@bevel-software/platform-core-backend 0.32.0 → 0.33.0

package/src/modules/database/__tests__/legacy-request-bodies.pg.test.ts

@@ -0,0 +1,258 @@
+import { afterAll, describe, expect, it } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { cpSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { migrate } from 'drizzle-orm/node-postgres/migrator';
+import { eq, sql } from 'drizzle-orm';
+import { closeDb, createDb, type Database } from '../connection.js';
+import { changeRequests, dataMigrations } from '../core-schema.js';
+import { runCoreMigrations, runPiiEncryptionBackfill } from '../migrate.js';
+import { coreMigrationsDir } from '../../../assets.js';
+import { IndexOnWrite, SealOnWrite } from '../../../shared/column-crypto.js';
+import { PG_ADMIN_URL, PG_TEST_TIMEOUT, dropScratchDatabases, scratchDatabaseUrl } from '../../../__tests__/pg-scratch.js';
+
+/**
+ * The data half of migration 0020, on a real Postgres: a deployment whose
+ * bodies still carry the generated owners block and an access request's
+ * level and note starts on this release, and comes out with the level and
+ * the note on their columns and the prose alone in the body. Pinned through
+ * the one entry point a start uses, `runCoreMigrations`, so the test fails if
+ * the pass is ever not wired to the start that applies 0020 — and shows that
+ * the next start writes nothing.
+ *
+ * Runs where `TEST_DATABASE_URL` names a server this role may create
+ * databases on, each test in a scratch database of its own.
+ */
+const KEY = randomBytes(32).toString('base64');
+const open: Database[] = [];
+const folders: string[] = [];
+
+/** The `data_migrations` row the move leaves behind — the pass's one public trace besides the rows. */
+const LEDGER_ROW = '0020_change_request_body_is_the_description';
+
+const GENERATED = ['## Affected owners', '', '- `Docs/a.md` — Admin', '- `Docs/b.md` — Jane <jane@x.io>'].join('\n');
+
+const ACCESS_REQUEST_BODY = [
+  '<!--hexis:access-request-level:owner-->',
+  'Rita \\(rita@x\\.io\\) asked for **Owner** on Research\\.',
+  '',
+  'Note from Rita:',
+  '',
+  '<!--hexis:access-request-note-->',
+  '> I maintain these pages now',
+  '<!--/hexis:access-request-note-->',
+  '',
+  "Anyone who can edit this folder's access answers it.",
+  '',
+  GENERATED,
+].join('\n');
+
+/** The core history as it stood BEFORE 0020: the packaged folder minus 0020 and its ledger table (0021), in a folder of this test's own. */
+function historyBefore0020(): string {
+  const folder = mkdtempSync(path.join(tmpdir(), 'hexis-core-before-0020-'));
+  folders.push(folder);
+  cpSync(coreMigrationsDir(), folder, { recursive: true });
+  rmSync(path.join(folder, '0020_change_request_body_is_the_description.sql'));
+  rmSync(path.join(folder, 'meta', '0020_snapshot.json'));
+  rmSync(path.join(folder, '0021_data_migrations_ledger.sql'));
+  rmSync(path.join(folder, 'meta', '0021_snapshot.json'));
+  const journalPath = path.join(folder, 'meta', '_journal.json');
+  const journal = JSON.parse(readFileSync(journalPath, 'utf8')) as { entries: { idx: number }[] };
+  journal.entries = journal.entries.filter((e) => e.idx < 20);
+  writeFileSync(journalPath, JSON.stringify(journal, null, 2));
+  return folder;
+}
+
+async function handle(): Promise<Database> {
+  const db = createDb(await scratchDatabaseUrl('hexis_legacy_bodies'), { piiKey: KEY });
+  open.push(db);
+  return db;
+}
+
+/**
+ * A database an older version left: started on the history to 0019 (so its
+ * personal-data backfill has run and sealed columns are trusted as sealed),
+ * holding the rows that version wrote — sealed as it sealed them, through SQL
+ * that names only the columns that existed then (the schema module already
+ * knows the two new ones).
+ */
+async function olderDeployment(): Promise<Database> {
+  const db = await handle();
+  // As that version's start did it: its SQL history, then its PII backfill.
+  await migrate(db, { migrationsFolder: historyBefore0020(), migrationsTable: '__drizzle_migrations_core' });
