@sixb/sqlite 0.1.21 → 0.1.22

package/src/auth-storage/users.ts

@@ -5,10 +5,12 @@ import type {
   ListAuthUsersInput,
   ListAuthUsersResult,
   UpdateAuthUserProfileInput,
+  UpdateAuthUserResult,
   UpdateAuthUserStatusInput,
   UserRecord,
 } from "@sixb/core/storage"
 import { AuthStorageError } from "@sixb/core/storage"
+import { runImmediateTransaction } from "../transactions"
 import type { SqliteAuthUserRow } from "./rows"
 import { rowToUserRecord } from "./rows"
 import {
@@ -103,6 +105,22 @@ export class SqliteAuthUserStore implements AuthUserStore {
     return row ? rowToUserRecord(row) : null
   }
 
+  async getByIds(params: {
+    readonly projectId: string
+    readonly ids: readonly string[]
+  }): Promise<readonly UserRecord[]> {
+    const ids = [...new Set(params.ids)]
+    if (ids.length === 0) return []
+
+    const rows = this.db
+      .query(
+        `SELECT * FROM auth_users WHERE project_id = ? AND id IN (${ids.map(() => "?").join(", ")})`
+      )
+      .all(params.projectId, ...ids) as SqliteAuthUserRow[]
+
+    return rows.map(rowToUserRecord)
+  }
+
   async getByEmail(params: {
     readonly projectId: string
     readonly email: string
@@ -111,77 +129,87 @@ export class SqliteAuthUserStore implements AuthUserStore {
     return row ? rowToUserRecord(row) : null
   }
 
-  async updateProfile(input: UpdateAuthUserProfileInput): Promise<UserRecord> {
-    const existing = getUserRowById(this.db, {
-      projectId: input.projectId,
-      id: input.id,
-    })
+  async updateProfile(input: UpdateAuthUserProfileInput): Promise<UpdateAuthUserResult> {
+    // One transaction, so the user it returns as previous is the one it changed.
+    return runImmediateTransaction(this.db, () => {
+      const existing = getUserRowById(this.db, {
+        projectId: input.projectId,
+        id: input.id,
+      })
 
-    if (!existing) {
-      throw new AuthStorageError(
-        "missing_user",
-        `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`
-      )
-    }
+      if (!existing) {
+        throw new AuthStorageError(
+          "missing_user",
+          `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`
+        )
+      }
 
-    const updatedAt = dateOrNow(input.updatedAt)
-    this.db
-      .query(
+      const previousUser = rowToUserRecord(existing)
+      if (!changesProfile(previousUser, input)) {
+        return { user: previousUser, previousUser }
+      }
+
+      const updatedAt = dateOrNow(input.updatedAt)
+      const row = this.db
+        .query(
+          `
+          UPDATE auth_users
+          SET display_name = CASE WHEN ? THEN ? ELSE display_name END,
+              avatar_url = CASE WHEN ? THEN ? ELSE avatar_url END,
+              updated_at = ?
+          WHERE project_id = ?
+            AND id = ?
+          RETURNING *
         `
-        UPDATE auth_users
-        SET display_name = ?,
-            avatar_url = ?,
-            updated_at = ?
-        WHERE project_id = ?
-          AND id = ?
-      `
-      )
-      .run(
-        input.displayName ?? null,
-        input.avatarUrl ?? null,
-        toIso(updatedAt),
-        input.projectId,
-        input.id
-      )
+        )
+        .get(
+          input.displayName === undefined ? 0 : 1,
+          input.displayName ?? null,
+          input.avatarUrl === undefined ? 0 : 1,
+          input.avatarUrl ?? null,
+          toIso(updatedAt),
+          input.projectId,
+          input.id
+        ) as SqliteAuthUserRow
 
-    return rowToUserRecord({
-      ...existing,
-      display_name: input.displayName ?? null,
-      avatar_url: input.avatarUrl ?? null,
-      updated_at: toIso(updatedAt),
+      return { user: rowToUserRecord(row), previousUser }
     })
   }
 
-  async updateStatus(input: UpdateAuthUserStatusInput): Promise<UserRecord> {
-    const existing = getUserRowById(this.db, {
-      projectId: input.projectId,
-      id: input.id,
-    })
+  async updateStatus(input: UpdateAuthUserStatusInput): Promise<UpdateAuthUserResult> {
+    // One transaction, so two status changes cannot both report the same previous one.
+    return runImmediateTransaction(this.db, () => {
+      const existing = getUserRowById(this.db, {
+        projectId: input.projectId,
+        id: input.id,
+      })
 
