@bugmole/cli 0.4.0

package/src/registry/migrations/0006_workspaces.sql

@@ -0,0 +1,36 @@
+CREATE TABLE IF NOT EXISTS workspaces (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  created_by TEXT NOT NULL REFERENCES aegis_users(id),
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE TABLE IF NOT EXISTS workspace_memberships (
+  workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  aegis_id TEXT NOT NULL REFERENCES aegis_users(id) ON DELETE CASCADE,
+  role TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'active',
+  PRIMARY KEY (workspace_id, aegis_id)
+);
+
+ALTER TABLE projects ADD COLUMN workspace_id TEXT REFERENCES workspaces(id);
+
+INSERT OR IGNORE INTO workspaces (id, name, created_by)
+SELECT tenant_id, tenant_id, MIN(m.aegis_id)
+FROM projects p
+JOIN project_memberships m ON m.project_id = p.id
+GROUP BY tenant_id;
+
+INSERT OR IGNORE INTO workspace_memberships (workspace_id, aegis_id, role, status)
+SELECT p.tenant_id, m.aegis_id, 'owner', 'active'
+FROM projects p
+JOIN project_memberships m ON m.project_id = p.id
+WHERE m.role = 'owner';
+
+UPDATE projects SET workspace_id = tenant_id WHERE workspace_id IS NULL;
+
+CREATE INDEX IF NOT EXISTS idx_workspace_memberships_aegis
+  ON workspace_memberships(aegis_id, status);
+
+CREATE INDEX IF NOT EXISTS idx_projects_workspace
+  ON projects(workspace_id, created_at DESC);

package/src/registry/migrations/0007_project_apps.sql

@@ -0,0 +1,26 @@
+CREATE TABLE IF NOT EXISTS project_apps (
+  id TEXT NOT NULL,
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  name TEXT NOT NULL,
+  type TEXT NOT NULL DEFAULT 'web',
+  location TEXT,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  is_default INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (project_id, id)
+);
+
+ALTER TABLE project_environments ADD COLUMN app_id TEXT;
+
+INSERT OR IGNORE INTO project_apps (id, project_id, name, type, is_default)
+SELECT 'default', id, name, 'web', 1
+FROM projects;
+
+UPDATE project_environments
+SET app_id = 'default'
+WHERE app_id IS NULL;
+
+CREATE INDEX IF NOT EXISTS idx_project_apps_project
+  ON project_apps(project_id, created_at);
+
+CREATE INDEX IF NOT EXISTS idx_project_environments_app
+  ON project_environments(project_id, app_id, status);

package/src/registry/migrations/0008_agent_tasks.sql

@@ -0,0 +1,30 @@
+CREATE TABLE IF NOT EXISTS agent_tasks (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  tenant_id TEXT NOT NULL,
+  title TEXT NOT NULL,
+  description TEXT NOT NULL,
+  task_type TEXT NOT NULL DEFAULT 'code',
+  priority INTEGER NOT NULL DEFAULT 0,
+  status TEXT NOT NULL DEFAULT 'queued',
+  requested_by TEXT NOT NULL,
+  worker_id TEXT,
+  lease_expires_at TEXT,
+  heartbeat_at TEXT,
+  progress_message TEXT,
+  continuation_json TEXT,
+  baseline_match_score REAL,
+  parity_match_score REAL,
+  parity_audit_id TEXT,
+  completion_summary TEXT,
+  changed_files_json TEXT,
+  error_message TEXT,
+  idempotency_key TEXT NOT NULL,
+  requested_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  started_at TEXT,
+  completed_at TEXT,
+  UNIQUE(project_id, idempotency_key)
+);
+
+CREATE INDEX IF NOT EXISTS idx_agent_tasks_project_status
+  ON agent_tasks(project_id, status, priority DESC, requested_at ASC);

package/src/registry/migrations/0009_journey_revisions.sql

@@ -0,0 +1,17 @@
+CREATE TABLE IF NOT EXISTS journey_revisions (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  tenant_id TEXT NOT NULL,
+  journey_id TEXT NOT NULL,
+  revision INTEGER NOT NULL,
+  object_key TEXT NOT NULL,
+  app_id TEXT,
+  environment_id TEXT,
+  status TEXT NOT NULL DEFAULT 'draft',
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  UNIQUE(project_id, journey_id, revision)
+);
+
+CREATE INDEX IF NOT EXISTS idx_journey_revisions_project
+  ON journey_revisions(project_id, journey_id, revision DESC);

