@sixb/sqlite 0.1.11 → 0.1.13

package/src/auth-storage/rows.ts

@@ -73,6 +73,11 @@ export interface SqliteAuthSessionRow {
   readonly last_seen_at: string | null
   readonly user_agent: string | null
   readonly ip_address: string | null
+  readonly client_name: string | null
+  readonly access_expires_at: string | null
+  readonly refresh_token_hash: string | null
+  readonly previous_refresh_token_hash: string | null
+  readonly refreshed_at: string | null
 }
 
 export interface SqliteAuthAccessTokenRow {
@@ -80,7 +85,7 @@ export interface SqliteAuthAccessTokenRow {
   readonly id: string
   readonly name: string
   readonly kind: AccessTokenRecord["kind"]
-  readonly subject_type: AccessTokenRecord["subjectType"]
+  readonly subject_type: AccessTokenRecord["subject"]["type"]
   readonly subject_id: string
   readonly token_hash: string
   readonly group_ids: string | null
@@ -152,8 +157,6 @@ export interface SqliteAuthDeviceAuthorizationRow {
   readonly device_code_hash: string
   readonly user_code: string
   readonly client_name: string
-  readonly token_name: string
-  readonly token_expires_at: string
   readonly status: DeviceAuthorizationRecord["status"]
   readonly approved_user_id: string | null
   readonly approved_session_id: string | null
@@ -236,6 +239,16 @@ export function rowToSessionRecord(row: SqliteAuthSessionRow): SessionRecord {
     lastSeenAt: row.last_seen_at ? new Date(row.last_seen_at) : undefined,
     userAgent: row.user_agent ?? undefined,
     ipAddress: row.ip_address ?? undefined,
+    bearer:
+      row.refresh_token_hash !== null && row.client_name !== null && row.access_expires_at !== null
+        ? {
+            clientName: row.client_name,
+            accessExpiresAt: new Date(row.access_expires_at),
+            refreshTokenHash: row.refresh_token_hash,
+            previousRefreshTokenHash: row.previous_refresh_token_hash ?? undefined,
+            refreshedAt: row.refreshed_at ? new Date(row.refreshed_at) : undefined,
+          }
+        : undefined,
   }
 }
 
@@ -245,8 +258,7 @@ export function rowToAccessTokenRecord(row: SqliteAuthAccessTokenRow): AccessTok
     projectId: row.project_id,
     name: row.name,
     kind: row.kind,
-    subjectType: row.subject_type,
-    subjectId: row.subject_id,
+    subject: { type: row.subject_type, id: row.subject_id },
     tokenHash: row.token_hash,
     groupIds: parseOptionalStringArray(row.group_ids),
     createdByPrincipal:
@@ -347,8 +359,6 @@ export function rowToDeviceAuthorizationRecord(
     deviceCodeHash: row.device_code_hash,
     userCode: row.user_code,
     clientName: row.client_name,
-    tokenName: row.token_name,
-    tokenExpiresAt: new Date(row.token_expires_at),
     status: row.status,
     approvedUserId: row.approved_user_id ?? undefined,
     approvedSessionId: row.approved_session_id ?? undefined,

package/src/auth-storage/sessions.ts

@@ -1,6 +1,11 @@
 import type { Database } from "bun:sqlite"
 import type { AuthSessionAudience } from "@sixb/core"
-import type { AuthSessionStore, CreateAuthSessionInput, SessionRecord } from "@sixb/core/storage"
+import type {
+  AuthSessionStore,
+  CreateAuthSessionInput,
+  RotateSessionRefreshTokenResult,
+  SessionRecord,
+} from "@sixb/core/storage"
 import { AuthStorageError } from "@sixb/core/storage"
 import { runImmediateTransaction } from "../transactions"
 import type { SqliteAuthSessionRow } from "./rows"
@@ -99,11 +104,10 @@ export class SqliteAuthSessionStore implements AuthSessionStore {
 
     if (
       !row ||
+      row.refresh_token_hash !== null ||
       row.audience !== params.audience ||
       row.token_hash !== params.tokenHash ||
-      row.revoked_at ||
-      new Date(row.expires_at) <= params.now ||
-      (row.absolute_expires_at !== null && new Date(row.absolute_expires_at) <= params.now)
+      !isLiveSessionRow(row, params.now)
     ) {
       return null
     }
@@ -111,6 +115,78 @@ export class SqliteAuthSessionStore implements AuthSessionStore {
     return rowToSessionRecord(row)
   }
 
