@sixb/sqlite 0.1.20 → 0.1.21

package/src/artifact-storage.ts

@@ -0,0 +1,356 @@
+import type { Database, SQLQueryBindings } from "bun:sqlite"
+import {
+  artifactStorageErrors,
+  parseArtifactFrameGrantRow,
+  parseArtifactRow,
+  parseArtifactVersionRow,
+} from "@sixb/core/internal/storage"
+import type {
+  ArtifactFrameGrantRecord,
+  ArtifactRecord,
+  ArtifactStorage,
+  ArtifactVersionInput,
+  ArtifactVersionRecord,
+  CreateArtifactInput,
+  DeleteArtifactInput,
+  DeleteArtifactVersionsByOriginInput,
+  DeleteExpiredArtifactFrameGrantsInput,
+  FindArtifactFrameGrantInput,
+  GetArtifactInput,
+  GetArtifactVersionInput,
+  ListArtifactsInput,
+  ListArtifactsResult,
+  ListArtifactVersionsInput,
+  ListArtifactVersionsResult,
+  ListReferencingVersionsInput,
+  PublishArtifactVersionInput,
+  PublishedArtifactVersion,
+} from "@sixb/core/storage"
+import { runImmediateTransaction, type SqliteStoreConnection } from "./transactions"
+
+const ARTIFACT_COLUMNS = `
+  project_id AS projectId, id, kind, title,
+  owner_principal_type AS ownerPrincipalType, owner_principal_id AS ownerPrincipalId,
+  latest_version AS latestVersion, created_at AS createdAt, updated_at AS updatedAt
+`
+
+const VERSION_COLUMNS = `
+  project_id AS projectId, artifact_id AS artifactId, version, title, entry, files, outline, refs,
+  author_principal_type AS authorPrincipalType, author_principal_id AS authorPrincipalId,
+  origin_thread_id AS originThreadId, origin_run_id AS originRunId, created_at AS createdAt
+`
+
+const FRAME_GRANT_COLUMNS = `
+  project_id AS projectId, token_hash AS tokenHash, artifact_id AS artifactId, version, targets,
+  created_at AS createdAt, expires_at AS expiresAt
+`
+
+type Row = Record<string, unknown>
+
+export class SqliteArtifactStorage implements ArtifactStorage {
+  private readonly db: Database
+
+  constructor(connection: SqliteStoreConnection) {
+    this.db = connection.db
+  }
+
+  async create(input: CreateArtifactInput): Promise<PublishedArtifactVersion> {
+    return runImmediateTransaction(this.db, () => {
+      const createdAt = input.version.createdAt.toISOString()
+      const artifact = this.db
+        .query(
+          `INSERT INTO artifacts (
+            project_id, id, kind, title, owner_principal_type, owner_principal_id,
+            latest_version, next_version, created_at, updated_at
+          ) VALUES (?, ?, ?, ?, ?, ?, 1, 2, ?, ?)
+          ON CONFLICT (project_id, id) DO NOTHING
+          RETURNING ${ARTIFACT_COLUMNS}`
+        )
+        .get(
+          input.projectId,
+          input.id,
+          input.kind,
+          input.version.title,
+          input.owner.type,
+          input.owner.id,
+          createdAt,
+          createdAt
+        ) as Row | null
+      if (!artifact) throw artifactStorageErrors.exists(input.id)
+      return {
+        artifact: parseArtifactRow(artifact),
+        version: this.insertVersion(input.projectId, input.id, 1, input.version),
+      }
+    })
+  }
+
+  async publish(input: PublishArtifactVersionInput): Promise<PublishedArtifactVersion> {
+    return runImmediateTransaction(this.db, () => {
+      const current = this.db
+        .query(
+          "SELECT kind, next_version AS nextVersion FROM artifacts WHERE project_id = ? AND id = ?"
+        )
+        .get(input.projectId, input.artifactId) as {
+        readonly kind: ArtifactRecord["kind"]
+        readonly nextVersion: number
+      } | null
+      if (!current) throw artifactStorageErrors.notFound(input.artifactId)
+      if (current.kind !== input.kind) {
+        throw artifactStorageErrors.kindMismatch(input.artifactId, current.kind, input.kind)
+      }
+      const version = this.insertVersion(
+        input.projectId,
+        input.artifactId,
+        current.nextVersion,
+        input.version
+      )
+      const artifact = this.db
+        .query(
+          `UPDATE artifacts
+           SET title = ?, latest_version = ?, next_version = ?, updated_at = ?
+           WHERE project_id = ? AND id = ?
+           RETURNING ${ARTIFACT_COLUMNS}`
+        )
+        .get(
+          input.version.title,
+          version.version,
+          version.version + 1,
+          input.version.createdAt.toISOString(),
+          input.projectId,
+          input.artifactId
