count.count >= input.maxActiveChildren) {
+        throw new AgentStorageError3("active_child_limit", `[SixbSqlite] Agent run '${parentRow.id}' already has ${count.count} active subagents.`);
+      }
+      try {
+        this.db.query(`
+            INSERT INTO agent_runs (
+              project_id, id, execution_id, kind, parent_run_id, spawn_key, spec,
+              requester_group_ids, status, attempt, created_at
+            ) VALUES (?, ?, ?, 'subagent', ?, ?, ?, ?, 'queued', 0, ?)
+          `).run(input.projectId, input.id, input.executionId, input.parentRunId, input.spawnKey, JSON.stringify(input.spec), parentRow.requester_group_ids, (input.createdAt ?? new Date).toISOString());
+      } catch (error) {
+        if (isUniqueConstraintError2(error)) {
+          throw new AgentStorageError3("duplicate_id", `[SixbSqlite] Subagent run '${input.id}' conflicts with an existing durable spawn.`);
+        }
+        throw error;
+      }
+      const created = this.requireRun(input.projectId, input.id);
+      if (created.kind !== "subagent") {
+        throw new Error(`[SixbSqlite] Subagent insert '${input.id}' returned the wrong run kind.`);
+      }
+      return created;
     })();
   }
   async start(input) {
@@ -4260,6 +4967,12 @@ class SqliteAgentRunStore {
       if (run.execution_token !== input.executionToken) {
         throw new AgentStorageError3("execution_lost", `[SixbSqlite] Execution token is no longer current on agent run '${input.id}'.`);
       }
+      if (input.status === "succeeded" && run.kind === "subagent") {
+        assertSubagentRunResult(input.result, run.id, "SixbSqlite");
+      }
+      if (input.status === "succeeded" && run.kind === "conversation" && input.result !== undefined) {
+        throw new AgentStorageError3("invalid_input", `[SixbSqlite] Conversational Agent run '${run.id}' cannot persist a subagent result.`);
+      }
       this.db.query(`
           UPDATE agent_runs
           SET
@@ -4268,11 +4981,12 @@ class SqliteAgentRunStore {
             finish_reason = ?,
             error = ?,
             diagnostics = ?,
+            result = ?,
             execution_token = NULL,
             execution_queue_lease_expires_at = NULL,
             completed_at = ?
           WHERE project_id = ? AND id = ?
-        `).run(input.status, input.modelId ?? null, input.finishReason ?? null, errorValue, input.diagnostics === undefined ? null : JSON.stringify(input.diagnostics), completedAt.toISOString(), input.projectId, input.id);
+        `).run(input.status, input.modelId ?? null, input.finishReason ?? null, errorValue, input.diagnostics === undefined ? null : JSON.stringify(input.diagnostics), input.status === "succeeded" && input.result !== undefined ? JSON.stringify(input.result) : null, completedAt.toISOString(), input.projectId, input.id);
       this.releaseThread(run, completedAt);
       return this.requireRun(input.projectId, input.id);
     })();
@@ -4299,18 +5013,22 @@ class SqliteAgentRunStore {
     });
   }
   async list(input) {
-    if (hasEmptyStatuses(input)) {
+    if (hasEmptyStatuses(input) || input.kinds?.length === 0) {
       return { runs: [], hasMore: false, total: 0 };
     }
     const whereClauses = ["project_id = ?"];
     const args = [input.projectId];
+    if (input.kinds) {
+      whereClauses.push(`kind IN (${input.kinds.map(() => "?").join(", ")})`);
+      args.push(...input.kinds);
+    }
     if (input.threadId) {
       whereClauses.push("thread_id = ?");
       args.push(input.threadId);
     }
-    if (input.agentId) {
-      whereClauses.push("agent_id = ?");
-      args.push(input.agentId);
+    if (input.parentRunId) {
+      whereClauses.push("parent_run_id = ?");
+      args.push(input.parentRunId);
     }
     appendRunListFilters(whereClauses, args, input, "COALESCE(started_at, created_at)");
     const { rows, total, hasMore } = queryRunList({
@@ -4338,6 +5056,8 @@ class SqliteAgentRunStore {
     return row;
   }
   releaseThread(run, completedAt) {
+    if (run.kind !== "conversation")
+      return;
     this.db.query(`
         UPDATE agent_threads
         SET active_run_id = NULL, updated_at = ?
@@ -4370,7 +5090,6 @@ class SqliteAgentThreadStore {
           INSERT INTO agent_threads (
             project_id,
             id,
-            agent_id,
             owner_principal_type,
             owner_principal_id,
             title,
@@ -4380,8 +5099,8 @@ class SqliteAgentThreadStore {
             message_count,
             created_at,
             updated_at
-          ) VALUES (?, ?, ?, ?, ?, ?, ?, NULL, NULL, 0, ?, ?)
-        `).run(input.projectId, input.id, input.agentId, input.ownerPrincipal.type, input.ownerPrincipal.id, input.title ?? null, input.status ?? "active", createdAt.toISOString(), updatedAt.toISOString());
+          ) VALUES (?, ?, ?, ?, ?, ?, NULL, NULL, 0, ?, ?)
+        `).run(input.projectId, input.id, input.ownerPrincipal.type, input.ownerPrincipal.id, input.title ?? null, input.status ?? "active", createdAt.toISOString(), updatedAt.toISOString());
     } catch (error) {
       if (isUniqueConstraintError2(error)) {
         throw new AgentStorageError4("duplicate_id", `[SixbSqlite] Agent thread '${input.id}' already exists for project '${input.projectId}'.`);
@@ -4390,93 +5109,391 @@ class SqliteAgentThreadStore {
     }
     return this.requireThread(input.projectId, input.id);
   }
-  async getById(params) {
-    const row = this.db.query("SELECT * FROM agent_threads WHERE project_id = ? AND id = ?").get(params.projectId, params.id);
-    return row ? rowToThreadRecord(row) : null;
+  async getById(params) {
+    const row = this.db.query("SELECT * FROM agent_threads WHERE project_id = ? AND id = ?").get(params.projectId, params.id);
+    return row ? rowToThreadRecord(row) : null;
+  }
+  async list(input) {
+    if (input.statuses !== undefined && input.statuses.length === 0) {
+      return { threads: [], hasMore: false, total: 0 };
+    }
+    const whereClauses = ["project_id = ?"];
+    const args = [input.projectId];
+    if (input.statuses) {
+      whereClauses.push(`status IN (${input.statuses.map(() => "?").join(", ")})`);
+      args.push(...input.statuses);
+    }
+    if (input.ownerPrincipal) {
+      whereClauses.push("owner_principal_type = ? AND owner_principal_id = ?");
+      args.push(input.ownerPrincipal.type, input.ownerPrincipal.id);
+    }
+    const dir = input.order === "asc" ? "ASC" : "DESC";
+    const { rows, total, hasMore } = queryAgentList({
+      db: this.db,
+      table: "agent_threads",
+      whereClauses,
+      args,
+      orderBy: `COALESCE(last_message_at, created_at) ${dir}, id ${dir}`,
+      limit: input.limit,
+      offset: input.offset
+    });
+    return { threads: rows.map(rowToThreadRecord), hasMore, total };
+  }
+  requireThread(projectId, id) {
+    const row = this.db.query("SELECT * FROM agent_threads WHERE project_id = ? AND id = ?").get(projectId, id);
+    if (!row) {
+      throw new AgentStorageError4("invalid_state", `[SixbSqlite] Failed to load agent thread '${id}' for project '${projectId}'.`);
+    }
+    return rowToThreadRecord(row);
+  }
+}
+
+// src/agents/agent-storage.ts
+class SqliteAgentStorage {
+  threads;
+  runs;
+  messages;
+  checkpoints;
+  connection;
+  constructor(options) {
+    this.connection = openSqliteStoreConnection(options);
+    if (this.connection.installFreshSchema) {
+      installFreshSqliteSchema(this.connection.db);
+    }
+    this.threads = new SqliteAgentThreadStore(this.connection.db);
+    this.runs = new SqliteAgentRunStore(this.connection.db, options.executions);
+    this.messages = new SqliteAgentMessageStore(this.connection.db);
+    this.checkpoints = new SqliteAgentContextCheckpointStore(this.connection.db);
+  }
+  close() {
+    closeSqliteStoreConnection(this.connection);
+  }
+}
+// src/ai-cost-storage.ts
+import {
+  aiModelCallCostDetails,
+  aiModelCallCostMatchesUsage,
+  buildAiAccountingOverviewFromFragments,
+  normalizeAiAccountingQuery,
+  normalizeAiModelCallAccountingQuery as normalizeAiModelCallAccountingQuery2,
+  normalizeAiModelCallCostRecord,
+  parseAiModelCallCostDetails,
+  toAccountingItem
+} from "@sixb/core/internal/ai-cost-storage-provider";
+import { normalizeModelProviderIds as normalizeModelProviderIds2 } from "@sixb/core/models";
+import {
+  AiCostStorageError
+} from "@sixb/core/storage";
+
+// src/ai-cost-groups.ts
+import {
+  aiModelCallGroupFragmentFromRow,
+  buildAiModelCallGroupsFromFragments,
+  normalizeAiModelCallAccountingQuery
+} from "@sixb/core/internal/ai-cost-storage-provider";
+async function listAiModelCallGroups(connection, input) {
+  const query = normalizeAiModelCallAccountingQuery(input);
+  const parameters = [
+    query.projectId,
+    query.from.toISOString(),
+    query.to.toISOString(),
+    query.providerId ?? null,
+    query.modelId ?? null,
+    query.valuationStatus ?? null
+  ];
+  const count = connection.db.query(COUNT_SQL).get(...parameters);
+  const rows = connection.db.query(PAGE_SQL).all(...parameters, query.limit, query.offset);
+  const total = Number(count?.total);
+  if (!Number.isSafeInteger(total) || total < 0)
+    throw new RangeError("[Sixb] Invalid model-call group count.");
+  const items = buildAiModelCallGroupsFromFragments(rows.map(aiModelCallGroupFragmentFromRow));
+  return { items, total, hasMore: query.offset + items.length < total };
+}
+var FILTERED_SQL = `
+WITH filtered AS (
+  SELECT COALESCE(root_agent.execution_id, usage.execution_id) AS root_execution_id,
+    usage.execution_id, usage.provider_id, usage.requested_model_id, usage.occurred_at,
+    usage.total_tokens,
+    COALESCE(cost.status, 'unvalued') AS valuation_status,
+    cost.currency AS amount_currency, cost.amount_nanos,
+    root_agent.id AS root_agent_run_id,
+    root_agent.thread_id AS root_thread_id,
+    direct_agent.kind AS direct_kind,
+    direct_agent.id AS direct_run_id,
+    direct_agent.parent_run_id AS parent_run_id,
+    workflow_node.node_id AS workflow_agent_step_id,
+    workflow_agent.node_run_id AS workflow_node_run_id,
+    workflow_node.workflow_id AS workflow_id,
+    workflow_node.workflow_run_id AS workflow_run_id
+  FROM ai_model_call_usage AS usage
+  LEFT JOIN agent_runs AS direct_agent
+    ON direct_agent.project_id = usage.project_id AND direct_agent.execution_id = usage.execution_id
+  LEFT JOIN agent_runs AS root_agent
+    ON root_agent.project_id = usage.project_id
+    AND root_agent.id = COALESCE(direct_agent.parent_run_id, direct_agent.id)
+  LEFT JOIN workflow_agent_node_runs AS workflow_agent
+    ON workflow_agent.project_id = usage.project_id AND workflow_agent.execution_id = usage.execution_id
+  LEFT JOIN workflow_node_runs AS workflow_node
+    ON workflow_node.project_id = workflow_agent.project_id AND workflow_node.id = workflow_agent.node_run_id
+  LEFT JOIN ai_model_call_valuations AS cost
+    ON cost.project_id = usage.project_id AND cost.usage_record_id = usage.id
+  WHERE usage.project_id = ?1
+    AND usage.occurred_at >= ?2
+    AND usage.occurred_at < ?3
+    AND (?4 IS NULL OR usage.provider_id = ?4)
+    AND (?5 IS NULL OR usage.requested_model_id = ?5)
+    AND (?6 IS NULL OR COALESCE(cost.status, 'unvalued') = ?6)
+), roots AS (
+  SELECT root_execution_id, MAX(occurred_at) AS last_call_at
+  FROM filtered GROUP BY root_execution_id
+)
+`;
+var COUNT_SQL = `${FILTERED_SQL} SELECT CAST(COUNT(*) AS TEXT) AS total FROM roots`;
+var PAGE_SQL = `${FILTERED_SQL}, page AS (
+  SELECT root_execution_id FROM roots
+  ORDER BY last_call_at DESC, root_execution_id ASC LIMIT ?7 OFFSET ?8
+)
+SELECT filtered.root_execution_id, execution_id, provider_id, requested_model_id,
+  MIN(occurred_at) AS first_call_at, MAX(occurred_at) AS last_call_at,
+  CAST(COUNT(*) AS TEXT) AS call_count,
+  CAST(COUNT(total_tokens) AS TEXT) AS token_count,
+  CAST(SUM(total_tokens) AS TEXT) AS total_tokens,
+  valuation_status, amount_currency,
+  CAST(SUM(amount_nanos / 1000000000000) AS TEXT) AS amount_high,
+  CAST(SUM((amount_nanos / 1000000) % 1000000) AS TEXT) AS amount_middle,
+  CAST(SUM(amount_nanos % 1000000) AS TEXT) AS amount_low,
+  MAX(root_agent_run_id) AS root_agent_run_id,
+  MAX(root_thread_id) AS root_thread_id,
+  MAX(direct_kind) AS direct_kind,
+  MAX(direct_run_id) AS direct_run_id,
+  MAX(parent_run_id) AS parent_run_id,
+  MAX(workflow_agent_step_id) AS workflow_agent_step_id,
+  MAX(workflow_node_run_id) AS workflow_node_run_id,
+  MAX(workflow_id) AS workflow_id,
+  MAX(workflow_run_id) AS workflow_run_id
+FROM filtered JOIN page ON page.root_execution_id = filtered.root_execution_id
+GROUP BY filtered.root_execution_id, execution_id, provider_id, requested_model_id,
+  valuation_status, amount_currency
+`;
+
+// src/ai-usage-storage.ts
+import { isModelReasoning, normalizeModelProviderIds } from "@sixb/core/models";
+import {
+  AiUsageStorageError,
+  aggregateAiModelCallUsage,
+  assertAiUsageExecutionId,
+  normalizeAiModelCallRecord
+} from "@sixb/core/storage";
+class SqliteAiUsageStorage {
+  connection;
+  constructor(options = {}) {
+    this.connection = openSqliteStoreConnection(options);
+    if (this.connection.installFreshSchema) {
+      installFreshSqliteSchema(this.connection.db);
+    }
+  }
+  async recordModelCall(input) {
+    const record = normalizeAiModelCallRecord(input);
+    return runImmediateTransaction(this.connection.db, () => {
+      const existing = this.findByIdempotencyKey(record);
+      if (existing)
+        return { record: existing, created: false };
+      this.assertExecutionExists(record.projectId, record.executionId);
+      try {
+        this.insertRecord(record);
+      } catch (error) {
+        if (!isUniqueConstraintError2(error))
+          throw error;
+        const concurrent = this.findByIdempotencyKey(record);
+        if (concurrent)
+          return { record: concurrent, created: false };
+        throw new AiUsageStorageError("duplicate_id", `[SixbSqlite] AI usage record '${record.id}' already exists for project '${record.projectId}'.`);
+      }
+      for (const groupId of record.requesterGroupIds) {
+        this.connection.db.query(`
+              INSERT INTO ai_model_call_usage_groups (
+                project_id, usage_record_id, group_id, occurred_at
+              ) VALUES (?, ?, ?, ?)
