@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.2-dev.9022f22

package/dist/packages/server/migrations/0001_tables.sql

@@ -0,0 +1,268 @@
+-- The service's tables, as ChainDB's migration 20261023200000 made them in public (so an
+-- install adopted from there and a fresh one end up identical; 0002 renames them). Apps an
+-- organization connected once for its agents, the agents (API keys) allowed to use them, what
+-- each agent may do in each app, a record of every call, and Microsoft Teams bots for agents.
+-- Only the service reads and writes these: RLS is forced. Run with search_path set to the
+-- service's schema.
+
+-- An agent authenticates with a key only it holds; we keep its SHA-256. last_used_at is
+-- stamped with every audit row, so listing keys does not aggregate the log.
+create table agent_connect_agents (
+  id uuid primary key default gen_random_uuid(),
+  organization_id uuid not null,
+  name text not null check (length(name) between 1 and 200),
+  key_hash text not null unique check (key_hash ~ '^[0-9a-f]{64}$'),
+  status text not null check (status in ('active', 'disabled')),
+  created_by text,
+  created_at timestamptz not null default now(),
+  last_used_at timestamptz,
+  unique (organization_id, name)
+);
+
+-- One sign-in per organization shared by several apps (Microsoft), and the organization's
+-- Claude API key (provider 'anthropic'). The credential is AES-256-GCM sealed by the service
+-- under credential_scope; credential_key_id names the key that sealed it.
+create table agent_connect_providers (
+  id uuid primary key default gen_random_uuid(),
+  organization_id uuid not null,
+  provider text not null check (provider ~ '^[a-z0-9-]+$'),
+  status text not null check (status in ('pending', 'connected', 'needs_reconnect')),
+  config jsonb not null default '{}'::jsonb,
+  credential bytea not null,
+  credential_key_id text not null,
+  credential_scope text not null,
+  account_label text,
+  connected_by text,
+  connected_at timestamptz not null default now(),
+  checked_at timestamptz not null default now(),
+  unique (organization_id, provider)
+);
+
+-- The service's shared app reaches any tenant that approved it, so one tenant binds to one
+-- organization. A customer's own app reaches only its own tenant.
+create unique index agent_connect_providers_one_org_per_tenant
+  on agent_connect_providers (provider, (config->>'tenantId'))
+  where config->>'auth' = 'arbium_app';
+
+-- One row per connected app: capabilities is the most any agent may do there; config holds
+-- non-secret values. An app signs in with its own sealed credential or through a provider
+-- row, never both. access_ceiling is unused (nullable, never written).
+create table agent_connect_connections (
+  id uuid primary key default gen_random_uuid(),
+  organization_id uuid not null,
+  connector_id text not null check (connector_id ~ '^[a-z0-9-]+$'),
+  access_ceiling text,
+  config jsonb not null default '{}'::jsonb,
+  credential bytea,
+  credential_key_id text,
+  status text not null check (status in ('connected', 'needs_reconnect')),
+  account_label text,
+  connected_by text,
+  connected_at timestamptz not null default now(),
+  checked_at timestamptz not null default now(),
+  capabilities text[] not null,
+  provider_id uuid references agent_connect_providers(id) on delete cascade,
+  unique (organization_id, connector_id),
+  constraint agent_connect_connections_one_credential
+    check ((provider_id is null) = (credential is not null and credential_key_id is not null))
+);
+
+-- Each agent's ticked capabilities per app (the effective set is these within the
+-- connection's), plus value limits such as {"projects": ["KAN"]}. access_level is unused.
+create table agent_connect_grants (
+  agent_id uuid not null references agent_connect_agents(id) on delete cascade,
+  connector_id text not null check (connector_id ~ '^[a-z0-9-]+$'),
+  access_level text,
+  limits jsonb not null default '{}'::jsonb check (jsonb_typeof(limits) = 'object'),
+  updated_at timestamptz not null default now(),
+  capabilities text[] not null,
+  primary key (agent_id, connector_id)
+);
+
+-- Vendors only see the shared connection, so this is the record of which agent did what. Rows
+-- keep the agent's name after the agent is removed; admin changes have no agent.
+create table agent_connect_audit (
+  id bigint generated always as identity primary key,
+  at timestamptz not null default now(),
+  organization_id uuid not null,
