@sixb/sqlite 0.1.16 → 0.1.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sixb/sqlite",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "SQLite storage provider for Sixb",
   "keywords": [
     "sixb",
@@ -37,10 +37,10 @@
     "prepack": "bun run build"
   },
   "peerDependencies": {
-    "@sixb/core": "0.1.16"
+    "@sixb/core": "0.1.17"
   },
   "devDependencies": {
-    "@sixb/core": "0.1.16",
+    "@sixb/core": "0.1.17",
     "@types/bun": "latest",
     "typescript": "^5.7.0"
   },

package/src/ai-cost-storage.ts

@@ -246,6 +246,7 @@ const SQLITE_ACCOUNTING_OVERVIEW_SQL = `
       usage.cache_write_input_tokens,
       usage.text_output_tokens,
       usage.reasoning_output_tokens,
+      usage.audio_duration_ms,
       usage.reporting_status,
       CASE
         WHEN direct_agent.kind = 'conversation' THEN 'agent'
@@ -330,6 +331,8 @@ const SQLITE_ACCOUNTING_OVERVIEW_SQL = `
     CAST(SUM(text_output_tokens) AS TEXT) AS text_output_tokens_sum,
     CAST(COUNT(reasoning_output_tokens) AS TEXT) AS reasoning_output_tokens_count,
     CAST(SUM(reasoning_output_tokens) AS TEXT) AS reasoning_output_tokens_sum,
+    CAST(COUNT(audio_duration_ms) AS TEXT) AS audio_duration_ms_count,
+    CAST(SUM(audio_duration_ms) AS TEXT) AS audio_duration_ms_sum,
     CAST(SUM(CASE WHEN valuation_status = 'rated' THEN 1 ELSE 0 END) AS TEXT)
       AS rated_call_count,
     CAST(SUM(CASE WHEN valuation_status = 'unpriceable' THEN 1 ELSE 0 END) AS TEXT)
@@ -382,6 +385,7 @@ interface UsageRow {
   readonly call_id: string
   readonly provider_id: string
   readonly requested_model_id: string
+  readonly model_kind: AiModelCallUsageRecord["modelKind"] | null
   readonly requested_reasoning: string | null
   readonly response_model_id: string | null
   readonly response_id: string
@@ -393,6 +397,7 @@ interface UsageRow {
   readonly cache_write_input_tokens: number | null
   readonly text_output_tokens: number | null
   readonly reasoning_output_tokens: number | null
+  readonly audio_duration_ms: number | null
   readonly reporting_status: AiModelCallUsageRecord["usage"]["reportingStatus"]
   readonly raw_usage: string | null
   readonly provider_ids: string | null
@@ -447,6 +452,8 @@ interface AggregateRow {
   readonly text_output_tokens_sum: string | null
   readonly reasoning_output_tokens_count: string
   readonly reasoning_output_tokens_sum: string | null
+  readonly audio_duration_ms_count: string
+  readonly audio_duration_ms_sum: string | null
   readonly rated_call_count: string
   readonly unpriceable_call_count: string
   readonly unvalued_call_count: string
@@ -508,6 +515,7 @@ function aggregateFragmentFromRow(row: AggregateRow): AiAccountingAggregateFragm
         row.reasoning_output_tokens_count,
         row.reasoning_output_tokens_sum
       ),
+      audioDurationMs: meterFragment(row.audio_duration_ms_count, row.audio_duration_ms_sum),
     },
     costs: {
       ...(row.amount_currency === null ||
@@ -587,6 +595,7 @@ function usageFromRow(row: UsageRow, requesterGroupIds: readonly string[]): AiMo
       ? {}
       : { providerIds: normalizeModelProviderIds(JSON.parse(row.provider_ids)) }),
     requestedModelId: row.requested_model_id,
+    ...(row.model_kind === null ? {} : { modelKind: row.model_kind }),
     ...(row.requested_reasoning === null
       ? {}
       : { requestedReasoning: requestedReasoningFromRow(row.requested_reasoning) }),
@@ -609,6 +618,7 @@ function usageFromRow(row: UsageRow, requesterGroupIds: readonly string[]): AiMo
       ...(row.reasoning_output_tokens === null
         ? {}
         : { reasoningOutputTokens: row.reasoning_output_tokens }),
+      ...(row.audio_duration_ms === null ? {} : { audioDurationMs: row.audio_duration_ms }),
       reportingStatus: row.reporting_status,
     },
     ...(row.raw_usage === null

