@sixb/sqlite 0.1.7 → 0.1.9

package/dist/index.js

@@ -2,18 +2,21 @@
 // src/index.ts
 import { AsyncLocalStorage } from "async_hooks";
 import { ProviderMaterializationTransactionLifecycle } from "@sixb/core/internal/ontology-storage-provider";
+import {
+  createTransactionStorageProxy,
+  throwNestedStorageTransaction
+} from "@sixb/core/internal/storage";
 import {
   createAgentOperationScope,
   createAuthOperationScope,
+  createObjectOperationScope,
   createOntologyOperationScope,
   createOperationScopedFacade,
   createStorageOperationScope,
   createWorkflowRunOperationScope
 } from "@sixb/core/internal/storage-operation-scope";
 import {
-  createTransactionStorageProxy,
-  StorageTransactionError,
-  throwNestedStorageTransaction
+  StorageTransactionError
 } from "@sixb/core/storage";
 
 // src/action-run-storage.ts
@@ -23,12 +26,11 @@ import {
 } from "@sixb/core/internal/action-run-storage";
 import { assertActionRunExecution } from "@sixb/core/internal/action-run-storage-provider";
 import {
-  ActionRunError,
   actionRunPhaseRecordsEqual,
   canRequeueActionRunAfterEnqueueFailure,
-  finishActionRunPhase,
-  isTerminalActionRun
-} from "@sixb/core/storage";
+  finishActionRunPhase
+} from "@sixb/core/internal/storage";
+import { ActionRunError, isTerminalActionRun } from "@sixb/core/storage";
 
 // src/migrations.ts
 import { Database } from "bun:sqlite";
@@ -3632,6 +3634,331 @@ CREATE INDEX idx_auth_device_authorizations_pending
   ON auth_device_authorizations(project_id, status, expires_at);
 `;
 
+// src/migrations/035-share-grants.sql
+var _035_share_grants_default = `CREATE TABLE share_grants (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  definition_id TEXT NOT NULL CHECK (length(trim(definition_id)) > 0),
+  target_object_type_id TEXT NOT NULL CHECK (length(trim(target_object_type_id)) > 0),
+  target_primary_id TEXT NOT NULL CHECK (length(trim(target_primary_id)) > 0),
+  issued_by_type TEXT NOT NULL CHECK (issued_by_type IN ('user', 'serviceAccount')),
+  issued_by_id TEXT NOT NULL CHECK (length(trim(issued_by_id)) > 0),
+  authority_version INTEGER NOT NULL CHECK (authority_version > 0),
+  authority_snapshot TEXT NOT NULL CHECK (
+    json_valid(authority_snapshot)
+    AND json_type(authority_snapshot) = 'object'
+    AND json_type(authority_snapshot, '$.version') = 'integer'
+    AND json_extract(authority_snapshot, '$.version') = authority_version
+    AND json_type(authority_snapshot, '$.access') = 'object'
+  ),
+  authority_digest TEXT NOT NULL CHECK (
+    length(authority_digest) = 64
+    AND authority_digest = lower(authority_digest)
+    AND authority_digest NOT GLOB '*[^0-9a-f]*'
+  ),
+  token_hash TEXT NOT NULL CHECK (
+    length(token_hash) = 64
+    AND token_hash = lower(token_hash)
+    AND token_hash NOT GLOB '*[^0-9a-f]*'
+  ),
+  destination_path TEXT NOT NULL CHECK (
+    substr(destination_path, 1, 1) = '/'
+    AND instr(destination_path, '?') = 0
+    AND instr(destination_path, '#') = 0
+    AND instr(destination_path, char(92)) = 0
+  ),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  revoked_at TEXT,
+  revoked_by_type TEXT CHECK (
+    revoked_by_type IS NULL OR revoked_by_type IN ('user', 'serviceAccount', 'system')
+  ),
+  revoked_by_id TEXT CHECK (revoked_by_id IS NULL OR length(trim(revoked_by_id)) > 0),
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, token_hash),
+  CHECK (expires_at > created_at),
+  CHECK (revoked_at IS NULL OR revoked_at >= created_at),
+  CHECK (
+    (revoked_at IS NULL AND revoked_by_type IS NULL AND revoked_by_id IS NULL)
+    OR
+    (revoked_at IS NOT NULL AND revoked_by_type IS NOT NULL AND revoked_by_id IS NOT NULL)
+  )
+);
+
+CREATE INDEX idx_share_grants_target
+  ON share_grants (
+    project_id,
+    definition_id,
+    target_object_type_id,
+    target_primary_id,
+    created_at DESC,
+    id DESC
+  );
+
+CREATE INDEX idx_share_grants_project_created
+  ON share_grants (project_id, created_at DESC, id DESC);
+
+CREATE INDEX idx_share_grants_expiry
+  ON share_grants (project_id, expires_at)
+  WHERE revoked_at IS NULL;
+`;
+
+// src/migrations/036-share-sessions.sql
+var _036_share_sessions_default = `-- Shared sessions and their execution provenance.
+CREATE TABLE share_sessions (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  grant_id TEXT NOT NULL CHECK (length(trim(grant_id)) > 0),
+  token_hash TEXT NOT NULL CHECK (
+    length(token_hash) = 64
+    AND token_hash = lower(token_hash)
+    AND token_hash NOT GLOB '*[^0-9a-f]*'
+  ),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  absolute_expires_at TEXT NOT NULL,
+  revoked_at TEXT,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, id, grant_id),
+  UNIQUE (project_id, token_hash),
+  FOREIGN KEY (project_id, grant_id)
+    REFERENCES share_grants (project_id, id),
+  CHECK (expires_at > created_at),
+  CHECK (absolute_expires_at > created_at),
+  CHECK (expires_at <= absolute_expires_at),
+  CHECK (revoked_at IS NULL OR revoked_at >= created_at)
+);
+
+CREATE INDEX idx_share_sessions_grant
+  ON share_sessions (project_id, grant_id, created_at DESC, id DESC);
+
+CREATE INDEX idx_share_sessions_expiry
+  ON share_sessions (project_id, expires_at)
+  WHERE revoked_at IS NULL;
+
+-- Persist shared-session provenance on request executions without fabricating a principal.
+CREATE TABLE executions_v2 (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  executor_kind TEXT NOT NULL CHECK (
+    executor_kind IN (
+      'request', 'action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow',
+      'agent', 'kernel'
+    )
+  ),
+  executor_id TEXT NOT NULL CHECK (length(trim(executor_id)) > 0),
+  source_kind TEXT NOT NULL CHECK (
+    source_kind IN ('http', 'webhook', 'schedule', 'event', 'datasetVersion', 'execution')
+  ),
+  source_id TEXT NOT NULL CHECK (length(trim(source_id)) > 0),
+  requested_by_user_id TEXT,
+  requested_by_service_account_id TEXT,
+  correlation_id TEXT NOT NULL CHECK (length(trim(correlation_id)) > 0),
+  parent_execution_id TEXT,
+  authority_kind TEXT NOT NULL CHECK (
+    authority_kind IN ('principal', 'trustedPrimitive', 'delegated', 'kernel', 'disabled')
+  ),
+  authority_user_id TEXT,
+  authority_service_account_id TEXT,
+  authority_session_id TEXT,
+  authority_access_token_id TEXT,
+  authority_primitive_kind TEXT CHECK (
+    authority_primitive_kind IS NULL
+      OR authority_primitive_kind IN (
+        'action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow'
+      )
+  ),
+  authority_primitive_id TEXT,
+  authority_kernel_operation TEXT CHECK (
+    authority_kernel_operation IS NULL OR authority_kernel_operation = 'ontology.recover'
+  ),
+  authority_delegation_kind TEXT CHECK (
+    authority_delegation_kind IS NULL OR authority_delegation_kind = 'share'
+  ),
+  authority_delegation_id TEXT,
+  authority_delegation_session_id TEXT,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, id),
+  FOREIGN KEY (project_id, parent_execution_id) REFERENCES executions (project_id, id),
+  FOREIGN KEY (project_id, requested_by_user_id) REFERENCES auth_users (project_id, id),
+  FOREIGN KEY (project_id, requested_by_service_account_id)
+    REFERENCES auth_service_accounts (project_id, id),
+  FOREIGN KEY (project_id, authority_user_id) REFERENCES auth_users (project_id, id),
+  FOREIGN KEY (project_id, authority_service_account_id)
+    REFERENCES auth_service_accounts (project_id, id),
+  FOREIGN KEY (project_id, authority_session_id) REFERENCES auth_sessions (project_id, id),
+  FOREIGN KEY (project_id, authority_access_token_id)
+    REFERENCES auth_access_tokens (project_id, id),
+  FOREIGN KEY (
+    project_id, authority_delegation_session_id, authority_delegation_id
+  ) REFERENCES share_sessions (project_id, id, grant_id),
+  CHECK ((requested_by_user_id IS NOT NULL) + (requested_by_service_account_id IS NOT NULL) <= 1),
+  CHECK (
+    (source_kind = 'execution' AND parent_execution_id = source_id)
+      OR (source_kind <> 'execution' AND parent_execution_id IS NULL)
+  ),
+  CHECK (
+    (
+      authority_kind = 'principal'
+      AND (authority_user_id IS NOT NULL) + (authority_service_account_id IS NOT NULL) = 1
+      AND (authority_session_id IS NOT NULL) + (authority_access_token_id IS NOT NULL) <= 1
+      AND (authority_session_id IS NULL OR authority_user_id IS NOT NULL)
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'trustedPrimitive'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NOT NULL
+      AND authority_primitive_id IS NOT NULL
+      AND length(trim(authority_primitive_id)) > 0
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'delegated'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NOT NULL
+      AND authority_delegation_kind = 'share'
+      AND authority_delegation_id IS NOT NULL
+      AND length(trim(authority_delegation_id)) > 0
+      AND authority_delegation_session_id IS NOT NULL
+      AND length(trim(authority_delegation_session_id)) > 0
+    )
+    OR (
+      authority_kind = 'kernel'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NOT NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'disabled'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+  ),
+  CHECK (
+    (
+      executor_kind = 'request'
+      AND source_kind = 'http'
+      AND executor_id = source_id
+      AND (
+        (
+          authority_kind = 'principal'
+          AND requested_by_user_id IS authority_user_id
+          AND requested_by_service_account_id IS authority_service_account_id
+        )
+        OR (
+          authority_kind IN ('delegated', 'disabled')
+          AND requested_by_user_id IS NULL
+          AND requested_by_service_account_id IS NULL
+        )
+      )
+    )
+    OR (
+      executor_kind IN ('action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow')
+      AND authority_kind = 'trustedPrimitive'
+      AND executor_kind = authority_primitive_kind
+    )
+    OR (
+      executor_kind = 'agent'
+      AND source_kind = 'execution'
+      AND (
+        (
+          authority_kind = 'principal'
+          AND authority_service_account_id IS NOT NULL
+          AND authority_session_id IS NULL
+          AND authority_access_token_id IS NULL
+        )
+        OR (
+          authority_kind = 'principal'
+          AND authority_user_id IS NOT NULL
+          AND (authority_session_id IS NOT NULL) + (authority_access_token_id IS NOT NULL) = 1
+        )
+        OR authority_kind = 'disabled'
+      )
+    )
+    OR (executor_kind = 'kernel' AND authority_kind = 'kernel')
+  )
+);
+
+INSERT INTO executions_v2 (
+  project_id, id, executor_kind, executor_id, source_kind, source_id,
+  requested_by_user_id, requested_by_service_account_id, correlation_id, parent_execution_id,
+  authority_kind, authority_user_id, authority_service_account_id, authority_session_id,
+  authority_access_token_id, authority_primitive_kind, authority_primitive_id,
+  authority_kernel_operation, authority_delegation_kind, authority_delegation_id,
+  authority_delegation_session_id, created_at
+)
+SELECT
+  project_id, id, executor_kind, executor_id, source_kind, source_id,
+  requested_by_user_id, requested_by_service_account_id, correlation_id, parent_execution_id,
+  authority_kind, authority_user_id, authority_service_account_id, authority_session_id,
+  authority_access_token_id, authority_primitive_kind, authority_primitive_id,
+  authority_kernel_operation, NULL, NULL, NULL, created_at
+FROM executions;
+
+DROP TABLE executions;
+ALTER TABLE executions_v2 RENAME TO executions;
+`;
+
+// src/migrations/037-execution-requester-groups.sql
+var _037_execution_requester_groups_default = `ALTER TABLE executions ADD COLUMN requester_group_ids TEXT NOT NULL DEFAULT '[]';
+
+-- Preserve each admitted snapshot, including an intentionally empty one. Executions without
+-- their own historical snapshot inherit from their parent; historical roots remain unknown/empty.
