@maiaos/node 0.1.0-canary.44938d4.manual.1

package/dist/storage/migrations.js

@@ -0,0 +1,909 @@
+import { createHash } from "node:crypto";
+import { MAX_ORCHESTRATION_DELIVERIES_PER_MAILBOX, MAX_ORCHESTRATION_MAILBOX_CONTENT_BYTES, MAX_ORCHESTRATION_MESSAGE_BODY_BYTES, MAX_ORCHESTRATION_MESSAGE_SUBJECT_BYTES, MAX_ORCHESTRATION_TASK_OBJECTIVE_BYTES, MAX_TURN_INPUT_BYTES, MAX_TURN_RESPONSE_BYTES, } from "@maiaos/protocol";
+import { Schema } from "effect";
+import { makeNodeRuntimeError } from "../runtime/errors.js";
+import { migrationElevenSql } from "./migration-eleven.js";
+import { migrationFourteenSql } from "./migration-fourteen.js";
+import { migrationNineSql } from "./migration-nine.js";
+import { migrationTenSql } from "./migration-ten.js";
+import { migrationThirteenSql } from "./migration-thirteen.js";
+import { migrationTwelveSql } from "./migration-twelve.js";
+import { sqlitePolicy } from "./policy.js";
+const migrationOneSql = `
+CREATE TABLE command_receipts (
+  command_id TEXT PRIMARY KEY NOT NULL,
+  receipt_id TEXT UNIQUE NOT NULL,
+  method TEXT NOT NULL,
+  request_digest TEXT NOT NULL,
+  result_json TEXT NOT NULL CHECK (json_valid(result_json)),
+  event_cursor INTEGER NOT NULL,
+  created_at TEXT NOT NULL
+) STRICT;
+
+CREATE TABLE aggregate_revisions (
+  aggregate_type TEXT NOT NULL,
+  aggregate_id TEXT NOT NULL,
+  revision INTEGER NOT NULL CHECK (revision >= 0),
+  PRIMARY KEY (aggregate_type, aggregate_id)
+) STRICT, WITHOUT ROWID;
+
+CREATE TABLE domain_events (
+  global_sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  aggregate_type TEXT NOT NULL,
+  aggregate_id TEXT NOT NULL,
+  aggregate_sequence INTEGER NOT NULL CHECK (aggregate_sequence > 0),
+  event_type TEXT NOT NULL,
+  payload_json TEXT NOT NULL CHECK (json_valid(payload_json)),
+  recorded_at TEXT NOT NULL,
+  command_id TEXT NOT NULL REFERENCES command_receipts(command_id),
+  UNIQUE (aggregate_type, aggregate_id, aggregate_sequence)
+) STRICT;
+
+CREATE INDEX domain_events_aggregate_sequence
+ON domain_events (aggregate_type, aggregate_id, aggregate_sequence);
+`;
+const migrationTwoSql = `
+CREATE TABLE configuration_snapshots (
+  snapshot_id TEXT PRIMARY KEY NOT NULL,
+  scope TEXT NOT NULL CHECK (scope IN ('user', 'project')),
+  scope_id TEXT NOT NULL,
+  content_digest TEXT NOT NULL,
+  schema_version TEXT NOT NULL,
+  resolved_json TEXT NOT NULL CHECK (json_valid(resolved_json)),
+  provenance_json TEXT NOT NULL CHECK (json_valid(provenance_json)),
+  created_at TEXT NOT NULL,
+  UNIQUE (scope, scope_id, content_digest)
+) STRICT;
+`;
+const migrationThreeSql = `
+ALTER TABLE command_receipts
+ADD COLUMN actor_id TEXT NOT NULL DEFAULT '!maia:v3:unresolved!';
+
+ALTER TABLE command_receipts
+ADD COLUMN target_type TEXT NOT NULL DEFAULT '!maia:v3:unresolved!';
+
+ALTER TABLE command_receipts
+ADD COLUMN target_id TEXT NOT NULL DEFAULT '!maia:v3:unresolved!';
+
+UPDATE command_receipts
+SET actor_id = 'actor_local_user',
+target_type = COALESCE(
+  (SELECT aggregate_type FROM domain_events
+   WHERE domain_events.command_id = command_receipts.command_id),
+  target_type
+),
+target_id = COALESCE(
+  (SELECT aggregate_id FROM domain_events
+   WHERE domain_events.command_id = command_receipts.command_id),
+  target_id
+);
+
+CREATE TABLE migration_three_identity_guard (
+  invalid INTEGER NOT NULL CHECK (invalid = 0)
+) STRICT;
+
+INSERT INTO migration_three_identity_guard(invalid)
+SELECT 1 FROM command_receipts
+WHERE actor_id = '!maia:v3:unresolved!'
+  OR target_type = '!maia:v3:unresolved!'
+  OR target_id = '!maia:v3:unresolved!'
+LIMIT 1;
+
+DROP TABLE migration_three_identity_guard;
+
+CREATE TRIGGER command_receipts_require_identity
+BEFORE INSERT ON command_receipts
+WHEN NEW.actor_id = '!maia:v3:unresolved!'
+  OR NEW.target_type = '!maia:v3:unresolved!'
+  OR NEW.target_id = '!maia:v3:unresolved!'
