@moondeck/station 0.0.1 → 1.0.0

package/db/schema.ts

@@ -0,0 +1,850 @@
+/**
+ * Host-local SQLite schema (ADR-020).
+ *
+ * The cloud DB owns metadata and lifecycle. Each host owns only the runtime
+ * fields needed to recover containers, discover local ports, and tunnel
+ * editor/preview traffic.
+ */
+
+import { sql } from "drizzle-orm";
+import {
+  blob,
+  check,
+  index,
+  integer,
+  primaryKey,
+  sqliteTable,
+  text,
+} from "drizzle-orm/sqlite-core";
+
+export const hostTasks = sqliteTable(
+  "uai_host_tasks",
+  {
+    taskId: text("task_id").primaryKey(),
+    // ADR-154: the v1 epoch whose runtime was successfully established.
+    // Admission's monotonic floor lives separately so deleting this recovery
+    // row can never make an older dispatch current again. 0 means no v1
+    // runtime has been proven for this row (including every legacy row).
+    runEpoch: integer("run_epoch").notNull().default(0),
+    codeServerPort: integer("code_server_port"),
+    previewPorts: text("preview_ports").notNull().default("[]"),
+    composeProject: text("compose_project"),
+    worktreePath: text("worktree_path"),
+    // ADR-101 Phase C. Null rows predate the provider seam and are inferred as
+    // Docker Compose only when their legacy runtime identity is complete.
+    environmentProvider: text("environment_provider"),
+    environmentLocator: text("environment_locator"),
+    // ADR-153 rollout fence. Null rows predate the loader and mean `baked`.
+    envMode: text("env_mode"),
+    // Value-free resolver metadata for rebuilding the project-env gateway
+    // after a runner restart, before the cloud re-sends task-up.
+    projectEnvSpec: text("project_env_spec"),
+    // ADR-154 Files v1: the normalized mode from the cloud's task launch.
+    // Recovery must never trust the task-writable `.uai/files-mounted`
+    // marker as authority for what may be mounted.
+    sharedFilesMode: text("shared_files_mode", {
+      enum: ["off", "ro", "rw"],
+    }),
+    statusMirror: text("status_mirror"),
+    // Owner + project slugs — received in TaskLaunchInput at task-up and
+    // persisted here so the local UI (ADR-028) can show "who/what" without a
+    // cloud round-trip. The cloud stays the audit authority.
+    ownerUserId: text("owner_user_id"),
+    ownerEmail: text("owner_email"),
+    ownerName: text("owner_name"),
+    projectSlugs: text("project_slugs").notNull().default("[]"),
+    // Lead project first. Retained for legacy/baked machine-task agent spawns;
+    // loader tasks resolve only declared names through projectEnvSpec.
+    projectIds: text("project_ids").notNull().default("[]"),
+    // ADR-131 D3: which engine-account scope this task resolves credentials
+    // from ("org:<orgId>" on a shared host; null = "host"). Persisted so a
+    // host restart re-provisions the same scope before the cloud re-sends it.
+    engineAccountScope: text("engine_account_scope"),
+    lockedAt: integer("locked_at", { mode: "number" }),
+    startedAt: integer("started_at", { mode: "number" }),
+    endedAt: integer("ended_at", { mode: "number" }),
+    updatedAt: integer("updated_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (table) => ({
+    runEpochCheck: check(
+      "uai_host_tasks_run_epoch",
+      sql`${table.runEpoch} >= 0`,
+    ),
+    environmentPair: check(
+      "uai_host_tasks_environment_pair",
+      sql`(${table.environmentProvider} IS NULL) = (${table.environmentLocator} IS NULL)`,
+    ),
+    sharedFilesModeCheck: check(
+      "uai_host_tasks_shared_files_mode",
+      sql`${table.sharedFilesMode} IS NULL OR ${table.sharedFilesMode} IN ('off', 'ro', 'rw')`,
+    ),
+  }),
+);
+
+export type HostTask = typeof hostTasks.$inferSelect;
+export type NewHostTask = typeof hostTasks.$inferInsert;
+
+// ADR-154's non-secret assignment authority. It intentionally has no foreign
+// key to uai_host_tasks: terminal-history retention and orphan GC may remove a
+// runtime row, but neither is allowed to erase the highest epoch this runner
+// has admitted or reopen a closed assignment.
