@package-broker/dist 2.0.0-rc.3 → 2.0.0-rc.4

package/node/migrations/core/0002_npm_publish.sql

@@ -0,0 +1,88 @@
+-- pb:phase expand
+
+ALTER TABLE source ADD COLUMN require_publish_approval INTEGER NOT NULL DEFAULT 0 CONSTRAINT source_publish_approval CHECK (require_publish_approval IN (0, 1));
+ALTER TABLE package ADD COLUMN new_project_access_mode TEXT NOT NULL DEFAULT 'none' CONSTRAINT package_access_mode CHECK (new_project_access_mode IN ('none', 'request'));
+ALTER TABLE package ADD COLUMN held_until_active INTEGER NOT NULL DEFAULT 0 CONSTRAINT package_held CHECK (held_until_active IN (0, 1));
+
+CREATE UNIQUE INDEX user_account_org_id ON user_account (id, org_id);
+
+CREATE TABLE publish_approval (
+  id TEXT NOT NULL PRIMARY KEY,
+  org_id TEXT NOT NULL REFERENCES organization (id),
+  package_id TEXT NOT NULL,
+  version_id TEXT NOT NULL UNIQUE,
+  source_id TEXT NOT NULL,
+  hold_approval INTEGER NOT NULL CONSTRAINT publish_hold_approval CHECK (hold_approval IN (0, 1)),
+  hold_scan INTEGER NOT NULL CONSTRAINT publish_hold_scan CHECK (hold_scan IN (0, 1)),
+  approval_state TEXT NOT NULL CONSTRAINT publish_approval_state CHECK (approval_state IN ('not_required', 'pending', 'approved', 'rejected', 'expired')),
+  scan_state TEXT NOT NULL CONSTRAINT publish_scan_state CHECK (scan_state IN ('not_required', 'queued', 'running', 'allowed', 'denied', 'failed')),
+  required_scanners_json TEXT NOT NULL DEFAULT '[]' CONSTRAINT publish_scanners_json CHECK (json_valid(required_scanners_json)),
+  scan_attempts INTEGER NOT NULL DEFAULT 0 CONSTRAINT publish_attempts CHECK (scan_attempts >= 0),
+  requested_by_type TEXT NOT NULL CONSTRAINT publish_requester_type CHECK (requested_by_type IN ('user', 'service')),
+  requested_by_id TEXT NOT NULL,
+  token_id TEXT NOT NULL,
+  route_project_id TEXT,
+  dist_tags_json TEXT NOT NULL DEFAULT '{}' CONSTRAINT publish_tags_json CHECK (json_valid(dist_tags_json)),
+  readme_pending INTEGER NOT NULL DEFAULT 0 CONSTRAINT publish_readme_pending CHECK (readme_pending IN (0, 1)),
+  decided_by_user_id TEXT,
+  decided_at TEXT,
+  decision_reason TEXT CONSTRAINT publish_reason_bytes CHECK (decision_reason IS NULL OR length(CAST(decision_reason AS BLOB)) <= 1000),
+  scan_verdict_json TEXT NOT NULL DEFAULT '[]' CONSTRAINT publish_verdict_json CHECK (json_valid(scan_verdict_json)),
+  expires_at TEXT NOT NULL,
+  revision INTEGER NOT NULL DEFAULT 1 CONSTRAINT publish_revision CHECK (revision >= 1),
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  CONSTRAINT publish_approval_hold CHECK ((hold_approval = 0) = (approval_state = 'not_required')),
+  CONSTRAINT publish_scan_hold CHECK ((hold_scan = 0) = (scan_state = 'not_required')),
+  CONSTRAINT publish_decision_time CHECK ((decided_at IS NOT NULL) = (approval_state IN ('approved', 'rejected', 'expired'))),
+  CONSTRAINT publish_decision_actor CHECK (approval_state NOT IN ('approved', 'rejected') OR decided_by_user_id IS NOT NULL),
+  CONSTRAINT publish_expiry_actor CHECK (approval_state <> 'expired' OR decided_by_user_id IS NULL),
+  FOREIGN KEY (org_id, package_id) REFERENCES package (org_id, id),
+  FOREIGN KEY (org_id, version_id) REFERENCES version (org_id, id),
+  FOREIGN KEY (org_id, source_id) REFERENCES source (org_id, id),
+  FOREIGN KEY (org_id, route_project_id) REFERENCES project (org_id, id),