+BEGIN
+  SELECT RAISE(ABORT, 'command receipt identity is required');
+END;
+
+CREATE TABLE projects (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  project_id TEXT UNIQUE NOT NULL,
+  name TEXT NOT NULL,
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+) STRICT;
+
+CREATE TABLE repositories (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  repository_id TEXT UNIQUE NOT NULL,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE RESTRICT,
+  name TEXT NOT NULL,
+  location_id TEXT UNIQUE NOT NULL,
+  root_path TEXT NOT NULL,
+  root_path_key TEXT UNIQUE NOT NULL,
+  root_device TEXT NOT NULL,
+  root_inode TEXT NOT NULL,
+  git_common_directory TEXT NOT NULL,
+  git_common_directory_key TEXT UNIQUE NOT NULL,
+  git_common_device TEXT NOT NULL,
+  git_common_inode TEXT NOT NULL,
+  vcs TEXT NOT NULL CHECK (vcs = 'git'),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+) STRICT;
+
+CREATE INDEX repositories_project_sequence
+ON repositories (project_id, sequence);
+
+CREATE UNIQUE INDEX repositories_root_identity
+ON repositories (root_device, root_inode);
+
+CREATE UNIQUE INDEX repositories_git_common_identity
+ON repositories (git_common_device, git_common_inode);
+
+CREATE TABLE workspaces (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  workspace_id TEXT UNIQUE NOT NULL,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE RESTRICT,
+  name TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK (kind IN ('local-main', 'git-worktree')),
+  state TEXT NOT NULL CHECK (state IN ('provisioning', 'ready', 'removing', 'failed')),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+) STRICT;
+
+CREATE INDEX workspaces_project_sequence
+ON workspaces (project_id, sequence);
+
+CREATE TABLE workspace_checkouts (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  checkout_id TEXT UNIQUE NOT NULL,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(workspace_id) ON DELETE RESTRICT,
+  repository_id TEXT NOT NULL REFERENCES repositories(repository_id) ON DELETE RESTRICT,
+  role TEXT NOT NULL CHECK (role IN ('primary', 'attached')),
+  location_id TEXT UNIQUE NOT NULL,
+  path TEXT NOT NULL,
+  path_key TEXT UNIQUE NOT NULL,
+  checkout_mode TEXT NOT NULL CHECK (checkout_mode IN ('canonical', 'git-worktree')),
+  branch TEXT NOT NULL,
+  base_revision TEXT NOT NULL,
+  head_revision TEXT NOT NULL,
+  dirty INTEGER NOT NULL CHECK (dirty IN (0, 1)),
+  ownership_kind TEXT NOT NULL CHECK (ownership_kind IN ('canonical', 'imported', 'maia-created')),
+  cleanup_policy TEXT NOT NULL CHECK (cleanup_policy IN ('never', 'unregister-only', 'plan-required')),
+  creation_receipt_id TEXT,
+  state TEXT NOT NULL CHECK (state IN ('provisioning', 'ready', 'removing', 'failed')),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  CHECK (
+    (ownership_kind = 'canonical' AND cleanup_policy = 'never' AND creation_receipt_id IS NULL) OR
+    (ownership_kind = 'imported' AND cleanup_policy = 'unregister-only' AND creation_receipt_id IS NULL) OR
+    (ownership_kind = 'maia-created' AND cleanup_policy = 'plan-required' AND creation_receipt_id IS NOT NULL)
+  ),
+  UNIQUE (workspace_id, repository_id)
+) STRICT;
+
+CREATE INDEX workspace_checkouts_workspace_sequence
+ON workspace_checkouts (workspace_id, sequence);
+
+CREATE UNIQUE INDEX workspace_checkouts_one_primary
+ON workspace_checkouts (workspace_id) WHERE role = 'primary';
+
+CREATE INDEX workspace_checkouts_repository
+ON workspace_checkouts (repository_id, sequence);
+`;
+const migrationFourSql = `
+CREATE TABLE sessions (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  session_id TEXT UNIQUE NOT NULL,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(workspace_id) ON DELETE RESTRICT,
+  workspace_revision INTEGER NOT NULL CHECK (workspace_revision >= 1),
+  runtime TEXT NOT NULL CHECK (runtime = 'codex'),
+  state TEXT NOT NULL CHECK (
+    state IN (
+      'idle', 'starting', 'running', 'waiting-approval', 'interrupted',
+      'recovering', 'stopping', 'stopped', 'failed'
+    )
+  ),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+) STRICT;
+
+CREATE INDEX sessions_workspace_sequence
+ON sessions (workspace_id, sequence);
+`;
+const migrationFiveSql = `
+CREATE TABLE session_runtime_activations (
+  session_id TEXT PRIMARY KEY REFERENCES sessions(session_id) ON DELETE RESTRICT,
+  command_id TEXT UNIQUE NOT NULL REFERENCES command_receipts(command_id)
+    ON DELETE RESTRICT DEFERRABLE INITIALLY DEFERRED,
+  runtime TEXT NOT NULL CHECK (runtime = 'codex'),
+  status TEXT NOT NULL CHECK (
+    status IN ('queued', 'launching', 'recovering', 'ready', 'failed')
+  ),
+  working_directory TEXT NOT NULL,
+  runtime_thread_id TEXT,
+  runtime_session_id TEXT,
+  executable_version TEXT,
