create-windy 0.6.14 → 0.6.16

package/template/packages/ai-client/src/client-agent/workflow-artifact/http.ts

@@ -0,0 +1,82 @@
+import type {
+  AdvanceClientAgentWorkflowArtifactRequest,
+  CancelClientAgentWorkflowArtifactRequest,
+  ClaimClientAgentWorkflowArtifactRequest,
+} from "./contracts.js";
+
+export const clientAgentWorkflowArtifactHttp = {
+  claim: "/api/agent/client-workflow-artifacts/claim",
+  advance: "/api/agent/client-workflow-artifacts/advance",
+  cancel: "/api/agent/client-workflow-artifacts/cancel",
+} as const;
+
+export type ClientAgentWorkflowArtifactHostAuthentication =
+  | { readonly mode: "current-session" }
+  | {
+      readonly mode: "paired-extension";
+      readonly accessToken: `bax_${string}`;
+    };
+
+export function clientAgentWorkflowArtifactClaimRequest(
+  body: ClaimClientAgentWorkflowArtifactRequest,
+  authentication: ClientAgentWorkflowArtifactHostAuthentication,
+  signal?: AbortSignal,
+): { url: string; init: RequestInit } {
+  return jsonRequest(
+    clientAgentWorkflowArtifactHttp.claim,
+    body,
+    authentication,
+    signal,
+  );
+}
+
+export function clientAgentWorkflowArtifactAdvanceRequest<Result>(
+  body: AdvanceClientAgentWorkflowArtifactRequest<Result>,
+  authentication: ClientAgentWorkflowArtifactHostAuthentication,
+  signal?: AbortSignal,
+): { url: string; init: RequestInit } {
+  return jsonRequest(
+    clientAgentWorkflowArtifactHttp.advance,
+    body,
+    authentication,
+    signal,
+  );
+}
+
+export function clientAgentWorkflowArtifactCancelRequest(
+  body: CancelClientAgentWorkflowArtifactRequest,
+  authentication: ClientAgentWorkflowArtifactHostAuthentication,
+  signal?: AbortSignal,
+): { url: string; init: RequestInit } {
+  return jsonRequest(
+    clientAgentWorkflowArtifactHttp.cancel,
+    body,
+    authentication,
+    signal,
+  );
+}
+
+function jsonRequest(
+  url: string,
+  body: unknown,
+  authentication: ClientAgentWorkflowArtifactHostAuthentication,
+  signal?: AbortSignal,
+): { url: string; init: RequestInit } {
+  const headers: Record<string, string> = {
+    "content-type": "application/json",
+  };
+  if (authentication.mode === "paired-extension") {
+    headers.authorization = `Bearer ${authentication.accessToken}`;
+  }
+  return {
+    url,
+    init: {
+      method: "POST",
+      headers,
+      credentials:
+        authentication.mode === "current-session" ? "same-origin" : "omit",
+      body: JSON.stringify(body),
+      ...(signal ? { signal } : {}),
+    },
+  };
+}

package/template/packages/ai-client/src/client-agent/workflow-artifact/index.ts

@@ -0,0 +1,3 @@
+export * from "./contracts.js";
+export * from "./http.js";
+export * from "./validation.js";

package/template/packages/ai-client/src/client-agent/workflow-artifact/validation.test.ts

@@ -0,0 +1,154 @@
+import { describe, expect, test } from "bun:test";
+import {
+  ClientAgentWorkflowArtifactContractError,
+  parseAdvanceClientAgentWorkflowArtifactRequest,
+  parseCancelClientAgentWorkflowArtifactRequest,
+  parseClientAgentWorkflowArtifactResponse,
+} from "./validation.js";
+
+describe("Client Agent Workflow Artifact validation", () => {
+  test("接受短期 grant 与最终 Artifact 安全摘要", () => {
+    const running = parseClientAgentWorkflowArtifactResponse({
+      workId: workId(),
+      status: "running",
+      claimVersion: 1,
+      claimToken: "cawc_12345678",
+      sessionGrant: grant(),
+      task: task(),
+    });