+            `).run(record.projectId, record.id, groupId, record.occurredAt.toISOString());
+      }
+      return { record: this.requireById(record.projectId, record.id), created: true };
+    });
+  }
+  async summarizeExecution(input) {
+    const [summary] = await this.summarizeExecutions({
+      projectId: input.projectId,
+      executionIds: [input.executionId]
+    });
+    return summary;
+  }
+  async getLatestForExecution(input) {
+    assertNonBlankProjectId(input.projectId);
+    assertAiUsageExecutionId(input.executionId);
+    const row = this.connection.db.query(`
+          SELECT * FROM ai_model_call_usage
+          WHERE project_id = ? AND execution_id = ?
+          ORDER BY occurred_at DESC, id DESC
+          LIMIT 1
+        `).get(input.projectId, input.executionId);
+    return row ? this.rowToRecord(row) : null;
+  }
+  async summarizeExecutions(input) {
+    assertNonBlankProjectId(input.projectId);
+    for (const executionId of input.executionIds)
+      assertAiUsageExecutionId(executionId);
+    if (input.executionIds.length === 0)
+      return [];
+    const rows = this.executionRows(input);
+    return aggregateExecutionRows(input.executionIds, rows);
+  }
+  close() {
+    closeSqliteStoreConnection(this.connection);
+  }
+  insertRecord(record) {
+    this.connection.db.query(`
+          INSERT INTO ai_model_call_usage (
+            project_id,
+            id,
+            execution_id,
+            attempt,
+            call_id,
+            provider_id,
+            provider_ids,
+            requested_model_id,
+            requested_reasoning,
+            response_model_id,
+            response_id,
+            input_tokens,
+            output_tokens,
+            total_tokens,
+            uncached_input_tokens,
+            cache_read_input_tokens,
+            cache_write_input_tokens,
+            text_output_tokens,
+            reasoning_output_tokens,
+            reporting_status,
+            raw_usage,
+            occurred_at,
+            recorded_at
+          ) VALUES (
+            ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+          )
+        `).run(record.projectId, record.id, record.executionId, record.attempt, record.callId, record.providerId, record.providerIds === undefined ? null : JSON.stringify(record.providerIds), record.requestedModelId, record.requestedReasoning === undefined ? null : JSON.stringify(record.requestedReasoning), record.responseModelId ?? null, record.responseId, record.usage.inputTokens ?? null, record.usage.outputTokens ?? null, record.usage.totalTokens ?? null, record.usage.uncachedInputTokens ?? null, record.usage.cacheReadInputTokens ?? null, record.usage.cacheWriteInputTokens ?? null, record.usage.textOutputTokens ?? null, record.usage.reasoningOutputTokens ?? null, record.usage.reportingStatus, record.rawUsage === undefined ? null : JSON.stringify(record.rawUsage), record.occurredAt.toISOString(), record.recordedAt.toISOString());
+  }
+  findByIdempotencyKey(record) {
+    const row = this.connection.db.query(`
+          SELECT * FROM ai_model_call_usage
+          WHERE project_id = ?
+            AND execution_id = ?
+            AND attempt = ?
+            AND call_id = ?
+            AND response_id = ?
+        `).get(record.projectId, record.executionId, record.attempt, record.callId, record.responseId);
+    return row ? this.rowToRecord(row) : null;
   }
-  async list(input) {
-    if (input.statuses !== undefined && input.statuses.length === 0 || input.agentIds !== undefined && input.agentIds.length === 0) {
-      return { threads: [], hasMore: false, total: 0 };
-    }
-    const whereClauses = ["project_id = ?"];
-    const args = [input.projectId];
-    if (input.agentId) {
-      whereClauses.push("agent_id = ?");
-      args.push(input.agentId);
-    }
-    if (input.agentIds) {
-      whereClauses.push(`agent_id IN (${input.agentIds.map(() => "?").join(", ")})`);
-      args.push(...input.agentIds);
-    }
-    if (input.statuses) {
-      whereClauses.push(`status IN (${input.statuses.map(() => "?").join(", ")})`);
-      args.push(...input.statuses);
-    }
-    if (input.ownerPrincipal) {
-      whereClauses.push("owner_principal_type = ? AND owner_principal_id = ?");
-      args.push(input.ownerPrincipal.type, input.ownerPrincipal.id);
-    }
-    const dir = input.order === "asc" ? "ASC" : "DESC";
-    const { rows, total, hasMore } = queryAgentList({
-      db: this.db,
-      table: "agent_threads",
-      whereClauses,
-      args,
-      orderBy: `COALESCE(last_message_at, created_at) ${dir}, id ${dir}`,
-      limit: input.limit,
-      offset: input.offset
-    });
-    return { threads: rows.map(rowToThreadRecord), hasMore, total };
+  requireById(projectId, id) {
+    const row = this.connection.db.query("SELECT * FROM ai_model_call_usage WHERE project_id = ? AND id = ?").get(projectId, id);
+    if (!row)
+      throw new Error(`[SixbSqlite] AI usage record '${id}' disappeared after insert.`);
+    return this.rowToRecord(row);
   }
-  requireThread(projectId, id) {
-    const row = this.db.query("SELECT * FROM agent_threads WHERE project_id = ? AND id = ?").get(projectId, id);
-    if (!row) {
-      throw new AgentStorageError4("invalid_state", `[SixbSqlite] Failed to load agent thread '${id}' for project '${projectId}'.`);
-    }
-    return rowToThreadRecord(row);
+  rowToRecord(row) {
+    const groupRows = this.connection.db.query(`
+          SELECT group_id FROM ai_model_call_usage_groups
+          WHERE project_id = ? AND usage_record_id = ?
+          ORDER BY group_id
+        `).all(row.project_id, row.id);
+    return {
+      id: row.id,
+      projectId: row.project_id,
+      executionId: row.execution_id,
+      attempt: row.attempt,
+      callId: row.call_id,
+      requesterGroupIds: groupRows.map((group) => group.group_id),
+      providerId: row.provider_id,
+      ...row.provider_ids === null ? {} : { providerIds: normalizeModelProviderIds(JSON.parse(row.provider_ids)) },
+      requestedModelId: row.requested_model_id,
+      ...row.requested_reasoning === null ? {} : { requestedReasoning: requestedReasoningFromRow(row.requested_reasoning) },
+      ...row.response_model_id === null ? {} : { responseModelId: row.response_model_id },
+      responseId: row.response_id,
+      usage: {
+        ...usageFromRow(row),
+        ...row.total_tokens === null ? {} : { totalTokens: row.total_tokens },
+        reportingStatus: row.reporting_status
+      },
+      ...row.raw_usage === null ? {} : { rawUsage: JSON.parse(row.raw_usage) },
+      occurredAt: new Date(row.occurred_at),
+      recordedAt: new Date(row.recorded_at)
+    };
+  }
+  executionRows(input) {
+    const requested = JSON.stringify([...new Set(input.executionIds)]);
+    return this.connection.db.query(`
+          WITH requested AS (
+            SELECT DISTINCT value AS execution_id
+            FROM json_each(?)
+          )
+          SELECT usage.* FROM requested
+          JOIN ai_model_call_usage AS usage
+            ON usage.project_id = ?
