@marinoscar/kvox-eval 0.0.0-bootstrap → 0.1.0-next.0

package/host/prisma/migrations/20240101000025_add_groups/migration.sql

@@ -0,0 +1,165 @@
+-- =============================================================================
+-- Groups: sharing groups inside an organization (PP-7.1, issue #728)
+-- =============================================================================
+--
+-- Three org-owned tables, each with a NOT NULL org_id and a FORCEd
+-- <table>_org_isolation policy copied from 0025_org_scoped_rls:
+--
+--   groups          a set of users inside ONE organization that can own content
+--                   (spec decision D6: a group is never a tenant)
+--   group_members   one row per (group, user), with a GroupRole
+--   group_invites   an invitation of an e-mail address to a group
+--
+-- ORG CONSISTENCY. A member and an invite reach their group through the
+-- COMPOSITE key (group_id, org_id) -> groups (id, org_id), with the supporting
+-- UNIQUE (id, org_id) on groups: a foreign-key check bypasses row-level
+-- security, so a plain key would let one organization store a reference to
+-- another's group, and the composite key also guarantees that
+-- group_members.org_id and group_invites.org_id equal groups.org_id.
+--
+-- RAW-SQL INDEX (intentional schema drift, listed in raw-sql-indexes.json):
+--   group_invites_pending_uniq_idx  at most one PENDING invite per (group,
+--                                   email); a declined, revoked or accepted
+--                                   invite does not block a new one. Prisma
+--                                   cannot express a partial unique index.
+--
+-- No backfill: the tables are new, so the policies are enabled at once.
+-- =============================================================================
+
+-- CreateEnum
+CREATE TYPE "GroupRole" AS ENUM ('admin', 'editor', 'viewer');
+
+-- CreateTable
+CREATE TABLE "groups" (
+    "id" UUID NOT NULL,
+    "org_id" UUID NOT NULL,
+    "name" TEXT NOT NULL,
+    "description" TEXT,
+    "metadata" JSONB,
+    "created_by_id" UUID,
+    "version" INTEGER NOT NULL DEFAULT 1,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "groups_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "group_members" (
+    "id" UUID NOT NULL,
+    "group_id" UUID NOT NULL,
+    "user_id" UUID NOT NULL,
+    "org_id" UUID NOT NULL,
+    "role" "GroupRole" NOT NULL DEFAULT 'viewer',
+    "added_by_id" UUID,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "group_members_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "group_invites" (
+    "id" UUID NOT NULL,
+    "group_id" UUID NOT NULL,
+    "org_id" UUID NOT NULL,
+    "email" TEXT NOT NULL,
+    "role" "GroupRole" NOT NULL DEFAULT 'viewer',
+    "invited_by_id" UUID,
+    "expires_at" TIMESTAMPTZ,
+    "accepted_at" TIMESTAMPTZ,
+    "accepted_by_id" UUID,
+    "declined_at" TIMESTAMPTZ,
+    "revoked_at" TIMESTAMPTZ,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "group_invites_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "groups_org_id_idx" ON "groups"("org_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "groups_id_org_id_key" ON "groups"("id", "org_id");
+
+-- CreateIndex
+CREATE INDEX "group_members_user_id_idx" ON "group_members"("user_id");
+
+-- CreateIndex
+CREATE INDEX "group_members_org_id_idx" ON "group_members"("org_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "group_members_group_id_user_id_key" ON "group_members"("group_id", "user_id");
