@intx/db 0.1.2 → 0.3.0

package/migrations/0073_grant_target_exactly_one_check.sql

@@ -0,0 +1,13 @@
+-- Every grant targets exactly one of a role or a principal. This CHECK is the
+-- universal backstop: it holds for every insert path, including the internal
+-- seeding and materialization sites that never touch the CreateGrant HTTP
+-- validator. On the HTTP path, CreateGrant additionally enforces the same
+-- exactly-one rule so a malformed POST is rejected with a 400 rather than
+-- tripping this constraint as a 500.
+--
+-- On an existing database, ADD CONSTRAINT validates every row and FAILS LOUDLY
+-- if a pre-existing grant carries both targets (or neither) -- rows a prior,
+-- looser write path could have created. That is intentional: a both-target row
+-- is ambiguous to auto-repair, so the migration surfaces it for manual
+-- resolution rather than silently guessing which target to keep.
+ALTER TABLE "grant" ADD CONSTRAINT "grant_target_exactly_one" CHECK (num_nonnulls("grant"."principal_id", "grant"."role_id") = 1);

package/migrations/0074_add_provider_api_base_url.sql

@@ -0,0 +1 @@
+ALTER TABLE "provider" ADD COLUMN "api_base_url" text;

package/migrations/0075_workflow_run_launch_spec.sql

@@ -0,0 +1,17 @@
+CREATE TABLE "workflow_run_launch_spec" (
+	"anchor_run_id" text PRIMARY KEY NOT NULL,
+	"schema_version" integer DEFAULT 1 NOT NULL,
+	"session_id" text NOT NULL,
+	"deployment_domain" text NOT NULL,
+	"source_authority_principal_id" text NOT NULL,
+	"definition_snapshot" jsonb NOT NULL,
+	"definition_hash" text NOT NULL,
+	"source_offering_ids" jsonb NOT NULL,
+	"default_source_offering_id" text NOT NULL,
+	"deploy_content" jsonb NOT NULL,
+	"tool_package_pins" jsonb,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "workflow_run_launch_spec" ADD CONSTRAINT "workflow_run_launch_spec_anchor_run_id_workflow_run_id_fk" FOREIGN KEY ("anchor_run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "workflow_run_launch_spec" ADD CONSTRAINT "workflow_run_launch_spec_source_authority_principal_id_principal_id_fk" FOREIGN KEY ("source_authority_principal_id") REFERENCES "public"."principal"("id") ON DELETE restrict ON UPDATE no action;

package/migrations/0076_sidecar_allocation.sql

@@ -0,0 +1,40 @@
+CREATE TABLE "sidecar_allocation" (
+	"id" text PRIMARY KEY NOT NULL,
+	"anchor_run_id" text NOT NULL,
+	"tenant_id" text NOT NULL,
+	"provisioner_id" text NOT NULL,
+	"provisioner_api_version" integer NOT NULL,
+	"provisioner_binding_fingerprint" text NOT NULL,
+	"sidecar_id" text,
+	"placement_sharing" text NOT NULL,
+	"sidecar_reuse" text DEFAULT 'never' NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"generation" integer DEFAULT 0 NOT NULL,
+	"ensure_accepted_generation" integer,
+	"external_ref" text,
+	"next_attempt_at" timestamp,
+	"reconciliation_lease_id" text,
+	"reconciliation_lease_expires_at" timestamp,
+	"ensure_attempts" integer DEFAULT 0 NOT NULL,
+	"destroy_attempts" integer DEFAULT 0 NOT NULL,
+	"connect_deadline" timestamp,
+	"failure_code" text,
+	"failure_message" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "sidecar_allocation_status_check" CHECK ("sidecar_allocation"."status" in ('pending', 'provisioning', 'allocated', 'replacing', 'releasing', 'released', 'failed')),
+	CONSTRAINT "sidecar_allocation_placement_check" CHECK ("sidecar_allocation"."placement_sharing" = 'exclusive'),
+	CONSTRAINT "sidecar_allocation_generation_check" CHECK ("sidecar_allocation"."generation" >= 0),
+	CONSTRAINT "sidecar_allocation_accepted_generation_check" CHECK ("sidecar_allocation"."ensure_accepted_generation" is null or "sidecar_allocation"."ensure_accepted_generation" <= "sidecar_allocation"."generation")
+);
+--> statement-breakpoint
+ALTER TABLE "sidecar" ALTER COLUMN "url" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "sidecar" ADD COLUMN "credential_scope" text DEFAULT 'shared' NOT NULL;--> statement-breakpoint
+ALTER TABLE "sidecar_allocation" ADD CONSTRAINT "sidecar_allocation_anchor_run_id_workflow_run_id_fk" FOREIGN KEY ("anchor_run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sidecar_allocation" ADD CONSTRAINT "sidecar_allocation_tenant_id_tenant_id_fk" FOREIGN KEY ("tenant_id") REFERENCES "public"."tenant"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sidecar_allocation" ADD CONSTRAINT "sidecar_allocation_sidecar_id_sidecar_id_fk" FOREIGN KEY ("sidecar_id") REFERENCES "public"."sidecar"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "sidecar_allocation_anchor_run_idx" ON "sidecar_allocation" USING btree ("anchor_run_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "sidecar_allocation_active_sidecar_idx" ON "sidecar_allocation" USING btree ("sidecar_id") WHERE "sidecar_allocation"."status" in ('provisioning', 'allocated', 'replacing', 'releasing');--> statement-breakpoint
+CREATE INDEX "sidecar_allocation_sidecar_idx" ON "sidecar_allocation" USING btree ("sidecar_id");--> statement-breakpoint
+CREATE INDEX "sidecar_allocation_reconciliation_idx" ON "sidecar_allocation" USING btree ("next_attempt_at","created_at") WHERE "sidecar_allocation"."status" in ('pending', 'provisioning', 'allocated', 'replacing', 'releasing') and "sidecar_allocation"."next_attempt_at" is not null;--> statement-breakpoint
+ALTER TABLE "sidecar" ADD CONSTRAINT "sidecar_credential_scope_check" CHECK ("sidecar"."credential_scope" in ('shared', 'allocated'));