+        ) as Row
+      return { artifact: parseArtifactRow(artifact), version }
+    })
+  }
+
+  async get(input: GetArtifactInput): Promise<ArtifactRecord | null> {
+    const row = this.db
+      .query(`SELECT ${ARTIFACT_COLUMNS} FROM artifacts WHERE project_id = ? AND id = ?`)
+      .get(input.projectId, input.id) as Row | null
+    return row ? parseArtifactRow(row) : null
+  }
+
+  async list(input: ListArtifactsInput): Promise<ListArtifactsResult> {
+    const where = ["a.project_id = ?"]
+    const params: SQLQueryBindings[] = [input.projectId]
+    if (input.owner) {
+      where.push("a.owner_principal_type = ? AND a.owner_principal_id = ?")
+      params.push(input.owner.type, input.owner.id)
+    }
+    if (input.originThreadId !== undefined) {
+      where.push(
+        `EXISTS (
+          SELECT 1 FROM artifact_versions v
+          WHERE v.project_id = a.project_id AND v.artifact_id = a.id AND v.origin_thread_id = ?
+        )`
+      )
+      params.push(input.originThreadId)
+    }
+    if (input.kind !== undefined) {
+      where.push("a.kind = ?")
+      params.push(input.kind)
+    }
+    const clause = where.join(" AND ")
+    const { total } = this.db
+      .query(`SELECT COUNT(*) AS total FROM artifacts a WHERE ${clause}`)
+      .get(...params) as { readonly total: number }
+    const offset = input.offset ?? 0
+    const rows = this.db
+      .query(
+        `SELECT ${ARTIFACT_COLUMNS} FROM artifacts a WHERE ${clause}
+         ORDER BY a.updated_at DESC, a.id ASC LIMIT ? OFFSET ?`
+      )
+      .all(...params, input.limit ?? -1, offset) as Row[]
+    return {
+      artifacts: rows.map(parseArtifactRow),
+      hasMore: offset + rows.length < total,
+      total,
+    }
+  }
+
+  async getVersion(input: GetArtifactVersionInput): Promise<ArtifactVersionRecord | null> {
+    const row = this.db
+      .query(
+        `SELECT ${VERSION_COLUMNS} FROM artifact_versions
+         WHERE project_id = ? AND artifact_id = ? AND version = ?`
+      )
+      .get(input.projectId, input.artifactId, input.version) as Row | null
+    return row ? parseArtifactVersionRow(row) : null
+  }
+
+  async listVersions(input: ListArtifactVersionsInput): Promise<ListArtifactVersionsResult> {
+    const { total } = this.db
+      .query(
+        "SELECT COUNT(*) AS total FROM artifact_versions WHERE project_id = ? AND artifact_id = ?"
+      )
+      .get(input.projectId, input.artifactId) as { readonly total: number }
+    const offset = input.offset ?? 0
+    const rows = this.db
+      .query(
+        `SELECT ${VERSION_COLUMNS} FROM artifact_versions
+         WHERE project_id = ? AND artifact_id = ?
+         ORDER BY version DESC LIMIT ? OFFSET ?`
+      )
+      .all(input.projectId, input.artifactId, input.limit ?? -1, offset) as Row[]
+    return {
+      versions: rows.map(parseArtifactVersionRow),
+      hasMore: offset + rows.length < total,
+      total,
+    }
+  }
+
+  async listReferencingVersions(
+    input: ListReferencingVersionsInput
+  ): Promise<ArtifactVersionRecord[]> {
+    // An address names the artifact when the id is followed by nothing, a version, a file, or a
+    // part.
+    const prefix = `artifact:${input.artifactId}`
+    const rows = this.db
+      .query(
+        `SELECT ${VERSION_COLUMNS} FROM artifact_versions v
+         WHERE (project_id, artifact_id, version) IN (
+           SELECT project_id, id, latest_version FROM artifacts WHERE project_id = ?
+         ) AND EXISTS (
+           SELECT 1 FROM json_each(v.refs) r
+           WHERE substr(json_extract(r.value, '$.address'), 1, ?) = ?
+             AND substr(json_extract(r.value, '$.address'), ? + 1, 1) IN ('', '@', '/', '#')
+         )
+         ORDER BY artifact_id`
+      )
+      .all(input.projectId, prefix.length, prefix, prefix.length) as Row[]
+    return rows.map(parseArtifactVersionRow)
+  }
+
+  async createFrameGrant(record: ArtifactFrameGrantRecord): Promise<void> {
+    runImmediateTransaction(this.db, () => {
+      const exists = this.db
+        .query("SELECT 1 FROM artifacts WHERE project_id = ? AND id = ?")
+        .get(record.projectId, record.artifactId)
+      if (!exists) throw artifactStorageErrors.notFound(record.artifactId)
+      this.db
+        .query(
+          `INSERT INTO artifact_frame_grants
