@lobu/cli 6.1.1 → 7.1.0

package/dist/db/migrations/20260515150000_geo_enrichment.sql

@@ -0,0 +1,208 @@
+-- migrate:up
+
+-- =============================================================================
+-- Geo enrichment: reverse-geocode lat/lng → country / admin1 / place at the
+-- gateway, once, for every event with coordinates. Used by `apple.photos`
+-- today; gmaps reviews, github commit metadata, and any future geo-bearing
+-- connector benefit automatically.
+--
+-- Three system-level reference tables (no organization_id — these are
+-- read-only geographic facts shared across all tenants) seeded from
+-- GeoNames (https://www.geonames.org/, CC-BY 4.0):
+--
+--   geo_countries — country_code → name/continent/currency/etc. (~250 rows)
+--   geo_admin1    — state/province codes per country (~4k rows)
+--   geo_places    — populated places (cities/towns/villages/hamlets);
+--                   seeded from GeoNames cities1000.txt (~150k rows for v1).
+--                   Can be upgraded to the full PPL-class subset of
+--                   allCountries (~5M rows) without schema changes —
+--                   nearest-neighbor query is the same shape.
+--
+-- The `geo_lookup(lat, lng)` function returns the enriched row in one
+-- call. Nearest-neighbor uses PostGIS `geography(POINT, 4326)` + GiST so
+-- distance is true geodesic (not L2-on-degrees), and the index keeps it
+-- sub-millisecond at any table size we'd ever load.
+--
+-- Run `scripts/seed-geo-data.sh` after this migration applies to populate
+-- the tables. The TS enrichment hook gracefully no-ops if the tables are
+-- empty or the function is missing, so partially-deployed installs keep
+-- working — events just don't get the enriched fields until seeding runs.
+--
+-- ENVIRONMENTS WITHOUT POSTGIS: the entire migration is wrapped in a DO
+-- block that probes for the extension. If PostGIS isn't installable
+-- (PGlite in tests, restricted hosts), every statement below is skipped
+-- with a NOTICE. The runtime enrichment hook also fails open, so
+-- partially-supported environments keep functioning — they just don't
+-- get geo enrichment.
+-- =============================================================================
+
+DO $migration$
+BEGIN
+    -- Try to install PostGIS. If it's not available on this host (PGlite
+    -- without the postgis extension registered, managed Postgres without
+    -- the extension, etc.), bail out cleanly.
+    BEGIN
+        CREATE EXTENSION IF NOT EXISTS postgis;
+    EXCEPTION
+        WHEN OTHERS THEN
+            RAISE NOTICE
+                'geo-enrichment: PostGIS unavailable (%), skipping geo schema. Runtime enrichment will no-op.',
+                SQLERRM;
+            RETURN;
+    END;
+
+    -- spatial_ref_sys row for SRID 4326 (WGS-84). Real PostGIS installs
+    -- bundle ~8000 standard projections; the pglite-postgis WASM build
+    -- ships an empty table to keep the bundle small. Inserting the one
+    -- row we use makes nearest-neighbour queries work everywhere; the
+    -- ON CONFLICT skips on prod where the row already exists.
+    INSERT INTO spatial_ref_sys (srid, auth_name, auth_srid, srtext, proj4text)
+    VALUES (
+        4326,
+        'EPSG',
+        4326,
+        'GEOGCS["WGS 84",DATUM["WGS_1984",SPHEROID["WGS 84",6378137,298.257223563,AUTHORITY["EPSG","7030"]],AUTHORITY["EPSG","6326"]],PRIMEM["Greenwich",0,AUTHORITY["EPSG","8901"]],UNIT["degree",0.0174532925199433,AUTHORITY["EPSG","9122"]],AUTHORITY["EPSG","4326"]]',
+        '+proj=longlat +datum=WGS84 +no_defs'
+    )
+    ON CONFLICT (srid) DO NOTHING;
+
+    -- Everything below this point assumes PostGIS is loaded. EXECUTE-wrapping
+    -- the DDL keeps the SQL parser from choking on `geography(POINT, 4326)`
+    -- when this whole DO block is parsed before the extension creates the type.
+
+    -- geo_countries — ISO-2 country code → full record. Source: GeoNames
+    -- countryInfo.txt.
+    EXECUTE $ddl$
+        CREATE TABLE IF NOT EXISTS geo_countries (
+            code             text PRIMARY KEY,
+            code3            text,
+            numeric_code     integer,
+            fips             text,
+            name             text NOT NULL,
+            capital          text,
+            area_sq_km       numeric,
+            population       bigint,
+            continent        text,
+            tld              text,
+            currency_code    text,
+            currency_name    text,
+            phone            text,
+            postal_code_fmt  text,
+            postal_code_re   text,
+            languages        text,
+            geonameid        bigint,
+            neighbours       text
+        )
+    $ddl$;
+
+    -- geo_admin1 — first-order administrative subdivisions.
