@indx-workspace/embedded 0.0.0-bootstrap → 0.3.0

package/dist/migrations/0010_little_power_pack.sql

@@ -0,0 +1,66 @@
+CREATE TABLE "agent_grants" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"agent_id" uuid NOT NULL,
+	"user_id" uuid NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "agent_grants_workspace_agent_user_key" UNIQUE("workspace_id","agent_id","user_id")
+);
+--> statement-breakpoint
+ALTER TABLE "agents" ADD COLUMN "created_by" uuid;--> statement-breakpoint
+ALTER TABLE "files" ADD COLUMN "created_by" uuid;--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD COLUMN "created_by" uuid;--> statement-breakpoint
+ALTER TABLE "skills" ADD COLUMN "created_by" uuid;--> statement-breakpoint
+ALTER TABLE "agent_grants" ADD CONSTRAINT "agent_grants_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_grants" ADD CONSTRAINT "agent_grants_agent_workspace_fk" FOREIGN KEY ("agent_id","workspace_id") REFERENCES "public"."agents"("id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_grants" ADD CONSTRAINT "agent_grants_member_workspace_fk" FOREIGN KEY ("workspace_id","user_id") REFERENCES "public"."memberships"("workspace_id","user_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "agent_grants_agent_idx" ON "agent_grants" USING btree ("agent_id");--> statement-breakpoint
+CREATE INDEX "agent_grants_user_idx" ON "agent_grants" USING btree ("user_id");--> statement-breakpoint
+ALTER TABLE "agents" ADD CONSTRAINT "agents_created_by_workspace_fk" FOREIGN KEY ("workspace_id","created_by") REFERENCES "public"."memberships"("workspace_id","user_id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "files" ADD CONSTRAINT "files_created_by_workspace_fk" FOREIGN KEY ("workspace_id","created_by") REFERENCES "public"."memberships"("workspace_id","user_id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD CONSTRAINT "mcp_servers_created_by_workspace_fk" FOREIGN KEY ("workspace_id","created_by") REFERENCES "public"."memberships"("workspace_id","user_id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "skills" ADD CONSTRAINT "skills_created_by_workspace_fk" FOREIGN KEY ("workspace_id","created_by") REFERENCES "public"."memberships"("workspace_id","user_id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+-- Backfill (docs/adr/W9-AUTH-117-ownership-columns-and-backfill.md): every existing row is
+-- attributed to its workspace's oldest Owner membership, falling back to that workspace's oldest
+-- membership of any role only if it somehow has no Owner. An explicit, documented owner — never
+-- NULL, and never a guess finer-grained than "the workspace's own longest-standing member".
+UPDATE "agents" AS t
+SET "created_by" = owner.user_id
+FROM (
+	SELECT DISTINCT ON (m.workspace_id) m.workspace_id, m.user_id
+	FROM "memberships" m
+	ORDER BY m.workspace_id, (m.role = 'owner') DESC, m.created_at ASC, m.id ASC
+) AS owner
+WHERE t.workspace_id = owner.workspace_id AND t."created_by" IS NULL;
+--> statement-breakpoint
+UPDATE "files" AS t
+SET "created_by" = owner.user_id
+FROM (
+	SELECT DISTINCT ON (m.workspace_id) m.workspace_id, m.user_id
+	FROM "memberships" m
+	ORDER BY m.workspace_id, (m.role = 'owner') DESC, m.created_at ASC, m.id ASC
+) AS owner
+WHERE t.workspace_id = owner.workspace_id AND t."created_by" IS NULL;
+--> statement-breakpoint
+UPDATE "mcp_servers" AS t
+SET "created_by" = owner.user_id
+FROM (
+	SELECT DISTINCT ON (m.workspace_id) m.workspace_id, m.user_id
+	FROM "memberships" m
+	ORDER BY m.workspace_id, (m.role = 'owner') DESC, m.created_at ASC, m.id ASC
+) AS owner
+WHERE t.workspace_id = owner.workspace_id AND t."created_by" IS NULL;
+--> statement-breakpoint
+UPDATE "skills" AS t
+SET "created_by" = owner.user_id
+FROM (
+	SELECT DISTINCT ON (m.workspace_id) m.workspace_id, m.user_id
+	FROM "memberships" m
+	ORDER BY m.workspace_id, (m.role = 'owner') DESC, m.created_at ASC, m.id ASC
+) AS owner
+WHERE t.workspace_id = owner.workspace_id AND t."created_by" IS NULL;
+--> statement-breakpoint
+ALTER TABLE "agents" ALTER COLUMN "created_by" SET NOT NULL;--> statement-breakpoint
+ALTER TABLE "files" ALTER COLUMN "created_by" SET NOT NULL;--> statement-breakpoint
+ALTER TABLE "mcp_servers" ALTER COLUMN "created_by" SET NOT NULL;--> statement-breakpoint
+ALTER TABLE "skills" ALTER COLUMN "created_by" SET NOT NULL;

package/dist/migrations/0011_goofy_storm.sql

@@ -0,0 +1,14 @@
+CREATE TABLE "user_identities" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"issuer" text NOT NULL,
+	"subject" text NOT NULL,
+	"user_id" uuid NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "user_identities_issuer_subject_key" UNIQUE("issuer","subject"),
+	CONSTRAINT "user_identities_issuer_not_blank" CHECK (length(btrim("user_identities"."issuer")) > 0),
+	CONSTRAINT "user_identities_subject_not_blank" CHECK (length(btrim("user_identities"."subject")) > 0)
+);
+--> statement-breakpoint
+ALTER TABLE "user_identities" ADD CONSTRAINT "user_identities_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "user_identities_user_idx" ON "user_identities" USING btree ("user_id");