package/src/registry/migrations/0010_agent_task_journey.sql

@@ -0,0 +1,2 @@
+ALTER TABLE agent_tasks ADD COLUMN journey_id TEXT;
+ALTER TABLE agent_tasks ADD COLUMN journey_revision INTEGER;

package/src/registry/migrations/0011_run_journey_revision.sql

@@ -0,0 +1 @@
+ALTER TABLE runs ADD COLUMN journey_revision INTEGER;

package/src/registry/migrations/0012_canonical_flow_execution.sql

@@ -0,0 +1,10 @@
+ALTER TABLE journey_revisions ADD COLUMN source_of_truth TEXT NOT NULL DEFAULT 'canonical_flow';
+ALTER TABLE journey_revisions ADD COLUMN stability TEXT NOT NULL DEFAULT 'discovered';
+ALTER TABLE journey_revisions ADD COLUMN linked_to_graph INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE journey_revisions ADD COLUMN verification_run_id TEXT;
+
+ALTER TABLE runs ADD COLUMN driver TEXT NOT NULL DEFAULT 'maestro';
+ALTER TABLE runs ADD COLUMN platform TEXT;
+ALTER TABLE runs ADD COLUMN recovery_attempts INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE runs ADD COLUMN failure_code TEXT;
+ALTER TABLE runs ADD COLUMN artifact_summary_json TEXT;

package/src/registry/migrations/0013_device_sessions.sql

@@ -0,0 +1,22 @@
+CREATE TABLE IF NOT EXISTS device_sessions (
+  id TEXT PRIMARY KEY,
+  device_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  device_type TEXT NOT NULL,
+  native_session_id TEXT NOT NULL,
+  tenant_id TEXT NOT NULL,
+  state TEXT NOT NULL,
+  started_at TEXT NOT NULL,
+  stopped_at TEXT,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  UNIQUE(provider, native_session_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_device_sessions_tenant
+  ON device_sessions(tenant_id, started_at DESC);
+
+ALTER TABLE agent_tasks ADD COLUMN device_session_id TEXT REFERENCES device_sessions(id);
+
+CREATE INDEX IF NOT EXISTS idx_agent_tasks_device_session
+  ON agent_tasks(device_session_id);

package/src/registry/migrations/0014_agent_task_step.sql

@@ -0,0 +1 @@
+ALTER TABLE agent_tasks ADD COLUMN step_id TEXT;

package/src/registry/migrations/0015_agent_task_attempts.sql

@@ -0,0 +1,6 @@
+-- Blocked tasks were re-served on every 5s worker poll forever: task
+-- selection accepted `status IN ('queued','blocked')` with no attempt
+-- counter and no backoff, so a task that always fails would be retried
+-- indefinitely. An autonomous pipeline built on that would spin.
+ALTER TABLE agent_tasks ADD COLUMN attempts INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE agent_tasks ADD COLUMN next_attempt_at TEXT;

package/src/registry/migrations/0016_github_issue_tracker.sql

@@ -0,0 +1,54 @@
+CREATE TABLE IF NOT EXISTS github_installations (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  installation_id INTEGER NOT NULL,
+  account_login TEXT NOT NULL,
+  account_type TEXT NOT NULL,
+  repository_selection TEXT NOT NULL,
+  repositories_json TEXT NOT NULL DEFAULT '[]',
+  connected_by TEXT NOT NULL,
+  connected_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  revoked_at TEXT
+);
+
+-- Not unique on installation_id alone: the same GitHub App installation can
+-- legitimately be connected to more than one Valkyrie project (e.g. a shared
+-- backend repo backing two projects), so uniqueness is scoped per project.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_github_installations_project_installation
+  ON github_installations(project_id, installation_id);
+
+CREATE INDEX IF NOT EXISTS idx_github_installations_installation
+  ON github_installations(installation_id);
+
+CREATE TABLE IF NOT EXISTS issue_tracker_links (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  provider TEXT NOT NULL DEFAULT 'github',
+  installation_id INTEGER,
+  owner TEXT NOT NULL,
+  repo TEXT NOT NULL,
+  issue_number INTEGER NOT NULL,
+  issue_node_id TEXT,
+  url TEXT NOT NULL,
+  title TEXT NOT NULL,
+  state TEXT NOT NULL DEFAULT 'unknown',
+  finding_kind TEXT NOT NULL,
+  finding_key TEXT NOT NULL,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  last_sync_source TEXT NOT NULL DEFAULT 'create'
+);
+
+-- At most one active link per finding per project: prevents a single parity
+-- issue or TestFlight feedback item from pointing at two tracker issues.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_issue_links_finding
+  ON issue_tracker_links(project_id, provider, finding_kind, finding_key);
+
+-- Reverse lookup used by the GitHub webhook handler: an `issues` event only
+-- carries owner/repo/issue_number, never our finding_key.
+CREATE INDEX IF NOT EXISTS idx_issue_links_external
+  ON issue_tracker_links(provider, owner, repo, issue_number);
+
+CREATE INDEX IF NOT EXISTS idx_issue_links_project
+  ON issue_tracker_links(project_id, updated_at);