+  agent_id uuid references agent_connect_agents(id) on delete set null,
+  connector_id text not null,
+  tool text not null,
+  target text,
+  decision text not null check (decision in ('allowed', 'denied', 'failed')),
+  reason text,
+  vendor_status integer,
+  agent_name text
+);
+create index agent_connect_audit_org_at on agent_connect_audit (organization_id, at desc);
+
+-- Setup steps the service cannot check live, marked done by an admin; steps of different apps with
+-- the same id share one mark.
+create table agent_connect_confirmed (
+  organization_id uuid not null,
+  step text not null check (step ~ '^[a-z0-9-]+$'),
+  confirmed_by text not null,
+  confirmed_at timestamptz not null default now(),
+  primary key (organization_id, step)
+);
+
+-- Teams (design: AgentConnect/docs/teams.md). One bot per agent; its private key is made by
+-- the service and sealed like other credentials.
+create table agent_connect_teams_bots (
+  id uuid primary key default gen_random_uuid(),
+  organization_id uuid not null,
+  agent_id uuid not null unique references agent_connect_agents(id) on delete cascade,
+  -- The Entra application id; null until the setup script made the app and it was proven.
+  bot_app_id uuid unique,
+  -- The Teams app manifest id, minted here once.
+  teams_app_id uuid not null unique default gen_random_uuid(),
+  tenant_id uuid not null,
+  display_name text not null check (length(display_name) between 1 and 30),
+  -- The manifest's version is 1.0.<manifest_version>.
+  manifest_version int not null default 1 check (manifest_version >= 1),
+  status text not null check (status in ('awaiting_setup', 'connected', 'needs_reconnect')),
+  -- {certificate, nextCertificate?}; the private keys are in the sealed credential.
+  config jsonb not null default '{}'::jsonb,
+  credential bytea not null,
+  credential_key_id text not null,
+  created_by text,
+  created_at timestamptz not null default now(),
+  checked_at timestamptz,
+  -- The last request refused for this bot, in plain words, so the admin sees why nothing
+  -- arrives.
+  last_refused_at timestamptz,
+  last_refused_reason text
+);
+
+-- Where the bot is installed. A team install is one row (the bot sees all its channels);
+-- team_id is Teams' thread id for the team, team_group_id its Microsoft 365 group id.
+create table agent_connect_teams_conversations (
+  bot_id uuid not null references agent_connect_teams_bots(id) on delete cascade,
+  conversation_id text not null,
+  kind text not null check (kind in ('personal', 'groupChat', 'team')),
+  service_url text not null check (service_url like 'https://%'),
+  team_id text,
+  team_group_id uuid,
+  name text,
+  user_aad_id uuid,
+  installed_at timestamptz not null default now(),
+  removed_at timestamptz,
+  -- The last "limit reached" notice sent there, at most one an hour.
+  limit_notice_at timestamptz,
+  primary key (bot_id, conversation_id)
+);
+
+-- Dedupe and work queue. The activity is sealed (it holds the message text) and cleared once
+-- processed. Pruned after 30 days by the service.
+create table agent_connect_teams_events (
+  id bigint generated always as identity primary key,
+  bot_id uuid not null references agent_connect_teams_bots(id) on delete cascade,
+  activity_id text not null,
+  type text not null,
+  conversation_id text not null,
+  thread_id text,
+  from_aad_id text,
+  received_at timestamptz not null default now(),
+  state text not null check (state in ('pending', 'processing', 'held', 'ignored', 'run', 'done', 'failed')),
+  reason text,
+  payload bytea,
+  payload_key_id text,
+  claimed_at timestamptz,
+  unique (bot_id, activity_id)
+);
+create index agent_connect_teams_events_pending on agent_connect_teams_events (id)
+  where state = 'pending';
+create index agent_connect_teams_events_held on agent_connect_teams_events (bot_id, thread_id)
+  where state = 'held';
+
+-- Each agent's real-time response settings.
+create table agent_connect_teams_triggers (
+  agent_id uuid primary key references agent_connect_agents(id) on delete cascade,
+  enabled boolean not null default false,
+  managed_agent_id text not null check (managed_agent_id ~ '^[A-Za-z0-9_-]{1,128}$'),
+  environment_id text not null check (environment_id ~ '^[A-Za-z0-9_-]{1,128}$'),
+  vault_ids text[] not null default '{}',
+  budget_cents int not null check (budget_cents between 1 and 2000),
+  max_runs_per_hour int not null default 20 check (max_runs_per_hour between 1 and 100),
+  -- What this agent's answers may cost together in any 24 hours.
