@sixb/sqlite 0.1.12 → 0.1.14

package/dist/index.js

@@ -4230,6 +4230,133 @@ var _045_agent_thread_sandbox_state_default = `ALTER TABLE agent_threads ADD COL
   CHECK (sandbox_state IS NULL OR (json_valid(sandbox_state) AND json_type(sandbox_state) = 'object'));
 `;
 
+// src/migrations/046-workflow-intervention-principals.sql
+var _046_workflow_intervention_principals_default = `-- Intervention actors were stored as { principalType, principalId }. Rewrite them to the
+-- canonical Principal shape { type, id } used by every other stored principal.
+UPDATE workflow_interventions
+SET submitted_by = json_object(
+  'type', json_extract(submitted_by, '$.principalType'),
+  'id', json_extract(submitted_by, '$.principalId')
+)
+WHERE json_extract(submitted_by, '$.principalType') IS NOT NULL;
+
+UPDATE workflow_interventions
+SET cancelled_by = json_object(
+  'type', json_extract(cancelled_by, '$.principalType'),
+  'id', json_extract(cancelled_by, '$.principalId')
+)
+WHERE json_extract(cancelled_by, '$.principalType') IS NOT NULL;
+`;
+
+// src/migrations/047-ontology-commit-attribution.sql
+var _047_ontology_commit_attribution_default = `-- Commits and their events name who requested the write and what ran it, replacing the
+-- authority-only \`actor\`. Both are copied from the commit's execution, which stays canonical and
+-- is immutable, so the backfill is exact. SQLite cannot add a NOT NULL column without a default;
+-- every insert supplies \`executor\`, and the UPDATE below replaces the placeholder on every row.
+ALTER TABLE ontology_commits ADD COLUMN requested_by TEXT
+  CHECK (requested_by IS NULL OR json_valid(requested_by));
+ALTER TABLE ontology_commits ADD COLUMN executor TEXT NOT NULL DEFAULT '{}'
+  CHECK (json_valid(executor));
+
+UPDATE ontology_commits SET
+  requested_by = (
+    SELECT CASE
+      WHEN e.requested_by_user_id IS NOT NULL
+        THEN json_object('id', e.requested_by_user_id, 'type', 'user')
+      WHEN e.requested_by_service_account_id IS NOT NULL
+        THEN json_object('id', e.requested_by_service_account_id, 'type', 'serviceAccount')
+    END
+    FROM executions e
+    WHERE e.project_id = ontology_commits.project_id AND e.id = ontology_commits.execution_id
+  ),
+  executor = (
+    SELECT CASE e.executor_kind
+      WHEN 'request' THEN json_object('requestId', e.executor_id, 'type', 'request')
+      WHEN 'agent' THEN json_object('runId', e.executor_id, 'type', 'agent')
+      WHEN 'kernel' THEN json_object(
+        'operation',
+        CASE e.authority_kernel_operation
+          WHEN 'ontology.recover'
+            THEN json_object('recoveryId', e.executor_id, 'type', 'ontology.recover')
+          ELSE json_object('indexingId', e.executor_id, 'type', 'ontology.indexVectors')
+        END,
+        'type', 'kernel'
+      )
+      ELSE json_object(
+        'id', e.authority_primitive_id,
+        'kind', e.executor_kind,
+        'runId', e.executor_id,
+        'type', 'primitive'
+      )
+    END
+    FROM executions e
+    WHERE e.project_id = ontology_commits.project_id AND e.id = ontology_commits.execution_id
+  );
+
+-- Events not yet published would otherwise reach consumers in the retired shape.
+UPDATE ontology_outbox SET envelope = (
+  SELECT json_remove(
+    CASE
+      WHEN c.requested_by IS NULL
+        THEN json_set(ontology_outbox.envelope, '$.executor', json(c.executor))
+      ELSE json_set(
+        ontology_outbox.envelope,
+        '$.executor', json(c.executor),
+        '$.requestedBy', json(c.requested_by)
+      )
+    END,
+    '$.actor'
+  )
+  FROM ontology_commits c
+  WHERE c.project_id = ontology_outbox.project_id AND c.id = ontology_outbox.commit_id
+)
+WHERE EXISTS (
+  SELECT 1 FROM ontology_commits c
+  WHERE c.project_id = ontology_outbox.project_id AND c.id = ontology_outbox.commit_id
+);
+
+ALTER TABLE ontology_commits DROP COLUMN actor;
+`;
+
+// src/migrations/049-native-sessions.sql
+var _049_native_sessions_default = `-- Native clients, such as the CLI, hold their session as bearer tokens: a
+-- short-lived access token, whose hash is \`token_hash\`, and a rotating refresh token. Browser
+-- sessions leave these columns NULL; \`refresh_token_hash IS NULL\` is what marks a cookie session.
+ALTER TABLE auth_sessions ADD COLUMN client_name TEXT;
+ALTER TABLE auth_sessions ADD COLUMN access_expires_at TEXT;
+ALTER TABLE auth_sessions ADD COLUMN refresh_token_hash TEXT;
+ALTER TABLE auth_sessions ADD COLUMN previous_refresh_token_hash TEXT;
+ALTER TABLE auth_sessions ADD COLUMN refreshed_at TEXT;
+
+-- The device flow now starts a session instead of issuing a personal access token.
+ALTER TABLE auth_device_authorizations DROP COLUMN token_name;
+ALTER TABLE auth_device_authorizations DROP COLUMN token_expires_at;
+`;
+
+// src/migrations/050-directory-group-memberships.sql
+var _050_directory_group_memberships_default = `-- A membership the identity provider owns is recorded with source 'directory' and synced to the
+-- provider's groups on every sign-in. Service accounts never sign in, so their table is unchanged.
+-- SQLite cannot change a CHECK constraint in place, so the table is rebuilt.