package/dist/migrations/0012_legal_shatterstar.sql

@@ -0,0 +1,14 @@
+ALTER TABLE "projects" ADD COLUMN "default_model_connection_id" uuid;--> statement-breakpoint
+ALTER TABLE "projects" ADD COLUMN "default_model" text;--> statement-breakpoint
+ALTER TABLE "runs" ADD COLUMN "model_connection_id" uuid;--> statement-breakpoint
+ALTER TABLE "workspaces" ADD COLUMN "default_model_connection_id" uuid;--> statement-breakpoint
+ALTER TABLE "workspaces" ADD COLUMN "default_model" text;--> statement-breakpoint
+ALTER TABLE "projects" ADD CONSTRAINT "projects_default_model_connection_id_model_connections_id_fk" FOREIGN KEY ("default_model_connection_id") REFERENCES "public"."model_connections"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "projects" ADD CONSTRAINT "projects_default_model_connection_workspace_fk" FOREIGN KEY ("default_model_connection_id","workspace_id") REFERENCES "public"."model_connections"("id","workspace_id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "runs" ADD CONSTRAINT "runs_model_connection_id_model_connections_id_fk" FOREIGN KEY ("model_connection_id") REFERENCES "public"."model_connections"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "runs" ADD CONSTRAINT "runs_model_connection_workspace_fk" FOREIGN KEY ("model_connection_id","workspace_id") REFERENCES "public"."model_connections"("id","workspace_id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "workspaces" ADD CONSTRAINT "workspaces_default_model_connection_id_model_connections_id_fk" FOREIGN KEY ("default_model_connection_id") REFERENCES "public"."model_connections"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "workspaces" ADD CONSTRAINT "workspaces_default_model_connection_workspace_fk" FOREIGN KEY ("default_model_connection_id","id") REFERENCES "public"."model_connections"("id","workspace_id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "runs_model_connection_idx" ON "runs" USING btree ("model_connection_id");--> statement-breakpoint
+ALTER TABLE "projects" ADD CONSTRAINT "projects_default_model_pair" CHECK (("projects"."default_model_connection_id" is null) = ("projects"."default_model" is null));--> statement-breakpoint
+ALTER TABLE "workspaces" ADD CONSTRAINT "workspaces_default_model_pair" CHECK (("workspaces"."default_model_connection_id" is null) = ("workspaces"."default_model" is null));

package/dist/migrations/0013_secret_namora.sql

@@ -0,0 +1,9 @@
+ALTER TABLE "run_usage_records" ALTER COLUMN "price_table_version" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "runs" ADD COLUMN "accounting_state" text DEFAULT 'pending' NOT NULL;--> statement-breakpoint
+ALTER TABLE "runs" ADD COLUMN "accounting_error" text;--> statement-breakpoint
+ALTER TABLE "runs" ADD CONSTRAINT "runs_accounting_state_valid" CHECK ("runs"."accounting_state" in ('pending', 'complete', 'partial', 'failed', 'unavailable'));--> statement-breakpoint
+-- Backfill only: at this point in the migration no row can have been inserted under the new
+-- 'pending' default yet, so every row this UPDATE reaches predates issue #134's settlement path.
+-- They were never durably settled by it, and defaulting them to 'complete' would be exactly the
+-- false zero this column exists to remove — 'unavailable' says the accounting is unknown, not good.
+UPDATE "runs" SET "accounting_state" = 'unavailable';

package/dist/migrations/0014_premium_vengeance.sql

@@ -0,0 +1,16 @@
+CREATE TABLE "share_run_charges" (
+	"run_id" uuid PRIMARY KEY NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"share_id" uuid NOT NULL,
+	"charged_usd" numeric(14, 6) DEFAULT '0' NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "share_run_charges_nonnegative" CHECK ("share_run_charges"."charged_usd" >= 0)
+);
+--> statement-breakpoint
+ALTER TABLE "shares" ALTER COLUMN "spent_usd" SET DATA TYPE numeric(14, 6);--> statement-breakpoint
+ALTER TABLE "shares" ALTER COLUMN "spent_usd" SET DEFAULT '0';--> statement-breakpoint
+ALTER TABLE "share_run_charges" ADD CONSTRAINT "share_run_charges_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "share_run_charges" ADD CONSTRAINT "share_run_charges_share_workspace_fk" FOREIGN KEY ("share_id","workspace_id") REFERENCES "public"."shares"("id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "share_run_charges" ADD CONSTRAINT "share_run_charges_run_workspace_fk" FOREIGN KEY ("run_id","workspace_id") REFERENCES "public"."runs"("id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "share_run_charges_workspace_share_idx" ON "share_run_charges" USING btree ("workspace_id","share_id");

package/dist/migrations/0015_amazing_screwball.sql

@@ -0,0 +1 @@
+ALTER TABLE "workspaces" ADD COLUMN "archived_at" timestamp with time zone;

