@sixb/pg 0.1.21 → 0.1.22

package/src/auth-storage/users.ts

@@ -4,11 +4,12 @@ import type {
   ListAuthUsersInput,
   ListAuthUsersResult,
   UpdateAuthUserProfileInput,
+  UpdateAuthUserResult,
   UpdateAuthUserStatusInput,
   UserRecord,
 } from "@sixb/core/storage"
 import { AuthStorageError } from "@sixb/core/storage"
-import type { PgStoreClient } from "../transactions"
+import { type PgStoreClient, runPgTransaction } from "../transactions"
 import type { PgAuthUserRow } from "./rows"
 import { rowToUserRecord } from "./rows"
 import {
@@ -90,6 +91,23 @@ export class PgAuthUserStore implements AuthUserStore {
     return row ? rowToUserRecord(row) : null
   }
 
+  async getByIds(params: {
+    readonly projectId: string
+    readonly ids: readonly string[]
+  }): Promise<readonly UserRecord[]> {
+    const ids = [...new Set(params.ids)]
+    if (ids.length === 0) return []
+
+    const rows = await this.sql<PgAuthUserRow[]>`
+      SELECT *
+      FROM auth_users
+      WHERE project_id = ${params.projectId}
+        AND id IN ${this.sql(ids)}
+    `
+
+    return rows.map(rowToUserRecord)
+  }
+
   async getByEmail(params: {
     readonly projectId: string
     readonly email: string
@@ -98,57 +116,83 @@ export class PgAuthUserStore implements AuthUserStore {
     return row ? rowToUserRecord(row) : null
   }
 
-  async updateProfile(input: UpdateAuthUserProfileInput): Promise<UserRecord> {
-    const existing = await getUserRowById(this.sql, {
-      projectId: input.projectId,
-      id: input.id,
-    })
-
-    if (!existing) {
-      throw new AuthStorageError(
-        "missing_user",
-        `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`
+  async updateProfile(input: UpdateAuthUserProfileInput): Promise<UpdateAuthUserResult> {
+    // The row stays locked until the update, so the user it returns as previous is the one it
+    // changed, and an omitted field keeps whatever a concurrent update wrote to it.
+    return runPgTransaction(this.sql, async (tx) => {
+      const existing = await getUserRowById(
+        tx,
+        {
+          projectId: input.projectId,
+          id: input.id,
+        },
+        { forUpdate: true }
       )
-    }
 
-    const updatedAt = dateOrNow(input.updatedAt)
-    const [row] = await this.sql<PgAuthUserRow[]>`
-      UPDATE auth_users
-      SET display_name = ${input.displayName ?? null},
-          avatar_url = ${input.avatarUrl ?? null},
-          updated_at = ${updatedAt}
-      WHERE project_id = ${input.projectId}
-        AND id = ${input.id}
-      RETURNING *
-    `
+      if (!existing) {
+        throw new AuthStorageError(
+          "missing_user",
+          `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`
+        )
+      }
 
-    return rowToUserRecord(row)
-  }
+      const previousUser = rowToUserRecord(existing)
+      if (!changesProfile(previousUser, input)) {
+        return { user: previousUser, previousUser }
+      }
+
+      const updatedAt = dateOrNow(input.updatedAt)
+      const [row] = await tx<PgAuthUserRow[]>`
+        UPDATE auth_users
+        SET display_name = CASE
+              WHEN ${input.displayName !== undefined}::boolean THEN ${input.displayName ?? null}::text
+              ELSE display_name
+            END,
+            avatar_url = CASE
+              WHEN ${input.avatarUrl !== undefined}::boolean THEN ${input.avatarUrl ?? null}::text
+              ELSE avatar_url
+            END,
+            updated_at = ${updatedAt}
+        WHERE project_id = ${input.projectId}
+          AND id = ${input.id}
+        RETURNING *
+      `
 
-  async updateStatus(input: UpdateAuthUserStatusInput): Promise<UserRecord> {
-    const existing = await getUserRowById(this.sql, {
-      projectId: input.projectId,
-      id: input.id,
+      return { user: rowToUserRecord(row), previousUser }
     })
+  }
 