+CREATE TABLE auth_group_memberships_next (
+  project_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  group_id TEXT NOT NULL,
+  source TEXT NOT NULL CHECK (source IN ('invitation', 'manual', 'agent', 'directory')),
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, user_id, group_id)
+);
+
+INSERT INTO auth_group_memberships_next (project_id, user_id, group_id, source, created_at)
+SELECT project_id, user_id, group_id, source, created_at
+FROM auth_group_memberships;
+
+DROP TABLE auth_group_memberships;
+ALTER TABLE auth_group_memberships_next RENAME TO auth_group_memberships;
+
+CREATE INDEX idx_auth_group_memberships_group
+  ON auth_group_memberships(project_id, group_id);
+`;
+
 // src/migrations/037-execution-requester-groups.sql
 var _037_execution_requester_groups_default = `ALTER TABLE executions ADD COLUMN requester_group_ids TEXT NOT NULL DEFAULT '[]';
 
@@ -4312,6 +4439,44 @@ CREATE INDEX idx_connector_attempts_expiry
   ON connector_authorization_attempts (project_id, connector_id, expires_at);
 `;
 
+// src/migrations/048-file-upload-sessions.sql
+var _048_file_upload_sessions_default = `-- Durable staged-upload sessions, so an upload survives restarts and spans API replicas.
+-- Timestamps are ISO-8601 UTC text and compare lexicographically.
+CREATE TABLE file_upload_sessions (
+  id TEXT PRIMARY KEY CHECK (length(trim(id)) > 0),
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  owner_principal_type TEXT NOT NULL
+    CHECK (owner_principal_type IN ('user', 'serviceAccount', 'system')),
+  owner_principal_id TEXT NOT NULL CHECK (length(owner_principal_id) > 0),
+  strategy TEXT NOT NULL CHECK (strategy IN ('server', 'direct-put', 'multipart')),
+  status TEXT NOT NULL CHECK (status IN ('pending', 'completed', 'aborted')),
+  file_name TEXT,
+  media_type TEXT,
+  logical_path TEXT,
+  expected_size_bytes INTEGER CHECK (expected_size_bytes IS NULL OR expected_size_bytes >= 0),
+  expected_digest TEXT,
+  provider_upload TEXT CHECK (provider_upload IS NULL OR json_type(provider_upload) = 'object'),
+  signed_parts TEXT NOT NULL CHECK (json_type(signed_parts) = 'array'),
+  file_ref TEXT CHECK (file_ref IS NULL OR json_type(file_ref) = 'object'),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  completed_at TEXT,
+  aborted_at TEXT,
+  -- Derived by core (fileUploadSessionReapAt); NULL while an abandoned upload awaits its abort.
+  reap_at TEXT,
+  CHECK ((status = 'completed') = (completed_at IS NOT NULL)),
+  CHECK ((status = 'aborted') = (aborted_at IS NOT NULL))
+);
+
+CREATE INDEX idx_file_upload_sessions_reap
+  ON file_upload_sessions (reap_at)
+  WHERE reap_at IS NOT NULL;
+
+CREATE INDEX idx_file_upload_sessions_abandoned
+  ON file_upload_sessions (project_id, expires_at)
+  WHERE status = 'pending' AND provider_upload IS NOT NULL;
+`;
+
 // src/migrations.ts
 var MIGRATIONS_TABLE_SQL = `
   CREATE TABLE IF NOT EXISTS sixb_migrations (
@@ -4391,7 +4556,12 @@ var sqliteStorageMigrations = defineMigrations({
     sqliteSql("042-vector-profiles", _042_vector_profiles_default),
     sqliteSql("043-vector-indexing", _043_vector_indexing_default),
     sqliteSql("044-vector-batching", _044_vector_batching_default),
-    sqliteSql("045-agent-thread-sandbox-state", _045_agent_thread_sandbox_state_default)
+    sqliteSql("045-agent-thread-sandbox-state", _045_agent_thread_sandbox_state_default),
+    sqliteSql("046-workflow-intervention-principals", _046_workflow_intervention_principals_default),
+    sqliteSql("047-ontology-commit-attribution", _047_ontology_commit_attribution_default),
+    sqliteSql("048-file-upload-sessions", _048_file_upload_sessions_default),
+    sqliteSql("049-native-sessions", _049_native_sessions_default),
+    sqliteSql("050-directory-group-memberships", _050_directory_group_memberships_default)
   ]
 });
 function sqliteStoragePath(basePath) {
@@ -7345,7 +7515,14 @@ function rowToSessionRecord(row) {
     revokedAt: row.revoked_at ? new Date(row.revoked_at) : undefined,
     lastSeenAt: row.last_seen_at ? new Date(row.last_seen_at) : undefined,
     userAgent: row.user_agent ?? undefined,
-    ipAddress: row.ip_address ?? undefined
+    ipAddress: row.ip_address ?? undefined,
+    bearer: row.refresh_token_hash !== null && row.client_name !== null && row.access_expires_at !== null ? {
+      clientName: row.client_name,
+      accessExpiresAt: new Date(row.access_expires_at),
+      refreshTokenHash: row.refresh_token_hash,
+      previousRefreshTokenHash: row.previous_refresh_token_hash ?? undefined,
+      refreshedAt: row.refreshed_at ? new Date(row.refreshed_at) : undefined
+    } : undefined
   };
 }
 function rowToAccessTokenRecord(row) {
@@ -7354,8 +7531,7 @@ function rowToAccessTokenRecord(row) {
     projectId: row.project_id,
     name: row.name,
     kind: row.kind,
-    subjectType: row.subject_type,
-    subjectId: row.subject_id,
+    subject: { type: row.subject_type, id: row.subject_id },
     tokenHash: row.token_hash,
     groupIds: parseOptionalStringArray(row.group_ids),
     createdByPrincipal: row.created_by_principal_type && row.created_by_principal_id ? {
@@ -7436,8 +7612,6 @@ function rowToDeviceAuthorizationRecord(row) {
     deviceCodeHash: row.device_code_hash,
     userCode: row.user_code,
     clientName: row.client_name,
-    tokenName: row.token_name,
-    tokenExpiresAt: new Date(row.token_expires_at),
     status: row.status,
     approvedUserId: row.approved_user_id ?? undefined,
