xaq-cli 0.0.0 → 0.1.0-nightly.72

package/dist/db-BEUEUPyP.js

@@ -0,0 +1,561 @@
+#!/usr/bin/env node
+import { chmodSync } from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+//#region server/db/schema.ts
+const MIGRATIONS = [
+	`
+  CREATE TABLE settings (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL
+  );
+
+  CREATE TABLE admin_sessions (
+    token_hash TEXT PRIMARY KEY,
+    created_at TEXT NOT NULL,
+    expires_at TEXT NOT NULL,
+    ip TEXT,
+    user_agent TEXT
+  );
+
+  CREATE TABLE accounts (
+    id TEXT PRIMARY KEY,
+    email TEXT NOT NULL UNIQUE,
+    display_name TEXT,
+    status TEXT NOT NULL DEFAULT 'active',
+    last_error TEXT,
+    refresh_token_enc TEXT NOT NULL,
+    access_token_enc TEXT,
+    access_expires_at TEXT,
+    scopes TEXT NOT NULL DEFAULT '[]',
+    history_id TEXT,
+    watch_expires_at TEXT,
+    last_sync_at TEXT,
+    created_at TEXT NOT NULL
+  );
+
+  -- Pending OAuth flows (state → PKCE verifier). Short-lived.
+  CREATE TABLE oauth_states (
+    state TEXT PRIMARY KEY,
+    code_verifier TEXT NOT NULL,
+    redirect_uri TEXT NOT NULL,
+    reauth_account_id TEXT,
+    created_at TEXT NOT NULL
+  );
+
+  CREATE TABLE agents (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    description TEXT,
+    key_prefix TEXT NOT NULL,
+    key_hash TEXT NOT NULL UNIQUE,
+    disabled INTEGER NOT NULL DEFAULT 0,
+    last_used_at TEXT,
+    created_at TEXT NOT NULL
+  );
+
+  CREATE TABLE grants (
+    id TEXT PRIMARY KEY,
+    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+    account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+    capabilities TEXT NOT NULL,           -- JSON Capability[]
+    label_scope TEXT,                     -- JSON string[] | NULL (= whole mailbox)
+    send_mode TEXT NOT NULL DEFAULT 'draft_only',
+    allow_to TEXT NOT NULL DEFAULT '[]',  -- JSON string[]
+    reply_only INTEGER NOT NULL DEFAULT 0,
+    max_sends_per_hour INTEGER,
+    max_sends_per_day INTEGER,
+    created_at TEXT NOT NULL,
+    UNIQUE (agent_id, account_id)
+  );
+
+  -- Agent event-feed cursor for the MCP pull tools (list_events / wait_for_events / ack_events).
+  CREATE TABLE agent_cursors (
+    agent_id TEXT PRIMARY KEY REFERENCES agents(id) ON DELETE CASCADE,
+    acked_seq INTEGER NOT NULL DEFAULT 0,
+    updated_at TEXT NOT NULL
+  );
+
+  CREATE TABLE events (
+    seq INTEGER PRIMARY KEY AUTOINCREMENT,
+    id TEXT NOT NULL UNIQUE,
+    type TEXT NOT NULL,
+    account_id TEXT NOT NULL,
+    gmail_message_id TEXT,
+    gmail_thread_id TEXT,
+    label_ids TEXT NOT NULL DEFAULT '[]',  -- JSON: message labels at event time (used for scope + filters)
+    message TEXT,                          -- JSON MessageSummary | NULL
+    changed_label_ids TEXT,                -- JSON string[] for label.added/removed
+    detail TEXT,                           -- JSON
+    dedupe_key TEXT NOT NULL UNIQUE,       -- e.g. "acc_x:msgid:message.received" — Pub/Sub is at-least-once
+    created_at TEXT NOT NULL
+  );
+  CREATE INDEX events_account_seq ON events(account_id, seq);
+  CREATE INDEX events_thread ON events(account_id, gmail_thread_id);
+  CREATE INDEX events_created ON events(created_at);
+
+  -- Threads the account has sent into; drives thread.reply_received.
+  CREATE TABLE sent_threads (
+    account_id TEXT NOT NULL,
+    gmail_thread_id TEXT NOT NULL,
+    last_sent_at TEXT NOT NULL,
+    PRIMARY KEY (account_id, gmail_thread_id)
+  );
+
+  CREATE TABLE webhooks (
+    id TEXT PRIMARY KEY,
+    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    url TEXT NOT NULL,
+    secret_enc TEXT NOT NULL,
+    secret_prefix TEXT NOT NULL,
+    event_types TEXT NOT NULL,   -- JSON EventType[]
+    filter TEXT NOT NULL DEFAULT '{}', -- JSON WebhookFilter
+    include_body INTEGER NOT NULL DEFAULT 0,
+    enabled INTEGER NOT NULL DEFAULT 1,
+    created_at TEXT NOT NULL
+  );
+
+  CREATE TABLE deliveries (
+    id TEXT PRIMARY KEY,
+    webhook_id TEXT NOT NULL REFERENCES webhooks(id) ON DELETE CASCADE,
+    event_seq INTEGER NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending',
+    attempts INTEGER NOT NULL DEFAULT 0,
+    next_attempt_at TEXT,
+    last_status_code INTEGER,
+    last_error TEXT,
+    last_response TEXT,
+    duration_ms INTEGER,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    UNIQUE (webhook_id, event_seq)
+  );
+  CREATE INDEX deliveries_due ON deliveries(status, next_attempt_at);
+  CREATE INDEX deliveries_webhook ON deliveries(webhook_id, created_at);
+
+  CREATE TABLE approvals (
+    id TEXT PRIMARY KEY,
+    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+    account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+    kind TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending',
+    draft_id TEXT NOT NULL,
+    payload TEXT NOT NULL,       -- JSON {to,cc,bcc,subject,body,threadId,attachments,reason}
+    decided_at TEXT,
+    decision_note TEXT,
+    sent_message_id TEXT,
+    error TEXT,
+    created_at TEXT NOT NULL,
+    expires_at TEXT NOT NULL
+  );
+  CREATE INDEX approvals_status ON approvals(status, created_at);
+
+  CREATE TABLE audit_log (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    ts TEXT NOT NULL,
+    actor_type TEXT NOT NULL,
+    actor_id TEXT,
+    action TEXT NOT NULL,
+    account_id TEXT,
+    target TEXT,
+    outcome TEXT NOT NULL,
+    reason TEXT,
+    duration_ms INTEGER,
+    detail TEXT
+  );
+  CREATE INDEX audit_ts ON audit_log(ts);
+  CREATE INDEX audit_actor ON audit_log(actor_id, ts);
+  `,
+	`
+  CREATE TABLE pairings (
+    id TEXT PRIMARY KEY,
+    device_code_hash TEXT NOT NULL UNIQUE, -- sha256 of the CLI's polling secret
+    user_code TEXT NOT NULL,               -- shown in the terminal and the console, e.g. "K7QM-2XPD"
+    name TEXT NOT NULL,
+    description TEXT,
+    requested TEXT NOT NULL DEFAULT '{}',  -- JSON
+    client TEXT NOT NULL DEFAULT '{}',     -- JSON
+    ip TEXT,
+    status TEXT NOT NULL DEFAULT 'pending',
+    agent_id TEXT REFERENCES agents(id) ON DELETE SET NULL,
+    api_key_enc TEXT,                      -- set on approval, wiped once delivered to the CLI
+    last_poll_at TEXT,
+    decided_at TEXT,
+    decision_note TEXT,
+    delivered_at TEXT,
+    created_at TEXT NOT NULL,
+    expires_at TEXT NOT NULL
+  );
+  CREATE INDEX pairings_status ON pairings(status, created_at);
+  CREATE INDEX pairings_user_code ON pairings(user_code);
+
+  -- Server-side cursor per agentinbox-listen consumer (MCP ack_events keeps using agent_cursors).