+export const hostTaskRunAssignments = sqliteTable(
+  "host_task_run_assignments",
+  {
+    taskId: text("task_id").primaryKey(),
+    highestRunEpoch: integer("highest_run_epoch").notNull(),
+    assignmentOpen: integer("assignment_open", { mode: "boolean" })
+      .notNull()
+      .default(true),
+    createdAt: integer("created_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+    updatedAt: integer("updated_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (table) => ({
+    runEpochCheck: check(
+      "host_task_run_assignments_epoch",
+      sql`${table.highestRunEpoch} >= 1`,
+    ),
+    assignmentOpenCheck: check(
+      "host_task_run_assignments_open",
+      sql`${table.assignmentOpen} IN (0, 1)`,
+    ),
+    taskIdCheck: check(
+      "host_task_run_assignments_task_id",
+      sql`length(${table.taskId}) > 0`,
+    ),
+  }),
+);
+
+export type HostTaskRunAssignment =
+  typeof hostTaskRunAssignments.$inferSelect;
+export type NewHostTaskRunAssignment =
+  typeof hostTaskRunAssignments.$inferInsert;
+
+// ADR-154: values never land here. This is only the durable witness needed
+// to remove a task-local credential file after a runner crash. The exact
+// runtime locator is part of the key because a later run may recreate the
+// same task id on a different container or VM.
+export const hostCredentialCleanupPaths = sqliteTable(
+  "host_credential_cleanup_paths",
+  {
+    taskId: text("task_id").notNull(),
+    runEpoch: integer("run_epoch").notNull(),
+    runtimeLocator: text("runtime_locator").notNull(),
+    lane: text("lane", {
+      enum: ["engine-auth", "github", "ssh", "files-session"],
+    }).notNull(),
+    path: text("path").notNull(),
+    credentialId: text("credential_id").notNull(),
+    createdAt: integer("created_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+    updatedAt: integer("updated_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (table) => ({
+    pk: primaryKey({
+      columns: [
+        table.taskId,
+        table.runEpoch,
+        table.runtimeLocator,
+        table.path,
+      ],
+    }),
+    taskCredentialIdx: index(
+      "host_credential_cleanup_paths_task_credential_idx",
+    ).on(table.taskId, table.runEpoch, table.credentialId),
+    runEpochCheck: check(
+      "host_credential_cleanup_paths_run_epoch",
+      sql`${table.runEpoch} >= 1`,
+    ),
+    identityCheck: check(
+      "host_credential_cleanup_paths_identity",
+      sql`length(${table.taskId}) > 0 AND length(${table.runtimeLocator}) > 0 AND length(${table.credentialId}) > 0`,
+    ),
+    laneCheck: check(
+      "host_credential_cleanup_paths_lane",
+      sql`${table.lane} IN ('engine-auth', 'github', 'ssh', 'files-session')`,
+    ),
+    absolutePathCheck: check(
+      "host_credential_cleanup_paths_absolute_path",
+      sql`substr(${table.path}, 1, 1) = '/'`,
+    ),
+  }),
+);
+
+export type HostCredentialCleanupPath =
+  typeof hostCredentialCleanupPaths.$inferSelect;
+export type NewHostCredentialCleanupPath =
+  typeof hostCredentialCleanupPaths.$inferInsert;
+
+// A task remains fail-closed across a host crash even when cleanup has not yet
+// reached (or has already deleted) an inventoried path. This row contains no
+// credential value; it is cleared only after the entire cleanup procedure has
+// completed successfully through the recorded epoch.
+export const hostCredentialCleanupPending = sqliteTable(
+  "host_credential_cleanup_pending",
+  {
+    taskId: text("task_id").primaryKey(),
+    runEpoch: integer("run_epoch").notNull(),
+    reason: text("reason", {
+      enum: [
+        "removed",
+        "denied",
+        "expired",
+        "assignment",
+        "restart",
+        "stop",
+        "park",
+        "teardown",
+      ],
+    }).notNull(),
+    createdAt: integer("created_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+    updatedAt: integer("updated_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (table) => ({
+    runEpochCheck: check(
+      "host_credential_cleanup_pending_run_epoch",
+      sql`${table.runEpoch} >= 1`,
+    ),
+    reasonCheck: check(
+      "host_credential_cleanup_pending_reason",
+      sql`${table.reason} IN ('removed', 'denied', 'expired', 'assignment', 'restart', 'stop', 'park', 'teardown')`,
+    ),
+    taskIdCheck: check(
+      "host_credential_cleanup_pending_task_id",
+      sql`length(${table.taskId}) > 0`,
+    ),
+  }),
+);
+
+export type HostCredentialCleanupPending =
+  typeof hostCredentialCleanupPending.$inferSelect;
+export type NewHostCredentialCleanupPending =
+  typeof hostCredentialCleanupPending.$inferInsert;
+
+// ADR-154 §6: every runtime a leased engine of a task's run was started in,
+// recorded before it starts. An env-token engine leaves no credential file
+// for the cleanup inventory to name, yet the cleanup must prove it stopped
+// wherever it ran, an older runtime included. Value-free.