     approvedSessionId: row.approved_session_id ?? undefined,
@@ -7668,9 +7842,12 @@ function createSession(db, input) {
       expires_at,
       absolute_expires_at,
       user_agent,
-      ip_address
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-  `).run(projectId, id, userId, strategyId, audience, tokenHash, toIso(input.createdAt), toIso(input.expiresAt), input.absoluteExpiresAt ? toIso(input.absoluteExpiresAt) : null, input.userAgent ?? null, input.ipAddress ?? null);
+      ip_address,
+      client_name,
+      access_expires_at,
+      refresh_token_hash
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(projectId, id, userId, strategyId, audience, tokenHash, toIso(input.createdAt), toIso(input.expiresAt), input.absoluteExpiresAt ? toIso(input.absoluteExpiresAt) : null, input.userAgent ?? null, input.ipAddress ?? null, input.bearer ? assertNonEmpty(input.bearer.clientName, "Session client name") : null, input.bearer ? toIso(input.bearer.accessExpiresAt) : null, input.bearer ? assertNonEmpty(input.bearer.refreshTokenHash, "Refresh token hash") : null);
   const session = getSessionById(db, { projectId, id });
   if (!session) {
     throw new AuthStorageError("missing_session", `[Sixb] Failed to load session '${id}' for project '${projectId}'.`);
@@ -7818,10 +7995,10 @@ function createAuthAccessToken(db, input) {
   const id = assertNonEmpty(input.id, "Access token id");
   const projectId = assertNonEmpty(input.projectId, "Project id");
   const name = assertNonEmpty(input.name, "Access token name");
-  const subjectId = assertNonEmpty(input.subjectId, "Access token subject id");
+  const subjectId = assertNonEmpty(input.subject.id, "Access token subject id");
   const tokenHash = assertNonEmpty(input.tokenHash, "Access token hash");
   assertKindMatchesSubject(input);
-  assertSubjectExists(db, projectId, input.subjectType, subjectId);
+  assertSubjectExists(db, projectId, input.subject.type, subjectId);
   const groupIds = input.groupIds === undefined ? undefined : normalizeGroupIds(input.groupIds);
   try {
     db.query(`
@@ -7840,7 +8017,7 @@ function createAuthAccessToken(db, input) {
             created_at,
             expires_at
           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-        `).run(projectId, id, name, input.kind, input.subjectType, subjectId, tokenHash, serializeOptionalStringArray(groupIds), input.createdByPrincipal?.type ?? null, input.createdByPrincipal?.id ?? null, input.createdBySessionId ?? null, toIso(input.createdAt), toIso(input.expiresAt));
+        `).run(projectId, id, name, input.kind, input.subject.type, subjectId, tokenHash, serializeOptionalStringArray(groupIds), input.createdByPrincipal?.type ?? null, input.createdByPrincipal?.id ?? null, input.createdBySessionId ?? null, toIso(input.createdAt), toIso(input.expiresAt));
   } catch (error) {
     mapUniqueConstraintError(error, "duplicate_access_token", `[Sixb] Access token '${id}' already exists for project '${projectId}'.`);
   }
@@ -7871,13 +8048,9 @@ class SqliteAuthAccessTokenStore {
       whereClauses.push("kind = ?");
       args.push(input.kind);
     }
-    if (input.subjectType) {
-      whereClauses.push("subject_type = ?");
-      args.push(input.subjectType);
-    }
-    if (input.subjectId) {
-      whereClauses.push("subject_id = ?");
-      args.push(input.subjectId);
+    if (input.subject) {
+      whereClauses.push("subject_type = ?", "subject_id = ?");
+      args.push(input.subject.type, input.subject.id);
     }
     if (!input.includeRevoked) {
       whereClauses.push("revoked_at IS NULL");
@@ -7961,10 +8134,10 @@ function assertSubjectExists(db, projectId, subjectType, subjectId) {
   throw new AuthStorageError2("missing_service_account", `[Sixb] Service account '${subjectId}' not found for project '${projectId}'.`);
 }
 function assertKindMatchesSubject(input) {
-  if (input.kind === "personal" && input.subjectType === "user" || input.kind === "serviceAccount" && input.subjectType === "serviceAccount") {
+  if (input.kind === "personal" && input.subject.type === "user" || input.kind === "serviceAccount" && input.subject.type === "serviceAccount") {
     return;
   }
-  throw new AuthStorageError2("invalid_input", `[Sixb] Access token kind '${input.kind}' cannot target subject type '${input.subjectType}'.`);
+  throw new AuthStorageError2("invalid_input", `[Sixb] Access token kind '${input.kind}' cannot target subject type '${input.subject.type}'.`);
 }
 
 // src/auth-storage/device-authorizations.ts
@@ -7984,10 +8157,10 @@ class SqliteAuthDeviceAuthorizationStore {
       try {
         this.db.query(`
           INSERT INTO auth_device_authorizations (
-            project_id, id, device_code_hash, user_code, client_name, token_name,
-            token_expires_at, status, created_at, expires_at
-          ) VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?)
-        `).run(assertNonEmpty(input.projectId, "Project id"), assertNonEmpty(input.id, "Device authorization id"), assertNonEmpty(input.deviceCodeHash, "Device code hash"), assertNonEmpty(input.userCode, "User code"), assertNonEmpty(input.clientName, "Client name"), assertNonEmpty(input.tokenName, "Token name"), toIso(input.tokenExpiresAt), toIso(input.createdAt), toIso(input.expiresAt));
+            project_id, id, device_code_hash, user_code, client_name, status, created_at,
+            expires_at
+          ) VALUES (?, ?, ?, ?, ?, 'pending', ?, ?)
