@indx-workspace/embedded 0.0.0-bootstrap → 0.3.0

package/dist/migrations/0025_name_the_engine_in_stored_rows.sql

@@ -0,0 +1,50 @@
+-- ADR-0065 gives the harness that runs an agent loop its own name, `engine`, because `provider`
+-- already means the *model* provider on `runs` and on `model_connections`. Migration 0024 renamed
+-- `sessions.claude_session_id` to `sessions.engine_session_id` and added `sessions.engine`,
+-- `runs.engine` and `runs.engine_version`. This migration moves the data that the rename leaves
+-- behind — the discriminant inside the `agents.policy` JSON document, which no `ALTER TABLE` can
+-- reach — and backfills the engine of every session that already has an identity.
+--
+-- Every statement is idempotent and order-independent with respect to the rows it does not touch,
+-- so re-running the migration set against a partially migrated database is safe.
+--
+-- `runs.engine` is deliberately NOT backfilled. A historic run row never recorded which engine
+-- executed it, and writing `claude-agent-sdk` onto it would make a guess indistinguishable from a
+-- measurement — the same false-zero mistake `runs.accounting_state` exists to avoid (issue #134).
+-- `NULL` reads as "this run predates the column", which is the truth. Stated here so a later reader
+-- does not take the omission for an oversight.
+
+-- `agents.policy` is a jsonb document whose discriminant was `provider`. Rewrite the key in place:
+-- `- 'provider'` removes the old key and `|| jsonb_build_object(...)` adds the new one, carrying the
+-- value across rather than assuming it. Only `claude-agent-sdk` was ever storable there — the
+-- column has always been written through `AgentPolicySchema` — so the value needs no mapping table.
+--
+-- A row that already carries `engine` is left alone, which is what makes this re-runnable. A row
+-- carrying NEITHER key is not a policy this schema ever wrote and is left for a reader to find,
+-- rather than being given an invented engine.
+UPDATE "agents"
+SET "policy" = ("policy" - 'provider') || jsonb_build_object('engine', "policy" ->> 'provider')
+WHERE "policy" IS NOT NULL
+  AND "policy" ? 'provider'
+  AND NOT ("policy" ? 'engine');
+--> statement-breakpoint
+-- Every session that already has an engine session id got it from the only engine this platform
+-- has ever run, so its engine is known rather than guessed. A session with no identity yet is left
+-- NULL: nothing has pinned it, and #318 is what pins it at first run.
+--
+-- This is the statement that makes the release's invariant hold:
+--   select count(*) from sessions where engine is null and engine_session_id is not null  -- 0
+UPDATE "sessions"
+SET "engine" = 'claude-agent-sdk'
+WHERE "engine" IS NULL
+  AND "engine_session_id" IS NOT NULL;
+--> statement-breakpoint
+-- Migration 0024 added both engine CHECK constraints `NOT VALID`, and this migration validates
+-- them. That split does NOT buy a weaker lock or a shorter cutover: drizzle's `migrate()` applies
+-- every pending migration in one transaction, so 0024's ACCESS EXCLUSIVE locks are still held
+-- while these scans run. What it buys is control over where the scan happens — here, after the
+-- backfill above, so it checks the rows this migration wrote — and re-runnability: `VALIDATE` on
+-- an already-validated constraint is a no-op (ADR-0069).
+ALTER TABLE "runs" VALIDATE CONSTRAINT "runs_engine_valid";
+--> statement-breakpoint
+ALTER TABLE "sessions" VALIDATE CONSTRAINT "sessions_engine_valid";

package/dist/migrations/0026_create_the_engine_scoped_session_state_store.sql

@@ -0,0 +1,47 @@
+CREATE TABLE "session_state_blobs" (
+	"workspace_id" uuid NOT NULL,
+	"session_id" uuid NOT NULL,
+	"engine" text NOT NULL,
+	"blob_key" text NOT NULL,
+	"storage_key" text NOT NULL,
+	"size_bytes" bigint NOT NULL,
+	"sha256" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "session_state_blobs_pkey" PRIMARY KEY("workspace_id","session_id","engine","blob_key"),
+	CONSTRAINT "session_state_blobs_engine_valid" CHECK ("session_state_blobs"."engine" in ('claude-agent-sdk'))
+);
+--> statement-breakpoint
+CREATE TABLE "session_state_entries" (
+	"workspace_id" uuid NOT NULL,
+	"session_id" uuid NOT NULL,
+	"engine" text NOT NULL,
+	"stream_key" text NOT NULL,
+	"sequence" bigint NOT NULL,
+	"entry_key" text,
+	"entry" jsonb NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "session_state_entries_pkey" PRIMARY KEY("workspace_id","session_id","engine","stream_key","sequence"),
+	CONSTRAINT "session_state_entries_engine_valid" CHECK ("session_state_entries"."engine" in ('claude-agent-sdk'))
+);
+--> statement-breakpoint
+CREATE TABLE "session_state_streams" (
+	"workspace_id" uuid NOT NULL,
+	"session_id" uuid NOT NULL,
+	"engine" text NOT NULL,
+	"stream_key" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "session_state_streams_pkey" PRIMARY KEY("workspace_id","session_id","engine","stream_key"),
+	CONSTRAINT "session_state_streams_engine_valid" CHECK ("session_state_streams"."engine" in ('claude-agent-sdk'))
+);
+--> statement-breakpoint
+ALTER TABLE "session_state_blobs" ADD CONSTRAINT "session_state_blobs_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "session_state_blobs" ADD CONSTRAINT "session_state_blobs_session_workspace_fk" FOREIGN KEY ("session_id","workspace_id") REFERENCES "public"."sessions"("id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "session_state_entries" ADD CONSTRAINT "session_state_entries_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "session_state_entries" ADD CONSTRAINT "session_state_entries_stream_fk" FOREIGN KEY ("workspace_id","session_id","engine","stream_key") REFERENCES "public"."session_state_streams"("workspace_id","session_id","engine","stream_key") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "session_state_streams" ADD CONSTRAINT "session_state_streams_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "session_state_streams" ADD CONSTRAINT "session_state_streams_session_workspace_fk" FOREIGN KEY ("session_id","workspace_id") REFERENCES "public"."sessions"("id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "session_state_blobs_workspace_updated_idx" ON "session_state_blobs" USING btree ("workspace_id","updated_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "session_state_entries_key_unique" ON "session_state_entries" USING btree ("workspace_id","session_id","engine","stream_key","entry_key");--> statement-breakpoint
+CREATE INDEX "session_state_streams_workspace_updated_idx" ON "session_state_streams" USING btree ("workspace_id","updated_at");