+  async findValidByAccessTokenHash(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly tokenHash: string
+    readonly now: Date
+  }): Promise<SessionRecord | null> {
+    const row = getSessionRowById(this.db, params)
+    if (
+      !row ||
+      row.access_expires_at === null ||
+      row.token_hash !== params.tokenHash ||
+      new Date(row.access_expires_at) <= params.now ||
+      !isLiveSessionRow(row, params.now)
+    ) {
+      return null
+    }
+
+    return rowToSessionRecord(row)
+  }
+
+  async rotateRefreshToken(
+    params: Parameters<AuthSessionStore["rotateRefreshToken"]>[0]
+  ): Promise<RotateSessionRefreshTokenResult> {
+    return runImmediateTransaction(this.db, (): RotateSessionRefreshTokenResult => {
+      const row = getSessionRowById(this.db, params)
+      if (!row?.refresh_token_hash || !isLiveSessionRow(row, params.now)) {
+        return { status: "invalid" }
+      }
+
+      const replacedRecently =
+        row.previous_refresh_token_hash === params.refreshTokenHash &&
+        row.refreshed_at !== null &&
+        params.now.getTime() - new Date(row.refreshed_at).getTime() <= params.reuseGraceMs
+      if (row.refresh_token_hash !== params.refreshTokenHash && !replacedRecently) {
+        if (row.previous_refresh_token_hash !== params.refreshTokenHash) {
+          return { status: "invalid" }
+        }
+        this.db
+          .query("UPDATE auth_sessions SET revoked_at = ? WHERE project_id = ? AND id = ?")
+          .run(toIso(params.now), params.projectId, params.id)
+        return { status: "reused" }
+      }
+
+      const expiresAt = toIso(params.next.expiresAt)
+      this.db
+        .query(`
+          UPDATE auth_sessions
+          SET token_hash = ?,
+              access_expires_at = ?,
+              previous_refresh_token_hash = refresh_token_hash,
+              refresh_token_hash = ?,
+              refreshed_at = ?,
+              last_seen_at = ?,
+              expires_at = MAX(expires_at, MIN(?, COALESCE(absolute_expires_at, ?)))
+          WHERE project_id = ? AND id = ?
+        `)
+        .run(
+          params.next.tokenHash,
+          toIso(params.next.accessExpiresAt),
+          params.next.refreshTokenHash,
+          toIso(params.now),
+          toIso(params.now),
+          expiresAt,
+          expiresAt,
+          params.projectId,
+          params.id
+        )
+      const session = getSessionById(this.db, params)
+      return session ? { status: "rotated", session } : { status: "invalid" }
+    })
+  }
+
   async renewIfValid(params: {
     readonly projectId: string
     readonly id: string
@@ -135,6 +211,7 @@ export class SqliteAuthSessionStore implements AuthSessionStore {
             AND id = ?
             AND audience = ?
             AND token_hash = ?
+            AND refresh_token_hash IS NULL
             AND revoked_at IS NULL
             AND expires_at > ?
             AND (absolute_expires_at IS NULL OR absolute_expires_at > ?)
@@ -228,3 +305,11 @@ export class SqliteAuthSessionStore implements AuthSessionStore {
     })
   }
 }
+
+function isLiveSessionRow(row: SqliteAuthSessionRow, now: Date): boolean {
+  return (
+    row.revoked_at === null &&
+    new Date(row.expires_at) > now &&
+    (row.absolute_expires_at === null || new Date(row.absolute_expires_at) > now)
+  )
+}

