@vellumai/assistant 0.10.0 → 0.10.1-dev.202606240317.ea25efe

package/src/memory/migrations/126-backfill-guardian-principal-id.ts

@@ -1,5 +1,4 @@
 import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
-import { withCrashRecovery } from "./validate-migration-state.js";
 
 /**
  * Reverse v15: set guardian_principal_id back to NULL on all rows in
@@ -84,227 +83,221 @@ export function downBackfillGuardianPrincipalId(database: DrizzleDb): void {
  *    guardianPrincipalId.
  */
 export function migrateBackfillGuardianPrincipalId(database: DrizzleDb): void {
-  withCrashRecovery(
-    database,
-    "migration_backfill_guardian_principal_id_v3",
-    () => {
-      const raw = getSqliteFrom(database);
+  const raw = getSqliteFrom(database);
 
-      // Guard: tables must exist
-      const bindingsTableExists = raw
-        .query(
-          `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'channel_guardian_bindings'`,
-        )
-        .get();
-      if (!bindingsTableExists) return;
+  // Guard: tables must exist
+  const bindingsTableExists = raw
+    .query(
+      `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'channel_guardian_bindings'`,
+    )
+    .get();
+  if (!bindingsTableExists) return;
 
-      const requestsTableExists = raw
+  const requestsTableExists = raw
+    .query(
+      `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'canonical_guardian_requests'`,
+    )
+    .get();
+
+  // Guard: guardian_principal_id column must exist on bindings table
+  const bindingColExists = raw
+    .query(
+      `SELECT 1 FROM pragma_table_info('channel_guardian_bindings') WHERE name = 'guardian_principal_id'`,
+    )
+    .get();
+  if (!bindingColExists) return;
+
+  try {
+    raw.exec("BEGIN");
+
+    // ── Step 1a: Backfill vellum binding first ─────────────────────
+    // The vellum binding's external user ID IS the canonical principal.
+    raw.exec(/*sql*/ `
+    UPDATE channel_guardian_bindings
+    SET guardian_principal_id = guardian_external_user_id,
+        updated_at = ${Date.now()}
+    WHERE status = 'active'
+      AND channel = 'vellum'
+      AND guardian_external_user_id IS NOT NULL
+      AND guardian_principal_id IS NULL
+  `);
+
+    // ── Step 1b: Derive canonical principal from vellum binding ──
+    const vellumRow = raw
+      .query(
+        `SELECT guardian_principal_id FROM channel_guardian_bindings
+     WHERE assistant_id = 'self' AND channel = 'vellum' AND status = 'active'
+     AND guardian_principal_id IS NOT NULL LIMIT 1`,
+      )
+      .get() as { guardian_principal_id: string } | null;
+
+    if (vellumRow) {
+      // Unify non-vellum bindings onto the canonical principal
+      raw
         .query(
-          `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'canonical_guardian_requests'`,
+          `UPDATE channel_guardian_bindings
+       SET guardian_principal_id = ?,
+           updated_at = ${Date.now()}
+       WHERE status = 'active'
+         AND channel != 'vellum'
+         AND guardian_external_user_id IS NOT NULL
+         AND guardian_principal_id IS NULL`,
         )
-        .get();
+        .run(vellumRow.guardian_principal_id);
+    } else {
+      // No vellum binding — fallback to channel-specific principal
+      raw.exec(/*sql*/ `
+      UPDATE channel_guardian_bindings
+      SET guardian_principal_id = guardian_external_user_id,
+          updated_at = ${Date.now()}
+      WHERE status = 'active'
+        AND guardian_external_user_id IS NOT NULL
+        AND guardian_principal_id IS NULL
+    `);
+    }
 