+export const hostLeasedEngineRuntimes = sqliteTable(
+  "host_leased_engine_runtimes",
+  {
+    taskId: text("task_id").notNull(),
+    runEpoch: integer("run_epoch").notNull(),
+    runtimeLocator: text("runtime_locator").notNull(),
+    createdAt: integer("created_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (table) => ({
+    pk: primaryKey({
+      columns: [table.taskId, table.runEpoch, table.runtimeLocator],
+    }),
+    runEpochCheck: check(
+      "host_leased_engine_runtimes_run_epoch",
+      sql`${table.runEpoch} >= 1`,
+    ),
+    identityCheck: check(
+      "host_leased_engine_runtimes_identity",
+      sql`length(${table.taskId}) > 0 AND length(${table.runtimeLocator}) > 0`,
+    ),
+  }),
+);
+
+export type HostLeasedEngineRuntime =
+  typeof hostLeasedEngineRuntimes.$inferSelect;
+
+// The boot sweep's owed re-stops (2026-10-30): a stopped app container the
+// sweep starts only to remove its credential files is recorded here, by its
+// exact id and runtime, BEFORE it starts. Only proof that this container is
+// stopped again, or gone, retires the row; removing a credential path never
+// does. A crash after the start, a start that timed out yet started it, or a
+// stop that failed all leave the row for the next cleanup of the task to
+// settle first. Value-free.
+export const hostCredentialCleanupRestops = sqliteTable(
+  "host_credential_cleanup_restops",
+  {
+    taskId: text("task_id").notNull(),
+    containerId: text("container_id").notNull(),
+    runEpoch: integer("run_epoch").notNull(),
+    runtimeLocator: text("runtime_locator").notNull(),
+    createdAt: integer("created_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (table) => ({
+    pk: primaryKey({ columns: [table.taskId, table.containerId] }),
+    runEpochCheck: check(
+      "host_credential_cleanup_restops_run_epoch",
+      sql`${table.runEpoch} >= 1`,
+    ),
+    identityCheck: check(
+      "host_credential_cleanup_restops_identity",
+      sql`length(${table.taskId}) > 0 AND length(${table.containerId}) > 0 AND length(${table.runtimeLocator}) > 0`,
+    ),
+  }),
+);
+
+export type HostCredentialCleanupRestop =
+  typeof hostCredentialCleanupRestops.$inferSelect;
+
+// Singleton host-local settings row (ADR-100). Runtime switches that must be
+// visible before SQLite opens remain in `.env.local`; retention policy belongs
+// here because it governs owner-facing local history only. Correctness
+// tombstones and orphan-GC evidence are never controlled by this setting.
+export const hostSettings = sqliteTable(
+  "host_settings",
+  {
+    id: text("id").primaryKey().default("host"),
+    retainTerminalHistory: integer("retain_terminal_history", {
+      mode: "boolean",
+    })
+      .notNull()
+      .default(true),
+    updatedAt: integer("updated_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (table) => ({
+    singleton: check("host_settings_singleton", sql`${table.id} = 'host'`),
+    retentionBoolean: check(
+      "host_settings_retention_boolean",
+      sql`${table.retainTerminalHistory} IN (0, 1)`,
+    ),
+  }),
+);
+
+export type HostSettings = typeof hostSettings.$inferSelect;
+export type NewHostSettings = typeof hostSettings.$inferInsert;
+
+// Host-side task lifecycle event log (ADR-028). HostEvent (the agent-output
+// stream) is forwarded to the cloud, not stored; this table is the local
+// `/api/events` feed — appended on task.created/started/ended (+ ship).
+export const hostEvents = sqliteTable(
+  "uai_host_events",
+  {
+    id: text("id").primaryKey(), // ulid
+    taskId: text("task_id").notNull(),
+    kind: text("kind").notNull(), // task.created | task.started | task.ended | task.ship
+    ts: integer("ts", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+    detail: text("detail"),
+  },
+  (t) => ({
+    taskIdIdx: index("uai_host_events_task_id_idx").on(t.taskId),
+  }),
+);
+
+export type HostEventRow = typeof hostEvents.$inferSelect;
+export type NewHostEventRow = typeof hostEvents.$inferInsert;
+
+// GitHub user refresh token, encrypted at rest with the host master key
+// (ADR-027). The ONLY place a GitHub secret lives at rest. Access tokens are
+// never stored — they go straight into the container's gh config.
+export const githubTokens = sqliteTable("host_github_tokens", {
+  userId: text("user_id").primaryKey(),
+  installationId: integer("installation_id").notNull(),
+  /** Generation of the cloud binding whose credential this row contains.