+  FOREIGN KEY (org_id, decided_by_user_id) REFERENCES user_account (org_id, id)
+) STRICT;
+
+CREATE INDEX publish_approval_package ON publish_approval (org_id, package_id);
+CREATE INDEX publish_approval_list ON publish_approval (org_id, approval_state, id);
+CREATE INDEX publish_approval_expiry ON publish_approval (org_id, expires_at, id) WHERE approval_state = 'pending';
+CREATE INDEX publish_approval_scan ON publish_approval (org_id, scan_state, updated_at, id);
+
+CREATE TABLE package_access_request (
+  id TEXT NOT NULL PRIMARY KEY,
+  org_id TEXT NOT NULL REFERENCES organization (id),
+  package_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  state TEXT NOT NULL DEFAULT 'pending' CONSTRAINT access_state CHECK (state IN ('pending', 'approved', 'rejected', 'expired')),
+  requested_by_user_id TEXT NOT NULL,
+  reason TEXT CONSTRAINT access_reason_bytes CHECK (reason IS NULL OR length(CAST(reason AS BLOB)) <= 1000) CONSTRAINT access_reason_controls CHECK (reason IS NULL OR (instr(reason, char(0)) = 0 AND glob(char(42,91,1,2,3,4,5,6,7,8,11,12,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,127,93,42), reason) = 0)),
+  decided_by_user_id TEXT,
+  decided_at TEXT,
+  decision_reason TEXT CONSTRAINT access_decision_reason_bytes CHECK (decision_reason IS NULL OR length(CAST(decision_reason AS BLOB)) <= 1000) CONSTRAINT access_decision_reason_controls CHECK (decision_reason IS NULL OR (instr(decision_reason, char(0)) = 0 AND glob(char(42,91,1,2,3,4,5,6,7,8,11,12,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,127,93,42), decision_reason) = 0)),
+  expires_at TEXT NOT NULL,
+  revision INTEGER NOT NULL DEFAULT 1 CONSTRAINT access_revision CHECK (revision >= 1),
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  FOREIGN KEY (org_id, package_id) REFERENCES package (org_id, id),
+  FOREIGN KEY (org_id, project_id) REFERENCES project (org_id, id),
+  CONSTRAINT access_decision_actor CHECK (state NOT IN ('approved', 'rejected') OR decided_by_user_id IS NOT NULL),
+  CONSTRAINT access_expiry_actor CHECK (state <> 'expired' OR decided_by_user_id IS NULL),
+  CONSTRAINT access_decision_time CHECK ((decided_at IS NOT NULL) = (state IN ('approved', 'rejected', 'expired'))),
+  FOREIGN KEY (org_id, requested_by_user_id) REFERENCES user_account (org_id, id),
+  FOREIGN KEY (org_id, decided_by_user_id) REFERENCES user_account (org_id, id)
+) STRICT;
+
+CREATE UNIQUE INDEX package_access_request_pending ON package_access_request (package_id, project_id) WHERE state = 'pending';
+CREATE INDEX package_access_request_list ON package_access_request (org_id, state, id);
+CREATE INDEX package_access_request_expiry ON package_access_request (org_id, expires_at, id) WHERE state = 'pending';
+
+CREATE TABLE version_readme (
+  version_id TEXT NOT NULL PRIMARY KEY,
+  org_id TEXT NOT NULL REFERENCES organization (id),
+  filename TEXT NOT NULL,
+  body TEXT NOT NULL CONSTRAINT readme_body_bytes CHECK (length(CAST(body AS BLOB)) <= 524288),
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  CONSTRAINT readme_controls CHECK (instr(body, char(0)) = 0 AND glob(char(42,91,1,2,3,4,5,6,7,8,11,12,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,127,93,42), body) = 0),
+  FOREIGN KEY (org_id, version_id) REFERENCES version (org_id, id) ON DELETE CASCADE
+) STRICT;