package/src/auth-storage/shared.ts

@@ -425,8 +425,11 @@ export function createSession(
       expires_at,
       absolute_expires_at,
       user_agent,
-      ip_address
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ip_address,
+      client_name,
+      access_expires_at,
+      refresh_token_hash
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `
   ).run(
     projectId,
@@ -439,7 +442,10 @@ export function createSession(
     toIso(input.expiresAt),
     input.absoluteExpiresAt ? toIso(input.absoluteExpiresAt) : null,
     input.userAgent ?? null,
-    input.ipAddress ?? null
+    input.ipAddress ?? null,
+    input.bearer ? assertNonEmpty(input.bearer.clientName, "Session client name") : null,
+    input.bearer ? toIso(input.bearer.accessExpiresAt) : null,
+    input.bearer ? assertNonEmpty(input.bearer.refreshTokenHash, "Refresh token hash") : null
   )
 
   const session = getSessionById(db, { projectId, id })

package/src/file-upload-session-storage.ts

@@ -0,0 +1,136 @@
+import type { Database } from "bun:sqlite"
+import {
+  DurableFileUploadSessions,
+  type FileUploadSessionPersistence,
+  type FileUploadSessionPersistenceBackend,
+  fileUploadSessionReapAt,
+  parseFileUploadSessionRow,
+} from "@sixb/core/internal/file-upload-session-storage-provider"
+import type { FileUploadSession, ListAbandonedFileUploadSessionsInput } from "@sixb/core/storage"
+import { isUniqueConstraintError } from "./storage-errors"
+import { runImmediateTransactionAsync, type SqliteStoreConnection } from "./transactions"
+
+export class SqliteFileUploadSessionStorage extends DurableFileUploadSessions {
+  constructor(connection: SqliteStoreConnection) {
+    super(new SqliteFileUploadSessionBackend(connection.db))
+  }
+}
+
+class SqliteFileUploadSessionBackend implements FileUploadSessionPersistenceBackend {
+  private readonly persistence: FileUploadSessionPersistence
+
+  constructor(private readonly db: Database) {
+    this.persistence = new SqliteFileUploadSessionPersistence(db)
+  }
+
+  read<T>(run: (persistence: FileUploadSessionPersistence) => Promise<T>): Promise<T> {
+    return run(this.persistence)
+  }
+
+  transaction<T>(run: (persistence: FileUploadSessionPersistence) => Promise<T>): Promise<T> {
+    return runImmediateTransactionAsync(this.db, () => run(this.persistence))
+  }
+}
+
+class SqliteFileUploadSessionPersistence implements FileUploadSessionPersistence {
+  constructor(private readonly db: Database) {}
+
+  async now(): Promise<Date> {
+    const row = this.db.query("SELECT strftime('%Y-%m-%dT%H:%M:%fZ', 'now') AS now").get() as {
+      readonly now: string
+    }
+    return new Date(row.now)
+  }
+
+  async insert(session: FileUploadSession): Promise<boolean> {
+    try {
+      this.db
+        .query(
+          `INSERT INTO file_upload_sessions (
+            id, project_id, owner_principal_type, owner_principal_id, strategy, status, file_name,
+            media_type, logical_path, expected_size_bytes, expected_digest, provider_upload, signed_parts, file_ref,
+            created_at, expires_at, completed_at, aborted_at, reap_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+        )
+        .run(
+          session.id,
+          session.projectId,
+          session.principal.type,
+          session.principal.id,
+          session.strategy,
+          session.status,
+          session.fileName ?? null,
+          session.mediaType ?? null,
+          session.logicalPath ?? null,
+          session.expectedSizeBytes ?? null,
+          session.expectedDigest ?? null,