+  CREATE TABLE listener_cursors (
+    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+    consumer TEXT NOT NULL,
+    acked_seq INTEGER NOT NULL DEFAULT 0,
+    client TEXT NOT NULL DEFAULT '{}',
+    connected INTEGER NOT NULL DEFAULT 0,
+    last_seen_at TEXT,
+    updated_at TEXT NOT NULL,
+    PRIMARY KEY (agent_id, consumer)
+  );
+  `,
+	`
+  -- When Google said the refresh token expires (refresh_token_expires_in); NULL = long-lived.
+  ALTER TABLE accounts ADD COLUMN refresh_expires_at TEXT;
+  -- Why it expires: 'testing' (initial lifetime ~7 days: External app in Testing) or 'time_based'
+  -- (any other lifetime, e.g. time-based access the user chose on the consent screen). NULL = unknown.
+  ALTER TABLE accounts ADD COLUMN refresh_expiry_kind TEXT;
+  -- id_token "hd" claim: Workspace domain, '' = personal (non-Workspace) Google account, NULL = not known (connected before this migration).
+  ALTER TABLE accounts ADD COLUMN workspace_domain TEXT;
+  `,
+	`
+  -- Seq the consumer's cursor started at when it was created (the head, or 0 for start=beginning):
+  -- mail at or below it predates the listener (what \`listen --backfill\` replays). NULL = created
+  -- before this migration, or by an ack (unknown).
+  ALTER TABLE listener_cursors ADD COLUMN start_seq INTEGER;
+  `,
+	`
+  -- Last authenticated request to /mcp; throttled like last_used_at (first write immediate).
+  ALTER TABLE agents ADD COLUMN last_mcp_at TEXT;
+  -- 'paired' (approved from \`agentinbox connect\`: the key lives in a profile on that machine) or
+  -- 'key' (created in the console, key copied by hand).
+  ALTER TABLE agents ADD COLUMN origin TEXT NOT NULL DEFAULT 'key';
+  -- Backfill: a kept approved pairing, or a listener (\`listen\` runs on a pairing's profile), means paired.
+  UPDATE agents SET origin = 'paired'
+    WHERE id IN (SELECT agent_id FROM pairings WHERE status = 'approved' AND agent_id IS NOT NULL)
+       OR id IN (SELECT agent_id FROM listener_cursors);
+  `,
+	`
+  -- SetupState.verified now needs a successful tool call in the audit log (pruned after the retention
+  -- period) or a listener ack, and is remembered in setup.verifiedAt once seen. Installs where an agent
+  -- already reached /mcp counted as verified before: remember that, so the setup guide doesn't come back.
+  INSERT OR IGNORE INTO settings (key, value)
+    SELECT 'setup.verifiedAt', json_quote(strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+    WHERE EXISTS (SELECT 1 FROM agents WHERE last_mcp_at IS NOT NULL);
+  `,
+	`
+  -- Grants: calendar.read / calendar.write live in grants.capabilities; existing grants have neither (mail-only).
+  ALTER TABLE grants ADD COLUMN calendar_scope TEXT;   -- JSON string[] of calendar ids | NULL (= every calendar)
+  ALTER TABLE grants ADD COLUMN calendar_write_mode TEXT NOT NULL DEFAULT 'approval'; -- 'direct' | 'approval'
+
+  -- Accounts: granted scopes are already in accounts.scopes (JSON, since migration 1).
+  -- NULL = derive from scopes (missing calendar scopes → not_granted, else active); 'api_disabled' | 'error'
+  -- when a probe or sync said so (cleared by the next success).
+  ALTER TABLE accounts ADD COLUMN calendar_status TEXT;
+  ALTER TABLE accounts ADD COLUMN calendar_error TEXT;
+  ALTER TABLE accounts ADD COLUMN calendar_synced_at TEXT;
+
+  -- Events: calendar.* events carry a CalendarEventSummary instead of a message.
+  ALTER TABLE events ADD COLUMN calendar_id TEXT;       -- for calendar scopes and filters
+  ALTER TABLE events ADD COLUMN calendar_event TEXT;    -- JSON CalendarEventSummary | NULL
+
+  -- Incremental sync cursor (and optional push channel) per synced calendar.
+  CREATE TABLE calendar_sync (
+    account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+    calendar_id TEXT NOT NULL,
+    name TEXT,
+    access_role TEXT,
+    is_primary INTEGER NOT NULL DEFAULT 0,
+    sync_token TEXT,                 -- events.list nextSyncToken; NULL = needs a (baseline) full sync
+    baseline_at TEXT,                -- when the last full sync finished: events created before it aren't "new"
+    last_sync_at TEXT,
+    last_error TEXT,
+    channel_id TEXT,                 -- events.watch channel (push), NULL when polling only
+    channel_resource_id TEXT,
+    channel_token_hash TEXT,         -- sha256 of the X-Goog-Channel-Token we chose
+    channel_expires_at TEXT,
+    channel_verified_at TEXT,        -- Google's "sync" notification reached us (the address is reachable)
+    updated_at TEXT NOT NULL,
+    PRIMARY KEY (account_id, calendar_id)
+  );
+  CREATE UNIQUE INDEX calendar_sync_channel ON calendar_sync(channel_id) WHERE channel_id IS NOT NULL;
+
+  -- Last seen version of events on synced calendars, to tell created / updated (what changed) / cancelled
+  -- apart and to replay a 410 full resync as changes. Upcoming and recurring events only (pruned after end).
+  CREATE TABLE calendar_event_state (
+    account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+    calendar_id TEXT NOT NULL,
+    event_id TEXT NOT NULL,
+    fingerprint TEXT NOT NULL,       -- digest of the material fields (CalendarEventChange)
+    summary TEXT NOT NULL,           -- JSON CalendarEventSummary as last seen
+    description_hash TEXT,
+    ends_at TEXT,                    -- NULL for recurring series (kept while the series lives)
+    updated_at TEXT NOT NULL,
+    PRIMARY KEY (account_id, calendar_id, event_id)
+  );
+  CREATE INDEX calendar_event_state_ends ON calendar_event_state(ends_at);
+
+  -- Calendar approvals reuse the approvals table: kind 'calendar.*', draft_id '' (no Gmail draft),
+  -- payload JSON {calendar: CalendarApprovalDetail, reason, …}, sent_message_id = the Google event id once applied.
+
+  -- Existing installs (an account was connected before this upgrade) add Calendar explicitly with the
+  -- console's "Add Google Calendar" flow; fresh installs get it by default (no row = enabled).
+  INSERT OR IGNORE INTO settings (key, value)
+    SELECT 'calendar.setup', '{"enabled":false}'
+    WHERE EXISTS (SELECT 1 FROM accounts);
+  `,
+	`
+  -- One upstream with its credential. Gmail/Calendar stay in accounts (M1 doesn't move them).
+  CREATE TABLE connections (
+    id TEXT PRIMARY KEY,                       -- con_…
+    owner_id TEXT,                             -- NULL = the install's single owner (real multi-user is M4)
+    -- remote_http in M1. native_whoop (M2) and stdio (M4) are reserved, and native_google too (Gmail/Calendar
+    -- as a connection kind, docs "Code impact"): CHECKs can't be widened without rebuilding a table that
+    -- other tables reference.
+    kind TEXT NOT NULL CHECK (kind IN ('remote_http', 'native_whoop', 'stdio', 'native_google')),
+    -- The preset id (notion, whoop, …) or NULL for a custom server. Deliberately no CHECK: presets are validated
+    -- in code against the registry, so adding one never needs a rebuild of this table.
+    preset TEXT,
+    -- Operator-chosen; tools are exposed as <slug>__<tool>. No "_" in a slug, so the split is unambiguous.
+    slug TEXT NOT NULL UNIQUE CHECK (length(slug) BETWEEN 1 AND 24 AND slug NOT GLOB '*[^a-z0-9-]*'),
+    name TEXT NOT NULL,
+    url TEXT,                                  -- the MCP endpoint; required for remote_http
+    auth_type TEXT NOT NULL DEFAULT 'none' CHECK (auth_type IN ('none', 'header', 'oauth')),
+    -- What agents may do by default (Wynn's model): full | ask (risky tools wait for approval) | read.
+    level_default TEXT NOT NULL DEFAULT 'ask' CHECK (level_default IN ('full', 'ask', 'read')),
+    -- Admin-only private-target allow: the exact scheme://host:port the admin entered, or NULL (off).
