@relaycast/engine 1.1.7

package/dist/auth/index.d.ts

@@ -0,0 +1,21 @@
+import type { AuthProvider, AuthResult, AuthRequire } from '../ports/auth.js';
+import type { EngineDb } from '../ports/database.js';
+/** SHA-256 hash of a raw token to its stored form. */
+export declare function hashToken(token: string): string;
+/**
+ * The built-in, self-host authentication provider.
+ *
+ * Reproduces the original `middleware/auth.ts` behavior: bearer tokens prefixed
+ * `rk_live_` (workspace) or `at_live_` (agent) are SHA-256 hashed and looked up
+ * in the `workspaces` / `agents` tables. The cloud product replaces this with a
+ * provider backed by its own accounts/billing system.
+ */
+export declare class SqliteApiKeyAuthProvider implements AuthProvider {
+    hashToken(token: string): string;
+    authenticate(args: {
+        token: string;
+        require: AuthRequire;
+        db: EngineDb;
+    }): Promise<AuthResult>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,sDAAsD;AACtD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAMD;;;;;;;GAOG;AACH,qBAAa,wBAAyB,YAAW,YAAY;IAC3D,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAI1B,YAAY,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,WAAW,CAAC;QAAC,EAAE,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;CA0BrG"}

package/dist/auth/index.js

@@ -0,0 +1,50 @@
+import crypto from 'node:crypto';
+import { eq } from 'drizzle-orm';
+import { workspaces, agents } from '../db/schema.js';
+/** SHA-256 hash of a raw token to its stored form. */
+export function hashToken(token) {
+    return crypto.createHash('sha256').update(token).digest('hex');
+}
+function unauthorized(message, code = 'unauthorized') {
+    return { ok: false, status: 401, code, message };
+}
+/**
+ * The built-in, self-host authentication provider.
+ *
+ * Reproduces the original `middleware/auth.ts` behavior: bearer tokens prefixed
+ * `rk_live_` (workspace) or `at_live_` (agent) are SHA-256 hashed and looked up
+ * in the `workspaces` / `agents` tables. The cloud product replaces this with a
+ * provider backed by its own accounts/billing system.
+ */
+export class SqliteApiKeyAuthProvider {
+    hashToken(token) {
+        return hashToken(token);
+    }
+    async authenticate(args) {
+        const { token, require, db } = args;
+        const hash = hashToken(token);
+        if (token.startsWith('rk_live_')) {
+            if (require === 'agent') {
+                return unauthorized('Agent token required (at_live_...)');
+            }
+            const [workspace] = await db.select().from(workspaces).where(eq(workspaces.apiKeyHash, hash));
+            if (!workspace)
+                return unauthorized('Invalid API key');
+            return { ok: true, workspace };
+        }
+        if (token.startsWith('at_live_')) {
+            if (require === 'workspace') {
+                return unauthorized('Workspace key required (rk_live_...)');
+            }
+            const [agent] = await db.select().from(agents).where(eq(agents.tokenHash, hash));
+            if (!agent)
+                return unauthorized('Invalid agent token', 'agent_token_invalid');
+            const [workspace] = await db.select().from(workspaces).where(eq(workspaces.id, agent.workspaceId));
+            if (!workspace)
+                return unauthorized('Workspace not found');
+            return { ok: true, workspace, agent };
+        }
+        return unauthorized('Invalid token format');
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAIrD,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,IAAI,GAAG,cAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnC,SAAS,CAAC,KAAa;QACrB,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAA2D;QAC5E,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAE9B,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,OAAO,YAAY,CAAC,oCAAoC,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9F,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,iBAAiB,CAAC,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjC,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBAC5B,OAAO,YAAY,CAAC,sCAAsC,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;YAC9E,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACnG,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACxC,CAAC;QAED,OAAO,YAAY,CAAC,sBAAsB,CAAC,CAAC;IAC9C,CAAC;CACF"}

package/dist/bin/serve.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=serve.d.ts.map

package/dist/bin/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/bin/serve.ts"],"names":[],"mappings":""}

