@rakay-technology/kraft 0.7.4

package/dist/server/migrations/0111_host_port_claim.sql

@@ -0,0 +1,381 @@
+-- Durable, host-wide loopback-port reservations.
+--
+-- A port collision domain is a physical target, not an organization. Claims are
+-- also deliberately detached from project/service foreign keys: a stopped app,
+-- record-only delete, or cleanup-pending vhost must keep its reservation until
+-- routing has been explicitly removed.
+CREATE TABLE IF NOT EXISTS "host_port_claim" (
+  "id" text PRIMARY KEY NOT NULL,
+  "target_key" text NOT NULL,
+  "port" integer NOT NULL,
+  "project_id" text NOT NULL,
+  "service_id" text,
+  "container_port" integer,
+  "created_at" timestamp DEFAULT now() NOT NULL,
+  "updated_at" timestamp DEFAULT now() NOT NULL,
+  CONSTRAINT "ck_host_port_claim_target_key"
+    CHECK (
+      "target_key" = 'local'
+      OR "target_key" ~ '^host:[0-9a-f]{64}$'
+      OR ("target_key" LIKE 'server:%' AND length("target_key") > 7)
+    ),
+  CONSTRAINT "ck_host_port_claim_port"
+    CHECK ("port" BETWEEN 1 AND 65535),
+  CONSTRAINT "ck_host_port_claim_container_port"
+    CHECK ("container_port" IS NULL OR "container_port" BETWEEN 1 AND 65535)
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_host_port_claim_target_port"
+  ON "host_port_claim" ("target_key", "port");
+--> statement-breakpoint
+-- NULLS NOT DISTINCT expressed with portable sentinels: port zero is rejected
+-- above, and ids generated by Kraft are never empty strings.
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_host_port_claim_target_owner"
+  ON "host_port_claim" (
+    "target_key",
+    "project_id",
+    COALESCE("service_id", ''),
+    COALESCE("container_port", 0)
+  );
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_host_port_claim_project"
+  ON "host_port_claim" ("project_id");
+--> statement-breakpoint
+
+-- Build one canonical candidate set for the whole migration. This is the same
+-- set used to detect legacy ambiguity and to insert ordinary claims, so a source
+-- cannot be considered by one path and silently omitted by the other.
+--
+-- Legacy `deployTarget:server` snapshots could omit serverId. Runtime resolves
+-- those to the org's sole server; this backfill mirrors that exact org-scoped
+-- fallback and collapses an isLocal server row into the local bind namespace.
+WITH "sole_org_servers" AS (
+  SELECT
+    candidate."organization_id",
+    MIN(candidate."id") AS "server_id"
+  FROM "servers" candidate
+  WHERE candidate."organization_id" IS NOT NULL
+  GROUP BY candidate."organization_id"
+  HAVING COUNT(*) = 1
+),
+"target_inputs" AS (
+  SELECT
+    'project'::text AS "context_kind",
+    p."id" AS "context_id",
+    COALESCE(d."organization_id", p."organization_id") AS "organization_id",
+    NULLIF(d."meta" ->> 'serverId', '') AS "snapshot_server_id",
+    NULLIF(p."server_id", '') AS "project_server_id",
+    d."meta" ->> 'deployTarget' AS "deploy_target"
+  FROM "project" p
+  LEFT JOIN "deployment" d ON d."id" = p."active_deployment_id"
+
+  UNION ALL
+
+  SELECT
+    'deployment'::text AS "context_kind",
+    d."id" AS "context_id",
+    d."organization_id",
+    NULLIF(d."meta" ->> 'serverId', '') AS "snapshot_server_id",
+    NULLIF(p."server_id", '') AS "project_server_id",
+    d."meta" ->> 'deployTarget' AS "deploy_target"
+  FROM "deployment" d
+  INNER JOIN "project" p ON p."id" = d."project_id"
+  WHERE p."active_deployment_id" = d."id"
+    OR d."status" IN ('deploying', 'reconciling')
+),
+"resolved_target_ids" AS (
+  SELECT
+    input."context_kind",
+    input."context_id",
+    COALESCE(
+      input."snapshot_server_id",
+      input."project_server_id",
+      CASE
+        WHEN input."deploy_target" = 'server' THEN sole."server_id"
+        ELSE NULL
+      END
+    ) AS "server_id"
+  FROM "target_inputs" input
+  LEFT JOIN "sole_org_servers" sole
+    ON sole."organization_id" = input."organization_id"
+),
+"candidate_targets" AS (
+  SELECT
+    target."context_kind",
+    target."context_id",
+    CASE
+      WHEN target."server_id" IS NULL OR server."is_local" = true THEN 'local'
+      ELSE 'server:' || target."server_id"
+    END AS "target_key"
+  FROM "resolved_target_ids" target
+  LEFT JOIN "servers" server ON server."id" = target."server_id"
+),
+-- Parse each routed service map once. Only numeric container keys and 0110's