+   * Readers trust the token only while it matches the durable mutation fence
+   * below, so a crash between claiming a newer generation and deleting this
+   * row leaves a safely inert old ciphertext rather than a usable old token. */
+  generation: integer("generation").notNull().default(0),
+  // ADR-033: holds a long-lived ACCESS token when kind="access", or a refresh
+  // token when kind="refresh" (legacy ADR-027). Encrypted at rest either way.
+  refreshTokenCt: blob("refresh_token_ct").notNull(),
+  refreshTokenNonce: blob("refresh_token_nonce").notNull(),
+  refreshTokenExpiresAt: integer("refresh_token_expires_at"),
+  // "access" (non-expiring, ADR-033) | "refresh" (expiring, ADR-027).
+  kind: text("kind").notNull().default("refresh"),
+  updatedAt: integer("updated_at").notNull(),
+  // ADR-134 slice 2: the credential-store parameter this row mirrors to.
+  storeRef: text("store_ref"),
+});
+
+export type GithubToken = typeof githubTokens.$inferSelect;
+export type NewGithubToken = typeof githubTokens.$inferInsert;
+
+// Durable monotonic tombstone for GitHub credential mutations. Kept separate
+// from the token row so a disconnect can reject a delayed older connect even
+// after the encrypted credential itself has been deleted.
+export const githubCredentialGenerations = sqliteTable(
+  "host_github_credential_generations",
+  {
+    userId: text("user_id").primaryKey(),
+    generation: integer("generation").notNull().default(0),
+    mutation: text("mutation").notNull().default("set"),
+    updatedAt: integer("updated_at").notNull(),
+  },
+);
+
+// Per-user ed25519 SSH key (ADR-029). Generated ON the host; the private key
+// lives encrypted at rest with the host master key (same secret-blind pattern
+// as host_github_tokens — ADR-015). The cloud only ever sees `public_key`,
+// which the user pastes into GitHub. Keyed by the internal cloud user id.
+export const sshKeys = sqliteTable("host_ssh_keys", {
+  userId: text("user_id").primaryKey(),
+  publicKey: text("public_key").notNull(), // OpenSSH "ssh-ed25519 AAAA… uai-<user>"
+  privateKeyCt: blob("private_key_ct").notNull(),
+  privateKeyNonce: blob("private_key_nonce").notNull(),
+  createdAt: integer("created_at").notNull(),
+  updatedAt: integer("updated_at").notNull(),
+  // ADR-134 slice 2: the credential-store parameter this row mirrors to.
+  storeRef: text("store_ref"),
+});
+
+export type SshKey = typeof sshKeys.$inferSelect;
+export type NewSshKey = typeof sshKeys.$inferInsert;
+
+// Per-(project, key) environment variable values, encrypted at rest with the
+// host master key (same secret-blind pattern as host_ssh_keys /
+// host_github_tokens — ADR-015). The cloud only ever sees KEY NAMES, never
+// values (values are write-only). Set by project/org members on the project
+// settings page (grouped by host); at task-up each project on the task gets ITS
+// (projectId, key) values injected under the key name. The same key name is
+// independent per project, and a project's values are independent per host.
+export const hostProjectEnv = sqliteTable(
+  "host_project_env",
+  {
+    projectId: text("project_id").notNull(),
+    key: text("key").notNull(),
+    valueEnc: text("value_enc").notNull(), // sealAesGcm output (base64 ct.nonce)
+    updatedAt: integer("updated_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+    // ADR-134 slice 3: the credential-store parameter this row mirrors to.
+    storeRef: text("store_ref"),
+    // The project's org, learned from an env.var.set/list frame that carries
+    // it (cloud from 2026-09-10) or from a stored value that does. It tags the
+    // mirrored parameter (`org`, `project`) so a task machine's tag-scoped
+    // lease can read it (ADR-133). Null until the cloud has said.
+    orgId: text("org_id"),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.projectId, t.key] }),
+  }),
+);
+
+export type HostProjectEnv = typeof hostProjectEnv.$inferSelect;
+export type NewHostProjectEnv = typeof hostProjectEnv.$inferInsert;
+
+// ADR-153: value-free authority records live beside (not inside) the legacy
+// encrypted value row. A delete therefore keeps its binding/head forever,
+// while a live owned-runner head always refers to that row.
+export const hostProjectEnvRecords = sqliteTable(
+  "host_project_env_records",
+  {
+    projectId: text("project_id").notNull(),
+    key: text("key").notNull(),
+    revision: integer("revision").notNull(),
+    generation: integer("generation").notNull(),
+    tombstone: integer("tombstone", { mode: "boolean" }).notNull(),
+    bindingJson: text("binding_json"),
+    policyEpoch: integer("policy_epoch"),
+    listingGeneration: integer("listing_generation").notNull(),
+    updatedAt: integer("updated_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.projectId, t.key] }),
+  }),
+);
+
+export const hostProjectEnvProjects = sqliteTable("host_project_env_projects", {
+  projectId: text("project_id").primaryKey(),
+  recordVersion: integer("record_version").notNull().default(0),
+});
+
+// Singleton activation, serving gate and ordered-delivery cursor. `modernWrite`
+// is raised only inside a mutation transaction so the permanent legacy table
+// triggers can distinguish this build from an old process still writing it.