-    if (!existing) {
-      throw new AuthStorageError(
-        "missing_user",
-        `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`
+  async updateStatus(input: UpdateAuthUserStatusInput): Promise<UpdateAuthUserResult> {
+    // Locked like a profile update, so two status changes cannot both report the same previous one.
+    return runPgTransaction(this.sql, async (tx) => {
+      const existing = await getUserRowById(
+        tx,
+        {
+          projectId: input.projectId,
+          id: input.id,
+        },
+        { forUpdate: true }
       )
-    }
 
-    const updatedAt = dateOrNow(input.updatedAt)
-    const [row] = await this.sql<PgAuthUserRow[]>`
-      UPDATE auth_users
-      SET status = ${input.status},
-          updated_at = ${updatedAt}
-      WHERE project_id = ${input.projectId}
-        AND id = ${input.id}
-      RETURNING *
-    `
+      if (!existing) {
+        throw new AuthStorageError(
+          "missing_user",
+          `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`
+        )
+      }
+
+      const updatedAt = dateOrNow(input.updatedAt)
+      const [row] = await tx<PgAuthUserRow[]>`
+        UPDATE auth_users
+        SET status = ${input.status},
+            updated_at = ${updatedAt}
+        WHERE project_id = ${input.projectId}
+          AND id = ${input.id}
+        RETURNING *
+      `
 
-    return rowToUserRecord(row)
+      return { user: rowToUserRecord(row), previousUser: rowToUserRecord(existing) }
+    })
   }
 
   async list(input: ListAuthUsersInput): Promise<ListAuthUsersResult> {
@@ -165,6 +209,15 @@ export class PgAuthUserStore implements AuthUserStore {
       params.push(...input.statuses)
     }
 
+    // `strpos` matches literally, so `%` and `_` need no escaping. Both sides fold through `lower()`.
+    if (input.search !== undefined) {
+      const index = nextIndex++
+      whereClauses.push(
+        `(strpos(lower(coalesce(display_name, '')), lower($${index})) > 0 OR strpos(lower(email), lower($${index})) > 0)`
+      )
+      params.push(input.search)
+    }
+
     const where = `WHERE ${whereClauses.join(" AND ")}`
     const order = input.order === "asc" ? "ASC" : "DESC"
     const [totalRow] = await this.sql.unsafe<{ readonly count: string | number }[]>(
@@ -194,3 +247,12 @@ export class PgAuthUserStore implements AuthUserStore {
     }
   }
 }
+
+// Omitted keeps the stored value, and `null` clears it.
+function changesProfile(user: UserRecord, input: UpdateAuthUserProfileInput): boolean {
+  const displayName =
+    input.displayName === undefined ? user.displayName : (input.displayName ?? undefined)
+  const avatarUrl = input.avatarUrl === undefined ? user.avatarUrl : (input.avatarUrl ?? undefined)
+
+  return displayName !== user.displayName || avatarUrl !== user.avatarUrl
+}

package/src/migrations/069-artifact-kinds.sql

@@ -0,0 +1,4 @@
+-- Artifacts take two more kinds: pages, and the canvases that lay pages out.
+ALTER TABLE artifacts DROP CONSTRAINT artifacts_kind_check;
+ALTER TABLE artifacts ADD CONSTRAINT artifacts_kind_check
+  CHECK (kind IN ('document', 'sheet', 'slides', 'page', 'canvas', 'file'));