+    -- Code shape: '<ISO2>.<ADMIN1>' (e.g. 'IT.07' = Lazio).
+    EXECUTE $ddl$
+        CREATE TABLE IF NOT EXISTS geo_admin1 (
+            code         text PRIMARY KEY,
+            country_code text NOT NULL,
+            name         text NOT NULL,
+            ascii_name   text NOT NULL,
+            geonameid    bigint
+        )
+    $ddl$;
+
+    EXECUTE 'CREATE INDEX IF NOT EXISTS geo_admin1_country_idx ON geo_admin1 (country_code)';
+
+    -- geo_places — populated places. `location` is a generated geography
+    -- point that the GiST index uses for nearest-neighbour lookup. Stays
+    -- sub-ms even at 5M+ rows.
+    EXECUTE $ddl$
+        CREATE TABLE IF NOT EXISTS geo_places (
+            geonameid    bigint PRIMARY KEY,
+            name         text NOT NULL,
+            ascii_name   text NOT NULL,
+            alt_names    text,
+            latitude     double precision NOT NULL,
+            longitude    double precision NOT NULL,
+            feature_class text,
+            feature_code  text,
+            country_code  text NOT NULL,
+            admin1_code   text,
+            admin2_code   text,
+            population    bigint DEFAULT 0,
+            elevation_m   integer,
+            timezone      text,
+            location      geography(POINT, 4326)
+                GENERATED ALWAYS AS (
+                    ST_SetSRID(ST_MakePoint(longitude, latitude), 4326)::geography
+                ) STORED
+        )
+    $ddl$;
+
+    EXECUTE 'CREATE INDEX IF NOT EXISTS geo_places_location_idx ON geo_places USING GIST (location)';
+    EXECUTE 'CREATE INDEX IF NOT EXISTS geo_places_country_idx  ON geo_places (country_code)';
+
+    -- geo_lookup(lat, lng) — single-call enrichment.
+    -- Returns the nearest populated place plus the country/admin1 join.
+    -- distance_km is included so callers can apply their own threshold
+    -- (e.g., reject results > 500 km away — ocean/desert coordinates that
+    -- would otherwise snap misleadingly to the closest coastal city).
+    EXECUTE $fn$
+        CREATE OR REPLACE FUNCTION geo_lookup(p_lat double precision, p_lng double precision)
+        RETURNS TABLE (
+            place_name    text,
+            place_id      bigint,
+            country_code  text,
+            country_name  text,
+            admin1_code   text,
+            admin1_name   text,
+            timezone      text,
+            population    bigint,
+            distance_km   double precision
+        )
+        LANGUAGE sql
+        STABLE
+        PARALLEL SAFE
+        AS $body$
+            WITH nearest AS (
+                SELECT
+                    p.geonameid,
+                    p.name,
+                    p.country_code,
+                    p.admin1_code,
+                    p.timezone,
+                    p.population,
+                    ST_Distance(
+                        p.location,
+                        ST_SetSRID(ST_MakePoint(p_lng, p_lat), 4326)::geography
+                    ) / 1000.0 AS distance_km
+                FROM geo_places p
+                ORDER BY p.location <-> ST_SetSRID(ST_MakePoint(p_lng, p_lat), 4326)::geography
+                LIMIT 1
+            )
+            SELECT
+                n.name                                              AS place_name,
+                n.geonameid                                         AS place_id,
+                n.country_code                                      AS country_code,
+                c.name                                              AS country_name,
+                CASE
+                    WHEN n.admin1_code IS NULL OR n.admin1_code = '' THEN NULL
+                    ELSE n.country_code || '.' || n.admin1_code
+                END                                                AS admin1_code,
+                a.name                                              AS admin1_name,
+                n.timezone                                          AS timezone,
+                n.population                                        AS population,
+                n.distance_km                                       AS distance_km
+            FROM nearest n
+            LEFT JOIN geo_countries c ON c.code = n.country_code
+            LEFT JOIN geo_admin1 a    ON a.code = n.country_code || '.' || n.admin1_code
+        $body$
+    $fn$;
+END
+$migration$;
+
+-- migrate:down
+
+DROP FUNCTION IF EXISTS geo_lookup(double precision, double precision);
+DROP TABLE IF EXISTS geo_places;
+DROP TABLE IF EXISTS geo_admin1;
+DROP TABLE IF EXISTS geo_countries;
+-- Intentionally do NOT DROP EXTENSION postgis. The extension may be
+-- shared by other tables / future migrations on the same Postgres
+-- instance; rolling back this migration shouldn't take that down.