package/src/ai-limit-storage.ts

@@ -2,6 +2,7 @@ import type { SQLQueryBindings } from "bun:sqlite"
 import {
   type AiLimitAccountingEntry,
   aiLimitAmountKey,
+  aiLimitMeterApplies,
   aiLimitQuantityFromAmount,
   aiLimitReservationBuckets,
   aiLimitReservationRequestKey,
@@ -194,7 +195,12 @@ export class SqliteAiLimitStorage implements AiLimitStorage {
       const unavailablePolicies: AiLimitPolicyStatus[] = []
       const unavailableReasons = new Set<"missingEstimate" | "incompleteAccounting">()
       for (const policy of enabledPolicies) {
-        if (!subjectKeys.has(aiLimitSubjectKey(policy.subject))) continue
+        if (
+          !subjectKeys.has(aiLimitSubjectKey(policy.subject)) ||
+          !aiLimitMeterApplies(policy.limit.meter, request.modelKind)
+        ) {
+          continue
+        }
         const limit = normalizeAiLimitAmount(policy.limit)
         const estimate = estimates.get(aiLimitAmountKey(limit))
         const status = this.statusForPolicy(policy, request.period)
@@ -235,7 +241,8 @@ export class SqliteAiLimitStorage implements AiLimitStorage {
       const buckets = aiLimitReservationBuckets(
         enabledPolicies,
         request.subjects,
-        request.estimates
+        request.estimates,
+        request.modelKind
       )
       if (buckets.length === 0) return { status: "notRequired" }
       for (const bucket of buckets) {
@@ -637,6 +644,7 @@ export class SqliteAiLimitStorage implements AiLimitStorage {
           SELECT usage.project_id, usage.id AS usage_record_id, usage.execution_id,
                  usage.attempt, usage.call_id, usage.occurred_at,
                  CAST(usage.total_tokens AS TEXT) AS total_tokens,
+                 usage.model_kind,
                  executions.requested_by_user_id,
                  executions.requested_by_service_account_id,
                  valuations.status AS valuation_status,
@@ -691,6 +699,7 @@ export class SqliteAiLimitStorage implements AiLimitStorage {
           SELECT usage.project_id, usage.id AS usage_record_id, usage.execution_id,
                  usage.attempt, usage.call_id, usage.occurred_at,
                  CAST(usage.total_tokens AS TEXT) AS total_tokens,
+                 usage.model_kind,
                  executions.requested_by_user_id,
                  executions.requested_by_service_account_id,
                  valuations.status AS valuation_status,
@@ -776,6 +785,7 @@ interface AiLimitAccountingRow {
   readonly call_id: string
   readonly occurred_at: string
   readonly total_tokens: string | null
+  readonly model_kind: AiLimitAccountingEntry["modelKind"] | null
   readonly requested_by_user_id: string | null
   readonly requested_by_service_account_id: string | null
   readonly valuation_status: "rated" | "unpriceable" | null
@@ -863,6 +873,7 @@ function accountingEntryFromRow(
     attempt: row.attempt,
     callId: row.call_id,
     occurredAt: new Date(row.occurred_at),
+    ...(row.model_kind === null ? {} : { modelKind: row.model_kind }),
     ...(totalTokens !== undefined && Number.isSafeInteger(totalTokens) ? { totalTokens } : {}),
     requesterGroupIds,
     ...(requester ? { requester } : {}),