+            AND usage.execution_id = requested.execution_id
+        `).all(requested, input.projectId);
+  }
+  assertExecutionExists(projectId, executionId) {
+    const execution = this.connection.db.query("SELECT 1 FROM executions WHERE project_id = ? AND id = ?").get(projectId, executionId);
+    if (execution)
+      return;
+    throw new AiUsageStorageError("missing_execution", `[SixbSqlite] AI usage execution '${executionId}' does not exist in project '${projectId}'.`);
   }
 }
-
-// src/agents/agent-storage.ts
-class SqliteAgentStorage {
-  threads;
-  runs;
-  messages;
-  checkpoints;
-  connection;
-  constructor(options) {
-    this.connection = openSqliteStoreConnection(options);
-    if (this.connection.installFreshSchema) {
-      installFreshSqliteSchema(this.connection.db);
-    }
-    this.threads = new SqliteAgentThreadStore(this.connection.db);
-    this.runs = new SqliteAgentRunStore(this.connection.db, options.executions);
-    this.messages = new SqliteAgentMessageStore(this.connection.db);
-    this.checkpoints = new SqliteAgentContextCheckpointStore(this.connection.db);
+function aggregateExecutionRows(executionIds, rows) {
+  const usageByExecutionId = new Map;
+  for (const executionId of executionIds)
+    usageByExecutionId.set(executionId, []);
+  for (const row of rows) {
+    usageByExecutionId.get(row.execution_id)?.push(usageFromRow(row));
   }
-  close() {
-    closeSqliteStoreConnection(this.connection);
+  return executionIds.map((executionId) => {
+    const usages = usageByExecutionId.get(executionId) ?? [];
+    return {
+      modelCallCount: usages.length,
+      usage: aggregateAiModelCallUsage(usages)
+    };
+  });
+}
+function usageFromRow(row) {
+  return {
+    ...row.input_tokens === null ? {} : { inputTokens: row.input_tokens },
+    ...row.output_tokens === null ? {} : { outputTokens: row.output_tokens },
+    ...row.uncached_input_tokens === null ? {} : { uncachedInputTokens: row.uncached_input_tokens },
+    ...row.cache_read_input_tokens === null ? {} : { cacheReadInputTokens: row.cache_read_input_tokens },
+    ...row.cache_write_input_tokens === null ? {} : { cacheWriteInputTokens: row.cache_write_input_tokens },
+    ...row.text_output_tokens === null ? {} : { textOutputTokens: row.text_output_tokens },
+    ...row.reasoning_output_tokens === null ? {} : { reasoningOutputTokens: row.reasoning_output_tokens }
+  };
+}
+function requestedReasoningFromRow(value) {
+  const parsed = JSON.parse(value);
+  if (!isModelReasoning(parsed)) {
+    throw new Error("[SixbSqlite] Stored AI usage requested reasoning is invalid.");
+  }
+  return parsed;
+}
+function assertNonBlankProjectId(projectId) {
+  if (typeof projectId !== "string" || projectId.trim().length === 0) {
+    throw new TypeError("[Sixb] AI usage projectId must be nonblank.");
   }
 }
+
 // src/ai-cost-storage.ts
-import {
-  aiModelCallCostDetails,
-  aiModelCallCostMatchesUsage,
-  buildAiAccountingOverviewFromFragments,
-  normalizeAiAccountingQuery,
-  normalizeAiModelCallAccountingQuery,
-  normalizeAiModelCallCostRecord,
-  parseAiModelCallCostDetails,
-  toAccountingItem
-} from "@sixb/core/internal/ai-cost-storage-provider";
-import {
-  AiCostStorageError
-} from "@sixb/core/storage";
 class SqliteAiCostStorage {
   connection;
   constructor(connection) {
     this.connection = connection;
   }
+  async listModelCallGroups(input) {
+    return listAiModelCallGroups(this.connection, input);
+  }
   async recordModelCallCost(input) {
     const record = normalizeAiModelCallCostRecord(input);
     runImmediateTransaction(this.connection.db, () => {
@@ -4522,7 +5539,7 @@ class SqliteAiCostStorage {
     return buildAiAccountingOverviewFromFragments(input, rows.map(aggregateFragmentFromRow));
   }
   async listModelCalls(input) {
-    const query = normalizeAiModelCallAccountingQuery(input);
+    const query = normalizeAiModelCallAccountingQuery2(input);
     const parameters = accountingListFilterParameters(query);
     const count = this.connection.db.query(SQLITE_ACCOUNTING_LIST_COUNT_SQL).get(...parameters);
     const rows = this.connection.db.query(SQLITE_ACCOUNTING_LIST_PAGE_SQL).all(...parameters, query.limit, query.offset);
@@ -4550,7 +5567,7 @@ class SqliteAiCostStorage {
   }
   findUsage(projectId, id) {
     const row = this.connection.db.query("SELECT * FROM ai_model_call_usage WHERE project_id = ? AND id = ?").get(projectId, id);
-    return row ? usageFromRow(row, []) : null;
+    return row ? usageFromRow2(row, []) : null;
   }
 }
 var SQLITE_ACCOUNTING_LIST_FILTER = `
@@ -4576,13 +5593,15 @@ var SQLITE_ACCOUNTING_LIST_COUNT_SQL = `
 var SQLITE_ACCOUNTING_LIST_PAGE_SQL = `
   SELECT usage.*,
     CASE
-      WHEN direct_agent.id IS NOT NULL THEN 'agent'
+      WHEN direct_agent.kind = 'conversation' THEN 'agent'
+      WHEN direct_agent.kind = 'subagent' THEN 'subagent'
       WHEN workflow_agent.node_run_id IS NOT NULL THEN 'workflowAgent'
       ELSE NULL
     END AS attribution_kind,
-    COALESCE(direct_agent.agent_id, workflow_agent.agent_id) AS attribution_agent_id,
+    workflow_node.node_id AS attribution_agent_step_id,
     direct_agent.id AS attribution_agent_run_id,
     direct_agent.thread_id AS attribution_thread_id,
+    direct_agent.parent_run_id AS attribution_parent_run_id,
     workflow_agent.node_run_id AS attribution_node_run_id,
     workflow_node.workflow_id AS attribution_workflow_id,
     workflow_node.workflow_run_id AS attribution_workflow_run_id,
@@ -4630,7 +5649,12 @@ var SQLITE_ACCOUNTING_OVERVIEW_SQL = `
       usage.text_output_tokens,
       usage.reasoning_output_tokens,
       usage.reporting_status,
-      COALESCE(direct_agent.agent_id, workflow_agent.agent_id) AS attribution_agent_id,
+      CASE
+        WHEN direct_agent.kind = 'conversation' THEN 'agent'
+        WHEN workflow_agent.node_run_id IS NOT NULL THEN 'workflowAgent'
+        ELSE NULL
+      END AS attribution_agent_kind,
+      workflow_node.node_id AS attribution_agent_step_id,
       workflow_node.workflow_id AS attribution_workflow_id,
       CASE
         WHEN cost.status = 'rated' THEN 'rated'
@@ -4655,11 +5679,11 @@ var SQLITE_ACCOUNTING_OVERVIEW_SQL = `
       AND (? IS NULL OR usage.provider_id = ?)
       AND (? IS NULL OR usage.requested_model_id = ?)
   ), expanded AS (
-    SELECT 'totals' AS dimension, NULL AS key_1, NULL AS key_2, NULL AS bucket_start,
+    SELECT 'totals' AS dimension, NULL AS key_1, NULL AS key_2, NULL AS key_3, NULL AS bucket_start,
       classified.*
     FROM classified
     UNION ALL
-    SELECT 'series', NULL, NULL,
+    SELECT 'series', NULL, NULL, NULL,
       CASE ?
         WHEN 'hour' THEN strftime('%Y-%m-%dT%H:00:00.000Z', occurred_at)
         WHEN 'day' THEN strftime('%Y-%m-%dT00:00:00.000Z', occurred_at)
@@ -4672,17 +5696,18 @@ var SQLITE_ACCOUNTING_OVERVIEW_SQL = `
       classified.*
     FROM classified
     UNION ALL
-    SELECT 'model', provider_id, requested_model_id, NULL, classified.* FROM classified
+    SELECT 'model', provider_id, requested_model_id, NULL, NULL, classified.* FROM classified
     UNION ALL
-    SELECT 'agent', attribution_agent_id, NULL, NULL, classified.*
-    FROM classified WHERE attribution_agent_id IS NOT NULL
+    SELECT 'agent', attribution_agent_kind, attribution_workflow_id, attribution_agent_step_id, NULL, classified.*
+    FROM classified WHERE attribution_agent_kind IS NOT NULL
     UNION ALL
-    SELECT 'workflow', attribution_workflow_id, NULL, NULL, classified.*
+    SELECT 'workflow', attribution_workflow_id, NULL, NULL, NULL, classified.*
     FROM classified WHERE attribution_workflow_id IS NOT NULL
   )
   SELECT dimension,
     key_1,
     key_2,
+    key_3,
     bucket_start,
     amount_currency,
     CAST(COUNT(*) AS TEXT) AS model_call_count,
@@ -4712,7 +5737,7 @@ var SQLITE_ACCOUNTING_OVERVIEW_SQL = `
     CAST(SUM((amount_nanos / 1000000) % 1000000) AS TEXT) AS amount_middle,
     CAST(SUM(amount_nanos % 1000000) AS TEXT) AS amount_low
   FROM expanded
-  GROUP BY dimension, key_1, key_2, bucket_start, amount_currency
+  GROUP BY dimension, key_1, key_2, key_3, bucket_start, amount_currency
 `;
 function accountingListFilterParameters(query) {
   return [
@@ -4730,7 +5755,10 @@ function accountingListFilterParameters(query) {
   ];
 }
 function aggregateFragmentFromRow(row) {
-  const dimensionKeys = row.dimension === "model" ? { providerId: required(row.key_1), modelId: required(row.key_2) } : row.dimension === "agent" ? { agentId: required(row.key_1) } : row.dimension === "workflow" ? { workflowId: required(row.key_1) } : row.dimension === "series" ? { start: new Date(required(row.bucket_start)) } : {};
+  const dimensionKeys = row.dimension === "model" ? { providerId: required(row.key_1), modelId: required(row.key_2) } : row.dimension === "agent" ? {
+    agentKind: required(row.key_1),
+    ...row.key_1 === "workflowAgent" ? { workflowId: required(row.key_2), agentStepId: required(row.key_3) } : {}
+  } : row.dimension === "workflow" ? { workflowId: required(row.key_1) } : row.dimension === "series" ? { start: new Date(required(row.bucket_start)) } : {};
   return {
     dimension: row.dimension,
     ...dimensionKeys,
@@ -4765,16 +5793,19 @@ function sqliteAggregateAmount(row) {
   return (BigInt(required(row.amount_high)) * 1000000000000n + BigInt(required(row.amount_middle)) * 1000000n + BigInt(required(row.amount_low))).toString();
 }
 function accountingItemFromRow(row) {
-  const usage = usageFromRow(row, parseStringArray(row.requester_group_ids));
+  const usage = usageFromRow2(row, parseStringArray(row.requester_group_ids));
   const cost = row.cost_status === null ? undefined : costFromJoinedRow(row);
   const attribution = row.attribution_kind === null ? undefined : row.attribution_kind === "agent" ? {
     kind: "agent",
-    agentId: required(row.attribution_agent_id),
     agentRunId: required(row.attribution_agent_run_id),
     threadId: required(row.attribution_thread_id)
+  } : row.attribution_kind === "subagent" ? {
+    kind: "subagent",
+    subagentRunId: required(row.attribution_agent_run_id),
+    parentRunId: required(row.attribution_parent_run_id)
   } : {
     kind: "workflowAgent",
-    agentId: required(row.attribution_agent_id),
+    agentStepId: required(row.attribution_agent_step_id),
     nodeRunId: required(row.attribution_node_run_id),
     workflowId: required(row.attribution_workflow_id),
     workflowRunId: required(row.attribution_workflow_run_id)
@@ -4785,7 +5816,7 @@ function accountingItemFromRow(row) {
     ...cost ? { cost } : {}
   };
 }
-function usageFromRow(row, requesterGroupIds) {
+function usageFromRow2(row, requesterGroupIds) {
   return {
     id: row.id,
     projectId: row.project_id,
@@ -4794,7 +5825,9 @@ function usageFromRow(row, requesterGroupIds) {
     callId: row.call_id,
     requesterGroupIds,
     providerId: row.provider_id,
+    ...row.provider_ids === null ? {} : { providerIds: normalizeModelProviderIds2(JSON.parse(row.provider_ids)) },
     requestedModelId: row.requested_model_id,
+    ...row.requested_reasoning === null ? {} : { requestedReasoning: requestedReasoningFromRow(row.requested_reasoning) },
     ...row.response_model_id === null ? {} : { responseModelId: row.response_model_id },
     responseId: row.response_id,
     usage: {
@@ -4843,14 +5876,12 @@ function costFromJoinedRow(row) {
 }
 function costRecord(input) {
   const details = parseAiModelCallCostDetails(input.details);
+  const priceSource = details.priceSource === undefined ? undefined : { ...details.priceSource, observedAt: new Date(details.priceSource.observedAt) };
   const base = {
+    ...details.estimate === undefined ? {} : { estimate: details.estimate },
     projectId: input.projectId,
     usageRecordId: input.usageId,
     pricingContext: details.pricingContext,
-    priceSource: {
-      ...details.priceSource,
-      observedAt: new Date(details.priceSource.observedAt)
-    },
     ratedAt: new Date(input.ratedAt)
   };
   if (input.status === "rated") {
@@ -4858,6 +5889,7 @@ function costRecord(input) {
       ...base,
       status: "rated",
       billingIdentity: { providerId: required(input.providerId), modelId: required(input.modelId) },
+      priceSource: required(priceSource),
       money: { currency: required(input.currency), amountNanos: required(input.amountNanos) },
       components: required(details.components)
     });
@@ -4866,6 +5898,7 @@ function costRecord(input) {
     ...base,
     status: "unpriceable",
     ...input.providerId && input.modelId ? { billingIdentity: { providerId: input.providerId, modelId: input.modelId } } : {},
+    ...priceSource === undefined ? {} : { priceSource },
     reason: required(input.reason),
     ...details.missingMeters ? { missingMeters: details.missingMeters } : {}
   });
@@ -4943,205 +5976,565 @@ function required(value) {
   return value;
 }
 
-// src/ai-usage-storage.ts
+// src/ai-limit-storage.ts
 import {
-  AiUsageStorageError,
-  aggregateAiModelCallUsage,
-  assertAiUsageExecutionId,
-  normalizeAiModelCallRecord
-} from "@sixb/core/storage";
-class SqliteAiUsageStorage {
+  aiLimitAmountKey,
+  aiLimitQuantityFromAmount,
+  aiLimitReservationBuckets,
+  aiLimitReservationRequestKey,
+  aiLimitReservationRequestMatches,
+  aiLimitSubjectFromParts,
+  aiLimitSubjectKey,
+  aiLimitSubjectParts,
+  aiLimitSubjectsFromAccountingEntry,
+  assertAiLimitAccountingMatchesReservation,
+  assertNonBlank as assertNonBlank2,
+  cloneValidDate,
+  normalizeAiLimitAmount,
+  normalizeAiLimitQuantities,
+  normalizeAiModelCallReservationIdentity,
+  normalizeCreateAiLimitPolicy,
+  normalizeReserveAiModelCall,
+  normalizeUpdateAiLimitPolicy,
+  resolveAiLimitActual
+} from "@sixb/core/internal/ai-limit-storage-provider";
+import { AiLimitStorageError, aiLimitCalendarMonth } from "@sixb/core/storage";
+class SqliteAiLimitStorage {
   connection;
   constructor(options = {}) {
     this.connection = openSqliteStoreConnection(options);
-    if (this.connection.installFreshSchema) {
+    if (this.connection.installFreshSchema)
       installFreshSqliteSchema(this.connection.db);
-    }
   }
-  async recordModelCall(input) {
-    const record = normalizeAiModelCallRecord(input);
+  async createPolicy(input) {
+    const policy = normalizeCreateAiLimitPolicy(input);
     return runImmediateTransaction(this.connection.db, () => {
-      const existing = this.findByIdempotencyKey(record);
-      if (existing)
-        return { record: existing, created: false };
-      this.assertExecutionExists(record.projectId, record.executionId);
+      const subject = aiLimitSubjectParts(policy.subject);
+      const limit = normalizeAiLimitAmount(policy.limit);
       try {
-        this.insertRecord(record);
+        this.connection.db.query(`
+              INSERT INTO ai_usage_limits (
+                project_id, id, subject_type, subject_id, meter, currency, limit_amount,
+                period_kind, enabled, created_at, updated_at
+              ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            `).run(policy.projectId, policy.id, subject.type, subject.id, limit.meter, limit.currency, limit.amount.toString(), policy.period, policy.enabled ? 1 : 0, policy.createdAt.toISOString(), policy.updatedAt.toISOString());
       } catch (error) {
-        if (!isUniqueConstraintError2(error))
+        if (!isConstraintError(error))
           throw error;
-        const concurrent = this.findByIdempotencyKey(record);
-        if (concurrent)
-          return { record: concurrent, created: false };
-        throw new AiUsageStorageError("duplicate_id", `[SixbSqlite] AI usage record '${record.id}' already exists for project '${record.projectId}'.`);
+        throw duplicatePolicy(policy);
       }
-      for (const groupId of record.requesterGroupIds) {
-        this.connection.db.query(`
-              INSERT INTO ai_model_call_usage_groups (
-                project_id, usage_record_id, group_id, occurred_at
-              ) VALUES (?, ?, ?, ?)
