@defrex/autobuild-postgres-store 0.10.1 → 0.12.0

package/src/schema.ts

@@ -1,3 +1,7 @@
+import { PostgresProjectRegistry } from './projects'
+import type { PostgresEnv } from './env'
+import type { BlobStore } from '@defrex/autobuild/plugin-sdk'
+import { migrateLegacyTickets } from './ticket-migration'
 import { SQL } from 'bun'
 import {
   AUTH_SCHEMA_CHECKSUM,
@@ -8,7 +12,7 @@ import {
   assertAuthSchema,
 } from './auth-schema'
 
-export const SCHEMA_VERSION = 9
+export const SCHEMA_VERSION = 12
 export const MIGRATE_COMMAND = 'bun run postgres:migrate (from a pinned Autobuild release checkout)'
 
 /** The frozen v3 DDL, kept verbatim so a deployed v3 marker's checksum can be
@@ -666,7 +670,7 @@ CREATE INDEX IF NOT EXISTS events_type_build_seq ON events (type, build, seq);
 CREATE INDEX IF NOT EXISTS repo_events_type_repo_seq ON repo_events (repo, type, seq);`.trim()
 export const SCHEMA_V8_CHECKSUM = new Bun.CryptoHasher('sha256').update(SCHEMA_V8_DDL).digest('hex')
 
-export const SCHEMA_DDL = `
+export const SCHEMA_V9_DDL = `
 CREATE TABLE IF NOT EXISTS ab_schema_migrations (
   singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
   version integer NOT NULL,
@@ -773,12 +777,53 @@ CREATE TABLE IF NOT EXISTS ticket_assets (
   PRIMARY KEY (repo, ticket_id, kind, name, revision)
 );`.trim()
 
+export const SCHEMA_V9_CHECKSUM = new Bun.CryptoHasher('sha256').update(SCHEMA_V9_DDL).digest('hex')
+
+export const PROJECT_SCHEMA_DDL = `
+CREATE SEQUENCE IF NOT EXISTS project_journal_seq;
+CREATE TABLE IF NOT EXISTS project_journal (
+  seq bigint PRIMARY KEY, repo text NOT NULL,
+  action text NOT NULL CHECK (action IN ('added','removed')),
+  actor text NOT NULL CHECK (length(btrim(actor)) > 0),
+  ts timestamptz NOT NULL
+);
+CREATE TABLE IF NOT EXISTS project_registry_state (
+  singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
+  legacy_imported boolean NOT NULL
+);`.trim()
+export const SCHEMA_V10_DDL = `${SCHEMA_V9_DDL}\n${PROJECT_SCHEMA_DDL}`
+export const SCHEMA_V10_CHECKSUM = new Bun.CryptoHasher('sha256')
+  .update(SCHEMA_V10_DDL)
+  .digest('hex')
+export const CREDENTIAL_SCHEMA_DDL = `
+CREATE TABLE IF NOT EXISTS project_credentials (
+  id text PRIMARY KEY, digest text NOT NULL, repo text NOT NULL,
+  created_at timestamptz NOT NULL, created_by text NOT NULL,
+  last_used_at timestamptz, revoked_at timestamptz, expires_at timestamptz,
+  purpose text NOT NULL CHECK (purpose IN ('project-owner','dispatcher'))
+);`.trim()
+export const SCHEMA_V11_DDL = `${SCHEMA_V10_DDL}\n${CREDENTIAL_SCHEMA_DDL}`
+export const SCHEMA_V11_CHECKSUM = new Bun.CryptoHasher('sha256')
+  .update(SCHEMA_V11_DDL)
+  .digest('hex')
+export const CONNECTION_SCHEMA_DDL = `
+CREATE TABLE IF NOT EXISTS project_connections (
+  id text PRIMARY KEY, repo text NOT NULL, credential_id text NOT NULL,
+  digest text NOT NULL, capability_hash text NOT NULL, code text NOT NULL UNIQUE,
+  created_at timestamptz NOT NULL, expires_at timestamptz NOT NULL,
+  status text NOT NULL CHECK (status IN ('pending','approved','denied','expired')),
+  approved_by text, polled_at timestamptz, poll_attempts integer NOT NULL DEFAULT 0
+);
+CREATE TABLE IF NOT EXISTS connection_lookup_limits (
+  actor text PRIMARY KEY, started_at timestamptz NOT NULL, attempts integer NOT NULL
+);`.trim()
+export const SCHEMA_DDL = `${SCHEMA_V11_DDL}\n${CONNECTION_SCHEMA_DDL}`
 export const SCHEMA_CHECKSUM = new Bun.CryptoHasher('sha256').update(SCHEMA_DDL).digest('hex')
 
