@sixb/pg 0.1.19 → 0.1.21

package/dist/index.js

@@ -1142,6 +1142,23 @@ class PgAgentThreadStore {
     `;
     return row ? rowToThreadRecord(row) : null;
   }
+  async getByIds(params) {
+    const ids = [...new Set(params.ids)];
+    if (ids.length === 0) {
+      return [];
+    }
+    const rows = await this.sql`
+      SELECT *
+      FROM agent_threads
+      WHERE project_id = ${params.projectId}
+        AND id = ANY(${this.sql.array(ids)}::text[])
+    `;
+    const byId = new Map(rows.map((row) => [row.id, row]));
+    return ids.flatMap((id) => {
+      const row = byId.get(id);
+      return row ? [rowToThreadRecord(row)] : [];
+    });
+  }
   async list(input) {
     if (input.statuses !== undefined && input.statuses.length === 0) {
       return { threads: [], hasMore: false, total: 0 };
@@ -1244,7 +1261,6 @@ function rowToSessionRecord(row) {
     projectId: row.project_id,
     userId: row.user_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     tokenHash: row.token_hash,
     createdAt: toDate(row.created_at),
     expiresAt: toDate(row.expires_at),
@@ -1311,7 +1327,6 @@ function rowToMagicLinkRecord(row) {
     id: row.id,
     projectId: row.project_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     email: row.email,
     tokenHash: row.token_hash,
     returnTo: row.return_to ?? undefined,
@@ -1326,7 +1341,6 @@ function rowToOidcAuthorizationAttemptRecord(row) {
     id: row.id,
     projectId: row.project_id,
     strategyId: row.strategy_id,
-    audience: row.audience,
     stateHash: row.state_hash,
     nonceHash: row.nonce_hash,
     codeVerifier: row.code_verifier,
@@ -1622,7 +1636,6 @@ async function consumeOidcAttempt(sql, params) {
 }
 async function validateCompleteSessionInput(sql, projectId, session) {
   const sessionId = assertNonEmpty(session.id, "Session id");
-  assertNonEmpty(session.audience, "Session audience");
   assertNonEmpty(session.tokenHash, "Session token hash");
   await assertSessionIdAvailable(sql, projectId, sessionId);
 }
@@ -1636,7 +1649,6 @@ async function createSession(sql, input) {
   const projectId = assertNonEmpty(input.projectId, "Project id");
   const userId = assertNonEmpty(input.userId, "User id");
   const strategyId = assertNonEmpty(input.strategyId, "Strategy id");
-  const audience = assertNonEmpty(input.audience, "Session audience");
   const tokenHash = assertNonEmpty(input.tokenHash, "Session token hash");
   await requireUserById(sql, { projectId, id: userId });
   await assertSessionIdAvailable(sql, projectId, id);
@@ -1647,7 +1659,6 @@ async function createSession(sql, input) {
         id,
         user_id,
         strategy_id,
-        audience,
         token_hash,
         created_at,
         expires_at,
@@ -1662,7 +1673,6 @@ async function createSession(sql, input) {
         ${id},
         ${userId},
         ${strategyId},
-        ${audience},
         ${tokenHash},
         ${input.createdAt},
         ${input.expiresAt},
@@ -1681,50 +1691,26 @@ async function createSession(sql, input) {
   }
 }
 async function revokeActiveSessionsForUser(sql, params) {
-  const rows = params.audience === undefined ? await sql`
-      SELECT *
-      FROM auth_sessions
-      WHERE project_id = ${params.projectId}
-        AND user_id = ${params.userId}
-        AND revoked_at IS NULL
-        AND expires_at > ${params.revokedAt}
-        AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.revokedAt})
-      ORDER BY created_at ASC, id ASC
-      FOR UPDATE
-    ` : await sql`
+  const rows = await sql`
       SELECT *
       FROM auth_sessions
       WHERE project_id = ${params.projectId}
         AND user_id = ${params.userId}
-        AND audience = ${params.audience}
         AND revoked_at IS NULL
         AND expires_at > ${params.revokedAt}
         AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.revokedAt})
       ORDER BY created_at ASC, id ASC
       FOR UPDATE
     `;
-  if (params.audience === undefined) {
-    await sql`
-      UPDATE auth_sessions
-      SET revoked_at = ${params.revokedAt}
-      WHERE project_id = ${params.projectId}
-        AND user_id = ${params.userId}
-        AND revoked_at IS NULL
-        AND expires_at > ${params.revokedAt}
-        AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.revokedAt})
-    `;
-  } else {
-    await sql`
+  await sql`
       UPDATE auth_sessions
       SET revoked_at = ${params.revokedAt}
       WHERE project_id = ${params.projectId}
         AND user_id = ${params.userId}
-        AND audience = ${params.audience}
         AND revoked_at IS NULL
         AND expires_at > ${params.revokedAt}
         AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.revokedAt})
     `;
-  }
   return rows.map((row) => rowToSessionRecord({
     ...row,
     revoked_at: params.revokedAt
@@ -2384,7 +2370,6 @@ class PgAuthInvitationStore {
 }
 
 // src/auth-storage/magic-links.ts
-import { resolveAuthSessionAudience } from "@sixb/core";
 import { AuthStorageError as AuthStorageError5 } from "@sixb/core/storage";
 class PgAuthMagicLinkStore {
   sql;
@@ -2396,7 +2381,6 @@ class PgAuthMagicLinkStore {
       const id = assertNonEmpty(input.id, "Magic link id");
       const projectId = assertNonEmpty(input.projectId, "Project id");
       const strategyId = assertNonEmpty(input.strategyId, "Strategy id");
-      const audience = resolveAuthSessionAudience(input.audience);
       const email = normalizeEmail(input.email);
       const tokenHash = assertNonEmpty(input.tokenHash, "Magic link token hash");
       await lockAdvisoryKeys(tx, [authLockKey("magic-links", projectId, email)]);
@@ -2414,7 +2398,6 @@ class PgAuthMagicLinkStore {
             project_id,
             id,
             strategy_id,
-            audience,
             email,
             token_hash,
             return_to,
@@ -2424,7 +2407,6 @@ class PgAuthMagicLinkStore {
             ${projectId},
             ${id},
             ${strategyId},
-            ${audience},
             ${email},
             ${tokenHash},
             ${input.returnTo ?? null},
@@ -2472,7 +2454,6 @@ class PgAuthMagicLinkStore {
 }
 
 // src/auth-storage/oidc-attempts.ts
-import { resolveAuthSessionAudience as resolveAuthSessionAudience2 } from "@sixb/core";
 import { AuthStorageError as AuthStorageError6 } from "@sixb/core/storage";
 class PgAuthOidcAuthorizationAttemptStore {
   sql;
@@ -2483,7 +2464,6 @@ class PgAuthOidcAuthorizationAttemptStore {
     const id = assertNonEmpty(input.id, "OIDC authorization attempt id");
     const projectId = assertNonEmpty(input.projectId, "Project id");
     const strategyId = assertNonEmpty(input.strategyId, "Strategy id");
-    const audience = resolveAuthSessionAudience2(input.audience);
     const stateHash = assertNonEmpty(input.stateHash, "OIDC state hash");
     const nonceHash = assertNonEmpty(input.nonceHash, "OIDC nonce hash");
     const codeVerifier = assertNonEmpty(input.codeVerifier, "OIDC code verifier");
@@ -2496,7 +2476,6 @@ class PgAuthOidcAuthorizationAttemptStore {
           project_id,
           id,
           strategy_id,
-          audience,
           state_hash,
           nonce_hash,
           code_verifier,
@@ -2507,7 +2486,6 @@ class PgAuthOidcAuthorizationAttemptStore {
           ${projectId},
           ${id},
           ${strategyId},
-          ${audience},
           ${stateHash},
           ${nonceHash},
           ${codeVerifier},
