@sixb/pg 0.1.12 → 0.1.14

package/dist/index.js

@@ -1162,7 +1162,14 @@ function rowToSessionRecord(row) {
     revokedAt: row.revoked_at ? toDate(row.revoked_at) : undefined,
     lastSeenAt: row.last_seen_at ? toDate(row.last_seen_at) : undefined,
     userAgent: row.user_agent ?? undefined,
-    ipAddress: row.ip_address ?? undefined
+    ipAddress: row.ip_address ?? undefined,
+    bearer: row.refresh_token_hash !== null && row.client_name !== null && row.access_expires_at !== null ? {
+      clientName: row.client_name,
+      accessExpiresAt: toDate(row.access_expires_at),
+      refreshTokenHash: row.refresh_token_hash,
+      previousRefreshTokenHash: row.previous_refresh_token_hash ?? undefined,
+      refreshedAt: row.refreshed_at ? toDate(row.refreshed_at) : undefined
+    } : undefined
   };
 }
 function rowToAccessTokenRecord(row) {
@@ -1171,8 +1178,7 @@ function rowToAccessTokenRecord(row) {
     projectId: row.project_id,
     name: row.name,
     kind: row.kind,
-    subjectType: row.subject_type,
-    subjectId: row.subject_id,
+    subject: { type: row.subject_type, id: row.subject_id },
     tokenHash: row.token_hash,
     groupIds: parseOptionalStringArray(row.group_ids),
     createdByPrincipal: principalFromColumns2(row),
@@ -1247,8 +1253,6 @@ function rowToDeviceAuthorizationRecord(row) {
     deviceCodeHash: row.device_code_hash,
     userCode: row.user_code,
     clientName: row.client_name,
-    tokenName: row.token_name,
-    tokenExpiresAt: toDate(row.token_expires_at),
     status: row.status,
     approvedUserId: row.approved_user_id ?? undefined,
     approvedSessionId: row.approved_session_id ?? undefined,
@@ -1559,7 +1563,10 @@ async function createSession(sql, input) {
         expires_at,
         absolute_expires_at,
         user_agent,
-        ip_address
+        ip_address,
+        client_name,
+        access_expires_at,
+        refresh_token_hash
       ) VALUES (
         ${projectId},
         ${id},
@@ -1571,7 +1578,10 @@ async function createSession(sql, input) {
         ${input.expiresAt},
         ${input.absoluteExpiresAt ?? null},
         ${input.userAgent ?? null},
-        ${input.ipAddress ?? null}
+        ${input.ipAddress ?? null},
+        ${input.bearer ? assertNonEmpty(input.bearer.clientName, "Session client name") : null},
+        ${input.bearer?.accessExpiresAt ?? null},
+        ${input.bearer ? assertNonEmpty(input.bearer.refreshTokenHash, "Refresh token hash") : null}
       )
       RETURNING *
     `;
@@ -1763,10 +1773,10 @@ class PgAuthAccessTokenStore {
     const id = assertNonEmpty(input.id, "Access token id");
     const projectId = assertNonEmpty(input.projectId, "Project id");
     const name = assertNonEmpty(input.name, "Access token name");
-    const subjectId = assertNonEmpty(input.subjectId, "Access token subject id");
+    const subjectId = assertNonEmpty(input.subject.id, "Access token subject id");
     const tokenHash = assertNonEmpty(input.tokenHash, "Access token hash");
     assertKindMatchesSubject(input);
-    await this.assertSubjectExists(projectId, input.subjectType, subjectId);
+    await this.assertSubjectExists(projectId, input.subject.type, subjectId);
     const groupIds = input.groupIds === undefined ? undefined : normalizeGroupIds(input.groupIds);
     try {
       const [row] = await this.sql`
@@ -1790,7 +1800,7 @@ class PgAuthAccessTokenStore {
           ${id},
           ${name},
           ${input.kind},
-          ${input.subjectType},
+          ${input.subject.type},
           ${subjectId},
           ${tokenHash},
           ${serializeOptionalStringArray(groupIds)},
@@ -1825,13 +1835,9 @@ class PgAuthAccessTokenStore {
       whereClauses.push(`kind = $${nextIndex++}`);
       params.push(input.kind);
     }
-    if (input.subjectType) {
-      whereClauses.push(`subject_type = $${nextIndex++}`);
-      params.push(input.subjectType);
-    }
-    if (input.subjectId) {
-      whereClauses.push(`subject_id = $${nextIndex++}`);
-      params.push(input.subjectId);
+    if (input.subject) {
+      whereClauses.push(`subject_type = $${nextIndex++}`, `subject_id = $${nextIndex++}`);
+      params.push(input.subject.type, input.subject.id);
     }
     if (!input.includeRevoked) {
       whereClauses.push("revoked_at IS NULL");
@@ -1919,10 +1925,10 @@ class PgAuthAccessTokenStore {
   }
 }
 function assertKindMatchesSubject(input) {
-  if (input.kind === "personal" && input.subjectType === "user" || input.kind === "serviceAccount" && input.subjectType === "serviceAccount") {
+  if (input.kind === "personal" && input.subject.type === "user" || input.kind === "serviceAccount" && input.subject.type === "serviceAccount") {
     return;
   }
-  throw new AuthStorageError2("invalid_input", `[Sixb] Access token kind '${input.kind}' cannot target subject type '${input.subjectType}'.`);
+  throw new AuthStorageError2("invalid_input", `[Sixb] Access token kind '${input.kind}' cannot target subject type '${input.subject.type}'.`);