-      // Guard: guardian_principal_id column must exist on bindings table
-      const bindingColExists = raw
+    // ── Step 2: Derive assistant principal from vellum binding ─────
+    // The vellum binding's guardianExternalUserId is the canonical
+    // assistant principal used for desktop-originated requests.
+    const vellumBinding = raw
+      .query(
+        `SELECT guardian_external_user_id, guardian_principal_id FROM channel_guardian_bindings WHERE assistant_id = 'self' AND channel = 'vellum' AND status = 'active' LIMIT 1`,
+      )
+      .get() as {
+      guardian_external_user_id: string;
+      guardian_principal_id: string | null;
+    } | null;
+
+    // Use the (now-backfilled) principal from the vellum binding
+    const assistantPrincipal =
+      vellumBinding?.guardian_principal_id ??
+      vellumBinding?.guardian_external_user_id ??
+      null;
+
+    // ── Step 3: Backfill canonical_guardian_requests ────────────────
+    if (requestsTableExists) {
+      const requestColExists = raw
         .query(
-          `SELECT 1 FROM pragma_table_info('channel_guardian_bindings') WHERE name = 'guardian_principal_id'`,
+          `SELECT 1 FROM pragma_table_info('canonical_guardian_requests') WHERE name = 'guardian_principal_id'`,
         )
         .get();
-      if (!bindingColExists) return;
 
-      try {
-        raw.exec("BEGIN");
+      if (requestColExists) {
+        const now = new Date().toISOString();
 
-        // ── Step 1a: Backfill vellum binding first ─────────────────────
-        // The vellum binding's external user ID IS the canonical principal.
-        raw.exec(/*sql*/ `
-        UPDATE channel_guardian_bindings
-        SET guardian_principal_id = guardian_external_user_id,
-            updated_at = ${Date.now()}
-        WHERE status = 'active'
-          AND channel = 'vellum'
-          AND guardian_external_user_id IS NOT NULL
-          AND guardian_principal_id IS NULL
-      `);
+        // 3a. Pending requests with a guardianExternalUserId that maps
+        // to an active binding — use the binding's principal.
+        // Includes all kinds; binding is always useful when available.
+        const pendingWithGuardian = raw
+          .query(
+            `SELECT r.id, r.guardian_external_user_id, r.kind
+         FROM canonical_guardian_requests r
+         WHERE r.status = 'pending'
+           AND r.guardian_principal_id IS NULL
+           AND r.guardian_external_user_id IS NOT NULL`,
+          )
+          .all() as Array<{
+          id: string;
+          guardian_external_user_id: string;
+          kind: string;
+        }>;
 
-        // ── Step 1b: Derive canonical principal from vellum binding ──
-        const vellumRow = raw
+        // Build a lookup of guardianExternalUserId -> principalId from
+        // active bindings (all already backfilled in step 1).
+        const activeBindings = raw
           .query(
-            `SELECT guardian_principal_id FROM channel_guardian_bindings
-         WHERE assistant_id = 'self' AND channel = 'vellum' AND status = 'active'
-         AND guardian_principal_id IS NOT NULL LIMIT 1`,
+            `SELECT guardian_external_user_id, guardian_principal_id
+         FROM channel_guardian_bindings
+         WHERE assistant_id = 'self' AND status = 'active' AND guardian_principal_id IS NOT NULL`,
           )
-          .get() as { guardian_principal_id: string } | null;
+          .all() as Array<{
+          guardian_external_user_id: string;
+          guardian_principal_id: string;
+        }>;
+
+        const externalToP = new Map<string, string>();
+        for (const b of activeBindings) {
+          externalToP.set(
+            b.guardian_external_user_id,
+            b.guardian_principal_id,
+          );
+        }
+
+        const updateStmt = raw.prepare(
+          `UPDATE canonical_guardian_requests SET guardian_principal_id = ?, updated_at = ? WHERE id = ?`,
+        );
+        const expireStmt = raw.prepare(
+          `UPDATE canonical_guardian_requests SET status = 'expired', updated_at = ? WHERE id = ?`,
+        );
 