+  max_cents_per_day int not null default 500 check (max_cents_per_day between 1 and 100000),
+  max_concurrent int not null default 2 check (max_concurrent between 1 and 10),
+  reply_mode text not null default 'mentions' check (reply_mode in ('mentions', 'all')),
+  allowed_teams uuid[] not null default '{}',
+  allowed_people uuid[] not null default '{}',
+  -- An empty allowed_people means nobody unless this is set: anyone in the organization (never
+  -- guests) may then ask the agent, which acts with everything the agent was granted.
+  anyone_in_organization boolean not null default false,
+  check (anyone_in_organization or cardinality(allowed_people) > 0 or not enabled),
+  updated_by text,
+  updated_at timestamptz not null default now()
+);
+
+-- One Claude Managed Agents session per thread, reused for later messages there. The reply
+-- token is for the latest message only.
+create table agent_connect_teams_runs (
+  id uuid primary key default gen_random_uuid(),
+  agent_id uuid not null references agent_connect_agents(id) on delete cascade,
+  bot_id uuid not null references agent_connect_teams_bots(id) on delete cascade,
+  conversation_id text not null,
+  thread_id text not null,
+  trigger_activity_id text not null,
+  session_id text,
+  reply_token_hash text not null unique check (reply_token_hash ~ '^[0-9a-f]{64}$'),
+  reply_token_at timestamptz not null default now(),
+  -- no_reply: the session finished without answering in Teams.
+  state text not null check (state in ('starting', 'running', 'idle', 'ended', 'failed', 'no_reply')),
+  error text,
+  -- Something the admin should know that did not stop the answer.
+  note text,
+  -- Who asked: a session is only reused for the same person.
+  requested_by_aad_id uuid,
+  -- Replies sent with the current reply token (a few per message at most), and the last one.
+  reply_count int not null default 0,
+  replied_at timestamptz,
+  cost_cents int,
+  turns int not null default 1,
+  started_at timestamptz not null default now(),
+  finished_at timestamptz
+);
+create index agent_connect_teams_runs_agent on agent_connect_teams_runs (agent_id, started_at desc);
+-- One active session per thread: a second message while one runs is held, not a second run.
+create unique index agent_connect_teams_runs_one_active
+  on agent_connect_teams_runs (bot_id, thread_id) where state in ('starting', 'running');
+
+-- What each Teams answer cost, per turn (a run's cost_cents is its session's running total);
+-- the 24-hour spend limit sums these.
+create table agent_connect_teams_spend (
+  id bigint generated always as identity primary key,
+  agent_id uuid not null references agent_connect_agents(id) on delete cascade,
+  run_id uuid not null references agent_connect_teams_runs(id) on delete cascade,
+  cents int not null check (cents > 0),
+  spent_at timestamptz not null default now()
+);
+create index agent_connect_teams_spend_agent
+  on agent_connect_teams_spend (agent_id, spent_at desc);
+
+alter table agent_connect_agents enable row level security;
+alter table agent_connect_agents force row level security;
+alter table agent_connect_providers enable row level security;
+alter table agent_connect_providers force row level security;
+alter table agent_connect_connections enable row level security;
+alter table agent_connect_connections force row level security;
+alter table agent_connect_grants enable row level security;
+alter table agent_connect_grants force row level security;
+alter table agent_connect_audit enable row level security;
+alter table agent_connect_audit force row level security;
+alter table agent_connect_confirmed enable row level security;
+alter table agent_connect_confirmed force row level security;
+alter table agent_connect_teams_bots enable row level security;
+alter table agent_connect_teams_bots force row level security;
+alter table agent_connect_teams_conversations enable row level security;
+alter table agent_connect_teams_conversations force row level security;
+alter table agent_connect_teams_events enable row level security;
+alter table agent_connect_teams_events force row level security;
+alter table agent_connect_teams_triggers enable row level security;
+alter table agent_connect_teams_triggers force row level security;
+alter table agent_connect_teams_runs enable row level security;
+alter table agent_connect_teams_runs force row level security;
+alter table agent_connect_teams_spend enable row level security;
+alter table agent_connect_teams_spend force row level security;

