@freema/drobek-modules 0.3.3

package/dist/migrations/core/0000_dusty_scarecrow.sql

@@ -0,0 +1,84 @@
+CREATE TYPE "public"."app_status" AS ENUM('live', 'hibernated');--> statement-breakpoint
+CREATE TYPE "public"."app_visibility" AS ENUM('public', 'team', 'password');--> statement-breakpoint
+CREATE TYPE "public"."membership_role" AS ENUM('workspace-admin', 'editor', 'viewer');--> statement-breakpoint
+CREATE TYPE "public"."routing_mode" AS ENUM('spa', 'exact');--> statement-breakpoint
+CREATE TYPE "public"."workspace_kind" AS ENUM('personal', 'team');--> statement-breakpoint
+CREATE TABLE "apps" (
+	"id" text PRIMARY KEY NOT NULL,
+	"workspace_id" text NOT NULL,
+	"slug" text NOT NULL,
+	"active_deploy_id" text,
+	"routing_mode" "routing_mode" DEFAULT 'spa' NOT NULL,
+	"visibility" "app_visibility" DEFAULT 'public' NOT NULL,
+	"password_hash" text,
+	"status" "app_status" DEFAULT 'live' NOT NULL,
+	"uses_end_user_auth" boolean DEFAULT false NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"deleted_at" timestamp
+);
+--> statement-breakpoint
+CREATE TABLE "blob_refs" (
+	"sha256" text NOT NULL,
+	"deploy_id" text NOT NULL,
+	CONSTRAINT "blob_refs_sha256_deploy_id_pk" PRIMARY KEY("sha256","deploy_id")
+);
+--> statement-breakpoint
+CREATE TABLE "blobs" (
+	"sha256" text PRIMARY KEY NOT NULL,
+	"content_type" text NOT NULL,
+	"size" bigint NOT NULL,
+	"path" text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "deploy_files" (
+	"deploy_id" text NOT NULL,
+	"path" text NOT NULL,
+	"sha256" text NOT NULL,
+	CONSTRAINT "deploy_files_deploy_id_path_pk" PRIMARY KEY("deploy_id","path")
+);
+--> statement-breakpoint
+CREATE TABLE "deploys" (
+	"id" text PRIMARY KEY NOT NULL,
+	"app_id" text NOT NULL,
+	"manifest" jsonb NOT NULL,
+	"lint_report" jsonb,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"deleted_at" timestamp
+);
+--> statement-breakpoint
+CREATE TABLE "memberships" (
+	"user_id" text NOT NULL,
+	"workspace_id" text NOT NULL,
+	"role" "membership_role" NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "memberships_user_id_workspace_id_pk" PRIMARY KEY("user_id","workspace_id")
+);
+--> statement-breakpoint
+CREATE TABLE "users" (
+	"id" text PRIMARY KEY NOT NULL,
+	"email" text NOT NULL,
+	"google_sub" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "users_email_unique" UNIQUE("email"),
+	CONSTRAINT "users_google_sub_unique" UNIQUE("google_sub")
+);
+--> statement-breakpoint
+CREATE TABLE "workspaces" (
+	"id" text PRIMARY KEY NOT NULL,
+	"kind" "workspace_kind" NOT NULL,
+	"slug" text NOT NULL,
+	"name" text NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "workspaces_slug_unique" UNIQUE("slug")
+);
+--> statement-breakpoint
+ALTER TABLE "apps" ADD CONSTRAINT "apps_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "apps" ADD CONSTRAINT "apps_active_deploy_id_deploys_id_fk" FOREIGN KEY ("active_deploy_id") REFERENCES "public"."deploys"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "blob_refs" ADD CONSTRAINT "blob_refs_sha256_blobs_sha256_fk" FOREIGN KEY ("sha256") REFERENCES "public"."blobs"("sha256") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "blob_refs" ADD CONSTRAINT "blob_refs_deploy_id_deploys_id_fk" FOREIGN KEY ("deploy_id") REFERENCES "public"."deploys"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "deploy_files" ADD CONSTRAINT "deploy_files_deploy_id_deploys_id_fk" FOREIGN KEY ("deploy_id") REFERENCES "public"."deploys"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "deploy_files" ADD CONSTRAINT "deploy_files_sha256_blobs_sha256_fk" FOREIGN KEY ("sha256") REFERENCES "public"."blobs"("sha256") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "deploys" ADD CONSTRAINT "deploys_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "memberships" ADD CONSTRAINT "memberships_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "memberships" ADD CONSTRAINT "memberships_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "apps_workspace_slug_uq" ON "apps" USING btree ("workspace_id","slug");