 /** Ticket persistence evolves independently so deployed v1 BuildStore markers
  * remain valid while the hosted ticket tables are added. */
-export const TICKET_SCHEMA_VERSION = 1
-export const TICKET_SCHEMA_DDL = `
+export const TICKET_SCHEMA_VERSION = 2
+export const TICKET_SCHEMA_V1_DDL = `
 CREATE TABLE IF NOT EXISTS ab_ticket_schema_migrations (
   singleton boolean PRIMARY KEY DEFAULT true CHECK (singleton),
   version integer NOT NULL, checksum text NOT NULL, applied_at timestamptz NOT NULL
@@ -803,6 +848,10 @@ CREATE TABLE IF NOT EXISTS ab_ticket_blockers (
   FOREIGN KEY (team, blocker_id) REFERENCES ab_tickets(team, id) ON DELETE CASCADE,
   CHECK (ticket_id <> blocker_id)
 );`.trim()
+export const TICKET_SCHEMA_V1_CHECKSUM = new Bun.CryptoHasher('sha256')
+  .update(TICKET_SCHEMA_V1_DDL)
+  .digest('hex')
+export const TICKET_SCHEMA_DDL = TICKET_SCHEMA_V1_DDL.replaceAll('team', 'repo')
 export const TICKET_SCHEMA_CHECKSUM = new Bun.CryptoHasher('sha256')
   .update(TICKET_SCHEMA_DDL)
   .digest('hex')
@@ -825,6 +874,47 @@ CREATE TABLE IF NOT EXISTS reducer_snapshots (
 type ExpectedColumn = readonly [name: string, type: string, notNull: boolean, defaultValue?: string]
 
 const EXPECTED_COLUMNS: Record<string, readonly ExpectedColumn[]> = {
+  project_connections: [
+    ['id', 'text', true],
+    ['repo', 'text', true],
+    ['credential_id', 'text', true],
+    ['digest', 'text', true],
+    ['capability_hash', 'text', true],
+    ['code', 'text', true],
+    ['created_at', 'timestamp with time zone', true],
+    ['expires_at', 'timestamp with time zone', true],
+    ['status', 'text', true],
+    ['approved_by', 'text', false],
+    ['polled_at', 'timestamp with time zone', false],
+    ['poll_attempts', 'integer', true, '0'],
+  ],
+  connection_lookup_limits: [
+    ['actor', 'text', true],
+    ['started_at', 'timestamp with time zone', true],
+    ['attempts', 'integer', true],
+  ],
+  project_credentials: [
+    ['id', 'text', true],
+    ['digest', 'text', true],
+    ['repo', 'text', true],
+    ['created_at', 'timestamp with time zone', true],
+    ['created_by', 'text', true],
+    ['last_used_at', 'timestamp with time zone', false],
+    ['revoked_at', 'timestamp with time zone', false],
+    ['expires_at', 'timestamp with time zone', false],
+    ['purpose', 'text', true],
+  ],
+  project_journal: [
+    ['seq', 'bigint', true],
+    ['repo', 'text', true],
+    ['action', 'text', true],
+    ['actor', 'text', true],
+    ['ts', 'timestamp with time zone', true],
+  ],
+  project_registry_state: [
+    ['singleton', 'boolean', true, 'true'],
+    ['legacy_imported', 'boolean', true],
+  ],
   ab_schema_migrations: [
     ['singleton', 'boolean', true, 'true'],
     ['version', 'integer', true],
@@ -958,6 +1048,16 @@ const EXPECTED_COLUMNS: Record<string, readonly ExpectedColumn[]> = {
 }
 