package/dist/migrations/0027_backfill_claude_session_state.sql

@@ -0,0 +1,66 @@
+-- ENG-06 (#305): move every existing Claude transcript into the engine-scoped session store that
+-- migration 0026 created, so a session that existed before the upgrade resumes after it with its
+-- full history. ADR-0071 records the shape; this file is the data half of it.
+--
+-- **A single-revision cutover** (ADR-0071, in the sense of `docs/adr/0069-*`). The schema is
+-- additive — `session_transcripts` and `session_messages` are left exactly as they are — but this
+-- copy is ONE-SHOT: it moves what the legacy tables hold when `migrate` runs, and nothing copies
+-- anything after that. A previous-release revision still serving during a rolling update keeps
+-- appending to the legacy tables, and those turns would be missing from every later resume. So the
+-- old revision is drained, or scaled to zero, before the new one starts and migrates; rollback is
+-- restoring the pre-upgrade backup. Every `docs/deploy/*` guide carries the step. Removing the old
+-- pair is the contract half, and it is a later unit's work, not this one's.
+--
+-- Every statement is idempotent: re-running the migration set against a partially migrated
+-- database inserts nothing a previous run already inserted, so a retry is safe.
+--
+-- `session_transcripts.session_id` holds the id the ENGINE reported, and for a Claude session that
+-- is the platform's own `sessions.id` — the platform passes `sessions.id` as `Options.sessionId`,
+-- which is also why `session_transcripts_session_workspace_fk` has always held. The new tables key
+-- on `sessions.id` deliberately (no other engine promises the two are equal), so the copy carries
+-- `session_id` across unchanged and the existing foreign key is the evidence that it resolves.
+
+-- One stream per old transcript key. `stream_key` is `project_key || '/' || subpath`, which is the
+-- Claude adapter's own key rendered into the one field the platform promises not to interpret —
+-- the main transcript's `subpath` is the empty string, so its stream key ends in a bare `/`.
+INSERT INTO "session_state_streams" ("workspace_id", "session_id", "engine", "stream_key", "created_at", "updated_at")
+SELECT "workspace_id", "session_id", 'claude-agent-sdk', "project_key" || '/' || "subpath", "created_at", "updated_at"
+FROM "session_transcripts"
+ON CONFLICT DO NOTHING;
+--> statement-breakpoint
+-- The entries, folded the way `load()` already folded them.
+--
+-- `session_messages` is append-only: a redelivered entry got a NEW `sequence` and kept its
+-- `position`, and a read folded the LATEST delivery into the FIRST position. The new store holds one
+-- row per entry instead, so the fold happens here, once, rather than on every read:
+--
+--   * `latest` picks the highest-`sequence` delivery of each `position` — the entry as the last
+--     delivery left it, which is exactly what `load()` returned;
+--   * `dense_rank()` over `position` renumbers the survivors from 1 with no gaps, because the new
+--     store's `sequence` is dense within a stream and `replace-all`/`delete-last` depend on it;
+--   * `entry_uuid` becomes `entry_key`, NULL and all: an entry the SDK gave no uuid has no
+--     identity to dedup on (R-01 §7), and inventing one here would be an idempotency claim about
+--     an entry that has none.
+--
+-- ORDER BY inside `dense_rank()` is `position` alone: `position` is a first-delivery sequence, so it
+-- is already unique per key and already the order `load()` produced.
+INSERT INTO "session_state_entries" ("workspace_id", "session_id", "engine", "stream_key", "sequence", "entry_key", "entry", "created_at")
+SELECT
+  "latest"."workspace_id",
+  "latest"."session_id",
+  'claude-agent-sdk',
+  "latest"."project_key" || '/' || "latest"."subpath",
+  dense_rank() OVER (
+    PARTITION BY "latest"."workspace_id", "latest"."session_id", "latest"."project_key", "latest"."subpath"
+    ORDER BY "latest"."position"
+  ),
+  "latest"."entry_uuid",
+  "latest"."entry",
+  "latest"."created_at"
+FROM (
+  SELECT DISTINCT ON ("workspace_id", "project_key", "session_id", "subpath", "position")
+    "workspace_id", "project_key", "session_id", "subpath", "position", "entry_uuid", "entry", "created_at"
+  FROM "session_messages"
+  ORDER BY "workspace_id", "project_key", "session_id", "subpath", "position", "sequence" DESC
+) AS "latest"
+ON CONFLICT DO NOTHING;