package/src/migrations/070-artifact-state.sql

@@ -0,0 +1,16 @@
+-- What a page keeps for each of its readers with `sixb.state`: JSON text by key, for one artifact
+-- and one principal, across the artifact's versions. The value stays text, as written, so its
+-- size is the one the reader's limits count; `size_bytes` is its UTF-8 length. Deleting the
+-- artifact cascades here.
+CREATE TABLE artifact_state (
+  project_id TEXT NOT NULL,
+  artifact_id TEXT NOT NULL,
+  principal_type TEXT NOT NULL CHECK (principal_type IN ('user', 'serviceAccount', 'system')),
+  principal_id TEXT NOT NULL CHECK (length(principal_id) > 0),
+  key TEXT NOT NULL CHECK (length(key) > 0),
+  value TEXT NOT NULL,
+  size_bytes INTEGER NOT NULL CHECK (size_bytes >= 0),
+  updated_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (project_id, artifact_id, principal_type, principal_id, key),
+  FOREIGN KEY (project_id, artifact_id) REFERENCES artifacts (project_id, id) ON DELETE CASCADE
+);

package/src/migrations/071-agent-thread-participants.sql

@@ -0,0 +1,16 @@
+-- The users a thread's owner added to the conversation. Only users take part: only a signed-in
+-- user talks to the Agent. Listing the threads shared with someone reads the principal index.
+CREATE TABLE agent_thread_participants (
+  project_id TEXT NOT NULL,
+  thread_id TEXT NOT NULL,
+  principal_type TEXT NOT NULL CHECK (principal_type = 'user'),
+  principal_id TEXT NOT NULL CHECK (length(principal_id) > 0),
+  added_at TIMESTAMPTZ NOT NULL,
+  added_by_type TEXT NOT NULL CHECK (added_by_type IN ('user', 'serviceAccount', 'system')),
+  added_by_id TEXT NOT NULL CHECK (length(added_by_id) > 0),
+  PRIMARY KEY (project_id, thread_id, principal_type, principal_id),
+  FOREIGN KEY (project_id, thread_id) REFERENCES agent_threads (project_id, id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_agent_thread_participants_principal
+  ON agent_thread_participants (project_id, principal_type, principal_id, thread_id);

package/src/migrations/072-forked-context-checkpoints.sql

@@ -0,0 +1,23 @@
+-- A forked thread copies the checkpoint its history needs, and the copy keeps the run that wrote
+-- the summary. A run's checkpoint is therefore unique within a thread, not within the project.
+-- The project-wide constraint was unnamed: drop the one unique on exactly those two columns, and
+-- stop if it is not there rather than leave the old rule in place.
+DO $$
+DECLARE run_constraint TEXT;
+BEGIN
+  SELECT conname INTO run_constraint
+  FROM pg_constraint
+  WHERE conrelid = 'agent_context_checkpoints'::regclass
+    AND contype = 'u'
+    AND pg_get_constraintdef(oid) = 'UNIQUE (project_id, created_by_run_id)';
+
+  IF run_constraint IS NULL THEN
+    RAISE EXCEPTION 'agent_context_checkpoints has no UNIQUE (project_id, created_by_run_id) to drop';
+  END IF;
+
+  EXECUTE format('ALTER TABLE agent_context_checkpoints DROP CONSTRAINT %I', run_constraint);
+END $$;
+
+ALTER TABLE agent_context_checkpoints
+  ADD CONSTRAINT uq_agent_context_checkpoints_thread_run
+  UNIQUE (project_id, thread_id, created_by_run_id);

package/src/migrations/073-unique-values.sql

@@ -0,0 +1,25 @@
+-- The values of unique properties, one row per value an object holds. Every object write keeps
+-- them current, so a write that would give a value to a second object of the type is refused.
+-- Values are keyed by their SHA-256: a long string stays under the btree key limit, and a lookup
+-- still compares `value_key` itself.
+CREATE TABLE object_unique_values (
+  project_id TEXT NOT NULL,
+  object_type_id TEXT NOT NULL,
+  property_id TEXT NOT NULL,
+  value_hash BYTEA NOT NULL,
+  value_key TEXT NOT NULL,
+  primary_id TEXT NOT NULL,
+  PRIMARY KEY (project_id, object_type_id, property_id, value_hash)
+);
+
+-- The unique properties whose values were built from the objects already stored, and how their
+-- keys were computed. A claim made with other keys is refused until they are built again.
+CREATE TABLE object_unique_properties (
+  project_id TEXT NOT NULL,
+  object_type_id TEXT NOT NULL,
+  property_id TEXT NOT NULL,
+  key_kind TEXT NOT NULL,
+  key_version INTEGER NOT NULL,
+  prepared_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (project_id, object_type_id, property_id)
+);

