@penclipai/db 2026.704.0 → 2026.714.0

package/dist/migration-safety-baseline.js

@@ -0,0 +1,150 @@
+export const MIGRATION_SAFETY_BASELINE = [
+    {
+        id: "2cfa16c89e561306",
+        rule: "large-create-index-not-concurrently",
+        migration: "0000_mature_masked_marvel.sql",
+        table: "activity_log",
+        reason: "Initial schema history predates the migration-safety guard.",
+    },
+    {
+        id: "2e21c87a27d0ecf3",
+        rule: "large-create-index-not-concurrently",
+        migration: "0000_mature_masked_marvel.sql",
+        table: "issue_comments",
+        reason: "Initial schema history predates the migration-safety guard.",
+    },
+    {
+        id: "3fa7b338f437c89d",
+        rule: "large-create-index-not-concurrently",
+        migration: "0000_mature_masked_marvel.sql",
+        table: "issue_comments",
+        reason: "Initial schema history predates the migration-safety guard.",
+    },
+    {
+        id: "26bf13d0e36e3bd0",
+        rule: "large-create-index-not-concurrently",
+        migration: "0001_fast_northstar.sql",
+        table: "agent_wakeup_requests",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "da73c844de91f262",
+        rule: "large-create-index-not-concurrently",
+        migration: "0001_fast_northstar.sql",
+        table: "agent_wakeup_requests",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "b86e70ea500d5d9e",
+        rule: "large-create-index-not-concurrently",
+        migration: "0001_fast_northstar.sql",
+        table: "agent_wakeup_requests",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "d12aeab5a11d37fe",
+        rule: "large-create-index-not-concurrently",
+        migration: "0001_fast_northstar.sql",
+        table: "heartbeat_run_events",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "80d2cc53747b47bc",
+        rule: "large-create-index-not-concurrently",
+        migration: "0001_fast_northstar.sql",
+        table: "heartbeat_run_events",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "8985fd1ec26c0449",
+        rule: "large-create-index-not-concurrently",
+        migration: "0001_fast_northstar.sql",
+        table: "heartbeat_run_events",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "06065c3f2e8bca76",
+        rule: "large-create-index-not-concurrently",
+        migration: "0003_shallow_quentin_quire.sql",
+        table: "activity_log",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "d0cb536e5b329013",
+        rule: "large-create-index-not-concurrently",
+        migration: "0003_shallow_quentin_quire.sql",
+        table: "activity_log",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "b84802ae05be9943",
+        rule: "large-create-index-not-concurrently",
+        migration: "0024_far_beast.sql",
+        table: "issue_comments",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "3eaba6ddfa29a678",
+        rule: "large-create-index-not-concurrently",
+        migration: "0024_far_beast.sql",
+        table: "issue_comments",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "2874b94c3f294f53",
+        rule: "large-create-index-not-concurrently",
+        migration: "0051_young_korg.sql",
+        table: "issue_comments",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "f0a44a3401b28d62",
+        rule: "large-create-index-not-concurrently",
+        migration: "0060_orange_annihilus.sql",
+        table: "issue_reference_mentions",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "f1fbb786a033df8d",
+        rule: "large-create-index-not-concurrently",
+        migration: "0060_orange_annihilus.sql",
+        table: "issue_reference_mentions",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "f74aa7dfb0152788",
+        rule: "large-create-index-not-concurrently",
+        migration: "0060_orange_annihilus.sql",
+        table: "issue_reference_mentions",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "3c1237481d6ee00d",
+        rule: "large-create-index-not-concurrently",
+        migration: "0060_orange_annihilus.sql",
+        table: "issue_reference_mentions",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "21cf0a7bb66a4058",
+        rule: "large-create-index-not-concurrently",
+        migration: "0060_orange_annihilus.sql",
+        table: "issue_reference_mentions",
+        reason: "Historical migration predates the migration-safety guard.",
+    },
+    {
+        id: "567b97176f9f06c3",
+        rule: "large-create-index-not-concurrently",
+        migration: "0132_issue_comment_derived_attribution_fast.sql",
+        table: "issue_comments",
+        reason: "Existing issue-attribution backfill branch uses a temporary support index before this guard landed.",
+    },
+    {
+        id: "38d8055cc228913d",
+        rule: "full-table-mutation-large-table",
+        migration: "0132_issue_comment_derived_attribution_fast.sql",
+        table: "issue_comments",
+        reason: "Batched DO-loop backfill with keyset pagination (LIMIT 5000 per batch); reviewed and approved as part of PAP-1505 fix. Already merged to master before this guard landed.",
+    },
+];
+//# sourceMappingURL=migration-safety-baseline.js.map