package/dist/migrations/0028_widen_the_engine_checks_to_openai_agents.sql

@@ -0,0 +1,14 @@
+-- ENG-09 (#308, ADR-0074): `openai-agents` joins `claude-agent-sdk` in every engine CHECK.
+-- Additive: each constraint is widened, never narrowed, and a revision from the previous release
+-- only ever writes `claude-agent-sdk`, which both the old and the new constraint admit — so no
+-- single-revision cutover is needed (ADR-0069's rule applies to incompatible changes).
+ALTER TABLE "runs" DROP CONSTRAINT "runs_engine_valid";--> statement-breakpoint
+ALTER TABLE "session_state_blobs" DROP CONSTRAINT "session_state_blobs_engine_valid";--> statement-breakpoint
+ALTER TABLE "session_state_entries" DROP CONSTRAINT "session_state_entries_engine_valid";--> statement-breakpoint
+ALTER TABLE "session_state_streams" DROP CONSTRAINT "session_state_streams_engine_valid";--> statement-breakpoint
+ALTER TABLE "sessions" DROP CONSTRAINT "sessions_engine_valid";--> statement-breakpoint
+ALTER TABLE "runs" ADD CONSTRAINT "runs_engine_valid" CHECK ("runs"."engine" in ('claude-agent-sdk', 'openai-agents'));--> statement-breakpoint
+ALTER TABLE "session_state_blobs" ADD CONSTRAINT "session_state_blobs_engine_valid" CHECK ("session_state_blobs"."engine" in ('claude-agent-sdk', 'openai-agents'));--> statement-breakpoint
+ALTER TABLE "session_state_entries" ADD CONSTRAINT "session_state_entries_engine_valid" CHECK ("session_state_entries"."engine" in ('claude-agent-sdk', 'openai-agents'));--> statement-breakpoint
+ALTER TABLE "session_state_streams" ADD CONSTRAINT "session_state_streams_engine_valid" CHECK ("session_state_streams"."engine" in ('claude-agent-sdk', 'openai-agents'));--> statement-breakpoint
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_engine_valid" CHECK ("sessions"."engine" in ('claude-agent-sdk', 'openai-agents'));

package/dist/migrations/0029_widen_the_engine_checks_to_pi.sql

@@ -0,0 +1,14 @@
+-- ENG-08 (#307, ADR-0081): `pi` joins `claude-agent-sdk` and `openai-agents` in every engine CHECK.
+-- Additive: each constraint is widened, never narrowed, and a revision from the previous release
+-- only ever writes `claude-agent-sdk` or `openai-agents`, which both the old and the new constraint
+-- admit — so no single-revision cutover is needed (ADR-0069's rule applies to incompatible changes).
+ALTER TABLE "runs" DROP CONSTRAINT "runs_engine_valid";--> statement-breakpoint
+ALTER TABLE "session_state_blobs" DROP CONSTRAINT "session_state_blobs_engine_valid";--> statement-breakpoint
+ALTER TABLE "session_state_entries" DROP CONSTRAINT "session_state_entries_engine_valid";--> statement-breakpoint
+ALTER TABLE "session_state_streams" DROP CONSTRAINT "session_state_streams_engine_valid";--> statement-breakpoint
+ALTER TABLE "sessions" DROP CONSTRAINT "sessions_engine_valid";--> statement-breakpoint
+ALTER TABLE "runs" ADD CONSTRAINT "runs_engine_valid" CHECK ("runs"."engine" in ('claude-agent-sdk', 'openai-agents', 'pi'));--> statement-breakpoint
+ALTER TABLE "session_state_blobs" ADD CONSTRAINT "session_state_blobs_engine_valid" CHECK ("session_state_blobs"."engine" in ('claude-agent-sdk', 'openai-agents', 'pi'));--> statement-breakpoint
+ALTER TABLE "session_state_entries" ADD CONSTRAINT "session_state_entries_engine_valid" CHECK ("session_state_entries"."engine" in ('claude-agent-sdk', 'openai-agents', 'pi'));--> statement-breakpoint
+ALTER TABLE "session_state_streams" ADD CONSTRAINT "session_state_streams_engine_valid" CHECK ("session_state_streams"."engine" in ('claude-agent-sdk', 'openai-agents', 'pi'));--> statement-breakpoint
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_engine_valid" CHECK ("sessions"."engine" in ('claude-agent-sdk', 'openai-agents', 'pi'));