+WITH RECURSIVE attribution(project_id, id, groups) AS (
+  SELECT e.project_id, e.id, COALESCE(w.requester_group_ids, a.requester_group_ids, '[]')
+  FROM executions e
+  LEFT JOIN workflow_runs w ON w.project_id = e.project_id AND w.execution_id = e.id
+  LEFT JOIN agent_runs a ON a.project_id = e.project_id AND a.execution_id = e.id
+  WHERE e.parent_execution_id IS NULL
+  UNION ALL
+  SELECT e.project_id, e.id, COALESCE(w.requester_group_ids, a.requester_group_ids, p.groups)
+  FROM executions e
+  JOIN attribution p ON p.project_id = e.project_id AND p.id = e.parent_execution_id
+  LEFT JOIN workflow_runs w ON w.project_id = e.project_id AND w.execution_id = e.id
+  LEFT JOIN agent_runs a ON a.project_id = e.project_id AND a.execution_id = e.id
+)
+UPDATE executions SET requester_group_ids = (
+  SELECT groups FROM attribution
+  WHERE attribution.project_id = executions.project_id AND attribution.id = executions.id
+);
+
+ALTER TABLE workflow_runs DROP COLUMN requester_group_ids;
+ALTER TABLE agent_runs DROP COLUMN requester_group_ids;
+`;
+
 // src/migrations.ts
 var MIGRATIONS_TABLE_SQL = `
   CREATE TABLE IF NOT EXISTS sixb_migrations (
@@ -3700,7 +4027,10 @@ var sqliteStorageMigrations = defineMigrations({
     sqliteSql("031-subagent-runs", _031_subagent_runs_default),
     sqliteSql("032-conversation-run-spec", _032_conversation_run_spec_default),
     sqliteSql("033-retire-agent-definitions", _033_retire_agent_definitions_default),
-    sqliteSql("034-device-authorizations", _034_device_authorizations_default)
+    sqliteSql("034-device-authorizations", _034_device_authorizations_default),
+    sqliteSql("035-share-grants", _035_share_grants_default),
+    sqliteSql("036-share-sessions", _036_share_sessions_default),
+    sqliteSql("037-execution-requester-groups", _037_execution_requester_groups_default)
   ]
 });
 function sqliteStoragePath(basePath) {
@@ -3879,6 +4209,7 @@ function closeSqliteStoreConnection(connection) {
   }
 }
 var activeImmediateTransactions = new WeakSet;
+var activeDeferredReadTransactions = new WeakSet;
 function runImmediateTransaction(db, run) {
   if (activeImmediateTransactions.has(db)) {
     return run();
@@ -3916,6 +4247,26 @@ async function runImmediateTransactionAsync(db, run) {
     activeImmediateTransactions.delete(db);
   }
 }
+function runDeferredReadTransaction(db, run) {
+  if (activeImmediateTransactions.has(db) || activeDeferredReadTransactions.has(db)) {
+    return run();
+  }
+  if (db.inTransaction) {
+    throw new Error("[SixbSqlite] Selected object reads cannot join an unverified SQLite transaction.");
+  }
+  db.run("BEGIN DEFERRED");
+  activeDeferredReadTransactions.add(db);
+  try {
+    const result = run();
+    db.run("COMMIT");
+    return result;
+  } catch (error) {
+    rollbackQuietly2(db);
+    throw error;
+  } finally {
+    activeDeferredReadTransactions.delete(db);
+  }
+}
 function rollbackQuietly2(db) {
   try {
     db.run("ROLLBACK");
@@ -4388,7 +4739,6 @@ function rowToRunRecord(row) {
     id: row.id,
     projectId: row.project_id,
     executionId: row.execution_id,
-    requesterGroupIds: JSON.parse(row.requester_group_ids),
     status: row.status,
     modelId: row.model_id ?? undefined,
     finishReason: coerceAgentRunFinishReason(row.finish_reason),
@@ -4602,6 +4952,9 @@ import {
 function isUniqueConstraintError2(error) {
   return error instanceof Error && error.message.includes("UNIQUE constraint failed");
 }
+function isForeignKeyConstraintError(error) {
+  return error instanceof Error && error.message.includes("FOREIGN KEY constraint failed");
+}
 
 // src/agents/messages.ts
 class SqliteAgentMessageStore {
@@ -4731,7 +5084,6 @@ import {
   assertSubagentRunResult,
   subagentRunMatchesCreateInput
 } from "@sixb/core/internal/agent-run-storage-provider";
-import { normalizeRequesterGroupIds } from "@sixb/core/internal/auth";
 import { serializeSixbFailure } from "@sixb/core/internal/errors";
 import {
   AGENT_RUN_FAILURE_CODES as AGENT_RUN_FAILURE_CODES2,
@@ -4826,12 +5178,11 @@ class SqliteAgentRunStore {
               thread_id,
               trigger_message_id,
               spec,
-              requester_group_ids,
               status,
               attempt,
               created_at
-            ) VALUES (?, ?, ?, 'conversation', ?, ?, ?, ?, 'queued', 0, ?)
-          `).run(input.projectId, input.id, input.executionId, input.threadId, input.triggerMessageId, JSON.stringify(input.spec), JSON.stringify(normalizeRequesterGroupIds(input.requesterGroupIds)), createdAt.toISOString());
+            ) VALUES (?, ?, ?, 'conversation', ?, ?, ?, 'queued', 0, ?)
+          `).run(input.projectId, input.id, input.executionId, input.threadId, input.triggerMessageId, JSON.stringify(input.spec), createdAt.toISOString());
       } catch (error) {
         if (isUniqueConstraintError2(error)) {
           throw new AgentStorageError3("duplicate_id", `[SixbSqlite] Agent run '${input.id}' already exists for project '${input.projectId}'.`);
@@ -4884,9 +5235,9 @@ class SqliteAgentRunStore {
         this.db.query(`
             INSERT INTO agent_runs (
               project_id, id, execution_id, kind, parent_run_id, spawn_key, spec,
-              requester_group_ids, status, attempt, created_at
-            ) VALUES (?, ?, ?, 'subagent', ?, ?, ?, ?, 'queued', 0, ?)
-          `).run(input.projectId, input.id, input.executionId, input.parentRunId, input.spawnKey, JSON.stringify(input.spec), parentRow.requester_group_ids, (input.createdAt ?? new Date).toISOString());
+              status, attempt, created_at
+            ) VALUES (?, ?, ?, 'subagent', ?, ?, ?, 'queued', 0, ?)
+          `).run(input.projectId, input.id, input.executionId, input.parentRunId, input.spawnKey, JSON.stringify(input.spec), (input.createdAt ?? new Date).toISOString());
       } catch (error) {
         if (isUniqueConstraintError2(error)) {
           throw new AgentStorageError3("duplicate_id", `[SixbSqlite] Subagent run '${input.id}' conflicts with an existing durable spawn.`);
@@ -5174,6 +5525,7 @@ import {
   aiModelCallCostDetails,
   aiModelCallCostMatchesUsage,
   buildAiAccountingOverviewFromFragments,
+  directModelCallAttribution,
   normalizeAiAccountingQuery,
   normalizeAiModelCallAccountingQuery as normalizeAiModelCallAccountingQuery2,
   normalizeAiModelCallCostRecord,
@@ -5214,6 +5566,7 @@ WITH filtered AS (
   SELECT COALESCE(root_agent.execution_id, usage.execution_id) AS root_execution_id,
     usage.execution_id, usage.provider_id, usage.requested_model_id, usage.occurred_at,
     usage.total_tokens,
+    execution.executor_kind, execution.executor_id, execution.authority_primitive_id AS primitive_id,
     COALESCE(cost.status, 'unvalued') AS valuation_status,
     cost.currency AS amount_currency, cost.amount_nanos,
     root_agent.id AS root_agent_run_id,
@@ -5226,6 +5579,7 @@ WITH filtered AS (
     workflow_node.workflow_id AS workflow_id,
     workflow_node.workflow_run_id AS workflow_run_id
   FROM ai_model_call_usage AS usage
+  JOIN executions AS execution ON execution.project_id = usage.project_id AND execution.id = usage.execution_id
   LEFT JOIN agent_runs AS direct_agent
     ON direct_agent.project_id = usage.project_id AND direct_agent.execution_id = usage.execution_id
   LEFT JOIN agent_runs AS root_agent
@@ -5263,6 +5617,7 @@ SELECT filtered.root_execution_id, execution_id, provider_id, requested_model_id
   CAST(SUM((amount_nanos / 1000000) % 1000000) AS TEXT) AS amount_middle,
   CAST(SUM(amount_nanos % 1000000) AS TEXT) AS amount_low,
   MAX(root_agent_run_id) AS root_agent_run_id,
+  MAX(executor_kind) AS executor_kind, MAX(executor_id) AS executor_id, MAX(primitive_id) AS primitive_id,
   MAX(root_thread_id) AS root_thread_id,
   MAX(direct_kind) AS direct_kind,
   MAX(direct_run_id) AS direct_run_id,
@@ -5277,12 +5632,11 @@ GROUP BY filtered.root_execution_id, execution_id, provider_id, requested_model_
 `;
 
 // src/ai-usage-storage.ts
+import { assertAiUsageExecutionId, normalizeAiModelCallRecord } from "@sixb/core/internal/storage";
 import { isModelReasoning, normalizeModelProviderIds } from "@sixb/core/models";
 import {
   AiUsageStorageError,
-  aggregateAiModelCallUsage,
-  assertAiUsageExecutionId,
-  normalizeAiModelCallRecord
+  aggregateAiModelCallUsage
 } from "@sixb/core/storage";
 class SqliteAiUsageStorage {
   connection;
@@ -5605,6 +5959,7 @@ var SQLITE_ACCOUNTING_LIST_PAGE_SQL = `
     workflow_agent.node_run_id AS attribution_node_run_id,
     workflow_node.workflow_id AS attribution_workflow_id,
     workflow_node.workflow_run_id AS attribution_workflow_run_id,
+    execution.executor_kind, execution.executor_id, execution.authority_primitive_id AS primitive_id,
     COALESCE((
       SELECT json_group_array(group_id) FROM (
         SELECT group_id FROM ai_model_call_usage_groups
@@ -5621,6 +5976,7 @@ var SQLITE_ACCOUNTING_LIST_PAGE_SQL = `
     cost.details AS cost_details,
     cost.rated_at AS cost_rated_at
   FROM ai_model_call_usage AS usage
+  JOIN executions AS execution ON execution.project_id = usage.project_id AND execution.id = usage.execution_id
   LEFT JOIN agent_runs AS direct_agent
     ON direct_agent.project_id = usage.project_id
     AND direct_agent.execution_id = usage.execution_id
@@ -5655,7 +6011,9 @@ var SQLITE_ACCOUNTING_OVERVIEW_SQL = `
         ELSE NULL
       END AS attribution_agent_kind,
       workflow_node.node_id AS attribution_agent_step_id,
-      workflow_node.workflow_id AS attribution_workflow_id,
+      COALESCE(workflow_node.workflow_id,
+        CASE WHEN execution.executor_kind = 'workflow' THEN execution.authority_primitive_id END
+      ) AS attribution_workflow_id,
       CASE
         WHEN cost.status = 'rated' THEN 'rated'
         WHEN cost.status = 'unpriceable' THEN 'unpriceable'
@@ -5664,6 +6022,7 @@ var SQLITE_ACCOUNTING_OVERVIEW_SQL = `
       CASE WHEN cost.status = 'rated' THEN cost.currency ELSE NULL END AS amount_currency,
       CASE WHEN cost.status = 'rated' THEN cost.amount_nanos ELSE NULL END AS amount_nanos
     FROM ai_model_call_usage AS usage
+    JOIN executions AS execution ON execution.project_id = usage.project_id AND execution.id = usage.execution_id
     LEFT JOIN agent_runs AS direct_agent
       ON direct_agent.project_id = usage.project_id
       AND direct_agent.execution_id = usage.execution_id
@@ -5795,7 +6154,7 @@ function sqliteAggregateAmount(row) {
 function accountingItemFromRow(row) {
   const usage = usageFromRow2(row, parseStringArray(row.requester_group_ids));
   const cost = row.cost_status === null ? undefined : costFromJoinedRow(row);
-  const attribution = row.attribution_kind === null ? undefined : row.attribution_kind === "agent" ? {
+  const attribution = row.attribution_kind === null ? directModelCallAttribution(row.executor_kind, row.executor_id, row.primitive_id) : row.attribution_kind === "agent" ? {
     kind: "agent",
     agentRunId: required(row.attribution_agent_run_id),
     threadId: required(row.attribution_thread_id)
@@ -7207,8 +7566,8 @@ class SqliteAuthAccessTokenStore {
 }
 function assertSubjectExists(db, projectId, subjectType, subjectId) {
   if (subjectType === "user") {
-    const row2 = db.query("SELECT * FROM auth_users WHERE project_id = ? AND id = ?").get(projectId, subjectId);
-    if (row2)
+    const row = db.query("SELECT * FROM auth_users WHERE project_id = ? AND id = ?").get(projectId, subjectId);
+    if (row)
       return;
     throw new AuthStorageError2("missing_user", `[Sixb] User '${subjectId}' not found for project '${projectId}'.`);
   }
@@ -8339,7 +8698,7 @@ class SqliteAuthStorage {
       }
       this.consumeOidcAttempt(input, completedAt, projectId);
       if (!userRow) {
-        const user2 = this.insertUser({
+        const user = this.insertUser({
           id: newUserId ?? assertNonEmpty(input.newUserId, "User id"),
           projectId,
           email,
@@ -8348,14 +8707,14 @@ class SqliteAuthStorage {
           createdAt: completedAt
         });
         userRow = {
-          project_id: user2.projectId,
-          id: user2.id,
-          email: user2.email,
-          display_name: user2.displayName ?? null,
-          avatar_url: user2.avatarUrl ?? null,
-          status: user2.status,
-          created_at: toIso(user2.createdAt),
-          updated_at: toIso(user2.updatedAt)
+          project_id: user.projectId,
+          id: user.id,
+          email: user.email,
+          display_name: user.displayName ?? null,
+          avatar_url: user.avatarUrl ?? null,
+          status: user.status,
+          created_at: toIso(user.createdAt),
+          updated_at: toIso(user.updatedAt)
         };
       }
       const user = rowToUserRecord(userRow);
@@ -9073,23 +9432,24 @@ function assertChanged(changes, label, id) {
 import {