package/migrations/0077_workflow_run_dispatch.sql

@@ -0,0 +1,29 @@
+CREATE TABLE "workflow_run_dispatch" (
+	"id" text PRIMARY KEY NOT NULL,
+	"anchor_run_id" text NOT NULL,
+	"message_id" text NOT NULL,
+	"raw_message" "bytea" NOT NULL,
+	"step_grants" jsonb NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"acknowledged_generation" integer,
+	"attempt_count" integer DEFAULT 0 NOT NULL,
+	"next_attempt_at" timestamp DEFAULT now(),
+	"delivery_lease_id" text,
+	"delivery_lease_expires_at" timestamp,
+	"failure_code" text,
+	"failure_message" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	"acknowledged_at" timestamp,
+	"settled_at" timestamp,
+	CONSTRAINT "workflow_run_dispatch_status_check" CHECK ("workflow_run_dispatch"."status" in ('pending', 'acknowledged', 'settled', 'failed')),
+	CONSTRAINT "workflow_run_dispatch_attempt_count_check" CHECK ("workflow_run_dispatch"."attempt_count" >= 0),
+	CONSTRAINT "workflow_run_dispatch_acknowledged_generation_check" CHECK ("workflow_run_dispatch"."acknowledged_generation" is null or "workflow_run_dispatch"."acknowledged_generation" >= 0),
+	CONSTRAINT "workflow_run_dispatch_acknowledged_state_check" CHECK ("workflow_run_dispatch"."status" <> 'acknowledged' or "workflow_run_dispatch"."acknowledged_generation" is not null),
+	CONSTRAINT "workflow_run_dispatch_pending_schedule_check" CHECK ("workflow_run_dispatch"."status" <> 'pending' or "workflow_run_dispatch"."next_attempt_at" is not null)
+);
+--> statement-breakpoint
+ALTER TABLE "workflow_run_dispatch" ADD CONSTRAINT "workflow_run_dispatch_anchor_run_id_workflow_run_id_fk" FOREIGN KEY ("anchor_run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "workflow_run_dispatch_anchor_message_idx" ON "workflow_run_dispatch" USING btree ("anchor_run_id","message_id");--> statement-breakpoint
+CREATE INDEX "workflow_run_dispatch_delivery_idx" ON "workflow_run_dispatch" USING btree ("next_attempt_at","created_at") WHERE "workflow_run_dispatch"."status" = 'pending';--> statement-breakpoint
+CREATE INDEX "workflow_run_dispatch_anchor_status_idx" ON "workflow_run_dispatch" USING btree ("anchor_run_id","status");

package/migrations/0078_workflow_run_dispatch_kind.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "workflow_run_dispatch" ADD COLUMN "kind" text DEFAULT 'mail' NOT NULL;--> statement-breakpoint
+ALTER TABLE "workflow_run_dispatch" ADD CONSTRAINT "workflow_run_dispatch_kind_check" CHECK ("workflow_run_dispatch"."kind" in ('mail', 'signal'));