@@ -2765,37 +2743,38 @@ class PgAuthSessionStore {
   async getById(params) {
     return getSessionById(this.sql, params);
   }
-  async getActiveByUserId(params) {
-    const [row] = await this.sql`
+  async listActiveByUserId(params) {
+    const rows = await this.sql`
       SELECT *
       FROM auth_sessions
       WHERE project_id = ${params.projectId}
         AND user_id = ${params.userId}
-        AND audience = ${params.audience}
         AND revoked_at IS NULL
         AND expires_at > ${params.now}
         AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.now})
-      ORDER BY created_at DESC, id DESC
-      LIMIT 1
+      ORDER BY COALESCE(last_seen_at, created_at) DESC, created_at DESC, id DESC
     `;
-    return row ? rowToSessionRecord(row) : null;
+    return rows.map(rowToSessionRecord);
   }
-  async listActiveByUserId(params) {
+  async listByUserId(params) {
     const rows = await this.sql`
       SELECT *
       FROM auth_sessions
       WHERE project_id = ${params.projectId}
         AND user_id = ${params.userId}
-        AND revoked_at IS NULL
-        AND expires_at > ${params.now}
-        AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.now})
-      ORDER BY COALESCE(last_seen_at, created_at) DESC, created_at DESC, id DESC
+        ${params.before ? this.sql`AND created_at <= ${params.before.createdAt}` : this.sql``}
+      ORDER BY created_at DESC, id DESC
+      LIMIT ${params.limit + 1}
+      OFFSET ${params.before?.skip ?? 0}
     `;
-    return rows.map(rowToSessionRecord);
+    return {
+      sessions: rows.slice(0, params.limit).map(rowToSessionRecord),
+      hasMore: rows.length > params.limit
+    };
   }
   async findValidByTokenHash(params) {
     const row = await getSessionRowById(this.sql, params);
-    if (!row || row.refresh_token_hash !== null || row.audience !== params.audience || row.token_hash !== params.tokenHash || !isLiveSessionRow(row, params.now)) {
+    if (!row || row.refresh_token_hash !== null || row.token_hash !== params.tokenHash || !isLiveSessionRow(row, params.now)) {
       return null;
     }
     return rowToSessionRecord(row);
@@ -2855,7 +2834,6 @@ class PgAuthSessionStore {
           last_seen_at = ${params.now}
       WHERE project_id = ${params.projectId}
         AND id = ${params.id}
-        AND audience = ${params.audience}
         AND token_hash = ${params.tokenHash}
         AND refresh_token_hash IS NULL
         AND revoked_at IS NULL
@@ -2883,11 +2861,7 @@ class PgAuthSessionStore {
   }
   async revokeActiveForUser(params) {
     return runPgTransaction(this.sql, async (tx) => {
-      const locks = [authLockKey("sessions", params.projectId, params.userId)];
-      if (params.audience) {
-        locks.push(authLockKey("sessions", params.projectId, params.userId, params.audience));
-      }
-      await lockAdvisoryKeys(tx, locks);
+      await lockAdvisoryKeys(tx, [authLockKey("sessions", params.projectId, params.userId)]);
       return revokeActiveSessionsForUser(tx, params);
     });
   }
@@ -3146,7 +3120,6 @@ class PgAuthStorage {
         };
       }
       await validateCompleteSessionInput(tx, projectId, input.session);
-      assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
       let newUserId;
       if (shouldCreateUser) {
         newUserId = assertNonEmpty(input.newUserId, "User id");
@@ -3251,7 +3224,6 @@ class PgAuthStorage {
         };
       }
       await validateCompleteSessionInput(tx, projectId, input.session);
-      assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
       let newUserId;
       if (shouldCreateUser) {
         newUserId = assertNonEmpty(input.newUserId, "User id");
@@ -3459,16 +3431,12 @@ class PgAuthStorage {
     return this.applyGroups(sql, { ...input, groupIds, source: "directory" });
   }
   async createSignInSession(sql, input) {
-    await lockAdvisoryKeys(sql, [
-      authLockKey("sessions", input.projectId, input.userId),
-      authLockKey("sessions", input.projectId, input.userId, input.session.audience)
-    ]);
+    await lockAdvisoryKeys(sql, [authLockKey("sessions", input.projectId, input.userId)]);
     return createSession(sql, {
       id: input.session.id,
       projectId: input.projectId,
       userId: input.userId,
       strategyId: input.strategyId,
-      audience: input.session.audience,
       tokenHash: input.session.tokenHash,
       createdAt: input.session.createdAt,
       expiresAt: input.session.expiresAt,
@@ -3514,12 +3482,6 @@ class PgAuthStorage {
     return rowToIdentityRecord(row);
   }
 }
-function assertSignInSessionAudience(projectId, sessionAudience, storedAudience) {
-  if (sessionAudience === storedAudience) {
-    return;
-  }
-  throw new AuthStorageError11("invalid_input", `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`);
-}
 function assertCompletableDeviceAuthorization(authorization, input) {
   if (authorization.deviceCodeHash !== input.deviceCodeHash) {
     throw new AuthStorageError11("invalid_device_authorization", "[Sixb] Invalid device authorization.");
@@ -8168,6 +8130,223 @@ CREATE INDEX idx_action_runs_project_status_started
   ON action_runs (project_id, status, started_at DESC);
 `;
 
+// src/migrations/062-drop-auth-audience.sql
+var _062_drop_auth_audience_default = `-- A project has one browser app, so sessions, magic links and sign-in attempts no longer name the
+-- one they belong to. Atlas's browser sessions end here: their cookie is no longer read. Native
+-- sessions carried Atlas's name only because the column needed a value, so they stay.
+UPDATE auth_sessions
+SET revoked_at = now()
+WHERE audience = 'atlas'
+  AND refresh_token_hash IS NULL
+  AND revoked_at IS NULL;
+
+-- Dropping the column drops the two indexes that name it.
+ALTER TABLE auth_sessions DROP COLUMN audience;
+CREATE INDEX idx_auth_sessions_user_active
+  ON auth_sessions (project_id, user_id, expires_at DESC, created_at DESC, id DESC)
+  WHERE revoked_at IS NULL;
+CREATE INDEX idx_auth_sessions_user_created
+  ON auth_sessions (project_id, user_id, created_at DESC, id DESC);
+
+ALTER TABLE auth_magic_links DROP COLUMN audience;
+ALTER TABLE auth_oidc_authorization_attempts DROP COLUMN audience;
+`;
+
+// src/migrations/063-artifacts.sql
+var _063_artifacts_default = `-- Artifacts: versioned documents, sheets, decks, and files. An artifact's kind never
+-- changes. Versions take \`next_version\`, which only grows, so a number is never reused after its
+-- version is deleted.
+CREATE TABLE artifacts (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  kind TEXT NOT NULL CHECK (kind IN ('document', 'sheet', 'slides', 'file')),
+  title TEXT NOT NULL CHECK (length(trim(title)) > 0),
+  owner_principal_type TEXT NOT NULL
+    CHECK (owner_principal_type IN ('user', 'serviceAccount', 'system')),
+  owner_principal_id TEXT NOT NULL CHECK (length(owner_principal_id) > 0),
+  latest_version INTEGER NOT NULL CHECK (latest_version > 0),
+  next_version INTEGER NOT NULL CHECK (next_version > latest_version),
+  created_at TIMESTAMPTZ NOT NULL,
+  updated_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (project_id, id)
+);
+
+CREATE INDEX idx_artifacts_project_updated ON artifacts (project_id, updated_at DESC, id);
+CREATE INDEX idx_artifacts_owner_updated
+  ON artifacts (project_id, owner_principal_type, owner_principal_id, updated_at DESC, id);
+
+-- \`refs\`, not \`references\`: that word is reserved in SQL.