package/dist/migrations/core/0001_busy_orphan.sql

@@ -0,0 +1,69 @@
+CREATE TABLE "oauth_access_tokens" (
+	"id" text PRIMARY KEY NOT NULL,
+	"token_hash" text NOT NULL,
+	"user_id" text NOT NULL,
+	"workspace_id" text NOT NULL,
+	"role" "membership_role" NOT NULL,
+	"oauth_client_id" text,
+	"scope" text NOT NULL,
+	"audience" text NOT NULL,
+	"expires_at" timestamp NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"revoked_at" timestamp,
+	CONSTRAINT "oauth_access_tokens_token_hash_unique" UNIQUE("token_hash")
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_authorization_codes" (
+	"id" text PRIMARY KEY NOT NULL,
+	"code_hash" text NOT NULL,
+	"client_id" text NOT NULL,
+	"user_id" text NOT NULL,
+	"workspace_id" text NOT NULL,
+	"role" "membership_role" NOT NULL,
+	"redirect_uri" text NOT NULL,
+	"code_challenge" text NOT NULL,
+	"code_challenge_method" text NOT NULL,
+	"scope" text NOT NULL,
+	"resource" text NOT NULL,
+	"used" boolean DEFAULT false NOT NULL,
+	"expires_at" timestamp NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "oauth_authorization_codes_code_hash_unique" UNIQUE("code_hash")
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_clients" (
+	"id" text PRIMARY KEY NOT NULL,
+	"client_id" text NOT NULL,
+	"client_name" text NOT NULL,
+	"redirect_uris" text[] NOT NULL,
+	"token_endpoint_auth_method" text DEFAULT 'none' NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "oauth_clients_client_id_unique" UNIQUE("client_id")
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_refresh_tokens" (
+	"id" text PRIMARY KEY NOT NULL,
+	"token_hash" text NOT NULL,
+	"user_id" text NOT NULL,
+	"workspace_id" text NOT NULL,
+	"role" "membership_role" NOT NULL,
+	"oauth_client_id" text,
+	"scope" text NOT NULL,
+	"audience" text NOT NULL,
+	"rotated_to" text,
+	"used_at" timestamp,
+	"expires_at" timestamp NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "oauth_refresh_tokens_token_hash_unique" UNIQUE("token_hash")
+);
+--> statement-breakpoint
+ALTER TABLE "oauth_access_tokens" ADD CONSTRAINT "oauth_access_tokens_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_access_tokens" ADD CONSTRAINT "oauth_access_tokens_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_access_tokens" ADD CONSTRAINT "oauth_access_tokens_oauth_client_id_oauth_clients_id_fk" FOREIGN KEY ("oauth_client_id") REFERENCES "public"."oauth_clients"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_authorization_codes" ADD CONSTRAINT "oauth_authorization_codes_client_id_oauth_clients_client_id_fk" FOREIGN KEY ("client_id") REFERENCES "public"."oauth_clients"("client_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_authorization_codes" ADD CONSTRAINT "oauth_authorization_codes_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_authorization_codes" ADD CONSTRAINT "oauth_authorization_codes_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_refresh_tokens" ADD CONSTRAINT "oauth_refresh_tokens_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_refresh_tokens" ADD CONSTRAINT "oauth_refresh_tokens_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_refresh_tokens" ADD CONSTRAINT "oauth_refresh_tokens_oauth_client_id_oauth_clients_id_fk" FOREIGN KEY ("oauth_client_id") REFERENCES "public"."oauth_clients"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_refresh_tokens" ADD CONSTRAINT "oauth_refresh_tokens_rotated_to_oauth_refresh_tokens_id_fk" FOREIGN KEY ("rotated_to") REFERENCES "public"."oauth_refresh_tokens"("id") ON DELETE no action ON UPDATE no action;

package/dist/migrations/core/0002_odd_alex_power.sql

@@ -0,0 +1,17 @@
+CREATE TYPE "public"."deploy_state" AS ENUM('awaiting_upload', 'queued', 'linting', 'storing', 'activating', 'ready', 'failed');--> statement-breakpoint
+CREATE TABLE "audit_log" (
+	"id" text PRIMARY KEY NOT NULL,
+	"workspace_id" text NOT NULL,
+	"actor_user_id" text,
+	"action" text NOT NULL,
+	"target" text,
+	"meta" jsonb,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "deploys" ADD COLUMN "state" "deploy_state" DEFAULT 'awaiting_upload' NOT NULL;--> statement-breakpoint
+ALTER TABLE "deploys" ADD COLUMN "error" text;--> statement-breakpoint
+ALTER TABLE "deploys" ADD COLUMN "total_bytes" bigint;--> statement-breakpoint
+ALTER TABLE "deploys" ADD COLUMN "activated_at" timestamp;--> statement-breakpoint
+ALTER TABLE "audit_log" ADD CONSTRAINT "audit_log_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "audit_log" ADD CONSTRAINT "audit_log_actor_user_id_users_id_fk" FOREIGN KEY ("actor_user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;

