or3-provider-sqlite 0.0.2 → 0.0.3

package/dist/runtime/server/db/migrate.js

@@ -7,6 +7,13 @@ import * as m005 from "./migrations/005_admin_stores.js";
 import * as m006 from "./migrations/006_sync_snapshots.js";
 import * as m007 from "./migrations/007_device_cursor_ownership.js";
 import * as m008 from "./migrations/008_upload_intents.js";
+import * as m009 from "./migrations/009_or3_connect.js";
+import * as m010 from "./migrations/010_connect_user_code_hmac.js";
+import * as m011 from "./migrations/011_connect_environment_scope_indexes.js";
+import * as m012 from "./migrations/012_connect_credential_redelivery.js";
+import * as m013 from "./migrations/013_connect_environment_lifecycle.js";
+import * as m014 from "./migrations/014_connect_retention_activation.js";
+import * as m015 from "./migrations/015_rate_limits.js";
 const REQUIRED_SCHEMA_TABLES = [
   "users",
   "auth_accounts",
@@ -28,7 +35,10 @@ const REQUIRED_SCHEMA_TABLES = [
   "admin_workspace_settings",
   "sync_snapshots",
   "sync_snapshot_items",
-  "upload_intents"
+  "upload_intents",
+  "connect_device_authorizations",
+  "connect_environments",
+  "rate_limits"
 ];
 const migrations = {
   "001_init": m001,
@@ -38,7 +48,14 @@ const migrations = {
   "005_admin_stores": m005,
   "006_sync_snapshots": m006,
   "007_device_cursor_ownership": m007,
-  "008_upload_intents": m008
+  "008_upload_intents": m008,
+  "009_or3_connect": m009,
+  "010_connect_user_code_hmac": m010,
+  "011_connect_environment_scope_indexes": m011,
+  "012_connect_credential_redelivery": m012,
+  "013_connect_environment_lifecycle": m013,
+  "014_connect_retention_activation": m014,
+  "015_rate_limits": m015
 };
 class StaticMigrationProvider {
   async getMigrations() {

package/dist/runtime/server/db/migrations/009_or3_connect.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+/** Durable device authorization and enrolled-computer records for OR3 Connect. */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/009_or3_connect.js

@@ -0,0 +1,91 @@
+import { sql } from "kysely";
+export async function up(db) {
+  await sql`
+        CREATE TABLE connect_device_authorizations (
+            id TEXT PRIMARY KEY,
+            device_code_hash TEXT NOT NULL UNIQUE,
+            user_code_hash TEXT NOT NULL,
+            status TEXT NOT NULL CHECK (
+                status IN (
+                    'pending', 'provisioning', 'approved', 'delivering',
+                    'denied', 'consumed', 'expired'
+                )
+            ),
+            host_json TEXT NOT NULL,
+            approved_user_id TEXT,
+            approved_workspace_id TEXT,
+            environment_id TEXT,
+            credential_ciphertext TEXT,
+            credential_delivery_started_at INTEGER,
+            credential_redeliver_until INTEGER,
+            expires_at INTEGER NOT NULL,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL
+        )
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_status_expiry
+        ON connect_device_authorizations(status, expires_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_user_code
+        ON connect_device_authorizations(user_code_hash, created_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_environment
+        ON connect_device_authorizations(environment_id)
+    `.execute(db);
+  await sql`
+        CREATE TABLE connect_environments (
+            id TEXT PRIMARY KEY,
+            user_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            name TEXT NOT NULL,
+            platform TEXT NOT NULL,
+            architecture TEXT NOT NULL,
+            host_id TEXT,
+            signing_public_key TEXT,
+            noise_public_key TEXT,
+            authorization_id TEXT,
+            hostname TEXT NOT NULL,
+            tunnel_id TEXT NOT NULL,
+            dns_record_id TEXT NOT NULL,
+            control_token_hash TEXT NOT NULL UNIQUE,
+            access_credential_ciphertext TEXT NOT NULL,
+            tunnel_secret_ciphertext TEXT,
+            status TEXT NOT NULL CHECK (
+                status IN (
+                    'provisioning', 'active', 'revoking', 'revoked', 'error'
+                )
+            ),
+            lifecycle_attempts INTEGER NOT NULL DEFAULT 0,
+            lifecycle_next_attempt_at INTEGER NOT NULL DEFAULT 0,
+            lifecycle_claim_token TEXT,
+            lifecycle_claimed_until INTEGER,
+            provisioning_deadline_at INTEGER,
+            lifecycle_error TEXT,
+            last_seen_at INTEGER,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL,
+            revoked_at INTEGER
+        )
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_user_status
+        ON connect_environments(user_id, status, updated_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_workspace_status
+        ON connect_environments(workspace_id, status, updated_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_lifecycle_due
+        ON connect_environments(
+            status, lifecycle_next_attempt_at, lifecycle_claimed_until
+        )
+    `.execute(db);
+}
+export async function down(db) {
+  await db.schema.dropTable("connect_environments").ifExists().execute();
+  await db.schema.dropTable("connect_device_authorizations").ifExists().execute();
+}

