@stackbone/cli 0.1.0-alpha.0

package/migrations/0001_runs.sql

@@ -0,0 +1,150 @@
+-- 0001_runs.sql — schema and tables for the run-level surface of Studio.
+-- Spec: docs/arquitectura/specs/stackbone-agent-protocol-v1.md §6 (runs, run_steps).
+-- ADR:  docs/arquitectura/decisiones/2026-05-03-stackbone-studio-datapath-y-scope-mvp.md §D2/D7/D9.
+
+CREATE SCHEMA IF NOT EXISTS stackbone_platform;
+
+CREATE TABLE IF NOT EXISTS stackbone_platform.runs (
+    id                  uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+    -- Nullable in local (single-agent emulator), required in cloud.
+    agent_id            text,
+    workspace_id        text,
+    trigger             text        NOT NULL DEFAULT 'manual'
+                                    CHECK (trigger IN ('manual', 'webhook', 'cron', 'event')),
+    status              text        NOT NULL DEFAULT 'running'
+                                    CHECK (status IN ('running', 'done', 'failed', 'interrupted')),
+    trace_id            text,
+    is_playground       boolean     NOT NULL DEFAULT false,
+    input               jsonb,
+    output              jsonb,
+    error               jsonb,
+    cost_estimated_usd  numeric,
+    metadata            jsonb       NOT NULL DEFAULT '{}'::jsonb,
+    created_at          timestamptz NOT NULL DEFAULT now(),
+    started_at          timestamptz,
+    finished_at         timestamptz,
+    duration_ms         integer
+);
+
+CREATE INDEX IF NOT EXISTS runs_workspace_started_idx
+    ON stackbone_platform.runs (workspace_id, started_at DESC NULLS LAST);
+
+-- Drives the cursor pagination from §5 of the protocol spec: order by
+-- created_at desc with id as the tie-break for runs created within the same
+-- millisecond.
+CREATE INDEX IF NOT EXISTS runs_created_at_id_idx
+    ON stackbone_platform.runs (created_at DESC, id DESC);
+
+CREATE TABLE IF NOT EXISTS stackbone_platform.run_steps (
+    id              uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+    run_id          uuid        NOT NULL
+                                REFERENCES stackbone_platform.runs(id) ON DELETE CASCADE,
+    parent_step_id  uuid        REFERENCES stackbone_platform.run_steps(id) ON DELETE CASCADE,
+    type            text        NOT NULL
+                                CHECK (type IN (
+                                    'agent', 'llm_call', 'db_query', 'http_fetch',
+                                    'queue_publish', 'hitl_pause', 'tool_call',
+                                    'rag_query', 'storage_op'
+                                )),
+    name            text,
+    status          text        NOT NULL DEFAULT 'running'
+                                CHECK (status IN ('ok', 'error', 'running')),
+    payload         jsonb,
+    error           jsonb,
+    started_at      timestamptz NOT NULL DEFAULT now(),
+    finished_at     timestamptz,
+    duration_ms     integer
+);
+
+CREATE INDEX IF NOT EXISTS run_steps_run_started_idx
+    ON stackbone_platform.run_steps (run_id, started_at);
+CREATE INDEX IF NOT EXISTS run_steps_parent_idx