+    -- Editing the URL clears it.
+    -- (No path, query, userinfo, blanks, backslash, percent-encoding, brackets or control characters; ends in
+    -- the port.) The code canonicalises it, and the guard itself validates host and ranges.
+    private_target TEXT CHECK (private_target IS NULL OR (
+      (private_target GLOB 'http://?*:[0-9]*' OR private_target GLOB 'https://?*:[0-9]*')
+      AND private_target NOT GLOB '*://*[/?#@ ]*' AND private_target NOT GLOB '*[^0-9]'
+      AND private_target NOT GLOB '*[\\%[]*'
+      AND private_target NOT GLOB '*[' || char(1) || '-' || char(31) || char(127) || ']*'
+    )),
+    status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'needs_reauth', 'error', 'disabled')),
+    status_reason TEXT,
+    -- When the credential stops working without a human (no refresh grant, or a hard cap such as Notion's
+    -- 180 days): drives the "expires in N days" warnings. NULL = not known to expire.
+    expires_at TEXT,
+    -- Negotiated protocol era and transport, cached (see the SDK ADR), and when it was last negotiated: the
+    -- cache expires from protocol_checked_at (the expiry is the code's).
+    protocol TEXT,
+    protocol_checked_at TEXT,
+    tools_cached_at TEXT,                      -- last successful tools/list
+    instructions_hash TEXT,                    -- sha256 of the server's instructions, pinned separately from tools
+    events_cursor TEXT,                        -- native presets: where the event poll resumes (e.g. WHOOP without a webhook URL)
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    CHECK (kind <> 'remote_http' OR url IS NOT NULL)
+  );
+
+  -- The connection's secrets, one row per connection. *_enc columns are AES-GCM ciphertext (server/crypto.ts)
+  -- and are never logged or sent to the console or agents.
+  CREATE TABLE connection_credentials (
+    connection_id TEXT PRIMARY KEY REFERENCES connections(id) ON DELETE CASCADE,
+    -- auth_type 'header': the static header injected on every request (e.g. Authorization: Bearer …).
+    header_name_enc TEXT,
+    header_value_enc TEXT,
+    -- auth_type 'oauth'. The issuer is the authorization server's exact issuer (checked on every flow). The
+    -- client is the registration (pre-registered, metadata document or DCR): JSON {client_id, client_secret?, …}.
+    oauth_issuer_enc TEXT,
+    oauth_client_enc TEXT,
+    access_token_enc TEXT,
+    refresh_token_enc TEXT,                    -- rotated with a compare-and-swap, saved before it's used
+    expires_at TEXT,                           -- access token expiry
+    scope TEXT,                                -- granted scopes, space-separated (the union after insufficient_scope)
+    -- An authorization in flight (cleared when it completes): the PKCE verifier and the discovery result
+    -- (JSON: resource metadata, authorization server metadata, resource, redirect URI).
+    pkce_verifier_enc TEXT,
+    discovery_enc TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+
+  -- Each upstream tool as pinned. Agents only ever see the pinned definition. A changed hash or a tool that
+  -- wasn't there at connect is held until the owner accepts the candidate.
+  CREATE TABLE upstream_tools (
+    connection_id TEXT NOT NULL REFERENCES connections(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,                        -- the upstream's own name
+    -- <slug>__<name> as listed to agents: [A-Za-z0-9_-], at most 64 (clients prepend mcp__<server>__).
+    exposed_name TEXT NOT NULL UNIQUE CHECK (length(exposed_name) BETWEEN 1 AND 64 AND exposed_name NOT GLOB '*[^A-Za-z0-9_-]*'),
+    -- JSON {title, description, inputSchema, outputSchema, annotations}; NULL only for a held new tool.
+    definition TEXT,
+    pin_hash TEXT,                             -- sha256(JCS({name, title, description, inputSchema, outputSchema, annotations}))
+    -- Risk classes (risky = irreversible; read = listed at the read-only level) and where they came from.
+    risky INTEGER NOT NULL DEFAULT 0 CHECK (risky IN (0, 1)),
+    read INTEGER NOT NULL DEFAULT 0 CHECK (read IN (0, 1)),
+    class_source TEXT NOT NULL CHECK (class_source IN ('preset', 'annotation', 'heuristic')),
+    state TEXT NOT NULL DEFAULT 'active' CHECK (state IN ('active', 'held')),
+    held_reason TEXT CHECK (held_reason IS NULL OR held_reason IN ('changed', 'new')),
+    candidate_definition TEXT,                 -- JSON, same shape as definition: what accepting would pin
+    candidate_hash TEXT,
+    first_seen_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    PRIMARY KEY (connection_id, name),
+    CHECK (risky = 0 OR read = 0),
+    CHECK ((definition IS NULL) = (pin_hash IS NULL)),
+    CHECK ((candidate_definition IS NULL) = (candidate_hash IS NULL)),
+    -- IS, not =: a NULL comparison would make the CHECK pass.
+    CHECK (
+      (state = 'active' AND held_reason IS NULL AND candidate_hash IS NULL AND pin_hash IS NOT NULL)
+      OR (state = 'held' AND held_reason IS 'changed' AND candidate_hash IS NOT NULL AND pin_hash IS NOT NULL)
+      OR (state = 'held' AND held_reason IS 'new' AND candidate_hash IS NOT NULL AND pin_hash IS NULL)
+    )
+  );
+
+  -- Per agent × connection access. No row = no access. There are no per-tool grant modes.
+  CREATE TABLE connection_grants (
+    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+    connection_id TEXT NOT NULL REFERENCES connections(id) ON DELETE CASCADE,
+    level TEXT NOT NULL CHECK (level IN ('full', 'ask', 'read')),
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    PRIMARY KEY (agent_id, connection_id)
+  );
+  CREATE INDEX connection_grants_connection ON connection_grants(connection_id);
+
+  -- "Always allow this": a matching call by this agent never asks again. Optionally only for one target:
+  -- an argument (JSON Pointer into the arguments) and its canonical JSON value.
+  CREATE TABLE approval_rules (
+    id TEXT PRIMARY KEY,                       -- rul_…
+    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+    connection_id TEXT NOT NULL REFERENCES connections(id) ON DELETE CASCADE,
+    tool TEXT NOT NULL,                        -- upstream tool name (upstream_tools.name), stable across slug edits
+    target_path TEXT,
+    target_value TEXT,
+    created_at TEXT NOT NULL,
+    CHECK ((target_path IS NULL) = (target_value IS NULL))
+  );
+  CREATE UNIQUE INDEX approval_rules_match ON approval_rules(agent_id, connection_id, tool, COALESCE(target_path, ''), COALESCE(target_value, ''));
+  CREATE INDEX approval_rules_connection ON approval_rules(connection_id);
+
+  -- Approvals, rebuilt: SQLite can't drop NOT NULL. account_id and draft_id become nullable (an mcp.call
+  -- has neither), connection_id and tool_call are added. Same ids, rowids (list order), indexes and
+  -- cascades; nothing references approvals, so dropping it cascades nowhere.
+  -- tool_call (mcp.call only): JSON {tool, exposedName, args (the exact canonical bytes, as a string),
+  -- argsSha256, pinHash, result (once executed)}.
+  CREATE TABLE approvals_new (
+    id TEXT PRIMARY KEY,
+    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+    account_id TEXT REFERENCES accounts(id) ON DELETE CASCADE,
+    connection_id TEXT REFERENCES connections(id) ON DELETE CASCADE,
+    kind TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending',
+    draft_id TEXT,
+    payload TEXT NOT NULL,       -- JSON {to,cc,bcc,subject,body,threadId,attachments,reason,…}
+    tool_call TEXT,
+    decided_at TEXT,
+    decision_note TEXT,
+    sent_message_id TEXT,
+    error TEXT,
+    created_at TEXT NOT NULL,
+    expires_at TEXT NOT NULL,
+    -- Mail and calendar kinds keep exactly the invariant they had (an account and a draft id, '' for
+    -- calendar); only mcp.call goes through a connection.