package/dist/runtime/server/db/migrations/010_connect_user_code_hmac.d.ts

@@ -0,0 +1,10 @@
+import { type Kysely } from 'kysely';
+/**
+ * Purges legacy readable pairing phrases.
+ *
+ * Device authorizations are ten-minute, retryable setup records. Their former
+ * unkeyed hashes cannot be upgraded to the server-keyed HMAC without retaining
+ * the plaintext, so an upgrade deliberately invalidates in-flight records.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/010_connect_user_code_hmac.js

@@ -0,0 +1,97 @@
+import { sql } from "kysely";
+export async function up(db) {
+  const columns = await sql`
+        PRAGMA table_info(connect_device_authorizations)
+    `.execute(db);
+  if (!columns.rows.some((column) => column.name === "user_code_display")) {
+    return;
+  }
+  await sql`DROP INDEX IF EXISTS connect_authorizations_status_expiry`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_authorizations_user_code`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_authorizations_environment`.execute(db);
+  await sql`
+        ALTER TABLE connect_device_authorizations
+        RENAME TO connect_device_authorizations_legacy
+    `.execute(db);
+  await createSecureAuthorizationTable(db);
+  await sql`DROP TABLE connect_device_authorizations_legacy`.execute(db);
+}
+export async function down(db) {
+  const columns = await sql`
+        PRAGMA table_info(connect_device_authorizations)
+    `.execute(db);
+  if (columns.rows.some((column) => column.name === "user_code_display")) {
+    return;
+  }
+  await sql`DROP INDEX IF EXISTS connect_authorizations_status_expiry`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_authorizations_user_code`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_authorizations_environment`.execute(db);
+  await sql`
+        ALTER TABLE connect_device_authorizations
+        RENAME TO connect_device_authorizations_secure
+    `.execute(db);
+  await sql`
+        CREATE TABLE connect_device_authorizations (
+            id TEXT PRIMARY KEY,
+            device_code_hash TEXT NOT NULL UNIQUE,
+            user_code_hash TEXT NOT NULL,
+            user_code_display TEXT NOT NULL,
+            status TEXT NOT NULL CHECK (
+                status IN (
+                    'pending', 'provisioning', 'approved',
+                    'denied', 'consumed', 'expired'
+                )
+            ),
+            host_json TEXT NOT NULL,
+            approved_user_id TEXT,
+            approved_workspace_id TEXT,
+            environment_id TEXT,
+            credential_ciphertext TEXT,
+            expires_at INTEGER NOT NULL,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL
+        )
+    `.execute(db);
+  await createAuthorizationIndexes(db);
+  await sql`DROP TABLE connect_device_authorizations_secure`.execute(db);
+}
+async function createSecureAuthorizationTable(db) {
+  await sql`
+        CREATE TABLE connect_device_authorizations (
+            id TEXT PRIMARY KEY,
+            device_code_hash TEXT NOT NULL UNIQUE,
+            user_code_hash TEXT NOT NULL,
+            status TEXT NOT NULL CHECK (
+                status IN (
+                    'pending', 'provisioning', 'approved', 'delivering',
+                    'denied', 'consumed', 'expired'
+                )
+            ),
+            host_json TEXT NOT NULL,
+            approved_user_id TEXT,
+            approved_workspace_id TEXT,
+            environment_id TEXT,
+            credential_ciphertext TEXT,
+            credential_delivery_started_at INTEGER,
+            credential_redeliver_until INTEGER,
+            expires_at INTEGER NOT NULL,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL
+        )
+    `.execute(db);
+  await createAuthorizationIndexes(db);
+}
+async function createAuthorizationIndexes(db) {
+  await sql`
+        CREATE INDEX connect_authorizations_status_expiry
+        ON connect_device_authorizations(status, expires_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_user_code
+        ON connect_device_authorizations(user_code_hash, created_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_environment
+        ON connect_device_authorizations(environment_id)
+    `.execute(db);
+}

