@sixb/pg 0.1.11 → 0.1.13

package/src/auth-storage/rows.ts

@@ -76,6 +76,11 @@ export interface PgAuthSessionRow {
   readonly last_seen_at: PgDate | null
   readonly user_agent: string | null
   readonly ip_address: string | null
+  readonly client_name: string | null
+  readonly access_expires_at: PgDate | null
+  readonly refresh_token_hash: string | null
+  readonly previous_refresh_token_hash: string | null
+  readonly refreshed_at: PgDate | null
 }
 
 export interface PgAuthAccessTokenRow {
@@ -83,7 +88,7 @@ export interface PgAuthAccessTokenRow {
   readonly id: string
   readonly name: string
   readonly kind: AccessTokenRecord["kind"]
-  readonly subject_type: AccessTokenRecord["subjectType"]
+  readonly subject_type: AccessTokenRecord["subject"]["type"]
   readonly subject_id: string
   readonly token_hash: string
   readonly group_ids: readonly string[] | string | null
@@ -157,8 +162,6 @@ export interface PgAuthDeviceAuthorizationRow {
   readonly device_code_hash: string
   readonly user_code: string
   readonly client_name: string
-  readonly token_name: string
-  readonly token_expires_at: PgDate
   readonly status: DeviceAuthorizationRecord["status"]
   readonly approved_user_id: string | null
   readonly approved_session_id: string | null
@@ -235,6 +238,16 @@ export function rowToSessionRecord(row: PgAuthSessionRow): SessionRecord {
     lastSeenAt: row.last_seen_at ? toDate(row.last_seen_at) : undefined,
     userAgent: row.user_agent ?? undefined,
     ipAddress: row.ip_address ?? undefined,
+    bearer:
+      row.refresh_token_hash !== null && row.client_name !== null && row.access_expires_at !== null
+        ? {
+            clientName: row.client_name,
+            accessExpiresAt: toDate(row.access_expires_at),
+            refreshTokenHash: row.refresh_token_hash,
+            previousRefreshTokenHash: row.previous_refresh_token_hash ?? undefined,
+            refreshedAt: row.refreshed_at ? toDate(row.refreshed_at) : undefined,
+          }
+        : undefined,
   }
 }
 
@@ -244,8 +257,7 @@ export function rowToAccessTokenRecord(row: PgAuthAccessTokenRow): AccessTokenRe
     projectId: row.project_id,
     name: row.name,
     kind: row.kind,
-    subjectType: row.subject_type,
-    subjectId: row.subject_id,
+    subject: { type: row.subject_type, id: row.subject_id },
     tokenHash: row.token_hash,
     groupIds: parseOptionalStringArray(row.group_ids),
     createdByPrincipal: principalFromColumns(row),
@@ -332,8 +344,6 @@ export function rowToDeviceAuthorizationRecord(
     deviceCodeHash: row.device_code_hash,
     userCode: row.user_code,
     clientName: row.client_name,
-    tokenName: row.token_name,
-    tokenExpiresAt: toDate(row.token_expires_at),
     status: row.status,
     approvedUserId: row.approved_user_id ?? undefined,
     approvedSessionId: row.approved_session_id ?? undefined,

package/src/auth-storage/sessions.ts

@@ -1,5 +1,10 @@
 import type { AuthSessionAudience } from "@sixb/core"
-import type { AuthSessionStore, CreateAuthSessionInput, SessionRecord } from "@sixb/core/storage"
+import type {
+  AuthSessionStore,
+  CreateAuthSessionInput,
+  RotateSessionRefreshTokenResult,
+  SessionRecord,
+} from "@sixb/core/storage"
 import { AuthStorageError } from "@sixb/core/storage"
 import {
   authLockKey,
@@ -85,11 +90,10 @@ export class PgAuthSessionStore implements AuthSessionStore {
 
     if (
       !row ||
+      row.refresh_token_hash !== null ||
       row.audience !== params.audience ||
       row.token_hash !== params.tokenHash ||
-      row.revoked_at ||
-      new Date(row.expires_at) <= params.now ||
-      (row.absolute_expires_at !== null && new Date(row.absolute_expires_at) <= params.now)
+      !isLiveSessionRow(row, params.now)
     ) {
       return null
     }
@@ -97,6 +101,71 @@ export class PgAuthSessionStore implements AuthSessionStore {
     return rowToSessionRecord(row)
   }
 