+
+-- CreateIndex
+CREATE INDEX "group_invites_email_idx" ON "group_invites"("email");
+
+-- CreateIndex
+CREATE INDEX "group_invites_group_id_idx" ON "group_invites"("group_id");
+
+-- CreateIndex
+CREATE INDEX "group_invites_org_id_idx" ON "group_invites"("org_id");
+
+-- AddForeignKey
+ALTER TABLE "groups" ADD CONSTRAINT "groups_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "groups" ADD CONSTRAINT "groups_created_by_id_fkey" FOREIGN KEY ("created_by_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "group_members" ADD CONSTRAINT "group_members_group_id_org_id_fkey" FOREIGN KEY ("group_id", "org_id") REFERENCES "groups"("id", "org_id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "group_members" ADD CONSTRAINT "group_members_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "group_members" ADD CONSTRAINT "group_members_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "group_members" ADD CONSTRAINT "group_members_added_by_id_fkey" FOREIGN KEY ("added_by_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "group_invites" ADD CONSTRAINT "group_invites_group_id_org_id_fkey" FOREIGN KEY ("group_id", "org_id") REFERENCES "groups"("id", "org_id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "group_invites" ADD CONSTRAINT "group_invites_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "group_invites" ADD CONSTRAINT "group_invites_invited_by_id_fkey" FOREIGN KEY ("invited_by_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "group_invites" ADD CONSTRAINT "group_invites_accepted_by_id_fkey" FOREIGN KEY ("accepted_by_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- CreateIndex (partial: one pending invite per group and address)
+CREATE UNIQUE INDEX "group_invites_pending_uniq_idx" ON "group_invites"("group_id", "email") WHERE "accepted_at" IS NULL AND "declined_at" IS NULL AND "revoked_at" IS NULL;
+
+-- =============================================================================
+-- Row-level security, as in 0025_org_scoped_rls. The policy names are listed in
+-- RLS_POLICIES (rls-policies.json) and asserted against pg_policies by the
+-- drift test. NULLIF(..., '') because current_setting(name, true) is the empty
+-- string on a connection that ever held a transaction-local value.
+-- =============================================================================
+
+ALTER TABLE "groups" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "groups" FORCE ROW LEVEL SECURITY;
+CREATE POLICY "groups_org_isolation" ON "groups"
+  USING      ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on')
+  WITH CHECK ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on');
+
+ALTER TABLE "group_members" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "group_members" FORCE ROW LEVEL SECURITY;
+CREATE POLICY "group_members_org_isolation" ON "group_members"
+  USING      ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on')
+  WITH CHECK ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on');
+
+ALTER TABLE "group_invites" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "group_invites" FORCE ROW LEVEL SECURITY;
+CREATE POLICY "group_invites_org_isolation" ON "group_invites"
+  USING      ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on')
+  WITH CHECK ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on');