package/src/migrations/074-generated-media-usage.sql

@@ -0,0 +1,21 @@
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN image_output_tokens BIGINT
+  CHECK (image_output_tokens IS NULL OR image_output_tokens >= 0),
+  ADD COLUMN audio_output_tokens BIGINT
+  CHECK (audio_output_tokens IS NULL OR audio_output_tokens >= 0),
+  ADD COLUMN output_images BIGINT
+  CHECK (output_images IS NULL OR output_images >= 0),
+  ADD COLUMN input_characters BIGINT
+  CHECK (input_characters IS NULL OR input_characters >= 0);
+
+ALTER TABLE ai_model_call_usage
+  DROP CONSTRAINT ai_model_call_usage_model_kind_check;
+
+ALTER TABLE ai_model_call_usage
+  ADD CONSTRAINT ai_model_call_usage_model_kind_check
+  CHECK (
+    model_kind IS NULL
+    OR model_kind IN (
+      'language', 'image', 'video', 'embedding', 'decision', 'transcription', 'speech', 'reranking'
+    )
+  );

package/src/migrations/075-model-call-files.sql

@@ -0,0 +1,11 @@
+-- The files a model call produced. The execution that made the call decides who may read them.
+CREATE TABLE ai_model_call_files (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  call_id TEXT NOT NULL CHECK (length(trim(call_id)) > 0),
+  execution_id TEXT NOT NULL CHECK (length(trim(execution_id)) > 0),
+  files JSONB NOT NULL CHECK (jsonb_typeof(files) = 'array' AND jsonb_array_length(files) > 0),
+  recorded_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (project_id, call_id),
+  FOREIGN KEY (project_id, execution_id)
+    REFERENCES executions(project_id, id)
+);

package/src/migrations/076-agent-memory.sql

@@ -0,0 +1,33 @@
+-- Agent memory: each repo, 'user:<userId>' or 'project', is a log of revisions. A save inserts one
+-- revision and the file versions it wrote, and never updates a row. A file's current contents are
+-- its highest-revision version; NULL contents mean that revision deleted it.
+CREATE TABLE agent_memory_revisions (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  repo_id TEXT NOT NULL CHECK (length(trim(repo_id)) > 0),
+  revision INTEGER NOT NULL CHECK (revision > 0),
+  message TEXT NOT NULL CHECK (length(trim(message)) > 0),
+  author_principal_type TEXT NOT NULL
+    CHECK (author_principal_type IN ('user', 'serviceAccount', 'system')),
+  author_principal_id TEXT NOT NULL CHECK (length(author_principal_id) > 0),
+  source TEXT,
+  created_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (project_id, repo_id, revision)
+);
+
+-- A save also removes versions older than 90 days that are not their path's latest, so a
+-- revision's rows here can be fewer than the files it wrote. Paths compare by code unit, as they
+-- do in SQLite.
+CREATE TABLE agent_memory_files (
+  project_id TEXT NOT NULL,
+  repo_id TEXT NOT NULL,
+  path TEXT COLLATE "C" NOT NULL CHECK (length(path) > 0),
+  revision INTEGER NOT NULL,
+  contents TEXT,
+  PRIMARY KEY (project_id, repo_id, path, revision),
+  FOREIGN KEY (project_id, repo_id, revision)
+    REFERENCES agent_memory_revisions (project_id, repo_id, revision) ON DELETE CASCADE
+);
+
+-- Deleting a repo cascades here, and Postgres does not index a foreign key by itself.
+CREATE INDEX idx_agent_memory_files_revision
+  ON agent_memory_files (project_id, repo_id, revision);