-        if (vellumRow) {
-          // Unify non-vellum bindings onto the canonical principal
+        const unboundRequestIds: string[] = [];
+
+        for (const req of pendingWithGuardian) {
+          const principal = externalToP.get(req.guardian_external_user_id);
+          if (principal) {
+            updateStmt.run(principal, now, req.id);
+          } else {
+            // Cannot deterministically map — will expire below.
+            unboundRequestIds.push(req.id);
+          }
+        }
+
+        // 3b. Desktop-originated pending requests missing guardian info
+        // entirely — bind to the assistant principal. Only applies to
+        // requests that also lack a guardian external user ID; requests
+        // that carry an external ID but failed step 3a mapping should be
+        // expired, not reassigned.
+        if (assistantPrincipal) {
           raw
             .query(
-              `UPDATE channel_guardian_bindings
-           SET guardian_principal_id = ?,
-               updated_at = ${Date.now()}
-           WHERE status = 'active'
-             AND channel != 'vellum'
-             AND guardian_external_user_id IS NOT NULL
-             AND guardian_principal_id IS NULL`,
+              `UPDATE canonical_guardian_requests
+           SET guardian_principal_id = ?, updated_at = ?
+           WHERE status = 'pending'
+             AND guardian_principal_id IS NULL
+             AND guardian_external_user_id IS NULL
+             AND (source_type = 'desktop' OR source_channel = 'vellum')`,
             )
-            .run(vellumRow.guardian_principal_id);
-        } else {
-          // No vellum binding — fallback to channel-specific principal
-          raw.exec(/*sql*/ `
-          UPDATE channel_guardian_bindings
-          SET guardian_principal_id = guardian_external_user_id,
-              updated_at = ${Date.now()}
-          WHERE status = 'active'
-            AND guardian_external_user_id IS NOT NULL
-            AND guardian_principal_id IS NULL
-        `);
+            .run(assistantPrincipal, now);
         }
 
-        // ── Step 2: Derive assistant principal from vellum binding ─────
-        // The vellum binding's guardianExternalUserId is the canonical
-        // assistant principal used for desktop-originated requests.
-        const vellumBinding = raw
+        // 3c. Expire remaining pending requests that still have no
+        // guardian_principal_id. These requests can never be approved
+        // in the principal-based system, so they must be expired
+        // proactively. This includes access_request rows which are
+        // now decisionable and principal-bound.
+        const stillUnbound = raw
           .query(
-            `SELECT guardian_external_user_id, guardian_principal_id FROM channel_guardian_bindings WHERE assistant_id = 'self' AND channel = 'vellum' AND status = 'active' LIMIT 1`,
+            `SELECT id FROM canonical_guardian_requests
+         WHERE guardian_principal_id IS NULL
+           AND status = 'pending'`,
           )
-          .get() as {
-          guardian_external_user_id: string;
-          guardian_principal_id: string | null;
-        } | null;
+          .all() as Array<{ id: string }>;
 
-        // Use the (now-backfilled) principal from the vellum binding
-        const assistantPrincipal =
-          vellumBinding?.guardian_principal_id ??
-          vellumBinding?.guardian_external_user_id ??
-          null;
+        for (const req of stillUnbound) {
+          expireStmt.run(now, req.id);
+        }
 
