@maiaos/node 0.1.0-canary.44938d4.manual.1

package/dist/storage/migration-eleven.js

@@ -0,0 +1,298 @@
+export const migrationElevenSql = `
+CREATE TABLE integration_authorization_plans (
+  plan_id TEXT PRIMARY KEY NOT NULL CHECK (
+    length(plan_id) BETWEEN 1 AND 128 AND
+    plan_id NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  integration TEXT NOT NULL CHECK (integration = 'codex'),
+  target_count INTEGER NOT NULL CHECK (target_count = 1),
+  target_adapter TEXT NOT NULL CHECK (target_adapter = 'codex'),
+  executable_path TEXT NOT NULL CHECK (
+    length(executable_path) BETWEEN 1 AND 4096 AND
+    substr(executable_path, 1, 1) = '/'
+  ),
+  executable_sha256 TEXT NOT NULL CHECK (
+    length(executable_sha256) = 64 AND executable_sha256 NOT GLOB '*[^a-f0-9]*'
+  ),
+  adapter_version TEXT NOT NULL CHECK (
+    length(adapter_version) BETWEEN 1 AND 128 AND
+    adapter_version NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  owner_kinds_json TEXT NOT NULL CHECK (json_valid(owner_kinds_json)),
+  sandbox_policy_revision TEXT NOT NULL CHECK (
+    length(sandbox_policy_revision) BETWEEN 1 AND 128 AND
+    sandbox_policy_revision NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  vouch_policy_revision TEXT NOT NULL CHECK (
+    length(vouch_policy_revision) BETWEEN 1 AND 128 AND
+    vouch_policy_revision NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  plan_json TEXT NOT NULL CHECK (json_valid(plan_json)),
+  plan_digest TEXT NOT NULL CHECK (
+    length(plan_digest) = 64 AND plan_digest NOT GLOB '*[^a-f0-9]*'
+  ),
+  plan_bytes INTEGER NOT NULL CHECK (plan_bytes BETWEEN 1 AND 8192),
+  created_at TEXT NOT NULL,
+  created_at_ms INTEGER NOT NULL CHECK (created_at_ms >= 0),
+  expires_at TEXT NOT NULL,
+  expires_at_ms INTEGER NOT NULL CHECK (expires_at_ms = created_at_ms + 300000)
+) STRICT;
+
+CREATE INDEX integration_authorization_plans_digest
+ON integration_authorization_plans (plan_digest);
+
+CREATE INDEX integration_authorization_plans_expiry
+ON integration_authorization_plans (integration, expires_at_ms);
+
+CREATE TABLE integration_authorization_revisions (
+  authorization_revision INTEGER PRIMARY KEY AUTOINCREMENT,
+  integration TEXT NOT NULL CHECK (integration = 'codex'),
+  state TEXT NOT NULL CHECK (
+    state IN ('active', 'replaced', 'revoking', 'revoked', 'cleanup_unknown')
+  ),
+  plan_id TEXT NOT NULL REFERENCES integration_authorization_plans(plan_id)
+    ON DELETE RESTRICT,
+  plan_digest TEXT NOT NULL CHECK (
+    length(plan_digest) = 64 AND plan_digest NOT GLOB '*[^a-f0-9]*'
+  ),
+  executable_path TEXT NOT NULL CHECK (
+    length(executable_path) BETWEEN 1 AND 4096 AND
+    substr(executable_path, 1, 1) = '/'
+  ),
+  executable_sha256 TEXT NOT NULL CHECK (
+    length(executable_sha256) = 64 AND executable_sha256 NOT GLOB '*[^a-f0-9]*'
+  ),
+  adapter_version TEXT NOT NULL CHECK (
+    length(adapter_version) BETWEEN 1 AND 128 AND
+    adapter_version NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  owner_kinds_json TEXT NOT NULL CHECK (json_valid(owner_kinds_json)),
+  sandbox_policy_revision TEXT NOT NULL CHECK (
+    length(sandbox_policy_revision) BETWEEN 1 AND 128 AND
+    sandbox_policy_revision NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  vouch_policy_revision TEXT NOT NULL CHECK (