package/dist/migrations/0016_next_satana.sql

@@ -0,0 +1,29 @@
+CREATE TABLE "invitations" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"email" text NOT NULL,
+	"role" text NOT NULL,
+	"invited_by" uuid,
+	"token_hash" text NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"accepted_at" timestamp with time zone,
+	"revoked_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "invitations_role_valid" CHECK ("invitations"."role" in ('owner', 'admin', 'builder', 'viewer')),
+	CONSTRAINT "invitations_email_lowercase" CHECK ("invitations"."email" = lower("invitations"."email")),
+	CONSTRAINT "invitations_email_shape" CHECK ("invitations"."email" ~ '^[^[:space:]@]+@[^[:space:]@]+[.][^[:space:]@]+$'),
+	CONSTRAINT "invitations_token_hash_not_blank" CHECK (length(btrim("invitations"."token_hash")) > 0),
+	CONSTRAINT "invitations_expires_after_created" CHECK ("invitations"."expires_at" > "invitations"."created_at"),
+	CONSTRAINT "invitations_accepted_after_created" CHECK ("invitations"."accepted_at" is null or "invitations"."accepted_at" >= "invitations"."created_at"),
+	CONSTRAINT "invitations_revoked_after_created" CHECK ("invitations"."revoked_at" is null or "invitations"."revoked_at" >= "invitations"."created_at"),
+	CONSTRAINT "invitations_not_accepted_and_revoked" CHECK ("invitations"."accepted_at" is null or "invitations"."revoked_at" is null)
+);
+--> statement-breakpoint
+ALTER TABLE "audit_events" DROP CONSTRAINT "audit_events_action_valid";--> statement-breakpoint
+ALTER TABLE "invitations" ADD CONSTRAINT "invitations_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "invitations" ADD CONSTRAINT "invitations_invited_by_users_id_fk" FOREIGN KEY ("invited_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "invitations_workspace_email_pending_key" ON "invitations" USING btree ("workspace_id","email") WHERE "invitations"."accepted_at" is null and "invitations"."revoked_at" is null;--> statement-breakpoint
+CREATE INDEX "invitations_workspace_idx" ON "invitations" USING btree ("workspace_id","created_at");--> statement-breakpoint
+CREATE INDEX "invitations_invited_by_idx" ON "invitations" USING btree ("invited_by");--> statement-breakpoint
+ALTER TABLE "audit_events" ADD CONSTRAINT "audit_events_action_valid" CHECK ("audit_events"."action" in ('user-created', 'user-deleted', 'agent-changed', 'provider-credential-changed', 'api-key-created', 'api-key-revoked', 'connector-changed', 'permission-changed', 'runtime-profile-changed', 'project-created', 'project-deleted', 'session-published', 'public-link-revoked', 'runnable-link-stopped', 'public-sharing-policy-changed', 'invitation-created', 'invitation-resent', 'invitation-revoked', 'invitation-accepted'));

package/dist/migrations/0017_wild_the_executioner.sql

@@ -0,0 +1 @@
+ALTER TABLE "projects" ADD COLUMN "archived_at" timestamp with time zone;

package/dist/migrations/0018_heavy_stone_men.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "audit_events" DROP CONSTRAINT "audit_events_action_valid";--> statement-breakpoint
+ALTER TABLE "audit_events" ADD CONSTRAINT "audit_events_action_valid" CHECK ("audit_events"."action" in ('user-created', 'user-deleted', 'agent-changed', 'provider-credential-changed', 'api-key-created', 'api-key-revoked', 'connector-changed', 'permission-changed', 'runtime-profile-changed', 'project-created', 'project-deleted', 'project-archived', 'project-restored', 'session-published', 'public-link-revoked', 'runnable-link-stopped', 'public-sharing-policy-changed', 'invitation-created', 'invitation-resent', 'invitation-revoked', 'invitation-accepted'));

package/dist/migrations/0019_repair_legacy_run_accounting.sql

@@ -0,0 +1,20 @@
+-- Before this release, session rows existed without their SDK identity even after they had runs.
+-- Fresh launches have always supplied the platform session UUID to Claude, so a run proves the
+-- conversation exists under that same identity. Preserve resume behavior across the upgrade.
+UPDATE "sessions"
+SET "claude_session_id" = "id"
+WHERE "claude_session_id" IS NULL
+  AND EXISTS (
+    SELECT 1
+    FROM "runs"
+    WHERE "runs"."session_id" = "sessions"."id"
+  );--> statement-breakpoint
+-- Migration 0013 conservatively marked every pre-accounting run unavailable, including rows that
+-- already had a real price-table version and cost. Those rows were fully priced under the old
+-- non-null ledger contract, so restore the state their durable data proves before adding guards.
+UPDATE "runs"
+SET "accounting_state" = 'complete'
+WHERE "accounting_state" = 'unavailable'
+  AND "price_table_version" IS NOT NULL;--> statement-breakpoint
+ALTER TABLE "runs" ADD CONSTRAINT "runs_price_version_matches_accounting_state" CHECK (("runs"."accounting_state" in ('complete', 'partial')) = ("runs"."price_table_version" is not null));--> statement-breakpoint
+ALTER TABLE "runs" ADD CONSTRAINT "runs_unpriced_cost_zero" CHECK ("runs"."accounting_state" in ('complete', 'partial') or "runs"."cost_usd" = 0);