package/node/migrations/core/0003_npm_identity.sql

@@ -0,0 +1,96 @@
+-- pb:phase expand
+
+CREATE TABLE trusted_publisher (
+  id TEXT NOT NULL PRIMARY KEY,
+  org_id TEXT NOT NULL REFERENCES organization (id),
+  package_name TEXT NOT NULL CONSTRAINT package_name_bytes CHECK (package_name IS NULL OR length(CAST(package_name AS BLOB)) <= 214) CONSTRAINT package_name_controls CHECK (package_name IS NULL OR (instr(package_name, char(0)) = 0 AND glob(char(42,91,1,2,3,4,5,6,7,8,11,12,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,127,93,42), package_name) = 0)),
+  repository_id TEXT NOT NULL CONSTRAINT repository_id_digits CHECK (length(repository_id) > 0 AND instr(repository_id, char(0)) = 0 AND repository_id NOT GLOB '*[^0-9]*'),
+  repository_owner_id TEXT NOT NULL CONSTRAINT repository_owner_id_digits CHECK (length(repository_owner_id) > 0 AND instr(repository_owner_id, char(0)) = 0 AND repository_owner_id NOT GLOB '*[^0-9]*'),
+  repository TEXT NOT NULL CONSTRAINT repository_bytes CHECK (repository IS NULL OR length(CAST(repository AS BLOB)) <= 140) CONSTRAINT repository_controls CHECK (repository IS NULL OR (instr(repository, char(0)) = 0 AND glob(char(42,91,1,2,3,4,5,6,7,8,11,12,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,127,93,42), repository) = 0)),
+  workflow TEXT NOT NULL CONSTRAINT workflow_bytes CHECK (workflow IS NULL OR length(CAST(workflow AS BLOB)) <= 255) CONSTRAINT workflow_controls CHECK (workflow IS NULL OR (instr(workflow, char(0)) = 0 AND glob(char(42,91,1,2,3,4,5,6,7,8,11,12,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,127,93,42), workflow) = 0)),
+  environment TEXT NOT NULL DEFAULT '' CONSTRAINT environment_bytes CHECK (environment IS NULL OR length(CAST(environment AS BLOB)) <= 255) CONSTRAINT environment_controls CHECK (environment IS NULL OR (instr(environment, char(0)) = 0 AND glob(char(42,91,1,2,3,4,5,6,7,8,11,12,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,127,93,42), environment) = 0)),
+  ref_pattern TEXT CONSTRAINT ref_pattern_bytes CHECK (ref_pattern IS NULL OR length(CAST(ref_pattern AS BLOB)) <= 255) CONSTRAINT ref_pattern_controls CHECK (ref_pattern IS NULL OR (instr(ref_pattern, char(0)) = 0 AND glob(char(42,91,1,2,3,4,5,6,7,8,11,12,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,127,93,42), ref_pattern) = 0)),
+  service_principal_id TEXT NOT NULL,
+  created_by_user_id TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  disabled_at TEXT,
+  last_used_at TEXT,
+  revision INTEGER NOT NULL DEFAULT 1 CONSTRAINT publisher_revision CHECK (revision >= 1),
+  FOREIGN KEY (org_id, service_principal_id) REFERENCES service_principal (org_id, id),
+  FOREIGN KEY (org_id, created_by_user_id) REFERENCES user_account (org_id, id)
+) STRICT;
+
+CREATE UNIQUE INDEX trusted_publisher_org_id ON trusted_publisher (org_id, id);
+CREATE UNIQUE INDEX trusted_publisher_binding ON trusted_publisher (org_id, package_name, repository_id, workflow, environment);
+
+ALTER TABLE token ADD COLUMN trusted_publisher_id TEXT REFERENCES trusted_publisher (id) ON DELETE SET NULL;
+ALTER TABLE token ADD COLUMN package_name TEXT CONSTRAINT package_name_bytes CHECK (package_name IS NULL OR length(CAST(package_name AS BLOB)) <= 214) CONSTRAINT package_name_controls CHECK (package_name IS NULL OR (instr(package_name, char(0)) = 0 AND glob(char(42,91,1,2,3,4,5,6,7,8,11,12,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,127,93,42), package_name) = 0));
+CREATE UNIQUE INDEX token_org_id ON token (id, org_id);
+CREATE INDEX token_trusted_publisher ON token (org_id, trusted_publisher_id) WHERE trusted_publisher_id IS NOT NULL;
+
+-- ADD COLUMN cannot add a composite foreign key to the existing token table.
+CREATE TRIGGER token_trusted_publisher_insert BEFORE INSERT ON token
+WHEN NEW.trusted_publisher_id IS NOT NULL AND NOT EXISTS (