+  async findValidByAccessTokenHash(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly tokenHash: string
+    readonly now: Date
+  }): Promise<SessionRecord | null> {
+    const row = await getSessionRowById(this.sql, params)
+    if (
+      !row ||
+      row.access_expires_at === null ||
+      row.token_hash !== params.tokenHash ||
+      new Date(row.access_expires_at) <= params.now ||
+      !isLiveSessionRow(row, params.now)
+    ) {
+      return null
+    }
+
+    return rowToSessionRecord(row)
+  }
+
+  async rotateRefreshToken(
+    params: Parameters<AuthSessionStore["rotateRefreshToken"]>[0]
+  ): Promise<RotateSessionRefreshTokenResult> {
+    return runPgTransaction(this.sql, async (tx): Promise<RotateSessionRefreshTokenResult> => {
+      const row = await getSessionRowById(tx, params, { forUpdate: true })
+      if (!row?.refresh_token_hash || !isLiveSessionRow(row, params.now)) {
+        return { status: "invalid" }
+      }
+
+      const replacedRecently =
+        row.previous_refresh_token_hash === params.refreshTokenHash &&
+        row.refreshed_at !== null &&
+        params.now.getTime() - new Date(row.refreshed_at).getTime() <= params.reuseGraceMs
+      if (row.refresh_token_hash !== params.refreshTokenHash && !replacedRecently) {
+        if (row.previous_refresh_token_hash !== params.refreshTokenHash) {
+          return { status: "invalid" }
+        }
+        await tx`
+          UPDATE auth_sessions SET revoked_at = ${params.now}
+          WHERE project_id = ${params.projectId} AND id = ${params.id}
+        `
+        return { status: "reused" }
+      }
+
+      const [rotated] = await tx<PgAuthSessionRow[]>`
+        UPDATE auth_sessions
+        SET token_hash = ${params.next.tokenHash},
+            access_expires_at = ${params.next.accessExpiresAt},
+            previous_refresh_token_hash = refresh_token_hash,
+            refresh_token_hash = ${params.next.refreshTokenHash},
+            refreshed_at = ${params.now},
+            last_seen_at = ${params.now},
+            expires_at = GREATEST(
+              expires_at,
+              LEAST(${params.next.expiresAt}, COALESCE(absolute_expires_at, ${params.next.expiresAt}))
+            )
+        WHERE project_id = ${params.projectId} AND id = ${params.id}
+        RETURNING *
+      `
+      return rotated
+        ? { status: "rotated", session: rowToSessionRecord(rotated) }
+        : { status: "invalid" }
+    })
+  }
+
   async renewIfValid(params: {
     readonly projectId: string
     readonly id: string
@@ -119,6 +188,7 @@ export class PgAuthSessionStore implements AuthSessionStore {
         AND id = ${params.id}
         AND audience = ${params.audience}
         AND token_hash = ${params.tokenHash}
+        AND refresh_token_hash IS NULL
         AND revoked_at IS NULL
         AND expires_at > ${params.now}
         AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.now})
@@ -191,3 +261,11 @@ export class PgAuthSessionStore implements AuthSessionStore {
     })
   }
 }
+
+function isLiveSessionRow(row: PgAuthSessionRow, now: Date): boolean {
+  return (
+    row.revoked_at === null &&
+    new Date(row.expires_at) > now &&
+    (row.absolute_expires_at === null || new Date(row.absolute_expires_at) > now)
+  )
+}