package/src/registry/migrations/0017_run_targets.sql

@@ -0,0 +1,7 @@
+-- A run fans out across a browser/device matrix and hits the environment it
+-- was requested against. The base URL is snapshotted at request time so the
+-- worker needs no extra lookup and the run records which URL it really hit,
+-- even if the environment is edited later.
+ALTER TABLE runs ADD COLUMN targets_json TEXT;
+ALTER TABLE runs ADD COLUMN environment_base_url TEXT;
+ALTER TABLE runs ADD COLUMN target_results_json TEXT;

package/src/registry/migrations/0018_run_fix_from.sql

@@ -0,0 +1,4 @@
+-- "Apply fix": a run can re-run a flow with the fix suggested by an earlier
+-- failed run. The worker reads that run's analysis from storage and applies
+-- it to the flow before executing.
+ALTER TABLE runs ADD COLUMN fix_from_json TEXT;

package/src/registry/migrations/0019_workspace_flags.sql

@@ -0,0 +1,9 @@
+-- Per-workspace opt-in for features that are still rolling out, so a feature
+-- can run for internal workspaces before its global flag is turned on.
+CREATE TABLE IF NOT EXISTS workspace_flags (
+  workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  flag TEXT NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (workspace_id, flag)
+);

package/src/registry/migrations/0020_orgs.sql

@@ -0,0 +1,40 @@
+-- Organizations: enforced workspace roles (owner, admin, member, billing),
+-- invitations, and an audit log of who changed what.
+-- Existing memberships keep their 'owner' role; roles are validated in code
+-- because SQLite can't add a CHECK constraint to an existing table.
+ALTER TABLE workspace_memberships ADD COLUMN invited_by TEXT;
+ALTER TABLE workspace_memberships ADD COLUMN created_at TEXT;
+ALTER TABLE projects ADD COLUMN deleted_at TEXT;
+
+CREATE TABLE IF NOT EXISTS workspace_invitations (
+  id TEXT PRIMARY KEY,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  email TEXT NOT NULL,
+  role TEXT NOT NULL,
+  token_hash TEXT NOT NULL UNIQUE,
+  invited_by TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  accepted_at TEXT,
+  accepted_by TEXT,
+  revoked_at TEXT,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS workspace_invitations_workspace ON workspace_invitations(workspace_id, created_at);
+
+CREATE TABLE IF NOT EXISTS audit_log (
+  id TEXT PRIMARY KEY,
+  workspace_id TEXT NOT NULL,
+  project_id TEXT,
+  actor_type TEXT NOT NULL,
+  actor_id TEXT NOT NULL,
+  action TEXT NOT NULL,
+  target_type TEXT,
+  target_id TEXT,
+  ip TEXT,
+  user_agent TEXT,
+  data_json TEXT,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+);
+CREATE INDEX IF NOT EXISTS audit_log_workspace_time ON audit_log(workspace_id, created_at);
+
+ALTER TABLE run_events ADD COLUMN actor_id TEXT;