+        `).run(assertNonEmpty(input.projectId, "Project id"), assertNonEmpty(input.id, "Device authorization id"), assertNonEmpty(input.deviceCodeHash, "Device code hash"), assertNonEmpty(input.userCode, "User code"), assertNonEmpty(input.clientName, "Client name"), toIso(input.createdAt), toIso(input.expiresAt));
       } catch (error) {
         mapUniqueConstraintError(error, "duplicate_device_authorization", `[Sixb] Device authorization '${input.id}' already exists for project '${input.projectId}'.`);
       }
@@ -8653,11 +8826,48 @@ class SqliteAuthSessionStore {
   }
   async findValidByTokenHash(params) {
     const row = getSessionRowById(this.db, params);
-    if (!row || row.audience !== params.audience || row.token_hash !== params.tokenHash || row.revoked_at || new Date(row.expires_at) <= params.now || row.absolute_expires_at !== null && new Date(row.absolute_expires_at) <= params.now) {
+    if (!row || row.refresh_token_hash !== null || row.audience !== params.audience || row.token_hash !== params.tokenHash || !isLiveSessionRow(row, params.now)) {
       return null;
     }
     return rowToSessionRecord(row);
   }
+  async findValidByAccessTokenHash(params) {
+    const row = getSessionRowById(this.db, params);
+    if (!row || row.access_expires_at === null || row.token_hash !== params.tokenHash || new Date(row.access_expires_at) <= params.now || !isLiveSessionRow(row, params.now)) {
+      return null;
+    }
+    return rowToSessionRecord(row);
+  }
+  async rotateRefreshToken(params) {
+    return runImmediateTransaction(this.db, () => {
+      const row = getSessionRowById(this.db, params);
+      if (!row?.refresh_token_hash || !isLiveSessionRow(row, params.now)) {
+        return { status: "invalid" };
+      }
+      const replacedRecently = row.previous_refresh_token_hash === params.refreshTokenHash && row.refreshed_at !== null && params.now.getTime() - new Date(row.refreshed_at).getTime() <= params.reuseGraceMs;
+      if (row.refresh_token_hash !== params.refreshTokenHash && !replacedRecently) {
+        if (row.previous_refresh_token_hash !== params.refreshTokenHash) {
+          return { status: "invalid" };
+        }
+        this.db.query("UPDATE auth_sessions SET revoked_at = ? WHERE project_id = ? AND id = ?").run(toIso(params.now), params.projectId, params.id);
+        return { status: "reused" };
+      }
+      const expiresAt = toIso(params.next.expiresAt);
+      this.db.query(`
+          UPDATE auth_sessions
+          SET token_hash = ?,
+              access_expires_at = ?,
+              previous_refresh_token_hash = refresh_token_hash,
+              refresh_token_hash = ?,
+              refreshed_at = ?,
+              last_seen_at = ?,
+              expires_at = MAX(expires_at, MIN(?, COALESCE(absolute_expires_at, ?)))
+          WHERE project_id = ? AND id = ?
+        `).run(params.next.tokenHash, toIso(params.next.accessExpiresAt), params.next.refreshTokenHash, toIso(params.now), toIso(params.now), expiresAt, expiresAt, params.projectId, params.id);
+      const session = getSessionById(this.db, params);
+      return session ? { status: "rotated", session } : { status: "invalid" };
+    });
+  }
   async renewIfValid(params) {
     return runImmediateTransaction(this.db, () => {
       const now = toIso(params.now);
@@ -8673,6 +8883,7 @@ class SqliteAuthSessionStore {
             AND id = ?
             AND audience = ?
             AND token_hash = ?
+            AND refresh_token_hash IS NULL
             AND revoked_at IS NULL
             AND expires_at > ?
             AND (absolute_expires_at IS NULL OR absolute_expires_at > ?)
@@ -8718,6 +8929,9 @@ class SqliteAuthSessionStore {
     });
   }
 }
+function isLiveSessionRow(row, now) {
+  return row.revoked_at === null && new Date(row.expires_at) > now && (row.absolute_expires_at === null || new Date(row.absolute_expires_at) > now);
+}
 
 // src/auth-storage/users.ts
 import { AuthStorageError as AuthStorageError10 } from "@sixb/core/storage";
@@ -8888,7 +9102,7 @@ class SqliteAuthStorage {
         throw new AuthStorageError11("missing_device_authorization", `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`);
       }
       assertCompletableDeviceAuthorization(authorization, input);
-      const accessToken = createAuthAccessToken(this.db, input.accessToken);
+      const session = createSession(this.db, input.session);
       this.db.query(`
         UPDATE auth_device_authorizations
         SET status = 'consumed', consumed_at = ?