+CREATE TABLE artifact_versions (
+  project_id TEXT NOT NULL,
+  artifact_id TEXT NOT NULL,
+  version INTEGER NOT NULL CHECK (version > 0),
+  title TEXT NOT NULL CHECK (length(trim(title)) > 0),
+  entry TEXT NOT NULL CHECK (length(entry) > 0),
+  files JSONB NOT NULL CHECK (jsonb_typeof(files) = 'array'),
+  outline JSONB NOT NULL CHECK (jsonb_typeof(outline) = 'object'),
+  refs JSONB NOT NULL CHECK (jsonb_typeof(refs) = 'array'),
+  author_principal_type TEXT NOT NULL
+    CHECK (author_principal_type IN ('user', 'serviceAccount', 'system')),
+  author_principal_id TEXT NOT NULL CHECK (length(author_principal_id) > 0),
+  origin_thread_id TEXT,
+  origin_run_id TEXT,
+  created_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (project_id, artifact_id, version),
+  FOREIGN KEY (project_id, artifact_id) REFERENCES artifacts (project_id, id) ON DELETE CASCADE,
+  CHECK ((origin_thread_id IS NULL) = (origin_run_id IS NULL))
+);
+
+CREATE INDEX idx_artifact_versions_origin_run
+  ON artifact_versions (project_id, origin_run_id) WHERE origin_run_id IS NOT NULL;
+CREATE INDEX idx_artifact_versions_origin_thread
+  ON artifact_versions (project_id, origin_thread_id, artifact_id) WHERE origin_thread_id IS NOT NULL;
+
+-- Short-lived links that a sandboxed frame loads a deck's files through. Only the SHA-256 of each
+-- link's token is stored. \`targets\` is what the frame may show from other artifacts, decided for
+-- its reader when the link was issued: a JSON array of { address, artifactId, version }.
+CREATE TABLE artifact_frame_grants (
+  project_id TEXT NOT NULL,
+  token_hash TEXT NOT NULL CHECK (token_hash ~ '^[0-9a-f]{64}$'),
+  artifact_id TEXT NOT NULL,
+  version INTEGER NOT NULL CHECK (version > 0),
+  targets JSONB NOT NULL CHECK (jsonb_typeof(targets) = 'array'),
+  created_at TIMESTAMPTZ NOT NULL,
+  expires_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (project_id, token_hash),
+  FOREIGN KEY (project_id, artifact_id) REFERENCES artifacts (project_id, id) ON DELETE CASCADE,
+  CHECK (expires_at > created_at)
+);
+
+CREATE INDEX idx_artifact_frame_grants_expiry ON artifact_frame_grants (project_id, expires_at);
+-- Deleting an artifact cascades here, and Postgres does not index a foreign key by itself.
+CREATE INDEX idx_artifact_frame_grants_artifact ON artifact_frame_grants (project_id, artifact_id);
+`;
+
+// src/migrations/064-drop-output-diagnostics.sql
+var _064_drop_output_diagnostics_default = `-- The Agent delivers files by publishing artifacts, so a run no longer collects an output
+-- directory or reports on it. Stored \`output_*\` diagnostics go; a run left with none stores none.
+UPDATE agent_runs
+SET diagnostics = (
+  SELECT jsonb_agg(item.value ORDER BY item.position)
+  FROM jsonb_array_elements(agent_runs.diagnostics) WITH ORDINALITY AS item(value, position)
+  WHERE item.value->>'code' NOT LIKE 'output\\_%'
+)
+WHERE jsonb_typeof(diagnostics) = 'array'
+  AND EXISTS (
+    SELECT 1
+    FROM jsonb_array_elements(agent_runs.diagnostics) AS item(value)
+    WHERE item.value->>'code' LIKE 'output\\_%'
+  );
+`;
+
+// src/migrations/065-plan-work-payload-statistics.sql
+var _065_plan_work_payload_statistics_default = "-- A plan's work is analyzed whenever a stream has staged enough of it, and most of that ANALYZE\n-- went into the statistics of `payload`, which no query reads: the plan queries filter on the\n-- typed columns and only extract values from `payload`, and an extracted value has no statistics.\n-- A query that filters `payload` itself (`@>`, `?`) would need them back.\nALTER TABLE ontology_replacement_plan_work ALTER COLUMN payload SET STATISTICS 0;\n";
+
+// src/migrations/066-activity.sql
+var _066_activity_default = `-- App activity: one source per verified session, the visits it opened, and their page views.
+-- Foreground activity moves a visit's \`last_seen_at\` and stores no row, unless it opens a visit.
+-- A session id names an \`auth_sessions\` row for a user and a \`share_sessions\` row for a share; it
+-- is not a secret, and no foreign key holds it, so history outlives its sessions. Ids compare
+-- byte by byte, as the other providers sort them.
+CREATE TABLE activity_sources (
+  project_id TEXT NOT NULL,
+  actor_type TEXT NOT NULL CHECK (actor_type IN ('user', 'share')),
+  session_id TEXT NOT NULL CHECK (length(session_id) > 0),
+  visit_id TEXT NOT NULL,
+  last_seen_at TIMESTAMPTZ NOT NULL,
+  sequence INTEGER NOT NULL CHECK (sequence >= 0),
+  window_start TIMESTAMPTZ NOT NULL,
+  window_count INTEGER NOT NULL CHECK (window_count >= 0),
+  PRIMARY KEY (project_id, actor_type, session_id)
+);
+
+CREATE TABLE activity_visits (
+  project_id TEXT NOT NULL,
+  id TEXT COLLATE "C" NOT NULL,
+  actor_type TEXT NOT NULL CHECK (actor_type IN ('user', 'share')),
+  user_id TEXT COLLATE "C",
+  grant_id TEXT,
+  session_id TEXT NOT NULL CHECK (length(session_id) > 0),
+  started_at TIMESTAMPTZ NOT NULL,
+  last_seen_at TIMESTAMPTZ NOT NULL CHECK (last_seen_at >= started_at),
+  page_views INTEGER NOT NULL CHECK (page_views >= 0),
+  attribution JSONB CHECK (attribution IS NULL OR jsonb_typeof(attribution) = 'object'),
+  PRIMARY KEY (project_id, id),
+  CHECK (
+    (actor_type = 'user' AND user_id IS NOT NULL AND grant_id IS NULL)
+    OR (actor_type = 'share' AND user_id IS NULL AND grant_id IS NOT NULL)
+  )
+);
+
+-- A period reads the visits it overlaps. A visit lasts less than a day, so they started in
+-- \`[from - 1 day, to)\`: both period indexes bound \`started_at\` on both sides. \`last_seen_at\` is
+-- left out of every index, so the update each batch makes touches none of them. The user index
+-- also serves deleting one user's history.
+CREATE INDEX idx_activity_visits_started
+  ON activity_visits (project_id, started_at, id);
+CREATE INDEX idx_activity_visits_user
+  ON activity_visits (project_id, user_id, started_at, id);
+-- A session's visits, to join them with the session and the executions it authorized.
+CREATE INDEX idx_activity_visits_session
+  ON activity_visits (project_id, actor_type, session_id);
+
+CREATE TABLE activity_page_views (
+  project_id TEXT NOT NULL,
+  visit_id TEXT COLLATE "C" NOT NULL,
+  sequence INTEGER NOT NULL CHECK (sequence > 0),
+  id TEXT NOT NULL,
+  route TEXT NOT NULL,
+  received_at TIMESTAMPTZ NOT NULL,
+  attribution JSONB CHECK (attribution IS NULL OR jsonb_typeof(attribution) = 'object'),
+  PRIMARY KEY (project_id, visit_id, sequence),
+  FOREIGN KEY (project_id, visit_id) REFERENCES activity_visits (project_id, id) ON DELETE CASCADE
+);
+
+-- Finds a retried page view by the id its browser chose.
+CREATE INDEX idx_activity_page_views_id ON activity_page_views (project_id, id);
+`;
+
+// src/migrations/067-activity-timeline.sql
+var _067_activity_timeline_default = `-- A visit's timeline reads what its session started: the roots it authorized in a window, then
+-- everything they caused. A signed-in session is the credential of its roots, a shared link's
+-- session their delegation; a child names its parent. Agent executions copy their parent's
+-- session: the root indexes hold only executions without a parent, so they never see those, and
+-- end with \`id\` so the root read's order needs no sort. A user's connection history reads
+-- \`idx_auth_sessions_user_created\`, which already exists.
