@heychunky/core 0.14.0 → 0.15.0

package/dist/admin/register.js

@@ -0,0 +1,191 @@
+/**
+ * The register's own schema, kept the way an app's is.
+ *
+ * `.heychunky/migrations` is how an app's database changes, and the register —
+ * the database holding who exists and what they own — had no equivalent. Its
+ * tables were typed into a psql session and existed in no file anywhere, which
+ * is `core#7`: the factory held customer apps to a standard it did not hold
+ * itself to.
+ *
+ * So the register gets the same mechanism rather than a second one. The same
+ * ledger table, the same one-statement-per-file rule, the same "the repository
+ * says what exists, the database says what ran". What differs is only where the
+ * files come from:
+ *
+ *   an app       its own repository, read at a ref, because the file rides the
+ *                branch and that is what makes "what does staging still owe"
+ *                answerable
+ *   the register this package, read from disk, because the register has one
+ *                database and no ladder to climb — the schema it should have
+ *                is the schema the installed Core ships
+ *
+ * That second property is worth saying out loud: `heychunky` pins a Core
+ * version, so the register schema a machine can apply is the one its CLI was
+ * built against. There is no way to apply an unreviewed local edit to the
+ * factory's live register by accident.
+ *
+ * A change is a directory, its statements numbered inside it:
+ *
+ *   register/0001-baseline/07-users.sql
+ *   register/0002-orgs/01-orgs.sql
+ *
+ * Sorted lexically, which is why both numbers pad. The directory is part of
+ * the ledger id, so the whole of a change is legible in `_heychunky_migrations`
+ * rather than twenty-two filenames that have to be mentally regrouped.
+ */
+import { readdir, readFile } from "node:fs/promises";
+import { adopt, applied, apply, isDestructive, pending } from "./migrations.js";
+/**
+ * Where the register's migrations live.
+ *
+ * Relative to this module, which resolves the same from `src/admin/` in the
+ * repository and `dist/admin/` in the published package — both are one level
+ * under the package root. Listed in `files` so the directory ships; a Core
+ * that could not stand up a register would be a Core that describes one.
+ */
+const DIR = new URL("../../register/", import.meta.url);
+/** The name of the change a statement belongs to — its directory. */
+export const changeOf = (id) => id.split("/")[0] ?? id;
+/**
+ * Every statement the register's schema is made of, in order.
+ *
+ * Read rather than declared, so the SQL lives in `.sql` files somebody can
+ * review as SQL. A directory with no `.sql` in it is not an error — it is a
+ * change whose files have not been written yet, and an empty answer is the
+ * honest one.
+ */
+export async function registerMigrations() {
+    const changes = (await readdir(DIR, { withFileTypes: true }))
+        .filter((e) => e.isDirectory())
+        .map((e) => e.name)
+        .sort();
+    const all = [];
+    for (const change of changes) {
+        const files = (await readdir(new URL(`${change}/`, DIR)))
+            .filter((f) => f.endsWith(".sql"))
+            .sort();
+        for (const file of files) {
+            const id = `${change}/${file}`;
+            all.push({ id, sql: (await readFile(new URL(id, DIR), "utf8")).trim() });
+        }
+    }
+    return all;
+}
+/**
+ * What this register has had, and what it still owes.
+ *
+ * Asks without creating: a register that has never been migrated has no ledger
+ * table, and `applied` reads that as "none" rather than making one. This is the
+ * call an unconfirmed plan makes, and a plan that wrote to the database would
+ * not be a plan.
+ */
+export async function registerState(register) {
+    const all = await registerMigrations();
+    const had = await applied(register);
+    const owed = pending(all, had);
+    return { all, had, owed, destructive: owed.filter((m) => isDestructive(m.sql)) };
+}
+/** A migration that would alter or discard, without the separate opt-in. */
+export class DestructiveMigrationError extends Error {
+    migrations;
+    constructor(migrations) {
+        super(`${migrations.length} statement${migrations.length === 1 ? "" : "s"} would alter or ` +
+            `discard what the register already holds: ${migrations.map((m) => m.id).join(", ")}. ` +
+            `That needs its own opt-in, not only a confirmation.`);
+        this.name = "DestructiveMigrationError";
+        this.migrations = migrations;
+    }
+}
+/**
