or3-provider-sqlite 0.0.1 → 0.0.3

package/dist/runtime/server/db/migrate.js

@@ -4,18 +4,78 @@ import * as m002 from "./migrations/002_sync_tables.js";
 import * as m003 from "./migrations/003_sync_hardening.js";
 import * as m004 from "./migrations/004_auth_invites.js";
 import * as m005 from "./migrations/005_admin_stores.js";
+import * as m006 from "./migrations/006_sync_snapshots.js";
+import * as m007 from "./migrations/007_device_cursor_ownership.js";
+import * as m008 from "./migrations/008_upload_intents.js";
+import * as m009 from "./migrations/009_or3_connect.js";
+import * as m010 from "./migrations/010_connect_user_code_hmac.js";
+import * as m011 from "./migrations/011_connect_environment_scope_indexes.js";
+import * as m012 from "./migrations/012_connect_credential_redelivery.js";
+import * as m013 from "./migrations/013_connect_environment_lifecycle.js";
+import * as m014 from "./migrations/014_connect_retention_activation.js";
+import * as m015 from "./migrations/015_rate_limits.js";
+const REQUIRED_SCHEMA_TABLES = [
+  "users",
+  "auth_accounts",
+  "workspaces",
+  "workspace_members",
+  "server_version_counter",
+  "change_log",
+  "device_cursors",
+  "tombstones",
+  "s_threads",
+  "s_messages",
+  "s_projects",
+  "s_posts",
+  "s_kv",
+  "s_file_meta",
+  "s_notifications",
+  "auth_invites",
+  "admin_users",
+  "admin_workspace_settings",
+  "sync_snapshots",
+  "sync_snapshot_items",
+  "upload_intents",
+  "connect_device_authorizations",
+  "connect_environments",
+  "rate_limits"
+];
 const migrations = {
   "001_init": m001,
   "002_sync_tables": m002,
   "003_sync_hardening": m003,
   "004_auth_invites": m004,
-  "005_admin_stores": m005
+  "005_admin_stores": m005,
+  "006_sync_snapshots": m006,
+  "007_device_cursor_ownership": m007,
+  "008_upload_intents": m008,
+  "009_or3_connect": m009,
+  "010_connect_user_code_hmac": m010,
+  "011_connect_environment_scope_indexes": m011,
+  "012_connect_credential_redelivery": m012,
+  "013_connect_environment_lifecycle": m013,
+  "014_connect_retention_activation": m014,
+  "015_rate_limits": m015
 };
 class StaticMigrationProvider {
   async getMigrations() {
     return migrations;
   }
 }
+async function assertLatestSchemaIntegrity(db) {
+  const tables = await db.introspection.getTables({
+    withInternalKyselyTables: true
+  });
+  const tableNames = new Set(tables.map((table) => table.name));
+  const missing = REQUIRED_SCHEMA_TABLES.filter(
+    (tableName) => !tableNames.has(tableName)
+  );
+  if (missing.length > 0) {
+    throw new Error(
+      `SQLite schema integrity check failed; required tables are missing: ${missing.join(", ")}`
+    );
+  }
+}
 export async function runMigrations(db) {
   const migrator = new Migrator({
     db,
@@ -35,4 +95,5 @@ export async function runMigrations(db) {
     console.error("[or3-sqlite] migration error:", error);
     throw error;
   }
+  await assertLatestSchemaIntegrity(db);
 }

package/dist/runtime/server/db/migrations/006_sync_snapshots.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Migration 006: Durable, consistent sync snapshot pages.
+ *
+ * - Stores the winning operation ID on materialized rows and tombstones.
+ * - Adds immutable snapshot headers/items for pagination across requests.
+ * - Backfills deterministic operation IDs for existing materialized state.
+ */
+import type { Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/006_sync_snapshots.js