+             (project_id, token_hash, artifact_id, version, targets, created_at, expires_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?)`
+        )
+        .run(
+          record.projectId,
+          record.tokenHash,
+          record.artifactId,
+          record.version,
+          JSON.stringify(record.targets),
+          record.createdAt.toISOString(),
+          record.expiresAt.toISOString()
+        )
+    })
+  }
+
+  async findFrameGrant(
+    input: FindArtifactFrameGrantInput
+  ): Promise<ArtifactFrameGrantRecord | null> {
+    const row = this.db
+      .query(
+        `SELECT ${FRAME_GRANT_COLUMNS} FROM artifact_frame_grants
+         WHERE project_id = ? AND token_hash = ?`
+      )
+      .get(input.projectId, input.tokenHash) as Row | null
+    return row ? parseArtifactFrameGrantRow(row) : null
+  }
+
+  async deleteExpiredFrameGrants(input: DeleteExpiredArtifactFrameGrantsInput): Promise<number> {
+    return this.db
+      .query(
+        `DELETE FROM artifact_frame_grants WHERE rowid IN (
+           SELECT rowid FROM artifact_frame_grants
+           WHERE project_id = ? AND expires_at < ?
+           ORDER BY expires_at LIMIT ?
+         )`
+      )
+      .run(input.projectId, input.expiredBefore.toISOString(), input.limit).changes
+  }
+
+  async delete(input: DeleteArtifactInput): Promise<boolean> {
+    // Versions and frame grants go with the artifact through ON DELETE CASCADE.
+    return (
+      this.db
+        .query("DELETE FROM artifacts WHERE project_id = ? AND id = ?")
+        .run(input.projectId, input.id).changes > 0
+    )
+  }
+
+  async deleteVersionsByOrigin(input: DeleteArtifactVersionsByOriginInput): Promise<number> {
+    return runImmediateTransaction(this.db, () => {
+      const affected = this.db
+        .query(
+          `SELECT DISTINCT artifact_id AS artifactId FROM artifact_versions
+           WHERE project_id = ? AND origin_run_id = ?`
+        )
+        .all(input.projectId, input.runId) as { readonly artifactId: string }[]
+      const deleted = this.db
+        .query("DELETE FROM artifact_versions WHERE project_id = ? AND origin_run_id = ?")
+        .run(input.projectId, input.runId).changes
+      for (const { artifactId } of affected) {
+        this.repointLatest(input.projectId, artifactId)
+      }
+      return deleted
+    })
+  }
+
+  /** Point an artifact at its newest remaining version, or delete it when none remains. */
+  private repointLatest(projectId: string, artifactId: string): void {
+    const latest = this.db
+      .query(
+        `SELECT version, title, created_at AS createdAt FROM artifact_versions
+         WHERE project_id = ? AND artifact_id = ? ORDER BY version DESC LIMIT 1`
+      )
+      .get(projectId, artifactId) as {
+      readonly version: number
+      readonly title: string
+      readonly createdAt: string
+    } | null
+    if (!latest) {
+      this.db
+        .query("DELETE FROM artifacts WHERE project_id = ? AND id = ?")
+        .run(projectId, artifactId)
+      return
+    }
+    this.db
+      .query(
+        `UPDATE artifacts SET title = ?, latest_version = ?, updated_at = ?
+         WHERE project_id = ? AND id = ?`
+      )
+      .run(latest.title, latest.version, latest.createdAt, projectId, artifactId)
+  }
+
+  private insertVersion(
+    projectId: string,
+    artifactId: string,
+    version: number,
+    input: ArtifactVersionInput
+  ): ArtifactVersionRecord {
+    const row = this.db
+      .query(
+        `INSERT INTO artifact_versions (
+          project_id, artifact_id, version, title, entry, files, outline, refs,
+          author_principal_type, author_principal_id, origin_thread_id, origin_run_id, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        RETURNING ${VERSION_COLUMNS}`
+      )
+      .get(
+        projectId,
+        artifactId,
+        version,
+        input.title,
+        input.entry,
+        JSON.stringify(input.files),
+        JSON.stringify(input.outline),
+        JSON.stringify(input.references),
+        input.author.type,
+        input.author.id,
+        input.origin?.threadId ?? null,
+        input.origin?.runId ?? null,
+        input.createdAt.toISOString()
+      ) as Row
+    return parseArtifactVersionRow(row)
+  }
+}