+CREATE INDEX idx_executions_session_roots
+  ON executions (project_id, authority_session_id, created_at, id)
+  WHERE authority_session_id IS NOT NULL AND parent_execution_id IS NULL;
+CREATE INDEX idx_executions_delegation_roots
+  ON executions (project_id, authority_delegation_session_id, created_at, id)
+  WHERE authority_delegation_session_id IS NOT NULL AND parent_execution_id IS NULL;
+CREATE INDEX idx_executions_parent
+  ON executions (project_id, parent_execution_id)
+  WHERE parent_execution_id IS NOT NULL;
+`;
+
+// src/migrations/068-activity-interactions.sql
+var _068_activity_interactions_default = `-- Interactions an app marks, such as a button: their name and route, never a value. They share
+-- the visit's sequence with its page views, so a visit reads both in the order they happened, and
+-- cascade with the visit, which counts them as it counts its page views.
+ALTER TABLE activity_visits
+  ADD COLUMN interactions INTEGER NOT NULL DEFAULT 0 CHECK (interactions >= 0);
+
+CREATE TABLE activity_interactions (
+  project_id TEXT NOT NULL,
+  visit_id TEXT COLLATE "C" NOT NULL,
+  sequence INTEGER NOT NULL CHECK (sequence > 0),
+  id TEXT NOT NULL,
+  name TEXT NOT NULL CHECK (length(name) BETWEEN 1 AND 100),
+  route TEXT NOT NULL,
+  received_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (project_id, visit_id, sequence),
+  FOREIGN KEY (project_id, visit_id) REFERENCES activity_visits (project_id, id) ON DELETE CASCADE
+);
+
+-- Finds a retried interaction by the id its browser chose.
+CREATE INDEX idx_activity_interactions_id ON activity_interactions (project_id, id);
+`;
+
 // src/migrations.ts
 var POSTGRES_STORAGE_ADAPTER_ID = "SixbPostgresStorage";
 function pgSql(id, sqlText) {
@@ -8395,7 +8574,14 @@ var postgresStorageMigrations = defineMigrations({
     pgSql("058-reranking-model-kind", _058_reranking_model_kind_default),
     pgSql("059-file-download-grants", _059_file_download_grants_default),
     pgSql("060-drained-source-versions", _060_drained_source_versions_default),
-    pgSql("061-terminal-action-runs", _061_terminal_action_runs_default)
+    pgSql("061-terminal-action-runs", _061_terminal_action_runs_default),
+    pgSql("062-drop-auth-audience", _062_drop_auth_audience_default),
+    pgSql("063-artifacts", _063_artifacts_default),
+    pgSql("064-drop-output-diagnostics", _064_drop_output_diagnostics_default),
+    pgSql("065-plan-work-payload-statistics", _065_plan_work_payload_statistics_default),
+    pgSql("066-activity", _066_activity_default),
+    pgSql("067-activity-timeline", _067_activity_timeline_default),
+    pgSql("068-activity-interactions", _068_activity_interactions_default)
   ]
 });
 
@@ -12723,7 +12909,7 @@ import {
 var PG_PLAN_WORK_TABLE = "ontology_replacement_plan_work";
 var IDENTITIES = "ontology_replacement_plan_identities";
 var SORT_KEY = "encode(convert_to(identity_key, 'UTF8'), 'hex')";
-var ANALYZE_ROWS = 1e4;
+var ANALYZE_ROWS = 1000;
 function objectRevision(type, id) {
   return `jsonb_build_array(
     (SELECT jsonb_build_array(version, last_commit_id) FROM objects
@@ -12860,7 +13046,7 @@ class PgOntologyReplacementPlanStorage {
   }
   async* streamState(input) {
     assertPageRows(input.pageRows);
-    await runPgTransaction(this.sql, async (sql) => {
+    const versionId = await runPgTransaction(this.sql, async (sql) => {
       const { candidate } = await requirePlan(sql, input);
       if (input.entityKind === "object" && candidate.projection_kind !== "object") {
         throw new MaterializationConflictError4("source-materialization", "Link projection replacement cannot stream object state.");
@@ -12873,6 +13059,7 @@ class PgOntologyReplacementPlanStorage {
         if (expanded >= ANALYZE_ROWS && !isWithinPgTransaction(this.sql))
           await analyzePlans(sql);
       }
+      return candidate.version_id;
     });
     let after = "";
     let streamed = 0;
@@ -12902,8 +13089,8 @@ class PgOntologyReplacementPlanStorage {
         return state;
       }, { isolation: "repeatableRead" });
       if (!page) {
-        if (streamed >= ANALYZE_ROWS && !isWithinPgTransaction(this.sql)) {
-          await analyzePlans(this.sql);
+        if (streamed > 0 && !isWithinPgTransaction(this.sql)) {
+          await analyzeStagedWork(this.sql, versionId);
         }
         return;
       }
@@ -13431,6 +13618,16 @@ async function purgeTouches(sql, projectId, limit) {
 async function analyzePlans(sql) {
   await sql`ANALYZE ${sql(IDENTITIES)}, ${sql(PG_PLAN_WORK_TABLE)}`;
 }
+async function analyzeStagedWork(sql, versionId) {
+  const [staged] = await sql`
+    SELECT COUNT(*) AS rows FROM (
+      SELECT 1 FROM ${sql(PG_PLAN_WORK_TABLE)} WHERE work_id = ${versionId} LIMIT ${ANALYZE_ROWS}
+    ) AS work
+  `;
+  if (Number(staged?.rows ?? 0) < ANALYZE_ROWS)
+    return;
+  await analyzePlans(sql);
+}
 async function dropUnplannedWork(sql, versionId, kind) {
   await sql`
     DELETE FROM ${sql(PG_PLAN_WORK_TABLE)}
@@ -14698,6 +14895,7 @@ import { ONTOLOGY_OUTBOX_FAILURE_CODES as ONTOLOGY_OUTBOX_FAILURE_CODES2 } from
 
 // src/pg-execution-storage.ts
 import {
+  compareExecutionCreation,
   executionRecordFromStorageRow,
   executionRecordToStorageRow,
   prepareExecutionRecord
@@ -14791,6 +14989,37 @@ class PgExecutionStorage {
     `;
     return row ? pgExecutionRecord(row) : null;
   }
+  async listBySession(input) {
+    const session = input.session.type === "user" ? this.sql`authority_session_id = ${input.session.id}` : this.sql`authority_delegation_session_id = ${input.session.id}`;
+    const rows = await this.sql`
+      WITH RECURSIVE tree AS (
+        (
+          SELECT *, 0 AS depth
+          FROM executions
+          WHERE project_id = ${input.projectId}
+            AND ${session}
+            AND parent_execution_id IS NULL
+            AND created_at >= ${input.from}
+            AND created_at < ${input.to}
+          ORDER BY created_at, id
+          LIMIT ${input.limit + 1}
+        )
+        UNION ALL
+        SELECT child.*, tree.depth + 1
+        FROM tree
+        JOIN executions child
+          ON child.project_id = tree.project_id
+          AND child.parent_execution_id = tree.id
+      )
+      SELECT * FROM tree
+      LIMIT ${input.limit + 1}
+    `;
+    const records = rows.map((row) => ({ depth: row.depth, record: pgExecutionRecord(row) })).sort((left, right) => left.depth - right.depth || compareExecutionCreation(left.record, right.record)).slice(0, input.limit).map(({ record }) => record);
+    return {
+      executions: records.sort(compareExecutionCreation),
+      truncated: rows.length > input.limit
+    };
+  }
 }
 function pgExecutionRecord(row) {
   return executionRecordFromStorageRow(toStorageRow(row));
@@ -15263,6 +15492,26 @@ class PgOntologySourceStorage {
       return row ? sourceRecord(row) : null;
     });
   }
+  async listActive(input) {
+    return this.runRootOperation(async (sql) => {
+      assertNonblank(input.projectId, "Source project id");
+      const rows = await sql`
+        SELECT source_id, dataset_id, dataset_version_id, dataset_version_created_at,
+          projection_revision
+        FROM ontology_sources
