@sixb/sqlite 0.1.20 → 0.1.22

package/src/migrations/063-drop-output-diagnostics.sql

@@ -0,0 +1,19 @@
+-- The Agent delivers files by publishing artifacts, so a run no longer collects an output
+-- directory or reports on it. Stored `output_*` diagnostics go; a run left with none stores none.
+UPDATE agent_runs
+SET diagnostics = (
+  SELECT CASE WHEN count(*) = 0 THEN NULL ELSE json_group_array(json(value)) END
+  FROM (
+    SELECT value
+    FROM json_each(agent_runs.diagnostics)
+    WHERE json_extract(value, '$.code') NOT LIKE 'output\_%' ESCAPE '\'
+    ORDER BY key
+  )
+)
+WHERE diagnostics IS NOT NULL
+  AND json_valid(diagnostics)
+  AND EXISTS (
+    SELECT 1
+    FROM json_each(agent_runs.diagnostics)
+    WHERE json_extract(value, '$.code') LIKE 'output\_%' ESCAPE '\'
+  );

package/src/migrations/064-activity.sql

@@ -0,0 +1,61 @@
+-- App activity: one source per verified session, the visits it opened, and their page views.
+-- Foreground activity moves a visit's `last_seen_at` and stores no row, unless it opens a visit.
+-- A session id names an `auth_sessions` row for a user and a `share_sessions` row for a share; it
+-- is not a secret, and no foreign key holds it, so history outlives its sessions. Timestamps are
+-- ISO-8601 UTC text and compare lexicographically.
+CREATE TABLE activity_sources (
+  project_id TEXT NOT NULL,
+  actor_type TEXT NOT NULL CHECK (actor_type IN ('user', 'share')),
+  session_id TEXT NOT NULL CHECK (length(session_id) > 0),
+  visit_id TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL,
+  sequence INTEGER NOT NULL CHECK (sequence >= 0),
+  window_start TEXT NOT NULL,
+  window_count INTEGER NOT NULL CHECK (window_count >= 0),
+  PRIMARY KEY (project_id, actor_type, session_id)
+);
+
+CREATE TABLE activity_visits (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  actor_type TEXT NOT NULL CHECK (actor_type IN ('user', 'share')),
+  user_id TEXT,
+  grant_id TEXT,
+  session_id TEXT NOT NULL CHECK (length(session_id) > 0),
+  started_at TEXT NOT NULL,
+  last_seen_at TEXT NOT NULL CHECK (last_seen_at >= started_at),
+  page_views INTEGER NOT NULL CHECK (page_views >= 0),
+  attribution TEXT CHECK (attribution IS NULL OR json_type(attribution) = 'object'),
+  PRIMARY KEY (project_id, id),
+  CHECK (
+    (actor_type = 'user' AND user_id IS NOT NULL AND grant_id IS NULL)
+    OR (actor_type = 'share' AND user_id IS NULL AND grant_id IS NOT NULL)
+  )
+);
+
+-- A period reads the visits it overlaps. A visit lasts less than a day, so they started in
+-- `[from - 1 day, to)`: both period indexes bound `started_at` on both sides. `last_seen_at` is
+-- left out of every index, so the update each batch makes touches none of them. The user index
+-- also serves deleting one user's history.
+CREATE INDEX idx_activity_visits_started
+  ON activity_visits (project_id, started_at, id);
+CREATE INDEX idx_activity_visits_user
+  ON activity_visits (project_id, user_id, started_at, id);
+-- A session's visits, to join them with the session and the executions it authorized.
+CREATE INDEX idx_activity_visits_session
+  ON activity_visits (project_id, actor_type, session_id);
+
+CREATE TABLE activity_page_views (
+  project_id TEXT NOT NULL,
+  visit_id TEXT NOT NULL,
+  sequence INTEGER NOT NULL CHECK (sequence > 0),
+  id TEXT NOT NULL,
+  route TEXT NOT NULL,
+  received_at TEXT NOT NULL,
+  attribution TEXT CHECK (attribution IS NULL OR json_type(attribution) = 'object'),
+  PRIMARY KEY (project_id, visit_id, sequence),
+  FOREIGN KEY (project_id, visit_id) REFERENCES activity_visits (project_id, id) ON DELETE CASCADE
+);
+
+-- Finds a retried page view by the id its browser chose.
+CREATE INDEX idx_activity_page_views_id ON activity_page_views (project_id, id);