+    const completed = parseClientAgentWorkflowArtifactResponse({
+      workId: workId(),
+      status: "completed",
+      claimVersion: 1,
+      artifact: {
+        artifactId: "artifact_0001",
+        kind: "analysis-report",
+        contentType: "application/json",
+        filename: "analysis.json",
+        byteSize: 1024,
+        sha256: "d".repeat(64),
+      },
+    });
+
+    expect(running.sessionGrant?.sessionId).toBe("cas_1");
+    expect(completed.artifact?.filename).toBe("analysis.json");
+  });
+
+  test("拒绝 advance 注入内部 Workflow 或 Provider 坐标", () => {
+    expect(() =>
+      parseAdvanceClientAgentWorkflowArtifactRequest({
+        ...advance(),
+        workflowRunId: "workflow-run-1",
+      }),
+    ).toThrow("advance.workflowRunId 不允许");
+    expect(() =>
+      parseAdvanceClientAgentWorkflowArtifactRequest({
+        ...advance(),
+        providerUrl: "https://provider.example",
+      }),
+    ).toThrow(ClientAgentWorkflowArtifactContractError);
+  });
+
+  test("拒绝 claim token/receipt chain 与终态投影漂移", () => {
+    expect(() =>
+      parseAdvanceClientAgentWorkflowArtifactRequest({
+        ...advance(),
+        claimToken: "workflow-command-1",
+      }),
+    ).toThrow("claimToken 无效");
+    expect(() =>
+      parseAdvanceClientAgentWorkflowArtifactRequest({
+        ...advance(),
+        receiptIds: ["receipt_0001", "receipt_0001"],
+      }),
+    ).toThrow("receiptIds 不能重复");
+    expect(() =>
+      parseClientAgentWorkflowArtifactResponse({
+        workId: workId(),
+        status: "completed",
+        claimVersion: 1,
+      }),
+    ).toThrow("completed response 缺少 artifact");
+    expect(() =>
+      parseClientAgentWorkflowArtifactResponse({
+        workId: workId(),
+        status: "running",
+        claimVersion: 1,
+        claimToken: "cawc_12345678",
+        sessionGrant: { ...grant(), providerUrl: "https://provider.example" },
+        task: task(),
+      }),
+    ).toThrow("sessionGrant.providerUrl 不允许");
+    expect(() =>
+      parseCancelClientAgentWorkflowArtifactRequest({
+        workId: workId(),
+        claimToken: "cawc_12345678",
+        claimVersion: 0,
+      }),
+    ).toThrow("claimVersion 必须是正整数");
+  });
+
+  test("canonical task envelope 严格拒绝未知字段与非 JSON 输入", () => {
+    expect(() =>
+      parseClientAgentWorkflowArtifactResponse({
+        workId: workId(),
+        status: "running",
+        claimVersion: 1,
+        claimToken: "cawc_12345678",
+        sessionGrant: grant(),
+        task: { ...task(), rawArtifact: { secret: true } },
+      }),
+    ).toThrow("task.rawArtifact 不允许");
+  });
+
+  test("pending 投影使用尚未领取的 generation 0", () => {
+    expect(
+      parseClientAgentWorkflowArtifactResponse({
+        workId: workId(),
+        status: "pending",
+        claimVersion: 0,
+      }).claimVersion,
+    ).toBe(0);
+  });
+});
+
+function workId() {
+  return `cawa_${"w".repeat(32)}`;
+}
+
+function advance() {
+  return {
+    workId: workId(),
+    claimToken: `cawc_${"c".repeat(32)}`,
+    claimVersion: 1,
+    receiptIds: ["receipt_0001"],
+  };
+}
+
+function grant() {
+  return {
+    clientRunId: "carun_1",
+    sessionId: "cas_1",
+    trustedBaseUrl: "https://windy.example/api/agent/client-sessions/cas_1/v1/",
+    modelAlias: "windy-client-agent-v1",
+    limits: {
+      maxSteps: 8,
+      maxRequestBytes: 65_536,
+      maxResponseBytes: 65_536,
+      maxDurationSeconds: 60,
+      maxConcurrentRequests: 1,