package/dist/db/migrations/20260515160000_drop_agents_org_id_unique.sql

@@ -0,0 +1,24 @@
+-- migrate:up
+-- Drop the parallel `UNIQUE (organization_id, id)` added in 20260515120000.
+-- It was meant as schema-prep for the eventual PK swap to (organization_id,
+-- id), but it actively broke `ON CONFLICT (id) DO NOTHING/UPDATE` callers.
+--
+-- Why: Postgres' `ON CONFLICT (X)` only suppresses violations of the unique
+-- constraint matching exactly column set X. Adding a second unique constraint
+-- that overlaps with the PK means inserts can fail on the new constraint
+-- before reaching the PK conflict — and ON CONFLICT (id) doesn't catch it.
+-- Surfaced in `__tests__/integration/.../race-mcp` where parallel inserts of
+-- `(org-a, race-mcp-0)` started throwing `agents_organization_id_id_key`
+-- duplicates instead of being silently de-duped by the existing
+-- `ON CONFLICT (id) DO NOTHING` clause.
+--
+-- The PK on `(id)` already enforces global uniqueness, which subsumes
+-- `(organization_id, id)` uniqueness — the new constraint was logically
+-- redundant. Phase C of the per-org PK migration will swap the PK directly
+-- without needing a parallel constraint as a stepping stone.
+
+ALTER TABLE agents DROP CONSTRAINT IF EXISTS agents_organization_id_id_key;
+
+-- migrate:down
+ALTER TABLE agents
+  ADD CONSTRAINT agents_organization_id_id_key UNIQUE (organization_id, id);

package/dist/db/migrations/20260515170000_auth_profiles_default_for_connector.sql

@@ -0,0 +1,23 @@
+-- migrate:up
+-- Admin-managed default app profile per (org, connector_key).
+-- Today getPrimaryAuthProfileForKind picks the most-recently-updated active
+-- oauth_app profile for the connector — admins have no way to designate
+-- which profile members should fall through to. The flag lets the admin
+-- pin a chosen profile; the resolver prefers flagged rows first.
+--
+-- Constrained to oauth_app for now since that's the only kind where
+-- "default for connector" is meaningful (env / interactive / browser_session
+-- are picked by other rules — device binding, capture mode, etc.).
+
+ALTER TABLE auth_profiles
+  ADD COLUMN is_default_for_connector boolean NOT NULL DEFAULT false;
+
+CREATE UNIQUE INDEX auth_profiles_default_for_connector_unique
+  ON auth_profiles (organization_id, connector_key)
+  WHERE is_default_for_connector AND profile_kind = 'oauth_app';
+
+-- migrate:down
+DROP INDEX IF EXISTS auth_profiles_default_for_connector_unique;
+
+ALTER TABLE auth_profiles
+  DROP COLUMN IF EXISTS is_default_for_connector;

