@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.21

package/src/migrations/0098_single_provider_running_first.sql

@@ -0,0 +1,41 @@
+-- A deployment that already has two enabled providers of one single-provider extension point
+-- (sandbox, object-store, secret-store, config-source; enabled before the second enable was
+-- refused) loads the one with the earliest `enabled_at` (0097). 0097 backfilled it from the audit
+-- or the install time, which can name a provider other than the one the replicas run now: the
+-- rolling deploy would switch the provider. Prefer what is running: of the enabled providers of a
+-- contested point, the one with a `loaded` replica status row (the most recent heartbeat) gets an
+-- `enabled_at` just before every other provider of that point. A point with no loaded provider
+-- keeps the 0097 values. Idempotent: once the running provider is the earliest, nothing matches.
+WITH provided AS (
+  SELECT i.name, split_part(p.ref, '@', 1) AS point, i.enabled_at
+    FROM extension_installs i
+    JOIN extension_packages k ON k.sha256 = i.sha256
+   CROSS JOIN LATERAL jsonb_array_elements_text(
+           CASE WHEN jsonb_typeof(k.section -> 'manifest' -> 'provides') = 'array'
+                THEN k.section -> 'manifest' -> 'provides' ELSE '[]'::jsonb END) AS p(ref)
+   WHERE i.desired_state = 'enabled'
+     AND split_part(p.ref, '@', 1) IN ('sandbox', 'object-store', 'secret-store', 'config-source')
+),
+contested AS (
+  SELECT point FROM provided GROUP BY point HAVING count(DISTINCT name) > 1
+),
+running AS (
+  SELECT DISTINCT ON (pr.point) pr.point, pr.name
+    FROM provided pr
+    JOIN contested c ON c.point = pr.point
+    JOIN extension_replica_status s
+      ON s.plugin = pr.name AND s.source = 'install' AND s.state = 'loaded'
+   ORDER BY pr.point, s.heartbeat_at DESC, pr.name
+),
+target AS (
+  SELECT r.name, min(o.enabled_at) AS others_first
+    FROM running r
+    JOIN provided o ON o.point = r.point AND o.name <> r.name
+   GROUP BY r.name
+)
+UPDATE extension_installs i
+   SET enabled_at = t.others_first - interval '1 millisecond'
+  FROM target t
+ WHERE i.name = t.name
+   AND t.others_first IS NOT NULL
+   AND (i.enabled_at IS NULL OR i.enabled_at >= t.others_first);

package/src/migrations/0099_channel_connection_guide_ack.sql

@@ -0,0 +1,6 @@
+-- The setup guide a channel connection was last set up with (plugin setup guides spec
+-- 2026-11-08-plugin-setup-guides-design.md §6): { guideId, version, hash, mode } of the plugin's
+-- channel-connection guide, recorded on create, on an inbound mode switch and when an admin
+-- confirms the platform app was updated. NULL = unknown (rows before this column, or a plugin
+-- without a guide): no drift notice for those.
+ALTER TABLE channel_connections ADD COLUMN IF NOT EXISTS guide_ack jsonb;

package/src/migrations/0100_catalog_files.sql

@@ -0,0 +1,13 @@
+-- Catalog display files kept in PG (bootstrap catalog files fix, 2026-11-08): a plugin's icon, its
+-- connector templates' icons and its setup guide files, each capped at 64 KiB by the plugin format.
+-- Content-addressed: one row per sha256, shared by every version (and org) whose
+-- catalog_item_versions.files lists it; a reader only asks for the sha256 its version row records
+-- and re-checks it. They are in PG, not object storage, so a bootstrap plugin's icon is stored
+-- before any object-store extension runs (the object store's own icon included). touched_at: set
+-- by every import that stores the file again; the staging cleanup removes rows no version or
+-- staging lists once they are older than the staging TTL.
+CREATE TABLE IF NOT EXISTS catalog_files (
+  sha256 text PRIMARY KEY CHECK (sha256 ~ '^[0-9a-f]{64}$'),
+  data bytea NOT NULL,
+  touched_at timestamptz NOT NULL DEFAULT now()
+);