+    CHECK (
+      (kind = 'mcp.call' AND account_id IS NULL AND draft_id IS NULL AND connection_id IS NOT NULL AND tool_call IS NOT NULL)
+      OR (kind <> 'mcp.call' AND account_id IS NOT NULL AND draft_id IS NOT NULL AND connection_id IS NULL AND tool_call IS NULL)
+    )
+  );
+  INSERT INTO approvals_new (rowid, id, agent_id, account_id, kind, status, draft_id, payload, decided_at, decision_note, sent_message_id, error, created_at, expires_at)
+    SELECT rowid, id, agent_id, account_id, kind, status, draft_id, payload, decided_at, decision_note, sent_message_id, error, created_at, expires_at
+    FROM approvals ORDER BY rowid;
+  DROP TABLE approvals;
+  ALTER TABLE approvals_new RENAME TO approvals;
+  CREATE INDEX approvals_status ON approvals(status, created_at);
+  CREATE INDEX approvals_connection ON approvals(connection_id);
+
+  -- Events from connections (connection.auth_failed, connection.tool_changed, approval.requested, whoop.*) carry
+  -- their connection here. account_id stays NOT NULL: connection events store '' there. Additive, no rebuild.
+  ALTER TABLE events ADD COLUMN connection_id TEXT;
+  CREATE INDEX events_connection_seq ON events(connection_id, seq) WHERE connection_id IS NOT NULL;
+  `,
+	`
+  -- When the stored access token was issued: proactive refresh runs at expires_at - max(60 s, 10 % of the lifetime).
+  ALTER TABLE connection_credentials ADD COLUMN issued_at TEXT;
+  -- An upstream connection's authorization in flight (/oauth/connections/callback): state -> connection. NULL for
+  -- Google's flow. code_verifier is '' for these rows: the verifier is kept encrypted, keyed by state, in
+  -- connection_credentials.pkce_verifier_enc.
+  ALTER TABLE oauth_states ADD COLUMN connection_id TEXT REFERENCES connections(id) ON DELETE CASCADE;
+  `,
+	`
+  -- 1: every agent gets this connection at level_default, including agents created later (console, pairing).
+  -- NULL: only the agents picked (connection_grants). Per-agent levels still live in connection_grants.
+  ALTER TABLE connections ADD COLUMN all_agents INTEGER CHECK (all_agents IS NULL OR all_agents = 1);
+  `
+];
+//#endregion
+//#region server/db/index.ts
+/** Thin synchronous wrapper over node:sqlite. All repos go through this. */
+var Db = class {
+	raw;
+	depth = 0;
+	constructor(path) {
+		this.raw = new DatabaseSync(path);
+		this.raw.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON; PRAGMA busy_timeout = 5000;");
+		this.migrate();
+		if (path !== ":memory:") for (const file of [
+			path,
+			`${path}-wal`,
+			`${path}-shm`
+		]) try {
+			chmodSync(file, 384);
+		} catch {}
+	}
+	get(sql, ...params) {
+		return this.raw.prepare(sql).get(...params);
+	}
+	all(sql, ...params) {
+		return this.raw.prepare(sql).all(...params);
+	}
+	run(sql, ...params) {
+		const r = this.raw.prepare(sql).run(...params);
+		return {
+			changes: Number(r.changes),
+			lastInsertRowid: Number(r.lastInsertRowid)
+		};
+	}
+	/** Nested calls join the outer transaction (savepoints). */
+	tx(fn) {
+		const sp = `sp${this.depth++}`;
+		this.raw.exec(`SAVEPOINT ${sp}`);
+		try {
+			const out = fn();
+			this.raw.exec(`RELEASE ${sp}`);
+			return out;
+		} catch (err) {
+			this.raw.exec(`ROLLBACK TO ${sp}; RELEASE ${sp}`);
+			throw err;
+		} finally {
+			this.depth--;
+		}
+	}
+	close() {
+		this.raw.close();
+	}
+	migrate() {
+		this.raw.exec("CREATE TABLE IF NOT EXISTS _migrations (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL)");
+		const current = this.get("SELECT MAX(version) AS v FROM _migrations")?.v ?? 0;
+		MIGRATIONS.forEach((sql, i) => {
+			const version = i + 1;
+			if (version <= current) return;
+			this.tx(() => {
+				this.raw.exec(sql);
+				this.run("INSERT INTO _migrations (version, applied_at) VALUES (?, ?)", version, (/* @__PURE__ */ new Date()).toISOString());
+			});
+		});
+	}
+};
+const json = {
+	parse(v, fallback) {
+		if (typeof v !== "string" || v === "") return fallback;
+		try {
+			return JSON.parse(v);
+		} catch {
+			return fallback;
+		}
+	},
+	str(v) {
+		return JSON.stringify(v);
+	}
+};
+const bool = (v) => v === 1 || v === 1n || v === true;
+const now = () => (/* @__PURE__ */ new Date()).toISOString();
+//#endregion
+export { now as i, bool as n, json as r, Db as t };
+
+//# sourceMappingURL=db-BEUEUPyP.js.map

package/dist/db-BEUEUPyP.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-BEUEUPyP.js","names":[],"sources":["../server/db/schema.ts","../server/db/index.ts"],"sourcesContent":["// Ordered migrations. Append only — never edit a shipped migration.\n// Conventions: ids are prefixed TEXT, timestamps are ISO-8601 TEXT (UTC), JSON is TEXT,\n// booleans are INTEGER 0/1, secrets are AES-GCM ciphertext TEXT (see server/crypto.ts).\n\nexport const MIGRATIONS: string[] = [\n  /* 1: initial schema */ `\n  CREATE TABLE settings (\n    key TEXT PRIMARY KEY,\n    value TEXT NOT NULL\n  );\n\n  CREATE TABLE admin_sessions (\n    token_hash TEXT PRIMARY KEY,\n    created_at TEXT NOT NULL,\n    expires_at TEXT NOT NULL,\n    ip TEXT,\n    user_agent TEXT\n  );\n\n  CREATE TABLE accounts (\n    id TEXT PRIMARY KEY,\n    email TEXT NOT NULL UNIQUE,\n    display_name TEXT,\n    status TEXT NOT NULL DEFAULT 'active',\n    last_error TEXT,\n    refresh_token_enc TEXT NOT NULL,\n    access_token_enc TEXT,\n    access_expires_at TEXT,\n    scopes TEXT NOT NULL DEFAULT '[]',\n    history_id TEXT,\n    watch_expires_at TEXT,\n    last_sync_at TEXT,\n    created_at TEXT NOT NULL\n  );\n\n  -- Pending OAuth flows (state → PKCE verifier). Short-lived.\n  CREATE TABLE oauth_states (\n    state TEXT PRIMARY KEY,\n    code_verifier TEXT NOT NULL,\n    redirect_uri TEXT NOT NULL,\n    reauth_account_id TEXT,\n    created_at TEXT NOT NULL\n  );\n\n  CREATE TABLE agents (\n    id TEXT PRIMARY KEY,\n    name TEXT NOT NULL,\n    description TEXT,\n    key_prefix TEXT NOT NULL,\n    key_hash TEXT NOT NULL UNIQUE,\n    disabled INTEGER NOT NULL DEFAULT 0,\n    last_used_at TEXT,\n    created_at TEXT NOT NULL\n  );\n\n  CREATE TABLE grants (\n    id TEXT PRIMARY KEY,\n    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,\n    account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,\n    capabilities TEXT NOT NULL,           -- JSON Capability[]\n    label_scope TEXT,                     -- JSON string[] | NULL (= whole mailbox)\n    send_mode TEXT NOT NULL DEFAULT 'draft_only',\n    allow_to TEXT NOT NULL DEFAULT '[]',  -- JSON string[]\n    reply_only INTEGER NOT NULL DEFAULT 0,\n    max_sends_per_hour INTEGER,\n    max_sends_per_day INTEGER,\n    created_at TEXT NOT NULL,\n    UNIQUE (agent_id, account_id)\n  );\n\n  -- Agent event-feed cursor for the MCP pull tools (list_events / wait_for_events / ack_events).