package/dist/db/migrations/20260516120000_agents_per_org_pk_swap.sql

@@ -0,0 +1,125 @@
+-- migrate:up
+-- Phase C: swap `agents` PK from globally-unique `id` to per-org composite
+-- `(organization_id, id)`. The application has always treated agents as
+-- org-scoped (every read/list filters by organization_id) but the global PK
+-- silently blocked two orgs from sharing an agent ID — for example, a stale
+-- `food-ordering` in one org would prevent `food-ordering` in another.
+--
+-- Phase A (20260515120000) added the org column + composite indexes on the
+-- 5 FK-holding child tables and backfilled values from agents. Phase B (the
+-- application-code refactor in this PR) plumbs `organization_id` through every
+-- INSERT/UPDATE/DELETE/SELECT touching these tables. This migration is the
+-- final structural swap: it drops the single-column PK + FKs, adds the
+-- composite PK + FKs, and widens the per-(agent,kind,pattern) uniques on
+-- agent_users / agent_grants / grants with organization_id.
+
+-- ── 0. Set NOT NULL on the columns Phase A backfilled.
+-- Backfill defensively in case any rows snuck in NULL (e.g. embedded PGlite
+-- installs that bypassed the dbmate runner during a partial state).
+UPDATE public.agent_grants           c SET organization_id = a.organization_id FROM public.agents a WHERE c.organization_id IS NULL AND c.agent_id = a.id;
+UPDATE public.agent_connections      c SET organization_id = a.organization_id FROM public.agents a WHERE c.organization_id IS NULL AND c.agent_id = a.id;
+UPDATE public.agent_users            c SET organization_id = a.organization_id FROM public.agents a WHERE c.organization_id IS NULL AND c.agent_id = a.id;
+UPDATE public.agent_channel_bindings c SET organization_id = a.organization_id FROM public.agents a WHERE c.organization_id IS NULL AND c.agent_id = a.id;
+UPDATE public.grants                 c SET organization_id = a.organization_id FROM public.agents a WHERE c.organization_id IS NULL AND c.agent_id = a.id;
+
+-- Drop any orphan rows (agent_id with no matching agents row). Backfill
+-- can't recover these.
+DELETE FROM public.agent_grants           WHERE organization_id IS NULL;
+DELETE FROM public.agent_connections      WHERE organization_id IS NULL;
+DELETE FROM public.agent_users            WHERE organization_id IS NULL;
+DELETE FROM public.agent_channel_bindings WHERE organization_id IS NULL;
+DELETE FROM public.grants                 WHERE organization_id IS NULL;
+
+ALTER TABLE public.agent_grants           ALTER COLUMN organization_id SET NOT NULL;
+ALTER TABLE public.agent_connections      ALTER COLUMN organization_id SET NOT NULL;
+ALTER TABLE public.agent_users            ALTER COLUMN organization_id SET NOT NULL;
+ALTER TABLE public.agent_channel_bindings ALTER COLUMN organization_id SET NOT NULL;
+ALTER TABLE public.grants                 ALTER COLUMN organization_id SET NOT NULL;
+
+-- ── 1. Drop the 6 single-column FKs into agents(id).
+ALTER TABLE public.agent_grants           DROP CONSTRAINT IF EXISTS agent_grants_agent_id_fkey;
+ALTER TABLE public.agent_connections      DROP CONSTRAINT IF EXISTS agent_connections_agent_id_fkey;
+ALTER TABLE public.agent_users            DROP CONSTRAINT IF EXISTS agent_users_agent_id_fkey;
+ALTER TABLE public.agent_channel_bindings DROP CONSTRAINT IF EXISTS agent_channel_bindings_agent_id_fkey;
+ALTER TABLE public.grants                 DROP CONSTRAINT IF EXISTS grants_agent_id_fkey;
+ALTER TABLE public.scheduled_jobs         DROP CONSTRAINT IF EXISTS scheduled_jobs_agent_fkey;
+
+-- ── 2. Drop the unique/PK constraints on child tables that scope to bare agent_id.
+ALTER TABLE public.agent_grants DROP CONSTRAINT IF EXISTS agent_grants_agent_id_pattern_key;
+ALTER TABLE public.agent_users  DROP CONSTRAINT IF EXISTS agent_users_pkey;
+ALTER TABLE public.grants       DROP CONSTRAINT IF EXISTS grants_pkey;
+
+-- ── 3. Swap the PK on agents from (id) to (organization_id, id).
+ALTER TABLE public.agents DROP CONSTRAINT IF EXISTS agents_pkey;
+ALTER TABLE public.agents ADD CONSTRAINT agents_pkey PRIMARY KEY (organization_id, id);
+
+-- ── 4. Re-add per-org-scoped uniques on the child tables.
+ALTER TABLE public.agent_grants
+  ADD CONSTRAINT agent_grants_org_agent_pattern_key UNIQUE (organization_id, agent_id, pattern);
+ALTER TABLE public.agent_users
+  ADD CONSTRAINT agent_users_pkey PRIMARY KEY (organization_id, agent_id, platform, user_id);