package/src/migrations/077-artifact-threads.sql

@@ -0,0 +1,21 @@
+-- The threads an artifact is shared in: everyone who reads one of them reads the artifact. An
+-- Agent turn publishing a version links its thread, for as long as a version from it remains; a
+-- forked thread links its copies, `copied`, for as long as they last. Existing versions published
+-- from a thread link it here.
+CREATE TABLE artifact_threads (
+  project_id TEXT NOT NULL,
+  artifact_id TEXT NOT NULL,
+  thread_id TEXT NOT NULL CHECK (length(thread_id) > 0),
+  shared_at TIMESTAMPTZ NOT NULL,
+  copied BOOLEAN NOT NULL DEFAULT FALSE,
+  PRIMARY KEY (project_id, artifact_id, thread_id),
+  FOREIGN KEY (project_id, artifact_id) REFERENCES artifacts (project_id, id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_artifact_threads_thread ON artifact_threads (project_id, thread_id, artifact_id);
+
+INSERT INTO artifact_threads (project_id, artifact_id, thread_id, shared_at)
+SELECT project_id, artifact_id, origin_thread_id, MIN(created_at)
+FROM artifact_versions
+WHERE origin_thread_id IS NOT NULL
+GROUP BY project_id, artifact_id, origin_thread_id;

package/src/migrations/078-agent-approvals.sql

@@ -0,0 +1,58 @@
+-- Calls of the Agent that wait for whoever asked for the turn. A call's run id is its key: a
+-- thread holds at most one pending, approved or denied approval per key, and a cancelled,
+-- superseded or expired one lets the same call ask again.
+CREATE TABLE agent_approvals (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  thread_id TEXT NOT NULL,
+  run_id TEXT NOT NULL CHECK (length(run_id) > 0),
+  caller_run_id TEXT NOT NULL CHECK (length(caller_run_id) > 0),
+  requested_by_type TEXT NOT NULL CHECK (requested_by_type IN ('user', 'serviceAccount', 'system')),
+  requested_by_id TEXT NOT NULL CHECK (length(requested_by_id) > 0),
+  mode TEXT NOT NULL CHECK (mode IN ('manual', 'accept-edits')),
+  call_key TEXT NOT NULL CHECK (length(call_key) > 0),
+  call JSONB NOT NULL,
+  status TEXT NOT NULL
+    CHECK (status IN ('pending', 'approved', 'denied', 'cancelled', 'superseded', 'expired')),
+  created_at TIMESTAMPTZ NOT NULL,
+  expires_at TIMESTAMPTZ NOT NULL,
+  decided_at TIMESTAMPTZ,
+  decided_by_type TEXT CHECK (decided_by_type IN ('user', 'serviceAccount', 'system')),
+  decided_by_id TEXT,
+  outcome JSONB,
+  reported_in_message_id TEXT,
+  PRIMARY KEY (project_id, id),
+  FOREIGN KEY (project_id, thread_id) REFERENCES agent_threads (project_id, id) ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX idx_agent_approvals_live_call
+  ON agent_approvals (project_id, thread_id, call_key)
+  WHERE status IN ('pending', 'approved', 'denied');
+
+CREATE INDEX idx_agent_approvals_thread ON agent_approvals (project_id, thread_id, created_at);
+CREATE INDEX idx_agent_approvals_run ON agent_approvals (project_id, run_id, status);
+CREATE INDEX idx_agent_approvals_caller_run ON agent_approvals (project_id, caller_run_id, status);
+CREATE INDEX idx_agent_approvals_requester
+  ON agent_approvals (project_id, requested_by_type, requested_by_id, status);
+
+-- What each user lets the Agent change without asking: a default, then their own choice in a
+-- thread. Absent rows fall back, in that order.
+CREATE TABLE agent_user_settings (
+  project_id TEXT NOT NULL,
+  principal_type TEXT NOT NULL CHECK (principal_type IN ('user', 'serviceAccount', 'system')),
+  principal_id TEXT NOT NULL CHECK (length(principal_id) > 0),
+  approval_mode TEXT NOT NULL CHECK (approval_mode IN ('manual', 'accept-edits', 'auto')),
+  updated_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (project_id, principal_type, principal_id)
+);
+
+CREATE TABLE agent_thread_user_settings (
+  project_id TEXT NOT NULL,
+  thread_id TEXT NOT NULL,
+  principal_type TEXT NOT NULL CHECK (principal_type IN ('user', 'serviceAccount', 'system')),
+  principal_id TEXT NOT NULL CHECK (length(principal_id) > 0),
+  approval_mode TEXT NOT NULL CHECK (approval_mode IN ('manual', 'accept-edits', 'auto')),
+  updated_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (project_id, thread_id, principal_type, principal_id),
+  FOREIGN KEY (project_id, thread_id) REFERENCES agent_threads (project_id, id) ON DELETE CASCADE
+);