package/dist/migrations/0020_sparkling_nova.sql

@@ -0,0 +1,340 @@
+-- RF-101 is intentionally one transactional migration because the repository's Drizzle
+-- migrator wraps every pending statement in a single transaction. The set-based backfill below
+-- is therefore atomic, but it is not an online/bounded-batch job: locks and WAL are retained until
+-- commit. Deployments must rehearse production-shaped row counts and coordinate the DDL lock
+-- window. Compatibility triggers installed below keep prior-version human writers working after
+-- commit; CREATE INDEX CONCURRENTLY still cannot run inside this migrator transaction.
+CREATE TABLE "workspace_principals" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"kind" text NOT NULL,
+	"membership_id" uuid,
+	"api_key_id" uuid,
+	"activated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"revoked_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "workspace_principals_workspace_id_key" UNIQUE("workspace_id","id"),
+	CONSTRAINT "workspace_principals_workspace_membership_key" UNIQUE("workspace_id","membership_id"),
+	CONSTRAINT "workspace_principals_workspace_api_key_key" UNIQUE("workspace_id","api_key_id"),
+	CONSTRAINT "workspace_principals_kind_valid" CHECK ("workspace_principals"."kind" in ('membership', 'api_key')),
+	CONSTRAINT "workspace_principals_source_xor" CHECK (("workspace_principals"."kind" = 'membership' and "workspace_principals"."membership_id" is not null and "workspace_principals"."api_key_id" is null)
+        or ("workspace_principals"."kind" = 'api_key' and "workspace_principals"."api_key_id" is not null and "workspace_principals"."membership_id" is null)),
+	CONSTRAINT "workspace_principals_revoked_after_activation" CHECK ("workspace_principals"."revoked_at" is null or "workspace_principals"."revoked_at" >= "workspace_principals"."activated_at")
+);
+--> statement-breakpoint
+-- The redundant workspace/id keys are the tenant-paired FK targets. Primary keys prove global
+-- uniqueness, while these constraints also prove that a source belongs to this workspace.
+ALTER TABLE "api_keys" ADD CONSTRAINT "api_keys_workspace_id_key" UNIQUE("workspace_id","id");--> statement-breakpoint
+ALTER TABLE "memberships" ADD CONSTRAINT "memberships_workspace_id_key" UNIQUE("workspace_id","id");--> statement-breakpoint
+ALTER TABLE "workspace_principals" ADD CONSTRAINT "workspace_principals_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "workspace_principals" ADD CONSTRAINT "workspace_principals_membership_workspace_fk" FOREIGN KEY ("workspace_id","membership_id") REFERENCES "public"."memberships"("workspace_id","id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "workspace_principals" ADD CONSTRAINT "workspace_principals_api_key_workspace_fk" FOREIGN KEY ("workspace_id","api_key_id") REFERENCES "public"."api_keys"("workspace_id","id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+
+-- Every existing source receives exactly one principal. Source timestamps preserve when the
+-- identity became active; revoked API keys remain historical principals and cannot authenticate.
+INSERT INTO "workspace_principals" ("workspace_id", "kind", "membership_id", "activated_at")
+SELECT m."workspace_id", 'membership', m."id", m."created_at"
+FROM "memberships" AS m
+ON CONFLICT ("workspace_id", "membership_id") DO NOTHING;--> statement-breakpoint
+INSERT INTO "workspace_principals" ("workspace_id", "kind", "api_key_id", "activated_at", "revoked_at")
+SELECT k."workspace_id", 'api_key', k."id", k."created_at", k."revoked_at"
+FROM "api_keys" AS k
+ON CONFLICT ("workspace_id", "api_key_id") DO NOTHING;--> statement-breakpoint
+
+-- Compatibility columns stay available for human rows, but become nullable so a machine-owned
+-- row is never stamped with an invented human. Principal columns are added nullable for the
+-- backfill and tightened only after the invariant queries below succeed.
+ALTER TABLE "agents" ALTER COLUMN "created_by" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "files" ALTER COLUMN "created_by" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "mcp_servers" ALTER COLUMN "created_by" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "projects" ALTER COLUMN "created_by" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "sessions" ALTER COLUMN "user_id" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "shares" ALTER COLUMN "created_by" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "skills" ALTER COLUMN "created_by" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "agents" ADD COLUMN "owner_principal_id" uuid;--> statement-breakpoint
+ALTER TABLE "audit_events" ADD COLUMN "actor_principal_id" uuid;--> statement-breakpoint
+ALTER TABLE "files" ADD COLUMN "owner_principal_id" uuid;--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD COLUMN "owner_principal_id" uuid;--> statement-breakpoint
+ALTER TABLE "projects" ADD COLUMN "owner_principal_id" uuid;--> statement-breakpoint
+ALTER TABLE "sessions" ADD COLUMN "owner_principal_id" uuid;--> statement-breakpoint
+ALTER TABLE "shares" ADD COLUMN "publisher_principal_id" uuid;--> statement-breakpoint
+ALTER TABLE "skills" ADD COLUMN "owner_principal_id" uuid;--> statement-breakpoint