-            `).run(record.projectId, record.id, groupId, record.occurredAt.toISOString());
+      return this.requirePolicy(policy.projectId, policy.id);
+    });
+  }
+  async updatePolicy(input) {
+    const update = normalizeUpdateAiLimitPolicy(input);
+    return runImmediateTransaction(this.connection.db, () => {
+      const existing = this.requirePolicy(update.projectId, update.id);
+      if (update.limit !== undefined)
+        assertSameDimension(existing.limit, update.limit);
+      const limit = normalizeAiLimitAmount(update.limit ?? existing.limit);
+      this.connection.db.query(`
+            UPDATE ai_usage_limits
+            SET limit_amount = ?, enabled = ?, updated_at = ?
+            WHERE project_id = ? AND id = ?
+          `).run(limit.amount.toString(), update.enabled ?? existing.enabled ? 1 : 0, update.updatedAt.toISOString(), update.projectId, update.id);
+      return this.requirePolicy(update.projectId, update.id);
+    });
+  }
+  async deletePolicy(input) {
+    validatePolicyIdentity(input);
+    return runImmediateTransaction(this.connection.db, () => {
+      const result = this.connection.db.query("DELETE FROM ai_usage_limits WHERE project_id = ? AND id = ?").run(input.projectId, input.id);
+      return result.changes > 0;
+    });
+  }
+  async getPolicy(input) {
+    validatePolicyIdentity(input);
+    const row = this.connection.db.query("SELECT * FROM ai_usage_limits WHERE project_id = ? AND id = ?").get(input.projectId, input.id);
+    return row ? policyFromRow(row) : null;
+  }
+  async listPolicies(input) {
+    assertNonBlank2(input.projectId, "projectId");
+    return this.policyRows(input.projectId, input.includeDisabled ?? false).map(policyFromRow);
+  }
+  async listPolicyStatuses(input) {
+    assertNonBlank2(input.projectId, "projectId");
+    const period = aiLimitCalendarMonth(input.at ?? new Date);
+    const existingGroups = input.existingGroupIds === undefined ? undefined : new Set(input.existingGroupIds);
+    return runImmediateTransaction(this.connection.db, () => this.policyRows(input.projectId, input.includeDisabled ?? false).map((row) => this.statusForPolicy(policyFromRow(row), period, existingGroups)));
+  }
+  async reserveModelCall(input) {
+    const request = normalizeReserveAiModelCall(input);
+    return runImmediateTransaction(this.connection.db, () => {
+      const existing = this.findReservation(request.identity);
+      if (existing) {
+        if (!aiLimitReservationRequestMatches(existing, request)) {
+          throw new AiLimitStorageError("reservation_conflict", `[SixbSqlite] AI model-call reservation '${input.callId}' was replayed with different subjects, estimates, or period.`);
+        }
+        if (existing.state !== "active") {
+          return { status: "terminal", reservation: existing, created: false };
+        }
+        return { status: "reserved", reservation: existing, created: false };
       }
-      return { record: this.requireById(record.projectId, record.id), created: true };
+      this.assertExecutionExists(request.identity.projectId, request.identity.executionId);
+      const subjectKeys = new Set(request.subjects.map(aiLimitSubjectKey));
+      const estimates = new Map(request.estimates.map((quantity) => {
+        const amount = normalizeAiLimitAmount(quantity);
+        return [aiLimitAmountKey(amount), amount];
+      }));
+      const enabledPolicies = this.policyRows(request.identity.projectId, false).map(policyFromRow);
+      const exhaustedPolicies = [];
+      const unavailablePolicies = [];
+      const unavailableReasons = new Set;
+      for (const policy of enabledPolicies) {
+        if (!subjectKeys.has(aiLimitSubjectKey(policy.subject)))
+          continue;
+        const limit = normalizeAiLimitAmount(policy.limit);
+        const estimate = estimates.get(aiLimitAmountKey(limit));
+        const status = this.statusForPolicy(policy, request.period);
+        if (!estimate || status.accountingStatus === "unavailable") {
+          unavailablePolicies.push(status);
+          if (!estimate)
+            unavailableReasons.add("missingEstimate");
+          if (status.accountingStatus === "unavailable") {
+            unavailableReasons.add("incompleteAccounting");
+          }
+          continue;
+        }
+        const consumption = status.consumption;
+        const consumed = normalizeAiLimitAmount(consumption.actual).amount + normalizeAiLimitAmount(consumption.reserved).amount + normalizeAiLimitAmount(consumption.unknown).amount;
+        if (consumed + estimate.amount > limit.amount)
+          exhaustedPolicies.push(status);
+      }
+      if (unavailablePolicies.length > 0) {
+        unavailablePolicies.sort((left, right) => left.policy.id.localeCompare(right.policy.id));
+        return {
+          status: "unavailable",
+          unavailablePolicies,
+          reasons: [...unavailableReasons].sort()
+        };
+      }
+      if (exhaustedPolicies.length > 0) {
+        exhaustedPolicies.sort((left, right) => left.policy.id.localeCompare(right.policy.id));
+        return {
+          status: "denied",
+          exhaustedPolicies,
+          resetAt: new Date(Math.min(...exhaustedPolicies.map((status) => status.period.resetAt.getTime())))
+        };
+      }
+      const buckets = aiLimitReservationBuckets(enabledPolicies, request.subjects, request.estimates);
+      if (buckets.length === 0)
+        return { status: "notRequired" };
+      for (const bucket of buckets) {
+        const amount = normalizeAiLimitAmount(bucket.estimate);
+        this.changeCounters(request.identity.projectId, bucket.subject, amount, request.period, { reserved: amount.amount }, request.reservedAt);
+      }
+      const reservation = {
+        ...request.identity,
+        buckets,
+        requestKey: aiLimitReservationRequestKey(request),
+        period: request.period,
+        state: "active",
+        reservedAt: request.reservedAt,
+        updatedAt: new Date(request.reservedAt)
+      };
+      this.insertReservation(reservation);
+      return { status: "reserved", reservation: structuredClone(reservation), created: true };
     });
   }
-  async summarizeExecution(input) {
-    const [summary] = await this.summarizeExecutions({
-      projectId: input.projectId,
-      executionIds: [input.executionId]
+  async recordModelCallActuals(input) {
+    assertNonBlank2(input.projectId, "projectId");
+    assertNonBlank2(input.usageRecordId, "usageRecordId");
+    const recordedAt = cloneValidDate(input.recordedAt ?? new Date, "recordedAt");
+    runImmediateTransaction(this.connection.db, () => {
+      const entry = this.requireAccountingEntry(input.projectId, input.usageRecordId);
+      const period = aiLimitCalendarMonth(entry.occurredAt);
+      for (const subjectValue of aiLimitSubjectsFromAccountingEntry(entry)) {
+        const subject = aiLimitSubjectParts(subjectValue);
+        const rows = this.connection.db.query(`
+              SELECT meter, currency, actual_amount, accounting_status
+              FROM ai_usage_limit_periods
+              WHERE project_id = ? AND subject_type = ? AND subject_id = ?
+                AND period_start = ?
+            `).all(input.projectId, subject.type, subject.id, period.start.toISOString());
+        for (const row of rows) {
+          const actual = resolveAiLimitActual([entry], row);
+          this.connection.db.query(`
+                UPDATE ai_usage_limit_periods
+                SET actual_amount = ?, accounting_status = ?, updated_at = ?
+                WHERE project_id = ? AND subject_type = ? AND subject_id = ?
+                  AND meter = ? AND currency = ? AND period_start = ?
+              `).run((BigInt(row.actual_amount) + actual.amount).toString(), row.accounting_status === "unavailable" || actual.accountingStatus === "unavailable" ? "unavailable" : "complete", recordedAt.toISOString(), input.projectId, subject.type, subject.id, row.meter, row.currency, period.start.toISOString());
+        }
+      }
     });
-    return summary;
   }
-  async getLatestForExecution(input) {
-    assertNonBlankProjectId(input.projectId);
-    assertAiUsageExecutionId(input.executionId);
-    const row = this.connection.db.query(`
-          SELECT * FROM ai_model_call_usage
-          WHERE project_id = ? AND execution_id = ?
-          ORDER BY occurred_at DESC, id DESC
-          LIMIT 1
-        `).get(input.projectId, input.executionId);
-    return row ? this.rowToRecord(row) : null;
+  async reconcileModelCall(input) {
+    const identity = normalizeAiModelCallReservationIdentity(input);
+    assertNonBlank2(input.usageRecordId, "usageRecordId");
+    const reconciledAt = cloneValidDate(input.reconciledAt ?? new Date, "reconciledAt");
+    return runImmediateTransaction(this.connection.db, () => {
+      const reservation = this.findReservation(identity);
+      if (!reservation)
+        throw missingReservation(identity);
+      if (reservation.state === "reconciled") {
+        if (reservation.usageRecordId === input.usageRecordId) {
+          return reservation;
+        }
+        throw reconciliationConflict(identity.callId);
+      }
+      const accounting = this.requireAccountingEntry(identity.projectId, input.usageRecordId);
+      assertAiLimitAccountingMatchesReservation(reservation, accounting);
+      this.reconcileEstimateCounters(reservation, accounting, reconciledAt);
+      const reconciled = {
+        ...reservation,
+        state: "reconciled",
+        usageRecordId: input.usageRecordId,
+        updatedAt: reconciledAt
+      };
+      this.updateReservation(reconciled);
+      return structuredClone(reconciled);
+    });
   }
-  async summarizeExecutions(input) {
-    assertNonBlankProjectId(input.projectId);
-    for (const executionId of input.executionIds)
-      assertAiUsageExecutionId(executionId);
-    if (input.executionIds.length === 0)
-      return [];
-    const rows = this.executionRows(input);
-    return aggregateExecutionRows(input.executionIds, rows);
+  async markReservationUnknown(input) {
+    const identity = normalizeAiModelCallReservationIdentity(input);
+    const markedAt = cloneValidDate(input.markedAt ?? new Date, "markedAt");
+    return runImmediateTransaction(this.connection.db, () => {
+      const reservation = this.findReservation(identity);
+      if (!reservation)
+        throw missingReservation(identity);
+      if (reservation.state === "unknown")
+        return reservation;
+      if (reservation.state !== "active")
+        throw invalidState(reservation, "mark unknown");
+      this.moveEstimateCounters(reservation, { reserved: -1n, unknown: 1n }, markedAt);
+      const unknown = { ...reservation, state: "unknown", updatedAt: markedAt };
+      this.updateReservation(unknown);
+      return structuredClone(unknown);
+    });
   }
   close() {
     closeSqliteStoreConnection(this.connection);
   }
-  insertRecord(record) {
+  policyRows(projectId, includeDisabled) {
+    return this.connection.db.query(`
+          SELECT * FROM ai_usage_limits
+          WHERE project_id = ? AND (? = 1 OR enabled = 1)
+          ORDER BY id
+        `).all(projectId, includeDisabled ? 1 : 0);
+  }
+  requirePolicy(projectId, id) {
+    const row = this.connection.db.query("SELECT * FROM ai_usage_limits WHERE project_id = ? AND id = ?").get(projectId, id);
+    if (row)
+      return policyFromRow(row);
+    throw new AiLimitStorageError("missing_policy", `[SixbSqlite] AI limit policy '${id}' does not exist in project '${projectId}'.`);
+  }
+  statusForPolicy(policy, period, existingGroups) {
+    const subject = aiLimitSubjectParts(policy.subject);
+    const limit = normalizeAiLimitAmount(policy.limit);
+    let row = this.connection.db.query(`
+          SELECT actual_amount, reserved_amount, unknown_amount, accounting_status
+          FROM ai_usage_limit_periods
+          WHERE project_id = ? AND subject_type = ? AND subject_id = ?