+        WHERE project_id = ${input.projectId} AND status = 'active'
+      `;
+      return rows.map((row) => ({
+        source: { projectionId: row.source_id },
+        datasetVersion: {
+          datasetId: row.dataset_id,
+          versionId: row.dataset_version_id,
+          createdAt: toIsoString2(row.dataset_version_created_at)
+        },
+        projectionRevision: row.projection_revision
+      }));
+    });
+  }
   async adopt(input) {
     return this.runRootOperation(async (sql) => {
       assertProjectAndSource(input);
@@ -15934,6 +16183,23 @@ class PgActionRunStorage {
     `;
     return row ? rowToActionRunRecord(row) : null;
   }
+  async getByExecutionIds(params) {
+    const executionIds = [...new Set(params.executionIds)];
+    if (executionIds.length === 0) {
+      return [];
+    }
+    const rows = await this.sql`
+      SELECT *
+      FROM action_runs
+      WHERE project_id = ${params.projectId}
+        AND execution_id = ANY(${this.sql.array(executionIds)}::text[])
+    `;
+    const byExecution = new Map(rows.map((row) => [row.execution_id, row]));
+    return executionIds.flatMap((executionId) => {
+      const row = byExecution.get(executionId);
+      return row ? [rowToActionRunRecord(row)] : [];
+    });
+  }
   async list(input) {
     if (input.statuses && input.statuses.length === 0 || input.actionIds?.length === 0) {
       return {
@@ -16097,6 +16363,350 @@ function rowToActionSubject(row) {
   };
 }
 
+// src/pg-activity-storage.ts
+import {
+  ACTIVITY_MAX_VISIT_MS,
+  activityActor,
+  activityCalendarDays,
+  parseActivityAttribution,
+  planActivityAppend,
+  serializeActivityAttribution,
+  validateActivityAppend
+} from "@sixb/core/internal/storage";
+var NO_CURSOR = { at: new Date("9999-12-31T23:59:59.999Z"), id: "" };
+
+class PgActivityStorage {
+  sql;
+  constructor(sql) {
+    this.sql = sql;
+  }
+  async append(input) {
+    validateActivityAppend(input);
+    return runPgTransaction(this.sql, async (sql) => {
+      await lockAdvisoryKeys(sql, [
+        JSON.stringify(["activity", input.projectId, input.actor.type, input.sessionId])
+      ]);
+      const plan = planActivityAppend(input, await readSource(sql, input), await readStoredEvents(sql, input));
+      if (plan.status !== "append") {
+        return { status: plan.status === "duplicate" ? "accepted" : "throttled", accepted: 0 };
+      }
+      const { state } = plan;
+      const lastSeenAt = new Date(state.lastSeenAt);
+      if (plan.newVisit) {
+        const attribution = plan.newVisit.attribution === null ? null : serializeActivityAttribution(plan.newVisit.attribution);
+        await sql`
+          INSERT INTO activity_visits (
+            project_id, id, actor_type, user_id, grant_id, session_id,
+            started_at, last_seen_at, page_views, interactions, attribution
+          ) VALUES (
+            ${input.projectId}, ${state.visitId}, ${input.actor.type},
+            ${input.actor.type === "user" ? input.actor.userId : null},
+            ${input.actor.type === "share" ? input.actor.grantId : null},
+            ${input.sessionId}, ${lastSeenAt}, ${lastSeenAt}, ${plan.pageViews.length},
+            ${plan.interactions.length}, ${attribution}::text::jsonb
+          )
+        `;
+      } else {
+        await sql`
+          UPDATE activity_visits
+          SET
+            last_seen_at = ${lastSeenAt},
+            page_views = page_views + ${plan.pageViews.length},
+            interactions = interactions + ${plan.interactions.length}
+          WHERE project_id = ${input.projectId} AND id = ${state.visitId}
+        `;
+      }
+      for (const pageView of plan.pageViews) {
+        await sql`
+          INSERT INTO activity_page_views (
+            project_id, visit_id, sequence, id, route, received_at, attribution
+          ) VALUES (
+            ${input.projectId}, ${pageView.visitId}, ${pageView.sequence}, ${pageView.id},
+            ${pageView.route}, ${pageView.receivedAt},
+            ${serializeActivityAttribution(pageView.attribution)}::text::jsonb
+          )
+        `;
+      }
+      for (const interaction of plan.interactions) {
+        await sql`
+          INSERT INTO activity_interactions (
+            project_id, visit_id, sequence, id, name, route, received_at
+          ) VALUES (
+            ${input.projectId}, ${interaction.visitId}, ${interaction.sequence},
+            ${interaction.id}, ${interaction.name}, ${interaction.route}, ${interaction.receivedAt}
+          )
+        `;
+      }
+      await sql`
+        INSERT INTO activity_sources (
+          project_id, actor_type, session_id, visit_id, last_seen_at, sequence,
+          window_start, window_count
+        ) VALUES (
+          ${input.projectId}, ${input.actor.type}, ${input.sessionId}, ${state.visitId},
+          ${lastSeenAt}, ${state.sequence}, ${new Date(state.windowStart)}, ${state.windowCount}
+        )
+        ON CONFLICT (project_id, actor_type, session_id) DO UPDATE SET
+          visit_id = excluded.visit_id,
+          last_seen_at = excluded.last_seen_at,
+          sequence = excluded.sequence,
+          window_start = excluded.window_start,
+          window_count = excluded.window_count
+      `;
+      return { status: "accepted", accepted: plan.accepted };
+    });
+  }
+  async list(input) {
+    const before = input.before ?? NO_CURSOR;
+    const rows = await this.sql`
+      SELECT ${this.visitColumns()}
+      FROM activity_visits v
+      WHERE ${this.overlapping(input)}
+        AND (
+          v.last_seen_at < ${before.at}
+          OR (v.last_seen_at = ${before.at} AND v.id < ${before.id})
+        )
+      ORDER BY v.last_seen_at DESC, v.id DESC
+      LIMIT ${input.limit + 1}
+    `;
+    return {
+      visits: rows.slice(0, input.limit).map(visitFromRow),
+      hasMore: rows.length > input.limit
+    };
+  }
+  async users(input) {
+    const before = input.before ?? NO_CURSOR;
+    const rows = await this.sql`
+      SELECT
+        v.user_id,
+        MAX(v.last_seen_at) AS last_seen_at,
+        COUNT(DISTINCT v.id) AS visits,
+        COUNT(p.id) AS page_views
+      FROM activity_visits v
+      LEFT JOIN activity_page_views p
+        ON p.project_id = v.project_id
+        AND p.visit_id = v.id
+        AND p.received_at >= ${input.from}
+        AND p.received_at < ${input.to}
+      WHERE ${this.overlapping(input)} AND v.actor_type = 'user'
+      GROUP BY v.user_id
+      HAVING MAX(v.last_seen_at) < ${before.at}
+        OR (MAX(v.last_seen_at) = ${before.at} AND v.user_id < ${before.id})
+      ORDER BY last_seen_at DESC, v.user_id DESC
+      LIMIT ${input.limit + 1}
+    `;
+    return {
+      users: rows.slice(0, input.limit).map((row) => ({
+        userId: row.user_id,
+        lastSeenAt: new Date(row.last_seen_at),
+        visits: Number(row.visits),
+        pageViews: Number(row.page_views)
+      })),
+      hasMore: rows.length > input.limit
+    };
+  }
+  async summarize(input) {
+    const [row] = await this.sql`
+      SELECT
+        COUNT(DISTINCT v.user_id) AS users,
+        COUNT(DISTINCT v.id) AS visits,
+        COUNT(DISTINCT v.id) FILTER (WHERE v.actor_type = 'share') AS shared_visits,