package/src/migrations/079-agent-approval-resume.sql

@@ -0,0 +1,20 @@
+-- A paused Agent turn resumes once its requester decided on every call it held. What that needs:
+-- the mode "Always allow" raised the turn to, whether the turn may still resume on a call, and the
+-- claim a process takes before it runs an approved call left without its outcome.
+ALTER TABLE agent_approvals
+  ADD COLUMN raised_mode TEXT CHECK (raised_mode IN ('manual', 'accept-edits', 'auto')),
+  ADD COLUMN turn_stopped_at TIMESTAMPTZ,
+  ADD COLUMN execution_claimed_at TIMESTAMPTZ;
+
+-- The repair pass: calls past their time, approved calls without an outcome, and decided calls of
+-- turns that may still resume. Each index covers only the rows that are still work.
+CREATE INDEX idx_agent_approvals_due
+  ON agent_approvals (project_id, expires_at)
+  WHERE status = 'pending';
+CREATE INDEX idx_agent_approvals_unfinished
+  ON agent_approvals (project_id, created_at, id)
+  WHERE status = 'approved' AND outcome IS NULL;
+CREATE INDEX idx_agent_approvals_resumable
+  ON agent_approvals (project_id, created_at, id)
+  WHERE status IN ('approved', 'denied') AND reported_in_message_id IS NULL
+    AND turn_stopped_at IS NULL;