package/dist/bin/serve.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+import { startServer } from '../entrypoints/node.js';
+const HELP = `relaycast-engine — run a self-hosted Relaycast server (Node + SQLite)
+
+Usage:
+  relaycast-engine [--db <path>] [--port <n>] [--base-url <url>] [--env <name>]
+
+Options:
+  --db <path>        SQLite database file (default: $RELAYCAST_DB_PATH or ./relaycast.db)
+  --port <n>         HTTP port (default: $PORT or 8787)
+  --base-url <url>   Public origin for signed file URLs (default: http://localhost:<port>)
+  --env <name>       Environment label (default: production)
+  -h, --help         Show this help
+
+After start, create a workspace:
+  curl -XPOST http://localhost:<port>/v1/workspaces -H 'content-type: application/json' -d '{"name":"my-team"}'
+`;
+function parseArgs(argv, env) {
+    const out = {
+        db: env.RELAYCAST_DB_PATH ?? './relaycast.db',
+        port: env.PORT ? Number(env.PORT) : 8787,
+        baseUrl: undefined,
+        environment: env.RELAYCAST_ENV ?? 'production',
+        help: false,
+    };
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--help' || arg === '-h')
+            out.help = true;
+        else if (arg === '--db')
+            out.db = argv[++i] ?? out.db;
+        else if (arg === '--port')
+            out.port = Number(argv[++i] ?? out.port);
+        else if (arg === '--base-url')
+            out.baseUrl = argv[++i];
+        else if (arg === '--env')
+            out.environment = argv[++i] ?? out.environment;
+    }
+    return out;
+}
+async function main() {
+    const opts = parseArgs(process.argv.slice(2), process.env);
+    if (opts.help) {
+        process.stdout.write(HELP);
+        return;
+    }
+    if (!Number.isFinite(opts.port) || opts.port <= 0) {
+        process.stderr.write('Invalid --port\n');
+        process.exitCode = 1;
+        return;
+    }
+    const baseUrl = opts.baseUrl ?? `http://localhost:${opts.port}`;
+    const running = startServer({
+        dbPath: opts.db,
+        port: opts.port,
+        baseUrl,
+        config: { environment: opts.environment },
+    });
+    process.stdout.write(`Relaycast self-host listening on ${baseUrl} (db: ${opts.db})\n`);
+    process.stdout.write(`Create a workspace:\n  curl -XPOST ${baseUrl}/v1/workspaces -H 'content-type: application/json' -d '{"name":"my-team"}'\n`);
+    await new Promise((resolve) => {
+        const shutdown = () => {
+            process.stdout.write('\nShutting down…\n');
+            void running.stop().then(resolve);
+        };
+        process.once('SIGINT', shutdown);
+        process.once('SIGTERM', shutdown);
+    });
+}
+main().catch((err) => {
+    process.stderr.write(`relaycast-engine failed to start: ${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=serve.js.map

package/dist/bin/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../src/bin/serve.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,MAAM,IAAI,GAAG;;;;;;;;;;;;;;CAcZ,CAAC;AAUF,SAAS,SAAS,CAAC,IAAc,EAAE,GAAsB;IACvD,MAAM,GAAG,GAAc;QACrB,EAAE,EAAE,GAAG,CAAC,iBAAiB,IAAI,gBAAgB;QAC7C,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACxC,OAAO,EAAE,SAAS;QAClB,WAAW,EAAE,GAAG,CAAC,aAAa,IAAI,YAAY;QAC9C,IAAI,EAAE,KAAK;KACZ,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;aACjD,IAAI,GAAG,KAAK,MAAM;YAAE,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;aACjD,IAAI,GAAG,KAAK,QAAQ;YAAE,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;aAC/D,IAAI,GAAG,KAAK,YAAY;YAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;aAClD,IAAI,GAAG,KAAK,OAAO;YAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC;IAC3E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACzC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,OAAO,GAAG,WAAW,CAAC;QAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO;QACP,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;KAC1C,CAAC,CAAC;IAEH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,OAAO,SAAS,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,OAAO,8EAA8E,CAC5H,CAAC;IAEF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAC3C,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/db/index.d.ts