package/src/migrations/0101_marketplace_icons.sql

@@ -0,0 +1,32 @@
+-- Marketplace entry icons (maintainer decision 2026-11-08): the svg / png an entry's `icon` names
+-- (an https URL, or a path in a git marketplace's repository), downloaded on refresh through the
+-- marketplace network rules and kept here so the market list never hits the network per request
+-- and every replica serves the same bytes. One row per (marketplace, icon as the entry writes it);
+-- entries naming the same icon share it. Each is at most 64 KiB (the plugin icon limit). A URL's
+-- content is treated as fixed (fetched once); a repository path is read again at every new commit.
+-- Rows no entry names any more are removed by the refresh; deleting the marketplace removes them.
+CREATE TABLE IF NOT EXISTS marketplace_icons (
+  source_id text NOT NULL REFERENCES marketplaces(id) ON DELETE CASCADE,
+  ref text NOT NULL,
+  sha256 text NOT NULL CHECK (sha256 ~ '^[0-9a-f]{64}$'),
+  content_type text NOT NULL CHECK (content_type IN ('image/svg+xml', 'image/png')),
+  data bytea NOT NULL,
+  fetched_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (source_id, ref)
+);
+
+-- Icon URLs whose last download failed (HTTP error, invalid content, refused by the network rules,
+-- timeout): retried only after a backoff, and after the URLs never tried, so a few broken URLs never
+-- starve the rest of a refresh's download cap. Removed when the URL is stored or no entry names it.
+CREATE TABLE IF NOT EXISTS marketplace_icon_failures (
+  source_id text NOT NULL REFERENCES marketplaces(id) ON DELETE CASCADE,
+  ref text NOT NULL,
+  failed_at timestamptz NOT NULL DEFAULT now(),
+  attempts integer NOT NULL DEFAULT 1,
+  PRIMARY KEY (source_id, ref)
+);
+
+-- The git commit whose repository-path icons were last stored completely (null: none yet, or a
+-- refresh that predates icons). A refresh at last_commit is not_modified only when this equals it;
+-- otherwise the commit is read again, so a failed icon write recovers at the same commit.
+ALTER TABLE marketplaces ADD COLUMN IF NOT EXISTS icons_commit text;

package/src/migrations/0102_themes.sql

@@ -0,0 +1,64 @@
+-- Themes as a platform component kind (themes spec 2026-11-08-themes-design.md §6, §7): rows and
+-- versions shaped like platform agent templates, with the owner columns of org-owned items; the
+-- `theme` kind in the component scope, switch and install component tables; the person's pick on
+-- the account. Expand-only: the only dropped objects are the three kind checks, re-added wider in
+-- the next statement each.
+
+CREATE TABLE IF NOT EXISTS platform_themes (
+  id text PRIMARY KEY,
+  catalog_item_id uuid REFERENCES catalog_items(id) ON DELETE SET NULL,
+  plugin_name text,
+  name text NOT NULL,
+  description text,
+  description_zh text,
+  current_version integer NOT NULL CHECK (current_version >= 1),
+  scope_mode text NOT NULL DEFAULT 'follow' CHECK (scope_mode IN ('follow', 'own')),
+  scope text NOT NULL DEFAULT 'optional' CHECK (scope IN ('all', 'optional', 'named')),
+  disabled boolean NOT NULL DEFAULT false,
+  shown_to_others boolean NOT NULL DEFAULT true,
+  scope_version integer NOT NULL DEFAULT 0,
+  -- The owning org (NULL = the platform), the org it was created in (no FK, immutable) and the
+  -- share switch, as on the other platform components (0084).
+  owner_org_id text REFERENCES orgs(id) ON DELETE SET NULL,
+  origin_org_id text,
+  shareable boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  deleted_at timestamptz
+);
+CREATE UNIQUE INDEX IF NOT EXISTS platform_themes_live_name_origin_uq
+  ON platform_themes ((coalesce(plugin_name, '')), name, (coalesce(origin_org_id, '')))
+  WHERE deleted_at IS NULL;
+
+-- One version of a theme: `definition` is the parsed theme file (`ParsedTheme`); fonts and logo
+-- live under `object_prefix` in `deployment/` (NULL for a theme without assets).
+CREATE TABLE IF NOT EXISTS platform_theme_versions (
+  theme_id text NOT NULL REFERENCES platform_themes(id) ON DELETE CASCADE,
+  version integer NOT NULL CHECK (version >= 1),
+  definition jsonb NOT NULL,
+  object_prefix text,
+  catalog_version text,
+  updated_on_own boolean NOT NULL DEFAULT false,
+  created_by text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (theme_id, version)
+);
+
+-- 0081 declared these checks inline, so they carry the default names.
+-- capybara:allow-destructive the check is added back with 'theme' in the next statement; existing rows satisfy it
+ALTER TABLE component_scope_orgs DROP CONSTRAINT IF EXISTS component_scope_orgs_kind_check;
+ALTER TABLE component_scope_orgs ADD CONSTRAINT component_scope_orgs_kind_check
+  CHECK (kind IN ('skill', 'agent_template', 'connector_template', 'theme'));
+-- capybara:allow-destructive the check is added back with 'theme' in the next statement; existing rows satisfy it
+ALTER TABLE component_org_switches DROP CONSTRAINT IF EXISTS component_org_switches_kind_check;
+ALTER TABLE component_org_switches ADD CONSTRAINT component_org_switches_kind_check
+  CHECK (kind IN ('skill', 'agent_template', 'connector_template', 'theme'));
+-- NOT VALID as in 0053: existing rows were checked by the narrower constraint already.
+-- capybara:allow-destructive the check is added back with 'theme' in the next statement; existing rows satisfy it
+ALTER TABLE plugin_install_components DROP CONSTRAINT IF EXISTS plugin_install_components_kind_check;
+ALTER TABLE plugin_install_components ADD CONSTRAINT plugin_install_components_kind_check
+  CHECK (kind IN ('extension', 'connector', 'skill', 'plugin', 'agent_template', 'theme')) NOT VALID;
+
+-- The person's theme (§7): one value across all their orgs; NULL follows the org. No FK: a pick
+-- that is not on in the current org (or no longer exists) is skipped, never an error.
+ALTER TABLE accounts ADD COLUMN IF NOT EXISTS theme text;