+-- explicit legacy sentinel are meaningful. Nested CASE expressions guarantee a
+-- malformed hand-edited JSON value is never cast before it passes the digit gate.
+"service_port_entries" AS (
+  SELECT
+    sd."id" AS "service_deployment_id",
+    target."target_key",
+    p."id" AS "project_id",
+    sd."service_id",
+    ports."container_key",
+    parsed."container_port",
+    parsed."host_port"
+  FROM "service_deployment" sd
+  INNER JOIN "deployment" d ON d."id" = sd."deployment_id"
+  INNER JOIN "project" p ON p."id" = d."project_id"
+  INNER JOIN "candidate_targets" target
+    ON target."context_kind" = 'deployment'
+    AND target."context_id" = d."id"
+  CROSS JOIN LATERAL jsonb_each_text(COALESCE(sd."host_ports", '{}'::jsonb))
+    AS ports("container_key", "host_port_text")
+  CROSS JOIN LATERAL (
+    SELECT
+      CASE
+        WHEN ports."container_key" ~ '^[0-9]{1,5}$' THEN
+          CASE
+            WHEN ports."container_key"::integer BETWEEN 1 AND 65535
+              THEN ports."container_key"::integer
+            ELSE NULL
+          END
+        ELSE NULL
+      END AS "container_port",
+      CASE
+        WHEN ports."host_port_text" ~ '^[0-9]{1,5}$' THEN
+          CASE
+            WHEN ports."host_port_text"::integer BETWEEN 1 AND 65535
+              THEN ports."host_port_text"::integer
+            ELSE NULL
+          END
+        ELSE NULL
+      END AS "host_port"
+  ) parsed
+  WHERE (
+      p."active_deployment_id" = d."id"
+      OR d."status" IN ('deploying', 'reconciling')
+    )
+    -- Cloud owns its own routing namespace. Persisted/imported hostPorts on a
+    -- cloud release are source-host cache, never a claim on this installation.
+    AND p."cloud_workspace_id" IS NULL
+    AND COALESCE(NULLIF(d."meta" ->> 'deployTarget', ''), '') <> 'cloud'
+    AND parsed."host_port" IS NOT NULL
+    AND (
+      parsed."container_port" IS NOT NULL
+      OR ports."container_key" = '__legacy__'
+    )
+),
+"candidate_claims" AS (
+  -- Single-app Docker compatibility pin. Cloud bindings are excluded for the
+  -- same reason as Compose maps above.
+  SELECT
+    'hpc_project_' || p."id" AS "id",
+    target."target_key",
+    p."host_port" AS "port",
+    p."id" AS "project_id",
+    NULL::text AS "service_id",
+    NULL::integer AS "container_port"
+  FROM "project" p
+  LEFT JOIN "deployment" d ON d."id" = p."active_deployment_id"
+  INNER JOIN "candidate_targets" target
+    ON target."context_kind" = 'project'
+    AND target."context_id" = p."id"
+  WHERE p."host_port" BETWEEN 1 AND 65535
+    AND p."cloud_workspace_id" IS NULL
+    AND COALESCE(NULLIF(d."meta" ->> 'deployTarget', ''), '') <> 'cloud'
+
+  UNION ALL
+
+  -- Bare web processes bind their declared app port directly.
+  SELECT
+    'hpc_bare_' || p."id" || '_' || p."port"::text AS "id",
+    target."target_key",
+    p."port" AS "port",
+    p."id" AS "project_id",
+    NULL::text AS "service_id",
+    p."port" AS "container_port"
+  FROM "project" p
+  INNER JOIN "deployment" d ON d."id" = p."active_deployment_id"
+  INNER JOIN "candidate_targets" target
+    ON target."context_kind" = 'project'
+    AND target."context_id" = p."id"
+  WHERE p."port" BETWEEN 1 AND 65535
+    AND p."cloud_workspace_id" IS NULL
+    AND COALESCE(NULLIF(d."meta" ->> 'deployTarget', ''), '') <> 'cloud'
+    AND COALESCE(
+      NULLIF(d."meta" ->> 'runtimeMode', ''),
+      NULLIF(p."runtime_mode", '')
+    ) = 'bare'
+    AND COALESCE(
+      NULLIF(d."meta" ->> 'workloadType', ''),
+      NULLIF(p."workload_type", ''),
+      CASE
+        WHEN COALESCE(NULLIF(d."meta" ->> 'hasServer', ''), p."has_server"::text) = 'false'
+          THEN 'static'
+        ELSE 'web'
+      END
+    ) = 'web'
+
+  UNION ALL
+
+  -- Complete Compose map. A numeric key supersedes 0110's targetless legacy
+  -- sentinel when both name the same host port.
+  SELECT
+    'hpc_service_' || entry."service_deployment_id" || '_' || entry."container_key" AS "id",
+    entry."target_key",
+    entry."host_port" AS "port",
+    entry."project_id",
+    entry."service_id",
+    entry."container_port"
+  FROM "service_port_entries" entry
+  WHERE NOT (
+    entry."container_port" IS NULL
+    AND EXISTS (
+      SELECT 1
+      FROM "service_port_entries" numeric_entry
+      WHERE numeric_entry."service_deployment_id" = entry."service_deployment_id"