@@ -0,0 +1,16 @@
+import type { EngineDb } from '../ports/database.js';
+/**
+ * The engine never constructs a database driver itself — an adapter does, and
+ * injects the handle as the `db` port. This identity helper exists only so the
+ * many engine modules that write `type Db = ReturnType<typeof getDb>` keep a
+ * single canonical alias for {@link EngineDb} without importing a concrete
+ * driver (which would pull `better-sqlite3` / `drizzle-orm/d1` into every
+ * bundle). Construct real handles with `getSqliteDb` (Node adapter) or the
+ * Cloudflare D1 driver (cloud adapter).
+ */
+export declare function getDb(db: EngineDb): EngineDb;
+/** Canonical database type used across the engine. */
+export type Db = EngineDb;
+/** Health check — run a trivial query to verify connectivity. */
+export declare function healthCheck(db: EngineDb): Promise<boolean>;
+//# sourceMappingURL=index.d.ts.map

package/dist/db/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,QAAQ,GAAG,QAAQ,CAE5C;AAED,sDAAsD;AACtD,MAAM,MAAM,EAAE,GAAG,QAAQ,CAAC;AAE1B,iEAAiE;AACjE,wBAAsB,WAAW,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAOhE"}

package/dist/db/index.js

@@ -0,0 +1,24 @@
+import { sql } from 'drizzle-orm';
+/**
+ * The engine never constructs a database driver itself — an adapter does, and
+ * injects the handle as the `db` port. This identity helper exists only so the
+ * many engine modules that write `type Db = ReturnType<typeof getDb>` keep a
+ * single canonical alias for {@link EngineDb} without importing a concrete
+ * driver (which would pull `better-sqlite3` / `drizzle-orm/d1` into every
+ * bundle). Construct real handles with `getSqliteDb` (Node adapter) or the
+ * Cloudflare D1 driver (cloud adapter).
+ */
+export function getDb(db) {
+    return db;
+}
+/** Health check — run a trivial query to verify connectivity. */
+export async function healthCheck(db) {
+    try {
+        await db.run(sql `SELECT 1`);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/db/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAGlC;;;;;;;;GAQG;AACH,MAAM,UAAU,KAAK,CAAC,EAAY;IAChC,OAAO,EAAE,CAAC;AACZ,CAAC;AAKD,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAY;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAA,UAAU,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/db/migrate.d.ts

@@ -0,0 +1,14 @@
+/**
+ * D1 migrations are applied via `wrangler d1 migrations apply`.
+ *
+ * For local development:
+ *   npx wrangler d1 migrations apply relaycast --local
+ *
+ * For production/staging:
+ *   npx wrangler d1 migrations apply relaycast --remote
+ *
+ * Generate new migrations after schema changes:
+ *   npx drizzle-kit generate
+ */
+export declare function runMigrations(): Promise<void>;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/db/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnD"}

package/dist/db/migrate.js

@@ -0,0 +1,16 @@
+/**
+ * D1 migrations are applied via `wrangler d1 migrations apply`.
+ *
+ * For local development:
+ *   npx wrangler d1 migrations apply relaycast --local
+ *
+ * For production/staging:
+ *   npx wrangler d1 migrations apply relaycast --remote
+ *
+ * Generate new migrations after schema changes:
+ *   npx drizzle-kit generate
+ */
+export async function runMigrations() {
+    console.log('D1 migrations are applied via `wrangler d1 migrations apply`');
+}
+//# sourceMappingURL=migrate.js.map

package/dist/db/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/db/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;AAC9E,CAAC"}