+export const hostProjectEnvAuthority = sqliteTable("host_project_env_authority", {
+  id: text("id").primaryKey().default("host"),
+  activated: integer("activated", { mode: "boolean" }).notNull().default(false),
+  gateOpen: integer("gate_open", { mode: "boolean" }).notNull().default(true),
+  streamId: text("stream_id"),
+  appliedSequence: integer("applied_sequence").notNull().default(0),
+  attemptId: text("attempt_id"),
+  attemptLegacyVersion: integer("attempt_legacy_version"),
+  legacyVersion: integer("legacy_version").notNull().default(0),
+  policyEpochsJson: text("policy_epochs_json").notNull().default("[1]"),
+  modernWrite: integer("modern_write", { mode: "boolean" }).notNull().default(false),
+  updatedAt: integer("updated_at", { mode: "number" })
+    .notNull()
+    .default(sql`(unixepoch() * 1000)`),
+});
+
+// A receipt contains a keyed request MAC and a value-free result. In
+// particular, a set's plaintext is never replayable from SQLite.
+export const hostProjectEnvDeliveryReceipts = sqliteTable(
+  "host_project_env_delivery_receipts",
+  {
+    streamId: text("stream_id").notNull(),
+    sequence: integer("sequence").notNull(),
+    requestKind: text("request_kind").notNull(),
+    requestMac: text("request_mac").notNull(),
+    ok: integer("ok", { mode: "boolean" }).notNull(),
+    stateJson: text("state_json"),
+    recordVersion: integer("record_version"),
+    code: text("code"),
+    createdAt: integer("created_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (t) => ({ pk: primaryKey({ columns: [t.streamId, t.sequence] }) }),
+);
+
+export const hostProjectEnvLegacyJournal = sqliteTable(
+  "host_project_env_legacy_journal",
+  {
+    id: integer("id").primaryKey({ autoIncrement: true }),
+    projectId: text("project_id").notNull(),
+    key: text("key").notNull(),
+    mutation: text("mutation").notNull(),
+    createdAt: integer("created_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (t) => ({ keyIdx: index("host_project_env_legacy_journal_key_idx").on(t.projectId, t.key) }),
+);
+
+// ADR-153 Uai Cloud task-machine replica. These tables are deliberately
+// separate from the owned-runner authority above: a sidecar stages a complete
+// task snapshot while serving nothing, then promotes it atomically. In
+// particular, materialising a cloud value must not fire the owned authority's
+// permanent legacy-write triggers.
+export const hostProjectEnvReplicaAuthority = sqliteTable(
+  "host_project_env_replica_authority",
+  {
+    id: text("id").primaryKey().default("replica"),
+    activated: integer("activated", { mode: "boolean" }).notNull().default(false),
+    gateOpen: integer("gate_open", { mode: "boolean" }).notNull().default(false),
+    streamId: text("stream_id"),
+    appliedSequence: integer("applied_sequence").notNull().default(0),
+    attemptId: text("attempt_id"),
+    orgId: text("org_id"),
+    policyEpochsJson: text("policy_epochs_json").notNull().default("[1]"),
+    updatedAt: integer("updated_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (t) => ({
+    singleton: check("host_project_env_replica_authority_singleton", sql`${t.id} = 'replica'`),
+    booleans: check(
+      "host_project_env_replica_authority_booleans",
+      sql`${t.activated} IN (0, 1) AND ${t.gateOpen} IN (0, 1)`,
+    ),
+    cursor: check("host_project_env_replica_authority_cursor", sql`${t.appliedSequence} >= 0`),
+    stream: check(
+      "host_project_env_replica_authority_stream",
+      sql`(${t.activated} = 0 AND ${t.streamId} IS NULL AND ${t.appliedSequence} = 0 AND ${t.attemptId} IS NULL AND ${t.orgId} IS NULL AND ${t.gateOpen} = 0) OR (${t.activated} = 1 AND ${t.streamId} IS NOT NULL AND ${t.orgId} IS NOT NULL)`,
+    ),
+    gate: check(
+      "host_project_env_replica_authority_gate",
+      sql`${t.gateOpen} = 0 OR ${t.attemptId} IS NULL`,
+    ),
+  }),
+);
+
+export const hostProjectEnvReplicaProjects = sqliteTable(
+  "host_project_env_replica_projects",
+  {
+    projectId: text("project_id").primaryKey(),
+    recordVersion: integer("record_version").notNull(),
+  },
+  (t) => ({