\n  CREATE TABLE agent_cursors (\n    agent_id TEXT PRIMARY KEY REFERENCES agents(id) ON DELETE CASCADE,\n    acked_seq INTEGER NOT NULL DEFAULT 0,\n    updated_at TEXT NOT NULL\n  );\n\n  CREATE TABLE events (\n    seq INTEGER PRIMARY KEY AUTOINCREMENT,\n    id TEXT NOT NULL UNIQUE,\n    type TEXT NOT NULL,\n    account_id TEXT NOT NULL,\n    gmail_message_id TEXT,\n    gmail_thread_id TEXT,\n    label_ids TEXT NOT NULL DEFAULT '[]',  -- JSON: message labels at event time (used for scope + filters)\n    message TEXT,                          -- JSON MessageSummary | NULL\n    changed_label_ids TEXT,                -- JSON string[] for label.added/removed\n    detail TEXT,                           -- JSON\n    dedupe_key TEXT NOT NULL UNIQUE,       -- e.g. \"acc_x:msgid:message.received\" — Pub/Sub is at-least-once\n    created_at TEXT NOT NULL\n  );\n  CREATE INDEX events_account_seq ON events(account_id, seq);\n  CREATE INDEX events_thread ON events(account_id, gmail_thread_id);\n  CREATE INDEX events_created ON events(created_at);\n\n  -- Threads the account has sent into; drives thread.reply_received.\n  CREATE TABLE sent_threads (\n    account_id TEXT NOT NULL,\n    gmail_thread_id TEXT NOT NULL,\n    last_sent_at TEXT NOT NULL,\n    PRIMARY KEY (account_id, gmail_thread_id)\n  );\n\n  CREATE TABLE webhooks (\n    id TEXT PRIMARY KEY,\n    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,\n    name TEXT NOT NULL,\n    url TEXT NOT NULL,\n    secret_enc TEXT NOT NULL,\n    secret_prefix TEXT NOT NULL,\n    event_types TEXT NOT NULL,   -- JSON EventType[]\n    filter TEXT NOT NULL DEFAULT '{}', -- JSON WebhookFilter\n    include_body INTEGER NOT NULL DEFAULT 0,\n    enabled INTEGER NOT NULL DEFAULT 1,\n    created_at TEXT NOT NULL\n  );\n\n  CREATE TABLE deliveries (\n    id TEXT PRIMARY KEY,\n    webhook_id TEXT NOT NULL REFERENCES webhooks(id) ON DELETE CASCADE,\n    event_seq INTEGER NOT NULL,\n    status TEXT NOT NULL DEFAULT 'pending',\n    attempts INTEGER NOT NULL DEFAULT 0,\n    next_attempt_at TEXT,\n    last_status_code INTEGER,\n    last_error TEXT,\n    last_response TEXT,\n    duration_ms INTEGER,\n    created_at TEXT NOT NULL,\n    updated_at TEXT NOT NULL,\n    UNIQUE (webhook_id, event_seq)\n  );\n  CREATE INDEX deliveries_due ON deliveries(status, next_attempt_at);\n  CREATE INDEX deliveries_webhook ON deliveries(webhook_id, created_at);\n\n  CREATE TABLE approvals (\n    id TEXT PRIMARY KEY,\n    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,\n    account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,\n    kind TEXT NOT NULL,\n    status TEXT NOT NULL DEFAULT 'pending',\n    draft_id TEXT NOT NULL,\n    payload TEXT NOT NULL,       -- JSON {to,cc,bcc,subject,body,threadId,attachments,reason}\n    decided_at TEXT,\n    decision_note TEXT,\n    sent_message_id TEXT,\n    error TEXT,\n    created_at TEXT NOT NULL,\n    expires_at TEXT NOT NULL\n  );\n  CREATE INDEX approvals_status ON approvals(status, created_at);\n\n  CREATE TABLE audit_log (\n    id INTEGER PRIMARY KEY AUTOINCREMENT,\n    ts TEXT NOT NULL,\n    actor_type TEXT NOT NULL,\n    actor_id TEXT,\n    action TEXT NOT NULL,\n    account_id TEXT,\n    target TEXT,\n    outcome TEXT NOT NULL,\n    reason TEXT,\n    duration_ms INTEGER,\n    detail TEXT\n  );\n  CREATE INDEX audit_ts ON audit_log(ts);\n  CREATE INDEX audit_actor ON audit_log(actor_id, ts);\n  `,\n\n  /* 2: device-flow pairing + listener cursors */ `\n  CREATE TABLE pairings (\n    id TEXT PRIMARY KEY,\n    device_code_hash TEXT NOT NULL UNIQUE, -- sha256 of the CLI's polling secret\n    user_code TEXT NOT NULL,               -- shown in the terminal and the console, e.g. \"K7QM-2XPD\"\n    name TEXT NOT NULL,\n    description TEXT,\n    requested TEXT NOT NULL DEFAULT '{}',  -- JSON\n    client TEXT NOT NULL DEFAULT '{}',     -- JSON\n    ip TEXT,\n    status TEXT NOT NULL DEFAULT 'pending',\n    agent_id TEXT REFERENCES agents(id) ON DELETE SET NULL,\n    api_key_enc TEXT,                      -- set on approval, wiped once delivered to the CLI\n    last_poll_at TEXT,\n    decided_at TEXT,\n    decision_note TEXT,\n    delivered_at TEXT,\n    created_at TEXT NOT NULL,\n    expires_at TEXT NOT NULL\n  );\n  CREATE INDEX pairings_status ON pairings(status, created_at);\n  CREATE INDEX pairings_user_code ON pairings(user_code);\n\n  -- Server-side cursor per agentinbox-listen consumer (MCP ack_events keeps using agent_cursors).\n  CREATE TABLE listener_cursors (\n    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,\n    consumer TEXT NOT NULL,\n    acked_seq INTEGER NOT NULL DEFAULT 0,\n    client TEXT NOT NULL DEFAULT '{}',\n    connected INTEGER NOT NULL DEFAULT 0,\n    last_seen_at TEXT,\n    updated_at TEXT NOT NULL,\n    PRIMARY KEY (agent_id, consumer)\n  );\n  `,\n  /* 3: onboarding diagnostics on accounts */ `\n  -- When Google said the refresh token expires (refresh_token_expires_in); NULL = long-lived.\n  ALTER TABLE accounts ADD COLUMN refresh_expires_at TEXT;\n  -- Why it expires: 'testing' (initial lifetime ~7 days: External app in Testing) or 'time_based'\n  -- (any other lifetime, e.g. time-based access the user chose on the consent screen). NULL = unknown.\n  ALTER TABLE accounts ADD COLUMN refresh_expiry_kind TEXT;\n  -- id_token \"hd\" claim: Workspace domain, '' = personal (non-Workspace) Google account, NULL = not known (connected before this migration).\n  ALTER TABLE accounts ADD COLUMN workspace_domain TEXT;\n  `,\n  /* 4: where each listener consumer started */ `\n  -- Seq the consumer's cursor started at when it was created (the head, or 0 for start=beginning):\n  -- mail at or below it predates the listener (what \\`listen --backfill\\` replays). NULL = created\n  -- before this migration, or by an ack (unknown).\n  ALTER TABLE listener_cursors ADD COLUMN start_seq INTEGER;\n  `,\n  /* 5: MCP use apart from listen; how each agent was added */ `\n  -- Last authenticated request to /mcp; throttled like last_used_at (first write immediate).\n  ALTER TABLE agents ADD COLUMN last_mcp_at TEXT;\n  -- 'paired' (approved from \\`agentinbox connect\\`: the key lives in a profile on that machine) or\n  -- 'key' (created in the console, key copied by hand).\n  ALTER TABLE agents ADD COLUMN origin TEXT NOT NULL DEFAULT 'key';\n  -- Backfill: a kept approved pairing, or a listener (\\`listen\\` runs on a pairing's profile), means paired.\n  UPDATE agents SET origin = 'paired'\n    WHERE id IN (SELECT agent_id FROM pairings WHERE status = 'approved' AND agent_id IS NOT NULL)\n       OR id IN (SELECT agent_id FROM listener_cursors);\n  `,\n  /* 6: keep existing installs verified */ `\n  -- SetupState.verified now needs a successful tool call in the audit log (pruned after the retention\n  -- period) or a listener ack, and is remembered in setup.verifiedAt once seen. Installs where an agent\n  -- already reached /mcp counted as verified before: remember that, so the setup guide doesn't come back.