package/dist/db/migrations/0000_broad_dagger.sql

@@ -0,0 +1,227 @@
+CREATE TABLE `agents` (
+	`id` text PRIMARY KEY NOT NULL,
+	`workspace_id` text NOT NULL,
+	`name` text NOT NULL,
+	`type` text DEFAULT 'agent' NOT NULL,
+	`token_hash` text NOT NULL,
+	`status` text DEFAULT 'online' NOT NULL,
+	`persona` text,
+	`metadata` text DEFAULT '{}',
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`last_seen` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`workspace_id`) REFERENCES `workspaces`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `agents_token_hash_unique` ON `agents` (`token_hash`);--> statement-breakpoint
+CREATE UNIQUE INDEX `agents_workspace_name_unique` ON `agents` (`workspace_id`,`name`);--> statement-breakpoint
+CREATE INDEX `idx_agents_workspace` ON `agents` (`workspace_id`);--> statement-breakpoint
+CREATE INDEX `idx_agents_token` ON `agents` (`token_hash`);--> statement-breakpoint
+CREATE TABLE `channel_members` (
+	`channel_id` text NOT NULL,
+	`agent_id` text NOT NULL,
+	`role` text DEFAULT 'member' NOT NULL,
+	`joined_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`last_read_id` text,
+	PRIMARY KEY(`channel_id`, `agent_id`),
+	FOREIGN KEY (`channel_id`) REFERENCES `channels`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`agent_id`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `idx_channel_members_agent` ON `channel_members` (`agent_id`);--> statement-breakpoint
+CREATE TABLE `channels` (
+	`id` text PRIMARY KEY NOT NULL,
+	`workspace_id` text NOT NULL,
+	`name` text NOT NULL,
+	`channel_type` integer DEFAULT 0 NOT NULL,
+	`topic` text,
+	`created_by` text,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`is_archived` integer DEFAULT false NOT NULL,
+	FOREIGN KEY (`workspace_id`) REFERENCES `workspaces`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`created_by`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `channels_workspace_name_unique` ON `channels` (`workspace_id`,`name`);--> statement-breakpoint
+CREATE INDEX `idx_channels_workspace` ON `channels` (`workspace_id`);--> statement-breakpoint
+CREATE TABLE `commands` (
+	`id` text PRIMARY KEY NOT NULL,
+	`workspace_id` text NOT NULL,
+	`command` text NOT NULL,
+	`description` text NOT NULL,
+	`handler_agent_id` text NOT NULL,
+	`parameters` text DEFAULT '[]',
+	`is_active` integer DEFAULT true NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`workspace_id`) REFERENCES `workspaces`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`handler_agent_id`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `commands_workspace_command_unique` ON `commands` (`workspace_id`,`command`);--> statement-breakpoint
+CREATE INDEX `idx_commands_workspace` ON `commands` (`workspace_id`);--> statement-breakpoint
+CREATE INDEX `idx_commands_handler` ON `commands` (`handler_agent_id`);--> statement-breakpoint
+CREATE TABLE `dm_conversations` (
+	`id` text PRIMARY KEY NOT NULL,
+	`workspace_id` text NOT NULL,
+	`channel_id` text NOT NULL,
+	`dm_type` text DEFAULT '1:1' NOT NULL,
+	`name` text,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`workspace_id`) REFERENCES `workspaces`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`channel_id`) REFERENCES `channels`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `idx_dm_conversations_workspace` ON `dm_conversations` (`workspace_id`);--> statement-breakpoint
+CREATE TABLE `dm_participants` (
+	`conversation_id` text NOT NULL,
+	`agent_id` text NOT NULL,
+	`joined_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`left_at` integer,
+	PRIMARY KEY(`conversation_id`, `agent_id`),
+	FOREIGN KEY (`conversation_id`) REFERENCES `dm_conversations`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`agent_id`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `idx_dm_participants_agent` ON `dm_participants` (`agent_id`);--> statement-breakpoint
+CREATE TABLE `event_subscriptions` (
+	`id` text PRIMARY KEY NOT NULL,
+	`workspace_id` text NOT NULL,
+	`events` text NOT NULL,
+	`filter` text,
+	`url` text NOT NULL,
+	`secret` text,
+	`is_active` integer DEFAULT true NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`workspace_id`) REFERENCES `workspaces`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `idx_event_subscriptions_workspace` ON `event_subscriptions` (`workspace_id`);--> statement-breakpoint
+CREATE TABLE `files` (
+	`id` text PRIMARY KEY NOT NULL,
+	`workspace_id` text NOT NULL,
+	`uploaded_by` text NOT NULL,
+	`filename` text NOT NULL,
+	`content_type` text NOT NULL,
+	`size_bytes` integer NOT NULL,
+	`storage_key` text NOT NULL,
+	`status` text DEFAULT 'pending' NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`workspace_id`) REFERENCES `workspaces`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`uploaded_by`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE INDEX `idx_files_workspace` ON `files` (`workspace_id`,`created_at`);--> statement-breakpoint
+CREATE INDEX `idx_files_uploader` ON `files` (`uploaded_by`);--> statement-breakpoint
+CREATE TABLE `message_attachments` (
+	`message_id` text NOT NULL,
+	`file_id` text NOT NULL,