+    length(vouch_policy_revision) BETWEEN 1 AND 128 AND
+    vouch_policy_revision NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  replaced_by_revision INTEGER
+    REFERENCES integration_authorization_revisions(authorization_revision)
+    ON DELETE RESTRICT DEFERRABLE INITIALLY DEFERRED,
+  revocation_started_at TEXT,
+  terminalized_at TEXT,
+  cleanup_unknown_at TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  CHECK (
+    (state = 'active' AND replaced_by_revision IS NULL AND
+      revocation_started_at IS NULL AND terminalized_at IS NULL AND
+      cleanup_unknown_at IS NULL) OR
+    (state = 'replaced' AND replaced_by_revision IS NOT NULL AND
+      revocation_started_at IS NULL AND terminalized_at IS NULL AND
+      cleanup_unknown_at IS NULL) OR
+    (state = 'revoking' AND replaced_by_revision IS NULL AND
+      revocation_started_at IS NOT NULL AND terminalized_at IS NULL AND
+      cleanup_unknown_at IS NULL) OR
+    (state = 'revoked' AND replaced_by_revision IS NULL AND
+      revocation_started_at IS NOT NULL AND terminalized_at IS NOT NULL AND
+      cleanup_unknown_at IS NULL) OR
+    (state = 'cleanup_unknown' AND replaced_by_revision IS NULL AND
+      revocation_started_at IS NOT NULL AND terminalized_at IS NULL AND
+      cleanup_unknown_at IS NOT NULL)
+  )
+) STRICT;
+
+CREATE UNIQUE INDEX integration_authorization_revisions_one_active
+ON integration_authorization_revisions (integration)
+WHERE state = 'active';
+
+CREATE UNIQUE INDEX integration_authorization_revisions_one_revoking
+ON integration_authorization_revisions (integration)
+WHERE state = 'revoking';
+
+CREATE INDEX integration_authorization_revisions_recent
+ON integration_authorization_revisions (integration, authorization_revision DESC);
+
+CREATE TABLE integration_authorization_permits (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  permit_id TEXT UNIQUE NOT NULL CHECK (
+    length(permit_id) BETWEEN 1 AND 128 AND
+    permit_id NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  integration TEXT NOT NULL CHECK (integration = 'codex'),
+  authorization_revision INTEGER NOT NULL
+    REFERENCES integration_authorization_revisions(authorization_revision)
+    ON DELETE RESTRICT,
+  owner_kind TEXT NOT NULL CHECK (owner_kind IN ('codex-probe', 'codex-session')),
+  scope_command_id TEXT NOT NULL CHECK (
+    length(scope_command_id) BETWEEN 1 AND 128 AND
+    scope_command_id NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  scope_session_id TEXT CHECK (
+    scope_session_id IS NULL OR
+    (length(scope_session_id) BETWEEN 1 AND 128 AND
+      scope_session_id NOT GLOB '*[^A-Za-z0-9._:-]*')
+  ),
+  executable_sha256 TEXT NOT NULL CHECK (
+    length(executable_sha256) = 64 AND executable_sha256 NOT GLOB '*[^a-f0-9]*'
+  ),
+  adapter_version TEXT NOT NULL CHECK (
+    length(adapter_version) BETWEEN 1 AND 128 AND
+    adapter_version NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  sandbox_policy_revision TEXT NOT NULL CHECK (
+    length(sandbox_policy_revision) BETWEEN 1 AND 128 AND
+    sandbox_policy_revision NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  vouch_policy_revision TEXT NOT NULL CHECK (
+    length(vouch_policy_revision) BETWEEN 1 AND 128 AND
+    vouch_policy_revision NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  fence_id TEXT NOT NULL CHECK (