package/src/migrations/0103_ui_theme_setting.sql

@@ -0,0 +1,7 @@
+-- The platform default theme setting `uiTheme` (themes spec §7) always has a row: the guards that
+-- refuse taking the default theme away from an org read it FOR SHARE, and the setting's write
+-- locks it FOR UPDATE before checking the chosen theme, so the two serialize on this row.
+-- `{"id": null}` is the built-in theme (the default when the key is missing).
+INSERT INTO deployment_settings (key, value)
+VALUES ('uiTheme', '{"id": null}'::jsonb)
+ON CONFLICT (key) DO NOTHING;

package/src/migrations/0104_connector_tool_account_policies.sql

@@ -0,0 +1,16 @@
+-- A member's own tool policies for their own connection of a personal-credential connector
+-- (maintainer decision 2026-11-09, the connector card's 权限): one row per account, connector and
+-- tool name. They apply to every agent the account uses; an agent's tool policy overrides them, and
+-- a tool the org switched off (or set to deny) stays denied whatever they say.
+CREATE TABLE IF NOT EXISTS capybara.connector_tool_account_policies (
+  org_id text NOT NULL REFERENCES capybara.orgs(id) ON DELETE CASCADE,
+  connector_id text NOT NULL REFERENCES capybara.connectors(id) ON DELETE CASCADE,
+  account_id text NOT NULL REFERENCES capybara.accounts(id) ON DELETE CASCADE,
+  tool_name text NOT NULL,
+  policy text NOT NULL CHECK (policy IN ('allow', 'ask', 'deny')),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (connector_id, account_id, tool_name)
+);
+
+CREATE INDEX IF NOT EXISTS connector_tool_account_policies_account
+  ON capybara.connector_tool_account_policies (account_id);