-    if (!existing) {
-      throw new AuthStorageError(
-        "missing_user",
-        `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`
-      )
-    }
+      if (!existing) {
+        throw new AuthStorageError(
+          "missing_user",
+          `[Sixb] User '${input.id}' not found for project '${input.projectId}'.`
+        )
+      }
 
-    const updatedAt = dateOrNow(input.updatedAt)
-    this.db
-      .query(
+      const updatedAt = dateOrNow(input.updatedAt)
+      this.db
+        .query(
+          `
+          UPDATE auth_users
+          SET status = ?,
+              updated_at = ?
+          WHERE project_id = ?
+            AND id = ?
         `
-        UPDATE auth_users
-        SET status = ?,
-            updated_at = ?
-        WHERE project_id = ?
-          AND id = ?
-      `
-      )
-      .run(input.status, toIso(updatedAt), input.projectId, input.id)
+        )
+        .run(input.status, toIso(updatedAt), input.projectId, input.id)
 
-    return rowToUserRecord({
-      ...existing,
-      status: input.status,
-      updated_at: toIso(updatedAt),
+      const user = rowToUserRecord({
+        ...existing,
+        status: input.status,
+        updated_at: toIso(updatedAt),
+      })
+      return { user, previousUser: rowToUserRecord(existing) }
     })
   }
 
@@ -198,6 +226,15 @@ export class SqliteAuthUserStore implements AuthUserStore {
       args.push(...input.statuses)
     }
 
+    // `instr` matches literally, so `%` and `_` need no escaping. Both sides fold through the same
+    // `lower()`, which ignores case for ASCII letters only: "émilie" does not find "Émilie" here.
+    if (input.search !== undefined) {
+      whereClauses.push(
+        "(instr(lower(coalesce(display_name, '')), lower(?)) > 0 OR instr(lower(email), lower(?)) > 0)"
+      )
+      args.push(input.search, input.search)
+    }
+
     const where = `WHERE ${whereClauses.join(" AND ")}`
     const order = input.order === "asc" ? "ASC" : "DESC"
     const totalRow = this.db
@@ -224,3 +261,12 @@ export class SqliteAuthUserStore implements AuthUserStore {
     }
   }
 }
+
+// Omitted keeps the stored value, and `null` clears it.
+function changesProfile(user: UserRecord, input: UpdateAuthUserProfileInput): boolean {
+  const displayName =
+    input.displayName === undefined ? user.displayName : (input.displayName ?? undefined)
+  const avatarUrl = input.avatarUrl === undefined ? user.avatarUrl : (input.avatarUrl ?? undefined)
+
+  return displayName !== user.displayName || avatarUrl !== user.avatarUrl
+}

package/src/execution-storage.ts

@@ -8,8 +8,10 @@ import {
 } from "@sixb/core/internal/execution-storage"
 import type {
   CreateExecutionInput,
+  ExecutionDescendant,
   ExecutionRecord,
   ExecutionStorage,
+  ListExecutionDescendantsInput,
   ListSessionExecutionsInput,
   SessionExecutions,
   ShareSessionStorage,
@@ -171,6 +173,43 @@ export class SqliteExecutionStorage implements ExecutionStorage {
       truncated: rows.length > input.limit,
     }
   }
+
+  async listDescendants(
+    input: ListExecutionDescendantsInput
+  ): Promise<readonly ExecutionDescendant[]> {
+    if (input.executionIds.length === 0) return []
+    const ids = [...new Set(input.executionIds)]
+
+    // UNION, not UNION ALL: an execution asked about may sit below another one asked about, and
+    // the walk would otherwise reach what it caused twice.
+    const rows = this.db
+      .query(
+        `
+        WITH RECURSIVE tree(id, parent_id) AS (
+          SELECT child.id, child.parent_execution_id
+          FROM executions child
+          WHERE child.project_id = ?
+            AND child.parent_execution_id IN (SELECT value FROM json_each(?))
+          UNION
+          SELECT child.id, child.parent_execution_id
+          FROM tree
+          CROSS JOIN executions child
+            ON child.project_id = ?
+            AND child.parent_execution_id = tree.id
+        )
+        SELECT id, parent_id
+        FROM tree
+        WHERE id NOT IN (SELECT value FROM json_each(?))
+        ORDER BY id
+      `
+      )
+      .all(input.projectId, JSON.stringify(ids), input.projectId, JSON.stringify(ids)) as {
+      id: string
+      parent_id: string
+    }[]
+
+    return rows.map((row) => ({ id: row.id, parentId: row.parent_id }))
+  }
 }
 