-        // ── Step 3: Backfill canonical_guardian_requests ────────────────
-        if (requestsTableExists) {
-          const requestColExists = raw
+        // Also expire requests identified in 3a that had no binding match.
+        for (const id of unboundRequestIds) {
+          const check = raw
             .query(
-              `SELECT 1 FROM pragma_table_info('canonical_guardian_requests') WHERE name = 'guardian_principal_id'`,
+              `SELECT guardian_principal_id FROM canonical_guardian_requests WHERE id = ? AND status = 'pending'`,
             )
-            .get();
-
-          if (requestColExists) {
-            const now = new Date().toISOString();
-
-            // 3a. Pending requests with a guardianExternalUserId that maps
-            // to an active binding — use the binding's principal.
-            // Includes all kinds; binding is always useful when available.
-            const pendingWithGuardian = raw
-              .query(
-                `SELECT r.id, r.guardian_external_user_id, r.kind
-             FROM canonical_guardian_requests r
-             WHERE r.status = 'pending'
-               AND r.guardian_principal_id IS NULL
-               AND r.guardian_external_user_id IS NOT NULL`,
-              )
-              .all() as Array<{
-              id: string;
-              guardian_external_user_id: string;
-              kind: string;
-            }>;
-
-            // Build a lookup of guardianExternalUserId -> principalId from
-            // active bindings (all already backfilled in step 1).
-            const activeBindings = raw
-              .query(
-                `SELECT guardian_external_user_id, guardian_principal_id
-             FROM channel_guardian_bindings
-             WHERE assistant_id = 'self' AND status = 'active' AND guardian_principal_id IS NOT NULL`,
-              )
-              .all() as Array<{
-              guardian_external_user_id: string;
-              guardian_principal_id: string;
-            }>;
-
-            const externalToP = new Map<string, string>();
-            for (const b of activeBindings) {
-              externalToP.set(
-                b.guardian_external_user_id,
-                b.guardian_principal_id,
-              );
-            }
-
-            const updateStmt = raw.prepare(
-              `UPDATE canonical_guardian_requests SET guardian_principal_id = ?, updated_at = ? WHERE id = ?`,
-            );
-            const expireStmt = raw.prepare(
-              `UPDATE canonical_guardian_requests SET status = 'expired', updated_at = ? WHERE id = ?`,
-            );
-
-            const unboundRequestIds: string[] = [];
-
-            for (const req of pendingWithGuardian) {
-              const principal = externalToP.get(req.guardian_external_user_id);
-              if (principal) {
-                updateStmt.run(principal, now, req.id);
-              } else {
-                // Cannot deterministically map — will expire below.
-                unboundRequestIds.push(req.id);
-              }
-            }
-
-            // 3b. Desktop-originated pending requests missing guardian info
-            // entirely — bind to the assistant principal. Only applies to
-            // requests that also lack a guardian external user ID; requests
-            // that carry an external ID but failed step 3a mapping should be
-            // expired, not reassigned.
-            if (assistantPrincipal) {
-              raw
-                .query(
-                  `UPDATE canonical_guardian_requests
-               SET guardian_principal_id = ?, updated_at = ?
-               WHERE status = 'pending'
-                 AND guardian_principal_id IS NULL
-                 AND guardian_external_user_id IS NULL
-                 AND (source_type = 'desktop' OR source_channel = 'vellum')`,
-                )
-                .run(assistantPrincipal, now);
-            }
-
-            // 3c. Expire remaining pending requests that still have no
-            // guardian_principal_id. These requests can never be approved
-            // in the principal-based system, so they must be expired
-            // proactively. This includes access_request rows which are
-            // now decisionable and principal-bound.
-            const stillUnbound = raw
-              .query(
-                `SELECT id FROM canonical_guardian_requests
-             WHERE guardian_principal_id IS NULL
-               AND status = 'pending'`,
-              )
-              .all() as Array<{ id: string }>;
-
-            for (const req of stillUnbound) {
-              expireStmt.run(now, req.id);
-            }
-
-            // Also expire requests identified in 3a that had no binding match.
-            for (const id of unboundRequestIds) {
-              const check = raw
-                .query(
-                  `SELECT guardian_principal_id FROM canonical_guardian_requests WHERE id = ? AND status = 'pending'`,
-                )
-                .get(id) as { guardian_principal_id: string | null } | null;
-              if (check && !check.guardian_principal_id) {
-                expireStmt.run(now, id);
-              }
-            }
+            .get(id) as { guardian_principal_id: string | null } | null;
+          if (check && !check.guardian_principal_id) {
+            expireStmt.run(now, id);
           }
         }
-
-        raw.exec("COMMIT");
-      } catch (e) {
-        try {
-          raw.exec("ROLLBACK");
-        } catch {
-          /* no active transaction */
-        }
-        throw e;
       }
-    },
-  );
+    }
+
+    raw.exec("COMMIT");
+  } catch (e) {
+    try {
+      raw.exec("ROLLBACK");
+    } catch {
+      /* no active transaction */
+    }
+    throw e;
+  }
 }

package/src/memory/migrations/127-guardian-principal-id-not-null.ts

@@ -1,5 +1,4 @@
 import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
-import { withCrashRecovery } from "./validate-migration-state.js";
 