package/src/ai-usage-storage.ts

@@ -131,6 +131,7 @@ export class SqliteAiUsageStorage implements AiUsageStorage {
             provider_id,
             provider_ids,
             requested_model_id,
+            model_kind,
             requested_reasoning,
             response_model_id,
             response_id,
@@ -142,12 +143,13 @@ export class SqliteAiUsageStorage implements AiUsageStorage {
             cache_write_input_tokens,
             text_output_tokens,
             reasoning_output_tokens,
+            audio_duration_ms,
             reporting_status,
             raw_usage,
             occurred_at,
             recorded_at
           ) VALUES (
-            ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
+            ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
           )
         `
       )
@@ -160,6 +162,7 @@ export class SqliteAiUsageStorage implements AiUsageStorage {
         record.providerId,
         record.providerIds === undefined ? null : JSON.stringify(record.providerIds),
         record.requestedModelId,
+        record.modelKind ?? null,
         record.requestedReasoning === undefined ? null : JSON.stringify(record.requestedReasoning),
         record.responseModelId ?? null,
         record.responseId,
@@ -171,6 +174,7 @@ export class SqliteAiUsageStorage implements AiUsageStorage {
         record.usage.cacheWriteInputTokens ?? null,
         record.usage.textOutputTokens ?? null,
         record.usage.reasoningOutputTokens ?? null,
+        record.usage.audioDurationMs ?? null,
         record.usage.reportingStatus,
         record.rawUsage === undefined ? null : JSON.stringify(record.rawUsage),
         record.occurredAt.toISOString(),
@@ -236,6 +240,7 @@ export class SqliteAiUsageStorage implements AiUsageStorage {
         ? {}
         : { providerIds: normalizeModelProviderIds(JSON.parse(row.provider_ids)) }),
       requestedModelId: row.requested_model_id,
+      ...(row.model_kind === null ? {} : { modelKind: row.model_kind }),
       ...(row.requested_reasoning === null
         ? {}
         : { requestedReasoning: requestedReasoningFromRow(row.requested_reasoning) }),
@@ -293,6 +298,7 @@ interface AiUsageRow {
   readonly provider_id: string
   readonly provider_ids: string | null
   readonly requested_model_id: string
+  readonly model_kind: AiModelCallUsageRecord["modelKind"] | null
   readonly requested_reasoning: string | null
   readonly response_model_id: string | null
   readonly response_id: string
@@ -304,6 +310,7 @@ interface AiUsageRow {
   readonly cache_write_input_tokens: number | null
   readonly text_output_tokens: number | null
   readonly reasoning_output_tokens: number | null
+  readonly audio_duration_ms: number | null
   readonly reporting_status: AiModelCallUsageRecord["usage"]["reportingStatus"]
   readonly raw_usage: string | null
   readonly occurred_at: string
@@ -345,6 +352,7 @@ function usageFromRow(row: AiUsageRow): AiModelCallUsageInput {
     ...(row.reasoning_output_tokens === null
       ? {}
       : { reasoningOutputTokens: row.reasoning_output_tokens }),
+    ...(row.audio_duration_ms === null ? {} : { audioDurationMs: row.audio_duration_ms }),
   }
 }
 

package/src/execution-storage.ts

@@ -113,10 +113,15 @@ export class SqliteExecutionStorage implements ExecutionStorage {
       )
       .get(params.projectId, params.id) as SqliteExecutionRow | null
 
-    return row ? executionRecordFromStorageRow(toStorageRow(row)) : null
+    return row ? sqliteExecutionRecord(row) : null
   }
 }
 
+/** An `executions` row as its record, for any store that reads executions alongside its own rows. */
+export function sqliteExecutionRecord(row: SqliteExecutionRow): ExecutionRecord {
+  return executionRecordFromStorageRow(toStorageRow(row))
+}
+
 function toStorageRow(row: SqliteExecutionRow): ExecutionStorageRow {
   return {
     projectId: row.project_id,
@@ -152,7 +157,7 @@ function isDuplicateExecutionError(error: unknown): boolean {
   )
 }
 