+        AND numeric_entry."host_port" = entry."host_port"
+        AND numeric_entry."container_port" IS NOT NULL
+    )
+  )
+
+  UNION ALL
+
+  -- Scalar fallback only when the map did not already preserve this port.
+  SELECT
+    'hpc_service_' || sd."id" || '_scalar' AS "id",
+    target."target_key",
+    sd."host_port" AS "port",
+    p."id" AS "project_id",
+    sd."service_id",
+    NULL::integer AS "container_port"
+  FROM "service_deployment" sd
+  INNER JOIN "deployment" d ON d."id" = sd."deployment_id"
+  INNER JOIN "project" p ON p."id" = d."project_id"
+  INNER JOIN "candidate_targets" target
+    ON target."context_kind" = 'deployment'
+    AND target."context_id" = d."id"
+  WHERE (
+      p."active_deployment_id" = d."id"
+      OR d."status" IN ('deploying', 'reconciling')
+    )
+    AND p."cloud_workspace_id" IS NULL
+    AND COALESCE(NULLIF(d."meta" ->> 'deployTarget', ''), '') <> 'cloud'
+    AND sd."host_port" BETWEEN 1 AND 65535
+    AND NOT EXISTS (
+      SELECT 1
+      FROM "service_port_entries" entry
+      WHERE entry."service_deployment_id" = sd."id"
+        AND entry."host_port" = sd."host_port"
+    )
+),
+-- Duplicate records of the exact same claim (for example an active and carried
+-- row agreeing on one port) are harmless. Pick one deterministic id.
+"canonical_candidates" AS (
+  SELECT
+    MIN(candidate."id") AS "id",
+    candidate."target_key",
+    candidate."port",
+    candidate."project_id",
+    candidate."service_id",
+    candidate."container_port"
+  FROM "candidate_claims" candidate
+  GROUP BY
+    candidate."target_key",
+    candidate."port",
+    candidate."project_id",
+    candidate."service_id",
+    candidate."container_port"
+),
+"port_conflicts" AS (
+  SELECT candidate."target_key", candidate."port"
+  FROM "canonical_candidates" candidate
+  GROUP BY candidate."target_key", candidate."port"
+  HAVING COUNT(*) > 1
+),
+"owner_conflicts" AS (
+  SELECT
+    candidate."target_key",
+    candidate."project_id",
+    candidate."service_id",
+    candidate."container_port"
+  FROM "canonical_candidates" candidate
+  GROUP BY
+    candidate."target_key",
+    candidate."project_id",
+    candidate."service_id",
+    candidate."container_port"
+  HAVING COUNT(*) > 1
+),
+"ambiguous_ports" AS (
+  SELECT DISTINCT candidate."target_key", candidate."port"
+  FROM "canonical_candidates" candidate
+  WHERE EXISTS (
+      SELECT 1
+      FROM "port_conflicts" conflict
+      WHERE conflict."target_key" = candidate."target_key"
+        AND conflict."port" = candidate."port"
+    )
+    OR EXISTS (
+      SELECT 1
+      FROM "owner_conflicts" conflict
+      WHERE conflict."target_key" = candidate."target_key"
+        AND conflict."project_id" = candidate."project_id"
+        AND conflict."service_id" IS NOT DISTINCT FROM candidate."service_id"
+        AND conflict."container_port" IS NOT DISTINCT FROM candidate."container_port"
+    )
+),
+"final_claims" AS (
+  -- An unambiguous persisted claim keeps its real stable owner.
+  SELECT
+    candidate."id",
+    candidate."target_key",
+    candidate."port",
+    candidate."project_id",
+    candidate."service_id",
+    candidate."container_port"
+  FROM "canonical_candidates" candidate
+  WHERE NOT EXISTS (
+    SELECT 1
+    FROM "ambiguous_ports" ambiguous
+    WHERE ambiguous."target_key" = candidate."target_key"
+      AND ambiguous."port" = candidate."port"
+  )
+
+  UNION ALL
+
+  -- Ambiguity is fail-closed. The reserved identity cannot match a generated
+  -- project/service id, and container_port=port makes every owner tuple unique.
+  SELECT
+    'hpc_quarantine_' || ambiguous."target_key" || '_' || ambiguous."port"::text AS "id",
+    ambiguous."target_key",
+    ambiguous."port",
+    '__host_port_quarantine__' AS "project_id",
+    '__host_port_quarantine__' AS "service_id",
+    ambiguous."port" AS "container_port"
+  FROM "ambiguous_ports" ambiguous
+)
+INSERT INTO "host_port_claim" (
+  "id",
+  "target_key",
+  "port",
+  "project_id",
+  "service_id",
+  "container_port"
+)
+SELECT
+  claim."id",
+  claim."target_key",
+  claim."port",
+  claim."project_id",
+  claim."service_id",
+  claim."container_port"
+FROM "final_claims" claim
+ORDER BY
+  claim."target_key",
+  claim."port",
+  claim."project_id",
+  claim."service_id" NULLS FIRST,
+  claim."container_port" NULLS FIRST,
+  claim."id"
+ON CONFLICT DO NOTHING;