package/src/migrations/065-activity-timeline.sql

@@ -0,0 +1,19 @@
+-- A visit's timeline reads what its session started: the roots it authorized in a window, then
+-- everything they caused. A signed-in session is the credential of its roots, a shared link's
+-- session their delegation; a child names its parent. Agent executions copy their parent's
+-- session: the root indexes hold only executions without a parent, so they never see those, and
+-- end with `id` so the root read's order needs no sort.
+CREATE INDEX idx_executions_session_roots
+  ON executions (project_id, authority_session_id, created_at, id)
+  WHERE authority_session_id IS NOT NULL AND parent_execution_id IS NULL;
+CREATE INDEX idx_executions_delegation_roots
+  ON executions (project_id, authority_delegation_session_id, created_at, id)
+  WHERE authority_delegation_session_id IS NOT NULL AND parent_execution_id IS NULL;
+CREATE INDEX idx_executions_parent
+  ON executions (project_id, parent_execution_id)
+  WHERE parent_execution_id IS NOT NULL;
+
+-- A user's connection history lists all their sessions, revoked and expired ones too, newest
+-- first.
+CREATE INDEX idx_auth_sessions_user_created
+  ON auth_sessions (project_id, user_id, created_at, id);

package/src/migrations/066-activity-interactions.sql

@@ -0,0 +1,20 @@
+-- Interactions an app marks, such as a button: their name and route, never a value. They share
+-- the visit's sequence with its page views, so a visit reads both in the order they happened, and
+-- cascade with the visit, which counts them as it counts its page views.
+ALTER TABLE activity_visits
+  ADD COLUMN interactions INTEGER NOT NULL DEFAULT 0 CHECK (interactions >= 0);
+
+CREATE TABLE activity_interactions (
+  project_id TEXT NOT NULL,
+  visit_id TEXT NOT NULL,
+  sequence INTEGER NOT NULL CHECK (sequence > 0),
+  id TEXT NOT NULL,
+  name TEXT NOT NULL CHECK (length(name) BETWEEN 1 AND 100),
+  route TEXT NOT NULL,
+  received_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, visit_id, sequence),
+  FOREIGN KEY (project_id, visit_id) REFERENCES activity_visits (project_id, id) ON DELETE CASCADE
+);
+
+-- Finds a retried interaction by the id its browser chose.
+CREATE INDEX idx_activity_interactions_id ON activity_interactions (project_id, id);

package/src/migrations/067-artifact-kinds.sql

@@ -0,0 +1,32 @@
+-- Artifacts take two more kinds: pages, and the canvases that lay pages out. SQLite cannot alter a
+-- CHECK constraint, so the table is rebuilt; its versions and frame grants reference it by name.
+CREATE TABLE artifacts_v2 (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  kind TEXT NOT NULL CHECK (kind IN ('document', 'sheet', 'slides', 'page', 'canvas', 'file')),
+  title TEXT NOT NULL CHECK (length(trim(title)) > 0),
+  owner_principal_type TEXT NOT NULL
+    CHECK (owner_principal_type IN ('user', 'serviceAccount', 'system')),
+  owner_principal_id TEXT NOT NULL CHECK (length(owner_principal_id) > 0),
+  latest_version INTEGER NOT NULL CHECK (latest_version > 0),
+  next_version INTEGER NOT NULL CHECK (next_version > latest_version),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, id)
+);
+
+INSERT INTO artifacts_v2 (
+  project_id, id, kind, title, owner_principal_type, owner_principal_id, latest_version,
+  next_version, created_at, updated_at
+)
+SELECT
+  project_id, id, kind, title, owner_principal_type, owner_principal_id, latest_version,
+  next_version, created_at, updated_at
+FROM artifacts;
+
+DROP TABLE artifacts;
+ALTER TABLE artifacts_v2 RENAME TO artifacts;
+
+CREATE INDEX idx_artifacts_project_updated ON artifacts (project_id, updated_at DESC, id);
+CREATE INDEX idx_artifacts_owner_updated
+  ON artifacts (project_id, owner_principal_type, owner_principal_id, updated_at DESC, id);