package/src/migrations/0105_devices_rename.sql

@@ -0,0 +1,136 @@
+-- One name: devices (spec 2026-11-07-environments-design §15.2). Every environment table, column,
+-- index and constraint takes the device name; a connected machine's source 'device' becomes
+-- 'local', the kernel-internal provider '@device' becomes '@local', and the log event
+-- 'environment_paths' becomes 'device_paths' (in the log and in eval case snapshots). The kernel
+-- is renamed in the same release; before 0.1.0, so no compatibility layer and no rolling deploy
+-- across this migration. Every statement is guarded, so a rerun changes nothing.
+
+-- capybara:allow-destructive table rename; the kernel is renamed in the same release (not released, no compatibility layer)
+ALTER TABLE IF EXISTS environments RENAME TO devices;
+-- capybara:allow-destructive table rename; the kernel is renamed in the same release (not released, no compatibility layer)
+ALTER TABLE IF EXISTS environment_instances RENAME TO device_instances;
+-- capybara:allow-destructive table rename; the kernel is renamed in the same release (not released, no compatibility layer)
+ALTER TABLE IF EXISTS environment_defaults RENAME TO device_defaults;
+-- capybara:allow-destructive table rename; the kernel is renamed in the same release (not released, no compatibility layer)
+ALTER TABLE IF EXISTS environment_machines RENAME TO device_machines;
+
+-- RENAME COLUMN has no IF EXISTS: checked against information_schema first.
+-- capybara:allow-destructive column rename environment_id -> device_id; the kernel is renamed in the same release (not released)
+DO $$
+DECLARE
+  t text;
+BEGIN
+  FOREACH t IN ARRAY ARRAY['device_instances', 'device_defaults', 'device_machines',
+                           'conversations', 'background_tasks'] LOOP
+    IF EXISTS (
+      SELECT 1 FROM information_schema.columns
+      WHERE table_schema = 'capybara' AND table_name = t AND column_name = 'environment_id'
+    ) THEN
+      EXECUTE format('ALTER TABLE capybara.%I RENAME COLUMN environment_id TO device_id', t);
+    END IF;
+  END LOOP;
+END
+$$;
+
+-- Indexes, including those behind the primary keys and unique constraints (renaming such an
+-- index renames its constraint too).
+-- capybara:allow-destructive index rename; names follow the table rename (not released)
+ALTER INDEX IF EXISTS environments_pkey RENAME TO devices_pkey;
+-- capybara:allow-destructive index rename; names follow the table rename (not released)
+ALTER INDEX IF EXISTS environments_default_uq RENAME TO devices_default_uq;
+-- capybara:allow-destructive index rename; names follow the table rename (not released)
+ALTER INDEX IF EXISTS environments_name_uq RENAME TO devices_name_uq;
+-- capybara:allow-destructive index rename; names follow the table rename (not released)
+ALTER INDEX IF EXISTS environment_instances_pkey RENAME TO device_instances_pkey;
+-- capybara:allow-destructive index rename; names follow the table rename (not released)
+ALTER INDEX IF EXISTS environment_instances_running_idx RENAME TO device_instances_running_idx;
+-- capybara:allow-destructive index rename; names follow the table rename (not released)
+ALTER INDEX IF EXISTS environment_instances_live_idx RENAME TO device_instances_live_idx;
+-- capybara:allow-destructive index rename; names follow the table rename (not released)
+ALTER INDEX IF EXISTS environment_instances_org_idx RENAME TO device_instances_org_idx;
+-- capybara:allow-destructive index rename; names follow the table rename (not released)
+ALTER INDEX IF EXISTS environment_defaults_pkey RENAME TO device_defaults_pkey;
+-- capybara:allow-destructive index rename; names follow the column rename (not released)
+ALTER INDEX IF EXISTS background_tasks_environment_running_idx RENAME TO background_tasks_device_running_idx;
+-- capybara:allow-destructive index rename; names follow the table rename (not released)
+ALTER INDEX IF EXISTS environment_machines_pkey RENAME TO device_machines_pkey;
+-- capybara:allow-destructive index rename; names follow the table rename (not released)
+ALTER INDEX IF EXISTS environment_machines_credential_hash_key RENAME TO device_machines_credential_hash_key;
+-- capybara:allow-destructive index rename; names follow the table rename (not released)