+  await runPiiEncryptionBackfill(db);
+  // Sealed by the handle's own connection, as every write through it is —
+  // the marks the column codecs hand it — so what the pass reads back is
+  // exactly what the older version wrote.
+  const seal = (plain: string) => new SealOnWrite(plain) as unknown as string;
+  const index = (plain: string) => new IndexOnWrite(plain) as unknown as string;
+  const row = (branch: string, title: string, body: string, email: string, name: string, state = 'open') =>
+    sql`(${branch}, 'main', ${seal(title)}, ${seal(body)}, ${seal(email)}, ${index(email)}, ${seal(name)}, ${state})`;
+  await db.execute(sql`
+    insert into change_requests (source_branch, target_branch, title, body, author_email, author_email_bidx, author_name, state) values
+      ${row('ada/draft', 'Ordinary', `Please take a look.\n\n## Why now\n\nBecause.\n\n${GENERATED}`, 'ada@example.com', 'Ada')},
+      ${row('rita/join-research', 'Access request: Research', ACCESS_REQUEST_BODY, 'rita@x.io', 'Rita')},
+      ${row('bo/clean', 'Already clean', 'P2 - Planned\n\nJust prose.', 'bo@example.com', 'Bo', 'merged')}
+  `);
+  return db;
+}
+
+const ledgerRows = async (db: Database) =>
+  (await db.select({ name: dataMigrations.name, note: dataMigrations.note }).from(dataMigrations)).map((r) => ({ name: r.name, note: r.note }));
+
+/** The ledger with its timestamps: what a second start must leave exactly as it found. */
+const ledger = async (db: Database) =>
+  (await db.select().from(dataMigrations)).map((r) => ({ name: r.name, note: r.note, appliedAt: r.appliedAt.toISOString() }));
+
+const rowsOf = async (db: Database) =>
+  (await db.select().from(changeRequests).orderBy(changeRequests.sourceBranch)).map((r) => ({
+    branch: r.sourceBranch,
+    body: r.body,
+    level: r.accessRequestLevel,
+    note: r.accessRequestNote,
+    updatedAt: r.updatedAt,
+  }));
+
+describe.skipIf(!PG_ADMIN_URL)('migration 0020 — a request body becomes its description', () => {
+  afterAll(async () => {
+    for (const db of open) await closeDb(db);
+    await dropScratchDatabases();
+    for (const folder of folders) rmSync(folder, { recursive: true, force: true });
+  }, PG_TEST_TIMEOUT);
+
+  it(
+    'the start that applies it moves the level and the note onto the columns and leaves the prose, open and closed rows alike',
+    async () => {
+      const db = await olderDeployment();
+      await runCoreMigrations(db, coreMigrationsDir());
+
+      expect(await rowsOf(db)).toEqual([
+        { branch: 'ada/draft', body: 'Please take a look.\n\n## Why now\n\nBecause.', level: null, note: null, updatedAt: null },
+        { branch: 'bo/clean', body: 'P2 - Planned\n\nJust prose.', level: null, note: null, updatedAt: null },
+        {
+          branch: 'rita/join-research',
+          body: [
+            'Rita \\(rita@x\\.io\\) asked for **Owner** on Research\\.',
+            '',
+            'Note from Rita:',
+            '',
+            '> I maintain these pages now',
+            '',
+            "Anyone who can edit this folder's access answers it.",
+          ].join('\n'),
+          level: 'owner',
+          note: 'I maintain these pages now',
+          updatedAt: null,
+        },
+      ]);
+    },
+    PG_TEST_TIMEOUT,
+  );
+
+  it(
+    'the next start writes nothing: the pass belongs to the start that applied 0020',
+    async () => {
+      const db = await olderDeployment();
+      await runCoreMigrations(db, coreMigrationsDir());
+      // A body written AFTER the release that happens to use the old words is
+      // the author's own, and a second start must not cut it.
+      await db
+        .update(changeRequests)
+        .set({ body: 'Lead.\n\n## Affected owners\n\nI mean the GTM ones.' })
+        .where(eq(changeRequests.sourceBranch, 'bo/clean'));
+
+      await runCoreMigrations(db, coreMigrationsDir());
+
+      const bo = (await rowsOf(db)).find((r) => r.branch === 'bo/clean');