-interface SqliteExecutionRow {
+export interface SqliteExecutionRow {
   readonly project_id: string
   readonly id: string
   readonly executor_kind: ExecutionStorageRow["executorKind"]

package/src/file-download-grant-storage.ts

@@ -0,0 +1,76 @@
+import type { Database } from "bun:sqlite"
+import { parseFileDownloadGrantRow } from "@sixb/core/internal/storage"
+import type {
+  DeleteExpiredFileDownloadGrantsInput,
+  FileDownloadGrantRecord,
+  FileDownloadGrantStorage,
+  FindFileDownloadGrantInput,
+  RevokeFileDownloadGrantInput,
+} from "@sixb/core/storage"
+import type { SqliteStoreConnection } from "./transactions"
+
+const GRANT_COLUMNS = `
+  project_id AS projectId, id, token_hash AS tokenHash, file, execution_id AS executionId,
+  created_at AS createdAt, expires_at AS expiresAt, revoked_at AS revokedAt
+`
+
+export class SqliteFileDownloadGrantStorage implements FileDownloadGrantStorage {
+  private readonly db: Database
+
+  constructor(connection: SqliteStoreConnection) {
+    this.db = connection.db
+  }
+
+  async create(record: FileDownloadGrantRecord): Promise<void> {
+    this.db
+      .query(
+        `INSERT INTO file_download_grants (
+          project_id, id, token_hash, file, execution_id, created_at, expires_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)`
+      )
+      .run(
+        record.projectId,
+        record.id,
+        record.tokenHash,
+        JSON.stringify(record.file),
+        record.executionId,
+        record.createdAt.toISOString(),
+        record.expiresAt.toISOString()
+      )
+  }
+
+  async findByTokenHash(
+    input: FindFileDownloadGrantInput
+  ): Promise<FileDownloadGrantRecord | null> {
+    const row = this.db
+      .query(
+        `SELECT ${GRANT_COLUMNS} FROM file_download_grants WHERE project_id = ? AND token_hash = ?`
+      )
+      .get(input.projectId, input.tokenHash)
+    return row ? parseFileDownloadGrantRow(row as Record<string, unknown>) : null
+  }
+
+  async revoke(input: RevokeFileDownloadGrantInput): Promise<FileDownloadGrantRecord | null> {
+    const row = this.db
+      .query(
+        `UPDATE file_download_grants SET revoked_at = COALESCE(revoked_at, ?)
+         WHERE project_id = ? AND id = ?
+         RETURNING ${GRANT_COLUMNS}`
+      )
+      .get(input.revokedAt.toISOString(), input.projectId, input.id)
+    return row ? parseFileDownloadGrantRow(row as Record<string, unknown>) : null
+  }
+
+  async deleteExpired(input: DeleteExpiredFileDownloadGrantsInput): Promise<number> {
+    return this.db
+      .query(
+        `DELETE FROM file_download_grants WHERE rowid IN (
+          SELECT rowid FROM file_download_grants
+          WHERE project_id = ? AND expires_at < ?
+          ORDER BY expires_at
+          LIMIT ?
+        )`
+      )
+      .run(input.projectId, input.expiredBefore.toISOString(), input.limit).changes
+  }
+}

package/src/index.ts

@@ -39,6 +39,7 @@ import { SqliteAiUsageStorage } from "./ai-usage-storage"
 import { SqliteAuthStorage } from "./auth-storage"
 import { SqliteConnectorConnectionStorage } from "./connector-connection-storage"
 import { SqliteExecutionStorage } from "./execution-storage"
+import { SqliteFileDownloadGrantStorage } from "./file-download-grant-storage"
 import { SqliteFileUploadSessionStorage } from "./file-upload-session-storage"
 import {
   createSqliteStorageMigrators,
@@ -108,6 +109,7 @@ export class SqliteStorage implements MigrationCapableStorage {
   readonly shareSessions: ShareSessionStorage
   readonly connectorConnections: SqliteConnectorConnectionStorage
   readonly fileUploadSessions: SqliteFileUploadSessionStorage
+  readonly fileDownloadGrants: SqliteFileDownloadGrantStorage
   readonly migrators: readonly StorageMigrator[]
 