package/dist/server/migrations/0112_backup_run_execution_lease.sql

@@ -0,0 +1,12 @@
+-- Separate a backup run's durable worker liveness from its public FSM outcome.
+-- A timeout may record server_error while the original worker is still unwinding;
+-- project deletion must keep waiting until that worker's outermost finally closes
+-- this lease.
+ALTER TABLE "backup_run"
+  ADD COLUMN "execution_started_at" timestamp,
+  ADD COLUMN "execution_finished_at" timestamp;
+--> statement-breakpoint
+CREATE INDEX "idx_backup_run_execution_in_flight"
+  ON "backup_run" ("project_id")
+  WHERE "execution_started_at" IS NOT NULL
+    AND "execution_finished_at" IS NULL;

package/dist/server/migrations/0113_docker_migration_execution_lease.sql

@@ -0,0 +1,11 @@
+-- A parked migration can be resumed/cut over by any API replica. Persist the
+-- winning callback's liveness separately from its public FSM status so project
+-- deletion never mistakes an early terminal outcome for a stopped worker.
+ALTER TABLE "docker_migration_run"
+  ADD COLUMN "execution_started_at" timestamp,
+  ADD COLUMN "execution_finished_at" timestamp;
+--> statement-breakpoint
+CREATE INDEX "idx_docker_migration_execution_in_flight"
+  ON "docker_migration_run" ("project_id")
+  WHERE "execution_started_at" IS NOT NULL
+    AND "execution_finished_at" IS NULL;

package/dist/server/migrations/0114_build_session_execution_lease_index.sql

@@ -0,0 +1,6 @@
+-- Project deletion and deployment admission query the durable build-worker
+-- lease, including after the deployment status has already become terminal.
+CREATE INDEX "idx_build_session_live_project_deployment"
+  ON "build_session" ("project_id", "deployment_id")
+  WHERE "started_at" IS NOT NULL
+    AND "finished_at" IS NULL;

package/dist/server/migrations/0115_orphan_target_key.sql

@@ -0,0 +1,3 @@
+-- Keep deferred cleanup ordered by immutable physical target identity. Server
+-- rows are aliases and two aliases may reach the same bind namespace.
+ALTER TABLE "orphaned_resource" ADD COLUMN "target_key" text;