+  failure_reason TEXT CHECK (
+    failure_reason IS NULL OR failure_reason IN (
+      'activation_failed', 'activation_outcome_unknown', 'runtime_exited'
+    )
+  ),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  CHECK (
+    (status IN ('queued', 'launching') AND runtime_thread_id IS NULL AND
+      runtime_session_id IS NULL AND executable_version IS NULL AND
+      failure_reason IS NULL) OR
+    (status IN ('recovering', 'ready') AND runtime_thread_id IS NOT NULL AND
+      runtime_session_id IS NOT NULL AND executable_version IS NOT NULL AND
+      failure_reason IS NULL) OR
+    (status = 'failed' AND runtime_thread_id IS NULL AND
+      runtime_session_id IS NULL AND executable_version IS NULL AND
+      failure_reason IS NOT NULL)
+  )
+) STRICT;
+
+CREATE INDEX session_runtime_activations_status
+ON session_runtime_activations (status, created_at);
+`;
+const migrationSixSql = `
+CREATE TABLE session_turns (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  turn_id TEXT UNIQUE NOT NULL,
+  session_id TEXT NOT NULL REFERENCES sessions(session_id) ON DELETE RESTRICT,
+  command_id TEXT UNIQUE NOT NULL REFERENCES command_receipts(command_id)
+    ON DELETE RESTRICT DEFERRABLE INITIALLY DEFERRED,
+  state TEXT NOT NULL CHECK (
+    state IN (
+      'queued', 'dispatching', 'running', 'completed', 'failed',
+      'outcome-unknown', 'interrupted'
+    )
+  ),
+  input_text TEXT NOT NULL CHECK (
+    length(CAST(input_text AS BLOB)) BETWEEN 1 AND ${String(MAX_TURN_INPUT_BYTES)}
+  ),
+  runtime_turn_id TEXT,
+  response_text TEXT,
+  token_usage_json TEXT CHECK (
+    token_usage_json IS NULL OR json_valid(token_usage_json)
+  ),
+  failure_reason TEXT CHECK (
+    failure_reason IS NULL OR failure_reason IN (
+      'approval_required', 'output_limit_exceeded', 'protocol_invalid',
+      'repository_changed', 'runtime_exited', 'runtime_failed',
+      'turn_deadline_exceeded', 'turn_rejected'
+    )
+  ),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  session_revision INTEGER NOT NULL CHECK (session_revision >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  CHECK (
+    (state IN ('queued', 'dispatching') AND runtime_turn_id IS NULL AND
+      response_text IS NULL AND token_usage_json IS NULL AND
+      failure_reason IS NULL) OR
+    (state = 'running' AND runtime_turn_id IS NOT NULL AND
+      response_text IS NULL AND token_usage_json IS NULL AND
+      failure_reason IS NULL) OR
+    (state = 'completed' AND runtime_turn_id IS NOT NULL AND
+      response_text IS NOT NULL AND
+      length(CAST(response_text AS BLOB)) <= ${String(MAX_TURN_RESPONSE_BYTES)} AND
+      failure_reason IS NULL) OR
+    (state = 'failed' AND response_text IS NULL AND
+      token_usage_json IS NULL AND failure_reason IS NOT NULL AND
+      failure_reason IN (
+        'approval_required', 'repository_changed', 'runtime_failed',
+        'turn_rejected'
+      )) OR
+    (state = 'outcome-unknown' AND response_text IS NULL AND
+      token_usage_json IS NULL AND failure_reason IS NOT NULL AND
+      failure_reason IN (
+        'output_limit_exceeded', 'protocol_invalid', 'runtime_exited',
+        'turn_deadline_exceeded'
+      )) OR
+    (state = 'interrupted' AND runtime_turn_id IS NOT NULL AND
+      response_text IS NULL AND token_usage_json IS NULL AND
+      failure_reason IS NULL)
+  )
+) STRICT;
+
+CREATE INDEX session_turns_session_sequence
+ON session_turns (session_id, sequence);
+
+CREATE INDEX session_turns_state_sequence
+ON session_turns (state, sequence);
+
+CREATE UNIQUE INDEX session_turns_one_active_per_session
+ON session_turns (session_id) WHERE state IN ('dispatching', 'running');
+`;
+const migrationSevenSql = `
+CREATE TABLE terminals (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  terminal_id TEXT UNIQUE NOT NULL,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(workspace_id) ON DELETE RESTRICT,
+  workspace_revision INTEGER NOT NULL CHECK (workspace_revision >= 1),
+  platform TEXT NOT NULL CHECK (platform IN ('darwin', 'linux', 'win32', 'other')),
+  unavailability_code TEXT NOT NULL CHECK (
+    unavailability_code IN (
+      'platform_unsupported', 'terminal_containment_unsupported'
+    )
+  ),
+  state TEXT NOT NULL CHECK (state = 'unavailable'),
+  revision INTEGER NOT NULL CHECK (revision = 1),
+  chunk_head INTEGER NOT NULL CHECK (chunk_head = 0),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  CHECK (
+    (platform IN ('darwin', 'linux') AND
+      unavailability_code = 'terminal_containment_unsupported') OR
+    (platform IN ('win32', 'other') AND
+      unavailability_code = 'platform_unsupported')
+  )
+) STRICT;
+
+CREATE INDEX terminals_workspace_sequence
+ON terminals (workspace_id, sequence);
+`;
+const migrationEightSql = `