+ALTER INDEX IF EXISTS environment_machines_active_uq RENAME TO device_machines_active_uq;
+-- capybara:allow-destructive index rename; names follow the table rename (not released)
+ALTER INDEX IF EXISTS environment_machines_org_idx RENAME TO device_machines_org_idx;
+
+-- NOT NULL constraints are unnamed on PostgreSQL 17 (the target), so nothing to rename there.
+-- The other CHECK and foreign key constraints: RENAME CONSTRAINT has no IF EXISTS, so each is
+-- checked against pg_constraint first. The source CHECK is not renamed here: it is replaced
+-- below with the new value list.
+-- capybara:allow-destructive constraint rename; names follow the table and column renames (not released)
+DO $$
+DECLARE
+  r record;
+BEGIN
+  FOR r IN
+    SELECT * FROM (VALUES
+      ('devices', 'environments_org_id_fkey', 'devices_org_id_fkey'),
+      ('devices', 'environments_owner_account_id_fkey', 'devices_owner_account_id_fkey'),
+      ('devices', 'environments_owner_kind_check', 'devices_owner_kind_check'),
+      ('device_instances', 'environment_instances_fs_status_check', 'device_instances_fs_status_check'),
+      ('device_instances', 'environment_instances_status_check', 'device_instances_status_check'),
+      ('device_instances', 'environment_instances_environment_id_fkey', 'device_instances_device_id_fkey'),
+      ('device_defaults', 'environment_defaults_environment_id_fkey', 'device_defaults_device_id_fkey'),
+      ('conversations', 'conversations_environment_id_fkey', 'conversations_device_id_fkey'),
+      ('device_machines', 'environment_machines_mode_check', 'device_machines_mode_check'),
+      ('device_machines', 'environment_machines_org_id_fkey', 'device_machines_org_id_fkey'),
+      ('device_machines', 'environment_machines_environment_id_fkey', 'device_machines_device_id_fkey')
+    ) AS v(tbl, old_name, new_name)
+  LOOP
+    IF EXISTS (
+      SELECT 1 FROM pg_constraint c
+      JOIN pg_namespace s ON s.oid = c.connamespace
+      WHERE s.nspname = 'capybara' AND c.conname = r.old_name
+    ) THEN
+      EXECUTE format('ALTER TABLE capybara.%I RENAME CONSTRAINT %I TO %I',
+                     r.tbl, r.old_name, r.new_name);
+    END IF;
+  END LOOP;
+END
+$$;
+
+-- A connected machine's source 'device' becomes 'local': the old CHECK goes, the rows change, and
+-- the CHECK comes back under the new name with the new list.
+ALTER TABLE devices DROP CONSTRAINT IF EXISTS environments_source_check;
+ALTER TABLE devices DROP CONSTRAINT IF EXISTS devices_source_check;
+UPDATE devices SET source = 'local' WHERE source = 'device';
+ALTER TABLE devices
+  ADD CONSTRAINT devices_source_check CHECK (source IN ('cloud', 'local'));
+
+-- The kernel-internal provider '@device' becomes '@local' wherever a provider name is stored.
+UPDATE devices SET provider = '@local' WHERE provider = '@device';
+UPDATE device_instances SET provider = '@local' WHERE provider = '@device';
+UPDATE device_instances SET prev_provider = '@local' WHERE prev_provider = '@device';
+
+-- The log event 'environment_paths' becomes 'device_paths' (its idempotency key prefix too); the
+-- rows are updated first, so the old partial index (0094) finds them, then the index follows.
+UPDATE conversation_events
+  SET type = 'device_paths',
+      idem_key = CASE
+        WHEN idem_key LIKE 'environment_paths:%' THEN 'device_paths:' || substr(idem_key, 19)
+        ELSE idem_key
+      END
+  WHERE type = 'environment_paths';
+DROP INDEX IF EXISTS conversation_events_environment_paths_idx;
+CREATE INDEX IF NOT EXISTS conversation_events_device_paths_idx
+  ON conversation_events (conversation_id, seq)
+  WHERE type = 'device_paths';
+
+-- Eval case snapshots carry the events of their run: the same event type change, order kept.
+-- snapshot_bytes is not recomputed: only type names change (a few bytes shorter), harmless.
+UPDATE eval_cases
+  SET snapshot = jsonb_set(snapshot, '{events}', (
+    SELECT jsonb_agg(
+      CASE WHEN e->>'type' = 'environment_paths' THEN jsonb_set(e, '{type}', '"device_paths"')
+           ELSE e END
+      ORDER BY ord)
+    FROM jsonb_array_elements(snapshot->'events') WITH ORDINALITY AS t(e, ord)))
+  WHERE snapshot @? '$.events[*] ? (@.type == "environment_paths")';