+  SELECT 1 FROM trusted_publisher WHERE org_id = NEW.org_id AND id = NEW.trusted_publisher_id
+)
+BEGIN
+  SELECT RAISE(ABORT, 'FOREIGN KEY constraint failed');
+END;
+
+CREATE TRIGGER token_trusted_publisher_update BEFORE UPDATE OF org_id, trusted_publisher_id ON token
+WHEN NEW.trusted_publisher_id IS NOT NULL AND NOT EXISTS (
+  SELECT 1 FROM trusted_publisher WHERE org_id = NEW.org_id AND id = NEW.trusted_publisher_id
+)
+BEGIN
+  SELECT RAISE(ABORT, 'FOREIGN KEY constraint failed');
+END;
+
+CREATE TRIGGER trusted_publisher_token_org_update BEFORE UPDATE OF org_id ON trusted_publisher
+WHEN EXISTS (
+  SELECT 1 FROM token WHERE trusted_publisher_id = OLD.id AND org_id <> NEW.org_id
+)
+BEGIN
+  SELECT RAISE(ABORT, 'FOREIGN KEY constraint failed');
+END;
+
+CREATE TABLE npm_login_session (
+  id TEXT NOT NULL PRIMARY KEY,
+  selector_hash TEXT NOT NULL UNIQUE CONSTRAINT selector_hash_hex CHECK (length(CAST(selector_hash AS BLOB)) = 64 AND instr(selector_hash, char(0)) = 0 AND selector_hash NOT GLOB '*[^0-9a-f]*'),
+  done_hash TEXT NOT NULL UNIQUE CONSTRAINT done_hash_hex CHECK (length(CAST(done_hash AS BLOB)) = 64 AND instr(done_hash, char(0)) = 0 AND done_hash NOT GLOB '*[^0-9a-f]*'),
+  org_id TEXT NOT NULL REFERENCES organization (id),
+  project_id TEXT NOT NULL,
+  state TEXT NOT NULL DEFAULT 'pending' CONSTRAINT login_state CHECK (state IN ('pending', 'approved', 'consumed')),
+  cli_hostname TEXT CONSTRAINT cli_hostname_bytes CHECK (cli_hostname IS NULL OR length(CAST(cli_hostname AS BLOB)) <= 253) CONSTRAINT cli_hostname_controls CHECK (cli_hostname IS NULL OR (instr(cli_hostname, char(0)) = 0 AND glob(char(42,91,1,2,3,4,5,6,7,8,11,12,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,127,93,42), cli_hostname) = 0)),
+  source_ip TEXT CONSTRAINT source_ip_bytes CHECK (source_ip IS NULL OR length(CAST(source_ip AS BLOB)) <= 45) CONSTRAINT source_ip_controls CHECK (source_ip IS NULL OR (instr(source_ip, char(0)) = 0 AND glob(char(42,91,1,2,3,4,5,6,7,8,11,12,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,127,93,42), source_ip) = 0)),
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  expires_at TEXT NOT NULL,
+  user_id TEXT,
+  token_id TEXT,
+  token_ciphertext TEXT,
+  token_nonce TEXT,
+  token_key_version INTEGER,
+  consumed_at TEXT,
+  CONSTRAINT login_sealed_token CHECK ((token_ciphertext IS NULL AND token_nonce IS NULL AND token_key_version IS NULL) OR (token_ciphertext IS NOT NULL AND token_nonce IS NOT NULL AND token_key_version IS NOT NULL)),
+  CONSTRAINT login_consumed_time CHECK ((state = 'consumed') = (consumed_at IS NOT NULL)),
+  CONSTRAINT login_consumed_token CHECK (state <> 'consumed' OR token_ciphertext IS NULL),
+  CONSTRAINT login_approved CHECK (state <> 'approved' OR (user_id IS NOT NULL AND token_id IS NOT NULL AND token_ciphertext IS NOT NULL)),
+  CONSTRAINT login_pending CHECK (state <> 'pending' OR (user_id IS NULL AND token_id IS NULL AND token_ciphertext IS NULL)),
+  FOREIGN KEY (org_id, project_id) REFERENCES project (org_id, id),
+  FOREIGN KEY (org_id, user_id) REFERENCES user_account (org_id, id),
+  FOREIGN KEY (org_id, token_id) REFERENCES token (org_id, id)
+) STRICT;
+
+CREATE INDEX npm_login_session_pending ON npm_login_session (org_id, project_id, expires_at) WHERE state = 'pending';
+CREATE INDEX npm_login_session_expiry ON npm_login_session (org_id, expires_at);
+
+CREATE TABLE oidc_replay (
+  issuer TEXT NOT NULL,
+  jti TEXT NOT NULL,
+  org_id TEXT NOT NULL REFERENCES organization (id),
+  trusted_publisher_id TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  PRIMARY KEY (issuer, jti),
+  FOREIGN KEY (org_id, trusted_publisher_id) REFERENCES trusted_publisher (org_id, id) ON DELETE CASCADE
+) STRICT, WITHOUT ROWID;
+
+CREATE INDEX oidc_replay_expiry ON oidc_replay (org_id, expires_at);