+    length(fence_id) BETWEEN 1 AND 128 AND
+    fence_id NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  state TEXT NOT NULL CHECK (
+    state IN ('issued', 'dispatching', 'started', 'terminal')
+  ),
+  issued_at TEXT NOT NULL,
+  issued_at_ms INTEGER NOT NULL CHECK (issued_at_ms >= 0),
+  expires_at TEXT NOT NULL,
+  expires_at_ms INTEGER NOT NULL CHECK (expires_at_ms = issued_at_ms + 2000),
+  dispatching_at TEXT,
+  dispatching_at_ms INTEGER,
+  started_at TEXT,
+  started_at_ms INTEGER,
+  terminal_at TEXT,
+  terminal_at_ms INTEGER,
+  terminal_reason TEXT CHECK (
+    terminal_reason IS NULL OR
+    terminal_reason IN (
+      'cleanup_unknown',
+      'completed',
+      'expired',
+      'failed',
+      'revoked_after_start',
+      'revoked_before_start',
+      'stale_policy',
+      'stale_revision'
+    )
+  ),
+  process_tree_id TEXT CHECK (
+    process_tree_id IS NULL OR
+    (length(process_tree_id) BETWEEN 1 AND 128 AND
+      process_tree_id NOT GLOB '*[^A-Za-z0-9._:-]*')
+  ),
+  CHECK (
+    (state = 'issued' AND dispatching_at IS NULL AND dispatching_at_ms IS NULL AND
+      started_at IS NULL AND started_at_ms IS NULL AND
+      terminal_at IS NULL AND terminal_at_ms IS NULL AND
+      terminal_reason IS NULL AND process_tree_id IS NULL) OR
+    (state = 'dispatching' AND dispatching_at IS NOT NULL AND
+      dispatching_at_ms IS NOT NULL AND dispatching_at_ms >= issued_at_ms AND
+      started_at IS NULL AND started_at_ms IS NULL AND
+      terminal_at IS NULL AND terminal_at_ms IS NULL AND
+      terminal_reason IS NULL AND process_tree_id IS NULL) OR
+    (state = 'started' AND dispatching_at IS NOT NULL AND
+      dispatching_at_ms IS NOT NULL AND dispatching_at_ms >= issued_at_ms AND
+      started_at IS NOT NULL AND started_at_ms IS NOT NULL AND
+      started_at_ms >= dispatching_at_ms AND terminal_at IS NULL AND
+      terminal_at_ms IS NULL AND terminal_reason IS NULL AND
+      process_tree_id IS NOT NULL) OR
+    (state = 'terminal' AND terminal_at IS NOT NULL AND
+      terminal_at_ms IS NOT NULL AND terminal_reason IS NOT NULL AND
+      terminal_at_ms >= COALESCE(started_at_ms, dispatching_at_ms, issued_at_ms) AND
+      ((dispatching_at IS NULL AND dispatching_at_ms IS NULL) OR
+        (dispatching_at IS NOT NULL AND dispatching_at_ms IS NOT NULL AND
+          dispatching_at_ms >= issued_at_ms)) AND
+      ((started_at IS NULL AND started_at_ms IS NULL AND process_tree_id IS NULL) OR
+        (started_at IS NOT NULL AND started_at_ms IS NOT NULL AND
+          started_at_ms >= COALESCE(dispatching_at_ms, issued_at_ms) AND
+          process_tree_id IS NOT NULL)))
+  )
+) STRICT;
+
+CREATE INDEX integration_authorization_permits_unsettled
+ON integration_authorization_permits (
+  authorization_revision, state, expires_at_ms, sequence
+);
+
+CREATE INDEX integration_authorization_permits_terminal_retention
+ON integration_authorization_permits (
+  integration, state, terminal_at_ms, sequence
+);
+
+CREATE TABLE integration_authorization_permit_rollups (
+  integration TEXT NOT NULL CHECK (integration = 'codex'),
+  authorization_revision INTEGER NOT NULL
+    REFERENCES integration_authorization_revisions(authorization_revision)
+    ON DELETE RESTRICT,
+  terminal_reason TEXT NOT NULL CHECK (