package/src/migrations/0106_setup_guides_v2.sql

@@ -0,0 +1,10 @@
+-- Setup guides v2 (spec 2026-11-09-setup-guides-v2-design.md §11, §15).
+-- A connector made from a connector template records the setup guide it was set up with:
+-- { guideId, version, hash, mode } (mode null: the place has no modes), recorded when the
+-- connector is created from the template and when an org admin confirms the third-party app was
+-- updated. NULL = unknown (connectors before this column, custom ones): no drift notice for those.
+ALTER TABLE connectors ADD COLUMN IF NOT EXISTS guide_ack jsonb;
+-- The v1 acks of channel connections hold v1 template hashes that no v2 hash can equal; keeping
+-- them would show every existing connection a false update notice. Cleared ("no ack, no notice"):
+-- those connections start tracking again at their next mode switch or ack.
+UPDATE channel_connections SET guide_ack = NULL WHERE guide_ack IS NOT NULL;

package/src/migrations/0107_extension_client_builds.sql

@@ -0,0 +1,50 @@
+-- Client extensions (spec 2026-11-09-client-extensions-design.md §9.1, §10.4).
+-- extension_client_builds: the client files of an extension package, keyed by the package sha256
+-- (the build id). The files live in object storage under `deployment/<object_prefix>`; the
+-- integrity values delivered to browsers come from this row, never from the object store.
+CREATE TABLE IF NOT EXISTS extension_client_builds (
+  package_sha256 text PRIMARY KEY REFERENCES extension_packages(sha256) ON DELETE CASCADE,
+  plugin text NOT NULL,
+  entry text,
+  styles text[] NOT NULL,
+  assets text[] NOT NULL,
+  integrity jsonb NOT NULL,
+  sizes jsonb NOT NULL,
+  api_version int NOT NULL,
+  object_prefix text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+-- extension_client_reports: crash and load reports of client code, one row per
+-- (plugin, build, org, contribution, kind); org_id is null for admin pages. Upserted, pruned after
+-- 30 days.
+CREATE TABLE IF NOT EXISTS extension_client_reports (
+  plugin text NOT NULL,
+  build text NOT NULL,
+  org_id text NULL,
+  contribution text NULL,
+  kind text NOT NULL CHECK (kind IN ('load', 'render', 'event', 'api', 'budget')),
+  count int NOT NULL DEFAULT 1,
+  first_at timestamptz NOT NULL DEFAULT now(),
+  last_at timestamptz NOT NULL DEFAULT now(),
+  last_message text NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS extension_client_reports_key_uq
+  ON extension_client_reports (
+    plugin, build, (coalesce(org_id, '')), (coalesce(contribution, '')), kind
+  );
+
+CREATE INDEX IF NOT EXISTS extension_client_reports_last_at
+  ON extension_client_reports (last_at);
+
+-- extension_replica_status.serving_sha256: the package a replica actually serves for the plugin
+-- (the row's own sha256 when loaded; the older package still running when the row's version is
+-- pending approval or failed; null when none runs). Client code follows the server code that runs
+-- (spec §9.3): a build is delivered while a live replica serves its package.
+ALTER TABLE extension_replica_status ADD COLUMN IF NOT EXISTS serving_sha256 text NULL;
+
+-- catalog_item_versions.appearance_order: the keys of plugin.json's
+-- suggestedAppearance.replacements in the author's order (a jsonb object does not keep key order),
+-- so the suggestion is listed and applied in that order (spec §6.5); null without replacements.
+ALTER TABLE catalog_item_versions ADD COLUMN IF NOT EXISTS appearance_order text[] NULL;

package/src/migrations/0108_question_skipped.sql

@@ -0,0 +1,6 @@
+-- A message from the run's starter closes a pending question as skipped (reply-while-question spec
+-- §6.2). Widening the inline CHECK of 0010 (PG's default name questions_status_check): drop and add
+-- in the file's one transaction, idempotent.
+ALTER TABLE questions DROP CONSTRAINT IF EXISTS questions_status_check;
+ALTER TABLE questions ADD CONSTRAINT questions_status_check
+  CHECK (status IN ('pending', 'answered', 'skipped', 'expired', 'cancelled'));

package/src/migrations/0109_audit_platform_idx.sql

@@ -0,0 +1,5 @@
+-- Platform-level audit events (org_id null), newest first: the admin overview's recent platform
+-- operations and /admin/audit page by keyset on id (admin overview spec §4.4, §5.4). A plain
+-- CREATE INDEX: the migrator runs each file in a transaction.
+CREATE INDEX IF NOT EXISTS audit_events_platform_idx
+  ON audit_events (id DESC) WHERE org_id IS NULL;

package/src/migrations/0110_usage_time_idx.sql

@@ -0,0 +1,8 @@
+-- The admin overview's seven-day usage aggregate (admin overview spec §4.3, §5.4) reads runs and
+-- embedding usage of every org by time: runs by created_at (only (conversation_id, created_at)
+-- existed) and model_usage by occurred_at (only (org_id, occurred_at) and a partial index on the
+-- unreported rows existed). Chat usage events already have conversation_events_usage_idx (0040).
+-- A plain CREATE INDEX: the migrator runs each file in a transaction, so not CONCURRENTLY; it
+-- locks writes to the table while it builds (pre-0.1.0: no large deployments).
+CREATE INDEX IF NOT EXISTS runs_created_idx ON runs (created_at);
+CREATE INDEX IF NOT EXISTS model_usage_time_idx ON model_usage (occurred_at);