   executionRecordFromStorageRow,
   executionRecordToStorageRow,
-  normalizeExecutionRecord,
-  validateExecutionRecordReferences
+  prepareExecutionRecord
 } from "@sixb/core/internal/execution-storage";
 import { ExecutionStorageError } from "@sixb/core/storage";
 
 class SqliteExecutionStorage {
   db;
   auth;
-  constructor(db, auth) {
+  shareSessions;
+  constructor(db, auth, shareSessions) {
     this.db = db;
     this.auth = auth;
+    this.shareSessions = shareSessions;
   }
   async create(input) {
-    const record = normalizeExecutionRecord(input);
-    await validateExecutionRecordReferences(record, {
+    const record = await prepareExecutionRecord(input, {
       auth: this.auth,
-      getExecution: (params) => this.getById(params)
+      getExecution: (params) => this.getById(params),
+      getShareSession: (params) => this.shareSessions.getById(params)
     });
     const row = executionRecordToStorageRow(record);
     try {
@@ -9103,6 +9463,7 @@ class SqliteExecutionStorage {
             source_id,
             requested_by_user_id,
             requested_by_service_account_id,
+            requester_group_ids,
             correlation_id,
             parent_execution_id,
             authority_kind,
@@ -9113,9 +9474,12 @@ class SqliteExecutionStorage {
             authority_primitive_kind,
             authority_primitive_id,
             authority_kernel_operation,
+            authority_delegation_kind,
+            authority_delegation_id,
+            authority_delegation_session_id,
             created_at
-          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-        `).run(row.projectId, row.id, row.executorKind, row.executorId, row.sourceKind, row.sourceId, row.requestedByUserId, row.requestedByServiceAccountId, row.correlationId, row.parentExecutionId, row.authorityKind, row.authorityUserId, row.authorityServiceAccountId, row.authoritySessionId, row.authorityAccessTokenId, row.authorityPrimitiveKind, row.authorityPrimitiveId, row.authorityKernelOperation, row.createdAt.toISOString());
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(row.projectId, row.id, row.executorKind, row.executorId, row.sourceKind, row.sourceId, row.requestedByUserId, row.requestedByServiceAccountId, JSON.stringify(row.requesterGroupIds), row.correlationId, row.parentExecutionId, row.authorityKind, row.authorityUserId, row.authorityServiceAccountId, row.authoritySessionId, row.authorityAccessTokenId, row.authorityPrimitiveKind, row.authorityPrimitiveId, row.authorityKernelOperation, row.authorityDelegationKind, row.authorityDelegationId, row.authorityDelegationSessionId, row.createdAt.toISOString());
     } catch (error) {
       if (isDuplicateExecutionError(error)) {
         throw new ExecutionStorageError("duplicate_execution", `[SixbSqlite] Execution '${record.id}' already exists in project '${record.projectId}'.`, { cause: error });
@@ -9143,6 +9507,7 @@ function toStorageRow(row) {
     sourceId: row.source_id,
     requestedByUserId: row.requested_by_user_id,
     requestedByServiceAccountId: row.requested_by_service_account_id,
+    requesterGroupIds: JSON.parse(row.requester_group_ids),
     correlationId: row.correlation_id,
     parentExecutionId: row.parent_execution_id,
     authorityKind: row.authority_kind,
@@ -9153,6 +9518,9 @@ function toStorageRow(row) {
     authorityPrimitiveKind: row.authority_primitive_kind,
     authorityPrimitiveId: row.authority_primitive_id,
     authorityKernelOperation: row.authority_kernel_operation,
+    authorityDelegationKind: row.authority_delegation_kind,
+    authorityDelegationId: row.authority_delegation_id,
+    authorityDelegationSessionId: row.authority_delegation_session_id,
     createdAt: new Date(row.created_at)
   };
 }
@@ -9160,56 +9528,62 @@ function isDuplicateExecutionError(error) {
   return error instanceof Error && error.message.includes("UNIQUE constraint failed: executions.project_id, executions.id");
 }
 
-// src/object-storage.ts
-import { linkBatchKey, objectBatchKey } from "@sixb/core/storage";
-
-// src/object-query-compiler.ts
+// src/objects/query-compiler.ts
 import {
   ObjectQueryExecutionError
 } from "@sixb/core";
 var PAGE_TOKEN_PREFIX = "keyset:";
-var exactContext = { probeLimit: false };
 var DEFAULT_EXPANSION_FANOUT = 1000;
 function compileObjectQuery(projectId, query, options = {}) {
-  const ctx = { probeLimit: options.includeTotal === false };
-  return compileObjectQueryInternal(projectId, query, ctx);
+  const source = options.source ?? DEFAULT_OBJECT_QUERY_SOURCE;
+  const ctx = { probeLimit: options.includeTotal === false, source };
+  return source.wrapQuery(compileObjectQueryInternal(projectId, query, ctx));
+}
+var DEFAULT_OBJECT_QUERY_SOURCE = {
+  objectsTable: "objects",
+  linksTable: "links",
+  wrapStatement: (sql, args = []) => ({ sql, args: [...args] }),
+  wrapQuery: (query) => query
+};
+function exactContext(ctx) {
+  return ctx.probeLimit ? { ...ctx, probeLimit: false } : ctx;
 }
 function compileObjectQueryInternal(projectId, query, ctx) {
   switch (query.kind) {
     case "start":
-      return compileStart(projectId, query);
+      return compileStart(projectId, query, ctx);
     case "refs":
-      return compileRefs(projectId, query);
+      return compileRefs(projectId, query, ctx);
     case "filter":
-      return compileFilter(projectId, query.input, query.predicate);
+      return compileFilter(projectId, query.input, query.predicate, ctx);
     case "sort":
       return compileSort(projectId, query.input, query.fields, ctx);
     case "limit":
       return compileLimit(projectId, query.input, query.limit, ctx);
     case "page":
-      return compilePage(projectId, query.input, query.pageSize, query.pageToken);
+      return compilePage(projectId, query.input, query.pageSize, query.pageToken, ctx);
     case "traverse":
-      return compileTraversal(projectId, query.input, query.linkId, query.direction, query.sourceObjectTypeId);
+      return compileTraversal(projectId, query.input, query.linkId, query.direction, query.sourceObjectTypeId, ctx);
     case "set":
-      return compileSet(projectId, query.op, query.inputs);
+      return compileSet(projectId, query.op, query.inputs, ctx);
     case "project":
       return compileProject(projectId, query.input, query.properties, ctx);
     case "text":
-      return compileText(projectId, query.input, query.query, query.fields, query.fieldsByObjectType);
+      return compileText(projectId, query.input, query.query, query.fields, query.fieldsByObjectType, ctx);
     case "expand":
-      return compileExpand(projectId, query.input, query.expansions);
+      return compileExpand(projectId, query.input, query.expansions, ctx);
     case "vector":
       throw new Error(`[Sixb] SQLite object storage does not support query node '${query.kind}'`);
   }
 }
-function compileStart(projectId, query) {
+function compileStart(projectId, query, ctx) {
   if (query.includeSubtypes === true) {
     throw new Error("[Sixb] SQLite object storage does not support start.includeSubtypes");
   }
   const order = compileOrder(identityOrderFields());
   const sql = `
     SELECT *, properties AS _cursor_properties
-    FROM objects
+    FROM ${ctx.source.objectsTable}
     WHERE project_id = ? AND object_type_id = ?
     ORDER BY ${order.sql}
   `;
@@ -9217,7 +9591,7 @@ function compileStart(projectId, query) {
   return {
     sql,
     args,
-    totalSql: "SELECT COUNT(*) as total FROM objects WHERE project_id = ? AND object_type_id = ?",
+    totalSql: `SELECT COUNT(*) as total FROM ${ctx.source.objectsTable} WHERE project_id = ? AND object_type_id = ?`,
     totalArgs: [projectId, query.objectTypeId],
     order,
     hasMore: () => false,
@@ -9227,7 +9601,7 @@ function compileStart(projectId, query) {
     }
   };
 }
-function compileRefs(projectId, query) {
+function compileRefs(projectId, query, ctx) {
   if (query.refs.length === 0) {
     throw new Error("[Sixb] SQLite object storage requires at least one ref");
   }
@@ -9241,10 +9615,9 @@ function compileRefs(projectId, query) {
     FROM json_each(?) AS ref
   `;
   const sql = `
-    WITH requested AS (${requested})
     SELECT selected.*, selected.properties AS _cursor_properties
-    FROM requested
-    JOIN objects AS selected
+    FROM (${requested}) AS requested
+    JOIN ${ctx.source.objectsTable} AS selected
       ON selected.project_id = ?
      AND selected.object_type_id = requested.object_type_id
      AND selected.primary_id = requested.primary_id
@@ -9254,10 +9627,9 @@ function compileRefs(projectId, query) {
     sql,
     args: [refsJson, projectId, ...selectedOrder.args],
     totalSql: `
-      WITH requested AS (${requested})
       SELECT COUNT(*) AS total
-      FROM requested
-      JOIN objects AS selected
+      FROM (${requested}) AS requested
+      JOIN ${ctx.source.objectsTable} AS selected
         ON selected.project_id = ?
        AND selected.object_type_id = requested.object_type_id
        AND selected.primary_id = requested.primary_id
@@ -9271,12 +9643,12 @@ function compileRefs(projectId, query) {
     }
   };
 }
-function compileFilter(projectId, inputQuery, predicateNode) {
+function compileFilter(projectId, inputQuery, predicateNode, ctx) {
   const predicate = compilePredicate(predicateNode);
-  return compileWhere(projectId, inputQuery, predicate);
+  return compileWhere(projectId, inputQuery, predicate, ctx);
 }
-function compileWhere(projectId, inputQuery, predicate) {
-  const input = compileObjectQueryInternal(projectId, inputQuery, exactContext);
+function compileWhere(projectId, inputQuery, predicate, ctx) {
+  const input = compileObjectQueryInternal(projectId, inputQuery, exactContext(ctx));
   const sql = `
     SELECT *
     FROM (${input.sql}) AS input
@@ -9300,15 +9672,15 @@ function compileWhere(projectId, inputQuery, predicate) {
     }
   };
 }
-function compileText(projectId, inputQuery, query, fields, fieldsByObjectType) {
+function compileText(projectId, inputQuery, query, fields, fieldsByObjectType, ctx) {
   const predicate = fields && fields.length > 0 ? compileTextPredicate(query, fields) : compileScopedTextPredicate(query, fieldsByObjectType);
   if (!predicate) {
     throw new Error("[Sixb] SQLite object text search requires fields or resolved text defaults");
   }
-  return compileWhere(projectId, inputQuery, predicate);
+  return compileWhere(projectId, inputQuery, predicate, ctx);
 }
 function compileSort(projectId, inputQuery, fields, ctx) {
-  const input = compileObjectQueryInternal(projectId, inputQuery, exactContext);
+  const input = compileObjectQueryInternal(projectId, inputQuery, exactContext(ctx));
   const probeInput = ctx.probeLimit && needsLimitProbe(inputQuery) ? compileObjectQueryInternal(projectId, inputQuery, ctx) : undefined;
   const order = compileOrder(sortOrderFields(fields));
   return {
@@ -9337,7 +9709,7 @@ function compileSort(projectId, inputQuery, fields, ctx) {
   };
 }
 function compileLimit(projectId, inputQuery, rawLimit, ctx) {
-  const input = compileObjectQueryInternal(projectId, inputQuery, exactContext);
+  const input = compileObjectQueryInternal(projectId, inputQuery, exactContext(ctx));
   const limit = Math.max(0, rawLimit);
   const rowLimit = ctx.probeLimit ? limit + 1 : limit;
   return {
@@ -9361,8 +9733,8 @@ function compileLimit(projectId, inputQuery, rawLimit, ctx) {
     }
   };
 }
-function compilePage(projectId, inputQuery, rawPageSize, pageToken) {
-  const input = compileObjectQueryInternal(projectId, inputQuery, exactContext);
+function compilePage(projectId, inputQuery, rawPageSize, pageToken, ctx) {
+  const input = compileObjectQueryInternal(projectId, inputQuery, exactContext(ctx));
   const pageSize = Math.max(0, rawPageSize);
   const cursor = pageToken ? decodePageToken(pageToken, input.order.fields) : undefined;
   const cursorPredicate = cursor ? compileKeysetPredicate(input.order.fields, cursor, input.order.propertyColumn) : undefined;
@@ -9391,27 +9763,27 @@ function compilePage(projectId, inputQuery, rawPageSize, pageToken) {
     }
   };
 }
-function compileTraversal(projectId, inputQuery, linkId, direction, sourceObjectTypeId) {
-  const input = compileObjectQueryInternal(projectId, inputQuery, exactContext);
+function compileTraversal(projectId, inputQuery, linkId, direction, sourceObjectTypeId, ctx) {
+  const input = compileObjectQueryInternal(projectId, inputQuery, exactContext(ctx));
   const outputAlias = direction === "outgoing" ? "target_object" : "source_object";
   const joinSql = direction === "outgoing" ? `
-        JOIN links AS edge
+        JOIN ${ctx.source.linksTable} AS edge
           ON edge.project_id = input.project_id
          AND edge.source_type_id = input.object_type_id
          AND edge.source_id = input.primary_id
          AND edge.link_id = ?