   private readonly connection: SqliteStoreConnection
@@ -175,10 +177,13 @@ export class SqliteStorage implements MigrationCapableStorage {
     this.shareSessions = createOperationScopedFacade(stores.shareSessions, scope)
     this.connectorConnections = createOperationScopedFacade(stores.connectorConnections, scope)
     this.fileUploadSessions = createOperationScopedFacade(stores.fileUploadSessions, scope)
+    this.fileDownloadGrants = createOperationScopedFacade(stores.fileDownloadGrants, scope)
     this.migrators = options.path ? createSqliteStorageMigrators(options.path) : []
-    registerSqliteStorageTestingAdapter(this, (durationMs) =>
-      stores.connectorConnections.advanceTimeForTesting(durationMs)
-    )
+    registerSqliteStorageTestingAdapter(this, {
+      advanceConnectorConnectionTime: (durationMs) =>
+        stores.connectorConnections.advanceTimeForTesting(durationMs),
+      db: this.connection.db,
+    })
   }
 
   async ping(): Promise<void> {
@@ -337,6 +342,7 @@ function createSqliteStores(
     shareSessions,
     connectorConnections: new SqliteConnectorConnectionStorage(connection),
     fileUploadSessions: new SqliteFileUploadSessionStorage(connection),
+    fileDownloadGrants: new SqliteFileDownloadGrantStorage(connection),
   }
 }
 
@@ -362,6 +368,7 @@ interface SqliteStoreSet {
   readonly shareSessions: SqliteShareSessionStorage
   readonly connectorConnections: SqliteConnectorConnectionStorage
   readonly fileUploadSessions: SqliteFileUploadSessionStorage
+  readonly fileDownloadGrants: SqliteFileDownloadGrantStorage
 }
 
 export { migrateSqliteStorage } from "./migrations"

package/src/migrations/053-replacement-plans.sql

@@ -0,0 +1,73 @@
+-- The plan of a ready replacement candidate, built outside its commit transaction. Its rows are a
+-- cache the commit verifies again, keyed by the candidate's source version, which outlives it:
+-- maintenance deletes a plan once its candidate is no longer ready, and only then the version.
+CREATE TABLE ontology_replacement_plans (
+  version_id INTEGER PRIMARY KEY REFERENCES ontology_sources (version_id) ON DELETE RESTRICT,
+  project_id TEXT NOT NULL,
+  -- The commit the plan's work carries, at the time fixed when the plan opened.
+  commit_id TEXT NOT NULL,
+  committed_at TEXT NOT NULL,
+  -- The active source the plan replaces, NULL when none was: a plan resumed once that moved
+  -- starts over.
+  replaced_materialization_id TEXT,
+  replaced_last_commit_id TEXT,
+  -- The last commit row every planned identity is known fresh against.
+  watermark INTEGER NOT NULL
+);
+
+-- One row per entity the plan decides. `read_revision` is the revision of the inputs its state was
+-- last read at; `planned_revision` the one its work was planned from, NULL while still to plan.
+-- `classified` and `change` summarize that work for the commit's change counts.
+CREATE TABLE ontology_replacement_plan_identities (
+  version_id INTEGER NOT NULL,
+  entity_kind TEXT NOT NULL CHECK (entity_kind IN ('object', 'link')),
+  identity_key TEXT NOT NULL,
+  sort_key TEXT NOT NULL,
+  diff_required INTEGER NOT NULL CHECK (diff_required IN (0, 1)),
+  read_revision TEXT,
+  planned_revision TEXT,
+  classified INTEGER NOT NULL DEFAULT 0 CHECK (classified IN (0, 1)),
+  change TEXT CHECK (change IN ('created', 'updated', 'deleted')),
+  PRIMARY KEY (version_id, entity_kind, identity_key)
+);
+-- The identities still to plan, in planning order: a round that plans a few again finds them
+-- without walking the rest.
+CREATE INDEX idx_ontology_replacement_plan_identities_unplanned
+  ON ontology_replacement_plan_identities (version_id, entity_kind, sort_key)
+  WHERE planned_revision IS NULL;
+
+-- Planned work, with the same columns as a session's work table plus the identity it belongs to.
+CREATE TABLE ontology_replacement_plan_work (
+  work_id INTEGER NOT NULL,
+  entity_kind TEXT NOT NULL,
+  identity_key TEXT NOT NULL,
+  record_key TEXT NOT NULL,
+  unique_key TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  lane TEXT NOT NULL,
+  major_order INTEGER NOT NULL,
+  minor_order INTEGER NOT NULL,
+  sort_one TEXT NOT NULL,
+  sort_two TEXT NOT NULL,
+  classification_entity_kind TEXT,
+  classification_identity_key TEXT,
+  cardinality_view TEXT,
+  cardinality_occupied INTEGER,
+  cardinality_source_type_id TEXT,
+  cardinality_source_primary_id TEXT,
+  cardinality_link_id TEXT,
+  cardinality_target_type_id TEXT,
+  cardinality_target_primary_id TEXT,
+  payload TEXT NOT NULL CHECK (json_valid(payload)),
+  PRIMARY KEY (work_id, record_key),
+  UNIQUE (work_id, unique_key)
+);
+CREATE INDEX idx_ontology_replacement_plan_work_identity
+  ON ontology_replacement_plan_work (work_id, entity_kind, identity_key);
+-- The few objects whose existence the plan flips, which link expansion starts from.
+CREATE INDEX idx_ontology_replacement_plan_work_incident
+  ON ontology_replacement_plan_work (work_id) WHERE kind = 'incident-object';
+CREATE INDEX idx_ontology_replacement_plan_work_lane
+  ON ontology_replacement_plan_work (
+    work_id, lane, major_order, minor_order, sort_one, sort_two, record_key
+  );