+ * Bring the register up to what this Core describes.
+ *
+ * The destructive guard is the same distinction `promote` draws and for the
+ * same reason: confirming says "yes, run these"; accepting destruction says
+ * "yes, to a dropped column on the database that knows who everybody is". One
+ * yes covering both hides the one that cannot be undone by redeploying.
+ */
+export async function migrateRegister(register, opts = {}, watch) {
+    const { owed, destructive } = await registerState(register);
+    if (destructive.length && !opts.acceptDestructive) {
+        throw new DestructiveMigrationError(destructive);
+    }
+    const ran = await apply(register, owed, watch);
+    return { ran, migrations: owed };
+}
+/**
+ * The relation a `create` statement makes.
+ *
+ * Only the two forms the register's schema is written in, and undefined for
+ * anything else — which is the point. A statement whose effect cannot be named
+ * cannot be checked, and `adoptChange` refuses rather than guessing.
+ */
+export function relationOf(sql) {
+    const head = sql.replace(/^\s*(--[^\n]*\n|\/\*[\s\S]*?\*\/)*\s*/, "");
+    const table = /^create\s+table\s+(?:if\s+not\s+exists\s+)?(?:public\.)?"?([a-z_][a-z0-9_]*)"?/i
+        .exec(head);
+    if (table)
+        return { kind: "table", name: table[1].toLowerCase() };
+    const index = /^create\s+(?:unique\s+)?index\s+(?:concurrently\s+)?(?:if\s+not\s+exists\s+)?"?([a-z_][a-z0-9_]*)"?/i
+        .exec(head);
+    if (index)
+        return { kind: "index", name: index[1].toLowerCase() };
+    return undefined;
+}
+/** Refused because the register does not hold what it was asked to vouch for. */
+export class MissingFromRegisterError extends Error {
+    missing;
+    constructor(change, missing) {
+        super(`${change} describes ${missing.length} thing${missing.length === 1 ? "" : "s"} this ` +
+            `register does not have: ${missing.map((m) => `${m.relation} (${m.id})`).join(", ")}. ` +
+            `Adopting would record them as applied when they are not.`);
+        this.name = "MissingFromRegisterError";
+        this.missing = missing;
+    }
+}
+/**
+ * Record one change as applied, having run none of it.
+ *
+ * The register predates its own ledger, so `0001-baseline` describes tables
+ * that have been there for months. Running it would fail on the first `create
+ * table`; skipping it would leave every later change looking like it depends on
+ * something that never happened. Recording it is the truth: those statements
+ * are already true of this database.
+ *
+ * **Checked rather than trusted.** The failure this command can cause is
+ * invisible — a false receipt, and then a schema change silently skipped
+ * forever after — so every statement's relation is looked up in the catalog
+ * first, and a change that is not entirely true of this register is refused
+ * with the missing pieces named. That matters most where databases have
+ * drifted: the factory's production register has a `runs` table and its dev one
+ * does not, and the honest answer there is "apply that one, adopt the rest"
+ * rather than a receipt covering both.
+ *
+ * Named rather than inferred. "Mark everything pending as done" would be a
+ * command that quietly swallows a real migration somebody meant to run — so a
+ * caller has to say which change it means, and mean it. A full statement id is
+ * accepted as well as a change name, which is how the operator resolves drift.
+ */
+export async function adoptChange(register, change) {
+    const all = await registerMigrations();
+    const mine = all.filter((m) => changeOf(m.id) === change || m.id === change);
+    if (!mine.length) {
+        throw new Error(`No change "${change}" in this Core. There is ` +
+            `${[...new Set(all.map((m) => changeOf(m.id)))].join(", ")}.`);
+    }
+    const missing = [];
+    for (const m of mine) {
+        const relation = relationOf(m.sql);
+        if (!relation) {
+            throw new Error(`${m.id} does not create a table or an index, so there is no way to check it is ` +
+                `already true of this register. Apply it rather than adopting it.`);
+        }
+        const { rows } = await register.query(`select 1 from pg_class c join pg_namespace n on n.oid = c.relnamespace
+        where n.nspname = 'public' and c.relname = $1`, [relation.name]);
+        if (!rows.length)
+            missing.push({ id: m.id, relation: relation.name });
+    }
+    if (missing.length)
+        throw new MissingFromRegisterError(change, missing);
+    return adopt(register, mine);
+}
+//# sourceMappingURL=register.js.map