package/dist/packages/server/migrations/0002_organizations.sql

@@ -0,0 +1,72 @@
+-- The service's own organizations, and table names without the prefix they needed in public.
+-- Index and constraint names keep their old spelling (a rename leaves them), so code matching
+-- one works on every install.
+
+create table organizations (
+  id uuid primary key default gen_random_uuid(),
+  -- Null for organizations taken over from rows saved before this table existed.
+  name text check (name is null or length(name) between 1 and 200),
+  created_at timestamptz not null default now()
+);
+alter table organizations enable row level security;
+alter table organizations force row level security;
+
+alter table agent_connect_agents rename to agents;
+alter table agent_connect_providers rename to providers;
+alter table agent_connect_connections rename to connections;
+alter table agent_connect_grants rename to grants;
+alter table agent_connect_audit rename to audit;
+alter table agent_connect_confirmed rename to confirmed;
+alter table agent_connect_teams_bots rename to teams_bots;
+alter table agent_connect_teams_conversations rename to teams_conversations;
+alter table agent_connect_teams_events rename to teams_events;
+alter table agent_connect_teams_triggers rename to teams_triggers;
+alter table agent_connect_teams_runs rename to teams_runs;
+alter table agent_connect_teams_spend rename to teams_spend;
+
+-- RLS stays forced. A role that owns these tables but cannot bypass RLS (one owning only this
+-- schema) needs a policy to see any row, before the backfill below reads them; the role running
+-- migrations is the service's own.
+create policy service on organizations for all to current_user using (true) with check (true);
+create policy service on agents for all to current_user using (true) with check (true);
+create policy service on providers for all to current_user using (true) with check (true);
+create policy service on connections for all to current_user using (true) with check (true);
+create policy service on grants for all to current_user using (true) with check (true);
+create policy service on audit for all to current_user using (true) with check (true);
+create policy service on confirmed for all to current_user using (true) with check (true);
+create policy service on teams_bots for all to current_user using (true) with check (true);
+create policy service on teams_conversations for all to current_user using (true) with check (true);
+create policy service on teams_events for all to current_user using (true) with check (true);
+create policy service on teams_triggers for all to current_user using (true) with check (true);
+create policy service on teams_runs for all to current_user using (true) with check (true);
+create policy service on teams_spend for all to current_user using (true) with check (true);
+
+-- Every organization already holding rows keeps its id.
+insert into organizations (id)
+select organization_id from agents
+union select organization_id from providers
+union select organization_id from connections
+union select organization_id from audit
+union select organization_id from confirmed
+union select organization_id from teams_bots
+on conflict do nothing;
+
+-- An install adopted from public still points these at public.organizations.
+alter table agents drop constraint if exists agent_connect_agents_organization_id_fkey,
+  add constraint agent_connect_agents_organization_id_fkey
+  foreign key (organization_id) references organizations (id) on delete restrict;
+alter table providers drop constraint if exists agent_connect_providers_organization_id_fkey,
+  add constraint agent_connect_providers_organization_id_fkey
+  foreign key (organization_id) references organizations (id) on delete restrict;
+alter table connections drop constraint if exists agent_connect_connections_organization_id_fkey,
+  add constraint agent_connect_connections_organization_id_fkey
+  foreign key (organization_id) references organizations (id) on delete restrict;
+alter table audit drop constraint if exists agent_connect_audit_organization_id_fkey,
+  add constraint agent_connect_audit_organization_id_fkey
+  foreign key (organization_id) references organizations (id) on delete restrict;
+alter table confirmed drop constraint if exists agent_connect_confirmed_organization_id_fkey,
+  add constraint agent_connect_confirmed_organization_id_fkey
+  foreign key (organization_id) references organizations (id) on delete restrict;
+alter table teams_bots drop constraint if exists agent_connect_teams_bots_organization_id_fkey,
+  add constraint agent_connect_teams_bots_organization_id_fkey
+  foreign key (organization_id) references organizations (id) on delete restrict;