 }
 
 // src/auth-storage/device-authorizations.ts
@@ -1949,16 +1955,15 @@ class PgAuthDeviceAuthorizationStore {
       try {
         const [row] = await tx`
         INSERT INTO auth_device_authorizations (
-          project_id, id, device_code_hash, user_code, client_name, token_name,
-          token_expires_at, status, created_at, expires_at
+          project_id, id, device_code_hash, user_code, client_name, status, created_at,
+          expires_at
         ) VALUES (
           ${assertNonEmpty(input.projectId, "Project id")},
           ${assertNonEmpty(input.id, "Device authorization id")},
           ${assertNonEmpty(input.deviceCodeHash, "Device code hash")},
           ${assertNonEmpty(input.userCode, "User code")},
           ${assertNonEmpty(input.clientName, "Client name")},
-          ${assertNonEmpty(input.tokenName, "Token name")},
-          ${input.tokenExpiresAt}, 'pending', ${input.createdAt}, ${input.expiresAt}
+          'pending', ${input.createdAt}, ${input.expiresAt}
         ) RETURNING *
       `;
         return rowToDeviceAuthorizationRecord(row);
@@ -2700,11 +2705,53 @@ class PgAuthSessionStore {
   }
   async findValidByTokenHash(params) {
     const row = await getSessionRowById(this.sql, params);
-    if (!row || row.audience !== params.audience || row.token_hash !== params.tokenHash || row.revoked_at || new Date(row.expires_at) <= params.now || row.absolute_expires_at !== null && new Date(row.absolute_expires_at) <= params.now) {
+    if (!row || row.refresh_token_hash !== null || row.audience !== params.audience || row.token_hash !== params.tokenHash || !isLiveSessionRow(row, params.now)) {
+      return null;
+    }
+    return rowToSessionRecord(row);
+  }
+  async findValidByAccessTokenHash(params) {
+    const row = await getSessionRowById(this.sql, params);
+    if (!row || row.access_expires_at === null || row.token_hash !== params.tokenHash || new Date(row.access_expires_at) <= params.now || !isLiveSessionRow(row, params.now)) {
       return null;
     }
     return rowToSessionRecord(row);
   }
+  async rotateRefreshToken(params) {
+    return runPgTransaction(this.sql, async (tx) => {
+      const row = await getSessionRowById(tx, params, { forUpdate: true });
+      if (!row?.refresh_token_hash || !isLiveSessionRow(row, params.now)) {
+        return { status: "invalid" };
+      }
+      const replacedRecently = row.previous_refresh_token_hash === params.refreshTokenHash && row.refreshed_at !== null && params.now.getTime() - new Date(row.refreshed_at).getTime() <= params.reuseGraceMs;
+      if (row.refresh_token_hash !== params.refreshTokenHash && !replacedRecently) {
+        if (row.previous_refresh_token_hash !== params.refreshTokenHash) {
+          return { status: "invalid" };
+        }
+        await tx`
+          UPDATE auth_sessions SET revoked_at = ${params.now}
+          WHERE project_id = ${params.projectId} AND id = ${params.id}
+        `;
+        return { status: "reused" };
+      }
+      const [rotated] = await tx`
+        UPDATE auth_sessions
+        SET token_hash = ${params.next.tokenHash},
+            access_expires_at = ${params.next.accessExpiresAt},
+            previous_refresh_token_hash = refresh_token_hash,
+            refresh_token_hash = ${params.next.refreshTokenHash},
+            refreshed_at = ${params.now},
+            last_seen_at = ${params.now},
+            expires_at = GREATEST(
+              expires_at,
+              LEAST(${params.next.expiresAt}, COALESCE(absolute_expires_at, ${params.next.expiresAt}))
+            )
+        WHERE project_id = ${params.projectId} AND id = ${params.id}
+        RETURNING *
+      `;
+      return rotated ? { status: "rotated", session: rowToSessionRecord(rotated) } : { status: "invalid" };
+    });
+  }
   async renewIfValid(params) {
     const [row] = await this.sql`
       UPDATE auth_sessions
@@ -2720,6 +2767,7 @@ class PgAuthSessionStore {
         AND id = ${params.id}
         AND audience = ${params.audience}
         AND token_hash = ${params.tokenHash}
+        AND refresh_token_hash IS NULL
         AND revoked_at IS NULL
         AND expires_at > ${params.now}
         AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.now})
@@ -2767,6 +2815,9 @@ class PgAuthSessionStore {
     });
   }
 }
+function isLiveSessionRow(row, now) {
+  return row.revoked_at === null && new Date(row.expires_at) > now && (row.absolute_expires_at === null || new Date(row.absolute_expires_at) > now);
+}
 
 // src/auth-storage/users.ts
 import { AuthStorageError as AuthStorageError10 } from "@sixb/core/storage";
@@ -2928,7 +2979,7 @@ class PgAuthStorage {
         throw new AuthStorageError11("missing_device_authorization", `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`);
       }
       assertCompletableDeviceAuthorization(authorization, input);
-      const accessToken = await new PgAuthAccessTokenStore(tx).create(input.accessToken);