package/dist/admin/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/admin/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAkB,MAAM,iBAAiB,CAAC;AAGhG;;;;;;;GAOG;AACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAExD,qEAAqE;AACrE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;SAC1D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,EAAE,CAAC;IACV,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;aACtD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aACjC,IAAI,EAAE,CAAC;QACV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAkB;IACpD,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,4EAA4E;AAC5E,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,UAAU,CAAc;IACjC,YAAY,UAAuB;QACjC,KAAK,CACH,GAAG,UAAU,CAAC,MAAM,aAAa,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,kBAAkB;YACnF,4CAA4C,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACtF,qDAAqD,CACxD,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAkB,EAClB,OAAwC,EAAE,EAC1C,KAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,MAAM,IAAI,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,iFAAiF;SAC5F,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACnE,MAAM,KAAK,GACT,sGAAsG;SACnG,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACnE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,OAAO,CAAqC;IACrD,YAAY,MAAc,EAAE,OAA2C;QACrE,KAAK,CACH,GAAG,MAAM,cAAc,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ;YACnF,2BAA2B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACvF,0DAA0D,CAC7D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAkB,EAAE,MAAc;IAClE,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IAC7E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,2BAA2B;YAC7C,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAuC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,GAAG,CAAC,CAAC,EAAE,0EAA0E;gBAC/E,kEAAkE,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CACnC;sDACgD,EAChD,CAAC,QAAQ,CAAC,IAAI,CAAC,CAChB,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAExE,OAAO,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC"}

package/dist/services/db.d.ts

@@ -7,6 +7,22 @@ export interface Column {
     type: string;
     nullable: boolean;
 }
+/**
+ * Reject a statement that is really several.
+ *
+ * The endpoint runs one query per request. Sent two separated by a semicolon,
+ * it runs one of them and answers as though all was well: a `delete` followed
+ * by a `delete` reported "1 row affected" while the first one never happened.
+ * Silence is the problem — an error would have been fine. Semicolons inside a
+ * string literal or a dollar-quoted body are left alone, since those are one
+ * statement.
+ *
+ * At module scope rather than inside `db()` because it is the rule every
+ * migration file is written to, and a rule the suite can assert is one that
+ * cannot quietly stop being true. The alternative — a second copy of this
+ * regular expression in a test — is how the two drift.
+ */
+export declare function refuseMultiple(sql: string): void;
 export declare function db(connectionString: string): {
     query: (sql: string, params?: unknown[]) => Promise<Rows>;
     write: (sql: string, params?: unknown[]) => Promise<Rows>;

package/dist/services/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/services/db.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,MAAM;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,EAAE,CAAC,gBAAgB,EAAE,MAAM;iBAuCf,MAAM,WAAU,OAAO,EAAE,KAAQ,OAAO,CAAC,IAAI,CAAC;iBAoC9C,MAAM,WAAU,OAAO,EAAE,KAAQ,OAAO,CAAC,IAAI,CAAC;cAatD,OAAO,CAAC,MAAM,EAAE,CAAC;mBAOZ,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;EAelD"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/services/db.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,MAAM;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAahD;AAED,wBAAgB,EAAE,CAAC,gBAAgB,EAAE,MAAM;iBAuCf,MAAM,WAAU,OAAO,EAAE,KAAQ,OAAO,CAAC,IAAI,CAAC;iBAW9C,MAAM,WAAU,OAAO,EAAE,KAAQ,OAAO,CAAC,IAAI,CAAC;cAatD,OAAO,CAAC,MAAM,EAAE,CAAC;mBAOZ,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;EAelD"}