package/src/migrations/054-slim-ontology-outbox.sql

@@ -0,0 +1,21 @@
+-- An outbox event stores what changed and nothing it can be rebuilt from: delivery rebuilds the
+-- event from its commit and the execution that commit ran under. The commit also stops copying
+-- `requested_by` and `executor` from that execution (047): the execution is canonical, immutable,
+-- and already referenced by the commit. The migration step checks beforehand that every stored
+-- event rebuilds exactly as it was stored.
+--
+-- SQLite cannot add a NOT NULL column without a default; every insert supplies the event, and the
+-- UPDATE below replaces the placeholder on every row.
+ALTER TABLE ontology_outbox ADD COLUMN event TEXT NOT NULL DEFAULT '{}' CHECK (json_valid(event));
+UPDATE ontology_outbox SET event = json_object(
+  'payload', CASE
+    WHEN envelope ->> '$.type' IN ('object.created', 'link.created')
+      THEN json_remove(envelope -> '$.payload', '$.propertyChanges')
+    ELSE envelope -> '$.payload'
+  END,
+  'type', envelope ->> '$.type'
+);
+ALTER TABLE ontology_outbox DROP COLUMN envelope;
+
+ALTER TABLE ontology_commits DROP COLUMN requested_by;
+ALTER TABLE ontology_commits DROP COLUMN executor;