+    terminal_reason IN (
+      'cleanup_unknown',
+      'completed',
+      'expired',
+      'failed',
+      'revoked_after_start',
+      'revoked_before_start',
+      'stale_policy',
+      'stale_revision'
+    )
+  ),
+  count INTEGER NOT NULL CHECK (count >= 1),
+  PRIMARY KEY (integration, authorization_revision, terminal_reason)
+) STRICT, WITHOUT ROWID;
+
+CREATE TABLE integration_authorization_command_replays (
+  command_id TEXT PRIMARY KEY NOT NULL CHECK (
+    length(command_id) BETWEEN 1 AND 128 AND
+    command_id NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  method TEXT NOT NULL CHECK (
+    method IN (
+      'integration.apply.codex',
+      'integration.permit.dispatch',
+      'integration.permit.issue',
+      'integration.permit.settle',
+      'integration.permit.start',
+      'integration.plan.codex',
+      'integration.remove.codex',
+      'integration.remove.settle.codex'
+    )
+  ),
+  request_digest TEXT NOT NULL CHECK (
+    length(request_digest) BETWEEN 1 AND 128 AND
+    request_digest NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  result_json TEXT NOT NULL CHECK (json_valid(result_json)),
+  created_at TEXT NOT NULL
+) STRICT;
+
+CREATE TRIGGER integration_authorization_plans_immutable_update
+BEFORE UPDATE ON integration_authorization_plans
+BEGIN
+  SELECT RAISE(ABORT, 'integration authorization plans are immutable');
+END;
+
+CREATE TRIGGER integration_authorization_plans_immutable_delete
+BEFORE DELETE ON integration_authorization_plans
+BEGIN
+  SELECT RAISE(ABORT, 'integration authorization plans are immutable');
+END;
+
+CREATE TRIGGER integration_authorization_permit_unsettled_limit_insert
+BEFORE INSERT ON integration_authorization_permits
+WHEN NEW.state IN ('issued', 'dispatching', 'started')
+BEGIN
+  SELECT CASE
+    WHEN (
+      SELECT COUNT(*)
+      FROM integration_authorization_permits
+      WHERE authorization_revision = NEW.authorization_revision
+        AND state IN ('issued', 'dispatching', 'started')
+    ) >= 8
+    THEN RAISE(ABORT, 'integration authorization permit saturation')
+  END;
+END;
+`;
+//# sourceMappingURL=migration-eleven.js.map

package/dist/storage/migration-eleven.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-eleven.js","sourceRoot":"","sources":["../../src/storage/migration-eleven.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwSjC,CAAC"}

package/dist/storage/migration-fourteen.d.ts

@@ -0,0 +1,2 @@
+export declare const migrationFourteenSql: string;
+//# sourceMappingURL=migration-fourteen.d.ts.map

package/dist/storage/migration-fourteen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-fourteen.d.ts","sourceRoot":"","sources":["../../src/storage/migration-fourteen.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,oBAAoB,QAyThC,CAAC"}

package/dist/storage/migration-fourteen.js

@@ -0,0 +1,316 @@
+import { MAX_TURN_INPUT_BYTES, MAX_TURN_RESPONSE_BYTES, } from "@maiaos/protocol";
+export const migrationFourteenSql = `
+CREATE TABLE migration_fourteen_sequences (
+  name TEXT PRIMARY KEY NOT NULL,
+  sequence INTEGER NOT NULL CHECK (sequence >= 0)
+) STRICT, WITHOUT ROWID;
+
+INSERT INTO migration_fourteen_sequences(name, sequence)
+SELECT name, seq FROM sqlite_sequence
+WHERE name IN ('sessions', 'session_turns', 'pi_rpc_authorization_permits');