+            AND meter = ? AND currency = ? AND period_start = ?
+        `).get(policy.projectId, subject.type, subject.id, limit.meter, limit.currency, period.start.toISOString());
+    if (!row || row.accounting_status === "unavailable") {
+      const actual = resolveAiLimitActual(this.accountingEntries(policy, period), limit);
+      row = {
+        actual_amount: actual.amount.toString(),
+        reserved_amount: row?.reserved_amount ?? "0",
+        unknown_amount: row?.unknown_amount ?? "0",
+        accounting_status: actual.accountingStatus
+      };
+      this.connection.db.query(`
+            INSERT INTO ai_usage_limit_periods (
+              project_id, subject_type, subject_id, meter, currency, period_start, period_end,
+              actual_amount, reserved_amount, unknown_amount, accounting_status, updated_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, '0', '0', ?, ?)
+            ON CONFLICT (project_id, subject_type, subject_id, meter, currency, period_start)
+            DO UPDATE SET
+              actual_amount = excluded.actual_amount,
+              accounting_status = excluded.accounting_status,
+              updated_at = excluded.updated_at
+          `).run(policy.projectId, subject.type, subject.id, limit.meter, limit.currency, period.start.toISOString(), period.end.toISOString(), row.actual_amount, row.accounting_status, new Date().toISOString());
+    }
+    return policyStatus(policy, period, row, existingGroups);
+  }
+  changeCounters(projectId, subjectValue, amount, period, changes, updatedAt) {
+    const subject = aiLimitSubjectParts(subjectValue);
+    const row = this.connection.db.query(`
+          SELECT actual_amount, reserved_amount, unknown_amount, accounting_status
+          FROM ai_usage_limit_periods
+          WHERE project_id = ? AND subject_type = ? AND subject_id = ?
+            AND meter = ? AND currency = ? AND period_start = ?
+        `).get(projectId, subject.type, subject.id, amount.meter, amount.currency, period.start.toISOString());
+    const reserved = BigInt(row?.reserved_amount ?? "0") + (changes.reserved ?? 0n);
+    const unknown = BigInt(row?.unknown_amount ?? "0") + (changes.unknown ?? 0n);
+    if (reserved < 0n || unknown < 0n) {
+      throw new Error("[SixbSqlite] AI limit period counter became negative.");
+    }
+    this.connection.db.query(`
+          INSERT INTO ai_usage_limit_periods (
+            project_id, subject_type, subject_id, meter, currency, period_start, period_end,
+            actual_amount, reserved_amount, unknown_amount, accounting_status, updated_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          ON CONFLICT (project_id, subject_type, subject_id, meter, currency, period_start)
+          DO UPDATE SET
+            period_end = excluded.period_end,
+            actual_amount = excluded.actual_amount,
+            reserved_amount = excluded.reserved_amount,
+            unknown_amount = excluded.unknown_amount,
+            accounting_status = excluded.accounting_status,
+            updated_at = excluded.updated_at
+        `).run(projectId, subject.type, subject.id, amount.meter, amount.currency, period.start.toISOString(), period.end.toISOString(), row?.actual_amount ?? "0", reserved.toString(), unknown.toString(), row?.accounting_status ?? "complete", updatedAt.toISOString());
+  }
+  moveEstimateCounters(reservation, directions, updatedAt) {
+    for (const bucket of reservation.buckets) {
+      const amount = normalizeAiLimitAmount(bucket.estimate);
+      this.changeCounters(reservation.projectId, bucket.subject, amount, reservation.period, {
+        ...directions.reserved === undefined ? {} : { reserved: directions.reserved * amount.amount },
+        ...directions.unknown === undefined ? {} : { unknown: directions.unknown * amount.amount }
+      }, updatedAt);
+    }
+  }
+  reconcileEstimateCounters(reservation, entry, updatedAt) {
+    for (const bucket of reservation.buckets) {
+      const amount = normalizeAiLimitAmount(bucket.estimate);
+      const actual = resolveAiLimitActual([entry], amount);
+      if (actual.accountingStatus === "complete") {
+        this.changeCounters(reservation.projectId, bucket.subject, amount, reservation.period, reservation.state === "active" ? { reserved: -amount.amount } : { unknown: -amount.amount }, updatedAt);
+      } else if (reservation.state === "active") {
+        this.changeCounters(reservation.projectId, bucket.subject, amount, reservation.period, { reserved: -amount.amount, unknown: amount.amount }, updatedAt);
+      }
+    }
+  }
+  insertReservation(reservation) {
+    this.connection.db.query(`
+          INSERT INTO ai_model_call_reservations (
+            project_id, execution_id, attempt, call_id, buckets, request_key,
+            period_start, period_end, state, usage_record_id, reserved_at, updated_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(...reservationSqlValues(reservation));
+  }
+  updateReservation(reservation) {
     this.connection.db.query(`
-          INSERT INTO ai_model_call_usage (
-            project_id,
-            id,
-            execution_id,
-            attempt,
-            call_id,
-            provider_id,
-            requested_model_id,
-            response_model_id,
-            response_id,
-            input_tokens,
-            output_tokens,
-            total_tokens,
-            uncached_input_tokens,
-            cache_read_input_tokens,
-            cache_write_input_tokens,
-            text_output_tokens,
-            reasoning_output_tokens,
-            reporting_status,
-            raw_usage,
-            occurred_at,
-            recorded_at
-          ) VALUES (
-            ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
-          )
-        `).run(record.projectId, record.id, record.executionId, record.attempt, record.callId, record.providerId, record.requestedModelId, record.responseModelId ?? null, record.responseId, record.usage.inputTokens ?? null, record.usage.outputTokens ?? null, record.usage.totalTokens ?? null, record.usage.uncachedInputTokens ?? null, record.usage.cacheReadInputTokens ?? null, record.usage.cacheWriteInputTokens ?? null, record.usage.textOutputTokens ?? null, record.usage.reasoningOutputTokens ?? null, record.usage.reportingStatus, record.rawUsage === undefined ? null : JSON.stringify(record.rawUsage), record.occurredAt.toISOString(), record.recordedAt.toISOString());
+          UPDATE ai_model_call_reservations
+          SET state = ?, usage_record_id = ?, updated_at = ?
+          WHERE project_id = ? AND execution_id = ? AND attempt = ? AND call_id = ?
+        `).run(reservation.state, reservation.usageRecordId ?? null, reservation.updatedAt.toISOString(), reservation.projectId, reservation.executionId, reservation.attempt, reservation.callId);
   }
-  findByIdempotencyKey(record) {
+  findReservation(input) {
     const row = this.connection.db.query(`
-          SELECT * FROM ai_model_call_usage
-          WHERE project_id = ?
-            AND execution_id = ?
-            AND attempt = ?
-            AND call_id = ?
-            AND response_id = ?
-        `).get(record.projectId, record.executionId, record.attempt, record.callId, record.responseId);
-    return row ? this.rowToRecord(row) : null;
-  }
-  requireById(projectId, id) {
-    const row = this.connection.db.query("SELECT * FROM ai_model_call_usage WHERE project_id = ? AND id = ?").get(projectId, id);
-    if (!row)
-      throw new Error(`[SixbSqlite] AI usage record '${id}' disappeared after insert.`);
-    return this.rowToRecord(row);
+          SELECT * FROM ai_model_call_reservations
+          WHERE project_id = ? AND execution_id = ? AND attempt = ? AND call_id = ?
+        `).get(input.projectId, input.executionId, input.attempt, input.callId);
+    return row ? reservationFromRow(row) : null;
   }
-  rowToRecord(row) {
-    const groupRows = this.connection.db.query(`
-          SELECT group_id FROM ai_model_call_usage_groups
-          WHERE project_id = ? AND usage_record_id = ?
-          ORDER BY group_id
-        `).all(row.project_id, row.id);
-    return {
-      id: row.id,
-      projectId: row.project_id,
-      executionId: row.execution_id,
-      attempt: row.attempt,
-      callId: row.call_id,
-      requesterGroupIds: groupRows.map((group) => group.group_id),
-      providerId: row.provider_id,
-      requestedModelId: row.requested_model_id,
-      ...row.response_model_id === null ? {} : { responseModelId: row.response_model_id },
-      responseId: row.response_id,
-      usage: {
-        ...usageFromRow2(row),
-        ...row.total_tokens === null ? {} : { totalTokens: row.total_tokens },
-        reportingStatus: row.reporting_status
-      },
-      ...row.raw_usage === null ? {} : { rawUsage: JSON.parse(row.raw_usage) },
-      occurredAt: new Date(row.occurred_at),
-      recordedAt: new Date(row.recorded_at)
-    };
+  accountingEntries(policy, period) {
+    const subject = aiLimitSubjectParts(policy.subject);
+    const rows = this.connection.db.query(`
+          SELECT usage.project_id, usage.id AS usage_record_id, usage.execution_id,
+                 usage.attempt, usage.call_id, usage.occurred_at,
+                 CAST(usage.total_tokens AS TEXT) AS total_tokens,
+                 executions.requested_by_user_id,
+                 executions.requested_by_service_account_id,
+                 valuations.status AS valuation_status,
+                 valuations.currency AS valuation_currency,
+                 CAST(valuations.amount_nanos AS TEXT) AS valuation_amount_nanos
+          FROM ai_model_call_usage AS usage
+          JOIN executions
+            ON executions.project_id = usage.project_id AND executions.id = usage.execution_id
+          LEFT JOIN ai_model_call_valuations AS valuations
+            ON valuations.project_id = usage.project_id
+           AND valuations.usage_record_id = usage.id
+          WHERE usage.project_id = ? AND usage.occurred_at >= ? AND usage.occurred_at < ?
+            AND (
+              ? = 'project'
+              OR (
+                ? = 'group'
+                AND EXISTS (
+                  SELECT 1 FROM ai_model_call_usage_groups AS usage_groups
+                  WHERE usage_groups.project_id = usage.project_id
+                    AND usage_groups.usage_record_id = usage.id
+                    AND usage_groups.group_id = ?
+                )
+              )
+              OR (? = 'user' AND executions.requested_by_user_id = ?)
+              OR (
+                ? = 'serviceAccount'
+                AND executions.requested_by_service_account_id = ?
+              )
+            )
+          ORDER BY usage.occurred_at, usage.id
+        `).all(policy.projectId, period.start.toISOString(), period.end.toISOString(), subject.type, subject.type, subject.id, subject.type, subject.id, subject.type, subject.id);
+    return rows.map((row) => accountingEntryFromRow(row, policy.subject));
   }
-  executionRows(input) {
-    const requested = JSON.stringify([...new Set(input.executionIds)]);
-    return this.connection.db.query(`
-          WITH requested AS (
-            SELECT DISTINCT value AS execution_id
-            FROM json_each(?)
-          )
-          SELECT usage.* FROM requested
-          JOIN ai_model_call_usage AS usage
-            ON usage.project_id = ?
-            AND usage.execution_id = requested.execution_id
-        `).all(requested, input.projectId);
+  requireAccountingEntry(projectId, usageRecordId) {
+    const row = this.connection.db.query(`
+          SELECT usage.project_id, usage.id AS usage_record_id, usage.execution_id,
+                 usage.attempt, usage.call_id, usage.occurred_at,
+                 CAST(usage.total_tokens AS TEXT) AS total_tokens,
+                 executions.requested_by_user_id,
+                 executions.requested_by_service_account_id,
+                 valuations.status AS valuation_status,
+                 valuations.currency AS valuation_currency,
+                 CAST(valuations.amount_nanos AS TEXT) AS valuation_amount_nanos
+          FROM ai_model_call_usage AS usage
+          JOIN executions
+            ON executions.project_id = usage.project_id AND executions.id = usage.execution_id
+          LEFT JOIN ai_model_call_valuations AS valuations
+            ON valuations.project_id = usage.project_id
+           AND valuations.usage_record_id = usage.id
+          WHERE usage.project_id = ? AND usage.id = ?
+        `).get(projectId, usageRecordId);
+    if (row) {
+      const groups = this.connection.db.query(`
+            SELECT group_id FROM ai_model_call_usage_groups
+            WHERE project_id = ? AND usage_record_id = ?