package/dist/migrations/core/0003_nosy_shatterstar.sql

@@ -0,0 +1,26 @@
+CREATE TYPE "public"."collection_access_mode" AS ENUM('public-read', 'public-write', 'locked', 'owner-only');--> statement-breakpoint
+CREATE TABLE "app_documents" (
+	"id" text PRIMARY KEY NOT NULL,
+	"app_id" text NOT NULL,
+	"collection" text NOT NULL,
+	"owner_end_user_id" text,
+	"doc" jsonb NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	"deleted_at" timestamp
+);
+--> statement-breakpoint
+CREATE TABLE "collections" (
+	"id" text PRIMARY KEY NOT NULL,
+	"app_id" text NOT NULL,
+	"name" text NOT NULL,
+	"json_schema" jsonb NOT NULL,
+	"access_mode" "collection_access_mode" DEFAULT 'locked' NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "app_documents" ADD CONSTRAINT "app_documents_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "collections" ADD CONSTRAINT "collections_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "app_documents_app_collection_idx" ON "app_documents" USING btree ("app_id","collection");--> statement-breakpoint
+CREATE UNIQUE INDEX "collections_app_name_uq" ON "collections" USING btree ("app_id","name");

package/dist/migrations/core/0004_nice_ben_parker.sql

@@ -0,0 +1,27 @@
+CREATE TYPE "public"."app_error_type" AS ENUM('error', 'unhandledrejection');--> statement-breakpoint
+CREATE TABLE "app_daily_stats" (
+	"app_id" text NOT NULL,
+	"day" text NOT NULL,
+	"path_404_counts" jsonb DEFAULT '{}'::jsonb NOT NULL,
+	"count_5xx" integer DEFAULT 0 NOT NULL,
+	"request_count" integer DEFAULT 0 NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "app_daily_stats_app_id_day_pk" PRIMARY KEY("app_id","day")
+);
+--> statement-breakpoint
+CREATE TABLE "app_errors" (
+	"id" text PRIMARY KEY NOT NULL,
+	"app_id" text NOT NULL,
+	"type" "app_error_type" NOT NULL,
+	"message" text NOT NULL,
+	"stack" text,
+	"url" text NOT NULL,
+	"ua" text,
+	"ts" timestamp,
+	"dedup_key" text NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "app_daily_stats" ADD CONSTRAINT "app_daily_stats_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_errors" ADD CONSTRAINT "app_errors_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "app_errors_app_created_idx" ON "app_errors" USING btree ("app_id","created_at");

package/dist/migrations/core/0005_panoramic_bill_hollister.sql

@@ -0,0 +1,4 @@
+CREATE TYPE "public"."audit_actor_kind" AS ENUM('user', 'agent');--> statement-breakpoint
+ALTER TABLE "audit_log" ADD COLUMN "actor_kind" "audit_actor_kind" DEFAULT 'user' NOT NULL;--> statement-breakpoint
+ALTER TABLE "audit_log" ADD COLUMN "subject_type" text;--> statement-breakpoint
+CREATE INDEX "audit_log_workspace_created_idx" ON "audit_log" USING btree ("workspace_id","created_at");

package/dist/migrations/core/0006_outgoing_ricochet.sql

@@ -0,0 +1,29 @@
+CREATE TYPE "public"."upstream_auth_type" AS ENUM('none', 'bearer', 'header');--> statement-breakpoint
+CREATE TABLE "upstream_secrets" (
+	"upstream_id" text PRIMARY KEY NOT NULL,
+	"ciphertext" text NOT NULL,
+	"iv" text NOT NULL,
+	"auth_tag" text NOT NULL,
+	"wrapped_dek" text NOT NULL,
+	"kek_id" text NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "upstreams" (
+	"id" text PRIMARY KEY NOT NULL,
+	"workspace_id" text NOT NULL,
+	"name" text NOT NULL,
+	"base_url" text NOT NULL,
+	"allowed_methods" text[] NOT NULL,
+	"allowed_path_prefixes" text[] NOT NULL,
+	"auth_type" "upstream_auth_type" DEFAULT 'none' NOT NULL,
+	"auth_header_name" text,
+	"allowed_app_ids" text[] DEFAULT '{}' NOT NULL,
+	"created_by" text,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "upstream_secrets" ADD CONSTRAINT "upstream_secrets_upstream_id_upstreams_id_fk" FOREIGN KEY ("upstream_id") REFERENCES "public"."upstreams"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "upstreams" ADD CONSTRAINT "upstreams_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "upstreams" ADD CONSTRAINT "upstreams_created_by_users_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "upstreams_workspace_name_uq" ON "upstreams" USING btree ("workspace_id","name");

