@sixb/sqlite 0.1.6 → 0.1.8

package/src/migrations/033-retire-agent-definitions.sql

@@ -0,0 +1,89 @@
+DROP INDEX idx_agent_threads_project_agent_activity;
+ALTER TABLE workflow_agent_node_runs RENAME COLUMN agent_id TO actor_id;
+ALTER TABLE agent_threads DROP COLUMN agent_id;
+
+CREATE TABLE agent_runs_v5 (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  execution_id TEXT NOT NULL,
+  kind TEXT NOT NULL DEFAULT 'conversation' CHECK (kind IN ('conversation', 'subagent')),
+  thread_id TEXT,
+  trigger_message_id TEXT,
+  parent_run_id TEXT,
+  spawn_key TEXT,
+  spec TEXT CHECK (spec IS NULL OR json_valid(spec)),
+  result TEXT CHECK (result IS NULL OR json_valid(result)),
+  requester_group_ids TEXT NOT NULL DEFAULT '[]'
+    CHECK (json_valid(requester_group_ids) AND json_type(requester_group_ids) = 'array'),
+  status TEXT NOT NULL CHECK (
+    status IN ('queued', 'running', 'succeeded', 'failed', 'cancelled')
+  ),
+  model_id TEXT,
+  finish_reason TEXT,
+  error TEXT CHECK (error IS NULL OR json_valid(error)),
+  diagnostics TEXT,
+  attempt INTEGER NOT NULL DEFAULT 0 CHECK (attempt >= 0),
+  execution_token TEXT,
+  execution_queue_lease_expires_at TEXT,
+  created_at TEXT NOT NULL,
+  started_at TEXT,
+  completed_at TEXT,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, execution_id),
+  UNIQUE (project_id, parent_run_id, spawn_key),
+  FOREIGN KEY (project_id, execution_id)
+    REFERENCES executions (project_id, id)
+    ON DELETE RESTRICT,
+  FOREIGN KEY (project_id, parent_run_id)
+    -- Use the final name: Bun's legacy ALTER mode preserves references when foreign keys are off.
+    REFERENCES agent_runs (project_id, id)
+    ON DELETE RESTRICT,
+  CHECK ((execution_token IS NULL) = (execution_queue_lease_expires_at IS NULL)),
+  CHECK (
+    (
+      kind = 'conversation'
+      AND thread_id IS NOT NULL
+      AND trigger_message_id IS NOT NULL
+      AND parent_run_id IS NULL
+      AND spawn_key IS NULL
+      AND result IS NULL
+    )
+    OR
+    (
+      kind = 'subagent'
+      AND thread_id IS NULL
+      AND trigger_message_id IS NULL
+      AND parent_run_id IS NOT NULL
+      AND spawn_key IS NOT NULL
+      AND spec IS NOT NULL
+    )
+  ),
+  CHECK (kind <> 'subagent' OR status <> 'succeeded' OR result IS NOT NULL)
+);
+
+INSERT INTO agent_runs_v5 (
+  project_id, id, execution_id, kind, thread_id, trigger_message_id, parent_run_id, spawn_key,
+  spec, result, requester_group_ids, status, model_id, finish_reason, error, diagnostics, attempt,
+  execution_token, execution_queue_lease_expires_at, created_at, started_at, completed_at
+)
+SELECT
+  project_id, id, execution_id, kind, thread_id, trigger_message_id, parent_run_id, spawn_key,
+  spec, result, requester_group_ids, status, model_id, finish_reason, error, diagnostics, attempt,
+  execution_token, execution_queue_lease_expires_at, created_at, started_at, completed_at
+FROM agent_runs;
+
+DROP TABLE agent_runs;
+ALTER TABLE agent_runs_v5 RENAME TO agent_runs;
+
+CREATE INDEX idx_agent_runs_project_thread_started
+  ON agent_runs (project_id, thread_id, COALESCE(started_at, created_at) DESC, id DESC);
+CREATE INDEX idx_agent_runs_project_status_created
+  ON agent_runs (project_id, status, created_at, id);
+CREATE INDEX idx_agent_runs_project_parent_started
+  ON agent_runs (
+    project_id,
+    parent_run_id,
+    status,
+    COALESCE(started_at, created_at) DESC,
+    id DESC
+  );

package/src/migrations/034-device-authorizations.sql

@@ -0,0 +1,22 @@
+CREATE TABLE auth_device_authorizations (
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  device_code_hash TEXT NOT NULL,
+  user_code TEXT NOT NULL,
+  client_name TEXT NOT NULL,
+  token_name TEXT NOT NULL,
+  token_expires_at TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('pending', 'approved', 'denied', 'consumed')),
+  approved_user_id TEXT,
+  approved_session_id TEXT,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  approved_at TEXT,
+  denied_at TEXT,
+  consumed_at TEXT,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, user_code)
+);
+
+CREATE INDEX idx_auth_device_authorizations_pending
+  ON auth_device_authorizations(project_id, status, expires_at);