package/src/migrations/068-artifact-state.sql

@@ -0,0 +1,15 @@
+-- What a page keeps for each of its readers with `sixb.state`: JSON text by key, for one artifact
+-- and one principal, across the artifact's versions. `size_bytes` is the value's UTF-8 length,
+-- which the reader's limits sum. Deleting the artifact cascades here.
+CREATE TABLE artifact_state (
+  project_id TEXT NOT NULL,
+  artifact_id TEXT NOT NULL,
+  principal_type TEXT NOT NULL CHECK (principal_type IN ('user', 'serviceAccount', 'system')),
+  principal_id TEXT NOT NULL CHECK (length(principal_id) > 0),
+  key TEXT NOT NULL CHECK (length(key) > 0),
+  value TEXT NOT NULL CHECK (json_valid(value)),
+  size_bytes INTEGER NOT NULL CHECK (size_bytes >= 0),
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, artifact_id, principal_type, principal_id, key),
+  FOREIGN KEY (project_id, artifact_id) REFERENCES artifacts (project_id, id) ON DELETE CASCADE
+);

package/src/migrations/069-agent-thread-participants.sql

@@ -0,0 +1,16 @@
+-- The users a thread's owner added to the conversation. Only users take part: only a signed-in
+-- user talks to the Agent. Listing the threads shared with someone reads the principal index.
+CREATE TABLE agent_thread_participants (
+  project_id TEXT NOT NULL,
+  thread_id TEXT NOT NULL,
+  principal_type TEXT NOT NULL CHECK (principal_type = 'user'),
+  principal_id TEXT NOT NULL CHECK (length(principal_id) > 0),
+  added_at TEXT NOT NULL,
+  added_by_type TEXT NOT NULL CHECK (added_by_type IN ('user', 'serviceAccount', 'system')),
+  added_by_id TEXT NOT NULL CHECK (length(added_by_id) > 0),
+  PRIMARY KEY (project_id, thread_id, principal_type, principal_id),
+  FOREIGN KEY (project_id, thread_id) REFERENCES agent_threads (project_id, id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_agent_thread_participants_principal
+  ON agent_thread_participants (project_id, principal_type, principal_id, thread_id);

package/src/migrations/070-forked-context-checkpoints.sql

@@ -0,0 +1,45 @@
+-- A forked thread copies the checkpoint its history needs, and the copy keeps the run that wrote
+-- the summary. A run's checkpoint is therefore unique within a thread, not within the project.
+-- SQLite cannot drop a UNIQUE constraint, so the table is rebuilt.
+CREATE TABLE agent_context_checkpoints_v2 (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  thread_id TEXT NOT NULL,
+  created_by_run_id TEXT NOT NULL,
+  previous_checkpoint_id TEXT,
+  reason TEXT NOT NULL CHECK (reason IN ('threshold', 'overflow')),
+  summary TEXT NOT NULL CHECK (length(trim(summary)) > 0),
+  summary_format_version INTEGER NOT NULL CHECK (summary_format_version = 1),
+  summarized_through_seq INTEGER NOT NULL CHECK (summarized_through_seq >= 1),
+  observed_head_seq INTEGER NOT NULL,
+  estimated_input_tokens_before INTEGER NOT NULL CHECK (estimated_input_tokens_before >= 0),
+  estimated_input_tokens_after INTEGER NOT NULL CHECK (estimated_input_tokens_after >= 0),
+  summary_model_id TEXT NOT NULL CHECK (length(trim(summary_model_id)) > 0),
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, thread_id, created_by_run_id),
+  FOREIGN KEY (project_id, thread_id)
+    REFERENCES agent_threads(project_id, id) ON DELETE CASCADE,
+  FOREIGN KEY (project_id, created_by_run_id)
+    REFERENCES agent_runs(project_id, id) ON DELETE RESTRICT,
+  FOREIGN KEY (project_id, previous_checkpoint_id)
+    REFERENCES agent_context_checkpoints(project_id, id) ON DELETE RESTRICT,
+  CHECK (summarized_through_seq < observed_head_seq)
+);
+
+INSERT INTO agent_context_checkpoints_v2 (
+  project_id, id, thread_id, created_by_run_id, previous_checkpoint_id, reason, summary,
+  summary_format_version, summarized_through_seq, observed_head_seq,
+  estimated_input_tokens_before, estimated_input_tokens_after, summary_model_id, created_at
+)
+SELECT
+  project_id, id, thread_id, created_by_run_id, previous_checkpoint_id, reason, summary,
+  summary_format_version, summarized_through_seq, observed_head_seq,
+  estimated_input_tokens_before, estimated_input_tokens_after, summary_model_id, created_at
+FROM agent_context_checkpoints;
+
+DROP TABLE agent_context_checkpoints;
+ALTER TABLE agent_context_checkpoints_v2 RENAME TO agent_context_checkpoints;
+
+CREATE INDEX idx_agent_context_checkpoints_thread_latest
+  ON agent_context_checkpoints(project_id, thread_id, summarized_through_seq DESC, created_at DESC, id DESC);