package/dist/migration-safety-baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-safety-baseline.js","sourceRoot":"","sources":["../src/migration-safety-baseline.ts"],"names":[],"mappings":"AAQA,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,+BAA+B;QAC1C,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,6DAA6D;KACtE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,+BAA+B;QAC1C,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,6DAA6D;KACtE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,+BAA+B;QAC1C,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,6DAA6D;KACtE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,uBAAuB;QAC9B,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,uBAAuB;QAC9B,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,uBAAuB;QAC9B,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,sBAAsB;QAC7B,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,sBAAsB;QAC7B,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,yBAAyB;QACpC,KAAK,EAAE,sBAAsB;QAC7B,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,oBAAoB;QAC/B,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,qBAAqB;QAChC,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,2BAA2B;QACtC,KAAK,EAAE,0BAA0B;QACjC,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,2BAA2B;QACtC,KAAK,EAAE,0BAA0B;QACjC,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,2BAA2B;QACtC,KAAK,EAAE,0BAA0B;QACjC,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,2BAA2B;QACtC,KAAK,EAAE,0BAA0B;QACjC,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,2BAA2B;QACtC,KAAK,EAAE,0BAA0B;QACjC,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,qCAAqC;QAC3C,SAAS,EAAE,iDAAiD;QAC5D,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,qGAAqG;KAC9G;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,iCAAiC;QACvC,SAAS,EAAE,iDAAiD;QAC5D,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,2KAA2K;KACpL;CACyD,CAAC"}