package/src/registry/migrations/0021_billing_core.sql

@@ -0,0 +1,58 @@
+-- Plans, usage metering and retention. A workspace without a row in
+-- workspace_plans is on the Free plan.
+CREATE TABLE IF NOT EXISTS workspace_plans (
+  workspace_id TEXT PRIMARY KEY REFERENCES workspaces(id) ON DELETE CASCADE,
+  plan TEXT NOT NULL,
+  billing_interval TEXT,
+  status TEXT NOT NULL DEFAULT 'active',
+  current_period_start TEXT,
+  current_period_end TEXT,
+  spending_limit_cents INTEGER,
+  overrides_json TEXT,
+  provider TEXT,
+  provider_subscription_id TEXT,
+  pending_plan TEXT,
+  grace_until TEXT,
+  updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE UNIQUE INDEX IF NOT EXISTS workspace_plans_subscription ON workspace_plans(provider, provider_subscription_id);
+
+CREATE TABLE IF NOT EXISTS usage_events (
+  id TEXT PRIMARY KEY,
+  workspace_id TEXT NOT NULL,
+  project_id TEXT,
+  run_id TEXT,
+  kind TEXT NOT NULL,
+  quantity INTEGER NOT NULL,
+  source TEXT NOT NULL,
+  idempotency_key TEXT NOT NULL UNIQUE,
+  period_start TEXT NOT NULL,
+  occurred_at TEXT NOT NULL,
+  meta_json TEXT
+);
+CREATE INDEX IF NOT EXISTS usage_events_period ON usage_events(workspace_id, period_start, kind);
+
+
+CREATE TABLE IF NOT EXISTS usage_alerts_sent (
+  workspace_id TEXT NOT NULL,
+  period_start TEXT NOT NULL,
+  alert TEXT NOT NULL,
+  sent_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (workspace_id, period_start, alert)
+);
+
+ALTER TABLE runs ADD COLUMN execution_mode TEXT NOT NULL DEFAULT 'self';
+ALTER TABLE runs ADD COLUMN workspace_id TEXT;
+ALTER TABLE runs ADD COLUMN claimed_at TEXT;
+ALTER TABLE runs ADD COLUMN billed_at TEXT;
+ALTER TABLE runs ADD COLUMN blocked_reason TEXT;
+CREATE INDEX IF NOT EXISTS runs_cloud_queue ON runs(execution_mode, status, requested_at);
+
+ALTER TABLE projects ADD COLUMN storage_mode TEXT NOT NULL DEFAULT 'byo';
+ALTER TABLE projects ADD COLUMN default_execution_mode TEXT NOT NULL DEFAULT 'self';
+
+UPDATE runs SET workspace_id = (SELECT workspace_id FROM projects WHERE projects.id = runs.project_id)
+WHERE workspace_id IS NULL;
+
+-- Where usage and billing emails go; filled in from the dashboard's sign-in.
+ALTER TABLE aegis_users ADD COLUMN email TEXT;

package/src/registry/migrations/0022_cloud_runners.sql

@@ -0,0 +1,19 @@
+-- Hosted runners: dispatch retries and the minutes a finished cloud run billed.
+ALTER TABLE runs ADD COLUMN dispatch_attempts INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE runs ADD COLUMN next_dispatch_at TEXT;
+ALTER TABLE runs ADD COLUMN billed_minutes INTEGER;
+
+-- "valkyrie" storage keeps plans and evidence in Valkyrie's own bucket, which
+-- is what lets a clean cloud container read them.
+UPDATE projects SET storage_mode = 'managed' WHERE storage_provider = 'valkyrie';
+
+-- Discovery can run on Valkyrie Cloud too, sharing the same slots and meter.
+ALTER TABLE agent_tasks ADD COLUMN execution_mode TEXT NOT NULL DEFAULT 'self';
+ALTER TABLE agent_tasks ADD COLUMN workspace_id TEXT;
+ALTER TABLE agent_tasks ADD COLUMN claimed_at TEXT;
+ALTER TABLE agent_tasks ADD COLUMN billed_at TEXT;
+ALTER TABLE agent_tasks ADD COLUMN billed_minutes INTEGER;
+ALTER TABLE agent_tasks ADD COLUMN blocked_reason TEXT;
+ALTER TABLE agent_tasks ADD COLUMN dispatch_attempts INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE agent_tasks ADD COLUMN next_dispatch_at TEXT;
+CREATE INDEX IF NOT EXISTS agent_tasks_cloud_queue ON agent_tasks(execution_mode, status, requested_at);

