@relaycast/engine 8.1.2 → 8.2.0

package/dist/auth/index.js

@@ -45,9 +45,9 @@ export class SqliteApiKeyAuthProvider {
             let [agent] = await db.select().from(agents).where(eq(agents.tokenHash, hash));
             if (!agent) {
                 // Fall back to the previous slot inside its grace window. This is the
-                // credential a caller that lost a `registerOrRotate` race was handed
-                // (relay#1542); it must remain live long enough for that caller to
-                // upgrade to a persistent session.
+                // credential a caller that lost a concurrent self-rollover race was
+                // handed (relay#1542); it must remain live long enough for that caller
+                // to upgrade to a persistent session.
                 [agent] = await db
                     .select()
                     .from(agents)

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAG1E,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1E,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,IAAI,GAAG,cAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnC,SAAS,CAAC,KAAa;QACrB,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAA2D;QAC5E,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC,sBAAsB,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,wBAAwB,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QAEpC,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9F,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,iBAAiB,CAAC,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjC,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjC,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,sEAAsE;gBACtE,qEAAqE;gBACrE,mEAAmE;gBACnE,mCAAmC;gBACnC,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;qBACf,MAAM,EAAE;qBACR,IAAI,CAAC,MAAM,CAAC;qBACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACnG,CAAC;YACD,IAAI,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;YAC9E,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACnG,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9E,IAAI,CAAC,IAAI;gBAAE,OAAO,YAAY,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;YAC3E,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACnE,IAAI,CAAC,aAAa;gBAAE,OAAO,YAAY,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;YAC5F,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3G,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,YAAY,CAAC,sBAAsB,CAAC,CAAC;IAC9C,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAG1E,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1E,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,IAAI,GAAG,cAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnC,SAAS,CAAC,KAAa;QACrB,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAA2D;QAC5E,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC,sBAAsB,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,wBAAwB,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QAEpC,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9F,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,iBAAiB,CAAC,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACjC,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjC,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,sEAAsE;gBACtE,oEAAoE;gBACpE,uEAAuE;gBACvE,sCAAsC;gBACtC,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;qBACf,MAAM,EAAE;qBACR,IAAI,CAAC,MAAM,CAAC;qBACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACnG,CAAC;YACD,IAAI,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;YAC9E,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACnG,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9E,IAAI,CAAC,IAAI;gBAAE,OAAO,YAAY,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;YAC3E,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACnE,IAAI,CAAC,aAAa;gBAAE,OAAO,YAAY,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;YAC5F,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3G,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAChD,CAAC;QAED,OAAO,YAAY,CAAC,sBAAsB,CAAC,CAAC;IAC9C,CAAC;CACF"}

package/dist/db/migrations/0039_workspace_usage_attribution.sql

@@ -0,0 +1,24 @@
+-- Durable creation provenance and explicit usage classification.
+--
+-- Existing rows remain honestly unclassified: provenance is NULL and the
+-- classification defaults to `unknown`. Historical heuristics belong in the
+-- reporting layer and must never be written into these recorded-fact columns.
+ALTER TABLE workspaces ADD COLUMN provenance TEXT;
+ALTER TABLE workspaces ADD COLUMN usage_classification TEXT NOT NULL DEFAULT 'unknown'
+  CHECK (usage_classification IN ('internal', 'external', 'unknown'));
+ALTER TABLE workspaces ADD COLUMN classification_source TEXT NOT NULL DEFAULT 'unclassified'
+  CONSTRAINT workspaces_usage_classification_source_check CHECK (
+    classification_source IN ('creator', 'operator', 'unclassified')
+    AND (
+      (usage_classification = 'unknown' AND classification_source = 'unclassified')
+      OR (
+        usage_classification IN ('internal', 'external')
+        AND classification_source IN ('creator', 'operator')
+      )
+    )
+  );
+ALTER TABLE workspaces ADD COLUMN classification_reason TEXT;
+ALTER TABLE workspaces ADD COLUMN classified_at INTEGER;
+
+CREATE INDEX IF NOT EXISTS idx_workspaces_usage_classification
+  ON workspaces(usage_classification, created_at);

package/dist/db/migrations/0041_agent_identity_recovery.sql

@@ -0,0 +1,40 @@
+-- relaycast#311: recovery authorization must be server-owned and explicit.
+-- No existing token or agent row is changed by this migration.
+
+CREATE TABLE agent_recovery_credentials (
+  id TEXT PRIMARY KEY NOT NULL,
+  workspace_id TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  proof_kind TEXT NOT NULL,
+  verifier_hash TEXT NOT NULL,
+  work_unit_id TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE,
+  FOREIGN KEY (workspace_id, agent_id) REFERENCES agents(workspace_id, id) ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX agent_recovery_credentials_agent_unique
+  ON agent_recovery_credentials(workspace_id, agent_id);
+CREATE UNIQUE INDEX agent_recovery_credentials_verifier_unique
+  ON agent_recovery_credentials(verifier_hash);
+CREATE TABLE agent_identity_audit (
+  id TEXT PRIMARY KEY NOT NULL,
+  workspace_id TEXT NOT NULL,
+  agent_id TEXT NOT NULL,
+  agent_name TEXT NOT NULL,
+  action TEXT NOT NULL,
+  authority TEXT NOT NULL,
+  actor TEXT NOT NULL,
+  reason TEXT NOT NULL,
+  session_ref TEXT,
+  node_id TEXT,
+  origin_actor TEXT NOT NULL,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_agent_identity_audit_workspace
+  ON agent_identity_audit(workspace_id, created_at);
+CREATE INDEX idx_agent_identity_audit_agent
+  ON agent_identity_audit(workspace_id, agent_id, created_at);

