Add workspace audit history

[RhysSullivan]

Summary

Adds workspace audit history. Second of two stacked PRs split from #1786; based on #1919.

A new append-only, tenant-scoped audit_event table records configuration changes: integrations, connections, OAuth clients, and tool policies. When a failed write is compensated, the log records rolled_back, or rollback_failed if the provider restore also failed. Payloads hold safe identifiers only, never credential values. Reads are admin-gated and shown in the admin console Activity tab.

Also included: the fumadb MySQL generator now requires bounded string primary keys, and IdColumnType is exported (major changeset).

Verification

• bun run format:check
• bun run lint
• bun run typecheck
• bun run test
• e2e — admin-users-console (cloud and selfhost) asserts the Activity tab renders audit events; workspace-write-permissions (cloud) exercises the migration chain at boot.

Checklist

• Added a changeset (bun run changeset), or this change needs none.
• Added or updated tests for the new behaviour.
• No secrets, credentials, or private data in the diff.

[github-actions]

Cloudflare preview

Console	https://executor-preview-pr-1920.executor-e2e.workers.dev
MCP	https://executor-preview-pr-1920.executor-e2e.workers.dev/mcp
Deployed commit	95b4419

Sign-in is Cloudflare Access (one-time PIN to an allowed email). The preview has its own database and encryption key; it is destroyed when this PR closes.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1920

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1920

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1920

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1920

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1920

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1920

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1920

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1920

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1920

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1920

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1920

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1920

executor

npm i https://pkg.pr.new/executor@1920

commit: 95b4419

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	95b4419	Sep 02 2026, 10:43 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	95b4419	Commit Preview URL Branch Preview URL	Sep 02 2026, 10:42 AM