+    ON stackbone_platform.run_steps (parent_step_id);
+
+-- AFTER INSERT/UPDATE triggers fan-out into pg_notify('stackbone_platform_events',
+-- ...). The `apps/api` SSE handler (D4) and the local emulator's bus (V2/V3)
+-- LISTEN on this channel and forward each frame as the SSE payload defined in
+-- the protocol spec §10.2.
+CREATE OR REPLACE FUNCTION stackbone_platform.notify_run_event() RETURNS trigger
+LANGUAGE plpgsql AS $fn$
+DECLARE
+    payload jsonb;
+BEGIN
+    IF TG_OP = 'INSERT' THEN
+        payload := jsonb_build_object(
+            'type', 'run.created',
+            'run_id', NEW.id,
+            'trigger', NEW.trigger,
+            'created_at', NEW.created_at
+        );
+    ELSIF TG_OP = 'UPDATE' THEN
+        IF (OLD.started_at IS NULL) AND (NEW.started_at IS NOT NULL) THEN
+            payload := jsonb_build_object(
+                'type', 'run.started',
+                'run_id', NEW.id,
+                'started_at', NEW.started_at
+            );
+        ELSIF (OLD.finished_at IS NULL) AND (NEW.finished_at IS NOT NULL) THEN
+            payload := jsonb_build_object(
+                'type', 'run.finished',
+                'run_id', NEW.id,
+                'status', NEW.status,
+                'finished_at', NEW.finished_at,
+                'duration_ms', NEW.duration_ms
+            );
+        ELSE
+            RETURN NULL;
+        END IF;
+    ELSE
+        RETURN NULL;
+    END IF;
+
+    PERFORM pg_notify('stackbone_platform_events', payload::text);
+    RETURN NULL;
+END;
+$fn$;
+
+DROP TRIGGER IF EXISTS runs_notify_aiu ON stackbone_platform.runs;
+CREATE TRIGGER runs_notify_aiu
+AFTER INSERT OR UPDATE ON stackbone_platform.runs
+FOR EACH ROW EXECUTE FUNCTION stackbone_platform.notify_run_event();
+
+CREATE OR REPLACE FUNCTION stackbone_platform.notify_run_step_event() RETURNS trigger
+LANGUAGE plpgsql AS $fn$
+DECLARE
+    payload jsonb;
+BEGIN
+    IF TG_OP = 'INSERT' THEN
+        payload := jsonb_build_object(
+            'type', 'run.step.created',
+            'run_id', NEW.run_id,
+            'step_id', NEW.id,
+            'parent_step_id', NEW.parent_step_id,
+            'step_type', NEW.type,
+            'started_at', NEW.started_at
+        );
+    ELSIF TG_OP = 'UPDATE' THEN
+        IF (OLD.finished_at IS NULL) AND (NEW.finished_at IS NOT NULL) THEN
+            payload := jsonb_build_object(
+                'type', 'run.step.finished',
+                'run_id', NEW.run_id,
+                'step_id', NEW.id,
+                'status', NEW.status,
+                'duration_ms', NEW.duration_ms
+            );
+        ELSE
+            RETURN NULL;
+        END IF;
+    ELSE
+        RETURN NULL;
+    END IF;
+
+    PERFORM pg_notify('stackbone_platform_events', payload::text);
+    RETURN NULL;
+END;
+$fn$;
+
+DROP TRIGGER IF EXISTS run_steps_notify_aiu ON stackbone_platform.run_steps;
+CREATE TRIGGER run_steps_notify_aiu
+AFTER INSERT OR UPDATE ON stackbone_platform.run_steps
+FOR EACH ROW EXECUTE FUNCTION stackbone_platform.notify_run_step_event();