+
+CREATE TABLE sessions_v14 (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  session_id TEXT UNIQUE NOT NULL,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(workspace_id) ON DELETE RESTRICT,
+  workspace_revision INTEGER NOT NULL CHECK (workspace_revision >= 1),
+  runtime TEXT NOT NULL,
+  profile TEXT NOT NULL,
+  state TEXT NOT NULL CHECK (
+    state IN (
+      'idle', 'starting', 'running', 'waiting-approval', 'interrupted',
+      'recovering', 'stopping', 'stopped', 'failed'
+    )
+  ),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  CHECK (
+    (runtime = 'codex' AND profile = 'codex') OR
+    (runtime = 'pi' AND profile = 'pi-rpc')
+  ),
+  UNIQUE (session_id, runtime, profile)
+) STRICT;
+
+CREATE TABLE session_runtime_activations_v14 (
+  session_id TEXT PRIMARY KEY,
+  command_id TEXT UNIQUE NOT NULL REFERENCES command_receipts(command_id)
+    ON DELETE RESTRICT DEFERRABLE INITIALLY DEFERRED,
+  runtime TEXT NOT NULL,
+  profile TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (
+    status IN ('queued', 'launching', 'recovering', 'ready', 'failed')
+  ),
+  working_directory TEXT NOT NULL,
+  runtime_thread_id TEXT,
+  runtime_session_id TEXT,
+  executable_version TEXT,
+  failure_reason TEXT CHECK (
+    failure_reason IS NULL OR failure_reason IN (
+      'activation_failed', 'activation_outcome_unknown', 'runtime_exited'
+    )
+  ),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  CHECK (
+    (runtime = 'codex' AND profile = 'codex') OR
+    (runtime = 'pi' AND profile = 'pi-rpc')
+  ),
+  CHECK (
+    (status IN ('queued', 'launching') AND runtime_thread_id IS NULL AND
+      runtime_session_id IS NULL AND executable_version IS NULL AND
+      failure_reason IS NULL) OR
+    (status IN ('recovering', 'ready') AND runtime_thread_id IS NOT NULL AND
+      runtime_session_id IS NOT NULL AND executable_version IS NOT NULL AND
+      failure_reason IS NULL) OR
+    (status = 'failed' AND runtime_thread_id IS NULL AND
+      runtime_session_id IS NULL AND executable_version IS NULL AND
+      failure_reason IS NOT NULL)
+  ),
+  FOREIGN KEY (session_id, runtime, profile)
+    REFERENCES sessions_v14(session_id, runtime, profile) ON DELETE RESTRICT
+) STRICT;
+
+CREATE TABLE session_turns_v14 (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  turn_id TEXT UNIQUE NOT NULL,
+  session_id TEXT NOT NULL REFERENCES sessions_v14(session_id) ON DELETE RESTRICT,
+  command_id TEXT UNIQUE NOT NULL REFERENCES command_receipts(command_id)
+    ON DELETE RESTRICT DEFERRABLE INITIALLY DEFERRED,
+  state TEXT NOT NULL CHECK (
+    state IN (
+      'queued', 'dispatching', 'running', 'completed', 'failed',
+      'outcome-unknown', 'interrupted'
+    )
+  ),
+  input_text TEXT NOT NULL CHECK (
+    length(CAST(input_text AS BLOB)) BETWEEN 1 AND ${String(MAX_TURN_INPUT_BYTES)}
+  ),
+  runtime_turn_id TEXT,
+  response_text TEXT,
+  token_usage_json TEXT CHECK (
+    token_usage_json IS NULL OR json_valid(token_usage_json)
+  ),
+  failure_reason TEXT CHECK (
+    failure_reason IS NULL OR failure_reason IN (
+      'approval_required', 'output_limit_exceeded', 'protocol_invalid',
+      'repository_changed', 'runtime_exited', 'runtime_failed',
+      'turn_deadline_exceeded', 'turn_rejected'
+    )