package/dist/packages/server/migrations/0003_drop_unused.sql

@@ -0,0 +1,3 @@
+-- Never read or written by the service.
+alter table connections drop column access_ceiling;
+alter table grants drop column access_level;

package/dist/packages/server/migrations/0004_trigger_runners.sql

@@ -0,0 +1,15 @@
+-- What answers a Teams trigger: Claude Managed Agents (every row before this, so the default)
+-- or another runner, with its own settings and, for a signed webhook, a signing secret sealed
+-- like other credentials. Only the Claude runner needs a Claude agent and environment.
+alter table teams_triggers
+  add column runner text not null default 'claude-managed-agents'
+    check (runner ~ '^[a-z][a-z0-9-]{1,40}$'),
+  add column settings jsonb not null default '{}',
+  add column secret bytea,
+  add column secret_key_id text,
+  alter column managed_agent_id drop not null,
+  alter column environment_id drop not null,
+  add constraint teams_triggers_claude_ids check (
+    runner <> 'claude-managed-agents'
+    or (managed_agent_id is not null and environment_id is not null)
+  );

package/dist/packages/server/migrations/0005_run_runner.sql

@@ -0,0 +1,3 @@
+-- The runner that started each session, so a trigger moved to another runner never hands a
+-- session to a runner that did not start it. Every run before this was Claude's.
+alter table teams_runs add column runner text not null default 'claude-managed-agents';

package/dist/packages/server/migrations/0006_approvals.sql

@@ -0,0 +1,36 @@
+-- Approval cards: an agent asks one person, through its Teams bot, to approve or reject. The
+-- answer is a click (adaptiveCard/action) in a request authenticated by a Bot Framework token,
+-- accepted only from that person's Entra object id, in the team or chat the card was posted in.
+create table approvals (
+  id uuid primary key default gen_random_uuid(),
+  agent_id uuid not null references agents (id) on delete cascade,
+  bot_id uuid not null references teams_bots (id) on delete cascade,
+  -- What the agent holds is a random id; only its SHA-256 is kept.
+  token_hash text not null unique check (token_hash ~ '^[0-9a-f]{64}$'),
+  -- Where the card is: the installed place, its Bot Connector address, the conversation to edit
+  -- the card in (a channel thread or the chat) and the card's activity id (set once posted).
+  conversation_id text not null,
+  service_url text not null,
+  thread_id text,
+  activity_id text,
+  approver_aad_id uuid not null,
+  approver_name text not null,
+  -- What the card says, to show it again with the decision.
+  title text not null,
+  body text not null,
+  facts jsonb not null default '[]',
+  status text not null default 'pending' check (status in ('pending', 'approved', 'rejected')),
+  decided_by_aad_id uuid,
+  decided_by_name text,
+  decided_at timestamptz,
+  comment text,
+  created_at timestamptz not null default now(),
+  expires_at timestamptz not null,
+  check ((status = 'pending') = (decided_at is null))
+);
+create index agent_connect_approvals_bot on approvals (bot_id, created_at desc);
+-- An agent's own lookups and the cascade when it is deleted.
+create index agent_connect_approvals_agent on approvals (agent_id);
+alter table approvals enable row level security;
+alter table approvals force row level security;
+create policy service on approvals for all to current_user using (true) with check (true);