package/src/migrations/035-share-grants.sql

@@ -0,0 +1,66 @@
+CREATE TABLE share_grants (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  definition_id TEXT NOT NULL CHECK (length(trim(definition_id)) > 0),
+  target_object_type_id TEXT NOT NULL CHECK (length(trim(target_object_type_id)) > 0),
+  target_primary_id TEXT NOT NULL CHECK (length(trim(target_primary_id)) > 0),
+  issued_by_type TEXT NOT NULL CHECK (issued_by_type IN ('user', 'serviceAccount')),
+  issued_by_id TEXT NOT NULL CHECK (length(trim(issued_by_id)) > 0),
+  authority_version INTEGER NOT NULL CHECK (authority_version > 0),
+  authority_snapshot TEXT NOT NULL CHECK (
+    json_valid(authority_snapshot)
+    AND json_type(authority_snapshot) = 'object'
+    AND json_type(authority_snapshot, '$.version') = 'integer'
+    AND json_extract(authority_snapshot, '$.version') = authority_version
+    AND json_type(authority_snapshot, '$.access') = 'object'
+  ),
+  authority_digest TEXT NOT NULL CHECK (
+    length(authority_digest) = 64
+    AND authority_digest = lower(authority_digest)
+    AND authority_digest NOT GLOB '*[^0-9a-f]*'
+  ),
+  token_hash TEXT NOT NULL CHECK (
+    length(token_hash) = 64
+    AND token_hash = lower(token_hash)
+    AND token_hash NOT GLOB '*[^0-9a-f]*'
+  ),
+  destination_path TEXT NOT NULL CHECK (
+    substr(destination_path, 1, 1) = '/'
+    AND instr(destination_path, '?') = 0
+    AND instr(destination_path, '#') = 0
+    AND instr(destination_path, char(92)) = 0
+  ),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  revoked_at TEXT,
+  revoked_by_type TEXT CHECK (
+    revoked_by_type IS NULL OR revoked_by_type IN ('user', 'serviceAccount', 'system')
+  ),
+  revoked_by_id TEXT CHECK (revoked_by_id IS NULL OR length(trim(revoked_by_id)) > 0),
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, token_hash),
+  CHECK (expires_at > created_at),
+  CHECK (revoked_at IS NULL OR revoked_at >= created_at),
+  CHECK (
+    (revoked_at IS NULL AND revoked_by_type IS NULL AND revoked_by_id IS NULL)
+    OR
+    (revoked_at IS NOT NULL AND revoked_by_type IS NOT NULL AND revoked_by_id IS NOT NULL)
+  )
+);
+
+CREATE INDEX idx_share_grants_target
+  ON share_grants (
+    project_id,
+    definition_id,
+    target_object_type_id,
+    target_primary_id,
+    created_at DESC,
+    id DESC
+  );
+
+CREATE INDEX idx_share_grants_project_created
+  ON share_grants (project_id, created_at DESC, id DESC);
+
+CREATE INDEX idx_share_grants_expiry
+  ON share_grants (project_id, expires_at)
+  WHERE revoked_at IS NULL;