+    },
+    expiresAt: "2026-08-28T10:00:00.000Z",
+    accessToken: `car_${"a".repeat(43)}`,
+    capabilities: ["pageAgentClientRun"],
+  };
+}
+
+function task() {
+  return {
+    schemaVersion: 1,
+    taskKey: "sharp.full-case.client-agent",
+    input: { artifactLocator: "case/clue.json" },
+    inputDigest: `sha256:${"f".repeat(64)}`,
+  };
+}

package/template/packages/ai-client/src/client-agent/workflow-artifact/validation.ts

@@ -0,0 +1,332 @@
+import { parseClientAgentSessionGrant } from "../validation.js";
+import {
+  clientAgentWorkflowArtifactSafeCodes,
+  clientAgentWorkflowArtifactWorkIdPrefix,
+  type AdvanceClientAgentWorkflowArtifactRequest,
+  type CancelClientAgentWorkflowArtifactRequest,
+  type ClaimClientAgentWorkflowArtifactRequest,
+  type ClientAgentWorkflowArtifactResponse,
+  type ClientAgentWorkflowArtifactSafeCode,
+  type ClientAgentWorkflowArtifactStatus,
+  type ClientAgentWorkflowArtifactSummary,
+  type ClientAgentWorkflowExecutionTask,
+  type ClientAgentWorkflowJsonValue,
+} from "./contracts.js";
+
+export class ClientAgentWorkflowArtifactContractError extends TypeError {
+  constructor(message: string) {
+    super(message);
+    this.name = "ClientAgentWorkflowArtifactContractError";
+  }
+}
+
+export function parseClaimClientAgentWorkflowArtifactRequest(
+  value: unknown,
+): ClaimClientAgentWorkflowArtifactRequest {
+  const input = strictObject(value, "claim", [
+    "workflowRunId",
+    "clientBindingDigest",
+  ]);
+  return {
+    workflowRunId: text(input.workflowRunId, "workflowRunId"),
+    clientBindingDigest: digest(
+      input.clientBindingDigest,
+      "clientBindingDigest",
+    ),
+  };
+}
+
+export function parseAdvanceClientAgentWorkflowArtifactRequest<
+  Result = unknown,
+>(value: unknown): AdvanceClientAgentWorkflowArtifactRequest<Result> {
+  const input = strictObject(value, "advance", [
+    "workId",
+    "claimToken",
+    "claimVersion",
+    "receiptIds",
+    "result",
+  ]);
+  return {
+    workId: workId(input.workId),
+    claimToken: claimToken(input.claimToken),
+    claimVersion: positive(input.claimVersion, "claimVersion"),
+    receiptIds: receiptIds(input.receiptIds),
+    ...(input.result === undefined ? {} : { result: input.result as Result }),
+  };
+}
+
+export function parseCancelClientAgentWorkflowArtifactRequest(
+  value: unknown,
+): CancelClientAgentWorkflowArtifactRequest {
+  const input = strictObject(value, "cancel", [
+    "workId",
+    "claimToken",
+    "claimVersion",
+  ]);
+  return {
+    workId: workId(input.workId),
+    claimToken: claimToken(input.claimToken),
+    claimVersion: positive(input.claimVersion, "claimVersion"),
+  };
+}
+
+export function parseClientAgentWorkflowArtifactResponse(
+  value: unknown,
+): ClientAgentWorkflowArtifactResponse {
+  const input = strictObject(value, "response", [
+    "workId",
+    "status",
+    "claimVersion",
+    "claimToken",
+    "sessionGrant",
+    "task",
+    "artifact",
+    "safeCode",
+  ]);
+  const status = workflowStatus(input.status);
+  const sessionGrant =
+    input.sessionGrant === undefined
+      ? undefined
+      : strictSessionGrant(input.sessionGrant);
+  const token =
+    input.claimToken === undefined ? undefined : claimToken(input.claimToken);
+  const artifact =
+    input.artifact === undefined ? undefined : artifactSummary(input.artifact);
+  const task = input.task === undefined ? undefined : executionTask(input.task);