+      expect(bo?.body).toBe('Lead.\n\n## Affected owners\n\nI mean the GTM ones.');
+    },
+    PG_TEST_TIMEOUT,
+  );
+
+  it(
+    'a start that died between the SQL history and the pass is finished by the next start',
+    async () => {
+      // The SQL history applied (drizzle's ledger has 0020 and 0021) but no
+      // `data_migrations` row: exactly what a crash in between leaves behind.
+      const db = await olderDeployment();
+      await migrate(db, { migrationsFolder: coreMigrationsDir(), migrationsTable: '__drizzle_migrations_core' });
+      expect(await ledgerRows(db)).toEqual([]);
+
+      await runCoreMigrations(db, coreMigrationsDir());
+
+      const rita = (await rowsOf(db)).find((r) => r.branch === 'rita/join-research');
+      expect(rita).toMatchObject({ level: 'owner', note: 'I maintain these pages now' });
+      expect(rita?.body).not.toContain('<!--');
+      expect(await ledgerRows(db)).toEqual([
+        { name: LEDGER_ROW, note: '2 of 3 change-request bodies moved to the description-only shape' },
+      ]);
+    },
+    PG_TEST_TIMEOUT,
+  );
+
+  it(
+    'a pass that fails midway leaves no body moved and no ledger row, and the next start does the whole of it',
+    async () => {
+      const db = await olderDeployment();
+      await migrate(db, { migrationsFolder: coreMigrationsDir(), migrationsTable: '__drizzle_migrations_core' });
+      // The second body the pass rewrites (in id order) is refused, after the
+      // first one was written.
+      await db.execute(sql`
+        create function refuse_rita() returns trigger language plpgsql as $refuse$
+        begin raise exception 'the start died here'; end $refuse$
+      `);
+      await db.execute(sql`
+        create trigger refuse_rita before update on change_requests
+        for each row when (old.source_branch = 'rita/join-research') execute function refuse_rita()
+      `);
+      const before = await rowsOf(db);
+
+      // The start dies in the pass: the SQL history was already applied, so
+      // the refusal can only come from the move's own UPDATE.
+      await expect(runCoreMigrations(db, coreMigrationsDir())).rejects.toThrow(/Failed query: update "change_requests"/);
+      expect(await rowsOf(db)).toEqual(before);
+      expect(await ledgerRows(db)).toEqual([]);
+
+      await db.execute(sql`drop trigger refuse_rita on change_requests`);
+      await runCoreMigrations(db, coreMigrationsDir());
+      const rows = await rowsOf(db);
+      expect(rows.find((r) => r.branch === 'ada/draft')?.body).toBe('Please take a look.\n\n## Why now\n\nBecause.');
+      expect(rows.find((r) => r.branch === 'rita/join-research')).toMatchObject({ level: 'owner', note: 'I maintain these pages now' });
+      expect((await ledgerRows(db)).map((r) => r.name)).toEqual([LEDGER_ROW]);
+    },
+    PG_TEST_TIMEOUT,
+  );
+
+  it(
+    'a start that finds the ledger row leaves the rows and the ledger exactly as they are',
+    async () => {
+      const db = await olderDeployment();
+      await runCoreMigrations(db, coreMigrationsDir());
+      const rowsAfterFirst = await rowsOf(db);
+      const ledgerAfterFirst = await ledger(db);
+      expect(ledgerAfterFirst.map((r) => r.name)).toEqual([LEDGER_ROW]);
+
+      await runCoreMigrations(db, coreMigrationsDir());
+
+      expect(await rowsOf(db)).toEqual(rowsAfterFirst);
+      expect(await ledger(db)).toEqual(ledgerAfterFirst);
+    },
+    PG_TEST_TIMEOUT,
+  );
+
+  it(
+    'a fresh database has nothing to move, and records that too',
+    async () => {
+      const db = await handle();
+      await runCoreMigrations(db, coreMigrationsDir());
+      expect(await ledgerRows(db)).toEqual([
+        { name: LEDGER_ROW, note: '0 of 0 change-request bodies moved to the description-only shape' },
+      ]);
+      const once = await ledger(db);
+      await runCoreMigrations(db, coreMigrationsDir());
+      expect(await ledger(db)).toEqual(once);
+    },
+    PG_TEST_TIMEOUT,
+  );
+});