package/src/migrations/036-share-sessions.sql

@@ -0,0 +1,226 @@
+-- Shared sessions and their execution provenance.
+CREATE TABLE share_sessions (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  grant_id TEXT NOT NULL CHECK (length(trim(grant_id)) > 0),
+  token_hash TEXT NOT NULL CHECK (
+    length(token_hash) = 64
+    AND token_hash = lower(token_hash)
+    AND token_hash NOT GLOB '*[^0-9a-f]*'
+  ),
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  absolute_expires_at TEXT NOT NULL,
+  revoked_at TEXT,
+  PRIMARY KEY (project_id, id),
+  UNIQUE (project_id, id, grant_id),
+  UNIQUE (project_id, token_hash),
+  FOREIGN KEY (project_id, grant_id)
+    REFERENCES share_grants (project_id, id),
+  CHECK (expires_at > created_at),
+  CHECK (absolute_expires_at > created_at),
+  CHECK (expires_at <= absolute_expires_at),
+  CHECK (revoked_at IS NULL OR revoked_at >= created_at)
+);
+
+CREATE INDEX idx_share_sessions_grant
+  ON share_sessions (project_id, grant_id, created_at DESC, id DESC);
+
+CREATE INDEX idx_share_sessions_expiry
+  ON share_sessions (project_id, expires_at)
+  WHERE revoked_at IS NULL;
+
+-- Persist shared-session provenance on request executions without fabricating a principal.
+CREATE TABLE executions_v2 (
+  project_id TEXT NOT NULL CHECK (length(trim(project_id)) > 0),
+  id TEXT NOT NULL CHECK (length(trim(id)) > 0),
+  executor_kind TEXT NOT NULL CHECK (
+    executor_kind IN (
+      'request', 'action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow',
+      'agent', 'kernel'
+    )
+  ),
+  executor_id TEXT NOT NULL CHECK (length(trim(executor_id)) > 0),
+  source_kind TEXT NOT NULL CHECK (
+    source_kind IN ('http', 'webhook', 'schedule', 'event', 'datasetVersion', 'execution')
+  ),
+  source_id TEXT NOT NULL CHECK (length(trim(source_id)) > 0),
+  requested_by_user_id TEXT,
+  requested_by_service_account_id TEXT,
+  correlation_id TEXT NOT NULL CHECK (length(trim(correlation_id)) > 0),
+  parent_execution_id TEXT,
+  authority_kind TEXT NOT NULL CHECK (
+    authority_kind IN ('principal', 'trustedPrimitive', 'delegated', 'kernel', 'disabled')
+  ),
+  authority_user_id TEXT,
+  authority_service_account_id TEXT,
+  authority_session_id TEXT,
+  authority_access_token_id TEXT,
+  authority_primitive_kind TEXT CHECK (
+    authority_primitive_kind IS NULL
+      OR authority_primitive_kind IN (
+        'action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow'
+      )
+  ),
+  authority_primitive_id TEXT,
+  authority_kernel_operation TEXT CHECK (
+    authority_kernel_operation IS NULL OR authority_kernel_operation = 'ontology.recover'
+  ),
+  authority_delegation_kind TEXT CHECK (
+    authority_delegation_kind IS NULL OR authority_delegation_kind = 'share'
+  ),
+  authority_delegation_id TEXT,
+  authority_delegation_session_id TEXT,
+  created_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, id),
+  FOREIGN KEY (project_id, parent_execution_id) REFERENCES executions (project_id, id),
+  FOREIGN KEY (project_id, requested_by_user_id) REFERENCES auth_users (project_id, id),
+  FOREIGN KEY (project_id, requested_by_service_account_id)
+    REFERENCES auth_service_accounts (project_id, id),
+  FOREIGN KEY (project_id, authority_user_id) REFERENCES auth_users (project_id, id),
+  FOREIGN KEY (project_id, authority_service_account_id)
+    REFERENCES auth_service_accounts (project_id, id),
+  FOREIGN KEY (project_id, authority_session_id) REFERENCES auth_sessions (project_id, id),
+  FOREIGN KEY (project_id, authority_access_token_id)
+    REFERENCES auth_access_tokens (project_id, id),
+  FOREIGN KEY (
+    project_id, authority_delegation_session_id, authority_delegation_id
+  ) REFERENCES share_sessions (project_id, id, grant_id),
+  CHECK ((requested_by_user_id IS NOT NULL) + (requested_by_service_account_id IS NOT NULL) <= 1),
+  CHECK (
+    (source_kind = 'execution' AND parent_execution_id = source_id)
+      OR (source_kind <> 'execution' AND parent_execution_id IS NULL)
+  ),
+  CHECK (
+    (
+      authority_kind = 'principal'
+      AND (authority_user_id IS NOT NULL) + (authority_service_account_id IS NOT NULL) = 1
+      AND (authority_session_id IS NOT NULL) + (authority_access_token_id IS NOT NULL) <= 1
+      AND (authority_session_id IS NULL OR authority_user_id IS NOT NULL)
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'trustedPrimitive'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NOT NULL
+      AND authority_primitive_id IS NOT NULL
+      AND length(trim(authority_primitive_id)) > 0
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'delegated'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NOT NULL
+      AND authority_delegation_kind = 'share'
+      AND authority_delegation_id IS NOT NULL
+      AND length(trim(authority_delegation_id)) > 0
+      AND authority_delegation_session_id IS NOT NULL
+      AND length(trim(authority_delegation_session_id)) > 0
+    )
+    OR (
+      authority_kind = 'kernel'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NOT NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+    OR (
+      authority_kind = 'disabled'
+      AND authority_user_id IS NULL
+      AND authority_service_account_id IS NULL
+      AND authority_session_id IS NULL
+      AND authority_access_token_id IS NULL
+      AND authority_primitive_kind IS NULL
+      AND authority_primitive_id IS NULL
+      AND authority_kernel_operation IS NULL
+      AND authority_delegation_kind IS NULL
+      AND authority_delegation_id IS NULL
+      AND authority_delegation_session_id IS NULL
+    )
+  ),
+  CHECK (
+    (
+      executor_kind = 'request'
+      AND source_kind = 'http'
+      AND executor_id = source_id
+      AND (
+        (
+          authority_kind = 'principal'
+          AND requested_by_user_id IS authority_user_id
+          AND requested_by_service_account_id IS authority_service_account_id
+        )
+        OR (
+          authority_kind IN ('delegated', 'disabled')
+          AND requested_by_user_id IS NULL
+          AND requested_by_service_account_id IS NULL
+        )
+      )
+    )
+    OR (
+      executor_kind IN ('action', 'pipeline', 'projection', 'rule', 'sync', 'webhook', 'workflow')
+      AND authority_kind = 'trustedPrimitive'
+      AND executor_kind = authority_primitive_kind
+    )
+    OR (
+      executor_kind = 'agent'
+      AND source_kind = 'execution'
+      AND (
+        (
+          authority_kind = 'principal'
+          AND authority_service_account_id IS NOT NULL
+          AND authority_session_id IS NULL
+          AND authority_access_token_id IS NULL
+        )
+        OR (
+          authority_kind = 'principal'
+          AND authority_user_id IS NOT NULL
+          AND (authority_session_id IS NOT NULL) + (authority_access_token_id IS NOT NULL) = 1
+        )
+        OR authority_kind = 'disabled'
+      )
+    )
+    OR (executor_kind = 'kernel' AND authority_kind = 'kernel')
+  )
+);
+
+INSERT INTO executions_v2 (
+  project_id, id, executor_kind, executor_id, source_kind, source_id,
+  requested_by_user_id, requested_by_service_account_id, correlation_id, parent_execution_id,
+  authority_kind, authority_user_id, authority_service_account_id, authority_session_id,
+  authority_access_token_id, authority_primitive_kind, authority_primitive_id,
+  authority_kernel_operation, authority_delegation_kind, authority_delegation_id,
+  authority_delegation_session_id, created_at
+)
+SELECT
+  project_id, id, executor_kind, executor_id, source_kind, source_id,
+  requested_by_user_id, requested_by_service_account_id, correlation_id, parent_execution_id,
+  authority_kind, authority_user_id, authority_service_account_id, authority_session_id,
+  authority_access_token_id, authority_primitive_kind, authority_primitive_id,
+  authority_kernel_operation, NULL, NULL, NULL, created_at
+FROM executions;
+
+DROP TABLE executions;
+ALTER TABLE executions_v2 RENAME TO executions;