+      const session = await createSession(tx, input.session);
       const [consumed] = await tx`
         UPDATE auth_device_authorizations
         SET status = 'consumed', consumed_at = ${input.completedAt}
@@ -2944,7 +2995,7 @@ class PgAuthStorage {
           status: "consumed",
           consumedAt: new Date(input.completedAt)
         },
-        accessToken
+        session
       };
     });
   }
@@ -3004,17 +3055,6 @@ class PgAuthStorage {
           error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
         };
       }
-      if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && await hasActiveUsers(tx, projectId)) {
-        await consumeMagicLink(tx, {
-          projectId,
-          id: input.magicLinkId,
-          tokenHash: input.tokenHash,
-          consumedAt: completedAt
-        });
-        return {
-          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
-        };
-      }
       await validateCompleteSessionInput(tx, projectId, input.session);
       assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
       let newUserId;
@@ -3046,8 +3086,9 @@ class PgAuthStorage {
         projectId,
         user
       });
-      const groupMemberships = await this.applyManualGroups(tx, {
+      const groupMemberships = await this.applyGroups(tx, {
         completedAt,
+        source: "manual",
         existing: invitation.groupMemberships,
         groupIds: manualGroupIds,
         projectId,
@@ -3107,36 +3148,18 @@ class PgAuthStorage {
           error: new AuthStorageError11("missing_user", `[Sixb] User '${identity.user_id}' not found for linked OIDC identity.`)
         };
       }
-      if (!identity && userRow && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
-        await this.consumeOidcAttempt(input, completedAt, projectId, tx);
-        return {
-          error: new AuthStorageError11("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${userRow.id}' for project '${projectId}'.`)
-        };
-      }
       if (userRow?.status === "suspended") {
         await this.consumeOidcAttempt(input, completedAt, projectId, tx);
         return {
           error: new AuthStorageError11("suspended_user", `[Sixb] User '${userRow.id}' is suspended for project '${projectId}'.`)
         };
       }
-      if (shouldCreateUser && !input.emailVerified) {
-        await this.consumeOidcAttempt(input, completedAt, projectId, tx);
-        return {
-          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
-        };
-      }
       if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
         await this.consumeOidcAttempt(input, completedAt, projectId, tx);
         return {
           error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
         };
       }
-      if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && await hasActiveUsers(tx, projectId)) {
-        await this.consumeOidcAttempt(input, completedAt, projectId, tx);
-        return {
-          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
-        };
-      }
       await validateCompleteSessionInput(tx, projectId, input.session);
       assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
       let newUserId;
@@ -3179,10 +3202,17 @@ class PgAuthStorage {
         projectId,
         user
       });
-      const groupMemberships = await this.applyManualGroups(tx, {
+      const groupMemberships = await this.syncDirectoryGroups(tx, {
         completedAt,
-        existing: invitation.groupMemberships,
-        groupIds: manualGroupIds,
+        existing: await this.applyGroups(tx, {
+          completedAt,
+          source: "manual",
+          existing: invitation.groupMemberships,
+          groupIds: manualGroupIds,
+          projectId,
+          userId: user.id
+        }),
+        groupIds: input.directoryGroupIds,
         projectId,
         userId: user.id
       });
@@ -3311,19 +3341,33 @@ class PgAuthStorage {
     }
     return { invitation, groupMemberships };
   }
-  async applyManualGroups(sql, input) {
+  async applyGroups(sql, input) {
     const groupMemberships = [...input.existing];
     for (const groupId of input.groupIds) {
       groupMemberships.push(await upsertGroupMembership(sql, {
         projectId: input.projectId,
         userId: input.userId,
         groupId,
-        source: "manual",
+        source: input.source,
         createdAt: input.completedAt
       }));
     }
     return groupMemberships;
   }
+  async syncDirectoryGroups(sql, input) {
+    if (!input.groupIds) {
+      return input.existing;
+    }
+    const groupIds = normalizeGroupIds(input.groupIds);
+    await sql`
+      DELETE FROM auth_group_memberships
+      WHERE project_id = ${input.projectId}
+        AND user_id = ${input.userId}
+        AND source = 'directory'
+        ${groupIds.length > 0 ? sql`AND group_id NOT IN ${sql(groupIds)}` : sql``}
+    `;
+    return this.applyGroups(sql, { ...input, groupIds, source: "directory" });
+  }
   async createSignInSession(sql, input) {