@@ -0,0 +1,106 @@
+import { sql } from "kysely";
+const SYNCED_TABLES = [
+  ["s_threads", "threads"],
+  ["s_messages", "messages"],
+  ["s_projects", "projects"],
+  ["s_posts", "posts"],
+  ["s_kv", "kv"],
+  ["s_file_meta", "file_meta"],
+  ["s_notifications", "notifications"]
+];
+export async function up(db) {
+  for (const [materializedTable, tableName] of SYNCED_TABLES) {
+    await sql.raw(
+      `ALTER TABLE "${materializedTable}" ADD COLUMN op_id TEXT NOT NULL DEFAULT ''`
+    ).execute(db);
+    await sql.raw(`
+            UPDATE "${materializedTable}" AS materialized
+            SET op_id = COALESCE(
+                (
+                    SELECT change.op_id
+                    FROM change_log AS change
+                    WHERE change.workspace_id = materialized.workspace_id
+                      AND change.table_name = '${tableName}'
+                      AND change.pk = materialized.id
+                      AND change.op = CASE WHEN materialized.deleted <> 0 THEN 'delete' ELSE 'put' END
+                      AND change.clock = materialized.clock
+                      AND change.hlc = materialized.hlc
+                    ORDER BY change.server_version DESC
+                    LIMIT 1
+                ),
+                'legacy:${tableName}:' || materialized.id || ':' || materialized.clock || ':' || materialized.hlc
+            )
+            WHERE materialized.op_id = ''
+        `).execute(db);
+  }
+  await sql.raw(
+    `ALTER TABLE tombstones ADD COLUMN hlc TEXT NOT NULL DEFAULT ''`
+  ).execute(db);
+  await sql.raw(
+    `ALTER TABLE tombstones ADD COLUMN op_id TEXT NOT NULL DEFAULT ''`
+  ).execute(db);
+  await sql.raw(`
+        UPDATE tombstones AS tombstone
+        SET
+            hlc = COALESCE(
+                (
+                    SELECT change.hlc
+                    FROM change_log AS change
+                    WHERE change.workspace_id = tombstone.workspace_id
+                      AND change.table_name = tombstone.table_name
+                      AND change.pk = tombstone.pk
+                      AND change.op = 'delete'
+                      AND change.server_version = tombstone.server_version
+                    LIMIT 1
+                ),
+                CASE WHEN tombstone.hlc <> '' THEN tombstone.hlc ELSE 'legacy:0' END
+            ),
+            op_id = COALESCE(
+                (
+                    SELECT change.op_id
+                    FROM change_log AS change
+                    WHERE change.workspace_id = tombstone.workspace_id
+                      AND change.table_name = tombstone.table_name
+                      AND change.pk = tombstone.pk
+                      AND change.op = 'delete'
+                      AND change.server_version = tombstone.server_version
+                    LIMIT 1
+                ),
+                'legacy:tombstone:' || tombstone.table_name || ':' || tombstone.pk || ':' || tombstone.clock
+            )
+        WHERE tombstone.hlc = '' OR tombstone.op_id = ''
+    `).execute(db);
+  await sql.raw(`
+        CREATE TABLE sync_snapshots (
+            id TEXT PRIMARY KEY,
+            workspace_id TEXT NOT NULL,
+            high_watermark INTEGER NOT NULL,
+            tables_json TEXT NOT NULL,
+            created_at INTEGER NOT NULL,
+            expires_at INTEGER NOT NULL
+        )
+    `).execute(db);
+  await sql.raw(`
+        CREATE INDEX idx_sync_snapshots_expires
+        ON sync_snapshots(expires_at)
+    `).execute(db);
+  await sql.raw(`
+        CREATE TABLE sync_snapshot_items (
+            snapshot_id TEXT NOT NULL,
+            table_name TEXT NOT NULL,
+            pk TEXT NOT NULL,
+            kind TEXT NOT NULL CHECK(kind IN ('row', 'tombstone')),
+            payload_json TEXT,
+            clock INTEGER NOT NULL,
+            hlc TEXT NOT NULL,
+            op_id TEXT NOT NULL,
+            server_deleted_at INTEGER,
+            PRIMARY KEY (snapshot_id, table_name, pk, kind),
+            FOREIGN KEY (snapshot_id) REFERENCES sync_snapshots(id) ON DELETE CASCADE
+        ) WITHOUT ROWID
+    `).execute(db);
+}
+export async function down(db) {
+  await db.schema.dropTable("sync_snapshot_items").ifExists().execute();
+  await db.schema.dropTable("sync_snapshots").ifExists().execute();
+}

package/dist/runtime/server/db/migrations/007_device_cursor_ownership.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Migration 007: bind device cursors to the authenticated user that created
+ * them. Legacy rows remain unbound until their next authenticated update.
+ */
+import type { Kysely } from 'kysely';
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(_db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/007_device_cursor_ownership.js

@@ -0,0 +1,5 @@
+export async function up(db) {
+  await db.schema.alterTable("device_cursors").addColumn("owner_user_id", "text").execute();
+}
+export async function down(_db) {
+}

package/dist/runtime/server/db/migrations/008_upload_intents.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+/** Persisted upload intents are both one-time authorizations and quota reservations. */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/008_upload_intents.js