package/src/registry/migrations/0023_signup.sql

@@ -0,0 +1,4 @@
+-- Whether Aegis confirmed the person's email; Free cloud minutes need it.
+ALTER TABLE aegis_users ADD COLUMN email_verified INTEGER NOT NULL DEFAULT 0;
+-- One Free workspace per verified email.
+CREATE INDEX IF NOT EXISTS aegis_users_email ON aegis_users(email);

package/src/registry/migrations/0024_billing.sql

@@ -0,0 +1,67 @@
+-- Paid plans: checkouts, invoices and receipts, provider webhook de-duplication,
+-- and the billing contact printed on receipts.
+ALTER TABLE workspace_plans ADD COLUMN billing_email TEXT;
+ALTER TABLE workspace_plans ADD COLUMN billing_name TEXT;
+ALTER TABLE workspace_plans ADD COLUMN billing_address TEXT;
+ALTER TABLE workspace_plans ADD COLUMN tax_id TEXT;
+-- The payment that paid for the current period, for pro-rata refunds on upgrade.
+ALTER TABLE workspace_plans ADD COLUMN last_payment_json TEXT;
+-- A cancellation or downgrade takes effect when the period ends.
+ALTER TABLE workspace_plans ADD COLUMN cancel_at_period_end INTEGER NOT NULL DEFAULT 0;
+
+CREATE TABLE IF NOT EXISTS billing_checkouts (
+  id TEXT PRIMARY KEY,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  plan TEXT NOT NULL,
+  billing_interval TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  provider_subscription_id TEXT,
+  status TEXT NOT NULL DEFAULT 'pending',
+  -- The subscription this checkout replaces (an upgrade), settled once it's paid.
+  replaces_subscription_id TEXT,
+  replaced_payment_json TEXT,
+  replaced_cancelled_at TEXT,
+  refund_json TEXT,
+  settled_at TEXT,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  completed_at TEXT
+);
+CREATE INDEX IF NOT EXISTS billing_checkouts_workspace ON billing_checkouts(workspace_id, created_at);
+CREATE UNIQUE INDEX IF NOT EXISTS billing_checkouts_subscription ON billing_checkouts(provider, provider_subscription_id);
+
+CREATE TABLE IF NOT EXISTS invoices (
+  id TEXT PRIMARY KEY,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  number TEXT NOT NULL UNIQUE,
+  -- "subscription": a plan payment PayPal already took. "usage": extra usage billed after the month.
+  kind TEXT NOT NULL,
+  status TEXT NOT NULL,
+  plan TEXT,
+  period_start TEXT NOT NULL,
+  period_end TEXT NOT NULL,
+  currency TEXT NOT NULL DEFAULT 'USD',
+  total_cents INTEGER NOT NULL,
+  lines_json TEXT NOT NULL,
+  provider TEXT,
+  provider_ref TEXT,
+  provider_url TEXT,
+  due_at TEXT,
+  paid_at TEXT,
+  refunded_cents INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS invoices_workspace ON invoices(workspace_id, created_at);
+CREATE UNIQUE INDEX IF NOT EXISTS invoices_provider_ref ON invoices(provider, provider_ref);
+CREATE UNIQUE INDEX IF NOT EXISTS invoices_usage_period ON invoices(workspace_id, kind, period_start);
+
+CREATE TABLE IF NOT EXISTS billing_events (
+  provider TEXT NOT NULL,
+  event_id TEXT NOT NULL,
+  event_type TEXT NOT NULL,
+  received_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (provider, event_id)
+);
+
+-- Projects beyond a downgraded plan's limit are kept, read-only.
+ALTER TABLE projects ADD COLUMN locked_at TEXT;