 const EXPECTED_CONSTRAINTS = [
+  'project_connections|p|id||||',
+  'project_connections|c|||||',
+  'connection_lookup_limits|p|actor||||',
+  'project_credentials|p|id||||',
+  'project_credentials|c|||||',
+  'project_journal|p|seq||||',
+  'project_journal|c|||||',
+  'project_journal|c|||||',
+  'project_registry_state|p|singleton||||',
+  'project_registry_state|c|||||',
   // CHECK constraints are compared by presence only (their pg_get_expr text
   // is version-sensitive); PK/FK rows compare fully.
   'ab_schema_migrations|c|||||',
@@ -1112,7 +1212,7 @@ async function assertCatalogShape(sql: SQL): Promise<void> {
           ].join('|'),
     )
     .sort()
-  if (JSON.stringify(actualConstraints) !== JSON.stringify(EXPECTED_CONSTRAINTS)) {
+  if (JSON.stringify(actualConstraints) !== JSON.stringify([...EXPECTED_CONSTRAINTS].sort())) {
     throw schemaError('constraints are missing or mismatched')
   }
 }
@@ -1170,7 +1270,7 @@ export async function assertTicketSchema(sql: SQL): Promise<void> {
       ['applied_at', 'timestamp with time zone', true],
     ],
     ab_tickets: [
-      ['team', 'text', true],
+      ['repo', 'text', true],
       ['id', 'text', true],
       ['creation_key', 'text', false],
       ['title', 'text', true],
@@ -1181,14 +1281,14 @@ export async function assertTicketSchema(sql: SQL): Promise<void> {
       ['updated_at', 'timestamp with time zone', true],
     ],
     ab_ticket_comments: [
-      ['team', 'text', true],
+      ['repo', 'text', true],
       ['ticket_id', 'text', true],
       ['seq', 'bigint', true],
       ['body', 'text', true],
       ['created_at', 'timestamp with time zone', true],
     ],
     ab_ticket_blockers: [
-      ['team', 'text', true],
+      ['repo', 'text', true],
       ['ticket_id', 'text', true],
       ['blocker_id', 'text', true],
     ],
@@ -1213,6 +1313,32 @@ export async function assertTicketSchema(sql: SQL): Promise<void> {
       throw schemaError(`ticket table ${table} is missing or mismatched`)
     }
   }
+  const constraints: { table_name: string; definition: string }[] = await sql`
+    SELECT c.relname AS table_name, pg_get_constraintdef(k.oid) AS definition
+    FROM pg_constraint k JOIN pg_class c ON c.oid = k.conrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname = current_schema() AND k.contype IN ('p', 'u', 'f', 'c') AND c.relname IN ('ab_tickets', 'ab_ticket_comments', 'ab_ticket_blockers')`
+  const expectedConstraints: Record<string, string[]> = {
+    ab_tickets: ['PRIMARY KEY (repo, id)', 'UNIQUE (repo, creation_key)'],
+    ab_ticket_comments: [
+      'PRIMARY KEY (repo, ticket_id, seq)',
+      'FOREIGN KEY (repo, ticket_id) REFERENCES ab_tickets(repo, id) ON DELETE CASCADE',
+    ],
+    ab_ticket_blockers: [
+      'PRIMARY KEY (repo, ticket_id, blocker_id)',
+      'FOREIGN KEY (repo, ticket_id) REFERENCES ab_tickets(repo, id) ON DELETE CASCADE',
+      'FOREIGN KEY (repo, blocker_id) REFERENCES ab_tickets(repo, id) ON DELETE CASCADE',
+      'CHECK ((ticket_id <> blocker_id))',
+    ],
+  }
+  for (const [table, definitions] of Object.entries(expectedConstraints)) {
+    const actual = constraints
+      .filter((row) => row.table_name === table)
+      .map((row) => row.definition)
+      .sort()
+    if (JSON.stringify(actual) !== JSON.stringify(definitions.sort()))
+      throw schemaError(`ticket table ${table} constraints are missing or mismatched`)
+  }
 }
 
 /** The guarded streams.creation_seq upgrade, shared by every pre-v7 marker
@@ -1243,7 +1369,13 @@ const STREAMS_CREATION_SEQ_MIGRATION = `
   END $$;
 `
 