+ALTER TABLE public.grants
+  ADD CONSTRAINT grants_pkey PRIMARY KEY (organization_id, agent_id, kind, pattern);
+
+-- ── 5. Re-add composite FKs (organization_id, agent_id) → agents(organization_id, id).
+ALTER TABLE public.agent_grants
+  ADD CONSTRAINT agent_grants_org_agent_fkey
+  FOREIGN KEY (organization_id, agent_id) REFERENCES public.agents(organization_id, id) ON DELETE CASCADE;
+ALTER TABLE public.agent_connections
+  ADD CONSTRAINT agent_connections_org_agent_fkey
+  FOREIGN KEY (organization_id, agent_id) REFERENCES public.agents(organization_id, id) ON DELETE CASCADE;
+ALTER TABLE public.agent_users
+  ADD CONSTRAINT agent_users_org_agent_fkey
+  FOREIGN KEY (organization_id, agent_id) REFERENCES public.agents(organization_id, id) ON DELETE CASCADE;
+ALTER TABLE public.agent_channel_bindings
+  ADD CONSTRAINT agent_channel_bindings_org_agent_fkey
+  FOREIGN KEY (organization_id, agent_id) REFERENCES public.agents(organization_id, id) ON DELETE CASCADE;
+ALTER TABLE public.grants
+  ADD CONSTRAINT grants_org_agent_fkey
+  FOREIGN KEY (organization_id, agent_id) REFERENCES public.agents(organization_id, id) ON DELETE CASCADE;
+ALTER TABLE public.scheduled_jobs
+  ADD CONSTRAINT scheduled_jobs_org_agent_fkey
+  FOREIGN KEY (organization_id, created_by_agent) REFERENCES public.agents(organization_id, id) ON DELETE CASCADE;
+
+-- migrate:down
+-- Reverse the swap. NOTE: this WILL FAIL if two orgs ended up sharing an
+-- agent ID after this migration shipped (the previous PK on (id) requires
+-- global uniqueness). That's by design — this migration's whole purpose is
+-- to allow per-org agent IDs that the old PK forbids.
+
+ALTER TABLE public.scheduled_jobs         DROP CONSTRAINT IF EXISTS scheduled_jobs_org_agent_fkey;
+ALTER TABLE public.grants                 DROP CONSTRAINT IF EXISTS grants_org_agent_fkey;
+ALTER TABLE public.agent_channel_bindings DROP CONSTRAINT IF EXISTS agent_channel_bindings_org_agent_fkey;
+ALTER TABLE public.agent_users            DROP CONSTRAINT IF EXISTS agent_users_org_agent_fkey;
+ALTER TABLE public.agent_connections      DROP CONSTRAINT IF EXISTS agent_connections_org_agent_fkey;
+ALTER TABLE public.agent_grants           DROP CONSTRAINT IF EXISTS agent_grants_org_agent_fkey;
+
+ALTER TABLE public.grants       DROP CONSTRAINT IF EXISTS grants_pkey;
+ALTER TABLE public.agent_users  DROP CONSTRAINT IF EXISTS agent_users_pkey;
+ALTER TABLE public.agent_grants DROP CONSTRAINT IF EXISTS agent_grants_org_agent_pattern_key;
+
+ALTER TABLE public.agents DROP CONSTRAINT IF EXISTS agents_pkey;
+ALTER TABLE public.agents ADD CONSTRAINT agents_pkey PRIMARY KEY (id);
+
+ALTER TABLE public.agent_grants ADD CONSTRAINT agent_grants_agent_id_pattern_key UNIQUE (agent_id, pattern);
+ALTER TABLE public.agent_users  ADD CONSTRAINT agent_users_pkey PRIMARY KEY (agent_id, platform, user_id);
+ALTER TABLE public.grants       ADD CONSTRAINT grants_pkey PRIMARY KEY (agent_id, kind, pattern);
+
+ALTER TABLE public.agent_grants
+  ADD CONSTRAINT agent_grants_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES public.agents(id) ON DELETE CASCADE;
+ALTER TABLE public.agent_connections
+  ADD CONSTRAINT agent_connections_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES public.agents(id) ON DELETE CASCADE;
+ALTER TABLE public.agent_users
+  ADD CONSTRAINT agent_users_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES public.agents(id) ON DELETE CASCADE;
+ALTER TABLE public.agent_channel_bindings
+  ADD CONSTRAINT agent_channel_bindings_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES public.agents(id) ON DELETE CASCADE;
+ALTER TABLE public.grants
+  ADD CONSTRAINT grants_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES public.agents(id) ON DELETE CASCADE;
+ALTER TABLE public.scheduled_jobs
+  ADD CONSTRAINT scheduled_jobs_agent_fkey FOREIGN KEY (created_by_agent) REFERENCES public.agents(id) ON DELETE CASCADE;
+
+ALTER TABLE public.grants                 ALTER COLUMN organization_id DROP NOT NULL;
+ALTER TABLE public.agent_channel_bindings ALTER COLUMN organization_id DROP NOT NULL;
+ALTER TABLE public.agent_users            ALTER COLUMN organization_id DROP NOT NULL;
+ALTER TABLE public.agent_connections      ALTER COLUMN organization_id DROP NOT NULL;
+ALTER TABLE public.agent_grants           ALTER COLUMN organization_id DROP NOT NULL;