package/dist/server/migrations/0116_domain_ssl_challenge.sql

@@ -0,0 +1,2 @@
+-- Add ssl_challenge column to domain table for DNS-01 ACME challenge support
+ALTER TABLE "domain" ADD COLUMN IF NOT EXISTS "ssl_challenge" text DEFAULT 'http-01' NOT NULL;

package/dist/server/migrations/0117_github_installation_workspace_scope.sql

@@ -0,0 +1,24 @@
+-- GitHub App installations belong to an Kraft workspace, not to whichever
+-- user happened to connect them. Keep the most recently reconciled legacy row
+-- for each workspace/owner before installing the new uniqueness boundary.
+ALTER TABLE "git_installation" ADD COLUMN IF NOT EXISTS "suspended_at" timestamp;
+--> statement-breakpoint
+
+WITH ranked AS (
+  SELECT
+    id,
+    row_number() OVER (
+      PARTITION BY provider, lower(owner), organization_id
+      ORDER BY updated_at DESC, created_at DESC, id DESC
+    ) AS rn
+  FROM git_installation
+)
+DELETE FROM git_installation
+WHERE id IN (SELECT id FROM ranked WHERE rn > 1);
+--> statement-breakpoint
+
+DROP INDEX IF EXISTS "uq_git_installation_provider_owner_user";
+--> statement-breakpoint
+
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_git_installation_provider_owner_org"
+  ON "git_installation" ("provider", "owner", "organization_id");

package/dist/server/migrations/0118_git_sources.sql

@@ -0,0 +1,66 @@
+CREATE TABLE "git_source" (
+	"id" text PRIMARY KEY NOT NULL,
+	"organization_id" text NOT NULL,
+	"provider" text DEFAULT 'github' NOT NULL,
+	"name" text NOT NULL,
+	"app_id" integer NOT NULL,
+	"slug" text NOT NULL,
+	"client_id" text,
+	"app_name" text,
+	"avatar_url" text,
+	"api_base_url" text DEFAULT 'https://api.github.com' NOT NULL,
+	"web_base_url" text DEFAULT 'https://github.com' NOT NULL,
+	"webhook_url" text NOT NULL,
+	"secrets_enc" text NOT NULL,
+	"is_default" boolean DEFAULT false NOT NULL,
+	"status" text DEFAULT 'active' NOT NULL,
+	"last_verified_at" timestamp,
+	"last_error" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "git_source_organization_id_organization_id_fk"
+		FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id")
+		ON DELETE cascade ON UPDATE no action
+);
+--> statement-breakpoint
+CREATE INDEX "idx_git_source_org_provider"
+	ON "git_source" USING btree ("organization_id", "provider");
+--> statement-breakpoint
+CREATE UNIQUE INDEX "uq_git_source_org_provider_name"
+	ON "git_source" USING btree ("organization_id", "provider", lower("name"));
+--> statement-breakpoint
+CREATE UNIQUE INDEX "uq_git_source_org_provider_app"
+	ON "git_source" USING btree ("organization_id", "provider", "api_base_url", "app_id");
+--> statement-breakpoint
+CREATE UNIQUE INDEX "uq_git_source_org_provider_default"
+	ON "git_source" USING btree ("organization_id", "provider")
+	WHERE "git_source"."is_default" = true;
+--> statement-breakpoint
+ALTER TABLE "git_installation" ADD COLUMN "source_id" text;
+--> statement-breakpoint
+ALTER TABLE "git_installation" ADD CONSTRAINT "git_installation_source_id_git_source_id_fk"
+	FOREIGN KEY ("source_id") REFERENCES "public"."git_source"("id")
+	ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+DROP INDEX IF EXISTS "uq_git_installation_provider_owner_org";
+--> statement-breakpoint
+CREATE UNIQUE INDEX "uq_git_installation_provider_owner_org_legacy"
+	ON "git_installation" USING btree ("provider", "owner", "organization_id")
+	WHERE "git_installation"."source_id" IS NULL;
+--> statement-breakpoint
+CREATE UNIQUE INDEX "uq_git_installation_provider_owner_org_source"
+	ON "git_installation" USING btree ("provider", "owner", "organization_id", "source_id")
+	WHERE "git_installation"."source_id" IS NOT NULL;
+--> statement-breakpoint
+CREATE INDEX "idx_git_installation_source"
+	ON "git_installation" USING btree ("source_id", "installation_id");
+--> statement-breakpoint
+ALTER TABLE "github_install_state" ADD COLUMN "source_id" text;
+--> statement-breakpoint
+ALTER TABLE "github_install_state" ADD COLUMN "flow" text DEFAULT 'install' NOT NULL;
+--> statement-breakpoint
+ALTER TABLE "github_install_state" ADD COLUMN "payload" jsonb DEFAULT '{}'::jsonb NOT NULL;
+--> statement-breakpoint
+ALTER TABLE "github_install_state" ADD CONSTRAINT "github_install_state_source_id_git_source_id_fk"
+	FOREIGN KEY ("source_id") REFERENCES "public"."git_source"("id")
+	ON DELETE cascade ON UPDATE no action;