-export async function migratePostgres(url: string): Promise<void> {
+export async function migratePostgres(
+  url: string,
+  options: {
+    openBlobs?: () => BlobStore | Promise<BlobStore>
+    legacyProjectEnv?: PostgresEnv
+  } = {},
+): Promise<void> {
   const sql = new SQL(url)
   try {
     await sql.begin(async (tx) => {
@@ -1427,6 +1559,18 @@ export async function migratePostgres(url: string): Promise<void> {
             SET version = ${SCHEMA_VERSION}, checksum = ${SCHEMA_CHECKSUM},
               applied_at = ${new Date().toISOString()}
             WHERE singleton = true`
+        } else if (version === 11 && marker.checksum === SCHEMA_V11_CHECKSUM) {
+          await tx`UPDATE ab_schema_migrations SET version = ${SCHEMA_VERSION}, checksum = ${SCHEMA_CHECKSUM},
+            applied_at = ${new Date().toISOString()} WHERE singleton = true`
+        } else if (version === 10 && marker.checksum === SCHEMA_V10_CHECKSUM) {
+          await tx`UPDATE ab_schema_migrations
+            SET version = ${SCHEMA_VERSION}, checksum = ${SCHEMA_CHECKSUM},
+              applied_at = ${new Date().toISOString()} WHERE singleton = true`
+        } else if (version === 9 && marker.checksum === SCHEMA_V9_CHECKSUM) {
+          await tx`UPDATE ab_schema_migrations
+            SET version = ${SCHEMA_VERSION}, checksum = ${SCHEMA_CHECKSUM},
+              applied_at = ${new Date().toISOString()}
+            WHERE singleton = true`
         } else if (version === 8 && marker.checksum === SCHEMA_V8_CHECKSUM) {
           // v8 → v9: the idempotent full DDL above created the ticket_assets
           // table, which is the entire delta (no pre-existing table changes).
@@ -1442,10 +1586,23 @@ export async function migratePostgres(url: string): Promise<void> {
         await tx`INSERT INTO ab_schema_migrations (singleton, version, checksum, applied_at)
           VALUES (true, ${SCHEMA_VERSION}, ${SCHEMA_CHECKSUM}, ${new Date().toISOString()})`
       }
+      if (options.legacyProjectEnv !== undefined) {
+        await new PostgresProjectRegistry(tx as SQL).initializeFromEnvInTransaction(
+          options.legacyProjectEnv,
+        )
+      }
       const ticketRows: { version: number; checksum: string }[] =
         await tx`SELECT version, checksum FROM ab_ticket_schema_migrations WHERE singleton = true FOR UPDATE`
       const ticketMarker = ticketRows[0]
-      if (ticketMarker) {
+      if (
+        ticketMarker &&
+        Number(ticketMarker.version) === 1 &&
+        ticketMarker.checksum === TICKET_SCHEMA_V1_CHECKSUM
+      ) {
+        await migrateLegacyTickets(tx as SQL, options.openBlobs)
+        await tx`UPDATE ab_ticket_schema_migrations SET version = ${TICKET_SCHEMA_VERSION},
+          checksum = ${TICKET_SCHEMA_CHECKSUM}, applied_at = ${new Date().toISOString()} WHERE singleton = true`
+      } else if (ticketMarker) {
         if (Number(ticketMarker.version) !== TICKET_SCHEMA_VERSION) {
           throw schemaError(
             `ticket marker is incompatible: version ${ticketMarker.version} does not match ` +