package/src/migrations/0111_agent_skill_sharing.sql

@@ -0,0 +1,22 @@
+-- Skill authoring via the Platform tool: an agent's owner shares an agent skill with the org. The
+-- shared skill is an org skill (scope 'org') that remembers the agent it came from
+-- (origin_agent_id, cleared when that agent is deleted; the skill stays) and the account that
+-- maintains it (maintainer_account_id).
+ALTER TABLE skills
+  ADD COLUMN IF NOT EXISTS origin_agent_id text REFERENCES agents(id) ON DELETE SET NULL;
+ALTER TABLE skills
+  ADD COLUMN IF NOT EXISTS maintainer_account_id text REFERENCES accounts(id);
+-- The skills an agent shared, for its skill list and for sharing again.
+CREATE INDEX IF NOT EXISTS skills_origin_agent_idx
+  ON skills (origin_agent_id)
+  WHERE origin_agent_id IS NOT NULL AND deleted_at IS NULL;
+
+-- A request is either a share of an agent skill with the org or a new version of a shared skill.
+ALTER TABLE skill_change_requests
+  ADD COLUMN IF NOT EXISTS kind text NOT NULL DEFAULT 'version'
+    CHECK (kind IN ('share', 'version'));
+
+-- The R4 owner-approved change flow ends. The draft objects of the cancelled rows are left to the
+-- org data cleanup.
+-- capybara:allow-destructive R4 owner-approved changes are removed; pending ones cannot be decided any more
+UPDATE skill_change_requests SET status = 'cancelled', decided_at = now() WHERE status = 'pending';

package/src/migrations/0112_skill_share_requests.sql

@@ -0,0 +1,4 @@
+-- A share request of an agent skill comes from the agent page or the Platform operation and has
+-- no trial, so it records no conversation; a version proposal registered on the web has none
+-- either. requested_in_conversation becomes optional.
+ALTER TABLE skill_change_requests ALTER COLUMN requested_in_conversation DROP NOT NULL;

package/dist/catalog/upgrade-targets.d.ts

@@ -1,56 +0,0 @@
-import type { KernelSchemaDb } from "../db/kernel-schema.js";
-import type { ExtensionRegistry } from "../extensions/registry.js";
-/**
- * Which versions an org may upgrade an installed plugin to (package ecosystem spec §10, Decision
- * 10, Ruling 8):
- * - a plugin with an extension follows the deployment: the only target is the catalog version
- *   whose extension package (sha256) is the one installed on the deployment, the newest import on
- *   ties (`1.0.0` and `1.0.0+sha256.x` can share an extension version with different bytes); an
- *   extension loaded from the startup config (config, no package) is matched by its
- *   version;
- * - a purely declarative plugin may move to any other imported version (an older one is a
- *   rollback).
- */
-/** The extension the deployment runs for a plugin name. */
-export interface DeployedExtension {
-    /** The installed package's sha256 (null for a config extension). */
-    sha256: string | null;
-    version: string;
-}
-/** A catalog version row as the target rules read it. */
-export interface TargetVersion {
-    version: string;
-    manifest: unknown;
-    extension_sha256: string | null;
-    imported_at: Date;
-}
-/**
- * The deployment's extension for plugin `name`: its install record (`extension_installs`, the
- * deployment's desired package; disabled on the deployment counts as none), else the extension
- * this replica loaded from the startup config; undefined when the deployment runs none (then no
- * upgrade target and no "upgrade pending").
- */
-export declare function deployedExtension(db: KernelSchemaDb, host: Pick<ExtensionRegistry, "manifests">, name: string): Promise<DeployedExtension | undefined>;
-/** Whether catalog version `v` carries the deployment's extension `d`. */
-export declare const runsDeployed: (v: TargetVersion, d: DeployedExtension) => boolean;
-/**
- * The catalog version an org install of an extension-bearing plugin may move to: the one carrying
- * the deployment's extension, the newest import on ties; undefined when none does.
- */
-export declare function deploymentTarget(versions: readonly TargetVersion[], d: DeployedExtension | undefined): TargetVersion | undefined;
-/** What an install view says about upgrades (Decision 10). */
-export interface UpgradeInfo {
-    /** The version an upgrade can move to now (the highest allowed target), null when none. */
-    upgradeAvailable: string | null;
-    /** An extension-bearing plugin whose org version is not the one the deployment runs. */
-    deploymentPending: boolean;
-}
-/**
- * The upgrade info of org installs (`itemId`, `name`, `version`), keyed by `itemId@version`; reads
- * the items' catalog versions and the deployment's extensions in a few queries.
- */
-export declare function upgradeInfo(db: KernelSchemaDb, host: Pick<ExtensionRegistry, "manifests">, installs: readonly {
-    itemId: string;
-    name: string;
-    version: string;
-}[]): Promise<Map<string, UpgradeInfo>>;