+	`position` integer DEFAULT 0 NOT NULL,
+	PRIMARY KEY(`message_id`, `file_id`),
+	FOREIGN KEY (`message_id`) REFERENCES `messages`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`file_id`) REFERENCES `files`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `idx_message_attachments_file` ON `message_attachments` (`file_id`);--> statement-breakpoint
+CREATE TABLE `messages` (
+	`id` text PRIMARY KEY NOT NULL,
+	`workspace_id` text NOT NULL,
+	`channel_id` text NOT NULL,
+	`agent_id` text NOT NULL,
+	`thread_id` text,
+	`body` text NOT NULL,
+	`blocks` text,
+	`has_attachments` integer DEFAULT false NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`updated_at` integer,
+	FOREIGN KEY (`workspace_id`) REFERENCES `workspaces`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`channel_id`) REFERENCES `channels`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`agent_id`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE no action,
+	FOREIGN KEY (`thread_id`) REFERENCES `messages`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE INDEX `idx_messages_channel_time` ON `messages` (`channel_id`,`id`);--> statement-breakpoint
+CREATE INDEX `idx_messages_thread` ON `messages` (`thread_id`,`id`);--> statement-breakpoint
+CREATE INDEX `idx_messages_workspace` ON `messages` (`workspace_id`,`id`);--> statement-breakpoint
+CREATE TABLE `pending_events` (
+	`id` text PRIMARY KEY NOT NULL,
+	`workspace_id` text NOT NULL,
+	`event_type` text NOT NULL,
+	`payload` text NOT NULL,
+	`status` text DEFAULT 'pending' NOT NULL,
+	`attempts` integer DEFAULT 0 NOT NULL,
+	`max_attempts` integer DEFAULT 5 NOT NULL,
+	`last_error` text,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`process_after` integer DEFAULT (unixepoch()) NOT NULL,
+	`completed_at` integer,
+	FOREIGN KEY (`workspace_id`) REFERENCES `workspaces`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `idx_pending_events_status` ON `pending_events` (`status`,`process_after`);--> statement-breakpoint
+CREATE INDEX `idx_pending_events_workspace` ON `pending_events` (`workspace_id`);--> statement-breakpoint
+CREATE TABLE `reactions` (
+	`id` text PRIMARY KEY NOT NULL,
+	`message_id` text NOT NULL,
+	`agent_id` text NOT NULL,
+	`emoji` text NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`message_id`) REFERENCES `messages`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`agent_id`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `reactions_message_agent_emoji_unique` ON `reactions` (`message_id`,`agent_id`,`emoji`);--> statement-breakpoint
+CREATE INDEX `idx_reactions_message` ON `reactions` (`message_id`);--> statement-breakpoint
+CREATE TABLE `read_receipts` (
+	`message_id` text NOT NULL,
+	`agent_id` text NOT NULL,
+	`read_at` integer DEFAULT (unixepoch()) NOT NULL,
+	PRIMARY KEY(`message_id`, `agent_id`),
+	FOREIGN KEY (`message_id`) REFERENCES `messages`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`agent_id`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `idx_read_receipts_message` ON `read_receipts` (`message_id`);--> statement-breakpoint
+CREATE INDEX `idx_read_receipts_agent` ON `read_receipts` (`agent_id`,`read_at`);--> statement-breakpoint
+CREATE TABLE `usage_records` (
+	`id` text PRIMARY KEY NOT NULL,
+	`workspace_id` text NOT NULL,
+	`period_start` integer NOT NULL,
+	`period_end` integer NOT NULL,
+	`messages_sent` integer DEFAULT 0 NOT NULL,
+	`api_calls` integer DEFAULT 0 NOT NULL,
+	`files_uploaded` integer DEFAULT 0 NOT NULL,
+	`file_bytes` integer DEFAULT 0 NOT NULL,
+	`ws_minutes` integer DEFAULT 0 NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`workspace_id`) REFERENCES `workspaces`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `idx_usage_workspace_period` ON `usage_records` (`workspace_id`,`period_start`);--> statement-breakpoint
+CREATE TABLE `webhooks` (
+	`id` text PRIMARY KEY NOT NULL,
+	`workspace_id` text NOT NULL,
+	`name` text NOT NULL,
+	`channel_id` text NOT NULL,
+	`created_by` text,
+	`is_active` integer DEFAULT true NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`workspace_id`) REFERENCES `workspaces`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`channel_id`) REFERENCES `channels`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`created_by`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE no action
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `webhooks_workspace_name_unique` ON `webhooks` (`workspace_id`,`name`);--> statement-breakpoint
+CREATE INDEX `idx_webhooks_workspace` ON `webhooks` (`workspace_id`);--> statement-breakpoint
+CREATE TABLE `workspaces` (
+	`id` text PRIMARY KEY NOT NULL,
+	`name` text NOT NULL,
+	`api_key_hash` text NOT NULL,
+	`system_prompt` text,
+	`plan` text DEFAULT 'free' NOT NULL,
+	`stripe_customer_id` text,
+	`stripe_subscription_id` text,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`metadata` text DEFAULT '{}'
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `workspaces_name_unique` ON `workspaces` (`name`);--> statement-breakpoint
+CREATE UNIQUE INDEX `workspaces_api_key_hash_unique` ON `workspaces` (`api_key_hash`);