+
+-- Rolling compatibility. A prior-version process knows only the legacy human user columns. It
+-- must neither fail against the new NOT NULL columns nor invent a principal. Resolve the exact
+-- same-workspace Membership principal, creating it on demand only when the Membership itself is
+-- real. Machine writers must continue to supply their API-key principal explicitly.
+CREATE FUNCTION "public"."rf101_compat_membership_principal_id"("target_workspace_id" uuid, "target_user_id" uuid)
+RETURNS uuid
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $$
+DECLARE
+	"resolved_principal_id" uuid;
+BEGIN
+	IF "target_user_id" IS NULL THEN
+		RETURN NULL;
+	END IF;
+
+	SELECT principal."id" INTO "resolved_principal_id"
+	FROM "public"."memberships" AS member
+	JOIN "public"."workspace_principals" AS principal
+		ON principal."workspace_id" = member."workspace_id"
+		AND principal."membership_id" = member."id"
+	WHERE member."workspace_id" = "target_workspace_id"
+		AND member."user_id" = "target_user_id";
+
+	IF "resolved_principal_id" IS NOT NULL THEN
+		RETURN "resolved_principal_id";
+	END IF;
+
+	INSERT INTO "public"."workspace_principals" ("workspace_id", "kind", "membership_id", "activated_at")
+	SELECT member."workspace_id", 'membership', member."id", member."created_at"
+	FROM "public"."memberships" AS member
+	WHERE member."workspace_id" = "target_workspace_id"
+		AND member."user_id" = "target_user_id"
+	ON CONFLICT ("workspace_id", "membership_id") DO NOTHING;
+
+	SELECT principal."id" INTO "resolved_principal_id"
+	FROM "public"."memberships" AS member
+	JOIN "public"."workspace_principals" AS principal
+		ON principal."workspace_id" = member."workspace_id"
+		AND principal."membership_id" = member."id"
+	WHERE member."workspace_id" = "target_workspace_id"
+		AND member."user_id" = "target_user_id";
+
+	RETURN "resolved_principal_id";
+END
+$$;--> statement-breakpoint
+
+CREATE FUNCTION "public"."rf101_compat_owner_from_creator"()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $$
+BEGIN
+	IF NEW."owner_principal_id" IS NULL THEN
+		NEW."owner_principal_id" := "public"."rf101_compat_membership_principal_id"(
+			NEW."workspace_id", NEW."created_by"
+		);
+	END IF;
+	RETURN NEW;
+END
+$$;--> statement-breakpoint
+
+CREATE FUNCTION "public"."rf101_compat_session_owner"()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $$
+BEGIN
+	IF NEW."owner_principal_id" IS NULL THEN
+		NEW."owner_principal_id" := "public"."rf101_compat_membership_principal_id"(
+			NEW."workspace_id", NEW."user_id"
+		);
+	END IF;
+	RETURN NEW;
+END
+$$;--> statement-breakpoint
+
+CREATE FUNCTION "public"."rf101_compat_share_publisher"()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $$
+BEGIN
+	IF NEW."publisher_principal_id" IS NULL THEN
+		NEW."publisher_principal_id" := "public"."rf101_compat_membership_principal_id"(
+			NEW."workspace_id", NEW."created_by"
+		);
+	END IF;
+	RETURN NEW;
+END
+$$;--> statement-breakpoint
+
+CREATE FUNCTION "public"."rf101_compat_audit_actor"()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $$
+BEGIN
+	IF NEW."actor_principal_id" IS NULL THEN
+		NEW."actor_principal_id" := "public"."rf101_compat_membership_principal_id"(
+			NEW."workspace_id", NEW."actor_user_id"
+		);
+	END IF;
+	RETURN NEW;
+END
+$$;--> statement-breakpoint
+
+CREATE TRIGGER "agents_rf101_compat_owner" BEFORE INSERT OR UPDATE OF "created_by" ON "public"."agents"
+FOR EACH ROW EXECUTE FUNCTION "public"."rf101_compat_owner_from_creator"();--> statement-breakpoint
+CREATE TRIGGER "files_rf101_compat_owner" BEFORE INSERT OR UPDATE OF "created_by" ON "public"."files"
+FOR EACH ROW EXECUTE FUNCTION "public"."rf101_compat_owner_from_creator"();--> statement-breakpoint
+CREATE TRIGGER "skills_rf101_compat_owner" BEFORE INSERT OR UPDATE OF "created_by" ON "public"."skills"
+FOR EACH ROW EXECUTE FUNCTION "public"."rf101_compat_owner_from_creator"();--> statement-breakpoint
+CREATE TRIGGER "mcp_servers_rf101_compat_owner" BEFORE INSERT OR UPDATE OF "created_by" ON "public"."mcp_servers"
+FOR EACH ROW EXECUTE FUNCTION "public"."rf101_compat_owner_from_creator"();--> statement-breakpoint
+CREATE TRIGGER "projects_rf101_compat_owner" BEFORE INSERT OR UPDATE OF "created_by" ON "public"."projects"
+FOR EACH ROW EXECUTE FUNCTION "public"."rf101_compat_owner_from_creator"();--> statement-breakpoint
+CREATE TRIGGER "sessions_rf101_compat_owner" BEFORE INSERT OR UPDATE OF "user_id" ON "public"."sessions"
+FOR EACH ROW EXECUTE FUNCTION "public"."rf101_compat_session_owner"();--> statement-breakpoint
+CREATE TRIGGER "shares_rf101_compat_publisher" BEFORE INSERT OR UPDATE OF "created_by" ON "public"."shares"
+FOR EACH ROW EXECUTE FUNCTION "public"."rf101_compat_share_publisher"();--> statement-breakpoint
+CREATE TRIGGER "audit_events_rf101_compat_actor" BEFORE INSERT OR UPDATE OF "actor_user_id" ON "public"."audit_events"
+FOR EACH ROW EXECUTE FUNCTION "public"."rf101_compat_audit_actor"();--> statement-breakpoint
+
+-- A prior-version writer can also create a Membership or API key without its new principal row.
+-- Deferred source triggers let a current writer insert its chosen principal in the same