+CREATE UNIQUE INDEX terminals_workspace_terminal_identity
+ON terminals (workspace_id, terminal_id);
+
+CREATE TABLE orchestration_runs (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  run_id TEXT UNIQUE NOT NULL,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(workspace_id) ON DELETE RESTRICT,
+  terminal_id TEXT NOT NULL REFERENCES terminals(terminal_id) ON DELETE RESTRICT,
+  root_task_id TEXT NOT NULL,
+  dispatch_task_id TEXT NOT NULL,
+  coordinator_actor_id TEXT NOT NULL CHECK (coordinator_actor_id = 'actor_local_user'),
+  coordinator_epoch INTEGER NOT NULL CHECK (coordinator_epoch = 1),
+  state TEXT NOT NULL CHECK (state IN ('active', 'waiting-question', 'failed')),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  message_content_bytes INTEGER NOT NULL DEFAULT 0 CHECK (
+    message_content_bytes BETWEEN 0 AND 8388608
+  ),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (run_id, workspace_id),
+  UNIQUE (run_id, terminal_id),
+  FOREIGN KEY (workspace_id, terminal_id)
+    REFERENCES terminals(workspace_id, terminal_id) ON DELETE RESTRICT,
+  FOREIGN KEY (run_id, root_task_id)
+    REFERENCES orchestration_tasks(run_id, task_id)
+    ON DELETE RESTRICT DEFERRABLE INITIALLY DEFERRED,
+  FOREIGN KEY (run_id, dispatch_task_id)
+    REFERENCES orchestration_tasks(run_id, task_id)
+    ON DELETE RESTRICT DEFERRABLE INITIALLY DEFERRED
+) STRICT;
+
+CREATE INDEX orchestration_runs_workspace_sequence
+ON orchestration_runs (workspace_id, sequence);
+
+CREATE TABLE orchestration_tasks (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  task_id TEXT UNIQUE NOT NULL,
+  run_id TEXT NOT NULL REFERENCES orchestration_runs(run_id) ON DELETE RESTRICT,
+  client_key TEXT NOT NULL,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(workspace_id) ON DELETE RESTRICT,
+  objective TEXT NOT NULL CHECK (
+    length(CAST(objective AS BLOB)) BETWEEN 1 AND ${String(MAX_ORCHESTRATION_TASK_OBJECTIVE_BYTES)}
+  ),
+  state TEXT NOT NULL CHECK (state IN ('pending', 'active', 'waiting-question', 'failed')),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (run_id, client_key),
+  UNIQUE (run_id, task_id),
+  UNIQUE (run_id, workspace_id, task_id),
+  FOREIGN KEY (run_id, workspace_id)
+    REFERENCES orchestration_runs(run_id, workspace_id) ON DELETE RESTRICT
+) STRICT;
+
+CREATE INDEX orchestration_tasks_run_sequence
+ON orchestration_tasks (run_id, sequence);
+
+CREATE TABLE orchestration_task_dependencies (
+  run_id TEXT NOT NULL REFERENCES orchestration_runs(run_id) ON DELETE RESTRICT,
+  task_id TEXT NOT NULL,
+  dependency_task_id TEXT NOT NULL,
+  position INTEGER NOT NULL CHECK (position >= 0),
+  PRIMARY KEY (run_id, task_id, dependency_task_id),
+  UNIQUE (run_id, task_id, position),
+  CHECK (task_id <> dependency_task_id),
+  FOREIGN KEY (run_id, task_id)
+    REFERENCES orchestration_tasks(run_id, task_id) ON DELETE RESTRICT,
+  FOREIGN KEY (run_id, dependency_task_id)
+    REFERENCES orchestration_tasks(run_id, task_id) ON DELETE RESTRICT
+) STRICT, WITHOUT ROWID;
+
+CREATE TABLE orchestration_attempts (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  attempt_id TEXT UNIQUE NOT NULL,
+  run_id TEXT NOT NULL REFERENCES orchestration_runs(run_id) ON DELETE RESTRICT,
+  task_id TEXT NOT NULL,
+  ordinal INTEGER NOT NULL CHECK (ordinal = 1),
+  state TEXT NOT NULL CHECK (state IN ('active', 'waiting-question', 'failed')),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (run_id),
+  UNIQUE (run_id, task_id, ordinal),
+  UNIQUE (run_id, task_id, attempt_id),
+  FOREIGN KEY (run_id, task_id)
+    REFERENCES orchestration_tasks(run_id, task_id) ON DELETE RESTRICT
+) STRICT;
+
+CREATE TABLE orchestration_dispatches (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  dispatch_id TEXT UNIQUE NOT NULL,
+  run_id TEXT NOT NULL REFERENCES orchestration_runs(run_id) ON DELETE RESTRICT,
+  task_id TEXT NOT NULL,
+  attempt_id TEXT UNIQUE NOT NULL,
+  terminal_id TEXT NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('active', 'waiting-question', 'failed')),
+  failure_code TEXT CHECK (
+    failure_code IS NULL OR failure_code IN ('platform_unsupported', 'terminal_containment_unsupported')
+  ),
+  failure_platform TEXT CHECK (
+    failure_platform IS NULL OR failure_platform IN ('darwin', 'linux', 'win32', 'other')
+  ),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  CHECK (
+    (state IN ('active', 'waiting-question') AND failure_code IS NULL AND failure_platform IS NULL) OR
+    (state = 'failed' AND failure_code = 'terminal_containment_unsupported' AND
+      failure_platform IN ('darwin', 'linux')) OR
+    (state = 'failed' AND failure_code = 'platform_unsupported' AND
+      failure_platform IN ('win32', 'other'))
+  ),