package/dist/migrations/core/0007_app_versions.sql

@@ -0,0 +1,95 @@
+-- M0-02 (NSO-281): immutable app versions replace the upload/deploy pipeline.
+--
+-- EXPLICIT, DESTRUCTIVE: the deploy pipeline tables are dropped and their
+-- history is NOT migrated (decided in the M0 plan). Apps, collections,
+-- documents, errors, stats, upstreams and the audit log are kept. Blob bytes
+-- move from the disk volume into Postgres (`blobs.bytes`); the old on-disk
+-- BLOB_DIR contents are no longer read by anything. See CHANGELOG.md.
+ALTER TABLE "apps" DROP CONSTRAINT "apps_active_deploy_id_deploys_id_fk";--> statement-breakpoint
+ALTER TABLE "apps" DROP COLUMN "active_deploy_id";--> statement-breakpoint
+ALTER TABLE "apps" DROP COLUMN "routing_mode";--> statement-breakpoint
+ALTER TABLE "apps" DROP COLUMN "uses_end_user_auth";--> statement-breakpoint
+DROP TABLE "blob_refs";--> statement-breakpoint
+DROP TABLE "deploy_files";--> statement-breakpoint
+DROP TABLE "deploys";--> statement-breakpoint
+DROP TABLE "blobs";--> statement-breakpoint
+DROP TYPE "public"."deploy_state";--> statement-breakpoint
+DROP TYPE "public"."routing_mode";--> statement-breakpoint
+DROP INDEX "apps_workspace_slug_uq";--> statement-breakpoint
+-- App slugs become GLOBALLY unique host labels (`<slug>.<APPS_DOMAIN>`):
+-- 3–40 chars of ^[a-z0-9]+(-[a-z0-9]+)*$, no reserved word. Existing slugs
+-- that break the grammar, are reserved, or collide with an OLDER app's slug
+-- in another workspace are renamed to `<base>-<4hex>` (deterministic from the
+-- app id; the oldest app keeps a contested slug).
+DO $$
+DECLARE
+  r record;
+  base text;
+  candidate text;
+  attempt int;
+BEGIN
+  FOR r IN
+    SELECT id, slug FROM (
+      SELECT id, slug,
+             row_number() OVER (PARTITION BY slug ORDER BY created_at, id) AS rank
+      FROM apps
+    ) ranked
+    WHERE rank > 1
+       OR slug !~ '^[a-z0-9]+(-[a-z0-9]+)*$'
+       OR char_length(slug) NOT BETWEEN 3 AND 40
+       OR slug IN ('www', 'api', 'mcp', 'preview', 'admin', 'mail', 'static', 'app', 'auth', 'oauth')
+    ORDER BY id
+  LOOP
+    base := trim(both '-' from regexp_replace(lower(r.slug), '[^a-z0-9]+', '-', 'g'));
+    base := trim(trailing '-' from left(base, 35));
+    IF base = '' THEN base := 'app'; END IF;
+    attempt := 0;
+    LOOP
+      candidate := base || '-' || substr(md5(r.id || attempt::text), 1, 4);
+      EXIT WHEN NOT EXISTS (SELECT 1 FROM apps WHERE slug = candidate);
+      attempt := attempt + 1;
+    END LOOP;
+    UPDATE apps SET slug = candidate WHERE id = r.id;
+  END LOOP;
+END $$;--> statement-breakpoint
+CREATE TYPE "public"."compile_status" AS ENUM('pending', 'ok', 'error');--> statement-breakpoint
+CREATE TYPE "public"."version_file_kind" AS ENUM('source', 'built');--> statement-breakpoint
+CREATE TABLE "blobs" (
+	"sha256" text PRIMARY KEY NOT NULL,
+	"bytes" "bytea" NOT NULL,
+	"size" integer NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "app_versions" (
+	"id" text PRIMARY KEY NOT NULL,
+	"app_id" text NOT NULL,
+	"number" integer NOT NULL,
+	"created_by_user_id" text,
+	"actor_kind" "audit_actor_kind" NOT NULL,
+	"reasoning" text,
+	"compile_status" "compile_status" DEFAULT 'pending' NOT NULL,
+	"compile_errors" jsonb,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "version_files" (
+	"version_id" text NOT NULL,
+	"path" text NOT NULL,
+	"sha256" text NOT NULL,
+	"size" integer NOT NULL,
+	"kind" "version_file_kind" NOT NULL,
+	CONSTRAINT "version_files_version_id_kind_path_pk" PRIMARY KEY("version_id","kind","path")
+);
+--> statement-breakpoint
+ALTER TABLE "apps" ADD COLUMN "published_version_id" text;--> statement-breakpoint
+ALTER TABLE "app_versions" ADD CONSTRAINT "app_versions_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_versions" ADD CONSTRAINT "app_versions_created_by_user_id_users_id_fk" FOREIGN KEY ("created_by_user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "apps" ADD CONSTRAINT "apps_published_version_id_app_versions_id_fk" FOREIGN KEY ("published_version_id") REFERENCES "public"."app_versions"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "version_files" ADD CONSTRAINT "version_files_version_id_app_versions_id_fk" FOREIGN KEY ("version_id") REFERENCES "public"."app_versions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "version_files" ADD CONSTRAINT "version_files_sha256_blobs_sha256_fk" FOREIGN KEY ("sha256") REFERENCES "public"."blobs"("sha256") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "app_versions_app_number_uq" ON "app_versions" USING btree ("app_id","number");--> statement-breakpoint
+CREATE UNIQUE INDEX "apps_slug_uq" ON "apps" USING btree ("slug");--> statement-breakpoint
+CREATE INDEX "apps_workspace_idx" ON "apps" USING btree ("workspace_id");--> statement-breakpoint
+CREATE INDEX "version_files_sha256_idx" ON "version_files" USING btree ("sha256");--> statement-breakpoint
+ALTER TABLE "apps" ADD CONSTRAINT "apps_slug_format" CHECK ("apps"."slug" ~ '^[a-z0-9]+(-[a-z0-9]+)*$' AND char_length("apps"."slug") BETWEEN 3 AND 40);