 /**
  * Reverse v16: rebuild channel_guardian_bindings to make guardian_principal_id
@@ -94,108 +93,102 @@ export function downGuardianPrincipalIdNotNull(database: DrizzleDb): void {
  * already has NOT NULL.
  */
 export function migrateGuardianPrincipalIdNotNull(database: DrizzleDb): void {
-  withCrashRecovery(
-    database,
-    "migration_guardian_principal_id_not_null_v1",
-    () => {
-      const raw = getSqliteFrom(database);
-
-      // Guard: table must exist
-      const tableExists = raw
-        .query(
-          `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'channel_guardian_bindings'`,
-        )
-        .get();
-      if (!tableExists) return;
-
-      // Guard: column must exist (added by migration 125)
-      const colExists = raw
-        .query(
-          `SELECT 1 FROM pragma_table_info('channel_guardian_bindings') WHERE name = 'guardian_principal_id'`,
-        )
-        .get();
-      if (!colExists) return;
-
-      // Check if the column already has NOT NULL (idempotency)
-      const colInfo = raw
-        .query(
-          `SELECT "notnull" FROM pragma_table_info('channel_guardian_bindings') WHERE name = 'guardian_principal_id'`,
-        )
-        .get() as { notnull: number } | null;
-      if (colInfo && colInfo.notnull === 1) return;
-
-      raw.exec("PRAGMA foreign_keys = OFF");
-      try {
-        raw.exec("BEGIN");
-
-        // Backfill any remaining null rows before adding the constraint
-        raw.exec(/*sql*/ `
-        UPDATE channel_guardian_bindings
-        SET guardian_principal_id = guardian_external_user_id,
-            updated_at = ${Date.now()}
-        WHERE guardian_principal_id IS NULL
-          AND guardian_external_user_id IS NOT NULL
-      `);
-
-        // For any rows where even guardian_external_user_id is null (shouldn't
-        // happen but defensive), use 'unknown' as a placeholder
-        raw.exec(/*sql*/ `
-        UPDATE channel_guardian_bindings
-        SET guardian_principal_id = 'unknown',
-            updated_at = ${Date.now()}
-        WHERE guardian_principal_id IS NULL
-      `);
-
-        // Rebuild the table with NOT NULL on guardian_principal_id
-        raw.exec(/*sql*/ `
-        CREATE TABLE channel_guardian_bindings_new (
-          id TEXT PRIMARY KEY,
-          assistant_id TEXT NOT NULL,
-          channel TEXT NOT NULL,
-          guardian_external_user_id TEXT NOT NULL,
-          guardian_delivery_chat_id TEXT NOT NULL,
-          guardian_principal_id TEXT NOT NULL,
-          status TEXT NOT NULL DEFAULT 'active',
-          verified_at INTEGER NOT NULL,
-          verified_via TEXT NOT NULL DEFAULT 'challenge',
-          metadata_json TEXT,
-          created_at INTEGER NOT NULL,
-          updated_at INTEGER NOT NULL
-        )
-      `);
-
-        raw.exec(/*sql*/ `
-        INSERT INTO channel_guardian_bindings_new
-        SELECT id, assistant_id, channel, guardian_external_user_id,
-               guardian_delivery_chat_id, guardian_principal_id,
-               status, verified_at, verified_via, metadata_json,
-               created_at, updated_at
-        FROM channel_guardian_bindings
-      `);
-
-        raw.exec(/*sql*/ `DROP TABLE channel_guardian_bindings`);
-        raw.exec(
-          /*sql*/ `ALTER TABLE channel_guardian_bindings_new RENAME TO channel_guardian_bindings`,
-        );
-
-        // Recreate the unique index for active bindings
-        raw.exec(/*sql*/ `
-        CREATE UNIQUE INDEX IF NOT EXISTS idx_channel_guardian_bindings_active