package/src/registry/migrations/0025_notifications.sql

@@ -0,0 +1,47 @@
+-- Work that talks to other services (Slack, GitHub, email) goes through an
+-- outbox, so a slow or failing service never fails the request that caused it.
+CREATE TABLE IF NOT EXISTS outbox (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL,
+  payload_json TEXT NOT NULL,
+  dedupe_key TEXT UNIQUE,
+  status TEXT NOT NULL DEFAULT 'pending',
+  attempts INTEGER NOT NULL DEFAULT 0,
+  next_attempt_at TEXT NOT NULL,
+  locked_until TEXT,
+  last_error TEXT,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  done_at TEXT
+);
+CREATE INDEX IF NOT EXISTS outbox_due ON outbox(status, next_attempt_at);
+
+CREATE TABLE IF NOT EXISTS slack_installations (
+  id TEXT PRIMARY KEY,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  team_id TEXT NOT NULL,
+  team_name TEXT,
+  channel_id TEXT NOT NULL,
+  channel_name TEXT,
+  bot_token_ciphertext TEXT NOT NULL,
+  bot_token_iv TEXT NOT NULL,
+  installed_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  revoked_at TEXT,
+  revoked_reason TEXT
+);
+CREATE INDEX IF NOT EXISTS slack_installations_workspace ON slack_installations(workspace_id);
+
+CREATE TABLE IF NOT EXISTS alert_rules (
+  id TEXT PRIMARY KEY,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  -- Null means every project in the workspace.
+  project_id TEXT,
+  event TEXT NOT NULL,
+  channel TEXT NOT NULL,
+  -- A Slack installation id, or an email address.
+  target TEXT NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  UNIQUE (workspace_id, project_id, event, channel, target)
+);

package/src/registry/migrations/0026_repo_bindings.sql

@@ -0,0 +1,28 @@
+-- Which repositories start runs, and which GitHub check a run reports to.
+CREATE TABLE IF NOT EXISTS project_repo_bindings (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  installation_id INTEGER NOT NULL,
+  repo_full_name TEXT NOT NULL,
+  -- JSON array of plan ids; null runs every published plan.
+  plan_ids_json TEXT,
+  environment_id TEXT,
+  -- pull_request: every push to an open PR. deployment: when a deployment succeeds.
+  trigger TEXT NOT NULL DEFAULT 'pull_request',
+  -- e.g. https://pr-{number}.preview.example.com; null uses the environment or the deployment's URL.
+  base_url_template TEXT,
+  execution_mode TEXT NOT NULL DEFAULT 'cloud',
+  enabled INTEGER NOT NULL DEFAULT 1,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  UNIQUE (project_id, repo_full_name, trigger)
+);
+CREATE INDEX IF NOT EXISTS project_repo_bindings_repo ON project_repo_bindings(repo_full_name);
+
+ALTER TABLE runs ADD COLUMN trigger_source TEXT;
+ALTER TABLE runs ADD COLUMN repo_full_name TEXT;
+ALTER TABLE runs ADD COLUMN commit_sha TEXT;
+ALTER TABLE runs ADD COLUMN pr_number INTEGER;
+ALTER TABLE runs ADD COLUMN github_installation_id INTEGER;
+ALTER TABLE runs ADD COLUMN check_run_id INTEGER;
+CREATE INDEX IF NOT EXISTS runs_check_run ON runs(check_run_id);

package/src/registry/migrations/0027_feedback.sql

@@ -0,0 +1,29 @@
+-- Bug reports and feedback sent from the dashboard, and the GitHub issue each became.
+CREATE TABLE IF NOT EXISTS feedback_reports (
+  id TEXT PRIMARY KEY,
+  aegis_id TEXT NOT NULL,
+  workspace_id TEXT,
+  project_id TEXT,
+  run_id TEXT,
+  kind TEXT NOT NULL,
+  rating INTEGER,
+  category TEXT,
+  message TEXT NOT NULL,
+  page TEXT,
+  plan TEXT,
+  -- Contact details only when the person chose to give them.
+  contact TEXT,
+  data_json TEXT NOT NULL DEFAULT '{}',
+  screenshot_keys_json TEXT NOT NULL DEFAULT '[]',
+  fingerprint TEXT NOT NULL,
+  duplicate_of TEXT,
+  github_issue_number INTEGER,
+  github_issue_url TEXT,
+  status TEXT NOT NULL DEFAULT 'new',
+  ip TEXT,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  closed_at TEXT
+);
+CREATE INDEX IF NOT EXISTS feedback_reports_person ON feedback_reports(aegis_id, created_at);
+CREATE INDEX IF NOT EXISTS feedback_reports_fingerprint ON feedback_reports(fingerprint, created_at);
+CREATE INDEX IF NOT EXISTS feedback_reports_issue ON feedback_reports(github_issue_number);