 /** An `executions` row as its record, for any store that reads executions alongside its own rows. */

package/src/migrations/067-artifact-kinds.sql

@@ -0,0 +1,32 @@
+-- Artifacts take two more kinds: pages, and the canvases that lay pages out. SQLite cannot alter a
+-- CHECK constraint, so the table is rebuilt; its versions and frame grants reference it by name.
+CREATE TABLE artifacts_v2 (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  kind TEXT NOT NULL CHECK (kind IN ('document', 'sheet', 'slides', 'page', 'canvas', 'file')),
+  title TEXT NOT NULL CHECK (length(trim(title)) > 0),
+  owner_principal_type TEXT NOT NULL
+    CHECK (owner_principal_type IN ('user', 'serviceAccount', 'system')),
+  owner_principal_id TEXT NOT NULL CHECK (length(owner_principal_id) > 0),
+  latest_version INTEGER NOT NULL CHECK (latest_version > 0),
+  next_version INTEGER NOT NULL CHECK (next_version > latest_version),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, id)
+);
+
+INSERT INTO artifacts_v2 (
+  project_id, id, kind, title, owner_principal_type, owner_principal_id, latest_version,
+  next_version, created_at, updated_at
+)
+SELECT
+  project_id, id, kind, title, owner_principal_type, owner_principal_id, latest_version,
+  next_version, created_at, updated_at
+FROM artifacts;
+
+DROP TABLE artifacts;
+ALTER TABLE artifacts_v2 RENAME TO artifacts;
+
+CREATE INDEX idx_artifacts_project_updated ON artifacts (project_id, updated_at DESC, id);
+CREATE INDEX idx_artifacts_owner_updated
+  ON artifacts (project_id, owner_principal_type, owner_principal_id, updated_at DESC, id);

package/src/migrations/068-artifact-state.sql

@@ -0,0 +1,15 @@
+-- What a page keeps for each of its readers with `sixb.state`: JSON text by key, for one artifact
+-- and one principal, across the artifact's versions. `size_bytes` is the value's UTF-8 length,
+-- which the reader's limits sum. Deleting the artifact cascades here.
+CREATE TABLE artifact_state (
+  project_id TEXT NOT NULL,
+  artifact_id TEXT NOT NULL,
+  principal_type TEXT NOT NULL CHECK (principal_type IN ('user', 'serviceAccount', 'system')),
+  principal_id TEXT NOT NULL CHECK (length(principal_id) > 0),
+  key TEXT NOT NULL CHECK (length(key) > 0),
+  value TEXT NOT NULL CHECK (json_valid(value)),
+  size_bytes INTEGER NOT NULL CHECK (size_bytes >= 0),
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, artifact_id, principal_type, principal_id, key),
+  FOREIGN KEY (project_id, artifact_id) REFERENCES artifacts (project_id, id) ON DELETE CASCADE
+);

package/src/migrations/069-agent-thread-participants.sql

@@ -0,0 +1,16 @@
+-- The users a thread's owner added to the conversation. Only users take part: only a signed-in
+-- user talks to the Agent. Listing the threads shared with someone reads the principal index.
+CREATE TABLE agent_thread_participants (
+  project_id TEXT NOT NULL,
+  thread_id TEXT NOT NULL,
+  principal_type TEXT NOT NULL CHECK (principal_type = 'user'),
+  principal_id TEXT NOT NULL CHECK (length(principal_id) > 0),
+  added_at TEXT NOT NULL,
+  added_by_type TEXT NOT NULL CHECK (added_by_type IN ('user', 'serviceAccount', 'system')),
+  added_by_id TEXT NOT NULL CHECK (length(added_by_id) > 0),
+  PRIMARY KEY (project_id, thread_id, principal_type, principal_id),
+  FOREIGN KEY (project_id, thread_id) REFERENCES agent_threads (project_id, id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_agent_thread_participants_principal
+  ON agent_thread_participants (project_id, principal_type, principal_id, thread_id);