package/dist/migrations/0030_create_the_cli_sessions_table.sql

@@ -0,0 +1,23 @@
+CREATE TABLE "cli_sessions" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"user_id" uuid NOT NULL,
+	"user_code" text NOT NULL,
+	"status" text NOT NULL,
+	"approval_expires_at" timestamp with time zone NOT NULL,
+	"token_hash" text,
+	"expires_at" timestamp with time zone,
+	"revoked_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "cli_sessions_status_valid" CHECK ("cli_sessions"."status" in ('approved', 'denied', 'active', 'revoked')),
+	CONSTRAINT "cli_sessions_user_code_shape" CHECK ("cli_sessions"."user_code" ~ '^[A-Z]{8}$'),
+	CONSTRAINT "cli_sessions_token_iff_issued" CHECK (("cli_sessions"."status" in ('active', 'revoked')) = ("cli_sessions"."token_hash" is not null and "cli_sessions"."expires_at" is not null)),
+	CONSTRAINT "cli_sessions_revoked_iff_status" CHECK (("cli_sessions"."status" = 'revoked') = ("cli_sessions"."revoked_at" is not null)),
+	CONSTRAINT "cli_sessions_expiry_after_created" CHECK ("cli_sessions"."expires_at" is null or "cli_sessions"."expires_at" > "cli_sessions"."created_at")
+);
+--> statement-breakpoint
+ALTER TABLE "cli_sessions" ADD CONSTRAINT "cli_sessions_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "cli_sessions" ADD CONSTRAINT "cli_sessions_member_workspace_fk" FOREIGN KEY ("workspace_id","user_id") REFERENCES "public"."memberships"("workspace_id","user_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "cli_sessions_user_code_key" ON "cli_sessions" USING btree ("user_code");--> statement-breakpoint
+CREATE UNIQUE INDEX "cli_sessions_token_hash_key" ON "cli_sessions" USING btree ("token_hash");--> statement-breakpoint
+CREATE INDEX "cli_sessions_workspace_user_idx" ON "cli_sessions" USING btree ("workspace_id","user_id");

package/dist/migrations/0031_widen_the_engine_checks_to_mastra.sql

@@ -0,0 +1,17 @@
+-- ENG-10 (#309, ADR-0084): `mastra` joins `claude-agent-sdk`, `openai-agents` and `pi` in every engine
+-- CHECK. Additive: each constraint is widened, never narrowed, and a revision from the previous release
+-- only ever writes one of the three earlier ids, which both the old and the new constraint admit — so
+-- no single-revision cutover is needed (ADR-0069's rule applies to incompatible changes). Numbered
+-- 0031 so the file prefix equals the journal `idx` (31): `drizzle-kit generate` names the next
+-- migration `lastEntry.idx + 1`, so a gap would make it reuse this prefix and overwrite
+-- `meta/0032_snapshot.json`. It follows 0030 (`cli_sessions`, #356, ADR-0083), which merged first.
+ALTER TABLE "runs" DROP CONSTRAINT "runs_engine_valid";--> statement-breakpoint
+ALTER TABLE "session_state_blobs" DROP CONSTRAINT "session_state_blobs_engine_valid";--> statement-breakpoint
+ALTER TABLE "session_state_entries" DROP CONSTRAINT "session_state_entries_engine_valid";--> statement-breakpoint
+ALTER TABLE "session_state_streams" DROP CONSTRAINT "session_state_streams_engine_valid";--> statement-breakpoint
+ALTER TABLE "sessions" DROP CONSTRAINT "sessions_engine_valid";--> statement-breakpoint
+ALTER TABLE "runs" ADD CONSTRAINT "runs_engine_valid" CHECK ("runs"."engine" in ('claude-agent-sdk', 'openai-agents', 'pi', 'mastra'));--> statement-breakpoint
+ALTER TABLE "session_state_blobs" ADD CONSTRAINT "session_state_blobs_engine_valid" CHECK ("session_state_blobs"."engine" in ('claude-agent-sdk', 'openai-agents', 'pi', 'mastra'));--> statement-breakpoint
+ALTER TABLE "session_state_entries" ADD CONSTRAINT "session_state_entries_engine_valid" CHECK ("session_state_entries"."engine" in ('claude-agent-sdk', 'openai-agents', 'pi', 'mastra'));--> statement-breakpoint
+ALTER TABLE "session_state_streams" ADD CONSTRAINT "session_state_streams_engine_valid" CHECK ("session_state_streams"."engine" in ('claude-agent-sdk', 'openai-agents', 'pi', 'mastra'));--> statement-breakpoint
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_engine_valid" CHECK ("sessions"."engine" in ('claude-agent-sdk', 'openai-agents', 'pi', 'mastra'));

package/dist/migrations/0032_mark_the_setup_agent.sql

@@ -0,0 +1,7 @@
+-- PR #403 review (issue #393): first-run setup marks the agent it configured and tested, so the
+-- composer selects that agent before the user chooses one. Recorded on the agent, not as an id on
+-- `workspaces`, so no reference points back into `agents` and a deleted agent takes its mark with it.
+-- Additive and nullable; no revision from the previous release reads or writes it, so no
+-- single-revision cutover is needed (ADR-0069). Numbered 0032 so the file prefix equals the journal
+-- idx (32).
+ALTER TABLE "agents" ADD COLUMN "setup_configured_at" timestamp with time zone;