package/dist/db/migrations/0001_fts5_search.sql

@@ -0,0 +1,23 @@
+-- FTS5 virtual table for message full-text search.
+-- Uses external content mode so the FTS index mirrors the messages table.
+
+CREATE VIRTUAL TABLE IF NOT EXISTS messages_fts USING fts5(
+  id UNINDEXED,
+  body,
+  content=messages,
+  content_rowid=rowid
+);
+
+-- Keep FTS index in sync via triggers.
+CREATE TRIGGER IF NOT EXISTS messages_fts_insert AFTER INSERT ON messages BEGIN
+  INSERT INTO messages_fts(rowid, id, body) VALUES (NEW.rowid, NEW.id, NEW.body);
+END;
+
+CREATE TRIGGER IF NOT EXISTS messages_fts_update AFTER UPDATE OF body ON messages BEGIN
+  INSERT INTO messages_fts(messages_fts, rowid, id, body) VALUES('delete', OLD.rowid, OLD.id, OLD.body);
+  INSERT INTO messages_fts(rowid, id, body) VALUES (NEW.rowid, NEW.id, NEW.body);
+END;
+
+CREATE TRIGGER IF NOT EXISTS messages_fts_delete AFTER DELETE ON messages BEGIN
+  INSERT INTO messages_fts(messages_fts, rowid, id, body) VALUES('delete', OLD.rowid, OLD.id, OLD.body);
+END;

package/dist/db/migrations/0002_add_metadata_columns.sql

@@ -0,0 +1,16 @@
+-- Migration: 0002_add_metadata_columns
+-- Purpose: Add metadata JSON columns to channels and messages tables
+-- for storing integration-specific data (e.g., Slack channel IDs, message timestamps)
+--
+-- SQLite ALTER TABLE ADD COLUMN constraints:
+-- - Cannot add NOT NULL column without DEFAULT to table with existing rows
+-- - DEFAULT must be a constant expression
+-- - Column will have DEFAULT value for new rows; existing rows get the default retroactively
+
+-- Add metadata column to channels table
+-- Stores JSON object for integration-specific data (e.g., slack_channel_id)
+ALTER TABLE channels ADD COLUMN metadata TEXT DEFAULT '{}';
+
+-- Add metadata column to messages table
+-- Stores JSON object for integration-specific data (e.g., slack_ts, slack_thread_ts)
+ALTER TABLE messages ADD COLUMN metadata TEXT DEFAULT '{}';

package/dist/db/migrations/0003_add_channel_mute.sql

@@ -0,0 +1,5 @@
+-- Migration: 0003_add_channel_mute
+-- Purpose: Add is_muted boolean column to channel_members table
+-- for per-agent channel mute functionality.
+
+ALTER TABLE channel_members ADD COLUMN is_muted INTEGER NOT NULL DEFAULT 0;