package/src/registry/migrations/0028_devices.sql

@@ -0,0 +1,48 @@
+-- Device clouds a workspace connects, app builds to install, and sessions on
+-- Valkyrie's own device cloud (metered in device minutes).
+CREATE TABLE IF NOT EXISTS device_cloud_credentials (
+  id TEXT PRIMARY KEY,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  provider TEXT NOT NULL,
+  label TEXT NOT NULL,
+  username TEXT NOT NULL,
+  project_arn TEXT,
+  secret_ciphertext TEXT NOT NULL,
+  secret_iv TEXT NOT NULL,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  last_verified_at TEXT,
+  revoked_at TEXT
+);
+CREATE INDEX IF NOT EXISTS device_cloud_credentials_workspace ON device_cloud_credentials(workspace_id);
+
+CREATE TABLE IF NOT EXISTS app_builds (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  platform TEXT NOT NULL,
+  filename TEXT NOT NULL,
+  object_key TEXT NOT NULL,
+  size_bytes INTEGER NOT NULL,
+  sha256 TEXT NOT NULL,
+  -- Uploads already made to device clouds, so a build isn't sent twice.
+  provider_refs_json TEXT NOT NULL DEFAULT '{}',
+  uploaded_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  deleted_at TEXT
+);
+CREATE INDEX IF NOT EXISTS app_builds_project ON app_builds(project_id, created_at);
+
+CREATE TABLE IF NOT EXISTS valkyrie_device_sessions (
+  id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  workspace_id TEXT NOT NULL,
+  device_name TEXT NOT NULL,
+  session_arn TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'starting',
+  metered_minutes INTEGER,
+  billed_at TEXT,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  finished_at TEXT
+);
+CREATE INDEX IF NOT EXISTS valkyrie_device_sessions_open ON valkyrie_device_sessions(status, created_at);

package/src/registry/migrations/0029_sso.sql

@@ -0,0 +1,31 @@
+-- Enterprise SSO/SCIM: a workspace linked to an Aegis organization, how IdP
+-- groups map to workspace roles, and who was removed by the IdP.
+ALTER TABLE workspaces ADD COLUMN aegis_org_id TEXT;
+-- Role for organization members whose groups match no mapping ('none' = no access).
+ALTER TABLE workspaces ADD COLUMN sso_default_role TEXT NOT NULL DEFAULT 'member';
+-- What Aegis was last told ('on' / 'off'), and when a plan that lost SSO stops using it.
+ALTER TABLE workspaces ADD COLUMN sso_entitlement TEXT;
+ALTER TABLE workspaces ADD COLUMN sso_grace_until TEXT;
+CREATE UNIQUE INDEX IF NOT EXISTS workspaces_aegis_org ON workspaces(aegis_org_id) WHERE aegis_org_id IS NOT NULL;
+
+-- 'invite' rows are managed by people; 'sso' rows follow the IdP.
+ALTER TABLE workspace_memberships ADD COLUMN source TEXT NOT NULL DEFAULT 'invite';
+
+CREATE TABLE IF NOT EXISTS workspace_group_roles (
+  workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  group_name TEXT NOT NULL,
+  role TEXT NOT NULL,
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (workspace_id, group_name)
+);
+
+-- Set when the IdP deprovisions someone; their dashboard sign-ins are refused until reactivated.
+ALTER TABLE aegis_users ADD COLUMN deprovisioned_at TEXT;
+
+-- Signed events already handled, so a replayed delivery does nothing.
+CREATE TABLE IF NOT EXISTS aegis_events (
+  id TEXT PRIMARY KEY,
+  type TEXT NOT NULL,
+  received_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);

package/src/registry/migrations/0030_workspace_domains.sql

@@ -0,0 +1,18 @@
+-- Domains a workspace has proven it controls, by DNS TXT record. Required
+-- before Valkyrie Cloud (its own IPs) will explore or run against a host on
+-- that domain, so a workspace can't point Valkyrie's cloud infrastructure at
+-- a site it doesn't own. Self-hosted runs and explorations are unaffected —
+-- those use the customer's own machine or CI, never Valkyrie's.
+CREATE TABLE IF NOT EXISTS workspace_domains (
+  id TEXT PRIMARY KEY,
+  workspace_id TEXT NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+  domain TEXT NOT NULL,
+  verification_token TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending', -- pending | verified
+  created_by TEXT,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  verified_at TEXT,
+  last_check_error TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS workspace_domains_unique ON workspace_domains(workspace_id, domain);
+CREATE INDEX IF NOT EXISTS workspace_domains_by_workspace ON workspace_domains(workspace_id, status);