package/dist/migrations/core/0008_user_bound_tokens.sql

@@ -0,0 +1,42 @@
+-- M0-04 (NSO-282): OAuth tokens become USER-bound; API keys; CIMD/DCR client
+-- bookkeeping.
+--
+-- EXPLICIT, DESTRUCTIVE: every authorization code, access token and refresh
+-- token is deleted — they were bound to one workspace + role and used the old
+-- scope vocabulary (mcp:whoami, apps:read, deploy:write, data:read,
+-- data:write), which nothing accepts any more. Connected agents simply
+-- reconnect (new consent → read / write / publish). Registered clients are
+-- kept; the ones that ever held a grant are stamped as used so they do not
+-- count toward the unused-DCR-client cap. See CHANGELOG.md.
+ALTER TABLE "oauth_clients" ADD COLUMN "source" text DEFAULT 'dcr' NOT NULL;--> statement-breakpoint
+ALTER TABLE "oauth_clients" ADD COLUMN "last_used_at" timestamp;--> statement-breakpoint
+UPDATE "oauth_clients" c SET "last_used_at" = c."created_at"
+ WHERE EXISTS (SELECT 1 FROM "oauth_authorization_codes" a WHERE a."client_id" = c."client_id")
+    OR EXISTS (SELECT 1 FROM "oauth_access_tokens" t WHERE t."oauth_client_id" = c."id")
+    OR EXISTS (SELECT 1 FROM "oauth_refresh_tokens" r WHERE r."oauth_client_id" = c."id");--> statement-breakpoint
+TRUNCATE TABLE "oauth_authorization_codes", "oauth_access_tokens", "oauth_refresh_tokens";--> statement-breakpoint
+CREATE TABLE "api_keys" (
+	"id" text PRIMARY KEY NOT NULL,
+	"user_id" text NOT NULL,
+	"name" text NOT NULL,
+	"key_hash" text NOT NULL,
+	"scopes" text NOT NULL,
+	"last_used_at" timestamp,
+	"revoked_at" timestamp,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "api_keys_key_hash_unique" UNIQUE("key_hash")
+);
+--> statement-breakpoint
+ALTER TABLE "oauth_access_tokens" DROP CONSTRAINT "oauth_access_tokens_workspace_id_workspaces_id_fk";
+--> statement-breakpoint
+ALTER TABLE "oauth_authorization_codes" DROP CONSTRAINT "oauth_authorization_codes_workspace_id_workspaces_id_fk";
+--> statement-breakpoint
+ALTER TABLE "oauth_refresh_tokens" DROP CONSTRAINT "oauth_refresh_tokens_workspace_id_workspaces_id_fk";
+--> statement-breakpoint
+ALTER TABLE "api_keys" ADD CONSTRAINT "api_keys_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_access_tokens" DROP COLUMN "workspace_id";--> statement-breakpoint
+ALTER TABLE "oauth_access_tokens" DROP COLUMN "role";--> statement-breakpoint
+ALTER TABLE "oauth_authorization_codes" DROP COLUMN "workspace_id";--> statement-breakpoint
+ALTER TABLE "oauth_authorization_codes" DROP COLUMN "role";--> statement-breakpoint
+ALTER TABLE "oauth_refresh_tokens" DROP COLUMN "workspace_id";--> statement-breakpoint
+ALTER TABLE "oauth_refresh_tokens" DROP COLUMN "role";