package/src/auth-storage/sessions.ts

@@ -2,6 +2,8 @@ import type { Database } from "bun:sqlite"
 import type {
   AuthSessionStore,
   CreateAuthSessionInput,
+  ListAuthSessionsInput,
+  ListAuthSessionsResult,
   RotateSessionRefreshTokenResult,
   SessionRecord,
 } from "@sixb/core/storage"
@@ -60,6 +62,31 @@ export class SqliteAuthSessionStore implements AuthSessionStore {
     return rows.map(rowToSessionRecord)
   }
 
+  async listByUserId(params: ListAuthSessionsInput): Promise<ListAuthSessionsResult> {
+    const rows = this.db
+      .query(
+        `
+        SELECT *
+        FROM auth_sessions
+        WHERE project_id = ? AND user_id = ? AND created_at <= ?
+        ORDER BY created_at DESC, id DESC
+        LIMIT ? OFFSET ?
+      `
+      )
+      .all(
+        params.projectId,
+        params.userId,
+        params.before ? toIso(params.before.createdAt) : "9999-12-31T23:59:59.999Z",
+        params.limit + 1,
+        params.before?.skip ?? 0
+      ) as SqliteAuthSessionRow[]
+
+    return {
+      sessions: rows.slice(0, params.limit).map(rowToSessionRecord),
+      hasMore: rows.length > params.limit,
+    }
+  }
+
   async findValidByTokenHash(params: {
     readonly projectId: string
     readonly id: string

package/src/execution-storage.ts

@@ -1,5 +1,6 @@
 import type { Database } from "bun:sqlite"
 import {
+  compareExecutionCreation,
   type ExecutionStorageRow,
   executionRecordFromStorageRow,
   executionRecordToStorageRow,
@@ -9,6 +10,8 @@ import type {
   CreateExecutionInput,
   ExecutionRecord,
   ExecutionStorage,
+  ListSessionExecutionsInput,
+  SessionExecutions,
   ShareSessionStorage,
 } from "@sixb/core/storage"
 import { ExecutionStorageError } from "@sixb/core/storage"
@@ -115,6 +118,59 @@ export class SqliteExecutionStorage implements ExecutionStorage {
 