+  UNIQUE (run_id, dispatch_id),
+  UNIQUE (run_id, task_id, attempt_id, dispatch_id),
+  FOREIGN KEY (run_id, task_id, attempt_id)
+    REFERENCES orchestration_attempts(run_id, task_id, attempt_id) ON DELETE RESTRICT,
+  FOREIGN KEY (run_id, terminal_id)
+    REFERENCES orchestration_runs(run_id, terminal_id) ON DELETE RESTRICT
+) STRICT;
+
+CREATE UNIQUE INDEX orchestration_dispatches_one_per_run
+ON orchestration_dispatches (run_id);
+
+CREATE TABLE orchestration_mailboxes (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  mailbox_id TEXT UNIQUE NOT NULL,
+  run_id TEXT NOT NULL REFERENCES orchestration_runs(run_id) ON DELETE RESTRICT,
+  owner_kind TEXT NOT NULL CHECK (owner_kind IN ('run', 'dispatch')),
+  owner_id TEXT NOT NULL,
+  run_owner_id TEXT,
+  dispatch_owner_id TEXT,
+  head_sequence INTEGER NOT NULL DEFAULT 0 CHECK (head_sequence >= 0),
+  delivery_count INTEGER NOT NULL DEFAULT 0 CHECK (
+    delivery_count BETWEEN 0 AND ${String(MAX_ORCHESTRATION_DELIVERIES_PER_MAILBOX)}
+  ),
+  content_bytes INTEGER NOT NULL DEFAULT 0 CHECK (
+    content_bytes BETWEEN 0 AND ${String(MAX_ORCHESTRATION_MAILBOX_CONTENT_BYTES)}
+  ),
+  revision INTEGER NOT NULL DEFAULT 1 CHECK (revision >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (owner_kind, owner_id),
+  UNIQUE (run_id, owner_kind),
+  UNIQUE (run_id, owner_kind, owner_id, mailbox_id),
+  CHECK (
+    (owner_kind = 'run' AND owner_id = run_id AND run_owner_id = owner_id AND
+      dispatch_owner_id IS NULL) OR
+    (owner_kind = 'dispatch' AND run_owner_id IS NULL AND
+      dispatch_owner_id = owner_id)
+  ),
+  FOREIGN KEY (run_owner_id)
+    REFERENCES orchestration_runs(run_id) ON DELETE RESTRICT,
+  FOREIGN KEY (run_id, dispatch_owner_id)
+    REFERENCES orchestration_dispatches(run_id, dispatch_id) ON DELETE RESTRICT
+) STRICT;
+
+CREATE TABLE orchestration_messages (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  message_id TEXT UNIQUE NOT NULL,
+  run_id TEXT NOT NULL REFERENCES orchestration_runs(run_id) ON DELETE RESTRICT,
+  sender_kind TEXT NOT NULL CHECK (sender_kind = 'run-coordinator'),
+  sender_run_id TEXT NOT NULL REFERENCES orchestration_runs(run_id) ON DELETE RESTRICT,
+  sender_actor_id TEXT NOT NULL CHECK (sender_actor_id = 'actor_local_user'),
+  recipient_kind TEXT NOT NULL CHECK (recipient_kind IN ('run', 'dispatch')),
+  recipient_id TEXT NOT NULL,
+  recipient_mailbox_id TEXT NOT NULL,
+  message_type TEXT NOT NULL CHECK (message_type IN ('dispatch', 'question', 'reply', 'dispatch-settled')),
+  subject TEXT NOT NULL CHECK (
+    length(CAST(subject AS BLOB)) BETWEEN 1 AND ${String(MAX_ORCHESTRATION_MESSAGE_SUBJECT_BYTES)}
+  ),
+  body TEXT NOT NULL CHECK (
+    length(CAST(body AS BLOB)) BETWEEN 1 AND ${String(MAX_ORCHESTRATION_MESSAGE_BODY_BYTES)}
+  ),
+  question_id TEXT,
+  content_bytes INTEGER NOT NULL CHECK (content_bytes > 0),
+  content_digest TEXT NOT NULL CHECK (
+    length(content_digest) = 64 AND content_digest NOT GLOB '*[^a-f0-9]*'
+  ),
+  created_at TEXT NOT NULL,
+  CHECK (run_id = sender_run_id),
+  UNIQUE (run_id, message_id),
+  UNIQUE (
+    run_id, message_id, question_id, message_type, recipient_kind, recipient_id
+  ),
+  UNIQUE (message_id, recipient_mailbox_id),
+  FOREIGN KEY (run_id, recipient_kind, recipient_id, recipient_mailbox_id)
+    REFERENCES orchestration_mailboxes(run_id, owner_kind, owner_id, mailbox_id)
+    ON DELETE RESTRICT,
+  FOREIGN KEY (run_id, question_id)
+    REFERENCES orchestration_questions(run_id, question_id)
+    ON DELETE RESTRICT DEFERRABLE INITIALLY DEFERRED
+) STRICT;
+
+CREATE TABLE orchestration_deliveries (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  delivery_id TEXT UNIQUE NOT NULL,
+  mailbox_id TEXT NOT NULL REFERENCES orchestration_mailboxes(mailbox_id) ON DELETE RESTRICT,
+  message_id TEXT UNIQUE NOT NULL,
+  mailbox_sequence INTEGER NOT NULL CHECK (mailbox_sequence >= 1),
+  state TEXT NOT NULL CHECK (state IN ('pending', 'acknowledged')),
+  attempt_count INTEGER NOT NULL DEFAULT 0 CHECK (attempt_count BETWEEN 0 AND 65535),
+  first_delivered_at TEXT,
+  last_delivered_at TEXT,
+  acknowledging_actor_id TEXT CHECK (
+    acknowledging_actor_id IS NULL OR acknowledging_actor_id = 'actor_local_user'
+  ),
+  acknowledgement_command_id TEXT,
+  acknowledged_at TEXT,
+  created_at TEXT NOT NULL,
+  UNIQUE (mailbox_id, mailbox_sequence),
+  CHECK (
+    (state = 'pending' AND acknowledging_actor_id IS NULL AND
+      acknowledgement_command_id IS NULL AND acknowledged_at IS NULL) OR
+    (state = 'acknowledged' AND acknowledging_actor_id IS NOT NULL AND
+      acknowledgement_command_id IS NOT NULL AND acknowledged_at IS NOT NULL)
+  ),
+  FOREIGN KEY (acknowledgement_command_id)
+    REFERENCES command_receipts(command_id)