+          ...mutableColumns(session)
+        )
+      return true
+    } catch (error) {
+      if (isUniqueConstraintError(error)) return false
+      throw error
+    }
+  }
+
+  async get(uploadId: string): Promise<FileUploadSession | null> {
+    const row = this.db.query(`${SELECT_SESSION} WHERE id = ?`).get(uploadId)
+    return row ? parseFileUploadSessionRow(row as Record<string, unknown>) : null
+  }
+
+  async update(session: FileUploadSession): Promise<void> {
+    this.db
+      .query(
+        `UPDATE file_upload_sessions
+         SET status = ?, provider_upload = ?, signed_parts = ?, file_ref = ?, created_at = ?,
+             expires_at = ?, completed_at = ?, aborted_at = ?, reap_at = ?
+         WHERE id = ?`
+      )
+      .run(session.status, ...mutableColumns(session), session.id)
+  }
+
+  async listAbandoned(
+    input: ListAbandonedFileUploadSessionsInput
+  ): Promise<readonly FileUploadSession[]> {
+    const rows = this.db
+      .query(
+        `${SELECT_SESSION}
+         WHERE project_id = ? AND status = 'pending' AND provider_upload IS NOT NULL
+           AND expires_at <= ?
+         ORDER BY expires_at, id
+         LIMIT ?`
+      )
+      .all(input.projectId, input.now.toISOString(), input.limit)
+    return rows.map((row) => parseFileUploadSessionRow(row as Record<string, unknown>))
+  }
+
+  async deleteReapable(now: Date): Promise<number> {
+    return this.db
+      .query("DELETE FROM file_upload_sessions WHERE reap_at IS NOT NULL AND reap_at <= ?")
+      .run(now.toISOString()).changes
+  }
+}
+
+const SELECT_SESSION = `
+  SELECT id, project_id AS projectId, owner_principal_type AS ownerPrincipalType,
+    owner_principal_id AS ownerPrincipalId, strategy, status,
+    file_name AS fileName, media_type AS mediaType, logical_path AS logicalPath,
+    expected_size_bytes AS expectedSizeBytes, expected_digest AS expectedDigest,
+    provider_upload AS providerUpload, signed_parts AS signedParts, file_ref AS fileRef,
+    created_at AS createdAt, expires_at AS expiresAt, completed_at AS completedAt,
+    aborted_at AS abortedAt
+  FROM file_upload_sessions`
+
+/** Columns a transition may change, in insert/update order after `expected_digest`/`status`. */
+function mutableColumns(session: FileUploadSession) {
+  return [
+    session.providerUpload === undefined ? null : JSON.stringify(session.providerUpload),
+    JSON.stringify(session.signedParts),
+    session.fileRef === undefined ? null : JSON.stringify(session.fileRef),
+    session.createdAt.toISOString(),
+    session.expiresAt.toISOString(),
+    session.completedAt?.toISOString() ?? null,
+    session.abortedAt?.toISOString() ?? null,
+    fileUploadSessionReapAt(session)?.toISOString() ?? null,
+  ] as const
+}

package/src/index.ts

@@ -39,6 +39,7 @@ import { SqliteAiUsageStorage } from "./ai-usage-storage"
 import { SqliteAuthStorage } from "./auth-storage"
 import { SqliteConnectorConnectionStorage } from "./connector-connection-storage"
 import { SqliteExecutionStorage } from "./execution-storage"
+import { SqliteFileUploadSessionStorage } from "./file-upload-session-storage"
 import {
   createSqliteStorageMigrators,
   installFreshSqliteSchema,
@@ -106,6 +107,7 @@ export class SqliteStorage implements MigrationCapableStorage {
   readonly shareGrants: ShareGrantStorage
   readonly shareSessions: ShareSessionStorage
   readonly connectorConnections: SqliteConnectorConnectionStorage
+  readonly fileUploadSessions: SqliteFileUploadSessionStorage
   readonly migrators: readonly StorageMigrator[]
 