package/dist/runtime/server/db/migrations/011_connect_environment_scope_indexes.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+/** Compound indexes for account-and-workspace-bound Connect operations. */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/011_connect_environment_scope_indexes.js

@@ -0,0 +1,26 @@
+import { sql } from "kysely";
+export async function up(db) {
+  await sql`
+        CREATE INDEX connect_environments_user_workspace_status_updated
+        ON connect_environments(user_id, workspace_id, status, updated_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_user_workspace_control_token
+        ON connect_environments(user_id, workspace_id, control_token_hash)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_user_workspace_id
+        ON connect_environments(user_id, workspace_id, id)
+    `.execute(db);
+}
+export async function down(db) {
+  await sql`
+        DROP INDEX IF EXISTS connect_environments_user_workspace_id
+    `.execute(db);
+  await sql`
+        DROP INDEX IF EXISTS connect_environments_user_workspace_control_token
+    `.execute(db);
+  await sql`
+        DROP INDEX IF EXISTS connect_environments_user_workspace_status_updated
+    `.execute(db);
+}

package/dist/runtime/server/db/migrations/012_connect_credential_redelivery.d.ts

@@ -0,0 +1,4 @@
+import { type Kysely } from 'kysely';
+/** Adds the bounded credential-delivery lease without losing pending requests. */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/012_connect_credential_redelivery.js

@@ -0,0 +1,124 @@
+import { sql } from "kysely";
+export async function up(db) {
+  const columns = await authorizationColumns(db);
+  if (columns.has("credential_redeliver_until")) return;
+  await dropAuthorizationIndexes(db);
+  await sql`
+        ALTER TABLE connect_device_authorizations
+        RENAME TO connect_device_authorizations_before_redelivery
+    `.execute(db);
+  await createRedeliveryTable(db);
+  await sql`
+        INSERT INTO connect_device_authorizations (
+            id, device_code_hash, user_code_hash, status, host_json,
+            approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, expires_at, created_at, updated_at
+        )
+        SELECT
+            id, device_code_hash, user_code_hash, status, host_json,
+            approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, expires_at, created_at, updated_at
+        FROM connect_device_authorizations_before_redelivery
+    `.execute(db);
+  await sql`
+        DROP TABLE connect_device_authorizations_before_redelivery
+    `.execute(db);
+}
+export async function down(db) {
+  const columns = await authorizationColumns(db);
+  if (!columns.has("credential_redeliver_until")) return;
+  await dropAuthorizationIndexes(db);
+  await sql`
+        ALTER TABLE connect_device_authorizations
+        RENAME TO connect_device_authorizations_with_redelivery
+    `.execute(db);
+  await sql`
+        CREATE TABLE connect_device_authorizations (
+            id TEXT PRIMARY KEY,
+            device_code_hash TEXT NOT NULL UNIQUE,
+            user_code_hash TEXT NOT NULL,
+            status TEXT NOT NULL CHECK (
+                status IN (
+                    'pending', 'provisioning', 'approved',
+                    'denied', 'consumed', 'expired'
+                )
+            ),
+            host_json TEXT NOT NULL,
+            approved_user_id TEXT,
+            approved_workspace_id TEXT,
+            environment_id TEXT,
+            credential_ciphertext TEXT,
+            expires_at INTEGER NOT NULL,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL
+        )
+    `.execute(db);
+  await sql`
+        INSERT INTO connect_device_authorizations (
+            id, device_code_hash, user_code_hash, status, host_json,
+            approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, expires_at, created_at, updated_at
+        )
+        SELECT
+            id, device_code_hash, user_code_hash,
+            CASE WHEN status = 'delivering' THEN 'approved' ELSE status END,
+            host_json, approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, expires_at, created_at, updated_at
+        FROM connect_device_authorizations_with_redelivery
+    `.execute(db);
+  await createAuthorizationIndexes(db);
+  await sql`
+        DROP TABLE connect_device_authorizations_with_redelivery
+    `.execute(db);
+}
+async function authorizationColumns(db) {
+  const result = await sql`
+        PRAGMA table_info(connect_device_authorizations)
+    `.execute(db);
+  return new Set(result.rows.map((column) => column.name));
+}
+async function createRedeliveryTable(db) {
+  await sql`
+        CREATE TABLE connect_device_authorizations (
+            id TEXT PRIMARY KEY,
+            device_code_hash TEXT NOT NULL UNIQUE,
+            user_code_hash TEXT NOT NULL,
+            status TEXT NOT NULL CHECK (
+                status IN (
+                    'pending', 'provisioning', 'approved', 'delivering',
+                    'denied', 'consumed', 'expired'
+                )
+            ),
+            host_json TEXT NOT NULL,
+            approved_user_id TEXT,
+            approved_workspace_id TEXT,
+            environment_id TEXT,
+            credential_ciphertext TEXT,
+            credential_delivery_started_at INTEGER,
+            credential_redeliver_until INTEGER,
+            expires_at INTEGER NOT NULL,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL
+        )
+    `.execute(db);
+  await createAuthorizationIndexes(db);
+}
+async function dropAuthorizationIndexes(db) {
+  await sql`DROP INDEX IF EXISTS connect_authorizations_status_expiry`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_authorizations_user_code`.execute(db);
+  await sql`DROP INDEX IF EXISTS connect_authorizations_environment`.execute(db);
+}
+async function createAuthorizationIndexes(db) {
+  await sql`
+        CREATE INDEX connect_authorizations_status_expiry
+        ON connect_device_authorizations(status, expires_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_user_code
+        ON connect_device_authorizations(user_code_hash, created_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_environment
+        ON connect_device_authorizations(environment_id)
+    `.execute(db);
+}