package/dist/migrations/0033_create_the_agent_version_store.sql

@@ -0,0 +1,41 @@
+-- Issue #442 (S1-04, ADR-0101): the agent version store. `agent_versions` holds each agent's
+-- immutable, numbered definitions and `agent_version_pointers` records which version is live in an
+-- environment. The pointer → version FK carries `workspace_id` as a third column so the reference is
+-- tenant-paired (tenancy.test.ts bucket 3). Additive: it creates two tables with their constraints
+-- and index, and no revision from the previous release reads or writes them, so no single-revision
+-- cutover is needed (ADR-0069). Numbered 0033 so the file prefix equals the journal idx (33).
+CREATE TABLE "agent_version_pointers" (
+	"workspace_id" uuid NOT NULL,
+	"agent_id" uuid NOT NULL,
+	"environment" text NOT NULL,
+	"version_id" uuid NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "agent_version_pointers_pkey" PRIMARY KEY("agent_id","environment"),
+	CONSTRAINT "agent_version_pointers_environment_valid" CHECK ("agent_version_pointers"."environment" in ('local'))
+);
+--> statement-breakpoint
+CREATE TABLE "agent_versions" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"agent_id" uuid NOT NULL,
+	"number" integer NOT NULL,
+	"summary" text NOT NULL,
+	"via" text NOT NULL,
+	"body" jsonb NOT NULL,
+	"created_by_principal_id" uuid NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "agent_versions_workspace_agent_number_key" UNIQUE("workspace_id","agent_id","number"),
+	CONSTRAINT "agent_versions_id_workspace_key" UNIQUE("id","workspace_id"),
+	CONSTRAINT "agent_versions_id_agent_workspace_key" UNIQUE("id","agent_id","workspace_id"),
+	CONSTRAINT "agent_versions_via_valid" CHECK ("agent_versions"."via" in ('ui', 'aw-push', 'api')),
+	CONSTRAINT "agent_versions_number_positive" CHECK ("agent_versions"."number" > 0)
+);
+--> statement-breakpoint
+ALTER TABLE "agent_version_pointers" ADD CONSTRAINT "agent_version_pointers_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_version_pointers" ADD CONSTRAINT "agent_version_pointers_agent_workspace_fk" FOREIGN KEY ("agent_id","workspace_id") REFERENCES "public"."agents"("id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_version_pointers" ADD CONSTRAINT "agent_version_pointers_version_fk" FOREIGN KEY ("version_id","agent_id","workspace_id") REFERENCES "public"."agent_versions"("id","agent_id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_versions" ADD CONSTRAINT "agent_versions_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_versions" ADD CONSTRAINT "agent_versions_agent_workspace_fk" FOREIGN KEY ("agent_id","workspace_id") REFERENCES "public"."agents"("id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_versions" ADD CONSTRAINT "agent_versions_created_by_principal_workspace_fk" FOREIGN KEY ("workspace_id","created_by_principal_id") REFERENCES "public"."workspace_principals"("workspace_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "agent_version_pointers_workspace_environment_idx" ON "agent_version_pointers" USING btree ("workspace_id","environment");

package/dist/migrations/0034_mark_the_workspace_default_runtime_profile.sql

@@ -0,0 +1,15 @@
+-- Issue #504 (S1-22): a workspace may mark one runtime profile as its default. An agent version
+-- that names no runtime profile (`runtimeProfileName: null`) resolves to it when the version is
+-- applied, so the stored agent row carries a concrete profile id and run preflight stays strict.
+-- The mark lives on `runtime_profiles` rather than as an id on `workspaces`, so the tenant root
+-- gains no reference back into a tenant table (no second schema cycle), a workspace can never
+-- default to another workspace's profile, and deleting the profile removes the default with it.
+-- `workspace_default` is `true` or NULL, never `false`, so the plain unique key on
+-- (workspace_id, workspace_default) allows at most one default per workspace.
+-- Additive and nullable, with no backfill: every existing profile stays unmarked, which means "no
+-- default" (agents that name no profile stay refused, as before). No revision from the previous
+-- release reads or writes it, so no single-revision cutover is needed (ADR-0069). Numbered 0034 so
+-- the file prefix equals the journal idx (34).
+ALTER TABLE "runtime_profiles" ADD COLUMN "workspace_default" boolean;--> statement-breakpoint
+ALTER TABLE "runtime_profiles" ADD CONSTRAINT "runtime_profiles_workspace_default_key" UNIQUE("workspace_id","workspace_default");--> statement-breakpoint
+ALTER TABLE "runtime_profiles" ADD CONSTRAINT "runtime_profiles_workspace_default_true_or_null" CHECK ("runtime_profiles"."workspace_default" is null or "runtime_profiles"."workspace_default");