package/dist/db/migrations/0041_d1_hot_path_indexes.sql

@@ -0,0 +1,12 @@
+-- Node reconnect/heartbeat drains only pending invocations, but the previous
+-- workspace index included every completed invocation. Keep the hot index
+-- partial and ordered by creation time so the drain reads the small pending
+-- working set in dispatch order.
+CREATE INDEX IF NOT EXISTS idx_action_invocations_pending_workspace
+  ON action_invocations(workspace_id, created_at)
+  WHERE status = 'pending';
+
+-- The activity feed left-joins a DM conversation by channel for every message.
+-- Without this lookup index SQLite scans the entire DM table once per result.
+CREATE INDEX IF NOT EXISTS idx_dm_conversations_channel
+  ON dm_conversations(channel_id);

package/dist/db/schema.d.ts

@@ -1,3 +1,4 @@
+import type { WorkspaceProvenance } from '@relaycast/types';
 /**
  * Per-workspace retention TTLs (days), stored in `workspaces.retention`.
  * `undefined` inherits the deployment default; explicit `null` disables
@@ -9,6 +10,7 @@ export interface WorkspaceRetentionSettings {
     message_log_ttl_days?: number | null;
     workspace_event_ttl_days?: number | null;
 }
+export type WorkspaceProvenanceRecord = WorkspaceProvenance;
 export interface ObserverTokenFilters {
     channel_ids?: string[];
     channel_names?: string[];
@@ -189,6 +191,119 @@ export declare const workspaces: import("drizzle-orm/sqlite-core").SQLiteTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        provenance: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "provenance";
+            tableName: "workspaces";
+            dataType: "json";
+            columnType: "SQLiteTextJson";
+            data: {
+                source: "cli" | "api" | "sdk" | "mcp" | "ci" | "relayflow" | "dashboard" | "other";
+                source_basis: "default" | "declared" | "origin_client";
+                origin_id?: string | undefined;
+                classification?: "unknown" | "external" | "internal" | undefined;
+                origin_actor?: string | undefined;
+                actor_user_id?: string | undefined;
+                actor_machine_id?: string | undefined;
+                actor_org_id?: string | undefined;
+                actor_org_slug?: string | undefined;
+            };
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: {
+                source: "cli" | "api" | "sdk" | "mcp" | "ci" | "relayflow" | "dashboard" | "other";
+                source_basis: "default" | "declared" | "origin_client";
+                origin_id?: string | undefined;
+                classification?: "unknown" | "external" | "internal" | undefined;
+                origin_actor?: string | undefined;
+                actor_user_id?: string | undefined;
+                actor_machine_id?: string | undefined;
+                actor_org_id?: string | undefined;
+                actor_org_slug?: string | undefined;
+            };
+        }>;
+        usageClassification: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "usage_classification";
+            tableName: "workspaces";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        classificationSource: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "classification_source";
+            tableName: "workspaces";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        classificationReason: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "classification_reason";
+            tableName: "workspaces";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        classifiedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "classified_at";
+            tableName: "workspaces";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
     };
     dialect: "sqlite";
 }>;
@@ -605,6 +720,406 @@ export declare const agents: import("drizzle-orm/sqlite-core").SQLiteTableWithCo
     };
     dialect: "sqlite";
 }>;
+/**
+ * Server-owned verifier state for explicit identity recovery.
+ *
+ * This deliberately does not live in `agents.metadata`: generic metadata is a
+ * caller-facing document and therefore cannot be an authorization boundary.
+ * Raw recovery proofs are never stored; callers present the proof and the
+ * engine compares its SHA-256 verifier.
+ */
+export declare const agentRecoveryCredentials: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "agent_recovery_credentials";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "id";
+            tableName: "agent_recovery_credentials";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        workspaceId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "workspace_id";
+            tableName: "agent_recovery_credentials";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        agentId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "agent_id";
+            tableName: "agent_recovery_credentials";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        proofKind: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "proof_kind";
+            tableName: "agent_recovery_credentials";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        verifierHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "verifier_hash";
+            tableName: "agent_recovery_credentials";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        workUnitId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "work_unit_id";
+            tableName: "agent_recovery_credentials";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "created_at";
+            tableName: "agent_recovery_credentials";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "updated_at";
+            tableName: "agent_recovery_credentials";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;
+/**
+ * Append-only security record. There is intentionally no agent foreign key:
+ * an identity audit must survive release/deletion and retention pruning.
+ */
+export declare const agentIdentityAudit: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "agent_identity_audit";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "id";
+            tableName: "agent_identity_audit";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        workspaceId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "workspace_id";
+            tableName: "agent_identity_audit";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        agentId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "agent_id";
+            tableName: "agent_identity_audit";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        agentName: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "agent_name";
+            tableName: "agent_identity_audit";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        action: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "action";
+            tableName: "agent_identity_audit";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        authority: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "authority";
+            tableName: "agent_identity_audit";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        actor: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "actor";
+            tableName: "agent_identity_audit";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        reason: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "reason";
+            tableName: "agent_identity_audit";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        sessionRef: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "session_ref";
+            tableName: "agent_identity_audit";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        nodeId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "node_id";
+            tableName: "agent_identity_audit";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        originActor: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "origin_actor";
+            tableName: "agent_identity_audit";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "created_at";
+            tableName: "agent_identity_audit";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;
 export declare const nodes: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
     name: "nodes";
     schema: undefined;