     await lockAdvisoryKeys(sql, [
       authLockKey("sessions", input.projectId, input.userId),
@@ -3380,16 +3424,6 @@ class PgAuthStorage {
     return rowToIdentityRecord(row);
   }
 }
-async function hasActiveUsers(sql, projectId) {
-  const rows = await sql`
-    SELECT 1 AS active
-    FROM auth_users
-    WHERE project_id = ${projectId}
-      AND status = 'active'
-    LIMIT 1
-  `;
-  return rows.length > 0;
-}
 function assertSignInSessionAudience(projectId, sessionAudience, storedAudience) {
   if (sessionAudience === storedAudience) {
     return;
@@ -3406,7 +3440,7 @@ function assertCompletableDeviceAuthorization(authorization, input) {
   if (authorization.status === "denied") {
     throw new AuthStorageError11("device_authorization_denied", "[Sixb] Device authorization was denied.");
   }
-  if (authorization.status !== "approved" || authorization.expiresAt <= input.completedAt || !authorization.approvedUserId || !authorization.approvedSessionId || input.accessToken.projectId !== input.projectId || input.accessToken.subjectType !== "user" || input.accessToken.subjectId !== authorization.approvedUserId || input.accessToken.createdBySessionId !== authorization.approvedSessionId) {
+  if (authorization.status !== "approved" || authorization.expiresAt <= input.completedAt || !authorization.approvedUserId || !authorization.approvedSessionId || input.session.projectId !== input.projectId || input.session.userId !== authorization.approvedUserId) {
     throw new AuthStorageError11("invalid_device_authorization", "[Sixb] Device authorization is invalid.");
   }
 }
@@ -7244,6 +7278,107 @@ var _045_agent_thread_sandbox_state_default = `ALTER TABLE agent_threads ADD COL
   CHECK (sandbox_state IS NULL OR jsonb_typeof(sandbox_state) = 'object');
 `;
 
+// src/migrations/046-workflow-intervention-principals.sql
+var _046_workflow_intervention_principals_default = `-- Intervention actors were stored as { principalType, principalId }. Rewrite them to the
+-- canonical Principal shape { type, id } used by every other stored principal.
+UPDATE workflow_interventions
+SET submitted_by = jsonb_build_object(
+  'type', submitted_by->>'principalType',
+  'id', submitted_by->>'principalId'
+)
+WHERE submitted_by->>'principalType' IS NOT NULL;
+
+UPDATE workflow_interventions
+SET cancelled_by = jsonb_build_object(
+  'type', cancelled_by->>'principalType',
+  'id', cancelled_by->>'principalId'
+)
+WHERE cancelled_by->>'principalType' IS NOT NULL;
+`;
+
+// src/migrations/047-ontology-commit-attribution.sql
+var _047_ontology_commit_attribution_default = `-- Commits and their events name who requested the write and what ran it, replacing the
+-- authority-only \`actor\`. Both are copied from the commit's execution, which stays canonical and
+-- is immutable, so the backfill is exact.
+ALTER TABLE ontology_commits
+  ADD COLUMN requested_by JSONB,
+  ADD COLUMN executor JSONB;
+
+UPDATE ontology_commits c SET
+  requested_by = CASE
+    WHEN e.requested_by_user_id IS NOT NULL
+      THEN jsonb_build_object('type', 'user', 'id', e.requested_by_user_id)
+    WHEN e.requested_by_service_account_id IS NOT NULL
+      THEN jsonb_build_object('type', 'serviceAccount', 'id', e.requested_by_service_account_id)
+  END,
+  executor = CASE e.executor_kind
+    WHEN 'request' THEN jsonb_build_object('type', 'request', 'requestId', e.executor_id)
+    WHEN 'agent' THEN jsonb_build_object('type', 'agent', 'runId', e.executor_id)
+    WHEN 'kernel' THEN jsonb_build_object(
+      'type', 'kernel',
+      'operation',
+      CASE e.authority_kernel_operation
+        WHEN 'ontology.recover'
+          THEN jsonb_build_object('type', 'ontology.recover', 'recoveryId', e.executor_id)
+        ELSE jsonb_build_object('type', 'ontology.indexVectors', 'indexingId', e.executor_id)
+      END
+    )
+    ELSE jsonb_build_object(
+      'type', 'primitive',
+      'kind', e.executor_kind,
+      'id', e.authority_primitive_id,
+      'runId', e.executor_id
+    )
+  END
+FROM executions e
+WHERE e.project_id = c.project_id AND e.id = c.execution_id;
+
+ALTER TABLE ontology_commits ALTER COLUMN executor SET NOT NULL;
+
+-- Events not yet published would otherwise reach consumers in the retired shape.
+UPDATE ontology_outbox o SET envelope =
+  (o.envelope - 'actor')
+  || jsonb_build_object('executor', c.executor)
+  || CASE
+    WHEN c.requested_by IS NULL THEN '{}'::jsonb
+    ELSE jsonb_build_object('requestedBy', c.requested_by)
+  END
+FROM ontology_commits c
+WHERE c.project_id = o.project_id AND c.id = o.commit_id;
+
+ALTER TABLE ontology_commits DROP COLUMN actor;
+`;
+
+// src/migrations/049-native-sessions.sql
+var _049_native_sessions_default = `-- Native clients, such as the CLI, hold their session as bearer tokens: a
+-- short-lived access token, whose hash is \`token_hash\`, and a rotating refresh token. Browser
+-- sessions leave these columns NULL; \`refresh_token_hash IS NULL\` is what marks a cookie session.