+        COUNT(p.id) AS page_views
+      FROM activity_visits v
+      LEFT JOIN activity_page_views p
+        ON p.project_id = v.project_id
+        AND p.visit_id = v.id
+        AND p.received_at >= ${input.from}
+        AND p.received_at < ${input.to}
+      WHERE ${this.overlapping(input)}
+    `;
+    return {
+      users: Number(row?.users ?? 0),
+      visits: Number(row?.visits ?? 0),
+      sharedVisits: Number(row?.shared_visits ?? 0),
+      pageViews: Number(row?.page_views ?? 0)
+    };
+  }
+  async calendar(input) {
+    const visits = await this.sql`
+      SELECT v.started_at, v.last_seen_at
+      FROM activity_visits v
+      WHERE ${this.overlapping(input)}
+    `;
+    const days = await this.sql`
+      SELECT
+        to_char(p.received_at AT TIME ZONE 'UTC', 'YYYY-MM-DD') AS day,
+        COUNT(*) AS page_views
+      FROM activity_visits v
+      JOIN activity_page_views p ON p.project_id = v.project_id AND p.visit_id = v.id
+      WHERE ${this.overlapping(input)}
+        AND p.received_at >= ${input.from}
+        AND p.received_at < ${input.to}
+      GROUP BY day
+    `;
+    return activityCalendarDays(input, visits.map((visit) => ({
+      startedAt: new Date(visit.started_at),
+      lastSeenAt: new Date(visit.last_seen_at)
+    })), new Map(days.map((row) => [row.day, Number(row.page_views)])));
+  }
+  async read(input) {
+    const [visit] = await this.sql`
+      SELECT ${this.visitColumns()}, v.session_id
+      FROM activity_visits v
+      WHERE v.project_id = ${input.projectId} AND v.id = ${input.id}
+    `;
+    if (!visit) {
+      return null;
+    }
+    const rows = await this.sql`
+      SELECT id, visit_id, sequence, route, NULL::text AS name, received_at
+      FROM activity_page_views
+      WHERE project_id = ${input.projectId}
+        AND visit_id = ${input.id}
+      UNION ALL
+      SELECT id, visit_id, sequence, route, name, received_at
+      FROM activity_interactions
+      WHERE project_id = ${input.projectId}
+        AND visit_id = ${input.id}
+      ORDER BY sequence
+      LIMIT ${input.limit + 1}
+    `;
+    const pageViews = [];
+    const interactions = [];
+    for (const row of rows.slice(0, input.limit)) {
+      if (row.name === null) {
+        pageViews.push(pageViewFromRow(row));
+      } else {
+        interactions.push({ ...pageViewFromRow(row), name: row.name });
+      }
+    }
+    return {
+      visit: visitFromRow(visit),
+      sessionId: visit.session_id,
+      pageViews,
+      interactions,
+      hasMore: rows.length > input.limit
+    };
+  }
+  async sessionVisits(input) {
+    if (input.sessionIds.length === 0) {
+      return [];
+    }
+    const rows = await this.sql`
+      SELECT *
+      FROM (
+        SELECT
+          ${this.visitColumns()},
+          v.session_id,
+          ROW_NUMBER() OVER (
+            PARTITION BY v.session_id ORDER BY v.started_at DESC, v.id DESC
+          ) AS position,
+          COUNT(*) OVER (PARTITION BY v.session_id) AS total
+        FROM activity_visits v
+        WHERE v.project_id = ${input.projectId}
+          AND v.actor_type = 'user'
+          AND v.session_id = ANY(${this.sql.array([...input.sessionIds])}::text[])
+          AND v.user_id = ${input.userId}
+      ) ranked
+      WHERE position <= ${input.limit}
+      ORDER BY session_id, position
+    `;
+    const bySession = new Map;
+    for (const row of rows) {
+      const session = bySession.get(row.session_id) ?? { visits: Number(row.total), latest: [] };
+      session.latest.push(visitFromRow(row));
+      bySession.set(row.session_id, session);
+    }
+    return [...bySession].map(([sessionId, session]) => ({ sessionId, ...session }));
+  }
+  overlapping(input) {
+    const user = input.userId === undefined ? this.sql`` : this.sql`AND v.user_id = ${input.userId}`;
+    const earliestStart = new Date(input.from.getTime() - ACTIVITY_MAX_VISIT_MS);
+    return this.sql`
+      v.project_id = ${input.projectId}
+      AND v.started_at >= ${earliestStart}
+      AND v.started_at < ${input.to}
+      AND v.last_seen_at >= ${input.from}
+      ${user}
+    `;
+  }
+  visitColumns() {
+    return this.sql`
+      v.id, v.actor_type, v.user_id, v.grant_id, v.started_at, v.last_seen_at, v.page_views,
+      v.interactions, v.attribution::text AS attribution
+    `;
+  }
+}
+async function readSource(sql, input) {
+  const [row] = await sql`
+    SELECT
+      s.visit_id, v.started_at AS visit_started_at, s.last_seen_at, s.sequence,
+      s.window_start, s.window_count
+    FROM activity_sources s
+    LEFT JOIN activity_visits v ON v.project_id = s.project_id AND v.id = s.visit_id
+    WHERE s.project_id = ${input.projectId}
+      AND s.actor_type = ${input.actor.type}
+      AND s.session_id = ${input.sessionId}
+  `;
+  if (!row) {
+    return;
+  }
+  return {
+    visitId: row.visit_id,
+    visitStartedAt: row.visit_started_at === null ? null : new Date(row.visit_started_at).getTime(),
+    lastSeenAt: new Date(row.last_seen_at).getTime(),
+    sequence: Number(row.sequence),
+    windowStart: new Date(row.window_start).getTime(),
+    windowCount: Number(row.window_count)
+  };
+}
+async function readStoredEvents(sql, input) {
+  const ids = input.events.map((event) => event.id);
+  const rows = await sql`
+    SELECT p.id, p.route, NULL::text AS name, p.attribution::text AS attribution
+    FROM activity_page_views p
+    JOIN activity_visits v ON v.project_id = p.project_id AND v.id = p.visit_id
+    WHERE p.project_id = ${input.projectId}
+      AND p.id = ANY(${sql.array(ids)}::text[])
+      AND v.actor_type = ${input.actor.type}
+      AND v.session_id = ${input.sessionId}
+    UNION ALL
+    SELECT i.id, i.route, i.name, NULL::text AS attribution
+    FROM activity_interactions i
+    JOIN activity_visits v ON v.project_id = i.project_id AND v.id = i.visit_id
+    WHERE i.project_id = ${input.projectId}
+      AND i.id = ANY(${sql.array(ids)}::text[])
+      AND v.actor_type = ${input.actor.type}
+      AND v.session_id = ${input.sessionId}
+  `;
+  return rows.map((row) => {
+    if (row.name !== null) {
+      return { id: row.id, route: row.route, name: row.name };
+    }
+    const attribution = parseActivityAttribution(row.attribution);
+    return { id: row.id, route: row.route, ...attribution ? { attribution } : {} };
+  });
+}
+function visitFromRow(row) {
+  return {
+    id: row.id,
+    actor: activityActor(row.actor_type, row.user_id, row.grant_id),
+    attribution: parseActivityAttribution(row.attribution),
+    startedAt: new Date(row.started_at),
+    lastSeenAt: new Date(row.last_seen_at),
+    pageViews: Number(row.page_views),
+    interactions: Number(row.interactions)
+  };
+}
+function pageViewFromRow(row) {
+  return {
+    id: row.id,
+    visitId: row.visit_id,
+    sequence: Number(row.sequence),
+    route: row.route,
+    receivedAt: new Date(row.received_at)
+  };
+}
+
 // src/pg-ai-cost-storage.ts
 import {
   aiModelCallCostDetails,
@@ -17580,6 +18190,260 @@ function invalidState(reservation, operation) {
   return new AiLimitStorageError("invalid_reservation_state", `[SixbPg] Cannot ${operation} AI model-call reservation '${reservation.callId}' in state '${reservation.state}'.`);