-        JOIN objects AS target_object
+        JOIN ${ctx.source.objectsTable} AS target_object
           ON target_object.project_id = edge.project_id
          AND target_object.object_type_id = edge.target_type_id
          AND target_object.primary_id = edge.target_id
       ` : `
-        JOIN links AS edge
+        JOIN ${ctx.source.linksTable} AS edge
           ON edge.project_id = input.project_id
          AND edge.target_type_id = input.object_type_id
          AND edge.target_id = input.primary_id
          AND edge.link_id = ?${sourceObjectTypeId === undefined ? "" : `
          AND edge.source_type_id = ?`}
-        JOIN objects AS source_object
+        JOIN ${ctx.source.objectsTable} AS source_object
           ON source_object.project_id = edge.project_id
          AND source_object.object_type_id = edge.source_type_id
          AND source_object.primary_id = edge.source_id
@@ -9443,9 +9815,9 @@ function compileTraversal(projectId, inputQuery, linkId, direction, sourceObject
     }
   };
 }
-function compileExpand(projectId, inputQuery, expansions) {
-  const input = compileObjectQueryInternal(projectId, inputQuery, exactContext);
-  const expand = compileExpansionsObject(expansions, { project: "input.project_id", type: "input.object_type_id", id: "input.primary_id" }, "");
+function compileExpand(projectId, inputQuery, expansions, ctx) {
+  const input = compileObjectQueryInternal(projectId, inputQuery, exactContext(ctx));
+  const expand = compileExpansionsObject(expansions, { project: "input.project_id", type: "input.object_type_id", id: "input.primary_id" }, "", ctx);
   const inputOrder = compileOrder(input.order.fields, "input", "input._cursor_properties");
   const sql = `
     SELECT input.*, ${expand.sql} AS _expand
@@ -9464,18 +9836,18 @@ function compileExpand(projectId, inputQuery, expansions) {
     nextPageToken: input.nextPageToken
   };
 }
-function compileExpansionsObject(expansions, parent, pathPrefix) {
+function compileExpansionsObject(expansions, parent, pathPrefix, ctx) {
   const parts = [];
   const args = [];
   expansions.forEach((expansion, index) => {
     const path = pathPrefix === "" ? `${index}` : `${pathPrefix}_${index}`;
-    const value = compileExpansionValue(expansion, parent, path);
+    const value = compileExpansionValue(expansion, parent, path, ctx);
     parts.push("?", `json(${value.sql})`);
     args.push(expansion.linkId, ...value.args);
   });
   return { sql: `json_object(${parts.join(", ")})`, args };
 }
-function compileExpansionValue(expansion, parent, path) {
+function compileExpansionValue(expansion, parent, path, ctx) {
   const edge = `edge_${path}`;
   const target = `tgt_${path}`;
   const ranked = `ranked_${path}`;
@@ -9484,7 +9856,7 @@ function compileExpansionValue(expansion, parent, path) {
   const neighborId = incoming ? `${edge}.source_id` : `${edge}.target_id`;
   const parentType = incoming ? `${edge}.target_type_id` : `${edge}.source_type_id`;
   const parentId = incoming ? `${edge}.target_id` : `${edge}.source_id`;
-  const child = compileExpansionChildJson(expansion, edge, target, path);
+  const child = compileExpansionChildJson(expansion, edge, target, path, ctx);
   const order = compileExpansionOrder(expansion, target, neighborType, neighborId);
   const whereParts = [
     `${edge}.project_id = ${parent.project}`,
@@ -9499,8 +9871,8 @@ function compileExpansionValue(expansion, parent, path) {
   }
   const inner = `
     SELECT ${child.sql} AS elem, row_number() OVER (ORDER BY ${order.sql}) AS _ord
-    FROM links AS ${edge}
-    JOIN objects AS ${target}
+    FROM ${ctx.source.linksTable} AS ${edge}
+    JOIN ${ctx.source.objectsTable} AS ${target}
       ON ${target}.project_id = ${edge}.project_id
      AND ${target}.object_type_id = ${neighborType}
      AND ${target}.primary_id = ${neighborId}
@@ -9519,7 +9891,7 @@ function compileExpansionValue(expansion, parent, path) {
     args: [...innerArgs, limit]
   };
 }
-function compileExpansionChildJson(expansion, edge, target, path) {
+function compileExpansionChildJson(expansion, edge, target, path, ctx) {
   const fields = [
     `'projectId', ${target}.project_id`,
     `'objectTypeId', ${target}.object_type_id`,
@@ -9537,7 +9909,7 @@ function compileExpansionChildJson(expansion, edge, target, path) {
       project: `${target}.project_id`,
       type: `${target}.object_type_id`,
       id: `${target}.primary_id`
-    }, path);
+    }, path, ctx);
     fields.push(`'links', ${nested.sql}`);
     args.push(...nested.args);
   }
@@ -9561,20 +9933,20 @@ function compileExpansionOrder(expansion, target, neighborType, neighborId) {
   clauses.push(`${neighborType} ASC`, `${neighborId} ASC`);
   return { sql: clauses.join(", "), args };
 }
-function compileSet(projectId, op, inputs) {
+function compileSet(projectId, op, inputs, ctx) {
   if (inputs.length === 0) {
-    const order2 = compileOrder(identityOrderFields());
+    const order = compileOrder(identityOrderFields());
     return {
       sql: `
         SELECT *
-        FROM objects
+        FROM ${ctx.source.objectsTable}
         WHERE 1 = 0
-        ORDER BY ${order2.sql}
+        ORDER BY ${order.sql}
       `,
-      args: order2.args,
+      args: order.args,
       totalSql: "SELECT 0 as total",
       totalArgs: [],
-      order: order2,
+      order,
       hasMore: () => false,
       trimRows: identityRows,
       nextPageToken: () => {
@@ -9582,14 +9954,14 @@ function compileSet(projectId, op, inputs) {
       }
     };
   }
-  const compiledInputs = inputs.map((input) => compileObjectQueryInternal(projectId, input, exactContext));
+  const compiledInputs = inputs.map((input) => compileObjectQueryInternal(projectId, input, exactContext(ctx)));
   const identities = compileSetIdentities(op, compiledInputs);
   const order = compileOrder(identityOrderFields());
   const selectedOrder = compileOrder(identityOrderFields(), "selected");
   const sql = `
     SELECT selected.*, selected.properties AS _cursor_properties
     FROM (${identities.sql}) AS ids
-    JOIN objects AS selected
+    JOIN ${ctx.source.objectsTable} AS selected
       ON selected.project_id = ?
      AND selected.object_type_id = ids.object_type_id
      AND selected.primary_id = ids.primary_id
@@ -9674,7 +10046,7 @@ function compileProjectionExpression(properties) {
     sql: `
       COALESCE(
         (
-          SELECT json_group_object(projected.key, projected.value)
+          SELECT json_group_object(projected.key, ${sqliteJsonEachValue("projected")})
           FROM json_each(input.properties) AS projected
           WHERE projected.key IN (${properties.map(() => "?").join(", ")})
         ),
@@ -9684,6 +10056,13 @@ function compileProjectionExpression(properties) {
     args: [...properties]
   };
 }
+function sqliteJsonEachValue(alias) {
+  return `CASE ${alias}.type
+    WHEN 'true' THEN json('true')
+    WHEN 'false' THEN json('false')
+    ELSE ${alias}.value
+  END`;
+}
 function compilePredicate(predicate) {
   if ("scalarKind" in predicate && predicate.scalarKind === "decimal" && (predicate.op === "lt" || predicate.op === "lte" || predicate.op === "gt" || predicate.op === "gte")) {
     throw new ObjectQueryExecutionError("exact_decimal_not_supported", "SQLite object storage cannot push down exact decimal predicates", "$.predicate");
@@ -10006,112 +10385,131 @@ function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-// src/object-storage.ts
-var SQLITE_OBJECT_QUERY_CAPABILITIES = {
-  queryObjects: true,
-  countObjects: true,
-  existsObjects: true,
-  facetObjects: true,
-  nodes: {
-    start: true,
-    refs: true,
-    filter: true,
-    text: true,
-    sort: true,
-    limit: true,
-    page: true,
-    traverse: true,
-    set: true,
-    project: true,
-    expand: true
-  },
-  predicateOps: {
-    and: true,
-    or: true,
-    not: true,
-    eq: true,
-    neq: true,
-    lt: true,
-    lte: true,
-    gt: true,
-    gte: true,
-    in: true,
-    exists: true,
-    contains: true
-  },
-  sortKinds: {
-    property: true
-  },
-  traversalDirections: {
-    outgoing: true,
-    incoming: true
-  },
-  setOps: {
-    union: true,
-    intersect: true,
-    subtract: true
-  },
-  scalarOperations: {
-    string: { equality: true, ordering: true },
-    uuid: { equality: true, ordering: true },
-    boolean: { equality: true },
-    integer: { equality: true, ordering: true },
-    double: { equality: true, ordering: true },
-    decimal: { equality: true },
-    date: { equality: true, ordering: true },
-    timestamp: { equality: true, ordering: true }
-  },
-  limits: {
-    totalCount: true,
-    stablePageTokens: true
-  },
-  notes: [
-    "SQLite object query pushdown supports start/refs/filter/text/sort/limit/page/traverse/set/project/expand over JSON properties and object links.",
-    "expand hydrates linked objects in-database (top-N per parent via row_number() + json_group_array); core resolves each expansion's cardinality before pushdown, and a mixed/unresolved one stays on the fallback.",
-    "Ordered decimal predicates and sorting use the bounded core fallback because SQLite has no native exact decimal type; canonical decimal equality remains pushdown-safe.",
-    "Relevance sorting, vector search, and unresolved start.includeSubtypes remain planner fallback or rejection cases."
-  ]
-};
+// src/objects/reader.ts
+import { linkBatchKey, objectBatchKey } from "@sixb/core/storage";
 
-class SqliteObjectStorage {
-  connection;
-  db;
-  constructor(options = {}) {
-    this.connection = openSqliteStoreConnection(options);
-    this.db = this.connection.db;
-    if (this.connection.installFreshSchema) {
-      installFreshSqliteSchema(this.db);
-    }
+// src/objects/rows.ts
+function rowToObject(row) {
+  return {
+    projectId: row.project_id,
+    objectTypeId: row.object_type_id,
+    primaryId: row.primary_id,
+    properties: JSON.parse(row.properties),
+    createdAt: new Date(row.created_at),
+    updatedAt: new Date(row.updated_at),
+    version: row.version,
+    lastCommitId: row.last_commit_id
+  };
+}
+function queryRowToObject(row) {
+  const base = rowToObject(row);
+  const links = reviveExpandedLinks(parseExpandColumn(row._expand));
+  return links ? { ...base, links } : base;
+}
+function rowToLink(row) {
+  return {
+    projectId: row.project_id,
+    sourceTypeId: row.source_type_id,
+    sourceId: row.source_id,
+    linkId: row.link_id,
+    targetTypeId: row.target_type_id,
+    targetId: row.target_id,
+    ...row.properties === null ? {} : { properties: JSON.parse(row.properties) },
+    createdAt: new Date(row.created_at),
+    updatedAt: new Date(row.updated_at),
+    lastCommitId: row.last_commit_id
+  };
+}
+function parseExpandColumn(value) {
+  if (typeof value !== "string")
+    return value ?? undefined;
+  return JSON.parse(value);
+}
+function reviveExpandedLinks(value) {
+  if (!isPlainObject2(value))
+    return;
+  const links = {};
+  for (const [linkId, raw] of Object.entries(value)) {
+    links[linkId] = reviveExpandedLinkValue(raw);
   }
-  queryCapabilities() {
-    return SQLITE_OBJECT_QUERY_CAPABILITIES;
+  return links;
+}
+function reviveExpandedLinkValue(value) {
+  if (value === null || value === undefined)
+    return null;
+  if (Array.isArray(value))
+    return value.map(reviveExpandedRow);
+  return reviveExpandedRow(value);
+}
+function reviveExpandedRow(value) {
+  const row = isPlainObject2(value) ? value : {};
+  const expanded = {
+    projectId: String(row.projectId),
+    objectTypeId: String(row.objectTypeId),
+    primaryId: String(row.primaryId),
+    properties: isPlainObject2(row.properties) ? row.properties : {},
+    createdAt: new Date(row.createdAt),
+    updatedAt: new Date(row.updatedAt),
+    version: Number(row.version),
+    lastCommitId: String(row.lastCommitId)
+  };
+  if (isPlainObject2(row.linkProperties) && Object.keys(row.linkProperties).length > 0) {
+    expanded.linkProperties = row.linkProperties;
   }
-  async queryObjects(params) {
+  const links = reviveExpandedLinks(row.links);
+  if (links)
+    expanded.links = links;
+  return expanded;
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/objects/reader.ts
+class SqliteObjectReader {
+  db;
+  source;
+  constructor(db, source) {
+    this.db = db;
+    this.source = source;
+  }
+  queryObjects(params) {
+    const source = this.source;
     const compiled = compileObjectQuery(params.projectId, params.query, {
-      includeTotal: params.includeTotal
+      includeTotal: params.includeTotal,
+      source
     });
     const total = params.includeTotal === false ? undefined : readTotal(this.db, compiled);
     const rawRows = this.db.query(compiled.sql).all(...compiled.args);
     const rows = compiled.trimRows(rawRows);
     const hasMore = total === undefined && compiled.hasMoreProbe ? compiled.hasMoreProbe.hasMore(this.db.query(compiled.hasMoreProbe.sql).all(...compiled.hasMoreProbe.args).length) : compiled.hasMore(rawRows.length, total);
     return {
-      objects: rows.map((row) => this.queryRowToObject(row)),
+      objects: rows.map((row) => queryRowToObject(row)),
       hasMore,
       nextPageToken: compiled.nextPageToken(rows, rawRows.length),
       ...total === undefined ? {} : { total }
     };
   }
-  async countObjects(params) {
+  countObjects(params) {
+    const source = this.source;
     return {
-      count: readTotal(this.db, compileObjectQuery(params.projectId, stripOuterRowShape(params.query)))
+      count: readTotal(this.db, compileObjectQuery(params.projectId, stripOuterRowShape(params.query), {
+        source
+      }))
     };
   }
-  async existsObjects(params) {
-    const compiled = compileObjectQuery(params.projectId, existsProbeQuery(params.query));
+  existsObjects(params) {
+    const source = this.source;
+    const compiled = compileObjectQuery(params.projectId, existsProbeQuery(params.query), {
+      source
+    });
     return { exists: this.db.query(compiled.sql).get(...compiled.args) !== null };
   }
-  async facetObjects(params) {
-    const compiled = compileObjectQuery(params.projectId, stripOuterRowShape(params.query));
+  facetObjects(params) {
+    const source = this.source;
+    const compiled = compileObjectQuery(params.projectId, stripOuterRowShape(params.query), {
+      source
+    });
     return {
       facets: params.facets.map((facet) => ({
         propertyId: facet.propertyId,
@@ -10119,14 +10517,43 @@ class SqliteObjectStorage {
       }))
     };
   }
-  async getByPrimaryId(params) {
-    const row = this.db.query("SELECT * FROM objects WHERE project_id = ? AND object_type_id = ? AND primary_id = ?").get(params.projectId, params.objectTypeId, params.primaryId);
-    return row ? this.rowToObject(row) : null;
+  getByPrimaryId(params) {
+    const source = this.source;
+    const objectsTable = source.objectsTable;
+    const statement = source.wrapStatement(`SELECT * FROM ${objectsTable} WHERE project_id = ? AND object_type_id = ? AND primary_id = ?`, [params.projectId, params.objectTypeId, params.primaryId]);
+    const row = this.db.query(statement.sql).get(...statement.args);
+    return row ? rowToObject(row) : null;
   }
-  async listLinks(params) {
+  selectsObjectProperties(params) {
+    const source = this.source;
+    const result = params.items.map(() => false);
+    if (params.items.length === 0)
+      return result;
+    const items = params.items.map((item, batchIndex) => ({ ...item, batchIndex }));
+    const requestedType = "CAST(json_extract(requested.value, '$.objectTypeId') AS TEXT)";
+    const requestedId = "CAST(json_extract(requested.value, '$.primaryId') AS TEXT)";
+    const requestedProperty = "CAST(json_extract(requested.value, '$.propertyId') AS TEXT)";
+    const selected = "objectPropertyPermissionsTable" in source;
+    const storedTable = selected ? source.objectPropertyPermissionsTable : source.objectsTable;
+    const propertyJoin = selected ? `AND stored.property_id = ${requestedProperty}` : "";
+    const statement = source.wrapStatement(`SELECT DISTINCT
+         CAST(json_extract(requested.value, '$.batchIndex') AS INTEGER) AS _batch_index
+       FROM ${storedTable} AS stored
+       JOIN json_each(?) AS requested
+         ON stored.object_type_id = ${requestedType}
+        AND stored.primary_id = ${requestedId}
+        ${propertyJoin}
+       WHERE stored.project_id = ?`, [JSON.stringify(items), params.projectId]);
+    const rows = this.db.query(statement.sql).all(...statement.args);
+    for (const row of rows)
+      result[row._batch_index] = true;
+    return result;
+  }
+  listLinks(params) {
+    const source = this.source;
     const direction = params.direction ?? "outgoing";
     const directionWhere = direction === "incoming" ? "target_type_id = ? AND target_id = ?" : direction === "both" ? "((source_type_id = ? AND source_id = ?) OR (target_type_id = ? AND target_id = ?))" : "source_type_id = ? AND source_id = ?";
-    let query = `SELECT * FROM links WHERE project_id = ? AND ${directionWhere}`;
+    let query = `SELECT * FROM ${source.linksTable} WHERE project_id = ? AND ${directionWhere}`;
     const args = direction === "both" ? [
       params.projectId,
       params.objectTypeId,
@@ -10138,64 +10565,104 @@ class SqliteObjectStorage {
       query += " AND link_id = ?";
       args.push(params.linkId);
     }
-    const rows = this.db.query(query).all(...args);
-    return rows.map((row) => this.rowToLink(row));
+    const statement = source.wrapStatement(query, args);
+    const rows = this.db.query(statement.sql).all(...statement.args);
+    return rows.map((row) => rowToLink(row));
   }
-  async getByPrimaryIdBatch(params) {
+  getByPrimaryIdBatch(params) {
+    const source = this.source;
     const result = new Map;
     if (params.items.length === 0)
       return result;
-    const rows = this.db.query(`
-          SELECT object.*
-          FROM json_each(?) AS requested
-          JOIN objects AS object
-            ON object.project_id = ?