package/src/auth-storage/shared.ts

@@ -487,7 +487,10 @@ export async function createSession(
         expires_at,
         absolute_expires_at,
         user_agent,
-        ip_address
+        ip_address,
+        client_name,
+        access_expires_at,
+        refresh_token_hash
       ) VALUES (
         ${projectId},
         ${id},
@@ -499,7 +502,10 @@ export async function createSession(
         ${input.expiresAt},
         ${input.absoluteExpiresAt ?? null},
         ${input.userAgent ?? null},
-        ${input.ipAddress ?? null}
+        ${input.ipAddress ?? null},
+        ${input.bearer ? assertNonEmpty(input.bearer.clientName, "Session client name") : null},
+        ${input.bearer?.accessExpiresAt ?? null},
+        ${input.bearer ? assertNonEmpty(input.bearer.refreshTokenHash, "Refresh token hash") : null}
       )
       RETURNING *
     `

package/src/index.ts

@@ -42,6 +42,7 @@ import { PgAiLimitStorage } from "./pg-ai-limit-storage"
 import { PgAiUsageStorage } from "./pg-ai-usage-storage"
 import { createPgClient, type SQL, type SQLClient } from "./pg-client"
 import { PgExecutionStorage } from "./pg-execution-storage"
+import { PgFileUploadSessionStorage } from "./pg-file-upload-session-storage"
 import { PgPipelineRunStorage } from "./pg-pipeline-run-storage"
 import { PgProjectionRunStorage } from "./pg-projection-run-storage"
 import { PgRulesStorage } from "./pg-rules-storage"
@@ -158,6 +159,7 @@ export class PostgresStorage implements MigrationCapableStorage {
   readonly connectorConnections: PgConnectorConnectionStorage
   readonly shareGrants: PgShareGrantStorage
   readonly shareSessions: PgShareSessionStorage
+  readonly fileUploadSessions: PgFileUploadSessionStorage
   readonly migrators: readonly StorageMigrator[]
 
   private readonly sql: SQL
@@ -235,6 +237,7 @@ export class PostgresStorage implements MigrationCapableStorage {
     this.connectorConnections = createOperationScopedFacade(stores.connectorConnections, scope)
     this.shareGrants = createOperationScopedFacade(stores.shareGrants, scope)
     this.shareSessions = createOperationScopedFacade(stores.shareSessions, scope)
+    this.fileUploadSessions = createOperationScopedFacade(stores.fileUploadSessions, scope)
     registerPostgresStorageTestingAdapter(this, (durationMs) =>
       stores.connectorConnections.advanceTimeForTesting(durationMs)
     )
@@ -371,6 +374,7 @@ function createPostgresStores(
     connectorConnections: new PgConnectorConnectionStorage(sql),
     shareGrants,
     shareSessions,
+    fileUploadSessions: new PgFileUploadSessionStorage(sql),
   }
 }
 
@@ -395,6 +399,7 @@ interface PostgresStoreSet {
   readonly connectorConnections: PgConnectorConnectionStorage
   readonly shareGrants: PgShareGrantStorage
   readonly shareSessions: PgShareSessionStorage
+  readonly fileUploadSessions: PgFileUploadSessionStorage
 }
 
 function resolveTimeoutMillis(value: number | undefined, label: string): number | undefined {

package/src/migrations/041-agent-thread-workspaces.sql

@@ -0,0 +1,2 @@
+ALTER TABLE agent_threads ADD COLUMN sandbox_params JSONB
+  CHECK (sandbox_params IS NULL OR jsonb_typeof(sandbox_params) = 'object');

package/src/migrations/042-vector-profiles.sql

@@ -0,0 +1,28 @@
+-- Transactional derived state. Search extensions are not required for persistence.
+CREATE TABLE object_vectors (
+  project_id TEXT NOT NULL,
+  object_type_id TEXT NOT NULL,
+  primary_id TEXT NOT NULL,
+  profile TEXT NOT NULL CHECK (length(btrim(profile)) > 0),
+  configuration TEXT NOT NULL,
+  source TEXT[] NOT NULL,
+  source_fingerprint TEXT NOT NULL,
+  embedding REAL[] NOT NULL,
+  last_commit_id TEXT NOT NULL,
+  PRIMARY KEY (project_id, object_type_id, primary_id, profile),
+  FOREIGN KEY (project_id, object_type_id, primary_id)
+    REFERENCES objects (project_id, object_type_id, primary_id) ON DELETE CASCADE,
+  FOREIGN KEY (project_id, last_commit_id)
+    REFERENCES ontology_commits (project_id, id) DEFERRABLE INITIALLY DEFERRED,
+  CONSTRAINT object_vectors_sources CHECK (
+    cardinality(source) > 0 AND array_ndims(source) = 1 AND array_lower(source, 1) = 1
+    AND array_position(source, NULL) IS NULL
+  ),
+  CONSTRAINT object_vectors_values CHECK (
+    cardinality(embedding) BETWEEN 1 AND 16000
+    AND array_ndims(embedding) = 1 AND array_lower(embedding, 1) = 1
+    AND array_position(embedding, NULL) IS NULL
+    AND '-Infinity'::real < ALL(embedding) AND 'Infinity'::real > ALL(embedding)
+    AND 0::real <> ANY(embedding)
+  )
+);