package/dist/migrations/0128_user_specific_secrets.sql

@@ -0,0 +1,178 @@
+CREATE TABLE IF NOT EXISTS "user_secret_definitions" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"key" text NOT NULL,
+	"name" text NOT NULL,
+	"description" text,
+	"status" text DEFAULT 'active' NOT NULL,
+	"provider" text DEFAULT 'local_encrypted' NOT NULL,
+	"managed_mode" text DEFAULT 'paperclip_managed' NOT NULL,
+	"provider_config_id" uuid,
+	"provider_metadata" jsonb,
+	"usage_guidance" text,
+	"created_by_agent_id" uuid,
+	"created_by_user_id" text,
+	"updated_by_agent_id" uuid,
+	"updated_by_user_id" text,
+	"deleted_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "user_secret_declarations" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"user_secret_definition_id" uuid NOT NULL,
+	"target_type" text NOT NULL,
+	"target_id" text NOT NULL,
+	"config_path" text NOT NULL,
+	"env_key" text NOT NULL,
+	"version_selector" text DEFAULT 'latest' NOT NULL,
+	"required" boolean DEFAULT true NOT NULL,
+	"allow_missing_override" boolean DEFAULT false NOT NULL,
+	"label" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "company_secrets" ADD COLUMN IF NOT EXISTS "scope" text DEFAULT 'company' NOT NULL;
+--> statement-breakpoint
+ALTER TABLE "company_secrets" ADD COLUMN IF NOT EXISTS "owner_user_id" text;
+--> statement-breakpoint
+ALTER TABLE "company_secrets" ADD COLUMN IF NOT EXISTS "user_secret_definition_id" uuid;
+--> statement-breakpoint
+UPDATE "company_secrets"
+SET "scope" = 'company'
+WHERE "scope" IS NULL;
+--> statement-breakpoint
+ALTER TABLE "secret_access_events" ALTER COLUMN "secret_id" DROP NOT NULL;
+--> statement-breakpoint
+ALTER TABLE "secret_access_events" ADD COLUMN IF NOT EXISTS "user_secret_definition_id" uuid;
+--> statement-breakpoint
+ALTER TABLE "secret_access_events" ADD COLUMN IF NOT EXISTS "secret_scope" text DEFAULT 'company' NOT NULL;
+--> statement-breakpoint
+ALTER TABLE "secret_access_events" ADD COLUMN IF NOT EXISTS "responsible_user_id" text;
+--> statement-breakpoint
+ALTER TABLE "secret_access_events" ADD COLUMN IF NOT EXISTS "credential_owner_user_id" text;
+--> statement-breakpoint
+ALTER TABLE "secret_access_events" ADD COLUMN IF NOT EXISTS "credential_subject_type" text;
+--> statement-breakpoint
+ALTER TABLE "secret_access_events" ADD COLUMN IF NOT EXISTS "credential_subject_id" text;
+--> statement-breakpoint
+ALTER TABLE "issues" ADD COLUMN IF NOT EXISTS "responsible_user_id" text;
+--> statement-breakpoint
+ALTER TABLE "heartbeat_runs" ADD COLUMN IF NOT EXISTS "responsible_user_id" text;
+--> statement-breakpoint
+ALTER TABLE "routines" ADD COLUMN IF NOT EXISTS "responsible_user_id" text;
+--> statement-breakpoint
+ALTER TABLE "routine_revisions" ADD COLUMN IF NOT EXISTS "responsible_user_id" text;
+--> statement-breakpoint
+ALTER TABLE "routine_runs" ADD COLUMN IF NOT EXISTS "responsible_user_id" text;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'user_secret_definitions_company_id_companies_id_fk') THEN
+		ALTER TABLE "user_secret_definitions" ADD CONSTRAINT "user_secret_definitions_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk') THEN
+		ALTER TABLE "user_secret_definitions" ADD CONSTRAINT "user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk" FOREIGN KEY ("provider_config_id") REFERENCES "public"."company_secret_provider_configs"("id") ON DELETE set null ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'user_secret_definitions_created_by_agent_id_agents_id_fk') THEN
+		ALTER TABLE "user_secret_definitions" ADD CONSTRAINT "user_secret_definitions_created_by_agent_id_agents_id_fk" FOREIGN KEY ("created_by_agent_id") REFERENCES "public"."agents"("id") ON DELETE set null ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'user_secret_definitions_updated_by_agent_id_agents_id_fk') THEN
+		ALTER TABLE "user_secret_definitions" ADD CONSTRAINT "user_secret_definitions_updated_by_agent_id_agents_id_fk" FOREIGN KEY ("updated_by_agent_id") REFERENCES "public"."agents"("id") ON DELETE set null ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'user_secret_declarations_company_id_companies_id_fk') THEN
+		ALTER TABLE "user_secret_declarations" ADD CONSTRAINT "user_secret_declarations_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk') THEN
+		ALTER TABLE "user_secret_declarations" ADD CONSTRAINT "user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk" FOREIGN KEY ("user_secret_definition_id") REFERENCES "public"."user_secret_definitions"("id") ON DELETE cascade ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'company_secrets_user_secret_definition_id_user_secret_definitions_id_fk') THEN
+		ALTER TABLE "company_secrets" ADD CONSTRAINT "company_secrets_user_secret_definition_id_user_secret_definitions_id_fk" FOREIGN KEY ("user_secret_definition_id") REFERENCES "public"."user_secret_definitions"("id") ON DELETE set null ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk') THEN
+		ALTER TABLE "secret_access_events" ADD CONSTRAINT "secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk" FOREIGN KEY ("user_secret_definition_id") REFERENCES "public"."user_secret_definitions"("id") ON DELETE set null ON UPDATE no action;
+	END IF;
+END $$;
+--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'company_secrets_scope_shape_check') THEN
+		ALTER TABLE "company_secrets" ADD CONSTRAINT "company_secrets_scope_shape_check" CHECK (
+			("scope" = 'company' AND "owner_user_id" IS NULL AND "user_secret_definition_id" IS NULL)
+			OR
+			("scope" = 'user' AND "owner_user_id" IS NOT NULL AND "user_secret_definition_id" IS NOT NULL)
+		);
+	END IF;
+END $$;
+--> statement-breakpoint
+DROP INDEX IF EXISTS "company_secrets_company_name_uq";
+--> statement-breakpoint
+DROP INDEX IF EXISTS "company_secrets_company_key_uq";
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_definitions_company_status_idx" ON "user_secret_definitions" USING btree ("company_id","status");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_definitions_company_provider_idx" ON "user_secret_definitions" USING btree ("company_id","provider");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_definitions_provider_config_idx" ON "user_secret_definitions" USING btree ("provider_config_id");
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "user_secret_definitions_company_key_uq" ON "user_secret_definitions" USING btree ("company_id","key") WHERE "user_secret_definitions"."deleted_at" IS NULL;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_declarations_company_idx" ON "user_secret_declarations" USING btree ("company_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_declarations_definition_idx" ON "user_secret_declarations" USING btree ("user_secret_definition_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_declarations_target_idx" ON "user_secret_declarations" USING btree ("company_id","target_type","target_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_declarations_company_required_idx" ON "user_secret_declarations" USING btree ("company_id","required");
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "user_secret_declarations_target_path_uq" ON "user_secret_declarations" USING btree ("company_id","target_type","target_id","config_path");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "user_secret_declarations_required_override_idx" ON "user_secret_declarations" USING btree ("company_id","allow_missing_override") WHERE "user_secret_declarations"."allow_missing_override" = true;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "company_secrets_company_scope_idx" ON "company_secrets" USING btree ("company_id","scope");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "company_secrets_company_owner_idx" ON "company_secrets" USING btree ("company_id","owner_user_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "company_secrets_user_definition_owner_idx" ON "company_secrets" USING btree ("company_id","user_secret_definition_id","owner_user_id");
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "company_secrets_company_name_uq" ON "company_secrets" USING btree ("company_id","name") WHERE "company_secrets"."scope" = 'company' AND "company_secrets"."deleted_at" IS NULL;
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "company_secrets_company_key_uq" ON "company_secrets" USING btree ("company_id","key") WHERE "company_secrets"."scope" = 'company' AND "company_secrets"."deleted_at" IS NULL;
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "company_secrets_user_definition_owner_uq" ON "company_secrets" USING btree ("company_id","user_secret_definition_id","owner_user_id") WHERE "company_secrets"."scope" = 'user' AND "company_secrets"."deleted_at" IS NULL;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "secret_access_events_user_definition_created_idx" ON "secret_access_events" USING btree ("user_secret_definition_id","created_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "secret_access_events_company_credential_owner_idx" ON "secret_access_events" USING btree ("company_id","credential_owner_user_id","created_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "issues_company_responsible_user_idx" ON "issues" USING btree ("company_id","responsible_user_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "heartbeat_runs_company_responsible_user_idx" ON "heartbeat_runs" USING btree ("company_id","responsible_user_id","created_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "routines_company_responsible_user_idx" ON "routines" USING btree ("company_id","responsible_user_id");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "routine_revisions_company_responsible_user_idx" ON "routine_revisions" USING btree ("company_id","responsible_user_id","created_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "routine_runs_company_responsible_user_idx" ON "routine_runs" USING btree ("company_id","responsible_user_id","created_at");