-           AND object.object_type_id = json_extract(requested.value, '$.objectTypeId')
-           AND object.primary_id = json_extract(requested.value, '$.primaryId')
-        `).all(JSON.stringify(params.items), params.projectId);
-    for (const row of rows) {
-      result.set(objectBatchKey(row.object_type_id, row.primary_id), this.rowToObject(row));
+    const items = params.items.map((item, batchIndex) => ({ ...item, batchIndex }));
+    const statement = source.wrapStatement(`
+        SELECT
+          object.*,
+          CAST(json_extract(requested.value, '$.batchIndex') AS INTEGER) AS _batch_index
+        FROM json_each(?) AS requested
+        JOIN ${source.objectsTable} AS object
+          ON object.project_id = ?
+         AND object.object_type_id = json_extract(requested.value, '$.objectTypeId')
+         AND object.primary_id = json_extract(requested.value, '$.primaryId')
+      `, [JSON.stringify(items), params.projectId]);
+    const rows = this.db.query(statement.sql).all(...statement.args);
+    const rowsByIndex = new Map(rows.map((row) => [row._batch_index, row]));
+    for (const [index, item] of params.items.entries()) {
+      const row = rowsByIndex.get(index);
+      if (row)
+        result.set(objectBatchKey(item.objectTypeId, item.primaryId), rowToObject(row));
     }
     return result;
   }
-  async listLinksBatch(params) {
+  listLinksBatch(params) {
+    const source = this.source;
     const result = new Map;
     if (params.items.length === 0)
       return result;
-    const stmt = this.db.query("SELECT * FROM links WHERE project_id = ? AND source_type_id = ? AND source_id = ? AND link_id = ?");
-    for (const item of params.items) {
-      const rows = stmt.all(params.projectId, item.objectTypeId, item.objectId, item.linkId);
-      if (rows.length > 0) {
-        result.set(linkBatchKey(item.objectTypeId, item.objectId, item.linkId), rows.map((r) => this.rowToLink(r)));
+    const direction = params.direction ?? "outgoing";
+    const requestedType = "CAST(json_extract(requested.value, '$.objectTypeId') AS TEXT)";
+    const requestedId = "CAST(json_extract(requested.value, '$.objectId') AS TEXT)";
+    const requestedLink = "CAST(json_extract(requested.value, '$.linkId') AS TEXT)";
+    const outgoing = `stored.source_type_id = ${requestedType} AND stored.source_id = ${requestedId}`;
+    const incoming = `stored.target_type_id = ${requestedType} AND stored.target_id = ${requestedId}`;
+    const directionJoin = direction === "both" ? `((${outgoing}) OR (${incoming}))` : direction === "incoming" ? incoming : outgoing;
+    const items = params.items.map((item, batchIndex) => ({ ...item, batchIndex }));
+    const statement = source.wrapStatement(`
+        SELECT
+          stored.*,
+          CAST(json_extract(requested.value, '$.batchIndex') AS INTEGER) AS _batch_index
+        FROM ${source.linksTable} AS stored
+        JOIN json_each(?) AS requested
+          ON ${directionJoin}
+         AND stored.link_id = ${requestedLink}
+        WHERE stored.project_id = ?
+        ORDER BY _batch_index, source_type_id, source_id, link_id, target_type_id, target_id
+      `, [JSON.stringify(items), params.projectId]);
+    const rows = this.db.query(statement.sql).all(...statement.args);
+    const rowsByIndex = params.items.map(() => new Map);
+    for (const row of rows) {
+      const link = rowToLink(row);
+      rowsByIndex[row._batch_index]?.set(fullLinkIdentity(link), link);
+    }
+    for (const [index, item] of params.items.entries()) {
+      const links = [...rowsByIndex[index]?.values() ?? []];
+      if (links.length > 0) {
+        result.set(linkBatchKey(item.objectTypeId, item.objectId, item.linkId), links);
       }
     }
     return result;
   }
-  async queryLinks(params) {
-    assertLinkQueryLimit(params.limit);
+  queryLinks(params) {
+    const source = this.source;
     if (params.objectRefs.length === 0 || params.endpointObjectTypeIds?.length === 0) {
       return { links: [], hasMore: false };
     }
+    const requested = `
+      SELECT DISTINCT
+        json_extract(value, '$.objectTypeId') AS object_type_id,
+        json_extract(value, '$.primaryId') AS object_id
+      FROM json_each(?)
+    `;
+    const linksTable = source.linksTable;
     const sourceJoin = `
       SELECT link.*
-      FROM links AS link
-      JOIN requested
+      FROM ${linksTable} AS link
+      JOIN (${requested}) AS requested
         ON requested.object_type_id = link.source_type_id
        AND requested.object_id = link.source_id
       WHERE link.project_id = ?
     `;
     const targetJoin = `
       SELECT link.*
-      FROM links AS link
-      JOIN requested
+      FROM ${linksTable} AS link
+      JOIN (${requested}) AS requested
         ON requested.object_type_id = link.target_type_id
        AND requested.object_id = link.target_id
       WHERE link.project_id = ?
     `;
     const incidentSql = params.direction === "outgoing" ? sourceJoin : params.direction === "incoming" ? targetJoin : `${sourceJoin} UNION ${targetJoin}`;
-    const args = [JSON.stringify(params.objectRefs), params.projectId];
-    if (params.direction === "both")
-      args.push(params.projectId);
+    const requestedJson = JSON.stringify(params.objectRefs);
+    const args = params.direction === "both" ? [requestedJson, params.projectId, requestedJson, params.projectId] : [requestedJson, params.projectId];
     const predicates = [];
     if (params.linkId !== undefined) {
       predicates.push("link_id = ?");
@@ -10212,69 +10679,22 @@ class SqliteObjectStorage {
     }
     args.push(params.limit + 1);
     const whereSql = predicates.length > 0 ? `WHERE ${predicates.join(" AND ")}` : "";
-    const rows = this.db.query(`
-          WITH requested AS (
-            SELECT DISTINCT
-              json_extract(value, '$.objectTypeId') AS object_type_id,
-              json_extract(value, '$.primaryId') AS object_id
-            FROM json_each(?)
-          ), incident AS (${incidentSql})
-          SELECT *
-          FROM incident
-          ${whereSql}
-          ORDER BY source_type_id, source_id, link_id, target_type_id, target_id
-          LIMIT ?
-        `).all(...args);
+    const statement = source.wrapStatement(`
+        SELECT *
+        FROM (${incidentSql}) AS incident
+        ${whereSql}
+        ORDER BY source_type_id, source_id, link_id, target_type_id, target_id
+        LIMIT ?
+      `, args);
+    const rows = this.db.query(statement.sql).all(...statement.args);
     return {
-      links: rows.slice(0, params.limit).map((row) => this.rowToLink(row)),
+      links: rows.slice(0, params.limit).map((row) => rowToLink(row)),
       hasMore: rows.length > params.limit
     };
   }
-  async listIncidentLinksBatch(params) {
-    if (params.items.length === 0)
-      return [];
-    const rows = this.db.query(`
-          WITH requested AS (
-            SELECT
-              json_extract(value, '$.objectTypeId') AS object_type_id,
-              json_extract(value, '$.objectId') AS object_id
-            FROM json_each(?)
-          )
-          SELECT link.*
-          FROM links AS link
-          JOIN requested
-            ON requested.object_type_id = link.source_type_id
-           AND requested.object_id = link.source_id
-          WHERE link.project_id = ?
-          UNION
-          SELECT link.*
-          FROM links AS link
-          JOIN requested
-            ON requested.object_type_id = link.target_type_id
-           AND requested.object_id = link.target_id
-          WHERE link.project_id = ?
-        `).all(JSON.stringify(params.items), params.projectId, params.projectId);
-    return rows.map((row) => this.rowToLink(row));
-  }
-  async listByPrimaryIdPage(params) {
-    assertReconciliationPageLimit(params.limit);
-    const rows = this.db.query(`
-          SELECT * FROM objects
-          WHERE project_id = ? AND object_type_id = ?
-            AND (? IS NULL OR primary_id > ?)
-          ORDER BY primary_id ASC
-          LIMIT ?
-        `).all(params.projectId, params.objectTypeId, params.afterPrimaryId ?? null, params.afterPrimaryId ?? null, params.limit + 1);
-    const hasMore = rows.length > params.limit;
-    const objects = rows.slice(0, params.limit).map((row) => this.rowToObject(row));
-    const last = objects.at(-1);
-    return {
-      objects,
-      ...hasMore && last ? { nextPrimaryId: last.primaryId } : {}
-    };
-  }
-  async list(params) {
-    let query = "SELECT * FROM objects WHERE project_id = ?";
+  list(params) {
+    const source = this.source;
+    let query = `SELECT * FROM ${source.objectsTable} WHERE project_id = ?`;
     const args = [params.projectId];
     if (params.objectTypeId) {
       if (typeof params.objectTypeId === "string") {
@@ -10309,7 +10729,8 @@ class SqliteObjectStorage {
       query += " AND created_at <= ?";
       args.push(params.createdBefore.toISOString());
     }
-    const countResult = this.db.query(`SELECT COUNT(*) as total FROM (${query})`).get(...args);
+    const countStatement = source.wrapStatement(`SELECT COUNT(*) as total FROM (${query}) AS filtered_objects`, args);
+    const countResult = this.db.query(countStatement.sql).get(...countStatement.args);
     const total = countResult.total;
     const offset = params.offset ?? 0;
     const limit = params.limit ?? 50;
@@ -10321,42 +10742,605 @@ class SqliteObjectStorage {
     query += ` ORDER BY ${orderColumn} ${order.toUpperCase()}`;
     query += " LIMIT ? OFFSET ?";
     args.push(limit + 1, offset);
-    const rows = this.db.query(query).all(...args);
+    const rowsStatement = source.wrapStatement(query, args);
+    const rows = this.db.query(rowsStatement.sql).all(...rowsStatement.args);
     const hasMore = rows.length > limit;
-    const objects = rows.slice(0, limit).map((row) => this.rowToObject(row));
+    const objects = rows.slice(0, limit).map((row) => rowToObject(row));
     return { objects, hasMore, total };
   }
-  rowToObject(row) {
-    return {
-      projectId: row.project_id,
-      objectTypeId: row.object_type_id,
-      primaryId: row.primary_id,
-      properties: JSON.parse(row.properties),
-      createdAt: new Date(row.created_at),
-      updatedAt: new Date(row.updated_at),
-      version: row.version,
-      lastCommitId: row.last_commit_id
-    };
+}
+function fullLinkIdentity(link) {
+  return JSON.stringify([
+    link.sourceTypeId,
+    link.sourceId,
+    link.linkId,
+    link.targetTypeId,
+    link.targetId
+  ]);
+}
+function assertLinkQueryLimit(limit) {
+  if (!Number.isSafeInteger(limit) || limit <= 0) {
+    throw new Error("Object link query limit must be a positive safe integer.");
+  }
+}
+function readTotal(db, compiled) {
+  const row = db.query(compiled.totalSql).get(...compiled.totalArgs);
+  return row.total;
+}
+function readFacetBuckets(db, compiled, facet) {
+  const path = sqliteJsonPath(facet.propertyId);
+  const rows = db.query(`
+      SELECT
+        json_type(input.properties, ?) AS value_type,
+        json_extract(input.properties, ?) AS value,
+        COUNT(*) AS count
+      FROM (${compiled.sql}) AS input
+      WHERE json_type(input.properties, ?) IS NOT NULL
+      GROUP BY value_type, value
+      ORDER BY count DESC, CAST(value AS TEXT) ASC
+      LIMIT ?