   private readonly connection: SqliteStoreConnection
@@ -172,6 +174,7 @@ export class SqliteStorage implements MigrationCapableStorage {
     this.shareGrants = createOperationScopedFacade(stores.shareGrants, scope)
     this.shareSessions = createOperationScopedFacade(stores.shareSessions, scope)
     this.connectorConnections = createOperationScopedFacade(stores.connectorConnections, scope)
+    this.fileUploadSessions = createOperationScopedFacade(stores.fileUploadSessions, scope)
     this.migrators = options.path ? createSqliteStorageMigrators(options.path) : []
     registerSqliteStorageTestingAdapter(this, (durationMs) =>
       stores.connectorConnections.advanceTimeForTesting(durationMs)
@@ -333,6 +336,7 @@ function createSqliteStores(
     shareGrants,
     shareSessions,
     connectorConnections: new SqliteConnectorConnectionStorage(connection),
+    fileUploadSessions: new SqliteFileUploadSessionStorage(connection),
   }
 }
 
@@ -357,6 +361,7 @@ interface SqliteStoreSet {
   readonly shareGrants: SqliteShareGrantStorage
   readonly shareSessions: SqliteShareSessionStorage
   readonly connectorConnections: SqliteConnectorConnectionStorage
+  readonly fileUploadSessions: SqliteFileUploadSessionStorage
 }
 
 export { migrateSqliteStorage } from "./migrations"

package/src/migrations/041-agent-thread-workspaces.sql

@@ -0,0 +1,2 @@
+ALTER TABLE agent_threads ADD COLUMN sandbox_params TEXT
+  CHECK (sandbox_params IS NULL OR (json_valid(sandbox_params) AND json_type(sandbox_params) = 'object'));

package/src/migrations/042-vector-profiles.sql

@@ -0,0 +1,21 @@
+CREATE TABLE object_vectors (
+  project_id TEXT NOT NULL,
+  object_type_id TEXT NOT NULL,
+  primary_id TEXT NOT NULL,
+  profile TEXT NOT NULL CHECK (length(trim(profile)) > 0),
+  configuration TEXT NOT NULL,
+  source TEXT NOT NULL CHECK (
+    json_valid(source) AND json_type(source) = 'array' AND json_array_length(source) > 0
+  ),
+  source_fingerprint TEXT NOT NULL,
+  embedding BLOB NOT NULL CHECK (
+    typeof(embedding) = 'blob' AND length(embedding) BETWEEN 4 AND 64000
+    AND length(embedding) % 4 = 0
+  ),
+  last_commit_id TEXT NOT NULL,
+  PRIMARY KEY (project_id, object_type_id, primary_id, profile),
+  FOREIGN KEY (project_id, object_type_id, primary_id)
+    REFERENCES objects (project_id, object_type_id, primary_id) ON DELETE CASCADE,
+  FOREIGN KEY (project_id, last_commit_id)
+    REFERENCES ontology_commits (project_id, id) DEFERRABLE INITIALLY DEFERRED
+);