+  assertProjection(status, token, sessionGrant, task, artifact);
+  return {
+    workId: workId(input.workId),
+    status,
+    claimVersion: nonNegative(input.claimVersion, "claimVersion"),
+    ...(token ? { claimToken: token } : {}),
+    ...(sessionGrant ? { sessionGrant } : {}),
+    ...(task ? { task } : {}),
+    ...(artifact ? { artifact } : {}),
+    ...(input.safeCode === undefined
+      ? {}
+      : { safeCode: safeCode(input.safeCode) }),
+  };
+}
+
+function executionTask(value: unknown): ClientAgentWorkflowExecutionTask {
+  const task = strictObject(value, "task", [
+    "schemaVersion",
+    "taskKey",
+    "input",
+    "inputDigest",
+  ]);
+  if (task.schemaVersion !== 1) invalid("task.schemaVersion 无效");
+  const taskKey = text(task.taskKey, "task.taskKey");
+  if (!/^[a-z0-9][a-z0-9._-]*$/u.test(taskKey)) {
+    invalid("task.taskKey 无效");
+  }
+  const input = jsonValue(task.input, "task.input");
+  if (new TextEncoder().encode(JSON.stringify(input)).byteLength > 256 * 1024) {
+    invalid("task.input 过大");
+  }
+  return {
+    schemaVersion: 1,
+    taskKey,
+    input,
+    inputDigest: digest(task.inputDigest, "task.inputDigest"),
+  };
+}
+
+function strictSessionGrant(value: unknown) {
+  const grant = strictObject(value, "sessionGrant", [
+    "clientRunId",
+    "sessionId",
+    "trustedBaseUrl",
+    "modelAlias",
+    "limits",
+    "expiresAt",
+    "accessToken",
+    "capabilities",
+  ]);
+  strictObject(grant.limits, "sessionGrant.limits", [
+    "maxSteps",
+    "maxRequestBytes",
+    "maxResponseBytes",
+    "maxDurationSeconds",
+    "maxConcurrentRequests",
+  ]);
+  return parseClientAgentSessionGrant(grant);
+}
+
+function artifactSummary(value: unknown): ClientAgentWorkflowArtifactSummary {
+  const artifact = strictObject(value, "artifact", [
+    "artifactId",
+    "kind",
+    "contentType",
+    "filename",
+    "byteSize",
+    "sha256",
+  ]);
+  const filename = text(artifact.filename, "artifact.filename");
+  if (filename.includes("/") || filename.includes("\\")) {
+    invalid("artifact.filename 无效");
+  }
+  return {
+    artifactId: opaque(artifact.artifactId, "artifact.artifactId"),
+    kind: text(artifact.kind, "artifact.kind"),
+    contentType: text(artifact.contentType, "artifact.contentType"),
+    filename,
+    byteSize: nonNegative(artifact.byteSize, "artifact.byteSize"),
+    sha256: hexDigest(artifact.sha256, "artifact.sha256"),
+  };
+}
+
+function assertProjection(
+  status: ClientAgentWorkflowArtifactStatus,
+  token: unknown,
+  sessionGrant: unknown,
+  task: unknown,
+  artifact: unknown,
+) {
+  if (status === "running" && (!token || !sessionGrant || !task)) {
+    invalid("running response 缺少 claimToken、sessionGrant 或 task");
+  }
+  if (status === "completed" && !artifact) {
+    invalid("completed response 缺少 artifact");
+  }
+  if (status !== "running" && (token || sessionGrant || task)) {
+    invalid("只有 running response 可以包含 claimToken、sessionGrant 和 task");
+  }
+  if (status !== "completed" && artifact) {
+    invalid("只有 completed response 可以包含 artifact");
+  }
+}
+
+function jsonValue(
+  value: unknown,
+  label: string,
+  depth = 0,
+): ClientAgentWorkflowJsonValue {
+  if (depth > 32) invalid(`${label} 嵌套过深`);
+  if (
+    value === null ||
+    typeof value === "string" ||
+    typeof value === "boolean" ||
+    (typeof value === "number" && Number.isFinite(value))
+  ) {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => jsonValue(item, label, depth + 1));