package/dist/db/migrations/20260516200000_events_search_tsv.sql

@@ -0,0 +1,134 @@
+-- migrate:up
+
+-- Materialize the fulltext search vector as a STORED column.
+--
+-- Why a real column instead of the previous expression-indexed `to_tsvector(payload_text)`:
+--   1. It includes both `title` (weight A) and `payload_text` (weight B) — the
+--      same shape buildSearchDocumentExpr() in content-search.ts uses for
+--      ranking. Retrieval (@@) and ts_rank_cd now read the same vector, so
+--      title-only hits surface correctly and ranking doesn't recompute the
+--      vector per matched row at query time.
+--   2. Planner-stable: `search_tsv @@ to_tsquery(...)` is a plain column
+--      reference — no expression-shape matching, no aliasing risk where the
+--      GIN gets skipped because the WHERE expression isn't byte-identical to
+--      the indexed expression.
+--   3. The new GIN strictly subsumes the old payload-only one (same lexemes
+--      plus title's), so we drop the old index and recover its write
+--      amplification on every events insert.
+--
+-- Operational note: ADD COLUMN ... GENERATED STORED rewrites the events
+-- table under ACCESS EXCLUSIVE. On a 1M-row table expect on the order of a
+-- minute; run during a quiet window. CONCURRENTLY does not apply to ADD
+-- COLUMN; it only applies to CREATE INDEX, which is a separate statement
+-- below.
+
+ALTER TABLE public.events
+    ADD COLUMN search_tsv tsvector GENERATED ALWAYS AS (
+        setweight(to_tsvector('english', COALESCE(title, '')), 'A') ||
+        setweight(to_tsvector('english', COALESCE(payload_text, '')), 'B')
+    ) STORED;
+
+CREATE INDEX idx_events_search_tsv ON public.events USING gin (search_tsv);
+
+DROP INDEX IF EXISTS public.idx_events_fulltext;
+
+-- Recreate the current_event_records view so it exposes search_tsv to
+-- callers that go through the supersession filter (the view materializes
+-- its column list at create time, so `e.*`-style auto-pickup doesn't
+-- apply). buildSearchDocumentExpr() reads `f.search_tsv` / `fi.search_tsv`
+-- where f and fi are this view's aliases, so without this the view-backed
+-- queries fail with "column ... does not exist".
+
+DROP VIEW IF EXISTS public.current_event_records;
+CREATE VIEW public.current_event_records AS
+ SELECT e.id,
+    e.organization_id,
+    e.entity_ids,
+    e.origin_id,
+    e.title,
+    e.payload_type,
+    e.payload_text,
+    e.payload_data,
+    e.payload_template,
+    e.attachments,
+    e.metadata,
+    e.score,
+    emb.embedding,
+    e.author_name,
+    e.source_url,
+    e.occurred_at,
+    e.created_at,
+    e.origin_parent_id,
+    COALESCE(length(e.payload_text), 0) AS content_length,
+    e.search_tsv,
+    e.origin_type,
+    e.connector_key,
+    e.connection_id,
+    e.feed_key,
+    e.feed_id,
+    e.run_id,
+    e.semantic_type,
+    e.client_id,
+    e.created_by,
+    e.interaction_type,
+    e.interaction_status,
+    e.interaction_input_schema,
+    e.interaction_input,
+    e.interaction_output,
+    e.interaction_error,
+    e.supersedes_event_id
+   FROM (public.events e
+     LEFT JOIN public.event_embeddings emb ON ((emb.event_id = e.id)))
+  WHERE (NOT (EXISTS ( SELECT 1
+           FROM public.events newer
+          WHERE (newer.supersedes_event_id = e.id))));
+
+-- migrate:down
+
+DROP VIEW IF EXISTS public.current_event_records;
+CREATE VIEW public.current_event_records AS
+ SELECT e.id,
+    e.organization_id,
+    e.entity_ids,
+    e.origin_id,
+    e.title,
+    e.payload_type,
+    e.payload_text,
+    e.payload_data,
+    e.payload_template,
+    e.attachments,
+    e.metadata,
+    e.score,
+    emb.embedding,
+    e.author_name,
+    e.source_url,
+    e.occurred_at,
+    e.created_at,
+    e.origin_parent_id,
+    COALESCE(length(e.payload_text), 0) AS content_length,
+    e.origin_type,
+    e.connector_key,
+    e.connection_id,
+    e.feed_key,
+    e.feed_id,
+    e.run_id,
+    e.semantic_type,
+    e.client_id,
+    e.created_by,
+    e.interaction_type,
+    e.interaction_status,
+    e.interaction_input_schema,
+    e.interaction_input,
+    e.interaction_output,
+    e.interaction_error,
+    e.supersedes_event_id
+   FROM (public.events e
+     LEFT JOIN public.event_embeddings emb ON ((emb.event_id = e.id)))
+  WHERE (NOT (EXISTS ( SELECT 1
+           FROM public.events newer
+          WHERE (newer.supersedes_event_id = e.id))));
+
+CREATE INDEX idx_events_fulltext ON public.events
+    USING gin (to_tsvector('english'::regconfig, COALESCE(payload_text, ''::text)));
+DROP INDEX IF EXISTS public.idx_events_search_tsv;
+ALTER TABLE public.events DROP COLUMN search_tsv;