package/dist/migrations/core/0009_app_name.sql

@@ -0,0 +1 @@
+ALTER TABLE "apps" ADD COLUMN "name" text;

package/dist/migrations/core/0010_apps_origin.sql

@@ -0,0 +1,12 @@
+-- M0-06 (NSO-285): apps origin. Generated by drizzle-kit, then hand-edited:
+-- the `team` visibility cannot be enforced on an app host (app hosts never read
+-- the dashboard session), so existing `team` apps become `password` apps —
+-- fail closed: with no password set nobody passes the gate until the owner sets one.
+ALTER TABLE "apps" ALTER COLUMN "visibility" SET DATA TYPE text;--> statement-breakpoint
+UPDATE "apps" SET "visibility" = 'password' WHERE "visibility" = 'team';--> statement-breakpoint
+ALTER TABLE "apps" ALTER COLUMN "visibility" SET DEFAULT 'public'::text;--> statement-breakpoint
+DROP TYPE "public"."app_visibility";--> statement-breakpoint
+CREATE TYPE "public"."app_visibility" AS ENUM('public', 'password');--> statement-breakpoint
+ALTER TABLE "apps" ALTER COLUMN "visibility" SET DEFAULT 'public'::"public"."app_visibility";--> statement-breakpoint
+ALTER TABLE "apps" ALTER COLUMN "visibility" SET DATA TYPE "public"."app_visibility" USING "visibility"::"public"."app_visibility";--> statement-breakpoint
+ALTER TABLE "apps" ADD COLUMN "frame_ancestors" text;

package/dist/migrations/core/0011_modules.sql

@@ -0,0 +1,32 @@
+-- M1-01 (NSO-287): platform modules. Generated by drizzle-kit. module_configs =
+-- per-app module configuration (+ one pending change awaiting the owner's
+-- confirmation); module_secrets = envelope-encrypted per-app module secrets
+-- (dashboard-only writes, never returned by any API). audit_actor_kind gains
+-- 'end_user' for module actions of an app's signed-in end users (ADD VALUE is
+-- fine inside the migration transaction on PG 12+: nothing uses it in-txn).
+ALTER TYPE "public"."audit_actor_kind" ADD VALUE 'end_user';--> statement-breakpoint
+CREATE TABLE "module_configs" (
+	"app_id" text NOT NULL,
+	"module" text NOT NULL,
+	"config" jsonb DEFAULT '{}'::jsonb NOT NULL,
+	"pending" jsonb,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "module_configs_app_id_module_pk" PRIMARY KEY("app_id","module")
+);
+--> statement-breakpoint
+CREATE TABLE "module_secrets" (
+	"app_id" text NOT NULL,
+	"module" text NOT NULL,
+	"name" text NOT NULL,
+	"ciphertext" text NOT NULL,
+	"iv" text NOT NULL,
+	"auth_tag" text NOT NULL,
+	"wrapped_dek" text NOT NULL,
+	"kek_id" text NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "module_secrets_app_id_module_name_pk" PRIMARY KEY("app_id","module","name")
+);
+--> statement-breakpoint
+ALTER TABLE "module_configs" ADD CONSTRAINT "module_configs_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "module_secrets" ADD CONSTRAINT "module_secrets_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;

package/dist/migrations/core/0012_data_module_tables.sql

@@ -0,0 +1,9 @@
+-- NSO-300 (M1-03): the pre-module Data API tables `collections`,
+-- `app_documents` and the enum `collection_access_mode` now belong to the
+-- platform module `data` (modules/data, drobek-module-data). Its first
+-- migration (journal __drizzle_migrations_mod_data) imports every collection
+-- into the app's `module_configs` row (access_mode → per-operation rules) and
+-- every live document into `mod_data_documents`, then drops the old tables.
+-- Core only forgets them here, so a server without the data module never
+-- loses the stored records.
+SELECT 1;