package/host/prisma/migrations/20240101000026_add_grants/migration.sql

@@ -0,0 +1,117 @@
+-- =============================================================================
+-- Grants: share one record with a user, a group or a link (PP-7.2, issue #729)
+-- =============================================================================
+--
+-- One org-owned table, `grants`, with a NOT NULL org_id and a FORCEd
+-- grants_org_isolation policy copied from 0025_org_scoped_rls.
+--
+-- POLYMORPHIC RESOURCE. (resource_type, resource_id) names a row of an app
+-- table the platform cannot know, so there is no foreign key to it. Integrity
+-- comes from GrantsService.deleteForResources() (inside the app's delete
+-- transaction) and the sharing.grants.prune job.
+--
+-- ORG CONSISTENCY. A group grantee reaches its group through the COMPOSITE key
+-- (grantee_group_id, org_id) -> groups (id, org_id): a foreign-key check
+-- bypasses row-level security, so a plain key would let a grant name another
+-- organization's group. A user is not org-scoped; the API checks that the
+-- grantee is an active member of the resource's organization.
+--
+-- The link columns (link_token_hash, link_token_ciphertext, link_label) are
+-- created now so #730 needs no migration.
+--
+-- RAW SQL (intentional schema drift: Prisma can express neither):
+--   grants_active_user_uniq_idx       at most one ACTIVE (unrevoked) grant per
+--                                     (resource, user): the API upserts on it
+--   grants_active_group_uniq_idx      the same per (resource, group)
+--   grants_grantee_consistency_check  the grantee columns match grantee_kind
+-- The two indexes are listed in raw-sql-indexes.json.
+--
+-- No backfill: the table is new, so the policy is enabled at once.
+-- =============================================================================
+
+-- CreateEnum
+CREATE TYPE "GrantGranteeKind" AS ENUM ('user', 'group', 'link');
+
+-- CreateTable
+CREATE TABLE "grants" (
+    "id" UUID NOT NULL,
+    "org_id" UUID NOT NULL,
+    "resource_type" TEXT NOT NULL,
+    "resource_id" UUID NOT NULL,
+    "grantee_kind" "GrantGranteeKind" NOT NULL,
+    "grantee_user_id" UUID,
+    "grantee_group_id" UUID,
+    "role" TEXT NOT NULL,
+    "link_token_hash" TEXT,
+    "link_token_ciphertext" TEXT,
+    "link_label" TEXT,
+    "expires_at" TIMESTAMPTZ,
+    "revoked_at" TIMESTAMPTZ,
+    "revoked_by_id" UUID,
+    "granted_by_id" UUID,
+    "metadata" JSONB,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "grants_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "grants_link_token_hash_key" ON "grants"("link_token_hash");
+
+-- CreateIndex
+CREATE INDEX "grants_resource_type_resource_id_idx" ON "grants"("resource_type", "resource_id");
+
+-- CreateIndex
+CREATE INDEX "grants_grantee_user_id_idx" ON "grants"("grantee_user_id");
+
+-- CreateIndex
+CREATE INDEX "grants_grantee_group_id_idx" ON "grants"("grantee_group_id");
+
+-- CreateIndex
+CREATE INDEX "grants_org_id_idx" ON "grants"("org_id");
+
+-- AddForeignKey
+ALTER TABLE "grants" ADD CONSTRAINT "grants_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "grants" ADD CONSTRAINT "grants_grantee_user_id_fkey" FOREIGN KEY ("grantee_user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "grants" ADD CONSTRAINT "grants_grantee_group_id_org_id_fkey" FOREIGN KEY ("grantee_group_id", "org_id") REFERENCES "groups"("id", "org_id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "grants" ADD CONSTRAINT "grants_revoked_by_id_fkey" FOREIGN KEY ("revoked_by_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "grants" ADD CONSTRAINT "grants_granted_by_id_fkey" FOREIGN KEY ("granted_by_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- CreateIndex (partial: one active grant per resource and user)
+CREATE UNIQUE INDEX "grants_active_user_uniq_idx" ON "grants"("resource_type", "resource_id", "grantee_user_id") WHERE "grantee_kind" = 'user' AND "revoked_at" IS NULL;
+
+-- CreateIndex (partial: one active grant per resource and group)
+CREATE UNIQUE INDEX "grants_active_group_uniq_idx" ON "grants"("resource_type", "resource_id", "grantee_group_id") WHERE "grantee_kind" = 'group' AND "revoked_at" IS NULL;
+
+-- AddCheckConstraint (the grantee columns match the grantee kind)
+ALTER TABLE "grants" ADD CONSTRAINT "grants_grantee_consistency_check" CHECK (
+  ("grantee_kind" = 'user'  AND "grantee_user_id" IS NOT NULL AND "grantee_group_id" IS NULL     AND "link_token_hash" IS NULL)
+  OR
+  ("grantee_kind" = 'group' AND "grantee_user_id" IS NULL     AND "grantee_group_id" IS NOT NULL AND "link_token_hash" IS NULL)
+  OR
+  ("grantee_kind" = 'link'  AND "grantee_user_id" IS NULL     AND "grantee_group_id" IS NULL     AND "link_token_hash" IS NOT NULL)
+);
+
+-- =============================================================================
+-- Row-level security, as in 0025_org_scoped_rls. The policy name is listed in
+-- RLS_POLICIES (rls-policies.json) and asserted against pg_policies by the
+-- drift test. NULLIF(..., '') because current_setting(name, true) is the empty
+-- string on a connection that ever held a transaction-local value.
+-- =============================================================================
+
+ALTER TABLE "grants" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "grants" FORCE ROW LEVEL SECURITY;
+CREATE POLICY "grants_org_isolation" ON "grants"
+  USING      ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on')
+  WITH CHECK ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on');