+ALTER TABLE auth_sessions
+  ADD COLUMN client_name TEXT,
+  ADD COLUMN access_expires_at TIMESTAMPTZ,
+  ADD COLUMN refresh_token_hash TEXT,
+  ADD COLUMN previous_refresh_token_hash TEXT,
+  ADD COLUMN refreshed_at TIMESTAMPTZ,
+  ADD CONSTRAINT auth_sessions_bearer_state CHECK (
+    (refresh_token_hash IS NULL) = (client_name IS NULL)
+    AND (refresh_token_hash IS NULL) = (access_expires_at IS NULL)
+    AND (refresh_token_hash IS NOT NULL OR previous_refresh_token_hash IS NULL)
+  );
+
+-- The device flow now starts a session instead of issuing a personal access token.
+ALTER TABLE auth_device_authorizations
+  DROP COLUMN token_name,
+  DROP COLUMN token_expires_at;
+`;
+
+// src/migrations/050-directory-group-memberships.sql
+var _050_directory_group_memberships_default = `-- A membership the identity provider owns is recorded with source 'directory' and synced to the
+-- provider's groups on every sign-in. Service accounts never sign in, so their table is unchanged.
+ALTER TABLE auth_group_memberships DROP CONSTRAINT auth_group_memberships_source_check;
+ALTER TABLE auth_group_memberships ADD CONSTRAINT auth_group_memberships_source_check
+  CHECK (source IN ('invitation', 'manual', 'agent', 'directory'));
+`;
+
 // src/migrations/037-execution-requester-groups.sql
 var _037_execution_requester_groups_default = `ALTER TABLE executions ADD COLUMN requester_group_ids JSONB NOT NULL DEFAULT '[]'::jsonb;
 
@@ -7282,6 +7417,43 @@ ALTER TABLE connector_authorization_attempts
   ALTER COLUMN code_verifier DROP NOT NULL;
 `;
 
+// src/migrations/048-file-upload-sessions.sql
+var _048_file_upload_sessions_default = `-- Durable staged-upload sessions, so an upload survives restarts and spans API replicas.
+CREATE TABLE file_upload_sessions (
+  id TEXT PRIMARY KEY CHECK (length(trim(id)) > 0),
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  owner_principal_type TEXT NOT NULL
+    CHECK (owner_principal_type IN ('user', 'serviceAccount', 'system')),
+  owner_principal_id TEXT NOT NULL CHECK (length(owner_principal_id) > 0),
+  strategy TEXT NOT NULL CHECK (strategy IN ('server', 'direct-put', 'multipart')),
+  status TEXT NOT NULL CHECK (status IN ('pending', 'completed', 'aborted')),
+  file_name TEXT,
+  media_type TEXT,
+  logical_path TEXT,
+  expected_size_bytes BIGINT CHECK (expected_size_bytes IS NULL OR expected_size_bytes >= 0),
+  expected_digest TEXT,
+  provider_upload JSONB CHECK (provider_upload IS NULL OR jsonb_typeof(provider_upload) = 'object'),
+  signed_parts JSONB NOT NULL CHECK (jsonb_typeof(signed_parts) = 'array'),
+  file_ref JSONB CHECK (file_ref IS NULL OR jsonb_typeof(file_ref) = 'object'),
+  created_at TIMESTAMPTZ NOT NULL,
+  expires_at TIMESTAMPTZ NOT NULL,
+  completed_at TIMESTAMPTZ,
+  aborted_at TIMESTAMPTZ,
+  -- Derived by core (fileUploadSessionReapAt); NULL while an abandoned upload awaits its abort.
+  reap_at TIMESTAMPTZ,
+  CHECK ((status = 'completed') = (completed_at IS NOT NULL)),
+  CHECK ((status = 'aborted') = (aborted_at IS NOT NULL))
+);
+
+CREATE INDEX idx_file_upload_sessions_reap
+  ON file_upload_sessions (reap_at)
+  WHERE reap_at IS NOT NULL;
+
+CREATE INDEX idx_file_upload_sessions_abandoned
+  ON file_upload_sessions (project_id, expires_at)
+  WHERE status = 'pending' AND provider_upload IS NOT NULL;
+`;
+
 // src/migrations.ts
 var POSTGRES_STORAGE_ADAPTER_ID = "SixbPostgresStorage";
 function pgSql(id, sqlText) {
@@ -7501,7 +7673,12 @@ var postgresStorageMigrations = defineMigrations({
     pgSql("042-vector-profiles", _042_vector_profiles_default),
     pgSql("043-vector-indexing", _043_vector_indexing_default),
     pgSql("044-vector-batching", _044_vector_batching_default),
-    pgSql("045-agent-thread-sandbox-state", _045_agent_thread_sandbox_state_default)
+    pgSql("045-agent-thread-sandbox-state", _045_agent_thread_sandbox_state_default),
+    pgSql("046-workflow-intervention-principals", _046_workflow_intervention_principals_default),
+    pgSql("047-ontology-commit-attribution", _047_ontology_commit_attribution_default),
+    pgSql("048-file-upload-sessions", _048_file_upload_sessions_default),
+    pgSql("049-native-sessions", _049_native_sessions_default),
+    pgSql("050-directory-group-memberships", _050_directory_group_memberships_default)
   ]
 });
 
@@ -9625,7 +9802,8 @@ var PG_OBJECT_QUERY_CAPABILITIES = {
     double: { equality: true, ordering: true },
     decimal: { equality: true, ordering: true },
     date: { equality: true, ordering: true },
-    timestamp: { equality: true, ordering: true }