package/dist/migrations/core/0014_get_logs.sql

@@ -0,0 +1,26 @@
+-- NSO-290 (M1-07): get_logs — the compile history (app_compiles) and the
+-- per-module request counters (module_request_stats). Additive only.
+CREATE TABLE "app_compiles" (
+	"id" text PRIMARY KEY NOT NULL,
+	"app_id" text NOT NULL,
+	"version_number" integer,
+	"ok" boolean NOT NULL,
+	"errors" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"warning_count" integer DEFAULT 0 NOT NULL,
+	"duration_ms" integer DEFAULT 0 NOT NULL,
+	"trigger" text NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "module_request_stats" (
+	"app_id" text NOT NULL,
+	"module" text NOT NULL,
+	"status_class" text NOT NULL,
+	"day" text NOT NULL,
+	"count" integer DEFAULT 0 NOT NULL,
+	CONSTRAINT "module_request_stats_app_id_module_status_class_day_pk" PRIMARY KEY("app_id","module","status_class","day")
+);
+--> statement-breakpoint
+ALTER TABLE "app_compiles" ADD CONSTRAINT "app_compiles_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "module_request_stats" ADD CONSTRAINT "module_request_stats_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "app_compiles_app_created_idx" ON "app_compiles" USING btree ("app_id","created_at");

package/dist/migrations/core/0016_apps_slug_release.sql

@@ -0,0 +1,8 @@
+-- NSO-288 (M2-01): dashboard app delete. A soft-deleted app keeps its slug for
+-- 30 days; then @drobek/apps (releaseDeletedAppSlugs) renames it to the
+-- tombstone `<slug>~deleted-<id>` so a new app can take the slug. The slug
+-- CHECK admits that tombstone on deleted rows only; the partial index serves
+-- the release sweep. Additive for live rows (their grammar is unchanged).
+ALTER TABLE "apps" DROP CONSTRAINT "apps_slug_format";--> statement-breakpoint
+CREATE INDEX "apps_deleted_at_idx" ON "apps" USING btree ("deleted_at") WHERE "apps"."deleted_at" IS NOT NULL;--> statement-breakpoint
+ALTER TABLE "apps" ADD CONSTRAINT "apps_slug_format" CHECK (("apps"."slug" ~ '^[a-z0-9]+(-[a-z0-9]+)*$' AND char_length("apps"."slug") BETWEEN 3 AND 40) OR ("apps"."deleted_at" IS NOT NULL AND "apps"."slug" ~ '^[a-z0-9]+(-[a-z0-9]+)*~deleted-[a-z0-9]+$'));

package/dist/migrations/core/0018_custom_domains.sql

@@ -0,0 +1,22 @@
+-- NSO-292 (M3-01): custom domains. Generated by drizzle-kit. Additive only.
+-- Partial unique indexes: one VERIFIED row per hostname instance-wide (an
+-- unverified claim never blocks the domain's real owner) and at most one
+-- primary (redirect target) domain per app.
+CREATE TABLE "domains" (
+	"id" text PRIMARY KEY NOT NULL,
+	"app_id" text NOT NULL,
+	"hostname" text NOT NULL,
+	"verification_token" text NOT NULL,
+	"verified_at" timestamp,
+	"last_check_at" timestamp,
+	"last_error" text,
+	"cert_state" text DEFAULT 'none' NOT NULL,
+	"is_primary" boolean DEFAULT false NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "domains" ADD CONSTRAINT "domains_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "domains_app_hostname_uq" ON "domains" USING btree ("app_id","hostname");--> statement-breakpoint
+CREATE UNIQUE INDEX "domains_verified_hostname_uq" ON "domains" USING btree ("hostname") WHERE "domains"."verified_at" IS NOT NULL;--> statement-breakpoint
+CREATE UNIQUE INDEX "domains_primary_uq" ON "domains" USING btree ("app_id") WHERE "domains"."is_primary";--> statement-breakpoint
+CREATE INDEX "domains_hostname_idx" ON "domains" USING btree ("hostname");