+  ),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  session_revision INTEGER NOT NULL CHECK (session_revision >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  CHECK (
+    (state IN ('queued', 'dispatching') AND runtime_turn_id IS NULL AND
+      response_text IS NULL AND token_usage_json IS NULL AND
+      failure_reason IS NULL) OR
+    (state = 'running' AND runtime_turn_id IS NOT NULL AND
+      response_text IS NULL AND token_usage_json IS NULL AND
+      failure_reason IS NULL) OR
+    (state = 'completed' AND runtime_turn_id IS NOT NULL AND
+      response_text IS NOT NULL AND
+      length(CAST(response_text AS BLOB)) <= ${String(MAX_TURN_RESPONSE_BYTES)} AND
+      failure_reason IS NULL) OR
+    (state = 'failed' AND response_text IS NULL AND
+      token_usage_json IS NULL AND failure_reason IS NOT NULL AND
+      failure_reason IN (
+        'approval_required', 'repository_changed', 'runtime_failed',
+        'turn_rejected'
+      )) OR
+    (state = 'outcome-unknown' AND response_text IS NULL AND
+      token_usage_json IS NULL AND failure_reason IS NOT NULL AND
+      failure_reason IN (
+        'output_limit_exceeded', 'protocol_invalid', 'runtime_exited',
+        'turn_deadline_exceeded'
+      )) OR
+    (state = 'interrupted' AND runtime_turn_id IS NOT NULL AND
+      response_text IS NULL AND token_usage_json IS NULL AND
+      failure_reason IS NULL)
+  )
+) STRICT;
+
+INSERT INTO sessions_v14(
+  sequence, session_id, workspace_id, workspace_revision, runtime, profile,
+  state, revision, created_at, updated_at
+)
+SELECT sequence, session_id, workspace_id, workspace_revision, runtime, 'codex',
+  state, revision, created_at, updated_at
+FROM sessions;
+
+INSERT INTO session_runtime_activations_v14(
+  session_id, command_id, runtime, profile, status, working_directory,
+  runtime_thread_id, runtime_session_id, executable_version, failure_reason,
+  created_at, updated_at
+)
+SELECT session_id, command_id, runtime, 'codex', status, working_directory,
+  runtime_thread_id, runtime_session_id, executable_version, failure_reason,
+  created_at, updated_at
+FROM session_runtime_activations;
+
+INSERT INTO session_turns_v14(
+  sequence, turn_id, session_id, command_id, state, input_text,
+  runtime_turn_id, response_text, token_usage_json, failure_reason, revision,
+  session_revision, created_at, updated_at
+)
+SELECT sequence, turn_id, session_id, command_id, state, input_text,
+  runtime_turn_id, response_text, token_usage_json, failure_reason, revision,
+  session_revision, created_at, updated_at
+FROM session_turns;
+
+DROP TABLE session_runtime_activations;
+DROP TABLE session_turns;
+DROP TABLE sessions;
+
+ALTER TABLE sessions_v14 RENAME TO sessions;
+ALTER TABLE session_runtime_activations_v14 RENAME TO session_runtime_activations;
+ALTER TABLE session_turns_v14 RENAME TO session_turns;
+
+CREATE INDEX sessions_workspace_sequence
+ON sessions (workspace_id, sequence);
+
+CREATE INDEX session_runtime_activations_status
+ON session_runtime_activations (status, created_at);
+
+CREATE INDEX session_turns_session_sequence
+ON session_turns (session_id, sequence);
+
+CREATE INDEX session_turns_state_sequence
+ON session_turns (state, sequence);
+
+CREATE UNIQUE INDEX session_turns_one_active_per_session
+ON session_turns (session_id) WHERE state IN ('dispatching', 'running');