package/node/migrations/core/0004_source_revision.sql

@@ -0,0 +1 @@
+ALTER TABLE source ADD COLUMN revision INTEGER NOT NULL DEFAULT 1 CHECK (revision >= 1);

package/node/migrations/core/0005_package_settings_revision.sql

@@ -0,0 +1 @@
+ALTER TABLE package ADD COLUMN settings_revision INTEGER NOT NULL DEFAULT 1 CHECK (settings_revision > 0);

package/node/migrations/core/0006_npm_login_handoff.sql

@@ -0,0 +1,39 @@
+-- pb:phase contract
+
+CREATE TABLE npm_login_session_handoff (
+  id TEXT NOT NULL PRIMARY KEY,
+  selector_hash TEXT NOT NULL UNIQUE CONSTRAINT selector_hash_hex CHECK (length(CAST(selector_hash AS BLOB)) = 64 AND instr(selector_hash, char(0)) = 0 AND selector_hash NOT GLOB '*[^0-9a-f]*'),
+  done_hash TEXT NOT NULL UNIQUE CONSTRAINT done_hash_hex CHECK (length(CAST(done_hash AS BLOB)) = 64 AND instr(done_hash, char(0)) = 0 AND done_hash NOT GLOB '*[^0-9a-f]*'),
+  org_id TEXT NOT NULL REFERENCES organization (id),
+  project_id TEXT NOT NULL,
+  state TEXT NOT NULL DEFAULT 'pending' CONSTRAINT login_state CHECK (state IN ('pending', 'approved', 'delivering', 'consumed')),
+  cli_hostname TEXT CONSTRAINT cli_hostname_bytes CHECK (cli_hostname IS NULL OR length(CAST(cli_hostname AS BLOB)) <= 253) CONSTRAINT cli_hostname_controls CHECK (cli_hostname IS NULL OR (instr(cli_hostname, char(0)) = 0 AND glob(char(42,91,1,2,3,4,5,6,7,8,11,12,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,127,93,42), cli_hostname) = 0)),
+  source_ip TEXT CONSTRAINT source_ip_bytes CHECK (source_ip IS NULL OR length(CAST(source_ip AS BLOB)) <= 45) CONSTRAINT source_ip_controls CHECK (source_ip IS NULL OR (instr(source_ip, char(0)) = 0 AND glob(char(42,91,1,2,3,4,5,6,7,8,11,12,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,127,93,42), source_ip) = 0)),
+  created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+  expires_at TEXT NOT NULL,
+  user_id TEXT,
+  token_id TEXT,
+  token_ciphertext TEXT,
+  token_nonce TEXT,
+  token_key_version INTEGER,
+  consumed_at TEXT,
+  delivering_at TEXT,
+  CONSTRAINT login_delivering CHECK ((state = 'delivering') = (delivering_at IS NOT NULL)),
+  CONSTRAINT login_delivery_token CHECK (state <> 'delivering' OR (user_id IS NOT NULL AND token_id IS NOT NULL AND token_ciphertext IS NULL)),
+  CONSTRAINT login_sealed_token CHECK ((token_ciphertext IS NULL AND token_nonce IS NULL AND token_key_version IS NULL) OR (token_ciphertext IS NOT NULL AND token_nonce IS NOT NULL AND token_key_version IS NOT NULL)),
+  CONSTRAINT login_consumed_time CHECK ((state = 'consumed') = (consumed_at IS NOT NULL)),
+  CONSTRAINT login_consumed_token CHECK (state <> 'consumed' OR token_ciphertext IS NULL),
+  CONSTRAINT login_approved CHECK (state <> 'approved' OR (user_id IS NOT NULL AND token_id IS NOT NULL AND token_ciphertext IS NOT NULL)),
+  CONSTRAINT login_pending CHECK (state <> 'pending' OR (user_id IS NULL AND token_id IS NULL AND token_ciphertext IS NULL)),
+  FOREIGN KEY (org_id, project_id) REFERENCES project (org_id, id),
+  FOREIGN KEY (org_id, user_id) REFERENCES user_account (org_id, id),
+  FOREIGN KEY (org_id, token_id) REFERENCES token (org_id, id)
+) STRICT;
+
+INSERT INTO npm_login_session_handoff (id, selector_hash, done_hash, org_id, project_id, state, cli_hostname, source_ip, created_at, expires_at, user_id, token_id, token_ciphertext, token_nonce, token_key_version, consumed_at)
+SELECT id, selector_hash, done_hash, org_id, project_id, state, cli_hostname, source_ip, created_at, expires_at, user_id, token_id, token_ciphertext, token_nonce, token_key_version, consumed_at FROM npm_login_session;
+DROP TABLE npm_login_session;
+ALTER TABLE npm_login_session_handoff RENAME TO npm_login_session;
+CREATE INDEX npm_login_session_pending ON npm_login_session (org_id, project_id, expires_at) WHERE state = 'pending';
+CREATE INDEX npm_login_session_expiry ON npm_login_session (org_id, expires_at);
+CREATE INDEX npm_login_session_delivery ON npm_login_session (org_id, delivering_at) WHERE state = 'delivering';

package/node/migrations/core/0007_npm_vcs_build_outcomes.sql

@@ -0,0 +1,10 @@
+CREATE TABLE npm_vcs_build_outcome (
+  org_id TEXT NOT NULL REFERENCES organization(id) ON DELETE CASCADE,
+  version_id TEXT NOT NULL,
+  source_ref TEXT NOT NULL CHECK(length(source_ref) = 40),
+  packing_policy TEXT NOT NULL,
+  retry_generation INTEGER NOT NULL DEFAULT 0 CHECK(retry_generation >= 0),
+  outcome TEXT CHECK(outcome IN ('too_large', 'unsupported_files_pattern', 'invalid_packlist', 'invalid_tarball', 'archive_changed', 'internal')),
+  PRIMARY KEY (org_id, version_id, source_ref, packing_policy),
+  FOREIGN KEY (version_id, org_id) REFERENCES version(id, org_id) ON DELETE CASCADE
+) STRICT;