package/src/migrations/080-subagent-threads.sql

@@ -0,0 +1,145 @@
+-- A sub-agent works in a thread of its own: its task and its work are that thread's messages, and
+-- each of its runs has the thread and a trigger message, as a turn does. The thread's parent is the
+-- conversation, which every read of it goes through, and its spawning turn and key name it.
+ALTER TABLE agent_threads
+  ADD COLUMN kind TEXT NOT NULL DEFAULT 'conversation'
+    CHECK (kind IN ('conversation', 'subagent')),
+  ADD COLUMN parent_thread_id TEXT,
+  ADD COLUMN parent_run_id TEXT,
+  ADD COLUMN spawn_key TEXT,
+  ADD CONSTRAINT agent_threads_kind_fields CHECK (
+    (
+      kind = 'conversation'
+      AND parent_thread_id IS NULL
+      AND parent_run_id IS NULL
+      AND spawn_key IS NULL
+    )
+    OR
+    (
+      kind = 'subagent'
+      AND parent_thread_id IS NOT NULL
+      AND parent_run_id IS NOT NULL
+      AND spawn_key IS NOT NULL
+      AND sandbox_params IS NULL
+    )
+  ),
+  -- A conversation's sub-agent threads go with it.
+  ADD CONSTRAINT fk_agent_threads_parent
+    FOREIGN KEY (project_id, parent_thread_id)
+    REFERENCES agent_threads (project_id, id)
+    ON DELETE CASCADE,
+  ADD CONSTRAINT fk_agent_threads_parent_run
+    FOREIGN KEY (project_id, parent_run_id)
+    REFERENCES agent_runs (project_id, id)
+    ON DELETE RESTRICT,
+  ADD CONSTRAINT uq_agent_threads_spawn UNIQUE (project_id, parent_run_id, spawn_key);
+
+ALTER TABLE agent_runs DROP CONSTRAINT agent_runs_kind_fields;
+
+-- The children admitted before this have no thread. Each gets one named as a new child's is, with
+-- its task as the only message: what it answered stays in its parent's `wait_agent` output.
+CREATE TEMPORARY TABLE legacy_subagent_threads ON COMMIT DROP AS
+SELECT
+  child.project_id,
+  child.id AS run_id,
+  'agt_thr_child_' || regexp_replace(child.id, '^agt_run_child_', '') AS thread_id,
+  'agt_msg_child_' || regexp_replace(child.id, '^agt_run_child_', '') AS message_id
+FROM agent_runs AS child
+WHERE child.kind = 'subagent' AND child.thread_id IS NULL;
+
+INSERT INTO agent_threads (
+  project_id, id, kind, parent_thread_id, parent_run_id, spawn_key, owner_principal_type,
+  owner_principal_id, status, active_run_id, last_message_at, message_count, created_at,
+  updated_at
+)
+SELECT
+  child.project_id,
+  legacy.thread_id,
+  'subagent',
+  parent.thread_id,
+  child.parent_run_id,
+  child.spawn_key,
+  conversation.owner_principal_type,
+  conversation.owner_principal_id,
+  'active',
+  CASE WHEN child.status IN ('queued', 'running') THEN child.id END,
+  child.created_at,
+  1,
+  child.created_at,
+  COALESCE(child.completed_at, child.created_at)
+FROM legacy_subagent_threads AS legacy
+JOIN agent_runs AS child ON child.project_id = legacy.project_id AND child.id = legacy.run_id
+JOIN agent_runs AS parent
+  ON parent.project_id = child.project_id AND parent.id = child.parent_run_id
+JOIN agent_threads AS conversation
+  ON conversation.project_id = parent.project_id AND conversation.id = parent.thread_id;
+
+INSERT INTO agent_messages (
+  project_id, id, thread_id, run_id, role, seq, parts, content_version, created_at
+)
+SELECT
+  child.project_id,
+  legacy.message_id,
+  legacy.thread_id,
+  child.id,
+  'user',
+  1,
+  jsonb_build_array(jsonb_build_object('type', 'text', 'text', child.spec->>'task')),
+  2,
+  child.created_at
+FROM legacy_subagent_threads AS legacy
+JOIN agent_runs AS child ON child.project_id = legacy.project_id AND child.id = legacy.run_id;
+
+UPDATE agent_runs AS child
+SET thread_id = legacy.thread_id, trigger_message_id = legacy.message_id
+FROM legacy_subagent_threads AS legacy
+WHERE child.project_id = legacy.project_id AND child.id = legacy.run_id;
+
+DROP TABLE legacy_subagent_threads;
+
+ALTER TABLE agent_runs ADD CONSTRAINT agent_runs_kind_fields CHECK (
+  (
+    kind = 'conversation'
+    AND thread_id IS NOT NULL
+    AND trigger_message_id IS NOT NULL
+    AND parent_run_id IS NULL
+    AND spawn_key IS NULL
+    AND result IS NULL
+  )
+  OR
+  (
+    kind = 'subagent'
+    AND thread_id IS NOT NULL
+    AND trigger_message_id IS NOT NULL
+    AND parent_run_id IS NOT NULL
+    AND spawn_key IS NOT NULL
+    AND spec IS NOT NULL
+  )
+);
+
+-- Lists read conversations only, so a conversation's children never weigh on them.
+DROP INDEX idx_agent_threads_project_activity;
+DROP INDEX idx_agent_threads_project_status_activity;
+DROP INDEX idx_agent_threads_project_owner_activity;
+
+CREATE INDEX idx_agent_threads_project_activity
+  ON agent_threads (project_id, (COALESCE(last_message_at, created_at)) DESC, id DESC)
+  WHERE kind = 'conversation';
+CREATE INDEX idx_agent_threads_project_status_activity
+  ON agent_threads (project_id, status, (COALESCE(last_message_at, created_at)) DESC, id DESC)
+  WHERE kind = 'conversation';
+CREATE INDEX idx_agent_threads_project_owner_activity
+  ON agent_threads (
+    project_id,
+    owner_principal_type,
+    owner_principal_id,
+    (COALESCE(last_message_at, created_at)) DESC,
+    id DESC
+  )
+  WHERE kind = 'conversation';
+
+-- A conversation's children, in the order they were spawned. Only a child has a parent, so the
+-- index holds children only, and a read by `parent_thread_id` can use it.
+CREATE INDEX idx_agent_threads_children
+  ON agent_threads (project_id, parent_thread_id, created_at, id)
+  WHERE parent_thread_id IS NOT NULL;