+-- transaction; otherwise they create the exact source principal at commit.
+CREATE FUNCTION "public"."rf101_compat_ensure_membership_principal"()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $$
+BEGIN
+	INSERT INTO "public"."workspace_principals" ("workspace_id", "kind", "membership_id", "activated_at")
+	VALUES (NEW."workspace_id", 'membership', NEW."id", NEW."created_at")
+	ON CONFLICT ("workspace_id", "membership_id") DO NOTHING;
+	RETURN NULL;
+END
+$$;--> statement-breakpoint
+
+CREATE FUNCTION "public"."rf101_compat_ensure_api_key_principal"()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $$
+BEGIN
+	INSERT INTO "public"."workspace_principals" (
+		"workspace_id", "kind", "api_key_id", "activated_at", "revoked_at"
+	)
+	VALUES (NEW."workspace_id", 'api_key', NEW."id", NEW."created_at", NEW."revoked_at")
+	ON CONFLICT ("workspace_id", "api_key_id") DO NOTHING;
+	RETURN NULL;
+END
+$$;--> statement-breakpoint
+
+CREATE FUNCTION "public"."rf101_compat_sync_api_key_revocation"()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $$
+BEGIN
+	UPDATE "public"."workspace_principals"
+	SET "revoked_at" = NEW."revoked_at"
+	WHERE "workspace_id" = NEW."workspace_id" AND "api_key_id" = NEW."id";
+	RETURN NULL;
+END
+$$;--> statement-breakpoint
+
+CREATE CONSTRAINT TRIGGER "memberships_rf101_compat_principal"
+AFTER INSERT ON "public"."memberships" DEFERRABLE INITIALLY DEFERRED
+FOR EACH ROW EXECUTE FUNCTION "public"."rf101_compat_ensure_membership_principal"();--> statement-breakpoint
+CREATE CONSTRAINT TRIGGER "api_keys_rf101_compat_principal"
+AFTER INSERT ON "public"."api_keys" DEFERRABLE INITIALLY DEFERRED
+FOR EACH ROW EXECUTE FUNCTION "public"."rf101_compat_ensure_api_key_principal"();--> statement-breakpoint
+CREATE TRIGGER "api_keys_rf101_compat_revocation"
+AFTER UPDATE OF "revoked_at" ON "public"."api_keys"
+FOR EACH ROW EXECUTE FUNCTION "public"."rf101_compat_sync_api_key_revocation"();--> statement-breakpoint
+
+-- Projects historically had only a users(id) creator FK. Refuse anomalous data rather than
+-- guessing another person or silently creating an unapproved workspace-system principal.
+DO $$
+BEGIN
+	IF EXISTS (
+		SELECT 1
+		FROM "projects" AS project
+		LEFT JOIN "memberships" AS member
+			ON member."workspace_id" = project."workspace_id"
+			AND member."user_id" = project."created_by"
+		WHERE member."id" IS NULL
+	) THEN
+		RAISE EXCEPTION USING
+			ERRCODE = '23514',
+			MESSAGE = 'RF-101 cannot map one or more project creators to a same-workspace membership';
+	END IF;
+END
+$$;--> statement-breakpoint
+
+UPDATE "agents" AS owned SET "owner_principal_id" = principal."id"
+FROM "memberships" AS member JOIN "workspace_principals" AS principal
+	ON principal."workspace_id" = member."workspace_id" AND principal."membership_id" = member."id"
+WHERE member."workspace_id" = owned."workspace_id" AND member."user_id" = owned."created_by";--> statement-breakpoint
+UPDATE "files" AS owned SET "owner_principal_id" = principal."id"
+FROM "memberships" AS member JOIN "workspace_principals" AS principal
+	ON principal."workspace_id" = member."workspace_id" AND principal."membership_id" = member."id"
+WHERE member."workspace_id" = owned."workspace_id" AND member."user_id" = owned."created_by";--> statement-breakpoint
+UPDATE "skills" AS owned SET "owner_principal_id" = principal."id"
+FROM "memberships" AS member JOIN "workspace_principals" AS principal
+	ON principal."workspace_id" = member."workspace_id" AND principal."membership_id" = member."id"
+WHERE member."workspace_id" = owned."workspace_id" AND member."user_id" = owned."created_by";--> statement-breakpoint
+UPDATE "mcp_servers" AS owned SET "owner_principal_id" = principal."id"
+FROM "memberships" AS member JOIN "workspace_principals" AS principal
+	ON principal."workspace_id" = member."workspace_id" AND principal."membership_id" = member."id"
+WHERE member."workspace_id" = owned."workspace_id" AND member."user_id" = owned."created_by";--> statement-breakpoint
+UPDATE "projects" AS owned SET "owner_principal_id" = principal."id"
+FROM "memberships" AS member JOIN "workspace_principals" AS principal
+	ON principal."workspace_id" = member."workspace_id" AND principal."membership_id" = member."id"
+WHERE member."workspace_id" = owned."workspace_id" AND member."user_id" = owned."created_by";--> statement-breakpoint
+UPDATE "sessions" AS owned SET "owner_principal_id" = principal."id"
+FROM "memberships" AS member JOIN "workspace_principals" AS principal
+	ON principal."workspace_id" = member."workspace_id" AND principal."membership_id" = member."id"
+WHERE member."workspace_id" = owned."workspace_id" AND member."user_id" = owned."user_id";--> statement-breakpoint
+UPDATE "shares" AS owned SET "publisher_principal_id" = principal."id"
+FROM "memberships" AS member JOIN "workspace_principals" AS principal
+	ON principal."workspace_id" = member."workspace_id" AND principal."membership_id" = member."id"
+WHERE member."workspace_id" = owned."workspace_id" AND member."user_id" = owned."created_by";--> statement-breakpoint
+-- Actor attribution is nullable by design. Only an exact surviving same-workspace membership is