package/host/prisma/migrations/20240101000027_add_org_settings/migration.sql

@@ -0,0 +1,49 @@
+-- =============================================================================
+-- Organization settings: one organization's overrides (PP-8.1, issue #733)
+-- =============================================================================
+--
+-- One org-owned table, `org_settings`: one row per organization, holding only
+-- the org-overridable fields of each system settings namespace that declares
+-- an `org` block ({ "<namespace>": { "<field>": value } }), with its own
+-- version for If-Match. NOT NULL org_id, ENABLE and FORCE ROW LEVEL SECURITY
+-- and an org_settings_org_isolation policy copied from 0025_org_scoped_rls:
+-- organization A's transaction never reads or writes organization B's row.
+-- system_settings (deployment-level) and user_settings (user-owned) are
+-- unchanged.
+-- =============================================================================
+
+-- CreateTable
+CREATE TABLE "org_settings" (
+    "id" UUID NOT NULL,
+    "org_id" UUID NOT NULL,
+    "value" JSONB NOT NULL,
+    "version" INTEGER NOT NULL DEFAULT 1,
+    "updated_by_user_id" UUID,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "org_settings_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "org_settings_org_id_key" ON "org_settings"("org_id");
+
+-- AddForeignKey
+ALTER TABLE "org_settings" ADD CONSTRAINT "org_settings_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "org_settings" ADD CONSTRAINT "org_settings_updated_by_user_id_fkey" FOREIGN KEY ("updated_by_user_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- =============================================================================
+-- Row-level security, as in 0025_org_scoped_rls. The policy name is listed in
+-- RLS_POLICIES (rls-policies.json) and asserted against pg_policies by the
+-- drift test. NULLIF(..., '') because current_setting(name, true) is the empty
+-- string on a connection that ever held a transaction-local value.
+-- =============================================================================
+
+ALTER TABLE "org_settings" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "org_settings" FORCE ROW LEVEL SECURITY;
+CREATE POLICY "org_settings_org_isolation" ON "org_settings"
+  USING      ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on')
+  WITH CHECK ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on');

package/host/prisma/migrations/20240101000028_add_org_credentials/migration.sql

@@ -0,0 +1,54 @@
+-- =============================================================================
+-- Organization credentials: the org tier of the credential store (PP-8.8, #735)
+-- =============================================================================
+--
+-- One org-owned table, mirroring user_credentials with an organization as the
+-- owner: org_credentials, addressed by (org_id, purpose, name), each secret
+-- encrypted under the org-bound sub-key domain org:<orgId>:<purpose>.
+--
+-- A plain composite UNIQUE suffices (all three columns are NOT NULL), so no
+-- raw-SQL index. The table is tenant data with a NOT NULL org_id and a FORCEd
+-- org_credentials_org_isolation policy copied from 0025_org_scoped_rls.
+--
+-- No backfill: the table is new, so the policy is enabled at once.
+-- =============================================================================
+
+-- CreateTable
+CREATE TABLE "org_credentials" (
+    "id" UUID NOT NULL,
+    "org_id" UUID NOT NULL,
+    "purpose" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "secret" TEXT NOT NULL,
+    "hint" TEXT,
+    "label" TEXT,
+    "updated_by_user_id" UUID,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ NOT NULL,
+
+    CONSTRAINT "org_credentials_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "org_credentials_org_id_purpose_name_key" ON "org_credentials"("org_id", "purpose", "name");
+
+-- AddForeignKey
+ALTER TABLE "org_credentials" ADD CONSTRAINT "org_credentials_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "org_credentials" ADD CONSTRAINT "org_credentials_updated_by_user_id_fkey" FOREIGN KEY ("updated_by_user_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- =============================================================================
+-- Row-level security, as in 0025_org_scoped_rls. The policy name is listed in
+-- RLS_POLICIES (rls-policies.json) and asserted against pg_policies by the
+-- drift test. NULLIF(..., '') because current_setting(name, true) is the empty
+-- string on a connection that ever held a transaction-local value.
+-- =============================================================================
+
+ALTER TABLE "org_credentials" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "org_credentials" FORCE ROW LEVEL SECURITY;
+CREATE POLICY "org_credentials_org_isolation" ON "org_credentials"
+  USING      ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on')
+  WITH CHECK ("org_id" = NULLIF(current_setting('app.org_id', true), '')::uuid
+              OR current_setting('app.rls_bypass', true) = 'on');