package/dist/db/migrations/20260516200100_events_lifecycle_changes_index.sql

@@ -0,0 +1,25 @@
+-- migrate:up
+
+-- Partial index for the dashboard's 14-day lifecycle-cumulative-stats query
+-- (lifecycleCumulativeStatsSql in packages/owletto/src/lib/api/metric-series.ts).
+--
+-- The query reads events older than `now() - interval '14 days'` and
+-- aggregates by date_trunc('day', created_at), with every COUNT FILTER
+-- already gated on semantic_type='change' AND metadata->>'category'='lifecycle'.
+-- A partial index whose predicate matches that gate prunes the scan from
+-- "all events in the last 14 days for the org" to "just the lifecycle
+-- changes" — typically a small slice of total events. The aggregation
+-- itself is cheap once the row set is narrow.
+--
+-- Why not a materialized view: at current scale the bottleneck is the row
+-- scan, not the per-bucket COUNT FILTER work. A partial index removes the
+-- scan cost without introducing a refresh job or staleness. Revisit if the
+-- post-prune row count grows into the millions.
+
+CREATE INDEX idx_events_lifecycle_changes
+    ON public.events (organization_id, created_at)
+    WHERE semantic_type = 'change' AND metadata->>'category' = 'lifecycle';
+
+-- migrate:down
+
+DROP INDEX IF EXISTS public.idx_events_lifecycle_changes;