package/src/migrations/043-vector-indexing.sql

@@ -0,0 +1,24 @@
+CREATE TABLE object_vector_indexing (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  object_type_id TEXT NOT NULL,
+  primary_id TEXT NOT NULL,
+  profile TEXT NOT NULL,
+  request JSONB NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('pending', 'running', 'ready', 'failed')),
+  available_at TIMESTAMPTZ NOT NULL,
+  dispatch_at TIMESTAMPTZ NOT NULL,
+  values_json JSONB,
+  error TEXT,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, object_type_id, primary_id, profile)
+);
+CREATE INDEX object_vector_indexing_due ON object_vector_indexing (project_id, dispatch_at, id)
+  WHERE status <> 'failed';
+
+ALTER TABLE executions DROP CONSTRAINT executions_authority_kernel_operation_check;
+ALTER TABLE executions ADD CONSTRAINT executions_authority_kernel_operation_check
+  CHECK (authority_kernel_operation IS NULL OR authority_kernel_operation IN ('ontology.recover', 'ontology.indexVectors'));
+ALTER TABLE executions DROP CONSTRAINT executions_source_kind_check;
+ALTER TABLE executions ADD CONSTRAINT executions_source_kind_check
+  CHECK (source_kind IN ('http', 'webhook', 'schedule', 'event', 'datasetVersion', 'execution', 'ontologyCommit'));

package/src/migrations/044-vector-batching.sql

@@ -0,0 +1,3 @@
+ALTER TABLE object_vector_indexing ADD COLUMN batch_id TEXT;
+CREATE INDEX object_vector_indexing_batch ON object_vector_indexing (project_id, batch_id, id)
+  WHERE batch_id IS NOT NULL;

package/src/migrations/045-agent-thread-sandbox-state.sql

@@ -0,0 +1,2 @@
+ALTER TABLE agent_threads ADD COLUMN sandbox_state JSONB
+  CHECK (sandbox_state IS NULL OR jsonb_typeof(sandbox_state) = 'object');

package/src/migrations/046-workflow-intervention-principals.sql

@@ -0,0 +1,15 @@
+-- Intervention actors were stored as { principalType, principalId }. Rewrite them to the
+-- canonical Principal shape { type, id } used by every other stored principal.
+UPDATE workflow_interventions
+SET submitted_by = jsonb_build_object(
+  'type', submitted_by->>'principalType',
+  'id', submitted_by->>'principalId'
+)
+WHERE submitted_by->>'principalType' IS NOT NULL;
+
+UPDATE workflow_interventions
+SET cancelled_by = jsonb_build_object(
+  'type', cancelled_by->>'principalType',
+  'id', cancelled_by->>'principalId'
+)
+WHERE cancelled_by->>'principalType' IS NOT NULL;