\n  INSERT OR IGNORE INTO settings (key, value)\n    SELECT 'setup.verifiedAt', json_quote(strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))\n    WHERE EXISTS (SELECT 1 FROM agents WHERE last_mcp_at IS NOT NULL);\n  `,\n  /* 7: Google Calendar (docs/calendar.md). Additive only: mail keeps working untouched. */ `\n  -- Grants: calendar.read / calendar.write live in grants.capabilities; existing grants have neither (mail-only).\n  ALTER TABLE grants ADD COLUMN calendar_scope TEXT;   -- JSON string[] of calendar ids | NULL (= every calendar)\n  ALTER TABLE grants ADD COLUMN calendar_write_mode TEXT NOT NULL DEFAULT 'approval'; -- 'direct' | 'approval'\n\n  -- Accounts: granted scopes are already in accounts.scopes (JSON, since migration 1).\n  -- NULL = derive from scopes (missing calendar scopes → not_granted, else active); 'api_disabled' | 'error'\n  -- when a probe or sync said so (cleared by the next success).\n  ALTER TABLE accounts ADD COLUMN calendar_status TEXT;\n  ALTER TABLE accounts ADD COLUMN calendar_error TEXT;\n  ALTER TABLE accounts ADD COLUMN calendar_synced_at TEXT;\n\n  -- Events: calendar.* events carry a CalendarEventSummary instead of a message.\n  ALTER TABLE events ADD COLUMN calendar_id TEXT;       -- for calendar scopes and filters\n  ALTER TABLE events ADD COLUMN calendar_event TEXT;    -- JSON CalendarEventSummary | NULL\n\n  -- Incremental sync cursor (and optional push channel) per synced calendar.\n  CREATE TABLE calendar_sync (\n    account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,\n    calendar_id TEXT NOT NULL,\n    name TEXT,\n    access_role TEXT,\n    is_primary INTEGER NOT NULL DEFAULT 0,\n    sync_token TEXT,                 -- events.list nextSyncToken; NULL = needs a (baseline) full sync\n    baseline_at TEXT,                -- when the last full sync finished: events created before it aren't \"new\"\n    last_sync_at TEXT,\n    last_error TEXT,\n    channel_id TEXT,                 -- events.watch channel (push), NULL when polling only\n    channel_resource_id TEXT,\n    channel_token_hash TEXT,         -- sha256 of the X-Goog-Channel-Token we chose\n    channel_expires_at TEXT,\n    channel_verified_at TEXT,        -- Google's \"sync\" notification reached us (the address is reachable)\n    updated_at TEXT NOT NULL,\n    PRIMARY KEY (account_id, calendar_id)\n  );\n  CREATE UNIQUE INDEX calendar_sync_channel ON calendar_sync(channel_id) WHERE channel_id IS NOT NULL;\n\n  -- Last seen version of events on synced calendars, to tell created / updated (what changed) / cancelled\n  -- apart and to replay a 410 full resync as changes. Upcoming and recurring events only (pruned after end).\n  CREATE TABLE calendar_event_state (\n    account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,\n    calendar_id TEXT NOT NULL,\n    event_id TEXT NOT NULL,\n    fingerprint TEXT NOT NULL,       -- digest of the material fields (CalendarEventChange)\n    summary TEXT NOT NULL,           -- JSON CalendarEventSummary as last seen\n    description_hash TEXT,\n    ends_at TEXT,                    -- NULL for recurring series (kept while the series lives)\n    updated_at TEXT NOT NULL,\n    PRIMARY KEY (account_id, calendar_id, event_id)\n  );\n  CREATE INDEX calendar_event_state_ends ON calendar_event_state(ends_at);\n\n  -- Calendar approvals reuse the approvals table: kind 'calendar.*', draft_id '' (no Gmail draft),\n  -- payload JSON {calendar: CalendarApprovalDetail, reason, …}, sent_message_id = the Google event id once applied.\n\n  -- Existing installs (an account was connected before this upgrade) add Calendar explicitly with the\n  -- console's \"Add Google Calendar\" flow; fresh installs get it by default (no row = enabled).\n  INSERT OR IGNORE INTO settings (key, value)\n    SELECT 'calendar.setup', '{\"enabled\":false}'\n    WHERE EXISTS (SELECT 1 FROM accounts);\n  `,\n  /* 8: MCP broker (docs/MCP-BROKER.md, M1 PR 2). New tables, events.connection_id and the approvals rebuild; nothing reads them yet. */ `\n  -- One upstream with its credential. Gmail/Calendar stay in accounts (M1 doesn't move them).\n  CREATE TABLE connections (\n    id TEXT PRIMARY KEY,                       -- con_…\n    owner_id TEXT,                             -- NULL = the install's single owner (real multi-user is M4)\n    -- remote_http in M1. native_whoop (M2) and stdio (M4) are reserved, and native_google too (Gmail/Calendar\n    -- as a connection kind, docs \"Code impact\"): CHECKs can't be widened without rebuilding a table that\n    -- other tables reference.\n    kind TEXT NOT NULL CHECK (kind IN ('remote_http', 'native_whoop', 'stdio', 'native_google')),\n    -- The preset id (notion, whoop, …) or NULL for a custom server. Deliberately no CHECK: presets are validated\n    -- in code against the registry, so adding one never needs a rebuild of this table.\n    preset TEXT,\n    -- Operator-chosen; tools are exposed as <slug>__<tool>. No \"_\" in a slug, so the split is unambiguous.\n    slug TEXT NOT NULL UNIQUE CHECK (length(slug) BETWEEN 1 AND 24 AND slug NOT GLOB '*[^a-z0-9-]*'),\n    name TEXT NOT NULL,\n    url TEXT,                                  -- the MCP endpoint; required for remote_http\n    auth_type TEXT NOT NULL DEFAULT 'none' CHECK (auth_type IN ('none', 'header', 'oauth')),\n    -- What agents may do by default (Wynn's model): full | ask (risky tools wait for approval) | read.\n    level_default TEXT NOT NULL DEFAULT 'ask' CHECK (level_default IN ('full', 'ask', 'read')),\n    -- Admin-only private-target allow: the exact scheme://host:port the admin entered, or NULL (off).\n    -- Editing the URL clears it.\n    -- (No path, query, userinfo, blanks, backslash, percent-encoding, brackets or control characters; ends in\n    -- the port.) The code canonicalises it, and the guard itself validates host and ranges.\n    private_target TEXT CHECK (private_target IS NULL OR (\n      (private_target GLOB 'http://?*:[0-9]*' OR private_target GLOB 'https://?*:[0-9]*')\n      AND private_target NOT GLOB '*://*[/?#@ ]*' AND private_target NOT GLOB '*[^0-9]'\n      AND private_target NOT GLOB '*[\\\\%[]*'\n      AND private_target NOT GLOB '*[' || char(1) || '-' || char(31) || char(127) || ']*'\n    )),\n    status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'needs_reauth', 'error', 'disabled')),\n    status_reason TEXT,\n    -- When the credential stops working without a human (no refresh grant, or a hard cap such as Notion's\n    -- 180 days): drives the \"expires in N days\" warnings. NULL = not known to expire.\n    expires_at TEXT,\n    -- Negotiated protocol era and transport, cached (see the SDK ADR), and when it was last negotiated: the\n    -- cache expires from protocol_checked_at (the expiry is the code's).