@sixb/pg 0.1.6 → 0.1.7

package/src/auth-storage/auth-storage.ts

@@ -1,8 +1,11 @@
 import type {
   AuthStorage,
+  CompleteDeviceAuthorizationInput,
+  CompleteDeviceAuthorizationResult,
   CompleteMagicLinkSignInInput,
   CompleteOidcSignInInput,
   CompleteSignInResult,
+  DeviceAuthorizationRecord,
   GroupMembershipRecord,
   InvitationRecord,
   SessionRecord,
@@ -19,6 +22,10 @@ import {
   runPgTransaction,
 } from "../transactions"
 import { PgAuthAccessTokenStore } from "./access-tokens"
+import {
+  getPgDeviceAuthorizationById,
+  PgAuthDeviceAuthorizationStore,
+} from "./device-authorizations"
 import { PgAuthGroupMembershipStore } from "./group-memberships"
 import { PgAuthUserIdentityStore } from "./identities"
 import { PgAuthInvitationStore } from "./invitations"
@@ -77,6 +84,7 @@ export class PgAuthStorage implements AuthStorage {
   readonly groupMemberships: PgAuthGroupMembershipStore
   readonly magicLinks: PgAuthMagicLinkStore
   readonly oidcAuthorizationAttempts: PgAuthOidcAuthorizationAttemptStore
+  readonly deviceAuthorizations: PgAuthDeviceAuthorizationStore
 
   constructor(options: PgAuthStorageOptions) {
     this.sql = options.sql
@@ -90,6 +98,43 @@ export class PgAuthStorage implements AuthStorage {
     this.groupMemberships = new PgAuthGroupMembershipStore(this.sql)
     this.magicLinks = new PgAuthMagicLinkStore(this.sql)
     this.oidcAuthorizationAttempts = new PgAuthOidcAuthorizationAttemptStore(this.sql)
+    this.deviceAuthorizations = new PgAuthDeviceAuthorizationStore(this.sql)
+  }
+
+  async completeDeviceAuthorization(
+    input: CompleteDeviceAuthorizationInput
+  ): Promise<CompleteDeviceAuthorizationResult> {
+    return runPgTransaction(this.sql, async (tx) => {
+      const authorization = await getPgDeviceAuthorizationById(tx, input.projectId, input.id)
+      if (!authorization) {
+        throw new AuthStorageError(
+          "missing_device_authorization",
+          `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`
+        )
+      }
+      assertCompletableDeviceAuthorization(authorization, input)
+      const accessToken = await new PgAuthAccessTokenStore(tx).create(input.accessToken)
+      const [consumed] = await tx`
+        UPDATE auth_device_authorizations
+        SET status = 'consumed', consumed_at = ${input.completedAt}
+        WHERE project_id = ${input.projectId} AND id = ${input.id} AND status = 'approved'
+        RETURNING *
+      `
+      if (!consumed) {
+        throw new AuthStorageError(
+          "invalid_device_authorization",
+          "[Sixb] Device authorization was already consumed."
+        )
+      }
+      return {
+        authorization: {
+          ...authorization,
+          status: "consumed" as const,
+          consumedAt: new Date(input.completedAt),
+        },
+        accessToken,
+      }
+    })
   }
 
   async completeMagicLinkSignIn(
@@ -796,3 +841,42 @@ function assertSignInSessionAudience(
     `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`
   )
 }
+
+function assertCompletableDeviceAuthorization(
+  authorization: DeviceAuthorizationRecord,
+  input: CompleteDeviceAuthorizationInput
+): void {
+  if (authorization.deviceCodeHash !== input.deviceCodeHash) {
+    throw new AuthStorageError(
+      "invalid_device_authorization",
+      "[Sixb] Invalid device authorization."
+    )
+  }
+  if (authorization.status === "pending") {
+    throw new AuthStorageError(
+      "pending_device_authorization",
+      "[Sixb] Device authorization is pending."
+    )
+  }
+  if (authorization.status === "denied") {
+    throw new AuthStorageError(
+      "device_authorization_denied",
+      "[Sixb] Device authorization was denied."
+    )
+  }
+  if (
+    authorization.status !== "approved" ||
+    authorization.expiresAt <= input.completedAt ||
+    !authorization.approvedUserId ||
+    !authorization.approvedSessionId ||
+    input.accessToken.projectId !== input.projectId ||
+    input.accessToken.subjectType !== "user" ||
+    input.accessToken.subjectId !== authorization.approvedUserId ||
+    input.accessToken.createdBySessionId !== authorization.approvedSessionId
+  ) {
+    throw new AuthStorageError(
+      "invalid_device_authorization",
+      "[Sixb] Device authorization is invalid."
+    )
+  }
+}