package/dist/runtime/server/db/migrations/013_connect_environment_lifecycle.d.ts

@@ -0,0 +1,10 @@
+import { type Kysely } from 'kysely';
+/**
+ * Adds durable provisioning/revocation work with lease-based claiming.
+ *
+ * SQLite cannot widen CHECK constraints in place, so both Connect tables are
+ * rebuilt transactionally while preserving active environments and approved
+ * credentials.
+ */
+export declare function up(db: Kysely<unknown>): Promise<void>;
+export declare function down(db: Kysely<unknown>): Promise<void>;

package/dist/runtime/server/db/migrations/013_connect_environment_lifecycle.js

@@ -0,0 +1,261 @@
+import { sql } from "kysely";
+export async function up(db) {
+  const environmentColumns = await tableColumns(db, "connect_environments");
+  if (environmentColumns.has("lifecycle_claim_token")) return;
+  await dropConnectIndexes(db);
+  await sql`
+        ALTER TABLE connect_device_authorizations
+        RENAME TO connect_device_authorizations_before_lifecycle
+    `.execute(db);
+  await sql`
+        ALTER TABLE connect_environments
+        RENAME TO connect_environments_before_lifecycle
+    `.execute(db);
+  await createAuthorizationTable(db, true);
+  await createEnvironmentTable(db, true);
+  await sql`
+        INSERT INTO connect_device_authorizations (
+            id, device_code_hash, user_code_hash, status, host_json,
+            approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, credential_delivery_started_at,
+            credential_redeliver_until, expires_at, created_at, updated_at
+        )
+        SELECT
+            id, device_code_hash, user_code_hash, status, host_json,
+            approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, credential_delivery_started_at,
+            credential_redeliver_until, expires_at, created_at, updated_at
+        FROM connect_device_authorizations_before_lifecycle
+    `.execute(db);
+  await sql`
+        INSERT INTO connect_environments (
+            id, user_id, workspace_id, name, platform, architecture,
+            host_id, signing_public_key, noise_public_key, hostname,
+            tunnel_id, dns_record_id, control_token_hash,
+            access_credential_ciphertext, status, lifecycle_attempts,
+            lifecycle_next_attempt_at, last_seen_at, created_at, updated_at,
+            revoked_at
+        )
+        SELECT
+            id, user_id, workspace_id, name, platform, architecture,
+            host_id, signing_public_key, noise_public_key, hostname,
+            tunnel_id, dns_record_id, control_token_hash,
+            access_credential_ciphertext, status, 0, 0, last_seen_at,
+            created_at, updated_at, revoked_at
+        FROM connect_environments_before_lifecycle
+    `.execute(db);
+  await sql`
+        DROP TABLE connect_device_authorizations_before_lifecycle
+    `.execute(db);
+  await sql`DROP TABLE connect_environments_before_lifecycle`.execute(db);
+}
+export async function down(db) {
+  const environmentColumns = await tableColumns(db, "connect_environments");
+  if (!environmentColumns.has("lifecycle_claim_token")) return;
+  await dropConnectIndexes(db);
+  await sql`
+        ALTER TABLE connect_device_authorizations
+        RENAME TO connect_device_authorizations_with_lifecycle
+    `.execute(db);
+  await sql`
+        ALTER TABLE connect_environments
+        RENAME TO connect_environments_with_lifecycle
+    `.execute(db);
+  await createAuthorizationTable(db, false);
+  await createEnvironmentTable(db, false);
+  await sql`
+        INSERT INTO connect_device_authorizations (
+            id, device_code_hash, user_code_hash, status, host_json,
+            approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, credential_delivery_started_at,