 }
 
+// src/pg-artifact-storage.ts
+import {
+  artifactStorageErrors,
+  parseArtifactFrameGrantRow,
+  parseArtifactRow,
+  parseArtifactVersionRow
+} from "@sixb/core/internal/storage";
+var ARTIFACT_COLUMNS = `
+  project_id AS "projectId", id, kind, title,
+  owner_principal_type AS "ownerPrincipalType", owner_principal_id AS "ownerPrincipalId",
+  latest_version AS "latestVersion", created_at AS "createdAt", updated_at AS "updatedAt"
+`;
+var VERSION_COLUMNS = `
+  project_id AS "projectId", artifact_id AS "artifactId", version, title, entry, files, outline,
+  refs, author_principal_type AS "authorPrincipalType", author_principal_id AS "authorPrincipalId",
+  origin_thread_id AS "originThreadId", origin_run_id AS "originRunId", created_at AS "createdAt"
+`;
+var FRAME_GRANT_COLUMNS = `
+  project_id AS "projectId", token_hash AS "tokenHash", artifact_id AS "artifactId", version,
+  targets, created_at AS "createdAt", expires_at AS "expiresAt"
+`;
+
+class PgArtifactStorage {
+  sql;
+  constructor(sql) {
+    this.sql = sql;
+  }
+  async create(input) {
+    return runPgTransaction(this.sql, async (tx) => {
+      const [artifact] = await tx`
+        INSERT INTO artifacts (
+          project_id, id, kind, title, owner_principal_type, owner_principal_id,
+          latest_version, next_version, created_at, updated_at
+        ) VALUES (
+          ${input.projectId}, ${input.id}, ${input.kind}, ${input.version.title},
+          ${input.owner.type}, ${input.owner.id}, 1, 2,
+          ${input.version.createdAt}, ${input.version.createdAt}
+        )
+        ON CONFLICT (project_id, id) DO NOTHING
+        RETURNING ${tx.unsafe(ARTIFACT_COLUMNS)}
+      `;
+      if (!artifact)
+        throw artifactStorageErrors.exists(input.id);
+      return {
+        artifact: parseArtifactRow(artifact),
+        version: await insertVersion(tx, input.projectId, input.id, 1, input.version)
+      };
+    });
+  }
+  async publish(input) {
+    return runPgTransaction(this.sql, async (tx) => {
+      const [current] = await tx`
+        SELECT kind, next_version FROM artifacts
+        WHERE project_id = ${input.projectId} AND id = ${input.artifactId}
+        FOR UPDATE
+      `;
+      if (!current)
+        throw artifactStorageErrors.notFound(input.artifactId);
+      const kind = current.kind;
+      if (kind !== input.kind) {
+        throw artifactStorageErrors.kindMismatch(input.artifactId, kind, input.kind);
+      }
+      const version = await insertVersion(tx, input.projectId, input.artifactId, Number(current.next_version), input.version);
+      const [artifact] = await tx`
+        UPDATE artifacts
+        SET title = ${input.version.title}, latest_version = ${version.version},
+            next_version = ${version.version + 1}, updated_at = ${input.version.createdAt}
+        WHERE project_id = ${input.projectId} AND id = ${input.artifactId}
+        RETURNING ${tx.unsafe(ARTIFACT_COLUMNS)}
+      `;
+      return { artifact: parseArtifactRow(artifact), version };
+    });
+  }
+  async get(input) {
+    const [row] = await this.sql`
+      SELECT ${this.sql.unsafe(ARTIFACT_COLUMNS)} FROM artifacts
+      WHERE project_id = ${input.projectId} AND id = ${input.id}
+    `;
+    return row ? parseArtifactRow(row) : null;
+  }
+  async list(input) {
+    const where = ["a.project_id = $1"];
+    const params = [input.projectId];
+    if (input.owner) {
+      where.push(`a.owner_principal_type = $${params.length + 1}`);
+      params.push(input.owner.type);
+      where.push(`a.owner_principal_id = $${params.length + 1}`);
+      params.push(input.owner.id);
+    }
+    if (input.originThreadId !== undefined) {
+      where.push(`EXISTS (
+          SELECT 1 FROM artifact_versions v
+          WHERE v.project_id = a.project_id AND v.artifact_id = a.id
+            AND v.origin_thread_id = $${params.length + 1}
+        )`);
+      params.push(input.originThreadId);
+    }
+    if (input.kind !== undefined) {
+      where.push(`a.kind = $${params.length + 1}`);
+      params.push(input.kind);
+    }
+    const clause = where.join(" AND ");
+    const [counted] = await this.sql.unsafe(`SELECT COUNT(*)::int AS total FROM artifacts a WHERE ${clause}`, params);
+    const offset = input.offset ?? 0;
+    const rows = await this.sql.unsafe(`SELECT ${ARTIFACT_COLUMNS} FROM artifacts a WHERE ${clause}
+       ORDER BY a.updated_at DESC, a.id ASC
+       LIMIT $${params.length + 1} OFFSET $${params.length + 2}`, [...params, input.limit ?? null, offset]);
+    const total = counted?.total ?? 0;
+    return { artifacts: rows.map(parseArtifactRow), hasMore: offset + rows.length < total, total };
+  }
+  async getVersion(input) {
+    const [row] = await this.sql`
+      SELECT ${this.sql.unsafe(VERSION_COLUMNS)} FROM artifact_versions
+      WHERE project_id = ${input.projectId} AND artifact_id = ${input.artifactId}
+        AND version = ${input.version}
+    `;
+    return row ? parseArtifactVersionRow(row) : null;
+  }
+  async listVersions(input) {
+    const [counted] = await this.sql`
+      SELECT COUNT(*)::int AS total FROM artifact_versions
+      WHERE project_id = ${input.projectId} AND artifact_id = ${input.artifactId}
+    `;
+    const offset = input.offset ?? 0;
+    const rows = await this.sql`
+      SELECT ${this.sql.unsafe(VERSION_COLUMNS)} FROM artifact_versions
+      WHERE project_id = ${input.projectId} AND artifact_id = ${input.artifactId}
+      ORDER BY version DESC
+      LIMIT ${input.limit ?? null} OFFSET ${offset}
+    `;
+    const total = counted?.total ?? 0;
+    return {
+      versions: rows.map(parseArtifactVersionRow),
+      hasMore: offset + rows.length < total,
+      total
+    };
+  }
+  async listReferencingVersions(input) {
+    const prefix = `artifact:${input.artifactId}`;
+    const rows = await this.sql`
+      SELECT ${this.sql.unsafe(VERSION_COLUMNS)} FROM artifact_versions v
+      WHERE project_id = ${input.projectId} AND (artifact_id, version) IN (
+        SELECT id, latest_version FROM artifacts WHERE project_id = ${input.projectId}
+      ) AND EXISTS (
+        SELECT 1 FROM jsonb_array_elements(v.refs) r
+        WHERE left(r ->> 'address', ${prefix.length}::int) = ${prefix}
+          AND substr(r ->> 'address', ${prefix.length + 1}::int, 1) IN ('', '@', '/', '#')
+      )
+      ORDER BY artifact_id
+    `;
+    return rows.map(parseArtifactVersionRow);
+  }
+  async createFrameGrant(record) {
+    const rows = await this.sql`
+      INSERT INTO artifact_frame_grants
+        (project_id, token_hash, artifact_id, version, targets, created_at, expires_at)
+      SELECT ${record.projectId}, ${record.tokenHash}, ${record.artifactId}, ${record.version},
+             ${JSON.stringify(record.targets)}::text::jsonb, ${record.createdAt},
+             ${record.expiresAt}
+      WHERE EXISTS (
+        SELECT 1 FROM artifacts WHERE project_id = ${record.projectId} AND id = ${record.artifactId}
+      )
+      RETURNING token_hash
+    `;
+    if (rows.length === 0)
+      throw artifactStorageErrors.notFound(record.artifactId);
+  }
+  async findFrameGrant(input) {
+    const [row] = await this.sql`