package/src/auth-storage/device-authorizations.ts

@@ -0,0 +1,131 @@
+import type {
+  AuthDeviceAuthorizationStore,
+  CreateDeviceAuthorizationInput,
+  DeviceAuthorizationRecord,
+} from "@sixb/core/storage"
+import { AuthStorageError, MAX_PENDING_DEVICE_AUTHORIZATIONS } from "@sixb/core/storage"
+import {
+  authLockKey,
+  lockAdvisoryKeys,
+  type PgStoreClient,
+  runPgTransaction,
+} from "../transactions"
+import type { PgAuthDeviceAuthorizationRow } from "./rows"
+import { rowToDeviceAuthorizationRecord } from "./rows"
+import { assertNonEmpty, mapUniqueConstraintError } from "./shared"
+
+export class PgAuthDeviceAuthorizationStore implements AuthDeviceAuthorizationStore {
+  constructor(private readonly sql: PgStoreClient) {}
+
+  async create(input: CreateDeviceAuthorizationInput): Promise<DeviceAuthorizationRecord> {
+    return runPgTransaction(this.sql, async (tx) => {
+      await lockAdvisoryKeys(tx, [authLockKey("device-authorizations", input.projectId)])
+      await tx`
+        DELETE FROM auth_device_authorizations
+        WHERE project_id = ${input.projectId} AND expires_at <= ${input.createdAt}
+      `
+      const [pending] = await tx<{ readonly count: string | number }[]>`
+        SELECT COUNT(*)::bigint AS count FROM auth_device_authorizations
+        WHERE project_id = ${input.projectId} AND status = 'pending'
+      `
+      if (Number(pending?.count ?? 0) >= MAX_PENDING_DEVICE_AUTHORIZATIONS) {
+        throw new AuthStorageError(
+          "device_authorization_limit_exceeded",
+          `[Sixb] Project '${input.projectId}' has too many pending device authorizations.`
+        )
+      }
+      try {
+        const [row] = await tx<PgAuthDeviceAuthorizationRow[]>`
+        INSERT INTO auth_device_authorizations (
+          project_id, id, device_code_hash, user_code, client_name, token_name,
+          token_expires_at, status, created_at, expires_at
+        ) VALUES (
+          ${assertNonEmpty(input.projectId, "Project id")},
+          ${assertNonEmpty(input.id, "Device authorization id")},
+          ${assertNonEmpty(input.deviceCodeHash, "Device code hash")},
+          ${assertNonEmpty(input.userCode, "User code")},
+          ${assertNonEmpty(input.clientName, "Client name")},
+          ${assertNonEmpty(input.tokenName, "Token name")},
+          ${input.tokenExpiresAt}, 'pending', ${input.createdAt}, ${input.expiresAt}
+        ) RETURNING *
+      `
+        return rowToDeviceAuthorizationRecord(row)
+      } catch (error) {
+        mapUniqueConstraintError(
+          error,
+          "duplicate_device_authorization",
+          `[Sixb] Device authorization '${input.id}' already exists for project '${input.projectId}'.`
+        )
+      }
+    })
+  }
+
+  async getById(params: { readonly projectId: string; readonly id: string }) {
+    return getPgDeviceAuthorizationById(this.sql, params.projectId, params.id)
+  }
+
+  async getByUserCode(params: { readonly projectId: string; readonly userCode: string }) {
+    const [row] = await this.sql<PgAuthDeviceAuthorizationRow[]>`
+      SELECT * FROM auth_device_authorizations
+      WHERE project_id = ${params.projectId} AND user_code = ${params.userCode}
+    `
+    return row ? rowToDeviceAuthorizationRecord(row) : null
+  }
+
+  async approve(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly userId: string
+    readonly sessionId: string
+    readonly approvedAt: Date
+  }) {
+    const [row] = await this.sql<PgAuthDeviceAuthorizationRow[]>`
+      UPDATE auth_device_authorizations
+      SET status = 'approved', approved_user_id = ${params.userId},
+          approved_session_id = ${params.sessionId}, approved_at = ${params.approvedAt}
+      WHERE project_id = ${params.projectId} AND id = ${params.id}
+        AND status = 'pending' AND expires_at > ${params.approvedAt}
+        AND EXISTS (
+          SELECT 1 FROM auth_sessions
+          WHERE project_id = ${params.projectId} AND id = ${params.sessionId}
+            AND user_id = ${params.userId} AND revoked_at IS NULL
+            AND expires_at > ${params.approvedAt}
+            AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.approvedAt})
+        )
+      RETURNING *
+    `
+    if (!row) throw invalidTransition(params.id, params.projectId)
+    return rowToDeviceAuthorizationRecord(row)
+  }
+
+  async deny(params: { readonly projectId: string; readonly id: string; readonly deniedAt: Date }) {
+    const [row] = await this.sql<PgAuthDeviceAuthorizationRow[]>`
+      UPDATE auth_device_authorizations
+      SET status = 'denied', denied_at = ${params.deniedAt}
+      WHERE project_id = ${params.projectId} AND id = ${params.id}
+        AND status = 'pending' AND expires_at > ${params.deniedAt}
+      RETURNING *
+    `
+    if (!row) throw invalidTransition(params.id, params.projectId)
+    return rowToDeviceAuthorizationRecord(row)
+  }
+}
+
+export async function getPgDeviceAuthorizationById(
+  sql: PgStoreClient,
+  projectId: string,
+  id: string
+) {
+  const [row] = await sql<PgAuthDeviceAuthorizationRow[]>`
+    SELECT * FROM auth_device_authorizations
+    WHERE project_id = ${projectId} AND id = ${id}
+  `
+  return row ? rowToDeviceAuthorizationRecord(row) : null
+}
+
+function invalidTransition(id: string, projectId: string): AuthStorageError {
+  return new AuthStorageError(
+    "invalid_device_authorization",
+    `[Sixb] Device authorization '${id}' is no longer pending for project '${projectId}'.`
+  )
+}