package/migrations/0002_approvals.sql

@@ -0,0 +1,110 @@
+-- 0002_approvals.sql — HITL approvals queue and audit trail.
+-- Spec: docs/arquitectura/specs/stackbone-agent-protocol-v1.md §6.6/§6.7.
+-- Component: docs/arquitectura/componentes/08-hitl-inbox.md.
+-- ADR:  docs/arquitectura/decisiones/2026-05-03-stackbone-studio-datapath-y-scope-mvp.md §D2.
+
+CREATE TABLE IF NOT EXISTS stackbone_platform.approvals (
+    id                      uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+    -- Nullable in local (single-agent emulator), required in cloud.
+    agent_id                text,
+    workspace_id            text,
+    topic                   text        NOT NULL,
+    status                  text        NOT NULL DEFAULT 'pending'
+                                        CHECK (status IN (
+                                            'pending', 'approved', 'rejected',
+                                            'timed_out', 'cancelled'
+                                        )),
+    payload                 jsonb       NOT NULL DEFAULT '{}'::jsonb,
+    schema                  jsonb,
+    run_id                  uuid        REFERENCES stackbone_platform.runs(id) ON DELETE SET NULL,
+    requested_by_step_id    uuid        REFERENCES stackbone_platform.run_steps(id) ON DELETE SET NULL,
+    callback_url            text,
+    idempotency_key         text,
+    fallback                text        CHECK (fallback IS NULL OR fallback IN (
+                                            'approve', 'reject', 'timeout'
+                                        )),
+    metadata                jsonb       NOT NULL DEFAULT '{}'::jsonb,
+    created_at              timestamptz NOT NULL DEFAULT now(),
+    timeout_at              timestamptz,
+    decided_at              timestamptz
+);
+
+-- Idempotency: same (workspace, topic, idempotency_key) tuple cannot create
+-- two approvals. Partial index keeps a NULL idempotency_key from blocking
+-- everything; the 99% of HITL pauses that don't carry a key still work.
+CREATE UNIQUE INDEX IF NOT EXISTS approvals_idempotency_uq
+    ON stackbone_platform.approvals (workspace_id, topic, idempotency_key)
+    WHERE idempotency_key IS NOT NULL;
+
+CREATE INDEX IF NOT EXISTS approvals_workspace_status_idx
+    ON stackbone_platform.approvals (workspace_id, status, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS approvals_run_idx
+    ON stackbone_platform.approvals (run_id);
+
+CREATE INDEX IF NOT EXISTS approvals_pending_timeout_idx
+    ON stackbone_platform.approvals (timeout_at)
+    WHERE status = 'pending' AND timeout_at IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS stackbone_platform.approval_decisions (
+    id              uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+    approval_id     uuid        NOT NULL
+                                REFERENCES stackbone_platform.approvals(id) ON DELETE CASCADE,
+    actor_user_id   text,
+    actor_email     text,
+    decision        text        NOT NULL CHECK (decision IN ('approve', 'reject')),
+    edited_payload  jsonb,
+    comment         text,
+    decided_at      timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS approval_decisions_approval_idx
+    ON stackbone_platform.approval_decisions (approval_id, decided_at);
+
+-- Triggers fire on the same `stackbone_platform_events` channel as the runs
+-- triggers, so the SSE handler in `apps/api` only LISTENs once.
+CREATE OR REPLACE FUNCTION stackbone_platform.notify_approval_event() RETURNS trigger
+LANGUAGE plpgsql AS $fn$
+DECLARE
+    payload jsonb;
+BEGIN
+    IF TG_OP = 'INSERT' THEN
+        payload := jsonb_build_object(
+            'type', 'approval.created',
+            'approval_id', NEW.id,
+            'run_id', NEW.run_id,
+            'topic', NEW.topic,
+            'created_at', NEW.created_at,
+            'timeout_at', NEW.timeout_at
+        );
+    ELSIF TG_OP = 'UPDATE' THEN
+        IF (OLD.decided_at IS NULL) AND (NEW.decided_at IS NOT NULL)
+           AND NEW.status IN ('approved', 'rejected') THEN
+            payload := jsonb_build_object(
+                'type', 'approval.decided',
+                'approval_id', NEW.id,
+                'status', NEW.status,
+                'decided_at', NEW.decided_at
+            );
+        ELSIF (OLD.status = 'pending') AND (NEW.status = 'timed_out') THEN
+            payload := jsonb_build_object(
+                'type', 'approval.timed_out',
+                'approval_id', NEW.id,
+                'fallback', NEW.fallback
+            );
+        ELSE
+            RETURN NULL;
+        END IF;
+    ELSE
+        RETURN NULL;
+    END IF;
+
+    PERFORM pg_notify('stackbone_platform_events', payload::text);
+    RETURN NULL;
+END;
+$fn$;
+
+DROP TRIGGER IF EXISTS approvals_notify_aiu ON stackbone_platform.approvals;
+CREATE TRIGGER approvals_notify_aiu
+AFTER INSERT OR UPDATE ON stackbone_platform.approvals
+FOR EACH ROW EXECUTE FUNCTION stackbone_platform.notify_approval_event();

package/migrations/0003_runs_is_playground_index.sql

@@ -0,0 +1,15 @@
+-- 0003_runs_is_playground_index.sql — billing-friendly partial index over runs.
+-- Spec: docs/tasks/Studio V5 - Playground e Invoke.md (V5#01).
+-- ADR:  docs/arquitectura/decisiones/2026-05-03-stackbone-studio-datapath-y-scope-mvp.md §D5/D9.
+--
+-- The `is_playground` column itself already lives in 0001_runs.sql (F2 baked it
+-- in defensively so playground writes had a place to land before V5 shipped).
+-- This migration adds the partial index that the billing pipeline and the
+-- workspace-level aggregations (V1+ Workspace Health, LLM Usage) need to scan
+-- only the runs that count toward billing — i.e. `is_playground = false`.
+-- Keeping it partial keeps the index small even when a workspace stress-tests
+-- the agent from the Playground.
+
+CREATE INDEX IF NOT EXISTS runs_billable_workspace_started_idx
+    ON stackbone_platform.runs (workspace_id, started_at DESC NULLS LAST)
+    WHERE is_playground = false;