@@ -8900,7 +9114,7 @@ class SqliteAuthStorage {
           status: "consumed",
           consumedAt: new Date(input.completedAt)
         },
-        accessToken
+        session
       };
     });
   }
@@ -8946,17 +9160,6 @@ class SqliteAuthStorage {
           error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
         };
       }
-      if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && hasActiveUsers(this.db, projectId)) {
-        consumeMagicLink(this.db, {
-          projectId,
-          id: input.magicLinkId,
-          tokenHash: input.tokenHash,
-          consumedAt: completedAt
-        });
-        return {
-          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`)
-        };
-      }
       validateCompleteSessionInput(this.db, projectId, input.session);
       assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
       let newUserId;
@@ -8986,8 +9189,9 @@ class SqliteAuthStorage {
         projectId,
         user
       });
-      const groupMemberships = this.applyManualGroups({
+      const groupMemberships = this.applyGroups({
         completedAt,
+        source: "manual",
         existing: invitation.groupMemberships,
         groupIds: manualGroupIds,
         projectId,
@@ -9041,36 +9245,18 @@ class SqliteAuthStorage {
           error: new AuthStorageError11("missing_user", `[Sixb] User '${identity.user_id}' not found for linked OIDC identity.`)
         };
       }
-      if (!identity && userRow && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
-        this.consumeOidcAttempt(input, completedAt, projectId);
-        return {
-          error: new AuthStorageError11("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${userRow.id}' for project '${projectId}'.`)
-        };
-      }
       if (userRow?.status === "suspended") {
         this.consumeOidcAttempt(input, completedAt, projectId);
         return {
           error: new AuthStorageError11("suspended_user", `[Sixb] User '${userRow.id}' is suspended for project '${projectId}'.`)
         };
       }
-      if (shouldCreateUser && !input.emailVerified) {
-        this.consumeOidcAttempt(input, completedAt, projectId);
-        return {
-          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
-        };
-      }
       if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
         this.consumeOidcAttempt(input, completedAt, projectId);
         return {
           error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
         };
       }
-      if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && hasActiveUsers(this.db, projectId)) {
-        this.consumeOidcAttempt(input, completedAt, projectId);
-        return {
-          error: new AuthStorageError11("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`)
-        };
-      }
       validateCompleteSessionInput(this.db, projectId, input.session);
       assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
       let newUserId;
@@ -9108,10 +9294,17 @@ class SqliteAuthStorage {
         projectId,
         user
       });
-      const groupMemberships = this.applyManualGroups({
+      const groupMemberships = this.syncDirectoryGroups({
         completedAt,
-        existing: invitation.groupMemberships,
-        groupIds: manualGroupIds,
+        existing: this.applyGroups({
+          completedAt,
+          source: "manual",
+          existing: invitation.groupMemberships,
+          groupIds: manualGroupIds,
+          projectId,
+          userId: user.id
+        }),
+        groupIds: input.directoryGroupIds,
         projectId,
         userId: user.id
       });
@@ -9251,19 +9444,33 @@ class SqliteAuthStorage {
     }));
     return { invitation, groupMemberships };
   }
-  applyManualGroups(input) {
+  applyGroups(input) {
     const groupMemberships = [...input.existing];
     for (const groupId of input.groupIds) {
       groupMemberships.push(upsertGroupMembership(this.db, {
         projectId: input.projectId,
         userId: input.userId,
         groupId,
-        source: "manual",
+        source: input.source,
         createdAt: input.completedAt
       }));
     }
     return groupMemberships;
   }
+  syncDirectoryGroups(input) {
+    if (!input.groupIds) {
+      return input.existing;
+    }
+    const groupIds = normalizeGroupIds(input.groupIds);
+    this.db.query(`
+        DELETE FROM auth_group_memberships
+        WHERE project_id = ?
+          AND user_id = ?
+          AND source = 'directory'
+          AND group_id NOT IN (${groupIds.map(() => "?").join(", ")})
+      `).run(input.projectId, input.userId, ...groupIds);
+    return this.applyGroups({ ...input, groupIds, source: "directory" });
+  }
   createSignInSession(input) {
     return createSession(this.db, {
       id: input.session.id,
@@ -9315,16 +9522,6 @@ class SqliteAuthStorage {
     });
   }
 }
-function hasActiveUsers(db, projectId) {
-  const row = db.query(`
-      SELECT 1 AS active
-      FROM auth_users
-      WHERE project_id = ?
-        AND status = 'active'
-      LIMIT 1
-    `).get(projectId);
-  return row !== null;
-}
 function assertSignInSessionAudience(projectId, sessionAudience, storedAudience) {
   if (sessionAudience === storedAudience) {
     return;
@@ -9341,7 +9538,7 @@ function assertCompletableDeviceAuthorization(authorization, input) {
   if (authorization.status === "denied") {
     throw new AuthStorageError11("device_authorization_denied", "[Sixb] Device authorization was denied.");
   }
-  if (authorization.status !== "approved" || authorization.expiresAt <= input.completedAt || !authorization.approvedUserId || !authorization.approvedSessionId || input.accessToken.projectId !== input.projectId || input.accessToken.subjectType !== "user" || input.accessToken.subjectId !== authorization.approvedUserId || input.accessToken.createdBySessionId !== authorization.approvedSessionId) {
+  if (authorization.status !== "approved" || authorization.expiresAt <= input.completedAt || !authorization.approvedUserId || !authorization.approvedSessionId || input.session.projectId !== input.projectId || input.session.userId !== authorization.approvedUserId) {
     throw new AuthStorageError11("invalid_device_authorization", "[Sixb] Device authorization is invalid.");
   }
 }
@@ -9920,6 +10117,100 @@ function isDuplicateExecutionError(error) {
   return error instanceof Error && error.message.includes("UNIQUE constraint failed: executions.project_id, executions.id");
 }
 
+// src/file-upload-session-storage.ts
+import {
+  DurableFileUploadSessions,
+  fileUploadSessionReapAt,
+  parseFileUploadSessionRow
+} from "@sixb/core/internal/file-upload-session-storage-provider";
+class SqliteFileUploadSessionStorage extends DurableFileUploadSessions {
+  constructor(connection) {
+    super(new SqliteFileUploadSessionBackend(connection.db));
+  }
+}
+
+class SqliteFileUploadSessionBackend {
+  db;
+  persistence;
+  constructor(db) {
+    this.db = db;
+    this.persistence = new SqliteFileUploadSessionPersistence(db);
+  }
+  read(run) {
+    return run(this.persistence);
+  }
+  transaction(run) {
+    return runImmediateTransactionAsync(this.db, () => run(this.persistence));
+  }
+}
+
+class SqliteFileUploadSessionPersistence {
+  db;
+  constructor(db) {
+    this.db = db;
+  }
+  async now() {
+    const row = this.db.query("SELECT strftime('%Y-%m-%dT%H:%M:%fZ', 'now') AS now").get();
+    return new Date(row.now);
+  }
+  async insert(session) {
+    try {
+      this.db.query(`INSERT INTO file_upload_sessions (
+            id, project_id, owner_principal_type, owner_principal_id, strategy, status, file_name,
+            media_type, logical_path, expected_size_bytes, expected_digest, provider_upload, signed_parts, file_ref,
+            created_at, expires_at, completed_at, aborted_at, reap_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(session.id, session.projectId, session.principal.type, session.principal.id, session.strategy, session.status, session.fileName ?? null, session.mediaType ?? null, session.logicalPath ?? null, session.expectedSizeBytes ?? null, session.expectedDigest ?? null, ...mutableColumns(session));
+      return true;
+    } catch (error) {
+      if (isUniqueConstraintError2(error))
+        return false;
+      throw error;
+    }
+  }
+  async get(uploadId) {
+    const row = this.db.query(`${SELECT_SESSION} WHERE id = ?`).get(uploadId);
+    return row ? parseFileUploadSessionRow(row) : null;
+  }
+  async update(session) {
+    this.db.query(`UPDATE file_upload_sessions
+         SET status = ?, provider_upload = ?, signed_parts = ?, file_ref = ?, created_at = ?,
+             expires_at = ?, completed_at = ?, aborted_at = ?, reap_at = ?