+    version: check("host_project_env_replica_projects_version", sql`${t.recordVersion} >= 0`),
+  }),
+);
+
+const replicaRecordColumns = () => ({
+  projectId: text("project_id").notNull(),
+  key: text("key").notNull(),
+  revision: integer("revision").notNull(),
+  generation: integer("generation").notNull(),
+  tombstone: integer("tombstone", { mode: "boolean" }).notNull(),
+  valueRefJson: text("value_ref_json"),
+  bindingJson: text("binding_json"),
+  policyEpoch: integer("policy_epoch"),
+  listingGeneration: integer("listing_generation").notNull(),
+  materialization: text("materialization").notNull(),
+  materializationReason: text("materialization_reason"),
+  updatedAt: integer("updated_at", { mode: "number" })
+    .notNull()
+    .default(sql`(unixepoch() * 1000)`),
+});
+
+export const hostProjectEnvReplicaRecords = sqliteTable(
+  "host_project_env_replica_records",
+  replicaRecordColumns(),
+  (t) => ({
+    pk: primaryKey({ columns: [t.projectId, t.key] }),
+    head: check(
+      "host_project_env_replica_records_head",
+      sql`(${t.tombstone} = 0 AND ${t.revision} >= 1 AND ${t.generation} >= 1 AND ${t.valueRefJson} IS NOT NULL) OR (${t.tombstone} = 1 AND ${t.revision} = 1 AND ${t.generation} = 0 AND ${t.valueRefJson} IS NULL) OR (${t.tombstone} = 1 AND ${t.revision} >= 2 AND ${t.generation} >= 2 AND ${t.valueRefJson} IS NULL)`,
+    ),
+    binding: check(
+      "host_project_env_replica_records_binding",
+      sql`(${t.generation} = 0 AND ${t.bindingJson} IS NULL AND ${t.policyEpoch} IS NULL AND ${t.listingGeneration} >= 2 AND (${t.listingGeneration} % 2) = 0) OR (${t.generation} > 0 AND ${t.policyEpoch} >= 1)`,
+    ),
+    listing: check(
+      "host_project_env_replica_records_listing",
+      sql`${t.listingGeneration} >= 0`,
+    ),
+    boolean: check(
+      "host_project_env_replica_records_boolean",
+      sql`${t.tombstone} IN (0, 1)`,
+    ),
+    materialization: check(
+      "host_project_env_replica_records_materialization",
+      sql`(${t.materialization} = 'installed' AND ${t.tombstone} = 0 AND ${t.materializationReason} IS NULL) OR (${t.materialization} IN ('withheld', 'unavailable') AND ${t.materializationReason} IS NOT NULL)`,
+    ),
+  }),
+);
+
+export const hostProjectEnvReplicaValues = sqliteTable(
+  "host_project_env_replica_values",
+  {
+    projectId: text("project_id").notNull(),
+    key: text("key").notNull(),
+    revision: integer("revision").notNull(),
+    generation: integer("generation").notNull(),
+    valueRefJson: text("value_ref_json").notNull(),
+    valueEnc: text("value_enc").notNull(),
+    updatedAt: integer("updated_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.projectId, t.key] }),
+    head: check(
+      "host_project_env_replica_values_head",
+      sql`${t.revision} >= 1 AND ${t.generation} >= 1`,
+    ),
+  }),
+);
+
+export const hostProjectEnvReplicaStageProjects = sqliteTable(
+  "host_project_env_replica_stage_projects",
+  {
+    attemptId: text("attempt_id").notNull(),
+    projectId: text("project_id").notNull(),
+    recordVersion: integer("record_version"),
+    lastKey: text("last_key"),
+    complete: integer("complete", { mode: "boolean" }).notNull().default(false),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.attemptId, t.projectId] }),
+    version: check(
+      "host_project_env_replica_stage_projects_version",
+      sql`${t.recordVersion} IS NULL OR ${t.recordVersion} >= 0`,
+    ),
+    completeBoolean: check(
+      "host_project_env_replica_stage_projects_complete",
+      sql`${t.complete} IN (0, 1)`,
+    ),
+  }),
+);
+
+export const hostProjectEnvReplicaStageRecords = sqliteTable(
+  "host_project_env_replica_stage_records",
+  {
+    attemptId: text("attempt_id").notNull(),
+    ...replicaRecordColumns(),
+    present: integer("present", { mode: "boolean" }).notNull().default(false),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.attemptId, t.projectId, t.key] }),
+    head: check(
+      "host_project_env_replica_stage_records_head",
+      sql`(${t.tombstone} = 0 AND ${t.revision} >= 1 AND ${t.generation} >= 1 AND ${t.valueRefJson} IS NOT NULL) OR (${t.tombstone} = 1 AND ${t.revision} = 1 AND ${t.generation} = 0 AND ${t.valueRefJson} IS NULL) OR (${t.tombstone} = 1 AND ${t.revision} >= 2 AND ${t.generation} >= 2 AND ${t.valueRefJson} IS NULL)`,