package/node/migrations/core/0008_registry_policy.sql

@@ -0,0 +1,49 @@
+-- pb:phase expand
+
+CREATE TABLE registry_policy_rule (
+  id TEXT NOT NULL PRIMARY KEY,
+  org_id TEXT NOT NULL REFERENCES organization (id),
+  project_id TEXT,
+  ecosystem TEXT NOT NULL CHECK (ecosystem IN ('npm', 'composer')),
+  package_key TEXT,
+  kind TEXT NOT NULL CHECK (kind IN ('min_age', 'block', 'allowlist', 'quarantine', 'client_floor')),
+  min_age_seconds INTEGER CHECK (min_age_seconds BETWEEN 0 AND 315360000),
+  client_family TEXT CHECK (client_family IN ('npm', 'pnpm', 'yarn', 'composer')),
+  client_min_version TEXT,
+  deny_unknown INTEGER NOT NULL DEFAULT 0 CHECK (deny_unknown IN (0, 1)),
+  reason_code TEXT NOT NULL CHECK (reason_code IN ('malware', 'security_review', 'compatibility', 'organization_policy')),
+  incident_id TEXT,
+  expires_at TEXT CHECK (expires_at IS NULL OR (length(expires_at) = 24 AND strftime('%Y-%m-%dT%H:%M:%fZ', expires_at) IS expires_at)),
+  expiry_audited_at TEXT CHECK (expiry_audited_at IS NULL OR (length(expiry_audited_at) = 24 AND strftime('%Y-%m-%dT%H:%M:%fZ', expiry_audited_at) IS expiry_audited_at)),
+  disabled_at TEXT CHECK (disabled_at IS NULL OR (length(disabled_at) = 24 AND strftime('%Y-%m-%dT%H:%M:%fZ', disabled_at) IS disabled_at)),
+  disabled_reason TEXT CHECK (disabled_reason IN ('false_positive', 'emergency_compatibility', 'superseded', 'other')),
+  revision INTEGER NOT NULL DEFAULT 1 CHECK (revision >= 1),
+  created_at TEXT NOT NULL CHECK (length(created_at) = 24 AND strftime('%Y-%m-%dT%H:%M:%fZ', created_at) IS created_at),
+  updated_at TEXT NOT NULL CHECK (length(updated_at) = 24 AND strftime('%Y-%m-%dT%H:%M:%fZ', updated_at) IS updated_at),
+  UNIQUE (org_id, id),
+  FOREIGN KEY (org_id, project_id) REFERENCES project (org_id, id),
+  CHECK ((kind = 'min_age' AND min_age_seconds IS NOT NULL) OR (kind <> 'min_age' AND min_age_seconds IS NULL)),
+  CHECK ((kind = 'client_floor' AND client_family IS NOT NULL AND client_min_version IS NOT NULL AND package_key IS NULL) OR (kind <> 'client_floor' AND client_family IS NULL AND client_min_version IS NULL)),
+  CHECK (kind = 'client_floor' OR deny_unknown = 0),
+  CHECK (kind NOT IN ('block', 'allowlist', 'quarantine') OR package_key IS NOT NULL),
+  CHECK (kind <> 'quarantine' OR (project_id IS NULL AND expires_at IS NULL AND reason_code = 'malware')),
+  CHECK (client_family IS NULL OR (ecosystem = 'composer' AND client_family = 'composer') OR (ecosystem = 'npm' AND client_family IN ('npm', 'pnpm', 'yarn'))),
+  CHECK (expires_at IS NULL OR expires_at > created_at),
+  CHECK (updated_at >= created_at),
+  CHECK ((disabled_at IS NULL) = (disabled_reason IS NULL)),
+  CHECK (disabled_at IS NULL OR disabled_at >= created_at),
+  CHECK (package_key IS NULL OR length(CAST(package_key AS BLOB)) BETWEEN 1 AND 512),
+  CHECK (client_min_version IS NULL OR length(client_min_version) BETWEEN 5 AND 64),
+  CHECK (incident_id IS NULL OR length(incident_id) = 26)
+) STRICT;
+
+CREATE INDEX registry_policy_scope ON registry_policy_rule (org_id, ecosystem, project_id, package_key) WHERE disabled_at IS NULL;
+CREATE INDEX registry_policy_expiry ON registry_policy_rule (org_id, expires_at, id) WHERE expires_at IS NOT NULL AND disabled_at IS NULL;
+
+CREATE TABLE registry_policy_version (
+  org_id TEXT NOT NULL REFERENCES organization (id),
+  rule_id TEXT NOT NULL,
+  version_normalized TEXT NOT NULL CHECK (length(CAST(version_normalized AS BLOB)) BETWEEN 1 AND 512),
+  PRIMARY KEY (org_id, rule_id, version_normalized),
+  FOREIGN KEY (org_id, rule_id) REFERENCES registry_policy_rule (org_id, id)
+) STRICT, WITHOUT ROWID;