+         WHERE id = ?`).run(session.status, ...mutableColumns(session), session.id);
+  }
+  async listAbandoned(input) {
+    const rows = this.db.query(`${SELECT_SESSION}
+         WHERE project_id = ? AND status = 'pending' AND provider_upload IS NOT NULL
+           AND expires_at <= ?
+         ORDER BY expires_at, id
+         LIMIT ?`).all(input.projectId, input.now.toISOString(), input.limit);
+    return rows.map((row) => parseFileUploadSessionRow(row));
+  }
+  async deleteReapable(now) {
+    return this.db.query("DELETE FROM file_upload_sessions WHERE reap_at IS NOT NULL AND reap_at <= ?").run(now.toISOString()).changes;
+  }
+}
+var SELECT_SESSION = `
+  SELECT id, project_id AS projectId, owner_principal_type AS ownerPrincipalType,
+    owner_principal_id AS ownerPrincipalId, strategy, status,
+    file_name AS fileName, media_type AS mediaType, logical_path AS logicalPath,
+    expected_size_bytes AS expectedSizeBytes, expected_digest AS expectedDigest,
+    provider_upload AS providerUpload, signed_parts AS signedParts, file_ref AS fileRef,
+    created_at AS createdAt, expires_at AS expiresAt, completed_at AS completedAt,
+    aborted_at AS abortedAt
+  FROM file_upload_sessions`;
+function mutableColumns(session) {
+  return [
+    session.providerUpload === undefined ? null : JSON.stringify(session.providerUpload),
+    JSON.stringify(session.signedParts),
+    session.fileRef === undefined ? null : JSON.stringify(session.fileRef),
+    session.createdAt.toISOString(),
+    session.expiresAt.toISOString(),
+    session.completedAt?.toISOString() ?? null,
+    session.abortedAt?.toISOString() ?? null,
+    fileUploadSessionReapAt(session)?.toISOString() ?? null
+  ];
+}
+
 // src/objects/storage.ts
 import { hasVectorProfile as hasVectorProfile3 } from "@sixb/core/internal/query";
 
@@ -10554,9 +10845,9 @@ function compilePredicate(predicate) {
       return negatePredicate(item);
     }
     case "eq":
-      return compileEqualityPredicate(predicate.propertyId, "eq", predicate.value);
+      return predicate.scalarKind === "userRef" ? compileUserRefInPredicate(predicate.propertyId, [predicate.value]) : compileEqualityPredicate(predicate.propertyId, "eq", predicate.value);
     case "neq":
-      return compileEqualityPredicate(predicate.propertyId, "neq", predicate.value);
+      return predicate.scalarKind === "userRef" ? negatePredicate(compileUserRefInPredicate(predicate.propertyId, [predicate.value])) : compileEqualityPredicate(predicate.propertyId, "neq", predicate.value);
     case "lt":
     case "lte":
     case "gt":
@@ -10568,16 +10859,52 @@ function compilePredicate(predicate) {
       };
     }
     case "in":
-      return compileInPredicate(predicate.propertyId, predicate.values);
+      return predicate.scalarKind === "userRef" ? compileUserRefInPredicate(predicate.propertyId, predicate.values) : compileInPredicate(predicate.propertyId, predicate.values);
     case "exists": {
       const sql = `${jsonTypeExpression()} IS NOT NULL`;
       const item = { sql, args: [jsonPath(predicate.propertyId)] };
       return predicate.value ? item : negatePredicate(item);
     }
     case "contains":
-      return compileContainsPredicate(predicate.propertyId, predicate.value);
+      return predicate.scalarKind === "userRef" ? compileUserRefContainsPredicate(predicate.propertyId, predicate.value) : compileContainsPredicate(predicate.propertyId, predicate.value);
   }
 }
+function compileUserRefInPredicate(propertyId, values) {
+  const path = jsonPath(propertyId);
+  const ids = values.flatMap((value) => {
+    const id = userRefId(value);
+    return id === undefined ? [] : [id];
+  });
+  const clauses = [];
+  const args = [];
+  if (values.includes(null)) {
+    clauses.push(`${jsonTypeExpression()} = 'null'`);
+    args.push(path);
+  }
+  if (ids.length > 0) {
+    clauses.push(`(${jsonValueExpression()} = 'user' AND ${jsonValueExpression()} IN (${ids.map(() => "?").join(", ")}))`);
+    args.push(`${path}.type`, `${path}.id`, ...ids);
+  }
+  if (clauses.length === 0)
+    return { sql: "0 = 1", args: [] };
+  return { sql: `(${clauses.join(" OR ")})`, args };
+}
+function compileUserRefContainsPredicate(propertyId, value) {
+  const id = userRefId(value);
+  if (id === undefined)
+    return { sql: "0 = 1", args: [] };
+  const path = jsonPath(propertyId);
+  return {
+    sql: `(${jsonTypeExpression()} = 'array' AND EXISTS (SELECT 1 FROM json_each(properties, ?) AS item WHERE item.type = 'object' AND json_extract(item.value, '$.type') = 'user' AND json_extract(item.value, '$.id') = ?))`,
+    args: [path, path, id]
+  };
+}
+function userRefId(value) {
+  if (typeof value !== "object" || value === null)
+    return;
+  const { type, id } = value;
+  return type === "user" && typeof id === "string" ? id : undefined;
+}
 function negatePredicate(predicate) {
   return {
     sql: `(NOT COALESCE((${predicate.sql}), 0))`,
@@ -11308,6 +11635,9 @@ function sqliteFacetValue(valueType, value) {
     return false;
   if (valueType === "null")