package/dist/db/migrations/20260517010000_drop_unused_indexes.sql

@@ -0,0 +1,49 @@
+-- migrate:up
+
+-- Drop 4 indexes that pg_stat_user_indexes reported `idx_scan = 0` after 28h
+-- of prod uptime AND are not referenced from any active code path.
+--
+-- A larger set (4 more, ~5 GB combined) was originally bundled here but
+-- review caught they're not actually unused — they're dormant. The three
+-- big search indexes (`idx_events_embedding`, `idx_events_raw_content_trgm`,
+-- `idx_events_search_tsv`) are explicitly used by the ANN/fulltext/trigram
+-- branches of `approximate_candidate_search` in
+-- `packages/server/src/utils/content-search.ts:1707-1733`. The `search()`
+-- agent tool path threads through there; prod just hasn't called it in
+-- 28h, but a single user-initiated search would now time out at 6s and
+-- return empty results without those indexes (`content-search.ts:1850-1863`).
+-- Similarly `idx_events_run_id` backs the "view in memory" filter
+-- (`content-query-filters.ts:197-201`); rare, but a real path.
+--
+-- Keep those four until either (a) the dormant features are removed in
+-- code, or (b) measured prod traffic confirms they're abandoned.
+--
+-- What remains is small but still real write amplification: each kept
+-- INSERT into events updates these btrees. Combined size ~66 MB —
+-- modest reclaim, but zero downside since the underlying queries don't
+-- exist anywhere in the codebase today (verified by grep).
+--
+-- Plain `DROP INDEX` (not CONCURRENTLY) is used because dbmate's
+-- `transaction:false` directive doesn't actually exit the transaction
+-- block against the `pq` driver — see the comment in
+-- 20260426130001_db_integrity_cleanup_concurrent.sql. These 4 indexes
+-- are all small btrees so the ACCESS EXCLUSIVE on `events` during the
+-- drop is sub-second; no operator runbook needed.
+
+DROP INDEX IF EXISTS public.idx_events_entity_ids_occurred_at;
+DROP INDEX IF EXISTS public.idx_events_origin_parent_id;
+DROP INDEX IF EXISTS public.idx_events_thread_lookup;
+DROP INDEX IF EXISTS public.idx_events_type;
+
+-- migrate:down
+
+CREATE INDEX IF NOT EXISTS idx_events_entity_ids_occurred_at
+    ON public.events USING btree ((entity_ids[1]), occurred_at DESC, id DESC)
+    WHERE ((entity_ids IS NOT NULL) AND (entity_ids <> '{}'::bigint[]));
+CREATE INDEX IF NOT EXISTS idx_events_origin_parent_id
+    ON public.events USING btree (origin_parent_id);
+CREATE INDEX IF NOT EXISTS idx_events_thread_lookup
+    ON public.events USING btree (origin_parent_id, occurred_at)
+    WHERE (origin_parent_id IS NOT NULL);
+CREATE INDEX IF NOT EXISTS idx_events_type
+    ON public.events USING btree (origin_type) WHERE (origin_type IS NOT NULL);

package/dist/db/migrations/20260517020000_softdelete_orphan_feeds.sql

@@ -0,0 +1,56 @@
+-- migrate:up
+
+-- Soft-delete feeds whose (connector_key, organization_id) has no active
+-- connector_definition row.
+--
+-- Why: the 2026-05-16 audit found feeds 117-155 (and others) referencing
+-- connector_key='website' in orgs that have no active definition for it
+-- (only one org has `website` active; one definition is archived). Every
+-- CheckDueFeeds tick (every minute) tried to materialize a sync run for
+-- these feeds and threw "No active connector definition found for X." —
+-- producing ~380 error logs / minute that masked real signal in stdout.
+--
+-- The app-side code path now warns + skips (no throw) for the same case
+-- so future orphans don't spam logs either. This migration is the one-time
+-- cleanup of the existing data.
+--
+-- Conservative criteria — match exactly the set CheckDueFeeds processes
+-- (so we only soft-delete feeds that actually produce the error stream).
+--   - feed has no pinned_version (= would have looked up connector_definitions)
+--   - feed.deleted_at IS NULL (still considered active)
+--   - feed.status = 'active' (CheckDueFeeds filters on this — see
+--     packages/server/src/scheduled/check-due-feeds.ts:36-43)
+--   - connection.deleted_at IS NULL AND connection.status = 'active' (same)
+--   - NO active connector_definition exists for that (key, organization) pair
+--
+-- Feeds in paused / pending_auth / error / revoked states are left alone
+-- — operators may be mid-recovery on them and they don't contribute to
+-- the error spam (CheckDueFeeds skips them anyway).
+--
+-- The same feed remains recoverable: clearing `deleted_at` + reinstalling
+-- the connector definition for the org restores it.
+
+UPDATE public.feeds f
+SET deleted_at = now()
+FROM public.connections c
+WHERE f.connection_id = c.id
+  AND f.deleted_at IS NULL
+  AND f.pinned_version IS NULL
+  AND f.status = 'active'
+  AND c.deleted_at IS NULL
+  AND c.status = 'active'
+  AND NOT EXISTS (
+    SELECT 1
+    FROM public.connector_definitions cd
+    WHERE cd.key = c.connector_key
+      AND cd.organization_id = f.organization_id
+      AND cd.status = 'active'
+  );
+
+-- migrate:down
+
+-- No-op: re-attaching the orphan feeds would require knowing which were
+-- soft-deleted by this migration vs. by an operator action. The original
+-- error condition is fixed in code; this migration is a one-shot data
+-- cleanup. To recover specific feeds in prod, clear `deleted_at` on the
+-- targeted rows manually and re-install the connector definition.