@@ -0,0 +1,26 @@
+import { sql } from "kysely";
+export async function up(db) {
+  await sql`
+        CREATE TABLE upload_intents (
+            id TEXT PRIMARY KEY,
+            workspace_id TEXT NOT NULL,
+            hash TEXT NOT NULL,
+            mime_type TEXT NOT NULL,
+            size_bytes INTEGER NOT NULL,
+            reserved_bytes INTEGER NOT NULL,
+            expires_at INTEGER NOT NULL,
+            status TEXT NOT NULL CHECK (status IN ('active', 'consumed', 'cancelled', 'expired')),
+            storage_id TEXT,
+            created_at INTEGER NOT NULL,
+            consumed_at INTEGER,
+            cancelled_at INTEGER
+        )
+    `.execute(db);
+  await sql`CREATE INDEX upload_intents_workspace_status_expiry
+        ON upload_intents(workspace_id, status, expires_at, id)`.execute(db);
+  await sql`CREATE INDEX upload_intents_workspace_hash_status
+        ON upload_intents(workspace_id, hash, status)`.execute(db);
+}
+export async function down(db) {
+  await db.schema.dropTable("upload_intents").ifExists().execute();
+}

package/dist/runtime/server/db/migrations/009_or3_connect.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+/** Durable device authorization and enrolled-computer records for OR3 Connect. */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/009_or3_connect.js

@@ -0,0 +1,91 @@
+import { sql } from "kysely";
+export async function up(db) {
+  await sql`
+        CREATE TABLE connect_device_authorizations (
+            id TEXT PRIMARY KEY,
+            device_code_hash TEXT NOT NULL UNIQUE,
+            user_code_hash TEXT NOT NULL,
+            status TEXT NOT NULL CHECK (
+                status IN (
+                    'pending', 'provisioning', 'approved', 'delivering',
+                    'denied', 'consumed', 'expired'
+                )
+            ),
+            host_json TEXT NOT NULL,
+            approved_user_id TEXT,
+            approved_workspace_id TEXT,
+            environment_id TEXT,
+            credential_ciphertext TEXT,
+            credential_delivery_started_at INTEGER,
+            credential_redeliver_until INTEGER,
+            expires_at INTEGER NOT NULL,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL
+        )
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_status_expiry
+        ON connect_device_authorizations(status, expires_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_user_code
+        ON connect_device_authorizations(user_code_hash, created_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_environment
+        ON connect_device_authorizations(environment_id)
+    `.execute(db);
+  await sql`
+        CREATE TABLE connect_environments (
+            id TEXT PRIMARY KEY,
+            user_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            name TEXT NOT NULL,
+            platform TEXT NOT NULL,
+            architecture TEXT NOT NULL,
+            host_id TEXT,
+            signing_public_key TEXT,
+            noise_public_key TEXT,
+            authorization_id TEXT,
+            hostname TEXT NOT NULL,
+            tunnel_id TEXT NOT NULL,
+            dns_record_id TEXT NOT NULL,
+            control_token_hash TEXT NOT NULL UNIQUE,
+            access_credential_ciphertext TEXT NOT NULL,
+            tunnel_secret_ciphertext TEXT,
+            status TEXT NOT NULL CHECK (
+                status IN (
+                    'provisioning', 'active', 'revoking', 'revoked', 'error'
+                )
+            ),
+            lifecycle_attempts INTEGER NOT NULL DEFAULT 0,
+            lifecycle_next_attempt_at INTEGER NOT NULL DEFAULT 0,
+            lifecycle_claim_token TEXT,
+            lifecycle_claimed_until INTEGER,
+            provisioning_deadline_at INTEGER,
+            lifecycle_error TEXT,
+            last_seen_at INTEGER,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL,
+            revoked_at INTEGER
+        )
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_user_status
+        ON connect_environments(user_id, status, updated_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_workspace_status
+        ON connect_environments(workspace_id, status, updated_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_lifecycle_due
+        ON connect_environments(
+            status, lifecycle_next_attempt_at, lifecycle_claimed_until
+        )
+    `.execute(db);
+}
+export async function down(db) {
+  await db.schema.dropTable("connect_environments").ifExists().execute();
+  await db.schema.dropTable("connect_device_authorizations").ifExists().execute();
+}

package/dist/runtime/server/db/migrations/010_connect_user_code_hmac.d.ts

@@ -0,0 +1,10 @@
+import { type Kysely } from 'kysely';
+/**
+ * Purges legacy readable pairing phrases.
+ *
+ * Device authorizations are ten-minute, retryable setup records. Their former
+ * unkeyed hashes cannot be upgraded to the server-keyed HMAC without retaining
+ * the plaintext, so an upgrade deliberately invalidates in-flight records.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/010_connect_user_code_hmac.js