+    timestamp: { equality: true, ordering: true },
+    userRef: { equality: true }
   },
   limits: {
     totalCount: true,
@@ -9828,9 +10006,10 @@ function commitRecord(row) {
     requestHash: row.request_hash,
     executionId: row.execution_id,
     origin: structuredClone(row.origin),
-    ...row.actor === null ? {} : {
-      actor: structuredClone(row.actor)
+    ...row.requested_by === null ? {} : {
+      requestedBy: structuredClone(row.requested_by)
     },
+    executor: structuredClone(row.executor),
     ontologyRevision: row.ontology_revision,
     ...row.projection_revision === null ? {} : { projectionRevision: row.projection_revision },
     ...row.ownership_hash === null ? {} : { ownershipHash: row.ownership_hash },
@@ -9979,6 +10158,9 @@ import {
   telemetryPointSortKey as telemetryPointSortKey2
 } from "@sixb/core/internal/materialization";
 import {
+  assertExpectedLinkRevision,
+  assertExpectedLinkScopeRevision,
+  assertExpectedObjectRevision,
   assertMaterializationFinalizationCorrelation,
   assertMaterializationHeader,
   assertMaterializationLaneCompletion,
@@ -11915,17 +12097,15 @@ class PgOntologyMaterializationStorage {
       await this.assertSources(input.expected.sources, input.commit.projectId);
       const objectRevisions = await reader.effectiveObjectRevisions(input.expected.objects.map((expected) => expected.ref), true);
       for (const expected of input.expected.objects) {
-        this.assertObject(objectRevisions.get(objectRefKey3(expected.ref)) ?? null, expected);
+        assertExpectedObjectRevision(objectRevisions.get(objectRefKey3(expected.ref)) ?? null, expected);
       }
       const linkRevisions = await reader.effectiveLinkLastCommits(input.expected.links.map((expected) => expected.ref), true);
       for (const expected of input.expected.links) {
-        this.assertLink(linkRevisions.get(linkRefKey3(expected.ref)), expected);
+        assertExpectedLinkRevision(linkRevisions.get(linkRefKey3(expected.ref)), expected);
       }
       const linkScopeRevisions = await reader.linkScopeRevisions(input.expected.linkScopes);
       for (const [index, expected] of input.expected.linkScopes.entries()) {
-        if (linkScopeRevisions[index]?.fingerprint !== expected.fingerprint) {
-          throw new MaterializationConflictError6("effective-state", `Expected link scope changed for ${expected.source.objectTypeId}:${expected.source.primaryId}.${expected.linkId}.`);
-        }
+        assertExpectedLinkScopeRevision(linkScopeRevisions[index]?.fingerprint, expected);
       }
       const points = await reader.exactPoints(input.expected.points, true);
       const pointRevisions = new Map(points.map((point) => [telemetryPointKey3(point.series, point.at), point.lastCommitId]));
@@ -12185,28 +12365,6 @@ class PgOntologyMaterializationStorage {
       throw new MaterializationConflictError6("projection-fence", `Source '${expected.source.projectionId}' changed.`);
     }
   }
-  assertObject(row, expected) {
-    if (!expected.exists) {
-      if (row) {
-        throw new MaterializationConflictError6("effective-state", `Expected object ${objectRefKey3(expected.ref)} to be absent.`);
-      }
-      return;
-    }
-    if (!row || row.version !== expected.version || row.lastCommitId !== expected.lastCommitId) {
-      throw new MaterializationConflictError6("effective-state", `Expected object ${objectRefKey3(expected.ref)} changed.`);
-    }
-  }
-  assertLink(lastCommitId, expected) {
-    if (!expected.exists) {
-      if (lastCommitId !== undefined) {
-        throw new MaterializationConflictError6("effective-state", `Expected link ${linkRefKey3(expected.ref)} to be absent.`);
-      }
-      return;
-    }
-    if (lastCommitId === undefined || lastCommitId !== expected.lastCommitId) {
-      throw new MaterializationConflictError6("effective-state", `Expected link ${linkRefKey3(expected.ref)} changed.`);
-    }
-  }
   async assertFinalization(session, input) {
     const { commit } = session.header;
     const { result } = input.finalization;
@@ -12442,18 +12600,19 @@ class PgOntologyMaterializationStorage {
   async insertCommit(header, input) {
     const { commit } = header;
     const origin = originColumns(commit.origin);
-    const actor = commit.actor === undefined ? null : jsonParameter2(this.sql, commit.actor);
+    const requestedBy = commit.requestedBy === undefined ? null : jsonParameter2(this.sql, commit.requestedBy);
     const rows = await this.sql`
       INSERT INTO ontology_commits (
         project_id, id, idempotency_key, request_hash, execution_id,