package/dist/services/db.js

@@ -18,6 +18,33 @@
  * `fetch`.
  */
 import { errorFor } from "../http/errors.js";
+/**
+ * Reject a statement that is really several.
+ *
+ * The endpoint runs one query per request. Sent two separated by a semicolon,
+ * it runs one of them and answers as though all was well: a `delete` followed
+ * by a `delete` reported "1 row affected" while the first one never happened.
+ * Silence is the problem — an error would have been fine. Semicolons inside a
+ * string literal or a dollar-quoted body are left alone, since those are one
+ * statement.
+ *
+ * At module scope rather than inside `db()` because it is the rule every
+ * migration file is written to, and a rule the suite can assert is one that
+ * cannot quietly stop being true. The alternative — a second copy of this
+ * regular expression in a test — is how the two drift.
+ */
+export function refuseMultiple(sql) {
+    const stripped = sql
+        .replace(/\$\$[\s\S]*?\$\$/g, "")
+        .replace(/'(?:[^']|'')*'/g, "")
+        .replace(/"(?:[^"]|"")*"/g, "")
+        .replace(/--[^\n]*/g, "")
+        .replace(/\/\*[\s\S]*?\*\//g, "");
+    if (/;\s*\S/.test(stripped)) {
+        throw new Error("One statement at a time. This runs a single query per request, so a " +
+            "second one after a semicolon would be dropped without saying so.");
+    }
+}
 export function db(connectionString) {
     let host;
     try {
@@ -59,28 +86,6 @@ export function db(connectionString) {
         const first = body.results?.[0];
         return { rows: first?.rows ?? [], rowCount: first?.rowCount ?? 0 };
     }
-    /**
-     * Reject a statement that is really several.
-     *
-     * The endpoint runs one query per request. Sent two separated by a
-     * semicolon, it runs one of them and answers as though all was well: a
-     * `delete` followed by a `delete` reported "1 row affected" while the first
-     * one never happened. Silence is the problem — an error would have been
-     * fine. Semicolons inside a string literal or a dollar-quoted body are left
-     * alone, since those are one statement.
-     */
-    function refuseMultiple(sql) {
-        const stripped = sql
-            .replace(/\$\$[\s\S]*?\$\$/g, "")
-            .replace(/'(?:[^']|'')*'/g, "")
-            .replace(/"(?:[^"]|"")*"/g, "")
-            .replace(/--[^\n]*/g, "")
-            .replace(/\/\*[\s\S]*?\*\//g, "");
-        if (/;\s*\S/.test(stripped)) {
-            throw new Error("One statement at a time. This runs a single query per request, so a " +
-                "second one after a semicolon would be dropped without saying so.");
-        }
-    }
     /** SQL that may change data. Gated in the registry, not here. */
     async function write(sql, params = []) {
         refuseMultiple(sql);