package/dist/server/migrations/0119_backup_run_batch.sql

@@ -0,0 +1,8 @@
+-- A project-default policy creates one child run per enabled service. Persist
+-- the enqueue identity so read models can aggregate exact siblings without
+-- co-mingling unrelated triggers that happened close together.
+ALTER TABLE "backup_run" ADD COLUMN "batch_id" text;
+--> statement-breakpoint
+CREATE INDEX "idx_backup_run_policy_batch"
+  ON "backup_run" ("policy_id", "batch_id")
+  WHERE "batch_id" IS NOT NULL AND "deleted_at" IS NULL;

package/dist/server/migrations/0120_domain_primary_unique.sql

@@ -0,0 +1,24 @@
+-- Older route-sync writes could mark a new primary without clearing the old
+-- one. Keep the most recently touched row: it is the best durable signal for
+-- the user's last selection, with creation time and id as deterministic ties.
+WITH ranked_primaries AS (
+  SELECT
+    "id",
+    row_number() OVER (
+      PARTITION BY "project_id"
+      ORDER BY "updated_at" DESC, "created_at" DESC, "id" DESC
+    ) AS "rank"
+  FROM "domain"
+  WHERE "project_id" IS NOT NULL AND "is_primary" = true
+)
+UPDATE "domain"
+SET "is_primary" = false, "updated_at" = now()
+WHERE "id" IN (
+  SELECT "id" FROM ranked_primaries WHERE "rank" > 1
+);
+--> statement-breakpoint
+-- Repository transactions make promotion orderly; this index makes the
+-- invariant impossible to bypass through another writer or a concurrent race.
+CREATE UNIQUE INDEX IF NOT EXISTS "uq_domain_project_primary"
+  ON "domain" ("project_id")
+  WHERE "is_primary" = true AND "project_id" IS NOT NULL;

package/dist/server/migrations/0121_host_port_claim_overlap.sql

@@ -0,0 +1,14 @@
+-- A routed workload may need a new loopback port while its previous route is
+-- still live. Keep both claims through that make-before-break window; the
+-- route-aware convergence pass removes the old claim only after a fresh edge
+-- scan proves no vhost still dials it. The target/port unique index remains the
+-- collision authority, so this does not permit two workloads to share a port.
+DROP INDEX IF EXISTS "uq_host_port_claim_target_owner";
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_host_port_claim_target_owner"
+  ON "host_port_claim" (
+    "target_key",
+    "project_id",
+    COALESCE("service_id", ''),
+    COALESCE("container_port", 0)
+  );