package/dist/migrations/0129_agent_api_key_responsible_user.sql

@@ -0,0 +1,41 @@
+ALTER TABLE "agent_api_keys" ADD COLUMN IF NOT EXISTS "responsible_user_id" text;
+--> statement-breakpoint
+UPDATE "agent_api_keys" AS key
+SET "responsible_user_id" = created_by."responsible_user_id"
+FROM (
+  SELECT DISTINCT ON (key_id)
+    key_id,
+    responsible_user_id
+  FROM (
+    SELECT
+      log.details ->> 'keyId' AS key_id,
+      log.actor_id AS responsible_user_id,
+      log.created_at
+    FROM "activity_log" AS log
+    WHERE log.action = 'agent.key_created'
+      AND log.actor_type = 'user'
+      AND log.details ->> 'keyId' IS NOT NULL
+      AND log.actor_id IS NOT NULL
+      AND log.actor_id <> ''
+
+    UNION ALL
+
+    SELECT
+      log.entity_id AS key_id,
+      request.approved_by_user_id AS responsible_user_id,
+      log.created_at
+    FROM "activity_log" AS log
+    INNER JOIN "join_requests" AS request
+      ON request.id::text = log.details ->> 'joinRequestId'
+    WHERE log.action = 'agent_api_key.claimed'
+      AND log.entity_type = 'agent_api_key'
+      AND log.entity_id IS NOT NULL
+      AND request.approved_by_user_id IS NOT NULL
+      AND request.approved_by_user_id <> ''
+  ) AS candidates
+  WHERE responsible_user_id IS NOT NULL
+    AND responsible_user_id <> ''
+  ORDER BY key_id, created_at ASC
+) AS created_by
+WHERE key.id::text = created_by.key_id
+  AND key.responsible_user_id IS NULL;