package/src/migrations/047-ontology-commit-attribution.sql

@@ -0,0 +1,50 @@
+-- Commits and their events name who requested the write and what ran it, replacing the
+-- authority-only `actor`. Both are copied from the commit's execution, which stays canonical and
+-- is immutable, so the backfill is exact.
+ALTER TABLE ontology_commits
+  ADD COLUMN requested_by JSONB,
+  ADD COLUMN executor JSONB;
+
+UPDATE ontology_commits c SET
+  requested_by = CASE
+    WHEN e.requested_by_user_id IS NOT NULL
+      THEN jsonb_build_object('type', 'user', 'id', e.requested_by_user_id)
+    WHEN e.requested_by_service_account_id IS NOT NULL
+      THEN jsonb_build_object('type', 'serviceAccount', 'id', e.requested_by_service_account_id)
+  END,
+  executor = CASE e.executor_kind
+    WHEN 'request' THEN jsonb_build_object('type', 'request', 'requestId', e.executor_id)
+    WHEN 'agent' THEN jsonb_build_object('type', 'agent', 'runId', e.executor_id)
+    WHEN 'kernel' THEN jsonb_build_object(
+      'type', 'kernel',
+      'operation',
+      CASE e.authority_kernel_operation
+        WHEN 'ontology.recover'
+          THEN jsonb_build_object('type', 'ontology.recover', 'recoveryId', e.executor_id)
+        ELSE jsonb_build_object('type', 'ontology.indexVectors', 'indexingId', e.executor_id)
+      END
+    )
+    ELSE jsonb_build_object(
+      'type', 'primitive',
+      'kind', e.executor_kind,
+      'id', e.authority_primitive_id,
+      'runId', e.executor_id
+    )
+  END
+FROM executions e
+WHERE e.project_id = c.project_id AND e.id = c.execution_id;
+
+ALTER TABLE ontology_commits ALTER COLUMN executor SET NOT NULL;
+
+-- Events not yet published would otherwise reach consumers in the retired shape.
+UPDATE ontology_outbox o SET envelope =
+  (o.envelope - 'actor')
+  || jsonb_build_object('executor', c.executor)
+  || CASE
+    WHEN c.requested_by IS NULL THEN '{}'::jsonb
+    ELSE jsonb_build_object('requestedBy', c.requested_by)
+  END
+FROM ontology_commits c
+WHERE c.project_id = o.project_id AND c.id = o.commit_id;
+
+ALTER TABLE ontology_commits DROP COLUMN actor;

package/src/migrations/048-file-upload-sessions.sql

@@ -0,0 +1,34 @@
+-- Durable staged-upload sessions, so an upload survives restarts and spans API replicas.
+CREATE TABLE file_upload_sessions (
+  id TEXT PRIMARY KEY CHECK (length(trim(id)) > 0),
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  owner_principal_type TEXT NOT NULL
+    CHECK (owner_principal_type IN ('user', 'serviceAccount', 'system')),
+  owner_principal_id TEXT NOT NULL CHECK (length(owner_principal_id) > 0),
+  strategy TEXT NOT NULL CHECK (strategy IN ('server', 'direct-put', 'multipart')),
+  status TEXT NOT NULL CHECK (status IN ('pending', 'completed', 'aborted')),
+  file_name TEXT,
+  media_type TEXT,
+  logical_path TEXT,
+  expected_size_bytes BIGINT CHECK (expected_size_bytes IS NULL OR expected_size_bytes >= 0),
+  expected_digest TEXT,
+  provider_upload JSONB CHECK (provider_upload IS NULL OR jsonb_typeof(provider_upload) = 'object'),
+  signed_parts JSONB NOT NULL CHECK (jsonb_typeof(signed_parts) = 'array'),
+  file_ref JSONB CHECK (file_ref IS NULL OR jsonb_typeof(file_ref) = 'object'),
+  created_at TIMESTAMPTZ NOT NULL,
+  expires_at TIMESTAMPTZ NOT NULL,
+  completed_at TIMESTAMPTZ,
+  aborted_at TIMESTAMPTZ,
+  -- Derived by core (fileUploadSessionReapAt); NULL while an abandoned upload awaits its abort.
+  reap_at TIMESTAMPTZ,
+  CHECK ((status = 'completed') = (completed_at IS NOT NULL)),
+  CHECK ((status = 'aborted') = (aborted_at IS NOT NULL))
+);
+
+CREATE INDEX idx_file_upload_sessions_reap
+  ON file_upload_sessions (reap_at)
+  WHERE reap_at IS NOT NULL;
+
+CREATE INDEX idx_file_upload_sessions_abandoned
+  ON file_upload_sessions (project_id, expires_at)
+  WHERE status = 'pending' AND provider_upload IS NOT NULL;