-        origin_kind, origin_run_id, origin_batch_ordinal, origin, actor,
+        origin_kind, origin_run_id, origin_batch_ordinal, origin, requested_by, executor,
         ontology_revision, projection_revision, ownership_hash,
         intent, result, committed_at
       ) VALUES (
         ${commit.projectId}, ${commit.id}, ${commit.idempotencyKey}, ${commit.requestHash},
         ${commit.executionId},
         ${origin.kind}, ${origin.runId}, ${origin.batchOrdinal},
-        ${jsonParameter2(this.sql, commit.origin)}, ${actor}, ${commit.ontologyRevision},
+        ${jsonParameter2(this.sql, commit.origin)}, ${requestedBy},
+        ${jsonParameter2(this.sql, commit.executor)}, ${commit.ontologyRevision},
         ${commit.projectionRevision ?? null}, ${commit.ownershipHash ?? null},
         ${jsonParameter2(this.sql, commit.intent)},
         ${jsonParameter2(this.sql, input.finalization.result)}, ${commit.committedAt}
@@ -15547,6 +15706,132 @@ function toStorageRow(row) {
   };
 }
 
+// src/pg-file-upload-session-storage.ts
+import {
+  DurableFileUploadSessions,
+  fileUploadSessionReapAt,
+  parseFileUploadSessionRow
+} from "@sixb/core/internal/file-upload-session-storage-provider";
+class PgFileUploadSessionStorage extends DurableFileUploadSessions {
+  constructor(sql) {
+    super(new PgFileUploadSessionBackend(sql));
+  }
+}
+
+class PgFileUploadSessionBackend {
+  sql;
+  constructor(sql) {
+    this.sql = sql;
+  }
+  read(run) {
+    return run(new PgFileUploadSessionPersistence(this.sql, false));
+  }
+  transaction(run) {
+    return runPgTransaction(this.sql, (tx) => run(new PgFileUploadSessionPersistence(tx, true)));
+  }
+}
+
+class PgFileUploadSessionPersistence {
+  sql;
+  locking;
+  constructor(sql, locking) {
+    this.sql = sql;
+    this.locking = locking;
+  }
+  async now() {
+    const [row] = await this.sql`SELECT clock_timestamp() AS now`;
+    if (!row)
+      throw new Error("[SixbPg] Database clock returned no row.");
+    return new Date(row.now);
+  }
+  async insert(session) {
+    const rows = await this.sql`
+      INSERT INTO file_upload_sessions (
+        id, project_id, owner_principal_type, owner_principal_id, strategy, status, file_name,
+        media_type, logical_path, expected_size_bytes, expected_digest, provider_upload,
+        signed_parts, file_ref, created_at, expires_at, completed_at, aborted_at, reap_at
+      ) VALUES (
+        ${session.id}, ${session.projectId}, ${session.principal.type}, ${session.principal.id},
+        ${session.strategy}, ${session.status}, ${session.fileName ?? null}, ${session.mediaType ?? null},
+        ${session.logicalPath ?? null}, ${session.expectedSizeBytes ?? null},
+        ${session.expectedDigest ?? null}, ${jsonText(session.providerUpload)}::text::jsonb,
+        ${JSON.stringify(session.signedParts)}::text::jsonb, ${jsonText(session.fileRef)}::text::jsonb,
+        ${session.createdAt}, ${session.expiresAt}, ${session.completedAt ?? null},
+        ${session.abortedAt ?? null}, ${fileUploadSessionReapAt(session)}
+      )
+      ON CONFLICT (id) DO NOTHING
+      RETURNING id
+    `;
+    return rows.length === 1;
+  }
+  async get(uploadId) {
+    const [row] = this.locking ? await this.sql`
+          SELECT * FROM file_upload_sessions WHERE id = ${uploadId} FOR UPDATE
+        ` : await this.sql`
+          SELECT * FROM file_upload_sessions WHERE id = ${uploadId}
+        `;
+    return row ? sessionFromRow(row) : null;
+  }
+  async update(session) {
+    await this.sql`
+      UPDATE file_upload_sessions
+      SET status = ${session.status},
+        provider_upload = ${jsonText(session.providerUpload)}::text::jsonb,
+        signed_parts = ${JSON.stringify(session.signedParts)}::text::jsonb,
+        file_ref = ${jsonText(session.fileRef)}::text::jsonb,
+        created_at = ${session.createdAt},
+        expires_at = ${session.expiresAt},
+        completed_at = ${session.completedAt ?? null},
+        aborted_at = ${session.abortedAt ?? null},
+        reap_at = ${fileUploadSessionReapAt(session)}
+      WHERE id = ${session.id}
+    `;
+  }
+  async listAbandoned(input) {
+    const rows = await this.sql`
+      SELECT * FROM file_upload_sessions
+      WHERE project_id = ${input.projectId} AND status = 'pending'
+        AND provider_upload IS NOT NULL AND expires_at <= ${input.now}
+      ORDER BY expires_at, id COLLATE "C"
+      LIMIT ${input.limit}
+    `;
+    return rows.map(sessionFromRow);
+  }
+  async deleteReapable(now) {
+    const rows = await this.sql`