package/dist/migrations/0131_repair_run_responsible_user_context_refs.sql

@@ -0,0 +1,67 @@
+WITH extracted_run_refs AS (
+  SELECT
+    h."id" AS "run_id",
+    h."company_id",
+    NULLIF(h."context_snapshot" ->> 'issueId', '') AS "issue_ref",
+    1 AS "ref_priority"
+  FROM "heartbeat_runs" AS h
+  WHERE h."responsible_user_id" IS NULL
+    AND NULLIF(h."context_snapshot" ->> 'issueId', '') IS NOT NULL
+
+  UNION ALL
+
+  SELECT
+    h."id" AS "run_id",
+    h."company_id",
+    NULLIF(h."context_snapshot" ->> 'taskId', '') AS "issue_ref",
+    2 AS "ref_priority"
+  FROM "heartbeat_runs" AS h
+  WHERE h."responsible_user_id" IS NULL
+    AND NULLIF(h."context_snapshot" ->> 'taskId', '') IS NOT NULL
+),
+uuid_run_refs AS (
+  SELECT
+    "run_id",
+    "company_id",
+    "issue_ref"::uuid AS "issue_id",
+    "ref_priority"
+  FROM extracted_run_refs
+  WHERE "issue_ref" ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+),
+resolved_run_users AS (
+  SELECT DISTINCT ON ("run_id")
+    "run_id",
+    "responsible_user_id"
+  FROM (
+    SELECT
+      refs."run_id",
+      i."responsible_user_id",
+      refs."ref_priority",
+      1 AS "match_priority"
+    FROM uuid_run_refs AS refs
+    JOIN "issues" AS i
+      ON i."id" = refs."issue_id"
+     AND i."company_id" = refs."company_id"
+    WHERE i."responsible_user_id" IS NOT NULL
+
+    UNION ALL
+
+    SELECT
+      refs."run_id",
+      i."responsible_user_id",
+      refs."ref_priority",
+      2 AS "match_priority"
+    FROM extracted_run_refs AS refs
+    JOIN "issues" AS i
+      ON i."identifier" = refs."issue_ref"
+     AND i."company_id" = refs."company_id"
+    WHERE i."responsible_user_id" IS NOT NULL
+  ) AS candidates
+  ORDER BY "run_id", "ref_priority" ASC, "match_priority" ASC
+)
+UPDATE "heartbeat_runs" AS h
+SET "responsible_user_id" = resolved_run_users."responsible_user_id",
+    "updated_at" = now()
+FROM resolved_run_users
+WHERE h."id" = resolved_run_users."run_id"
+  AND h."responsible_user_id" IS NULL;