package/migrations/0079_rename_workflow_run_deployment_id_to_anchor_run_id.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "workflow_run" RENAME COLUMN "deployment_id" TO "anchor_run_id";--> statement-breakpoint
+ALTER TABLE "workflow_run" DROP CONSTRAINT "workflow_run_deployment_id_workflow_run_id_fk";
+--> statement-breakpoint
+ALTER TABLE "workflow_run" ADD CONSTRAINT "workflow_run_anchor_run_id_workflow_run_id_fk" FOREIGN KEY ("anchor_run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;

package/migrations/0080_rename_correlation_approval_deployment_id_to_anchor_run_id.sql

@@ -0,0 +1,9 @@
+ALTER TABLE "signal_correlation" RENAME COLUMN "deployment_id" TO "anchor_run_id";--> statement-breakpoint
+ALTER TABLE "approval" RENAME COLUMN "deployment_id" TO "anchor_run_id";--> statement-breakpoint
+ALTER TABLE "approval" DROP CONSTRAINT "approval_deployment_id_workflow_run_id_fk";
+--> statement-breakpoint
+ALTER TABLE "signal_correlation" DROP CONSTRAINT "signal_correlation_deployment_id_workflow_run_id_fk";
+--> statement-breakpoint
+ALTER INDEX "approval_deployment_idx" RENAME TO "approval_anchor_run_idx";--> statement-breakpoint
+ALTER TABLE "approval" ADD CONSTRAINT "approval_anchor_run_id_workflow_run_id_fk" FOREIGN KEY ("anchor_run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "signal_correlation" ADD CONSTRAINT "signal_correlation_anchor_run_id_workflow_run_id_fk" FOREIGN KEY ("anchor_run_id") REFERENCES "public"."workflow_run"("id") ON DELETE cascade ON UPDATE no action;

package/migrations/0081_workflow_definition_content_hash_and_approved_wire_hash.sql

@@ -0,0 +1,4 @@
+DROP INDEX "workflow_definition_asset_idx";--> statement-breakpoint
+ALTER TABLE "workflow_definition" ADD COLUMN "wire_hash" text;--> statement-breakpoint
+ALTER TABLE "workflow_definition_version" ADD COLUMN "approved_wire_hash" text;--> statement-breakpoint
+CREATE UNIQUE INDEX "workflow_definition_asset_wire_hash_idx" ON "workflow_definition" USING btree ("asset_id","wire_hash");

package/migrations/0082_blue_black_queen.sql

@@ -0,0 +1 @@
+ALTER TABLE "workflow_definition_version" ADD COLUMN "grant_snapshot" jsonb;

package/migrations/0083_replace_launch_spec_snapshot_with_frozen_bundle.sql

@@ -0,0 +1,3 @@
+ALTER TABLE "workflow_run_launch_spec" ADD COLUMN "frozen_approval_bundle" jsonb NOT NULL;--> statement-breakpoint
+ALTER TABLE "workflow_run_launch_spec" DROP COLUMN "definition_snapshot";--> statement-breakpoint
+ALTER TABLE "workflow_run_launch_spec" DROP COLUMN "definition_hash";

package/migrations/0084_delete_orphaned_credential_grants.sql

@@ -0,0 +1,22 @@
+-- Remove `credential:{id}` grant rows that reference a credential that no longer
+-- exists. Before credential DELETE cleaned up its per-credential grants, deleting
+-- a personal credential left its `credential:{id}` grant behind, and migration
+-- 0037 backfilled the same shape for pre-existing personal credentials, so a
+-- credential hard-deleted before that cleanup shipped left an orphaned grant.
+--
+-- The coarse wildcard `credential:*` role resource is excluded explicitly: no
+-- credential has the id `*`, so the NOT EXISTS guard alone would wrongly match
+-- it. There is no tenant scope: credential ids are globally unique, so an
+-- orphaned grant is one whose id matches no credential in any tenant. This
+-- removes every action on an orphaned resource, matching the credential DELETE
+-- handler.
+--
+-- Idempotent: after this runs no orphaned row remains, so a re-run is a no-op.
+DELETE FROM "grant"
+WHERE "resource" LIKE 'credential:%'
+  AND "resource" <> 'credential:*'
+  AND NOT EXISTS (
+    SELECT 1
+    FROM "credential" c
+    WHERE c."id" = substr("grant"."resource", length('credential:') + 1)
+  );