     return row ? sqliteExecutionRecord(row) : null
   }
+
+  async listBySession(input: ListSessionExecutionsInput): Promise<SessionExecutions> {
+    const sessionColumn =
+      input.session.type === "user" ? "authority_session_id" : "authority_delegation_session_id"
+
+    // The queue is ordered by depth, so the walk takes roots, then their children level by level,
+    // the earliest first, and the limit stops it: a large tree costs no more than the rows
+    // returned. CROSS JOIN keeps the walk driven by the rows found: statistics taken on a small
+    // ledger choose to scan every child.
+    const rows = this.db
+      .query(
+        `
+        WITH RECURSIVE tree AS (
+          SELECT roots.*, 0 AS depth
+          FROM (
+            SELECT *
+            FROM executions
+            WHERE project_id = ?
+              AND ${sessionColumn} = ?
+              AND parent_execution_id IS NULL
+              AND created_at >= ?
+              AND created_at < ?
+            ORDER BY created_at, id
+            LIMIT ?
+          ) roots
+          UNION ALL
+          SELECT child.*, tree.depth + 1
+          FROM tree
+          CROSS JOIN executions child
+            ON child.project_id = tree.project_id
+            AND child.parent_execution_id = tree.id
+          ORDER BY depth, created_at, id
+          LIMIT ?
+        )
+        SELECT * FROM tree
+      `
+      )
+      .all(
+        input.projectId,
+        input.session.id,
+        input.from.toISOString(),
+        input.to.toISOString(),
+        input.limit + 1,
+        input.limit + 1
+      ) as SqliteExecutionRow[]
+
+    // Rows come out in walk order, so the first `limit` are the ones the contract keeps.
+    const kept = rows.slice(0, input.limit).map(sqliteExecutionRecord)
+    return {
+      executions: kept.sort(compareExecutionCreation),
+      truncated: rows.length > input.limit,
+    }
+  }
 }
 
 /** An `executions` row as its record, for any store that reads executions alongside its own rows. */

package/src/index.ts

@@ -32,10 +32,12 @@ import {
   StorageTransactionError,
 } from "@sixb/core/storage"
 import { SqliteActionRunStorage } from "./action-run-storage"
+import { SqliteActivityStorage } from "./activity-storage"
 import { SqliteAgentStorage } from "./agents"
 import { SqliteAiCostStorage } from "./ai-cost-storage"
 import { SqliteAiLimitStorage } from "./ai-limit-storage"
 import { SqliteAiUsageStorage } from "./ai-usage-storage"
+import { SqliteArtifactStorage } from "./artifact-storage"
 import { SqliteAuthStorage } from "./auth-storage"
 import { SqliteConnectorConnectionStorage } from "./connector-connection-storage"
 import { SqliteExecutionStorage } from "./execution-storage"
@@ -89,6 +91,7 @@ export class SqliteStorage implements MigrationCapableStorage {
   readonly auth: SqliteAuthStorage
   readonly executions: SqliteExecutionStorage
   readonly agents: SqliteAgentStorage
+  readonly artifacts: SqliteArtifactStorage
   readonly aiUsage: AiUsageStorage
   readonly aiCosts: AiCostStorage
   readonly aiLimits: AiLimitStorage
@@ -106,6 +109,7 @@ export class SqliteStorage implements MigrationCapableStorage {
   readonly connectorConnections: SqliteConnectorConnectionStorage
   readonly fileUploadSessions: SqliteFileUploadSessionStorage
   readonly fileDownloadGrants: SqliteFileDownloadGrantStorage
+  readonly activity: SqliteActivityStorage
   readonly migrators: readonly StorageMigrator[]
 