package/src/migrations/081-subagent-questions.sql

@@ -0,0 +1,6 @@
+-- A child that pauses on its question waits for a later turn of its parent's conversation to
+-- answer it. Each turn reads which of the conversation's children wait so: few do, so a partial
+-- index keeps that read small however many children the conversation had.
+CREATE INDEX idx_agent_runs_paused_on_question
+  ON agent_runs (project_id, parent_run_id)
+  WHERE kind = 'subagent' AND finish_reason = 'awaiting_answer';

package/src/migrations.ts

@@ -439,6 +439,19 @@ export const postgresStorageMigrations = defineMigrations<PostgresMigrationConte
     pgSql("066-activity", activitySql),
     pgSql("067-activity-timeline", activityTimelineSql),
     pgSql("068-activity-interactions", activityInteractionsSql),
+    pgSql("069-artifact-kinds", artifactKindsSql),
+    pgSql("070-artifact-state", artifactStateSql),
+    pgSql("071-agent-thread-participants", agentThreadParticipantsSql),
+    pgSql("072-forked-context-checkpoints", forkedContextCheckpointsSql),
+    pgSql("073-unique-values", uniqueValuesSql),
+    pgSql("074-generated-media-usage", generatedMediaUsageSql),
+    pgSql("075-model-call-files", modelCallFilesSql),
+    pgSql("076-agent-memory", agentMemorySql),
+    pgSql("077-artifact-threads", artifactThreadsSql),
+    pgSql("078-agent-approvals", agentApprovalsSql),
+    pgSql("079-agent-approval-resume", agentApprovalResumeSql),
+    pgSql("080-subagent-threads", subagentThreadsSql),
+    pgSql("081-subagent-questions", subagentQuestionsSql),
   ],
 })
 
@@ -481,3 +494,24 @@ import activityTimelineSql from "./migrations/067-activity-timeline.sql" with {
 import activityInteractionsSql from "./migrations/068-activity-interactions.sql" with {
   type: "text",
 }
+import artifactKindsSql from "./migrations/069-artifact-kinds.sql" with { type: "text" }
+import artifactStateSql from "./migrations/070-artifact-state.sql" with { type: "text" }
+import agentThreadParticipantsSql from "./migrations/071-agent-thread-participants.sql" with {
+  type: "text",
+}
+import forkedContextCheckpointsSql from "./migrations/072-forked-context-checkpoints.sql" with {
+  type: "text",
+}
+import uniqueValuesSql from "./migrations/073-unique-values.sql" with { type: "text" }
+import generatedMediaUsageSql from "./migrations/074-generated-media-usage.sql" with {
+  type: "text",
+}
+import modelCallFilesSql from "./migrations/075-model-call-files.sql" with { type: "text" }
+import agentMemorySql from "./migrations/076-agent-memory.sql" with { type: "text" }
+import artifactThreadsSql from "./migrations/077-artifact-threads.sql" with { type: "text" }
+import agentApprovalsSql from "./migrations/078-agent-approvals.sql" with { type: "text" }
+import agentApprovalResumeSql from "./migrations/079-agent-approval-resume.sql" with {
+  type: "text",
+}
+import subagentThreadsSql from "./migrations/080-subagent-threads.sql" with { type: "text" }
+import subagentQuestionsSql from "./migrations/081-subagent-questions.sql" with { type: "text" }