package/src/auth-storage/rows.ts

@@ -1,6 +1,7 @@
 import type { Principal } from "@sixb/core"
 import type {
   AccessTokenRecord,
+  DeviceAuthorizationRecord,
   GroupMembershipRecord,
   GroupMembershipSource,
   InvitationRecord,
@@ -150,6 +151,24 @@ export interface PgAuthOidcAttemptRow {
   readonly consumed_at: PgDate | null
 }
 
+export interface PgAuthDeviceAuthorizationRow {
+  readonly project_id: string
+  readonly id: string
+  readonly device_code_hash: string
+  readonly user_code: string
+  readonly client_name: string
+  readonly token_name: string
+  readonly token_expires_at: PgDate
+  readonly status: DeviceAuthorizationRecord["status"]
+  readonly approved_user_id: string | null
+  readonly approved_session_id: string | null
+  readonly created_at: PgDate
+  readonly expires_at: PgDate
+  readonly approved_at: PgDate | null
+  readonly denied_at: PgDate | null
+  readonly consumed_at: PgDate | null
+}
+
 export function rowToUserRecord(row: PgAuthUserRow): UserRecord {
   return {
     id: row.id,
@@ -304,6 +323,28 @@ export function rowToOidcAuthorizationAttemptRecord(
   }
 }
 
+export function rowToDeviceAuthorizationRecord(
+  row: PgAuthDeviceAuthorizationRow
+): DeviceAuthorizationRecord {
+  return {
+    id: row.id,
+    projectId: row.project_id,
+    deviceCodeHash: row.device_code_hash,
+    userCode: row.user_code,
+    clientName: row.client_name,
+    tokenName: row.token_name,
+    tokenExpiresAt: toDate(row.token_expires_at),
+    status: row.status,
+    approvedUserId: row.approved_user_id ?? undefined,
+    approvedSessionId: row.approved_session_id ?? undefined,
+    createdAt: toDate(row.created_at),
+    expiresAt: toDate(row.expires_at),
+    approvedAt: row.approved_at ? toDate(row.approved_at) : undefined,
+    deniedAt: row.denied_at ? toDate(row.denied_at) : undefined,
+    consumedAt: row.consumed_at ? toDate(row.consumed_at) : undefined,
+  }
+}
+
 export function serializeOptionalRecord(
   value: Readonly<Record<string, unknown>> | undefined
 ): string | null {