package/dist/packages/server/migrations/0007_app_events.sql

@@ -0,0 +1,110 @@
+-- Events from connected apps (a Jira issue created, ...) that start agents. An organization
+-- subscribes once per app, by webhook (the app posts to /agent-connect/events/<id>, signed with
+-- the subscription's secret) or by polling the app on an interval from a cursor.
+create table event_subscriptions (
+  id uuid primary key default gen_random_uuid(),
+  organization_id uuid not null references organizations (id) on delete cascade,
+  connector_id text not null,
+  source text not null check (source in ('webhook', 'poll')),
+  -- The webhook's secret, sealed (event-subscription:<id>); null for a poll.
+  secret bytea,
+  secret_key_id text,
+  -- Narrows what the app sends or what a poll reads, in the app's own terms (Jira: JQL).
+  filter text not null default '',
+  interval_seconds int not null default 300 check (interval_seconds between 60 and 86400),
+  -- A poll's position: the newest change it has read.
+  cursor text,
+  polled_at timestamptz,
+  last_error text,
+  -- Where the app keeps the webhook when it was registered through its API.
+  registered text,
+  created_by text not null,
+  created_at timestamptz not null default now(),
+  unique (organization_id, connector_id),
+  check ((source = 'webhook') = (secret is not null))
+);
+
+-- Deliveries waiting to be matched against triggers, and those done (kept 30 days, so a signed
+-- delivery cannot be replayed while its timestamp would still pass). Only the fields the
+-- connector keeps are stored, sealed, and only until processed.
+create table app_events (
+  id bigint generated always as identity primary key,
+  subscription_id uuid not null references event_subscriptions (id) on delete cascade,
+  delivery_id text not null,
+  event_type text not null,
+  state text not null default 'pending'
+    check (state in ('pending', 'processing', 'done', 'failed')),
+  reason text,
+  payload bytea,
+  payload_key_id text,
+  received_at timestamptz not null default now(),
+  claimed_at timestamptz,
+  unique (subscription_id, delivery_id)
+);
+create index agent_connect_app_events_pending on app_events (id)
+  where state in ('pending', 'processing');
+create index agent_connect_app_events_received on app_events (received_at);
+
+-- What an agent does when an app's event arrives: which events, conditions on their fields,
+-- its instructions, what runs it (as teams_triggers: runner, settings, sealed signing secret,
+-- the Claude agent) and its caps.
+create table event_triggers (
+  id uuid primary key default gen_random_uuid(),
+  agent_id uuid not null references agents (id) on delete cascade,
+  connector_id text not null,
+  enabled boolean not null default false,
+  event_types text[] not null check (cardinality(event_types) > 0),
+  conditions jsonb not null default '[]',
+  prompt text not null check (length(prompt) between 1 and 4000),
+  runner text not null check (runner ~ '^[a-z][a-z0-9-]{1,40}$'),
+  settings jsonb not null default '{}',
+  secret bytea,
+  secret_key_id text,
+  managed_agent_id text check (managed_agent_id ~ '^[A-Za-z0-9_-]{1,128}$'),
+  environment_id text check (environment_id ~ '^[A-Za-z0-9_-]{1,128}$'),
+  vault_ids text[] not null default '{}',
+  budget_cents int not null check (budget_cents between 1 and 2000),
+  max_runs_per_hour int not null default 20 check (max_runs_per_hour between 1 and 100),
+  max_cents_per_day int not null default 500 check (max_cents_per_day between 1 and 100000),
+  max_concurrent int not null default 2 check (max_concurrent between 1 and 10),
+  updated_by text,
+  updated_at timestamptz not null default now(),
+  unique (agent_id, connector_id),
+  check (
+    runner <> 'claude-managed-agents'
+    or (managed_agent_id is not null and environment_id is not null)
+  )
+);
+create index agent_connect_event_triggers_app on event_triggers (connector_id);
+
+create table event_runs (
+  id uuid primary key default gen_random_uuid(),
+  agent_id uuid not null references agents (id) on delete cascade,
+  trigger_id uuid not null references event_triggers (id) on delete cascade,
+  event_id bigint references app_events (id) on delete set null,
+  event_type text not null,
+  delivery_id text not null,
+  runner text not null,
+  session_id text,
+  state text not null check (state in ('starting', 'running', 'ended', 'failed')),
+  error text,
+  cost_cents int,
+  started_at timestamptz not null default now(),
+  finished_at timestamptz
+);
+create index agent_connect_event_runs_trigger on event_runs (trigger_id, started_at desc);
+create index agent_connect_event_runs_agent on event_runs (agent_id, started_at desc);
+create index agent_connect_event_runs_live on event_runs (state) where state in ('starting', 'running');
+
+alter table event_subscriptions enable row level security;
+alter table event_subscriptions force row level security;
+create policy service on event_subscriptions for all to current_user using (true) with check (true);
+alter table app_events enable row level security;
+alter table app_events force row level security;
+create policy service on app_events for all to current_user using (true) with check (true);
+alter table event_triggers enable row level security;
+alter table event_triggers force row level security;
+create policy service on event_triggers for all to current_user using (true) with check (true);
+alter table event_runs enable row level security;
+alter table event_runs force row level security;
+create policy service on event_runs for all to current_user using (true) with check (true);