package/src/migrations/049-native-sessions.sql

@@ -0,0 +1,19 @@
+-- Native clients, such as the CLI, hold their session as bearer tokens: a
+-- short-lived access token, whose hash is `token_hash`, and a rotating refresh token. Browser
+-- sessions leave these columns NULL; `refresh_token_hash IS NULL` is what marks a cookie session.
+ALTER TABLE auth_sessions
+  ADD COLUMN client_name TEXT,
+  ADD COLUMN access_expires_at TIMESTAMPTZ,
+  ADD COLUMN refresh_token_hash TEXT,
+  ADD COLUMN previous_refresh_token_hash TEXT,
+  ADD COLUMN refreshed_at TIMESTAMPTZ,
+  ADD CONSTRAINT auth_sessions_bearer_state CHECK (
+    (refresh_token_hash IS NULL) = (client_name IS NULL)
+    AND (refresh_token_hash IS NULL) = (access_expires_at IS NULL)
+    AND (refresh_token_hash IS NOT NULL OR previous_refresh_token_hash IS NULL)
+  );
+
+-- The device flow now starts a session instead of issuing a personal access token.
+ALTER TABLE auth_device_authorizations
+  DROP COLUMN token_name,
+  DROP COLUMN token_expires_at;

package/src/migrations.ts

@@ -90,6 +90,22 @@ import shareSessionsSql from "./migrations/036-share-sessions.sql" with { type:
 import projectionSourceRootsSql from "./migrations/039-projection-source-roots.sql" with {
   type: "text",
 }
+import agentThreadWorkspacesSql from "./migrations/041-agent-thread-workspaces.sql" with {
+  type: "text",
+}
+import vectorProfilesSql from "./migrations/042-vector-profiles.sql" with { type: "text" }
+import vectorIndexingSql from "./migrations/043-vector-indexing.sql" with { type: "text" }
+import vectorBatchingSql from "./migrations/044-vector-batching.sql" with { type: "text" }
+import agentThreadSandboxStateSql from "./migrations/045-agent-thread-sandbox-state.sql" with {
+  type: "text",
+}
+import workflowInterventionPrincipalsSql from "./migrations/046-workflow-intervention-principals.sql" with {
+  type: "text",
+}
+import ontologyCommitAttributionSql from "./migrations/047-ontology-commit-attribution.sql" with {
+  type: "text",
+}
+import nativeSessionsSql from "./migrations/049-native-sessions.sql" with { type: "text" }
 import type { SQL, SQLClient } from "./pg-client"
 
 export interface PostgresMigrationContext {
@@ -383,6 +399,15 @@ export const postgresStorageMigrations = defineMigrations<PostgresMigrationConte
     pgSql("038-outbox-publication-order", outboxPublicationOrderSql),
     pgSql("039-projection-source-roots", projectionSourceRootsSql),
     pgSql("040-connector-optional-pkce", connectorOptionalPkceSql),
+    pgSql("041-agent-thread-workspaces", agentThreadWorkspacesSql),
+    pgSql("042-vector-profiles", vectorProfilesSql),
+    pgSql("043-vector-indexing", vectorIndexingSql),
+    pgSql("044-vector-batching", vectorBatchingSql),
+    pgSql("045-agent-thread-sandbox-state", agentThreadSandboxStateSql),
+    pgSql("046-workflow-intervention-principals", workflowInterventionPrincipalsSql),
+    pgSql("047-ontology-commit-attribution", ontologyCommitAttributionSql),
+    pgSql("048-file-upload-sessions", fileUploadSessionsSql),
+    pgSql("049-native-sessions", nativeSessionsSql),
   ],
 })
 
@@ -406,3 +431,4 @@ import outboxPublicationOrderSql from "./migrations/038-outbox-publication-order
 import connectorOptionalPkceSql from "./migrations/040-connector-optional-pkce.sql" with {
   type: "text",
 }
+import fileUploadSessionsSql from "./migrations/048-file-upload-sessions.sql" with { type: "text" }