package/dist/services/db.js.map

@@ -1 +1 @@
-{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/services/db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAa7C,MAAM,UAAU,EAAE,CAAC,gBAAwB;IACzC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,IAAI,MAAM,CAAC;IAEvC,KAAK,UAAU,IAAI,CACjB,IAAa,EACb,UAAkC,EAAE;QAEpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,wBAAwB,EAAE,gBAAgB;gBAC1C,GAAG,OAAO;aACX;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,sEAAsE;YACtE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,SAAoB,EAAE;QACtD,cAAc,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CACtB,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,EACrC,EAAE,sBAAsB,EAAE,MAAM,EAAE,CACnC,CAA4E,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,IAAI,CAAC,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;OASG;IACH,SAAS,cAAc,CAAC,GAAW;QACjC,MAAM,QAAQ,GAAG,GAAG;aACjB,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;aAChC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;aAC9B,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;aAC9B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;aACxB,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;QACpC,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,sEAAsE;gBACpE,kEAAkE,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,SAAoB,EAAE;QACtD,cAAc,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAG/C,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;IACjE,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK;QAEL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAC1B,gFAAgF,CACjF,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAa;YACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAC1B;;;oCAG4B,EAC5B,CAAC,KAAK,CAAC,CACR,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAChC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBAC5B,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,KAAK;aACrC,CAAC,CAAC,CAAC;QACN,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/services/db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAa7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,QAAQ,GAAG,GAAG;SACjB,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;SAChC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;SAC9B,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;SAC9B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACpC,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,kEAAkE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,EAAE,CAAC,gBAAwB;IACzC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,IAAI,MAAM,CAAC;IAEvC,KAAK,UAAU,IAAI,CACjB,IAAa,EACb,UAAkC,EAAE;QAEpC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,wBAAwB,EAAE,gBAAgB;gBAC1C,GAAG,OAAO;aACX;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,sEAAsE;YACtE,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,SAAoB,EAAE;QACtD,cAAc,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CACtB,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,EACrC,EAAE,sBAAsB,EAAE,MAAM,EAAE,CACnC,CAA4E,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,IAAI,CAAC,EAAE,CAAC;IACrE,CAAC;IAED,iEAAiE;IACjE,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,SAAoB,EAAE;QACtD,cAAc,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAG/C,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;IACjE,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK;QAEL,KAAK,CAAC,MAAM;YACV,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAC1B,gFAAgF,CACjF,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAa;YACzB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAC1B;;;oCAG4B,EAC5B,CAAC,KAAK,CAAC,CACR,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;gBAChC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBAC5B,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,KAAK;aACrC,CAAC,CAAC,CAAC;QACN,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heychunky/core",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "The engine the Chunky CLI, worker and apps run on.",
   "license": "MIT",
   "type": "module",
@@ -15,7 +15,8 @@
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "register"
   ],
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json",

package/register/0001-baseline/01-invite-requests.sql

@@ -0,0 +1,11 @@
+create table invite_requests (
+  id uuid default gen_random_uuid() not null,
+  email text not null,
+  name text,
+  note text,
+  created_at timestamptz default now() not null,
+  invited_at timestamptz,
+  asks integer default 1 not null,
+  last_asked_at timestamptz default now() not null,
+  constraint invite_requests_pkey PRIMARY KEY (id)
+);

package/register/0001-baseline/02-invite-requests-email-key.sql

@@ -0,0 +1 @@
+CREATE UNIQUE INDEX invite_requests_email_key ON public.invite_requests USING btree (lower(email));

package/register/0001-baseline/03-login-codes.sql

@@ -0,0 +1,12 @@
+create table login_codes (
+  id uuid default gen_random_uuid() not null,
+  email text not null,
+  kind text not null,
+  code_hash text not null,
+  expires_at timestamptz not null,
+  consumed_at timestamptz,
+  attempts integer default 0 not null,
+  created_at timestamptz default now() not null,
+  constraint login_codes_pkey PRIMARY KEY (id),
+  constraint login_codes_kind_check CHECK ((kind = ANY (ARRAY['link'::text, 'pin'::text])))
+);

package/register/0001-baseline/04-login-codes-email-idx.sql

@@ -0,0 +1 @@
+CREATE INDEX login_codes_email_idx ON public.login_codes USING btree (lower(email), created_at DESC);

package/register/0001-baseline/05-notifications.sql

@@ -0,0 +1,11 @@
+create table notifications (
+  id uuid default gen_random_uuid() not null,
+  kind text not null,
+  subject text not null,
+  detail jsonb,
+  created_at timestamptz default now() not null,
+  sent_at timestamptz,
+  send_error text,
+  read_at timestamptz,
+  constraint notifications_pkey PRIMARY KEY (id)
+);

package/register/0001-baseline/06-notifications-unread-idx.sql

@@ -0,0 +1 @@
+CREATE INDEX notifications_unread_idx ON public.notifications USING btree (created_at DESC) WHERE (read_at IS NULL);