package/host/prisma/migrations/20240101000029_add_jobs_org_id/migration.sql

@@ -0,0 +1,18 @@
+-- Jobs carry the organization they belong to (issue #734, PP-8.2).
+--
+-- Nullable with no default: a metadata-only ADD COLUMN, no table rewrite.
+-- NULL is a deployment-wide (system) job, and every row written before this
+-- migration is one. No row-level security on `jobs` (the claim is one
+-- cross-organization statement); see the `Job.orgId` comment in the jobs
+-- fragment. The `(org_id, status)` index is built CONCURRENTLY in the next
+-- migration, on its own, because `jobs` is a big table.
+
+-- AlterTable
+ALTER TABLE "jobs" ADD COLUMN     "org_id" UUID;
+
+-- AddForeignKey
+-- NOT VALID then VALIDATE: the add takes its lock without scanning `jobs`,
+-- and the validation scan runs under a lock that does not block writes.
+-- ON DELETE SET NULL keeps an organization's job history when it is deleted.
+ALTER TABLE "jobs" ADD CONSTRAINT "jobs_org_id_fkey" FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE SET NULL ON UPDATE CASCADE NOT VALID;
+ALTER TABLE "jobs" VALIDATE CONSTRAINT "jobs_org_id_fkey";

package/host/prisma/migrations/20240101000030_add_jobs_org_id_status_index/migration.sql

@@ -0,0 +1,6 @@
+-- "This organization's jobs by status" (issue #734, PP-8.2): the admin job
+-- list's orgId filter and offboarding's cancel of an organization's pending
+-- jobs. CONCURRENTLY, so building it never blocks the queue's writes, and
+-- therefore the only statement in this migration (it cannot run inside a
+-- transaction, and Prisma runs a single such statement outside one).
+CREATE INDEX CONCURRENTLY IF NOT EXISTS "jobs_org_id_status_idx" ON "jobs"("org_id", "status");

package/host/prisma/migrations/20240101000031_add_broadcast_target_org/migration.sql

@@ -0,0 +1,21 @@
+-- Broadcasts can target one organization (issue #738, PP-8.5).
+--
+-- Nullable with no default: a metadata-only ADD COLUMN. NULL is a system
+-- broadcast (every active user of the deployment), and every row written
+-- before this migration is one. No row-level security on
+-- `notification_broadcasts`: a system broadcast belongs to no organization and
+-- the delivering job must read it; the API authorizes `target_org_id` instead.
+-- ON DELETE CASCADE: an organization's broadcasts have no audience once it is
+-- deleted.
+
+-- AlterTable
+ALTER TABLE "notification_broadcasts" ADD COLUMN     "target_org_id" UUID;
+
+-- CreateIndex
+CREATE INDEX "notification_broadcasts_target_org_id_idx" ON "notification_broadcasts"("target_org_id");
+
+-- AddForeignKey
+-- NOT VALID then VALIDATE, as for `jobs.org_id`: the add takes its lock
+-- without scanning the table, and the validation scan does not block writes.
+ALTER TABLE "notification_broadcasts" ADD CONSTRAINT "notification_broadcasts_target_org_id_fkey" FOREIGN KEY ("target_org_id") REFERENCES "organizations"("id") ON DELETE CASCADE ON UPDATE CASCADE NOT VALID;
+ALTER TABLE "notification_broadcasts" VALIDATE CONSTRAINT "notification_broadcasts_target_org_id_fkey";