+  }
+  if (value && typeof value === "object") {
+    const record = value as Record<string, unknown>;
+    return Object.fromEntries(
+      Object.entries(record).map(([key, item]) => [
+        key,
+        jsonValue(item, `${label}.${key}`, depth + 1),
+      ]),
+    );
+  }
+  invalid(`${label} 不是 JSON`);
+}
+
+function workflowStatus(value: unknown): ClientAgentWorkflowArtifactStatus {
+  if (
+    value !== "pending" &&
+    value !== "running" &&
+    value !== "completed" &&
+    value !== "cancelled"
+  ) {
+    invalid("status 无效");
+  }
+  return value;
+}
+
+function safeCode(value: unknown): ClientAgentWorkflowArtifactSafeCode {
+  if (!clientAgentWorkflowArtifactSafeCodes.includes(value as never)) {
+    invalid("safeCode 无效");
+  }
+  return value as ClientAgentWorkflowArtifactSafeCode;
+}
+
+function receiptIds(value: unknown): readonly string[] {
+  if (!Array.isArray(value) || value.length === 0 || value.length > 128) {
+    invalid("receiptIds 无效");
+  }
+  const parsed = value.map((item) => opaque(item, "receiptId"));
+  if (new Set(parsed).size !== parsed.length) invalid("receiptIds 不能重复");
+  return parsed;
+}
+
+function workId(value: unknown): string {
+  return prefixedOpaque(
+    value,
+    "workId",
+    clientAgentWorkflowArtifactWorkIdPrefix,
+  );
+}
+
+function claimToken(value: unknown): string {
+  return prefixedOpaque(value, "claimToken", "cawc_");
+}
+
+function prefixedOpaque(value: unknown, label: string, prefix: string): string {
+  const parsed = opaque(value, label);
+  if (!parsed.startsWith(prefix)) invalid(`${label} 无效`);
+  return parsed;
+}
+
+function opaque(value: unknown, label: string): string {
+  const parsed = text(value, label);
+  if (!/^[A-Za-z0-9_-]{8,512}$/u.test(parsed)) invalid(`${label} 无效`);
+  return parsed;
+}
+
+function strictObject(
+  value: unknown,
+  label: string,
+  allowedKeys: readonly string[],
+): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    invalid(`${label} 必须是对象`);
+  }
+  const record = value as Record<string, unknown>;
+  const unknownKey = Object.keys(record).find(
+    (key) => !allowedKeys.includes(key),
+  );
+  if (unknownKey) invalid(`${label}.${unknownKey} 不允许`);
+  return record;
+}
+
+function text(value: unknown, label: string): string {
+  if (typeof value !== "string" || !value.trim() || value.length > 512) {
+    invalid(`${label} 无效`);
+  }
+  return value;
+}
+
+function positive(value: unknown, label: string): number {
+  if (!Number.isSafeInteger(value) || Number(value) <= 0) {
+    invalid(`${label} 必须是正整数`);
+  }
+  return Number(value);
+}
+
+function nonNegative(value: unknown, label: string): number {
+  if (!Number.isSafeInteger(value) || Number(value) < 0) {
+    invalid(`${label} 必须是非负整数`);
+  }
+  return Number(value);
+}
+
+function digest(value: unknown, label: string): `sha256:${string}` {
+  const parsed = text(value, label);
+  if (!/^sha256:[a-f0-9]{64}$/u.test(parsed)) invalid(`${label} 无效`);
+  return parsed as `sha256:${string}`;
+}
+
+function hexDigest(value: unknown, label: string): string {
+  const parsed = text(value, label);
+  if (!/^[a-f0-9]{64}$/u.test(parsed)) invalid(`${label} 无效`);
+  return parsed;
+}
+
+function invalid(message: string): never {
+  throw new ClientAgentWorkflowArtifactContractError(message);
+}

package/template/packages/database/drizzle/0062_client_agent_workflow_artifact.sql

@@ -0,0 +1,63 @@