package/src/migrations/071-unique-values.sql

@@ -0,0 +1,22 @@
+-- The values of unique properties, one row per value an object holds. Every object write keeps
+-- them current, so a write that would give a value to a second object of the type is refused.
+CREATE TABLE object_unique_values (
+  project_id TEXT NOT NULL,
+  object_type_id TEXT NOT NULL,
+  property_id TEXT NOT NULL,
+  value_key TEXT NOT NULL,
+  primary_id TEXT NOT NULL,
+  PRIMARY KEY (project_id, object_type_id, property_id, value_key)
+);
+
+-- The unique properties whose values were built from the objects already stored, and how their
+-- keys were computed. A claim made with other keys is refused until they are built again.
+CREATE TABLE object_unique_properties (
+  project_id TEXT NOT NULL,
+  object_type_id TEXT NOT NULL,
+  property_id TEXT NOT NULL,
+  key_kind TEXT NOT NULL,
+  key_version INTEGER NOT NULL,
+  prepared_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, object_type_id, property_id)
+);

package/src/migrations/072-generated-media-usage.sql

@@ -0,0 +1,32 @@
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN image_output_tokens INTEGER
+  CHECK (image_output_tokens IS NULL OR image_output_tokens >= 0);
+
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN audio_output_tokens INTEGER
+  CHECK (audio_output_tokens IS NULL OR audio_output_tokens >= 0);
+
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN output_images INTEGER
+  CHECK (output_images IS NULL OR output_images >= 0);
+
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN input_characters INTEGER
+  CHECK (input_characters IS NULL OR input_characters >= 0);
+
+-- SQLite cannot alter a CHECK constraint. Swapping the column avoids rebuilding a table that
+-- usage groups, costs and limit reservations reference.
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN model_kind_next TEXT
+  CHECK (
+    model_kind_next IS NULL
+    OR model_kind_next IN (
+      'language', 'image', 'video', 'embedding', 'decision', 'transcription', 'speech', 'reranking'
+    )
+  );
+
+UPDATE ai_model_call_usage SET model_kind_next = model_kind;
+
+ALTER TABLE ai_model_call_usage DROP COLUMN model_kind;
+
+ALTER TABLE ai_model_call_usage RENAME COLUMN model_kind_next TO model_kind;

package/src/migrations/073-model-call-files.sql

@@ -0,0 +1,11 @@
+-- The files a model call produced. The execution that made the call decides who may read them.
+CREATE TABLE ai_model_call_files (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  call_id TEXT NOT NULL CHECK (length(trim(call_id)) > 0),
+  execution_id TEXT NOT NULL CHECK (length(trim(execution_id)) > 0),
+  files TEXT NOT NULL CHECK (json_type(files) = 'array' AND json_array_length(files) > 0),
+  recorded_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, call_id),
+  FOREIGN KEY (project_id, execution_id)
+    REFERENCES executions(project_id, id)
+);