package/src/modules/database/__tests__/pii-backfill.pg.test.ts

@@ -34,7 +34,6 @@ const TABLES = [
   'users',
   'pr_file_approvals',
   'pr_merge_log',
-  'pr_comments',
   'change_requests',
   'pending_commits',
   'file_locks',
@@ -98,8 +97,6 @@ async function plantLegacyRows(q: Query): Promise<void> {
   await q(`insert into pr_merge_log (pr_number, triggered_by_email, triggered_by_name, head_sha_at_merge, merge_method, succeeded, error)
     values (1, 'ada@example.com', 'Ada', 'abc', 'merge', true, null),
            (1, 'bo@example.com', 'Bo', 'abc', 'merge', false, 'Bo has no push right')`);
-  await q(`insert into pr_comments (pr_number, author_email, author_name, head_sha, body)
-    values (1, 'bo@example.com', 'Bo', 'abc', 'Looks right to me')`);
   await q(`insert into pending_commits (workspace_id, branch, path, author_email, author_name, last_error)
     values ('w', 'main', 'a.md', 'ada@example.com', 'Ada', 'rejected for Ada')`);
   await q(`insert into file_locks (workspace_id, branch, path, holder_user_id, holder_name, expires_at)
@@ -302,10 +299,6 @@ describe.skipIf(!ADMIN_URL)('personal data, on a real Postgres', () => {
         expect(log.every((r) => r.error === null || sealed(r.error))).toBe(true);
         expect(log.every((r) => r.triggered_by_email_bidx === keys.index(opened(r.triggered_by_email)))).toBe(true);
 
-        const [comment] = await q(`select * from pr_comments`);
-        expect([comment!.author_email, comment!.author_name, comment!.body].every(sealed)).toBe(true);
-        expect(comment!.author_email_bidx).toBe(keys.index('bo@example.com'));
-
         const [queued] = await q(`select * from pending_commits`);
         expect([queued!.author_email, queued!.author_name, queued!.last_error].every(sealed)).toBe(true);
         expect(queued!.author_email_bidx).toBe(keys.index('ada@example.com'));
@@ -347,6 +340,10 @@ describe.skipIf(!ADMIN_URL)('personal data, on a real Postgres', () => {
         ).rejects.toThrow();
         await expect(q(`insert into users (email, name) values ('x', 'x')`)).rejects.toThrow();
 
+        // Change-request comments are gone, storage and all (migration 0018).
+        const [comments] = await q(`select to_regclass('pr_comments')::text as t`);
+        expect(comments!.t).toBeNull();
+
         // And the application reads it back as it was written.
         const [read] = await db.select().from(users).where(eq(users.emailBidx, 'ADA@EXAMPLE.COM '));
         expect(read).toMatchObject({ email: 'Ada@Example.com', name: 'Ada', avatarUrl: null });
@@ -371,7 +368,7 @@ describe.skipIf(!ADMIN_URL)('personal data, on a real Postgres', () => {
         const exact = `pii:v1:${'A'.repeat(16)}:${'B'.repeat(22)}==:Q2xlYXI=`;
         const unpadded = `pii:v1:${'A'.repeat(16)}:${'B'.repeat(22)}:Q2xlYXI=`;
         await q(`update users set name = '${exact}' where email = 'bo@example.com'`);
-        await q(`update pr_comments set body = '${unpadded}'`);
+        await q(`update change_requests set title = '${unpadded}'`);
         await q(`update file_locks set holder_name = '${exact}'`);
 
         await runCoreMigrations(db, coreMigrationsDir());
@@ -379,9 +376,9 @@ describe.skipIf(!ADMIN_URL)('personal data, on a real Postgres', () => {
         const [bo] = await q(`select name from users where email_bidx = '${keys.index('bo@example.com')}'`);
         expect(bo!.name).not.toBe(exact);
         expect(opened(bo!.name)).toBe(exact);
-        const [comment] = await q(`select body from pr_comments`);
-        expect(comment!.body).not.toBe(unpadded);
-        expect(opened(comment!.body)).toBe(unpadded);
+        const [cr] = await q(`select title from change_requests`);
+        expect(cr!.title).not.toBe(unpadded);
+        expect(opened(cr!.title)).toBe(unpadded);
         const [lock] = await q(`select holder_name from file_locks`);
         expect(opened(lock!.holder_name)).toBe(exact);
         // And what the application reads back is what was typed.
@@ -400,17 +397,17 @@ describe.skipIf(!ADMIN_URL)('personal data, on a real Postgres', () => {
       async () => {
         const { db, q } = await beforeTheBackfill(await scratchDatabase());
         await plantLegacyRows(q);
-        await q(`insert into pr_comments (pr_number, author_email, author_name, head_sha, body)
-          select n, 'ada@example.com', 'Ada', 'abc', 'comment ' || n from generate_series(2, 1300) n`);
+        await q(`insert into pr_merge_log (pr_number, triggered_by_email, triggered_by_name, head_sha_at_merge, merge_method, succeeded, error)
+          select n, 'ada@example.com', 'Ada', 'abc', 'merge', false, 'refusal ' || n from generate_series(2, 1300) n`);
 
         await runCoreMigrations(db, coreMigrationsDir());
 