package/dist/packages/server/migrations/rollback/to-legacy.sql

@@ -0,0 +1,90 @@
+-- Rolls an install back to the earlier layout: the tables back in public under their old
+-- names, pointing at public.organizations, and the service's schema gone. By hand, only to run
+-- an older image again, in one transaction:
+--   psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -1 -f migrations/rollback/to-legacy.sql
+-- Written for the default schema agent_connect. Fails, changing nothing, if an organization
+-- here is missing from public.organizations.
+
+-- The views migrate() made for the previous release, in the way of the tables' old names.
+drop view if exists public.agent_connect_agents, public.agent_connect_providers,
+  public.agent_connect_connections, public.agent_connect_grants, public.agent_connect_audit,
+  public.agent_connect_confirmed, public.agent_connect_teams_bots,
+  public.agent_connect_teams_conversations, public.agent_connect_teams_events,
+  public.agent_connect_teams_triggers, public.agent_connect_teams_runs,
+  public.agent_connect_teams_spend;
+-- 0007: app events and their triggers, which 0.7.5 does not have.
+drop table agent_connect.event_runs, agent_connect.event_triggers, agent_connect.app_events,
+  agent_connect.event_subscriptions;
+-- 0006: approval cards, which 0.7.5 does not have.
+drop table agent_connect.approvals;
+-- 0005: the runner of each session.
+alter table agent_connect.teams_runs drop column runner;
+-- 0004: triggers of other runners than Claude Managed Agents, which 0.7.5 cannot run, go.
+delete from agent_connect.teams_triggers where runner <> 'claude-managed-agents';
+alter table agent_connect.teams_triggers
+  drop constraint teams_triggers_claude_ids,
+  drop column runner,
+  drop column settings,
+  drop column secret,
+  drop column secret_key_id,
+  alter column managed_agent_id set not null,
+  alter column environment_id set not null;
+alter table agent_connect.connections add column access_ceiling text;
+alter table agent_connect.grants add column access_level text;
+drop policy service on agent_connect.organizations;
+drop policy service on agent_connect.agents;
+drop policy service on agent_connect.providers;
+drop policy service on agent_connect.connections;
+drop policy service on agent_connect.grants;
+drop policy service on agent_connect.audit;
+drop policy service on agent_connect.confirmed;
+drop policy service on agent_connect.teams_bots;
+drop policy service on agent_connect.teams_conversations;
+drop policy service on agent_connect.teams_events;
+drop policy service on agent_connect.teams_triggers;
+drop policy service on agent_connect.teams_runs;
+drop policy service on agent_connect.teams_spend;
+alter table agent_connect.agents drop constraint agent_connect_agents_organization_id_fkey,
+  add constraint agent_connect_agents_organization_id_fkey
+  foreign key (organization_id) references public.organizations (id) on delete restrict;
+alter table agent_connect.providers drop constraint agent_connect_providers_organization_id_fkey,