+            credential_redeliver_until, expires_at, created_at, updated_at
+        )
+        SELECT
+            id, device_code_hash, user_code_hash,
+            CASE WHEN status = 'provisioning' THEN 'expired' ELSE status END,
+            host_json, approved_user_id, approved_workspace_id, environment_id,
+            credential_ciphertext, credential_delivery_started_at,
+            credential_redeliver_until, expires_at, created_at, updated_at
+        FROM connect_device_authorizations_with_lifecycle
+    `.execute(db);
+  await sql`
+        INSERT INTO connect_environments (
+            id, user_id, workspace_id, name, platform, architecture,
+            host_id, signing_public_key, noise_public_key, hostname,
+            tunnel_id, dns_record_id, control_token_hash,
+            access_credential_ciphertext, status, last_seen_at, created_at,
+            updated_at, revoked_at
+        )
+        SELECT
+            id, user_id, workspace_id, name, platform, architecture,
+            host_id, signing_public_key, noise_public_key, hostname,
+            tunnel_id, dns_record_id, control_token_hash,
+            access_credential_ciphertext,
+            CASE
+                WHEN status = 'provisioning' THEN 'error'
+                WHEN status = 'revoking' THEN 'revoked'
+                ELSE status
+            END,
+            last_seen_at, created_at, updated_at, revoked_at
+        FROM connect_environments_with_lifecycle
+    `.execute(db);
+  await sql`
+        DROP TABLE connect_device_authorizations_with_lifecycle
+    `.execute(db);
+  await sql`DROP TABLE connect_environments_with_lifecycle`.execute(db);
+}
+async function tableColumns(db, table) {
+  const result = await sql`
+        PRAGMA table_info(${sql.raw(table)})
+    `.execute(db);
+  return new Set(result.rows.map((column) => column.name));
+}
+async function createAuthorizationTable(db, lifecycle) {
+  const statuses = lifecycle ? "'pending', 'provisioning', 'approved', 'delivering', 'denied', 'consumed', 'expired'" : "'pending', 'approved', 'delivering', 'denied', 'consumed', 'expired'";
+  await sql`
+        CREATE TABLE connect_device_authorizations (
+            id TEXT PRIMARY KEY,
+            device_code_hash TEXT NOT NULL UNIQUE,
+            user_code_hash TEXT NOT NULL,
+            status TEXT NOT NULL CHECK (status IN (${sql.raw(statuses)})),
+            host_json TEXT NOT NULL,
+            approved_user_id TEXT,
+            approved_workspace_id TEXT,
+            environment_id TEXT,
+            credential_ciphertext TEXT,
+            credential_delivery_started_at INTEGER,
+            credential_redeliver_until INTEGER,
+            expires_at INTEGER NOT NULL,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL
+        )
+    `.execute(db);
+  await createAuthorizationIndexes(db);
+}
+async function createEnvironmentTable(db, lifecycle) {
+  if (!lifecycle) {
+    await sql`
+            CREATE TABLE connect_environments (
+                id TEXT PRIMARY KEY,
+                user_id TEXT NOT NULL,
+                workspace_id TEXT NOT NULL,
+                name TEXT NOT NULL,
+                platform TEXT NOT NULL,
+                architecture TEXT NOT NULL,
+                host_id TEXT,
+                signing_public_key TEXT,
+                noise_public_key TEXT,
+                hostname TEXT NOT NULL,
+                tunnel_id TEXT NOT NULL,
+                dns_record_id TEXT NOT NULL,
+                control_token_hash TEXT NOT NULL UNIQUE,
+                access_credential_ciphertext TEXT NOT NULL,
+                status TEXT NOT NULL CHECK (
+                    status IN ('active', 'revoked', 'error')
+                ),
+                last_seen_at INTEGER,