package/src/auth-storage/shared.ts

@@ -761,6 +761,7 @@ export function mapUniqueConstraintError(
   error: unknown,
   code:
     | "duplicate_access_token"
+    | "duplicate_device_authorization"
     | "duplicate_identity"
     | "duplicate_invitation"
     | "duplicate_magic_link"

package/src/index.ts

@@ -20,6 +20,7 @@ import {
 } from "@sixb/core/internal/storage-operation-scope"
 import {
   type AiCostStorage,
+  type AiLimitStorage,
   type AiUsageStorage,
   createTransactionStorageProxy,
   type ObjectStorage,
@@ -33,6 +34,7 @@ import { createPostgresStorageMigrators, dropSchema } from "./migrations"
 import { PgOntologyStorage, type PgOntologyTransactionContext } from "./ontology-storage"
 import { PgActionRunStorage } from "./pg-action-run-storage"
 import { PgAiCostStorage } from "./pg-ai-cost-storage"
+import { PgAiLimitStorage } from "./pg-ai-limit-storage"
 import { PgAiUsageStorage } from "./pg-ai-usage-storage"
 import { createPgClient, type SQL, type SQLClient } from "./pg-client"
 import { PgExecutionStorage } from "./pg-execution-storage"
@@ -138,6 +140,7 @@ export class PostgresStorage implements MigrationCapableStorage {
   readonly agents: PgAgentStorage
   readonly aiUsage: AiUsageStorage
   readonly aiCosts: AiCostStorage
+  readonly aiLimits: AiLimitStorage
   readonly actionRuns: PgActionRunStorage
   readonly pipelineRuns: PgPipelineRunStorage
   readonly workflowRuns: PgWorkflowRunStorage
@@ -212,6 +215,7 @@ export class PostgresStorage implements MigrationCapableStorage {
     this.agents = createAgentOperationScope(stores.agents, scope)
     this.aiUsage = createOperationScopedFacade(stores.aiUsage, scope)
     this.aiCosts = createOperationScopedFacade(stores.aiCosts, scope)
+    this.aiLimits = createOperationScopedFacade(stores.aiLimits, scope)
     this.actionRuns = createOperationScopedFacade(stores.actionRuns, scope)
     this.pipelineRuns = createOperationScopedFacade(stores.pipelineRuns, scope)
     this.workflowRuns = createWorkflowRunOperationScope(stores.workflowRuns, scope)
@@ -258,6 +262,7 @@ export class PostgresStorage implements MigrationCapableStorage {
             transactionContext.materializations.assertCommittable()
             return result
           } finally {
+            await txStorage.aiLimits.settleOperations()
             transactionContext.active = false
             txStorage.ontology.deactivateSessions()
             transactionContext.materializations.deactivate()
@@ -305,7 +310,7 @@ export class PostgresStorage implements MigrationCapableStorage {
   private createTransactionStorage(
     client: PgStoreClient,
     transactionContext: PgOntologyTransactionContext
-  ): Storage & { readonly ontology: PgOntologyStorage } {
+  ): Storage & { readonly ontology: PgOntologyStorage; readonly aiLimits: PgAiLimitStorage } {
     return {
       ...createPostgresStores(client, {
         runOntologyOperation: async (run) => run(client),
@@ -342,6 +347,7 @@ function createPostgresStores(
     agents: new PgAgentStorage({ sql, executions }),
     aiUsage: new PgAiUsageStorage(sql),
     aiCosts: new PgAiCostStorage(sql),
+    aiLimits: new PgAiLimitStorage(sql),
     actionRuns: new PgActionRunStorage(sql, executions),
     pipelineRuns: new PgPipelineRunStorage(sql, executions),
     workflowRuns: new PgWorkflowRunStorage(sql, executions),
@@ -363,6 +369,7 @@ interface PostgresStoreSet {
   readonly agents: PgAgentStorage
   readonly aiUsage: PgAiUsageStorage
   readonly aiCosts: PgAiCostStorage
+  readonly aiLimits: PgAiLimitStorage
   readonly actionRuns: PgActionRunStorage
   readonly pipelineRuns: PgPipelineRunStorage
   readonly workflowRuns: PgWorkflowRunStorage