package/src/migrations/074-agent-memory.sql

@@ -0,0 +1,32 @@
+-- Agent memory: each repo, 'user:<userId>' or 'project', is a log of revisions. A save inserts one
+-- revision and the file versions it wrote, and never updates a row. A file's current contents are
+-- its highest-revision version; NULL contents mean that revision deleted it. Timestamps are
+-- ISO-8601 UTC text and compare lexicographically.
+CREATE TABLE agent_memory_revisions (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  repo_id TEXT NOT NULL CHECK (length(trim(repo_id)) > 0),
+  revision INTEGER NOT NULL CHECK (revision > 0),
+  message TEXT NOT NULL CHECK (length(trim(message)) > 0),
+  author_principal_type TEXT NOT NULL
+    CHECK (author_principal_type IN ('user', 'serviceAccount', 'system')),
+  author_principal_id TEXT NOT NULL CHECK (length(author_principal_id) > 0),
+  source TEXT,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, repo_id, revision)
+);
+
+-- A save also removes versions older than 90 days that are not their path's latest, so a
+-- revision's rows here can be fewer than the files it wrote.
+CREATE TABLE agent_memory_files (
+  project_id TEXT NOT NULL,
+  repo_id TEXT NOT NULL,
+  path TEXT NOT NULL CHECK (length(path) > 0),
+  revision INTEGER NOT NULL,
+  contents TEXT,
+  PRIMARY KEY (project_id, repo_id, path, revision),
+  FOREIGN KEY (project_id, repo_id, revision)
+    REFERENCES agent_memory_revisions (project_id, repo_id, revision) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_agent_memory_files_revision
+  ON agent_memory_files (project_id, repo_id, revision);

package/src/migrations/075-artifact-threads.sql

@@ -0,0 +1,21 @@
+-- The threads an artifact is shared in: everyone who reads one of them reads the artifact. An
+-- Agent turn publishing a version links its thread, for as long as a version from it remains; a
+-- forked thread links its copies, `copied`, for as long as they last. Existing versions published
+-- from a thread link it here.
+CREATE TABLE artifact_threads (
+  project_id TEXT NOT NULL,
+  artifact_id TEXT NOT NULL,
+  thread_id TEXT NOT NULL CHECK (length(thread_id) > 0),
+  shared_at TEXT NOT NULL,
+  copied INTEGER NOT NULL DEFAULT 0 CHECK (copied IN (0, 1)),
+  PRIMARY KEY (project_id, artifact_id, thread_id),
+  FOREIGN KEY (project_id, artifact_id) REFERENCES artifacts (project_id, id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_artifact_threads_thread ON artifact_threads (project_id, thread_id, artifact_id);
+
+INSERT INTO artifact_threads (project_id, artifact_id, thread_id, shared_at)
+SELECT project_id, artifact_id, origin_thread_id, MIN(created_at)
+FROM artifact_versions
+WHERE origin_thread_id IS NOT NULL
+GROUP BY project_id, artifact_id, origin_thread_id;