+-- backfilled; actor_label remains the historical record when the user or membership is gone.
+UPDATE "audit_events" AS event SET "actor_principal_id" = principal."id"
+FROM "memberships" AS member JOIN "workspace_principals" AS principal
+	ON principal."workspace_id" = member."workspace_id" AND principal."membership_id" = member."id"
+WHERE member."workspace_id" = event."workspace_id" AND member."user_id" = event."actor_user_id";--> statement-breakpoint
+
+DO $$
+BEGIN
+	IF EXISTS (SELECT 1 FROM "agents" WHERE "owner_principal_id" IS NULL)
+		OR EXISTS (SELECT 1 FROM "files" WHERE "owner_principal_id" IS NULL)
+		OR EXISTS (SELECT 1 FROM "skills" WHERE "owner_principal_id" IS NULL)
+		OR EXISTS (SELECT 1 FROM "mcp_servers" WHERE "owner_principal_id" IS NULL)
+		OR EXISTS (SELECT 1 FROM "projects" WHERE "owner_principal_id" IS NULL)
+		OR EXISTS (SELECT 1 FROM "sessions" WHERE "owner_principal_id" IS NULL)
+		OR EXISTS (SELECT 1 FROM "shares" WHERE "publisher_principal_id" IS NULL)
+	THEN
+		RAISE EXCEPTION USING
+			ERRCODE = '23514',
+			MESSAGE = 'RF-101 principal ownership backfill left one or more required rows unmapped';
+	END IF;
+END
+$$;--> statement-breakpoint
+
+-- Required ownership must be complete before constraints are installed. SET NOT NULL is safe in
+-- this drained transactional cutover only after the exact backfill above has mapped every row.
+ALTER TABLE "agents" ALTER COLUMN "owner_principal_id" SET NOT NULL;--> statement-breakpoint
+ALTER TABLE "files" ALTER COLUMN "owner_principal_id" SET NOT NULL;--> statement-breakpoint
+ALTER TABLE "mcp_servers" ALTER COLUMN "owner_principal_id" SET NOT NULL;--> statement-breakpoint
+ALTER TABLE "projects" ALTER COLUMN "owner_principal_id" SET NOT NULL;--> statement-breakpoint
+ALTER TABLE "sessions" ALTER COLUMN "owner_principal_id" SET NOT NULL;--> statement-breakpoint
+ALTER TABLE "shares" ALTER COLUMN "publisher_principal_id" SET NOT NULL;--> statement-breakpoint
+ALTER TABLE "skills" ALTER COLUMN "owner_principal_id" SET NOT NULL;--> statement-breakpoint
+
+CREATE INDEX "workspace_principals_workspace_revoked_idx" ON "workspace_principals" USING btree ("workspace_id","revoked_at");--> statement-breakpoint
+CREATE INDEX "agents_owner_principal_idx" ON "agents" USING btree ("owner_principal_id");--> statement-breakpoint
+CREATE INDEX "audit_events_actor_principal_idx" ON "audit_events" USING btree ("actor_principal_id");--> statement-breakpoint
+CREATE INDEX "files_workspace_owner_principal_idx" ON "files" USING btree ("workspace_id","owner_principal_id");--> statement-breakpoint
+CREATE INDEX "mcp_servers_owner_principal_idx" ON "mcp_servers" USING btree ("owner_principal_id");--> statement-breakpoint
+CREATE INDEX "projects_owner_principal_idx" ON "projects" USING btree ("owner_principal_id");--> statement-breakpoint
+CREATE INDEX "sessions_owner_principal_idx" ON "sessions" USING btree ("owner_principal_id");--> statement-breakpoint
+CREATE INDEX "shares_publisher_principal_idx" ON "shares" USING btree ("publisher_principal_id");--> statement-breakpoint
+CREATE INDEX "skills_owner_principal_idx" ON "skills" USING btree ("owner_principal_id");--> statement-breakpoint
+ALTER TABLE "agents" ADD CONSTRAINT "agents_owner_principal_workspace_fk" FOREIGN KEY ("workspace_id","owner_principal_id") REFERENCES "public"."workspace_principals"("workspace_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+-- Preserve immutable audit tenant/label history when a source principal disappears. PostgreSQL's
+-- column-list SET NULL clears only the nullable actor id; workspace_id remains required and intact.
+ALTER TABLE "audit_events" ADD CONSTRAINT "audit_events_actor_principal_workspace_fk" FOREIGN KEY ("workspace_id","actor_principal_id") REFERENCES "public"."workspace_principals"("workspace_id","id") ON DELETE SET NULL ("actor_principal_id") ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "files" ADD CONSTRAINT "files_owner_principal_workspace_fk" FOREIGN KEY ("workspace_id","owner_principal_id") REFERENCES "public"."workspace_principals"("workspace_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD CONSTRAINT "mcp_servers_owner_principal_workspace_fk" FOREIGN KEY ("workspace_id","owner_principal_id") REFERENCES "public"."workspace_principals"("workspace_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "projects" ADD CONSTRAINT "projects_owner_principal_workspace_fk" FOREIGN KEY ("workspace_id","owner_principal_id") REFERENCES "public"."workspace_principals"("workspace_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_owner_principal_workspace_fk" FOREIGN KEY ("workspace_id","owner_principal_id") REFERENCES "public"."workspace_principals"("workspace_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "shares" ADD CONSTRAINT "shares_publisher_principal_workspace_fk" FOREIGN KEY ("workspace_id","publisher_principal_id") REFERENCES "public"."workspace_principals"("workspace_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "skills" ADD CONSTRAINT "skills_owner_principal_workspace_fk" FOREIGN KEY ("workspace_id","owner_principal_id") REFERENCES "public"."workspace_principals"("workspace_id","id") ON DELETE no action ON UPDATE no action;