+    ON DELETE RESTRICT DEFERRABLE INITIALLY DEFERRED,
+  FOREIGN KEY (message_id, mailbox_id)
+    REFERENCES orchestration_messages(message_id, recipient_mailbox_id)
+    ON DELETE RESTRICT
+) STRICT;
+
+CREATE INDEX orchestration_deliveries_pending
+ON orchestration_deliveries (mailbox_id, state, mailbox_sequence);
+
+CREATE TABLE orchestration_questions (
+  sequence INTEGER PRIMARY KEY AUTOINCREMENT,
+  question_id TEXT UNIQUE NOT NULL,
+  run_id TEXT NOT NULL REFERENCES orchestration_runs(run_id) ON DELETE RESTRICT,
+  task_id TEXT NOT NULL,
+  attempt_id TEXT NOT NULL,
+  dispatch_id TEXT NOT NULL,
+  ask_message_id TEXT UNIQUE NOT NULL,
+  ask_message_type TEXT NOT NULL DEFAULT 'question' CHECK (ask_message_type = 'question'),
+  ask_recipient_kind TEXT NOT NULL DEFAULT 'run' CHECK (ask_recipient_kind = 'run'),
+  ask_recipient_id TEXT NOT NULL,
+  reply_message_id TEXT UNIQUE,
+  reply_message_type TEXT CHECK (reply_message_type IS NULL OR reply_message_type = 'reply'),
+  reply_recipient_kind TEXT CHECK (reply_recipient_kind IS NULL OR reply_recipient_kind = 'dispatch'),
+  reply_recipient_id TEXT,
+  subject TEXT NOT NULL CHECK (
+    length(CAST(subject AS BLOB)) BETWEEN 1 AND ${String(MAX_ORCHESTRATION_MESSAGE_SUBJECT_BYTES)}
+  ),
+  body TEXT NOT NULL CHECK (
+    length(CAST(body AS BLOB)) BETWEEN 1 AND ${String(MAX_ORCHESTRATION_MESSAGE_BODY_BYTES)}
+  ),
+  answer TEXT CHECK (
+    answer IS NULL OR length(CAST(answer AS BLOB)) BETWEEN 1 AND ${String(MAX_ORCHESTRATION_MESSAGE_BODY_BYTES)}
+  ),
+  state TEXT NOT NULL CHECK (state IN ('open', 'answered', 'cancelled')),
+  revision INTEGER NOT NULL CHECK (revision >= 1),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  UNIQUE (run_id, question_id),
+  CHECK (ask_recipient_id = run_id),
+  CHECK (
+    (state = 'open' AND reply_message_id IS NULL AND reply_message_type IS NULL AND
+      reply_recipient_kind IS NULL AND reply_recipient_id IS NULL AND answer IS NULL) OR
+    (state = 'answered' AND reply_message_id IS NOT NULL AND
+      reply_message_type = 'reply' AND reply_recipient_kind = 'dispatch' AND
+      reply_recipient_id = dispatch_id AND answer IS NOT NULL) OR
+    (state = 'cancelled' AND reply_message_id IS NULL AND reply_message_type IS NULL AND
+      reply_recipient_kind IS NULL AND reply_recipient_id IS NULL AND answer IS NULL)
+  ),
+  FOREIGN KEY (run_id, task_id, attempt_id, dispatch_id)
+    REFERENCES orchestration_dispatches(run_id, task_id, attempt_id, dispatch_id)
+    ON DELETE RESTRICT,
+  FOREIGN KEY (
+    run_id, ask_message_id, question_id, ask_message_type,
+    ask_recipient_kind, ask_recipient_id
+  ) REFERENCES orchestration_messages(
+    run_id, message_id, question_id, message_type, recipient_kind, recipient_id
+  ) ON DELETE RESTRICT,
+  FOREIGN KEY (
+    run_id, reply_message_id, question_id, reply_message_type,
+    reply_recipient_kind, reply_recipient_id
+  ) REFERENCES orchestration_messages(
+    run_id, message_id, question_id, message_type, recipient_kind, recipient_id
+  ) ON DELETE RESTRICT
+) STRICT;
+
+CREATE UNIQUE INDEX orchestration_questions_one_open_dispatch
+ON orchestration_questions (dispatch_id) WHERE state = 'open';
+`;
+const migrationChecksum = (sql) => createHash("sha256").update(sql).digest("hex");
+const migrations = [
+    {
+        checksum: migrationChecksum(migrationOneSql),
+        name: "command-event-journal",
+        sql: migrationOneSql,
+        version: 1,
+    },
+    {
+        checksum: migrationChecksum(migrationTwoSql),
+        name: "configuration-snapshots",
+        sql: migrationTwoSql,
+        version: 2,
+    },
+    {
+        checksum: migrationChecksum(migrationThreeSql),
+        name: "project-workspace-registry",
+        sql: migrationThreeSql,
+        version: 3,
+    },
+    {
+        checksum: migrationChecksum(migrationFourSql),
+        name: "durable-session-ledger",
+        sql: migrationFourSql,
+        version: 4,
+    },
+    {
+        checksum: migrationChecksum(migrationFiveSql),
+        name: "codex-session-activation",
+        sql: migrationFiveSql,
+        version: 5,
+    },
+    {
+        checksum: migrationChecksum(migrationSixSql),
+        name: "durable-session-turns",
+        sql: migrationSixSql,
+        version: 6,
+    },
+    {
+        checksum: migrationChecksum(migrationSevenSql),
+        name: "durable-terminal-contract",
+        sql: migrationSevenSql,
+        version: 7,
+    },
+    {
+        checksum: migrationChecksum(migrationEightSql),
+        name: "local-v1-orchestration",
+        sql: migrationEightSql,
+        version: 8,
+    },
+    {
+        checksum: migrationChecksum(migrationNineSql),
+        name: "durable-live-terminal-authority",