package/src/store.ts

@@ -77,6 +77,7 @@ import {
   DIGEST_EVENT_TYPES,
   type DigestEventRow,
   REPOSITORY_STATE_EVENT_TYPES,
+  REPOSITORY_LATEST_EVENT_TYPES,
   readRepoStateEventsWithAnchorRecheck,
   reduceBuildDigest,
 } from '@defrex/autobuild/store-adapter'
@@ -1091,10 +1092,6 @@ export class PostgresBuildStore implements BuildStore {
     // select; an append after the final re-probe is an ordinary post-read
     // concurrent append, not this race.
     const durableList = [...REPOSITORY_STATE_EVENT_TYPES]
-    // `repo` is $1; the anchored select also spends $2 on the anchor, so the
-    // type list's placeholders start at the right offset per branch.
-    const placeholders = (start: number) =>
-      durableList.map((_, index) => `$${index + start}`).join(', ')
     return readRepoStateEventsWithAnchorRecheck(
       async () => {
         // The probe below is an aggregate: MAX() always returns exactly one row —
@@ -1115,16 +1112,26 @@ export class PostgresBuildStore implements BuildStore {
         return probe?.no_anchor ? undefined : num(probe?.seq)
       },
       async (anchor) => {
-        const rows: Row[] = await this.run((q) =>
+        const bindings: (string | number)[] = [repo]
+        const bind = (value: string | number) => {
+          bindings.push(value)
+          return `$${bindings.length}`
+        }
+        const durable = `type IN (${durableList.map(bind).join(', ')})`
+        const latestTypes = REPOSITORY_LATEST_EVENT_TYPES.map(bind)
+        const latest = latestTypes.map(
+          (type) =>
+            `(type = ${type} AND seq = (SELECT seq FROM repo_events WHERE repo = $1 AND type = ${type} ORDER BY seq DESC LIMIT 1))`,
+        )
+        const tail =
           anchor === undefined
-            ? q.unsafe(
-                `SELECT * FROM repo_events WHERE repo = $1 AND type IN (${placeholders(2)}) ORDER BY seq`,
-                [repo, ...durableList],
-              )
-            : q.unsafe(
-                `SELECT * FROM repo_events WHERE repo = $1 AND (seq >= $2 OR type IN (${placeholders(3)})) ORDER BY seq`,
-                [repo, anchor, ...durableList],
-              ),
+            ? []
+            : [`(seq >= ${bind(anchor)} AND type NOT IN (${latestTypes.join(', ')}))`]
+        const rows: Row[] = await this.run((q) =>
+          q.unsafe(
+            `SELECT * FROM repo_events WHERE repo = $1 AND (${[durable, ...tail, ...latest].join(' OR ')}) ORDER BY seq`,
+            bindings,
+          ),
         )
         return rows.map((row) => ({
           repo: String(row.repo),

package/src/ticket-assignments.ts

@@ -0,0 +1,39 @@
+import { SQL } from 'bun'
+import { normalizeProjectRepository, initializeProjectRegistryForRecovery } from './projects'
+import { resolvePostgresUrl, type PostgresEnv } from './env'
+
+export const TICKET_ASSIGNMENTS_DDL = `CREATE TABLE IF NOT EXISTS ticket_team_assignments (
+  seq bigserial PRIMARY KEY, team text NOT NULL, repo text NOT NULL,
+  actor text NOT NULL, ts timestamptz NOT NULL
+)`
+export interface TicketAssignments {
+  assign(team: string, repo: string, actor: string): Promise<void>
+  close(): Promise<void>
+}
+/** Deliberately independent of v2 ticket schema assertion: this is the recovery
+ * path for a migration whose ownership preflight has stopped. */
+export async function openTicketAssignmentsFromEnv(env: PostgresEnv): Promise<TicketAssignments> {
+  const sql = new SQL(resolvePostgresUrl(env))
+  try {
+    await initializeProjectRegistryForRecovery(sql, env)
+    await sql.unsafe(TICKET_ASSIGNMENTS_DDL)
+    return {
+      async assign(team, rawRepo, actor) {
+        const repo = normalizeProjectRepository(rawRepo)
+        if (!team.trim() || !actor.trim()) throw new Error('team and actor must be nonblank')
+        await sql.begin(async (tx) => {
+          await tx`LOCK TABLE project_journal, ticket_team_assignments IN SHARE ROW EXCLUSIVE MODE`
+          const [entry] =
+            await tx`SELECT action FROM project_journal WHERE repo = ${repo} ORDER BY seq DESC LIMIT 1`
+          if (entry?.action !== 'added') throw new Error(`project not registered: ${repo}`)
+          await tx`INSERT INTO ticket_team_assignments (team, repo, actor, ts)
+            VALUES (${team}, ${repo}, ${actor.trim()}, ${new Date().toISOString()})`
+        })
+      },
+      close: () => sql.close(),
+    }
+  } catch (error) {
+    await sql.close()
+    throw error
+  }
+}