+    ),
+    binding: check(
+      "host_project_env_replica_stage_records_binding",
+      sql`(${t.generation} = 0 AND ${t.bindingJson} IS NULL AND ${t.policyEpoch} IS NULL AND ${t.listingGeneration} >= 2 AND (${t.listingGeneration} % 2) = 0) OR (${t.generation} > 0 AND ${t.policyEpoch} >= 1)`,
+    ),
+    listing: check(
+      "host_project_env_replica_stage_records_listing",
+      sql`${t.listingGeneration} >= 0`,
+    ),
+    boolean: check(
+      "host_project_env_replica_stage_records_boolean",
+      sql`${t.tombstone} IN (0, 1) AND ${t.present} IN (0, 1)`,
+    ),
+    materialization: check(
+      "host_project_env_replica_stage_records_materialization",
+      sql`(${t.materialization} = 'installed' AND ${t.tombstone} = 0 AND ${t.materializationReason} IS NULL) OR (${t.materialization} IN ('withheld', 'unavailable') AND ${t.materializationReason} IS NOT NULL)`,
+    ),
+  }),
+);
+
+export const hostProjectEnvReplicaStageValues = sqliteTable(
+  "host_project_env_replica_stage_values",
+  {
+    attemptId: text("attempt_id").notNull(),
+    projectId: text("project_id").notNull(),
+    key: text("key").notNull(),
+    revision: integer("revision").notNull(),
+    generation: integer("generation").notNull(),
+    valueRefJson: text("value_ref_json").notNull(),
+    valueEnc: text("value_enc").notNull(),
+    updatedAt: integer("updated_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.attemptId, t.projectId, t.key] }),
+    head: check(
+      "host_project_env_replica_stage_values_head",
+      sql`${t.revision} >= 1 AND ${t.generation} >= 1`,
+    ),
+  }),
+);
+
+export const hostProjectEnvReplicaReceipts = sqliteTable(
+  "host_project_env_replica_receipts",
+  {
+    streamId: text("stream_id").notNull(),
+    sequence: integer("sequence").notNull(),
+    requestMac: text("request_mac").notNull(),
+    resultJson: text("result_json"),
+    recordVersion: integer("record_version"),
+    ok: integer("ok", { mode: "boolean" }).notNull(),
+    code: text("code"),
+    createdAt: integer("created_at", { mode: "number" })
+      .notNull()
+      .default(sql`(unixepoch() * 1000)`),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.streamId, t.sequence] }),
+    sequenceCheck: check(
+      "host_project_env_replica_receipts_sequence",
+      sql`${t.sequence} >= 1`,
+    ),
+    booleanCheck: check(
+      "host_project_env_replica_receipts_boolean",
+      sql`${t.ok} IN (0, 1)`,
+    ),
+    outcome: check(
+      "host_project_env_replica_receipts_outcome",
+      sql`(${t.ok} = 1 AND ${t.resultJson} IS NOT NULL AND ${t.recordVersion} IS NOT NULL AND ${t.code} IS NULL) OR (${t.ok} = 0 AND ${t.resultJson} IS NULL AND ${t.recordVersion} IS NULL AND ${t.code} IS NOT NULL)`,
+    ),
+  }),
+);
+
+// User-authed MCP connections (ADR-057). One row per cloud connection id; all
+// secret material (static header, OAuth client secret, PKCE verifier, tokens)
+// is sealed with the host master key in single-column `ct.nonce` base64 form
+// (same packing as host_project_env). The cloud only ever holds the non-secret
+// metadata; acks never echo secrets back.
+// ---------------------------------------------------------------------------
+// host_agent_sessions — ADR-061 durable agent sessions. One row per
+// (task, agent): where the live in-container runner's session dir is and how
+// far the host has consumed its outbox. The byte offset is what turns a host
+// restart into "resume tailing" instead of "kill and respawn"; attachability
+// itself is judged live off the runner's heartbeat file, not this row.
+// ---------------------------------------------------------------------------
+
+export const hostAgentSessions = sqliteTable(
+  "host_agent_sessions",
+  {
+    taskId: text("task_id").notNull(),
+    agentId: text("agent_id").notNull(),
+    // Host-side absolute path of the session dir (on the workspace mount,
+    // identical in-container — task-up bind-mounts the workspace at its own
+    // host path).