+
+CREATE TABLE pi_rpc_authorization_permits_v14 (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  permit_id TEXT UNIQUE NOT NULL CHECK (
+    length(permit_id) BETWEEN 1 AND 128 AND
+    permit_id NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  integration TEXT NOT NULL CHECK (integration = 'pi-rpc'),
+  authorization_revision INTEGER NOT NULL
+    REFERENCES pi_rpc_authorization_revisions(authorization_revision)
+    ON DELETE RESTRICT,
+  owner_kind TEXT NOT NULL CHECK (
+    owner_kind IN ('pi-rpc-probe', 'pi-rpc-session')
+  ),
+  scope_command_id TEXT NOT NULL CHECK (
+    length(scope_command_id) BETWEEN 1 AND 128 AND
+    scope_command_id NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  runtime_session_id TEXT NOT NULL CHECK (
+    length(runtime_session_id) BETWEEN 1 AND 128 AND
+    runtime_session_id NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  interpreter_sha256 TEXT NOT NULL CHECK (
+    length(interpreter_sha256) = 64 AND
+    interpreter_sha256 NOT GLOB '*[^a-f0-9]*'
+  ),
+  entry_sha256 TEXT NOT NULL CHECK (
+    length(entry_sha256) = 64 AND entry_sha256 NOT GLOB '*[^a-f0-9]*'
+  ),
+  closure_sha256 TEXT NOT NULL CHECK (
+    length(closure_sha256) = 64 AND closure_sha256 NOT GLOB '*[^a-f0-9]*'
+  ),
+  adapter_version TEXT NOT NULL CHECK (
+    length(adapter_version) BETWEEN 1 AND 128 AND
+    adapter_version NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  conversation_policy_revision TEXT NOT NULL CHECK (
+    length(conversation_policy_revision) BETWEEN 1 AND 128 AND
+    conversation_policy_revision NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  vouch_policy_revision TEXT NOT NULL CHECK (
+    length(vouch_policy_revision) BETWEEN 1 AND 128 AND
+    vouch_policy_revision NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  fence_id TEXT NOT NULL CHECK (
+    length(fence_id) BETWEEN 1 AND 128 AND
+    fence_id NOT GLOB '*[^A-Za-z0-9._:-]*'
+  ),
+  state TEXT NOT NULL CHECK (
+    state IN ('issued', 'dispatching', 'started', 'terminal')
+  ),
+  issued_at TEXT NOT NULL,
+  issued_at_ms INTEGER NOT NULL CHECK (issued_at_ms >= 0),
+  expires_at TEXT NOT NULL,
+  expires_at_ms INTEGER NOT NULL CHECK (expires_at_ms = issued_at_ms + 2000),
+  dispatching_at TEXT,
+  dispatching_at_ms INTEGER,
+  started_at TEXT,
+  started_at_ms INTEGER,
+  terminal_at TEXT,
+  terminal_at_ms INTEGER,
+  terminal_reason TEXT CHECK (
+    terminal_reason IS NULL OR terminal_reason IN (
+      'cleanup_unknown', 'completed', 'expired', 'failed',
+      'revoked_after_start', 'revoked_before_start', 'stale_policy',
+      'stale_revision'
+    )
+  ),
+  process_tree_id TEXT CHECK (
+    process_tree_id IS NULL OR
+    (length(process_tree_id) BETWEEN 1 AND 128 AND
+      process_tree_id NOT GLOB '*[^A-Za-z0-9._:-]*')
+  ),
+  CHECK (
+    (state = 'issued' AND dispatching_at IS NULL AND dispatching_at_ms IS NULL AND
+      started_at IS NULL AND started_at_ms IS NULL AND terminal_at IS NULL AND
+      terminal_at_ms IS NULL AND terminal_reason IS NULL AND
+      process_tree_id IS NULL) OR
+    (state = 'dispatching' AND dispatching_at IS NOT NULL AND
+      dispatching_at_ms IS NOT NULL AND dispatching_at_ms >= issued_at_ms AND
+      started_at IS NULL AND started_at_ms IS NULL AND terminal_at IS NULL AND