     return null;
+  if ((valueType === "object" || valueType === "array") && typeof value === "string") {
+    return JSON.parse(value);
+  }
   return value;
 }
 function existsProbeQuery(query) {
@@ -11744,7 +12074,8 @@ var SQLITE_OBJECT_QUERY_CAPABILITIES = {
     double: { equality: true, ordering: true },
     decimal: { equality: true },
     date: { equality: true, ordering: true },
-    timestamp: { equality: true, ordering: true }
+    timestamp: { equality: true, ordering: true },
+    userRef: { equality: true }
   },
   limits: {
     totalCount: true,
@@ -11938,7 +12269,10 @@ function commitRecord(row) {
     requestHash: row.request_hash,
     executionId: row.execution_id,
     origin: parseJson2(row.origin),
-    ...row.actor === null ? {} : { actor: parseJson2(row.actor) },
+    ...row.requested_by === null ? {} : {
+      requestedBy: parseJson2(row.requested_by)
+    },
+    executor: parseJson2(row.executor),
     ontologyRevision: row.ontology_revision,
     ...row.projection_revision === null ? {} : { projectionRevision: row.projection_revision },
     ...row.ownership_hash === null ? {} : { ownershipHash: row.ownership_hash },
@@ -12092,6 +12426,9 @@ import {
   telemetryPointSortKey as telemetryPointSortKey2
 } from "@sixb/core/internal/materialization";
 import {
+  assertExpectedLinkRevision,
+  assertExpectedLinkScopeRevision,
+  assertExpectedObjectRevision,
   assertMaterializationFinalizationCorrelation,
   assertMaterializationHeader,
   assertMaterializationLaneCompletion,
@@ -13587,15 +13924,15 @@ class SqliteOntologyMaterializationStorage {
       const reader = new SqliteMaterializationStateReader(this.db, input.commit.projectId);
       for (const expected of input.expected.sources)
         this.assertSource(expected, input.commit.projectId);
-      for (const expected of input.expected.objects)
-        this.assertObject(reader, expected);
-      for (const expected of input.expected.links)
-        this.assertLink(reader, expected);
+      for (const expected of input.expected.objects) {
+        assertExpectedObjectRevision(reader.effectiveObjectRevision(expected.ref), expected);
+      }
+      for (const expected of input.expected.links) {
+        assertExpectedLinkRevision(reader.effectiveLinkLastCommit(expected.ref), expected);
+      }
       const linkScopeRevisions = reader.linkScopeRevisions(input.expected.linkScopes);
       for (const [index, expected] of input.expected.linkScopes.entries()) {
-        if (linkScopeRevisions[index]?.fingerprint !== expected.fingerprint) {
-          throw new MaterializationConflictError6("effective-state", `Expected link scope changed for ${expected.source.objectTypeId}:${expected.source.primaryId}.${expected.linkId}.`);
-        }
+        assertExpectedLinkScopeRevision(linkScopeRevisions[index]?.fingerprint, expected);
       }
       for (const expected of input.expected.points) {
         const point = reader.exactPoint(expected.series, expected.at);
@@ -13828,30 +14165,6 @@ class SqliteOntologyMaterializationStorage {
       throw new MaterializationConflictError6("projection-fence", `Source '${expected.source.projectionId}' changed.`);
     }
   }
-  assertObject(reader, expected) {
-    const row = reader.effectiveObjectRevision(expected.ref);
-    if (!expected.exists) {
-      if (row) {
-        throw new MaterializationConflictError6("effective-state", `Expected object ${objectRefKey3(expected.ref)} to be absent.`);
-      }
-      return;
-    }
-    if (!row || row.version !== expected.version || row.lastCommitId !== expected.lastCommitId) {
-      throw new MaterializationConflictError6("effective-state", `Expected object ${objectRefKey3(expected.ref)} changed.`);
-    }
-  }
-  assertLink(reader, expected) {
-    const lastCommitId = reader.effectiveLinkLastCommit(expected.ref);
-    if (!expected.exists) {
-      if (lastCommitId !== undefined) {
-        throw new MaterializationConflictError6("effective-state", `Expected link ${linkRefKey3(expected.ref)} to be absent.`);
-      }
-      return;
-    }
-    if (lastCommitId === undefined || lastCommitId !== expected.lastCommitId) {
-      throw new MaterializationConflictError6("effective-state", `Expected link ${linkRefKey3(expected.ref)} changed.`);
-    }
-  }
   async assertFinalization(session, input) {
     const { commit } = session.header;
     const { result } = input.finalization;
@@ -13988,11 +14301,13 @@ class SqliteOntologyMaterializationStorage {
       this.db.query(`
             INSERT INTO ontology_commits (
               project_id, id, idempotency_key, request_hash, execution_id,
-              origin_kind, origin_run_id, origin_batch_ordinal, origin, actor,
+              origin_kind, origin_run_id, origin_batch_ordinal, origin, requested_by, executor,
               ontology_revision, projection_revision, ownership_hash,
               intent, result, committed_at
-            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, json(?), json(?), ?, ?, ?, json(?), json(?), ?)