-        ON channel_guardian_bindings(assistant_id, channel)
-        WHERE status = 'active'
-      `);
-
-        raw.exec("COMMIT");
-      } catch (e) {
-        try {
-          raw.exec("ROLLBACK");
-        } catch {
-          /* no active transaction */
-        }
-        throw e;
-      } finally {
-        raw.exec("PRAGMA foreign_keys = ON");
-      }
-    },
-  );
+  const raw = getSqliteFrom(database);
+
+  // Guard: table must exist
+  const tableExists = raw
+    .query(
+      `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'channel_guardian_bindings'`,
+    )
+    .get();
+  if (!tableExists) return;
+
+  // Guard: column must exist (added by migration 125)
+  const colExists = raw
+    .query(
+      `SELECT 1 FROM pragma_table_info('channel_guardian_bindings') WHERE name = 'guardian_principal_id'`,
+    )
+    .get();
+  if (!colExists) return;
+
+  // Check if the column already has NOT NULL (idempotency)
+  const colInfo = raw
+    .query(
+      `SELECT "notnull" FROM pragma_table_info('channel_guardian_bindings') WHERE name = 'guardian_principal_id'`,
+    )
+    .get() as { notnull: number } | null;
+  if (colInfo && colInfo.notnull === 1) return;
+
+  raw.exec("PRAGMA foreign_keys = OFF");
+  try {
+    raw.exec("BEGIN");
+
+    // Backfill any remaining null rows before adding the constraint
+    raw.exec(/*sql*/ `
+    UPDATE channel_guardian_bindings
+    SET guardian_principal_id = guardian_external_user_id,
+        updated_at = ${Date.now()}
+    WHERE guardian_principal_id IS NULL
+      AND guardian_external_user_id IS NOT NULL
+  `);
+
+    // For any rows where even guardian_external_user_id is null (shouldn't
+    // happen but defensive), use 'unknown' as a placeholder
+    raw.exec(/*sql*/ `
+    UPDATE channel_guardian_bindings
+    SET guardian_principal_id = 'unknown',
+        updated_at = ${Date.now()}
+    WHERE guardian_principal_id IS NULL
+  `);
+
+    // Rebuild the table with NOT NULL on guardian_principal_id
+    raw.exec(/*sql*/ `
+    CREATE TABLE channel_guardian_bindings_new (
+      id TEXT PRIMARY KEY,
+      assistant_id TEXT NOT NULL,
+      channel TEXT NOT NULL,
+      guardian_external_user_id TEXT NOT NULL,
+      guardian_delivery_chat_id TEXT NOT NULL,
+      guardian_principal_id TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'active',
+      verified_at INTEGER NOT NULL,
+      verified_via TEXT NOT NULL DEFAULT 'challenge',
+      metadata_json TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    )
+  `);
+
+    raw.exec(/*sql*/ `
+    INSERT INTO channel_guardian_bindings_new
+    SELECT id, assistant_id, channel, guardian_external_user_id,
+           guardian_delivery_chat_id, guardian_principal_id,
+           status, verified_at, verified_via, metadata_json,
+           created_at, updated_at
+    FROM channel_guardian_bindings
+  `);
+
+    raw.exec(/*sql*/ `DROP TABLE channel_guardian_bindings`);
+    raw.exec(
+      /*sql*/ `ALTER TABLE channel_guardian_bindings_new RENAME TO channel_guardian_bindings`,
+    );
+
+    // Recreate the unique index for active bindings
+    raw.exec(/*sql*/ `
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_channel_guardian_bindings_active
+    ON channel_guardian_bindings(assistant_id, channel)
+    WHERE status = 'active'
+  `);
+
+    raw.exec("COMMIT");
+  } catch (e) {
+    try {
+      raw.exec("ROLLBACK");
+    } catch {
+      /* no active transaction */
+    }
+    throw e;
+  } finally {
+    raw.exec("PRAGMA foreign_keys = ON");
+  }
 }