+        sql: migrationNineSql,
+        version: 9,
+    },
+    {
+        checksum: migrationChecksum(migrationTenSql),
+        name: "command-receipt-recent-indexes",
+        sql: migrationTenSql,
+        version: 10,
+    },
+    {
+        checksum: migrationChecksum(migrationElevenSql),
+        name: "integration-authorization-and-permits",
+        sql: migrationElevenSql,
+        version: 11,
+    },
+    {
+        checksum: migrationChecksum(migrationTwelveSql),
+        name: "neutral-execution-selection",
+        sql: migrationTwelveSql,
+        version: 12,
+    },
+    {
+        checksum: migrationChecksum(migrationThirteenSql),
+        name: "pi-rpc-authorization",
+        sql: migrationThirteenSql,
+        version: 13,
+    },
+    {
+        checksum: migrationChecksum(migrationFourteenSql),
+        name: "pi-rpc-session-authority",
+        sql: migrationFourteenSql,
+        version: 14,
+    },
+];
+export const LATEST_SCHEMA_VERSION = migrations.length;
+export const schemaTagForVersion = (version) => `maia.node-storage/v${String(version)}`;
+const migrationRowSchema = Schema.Struct({
+    checksum: Schema.String,
+    name: Schema.String,
+    version: Schema.Number,
+});
+const decodeMigrationRow = Schema.decodeUnknownSync(migrationRowSchema);
+const schemaTagRowSchema = Schema.Struct({ value: Schema.String });
+const decodeSchemaTagRow = Schema.decodeUnknownSync(schemaTagRowSchema);
+const numberRowSchema = Schema.Record(Schema.String, Schema.Number);
+const decodeNumberRow = Schema.decodeUnknownSync(numberRowSchema);
+const stringRowSchema = Schema.Record(Schema.String, Schema.String);
+const decodeStringRow = Schema.decodeUnknownSync(stringRowSchema);
+export const readPragmaNumber = (database, sql) => {
+    const value = Object.values(decodeNumberRow(database.prepare(sql).get()))[0];
+    if (value === undefined || !Number.isSafeInteger(value)) {
+        throw new TypeError("SQLite returned an invalid numeric pragma.");
+    }
+    return value;
+};
+export const readPragmaString = (database, sql) => {
+    const value = Object.values(decodeStringRow(database.prepare(sql).get()))[0];
+    if (value === undefined) {
+        throw new TypeError("SQLite returned an invalid string pragma.");
+    }
+    return value;
+};
+export const verifyIntegrity = (database) => {
+    if (readPragmaString(database, "PRAGMA quick_check(1)") !== "ok" ||
+        database.prepare("PRAGMA foreign_key_check").get() !== undefined) {
+        throw makeNodeRuntimeError("storage_corrupt", "The Maia database failed its integrity check.");
+    }
+};
+const configureSecurityPragmas = (database) => {
+    database.enableLoadExtension(false);
+    const optionalDatabase = database;
+    optionalDatabase.enableDefensive?.(true);
+    database.exec(`
+    PRAGMA busy_timeout = ${String(sqlitePolicy.busyTimeoutMs)};
+    PRAGMA foreign_keys = ON;
+    PRAGMA journal_mode = WAL;
+    PRAGMA journal_size_limit = ${String(sqlitePolicy.maximumWalBytes)};
+    PRAGMA synchronous = FULL;
+    PRAGMA temp_store = MEMORY;
+    PRAGMA trusted_schema = OFF;
+    PRAGMA wal_autocheckpoint = 1000;
+  `);
+};
+const requireCompatibleApplicationId = (database) => {
+    const applicationId = readPragmaNumber(database, "PRAGMA application_id");
+    if (applicationId !== 0 && applicationId !== sqlitePolicy.applicationId) {
+        throw makeNodeRuntimeError("storage_corrupt", "The database file belongs to a different application.");
+    }
+    return applicationId;
+};
+const initializeApplicationId = (database, applicationId) => {
+    if (applicationId === sqlitePolicy.applicationId)
+        return;
+    database.exec(`PRAGMA application_id = ${String(sqlitePolicy.applicationId)}`);
+};
+const verifyInitializedApplicationId = (database) => {
+    if (readPragmaNumber(database, "PRAGMA application_id") !==
+        sqlitePolicy.applicationId) {
+        throw makeNodeRuntimeError("storage_corrupt", "The Maia database application identifier was not persisted.");
+    }
+};
+const enforcePageLimit = (database) => {
+    const pageSize = readPragmaNumber(database, "PRAGMA page_size");
+    if (pageSize < 512 || pageSize > sqlitePolicy.maximumPageBytes) {
+        throw makeNodeRuntimeError("storage_corrupt", "The Maia database uses an unsupported page size.");
+    }
+    const maximumPages = Math.floor(sqlitePolicy.maximumDatabaseBytes / pageSize);
+    database.exec(`PRAGMA max_page_count = ${String(maximumPages)}`);
+};
+export const configureDatabase = (database) => {
+    configureSecurityPragmas(database);
+    requireCompatibleApplicationId(database);
+    enforcePageLimit(database);
+};
+const migrationMatches = (row, expected) => row.version === expected?.version &&