+  add constraint agent_connect_providers_organization_id_fkey
+  foreign key (organization_id) references public.organizations (id) on delete restrict;
+alter table agent_connect.connections drop constraint agent_connect_connections_organization_id_fkey,
+  add constraint agent_connect_connections_organization_id_fkey
+  foreign key (organization_id) references public.organizations (id) on delete restrict;
+alter table agent_connect.audit drop constraint agent_connect_audit_organization_id_fkey,
+  add constraint agent_connect_audit_organization_id_fkey
+  foreign key (organization_id) references public.organizations (id) on delete restrict;
+alter table agent_connect.confirmed drop constraint agent_connect_confirmed_organization_id_fkey,
+  add constraint agent_connect_confirmed_organization_id_fkey
+  foreign key (organization_id) references public.organizations (id) on delete restrict;
+alter table agent_connect.teams_bots drop constraint agent_connect_teams_bots_organization_id_fkey,
+  add constraint agent_connect_teams_bots_organization_id_fkey
+  foreign key (organization_id) references public.organizations (id) on delete restrict;
+alter table agent_connect.agents rename to agent_connect_agents;
+alter table agent_connect.providers rename to agent_connect_providers;
+alter table agent_connect.connections rename to agent_connect_connections;
+alter table agent_connect.grants rename to agent_connect_grants;
+alter table agent_connect.audit rename to agent_connect_audit;
+alter table agent_connect.confirmed rename to agent_connect_confirmed;
+alter table agent_connect.teams_bots rename to agent_connect_teams_bots;
+alter table agent_connect.teams_conversations rename to agent_connect_teams_conversations;
+alter table agent_connect.teams_events rename to agent_connect_teams_events;
+alter table agent_connect.teams_triggers rename to agent_connect_teams_triggers;
+alter table agent_connect.teams_runs rename to agent_connect_teams_runs;
+alter table agent_connect.teams_spend rename to agent_connect_teams_spend;
+alter table agent_connect.agent_connect_agents set schema public;
+alter table agent_connect.agent_connect_providers set schema public;
+alter table agent_connect.agent_connect_connections set schema public;
+alter table agent_connect.agent_connect_grants set schema public;
+alter table agent_connect.agent_connect_audit set schema public;
+alter table agent_connect.agent_connect_confirmed set schema public;
+alter table agent_connect.agent_connect_teams_bots set schema public;
+alter table agent_connect.agent_connect_teams_conversations set schema public;
+alter table agent_connect.agent_connect_teams_events set schema public;
+alter table agent_connect.agent_connect_teams_triggers set schema public;
+alter table agent_connect.agent_connect_teams_runs set schema public;
+alter table agent_connect.agent_connect_teams_spend set schema public;
+drop table agent_connect.organizations, agent_connect.schema_migrations;
+drop schema agent_connect;