+            ORDER BY group_id
+          `).all(projectId, usageRecordId);
+      return accountingEntryFromRow(row, undefined, groups.map((group) => group.group_id));
+    }
+    throw new AiLimitStorageError("missing_usage_record", `[SixbSqlite] AI usage record '${usageRecordId}' does not exist in project '${projectId}'.`);
   }
   assertExecutionExists(projectId, executionId) {
-    const execution = this.connection.db.query("SELECT 1 FROM executions WHERE project_id = ? AND id = ?").get(projectId, executionId);
-    if (execution)
+    const row = this.connection.db.query("SELECT 1 FROM executions WHERE project_id = ? AND id = ?").get(projectId, executionId);
+    if (row)
       return;
-    throw new AiUsageStorageError("missing_execution", `[SixbSqlite] AI usage execution '${executionId}' does not exist in project '${projectId}'.`);
+    throw new AiLimitStorageError("missing_execution", `[SixbSqlite] AI limit execution '${executionId}' does not exist in project '${projectId}'.`);
   }
 }
-function aggregateExecutionRows(executionIds, rows) {
-  const usageByExecutionId = new Map;
-  for (const executionId of executionIds)
-    usageByExecutionId.set(executionId, []);
-  for (const row of rows) {
-    usageByExecutionId.get(row.execution_id)?.push(usageFromRow2(row));
-  }
-  return executionIds.map((executionId) => {
-    const usages = usageByExecutionId.get(executionId) ?? [];
-    return {
-      modelCallCount: usages.length,
-      usage: aggregateAiModelCallUsage(usages)
-    };
-  });
+function policyFromRow(row) {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    subject: aiLimitSubjectFromParts(row.subject_type, row.subject_id),
+    limit: aiLimitQuantityFromAmount({
+      meter: row.meter,
+      currency: row.currency,
+      amount: BigInt(row.limit_amount)
+    }),
+    period: row.period_kind,
+    enabled: row.enabled === 1,
+    createdAt: new Date(row.created_at),
+    updatedAt: new Date(row.updated_at)
+  };
 }
-function usageFromRow2(row) {
+function policyStatus(policy, period, row, existingGroups) {
+  const limit = normalizeAiLimitAmount(policy.limit);
+  const actual = BigInt(row.actual_amount);
+  const reserved = BigInt(row.reserved_amount);
+  const unknown = BigInt(row.unknown_amount);
+  const consumed = actual + reserved + unknown;
+  const quantity = (amount) => aiLimitQuantityFromAmount({ ...limit, amount });
   return {
-    ...row.input_tokens === null ? {} : { inputTokens: row.input_tokens },
-    ...row.output_tokens === null ? {} : { outputTokens: row.output_tokens },
-    ...row.uncached_input_tokens === null ? {} : { uncachedInputTokens: row.uncached_input_tokens },
-    ...row.cache_read_input_tokens === null ? {} : { cacheReadInputTokens: row.cache_read_input_tokens },
-    ...row.cache_write_input_tokens === null ? {} : { cacheWriteInputTokens: row.cache_write_input_tokens },
-    ...row.text_output_tokens === null ? {} : { textOutputTokens: row.text_output_tokens },
-    ...row.reasoning_output_tokens === null ? {} : { reasoningOutputTokens: row.reasoning_output_tokens }
+    policy,
+    period: structuredClone(period),
+    consumption: {
+      actual: quantity(actual),
+      reserved: quantity(reserved),
+      unknown: quantity(unknown),
+      remaining: quantity(limit.amount > consumed ? limit.amount - consumed : 0n)
+    },
+    accountingStatus: row.accounting_status,
+    exhausted: consumed >= limit.amount,
+    orphaned: policy.subject.type === "group" && existingGroups !== undefined && !existingGroups.has(policy.subject.id)
   };
 }
-function assertNonBlankProjectId(projectId) {
-  if (typeof projectId !== "string" || projectId.trim().length === 0) {
-    throw new TypeError("[Sixb] AI usage projectId must be nonblank.");
+function accountingEntryFromRow(row, subject, requesterGroupIds = subject?.type === "group" ? [subject.id] : []) {
+  const totalTokens = row.total_tokens === null ? undefined : Number(row.total_tokens);
+  const requester = row.requested_by_user_id ? { type: "user", id: row.requested_by_user_id } : row.requested_by_service_account_id ? { type: "serviceAccount", id: row.requested_by_service_account_id } : undefined;
+  return {
+    projectId: row.project_id,
+    usageRecordId: row.usage_record_id,
+    executionId: row.execution_id,
+    attempt: row.attempt,
+    callId: row.call_id,
+    occurredAt: new Date(row.occurred_at),
+    ...totalTokens !== undefined && Number.isSafeInteger(totalTokens) ? { totalTokens } : {},
+    requesterGroupIds,
+    ...requester ? { requester } : {},
+    ...row.valuation_status === "rated" && row.valuation_currency !== null && row.valuation_amount_nanos !== null ? {
+      valuation: {
+        status: "rated",
+        money: {
+          currency: row.valuation_currency,
+          amountNanos: row.valuation_amount_nanos
+        }
+      }
+    } : row.valuation_status === "unpriceable" ? { valuation: { status: "unavailable" } } : {}
+  };
+}
+function reservationFromRow(row) {
+  return {
+    projectId: row.project_id,
+    executionId: row.execution_id,
+    attempt: row.attempt,
+    callId: row.call_id,
+    buckets: normalizeBucketsJson(row.buckets),
+    requestKey: row.request_key,
+    period: {
+      kind: "calendarMonth",
+      start: new Date(row.period_start),
+      end: new Date(row.period_end),
+      resetAt: new Date(row.period_end)
+    },
+    state: row.state,
+    ...row.usage_record_id === null ? {} : { usageRecordId: row.usage_record_id },
+    reservedAt: new Date(row.reserved_at),
+    updatedAt: new Date(row.updated_at)
+  };
+}
+function normalizeBucketsJson(value) {
+  const buckets = JSON.parse(value);
+  return buckets.map((bucket) => ({
+    subject: structuredClone(bucket.subject),
+    estimate: normalizeAiLimitQuantities([bucket.estimate], "stored bucket")[0]
+  }));
+}
+function reservationSqlValues(reservation) {
+  return [
+    reservation.projectId,
+    reservation.executionId,
+    reservation.attempt,
+    reservation.callId,
+    JSON.stringify(reservation.buckets),
+    reservation.requestKey,
+    reservation.period.start.toISOString(),
+    reservation.period.end.toISOString(),
+    reservation.state,
+    reservation.usageRecordId ?? null,
+    reservation.reservedAt.toISOString(),
+    reservation.updatedAt.toISOString()
+  ];
+}
+function assertSameDimension(previous, next) {
+  if (aiLimitAmountKey(normalizeAiLimitAmount(previous)) !== aiLimitAmountKey(normalizeAiLimitAmount(next))) {
+    throw new TypeError("[Sixb] AI limit policy meter and cost currency are immutable.");
   }
 }
+function validatePolicyIdentity(input) {
+  assertNonBlank2(input.projectId, "projectId");
+  assertNonBlank2(input.id, "policy id");
+}
+function duplicatePolicy(policy) {
+  return new AiLimitStorageError("duplicate_policy", `[SixbSqlite] An AI limit policy already exists for policy ID or subject-meter dimension '${policy.id}'.`);
+}
+function missingReservation(input) {
+  return new AiLimitStorageError("missing_reservation", `[SixbSqlite] AI model-call reservation '${input.callId}' does not exist for execution '${input.executionId}' attempt ${input.attempt}.`);
+}
+function reconciliationConflict(callId) {
+  return new AiLimitStorageError("reconciliation_conflict", `[SixbSqlite] AI model-call reservation '${callId}' was reconciled with a different usage record.`);
+}
+function invalidState(reservation, operation) {
+  return new AiLimitStorageError("invalid_reservation_state", `[SixbSqlite] Cannot ${operation} AI model-call reservation '${reservation.callId}' in state '${reservation.state}'.`);
+}
+function isConstraintError(error) {
+  return error instanceof Error && /constraint/i.test(error.message);
+}
 
 // src/auth-storage/auth-storage.ts
-import { AuthStorageError as AuthStorageError10 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError11 } from "@sixb/core/storage";
 
 // src/auth-storage/access-tokens.ts
 import { AuthStorageError as AuthStorageError2 } from "@sixb/core/storage";
@@ -5293,6 +6686,25 @@ function rowToOidcAuthorizationAttemptRecord(row) {
     consumedAt: row.consumed_at ? new Date(row.consumed_at) : undefined
   };
 }
+function rowToDeviceAuthorizationRecord(row) {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    deviceCodeHash: row.device_code_hash,
+    userCode: row.user_code,
+    clientName: row.client_name,
+    tokenName: row.token_name,
+    tokenExpiresAt: new Date(row.token_expires_at),
+    status: row.status,
+    approvedUserId: row.approved_user_id ?? undefined,
+    approvedSessionId: row.approved_session_id ?? undefined,
+    createdAt: new Date(row.created_at),
+    expiresAt: new Date(row.expires_at),
+    approvedAt: row.approved_at ? new Date(row.approved_at) : undefined,
+    deniedAt: row.denied_at ? new Date(row.denied_at) : undefined,
+    consumedAt: row.consumed_at ? new Date(row.consumed_at) : undefined
+  };
+}
 function serializeOptionalRecord(value) {
   return value ? JSON.stringify(value) : null;
 }
@@ -5659,22 +7071,17 @@ function invitationRowToRecord(db, row) {
 }
 
 // src/auth-storage/access-tokens.ts
-class SqliteAuthAccessTokenStore {
-  db;
-  constructor(db) {
-    this.db = db;
-  }
-  async create(input) {
-    const id = assertNonEmpty(input.id, "Access token id");
-    const projectId = assertNonEmpty(input.projectId, "Project id");
-    const name = assertNonEmpty(input.name, "Access token name");
-    const subjectId = assertNonEmpty(input.subjectId, "Access token subject id");
-    const tokenHash = assertNonEmpty(input.tokenHash, "Access token hash");
-    assertKindMatchesSubject(input);
-    this.assertSubjectExists(projectId, input.subjectType, subjectId);
-    const groupIds = input.groupIds === undefined ? undefined : normalizeGroupIds(input.groupIds);
-    try {
-      this.db.query(`
+function createAuthAccessToken(db, input) {
+  const id = assertNonEmpty(input.id, "Access token id");
+  const projectId = assertNonEmpty(input.projectId, "Project id");
+  const name = assertNonEmpty(input.name, "Access token name");
+  const subjectId = assertNonEmpty(input.subjectId, "Access token subject id");
+  const tokenHash = assertNonEmpty(input.tokenHash, "Access token hash");
+  assertKindMatchesSubject(input);
+  assertSubjectExists(db, projectId, input.subjectType, subjectId);
+  const groupIds = input.groupIds === undefined ? undefined : normalizeGroupIds(input.groupIds);
+  try {
+    db.query(`
           INSERT INTO auth_access_tokens (
             project_id,
             id,
@@ -5691,14 +7098,24 @@ class SqliteAuthAccessTokenStore {
             expires_at
           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
         `).run(projectId, id, name, input.kind, input.subjectType, subjectId, tokenHash, serializeOptionalStringArray(groupIds), input.createdByPrincipal?.type ?? null, input.createdByPrincipal?.id ?? null, input.createdBySessionId ?? null, toIso(input.createdAt), toIso(input.expiresAt));
-    } catch (error) {
-      mapUniqueConstraintError(error, "duplicate_access_token", `[Sixb] Access token '${id}' already exists for project '${projectId}'.`);
-    }
-    const token = await this.getById({ projectId, id });
-    if (!token) {
-      throw new AuthStorageError2("missing_access_token", `[Sixb] Access token '${id}' not found for project '${projectId}'.`);
-    }
-    return token;
+  } catch (error) {
+    mapUniqueConstraintError(error, "duplicate_access_token", `[Sixb] Access token '${id}' already exists for project '${projectId}'.`);
+  }
+  const row = db.query("SELECT * FROM auth_access_tokens WHERE project_id = ? AND id = ?").get(projectId, id);
+  const token = row ? rowToAccessTokenRecord(row) : null;
+  if (!token) {
+    throw new AuthStorageError2("missing_access_token", `[Sixb] Access token '${id}' not found for project '${projectId}'.`);
+  }
+  return token;
+}
+
+class SqliteAuthAccessTokenStore {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async create(input) {
+    return createAuthAccessToken(this.db, input);
   }
   async getById(params) {
     const row = this.db.query("SELECT * FROM auth_access_tokens WHERE project_id = ? AND id = ?").get(params.projectId, params.id);
@@ -5787,18 +7204,18 @@ class SqliteAuthAccessTokenStore {
       lastUsedIpAddress
     };
   }
-  assertSubjectExists(projectId, subjectType, subjectId) {
-    if (subjectType === "user") {
-      const row2 = this.db.query("SELECT * FROM auth_users WHERE project_id = ? AND id = ?").get(projectId, subjectId);
-      if (row2)
-        return;
-      throw new AuthStorageError2("missing_user", `[Sixb] User '${subjectId}' not found for project '${projectId}'.`);
-    }
-    const row = this.db.query("SELECT * FROM auth_service_accounts WHERE project_id = ? AND id = ?").get(projectId, subjectId);
-    if (row)
+}
+function assertSubjectExists(db, projectId, subjectType, subjectId) {
+  if (subjectType === "user") {
+    const row2 = db.query("SELECT * FROM auth_users WHERE project_id = ? AND id = ?").get(projectId, subjectId);
+    if (row2)
       return;
-    throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${subjectId}' not found for project '${projectId}'.`);
+    throw new AuthStorageError2("missing_user", `[Sixb] User '${subjectId}' not found for project '${projectId}'.`);
   }
+  const row = db.query("SELECT * FROM auth_service_accounts WHERE project_id = ? AND id = ?").get(projectId, subjectId);
+  if (row)
+    return;
+  throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${subjectId}' not found for project '${projectId}'.`);
 }
 function assertKindMatchesSubject(input) {
   if (input.kind === "personal" && input.subjectType === "user" || input.kind === "serviceAccount" && input.subjectType === "serviceAccount") {
@@ -5807,6 +7224,89 @@ function assertKindMatchesSubject(input) {
   throw new AuthStorageError2("invalid_input", `[Sixb] Access token kind '${input.kind}' cannot target subject type '${input.subjectType}'.`);
 }
 
+// src/auth-storage/device-authorizations.ts
+import { AuthStorageError as AuthStorageError3, MAX_PENDING_DEVICE_AUTHORIZATIONS } from "@sixb/core/storage";
+class SqliteAuthDeviceAuthorizationStore {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async create(input) {
+    return runImmediateTransaction(this.db, () => {
+      this.db.query("DELETE FROM auth_device_authorizations WHERE project_id = ? AND expires_at <= ?").run(input.projectId, toIso(input.createdAt));
+      const pending = this.db.query("SELECT COUNT(*) AS count FROM auth_device_authorizations WHERE project_id = ? AND status = 'pending'").get(input.projectId);
+      if (pending.count >= MAX_PENDING_DEVICE_AUTHORIZATIONS) {
+        throw new AuthStorageError3("device_authorization_limit_exceeded", `[Sixb] Project '${input.projectId}' has too many pending device authorizations.`);
+      }
+      try {
+        this.db.query(`
+          INSERT INTO auth_device_authorizations (
+            project_id, id, device_code_hash, user_code, client_name, token_name,
+            token_expires_at, status, created_at, expires_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)
+        `).run(assertNonEmpty(input.projectId, "Project id"), assertNonEmpty(input.id, "Device authorization id"), assertNonEmpty(input.deviceCodeHash, "Device code hash"), assertNonEmpty(input.userCode, "User code"), assertNonEmpty(input.clientName, "Client name"), assertNonEmpty(input.tokenName, "Token name"), toIso(input.tokenExpiresAt), toIso(input.createdAt), toIso(input.expiresAt));
+      } catch (error) {
+        mapUniqueConstraintError(error, "duplicate_device_authorization", `[Sixb] Device authorization '${input.id}' already exists for project '${input.projectId}'.`);
+      }
+      return requireById(this.db, input.projectId, input.id);
+    });
+  }
+  async getById(params) {
+    return getById(this.db, params.projectId, params.id);
+  }
+  async getByUserCode(params) {
+    const row = this.db.query("SELECT * FROM auth_device_authorizations WHERE project_id = ? AND user_code = ?").get(params.projectId, params.userCode);
+    return row ? rowToDeviceAuthorizationRecord(row) : null;
+  }
+  async approve(params) {
+    return runImmediateTransaction(this.db, () => {
+      const result = this.db.query(`
+        UPDATE auth_device_authorizations
+        SET status = 'approved', approved_user_id = ?, approved_session_id = ?, approved_at = ?