package/src/migrations/070-forked-context-checkpoints.sql

@@ -0,0 +1,45 @@
+-- A forked thread copies the checkpoint its history needs, and the copy keeps the run that wrote
+-- the summary. A run's checkpoint is therefore unique within a thread, not within the project.
+-- SQLite cannot drop a UNIQUE constraint, so the table is rebuilt.
+CREATE TABLE agent_context_checkpoints_v2 (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  thread_id TEXT NOT NULL,
+  created_by_run_id TEXT NOT NULL,
+  previous_checkpoint_id TEXT,
+  reason TEXT NOT NULL CHECK (reason IN ('threshold', 'overflow')),
+  summary TEXT NOT NULL CHECK (length(trim(summary)) > 0),
+  summary_format_version INTEGER NOT NULL CHECK (summary_format_version = 1),
+  summarized_through_seq INTEGER NOT NULL CHECK (summarized_through_seq >= 1),
+  observed_head_seq INTEGER NOT NULL,
+  estimated_input_tokens_before INTEGER NOT NULL CHECK (estimated_input_tokens_before >= 0),
+  estimated_input_tokens_after INTEGER NOT NULL CHECK (estimated_input_tokens_after >= 0),
+  summary_model_id TEXT NOT NULL CHECK (length(trim(summary_model_id)) > 0),
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, thread_id, created_by_run_id),
+  FOREIGN KEY (project_id, thread_id)
+    REFERENCES agent_threads(project_id, id) ON DELETE CASCADE,
+  FOREIGN KEY (project_id, created_by_run_id)
+    REFERENCES agent_runs(project_id, id) ON DELETE RESTRICT,
+  FOREIGN KEY (project_id, previous_checkpoint_id)
+    REFERENCES agent_context_checkpoints(project_id, id) ON DELETE RESTRICT,
+  CHECK (summarized_through_seq < observed_head_seq)
+);
+
+INSERT INTO agent_context_checkpoints_v2 (
+  project_id, id, thread_id, created_by_run_id, previous_checkpoint_id, reason, summary,
+  summary_format_version, summarized_through_seq, observed_head_seq,
+  estimated_input_tokens_before, estimated_input_tokens_after, summary_model_id, created_at
+)
+SELECT
+  project_id, id, thread_id, created_by_run_id, previous_checkpoint_id, reason, summary,
+  summary_format_version, summarized_through_seq, observed_head_seq,
+  estimated_input_tokens_before, estimated_input_tokens_after, summary_model_id, created_at
+FROM agent_context_checkpoints;
+
+DROP TABLE agent_context_checkpoints;
+ALTER TABLE agent_context_checkpoints_v2 RENAME TO agent_context_checkpoints;
+
+CREATE INDEX idx_agent_context_checkpoints_thread_latest
+  ON agent_context_checkpoints(project_id, thread_id, summarized_through_seq DESC, created_at DESC, id DESC);

package/src/migrations/071-unique-values.sql

@@ -0,0 +1,22 @@
+-- The values of unique properties, one row per value an object holds. Every object write keeps
+-- them current, so a write that would give a value to a second object of the type is refused.
+CREATE TABLE object_unique_values (
+  project_id TEXT NOT NULL,
+  object_type_id TEXT NOT NULL,
+  property_id TEXT NOT NULL,
+  value_key TEXT NOT NULL,
+  primary_id TEXT NOT NULL,
+  PRIMARY KEY (project_id, object_type_id, property_id, value_key)
+);
+
+-- The unique properties whose values were built from the objects already stored, and how their
+-- keys were computed. A claim made with other keys is refused until they are built again.
+CREATE TABLE object_unique_properties (
+  project_id TEXT NOT NULL,
+  object_type_id TEXT NOT NULL,
+  property_id TEXT NOT NULL,
+  key_kind TEXT NOT NULL,
+  key_version INTEGER NOT NULL,
+  prepared_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, object_type_id, property_id)
+);

package/src/migrations/072-generated-media-usage.sql

@@ -0,0 +1,32 @@
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN image_output_tokens INTEGER
+  CHECK (image_output_tokens IS NULL OR image_output_tokens >= 0);
+
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN audio_output_tokens INTEGER
+  CHECK (audio_output_tokens IS NULL OR audio_output_tokens >= 0);
+
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN output_images INTEGER
+  CHECK (output_images IS NULL OR output_images >= 0);
+
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN input_characters INTEGER
+  CHECK (input_characters IS NULL OR input_characters >= 0);
+
+-- SQLite cannot alter a CHECK constraint. Swapping the column avoids rebuilding a table that
+-- usage groups, costs and limit reservations reference.
+ALTER TABLE ai_model_call_usage
+  ADD COLUMN model_kind_next TEXT
+  CHECK (
+    model_kind_next IS NULL
+    OR model_kind_next IN (
+      'language', 'image', 'video', 'embedding', 'decision', 'transcription', 'speech', 'reranking'
+    )
+  );
+
+UPDATE ai_model_call_usage SET model_kind_next = model_kind;
+
+ALTER TABLE ai_model_call_usage DROP COLUMN model_kind;
+
+ALTER TABLE ai_model_call_usage RENAME COLUMN model_kind_next TO model_kind;