package/dist/db/migrations/0004_a2a_agents.sql

@@ -0,0 +1,21 @@
+CREATE TABLE `a2a_agents` (
+	`id` text PRIMARY KEY NOT NULL,
+	`workspace_id` text NOT NULL,
+	`relay_agent_id` text NOT NULL,
+	`agent_card` text DEFAULT '{}' NOT NULL,
+	`external_url` text NOT NULL,
+	`auth_scheme` text,
+	`auth_credential` text,
+	`status` text DEFAULT 'active' NOT NULL,
+	`messages_sent` integer DEFAULT 0 NOT NULL,
+	`messages_recv` integer DEFAULT 0 NOT NULL,
+	`last_health` integer,
+	`health_failures` integer DEFAULT 0 NOT NULL,
+	`created_at` integer DEFAULT (unixepoch()) NOT NULL,
+	`updated_at` integer DEFAULT (unixepoch()) NOT NULL,
+	FOREIGN KEY (`workspace_id`) REFERENCES `workspaces`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`relay_agent_id`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `idx_a2a_agents_workspace` ON `a2a_agents` (`workspace_id`);--> statement-breakpoint
+CREATE UNIQUE INDEX `idx_a2a_agents_relay_agent` ON `a2a_agents` (`relay_agent_id`);

package/dist/db/migrations/0005_certifications.sql

@@ -0,0 +1,24 @@
+CREATE TABLE `certifications` (
+  `id` text PRIMARY KEY NOT NULL,
+  `workspace_id` text NOT NULL,
+  `agent_url` text NOT NULL,
+  `level` integer NOT NULL,
+  `source` text NOT NULL DEFAULT 'manual',
+  `status` text NOT NULL DEFAULT 'pending',
+  `passed` integer NOT NULL DEFAULT false,
+  `passed_tests` integer NOT NULL DEFAULT 0,
+  `total_tests` integer NOT NULL DEFAULT 0,
+  `monitor_enabled` integer NOT NULL DEFAULT false,
+  `monitor_interval_minutes` integer NOT NULL DEFAULT 60,
+  `last_run_at` integer,
+  `results` text DEFAULT '[]',
+  `created_at` integer NOT NULL DEFAULT (unixepoch()),
+  `updated_at` integer NOT NULL DEFAULT (unixepoch()),
+  FOREIGN KEY (`workspace_id`) REFERENCES `workspaces`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX `idx_certifications_workspace` ON `certifications` (`workspace_id`,`created_at`);
+--> statement-breakpoint
+CREATE INDEX `idx_certifications_agent_url` ON `certifications` (`agent_url`);
+--> statement-breakpoint
+CREATE INDEX `idx_certifications_monitor_enabled` ON `certifications` (`monitor_enabled`,`updated_at`);

package/dist/db/migrations/0006_message_logs.sql

@@ -0,0 +1,30 @@
+CREATE TABLE `message_logs` (
+  `id` text PRIMARY KEY NOT NULL,
+  `workspace_id` text NOT NULL,
+  `message_id` text NOT NULL,
+  `channel_id` text NOT NULL,
+  `agent_id` text NOT NULL,
+  `conversation_id` text,
+  `delivery_kind` text NOT NULL,
+  `body` text NOT NULL,
+  `content_type` text,
+  `metadata` text DEFAULT '{}',
+  `attachment_count` integer DEFAULT 0 NOT NULL,
+  `mention_count` integer DEFAULT 0 NOT NULL,
+  `latency_ms` integer DEFAULT 0 NOT NULL,
+  `created_at` integer DEFAULT (unixepoch()) NOT NULL,
+  FOREIGN KEY (`workspace_id`) REFERENCES `workspaces`(`id`) ON UPDATE no action ON DELETE cascade,
+  FOREIGN KEY (`message_id`) REFERENCES `messages`(`id`) ON UPDATE no action ON DELETE cascade,
+  FOREIGN KEY (`channel_id`) REFERENCES `channels`(`id`) ON UPDATE no action ON DELETE cascade,
+  FOREIGN KEY (`agent_id`) REFERENCES `agents`(`id`) ON UPDATE no action ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX `message_logs_message_unique` ON `message_logs` (`message_id`);
+--> statement-breakpoint
+CREATE INDEX `idx_message_logs_workspace_time` ON `message_logs` (`workspace_id`, `id`);
+--> statement-breakpoint
+CREATE INDEX `idx_message_logs_agent_time` ON `message_logs` (`agent_id`, `id`);
+--> statement-breakpoint
+CREATE INDEX `idx_message_logs_channel_time` ON `message_logs` (`channel_id`, `id`);
+--> statement-breakpoint
+CREATE INDEX `idx_message_logs_conversation_time` ON `message_logs` (`conversation_id`, `id`);