+CREATE TABLE "client_agent_workflow_artifacts" (
+	"work_id" varchar(80) PRIMARY KEY NOT NULL,
+	"command_id" varchar(96) NOT NULL,
+	"durable_job_id" varchar(64) NOT NULL,
+	"run_id" varchar(96) NOT NULL,
+	"node_run_id" varchar(96) NOT NULL,
+	"effect_kind" varchar(24) NOT NULL,
+	"task_key" varchar(160) NOT NULL,
+	"operation_key" varchar(200) NOT NULL,
+	"binding_digest" varchar(71) NOT NULL,
+	"actor_id" varchar(64) NOT NULL,
+	"scope_digest" varchar(71) NOT NULL,
+	"authorization_snapshot_digest" varchar(71) NOT NULL,
+	"run_policy_digest" varchar(71) NOT NULL,
+	"request_digest" varchar(71) NOT NULL,
+	"input_digest" varchar(71) NOT NULL,
+	"effect_generation" integer NOT NULL,
+	"effect_fence_token_digest" varchar(71) NOT NULL,
+	"status" varchar(32) NOT NULL,
+	"claim_generation" integer DEFAULT 0 NOT NULL,
+	"client_binding_digest" varchar(71),
+	"installation_id" varchar(160),
+	"host_session_digest" varchar(71),
+	"client_session_id" varchar(80),
+	"claim_token_hash" varchar(71),
+	"claim_expires_at" double precision,
+	"history_sequence" integer DEFAULT 0 NOT NULL,
+	"history_head_digest" varchar(71),
+	"terminal_receipt_id" varchar(96),
+	"terminal_receipt_digest" varchar(71),
+	"terminal_request_digest" varchar(71),
+	"terminal_result_json" jsonb,
+	"artifact_ref" varchar(37),
+	"artifact_filename" varchar(240),
+	"artifact_content_type" varchar(120),
+	"artifact_byte_size" integer,
+	"artifact_sha256" varchar(64),
+	"cancel_requested_at" double precision,
+	"finished_at" double precision,
+	"version" integer DEFAULT 1 NOT NULL,
+	"created_at" double precision NOT NULL,
+	"updated_at" double precision NOT NULL,
+	CONSTRAINT "ck_client_agent_workflow_status" CHECK ("client_agent_workflow_artifacts"."status" in ('pending', 'claimed', 'cancellation-requested', 'completed', 'cancelled')),
+	CONSTRAINT "ck_client_agent_workflow_generation" CHECK ("client_agent_workflow_artifacts"."effect_generation" > 0 and "client_agent_workflow_artifacts"."claim_generation" >= 0),
+	CONSTRAINT "ck_client_agent_workflow_effect_kind" CHECK ("client_agent_workflow_artifacts"."effect_kind" = 'job'),
+	CONSTRAINT "ck_client_agent_workflow_claim_binding" CHECK (("client_agent_workflow_artifacts"."claim_generation" = 0 and "client_agent_workflow_artifacts"."status" in ('pending', 'cancellation-requested', 'cancelled') and "client_agent_workflow_artifacts"."client_binding_digest" is null and "client_agent_workflow_artifacts"."installation_id" is null and "client_agent_workflow_artifacts"."host_session_digest" is null and "client_agent_workflow_artifacts"."client_session_id" is null and "client_agent_workflow_artifacts"."claim_token_hash" is null and "client_agent_workflow_artifacts"."claim_expires_at" is null)
+        or ("client_agent_workflow_artifacts"."claim_generation" > 0 and "client_agent_workflow_artifacts"."status" <> 'pending' and "client_agent_workflow_artifacts"."client_binding_digest" is not null and "client_agent_workflow_artifacts"."installation_id" is not null and "client_agent_workflow_artifacts"."host_session_digest" is not null)),