package/src/migrations/055-commit-touches.sql

@@ -0,0 +1,31 @@
+-- Every commit records the entities whose plan inputs it changed, so a replacement plan's refresh
+-- rechecks only what the commits since it was last fresh touched, instead of the whole plan.
+CREATE TABLE ontology_commit_touches (
+  project_id TEXT NOT NULL,
+  commit_id TEXT NOT NULL,
+  entity_kind TEXT NOT NULL CHECK (entity_kind IN ('object', 'link', 'scope')),
+  -- `objectRefKey`, `linkRefKey` or `linkScopeKey`.
+  identity_key TEXT NOT NULL
+);
+CREATE INDEX idx_ontology_commit_touches_commit ON ontology_commit_touches (project_id, commit_id);
+
+-- Existing plans predate the touches of the commits since their watermark: they plan again.
+DELETE FROM ontology_replacement_plan_work;
+DELETE FROM ontology_replacement_plan_identities;
+DELETE FROM ontology_replacement_plans;
+
+-- Link expansion starts only from what changed since it last ran: `expansions` counts the runs,
+-- and an identity's `expand_at` is the run that has yet to start from it (an object once planned,
+-- a link once it needs a diff). `source_key` and `target_key` find a link from either endpoint.
+ALTER TABLE ontology_replacement_plans ADD COLUMN expansions INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE ontology_replacement_plan_identities ADD COLUMN expand_at INTEGER;
+ALTER TABLE ontology_replacement_plan_identities ADD COLUMN source_key TEXT;
+ALTER TABLE ontology_replacement_plan_identities ADD COLUMN target_key TEXT;
+CREATE INDEX idx_ontology_replacement_plan_identities_expand
+  ON ontology_replacement_plan_identities (version_id, entity_kind, expand_at);
+CREATE INDEX idx_ontology_replacement_plan_identities_source
+  ON ontology_replacement_plan_identities (version_id, source_key)
+  WHERE source_key IS NOT NULL;
+CREATE INDEX idx_ontology_replacement_plan_identities_target
+  ON ontology_replacement_plan_identities (version_id, target_key)
+  WHERE target_key IS NOT NULL;

package/src/migrations/056-audio-transcription.sql

@@ -0,0 +1,10 @@
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN audio_duration_ms INTEGER
+  CHECK (audio_duration_ms IS NULL OR audio_duration_ms >= 0);
+
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN model_kind TEXT
+  CHECK (
+    model_kind IS NULL
+    OR model_kind IN ('language', 'image', 'video', 'embedding', 'decision', 'transcription')
+  );

package/src/migrations/057-reranking-model-kind.sql

@@ -0,0 +1,16 @@
+-- SQLite cannot alter a CHECK constraint. Swapping the column avoids rebuilding a table that
+-- usage groups, costs and limit reservations reference.
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN model_kind_next TEXT
+  CHECK (
+    model_kind_next IS NULL
+    OR model_kind_next IN (
+      'language', 'image', 'video', 'embedding', 'decision', 'transcription', 'reranking'
+    )
+  );
+
+UPDATE ai_model_call_usage SET model_kind_next = model_kind;
+
+ALTER TABLE ai_model_call_usage DROP COLUMN model_kind;
+
+ALTER TABLE ai_model_call_usage RENAME COLUMN model_kind_next TO model_kind;

package/src/migrations/058-file-download-grants.sql

@@ -0,0 +1,21 @@
+-- URLs issued by blobs.createDownloadUrl(). Only the SHA-256 of each URL's token is stored.
+-- Timestamps are ISO-8601 UTC text and compare lexicographically.
+CREATE TABLE file_download_grants (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  token_hash TEXT NOT NULL CHECK (
+    length(token_hash) = 64
+    AND token_hash = lower(token_hash)
+    AND token_hash NOT GLOB '*[^0-9a-f]*'
+  ),
+  file TEXT NOT NULL CHECK (json_type(file) = 'object'),
+  execution_id TEXT NOT NULL CHECK (length(trim(execution_id)) > 0),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  revoked_at TEXT,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, token_hash),
+  CHECK (expires_at > created_at)
+);
+
+CREATE INDEX idx_file_download_grants_expiry ON file_download_grants (project_id, expires_at);

package/src/migrations/059-drained-source-versions.sql

@@ -0,0 +1,11 @@
+-- A superseded version's `root_count` counts the roots it still holds: cleanup lowers it as it
+-- deletes them. A version that reaches zero is found through this index, instead of every
+-- superseded version being walked and probed for roots on every maintenance pass.
+UPDATE ontology_sources
+SET root_count = (SELECT count(*) FROM ontology_source_roots AS roots
+  WHERE roots.version_id = ontology_sources.version_id)
+WHERE status = 'superseded' AND root_count <> (SELECT count(*) FROM ontology_source_roots AS roots
+  WHERE roots.version_id = ontology_sources.version_id);
+CREATE INDEX idx_ontology_sources_drained
+  ON ontology_sources (project_id, terminal_at, source_id, materialization_id)
+  WHERE status = 'superseded' AND root_count = 0;