-        const [left] = await q(`select count(*)::int as n from pr_comments where body not like 'pii:v1:%' or author_email_bidx is null`);
+        const [left] = await q(`select count(*)::int as n from pr_merge_log where triggered_by_name not like 'pii:v1:%' or triggered_by_email_bidx is null`);
         expect(left!.n).toBe(0);
-        const [all] = await q(`select count(*)::int as n from pr_comments`);
-        expect(all!.n).toBe(1300);
-        const [one] = await q(`select body from pr_comments where pr_number = 1300`);
-        expect(opened(one!.body)).toBe('comment 1300');
+        const [all] = await q(`select count(*)::int as n from pr_merge_log`);
+        expect(all!.n).toBe(1301);
+        const [one] = await q(`select error from pr_merge_log where pr_number = 1300`);
+        expect(opened(one!.error)).toBe('refusal 1300');
       },
       TIMEOUT,
     );

package/src/modules/database/core-schema.ts

@@ -10,7 +10,7 @@
  * `externalApiKeys`) from here. `schema.ts` re-exports both, so existing
  * imports keep working unchanged.
  *
- * PII columns (emails, display names, change-request/comment text) are
+ * PII columns (emails, display names, change-request text) are
  * `encryptedText` — AES-256-GCM ciphertext in the database, transparently
  * decrypted on read (see `shared/column-crypto.ts`). Because the ciphertext is
  * randomized, equality lookups and unique constraints on those columns go
@@ -128,40 +128,6 @@ export const prMergeLog = pgTable('pr_merge_log', {
   byPr: index('pr_merge_log_by_pr').on(t.prNumber),
 }));
 
-/**
- * In-app PR comments. GitHub is authoritative for the diff + PR metadata;
- * Bevel owns the review conversation. Comments never round-trip to GitHub.
- *
- * Shape encodes three comment kinds:
- *   • General PR comment        — path null, line null
- *   • File-level comment        — path set,  line null
- *   • Inline (line-anchored)    — path set,  line set
- *
- * Threading: replies point at their root via `parentId`. Root comments have
- * `parentId = null`. We use a self-FK-less column (no DB-side constraint) to
- * keep the parent row independently deletable — the service layer tolerates
- * orphan replies rather than cascading deletes and losing discussion context.
- */
-export const prComments = pgTable('pr_comments', {
-  id: uuid('id').defaultRandom().primaryKey(),
-  prNumber: integer('pr_number').notNull(),
-  authorEmail: encryptedText('author_email').notNull(),
-  /** Blind index of `author_email` — GDPR-erasure lookup. */
-  authorEmailBidx: blindIndexText('author_email_bidx').notNull(),
-  authorName: encryptedText('author_name').notNull(),
-  path: text('path'),
-  line: integer('line'),
-  headSha: text('head_sha').notNull(),
-  // Encrypted: review conversation exists only in this DB (never on GitHub).
-  body: encryptedText('body').notNull(),
-  parentId: uuid('parent_id'),
-  createdAt: timestamp('created_at').defaultNow().notNull(),
-  updatedAt: timestamp('updated_at'),
-}, (t) => ({
-  byPr: index('pr_comments_by_pr').on(t.prNumber),
-  byThread: index('pr_comments_by_thread').on(t.prNumber, t.path, t.line),
-}));
-
 /**
  * Change requests (the app's own "pull request" model). The app used to lean on
  * GitHub PRs via the `gh` CLI; now a change request is a plain DB row plus git
@@ -169,7 +135,7 @@ export const prComments = pgTable('pr_comments', {
  * hosted) works — the remote only stores commits/branches.
  *
  * `number` is the human-facing id and the join key the sibling tables
- * (`pr_file_approvals`, `pr_comments`, `pr_merge_log`) reference in their
+ * (`pr_file_approvals`, `pr_merge_log`) reference in their
  * `pr_number` column — those columns now hold THIS number, not a GitHub PR
  * number. It's a DB-assigned identity so allocation is race-free.
  *
@@ -187,7 +153,24 @@ export const changeRequests = pgTable('change_requests', {
   // is deliberately stored unencrypted (see encryptPii), so a defaulted row
   // and an app-written empty body hold the identical representation.
   title: encryptedText('title').notNull(),
+  /**
+   * The request's description, and nothing else: exactly what its author (or
+   * a later edit) wrote. Hexis keeps none of its own facts in here — who must
+   * approve each file is resolved live from the access rules, and an access
+   * request's level and note have columns of their own below. Bodies written
+   * before this release carried both as prose and hidden markers; the first
+   * start on it moves them out (`moveLegacyRequestBodies` in `migrate.ts`).
+   */
   body: encryptedText('body').notNull().default(''),
+  /**
+   * Set on a request the access-request flow opened: the level the person
+   * asked for. Null on every other request. Read back by that flow to say
+   * "Requested: Owner" from the request itself, whose row is always readable,
+   * rather than from a branch a stale clone may not see yet.
+   */
+  accessRequestLevel: text('access_request_level'),
+  /** The requester's note, when they wrote one. Encrypted: a person's own words. */
+  accessRequestNote: encryptedText('access_request_note'),
   authorEmail: encryptedText('author_email').notNull(), // lowercased at insert
   /** Blind index of `author_email` — GDPR-erasure lookup. */
   authorEmailBidx: blindIndexText('author_email_bidx').notNull(),
@@ -242,6 +225,10 @@ export const changeRequests = pgTable('change_requests', {
     'change_requests_state_check',
     sql`${t.state} IN ('open', 'merged', 'closed')`,
   ),
+  accessRequestLevelCheck: check(
+    'change_requests_access_request_level_check',
+    sql`${t.accessRequestLevel} IS NULL OR ${t.accessRequestLevel} IN ('write', 'owner')`,
+  ),
 }));
 