package/dist/migrations/0132_issue_comment_derived_attribution_fast.sql

@@ -0,0 +1,82 @@
+ALTER TABLE "issue_comments" ADD COLUMN IF NOT EXISTS "derived_author_agent_id" uuid;--> statement-breakpoint
+ALTER TABLE "issue_comments" ADD COLUMN IF NOT EXISTS "derived_created_by_run_id" uuid;--> statement-breakpoint
+ALTER TABLE "issue_comments" ADD COLUMN IF NOT EXISTS "derived_author_source" text;--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (
+		SELECT 1 FROM "pg_constraint" WHERE "conname" = 'issue_comments_derived_author_agent_id_agents_id_fk'
+	) THEN
+		ALTER TABLE "issue_comments" ADD CONSTRAINT "issue_comments_derived_author_agent_id_agents_id_fk" FOREIGN KEY ("derived_author_agent_id") REFERENCES "public"."agents"("id") ON DELETE set null ON UPDATE no action;
+	END IF;
+END $$;--> statement-breakpoint
+DO $$ BEGIN
+	IF NOT EXISTS (
+		SELECT 1 FROM "pg_constraint" WHERE "conname" = 'issue_comments_derived_created_by_run_id_heartbeat_runs_id_fk'
+	) THEN
+		ALTER TABLE "issue_comments" ADD CONSTRAINT "issue_comments_derived_created_by_run_id_heartbeat_runs_id_fk" FOREIGN KEY ("derived_created_by_run_id") REFERENCES "public"."heartbeat_runs"("id") ON DELETE set null ON UPDATE no action;
+	END IF;
+END $$;--> statement-breakpoint
+-- Temporary support for the forward-only backfill. The keyset loop below
+-- advances over this partial index by comment id, so each eligible slice is
+-- visited once instead of re-scanning issue_comments from the beginning on
+-- every batch.
+CREATE INDEX IF NOT EXISTS "issue_comments_derived_attribution_backfill_idx"
+	ON "issue_comments" USING btree ("id")
+	WHERE "author_agent_id" IS NULL
+		AND "derived_author_agent_id" IS NULL
+		AND "author_user_id" IS NOT NULL
+		AND "created_by_run_id" IS NOT NULL;--> statement-breakpoint
+ANALYZE "issue_comments";--> statement-breakpoint
+DO $$
+DECLARE
+	last_comment_id uuid := '00000000-0000-0000-0000-000000000000'::uuid;
+	next_last_comment_id uuid;
+BEGIN
+	LOOP
+		next_last_comment_id := NULL;
+
+		WITH batch AS MATERIALIZED (
+			SELECT c."id" AS comment_id, hr."agent_id", hr."id" AS run_id
+			FROM "issue_comments" c
+			JOIN "heartbeat_runs" hr ON hr."id" = c."created_by_run_id"
+			LEFT JOIN "user" u ON u."id" = c."author_user_id"
+			WHERE c."id" > last_comment_id
+				AND c."author_agent_id" IS NULL
+				AND c."derived_author_agent_id" IS NULL
+				AND c."author_user_id" IS NOT NULL
+				AND c."created_by_run_id" IS NOT NULL
+				AND (
+					c."author_user_id" = 'local-board'
+					OR u."id" IS NULL
+				)
+			ORDER BY c."id"
+			LIMIT 5000
+		),
+		updated AS (
+			UPDATE "issue_comments" c
+			SET "derived_author_agent_id" = b."agent_id",
+				"derived_created_by_run_id" = b."run_id",
+				"derived_author_source" = 'run_id'
+			FROM batch b
+			WHERE c."id" = b."comment_id"
+			RETURNING c."id"
+		)
+		SELECT b."comment_id"
+		INTO next_last_comment_id
+		FROM batch b
+		LEFT JOIN updated u ON u."id" = b."comment_id"
+		ORDER BY b."comment_id" DESC
+		LIMIT 1;
+
+		EXIT WHEN next_last_comment_id IS NULL;
+		last_comment_id := next_last_comment_id;
+	END LOOP;
+END $$;--> statement-breakpoint
+DROP INDEX IF EXISTS "issue_comments_derived_attribution_backfill_idx";--> statement-breakpoint
+-- Keep the Option-A cleanup at the end as well, matching the original 0126
+-- terminal state if any timing-tier rows are introduced before this migration
+-- is retried.
+UPDATE "issue_comments"
+SET "derived_author_agent_id" = NULL,
+	"derived_created_by_run_id" = NULL,
+	"derived_author_source" = NULL
+WHERE "derived_author_source" IN ('run_window_unique', 'run_window_agent_unique');

package/dist/migrations/0133_resource_membership_stars.sql

@@ -0,0 +1,7 @@
+ALTER TABLE "agent_memberships" ADD COLUMN IF NOT EXISTS "starred_at" timestamp with time zone;
+--> statement-breakpoint
+ALTER TABLE "project_memberships" ADD COLUMN IF NOT EXISTS "starred_at" timestamp with time zone;
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "agent_memberships_company_user_starred_idx" ON "agent_memberships" USING btree ("company_id","user_id","starred_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "project_memberships_company_user_starred_idx" ON "project_memberships" USING btree ("company_id","user_id","starred_at");