package/src/ticket-migration.ts

@@ -0,0 +1,147 @@
+import type { SQL } from 'bun'
+import type { BlobStore, RepositoryEvent } from '@defrex/autobuild/plugin-sdk'
+import { findEffectiveConfigRef, decodeEffectiveConfig } from '@defrex/autobuild/operator'
+import { TICKET_ASSIGNMENTS_DDL } from './ticket-assignments'
+
+/** Called only inside the schema migration transaction. Locks preserve the
+ * registry/config/ownership snapshot across immutable blob reads and rekeying. */
+export async function migrateLegacyTickets(
+  sql: SQL,
+  openBlobs?: () => BlobStore | Promise<BlobStore>,
+): Promise<void> {
+  await sql.unsafe(TICKET_ASSIGNMENTS_DDL)
+  await sql`LOCK TABLE project_journal, repo_streams, repo_events, repo_artifacts,
+    ticket_team_assignments, ab_tickets, ab_ticket_comments, ab_ticket_blockers,
+    ticket_assets IN SHARE ROW EXCLUSIVE MODE`
+  const teams: { team: string }[] = await sql`SELECT team FROM ab_tickets UNION
+    SELECT team FROM ab_ticket_comments UNION SELECT team FROM ab_ticket_blockers`
+  const assignments = new Map<string, string>()
+  if (teams.length > 0) {
+    if (!openBlobs)
+      throw new Error(
+        'Populated v1 ticket migration requires blob access; configure the service blob backend, credentials, access and prefix and rerun the environment-aware migration command.',
+      )
+    let blobs: BlobStore
+    try {
+      blobs = await openBlobs()
+    } catch {
+      throw new Error(
+        'Ticket migration cannot open blob storage; configure the service blob backend, credentials, access and prefix.',
+      )
+    }
+    const projects: { repo: string }[] = await sql`SELECT repo FROM (
+      SELECT DISTINCT ON (repo) repo, action FROM project_journal ORDER BY repo, seq DESC
+    ) latest WHERE action = 'added' ORDER BY repo`
+    const overrides: { team: string; repo: string }[] =
+      await sql`SELECT DISTINCT ON (team) team, repo FROM ticket_team_assignments ORDER BY team, seq DESC`
+    const remaining = teams.filter(({ team }) => !overrides.some((item) => item.team === team))
+    const configFailure = (detail: string) =>
+      new Error(
+        `Ticket migration stopped unchanged: ${detail}. Restore the selected effective configuration/blob, or explicitly assign every remaining legacy team (${remaining.map(({ team }) => team).join(', ')}) with ab-hosted-store tickets assign-team TEAM REPOSITORY --user IDENTITY, then rerun migration.`,
+      )
+    const claimants = new Map<string, string[]>()
+    for (const { repo } of remaining.length > 0 ? projects : []) {
+      const rows: { seq: number; ts: string; actor: unknown; type: string; payload: unknown }[] =
+        await sql`SELECT seq, ts, actor, type, payload FROM repo_events WHERE repo = ${repo} ORDER BY seq`
+      const events = rows.map((row) => ({
+        ...row,
+        repo,
+        seq: Number(row.seq),
+        ts: new Date(row.ts).toISOString(),
+      })) as RepositoryEvent[]
+      const ref = findEffectiveConfigRef(events)
+      // Registration/onboarding alone makes no team claim.
+      if (ref === undefined) continue
+      const [artifact] =
+        await sql`SELECT blob_ref FROM repo_artifacts WHERE repo = ${repo} AND kind = ${ref.kind} AND revision = ${ref.rev}`
+      if (!artifact)
+        throw configFailure(`effective config ${ref.kind}@${ref.rev} unavailable for ${repo}`)
+      let bytes: Uint8Array | null
+      try {
+        bytes = await blobs.get(artifact.blob_ref)
+      } catch {
+        throw configFailure(
+          `cannot read effective configuration blob for ${repo}; check blob access and prefix`,
+        )
+      }
+      if (bytes === null)
+        throw configFailure(
+          `missing effective configuration blob for ${repo}; check blob backend and prefix`,
+        )
+      let config: ReturnType<typeof decodeEffectiveConfig>
+      try {
+        config = decodeEffectiveConfig(bytes, `${repo} ${ref.kind}@${ref.rev}`)
+      } catch {
+        throw configFailure(
+          `selected effective config ${ref.kind}@${ref.rev} for ${repo} is invalid`,