+    sessionDir: text("session_dir").notNull(),
+    containerName: text("container_name").notNull(),
+    kind: text("kind").notNull(), // "claude" | "codex" | ...
+    // Attach only when the process was launched under the same host-owned
+    // policy generation. Null preserves legacy attach behavior for ordinary
+    // agents; Secretary transitions use an explicit key.
+    attachCompatibilityKey: text("attach_compatibility_key"),
+    outboxOffset: integer("outbox_offset", { mode: "number" })
+      .notNull()
+      .default(0),
+    status: text("status").notNull().default("running"), // running|closed
+    // ADR-078: Codex thread id (from thread/start). Persisted so a respawned
+    // app-server after a host restart resumes the SAME thread (thread/resume)
+    // instead of losing the conversation. Null for non-codex kinds / pre-resume.
+    codexThreadId: text("codex_thread_id"),
+    createdAt: integer("created_at", { mode: "number" }).notNull(),
+    updatedAt: integer("updated_at", { mode: "number" }).notNull(),
+  },
+  (t) => ({
+    pk: primaryKey({ columns: [t.taskId, t.agentId] }),
+  }),
+);
+
+export type HostAgentSession = typeof hostAgentSessions.$inferSelect;
+
+export const mcpConnections = sqliteTable("host_mcp_connections", {
+  id: text("id").primaryKey(), // cloud uai_mcp_connections id
+  userId: text("user_id").notNull(),
+  url: text("url").notNull(),
+  // "oauth" | "token" | "none"
+  authKind: text("auth_kind").notNull(),
+  // OAuth machinery discovered at probe time.
+  tokenEndpoint: text("token_endpoint"),
+  redirectUri: text("redirect_uri"),
+  clientId: text("client_id"),
+  clientSecretEnc: text("client_secret_enc"),
+  // PKCE verifier held between probe and oauth.complete.
+  pkceVerifierEnc: text("pkce_verifier_enc"),
+  // Sealed JSON: {"headerName","headerValue"} (token kind) or
+  // {"accessToken","refreshToken","expiresAt"} (oauth kind). Null for "none".
+  secretEnc: text("secret_enc"),
+  status: text("status").notNull().default("pending"), // pending|connected
+  scopes: text("scopes"),
+  updatedAt: integer("updated_at", { mode: "number" }).notNull(),
+  // ADR-134 slice 2: the credential-store parameter this row mirrors to.
+  storeRef: text("store_ref"),
+});
+
+export type McpConnection = typeof mcpConnections.$inferSelect;
+
+// Extra (non-default) engine accounts (ADR-076). One row per additional
+// credential for an engine kind, beyond the single legacy slot (.env.local /
+// ~/.codex / ~/.local/share/opencode) which is synthesized as the "default"
+// account and NOT stored here. Secret material is sealed with the host master
+// key (same secret-blind pattern as host_github_tokens — ADR-015):
+//   - authKind "env":        secretEnc = sealed JSON of env vars, e.g.
+//                            {"CLAUDE_CODE_OAUTH_TOKEN":"sk-ant-oat…"}.
+//   - authKind "config-dir": configDir = the host dir holding this account's
+//                            auth files (an isolated ~/.codex-acct-<id> etc.);
+//                            secretEnc is null (the dir IS the secret at rest).
+// Rotation state (cooldown / last-used) is in-memory only, not persisted.
+export const engineAccounts = sqliteTable("host_engine_accounts", {
+  id: text("id").primaryKey(), // ulid
+  kind: text("kind").notNull(), // "claude" | "codex" | "opencode" | …
+  label: text("label").notNull(), // display, e.g. "work"
+  authKind: text("auth_kind").notNull(), // "env" | "config-dir"
+  secretEnc: text("secret_enc"), // sealed JSON (env kind); null for config-dir
+  configDir: text("config_dir"), // host dir (config-dir kind); null for env
+  // ADR-131 D3: "host" (owner-level, default) or "org:<orgId>" (a workspace's
+  // account on a shared host). Resolution is by exact scope.
+  scope: text("scope").notNull().default("host"),
+  // Manage-v1: priority within (scope, kind) — tasks pick the first healthy
+  // account in ascending position; ties break on created_at.
+  position: integer("position", { mode: "number" }).notNull().default(0),
+  // ADR-134: the credential-store parameter this row mirrors to (null on an
+  // owned host, or before the first successful mirror). The store is the
+  // truth when configured; this row is the local cache.
+  storeRef: text("store_ref"),
+  createdAt: integer("created_at", { mode: "number" }).notNull(),
+});
+
+export type EngineAccountRow = typeof engineAccounts.$inferSelect;
+export type NewEngineAccountRow = typeof engineAccounts.$inferInsert;