 /**
@@ -883,3 +870,23 @@ export const atlassianAccountLinks = pgTable('atlassian_account_links', {
 }, (t) => ({
   byUser: index('atlassian_account_links_by_user').on(t.userId),
 }));
+
+/**
+ * The ledger of the DATA halves of migrations: the rewrites SQL cannot do
+ * because they read sealed columns, run by the application right after the
+ * SQL history under the same lock (`migrate.ts`). One row per pass, written
+ * in the SAME transaction as the rows it rewrote, so a pass is recorded done
+ * exactly when its work is — a crash between the SQL history's own ledger
+ * and the pass leaves no row here, and the next start runs the pass. Drizzle's
+ * `__drizzle_migrations_core` ledger records only the SQL.
+ *
+ * The PII backfill of migration 0016 predates this table and keeps its own
+ * marker (the nullability of the blind-index columns it finalises).
+ */
+export const dataMigrations = pgTable('data_migrations', {
+  /** The pass, named after the migration whose data half it is: `0020_change_request_body_is_the_description`. */
+  name: text('name').primaryKey(),
+  appliedAt: timestamp('applied_at').defaultNow().notNull(),
+  /** What the pass did, for an operator reading the ledger: rows moved, say. */
+  note: text('note'),
+});

package/src/modules/database/index.ts

@@ -0,0 +1,9 @@
+/**
+ * What the database module offers the other modules. A consumer outside the
+ * module imports from here, never from the files: they are the module's own
+ * layout and free to move. Export what another module needs; nothing more.
+ */
+export type { Database } from './connection.js';
+export { deploymentSettings } from './core-schema.js';
+export { pgErrorCode } from './pg-error.js';
+export { agentConnections, agentEvents, atlassianAccountLinks, changeRequests, externalApiKeys, fileLocks, githubFacadeCodes, githubFacadeIdentity, oauthAuthCodes, oauthClients, oauthTokens, pendingCommits, pluginJoinRequests, prFileApprovals, prMergeLog, secrets, users } from './schema.js';

package/src/modules/database/migrate.ts

@@ -1,6 +1,8 @@
 import { migrate } from 'drizzle-orm/node-postgres/migrator';
-import { sql } from 'drizzle-orm';
+import { eq, sql } from 'drizzle-orm';
+import { parseLegacyChangeRequestBody } from '@bevel-software/platform-shared';
 import { logger } from '../../shared/logging.js';
+import { changeRequests, dataMigrations } from './core-schema.js';
 
 const log = logger('database');
 import { DEFAULT_DB_SCHEMA, dbSchemaOf, piiKeysOf, type Database } from './connection.js';
@@ -74,11 +76,87 @@ export async function runCoreMigrations(db: Database, folder: string): Promise<v
       // Under the same lock, before anything reads or writes a PII column:
       // the data half of migration 0016, which SQL cannot do (see below).
       await runPiiEncryptionBackfill(db);
+      // And the data half of 0020, recorded in `data_migrations` by the
+      // transaction that does it: a start that crashed between the SQL
+      // history's ledger and this pass finds no row and runs it.
+      await moveLegacyRequestBodies(db);
     },
     { tenantKey },
   );
 }
 