   private readonly connection: SqliteStoreConnection
@@ -153,6 +157,7 @@ export class SqliteStorage implements MigrationCapableStorage {
     this.auth = createAuthOperationScope(stores.auth, scope)
     this.executions = createOperationScopedFacade(stores.executions, scope)
     this.agents = createAgentOperationScope(stores.agents, scope)
+    this.artifacts = createOperationScopedFacade(stores.artifacts, scope)
     this.aiUsage = createOperationScopedFacade(stores.aiUsage, scope)
     this.aiCosts = createOperationScopedFacade(stores.aiCosts, scope)
     this.aiLimits = createOperationScopedFacade(stores.aiLimits, scope)
@@ -170,6 +175,7 @@ export class SqliteStorage implements MigrationCapableStorage {
     this.connectorConnections = createOperationScopedFacade(stores.connectorConnections, scope)
     this.fileUploadSessions = createOperationScopedFacade(stores.fileUploadSessions, scope)
     this.fileDownloadGrants = createOperationScopedFacade(stores.fileDownloadGrants, scope)
+    this.activity = createOperationScopedFacade(stores.activity, scope)
     this.migrators = options.path ? createSqliteStorageMigrators(options.path) : []
     registerSqliteStorageTestingAdapter(this, {
       advanceConnectorConnectionTime: (durationMs) =>
@@ -317,6 +323,7 @@ function createSqliteStores(
     auth,
     executions,
     agents: new SqliteAgentStorage({ connection, executions }),
+    artifacts: new SqliteArtifactStorage(connection),
     aiUsage: new SqliteAiUsageStorage({ connection }),
     aiCosts: new SqliteAiCostStorage(connection),
     aiLimits: new SqliteAiLimitStorage({ connection }),
@@ -334,6 +341,7 @@ function createSqliteStores(
     connectorConnections: new SqliteConnectorConnectionStorage(connection),
     fileUploadSessions: new SqliteFileUploadSessionStorage(connection),
     fileDownloadGrants: new SqliteFileDownloadGrantStorage(connection),
+    activity: new SqliteActivityStorage(connection),
   }
 }
 
@@ -343,6 +351,7 @@ interface SqliteStoreSet {
   readonly auth: SqliteAuthStorage
   readonly executions: SqliteExecutionStorage
   readonly agents: SqliteAgentStorage
+  readonly artifacts: SqliteArtifactStorage
   readonly aiUsage: SqliteAiUsageStorage
   readonly aiCosts: SqliteAiCostStorage
   readonly aiLimits: SqliteAiLimitStorage
@@ -360,6 +369,7 @@ interface SqliteStoreSet {
   readonly connectorConnections: SqliteConnectorConnectionStorage
   readonly fileUploadSessions: SqliteFileUploadSessionStorage
   readonly fileDownloadGrants: SqliteFileDownloadGrantStorage
+  readonly activity: SqliteActivityStorage
 }
 
 export { migrateSqliteStorage } from "./migrations"