+                created_at INTEGER NOT NULL,
+                updated_at INTEGER NOT NULL,
+                revoked_at INTEGER
+            )
+        `.execute(db);
+    await createEnvironmentIndexes(db, false);
+    return;
+  }
+  await sql`
+        CREATE TABLE connect_environments (
+            id TEXT PRIMARY KEY,
+            user_id TEXT NOT NULL,
+            workspace_id TEXT NOT NULL,
+            name TEXT NOT NULL,
+            platform TEXT NOT NULL,
+            architecture TEXT NOT NULL,
+            host_id TEXT,
+            signing_public_key TEXT,
+            noise_public_key TEXT,
+            authorization_id TEXT,
+            hostname TEXT NOT NULL,
+            tunnel_id TEXT NOT NULL,
+            dns_record_id TEXT NOT NULL,
+            control_token_hash TEXT NOT NULL UNIQUE,
+            access_credential_ciphertext TEXT NOT NULL,
+            tunnel_secret_ciphertext TEXT,
+            status TEXT NOT NULL CHECK (
+                status IN (
+                    'provisioning', 'active', 'revoking', 'revoked', 'error'
+                )
+            ),
+            lifecycle_attempts INTEGER NOT NULL DEFAULT 0,
+            lifecycle_next_attempt_at INTEGER NOT NULL DEFAULT 0,
+            lifecycle_claim_token TEXT,
+            lifecycle_claimed_until INTEGER,
+            provisioning_deadline_at INTEGER,
+            lifecycle_error TEXT,
+            last_seen_at INTEGER,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL,
+            revoked_at INTEGER
+        )
+    `.execute(db);
+  await createEnvironmentIndexes(db, true);
+}
+async function dropConnectIndexes(db) {
+  const names = [
+    "connect_authorizations_status_expiry",
+    "connect_authorizations_user_code",
+    "connect_authorizations_environment",
+    "connect_environments_user_status",
+    "connect_environments_workspace_status",
+    "connect_environments_user_workspace_status_updated",
+    "connect_environments_user_workspace_control_token",
+    "connect_environments_user_workspace_id",
+    "connect_environments_lifecycle_due"
+  ];
+  for (const name of names) {
+    await sql`DROP INDEX IF EXISTS ${sql.raw(name)}`.execute(db);
+  }
+}
+async function createAuthorizationIndexes(db) {
+  await sql`
+        CREATE INDEX connect_authorizations_status_expiry
+        ON connect_device_authorizations(status, expires_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_user_code
+        ON connect_device_authorizations(user_code_hash, created_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_authorizations_environment
+        ON connect_device_authorizations(environment_id)
+    `.execute(db);
+}
+async function createEnvironmentIndexes(db, lifecycle) {
+  await sql`
+        CREATE INDEX connect_environments_user_status
+        ON connect_environments(user_id, status, updated_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_workspace_status
+        ON connect_environments(workspace_id, status, updated_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_user_workspace_status_updated
+        ON connect_environments(user_id, workspace_id, status, updated_at)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_user_workspace_control_token
+        ON connect_environments(user_id, workspace_id, control_token_hash)
+    `.execute(db);
+  await sql`
+        CREATE INDEX connect_environments_user_workspace_id
+        ON connect_environments(user_id, workspace_id, id)
+    `.execute(db);
+  if (lifecycle) {
+    await sql`
+            CREATE INDEX connect_environments_lifecycle_due
+            ON connect_environments(
+                status, lifecycle_next_attempt_at, lifecycle_claimed_until
+            )
+        `.execute(db);
+  }
+}