+      DELETE FROM file_upload_sessions
+      WHERE reap_at IS NOT NULL AND reap_at <= ${now}
+      RETURNING id
+    `;
+    return rows.length;
+  }
+}
+function sessionFromRow(row) {
+  return parseFileUploadSessionRow({
+    id: row.id,
+    projectId: row.project_id,
+    ownerPrincipalType: row.owner_principal_type,
+    ownerPrincipalId: row.owner_principal_id,
+    strategy: row.strategy,
+    status: row.status,
+    fileName: row.file_name,
+    mediaType: row.media_type,
+    logicalPath: row.logical_path,
+    expectedSizeBytes: row.expected_size_bytes,
+    expectedDigest: row.expected_digest,
+    providerUpload: row.provider_upload,
+    signedParts: row.signed_parts,
+    fileRef: row.file_ref,
+    createdAt: row.created_at,
+    expiresAt: row.expires_at,
+    completedAt: row.completed_at,
+    abortedAt: row.aborted_at
+  });
+}
+function jsonText(value) {
+  return value === undefined ? null : JSON.stringify(value);
+}
+
 // src/pg-pipeline-run-storage.ts
 import { parseSixbFailure as parseSixbFailure4, serializeSixbFailure as serializeSixbFailure3 } from "@sixb/core/internal/errors";
 import { assertPipelineRunExecution } from "@sixb/core/internal/pipeline-run-storage-provider";
@@ -17218,7 +17503,7 @@ class PgWorkflowInterventionStorage {
         SET
           status = ${"submitted"},
           submitted_at = ${input.submittedAt ?? new Date},
-          submitted_by = ${serializeActor(input.submittedBy)}::text::jsonb,
+          submitted_by = ${serializePrincipal(input.submittedBy)}::text::jsonb,
           response = ${serializeRecord(input.response)}::text::jsonb
         WHERE project_id = ${input.projectId} AND id = ${input.id}
         RETURNING *
@@ -17234,7 +17519,7 @@ class PgWorkflowInterventionStorage {
         SET
           status = ${"cancelled"},
           cancelled_at = ${input.cancelledAt ?? new Date},
-          cancelled_by = ${serializeActor(input.cancelledBy)}::text::jsonb
+          cancelled_by = ${serializePrincipal(input.cancelledBy)}::text::jsonb
         WHERE project_id = ${input.projectId} AND id = ${input.id}
         RETURNING *
       `;
@@ -17361,10 +17646,10 @@ function serializeRecord(value) {
 function parseRecord(value) {
   return typeof value === "string" ? JSON.parse(value) : value;
 }
-function serializeActor(actor) {
-  return actor ? JSON.stringify(actor) : null;
+function serializePrincipal(principal) {
+  return principal ? JSON.stringify(principal) : null;
 }
-function parseActor(value) {
+function parsePrincipal(value) {
   return typeof value === "string" ? JSON.parse(value) : value ?? undefined;
 }
 function rowToWorkflowInterventionRecord(row) {
@@ -17384,10 +17669,10 @@ function rowToWorkflowInterventionRecord(row) {
     requestedAt: new Date(row.requested_at),
     expiresAt: row.expires_at ? new Date(row.expires_at) : undefined,
     submittedAt: row.submitted_at ? new Date(row.submitted_at) : undefined,
-    submittedBy: parseActor(row.submitted_by),
+    submittedBy: parsePrincipal(row.submitted_by),
     response: row.response ? parseRecord(row.response) : undefined,
     cancelledAt: row.cancelled_at ? new Date(row.cancelled_at) : undefined,
-    cancelledBy: parseActor(row.cancelled_by),
+    cancelledBy: parsePrincipal(row.cancelled_by),
     expiredAt: row.expired_at ? new Date(row.expired_at) : undefined
   };
 }
@@ -18455,6 +18740,7 @@ class PostgresStorage {
   connectorConnections;
   shareGrants;
   shareSessions;
+  fileUploadSessions;
   migrators;
   sql;
   schemaName;
@@ -18508,6 +18794,7 @@ class PostgresStorage {
     this.connectorConnections = createOperationScopedFacade(stores.connectorConnections, scope);
     this.shareGrants = createOperationScopedFacade(stores.shareGrants, scope);
     this.shareSessions = createOperationScopedFacade(stores.shareSessions, scope);
+    this.fileUploadSessions = createOperationScopedFacade(stores.fileUploadSessions, scope);
     registerPostgresStorageTestingAdapter(this, (durationMs) => stores.connectorConnections.advanceTimeForTesting(durationMs));
   }
   async ping() {
@@ -18602,7 +18889,8 @@ function createPostgresStores(sql, options) {
     rules: new PgRulesStorage(sql),
     connectorConnections: new PgConnectorConnectionStorage(sql),
     shareGrants,
-    shareSessions
+    shareSessions,
+    fileUploadSessions: new PgFileUploadSessionStorage(sql)
   };
 }
 function resolveTimeoutMillis(value, label) {
@@ -18619,4 +18907,4 @@ export {
   migratePostgresStorage
 };
 
-//# debugId=C35F49117A3070E564756E2164756E21
+//# debugId=5427C0EF9727207C64756E2164756E21