-          `).run(commit.projectId, commit.id, commit.idempotencyKey, commit.requestHash, commit.executionId, origin.kind, origin.runId, origin.batchOrdinal, canonicalJson(commit.origin), commit.actor === undefined ? null : canonicalJson(commit.actor), commit.ontologyRevision, commit.projectionRevision ?? null, commit.ownershipHash ?? null, canonicalJson(commit.intent), canonicalJson(input.finalization.result), commit.committedAt);
+            ) VALUES (
+              ?, ?, ?, ?, ?, ?, ?, ?, json(?), json(?), json(?), ?, ?, ?, json(?), json(?), ?
+            )
+          `).run(commit.projectId, commit.id, commit.idempotencyKey, commit.requestHash, commit.executionId, origin.kind, origin.runId, origin.batchOrdinal, canonicalJson(commit.origin), commit.requestedBy === undefined ? null : canonicalJson(commit.requestedBy), canonicalJson(commit.executor), commit.ontologyRevision, commit.projectionRevision ?? null, commit.ownershipHash ?? null, canonicalJson(commit.intent), canonicalJson(input.finalization.result), commit.committedAt);
     } catch (error) {
       if (isSqliteConstraintError(error)) {
         throw new MaterializationConflictError6("idempotency", "Ontology commit identity already exists.");
@@ -16620,7 +16935,7 @@ class SqliteWorkflowInterventionStorage {
             submitted_by = ?,
             response = ?
           WHERE project_id = ? AND id = ?
-        `).run("submitted", (input.submittedAt ?? new Date).toISOString(), serializeActor(input.submittedBy), serializeRecord(input.response), existing.project_id, existing.id);
+        `).run("submitted", (input.submittedAt ?? new Date).toISOString(), serializePrincipal(input.submittedBy), serializeRecord(input.response), existing.project_id, existing.id);
       return this.requireIntervention(input.projectId, input.id);
     })();
   }
@@ -16634,7 +16949,7 @@ class SqliteWorkflowInterventionStorage {
             cancelled_at = ?,
             cancelled_by = ?
           WHERE project_id = ? AND id = ?
-        `).run("cancelled", (input.cancelledAt ?? new Date).toISOString(), serializeActor(input.cancelledBy), existing.project_id, existing.id);
+        `).run("cancelled", (input.cancelledAt ?? new Date).toISOString(), serializePrincipal(input.cancelledBy), existing.project_id, existing.id);
       return this.requireIntervention(input.projectId, input.id);
     })();
   }
@@ -16756,10 +17071,10 @@ function serializeRecord(value) {
 function parseRecord(value) {
   return JSON.parse(value);
 }
-function serializeActor(actor) {
-  return actor ? JSON.stringify(actor) : null;
+function serializePrincipal(principal) {
+  return principal ? JSON.stringify(principal) : null;
 }
-function parseActor(value) {
+function parsePrincipal(value) {
   return value ? JSON.parse(value) : undefined;
 }
 function rowToWorkflowInterventionRecord(row) {
@@ -16779,10 +17094,10 @@ function rowToWorkflowInterventionRecord(row) {
     requestedAt: new Date(row.requested_at),
     expiresAt: row.expires_at ? new Date(row.expires_at) : undefined,
     submittedAt: row.submitted_at ? new Date(row.submitted_at) : undefined,
-    submittedBy: parseActor(row.submitted_by),
+    submittedBy: parsePrincipal(row.submitted_by),
     response: row.response ? parseRecord(row.response) : undefined,
     cancelledAt: row.cancelled_at ? new Date(row.cancelled_at) : undefined,
-    cancelledBy: parseActor(row.cancelled_by),
+    cancelledBy: parsePrincipal(row.cancelled_by),
     expiredAt: row.expired_at ? new Date(row.expired_at) : undefined
   };
 }
@@ -17445,6 +17760,7 @@ class SqliteStorage {
   shareGrants;
   shareSessions;
   connectorConnections;
+  fileUploadSessions;
   migrators;
   connection;
   readConnection;
@@ -17495,6 +17811,7 @@ class SqliteStorage {
     this.shareGrants = createOperationScopedFacade(stores.shareGrants, scope);
     this.shareSessions = createOperationScopedFacade(stores.shareSessions, scope);
     this.connectorConnections = createOperationScopedFacade(stores.connectorConnections, scope);
+    this.fileUploadSessions = createOperationScopedFacade(stores.fileUploadSessions, scope);
     this.migrators = options.path ? createSqliteStorageMigrators(options.path) : [];
     registerSqliteStorageTestingAdapter(this, (durationMs) => stores.connectorConnections.advanceTimeForTesting(durationMs));
   }
@@ -17619,7 +17936,8 @@ function createSqliteStores(connection, options) {
     rules: new SqliteRulesStorage({ connection }),
     shareGrants,
     shareSessions,
-    connectorConnections: new SqliteConnectorConnectionStorage(connection)
+    connectorConnections: new SqliteConnectorConnectionStorage(connection),
+    fileUploadSessions: new SqliteFileUploadSessionStorage(connection)
   };
 }
 export {
@@ -17627,4 +17945,4 @@ export {
   migrateSqliteStorage
 };
 
-//# debugId=23F5EFFEE42C282464756E2164756E21
+//# debugId=9F25188860B63C3464756E2164756E21