package/src/migrations/029-model-accounting.sql

@@ -0,0 +1,24 @@
+-- Call-time model configuration and provider identity. Historical identity remains unknown.
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN requested_reasoning JSONB
+  CHECK (
+    requested_reasoning IS NULL OR
+    jsonb_typeof(requested_reasoning) IN ('string', 'object')
+  );
+ALTER TABLE ai_model_call_usage ADD COLUMN provider_ids JSONB;
+
+-- Upgrade the shipped valuation reason while retaining the selected-cost projection.
+ALTER TABLE ai_model_call_valuations
+  DROP CONSTRAINT ai_model_call_valuations_reason_check;
+
+UPDATE ai_model_call_valuations SET reason = 'missingRateCard'
+  WHERE reason = 'missingCatalogEntry';
+
+ALTER TABLE ai_model_call_valuations ADD CONSTRAINT ai_model_call_valuations_reason_check
+  CHECK (reason IS NULL OR reason IN (
+    'missingBillingIdentity',
+    'missingRateCard',
+    'missingUsageMeter',
+    'unsupportedPricingDimension',
+    'invalidUsageForFormula'
+  ));

package/src/migrations/030-ai-usage-limits.sql

@@ -0,0 +1,94 @@
+CREATE TABLE ai_usage_limits (
+  project_id TEXT NOT NULL CHECK (length(btrim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(btrim(id)) > 0),
+  subject_type TEXT NOT NULL CHECK (
+    subject_type IN ('project', 'group', 'user', 'serviceAccount')
+  ),
+  subject_id TEXT NOT NULL CHECK (
+    (subject_type = 'project' AND subject_id = '')
+    OR (subject_type <> 'project' AND length(btrim(subject_id)) > 0)
+  ),
+  meter TEXT NOT NULL CHECK (meter IN ('tokens.total', 'cost.catalogEstimated')),
+  currency TEXT NOT NULL CHECK (
+    (meter = 'tokens.total' AND currency = '')
+    OR (meter = 'cost.catalogEstimated' AND currency = 'USD')
+  ),
+  limit_amount NUMERIC(78, 0) NOT NULL CHECK (limit_amount >= 0),
+  period_kind TEXT NOT NULL CHECK (period_kind = 'calendarMonth'),
+  enabled BOOLEAN NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL,
+  updated_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, subject_type, subject_id, meter, currency)
+);
+
+CREATE INDEX idx_ai_usage_limits_project_enabled
+  ON ai_usage_limits (project_id, enabled, subject_type, subject_id, meter, currency);
+
+CREATE TABLE ai_usage_limit_periods (
+  project_id TEXT NOT NULL CHECK (length(btrim(project_id)) > 0),
+  subject_type TEXT NOT NULL CHECK (
+    subject_type IN ('project', 'group', 'user', 'serviceAccount')
+  ),
+  subject_id TEXT NOT NULL CHECK (
+    (subject_type = 'project' AND subject_id = '')
+    OR (subject_type <> 'project' AND length(btrim(subject_id)) > 0)
+  ),
+  meter TEXT NOT NULL CHECK (meter IN ('tokens.total', 'cost.catalogEstimated')),
+  currency TEXT NOT NULL CHECK (
+    (meter = 'tokens.total' AND currency = '')
+    OR (meter = 'cost.catalogEstimated' AND currency = 'USD')
+  ),
+  period_start TIMESTAMPTZ NOT NULL,
+  period_end TIMESTAMPTZ NOT NULL,
+  actual_amount NUMERIC(78, 0) NOT NULL DEFAULT 0 CHECK (actual_amount >= 0),
+  reserved_amount NUMERIC(78, 0) NOT NULL DEFAULT 0 CHECK (reserved_amount >= 0),
+  unknown_amount NUMERIC(78, 0) NOT NULL DEFAULT 0 CHECK (unknown_amount >= 0),
+  accounting_status TEXT NOT NULL DEFAULT 'complete' CHECK (
+    accounting_status IN ('complete', 'unavailable')
+  ),
+  updated_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (
+    project_id, subject_type, subject_id, meter, currency, period_start
+  )
+);
+
+CREATE INDEX idx_ai_usage_limit_periods_subject_period
+  ON ai_usage_limit_periods (
+    project_id, subject_type, subject_id, period_start, period_end, meter, currency
+  );
+
+CREATE TABLE ai_model_call_reservations (
+  project_id TEXT NOT NULL CHECK (length(btrim(project_id)) > 0),
+  execution_id TEXT NOT NULL CHECK (length(btrim(execution_id)) > 0),
+  attempt BIGINT NOT NULL CHECK (attempt >= 1),
+  call_id TEXT NOT NULL CHECK (length(btrim(call_id)) > 0),
+  buckets JSONB NOT NULL CHECK (jsonb_typeof(buckets) = 'array'),
+  request_key TEXT NOT NULL,
+  period_start TIMESTAMPTZ NOT NULL,
+  period_end TIMESTAMPTZ NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('active', 'reconciled', 'unknown')),
+  usage_record_id TEXT,
+  reserved_at TIMESTAMPTZ NOT NULL,
+  updated_at TIMESTAMPTZ NOT NULL,
+  PRIMARY KEY (project_id, execution_id, attempt, call_id),
+  FOREIGN KEY (project_id, execution_id)
+    REFERENCES executions(project_id, id)
+    ON DELETE RESTRICT,
+  FOREIGN KEY (project_id, usage_record_id)
+    REFERENCES ai_model_call_usage(project_id, id)
+    ON DELETE RESTRICT,
+  CHECK (
+    (
+      state = 'reconciled'
+      AND usage_record_id IS NOT NULL
+    )
+    OR (
+      state <> 'reconciled'
+      AND usage_record_id IS NULL
+    )
+  )
+);
+
+CREATE INDEX idx_ai_model_call_reservations_active
+  ON ai_model_call_reservations (project_id, state, period_end, execution_id, attempt, call_id);