package/register/0001-baseline/07-users.sql

@@ -0,0 +1,13 @@
+create table users (
+  id uuid default gen_random_uuid() not null,
+  email text not null,
+  name text,
+  role text default 'developer'::text not null,
+  created_at timestamptz default now() not null,
+  app_limit integer default 3,
+  username text,
+  plan text default 'free'::text not null,
+  constraint users_pkey PRIMARY KEY (id),
+  constraint users_app_limit_check CHECK ((app_limit >= 0)),
+  constraint users_role_check CHECK ((role = ANY (ARRAY['superadmin'::text, 'developer'::text])))
+);

package/register/0001-baseline/08-users-email-key.sql

@@ -0,0 +1 @@
+CREATE UNIQUE INDEX users_email_key ON public.users USING btree (lower(email));

package/register/0001-baseline/09-users-one-superadmin.sql

@@ -0,0 +1 @@
+CREATE UNIQUE INDEX users_one_superadmin ON public.users USING btree (role) WHERE (role = 'superadmin'::text);

package/register/0001-baseline/10-users-username-unique.sql

@@ -0,0 +1 @@
+CREATE UNIQUE INDEX users_username_unique ON public.users USING btree (lower(username));

package/register/0001-baseline/11-api-tokens.sql

@@ -0,0 +1,13 @@
+create table api_tokens (
+  id uuid default gen_random_uuid() not null,
+  user_id uuid not null,
+  name text not null,
+  token_hash text not null,
+  prefix text not null,
+  created_at timestamptz default now() not null,
+  last_used_at timestamptz,
+  revoked_at timestamptz,
+  constraint api_tokens_token_hash_key UNIQUE (token_hash),
+  constraint api_tokens_pkey PRIMARY KEY (id),
+  constraint api_tokens_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);

package/register/0001-baseline/12-apps.sql

@@ -0,0 +1,14 @@
+create table apps (
+  id uuid default gen_random_uuid() not null,
+  name text not null,
+  owner_id uuid not null,
+  org text,
+  repo text,
+  vercel_project text,
+  neon_project text,
+  created_at timestamptz default now() not null,
+  provisioned jsonb,
+  theme text,
+  constraint apps_pkey PRIMARY KEY (id),
+  constraint apps_owner_id_fkey FOREIGN KEY (owner_id) REFERENCES users(id) ON DELETE RESTRICT
+);

package/register/0001-baseline/13-apps-name-key.sql

@@ -0,0 +1 @@
+CREATE UNIQUE INDEX apps_name_key ON public.apps USING btree (lower(name));

package/register/0001-baseline/14-apps-owner-idx.sql

@@ -0,0 +1 @@
+CREATE INDEX apps_owner_idx ON public.apps USING btree (owner_id);

package/register/0001-baseline/15-contexts.sql

@@ -0,0 +1,9 @@
+create table contexts (
+  name text not null,
+  kind text default 'user'::text not null,
+  owner_id uuid not null,
+  created_at timestamptz default now() not null,
+  constraint contexts_pkey PRIMARY KEY (name),
+  constraint contexts_owner_id_fkey FOREIGN KEY (owner_id) REFERENCES users(id) ON DELETE CASCADE,
+  constraint contexts_kind_check CHECK ((kind = ANY (ARRAY['user'::text, 'org'::text])))
+);

package/register/0001-baseline/16-credit-ledger.sql

@@ -0,0 +1,10 @@
+create table credit_ledger (
+  id uuid default gen_random_uuid() not null,
+  user_id uuid not null,
+  delta integer not null,
+  reason text not null,
+  ref text,
+  created_at timestamptz default now() not null,
+  constraint credit_ledger_pkey PRIMARY KEY (id),
+  constraint credit_ledger_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);

package/register/0001-baseline/17-credit-ledger-user.sql

@@ -0,0 +1 @@
+CREATE INDEX credit_ledger_user ON public.credit_ledger USING btree (user_id, created_at DESC);