package/migrations/0004_playground_fixtures.sql

@@ -0,0 +1,40 @@
+-- 0004_playground_fixtures.sql — saved Playground inputs for V5 (Studio).
+-- Spec: docs/arquitectura/specs/stackbone-agent-protocol-v1.md §6.10.
+-- Task: docs/tasks/Studio V5 - Playground e Invoke.md (V5#03).
+--
+-- The table holds JSON inputs the creator pinned for repeated invocations
+-- from the Studio Playground. Cloud-only — local fixtures live in
+-- `~/.stackbone/dev/fixtures/<agentId>.jsonl` for filesystem parity with the
+-- rest of the local datapath. Workspace-shared fixtures and version history
+-- land in V1+ (today MVP only stores the owner's saved inputs).
+--
+-- The `(agent_id, name)` unique constraint backs the `409 fixture_name_conflict`
+-- response defined in the protocol spec — the partial index keeps the
+-- agentless rows (single-agent local emulator parity) from blocking each
+-- other on `name`.
+
+CREATE TABLE IF NOT EXISTS stackbone_platform.playground_fixtures (
+    id              uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+    -- Nullable in local (single-agent emulator). In cloud the saga sets it
+    -- to the install's agent_id so different agents in the same workspace
+    -- can reuse fixture names.
+    agent_id        text,
+    name            text        NOT NULL,
+    input_json      jsonb       NOT NULL,
+    description     text,
+    -- The owner's better-auth user id at save time. Kept text to match the
+    -- existing `workspaces.owner_user_id` column type.
+    created_by      text,
+    created_at      timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS playground_fixtures_agent_name_uq
+    ON stackbone_platform.playground_fixtures (agent_id, name)
+    WHERE agent_id IS NOT NULL;
+
+CREATE UNIQUE INDEX IF NOT EXISTS playground_fixtures_name_uq
+    ON stackbone_platform.playground_fixtures (name)
+    WHERE agent_id IS NULL;
+
+CREATE INDEX IF NOT EXISTS playground_fixtures_created_at_idx
+    ON stackbone_platform.playground_fixtures (created_at DESC, id DESC);

package/migrations/0005_stackbone_viewer.sql

@@ -0,0 +1,47 @@
+-- 0005_stackbone_viewer.sql — read-only role for the Studio DB Explorer.
+-- Spec: docs/arquitectura/componentes/11-stackbone-studio.md §"DB Explorer".
+-- Task: docs/tasks/Studio V6 - DB Explorer read-only.md (V6#01).
+-- ADR:  docs/arquitectura/decisiones/2026-05-03-stackbone-studio-datapath-y-scope-mvp.md §D6.
+--
+-- The role is `NOLOGIN` because callers (apps/api, apps/cli emulator) reach it
+-- via `SET ROLE stackbone_viewer` on a session opened with the regular owner
+-- credentials, not by logging in as `stackbone_viewer` directly. This keeps the
+-- Neon HTTP driver one-shot model (D3) untouched: the connection string still
+-- belongs to the owner, the privilege drop happens per-statement.
+--
+-- DEFAULT PRIVILEGES are scoped to the current migration runner (`current_user`)
+-- so any table the runner creates afterwards in `public`, `stackbone_platform`,
+-- and the future `pgmq` / `rag_*` schemas auto-grants SELECT to the viewer
+-- without re-issuing GRANTs from a follow-up migration.
+
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'stackbone_viewer') THEN
+        CREATE ROLE stackbone_viewer NOLOGIN;
+    END IF;
+END
+$$;
+
+-- Existing schemas at the time this migration runs.
+GRANT USAGE ON SCHEMA public           TO stackbone_viewer;
+GRANT USAGE ON SCHEMA stackbone_platform  TO stackbone_viewer;
+
+GRANT SELECT ON ALL TABLES    IN SCHEMA public          TO stackbone_viewer;
+GRANT SELECT ON ALL TABLES    IN SCHEMA stackbone_platform TO stackbone_viewer;
+GRANT SELECT ON ALL SEQUENCES IN SCHEMA public          TO stackbone_viewer;
+GRANT SELECT ON ALL SEQUENCES IN SCHEMA stackbone_platform TO stackbone_viewer;
+
+-- Default privileges so any *future* table created by the migration runner in
+-- these schemas auto-grants SELECT to `stackbone_viewer`. The Studio sidebar
+-- promises visibility into `pgmq.*`, `_storage_objects`, `rag_*` and the
+-- creator's own schemas — without these defaults, every new table created by
+-- a downstream migration (or by the agent itself via Drizzle) would silently
+-- be invisible to the DB Explorer.
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+    GRANT SELECT ON TABLES    TO stackbone_viewer;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
+    GRANT SELECT ON SEQUENCES TO stackbone_viewer;
+ALTER DEFAULT PRIVILEGES IN SCHEMA stackbone_platform
+    GRANT SELECT ON TABLES    TO stackbone_viewer;
+ALTER DEFAULT PRIVILEGES IN SCHEMA stackbone_platform
+    GRANT SELECT ON SEQUENCES TO stackbone_viewer;