package/dist/migrations/0035_record_who_a_local_runtime_key_acts_for.sql

@@ -0,0 +1,19 @@
+-- Issue #509 (S1-24): an API-key principal may record the membership principal it acts for. The
+-- per-run local runtime key `aw dev` mints (ADR-0109, S1-21) acts for the bootstrap admin who
+-- issued it, so what that key writes (agents, sessions, skills, files, MCP servers, projects and
+-- shares) is owned by that admin rather than by a key the next start sweeps or that expires after
+-- 12 h. Audit, version and browser-token attribution keep the acting key.
+-- The column lives on `workspace_principals` rather than on `api_keys`: a reference from
+-- `api_keys` to this table would close a schema cycle, while a self-reference is none. The pair
+-- FK is tenant-paired and NO ACTION, like every owner FK, so a membership principal a key acted
+-- for cannot be deleted while that key principal remains. The two checks keep the column on
+-- API-key principals only and never pointing at the principal itself.
+-- Additive and nullable, with no backfill: every existing principal stays unset, which means "owns
+-- what it writes" (today's semantics; hosted keys never set it). The local start's repair step
+-- fills it for earlier local runtime keys. No revision from the previous release reads or writes
+-- it, so no single-revision cutover is needed (ADR-0069). Numbered 0035 so the file prefix equals
+-- the journal idx (35).
+ALTER TABLE "workspace_principals" ADD COLUMN "acts_for_principal_id" uuid;--> statement-breakpoint
+ALTER TABLE "workspace_principals" ADD CONSTRAINT "workspace_principals_acts_for_workspace_fk" FOREIGN KEY ("workspace_id","acts_for_principal_id") REFERENCES "public"."workspace_principals"("workspace_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "workspace_principals" ADD CONSTRAINT "workspace_principals_acts_for_api_key_only" CHECK ("workspace_principals"."acts_for_principal_id" is null or "workspace_principals"."kind" = 'api_key');--> statement-breakpoint
+ALTER TABLE "workspace_principals" ADD CONSTRAINT "workspace_principals_acts_for_not_self" CHECK ("workspace_principals"."acts_for_principal_id" is null or "workspace_principals"."acts_for_principal_id" <> "workspace_principals"."id");

package/dist/migrations/0036_add_connector_kinds_and_the_run_tool_snapshot.sql

@@ -0,0 +1,34 @@
+-- Issue #527 (S2-02b, ADR-0113 C15/C16): connector kinds and the run tool snapshot.
+-- `mcp_servers` gains `kind` ('mcp', 'openapi' or 'postgres'; default 'mcp') and `tool_config`, a
+-- JSON object a tool connector carries instead of a transport, command, args or URL. `runs` gains
+-- `tool_connector_ids`, the sorted, distinct set of tool connectors a run may call, snapshotted
+-- before launch (C16); it has no foreign key because PostgreSQL cannot put one on an array element,
+-- and the gateway re-checks tenancy, kind and existence on every call. There is no secret-by-name
+-- column (SD3): a tool connector's credential stays a reference by id into `secrets`.
+-- Additive except two things: `transport` drops NOT NULL (a tool row has none), and the four
+-- transport and credential checks are dropped and re-added under the same names, guarded by
+-- `kind <> 'mcp' or (...)` so they mean exactly what they meant for every MCP row. Every existing
+-- row becomes kind 'mcp' with tool_config NULL, and every constraint is added VALID, so applying
+-- this migration proves that the existing rows satisfy the new checks. A revision from the previous
+-- release inserts without `kind` and gets 'mcp', and reads neither new column, so no
+-- single-revision cutover is needed (ADR-0069); tool rows cannot exist until S2-02c ships. The
+-- openapi auth/credential pairing lives in tool_config and is enforced by the server and the
+-- resource schema, not here. Numbered 0036 so the file prefix equals the journal idx (36).
+ALTER TABLE "mcp_servers" DROP CONSTRAINT "mcp_servers_stdio_has_command";--> statement-breakpoint
+ALTER TABLE "mcp_servers" DROP CONSTRAINT "mcp_servers_remote_has_url";--> statement-breakpoint
+ALTER TABLE "mcp_servers" DROP CONSTRAINT "mcp_servers_args_are_stdio_only";--> statement-breakpoint
+ALTER TABLE "mcp_servers" DROP CONSTRAINT "mcp_servers_credential_required";--> statement-breakpoint
+ALTER TABLE "mcp_servers" ALTER COLUMN "transport" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD COLUMN "kind" text DEFAULT 'mcp' NOT NULL;--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD COLUMN "tool_config" jsonb;--> statement-breakpoint
+ALTER TABLE "runs" ADD COLUMN "tool_connector_ids" uuid[] DEFAULT '{}'::uuid[] NOT NULL;--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD CONSTRAINT "mcp_servers_kind_valid" CHECK ("mcp_servers"."kind" in ('mcp', 'openapi', 'postgres'));--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD CONSTRAINT "mcp_servers_transport_by_kind" CHECK (("mcp_servers"."kind" = 'mcp') = ("mcp_servers"."transport" is not null));--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD CONSTRAINT "mcp_servers_tool_kind_fields" CHECK ("mcp_servers"."kind" = 'mcp' or ("mcp_servers"."command" is null and "mcp_servers"."args" is null and "mcp_servers"."url" is null));--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD CONSTRAINT "mcp_servers_tool_config_by_kind" CHECK (("mcp_servers"."kind" = 'mcp') = ("mcp_servers"."tool_config" is null));--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD CONSTRAINT "mcp_servers_tool_config_is_object" CHECK ("mcp_servers"."tool_config" is null or jsonb_typeof("mcp_servers"."tool_config") = 'object');--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD CONSTRAINT "mcp_servers_tool_credential" CHECK ("mcp_servers"."kind" = 'mcp' or ("mcp_servers"."auth_type" = 'none' and ("mcp_servers"."kind" <> 'postgres' or "mcp_servers"."credential_secret_id" is not null)));--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD CONSTRAINT "mcp_servers_stdio_has_command" CHECK ("mcp_servers"."kind" <> 'mcp' or (("mcp_servers"."transport" = 'stdio') = ("mcp_servers"."command" is not null)));--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD CONSTRAINT "mcp_servers_remote_has_url" CHECK ("mcp_servers"."kind" <> 'mcp' or (("mcp_servers"."transport" in ('http', 'sse')) = ("mcp_servers"."url" is not null)));--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD CONSTRAINT "mcp_servers_args_are_stdio_only" CHECK ("mcp_servers"."kind" <> 'mcp' or ("mcp_servers"."args" is null or "mcp_servers"."transport" = 'stdio'));--> statement-breakpoint
+ALTER TABLE "mcp_servers" ADD CONSTRAINT "mcp_servers_credential_required" CHECK ("mcp_servers"."kind" <> 'mcp' or (("mcp_servers"."auth_type" in ('api-key', 'bearer', 'oauth')) = ("mcp_servers"."credential_secret_id" is not null)));