+	CONSTRAINT "ck_client_agent_workflow_terminal" CHECK (("client_agent_workflow_artifacts"."status" = 'completed' and "client_agent_workflow_artifacts"."terminal_receipt_id" is not null and "client_agent_workflow_artifacts"."terminal_receipt_digest" is not null and "client_agent_workflow_artifacts"."terminal_request_digest" is not null and "client_agent_workflow_artifacts"."terminal_result_json" is not null and "client_agent_workflow_artifacts"."artifact_ref" is not null and "client_agent_workflow_artifacts"."artifact_filename" is not null and "client_agent_workflow_artifacts"."artifact_content_type" is not null and "client_agent_workflow_artifacts"."artifact_byte_size" is not null and "client_agent_workflow_artifacts"."artifact_sha256" is not null and "client_agent_workflow_artifacts"."finished_at" is not null)
+        or ("client_agent_workflow_artifacts"."status" = 'cancelled' and "client_agent_workflow_artifacts"."finished_at" is not null and "client_agent_workflow_artifacts"."terminal_receipt_id" is null and "client_agent_workflow_artifacts"."terminal_request_digest" is null and "client_agent_workflow_artifacts"."artifact_ref" is null)
+        or ("client_agent_workflow_artifacts"."status" in ('pending', 'claimed', 'cancellation-requested') and "client_agent_workflow_artifacts"."finished_at" is null and "client_agent_workflow_artifacts"."terminal_receipt_id" is null and "client_agent_workflow_artifacts"."terminal_request_digest" is null and "client_agent_workflow_artifacts"."artifact_ref" is null)),
+	CONSTRAINT "ck_client_agent_workflow_history" CHECK ("client_agent_workflow_artifacts"."history_sequence" >= 0 and ("client_agent_workflow_artifacts"."history_sequence" = 0 or "client_agent_workflow_artifacts"."history_head_digest" is not null)),
+	CONSTRAINT "ck_client_agent_workflow_version" CHECK ("client_agent_workflow_artifacts"."version" > 0 and "client_agent_workflow_artifacts"."created_at" <= "client_agent_workflow_artifacts"."updated_at")
+);
+--> statement-breakpoint
+ALTER TABLE "client_agent_workflow_artifacts" ADD CONSTRAINT "client_agent_workflow_artifacts_durable_job_id_durable_jobs_id_fk" FOREIGN KEY ("durable_job_id") REFERENCES "public"."durable_jobs"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "client_agent_workflow_artifacts" ADD CONSTRAINT "client_agent_workflow_artifacts_client_session_id_client_agent_sessions_session_id_fk" FOREIGN KEY ("client_session_id") REFERENCES "public"."client_agent_sessions"("session_id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "client_agent_workflow_artifacts" ADD CONSTRAINT "fk_client_agent_workflow_effect_fence" FOREIGN KEY ("command_id","run_id","node_run_id","effect_kind","effect_generation","request_digest","effect_fence_token_digest") REFERENCES "public"."agent_workflow_side_effect_commands"("command_id","run_id","node_run_id","effect_kind","generation","request_digest","fence_token_digest") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "uk_client_agent_workflow_command" ON "client_agent_workflow_artifacts" USING btree ("command_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "uk_client_agent_workflow_job" ON "client_agent_workflow_artifacts" USING btree ("durable_job_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "uk_client_agent_workflow_terminal_receipt" ON "client_agent_workflow_artifacts" USING btree ("terminal_receipt_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "uk_client_agent_workflow_client_session" ON "client_agent_workflow_artifacts" USING btree ("client_session_id");--> statement-breakpoint
+CREATE INDEX "idx_client_agent_workflow_claim" ON "client_agent_workflow_artifacts" USING btree ("actor_id","status","updated_at");--> statement-breakpoint
+CREATE INDEX "idx_client_agent_workflow_host" ON "client_agent_workflow_artifacts" USING btree ("host_session_digest","status");