+    `).all(path, path, ...compiled.args, path, facet.limit);
+  return rows.map((row) => ({
+    value: sqliteFacetValue(row.value_type, row.value),
+    count: Number(row.count)
+  }));
+}
+function sqliteJsonPath(propertyId) {
+  return `$."${propertyId.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function sqliteFacetValue(valueType, value) {
+  if (valueType === "true")
+    return true;
+  if (valueType === "false")
+    return false;
+  if (valueType === "null")
+    return null;
+  return value;
+}
+function existsProbeQuery(query) {
+  return { kind: "limit", limit: 1, input: stripOuterRowShape(query) };
+}
+function stripOuterRowShape(query) {
+  switch (query.kind) {
+    case "limit":
+    case "page":
+    case "project":
+    case "sort":
+      return stripOuterRowShape(query.input);
+    default:
+      return query;
+  }
+}
+
+// src/objects/selected-reader.ts
+import {
+  assertObjectReaderProject,
+  assertObjectReadFacetCount,
+  assertObjectReadOutputWithinLimit,
+  ObjectReadLimitExceededError,
+  snapshotObjectReadExecutionLimits
+} from "@sixb/core/storage";
+
+// src/objects/read-scope.ts
+function compileSqliteSelectedObjectReadSource(projectId, scope, maxTraversalFacts) {
+  const scopeJson = JSON.stringify({
+    roots: scope.roots,
+    objects: scope.objects,
+    steps: scope.steps
+  });
+  const compiled = compileSelectedReadScopeCte(scopeJson, projectId);
+  const wrapStatement = (sql, args = []) => ({
+    sql: `${compiled.sql}
+${sql}`,
+    args: [...compiled.args, ...args]
+  });
+  return Object.freeze({
+    objectsTable: "_sixb_scope_objects",
+    linksTable: "_sixb_scope_links",
+    objectPropertyPermissionsTable: "_sixb_scope_object_permissions",
+    wrapStatement,
+    wrapQuery: (query) => ({
+      ...query,
+      ...wrapStatement(query.sql, query.args),
+      totalSql: `${compiled.sql}
+${query.totalSql}`,
+      totalArgs: [...compiled.args, ...query.totalArgs],
+      ...query.hasMoreProbe ? {
+        hasMoreProbe: {
+          ...query.hasMoreProbe,
+          ...wrapStatement(query.hasMoreProbe.sql, query.hasMoreProbe.args)
+        }
+      } : {}
+    }),
+    traversalProbe: wrapStatement(`
+        SELECT COUNT(*) AS total
+        FROM (
+          SELECT 1 AS traversal_fact
+          FROM _sixb_scope_root_facts
+
+          UNION ALL
+
+          SELECT 1 AS traversal_fact
+          FROM _sixb_scope_reached_links
+
+          LIMIT ?
+        ) AS bounded_traversal_facts
+      `, [BigInt(maxTraversalFacts) + 1n])
+  });
+}
+function compileSelectedReadScopeCte(scopeJson, projectId) {
+  return {
+    sql: `
+      WITH RECURSIVE
+      _sixb_scope_document(scope) AS (
+        SELECT json(?)
+      ),
+      _sixb_scope_roots(root_id, node_id, object_type_id, primary_id) AS (
+        SELECT
+          CAST(root.key AS INTEGER),
+          CAST(json_extract(root.value, '$.nodeId') AS INTEGER),
+          CAST(json_extract(root.value, '$.objectTypeId') AS TEXT),
+          CAST(json_extract(root.value, '$.primaryId') AS TEXT)
+        FROM _sixb_scope_document AS document,
+             json_each(json_extract(document.scope, '$.roots')) AS root
+      ),
+      _sixb_scope_root_facts(project_id, root_id, node_id, object_type_id, primary_id) AS (
+        SELECT anchor.project_id, root.root_id, root.node_id, root.object_type_id, root.primary_id
+        FROM _sixb_scope_roots AS root
+        JOIN objects AS anchor
+          ON anchor.project_id = ?
+         AND anchor.object_type_id = root.object_type_id
+         AND anchor.primary_id = root.primary_id
+      ),
+      _sixb_scope_object_selections(node_id, object_type_id, property_ids) AS (
+        SELECT
+          CAST(json_extract(selection.value, '$.nodeId') AS INTEGER),
+          CAST(json_extract(selection.value, '$.objectTypeId') AS TEXT),
+          json_extract(selection.value, '$.propertyIds')
+        FROM _sixb_scope_document AS document,
+             json_each(json_extract(document.scope, '$.objects')) AS selection
+      ),
+      _sixb_scope_link_selections(
+        step_id,
+        node_id,
+        parent_node_id,
+        source_object_type_id,
+        link_id,
+        target_object_type_id,
+        property_ids
+      ) AS (
+        SELECT
+          CAST(step.key AS INTEGER),
+          CAST(json_extract(step.value, '$.nodeId') AS INTEGER),
+          CAST(json_extract(step.value, '$.parentNodeId') AS INTEGER),
+          CAST(json_extract(step.value, '$.sourceObjectTypeId') AS TEXT),
+          CAST(json_extract(step.value, '$.linkId') AS TEXT),
+          CAST(json_extract(step.value, '$.targetObjectTypeId') AS TEXT),
+          json_extract(step.value, '$.propertyIds')
+        FROM _sixb_scope_document AS document,
+             json_each(json_extract(document.scope, '$.steps')) AS step
+      ),
+      _sixb_scope_reachable(project_id, node_id, object_type_id, primary_id) AS (
+        SELECT root.project_id, root.node_id, root.object_type_id, root.primary_id
+        FROM _sixb_scope_root_facts AS root
+
+        UNION
+
+        SELECT edge.project_id, selection.node_id, edge.target_type_id, edge.target_id
+        FROM _sixb_scope_reachable AS parent
+        JOIN _sixb_scope_link_selections AS selection
+          ON selection.parent_node_id = parent.node_id
+         AND selection.source_object_type_id = parent.object_type_id
+        JOIN links AS edge
+          ON edge.project_id = parent.project_id
+         AND edge.source_type_id = parent.object_type_id
+         AND edge.source_id = parent.primary_id
+         AND edge.link_id = selection.link_id
+         AND edge.target_type_id = selection.target_object_type_id
+        JOIN objects AS target
+          ON target.project_id = edge.project_id
+         AND target.object_type_id = edge.target_type_id
+         AND target.primary_id = edge.target_id
+      ),
+      _sixb_scope_object_permissions(project_id, object_type_id, primary_id, property_id) AS (
+        SELECT DISTINCT
+          reachable.project_id,
+          reachable.object_type_id,
+          reachable.primary_id,
+          CAST(selected_property.value AS TEXT)
+        FROM _sixb_scope_reachable AS reachable
+        JOIN _sixb_scope_object_selections AS selection
+          ON selection.node_id = reachable.node_id
+         AND selection.object_type_id = reachable.object_type_id
+        JOIN json_each(selection.property_ids) AS selected_property
+      ),
+      _sixb_scope_object_ids(project_id, object_type_id, primary_id) AS (
+        SELECT DISTINCT project_id, object_type_id, primary_id
+        FROM _sixb_scope_reachable
+      ),
+      _sixb_scope_objects AS (
+        SELECT
+          stored.project_id,
+          stored.object_type_id,
+          stored.primary_id,
+          COALESCE(
+            (
+              SELECT json_group_object(property.key, ${sqliteJsonEachValue("property")})
+              FROM json_each(stored.properties) AS property
+              JOIN _sixb_scope_object_permissions AS permission
+                ON permission.project_id = stored.project_id
+               AND permission.object_type_id = stored.object_type_id
+               AND permission.primary_id = stored.primary_id
+               AND permission.property_id = property.key
+            ),
+            json('{}')
+          ) AS properties,
+          stored.created_at,
+          stored.updated_at,
+          stored.version,
+          stored.last_commit_id
+        FROM objects AS stored
+        JOIN _sixb_scope_object_ids AS visible
+          ON visible.project_id = stored.project_id
+         AND visible.object_type_id = stored.object_type_id
+         AND visible.primary_id = stored.primary_id
+      ),
+      _sixb_scope_reached_links(
+        project_id,
+        step_id,
+        node_id,
+        parent_node_id,
+        source_type_id,
+        source_id,
+        link_id,
+        target_type_id,
+        target_id,
+        property_ids
+      ) AS (
+        SELECT
+          edge.project_id,
+          selection.step_id,
+          selection.node_id,
+          selection.parent_node_id,
+          edge.source_type_id,
+          edge.source_id,
+          edge.link_id,
+          edge.target_type_id,
+          edge.target_id,
+          selection.property_ids
+        FROM _sixb_scope_reachable AS parent
+        JOIN _sixb_scope_link_selections AS selection
+          ON selection.parent_node_id = parent.node_id
+         AND selection.source_object_type_id = parent.object_type_id
+        JOIN links AS edge
+          ON edge.project_id = parent.project_id
+         AND edge.source_type_id = parent.object_type_id
+         AND edge.source_id = parent.primary_id
+         AND edge.link_id = selection.link_id
+         AND edge.target_type_id = selection.target_object_type_id
+        JOIN objects AS target
+          ON target.project_id = edge.project_id
+         AND target.object_type_id = edge.target_type_id
+         AND target.primary_id = edge.target_id
+      ),
+      _sixb_scope_link_permissions(
+        project_id,
+        source_type_id,
+        source_id,
+        link_id,
+        target_type_id,
+        target_id,
+        property_id
+      ) AS (
+        SELECT DISTINCT
+          reached.project_id,
+          reached.source_type_id,
+          reached.source_id,
+          reached.link_id,
+          reached.target_type_id,
+          reached.target_id,
+          CAST(selected_property.value AS TEXT)
+        FROM _sixb_scope_reached_links AS reached
+        JOIN json_each(reached.property_ids) AS selected_property
+      ),
+      _sixb_scope_link_ids(
+        project_id,
+        source_type_id,
+        source_id,
+        link_id,
+        target_type_id,
+        target_id
+      ) AS (
+        SELECT DISTINCT
+          project_id,
+          source_type_id,
+          source_id,
+          link_id,
+          target_type_id,
+          target_id
+        FROM _sixb_scope_reached_links
+      ),
+      _sixb_scope_links AS (
+        SELECT
+          stored.project_id,
+          stored.source_type_id,
+          stored.source_id,
+          stored.link_id,
+          stored.target_type_id,
+          stored.target_id,
+          CASE
+            WHEN stored.properties IS NULL THEN NULL
+            ELSE NULLIF(
+              (
+                SELECT json_group_object(property.key, ${sqliteJsonEachValue("property")})
+                FROM json_each(stored.properties) AS property
+                JOIN _sixb_scope_link_permissions AS permission
+                  ON permission.project_id = stored.project_id
+                 AND permission.source_type_id = stored.source_type_id
+                 AND permission.source_id = stored.source_id
+                 AND permission.link_id = stored.link_id
+                 AND permission.target_type_id = stored.target_type_id
+                 AND permission.target_id = stored.target_id
+                 AND permission.property_id = property.key
+              ),
+              json('{}')
+            )
+          END AS properties,
+          stored.created_at,
+          stored.updated_at,
+          stored.last_commit_id
+        FROM links AS stored
+        JOIN _sixb_scope_link_ids AS visible
+          ON visible.project_id = stored.project_id
+         AND visible.source_type_id = stored.source_type_id
+         AND visible.source_id = stored.source_id
+         AND visible.link_id = stored.link_id
+         AND visible.target_type_id = stored.target_type_id
+         AND visible.target_id = stored.target_id
+      )
+    `,
+    args: [scopeJson, projectId]
+  };
+}
+
+// src/objects/selected-reader.ts
+function createSqliteSelectedReader(db, params, queryCapabilities) {
+  const projectId = params.projectId;
+  const limits = snapshotObjectReadExecutionLimits(params.limits);
+  const source = compileSqliteSelectedObjectReadSource(projectId, params.scope, limits.maxTraversalFacts);
+  const reader = new SqliteObjectReader(db, source);
+  const assertProject = (actualProjectId) => assertObjectReaderProject(projectId, actualProjectId);
+  const read = (run) => runDeferredReadTransaction(db, () => {
+    assertTraversalBudget(db, source, limits.maxTraversalFacts);
+    const value = run();
+    assertObjectReadOutputWithinLimit(value, limits);
+    return value;
+  });
+  const readMap = (run) => runDeferredReadTransaction(db, () => {
+    assertTraversalBudget(db, source, limits.maxTraversalFacts);
+    const value = run();
+    assertObjectReadOutputWithinLimit([...value.entries()], limits);
+    return value;
+  });
+  return Object.freeze({
+    queryCapabilities,
+    queryObjects: async (input) => {
+      assertProject(input.projectId);
+      return read(() => reader.queryObjects(input));
+    },
+    countObjects: async (input) => {
+      assertProject(input.projectId);
+      return read(() => reader.countObjects(input));
+    },
+    existsObjects: async (input) => {
+      assertProject(input.projectId);
+      return read(() => reader.existsObjects(input));
+    },
+    facetObjects: async (input) => {
+      assertProject(input.projectId);
+      assertObjectReadFacetCount(input.facets.length);
+      return read(() => reader.facetObjects(input));
+    },
+    getByPrimaryId: async (input) => {
+      assertProject(input.projectId);
+      return read(() => reader.getByPrimaryId(input));
+    },
+    selectsObjectProperties: async (input) => {
+      assertProject(input.projectId);
+      return read(() => reader.selectsObjectProperties(input));
+    },
+    listLinks: async (input) => {
+      assertProject(input.projectId);
+      return read(() => reader.listLinks(input));
+    },
+    getByPrimaryIdBatch: async (input) => {
+      assertProject(input.projectId);
+      return readMap(() => reader.getByPrimaryIdBatch(input));
+    },
+    listLinksBatch: async (input) => {
+      assertProject(input.projectId);
+      return readMap(() => reader.listLinksBatch(input));
+    },
+    queryLinks: async (input) => {
+      assertProject(input.projectId);
+      assertLinkQueryLimit(input.limit);
+      return read(() => reader.queryLinks(input));
+    },
+    list: async (input) => {
+      assertProject(input.projectId);
+      return read(() => reader.list(input));
+    }
+  });
+}
+function assertTraversalBudget(db, source, maxTraversalFacts) {
+  const row = db.query(source.traversalProbe.sql).get(...source.traversalProbe.args);
+  if (BigInt(row.total) > BigInt(maxTraversalFacts)) {
+    throw new ObjectReadLimitExceededError("traversalFacts", maxTraversalFacts);
+  }
+}
+
+// src/objects/storage.ts
+var SQLITE_OBJECT_QUERY_CAPABILITIES = {
+  queryObjects: true,
+  countObjects: true,
+  existsObjects: true,
+  facetObjects: true,
+  nodes: {
+    start: true,
+    refs: true,
+    filter: true,
+    text: true,
+    sort: true,
+    limit: true,
+    page: true,
+    traverse: true,
+    set: true,
+    project: true,
+    expand: true
+  },
+  predicateOps: {
+    and: true,
+    or: true,
+    not: true,
+    eq: true,
+    neq: true,
+    lt: true,
+    lte: true,
+    gt: true,
+    gte: true,
+    in: true,
+    exists: true,
+    contains: true
+  },
+  sortKinds: {
+    property: true
+  },
+  traversalDirections: {
+    outgoing: true,
+    incoming: true
+  },
+  setOps: {
+    union: true,
+    intersect: true,
+    subtract: true
+  },
+  scalarOperations: {
+    string: { equality: true, ordering: true },
+    uuid: { equality: true, ordering: true },
+    boolean: { equality: true },
+    integer: { equality: true, ordering: true },
+    double: { equality: true, ordering: true },
+    decimal: { equality: true },
+    date: { equality: true, ordering: true },
+    timestamp: { equality: true, ordering: true }
+  },
+  limits: {
+    totalCount: true,
+    stablePageTokens: true
+  },
+  notes: [
+    "SQLite object query pushdown supports start/refs/filter/text/sort/limit/page/traverse/set/project/expand over JSON properties and object links.",
+    "expand hydrates linked objects in-database (top-N per parent via row_number() + json_group_array); core resolves each expansion's cardinality before pushdown, and a mixed/unresolved one stays on the fallback.",
+    "Ordered decimal predicates and sorting use the bounded core fallback because SQLite has no native exact decimal type; canonical decimal equality remains pushdown-safe.",
+    "Relevance sorting, vector search, and unresolved start.includeSubtypes remain planner fallback or rejection cases."