@@ -0,0 +1,97 @@
+import { sql } from "kysely";
+export async function up(db) {
+  const columns = await sql`
+        PRAGMA table_info(connect_device_authorizations)
+    `.execute(db);
+  if (!columns.rows.some((column) => column.name === "user_code_display")) {
+    return;
+  }
+  await sql`DROP INDEX IF EXISTS connect_authorizations_status_expiry`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_authorizations_user_code`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_authorizations_environment`.execute(db);
+  await sql`
+        ALTER TABLE connect_device_authorizations
+        RENAME TO connect_device_authorizations_legacy
+    `.execute(db);
+  await createSecureAuthorizationTable(db);
+  await sql`DROP TABLE connect_device_authorizations_legacy`.execute(db);
+}
+export async function down(db) {
+  const columns = await sql`
+        PRAGMA table_info(connect_device_authorizations)
+    `.execute(db);
+  if (columns.rows.some((column) => column.name === "user_code_display")) {
+    return;
+  }
+  await sql`DROP INDEX IF EXISTS connect_authorizations_status_expiry`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_authorizations_user_code`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_authorizations_environment`.execute(db);
+  await sql`
+        ALTER TABLE connect_device_authorizations
+        RENAME TO connect_device_authorizations_secure
+    `.execute(db);
+  await sql`
+        CREATE TABLE connect_device_authorizations (
+            id TEXT PRIMARY KEY,
+            device_code_hash TEXT NOT NULL UNIQUE,
+            user_code_hash TEXT NOT NULL,
+            user_code_display TEXT NOT NULL,
+            status TEXT NOT NULL CHECK (
+                status IN (
+                    'pending', 'provisioning', 'approved',
+                    'denied', 'consumed', 'expired'
+                )
+            ),
+            host_json TEXT NOT NULL,
+            approved_user_id TEXT,
+            approved_workspace_id TEXT,
+            environment_id TEXT,
+            credential_ciphertext TEXT,
+            expires_at INTEGER NOT NULL,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL
+        )
+    `.execute(db);
+  await createAuthorizationIndexes(db);
+  await sql`DROP TABLE connect_device_authorizations_secure`.execute(db);
+}
+async function createSecureAuthorizationTable(db) {
+  await sql`
+        CREATE TABLE connect_device_authorizations (
+            id TEXT PRIMARY KEY,
+            device_code_hash TEXT NOT NULL UNIQUE,
+            user_code_hash TEXT NOT NULL,
+            status TEXT NOT NULL CHECK (
+                status IN (
+                    'pending', 'provisioning', 'approved', 'delivering',
+                    'denied', 'consumed', 'expired'
+                )
+            ),
+            host_json TEXT NOT NULL,
+            approved_user_id TEXT,
+            approved_workspace_id TEXT,
+            environment_id TEXT,
+            credential_ciphertext TEXT,
+            credential_delivery_started_at INTEGER,
+            credential_redeliver_until INTEGER,
+            expires_at INTEGER NOT NULL,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL
+        )
+    `.execute(db);
+  await createAuthorizationIndexes(db);
+}
+async function createAuthorizationIndexes(db) {
+  await sql`
+        CREATE INDEX connect_authorizations_status_expiry
+        ON connect_device_authorizations(status, expires_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_user_code
+        ON connect_device_authorizations(user_code_hash, created_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_environment
+        ON connect_device_authorizations(environment_id)
+    `.execute(db);
+}

package/dist/runtime/server/db/migrations/011_connect_environment_scope_indexes.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+/** Compound indexes for account-and-workspace-bound Connect operations. */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/011_connect_environment_scope_indexes.js

@@ -0,0 +1,26 @@
+import { sql } from "kysely";
+export async function up(db) {
+  await sql`
+        CREATE INDEX connect_environments_user_workspace_status_updated
+        ON connect_environments(user_id, workspace_id, status, updated_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_user_workspace_control_token
+        ON connect_environments(user_id, workspace_id, control_token_hash)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_user_workspace_id
+        ON connect_environments(user_id, workspace_id, id)
+    `.execute(db);
+}
+export async function down(db) {
+  await sql`
+        DROP INDEX IF EXISTS connect_environments_user_workspace_id
+    `.execute(db);
+  await sql`
+        DROP INDEX IF EXISTS connect_environments_user_workspace_control_token
+    `.execute(db);
+  await sql`
+        DROP INDEX IF EXISTS connect_environments_user_workspace_status_updated
+    `.execute(db);
+}

package/dist/runtime/server/db/migrations/012_connect_credential_redelivery.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+/** Adds the bounded credential-delivery lease without losing pending requests. */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/012_connect_credential_redelivery.js