package/src/migrations/073-model-call-files.sql

@@ -0,0 +1,11 @@
+-- The files a model call produced. The execution that made the call decides who may read them.
+CREATE TABLE ai_model_call_files (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  call_id TEXT NOT NULL CHECK (length(trim(call_id)) > 0),
+  execution_id TEXT NOT NULL CHECK (length(trim(execution_id)) > 0),
+  files TEXT NOT NULL CHECK (json_type(files) = 'array' AND json_array_length(files) > 0),
+  recorded_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, call_id),
+  FOREIGN KEY (project_id, execution_id)
+    REFERENCES executions(project_id, id)
+);

package/src/migrations/074-agent-memory.sql

@@ -0,0 +1,32 @@
+-- Agent memory: each repo, 'user:<userId>' or 'project', is a log of revisions. A save inserts one
+-- revision and the file versions it wrote, and never updates a row. A file's current contents are
+-- its highest-revision version; NULL contents mean that revision deleted it. Timestamps are
+-- ISO-8601 UTC text and compare lexicographically.
+CREATE TABLE agent_memory_revisions (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  repo_id TEXT NOT NULL CHECK (length(trim(repo_id)) > 0),
+  revision INTEGER NOT NULL CHECK (revision > 0),
+  message TEXT NOT NULL CHECK (length(trim(message)) > 0),
+  author_principal_type TEXT NOT NULL
+    CHECK (author_principal_type IN ('user', 'serviceAccount', 'system')),
+  author_principal_id TEXT NOT NULL CHECK (length(author_principal_id) > 0),
+  source TEXT,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, repo_id, revision)
+);
+
+-- A save also removes versions older than 90 days that are not their path's latest, so a
+-- revision's rows here can be fewer than the files it wrote.
+CREATE TABLE agent_memory_files (
+  project_id TEXT NOT NULL,
+  repo_id TEXT NOT NULL,
+  path TEXT NOT NULL CHECK (length(path) > 0),
+  revision INTEGER NOT NULL,
+  contents TEXT,
+  PRIMARY KEY (project_id, repo_id, path, revision),
+  FOREIGN KEY (project_id, repo_id, revision)
+    REFERENCES agent_memory_revisions (project_id, repo_id, revision) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_agent_memory_files_revision
+  ON agent_memory_files (project_id, repo_id, revision);

package/src/migrations/075-artifact-threads.sql

@@ -0,0 +1,21 @@
+-- The threads an artifact is shared in: everyone who reads one of them reads the artifact. An
+-- Agent turn publishing a version links its thread, for as long as a version from it remains; a
+-- forked thread links its copies, `copied`, for as long as they last. Existing versions published
+-- from a thread link it here.
+CREATE TABLE artifact_threads (
+  project_id TEXT NOT NULL,
+  artifact_id TEXT NOT NULL,
+  thread_id TEXT NOT NULL CHECK (length(thread_id) > 0),
+  shared_at TEXT NOT NULL,
+  copied INTEGER NOT NULL DEFAULT 0 CHECK (copied IN (0, 1)),
+  PRIMARY KEY (project_id, artifact_id, thread_id),
+  FOREIGN KEY (project_id, artifact_id) REFERENCES artifacts (project_id, id) ON DELETE CASCADE
+);
+
+CREATE INDEX idx_artifact_threads_thread ON artifact_threads (project_id, thread_id, artifact_id);
+
+INSERT INTO artifact_threads (project_id, artifact_id, thread_id, shared_at)
+SELECT project_id, artifact_id, origin_thread_id, MIN(created_at)
+FROM artifact_versions
+WHERE origin_thread_id IS NOT NULL
+GROUP BY project_id, artifact_id, origin_thread_id;