package/migrations/0006_secrets.sql

@@ -0,0 +1,37 @@
+-- 0006_secrets.sql — local mirror of `installation_secret` for the
+-- `stackbone dev` emulator (Studio V10).
+-- Spec: docs/arquitectura/componentes/11-stackbone-studio.md §"Secrets".
+-- Task: docs/tasks/Studio V10 - Secrets.md (V10#02).
+-- ADR:  docs/arquitectura/decisiones/2026-05-03-stackbone-studio-datapath-y-scope-mvp.md
+--       (decision V10#01 in the task itself: cloud secrets stay in
+--       `installation_secret` of the control plane; local emulator stores
+--       the same wire shape here so the Studio UI sees identical data.)
+--
+-- The emulator runs without a control plane. To keep the Studio Secrets
+-- screen wire-compatible (one shape from `@stackbone/validators`) we mirror
+-- the cloud table inside `stackbone_platform.secrets`. Encryption uses the
+-- documented `dev-only-encryption-key` (see STUDIO_LOCAL_DEV_ENCRYPTION_KEY
+-- in libs/validators) and never leaves the developer machine.
+--
+-- `is_system` carries the same semantics as in cloud — the saga injects
+-- nothing here so the column stays at its default `false`, but we keep it
+-- for parity in case future system-level injectors land in the emulator.
+
+CREATE TABLE IF NOT EXISTS stackbone_platform.secrets (
+    id              uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+    name            text        NOT NULL,
+    version         text        NOT NULL DEFAULT 'v1' CHECK (version IN ('v1')),
+    nonce           bytea       NOT NULL,
+    ciphertext      bytea       NOT NULL,
+    is_system       boolean     NOT NULL DEFAULT false,
+    description     text,
+    -- created_by_email is a free-text field in local: there is no `user`
+    -- table in the emulator's Postgres. The cloud surface backfills the
+    -- equivalent via better-auth user lookup.
+    created_by_email text,
+    created_at      timestamptz NOT NULL DEFAULT now(),
+    updated_at      timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS secrets_name_idx
+    ON stackbone_platform.secrets (name);