package/node/migrations/core/0009_npm_notifications.sql

@@ -0,0 +1,108 @@
+-- pb:phase expand
+
+CREATE UNIQUE INDEX credential_notification_scope ON credential (org_id, project_id, id);
+
+CREATE TABLE notification_endpoint (
+  org_id TEXT NOT NULL REFERENCES organization (id),
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  name TEXT NOT NULL CONSTRAINT notification_endpoint_name CHECK (length(name) BETWEEN 1 AND 80),
+  method TEXT NOT NULL CONSTRAINT notification_endpoint_method CHECK (method IN ('POST', 'PUT')),
+  events_json TEXT NOT NULL CONSTRAINT notification_endpoint_events CHECK (json_valid(events_json) AND json_type(events_json) = 'array' AND json_array_length(events_json) >= 1 AND length(events_json) <= 256),
+  package_pattern TEXT NOT NULL CONSTRAINT notification_endpoint_pattern CHECK (length(package_pattern) BETWEEN 1 AND 50),
+  credential_id TEXT NOT NULL,
+  headers_configured INTEGER NOT NULL DEFAULT 0 CONSTRAINT notification_endpoint_headers CHECK (headers_configured IN (0, 1)),
+  template_configured INTEGER NOT NULL DEFAULT 0 CONSTRAINT notification_endpoint_template CHECK (template_configured IN (0, 1)),
+  revision INTEGER NOT NULL DEFAULT 1 CONSTRAINT notification_endpoint_revision CHECK (revision >= 1),
+  state TEXT NOT NULL DEFAULT 'disabled' CONSTRAINT notification_endpoint_state CHECK (state IN ('enabled', 'disabled', 'deleted')),
+  disabled_reason TEXT CONSTRAINT notification_endpoint_reason CHECK (disabled_reason IN ('manual', 'configuration_changed', 'failures', 'credentials', 'policy', 'gone')),
+  failure_streak INTEGER NOT NULL DEFAULT 0 CONSTRAINT notification_endpoint_streak CHECK (failure_streak >= 0),
+  last_op_id TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (org_id, id),
+  UNIQUE (org_id, project_id, id),
+  CONSTRAINT notification_endpoint_enabled CHECK (state <> 'enabled' OR disabled_reason IS NULL),
+  FOREIGN KEY (org_id, project_id) REFERENCES project (org_id, id),
+  FOREIGN KEY (org_id, project_id, credential_id) REFERENCES credential (org_id, project_id, id)
+) STRICT;
+
+CREATE INDEX notification_endpoint_project ON notification_endpoint (org_id, project_id, state, id);
+
+CREATE TABLE notification_event (
+  org_id TEXT NOT NULL REFERENCES organization (id),
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  operation_id TEXT NOT NULL,
+  ordinal INTEGER NOT NULL DEFAULT 0 CONSTRAINT notification_event_ordinal CHECK (ordinal >= 0),
+  event_type TEXT NOT NULL CONSTRAINT notification_event_type CHECK (event_type IN ('npm.package.published', 'npm.package.released', 'npm.package.unpublished', 'npm.package.deprecation_changed', 'npm.package.dist_tag_changed')),
+  source_id TEXT NOT NULL,
+  package_key TEXT NOT NULL CONSTRAINT notification_event_key CHECK (length(CAST(package_key AS BLOB)) BETWEEN 1 AND 512),
+  payload_json TEXT NOT NULL CONSTRAINT notification_event_payload CHECK (json_valid(payload_json) AND length(CAST(payload_json AS BLOB)) <= 16384),
+  occurred_at TEXT NOT NULL,
+  dispatched_at TEXT,
+  dispatch_generation INTEGER NOT NULL DEFAULT 1 CONSTRAINT notification_event_generation CHECK (dispatch_generation >= 1),
+  PRIMARY KEY (org_id, id),
+  UNIQUE (org_id, project_id, id),
+  UNIQUE (org_id, operation_id, event_type, ordinal),
+  FOREIGN KEY (org_id, project_id) REFERENCES project (org_id, id)
+) STRICT;
+
+CREATE INDEX notification_event_dispatch ON notification_event (org_id, dispatched_at, id);
+CREATE INDEX notification_event_retention ON notification_event (org_id, occurred_at, id);
+
+CREATE TABLE notification_delivery (
+  org_id TEXT NOT NULL REFERENCES organization (id),
+  project_id TEXT NOT NULL,
+  id TEXT NOT NULL,
+  event_id TEXT NOT NULL,
+  endpoint_id TEXT NOT NULL,