package/register/0001-baseline/18-runs.sql

@@ -0,0 +1,16 @@
+create table runs (
+  id uuid not null,
+  repo text not null,
+  app_id uuid,
+  operator_id uuid not null,
+  source text not null,
+  title text,
+  steps jsonb default '[]'::jsonb not null,
+  cost numeric,
+  outcome text default 'running'::text not null,
+  created_at timestamptz default now() not null,
+  finished_at timestamptz,
+  constraint runs_pkey PRIMARY KEY (id),
+  constraint runs_app_id_fkey FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE SET NULL,
+  constraint runs_operator_id_fkey FOREIGN KEY (operator_id) REFERENCES users(id)
+);

package/register/0001-baseline/19-sessions.sql

@@ -0,0 +1,10 @@
+create table sessions (
+  id uuid default gen_random_uuid() not null,
+  user_id uuid not null,
+  token_hash text not null,
+  expires_at timestamptz not null,
+  created_at timestamptz default now() not null,
+  constraint sessions_token_hash_key UNIQUE (token_hash),
+  constraint sessions_pkey PRIMARY KEY (id),
+  constraint sessions_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);

package/register/0001-baseline/20-sessions-user-idx.sql

@@ -0,0 +1 @@
+CREATE INDEX sessions_user_idx ON public.sessions USING btree (user_id);

package/register/0001-baseline/21-app-chunks.sql

@@ -0,0 +1,7 @@
+create table app_chunks (
+  app_id uuid not null,
+  chunk text not null,
+  added_at timestamptz default now() not null,
+  constraint app_chunks_pkey PRIMARY KEY (app_id, chunk),
+  constraint app_chunks_app_id_fkey FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
+);

package/register/0001-baseline/22-context-members.sql

@@ -0,0 +1,10 @@
+create table context_members (
+  context text not null,
+  user_id uuid not null,
+  role text default 'publisher'::text not null,
+  added_at timestamptz default now() not null,
+  constraint context_members_pkey PRIMARY KEY (context, user_id),
+  constraint context_members_context_fkey FOREIGN KEY (context) REFERENCES contexts(name) ON DELETE CASCADE,
+  constraint context_members_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+  constraint context_members_role_check CHECK ((role = ANY (ARRAY['owner'::text, 'publisher'::text])))
+);

package/register/0002-orgs/01-orgs.sql

@@ -0,0 +1,14 @@
+create table orgs (
+  id uuid default gen_random_uuid() not null,
+  name text not null,
+  kind text default 'personal'::text not null,
+  plan text default 'free'::text not null,
+  github_org text,
+  vercel_team text,
+  vault_folder text,
+  created_at timestamptz default now() not null,
+  constraint orgs_pkey PRIMARY KEY (id),
+  constraint orgs_kind_check CHECK ((kind = ANY (ARRAY['personal'::text, 'team'::text]))),
+  constraint orgs_plan_check CHECK ((plan = ANY (ARRAY['free'::text, 'pro'::text, 'team'::text, 'enterprise'::text, 'super'::text]))),
+  constraint orgs_name_check CHECK ((name ~ '^[a-z0-9][a-z0-9-]*$'))
+);

package/register/0002-orgs/02-orgs-name-key.sql

@@ -0,0 +1 @@
+CREATE UNIQUE INDEX orgs_name_key ON public.orgs USING btree (lower(name));

package/register/0002-orgs/03-org-members.sql

@@ -0,0 +1,10 @@
+create table org_members (
+  org_id uuid not null,
+  user_id uuid not null,
+  role text default 'publisher'::text not null,
+  added_at timestamptz default now() not null,
+  constraint org_members_pkey PRIMARY KEY (org_id, user_id),
+  constraint org_members_org_id_fkey FOREIGN KEY (org_id) REFERENCES orgs(id) ON DELETE CASCADE,
+  constraint org_members_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
+  constraint org_members_role_check CHECK ((role = ANY (ARRAY['admin'::text, 'publisher'::text])))
+);

package/register/0002-orgs/04-org-members-user-idx.sql

@@ -0,0 +1 @@
+CREATE INDEX org_members_user_idx ON public.org_members USING btree (user_id);

package/register/0002-orgs/05-apps-org-id.sql

@@ -0,0 +1 @@
+alter table apps add column org_id uuid references orgs(id) on delete restrict;