package/migrations/0007_agent_config_versions.sql

@@ -0,0 +1,57 @@
+-- 0007_agent_config_versions.sql — versioned history of `AGENT_CONFIG`
+-- payloads for Studio's Config dinámica screen (V11).
+-- Spec: docs/arquitectura/componentes/11-stackbone-studio.md §"Mapa de pantallas / C.Config dinámica".
+-- Task: docs/tasks/Studio V11 - Config dinámica.md (V11#01).
+-- ADR:  docs/arquitectura/decisiones/2026-05-03-stackbone-studio-datapath-y-scope-mvp.md §D2/D7.
+--
+-- The current config is the row with the highest `version`. Older rows are
+-- kept for the rollback action and the lateral history list. Hot-reload is
+-- driven off `pg_notify('stackbone_platform_events', …)` from an INSERT trigger
+-- — the local emulator orchestrator (V11#04) and `apps/api` SSE handlers
+-- LISTEN on the same channel as the rest of the platform events.
+--
+-- `created_by_email` carries free text on the local emulator (no `user`
+-- table inside the agent's Postgres) and the cloud control plane backfills
+-- it via better-auth lookup. This mirrors `stackbone_platform.secrets` so the
+-- audit shape stays uniform across vault screens.
+
+CREATE TABLE IF NOT EXISTS stackbone_platform.agent_config_versions (
+    id                  uuid        PRIMARY KEY DEFAULT gen_random_uuid(),
+    -- Monotonically increasing per install. The application layer assigns
+    -- `MAX(version) + 1` inside the same transaction as the INSERT so the
+    -- column doubles as a stable cursor for the lateral history list.
+    version             integer     NOT NULL CHECK (version >= 1),
+    value               jsonb       NOT NULL,
+    -- When a row originates from a rollback we record the source version
+    -- so the UI can render "rolled back from v7" without joining twice.
+    rolled_back_from    integer,
+    created_by_email    text,
+    created_at          timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS agent_config_versions_version_idx
+    ON stackbone_platform.agent_config_versions (version);
+
+CREATE INDEX IF NOT EXISTS agent_config_versions_created_at_idx
+    ON stackbone_platform.agent_config_versions (created_at DESC, version DESC);
+
+CREATE OR REPLACE FUNCTION stackbone_platform.notify_agent_config_event() RETURNS trigger
+LANGUAGE plpgsql AS $fn$
+DECLARE
+    payload jsonb;
+BEGIN
+    payload := jsonb_build_object(
+        'type', 'agent_config.changed',
+        'version', NEW.version,
+        'rolled_back_from', NEW.rolled_back_from,
+        'created_at', NEW.created_at
+    );
+    PERFORM pg_notify('stackbone_platform_events', payload::text);
+    RETURN NULL;
+END;
+$fn$;
+
+DROP TRIGGER IF EXISTS agent_config_versions_notify_aiu ON stackbone_platform.agent_config_versions;
+CREATE TRIGGER agent_config_versions_notify_aiu
+AFTER INSERT ON stackbone_platform.agent_config_versions
+FOR EACH ROW EXECUTE FUNCTION stackbone_platform.notify_agent_config_event();

package/migrations/0008_approvals_idempotency_nulls_not_distinct.sql

@@ -0,0 +1,19 @@
+-- 0008_approvals_idempotency_nulls_not_distinct.sql — fix the partial unique
+-- index on `approvals` so the `ON CONFLICT (workspace_id, topic,
+-- idempotency_key)` upsert in `apps/cli` reuses an existing row when
+-- `workspace_id IS NULL` (the local emulator never populates it).
+--
+-- Postgres treats NULL as distinct in unique indexes by default, so two
+-- inserts with the same (NULL, topic, idempotencyKey) tuple were both
+-- accepted instead of round-tripping the original approvalId. `NULLS NOT
+-- DISTINCT` (Postgres 15+) collapses NULLs into a single comparable value,
+-- which preserves the cloud semantics (workspace_id NOT NULL) and unblocks
+-- the local emulator path.
+--
+-- Spec: docs/arquitectura/specs/stackbone-agent-protocol-v1.md §6.6.
+
+DROP INDEX IF EXISTS stackbone_platform.approvals_idempotency_uq;
+
+CREATE UNIQUE INDEX IF NOT EXISTS approvals_idempotency_uq
+    ON stackbone_platform.approvals (workspace_id, topic, idempotency_key) NULLS NOT DISTINCT
+    WHERE idempotency_key IS NOT NULL;

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@stackbone/cli",
+  "version": "0.1.0-alpha.0",
+  "license": "UNLICENSED",
+  "type": "module",
+  "bin": {
+    "stackbone": "./main.js"
+  },
+  "engines": {
+    "node": ">=20.18.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.1038.0",
+    "@aws-sdk/s3-request-presigner": "^3.1038.0",
+    "@clack/prompts": "^1.2.0",
+    "@hono/node-server": "^2.0.0",
+    "ajv": "^8.20.0",
+    "citty": "^0.2.2",
+    "drizzle-kit": "^0.31.10",
+    "drizzle-orm": "^0.45.2",
+    "hono": "^4.12.15",
+    "open": "^11.0.0",
+    "pg": "^8.20.0",
+    "pg-query-emscripten": "^5.1.0",
+    "pino": "^10.3.1",
+    "pino-pretty": "^13.1.3",
+    "postgres": "^3.4.9",
+    "yaml": "^2.8.3",
+    "zod": "^4.3.6"
+  }
+}