package/src/migrations/043-vector-indexing.sql

@@ -0,0 +1,197 @@
+CREATE TABLE object_vector_indexing (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  object_type_id TEXT NOT NULL,
+  primary_id TEXT NOT NULL,
+  profile TEXT NOT NULL,
+  request TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('pending', 'running', 'ready', 'failed')),
+  available_at TEXT NOT NULL,
+  dispatch_at TEXT NOT NULL,
+  values_json TEXT,
+  error TEXT,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, object_type_id, primary_id, profile)
+);
+CREATE INDEX object_vector_indexing_due ON object_vector_indexing (project_id, dispatch_at, id)
+  WHERE status <> 'failed';
+
+CREATE TABLE executions_v2 (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  executor_kind TEXT NOT NULL CHECK (
+    executor_kind IN (
+      'request', 'action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow',
+      'agent', 'kernel'
+    )
+  ),
+  executor_id TEXT NOT NULL CHECK (length(trim(executor_id)) > 0),
+  source_kind TEXT NOT NULL CHECK (
+    source_kind IN ('http', 'webhook', 'schedule', 'event', 'datasetVersion', 'execution', 'ontologyCommit')
+  ),
+  source_id TEXT NOT NULL CHECK (length(trim(source_id)) > 0),
+  requested_by_user_id TEXT,
+  requested_by_service_account_id TEXT,
+  correlation_id TEXT NOT NULL CHECK (length(trim(correlation_id)) > 0),
+  parent_execution_id TEXT,
+  authority_kind TEXT NOT NULL CHECK (
+    authority_kind IN ('principal', 'trustedPrimitive', 'delegated', 'kernel', 'disabled')
+  ),
+  authority_user_id TEXT,
+  authority_service_account_id TEXT,
+  authority_session_id TEXT,
+  authority_access_token_id TEXT,
+  authority_primitive_kind TEXT CHECK (
+    authority_primitive_kind IS NULL
+      OR authority_primitive_kind IN (
+        'action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow'
+      )
+  ),
+  authority_primitive_id TEXT,
+  authority_kernel_operation TEXT CHECK (
+    authority_kernel_operation IS NULL OR authority_kernel_operation IN ('ontology.recover', 'ontology.indexVectors')
+  ),
+  authority_delegation_kind TEXT CHECK (
+    authority_delegation_kind IS NULL OR authority_delegation_kind = 'share'
+  ),
+  authority_delegation_id TEXT,
+  authority_delegation_session_id TEXT,
+  requester_group_ids TEXT NOT NULL DEFAULT '[]',
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, id),
+  FOREIGN KEY (project_id, parent_execution_id) REFERENCES executions (project_id, id),
+  FOREIGN KEY (project_id, requested_by_user_id) REFERENCES auth_users (project_id, id),
+  FOREIGN KEY (project_id, requested_by_service_account_id)
+    REFERENCES auth_service_accounts (project_id, id),
+  FOREIGN KEY (project_id, authority_user_id) REFERENCES auth_users (project_id, id),
+  FOREIGN KEY (project_id, authority_service_account_id)
+    REFERENCES auth_service_accounts (project_id, id),
+  FOREIGN KEY (project_id, authority_session_id) REFERENCES auth_sessions (project_id, id),
+  FOREIGN KEY (project_id, authority_access_token_id)
+    REFERENCES auth_access_tokens (project_id, id),
+  FOREIGN KEY (
+    project_id, authority_delegation_session_id, authority_delegation_id
+  ) REFERENCES share_sessions (project_id, id, grant_id),
+  CHECK ((requested_by_user_id IS NOT NULL) + (requested_by_service_account_id IS NOT NULL) <= 1),
+  CHECK (
+    (source_kind = 'execution' AND parent_execution_id = source_id)
+      OR (source_kind <> 'execution' AND parent_execution_id IS NULL)
+  ),
+  CHECK (
+    (
+      authority_kind = 'principal'
+      AND (authority_user_id IS NOT NULL) + (authority_service_account_id IS NOT NULL) = 1
+      AND (authority_session_id IS NOT NULL) + (authority_access_token_id IS NOT NULL) <= 1
+      AND (authority_session_id IS NULL OR authority_user_id IS NOT NULL)
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'trustedPrimitive'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NOT NULL
+      AND authority_primitive_id IS NOT NULL
+      AND length(trim(authority_primitive_id)) > 0
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'delegated'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NOT NULL
+      AND authority_delegation_kind = 'share'
+      AND authority_delegation_id IS NOT NULL
+      AND length(trim(authority_delegation_id)) > 0
+      AND authority_delegation_session_id IS NOT NULL
+      AND length(trim(authority_delegation_session_id)) > 0
+    )
+    OR (
+      authority_kind = 'kernel'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NOT NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'disabled'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+  ),
+  CHECK (
+    (
+      executor_kind = 'request'
+      AND source_kind = 'http'
+      AND executor_id = source_id
+      AND (
+        (
+          authority_kind = 'principal'
+          AND requested_by_user_id IS authority_user_id
+          AND requested_by_service_account_id IS authority_service_account_id
+        )
+        OR (
+          authority_kind IN ('delegated', 'disabled')
+          AND requested_by_user_id IS NULL
+          AND requested_by_service_account_id IS NULL
+        )
+      )
+    )
+    OR (
+      executor_kind IN ('action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow')
+      AND authority_kind = 'trustedPrimitive'
+      AND executor_kind = authority_primitive_kind
+    )
+    OR (
+      executor_kind = 'agent'
+      AND source_kind = 'execution'
+      AND (
+        (
+          authority_kind = 'principal'
+          AND authority_service_account_id IS NOT NULL
+          AND authority_session_id IS NULL
+          AND authority_access_token_id IS NULL
+        )
+        OR (
+          authority_kind = 'principal'
+          AND authority_user_id IS NOT NULL
+          AND (authority_session_id IS NOT NULL) + (authority_access_token_id IS NOT NULL) = 1
+        )
+        OR authority_kind = 'disabled'
+      )
+    )
+    OR (executor_kind = 'kernel' AND authority_kind = 'kernel')
+  )
+);
+
+INSERT INTO executions_v2 (project_id, id, executor_kind, executor_id, source_kind, source_id, requested_by_user_id, requested_by_service_account_id, correlation_id, parent_execution_id, authority_kind, authority_user_id, authority_service_account_id, authority_session_id, authority_access_token_id, authority_primitive_kind, authority_primitive_id, authority_kernel_operation, authority_delegation_kind, authority_delegation_id, authority_delegation_session_id, requester_group_ids, created_at) SELECT project_id, id, executor_kind, executor_id, source_kind, source_id, requested_by_user_id, requested_by_service_account_id, correlation_id, parent_execution_id, authority_kind, authority_user_id, authority_service_account_id, authority_session_id, authority_access_token_id, authority_primitive_kind, authority_primitive_id, authority_kernel_operation, authority_delegation_kind, authority_delegation_id, authority_delegation_session_id, requester_group_ids, created_at FROM executions;
+DROP TABLE executions;
+ALTER TABLE executions_v2 RENAME TO executions;