package/dist/server/migrations/0122_data_transfer_staging.sql

@@ -0,0 +1,45 @@
+-- Durable, bounded staging for browser imports and encrypted instance-to-instance
+-- transfers. Sessions survive API worker changes/restarts; chunks cascade away
+-- when the short-lived session is cleaned up.
+CREATE TABLE "data_transfer_session" (
+	"id" text PRIMARY KEY NOT NULL,
+	"kind" text NOT NULL,
+	"status" text DEFAULT 'ready' NOT NULL,
+	"mode" text,
+	"owner_user_id" text,
+	"token_hash" text,
+	"private_key" text,
+	"sender_public_key" text,
+	"claim_token" text,
+	"expected_bytes" bigint,
+	"expected_chunks" integer,
+	"result" jsonb,
+	"expires_at" timestamp NOT NULL,
+	"max_expires_at" timestamp NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "ck_data_transfer_session_kind" CHECK ("kind" IN ('direct', 'file')),
+	CONSTRAINT "ck_data_transfer_session_status" CHECK ("status" IN ('ready', 'uploading', 'consuming', 'complete', 'failed')),
+	CONSTRAINT "ck_data_transfer_session_mode" CHECK ("mode" IS NULL OR "mode" IN ('wipe', 'merge')),
+	CONSTRAINT "ck_data_transfer_session_expected_bytes" CHECK ("expected_bytes" IS NULL OR "expected_bytes" BETWEEN 1 AND 500000000),
+	CONSTRAINT "ck_data_transfer_session_expected_chunks" CHECK ("expected_chunks" IS NULL OR "expected_chunks" BETWEEN 1 AND 63)
+);
+--> statement-breakpoint
+CREATE TABLE "data_transfer_chunk" (
+	"session_id" text NOT NULL,
+	"chunk_index" integer NOT NULL,
+	"bytes" bytea NOT NULL,
+	"byte_length" integer NOT NULL,
+	"sha256" text NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "data_transfer_chunk_session_id_chunk_index_pk" PRIMARY KEY("session_id","chunk_index"),
+	CONSTRAINT "ck_data_transfer_chunk_index" CHECK ("chunk_index" BETWEEN 0 AND 62),
+	CONSTRAINT "ck_data_transfer_chunk_length" CHECK ("byte_length" BETWEEN 1 AND 8000064),
+	CONSTRAINT "ck_data_transfer_chunk_bytes" CHECK (octet_length("bytes") = "byte_length")
+);
+--> statement-breakpoint
+ALTER TABLE "data_transfer_chunk" ADD CONSTRAINT "data_transfer_chunk_session_id_data_transfer_session_id_fk" FOREIGN KEY ("session_id") REFERENCES "public"."data_transfer_session"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+CREATE INDEX "data_transfer_session_expires_idx" ON "data_transfer_session" USING btree ("expires_at");
+--> statement-breakpoint
+CREATE INDEX "data_transfer_session_owner_idx" ON "data_transfer_session" USING btree ("owner_user_id");

package/dist/server/migrations/0123_drop_cloud_infra.sql

@@ -0,0 +1,7 @@
+-- Drop the hosted-cloud ("Kraft Cloud" / Oblien) infrastructure:
+-- the project workspace binding, its uniqueness index, and the two
+-- cloud-only tables (handoff codes + GitHub webhook bindings).
+DROP INDEX IF EXISTS "uq_project_cloud_workspace_id";--> statement-breakpoint
+ALTER TABLE "project" DROP COLUMN IF EXISTS "cloud_workspace_id";--> statement-breakpoint
+DROP TABLE IF EXISTS "cloud_webhook_binding";--> statement-breakpoint
+DROP TABLE IF EXISTS "cloud_handoff_code";

package/dist/server/migrations/0124_mail_dmarc_report.sql

@@ -0,0 +1,23 @@
+CREATE TABLE "mail_dmarc_report" (
+	"id" text PRIMARY KEY NOT NULL,
+	"server_id" text NOT NULL,
+	"organization_id" text NOT NULL,
+	"domain" text NOT NULL,
+	"reporter" text NOT NULL,
+	"report_id" text NOT NULL,
+	"date_begin" timestamp NOT NULL,
+	"date_end" timestamp NOT NULL,
+	"messages" integer DEFAULT 0 NOT NULL,
+	"dkim_pass" integer DEFAULT 0 NOT NULL,
+	"spf_pass" integer DEFAULT 0 NOT NULL,
+	"full_pass" integer DEFAULT 0 NOT NULL,
+	"records" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "mail_dmarc_report" ADD CONSTRAINT "mail_dmarc_report_server_id_mail_servers_server_id_fk" FOREIGN KEY ("server_id") REFERENCES "public"."mail_servers"("server_id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+ALTER TABLE "mail_dmarc_report" ADD CONSTRAINT "mail_dmarc_report_organization_id_organization_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;
+--> statement-breakpoint
+CREATE UNIQUE INDEX "uq_mail_dmarc_report_stream" ON "mail_dmarc_report" USING btree ("server_id","reporter","report_id");--> statement-breakpoint
+CREATE INDEX "idx_mail_dmarc_report_server_domain" ON "mail_dmarc_report" USING btree ("server_id","domain","date_end");