+  endpoint_revision INTEGER NOT NULL CONSTRAINT notification_delivery_endpoint_revision CHECK (endpoint_revision >= 1),
+  configuration_credential_id TEXT NOT NULL,
+  body_credential_id TEXT,
+  state TEXT NOT NULL DEFAULT 'pending' CONSTRAINT notification_delivery_state CHECK (state IN ('pending', 'sending', 'delivered', 'failed', 'cancelled')),
+  attempts INTEGER NOT NULL DEFAULT 0 CONSTRAINT notification_delivery_attempts CHECK (attempts BETWEEN 0 AND 8),
+  job_generation INTEGER NOT NULL DEFAULT 1 CONSTRAINT notification_delivery_generation CHECK (job_generation >= 1),
+  active_job_id TEXT,
+  active_fence INTEGER CONSTRAINT notification_delivery_fence CHECK (active_fence >= 1),
+  revision INTEGER NOT NULL DEFAULT 1 CONSTRAINT notification_delivery_revision CHECK (revision >= 1),
+  next_attempt_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  last_status INTEGER CONSTRAINT notification_delivery_status CHECK (last_status BETWEEN 100 AND 599),
+  outcome_code TEXT CONSTRAINT notification_delivery_outcome CHECK (outcome_code IN ('ok', 'network', 'timeout', 'http_retry', 'http_permanent', 'redirect', 'policy', 'credentials', 'template', 'unknown', 'expired', 'attempt_limit', 'disabled', 'superseded', 'project_inactive', 'admission_lost', 'deleted')),
+  created_at TEXT NOT NULL,
+  finished_at TEXT,
+  PRIMARY KEY (org_id, id),
+  UNIQUE (org_id, event_id, endpoint_id),
+  UNIQUE (org_id, project_id, id),
+  FOREIGN KEY (org_id, project_id, event_id) REFERENCES notification_event (org_id, project_id, id),
+  FOREIGN KEY (org_id, project_id, endpoint_id) REFERENCES notification_endpoint (org_id, project_id, id),
+  FOREIGN KEY (org_id, project_id, configuration_credential_id) REFERENCES credential (org_id, project_id, id),
+  FOREIGN KEY (org_id, project_id, body_credential_id) REFERENCES credential (org_id, project_id, id),
+  CONSTRAINT notification_delivery_finished CHECK ((state IN ('delivered', 'failed', 'cancelled')) = (finished_at IS NOT NULL)),
+  CONSTRAINT notification_delivery_sending CHECK (state <> 'sending' OR (active_job_id IS NOT NULL AND active_fence IS NOT NULL))
+) STRICT;
+
+CREATE INDEX notification_delivery_due ON notification_delivery (org_id, state, next_attempt_at, id);
+CREATE INDEX notification_delivery_history ON notification_delivery (org_id, project_id, endpoint_id, created_at, id);
+CREATE INDEX notification_delivery_retention ON notification_delivery (org_id, finished_at, id);
+
+CREATE TABLE notification_attempt (
+  org_id TEXT NOT NULL REFERENCES organization (id),
+  project_id TEXT NOT NULL,
+  delivery_id TEXT NOT NULL,
+  attempt INTEGER NOT NULL CONSTRAINT notification_attempt_number CHECK (attempt BETWEEN 1 AND 8),
+  job_id TEXT NOT NULL,
+  fence INTEGER NOT NULL CONSTRAINT notification_attempt_fence CHECK (fence >= 1),
+  outcome TEXT NOT NULL CONSTRAINT notification_attempt_outcome CHECK (outcome IN ('started', 'delivered', 'retry', 'failed', 'unknown')),
+  outcome_code TEXT CONSTRAINT notification_attempt_code CHECK (outcome_code IN ('ok', 'network', 'timeout', 'http_retry', 'http_permanent', 'redirect', 'policy', 'credentials', 'template', 'unknown')),
+  status INTEGER CONSTRAINT notification_attempt_status CHECK (status BETWEEN 100 AND 599),
+  duration_ms INTEGER CONSTRAINT notification_attempt_duration CHECK (duration_ms >= 0),
+  started_at TEXT NOT NULL,
+  finished_at TEXT,
+  PRIMARY KEY (org_id, delivery_id, attempt),
+  FOREIGN KEY (org_id, project_id, delivery_id) REFERENCES notification_delivery (org_id, project_id, id) ON DELETE CASCADE,
+  CONSTRAINT notification_attempt_finished CHECK ((outcome = 'started') = (finished_at IS NULL))
+) STRICT;
+
+CREATE INDEX notification_attempt_started ON notification_attempt (org_id, outcome, started_at, delivery_id);