package/dist/catalog/upgrade-targets.js

@@ -1,90 +0,0 @@
-import { compareVersions } from "./versions.js";
-/**
- * The deployment's extension for plugin `name`: its install record (`extension_installs`, the
- * deployment's desired package; disabled on the deployment counts as none), else the extension
- * this replica loaded from the startup config; undefined when the deployment runs none (then no
- * upgrade target and no "upgrade pending").
- */
-export async function deployedExtension(db, host, name) {
-    const row = await db
-        .selectFrom("extension_installs")
-        .select(["sha256", "version", "desired_state"])
-        .where("name", "=", name)
-        .executeTakeFirst();
-    if (row) {
-        return row.desired_state === "enabled"
-            ? { sha256: row.sha256, version: row.version }
-            : undefined;
-    }
-    const loaded = host.manifests().find((m) => m.name === name);
-    return loaded ? { sha256: null, version: loaded.version } : undefined;
-}
-const extensionVersionOf = (v) => v.manifest.extension?.manifest.version;
-/** Whether catalog version `v` carries the deployment's extension `d`. */
-export const runsDeployed = (v, d) => d.sha256 !== null
-    ? v.extension_sha256 === d.sha256
-    : v.manifest.extension !== undefined && extensionVersionOf(v) === d.version;
-/**
- * The catalog version an org install of an extension-bearing plugin may move to: the one carrying
- * the deployment's extension, the newest import on ties; undefined when none does.
- */
-export function deploymentTarget(versions, d) {
-    if (d === undefined)
-        return undefined;
-    let best;
-    for (const v of versions) {
-        if (!runsDeployed(v, d))
-            continue;
-        if (best === undefined ||
-            v.imported_at.getTime() > best.imported_at.getTime() ||
-            (v.imported_at.getTime() === best.imported_at.getTime() && compareVersions(v, best) > 0)) {
-            best = v;
-        }
-    }
-    return best;
-}
-/**
- * The upgrade info of org installs (`itemId`, `name`, `version`), keyed by `itemId@version`; reads
- * the items' catalog versions and the deployment's extensions in a few queries.
- */
-export async function upgradeInfo(db, host, installs) {
-    const out = new Map();
-    if (installs.length === 0)
-        return out;
-    const rows = await db
-        .selectFrom("catalog_item_versions")
-        .select(["item_id", "version", "manifest", "extension_sha256", "imported_at"])
-        .where("item_id", "in", [...new Set(installs.map((i) => i.itemId))])
-        .execute();
-    const deployed = new Map();
-    for (const i of installs) {
-        const versions = rows.filter((r) => r.item_id === i.itemId);
-        const current = versions.find((v) => v.version === i.version);
-        if (current && current.manifest.extension !== undefined) {
-            if (!deployed.has(i.name))
-                deployed.set(i.name, await deployedExtension(db, host, i.name));
-            const d = deployed.get(i.name);
-            const target = deploymentTarget(versions, d);
-            out.set(`${i.itemId}@${i.version}`, {
-                upgradeAvailable: target && target.version !== i.version ? target.version : null,
-                deploymentPending: d !== undefined && !runsDeployed(current, d),
-            });
-            continue;
-        }
-        let newest;
-        for (const v of versions) {
-            if (newest === undefined || compareVersions(v, newest) > 0)
-                newest = v;
-        }
-        const newer = newest !== undefined &&
-            newest.version !== i.version &&
-            (current === undefined
-                ? compareVersions(newest.version, i.version) > 0
-                : compareVersions(newest, current) > 0);
-        out.set(`${i.itemId}@${i.version}`, {
-            upgradeAvailable: newer ? newest.version : null,
-            deploymentPending: false,
-        });
-    }
-    return out;
-}

package/dist/conversations/sandbox-status.d.ts

@@ -1,24 +0,0 @@
-import { SandboxService } from "../sandbox/sandbox.service.js";
-import { ConversationAccess } from "./access.js";
-import { ConversationsService } from "./conversations.service.js";
-export interface SandboxStatusView {
-    status: "running" | "suspended";
-    lastUsedAt: string;
-}
-/**
- * 对话沙箱的状态（网页上下文标签，M5 T11）：会话不可见 → `conversation.not_found`；
- * 没有可用的沙箱（未创建、已销毁、正在创建）→ `sandbox.not_found`（界面显示「未创建」）。
- */
-export declare class ConversationSandboxStatus {
-    /** 会话可见性（与会话 SSE 流同一判定）。 */
-    private readonly access;
-    /** The conversation whose sandbox it works in: a sub-agent's parent, else itself. */
-    private readonly conversations;
-    private readonly sandbox;
-    constructor(
-    /** 会话可见性（与会话 SSE 流同一判定）。 */
-    access: Pick<ConversationAccess, "isAccessible">, 
-    /** The conversation whose sandbox it works in: a sub-agent's parent, else itself. */
-    conversations: Pick<ConversationsService, "sandboxConversationOf">, sandbox: Pick<SandboxService, "status">);
-    get(orgId: string, conversationId: string, viewerAccountId: string): Promise<SandboxStatusView>;
-}