package/src/migrations/044-vector-batching.sql

@@ -0,0 +1,3 @@
+ALTER TABLE object_vector_indexing ADD COLUMN batch_id TEXT;
+CREATE INDEX object_vector_indexing_batch ON object_vector_indexing (project_id, batch_id, id)
+  WHERE batch_id IS NOT NULL;

package/src/migrations/045-agent-thread-sandbox-state.sql

@@ -0,0 +1,2 @@
+ALTER TABLE agent_threads ADD COLUMN sandbox_state TEXT
+  CHECK (sandbox_state IS NULL OR (json_valid(sandbox_state) AND json_type(sandbox_state) = 'object'));

package/src/migrations/046-workflow-intervention-principals.sql

@@ -0,0 +1,15 @@
+-- Intervention actors were stored as { principalType, principalId }. Rewrite them to the
+-- canonical Principal shape { type, id } used by every other stored principal.
+UPDATE workflow_interventions
+SET submitted_by = json_object(
+  'type', json_extract(submitted_by, '$.principalType'),
+  'id', json_extract(submitted_by, '$.principalId')
+)
+WHERE json_extract(submitted_by, '$.principalType') IS NOT NULL;
+
+UPDATE workflow_interventions
+SET cancelled_by = json_object(
+  'type', json_extract(cancelled_by, '$.principalType'),
+  'id', json_extract(cancelled_by, '$.principalId')
+)
+WHERE json_extract(cancelled_by, '$.principalType') IS NOT NULL;