package/src/migrations.ts

@@ -76,6 +76,20 @@ import agentContextCheckpointsSql from "./migrations/027-agent-context-checkpoin
 import objectOverrideEditTimesSql from "./migrations/028-object-override-edit-times.sql" with {
   type: "text",
 }
+import modelAccountingSql from "./migrations/029-model-accounting.sql" with { type: "text" }
+import aiUsageLimitsSql from "./migrations/030-ai-usage-limits.sql" with { type: "text" }
+import subagentRunsSql from "./migrations/031-subagent-runs.sql" with { type: "text" }
+import conversationRunSpecSql from "./migrations/032-conversation-run-spec.sql" with {
+  type: "text",
+}
+import retireAgentDefinitionsSql from "./migrations/033-retire-agent-definitions.sql" with {
+  type: "text",
+}
+import deviceAuthorizationsSql from "./migrations/034-device-authorizations.sql" with {
+  type: "text",
+}
+import shareGrantsSql from "./migrations/035-share-grants.sql" with { type: "text" }
+import shareSessionsSql from "./migrations/036-share-sessions.sql" with { type: "text" }
 
 const MIGRATIONS_TABLE_SQL = `
   CREATE TABLE IF NOT EXISTS sixb_migrations (
@@ -159,6 +173,14 @@ export const sqliteStorageMigrations = defineMigrations({
     sqliteSql("026-ai-cost-accounting", aiCostAccountingSql),
     sqliteSql("027-agent-context-checkpoints", agentContextCheckpointsSql),
     sqliteSql("028-object-override-edit-times", objectOverrideEditTimesSql),
+    sqliteSql("029-model-accounting", modelAccountingSql),
+    sqliteSql("030-ai-usage-limits", aiUsageLimitsSql),
+    sqliteSql("031-subagent-runs", subagentRunsSql),
+    sqliteSql("032-conversation-run-spec", conversationRunSpecSql),
+    sqliteSql("033-retire-agent-definitions", retireAgentDefinitionsSql),
+    sqliteSql("034-device-authorizations", deviceAuthorizationsSql),
+    sqliteSql("035-share-grants", shareGrantsSql),
+    sqliteSql("036-share-sessions", shareSessionsSql),
   ],
 })
 

package/src/objects/index.ts

@@ -0,0 +1,2 @@
+export type { SqliteObjectStorageOptions } from "./storage"
+export { SqliteObjectStorage } from "./storage"