+/** The `data_migrations` row of the body move: present exactly when the move has been committed. */
+const LEGACY_REQUEST_BODIES_MOVED = '0020_change_request_body_is_the_description';
+
+/**
+ * The data half of migration 0020, which makes a request's body nothing but
+ * its description. Bodies written before it carried three other things: an
+ * `## Affected owners` block `openChangeRequest` appended (a snapshot of the
+ * eligible approvers that nothing read back — they are resolved live, per
+ * file), an access request's level and note in hidden markers (which the
+ * access-request flow parsed back out of the prose), and identity markers
+ * from the time a service account opened requests for people. Every body is
+ * read once here, under the handle's key, the level and the note are moved
+ * onto their own columns, and the prose is written back without the rest.
+ *
+ * ONE transaction: the rows it rewrites and the `data_migrations` row that
+ * records it commit together, or not at all. So the pass runs exactly once —
+ * on the start that first finds no ledger row, which is the start that applies
+ * 0020 or, if that start died between drizzle's own ledger and this pass, the
+ * next one — and never again: a body of the new shape is already clean, and
+ * the grammar this reads is written by nothing. A start that finds the row
+ * reads nothing.
+ *
+ * What the transaction does NOT do is fence the old version: its rows are
+ * read `FOR UPDATE`, which only makes an old-version edit of an existing row
+ * wait for the move, and a request the old version opens after the move has
+ * committed is stored in the old shape and never rewritten. That is why the
+ * upgrade requires the old version to be stopped before the new one starts
+ * (UPGRADING.md, "Stop the old version before the new one starts"), as the
+ * personal-data backfill of 0016 already did; this pass adds no mechanism of
+ * its own, and a rolling update across this release is not supported.
+ *
+ * Walked row by row rather than in one UPDATE because the column is sealed:
+ * SQL can neither read the marker nor write the cleaned text. Reached only
+ * through {@link runCoreMigrations}, and observed through what it leaves:
+ * the rows and the ledger.
+ */
+async function moveLegacyRequestBodies(db: Database): Promise<void> {
+  await db.transaction(async (tx) => {
+    const done = await tx
+      .select({ name: dataMigrations.name })
+      .from(dataMigrations)
+      .where(eq(dataMigrations.name, LEGACY_REQUEST_BODIES_MOVED))
+      .limit(1);
+    if (done.length > 0) return;
+
+    const rows = await tx
+      .select({ id: changeRequests.id, body: changeRequests.body })
+      .from(changeRequests)
+      .orderBy(changeRequests.id)
+      .for('update');
+    let moved = 0;
+    for (const row of rows) {
+      const legacy = parseLegacyChangeRequestBody(row.body);
+      if (!legacy.changed) continue;
+      await tx
+        .update(changeRequests)
+        .set({
+          body: legacy.description,
+          ...(legacy.accessRequestLevel ? { accessRequestLevel: legacy.accessRequestLevel } : {}),
+          ...(legacy.accessRequestNote ? { accessRequestNote: legacy.accessRequestNote } : {}),
+        })
+        .where(eq(changeRequests.id, row.id));
+      moved += 1;
+    }
+    await tx.insert(dataMigrations).values({
+      name: LEGACY_REQUEST_BODIES_MOVED,
+      note: `${moved} of ${rows.length} change-request bodies moved to the description-only shape`,
+    });
+    log.info(`Change-request bodies: ${moved} of ${rows.length} moved to the description-only shape.`);
+  });
+}
+
 /**
  * Apply the ENTERPRISE migration history from `folder`, tracked in
  * `__drizzle_migrations_enterprise`. Run AFTER {@link runCoreMigrations} —
@@ -220,7 +298,6 @@ const PII_BACKFILL_TABLES: PiiBackfillTable[] = [
   { table: 'users', key: ['id'], encrypted: ['email', 'name', 'avatar_url'], bidx: { source: 'email', column: 'email_bidx' } },
   { table: 'pr_file_approvals', key: ['id'], encrypted: ['approver_email', 'approver_name'], bidx: { source: 'approver_email', column: 'approver_email_bidx' } },
   { table: 'pr_merge_log', key: ['id'], encrypted: ['triggered_by_email', 'triggered_by_name', 'error'], bidx: { source: 'triggered_by_email', column: 'triggered_by_email_bidx' } },
-  { table: 'pr_comments', key: ['id'], encrypted: ['author_email', 'author_name', 'body'], bidx: { source: 'author_email', column: 'author_email_bidx' } },
   { table: 'change_requests', key: ['id'], encrypted: ['author_email', 'author_name', 'title', 'body', 'apply_failure_reason', 'apply_failed_by_name'], bidx: { source: 'author_email', column: 'author_email_bidx' } },
   { table: 'pending_commits', key: ['id'], encrypted: ['author_email', 'author_name', 'last_error'], bidx: { source: 'author_email', column: 'author_email_bidx' } },
   { table: 'file_locks', key: ['workspace_id', 'branch', 'path'], encrypted: ['holder_name'] },
@@ -529,7 +606,6 @@ const PII_FINALIZE_STATEMENTS = [
   'CREATE UNIQUE INDEX IF NOT EXISTS "pr_file_approvals_bidx_unq" ON "pr_file_approvals" ("pr_number","path","approver_email_bidx","head_sha")',
   'DROP INDEX IF EXISTS "pr_file_approvals_unq"',
   'ALTER TABLE "pr_merge_log" ALTER COLUMN "triggered_by_email_bidx" SET NOT NULL',
-  'ALTER TABLE "pr_comments" ALTER COLUMN "author_email_bidx" SET NOT NULL',
   'ALTER TABLE "change_requests" ALTER COLUMN "author_email_bidx" SET NOT NULL',
   'ALTER TABLE "pending_commits" ALTER COLUMN "author_email_bidx" SET NOT NULL',
   'ALTER TABLE "plugin_join_requests" ALTER COLUMN "requester_email_bidx" SET NOT NULL',