package/src/migrations/062-artifacts.sql

@@ -0,0 +1,71 @@
+-- Artifacts: versioned documents, sheets, decks, and files. An artifact's kind never
+-- changes. Versions take `next_version`, which only grows, so a number is never reused after its
+-- version is deleted. Timestamps are ISO-8601 UTC text and compare lexicographically.
+CREATE TABLE artifacts (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  kind TEXT NOT NULL CHECK (kind IN ('document', 'sheet', 'slides', 'file')),
+  title TEXT NOT NULL CHECK (length(trim(title)) > 0),
+  owner_principal_type TEXT NOT NULL
+    CHECK (owner_principal_type IN ('user', 'serviceAccount', 'system')),
+  owner_principal_id TEXT NOT NULL CHECK (length(owner_principal_id) > 0),
+  latest_version INTEGER NOT NULL CHECK (latest_version > 0),
+  next_version INTEGER NOT NULL CHECK (next_version > latest_version),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, id)
+);
+
+CREATE INDEX idx_artifacts_project_updated ON artifacts (project_id, updated_at DESC, id);
+CREATE INDEX idx_artifacts_owner_updated
+  ON artifacts (project_id, owner_principal_type, owner_principal_id, updated_at DESC, id);
+
+-- `refs`, not `references`: that word is reserved in SQL.
+CREATE TABLE artifact_versions (
+  project_id TEXT NOT NULL,
+  artifact_id TEXT NOT NULL,
+  version INTEGER NOT NULL CHECK (version > 0),
+  title TEXT NOT NULL CHECK (length(trim(title)) > 0),
+  entry TEXT NOT NULL CHECK (length(entry) > 0),
+  files TEXT NOT NULL CHECK (json_type(files) = 'array'),
+  outline TEXT NOT NULL CHECK (json_type(outline) = 'object'),
+  refs TEXT NOT NULL CHECK (json_type(refs) = 'array'),
+  author_principal_type TEXT NOT NULL
+    CHECK (author_principal_type IN ('user', 'serviceAccount', 'system')),
+  author_principal_id TEXT NOT NULL CHECK (length(author_principal_id) > 0),
+  origin_thread_id TEXT,
+  origin_run_id TEXT,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, artifact_id, version),
+  FOREIGN KEY (project_id, artifact_id) REFERENCES artifacts (project_id, id) ON DELETE CASCADE,
+  CHECK ((origin_thread_id IS NULL) = (origin_run_id IS NULL))
+);
+
+CREATE INDEX idx_artifact_versions_origin_run
+  ON artifact_versions (project_id, origin_run_id) WHERE origin_run_id IS NOT NULL;
+CREATE INDEX idx_artifact_versions_origin_thread
+  ON artifact_versions (project_id, origin_thread_id, artifact_id) WHERE origin_thread_id IS NOT NULL;
+
+-- Short-lived links that a sandboxed frame loads a deck's files through. Only the SHA-256 of each
+-- link's token is stored. `targets` is what the frame may show from other artifacts, decided for
+-- its reader when the link was issued: a JSON array of { address, artifactId, version }.
+CREATE TABLE artifact_frame_grants (
+  project_id TEXT NOT NULL,
+  token_hash TEXT NOT NULL CHECK (
+    length(token_hash) = 64
+    AND token_hash = lower(token_hash)
+    AND token_hash NOT GLOB '*[^0-9a-f]*'
+  ),
+  artifact_id TEXT NOT NULL,
+  version INTEGER NOT NULL CHECK (version > 0),
+  targets TEXT NOT NULL CHECK (json_type(targets) = 'array'),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, token_hash),
+  FOREIGN KEY (project_id, artifact_id) REFERENCES artifacts (project_id, id) ON DELETE CASCADE,
+  CHECK (expires_at > created_at)
+);
+
+CREATE INDEX idx_artifact_frame_grants_expiry ON artifact_frame_grants (project_id, expires_at);
+-- Deleting an artifact cascades here.
+CREATE INDEX idx_artifact_frame_grants_artifact ON artifact_frame_grants (project_id, artifact_id);

package/src/migrations/063-drop-output-diagnostics.sql

@@ -0,0 +1,19 @@
+-- The Agent delivers files by publishing artifacts, so a run no longer collects an output
+-- directory or reports on it. Stored `output_*` diagnostics go; a run left with none stores none.
+UPDATE agent_runs
+SET diagnostics = (
+  SELECT CASE WHEN count(*) = 0 THEN NULL ELSE json_group_array(json(value)) END
+  FROM (
+    SELECT value
+    FROM json_each(agent_runs.diagnostics)
+    WHERE json_extract(value, '$.code') NOT LIKE 'output\_%' ESCAPE '\'
+    ORDER BY key
+  )
+)
+WHERE diagnostics IS NOT NULL
+  AND json_valid(diagnostics)
+  AND EXISTS (
+    SELECT 1
+    FROM json_each(agent_runs.diagnostics)
+    WHERE json_extract(value, '$.code') LIKE 'output\_%' ESCAPE '\'
+  );