package/dist/migrations/0037_create_the_surface_session_keys.sql

@@ -0,0 +1,20 @@
+-- Issue #538 (S2-05b, C18, ADR-0105): the resume key of a hosted surface session.
+-- `surface_session_keys` holds one row per session a surface bootstrap opened: the SHA-256 digest
+-- of the key (never the key), and the surface name and agent it was issued for, so a reloaded page
+-- resumes exactly that (surface, agent) session. Both references are tenant-paired and cascade.
+-- Additive: one new table, its constraints and one index. No revision from the previous release
+-- reads or writes it, so no single-revision cutover is needed (ADR-0069). Numbered 0037 so the
+-- file prefix equals the journal idx (37).
+CREATE TABLE "surface_session_keys" (
+	"session_id" uuid PRIMARY KEY NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"surface_name" text NOT NULL,
+	"agent_id" uuid NOT NULL,
+	"key_hash" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "surface_session_keys" ADD CONSTRAINT "surface_session_keys_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "surface_session_keys" ADD CONSTRAINT "surface_session_keys_session_workspace_fk" FOREIGN KEY ("session_id","workspace_id") REFERENCES "public"."sessions"("id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "surface_session_keys" ADD CONSTRAINT "surface_session_keys_agent_workspace_fk" FOREIGN KEY ("agent_id","workspace_id") REFERENCES "public"."agents"("id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "surface_session_keys_workspace_idx" ON "surface_session_keys" USING btree ("workspace_id");

package/dist/migrations/0038_record_feedback_on_a_run.sql

@@ -0,0 +1,14 @@
+CREATE TABLE "run_feedback" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"run_id" uuid NOT NULL,
+	"rating" text NOT NULL,
+	"comment" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "run_feedback_rating_valid" CHECK ("run_feedback"."rating" in ('up', 'down')),
+	CONSTRAINT "run_feedback_comment_length" CHECK ("run_feedback"."comment" is null or char_length("run_feedback"."comment") <= 1000)
+);
+--> statement-breakpoint
+ALTER TABLE "run_feedback" ADD CONSTRAINT "run_feedback_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "run_feedback" ADD CONSTRAINT "run_feedback_run_workspace_fk" FOREIGN KEY ("run_id","workspace_id") REFERENCES "public"."runs"("id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "run_feedback_workspace_run_idx" ON "run_feedback" USING btree ("workspace_id","run_id");

package/dist/migrations/0039_record_an_evaluation_of_a_version.sql

@@ -0,0 +1,18 @@
+CREATE TABLE "agent_version_evaluations" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"version_id" uuid NOT NULL,
+	"score" numeric(5, 4) NOT NULL,
+	"passed" integer NOT NULL,
+	"total" integer NOT NULL,
+	"cases_snapshot" jsonb NOT NULL,
+	"results" jsonb NOT NULL,
+	"created_by_principal_id" uuid NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "agent_version_evaluations_counts" CHECK ("agent_version_evaluations"."total" > 0 and "agent_version_evaluations"."passed" >= 0 and "agent_version_evaluations"."passed" <= "agent_version_evaluations"."total")
+);
+--> statement-breakpoint
+ALTER TABLE "agent_version_evaluations" ADD CONSTRAINT "agent_version_evaluations_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_version_evaluations" ADD CONSTRAINT "agent_version_evaluations_version_workspace_fk" FOREIGN KEY ("version_id","workspace_id") REFERENCES "public"."agent_versions"("id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_version_evaluations" ADD CONSTRAINT "agent_version_evaluations_created_by_principal_workspace_fk" FOREIGN KEY ("workspace_id","created_by_principal_id") REFERENCES "public"."workspace_principals"("workspace_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "agent_version_evaluations_workspace_version_idx" ON "agent_version_evaluations" USING btree ("workspace_id","version_id");