package/host/prisma/migrations/20240101000032_add_android_app/migration.sql

@@ -0,0 +1,60 @@
+-- The Android companion slice (#746, PP-9.4; merged from EvoPath and
+-- MemoriaHub). Expand-only: one new table and one defaulted column.
+
+-- CreateTable
+CREATE TABLE "android_app_releases" (
+    "id" UUID NOT NULL,
+    "package_name" TEXT NOT NULL,
+    "version_name" VARCHAR(50) NOT NULL,
+    "version_code" INTEGER NOT NULL,
+    "signing_sha256" TEXT NOT NULL,
+    "file_sha256" CHAR(64) NOT NULL,
+    "size_bytes" BIGINT NOT NULL,
+    "storage_key" TEXT NOT NULL,
+    "storage_provider" TEXT,
+    "bucket" TEXT,
+    "notes" VARCHAR(2000),
+    "is_current" BOOLEAN NOT NULL DEFAULT false,
+    "uploaded_by_id" UUID,
+    "created_at" TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "android_app_releases_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "android_app_releases_created_at_idx" ON "android_app_releases"("created_at");
+
+-- CreateIndex
+CREATE INDEX "android_app_releases_uploaded_by_id_idx" ON "android_app_releases"("uploaded_by_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "android_app_releases_package_name_version_code_key" ON "android_app_releases"("package_name", "version_code");
+
+-- AddForeignKey
+ALTER TABLE "android_app_releases" ADD CONSTRAINT "android_app_releases_uploaded_by_id_fkey" FOREIGN KEY ("uploaded_by_id") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- =============================================================================
+-- Raw-SQL constraints (intentional schema drift: Prisma cannot express these).
+-- Never declare android_app_releases_one_current_uniq_idx as @@unique and never
+-- replace it with a findFirst pre-check; make-current clears the old flag and
+-- sets the new one in one transaction, and the database rejects a second
+-- current row (P2002, mapped to 409 RELEASE_CURRENT_CONFLICT).
+-- =============================================================================
+
+-- At most one current release deployment-wide.
+CREATE UNIQUE INDEX "android_app_releases_one_current_uniq_idx" ON "android_app_releases" ((true)) WHERE "is_current";
+
+-- Push subscription platform: tags each Web Push subscription with the surface
+-- that registered it, so the `android_app` notification channel can target the
+-- Android companion alone. Existing rows are browser subscriptions. A constant
+-- default makes this a metadata-only ADD COLUMN (no table rewrite).
+
+-- AlterTable
+ALTER TABLE "push_subscriptions" ADD COLUMN "platform" TEXT NOT NULL DEFAULT 'browser';
+
+-- Prisma cannot express a CHECK constraint, so it lives here only (intentional
+-- schema drift, like the raw-SQL partial unique indexes). The contract's
+-- PUSH_SUBSCRIPTION_PLATFORMS mirrors it.
+ALTER TABLE "push_subscriptions"
+  ADD CONSTRAINT "push_subscriptions_platform_check"
+  CHECK ("platform" IN ('browser', 'android_app'));

package/host/prisma/migrations/20240101000033_open_job_reason/migration.sql

@@ -0,0 +1,16 @@
+-- Open the job-reason vocabulary: "jobs"."reason" goes from the closed
+-- "JobReason" enum ('upload', 'rerun', 'backfill') to plain TEXT, so an app can
+-- register its own reasons (`registerJobReason`) at zero migrations. Every
+-- stored value is kept as it is: the cast is the enum's own label.
+--
+-- No CHECK constraint on purpose: a row must outlive the reason that wrote it,
+-- and the allowed shape is the contract's `jobReasonSchema` pattern at the API
+-- edge. "jobs" has no row-level security, so no bypass is needed here.
+--
+-- The column type changes in place (a table rewrite, taken under an ACCESS
+-- EXCLUSIVE lock for its duration); no index covers "reason", so nothing is
+-- rebuilt besides the heap. The enum type is dropped last: nothing else uses it.
+ALTER TABLE "jobs" ALTER COLUMN "reason" TYPE TEXT USING "reason"::text;
+
+-- DropEnum
+DROP TYPE "JobReason";