+  ]
+};
+
+class SqliteObjectStorage {
+  connection;
+  db;
+  reader;
+  constructor(options = {}) {
+    this.connection = openSqliteStoreConnection(options);
+    this.db = this.connection.db;
+    this.reader = new SqliteObjectReader(this.db, DEFAULT_OBJECT_QUERY_SOURCE);
+    if (this.connection.installFreshSchema) {
+      installFreshSqliteSchema(this.db);
+    }
+  }
+  queryCapabilities() {
+    return SQLITE_OBJECT_QUERY_CAPABILITIES;
+  }
+  createSelectedReadScope(params) {
+    return createSqliteSelectedReader(this.db, params, () => this.queryCapabilities());
+  }
+  async queryObjects(params) {
+    return this.reader.queryObjects(params);
+  }
+  async countObjects(params) {
+    return this.reader.countObjects(params);
+  }
+  async existsObjects(params) {
+    return this.reader.existsObjects(params);
+  }
+  async facetObjects(params) {
+    return this.reader.facetObjects(params);
+  }
+  async getByPrimaryId(params) {
+    return this.reader.getByPrimaryId(params);
+  }
+  async selectsObjectProperties(params) {
+    return this.reader.selectsObjectProperties(params);
+  }
+  async listLinks(params) {
+    return this.reader.listLinks(params);
+  }
+  async getByPrimaryIdBatch(params) {
+    return this.reader.getByPrimaryIdBatch(params);
+  }
+  async listLinksBatch(params) {
+    return this.reader.listLinksBatch(params);
+  }
+  async queryLinks(params) {
+    assertLinkQueryLimit(params.limit);
+    return this.reader.queryLinks(params);
   }
-  queryRowToObject(row) {
-    const base = this.rowToObject(row);
-    const links = reviveExpandedLinks(parseExpandColumn(row._expand));
-    return links ? { ...base, links } : base;
+  async listIncidentLinksBatch(params) {
+    if (params.items.length === 0)
+      return [];
+    const rows = this.db.query(`
+          WITH requested AS (
+            SELECT
+              json_extract(value, '$.objectTypeId') AS object_type_id,
+              json_extract(value, '$.objectId') AS object_id
+            FROM json_each(?)
+          )
+          SELECT link.*
+          FROM links AS link
+          JOIN requested
+            ON requested.object_type_id = link.source_type_id
+           AND requested.object_id = link.source_id
+          WHERE link.project_id = ?
+          UNION
+          SELECT link.*
+          FROM links AS link
+          JOIN requested
+            ON requested.object_type_id = link.target_type_id
+           AND requested.object_id = link.target_id
+          WHERE link.project_id = ?
+        `).all(JSON.stringify(params.items), params.projectId, params.projectId);
+    return rows.map((row) => rowToLink(row));
   }
-  rowToLink(row) {
+  async listByPrimaryIdPage(params) {
+    assertReconciliationPageLimit(params.limit);
+    const rows = this.db.query(`
+          SELECT * FROM objects
+          WHERE project_id = ? AND object_type_id = ?
+            AND (? IS NULL OR primary_id > ?)
+          ORDER BY primary_id ASC
+          LIMIT ?
+        `).all(params.projectId, params.objectTypeId, params.afterPrimaryId ?? null, params.afterPrimaryId ?? null, params.limit + 1);
+    const hasMore = rows.length > params.limit;
+    const objects = rows.slice(0, params.limit).map((row) => rowToObject(row));
+    const last = objects.at(-1);
     return {
-      projectId: row.project_id,
-      sourceTypeId: row.source_type_id,
-      sourceId: row.source_id,
-      linkId: row.link_id,
-      targetTypeId: row.target_type_id,
-      targetId: row.target_id,
-      properties: row.properties ? JSON.parse(row.properties) : undefined,
-      createdAt: new Date(row.created_at),
-      updatedAt: new Date(row.updated_at),
-      lastCommitId: row.last_commit_id
+      objects,
+      ...hasMore && last ? { nextPrimaryId: last.primaryId } : {}
     };
   }
+  async list(params) {
+    return this.reader.list(params);
+  }
   close() {
     closeSqliteStoreConnection(this.connection);
   }
@@ -10366,104 +11350,6 @@ function assertReconciliationPageLimit(limit) {
     throw new Error("Object reconciliation page limit must be a positive safe integer.");
   }
 }
-function assertLinkQueryLimit(limit) {
-  if (!Number.isSafeInteger(limit) || limit <= 0) {
-    throw new Error("Object link query limit must be a positive safe integer.");
-  }
-}
-function readTotal(db, compiled) {
-  const row = db.query(compiled.totalSql).get(...compiled.totalArgs);
-  return row.total;
-}
-function readFacetBuckets(db, compiled, facet) {
-  const path = sqliteJsonPath(facet.propertyId);
-  const rows = db.query(`
-      SELECT
-        json_type(input.properties, ?) AS value_type,
-        json_extract(input.properties, ?) AS value,
-        COUNT(*) AS count
-      FROM (${compiled.sql}) AS input
-      WHERE json_type(input.properties, ?) IS NOT NULL
-      GROUP BY value_type, value
-      ORDER BY count DESC, CAST(value AS TEXT) ASC
-      LIMIT ?
-    `).all(path, path, ...compiled.args, path, facet.limit);
-  return rows.map((row) => ({
-    value: sqliteFacetValue(row.value_type, row.value),
-    count: Number(row.count)
-  }));
-}
-function sqliteJsonPath(propertyId) {
-  return `$."${propertyId.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
-}
-function sqliteFacetValue(valueType, value) {
-  if (valueType === "true")
-    return true;
-  if (valueType === "false")
-    return false;
-  if (valueType === "null")
-    return null;
-  return value;
-}
-function parseExpandColumn(value) {
-  if (typeof value !== "string")
-    return value ?? undefined;
-  return JSON.parse(value);
-}
-function reviveExpandedLinks(value) {
-  if (!isPlainObject2(value))
-    return;
-  const links = {};
-  for (const [linkId, raw] of Object.entries(value)) {
-    links[linkId] = reviveExpandedLinkValue(raw);
-  }
-  return links;
-}
-function reviveExpandedLinkValue(value) {
-  if (value === null || value === undefined)
-    return null;
-  if (Array.isArray(value))
-    return value.map(reviveExpandedRow);
-  return reviveExpandedRow(value);
-}
-function reviveExpandedRow(value) {
-  const row = isPlainObject2(value) ? value : {};
-  const expanded = {
-    projectId: String(row.projectId),
-    objectTypeId: String(row.objectTypeId),
-    primaryId: String(row.primaryId),
-    properties: isPlainObject2(row.properties) ? row.properties : {},
-    createdAt: new Date(row.createdAt),
-    updatedAt: new Date(row.updatedAt),
-    version: Number(row.version),
-    lastCommitId: String(row.lastCommitId)
-  };
-  if (isPlainObject2(row.linkProperties) && Object.keys(row.linkProperties).length > 0) {
-    expanded.linkProperties = row.linkProperties;
-  }
-  const links = reviveExpandedLinks(row.links);
-  if (links)
-    expanded.links = links;
-  return expanded;
-}
-function isPlainObject2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function existsProbeQuery(query) {
-  return { kind: "limit", limit: 1, input: stripOuterRowShape(query) };
-}
-function stripOuterRowShape(query) {
-  switch (query.kind) {
-    case "limit":
-    case "page":
-    case "project":
-    case "sort":
-      return stripOuterRowShape(query.input);
-    default:
-      return query;
-  }
-}
-
 // src/ontology-storage/shared.ts
 import { parseSixbFailure as parseSixbFailure2 } from "@sixb/core/internal/errors";
 import { MaterializationConflictError } from "@sixb/core/internal/materialization";
@@ -11019,13 +11905,13 @@ class SqliteMaterializationStateReader {
           ORDER BY requested.scope_sort_key, ${linkSortExpression("links")}
         `).iterate(requestedJson, this.projectId);
     for (const row of rows) {
-      const accumulator2 = accumulators.get(row.scope_sort_key);
-      if (!accumulator2) {
+      const accumulator = accumulators.get(row.scope_sort_key);
+      if (!accumulator) {
         throw new MaterializationConflictError2("effective-state", `Unexpected link scope '${row.scope_sort_key}' returned by storage.`);
       }
       const snapshot = effectiveLinkSnapshot(row);
-      appendScopeSnapshot(accumulator2, snapshot);
-      effective.set(row.scope_sort_key, accumulator2.effectiveCount === 1 ? snapshot : null);
+      appendScopeSnapshot(accumulator, snapshot);
+      effective.set(row.scope_sort_key, accumulator.effectiveCount === 1 ? snapshot : null);
     }
     return {
       revisions: scopes.map(({ source, linkId }) => finishScopeAccumulator(accumulators.get(linkScopeSortKey(source, linkId)))),
@@ -13037,11 +13923,8 @@ class SqliteOntologyStorage {
 // src/pipeline-run-storage.ts
 import { parseSixbFailure as parseSixbFailure3, serializeSixbFailure as serializeSixbFailure3 } from "@sixb/core/internal/errors";
 import { assertPipelineRunExecution } from "@sixb/core/internal/pipeline-run-storage-provider";
-import {
-  canRequeuePipelineRunAfterEnqueueFailure,
-  PIPELINE_RUN_FAILURE_CODES,
-  PipelineRunError
-} from "@sixb/core/storage";
+import { canRequeuePipelineRunAfterEnqueueFailure } from "@sixb/core/internal/storage";
+import { PIPELINE_RUN_FAILURE_CODES, PipelineRunError } from "@sixb/core/storage";
 
 // src/latest-run-query.ts
 function queryLatestRunsByOwnerId(input) {
@@ -14069,14 +14952,263 @@ function rowToRuleStateRecord(row) {
   };
 }
 
+// src/share-grant-storage.ts
+import {
+  normalizeGetShareGrantByIdInput,
+  normalizeListShareGrantsInput,
+  normalizeRevokeShareGrantInput,
+  normalizeShareGrantCreate,
+  parseShareGrantRecord
+} from "@sixb/core/internal/share-grant-storage-provider";
+import { ShareGrantStorageError } from "@sixb/core/storage";
+class SqliteShareGrantStorage {
+  connection;
+  db;
+  constructor(options = {}) {
+    this.connection = openSqliteStoreConnection(options);
+    this.db = this.connection.db;
+    if (this.connection.installFreshSchema)
+      installFreshSqliteSchema(this.db);
+  }
+  async create(input) {
+    const record = normalizeShareGrantCreate(input);
+    try {
+      this.db.query(`
+            INSERT INTO share_grants (
+              project_id, id, definition_id, target_object_type_id, target_primary_id,
+              issued_by_type, issued_by_id, authority_version, authority_snapshot,
+              authority_digest, token_hash, destination_path, created_at, expires_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          `).run(record.projectId, record.id, record.definitionId, record.target.objectTypeId, record.target.primaryId, record.issuedBy.type, record.issuedBy.id, record.authoritySnapshot.version, JSON.stringify(record.authoritySnapshot), record.authorityDigest, record.tokenHash, record.destinationPath, record.createdAt.toISOString(), record.expiresAt.toISOString());
+    } catch (error) {
+      if (isUniqueConstraintError2(error)) {
+        throw new ShareGrantStorageError("duplicate", `[SixbSqlite] Share grant '${record.id}' conflicts with an existing record.`, { cause: error });
+      }
+      throw error;
+    }
+    return this.require(record.projectId, record.id, "create");
+  }
+  async getById(input) {
+    const normalized = normalizeGetShareGrantByIdInput(input);
+    return this.getRow(normalized.projectId, normalized.id);
+  }
+  async list(input) {
+    const normalized = normalizeListShareGrantsInput(input);
+    const where = ["project_id = ?"];
+    const args = [normalized.projectId];
+    if (normalized.definitionId !== undefined) {
+      where.push("definition_id = ?");
+      args.push(normalized.definitionId);
+    }
+    if (normalized.target !== undefined) {
+      where.push("target_object_type_id = ?", "target_primary_id = ?");
+      args.push(normalized.target.objectTypeId, normalized.target.primaryId);
+    }
+    if (!normalized.includeRevoked)
+      where.push("revoked_at IS NULL");
+    if (!normalized.includeExpired) {
+      where.push("expires_at > ?");
+      args.push(normalized.now.toISOString());
+    }
+    const predicate = where.join(" AND ");
+    const totalRow = this.db.query(`SELECT COUNT(*) AS total FROM share_grants WHERE ${predicate}`).get(...args);
+    const rows = this.db.query(`
+          SELECT * FROM share_grants
+          WHERE ${predicate}
+          ORDER BY created_at DESC, id DESC
+          LIMIT ? OFFSET ?