+        WHERE project_id = ? AND id = ? AND status = 'pending' AND expires_at > ?
+          AND EXISTS (
+            SELECT 1 FROM auth_sessions
+            WHERE project_id = ? AND id = ? AND user_id = ?
+              AND revoked_at IS NULL AND expires_at > ?
+              AND (absolute_expires_at IS NULL OR absolute_expires_at > ?)
+          )
+      `).run(params.userId, params.sessionId, toIso(params.approvedAt), params.projectId, params.id, toIso(params.approvedAt), params.projectId, params.sessionId, params.userId, toIso(params.approvedAt), toIso(params.approvedAt));
+      if (result.changes !== 1)
+        throw invalidTransition(params.id, params.projectId);
+      return requireById(this.db, params.projectId, params.id);
+    });
+  }
+  async deny(params) {
+    return runImmediateTransaction(this.db, () => {
+      const result = this.db.query(`
+        UPDATE auth_device_authorizations
+        SET status = 'denied', denied_at = ?
+        WHERE project_id = ? AND id = ? AND status = 'pending' AND expires_at > ?
+      `).run(toIso(params.deniedAt), params.projectId, params.id, toIso(params.deniedAt));
+      if (result.changes !== 1)
+        throw invalidTransition(params.id, params.projectId);
+      return requireById(this.db, params.projectId, params.id);
+    });
+  }
+}
+function getDeviceAuthorizationById(db, projectId, id) {
+  return getById(db, projectId, id);
+}
+function getById(db, projectId, id) {
+  const row = db.query("SELECT * FROM auth_device_authorizations WHERE project_id = ? AND id = ?").get(projectId, id);
+  return row ? rowToDeviceAuthorizationRecord(row) : null;
+}
+function requireById(db, projectId, id) {
+  const record = getById(db, projectId, id);
+  if (!record) {
+    throw new AuthStorageError3("missing_device_authorization", `[Sixb] Device authorization '${id}' not found for project '${projectId}'.`);
+  }
+  return record;
+}
+function invalidTransition(id, projectId) {
+  return new AuthStorageError3("invalid_device_authorization", `[Sixb] Device authorization '${id}' is no longer pending for project '${projectId}'.`);
+}
+
 // src/auth-storage/group-memberships.ts
 class SqliteAuthGroupMembershipStore {
   db;
@@ -5895,7 +7395,7 @@ class SqliteAuthUserIdentityStore {
 }
 
 // src/auth-storage/invitations.ts
-import { AuthStorageError as AuthStorageError3 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError4 } from "@sixb/core/storage";
 class SqliteAuthInvitationStore {
   db;
   constructor(db) {
@@ -5932,7 +7432,7 @@ class SqliteAuthInvitationStore {
         return requireInvitationById(this.db, { projectId, id: existingActive.id });
       }
       if (getInvitationById(this.db, { projectId, id })) {
-        throw new AuthStorageError3("duplicate_invitation", `[Sixb] Invitation '${id}' already exists but is not active for project '${projectId}'.`);
+        throw new AuthStorageError4("duplicate_invitation", `[Sixb] Invitation '${id}' already exists but is not active for project '${projectId}'.`);
       }
       const createdAt = dateOrNow(input.createdAt);
       try {
@@ -6042,7 +7542,7 @@ class SqliteAuthInvitationStore {
 
 // src/auth-storage/magic-links.ts
 import { resolveAuthSessionAudience } from "@sixb/core";
-import { AuthStorageError as AuthStorageError4 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError5 } from "@sixb/core/storage";
 class SqliteAuthMagicLinkStore {
   db;
   constructor(db) {
@@ -6057,7 +7557,7 @@ class SqliteAuthMagicLinkStore {
       const email = normalizeEmail(input.email);
       const tokenHash = assertNonEmpty(input.tokenHash, "Magic link token hash");
       if (getMagicLinkRowById(this.db, { projectId, id })) {
-        throw new AuthStorageError4("duplicate_magic_link", `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`);
+        throw new AuthStorageError5("duplicate_magic_link", `[Sixb] Magic link '${id}' already exists for project '${projectId}'.`);
       }
       revokeActiveMagicLinksForEmail(this.db, {
         projectId,
@@ -6121,7 +7621,7 @@ class SqliteAuthMagicLinkStore {
 
 // src/auth-storage/oidc-attempts.ts
 import { resolveAuthSessionAudience as resolveAuthSessionAudience2 } from "@sixb/core";
-import { AuthStorageError as AuthStorageError5 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError6 } from "@sixb/core/storage";
 class SqliteAuthOidcAuthorizationAttemptStore {
   db;
   constructor(db) {
@@ -6137,7 +7637,7 @@ class SqliteAuthOidcAuthorizationAttemptStore {
       const nonceHash = assertNonEmpty(input.nonceHash, "OIDC nonce hash");
       const codeVerifier = assertNonEmpty(input.codeVerifier, "OIDC code verifier");
       if (getOidcAttemptRowById(this.db, { projectId, id })) {
-        throw new AuthStorageError5("duplicate_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`);
+        throw new AuthStorageError6("duplicate_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' already exists for project '${projectId}'.`);
       }
       try {
         this.db.query(`
@@ -6180,7 +7680,7 @@ class SqliteAuthOidcAuthorizationAttemptStore {
 }
 
 // src/auth-storage/service-account-group-memberships.ts
-import { AuthStorageError as AuthStorageError6 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError7 } from "@sixb/core/storage";
 class SqliteAuthServiceAccountGroupMembershipStore {
   db;
   constructor(db) {
@@ -6192,7 +7692,7 @@ class SqliteAuthServiceAccountGroupMembershipStore {
     const groupId = assertNonEmpty(input.groupId, "Group id");
     const serviceAccount = this.db.query("SELECT * FROM auth_service_accounts WHERE project_id = ? AND id = ?").get(projectId, serviceAccountId);
     if (!serviceAccount) {
-      throw new AuthStorageError6("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
+      throw new AuthStorageError7("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
     }
     this.db.query(`
         INSERT OR IGNORE INTO auth_service_account_group_memberships (
@@ -6217,7 +7717,7 @@ class SqliteAuthServiceAccountGroupMembershipStore {
     const serviceAccountId = assertNonEmpty(input.serviceAccountId, "Service account id");
     const serviceAccount = this.db.query("SELECT * FROM auth_service_accounts WHERE project_id = ? AND id = ?").get(projectId, serviceAccountId);
     if (!serviceAccount) {
-      throw new AuthStorageError6("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
+      throw new AuthStorageError7("missing_service_account", `[Sixb] Service account '${serviceAccountId}' not found for project '${projectId}'.`);
     }
     const groupIds = normalizeGroupIds(input.groupIds);
     const desired = new Set(groupIds);
@@ -6272,7 +7772,7 @@ class SqliteAuthServiceAccountGroupMembershipStore {
 }
 
 // src/auth-storage/service-accounts.ts
-import { AuthStorageError as AuthStorageError7 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError8 } from "@sixb/core/storage";
 class SqliteAuthServiceAccountStore {
   db;
   constructor(db) {
@@ -6334,7 +7834,7 @@ class SqliteAuthServiceAccountStore {
       `).run(name, input.description ?? null, input.status ?? null, toIso(updatedAt), projectId, id);
     const updated = await this.getById({ projectId, id });
     if (!updated) {
-      throw new AuthStorageError7("missing_service_account", `[Sixb] Service account '${id}' not found for project '${projectId}'.`);
+      throw new AuthStorageError8("missing_service_account", `[Sixb] Service account '${id}' not found for project '${projectId}'.`);
     }
     return updated;
   }
@@ -6368,7 +7868,7 @@ class SqliteAuthServiceAccountStore {
 }
 
 // src/auth-storage/sessions.ts
-import { AuthStorageError as AuthStorageError8 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError9 } from "@sixb/core/storage";
 class SqliteAuthSessionStore {
   db;
   constructor(db) {
@@ -6441,7 +7941,7 @@ class SqliteAuthSessionStore {
     return runImmediateTransaction(this.db, () => {
       const existing = getSessionRowById(this.db, params);
       if (!existing) {
-        throw new AuthStorageError8("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
+        throw new AuthStorageError9("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
       }
       this.db.query(`
           UPDATE auth_sessions
@@ -6469,7 +7969,7 @@ class SqliteAuthSessionStore {
         `).run(toIso(params.lastSeenAt), params.projectId, params.id);
       const updated = getSessionById(this.db, params);
       if (!updated) {
-        throw new AuthStorageError8("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
+        throw new AuthStorageError9("missing_session", `[Sixb] Session '${params.id}' not found for project '${params.projectId}'.`);
       }
       return updated;
     });
@@ -6477,7 +7977,7 @@ class SqliteAuthSessionStore {
 }
 
 // src/auth-storage/users.ts
-import { AuthStorageError as AuthStorageError9 } from "@sixb/core/storage";
+import { AuthStorageError as AuthStorageError10 } from "@sixb/core/storage";
 class SqliteAuthUserStore {
   db;
   constructor(db) {
@@ -6488,10 +7988,10 @@ class SqliteAuthUserStore {
     const projectId = assertNonEmpty(input.projectId, "Project id");
     const email = normalizeEmail(input.email);
     if (getUserRowById(this.db, { projectId, id })) {
-      throw new AuthStorageError9("duplicate_user", `[Sixb] User '${id}' already exists for project '${projectId}'.`);
+      throw new AuthStorageError10("duplicate_user", `[Sixb] User '${id}' already exists for project '${projectId}'.`);
     }
     if (getUserRowByEmail(this.db, { projectId, email })) {
-      throw new AuthStorageError9("duplicate_user", `[Sixb] User email '${email}' already exists for project '${projectId}'.`);
+      throw new AuthStorageError10("duplicate_user", `[Sixb] User email '${email}' already exists for project '${projectId}'.`);
     }
     const createdAt = dateOrNow(input.createdAt);
     const updatedAt = input.updatedAt ? new Date(input.updatedAt) : createdAt;
@@ -6536,7 +8036,7 @@ class SqliteAuthUserStore {
       id: input.id
     });
     if (!existing) {
-      throw new AuthStorageError9("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
+      throw new AuthStorageError10("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
     }
     const updatedAt = dateOrNow(input.updatedAt);
     this.db.query(`
@@ -6560,7 +8060,7 @@ class SqliteAuthUserStore {
       id: input.id
     });
     if (!existing) {
-      throw new AuthStorageError9("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
+      throw new AuthStorageError10("missing_user", `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`);
     }
     const updatedAt = dateOrNow(input.updatedAt);
     this.db.query(`
@@ -6619,6 +8119,7 @@ class SqliteAuthStorage {
   groupMemberships;
   magicLinks;
   oidcAuthorizationAttempts;
+  deviceAuthorizations;
   constructor(options = {}) {
     this.connection = openSqliteStoreConnection(options);
     this.db = this.connection.db;
@@ -6635,6 +8136,30 @@ class SqliteAuthStorage {
     this.groupMemberships = new SqliteAuthGroupMembershipStore(this.db);
     this.magicLinks = new SqliteAuthMagicLinkStore(this.db);
     this.oidcAuthorizationAttempts = new SqliteAuthOidcAuthorizationAttemptStore(this.db);
+    this.deviceAuthorizations = new SqliteAuthDeviceAuthorizationStore(this.db);
+  }
+  async completeDeviceAuthorization(input) {
+    return runImmediateTransaction(this.db, () => {
+      const authorization = getDeviceAuthorizationById(this.db, input.projectId, input.id);
+      if (!authorization) {
+        throw new AuthStorageError11("missing_device_authorization", `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`);
+      }
+      assertCompletableDeviceAuthorization(authorization, input);
+      const accessToken = createAuthAccessToken(this.db, input.accessToken);
+      this.db.query(`
+        UPDATE auth_device_authorizations
+        SET status = 'consumed', consumed_at = ?