@@ -0,0 +1,124 @@
+import { sql } from "kysely";
+export async function up(db) {
+  const columns = await authorizationColumns(db);
+  if (columns.has("credential_redeliver_until")) return;
+  await dropAuthorizationIndexes(db);
+  await sql`
+        ALTER TABLE connect_device_authorizations
+        RENAME TO connect_device_authorizations_before_redelivery
+    `.execute(db);
+  await createRedeliveryTable(db);
+  await sql`
+        INSERT INTO connect_device_authorizations (
+            id, device_code_hash, user_code_hash, status, host_json,
+            approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, expires_at, created_at, updated_at
+        )
+        SELECT
+            id, device_code_hash, user_code_hash, status, host_json,
+            approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, expires_at, created_at, updated_at
+        FROM connect_device_authorizations_before_redelivery
+    `.execute(db);
+  await sql`
+        DROP TABLE connect_device_authorizations_before_redelivery
+    `.execute(db);
+}
+export async function down(db) {
+  const columns = await authorizationColumns(db);
+  if (!columns.has("credential_redeliver_until")) return;
+  await dropAuthorizationIndexes(db);
+  await sql`
+        ALTER TABLE connect_device_authorizations
+        RENAME TO connect_device_authorizations_with_redelivery
+    `.execute(db);
+  await sql`
+        CREATE TABLE connect_device_authorizations (
+            id TEXT PRIMARY KEY,
+            device_code_hash TEXT NOT NULL UNIQUE,
+            user_code_hash TEXT NOT NULL,
+            status TEXT NOT NULL CHECK (
+                status IN (
+                    'pending', 'provisioning', 'approved',
+                    'denied', 'consumed', 'expired'
+                )
+            ),
+            host_json TEXT NOT NULL,
+            approved_user_id TEXT,
+            approved_workspace_id TEXT,
+            environment_id TEXT,
+            credential_ciphertext TEXT,
+            expires_at INTEGER NOT NULL,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL
+        )
+    `.execute(db);
+  await sql`
+        INSERT INTO connect_device_authorizations (
+            id, device_code_hash, user_code_hash, status, host_json,
+            approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, expires_at, created_at, updated_at
+        )
+        SELECT
+            id, device_code_hash, user_code_hash,
+            CASE WHEN status = 'delivering' THEN 'approved' ELSE status END,
+            host_json, approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, expires_at, created_at, updated_at
+        FROM connect_device_authorizations_with_redelivery
+    `.execute(db);
+  await createAuthorizationIndexes(db);
+  await sql`
+        DROP TABLE connect_device_authorizations_with_redelivery
+    `.execute(db);
+}
+async function authorizationColumns(db) {
+  const result = await sql`
+        PRAGMA table_info(connect_device_authorizations)
+    `.execute(db);
+  return new Set(result.rows.map((column) => column.name));
+}
+async function createRedeliveryTable(db) {
+  await sql`
+        CREATE TABLE connect_device_authorizations (
+            id TEXT PRIMARY KEY,
+            device_code_hash TEXT NOT NULL UNIQUE,
+            user_code_hash TEXT NOT NULL,
+            status TEXT NOT NULL CHECK (
+                status IN (
+                    'pending', 'provisioning', 'approved', 'delivering',
+                    'denied', 'consumed', 'expired'
+                )
+            ),
+            host_json TEXT NOT NULL,
+            approved_user_id TEXT,
+            approved_workspace_id TEXT,
+            environment_id TEXT,
+            credential_ciphertext TEXT,
+            credential_delivery_started_at INTEGER,
+            credential_redeliver_until INTEGER,
+            expires_at INTEGER NOT NULL,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL
+        )
+    `.execute(db);
+  await createAuthorizationIndexes(db);
+}
+async function dropAuthorizationIndexes(db) {
+  await sql`DROP INDEX IF EXISTS connect_authorizations_status_expiry`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_authorizations_user_code`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_authorizations_environment`.execute(db);
+}
+async function createAuthorizationIndexes(db) {
+  await sql`
+        CREATE INDEX connect_authorizations_status_expiry
+        ON connect_device_authorizations(status, expires_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_user_code
+        ON connect_device_authorizations(user_code_hash, created_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_environment
+        ON connect_device_authorizations(environment_id)
+    `.execute(db);
+}

package/dist/runtime/server/db/migrations/013_connect_environment_lifecycle.d.ts

@@ -0,0 +1,10 @@
+import { type Kysely } from 'kysely';
+/**
+ * Adds durable provisioning/revocation work with lease-based claiming.
+ *
+ * SQLite cannot widen CHECK constraints in place, so both Connect tables are
+ * rebuilt transactionally while preserving active environments and approved
+ * credentials.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;