package/src/migrations/076-agent-approvals.sql

@@ -0,0 +1,59 @@
+-- Calls of the Agent that wait for whoever asked for the turn. A call's run id is its key: a
+-- thread holds at most one pending, approved or denied approval per key, and a cancelled,
+-- superseded or expired one lets the same call ask again. Timestamps are ISO-8601 UTC text and
+-- compare lexicographically.
+CREATE TABLE agent_approvals (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  thread_id TEXT NOT NULL,
+  run_id TEXT NOT NULL CHECK (length(run_id) > 0),
+  caller_run_id TEXT NOT NULL CHECK (length(caller_run_id) > 0),
+  requested_by_type TEXT NOT NULL CHECK (requested_by_type IN ('user', 'serviceAccount', 'system')),
+  requested_by_id TEXT NOT NULL CHECK (length(requested_by_id) > 0),
+  mode TEXT NOT NULL CHECK (mode IN ('manual', 'accept-edits')),
+  call_key TEXT NOT NULL CHECK (length(call_key) > 0),
+  call TEXT NOT NULL,
+  status TEXT NOT NULL
+    CHECK (status IN ('pending', 'approved', 'denied', 'cancelled', 'superseded', 'expired')),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  decided_at TEXT,
+  decided_by_type TEXT CHECK (decided_by_type IN ('user', 'serviceAccount', 'system')),
+  decided_by_id TEXT,
+  outcome TEXT,
+  reported_in_message_id TEXT,
+  PRIMARY KEY (project_id, id),
+  FOREIGN KEY (project_id, thread_id) REFERENCES agent_threads (project_id, id) ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX idx_agent_approvals_live_call
+  ON agent_approvals (project_id, thread_id, call_key)
+  WHERE status IN ('pending', 'approved', 'denied');
+
+CREATE INDEX idx_agent_approvals_thread ON agent_approvals (project_id, thread_id, created_at);
+CREATE INDEX idx_agent_approvals_run ON agent_approvals (project_id, run_id, status);
+CREATE INDEX idx_agent_approvals_caller_run ON agent_approvals (project_id, caller_run_id, status);
+CREATE INDEX idx_agent_approvals_requester
+  ON agent_approvals (project_id, requested_by_type, requested_by_id, status);
+
+-- What each user lets the Agent change without asking: a default, then their own choice in a
+-- thread. Absent rows fall back, in that order.
+CREATE TABLE agent_user_settings (
+  project_id TEXT NOT NULL,
+  principal_type TEXT NOT NULL CHECK (principal_type IN ('user', 'serviceAccount', 'system')),
+  principal_id TEXT NOT NULL CHECK (length(principal_id) > 0),
+  approval_mode TEXT NOT NULL CHECK (approval_mode IN ('manual', 'accept-edits', 'auto')),
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, principal_type, principal_id)
+);
+
+CREATE TABLE agent_thread_user_settings (
+  project_id TEXT NOT NULL,
+  thread_id TEXT NOT NULL,
+  principal_type TEXT NOT NULL CHECK (principal_type IN ('user', 'serviceAccount', 'system')),
+  principal_id TEXT NOT NULL CHECK (length(principal_id) > 0),
+  approval_mode TEXT NOT NULL CHECK (approval_mode IN ('manual', 'accept-edits', 'auto')),
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, thread_id, principal_type, principal_id),
+  FOREIGN KEY (project_id, thread_id) REFERENCES agent_threads (project_id, id) ON DELETE CASCADE
+);

package/src/migrations/077-agent-approval-resume.sql

@@ -0,0 +1,20 @@
+-- A paused Agent turn resumes once its requester decided on every call it held. What that needs:
+-- the mode "Always allow" raised the turn to, whether the turn may still resume on a call, and the
+-- claim a process takes before it runs an approved call left without its outcome.
+ALTER TABLE agent_approvals
+  ADD COLUMN raised_mode TEXT CHECK (raised_mode IN ('manual', 'accept-edits', 'auto'));
+ALTER TABLE agent_approvals ADD COLUMN turn_stopped_at TEXT;
+ALTER TABLE agent_approvals ADD COLUMN execution_claimed_at TEXT;
+
+-- The repair pass: calls past their time, approved calls without an outcome, and decided calls of
+-- turns that may still resume. Each index covers only the rows that are still work.
+CREATE INDEX idx_agent_approvals_due
+  ON agent_approvals (project_id, expires_at)
+  WHERE status = 'pending';
+CREATE INDEX idx_agent_approvals_unfinished
+  ON agent_approvals (project_id, created_at, id)
+  WHERE status = 'approved' AND outcome IS NULL;
+CREATE INDEX idx_agent_approvals_resumable
+  ON agent_approvals (project_id, created_at, id)
+  WHERE status IN ('approved', 'denied') AND reported_in_message_id IS NULL
+    AND turn_stopped_at IS NULL;