+      terminal_at_ms IS NULL AND terminal_reason IS NULL AND
+      process_tree_id IS NULL) OR
+    (state = 'started' AND dispatching_at IS NOT NULL AND
+      dispatching_at_ms IS NOT NULL AND started_at IS NOT NULL AND
+      started_at_ms IS NOT NULL AND started_at_ms >= dispatching_at_ms AND
+      terminal_at IS NULL AND terminal_at_ms IS NULL AND
+      terminal_reason IS NULL AND process_tree_id IS NOT NULL) OR
+    (state = 'terminal' AND terminal_at IS NOT NULL AND
+      terminal_at_ms IS NOT NULL AND terminal_reason IS NOT NULL AND
+      terminal_at_ms >= COALESCE(started_at_ms, dispatching_at_ms, issued_at_ms) AND
+      ((dispatching_at IS NULL AND dispatching_at_ms IS NULL) OR
+        (dispatching_at IS NOT NULL AND dispatching_at_ms IS NOT NULL)) AND
+      ((started_at IS NULL AND started_at_ms IS NULL AND process_tree_id IS NULL) OR
+        (started_at IS NOT NULL AND started_at_ms IS NOT NULL AND
+          process_tree_id IS NOT NULL)))
+  )
+) STRICT;
+
+INSERT INTO pi_rpc_authorization_permits_v14(
+  sequence, permit_id, integration, authorization_revision, owner_kind,
+  scope_command_id, runtime_session_id, interpreter_sha256, entry_sha256,
+  closure_sha256, adapter_version, conversation_policy_revision,
+  vouch_policy_revision, fence_id, state, issued_at, issued_at_ms, expires_at,
+  expires_at_ms, dispatching_at, dispatching_at_ms, started_at, started_at_ms,
+  terminal_at, terminal_at_ms, terminal_reason, process_tree_id
+)
+SELECT sequence, permit_id, integration, authorization_revision, owner_kind,
+  scope_command_id, runtime_session_id, interpreter_sha256, entry_sha256,
+  closure_sha256, adapter_version, conversation_policy_revision,
+  vouch_policy_revision, fence_id, state, issued_at, issued_at_ms, expires_at,
+  expires_at_ms, dispatching_at, dispatching_at_ms, started_at, started_at_ms,
+  terminal_at, terminal_at_ms, terminal_reason, process_tree_id
+FROM pi_rpc_authorization_permits;
+
+DROP TABLE pi_rpc_authorization_permits;
+ALTER TABLE pi_rpc_authorization_permits_v14
+RENAME TO pi_rpc_authorization_permits;
+
+CREATE INDEX pi_rpc_authorization_permits_unsettled
+ON pi_rpc_authorization_permits (
+  authorization_revision, state, expires_at_ms, sequence
+);
+
+DELETE FROM sqlite_sequence
+WHERE name IN ('sessions', 'session_turns', 'pi_rpc_authorization_permits');
+
+INSERT INTO sqlite_sequence(name, seq)
+SELECT name, sequence FROM migration_fourteen_sequences;
+
+DROP TABLE migration_fourteen_sequences;
+`;
+//# sourceMappingURL=migration-fourteen.js.map

package/dist/storage/migration-fourteen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-fourteen.js","sourceRoot":"","sources":["../../src/storage/migration-fourteen.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qDAqFiB,MAAM,CAAC,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;+CA2BlC,MAAM,CAAC,uBAAuB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyM7E,CAAC"}

package/dist/storage/migration-nine.d.ts

@@ -0,0 +1,2 @@
+export declare const migrationNineSql: string;
+//# sourceMappingURL=migration-nine.d.ts.map

package/dist/storage/migration-nine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-nine.d.ts","sourceRoot":"","sources":["../../src/storage/migration-nine.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,gBAAgB,QAmsC5B,CAAC"}