package/host/prisma/migrations/20240101000034_ai_usage_feature/migration.sql

@@ -0,0 +1,37 @@
+-- =============================================================================
+-- Per-feature AI usage (PP-14.17, #935)
+-- =============================================================================
+--
+-- Persist the registered AI feature (`registerAiFeature`) a call was made for,
+-- so usage can be filtered and grouped per feature from the database:
+--
+--   ai_runs.feature          the feature a background run was started for
+--   ai_usage_events.feature  the feature a provider round trip was made for
+--
+-- Both columns are nullable plain TEXT: every row written before this
+-- migration, a call made without a feature, and a catalogue sync have none.
+-- No backfill, no default, no foreign key (a feature is code, not data, and a
+-- row must outlive the feature that wrote it).
+--
+-- ai_runs and ai_usage_events are organization tables under forced row-level
+-- security, so the migration runs with the bypass on for its transaction
+-- (set_config with is_local = true: transaction-local, never session-level).
+-- Adding a nullable column rewrites nothing; the index is built under the
+-- table's SHARE lock, which blocks writes to ai_usage_events for the length of
+-- the build (the table holds one row per provider round trip, an append-only
+-- ledger a retention purge keeps bounded).
+-- =============================================================================
+
+BEGIN;
+SELECT set_config('app.rls_bypass', 'on', true);
+
+-- AlterTable
+ALTER TABLE "ai_runs" ADD COLUMN     "feature" TEXT;
+
+-- AlterTable
+ALTER TABLE "ai_usage_events" ADD COLUMN     "feature" TEXT;
+
+-- CreateIndex
+CREATE INDEX "ai_usage_events_org_id_feature_created_at_idx" ON "ai_usage_events"("org_id", "feature", "created_at");
+
+COMMIT;

package/host/prisma/migrations/20240101000035_add_app_metadata/migration.sql

@@ -0,0 +1,49 @@
+-- =============================================================================
+-- App metadata on users and organizations; composite-key targets (PP-14.27, #945)
+-- =============================================================================
+--
+-- users.metadata and organizations.metadata are JSONB documents an app fills
+-- with namespaced fields of its own (registerUserMetadataSchema,
+-- registerOrganizationMetadataSchema): one top-level key per registered
+-- namespace, validated against that namespace's zod schema on write. They are
+-- not a secret store; a secret-named field is refused at registration.
+--
+-- NOT NULL DEFAULT '{}': every existing row gets an empty document; no backfill
+-- and no rewrite (a constant default is stored in the catalog, PostgreSQL 11+).
+--
+-- The size CHECK is a backstop, not the contract. The writer enforces 16 KiB of
+-- compact JSON per row; the constraint allows 32 KiB of jsonb text, because the
+-- text form of a jsonb value carries a space after every colon and comma, so
+-- the two measures differ by a few percent. A constraint that matched the
+-- writer's limit exactly would reject a document the writer accepted.
+--
+-- ai_runs and grants get a unique index on (id, org_id): the target of a
+-- composite foreign key (grant_id, org_id) from an organization-owned table an
+-- app adds, exactly as groups and storage_objects already are. A plain key on
+-- id alone would let a row of one organization point at another's, since a
+-- foreign-key check bypasses row-level security. No existing key changes.
+--
+-- ai_runs and grants are organization tables under forced row-level security,
+-- so the migration runs with the bypass on for its transaction (set_config with
+-- is_local = true: transaction-local, never session-level). users and
+-- organizations have no row-level security.
+-- =============================================================================
+
+BEGIN;
+SELECT set_config('app.rls_bypass', 'on', true);
+
+-- AlterTable
+ALTER TABLE "users" ADD COLUMN     "metadata" JSONB NOT NULL DEFAULT '{}';
+ALTER TABLE "users" ADD CONSTRAINT "users_metadata_size_check" CHECK (jsonb_typeof("metadata") = 'object' AND octet_length("metadata"::text) <= 32768);
+
+-- AlterTable
+ALTER TABLE "organizations" ADD COLUMN     "metadata" JSONB NOT NULL DEFAULT '{}';
+ALTER TABLE "organizations" ADD CONSTRAINT "organizations_metadata_size_check" CHECK (jsonb_typeof("metadata") = 'object' AND octet_length("metadata"::text) <= 32768);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "ai_runs_id_org_id_key" ON "ai_runs"("id", "org_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "grants_id_org_id_key" ON "grants"("id", "org_id");
+
+COMMIT;