+    row.name === expected?.name &&
+    row.checksum === expected?.checksum;
+const verifyAppliedMigrations = (database, targetVersion) => {
+    const rows = database
+        .prepare("SELECT version, name, checksum FROM schema_migrations ORDER BY version")
+        .all()
+        .map((row) => decodeMigrationRow(row));
+    const expected = migrations.filter((migration) => migration.version <= targetVersion);
+    if (rows.length !== expected.length ||
+        rows.some((row, index) => !migrationMatches(row, expected[index]))) {
+        throw makeNodeRuntimeError("storage_corrupt", "The Maia database migration history does not match this executable.");
+    }
+};
+const applyOneMigration = (write, migration) => {
+    write.database.exec(migration.sql);
+    write.insert.run(migration.version, migration.name, migration.checksum, write.appliedAt);
+    write.writeSchemaTag.run(schemaTagForVersion(migration.version));
+    write.database.exec(`PRAGMA user_version = ${String(migration.version)}`);
+    write.afterMigration?.(migration.version);
+};
+const ensureMigrationInfrastructure = (database) => {
+    database.exec(`CREATE TABLE IF NOT EXISTS schema_migrations (
+    version INTEGER PRIMARY KEY NOT NULL,
+    name TEXT UNIQUE NOT NULL,
+    checksum TEXT NOT NULL,
+    applied_at TEXT NOT NULL
+  ) STRICT;
+
+  CREATE TABLE IF NOT EXISTS storage_metadata (
+    key TEXT PRIMARY KEY NOT NULL,
+    value TEXT NOT NULL
+  ) STRICT, WITHOUT ROWID`);
+};
+export const readSchemaTag = (database) => {
+    const row = database
+        .prepare("SELECT value FROM storage_metadata WHERE key = 'schema_tag'")
+        .get();
+    return row === undefined ? undefined : decodeSchemaTagRow(row).value;
+};
+const verifySchemaTag = (database, schemaVersion) => {
+    const actual = readSchemaTag(database);
+    const expected = schemaVersion === 0 ? undefined : schemaTagForVersion(schemaVersion);
+    if (actual !== expected) {
+        throw makeNodeRuntimeError("storage_corrupt", "The Maia database schema tag does not match its numeric version.");
+    }
+};
+const requireSupportedVersion = (database, targetVersion) => {
+    const current = readPragmaNumber(database, "PRAGMA user_version");
+    if (current > targetVersion) {
+        throw makeNodeRuntimeError("storage_corrupt", "The Maia database schema is newer than this executable.");
+    }
+    return current;
+};
+const makeMigrationWrite = (database, appliedAt, afterMigration) => ({
+    ...(afterMigration === undefined ? {} : { afterMigration }),
+    appliedAt,
+    database,
+    insert: database.prepare("INSERT INTO schema_migrations(version, name, checksum, applied_at) VALUES (?, ?, ?, ?)"),
+    writeSchemaTag: database.prepare("INSERT INTO storage_metadata(key, value) VALUES ('schema_tag', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value"),
+});
+const applyPendingMigrations = (write, currentVersion, targetVersion) => {
+    migrations
+        .filter(({ version }) => version > currentVersion && version <= targetVersion)
+        .forEach((migration) => {
+        applyOneMigration(write, migration);
+    });
+};
+const applyPendingMigrationState = (input, currentVersion) => {
+    ensureMigrationInfrastructure(input.database);
+    verifyAppliedMigrations(input.database, currentVersion);
+    verifySchemaTag(input.database, currentVersion);
+    applyPendingMigrations(makeMigrationWrite(input.database, input.appliedAt, input.afterMigration), currentVersion, input.targetVersion);
+};
+const applyMigrationBatch = (input) => {
+    const { database, targetVersion } = input;
+    const currentVersion = requireSupportedVersion(database, targetVersion);
+    const applicationId = requireCompatibleApplicationId(database);
+    if (currentVersion === targetVersion &&
+        applicationId === sqlitePolicy.applicationId) {
+        verifyAppliedMigrations(database, targetVersion);
+        verifySchemaTag(database, targetVersion);
+        return;
+    }
+    database.exec("BEGIN IMMEDIATE");
+    try {
+        initializeApplicationId(database, applicationId);
+        if (currentVersion !== targetVersion) {
+            applyPendingMigrationState(input, currentVersion);
+        }
+        verifyAppliedMigrations(database, targetVersion);
+        verifySchemaTag(database, targetVersion);
+        verifyInitializedApplicationId(database);
+        database.exec("COMMIT");
+    }
+    catch (error) {
+        database.exec("ROLLBACK");
+        throw error;
+    }
+};
+export const applyMigrations = (database, targetVersion, appliedAt) => {
+    applyMigrationBatch({ appliedAt, database, targetVersion });
+};
+export const migrationInternals = {
+    applyMigrationBatch,
+};
+//# sourceMappingURL=migrations.js.map