\n    protocol TEXT,\n    protocol_checked_at TEXT,\n    tools_cached_at TEXT,                      -- last successful tools/list\n    instructions_hash TEXT,                    -- sha256 of the server's instructions, pinned separately from tools\n    events_cursor TEXT,                        -- native presets: where the event poll resumes (e.g. WHOOP without a webhook URL)\n    created_at TEXT NOT NULL,\n    updated_at TEXT NOT NULL,\n    CHECK (kind <> 'remote_http' OR url IS NOT NULL)\n  );\n\n  -- The connection's secrets, one row per connection. *_enc columns are AES-GCM ciphertext (server/crypto.ts)\n  -- and are never logged or sent to the console or agents.\n  CREATE TABLE connection_credentials (\n    connection_id TEXT PRIMARY KEY REFERENCES connections(id) ON DELETE CASCADE,\n    -- auth_type 'header': the static header injected on every request (e.g. Authorization: Bearer …).\n    header_name_enc TEXT,\n    header_value_enc TEXT,\n    -- auth_type 'oauth'. The issuer is the authorization server's exact issuer (checked on every flow). The\n    -- client is the registration (pre-registered, metadata document or DCR): JSON {client_id, client_secret?, …}.\n    oauth_issuer_enc TEXT,\n    oauth_client_enc TEXT,\n    access_token_enc TEXT,\n    refresh_token_enc TEXT,                    -- rotated with a compare-and-swap, saved before it's used\n    expires_at TEXT,                           -- access token expiry\n    scope TEXT,                                -- granted scopes, space-separated (the union after insufficient_scope)\n    -- An authorization in flight (cleared when it completes): the PKCE verifier and the discovery result\n    -- (JSON: resource metadata, authorization server metadata, resource, redirect URI).\n    pkce_verifier_enc TEXT,\n    discovery_enc TEXT,\n    created_at TEXT NOT NULL,\n    updated_at TEXT NOT NULL\n  );\n\n  -- Each upstream tool as pinned. Agents only ever see the pinned definition. A changed hash or a tool that\n  -- wasn't there at connect is held until the owner accepts the candidate.\n  CREATE TABLE upstream_tools (\n    connection_id TEXT NOT NULL REFERENCES connections(id) ON DELETE CASCADE,\n    name TEXT NOT NULL,                        -- the upstream's own name\n    -- <slug>__<name> as listed to agents: [A-Za-z0-9_-], at most 64 (clients prepend mcp__<server>__).\n    exposed_name TEXT NOT NULL UNIQUE CHECK (length(exposed_name) BETWEEN 1 AND 64 AND exposed_name NOT GLOB '*[^A-Za-z0-9_-]*'),\n    -- JSON {title, description, inputSchema, outputSchema, annotations}; NULL only for a held new tool.\n    definition TEXT,\n    pin_hash TEXT,                             -- sha256(JCS({name, title, description, inputSchema, outputSchema, annotations}))\n    -- Risk classes (risky = irreversible; read = listed at the read-only level) and where they came from.\n    risky INTEGER NOT NULL DEFAULT 0 CHECK (risky IN (0, 1)),\n    read INTEGER NOT NULL DEFAULT 0 CHECK (read IN (0, 1)),\n    class_source TEXT NOT NULL CHECK (class_source IN ('preset', 'annotation', 'heuristic')),\n    state TEXT NOT NULL DEFAULT 'active' CHECK (state IN ('active', 'held')),\n    held_reason TEXT CHECK (held_reason IS NULL OR held_reason IN ('changed', 'new')),\n    candidate_definition TEXT,                 -- JSON, same shape as definition: what accepting would pin\n    candidate_hash TEXT,\n    first_seen_at TEXT NOT NULL,\n    updated_at TEXT NOT NULL,\n    PRIMARY KEY (connection_id, name),\n    CHECK (risky = 0 OR read = 0),\n    CHECK ((definition IS NULL) = (pin_hash IS NULL)),\n    CHECK ((candidate_definition IS NULL) = (candidate_hash IS NULL)),\n    -- IS, not =: a NULL comparison would make the CHECK pass.\n    CHECK (\n      (state = 'active' AND held_reason IS NULL AND candidate_hash IS NULL AND pin_hash IS NOT NULL)\n      OR (state = 'held' AND held_reason IS 'changed' AND candidate_hash IS NOT NULL AND pin_hash IS NOT NULL)\n      OR (state = 'held' AND held_reason IS 'new' AND candidate_hash IS NOT NULL AND pin_hash IS NULL)\n    )\n  );\n\n  -- Per agent × connection access. No row = no access. There are no per-tool grant modes.\n  CREATE TABLE connection_grants (\n    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,\n    connection_id TEXT NOT NULL REFERENCES connections(id) ON DELETE CASCADE,\n    level TEXT NOT NULL CHECK (level IN ('full', 'ask', 'read')),\n    created_at TEXT NOT NULL,\n    updated_at TEXT NOT NULL,\n    PRIMARY KEY (agent_id, connection_id)\n  );\n  CREATE INDEX connection_grants_connection ON connection_grants(connection_id);\n\n  -- \"Always allow this\": a matching call by this agent never asks again. Optionally only for one target:\n  -- an argument (JSON Pointer into the arguments) and its canonical JSON value.\n  CREATE TABLE approval_rules (\n    id TEXT PRIMARY KEY,                       -- rul_…\n    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,\n    connection_id TEXT NOT NULL REFERENCES connections(id) ON DELETE CASCADE,\n    tool TEXT NOT NULL,                        -- upstream tool name (upstream_tools.name), stable across slug edits\n    target_path TEXT,\n    target_value TEXT,\n    created_at TEXT NOT NULL,\n    CHECK ((target_path IS NULL) = (target_value IS NULL))\n  );\n  CREATE UNIQUE INDEX approval_rules_match ON approval_rules(agent_id, connection_id, tool, COALESCE(target_path, ''), COALESCE(target_value, ''));\n  CREATE INDEX approval_rules_connection ON approval_rules(connection_id);\n\n  -- Approvals, rebuilt: SQLite can't drop NOT NULL. account_id and draft_id become nullable (an mcp.call\n  -- has neither), connection_id and tool_call are added. Same ids, rowids (list order), indexes and\n  -- cascades; nothing references approvals, so dropping it cascades nowhere.\n  -- tool_call (mcp.call only): JSON {tool, exposedName, args (the exact canonical bytes, as a string),\n  -- argsSha256, pinHash, result (once executed)}.\n  CREATE TABLE approvals_new (\n    id TEXT PRIMARY KEY,\n    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,\n    account_id TEXT REFERENCES accounts(id) ON DELETE CASCADE,\n    connection_id TEXT REFERENCES connections(id) ON DELETE CASCADE,\n    kind TEXT NOT NULL,\n    status TEXT NOT NULL DEFAULT 'pending',\n    draft_id TEXT,\n    payload TEXT NOT NULL,       -- JSON {to,cc,bcc,subject,body,threadId,attachments,reason,…}\n    tool_call TEXT,\n    decided_at TEXT,\n    decision_note TEXT,\n    sent_message_id TEXT,\n    error TEXT,\n    created_at TEXT NOT NULL,\n    expires_at TEXT NOT NULL,\n    -- Mail and calendar kinds keep exactly the invariant they had (an account and a draft id, '' for\n    -- calendar); only mcp.call goes through a connection.