package/dist/migrations/0040_record_the_materialised_version.sql

@@ -0,0 +1,23 @@
+-- Issue #613: `agents.materialised_version_id` records the version the agent row was last written
+-- from, so "edited since the pointer moved" is `materialised_version_id IS DISTINCT FROM
+-- pointer.version_id` instead of the `agents.updated_at <= agent_version_pointers.updated_at`
+-- timestamp proxy.
+--
+-- Additive and nullable, so no single-revision cutover is needed (ADR-0069): a revision that
+-- predates this column ignores it. During a rollout, an old revision that still serves a legacy
+-- `PATCH` does not clear the column, so `aw dev` misses that one edit until the agent is edited
+-- again. The result is the overwrite `aw push` already does by default.
+--
+-- ON DELETE is NO ACTION: a version is only deleted by its agent's cascade, which removes the
+-- referencing row in the same statement. MATCH SIMPLE leaves NULL unchecked.
+ALTER TABLE "agents" ADD COLUMN "materialised_version_id" uuid;--> statement-breakpoint
+ALTER TABLE "agents" ADD CONSTRAINT "agents_materialised_version_fk" FOREIGN KEY ("materialised_version_id","id","workspace_id") REFERENCES "public"."agent_versions"("id","agent_id","workspace_id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+-- The backfill uses the old proxy one last time, so no existing agent reads as edited on upgrade:
+-- an agent whose row was not written after its `local` pointer moved still equals that version.
+UPDATE "agents" AS a
+SET "materialised_version_id" = p."version_id"
+FROM "agent_version_pointers" AS p
+WHERE p."agent_id" = a."id"
+  AND p."workspace_id" = a."workspace_id"
+  AND p."environment" = 'local'
+  AND a."updated_at" <= p."updated_at";

package/dist/migrations/0041_pin_a_session_to_its_agent_version.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "agent_version_pointers" DROP CONSTRAINT "agent_version_pointers_environment_valid";--> statement-breakpoint
+ALTER TABLE "sessions" ADD COLUMN "agent_version_id" uuid;--> statement-breakpoint
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_agent_version_fk" FOREIGN KEY ("agent_version_id","agent_id","workspace_id") REFERENCES "public"."agent_versions"("id","agent_id","workspace_id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_version_pointers" ADD CONSTRAINT "agent_version_pointers_environment_valid" CHECK ("agent_version_pointers"."environment" in ('local', 'production'));

package/dist/migrations/0042_store_the_prompt_of_a_run.sql

@@ -0,0 +1 @@
+ALTER TABLE "runs" ADD COLUMN "prompt" text;

package/dist/migrations/0043_record_every_pointer_move.sql

@@ -0,0 +1,30 @@
+-- Issue #615 (80-08): `agent_pointer_moves` is every version an environment has pointed at. The
+-- repository appends one row in the transaction that moves a pointer, so the newest row of an
+-- (agent, environment) is its pointer and a rollback is the row before it.
+--
+-- Additive, so no single-revision cutover is needed (ADR-0069). During a rollout an old revision
+-- still moves pointers without a row, so a history head can lag its pointer until the next move;
+-- a rollback in that window steps back from the last recorded move.
+CREATE TABLE "agent_pointer_moves" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"agent_id" uuid NOT NULL,
+	"environment" text NOT NULL,
+	"version_id" uuid NOT NULL,
+	"moved_by" uuid,
+	"moved_at" timestamp with time zone DEFAULT clock_timestamp() NOT NULL,
+	"reason" text NOT NULL,
+	CONSTRAINT "agent_pointer_moves_environment_valid" CHECK ("agent_pointer_moves"."environment" in ('local', 'production')),
+	CONSTRAINT "agent_pointer_moves_reason_valid" CHECK ("agent_pointer_moves"."reason" in ('set', 'promote', 'rollback'))
+);
+--> statement-breakpoint
+ALTER TABLE "agent_pointer_moves" ADD CONSTRAINT "agent_pointer_moves_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_pointer_moves" ADD CONSTRAINT "agent_pointer_moves_agent_workspace_fk" FOREIGN KEY ("agent_id","workspace_id") REFERENCES "public"."agents"("id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_pointer_moves" ADD CONSTRAINT "agent_pointer_moves_version_fk" FOREIGN KEY ("version_id","agent_id","workspace_id") REFERENCES "public"."agent_versions"("id","agent_id","workspace_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "agent_pointer_moves" ADD CONSTRAINT "agent_pointer_moves_moved_by_principal_workspace_fk" FOREIGN KEY ("workspace_id","moved_by") REFERENCES "public"."workspace_principals"("workspace_id","id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "agent_pointer_moves_workspace_agent_environment_idx" ON "agent_pointer_moves" USING btree ("workspace_id","agent_id","environment","moved_at");--> statement-breakpoint
+-- The backfill gives every existing pointer one `set` row, so each head equals its pointer from the
+-- start. `moved_by` is NULL: the pointer row never recorded who moved it.
+INSERT INTO "agent_pointer_moves" ("workspace_id", "agent_id", "environment", "version_id", "moved_by", "moved_at", "reason")
+SELECT p."workspace_id", p."agent_id", p."environment", p."version_id", NULL, p."updated_at", 'set'
+FROM "agent_version_pointers" AS p;