package/src/modules/declared-variables/declared-variables.routes.ts

@@ -3,8 +3,8 @@ import { logger } from '../../shared/logging.js';
 
 const log = logger('declared-variables');
 import { utcpNamespacedKey } from '../../shared/utcp-namespace.js';
-import type { IToolManualService } from '../tool-manuals/tool-manuals.contract.js';
-import type { ISecretsVaultService } from '../secrets-vault/secrets-vault.contract.js';
+import type { IToolManualService } from '../tool-manuals/index.js';
+import type { ISecretsVaultService } from '../secrets-vault/index.js';
 
 type ResolveUserEmail = (userId: string) => Promise<string | undefined>;
 

package/src/modules/diff/diff.routes.ts

@@ -1,14 +1,14 @@
 import express from 'express';
 import type { AuthUser, IWorkflowService } from '@bevel-software/platform-shared';
 import type { IDiffService } from './diff.interface.js';
-import type { AuthService } from '../auth/auth.service.js';
-import type { IAccessControl } from '../access/access-control.interface.js';
-import { canReadWorkspacePath, toKbRelative, resolveReadableMap } from '../access-model/kb-read-filter.js';
+import type { AuthService } from '../auth/index.js';
+import type { IAccessControl } from '../access/index.js';
+import { canReadWorkspacePath, toKbRelative, resolveReadableMap } from '../access-model/index.js';
 import { WorkflowDomainError, WorkflowValidationError } from '../../shared/domain-errors.js';
 import { domainErrorBody } from '../../shared/http-errors.js';
-import { LockingFilesystem } from '../kb-fs/locking-filesystem.js';
+import { LockingFilesystem } from '../kb-fs/index.js';
 import { branchForWorkspaceId } from '../../shared/workspace-id.js';
-import '../auth/auth.middleware.js';
+import '../auth/index.js';
 
 function toHttpError(
   err: unknown,

package/src/modules/diff/diff.service.ts

@@ -2,8 +2,8 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import type { FileDiffPayload, PendingChange, ReviewSession, ChangeKind } from '@bevel-software/platform-shared';
 import type { IDiffService } from './diff.interface.js';
-import type { WorkspaceService } from '../workspace/workspace.service.js';
-import type { WorkspaceMutex } from '../kb-fs/mutex.js';
+import type { WorkspaceService } from '../workspace/index.js';
+import type { WorkspaceMutex } from '../kb-fs/index.js';
 import { gitDirOf } from '../kb-fs/index.js';
 import { isAbsence, type ITreeWalker, type TreeWalkOptions } from '../../shared/fs.contract.js';
 import { isDiffable } from './diff.config.js';

package/src/modules/diff/index.ts

@@ -0,0 +1,6 @@
+/**
+ * What the diff module offers the other modules. A consumer outside the
+ * module imports from here, never from the files: they are the module's own
+ * layout and free to move. Export what another module needs; nothing more.
+ */
+export type { IDiffService } from './diff.interface.js';

package/src/modules/embed/account-link.service.ts

@@ -1,6 +1,6 @@
 import { and, eq } from 'drizzle-orm';
-import type { Database } from '../database/connection.js';
-import { atlassianAccountLinks } from '../database/schema.js';
+import type { Database } from '../database/index.js';
+import { atlassianAccountLinks } from '../database/index.js';
 
 /**
  * Maps an outside system's account id — today an Atlassian (Forge) account —