package/src/migrations/031-subagent-runs.sql

@@ -0,0 +1,97 @@
+-- Agent executions may either use a managed service account or inherit their parent's exact
+-- credentialed-user / auth-disabled authority.
+ALTER TABLE executions
+  DROP CONSTRAINT executions_check3,
+  ADD CONSTRAINT executions_agent_authority_check CHECK (
+    (
+      executor_kind = 'request'
+      AND source_kind = 'http'
+      AND executor_id = source_id
+      AND (
+        (
+          authority_kind = 'principal'
+          AND requested_by_user_id IS NOT DISTINCT FROM authority_user_id
+          AND requested_by_service_account_id IS NOT DISTINCT FROM authority_service_account_id
+        )
+        OR (
+          authority_kind = 'disabled'
+          AND requested_by_user_id IS NULL
+          AND requested_by_service_account_id IS NULL
+        )
+      )
+    )
+    OR (
+      executor_kind IN ('action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow')
+      AND authority_kind = 'trustedPrimitive'
+      AND executor_kind = authority_primitive_kind
+    )
+    OR (
+      executor_kind = 'agent'
+      AND source_kind = 'execution'
+      AND (
+        (
+          authority_kind = 'principal'
+          AND authority_service_account_id IS NOT NULL
+          AND authority_session_id IS NULL
+          AND authority_access_token_id IS NULL
+        )
+        OR (
+          authority_kind = 'principal'
+          AND authority_user_id IS NOT NULL
+          AND num_nonnulls(authority_session_id, authority_access_token_id) = 1
+        )
+        OR authority_kind = 'disabled'
+      )
+    )
+    OR (executor_kind = 'kernel' AND authority_kind = 'kernel')
+  );
+
+ALTER TABLE agent_runs
+  ADD COLUMN kind TEXT NOT NULL DEFAULT 'conversation'
+    CHECK (kind IN ('conversation', 'subagent')),
+  ADD COLUMN parent_run_id TEXT,
+  ADD COLUMN spawn_key TEXT,
+  ADD COLUMN spec JSONB,
+  ADD COLUMN result JSONB,
+  ALTER COLUMN thread_id DROP NOT NULL,
+  ALTER COLUMN agent_id DROP NOT NULL,
+  ALTER COLUMN trigger_message_id DROP NOT NULL,
+  ADD CONSTRAINT fk_agent_runs_parent
+    FOREIGN KEY (project_id, parent_run_id)
+    REFERENCES agent_runs (project_id, id)
+    ON DELETE RESTRICT,
+  ADD CONSTRAINT agent_runs_kind_fields CHECK (
+    (
+      kind = 'conversation'
+      AND thread_id IS NOT NULL
+      AND agent_id IS NOT NULL
+      AND trigger_message_id IS NOT NULL
+      AND parent_run_id IS NULL
+      AND spawn_key IS NULL
+      AND spec IS NULL
+      AND result IS NULL
+    )
+    OR
+    (
+      kind = 'subagent'
+      AND thread_id IS NULL
+      AND agent_id IS NULL
+      AND trigger_message_id IS NULL
+      AND parent_run_id IS NOT NULL
+      AND spawn_key IS NOT NULL
+      AND spec IS NOT NULL
+    )
+  ),
+  ADD CONSTRAINT agent_runs_subagent_result CHECK (
+    kind <> 'subagent' OR status <> 'succeeded' OR result IS NOT NULL
+  ),
+  ADD CONSTRAINT uq_agent_runs_parent_spawn_key UNIQUE (project_id, parent_run_id, spawn_key);
+
+CREATE INDEX idx_agent_runs_project_parent_started
+  ON agent_runs (
+    project_id,
+    parent_run_id,
+    status,
+    COALESCE(started_at, created_at) DESC,
+    id DESC
+  );