package/register/0002-orgs/06-apps-org-idx.sql

@@ -0,0 +1 @@
+CREATE INDEX apps_org_idx ON public.apps USING btree (org_id);

package/register/0002-orgs/07-apps-org-name-key.sql

@@ -0,0 +1 @@
+CREATE UNIQUE INDEX apps_org_name_key ON public.apps USING btree (org_id, lower(name));

package/register/0002-orgs/08-credit-ledger-org-id.sql

@@ -0,0 +1 @@
+alter table credit_ledger add column org_id uuid references orgs(id) on delete cascade;

package/register/0002-orgs/09-credit-ledger-org-idx.sql

@@ -0,0 +1 @@
+CREATE INDEX credit_ledger_org ON public.credit_ledger USING btree (org_id, created_at DESC);

package/register/0002-orgs/10-api-tokens-org-id.sql

@@ -0,0 +1 @@
+alter table api_tokens add column org_id uuid references orgs(id) on delete cascade;

package/register/0002-orgs/11-api-tokens-created-by.sql

@@ -0,0 +1 @@
+alter table api_tokens add column created_by uuid references users(id) on delete set null;

package/register/0002-orgs/12-backfill-personal-orgs.sql

@@ -0,0 +1,15 @@
+-- Everyone who has claimed a username gets the personal organisation of that
+-- name, carrying the plan they are on today.
+--
+-- The username is the scope: `@dan/auth` was already going to mean Dan, and an
+-- organisation is what that scope now names. A user who has not claimed one
+-- yet gets no organisation here — `claimUsername` makes it in the same breath
+-- as the name, so the two can never disagree about who owns `dan`.
+--
+-- Guarded by `not exists` rather than `on conflict`, because the unique index
+-- is on `lower(name)` and a conflict target has to name the index expression.
+insert into orgs (name, kind, plan)
+select u.username, 'personal', u.plan
+  from users u
+ where u.username is not null
+   and not exists (select 1 from orgs o where lower(o.name) = lower(u.username));

package/register/0002-orgs/13-backfill-org-members.sql

@@ -0,0 +1,12 @@
+-- A personal organisation has exactly one member, and they run it.
+--
+-- `admin` rather than `owner`: ownership of the organisation is not a role, it
+-- is what `kind = 'personal'` and the matching username already say. The two
+-- roles that exist are the two that describe what somebody may do — administer
+-- the organisation, or publish under it.
+insert into org_members (org_id, user_id, role)
+select o.id, u.id, 'admin'
+  from users u
+  join orgs o on lower(o.name) = lower(u.username) and o.kind = 'personal'
+ where u.username is not null
+on conflict (org_id, user_id) do nothing;

package/register/0002-orgs/14-backfill-apps-org.sql

@@ -0,0 +1,14 @@
+-- Every app moves into its owner's personal organisation.
+--
+-- Joined through the username rather than through `org_members`, so exactly one
+-- row can match: `orgs_name_key` is unique on `lower(name)`, and a user is a
+-- member of one personal organisation by construction but the join could not
+-- prove it. An `update ... from` that matches twice picks one arbitrarily and
+-- says nothing, which is precisely the silent wrong backfill to avoid.
+--
+-- `org_id is null` makes it repeatable, and leaves alone any app already placed.
+update apps a
+   set org_id = o.id
+  from users u
+  join orgs o on lower(o.name) = lower(u.username) and o.kind = 'personal'
+ where u.id = a.owner_id and a.org_id is null;

package/register/0002-orgs/15-backfill-credit-ledger-org.sql

@@ -0,0 +1,11 @@
+-- Credit is spent by an organisation, not by a person in it.
+--
+-- Empty on the factory's own register today. It is written anyway because the
+-- migration has to be correct for any register it meets — a staging factory, a
+-- test — and because a backfill written later, against rows that exist, is a
+-- backfill written under pressure.
+update credit_ledger l
+   set org_id = o.id
+  from users u
+  join orgs o on lower(o.name) = lower(u.username) and o.kind = 'personal'
+ where u.id = l.user_id and l.org_id is null;