package/dist/migrations/core/0021_abuse_reports.sql

@@ -0,0 +1,23 @@
+-- NSO-293 (M4-02): abuse and moderation — the abuse_reports queue (public
+-- report form + publish heuristic flags) and apps.locked_reason (super-admin
+-- takedown). Additive only.
+CREATE TYPE "public"."abuse_report_status" AS ENUM('open', 'resolved');--> statement-breakpoint
+CREATE TABLE "abuse_reports" (
+	"id" text PRIMARY KEY NOT NULL,
+	"app_id" text,
+	"host" text NOT NULL,
+	"reason" text NOT NULL,
+	"details" text DEFAULT '' NOT NULL,
+	"reporter_email" text,
+	"ip_hash" text,
+	"status" "abuse_report_status" DEFAULT 'open' NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"resolved_at" timestamp,
+	"resolved_by" text
+);
+--> statement-breakpoint
+ALTER TABLE "apps" ADD COLUMN "locked_reason" text;--> statement-breakpoint
+ALTER TABLE "abuse_reports" ADD CONSTRAINT "abuse_reports_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "abuse_reports" ADD CONSTRAINT "abuse_reports_resolved_by_users_id_fk" FOREIGN KEY ("resolved_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "abuse_reports_status_created_idx" ON "abuse_reports" USING btree ("status","created_at");--> statement-breakpoint
+CREATE INDEX "abuse_reports_app_idx" ON "abuse_reports" USING btree ("app_id");

package/dist/migrations/core/0022_gallery.sql

@@ -0,0 +1,20 @@
+-- NSO-340: the public gallery. Generated by drizzle-kit, then the backfill
+-- was added by hand. Additive only.
+-- apps.published_at = when the production host last started serving a
+-- version (publish sets it, unpublish / takedown clear it); backfilled from
+-- the newest `app.publish` audit row, else the published version's creation.
+-- Millisecond precision (the gallery cursor round-trips it through JS Date).
+-- gallery_listed / gallery_description = the owner's opt-in (dashboard);
+-- gallery_hidden_at = a super-admin hid the entry.
+ALTER TABLE "apps" ADD COLUMN "published_at" timestamp;--> statement-breakpoint
+ALTER TABLE "apps" ADD COLUMN "gallery_listed" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "apps" ADD COLUMN "gallery_description" text;--> statement-breakpoint
+ALTER TABLE "apps" ADD COLUMN "gallery_hidden_at" timestamp;--> statement-breakpoint
+CREATE INDEX "apps_gallery_idx" ON "apps" USING btree ("published_at" DESC NULLS LAST,"slug" DESC NULLS LAST) WHERE "apps"."gallery_listed";--> statement-breakpoint
+UPDATE "apps" AS a SET "published_at" = date_trunc('milliseconds', COALESCE(
+	(SELECT max(l."created_at") FROM "audit_log" l
+		WHERE l."workspace_id" = a."workspace_id" AND l."subject_type" = 'app'
+			AND l."target" = a."slug" AND l."action" = 'app.publish'),
+	(SELECT v."created_at" FROM "app_versions" v WHERE v."id" = a."published_version_id"),
+	now()
+)) WHERE a."published_version_id" IS NOT NULL;

package/dist/migrations/core/0023_workspace_modules.sql

@@ -0,0 +1,13 @@
+-- NSO-346: opt-in platform modules a super-admin enabled per workspace
+-- (dashboard). Generated by drizzle-kit. Additive only. A default module never
+-- has a row; the limits provider's MODULE_ENABLED_<NAME> overrides a row.
+CREATE TABLE "workspace_modules" (
+	"workspace_id" text NOT NULL,
+	"module" text NOT NULL,
+	"enabled_by" text,
+	"enabled_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "workspace_modules_workspace_id_module_pk" PRIMARY KEY("workspace_id","module")
+);
+--> statement-breakpoint
+ALTER TABLE "workspace_modules" ADD CONSTRAINT "workspace_modules_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "workspace_modules" ADD CONSTRAINT "workspace_modules_enabled_by_users_id_fk" FOREIGN KEY ("enabled_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;

package/dist/migrations/core/0024_app_assets.sql

@@ -0,0 +1,18 @@
+-- NSO-358: app assets — binary files (images, video, audio, fonts) an app
+-- serves at /assets/<name>; the bytes live on disk under ASSETS_DIR, the rows
+-- here. Additive only.
+CREATE TABLE "app_assets" (
+	"app_id" text NOT NULL,
+	"name" text NOT NULL,
+	"content_type" text NOT NULL,
+	"size" bigint NOT NULL,
+	"sha256" text NOT NULL,
+	"storage_key" text NOT NULL,
+	"created_by_user_id" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "app_assets_app_id_name_pk" PRIMARY KEY("app_id","name")
+);
+--> statement-breakpoint
+ALTER TABLE "app_assets" ADD CONSTRAINT "app_assets_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "app_assets" ADD CONSTRAINT "app_assets_created_by_user_id_users_id_fk" FOREIGN KEY ("created_by_user_id") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;