+        WHERE project_id = ? AND id = ? AND status = 'approved'
+      `).run(toIso(input.completedAt), input.projectId, input.id);
+      return {
+        authorization: {
+          ...authorization,
+          status: "consumed",
+          consumedAt: new Date(input.completedAt)
+        },
+        accessToken
+      };
+    });
   }
   async completeMagicLinkSignIn(input) {
     const result = runImmediateTransaction(this.db, () => {
@@ -6664,7 +8189,7 @@ class SqliteAuthStorage {
           consumedAt: completedAt
         });
         return {
-          error: new AuthStorageError10("suspended_user", `[Sixb] User '${existingUserRow.id}' is suspended for project '${projectId}'.`)
+          error: new AuthStorageError11("suspended_user", `[Sixb] User '${existingUserRow.id}' is suspended for project '${projectId}'.`)
         };
       }
       if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
@@ -6675,7 +8200,7 @@ class SqliteAuthStorage {
           consumedAt: completedAt
         });
         return {
-          error: new AuthStorageError10("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
+          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
         };
       }
       if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && hasActiveUsers(this.db, projectId)) {
@@ -6686,7 +8211,7 @@ class SqliteAuthStorage {
           consumedAt: completedAt
         });
         return {
-          error: new AuthStorageError10("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
+          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
         };
       }
       validateCompleteSessionInput(this.db, projectId, input.session);
@@ -6695,7 +8220,7 @@ class SqliteAuthStorage {
       if (shouldCreateUser) {
         newUserId = assertNonEmpty(input.newUserId, "User id");
         if (getUserRowById(this.db, { projectId, id: newUserId })) {
-          throw new AuthStorageError10("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
+          throw new AuthStorageError11("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
         }
       }
       consumeMagicLink(this.db, {
@@ -6770,37 +8295,37 @@ class SqliteAuthStorage {
       if (identity && !userRow) {
         this.consumeOidcAttempt(input, completedAt, projectId);
         return {
-          error: new AuthStorageError10("missing_user", `[Sixb] User '${identity.user_id}' not found for linked OIDC identity.`)
+          error: new AuthStorageError11("missing_user", `[Sixb] User '${identity.user_id}' not found for linked OIDC identity.`)
         };
       }
       if (!identity && userRow && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
         this.consumeOidcAttempt(input, completedAt, projectId);
         return {
-          error: new AuthStorageError10("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${userRow.id}' for project '${projectId}'.`)
+          error: new AuthStorageError11("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${userRow.id}' for project '${projectId}'.`)
         };
       }
       if (userRow?.status === "suspended") {
         this.consumeOidcAttempt(input, completedAt, projectId);
         return {
-          error: new AuthStorageError10("suspended_user", `[Sixb] User '${userRow.id}' is suspended for project '${projectId}'.`)
+          error: new AuthStorageError11("suspended_user", `[Sixb] User '${userRow.id}' is suspended for project '${projectId}'.`)
         };
       }
       if (shouldCreateUser && !input.emailVerified) {
         this.consumeOidcAttempt(input, completedAt, projectId);
         return {
-          error: new AuthStorageError10("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
+          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
         };
       }
       if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
         this.consumeOidcAttempt(input, completedAt, projectId);
         return {
-          error: new AuthStorageError10("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
+          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
         };
       }
       if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && hasActiveUsers(this.db, projectId)) {
         this.consumeOidcAttempt(input, completedAt, projectId);
         return {
-          error: new AuthStorageError10("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
+          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
         };
       }
       validateCompleteSessionInput(this.db, projectId, input.session);
@@ -6809,7 +8334,7 @@ class SqliteAuthStorage {
       if (shouldCreateUser) {
         newUserId = assertNonEmpty(input.newUserId, "User id");
         if (getUserRowById(this.db, { projectId, id: newUserId })) {
-          throw new AuthStorageError10("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
+          throw new AuthStorageError11("duplicate_user", `[Sixb] User '${newUserId}' already exists for project '${projectId}'.`);
         }
       }
       this.consumeOidcAttempt(input, completedAt, projectId);
@@ -6882,7 +8407,7 @@ class SqliteAuthStorage {
         id: input.userId
       });
       if (!existing) {
-        throw new AuthStorageError10("missing_user", `[Sixb] User '${input.userId}' not found for project '${input.projectId}'.`);
+        throw new AuthStorageError11("missing_user", `[Sixb] User '${input.userId}' not found for project '${input.projectId}'.`);
       }
       this.db.query(`
           UPDATE auth_users
@@ -6908,24 +8433,24 @@ class SqliteAuthStorage {
   }
   assertMagicLinkUsable(projectId, id, tokenHash, completedAt, row) {
     if (!row) {
-      throw new AuthStorageError10("missing_magic_link", `[Sixb] Magic link '${id}' not found for project '${projectId}'.`);
+      throw new AuthStorageError11("missing_magic_link", `[Sixb] Magic link '${id}' not found for project '${projectId}'.`);
     }
     if (row.token_hash !== tokenHash || row.consumed_at || row.revoked_at) {
-      throw new AuthStorageError10("invalid_magic_link", `[Sixb] Magic link '${id}' is not valid for project '${projectId}'.`);
+      throw new AuthStorageError11("invalid_magic_link", `[Sixb] Magic link '${id}' is not valid for project '${projectId}'.`);
     }
     if (new Date(row.expires_at) <= completedAt) {
-      throw new AuthStorageError10("expired_magic_link", `[Sixb] Magic link '${id}' is expired for project '${projectId}'.`);
+      throw new AuthStorageError11("expired_magic_link", `[Sixb] Magic link '${id}' is expired for project '${projectId}'.`);
     }
   }
   assertOidcAttemptUsable(projectId, id, stateHash, completedAt, row) {
     if (!row) {
-      throw new AuthStorageError10("missing_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' not found for project '${projectId}'.`);
+      throw new AuthStorageError11("missing_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' not found for project '${projectId}'.`);
     }
     if (row.state_hash !== stateHash || row.consumed_at) {
-      throw new AuthStorageError10("invalid_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' is not valid for project '${projectId}'.`);
+      throw new AuthStorageError11("invalid_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' is not valid for project '${projectId}'.`);
     }
     if (new Date(row.expires_at) <= completedAt) {
-      throw new AuthStorageError10("expired_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' is expired for project '${projectId}'.`);
+      throw new AuthStorageError11("expired_oidc_attempt", `[Sixb] OIDC authorization attempt '${id}' is expired for project '${projectId}'.`);
     }
   }
   insertUser(input) {
@@ -7061,7 +8586,21 @@ function assertSignInSessionAudience(projectId, sessionAudience, storedAudience)
   if (sessionAudience === storedAudience) {
     return;
   }
-  throw new AuthStorageError10("invalid_input", `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`);
+  throw new AuthStorageError11("invalid_input", `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`);
+}
+function assertCompletableDeviceAuthorization(authorization, input) {
+  if (authorization.deviceCodeHash !== input.deviceCodeHash) {
+    throw new AuthStorageError11("invalid_device_authorization", "[Sixb] Invalid device authorization.");
+  }
+  if (authorization.status === "pending") {
+    throw new AuthStorageError11("pending_device_authorization", "[Sixb] Device authorization is pending.");
+  }
+  if (authorization.status === "denied") {
+    throw new AuthStorageError11("device_authorization_denied", "[Sixb] Device authorization was denied.");
+  }
+  if (authorization.status !== "approved" || authorization.expiresAt <= input.completedAt || !authorization.approvedUserId || !authorization.approvedSessionId || input.accessToken.projectId !== input.projectId || input.accessToken.subjectType !== "user" || input.accessToken.subjectId !== authorization.approvedUserId || input.accessToken.createdBySessionId !== authorization.approvedSessionId) {
+    throw new AuthStorageError11("invalid_device_authorization", "[Sixb] Device authorization is invalid.");
+  }
 }
 // src/connector-connection-storage.ts
 import {
@@ -13521,15 +15060,15 @@ class SqliteWorkflowAgentNodeRunStorage {
       projectId: input.projectId,
       executionId: input.executionId,
       nodeRunId: input.nodeRunId,
-      agentId: input.agentId,
+      actorId: input.actorId,
       workflowExecutionId: parent.execution_id
     });
     try {
       this.db.query(`
           INSERT INTO workflow_agent_node_runs (
-            project_id, node_run_id, execution_id, agent_id, status, prompt, attempt, created_at
+            project_id, node_run_id, execution_id, actor_id, status, prompt, attempt, created_at
           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-        `).run(input.projectId, input.nodeRunId, input.executionId, input.agentId, "queued", input.prompt, 0, (input.createdAt ?? new Date).toISOString());
+        `).run(input.projectId, input.nodeRunId, input.executionId, input.actorId, "queued", input.prompt, 0, (input.createdAt ?? new Date).toISOString());
     } catch (error) {
       if (isUniqueConstraintError2(error)) {
         throw new WorkflowRunError(`[SixbSqlite] Agent execution already exists for workflow node run '${input.nodeRunId}'.`);
@@ -13608,9 +15147,9 @@ class SqliteWorkflowAgentNodeRunStorage {
       return { runs: [], total: 0, hasMore: false };
     const whereClauses = ["project_id = ?"];
     const args = [input.projectId];
-    if (input.agentId) {
-      whereClauses.push("agent_id = ?");
-      args.push(input.agentId);
+    if (input.actorId) {
+      whereClauses.push("actor_id = ?");
+      args.push(input.actorId);
     }
     appendRunListFilters(whereClauses, args, input);
     const result = queryRunList({
@@ -13860,7 +15399,7 @@ function rowToWorkflowAgentNodeRunRecord(row) {
     projectId: row.project_id,
     nodeRunId: row.node_run_id,
     executionId: row.execution_id,
-    agentId: row.agent_id,
+    actorId: row.actor_id,
     status: row.status,
     prompt: row.prompt,
     ...row.model_id ? { modelId: row.model_id } : {},
@@ -13895,6 +15434,7 @@ class SqliteStorage {
   agents;
   aiUsage;
   aiCosts;
+  aiLimits;
   actionRuns;
   pipelineRuns;
   syncRuns;
@@ -13942,6 +15482,7 @@ class SqliteStorage {
     this.agents = createAgentOperationScope(stores.agents, scope);
     this.aiUsage = createOperationScopedFacade(stores.aiUsage, scope);
     this.aiCosts = createOperationScopedFacade(stores.aiCosts, scope);
+    this.aiLimits = createOperationScopedFacade(stores.aiLimits, scope);
     this.actionRuns = createOperationScopedFacade(stores.actionRuns, scope);
     this.pipelineRuns = createOperationScopedFacade(stores.pipelineRuns, scope);
     this.timeseries = createOperationScopedFacade(readTimeseries, readScope);
@@ -14062,6 +15603,7 @@ function createSqliteStores(connection, options) {
     agents: new SqliteAgentStorage({ connection, executions }),
     aiUsage: new SqliteAiUsageStorage({ connection }),
     aiCosts: new SqliteAiCostStorage(connection),
+    aiLimits: new SqliteAiLimitStorage({ connection }),
     actionRuns: new SqliteActionRunStorage({ connection, executions }),
     pipelineRuns: new SqlitePipelineRunStorage({ connection, executions }),
     timeseries: new SqliteTimeseriesStorage({ connection }),
@@ -14079,4 +15621,4 @@ export {
   SqliteStorage
 };
 
-//# debugId=65891EE349DAB6B764756E2164756E21
+//# debugId=CC3E88BEF909A1E364756E2164756E21