\n    CHECK (\n      (kind = 'mcp.call' AND account_id IS NULL AND draft_id IS NULL AND connection_id IS NOT NULL AND tool_call IS NOT NULL)\n      OR (kind <> 'mcp.call' AND account_id IS NOT NULL AND draft_id IS NOT NULL AND connection_id IS NULL AND tool_call IS NULL)\n    )\n  );\n  INSERT INTO approvals_new (rowid, id, agent_id, account_id, kind, status, draft_id, payload, decided_at, decision_note, sent_message_id, error, created_at, expires_at)\n    SELECT rowid, id, agent_id, account_id, kind, status, draft_id, payload, decided_at, decision_note, sent_message_id, error, created_at, expires_at\n    FROM approvals ORDER BY rowid;\n  DROP TABLE approvals;\n  ALTER TABLE approvals_new RENAME TO approvals;\n  CREATE INDEX approvals_status ON approvals(status, created_at);\n  CREATE INDEX approvals_connection ON approvals(connection_id);\n\n  -- Events from connections (connection.auth_failed, connection.tool_changed, approval.requested, whoop.*) carry\n  -- their connection here. account_id stays NOT NULL: connection events store '' there. Additive, no rebuild.\n  ALTER TABLE events ADD COLUMN connection_id TEXT;\n  CREATE INDEX events_connection_seq ON events(connection_id, seq) WHERE connection_id IS NOT NULL;\n  `,\n  /* 9: broker upstream OAuth (M1 PRs 3/4). Additive columns only. */ `\n  -- When the stored access token was issued: proactive refresh runs at expires_at - max(60 s, 10 % of the lifetime).\n  ALTER TABLE connection_credentials ADD COLUMN issued_at TEXT;\n  -- An upstream connection's authorization in flight (/oauth/connections/callback): state -> connection. NULL for\n  -- Google's flow. code_verifier is '' for these rows: the verifier is kept encrypted, keyed by state, in\n  -- connection_credentials.pkce_verifier_enc.\n  ALTER TABLE oauth_states ADD COLUMN connection_id TEXT REFERENCES connections(id) ON DELETE CASCADE;\n  `,\n  /* 10: broker \"All agents\" (new-user walk). Additive. */ `\n  -- 1: every agent gets this connection at level_default, including agents created later (console, pairing).\n  -- NULL: only the agents picked (connection_grants). Per-agent levels still live in connection_grants.\n  ALTER TABLE connections ADD COLUMN all_agents INTEGER CHECK (all_agents IS NULL OR all_agents = 1);\n  `,\n];\n","import { chmodSync } from \"node:fs\";\nimport { DatabaseSync, type SQLInputValue } from \"node:sqlite\";\nimport { MIGRATIONS } from \"./schema.ts\";\n\nexport type Param = SQLInputValue;\nexport type Row = Record<string, unknown>;\n\n/** Thin synchronous wrapper over node:sqlite. All repos go through this. */\nexport class Db {\n  readonly raw: DatabaseSync;\n  private depth = 0;\n\n  constructor(path: string) {\n    this.raw = new DatabaseSync(path);\n    this.raw.exec(\"PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON; PRAGMA busy_timeout = 5000;\");\n    this.migrate();\n    // The database holds (encrypted) tokens and the audit log: owner-only, whatever the umask.\n    if (path !== \":memory:\") {\n      for (const file of [path, `${path}-wal`, `${path}-shm`]) {\n        try {\n          chmodSync(file, 0o600);\n        } catch {\n          // Not created (yet) or not ours to change.\n        }\n      }\n    }\n  }\n\n  get<T = Row>(sql: string, ...params: Param[]): T | undefined {\n    return this.raw.prepare(sql).get(...params) as T | undefined;\n  }\n\n  all<T = Row>(sql: string, ...params: Param[]): T[] {\n    return this.raw.prepare(sql).all(...params) as T[];\n  }\n\n  run(sql: string, ...params: Param[]): { changes: number; lastInsertRowid: number } {\n    const r = this.raw.prepare(sql).run(...params);\n    return { changes: Number(r.changes), lastInsertRowid: Number(r.lastInsertRowid) };\n  }\n\n  /** Nested calls join the outer transaction (savepoints). */\n  tx<T>(fn: () => T): T {\n    const sp = `sp${this.depth++}`;\n    this.raw.exec(`SAVEPOINT ${sp}`);\n    try {\n      const out = fn();\n      this.raw.exec(`RELEASE ${sp}`);\n      return out;\n    } catch (err) {\n      this.raw.exec(`ROLLBACK TO ${sp}; RELEASE ${sp}`);\n      throw err;\n    } finally {\n      this.depth--;\n    }\n  }\n\n  close(): void {\n    this.raw.close();\n  }\n\n  private migrate(): void {\n    this.raw.exec(\"CREATE TABLE IF NOT EXISTS _migrations (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL)\");\n    const row = this.get<{ v: number | null }>(\"SELECT MAX(version) AS v FROM _migrations\");\n    const current = row?.v ?? 0;\n    MIGRATIONS.forEach((sql, i) => {\n      const version = i + 1;\n      if (version <= current) return;\n      this.tx(() => {\n        this.raw.exec(sql);\n        this.run(\"INSERT INTO _migrations (version, applied_at) VALUES (?, ?)\", version, new Date().toISOString());\n      });\n    });\n  }\n}\n\nexport const json = {\n  parse<T>(v: unknown, fallback: T): T {\n    if (typeof v !== \"string\" || v === \"\") return fallback;\n    try {\n      return JSON.parse(v) as T;\n    } catch {\n      return fallback;\n    }\n  },\n  str(v: unknown): string {\n    return JSON.stringify(v);\n  },\n};\n\nexport const bool = (v: unknown): boolean => v === 1 || v === 1n || v === true;\nexport const now = (): string => new Date().toISOString();\n"],"mappings":";;;;AAIA,MAAa,aAAuB;CACV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoKwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCJ;;;;;;;;;CASE;;;;;;CAMe;;;;;;;;;;;CAWpB;;;;;;;;CAQiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6D6C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwKnE;;;;;;;;CAQX;;;;;AAK3D;;;;ACxdA,IAAa,KAAb,MAAgB;CACd;CACA,QAAgB;CAEhB,YAAY,MAAc;EACxB,KAAK,MAAM,IAAI,aAAa,IAAI;EAChC,KAAK,IAAI,KAAK,kFAAkF;EAChG,KAAK,QAAQ;EAEb,IAAI,SAAS,YACX,KAAK,MAAM,QAAQ;GAAC;GAAM,GAAG,KAAK;GAAO,GAAG,KAAK;EAAK,GACpD,IAAI;GACF,UAAU,MAAM,GAAK;EACvB,QAAQ,CAER;CAGN;CAEA,IAAa,KAAa,GAAG,QAAgC;EAC3D,OAAO,KAAK,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,GAAG,MAAM;CAC5C;CAEA,IAAa,KAAa,GAAG,QAAsB;EACjD,OAAO,KAAK,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,GAAG,MAAM;CAC5C;CAEA,IAAI,KAAa,GAAG,QAA+D;EACjF,MAAM,IAAI,KAAK,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,GAAG,MAAM;EAC7C,OAAO;GAAE,SAAS,OAAO,EAAE,OAAO;GAAG,iBAAiB,OAAO,EAAE,eAAe;EAAE;CAClF;;CAGA,GAAM,IAAgB;EACpB,MAAM,KAAK,KAAK,KAAK;EACrB,KAAK,IAAI,KAAK,aAAa,IAAI;EAC/B,IAAI;GACF,MAAM,MAAM,GAAG;GACf,KAAK,IAAI,KAAK,WAAW,IAAI;GAC7B,OAAO;EACT,SAAS,KAAK;GACZ,KAAK,IAAI,KAAK,eAAe,GAAG,YAAY,IAAI;GAChD,MAAM;EACR,UAAU;GACR,KAAK;EACP;CACF;CAEA,QAAc;EACZ,KAAK,IAAI,MAAM;CACjB;CAEA,UAAwB;EACtB,KAAK,IAAI,KAAK,gGAAgG;EAE9G,MAAM,UADM,KAAK,IAA0B,2CACzB,CAAC,EAAE,KAAK;EAC1B,WAAW,SAAS,KAAK,MAAM;GAC7B,MAAM,UAAU,IAAI;GACpB,IAAI,WAAW,SAAS;GACxB,KAAK,SAAS;IACZ,KAAK,IAAI,KAAK,GAAG;IACjB,KAAK,IAAI,+DAA+D,0BAAS,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC;GAC3G,CAAC;EACH,CAAC;CACH;AACF;AAEA,MAAa,OAAO;CAClB,MAAS,GAAY,UAAgB;EACnC,IAAI,OAAO,MAAM,YAAY,MAAM,IAAI,OAAO;EAC9C,IAAI;GACF,OAAO,KAAK,MAAM,CAAC;EACrB,QAAQ;GACN,OAAO;EACT;CACF;CACA,IAAI,GAAoB;EACtB,OAAO,KAAK,UAAU,CAAC;CACzB;AACF;AAEA,MAAa,QAAQ,MAAwB,MAAM,KAAK,MAAM,MAAM,MAAM;AAC1E,MAAa,6BAAoB,IAAI,KAAK,EAAA,CAAE,YAAY"}

package/dist/db-Q5BQuwga.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { t as Db } from "./db-BEUEUPyP.js";