+      SELECT ${this.sql.unsafe(FRAME_GRANT_COLUMNS)} FROM artifact_frame_grants
+      WHERE project_id = ${input.projectId} AND token_hash = ${input.tokenHash}
+    `;
+    return row ? parseArtifactFrameGrantRow(row) : null;
+  }
+  async deleteExpiredFrameGrants(input) {
+    const rows = await this.sql`
+      DELETE FROM artifact_frame_grants
+      WHERE (project_id, token_hash) IN (
+        SELECT project_id, token_hash FROM artifact_frame_grants
+        WHERE project_id = ${input.projectId} AND expires_at < ${input.expiredBefore}
+        ORDER BY expires_at LIMIT ${input.limit}
+      )
+      RETURNING token_hash
+    `;
+    return rows.length;
+  }
+  async delete(input) {
+    const rows = await this.sql`
+      DELETE FROM artifacts WHERE project_id = ${input.projectId} AND id = ${input.id}
+      RETURNING id
+    `;
+    return rows.length > 0;
+  }
+  async deleteVersionsByOrigin(input) {
+    return runPgTransaction(this.sql, async (tx) => {
+      const locked = await tx`
+        SELECT id FROM artifacts
+        WHERE project_id = ${input.projectId} AND id IN (
+          SELECT artifact_id FROM artifact_versions
+          WHERE project_id = ${input.projectId} AND origin_run_id = ${input.runId}
+        )
+        ORDER BY id
+        FOR UPDATE
+      `;
+      const affected = locked.map((row) => row.id);
+      if (affected.length === 0)
+        return 0;
+      const deleted = await tx`
+        DELETE FROM artifact_versions
+        WHERE project_id = ${input.projectId} AND origin_run_id = ${input.runId}
+          AND artifact_id IN ${tx(affected)}
+        RETURNING version
+      `;
+      await tx`
+        DELETE FROM artifacts a
+        WHERE a.project_id = ${input.projectId} AND a.id IN ${tx(affected)}
+          AND NOT EXISTS (
+            SELECT 1 FROM artifact_versions v
+            WHERE v.project_id = a.project_id AND v.artifact_id = a.id
+          )
+      `;
+      await tx`
+        UPDATE artifacts a
+        SET latest_version = latest.version, title = latest.title, updated_at = latest.created_at
+        FROM (
+          SELECT DISTINCT ON (artifact_id) artifact_id, version, title, created_at
+          FROM artifact_versions
+          WHERE project_id = ${input.projectId} AND artifact_id IN ${tx(affected)}
+          ORDER BY artifact_id, version DESC
+        ) latest
+        WHERE a.project_id = ${input.projectId} AND a.id = latest.artifact_id
+      `;
+      return deleted.length;
+    });
+  }
+}
+async function insertVersion(sql, projectId, artifactId, version, input) {
+  const [row] = await sql`
+    INSERT INTO artifact_versions (
+      project_id, artifact_id, version, title, entry, files, outline, refs,
+      author_principal_type, author_principal_id, origin_thread_id, origin_run_id, created_at
+    ) VALUES (
+      ${projectId}, ${artifactId}, ${version}, ${input.title}, ${input.entry},
+      ${JSON.stringify(input.files)}::text::jsonb,
+      ${JSON.stringify(input.outline)}::text::jsonb,
+      ${JSON.stringify(input.references)}::text::jsonb,
+      ${input.author.type}, ${input.author.id},
+      ${input.origin?.threadId ?? null}, ${input.origin?.runId ?? null}, ${input.createdAt}
+    )
+    RETURNING ${sql.unsafe(VERSION_COLUMNS)}
+  `;
+  return parseArtifactVersionRow(row);
+}
+
 // src/pg-client.ts
 import { isIP } from "net";
 import { connect as connectTls } from "tls";
@@ -20004,6 +20868,23 @@ class PgWorkflowRunStorage {
     `;
     return row ? rowToWorkflowRunRecord(row) : null;
   }
+  async getByExecutionIds(params) {
+    const executionIds = [...new Set(params.executionIds)];
+    if (executionIds.length === 0) {
+      return [];
+    }
+    const rows = await this.sql`
+      SELECT *
+      FROM workflow_runs
+      WHERE project_id = ${params.projectId}
+        AND execution_id = ANY(${this.sql.array(executionIds)}::text[])
+    `;
+    const byExecution = new Map(rows.map((row) => [row.execution_id, row]));
+    return executionIds.flatMap((executionId) => {
+      const row = byExecution.get(executionId);
+      return row ? [rowToWorkflowRunRecord(row)] : [];
+    });
+  }
   async list(input) {
     if (hasEmptyStatuses(input) || input.workflowIds?.length === 0) {
       return {
@@ -20607,6 +21488,23 @@ class PgShareGrantStorage {
     `;
     return row ? recordFromRow(row) : null;
   }
+  async getByIds(input) {
+    const ids = [...new Set(input.ids)];
+    if (ids.length === 0) {
+      return [];
+    }
+    const rows = await this.sql`
+      SELECT *
+      FROM share_grants
+      WHERE project_id = ${input.projectId}
+        AND id = ANY(${this.sql.array(ids)}::text[])
+    `;
+    const byId = new Map(rows.map((row) => [row.id, row]));
+    return ids.flatMap((id) => {
+      const row = byId.get(id);
+      return row ? [recordFromRow(row)] : [];
+    });
+  }
   async list(input) {
     const normalized = normalizeListShareGrantsInput(input);
     const where = ["project_id = $1"];
@@ -20826,6 +21724,7 @@ class PostgresStorage {
   auth;
   executions;
   agents;
+  artifacts;
   aiUsage;
   aiCosts;
   aiLimits;
@@ -20843,6 +21742,7 @@ class PostgresStorage {
   shareSessions;
   fileUploadSessions;
   fileDownloadGrants;
+  activity;
   migrators;
   sql;
   schemaName;
@@ -20884,6 +21784,7 @@ class PostgresStorage {
     this.auth = createAuthOperationScope(stores.auth, scope);
     this.executions = createOperationScopedFacade(stores.executions, scope);
     this.agents = createAgentOperationScope(stores.agents, scope);
+    this.artifacts = createOperationScopedFacade(stores.artifacts, scope);
     this.aiUsage = createOperationScopedFacade(stores.aiUsage, scope);
     this.aiCosts = createOperationScopedFacade(stores.aiCosts, scope);
     this.aiLimits = createOperationScopedFacade(stores.aiLimits, scope);
@@ -20901,6 +21802,7 @@ class PostgresStorage {
     this.shareSessions = createOperationScopedFacade(stores.shareSessions, scope);
     this.fileUploadSessions = createOperationScopedFacade(stores.fileUploadSessions, scope);
     this.fileDownloadGrants = createOperationScopedFacade(stores.fileDownloadGrants, scope);
+    this.activity = createOperationScopedFacade(stores.activity, scope);
     registerPostgresStorageTestingAdapter(this, (durationMs) => stores.connectorConnections.advanceTimeForTesting(durationMs));
   }
   async ping() {
@@ -20993,6 +21895,7 @@ function createPostgresStores(sql, options) {
     auth,
     executions,
     agents: new PgAgentStorage({ sql, executions }),
+    artifacts: new PgArtifactStorage(sql),
     aiUsage: new PgAiUsageStorage(sql),
     aiCosts: new PgAiCostStorage(sql),
     aiLimits: new PgAiLimitStorage(sql),
@@ -21009,7 +21912,8 @@ function createPostgresStores(sql, options) {
     shareGrants,
     shareSessions,
     fileUploadSessions: new PgFileUploadSessionStorage(sql),
-    fileDownloadGrants: new PgFileDownloadGrantStorage(sql)
+    fileDownloadGrants: new PgFileDownloadGrantStorage(sql),
+    activity: new PgActivityStorage(sql)
   };
 }
 function resolveTimeoutMillis(value, label) {
@@ -21026,4 +21930,4 @@ export {
   migratePostgresStorage
 };
 
-//# debugId=295D429EF5EE4F7864756E2164756E21
+//# debugId=E2B2D974990D4A3064756E2164756E21