+        `).all(...args, normalized.limit, normalized.offset);
+    const grants = rows.map(rowToRecord);
+    return {
+      grants,
+      total: totalRow.total,
+      hasMore: normalized.offset + grants.length < totalRow.total
+    };
+  }
+  async revoke(input) {
+    const normalized = normalizeRevokeShareGrantInput(input);
+    const current = this.getRow(normalized.projectId, normalized.id);
+    if (!current || current.revokedAt)
+      return current;
+    const revocation = normalizeRevokeShareGrantInput(normalized, current.createdAt);
+    this.db.query(`
+          UPDATE share_grants
+          SET revoked_at = ?, revoked_by_type = ?, revoked_by_id = ?
+          WHERE project_id = ? AND id = ? AND revoked_at IS NULL
+        `).run(revocation.revokedAt.toISOString(), revocation.revokedBy.type, revocation.revokedBy.id, revocation.projectId, revocation.id);
+    return this.require(revocation.projectId, revocation.id, "revoke");
+  }
+  close() {
+    closeSqliteStoreConnection(this.connection);
+  }
+  getRow(projectId, id) {
+    const row = this.db.query("SELECT * FROM share_grants WHERE project_id = ? AND id = ?").get(projectId, id);
+    return row ? rowToRecord(row) : null;
+  }
+  require(projectId, id, operation) {
+    const record = this.getRow(projectId, id);
+    if (!record) {
+      throw new ShareGrantStorageError("invalid_record", `[SixbSqlite] Share grant '${id}' disappeared after ${operation}.`);
+    }
+    return record;
+  }
+}
+function rowToRecord(row) {
+  const authoritySnapshot = parseStoredJson(row.authority_snapshot, "authority snapshot");
+  if (typeof row.authority_version !== "number" || !isRecord(authoritySnapshot) || authoritySnapshot.version !== row.authority_version) {
+    throw invalidRecord("Share authority version does not match its snapshot.");
+  }
+  const hasRevokedAt = row.revoked_at !== null;
+  const hasRevokedBy = row.revoked_by_type !== null || row.revoked_by_id !== null;
+  if (hasRevokedAt !== hasRevokedBy) {
+    throw invalidRecord("Share revocation time and actor must be stored together.");
+  }
+  return parseShareGrantRecord({
+    projectId: row.project_id,
+    id: row.id,
+    definitionId: row.definition_id,
+    target: {
+      objectTypeId: row.target_object_type_id,
+      primaryId: row.target_primary_id
+    },
+    issuedBy: { type: row.issued_by_type, id: row.issued_by_id },
+    authoritySnapshot,
+    authorityDigest: row.authority_digest,
+    tokenHash: row.token_hash,
+    destinationPath: row.destination_path,
+    createdAt: row.created_at,
+    expiresAt: row.expires_at,
+    ...hasRevokedAt ? { revokedAt: row.revoked_at } : {},
+    ...hasRevokedBy ? { revokedBy: { type: row.revoked_by_type, id: row.revoked_by_id } } : {}
+  });
+}
+function parseStoredJson(value, field) {
+  if (typeof value !== "string")
+    throw invalidRecord(`Share ${field} must be stored as JSON text.`);
+  try {
+    return JSON.parse(value);
+  } catch (cause) {
+    throw new ShareGrantStorageError("invalid_record", `[SixbSqlite] Share ${field} contains invalid JSON.`, { cause });
+  }
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function invalidRecord(message) {
+  return new ShareGrantStorageError("invalid_record", `[SixbSqlite] ${message}`);
+}
+
+// src/share-session-storage.ts
+import {
+  normalizeGetShareSessionByIdInput,
+  normalizeRenewShareSessionIfValidInput,
+  normalizeRevokeShareSessionInput,
+  normalizeShareSessionCreate,
+  parseShareSessionRecord
+} from "@sixb/core/internal/share-session-storage-provider";
+import { ShareSessionStorageError } from "@sixb/core/storage";
+class SqliteShareSessionStorage {
+  connection;
+  db;
+  constructor(options = {}) {
+    this.connection = openSqliteStoreConnection(options);
+    this.db = this.connection.db;
+    if (this.connection.installFreshSchema)
+      installFreshSqliteSchema(this.db);
+  }
+  async create(input) {
+    const record = normalizeShareSessionCreate(input);
+    try {
+      const row = this.db.query(`
+            INSERT INTO share_sessions (
+              project_id, id, grant_id, token_hash, created_at, expires_at,
+              absolute_expires_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?)
+            RETURNING *
+          `).get(record.projectId, record.id, record.grantId, record.tokenHash, record.createdAt.toISOString(), record.expiresAt.toISOString(), record.absoluteExpiresAt.toISOString());
+      if (!row)
+        throw invalidRecord2(`Share session '${record.id}' disappeared after create.`);
+      return rowToRecord2(row);
+    } catch (error) {
+      if (isUniqueConstraintError2(error)) {
+        throw new ShareSessionStorageError("duplicate", `[SixbSqlite] Share session '${record.id}' conflicts with an existing record.`, { cause: error });
+      }
+      if (isForeignKeyConstraintError(error)) {
+        throw new ShareSessionStorageError("invalid_input", `[SixbSqlite] Share grant '${record.grantId}' does not exist in project '${record.projectId}'.`, { cause: error });
+      }
+      throw error;
+    }
+  }
+  async getById(input) {
+    const normalized = normalizeGetShareSessionByIdInput(input);
+    return this.getRow(normalized.projectId, normalized.id);
+  }
+  async renewIfValid(input) {
+    const normalized = normalizeRenewShareSessionIfValidInput(input);
+    const requestedExpiry = normalized.expiresAt.toISOString();
+    const now = normalized.now.toISOString();
+    const row = this.db.query(`
+          UPDATE share_sessions
+          SET expires_at = CASE
+            WHEN ? > absolute_expires_at THEN absolute_expires_at
+            WHEN ? > expires_at THEN ?
+            ELSE expires_at
+          END
+          WHERE project_id = ?
+            AND id = ?
+            AND grant_id = ?
+            AND token_hash = ?
+            AND revoked_at IS NULL
+            AND created_at <= ?
+            AND expires_at > ?
+            AND absolute_expires_at > ?
+          RETURNING *
+        `).get(requestedExpiry, requestedExpiry, requestedExpiry, normalized.projectId, normalized.id, normalized.grantId, normalized.tokenHash, now, now, now);
+    return row ? rowToRecord2(row) : null;
+  }
+  async revoke(input) {
+    const normalized = normalizeRevokeShareSessionInput(input);
+    const current = this.getRow(normalized.projectId, normalized.id);
+    if (!current || current.revokedAt)
+      return current;
+    const revocation = normalizeRevokeShareSessionInput(normalized, current.createdAt);
+    const row = this.db.query(`
+          UPDATE share_sessions
+          SET revoked_at = ?
+          WHERE project_id = ? AND id = ? AND revoked_at IS NULL
+          RETURNING *
+        `).get(revocation.revokedAt.toISOString(), revocation.projectId, revocation.id);
+    return row ? rowToRecord2(row) : this.getRow(revocation.projectId, revocation.id);
+  }
+  close() {
+    closeSqliteStoreConnection(this.connection);
+  }
+  getRow(projectId, id) {
+    const row = this.db.query("SELECT * FROM share_sessions WHERE project_id = ? AND id = ?").get(projectId, id);
+    return row ? rowToRecord2(row) : null;
+  }
+}
+function rowToRecord2(row) {
+  return parseShareSessionRecord({
+    projectId: row.project_id,
+    id: row.id,
+    grantId: row.grant_id,
+    tokenHash: row.token_hash,
+    createdAt: row.created_at,
+    expiresAt: row.expires_at,
+    absoluteExpiresAt: row.absolute_expires_at,
+    ...row.revoked_at === null ? {} : { revokedAt: row.revoked_at }
+  });
+}
+function invalidRecord2(message) {
+  return new ShareSessionStorageError("invalid_record", `[SixbSqlite] ${message}`);
+}
+
 // src/sync-run-storage.ts
 import { parseSixbFailure as parseSixbFailure4, serializeSixbFailure as serializeSixbFailure5 } from "@sixb/core/internal/errors";
+import { canRequeueSyncRunAfterEnqueueFailure } from "@sixb/core/internal/storage";
 import { assertSyncRunExecution } from "@sixb/core/internal/sync-run-storage-provider";
-import {
-  canRequeueSyncRunAfterEnqueueFailure,
-  SYNC_RUN_FAILURE_CODES,
-  SyncRunError
-} from "@sixb/core/storage";
+import { SYNC_RUN_FAILURE_CODES, SyncRunError } from "@sixb/core/storage";
 class SqliteSyncRunStorage {
   connection;
   db;
@@ -14792,7 +15924,6 @@ function assertNonNegativeInteger(value, fieldName) {
 }
 
 // src/workflow-run-storage.ts
-import { normalizeRequesterGroupIds as normalizeRequesterGroupIds2 } from "@sixb/core/internal/auth";
 import { parseSixbFailure as parseSixbFailure6, serializeSixbFailure as serializeSixbFailure7 } from "@sixb/core/internal/errors";
 import {
   assertWorkflowAgentNodeRunExecution,
@@ -14839,10 +15970,9 @@ class SqliteWorkflowRunStorage {
             input,
             queued_at,
             started_at,
-            requester_group_ids,
             attempt
-          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-        `).run(input.projectId, input.id, input.executionId, input.workflowId, "queued", serializeRecord2(input.input), queuedAt.toISOString(), queuedAt.toISOString(), JSON.stringify(normalizeRequesterGroupIds2(input.requesterGroupIds)), 0);
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(input.projectId, input.id, input.executionId, input.workflowId, "queued", serializeRecord2(input.input), queuedAt.toISOString(), queuedAt.toISOString(), 0);
     } catch (error) {
       if (isUniqueConstraintError2(error)) {
         throw new WorkflowRunError(`[SixbSqlite] Workflow run '${input.id}' or execution '${input.executionId}' is already linked for project '${input.projectId}'.`);
@@ -15353,7 +16483,6 @@ function rowToWorkflowRunRecord(row) {
     startedAt: new Date(row.started_at),
     finishedAt: row.finished_at ? new Date(row.finished_at) : undefined,
     error: row.error === null ? undefined : parseSixbFailure6(row.error, WORKFLOW_RUN_FAILURE_CODES),
-    requesterGroupIds: JSON.parse(row.requester_group_ids),
     attempt: row.attempt,
     ...row.execution_token && row.execution_queue_lease_expires_at ? {
       execution: {
@@ -15444,6 +16573,8 @@ class SqliteStorage {
   timeseries;
   webhookRuns;
   rules;
+  shareGrants;
+  shareSessions;
   connectorConnections;
   migrators;
   connection;
@@ -15475,7 +16606,7 @@ class SqliteStorage {
     }, assertRootOperationAvailable) : scope;
     const readObjects = path ? new SqliteObjectStorage({ connection: this.readConnection }) : stores.objects;
     const readTimeseries = path ? new SqliteTimeseriesStorage({ connection: this.readConnection }) : stores.timeseries;
-    this.objects = createOperationScopedFacade(readObjects, readScope);
+    this.objects = createObjectOperationScope(readObjects, readScope);
     this.ontology = createOntologyOperationScope(stores.ontology, ontologyScope);
     this.auth = createAuthOperationScope(stores.auth, scope);
     this.executions = createOperationScopedFacade(stores.executions, scope);
@@ -15492,6 +16623,8 @@ class SqliteStorage {
     this.workflowInterventions = createOperationScopedFacade(stores.workflowInterventions, scope);
     this.webhookRuns = createOperationScopedFacade(stores.webhookRuns, scope);
     this.rules = createOperationScopedFacade(stores.rules, scope);
+    this.shareGrants = createOperationScopedFacade(stores.shareGrants, scope);
+    this.shareSessions = createOperationScopedFacade(stores.shareSessions, scope);
     this.connectorConnections = createOperationScopedFacade(stores.connectorConnections, scope);
     this.migrators = options.path ? createSqliteStorageMigrators(options.path) : [];
     registerSqliteStorageTestingAdapter(this, (durationMs) => stores.connectorConnections.advanceTimeForTesting(durationMs));
@@ -15590,7 +16723,9 @@ class SqliteStorage {
 }
 function createSqliteStores(connection, options) {
   const auth = new SqliteAuthStorage({ connection });
-  const executions = new SqliteExecutionStorage(connection.db, auth);
+  const shareGrants = new SqliteShareGrantStorage({ connection });
+  const shareSessions = new SqliteShareSessionStorage({ connection });
+  const executions = new SqliteExecutionStorage(connection.db, auth, shareSessions);
   return {
     objects: new SqliteObjectStorage({ connection }),
     ontology: new SqliteOntologyStorage({
@@ -15613,12 +16748,14 @@ function createSqliteStores(connection, options) {
     workflowInterventions: new SqliteWorkflowInterventionStorage({ connection }),
     webhookRuns: new SqliteWebhookRunStorage({ connection, executions }),
     rules: new SqliteRulesStorage({ connection }),
+    shareGrants,
+    shareSessions,
     connectorConnections: new SqliteConnectorConnectionStorage(connection)
   };
 }
 export {
-  migrateSqliteStorage,
-  SqliteStorage
+  SqliteStorage,
+  migrateSqliteStorage
 };
 
-//# debugId=CC3E88BEF909A1E364756E2164756E21
+//# debugId=8848EEC97F2007FB64756E2164756E21