package/src/migrations/076-agent-approvals.sql

@@ -0,0 +1,59 @@
+-- Calls of the Agent that wait for whoever asked for the turn. A call's run id is its key: a
+-- thread holds at most one pending, approved or denied approval per key, and a cancelled,
+-- superseded or expired one lets the same call ask again. Timestamps are ISO-8601 UTC text and
+-- compare lexicographically.
+CREATE TABLE agent_approvals (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  thread_id TEXT NOT NULL,
+  run_id TEXT NOT NULL CHECK (length(run_id) > 0),
+  caller_run_id TEXT NOT NULL CHECK (length(caller_run_id) > 0),
+  requested_by_type TEXT NOT NULL CHECK (requested_by_type IN ('user', 'serviceAccount', 'system')),
+  requested_by_id TEXT NOT NULL CHECK (length(requested_by_id) > 0),
+  mode TEXT NOT NULL CHECK (mode IN ('manual', 'accept-edits')),
+  call_key TEXT NOT NULL CHECK (length(call_key) > 0),
+  call TEXT NOT NULL,
+  status TEXT NOT NULL
+    CHECK (status IN ('pending', 'approved', 'denied', 'cancelled', 'superseded', 'expired')),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  decided_at TEXT,
+  decided_by_type TEXT CHECK (decided_by_type IN ('user', 'serviceAccount', 'system')),
+  decided_by_id TEXT,
+  outcome TEXT,
+  reported_in_message_id TEXT,
+  PRIMARY KEY (project_id, id),
+  FOREIGN KEY (project_id, thread_id) REFERENCES agent_threads (project_id, id) ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX idx_agent_approvals_live_call
+  ON agent_approvals (project_id, thread_id, call_key)
+  WHERE status IN ('pending', 'approved', 'denied');
+
+CREATE INDEX idx_agent_approvals_thread ON agent_approvals (project_id, thread_id, created_at);
+CREATE INDEX idx_agent_approvals_run ON agent_approvals (project_id, run_id, status);
+CREATE INDEX idx_agent_approvals_caller_run ON agent_approvals (project_id, caller_run_id, status);
+CREATE INDEX idx_agent_approvals_requester
+  ON agent_approvals (project_id, requested_by_type, requested_by_id, status);
+
+-- What each user lets the Agent change without asking: a default, then their own choice in a
+-- thread. Absent rows fall back, in that order.
+CREATE TABLE agent_user_settings (
+  project_id TEXT NOT NULL,
+  principal_type TEXT NOT NULL CHECK (principal_type IN ('user', 'serviceAccount', 'system')),
+  principal_id TEXT NOT NULL CHECK (length(principal_id) > 0),
+  approval_mode TEXT NOT NULL CHECK (approval_mode IN ('manual', 'accept-edits', 'auto')),
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, principal_type, principal_id)
+);
+
+CREATE TABLE agent_thread_user_settings (
+  project_id TEXT NOT NULL,
+  thread_id TEXT NOT NULL,
+  principal_type TEXT NOT NULL CHECK (principal_type IN ('user', 'serviceAccount', 'system')),
+  principal_id TEXT NOT NULL CHECK (length(principal_id) > 0),
+  approval_mode TEXT NOT NULL CHECK (approval_mode IN ('manual', 'accept-edits', 'auto')),
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, thread_id, principal_type, principal_id),
+  FOREIGN KEY (project_id, thread_id) REFERENCES agent_threads (project_id, id) ON DELETE CASCADE
+);

package/src/migrations/077-agent-approval-resume.sql

@@ -0,0 +1,20 @@
+-- A paused Agent turn resumes once its requester decided on every call it held. What that needs:
+-- the mode "Always allow" raised the turn to, whether the turn may still resume on a call, and the
+-- claim a process takes before it runs an approved call left without its outcome.
+ALTER TABLE agent_approvals
+  ADD COLUMN raised_mode TEXT CHECK (raised_mode IN ('manual', 'accept-edits', 'auto'));
+ALTER TABLE agent_approvals ADD COLUMN turn_stopped_at TEXT;
+ALTER TABLE agent_approvals ADD COLUMN execution_claimed_at TEXT;
+
+-- The repair pass: calls past their time, approved calls without an outcome, and decided calls of
+-- turns that may still resume. Each index covers only the rows that are still work.
+CREATE INDEX idx_agent_approvals_due
+  ON agent_approvals (project_id, expires_at)
+  WHERE status = 'pending';
+CREATE INDEX idx_agent_approvals_unfinished
+  ON agent_approvals (project_id, created_at, id)
+  WHERE status = 'approved' AND outcome IS NULL;
+CREATE INDEX idx_agent_approvals_resumable
+  ON agent_approvals (project_id, created_at, id)
+  WHERE status IN ('approved', 'denied') AND reported_in_message_id IS NULL
+    AND turn_stopped_at IS NULL;