package/src/migrations/032-conversation-run-spec.sql

@@ -0,0 +1,23 @@
+ALTER TABLE agent_runs
+  DROP CONSTRAINT agent_runs_kind_fields,
+  ADD CONSTRAINT agent_runs_kind_fields CHECK (
+    (
+      kind = 'conversation'
+      AND thread_id IS NOT NULL
+      AND agent_id IS NOT NULL
+      AND trigger_message_id IS NOT NULL
+      AND parent_run_id IS NULL
+      AND spawn_key IS NULL
+      AND result IS NULL
+    )
+    OR
+    (
+      kind = 'subagent'
+      AND thread_id IS NULL
+      AND agent_id IS NULL
+      AND trigger_message_id IS NULL
+      AND parent_run_id IS NOT NULL
+      AND spawn_key IS NOT NULL
+      AND spec IS NOT NULL
+    )
+  );

package/src/migrations/033-retire-agent-definitions.sql

@@ -0,0 +1,28 @@
+DROP INDEX IF EXISTS idx_agent_threads_project_agent_activity;
+ALTER TABLE workflow_agent_node_runs RENAME COLUMN agent_id TO actor_id;
+DROP INDEX IF EXISTS idx_agent_runs_project_agent_started;
+
+ALTER TABLE agent_threads DROP COLUMN agent_id;
+
+ALTER TABLE agent_runs
+  DROP CONSTRAINT agent_runs_kind_fields,
+  DROP COLUMN agent_id,
+  ADD CONSTRAINT agent_runs_kind_fields CHECK (
+    (
+      kind = 'conversation'
+      AND thread_id IS NOT NULL
+      AND trigger_message_id IS NOT NULL
+      AND parent_run_id IS NULL
+      AND spawn_key IS NULL
+      AND result IS NULL
+    )
+    OR
+    (
+      kind = 'subagent'
+      AND thread_id IS NULL
+      AND trigger_message_id IS NULL
+      AND parent_run_id IS NOT NULL
+      AND spawn_key IS NOT NULL
+      AND spec IS NOT NULL
+    )
+  );

package/src/migrations/034-device-authorizations.sql

@@ -0,0 +1,24 @@
+CREATE TABLE auth_device_authorizations (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  device_code_hash TEXT NOT NULL,
+  user_code TEXT NOT NULL,
+  client_name TEXT NOT NULL,
+  token_name TEXT NOT NULL,
+  token_expires_at TIMESTAMPTZ NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('pending', 'approved', 'denied', 'consumed')),
+  approved_user_id TEXT,
+  approved_session_id TEXT,
+  created_at TIMESTAMPTZ NOT NULL,
+  expires_at TIMESTAMPTZ NOT NULL,
+  approved_at TIMESTAMPTZ,
+  denied_at TIMESTAMPTZ,
+  consumed_at TIMESTAMPTZ,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, user_code),
+  FOREIGN KEY (project_id, approved_user_id) REFERENCES auth_users (project_id, id),
+  FOREIGN KEY (project_id, approved_session_id) REFERENCES auth_sessions (project_id, id)
+);
+
+CREATE INDEX idx_auth_device_authorizations_pending
+  ON auth_device_authorizations (project_id, status, expires_at DESC);