+        )
+      }
+      const team = config.tickets.teamKey
+      if (team !== undefined) claimants.set(team, [...(claimants.get(team) ?? []), repo])
+    }
+    const errors: string[] = []
+    for (const { team } of teams) {
+      const override = overrides.find((item) => item.team === team)
+      const candidates = claimants.get(team) ?? []
+      if (override && projects.some((project) => project.repo === override.repo))
+        assignments.set(team, override.repo)
+      else if (!override && candidates.length === 1) assignments.set(team, candidates[0]!)
+      else
+        errors.push(
+          `team "${team}": ${override ? `assignment project is not registered: ${override.repo}` : candidates.length ? `conflicting projects: ${candidates.join(', ')}` : 'no project claims this team'}`,
+        )
+    }
+    if (errors.length)
+      throw new Error(
+        `Ticket migration stopped unchanged: ${errors.join('; ')}. Resolve ownership with ab-hosted-store tickets assign-team TEAM REPOSITORY --user IDENTITY, then rerun migration.`,
+      )
+    const assets: { repo: string; ticket_id: string; team: string }[] =
+      await sql`SELECT DISTINCT a.repo, a.ticket_id, t.team FROM ticket_assets a JOIN ab_tickets t ON t.id = a.ticket_id`
+    for (const asset of assets) {
+      if (assignments.get(asset.team) !== asset.repo)
+        throw new Error(
+          `Ticket migration: asset ownership mismatch for ${asset.ticket_id}, team ${asset.team}, project ${asset.repo}`,
+        )
+    }
+    // Reject collapsing distinct old teams onto a duplicate project id/key.
+    const tickets: { team: string; id: string; creation_key: string | null }[] =
+      await sql`SELECT team, id, creation_key FROM ab_tickets`
+    const ids = new Set<string>(),
+      keys = new Set<string>()
+    for (const ticket of tickets) {
+      const repo = assignments.get(ticket.team)!
+      const id = JSON.stringify([repo, ticket.id]),
+        key = JSON.stringify([repo, ticket.creation_key])
+      if (ids.has(id) || (ticket.creation_key !== null && keys.has(key)))
+        throw new Error(`Ticket migration: colliding ticket id or creation key in ${repo}`)
+      ids.add(id)
+      if (ticket.creation_key !== null) keys.add(key)
+    }
+  }
+  // Drop FKs during the all-at-once partition rewrite; PKs/unique indexes stay
+  // live. Temporary values avoid collisions with legacy team strings.
+  await sql.unsafe(`ALTER TABLE ab_ticket_comments DROP CONSTRAINT ab_ticket_comments_team_ticket_id_fkey;
+    ALTER TABLE ab_ticket_blockers DROP CONSTRAINT ab_ticket_blockers_team_ticket_id_fkey;
+    ALTER TABLE ab_ticket_blockers DROP CONSTRAINT ab_ticket_blockers_team_blocker_id_fkey;`)
+  const staged = [...assignments].map(([team, repo]) => ({
+    team,
+    repo,
+    temporary: `migration-${crypto.randomUUID()}`,
+  }))
+  for (const item of staged) {
+    await sql`UPDATE ab_tickets SET team = ${item.temporary} WHERE team = ${item.team}`
+    await sql`UPDATE ab_ticket_comments SET team = ${item.temporary} WHERE team = ${item.team}`
+    await sql`UPDATE ab_ticket_blockers SET team = ${item.temporary} WHERE team = ${item.team}`
+  }
+  for (const item of staged) {
+    await sql`UPDATE ab_tickets SET team = ${item.repo} WHERE team = ${item.temporary}`
+    await sql`UPDATE ab_ticket_comments SET team = ${item.repo} WHERE team = ${item.temporary}`
+    await sql`UPDATE ab_ticket_blockers SET team = ${item.repo} WHERE team = ${item.temporary}`
+  }
+  await sql.unsafe(`ALTER TABLE ab_tickets RENAME COLUMN team TO repo;
+    ALTER TABLE ab_ticket_comments RENAME COLUMN team TO repo;
+    ALTER TABLE ab_ticket_blockers RENAME COLUMN team TO repo;
+    ALTER TABLE ab_ticket_comments ADD FOREIGN KEY (repo,ticket_id) REFERENCES ab_tickets(repo,id) ON DELETE CASCADE;
+    ALTER TABLE ab_ticket_blockers ADD FOREIGN KEY (repo,ticket_id) REFERENCES ab_tickets(repo,id) ON DELETE CASCADE;
+    ALTER TABLE ab_ticket_blockers ADD FOREIGN KEY (repo,blocker_id) REFERENCES ab_tickets(repo,id) ON DELETE CASCADE;`)
+}