package/dist/migrations/0021_slippery_sister_grimm.sql

@@ -0,0 +1 @@
+ALTER TABLE "agents" ADD COLUMN "policy" jsonb;

package/dist/migrations/0022_warm_paibok.sql

@@ -0,0 +1,26 @@
+CREATE TABLE "browser_tokens" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"minted_by_principal_id" uuid NOT NULL,
+	"scope_kind" text NOT NULL,
+	"run_id" uuid,
+	"session_id" uuid,
+	"token_hash" text NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"revoked_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "browser_tokens_scope_kind_valid" CHECK ("browser_tokens"."scope_kind" in ('run', 'session')),
+	CONSTRAINT "browser_tokens_scope_xor" CHECK (("browser_tokens"."scope_kind" = 'run' and "browser_tokens"."run_id" is not null and "browser_tokens"."session_id" is null)
+        or ("browser_tokens"."scope_kind" = 'session' and "browser_tokens"."session_id" is not null and "browser_tokens"."run_id" is null)),
+	CONSTRAINT "browser_tokens_expiry_after_created" CHECK ("browser_tokens"."expires_at" > "browser_tokens"."created_at"),
+	CONSTRAINT "browser_tokens_revoked_after_created" CHECK ("browser_tokens"."revoked_at" is null or "browser_tokens"."revoked_at" >= "browser_tokens"."created_at")
+);
+--> statement-breakpoint
+ALTER TABLE "browser_tokens" ADD CONSTRAINT "browser_tokens_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "browser_tokens" ADD CONSTRAINT "browser_tokens_run_workspace_fk" FOREIGN KEY ("run_id","workspace_id") REFERENCES "public"."runs"("id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "browser_tokens" ADD CONSTRAINT "browser_tokens_session_workspace_fk" FOREIGN KEY ("session_id","workspace_id") REFERENCES "public"."sessions"("id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "browser_tokens" ADD CONSTRAINT "browser_tokens_minter_workspace_fk" FOREIGN KEY ("workspace_id","minted_by_principal_id") REFERENCES "public"."workspace_principals"("workspace_id","id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "browser_tokens_hash_key" ON "browser_tokens" USING btree ("token_hash");--> statement-breakpoint
+CREATE INDEX "browser_tokens_workspace_run_idx" ON "browser_tokens" USING btree ("workspace_id","run_id");--> statement-breakpoint
+CREATE INDEX "browser_tokens_workspace_session_idx" ON "browser_tokens" USING btree ("workspace_id","session_id");--> statement-breakpoint
+CREATE INDEX "browser_tokens_active_idx" ON "browser_tokens" USING btree ("workspace_id","revoked_at","expires_at");

package/dist/migrations/0023_colorful_shotgun.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "run_usage_records" ADD COLUMN "wire_protocol" text DEFAULT 'anthropic-messages' NOT NULL;--> statement-breakpoint
+ALTER TABLE "run_usage_records" ADD CONSTRAINT "run_usage_records_wire_protocol_known" CHECK ("run_usage_records"."wire_protocol" in ('anthropic-messages', 'openai-responses', 'openai-chat-completions'));

package/dist/migrations/0024_curly_molten_man.sql

@@ -0,0 +1,9 @@
+ALTER TABLE "sessions" RENAME COLUMN "claude_session_id" TO "engine_session_id";--> statement-breakpoint
+DROP INDEX "sessions_workspace_claude_session_key";--> statement-breakpoint
+ALTER TABLE "runs" ADD COLUMN "engine" text;--> statement-breakpoint
+ALTER TABLE "runs" ADD COLUMN "engine_version" text;--> statement-breakpoint
+ALTER TABLE "sessions" ADD COLUMN "engine" text;--> statement-breakpoint
+CREATE UNIQUE INDEX "sessions_workspace_engine_session_key" ON "sessions" USING btree ("workspace_id","engine_session_id");--> statement-breakpoint
+-- Hand edit: both `NOT VALID` clauses below are not drizzle-kit output; restore them after any regeneration (ADR-0069).
+ALTER TABLE "runs" ADD CONSTRAINT "runs_engine_valid" CHECK ("runs"."engine" in ('claude-agent-sdk')) NOT VALID;--> statement-breakpoint
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_engine_valid" CHECK ("sessions"."engine" in ('claude-agent-sdk')) NOT VALID;